zenith-net 0.1.0

//! 来源准入引擎
//!
//! O(1) 规则匹配的准入控制：
//! - 支持源 IP 白名单/黑名单
//! - 支持源端口/目标端口规则
//! - 支持协议类型过滤（TCP/UDP/ICMP）
//! - 预分配固定容量，热路径零堆分配
//! - 单 Owner 设计，无锁

use crate::error::{NetError, Result};

/// 准入动作
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AdmissionAction {
    /// 允许通过
    Allow,
    /// 拒绝
    Deny,
}

/// IP 地址类型
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum IpAddr {
    /// IPv4 地址（4 字节）
    V4([u8; 4]),
    /// IPv6 地址（16 字节）
    V6([u8; 16]),
    /// 跨族通配（NET-019：匹配任意地址族）
    Any,
}

impl IpAddr {
    /// IPv4 通配（仅匹配 IPv4）
    pub const V4_WILDCARD: Self = Self::V4([0, 0, 0, 0]);
    /// IPv6 通配（仅匹配 IPv6）
    pub const V6_WILDCARD: Self = Self::V6([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
    /// 跨族通配（NET-019：同时匹配 IPv4 与 IPv6）
    pub const ANY: Self = Self::Any;

    /// 是否为 IPv4
    #[inline]
    pub fn is_v4(&self) -> bool {
        matches!(self, Self::V4(_))
    }

    /// 是否为 IPv6
    #[inline]
    pub fn is_v6(&self) -> bool {
        matches!(self, Self::V6(_))
    }

    /// 获取 IPv4 字节
    #[inline]
    pub fn as_v4(&self) -> Option<[u8; 4]> {
        match self {
            Self::V4(bytes) => Some(*bytes),
            Self::V6(_) | Self::Any => None,
        }
    }

    /// 获取 IPv6 字节
    #[inline]
    pub fn as_v6(&self) -> Option<[u8; 16]> {
        match self {
            Self::V6(bytes) => Some(*bytes),
            Self::V4(_) | Self::Any => None,
        }
    }

    /// 判断是否为通配地址
    #[inline]
    pub fn is_wildcard(&self) -> bool {
        match self {
            Self::V4(b) => *b == [0, 0, 0, 0],
            Self::V6(b) => *b == [0u8; 16],
            Self::Any => true,
        }
    }
}

/// 协议匹配条件
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ProtoMatch {
    /// 匹配 TCP
    Tcp,
    /// 匹配 UDP
    Udp,
    /// 匹配 ICMP
    Icmp,
    /// 匹配所有协议
    Any,
}

impl ProtoMatch {
    /// 是否匹配给定协议号
    #[inline]
    pub fn matches(&self, proto: u8) -> bool {
        match self {
            Self::Tcp => proto == 6,
            Self::Udp => proto == 17,
            Self::Icmp => proto == 1 || proto == 58,
            Self::Any => true,
        }
    }
}

/// 准入规则
///
/// 单条规则定义一组匹配条件和对应动作。
/// 所有字段均为 Copy 类型，无堆分配。
#[derive(Debug, Clone, Copy)]
pub struct AdmissionRule {
    /// 规则 ID
    pub id: u32,
    /// 源 IP（通配表示匹配所有）
    pub src_ip: IpAddr,
    /// CIDR 前缀长度（NET-018：0 = 精确匹配/全掩码；1..=32(V4)/1..=128(V6) = 前缀匹配）
    pub prefix_len: u8,
    /// 源端口（0 表示匹配所有）
    pub src_port: u16,
    /// 目标端口（0 表示匹配所有）
    pub dst_port: u16,
    /// 协议匹配
    pub proto: ProtoMatch,
    /// 准入动作
    pub action: AdmissionAction,
    /// 是否启用
    pub enabled: bool,
}

/// NET-018：判断 `src_ip` 是否匹配规则 IP（含 CIDR 前缀与跨族通配）。
///
/// 语义：
/// - 规则为 [`IpAddr::Any`] → 任意地址族均匹配（NET-019）。
/// - 规则为族内通配（全 0）→ 匹配该族任意地址（向后兼容）。
/// - `prefix_len == 0` → 精确匹配（向后兼容，全掩码）。
/// - 1..=max 前缀 → 仅比较前 `prefix_len` 位（CIDR/子网）。
#[inline]
fn ip_subnet_matches(rule_ip: IpAddr, prefix_len: u8, src_ip: IpAddr) -> bool {
    match rule_ip {
        IpAddr::Any => true,
        IpAddr::V4(rb) => match src_ip {
            IpAddr::V4(sb) => {
                if rb == [0, 0, 0, 0] {
                    return true;
                }
                let plen = prefix_len.min(32) as u32;
                if plen == 0 {
                    return rb == sb;
                }
                let r = u32::from_be_bytes(rb);
                let s = u32::from_be_bytes(sb);
                r >> (32 - plen) == s >> (32 - plen)
            }
            IpAddr::V6(_) | IpAddr::Any => false,
        },
        IpAddr::V6(rb) => match src_ip {
            IpAddr::V6(sb) => {
                if rb == [0u8; 16] {
                    return true;
                }
                let plen = prefix_len.min(128) as u32;
                if plen == 0 {
                    return rb == sb;
                }
                let r = u128::from_be_bytes(rb);
                let s = u128::from_be_bytes(sb);
                r >> (128 - plen) == s >> (128 - plen)
            }
            IpAddr::V4(_) | IpAddr::Any => false,
        },
    }
}

impl AdmissionRule {
    /// 创建默认规则（允许所有，作为默认规则）
    #[inline]
    pub const fn default_allow(id: u32) -> Self {
        Self {
            id,
            src_ip: IpAddr::V4_WILDCARD,
            prefix_len: 0,
            src_port: 0,
            dst_port: 0,
            proto: ProtoMatch::Any,
            action: AdmissionAction::Allow,
            enabled: true,
        }
    }

    /// 创建默认拒绝规则
    #[inline]
    pub const fn default_deny(id: u32) -> Self {
        Self {
            id,
            src_ip: IpAddr::V4_WILDCARD,
            prefix_len: 0,
            src_port: 0,
            dst_port: 0,
            proto: ProtoMatch::Any,
            action: AdmissionAction::Deny,
            enabled: true,
        }
    }

    /// 检查数据包是否匹配此规则
    #[inline]
    pub fn matches(
        &self,
        src_ip: IpAddr,
        src_port: u16,
        dst_port: u16,
        proto: u8,
    ) -> bool {
        if !self.enabled {
            return false;
        }

        // 协议匹配
        if !self.proto.matches(proto) {
            return false;
        }

        // 源 IP 匹配（含 CIDR 前缀与跨族通配，NET-018/019）
        if !ip_subnet_matches(self.src_ip, self.prefix_len, src_ip) {
            return false;
        }

        // 源端口匹配（0 表示通配）
        if self.src_port != 0 && self.src_port != src_port {
            return false;
        }

        // 目标端口匹配（0 表示通配）
        if self.dst_port != 0 && self.dst_port != dst_port {
            return false;
        }

        true
    }
}

/// 最大规则数量（预分配容量）
const MAX_RULES: usize = 64;

/// 来源准入引擎
///
/// 单 Owner 设计，预分配固定容量。
/// 规则按优先级存储，匹配时线性扫描（固定上限 64 条规则）。
///
/// # 性能
/// - 热路径 O(N) where N <= 64 固定
/// - 所有规则预分配在栈上/连续内存
/// - 无堆分配、无锁
#[derive(Debug)]
pub struct SourceAdmissionEngine {
    /// 规则存储（连续内存，缓存友好）
    rules: [AdmissionRule; MAX_RULES],
    /// 已使用规则数
    rule_count: usize,
    /// 默认动作（无规则匹配时的行为）
    default_action: AdmissionAction,
}

impl SourceAdmissionEngine {
    /// 创建新的准入引擎
    ///
    /// # 参数
    /// * `default_action` - 无规则匹配时的默认动作
    pub fn new(default_action: AdmissionAction) -> Self {
        Self {
            rules: [AdmissionRule::default_allow(0); MAX_RULES],
            rule_count: 0,
            default_action,
        }
    }

    /// 添加规则
    ///
    /// 规则按添加顺序存储，匹配时按顺序检查。
    /// 先匹配先生效。
    ///
    /// # 参数
    /// * `rule` - 要添加的规则
    ///
    /// # 返回
    /// * `Ok(())` - 添加成功
    /// * `Err(NetError)` - 规则数量已满
    pub fn add_rule(&mut self, rule: AdmissionRule) -> Result<()> {
        if self.rule_count >= MAX_RULES {
            return Err(NetError::Internal("admission rule table full"));
        }
        self.rules[self.rule_count] = rule;
        self.rule_count += 1;
        Ok(())
    }

    /// 批量添加规则
    ///
    /// # 参数
    /// * `rules` - 规则数组
    ///
    /// # 返回
    /// * `Ok(())` - 批量添加成功
    /// * `Err(NetError)` - 超出容量
    ///
    /// # 安全
    /// 使用 checked_add 防止加法溢出（AGENT.md §5.1 铁律）。
    pub fn add_rules(&mut self, rules: &[AdmissionRule]) -> Result<()> {
        let new_count = self
            .rule_count
            .checked_add(rules.len())
            .ok_or(NetError::Internal("admission rule count overflow"))?;
        if new_count > MAX_RULES {
            return Err(NetError::Internal("admission rule table overflow"));
        }
        for rule in rules {
            self.rules[self.rule_count] = *rule;
            self.rule_count += 1;
        }
        Ok(())
    }

    /// 移除指定 ID 的规则
    ///
    /// # 参数
    /// * `rule_id` - 要移除的规则 ID
    ///
    /// # 返回
    /// * `Ok(())` - 移除成功
    /// * `Err(NetError)` - 规则未找到
    pub fn remove_rule(&mut self, rule_id: u32) -> Result<()> {
        for i in 0..self.rule_count {
            if self.rules[i].id == rule_id {
                // 将后面的规则前移
                self.rules[i..self.rule_count].rotate_left(1);
                self.rule_count -= 1;
                return Ok(());
            }
        }
        Err(NetError::Internal("rule not found"))
    }

    /// 评估数据包是否被允许通过
    ///
    /// 按规则顺序匹配，先匹配先生效。
    /// 无匹配时返回默认动作。
    ///
    /// # 参数
    /// * `src_ip` - 源 IP
    /// * `src_port` - 源端口（0 表示未知）
    /// * `dst_port` - 目标端口（0 表示未知）
    /// * `proto` - IP 协议号
    ///
    /// # 返回
    /// * `AdmissionAction` - 准入决定
    #[inline]
    pub fn evaluate(
        &self,
        src_ip: IpAddr,
        src_port: u16,
        dst_port: u16,
        proto: u8,
    ) -> AdmissionAction {
        for i in 0..self.rule_count {
            let rule = &self.rules[i];
            if rule.matches(src_ip, src_port, dst_port, proto) {
                return rule.action;
            }
        }
        self.default_action
    }

    /// 获取规则数量
    #[inline]
    pub fn rule_count(&self) -> usize {
        self.rule_count
    }

    /// 获取最大规则容量
    #[inline]
    pub fn max_rules(&self) -> usize {
        MAX_RULES
    }

    /// 获取默认动作
    #[inline]
    pub fn default_action(&self) -> AdmissionAction {
        self.default_action
    }

    /// 清空所有规则
    pub fn clear(&mut self) {
        self.rule_count = 0;
    }

    /// 预定义：允许所有流量
    pub fn allow_all() -> Self {
        Self::new(AdmissionAction::Allow)
    }

    /// 预定义：拒绝所有流量（默认拒绝，需显式添加允许规则）
    pub fn deny_all() -> Self {
        Self::new(AdmissionAction::Deny)
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_allow_all() {
        let engine = SourceAdmissionEngine::allow_all();
        let action = engine.evaluate(
            IpAddr::V4([192, 168, 1, 1]),
            8080,
            443,
            6,
        );
        assert_eq!(action, AdmissionAction::Allow);
    }

    #[test]
    fn test_deny_all() {
        let engine = SourceAdmissionEngine::deny_all();
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            0,
            17,
        );
        assert_eq!(action, AdmissionAction::Deny);
    }

    #[test]
    fn test_ip_whitelist() {
        let mut engine = SourceAdmissionEngine::deny_all();

        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4([192, 168, 1, 100]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        // 白名单 IP 应该被允许
        let action = engine.evaluate(
            IpAddr::V4([192, 168, 1, 100]),
            0,
            0,
            6,
        );
        assert_eq!(action, AdmissionAction::Allow);

        // 非白名单 IP 应该被拒绝
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            0,
            6,
        );
        assert_eq!(action, AdmissionAction::Deny);
    }

    #[test]
    fn test_port_rule() {
        let mut engine = SourceAdmissionEngine::deny_all();

        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4_WILDCARD,
                prefix_len: 0,
                src_port: 0,
                dst_port: 8080,
                proto: ProtoMatch::Tcp,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        // TCP 8080 应该被允许
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            8080,
            6,
        );
        assert_eq!(action, AdmissionAction::Allow);

        // UDP 8080 应该被拒绝（协议不匹配）
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            8080,
            17,
        );
        assert_eq!(action, AdmissionAction::Deny);

        // TCP 其他端口应该被拒绝
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            443,
            6,
        );
        assert_eq!(action, AdmissionAction::Deny);
    }

    #[test]
    fn test_rule_priority() {
        let mut engine = SourceAdmissionEngine::deny_all();

        // 先添加：允许所有
        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4_WILDCARD,
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        // 后添加：拒绝特定 IP
        engine
            .add_rule(AdmissionRule {
                id: 2,
                src_ip: IpAddr::V4([10, 0, 0, 1]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Deny,
                enabled: true,
            })
            .unwrap();

        // 先匹配先生效：规则 1 先被检查，所以允许所有
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            0,
            6,
        );
        assert_eq!(action, AdmissionAction::Allow);
    }

    #[test]
    fn test_remove_rule() {
        let mut engine = SourceAdmissionEngine::deny_all();

        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4([10, 0, 0, 1]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        assert_eq!(engine.rule_count(), 1);

        engine.remove_rule(1).unwrap();
        assert_eq!(engine.rule_count(), 0);

        // 移除后，该 IP 应该被拒绝
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            0,
            6,
        );
        assert_eq!(action, AdmissionAction::Deny);
    }

    #[test]
    fn test_max_rules() {
        let mut engine = SourceAdmissionEngine::new(AdmissionAction::Deny);

        for i in 0..MAX_RULES {
            engine
                .add_rule(AdmissionRule {
                    id: i as u32,
                    src_ip: IpAddr::V4([127, 0, 0, (i % 256) as u8]),
                    prefix_len: 0,
                    src_port: 0,
                    dst_port: 0,
                    proto: ProtoMatch::Any,
                    action: AdmissionAction::Allow,
                    enabled: true,
                })
                .unwrap();
        }

        // 第 65 条规则应该失败
        let result = engine.add_rule(AdmissionRule::default_allow(100));
        assert!(result.is_err());
    }

    #[test]
    fn test_add_rules_batch_overflow() {
        // 回归测试：add_rules 使用 checked_add 防止 usize 溢出
        let mut engine = SourceAdmissionEngine::new(AdmissionAction::Deny);
        // 构造一个超过容量的批量规则
        let rules: Vec<AdmissionRule> = (0..MAX_RULES + 1)
            .map(|i| AdmissionRule {
                id: i as u32,
                src_ip: IpAddr::V4([127, 0, 0, (i % 256) as u8]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .collect();
        let result = engine.add_rules(&rules);
        assert!(result.is_err(), "应拒绝超出容量的批量规则");
        assert_eq!(engine.rule_count(), 0, "失败后不应部分插入");
    }

    #[test]
    fn test_add_rules_batch_success() {
        let mut engine = SourceAdmissionEngine::new(AdmissionAction::Deny);
        let rules: Vec<AdmissionRule> = (0..10)
            .map(|i| AdmissionRule {
                id: i as u32,
                src_ip: IpAddr::V4([127, 0, 0, (i % 256) as u8]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .collect();
        assert!(engine.add_rules(&rules).is_ok());
        assert_eq!(engine.rule_count(), 10);
    }

    #[test]
    fn test_disabled_rule() {
        let mut engine = SourceAdmissionEngine::deny_all();

        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4([10, 0, 0, 1]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: false, // 禁用
            })
            .unwrap();

        // 禁用的规则不匹配
        let action = engine.evaluate(
            IpAddr::V4([10, 0, 0, 1]),
            0,
            0,
            6,
        );
        assert_eq!(action, AdmissionAction::Deny);
    }

    #[test]
    fn test_empty_ruleset_default_allow() {
        let engine = SourceAdmissionEngine::allow_all();
        assert_eq!(engine.rule_count(), 0);
        assert_eq!(
            engine.evaluate(IpAddr::V4([1, 2, 3, 4]), 1234, 80, 6),
            AdmissionAction::Allow
        );
    }

    #[test]
    fn test_empty_ruleset_default_deny() {
        let engine = SourceAdmissionEngine::deny_all();
        assert_eq!(engine.rule_count(), 0);
        assert_eq!(
            engine.evaluate(IpAddr::V4([1, 2, 3, 4]), 1234, 80, 6),
            AdmissionAction::Deny
        );
    }

    #[test]
    fn test_clear_rules() {
        let mut engine = SourceAdmissionEngine::deny_all();
        for i in 0..10 {
            engine
                .add_rule(AdmissionRule {
                    id: i,
                    src_ip: IpAddr::V4_WILDCARD,
                    prefix_len: 0,
                    src_port: 0,
                    dst_port: 0,
                    proto: ProtoMatch::Any,
                    action: AdmissionAction::Allow,
                    enabled: true,
                })
                .unwrap();
        }
        assert_eq!(engine.rule_count(), 10);
        engine.clear();
        assert_eq!(engine.rule_count(), 0);
        assert_eq!(
            engine.evaluate(IpAddr::V4([10, 0, 0, 1]), 0, 0, 6),
            AdmissionAction::Deny
        );
    }

    #[test]
    fn test_ipv6_addresses() {
        let mut engine = SourceAdmissionEngine::deny_all();
        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V6([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        // ::1 应该被允许
        assert_eq!(
            engine.evaluate(
                IpAddr::V6([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]),
                0,
                0,
                6
            ),
            AdmissionAction::Allow
        );

        // 其他 IPv6 应该被拒绝
        assert_eq!(
            engine.evaluate(
                IpAddr::V6([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2]),
                0,
                0,
                6
            ),
            AdmissionAction::Deny
        );
    }

    #[test]
    fn test_boundary_ipv4_addresses() {
        let mut engine = SourceAdmissionEngine::deny_all();

        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4([0, 0, 0, 0]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        engine
            .add_rule(AdmissionRule {
                id: 2,
                src_ip: IpAddr::V4([255, 255, 255, 255]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        assert_eq!(
            engine.evaluate(IpAddr::V4([0, 0, 0, 0]), 0, 0, 6),
            AdmissionAction::Allow
        );
        assert_eq!(
            engine.evaluate(IpAddr::V4([255, 255, 255, 255]), 0, 0, 6),
            AdmissionAction::Allow
        );
    }

    #[test]
    fn test_ip_addr_methods() {
        let v4 = IpAddr::V4([192, 168, 1, 1]);
        assert!(v4.is_v4());
        assert!(!v4.is_v6());
        assert_eq!(v4.as_v4(), Some([192, 168, 1, 1]));
        assert_eq!(v4.as_v6(), None);
        assert!(!v4.is_wildcard());

        let v4_wild = IpAddr::V4_WILDCARD;
        assert!(v4_wild.is_wildcard());

        let v6 = IpAddr::V6([0u8; 16]);
        assert!(v6.is_v6());
        assert!(!v6.is_v4());
        assert!(v6.is_wildcard());
        assert_eq!(v6.as_v6(), Some([0u8; 16]));
    }

    #[test]
    fn test_proto_match_variants() {
        assert!(ProtoMatch::Tcp.matches(6));
        assert!(!ProtoMatch::Tcp.matches(17));

        assert!(ProtoMatch::Udp.matches(17));
        assert!(!ProtoMatch::Udp.matches(6));

        assert!(ProtoMatch::Icmp.matches(1));
        assert!(ProtoMatch::Icmp.matches(58));
        assert!(!ProtoMatch::Icmp.matches(6));

        assert!(ProtoMatch::Any.matches(6));
        assert!(ProtoMatch::Any.matches(17));
        assert!(ProtoMatch::Any.matches(99));
    }

    #[test]
    fn test_port_boundaries() {
        let mut engine = SourceAdmissionEngine::deny_all();
        engine
            .add_rule(AdmissionRule {
                id: 1,
                src_ip: IpAddr::V4_WILDCARD,
                prefix_len: 0,
                src_port: 0,
                dst_port: 80,
                proto: ProtoMatch::Tcp,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .unwrap();

        // 精确匹配
        assert_eq!(
            engine.evaluate(IpAddr::V4([10, 0, 0, 1]), 12345, 80, 6),
            AdmissionAction::Allow
        );

        // 源端口 0（通配）
        assert_eq!(
            engine.evaluate(IpAddr::V4([10, 0, 0, 1]), 0, 80, 6),
            AdmissionAction::Allow
        );

        // 不匹配的目标端口
        assert_eq!(
            engine.evaluate(IpAddr::V4([10, 0, 0, 1]), 12345, 81, 6),
            AdmissionAction::Deny
        );
    }

    #[test]
    fn test_max_rules_boundary() {
        let mut engine = SourceAdmissionEngine::new(AdmissionAction::Deny);
        assert_eq!(engine.max_rules(), MAX_RULES);

        for i in 0..MAX_RULES {
            engine
                .add_rule(AdmissionRule {
                    id: i as u32,
                    src_ip: IpAddr::V4([127, 0, 0, (i % 256) as u8]),
                    prefix_len: 0,
                    src_port: 0,
                    dst_port: 0,
                    proto: ProtoMatch::Any,
                    action: AdmissionAction::Allow,
                    enabled: true,
                })
                .unwrap();
        }
        assert_eq!(engine.rule_count(), MAX_RULES);

        let result = engine.add_rule(AdmissionRule::default_allow(9999));
        assert!(result.is_err());
    }

    #[test]
    fn test_remove_nonexistent_rule() {
        let mut engine = SourceAdmissionEngine::allow_all();
        let result = engine.remove_rule(999);
        assert!(result.is_err());
    }

    #[test]
    fn test_add_rules_batch_partial_overflow() {
        let mut engine = SourceAdmissionEngine::new(AdmissionAction::Deny);
        let rules: Vec<AdmissionRule> = (0..MAX_RULES - 5)
            .map(|i| AdmissionRule {
                id: i as u32,
                src_ip: IpAddr::V4([127, 0, 0, (i % 256) as u8]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .collect();
        assert!(engine.add_rules(&rules).is_ok());
        assert_eq!(engine.rule_count(), MAX_RULES - 5);

        let extra: Vec<AdmissionRule> = (0..10)
            .map(|i| AdmissionRule {
                id: (MAX_RULES + i) as u32,
                src_ip: IpAddr::V4([10, 0, 0, i as u8]),
                prefix_len: 0,
                src_port: 0,
                dst_port: 0,
                proto: ProtoMatch::Any,
                action: AdmissionAction::Allow,
                enabled: true,
            })
            .collect();
        let result = engine.add_rules(&extra);
        assert!(result.is_err());
        assert_eq!(engine.rule_count(), MAX_RULES - 5);
    }

    #[test]
    fn test_cidr_subnet_matching() {
        // NET-018：CIDR/子网前缀匹配（prefix_len 掩码比较）
        let rule = AdmissionRule {
            id: 1,
            src_ip: IpAddr::V4([192, 168, 1, 0]),
            prefix_len: 24,
            src_port: 0,
            dst_port: 0,
            proto: ProtoMatch::Any,
            action: AdmissionAction::Allow,
            enabled: true,
        };
        // 同子网命中
        assert!(rule.matches(IpAddr::V4([192, 168, 1, 200]), 0, 0, 6));
        // 不同子网不命中
        assert!(!rule.matches(IpAddr::V4([192, 168, 2, 1]), 0, 0, 6));
        // CIDR 规则不跨族
        assert!(!rule.matches(
            IpAddr::V6([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]),
            0,
            0,
            6
        ));
        // prefix_len=0 = 精确匹配（向后兼容）
        let exact = AdmissionRule {
            id: 2,
            src_ip: IpAddr::V4([10, 0, 0, 1]),
            prefix_len: 0,
            src_port: 0,
            dst_port: 0,
            proto: ProtoMatch::Any,
            action: AdmissionAction::Allow,
            enabled: true,
        };
        assert!(exact.matches(IpAddr::V4([10, 0, 0, 1]), 0, 0, 6));
        assert!(!exact.matches(IpAddr::V4([10, 0, 0, 2]), 0, 0, 6));
    }

    #[test]
    fn test_cross_family_wildcard_any() {
        // NET-019：IpAddr::Any 跨族通配（IPv4 与 IPv6 均匹配）
        let rule = AdmissionRule {
            id: 1,
            src_ip: IpAddr::Any,
            prefix_len: 0,
            src_port: 0,
            dst_port: 0,
            proto: ProtoMatch::Any,
            action: AdmissionAction::Allow,
            enabled: true,
        };
        assert!(rule.matches(IpAddr::V4([1, 2, 3, 4]), 0, 0, 6));
        assert!(rule.matches(
            IpAddr::V6([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]),
            0,
            0,
            6
        ));
        // is_wildcard 亦视为通配
        assert!(IpAddr::Any.is_wildcard());
    }
}