//! Implement port-based policies

//!

//! These are also known as "short policies" or "policy summaries".

use std::fmt::Display;

use std::str::FromStr;

use std::sync::Arc;

use super::{PolicyError, PortRange};

use crate::util::intern::InternCache;

/// A policy to match zero or more TCP/UDP ports.

///

/// These are used in Tor to summarize all policies in

/// microdescriptors, and Ipv6 policies in router descriptors.

///

/// NOTE: If a port is listed as accepted, it doesn't mean that the

/// relay allows _every_ address on that port.  Instead, a port is

/// listed if a relay will exit to _most public addresses_ on that

/// port. Therefore, unlike [super::addrpolicy::AddrPolicy] objects,

/// these policies cannot tell you if a port is _definitely_ allowed

/// or rejected: only if it is _probably_ allowed or rejected.

///

/// # Examples

/// ```

/// use tor_netdoc::types::policy::PortPolicy;

/// let policy: PortPolicy = "accept 1-1023,8000-8999,60000-65535".parse().unwrap();

///

/// assert!(policy.allows_port(22));

/// assert!(policy.allows_port(8000));

/// assert!(! policy.allows_port(1024));

/// assert!(! policy.allows_port(9000));

/// ```

#[derive(Clone, Debug, PartialEq, Eq, Hash)]

pub struct PortPolicy {

    /// A list of port ranges that this policy allows.

    ///

    /// These ranges sorted, disjoint, and compact.

    allowed: Vec<PortRange>,

}

impl Display for PortPolicy {

        } else {

            }

        }

}

impl PortPolicy {

    /// Return a new PortPolicy that rejects all ports.

    /// Create a PortPolicy from a list of allowed ports. All other ports will be rejected. The

    /// ports in the list may be in any order.

        }

    /// Helper: replace this policy with its inverse.

            // ports prev_hi+1 through entry.lo-1 were rejected.  We should

            // make them allowed.

        }

    /// Helper: add a new range to the end of this portpolicy.

    ///

    /// gives an error if this range cannot appear next in sequence.

            // TODO SPEC: We don't enforce this in Tor, but we probably

            // should.  See torspec#60.

                // We compress a-b,(b+1)-c into a-c.

    /// Return true iff `port` is allowed by this policy.

    /// Replace this PortPolicy with an interned copy, to save memory.

    /// Return true if this policy allows any ports at all.

    ///

    /// # Example

    /// ```

    /// use tor_netdoc::types::policy::PortPolicy;

    ///

    /// let policy: PortPolicy = "accept 22".parse().unwrap();

    /// assert!(policy.allows_some_port());

    /// let policy2: PortPolicy = "reject 1-65535".parse().unwrap();

    /// assert!(! policy2.allows_some_port());

    /// ```

}

impl FromStr for PortPolicy {

    type Err = PolicyError;

        } else {

        };

        }

}

/// Cache of PortPolicy objects, for saving memory.

//

/// This only holds weak references to the policy objects, so we don't

/// need to worry about running out of space because of stale entries.

static POLICY_CACHE: InternCache<PortPolicy> = InternCache::new();

#[cfg(test)]

mod test {

    // @@ begin test lint list maintained by maint/add_warning @@

    #![allow(clippy::bool_assert_comparison)]

    #![allow(clippy::clone_on_copy)]

    #![allow(clippy::dbg_macro)]

    #![allow(clippy::mixed_attributes_style)]

    #![allow(clippy::print_stderr)]

    #![allow(clippy::print_stdout)]

    #![allow(clippy::single_char_pattern)]

    #![allow(clippy::unwrap_used)]

    #![allow(clippy::unchecked_duration_subtraction)]

    #![allow(clippy::useless_vec)]

    #![allow(clippy::needless_pass_by_value)]

    //! <!-- @@ end test lint list maintained by maint/add_warning @@ -->

    use itertools::Itertools;

    use super::*;

    #[test]

    fn test_roundtrip() {

        fn check(inp: &str, outp: &str, allow: &[u16], deny: &[u16]) {

            let policy = inp.parse::<PortPolicy>().unwrap();

            assert_eq!(format!("{}", policy), outp);

            for p in allow {

                assert!(policy.allows_port(*p));

            }

            for p in deny {

                assert!(!policy.allows_port(*p));

            }

        }

        check(

            "accept 1-10,30-50,600",

            "accept 1-10,30-50,600",

            &[1, 10, 35, 600],

            &[0, 11, 55, 599, 601],

        );

        check("accept 1-10,11-20", "accept 1-20", &[], &[]);

        check(

            "reject 1-30",

            "accept 31-65535",

            &[31, 10001, 65535],

            &[0, 1, 30],

        );

        check(

            "reject 300-500",

            "accept 1-299,501-65535",

            &[31, 10001, 65535],

            &[300, 301, 500],

        );

        check("reject 10,11,12,13,15", "accept 1-9,14,16-65535", &[], &[]);

        check(

            "reject 1-65535",

            "reject 1-65535",

            &[],

            &[1, 300, 301, 500, 10001, 65535],

        );

    }

    #[test]

    fn test_bad() {

        for s in &[

            "ignore 1-10",

            "allow 1-100",

            "accept",

            "reject",

            "accept x-y",

            "accept 1-20,19-30",

            "accept 1-20,20-30",

            "reject 1,1,1,1",

            "reject 1,2,foo,4",

            "reject 5,4,3,2",

        ] {

            assert!(s.parse::<PortPolicy>().is_err());

        }

    }

    #[test]

    fn test_from_allowed_port_list() {

        let mut cases = vec![];

        cases.push((vec![1, 2, 3, 7, 8, 10, 42], "accept 1-3,7-8,10,42"));

        cases.push((vec![1, 3, 5], "accept 1,3,5"));

        cases.push((vec![1, 2, 3, 4], "accept 1-4"));

        cases.push((vec![65535], "accept 65535"));

        cases.push((vec![], "reject 1-65535"));

        for (port_list, port_range) in cases {

            let expected = port_range.parse::<PortPolicy>().unwrap();

            for port_list in port_list.iter().copied().permutations(port_list.len()) {

                assert_eq!(PortPolicy::from_allowed_port_list(port_list), expected,);

            }

        }

    }

}