/*
 * Unix SMB/CIFS implementation.
 *
 * Copyright (C) Catalyst.Net Ltd 2023
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

#include <stdarg.h>
#include <stddef.h>
#include <stdint.h>
#include <setjmp.h>
#include <cmocka.h>

#include "replace.h"
#include <talloc.h>
#include "libcli/util/ntstatus.h"
#include "lib/crypto/gkdi.h"

static const uint8_t gmsa_security_descriptor[] = {
	/* O:SYD:(A;;FRFW;;;S-1-5-9) */
	0x01, 0x00, 0x04, 0x80, 0x30, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
	0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x02, 0x00, 0x1c, 0x00,
	0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x9f, 0x01, 0x12, 0x00,
	0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x09, 0x00, 0x00, 0x00,
	0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x12, 0x00, 0x00, 0x00};

#define GKID(l0_idx_, l1_idx_, l2_idx_) \
	((struct Gkid){.l0_idx = l0_idx_, .l1_idx = l1_idx_, .l2_idx = l2_idx_})

#define GUID_LITERAL(                                                     \
	time_low_, time_mid_, time_hi_and_version_, clock_seq_, node_)    \
	((struct GUID){.time_low = (0x##time_low_),                       \
		       .time_mid = (0x##time_mid_),                       \
		       .time_hi_and_version = (0x##time_hi_and_version_), \
		       .clock_seq = {(uint32_t)(0x##clock_seq_) >> 8,     \
				     (uint8_t)(0x##clock_seq_)},          \
		       .node = {(uint64_t)(0x##node_) >> 40,              \
				(uint8_t)((uint64_t)(0x##node_) >> 32),   \
				(uint8_t)((uint64_t)(0x##node_) >> 24),   \
				(uint8_t)((uint64_t)(0x##node_) >> 16),   \
				(uint8_t)((uint64_t)(0x##node_) >> 8),    \
				(uint8_t)(0x##node_)}})

struct test_vector {
	const char *name; /* The name of the test scenario. */
	struct Gkid gkid; /* The GKID of the key to derive. */
	struct ProvRootKey root_key;
	NTSTATUS expected_status;
	uint8_t expected_key[GKDI_KEY_LEN]; /* The expected derived key. */
};

#define DATA_BLOB_CONST(data_, length_)                         \
	((DATA_BLOB){.data = (discard_const_p(uint8_t, data_)), \
		     .length = (length_)})

#define ARRAY(...) ((const uint8_t[]){__VA_ARGS__})
#define ROOT_KEY_DATA(...) \
	DATA_BLOB_CONST(ARRAY(__VA_ARGS__), sizeof(ARRAY(__VA_ARGS__)))
#define EXPECTED_KEY(...) {__VA_ARGS__}
#define ROOT_KEY_VERSION(version) (version)

#define ARBITRARY_ROOT_KEY_DATA                                              \
	ROOT_KEY_DATA(72,  159, 53,  49,  197, 55,  119, 77,  67,  45,	107, \
		      151, 227, 188, 31,  67,  210, 232, 198, 220, 23,	235, \
		      14,  79,	217, 160, 135, 13,  47,	 30,  191, 146, 226, \
		      73,  102, 104, 168, 181, 189, 17,	 174, 162, 211, 45,  \
		      10,  171, 113, 111, 72,  254, 86,	 159, 92,  155, 80,  \
		      255, 63,	155, 245, 222, 174, 165, 114, 251)

#define ARBITRARY_GUID GUID_LITERAL(4cdf4285, c46a, 62a3, 2f7d, 95f97342685b)

#define SUCCESS_VECTOR(                                                       \
	name_, root_key_id, algorithm, gkid_, root_key_data, expected_key_)   \
	{                                                                     \
		.name = (name_), .gkid = (gkid_),                               \
		.root_key = {.version = root_key_version_1,                   \
			     .id = (root_key_id),                             \
			     .data = (root_key_data),                         \
			     .kdf_algorithm =                                 \
				     {.id = KDF_ALGORITHM_SP800_108_CTR_HMAC, \
				      .param.sp800_108 = (algorithm)}},       \
		.expected_status = NT_STATUS_OK,                              \
		.expected_key = expected_key_,                                \
	}

#define FAILURE_VECTOR_VERSION(name_,                                         \
			       root_key_id,                                   \
			       algorithm,                                     \
			       gkid_,                                         \
			       root_key_version,                              \
			       root_key_data,                                 \
			       expected_status_)                              \
	{                                                                     \
		.name = (name_), .gkid = (gkid_),                               \
		.root_key = {.version = (root_key_version),                   \
			     .id = (root_key_id),                             \
			     .data = (root_key_data),                         \
			     .kdf_algorithm =                                 \
				     {.id = KDF_ALGORITHM_SP800_108_CTR_HMAC, \
				      .param.sp800_108 = (algorithm)}},       \
		.expected_status = (expected_status_), .expected_key = {},    \
	}

#define FAILURE_VECTOR(                                                        \
	name_, root_key_id, algorithm, gkid_, root_key_data, expected_status_) \
	FAILURE_VECTOR_VERSION(name_,                                          \
			       root_key_id,                                    \
			       algorithm,                                      \
			       gkid_,                                          \
			       root_key_version_1,                             \
			       root_key_data,                                  \
			       expected_status_)

/* Test vectors derived from samba.tests.krb5.gkdi_tests Python tests. */
static const struct test_vector gkdi_vectors[] = {
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_current_l0_idx_"
		"l1_seed_key",
		GUID_LITERAL(89f70521, 9d66, 441f, c314, 1b462f9b1052),
		KDF_PARAM_SHA512,
		GKID(255, 24, -1),
		ROOT_KEY_DATA(166, 239, 135, 219, 187, 248, 107, 107, 190, 85,
			      117, 11,	148, 31,  19,  202, 153, 239, 229, 24,
			      94,  46,	43,  222, 213, 184, 56,	 216, 160, 231,
			      118, 71,	5,   55,  230, 140, 174, 69,  167, 160,
			      244, 177, 214, 201, 191, 84,  148, 195, 248, 121,
			      225, 114, 227, 38,  85,  124, 219, 182, 165, 110,
			      135, 153, 167, 34),
		EXPECTED_KEY(189, 83,  138, 7,	 52,  144, 243, 207, 148, 81,
			     201, 51,  2,   93,	 233, 178, 44,	151, 234, 221,
			     175, 250, 148, 179, 121, 226, 185, 25,  164, 190,
			     209, 71,  91,  198, 127, 106, 145, 117, 177, 57,
			     198, 146, 4,   197, 125, 67,  0,	160, 20,  31,
			     254, 52,  209, 44,	 237, 132, 97,	69,  147, 177,
			     170, 19,  175, 28)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_current_l0_idx_"
		"l2_seed_key",
		GUID_LITERAL(1a3d6c30, aa81, cb7f, d3fe, 80775d135dfe),
		KDF_PARAM_SHA512,
		GKID(321, 0, 12),
		ROOT_KEY_DATA(223, 217, 91,  227, 21,  58,  8,	 5,   198, 86,
			      148, 231, 210, 132, 170, 206, 90,	 176, 170, 73,
			      51,  80,	2,   94,  184, 219, 198, 223, 11,  78,
			      146, 86,	251, 76,  191, 190, 98,	 55,  206, 55,
			      50,  105, 78,  38,  8,   118, 0,	 118, 182, 112,
			      130, 211, 154, 189, 60,  15,  237, 186, 27,  136,
			      115, 100, 80,  100),
		EXPECTED_KEY(187, 189, 147, 118, 205, 22,  194, 71, 237, 64,
			     245, 145, 45,  25,	 8,   33,  140, 8,  240, 145,
			     91,  174, 2,   254, 2,   203, 251, 55, 83,	 189,
			     228, 6,   249, 197, 83,  172, 217, 81, 67,	 207,
			     99,  144, 106, 4,	 64,  227, 207, 35, 125, 35,
			     53,  174, 78,  75,	 156, 210, 217, 70, 167, 19,
			     81,  235, 203, 123)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_current_l0_idx_"
		"both_seed_keys (next older L1)",
		GUID_LITERAL(09de0b38, c743, 7abf, 44ea, 7a3c3e404314),
		KDF_PARAM_SHA512,
		GKID(123, 20, -1),
		ROOT_KEY_DATA(213, 145, 45,  14,  179, 189, 96,	 225, 55,  27,
			      30,  82,	93,  216, 59,  231, 252, 91,  175, 119,
			      1,   139, 13,  186, 107, 217, 72,	 183, 169, 142,
			      190, 90,	243, 118, 116, 51,  37,	 6,   164, 108,
			      82,  193, 8,   166, 47,  42,  62,	 137, 37,  26,
			      209, 189, 230, 213, 57,  0,   70,	 121, 192, 101,
			      136, 83,	187, 104),
		EXPECTED_KEY(177, 247, 197, 137, 110, 125, 199, 145, 217, 192,
			     170, 248, 202, 125, 186, 184, 193, 114, 164, 248,
			     184, 115, 219, 72,	 138, 60,  76,	189, 15,  85,
			     155, 17,  82,  255, 186, 57,  212, 175, 242, 217,
			     232, 170, 218, 144, 178, 122, 60,	148, 165, 175,
			     153, 111, 75,  143, 88,  74,  79,	55,  204, 171,
			     77,  80,  93,  61)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_current_l0_idx_"
		"both_seed_keys (L2)",
		GUID_LITERAL(09de0b38, c743, 7abf, 44ea, 7a3c3e404314),
		KDF_PARAM_SHA512,
		GKID(123, 21, 0),
		ROOT_KEY_DATA(213, 145, 45,  14,  179, 189, 96,	 225, 55,  27,
			      30,  82,	93,  216, 59,  231, 252, 91,  175, 119,
			      1,   139, 13,  186, 107, 217, 72,	 183, 169, 142,
			      190, 90,	243, 118, 116, 51,  37,	 6,   164, 108,
			      82,  193, 8,   166, 47,  42,  62,	 137, 37,  26,
			      209, 189, 230, 213, 57,  0,   70,	 121, 192, 101,
			      136, 83,	187, 104),
		EXPECTED_KEY(19,  60,  155, 189, 32,  217, 34,	122, 235, 56,
			     223, 205, 59,  230, 188, 191, 197, 152, 59,  163,
			     114, 2,   8,   143, 245, 200, 167, 5,   17,  33,
			     69,  6,   166, 156, 25,  90,  136, 7,   205, 132,
			     75,  203, 149, 94,	 149, 105, 200, 228, 209, 151,
			     117, 159, 40,  87,	 124, 193, 38,	209, 95,  22,
			     167, 218, 78,  224)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_previous_l0_"
		"idx",
		GUID_LITERAL(27136e8f, e093, 6fe3, e57f, 1d915b102e1c),
		KDF_PARAM_SHA512,
		GKID(100, 31, -1),
		ROOT_KEY_DATA(180, 17,	24,  198, 10,  25,  202, 250, 94,  207,
			      133, 141, 26,  42,  34,  22,  82,	 123, 45,  174,
			      223, 56,	110, 157, 89,  158, 66,	 164, 106, 221,
			      108, 125, 201, 56,  104, 97,  151, 97,  200, 128,
			      255, 54,	116, 167, 124, 110, 95,	 191, 52,  52,
			      209, 48,	169, 114, 123, 178, 205, 42,  37,  87,
			      189, 207, 199, 82),
		EXPECTED_KEY(147, 92,  189, 192, 97,  152, 235, 40,  250, 68,
			     184, 216, 39,  143, 81,  7,   44,	70,  19,  153,
			     146, 54,  88,  80,	 65,  237, 232, 231, 45,  2,
			     254, 149, 227, 69,	 79,  4,   99,	130, 203, 192,
			     167, 0,   119, 155, 121, 71,  77,	215, 224, 128,
			     80,  157, 118, 48,	 45,  41,  55,	64,  126, 150,
			     227, 211, 208, 34)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_sha1 (next "
		"older L1)",
		GUID_LITERAL(970abad6, fe55, 073a, caf1, b801d3f26bd3),
		KDF_PARAM_SHA1,
		GKID(1, 1, -1),
		ROOT_KEY_DATA(59,  237, 3,   191, 15,  183, 212, 1,   49,  73,
			      21,  79,	36,  202, 45,  89,  185, 141, 182, 213,
			      136, 203, 31,  84,  236, 160, 131, 133, 94,  37,
			      235, 40,	211, 86,  42,  1,   173, 199, 140, 75,
			      112, 224, 183, 42,  89,  81,  88,	 99,  231, 115,
			      43,  133, 63,  186, 2,   221, 118, 70,  230, 49,
			      8,   68,	18,  17),
		EXPECTED_KEY(87,  108, 182, 143, 46,  82,  235, 115, 159, 129,
			     123, 72,  140, 53,	 144, 216, 111, 28,  44,  54,
			     95,  63,  201, 32,	 29,  156, 127, 238, 116, 148,
			     133, 61,  88,  116, 110, 225, 62,	72,  241, 138,
			     166, 250, 105, 247, 21,  125, 227, 208, 125, 227,
			     78,  19,  131, 103, 146, 183, 192, 136, 255, 182,
			     145, 74,  137, 194)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_sha1 (L2)",
		GUID_LITERAL(970abad6, fe55, 073a, caf1, b801d3f26bd3),
		KDF_PARAM_SHA1,
		GKID(1, 2, 3),
		ROOT_KEY_DATA(59,  237, 3,   191, 15,  183, 212, 1,   49,  73,
			      21,  79,	36,  202, 45,  89,  185, 141, 182, 213,
			      136, 203, 31,  84,  236, 160, 131, 133, 94,  37,
			      235, 40,	211, 86,  42,  1,   173, 199, 140, 75,
			      112, 224, 183, 42,  89,  81,  88,	 99,  231, 115,
			      43,  133, 63,  186, 2,   221, 118, 70,  230, 49,
			      8,   68,	18,  17),
		EXPECTED_KEY(63,  251, 130, 90,	 218, 241, 22,	182, 83,  50,
			     7,	  213, 104, 163, 14,  211, 211, 242, 28,  104,
			     132, 9,   65,  201, 69,  102, 132, 249, 175, 161,
			     27,  5,   110, 12,	 89,  57,  27,	77,  136, 196,
			     149, 217, 132, 195, 214, 128, 2,	156, 197, 197,
			     148, 99,  15,  52,	 23,  145, 25,	193, 197, 172,
			     170, 229, 233, 14)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_sha256 (next "
		"older L1)",
		GUID_LITERAL(45e26207, ed33, dcd5, 925a, 518a0deef69e),
		KDF_PARAM_SHA256,
		GKID(222, 21, -1),
		ROOT_KEY_DATA(40,  181, 182, 80,  61,  60,  29,	 36,  129, 77,
			      231, 129, 187, 123, 252, 227, 239, 105, 238, 209,
			      206, 72,	9,   55,  43,  238, 44,	 80,  98,  112,
			      197, 240, 181, 198, 223, 89,  116, 114, 98,  63,
			      37,  108, 134, 218, 160, 153, 30,	 138, 17,  161,
			      112, 95,	33,  178, 207, 220, 11,	 185, 219, 75,
			      162, 50,	70,  162),
		EXPECTED_KEY(87,  172, 237, 110, 117, 248, 63,	58,  244, 248,
			     121, 179, 139, 96,	 240, 144, 180, 46,  75,  250,
			     2,	  47,  174, 62,	 111, 217, 66,	128, 180, 105,
			     176, 236, 21,  216, 184, 83,  168, 112, 181, 251,
			     223, 40,  112, 140, 206, 25,  39,	59,  116, 165,
			     115, 172, 190, 13,	 237, 168, 239, 81,  93,  180,
			     105, 30,  45,  203)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_sha256 (L2)",
		GUID_LITERAL(45e26207, ed33, dcd5, 925a, 518a0deef69e),
		KDF_PARAM_SHA256,
		GKID(222, 22, 22),
		ROOT_KEY_DATA(40,  181, 182, 80,  61,  60,  29,	 36,  129, 77,
			      231, 129, 187, 123, 252, 227, 239, 105, 238, 209,
			      206, 72,	9,   55,  43,  238, 44,	 80,  98,  112,
			      197, 240, 181, 198, 223, 89,  116, 114, 98,  63,
			      37,  108, 134, 218, 160, 153, 30,	 138, 17,  161,
			      112, 95,	33,  178, 207, 220, 11,	 185, 219, 75,
			      162, 50,	70,  162),
		EXPECTED_KEY(117, 42,  8,   121, 174, 36,  36,	192, 80,  76,
			     116, 147, 89,  159, 19,  229, 136, 225, 187, 220,
			     37,  47,  131, 50,	 90,  213, 177, 251, 145, 194,
			     76,  137, 1,   212, 64,  243, 255, 159, 251, 165,
			     159, 205, 101, 187, 151, 87,  50,	217, 243, 131,
			     221, 80,  184, 152, 23,  75,  185, 57,  62,  56,
			     61,  37,  213, 64)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_sha384 (next "
		"older L1)",
		GUID_LITERAL(66e6d9f7, 4924, f3fc, fe34, 605634d42ebd),
		KDF_PARAM_SHA384,
		GKID(287, 27, -1),
		ROOT_KEY_DATA(35,  229, 186, 134, 203, 216, 143, 123, 67,  46,
			      230, 109, 187, 3,	  191, 78,  235, 244, 1,   203,
			      252, 61,	247, 53,  212, 215, 40,	 181, 3,   200,
			      127, 132, 50,  7,	  198, 246, 21,	 63,  25,  13,
			      254, 133, 168, 108, 184, 216, 183, 77,  241, 59,
			      37,  48,	89,  129, 190, 141, 126, 41,  201, 110,
			      229, 76,	150, 48),
		EXPECTED_KEY(250, 186, 221, 122, 154, 99,  223, 87,  214, 131,
			     45,  247, 167, 53,	 174, 187, 110, 24,  24,  136,
			     178, 234, 243, 1,	 162, 228, 255, 154, 112, 36,
			     109, 56,  171, 29,	 36,  22,  50,	91,  243, 235,
			     114, 106, 2,   103, 186, 180, 189, 149, 12,  114,
			     145, 240, 94,  165, 241, 113, 151, 236, 229, 105,
			     146, 175, 62,  184)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_sha384 (L2)",
		GUID_LITERAL(66e6d9f7, 4924, f3fc, fe34, 605634d42ebd),
		KDF_PARAM_SHA384,
		GKID(287, 28, 27),
		ROOT_KEY_DATA(35,  229, 186, 134, 203, 216, 143, 123, 67,  46,
			      230, 109, 187, 3,	  191, 78,  235, 244, 1,   203,
			      252, 61,	247, 53,  212, 215, 40,	 181, 3,   200,
			      127, 132, 50,  7,	  198, 246, 21,	 63,  25,  13,
			      254, 133, 168, 108, 184, 216, 183, 77,  241, 59,
			      37,  48,	89,  129, 190, 141, 126, 41,  201, 110,
			      229, 76,	150, 48),
		EXPECTED_KEY(236, 28,  101, 99,	 75,  86,  148, 129, 142, 29,
			     52,  29,  169, 153, 109, 184, 242, 161, 239, 106,
			     44,  119, 106, 113, 38,  167, 235, 209, 139, 55,
			     160, 115, 175, 218, 196, 76,  65,	177, 103, 177,
			     78,  75,  135, 45,	 72,  91,  187, 109, 123, 112,
			     150, 66,  21,  208, 232, 74,  47,	241, 66,  169,
			     217, 67,  242, 5)),
	SUCCESS_VECTOR(
		"samba.tests.krb5.gkdi_tests.GkdiSelfTests.test_derive_key_"
		"exact",
		GUID_LITERAL(d95fb06f, 5a9c, 1829, e20d, 27f3f2ecfbeb),
		KDF_PARAM_SHA512,
		GKID(333, 22, 11),
		ROOT_KEY_DATA(72,  159, 53,  49,  197, 55,  119, 77,  67,  45,
			      107, 151, 227, 188, 31,  67,  210, 232, 198, 220,
			      23,  235, 14,  79,  217, 160, 135, 13,  47,  30,
			      191, 146, 226, 73,  102, 104, 168, 181, 189, 17,
			      174, 162, 211, 45,  10,  171, 113, 111, 72,  254,
			      86,  159, 92,  155, 80,  255, 63,	 155, 245, 222,
			      174, 165, 114, 251),
		EXPECTED_KEY(214, 171, 59,  20,	 244, 244, 200, 144, 138, 163,
			     70,  64,  17,  179, 159, 16,  168, 191, 173, 185,
			     151, 74,  249, 15,	 125, 154, 159, 237, 226, 253,
			     198, 229, 246, 138, 98,  142, 192, 15,  153, 148,
			     163, 171, 216, 165, 42,  233, 226, 219, 79,  104,
			     232, 54,  72,  49,	 30,  157, 119, 101, 242, 83,
			     85,  21,  181, 226)),
	FAILURE_VECTOR_VERSION("unsupported root key version (0)",
			       ARBITRARY_GUID,
			       KDF_PARAM_SHA512,
			       GKID(0, 0, 0),
			       ROOT_KEY_VERSION(0),
			       ARBITRARY_ROOT_KEY_DATA,
			       NT_STATUS_NOT_SUPPORTED),
	FAILURE_VECTOR_VERSION("unsupported root key version (2)",
			       ARBITRARY_GUID,
			       KDF_PARAM_SHA512,
			       GKID(0, 0, 0),
			       ROOT_KEY_VERSION(2),
			       ARBITRARY_ROOT_KEY_DATA,
			       NT_STATUS_NOT_SUPPORTED),
	FAILURE_VECTOR("unsupported algorithm (−1)",
		       ARBITRARY_GUID,
		       -1 /* an unsupported algorithm */,
		       GKID(0, 0, 0),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_NOT_SUPPORTED),
	FAILURE_VECTOR("wrong length (32 bytes short) for root key data",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(0, 0, 0),
		       ROOT_KEY_DATA(0,	 1,  2,	 3,  4,	 5,  6,	 7,  8,	 9,  10,
				     11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
				     22, 23, 24, 25, 26, 27, 28, 29, 30, 31),
		       NT_STATUS_NOT_SUPPORTED),
	FAILURE_VECTOR("default GKID (−1, −1, −1)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(-1, -1, -1),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (−2, −1, −1)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(-2, -1, -1),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (−1, 0, 0)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(-1, 0, 0),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (0, −1, 0)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(0, -1, 0),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (0, −2, −1)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(0, -2, -1),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (0, 0, −2)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(0, 0, -2),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (123, 0, 32)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(123, 0, 32),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("invalid GKID (456, 32, 0)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(456, 32, 0),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
	FAILURE_VECTOR("try to derive L0 seed key (333, −1, −1)",
		       ARBITRARY_GUID,
		       KDF_PARAM_SHA512,
		       GKID(333, -1, -1),
		       ARBITRARY_ROOT_KEY_DATA,
		       NT_STATUS_INVALID_PARAMETER),
};

static void test_gkdi_key_derivation(void **state)
{
	TALLOC_CTX *mem_ctx = NULL;
	size_t n;

	mem_ctx = talloc_new(NULL);
	assert_non_null(mem_ctx);

	for (n = 0; n < ARRAY_SIZE(gkdi_vectors); ++n) {
		const struct test_vector *test_vector = &gkdi_vectors[n];
		uint8_t out[GKDI_KEY_LEN] = {};
		NTSTATUS status;

		print_message("Running: %s\n", test_vector->name);

		status = compute_seed_key(
			mem_ctx,
			DATA_BLOB_CONST(gmsa_security_descriptor,
					sizeof gmsa_security_descriptor),
			&test_vector->root_key,
			test_vector->gkid,
			out);
		assert_int_equal(NT_STATUS_V(test_vector->expected_status),
				 NT_STATUS_V(status));
		assert_memory_equal(test_vector->expected_key,
				    out,
				    GKDI_KEY_LEN);
	}

	talloc_free(mem_ctx);
}

int main(int argc, char *argv[])
{
	static const struct CMUnitTest tests[] = {
		cmocka_unit_test(test_gkdi_key_derivation),
	};

	if (argc == 2) {
		cmocka_set_test_filter(argv[1]);
	}
	cmocka_set_message_output(CM_OUTPUT_SUBUNIT);
	return cmocka_run_group_tests(tests, NULL, NULL);
}