. "$BST_LIB"
# BST-TIMEOUT: 600   # measured 21 s on a fresh guest; see THE BOUND below
# libexosip2 5.3.0 (meta-networking recipes-support/libexosip2) -- the eXosip2
# session layer over libosip2, proved by the only thing worth proving about a SIP
# stack: the dialogue it puts on the wire and what it makes of the answers.
#
# WHAT THIS ASSERTS, AND WHY IN TWO HALVES. The suite reads two independent
# records of one REGISTER dialogue and asserts on both:
#
#   * what the LIBRARY REPORTED -- the probe's own lines: the return code of
#     every API call, one line per eXosip event, the challenge count, the final
#     status. This is the half a consumer sees.
#   * what WENT ON THE WIRE -- the responder's verbatim request transcript: the
#     request lines, the CSeq progression, the Call-ID and From-tag, the Via
#     branches, and every field of the Authorization header including the digest.
#     This is the half a peer sees.
#
# Both are needed and neither implies the other. A stack that reported
# REGISTRATION_SUCCESS while sending a second REGISTER with the SAME CSeq would
# satisfy every event case and fail the wire cases; one that emitted a perfect
# retry but surfaced it as a failure would do the reverse.
#
# THE RESPONDER is libexosip2-sipd, a 2.1 MB single-process registrar this port
# builds at recipe time beside the probe. Its header carries the protocol
# reasoning and why it does NOT validate the digest -- the digest is the
# library's arithmetic, and a registrar that recomputed it would be checking
# itself. It is NOT the `socat ... EXEC:<script>` the ticket asked for: measured
# on target, a socat responder of that shape BINDS and then never delivers a
# datagram to its EXEC child, for a small client as well as for the probe, with
# 794 MB free. The recipe's bbappend carries the three-arm measurement.
#
# EVERY EXPECTED VALUE HERE WAS MEASURED ON AN x86_64 CONTROL, not predicted:
# libosip2 5.3.1 and libexosip2 5.3.0 from the same two tarballs the recipes
# fetch, both configured --enable-mt=no (see the recipes -- the pair must agree,
# and BRINTOS-1242 records what happens when they do not), the same probe source
# and the same responder, run on fra2 at port time (2026-08-23). It produced
# rc=0, the two events below, and the two-request transcript this file asserts.
# A red here is therefore a statement about THIS ARM, which is the only thing
# that makes a red worth anything.
#
# THE DIGEST IS DERIVED, NOT COPIED. WANT_DIGEST below is not the hex the control
# happened to print -- it is RFC 2617 evaluated independently over the inputs
# this suite fixes:
#
#     HA1      = MD5("bst:bst.invalid:bstpass")             = 701df197019f7ebe2877dafb63df36fb
#     HA2      = MD5("REGISTER:sip:127.0.0.1:15761")        = b03f836b38e8ff54ee021e0ed8d3e674
#     response = MD5(HA1 ":" nonce ":" HA2)                 = 8cc55aa440743b69db1eed6b86b9f7d6
#
# and the control's Authorization header carried exactly that. So this case
# asserts the library's MD5 and its digest-input assembly against arithmetic done
# outside it, rather than against a recording of its own output. NOTE IT DEPENDS
# ON PROXY_PORT, which is inside HA2 via the digest uri -- change the port and
# this constant must be recomputed, which is why the derivation is written out
# here rather than left as a magic number.
#
# THE BOUND. 600 s against a measured 21 s. The one part that can legitimately
# take time is the responder coming up, which wait_udp bounds at 120 s so that a
# listener that never appears is reported as named reds inside the bound rather
# than consuming it.
#
# $BST_EXOSIP_ROOT prefixes every installed path and is EMPTY on target -- it
# exists so the whole suite can be driven against a native x86_64 tree of the
# identical releases before it ever ships, which is where the values above come
# from. One knob rather than one per path, so a control run cannot cover half the
# payload by accident.

R=${BST_EXOSIP_ROOT:-}
ARCHIVE=$R/usr/lib/libeXosip2.a
INC=$R/usr/include/eXosip2
PROBE=$R/usr/libexec/libexosip2-tests/libexosip2-probe
SIPD=$R/usr/libexec/libexosip2-tests/libexosip2-sipd
SIP_REG=$R/usr/bin/sip_reg
SIP_MONITOR=$R/usr/bin/sip_monitor
SIP_STORM=$R/usr/bin/sip_storm

WANT_VERSION=5.3.0
PROXY_PORT=15761
LOCAL_PORT=15770
REALM=bst.invalid
NONCE=0123456789abcdef0123456789abcdef
WANT_DIGEST=8cc55aa440743b69db1eed6b86b9f7d6

if [ ! -f "$ARCHIVE" ]; then
  bst_skip libexosip2/present "libexosip2 not installed on this image"
  exit 0
fi
bst_ok libexosip2/present

# ONE BST RESULT LINE IS LOST IN TRANSPORT EVERY RUN (BRINTOS-1149 /
# brintos/linux#96). This case is first and asserts nothing, so the loss lands on
# it instead of on a case that means something. It comes out when #96 closes.
bst_ok libexosip2/canary

D=${TMPDIR:-/tmp}/bst-libexosip2.$$
rm -rf "$D"; mkdir -p "$D" || { bst_notok libexosip2/workdir "cannot create $D"; exit 0; }

hasfile() { if [ -s "$2" ]; then bst_ok "$1"; else bst_notok "$1" "absent or empty: $2"; fi; }
has()     { case "$3" in *"$2"*) bst_ok "$1" ;; *) bst_notok "$1" "not found: $2 -- got $(_bst_1line "$3")" ;; esac; }
hasnot()  { case "$3" in *"$2"*) bst_notok "$1" "unexpectedly present: $2 -- got $(_bst_1line "$3")" ;; *) bst_ok "$1" ;; esac; }

# --- the shipped payload ------------------------------------------------------
hasfile libexosip2/staticlib    "$ARCHIVE"
hasfile libexosip2/hdr-exosip   "$INC/eXosip.h"
hasfile libexosip2/hdr-setup    "$INC/eX_setup.h"
hasfile libexosip2/hdr-register "$INC/eX_register.h"
hasfile libexosip2/probe-payload "$PROBE"
hasfile libexosip2/sipd-payload  "$SIPD"

# --- the responder ------------------------------------------------------------
#
# STARTED INLINE AND REPORTING ITS PID IN A VARIABLE, NOT ON STDOUT. A command
# substitution cannot return while any process holds its pipe's write end open,
# and a backgrounded listener inherits exactly that fd -- 88-ssmtp.test's first
# revision blocked forever before its first case for this reason.
#
# It is given a datagram budget of 2 and a 40 s wall-clock bound of its own, so it
# exits on its own terms: nothing on this image can be killed reliably
# (brintos/linux#21), and a registrar that outlived the suite would hold the port
# against the next run in the same boot.
LOG="$D/req.log"; : > "$LOG"
"$SIPD" "$PROXY_PORT" "$LOG" "$REALM" "$NONCE" 2 40 >"$D/sipd.out" 2>&1 &
SPID=$!

# A UDP socket has no LISTEN state to wait on -- /proc/net/udp carries the bound
# port in hex with the address, which is one file open rather than another
# process. 120 s so a listener that never appears reports as the named reds below
# instead of eating the whole bound; the measured cost is seconds.
wait_udp() {
  _hex=$(printf '%04X' "$1"); _n=0
  while [ "$_n" -lt 120 ]; do
    if grep -qi ":$_hex " /proc/net/udp 2>/dev/null; then return 0; fi
    _n=$((_n+1)); sleep 1
  done
  return 1
}

DIALOGUE_IDS="probe-init probe-listen probe-build probe-send challenge-401 registered-200 probe-rc
req-count req1-line req1-cseq req2-cseq callid-stable fromtag-stable branch-differs via-magic-cookie
req1-no-auth req2-auth auth-username auth-realm auth-nonce auth-uri auth-digest
req-contact req-expires req-maxforwards req-useragent"

if wait_udp $PROXY_PORT; then
  out=$("$PROBE" "$PROXY_PORT" "$LOCAL_PORT" 20 2>"$D/probe.err"); rc=$?

  if bst_execfail "$out$(cat "$D/probe.err" 2>/dev/null)"; then
    for id in $DIALOGUE_IDS; do bst_unrun "libexosip2/$id" "$out"; done
  else
    # --- what the library reported ------------------------------------------
    has libexosip2/probe-init   "BSTX init rc=0"                "$out"
    has libexosip2/probe-listen "BSTX listen rc=0 port=$LOCAL_PORT" "$out"
    has libexosip2/probe-send   "BSTX send rc=0"                "$out"
    case "$out" in
    *"BSTX build rid="[0-9]*) bst_ok libexosip2/probe-build ;;
    *) bst_notok libexosip2/probe-build "no non-negative registration id -- got $(_bst_1line "$out")" ;;
    esac

    # THE CHALLENGE AND THE ANSWER ARE SEPARATE CASES ON PURPOSE. A stack that
    # never retried would satisfy the first and fail the second; one that
    # retried without ever having been challenged (credentials sent unprompted)
    # would fail the first and could still reach a 200.
    has libexosip2/challenge-401  "BSTX challenge n=1 status=401 cseq=1" "$out"
    has libexosip2/registered-200 "name=REGISTRATION_SUCCESS status=200 cseq=2" "$out"

    if [ "$rc" -eq 0 ]; then bst_ok libexosip2/probe-rc
    else bst_notok libexosip2/probe-rc "rc=$rc $(_bst_1line "$out")"; fi

    # --- what went on the wire ----------------------------------------------
    reqs=$(cat "$LOG" 2>/dev/null)
    # awk rather than `grep -c ... || echo 0`: grep exits 1 on zero matches, so
    # the fallback APPENDS a second line and check_eq compares against "0 0".
    n_req=$(awk '/^==END-OF-REQUEST==$/{n++} END{print n+0}' "$LOG" 2>/dev/null)

    # EXACTLY TWO. Three would mean the credentialed retry was itself
    # challenged; one would mean no retry happened at all. Both are states the
    # per-header cases below could not distinguish on their own.
    check_eq libexosip2/req-count 2 "$n_req"

    r1=$(awk '/^==END-OF-REQUEST==$/{exit} {print}' "$LOG" 2>/dev/null)
    r2=$(awk 'f{print} /^==END-OF-REQUEST==$/{f=1}' "$LOG" 2>/dev/null |
         awk '/^==END-OF-REQUEST==$/{exit} {print}')

    has libexosip2/req1-line "REGISTER sip:127.0.0.1:$PROXY_PORT SIP/2.0" "$r1"
    has libexosip2/req1-cseq "CSeq: 1 REGISTER" "$r1"
    # THE CSeq INCREMENT IS THE RETRY'S SIGNATURE. RFC 3261 requires a new CSeq
    # for the re-sent request; a stack that reused 1 would be retransmitting,
    # not retrying, and the registrar would answer the old transaction.
    has libexosip2/req2-cseq "CSeq: 2 REGISTER" "$r2"

    cid1=$(printf '%s\n' "$r1" | awk '/^Call-ID:/{print $2; exit}')
    cid2=$(printf '%s\n' "$r2" | awk '/^Call-ID:/{print $2; exit}')
    if [ -n "$cid1" ] && [ "$cid1" = "$cid2" ]; then bst_ok libexosip2/callid-stable
    else bst_notok libexosip2/callid-stable "Call-ID changed across the retry: '$cid1' -> '$cid2'"; fi

    ft1=$(printf '%s\n' "$r1" | awk '/^From:/{print; exit}')
    ft2=$(printf '%s\n' "$r2" | awk '/^From:/{print; exit}')
    if [ -n "$ft1" ] && [ "$ft1" = "$ft2" ]; then bst_ok libexosip2/fromtag-stable
    else bst_notok libexosip2/fromtag-stable "From changed across the retry: '$ft1' -> '$ft2'"; fi

    # THE BRANCH MUST DIFFER where the Call-ID must not: same registration,
    # different transaction. Asserting only that both carry a branch would pass
    # on a stack that reused one, which is the bug this pair exists to catch.
    b1=$(printf '%s\n' "$r1" | sed -n 's/.*branch=\([^;]*\).*/\1/p' | head -1)
    b2=$(printf '%s\n' "$r2" | sed -n 's/.*branch=\([^;]*\).*/\1/p' | head -1)
    if [ -n "$b1" ] && [ -n "$b2" ] && [ "$b1" != "$b2" ]; then bst_ok libexosip2/branch-differs
    else bst_notok libexosip2/branch-differs "Via branch not renewed for the retry: '$b1' vs '$b2'"; fi
    has libexosip2/via-magic-cookie "branch=z9hG4bK" "$r1"

    # The first request must be unauthenticated: credentials are a RESPONSE to a
    # challenge, and a stack that volunteered them would be leaking a digest to
    # any host that answered.
    hasnot libexosip2/req1-no-auth "Authorization:" "$r1"
    has libexosip2/req2-auth   "Authorization: Digest" "$r2"
    has libexosip2/auth-username "username=\"bst\""   "$r2"
    has libexosip2/auth-realm    "realm=\"$REALM\""   "$r2"
    has libexosip2/auth-nonce    "nonce=\"$NONCE\""   "$r2"
    has libexosip2/auth-uri      "uri=\"sip:127.0.0.1:$PROXY_PORT\"" "$r2"
    has libexosip2/auth-digest   "response=\"$WANT_DIGEST\"" "$r2"

    has libexosip2/req-contact     "Contact: <sip:bst@127.0.0.1:$LOCAL_PORT>" "$r1"
    has libexosip2/req-expires     "Expires: 1800"        "$r1"
    has libexosip2/req-maxforwards "Max-Forwards: 70"     "$r1"
    has libexosip2/req-useragent   "User-Agent: eXosip/$WANT_VERSION" "$r1"
  fi
else
  for id in $DIALOGUE_IDS; do
    bst_notok "libexosip2/$id" "registrar never bound 127.0.0.1:$PROXY_PORT within 120s -- $(_bst_1line "$(cat "$D/sipd.out" 2>/dev/null)")"
  done
fi

# --- upstream's own tools, LAST AND DELIBERATELY SO --------------------------
#
# THIS BLOCK RUNS AFTER THE DIALOGUE BECAUSE EXEC BUDGET IS FINITE HERE, and
# that ordering is the whole of a bug this suite had. Each of sip_reg,
# sip_monitor and sip_storm is a ~47 MB whole-program image, the probe is
# another, and guest memory is NOT returned on process exit. With the three
# tools exec'd first the probe could no longer be staged, and all 26 dialogue
# cases came back
#
#     UNRUN-EXEC-ENOMEM (brintos/linux#44): command could not be exec'd
#
# on an image where the dialogue demonstrably works -- a suite reporting on its
# own exec budget rather than on the port. So the ticket's criterion goes first
# and gets the staging, and the tools take what is left.
#
# ONLY ONE OF THEM IS EXEC'D for the same reason. sip_reg is the one worth
# spending it on: it is the REGISTER client, so its banner is the closest thing
# to a second witness for the library, and it is asserted on its exit status too
# -- it prints usage and exits 1 with no arguments, so a binary that exited 0
# would have taken a different path entirely. sip_monitor and sip_storm are
# asserted present and executable, which is what the packaging question actually
# is; running them would buy a banner at the price of the case above.
sr_out=$("$SIP_REG" 2>&1); sr_rc=$?
if bst_execfail "$sr_out"; then
  bst_unrun libexosip2/sip_reg-banner "$sr_out"
  bst_unrun libexosip2/sip_reg-usage-rc "$sr_out"
else
  has libexosip2/sip_reg-banner "sip_reg v$WANT_VERSION" "$sr_out"
  check_eq libexosip2/sip_reg-usage-rc 1 "$sr_rc"
fi

if [ -x "$SIP_MONITOR" ]; then bst_ok libexosip2/sip_monitor-present
else bst_notok libexosip2/sip_monitor-present "$SIP_MONITOR is not present and executable"; fi
if [ -x "$SIP_STORM" ]; then bst_ok libexosip2/sip_storm-present
else bst_notok libexosip2/sip_storm-present "$SIP_STORM is not present and executable"; fi

# NO `wait` IN TEARDOWN, and the kill is best-effort. The registrar bounds itself
# (2 datagrams or 40 s) precisely because neither can be relied on here: a shell
# `wait` blocks until the whole group is gone, which two runs of
# 88-imapfilter-net.test measured as a suite-timeout after every case had passed,
# and a signal does not reliably reach a process on this arm (brintos/linux#21).
kill "$SPID" 2>/dev/null

rm -rf "$D"