/*

 * Copyright (C) 2000-2012 Free Software Foundation, Inc.

 * Copyright (C) 2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* Functions that relate to base64 encoding and decoding.

 */

#include "gnutls_int.h"

#include "errors.h"

#include <datum.h>

#include <x509_b64.h>

#include <nettle/base64.h>

#define INCR(what, size, max_len) \

	do { \

	what+=size; \

	if (what > max_len) { \

		gnutls_assert(); \

		gnutls_free( result->data); result->data = NULL; \

		return GNUTLS_E_INTERNAL_ERROR; \

	} \

	} while(0)

/* encodes data and puts the result into result (locally allocated)

 * The result_size (including the null terminator) is the return value.

 */

int

_gnutls_fbase64_encode(const char *msg, const uint8_t * data,

		       size_t data_size, gnutls_datum_t * result)

{

	int tmp;

	unsigned int i;

	uint8_t tmpres[66];

	uint8_t *ptr;

	char top[80];

	char bottom[80];

	size_t size, max, bytes;

	int pos, top_len = 0, bottom_len = 0;

	unsigned raw_encoding = 0;

	if (msg == NULL || msg[0] == 0)

		raw_encoding = 1;

	if (!raw_encoding) {

		if (strlen(msg) > 50) {

			gnutls_assert();

			return GNUTLS_E_BASE64_ENCODING_ERROR;

		}

		_gnutls_str_cpy(top, sizeof(top), "-----BEGIN ");

		_gnutls_str_cat(top, sizeof(top), msg);

		_gnutls_str_cat(top, sizeof(top), "-----\n");

		_gnutls_str_cpy(bottom, sizeof(bottom), "-----END ");

		_gnutls_str_cat(bottom, sizeof(bottom), msg);

		_gnutls_str_cat(bottom, sizeof(bottom), "-----\n");

		top_len = strlen(top);

		bottom_len = strlen(bottom);

	}

	max = B64FSIZE(top_len + bottom_len, data_size);

	result->data = gnutls_malloc(max + 1);

	if (result->data == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	bytes = pos = 0;

	INCR(bytes, top_len, max);

	pos = top_len;

	memcpy(result->data, top, top_len);

	for (i = 0; i < data_size; i += 48) {

		if (data_size - i < 48)

			tmp = data_size - i;

		else

			tmp = 48;

		size = BASE64_ENCODE_RAW_LENGTH(tmp);

		if (sizeof(tmpres) < size)

			return gnutls_assert_val(GNUTLS_E_BASE64_ENCODING_ERROR);

		base64_encode_raw((void*)tmpres, tmp, &data[i]);

		INCR(bytes, size + 1, max);

		ptr = &result->data[pos];

		memcpy(ptr, tmpres, size);

		ptr += size;

		pos += size;

		if (!raw_encoding) {

			*ptr++ = '\n';

			pos++;

		} else {

			bytes--;

		}

	}

	INCR(bytes, bottom_len, max);

	memcpy(&result->data[bytes - bottom_len], bottom, bottom_len);

	result->data[bytes] = 0;

	result->size = bytes;

	return max + 1;

}

/**

 * gnutls_pem_base64_encode:

 * @msg: is a message to be put in the header (may be %NULL)

 * @data: contain the raw data

 * @result: the place where base64 data will be copied

 * @result_size: holds the size of the result

 *

 * This function will convert the given data to printable data, using

 * the base64 encoding. This is the encoding used in PEM messages.

 *

 * The output string will be null terminated, although the output size will

 * not include the terminating null.

 *

 * Returns: On success %GNUTLS_E_SUCCESS (0) is returned,

 *   %GNUTLS_E_SHORT_MEMORY_BUFFER is returned if the buffer given is

 *   not long enough, or 0 on success.

 **/

int

gnutls_pem_base64_encode(const char *msg, const gnutls_datum_t * data,

			 char *result, size_t * result_size)

{

	gnutls_datum_t res;

	int ret;

	ret = _gnutls_fbase64_encode(msg, data->data, data->size, &res;;

	if (ret < 0)

		return ret;

	if (result == NULL || *result_size < (unsigned) res.size) {

		gnutls_free(res.data);

		*result_size = res.size + 1;

		return GNUTLS_E_SHORT_MEMORY_BUFFER;

	} else {

		memcpy(result, res.data, res.size);

		gnutls_free(res.data);

		*result_size = res.size;

	}

	return 0;

}

/**

 * gnutls_pem_base64_encode2:

 * @header: is a message to be put in the encoded header (may be %NULL)

 * @data: contains the raw data

 * @result: will hold the newly allocated encoded data

 *

 * This function will convert the given data to printable data, using

 * the base64 encoding.  This is the encoding used in PEM messages.

 * This function will allocate the required memory to hold the encoded

 * data.

 *

 * You should use gnutls_free() to free the returned data.

 *

 * Note, that prior to GnuTLS 3.4.0 this function was available

 * under the name gnutls_pem_base64_encode_alloc(). There is

 * compatibility macro pointing to this function.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise

 *   an error code is returned.

 *

 * Since: 3.4.0

 **/

int

gnutls_pem_base64_encode2(const char *header,

			       const gnutls_datum_t * data,

			       gnutls_datum_t * result)

{

	int ret;

	if (result == NULL)

		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	ret = _gnutls_fbase64_encode(header, data->data, data->size, result);

	if (ret < 0)

		return gnutls_assert_val(ret);

	return 0;

}

/* copies data to result but removes newlines and <CR>

 * returns the size of the data copied.

 *

 * It will fail with GNUTLS_E_BASE64_DECODING_ERROR if the

 * end-result is the empty string.

 */

inline static int

cpydata(const uint8_t * data, int data_size, gnutls_datum_t * result)

{

	int i, j;

	result->data = gnutls_malloc(data_size + 1);

	if (result->data == NULL)

		return GNUTLS_E_MEMORY_ERROR;

	for (j = i = 0; i < data_size; i++) {

		if (data[i] == '\n' || data[i] == '\r' || data[i] == ' '

		    || data[i] == '\t')

			continue;

		else if (data[i] == '-')

			break;

		result->data[j] = data[i];

		j++;

	}

	result->size = j;

	result->data[j] = 0;

	if (j==0) {

		gnutls_free(result->data);

		return gnutls_assert_val(GNUTLS_E_BASE64_DECODING_ERROR);

	}

	return j;

}

/* decodes data and puts the result into result (locally allocated).

 * Note that encodings of zero-length strings are being rejected

 * with GNUTLS_E_BASE64_DECODING_ERROR.

 *

 * The result_size is the return value.

 */

int

_gnutls_base64_decode(const uint8_t * data, size_t data_size,

		      gnutls_datum_t * result)

{

	int ret;

	size_t size;

	gnutls_datum_t pdata;

	struct base64_decode_ctx ctx;

	if (data_size == 0) {

		result->data = (unsigned char*)gnutls_strdup("");

		if (result->data == NULL)

			return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

		result->size = 0;

		return 0;

	}

	ret = cpydata(data, data_size, &pdata);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	base64_decode_init(&ctx;;

	size = BASE64_DECODE_LENGTH(pdata.size);

	if (size == 0) {

		ret = gnutls_assert_val(GNUTLS_E_BASE64_DECODING_ERROR);

		goto cleanup;

	}

	result->data = gnutls_malloc(size);

	if (result->data == NULL) {

		ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);

		goto cleanup;

	}

	ret = base64_decode_update(&ctx, &size, result->data,

				   pdata.size, (void*)pdata.data);

	if (ret == 0 || size == 0) {

		gnutls_assert();

		ret = GNUTLS_E_BASE64_DECODING_ERROR;

		goto fail;

	}

	ret = base64_decode_final(&ctx;;

	if (ret != 1) {

		ret = gnutls_assert_val(GNUTLS_E_BASE64_DECODING_ERROR);

		goto fail;

	}

	result->size = size;

	ret = size;

	goto cleanup;

 fail:

	gnutls_free(result->data);

 cleanup:

	gnutls_free(pdata.data);

	return ret;

}

/* Searches the given string for ONE PEM encoded certificate, and

 * stores it in the result.

 *

 * The result_size (always non-zero) is the return value,

 * or a negative error code.

 */

#define ENDSTR "-----"

int

_gnutls_fbase64_decode(const char *header, const uint8_t * data,

		       size_t data_size, gnutls_datum_t * result)

{

	int ret;

	static const char top[] = "-----BEGIN ";

	static const char bottom[] = "-----END ";

	uint8_t *rdata, *kdata;

	int rdata_size;

	char pem_header[128];

	_gnutls_str_cpy(pem_header, sizeof(pem_header), top);

	if (header != NULL)

		_gnutls_str_cat(pem_header, sizeof(pem_header), header);

	rdata = memmem(data, data_size, pem_header, strlen(pem_header));

	if (rdata == NULL) {

		gnutls_assert();

		_gnutls_hard_log("Could not find '%s'\n", pem_header);

		return GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR;

	}

	data_size -= MEMSUB(rdata, data);

	if (data_size < 4 + strlen(bottom)) {

		gnutls_assert();

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	kdata =

	    memmem(rdata + 1, data_size - 1, ENDSTR, sizeof(ENDSTR) - 1);

	/* allow CR as well.

	 */

	if (kdata == NULL) {

		gnutls_assert();

		_gnutls_hard_log("Could not find '%s'\n", ENDSTR);

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	data_size -= strlen(ENDSTR);

	data_size -= MEMSUB(kdata, rdata);

	rdata = kdata + strlen(ENDSTR);

	/* position is now after the ---BEGIN--- headers */

	kdata = memmem(rdata, data_size, bottom, strlen(bottom));

	if (kdata == NULL) {

		gnutls_assert();

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	/* position of kdata is before the ----END--- footer 

	 */

	rdata_size = MEMSUB(kdata, rdata);

	if (rdata_size < 4) {

		gnutls_assert();

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	if ((ret = _gnutls_base64_decode(rdata, rdata_size, result)) < 0) {

		gnutls_assert();

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	return ret;

}

/**

 * gnutls_pem_base64_decode:

 * @header: A null terminated string with the PEM header (eg. CERTIFICATE)

 * @b64_data: contain the encoded data

 * @result: the place where decoded data will be copied

 * @result_size: holds the size of the result

 *

 * This function will decode the given encoded data.  If the header

 * given is non %NULL this function will search for "-----BEGIN header"

 * and decode only this part.  Otherwise it will decode the first PEM

 * packet found.

 *

 * Returns: On success %GNUTLS_E_SUCCESS (0) is returned,

 *   %GNUTLS_E_SHORT_MEMORY_BUFFER is returned if the buffer given is

 *   not long enough, or 0 on success.

 **/

int

gnutls_pem_base64_decode(const char *header,

			 const gnutls_datum_t * b64_data,

			 unsigned char *result, size_t * result_size)

{

	gnutls_datum_t res;

	int ret;

	ret =

	    _gnutls_fbase64_decode(header, b64_data->data, b64_data->size,

				   &res;;

	if (ret < 0)

		return gnutls_assert_val(ret);

	if (result == NULL || *result_size < (unsigned) res.size) {

		gnutls_free(res.data);

		*result_size = res.size;

		return GNUTLS_E_SHORT_MEMORY_BUFFER;

	} else {

		memcpy(result, res.data, res.size);

		gnutls_free(res.data);

		*result_size = res.size;

	}

	return 0;

}

/**

 * gnutls_pem_base64_decode2:

 * @header: The PEM header (eg. CERTIFICATE)

 * @b64_data: contains the encoded data

 * @result: the location of decoded data

 *

 * This function will decode the given encoded data. The decoded data

 * will be allocated, and stored into result.  If the header given is

 * non null this function will search for "-----BEGIN header" and

 * decode only this part. Otherwise it will decode the first PEM

 * packet found.

 *

 * You should use gnutls_free() to free the returned data.

 *

 * Note, that prior to GnuTLS 3.4.0 this function was available

 * under the name gnutls_pem_base64_decode_alloc(). There is

 * compatibility macro pointing to this function.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise

 *   an error code is returned.

 *

 * Since: 3.4.0

 **/

int

gnutls_pem_base64_decode2(const char *header,

			       const gnutls_datum_t * b64_data,

			       gnutls_datum_t * result)

{

	int ret;

	if (result == NULL)

		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	ret =

	    _gnutls_fbase64_decode(header, b64_data->data, b64_data->size,

				   result);

	if (ret < 0)

		return gnutls_assert_val(ret);

	return 0;

}

/**

 * gnutls_base64_decode2:

 * @base64: contains the encoded data

 * @result: the location of decoded data

 *

 * This function will decode the given base64 encoded data. The decoded data

 * will be allocated, and stored into result.

 *

 * You should use gnutls_free() to free the returned data.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise

 *   an error code is returned.

 *

 * Since: 3.6.0

 **/

int

gnutls_base64_decode2(const gnutls_datum_t *base64,

		      gnutls_datum_t *result)

{

	int ret;

	ret = _gnutls_base64_decode(base64->data, base64->size, result);

	if (ret < 0) {

		return gnutls_assert_val(ret);

	}

	return 0;

}

/**

 * gnutls_base64_encode2:

 * @data: contains the raw data

 * @result: will hold the newly allocated encoded data

 *

 * This function will convert the given data to printable data, using

 * the base64 encoding. This function will allocate the required

 * memory to hold the encoded data.

 *

 * You should use gnutls_free() to free the returned data.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise

 *   an error code is returned.

 *

 * Since: 3.6.0

 **/

int

gnutls_base64_encode2(const gnutls_datum_t *data,

		      gnutls_datum_t *result)

{

	int ret;

	if (result == NULL)

		return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

	ret = _gnutls_fbase64_encode(NULL, data->data, data->size, result);

	if (ret < 0)

		return gnutls_assert_val(ret);

	return 0;

}