/*

 * Copyright (C) 2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * GnuTLS is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 3 of the License, or

 * (at your option) any later version.

 *

 * GnuTLS is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 */

#include <assert.h>

typedef struct test_case_st {

	const char *name;

	int server_ret;

	int client_ret;

	unsigned have_anon_cred;

	unsigned have_anon_dh_params;

	unsigned have_anon_exp_dh_params;

	unsigned have_srp_cred;

	unsigned have_psk_cred;

	unsigned have_psk_dh_params;

	unsigned have_psk_exp_dh_params;

	unsigned have_cert_cred;

	unsigned have_cert_dh_params;

	unsigned have_cert_exp_dh_params;

	unsigned have_rsa_sign_cert;

	unsigned have_ecc_sign_cert;

	unsigned have_ed25519_sign_cert;

	unsigned have_rsa_decrypt_cert;

	unsigned have_gost12_256_cert;

	unsigned have_gost12_512_cert;

	unsigned not_on_fips;

	unsigned exp_version;

	const char *client_prio;

	const char *server_prio;

} test_case_st;

static int

serv_psk_func(gnutls_session_t session, const char *username,

	gnutls_datum_t * key) {

	key->data = gnutls_malloc(4);

	assert(key->data != NULL);

	key->data[0] = 0xDE;

	key->data[1] = 0xAD;

	key->data[2] = 0xBE;

	key->data[3] = 0xEF;

	key->size = 4;

	return 0;

}

#define SALT_TEST1 "3a3xX3Myzb9YJn5X0R7sbx"

#define VERIF_TEST1 "CEqjUZBlkQCocfOR0E4AsPZKOFYPGjKFMHW7KDcnpE4sH4.iGMbkygb/bViRNjskF9/TQdD46Mvlt6pLs5MZoTn8mO3G.RGyXdWuIrhnVn29p41Cpc5RhTLaeUm3asW6LF60VTKnGERC0eB37xZUsaTpzmaTNdD4mOoYCN3bD9Y"

#define PRIME "Ewl2hcjiutMd3Fu2lgFnUXWSc67TVyy2vwYCKoS9MLsrdJVT9RgWTCuEqWJrfB6uE3LsE9GkOlaZabS7M29sj5TnzUqOLJMjiwEzArfiLr9WbMRANlF68N5AVLcPWvNx6Zjl3m5Scp0BzJBz9TkgfhzKJZ.WtP3Mv/67I/0wmRZ"

gnutls_datum_t tprime = 

{

	.data = (void*)PRIME,

	.size = sizeof(PRIME)-1

};

gnutls_datum_t test1_verif = 

{

	.data = (void*)VERIF_TEST1,

	.size = sizeof(VERIF_TEST1)-1

};

gnutls_datum_t test1_salt = 

{

	.data = (void*)SALT_TEST1,

	.size = sizeof(SALT_TEST1)-1

};

const char *side;

#define switch_side(str) side = str

static void tls_log_func(int level, const char *str)

{

	fprintf(stderr, "%s|<%d>| %s", side, level, str);

}

static int

serv_srp_func(gnutls_session_t session, const char *username,

	      gnutls_datum_t *salt, gnutls_datum_t *verifier, gnutls_datum_t *generator,

	      gnutls_datum_t *prime)

{

	int ret;

	if (debug)

		printf("srp: username %s\n", username);

	generator->data = gnutls_malloc(1);

	generator->data[0] = 2;

	generator->size = 1;

	ret = gnutls_srp_base64_decode2(&tprime, prime);

	if (ret < 0)

		fail("error in gnutls_srp_base64_decode2 -prime\n");

	if (strcmp(username, "test1") == 0) {

		ret = gnutls_srp_base64_decode2(&test1_verif, verifier);

		if (ret < 0)

			fail("error in gnutls_srp_base64_decode2 -verif\n");

		ret = gnutls_srp_base64_decode2(&test1_salt, salt);

		if (ret < 0)

			fail("error in gnutls_srp_base64_decode2 -salt\n");

	} else {

		fail("Unknown username %s\n", username);

	}

	return 0;

}

static void try(test_case_st *test)

{

	int sret, cret, ret;

	gnutls_anon_client_credentials_t c_anon_cred;

	gnutls_anon_server_credentials_t s_anon_cred;

	gnutls_psk_client_credentials_t c_psk_cred;

	gnutls_psk_server_credentials_t s_psk_cred;

	gnutls_certificate_credentials_t s_cert_cred;

	gnutls_certificate_credentials_t c_cert_cred;

	gnutls_srp_server_credentials_t s_srp_cred;

	gnutls_srp_client_credentials_t c_srp_cred;

	const gnutls_datum_t p3_2048 =

	    { (void *)pkcs3_2048, strlen(pkcs3_2048) };

	gnutls_dh_params_t dh_params = NULL;

	gnutls_session_t server, client;

	const gnutls_datum_t pskkey = { (void *) "DEADBEEF", 8 };

	if (test->not_on_fips && gnutls_fips140_mode_enabled()) {

		success("Skipping %s...\n", test->name);

		return;

	}

	success("Running %s...\n", test->name);

	/* General init. */

	gnutls_global_set_log_function(tls_log_func);

	if (debug)

		gnutls_global_set_log_level(6);

	assert(gnutls_anon_allocate_client_credentials(&c_anon_cred) >= 0);

	assert(gnutls_anon_allocate_server_credentials(&s_anon_cred) >= 0);

	assert(gnutls_psk_allocate_client_credentials(&c_psk_cred) >= 0);

	assert(gnutls_psk_allocate_server_credentials(&s_psk_cred) >= 0);

	assert(gnutls_srp_allocate_client_credentials(&c_srp_cred) >= 0);

	assert(gnutls_srp_allocate_server_credentials(&s_srp_cred) >= 0);

	assert(gnutls_certificate_allocate_credentials(&s_cert_cred) >= 0);

	assert(gnutls_certificate_allocate_credentials(&c_cert_cred) >= 0);

	assert(gnutls_dh_params_init(&dh_params) >= 0);

	assert(gnutls_init(&server, GNUTLS_SERVER)>=0);

	assert(gnutls_init(&client, GNUTLS_CLIENT)>=0);

	if (test->have_anon_cred) {

		gnutls_credentials_set(server, GNUTLS_CRD_ANON, s_anon_cred);

		if (test->have_anon_dh_params)

			gnutls_anon_set_server_known_dh_params(s_anon_cred, GNUTLS_SEC_PARAM_MEDIUM);

		else if (test->have_anon_exp_dh_params) {

			ret = gnutls_dh_params_import_pkcs3(dh_params, &p3_2048,

							    GNUTLS_X509_FMT_PEM);

			assert(ret>=0);

			gnutls_anon_set_server_dh_params(s_anon_cred, dh_params);

		}

	}

	if (test->have_cert_cred) {

		gnutls_credentials_set(server, GNUTLS_CRD_CERTIFICATE, s_cert_cred);

		if (test->have_cert_dh_params)

			gnutls_certificate_set_known_dh_params(s_cert_cred, GNUTLS_SEC_PARAM_MEDIUM);

		else if (test->have_cert_exp_dh_params) {

			ret = gnutls_dh_params_import_pkcs3(dh_params, &p3_2048,

							    GNUTLS_X509_FMT_PEM);

			assert(ret>=0);

			gnutls_certificate_set_dh_params(s_cert_cred, dh_params);

		}

	}

	if (test->have_psk_cred) {

		gnutls_credentials_set(server, GNUTLS_CRD_PSK, s_psk_cred);

		if (test->have_psk_dh_params)

			gnutls_psk_set_server_known_dh_params(s_psk_cred, GNUTLS_SEC_PARAM_MEDIUM);

		else if (test->have_psk_exp_dh_params) {

			ret = gnutls_dh_params_import_pkcs3(dh_params, &p3_2048,

							    GNUTLS_X509_FMT_PEM);

			assert(ret>=0);

			gnutls_psk_set_server_dh_params(s_psk_cred, dh_params);

		}

		gnutls_psk_set_server_credentials_function(s_psk_cred, serv_psk_func);

	}

	if (test->have_srp_cred) {

		gnutls_credentials_set(server, GNUTLS_CRD_SRP, s_srp_cred);

		gnutls_srp_set_server_credentials_function(s_srp_cred, serv_srp_func);

	}

	if (test->have_rsa_decrypt_cert) {

		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_rsa_decrypt_cert, &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);

	}

	if (test->have_ecc_sign_cert) {

		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_ecc_cert, &server_ca3_ecc_key, GNUTLS_X509_FMT_PEM) >= 0);

	}

	if (test->have_ed25519_sign_cert) {

		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_eddsa_cert, &server_ca3_eddsa_key, GNUTLS_X509_FMT_PEM) >= 0);

	}

	if (test->have_rsa_sign_cert) {

		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_localhost_rsa_sign_cert, &server_ca3_key, GNUTLS_X509_FMT_PEM) >= 0);

	}

	if (test->have_gost12_256_cert) {

		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_gost12_256_cert, &server_ca3_gost12_256_key, GNUTLS_X509_FMT_PEM) >= 0);

	}

	if (test->have_gost12_512_cert) {

		assert(gnutls_certificate_set_x509_key_mem(s_cert_cred, &server_ca3_gost12_512_cert, &server_ca3_gost12_512_key, GNUTLS_X509_FMT_PEM) >= 0);

	}

	/* client does everything */

	gnutls_credentials_set(client, GNUTLS_CRD_ANON, c_anon_cred);

	gnutls_credentials_set(client, GNUTLS_CRD_CERTIFICATE, c_cert_cred);

	gnutls_credentials_set(client, GNUTLS_CRD_PSK, c_psk_cred);

	gnutls_credentials_set(client, GNUTLS_CRD_SRP, c_srp_cred);

	assert(gnutls_psk_set_client_credentials(c_psk_cred, "psk", &pskkey, GNUTLS_PSK_KEY_HEX) >= 0);

	assert(gnutls_srp_set_client_credentials(c_srp_cred, "test1", "test") >= 0);

	gnutls_transport_set_push_function(server, server_push);

	gnutls_transport_set_pull_function(server, server_pull);

	gnutls_transport_set_ptr(server, server);

	assert(gnutls_priority_set_direct(server, test->server_prio, 0) >= 0);

	gnutls_transport_set_push_function(client, client_push);

	gnutls_transport_set_pull_function(client, client_pull);

	gnutls_transport_set_ptr(client, client);

	assert(gnutls_priority_set_direct(client, test->client_prio, 0) >= 0);

	HANDSHAKE_EXPECT(client, server, test->client_ret, test->server_ret);

	if (test->client_ret == 0 && test->server_ret == 0 && test->exp_version) {

		if (gnutls_protocol_get_version(client) != test->exp_version)

			fail("expected version (%s) does not match %s\n",

			     gnutls_protocol_get_name(test->exp_version),

			     gnutls_protocol_get_name(gnutls_protocol_get_version(client)));

	}

	gnutls_deinit(server);

	gnutls_deinit(client);

	gnutls_anon_free_client_credentials(c_anon_cred);

	gnutls_anon_free_server_credentials(s_anon_cred);

	gnutls_psk_free_client_credentials(c_psk_cred);

	gnutls_psk_free_server_credentials(s_psk_cred);

	gnutls_srp_free_client_credentials(c_srp_cred);

	gnutls_srp_free_server_credentials(s_srp_cred);

	gnutls_certificate_free_credentials(s_cert_cred);

	gnutls_certificate_free_credentials(c_cert_cred);

	if (dh_params)

		gnutls_dh_params_deinit(dh_params);

	reset_buffers();

}