#include <config.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <utils.h>
#include <stdlib.h>
#include <gnutls/gnutls.h>
#include <gnutls/crypto.h>
#include <gnutls/abstract.h>
#include <gnutls/x509.h>
#include <assert.h>

unsigned audit_called = 0;

/* This does check the FIPS140 override support with
 * gnutls_fips140_set_mode().
 */

static void tls_log_func(int level, const char *str)
{
	fprintf(stderr, "<%d>| %s", level, str);
}

static void audit_log_func(gnutls_session_t session, const char *str)
{
	audit_called = 1;
}


static void try_crypto(void)
{
	static uint8_t key16[16];
	static uint8_t iv16[16];
	gnutls_datum_t key = { key16, sizeof(key16) };
	gnutls_datum_t iv = { iv16, sizeof(iv16) };
	gnutls_cipher_hd_t ch;
	gnutls_hmac_hd_t mh;
	int ret;
	gnutls_x509_privkey_t privkey;

	ret =
	    gnutls_cipher_init(&ch, GNUTLS_CIPHER_ARCFOUR_128, &key, &iv);
	if (ret < 0) {
		fail("gnutls_cipher_init failed\n");
	}
	gnutls_cipher_deinit(ch);

	ret =
	    gnutls_cipher_init(&ch, GNUTLS_CIPHER_AES_128_CBC, &key, &iv);
	if (ret < 0) {
		fail("gnutls_cipher_init failed\n");
	}
	gnutls_cipher_deinit(ch);

	ret = gnutls_hmac_init(&mh, GNUTLS_MAC_MD5, key.data, key.size);
	if (ret < 0) {
		fail("gnutls_hmac_init failed\n");
	}
	gnutls_hmac_deinit(mh, NULL);

	ret = gnutls_hmac_init(&mh, GNUTLS_MAC_SHA1, key.data, key.size);
	if (ret < 0) {
		fail("gnutls_hmac_init failed\n");
	}
	gnutls_hmac_deinit(mh, NULL);

	ret = gnutls_rnd(GNUTLS_RND_NONCE, key16, sizeof(key16));
	if (ret < 0) {
		fail("gnutls_rnd failed\n");
	}

	assert(gnutls_x509_privkey_init(&privkey) == 0);
	ret = gnutls_x509_privkey_generate(privkey, GNUTLS_PK_RSA, 512, 0);
	if (ret < 0) {
		fail("gnutls_x509_privkey_generate failed for 512-bit key\n");
	}
	gnutls_x509_privkey_deinit(privkey);
}

void doit(void)
{
	int ret;
	unsigned int mode;

	fprintf(stderr,
		"Please note that if in FIPS140 mode, you need to assure the library's integrity prior to running this test\n");

	gnutls_global_set_log_function(tls_log_func);
	gnutls_global_set_audit_log_function(audit_log_func);
	if (debug)
		gnutls_global_set_log_level(4711);

	mode = gnutls_fips140_mode_enabled();
	if (mode == 0) {
		success("We are not in FIPS140 mode\n");
		exit(77);
	}

	ret = global_init();
	if (ret < 0) {
		fail("Cannot initialize library\n");
	}

	/* switch to lax mode and check whether forbidden algorithms are accessible */
	gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, 0);

	try_crypto();

	/* check whether audit log was called */
	if (audit_called) {
		fail("the audit function was called in lax mode!\n");
	}

	gnutls_fips140_set_mode(GNUTLS_FIPS140_LOG, 0);

	try_crypto();

	/* check whether audit log was called */
	if (!audit_called) {
		fail("the audit function was not called in log mode!\n");
	}

	gnutls_fips140_set_mode(GNUTLS_FIPS140_SELFTESTS, 0);
	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT)
		fail("switching to selftests didn't switch the lib to the expected mode\n");

	gnutls_fips140_set_mode(532, 0);
	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT)
		fail("switching to unknown mode didn't switch the lib to the expected mode\n");

	GNUTLS_FIPS140_SET_LAX_MODE();
	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_LAX)
		fail("switching to lax mode did not succeed!\n");

	GNUTLS_FIPS140_SET_STRICT_MODE();
	if (gnutls_fips140_mode_enabled() != GNUTLS_FIPS140_STRICT)
		fail("switching to strict mode did not succeed!\n");

	gnutls_global_deinit();
	return;
}