/*

 * Copyright (C) 2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "errors.h"

#include "handshake.h"

#include "auth/cert.h"

#include "ext/signature.h"

#include "algorithms.h"

#include "tls13-sig.h"

#include "mbuffers.h"

#include "tls13/certificate_verify.h"

#define SRV_CTX "TLS 1.3, server CertificateVerify"

static const gnutls_datum_t srv_ctx = { (void *)SRV_CTX, sizeof(SRV_CTX) - 1 };

#define CLI_CTX "TLS 1.3, client CertificateVerify"

static const gnutls_datum_t cli_ctx = { (void *)CLI_CTX, sizeof(CLI_CTX) - 1 };

int _gnutls13_recv_certificate_verify(gnutls_session_t session)

{

  int ret;

  gnutls_buffer_st buf;

  const gnutls_sign_entry_st *se;

  gnutls_datum_t sig_data;

  gnutls_certificate_credentials_t cred;

  unsigned vflags;

  gnutls_pcert_st peer_cert;

  cert_auth_info_t info =

    _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);

  bool server = 0;

  gnutls_certificate_type_t cert_type;

  memset(&peer_cert, 0, sizeof(peer_cert));

  /* this message is only expected if we have received

   * a certificate message */

  if (!(session->internals.hsk_flags & HSK_CRT_VRFY_EXPECTED))

    return 0;

  if (session->security_parameters.entity == GNUTLS_SERVER)

    server = 1;

  cred = (gnutls_certificate_credentials_t)_gnutls_get_cred(

    session, GNUTLS_CRD_CERTIFICATE);

  if (unlikely(cred == NULL))

    return gnutls_assert_val(GNUTLS_E_INSUFFICIENT_CREDENTIALS);

  if (unlikely(info == NULL))

    return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);

  ret = _gnutls_recv_handshake(

    session, GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY, 0, &buf);

  if (ret < 0)

    return gnutls_assert_val(ret);

  _gnutls_handshake_log("HSK[%p]: Parsing certificate verify\n", session);

  if (buf.length < 2) {

    gnutls_assert();

    ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;

    goto cleanup;

  }

  se = _gnutls_tls_aid_to_sign_entry(buf.data[0], buf.data[1],

             get_version(session));

  if (se == NULL) {

    _gnutls_handshake_log("Found unsupported signature (%d.%d)\n",

              (int)buf.data[0], (int)buf.data[1]);

    ret = gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);

    goto cleanup;

  }

  if (server)

    gnutls_sign_algorithm_set_client(session, se->id);

  else

    gnutls_sign_algorithm_set_server(session, se->id);

  buf.data += 2;

  buf.length -= 2;

  /* we check during verification whether the algorithm is enabled */

  ret = _gnutls_buffer_pop_datum_prefix16(&buf, &sig_data);

  if (ret < 0) {

    gnutls_assert();

    goto cleanup;

  }

  if (sig_data.size == 0) {

    gnutls_assert();

    ret = GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER;

    goto cleanup;

  }

  /* We verify the certificate of the peer. Therefore we need to

   * retrieve the negotiated certificate type for the peer. */

  cert_type = get_certificate_type(session, GNUTLS_CTYPE_PEERS);

  /* Verify the signature */

  ret = _gnutls_get_auth_info_pcert(&peer_cert, cert_type, info);

  if (ret < 0) {

    gnutls_assert();

    goto cleanup;

  }

  vflags = cred->verify_flags |

     session->internals.additional_verify_flags;

  ret = _gnutls13_handshake_verify_data(session, vflags, &peer_cert,

                server ? (&cli_ctx) : (&srv_ctx),

                &sig_data, se);

  if (ret < 0) {

    gnutls_assert();

    goto cleanup;

  }

  if (buf.length > 0) {

    gnutls_assert();

    ret = GNUTLS_E_UNEXPECTED_PACKET_LENGTH;

    goto cleanup;

  }

  ret = 0;

cleanup:

  gnutls_pcert_deinit(&peer_cert);

  _gnutls_buffer_clear(&buf);

  return ret;

}

int _gnutls13_send_certificate_verify(gnutls_session_t session, unsigned again)

{

  int ret;

  gnutls_pcert_st *apr_cert_list;

  gnutls_privkey_t apr_pkey;

  int apr_cert_list_length;

  mbuffer_st *bufel = NULL;

  gnutls_buffer_st buf;

  gnutls_datum_t sig = { NULL, 0 };

  gnutls_sign_algorithm_t algo;

  const gnutls_sign_entry_st *se;

  bool server = 0;

  if (again == 0) {

    if (!session->internals.initial_negotiation_completed &&

        session->internals.hsk_flags & HSK_PSK_SELECTED)

      return 0;

    if (session->security_parameters.entity == GNUTLS_SERVER &&

        session->internals.resumed)

      return 0;

    if (session->security_parameters.entity == GNUTLS_SERVER)

      server = 1;

    ret = _gnutls_get_selected_cert(session, &apr_cert_list,

            &apr_cert_list_length,

            &apr_pkey);

    if (ret < 0)

      return gnutls_assert_val(ret);

    if (apr_cert_list_length == 0) {

      if (server) {

        return gnutls_assert_val(

          GNUTLS_E_INSUFFICIENT_CREDENTIALS);

      } else {

        /* for client, this means either we

         * didn't get a cert request or we are

         * declining authentication; in either

         * case we don't send a cert verify */

        return 0;

      }

    }

    if (server) {

      algo = _gnutls_session_get_sign_algo(session,

                   &apr_cert_list[0],

                   apr_pkey, 0,

                   GNUTLS_KX_UNKNOWN);

      if (algo == GNUTLS_SIGN_UNKNOWN)

        return gnutls_assert_val(

          GNUTLS_E_INCOMPATIBLE_SIG_WITH_KEY);

      gnutls_sign_algorithm_set_server(session, algo);

    } else {

      /* for client, signature algorithm is already

       * determined from Certificate Request */

      algo = gnutls_sign_algorithm_get_client(session);

      if (unlikely(algo == GNUTLS_SIGN_UNKNOWN))

        return gnutls_assert_val(

          GNUTLS_E_INTERNAL_ERROR);

    }

    se = _gnutls_sign_to_entry(algo);

    ret = _gnutls13_handshake_sign_data(

      session, &apr_cert_list[0], apr_pkey,

      server ? (&srv_ctx) : (&cli_ctx), &sig, se);

    if (ret < 0)

      return gnutls_assert_val(ret);

    ret = _gnutls_buffer_init_handshake_mbuffer(&buf);

    if (ret < 0) {

      gnutls_assert();

      goto cleanup;

    }

    ret = _gnutls_buffer_append_data(&buf, se->aid.id, 2);

    if (ret < 0) {

      gnutls_assert();

      goto cleanup;

    }

    ret = _gnutls_buffer_append_data_prefix(&buf, 16, sig.data,

              sig.size);

    if (ret < 0) {

      gnutls_assert();

      goto cleanup;

    }

    bufel = _gnutls_buffer_to_mbuffer(&buf);

    gnutls_free(sig.data);

  }

  return _gnutls_send_handshake(session, bufel,

              GNUTLS_HANDSHAKE_CERTIFICATE_VERIFY);

cleanup:

  gnutls_free(sig.data);

  _gnutls_buffer_clear(&buf);

  return ret;

}