/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/.

 *

 *    Copyright 2014-2020 (c) Fraunhofer IOSB (Author: Julius Pfrommer)

 *    Copyright 2014, 2016-2017 (c) Florian Palm

 *    Copyright 2015-2016 (c) Sten Grüner

 *    Copyright 2015 (c) Oleksiy Vasylyev

 *    Copyright 2016 (c) TorbenD

 *    Copyright 2017 (c) Stefan Profanter, fortiss GmbH

 *    Copyright 2017-2018 (c) Mark Giraud, Fraunhofer IOSB

 *    Copyright 2025 (c) o6 Automation GmbH (Author: Julius Pfrommer)

 *    Copyright 2026 (c) o6 Automation GmbH (Author: Andreas Ebner)

 */

#include "open62541/transport_generated.h"

#include "ua_securechannel.h"

#include "ua_types_encoding_binary.h"

UA_StatusCode

UA_CertificateUtils_checkExtendedKeyUsage(const UA_ByteString *certificate,

                                          UA_CertificateEku requestedUsage,

                                          UA_Boolean ekuRequired) {

    UA_CertificateEku eku = UA_CERTIFICATEEKU_NONE;

    UA_StatusCode res =

        UA_CertificateUtils_getExtendedKeyUsage(certificate, &eku);

    if(res != UA_STATUSCODE_GOOD)

        return res;

    if(eku == UA_CERTIFICATEEKU_NONE)

        return ekuRequired ? UA_STATUSCODE_BADCERTIFICATEUSENOTALLOWED :

            UA_STATUSCODE_GOOD;

    if((eku & (requestedUsage | UA_CERTIFICATEEKU_ANY)) != 0)

        return UA_STATUSCODE_GOOD;

    return UA_STATUSCODE_BADCERTIFICATEUSENOTALLOWED;

}

UA_StatusCode

UA_SecureChannel_generateLocalNonce(UA_SecureChannel *channel) {

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    UA_CHECK_MEM(sp, return UA_STATUSCODE_BADINTERNALERROR);

    UA_LOG_DEBUG_CHANNEL(sp->logger, channel, "Generating new local nonce");

    /* Is the length of the previous nonce correct? The SecureChannel nonce has

     * exactly the SecureChannelNonceLength of the SecurityPolicy (Part 7).

     * E.g. 16 byte for Basic128Rsa15; other stacks reject a longer nonce

     * with Bad_NonceInvalid. */

    size_t nonceLength = sp->nonceLength;

    if(nonceLength == 0)

        return UA_STATUSCODE_GOOD;

    if(channel->localNonce.length != nonceLength) {

        UA_ByteString_clear(&channel->localNonce);

        UA_StatusCode res = UA_ByteString_allocBuffer(&channel->localNonce, nonceLength);

        UA_CHECK_STATUS(res, return res);

    }

    /* Generate the nonce */

    channel->localNonce.data[0] = 'e';

    channel->localNonce.data[1] = 'p';

    channel->localNonce.data[2] = 'h';

    return sp->generateNonce(sp, channel->channelContext, &channel->localNonce);

}

/* OPC UA Part 6 v1.05.07 §6.8.1 step 2 "Extract" — IKM chaining (enhanced

 * policies only). The IKM is XORed with the new shared secret on each renewal;

 * the accumulator is the curve's coordinate size (half the nonceLength, e.g. 32

 * bytes for P-256). It is carried through sp->generateKey without changing that

 * signature by prepending it to the `secret` ByteString: the backend's

 * DeriveKeys helper detects the prepend (key1 longer than the ephemeral public

 * key), XORs, and writes the chained IKM back into the slot. */

#define IKM_PREPEND_LENGTH(channel) \

    ((channel)->enhancedSecurity ? ((channel)->securityPolicy->nonceLength / 2) : 0)

/* Allocate and fill the prepend buffer [currentIKM | nonce] when

 * chaining is active; otherwise point *outInput at the original

 * nonce. The caller frees *outCombined with UA_ByteString_clear. */

static UA_StatusCode

prepareKeyInput(UA_SecureChannel *channel, const UA_ByteString *nonce,

                UA_ByteString *outInput, UA_ByteString *outCombined) {

    size_t ikmLen = IKM_PREPEND_LENGTH(channel);

    if(ikmLen == 0) {

        *outInput = *nonce;

        *outCombined = UA_BYTESTRING_NULL;

        return UA_STATUSCODE_GOOD;

    }

    UA_StatusCode res =

        UA_ByteString_allocBuffer(outCombined, ikmLen + nonce->length);

    if(res != UA_STATUSCODE_GOOD)

        return res;

    if(channel->currentIKM.length == ikmLen)

        memcpy(outCombined->data, channel->currentIKM.data, ikmLen);

    else

        memset(outCombined->data, 0, ikmLen);

    memcpy(outCombined->data + ikmLen, nonce->data, nonce->length);

    *outInput = *outCombined;

    return UA_STATUSCODE_GOOD;

}

/* Pull the (possibly updated) IKM from the prepend slot and store

 * it as channel->currentIKM. Called only by the local-keys pass;

 * the remote-keys pass leaves the accumulator untouched. */

static UA_StatusCode

captureIKMSlot(UA_SecureChannel *channel, const UA_ByteString *combined) {

    size_t ikmLen = IKM_PREPEND_LENGTH(channel);

    if(ikmLen == 0)

        return UA_STATUSCODE_GOOD;

    UA_ByteString_clear(&channel->currentIKM);

    UA_ByteString ikmSlot = {ikmLen, combined->data};

    return UA_ByteString_copy(&ikmSlot, &channel->currentIKM);

}

/* OPC UA Part 6, 6.8.1 Step 1: "When not using AuthenticatedEncryption with

 * Sign only, the EncryptionKeyLength and InitializationVectorLength are set to

 * 0 in the calculation of L." L is part of the HKDF salt and the length of the

 * derived key material, so only the signing key is derived for the ECC

 * policies without AEAD in the SecurityMode Sign. The encrypting key and IV

 * are not used in this mode and stay zeroed. */

static size_t

derivedKeyMaterialLength(const UA_SecureChannel *channel, size_t signKL,

                         size_t totalLength) {

    if(channel->securityPolicy->policyType == UA_SECURITYPOLICYTYPE_ECC &&

       channel->securityMode == UA_MESSAGESECURITYMODE_SIGN)

        return signKL;

    return totalLength;

}

UA_StatusCode

UA_SecureChannel_generateLocalKeys(UA_SecureChannel *channel) {

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    UA_CHECK_MEM(sp, return UA_STATUSCODE_BADINTERNALERROR);

    UA_LOG_DEBUG_CHANNEL(sp->logger, channel, "Generating new local keys");

    void *cc = channel->channelContext;

    const UA_SecurityPolicyEncryptionAlgorithm *ea = &sp->symEncryptionAlgorithm;

    /* Generate symmetric key buffer of the required length. The block size is

     * identical for local/remote. For AEAD ciphers the IV length differs from

     * the block size, so use getLocalIvLength when available. */

    UA_ByteString buf;

    size_t encrKL = ea->getLocalKeyLength(sp, cc);

    size_t encrBS = ea->getRemoteBlockSize(sp, cc);

    size_t ivLen = ea->getLocalIvLength ? ea->getLocalIvLength(sp, cc) : encrBS;

    size_t signKL = sp->symSignatureAlgorithm.getLocalKeyLength(sp, cc);

    if(ivLen + signKL + encrKL == 0)

        return UA_STATUSCODE_GOOD; /* No keys to generate */

    UA_StatusCode res = UA_ByteString_allocBuffer(&buf, ivLen + signKL + encrKL);

    UA_CHECK_STATUS(res, return res);

    UA_ByteString localSigningKey = {signKL, buf.data};

    UA_ByteString localEncryptingKey = {encrKL, &buf.data[signKL]};

    UA_ByteString localIv = {ivLen, &buf.data[signKL + encrKL]};

    memset(buf.data, 0, buf.length);

    UA_ByteString derived = {

        derivedKeyMaterialLength(channel, signKL, buf.length), buf.data};

    /* Build the IKM-prefixed `secret` input (the helper detects

     * the prepend via the length mismatch against the local

     * ephemeral public key). The `seed` arg is passed unchanged —

     * the helper uses it as the alternate ephemeral public key

     * candidate and as part of the salt, so the prepend must not

     * appear there. */

    UA_ByteString secretInput, seedInput = channel->localNonce;

    UA_ByteString secretCombined = UA_BYTESTRING_NULL;

    res = prepareKeyInput(channel, &channel->remoteNonce,

                         &secretInput, &secretCombined);

    UA_CHECK_STATUS(res, goto error);

    /* Generate key. The policy's wrapper detects the prepend (via the

     * length mismatch in key1 vs the local ephemeral public key) and

     * performs the IKM chaining, deriving against the *previous*

     * accumulator (channel->currentIKM). The new accumulator is NOT

     * promoted here: the local- and remote-keys passes of one OPN must

     * both derive against the same previous accumulator, so the

     * advance to IKM_n happens exactly once, in generateRemoteKeys

     * (the last of the two passes). */

    res = sp->generateKey(sp, cc, &secretInput, &seedInput, &derived);

    UA_CHECK_STATUS(res, goto error);

    /* Set the channel context */

    res |= sp->setLocalSymSigningKey(sp, cc, &localSigningKey);

    res |= sp->setLocalSymEncryptingKey(sp, cc, &localEncryptingKey);

    res |= sp->setLocalSymIv(sp, cc, &localIv);

 error:

    if(res != UA_STATUSCODE_GOOD) {

        UA_LOG_ERROR_CHANNEL(sp->logger, channel,

                             "Could not generate local keys (%s)",

                             UA_StatusCode_name(res));

    }

    UA_ByteString_clear(&buf);

    UA_ByteString_clear(&secretCombined);

    return res;

}

UA_StatusCode

generateRemoteKeys(UA_SecureChannel *channel) {

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    UA_CHECK_MEM(sp, return UA_STATUSCODE_BADINTERNALERROR);

    UA_LOG_DEBUG_CHANNEL(sp->logger, channel, "Generating new remote keys");

    void *cc = channel->channelContext;

    const UA_SecurityPolicyEncryptionAlgorithm *ea = &sp->symEncryptionAlgorithm;

    /* Generate symmetric key buffer of the required length. For AEAD ciphers

     * the IV length differs from the block size, so use getLocalIvLength when

     * available. */

    UA_ByteString buf;

    size_t encrKL = ea->getRemoteKeyLength(sp, cc);

    size_t encrBS = ea->getRemoteBlockSize(sp, cc);

    size_t ivLen = ea->getLocalIvLength ? ea->getLocalIvLength(sp, cc) : encrBS;

    size_t signKL = sp->symSignatureAlgorithm.getRemoteKeyLength(sp, cc);

    if(ivLen + signKL + encrKL == 0)

        return UA_STATUSCODE_GOOD; /* No keys to generate */

    UA_StatusCode res = UA_ByteString_allocBuffer(&buf, ivLen + signKL + encrKL);

    UA_CHECK_STATUS(res, return res);

    UA_ByteString remoteSigningKey = {signKL, buf.data};

    UA_ByteString remoteEncryptingKey = {encrKL, &buf.data[signKL]};

    UA_ByteString remoteIv = {ivLen, &buf.data[signKL + encrKL]};

    memset(buf.data, 0, buf.length);

    UA_ByteString derived = {

        derivedKeyMaterialLength(channel, signKL, buf.length), buf.data};

    /* Build the IKM-prefixed `secret` input. Both the local- and

     * remote-keys passes of one OPN derive against the *same* previous

     * accumulator (channel->currentIKM); generateLocalKeys deliberately

     * did not advance it. The `seed` arg is passed unchanged — the

     * helper uses it as the alternate ephemeral public key candidate

     * and as part of the salt, so the prepend must not appear there. */

    UA_ByteString secretInput, seedInput = channel->remoteNonce;

    UA_ByteString secretCombined = UA_BYTESTRING_NULL;

    res = prepareKeyInput(channel, &channel->localNonce,

                         &secretInput, &secretCombined);

    UA_CHECK_STATUS(res, goto error);

    /* Generate key. The policy's wrapper XORs the previous accumulator

     * with the new shared secret and writes the result (IKM_n) back

     * into secretCombined. */

    res = sp->generateKey(sp, cc, &secretInput, &seedInput, &derived);

    UA_CHECK_STATUS(res, goto error);

    /* This is the last derivation of the OPN: promote the just-updated

     * IKM slot into channel->currentIKM so the next renewal chains from

     * IKM_n. (On the first OPN currentIKM was empty, so IKM_0 == the raw

     * shared secret for both passes — matching the spec's "no chaining

     * on the first OpenSecureChannel".) */

    res = captureIKMSlot(channel, &secretCombined);

    if(res != UA_STATUSCODE_GOOD) {

        res = UA_STATUSCODE_BADOUTOFMEMORY;

        goto error;

    }

    /* Set the channel context */

    res |= sp->setRemoteSymSigningKey(sp, cc, &remoteSigningKey);

    res |= sp->setRemoteSymEncryptingKey(sp, cc, &remoteEncryptingKey);

    res |= sp->setRemoteSymIv(sp, cc, &remoteIv);

 error:

    if(res != UA_STATUSCODE_GOOD) {

        UA_LOG_ERROR_CHANNEL(sp->logger, channel,

                               "Could not generate remote keys (%s)",

                               UA_StatusCode_name(res));

    }

    UA_ByteString_clear(&buf);

    UA_ByteString_clear(&secretCombined);

    return res;

}

/* v1.05.07 channel-bound SignatureData (SecureChannelEnhancements): the

 * CreateSession / ActivateSession signatures are bound to the SecureChannel by

 * prepending the ChannelThumbprint and including certificate hashes (not the

 * raw certs). */

/* The certificate hash is provided by the crypto backend via the global

 * UA_SecurityPolicy_hashCertificate (the algorithm is derived from the policy

 * URI). Wrapped here so this file links without a crypto backend - the

 * builders below are only reached at runtime for enhanced-security policies,

 * which only exist when encryption is enabled. */

#ifdef UA_ENABLE_ENCRYPTION

static UA_StatusCode

hashCert(const UA_SecurityPolicy *sp, const UA_ByteString *cert,

         UA_ByteString *hash) {

    return UA_SecurityPolicy_hashCertificate(sp, cert, hash);

}

#else

static UA_StatusCode

hashCert(const UA_SecurityPolicy *sp, const UA_ByteString *cert,

         UA_ByteString *hash) {

    (void)sp; (void)cert; (void)hash;

    return UA_STATUSCODE_BADINTERNALERROR;

}

#endif

/* Assemble a channel-bound SignatureData (OPC UA Part 6 v1.05.07,

 * SecureChannelEnhancements). All three share the shape

 *   channelThumbprint | nonceA | H(cert_0) .. H(cert_n-1) | nonceB

 * and differ only in which certificate hashes appear and the nonce order:

 *

 *   CreateSession ServerSignature   (server signs, client verifies):

 *     TP | clientNonce | H(serverChannelCert) | H(clientChannelCert) | serverNonce

 *   ActivateSession ClientSignature (client signs, server verifies):

 *     TP | serverNonce | H(serverAppCert) | H(serverChannelCert) |

 *                        H(clientChannelCert) | clientNonce

 *   ActivateSession user-token sig  (client signs w/ user key, server verifies):

 *     TP | serverNonce | H(serverAppCert) | H(serverChannelCert) |

 *                        H(clientAppCert) | H(clientChannelCert) | clientNonce

 *

 * H() = the policy's curve hash of the leaf DER. Both peers must produce the

 * SAME bytes, so each side maps the logical certificate roles onto its own

 * local vs. remote view (the certs are channel-scoped: app == channel cert in

 * open62541, hence the duplicated hashes). The user/X.509-token certificate is

 * NOT part of the signed data (it is conveyed and validated separately).

 *

 *   logical cert role      server passes               client passes

 *   --------------------------------------------------------------------------

 *   server App / Channel   sp->localCertificate        channel->remoteCertificate

 *   client App / Channel   channel->remoteCertificate  sp->localCertificate

 *

 *   serverNonce = the session ServerNonce, clientNonce = the session

 *   ClientNonce (the same value on both sides). */

#define UA_MAX_SIGDATA_CERTS 4

static UA_StatusCode

buildChannelBoundSignatureData(const UA_SecureChannel *channel,

                               const UA_ByteString *firstNonce,

                               const UA_ByteString *const *certs, size_t certCount,

                               const UA_ByteString *lastNonce, UA_ByteString *out) {

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    if(!sp || !channel->enhancedSecurity || certCount > UA_MAX_SIGDATA_CERTS ||

       channel->channelThumbprint.length == 0)

        return UA_STATUSCODE_BADINTERNALERROR;

    /* Hash the certificates. The inputs may be DER chains (e.g. the OPN

     * SenderCertificate stored in remoteCertificate), so hash only the leaf -

     * independent of how a given crypto backend's hashCert handles a chain. */

    UA_ByteString hashes[UA_MAX_SIGDATA_CERTS];

    for(size_t i = 0; i < UA_MAX_SIGDATA_CERTS; i++)

        hashes[i] = UA_BYTESTRING_NULL;

    UA_StatusCode res = UA_STATUSCODE_GOOD;

    size_t hashesLen = 0;

    for(size_t i = 0; i < certCount && res == UA_STATUSCODE_GOOD; i++) {

        UA_ByteString leaf = getLeafCertificate(*certs[i]);

        res = hashCert(sp, &leaf, &hashes[i]);

        hashesLen += hashes[i].length;

    }

    if(res != UA_STATUSCODE_GOOD)

        goto cleanup;

    /* channelThumbprint | firstNonce | hashes | lastNonce */

    const UA_ByteString *tp = &channel->channelThumbprint;

    res = UA_ByteString_allocBuffer(out, tp->length + firstNonce->length +

                                    hashesLen + lastNonce->length);

    if(res != UA_STATUSCODE_GOOD)

        goto cleanup;

    size_t o = 0;

    memcpy(out->data + o, tp->data, tp->length); o += tp->length;

    memcpy(out->data + o, firstNonce->data, firstNonce->length); o += firstNonce->length;

    for(size_t i = 0; i < certCount; i++) {

        memcpy(out->data + o, hashes[i].data, hashes[i].length);

        o += hashes[i].length;

    }

    memcpy(out->data + o, lastNonce->data, lastNonce->length);

 cleanup:

    for(size_t i = 0; i < certCount; i++)

        UA_ByteString_clear(&hashes[i]);

    return res;

}

/* CreateSession ServerSignature (see the layout table above). */

UA_StatusCode

UA_SecureChannel_buildCreateSessionSignatureData(

    const UA_SecureChannel *channel, const UA_ByteString *clientNonce,

    const UA_ByteString *serverNonce, const UA_ByteString *serverChannelCert,

    const UA_ByteString *clientChannelCert, UA_ByteString *out) {

    const UA_ByteString *certs[] = {serverChannelCert, clientChannelCert};

    return buildChannelBoundSignatureData(channel, clientNonce, certs, 2,

                                          serverNonce, out);

}

/* ActivateSession ClientSignature (see the layout table above). */

UA_StatusCode

UA_SecureChannel_buildActivateSessionSignatureData(

    const UA_SecureChannel *channel, const UA_ByteString *serverNonce,

    const UA_ByteString *clientNonce, const UA_ByteString *serverAppCert,

    const UA_ByteString *serverChannelCert, const UA_ByteString *clientChannelCert,

    UA_ByteString *out) {

    const UA_ByteString *certs[] = {serverAppCert, serverChannelCert, clientChannelCert};

    return buildChannelBoundSignatureData(channel, serverNonce, certs, 3,

                                          clientNonce, out);

}

/* ActivateSession X.509 user-token signature (see the layout table above). */

UA_StatusCode

UA_SecureChannel_buildUserTokenSignatureData(

    const UA_SecureChannel *channel, const UA_ByteString *serverNonce,

    const UA_ByteString *clientNonce, const UA_ByteString *serverAppCert,

    const UA_ByteString *serverChannelCert, const UA_ByteString *clientAppCert,

    const UA_ByteString *clientChannelCert, UA_ByteString *out) {

    const UA_ByteString *certs[] = {serverAppCert, serverChannelCert,

                                    clientAppCert, clientChannelCert};

    return buildChannelBoundSignatureData(channel, serverNonce, certs, 4,

                                          clientNonce, out);

}

/***************************/

/* Send Asymmetric Message */

/***************************/

/* The length of the static header content */

#define UA_SECURECHANNEL_ASYMMETRIC_SECURITYHEADER_FIXED_LENGTH 12

size_t

calculateAsymAlgSecurityHeaderLength(const UA_SecureChannel *channel) {

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    UA_CHECK_MEM(sp, return UA_STATUSCODE_BADINTERNALERROR);

    size_t asymHeaderLength = UA_SECURECHANNEL_ASYMMETRIC_SECURITYHEADER_FIXED_LENGTH;

    if(sp->policyUri.length > SIZE_MAX - asymHeaderLength)

        return SIZE_MAX;

    asymHeaderLength += sp->policyUri.length;

    if(channel->securityMode == UA_MESSAGESECURITYMODE_NONE)

        return asymHeaderLength;

    /* OPN is always encrypted even if the mode is sign only */

    if(asymHeaderLength > SIZE_MAX - 20)

        return SIZE_MAX;

    asymHeaderLength += 20; /* Thumbprints are always 20 byte long */

    if(sp->localCertificate.length > SIZE_MAX - asymHeaderLength)

        return SIZE_MAX;

    asymHeaderLength += sp->localCertificate.length;

    return asymHeaderLength;

}

UA_StatusCode

prependHeadersAsym(UA_SecureChannel *const channel, UA_Byte *header_pos,

                   const UA_Byte *buf_end, size_t totalLength,

                   size_t securityHeaderLength, UA_UInt32 requestId,

                   size_t *const encryptedLength) {

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    UA_CHECK_MEM(sp, return UA_STATUSCODE_BADINTERNALERROR);

    void *cc = channel->channelContext;

    *encryptedLength = totalLength;

    if(channel->securityMode != UA_MESSAGESECURITYMODE_NONE) {

        size_t dataToEncryptLength = totalLength -

            (UA_SECURECHANNEL_CHANNELHEADER_LENGTH + securityHeaderLength);

        size_t plainTextBlockSize = sp->asymEncryptionAlgorithm.

            getRemotePlainTextBlockSize(sp, cc);

        size_t encryptedBlockSize = sp->asymEncryptionAlgorithm.

            getRemoteBlockSize(sp, cc);

        /* Padding always fills up the last block */

        UA_assert(plainTextBlockSize > 0);

        UA_assert(dataToEncryptLength % plainTextBlockSize == 0);

        size_t blocks = dataToEncryptLength / plainTextBlockSize;

        *encryptedLength = totalLength + blocks * (encryptedBlockSize - plainTextBlockSize);

    }

    UA_TcpMessageHeader messageHeader;

    messageHeader.messageTypeAndChunkType = UA_MESSAGETYPE_OPN + UA_CHUNKTYPE_FINAL;

    messageHeader.messageSize = (UA_UInt32)*encryptedLength;

    UA_UInt32 secureChannelId = channel->securityToken.channelId;

    UA_StatusCode res = UA_STATUSCODE_GOOD;

    res |= UA_encodeBinaryInternal(&messageHeader,

                                   &UA_TRANSPORT[UA_TRANSPORT_TCPMESSAGEHEADER],

                                   &header_pos, &buf_end, NULL, NULL, NULL);

    res |= UA_UInt32_encodeBinary(&secureChannelId, &header_pos, buf_end);

    UA_CHECK_STATUS(res, return res);

    UA_AsymmetricAlgorithmSecurityHeader asymHeader;

    UA_AsymmetricAlgorithmSecurityHeader_init(&asymHeader);

    asymHeader.securityPolicyUri = sp->policyUri;

    if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN ||

       channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT) {

        asymHeader.senderCertificate = sp->localCertificate;

        asymHeader.receiverCertificateThumbprint.length = 20;

        asymHeader.receiverCertificateThumbprint.data = channel->remoteCertificateThumbprint;

    }

    res = UA_encodeBinaryInternal(&asymHeader,

                                  &UA_TRANSPORT[UA_TRANSPORT_ASYMMETRICALGORITHMSECURITYHEADER],

                                  &header_pos, &buf_end, NULL, NULL, NULL);

    UA_CHECK_STATUS(res, return res);

    UA_SequenceHeader seqHeader;

    seqHeader.requestId = requestId;

    seqHeader.sequenceNumber = UA_SecureChannel_nextSequenceNumber(channel);

    res = UA_encodeBinaryInternal(&seqHeader, &UA_TRANSPORT[UA_TRANSPORT_SEQUENCEHEADER],

                                  &header_pos, &buf_end, NULL, NULL, NULL);

    return res;

}

UA_StatusCode

hideBytesAsym(const UA_SecureChannel *channel, UA_Byte **buf_start,

              const UA_Byte **buf_end) {

    UA_Byte *const bufferStart = *buf_start;

    const size_t bufferLength = (size_t)(*buf_end - bufferStart);

    /* Check the complete unencrypted header before constructing pointers into

     * the payload. The certificate is already constrained by the negotiated

     * send-buffer size; it does not need a separate policy limit. */

    const size_t asymHeaderLength = calculateAsymAlgSecurityHeaderLength(channel);

    if(asymHeaderLength > bufferLength ||

       UA_SECURECHANNEL_CHANNELHEADER_LENGTH > bufferLength - asymHeaderLength)

        return UA_STATUSCODE_BADENCODINGLIMITSEXCEEDED;

    const size_t headerLength =

        UA_SECURECHANNEL_CHANNELHEADER_LENGTH + asymHeaderLength;

    if(UA_SECURECHANNEL_SEQUENCEHEADER_LENGTH > bufferLength - headerLength)

        return UA_STATUSCODE_BADENCODINGLIMITSEXCEEDED;

    const size_t payloadOffset =

        headerLength + UA_SECURECHANNEL_SEQUENCEHEADER_LENGTH;

    if(channel->securityMode == UA_MESSAGESECURITYMODE_NONE) {

        *buf_start = bufferStart + payloadOffset;

        return UA_STATUSCODE_GOOD;

    }

    /* Determine how many complete encrypted blocks fit into the chunk. */

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    UA_CHECK_MEM(sp, return UA_STATUSCODE_BADINTERNALERROR);

    void *cc = channel->channelContext;

    /* Block sizes depend on the remote key (certificate) */

    const size_t plainTextBlockSize =

        sp->asymEncryptionAlgorithm.getRemotePlainTextBlockSize(sp, cc);

    const size_t encryptedBlockSize =

        sp->asymEncryptionAlgorithm.getRemoteBlockSize(sp, cc);

    if(plainTextBlockSize == 0 || encryptedBlockSize == 0)

        return UA_STATUSCODE_BADINTERNALERROR;

    const UA_Boolean extraPadding =

        (sp->asymEncryptionAlgorithm.getRemoteKeyLength(sp, cc) > 2048);

    const size_t maxEncrypted = bufferLength - headerLength;

    const size_t maxBlocks = maxEncrypted / encryptedBlockSize;

    if(maxBlocks > SIZE_MAX / plainTextBlockSize)

        return UA_STATUSCODE_BADENCODINGLIMITSEXCEEDED;

    const size_t maxPlaintext = maxBlocks * plainTextBlockSize;

    /* The encrypted plaintext also contains the SequenceHeader, signature and

     * at least one padding-size byte. */

    const size_t signatureSize =

        sp->asymSignatureAlgorithm.getLocalSignatureSize(sp, cc);

    const size_t paddingBytes = (UA_LIKELY(!extraPadding)) ? 1u : 2u;

    const size_t fixedOverhead =

        UA_SECURECHANNEL_SEQUENCEHEADER_LENGTH + paddingBytes;

    if(signatureSize > SIZE_MAX - fixedOverhead)

        return UA_STATUSCODE_BADENCODINGLIMITSEXCEEDED;

    const size_t payloadOverhead = fixedOverhead + signatureSize;

    if(maxPlaintext < payloadOverhead)

        return UA_STATUSCODE_BADENCODINGLIMITSEXCEEDED;

    const size_t payloadCapacity = maxPlaintext - payloadOverhead;

    if(payloadCapacity > bufferLength - payloadOffset)

        return UA_STATUSCODE_BADENCODINGLIMITSEXCEEDED;

    *buf_end = bufferStart + payloadOffset + payloadCapacity;

    *buf_start = bufferStart + payloadOffset;

    return UA_STATUSCODE_GOOD;

}

/* Assumes that pos can be advanced to the end of the current block */

void

padChunk(UA_SecureChannel *channel,

         const UA_SecurityPolicySignatureAlgorithm *sa,

         const UA_SecurityPolicyEncryptionAlgorithm *ea,

         const UA_Byte *start, UA_Byte **pos) {

    UA_SecurityPolicy *sp = channel->securityPolicy;

    void *cc = channel->channelContext;

    const size_t bytesToWrite = (uintptr_t)*pos - (uintptr_t)start;

    size_t signatureSize = sa->getLocalSignatureSize(sp, cc);

    size_t plainTextBlockSize = ea->getRemotePlainTextBlockSize(sp, cc);

    UA_Boolean extraPadding = (ea->getRemoteKeyLength(sp, cc) > 2048);

    size_t paddingBytes = (UA_LIKELY(!extraPadding)) ? 1u : 2u;

    UA_assert(plainTextBlockSize > 0);

    size_t lastBlock = ((bytesToWrite + signatureSize + paddingBytes) % plainTextBlockSize);

    size_t paddingLength = (lastBlock != 0) ? plainTextBlockSize - lastBlock : 0;

    UA_assert((bytesToWrite + signatureSize +

               paddingBytes + paddingLength) % plainTextBlockSize == 0);

    UA_LOG_TRACE_CHANNEL(sp->logger, channel,

                         "Add %lu bytes of padding plus %lu padding size bytes",

                         (long unsigned int)paddingLength,

                         (long unsigned int)paddingBytes);

    /* Write the padding. This is <= because the paddingSize byte also has to be

     * written */

    UA_Byte paddingByte = (UA_Byte)paddingLength;

    for(size_t i = 0; i <= paddingLength; ++i) {

        **pos = paddingByte;

        ++*pos;

    }

    /* Write the extra padding byte if required */

    if(extraPadding) {

        **pos = (UA_Byte)(paddingLength >> 8u);

        ++*pos;

    }

}

UA_StatusCode

signAndEncryptAsym(UA_SecureChannel *channel, size_t preSignLength,

                   UA_ByteString *buf, size_t securityHeaderLength,

                   size_t totalLength) {

    if(channel->securityMode != UA_MESSAGESECURITYMODE_SIGN &&

       channel->securityMode != UA_MESSAGESECURITYMODE_SIGNANDENCRYPT)

        return UA_STATUSCODE_GOOD;

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    void *cc = channel->channelContext;

    /* OPC UA Part 6 v1.05.07 §6.7.5 "ChannelThumbprint" (enhanced policies,

     * FIRST OPN only — an empty channelThumbprint identifies the first OPN; NOT

     * on renewals. The OPN response signature is extended with the first OPN

     * request signature: the client (request side) stores its just-computed

     * signature for the later response verify; the server (response side)

     * appends the request signature captured by decryptAndVerifyChunk to the

     * data being signed. */

    UA_Boolean firstOPN = (channel->enhancedSecurity &&

                           channel->channelThumbprint.length == 0);

    UA_ByteString *appendSig = NULL;

    if(firstOPN && channel->firstRequestSignature.length > 0)

        appendSig = &channel->firstRequestSignature; /* server: extend signed data */

    size_t sigsize = sp->asymSignatureAlgorithm.getLocalSignatureSize(sp, cc);

    /* Prepare the data to sign. If we need to append the request

     * signature, build a contiguous buffer [body | requestSig] and sign

     * that. Otherwise sign the body in-place. */

    UA_ByteString signature = {sigsize, buf->data + preSignLength};

    UA_StatusCode retval;

    if(appendSig) {

        size_t bodyLen = preSignLength;

        size_t extLen = bodyLen + appendSig->length;

        UA_Byte *ext = (UA_Byte*)UA_malloc(extLen);

        if(!ext)

            return UA_STATUSCODE_BADOUTOFMEMORY;

        memcpy(ext, buf->data, bodyLen);

        memcpy(ext + bodyLen, appendSig->data, appendSig->length);

        UA_ByteString dataToSignExt = {extLen, ext};

        retval = sp->asymSignatureAlgorithm.sign(sp, cc, &dataToSignExt, &signature);

        UA_free(ext);

    } else {

        const UA_ByteString dataToSign = {preSignLength, buf->data};

        retval = sp->asymSignatureAlgorithm.sign(sp, cc, &dataToSign, &signature);

        /* First-OPN client side: remember the just-computed request

         * signature. The verify path on the client will use it to

         * extend the response body. */

        if(retval == UA_STATUSCODE_GOOD && firstOPN && signature.length > 0) {

            UA_StatusCode clip =

                UA_ByteString_copy(&signature, &channel->firstRequestSignature);

            if(clip != UA_STATUSCODE_GOOD)

                retval = clip;

        }

    }

    UA_CHECK_STATUS(retval, return retval);

    /* Server, first OPN response (appendSig != NULL): the just-computed

     * signature is the ChannelThumbprint - capture it (preserved across renewals

     * to bind the session SignatureData) and release the consumed request

     * signature. (The client stored its request signature above; that copy is

     * released later by the OPN-response verify.) */

    if(appendSig != NULL) {

        UA_StatusCode tp = UA_ByteString_copy(&signature, &channel->channelThumbprint);

        UA_CHECK_STATUS(tp, return tp);

        UA_ByteString_clear(&channel->firstRequestSignature);

    }

    /* Specification part 6, 6.7.4: The OpenSecureChannel Messages are

     * signed and encrypted if the SecurityMode is not None (even if the

     * SecurityMode is SignOnly). */

    size_t unencrypted_length =

        UA_SECURECHANNEL_CHANNELHEADER_LENGTH + securityHeaderLength;

    UA_ByteString dataToEncrypt =

        {totalLength - unencrypted_length, &buf->data[unencrypted_length]};

    return sp->asymEncryptionAlgorithm.encrypt(sp, cc, &dataToEncrypt);

}

/**************************/

/* Send Symmetric Message */

/**************************/

UA_StatusCode

signAndEncryptSym(UA_MessageContext *messageContext,

                  size_t preSigLength, size_t totalLength) {

    const UA_SecureChannel *channel = messageContext->channel;

    if(channel->securityMode == UA_MESSAGESECURITYMODE_NONE)

        return UA_STATUSCODE_GOOD;

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    void *cc = channel->channelContext;

    /* For AEAD policies (ChaCha20-Poly1305), set the message security

     * parameters for nonce masking. Then let the encrypt callback handle

     * both authentication and encryption. */

    if(UA_SecurityPolicy_isAead(sp)) {

        /* Set AEAD parameters: tokenId, previous seqNo, AAD */

        if(sp->setMessageSecurityParameters) {

            UA_ByteString aad;

            aad.data = messageContext->messageBuffer.data;

            aad.length = UA_SECURECHANNEL_CHANNELHEADER_LENGTH +

                         UA_SECURECHANNEL_SYMMETRIC_SECURITYHEADER_LENGTH;

            /* The AEAD nonce is masked with the PREVIOUS sequence number: the

             * receiver masks with its receiveSequenceNumber, which is still the

             * prior chunk's number at decrypt time (incremented only after

             * decryption). sendSequenceNumber is the post-increment counter, so

             * the value just emitted is (sendSequenceNumber - 1) and the

             * previous one is (sendSequenceNumber - 2). ECC_AEAD always uses the

             * non-legacy counter (first emitted number is 0). */

            UA_UInt32 prevSeqNo = channel->sendSequenceNumber >= 2 ?

                (UA_UInt32)(channel->sendSequenceNumber - 2) : 0;

            UA_StatusCode res = sp->setMessageSecurityParameters(

                sp, cc, channel->securityToken.tokenId, prevSeqNo, &aad);

            UA_CHECK_STATUS(res, return res);

        }

        if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT) {

            /* Full AEAD: encrypt + compute auth tag. Data includes

             * the 16-byte tag space at the end. */

            UA_ByteString dataToProcess;

            dataToProcess.data = messageContext->messageBuffer.data +

                UA_SECURECHANNEL_CHANNELHEADER_LENGTH +

                UA_SECURECHANNEL_SYMMETRIC_SECURITYHEADER_LENGTH;

            dataToProcess.length = totalLength -

                (UA_SECURECHANNEL_CHANNELHEADER_LENGTH +

                 UA_SECURECHANNEL_SYMMETRIC_SECURITYHEADER_LENGTH);

            return sp->symEncryptionAlgorithm.encrypt(sp, cc, &dataToProcess);

        }

        /* Sign-only: Compute Poly1305 auth tag */

        UA_ByteString dataToSign = messageContext->messageBuffer;

        dataToSign.length = preSigLength;

        UA_ByteString signature;

        signature.length =

            sp->symSignatureAlgorithm.getLocalSignatureSize(sp, cc);

        signature.data = messageContext->buf_pos;

        return sp->symSignatureAlgorithm.

            sign(sp, cc, &dataToSign, &signature);

    }

    /* Sign */

    UA_ByteString dataToSign = messageContext->messageBuffer;

    dataToSign.length = preSigLength;

    UA_ByteString signature;

    signature.length =

        sp->symSignatureAlgorithm.getLocalSignatureSize(sp, cc);

    signature.data = messageContext->buf_pos;

    UA_StatusCode res = sp->symSignatureAlgorithm.

        sign(sp, cc, &dataToSign, &signature);

    UA_CHECK_STATUS(res, return res);

    if(channel->securityMode != UA_MESSAGESECURITYMODE_SIGNANDENCRYPT)

        return UA_STATUSCODE_GOOD;

    /* Encrypt */

    UA_ByteString dataToEncrypt;

    dataToEncrypt.data = messageContext->messageBuffer.data +

        UA_SECURECHANNEL_CHANNELHEADER_LENGTH +

        UA_SECURECHANNEL_SYMMETRIC_SECURITYHEADER_LENGTH;

    dataToEncrypt.length = totalLength -

        (UA_SECURECHANNEL_CHANNELHEADER_LENGTH +

         UA_SECURECHANNEL_SYMMETRIC_SECURITYHEADER_LENGTH);

    return sp->symEncryptionAlgorithm.encrypt(sp, cc, &dataToEncrypt);

}

void

setBufPos(UA_MessageContext *mc) {

    /* Forward the data pointer so that the payload is encoded after the message

     * header. This has to be a symmetric message because OPN (with asymmetric

     * encryption) does not support chunking. */

    mc->buf_pos = &mc->messageBuffer.data[UA_SECURECHANNEL_SYMMETRIC_HEADER_TOTALLENGTH];

    mc->buf_end = &mc->messageBuffer.data[mc->messageBuffer.length];

    if(mc->channel->securityMode == UA_MESSAGESECURITYMODE_NONE)

        return;

    const UA_SecureChannel *channel = mc->channel;

    const UA_SecurityPolicy *sp = channel->securityPolicy;

    void *cc = channel->channelContext;

    /* For AEAD (ChaCha20-Poly1305): no padding, no block alignment.

     * Only reserve space for the authentication tag (signature size). */

    if(UA_SecurityPolicy_isAead(sp)) {

        size_t sigsize =

            sp->symSignatureAlgorithm.getLocalSignatureSize(sp, cc);

        mc->buf_end -= sigsize;

        UA_LOG_TRACE_CHANNEL(sp->logger, channel,

                             "Prepare an AEAD symmetric message buffer of length %lu "

                             "with a usable maximum payload length of %lu",

                             (long unsigned)mc->messageBuffer.length,

                             (long unsigned)((uintptr_t)mc->buf_end -

                                             (uintptr_t)mc->messageBuffer.data));

        return;

    }

    size_t sigsize =

        sp->symSignatureAlgorithm.getLocalSignatureSize(sp, cc);

    size_t plainBlockSize =

        sp->symEncryptionAlgorithm.getRemotePlainTextBlockSize(sp, cc);

    /* Assuming that for symmetric encryption the plainTextBlockSize ==

     * cypherTextBlockSize. For symmetric encryption the remote/local block

     * sizes are identical. */

    UA_assert(sp->symEncryptionAlgorithm.getRemoteBlockSize(sp, cc) == plainBlockSize);

    /* Leave enough space for the signature and padding */

    mc->buf_end -= sigsize;

    UA_assert(plainBlockSize > 0);

    mc->buf_end -= mc->messageBuffer.length % plainBlockSize;

    if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT) {

        /* Reserve space for the padding bytes */

        UA_Boolean extraPadding =

            (sp->symEncryptionAlgorithm.getRemoteKeyLength(sp, cc) > 2048);

        mc->buf_end -= (UA_LIKELY(!extraPadding)) ? 1 : 2;

    }

    UA_LOG_TRACE_CHANNEL(sp->logger, channel,

                         "Prepare a symmetric message buffer of length %lu "

                         "with a usable maximum payload length of %lu",

                         (long unsigned)mc->messageBuffer.length,

                         (long unsigned)((uintptr_t)mc->buf_end -

                                         (uintptr_t)mc->messageBuffer.data));

}

/****************************/

/* Process a received Chunk */

/****************************/

static size_t

decodePadding(const UA_SecureChannel *channel,

              const UA_SecurityPolicyEncryptionAlgorithm *encryptionAlgorithm,

              const UA_ByteString *chunk, size_t sigsize) {

    /* Read the byte with the padding size */

    size_t paddingSize = chunk->data[chunk->length - sigsize - 1];

    /* Extra padding size */

    if(encryptionAlgorithm->getLocalKeyLength(channel->securityPolicy,

                                              channel->channelContext) > 2048) {

        paddingSize <<= 8u;

        paddingSize += chunk->data[chunk->length - sigsize - 2];

        paddingSize += 1; /* Extra padding byte itself */

    }

    /* Add one since the paddingSize byte itself needs to be removed as well */

    return paddingSize + 1;

}

/* Sets the payload to a pointer inside the chunk buffer. Returns the requestId

 * and the sequenceNumber */

UA_StatusCode

decryptAndVerifyChunk(UA_SecureChannel *channel,

                      const UA_SecurityPolicySignatureAlgorithm *signatureAlgorithm,

                      const UA_SecurityPolicyEncryptionAlgorithm *encryptionAlgorithm,

                      UA_MessageType messageType, UA_ByteString *chunk,

                      size_t offset) {

    UA_SecurityPolicy *sp = channel->securityPolicy;

    void *cc = channel->channelContext;

    UA_StatusCode res = UA_STATUSCODE_GOOD;

    /* AEAD path (ChaCha20-Poly1305): the decrypt callback handles both

     * decryption and authentication tag verification in one step. */

    if(UA_SecurityPolicy_isAead(sp) &&

       messageType != UA_MESSAGETYPE_OPN) {

        /* Set AEAD parameters before decrypt/verify. The masked nonce is keyed

         * on the TokenId of *this* message, which is taken from the chunk's

         * symmetric SecurityHeader (right after the 12-byte channel header) and

         * not from channel->securityToken: during a token rollover the peer may

         * still secure messages with the old token (Part 4 §5.5.2) while the

         * channel already holds the new token. Using the wrong TokenId here

         * makes the AEAD tag verification fail. */

        if(sp->setMessageSecurityParameters) {

            UA_ByteString aad = {offset, chunk->data};

            size_t tokenOffset = UA_SECURECHANNEL_CHANNELHEADER_LENGTH;

            UA_UInt32 msgTokenId = channel->securityToken.tokenId;

            if(offset >= UA_SECURECHANNEL_MESSAGE_MIN_LENGTH)

                UA_UInt32_decodeBinary(chunk, &tokenOffset, &msgTokenId);

            res = sp->setMessageSecurityParameters(

                sp, cc, msgTokenId,

                channel->receiveSequenceNumber, &aad);

            UA_CHECK_STATUS(res, return res);

        }

        if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGNANDENCRYPT) {

            /* Full AEAD decrypt + verify. The decrypt callback processes

             * the data including the 16-byte auth tag at the end. On

             * success, it reduces cipher.length by the tag size. */

            UA_ByteString cipher = {chunk->length - offset, chunk->data + offset};

            res = encryptionAlgorithm->decrypt(sp, cc, &cipher);

            UA_CHECK_STATUS(res,

                UA_LOG_WARNING_CHANNEL(sp->logger, channel,

                                       "AEAD decryption/verification failed");

                return res);

            chunk->length = cipher.length + offset;

        } else if(channel->securityMode == UA_MESSAGESECURITYMODE_SIGN) {

            /* Sign-only: verify the auth tag without decryption */

            size_t sigsize = signatureAlgorithm->getRemoteSignatureSize(sp, cc);

            UA_CHECK(sigsize < chunk->length,

                     return UA_STATUSCODE_BADSECURITYCHECKSFAILED);

            const UA_ByteString content = {chunk->length - sigsize, chunk->data};

            const UA_ByteString sig = {sigsize, chunk->data + chunk->length - sigsize};

            res = signatureAlgorithm->verify(sp, cc, &content, &sig);

            UA_CHECK_STATUS(res,

                UA_LOG_WARNING_CHANNEL(sp->logger, channel,

                                       "AEAD signature verification failed");

                return res);

            chunk->length -= sigsize;

        }

        /* Verify the content length */

        UA_CHECK(offset + 9 < chunk->length,

                 UA_LOG_ERROR_CHANNEL(sp->logger, channel,

                                      "AEAD message too short");

                 return UA_STATUSCODE_BADSECURITYCHECKSFAILED);

        return UA_STATUSCODE_GOOD;

    }