/*

 * Copyright (C) 2012 Free Software Foundation

 * 

 * Author: Martin Storsjo

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "auth.h"

#include "errors.h"

#include "num.h"

#include <ext/srtp.h>

static int _gnutls_srtp_recv_params(gnutls_session_t session,

            const uint8_t * data, size_t data_size);

static int _gnutls_srtp_send_params(gnutls_session_t session,

            gnutls_buffer_st * extdata);

static int _gnutls_srtp_unpack(gnutls_buffer_st * ps,

             gnutls_ext_priv_data_t * _priv);

static int _gnutls_srtp_pack(gnutls_ext_priv_data_t _priv,

           gnutls_buffer_st * ps);

static void _gnutls_srtp_deinit_data(gnutls_ext_priv_data_t priv);

const hello_ext_entry_st ext_mod_srtp = {

  .name = "SRTP",

  .tls_id = 14,

  .gid = GNUTLS_EXTENSION_SRTP,

  .validity =

      GNUTLS_EXT_FLAG_TLS | GNUTLS_EXT_FLAG_DTLS |

      GNUTLS_EXT_FLAG_CLIENT_HELLO | GNUTLS_EXT_FLAG_EE |

      GNUTLS_EXT_FLAG_TLS12_SERVER_HELLO,

  .client_parse_point = GNUTLS_EXT_APPLICATION,

  .server_parse_point = GNUTLS_EXT_APPLICATION,

  .recv_func = _gnutls_srtp_recv_params,

  .send_func = _gnutls_srtp_send_params,

  .pack_func = _gnutls_srtp_pack,

  .unpack_func = _gnutls_srtp_unpack,

  .deinit_func = _gnutls_srtp_deinit_data,

  .cannot_be_overriden = 1

};

typedef struct {

  const char *name;

  gnutls_srtp_profile_t id;

  unsigned int key_length;

  unsigned int salt_length;

} srtp_profile_st;

static const srtp_profile_st profile_names[] = {

  {

   "SRTP_AES128_CM_HMAC_SHA1_80",

   GNUTLS_SRTP_AES128_CM_HMAC_SHA1_80,

   16, 14},

  {

   "SRTP_AES128_CM_HMAC_SHA1_32",

   GNUTLS_SRTP_AES128_CM_HMAC_SHA1_32,

   16, 14},

  {

   "SRTP_NULL_HMAC_SHA1_80",

   GNUTLS_SRTP_NULL_HMAC_SHA1_80,

   16, 14},

  {

   "SRTP_NULL_SHA1_32",

   GNUTLS_SRTP_NULL_HMAC_SHA1_32,

   16, 14},

  {

   "SRTP_AEAD_AES_128_GCM",

   GNUTLS_SRTP_AEAD_AES_128_GCM,

   16, 12},

  {

   "SRTP_AEAD_AES_256_GCM",

   GNUTLS_SRTP_AEAD_AES_256_GCM,

   32, 12},

  {

   NULL,

   0, 0, 0}

};

static const srtp_profile_st *get_profile(gnutls_srtp_profile_t profile)

{

  const srtp_profile_st *p = profile_names;

  while (p->name != NULL) {

    if (p->id == profile)

      return p;

    p++;

  }

  return NULL;

}

static gnutls_srtp_profile_t find_profile(const char *str, const char *end)

{

  const srtp_profile_st *prof = profile_names;

  unsigned int len;

  if (end != NULL) {

    len = end - str;

  } else {

    len = strlen(str);

  }

  while (prof->name != NULL) {

    if (strlen(prof->name) == len && !strncmp(str, prof->name, len)) {

      return prof->id;

    }

    prof++;

  }

  return 0;

}

/**

 * gnutls_srtp_get_profile_id

 * @name: The name of the profile to look up

 * @profile: Will hold the profile id

 *

 * This function allows you to look up a profile based on a string.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,

 *   otherwise a negative error code is returned.

 *

 * Since 3.1.4

 **/

int gnutls_srtp_get_profile_id(const char *name,

             gnutls_srtp_profile_t * profile)

{

  *profile = find_profile(name, NULL);

  if (*profile == 0) {

    return GNUTLS_E_ILLEGAL_PARAMETER;

  }

  return 0;

}

#define MAX_PROFILES_IN_SRTP_EXTENSION 256

/**

 * gnutls_srtp_get_profile_name

 * @profile: The profile to look up a string for

 *

 * This function allows you to get the corresponding name for a

 * SRTP protection profile.

 *

 * Returns: On success, the name of a SRTP profile as a string,

 *   otherwise NULL.

 *

 * Since 3.1.4

 **/

const char *gnutls_srtp_get_profile_name(gnutls_srtp_profile_t profile)

{

  const srtp_profile_st *p = get_profile(profile);

  if (p != NULL)

    return p->name;

  return NULL;

}

static int

_gnutls_srtp_recv_params(gnutls_session_t session,

       const uint8_t * data, size_t data_size)

{

  unsigned int i;

  int ret;

  const uint8_t *p = data;

  size_t len;

  srtp_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  uint16_t profile;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0)

    return 0;

  priv = epriv;

  DECR_LENGTH_RET(data_size, 2, 0);

  len = _gnutls_read_uint16(p);

  p += 2;

  if (len + 1 > data_size)

    return gnutls_assert_val(GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

  if (session->security_parameters.entity == GNUTLS_SERVER) {

    if (len > MAX_PROFILES_IN_SRTP_EXTENSION * 2)

      return 0;

  } else {

    if (len != 2)

      return

          gnutls_assert_val

          (GNUTLS_E_UNEXPECTED_PACKET_LENGTH);

  }

  priv->selected_profile = 0;

  while (len > 0) {

    DECR_LEN(data_size, 2);

    profile = _gnutls_read_uint16(p);

    for (i = 0;

         i < priv->profiles_size

         && priv->selected_profile == 0; i++) {

      if (priv->profiles[i] == profile) {

        priv->selected_profile = profile;

        break;

      }

    }

    p += 2;

    len -= 2;

  }

  DECR_LEN(data_size, 1);

  priv->mki_size = *p;

  p++;

  if (priv->mki_size > 0) {

    DECR_LEN(data_size, priv->mki_size);

    memcpy(priv->mki, p, priv->mki_size);

    priv->mki_received = 1;

  }

  return 0;

}

static int

_gnutls_srtp_send_params(gnutls_session_t session, gnutls_buffer_st * extdata)

{

  unsigned i;

  int total_size = 0, ret;

  srtp_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0)

    return 0;

  priv = epriv;

  if (priv->profiles_size == 0)

    return 0;

  if (session->security_parameters.entity == GNUTLS_SERVER) {

    /* Don't send anything if no matching profile was found */

    if (priv->selected_profile == 0)

      return 0;

    ret = _gnutls_buffer_append_prefix(extdata, 16, 2);

    if (ret < 0)

      return gnutls_assert_val(ret);

    ret =

        _gnutls_buffer_append_prefix(extdata, 16,

             priv->selected_profile);

    if (ret < 0)

      return gnutls_assert_val(ret);

    total_size = 4;

  } else {

    ret =

        _gnutls_buffer_append_prefix(extdata, 16,

             2 * priv->profiles_size);

    if (ret < 0)

      return gnutls_assert_val(ret);

    for (i = 0; i < priv->profiles_size; i++) {

      ret =

          _gnutls_buffer_append_prefix(extdata, 16,

               priv->profiles[i]);

      if (ret < 0)

        return gnutls_assert_val(ret);

    }

    total_size = 2 + 2 * priv->profiles_size;

  }

  /* use_mki */

  ret =

      _gnutls_buffer_append_data_prefix(extdata, 8, priv->mki,

                priv->mki_size);

  if (ret < 0)

    return gnutls_assert_val(ret);

  total_size += 1 + priv->mki_size;

  return total_size;

}

/**

 * gnutls_srtp_get_selected_profile:

 * @session: is a #gnutls_session_t type.

 * @profile: will hold the profile

 *

 * This function allows you to get the negotiated SRTP profile.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,

 *   otherwise a negative error code is returned.

 *

 * Since 3.1.4

 **/

int

gnutls_srtp_get_selected_profile(gnutls_session_t session,

         gnutls_srtp_profile_t * profile)

{

  srtp_ext_st *priv;

  int ret;

  gnutls_ext_priv_data_t epriv;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0) {

    gnutls_assert();

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

  }

  priv = epriv;

  if (priv->selected_profile == 0) {

    return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

  }

  *profile = priv->selected_profile;

  return 0;

}

/**

 * gnutls_srtp_get_mki:

 * @session: is a #gnutls_session_t type.

 * @mki: will hold the MKI

 *

 * This function exports the negotiated Master Key Identifier,

 * received by the peer if any. The returned value in @mki should be 

 * treated as constant and valid only during the session's lifetime.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,

 *   otherwise a negative error code is returned.

 *

 * Since 3.1.4

 **/

int gnutls_srtp_get_mki(gnutls_session_t session, gnutls_datum_t * mki)

{

  srtp_ext_st *priv;

  int ret;

  gnutls_ext_priv_data_t epriv;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0)

    return gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE);

  priv = epriv;

  if (priv->mki_received == 0)

    return gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE);

  mki->data = priv->mki;

  mki->size = priv->mki_size;

  return 0;

}

/**

 * gnutls_srtp_set_mki:

 * @session: is a #gnutls_session_t type.

 * @mki: holds the MKI

 *

 * This function sets the Master Key Identifier, to be

 * used by this session (if any).

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,

 *   otherwise a negative error code is returned.

 *

 * Since 3.1.4

 **/

int gnutls_srtp_set_mki(gnutls_session_t session, const gnutls_datum_t * mki)

{

  int ret;

  srtp_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0) {

    priv = gnutls_calloc(1, sizeof(*priv));

    if (priv == NULL) {

      gnutls_assert();

      return GNUTLS_E_MEMORY_ERROR;

    }

    epriv = priv;

    _gnutls_hello_ext_set_priv(session,

             GNUTLS_EXTENSION_SRTP, epriv);

  } else

    priv = epriv;

  if (mki->size > 0 && mki->size <= sizeof(priv->mki)) {

    priv->mki_size = mki->size;

    memcpy(priv->mki, mki->data, mki->size);

  } else

    return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

  return 0;

}

/**

 * gnutls_srtp_set_profile:

 * @session: is a #gnutls_session_t type.

 * @profile: is the profile id to add.

 *

 * This function is to be used by both clients and servers, to declare

 * what SRTP profiles they support, to negotiate with the peer.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,

 *   otherwise a negative error code is returned.

 *

 * Since 3.1.4

 **/

int

gnutls_srtp_set_profile(gnutls_session_t session, gnutls_srtp_profile_t profile)

{

  int ret;

  srtp_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0) {

    priv = gnutls_calloc(1, sizeof(*priv));

    if (priv == NULL) {

      gnutls_assert();

      return GNUTLS_E_MEMORY_ERROR;

    }

    epriv = priv;

    _gnutls_hello_ext_set_priv(session,

             GNUTLS_EXTENSION_SRTP, epriv);

  } else

    priv = epriv;

  if (priv->profiles_size < MAX_SRTP_PROFILES)

    priv->profiles_size++;

  priv->profiles[priv->profiles_size - 1] = profile;

  return 0;

}

/**

 * gnutls_srtp_set_profile_direct:

 * @session: is a #gnutls_session_t type.

 * @profiles: is a string that contains the supported SRTP profiles,

 *   separated by colons.

 * @err_pos: In case of an error this will have the position in the string the error occurred, may be NULL.

 *

 * This function is to be used by both clients and servers, to declare

 * what SRTP profiles they support, to negotiate with the peer.

 *

 * Returns: On syntax error %GNUTLS_E_INVALID_REQUEST is returned,

 * %GNUTLS_E_SUCCESS on success, or an error code.

 *

 * Since 3.1.4

 **/

int

gnutls_srtp_set_profile_direct(gnutls_session_t session,

             const char *profiles, const char **err_pos)

{

  int ret;

  srtp_ext_st *priv;

  gnutls_ext_priv_data_t epriv;

  int set = 0;

  const char *col;

  gnutls_srtp_profile_t id;

  ret =

      _gnutls_hello_ext_get_priv(session, GNUTLS_EXTENSION_SRTP, &epriv);

  if (ret < 0) {

    set = 1;

    priv = gnutls_calloc(1, sizeof(*priv));

    if (priv == NULL) {

      if (err_pos != NULL)

        *err_pos = profiles;

      gnutls_assert();

      return GNUTLS_E_MEMORY_ERROR;

    }

    epriv = priv;

  } else

    priv = epriv;

  do {

    col = strchr(profiles, ':');

    id = find_profile(profiles, col);

    if (id == 0) {

      if (set != 0)

        gnutls_free(priv);

      if (err_pos != NULL)

        *err_pos = profiles;

      return GNUTLS_E_INVALID_REQUEST;

    }

    if (priv->profiles_size < MAX_SRTP_PROFILES) {

      priv->profiles_size++;

    }

    priv->profiles[priv->profiles_size - 1] = id;

    profiles = col + 1;

  } while (col != NULL);

  if (set != 0)

    _gnutls_hello_ext_set_priv(session,

             GNUTLS_EXTENSION_SRTP, epriv);

  return 0;

}

/**

 * gnutls_srtp_get_keys:

 * @session: is a #gnutls_session_t type.

 * @key_material: Space to hold the generated key material

 * @key_material_size: The maximum size of the key material

 * @client_key: The master client write key, pointing inside the key material

 * @server_key: The master server write key, pointing inside the key material

 * @client_salt: The master client write salt, pointing inside the key material

 * @server_salt: The master server write salt, pointing inside the key material

 *

 * This is a helper function to generate the keying material for SRTP.

 * It requires the space of the key material to be pre-allocated (should be at least

 * 2x the maximum key size and salt size). The @client_key, @client_salt, @server_key

 * and @server_salt are convenience datums that point inside the key material. They may

 * be %NULL.

 *

 * Returns: On success the size of the key material is returned,

 * otherwise, %GNUTLS_E_SHORT_MEMORY_BUFFER if the buffer given is not 

 * sufficient, or a negative error code.

 *

 * Since 3.1.4

 **/

int

gnutls_srtp_get_keys(gnutls_session_t session,

         void *key_material,

         unsigned int key_material_size,

         gnutls_datum_t * client_key,

         gnutls_datum_t * client_salt,

         gnutls_datum_t * server_key, gnutls_datum_t * server_salt)

{

  int ret;

  const srtp_profile_st *p;

  gnutls_srtp_profile_t profile;

  unsigned int msize;

  uint8_t *km = key_material;

  ret = gnutls_srtp_get_selected_profile(session, &profile);

  if (ret < 0)

    return gnutls_assert_val(ret);

  p = get_profile(profile);

  if (p == NULL)

    return gnutls_assert_val(GNUTLS_E_UNKNOWN_ALGORITHM);

  msize = 2 * (p->key_length + p->salt_length);

  if (msize > key_material_size)

    return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);

  if (msize == 0)

    return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);

  ret =

      gnutls_prf(session, sizeof("EXTRACTOR-dtls_srtp") - 1,

           "EXTRACTOR-dtls_srtp", 0, 0, NULL, msize, key_material);

  if (ret < 0)

    return gnutls_assert_val(ret);

  if (client_key) {

    client_key->data = km;

    client_key->size = p->key_length;

  }

  if (server_key) {

    server_key->data = km + p->key_length;

    server_key->size = p->key_length;

  }

  if (client_salt) {

    client_salt->data = km + 2 * p->key_length;

    client_salt->size = p->salt_length;

  }

  if (server_salt) {

    server_salt->data = km + 2 * p->key_length + p->salt_length;

    server_salt->size = p->salt_length;

  }

  return msize;

}

static void _gnutls_srtp_deinit_data(gnutls_ext_priv_data_t priv)

{

  gnutls_free(priv);

}

static int

_gnutls_srtp_pack(gnutls_ext_priv_data_t epriv, gnutls_buffer_st * ps)

{

  srtp_ext_st *priv = epriv;

  unsigned int i;

  int ret;

  BUFFER_APPEND_NUM(ps, priv->profiles_size);

  for (i = 0; i < priv->profiles_size; i++) {

    BUFFER_APPEND_NUM(ps, priv->profiles[i]);

  }

  BUFFER_APPEND_NUM(ps, priv->mki_received);

  if (priv->mki_received) {

    BUFFER_APPEND_NUM(ps, priv->selected_profile);

    BUFFER_APPEND_PFX4(ps, priv->mki, priv->mki_size);

  }

  return 0;

}

static int

_gnutls_srtp_unpack(gnutls_buffer_st * ps, gnutls_ext_priv_data_t * _priv)

{

  srtp_ext_st *priv;

  unsigned int i;

  int ret;

  gnutls_ext_priv_data_t epriv;

  priv = gnutls_calloc(1, sizeof(*priv));

  if (priv == NULL) {

    gnutls_assert();

    return GNUTLS_E_MEMORY_ERROR;

  }

  BUFFER_POP_NUM(ps, priv->profiles_size);

  for (i = 0; i < priv->profiles_size; i++) {

    BUFFER_POP_NUM(ps, priv->profiles[i]);

  }

  BUFFER_POP_NUM(ps, priv->selected_profile);

  BUFFER_POP_NUM(ps, priv->mki_received);

  if (priv->mki_received) {

    BUFFER_POP_NUM(ps, priv->mki_size);

    BUFFER_POP(ps, priv->mki, priv->mki_size);

  }

  epriv = priv;

  *_priv = epriv;

  return 0;

 error:

  gnutls_free(priv);

  return ret;

}