/*

 * Copyright (C) 2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "algorithms.h"

#include "errors.h"

#include "x509/common.h"

#include "pk.h"

#include "c-strcase.h"

/* Supported ECC curves

 */

static const gnutls_group_entry_st supported_groups[] = {

  {

    .name = "SECP192R1",

    .id = GNUTLS_GROUP_SECP192R1,

    .curve = GNUTLS_ECC_CURVE_SECP192R1,

    .tls_id = 19,

    .pk = GNUTLS_PK_ECDSA,

  },

  {

    .name = "SECP224R1",

    .id = GNUTLS_GROUP_SECP224R1,

    .curve = GNUTLS_ECC_CURVE_SECP224R1,

    .tls_id = 21,

    .pk = GNUTLS_PK_ECDSA,

  },

  {

    .name = "SECP256R1",

    .id = GNUTLS_GROUP_SECP256R1,

    .curve = GNUTLS_ECC_CURVE_SECP256R1,

    .tls_id = 23,

    .pk = GNUTLS_PK_ECDSA,

  },

  {

    .name = "SECP384R1",

    .id = GNUTLS_GROUP_SECP384R1,

    .curve = GNUTLS_ECC_CURVE_SECP384R1,

    .tls_id = 24,

    .pk = GNUTLS_PK_ECDSA,

  },

  {

    .name = "SECP521R1",

    .id = GNUTLS_GROUP_SECP521R1,

    .curve = GNUTLS_ECC_CURVE_SECP521R1,

    .tls_id = 25,

    .pk = GNUTLS_PK_ECDSA,

  },

  {

    .name = "X25519",

    .id = GNUTLS_GROUP_X25519,

    .curve = GNUTLS_ECC_CURVE_X25519,

    .tls_id = 29,

    .pk = GNUTLS_PK_ECDH_X25519,

  },

#ifdef ENABLE_GOST

  /* draft-smyshlyaev-tls12-gost-suites-06, Section 6 */

  {

    .name = "GC256A",

    .id = GNUTLS_GROUP_GC256A,

    .curve = GNUTLS_ECC_CURVE_GOST256A,

    .pk = GNUTLS_PK_GOST_12_256,

    .tls_id = 34,

  },

  {

    .name = "GC256B",

    .id = GNUTLS_GROUP_GC256B,

    .curve = GNUTLS_ECC_CURVE_GOST256B,

    .pk = GNUTLS_PK_GOST_12_256,

    .tls_id = 35,

  },

  {

    .name = "GC256C",

    .id = GNUTLS_GROUP_GC256C,

    .curve = GNUTLS_ECC_CURVE_GOST256C,

    .pk = GNUTLS_PK_GOST_12_256,

    .tls_id = 36,

  },

  {

    .name = "GC256D",

    .id = GNUTLS_GROUP_GC256D,

    .curve = GNUTLS_ECC_CURVE_GOST256D,

    .pk = GNUTLS_PK_GOST_12_256,

    .tls_id = 37,

  },

  {

    .name = "GC512A",

    .id = GNUTLS_GROUP_GC512A,

    .curve = GNUTLS_ECC_CURVE_GOST512A,

    .pk = GNUTLS_PK_GOST_12_512,

    .tls_id = 38,

  },

  {

    .name = "GC512B",

    .id = GNUTLS_GROUP_GC512B,

    .curve = GNUTLS_ECC_CURVE_GOST512B,

    .pk = GNUTLS_PK_GOST_12_512,

    .tls_id = 39,

  },

  {

    .name = "GC512C",

    .id = GNUTLS_GROUP_GC512C,

    .curve = GNUTLS_ECC_CURVE_GOST512C,

    .pk = GNUTLS_PK_GOST_12_512,

    .tls_id = 40,

  },

#endif

  { .name = "X448",

    .id = GNUTLS_GROUP_X448,

    .curve = GNUTLS_ECC_CURVE_X448,

    .tls_id = 30,

    .pk = GNUTLS_PK_ECDH_X448 },

#ifdef ENABLE_DHE

  { .name = "FFDHE2048",

    .id = GNUTLS_GROUP_FFDHE2048,

    .generator = &gnutls_ffdhe_2048_group_generator,

    .prime = &gnutls_ffdhe_2048_group_prime,

    .q = &gnutls_ffdhe_2048_group_q,

    .q_bits = &gnutls_ffdhe_2048_key_bits,

    .pk = GNUTLS_PK_DH,

    .tls_id = 0x100 },

  { .name = "FFDHE3072",

    .id = GNUTLS_GROUP_FFDHE3072,

    .generator = &gnutls_ffdhe_3072_group_generator,

    .prime = &gnutls_ffdhe_3072_group_prime,

    .q = &gnutls_ffdhe_3072_group_q,

    .q_bits = &gnutls_ffdhe_3072_key_bits,

    .pk = GNUTLS_PK_DH,

    .tls_id = 0x101 },

  { .name = "FFDHE4096",

    .id = GNUTLS_GROUP_FFDHE4096,

    .generator = &gnutls_ffdhe_4096_group_generator,

    .prime = &gnutls_ffdhe_4096_group_prime,

    .q = &gnutls_ffdhe_4096_group_q,

    .q_bits = &gnutls_ffdhe_4096_key_bits,

    .pk = GNUTLS_PK_DH,

    .tls_id = 0x102 },

  { .name = "FFDHE6144",

    .id = GNUTLS_GROUP_FFDHE6144,

    .generator = &gnutls_ffdhe_6144_group_generator,

    .prime = &gnutls_ffdhe_6144_group_prime,

    .q = &gnutls_ffdhe_6144_group_q,

    .q_bits = &gnutls_ffdhe_6144_key_bits,

    .pk = GNUTLS_PK_DH,

    .tls_id = 0x103 },

  { .name = "FFDHE8192",

    .id = GNUTLS_GROUP_FFDHE8192,

    .generator = &gnutls_ffdhe_8192_group_generator,

    .prime = &gnutls_ffdhe_8192_group_prime,

    .q = &gnutls_ffdhe_8192_group_q,

    .q_bits = &gnutls_ffdhe_8192_key_bits,

    .pk = GNUTLS_PK_DH,

    .tls_id = 0x104 },

#endif

#if defined(HAVE_LIBOQS) || defined(HAVE_LEANCRYPTO)

  {

    .name = "MLKEM768",

    .id = GNUTLS_GROUP_EXP_MLKEM768,

    .pk = GNUTLS_PK_MLKEM768,

    .pubkey_size = MLKEM768_PUBKEY_SIZE,

    .ciphertext_size = MLKEM768_CIPHERTEXT_SIZE,

    /* absense of .tls_id means that this group alone cannot be used in TLS */

  },

  {

    .name = "MLKEM1024",

    .id = GNUTLS_GROUP_EXP_MLKEM1024,

    .pk = GNUTLS_PK_MLKEM1024,

    .pubkey_size = MLKEM1024_PUBKEY_SIZE,

    .ciphertext_size = MLKEM1024_CIPHERTEXT_SIZE,

    /* absense of .tls_id means that this group alone cannot be used in TLS */

  },

#endif

#ifdef HAVE_LIBOQS

  {

    .name = "KYBER768",

    .id = GNUTLS_GROUP_EXP_KYBER768,

    .pk = GNUTLS_PK_EXP_KYBER768,

    .pubkey_size = MLKEM768_PUBKEY_SIZE,

    .ciphertext_size = MLKEM768_CIPHERTEXT_SIZE,

    /* absense of .tls_id means that this group alone cannot be used in TLS */

  },

#endif

#if defined(HAVE_LIBOQS) || defined(HAVE_LEANCRYPTO)

  { .name = "SECP256R1-MLKEM768",

    .id = GNUTLS_GROUP_EXP_SECP256R1_MLKEM768,

    .ids = { GNUTLS_GROUP_SECP256R1, GNUTLS_GROUP_EXP_MLKEM768,

       GNUTLS_GROUP_INVALID },

    .tls_id = 0x11EB },

  { .name = "SECP384R1-MLKEM1024",

    .id = GNUTLS_GROUP_EXP_SECP384R1_MLKEM1024,

    .ids = { GNUTLS_GROUP_SECP384R1, GNUTLS_GROUP_EXP_MLKEM1024,

       GNUTLS_GROUP_INVALID },

    .tls_id = 0x11ED },

  { .name = "X25519-MLKEM768",

    .id = GNUTLS_GROUP_EXP_X25519_MLKEM768,

    .ids = { GNUTLS_GROUP_EXP_MLKEM768, GNUTLS_GROUP_X25519,

       GNUTLS_GROUP_INVALID },

    .tls_id = 0x11EC },

#endif

#ifdef HAVE_LIBOQS

  { .name = "X25519-KYBER768",

    .id = GNUTLS_GROUP_EXP_X25519_KYBER768,

    .ids = { GNUTLS_GROUP_X25519, GNUTLS_GROUP_EXP_KYBER768,

       GNUTLS_GROUP_INVALID },

    .tls_id = 0x6399 },

#endif

  { 0, 0, 0 }

};

#define GNUTLS_GROUP_LOOP(b)                                       \

  {                                                          \

    const gnutls_group_entry_st *p;                    \

    for (p = supported_groups; p->name != NULL; p++) { \

      b;                                         \

    }                                                  \

  }

static inline const gnutls_group_entry_st *group_to_entry(gnutls_group_t group)

{

  if (group == 0)

    return NULL;

  GNUTLS_GROUP_LOOP(if (p->id == group) { return p; });

  return NULL;

}

static inline bool

group_is_supported_standalone(const gnutls_group_entry_st *group)

{

  return group->pk != 0 && _gnutls_pk_exists(group->pk) &&

         (group->curve == 0 ||

    _gnutls_ecc_curve_is_supported(group->curve));

}

static inline bool group_is_supported(const gnutls_group_entry_st *group)

{

  if (!IS_GROUP_HYBRID(group))

    return group_is_supported_standalone(group);

  for (size_t i = 0;

       i < MAX_HYBRID_GROUPS && group->ids[i] != GNUTLS_GROUP_INVALID;

       i++) {

    const gnutls_group_entry_st *p = group_to_entry(group->ids[i]);

    if (!p || !group_is_supported_standalone(p))

      return false;

  }

  return true;

}

/* Returns the TLS id of the given curve

 */

const gnutls_group_entry_st *_gnutls_tls_id_to_group(unsigned num)

{

  GNUTLS_GROUP_LOOP(

    if (p->tls_id == num && group_is_supported(p)) { return p; });

  return NULL;

}

const gnutls_group_entry_st *_gnutls_id_to_group(unsigned id)

{

  if (id == 0)

    return NULL;

  GNUTLS_GROUP_LOOP(

    if (p->id == id && group_is_supported(p)) { return p; });

  return NULL;

}

/**

 * gnutls_group_list:

 *

 * Get the list of supported elliptic curves.

 *

 * This function is not thread safe.

 *

 * Returns: Return a (0)-terminated list of #gnutls_group_t

 *   integers indicating the available groups.

 *

 * Since: 3.6.0

 **/

const gnutls_group_t *gnutls_group_list(void)

{

  static gnutls_group_t groups[MAX_ALGOS + 1] = { 0 };

  if (groups[0] == 0) {

    size_t i = 0;

    for (const gnutls_group_entry_st *p = supported_groups;

         p->name != NULL; p++) {

      if (group_is_supported(p))

        groups[i++] = p->id;

    }

    groups[i++] = GNUTLS_GROUP_INVALID;

  }

  return groups;

}

/**

 * gnutls_group_get_id:

 * @name: is a group name

 *

 * The names are compared in a case insensitive way.

 *

 * Returns: return a #gnutls_group_t value corresponding to

 *   the specified group, or %GNUTLS_GROUP_INVALID on error.

 *

 * Since: 3.6.0

 **/

gnutls_group_t gnutls_group_get_id(const char *name)

{

  gnutls_group_t ret = GNUTLS_GROUP_INVALID;

  GNUTLS_GROUP_LOOP(if (c_strcasecmp(p->name, name) == 0 &&

            (p->curve == 0 ||

             _gnutls_ecc_curve_is_supported(p->curve))) {

    ret = p->id;

    break;

  });

  return ret;

}

/* Similar to gnutls_group_get_id, except that it does not check if

 * the curve is supported.

 */

gnutls_group_t _gnutls_group_get_id(const char *name)

{

  gnutls_group_t ret = GNUTLS_GROUP_INVALID;

  GNUTLS_GROUP_LOOP(if (c_strcasecmp(p->name, name) == 0) {

    ret = p->id;

    break;

  });

  return ret;

}

/**

 * gnutls_group_get_name:

 * @group: is an element from %gnutls_group_t

 *

 * Convert a #gnutls_group_t value to a string.

 *

 * Returns: a string that contains the name of the specified

 *   group or %NULL.

 *

 * Since: 3.6.0

 **/

const char *gnutls_group_get_name(gnutls_group_t group)

{

  GNUTLS_GROUP_LOOP(if (p->id == group) { return p->name; });

  return NULL;

}

/* Expand GROUP into hybrid SUBGROUPS if any, otherwise an array

 * containing the GROUP itself. The result will be written to

 * SUBGROUPS, which will be NUL-terminated.

 */

int _gnutls_group_expand(

  const gnutls_group_entry_st *group,

  const gnutls_group_entry_st *subgroups[MAX_HYBRID_GROUPS + 1])

{

  size_t pos = 0;

  if (IS_GROUP_HYBRID(group)) {

    for (size_t i = 0; i < MAX_HYBRID_GROUPS &&

           group->ids[i] != GNUTLS_GROUP_INVALID;

         i++) {

      const gnutls_group_entry_st *p =

        group_to_entry(group->ids[i]);

      /* This shouldn't happen, as GROUP is assumed

       * to be supported before calling this

       * function. */

      if (unlikely(!p))

        return gnutls_assert_val(

          GNUTLS_E_INTERNAL_ERROR);

      subgroups[pos++] = p;

    }

  } else {

    subgroups[pos++] = group;

  }

  subgroups[pos] = NULL;

  return 0;

}