/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <sys/types.h>
#include <sys/crypto/common.h>
#include <security/cryptoki.h>
#include <bignum.h>
#include <des_impl.h>
#include "softGlobal.h"
#include "softSession.h"
#include "softObject.h"
#include "softEC.h"
#include "softCrypt.h"
#include "softOps.h"
#include "softMAC.h"

void
soft_free_ecparams(ECParams *params, boolean_t freeit)
{
        SECITEM_FreeItem(&params->fieldID.u.prime, B_FALSE);
        SECITEM_FreeItem(&params->curve.a, B_FALSE);
        SECITEM_FreeItem(&params->curve.b, B_FALSE);
        SECITEM_FreeItem(&params->curve.seed, B_FALSE);
        SECITEM_FreeItem(&params->base, B_FALSE);
        SECITEM_FreeItem(&params->order, B_FALSE);
        SECITEM_FreeItem(&params->DEREncoding, B_FALSE);
        SECITEM_FreeItem(&params->curveOID, B_FALSE);
        if (freeit)
                free(params);
}

static void
soft_free_ecc_context(soft_ecc_ctx_t *ecc_ctx)
{
        if (ecc_ctx != NULL) {
                if (ecc_ctx->key != NULL) {
                        soft_cleanup_object(ecc_ctx->key);
                        free(ecc_ctx->key);
                }

                soft_free_ecparams(&ecc_ctx->ecparams, B_FALSE);
                free(ecc_ctx);
        }
}

void
soft_free_ecprivkey(ECPrivateKey *key)
{
        soft_free_ecparams(&key->ecParams, B_FALSE);
        /*
         * Don't free publicValue or privateValue
         * as these values are copied into objects.
         */
        SECITEM_FreeItem(&key->version, B_FALSE);
        free(key);
}

/*
 * Called from init routines to do basic sanity checks. Init routines,
 * e.g. sign_init should fail rather than subsequent operations.
 */
static int
check_key(soft_object_t *key_p, boolean_t sign)
{
        biginteger_t *p;
        ulong_t len;

        if (sign) {
                if ((key_p->class != CKO_PRIVATE_KEY) ||
                    (key_p->key_type != CKK_EC))
                        return (CKR_KEY_TYPE_INCONSISTENT);

                p = OBJ_PRI_EC_VALUE(key_p);
                len = p->big_value_len;
                if (p->big_value == NULL)
                        len = 0;

                if (len < CRYPTO_BITS2BYTES(EC_MIN_KEY_LEN) ||
                    len > CRYPTO_BITS2BYTES(EC_MAX_KEY_LEN))
                        return (CKR_KEY_SIZE_RANGE);
        } else {
                if ((key_p->class != CKO_PUBLIC_KEY) ||
                    (key_p->key_type != CKK_EC))
                        return (CKR_KEY_TYPE_INCONSISTENT);

                p = OBJ_PUB_EC_POINT(key_p);
                len = p->big_value_len;
                if (p->big_value == NULL)
                        len = 0;

                if (len < CRYPTO_BITS2BYTES(EC_MIN_KEY_LEN) * 2 + 1 ||
                    len > CRYPTO_BITS2BYTES(EC_MAX_KEY_LEN) * 2 + 1)
                        return (CKR_KEY_SIZE_RANGE);
        }

        return (CKR_OK);
}

/*
 * This function places the octet string of the specified attribute
 * into the corresponding key object.
 */
static void
soft_genECkey_set_attribute(soft_object_t *key, biginteger_t *bi,
    CK_ATTRIBUTE_TYPE type)
{
        biginteger_t *dst;

        switch (type) {
        case CKA_VALUE:
                dst = OBJ_PRI_EC_VALUE(key);
                break;

        case CKA_EC_POINT:
                dst = OBJ_PUB_EC_POINT(key);
                break;
        }
        copy_bigint_attr(bi, dst);
}

CK_RV
soft_ec_genkey_pair(soft_object_t *pubkey, soft_object_t *prikey)
{
        CK_RV rv;
        CK_ATTRIBUTE template;
        ECPrivateKey *privKey;  /* contains both public and private values */
        ECParams *ecparams;
        SECKEYECParams params_item;
        biginteger_t bi;
        uchar_t param_buffer[EC_MAX_OID_LEN];
        uint_t paramlen;

        if ((pubkey->class != CKO_PUBLIC_KEY) ||
            (pubkey->key_type != CKK_EC))
                return (CKR_KEY_TYPE_INCONSISTENT);

        if ((prikey->class != CKO_PRIVATE_KEY) ||
            (prikey->key_type != CKK_EC))
                return (CKR_KEY_TYPE_INCONSISTENT);

        template.type = CKA_EC_PARAMS;
        template.pValue = param_buffer;
        template.ulValueLen = sizeof (param_buffer);
        rv = soft_get_public_key_attribute(pubkey, &template);
        if (rv != CKR_OK) {
                return (rv);
        }
        paramlen = template.ulValueLen;

        /* private key also has CKA_EC_PARAMS attribute */
        rv = set_extra_attr_to_object(prikey, CKA_EC_PARAMS, &template);
        if (rv != CKR_OK) {
                return (rv);
        }

        /* ASN1 check */
        if (param_buffer[0] != 0x06 ||
            param_buffer[1] != paramlen - 2) {
                return (CKR_ATTRIBUTE_VALUE_INVALID);
        }
        params_item.len = paramlen;
        params_item.data = param_buffer;
        if (EC_DecodeParams(&params_item, &ecparams, 0) != SECSuccess) {
                /* bad curve OID */
                return (CKR_ARGUMENTS_BAD);
        }

        if (EC_NewKey(ecparams, &privKey, 0) != SECSuccess) {
                soft_free_ecparams(ecparams, B_TRUE);
                return (CKR_FUNCTION_FAILED);
        }

        bi.big_value = privKey->privateValue.data;
        bi.big_value_len = privKey->privateValue.len;
        soft_genECkey_set_attribute(prikey, &bi, CKA_VALUE);

        bi.big_value = privKey->publicValue.data;
        bi.big_value_len = privKey->publicValue.len;
        soft_genECkey_set_attribute(pubkey, &bi, CKA_EC_POINT);

        soft_free_ecprivkey(privKey);
        soft_free_ecparams(ecparams, B_TRUE);

        return (CKR_OK);
}

CK_RV
soft_ec_key_derive(soft_object_t *basekey, soft_object_t *secretkey,
    void *mech_params, size_t mech_params_len)
{
        CK_RV           rv;
        CK_ATTRIBUTE    template;
        CK_ECDH1_DERIVE_PARAMS *ecdh1_derive_params = mech_params;
        uchar_t         value[EC_MAX_VALUE_LEN];
        uint32_t        value_len = sizeof (value);
        uchar_t         params[EC_MAX_OID_LEN];
        uint32_t        params_len = sizeof (params);
        uint32_t        keylen;
        ECParams        *ecparams;
        SECKEYECParams  params_item;
        SECItem         public_value_item, private_value_item, secret_item;
        uchar_t         *buf;

        if (mech_params_len != sizeof (CK_ECDH1_DERIVE_PARAMS) ||
            ecdh1_derive_params->kdf != CKD_NULL) {
                return (CKR_MECHANISM_PARAM_INVALID);
        }

        template.type = CKA_VALUE;
        template.pValue = value;
        template.ulValueLen = value_len;
        rv = soft_get_private_key_attribute(basekey, &template);
        if (rv != CKR_OK) {
                return (rv);
        }
        value_len = template.ulValueLen;
        private_value_item.data = value;
        private_value_item.len = value_len;

        template.type = CKA_EC_PARAMS;
        template.pValue = params;
        template.ulValueLen = params_len;
        rv = soft_get_private_key_attribute(basekey, &template);
        if (rv != CKR_OK) {
                return (rv);
        }
        params_len = template.ulValueLen;

        switch (secretkey->key_type) {
        case CKK_DES:
                keylen = DES_KEYSIZE;
                break;
        case CKK_DES2:
                keylen = DES2_KEYSIZE;
                break;
        case CKK_DES3:
                keylen = DES3_KEYSIZE;
                break;
        case CKK_RC4:
        case CKK_AES:
        case CKK_GENERIC_SECRET:
#ifdef  __sparcv9
                /* LINTED */
                keylen = (uint32_t)OBJ_SEC_VALUE_LEN(secretkey);
#else   /* !__sparcv9 */
                keylen = OBJ_SEC_VALUE_LEN(secretkey);
#endif  /* __sparcv9 */
                break;
        }

        /* ASN1 check */
        if (params[0] != 0x06 ||
            params[1] != params_len - 2) {
                return (CKR_ATTRIBUTE_VALUE_INVALID);
        }
        params_item.data = params;
        params_item.len = params_len;
        if (EC_DecodeParams(&params_item, &ecparams, 0) != SECSuccess) {
                /* bad curve OID */
                return (CKR_ARGUMENTS_BAD);
        }

        public_value_item.data = ecdh1_derive_params->pPublicData;
        public_value_item.len = ecdh1_derive_params->ulPublicDataLen;

        secret_item.data = NULL;
        secret_item.len = 0;

        if (ECDH_Derive(&public_value_item, ecparams, &private_value_item,
            B_FALSE, &secret_item, 0) != SECSuccess) {
                soft_free_ecparams(ecparams, B_TRUE);
                return (CKR_FUNCTION_FAILED);
        } else {
                rv = CKR_OK;
        }

        if (keylen == 0)
                keylen = secret_item.len;

        if (keylen > secret_item.len) {
                rv = CKR_ATTRIBUTE_VALUE_INVALID;
                goto out;
        }
        buf = malloc(keylen);
        if (buf == NULL) {
                rv = CKR_HOST_MEMORY;
                goto out;
        }
        bcopy(secret_item.data + secret_item.len - keylen, buf, keylen);
        OBJ_SEC_VALUE_LEN(secretkey) = keylen;
        OBJ_SEC_VALUE(secretkey) = buf;

out:
        soft_free_ecparams(ecparams, B_TRUE);
        SECITEM_FreeItem(&secret_item, B_FALSE);

        return (rv);
}

/*
 * Allocate a ECC context for the active sign or verify operation.
 * This function is called without the session lock held.
 */
CK_RV
soft_ecc_sign_verify_init_common(soft_session_t *session_p,
    CK_MECHANISM_PTR pMechanism, soft_object_t *key_p,
    boolean_t sign)
{
        CK_RV rv;
        CK_ATTRIBUTE template;
        CK_MECHANISM digest_mech;
        soft_ecc_ctx_t *ecc_ctx;
        soft_object_t *tmp_key = NULL;
        uchar_t params[EC_MAX_OID_LEN];
        ECParams *ecparams;
        SECKEYECParams params_item;

        if ((rv = check_key(key_p, sign)) != CKR_OK)
                return (rv);

        if (pMechanism->mechanism == CKM_ECDSA_SHA1) {
                digest_mech.mechanism = CKM_SHA_1;
                rv = soft_digest_init_internal(session_p, &digest_mech);
                if (rv != CKR_OK)
                        return (rv);
        }

        ecc_ctx = malloc(sizeof (soft_ecc_ctx_t));
        if (ecc_ctx == NULL) {
                return (CKR_HOST_MEMORY);
        }

        /*
         * Make a copy of the signature or verification key, and save it
         * in the ECC crypto context since it will be used later for
         * signing/verification. We don't want to hold any object reference
         * on this original key while doing signing/verification.
         */
        (void) pthread_mutex_lock(&key_p->object_mutex);
        rv = soft_copy_object(key_p, &tmp_key, SOFT_COPY_OBJ_ORIG_SH, NULL);
        if ((rv != CKR_OK) || (tmp_key == NULL)) {
                /* Most likely we ran out of space. */
                (void) pthread_mutex_unlock(&key_p->object_mutex);
                free(ecc_ctx);
                return (rv);
        }


        template.type = CKA_EC_PARAMS;
        template.pValue = params;
        template.ulValueLen = sizeof (params);
        rv = soft_get_private_key_attribute(key_p, &template);
        (void) pthread_mutex_unlock(&key_p->object_mutex);
        if (rv != CKR_OK) {
                goto out;
        }

        /* ASN1 check */
        if (params[0] != 0x06 ||
            params[1] != template.ulValueLen - 2) {
                rv = CKR_ATTRIBUTE_VALUE_INVALID;
                goto out;
        }
        params_item.data = params;
        params_item.len = template.ulValueLen;

        ecc_ctx->key = tmp_key;

        if (EC_DecodeParams(&params_item, &ecparams, 0) != SECSuccess) {
                /* bad curve OID */
                rv = CKR_ARGUMENTS_BAD;
                goto out;
        }
        ecc_ctx->ecparams = *ecparams;
        free(ecparams);

        (void) pthread_mutex_lock(&session_p->session_mutex);

        if (sign) {
                session_p->sign.context = ecc_ctx;
                session_p->sign.mech.mechanism = pMechanism->mechanism;
        } else {
                session_p->verify.context = ecc_ctx;
                session_p->verify.mech.mechanism = pMechanism->mechanism;
        }

        (void) pthread_mutex_unlock(&session_p->session_mutex);
        return (CKR_OK);

out:
        soft_cleanup_object(tmp_key);
        free(tmp_key);
        free(ecc_ctx);

        return (rv);
}

CK_RV
soft_ecc_digest_sign_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSigned,
    CK_ULONG_PTR pulSignedLen, boolean_t Final)
{
        CK_RV rv = CKR_OK;
        CK_BYTE hash[SHA1_HASH_SIZE];
        CK_ULONG hash_len = SHA1_HASH_SIZE;

        if (pSigned != NULL) {
                if (Final) {
                        rv = soft_digest_final(session_p, hash, &hash_len);
                } else {
                        rv = soft_digest(session_p, pData, ulDataLen, hash,
                            &hash_len);
                }

                if (rv != CKR_OK) {
                        (void) pthread_mutex_lock(&session_p->session_mutex);
                        soft_free_ecc_context(session_p->sign.context);
                        session_p->sign.context = NULL;
                        session_p->digest.flags = 0;
                        (void) pthread_mutex_unlock(&session_p->session_mutex);
                        return (rv);
                }
        }

        rv = soft_ecc_sign(session_p, hash, hash_len, pSigned, pulSignedLen);

        (void) pthread_mutex_lock(&session_p->session_mutex);
        /* soft_digest_common() has freed the digest context */
        session_p->digest.flags = 0;
        (void) pthread_mutex_unlock(&session_p->session_mutex);

        return (rv);
}

CK_RV
soft_ecc_sign(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSigned,
    CK_ULONG_PTR pulSignedLen)
{
        CK_RV rv = CKR_OK;
        SECStatus ss;
        soft_ecc_ctx_t *ecc_ctx = session_p->sign.context;
        soft_object_t *key = ecc_ctx->key;
        uchar_t value[EC_MAX_VALUE_LEN];
        ECPrivateKey ECkey;
        SECItem signature_item;
        SECItem digest_item;
        uint_t value_len;

        if ((key->class != CKO_PRIVATE_KEY) || (key->key_type != CKK_EC)) {
                rv = CKR_KEY_TYPE_INCONSISTENT;
                goto clean_exit;
        }

        if (ulDataLen > EC_MAX_DIGEST_LEN) {
                rv = CKR_DATA_LEN_RANGE;
                goto clean_exit;
        }

        /* structure assignment */
        ECkey.ecParams = ecc_ctx->ecparams;

        value_len = EC_MAX_VALUE_LEN;
        rv = soft_get_private_value(key, CKA_VALUE, value, &value_len);
        if (rv != CKR_OK) {
                goto clean_exit;
        }

        ECkey.privateValue.data = value;
        ECkey.privateValue.len = value_len;

        signature_item.data = pSigned;
        signature_item.len = *pulSignedLen;

        digest_item.data = pData;
        digest_item.len = ulDataLen;

        if ((ss = ECDSA_SignDigest(&ECkey, &signature_item, &digest_item, 0))
            != SECSuccess) {
                if (ss == SECBufferTooSmall)
                        return (CKR_BUFFER_TOO_SMALL);

                rv = CKR_FUNCTION_FAILED;
                goto clean_exit;
        }

        if (rv == CKR_OK) {
                *pulSignedLen = signature_item.len;
                if (pSigned == NULL)
                        return (rv);
        }

clean_exit:
        (void) pthread_mutex_lock(&session_p->session_mutex);
        soft_free_ecc_context(session_p->sign.context);
        session_p->sign.context = NULL;
        (void) pthread_mutex_unlock(&session_p->session_mutex);
        return (rv);
}

CK_RV
soft_ecc_verify(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSignature,
    CK_ULONG ulSignatureLen)
{
        CK_RV rv = CKR_OK;
        soft_ecc_ctx_t *ecc_ctx = session_p->verify.context;
        soft_object_t *key = ecc_ctx->key;
        uchar_t point[EC_MAX_POINT_LEN];
        CK_ATTRIBUTE template;
        ECPublicKey ECkey;
        SECItem signature_item;
        SECItem digest_item;

        if ((key->class != CKO_PUBLIC_KEY) ||(key->key_type != CKK_EC)) {
                rv = CKR_KEY_TYPE_INCONSISTENT;
                goto clean_exit;
        }

        if (ulSignatureLen > EC_MAX_SIG_LEN) {
                rv = CKR_SIGNATURE_LEN_RANGE;
                goto clean_exit;
        }

        if (ulDataLen > EC_MAX_DIGEST_LEN) {
                rv = CKR_DATA_LEN_RANGE;
                goto clean_exit;
        }

        /* structure assignment */
        ECkey.ecParams = ecc_ctx->ecparams;

        template.type = CKA_EC_POINT;
        template.pValue = point;
        template.ulValueLen = sizeof (point);
        rv = soft_get_public_key_attribute(key, &template);
        if (rv != CKR_OK) {
                goto clean_exit;
        }

        ECkey.publicValue.data = point;
        ECkey.publicValue.len = template.ulValueLen;

        signature_item.data = pSignature;
        signature_item.len = ulSignatureLen;

        digest_item.data = pData;
        digest_item.len = ulDataLen;

        if (ECDSA_VerifyDigest(&ECkey, &signature_item, &digest_item, 0)
            != SECSuccess) {
                rv = CKR_SIGNATURE_INVALID;
        } else {
                rv = CKR_OK;
        }

clean_exit:
        (void) pthread_mutex_lock(&session_p->session_mutex);
        soft_free_ecc_context(session_p->verify.context);
        session_p->verify.context = NULL;
        (void) pthread_mutex_unlock(&session_p->session_mutex);
        return (rv);
}


CK_RV
soft_ecc_digest_verify_common(soft_session_t *session_p, CK_BYTE_PTR pData,
    CK_ULONG ulDataLen, CK_BYTE_PTR pSigned,
    CK_ULONG ulSignedLen, boolean_t Final)
{
        CK_RV rv;
        CK_BYTE hash[SHA1_HASH_SIZE];
        CK_ULONG hash_len = SHA1_HASH_SIZE;

        if (Final) {
                rv = soft_digest_final(session_p, hash, &hash_len);
        } else {
                rv = soft_digest(session_p, pData, ulDataLen, hash, &hash_len);
        }

        if (rv != CKR_OK) {
                (void) pthread_mutex_lock(&session_p->session_mutex);
                soft_free_ecc_context(session_p->verify.context);
                session_p->verify.context = NULL;
                session_p->digest.flags = 0;
                (void) pthread_mutex_unlock(&session_p->session_mutex);
                return (rv);
        }

        /*
         * Now, we are ready to verify the data using signature.
         * soft_ecc_verify() will free the verification key.
         */
        rv = soft_ecc_verify(session_p, hash, hash_len,
            pSigned, ulSignedLen);

        (void) pthread_mutex_lock(&session_p->session_mutex);
        /* soft_digest_common() has freed the digest context */
        session_p->digest.flags = 0;
        (void) pthread_mutex_unlock(&session_p->session_mutex);
        return (rv);
}