/*      $OpenBSD: cipher_list.c,v 1.14 2022/12/17 16:05:28 jsing Exp $  */
/*
 * Copyright (c) 2015 Doug Hogan <doug@openbsd.org>
 * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/*
 * Test TLS ssl bytes (aka cipher suites) to cipher list and back.
 *
 * TLSv1.0 - RFC 2246 section 7.4.1.2 (ClientHello struct)
 * TLSv1.1 - RFC 4346 section 7.4.1.2 (ClientHello struct)
 * TLSv1.2 - RFC 5246 section 7.4.1.2 (ClientHello struct)
 *
 * In all of these standards, the relevant structures are:
 *
 * uint8 CipherSuite[2];
 *
 * struct {
 *    ...
 *    CipherSuite cipher_suites<2..2^16-2>
 *    ...
 * } ClientHello;
 */

#include <openssl/ssl.h>

#include <stdio.h>
#include <string.h>

#include "ssl_local.h"

#include "tests.h"

static uint8_t cipher_bytes[] = {
        0xcc, 0xa8,     /* ECDHE-ECDSA-CHACHA20-POLY1305 */
        0xcc, 0xa9,     /* ECDHE-RSA-CHACHA20-POLY1305 */
        0xcc, 0xaa,     /* DHE-RSA-CHACHA20-POLY1305 */
        0x00, 0x9c,     /* AES128-GCM-SHA256 */
        0x00, 0x3d,     /* AES256-SHA256 */
};

static uint8_t cipher_bytes_seclevel3[] = {
        0xcc, 0xa8,     /* ECDHE-ECDSA-CHACHA20-POLY1305 */
        0xcc, 0xa9,     /* ECDHE-RSA-CHACHA20-POLY1305 */
        0xcc, 0xaa,     /* DHE-RSA-CHACHA20-POLY1305 */
};

static uint16_t cipher_values[] = {
        0xcca8,         /* ECDHE-ECDSA-CHACHA20-POLY1305 */
        0xcca9,         /* ECDHE-RSA-CHACHA20-POLY1305 */
        0xccaa,         /* DHE-RSA-CHACHA20-POLY1305 */
        0x009c,         /* AES128-GCM-SHA256 */
        0x003d,         /* AES256-SHA256 */
};

#define N_CIPHERS (sizeof(cipher_bytes) / 2)

static int
ssl_bytes_to_list_alloc(SSL *s, STACK_OF(SSL_CIPHER) **ciphers)
{
        SSL_CIPHER *cipher;
        uint16_t value;
        CBS cbs;
        int i;

        CBS_init(&cbs, cipher_bytes, sizeof(cipher_bytes));

        *ciphers = ssl_bytes_to_cipher_list(s, &cbs);
        CHECK(*ciphers != NULL);
        CHECK(sk_SSL_CIPHER_num(*ciphers) == N_CIPHERS);
        for (i = 0; i < sk_SSL_CIPHER_num(*ciphers); i++) {
                cipher = sk_SSL_CIPHER_value(*ciphers, i);
                CHECK(cipher != NULL);
                value = SSL_CIPHER_get_value(cipher);
                CHECK(value == cipher_values[i]);
        }

        return 1;
}

static int
ssl_list_to_bytes_scsv(SSL *s, STACK_OF(SSL_CIPHER) **ciphers,
    const uint8_t *cb, size_t cb_len)
{
        CBB cbb;
        unsigned char *buf = NULL;
        size_t buflen, outlen;
        int ret = 0;

        /* Space for cipher bytes, plus reneg SCSV and two spare bytes. */
        CHECK(sk_SSL_CIPHER_num(*ciphers) == N_CIPHERS);
        buflen = cb_len + 2 + 2;
        CHECK((buf = calloc(1, buflen)) != NULL);

        /* Clear renegotiate so it adds SCSV */
        s->renegotiate = 0;

        CHECK_GOTO(CBB_init_fixed(&cbb, buf, buflen));
        CHECK_GOTO(ssl_cipher_list_to_bytes(s, *ciphers, &cbb));
        CHECK_GOTO(CBB_finish(&cbb, NULL, &outlen));

        CHECK_GOTO(outlen > 0 && outlen == cb_len + 2);
        CHECK_GOTO(memcmp(buf, cb, cb_len) == 0);
        CHECK_GOTO(buf[buflen - 4] == 0x00 && buf[buflen - 3] == 0xff);
        CHECK_GOTO(buf[buflen - 2] == 0x00 && buf[buflen - 1] == 0x00);

        ret = 1;

 err:
        free(buf);
        return ret;
}

static int
ssl_list_to_bytes_no_scsv(SSL *s, STACK_OF(SSL_CIPHER) **ciphers,
    const uint8_t *cb, size_t cb_len)
{
        CBB cbb;
        unsigned char *buf = NULL;
        size_t buflen, outlen;
        int ret = 0;

        /* Space for cipher bytes and two spare bytes */
        CHECK(sk_SSL_CIPHER_num(*ciphers) == N_CIPHERS);
        buflen = cb_len + 2;
        CHECK((buf = calloc(1, buflen)) != NULL);
        buf[buflen - 2] = 0xfe;
        buf[buflen - 1] = 0xab;

        /* Set renegotiate so it doesn't add SCSV */
        s->renegotiate = 1;

        CHECK_GOTO(CBB_init_fixed(&cbb, buf, buflen));
        CHECK_GOTO(ssl_cipher_list_to_bytes(s, *ciphers, &cbb));
        CHECK_GOTO(CBB_finish(&cbb, NULL, &outlen));

        CHECK_GOTO(outlen > 0 && outlen == cb_len);
        CHECK_GOTO(memcmp(buf, cb, cb_len) == 0);
        CHECK_GOTO(buf[buflen - 2] == 0xfe && buf[buflen - 1] == 0xab);

        ret = 1;

 err:
        free(buf);
        return ret;
}

static int
ssl_bytes_to_list_invalid(SSL *s, STACK_OF(SSL_CIPHER) **ciphers)
{
        uint8_t empty_cipher_bytes[] = {0};
        CBS cbs;

        sk_SSL_CIPHER_free(*ciphers);

        /* Invalid length: CipherSuite is 2 bytes so it must be even */
        CBS_init(&cbs, cipher_bytes, sizeof(cipher_bytes) - 1);
        *ciphers = ssl_bytes_to_cipher_list(s, &cbs);
        CHECK(*ciphers == NULL);

        /* Invalid length: cipher_suites must be at least 2 */
        CBS_init(&cbs, empty_cipher_bytes, sizeof(empty_cipher_bytes));
        *ciphers = ssl_bytes_to_cipher_list(s, &cbs);
        CHECK(*ciphers == NULL);

        return 1;
}

int
main(void)
{
        STACK_OF(SSL_CIPHER) *ciphers = NULL;
        SSL_CTX *ctx = NULL;
        SSL *s = NULL;
        int rv = 1;

        SSL_library_init();

        /* Use TLSv1.2 client to get all ciphers. */
        CHECK_GOTO((ctx = SSL_CTX_new(TLSv1_2_client_method())) != NULL);
        CHECK_GOTO((s = SSL_new(ctx)) != NULL);
        SSL_set_security_level(s, 2);

        if (!ssl_bytes_to_list_alloc(s, &ciphers))
                goto err;
        if (!ssl_list_to_bytes_scsv(s, &ciphers, cipher_bytes,
            sizeof(cipher_bytes)))
                goto err;
        if (!ssl_list_to_bytes_no_scsv(s, &ciphers, cipher_bytes,
            sizeof(cipher_bytes)))
                goto err;
        if (!ssl_bytes_to_list_invalid(s, &ciphers))
                goto err;

        sk_SSL_CIPHER_free(ciphers);
        ciphers = NULL;

        SSL_set_security_level(s, 3);
        if (!ssl_bytes_to_list_alloc(s, &ciphers))
                goto err;
        if (!ssl_list_to_bytes_scsv(s, &ciphers, cipher_bytes_seclevel3,
            sizeof(cipher_bytes_seclevel3)))
                goto err;
        if (!ssl_list_to_bytes_no_scsv(s, &ciphers, cipher_bytes_seclevel3,
            sizeof(cipher_bytes_seclevel3)))
                goto err;

        rv = 0;

 err:
        sk_SSL_CIPHER_free(ciphers);
        SSL_CTX_free(ctx);
        SSL_free(s);

        if (!rv)
                printf("PASS %s\n", __FILE__);

        return rv;
}