/*
 * Copyright (C) 2015-2018 Red Hat, Inc.
 *
 * This file is part of GnuTLS.
 *
 * GnuTLS is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * GnuTLS is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <assert.h>
#include <stdint.h>

#include "virt-time.h"
#include "../../lib/tls13/anti_replay.h"
#include "../../lib/system.h"

/* utils.h must be loaded after gnutls_int.h, as it redefines some
 * macros from gnulib */
#include "utils.h"

#define MAX_CLIENT_HELLO_RECORDED 10

struct storage_st {
	gnutls_datum_t entries[MAX_CLIENT_HELLO_RECORDED];
	size_t num_entries;
};

static int
storage_add(void *ptr, time_t expires, const gnutls_datum_t *key, const gnutls_datum_t *value)
{
	struct storage_st *storage = ptr;
	gnutls_datum_t *datum;
	size_t i;

	for (i = 0; i < storage->num_entries; i++) {
		if (key->size == storage->entries[i].size &&
		    memcmp(storage->entries[i].data, key->data, key->size) == 0) {
			return GNUTLS_E_DB_ENTRY_EXISTS;
		}
	}

	/* If the maximum number of ClientHello exceeded, reject early
	 * data until next time.
	 */
	if (storage->num_entries == MAX_CLIENT_HELLO_RECORDED)
		return GNUTLS_E_DB_ERROR;

	datum = &storage->entries[storage->num_entries];
	datum->data = gnutls_malloc(key->size);
	if (!datum->data)
		return GNUTLS_E_MEMORY_ERROR;
	memcpy(datum->data, key->data, key->size);
	datum->size = key->size;

	storage->num_entries++;

	return 0;
}

static void
storage_clear(struct storage_st *storage)
{
	size_t i;

	for (i = 0; i < storage->num_entries; i++)
		gnutls_free(storage->entries[i].data);
	storage->num_entries = 0;
}

void doit(void)
{
	gnutls_anti_replay_t anti_replay;
	gnutls_datum_t key = { (unsigned char *) "\xFF\xFF\xFF\xFF", 4 };
	struct timespec creation_time;
	struct storage_st storage;
	int ret;

	virt_time_init();
	memset(&storage, 0, sizeof(storage));

	/* server_ticket_age < client_ticket_age */
	ret = gnutls_anti_replay_init(&anti_replay);
	assert(ret == 0);
	gnutls_anti_replay_set_window(anti_replay, 10000);
	gnutls_anti_replay_set_add_function(anti_replay, storage_add);
	gnutls_anti_replay_set_ptr(anti_replay, &storage);
	mygettime(&creation_time);
	ret = _gnutls_anti_replay_check(anti_replay, 10000, &creation_time, &key);
	if (ret != GNUTLS_E_ILLEGAL_PARAMETER)
		fail("error is not returned, while server_ticket_age < client_ticket_age\n");
	gnutls_anti_replay_deinit(anti_replay);
	storage_clear(&storage);

	/* server_ticket_age - client_ticket_age > window */
	ret = gnutls_anti_replay_init(&anti_replay);
	assert(ret == 0);
	gnutls_anti_replay_set_add_function(anti_replay, storage_add);
	gnutls_anti_replay_set_ptr(anti_replay, &storage);
	gnutls_anti_replay_set_window(anti_replay, 10000);
	mygettime(&creation_time);
	virt_sec_sleep(30);
	ret = _gnutls_anti_replay_check(anti_replay, 10000, &creation_time, &key);
	if (ret != GNUTLS_E_EARLY_DATA_REJECTED)
		fail("early data is NOT rejected, while freshness check fails\n");
	gnutls_anti_replay_deinit(anti_replay);
	storage_clear(&storage);

	/* server_ticket_age - client_ticket_age < window */
	ret = gnutls_anti_replay_init(&anti_replay);
	assert(ret == 0);
	gnutls_anti_replay_set_add_function(anti_replay, storage_add);
	gnutls_anti_replay_set_ptr(anti_replay, &storage);
	gnutls_anti_replay_set_window(anti_replay, 10000);
	mygettime(&creation_time);
	virt_sec_sleep(15);
	ret = _gnutls_anti_replay_check(anti_replay, 10000, &creation_time, &key);
	if (ret != 0)
		fail("early data is rejected, while freshness check succeeds\n");
	ret = _gnutls_anti_replay_check(anti_replay, 10000, &creation_time, &key);
	if (ret != GNUTLS_E_EARLY_DATA_REJECTED)
		fail("early data is NOT rejected for a duplicate key\n");
	gnutls_anti_replay_deinit(anti_replay);
	storage_clear(&storage);
}