/* $OpenBSD: ssl_kex.c,v 1.12 2023/07/28 16:02:34 tb Exp $ */
/*
 * Copyright (c) 2020, 2021 Joel Sing <jsing@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <stdlib.h>

#include <openssl/bn.h>
#include <openssl/dh.h>
#include <openssl/ec.h>
#include <openssl/evp.h>
#include <openssl/objects.h>

#include "bytestring.h"

#define DHE_MINIMUM_BITS	1024

int
ssl_kex_generate_dhe(DH *dh, DH *dh_params)
{
	BIGNUM *p = NULL, *g = NULL;
	int ret = 0;

	if ((p = BN_dup(DH_get0_p(dh_params))) == NULL)
		goto err;
	if ((g = BN_dup(DH_get0_g(dh_params))) == NULL)
		goto err;

	if (!DH_set0_pqg(dh, p, NULL, g))
		goto err;
	p = NULL;
	g = NULL;

	if (!DH_generate_key(dh))
		goto err;

	ret = 1;

 err:
	BN_free(p);
	BN_free(g);

	return ret;
}

int
ssl_kex_generate_dhe_params_auto(DH *dh, size_t key_bits)
{
	BIGNUM *p = NULL, *g = NULL;
	int ret = 0;

	if (key_bits >= 8192)
		p = BN_get_rfc3526_prime_8192(NULL);
	else if (key_bits >= 4096)
		p = BN_get_rfc3526_prime_4096(NULL);
	else if (key_bits >= 3072)
		p = BN_get_rfc3526_prime_3072(NULL);
	else if (key_bits >= 2048)
		p = BN_get_rfc3526_prime_2048(NULL);
	else if (key_bits >= 1536)
		p = BN_get_rfc3526_prime_1536(NULL);
	else
		p = BN_get_rfc2409_prime_1024(NULL);

	if (p == NULL)
		goto err;

	if ((g = BN_new()) == NULL)
		goto err;
	if (!BN_set_word(g, 2))
		goto err;

	if (!DH_set0_pqg(dh, p, NULL, g))
		goto err;
	p = NULL;
	g = NULL;

	if (!DH_generate_key(dh))
		goto err;

	ret = 1;

 err:
	BN_free(p);
	BN_free(g);

	return ret;
}

int
ssl_kex_params_dhe(DH *dh, CBB *cbb)
{
	int dh_p_len, dh_g_len;
	CBB dh_p, dh_g;
	uint8_t *data;

	if ((dh_p_len = BN_num_bytes(DH_get0_p(dh))) <= 0)
		return 0;
	if ((dh_g_len = BN_num_bytes(DH_get0_g(dh))) <= 0)
		return 0;

	if (!CBB_add_u16_length_prefixed(cbb, &dh_p))
		return 0;
	if (!CBB_add_space(&dh_p, &data, dh_p_len))
		return 0;
	if (BN_bn2bin(DH_get0_p(dh), data) != dh_p_len)
		return 0;

	if (!CBB_add_u16_length_prefixed(cbb, &dh_g))
		return 0;
	if (!CBB_add_space(&dh_g, &data, dh_g_len))
		return 0;
	if (BN_bn2bin(DH_get0_g(dh), data) != dh_g_len)
		return 0;

	if (!CBB_flush(cbb))
		return 0;

	return 1;
}

int
ssl_kex_public_dhe(DH *dh, CBB *cbb)
{
	uint8_t *data;
	int dh_y_len;
	CBB dh_y;

	if ((dh_y_len = BN_num_bytes(DH_get0_pub_key(dh))) <= 0)
		return 0;

	if (!CBB_add_u16_length_prefixed(cbb, &dh_y))
		return 0;
	if (!CBB_add_space(&dh_y, &data, dh_y_len))
		return 0;
	if (BN_bn2bin(DH_get0_pub_key(dh), data) != dh_y_len)
		return 0;

	if (!CBB_flush(cbb))
		return 0;

	return 1;
}

int
ssl_kex_peer_params_dhe(DH *dh, CBS *cbs, int *decode_error,
    int *invalid_params)
{
	BIGNUM *p = NULL, *g = NULL;
	CBS dh_p, dh_g;
	int ret = 0;

	*decode_error = 0;
	*invalid_params = 0;

	if (!CBS_get_u16_length_prefixed(cbs, &dh_p)) {
		*decode_error = 1;
		goto err;
	}
	if (!CBS_get_u16_length_prefixed(cbs, &dh_g)) {
		*decode_error = 1;
		goto err;
	}

	if ((p = BN_bin2bn(CBS_data(&dh_p), CBS_len(&dh_p), NULL)) == NULL)
		goto err;
	if ((g = BN_bin2bn(CBS_data(&dh_g), CBS_len(&dh_g), NULL)) == NULL)
		goto err;

	if (!DH_set0_pqg(dh, p, NULL, g))
		goto err;
	p = NULL;
	g = NULL;

	/* XXX - consider calling DH_check(). */

	if (DH_bits(dh) < DHE_MINIMUM_BITS)
		*invalid_params = 1;

	ret = 1;

 err:
	BN_free(p);
	BN_free(g);

	return ret;
}

int
ssl_kex_peer_public_dhe(DH *dh, CBS *cbs, int *decode_error,
    int *invalid_key)
{
	BIGNUM *pub_key = NULL;
	int check_flags;
	CBS dh_y;
	int ret = 0;

	*decode_error = 0;
	*invalid_key = 0;

	if (!CBS_get_u16_length_prefixed(cbs, &dh_y)) {
		*decode_error = 1;
		goto err;
	}

	if ((pub_key = BN_bin2bn(CBS_data(&dh_y), CBS_len(&dh_y),
	    NULL)) == NULL)
		goto err;

	if (!DH_set0_key(dh, pub_key, NULL))
		goto err;
	pub_key = NULL;

	if (!DH_check_pub_key(dh, DH_get0_pub_key(dh), &check_flags))
		goto err;
	if (check_flags != 0)
		*invalid_key = 1;

	ret = 1;

 err:
	BN_free(pub_key);

	return ret;
}

int
ssl_kex_derive_dhe(DH *dh, DH *dh_peer,
    uint8_t **shared_key, size_t *shared_key_len)
{
	uint8_t *key = NULL;
	int key_len = 0;
	int ret = 0;

	if ((key_len = DH_size(dh)) <= 0)
		goto err;
	if ((key = calloc(1, key_len)) == NULL)
		goto err;

	if ((key_len = DH_compute_key(key, DH_get0_pub_key(dh_peer), dh)) <= 0)
		goto err;

	*shared_key = key;
	*shared_key_len = key_len;
	key = NULL;

	ret = 1;

 err:
	freezero(key, key_len);

	return ret;
}

int
ssl_kex_dummy_ecdhe_x25519(EVP_PKEY *pkey)
{
	EC_GROUP *group = NULL;
	EC_POINT *point = NULL;
	EC_KEY *ec_key = NULL;
	BIGNUM *order = NULL;
	int ret = 0;

	/* Fudge up an EC_KEY that looks like X25519... */
	if ((group = EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) == NULL)
		goto err;
	if ((point = EC_POINT_new(group)) == NULL)
		goto err;
	if ((order = BN_new()) == NULL)
		goto err;
	if (!BN_set_bit(order, 252))
		goto err;
	if (!EC_GROUP_set_generator(group, point, order, NULL))
		goto err;
	EC_GROUP_set_curve_name(group, NID_X25519);
	if ((ec_key = EC_KEY_new()) == NULL)
		goto err;
	if (!EC_KEY_set_group(ec_key, group))
		goto err;
	if (!EVP_PKEY_set1_EC_KEY(pkey, ec_key))
		goto err;

	ret = 1;

 err:
	EC_GROUP_free(group);
	EC_POINT_free(point);
	EC_KEY_free(ec_key);
	BN_free(order);

	return ret;
}

int
ssl_kex_generate_ecdhe_ecp(EC_KEY *ecdh, int nid)
{
	EC_GROUP *group;
	int ret = 0;

	if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL)
		goto err;

	if (!EC_KEY_set_group(ecdh, group))
		goto err;
	if (!EC_KEY_generate_key(ecdh))
		goto err;

	ret = 1;

 err:
	EC_GROUP_free(group);

	return ret;
}

int
ssl_kex_public_ecdhe_ecp(EC_KEY *ecdh, CBB *cbb)
{
	const EC_GROUP *group;
	const EC_POINT *point;
	uint8_t *ecp;
	size_t ecp_len;
	int ret = 0;

	if ((group = EC_KEY_get0_group(ecdh)) == NULL)
		goto err;
	if ((point = EC_KEY_get0_public_key(ecdh)) == NULL)
		goto err;

	if ((ecp_len = EC_POINT_point2oct(group, point,
	    POINT_CONVERSION_UNCOMPRESSED, NULL, 0, NULL)) == 0)
		goto err;
	if (!CBB_add_space(cbb, &ecp, ecp_len))
		goto err;
	if ((EC_POINT_point2oct(group, point, POINT_CONVERSION_UNCOMPRESSED,
	    ecp, ecp_len, NULL)) == 0)
		goto err;

	ret = 1;

 err:
	return ret;
}

int
ssl_kex_peer_public_ecdhe_ecp(EC_KEY *ecdh, int nid, CBS *cbs)
{
	EC_GROUP *group = NULL;
	EC_POINT *point = NULL;
	int ret = 0;

	if ((group = EC_GROUP_new_by_curve_name(nid)) == NULL)
		goto err;

	if (!EC_KEY_set_group(ecdh, group))
		goto err;

	if ((point = EC_POINT_new(group)) == NULL)
		goto err;
	if (EC_POINT_oct2point(group, point, CBS_data(cbs), CBS_len(cbs),
	    NULL) == 0)
		goto err;
	if (!EC_KEY_set_public_key(ecdh, point))
		goto err;

	ret = 1;

 err:
	EC_GROUP_free(group);
	EC_POINT_free(point);

	return ret;
}

int
ssl_kex_derive_ecdhe_ecp(EC_KEY *ecdh, EC_KEY *ecdh_peer,
    uint8_t **shared_key, size_t *shared_key_len)
{
	const EC_POINT *point;
	uint8_t *key = NULL;
	int key_len = 0;
	int ret = 0;

	if (!EC_GROUP_check(EC_KEY_get0_group(ecdh), NULL))
		goto err;
	if (!EC_GROUP_check(EC_KEY_get0_group(ecdh_peer), NULL))
		goto err;

	if ((point = EC_KEY_get0_public_key(ecdh_peer)) == NULL)
		goto err;

	if ((key_len = ECDH_size(ecdh)) <= 0)
		goto err;
	if ((key = calloc(1, key_len)) == NULL)
		goto err;

	if (ECDH_compute_key(key, key_len, point, ecdh, NULL) <= 0)
		goto err;

	*shared_key = key;
	*shared_key_len = key_len;
	key = NULL;

	ret = 1;

 err:
	freezero(key, key_len);

	return ret;
}