 /*
 * libwebsockets - small server side websockets and web server implementation
 *
 * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to
 * deal in the Software without restriction, including without limitation the
 * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 * sell copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
 * IN THE SOFTWARE.
 *
 *  This is included from private-lib-core.h if LWS_WITH_TLS
 */

#if !defined(__LWS_TLS_PRIVATE_H__)
#define __LWS_TLS_PRIVATE_H__


#if defined(LWS_WITH_TLS)

#include "private-jit-trust.h"

#if defined(WIN32) && defined(LWS_WITH_SCHANNEL)
 #include <wincrypt.h>
 #include <bcrypt.h>
 #include <ncrypt.h>
#else

#if defined(USE_WOLFSSL)
 #if defined(USE_OLD_CYASSL)
  #if defined(_WIN32)
   #include <IDE/WIN/user_settings.h>
   #include <cyassl/ctaocrypt/settings.h>
  #else
   #include <cyassl/options.h>
  #endif
  #include <cyassl/openssl/ssl.h>
  #include <cyassl/error-ssl.h>
 #else
  #if defined(_WIN32)
   #include <IDE/WIN/user_settings.h>
   #include <wolfssl/wolfcrypt/settings.h>
  #else
   #include <wolfssl/options.h>
  #endif
  #include <wolfssl/openssl/ssl.h>
  #include <wolfssl/error-ssl.h>
  #define OPENSSL_NO_TLSEXT
 #endif /* not USE_OLD_CYASSL */
#else /* WOLFSSL */
 #if defined(LWS_PLAT_FREERTOS)
  #define OPENSSL_NO_TLSEXT
  #if !defined(LWS_AMAZON_RTOS)
   /* AMAZON RTOS has its own setting via MTK_MBEDTLS_CONFIG_FILE */
   #undef MBEDTLS_CONFIG_FILE
   #define MBEDTLS_CONFIG_FILE <mbedtls/esp_config.h>
  #endif
   #include <mbedtls/ssl.h>
#if !defined(LWS_HAVE_MBEDTLS_V4)
  #include <mbedtls/aes.h>
  #include <mbedtls/gcm.h>
#endif
  #include <mbedtls/x509_crt.h>
 #else /* not esp32 */
  #if defined(LWS_WITH_MBEDTLS)
   #include <mbedtls/ssl.h>
#if !defined(LWS_HAVE_MBEDTLS_V4)
   #include <mbedtls/aes.h>
   #include <mbedtls/gcm.h>
#endif
   #include <mbedtls/x509_crt.h>
   #include <mbedtls/x509_csr.h>
#if !defined(LWS_HAVE_MBEDTLS_V4)
   #include <mbedtls/ecp.h>
   #include <mbedtls/ecdsa.h>
#else
   #include <psa/crypto.h>
#endif
  #elif defined(LWS_WITH_GNUTLS)
   #include <gnutls/gnutls.h>
   #include <gnutls/abstract.h>
   #include <gnutls/crypto.h>
  #elif defined(LWS_WITH_OPENHITLS)
   #include "openhitls/private.h"
  #else
   #include <openssl/ssl.h>
   #include <openssl/evp.h>
   #include <openssl/err.h>
   #include <openssl/md5.h>
   #include <openssl/sha.h>
   #include <openssl/rsa.h>
   #include <openssl/bn.h>
   #include <openssl/aes.h>
   #ifdef LWS_HAVE_OPENSSL_ECDH_H
    #include <openssl/ecdh.h>
   #endif
   #if !defined(LWS_HAVE_EVP_MD_CTX_free) && !defined(USE_WOLFSSL)
    #define EVP_MD_CTX_free EVP_MD_CTX_destroy
   #endif
   #include <openssl/x509v3.h>
  #endif /* not mbedtls */
  #if defined(OPENSSL_VERSION_NUMBER)
   #if (OPENSSL_VERSION_NUMBER < 0x0009080afL)
/*
 * later openssl defines this to negate the presence of tlsext... but it was
 * only introduced at 0.9.8j.  Earlier versions don't know it exists so don't
 * define it... making it look like the feature exists...
 */
    #define OPENSSL_NO_TLSEXT
   #endif
  #endif
 #endif /* not ESP32 */
#endif /* not USE_WOLFSSL */

#endif /* !LWS_WITH_SCHANNEL */

#endif /* LWS_WITH_TLS */

enum lws_tls_extant {
	LWS_TLS_EXTANT_NO,
	LWS_TLS_EXTANT_YES,
	LWS_TLS_EXTANT_ALTERNATIVE
};

#if defined(LWS_WITH_TLS)

#if defined(LWS_WITH_TLS_SESSIONS) && defined(LWS_WITH_CLIENT) && \
	(defined(LWS_WITH_MBEDTLS) || defined(OPENSSL_IS_BORINGSSL)) || defined(OPENSSL_IS_AWSLC)
#define LWS_TLS_SYNTHESIZE_CB 1
#endif

int
lws_tls_restrict_borrow(struct lws *wsi);

void
lws_tls_restrict_return(struct lws *wsi);

void
lws_tls_restrict_return_handshake(struct lws *wsi);

void
lws_tls_restrict_return(struct lws *wsi);

void
lws_tls_restrict_return_handshake(struct lws *wsi);

#if defined(LWS_WITH_SCHANNEL)
struct lws_tls_schannel_conn;
struct lws_tls_schannel_ctx;
struct lws_tls_schannel_bio;
struct lws_tls_schannel_x509;
typedef struct lws_tls_schannel_conn lws_tls_conn;
typedef struct lws_tls_schannel_ctx lws_tls_ctx;
typedef struct lws_tls_schannel_bio lws_tls_bio;
typedef struct lws_tls_schannel_x509 lws_tls_x509;
int lws_tls_schannel_server_conn_alpn(struct lws *wsi);
#elif defined(LWS_WITH_GNUTLS)
#include "gnutls/private.h"
#elif defined(LWS_WITH_BEARSSL)
#include "bearssl/private-lib-tls-bearssl.h"
#elif defined(LWS_WITH_MBEDTLS)
#include "mbedtls/private-lib-tls-mbedtls.h"
#elif defined(LWS_WITH_OPENHITLS)
/* openhitls types are already defined in openhitls/private.h */
#else
typedef SSL lws_tls_conn;
typedef SSL_CTX lws_tls_ctx;
typedef BIO lws_tls_bio;
typedef X509 lws_tls_x509;
#endif

#if defined(LWS_WITH_NETWORK)
#include "private-network.h"
#endif

#if defined(LWS_ROLE_QUIC) && defined(LWS_WITH_TLS) && !defined(LWS_WITH_WOLFSSL) && !defined(LWS_WITH_SCHANNEL) && !defined(LWS_WITH_GNUTLS) && !defined(LWS_WITH_BEARSSL)
int
lws_tls_quic_vhost_init(lws_tls_ctx *ctx);
#endif

#if defined(LWS_ROLE_QUIC) && defined(LWS_WITH_TLS)
/*
 * Feed parsed QUIC CRYPTO frame data into the active TLS backend
 * (e.g., via OpenSSL SSL_provide_quic_data)
 */
int
lws_tls_quic_rx_crypto(struct lws *wsi, int level, const uint8_t *buf, size_t len);

/*
 * Callback from the TLS backend when it has generated outbound CRYPTO data
 * (e.g., ServerHello). LWS wraps this in a tx_frame and queues it to pending_tx.
 */
int
lws_tls_quic_tx_crypto_cb(struct lws *wsi, int level, const uint8_t *buf, size_t len);
#endif

enum {
	CCTLS_RETURN_ERROR		= -1,
	CCTLS_RETURN_DONE		= 0,
	CCTLS_RETURN_RETRY		= 1,
};

int
lws_client_create_tls(struct lws *wsi, const char **pcce, int do_c1);

int
lws_context_init_ssl_library(struct lws_context *cx,
			     const struct lws_context_creation_info *info);
void
lws_context_deinit_ssl_library(struct lws_context *context);
#define LWS_SSL_ENABLED(vh) (vh && vh->tls.use_ssl)

extern const struct lws_tls_ops tls_ops_openssl, tls_ops_mbedtls, tls_ops_schannel,
				 tls_ops_gnutls, tls_ops_bearssl;
extern const struct lws_tls_ops tls_ops_openhitls;

struct lws_ec_valid_curves {
	int id;
	const char *jwa_name; /* list terminates with NULL jwa_name */
};

enum lws_tls_extant
lws_tls_use_any_upgrade_check_extant(const char *name);
extern int openssl_websocket_private_data_index;

void
lws_tls_err_describe_clear(void);

#if !defined(LWS_WITH_MBEDTLS)
int
lws_tls_openssl_cert_info(X509 *x509, enum lws_tls_cert_info type,
			  union lws_tls_cert_info_results *buf, size_t len);
#endif
int
lws_tls_check_all_cert_lifetimes(struct lws_context *context);

LWS_VISIBLE int
lws_tls_cert_get_x509_remaining(struct lws_context *context, const char *filepath, int *days_left, int *total_days);

#if defined(LWS_WITH_NETWORK) && defined(LWS_WITH_CLIENT)
int
lws_tls_client_vhost_extra_cert_mem(struct lws_vhost *vh, const uint8_t *der, size_t len);

int
lws_tls_client_vhost_ca_mem_parse(struct lws_vhost *vh, const void *ca_mem,
				  unsigned int ca_mem_len);
#endif

int
lws_tls_alloc_pem_to_der_file(struct lws_context *context, const char *filename,
			      const char *inbuf, lws_filepos_t inlen,
			      uint8_t **buf, lws_filepos_t *amount);

int
lws_gencrypto_bits_to_bytes(int bits);

void
lws_gencrypto_destroy_elements(struct lws_gencrypto_keyelem *el, int m);

/* genec */

struct lws_gencrypto_keyelem;
struct lws_ec_curves;

extern const struct lws_ec_curves lws_ec_curves[4];
const struct lws_ec_curves *
lws_genec_curve(const struct lws_ec_curves *table, const char *name);
LWS_VISIBLE void
lws_genec_destroy_elements(struct lws_gencrypto_keyelem *el);
int
lws_gencrypto_mbedtls_rngf(void *context, unsigned char *buf, size_t len);

int
lws_genec_confirm_curve_allowed_by_tls_id(const char *allowed, int id,
					  struct lws_jwk *jwk);

#if defined(LWS_WITH_GNUTLS)
int
lws_tls_session_new_gnutls(struct lws *wsi);
#endif

int
lws_tls_reuse_session(struct lws *wsi);

void
lws_tls_session_cache(struct lws_vhost *vh, uint32_t ttl);

int
lws_tls_session_name_from_wsi(struct lws *wsi, char *buf, size_t len);

/**
 * lws_tls_session_name_discrete() - form an lws session tag name from pieces
 *
 * \param vhname: name of the vhost
 * \param host: name of the host we are connecting to, like warmcat.com
 * \param port: the port we connected to
 * \param buf: the destination buffer for the tag
 * \param len: the max available size of the destination buffer
 *
 * Creates a tag string representing a specific host, for use with serializing
 * sessions made with the host.
 */
void
lws_tls_session_tag_discrete(const char *vhname, const char *host,
			     uint16_t port, char *buf, size_t len);

/**
 * lws_tls_session_name_from_wsi() - form an lws session tag name from a client wsi
 *
 * \param wsi: the wsi whose vhost, host and port we should use for the tag
 * \param buf: the destination buffer for the tag
 * \param len: the max available size of the destination buffer
 *
 * Creates a tag string representing a specific host, for use with serializing
 * sessions made with the host.
 */
int
lws_tls_session_tag_from_wsi(struct lws *wsi, char *buf, size_t len);

int
lws_tls_resolve_grace_period_certs(struct lws_context *context,
				   const char *certpath, const char *keypath,
				   char *resolved_cert, size_t resolved_cert_len,
				   char *resolved_key, size_t resolved_key_len);

int
lws_tls_cert_get_x509_validity(struct lws_context *context, const char *filepath,
			       time_t *not_before, time_t *not_after);

#else /* ! WITH_TLS */

#define lws_tls_restrict_borrow(xxx) (0)
#define lws_tls_restrict_return(xxx)

#endif
#endif
