/*
 * lws-api-test-gencrypto - lws-genchacha
 *
 * Written in 2010-2026 by Andy Green <andy@warmcat.com>
 *
 * This file is made available under the Creative Commons CC0 1.0
 * Universal Public Domain Dedication.
 */

#include <libwebsockets.h>

/* RFC 8439 Section 2.8.2 AEAD Test Vector */
static const uint8_t rfc8439_key[] = {
	0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
	0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
	0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
	0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f
};

static const uint8_t rfc8439_nonce[] = {
	0x07, 0x00, 0x00, 0x00, 0x40, 0x41, 0x42, 0x43,
	0x44, 0x45, 0x46, 0x47
};

static const uint8_t rfc8439_aad[] = {
	0x50, 0x51, 0x52, 0x53, 0xc0, 0xc1, 0xc2, 0xc3,
	0xc4, 0xc5, 0xc6, 0xc7
};

static const uint8_t rfc8439_pt[] = {
	0x4c, 0x61, 0x64, 0x69, 0x65, 0x73, 0x20, 0x61,
	0x6e, 0x64, 0x20, 0x47, 0x65, 0x6e, 0x74, 0x6c,
	0x65, 0x6d, 0x65, 0x6e, 0x20, 0x6f, 0x66, 0x20,
	0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x61, 0x73,
	0x73, 0x20, 0x6f, 0x66, 0x20, 0x27, 0x39, 0x39,
	0x3a, 0x20, 0x49, 0x66, 0x20, 0x49, 0x20, 0x63,
	0x6f, 0x75, 0x6c, 0x64, 0x20, 0x6f, 0x66, 0x66,
	0x65, 0x72, 0x20, 0x79, 0x6f, 0x75, 0x20, 0x6f,
	0x6e, 0x6c, 0x79, 0x20, 0x6f, 0x6e, 0x65, 0x20,
	0x74, 0x69, 0x70, 0x20, 0x66, 0x6f, 0x72, 0x20,
	0x74, 0x68, 0x65, 0x20, 0x66, 0x75, 0x74, 0x75,
	0x72, 0x65, 0x2c, 0x20, 0x73, 0x75, 0x6e, 0x73,
	0x63, 0x72, 0x65, 0x65, 0x6e, 0x20, 0x77, 0x6f,
	0x75, 0x6c, 0x64, 0x20, 0x62, 0x65, 0x20, 0x69,
	0x74, 0x2e
};

static const uint8_t rfc8439_ct[] = {
	0xd3, 0x1a, 0x8d, 0x34, 0x64, 0x8e, 0x60, 0xdb,
	0x7b, 0x86, 0xaf, 0xbc, 0x53, 0xef, 0x7e, 0xc2,
	0xa4, 0xad, 0xed, 0x51, 0x29, 0x6e, 0x08, 0xfe,
	0xa9, 0xe2, 0xb5, 0xa7, 0x36, 0xee, 0x62, 0xd6,
	0x3d, 0xbe, 0xa4, 0x5e, 0x8c, 0xa9, 0x67, 0x12,
	0x82, 0xfa, 0xfb, 0x69, 0xda, 0x92, 0x72, 0x8b,
	0x1a, 0x71, 0xde, 0x0a, 0x9e, 0x06, 0x0b, 0x29,
	0x05, 0xd6, 0xa5, 0xb6, 0x7e, 0xcd, 0x3b, 0x36,
	0x92, 0xdd, 0xbd, 0x7f, 0x2d, 0x77, 0x8b, 0x8c,
	0x98, 0x03, 0xae, 0xe3, 0x28, 0x09, 0x1b, 0x58,
	0xfa, 0xb3, 0x24, 0xe4, 0xfa, 0xd6, 0x75, 0x94,
	0x55, 0x85, 0x80, 0x8b, 0x48, 0x31, 0xd7, 0xbc,
	0x3f, 0xf4, 0xde, 0xf0, 0x8e, 0x4b, 0x7a, 0x9d,
	0xe5, 0x76, 0xd2, 0x65, 0x86, 0xce, 0xc6, 0x4b,
	0x61, 0x16
};

static const uint8_t rfc8439_tag[] = {
	0x1a, 0xe1, 0x0b, 0x59, 0x4f, 0x09, 0xe2, 0x6a,
	0x7e, 0x90, 0x2e, 0xcb, 0xd0, 0x60, 0x06, 0x91
};

int
test_genchacha(struct lws_context *context)
{
	struct lws_genchacha_ctx ctx;
	struct lws_gencrypto_keyelem e;
	uint8_t out[256];
	uint8_t tag[16];

	lwsl_user("%s\n", __func__);

	e.buf = (uint8_t *)rfc8439_key;
	e.len = sizeof(rfc8439_key);

	/* 1. Encrypt Test */
	if (lws_genchacha_create(&ctx, LWS_GAESO_ENC, &e, NULL)) {
		lwsl_err("%s: enc init failed\n", __func__);
		return 1;
	}

	if (lws_genchacha_crypt(&ctx, rfc8439_pt, sizeof(rfc8439_pt), out,
				rfc8439_nonce,
				rfc8439_aad, sizeof(rfc8439_aad),
				tag, sizeof(tag))) {
		/* Some backends might not support one-shot fully, so we allow skip */
		lwsl_notice("%s: crypt enc failed (expected if native fallback)\n", __func__);
	} else {
		if (memcmp(out, rfc8439_ct, sizeof(rfc8439_ct))) {
			lwsl_err("%s: enc ct mismatch\n", __func__);
			lwsl_hexdump_err(out, sizeof(rfc8439_ct));
			return 1;
		}
		if (memcmp(tag, rfc8439_tag, sizeof(rfc8439_tag))) {
			lwsl_err("%s: enc tag mismatch\n", __func__);
			lwsl_hexdump_err(tag, sizeof(rfc8439_tag));
			return 1;
		}
	}
	lws_genchacha_destroy(&ctx);

	/* 2. Decrypt Test */
	if (lws_genchacha_create(&ctx, LWS_GAESO_DEC, &e, NULL)) {
		lwsl_err("%s: dec init failed\n", __func__);
		return 1;
	}

	memcpy(tag, rfc8439_tag, sizeof(tag)); /* Supply expected tag */
	if (lws_genchacha_crypt(&ctx, rfc8439_ct, sizeof(rfc8439_ct), out,
				rfc8439_nonce,
				rfc8439_aad, sizeof(rfc8439_aad),
				tag, sizeof(tag))) {
		lwsl_notice("%s: crypt dec failed (expected if native fallback)\n", __func__);
	} else {
		if (memcmp(out, rfc8439_pt, sizeof(rfc8439_pt))) {
			lwsl_err("%s: dec pt mismatch\n", __func__);
			lwsl_hexdump_err(out, sizeof(rfc8439_pt));
			return 1;
		}
	}
	lws_genchacha_destroy(&ctx);

	/* 3. Raw Stream Test (Native Fallback) */
	struct lws_chacha_ctx cctx;
	lws_chacha_keysetup(&cctx, rfc8439_key, 256);
	/* The RFC AEAD test uses a 12-byte nonce and starts counter at 1 for the payload! */
	lws_chacha_ivsetup_ietf(&cctx, rfc8439_nonce, 1);
	lws_chacha_encrypt_bytes(&cctx, rfc8439_pt, out, sizeof(rfc8439_pt));

	if (memcmp(out, rfc8439_ct, sizeof(rfc8439_ct))) {
		lwsl_err("%s: native stream ct mismatch\n", __func__);
		lwsl_hexdump_err(out, sizeof(rfc8439_ct));
		return 1;
	}

	return 0;
}
