/*
 ******************************************************************************
 *                     SOURCE FILE
 *
 *     Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipike_ipsec_attributes.c,v $ $Revision: 1.20.10.4 $
 *     $Source: /home/interpeak/CVSRoot/ipike/src/ipike_ipsec_attributes.c,v $
 *     $Author: zan $ $Date: 2013-08-02 03:20:23 $
 *     $State: Exp $ $Locker:  $
 *
 *     INTERPEAK_COPYRIGHT_STRING
 *        Design and implementation by Kenneth Jonsson <kenneth@interpeak.se>
 ******************************************************************************
 */

/*
 ****************************************************************************
 * 1                    DESCRIPTION
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 2                    CONFIGURATION
 ****************************************************************************
 */
#include "ipike_config.h"

/*
 ****************************************************************************
 * 3                    INCLUDE FILES
 ****************************************************************************
 */

#include "ipike_h.h"
#include "ipike_ipsec_attributes.h"
#include "ipike_payload_proposal.h"
#include "ipike_util.h"
#include <openssl/evp.h>
#include <ipcom_syslog.h>

/*
 ****************************************************************************
 * 4                    EXTERN PROTOTYPES
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 5                    DEFINES
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 6                    TYPES
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 7                    LOCAL PROTOTYPES
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 8                    DATA
 ****************************************************************************
 */

static const char* ipike_invalid_attr = "invalid attribute value";

/*
 ****************************************************************************
 * 9                    LOCAL FUNCTIONS
 ****************************************************************************
 */

/*
 ****************************************************************************
 * 10                   PUBLIC FUNCTIONS
 ****************************************************************************
 */

IP_GLOBAL const char *
ipike_ipsec_attribute_class_to_string(Ip_u16 attribute_type)
{
    static const char *attr_cls_str[IPIKE_IPSEC_CLS_COUNT] = {
       "SA life type",
       "SA life duration",
       "group description",
       "encapsulation mode",
       "authentication algorithm",
       "key length",
       "key rounds",
       "compress dictionary size",
       "compress private algorithm"
    };

    if (attribute_type != 0 && attribute_type <= IPIKE_IPSEC_CLS_COUNT)
        return attr_cls_str[attribute_type - 1];

    return "invalid attribute type";
}


IP_GLOBAL const char*
ipike_ipsec_attribute_value_to_string(Ip_u16 type, Ip_u16 value)
{
    switch (type)
    {
        case IPIKE_IPSEC_CLS_SA_LIFE_TYPE:
            return ipike_attribute_life_type_to_string(value);
        case IPIKE_IPSEC_CLS_GROUP_DESCRIPTION:
            return ipike_attribute_dh_group_to_string(value);
        case IPIKE_IPSEC_CLS_ENCAPSULATION_MODE:
            return ipike_ipsec_attribute_encap_mode_to_string(value);
        case IPIKE_IPSEC_CLS_AUTHENTICATION_ALG:
            return ipike_ipsec_attribute_integrity_alg_to_string(value);
    }
    return IP_NULL;
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_encapsulation_mode(
    Ipike_attribute* attr,
    Ip_u16*          enc_alg)
{
    Ipike_error err;

    err = ipike_check_basic_attr(attr, IPIKE_IPSEC_ENCAPSULATION_MODE_MAX);
    if (IPIKE_SUCCESS != err)
        return err;

    *enc_alg = ip_ntohs(attr->value);
    return IPIKE_SUCCESS;
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_authentication_algorithm(
    Ipike_attribute* attr,
    Ip_u16*          auth_alg)
{
    Ipike_error err;

    err = ipike_check_basic_attr(attr, IPIKE_IPSEC_AUTHENTICATION_ALG_COUNT);
    if (IPIKE_SUCCESS != err)
        return err;

    if (ip_ntohs(attr->value) == IPIKE_IPSEC_AUTHENTICATION_ALG_DES_MAC
        || ip_ntohs(attr->value) == IPIKE_IPSEC_AUTHENTICATION_ALG_KPDK)
    {
        IPCOM_LOG1(ERR,
            "ipike_ipsec_attribute_process_authentication_algorithm: %s not supported",
            ipike_ipsec_attribute_value_to_string(IPIKE_ATTR_TYPE(attr->type), ip_ntohs(attr->value)));
        return IPIKE_SA_AUTHENTICATION_ALGORITHM_NOT_SUPPORTED;
    }

    *auth_alg = ip_ntohs(attr->value);
    return IPIKE_SUCCESS;
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_process_key_length(Ipike_attribute* attr, Ip_u16* key_length)
{
    return ipike_attribute_process_key_length(attr, key_length);
}


IP_GLOBAL Ipike_error
ipike_ipsec_check_transform_identifier(Ip_u8 security_proto_id, Ip_u8 transform_id)
{
    switch (security_proto_id)
    {
    case IPIKE_PROTO_IPSEC_AH:
        if (transform_id >= IPIKE_IPSEC_AH_MIN && transform_id <= IPIKE_IPSEC_AH_MAX)
            return IPIKE_SUCCESS;
        break;
    case IPIKE_PROTO_IPSEC_ESP:
        if (transform_id >= IPIKE_IPSEC_ESP_MIN && transform_id <= IPIKE_IPSEC_ESP_MAX)
            return IPIKE_SUCCESS;
        break;
    case IPIKE_PROTO_IPCOMP:
        if (transform_id >= IPIKE_IPSEC_IPCOMP_MIN && transform_id <= IPIKE_IPSEC_IPCOMP_MAX)
            return IPIKE_SUCCESS;
        break;
    default:
        break;
    }
    IPCOM_LOG2(ERR,
        "ipike_ipsec_check_transform_identifier: invalid transform id (%d) for security protocol ID %s",
        transform_id,
        ipike_proposal_proto_id_to_string(security_proto_id));
    return IPIKE_ISAKMP_INVALID_TRANSFORM_ID;
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_esp_cipher_key_length(Ip_u8 transform_id, Ip_size_t* key_length)
{
    EVP_CIPHER *cipher      = IP_NULL;
    switch (transform_id)
    {
        case 0:
            *key_length = 0;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_DES_IV64:
        case IPIKE_IPSEC_ESP_DES:
        case IPIKE_IPSEC_ESP_DES_IV32:
            cipher=EVP_get_cipherbyname("des");
            if (cipher == IP_NULL)
                return IPIKE_PROPOSAL_INVALID_ID;     
            *key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_3DES:
            cipher=EVP_get_cipherbyname("des3");
            if (cipher == IP_NULL)
                return IPIKE_PROPOSAL_INVALID_ID;
            *key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_IDEA:
            cipher=EVP_get_cipherbyname("idea");
            if (cipher == IP_NULL)
                return IPIKE_PROPOSAL_INVALID_ID;
            *key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_CAST:
            cipher=EVP_get_cipherbyname("cast");
            if (cipher == IP_NULL)
                return IPIKE_PROPOSAL_INVALID_ID;
            *key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_BLOWFISH:
            cipher=EVP_get_cipherbyname("bf");
            if (cipher == IP_NULL)
                return IPIKE_PROPOSAL_INVALID_ID;
            *key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_NULL:
            *key_length = 0;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_ESP_AESCBC:
        case IPIKE_IPSEC_ESP_AESCTR:
            /* default 128 bits */
            cipher=EVP_get_cipherbyname("aes128");
            if (cipher == IP_NULL)
                return IPIKE_PROPOSAL_INVALID_ID;
            *key_length = (Ip_size_t)EVP_CIPHER_key_length(cipher);
            return IPIKE_SUCCESS;
    }
    IPCOM_LOG1(ERR,
        "ipike_ipsec_attribute_get_esp_cipher_key_length: %d is an unknown transform ID",
        transform_id);
    return IPIKE_PROPOSAL_INVALID_ID;
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_esp_auth_key_length(
    Ip_u16      transform_id,
    Ip_size_t * key_length)
{
    switch (transform_id)
    {
        case 0:
            *key_length = 0;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_MD5:
            *key_length = 128/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA1:
            *key_length = 160/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AUTHENTICATION_ALG_AES_XCBC_MAC:
            *key_length = 128/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_256_128:
            *key_length = 256/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_384_192:
            *key_length = 384/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AUTHENTICATION_ALG_HMAC_SHA2_512_256:
            *key_length = 512/8;
            return IPIKE_SUCCESS;
    }
    IPCOM_LOG1(ERR, "ipike_ipsec_attribute_get_esp_auth_key_length() :: "\
                    "%d is an unknown transform ID",
                    transform_id);
    return IPIKE_ATTRIBUTE_UNSUPPORTED_VALUE;
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_get_ah_key_length(
    Ip_u8       transform_id,
    Ip_size_t*  key_length)
{
    switch (transform_id)
    {
        case 0:
            *key_length = 0;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AH_MD5:
            *key_length = 128/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AH_SHA:
            *key_length = 160/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AH_DES:
            *key_length = 128/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AH_SHA2_256:
            *key_length = 256/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AH_SHA2_384:
            *key_length = 384/8;
            return IPIKE_SUCCESS;
        case IPIKE_IPSEC_AH_SHA2_512:
            *key_length = 512/8;
            return IPIKE_SUCCESS;
    }
    IPCOM_LOG1(ERR, "ipike_ipsec_attribute_get_ah_key_length() ::"\
                    " %d is an unknown transform ID",
                    transform_id);
    return IPIKE_PROPOSAL_INVALID_ID;
}


IP_GLOBAL const char*
ipike_ipsec_attribute_esp_alg_to_string(Ip_u16 v)
{
    const char *s;
    if ((ipike_map_string(ipike.ipsec_esp_trans_id_map, v, &s)))
        return ipike_invalid_attr;
    return s;
}


IP_GLOBAL const char*
ipike_ipsec_attribute_ah_alg_to_string(Ip_u16 v)
{
    const char *s;
    if ((ipike_map_string(ipike.ipsec_ah_trans_id_map, v, &s)))
        return ipike_invalid_attr;
    return s;
}


IP_GLOBAL const char*
ipike_ipsec_attribute_integrity_alg_to_string(Ip_u16 v)
{
    const char *s;
    if ((ipike_map_string(ipike.authentication_algorithm_map, v, &s)))
        return ipike_invalid_attr;
    return s;
}


IP_GLOBAL const char*
ipike_ipsec_attribute_encap_mode_to_string(Ip_u16 v)
{
    const char* s;
    if ((ipike_map_string(ipike.encapsulation_mode_map, v, &s)))
        return ipike_invalid_attr;
    return s;
}


IP_GLOBAL const char*
ipike_ipsec_attribute_esp_key_length_alg_to_string(Ip_u16 v1, Ip_u16 v2)
{
    const char* s;
    int v = v1 + (v2 << 16);
    if ((ipike_map_string(ipike.ipsec_esp_key_length_map, v, &s)))
        return IP_NULL;
    return s;
}

IP_GLOBAL Ipike_error
ipike_ipsec_attribute_esp_alg_from_string(const char* s, Ip_u16* v)
{
    return ipike_attribute_map_Ip_u16(ipike.ipsec_esp_trans_id_map, s, v);
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_ah_alg_from_string(const char* s, Ip_u16* v)
{
    return ipike_attribute_map_Ip_u16(ipike.ipsec_ah_trans_id_map, s, v);
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_integrity_alg_from_string(const char* s, Ip_u16* v)
{
    return ipike_attribute_map_Ip_u16(ipike.authentication_algorithm_map, s, v);
}


IP_GLOBAL Ipike_error
ipike_ipsec_attribute_encap_mode_from_string(const char* s, Ip_u16* v)
{
    return ipike_attribute_map_Ip_u16(ipike.encapsulation_mode_map, s, v);
}


/*
 ****************************************************************************
 *                      END OF FILE
 ****************************************************************************
 */