/*
 * Generate a random key.  If key_type is provided, make
 * sure generated key is valid for key_type.
 */
void
generate_key_random (struct key *key, const struct key_type *kt)
{
  int cipher_len = MAX_CIPHER_KEY_LENGTH;
  int hmac_len = MAX_HMAC_KEY_LENGTH;

  struct gc_arena gc = gc_new ();

  do {
    CLEAR (*key);
    if (kt)
      {
	if (kt->cipher && kt->cipher_length > 0 && kt->cipher_length <= cipher_len)
	  cipher_len = kt->cipher_length;

	if (kt->digest && kt->hmac_length > 0 && kt->hmac_length <= hmac_len)
	  hmac_len = kt->hmac_length;
      }
    if (!rand_bytes (key->cipher, cipher_len)
	|| !rand_bytes (key->hmac, hmac_len))
      msg (M_FATAL, "ERROR: Random number generator cannot obtain entropy for key generation");

    dmsg (D_SHOW_KEY_SOURCE, "Cipher source entropy: %s", format_hex (key->cipher, cipher_len, 0, &gc));
    dmsg (D_SHOW_KEY_SOURCE, "HMAC source entropy: %s", format_hex (key->hmac, hmac_len, 0, &gc));

    if (kt)
      fixup_key (key, kt);
  } while (kt && !check_key (key, kt));

  gc_free (&gc);
}

END_TEST

START_TEST(test_large_data_symmetric)
{
    unsigned char k[CRYPTO_SYMMETRIC_KEY_SIZE];

    unsigned char n[CRYPTO_NONCE_SIZE];

    unsigned char m1[16 * 16 * 16];
    unsigned char c1[sizeof(m1) + CRYPTO_MAC_SIZE];
    unsigned char m1prime[sizeof(m1)];

    int c1len;
    int m1plen;

    //Generate random messages
    rand_bytes(m1, sizeof(m1));
    rand_bytes(n, CRYPTO_NONCE_SIZE);

    //Generate key
    new_symmetric_key(k);

    c1len = encrypt_data_symmetric(k, n, m1, sizeof(m1), c1);
    ck_assert_msg(c1len == sizeof(m1) + CRYPTO_MAC_SIZE, "could not encrypt data");

    m1plen = decrypt_data_symmetric(k, n, c1, c1len, m1prime);

    ck_assert_msg(m1plen == sizeof(m1), "decrypted text lengths differ");
    ck_assert_msg(memcmp(m1prime, m1, sizeof(m1)) == 0, "decrypted texts differ");
}

void * auth_simple_init_data() {
    auth_simple_global_data *global = (auth_simple_global_data*)malloc(sizeof(auth_simple_global_data));
    rand_bytes(global->local_client_id, 8);
    rand_bytes((uint8_t*)&global->connection_id, 4);
    global->connection_id &= 0xFFFFFF;
    return global;
}

/*
	Generate random compact signatures and messagse and check
*/
void test_random_sigs(int count) {
	
	int error_count = 0;
	for(int i=0;i<count; i++) {
		
		unsigned char sig[64];
		unsigned char msg[32];
		unsigned char pubkey[33];
		int pubkeylen;
		
		rand_bytes(sig,64); //try 65
		rand_bytes(msg,32);

		int ret = secp256k1_ecdsa_recover_compact(
			msg, 32,
            sig,
            pubkey, &pubkeylen,
            1, (int)(rand_byte()%4)
        );
		if(ret == 1) { error_count++; }
	}
	
	printf("test_random_sigs: %d out of %d randomly generated messages/signatures returned 1 for secp256k1_ecdsa_recover_compact\n", error_count, count);
	
}

TEST_F(cryptoboxtest, send_ten_messages)
{
	struct device *a, *b;

	add_devices(2);

	/* Connect the 2 devices */
	connect_devices();

	a = (struct device *)devicel.head->data;
	b = (struct device *)devicel.tail->data;

	err = device_new_session(a, b);
	ASSERT_EQ(0, err);

	for (int i=0; i<5; i++) {
		size_t len = rand_u16();
		uint8_t *msg = (uint8_t *)mem_alloc(len, NULL);

		rand_bytes(msg, len);

		send_message(a, b, msg, len);

		/* reverse direction */
		send_message(b, a, msg, len);

		mem_deref(msg);
	}
}

static void test_binary_seq_rev_cmp()
{
  test_status("binary_seq_reverse_complement() binary_seq_to_str()");

  uint8_t data[TLEN], tmp[TLEN];
  char str[4*TLEN+1], rev[4*TLEN+1], restore[4*TLEN+1];
  size_t i, j, k, nbases;

  for(i = 0; i < NTESTS; i++)
  {
    // Get random sequence, mask top byte, convert to string
    rand_bytes(data, TLEN);
    nbases = rand() & (4*TLEN-1);
    binary_seq_to_str(data, nbases, str);

    // Reverse complement, convert to string
    memcpy(tmp, data, TLEN);
    binary_seq_reverse_complement(tmp, nbases);
    binary_seq_to_str(tmp, nbases, rev);

    // Check strings match
    for(j = 0, k = nbases-1; j < nbases; j++, k--)
      TASSERT(str[j] == dna_char_complement(rev[k]));

    // Reverse complement again, check we get back same binary_seq+string
    binary_seq_reverse_complement(tmp, nbases);
    binary_seq_to_str(tmp, nbases, restore);
    TASSERT(memcmp(data, tmp, TLEN) == 0);
    TASSERT(strncmp(str, restore, nbases) == 0);
  }
}

void
prng_bytes (uint8_t *output, int len)
{
  static size_t processed = 0;

  if (nonce_md)
    {
      const int md_size = md_kt_size (nonce_md);
      while (len > 0)
	{
	  unsigned int outlen = 0;
	  const int blen = min_int (len, md_size);
	  md_full(nonce_md, nonce_data, md_size + nonce_secret_len, nonce_data);
	  memcpy (output, nonce_data, blen);
	  output += blen;
	  len -= blen;

	  /* Ensure that random data is reset regularly */
	  processed += blen;
	  if(processed > PRNG_NONCE_RESET_BYTES) {
	    prng_reset_nonce();
	    processed = 0;
	  }
	}
    }
  else
    rand_bytes (output, len);
}

static int media_alloc(struct mnat_media **mp, struct mnat_sess *sess,
		       int proto, void *sock1, void *sock2,
		       struct sdp_media *sdpm)
{
	struct mnat_media *m;
	struct sa laddr;
	struct pcp_map map;
	unsigned i;
	int err = 0;

	if (!mp || !sess || !sdpm || proto != IPPROTO_UDP)
		return EINVAL;

	m = mem_zalloc(sizeof(*m), media_destructor);
	if (!m)
		return ENOMEM;

	m->compc = sock2 ? 2 : 1;

	list_append(&sess->medial, &m->le, m);
	m->sess = sess;
	m->sdpm = mem_ref(sdpm);

	for (i=0; i<m->compc; i++) {
		struct comp *comp = &m->compv[i];

		comp->id = i+1;
		comp->media = m;

		err = udp_local_get(i==0 ? sock1 : sock2, &laddr);
		if (err)
			goto out;

		rand_bytes(map.nonce, sizeof(map.nonce));
		map.proto = proto;
		map.int_port = sa_port(&laddr);
		/* note: using same address-family as the PCP server */
		sa_init(&map.ext_addr, sa_af(&pcp_srv));

		info("pcp: %s: internal port for %s is %u\n",
		     sdp_media_name(sdpm),
		     i==0 ? "RTP" : "RTCP",
		     map.int_port);

		err = pcp_request(&comp->pcp, NULL, &pcp_srv, PCP_MAP,
				  LIFETIME, &map, pcp_resp_handler, comp, 0);
		if (err)
			goto out;
	}

 out:
	if (err)
		mem_deref(m);
	else if (mp) {
		*mp = m;
	}

	return err;
}

void enc_ctx_init(int method, enc_ctx_t *ctx, int enc)
{
    memset(ctx, 0, sizeof(enc_ctx_t));
    cipher_context_init(&ctx->evp, method, enc);

    if (enc) {
        rand_bytes(ctx->evp.iv, enc_iv_len);
    }
}

int auth_simple_pack_auth_data(auth_simple_global_data *global, char *data, int datalength, char *outdata) {
    unsigned char rand_len = (xorshift128plus() & 0xF) + 1;
    int out_size = rand_len + datalength + 6 + 12;
    outdata[0] = out_size >> 8;
    outdata[1] = out_size;
    outdata[2] = rand_len;
    ++global->connection_id;
    if (global->connection_id > 0xFF000000) {
        rand_bytes(global->local_client_id, 8);
        rand_bytes((uint8_t*)&global->connection_id, 4);
        global->connection_id &= 0xFFFFFF;
    }
    time_t t = time(NULL);
    memintcopy_lt(outdata + rand_len + 2, t);
    memmove(outdata + rand_len + 2 + 4, global->local_client_id, 4);
    memintcopy_lt(outdata + rand_len + 2 + 8, global->connection_id);
    memmove(outdata + rand_len + 2 + 12, data, datalength);
    fillcrc32((unsigned char *)outdata, out_size);
    return out_size;
}

void
stream_ctx_init(cipher_t *cipher, cipher_ctx_t *cipher_ctx, int enc)
{
    sodium_memzero(cipher_ctx, sizeof(cipher_ctx_t));
    stream_cipher_ctx_init(cipher_ctx, cipher->method, enc);
    cipher_ctx->cipher = cipher;

    if (enc) {
        rand_bytes(cipher_ctx->nonce, cipher->nonce_len);
    }
}

void
aead_ctx_init(cipher_t *cipher, cipher_ctx_t *cipher_ctx, int enc)
{
    sodium_memzero(cipher_ctx, sizeof(cipher_ctx_t));
    cipher_ctx->cipher = cipher;

    aead_cipher_ctx_init(cipher_ctx, cipher->method, enc);

    if (enc) {
        rand_bytes(cipher_ctx->salt, cipher->key_len);
    }
}

void
test_crypto (const struct crypto_options *co, struct frame* frame)
{
  int i, j;
  struct gc_arena gc = gc_new ();
  struct buffer src = alloc_buf_gc (TUN_MTU_SIZE (frame), &gc);
  struct buffer work = alloc_buf_gc (BUF_SIZE (frame), &gc);
  struct buffer encrypt_workspace = alloc_buf_gc (BUF_SIZE (frame), &gc);
  struct buffer decrypt_workspace = alloc_buf_gc (BUF_SIZE (frame), &gc);
  struct buffer buf = clear_buf();

  /* init work */
  ASSERT (buf_init (&work, FRAME_HEADROOM (frame)));

  msg (M_INFO, "Entering " PACKAGE_NAME " crypto self-test mode.");
  for (i = 1; i <= TUN_MTU_SIZE (frame); ++i)
    {
      update_time ();

      msg (M_INFO, "TESTING ENCRYPT/DECRYPT of packet length=%d", i);

      /*
       * Load src with random data.
       */
      ASSERT (buf_init (&src, 0));
      ASSERT (i <= src.capacity);
      src.len = i;
      ASSERT (rand_bytes (BPTR (&src), BLEN (&src)));

      /* copy source to input buf */
      buf = work;
      memcpy (buf_write_alloc (&buf, BLEN (&src)), BPTR (&src), BLEN (&src));

      /* encrypt */
      openvpn_encrypt (&buf, encrypt_workspace, co, frame);

      /* decrypt */
      openvpn_decrypt (&buf, decrypt_workspace, co, frame);

      /* compare */
      if (buf.len != src.len)
	msg (M_FATAL, "SELF TEST FAILED, src.len=%d buf.len=%d", src.len, buf.len);
      for (j = 0; j < i; ++j)
	{
	  const uint8_t in = *(BPTR (&src) + j);
	  const uint8_t out = *(BPTR (&buf) + j);
	  if (in != out)
	    msg (M_FATAL, "SELF TEST FAILED, pos=%d in=%d out=%d", j, in, out);
	}
    }
  msg (M_INFO, PACKAGE_NAME " crypto self-test mode SUCCEEDED.");
  gc_free (&gc);
}

int auth_sha1_v4_pack_auth_data(auth_simple_global_data *global, server_info *server, char *data, int datalength, char *outdata) {
    unsigned int rand_len = (datalength > 1300 ? 0 : datalength > 400 ? (xorshift128plus() & 0x7F) : (xorshift128plus() & 0x3FF)) + 1;
    int data_offset = rand_len + 4 + 2;
    int out_size = data_offset + datalength + 12 + OBFS_HMAC_SHA1_LEN;
    const char* salt = "auth_sha1_v4";
    int salt_len = strlen(salt);
    unsigned char *crc_salt = (unsigned char*)malloc(salt_len + server->key_len + 2);
    crc_salt[0] = outdata[0] = out_size >> 8;
    crc_salt[1] = outdata[1] = out_size;

    memcpy(crc_salt + 2, salt, salt_len);
    memcpy(crc_salt + salt_len + 2, server->key, server->key_len);
    fillcrc32to(crc_salt, salt_len + server->key_len + 2, (unsigned char *)outdata + 2);
    free(crc_salt);
    if (rand_len < 128)
    {
        outdata[6] = rand_len;
    }
    else
    {
        outdata[6] = 0xFF;
        outdata[7] = rand_len >> 8;
        outdata[8] = rand_len;
    }
    ++global->connection_id;
    if (global->connection_id > 0xFF000000) {
        rand_bytes(global->local_client_id, 8);
        rand_bytes((uint8_t*)&global->connection_id, 4);
        global->connection_id &= 0xFFFFFF;
    }
    time_t t = time(NULL);
    memintcopy_lt(outdata + data_offset, t);
    memmove(outdata + data_offset + 4, global->local_client_id, 4);
    memintcopy_lt(outdata + data_offset + 8, global->connection_id);
    memmove(outdata + data_offset + 12, data, datalength);
    char hash[ONETIMEAUTH_BYTES * 2];
    ss_sha1_hmac(hash, outdata, out_size - OBFS_HMAC_SHA1_LEN, server->iv);
    memcpy(outdata + out_size - OBFS_HMAC_SHA1_LEN, hash, OBFS_HMAC_SHA1_LEN);
    return out_size;
}

void rand_pseudo_bytes(char* buf, int count)
{
  static int init = init_openssl();
  (void)init;

  // RAND_pseudo_bytes is deprecated in favor of RAND_bytes as of OpenSSL 1.1.0
#if OPENSSL_VERSION_NUMBER < 0x10100000L
  int result = RAND_pseudo_bytes((unsigned char*)buf, count);
  if (result == -1)
    FC_THROW("Error calling OpenSSL's RAND_pseudo_bytes(): ${code}", ("code", (uint32_t)ERR_get_error()));
#else
  rand_bytes(buf, count);
#endif
}

void fp_rand(fp_t a) {
	int bits, digits;

	rand_bytes((uint8_t *)a, RLC_FP_DIGS * sizeof(dig_t));

	RLC_RIP(bits, digits, RLC_FP_BITS);
	if (bits > 0) {
		dig_t mask = ((dig_t)1 << (dig_t)bits) - 1;
		a[RLC_FP_DIGS - 1] &= mask;
	}

	while (dv_cmp(a, fp_prime_get(), RLC_FP_DIGS) != RLC_LT) {
		fp_subn_low(a, a, fp_prime_get());
	}
}

int auth_sha1_pack_auth_data(auth_simple_global_data *global, server_info *server, char *data, int datalength, char *outdata) {
    unsigned char rand_len = (xorshift128plus() & 0x7F) + 1;
    int data_offset = rand_len + 4 + 2;
    int out_size = data_offset + datalength + 12 + OBFS_HMAC_SHA1_LEN;
    fillcrc32to((unsigned char *)server->key, server->key_len, (unsigned char *)outdata);
    outdata[4] = out_size >> 8;
    outdata[5] = out_size;
    outdata[6] = rand_len;
    ++global->connection_id;
    if (global->connection_id > 0xFF000000) {
        rand_bytes(global->local_client_id, 8);
        rand_bytes((uint8_t*)&global->connection_id, 4);
        global->connection_id &= 0xFFFFFF;
    }
    time_t t = time(NULL);
    memintcopy_lt(outdata + data_offset, t);
    memmove(outdata + data_offset + 4, global->local_client_id, 4);
    memintcopy_lt(outdata + data_offset + 8, global->connection_id);
    memmove(outdata + data_offset + 12, data, datalength);
    char hash[ONETIMEAUTH_BYTES * 2];
    ss_sha1_hmac(hash, outdata, out_size - OBFS_HMAC_SHA1_LEN, server->iv);
    memcpy(outdata + out_size - OBFS_HMAC_SHA1_LEN, hash, OBFS_HMAC_SHA1_LEN);
    return out_size;
}

/* Reset the nonce value, also done periodically to refresh entropy */
static void
prng_reset_nonce ()
{
  const int size = md_kt_size (nonce_md) + nonce_secret_len;
#if 1 /* Must be 1 for real usage */
  if (!rand_bytes (nonce_data, size))
    msg (M_FATAL, "ERROR: Random number generator cannot obtain entropy for PRNG");
#else
    /* Only for testing -- will cause a predictable PRNG sequence */
    {
      int i;
      for (i = 0; i < size; ++i)
	nonce_data[i] = (uint8_t) i;
    }
#endif
}

int tls12_ticket_pack_auth_data(tls12_ticket_auth_global_data *global, server_info *server, char *outdata) {
    int out_size = 32;
    time_t t = time(NULL);
    outdata[0] = t >> 24;
    outdata[1] = t >> 16;
    outdata[2] = t >> 8;
    outdata[3] = t;
    rand_bytes((uint8_t*)outdata + 4, 18);

    uint8_t *key = (uint8_t*)malloc(server->key_len + 32);
    char hash[ONETIMEAUTH_BYTES * 2];
    memcpy(key, server->key, server->key_len);
    memcpy(key + server->key_len, global->local_client_id, 32);
    ss_sha1_hmac_with_key(hash, outdata, out_size - OBFS_HMAC_SHA1_LEN, key, server->key_len + 32);
    free(key);
    memcpy(outdata + out_size - OBFS_HMAC_SHA1_LEN, hash, OBFS_HMAC_SHA1_LEN);
    return out_size;
}

void bn_rand(bn_t a, int sign, int bits) {
	int digits;

	SPLIT(bits, digits, bits, BN_DIG_LOG);
	digits += (bits > 0 ? 1 : 0);

	bn_grow(a, digits);

	rand_bytes((uint8_t *)a->dp, digits * sizeof(dig_t));

	a->used = digits;
	a->sign = sign;
	if (bits > 0) {
		dig_t mask = ((dig_t)1 << (dig_t)bits) - 1;
		a->dp[a->used - 1] &= mask;
	}
	bn_trim(a);
}