/*
	Free a tlsExtenstion_t structure and any extensions that have been loaded
*/
void matrixSslDeleteHelloExtension(tlsExtension_t *extension)
{
	tlsExtension_t	*next, *ext;
	
	if (extension == NULL) {
		return;
	}
	ext = extension;
/*
	Free first one
*/
	if (ext->extData) {
		psFree(ext->extData);
	}
	next = ext->next;
	psFree(ext);
/*
	Free others
*/
	while (next) {
		ext = next;
		next = ext->next;
		if (ext->extData) {
			psFree(ext->extData);
		}
		psFree(ext);
	}
	
	return; 
}

/*
	Free private key and cert and zero memory allocated by matrixSslReadKeys.
*/
void matrixRsaFreeKeys(sslKeys_t *keys)
{
	sslLocalCert_t	*current, *next;
	int32			i = 0;

	if (keys) {
		current = &keys->cert;
		while (current) {
			if (current->certBin) {
				memset(current->certBin, 0x0, current->certLen);
				psFree(current->certBin);
			}
			if (current->privKey) {
				matrixRsaFreeKey(current->privKey);
			}
			next = current->next;
			if (i++ > 0) {
				psFree(current);
			}
			current = next;
		}
#ifdef USE_CLIENT_SIDE_SSL
		if (keys->caCerts) {
			matrixX509FreeCert(keys->caCerts);
		}
#endif /* USE_CLIENT_SIDE_SSL */
		psFree(keys);
	}
}

/*
	Delete an SSL session.  Some information on the session may stay around
	in the session resumption cache.
	SECURITY - We memset relevant values to zero before freeing to reduce 
	the risk of our keys floating around in memory after we're done.
*/
void matrixSslDeleteSession(ssl_t *ssl)
{

	if (ssl == NULL) {
		return;
	}
	ssl->flags |= SSL_FLAGS_CLOSED;
/*
	If we have a sessionId, for servers we need to clear the inUse flag in 
	the session cache so the ID can be replaced if needed.  In the client case
	the caller should have called matrixSslGetSessionId already to copy the
	master secret and sessionId, so free it now.

	In all cases except a successful updateSession call on the server, the
	master secret must be freed.
*/
#ifdef USE_SERVER_SIDE_SSL
	if (ssl->sessionIdLen > 0 && (ssl->flags & SSL_FLAGS_SERVER)) {
		matrixUpdateSession(ssl);
	}
#endif /* USE_SERVER_SIDE_SSL */
	ssl->sessionIdLen = 0;

#ifdef USE_CLIENT_SIDE_SSL
	if (ssl->sec.cert) {
		psX509FreeCert(ssl->sec.cert);
		ssl->sec.cert = NULL;
	}

#endif /* USE_CLIENT_SIDE_SSL */



/*
	Premaster could also be allocated if this DeleteSession is the result
	of a failed handshake.  This test is fine since all frees will NULL pointer
*/
	if (ssl->sec.premaster) {
		psFree(ssl->sec.premaster);
	}
	if (ssl->fragMessage) {
		psFree(ssl->fragMessage);
	}




/*
	Free the data buffers
*/
	psFree(ssl->outbuf);
	psFree(ssl->inbuf);
	
/*
	The cipher and mac contexts are inline in the ssl structure, so
	clearing the structure clears those states as well.
*/
	memset(ssl, 0x0, sizeof(ssl_t));
	psFree(ssl);
}

int *glitch_one_detector_simple(
  actData *mydat,        ///< Data vector to filter.  Modified and returned.
  int n,                 ///< Length of the input data vector mydat.
  bool do_smooth,        ///< Whether to replace the entire data vector with its smoothed value.
  bool apply_glitch,     ///< Whether to replace data exceeding the cut threshold with its smoothed value.
  bool do_cuts,          ///< Whether to build the cutvec of data failing the cut threshhold test.
  actData nsig,          ///< The cut threshold is this factor times the median abs deviation of smooths.
  actData t_glitch,      ///< The width (Gaussian sigma) of the glitch time
  actData t_smooth,      ///< The width (Gaussian sigma) of the smoothing time
  actData dt,            ///< Time between data samples.
  int filt_type)         ///< Select filter type (currently only Gaussian filters are implemented).
{
  // If we have both set to true, we don't know what to put in mydat
#ifdef HAVE_PSERR
  if(do_smooth && apply_glitch)
    psError(MB_ERR_BAD_VALUE, true, 
            "Cannot both smooth and deglitch (=not smooth) data in glitch_one_detector\n");
#endif

  actComplex *tmpfft=act_fftw_malloc(sizeof(actComplex)*n);
  actData *tmpvec=psAlloc(n*sizeof(actData));
  actData *tmpclean=psAlloc(n*sizeof(actData));
  actData *filtvec=calculate_glitch_filterC(t_glitch,t_smooth,dt,n,1);
  int *cutvec=psAlloc(n*sizeof(int));
      
  act_fftw_plan p_forward;
  act_fftw_plan p_back;
#if !defined(MB_SKIP_OMP)
#pragma omp critical
#endif
  {
    p_forward =act_fftw_plan_dft_r2c_1d(n,tmpvec,tmpfft,FFTW_ESTIMATE);  
    p_back    =act_fftw_plan_dft_c2r_1d(n,tmpfft,tmpvec,FFTW_ESTIMATE);  
  }
  glitch_one_detector(mydat,filtvec, tmpfft,tmpvec,tmpclean,cutvec,n, p_forward,  p_back,do_smooth,
                      apply_glitch, do_cuts,nsig);

      
#if !defined(MB_SKIP_OMP)
#pragma omp critical
#endif
  {
    act_fftw_destroy_plan(p_forward);
    act_fftw_destroy_plan(p_back);
  }
  psFree(tmpvec);
  psFree(tmpclean);
  psFree(filtvec);
  act_fftw_free(tmpfft);
  
  if (do_cuts)
    return cutvec;
  else {
    psFree(cutvec);
    return NULL;
  }
}

/*
	Add a pre-shared key and ID to the static table in the first NULL spot
*/
int32 matrixSslLoadPsk(sslKeys_t *keys, unsigned char *key, uint32 keyLen,
				unsigned char *id, uint32 idLen)
{
	psPsk_t		*psk, *list;

	if (keys == NULL || key == NULL || id == NULL) {
		return PS_ARG_FAIL;
	}
	if (keyLen > SSL_PSK_MAX_KEY_SIZE) {
		psTraceIntInfo("Can't add PSK.  Key too large: %d\n", keyLen);
		return PS_ARG_FAIL;
	}

	if (idLen > SSL_PSK_MAX_ID_SIZE) {
		psTraceIntInfo("Can't add PSK.  Key ID too large: %d\n", idLen);
		return PS_ARG_FAIL;
	}

	if (keyLen < 1 || idLen < 1) {
		psTraceInfo("Can't add PSK. Both key and identity length must be >0\n");
		return PS_ARG_FAIL;
	}
	
	if ((psk = psMalloc(keys->pool, sizeof(psPsk_t))) == NULL) {
		return PS_MEM_FAIL;
	}
	memset(psk, 0, sizeof(psPsk_t));
	
	if ((psk->pskKey = psMalloc(keys->pool, keyLen)) == NULL) {
		psFree(psk);
		return PS_MEM_FAIL;
	}
	if ((psk->pskId = psMalloc(keys->pool, idLen)) == NULL) {
		psFree(psk->pskKey);
		psFree(psk);
		return PS_MEM_FAIL;
	}
	memcpy(psk->pskKey, key, keyLen);
	psk->pskLen = keyLen;
	
	memcpy(psk->pskId, id, idLen);
	psk->pskIdLen = idLen;
	
	if (keys->pskKeys == NULL) {
		keys->pskKeys = psk;
	} else {
		list = keys->pskKeys;
		while (list->next != NULL) {
			list = list->next;
		}
		list->next = psk;
	}
		
	return 0;
}

void matrixSslDeleteSessionId(sslSessionId_t *sess)
{
	if (sess == NULL) {
		return;
	}
#ifdef USE_STATELESS_SESSION_TICKETS
	if (sess->sessionTicket) {
		psFree(sess->sessionTicket);
	}
#endif
	memset(sess, 0x0, sizeof(sslSessionId_t));
	psFree(sess);
}

/*
	This will free the struct and any key material that was loaded via:
		matrixSslLoadRsaKeys
		matrixSslLoadDhParams
		matrixSslLoadPsk	
*/
void matrixSslDeleteKeys(sslKeys_t *keys)
{
	
	if (keys == NULL) {
		return;
	}
#ifdef USE_SERVER_SIDE_SSL	
	if (keys->cert) {
		psX509FreeCert(keys->cert);
	}
	
	if (keys->privKey) {
		psFreePubKey(keys->privKey);
	}
#endif /* USE_SERVER_SIDE_SSL */
	
#ifdef USE_CLIENT_SIDE_SSL
	if (keys->CAcerts) {
		psX509FreeCert(keys->CAcerts);
	}
#endif /* USE_CLIENT_SIDE_SSL */



	psFree(keys);
}

/*
	In-memory version of matrixX509ReadPubKey.
	This function was written strictly for clarity in the PeerSec crypto API
	subset.  It extracts only the public key from a certificate file for use
	in the lower level encrypt/decrypt RSA routines.
*/
int32 matrixX509ParsePubKey(psPool_t *pool, unsigned char *certBuf,
							int32 certLen, sslRsaKey_t **key)
{
	sslRsaKey_t		*lkey;
	sslRsaCert_t	*certStruct;
	int32			err;

	if (matrixX509ParseCert(pool, certBuf, certLen, &certStruct) < 0) {
		matrixX509FreeCert(certStruct);
		return -1;
	}
	lkey = *key = psMalloc(pool, sizeof(sslRsaKey_t));
	memset(lkey, 0x0, sizeof(sslRsaKey_t));

	if ((err = _mp_init_multi(pool, &lkey->e, &lkey->N, NULL,
			NULL, NULL,	NULL, NULL,	NULL)) != MP_OKAY) {
		matrixX509FreeCert(certStruct);
		psFree(lkey);
		return err;
	}
	mp_copy(&certStruct->publicKey.e, &lkey->e);
	mp_copy(&certStruct->publicKey.N, &lkey->N);

	mp_shrink(&lkey->e);
	mp_shrink(&lkey->N);

	lkey->size = certStruct->publicKey.size;

	matrixX509FreeCert(certStruct);

	return 0;
}

void psFreeList(psList_t *list)
{
	psList_t	*next, *current;

	if (list == NULL) {
		return;
	}
	current = list;
	while (current) {
		next = current->next;
		if (current->item) {
			psFree(current->item);
		}
		psFree(current);
		current = next;
	}	
}

/*
	Allows for semi-colon delimited list of certificates for cert chaining.
	Also allows multiple certificiates in a single file.
	
	HOWERVER, in both cases the first in the list must be the identifying
	cert of the application. Each subsequent cert is the parent of the previous
*/
int32 readCertChain(psPool_t *pool, const char *certFiles,
					sslLocalCert_t *lkeys)
{
	sslLocalCert_t	*currCert;
	unsigned char	*certBin, *tmp;
	sslChainLen_t	chain;
	int32			certLen, i;

	if (certFiles == NULL) {
		return 0;
	}

	if (matrixX509ReadCert(pool, certFiles, &certBin, &certLen, &chain) < 0) {
		matrixStrDebugMsg("Error reading cert file %s\n", (char*)certFiles);
		return -1;
	}
/*
	The first cert is allocated in the keys struct.  All others in
	linked list are allocated here.
*/
	i = 0;
	tmp = certBin;
	while (chain[i] != 0) {
		if (i == 0) {
			currCert = lkeys;
		} else {
			currCert->next = psMalloc(pool, sizeof(sslLocalCert_t));
			if (currCert->next == NULL) {
				psFree(tmp);
				return -8; /* SSL_MEM_ERROR */
			}
			memset(currCert->next, 0x0, sizeof(sslLocalCert_t));
			currCert = currCert->next;
		}
		currCert->certBin = psMalloc(pool, chain[i]);
		memcpy(currCert->certBin, certBin, chain[i]);
		currCert->certLen = chain[i];
		certBin += chain[i]; certLen -= chain[i];
		i++;
	}
	psFree(tmp);
	sslAssert(certLen == 0);
	return 0;
}

void filter_whole_tod(mbTOD *tod, const actData *filt, actData **to_filt_in)
{

#if 1  //use this to avoid problems below wherein it seems that some stuff is incompatible with also using fft_all_data with MKL ffts
  if (to_filt_in==NULL) {
    apply_real_filter_to_data(tod,filt);
#pragma omp parallel for shared(tod) default(none)
    for (int i=0;i<tod->ndet;i++)
      for (int j=0;j<tod->ndata;j++)
	tod->data[i][j]*=tod->ndata;
    return;
  }
#endif

  actData **to_filt;    // The list of vectors to filter.
  if (to_filt_in==NULL)
    to_filt=tod->data;
  else
    to_filt=to_filt_in;
  

#pragma omp parallel shared(tod,to_filt,filt) default (none)
  {
    int n=tod->ndata;
    actData *myfilt=(actData *)psAlloc(n*sizeof(actData));
    memcpy(myfilt,filt,sizeof(actData)*n);
    actComplex *tmpfft=(actComplex *)act_fftw_malloc((n/2+1)*sizeof(actComplex));
    
    act_fftw_plan p_forward;
    act_fftw_plan p_back;
#pragma omp critical
    {
      p_forward =act_fftw_plan_dft_r2c_1d(n,to_filt[0],tmpfft,FFTW_ESTIMATE);  
      p_back    =act_fftw_plan_dft_c2r_1d(n,tmpfft,to_filt[0],FFTW_ESTIMATE);  
    }
    
#pragma omp for
    for (int i=0; i<tod->ndet; i++) {
      filter_one_tod(to_filt[i],filt,tmpfft,p_forward,p_back,n);
    }
#pragma omp critical
    {
      act_fftw_destroy_plan(p_forward);
      act_fftw_destroy_plan(p_back);
    }
    act_fftw_free(tmpfft);
    psFree(myfilt);
#if 0
    actData nn=n;
#pragma omp for
    for (int i=0;i<tod->ndet;i++)
      for (int j=0;j<n;j++)
	tod->data[i][j]/=nn;
#endif
  }
}

/*
 *	Generates all key material.
 */
int32 sslDeriveKeys(ssl_t *ssl)
{
	sslMd5Context_t		md5Ctx;
	sslSha1Context_t	sha1Ctx;
	unsigned char		buf[SSL_MD5_HASH_SIZE + SSL_SHA1_HASH_SIZE];
	unsigned char		*tmp;
	int32				i;

/*
	If this session is resumed, we want to reuse the master secret to 
	regenerate the key block with the new random values.
*/
	if (ssl->flags & SSL_FLAGS_RESUMED) {
		goto skipPremaster;
	}
/*
	master_secret =
		MD5(pre_master_secret + SHA('A' + pre_master_secret +
			ClientHello.random + ServerHello.random)) +
		MD5(pre_master_secret + SHA('BB' + pre_master_secret +
			ClientHello.random + ServerHello.random)) +
		MD5(pre_master_secret + SHA('CCC' + pre_master_secret +
			ClientHello.random + ServerHello.random));
*/
	tmp = ssl->sec.masterSecret;
	for (i = 0; i < 3; i++) {
		matrixSha1Init(&sha1Ctx);
		matrixSha1Update(&sha1Ctx, salt[i], i + 1);
		matrixSha1Update(&sha1Ctx, ssl->sec.premaster, ssl->sec.premasterSize);
		matrixSha1Update(&sha1Ctx, ssl->sec.clientRandom, SSL_HS_RANDOM_SIZE);
		matrixSha1Update(&sha1Ctx, ssl->sec.serverRandom, SSL_HS_RANDOM_SIZE);
		matrixSha1Final(&sha1Ctx, buf);
		
		matrixMd5Init(&md5Ctx);
		matrixMd5Update(&md5Ctx, ssl->sec.premaster, ssl->sec.premasterSize);
		matrixMd5Update(&md5Ctx, buf, SSL_SHA1_HASH_SIZE);
		matrixMd5Final(&md5Ctx, tmp);
		tmp += SSL_MD5_HASH_SIZE;
	}
	memset(buf, 0x0, SSL_MD5_HASH_SIZE + SSL_SHA1_HASH_SIZE);
/*
	premaster is now allocated for DH reasons.  Can free here
*/
	psFree(ssl->sec.premaster);
	ssl->sec.premaster = NULL;
	ssl->sec.premasterSize = 0;

skipPremaster:
	if (createKeyBlock(ssl, ssl->sec.clientRandom, ssl->sec.serverRandom, 
			ssl->sec.masterSecret, SSL_HS_MASTER_SIZE) < 0) {
		matrixStrDebugMsg("Unable to create key block\n", NULL);
		return -1;
	}
	
	return SSL_HS_MASTER_SIZE;
}

void psFreePubKey(psPubKey_t *key)
{
	if (key == NULL) {
		return;
	}
	if (key->type == PS_RSA) {
#ifdef USE_RSA
		psRsaFreeKey((psRsaKey_t*)key->key);
#else
		psFree(key->key);
#endif		
	} else {
/*
		If type not found, assume an empty key type
*/
		psFree(key->key);
	}
	psFree(key);
}

/*
 *	Free an RSA key.  mp_clear will zero the memory of each element and free it.
 */
void matrixRsaFreeKey(sslRsaKey_t *key)
{
	mp_clear(&(key->N));
	mp_clear(&(key->e));
	mp_clear(&(key->d));
	mp_clear(&(key->p));
	mp_clear(&(key->q));
	mp_clear(&(key->dP));
	mp_clear(&(key->dQ));
	mp_clear(&(key->qP));
	psFree(key);
}

/*
	This function was written strictly for clarity in the PeerSec crypto API
	product.  It extracts only the public key from a certificate file for use
	in the lower level encrypt/decrypt RSA routines
*/
int32 matrixX509ReadPubKey(psPool_t *pool, const char *certFile,
						   sslRsaKey_t **key)
{
	unsigned char	*certBuf;
	sslChainLen_t	chain;
	int32			certBufLen;

	certBuf = NULL;
	if (matrixX509ReadCert(pool, certFile, &certBuf, &certBufLen, &chain) < 0) {
		matrixStrDebugMsg("Unable to read certificate file %s\n",
			(char*)certFile);
		if (certBuf) psFree(certBuf);
		return -1;
	}
	if (matrixX509ParsePubKey(pool, certBuf, certBufLen, key) < 0) {
		psFree(certBuf);
		return -1;
	}
	psFree(certBuf);
	return 0;
}

/*!
 * Smooth a whole TOD on time scale t_smooth.  If to_filt_in is non-NULL, smooth that and store
 * the result into the TOD.
 * \param tod        The TOD to filter.
 * \param t_smooth   The smoothing time (sigma of a Gaussian), in units of tod->dt (presumably: seconds).
 * \param to_filt_in The data set to filter in place of the TOD.  If not NULL, it must be of length
 *                   tod->ndet each entry having length tod->ndata.
 */
void smooth_tod(mbTOD *tod, actData t_smooth, actData **to_filt_in)
{
  //assert(tod->dt!=NULL);
  //actData dt=(tod->dt[tod->ndata-1]-tod->dt[0])/((actData)tod->ndata);
  assert(tod->deltat>0);
  actData *filt=calculate_glitch_filterC(0.0, t_smooth,tod->deltat,tod->ndata, 1);
  for (int i=0; i<tod->ndata; i++)
    filt[i]/=tod->ndata;

  filter_whole_tod(tod,filt,to_filt_in);
  psFree(filt);
  
}

/*
    Memory info:
    Caller must free 'buf' parameter on success
    Callers do not need to free buf on function failure
*/
int32 psGetFileBuf(psPool_t *pool, const char *fileName, unsigned char **buf,
                int32 *bufLen)
{
	DWORD	dwAttributes;
	HANDLE	hFile;
	int32	size;
	DWORD	tmp = 0;

	*bufLen = 0;
	*buf = NULL;

	dwAttributes = GetFileAttributesA(fileName);
	if (dwAttributes != 0xFFFFFFFF && dwAttributes & FILE_ATTRIBUTE_DIRECTORY) {
		psTraceStrCore("Unable to find %s\n", (char*)fileName);
        return PS_PLATFORM_FAIL;
	}

	if ((hFile = CreateFileA(fileName, GENERIC_READ,
			FILE_SHARE_READ && FILE_SHARE_WRITE, NULL, OPEN_EXISTING,
			FILE_ATTRIBUTE_NORMAL, NULL)) == INVALID_HANDLE_VALUE) {
		psTraceStrCore("Unable to open %s\n", (char*)fileName);
        return PS_PLATFORM_FAIL;
	}
	
/*
 *	 Get the file size.
 */
	size = GetFileSize(hFile, NULL);

	*buf = psMalloc(pool, size + 1);
	if (*buf == NULL) {
		CloseHandle(hFile);
		return PS_MEM_FAIL;
	}
	memset(*buf, 0x0, size + 1);
	
	while (*bufLen < size) { 
		if (ReadFile(hFile, *buf + *bufLen,
				(size-*bufLen > 512 ? 512 : size-*bufLen), &tmp, NULL)
				== FALSE) {
			psFree(*buf);
			psTraceStrCore("Unable to read %s\n", (char*)fileName);
			CloseHandle(hFile);
			return PS_PLATFORM_FAIL;
		}
		*bufLen += (int32)tmp;
	}

	CloseHandle(hFile);
	return PS_SUCCESS;
}

/*
	Free helper
*/
void psFreeDNStruct(DNattributes_t *dn)
{
	if (dn->country)		psFree(dn->country);
	if (dn->state)			psFree(dn->state);
	if (dn->locality)		psFree(dn->locality);
	if (dn->organization)	psFree(dn->organization);
	if (dn->orgUnit)		psFree(dn->orgUnit);
	if (dn->commonName)		psFree(dn->commonName);
}

/*
	Allocate a new psPubKey_t and memset empty 
*/
psPubKey_t * psNewPubKey(psPool_t *pool) {

	psPubKey_t *ret;

	ret = psMalloc(pool, sizeof(psPubKey_t));

	if (ret == NULL) {
		psError("Memory allocation error in psNewPubKey\n");
		return NULL;
	}
	memset(ret, 0x0, sizeof(psPubKey_t));
	ret->key = psMalloc(pool, sizeof(pubKeyUnion_t));
	if (ret->key == NULL) {
		psFree(ret);
		psError("Memory allocation error in psNewPubKey\n");
		return NULL;
	}
	memset(ret->key, 0x0, sizeof(pubKeyUnion_t));
	return ret;
}

/* If the required size is known, grow the buffer here so the caller doesn't
	have to go through the REQUEST_RECV logic of matrixSslReceivedData

	The return value MAY be larger than the requested size if the inbuf
	is already larger than what was requested.
*/
int32 matrixSslGetReadbufOfSize(ssl_t *ssl, int32 size, unsigned char **buf)
{
	unsigned char *p;

	if (!ssl || !buf) {
		return PS_ARG_FAIL;
	}
	psAssert(ssl && ssl->insize > 0 && ssl->inbuf != NULL);

	if ((ssl->insize - ssl->inlen) >= size) {
		/* Already enough room in current buffer */
		return matrixSslGetReadbuf(ssl, buf);
	}

	/* Going to have to grow... but do we have to realloc to save data? */
	if (ssl->inlen == 0) {
		/* buffer is empty anyway so can free before alloc and help keep high
			water mark down */
		psFree(ssl->inbuf, ssl->bufferPool);
		ssl->inbuf = NULL;
		if ((ssl->inbuf = psMalloc(ssl->bufferPool, size)) == NULL) {
			ssl->insize = 0;
			return PS_MEM_FAIL;
		}
		ssl->insize = size;
		*buf = ssl->inbuf;
		return ssl->insize;
	} else {
		/* realloc with: total size = current size + requested size */
		if ((p = psRealloc(ssl->inbuf, ssl->inlen + size, ssl->bufferPool))
				== NULL) {
			ssl->inbuf = NULL; ssl->insize = 0; ssl->inlen = 0;
			return PS_MEM_FAIL;
		}
		ssl->inbuf = p;
		ssl->insize = ssl->inlen + size;
		*buf = ssl->inbuf + ssl->inlen;
		return size;
	}
	return PS_FAILURE; /* can't hit */
}