/*
 * Copyright (C) 2003-2016 Free Software Foundation, Inc.
 * Copyright (C) 2016 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

#ifndef GNUTLS_LIB_X509_PKCS7_INT_H
#define GNUTLS_LIB_X509_PKCS7_INT_H

#include <gnutls/x509.h>

/* PKCS #7
 */
#define DATA_OID "1.2.840.113549.1.7.1"
#define ENC_DATA_OID "1.2.840.113549.1.7.6"

#define SIGNED_DATA_OID "1.2.840.113549.1.7.2"
#define DIGESTED_DATA_OID "1.2.840.113549.1.7.5"


typedef enum schema_id {
	PBES2_GENERIC=1,	/* when the algorithm is unknown, temporal use when reading only */
	PBES2_DES,		/* the stuff in PKCS #5 */
	PBES2_3DES,
	PBES2_AES_128,
	PBES2_AES_192,
	PBES2_AES_256,
	PBES2_GOST28147_89_TC26Z,
	PBES2_GOST28147_89_CPA,
	PBES2_GOST28147_89_CPB,
	PBES2_GOST28147_89_CPC,
	PBES2_GOST28147_89_CPD,
	PKCS12_3DES_SHA1,	/* the stuff in PKCS #12 */
	PKCS12_ARCFOUR_SHA1,
	PKCS12_RC2_40_SHA1,
	PBES1_DES_MD5		/* openssl before 1.1.0 uses that by default */
} schema_id;

struct pkcs_cipher_schema_st {
	unsigned int schema;
	const char *name;
	unsigned int flag;
	unsigned int cipher;
	unsigned pbes2;
	const char *cipher_oid;
	const char *write_oid;
	const char *desc;
	const char *iv_name;
	unsigned decrypt_only;
};

const struct pkcs_cipher_schema_st *_gnutls_pkcs_schema_get(schema_id schema);

struct pbe_enc_params {
	gnutls_cipher_algorithm_t cipher;
	uint8_t iv[MAX_CIPHER_BLOCK_SIZE];
	int iv_size;
	char pbes2_oid[MAX_OID_SIZE]; /* when reading params, the OID is stored for info purposes */
};

int
_gnutls_decrypt_pbes1_des_md5_data(const char *password,
			   unsigned password_len,
			   const struct pbkdf2_params *kdf_params,
			   const struct pbe_enc_params *enc_params,
			   const gnutls_datum_t *encrypted_data,
			   gnutls_datum_t *decrypted_data);

int _gnutls_check_pkcs_cipher_schema(const char *oid);

int
_gnutls_pkcs_raw_decrypt_data(schema_id schema, ASN1_TYPE pkcs8_asn,
	     const char *root, const char *password,
	     const struct pbkdf2_params *kdf_params,
	     const struct pbe_enc_params *enc_params,
	     gnutls_datum_t *decrypted_data);

int
_gnutls_pkcs_raw_encrypt_data(const gnutls_datum_t * plain,
	     const struct pbe_enc_params *enc_params,
	     const gnutls_datum_t * key, gnutls_datum_t * encrypted);

int _gnutls_pkcs7_decrypt_data(const gnutls_datum_t * data,
			       const char *password, gnutls_datum_t * dec);

int _gnutls_read_pbkdf1_params(const uint8_t * data, int data_size,
		       struct pbkdf2_params *kdf_params,
		       struct pbe_enc_params *enc_params);

int
_gnutls_read_pkcs_schema_params(schema_id * schema, const char *password,
			const uint8_t * data, int data_size,
			struct pbkdf2_params *kdf_params,
			struct pbe_enc_params *enc_params);

int
_gnutls_pkcs_write_schema_params(schema_id schema, ASN1_TYPE pkcs8_asn,
		    const char *where,
		    const struct pbkdf2_params *kdf_params,
		    const struct pbe_enc_params *enc_params);

int
_gnutls_pkcs_generate_key(schema_id schema,
	     const char *password,
	     struct pbkdf2_params *kdf_params,
	     struct pbe_enc_params *enc_params, gnutls_datum_t * key);

int _gnutls_pkcs_flags_to_schema(unsigned int flags);
int _gnutls_pkcs7_encrypt_data(schema_id schema,
			       const gnutls_datum_t * data,
			       const char *password, gnutls_datum_t * enc);

int
_gnutls_pkcs7_data_enc_info(const gnutls_datum_t * data, const struct pkcs_cipher_schema_st **p,
	struct pbkdf2_params *kdf_params, char **oid);

#endif /* GNUTLS_LIB_X509_PKCS7_INT_H */