/**
 * (c) Copyright, Real-Time Innovations, 2011-2016.
 * All rights reserved.
 * No duplications, whole or partial, manual or electronic, may be made
 * without express written permission.  Any such copies, or
 * revisions thereof, must display this notice unaltered.
 * This code contains trade secrets of Real-Time Innovations, Inc.
 *
 * Description
 * -----------
 * Default create functions for security plugins
 * =====================================================================
 */
#ifndef security_default_h
#define security_default_h

#include "security/security_infrastructure.h"
#include "security/security_cryptography.h"

typedef DDS_TopicTrustAttributes DDS_TopicSecurityAttributes;

#define DDS_TOPIC_SECURITY_ATTRIBUTES_DEFAULT \
    DDS_TOPIC_TRUST_ATTRIBUTES_DEFAULT

typedef DDS_PublicationBuiltinTopicDataTrust DDS_PublicationBuiltinTopicDataSecure;
typedef DDS_SubscriptionBuiltinTopicDataTrust DDS_SubscriptionBuiltinTopicDataSecure;

#define RTI_SECURITY_BUILTIN_PLUGIN_PROPERTY_NAME \
    RTI_TRUST_PLUGIN_PROPERTY_PREFIX "secure"
#define RTI_SECURITY_OPENSSL_ENGINE_PROPERTY "openssl_engine"

#define DDS_SECURITY_FILE_PREFIX "file:"
#define RTI_SECURITY_FILE_PREFIX_LEN (5)
/*
 * The comma is for furthering compliance with RFC 2397. We don't support
 * putting content between the colon and the comma, but we at least need the
 * comma to be consistent with the example URIs in the DDS Security
 * specification.
 */
#define DDS_SECURITY_DATA_PREFIX "data:,"
#define RTI_SECURITY_DATA_PREFIX_LEN (6)

#define RTI_SECURITY_BUILTIN_PLUGIN_GMCLASSID_PREFIX \
    DDS_GMCLASSID_TRUST_RTI_PLUGIN_PREFIX

#define RTI_SECURITY_EXCEPTION_CODE_OK 0
#define RTI_SECURITY_EXCEPTION_CODE_CA_READ_FAIL 1
#define RTI_SECURITY_EXCEPTION_CODE_CERT_READ_FAIL 2
#define RTI_SECURITY_EXCEPTION_CODE_PRIVATE_KEY_READ_FAIL 3
#define RTI_SECURITY_EXCEPTION_CODE_MISSING_KEY 4
#define RTI_SECURITY_EXCEPTION_CODE_INVALID_CIPHER 5
#define RTI_SECURITY_EXCEPTION_CODE_CERTIFICATE_DECODE_FAIL 6
#define RTI_SECURITY_EXCEPTION_CODE_CERTIFICATE_VERIFY_FAIL 7
#define RTI_SECURITY_EXCEPTION_CODE_PRIVATE_SIGN_FAIL 8
#define RTI_SECURITY_EXCEPTION_CODE_CHALLENGE_VERIFY_FAIL 9
#define RTI_SECURITY_EXCEPTION_CODE_PUBLIC_ENCRYPT_FAIL 10
#define RTI_SECURITY_EXCEPTION_CODE_PRIVATE_DECRYPT_FAIL 11
#define RTI_SECURITY_EXCEPTION_CODE_KEY_GENERATION_FAIL 12
#define RTI_SECURITY_EXCEPTION_CODE_INSUFFICIENT_MEMORY 13
#define RTI_SECURITY_EXCEPTION_CODE_RNG_FAIL 14
#define RTI_SECURITY_EXCEPTION_CODE_KEY_IMPORT_FAIL 15
#define RTI_SECURITY_EXCEPTION_CODE_UPDATE_FAIL 16
#define RTI_SECURITY_EXCEPTION_CODE_IV_FAIL 17
#define RTI_SECURITY_EXCEPTION_CODE_FINAL_FAIL 18
#define RTI_SECURITY_EXCEPTION_CODE_RECEIVER_SPECIFIC_MAC_FAIL 19
#define RTI_SECURITY_EXCEPTION_CODE_GENERATE_OCSP_REQUEST_FAIL 20
#define RTI_SECURITY_EXCEPTION_CODE_HTTP_QUERY_FAIL 21
#define RTI_SECURITY_EXCEPTION_CODE_NOT_SUPPORTED 22
#define RTI_SECURITY_EXCEPTION_CODE_PENDING_AUTHENTICATION \
    DDS_TRUST_EXCEPTION_CODE_PENDING_AUTHENTICATION
#define RTI_SECURITY_EXCEPTION_CODE_INCONSISTENT_PROPERTIES \
    DDS_TRUST_EXCEPTION_CODE_INCONSISTENT_PROPERTIES

/* ------------------------------------------------------------------------- */
/* ---- Cryptographic Algorithms ------------------------------------------- */
/* ------------------------------------------------------------------------- */

typedef DDS_TrustAlgorithmBit DDS_CryptoAlgorithmBit;
typedef DDS_TrustAlgorithmSet DDS_CryptoAlgorithmSet;

#define DDS_CRYPTO_ALGORITHM_BIT_COMPATIBILITY_MODE \
    DDS_TRUST_ALGORITHM_BIT_COMPATIBILITY_MODE

#define DDS_CryptoAlgorithmSet_isCompatible( \
        supportedMask__, \
        requiredMask__) \
( \
    (((requiredMask__) & (supportedMask__)) == (requiredMask__)) \
    || ((((requiredMask__) & (supportedMask__)) != 0 ) \
            && (((requiredMask__) & DDS_CRYPTO_ALGORITHM_BIT_COMPATIBILITY_MODE) != 0)) \
)

/*
 * The types here must have the same memory mapping as their DDS counterparts.
 *
 * DDS_CryptoAlgorithmRequirements: DDS_TrustAlgorithmRequirements.
 * DDS_ParticipantSecurityAlgorithmInfo: DDS_ParticipantTrustAlgorithmInfo.
 * DDS_ParticipantSecurityDigitalSignatureAlgorithmInfo:
 *     DDS_ParticipantTrustSignatureAlgorithmInfo
 * DDS_ParticipantSecurityKeyEstablishmentAlgorithmInfo:
 *     DDS_ParticipantTrustKeyEstablishmentAlgorithmInfo
 * DDS_ParticipantSecuritySymmetricCipherAlgorithmInfo:
 *     DDS_ParticipantTrustInterceptorAlgorithmInfo
 * DDS_ParticipantSecurityVendorProtectionInfo:
 *     DDS_ParticipantTrustVendorProtectionInfo
 */

typedef struct {
    DDS_CryptoAlgorithmSet supported_mask;
    DDS_CryptoAlgorithmSet required_mask;
} DDS_CryptoAlgorithmRequirements;

typedef struct {
    DDS_CryptoAlgorithmRequirements trust_chain;
    DDS_CryptoAlgorithmRequirements message_auth;
} DDS_ParticipantSecurityDigitalSignatureAlgorithmInfo;

typedef struct {
    DDS_CryptoAlgorithmRequirements shared_secret;
} DDS_ParticipantSecurityKeyEstablishmentAlgorithmInfo;

typedef struct {
    DDS_CryptoAlgorithmSet supported_mask;
    DDS_CryptoAlgorithmSet builtin_endpoints_required_mask;
    DDS_CryptoAlgorithmSet builtin_kx_endpoints_required_mask;
    DDS_CryptoAlgorithmSet user_endpoints_default_required_mask;
} DDS_ParticipantSecuritySymmetricCipherAlgorithmInfo;

typedef struct {
    DDS_ParticipantSecurityDigitalSignatureAlgorithmInfo digital_signature;
    DDS_ParticipantSecurityKeyEstablishmentAlgorithmInfo key_establishment;
    DDS_ParticipantSecuritySymmetricCipherAlgorithmInfo symmetric_cipher;
} DDS_ParticipantSecurityAlgorithmInfo;

/* ------------------------------------------------------------------------- */
typedef DDS_PluginParticipantTrustAttributesMask
        DDS_PluginParticipantSecurityAttributesMask;

typedef DDS_PluginEndpointTrustAttributesMask
        DDS_PluginEndpointSecurityAttributesMask;

typedef DDS_ParticipantTrustVendorProtectionInfoMask
        DDS_ParticipantSecurityVendorProtectionInfoMask;

typedef struct {
    /*
     * The bitmask represents the RTI-vendor-specific participant protection
     * configuration. Regardless of whether a field is set explicitly by the
     * user, of its protection kind is inherited from a different field, this
     * bitmask always corresponds to the actual configuration in use.
     */
    DDS_ParticipantSecurityVendorProtectionInfoMask bitmask;
    /*
     * The above bitmask corresponds to the actual configuration of the
     * user. This bitmask contains the bits that do not match their
     * corresponding derived value from other fields (for example,
     * IS_SERVICE_REQUEST_PROTECTED is derived from IS_DISCOVERY_PROTECTED).
     * This is not sent on the wire.
     */
    DDS_ParticipantSecurityVendorProtectionInfoMask non_derived_bitmask; /* @non-serialized */
} DDS_ParticipantSecurityVendorProtectionInfo;

typedef DDS_VendorEndpointTrustAttributesMask
        DDS_VendorEndpointSecurityAttributesMask;

/*
 * The types here must have the same memory mapping as their DDS counterparts.
 * DDS_ParticipantSecurityAttributes:
 *     DDS_ParticipantTrustAttributes
 * DDS_EndpointSecuritySymmetricCipherAlgorithmInfo:
 *     DDS_EndpointTrustInterceptorAlgorithmInfo
 * DDS_EndpointSecurityAlgorithmInfo: DDS_EndpointTrustAlgorithmInfo
 * DDS_EndpointSecurityAttributes: DDS_EndpointTrustAttributes
 * DDS_ParticipantSecurityVendorProtectionInfo:
 *     DDS_ParticipantTrustVendorProtectionInfo
 */
typedef struct {
    DDS_Boolean allow_unauthenticated_participants;
    DDS_Boolean is_access_protected;
    /* axk: Authenticated participant eXchanged Key. */
    DDS_Boolean is_rtps_axk_protected;
    /* psk: Pre-Shared Key. */
    DDS_Boolean is_rtps_psk_protected;
    DDS_Boolean is_discovery_protected;
    DDS_Boolean is_liveliness_protected;
    DDS_Boolean is_key_revision_enabled;
    DDS_PluginParticipantSecurityAttributesMask plugin_participant_attributes;
    struct DDS_PropertySeq ac_participant_properties;
    DDS_ParticipantSecurityAlgorithmInfo algorithm_info;
    DDS_ParticipantSecurityVendorProtectionInfo vendor_participant_protection_info;
    DDS_RequirementKind ocsp_requirement_kind;
    DDS_RequirementKind crl_requirement_kind;
} DDS_ParticipantSecurityAttributes;

#define DDS_ParticipantSecurityAttributes_INITIALIZER \
    DDS_ParticipantTrustAttributes_INITIALIZER

typedef struct {
    DDS_CryptoAlgorithmSet required_mask;
    DDS_CryptoAlgorithmSet supported_mask; /* @non_serialized */
} DDS_EndpointSecuritySymmetricCipherAlgorithmInfo;

typedef struct {
    DDS_EndpointSecuritySymmetricCipherAlgorithmInfo symmetric_cipher;
} DDS_EndpointSecurityAlgorithmInfo;

typedef struct {
    DDS_TopicSecurityAttributes parent;
    DDS_Boolean is_submessage_protected;
    DDS_Boolean is_payload_protected;
    DDS_Boolean is_key_protected;
    DDS_PluginEndpointSecurityAttributesMask plugin_endpoint_attributes;
    DDS_VendorEndpointSecurityAttributesMask vendor_endpoint_attributes;
    struct DDS_PropertySeq ac_endpoint_properties;
    DDS_EndpointSecurityAlgorithmInfo algorithm_info;
} DDS_EndpointSecurityAttributes;

#define DDS_EndpointSecurityAttributes_INITIALIZER \
    DDS_EndpointTrustAttributes_INITIALIZER

/* ------------------------------------------------------------------------- */

#ifdef __cplusplus
extern "C" {
#endif

struct RTI_Security_PluginSuite;

/*
 * This API initializes (or retrieves if it already exists) the thread context
 * for the current thread. Thread context is Thread Specific Storage (TSS) used
 * by Core and the Security Plugins to store state.
 *
 * @return A handle to the thread context from the current thread's TSS.
 */
extern DDS_ThreadContextHandle
RTI_Security_PluginSuiteUtils_getThreadContextHandle(void);

/*
 * This API returns the process CryptoContext thread context accessor. The
 * Security Plugins use process thread context accessors in combination with a
 * ThreadContextHandle to retrieve specific parts of a thread's TSS.
 *
 * @return A handle to the CryptoContext accessor for this process.
 */
extern RTI_Security_ThreadContextAccessorHandle
RTI_Security_PluginSuiteUtils_getCryptoContextAccessor(void);

extern RTISecurityDllExport
void RTI_Security_PluginSuite_create(
        struct RTI_Security_PluginSuite **securityPluginSuite,
        const struct DDS_PropertyQosPolicy *properties);

extern RTISecurityDllExport
void RTI_SecurityLightweight_PluginSuite_create(
        struct RTI_Security_PluginSuite **security,
        const struct DDS_PropertyQosPolicy *properties);

#ifdef __cplusplus
}    /* extern "C" */
#endif

#endif /* security_default_h */