/**
 * (c) Copyright, Real-Time Innovations, 2017-2017.
 * All rights reserved.
 * No duplications, whole or partial, manual or electronic, may be made
 * without express written permission.  Any such copies, or
 * revisions thereof, must display this notice unaltered.
 * This code contains trade secrets of Real-Time Innovations, Inc.
 *
 * Description
 * -----------
 * Property names and values for security authentication plugin
 * =====================================================================
 */
#ifndef security_authentication_h
#define security_authentication_h

#include "security/security_default.h"
#include "security/security_infrastructure.h"

#ifdef __cplusplus
    extern "C" {
#endif

    /* DDS Security 1.2 specification Table 51 */
#define RTI_SECURITY_AUTHENTICATION_IDENTITY_CLASS_ID \
  RTI_SECURITY_AUTHENTICATION_IDENTITY_12_CLASS_ID
#define RTI_SECURITY_AUTHENTICATION_IDENTITY_12_CLASS_ID \
  RTI_SECURITY_AUTHENTICATION_PLUGIN_CLASS ":1.2"
#define RTI_SECURITY_AUTHENTICATION_IDENTITY_10_CLASS_ID \
  RTI_SECURITY_AUTHENTICATION_PLUGIN_CLASS ":1.0"

    /* RTI Lightweight Security */
#define RTI_SECURITY_AUTHENTICATION_LIGHTWEIGHT_IDENTITY_CLASSID \
  RTI_SECURITY_AUTHENTICATION_LIGHTWEIGHT_SECURITY_PLUGIN_CLASS ":1.2"

#define RTI_SECURITY_PROPERTY_VALUE_LEGACY_DH "dh"
#define RTI_SECURITY_PROPERTY_VALUE_LEGACY_ECDH "ecdh"

/* Default property values */
#define PROPERTY_PLUGIN_SUFFIX_AUTHENTICATION_PROPAGATE_SIMPLIFIED_IDENTITY_CERTIFICATE_DEFAULT \
    RTI_TRUE

/*
 * Digital signature algorithm property values.
 * DDS Security specification Table 38.
 */
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_RSASSA_PSS_MGF1SHA256_2048_SHA256 \
    "RSASSA-PSS-MGF1SHA256+2048+SHA256"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_RSASSA_PKCS1_V1_5_2048_SHA256 \
    "RSASSA-PKCS1-V1_5+2048+SHA256"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_ECDSA256_SHA256 \
    "ECDSA+P256+SHA256"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_ECDSA384_SHA384 \
    "ECDSA+P384+SHA384"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_EDDSA_ED25519_SHA512 \
    "EDDSA+ED25519+SHA512"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_EDDSA_ED448_SHAKE256 \
    "EDDSA+ED448+SHAKE256"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_SM2_SM2P256_SM3 "SM2+SM2P256+SM3"

#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_RSA_LEGACY "RSASSA-PSS-SHA256"
#define RTI_SECURITY_AUTHENTICATION_DSIGN_ALGO_ECDSA_LEGACY "ECDSA-SHA256"

/* Key establishment algorithm property values */
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_DHE "DHE+MODP-2048-256"
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_ECDHE_P256 "ECDHE-CEUM+P256"
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_ECDHE_P384 "ECDHE-CEUM+P384"
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_ECDHE_X25519 "ECDHE-CEUM+X25519"
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_ECDHE_X448 "ECDHE-CEUM+X448"
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_SM2_KXEPH_SM2P256 "SM2-KXEPH+SM2P256"

#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_DHE_LEGACY "DH+MODP-2048-256"
#define RTI_SECURITY_AUTHENTICATION_KEST_ALGO_ECDHE_LEGACY "ECDH+prime256v1-CEUM"

/*
 * EXFLAG_KUSAGE, which is defined by OpenSSL has been detected as a signed int,
 * but according to the documentation it's a uint32_t. Since we do bitwise
 * operations with this value some issues could arise (see SEC-2130). As a
 * workaround we redefine this flag so that it is detected now as unsigned.
 */
#define RTI_EXFLAG_KUSAGE ((unsigned int) EXFLAG_KUSAGE)

    /*
     * OCSP_check_validity parameters when checking the time validity of the
     * OCSP response. They are both given in seconds.
     *
     * RTI_SECURITY_AUTHENTICATION_OCSP_RESPONSE_LEEWAY is to account for clock
     * inaccuracies.
     *
     * RTI_SECURITY_AUTHENTICATION_OSCP_RESPONSE_MAX_AGE imposes a limit on the
     * maximum age of the response. If the response is older than this limit,
     * then we don't consider it valid. At the moment, the value is -1 (meaning
     * no maximum). We are trusting that the responder is not configured to
     * allow very large nextUpdateFields.
     *
     * The response is valid if the current time is between
     *   thisUpdate - RTI_SECURITY_AUTHENTICATION_OCSP_RESPONSE_LEEWAY
     * and
     *   nextUpdateField + RTI_SECURITY_AUTHENTICATION_OCSP_RESPONSE_LEEWAY.
     *
     * That is, [thisUpdate - 10, nextUpdate + 10].
     */
#define RTI_SECURITY_AUTHENTICATION_OCSP_RESPONSE_LEEWAY 10
#define RTI_SECURITY_AUTHENTICATION_OSCP_RESPONSE_MAX_AGE -1

#ifdef __cplusplus
}    /* extern "C" */
#endif

#endif /* security_authentication_h */