/*
 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License").
 * You may not use this file except in compliance with the License.
 * A copy of the License is located at
 *
 *  http://aws.amazon.com/apache2.0
 *
 * or in the "license" file accompanying this file. This file is distributed
 * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
 * express or implied. See the License for the specific language governing
 * permissions and limitations under the License.
 */

#pragma once

#include "crypto/s2n_hash.h"

/* Codes from http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-5 */
#define TLS_NULL_WITH_NULL_NULL             0x00, 0x00
#define TLS_RSA_WITH_AES_256_CBC_SHA256     0x00, 0x3D
#define TLS_RSA_WITH_AES_256_CBC_SHA        0x00, 0x35
#define TLS_RSA_WITH_AES_128_CBC_SHA256     0x00, 0x3C
#define TLS_RSA_WITH_AES_128_CBC_SHA        0x00, 0x2F
#define TLS_RSA_WITH_3DES_EDE_CBC_SHA       0x00, 0x0A
#define TLS_RSA_WITH_RC4_128_MD5            0x00, 0x04
#define TLS_RSA_WITH_RC4_128_SHA            0x00, 0x05

#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA    0x00, 0x33
#define TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 0x00, 0x67
#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA    0x00, 0x39
#define TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 0x00, 0x6B
#define TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA   0x00, 0x16

#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA       0xC0, 0x09
#define TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256    0xC0, 0x23
#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA       0xC0, 0x0A
#define TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384    0xC0, 0x24

#define TLS_ECDHE_RSA_WITH_RC4_128_SHA           0xC0, 0x11
#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA       0xC0, 0x13
#define TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256    0xC0, 0x27
#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA       0xC0, 0x14
#define TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384    0xC0, 0x28
#define TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA      0xC0, 0x12

#define TLS_RSA_WITH_AES_128_GCM_SHA256          0x00, 0x9C
#define TLS_RSA_WITH_AES_256_GCM_SHA384          0x00, 0x9D
#define TLS_DHE_RSA_WITH_AES_128_GCM_SHA256      0x00, 0x9E
#define TLS_DHE_RSA_WITH_AES_256_GCM_SHA384      0x00, 0x9F
#define TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256  0xC0, 0x2B
#define TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384  0xC0, 0x2C
#define TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256    0xC0, 0x2F
#define TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384    0xC0, 0x30

#define TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256    0xCC, 0xA8
#define TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256  0xCC, 0xA9
#define TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256      0xCC, 0xAA

/* TLS 1.2 hybrid post-quantum definitions from https://tools.ietf.org/html/draft-campagna-tls-bike-sike-hybrid */
#define TLS_ECDHE_BIKE_RSA_WITH_AES_256_GCM_SHA384 0xFF, 0x04
#define TLS_ECDHE_SIKE_RSA_WITH_AES_256_GCM_SHA384 0xFF, 0x08
#define TLS_ECDHE_KYBER_RSA_WITH_AES_256_GCM_SHA384 0xFF, 0x0C
#define TLS_EXTENSION_PQ_KEM_PARAMETERS 0xFE01
#define TLS_PQ_KEM_EXTENSION_ID_BIKE1_L1_R1 1
#define TLS_PQ_KEM_EXTENSION_ID_BIKE1_L1_R2 13
#define TLS_PQ_KEM_EXTENSION_ID_SIKE_P503_R1 10
#define TLS_PQ_KEM_EXTENSION_ID_SIKE_P434_R2 19
#define TLS_PQ_KEM_EXTENSION_ID_KYBER_512_R2 23
#define TLS_PQ_KEM_EXTENSION_ID_KYBER_512_90S_R2 24

/* TLS 1.3 hybrid post-quantum definitions are from the proposed reserved range defined
 * in https://tools.ietf.org/html/draft-stebila-tls-hybrid-design. Values for interoperability
 * are defined in https://docs.google.com/spreadsheets/d/12YarzaNv3XQNLnvDsWLlRKwtZFhRrDdWf36YlzwrPeg/edit#gid=0. */
#define TLS_PQ_KEM_GROUP_ID_X25519_SIKE_P434_R2 0x2F27
#define TLS_PQ_KEM_GROUP_ID_SECP256R1_SIKE_P434_R2 0x2F1F
#define TLS_PQ_KEM_GROUP_ID_X25519_BIKE1_L1_R2 0x2F28
#define TLS_PQ_KEM_GROUP_ID_SECP256R1_BIKE1_L1_R2 0x2F23
#define TLS_PQ_KEM_GROUP_ID_X25519_KYBER_512_R2 0x2F26
#define TLS_PQ_KEM_GROUP_ID_SECP256R1_KYBER_512_R2 0x2F0F

/* From https://tools.ietf.org/html/rfc7507 */
#define TLS_FALLBACK_SCSV                   0x56, 0x00
#define TLS_EMPTY_RENEGOTIATION_INFO_SCSV   0x00, 0xff

/* TLS 1.3 cipher suites from https://tools.ietf.org/html/rfc8446#appendix-B.4 */
#define TLS_AES_128_GCM_SHA256              0x13, 0x01
#define TLS_AES_256_GCM_SHA384              0x13, 0x02
#define TLS_CHACHA20_POLY1305_SHA256        0x13, 0x03
#define TLS_AES_128_CCM_SHA256              0x13, 0x04
#define TLS_AES_128_CCM_8_SHA256            0x13, 0x05

/* TLS extensions from https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml */
#define TLS_EXTENSION_SERVER_NAME           0
#define TLS_EXTENSION_MAX_FRAG_LEN          1
#define TLS_EXTENSION_STATUS_REQUEST        5
#define TLS_EXTENSION_SUPPORTED_GROUPS     10
#define TLS_EXTENSION_EC_POINT_FORMATS     11
#define TLS_EXTENSION_SIGNATURE_ALGORITHMS 13
#define TLS_EXTENSION_ALPN                 16
#define TLS_EXTENSION_SCT_LIST             18
#define TLS_EXTENSION_SESSION_TICKET       35
#define TLS_EXTENSION_CERT_AUTHORITIES     47
#define TLS_EXTENSION_RENEGOTIATION_INFO   65281

/* TLS 1.3 extensions from https://tools.ietf.org/html/rfc8446#section-4.2 */
#define TLS_EXTENSION_SUPPORTED_VERSIONS   43
#define TLS_EXTENSION_COOKIE               44
#define TLS_EXTENSION_KEY_SHARE            51

/* QUIC-TLS extension from https://tools.ietf.org/html/draft-ietf-quic-tls-29#section-8.2 */
#define TLS_QUIC_TRANSPORT_PARAMETERS      65535

/* TLS Signature Algorithms - RFC 5246 7.4.1.4.1 */
/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-16 */
#define TLS_SIGNATURE_ALGORITHM_ANONYMOUS   0
#define TLS_SIGNATURE_ALGORITHM_RSA         1
#define TLS_SIGNATURE_ALGORITHM_DSA         2
#define TLS_SIGNATURE_ALGORITHM_ECDSA       3
#define TLS_SIGNATURE_ALGORITHM_PRIVATE     224

#define TLS_SIGNATURE_ALGORITHM_COUNT       4

/* TLS Hash Algorithm - https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1 */
/* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-18 */
#define TLS_HASH_ALGORITHM_ANONYMOUS        0
#define TLS_HASH_ALGORITHM_MD5              1
#define TLS_HASH_ALGORITHM_SHA1             2
#define TLS_HASH_ALGORITHM_SHA224           3
#define TLS_HASH_ALGORITHM_SHA256           4
#define TLS_HASH_ALGORITHM_SHA384           5
#define TLS_HASH_ALGORITHM_SHA512           6
#define TLS_HASH_ALGORITHM_COUNT            7

/* TLS SignatureScheme (Backwards compatible with SigHash and SigAlg values above) */
/* Defined here: https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-signaturescheme */
#define TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA1             0x0201
#define TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA224           0x0301
#define TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA256           0x0401
#define TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA384           0x0501
#define TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA512           0x0601

/* In TLS 1.0 and 1.1 the hard-coded default scheme was RSA_PKCS1_MD5_SHA1, but there's no IANA defined backwards
 * compatible value for that Scheme for TLS 1.2 and 1.3. So we define an internal value in the private range that won't
 * match anything in the valid range so that all TLS Versions can use the same SignatureScheme negotiation abstraction
 * layer. This scheme isn't in any preference list, so it can't be negotiated even if a client sent it in its pref list. */
#define TLS_SIGNATURE_SCHEME_PRIVATE_INTERNAL_RSA_PKCS1_MD5_SHA1         0xFFFF

/* TLS 1.2 Backwards Compatible ECDSA Schemes */
#define TLS_SIGNATURE_SCHEME_ECDSA_SHA1                 0x0203
#define TLS_SIGNATURE_SCHEME_ECDSA_SHA224               0x0303
#define TLS_SIGNATURE_SCHEME_ECDSA_SHA256               0x0403
#define TLS_SIGNATURE_SCHEME_ECDSA_SHA384               0x0503
#define TLS_SIGNATURE_SCHEME_ECDSA_SHA512               0x0603

/* TLS 1.3 ECDSA Signature Schemes */
#define TLS_SIGNATURE_SCHEME_ECDSA_SECP256R1_SHA256     0x0403
#define TLS_SIGNATURE_SCHEME_ECDSA_SECP384R1_SHA384     0x0503
#define TLS_SIGNATURE_SCHEME_ECDSA_SECP521R1_SHA512     0x0603
#define TLS_SIGNATURE_SCHEME_RSA_PSS_RSAE_SHA256        0x0804
#define TLS_SIGNATURE_SCHEME_RSA_PSS_RSAE_SHA384        0x0805
#define TLS_SIGNATURE_SCHEME_RSA_PSS_RSAE_SHA512        0x0806
#define TLS_SIGNATURE_SCHEME_ED25519                    0x0807
#define TLS_SIGNATURE_SCHEME_ED448                      0x0808
#define TLS_SIGNATURE_SCHEME_RSA_PSS_PSS_SHA256         0x0809
#define TLS_SIGNATURE_SCHEME_RSA_PSS_PSS_SHA384         0x080A
#define TLS_SIGNATURE_SCHEME_RSA_PSS_PSS_SHA512         0x080B


#define TLS_SIGNATURE_SCHEME_LEN                        2
#define TLS_SIGNATURE_SCHEME_LIST_MAX_LEN               64

/* The TLS record types we support */
#define SSLv2_CLIENT_HELLO     1
#define TLS_CHANGE_CIPHER_SPEC 20
#define TLS_ALERT              21
#define TLS_HANDSHAKE          22
#define TLS_APPLICATION_DATA   23

/* Elliptic curve formats from http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-9
 * Only uncompressed is supported.
 */
#define TLS_EC_FORMAT_UNCOMPRESSED               0
#define TLS_EC_FORMAT_ANSIX962_COMPRESSED_PRIME  1
#define TLS_EC_FORMAT_ANSIX962_COMPRESSED_CHAR2  2

/* Elliptic curves from https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8 */
#define TLS_EC_CURVE_SECP_256_R1           23
#define TLS_EC_CURVE_SECP_384_R1           24
#define TLS_EC_CURVE_ECDH_X25519           29

/* Ethernet maximum transmission unit (MTU)
 * MTU is usually associated with the Ethernet protocol,
 * where a 1500-byte packet is the largest allowed in it
 */
#define ETH_MTU 1500

#define IP_V4_HEADER_LENGTH 20
#define IP_V6_HEADER_LENGTH 40

#define TCP_HEADER_LENGTH 20
#define TCP_OPTIONS_LENGTH 40

/* The maximum size of a TLS record is 16389 bytes. This is;  1 byte for content
 * type, 2 bytes for the protocol version, 2 bytes for the length field,
 * and then up to 2^14 for the encrypted+compressed payload data.
 */
#define S2N_TLS_RECORD_HEADER_LENGTH    5
#define S2N_TLS_MAXIMUM_FRAGMENT_LENGTH 16384
/* Maximum TLS record length allows for 2048 octets of compression expansion and padding */
#define S2N_TLS_MAXIMUM_RECORD_LENGTH   (S2N_TLS_MAXIMUM_FRAGMENT_LENGTH + S2N_TLS_RECORD_HEADER_LENGTH + 2048)
#define S2N_TLS_MAX_FRAG_LEN_EXT_NONE   0

/* TLS1.3 has a max fragment length of 2^14 + 1 byte for the content type */
#define S2N_TLS13_MAXIMUM_FRAGMENT_LENGTH 16385
/* Max encryption overhead is 255 for AEAD padding */
#define S2N_TLS13_MAXIMUM_RECORD_LENGTH   (S2N_TLS13_MAXIMUM_FRAGMENT_LENGTH + S2N_TLS_RECORD_HEADER_LENGTH + 255)

/* The maximum size of an SSL2 message is 2^14 - 1, as neither of the first two
 * bits in the length field are usable. Per;
 * http://www-archive.mozilla.org/projects/security/pki/nss/ssl/draft02.html
 * section 1.1
 */
#define S2N_SSL2_RECORD_HEADER_LENGTH   2
#define S2N_SSL2_MAXIMUM_MESSAGE_LENGTH 16383
#define S2N_SSL2_MAXIMUM_RECORD_LENGTH  (S2N_SSL2_MAXIMUM_MESSAGE_LENGTH + S2N_SSL2_RECORD_HEADER_LENGTH)

/* s2n can use a "small" record length that is aligned to the dominant internet MTU;
 * 1500 bytes, minus 20 bytes for an IP header, minus 20 bytes for a tcp
 * header and 20 bytes for tcp/ip options (timestamp, sack etc) and a "large" record
 * length that is designed to maximize throughput (fewer MACs per byte transferred
 * and better efficiency of crypto engines).
 */
#define S2N_SMALL_RECORD_LENGTH (1500 - 20 - 20 - 20)
#define S2N_SMALL_FRAGMENT_LENGTH (S2N_SMALL_RECORD_LENGTH - S2N_TLS_RECORD_HEADER_LENGTH)

/* Testing in the wild has found 8k max record sizes give a good balance of low latency
 * and throughput.
 */
#define S2N_DEFAULT_RECORD_LENGTH 8092
#define S2N_DEFAULT_FRAGMENT_LENGTH (S2N_DEFAULT_RECORD_LENGTH - S2N_TLS_RECORD_HEADER_LENGTH)

/* S2N_LARGE_RECORD_LENGTH is used for initializing output buffers, we use the largest
 * possible value of all supported protocols to avoid branching at runtime
 */
#define S2N_LARGE_RECORD_LENGTH S2N_TLS_MAXIMUM_RECORD_LENGTH
#define S2N_LARGE_FRAGMENT_LENGTH S2N_TLS_MAXIMUM_FRAGMENT_LENGTH
#define S2N_TLS13_LARGE_FRAGMENT_LENGTH S2N_TLS13_MAXIMUM_FRAGMENT_LENGTH

/* Cap dynamic record resize threshold to 8M */
#define S2N_TLS_MAX_RESIZE_THRESHOLD (1024 * 1024 * 8)

/* Put a 64k cap on the size of any handshake message */
#define S2N_MAXIMUM_HANDSHAKE_MESSAGE_LENGTH (64 * 1024)

/* Maximum size for full encoded TLSInnerPlaintext (https://tools.ietf.org/html/rfc8446#section-5.4) */
#define S2N_MAXIMUM_INNER_PLAINTEXT_LENGTH ((1 << 14) + 1)

/* Alert messages are always 2 bytes long */
#define S2N_ALERT_LENGTH 2

/* Handshake messages have their own header too */
#define TLS_HANDSHAKE_HEADER_LENGTH   4

#define S2N_MAX_SERVER_NAME 255
