/*
* Copyright (c) 2007-2009 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of the License "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description: 
*
*/


#include "symmetriccipherimpl.h"

#include <e32def.h>
#include <cryptostrength.h>
#include <cryptospi/cryptospidef.h>
#include "keys.h"
#include <cryptopanic.h>
#include <cryptospi/plugincharacteristics.h>
#include "pluginconfig.h"
#include <securityerr.h>
#include "common/inlines.h"

using namespace SoftwareCrypto;

//
// Implementation of Symmetric Cipher class
//
CSymmetricCipherImpl::CSymmetricCipherImpl() 
	{
	}

void CSymmetricCipherImpl::ConstructL(const CKey& aKey) 
	{
	DoSetKeyL(aKey);		
	}
	
void CSymmetricCipherImpl::SecureDelete(HBufC8*& aBuffer)
	{
	if (aBuffer)
		{
		aBuffer->Des().FillZ();
		}
	delete aBuffer;
	aBuffer = 0;	
	}

CSymmetricCipherImpl::~CSymmetricCipherImpl()
	{			
	SecureDelete(iKey);	
	}
		
void CSymmetricCipherImpl::Close()
	{
	delete this;
	}
	
TAny* CSymmetricCipherImpl::GetExtension(TUid /*aExtensionId*/) 
	{
	return 0;
	}
	
void CSymmetricCipherImpl::GetCharacteristicsL(const TAny*& aPluginCharacteristics)
	{
	TInt numCiphers = sizeof(KSymmetricCipherCharacteristics)/sizeof(TSymmetricCipherCharacteristics*);
	TInt32 implUid = ImplementationUid().iUid;
	for (TInt i = 0; i < numCiphers; ++i)
		{
		if (KSymmetricCipherCharacteristics[i]->cmn.iImplementationUID == implUid)
			{
			aPluginCharacteristics = KSymmetricCipherCharacteristics[i];
			break;
			}
		}	
	}

TInt CSymmetricCipherImpl::GetKeyStrength() const
	{
	return BytesToBits(iKey->Length());
	}
	
HBufC8* CSymmetricCipherImpl::ExtractKeyDataLC(const CKey& aKey) const
	{
	const TDesC8& keyContent = aKey.GetTDesC8L(KSymmetricKeyParameterUid);
	return keyContent.AllocLC();
	}

TInt CSymmetricCipherImpl::KeySize() const
	{
	// return key size in BITS
	return BytesToBits(iKeyBytes);
	}

void CSymmetricCipherImpl::DoSetKeyL(const CKey& aKey)
	{
	HBufC8* key = ExtractKeyDataLC(aKey);
	TInt keyLength(key->Length());
	
	TCrypto::IsSymmetricWeakEnoughL(BytesToBits(keyLength));
	if (! IsValidKeyLength(keyLength))
		{
		CleanupStack::PopAndDestroy(key);
		User::Leave(KErrNotSupported);
		}
	
	SecureDelete(iKey);	
	CleanupStack::Pop(key);
	iKey = key;
	iKeyBytes = keyLength;
	}	

//
// Implementation of Symmetric Stream Cipher
//
CSymmetricStreamCipherImpl::CSymmetricStreamCipherImpl()
	{
	}

CSymmetricStreamCipherImpl::~CSymmetricStreamCipherImpl()
	{
	}

void CSymmetricStreamCipherImpl::SetKeyL(const CKey& aKey)
	{
	DoSetKeyL(aKey);
	TCrypto::IsSymmetricWeakEnoughL(GetKeyStrength());
	Reset();
	}	

void CSymmetricStreamCipherImpl::ConstructL(const CKey& aKey) 
	{
	CSymmetricCipherImpl::ConstructL(aKey);
	}

TInt CSymmetricStreamCipherImpl::BlockSize() const
	{
	// return block size in BITS
	return BYTE_BITS;
	}

void CSymmetricStreamCipherImpl::SetCryptoModeL(TUid /*aCryptoMode*/)
	{
	// Call the reset method.
	Reset();
	}
	
TInt CSymmetricStreamCipherImpl::MaxOutputLength(TInt aInputLength) const
	{
	return aInputLength;	
	}
	
TInt CSymmetricStreamCipherImpl::MaxFinalOutputLength(TInt aInputLength) const
	{
	return aInputLength;	
	}
	
void CSymmetricStreamCipherImpl::ProcessL(const TDesC8& aInput, TDes8& aOutput)
	{
	TInt outputIndex = aOutput.Size();

	// aOutput may already have outputIndex bytes of data in it
	// check there will still be enough space to process the result
	__ASSERT_DEBUG(aOutput.MaxLength() - outputIndex >= MaxOutputLength(aInput.Length()), User::Panic(KCryptoPanic, ECryptoPanicOutputDescriptorOverflow));

	aOutput.Append(aInput);

	TPtr8 transformBuf((TUint8*)(aOutput.Ptr()) + outputIndex, aInput.Size(),
		aInput.Size());
	DoProcess(transformBuf);
	}

void CSymmetricStreamCipherImpl::ProcessFinalL(const TDesC8& aInput, TDes8& aOutput)
	{
	ProcessL(aInput, aOutput);	
	}

//
// Implementation of Symmetric Block Cipher
//
CSymmetricBlockCipherImpl::CSymmetricBlockCipherImpl(
	TUint8 aBlockBytes,
	TUid aCryptoMode,
	TUid aOperationMode,
	TUid aPaddingMode) :
	iBlockBytes(aBlockBytes),
	iCryptoMode(aCryptoMode),
	iOperationMode(aOperationMode),
	iPaddingMode(aPaddingMode),
	iBufferedPlaintextPtr(0,0,0),
	iCtrUnusedKeystreamPtr(0,0,0)
	{
	}

CSymmetricBlockCipherImpl::~CSymmetricBlockCipherImpl()
	{			
	delete iPadding;
	delete [] iRegister;
	delete [] iCurrentCipherText;
	delete iBufferedPlaintext;
	delete iCtrUnusedKeystream;
	iIv.Close();
	iInputStore.Close();
	iPaddingBlock.Close();	
	}


void CSymmetricBlockCipherImpl::ConstructL(const CKey& aKey) 
	{
	CSymmetricCipherImpl::ConstructL(aKey);
	DoSetOperationModeL(iOperationMode);
	DoSetCryptoModeL(iCryptoMode);	
	DoSetPaddingModeL(iPaddingMode);
	
	iInputStore.ReAllocL(iBlockBytes);
	iPaddingBlock.ReAllocL(iBlockBytes);

	iRegister = new(ELeave) TUint32[iBlockBytes/4];	
	iRegisterPtr = reinterpret_cast<TUint8*>(iRegister);

	iCurrentCipherText = new(ELeave) TUint32[iBlockBytes/4];	
	iCurrentCipherTextPtr = reinterpret_cast<TUint8*>(iCurrentCipherText);
	
	iBufferedPlaintext = HBufC8::NewL(iBlockBytes);
	iBufferedPlaintextPtr.Set(iBufferedPlaintext->Des());
	
	iCtrUnusedKeystream = HBufC8::NewL(iBlockBytes);
	iCtrUnusedKeystreamPtr.Set(iCtrUnusedKeystream->Des());
	}

void CSymmetricBlockCipherImpl::Reset()
	{
	iInputStore.Zero();
	iPaddingBlock.Zero();
	iCtrUnusedKeystreamPtr.Zero();
	
	if (iOperationMode.iUid == KOperationModeCBC)
		{
		// only copy the IV if it is already set
		if (iIv.MaxLength() > 0)
			{
			Mem::Copy(iRegisterPtr, &iIv[0], iBlockBytes);
			}
		}
	}	

void CSymmetricBlockCipherImpl::SetKeyL(const CKey& aKey)
	{
	DoSetKeyL(aKey);
	TCrypto::IsSymmetricWeakEnoughL(GetKeyStrength());
	SetKeySchedule();
	Reset();
	}

void CSymmetricBlockCipherImpl::SetOperationModeL(TUid aOperationMode)
	{
	DoSetOperationModeL(aOperationMode);
	Reset();
	}
	
void CSymmetricBlockCipherImpl::SetCryptoModeL(TUid aCryptoMode)
	{
	DoSetCryptoModeL(aCryptoMode);
	SetKeySchedule();
	Reset();
	}
	
void CSymmetricBlockCipherImpl::SetPaddingModeL(TUid aPaddingMode)
	{
	DoSetPaddingModeL(aPaddingMode);
	Reset();
	}
	
void CSymmetricBlockCipherImpl::SetIvL(const TDesC8& aIv)
	{
	if ((iOperationMode.iUid != KOperationModeCBC) && (iOperationMode.iUid != KOperationModeCTR))
		{
		User::Leave(KErrNotSupported);
		}
	DoSetIvL(aIv);
	Reset();
	}

void CSymmetricBlockCipherImpl::DoSetOperationModeL(TUid aOperationMode)
	{
	switch (aOperationMode.iUid)
		{
		case KOperationModeNone:
		case KOperationModeECB:
		case KOperationModeCBC:
			break;
		case KOperationModeCTR:
			SetCryptoModeL(KCryptoModeEncryptUid);
			break;
		default:
			User::Leave(KErrNotSupported);
		}
	iOperationMode = aOperationMode;		
	}

void CSymmetricBlockCipherImpl::DoSetCryptoModeL(TUid aCryptoMode)
	{
	switch (aCryptoMode.iUid)
		{
		case KCryptoModeEncrypt:
			break;
		case KCryptoModeDecrypt:
			if (iOperationMode.iUid == KOperationModeCTR)
				{
				return;
				}
			break;
		default:
			User::Leave(KErrNotSupported);
		}
	iCryptoMode = aCryptoMode;		
	}

void CSymmetricBlockCipherImpl::DoSetPaddingModeL(TUid aPaddingMode)
	{
	CPadding* padding(0);
	switch (aPaddingMode.iUid)
		{
		case KPaddingModeNone:
			padding = CPaddingNone::NewL(iBlockBytes);
		break;
		case KPaddingModeSSLv3:
			padding = CPaddingSSLv3::NewL(iBlockBytes);
		break;
		case KPaddingModePKCS7:
			padding = CPaddingPKCS7::NewL(iBlockBytes);
		break;
		default:
			User::Leave(KErrNotSupported);
		}
	delete iPadding;
	iPadding = padding;
	iPaddingMode = aPaddingMode;
	}	

void CSymmetricBlockCipherImpl::DoSetIvL(const TDesC8& aIv)
	{
	iIv.ReAllocL(iBlockBytes);
	iIv.SetLength(iBlockBytes);

	iIv.Zero();
	if (aIv.Length() != iBlockBytes) 
		{
		User::Leave(KErrArgument);
		}
	iIv = aIv;
	Mem::Copy(iRegisterPtr, &iIv[0], iBlockBytes);	//for CTR mode

	}	

TInt CSymmetricBlockCipherImpl::BlockSize() const
	{
	// return block size in BITS
	if (iOperationMode.iUid == KOperationModeCTR)
		{
		return 8;
		}
	else
		{
		return BytesToBits(iBlockBytes);
		}
	}

TInt CSymmetricBlockCipherImpl::MaxOutputLength(TInt aInputLength) const
	{	
	if (iOperationMode.iUid == KOperationModeCTR)
		{
		return aInputLength;
		}
	else
		{
		// The maximum output length required for Process is equal to the
		// size of the number of whole input blocks available.
		//
		// The block bytes is a power of two so we can use this to avoid
		// doing a real mod operation
		TUint inputStoreLength(iInputStore.Length());
		TInt rem = (aInputLength + inputStoreLength) & (iBlockBytes - 1);
		return (aInputLength + inputStoreLength - rem);
		}
	}	

TInt CSymmetricBlockCipherImpl::MaxFinalOutputLength(TInt aInputLength) const
	{
	if (iOperationMode.iUid == KOperationModeCTR)
		{
		return aInputLength;
		}
	else if (iCryptoMode.iUid == KCryptoModeEncrypt)
		{
		return iPadding->MaxPaddedLength(iInputStore.Length() + aInputLength);
		}
	else
		{
		return iPadding->MaxUnPaddedLength(aInputLength + iInputStore.Size());
		}
	}

void CSymmetricBlockCipherImpl::ProcessL(const TDesC8& aInput, TDes8& aOutput)
	{
	// if we're running in CBC or CTR mode then we must have an IV set before we can 
	// do any processing ie call SetIvL() before this method
	if ((iOperationMode.iUid == KOperationModeCBC) || (iOperationMode.iUid == KOperationModeCTR))
		{
		if (iIv.MaxLength() == 0)
			{
			User::Leave(KErrNotSupported);
			}
		}

	TInt inputLength(aInput.Length());	
	TInt inputStoreLength(iInputStore.Length());
	
	if (MaxOutputLength(inputLength) > aOutput.MaxLength())
		{
		User::Leave(KErrOverflow);
		}	

	if (iOperationMode.iUid == KOperationModeCTR)
		{
		ProcessCtrL(aInput, aOutput);
		}	
	else
		{
		TUint8 blockSizeLog = CryptoLog2(iBlockBytes);
		TInt wholeBlocks = (inputLength + inputStoreLength) >> blockSizeLog; 
		TInt wholeBlocksSize = wholeBlocks << blockSizeLog;
	
		if (wholeBlocks)
			{
			TInt outputLength(aOutput.Length());

			if (inputStoreLength > 0)
				{
				aOutput.Append(iInputStore);
				iInputStore.Zero();
				}
			aOutput.Append(aInput.Left(wholeBlocksSize - inputStoreLength));
			Transform(const_cast<TUint8*>(aOutput.Ptr()) + outputLength, wholeBlocks);
			}
		
		TInt remainingBytes = inputLength + inputStoreLength - wholeBlocksSize;
		if (remainingBytes > 0)
			{		
			iInputStore.Append(aInput.Right(remainingBytes));
			}
		}
	}
		
void CSymmetricBlockCipherImpl::ProcessFinalL(const TDesC8& aInput, TDes8& aOutput)
	{
	if (iOperationMode.iUid == KOperationModeCTR)
		{
		ProcessL(aInput, aOutput);
		}
	else
		{
		// if we're running in CBC mode then we must have an IV set before we can 
		// do any processing ie call SetIvL() before this method
		if (iOperationMode.iUid == KOperationModeCBC)
			{
			if (iIv.MaxLength() == 0)
				{
				User::Leave(KErrNotSupported);
				}
			}

		if (iCryptoMode.iUid == KCryptoModeEncrypt)
			{
			return DoProcessFinalEncryptL(aInput, aOutput);
			}
		else
			{
			return DoProcessFinalDecryptL(aInput, aOutput);
			}
		}
	}

void CSymmetricBlockCipherImpl::DoProcessFinalEncryptL(const TDesC8& aInput, TDes8& aOutput)
	{	
	if (MaxFinalOutputLength(aInput.Length()) > aOutput.MaxLength() - aOutput.Length())
		{
		User::Leave(KErrOverflow);
		}
		
	// process everything up to the last (possibly empty block)
	TInt outputStartIndex = aOutput.Length();
	ProcessL(aInput, aOutput);

	// pad the plaintext
	iPadding->PadL(iInputStore, iPaddingBlock);
	
	// if padding required
	if (iPaddingBlock.Length() > 0)
		{
		iInputStore.Zero();

		// make sure the output is a multiple of the block size
		User::LeaveIfError(((aOutput.Length() - outputStartIndex + iPaddingBlock.Length()) % iBlockBytes) == 0 ? KErrNone : KErrInvalidPadding);

		outputStartIndex = aOutput.Length();
		aOutput.Append(iPaddingBlock);
		iPaddingBlock.Zero();
		TransformEncrypt(const_cast<TUint8*>(aOutput.Ptr()) + outputStartIndex, 1);		
		}
	}

void CSymmetricBlockCipherImpl::DoProcessFinalDecryptL(const TDesC8& aInput, TDes8& aOutput)
	{
	if (MaxFinalOutputLength(aInput.Length()) > aOutput.MaxLength() - aOutput.Length())
		{
		User::Leave(KErrOverflow);
		}

	// Input length (including inputstore) must be a multiple of the 
	// block size in length
	if ((aInput.Length() + iInputStore.Length()) & (iBlockBytes - 1)) 
		{
		User::Leave(KErrArgument);
		}

	if(aInput.Length() > iBlockBytes)
		{
		HBufC8* processBuf = HBufC8::NewLC(MaxFinalOutputLength(aInput.Length()));
		TPtr8 processPtr = processBuf->Des(); 
	
		ProcessL(aInput, processPtr);

		ASSERT(iInputStore.Length()==0); // all the blocks should have been decrypted
		
		// Unpad processPtr into aOutput
		iPadding->UnPadL(processPtr, aOutput);

		CleanupStack::PopAndDestroy(processBuf);
		}
	else 
		{
		// now contains the final ciphertext block
		iInputStore.Append(aInput);

		// Decrypt the last _padding_ blocksize into a new buffer
		TransformDecrypt(const_cast<TUint8*>(iInputStore.Ptr()), 1);
		
		// Unpad the last block and append to output
		iPadding->UnPadL(iInputStore, aOutput);
		}
			
	iPaddingBlock.Zero();
	iInputStore.Zero();
	}

	
/**
CTR mode behaves like a stream cipher, accepting input of any arbitrary length. This results 
in a significant body of code that behaves fundamentally differently to the ECB and CBC modes. 
ProcessCtrL() is called by ProcessL() when operating in CTR mode, wrapping up all this 
functionality into a separate method for clarity.

Encrypting zero-filled bytes will return the keystream since the output of Transformation is simply 
the input XORed with the keystream.
	
See: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
*/
void CSymmetricBlockCipherImpl::ProcessCtrL(const TDesC8& aInput, TDes8& aOutput)
	{
	TInt inputLength(aInput.Length());	

	TInt outputLength(aOutput.Length());
	TInt amountToXor = Min(iCtrUnusedKeystreamPtr.Length(), inputLength);

	// Try applying previously unused key stream bytes.
	if (amountToXor > 0)
		{
		aOutput.Append(aInput.Left(amountToXor));
		for (TInt i = 0; i < amountToXor; ++i)
			{
			aOutput[outputLength + i] ^= iCtrUnusedKeystreamPtr[i];
			}
		iCtrUnusedKeystreamPtr = iCtrUnusedKeystreamPtr.RightTPtr((iCtrUnusedKeystreamPtr.Length() - amountToXor));	
		}
		
	TInt amountToEncode = inputLength - amountToXor;
	
	if ((iCtrUnusedKeystreamPtr.Length() == 0) && (amountToEncode > 0))
		{
		// For each whole block's worth of input, transform it.
		TInt wholeBlocks = (amountToEncode) / iBlockBytes; 
		TInt wholeBlocksSize = wholeBlocks * iBlockBytes;		
		outputLength = aOutput.Length();
		
		if (wholeBlocks)
			{
			aOutput.Append(aInput.Mid(amountToXor, wholeBlocksSize));
			Transform(const_cast<TUint8*>(aOutput.Ptr()) + outputLength, wholeBlocks);
			}
			
		// CTR mode can handle arbitrary sized inputs. Here any remaining input data of less than the block size
		// is padded with zeros and then transformed. On return this padded section of the block will contain the next
		// sequence of keystream, which is copied to iCtrUnusedKeystream for use next time ProcessCtrL() is called.
		TInt remainingBytes = amountToEncode - wholeBlocksSize;
		iCtrUnusedKeystreamPtr = iCtrUnusedKeystream->Des();
		iCtrUnusedKeystreamPtr.SetMax();
		iCtrUnusedKeystreamPtr.FillZ();
		iCtrUnusedKeystreamPtr.Copy(aInput.Right(remainingBytes));
		iCtrUnusedKeystreamPtr.SetLength(iBlockBytes);	
	
		Transform(const_cast<TUint8*>(iCtrUnusedKeystreamPtr.Ptr()), 1);
	
		aOutput.Append(iCtrUnusedKeystreamPtr.Left(remainingBytes));
			
		iCtrUnusedKeystreamPtr = iCtrUnusedKeystreamPtr.RightTPtr((iCtrUnusedKeystreamPtr.Length() - remainingBytes));	
		}
	}



// Methods implemented in subclass. No coverage here.
#ifdef _BullseyeCoverage
#pragma suppress_warnings on
#pragma BullseyeCoverage off
#pragma suppress_warnings off
#endif
void CSymmetricStreamCipherImpl::SetOperationModeL(TUid /*aOperationMode*/)
	{
	// Override in subclass
	User::Leave(KErrNotSupported);
	}
	
void CSymmetricStreamCipherImpl::SetPaddingModeL(TUid /*aPaddingMode*/)
	{
	// Override in subclass
	User::Leave(KErrNotSupported);
	}
	
void CSymmetricStreamCipherImpl::SetIvL(const TDesC8& /*aIv*/)
	{
	// Override in subclass
	User::Leave(KErrNotSupported);
	}