/** @file
 * Copyright (c) 2019, Arm Limited or its affiliates. All rights reserved.
 * SPDX-License-Identifier : Apache-2.0
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
**/

#include "pal_attestation_eat.h"

uint32_t  mandatory_claims = 0, mandaroty_sw_components = 0;
bool_t    sw_component_present = 0;

static int get_items_in_map(QCBORDecodeContext *decode_context,
                            struct items_to_get_t *item_list)
{
    int                     item_index;
    QCBORItem               item;
    struct items_to_get_t  *item_ptr = item_list;

    /* initialize the data type of all items in the list */
    while (item_ptr->label != 0)
    {
        item_ptr->item.uDataType = QCBOR_TYPE_NONE;
        item_ptr++;
    }

    QCBORDecode_GetNext(decode_context, &item);
    if (item.uDataType != QCBOR_TYPE_MAP)
    {
        return PAL_ATTEST_ERROR;
    }

    for (item_index = item.val.uCount; item_index != 0; item_index--)
    {
        if (QCBORDecode_GetNext(decode_context, &item) != QCBOR_SUCCESS)
        {
            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
        }
        if (item.uLabelType != QCBOR_TYPE_INT64)
        {
            continue;
        }

        item_ptr = item_list;
        while (item_ptr->label != 0)
        {
            if (item.label.int64 == item_ptr->label)
            {
                item_ptr->item = item;
            }
            item_ptr++;
        }
    }

    return PAL_ATTEST_SUCCESS;
}

static int get_item_in_map(QCBORDecodeContext *decode_context,
                           int32_t label,
                           QCBORItem *item)
{
    struct items_to_get_t   item_list[2];

    item_list[0].label = label;
    item_list[1].label = 0;

    if (get_items_in_map(decode_context, item_list))
    {
        return PAL_ATTEST_ERROR;
    }

    if (item_list[0].item.uDataType == QCBOR_TYPE_NONE)
    {
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
    }

    *item = item_list[0].item;

    return PAL_ATTEST_SUCCESS;
}

static int parse_unprotected_headers(QCBORDecodeContext *decode_context,
                                     struct useful_buf_c *child,
                                     bool *loop_back)
{
    struct items_to_get_t   item_list[3];

    item_list[0].label = COSE_HEADER_PARAM_KID;
    item_list[1].label = T_COSE_SHORT_CIRCUIT_LABEL;
    item_list[2].label = 0;
    *loop_back = false;

    if (get_items_in_map(decode_context, item_list))
    {
        return PAL_ATTEST_ERROR;
    }

    if (item_list[1].item.uDataType == QCBOR_TYPE_TRUE)
    {
        *loop_back = true;
    }

    if (item_list[0].item.uDataType != QCBOR_TYPE_BYTE_STRING)
    {
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
    }

    *child = item_list[0].item.val.string;

    return PAL_ATTEST_SUCCESS;
}

static int parse_protected_headers(struct useful_buf_c protected_headers,
                                   int32_t *alg_id)
{
    QCBORDecodeContext  decode_context;
    QCBORItem           item;

    QCBORDecode_Init(&decode_context, protected_headers, 0);

    if (get_item_in_map(&decode_context, COSE_HEADER_PARAM_ALG, &item))
    {
        return PAL_ATTEST_ERROR;
    }

    if (QCBORDecode_Finish(&decode_context))
    {
        return PAL_ATTEST_ERROR;
    }

    if ((item.uDataType != QCBOR_TYPE_INT64) || (item.val.int64 > INT32_MAX))
    {
        return PAL_ATTEST_ERROR;
    }

    *alg_id = (int32_t)item.val.int64;

    return PAL_ATTEST_SUCCESS;
}

/**
    @brief    - This API will verify the claims
    @param    - decode_context      : The buffer containing the challenge
                item                : context for decoding the data items
                completed_challenge : Buffer containing the challenge
    @return   - error status
**/
static int parse_claims(QCBORDecodeContext *decode_context, QCBORItem item,
                                   struct useful_buf_c completed_challenge)
{
    int i, count = 0;
    int status = PAL_ATTEST_SUCCESS;

    /* Parse each claim and validate their data type */
    while (status == PAL_ATTEST_SUCCESS)
    {
        status = QCBORDecode_GetNext(decode_context, &item);
        if (status != PAL_ATTEST_SUCCESS)
            break;

        mandatory_claims |= 1 << (EAT_CBOR_ARM_RANGE_BASE - item.label.int64);
        if (item.uLabelType == QCBOR_TYPE_INT64)
        {
            if (item.label.int64 == EAT_CBOR_ARM_LABEL_NONCE)
            {
                if (item.uDataType == QCBOR_TYPE_BYTE_STRING)
                {
                    /* Given challenge vs challenge in token */
                    if (UsefulBuf_Compare(item.val.string, completed_challenge))
                        return PAL_ATTEST_TOKEN_CHALLENGE_MISMATCH;
                }
                else
                    return PAL_ATTEST_TOKEN_NOT_SUPPORTED;
            }
            else if (item.label.int64 == EAT_CBOR_ARM_LABEL_BOOT_SEED ||
                     item.label.int64 == EAT_CBOR_ARM_LABEL_IMPLEMENTATION_ID ||
                     item.label.int64 == EAT_CBOR_ARM_LABEL_UEID)
            {
                if (item.uDataType != QCBOR_TYPE_BYTE_STRING)
                    return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
            }
            else if (item.label.int64 == EAT_CBOR_ARM_LABEL_ORIGINATION ||
                     item.label.int64 == EAT_CBOR_ARM_LABEL_PROFILE_DEFINITION ||
                     item.label.int64 == EAT_CBOR_ARM_LABEL_HW_VERSION)
            {
                if (item.uDataType != QCBOR_TYPE_TEXT_STRING)
                    return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
            }
            else if (item.label.int64 == EAT_CBOR_ARM_LABEL_CLIENT_ID ||
                     item.label.int64 == EAT_CBOR_ARM_LABEL_SECURITY_LIFECYCLE)
            {
                if (item.uDataType != QCBOR_TYPE_INT64)
                    return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
            }
            else if (item.label.int64 == EAT_CBOR_ARM_LABEL_SW_COMPONENTS)
            {
                if (item.uDataType != QCBOR_TYPE_ARRAY)
                    return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;

                sw_component_present = 1;
                status = QCBORDecode_GetNext(decode_context, &item);
                if (status != PAL_ATTEST_SUCCESS)
                    continue;

                count = item.val.uCount;
                for (i = 0; i <= count; i++)
                {
                    mandaroty_sw_components |= 1 << item.label.int64;

                    if (item.label.int64 == EAT_CBOR_SW_COMPONENT_MEASUREMENT)
                    {
                         if (item.uDataType != QCBOR_TYPE_BYTE_STRING)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }
                    else if (item.label.int64 == EAT_CBOR_SW_COMPONENT_MEASUREMENT_DESC)
                    {
                        if (item.uDataType != QCBOR_TYPE_TEXT_STRING)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }
                    else if (item.label.int64 == EAT_CBOR_SW_COMPONENT_VERSION)
                    {
                        if (item.uDataType != QCBOR_TYPE_TEXT_STRING)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }
                    else if (item.label.int64 == EAT_CBOR_SW_COMPONENT_SIGNER_ID)
                    {
                        if (item.uDataType != QCBOR_TYPE_BYTE_STRING)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }
                    else if (item.label.int64 == EAT_CBOR_SW_COMPONENT_EPOCH)
                    {
                        if (item.uDataType != QCBOR_TYPE_INT64)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }
                    else if (item.label.int64 == EAT_CBOR_SW_COMPONENT_TYPE)
                    {
                        if (item.uDataType != QCBOR_TYPE_TEXT_STRING)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }

                    if (i < count)
                    {
                        status = QCBORDecode_GetNext(decode_context, &item);
                        if (status != PAL_ATTEST_SUCCESS)
                            return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
                    }
                }

            }
        }
        else
        {
            /* ToDo: Add other claim types */
        }
    }

    if (status == QCBOR_ERR_HIT_END)
        return PAL_ATTEST_SUCCESS;
    else
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;
}

/**
    @brief    - This API will verify the attestation token
    @param    - challenge       : The buffer containing the challenge
                challenge_size  : Size of the challenge buffer
                token           : The buffer containing the attestation token
                token_size      : Size of the token buffer
    @return   - error status
**/
int32_t pal_initial_attest_verify_token(uint8_t *challenge, uint32_t challenge_size,
                                        uint8_t *token, uint32_t token_size)
{
    int                 status = PAL_ATTEST_SUCCESS;
    bool                short_circuit;
    int32_t             cose_algorithm_id;
    QCBORItem           item;
    QCBORDecodeContext  decode_context;
    struct useful_buf_c completed_challenge;
    struct useful_buf_c completed_token;
    struct useful_buf_c payload;
    struct useful_buf_c protected_headers;
    struct useful_buf_c kid;

    /* Construct the token buffer for validation */
    completed_token.ptr = token;
    completed_token.len = token_size;

    /* Construct the challenge buffer for validation */
    completed_challenge.ptr = challenge;
    completed_challenge.len = challenge_size;

/*
    -------------------------
    |  CBOR Array Type      |
    -------------------------
    |  Protected Headers    |
    -------------------------
    |  Unprotected Headers  |
    -------------------------
    |  Payload              |
    -------------------------
    |  Signature            |
    -------------------------
*/

    /* Initialize the decorder */
    QCBORDecode_Init(&decode_context, completed_token, QCBOR_DECODE_MODE_NORMAL);

    /* Get the Header */
    QCBORDecode_GetNext(&decode_context, &item);

    /* Check the CBOR Array type. Check if the count is 4.
     * Only COSE_SIGN1 is supported now.
     */
    if (item.uDataType != QCBOR_TYPE_ARRAY || item.val.uCount != 4 ||
       !QCBORDecode_IsTagged(&decode_context, &item, CBOR_TAG_COSE_SIGN1))
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;

    /* Get the next headers */
    QCBORDecode_GetNext(&decode_context, &item);
    if (item.uDataType != QCBOR_TYPE_BYTE_STRING)
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;

    protected_headers = item.val.string;

    /* Parse the protected headers and check the data type and value*/
    status = parse_protected_headers(protected_headers, &cose_algorithm_id);
    if (status != PAL_ATTEST_SUCCESS)
        return status;

    /* Parse the unprotected headers and check the data type and value */
    short_circuit = false;
    status = parse_unprotected_headers(&decode_context, &kid, &short_circuit);
    if (status != PAL_ATTEST_SUCCESS)
        return status;

    /* Get the payload */
    QCBORDecode_GetNext(&decode_context, &item);
    if (item.uDataType != QCBOR_TYPE_BYTE_STRING)
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;

    payload = item.val.string;

    /* Get the digital signature */
    QCBORDecode_GetNext(&decode_context, &item);
    if (item.uDataType != QCBOR_TYPE_BYTE_STRING)
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;

    /* Initialize the Decoder and validate the payload format */
    QCBORDecode_Init(&decode_context, payload, QCBOR_DECODE_MODE_NORMAL);
    status = QCBORDecode_GetNext(&decode_context, &item);
    if (status != PAL_ATTEST_SUCCESS)
        return status;

    if (item.uDataType != QCBOR_TYPE_MAP)
        return PAL_ATTEST_TOKEN_ERR_CBOR_FORMATTING;

    /* Parse the payload and check the data type of each claim */
    status = parse_claims(&decode_context, item, completed_challenge);
    if (status != PAL_ATTEST_SUCCESS)
        return status;

    if ((mandatory_claims & MANDATORY_CLAIM_WITH_SW_COMP) == MANDATORY_CLAIM_WITH_SW_COMP)
    {
        if ((mandaroty_sw_components & MANDATORY_SW_COMP) != MANDATORY_SW_COMP)
            return PAL_ATTEST_TOKEN_NOT_ALL_MANDATORY_CLAIMS;
    }
    else if ((mandatory_claims & MANDATORY_CLAIM_NO_SW_COMP) != MANDATORY_CLAIM_NO_SW_COMP)
    {
        return PAL_ATTEST_TOKEN_NOT_ALL_MANDATORY_CLAIMS;
    }

    return PAL_ATTEST_SUCCESS;
}