// SPDX-License-Identifier: GPL-2.0-or-later

  /*  Diffie-Hellman Key Agreement Method [RFC2631]
   *
   * Copyright (c) 2016, Intel Corporation
   * Authors: Salvatore Benedetto <salvatore.benedetto@intel.com>

   */
  
  #include <linux/module.h>
  #include <crypto/internal/kpp.h>
  #include <crypto/kpp.h>
  #include <crypto/dh.h>

  #include <linux/fips.h>

  #include <linux/mpi.h>
  
  struct dh_ctx {

  	MPI p;	/* Value is guaranteed to be set. */
  	MPI q;	/* Value is optional. */
  	MPI g;	/* Value is guaranteed to be set. */
  	MPI xa;	/* Value is guaranteed to be set. */

  };

  static void dh_clear_ctx(struct dh_ctx *ctx)

  {
  	mpi_free(ctx->p);

  	mpi_free(ctx->q);

  	mpi_free(ctx->g);

  	mpi_free(ctx->xa);

  	memset(ctx, 0, sizeof(*ctx));

  }
  
  /*
   * If base is g we compute the public key
   *	ya = g^xa mod p; [RFC2631 sec 2.1.1]
   * else if base if the counterpart public key we compute the shared secret
   *	ZZ = yb^xa mod p; [RFC2631 sec 2.1.1]
   */
  static int _compute_val(const struct dh_ctx *ctx, MPI base, MPI val)
  {
  	/* val = base^xa mod p */
  	return mpi_powm(val, base, ctx->xa, ctx->p);
  }
  
  static inline struct dh_ctx *dh_get_ctx(struct crypto_kpp *tfm)
  {
  	return kpp_tfm_ctx(tfm);
  }
  
  static int dh_check_params_length(unsigned int p_len)
  {
  	return (p_len < 1536) ? -EINVAL : 0;
  }
  
  static int dh_set_params(struct dh_ctx *ctx, struct dh *params)
  {

  	if (dh_check_params_length(params->p_size << 3))
  		return -EINVAL;
  
  	ctx->p = mpi_read_raw_data(params->p, params->p_size);
  	if (!ctx->p)
  		return -EINVAL;

  	if (params->q && params->q_size) {
  		ctx->q = mpi_read_raw_data(params->q, params->q_size);
  		if (!ctx->q)
  			return -EINVAL;
  	}

  	ctx->g = mpi_read_raw_data(params->g, params->g_size);

  	if (!ctx->g)

  		return -EINVAL;

  
  	return 0;
  }

  static int dh_set_secret(struct crypto_kpp *tfm, const void *buf,
  			 unsigned int len)

  {
  	struct dh_ctx *ctx = dh_get_ctx(tfm);
  	struct dh params;

  	/* Free the old MPI key if any */

  	dh_clear_ctx(ctx);

  	if (crypto_dh_decode_key(buf, len, &params) < 0)

  		goto err_clear_ctx;

  
  	if (dh_set_params(ctx, &params) < 0)

  		goto err_clear_ctx;

  
  	ctx->xa = mpi_read_raw_data(params.key, params.key_size);

  	if (!ctx->xa)
  		goto err_clear_ctx;

  
  	return 0;

  
  err_clear_ctx:
  	dh_clear_ctx(ctx);
  	return -EINVAL;

  }

  /*
   * SP800-56A public key verification:
   *
   * * If Q is provided as part of the domain paramenters, a full validation
   *   according to SP800-56A section 5.6.2.3.1 is performed.
   *
   * * If Q is not provided, a partial validation according to SP800-56A section
   *   5.6.2.3.2 is performed.
   */
  static int dh_is_pubkey_valid(struct dh_ctx *ctx, MPI y)
  {
  	if (unlikely(!ctx->p))
  		return -EINVAL;
  
  	/*
  	 * Step 1: Verify that 2 <= y <= p - 2.
  	 *
  	 * The upper limit check is actually y < p instead of y < p - 1
  	 * as the mpi_sub_ui function is yet missing.
  	 */
  	if (mpi_cmp_ui(y, 1) < 1 || mpi_cmp(y, ctx->p) >= 0)
  		return -EINVAL;
  
  	/* Step 2: Verify that 1 = y^q mod p */
  	if (ctx->q) {
  		MPI val = mpi_alloc(0);
  		int ret;
  
  		if (!val)
  			return -ENOMEM;
  
  		ret = mpi_powm(val, y, ctx->q, ctx->p);
  
  		if (ret) {
  			mpi_free(val);
  			return ret;
  		}
  
  		ret = mpi_cmp_ui(val, 1);
  
  		mpi_free(val);
  
  		if (ret != 0)
  			return -EINVAL;
  	}
  
  	return 0;
  }

  static int dh_compute_value(struct kpp_request *req)
  {
  	struct crypto_kpp *tfm = crypto_kpp_reqtfm(req);
  	struct dh_ctx *ctx = dh_get_ctx(tfm);
  	MPI base, val = mpi_alloc(0);
  	int ret = 0;
  	int sign;
  
  	if (!val)
  		return -ENOMEM;
  
  	if (unlikely(!ctx->xa)) {
  		ret = -EINVAL;
  		goto err_free_val;
  	}
  
  	if (req->src) {
  		base = mpi_read_raw_from_sgl(req->src, req->src_len);
  		if (!base) {

  			ret = -EINVAL;

  			goto err_free_val;
  		}

  		ret = dh_is_pubkey_valid(ctx, base);
  		if (ret)

  			goto err_free_base;

  	} else {
  		base = ctx->g;
  	}
  
  	ret = _compute_val(ctx, base, val);
  	if (ret)
  		goto err_free_base;

  	if (fips_enabled) {
  		/* SP800-56A rev3 5.7.1.1 check: Validation of shared secret */
  		if (req->src) {
  			MPI pone;
  
  			/* z <= 1 */
  			if (mpi_cmp_ui(val, 1) < 1) {
  				ret = -EBADMSG;
  				goto err_free_base;
  			}
  
  			/* z == p - 1 */
  			pone = mpi_alloc(0);
  
  			if (!pone) {
  				ret = -ENOMEM;
  				goto err_free_base;
  			}
  
  			ret = mpi_sub_ui(pone, ctx->p, 1);
  			if (!ret && !mpi_cmp(pone, val))
  				ret = -EBADMSG;
  
  			mpi_free(pone);
  
  			if (ret)
  				goto err_free_base;
  
  		/* SP800-56A rev 3 5.6.2.1.3 key check */
  		} else {
  			if (dh_is_pubkey_valid(ctx, val)) {
  				ret = -EAGAIN;
  				goto err_free_val;
  			}

  		}

  	}

  	ret = mpi_write_to_sgl(val, req->dst, req->dst_len, &sign);

  	if (ret)
  		goto err_free_base;
  
  	if (sign < 0)
  		ret = -EBADMSG;
  err_free_base:
  	if (req->src)
  		mpi_free(base);
  err_free_val:
  	mpi_free(val);
  	return ret;
  }

  static unsigned int dh_max_size(struct crypto_kpp *tfm)

  {
  	struct dh_ctx *ctx = dh_get_ctx(tfm);
  
  	return mpi_get_size(ctx->p);
  }
  
  static void dh_exit_tfm(struct crypto_kpp *tfm)
  {
  	struct dh_ctx *ctx = dh_get_ctx(tfm);

  	dh_clear_ctx(ctx);

  }
  
  static struct kpp_alg dh = {
  	.set_secret = dh_set_secret,
  	.generate_public_key = dh_compute_value,
  	.compute_shared_secret = dh_compute_value,
  	.max_size = dh_max_size,
  	.exit = dh_exit_tfm,
  	.base = {
  		.cra_name = "dh",
  		.cra_driver_name = "dh-generic",
  		.cra_priority = 100,
  		.cra_module = THIS_MODULE,
  		.cra_ctxsize = sizeof(struct dh_ctx),
  	},
  };
  
  static int dh_init(void)
  {
  	return crypto_register_kpp(&dh);
  }
  
  static void dh_exit(void)
  {
  	crypto_unregister_kpp(&dh);
  }

  subsys_initcall(dh_init);

  module_exit(dh_exit);
  MODULE_ALIAS_CRYPTO("dh");
  MODULE_LICENSE("GPL");
  MODULE_DESCRIPTION("DH generic algorithm");