/* SPDX-License-Identifier: GPL-3.0-only */
#include "alloc.h"
#define MBEDTLS_SSL_IS_SERVER 1
#define MBEDTLS_SSL_IS_CLIENT 0
#define MBEDTLS_SSL_TRANSPORT_STREAM 0
#define MBEDTLS_SSL_PRESET_DEFAULT 0
#define MBEDTLS_SSL_VERIFY_NONE 0
#define MBEDTLS_SSL_VERIFY_REQUIRED 2
#define MBEDTLS_SSL_VERSION_TLS1_2 0x303
#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0
#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xc02b
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xc02c
#define ESP_ERR_MBEDTLS_SSL_CONFIG_DEFAULTS_FAILED -11
#define ESP_ERR_MBEDTLS_SSL_SET_HOSTNAME_FAILED -12
#define ESP_ERR_MBEDTLS_SSL_SETUP_FAILED -13
#define ESP_INT_EVENT_TRACKER_CAPTURE(...) ((void)0)
/* TLS_GUARDS */
typedef int mbedtls_x509_crt;
typedef int mbedtls_pk_context;
typedef struct {
    const int *suites;
    int endpoint, min, max, reneg, policy_calls;
    void *userdata;
} mbedtls_ssl_config;
typedef struct {
    mbedtls_ssl_config conf;
    int ssl, servercert, serverkey, clientcert, clientkey, error_handle;
    void *cacert_ptr;
} esp_tls_t;
typedef struct {
    void *userdata; const char **alpn_protos;
    bool use_secure_element, use_ecdsa_peripheral;
    const unsigned char *cacert_buf, *servercert_buf, *serverkey_buf, *serverkey_password;
    unsigned cacert_bytes, servercert_bytes, serverkey_bytes, serverkey_password_len;
} esp_tls_cfg_server_t;
typedef struct {
    bool skip_common_name, use_global_ca_store, use_secure_element, use_ecdsa_peripheral;
    const char *common_name; const char **alpn_protos;
    void *crt_bundle_attach, *ds_data;
    const unsigned char *cacert_buf, *clientcert_buf, *clientkey_buf, *clientkey_password;
    const unsigned char *clientcert_pem_buf, *clientkey_pem_buf;
    unsigned cacert_bytes, clientcert_bytes, clientkey_bytes, clientkey_password_len;
    const int *ciphersuites_list;
} esp_tls_cfg_t;
/* SDK_PKI */
static int defaults_fail, pki_fail;
static const int default_suites[] = {123, 456, 0};
static int mbedtls_ssl_config_defaults(mbedtls_ssl_config *c, int endpoint, int transport, int preset) {
    if (defaults_fail) return -1;
    *c = (mbedtls_ssl_config){.suites=default_suites, .endpoint=endpoint,
                            .min=11, .max=22, .reneg=1};
    return 0;
}
static void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *c, const int *list) { c->suites=list; ++c->policy_calls; }
static void mbedtls_ssl_conf_min_tls_version(mbedtls_ssl_config *c, int v) { c->min=v; }
static void mbedtls_ssl_conf_max_tls_version(mbedtls_ssl_config *c, int v) { c->max=v; }
static void mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config *c, int v) { c->reneg=v; }
static void mbedtls_ssl_conf_set_user_data_p(mbedtls_ssl_config *c, void *p) { c->userdata=p; }
static void mbedtls_ssl_conf_authmode(mbedtls_ssl_config *c, int mode) {}
static void mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config *c, void *p, void *q) {}
static int mbedtls_ssl_set_hostname(void *ssl, const char *host) { return 0; }
static void mbedtls_print_error_msg(int e) {}
static int set_ca_cert(esp_tls_t *tls, const unsigned char *cert, size_t n) { return 0; }
static int set_global_ca_store(esp_tls_t *tls) { return 0; }
static void check_policy(mbedtls_ssl_config *c) {
    assert(c->endpoint == MBEDTLS_SSL_IS_SERVER && c->policy_calls == 1);
    assert(c->suites[0] == 0xc02b && c->suites[1] == 0xc02c && c->suites[2] == 0);
    assert(c->min == 0x303 && c->max == 0x303);
#ifdef MBEDTLS_SSL_RENEGOTIATION
    assert(c->reneg == 0);
#endif
}
static int set_pki_context(esp_tls_t *tls, esp_tls_pki_t *pki) {
    if (tls->conf.endpoint == MBEDTLS_SSL_IS_SERVER) check_policy(&tls->conf);
    return pki_fail ? -1 : 0;
}
/* SDK_FUNCTIONS */
int main(void) {
    static const unsigned char cert[] = {1}, key[] = {2};
    esp_tls_cfg_server_t cfg = {.servercert_buf=cert, .serverkey_buf=key, .userdata=&cfg};
    esp_tls_t server = {0}, second = {0}, client = {0};
    defaults_fail = 1;
    assert(set_server_config(&cfg, &server) == ESP_ERR_MBEDTLS_SSL_CONFIG_DEFAULTS_FAILED);
    assert(!server.conf.policy_calls && !server.conf.suites);
    defaults_fail = 0;
    assert(set_server_config(&cfg, &server) == 0); check_policy(&server.conf);
    assert(server.conf.userdata == &cfg);
    assert(set_server_config(&cfg, &second) == 0); check_policy(&second.conf);
    assert(server.conf.suites == second.conf.suites); /* retained static lifetime */
    esp_tls_cfg_t ccfg = {.skip_common_name=true, .use_global_ca_store=true};
    assert(set_client_config("host", 4, &ccfg, &client) == 0);
    assert(client.conf.suites == default_suites && !client.conf.policy_calls);
    assert(client.conf.min == 11 && client.conf.max == 22 && client.conf.reneg == 1);
    static const int custom[] = {999, 0}; ccfg.ciphersuites_list = custom;
    assert(set_client_config("host", 4, &ccfg, &client) == 0);
    assert(client.conf.suites == custom && client.conf.policy_calls == 1);
    check_policy(&server.conf);
    pki_fail = 1;
    assert(set_server_config(&cfg, &second) != 0); check_policy(&second.conf);
    pki_fail = 0; cfg.serverkey_buf = NULL;
    assert(set_server_config(&cfg, &second) == ESP_ERR_INVALID_STATE);
    assert(!live);
    puts("TLS server-only allowlist/version/renegotiation/config-failure/client isolation PASS");
}