/* BEGIN_HEADER */
#include <mbedtls/ssl.h>
#include <mbedtls/ssl_internal.h>

/*
 * Helper function setting up inverse record transformations
 * using given cipher, hash, EtM mode, authentication tag length,
 * and version.
 */

#define CHK( x )                                \
    do                                          \
    {                                           \
        if( !( x ) )                            \
        {                                       \
            ret = -1;                           \
            goto cleanup;                       \
        }                                       \
    } while( 0 )

#if MBEDTLS_SSL_CID_OUT_LEN_MAX > MBEDTLS_SSL_CID_IN_LEN_MAX
#define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_IN_LEN_MAX
#else
#define SSL_CID_LEN_MIN MBEDTLS_SSL_CID_OUT_LEN_MAX
#endif

static int build_transforms( mbedtls_ssl_transform *t_in,
                             mbedtls_ssl_transform *t_out,
                             int cipher_type, int hash_id,
                             int etm, int tag_mode, int ver,
                             size_t cid0_len,
                             size_t cid1_len )
{
    mbedtls_cipher_info_t const *cipher_info;
    int ret = 0;

    size_t keylen, maclen, ivlen;
    unsigned char *key0 = NULL, *key1 = NULL;
    unsigned char iv_enc[16], iv_dec[16];

#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    unsigned char cid0[ SSL_CID_LEN_MIN ];
    unsigned char cid1[ SSL_CID_LEN_MIN ];

    rnd_std_rand( NULL, cid0, sizeof( cid0 ) );
    rnd_std_rand( NULL, cid1, sizeof( cid1 ) );
#else
    ((void) cid0_len);
    ((void) cid1_len);
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */

    maclen = 0;

    /* Pick cipher */
    cipher_info = mbedtls_cipher_info_from_type( cipher_type );
    CHK( cipher_info != NULL );
    CHK( cipher_info->iv_size <= 16 );
    CHK( cipher_info->key_bitlen % 8 == 0 );

    /* Pick keys */
    keylen = cipher_info->key_bitlen / 8;
    /* Allocate `keylen + 1` bytes to ensure that we get
     * a non-NULL pointers from `mbedtls_calloc` even if
     * `keylen == 0` in the case of the NULL cipher. */
    CHK( ( key0 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL );
    CHK( ( key1 = mbedtls_calloc( 1, keylen + 1 ) ) != NULL );
    memset( key0, 0x1, keylen );
    memset( key1, 0x2, keylen );

    /* Setup cipher contexts */
    CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_enc,  cipher_info ) == 0 );
    CHK( mbedtls_cipher_setup( &t_in->cipher_ctx_dec,  cipher_info ) == 0 );
    CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_enc, cipher_info ) == 0 );
    CHK( mbedtls_cipher_setup( &t_out->cipher_ctx_dec, cipher_info ) == 0 );

#if defined(MBEDTLS_CIPHER_MODE_CBC)
    if( cipher_info->mode == MBEDTLS_MODE_CBC )
    {
        CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_enc,
                                              MBEDTLS_PADDING_NONE ) == 0 );
        CHK( mbedtls_cipher_set_padding_mode( &t_in->cipher_ctx_dec,
                                              MBEDTLS_PADDING_NONE ) == 0 );
        CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_enc,
                                              MBEDTLS_PADDING_NONE ) == 0 );
        CHK( mbedtls_cipher_set_padding_mode( &t_out->cipher_ctx_dec,
                                              MBEDTLS_PADDING_NONE ) == 0 );
    }
#endif /* MBEDTLS_CIPHER_MODE_CBC */

    CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_enc, key0,
                                keylen << 3, MBEDTLS_ENCRYPT ) == 0 );
    CHK( mbedtls_cipher_setkey( &t_in->cipher_ctx_dec, key1,
                                keylen << 3, MBEDTLS_DECRYPT ) == 0 );
    CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_enc, key1,
                                keylen << 3, MBEDTLS_ENCRYPT ) == 0 );
    CHK( mbedtls_cipher_setkey( &t_out->cipher_ctx_dec, key0,
                                keylen << 3, MBEDTLS_DECRYPT ) == 0 );

    /* Setup MAC contexts */
#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
    if( cipher_info->mode == MBEDTLS_MODE_CBC ||
        cipher_info->mode == MBEDTLS_MODE_STREAM )
    {
        mbedtls_md_info_t const *md_info;
        unsigned char *md0, *md1;

        /* Pick hash */
        md_info = mbedtls_md_info_from_type( hash_id );
        CHK( md_info != NULL );

        /* Pick hash keys */
        maclen = mbedtls_md_get_size( md_info );
        CHK( ( md0 = mbedtls_calloc( 1, maclen ) ) != NULL );
        CHK( ( md1 = mbedtls_calloc( 1, maclen ) ) != NULL );
        memset( md0, 0x5, maclen );
        memset( md1, 0x6, maclen );

        CHK( mbedtls_md_setup( &t_out->md_ctx_enc, md_info, 1 ) == 0 );
        CHK( mbedtls_md_setup( &t_out->md_ctx_dec, md_info, 1 ) == 0 );
        CHK( mbedtls_md_setup( &t_in->md_ctx_enc,  md_info, 1 ) == 0 );
        CHK( mbedtls_md_setup( &t_in->md_ctx_dec,  md_info, 1 ) == 0 );

        if( ver > MBEDTLS_SSL_MINOR_VERSION_0 )
        {
            CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_enc,
                                         md0, maclen ) == 0 );
            CHK( mbedtls_md_hmac_starts( &t_in->md_ctx_dec,
                                         md1, maclen ) == 0 );
            CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_enc,
                                         md1, maclen ) == 0 );
            CHK( mbedtls_md_hmac_starts( &t_out->md_ctx_dec,
                                         md0, maclen ) == 0 );
        }
#if defined(MBEDTLS_SSL_PROTO_SSL3)
        else
        {
            memcpy( &t_in->mac_enc, md0, maclen );
            memcpy( &t_in->mac_dec, md1, maclen );
            memcpy( &t_out->mac_enc, md1, maclen );
            memcpy( &t_out->mac_dec, md0, maclen );
        }
#endif

        mbedtls_free( md0 );
        mbedtls_free( md1 );
    }
#else
    ((void) hash_id);
#endif /* MBEDTLS_SSL_SOME_MODES_USE_MAC */


    /* Pick IV's (regardless of whether they
     * are being used by the transform). */
    ivlen = cipher_info->iv_size;
    memset( iv_enc, 0x3, sizeof( iv_enc ) );
    memset( iv_dec, 0x4, sizeof( iv_dec ) );

    /*
     * Setup transforms
     */

#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
    defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
    t_out->encrypt_then_mac = etm;
    t_in->encrypt_then_mac = etm;
#else
    ((void) etm);
#endif

    t_out->minor_ver = ver;
    t_in->minor_ver = ver;
    t_out->ivlen = ivlen;
    t_in->ivlen = ivlen;

    switch( cipher_info->mode )
    {
        case MBEDTLS_MODE_GCM:
        case MBEDTLS_MODE_CCM:
            t_out->fixed_ivlen = 4;
            t_in->fixed_ivlen = 4;
            t_out->maclen = 0;
            t_in->maclen = 0;
            switch( tag_mode )
            {
                case 0: /* Full tag */
                    t_out->taglen = 16;
                    t_in->taglen = 16;
                    break;
                case 1: /* Partial tag */
                    t_out->taglen = 8;
                    t_in->taglen = 8;
                    break;
                default:
                    return( 1 );
            }
            break;

        case MBEDTLS_MODE_CHACHAPOLY:
            t_out->fixed_ivlen = 12;
            t_in->fixed_ivlen = 12;
            t_out->maclen = 0;
            t_in->maclen = 0;
            switch( tag_mode )
            {
                case 0: /* Full tag */
                    t_out->taglen = 16;
                    t_in->taglen = 16;
                    break;
                case 1: /* Partial tag */
                    t_out->taglen = 8;
                    t_in->taglen = 8;
                    break;
                default:
                    return( 1 );
            }
            break;

        case MBEDTLS_MODE_STREAM:
        case MBEDTLS_MODE_CBC:
            t_out->fixed_ivlen = 0; /* redundant, must be 0 */
            t_in->fixed_ivlen = 0;  /* redundant, must be 0 */
            t_out->taglen = 0;
            t_in->taglen = 0;
            switch( tag_mode )
            {
                case 0: /* Full tag */
                    t_out->maclen = maclen;
                    t_in->maclen = maclen;
                    break;
                case 1: /* Partial tag */
                    t_out->maclen = 10;
                    t_in->maclen = 10;
                    break;
                default:
                    return( 1 );
            }
            break;
        default:
            return( 1 );
            break;
    }

    /* Setup IV's */

    memcpy( &t_in->iv_dec, iv_dec, sizeof( iv_dec ) );
    memcpy( &t_in->iv_enc, iv_enc, sizeof( iv_enc ) );
    memcpy( &t_out->iv_dec, iv_enc, sizeof( iv_enc ) );
    memcpy( &t_out->iv_enc, iv_dec, sizeof( iv_dec ) );

#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
    /* Add CID */
    memcpy( &t_in->in_cid,  cid0, cid0_len );
    memcpy( &t_in->out_cid, cid1, cid1_len );
    t_in->in_cid_len = cid0_len;
    t_in->out_cid_len = cid1_len;
    memcpy( &t_out->in_cid,  cid1, cid1_len );
    memcpy( &t_out->out_cid, cid0, cid0_len );
    t_out->in_cid_len = cid1_len;
    t_out->out_cid_len = cid0_len;
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */

cleanup:

    mbedtls_free( key0 );
    mbedtls_free( key1 );

    return( ret );
}

/*
 * Populate a session structure for serialization tests.
 * Choose dummy values, mostly non-0 to distinguish from the init default.
 */
static int ssl_populate_session( mbedtls_ssl_session *session,
                                 int ticket_len,
                                 const char *crt_file )
{
#if defined(MBEDTLS_HAVE_TIME)
    session->start = mbedtls_time( NULL ) - 42;
#endif
    session->ciphersuite = 0xabcd;
    session->compression = 1;
    session->id_len = sizeof( session->id );
    memset( session->id, 66, session->id_len );
    memset( session->master, 17, sizeof( session->master ) );

#if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_FS_IO)
    if( strlen( crt_file ) != 0 )
    {
        mbedtls_x509_crt tmp_crt;
        int ret;

        mbedtls_x509_crt_init( &tmp_crt );
        ret = mbedtls_x509_crt_parse_file( &tmp_crt, crt_file );
        if( ret != 0 )
            return( ret );

#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
        /* Move temporary CRT. */
        session->peer_cert = mbedtls_calloc( 1, sizeof( *session->peer_cert ) );
        if( session->peer_cert == NULL )
            return( -1 );
        *session->peer_cert = tmp_crt;
        memset( &tmp_crt, 0, sizeof( tmp_crt ) );
#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
        /* Calculate digest of temporary CRT. */
        session->peer_cert_digest =
            mbedtls_calloc( 1, MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN );
        if( session->peer_cert_digest == NULL )
            return( -1 );
        ret = mbedtls_md( mbedtls_md_info_from_type(
                              MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE ),
                          tmp_crt.raw.p, tmp_crt.raw.len,
                          session->peer_cert_digest );
        if( ret != 0 )
            return( ret );
        session->peer_cert_digest_type =
            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_TYPE;
        session->peer_cert_digest_len =
            MBEDTLS_SSL_PEER_CERT_DIGEST_DFL_LEN;
#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */

        mbedtls_x509_crt_free( &tmp_crt );
    }
#else /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO */
    (void) crt_file;
#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_FS_IO */
    session->verify_result = 0xdeadbeef;

#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
    if( ticket_len != 0 )
    {
        session->ticket = mbedtls_calloc( 1, ticket_len );
        if( session->ticket == NULL )
            return( -1 );
        memset( session->ticket, 33, ticket_len );
    }
    session->ticket_len = ticket_len;
    session->ticket_lifetime = 86401;
#else
    (void) ticket_len;
#endif

#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
    session->mfl_code = 1;
#endif
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
    session->trunc_hmac = 1;
#endif
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
    session->encrypt_then_mac = 1;
#endif

    return( 0 );
}

/* END_HEADER */

/* BEGIN_DEPENDENCIES
 * depends_on:MBEDTLS_SSL_TLS_C
 * END_DEPENDENCIES
 */

/* BEGIN_CASE depends_on:MBEDTLS_SSL_DTLS_ANTI_REPLAY */
void ssl_dtls_replay( data_t * prevs, data_t * new, int ret )
{
    uint32_t len = 0;
    mbedtls_ssl_context ssl;
    mbedtls_ssl_config conf;

    mbedtls_ssl_init( &ssl );
    mbedtls_ssl_config_init( &conf );

    TEST_ASSERT( mbedtls_ssl_config_defaults( &conf,
                 MBEDTLS_SSL_IS_CLIENT,
                 MBEDTLS_SSL_TRANSPORT_DATAGRAM,
                 MBEDTLS_SSL_PRESET_DEFAULT ) == 0 );
    TEST_ASSERT( mbedtls_ssl_setup( &ssl, &conf ) == 0 );

    /* Read previous record numbers */
    for( len = 0; len < prevs->len; len += 6 )
    {
        memcpy( ssl.in_ctr + 2, prevs->x + len, 6 );
        mbedtls_ssl_dtls_replay_update( &ssl );
    }

    /* Check new number */
    memcpy( ssl.in_ctr + 2, new->x, 6 );
    TEST_ASSERT( mbedtls_ssl_dtls_replay_check( &ssl ) == ret );

    mbedtls_ssl_free( &ssl );
    mbedtls_ssl_config_free( &conf );
}
/* END_CASE */

/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
void ssl_set_hostname_twice( char *hostname0, char *hostname1 )
{
    mbedtls_ssl_context ssl;
    mbedtls_ssl_init( &ssl );

    TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname0 ) == 0 );
    TEST_ASSERT( mbedtls_ssl_set_hostname( &ssl, hostname1 ) == 0 );

    mbedtls_ssl_free( &ssl );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_crypt_record( int cipher_type, int hash_id,
                       int etm, int tag_mode, int ver,
                       int cid0_len, int cid1_len )
{
    /*
     * Test several record encryptions and decryptions
     * with plenty of space before and after the data
     * within the record buffer.
     */

    int ret;
    int num_records = 16;
    mbedtls_ssl_context ssl; /* ONLY for debugging */

    mbedtls_ssl_transform t0, t1;
    unsigned char *buf = NULL;
    size_t const buflen = 512;
    mbedtls_record rec, rec_backup;

    mbedtls_ssl_init( &ssl );
    mbedtls_ssl_transform_init( &t0 );
    mbedtls_ssl_transform_init( &t1 );
    TEST_ASSERT( build_transforms( &t0, &t1, cipher_type, hash_id,
                                   etm, tag_mode, ver,
                                   (size_t) cid0_len,
                                   (size_t) cid1_len ) == 0 );

    TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL );

    while( num_records-- > 0 )
    {
        mbedtls_ssl_transform *t_dec, *t_enc;
        /* Take turns in who's sending and who's receiving. */
        if( num_records % 3 == 0 )
        {
            t_dec = &t0;
            t_enc = &t1;
        }
        else
        {
            t_dec = &t1;
            t_enc = &t0;
        }

        /*
         * The record header affects the transformation in two ways:
         * 1) It determines the AEAD additional data
         * 2) The record counter sometimes determines the IV.
         *
         * Apart from that, the fields don't have influence.
         * In particular, it is currently not the responsibility
         * of ssl_encrypt/decrypt_buf to check if the transform
         * version matches the record version, or that the
         * type is sensible.
         */

        memset( rec.ctr, num_records, sizeof( rec.ctr ) );
        rec.type    = 42;
        rec.ver[0]  = num_records;
        rec.ver[1]  = num_records;
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
        rec.cid_len = 0;
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */

        rec.buf     = buf;
        rec.buf_len = buflen;
        rec.data_offset = 16;
        /* Make sure to vary the length to exercise different
         * paddings. */
        rec.data_len = 1 + num_records;

        memset( rec.buf + rec.data_offset, 42, rec.data_len );

        /* Make a copy for later comparison */
        rec_backup = rec;

        /* Encrypt record */
        ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec,
                                       rnd_std_rand, NULL );
        TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
        if( ret != 0 )
        {
            continue;
        }

        /* Decrypt record with t_dec */
        ret = mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec );
        TEST_ASSERT( ret == 0 );

        /* Compare results */
        TEST_ASSERT( rec.type == rec_backup.type );
        TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 );
        TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] );
        TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] );
        TEST_ASSERT( rec.data_len == rec_backup.data_len );
        TEST_ASSERT( rec.data_offset == rec_backup.data_offset );
        TEST_ASSERT( memcmp( rec.buf + rec.data_offset,
                             rec_backup.buf + rec_backup.data_offset,
                             rec.data_len ) == 0 );
    }

exit:

    /* Cleanup */
    mbedtls_ssl_free( &ssl );
    mbedtls_ssl_transform_free( &t0 );
    mbedtls_ssl_transform_free( &t1 );

    mbedtls_free( buf );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_crypt_record_small( int cipher_type, int hash_id,
                             int etm, int tag_mode, int ver,
                             int cid0_len, int cid1_len )
{
    /*
     * Test pairs of encryption and decryption with an increasing
     * amount of space in the record buffer - in more detail:
     * 1) Try to encrypt with 0, 1, 2, ... bytes available
     *    in front of the plaintext, and expect the encryption
     *    to succeed starting from some offset. Always keep
     *    enough space in the end of the buffer.
     * 2) Try to encrypt with 0, 1, 2, ... bytes available
     *    at the end of the plaintext, and expect the encryption
     *    to succeed starting from some offset. Always keep
     *    enough space at the beginning of the buffer.
     * 3) Try to encrypt with 0, 1, 2, ... bytes available
     *    both at the front and end of the plaintext,
     *    and expect the encryption to succeed starting from
     *    some offset.
     *
     * If encryption succeeds, check that decryption succeeds
     * and yields the original record.
     */

    mbedtls_ssl_context ssl; /* ONLY for debugging */

    mbedtls_ssl_transform t0, t1;
    unsigned char *buf = NULL;
    size_t const buflen = 256;
    mbedtls_record rec, rec_backup;

    int ret;
    int mode;              /* Mode 1, 2 or 3 as explained above     */
    size_t offset;         /* Available space at beginning/end/both */
    size_t threshold = 96; /* Maximum offset to test against        */

    size_t default_pre_padding  = 64;  /* Pre-padding to use in mode 2  */
    size_t default_post_padding = 128; /* Post-padding to use in mode 1 */

    int seen_success; /* Indicates if in the current mode we've
                       * already seen a successful test. */

    mbedtls_ssl_init( &ssl );
    mbedtls_ssl_transform_init( &t0 );
    mbedtls_ssl_transform_init( &t1 );
    TEST_ASSERT( build_transforms( &t0, &t1, cipher_type, hash_id,
                                   etm, tag_mode, ver,
                                   (size_t) cid0_len,
                                   (size_t) cid1_len ) == 0 );

    TEST_ASSERT( ( buf = mbedtls_calloc( 1, buflen ) ) != NULL );

    for( mode=1; mode <= 3; mode++ )
    {
        seen_success = 0;
        for( offset=0; offset <= threshold; offset++ )
        {
            mbedtls_ssl_transform *t_dec, *t_enc;
            t_dec = &t0;
            t_enc = &t1;

            memset( rec.ctr, offset, sizeof( rec.ctr ) );
            rec.type    = 42;
            rec.ver[0]  = offset;
            rec.ver[1]  = offset;
            rec.buf     = buf;
            rec.buf_len = buflen;
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
            rec.cid_len = 0;
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */

            switch( mode )
            {
                case 1: /* Space in the beginning */
                    rec.data_offset = offset;
                    rec.data_len = buflen - offset - default_post_padding;
                    break;

                case 2: /* Space in the end */
                    rec.data_offset = default_pre_padding;
                    rec.data_len = buflen - default_pre_padding - offset;
                    break;

                case 3: /* Space in the beginning and end */
                    rec.data_offset = offset;
                    rec.data_len = buflen - 2 * offset;
                    break;

                default:
                    TEST_ASSERT( 0 );
                    break;
            }

            memset( rec.buf + rec.data_offset, 42, rec.data_len );

            /* Make a copy for later comparison */
            rec_backup = rec;

            /* Encrypt record */
            ret = mbedtls_ssl_encrypt_buf( &ssl, t_enc, &rec, rnd_std_rand, NULL );

            if( ( mode == 1 || mode == 2 ) && seen_success )
            {
                TEST_ASSERT( ret == 0 );
            }
            else
            {
                TEST_ASSERT( ret == 0 || ret == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
                if( ret == 0 )
                    seen_success = 1;
            }

            if( ret != 0 )
                continue;

            /* Decrypt record with t_dec */
            TEST_ASSERT( mbedtls_ssl_decrypt_buf( &ssl, t_dec, &rec ) == 0 );

            /* Compare results */
            TEST_ASSERT( rec.type == rec_backup.type );
            TEST_ASSERT( memcmp( rec.ctr, rec_backup.ctr, 8 ) == 0 );
            TEST_ASSERT( rec.ver[0] == rec_backup.ver[0] );
            TEST_ASSERT( rec.ver[1] == rec_backup.ver[1] );
            TEST_ASSERT( rec.data_len == rec_backup.data_len );
            TEST_ASSERT( rec.data_offset == rec_backup.data_offset );
            TEST_ASSERT( memcmp( rec.buf + rec.data_offset,
                                 rec_backup.buf + rec_backup.data_offset,
                                 rec.data_len ) == 0 );
        }

        TEST_ASSERT( seen_success == 1 );
    }

exit:

    /* Cleanup */
    mbedtls_ssl_free( &ssl );
    mbedtls_ssl_transform_free( &t0 );
    mbedtls_ssl_transform_free( &t1 );

    mbedtls_free( buf );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_tls_prf( int type, data_t * secret, data_t * random,
                  char *label, data_t *result_hex_str, int exp_ret )
{
    unsigned char *output;

    output = mbedtls_calloc( 1, result_hex_str->len );
    if( output == NULL )
        goto exit;

#if defined(MBEDTLS_USE_PSA_CRYPTO)
    TEST_ASSERT( psa_crypto_init() == 0 );
#endif

    TEST_ASSERT( mbedtls_ssl_tls_prf( type, secret->x, secret->len,
                                      label, random->x, random->len,
                                      output, result_hex_str->len ) == exp_ret );

    if( exp_ret == 0 )
    {
        TEST_ASSERT( hexcmp( output, result_hex_str->x,
                     result_hex_str->len, result_hex_str->len ) == 0 );
    }
exit:

    mbedtls_free( output );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_serialize_session_save_load( int ticket_len, char *crt_file )
{
    mbedtls_ssl_session original, restored;
    unsigned char *buf = NULL;
    size_t len;

    /*
     * Test that a save-load pair is the identity
     */

    mbedtls_ssl_session_init( &original );
    mbedtls_ssl_session_init( &restored );

    /* Prepare a dummy session to work on */
    TEST_ASSERT( ssl_populate_session( &original, ticket_len, crt_file ) == 0 );

    /* Serialize it */
    TEST_ASSERT( mbedtls_ssl_session_save( &original, NULL, 0, &len )
                 == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
    TEST_ASSERT( ( buf = mbedtls_calloc( 1, len ) ) != NULL );
    TEST_ASSERT( mbedtls_ssl_session_save( &original, buf, len, &len )
                 == 0 );

    /* Restore session from serialized data */
    TEST_ASSERT( mbedtls_ssl_session_load( &restored, buf, len) == 0 );

    /*
     * Make sure both session structures are identical
     */
#if defined(MBEDTLS_HAVE_TIME)
    TEST_ASSERT( original.start == restored.start );
#endif
    TEST_ASSERT( original.ciphersuite == restored.ciphersuite );
    TEST_ASSERT( original.compression == restored.compression );
    TEST_ASSERT( original.id_len == restored.id_len );
    TEST_ASSERT( memcmp( original.id,
                         restored.id, sizeof( original.id ) ) == 0 );
    TEST_ASSERT( memcmp( original.master,
                         restored.master, sizeof( original.master ) ) == 0 );

#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
    TEST_ASSERT( ( original.peer_cert == NULL ) ==
                 ( restored.peer_cert == NULL ) );
    if( original.peer_cert != NULL )
    {
        TEST_ASSERT( original.peer_cert->raw.len ==
                     restored.peer_cert->raw.len );
        TEST_ASSERT( memcmp( original.peer_cert->raw.p,
                             restored.peer_cert->raw.p,
                             original.peer_cert->raw.len ) == 0 );
    }
#else /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
    TEST_ASSERT( original.peer_cert_digest_type ==
                 restored.peer_cert_digest_type );
    TEST_ASSERT( original.peer_cert_digest_len ==
                 restored.peer_cert_digest_len );
    TEST_ASSERT( ( original.peer_cert_digest == NULL ) ==
                 ( restored.peer_cert_digest == NULL ) );
    if( original.peer_cert_digest != NULL )
    {
        TEST_ASSERT( memcmp( original.peer_cert_digest,
                             restored.peer_cert_digest,
                             original.peer_cert_digest_len ) == 0 );
    }
#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
#endif /* MBEDTLS_X509_CRT_PARSE_C */
    TEST_ASSERT( original.verify_result == restored.verify_result );

#if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
    TEST_ASSERT( original.ticket_len == restored.ticket_len );
    if( original.ticket_len != 0 )
    {
        TEST_ASSERT( original.ticket != NULL );
        TEST_ASSERT( restored.ticket != NULL );
        TEST_ASSERT( memcmp( original.ticket,
                             restored.ticket, original.ticket_len ) == 0 );
    }
    TEST_ASSERT( original.ticket_lifetime == restored.ticket_lifetime );
#endif

#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
    TEST_ASSERT( original.mfl_code == restored.mfl_code );
#endif

#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
    TEST_ASSERT( original.trunc_hmac == restored.trunc_hmac );
#endif

#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
    TEST_ASSERT( original.encrypt_then_mac == restored.encrypt_then_mac );
#endif

exit:
    mbedtls_ssl_session_free( &original );
    mbedtls_ssl_session_free( &restored );
    mbedtls_free( buf );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_serialize_session_load_save( int ticket_len, char *crt_file )
{
    mbedtls_ssl_session session;
    unsigned char *buf1 = NULL, *buf2 = NULL;
    size_t len0, len1, len2;

    /*
     * Test that a load-save pair is the identity
     */

    mbedtls_ssl_session_init( &session );

    /* Prepare a dummy session to work on */
    TEST_ASSERT( ssl_populate_session( &session, ticket_len, crt_file ) == 0 );

    /* Get desired buffer size for serializing */
    TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &len0 )
                 == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );

    /* Allocate first buffer */
    buf1 = mbedtls_calloc( 1, len0 );
    TEST_ASSERT( buf1 != NULL );

    /* Serialize to buffer and free live session */
    TEST_ASSERT( mbedtls_ssl_session_save( &session, buf1, len0, &len1 )
                 == 0 );
    TEST_ASSERT( len0 == len1 );
    mbedtls_ssl_session_free( &session );

    /* Restore session from serialized data */
    TEST_ASSERT( mbedtls_ssl_session_load( &session, buf1, len1 ) == 0 );

    /* Allocate second buffer and serialize to it */
    buf2 = mbedtls_calloc( 1, len0 );
    TEST_ASSERT( buf2 != NULL );
    TEST_ASSERT( mbedtls_ssl_session_save( &session, buf2, len0, &len2 )
                 == 0 );

    /* Make sure both serialized versions are identical */
    TEST_ASSERT( len1 == len2 );
    TEST_ASSERT( memcmp( buf1, buf2, len1 ) == 0 );

exit:
    mbedtls_ssl_session_free( &session );
    mbedtls_free( buf1 );
    mbedtls_free( buf2 );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_serialize_session_save_buf_size( int ticket_len, char *crt_file )
{
    mbedtls_ssl_session session;
    unsigned char *buf = NULL;
    size_t good_len, bad_len, test_len;

    /*
     * Test that session_save() fails cleanly on small buffers
     */

    mbedtls_ssl_session_init( &session );

    /* Prepare dummy session and get serialized size */
    TEST_ASSERT( ssl_populate_session( &session, ticket_len, crt_file ) == 0 );
    TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len )
                 == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );

    /* Try all possible bad lengths */
    for( bad_len = 1; bad_len < good_len; bad_len++ )
    {
        /* Allocate exact size so that asan/valgrind can detect any overwrite */
        mbedtls_free( buf );
        TEST_ASSERT( ( buf = mbedtls_calloc( 1, bad_len ) ) != NULL );
        TEST_ASSERT( mbedtls_ssl_session_save( &session, buf, bad_len,
                                               &test_len )
                     == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
        TEST_ASSERT( test_len == good_len );
    }

exit:
    mbedtls_ssl_session_free( &session );
    mbedtls_free( buf );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_serialize_session_load_buf_size( int ticket_len, char *crt_file )
{
    mbedtls_ssl_session session;
    unsigned char *good_buf = NULL, *bad_buf = NULL;
    size_t good_len, bad_len;

    /*
     * Test that session_load() fails cleanly on small buffers
     */

    mbedtls_ssl_session_init( &session );

    /* Prepare serialized session data */
    TEST_ASSERT( ssl_populate_session( &session, ticket_len, crt_file ) == 0 );
    TEST_ASSERT( mbedtls_ssl_session_save( &session, NULL, 0, &good_len )
                 == MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
    TEST_ASSERT( ( good_buf = mbedtls_calloc( 1, good_len ) ) != NULL );
    TEST_ASSERT( mbedtls_ssl_session_save( &session, good_buf, good_len,
                                           &good_len ) == 0 );
    mbedtls_ssl_session_free( &session );

    /* Try all possible bad lengths */
    for( bad_len = 0; bad_len < good_len; bad_len++ )
    {
        /* Allocate exact size so that asan/valgrind can detect any overread */
        mbedtls_free( bad_buf );
        bad_buf = mbedtls_calloc( 1, bad_len ? bad_len : 1 );
        TEST_ASSERT( bad_buf != NULL );
        memcpy( bad_buf, good_buf, bad_len );

        TEST_ASSERT( mbedtls_ssl_session_load( &session, bad_buf, bad_len )
                     == MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
    }

exit:
    mbedtls_ssl_session_free( &session );
    mbedtls_free( good_buf );
    mbedtls_free( bad_buf );
}
/* END_CASE */

/* BEGIN_CASE */
void ssl_session_serialize_version_check( int corrupt_major,
                                          int corrupt_minor,
                                          int corrupt_patch,
                                          int corrupt_config )
{
    unsigned char serialized_session[ 2048 ];
    size_t serialized_session_len;
    unsigned cur_byte;
    mbedtls_ssl_session session;
    uint8_t should_corrupt_byte[] = { corrupt_major  == 1,
                                      corrupt_minor  == 1,
                                      corrupt_patch  == 1,
                                      corrupt_config == 1,
                                      corrupt_config == 1 };

    mbedtls_ssl_session_init( &session );

    /* Infer length of serialized session. */
    TEST_ASSERT( mbedtls_ssl_session_save( &session,
                                           serialized_session,
                                           sizeof( serialized_session ),
                                           &serialized_session_len ) == 0 );

    mbedtls_ssl_session_free( &session );

    /* Without any modification, we should be able to successfully
     * de-serialize the session - double-check that. */
    TEST_ASSERT( mbedtls_ssl_session_load( &session,
                                           serialized_session,
                                           serialized_session_len ) == 0 );
    mbedtls_ssl_session_free( &session );

    /* Go through the bytes in the serialized session header and
     * corrupt them bit-by-bit. */
    for( cur_byte = 0; cur_byte < sizeof( should_corrupt_byte ); cur_byte++ )
    {
        int cur_bit;
        unsigned char * const byte = &serialized_session[ cur_byte ];

        if( should_corrupt_byte[ cur_byte ] == 0 )
            continue;

        for( cur_bit = 0; cur_bit < CHAR_BIT; cur_bit++ )
        {
            unsigned char const corrupted_bit = 0x1u << cur_bit;
            /* Modify a single bit in the serialized session. */
            *byte ^= corrupted_bit;

            /* Attempt to deserialize */
            TEST_ASSERT( mbedtls_ssl_session_load( &session,
                                                   serialized_session,
                                                   serialized_session_len ) ==
                         MBEDTLS_ERR_SSL_VERSION_MISMATCH );

            /* Undo the change */
            *byte ^= corrupted_bit;
        }
    }

}
/* END_CASE */