/**

 * This file is part of the CernVM File System.

 *

 * Provides a bit syntactic sugar around the hash algorithms.

 * In particular, hashes can easily be created by constructors.

 * Also, we have a little to-string-from-string conversion.

 *

 * The complexity is due to the need to avoid dynamically allocated memory

 * for the hashes.  Almost everything happens on the stack.

 */

#ifndef CVMFS_HASH_H_

#define CVMFS_HASH_H_

#include <stdint.h>

#include <cassert>

#include <cctype>

#include <cstdlib>

#include <cstring>

#include <string>

#include "logging.h"

#include "prng.h"

#include "smalloc.h"

#ifdef CVMFS_NAMESPACE_GUARD

namespace CVMFS_NAMESPACE_GUARD {

#endif

namespace shash {

/**

 * Don't change order!  The integer value of the enum constants is used

 * as file catalog flags and as flags in communication with the cache manager.

 * If algorithms are added, the protocol definition for external cache managers

 * needs to be updated, too.

 */

enum Algorithms {

  kMd5 = 0,

  kSha1,

  kRmd160,

  kShake128,  // with 160 output bits

  kAny,

};

/**

 * NOTE: when adding a suffix here, one must edit `cvmfs_swissknife scrub`

 *       accordingly, that checks for invalid hash suffixes

 */

const char kSuffixNone         = 0;

const char kSuffixCatalog      = 'C';

const char kSuffixHistory      = 'H';

const char kSuffixMicroCatalog = 'L';  // currently unused

const char kSuffixPartial      = 'P';

const char kSuffixTemporary    = 'T';

const char kSuffixCertificate  = 'X';

const char kSuffixMetainfo     = 'M';

/**

 * Corresponds to Algorithms.  "Any" is the maximum of all the other

 * digest sizes.

 * When the maximum digest size changes, the memory layout of DirectoryEntry and

 * PosixQuotaManager::LruCommand changes, too!

 */

const unsigned kDigestSizes[] =

  {16,  20,   20,     20,       20};

// Md5  Sha1  Rmd160  Shake128  Any

const unsigned kMaxDigestSize = 20;

/**

 * Hex representations of hashes with the same length need a suffix

 * to be distinguished from each other.  They should all have one but

 * for backwards compatibility MD5 and SHA-1 have none.  Initialized in hash.cc

 * like const char *kAlgorithmIds[] = {"", "", "-rmd160", ...

 */

extern const char *kAlgorithmIds[];

const unsigned kAlgorithmIdSizes[] =

  {0,   0,    7,       9,         0};

// Md5  Sha1  -rmd160  -shake128  Any

const unsigned kMaxAlgorithmIdentifierSize = 9;

/**

 * Corresponds to Algorithms.  There is no block size for Any.

 * Is an HMAC for SHAKE well-defined?

 */

const unsigned kBlockSizes[] =

  {64,  64,   64,     168};

// Md5  Sha1  Rmd160  Shake128

/**

 * Distinguishes between interpreting a string as hex hash and hashing over

 * the contents of a string.

 */

struct HexPtr {

  const std::string *str;

  bool IsValid() const;

};

struct AsciiPtr {

  const std::string *str;

};

typedef char Suffix;

/**

 * Holds a hash digest and provides from string / to string conversion and

 * comparison.  The kAny algorithm may not be used in functions!  The algorithm

 * has to be changed beforehand.

 * This class is not used directly, but used as base clase of Md5, Sha1, ...

 */

template<unsigned digest_size_, Algorithms algorithm_>

struct Digest {

  unsigned char digest[digest_size_];

  Algorithms    algorithm;

  Suffix        suffix;

  class Hex {

   public:

      digest_(*digest),

      hash_length_(2 * kDigestSizes[digest_.algorithm]),

      return (position < hash_length_)

        ? GetHashChar(position)

    }

   protected:

      const char digit = (position % 2 == 0)

        ? digest_.digest[position / 2] / 16

    }

    }

   private:

    const Digest<digest_size_, algorithm_>  &digest_;

    const unsigned int                       hash_length_;

    const unsigned int                       algo_id_length_;

  };

  }

  {

  {

        ((*str)[i] <= '9' ? (*str)[i] -'0' : (*str)[i] - 'a' + 10)*16 +

        ((*str)[i+1] <= '9' ? (*str)[i+1] - '0' : (*str)[i+1] - 'a' + 10);

    }

         const unsigned char *digest_buffer,

         const Suffix s = kSuffixNone) :

  {

  /**

   * Generates a purely random hash

   * Only used for testing purposes

   */

  /**

   * Generates a purely random hash

   * Only used for testing purposes

   *

   * @param seed  random number generator seed (for reproducability)

   */

  /**

   * Generates a purely random hash

   * Only used for testing purposes

   *

   * @param prng  random number generator object (for external reproducability)

   */

    }

  /**

   * Generates a hexified repesentation of the digest including the identifier

   * string for newly added hashes.

   *

   * @param with_suffix  append the hash suffix (C,H,X, ...) to the result

   * @return             a string representation of the digest

   */

    }

    }

  }

  /**

   * Generates a hexified repesentation of the digest including the identifier

   * string for newly added hashes.  Output is in the form of

   * 'openssl x509 fingerprint', e.g. 00:AA:BB:...-SHAKE128

   *

   * @param with_suffix  append the hash suffix (C,H,X, ...) to the result

   * @return             a string representation of the digest

   */

    const unsigned string_length =

      }

    }

    }

  }

  /**

   * Convenience method to generate a string representation of the digest.

   * See Digest<>::ToString() for details

   *

   * @return  a string representation including the hash suffix of the digest

   */

  }

  /**

   * Generate the standard relative path from the hexified digest to be used in

   * CAS areas or cache directories. Throughout the entire system we use one

   * directory level (first to hex digest characters) for namespace splitting.

   * Note: This method appends the internal hash suffix to the path.

   *

   * @return  a relative path representation of the digest including the suffix

   */

  }

  /**

   * The alternative path is used to symlink the root catalog from the webserver

   * root to the data directory.  This way, the data directory can be protected

   * while the root catalog remains accessible.

   */

  }

  /**

   * Produces a relative path representation of the digest without appending the

   * hash suffix. See Digest<>::MakePath() for more details.

   *

   * @return  a relative path representation of the digest without the suffix

   */

  }

  /**

   * Generates an arbitrary path representation of the digest. Both number of

   * directory levels and the hash-digits per level can be customized. Further-

   * more an arbitrary hash suffix can be provided.

   * Note: This method is mainly meant for internal usage but stays public for

   *       historical reasons.

   *

   * @param dir_levels        the number of namespace splitting directory levels

   * @param digits_per_level  each directory level's number of hex-digits

   * @param hash_suffix       the hash suffix character to be appended

   * @return                  a relative path representation of the digest

   */

                               const unsigned digits_per_level,

                               const Suffix   hash_suffix = kSuffixNone) const {

    // figure out how big the output string needs to be

    // build hexified hash and path delimiters

                && (i / digits_per_level <= dir_levels)) {

      }

    }

    // (optionally) add hash hint suffix

    }

  }

  }

  }

  }

    }

  }

    }

  }

};

  explicit Md5(const AsciiPtr ascii);

  Md5(const char *chars, const unsigned length);

  /**

   * An MD5 hash can be seen as two 64bit integers.

   */

  Md5(const uint64_t lo, const uint64_t hi);

  void ToIntPair(uint64_t *lo, uint64_t *hi) const;

};

struct Sha1 : public Digest<20, kSha1> { };

struct Rmd160 : public Digest<20, kRmd160> { };

/**

 * Any as such must not be used except for digest storage.

 * To do real work, the class has to be "blessed" to be a real hash by

 * setting the algorithm field accordingly.

 */

               const char       s = kSuffixNone) :

      const unsigned char *digest_buffer,

      const Suffix         suffix = kSuffixNone) :

               const HexPtr      hex,

               const char        suffix = kSuffixNone) :

  Md5 CastToMd5();

};

/**

 * Actual operations on digests, like "hash a file", "hash a buffer", or

 * iterative operations.

 */

unsigned GetContextSize(const Algorithms algorithm);

/**

 * Holds an OpenSSL context, only required for hash operations.  Allows to

 * deferr the storage allocation for the context to alloca.

 */

class ContextPtr {

 public:

  Algorithms  algorithm;

  void       *buffer;

  unsigned    size;

};

void Init(ContextPtr context);

void Update(const unsigned char *buffer, const unsigned buffer_size,

            ContextPtr context);

void Final(ContextPtr context, Any *any_digest);

bool HashFile(const std::string &filename, Any *any_digest);

bool HashFd(int fd, Any *any_digest);

void HashMem(const unsigned char *buffer, const unsigned buffer_size,

             Any *any_digest);

void HashString(const std::string &content, Any *any_digest);

void Hmac(const std::string &key,

          const unsigned char *buffer, const unsigned buffer_size,

          Any *any_digest);

                       Any *any_digest)

{

  Hmac(key,

       reinterpret_cast<const unsigned char *>(content.data()),

       content.size(),

/**

 * Only used for AWS4 signature.

 *

 * Adding SHA-256 to the standard hash infrastructure would generally bloat the

 * digets size to 32 bytes and require client data structure transformation

 * during hotpatch.

 */

std::string Hmac256(const std::string &key, const std::string &content,

                    bool raw_output = false);

std::string Sha256File(const std::string &filename);

std::string Sha256Mem(const unsigned char *buffer, const unsigned buffer_size);

std::string Sha256String(const std::string &content);

Algorithms ParseHashAlgorithm(const std::string &algorithm_option);

Any MkFromHexPtr(const HexPtr hex, const Suffix suffix = kSuffixNone);

Any MkFromSuffixedHexPtr(const HexPtr hex);

}  // namespace shash

#ifdef CVMFS_NAMESPACE_GUARD

}  // namespace CVMFS_NAMESPACE_GUARD

#endif

#endif  // CVMFS_HASH_H_