//! Encryption schemes supported by Discord's secure RTP negotiation.
use super::tasks::error::Error as InternalError;
use aead::AeadCore;
use aes_gcm::{AeadInPlace, Aes256Gcm, KeyInit};
use byteorder::{NetworkEndian, WriteBytesExt};
use chacha20poly1305::XChaCha20Poly1305;
use crypto_secretbox::{cipher::InvalidLength, Error as CryptoError, XSalsa20Poly1305};
#[cfg(feature = "receive")]
use discortp::rtcp::MutableRtcpPacket;
use discortp::{rtp::RtpPacket, MutablePacket};
#[cfg(any(feature = "receive", test))]
use discortp::{
    rtp::{MutableRtpPacket, RtpExtensionPacket},
    Packet,
};
use rand::Rng;
use std::{num::Wrapping, str::FromStr};
use typenum::Unsigned;

use crate::error::ConnectionError;

/// Variants of the `XSalsa20Poly1305` encryption scheme.
#[derive(Clone, Copy, Debug, Eq, PartialEq, Default, Hash)]
#[non_exhaustive]
pub enum CryptoMode {
    #[default]
    /// Discord's currently preferred non-E2EE encryption scheme.
    ///
    /// Packets are encrypted and decrypted using the `AES256GCM` encryption scheme.
    /// An additional random 4B suffix is used as the source of nonce bytes for the packet.
    /// This nonce value increments by `1` with each packet.
    ///
    /// Encrypted content begins *after* the RTP header and extensions, following the SRTP
    /// specification.
    ///
    /// Nonce width of 4B (32b), at an extra 4B per packet (~0.2 kB/s).
    Aes256Gcm,
    /// A fallback non-E2EE encryption scheme.
    ///
    /// Packets are encrypted and decrypted using the `XChaCha20Poly1305` encryption scheme.
    /// An additional random 4B suffix is used as the source of nonce bytes for the packet.
    /// This nonce value increments by `1` with each packet.
    ///
    /// Encrypted content begins *after* the RTP header and extensions, following the SRTP
    /// specification.
    ///
    /// Nonce width of 4B (32b), at an extra 4B per packet (~0.2 kB/s).
    XChaCha20Poly1305,
    #[deprecated(
        since = "0.4.4",
        note = "This voice encryption mode will no longer be accepted by Discord\
                as of 2024-11-18. This variant will be removed in `v0.5`."
    )]
    /// The RTP header is used as the source of nonce bytes for the packet.
    ///
    /// Equivalent to a nonce of at most 48b (6B) at no extra packet overhead:
    /// the RTP sequence number and timestamp are the varying quantities.
    Normal,
    #[deprecated(
        since = "0.4.4",
        note = "This voice encryption mode will no longer be accepted by Discord\
                as of 2024-11-18. This variant will be removed in `v0.5`."
    )]
    /// An additional random 24B suffix is used as the source of nonce bytes for the packet.
    /// This is regenerated randomly for each packet.
    ///
    /// Full nonce width of 24B (192b), at an extra 24B per packet (~1.2 kB/s).
    Suffix,
    #[deprecated(
        since = "0.4.4",
        note = "This voice encryption mode will no longer be accepted by Discord\
                as of 2024-11-18. This variant will be removed in `v0.5`."
    )]
    /// An additional random 4B suffix is used as the source of nonce bytes for the packet.
    /// This nonce value increments by `1` with each packet.
    ///
    /// Nonce width of 4B (32b), at an extra 4B per packet (~0.2 kB/s).
    Lite,
}

#[allow(deprecated)]
impl From<CryptoState> for CryptoMode {
    fn from(val: CryptoState) -> Self {
        match val {
            CryptoState::Normal => Self::Normal,
            CryptoState::Suffix => Self::Suffix,
            CryptoState::Lite(_) => Self::Lite,
            CryptoState::Aes256Gcm(_) => Self::Aes256Gcm,
            CryptoState::XChaCha20Poly1305(_) => Self::XChaCha20Poly1305,
        }
    }
}

/// The input string could not be parsed as an encryption scheme supported by songbird.
#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
pub struct UnrecognisedCryptoMode;

impl FromStr for CryptoMode {
    type Err = UnrecognisedCryptoMode;

    #[allow(deprecated)]
    fn from_str(s: &str) -> Result<Self, Self::Err> {
        match s {
            "aead_aes256_gcm_rtpsize" => Ok(Self::Aes256Gcm),
            "aead_xchacha20_poly1305_rtpsize" => Ok(Self::XChaCha20Poly1305),
            "xsalsa20_poly1305" => Ok(Self::Normal),
            "xsalsa20_poly1305_suffix" => Ok(Self::Suffix),
            "xsalsa20_poly1305_lite" => Ok(Self::Lite),
            _ => Err(UnrecognisedCryptoMode),
        }
    }
}

#[allow(deprecated)]
impl CryptoMode {
    /// Returns the underlying crypto algorithm used by a given [`CryptoMode`].
    #[must_use]
    pub(crate) const fn algorithm(self) -> EncryptionAlgorithm {
        match self {
            CryptoMode::Aes256Gcm => EncryptionAlgorithm::Aes256Gcm,
            CryptoMode::XChaCha20Poly1305 => EncryptionAlgorithm::XChaCha20Poly1305,
            CryptoMode::Normal | CryptoMode::Suffix | CryptoMode::Lite =>
                EncryptionAlgorithm::XSalsa20Poly1305,
        }
    }

    /// Returns whether this [`CryptoMode`] dynamically sizes the ciphertext region
    /// to begin in the middle of RTP extensions.
    ///
    /// Compliant SRTP would leave all extensions in cleartext, hence 'more' SRTP
    /// compliant.
    #[must_use]
    #[cfg(any(feature = "receive", test))]
    pub(crate) const fn is_more_srtp_compliant(self) -> bool {
        match self {
            CryptoMode::Aes256Gcm | CryptoMode::XChaCha20Poly1305 => true,
            CryptoMode::Normal | CryptoMode::Suffix | CryptoMode::Lite => false,
        }
    }

    /// Returns an encryption cipher based on the supplied key.
    ///
    /// Creation fails if the key is the incorrect length for the target cipher.
    pub(crate) fn cipher_from_key(self, key: &[u8]) -> Result<Cipher, InvalidLength> {
        match self.algorithm() {
            EncryptionAlgorithm::Aes256Gcm => Aes256Gcm::new_from_slice(key)
                .map(Box::new)
                .map(Cipher::Aes256Gcm),
            EncryptionAlgorithm::XChaCha20Poly1305 =>
                XChaCha20Poly1305::new_from_slice(key).map(Cipher::XChaCha20Poly1305),
            EncryptionAlgorithm::XSalsa20Poly1305 =>
                XSalsa20Poly1305::new_from_slice(key).map(|v| Cipher::XSalsa20Poly1305(v, self)),
        }
    }

    /// Returns a local priority score for a given [`CryptoMode`].
    ///
    /// Higher values are preferred.
    #[must_use]
    pub(crate) fn priority(self) -> u64 {
        match self {
            CryptoMode::Aes256Gcm => 4,
            CryptoMode::XChaCha20Poly1305 => 3,
            CryptoMode::Normal => 2,
            CryptoMode::Suffix => 1,
            CryptoMode::Lite => 0,
        }
    }

    /// Returns the best available crypto mode, given the `modes` offered by the Discord voice server.
    ///
    /// If `preferred` is set and the mode exists in the server's supported algorithms, then that
    /// mode will be chosen. Otherwise we select the highest-scoring option which is mutually understood.
    pub(crate) fn negotiate<It, T>(
        modes: It,
        preferred: Option<Self>,
    ) -> Result<Self, ConnectionError>
    where
        T: AsRef<str>,
        It: IntoIterator<Item = T>,
    {
        let mut best = None;
        for el in modes {
            let Ok(el) = CryptoMode::from_str(el.as_ref()) else {
                // Unsupported mode. Ignore.
                continue;
            };

            let mut el_priority = el.priority();
            if let Some(preferred) = preferred {
                if el == preferred {
                    el_priority = u64::MAX;
                }
            }

            let accept = match best {
                None => true,
                Some((_, score)) if el_priority > score => true,
                _ => false,
            };

            if accept {
                best = Some((el, el_priority));
            }
        }

        best.map(|(v, _)| v)
            .ok_or(ConnectionError::CryptoModeUnavailable)
    }

    /// Returns the name of a mode as it will appear during negotiation.
    #[must_use]
    pub const fn to_request_str(self) -> &'static str {
        match self {
            Self::Normal => "xsalsa20_poly1305",
            Self::Suffix => "xsalsa20_poly1305_suffix",
            Self::Lite => "xsalsa20_poly1305_lite",
            Self::Aes256Gcm => "aead_aes256_gcm_rtpsize",
            Self::XChaCha20Poly1305 => "aead_xchacha20_poly1305_rtpsize",
        }
    }

    /// Returns the nonce length in bytes required by algorithm.
    #[must_use]
    pub const fn algorithm_nonce_size(self) -> usize {
        use typenum::Unsigned as _;
        match self {
            Self::Lite | Self::Normal | Self::Suffix => XSalsa20Poly1305::NONCE_SIZE,
            Self::XChaCha20Poly1305 => <XChaCha20Poly1305 as AeadCore>::NonceSize::USIZE, // => 24
            Self::Aes256Gcm => <Aes256Gcm as AeadCore>::NonceSize::USIZE,                 // => 12
        }
    }

    /// Returns the number of bytes each nonce is stored as within
    /// a packet.
    #[must_use]
    pub const fn nonce_size(self) -> usize {
        match self {
            Self::Aes256Gcm | Self::XChaCha20Poly1305 | Self::Lite => 4,
            Self::Normal => RtpPacket::minimum_packet_size(),
            Self::Suffix => XSalsa20Poly1305::NONCE_SIZE,
        }
    }

    /// Returns the number of bytes occupied by the XSalsa20Poly1305
    /// encryption schemes which fall before the payload.
    #[must_use]
    #[deprecated(
        since = "0.4.4",
        note = "This method returns the fixed payload prefix for older encryption modes,\
                which will no longer be accepted by Discord as of 2024-11-18. It is an\
                implementation detail and will be removed in `v0.5`."
    )]
    pub fn payload_prefix_len() -> usize {
        XSalsa20Poly1305::TAG_SIZE
    }

    /// Returns the number of bytes occupied by the encryption scheme
    /// which fall before the payload.
    ///
    /// Method name duplicated until v0.5, to prevent breaking change.
    #[must_use]
    pub(crate) const fn payload_prefix_len2(self) -> usize {
        match self {
            CryptoMode::Aes256Gcm | CryptoMode::XChaCha20Poly1305 => 0,
            CryptoMode::Normal | CryptoMode::Suffix | CryptoMode::Lite =>
                XSalsa20Poly1305::TAG_SIZE,
        }
    }

    /// Returns the tag length in bytes.
    #[must_use]
    pub(crate) const fn encryption_tag_len(self) -> usize {
        self.algorithm().encryption_tag_len()
    }

    /// Returns the number of bytes occupied by the encryption scheme
    /// which fall after the payload.
    #[must_use]
    pub const fn payload_suffix_len(self) -> usize {
        match self {
            Self::Normal => 0,
            Self::Suffix | Self::Lite => self.nonce_size(),
            Self::Aes256Gcm | Self::XChaCha20Poly1305 =>
                self.nonce_size() + self.encryption_tag_len(),
        }
    }

    /// Returns the number of bytes occupied by an encryption scheme's tag which
    /// fall *after* the payload.
    #[must_use]
    pub const fn tag_suffix_len(self) -> usize {
        match self {
            Self::Normal | Self::Suffix | Self::Lite => 0,
            Self::Aes256Gcm | Self::XChaCha20Poly1305 => self.encryption_tag_len(),
        }
    }

    /// Calculates the number of additional bytes required compared
    /// to an unencrypted payload.
    #[must_use]
    pub const fn payload_overhead(self) -> usize {
        self.payload_prefix_len2() + self.payload_suffix_len()
    }

    /// Extracts the byte slice in a packet used as the nonce, and the remaining mutable
    /// portion of the packet.
    fn nonce_slice<'a>(
        self,
        header: &'a [u8],
        body: &'a mut [u8],
    ) -> Result<(&'a [u8], &'a mut [u8]), CryptoError> {
        match self {
            Self::Normal => Ok((header, body)),
            Self::Suffix | Self::Lite | Self::Aes256Gcm | Self::XChaCha20Poly1305 => {
                let len = body.len();
                if len < self.payload_suffix_len() {
                    Err(CryptoError)
                } else {
                    let (body_left, nonce_loc) = body.split_at_mut(len - self.nonce_size());
                    Ok((nonce_loc, body_left))
                }
            },
        }
    }

    /// Encrypts a Discord RT(C)P packet using the given XSalsa20Poly1305 cipher.
    ///
    /// Use of this requires that the input packet has had a nonce generated in the correct location,
    /// and `payload_len` specifies the number of bytes after the header including this nonce.
    #[deprecated(
        since = "0.4.4",
        note = "This method performs encryption for older encryption modes,\
                which will no longer be accepted by Discord as of 2024-11-18. It is an\
                implementation detail and will be removed in `v0.5`."
    )]
    #[inline]
    pub fn encrypt_in_place(
        self,
        packet: &mut impl MutablePacket,
        cipher: &XSalsa20Poly1305,
        payload_len: usize,
    ) -> Result<(), CryptoError> {
        let header_len = packet.packet().len() - packet.payload().len();
        let (header, body) = packet.packet_mut().split_at_mut(header_len);
        let (slice_to_use, body_remaining) = self.nonce_slice(header, &mut body[..payload_len])?;

        let nonce_size = self.nonce_size();
        let tag_size = self.encryption_tag_len();

        let mut nonce = crypto_secretbox::Nonce::default();
        let nonce_slice = if slice_to_use.len() == nonce_size {
            crypto_secretbox::Nonce::from_slice(&slice_to_use[..nonce_size])
        } else {
            nonce[..slice_to_use.len()].copy_from_slice(slice_to_use);
            &nonce
        };

        // body_remaining is now correctly truncated by this point.
        // the true_payload to encrypt follows after the first TAG_LEN bytes.
        let tag =
            cipher.encrypt_in_place_detached(nonce_slice, b"", &mut body_remaining[tag_size..])?;
        body_remaining[..tag_size].copy_from_slice(&tag[..]);

        Ok(())
    }
}

/// State used in nonce generation for the encryption variants in [`CryptoMode`].
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
#[non_exhaustive]
pub enum CryptoState {
    /// An additional random 4B suffix is used as the source of nonce bytes for the packet.
    /// This nonce value increments by `1` with each packet.
    ///
    /// The last used nonce is stored.
    Aes256Gcm(Wrapping<u32>),
    /// An additional random 4B suffix is used as the source of nonce bytes for the packet.
    /// This nonce value increments by `1` with each packet.
    ///
    /// The last used nonce is stored.
    XChaCha20Poly1305(Wrapping<u32>),
    /// The RTP header is used as the source of nonce bytes for the packet.
    ///
    /// No state is required.
    Normal,
    /// An additional random 24B suffix is used as the source of nonce bytes for the packet.
    /// This is regenerated randomly for each packet.
    ///
    /// No state is required.
    Suffix,
    /// An additional random 4B suffix is used as the source of nonce bytes for the packet.
    /// This nonce value increments by `1` with each packet.
    ///
    /// The last used nonce is stored.
    Lite(Wrapping<u32>),
}

#[allow(deprecated)]
impl From<CryptoMode> for CryptoState {
    fn from(val: CryptoMode) -> Self {
        match val {
            CryptoMode::Normal => CryptoState::Normal,
            CryptoMode::Suffix => CryptoState::Suffix,
            CryptoMode::Lite => CryptoState::Lite(Wrapping(rand::random::<u32>())),
            CryptoMode::Aes256Gcm => CryptoState::Aes256Gcm(Wrapping(rand::random::<u32>())),
            CryptoMode::XChaCha20Poly1305 =>
                CryptoState::XChaCha20Poly1305(Wrapping(rand::random::<u32>())),
        }
    }
}

impl CryptoState {
    /// Writes packet nonce into the body, if required, returning the new length.
    pub fn write_packet_nonce(
        &mut self,
        packet: &mut impl MutablePacket,
        payload_end: usize,
    ) -> usize {
        let mode = self.kind();
        let endpoint = payload_end + mode.payload_suffix_len();
        let startpoint = endpoint - mode.nonce_size();

        match self {
            Self::Suffix => {
                rand::rng().fill(&mut packet.payload_mut()[startpoint..endpoint]);
            },
            Self::Lite(ref mut i)
            | Self::Aes256Gcm(ref mut i)
            | Self::XChaCha20Poly1305(ref mut i) => {
                (&mut packet.payload_mut()[startpoint..endpoint])
                    .write_u32::<NetworkEndian>(i.0)
                    .expect(
                        "Nonce size is guaranteed to be sufficient to write u32 for lite tagging.",
                    );
                *i += Wrapping(1);
            },
            Self::Normal => {},
        }

        endpoint
    }

    /// Returns the underlying (stateless) type of the active crypto mode.
    #[must_use]
    pub fn kind(self) -> CryptoMode {
        CryptoMode::from(self)
    }
}

#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
pub(crate) enum EncryptionAlgorithm {
    Aes256Gcm,
    XChaCha20Poly1305,
    XSalsa20Poly1305,
}

impl EncryptionAlgorithm {
    #[must_use]
    pub(crate) const fn encryption_tag_len(self) -> usize {
        match self {
            Self::Aes256Gcm => <Aes256Gcm as AeadCore>::TagSize::USIZE, // 16
            Self::XChaCha20Poly1305 => <XChaCha20Poly1305 as AeadCore>::TagSize::USIZE, // 16
            Self::XSalsa20Poly1305 => XSalsa20Poly1305::TAG_SIZE,       // 16
        }
    }
}

impl From<&Cipher> for EncryptionAlgorithm {
    fn from(value: &Cipher) -> Self {
        match value {
            Cipher::XSalsa20Poly1305(..) => EncryptionAlgorithm::XSalsa20Poly1305,
            Cipher::XChaCha20Poly1305(_) => EncryptionAlgorithm::XChaCha20Poly1305,
            Cipher::Aes256Gcm(_) => EncryptionAlgorithm::Aes256Gcm,
        }
    }
}

#[derive(Clone)]
pub enum Cipher {
    XSalsa20Poly1305(XSalsa20Poly1305, CryptoMode),
    XChaCha20Poly1305(XChaCha20Poly1305),
    Aes256Gcm(Box<Aes256Gcm>),
}

impl Cipher {
    #[must_use]
    pub(crate) fn mode(&self) -> CryptoMode {
        match self {
            Cipher::XSalsa20Poly1305(_, mode) => *mode,
            Cipher::XChaCha20Poly1305(_) => CryptoMode::XChaCha20Poly1305,
            Cipher::Aes256Gcm(_) => CryptoMode::Aes256Gcm,
        }
    }

    #[must_use]
    pub(crate) fn encryption_tag_len(&self) -> usize {
        EncryptionAlgorithm::from(self).encryption_tag_len()
    }

    /// Encrypts a Discord RT(C)P packet using the given key.
    ///
    /// Use of this requires that the input packet has had a nonce generated in the correct location,
    /// and `payload_len` specifies the number of bytes after the header including this nonce.
    #[inline]
    pub fn encrypt_pkt_in_place(
        &self,
        packet: &mut impl MutablePacket,
        payload_len: usize,
    ) -> Result<(), CryptoError> {
        let mode = self.mode();
        let header_len = packet.packet().len() - packet.payload().len();

        let (header, body) = packet.packet_mut().split_at_mut(header_len);
        let (slice_to_use, body_remaining) = mode.nonce_slice(header, &mut body[..payload_len])?;

        let tag_size = self.encryption_tag_len();

        // body_remaining is now correctly truncated to exclude the nonce by this point.
        // the true_payload to encrypt is within the buf[prefix:-suffix].
        let (pre_payload, body_remaining) = body_remaining.split_at_mut(mode.payload_prefix_len2());
        let (body, post_payload) =
            body_remaining.split_at_mut(body_remaining.len() - mode.tag_suffix_len());

        // All these Nonce types are distinct at the type level
        // (96b for AES, 192b for XSalsa/XChaCha).
        match self {
            // Older modes place the tag before the payload and do not authenticate
            // cleartext.
            Self::XSalsa20Poly1305(secret_box, _) => {
                let mut nonce = crypto_secretbox::Nonce::default();
                nonce[..mode.nonce_size()].copy_from_slice(slice_to_use);

                let tag = secret_box.encrypt_in_place_detached(&nonce, b"", body)?;
                pre_payload[..tag_size].copy_from_slice(&tag[..]);
            },

            // The below variants follow part of the SRTP spec (RFC3711, sec 3.1)
            // by requiring that we include the cleartext header portion as
            // authenticated data.
            Self::Aes256Gcm(aes_gcm) => {
                let mut nonce = aes_gcm::Nonce::default();
                nonce[..mode.nonce_size()].copy_from_slice(slice_to_use);

                let tag = aes_gcm.encrypt_in_place_detached(&nonce, header, body)?;
                post_payload[..tag_size].copy_from_slice(&tag[..]);
            },
            Self::XChaCha20Poly1305(cha_cha_poly1305) => {
                let mut nonce = chacha20poly1305::XNonce::default();
                nonce[..mode.nonce_size()].copy_from_slice(slice_to_use);

                let tag = cha_cha_poly1305.encrypt_in_place_detached(&nonce, header, body)?;
                post_payload[..tag_size].copy_from_slice(&tag[..]);
            },
        }

        Ok(())
    }

    #[cfg(any(feature = "receive", test))]
    pub(crate) fn decrypt_rtp_in_place(
        &self,
        packet: &mut MutableRtpPacket<'_>,
    ) -> Result<(usize, usize), InternalError> {
        let mode = self.mode();
        // An exciting difference from the SRTP spec: Discord begins encryption
        // after the RTP extension *header*, encrypting the extensions themselves,
        // whereas the spec leaves all extensions in the clear.
        // This header is described as the 'extension preamble'.
        let has_extension = packet.get_extension() != 0;

        let plain_bytes = if mode.is_more_srtp_compliant() && has_extension {
            // CSRCs and extension bytes will be in the plaintext segment.
            // We will need these demarcated to select the right bytes to
            // decrypt, and to use as auth data.
            RtpExtensionPacket::minimum_packet_size()
        } else {
            0
        };

        let (mut start_estimate, end) = self.decrypt_pkt_in_place(packet, plain_bytes)?;

        // Update the start estimate to account for bytes occupied by extension headers.
        if has_extension {
            let packet = packet.packet();
            if let Some((_, exts_and_opus)) = split_at_checked(packet, start_estimate) {
                let extension = RtpExtensionPacket::new(exts_and_opus)
                    .ok_or(InternalError::IllegalVoicePacket)?;
                start_estimate += extension.packet().len() - extension.payload().len();
            }
        }

        Ok((start_estimate, end))
    }

    #[cfg(feature = "receive")]
    pub(crate) fn decrypt_rtcp_in_place(
        &self,
        packet: &mut MutableRtcpPacket<'_>,
    ) -> Result<(usize, usize), InternalError> {
        // RTCP/SRTCP have identical handling -- no var-length elements
        // are included as part of the plaintext.
        self.decrypt_pkt_in_place(packet, 0)
    }

    /// Decrypts an arbitrary packet using the given key.
    ///
    /// If successful, this returns the number of bytes to be ignored from the
    /// start and end of the packet payload.
    #[inline]
    #[cfg(any(feature = "receive", test))]
    pub(crate) fn decrypt_pkt_in_place(
        &self,
        packet: &mut impl MutablePacket,
        n_plaintext_body_bytes: usize,
    ) -> Result<(usize, usize), InternalError> {
        let mode = self.mode();
        let header_len = packet.packet().len() - packet.payload().len();
        let plaintext_end = header_len + n_plaintext_body_bytes;

        let (plaintext, ciphertext) =
            split_at_mut_checked(packet.packet_mut(), plaintext_end).ok_or(CryptoError)?;
        let (slice_to_use, body_remaining) = mode.nonce_slice(plaintext, ciphertext)?;

        let (pre_payload, body_remaining) =
            split_at_mut_checked(body_remaining, mode.payload_prefix_len2()).ok_or(CryptoError)?;

        let suffix_split_point = body_remaining
            .len()
            .checked_sub(mode.tag_suffix_len())
            .ok_or(CryptoError)?;

        let (body, post_payload) =
            split_at_mut_checked(body_remaining, suffix_split_point).ok_or(CryptoError)?;

        let tag_size = self.encryption_tag_len();

        match self {
            // Older modes place the tag before the payload and do not authenticate
            // cleartext.
            Self::XSalsa20Poly1305(secret_box, _) => {
                let mut nonce = crypto_secretbox::Nonce::default();
                nonce[..mode.nonce_size().min(slice_to_use.len())].copy_from_slice(slice_to_use);

                let tag = crypto_secretbox::Tag::from_slice(&pre_payload[..tag_size]);
                secret_box.decrypt_in_place_detached(&nonce, b"", body, tag)?;
            },

            // The below variants follow part of the SRTP spec (RFC3711, sec 3.1)
            // by requiring that we include the cleartext header portion as
            // authenticated data.
            Self::Aes256Gcm(aes_gcm) => {
                let mut nonce = aes_gcm::Nonce::default();
                nonce[..mode.nonce_size()].copy_from_slice(slice_to_use);

                let tag = aes_gcm::Tag::from_slice(&post_payload[..tag_size]);
                aes_gcm.decrypt_in_place_detached(&nonce, plaintext, body, tag)?;
            },
            Self::XChaCha20Poly1305(cha_cha_poly1305) => {
                let mut nonce = chacha20poly1305::XNonce::default();
                nonce[..mode.nonce_size()].copy_from_slice(slice_to_use);

                let tag = chacha20poly1305::Tag::from_slice(&post_payload[..tag_size]);
                cha_cha_poly1305.decrypt_in_place_detached(&nonce, plaintext, body, tag)?;
            },
        }

        Ok((plaintext_end + pre_payload.len(), post_payload.len()))
    }
}

// Temporary functions -- MSRV is ostensibly 1.74, slice::split_at(_mut)_checked is 1.80+.
// TODO: Remove in v0.5+ with MSRV bump to 1.81+.
#[cfg(any(feature = "receive", test))]
#[inline]
#[must_use]
const fn split_at_checked(els: &[u8], mid: usize) -> Option<(&[u8], &[u8])> {
    if mid <= els.len() {
        Some(els.split_at(mid))
    } else {
        None
    }
}

#[cfg(any(feature = "receive", test))]
#[inline]
#[must_use]
fn split_at_mut_checked(els: &mut [u8], mid: usize) -> Option<(&mut [u8], &mut [u8])> {
    if mid <= els.len() {
        Some(els.split_at_mut(mid))
    } else {
        None
    }
}

#[cfg(test)]
mod test {
    use super::*;
    use discortp::rtp::MutableRtpPacket;

    #[test]
    #[allow(deprecated)]
    fn small_packet_decrypts_error() {
        let mut buf = [0u8; MutableRtpPacket::minimum_packet_size()];
        let modes = [
            CryptoMode::Normal,
            CryptoMode::Suffix,
            CryptoMode::Lite,
            CryptoMode::Aes256Gcm,
            CryptoMode::XChaCha20Poly1305,
        ];
        let mut pkt = MutableRtpPacket::new(&mut buf[..]).unwrap();

        for mode in modes {
            // Coincidentally, these are all 32B for now.
            let cipher = mode.cipher_from_key(&[1u8; 32]).unwrap();
            // AIM: should error, and not panic.
            assert!(cipher.decrypt_rtp_in_place(&mut pkt).is_err());
        }
    }

    #[test]
    #[allow(deprecated)]
    fn symmetric_encrypt_decrypt_xsalsa20() {
        const TRUE_PAYLOAD: [u8; 8] = [1, 2, 3, 4, 5, 6, 7, 8];
        let mut buf = [0u8; MutableRtpPacket::minimum_packet_size()
            + TRUE_PAYLOAD.len()
            + XSalsa20Poly1305::TAG_SIZE
            + XSalsa20Poly1305::NONCE_SIZE];
        let modes = [CryptoMode::Normal, CryptoMode::Lite, CryptoMode::Suffix];

        for mode in modes {
            buf.fill(0);
            let cipher = mode
                .cipher_from_key(&[7u8; XSalsa20Poly1305::KEY_SIZE])
                .unwrap();
            let mut pkt = MutableRtpPacket::new(&mut buf[..]).unwrap();
            let mut crypto_state = CryptoState::from(mode);
            let payload = pkt.payload_mut();
            payload[XSalsa20Poly1305::TAG_SIZE..XSalsa20Poly1305::TAG_SIZE + TRUE_PAYLOAD.len()]
                .copy_from_slice(&TRUE_PAYLOAD[..]);

            let final_payload_size = crypto_state
                .write_packet_nonce(&mut pkt, XSalsa20Poly1305::TAG_SIZE + TRUE_PAYLOAD.len());

            let enc_succ = cipher.encrypt_pkt_in_place(&mut pkt, final_payload_size);

            assert!(enc_succ.is_ok());

            let final_pkt_len = MutableRtpPacket::minimum_packet_size() + final_payload_size;
            let mut pkt = MutableRtpPacket::new(&mut buf[..final_pkt_len]).unwrap();

            assert!(cipher.decrypt_rtp_in_place(&mut pkt).is_ok());
        }
    }

    #[test]
    fn symmetric_encrypt_decrypt_tag_after_data() {
        const TRUE_PAYLOAD: [u8; 8] = [1, 2, 3, 4, 5, 6, 7, 8];
        for mode in [CryptoMode::Aes256Gcm, CryptoMode::XChaCha20Poly1305] {
            let mut buf = vec![
                0u8;
                MutableRtpPacket::minimum_packet_size()
                    + TRUE_PAYLOAD.len()
                    + mode.nonce_size()
                    + mode.encryption_tag_len()
            ];

            buf.fill(0);
            let cipher = mode.cipher_from_key(&[7u8; 32]).unwrap();
            let mut pkt = MutableRtpPacket::new(&mut buf[..]).unwrap();
            let mut crypto_state = CryptoState::from(mode);
            let payload = pkt.payload_mut();
            payload[mode.payload_prefix_len2()..TRUE_PAYLOAD.len()].copy_from_slice(&TRUE_PAYLOAD);

            let final_payload_size = crypto_state.write_packet_nonce(&mut pkt, TRUE_PAYLOAD.len());

            let enc_succ = cipher.encrypt_pkt_in_place(&mut pkt, final_payload_size);

            assert!(enc_succ.is_ok());

            let final_pkt_len = MutableRtpPacket::minimum_packet_size() + final_payload_size;
            let mut pkt = MutableRtpPacket::new(&mut buf[..final_pkt_len]).unwrap();

            assert!(cipher.decrypt_rtp_in_place(&mut pkt).is_ok());
        }
    }

    #[test]
    #[allow(deprecated)]
    fn negotiate_cryptomode() {
        // If we have no preference (or our preference is missing), choose the highest available in the set.
        let test_set = [
            CryptoMode::Suffix,
            CryptoMode::XChaCha20Poly1305,
            CryptoMode::Lite,
        ]
        .map(CryptoMode::to_request_str);
        assert_eq!(
            CryptoMode::negotiate(test_set, None).unwrap(),
            CryptoMode::XChaCha20Poly1305
        );
        assert_eq!(
            CryptoMode::negotiate(test_set, Some(CryptoMode::Aes256Gcm)).unwrap(),
            CryptoMode::XChaCha20Poly1305
        );

        // Preference wins in spite of the defined `priority` value.
        assert_eq!(
            CryptoMode::negotiate(test_set, Some(CryptoMode::Suffix)).unwrap(),
            CryptoMode::Suffix
        );

        // If there is no mutual intelligibility, return an error.
        let bad_modes = ["not_real", "des", "rc5"];
        assert!(CryptoMode::negotiate(&bad_modes, None).is_err());
        assert!(CryptoMode::negotiate(&bad_modes, Some(CryptoMode::Aes256Gcm)).is_err());
    }
}