/* Copyright 2000-2005 The Apache Software Foundation
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

/** SSL info wrapper
 *
 * @author Mladen Turk
 * @version $Revision$, $Date$
 */

#include "tcn.h"
#include "apr_file_io.h"
#include "apr_thread_mutex.h"
#include "apr_poll.h"

#ifdef HAVE_OPENSSL
#include "ssl_private.h"

static const char *hex_basis = "0123456789ABCDEF";

static char *convert_to_hex(const void *buf, size_t len)
{
    const unsigned char *p = ( const unsigned char *)buf;
    char *str, *s;
    size_t i;

    if ((len < 1) || ((str = malloc(len * 2 + 1)) == NULL))
        return NULL;
    for (i = 0, s = str; i < len; i++) {
        unsigned char c = *p++;
        *s++ = hex_basis[c >> 4];
        *s++ = hex_basis[c & 0x0F];
    }
    *s = '\0';
    return str;
}

#define DIGIT2NUM(x) (((x)[0] - '0') * 10 + (x)[1] - '0')

static int get_days_remaining(ASN1_UTCTIME *tm)
{
    apr_time_t then, now = apr_time_now();
    apr_time_exp_t exp = {0};
    int diff;

    /* Fail if the time isn't a valid ASN.1 UTCTIME; RFC3280 mandates
     * that the seconds digits are present even though ASN.1
     * doesn't. */
    if (tm->length < 11 || !ASN1_UTCTIME_check(tm))
        return 0;

    exp.tm_year = DIGIT2NUM(tm->data);
    exp.tm_mon  = DIGIT2NUM(tm->data + 2) - 1;
    exp.tm_mday = DIGIT2NUM(tm->data + 4) + 1;
    exp.tm_hour = DIGIT2NUM(tm->data + 6);
    exp.tm_min  = DIGIT2NUM(tm->data + 8);
    exp.tm_sec  = DIGIT2NUM(tm->data + 10);

    if (exp.tm_year <= 50)
        exp.tm_year += 100;
    if (apr_time_exp_gmt_get(&then, &exp) != APR_SUCCESS)
        return 0;

    diff = (int)((apr_time_sec(then) - apr_time_sec(now)) / (60*60*24));
    return diff > 0 ? diff : 0;
}

static char *get_cert_valid(ASN1_UTCTIME *tm)
{
    char *result;
    BIO* bio;
    int n;

    if ((bio = BIO_new(BIO_s_mem())) == NULL)
        return NULL;
    ASN1_UTCTIME_print(bio, tm);
    n = BIO_pending(bio);
    result = malloc(n+1);
    n = BIO_read(bio, result, n);
    result[n] = '\0';
    BIO_free(bio);
    return result;
}

static char *get_cert_PEM(X509 *xs)
{
    char *result = NULL;
    BIO *bio;

    if ((bio = BIO_new(BIO_s_mem())) == NULL)
        return NULL;
    if (PEM_write_bio_X509(bio, xs)) {
        int n = BIO_pending(bio);
        result = malloc(n+1);
        n = BIO_read(bio, result, n);
        result[n] = '\0';
    }
    BIO_free(bio);
    return result;
}

static unsigned char *get_cert_ASN1(X509 *xs, int *len)
{
    unsigned char *result = NULL;
    BIO *bio;

    *len = 0;
    if ((bio = BIO_new(BIO_s_mem())) == NULL)
        return NULL;
    if (i2d_X509_bio(bio, xs)) {
        int n = BIO_pending(bio);
        result = malloc(n);
        n = BIO_read(bio, result, n);
        *len = n;
    }
    BIO_free(bio);
    return result;
}


static char *get_cert_serial(X509 *xs)
{
    char *result;
    BIO *bio;
    int n;

    if ((bio = BIO_new(BIO_s_mem())) == NULL)
        return NULL;
    i2a_ASN1_INTEGER(bio, X509_get_serialNumber(xs));
    n = BIO_pending(bio);
    result = malloc(n+1);
    n = BIO_read(bio, result, n);
    result[n] = '\0';
    BIO_free(bio);
    return result;
}

static const struct {
    int   fid;
    int   nid;
} info_cert_dn_rec[] = {
    { SSL_INFO_DN_COUNTRYNAME,            NID_countryName            },
    { SSL_INFO_DN_STATEORPROVINCENAME,    NID_stateOrProvinceName    },
    { SSL_INFO_DN_LOCALITYNAME,           NID_localityName           },
    { SSL_INFO_DN_ORGANIZATIONNAME,       NID_organizationName       },
    { SSL_INFO_DN_ORGANIZATIONALUNITNAME, NID_organizationalUnitName },
    { SSL_INFO_DN_COMMONNAME,             NID_commonName             },
    { SSL_INFO_DN_TITLE,                  NID_title                  },
    { SSL_INFO_DN_INITIALS,               NID_initials               },
    { SSL_INFO_DN_GIVENNAME,              NID_givenName              },
    { SSL_INFO_DN_SURNAME,                NID_surname                },
    { SSL_INFO_DN_DESCRIPTION,            NID_description            },
    { SSL_INFO_DN_UNIQUEIDENTIFIER,       NID_x500UniqueIdentifier   },
    { SSL_INFO_DN_EMAILADDRESS,           NID_pkcs9_emailAddress     },
    { 0,                                  0                          }
};

static char *lookup_ssl_cert_dn(X509_NAME *xsname, int dnidx)
{
    char *result;
    X509_NAME_ENTRY *xsne;
    int i, j, n, idx = 0;

    result = NULL;

    for (i = 0; info_cert_dn_rec[i].fid != 0; i++) {
        if (info_cert_dn_rec[i].fid == dnidx) {
            for (j = 0; j < sk_X509_NAME_ENTRY_num((STACK_OF(X509_NAME_ENTRY) *)
                                                   (xsname->entries)); j++) {
                xsne = sk_X509_NAME_ENTRY_value((STACK_OF(X509_NAME_ENTRY) *)
                                                (xsname->entries), j);

                n =OBJ_obj2nid((ASN1_OBJECT *)X509_NAME_ENTRY_get_object(xsne));
                if (n == info_cert_dn_rec[i].nid && idx-- == 0) {
                    result = malloc(xsne->value->length + 1);
                    memcpy(result, xsne->value->data,
                                   xsne->value->length);
                    result[xsne->value->length] = '\0';

#if APR_CHARSET_EBCDIC
                    ap_xlate_proto_from_ascii(result, xsne->value->length);
#endif /* APR_CHARSET_EBCDIC */
                    break;
                }
            }
            break;
        }
    }
    return result;
}

TCN_IMPLEMENT_CALL(jobject, SSLSocket, getInfoB)(TCN_STDARGS, jlong sock,
                                                 jint what)
{
    tcn_socket_t   *a = J2P(sock, tcn_socket_t *);
    tcn_ssl_conn_t *s;
    jbyteArray array = NULL;
    apr_status_t rv = APR_SUCCESS;

    UNREFERENCED(o);
    TCN_ASSERT(sock != 0);

    s = (tcn_ssl_conn_t *)(a->opaque);
    switch (what) {
        case SSL_INFO_SESSION_ID:
        {
            SSL_SESSION *session  = SSL_get_session(s->ssl);
            if (session) {
                array = tcn_new_arrayb(e, &session->session_id[0],
                                       session->session_id_length);
            }
        }
        break;
        default:
            rv = APR_EINVAL;
        break;
    }
    if (what & SSL_INFO_CLIENT_MASK) {
        X509 *xs;
        unsigned char *result;
        int len;
        if ((xs = SSL_get_peer_certificate(s->ssl)) != NULL) {
            switch (what) {
                case SSL_INFO_CLIENT_CERT:
                    if ((result = get_cert_ASN1(xs, &len))) {
                        array = tcn_new_arrayb(e, result, len);
                        free(result);
                    }
                break;
            }
            X509_free(xs);
        }
        rv = APR_SUCCESS;
    }
    else if (what & SSL_INFO_SERVER_MASK) {
        X509 *xs;
        unsigned char *result;
        int len;
        if ((xs = SSL_get_certificate(s->ssl)) != NULL) {
            switch (what) {
                case SSL_INFO_SERVER_CERT:
                    if ((result = get_cert_ASN1(xs, &len))) {
                        array = tcn_new_arrayb(e, result, len);
                        free(result);
                    }
                break;
            }
            /* XXX: No need to call the X509_free(xs); */
        }
        rv = APR_SUCCESS;
    }
    else if (what & SSL_INFO_CLIENT_CERT_CHAIN) {
        X509 *xs;
        unsigned char *result;
        STACK_OF(X509) *sk =  SSL_get_peer_cert_chain(s->ssl);
        int len, n = what & 0x0F;
        if (n < sk_X509_num(sk)) {
            xs = sk_X509_value(sk, n);
            if ((result = get_cert_ASN1(xs, &len))) {
                array = tcn_new_arrayb(e, result, len);
                free(result);
            }
        }
        rv = APR_SUCCESS;
    }
    if (rv != APR_SUCCESS)
        tcn_ThrowAPRException(e, rv);

    return array;
}

TCN_IMPLEMENT_CALL(jstring, SSLSocket, getInfoS)(TCN_STDARGS, jlong sock,
                                                 jint what)
{
    tcn_socket_t   *a = J2P(sock, tcn_socket_t *);
    tcn_ssl_conn_t *s;
    jstring value = NULL;
    apr_status_t rv = APR_SUCCESS;

    UNREFERENCED(o);
    TCN_ASSERT(sock != 0);

    s = (tcn_ssl_conn_t *)(a->opaque);
    switch (what) {
        case SSL_INFO_SESSION_ID:
        {
            SSL_SESSION *session  = SSL_get_session(s->ssl);
            if (session) {
                char *hs = convert_to_hex(&session->session_id[0],
                                          session->session_id_length);
                if (hs) {
                    value = tcn_new_string(e, hs);
                    free(hs);
                }
            }
        }
        break;
        case SSL_INFO_PROTOCOL:
            value = tcn_new_string(e, SSL_get_version(s->ssl));
        break;
        case SSL_INFO_CIPHER:
            value = tcn_new_string(e, SSL_get_cipher_name(s->ssl));
        break;
        case SSL_INFO_CIPHER_VERSION:
            value = tcn_new_string(e, SSL_get_cipher_version(s->ssl));
        break;
        case SSL_INFO_CIPHER_DESCRIPTION:
            {
                SSL_CIPHER *cipher = SSL_get_current_cipher(s->ssl);
                if (cipher) {
                    char buf[256];
                    char *desc = SSL_CIPHER_description(cipher, buf, 256);
                    value = tcn_new_string(e, desc);
                }
            }
        break;
        default:
            rv = APR_EINVAL;
        break;
    }
    if (what & (SSL_INFO_CLIENT_S_DN | SSL_INFO_CLIENT_I_DN)) {
        X509 *xs;
        X509_NAME *xsname;
        if ((xs = SSL_get_peer_certificate(s->ssl)) != NULL) {
            char *result;
            int idx = what & 0x0F;
            if (what & SSL_INFO_CLIENT_S_DN)
                xsname = X509_get_subject_name(xs);
            else
                xsname = X509_get_issuer_name(xs);
            if (idx) {
                result = lookup_ssl_cert_dn(xsname, idx);
                if (result) {
                    value = tcn_new_string(e, result);
                    free(result);
                }
            }
            else
                value = tcn_new_string(e, X509_NAME_oneline(xsname, NULL, 0));
            X509_free(xs);
        }
        rv = APR_SUCCESS;
    }
    else if (what & (SSL_INFO_SERVER_S_DN | SSL_INFO_SERVER_I_DN)) {
        X509 *xs;
        X509_NAME *xsname;
        if ((xs = SSL_get_certificate(s->ssl)) != NULL) {
            char *result;
            int idx = what & 0x0F;
            if (what & SSL_INFO_SERVER_S_DN)
                xsname = X509_get_subject_name(xs);
            else
                xsname = X509_get_issuer_name(xs);
            if (idx) {
                result = lookup_ssl_cert_dn(xsname, what & 0x0F);
                if (result) {
                    value = tcn_new_string(e, result);
                    free(result);
                }
            }
            else
                value = tcn_new_string(e, X509_NAME_oneline(xsname, NULL, 0));
            /* XXX: No need to call the X509_free(xs); */
        }
        rv = APR_SUCCESS;
    }
    else if (what & SSL_INFO_CLIENT_MASK) {
        X509 *xs;
        char *result;
        int nid;
        if ((xs = SSL_get_peer_certificate(s->ssl)) != NULL) {
            switch (what) {
                case SSL_INFO_CLIENT_V_START:
                    if ((result = get_cert_valid(X509_get_notBefore(xs)))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
                case SSL_INFO_CLIENT_V_END:
                    if ((result = get_cert_valid(X509_get_notAfter(xs)))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
                case SSL_INFO_CLIENT_A_SIG:
                    nid = OBJ_obj2nid((ASN1_OBJECT *)xs->cert_info->signature->algorithm);
                    if (nid == NID_undef)
                        value = tcn_new_string(e, "UNKNOWN");
                    else
                        value = tcn_new_string(e, OBJ_nid2ln(nid));
                break;
                case SSL_INFO_CLIENT_A_KEY:
                    nid = OBJ_obj2nid((ASN1_OBJECT *)xs->cert_info->key->algor->algorithm);
                    if (nid == NID_undef)
                        value = tcn_new_string(e, "UNKNOWN");
                    else
                        value = tcn_new_string(e, OBJ_nid2ln(nid));
                break;
                case SSL_INFO_CLIENT_CERT:
                    if ((result = get_cert_PEM(xs))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
                case SSL_INFO_CLIENT_M_SERIAL:
                    if ((result = get_cert_serial(xs))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
            }
            X509_free(xs);
        }
        rv = APR_SUCCESS;
    }
    else if (what & SSL_INFO_SERVER_MASK) {
        X509 *xs;
        char *result;
        int nid;
        if ((xs = SSL_get_certificate(s->ssl)) != NULL) {
            switch (what) {
                case SSL_INFO_SERVER_V_START:
                    if ((result = get_cert_valid(X509_get_notBefore(xs)))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
                case SSL_INFO_SERVER_V_END:
                    if ((result = get_cert_valid(X509_get_notAfter(xs)))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
                case SSL_INFO_SERVER_A_SIG:
                    nid = OBJ_obj2nid((ASN1_OBJECT *)xs->cert_info->signature->algorithm);
                    if (nid == NID_undef)
                        value = tcn_new_string(e, "UNKNOWN");
                    else
                        value = tcn_new_string(e, OBJ_nid2ln(nid));
                break;
                case SSL_INFO_SERVER_A_KEY:
                    nid = OBJ_obj2nid((ASN1_OBJECT *)xs->cert_info->key->algor->algorithm);
                    if (nid == NID_undef)
                        value = tcn_new_string(e, "UNKNOWN");
                    else
                        value = tcn_new_string(e, OBJ_nid2ln(nid));
                break;
                case SSL_INFO_SERVER_CERT:
                    if ((result = get_cert_PEM(xs))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
                case SSL_INFO_SERVER_M_SERIAL:
                    if ((result = get_cert_serial(xs))) {
                        value = tcn_new_string(e, result);
                        free(result);
                    }
                break;
            }
            /* XXX: No need to call the X509_free(xs); */
        }
        rv = APR_SUCCESS;
    }
    else if (what & SSL_INFO_CLIENT_CERT_CHAIN) {
        X509 *xs;
        char *result;
        STACK_OF(X509) *sk =  SSL_get_peer_cert_chain(s->ssl);
        int n = what & 0x0F;
        if (n < sk_X509_num(sk)) {
            xs = sk_X509_value(sk, n);
            if ((result = get_cert_PEM(xs))) {
                value = tcn_new_string(e, result);
                free(result);
            }
        }
        rv = APR_SUCCESS;
    }
    if (rv != APR_SUCCESS)
        tcn_ThrowAPRException(e, rv);

    return value;
}

TCN_IMPLEMENT_CALL(jint, SSLSocket, getInfoI)(TCN_STDARGS, jlong sock,
                                              jint what)
{
    tcn_socket_t   *a = J2P(sock, tcn_socket_t *);
    tcn_ssl_conn_t *s;
    apr_status_t rv = APR_SUCCESS;
    jint value = -1;

    UNREFERENCED(o);
    TCN_ASSERT(sock != 0);

    s = (tcn_ssl_conn_t *)(a->opaque);

    switch (what) {
        case SSL_INFO_CIPHER_USEKEYSIZE:
        case SSL_INFO_CIPHER_ALGKEYSIZE:
        {
            int usekeysize = 0;
            int algkeysize = 0;
            SSL_CIPHER *cipher = SSL_get_current_cipher(s->ssl);
            if (cipher) {
                usekeysize = SSL_CIPHER_get_bits(cipher, &algkeysize);
                if (what == SSL_INFO_CIPHER_USEKEYSIZE)
                    value = usekeysize;
                else
                    value = algkeysize;
            }
        }
        break;
        case SSL_INFO_CLIENT_CERT_CHAIN:
        {
            STACK_OF(X509) *sk =  SSL_get_peer_cert_chain(s->ssl);
            value = sk_X509_num(sk);
        }
        break;
        default:
            rv = APR_EINVAL;
        break;
    }
    if (what & SSL_INFO_CLIENT_MASK) {
        X509 *xs;
        if ((xs = SSL_get_peer_certificate(s->ssl)) != NULL) {
            switch (what) {
                case SSL_INFO_CLIENT_V_REMAIN:
                    value = get_days_remaining(X509_get_notAfter(xs));
                    rv = APR_SUCCESS;
                break;
                default:
                    rv = APR_EINVAL;
                break;                    
           }
           X509_free(xs);
        }
    }

    if (rv != APR_SUCCESS)
        tcn_ThrowAPRException(e, rv);
    return value;
}

#else
/* OpenSSL is not supported
 * If someday we make OpenSSL optional
 * APR_ENOTIMPL will go here
 */
#error "No OpenSSL Toolkit defined."
#endif