/*

 * Copyright (C) 2011-2012 Free Software Foundation, Inc.

 * Author: Simon Josefsson

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

/* Online Certificate Status Protocol - RFC 2560

 */

#include "gnutls_int.h"

#include <global.h>

#include "errors.h"

#include <libtasn1.h>

#include <pk.h>

#include <str.h>

#include "algorithms.h"

#include <gnutls/ocsp.h>

#define addf _gnutls_buffer_append_printf

#define adds _gnutls_buffer_append_str

static void print_req(gnutls_buffer_st * str, gnutls_ocsp_req_const_t req)

{

	int ret;

	unsigned indx;

	/* Version. */

	{

		int version = gnutls_ocsp_req_get_version(req);

		if (version < 0)

			addf(str, "error: get_version: %s\n",

			     gnutls_strerror(version));

		else

			addf(str, _("\tVersion: %d\n"), version);

	}

	/* XXX requestorName */

	/* requestList */

	addf(str, "\tRequest List:\n");

	for (indx = 0;; indx++) {

		gnutls_digest_algorithm_t digest;

		gnutls_datum_t in, ik, sn;

		ret =

		    gnutls_ocsp_req_get_cert_id(req, indx, &digest, &in,

						&ik, &sn;;

		if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			break;

		addf(str, "\t\tCertificate ID:\n");

		if (ret != GNUTLS_E_SUCCESS) {

			addf(str, "error: get_cert_id: %s\n",

			     gnutls_strerror(ret));

			continue;

		}

		addf(str, "\t\t\tHash Algorithm: %s\n",

		     _gnutls_digest_get_name(hash_to_entry(digest)));

		adds(str, "\t\t\tIssuer Name Hash: ");

		_gnutls_buffer_hexprint(str, in.data, in.size);

		adds(str, "\n");

		adds(str, "\t\t\tIssuer Key Hash: ");

		_gnutls_buffer_hexprint(str, ik.data, ik.size);

		adds(str, "\n");

		adds(str, "\t\t\tSerial Number: ");

		_gnutls_buffer_hexprint(str, sn.data, sn.size);

		adds(str, "\n");

		gnutls_free(in.data);

		gnutls_free(ik.data);

		gnutls_free(sn.data);

		/* XXX singleRequestExtensions */

	}

	for (indx = 0;; indx++) {

		gnutls_datum_t oid;

		unsigned int critical;

		gnutls_datum_t data;

		ret =

		    gnutls_ocsp_req_get_extension(req, indx, &oid,

						  &critical, &data);

		if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			break;

		else if (ret != GNUTLS_E_SUCCESS) {

			addf(str, "error: get_extension: %s\n",

			     gnutls_strerror(ret));

			continue;

		}

		if (indx == 0)

			adds(str, "\tExtensions:\n");

		if (oid.size == sizeof(GNUTLS_OCSP_NONCE) &&

		    memcmp(oid.data, GNUTLS_OCSP_NONCE, oid.size) == 0) {

			gnutls_datum_t nonce;

			unsigned int ncrit;

			ret =

			    gnutls_ocsp_req_get_nonce(req, &ncrit,

						      &nonce);

			if (ret != GNUTLS_E_SUCCESS) {

				addf(str, "error: get_nonce: %s\n",

				     gnutls_strerror(ret));

			} else {

				addf(str, "\t\tNonce%s: ",

				     ncrit ? " (critical)" : "");

				_gnutls_buffer_hexprint(str, nonce.data,

							nonce.size);

				adds(str, "\n");

				gnutls_free(nonce.data);

			}

		} else {

			addf(str, "\t\tUnknown extension %s (%s):\n",

			     oid.data,

			     critical ? "critical" : "not critical");

			adds(str, _("\t\t\tASCII: "));

			_gnutls_buffer_asciiprint(str, (char *) data.data,

						  data.size);

			addf(str, "\n");

			adds(str, _("\t\t\tHexdump: "));

			_gnutls_buffer_hexprint(str, (char *) data.data,

						data.size);

			adds(str, "\n");

		}

		gnutls_free(oid.data);

		gnutls_free(data.data);

	}

	/* XXX Signature */

}

/**

 * gnutls_ocsp_req_print:

 * @req: The data to be printed

 * @format: Indicate the format to use

 * @out: Newly allocated datum with (0) terminated string.

 *

 * This function will pretty print a OCSP request, suitable for

 * display to a human.

 *

 * If the format is %GNUTLS_OCSP_PRINT_FULL then all fields of the

 * request will be output, on multiple lines.

 *

 * The output @out->data needs to be deallocate using gnutls_free().

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 **/

int

gnutls_ocsp_req_print(gnutls_ocsp_req_const_t req,

		      gnutls_ocsp_print_formats_t format,

		      gnutls_datum_t * out)

{

	gnutls_buffer_st str;

	int rc;

	if (format != GNUTLS_OCSP_PRINT_FULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	_gnutls_buffer_init(&str);

	_gnutls_buffer_append_str(&str, _("OCSP Request Information:\n"));

	print_req(&str, req);

	rc = _gnutls_buffer_to_datum(&str, out, 1);

	if (rc != GNUTLS_E_SUCCESS) {

		gnutls_assert();

		return rc;

	}

	return GNUTLS_E_SUCCESS;

}

static void

print_resp(gnutls_buffer_st * str, gnutls_ocsp_resp_const_t resp,

	   gnutls_ocsp_print_formats_t format)

{

	int ret;

	unsigned indx;

	ret = gnutls_ocsp_resp_get_status(resp);

	if (ret < 0) {

		addf(str, "error: ocsp_resp_get_status: %s\n",

		     gnutls_strerror(ret));

		return;

	}

	adds(str, "\tResponse Status: ");

	switch (ret) {

	case GNUTLS_OCSP_RESP_SUCCESSFUL:

		adds(str, "Successful\n");

		break;

	case GNUTLS_OCSP_RESP_MALFORMEDREQUEST:

		adds(str, "malformedRequest\n");

		return;

	case GNUTLS_OCSP_RESP_INTERNALERROR:

		adds(str, "internalError\n");

		return;

	case GNUTLS_OCSP_RESP_TRYLATER:

		adds(str, "tryLater\n");

		return;

	case GNUTLS_OCSP_RESP_SIGREQUIRED:

		adds(str, "sigRequired\n");

		return;

	case GNUTLS_OCSP_RESP_UNAUTHORIZED:

		adds(str, "unauthorized\n");

		return;

	default:

		adds(str, "unknown\n");

		return;

	}

	{

		gnutls_datum_t oid;

		ret = gnutls_ocsp_resp_get_response(resp, &oid, NULL);

		if (ret < 0) {

			addf(str, "error: get_response: %s\n",

			     gnutls_strerror(ret));

			return;

		}

		adds(str, "\tResponse Type: ");

#define OCSP_BASIC "1.3.6.1.5.5.7.48.1.1"

		if (oid.size == sizeof(OCSP_BASIC)

		    && memcmp(oid.data, OCSP_BASIC, oid.size) == 0) {

			adds(str, "Basic OCSP Response\n");

			gnutls_free(oid.data);

		} else {

			addf(str, "Unknown response type (%.*s)\n",

			     oid.size, oid.data);

			gnutls_free(oid.data);

			return;

		}

	}

	/* Version. */

	{

		int version = gnutls_ocsp_resp_get_version(resp);

		if (version < 0)

			addf(str, "error: get_version: %s\n",

			     gnutls_strerror(version));

		else

			addf(str, _("\tVersion: %d\n"), version);

	}

	/* responderID */

	{

		gnutls_datum_t dn = {NULL, 0};

		ret = gnutls_ocsp_resp_get_responder2(resp, &dn, 0);

		if (ret < 0) {

			if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

				ret = gnutls_ocsp_resp_get_responder_raw_id(resp, GNUTLS_OCSP_RESP_ID_KEY, &dn;;

				if (ret >= 0) {

					addf(str, _("\tResponder Key ID: "));

					_gnutls_buffer_hexprint(str, dn.data, dn.size);

					adds(str, "\n");

				}

				gnutls_free(dn.data);

			} else {

				addf(str, "error: get_responder2: %s\n",

				     gnutls_strerror(ret));

			}

		} else {

			addf(str, _("\tResponder ID: %s\n"), dn.data);

			gnutls_free(dn.data);

		}

	}

	{

		char s[42];

		size_t max = sizeof(s);

		struct tm t;

		time_t tim = gnutls_ocsp_resp_get_produced(resp);

		if (tim == (time_t) - 1)

			addf(str, "error: ocsp_resp_get_produced\n");

		else if (gmtime_r(&tim, &t) == NULL)

			addf(str, "error: gmtime_r (%ld)\n",

			     (unsigned long) tim);

		else if (strftime(s, max, "%a %b %d %H:%M:%S UTC %Y", &t)

			 == 0)

			addf(str, "error: strftime (%ld)\n",

			     (unsigned long) tim);

		else

			addf(str, _("\tProduced At: %s\n"), s);

	}

	addf(str, "\tResponses:\n");

	for (indx = 0;; indx++) {

		gnutls_digest_algorithm_t digest;

		gnutls_datum_t in, ik, sn;

		unsigned int cert_status;

		time_t this_update;

		time_t next_update;

		time_t revocation_time;

		unsigned int revocation_reason;

		ret = gnutls_ocsp_resp_get_single(resp,

						  indx,

						  &digest, &in, &ik, &sn,

						  &cert_status,

						  &this_update,

						  &next_update,

						  &revocation_time,

						  &revocation_reason);

		if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			break;

		addf(str, "\t\tCertificate ID:\n");

		if (ret != GNUTLS_E_SUCCESS) {

			addf(str, "error: get_singleresponse: %s\n",

			     gnutls_strerror(ret));

			continue;

		}

		addf(str, "\t\t\tHash Algorithm: %s\n",

		     _gnutls_digest_get_name(hash_to_entry(digest)));

		adds(str, "\t\t\tIssuer Name Hash: ");

		_gnutls_buffer_hexprint(str, in.data, in.size);

		adds(str, "\n");

		adds(str, "\t\t\tIssuer Key Hash: ");

		_gnutls_buffer_hexprint(str, ik.data, ik.size);

		adds(str, "\n");

		adds(str, "\t\t\tSerial Number: ");

		_gnutls_buffer_hexprint(str, sn.data, sn.size);

		adds(str, "\n");

		gnutls_free(in.data);

		gnutls_free(ik.data);

		gnutls_free(sn.data);

		{

			const char *p = NULL;

			switch (cert_status) {

			case GNUTLS_OCSP_CERT_GOOD:

				p = "good";

				break;

			case GNUTLS_OCSP_CERT_REVOKED:

				p = "revoked";

				break;

			case GNUTLS_OCSP_CERT_UNKNOWN:

				p = "unknown";

				break;

			default:

				addf(str,

				     "\t\tCertificate Status: unexpected value %d\n",

				     cert_status);

				break;

			}

			if (p)

				addf(str, "\t\tCertificate Status: %s\n",

				     p);

		}

		/* XXX revocation reason */

		if (cert_status == GNUTLS_OCSP_CERT_REVOKED) {

			char s[42];

			size_t max = sizeof(s);

			struct tm t;

			if (revocation_time == (time_t) - 1)

				addf(str, "error: revocation_time\n");

			else if (gmtime_r(&revocation_time, &t) == NULL)

				addf(str, "error: gmtime_r (%ld)\n",

				     (unsigned long) revocation_time);

			else if (strftime

				 (s, max, "%a %b %d %H:%M:%S UTC %Y",

				  &t) == 0)

				addf(str, "error: strftime (%ld)\n",

				     (unsigned long) revocation_time);

			else

				addf(str, _("\t\tRevocation time: %s\n"),

				     s);

		}

		{

			char s[42];

			size_t max = sizeof(s);

			struct tm t;

			if (this_update == (time_t) - 1)

				addf(str, "error: this_update\n");

			else if (gmtime_r(&this_update, &t) == NULL)

				addf(str, "error: gmtime_r (%ld)\n",

				     (unsigned long) this_update);

			else if (strftime

				 (s, max, "%a %b %d %H:%M:%S UTC %Y",

				  &t) == 0)

				addf(str, "error: strftime (%ld)\n",

				     (unsigned long) this_update);

			else

				addf(str, _("\t\tThis Update: %s\n"), s);

		}

		{

			char s[42];

			size_t max = sizeof(s);

			struct tm t;

			if (next_update != (time_t) - 1) {

				if (gmtime_r(&next_update, &t) == NULL)

					addf(str, "error: gmtime_r (%ld)\n",

					     (unsigned long) next_update);

				else if (strftime

					 (s, max, "%a %b %d %H:%M:%S UTC %Y",

					  &t) == 0)

					addf(str, "error: strftime (%ld)\n",

					     (unsigned long) next_update);

				else

					addf(str, _("\t\tNext Update: %s\n"), s);

			}

		}

		/* XXX singleRequestExtensions */

	}

	adds(str, "\tExtensions:\n");

	for (indx = 0;; indx++) {

		gnutls_datum_t oid;

		unsigned int critical;

		gnutls_datum_t data;

		ret =

		    gnutls_ocsp_resp_get_extension(resp, indx, &oid,

						   &critical, &data);

		if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

			break;

		else if (ret != GNUTLS_E_SUCCESS) {

			addf(str, "error: get_extension: %s\n",

			     gnutls_strerror(ret));

			continue;

		}

		if (oid.size == sizeof(GNUTLS_OCSP_NONCE) &&

		    memcmp(oid.data, GNUTLS_OCSP_NONCE, oid.size) == 0) {

			gnutls_datum_t nonce;

			unsigned int ncrit;

			ret =

			    gnutls_ocsp_resp_get_nonce(resp, &ncrit,

						       &nonce);

			if (ret != GNUTLS_E_SUCCESS) {

				addf(str, "error: get_nonce: %s\n",

				     gnutls_strerror(ret));

			} else {

				addf(str, "\t\tNonce%s: ",

				     ncrit ? " (critical)" : "");

				_gnutls_buffer_hexprint(str, nonce.data,

							nonce.size);

				adds(str, "\n");

				gnutls_free(nonce.data);

			}

		} else {

			addf(str, "\t\tUnknown extension %s (%s):\n",

			     oid.data,

			     critical ? "critical" : "not critical");

			adds(str, _("\t\t\tASCII: "));

			_gnutls_buffer_asciiprint(str, (char *) data.data,

						  data.size);

			addf(str, "\n");

			adds(str, _("\t\t\tHexdump: "));

			_gnutls_buffer_hexprint(str, (char *) data.data,

						data.size);

			adds(str, "\n");

		}

		gnutls_free(oid.data);

		gnutls_free(data.data);

	}

	ret = gnutls_ocsp_resp_get_signature_algorithm(resp);

	if (ret < 0)

		addf(str, "error: get_signature_algorithm: %s\n",

		     gnutls_strerror(ret));

	else {

		const char *name =

		    gnutls_sign_algorithm_get_name(ret);

		if (name == NULL)

			name = _("unknown");

		addf(str, _("\tSignature Algorithm: %s\n"), name);

	}

	if (ret != GNUTLS_SIGN_UNKNOWN && gnutls_sign_is_secure(ret) == 0) {

		adds(str,

		     _("warning: signed using a broken signature "

		       "algorithm that can be forged.\n"));

	}

	/* Signature. */

	if (format == GNUTLS_OCSP_PRINT_FULL) {

		gnutls_datum_t sig;

		ret = gnutls_ocsp_resp_get_signature(resp, &sig);

		if (ret < 0)

			addf(str, "error: get_signature: %s\n",

			     gnutls_strerror(ret));

		else {

			adds(str, _("\tSignature:\n"));

			_gnutls_buffer_hexdump(str, sig.data, sig.size,

					       "\t\t");

			gnutls_free(sig.data);

		}

	}

	/* certs */

	if (format == GNUTLS_OCSP_PRINT_FULL) {

		gnutls_x509_crt_t *certs;

		size_t ncerts, i;

		gnutls_datum_t out;

		ret = gnutls_ocsp_resp_get_certs(resp, &certs, &ncerts);

		if (ret < 0)

			addf(str, "error: get_certs: %s\n",

			     gnutls_strerror(ret));

		else {

			if (ncerts > 0)

				addf(str, "\tAdditional certificates:\n");

			for (i = 0; i < ncerts; i++) {

				size_t s = 0;

				ret =

				    gnutls_x509_crt_print(certs[i],

							  GNUTLS_CRT_PRINT_FULL,

							  &out;;

				if (ret < 0)

					addf(str, "error: crt_print: %s\n",

					     gnutls_strerror(ret));

				else {

					addf(str, "%.*s", out.size,

					     out.data);

					gnutls_free(out.data);

				}

				ret =

				    gnutls_x509_crt_export(certs[i],

							   GNUTLS_X509_FMT_PEM,

							   NULL, &s);

				if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)

					addf(str,

					     "error: crt_export: %s\n",

					     gnutls_strerror(ret));

				else {

					out.data = gnutls_malloc(s);

					if (out.data == NULL)

						addf(str,

						     "error: malloc: %s\n",

						     gnutls_strerror

						     (GNUTLS_E_MEMORY_ERROR));

					else {

						ret =

						    gnutls_x509_crt_export

						    (certs[i],

						     GNUTLS_X509_FMT_PEM,

						     out.data, &s);

						if (ret < 0)

							addf(str,

							     "error: crt_export: %s\n",

							     gnutls_strerror

							     (ret));

						else {

							out.size = s;

							addf(str, "%.*s",

							     out.size,

							     out.data);

						}

						gnutls_free(out.data);

					}

				}

				gnutls_x509_crt_deinit(certs[i]);

			}

			gnutls_free(certs);

		}

	}

}

/**

 * gnutls_ocsp_resp_print:

 * @resp: The data to be printed

 * @format: Indicate the format to use

 * @out: Newly allocated datum with (0) terminated string.

 *

 * This function will pretty print a OCSP response, suitable for

 * display to a human.

 *

 * If the format is %GNUTLS_OCSP_PRINT_FULL then all fields of the

 * response will be output, on multiple lines.

 *

 * The output @out->data needs to be deallocate using gnutls_free().

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 **/

int

gnutls_ocsp_resp_print(gnutls_ocsp_resp_const_t resp,

		       gnutls_ocsp_print_formats_t format,

		       gnutls_datum_t * out)

{

	gnutls_buffer_st str;

	int rc;

	_gnutls_buffer_init(&str);

	_gnutls_buffer_append_str(&str, _("OCSP Response Information:\n"));

	print_resp(&str, resp, format);

	rc = _gnutls_buffer_to_datum(&str, out, 1);

	if (rc != GNUTLS_E_SUCCESS) {

		gnutls_assert();

		return rc;

	}

	return GNUTLS_E_SUCCESS;

}