/*
 * Copyright (C) 2016-2017 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * GnuTLS is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * GnuTLS is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 */

#ifdef HAVE_CONFIG_H
#include <config.h>
#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

#include <gnutls/gnutls.h>
#include <gnutls/x509.h>
#include <gnutls/abstract.h>
#include <getopt.h>
#include <assert.h>
#define P11_KIT_FUTURE_UNSTABLE_API
#include <p11-kit/p11-kit.h>
#include "cert-common.h"

/* lists the registered PKCS#11 modules by p11-kit.
 */

static void tls_log_func(int level, const char *str)
{
	fprintf(stderr, "|<%d>| %s", level, str);
}

int
_gnutls_pkcs11_token_get_url(unsigned int seq,
                            gnutls_pkcs11_url_type_t detailed, char **url,
                            unsigned flags);

int main(int argc, char **argv)
{
	int ret;
	unsigned i;
	int opt;
	char *url, *mod;
	gnutls_x509_trust_list_t tl;
	gnutls_x509_crt_t crt;
	gnutls_pkcs11_privkey_t key;
	unsigned flag = 1;
	unsigned int status;

	ret = gnutls_global_init();
	if (ret != 0) {
		fprintf(stderr, "error at %d: %s\n", __LINE__, gnutls_strerror(ret));
		exit(1);
	}

	gnutls_global_set_log_function(tls_log_func);
	//gnutls_global_set_log_level(4711);

	while((opt = getopt(argc, argv, "s:o:mvatdp")) != -1) {
		switch(opt) {
			case 'o':
				mod = strdup(optarg);
				p11_kit_override_system_files(NULL, NULL, mod, mod, NULL);
				break;
			case 'm':
				/* initialize manually - i.e., do no module loading */
				ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
				if (ret != 0) {
					fprintf(stderr, "error at %d: %s\n", __LINE__, gnutls_strerror(ret));
					exit(1);
				}
				break;
			case 's':
				/* load module */
				ret = gnutls_pkcs11_add_provider(optarg, NULL);
				if (ret != 0) {
					fprintf(stderr, "error at %d: %s\n", __LINE__, gnutls_strerror(ret));
					exit(1);
				}
				break;
			case 'd':
				/* when call _gnutls_pkcs11_token_get_url() do proper initialization
				 * if none done */
				flag = 0;
				break;
			case 'p':
				/* do private key operations */
				assert(gnutls_pkcs11_privkey_init(&key) >= 0);
				gnutls_pkcs11_privkey_import_url(key, "pkcs11:", 0);
				gnutls_pkcs11_privkey_deinit(key);
				break;
			case 'a':
				/* initialize auto - i.e., do module loading */
				ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO, NULL);
				if (ret != 0) {
					fprintf(stderr, "error at %d: %s\n", __LINE__, gnutls_strerror(ret));
					exit(1);
				}
				break;
			case 't':
				/* do trusted module loading */
				ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_AUTO_TRUSTED, NULL);
				if (ret != 0) {
					fprintf(stderr, "error at %d: %s\n", __LINE__, gnutls_strerror(ret));
					exit(1);
				}
				break;
			case 'v':
				/* do verification which should trigger trusted module loading */
				assert(gnutls_x509_crt_init(&crt) >= 0);
				assert(gnutls_x509_crt_import(crt, &ca3_cert, GNUTLS_X509_FMT_PEM) >= 0);

				assert(gnutls_x509_trust_list_init(&tl, 0) >= 0);
				assert(gnutls_x509_trust_list_add_system_trust(tl, 0, 0) >= 0);
				gnutls_x509_trust_list_verify_crt2(tl, &crt, 1, NULL, 0, 0, &status, NULL);
				gnutls_x509_trust_list_deinit(tl, 1);
				gnutls_x509_crt_deinit(crt);
				break;
			default:
				fprintf(stderr, "Unknown option %c\n", (char)opt);
				exit(1);
		}
	}


	for (i=0;;i++) {
		ret = _gnutls_pkcs11_token_get_url(i, 0, &url, flag);
		if (ret < 0)
			break;
		printf("%s\n", url);
		free(url);
	}

	/* try whether these URIs are operational */
	for (i=0;;i++) {
		unsigned tflags;

		ret = _gnutls_pkcs11_token_get_url(i, 0, &url, flag);
		if (ret < 0)
			break;
		ret = gnutls_pkcs11_token_get_flags(url, &tflags);
		if (ret < 0) {
			fprintf(stderr, "cannot get token %s flags: %s\n", url, gnutls_strerror(ret));
			exit(1);
		}
		free(url);
	}

	gnutls_global_deinit();
}