/*
 * Copyright (C) 2015 Red Hat, Inc.
 *
 * Author: Nikos Mavrogiannopoulos
 *
 * This file is part of GnuTLS.
 *
 * The GnuTLS is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>
 *
 */

#include "gnutls_int.h"
#include "errors.h"
#include <auth/cert.h>
#include <gnutls/gnutls.h>

/* This file implements the client certificate auto verification functionality.
 */

/* The actual verification callback. */
static int auto_verify_cb(gnutls_session_t session)
{
	unsigned int status;
	int ret;

	if (session->internals.vc_elements == 0) {
		ret = gnutls_certificate_verify_peers2(session, &status);
	} else {
		ret = gnutls_certificate_verify_peers(session, session->internals.vc_data,
						      session->internals.vc_elements, &status);
	}
	if (ret < 0) {
		return gnutls_assert_val(GNUTLS_E_CERTIFICATE_ERROR);
	}

	session->internals.vc_status = status;

	if (status != 0)	/* Certificate is not trusted */
		return gnutls_assert_val(GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR);

	/* notify gnutls to continue handshake normally */
	return 0;
}

/**
 * gnutls_session_set_verify_cert:
 * @session: is a gnutls session
 * @hostname: is the expected name of the peer; may be %NULL
 * @flags: flags for certificate verification -- #gnutls_certificate_verify_flags
 *
 * This function instructs GnuTLS to verify the peer's certificate
 * using the provided hostname. If the verification fails the handshake
 * will also fail with %GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR. In that
 * case the verification result can be obtained using gnutls_session_get_verify_cert_status().
 *
 * The @hostname pointer provided must remain valid for the lifetime
 * of the session. More precisely it should be available during any subsequent
 * handshakes. If no hostname is provided, no hostname verification
 * will be performed. For a more advanced verification function check
 * gnutls_session_set_verify_cert2().
 *
 * If @flags is provided which contain a profile, this function should be
 * called after any session priority setting functions.
 *
 * The gnutls_session_set_verify_cert() function is intended to be used by TLS
 * clients to verify the server's certificate.
 *
 * Since: 3.4.6
 **/
void gnutls_session_set_verify_cert(gnutls_session_t session,
				     const char *hostname, unsigned flags)
{
	if (hostname) {
		session->internals.vc_sdata.type = GNUTLS_DT_DNS_HOSTNAME;
		session->internals.vc_sdata.data = (void*)hostname;
		session->internals.vc_sdata.size = 0;
		session->internals.vc_elements = 1;
		session->internals.vc_data = &session->internals.vc_sdata;
	} else {
		session->internals.vc_elements = 0;
	}

	if (flags) {
		ADD_PROFILE_VFLAGS(session, flags);
	}

	gnutls_session_set_verify_function(session, auto_verify_cb);
}

/**
 * gnutls_session_set_verify_cert2:
 * @session: is a gnutls session
 * @data: an array of typed data
 * @elements: the number of data elements
 * @flags: flags for certificate verification -- #gnutls_certificate_verify_flags
 *
 * This function instructs GnuTLS to verify the peer's certificate
 * using the provided typed data information. If the verification fails the handshake
 * will also fail with %GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR. In that
 * case the verification result can be obtained using gnutls_session_get_verify_cert_status().
 *
 * The acceptable typed data are the same as in gnutls_certificate_verify_peers(),
 * and once set must remain valid for the lifetime of the session. More precisely
 * they should be available during any subsequent handshakes.
 *
 * If @flags is provided which contain a profile, this function should be
 * called after any session priority setting functions.
 *
 * Since: 3.4.6
 **/
void gnutls_session_set_verify_cert2(gnutls_session_t session,
				     gnutls_typed_vdata_st * data,
				     unsigned elements,
				     unsigned flags)
{
	session->internals.vc_data = data;
	session->internals.vc_elements = elements;

	if (flags)
		session->internals.additional_verify_flags |= flags;

	gnutls_session_set_verify_function(session, auto_verify_cb);
}

/**
 * gnutls_session_get_verify_cert_status:
 * @session: is a gnutls session
 *
 * This function returns the status of the verification when initiated
 * via auto-verification, i.e., by gnutls_session_set_verify_cert2() or
 * gnutls_session_set_verify_cert(). If no certificate verification
 * was occurred then the return value would be set to ((unsigned int)-1).
 *
 * The certificate verification status is the same as in gnutls_certificate_verify_peers().
 *
 * Returns: the certificate verification status.
 *
 * Since: 3.4.6
 **/
unsigned int gnutls_session_get_verify_cert_status(gnutls_session_t session)
{
	return session->internals.vc_status;
}