/* Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#ifndef mod_md_md_h

#define mod_md_md_h

#include "md_version.h"

struct apr_array_header_t;

struct apr_hash_t;

struct md_json_t;

struct md_cert_t;

struct md_pkey_t;

struct md_store_t;

struct md_srv_conf_t;

struct md_pkey_spec_t;

#define MD_TLSSNI01_DNS_SUFFIX     ".acme.invalid"

#define MD_PKEY_RSA_BITS_MIN       2048

#define MD_PKEY_RSA_BITS_DEF       2048

/* Minimum age for the HSTS header (RFC 6797), considered appropriate by Mozilla Security */

#define MD_HSTS_HEADER             "Strict-Transport-Security"

#define MD_HSTS_MAX_AGE_DEFAULT    15768000

typedef enum {

    MD_S_UNKNOWN,                   /* MD has not been analysed yet */

    MD_S_INCOMPLETE,                /* MD is missing necessary information, cannot go live */

    MD_S_COMPLETE,                  /* MD has all necessary information, can go live */

    MD_S_EXPIRED,                   /* MD is complete, but credentials have expired */

    MD_S_ERROR,                     /* MD data is flawed, unable to be processed as is */ 

    MD_S_MISSING,                   /* MD is missing config information, cannot proceed */

} md_state_t;

typedef enum {

    MD_REQUIRE_UNSET = -1,

    MD_REQUIRE_OFF,

    MD_REQUIRE_TEMPORARY,

    MD_REQUIRE_PERMANENT,

} md_require_t;

typedef enum {

    MD_SV_TEXT,

    MD_SV_JSON,

    MD_SV_CERT,

    MD_SV_PKEY,

    MD_SV_CHAIN,

} md_store_vtype_t;

typedef enum {

    MD_SG_NONE,

    MD_SG_ACCOUNTS,

    MD_SG_CHALLENGES,

    MD_SG_DOMAINS,

    MD_SG_STAGING,

    MD_SG_ARCHIVE,

    MD_SG_TMP,

    MD_SG_COUNT,

} md_store_group_t;

typedef enum {

    MD_DRIVE_DEFAULT = -1,          /* default value */

    MD_DRIVE_MANUAL,                /* manually triggered transmission of credentials */

    MD_DRIVE_AUTO,                  /* automatic process performed by httpd */

    MD_DRIVE_ALWAYS,                /* always driven by httpd, even if not used in any vhost */

} md_drive_mode_t;

typedef struct md_t md_t;

struct md_t {

    const char *name;               /* unique name of this MD */

    struct apr_array_header_t *domains; /* all DNS names this MD includes */

    struct apr_array_header_t *contacts;   /* list of contact uris, e.g. mailto:xxx */

    int transitive;                 /* != 0 iff VirtualHost names/aliases are auto-added */

    md_require_t require_https;     /* Iff https: is required for this MD */

    int drive_mode;                 /* mode of obtaining credentials */

    struct md_pkey_spec_t *pkey_spec;/* specification for generating new private keys */

    int must_staple;                /* certificates should set the OCSP Must Staple extension */

    apr_interval_time_t renew_norm; /* if > 0, normalized cert lifetime */

    apr_interval_time_t renew_window;/* time before expiration that starts renewal */

    const char *ca_url;             /* url of CA certificate service */

    const char *ca_proto;           /* protocol used vs CA (e.g. ACME) */

    const char *ca_account;         /* account used at CA */

    const char *ca_agreement;       /* accepted agreement uri between CA and user */ 

    struct apr_array_header_t *ca_challenges; /* challenge types configured for this MD */

    md_state_t state;               /* state of this MD */

    apr_time_t valid_from;          /* When the credentials start to be valid. 0 if unknown */

    apr_time_t expires;             /* When the credentials expire. 0 if unknown */

    const char *cert_url;           /* url where cert has been created, remember during drive */ 

    const struct md_srv_conf_t *sc; /* server config where it was defined or NULL */

    const char *defn_name;          /* config file this MD was defined */

    unsigned defn_line_number;      /* line number of definition */

};

#define MD_KEY_ACCOUNT          "account"

#define MD_KEY_AGREEMENT        "agreement"

#define MD_KEY_BITS             "bits"

#define MD_KEY_CA               "ca"

#define MD_KEY_CA_URL           "ca-url"

#define MD_KEY_CERT             "cert"

#define MD_KEY_CHALLENGES       "challenges"

#define MD_KEY_CONTACT          "contact"

#define MD_KEY_CONTACTS         "contacts"

#define MD_KEY_CSR              "csr"

#define MD_KEY_DETAIL           "detail"

#define MD_KEY_DISABLED         "disabled"

#define MD_KEY_DIR              "dir"

#define MD_KEY_DOMAIN           "domain"

#define MD_KEY_DOMAINS          "domains"

#define MD_KEY_DRIVE_MODE       "drive-mode"

#define MD_KEY_ERRORS           "errors"

#define MD_KEY_EXPIRES          "expires"

#define MD_KEY_HTTP             "http"

#define MD_KEY_HTTPS            "https"

#define MD_KEY_ID               "id"

#define MD_KEY_IDENTIFIER       "identifier"

#define MD_KEY_KEY              "key"

#define MD_KEY_KEYAUTHZ         "keyAuthorization"

#define MD_KEY_LOCATION         "location"

#define MD_KEY_MUST_STAPLE      "must-staple"

#define MD_KEY_NAME             "name"

#define MD_KEY_PERMANENT        "permanent"

#define MD_KEY_PKEY             "privkey"

#define MD_KEY_PROCESSED        "processed"

#define MD_KEY_PROTO            "proto"

#define MD_KEY_REGISTRATION     "registration"

#define MD_KEY_RENEW            "renew"

#define MD_KEY_RENEW_WINDOW     "renew-window"

#define MD_KEY_REQUIRE_HTTPS    "require-https"

#define MD_KEY_RESOURCE         "resource"

#define MD_KEY_STATE            "state"

#define MD_KEY_STATUS           "status"

#define MD_KEY_STORE            "store"

#define MD_KEY_TEMPORARY        "temporary"

#define MD_KEY_TOKEN            "token"

#define MD_KEY_TRANSITIVE       "transitive"

#define MD_KEY_TYPE             "type"

#define MD_KEY_URL              "url"

#define MD_KEY_URI              "uri"

#define MD_KEY_VALID_FROM       "validFrom"

#define MD_KEY_VALUE            "value"

#define MD_KEY_VERSION          "version"

#define MD_FN_MD                "md.json"

#define MD_FN_JOB               "job.json"

#define MD_FN_PRIVKEY           "privkey.pem"

#define MD_FN_PUBCERT           "pubcert.pem"

#define MD_FN_CERT              "cert.pem"

#define MD_FN_CHAIN             "chain.pem"

#define MD_FN_HTTPD_JSON        "httpd.json"

#define MD_FN_FALLBACK_PKEY     "fallback-privkey.pem"

#define MD_FN_FALLBACK_CERT     "fallback-cert.pem"

/* Check if a string member of a new MD (n) has 

 * a value and if it differs from the old MD o

 */

#define MD_VAL_UPDATE(n,o,s)    ((n)->s != (o)->s)

#define MD_SVAL_UPDATE(n,o,s)   ((n)->s && (!(o)->s || strcmp((n)->s, (o)->s)))

/**

 * Determine if the Managed Domain contains a specific domain name.

 */

int md_contains(const md_t *md, const char *domain, int case_sensitive);

/**

 * Determine if the names of the two managed domains overlap.

 */

int md_domains_overlap(const md_t *md1, const md_t *md2);

/**

 * Determine if the domain names are equal.

 */

int md_equal_domains(const md_t *md1, const md_t *md2, int case_sensitive);

/**

 * Determine if the domains in md1 contain all domains of md2.

 */

int md_contains_domains(const md_t *md1, const md_t *md2);

/**

 * Get one common domain name of the two managed domains or NULL.

 */

const char *md_common_name(const md_t *md1, const md_t *md2);

/**

 * Get the number of common domains.

 */

apr_size_t md_common_name_count(const md_t *md1, const md_t *md2);

/**

 * Look up a managed domain by its name.

 */

md_t *md_get_by_name(struct apr_array_header_t *mds, const char *name);

/**

 * Look up a managed domain by a DNS name it contains.

 */

md_t *md_get_by_domain(struct apr_array_header_t *mds, const char *domain);

/**

 * Find a managed domain, different from the given one, that has overlaps

 * in the domain list.

 */

md_t *md_get_by_dns_overlap(struct apr_array_header_t *mds, const md_t *md);

/**

 * Find the managed domain in the list that, for the given md, 

 * has the same name, or the most number of overlaps in domains

 */

md_t *md_find_closest_match(apr_array_header_t *mds, const md_t *md);

/**

 * Create and empty md record, structures initialized.

 */

md_t *md_create_empty(apr_pool_t *p);

/**

 * Create a managed domain, given a list of domain names.

 */

md_t *md_create(apr_pool_t *p, struct apr_array_header_t *domains);

/**

 * Deep copy an md record into another pool.

 */

md_t *md_clone(apr_pool_t *p, const md_t *src);

/**

 * Shallow copy an md record into another pool.

 */

md_t *md_copy(apr_pool_t *p, const md_t *src);

/**

 * Create a merged md with the settings of add overlaying the ones from base.

 */

md_t *md_merge(apr_pool_t *p, const md_t *add, const md_t *base);

/** 

 * Convert the managed domain into a JSON representation and vice versa. 

 *

 * This reads and writes the following information: name, domains, ca_url, ca_proto and state.

 */

struct md_json_t *md_to_json (const md_t *md, apr_pool_t *p);

md_t *md_from_json(struct md_json_t *json, apr_pool_t *p);

/**

 * Determine if MD should renew its cert (if it has one)

 */

int md_should_renew(const md_t *md);

/**************************************************************************************************/

/* domain credentials */

typedef struct md_creds_t md_creds_t;

struct md_creds_t {

    struct md_pkey_t *privkey;

    struct apr_array_header_t *pubcert;    /* complete md_cert* chain */

    struct md_cert_t *cert;

    int expired;

};

/* TODO: not sure this is a good idea, testing some readability and debuggabiltiy of

 * cascaded apr_status_t checks. */

#define MD_CHK_VARS                 const char *md_chk_

#define MD_LAST_CHK                 md_chk_

#define MD_CHK_STEP(c, status, s)   (md_chk_ = s, (void)md_chk_, status == (rv = (c)))

#define MD_CHK(c, status)           MD_CHK_STEP(c, status, #c)

#define MD_IS_ERR(c, err)           (md_chk_ = #c, APR_STATUS_IS_##err((rv = (c))))

#define MD_CHK_SUCCESS(c)           MD_CHK(c, APR_SUCCESS)

#define MD_OK(c)                    MD_CHK_SUCCESS(c)

#endif /* mod_md_md_h */