/* Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include <assert.h>

#include <stdio.h>

#include <stdlib.h>

#include <apr_lib.h>

#include <apr_buckets.h>

#include <apr_file_io.h>

#include <apr_strings.h>

#include <openssl/err.h>

#include <openssl/evp.h>

#include <openssl/pem.h>

#include <openssl/rand.h>

#include <openssl/rsa.h>

#include <openssl/x509v3.h>

#include "md.h"

#include "md_crypt.h"

#include "md_json.h"

#include "md_log.h"

#include "md_http.h"

#include "md_util.h"

/* getpid for *NIX */

#if APR_HAVE_SYS_TYPES_H

#include <sys/types.h>

#endif

#if APR_HAVE_UNISTD_H

#include <unistd.h>

#endif

/* getpid for Windows */

#if APR_HAVE_PROCESS_H

#include <process.h>

#endif

#if defined(LIBRESSL_VERSION_NUMBER)

/* Missing from LibreSSL */

#define MD_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)

#else /* defined(LIBRESSL_VERSION_NUMBER) */

#define MD_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)

#endif

static int initialized;

struct md_pkey_t {

    apr_pool_t *pool;

    EVP_PKEY   *pkey;

};

#ifdef MD_HAVE_ARC4RANDOM

static void seed_RAND(int pid)

{

    char seed[128];

    (void)pid;

    arc4random_buf(seed, sizeof(seed));

    RAND_seed(seed, sizeof(seed));

}

#else /* ifdef MD_HAVE_ARC4RANDOM */

static int rand_choosenum(int l, int h)

{

    int i;

    char buf[50];

    apr_snprintf(buf, sizeof(buf), "%.0f",

                 (((double)(rand()%RAND_MAX)/RAND_MAX)*(h-l)));

    i = atoi(buf)+1;

    if (i < l) i = l;

    if (i > h) i = h;

    return i;

}

static void seed_RAND(int pid)

{   

    unsigned char stackdata[256];

    /* stolen from mod_ssl/ssl_engine_rand.c */

    int n;

    struct {

        time_t t;

        pid_t pid;

    } my_seed;

    /*

     * seed in the current time (usually just 4 bytes)

     */

    my_seed.t = time(NULL);

    /*

     * seed in the current process id (usually just 4 bytes)

     */

    my_seed.pid = pid;

    RAND_seed((unsigned char *)&my_seed, sizeof(my_seed));

    /*

     * seed in some current state of the run-time stack (128 bytes)

     */

    n = rand_choosenum(0, sizeof(stackdata)-128-1);

    RAND_seed(stackdata+n, 128);

}

#endif /*ifdef MD_HAVE_ARC4RANDOM (else part) */

apr_status_t md_crypt_init(apr_pool_t *pool)

{

    (void)pool;

    if (!initialized) {

        int pid = getpid();

        ERR_load_crypto_strings();

        OpenSSL_add_all_algorithms();

        md_log_perror(MD_LOG_MARK, MD_LOG_TRACE2, 0, pool, "initializing RAND"); 

        while (!RAND_status()) {

            seed_RAND(pid);

	}

        initialized = 1;

    }

    return APR_SUCCESS;

}

typedef struct {

    char *data;

    apr_size_t len;

} buffer_rec;

static apr_status_t fwrite_buffer(void *baton, apr_file_t *f, apr_pool_t *p) 

{

    buffer_rec *buf = baton;

    (void)p;

    return apr_file_write_full(f, buf->data, buf->len, &buf->len);

}

apr_status_t md_rand_bytes(unsigned char *buf, apr_size_t len, apr_pool_t *p)

{

    apr_status_t rv;

    if (len > INT_MAX) {

        return APR_ENOTIMPL;

    }

    if (APR_SUCCESS == (rv = md_crypt_init(p))) {

        RAND_bytes((unsigned char*)buf, (int)len);

    }

    return rv;

}

typedef struct {

    const char *pass_phrase;

    int pass_len;

} passwd_ctx;

static int pem_passwd(char *buf, int size, int rwflag, void *baton)

{

    passwd_ctx *ctx = baton;

    (void)rwflag;

    if (ctx->pass_len > 0) {

        if (ctx->pass_len < size) {

            size = (int)ctx->pass_len;

        }

        memcpy(buf, ctx->pass_phrase, (size_t)size);

    }

    return ctx->pass_len;

}

/**************************************************************************************************/

/* date time things */

/* Get the apr time (micro seconds, since 1970) from an ASN1 time, as stored in X509

 * certificates. OpenSSL now has a utility function, but other *SSL derivatives have

 * not caughts up yet or chose to ignore. An alternative is implemented, we prefer 

 * however the *SSL to maintain such things.

 */

static apr_time_t md_asn1_time_get(const ASN1_TIME* time)

{

#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)

    /* courtesy: https://stackoverflow.com/questions/10975542/asn1-time-to-time-t-conversion#11263731

     * all bugs are mine */

    apr_time_exp_t t;

    apr_time_t ts;

    const char* str = (const char*) time->data;

    apr_size_t i = 0;

    memset(&t, 0, sizeof(t));

    if (time->type == V_ASN1_UTCTIME) {/* two digit year */

        t.tm_year = (str[i++] - '0') * 10;

        t.tm_year += (str[i++] - '0');

        if (t.tm_year < 70)

            t.tm_year += 100;

    } 

    else if (time->type == V_ASN1_GENERALIZEDTIME) {/* four digit year */

        t.tm_year = (str[i++] - '0') * 1000;

        t.tm_year+= (str[i++] - '0') * 100;

        t.tm_year+= (str[i++] - '0') * 10;

        t.tm_year+= (str[i++] - '0');

        t.tm_year -= 1900;

    }

    t.tm_mon  = (str[i++] - '0') * 10;

    t.tm_mon += (str[i++] - '0') - 1; /* -1 since January is 0 not 1. */

    t.tm_mday = (str[i++] - '0') * 10;

    t.tm_mday+= (str[i++] - '0');

    t.tm_hour = (str[i++] - '0') * 10;

    t.tm_hour+= (str[i++] - '0');

    t.tm_min  = (str[i++] - '0') * 10;

    t.tm_min += (str[i++] - '0');

    t.tm_sec  = (str[i++] - '0') * 10;

    t.tm_sec += (str[i++] - '0');

    if (APR_SUCCESS == apr_time_exp_gmt_get(&ts, &t)) {

        return ts;

    }

    return 0;

#else 

    int secs, days;

    apr_time_t ts = apr_time_now();

    if (ASN1_TIME_diff(&days, &secs, NULL, time)) {

        ts += apr_time_from_sec((days * MD_SECS_PER_DAY) + secs); 

    }

    return ts;

#endif

}

/**************************************************************************************************/

/* private keys */

md_json_t *md_pkey_spec_to_json(const md_pkey_spec_t *spec, apr_pool_t *p)

{

    md_json_t *json = md_json_create(p);

    if (json) {

        switch (spec->type) {

            case MD_PKEY_TYPE_DEFAULT:

                md_json_sets("Default", json, MD_KEY_TYPE, NULL);

                break;

            case MD_PKEY_TYPE_RSA:

                md_json_sets("RSA", json, MD_KEY_TYPE, NULL);

                if (spec->params.rsa.bits >= MD_PKEY_RSA_BITS_MIN) {

                    md_json_setl((long)spec->params.rsa.bits, json, MD_KEY_BITS, NULL);

                }

                break;

            default:

                md_json_sets("Unsupported", json, MD_KEY_TYPE, NULL);

                break;

        }

    }

    return json;    

}

md_pkey_spec_t *md_pkey_spec_from_json(struct md_json_t *json, apr_pool_t *p)

{

    md_pkey_spec_t *spec = apr_pcalloc(p, sizeof(*spec));

    const char *s;

    long l;

    if (spec) {

        s = md_json_gets(json, MD_KEY_TYPE, NULL);

        if (!s || !apr_strnatcasecmp("Default", s)) {

            spec->type = MD_PKEY_TYPE_DEFAULT;

        }

        else if (!apr_strnatcasecmp("RSA", s)) {

            spec->type = MD_PKEY_TYPE_RSA;

            l = md_json_getl(json, MD_KEY_BITS, NULL);

            if (l >= MD_PKEY_RSA_BITS_MIN) {

                spec->params.rsa.bits = (unsigned int)l;

            }

            else {

                spec->params.rsa.bits = MD_PKEY_RSA_BITS_DEF;

            }

        }

    }

    return spec;

}

int md_pkey_spec_eq(md_pkey_spec_t *spec1, md_pkey_spec_t *spec2)

{

    if (spec1 == spec2) {

        return 1;

    }

    if (spec1 && spec2 && spec1->type == spec2->type) {

        switch (spec1->type) {

            case MD_PKEY_TYPE_DEFAULT:

                return 1;

            case MD_PKEY_TYPE_RSA:

                if (spec1->params.rsa.bits == spec2->params.rsa.bits) {

                    return 1;

                }

                break;

        }

    }

    return 0;

}

static md_pkey_t *make_pkey(apr_pool_t *p) 

{

    md_pkey_t *pkey = apr_pcalloc(p, sizeof(*pkey));

    pkey->pool = p;

    return pkey;

}

static apr_status_t pkey_cleanup(void *data)

{

    md_pkey_t *pkey = data;

    if (pkey->pkey) {

        EVP_PKEY_free(pkey->pkey);

        pkey->pkey = NULL;

    }

    return APR_SUCCESS;

}

void md_pkey_free(md_pkey_t *pkey)

{

    pkey_cleanup(pkey);

}

void *md_pkey_get_EVP_PKEY(struct md_pkey_t *pkey)

{

    return pkey->pkey;

}

apr_status_t md_pkey_fload(md_pkey_t **ppkey, apr_pool_t *p, 

                           const char *key, apr_size_t key_len,

                           const char *fname)

{

    apr_status_t rv = APR_ENOENT;

    md_pkey_t *pkey;

    BIO *bf;

    passwd_ctx ctx;

    pkey =  make_pkey(p);

    if (NULL != (bf = BIO_new_file(fname, "r"))) {

        ctx.pass_phrase = key;

        ctx.pass_len = (int)key_len;

        ERR_clear_error();

        pkey->pkey = PEM_read_bio_PrivateKey(bf, NULL, pem_passwd, &ctx;;

        BIO_free(bf);

        if (pkey->pkey != NULL) {

            rv = APR_SUCCESS;

            apr_pool_cleanup_register(p, pkey, pkey_cleanup, apr_pool_cleanup_null);

        }

        else {

            unsigned long err = ERR_get_error();

            rv = APR_EINVAL;

            md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, rv, p, 

                          "error loading pkey %s: %s (pass phrase was %snull)", fname,

                          ERR_error_string(err, NULL), key? "not " : ""); 

        }

    }

    *ppkey = (APR_SUCCESS == rv)? pkey : NULL;

    return rv;

}

static apr_status_t pkey_to_buffer(buffer_rec *buffer, md_pkey_t *pkey, apr_pool_t *p,

                                   const char *pass, apr_size_t pass_len)

{

    BIO *bio = BIO_new(BIO_s_mem());

    const EVP_CIPHER *cipher = NULL;

    pem_password_cb *cb = NULL;

    void *cb_baton = NULL;

    passwd_ctx ctx;

    unsigned long err;

    int i;

    if (!bio) {

        return APR_ENOMEM;

    }

    if (pass_len > INT_MAX) {

        return APR_EINVAL;

    }

    if (pass && pass_len > 0) {

        ctx.pass_phrase = pass;

        ctx.pass_len = (int)pass_len;

        cb = pem_passwd;

        cb_baton = &ctx;

        cipher = EVP_aes_256_cbc();

        if (!cipher) {

            return APR_ENOTIMPL;

        }

    }

    ERR_clear_error();

    if (!PEM_write_bio_PrivateKey(bio, pkey->pkey, cipher, NULL, 0, cb, cb_baton)) {

        BIO_free(bio);

        err = ERR_get_error();

        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, p, "PEM_write key: %ld %s", 

                      err, ERR_error_string(err, NULL)); 

        return APR_EINVAL;

    }

    i = BIO_pending(bio);

    if (i > 0) {

        buffer->data = apr_palloc(p, (apr_size_t)i + 1);

        i = BIO_read(bio, buffer->data, i);

        buffer->data[i] = '\0';

        buffer->len = (apr_size_t)i;

    }

    BIO_free(bio);

    return APR_SUCCESS;

}

apr_status_t md_pkey_fsave(md_pkey_t *pkey, apr_pool_t *p, 

                           const char *pass_phrase, apr_size_t pass_len,

                           const char *fname, apr_fileperms_t perms)

{

    buffer_rec buffer;

    apr_status_t rv;

    if (APR_SUCCESS == (rv = pkey_to_buffer(&buffer, pkey, p, pass_phrase, pass_len))) {

        return md_util_freplace(fname, perms, p, fwrite_buffer, &buffer); 

    }

    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, "save pkey %s (%s pass phrase, len=%d)",

                  fname, pass_len > 0? "with" : "without", (int)pass_len); 

    return rv;

}

static apr_status_t gen_rsa(md_pkey_t **ppkey, apr_pool_t *p, unsigned int bits)

{

    EVP_PKEY_CTX *ctx = NULL;

    apr_status_t rv;

    *ppkey = make_pkey(p);

    ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);

    if (ctx 

        && EVP_PKEY_keygen_init(ctx) >= 0

        && EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, (int)bits) >= 0

        && EVP_PKEY_keygen(ctx, &(*ppkey)->pkey) >= 0) {

        rv = APR_SUCCESS;

    }

    else {

        md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, 0, p, "error generate pkey RSA %d", bits); 

        *ppkey = NULL;

        rv = APR_EGENERAL;

    }

    if (ctx != NULL) {

        EVP_PKEY_CTX_free(ctx);

    }

    return rv;

}

apr_status_t md_pkey_gen(md_pkey_t **ppkey, apr_pool_t *p, md_pkey_spec_t *spec)

{

    md_pkey_type_t ptype = spec? spec->type : MD_PKEY_TYPE_DEFAULT;

    switch (ptype) {

        case MD_PKEY_TYPE_DEFAULT:

            return gen_rsa(ppkey, p, MD_PKEY_RSA_BITS_DEF);

        case MD_PKEY_TYPE_RSA:

            return gen_rsa(ppkey, p, spec->params.rsa.bits);

        default:

            return APR_ENOTIMPL;

    }

}

#if MD_USE_OPENSSL_PRE_1_1_API || (defined(LIBRESSL_VERSION_NUMBER) && \

                                   LIBRESSL_VERSION_NUMBER < 0x2070000f)

#ifndef NID_tlsfeature

#define NID_tlsfeature          1020

#endif

static void RSA_get0_key(const RSA *r,

                         const BIGNUM **n, const BIGNUM **e, const BIGNUM **d)

{

    if (n != NULL)

        *n = r->n;

    if (e != NULL)

        *e = r->e;

    if (d != NULL)

        *d = r->d;

}

#endif

static const char *bn64(const BIGNUM *b, apr_pool_t *p) 

{

    if (b) {

         apr_size_t len = (apr_size_t)BN_num_bytes(b);

         char *buffer = apr_pcalloc(p, len);

         if (buffer) {

            BN_bn2bin(b, (unsigned char *)buffer);

            return md_util_base64url_encode(buffer, len, p);

         }

    }

    return NULL;

}

const char *md_pkey_get_rsa_e64(md_pkey_t *pkey, apr_pool_t *p)

{

    const BIGNUM *e;

    RSA *rsa = EVP_PKEY_get1_RSA(pkey->pkey);

    if (!rsa) {

        return NULL;

    }

    RSA_get0_key(rsa, NULL, &e, NULL);

    return bn64(e, p);

}

const char *md_pkey_get_rsa_n64(md_pkey_t *pkey, apr_pool_t *p)

{

    const BIGNUM *n;

    RSA *rsa = EVP_PKEY_get1_RSA(pkey->pkey);

    if (!rsa) {

        return NULL;

    }

    RSA_get0_key(rsa, &n, NULL, NULL);

    return bn64(n, p);

}

apr_status_t md_crypt_sign64(const char **psign64, md_pkey_t *pkey, apr_pool_t *p, 

                             const char *d, size_t dlen)

{

    EVP_MD_CTX *ctx = NULL;

    char *buffer;

    unsigned int blen;

    const char *sign64 = NULL;

    apr_status_t rv = APR_ENOMEM;

    buffer = apr_pcalloc(p, (apr_size_t)EVP_PKEY_size(pkey->pkey));

    if (buffer) {

        ctx = EVP_MD_CTX_create();

        if (ctx) {

            rv = APR_ENOTIMPL;

            if (EVP_SignInit_ex(ctx, EVP_sha256(), NULL)) {

                rv = APR_EGENERAL;

                if (EVP_SignUpdate(ctx, d, dlen)) {

                    if (EVP_SignFinal(ctx, (unsigned char*)buffer, &blen, pkey->pkey)) {

                        sign64 = md_util_base64url_encode(buffer, blen, p);

                        if (sign64) {

                            rv = APR_SUCCESS;

                        }

                    }

                }

            }

        }

        if (ctx) {

            EVP_MD_CTX_destroy(ctx);

        }

    }

    if (rv != APR_SUCCESS) {

        md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, rv, p, "signing"); 

    }

    *psign64 = sign64;

    return rv;

}

static apr_status_t sha256_digest(unsigned char **pdigest, size_t *pdigest_len,

                                  apr_pool_t *p, const char *d, size_t dlen)

{

    EVP_MD_CTX *ctx = NULL;

    unsigned char *buffer;

    apr_status_t rv = APR_ENOMEM;

    unsigned int blen;

    buffer = apr_pcalloc(p, EVP_MAX_MD_SIZE);

    if (buffer) {

        ctx = EVP_MD_CTX_create();

        if (ctx) {

            rv = APR_ENOTIMPL;

            if (EVP_DigestInit_ex(ctx, EVP_sha256(), NULL)) {

                rv = APR_EGENERAL;

                if (EVP_DigestUpdate(ctx, d, dlen)) {

                    if (EVP_DigestFinal(ctx, buffer, &blen)) {

                        rv = APR_SUCCESS;

                    }

                }

            }

        }

        if (ctx) {

            EVP_MD_CTX_destroy(ctx);

        }

    }

    if (APR_SUCCESS == rv) {

        *pdigest = buffer;

        *pdigest_len = blen;

    }

    else {

        md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, rv, p, "digest"); 

        *pdigest = NULL;

        *pdigest_len = 0;

    }

    return rv;

}

apr_status_t md_crypt_sha256_digest64(const char **pdigest64, apr_pool_t *p, 

                                      const char *d, size_t dlen)

{

    const char *digest64 = NULL;

    unsigned char *buffer;

    size_t blen;

    apr_status_t rv;

    if (APR_SUCCESS == (rv = sha256_digest(&buffer, &blen, p, d, dlen))) {

        if (NULL == (digest64 = md_util_base64url_encode((const char*)buffer, blen, p))) {

            rv = APR_EGENERAL;

        }

    }

    *pdigest64 = digest64;

    return rv;

}

static const char * const hex_const[] = {

    "00", "01", "02", "03", "04", "05", "06", "07", "08", "09", "0a", "0b", "0c", "0d", "0e", "0f", 

    "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "1a", "1b", "1c", "1d", "1e", "1f", 

    "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "2a", "2b", "2c", "2d", "2e", "2f", 

    "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "3a", "3b", "3c", "3d", "3e", "3f", 

    "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "4a", "4b", "4c", "4d", "4e", "4f", 

    "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "5a", "5b", "5c", "5d", "5e", "5f", 

    "60", "61", "62", "63", "64", "65", "66", "67", "68", "69", "6a", "6b", "6c", "6d", "6e", "6f", 

    "70", "71", "72", "73", "74", "75", "76", "77", "78", "79", "7a", "7b", "7c", "7d", "7e", "7f", 

    "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "8a", "8b", "8c", "8d", "8e", "8f", 

    "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "9a", "9b", "9c", "9d", "9e", "9f", 

    "a0", "a1", "a2", "a3", "a4", "a5", "a6", "a7", "a8", "a9", "aa", "ab", "ac", "ad", "ae", "af", 

    "b0", "b1", "b2", "b3", "b4", "b5", "b6", "b7", "b8", "b9", "ba", "bb", "bc", "bd", "be", "bf", 

    "c0", "c1", "c2", "c3", "c4", "c5", "c6", "c7", "c8", "c9", "ca", "cb", "cc", "cd", "ce", "cf", 

    "d0", "d1", "d2", "d3", "d4", "d5", "d6", "d7", "d8", "d9", "da", "db", "dc", "dd", "de", "df", 

    "e0", "e1", "e2", "e3", "e4", "e5", "e6", "e7", "e8", "e9", "ea", "eb", "ec", "ed", "ee", "ef", 

    "f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7", "f8", "f9", "fa", "fb", "fc", "fd", "fe", "ff", 

};

apr_status_t md_crypt_sha256_digest_hex(const char **pdigesthex, apr_pool_t *p, 

                                        const char *d, size_t dlen)

{

    char *dhex = NULL, *cp;

    const char * x;

    unsigned char *buffer;

    size_t blen;

    apr_status_t rv;

    unsigned int i;

    if (APR_SUCCESS == (rv = sha256_digest(&buffer, &blen, p, d, dlen))) {

        cp = dhex = apr_pcalloc(p,  2 * blen + 1);

        if (!dhex) {

            rv = APR_EGENERAL;

        }

        for (i = 0; i < blen; ++i, cp += 2) {

            x = hex_const[buffer[i]];

            cp[0] = x[0];

            cp[1] = x[1];

        }

    }

    *pdigesthex = dhex;

    return rv;

}

/**************************************************************************************************/

/* certificates */

struct md_cert_t {

    apr_pool_t *pool;

    X509 *x509;

    apr_array_header_t *alt_names;

};

static apr_status_t cert_cleanup(void *data)

{

    md_cert_t *cert = data;

    if (cert->x509) {

        X509_free(cert->x509);

        cert->x509 = NULL;

    }

    return APR_SUCCESS;

}

static md_cert_t *make_cert(apr_pool_t *p, X509 *x509) 

{

    md_cert_t *cert = apr_pcalloc(p, sizeof(*cert));

    cert->pool = p;

    cert->x509 = x509;

    apr_pool_cleanup_register(p, cert, cert_cleanup, apr_pool_cleanup_null);

    return cert;

}

void md_cert_free(md_cert_t *cert)

{

    cert_cleanup(cert);

}

void *md_cert_get_X509(struct md_cert_t *cert)

{

    return cert->x509;

}

int md_cert_is_valid_now(const md_cert_t *cert)

{

    return ((X509_cmp_current_time(X509_get_notBefore(cert->x509)) < 0)

            && (X509_cmp_current_time(X509_get_notAfter(cert->x509)) > 0));

}

int md_cert_has_expired(const md_cert_t *cert)

{

    return (X509_cmp_current_time(X509_get_notAfter(cert->x509)) <= 0);

}

apr_time_t md_cert_get_not_after(md_cert_t *cert)

{

    return md_asn1_time_get(X509_get_notAfter(cert->x509));

}

apr_time_t md_cert_get_not_before(md_cert_t *cert)

{

    return md_asn1_time_get(X509_get_notBefore(cert->x509));

}

int md_cert_covers_domain(md_cert_t *cert, const char *domain_name)

{

    if (!cert->alt_names) {

        md_cert_get_alt_names(&cert->alt_names, cert, cert->pool);

    }

    if (cert->alt_names) {

        return md_array_str_index(cert->alt_names, domain_name, 0, 0) >= 0;

    }

    return 0;

}

int md_cert_covers_md(md_cert_t *cert, const md_t *md)

{

    const char *name;

    int i;

    if (!cert->alt_names) {

        md_cert_get_alt_names(&cert->alt_names, cert, cert->pool);

    }

    if (cert->alt_names) {

        md_log_perror(MD_LOG_MARK, MD_LOG_TRACE4, 0, cert->pool, "cert has %d alt names",

                      cert->alt_names->nelts); 

        for (i = 0; i < md->domains->nelts; ++i) {

            name = APR_ARRAY_IDX(md->domains, i, const char *);

            if (md_array_str_index(cert->alt_names, name, 0, 0) < 0) {

                md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, 0, cert->pool, 

                              "md domain %s not covered by cert", name);

                return 0;

            }

        }

        return 1;

    }

    else {

        md_log_perror(MD_LOG_MARK, MD_LOG_WARNING, 0, cert->pool, "cert has NO alt names");

    }

    return 0;

}

apr_status_t md_cert_get_issuers_uri(const char **puri, md_cert_t *cert, apr_pool_t *p)

{

    apr_status_t rv = APR_ENOENT;

    STACK_OF(ACCESS_DESCRIPTION) *xinfos;

    const char *uri = NULL;

    unsigned char *buf;

    int i;

    xinfos = X509_get_ext_d2i(cert->x509, NID_info_access, NULL, NULL);

    if (xinfos) {

        for (i = 0; i < sk_ACCESS_DESCRIPTION_num(xinfos); i++) {

            ACCESS_DESCRIPTION *val = sk_ACCESS_DESCRIPTION_value(xinfos, i);

            if (OBJ_obj2nid(val->method) == NID_ad_ca_issuers

                    && val->location && val->location->type == GEN_URI) {

                ASN1_STRING_to_UTF8(&buf, val->location->d.uniformResourceIdentifier);

                uri = apr_pstrdup(p, (char *)buf);

                OPENSSL_free(buf);

                rv = APR_SUCCESS;

                break;

            }

        }

        sk_ACCESS_DESCRIPTION_pop_free(xinfos, ACCESS_DESCRIPTION_free);

    } 

    *puri = (APR_SUCCESS == rv)? uri : NULL;

    return rv;

}

apr_status_t md_cert_get_alt_names(apr_array_header_t **pnames, md_cert_t *cert, apr_pool_t *p)

{

    apr_array_header_t *names;

    apr_status_t rv = APR_ENOENT;

    STACK_OF(GENERAL_NAME) *xalt_names;

    unsigned char *buf;

    int i;

    xalt_names = X509_get_ext_d2i(cert->x509, NID_subject_alt_name, NULL, NULL);

    if (xalt_names) {

        GENERAL_NAME *cval;

        names = apr_array_make(p, sk_GENERAL_NAME_num(xalt_names), sizeof(char *));

        for (i = 0; i < sk_GENERAL_NAME_num(xalt_names); ++i) {

            cval = sk_GENERAL_NAME_value(xalt_names, i);

            switch (cval->type) {

                case GEN_DNS:

                case GEN_URI:

                case GEN_IPADD:

                    ASN1_STRING_to_UTF8(&buf, cval->d.ia5);

                    APR_ARRAY_PUSH(names, const char *) = apr_pstrdup(p, (char*)buf);

                    OPENSSL_free(buf);

                    break;

                default:

                    break;

            }

        }

        sk_GENERAL_NAME_pop_free(xalt_names, GENERAL_NAME_free);

        rv = APR_SUCCESS;

    }

    *pnames = (APR_SUCCESS == rv)? names : NULL;

    return rv;

}

apr_status_t md_cert_fload(md_cert_t **pcert, apr_pool_t *p, const char *fname)

{

    FILE *f;

    apr_status_t rv;

    md_cert_t *cert;

    X509 *x509;

    rv = md_util_fopen(&f, fname, "r");

    if (rv == APR_SUCCESS) {

        x509 = PEM_read_X509(f, NULL, NULL, NULL);

        rv = fclose(f);

        if (x509 != NULL) {

            cert =  make_cert(p, x509);

        }

        else {

            rv = APR_EINVAL;

        }

    }

    *pcert = (APR_SUCCESS == rv)? cert : NULL;

    return rv;

}

static apr_status_t cert_to_buffer(buffer_rec *buffer, md_cert_t *cert, apr_pool_t *p)

{

    BIO *bio = BIO_new(BIO_s_mem());

    int i;

    if (!bio) {

        return APR_ENOMEM;

    }

    ERR_clear_error();

    PEM_write_bio_X509(bio, cert->x509);

    if (ERR_get_error() > 0) {

        BIO_free(bio);

        return APR_EINVAL;

    }

    i = BIO_pending(bio);

    if (i > 0) {

        buffer->data = apr_palloc(p, (apr_size_t)i + 1);