/*
 * lftp - file transfer program
 *
 * Copyright (c) 1996-2016 by Alexander V. Lukyanov (lav@yars.free.net)
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

#ifndef LFTP_SSL_H
#define LFTP_SSL_H

#if USE_SSL
# if USE_GNUTLS
#  include <gnutls/gnutls.h>
# elif USE_OPENSSL
#  include <openssl/ssl.h>
#  include <openssl/err.h>
#  include <openssl/rand.h>
#  include <openssl/x509v3.h>
# endif

#include "Ref.h"
#include "xstring.h"

class lftp_ssl_base
{
public:
   bool handshake_done;
   int fd;
   xstring_c hostname;
   enum handshake_mode_t { CLIENT, SERVER } handshake_mode;
   xstring error;
   bool fatal;
   bool cert_error;

   lftp_ssl_base(int fd,handshake_mode_t m,const char *host=0);

   enum code { RETRY=-2, ERROR=-1, DONE=0 };

   void set_error(const char *s1,const char *s2);
   void set_cert_error(const char *s,const xstring& fp);
};

#if USE_GNUTLS

#include <gnutls/x509.h>

#if LFTP_LIBGNUTLS_VERSION_CODE < 0x010201
/* Compatibility defintions for old gnutls */
typedef gnutls_session gnutls_session_t;
typedef gnutls_anon_server_credentials gnutls_anon_server_credentials_t;
typedef gnutls_dh_params gnutls_dh_params_t;
typedef gnutls_certificate_credentials gnutls_certificate_credentials_t;
typedef gnutls_transport_ptr gnutls_transport_ptr_t;
typedef gnutls_x509_crt gnutls_x509_crt_t;
typedef gnutls_x509_crl gnutls_x509_crl_t;
typedef gnutls_x509_crt_fmt gnutls_x509_crt_fmt_t;
typedef gnutls_datum gnutls_datum_t;
#endif

#include "ResMgr.h"
class lftp_ssl_gnutls_instance : public ResClient
{
   gnutls_x509_crl_t *crl_list;
   unsigned crl_list_size;
   gnutls_x509_crt_t *ca_list;
   unsigned ca_list_size;
   friend class lftp_ssl_gnutls;

   void LoadCA();
   void LoadCRL();
public:
   lftp_ssl_gnutls_instance();
   ~lftp_ssl_gnutls_instance();
   void Reconfig(const char *);
};
class lftp_ssl_gnutls : public lftp_ssl_base
{
   static Ref<lftp_ssl_gnutls_instance> instance;
   gnutls_session_t session;
   gnutls_certificate_credentials_t cred;
   void verify_certificate_chain(const gnutls_datum_t *cert_chain,int cert_chain_length);
   void verify_cert2(gnutls_x509_crt_t crt,gnutls_x509_crt_t issuer);
   void verify_last_cert(gnutls_x509_crt_t crt);
   int do_handshake();
   bool check_fatal(int res);
   static const xstring& get_fp(gnutls_x509_crt_t crt);
public:
   static void global_init();
   static void global_deinit();

   lftp_ssl_gnutls(int fd,handshake_mode_t m,const char *host=0);
   ~lftp_ssl_gnutls();

   int read(char *buf,int size);
   int write(const char *buf,int size);
   bool want_in();
   bool want_out();
   void copy_sid(const lftp_ssl_gnutls *);
   void load_keys();
   void shutdown();
};
typedef lftp_ssl_gnutls lftp_ssl;
#elif USE_OPENSSL
class lftp_ssl_openssl_instance {
public:
   SSL_CTX *ssl_ctx;
   X509_STORE *crl_store;
   lftp_ssl_openssl_instance();
   ~lftp_ssl_openssl_instance();
};
class lftp_ssl_openssl : public lftp_ssl_base
{
   static Ref<lftp_ssl_openssl_instance> instance;
   SSL *ssl;
   bool check_fatal(int res);
   int do_handshake();
   const char *strerror();
   static const xstring& get_fp(X509 *crt);
public:
   static int verify_crl(X509_STORE_CTX *ctx);
   static int verify_callback(int ok,X509_STORE_CTX *ctx);
   void check_certificate();

   static void global_init();
   static void global_deinit();

   lftp_ssl_openssl(int fd,handshake_mode_t m,const char *host=0);
   ~lftp_ssl_openssl();

   int read(char *buf,int size);
   int write(const char *buf,int size);
   bool want_in();
   bool want_out();
   void copy_sid(const lftp_ssl_openssl *);
   void load_keys();
   void shutdown();
};
typedef lftp_ssl_openssl lftp_ssl;
#endif

#endif//USE_SSL

#endif//LFTP_SSL_H