/*

 * Portions of this file are subject to the following copyright(s).  See

 * the Net-SNMP's COPYING file for more details and other copyrights

 * that may apply:

 *

 * Portions of this file are copyrighted by:

 * Copyright (c) 2016 VMware, Inc. All rights reserved.

 * Use is subject to license terms specified in the COPYING file

 * distributed with the Net-SNMP package.

 */

#include <net-snmp/net-snmp-config.h>

#include <net-snmp/net-snmp-features.h>

#if defined(NETSNMP_USE_OPENSSL) && defined(HAVE_LIBSSL) && NETSNMP_TRANSPORT_TLSBASE_DOMAIN

netsnmp_feature_child_of(cert_util_all, libnetsnmp)

netsnmp_feature_child_of(cert_util, cert_util_all)

#ifdef NETSNMP_FEATURE_REQUIRE_CERT_UTIL

netsnmp_feature_require(container_directory)

netsnmp_feature_require(container_fifo)

netsnmp_feature_require(container_dup)

netsnmp_feature_require(container_free_all)

netsnmp_feature_require(subcontainer_find)

netsnmp_feature_child_of(cert_map_remove, netsnmp_unused)

netsnmp_feature_child_of(cert_map_find, netsnmp_unused)

netsnmp_feature_child_of(tlstmparams_external, cert_util_all)

netsnmp_feature_child_of(tlstmparams_container, tlstmparams_external)

netsnmp_feature_child_of(tlstmparams_remove, tlstmparams_external)

netsnmp_feature_child_of(tlstmparams_find, tlstmparams_external)

netsnmp_feature_child_of(tlstmAddr_remove, netsnmp_unused)

netsnmp_feature_child_of(tlstmaddr_external, cert_util_all)

netsnmp_feature_child_of(tlstmaddr_container, tlstmaddr_external)

netsnmp_feature_child_of(tlstmAddr_get_serverId, tlstmaddr_external)

netsnmp_feature_child_of(cert_fingerprints, cert_util_all)

netsnmp_feature_child_of(tls_fingerprint_build, cert_util_all)

#endif /* NETSNMP_FEATURE_REQUIRE_CERT_UTIL */

#ifndef NETSNMP_FEATURE_REMOVE_CERT_UTIL

#include <ctype.h>

#if HAVE_STDLIB_H

#include <stdlib.h>

#endif

#if HAVE_STRING_H

#include <string.h>

#else

#include <strings.h>

#endif

#if HAVE_SYS_STAT_H

#   include <sys/stat.h>

#endif

#if HAVE_DIRENT_H

# include <dirent.h>

# define NAMLEN(dirent) strlen((dirent)->d_name)

#else

# define dirent direct

# define NAMLEN(dirent) (dirent)->d_namlen

# if HAVE_SYS_NDIR_H

#  include <sys/ndir.h>

# endif

# if HAVE_SYS_DIR_H

#  include <sys/dir.h>

# endif

# if HAVE_NDIR_H

#  include <ndir.h>

# endif

#endif

#if HAVE_DMALLOC_H

#include <dmalloc.h>

#endif

#include <net-snmp/types.h>

#include <net-snmp/output_api.h>

#include <net-snmp/config_api.h>

#include <net-snmp/library/snmp_assert.h>

#include <net-snmp/library/snmp_transport.h>

#include <net-snmp/library/system.h>

#include <net-snmp/library/tools.h>

#include <net-snmp/library/container.h>

#include <net-snmp/library/data_list.h>

#include <net-snmp/library/file_utils.h>

#include <net-snmp/library/dir_utils.h>

#include <net-snmp/library/read_config.h>

#include <openssl/ssl.h>

#include <openssl/err.h>

#include <openssl/x509v3.h>

#include <net-snmp/library/cert_util.h>

#include <net-snmp/library/snmp_openssl.h>

#ifndef NAME_MAX

#define NAME_MAX 255

#endif

/*

 * bump this value whenever cert index format changes, so indexes

 * will be regenerated with new format.

 */

#define CERT_INDEX_FORMAT  1

static netsnmp_container *_certs = NULL;

static netsnmp_container *_keys = NULL;

static netsnmp_container *_maps = NULL;

static netsnmp_container *_tlstmParams = NULL;

static netsnmp_container *_tlstmAddr = NULL;

static struct snmp_enum_list *_certindexes = NULL;

static netsnmp_container *_trusted_certs = NULL;

static void _setup_containers(void);

static void _cert_indexes_load(void);

static void _cert_free(netsnmp_cert *cert, void *context);

static void _key_free(netsnmp_key *key, void *context);

static int  _cert_compare(netsnmp_cert *lhs, netsnmp_cert *rhs);

static int  _cert_sn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs);

static int  _cert_sn_ncompare(netsnmp_cert *lhs, netsnmp_cert *rhs);

static int  _cert_cn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs);

static int  _cert_fn_compare(netsnmp_cert_common *lhs,

                             netsnmp_cert_common *rhs);

static int  _cert_fn_ncompare(netsnmp_cert_common *lhs,

                              netsnmp_cert_common *rhs);

static void _find_partner(netsnmp_cert *cert, netsnmp_key *key);

static netsnmp_cert *_find_issuer(netsnmp_cert *cert);

static netsnmp_void_array *_cert_find_subset_fn(const char *filename,

                                                const char *directory);

static netsnmp_void_array *_cert_find_subset_sn(const char *subject);

static netsnmp_void_array *_key_find_subset(const char *filename);

static netsnmp_cert *_cert_find_fp(const char *fingerprint);

static char *_find_tlstmParams_fingerprint(const char *param);

static char *_find_tlstmAddr_fingerprint(const char *name);

static const char *_mode_str(u_char mode);

static const char *_where_str(u_int what);

void netsnmp_cert_dump_all(void);

int netsnmp_cert_load_x509(netsnmp_cert *cert);

void netsnmp_cert_free(netsnmp_cert *cert);

void netsnmp_key_free(netsnmp_key *key);

static int _certindex_add( const char *dirname, int i );

static int _time_filter(netsnmp_file *f, struct stat *idx);

static void _init_tlstmCertToTSN(void);

#define TRUSTCERT_CONFIG_TOKEN "trustCert"

static void _parse_trustcert(const char *token, char *line);

static void _init_tlstmParams(void);

static void _init_tlstmAddr(void);

/** mode descriptions should match up with header */

static const char _modes[][256] =

        {

            "none",

            "identity",

            "remote_peer",

            "identity+remote_peer",

            "reserved1",

            "reserved1+identity",

            "reserved1+remote_peer",

            "reserved1+identity+remote_peer",

            "CA",

            "CA+identity",

            "CA+remote_peer",

            "CA+identity+remote_peer",

            "CA+reserved1",

            "CA+reserved1+identity",

            "CA+reserved1+remote_peer",

            "CA+reserved1+identity+remote_peer",

        };

/* #####################################################################

 *

 * init and shutdown functions

 *

 */

void

_netsnmp_release_trustcerts(void)

{

    if (NULL != _trusted_certs) {

        CONTAINER_FREE_ALL(_trusted_certs, NULL);

        CONTAINER_FREE(_trusted_certs);

        _trusted_certs = NULL;

    }

}

void

_setup_trusted_certs(void)

{

    _trusted_certs = netsnmp_container_find("trusted_certs:fifo");

    if (NULL == _trusted_certs) {

        snmp_log(LOG_ERR, "could not create container for trusted certs\n");

        netsnmp_certs_shutdown();

        return;

    }

    _trusted_certs->container_name = strdup("trusted certificates");

    _trusted_certs->compare = (netsnmp_container_compare*) strcmp;

}

/*

 * secname mapping for servers.

 */

void

netsnmp_certs_agent_init(void)

{

    _init_tlstmCertToTSN();

    _init_tlstmParams();

    _init_tlstmAddr();

}

void

netsnmp_certs_init(void)

{

    const char *trustCert_help = TRUSTCERT_CONFIG_TOKEN

        " FINGERPRINT|FILENAME";

    register_config_handler("snmp", TRUSTCERT_CONFIG_TOKEN,

                            _parse_trustcert, _netsnmp_release_trustcerts,

                            trustCert_help);

    _setup_containers();

    /** add certificate type mapping */

    se_add_pair_to_slist("cert_types", strdup("pem"), NS_CERT_TYPE_PEM);

    se_add_pair_to_slist("cert_types", strdup("crt"), NS_CERT_TYPE_DER);

    se_add_pair_to_slist("cert_types", strdup("cer"), NS_CERT_TYPE_DER);

    se_add_pair_to_slist("cert_types", strdup("cert"), NS_CERT_TYPE_DER);

    se_add_pair_to_slist("cert_types", strdup("der"), NS_CERT_TYPE_DER);

    se_add_pair_to_slist("cert_types", strdup("key"), NS_CERT_TYPE_KEY);

    se_add_pair_to_slist("cert_types", strdup("private"), NS_CERT_TYPE_KEY);

    /** hash algs */

    se_add_pair_to_slist("cert_hash_alg", strdup("sha1"), NS_HASH_SHA1);

    se_add_pair_to_slist("cert_hash_alg", strdup("md5"), NS_HASH_MD5);

    se_add_pair_to_slist("cert_hash_alg", strdup("sha224"), NS_HASH_SHA224);

    se_add_pair_to_slist("cert_hash_alg", strdup("sha256"), NS_HASH_SHA256);

    se_add_pair_to_slist("cert_hash_alg", strdup("sha384"), NS_HASH_SHA384);

    se_add_pair_to_slist("cert_hash_alg", strdup("sha512"), NS_HASH_SHA512);

    /** map types */

    se_add_pair_to_slist("cert_map_type", strdup("cn"),

                         TSNM_tlstmCertCommonName);

    se_add_pair_to_slist("cert_map_type", strdup("ip"),

                         TSNM_tlstmCertSANIpAddress);

    se_add_pair_to_slist("cert_map_type", strdup("rfc822"),

                         TSNM_tlstmCertSANRFC822Name);

    se_add_pair_to_slist("cert_map_type", strdup("dns"),

                         TSNM_tlstmCertSANDNSName);

    se_add_pair_to_slist("cert_map_type", strdup("any"), TSNM_tlstmCertSANAny);

    se_add_pair_to_slist("cert_map_type", strdup("sn"),

                         TSNM_tlstmCertSpecified);

}

void

netsnmp_certs_shutdown(void)

{

    DEBUGMSGT(("cert:util:shutdown","shutdown\n"));

    if (_maps) {

        CONTAINER_FREE_ALL(_maps, NULL);

        CONTAINER_FREE(_maps);

        _maps = NULL;

    }

    if (NULL != _certs) {

        CONTAINER_FREE_ALL(_certs, NULL);

        CONTAINER_FREE(_certs);

        _certs = NULL;

    }

    if (NULL != _keys) {

        CONTAINER_FREE_ALL(_keys, NULL);

        CONTAINER_FREE(_keys);

        _keys = NULL;

    }

    _netsnmp_release_trustcerts();

}

void

netsnmp_certs_load(void)

{

    netsnmp_iterator  *itr;

    netsnmp_key        *key;

    netsnmp_cert       *cert;

    DEBUGMSGT(("cert:util:init","init\n"));

    if (NULL == _certs) {

        snmp_log(LOG_ERR, "cant load certs without container\n");

        return;

    }

    if (CONTAINER_SIZE(_certs) != 0) {

        DEBUGMSGT(("cert:util:init", "ignoring duplicate init\n"));

        return;

    }

    netsnmp_init_openssl();

    /** scan config dirs for certs */

    _cert_indexes_load();

    /** match up keys w/certs */

    itr = CONTAINER_ITERATOR(_keys);

    if (NULL == itr) {

        snmp_log(LOG_ERR, "could not get iterator for keys\n");

        netsnmp_certs_shutdown();

        return;

    }

    key = ITERATOR_FIRST(itr);

    for( ; key; key = ITERATOR_NEXT(itr))

        _find_partner(NULL, key);

    ITERATOR_RELEASE(itr);

    DEBUGIF("cert:dump") {

        itr = CONTAINER_ITERATOR(_certs);

        if (NULL == itr) {

            snmp_log(LOG_ERR, "could not get iterator for certs\n");

            netsnmp_certs_shutdown();

            return;

        }

        cert = ITERATOR_FIRST(itr);

        for( ; cert; cert = ITERATOR_NEXT(itr)) {

            netsnmp_cert_load_x509(cert);

        }

        ITERATOR_RELEASE(itr);

        DEBUGMSGT(("cert:dump",

                   "-------------------- Certificates -----------------\n"));

        netsnmp_cert_dump_all();

        DEBUGMSGT(("cert:dump",

                   "------------------------ End ----------------------\n"));

    }

}

/* #####################################################################

 *

 * cert container functions

 */

static netsnmp_container *

_get_cert_container(const char *use)

{

    netsnmp_container *c;

    c = netsnmp_container_find("certs:binary_array");

    if (NULL == c) {

        snmp_log(LOG_ERR, "could not create container for %s\n", use);

        return NULL;

    }

    c->container_name = strdup(use);

    c->free_item = (netsnmp_container_obj_func*)_cert_free;

    c->compare = (netsnmp_container_compare*)_cert_compare;

    return c;

}

static void

_setup_containers(void)

{

    netsnmp_container *additional_keys;

    _certs = _get_cert_container("netsnmp certificates");

    if (NULL == _certs)

        return;

    /** additional keys: common name */

    additional_keys = netsnmp_container_find("certs_cn:binary_array");

    if (NULL == additional_keys) {

        snmp_log(LOG_ERR, "could not create CN container for certificates\n");

        netsnmp_certs_shutdown();

        return;

    }

    additional_keys->container_name = strdup("certs_cn");

    additional_keys->free_item = NULL;

    additional_keys->compare = (netsnmp_container_compare*)_cert_cn_compare;

    netsnmp_container_add_index(_certs, additional_keys);

    /** additional keys: subject name */

    additional_keys = netsnmp_container_find("certs_sn:binary_array");

    if (NULL == additional_keys) {

        snmp_log(LOG_ERR, "could not create SN container for certificates\n");

        netsnmp_certs_shutdown();

        return;

    }

    additional_keys->container_name = strdup("certs_sn");

    additional_keys->free_item = NULL;

    additional_keys->compare = (netsnmp_container_compare*)_cert_sn_compare;

    additional_keys->ncompare = (netsnmp_container_compare*)_cert_sn_ncompare;

    netsnmp_container_add_index(_certs, additional_keys);

    /** additional keys: file name */

    additional_keys = netsnmp_container_find("certs_fn:binary_array");

    if (NULL == additional_keys) {

        snmp_log(LOG_ERR, "could not create FN container for certificates\n");

        netsnmp_certs_shutdown();

        return;

    }

    additional_keys->container_name = strdup("certs_fn");

    additional_keys->free_item = NULL;

    additional_keys->compare = (netsnmp_container_compare*)_cert_fn_compare;

    additional_keys->ncompare = (netsnmp_container_compare*)_cert_fn_ncompare;

    netsnmp_container_add_index(_certs, additional_keys);

    _keys = netsnmp_container_find("cert_keys:binary_array");

    if (NULL == _keys) {

        snmp_log(LOG_ERR, "could not create container for certificate keys\n");

        netsnmp_certs_shutdown();

        return;

    }

    _keys->container_name = strdup("netsnmp certificate keys");

    _keys->free_item = (netsnmp_container_obj_func*)_key_free;

    _keys->compare = (netsnmp_container_compare*)_cert_fn_compare;

    _setup_trusted_certs();

}

netsnmp_container *

netsnmp_cert_map_container(void)

{

    return _maps;

}

static netsnmp_cert *

_new_cert(const char *dirname, const char *filename, int certType,

          int hashType, const char *fingerprint, const char *common_name,

          const char *subject)

{

    netsnmp_cert    *cert;

    if ((NULL == dirname) || (NULL == filename)) {

        snmp_log(LOG_ERR, "bad parameters to _new_cert\n");

        return NULL;

    }

    cert = SNMP_MALLOC_TYPEDEF(netsnmp_cert);

    if (NULL == cert) {

        snmp_log(LOG_ERR,"could not allocate memory for certificate at %s/%s\n",

                 dirname, filename);

        return NULL;

    }

    DEBUGMSGT(("9:cert:struct:new","new cert 0x%p for %s\n", cert, filename));

    cert->info.dir = strdup(dirname);

    cert->info.filename = strdup(filename);

    cert->info.allowed_uses = NS_CERT_REMOTE_PEER;

    cert->info.type = certType;

    if (fingerprint) {

        cert->hash_type = hashType;

        cert->fingerprint = strdup(fingerprint);

    }

    if (common_name)

        cert->common_name = strdup(common_name);

    if (subject)

        cert->subject = strdup(subject);

    return cert;

}

static netsnmp_key *

_new_key(const char *dirname, const char *filename)

{

    netsnmp_key    *key;

    struct stat     fstat;

    char            fn[SNMP_MAXPATH];

    if ((NULL == dirname) || (NULL == filename)) {

        snmp_log(LOG_ERR, "bad parameters to _new_key\n");

        return NULL;

    }

    /** check file permissions */

    snprintf(fn, sizeof(fn), "%s/%s", dirname, filename);

    if (stat(fn, &fstat) != 0) {

        snmp_log(LOG_ERR, "could  not stat %s\n", fn);

        return NULL;

    }

#if !defined(_MSC_VER)

    if ((fstat.st_mode & S_IROTH) || (fstat.st_mode & S_IWOTH)) {

        snmp_log(LOG_ERR,

                 "refusing to read world readable or writable key %s\n", fn);

        return NULL;

    }

#endif

    key = SNMP_MALLOC_TYPEDEF(netsnmp_key);

    if (NULL == key) {

        snmp_log(LOG_ERR, "could not allocate memory for key at %s/%s\n",

                 dirname, filename);

        return NULL;

    }

    DEBUGMSGT(("cert:key:struct:new","new key %p for %s\n", key, filename));

    key->info.type = NS_CERT_TYPE_KEY;

    key->info.dir = strdup(dirname);

    key->info.filename = strdup(filename);

    key->info.allowed_uses = NS_CERT_IDENTITY;

    return key;

}

void

netsnmp_cert_free(netsnmp_cert *cert)

{

    if (NULL == cert)

        return;

    DEBUGMSGT(("9:cert:struct:free","freeing cert %p, %s (fp %s; CN %s)\n",

               cert, cert->info.filename ? cert->info.filename : "UNK",

               cert->fingerprint ? cert->fingerprint : "UNK",

               cert->common_name ? cert->common_name : "UNK"));

    SNMP_FREE(cert->info.dir);

    SNMP_FREE(cert->info.filename);

    SNMP_FREE(cert->subject);

    SNMP_FREE(cert->issuer);

    SNMP_FREE(cert->fingerprint);

    SNMP_FREE(cert->common_name);

    if (cert->ocert)

        X509_free(cert->ocert);

    if (cert->key && cert->key->cert == cert)

        cert->key->cert = NULL;

    free(cert); /* SNMP_FREE not needed on parameters */

}

void

netsnmp_key_free(netsnmp_key *key)

{

    if (NULL == key)

        return;

    DEBUGMSGT(("cert:key:struct:free","freeing key %p, %s\n",

               key, key->info.filename ? key->info.filename : "UNK"));

    SNMP_FREE(key->info.dir);

    SNMP_FREE(key->info.filename);

    EVP_PKEY_free(key->okey);

    if (key->cert && key->cert->key == key)

        key->cert->key = NULL;

    free(key); /* SNMP_FREE not needed on parameters */

}

static void

_cert_free(netsnmp_cert *cert, void *context)

{

    netsnmp_cert_free(cert);

}

static void

_key_free(netsnmp_key *key, void *context)

{

    netsnmp_key_free(key);

}

static int

_cert_compare(netsnmp_cert *lhs, netsnmp_cert *rhs)

{

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    netsnmp_assert((lhs->fingerprint != NULL) &&

                   (rhs->fingerprint != NULL));

    /** ignore hash type? */

    return strcmp(lhs->fingerprint, rhs->fingerprint);

}

static int

_cert_path_compare(netsnmp_cert_common *lhs, netsnmp_cert_common *rhs)

{

    int rc;

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    /** dir name first */

    rc = strcmp(lhs->dir, rhs->dir);

    if (rc)

        return rc;

    /** filename */

    return strcmp(lhs->filename, rhs->filename);

}

static int

_cert_cn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs)

{

    int rc;

    const char *lhcn, *rhcn;

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    if (NULL == lhs->common_name)

        lhcn = "";

    else

        lhcn = lhs->common_name;

    if (NULL == rhs->common_name)

        rhcn = "";

    else

        rhcn = rhs->common_name;

    rc = strcmp(lhcn, rhcn);

    if (rc)

        return rc;

    /** in case of equal common names, sub-sort by path */

    return _cert_path_compare((netsnmp_cert_common*)lhs,

                              (netsnmp_cert_common*)rhs);

}

static int

_cert_sn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs)

{

    int rc;

    const char *lhsn, *rhsn;

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    if (NULL == lhs->subject)

        lhsn = "";

    else

        lhsn = lhs->subject;

    if (NULL == rhs->subject)

        rhsn = "";

    else

        rhsn = rhs->subject;

    rc = strcmp(lhsn, rhsn);

    if (rc)

        return rc;

    /** in case of equal common names, sub-sort by path */

    return _cert_path_compare((netsnmp_cert_common*)lhs,

                              (netsnmp_cert_common*)rhs);

}

static int

_cert_fn_compare(netsnmp_cert_common *lhs, netsnmp_cert_common *rhs)

{

    int rc;

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    rc = strcmp(lhs->filename, rhs->filename);

    if (rc)

        return rc;

    /** in case of equal common names, sub-sort by dir */

    return strcmp(lhs->dir, rhs->dir);

}

static int

_cert_fn_ncompare(netsnmp_cert_common *lhs, netsnmp_cert_common *rhs)

{

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    netsnmp_assert((lhs->filename != NULL) && (rhs->filename != NULL));

    return strncmp(lhs->filename, rhs->filename, strlen(rhs->filename));

}

static int

_cert_sn_ncompare(netsnmp_cert *lhs, netsnmp_cert *rhs)

{

    netsnmp_assert((lhs != NULL) && (rhs != NULL));

    netsnmp_assert((lhs->subject != NULL) && (rhs->subject != NULL));

    return strncmp(lhs->subject, rhs->subject, strlen(rhs->subject));

}

static int

_cert_ext_type(const char *ext)

{

    int rc = se_find_value_in_slist("cert_types", ext);

    if (SE_DNE == rc)

        return NS_CERT_TYPE_UNKNOWN;

    return rc;

}

static int

_type_from_filename(const char *filename)

{

    char     *pos;

    int       type;

    if (NULL == filename)

        return NS_CERT_TYPE_UNKNOWN;

    pos = strrchr(filename, '.');

    if (NULL == pos)

        return NS_CERT_TYPE_UNKNOWN;

    type = _cert_ext_type(++pos);

    return type;

}

/*

 * filter functions; return 1 to include file, 0 to exclude

 */

static int

_cert_cert_filter(const char *filename)

{

    int  len = strlen(filename);

    const char *pos;

    if (len < 5) /* shortest name: x.YYY */

        return 0;

    pos = strrchr(filename, '.');

    if (NULL == pos)

        return 0;

    if (_cert_ext_type(++pos) != NS_CERT_TYPE_UNKNOWN)

        return 1;

    return 0;

}

/* #####################################################################

 *

 * cert index functions

 *

 * This code mimics what the mib index code does. The persistent

 * directory will have a subdirectory named 'cert_indexes'. Inside

 * this directory will be some number of files with ascii numeric

 * names (0, 1, 2, etc). Each of these files will start with a line

 * with the text "DIR ", followed by a directory name. The rest of the

 * file will be certificate fields and the certificate file name, one

 * certificate per line. The numeric file name is the integer 'directory

 * index'.

 */

/**

 * _certindex_add

 *

 * add a directory name to the indexes

 */

static int

_certindex_add( const char *dirname, int i )

{

    int rc;

    char *dirname_copy = strdup(dirname);

    if ( i == -1 ) {

        int max = se_find_free_value_in_list(_certindexes);

        if (SE_DNE == max)

            i = 0;

        else

            i = max;

    }

    DEBUGMSGT(("cert:index:add","dir %s at index %d\n", dirname, i ));

    rc = se_add_pair_to_list(&_certindexes, dirname_copy, i);

    if (SE_OK != rc) {

        snmp_log(LOG_ERR, "adding certindex dirname failed; "

                 "%d (%s) not added\n", i, dirname);

        return -1;

    }

    return i;

}

/**

 * _certindex_load

 *

 * read in the existing indexes

 */

static void

_certindexes_load( void )

{

    DIR *dir;

    struct dirent *file;

    FILE *fp;

    char filename[SNMP_MAXPATH], line[300];

    int  i;

    char *cp, *pos;

    /*

     * Open the CERT index directory, or create it (empty)

     */

    snprintf( filename, sizeof(filename), "%s/cert_indexes",

              get_persistent_directory());

    filename[sizeof(filename)-1] = 0;

    dir = opendir( filename );

    if ( dir == NULL ) {

        DEBUGMSGT(("cert:index:load",

                   "creating new cert_indexes directory\n"));

        mkdirhier( filename, NETSNMP_AGENT_DIRECTORY_MODE, 0);

        return;

    }

    /*

     * Create a list of which directory each file refers to

     */

    while ((file = readdir( dir ))) {

        if ( !isdigit(0xFF & file->d_name[0]))

            continue;

        i = atoi( file->d_name );

        snprintf( filename, sizeof(filename), "%s/cert_indexes/%d",

              get_persistent_directory(), i );

        filename[sizeof(filename)-1] = 0;

        fp = fopen( filename, "r" );

        if ( !fp ) {

            DEBUGMSGT(("cert:index:load", "error opening index (%d)\n", i));

            continue;

        }

        cp = fgets( line, sizeof(line), fp );

        if ( cp ) {

            line[strlen(line)-1] = 0;

            pos = strrchr(line, ' ');

            if (pos)

                *pos = '\0';

            DEBUGMSGT(("9:cert:index:load","adding (%d) %s\n", i, line));

            (void)_certindex_add( line+4, i );  /* Skip 'DIR ' */

        } else {

            DEBUGMSGT(("cert:index:load", "Empty index (%d)\n", i));

        }

        fclose( fp );

    }

    closedir( dir );

}

/**

 * _certindex_lookup

 *

 * find index for a directory

 */

static char *

_certindex_lookup( const char *dirname )

{

    int i;

    char filename[SNMP_MAXPATH];

    i = se_find_value_in_list(_certindexes, dirname);

    if (SE_DNE == i) {

        DEBUGMSGT(("9:cert:index:lookup","%s : (none)\n", dirname));

        return NULL;

    }

    snprintf(filename, sizeof(filename), "%s/cert_indexes/%d",

             get_persistent_directory(), i);

    filename[sizeof(filename)-1] = 0;

    DEBUGMSGT(("cert:index:lookup", "%s (%d) %s\n", dirname, i, filename ));

    return strdup(filename);

}

static FILE *

_certindex_new( const char *dirname )

{

    FILE *fp;

    char  filename[SNMP_MAXPATH], *cp;

    int   i;

    cp = _certindex_lookup( dirname );

    if (!cp) {

        i  = _certindex_add( dirname, -1 );

        if (-1 == i)

            return NULL; /* msg already logged */

        snprintf( filename, sizeof(filename), "%s/cert_indexes/%d",

                  get_persistent_directory(), i );

        filename[sizeof(filename)-1] = 0;

        cp = filename;

    }

    DEBUGMSGT(("9:cert:index:new", "%s (%s)\n", dirname, cp ));

    fp = fopen( cp, "w" );

    if (fp)

        fprintf( fp, "DIR %s %d\n", dirname, CERT_INDEX_FORMAT );

    else

        DEBUGMSGTL(("cert:index", "error opening new index file %s\n", dirname));

    if (cp != filename)