/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * KMF CN certificate-to-name mapper.
 */

#include <kmftypes.h>
#include <kmfapi.h>
#include <fcntl.h>

/*
 * KMF uses long identifiers for RDN processing which makes it hard to keep
 * cstyle cleanliness without using some auxiliary macros. Parameter 'x' is of
 * the KMF_X509_NAME type.
 */
#define	RDN_VALUE(x, i) \
	(&x.RelativeDistinguishedName[i].AttributeTypeAndValue->value)

#define	RDN_OID(x, i) \
	(&x.RelativeDistinguishedName[i].AttributeTypeAndValue->type)

#define	RDN_NPAIRS(x, i) (x.RelativeDistinguishedName[i].numberOfPairs)

/* Error codes specific to this mapper. */
#define	CN_MAPPER_CN_RDN_NOT_PRESENT	1

typedef struct cooked_opts {
	int casesensitive;
} cooked_opts;

KMF_RETURN
mapper_initialize(KMF_HANDLE_T h, char *options)
{
	cooked_opts *opts;

	if ((opts = malloc(sizeof (cooked_opts))) == NULL)
		return (KMF_ERR_MEMORY);

	/* This is the default. */
	opts->casesensitive = B_FALSE;

	if (options != NULL) {
		if (strcmp(options, "casesensitive") == 0)
			opts->casesensitive = B_TRUE;
	}

	kmf_set_mapper_options(h, opts);

	return (KMF_OK);
}

void
mapper_finalize(KMF_HANDLE_T h)
{
	void *opts;

	if ((opts = kmf_get_mapper_options(h)) != NULL)
		free(opts);
	kmf_set_mapper_options(h, NULL);
}

/*
 * The CN string returned in name.Data will be NULL-terminated. The caller is
 * expected to free name->Data after use.
 */
KMF_RETURN
mapper_map_cert_to_name(KMF_HANDLE_T h, KMF_DATA *cert, KMF_DATA *name)
{
	int i, j;
	char *dn;
	KMF_RETURN rv;
	uchar_t *cn = NULL;
	KMF_X509_NAME x509name;

	kmf_set_mapper_lasterror(h, KMF_OK);

	if ((rv = kmf_get_cert_subject_str(h, cert, &dn)) != KMF_OK)
		return (rv);

	if ((rv = kmf_dn_parser(dn, &x509name)) != KMF_OK)
		return (rv);

	/* Go through the list of RDNs and look for the CN. */
	for (i = 0; i < x509name.numberOfRDNs; ++i) {
		for (j = 0; j < RDN_NPAIRS(x509name, i); ++j) {
			KMF_OID *oid = RDN_OID(x509name, i);
			KMF_DATA *data = RDN_VALUE(x509name, i);

			if (oid == NULL)
				continue;

			/* Is this RDN a Common Name? */
			if (oid->Length == KMFOID_CommonName.Length &&
			    memcmp(oid->Data, KMFOID_CommonName.Data,
			    oid->Length) == 0) {
				if ((cn = malloc(data->Length + 1)) == NULL) {
					kmf_free_dn(&x509name);
					return (KMF_ERR_MEMORY);
				}
				(void) memcpy(cn, data->Data, data->Length);
				/* Terminate the string. */
				cn[data->Length] = '\0';
				name->Length = data->Length + 1;
				name->Data = cn;
				goto finished;
			}
		}
	}

finished:
	kmf_free_dn(&x509name);
	if (cn != NULL)
		return (KMF_OK);
	else {
		kmf_set_mapper_lasterror(h, CN_MAPPER_CN_RDN_NOT_PRESENT);
		return (KMF_ERR_INTERNAL);
	}
}

/*
 * Note that name_to_match->Data might or might not be NULL terminated. If
 * mapped_name->Length returned is greater than zero the caller is expected to
 * free mapped_name->Data after use.
 */
KMF_RETURN
mapper_match_cert_to_name(KMF_HANDLE_T h, KMF_DATA *cert,
    KMF_DATA *name_to_match, KMF_DATA *mapped_name)
{
	int ret;
	KMF_RETURN rv;
	KMF_DATA get_name;
	cooked_opts *opts = NULL;

	opts = (cooked_opts *)kmf_get_mapper_options(h);

	/* Initialize the output parameter. */
	if (mapped_name != NULL) {
		mapped_name->Length = 0;
		mapped_name->Data = NULL;
	}

	if ((rv = mapper_map_cert_to_name(h, cert, &get_name)) != KMF_OK)
		return (rv);

	/*
	 * If name_to_match->Data is not NULL terminated, check that we have the
	 * same number of characters.
	 */
	if (name_to_match->Data[name_to_match->Length - 1] != '\0')
		/* We know that get_name.Data is NULL terminated. */
		if (name_to_match->Length != get_name.Length - 1)
			return (KMF_ERR_NAME_NOT_MATCHED);

	/*
	 * Compare the strings. We must use name_to_match->Length in case
	 * name_to_match->Data was not NULL terminated. If we used
	 * get_name.Length we could overrun name_to_match->Data by one byte.
	 */
	if (opts->casesensitive == B_TRUE)
		ret = strncmp((char *)name_to_match->Data,
		    (char *)get_name.Data, name_to_match->Length);
	else
		ret = strncasecmp((char *)name_to_match->Data,
		    (char *)get_name.Data, name_to_match->Length);

	if (mapped_name != NULL) {
		mapped_name->Length = get_name.Length;
		mapped_name->Data = get_name.Data;
	} else
		kmf_free_data(&get_name);

	if (ret == 0)
		return (KMF_OK);
	else
		return (KMF_ERR_NAME_NOT_MATCHED);
}

/* The caller is responsible for freeing the error string when done with it. */
KMF_RETURN
mapper_get_error_str(KMF_HANDLE_T h, char **errstr)
{
	uint32_t lasterr;

	lasterr = kmf_get_mapper_lasterror(h);
	*errstr = NULL;
	if (lasterr == 0)
		return (KMF_ERR_MISSING_ERRCODE);

	switch (lasterr) {
	case CN_MAPPER_CN_RDN_NOT_PRESENT:
		*errstr = (char *)strdup("CN_MAPPER_CN_RDN_NOT_PRESENT");
		break;
	default:
		*errstr = (char *)strdup("KMF_ERR_MISSING_MAPPER_ERRCODE");
	}

	if (*errstr == NULL)
		return (KMF_ERR_MEMORY);

	return (KMF_OK);
}