/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef PKIM_H

#include "pkim.h"

#endif /* PKIM_H */

#ifndef PKI_H

#include "pki.h"

#endif /* PKI_H */

#ifndef NSSPKI_H

#include "nsspki.h"

#endif /* NSSPKI_H */

#ifndef BASE_H

#include "base.h"

#endif /* BASE_H */

#ifndef PKISTORE_H

#include "pkistore.h"

#endif /* PKISTORE_H */

#include "cert.h"

#include "pki3hack.h"

#include "prbit.h"

/*

 * Certificate Store

 *

 * This differs from the cache in that it is a true storage facility.  Items

 * stay in until they are explicitly removed.  It is only used by crypto

 * contexts at this time, but may be more generally useful...

 *

 */

struct nssCertificateStoreStr {

    PRBool i_alloced_arena;

    NSSArena *arena;

    PZLock *lock;

    nssHash *subject;

    nssHash *issuer_and_serial;

};

typedef struct certificate_hash_entry_str certificate_hash_entry;

struct certificate_hash_entry_str {

    NSSCertificate *cert;

    NSSTrust *trust;

    nssSMIMEProfile *profile;

};

/* forward static declarations */

static NSSCertificate *

nssCertStore_FindCertByIssuerAndSerialNumberLocked(

    nssCertificateStore *store,

    NSSDER *issuer,

    NSSDER *serial);

NSS_IMPLEMENT nssCertificateStore *

nssCertificateStore_Create(NSSArena *arenaOpt)

{

    NSSArena *arena;

    nssCertificateStore *store;

    PRBool i_alloced_arena;

    if (arenaOpt) {

        arena = arenaOpt;

        i_alloced_arena = PR_FALSE;

    } else {

        arena = nssArena_Create();

        if (!arena) {

            return NULL;

        }

        i_alloced_arena = PR_TRUE;

    }

    store = nss_ZNEW(arena, nssCertificateStore);

    if (!store) {

        goto loser;

    }

    store->lock = PZ_NewLock(nssILockOther);

    if (!store->lock) {

        goto loser;

    }

    /* Create the issuer/serial --> {cert, trust, S/MIME profile } hash */

    store->issuer_and_serial = nssHash_CreateCertificate(arena, 0);

    if (!store->issuer_and_serial) {

        goto loser;

    }

    /* Create the subject DER --> subject list hash */

    store->subject = nssHash_CreateItem(arena, 0);

    if (!store->subject) {

        goto loser;

    }

    store->arena = arena;

    store->i_alloced_arena = i_alloced_arena;

    return store;

loser:

    if (store) {

        if (store->lock) {

            PZ_DestroyLock(store->lock);

        }

        if (store->issuer_and_serial) {

            nssHash_Destroy(store->issuer_and_serial);

        }

        if (store->subject) {

            nssHash_Destroy(store->subject);

        }

    }

    if (i_alloced_arena) {

        nssArena_Destroy(arena);

    }

    return NULL;

}

extern const NSSError NSS_ERROR_BUSY;

NSS_IMPLEMENT PRStatus

nssCertificateStore_Destroy(nssCertificateStore *store)

{

    if (nssHash_Count(store->issuer_and_serial) > 0) {

        nss_SetError(NSS_ERROR_BUSY);

        return PR_FAILURE;

    }

    PZ_DestroyLock(store->lock);

    nssHash_Destroy(store->issuer_and_serial);

    nssHash_Destroy(store->subject);

    if (store->i_alloced_arena) {

        nssArena_Destroy(store->arena);

    } else {

        nss_ZFreeIf(store);

    }

    return PR_SUCCESS;

}

static PRStatus

add_certificate_entry(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    PRStatus nssrv;

    certificate_hash_entry *entry;

    entry = nss_ZNEW(cert->object.arena, certificate_hash_entry);

    if (!entry) {

        return PR_FAILURE;

    }

    entry->cert = cert;

    nssrv = nssHash_Add(store->issuer_and_serial, cert, entry);

    if (nssrv != PR_SUCCESS) {

        nss_ZFreeIf(entry);

    }

    return nssrv;

}

static PRStatus

add_subject_entry(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    PRStatus nssrv;

    nssList *subjectList;

    subjectList = (nssList *)nssHash_Lookup(store->subject, &cert->subject);

    if (subjectList) {

        /* The subject is already in, add this cert to the list */

        nssrv = nssList_AddUnique(subjectList, cert);

    } else {

        /* Create a new subject list for the subject */

        subjectList = nssList_Create(NULL, PR_FALSE);

        if (!subjectList) {

            return PR_FAILURE;

        }

        nssList_SetSortFunction(subjectList, nssCertificate_SubjectListSort);

        /* Add the cert entry to this list of subjects */

        nssrv = nssList_Add(subjectList, cert);

        if (nssrv != PR_SUCCESS) {

            return nssrv;

        }

        /* Add the subject list to the cache */

        nssrv = nssHash_Add(store->subject, &cert->subject, subjectList);

    }

    return nssrv;

}

/* declared below */

static void

remove_certificate_entry(

    nssCertificateStore *store,

    NSSCertificate *cert);

/* Caller must hold store->lock */

static PRStatus

nssCertificateStore_AddLocked(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    PRStatus nssrv = add_certificate_entry(store, cert);

    if (nssrv == PR_SUCCESS) {

        nssrv = add_subject_entry(store, cert);

        if (nssrv == PR_FAILURE) {

            remove_certificate_entry(store, cert);

        }

    }

    return nssrv;

}

NSS_IMPLEMENT NSSCertificate *

nssCertificateStore_FindOrAdd(

    nssCertificateStore *store,

    NSSCertificate *c)

{

    PRStatus nssrv;

    NSSCertificate *rvCert = NULL;

    PZ_Lock(store->lock);

    rvCert = nssCertStore_FindCertByIssuerAndSerialNumberLocked(

        store, &c->issuer, &c->serial);

    if (!rvCert) {

        nssrv = nssCertificateStore_AddLocked(store, c);

        if (PR_SUCCESS == nssrv) {

            rvCert = nssCertificate_AddRef(c);

        }

    }

    PZ_Unlock(store->lock);

    return rvCert;

}

static void

remove_certificate_entry(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    certificate_hash_entry *entry;

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, cert);

    if (entry) {

        nssHash_Remove(store->issuer_and_serial, cert);

        if (entry->trust) {

            nssTrust_Destroy(entry->trust);

        }

        if (entry->profile) {

            nssSMIMEProfile_Destroy(entry->profile);

        }

        nss_ZFreeIf(entry);

    }

}

static void

remove_subject_entry(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    nssList *subjectList;

    /* Get the subject list for the cert's subject */

    subjectList = (nssList *)nssHash_Lookup(store->subject, &cert->subject);

    if (subjectList) {

        /* Remove the cert from the subject hash */

        nssList_Remove(subjectList, cert);

        nssHash_Remove(store->subject, &cert->subject);

        if (nssList_Count(subjectList) == 0) {

            nssList_Destroy(subjectList);

        } else {

            /* The cert being released may have keyed the subject entry.

             * Since there are still subject certs around, get another and

             * rekey the entry just in case.

             */

            NSSCertificate *subjectCert;

            (void)nssList_GetArray(subjectList, (void **)&subjectCert, 1);

            nssHash_Add(store->subject, &subjectCert->subject, subjectList);

        }

    }

}

NSS_IMPLEMENT void

nssCertificateStore_RemoveCertLOCKED(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    certificate_hash_entry *entry;

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, cert);

    if (entry && entry->cert == cert) {

        remove_certificate_entry(store, cert);

        remove_subject_entry(store, cert);

    }

}

NSS_IMPLEMENT void

nssCertificateStore_Lock(nssCertificateStore *store, nssCertificateStoreTrace *out)

{

#ifdef DEBUG

    PORT_Assert(out);

    out->store = store;

    out->lock = store->lock;

    out->locked = PR_TRUE;

    PZ_Lock(out->lock);

#else

    PZ_Lock(store->lock);

#endif

}

NSS_IMPLEMENT void

nssCertificateStore_Unlock(

    nssCertificateStore *store, const nssCertificateStoreTrace *in,

    nssCertificateStoreTrace *out)

{

#ifdef DEBUG

    PORT_Assert(in);

    PORT_Assert(out);

    out->store = store;

    out->lock = store->lock;

    PORT_Assert(!out->locked);

    out->unlocked = PR_TRUE;

    PORT_Assert(in->store == out->store);

    PORT_Assert(in->lock == out->lock);

    PORT_Assert(in->locked);

    PORT_Assert(!in->unlocked);

    PZ_Unlock(out->lock);

#else

    PZ_Unlock(store->lock);

#endif

}

static NSSCertificate **

get_array_from_list(

    nssList *certList,

    NSSCertificate *rvOpt[],

    PRUint32 maximumOpt,

    NSSArena *arenaOpt)

{

    PRUint32 count;

    NSSCertificate **rvArray = NULL;

    count = nssList_Count(certList);

    if (count == 0) {

        return NULL;

    }

    if (maximumOpt > 0) {

        count = PR_MIN(maximumOpt, count);

    }

    if (rvOpt) {

        nssList_GetArray(certList, (void **)rvOpt, count);

    } else {

        rvArray = nss_ZNEWARRAY(arenaOpt, NSSCertificate *, count + 1);

        if (rvArray) {

            nssList_GetArray(certList, (void **)rvArray, count);

        }

    }

    return rvArray;

}

NSS_IMPLEMENT NSSCertificate **

nssCertificateStore_FindCertificatesBySubject(

    nssCertificateStore *store,

    NSSDER *subject,

    NSSCertificate *rvOpt[],

    PRUint32 maximumOpt,

    NSSArena *arenaOpt)

{

    NSSCertificate **rvArray = NULL;

    nssList *subjectList;

    PZ_Lock(store->lock);

    subjectList = (nssList *)nssHash_Lookup(store->subject, subject);

    if (subjectList) {

        nssCertificateList_AddReferences(subjectList);

        rvArray = get_array_from_list(subjectList,

                                      rvOpt, maximumOpt, arenaOpt);

    }

    PZ_Unlock(store->lock);

    return rvArray;

}

/* Because only subject indexing is implemented, all other lookups require

 * full traversal (unfortunately, PLHashTable doesn't allow you to exit

 * early from the enumeration).  The assumptions are that 1) lookups by

 * fields other than subject will be rare, and 2) the hash will not have

 * a large number of entries.  These assumptions will be tested.

 *

 * XXX

 * For NSS 3.4, it is worth consideration to do all forms of indexing,

 * because the only crypto context is global and persistent.

 */

struct nickname_template_str {

    NSSUTF8 *nickname;

    nssList *subjectList;

};

static void

match_nickname(const void *k, void *v, void *a)

{

    PRStatus nssrv;

    NSSCertificate *c;

    NSSUTF8 *nickname;

    nssList *subjectList = (nssList *)v;

    struct nickname_template_str *nt = (struct nickname_template_str *)a;

    nssrv = nssList_GetArray(subjectList, (void **)&c, 1);

    nickname = nssCertificate_GetNickname(c, NULL);

    if (nssrv == PR_SUCCESS && nickname &&

        nssUTF8_Equal(nickname, nt->nickname, &nssrv)) {

        nt->subjectList = subjectList;

    }

    nss_ZFreeIf(nickname);

}

/*

 * Find all cached certs with this label.

 */

NSS_IMPLEMENT NSSCertificate **

nssCertificateStore_FindCertificatesByNickname(

    nssCertificateStore *store,

    const NSSUTF8 *nickname,

    NSSCertificate *rvOpt[],

    PRUint32 maximumOpt,

    NSSArena *arenaOpt)

{

    NSSCertificate **rvArray = NULL;

    struct nickname_template_str nt;

    nt.nickname = (char *)nickname;

    nt.subjectList = NULL;

    PZ_Lock(store->lock);

    nssHash_Iterate(store->subject, match_nickname, &nt);

    if (nt.subjectList) {

        nssCertificateList_AddReferences(nt.subjectList);

        rvArray = get_array_from_list(nt.subjectList,

                                      rvOpt, maximumOpt, arenaOpt);

    }

    PZ_Unlock(store->lock);

    return rvArray;

}

struct email_template_str {

    NSSASCII7 *email;

    nssList *emailList;

};

static void

match_email(const void *k, void *v, void *a)

{

    PRStatus nssrv;

    NSSCertificate *c;

    nssList *subjectList = (nssList *)v;

    struct email_template_str *et = (struct email_template_str *)a;

    nssrv = nssList_GetArray(subjectList, (void **)&c, 1);

    if (nssrv == PR_SUCCESS &&

        nssUTF8_Equal(c->email, et->email, &nssrv)) {

        nssListIterator *iter = nssList_CreateIterator(subjectList);

        if (iter) {

            for (c = (NSSCertificate *)nssListIterator_Start(iter);

                 c != (NSSCertificate *)NULL;

                 c = (NSSCertificate *)nssListIterator_Next(iter)) {

                nssList_Add(et->emailList, c);

            }

            nssListIterator_Finish(iter);

            nssListIterator_Destroy(iter);

        }

    }

}

/*

 * Find all cached certs with this email address.

 */

NSS_IMPLEMENT NSSCertificate **

nssCertificateStore_FindCertificatesByEmail(

    nssCertificateStore *store,

    NSSASCII7 *email,

    NSSCertificate *rvOpt[],

    PRUint32 maximumOpt,

    NSSArena *arenaOpt)

{

    NSSCertificate **rvArray = NULL;

    struct email_template_str et;

    et.email = email;

    et.emailList = nssList_Create(NULL, PR_FALSE);

    if (!et.emailList) {

        return NULL;

    }

    PZ_Lock(store->lock);

    nssHash_Iterate(store->subject, match_email, &et);

    if (et.emailList) {

        /* get references before leaving the store's lock protection */

        nssCertificateList_AddReferences(et.emailList);

    }

    PZ_Unlock(store->lock);

    if (et.emailList) {

        rvArray = get_array_from_list(et.emailList,

                                      rvOpt, maximumOpt, arenaOpt);

        nssList_Destroy(et.emailList);

    }

    return rvArray;

}

/* Caller holds store->lock */

static NSSCertificate *

nssCertStore_FindCertByIssuerAndSerialNumberLocked(

    nssCertificateStore *store,

    NSSDER *issuer,

    NSSDER *serial)

{

    certificate_hash_entry *entry;

    NSSCertificate *rvCert = NULL;

    NSSCertificate index;

    index.issuer = *issuer;

    index.serial = *serial;

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, &index);

    if (entry) {

        rvCert = nssCertificate_AddRef(entry->cert);

    }

    return rvCert;

}

NSS_IMPLEMENT NSSCertificate *

nssCertificateStore_FindCertificateByIssuerAndSerialNumber(

    nssCertificateStore *store,

    NSSDER *issuer,

    NSSDER *serial)

{

    NSSCertificate *rvCert = NULL;

    PZ_Lock(store->lock);

    rvCert = nssCertStore_FindCertByIssuerAndSerialNumberLocked(

        store, issuer, serial);

    PZ_Unlock(store->lock);

    return rvCert;

}

NSS_IMPLEMENT NSSCertificate *

nssCertificateStore_FindCertificateByEncodedCertificate(

    nssCertificateStore *store,

    NSSDER *encoding)

{

    PRStatus nssrv = PR_FAILURE;

    NSSDER issuer, serial;

    NSSCertificate *rvCert = NULL;

    nssrv = nssPKIX509_GetIssuerAndSerialFromDER(encoding, &issuer, &serial);

    if (nssrv != PR_SUCCESS) {

        return NULL;

    }

    rvCert = nssCertificateStore_FindCertificateByIssuerAndSerialNumber(store,

                                                                        &issuer,

                                                                        &serial);

    PORT_Free(issuer.data);

    PORT_Free(serial.data);

    return rvCert;

}

NSS_EXTERN PRStatus

nssCertificateStore_AddTrust(

    nssCertificateStore *store,

    NSSTrust *trust)

{

    NSSCertificate *cert;

    certificate_hash_entry *entry;

    cert = trust->certificate;

    PZ_Lock(store->lock);

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, cert);

    if (entry) {

        NSSTrust *newTrust = nssTrust_AddRef(trust);

        if (entry->trust) {

            nssTrust_Destroy(entry->trust);

        }

        entry->trust = newTrust;

    }

    PZ_Unlock(store->lock);

    return (entry) ? PR_SUCCESS : PR_FAILURE;

}

NSS_IMPLEMENT NSSTrust *

nssCertificateStore_FindTrustForCertificate(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    certificate_hash_entry *entry;

    NSSTrust *rvTrust = NULL;

    PZ_Lock(store->lock);

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, cert);

    if (entry && entry->trust) {

        rvTrust = nssTrust_AddRef(entry->trust);

    }

    PZ_Unlock(store->lock);

    return rvTrust;

}

NSS_EXTERN PRStatus

nssCertificateStore_AddSMIMEProfile(

    nssCertificateStore *store,

    nssSMIMEProfile *profile)

{

    NSSCertificate *cert;

    certificate_hash_entry *entry;

    cert = profile->certificate;

    PZ_Lock(store->lock);

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, cert);

    if (entry) {

        nssSMIMEProfile *newProfile = nssSMIMEProfile_AddRef(profile);

        if (entry->profile) {

            nssSMIMEProfile_Destroy(entry->profile);

        }

        entry->profile = newProfile;

    }

    PZ_Unlock(store->lock);

    return (entry) ? PR_SUCCESS : PR_FAILURE;

}

NSS_IMPLEMENT nssSMIMEProfile *

nssCertificateStore_FindSMIMEProfileForCertificate(

    nssCertificateStore *store,

    NSSCertificate *cert)

{

    certificate_hash_entry *entry;

    nssSMIMEProfile *rvProfile = NULL;

    PZ_Lock(store->lock);

    entry = (certificate_hash_entry *)

        nssHash_Lookup(store->issuer_and_serial, cert);

    if (entry && entry->profile) {

        rvProfile = nssSMIMEProfile_AddRef(entry->profile);

    }

    PZ_Unlock(store->lock);

    return rvProfile;

}

/* XXX this is also used by cache and should be somewhere else */

static PLHashNumber

nss_certificate_hash(const void *key)

{

    unsigned int i;

    PLHashNumber h;

    NSSCertificate *c = (NSSCertificate *)key;

    h = 0;

    for (i = 0; i < c->issuer.size; i++)

        h = PR_ROTATE_LEFT32(h, 4) ^ ((unsigned char *)c->issuer.data)[i];

    for (i = 0; i < c->serial.size; i++)

        h = PR_ROTATE_LEFT32(h, 4) ^ ((unsigned char *)c->serial.data)[i];

    return h;

}

static int

nss_compare_certs(const void *v1, const void *v2)

{

    PRStatus ignore;

    NSSCertificate *c1 = (NSSCertificate *)v1;

    NSSCertificate *c2 = (NSSCertificate *)v2;

    return (int)(nssItem_Equal(&c1->issuer, &c2->issuer, &ignore) &&

                 nssItem_Equal(&c1->serial, &c2->serial, &ignore));

}

NSS_IMPLEMENT nssHash *

nssHash_CreateCertificate(

    NSSArena *arenaOpt,

    PRUint32 numBuckets)

{

    return nssHash_Create(arenaOpt,

                          numBuckets,

                          nss_certificate_hash,

                          nss_compare_certs,

                          PL_CompareValues);

}

NSS_IMPLEMENT void

nssCertificateStore_DumpStoreInfo(

    nssCertificateStore *store,

    void (*cert_dump_iter)(const void *, void *, void *),

    void *arg)

{

    PZ_Lock(store->lock);

    nssHash_Iterate(store->issuer_and_serial, cert_dump_iter, arg);

    PZ_Unlock(store->lock);

}