/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/.

 *

 *    Copyright 2022 (c) Mark Giraud, Fraunhofer IOSB

 *    Copyright 2023 (c) Fraunhofer IOSB (Author: Kai Huebl)

 *    Copyright 2024 (c) Fraunhofer IOSB (Author: Noel Graf)

 */

#include <open62541/util.h>

#include <open62541/plugin/certificategroup_default.h>

#include "ua_filestore_common.h"

#include "mp_printf.h"

#ifdef UA_ENABLE_ENCRYPTION

#if defined(__linux__) || defined(UA_ARCHITECTURE_WIN32) || defined(__APPLE__) || defined(__OpenBSD__)

#ifdef __linux__

#define EVENT_SIZE (sizeof(struct inotify_event))

#define BUF_LEN (1024 * ( EVENT_SIZE + 16 ))

#endif /* __linux__ */

static size_t

UA_strnlen(const char *s, size_t maxlen) {

      size_t len = 0;

          while(len < maxlen && s[len] != '\0')

              len++;

        return len;

}

typedef struct {

    /* Memory cert store as a base */

    UA_CertificateGroup *store;

#ifdef __linux__

    int inotifyFd;

#endif /* __linux__ */

    UA_String trustedCertFolder;

    UA_String trustedCrlFolder;

    UA_String issuerCertFolder;

    UA_String issuerCrlFolder;

    UA_String rejectedCertFolder;

    UA_String ownCertFolder;

    UA_String ownKeyFolder;

    UA_String rootFolder;

} FileCertStore;

static int

mkpath(char *dir, UA_MODE mode) {

    if(dir == NULL)

        return 1;

    size_t dirLen = strlen(dir);

    char *path = (char*)UA_malloc(dirLen + 1);

    if(!path)

        return 1;

    memcpy(path, dir, dirLen + 1);

    char *pos = path;

    if(pos[0] == '/')

        pos++;

    for(; *pos; pos++) {

        if(*pos != '/')

            continue;

        *pos = '\0';

        if(path[0] != '\0' && UA_mkdir(path, mode) != 0 && errno != EEXIST) {

            UA_free(path);

            return 1;

        }

        *pos = '/';

    }

    if(UA_mkdir(path, mode) != 0 && errno != EEXIST) {

        UA_free(path);

        return 1;

    }

    UA_free(path);

    return 0;

}

static UA_StatusCode

removeAllFilesFromDir(const char *const path, bool removeSubDirs) {

    UA_StatusCode retval = UA_STATUSCODE_GOOD;

    /* Check parameter */

    if(path == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    /* remove all regular files from directory */

    UA_DIR *dir = UA_opendir(path);

    if(!dir)

        return UA_STATUSCODE_BADINTERNALERROR;

    struct UA_DIRENT *dirent;

    while((dirent = UA_readdir(dir)) != NULL) {

        if(dirent->d_type == UA_DT_REG) {

            char file_name[UA_FILENAME_MAX];

            mp_snprintf(file_name, UA_FILENAME_MAX, "%s/%s", path,

                        (char *)dirent->d_name);

            UA_remove(file_name);

        }

        if(dirent->d_type == UA_DT_DIR && removeSubDirs == true) {

            char *directory = (char*)dirent->d_name;

            char dir_name[UA_FILENAME_MAX];

            mp_snprintf(dir_name, UA_FILENAME_MAX, "%s/%s", path, (char *)dirent->d_name);

            if(strlen(directory) == 1 && directory[0] == '.')

                continue;

            if(strlen(directory) == 2 && directory[0] == '.' && directory[1] == '.')

                continue;

            retval = removeAllFilesFromDir(dir_name, removeSubDirs);

        }

    }

    UA_closedir(dir);

    return retval;

}

static UA_StatusCode

getCertFileName(const char *path, const char *fileExt,

                const UA_ByteString *certificate, char *fileNameBuf,

                size_t fileNameLen) {

    /* Check parameter */

    if(path == NULL || fileExt == NULL || certificate == NULL ||

       fileNameBuf == NULL || fileNameLen == 0)

        return UA_STATUSCODE_BADINTERNALERROR;

    UA_Byte thumbprintData[40];

    UA_String thumbprint = {sizeof(thumbprintData), thumbprintData};

    UA_StatusCode retval = UA_CertificateUtils_getThumbprint(

        (UA_ByteString*)(uintptr_t)certificate, &thumbprint);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    UA_String name = UA_STRING_NULL;

    retval = UA_CertificateUtils_getCertCommonName(certificate, &name);

    if(retval != UA_STATUSCODE_GOOD) {

        retval = UA_CertificateUtils_getSubjectName(

            (UA_ByteString*)(uintptr_t)certificate, &name);

    }

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    if(name.length > UA_INT32_MAX) {

        UA_String_clear(&name);

        return UA_STATUSCODE_BADINTERNALERROR;

    }

    for(size_t i = 0; i < name.length; i++) {

        if(name.data[i] == '/' || name.data[i] == '\\' || name.data[i] < 0x20)

            name.data[i] = '_';

    }

    int len = mp_snprintf(fileNameBuf, fileNameLen, "%s/%.*s[%.*s]%s", path,

                          (int)name.length, (char*)name.data,

                          (int)thumbprint.length,

                          (char*)thumbprint.data, fileExt);

    if(len < 0 || (size_t)len >= fileNameLen)

        retval = UA_STATUSCODE_BADINTERNALERROR;

    UA_String_clear(&name);

    return retval;

}

static bool

isRegularFile(const char *path, const struct UA_DIRENT *dirent) {

    if(dirent->d_type == UA_DT_DIR)

        return false;

    if(dirent->d_type == UA_DT_REG)

        return true;

#ifndef UA_ARCHITECTURE_WIN32

    char filename[UA_PATH_MAX] = {0};

    int len = mp_snprintf(filename, UA_PATH_MAX, "%s/%s", path, dirent->d_name);

    if(len < 0 || len >= UA_PATH_MAX)

        return false;

    struct UA_STAT statBuf;

    return (UA_stat(filename, &statBuf) == 0 && S_ISREG(statBuf.st_mode));

#else

    return false;

#endif

}

static UA_StatusCode

readCertificates(UA_ByteString **list, size_t *listSize, const UA_String path) {

    UA_StatusCode retval = UA_STATUSCODE_GOOD;

    char listPath[UA_PATH_MAX] = {0};

    int pathLen = mp_snprintf(listPath, UA_PATH_MAX, "%.*s",

                              (int)path.length, (char*)path.data);

    if(pathLen < 0 || pathLen >= UA_PATH_MAX)

        return UA_STATUSCODE_BADINTERNALERROR;

    /* Determine number of certificates */

    size_t numCerts = 0;

    UA_DIR *dir = UA_opendir(listPath);

    if(!dir) {

        if(mkpath(listPath, 0777) != 0)

            return UA_STATUSCODE_BADINTERNALERROR;

        dir = UA_opendir(listPath);

        if(!dir)

            return UA_STATUSCODE_BADINTERNALERROR;

    }

    struct UA_DIRENT *dirent;

    while((dirent = UA_readdir(dir)) != NULL) {

        if(!isRegularFile(listPath, dirent))

            continue;

        numCerts++;

    }

    retval = UA_Array_resize((void **)list, listSize, numCerts, &UA_TYPES[UA_TYPES_BYTESTRING]);

    if(retval != UA_STATUSCODE_GOOD) {

        UA_closedir(dir);

        return retval;

    }

    /* Read files from directory */

    size_t numActCerts = 0;

    UA_rewinddir(dir);

    while((dirent = UA_readdir(dir)) != NULL) {

        if(!isRegularFile(listPath, dirent))

            continue;

        if(numActCerts < numCerts) {

            /* Create filename to load */

            char filename[UA_PATH_MAX] = {0};

            if(mp_snprintf(filename, UA_PATH_MAX, "%s/%s", listPath, dirent->d_name) < 0) {

                UA_closedir(dir);

                return UA_STATUSCODE_BADINTERNALERROR;

            }

            /* Load data from file */

            retval = readFileToByteString(filename, &((*list)[numActCerts]));

            if(retval != UA_STATUSCODE_GOOD) {

                UA_closedir(dir);

                return retval;

            }

        }

        numActCerts++;

    }

    UA_closedir(dir);

    return retval;

}

static UA_StatusCode

readTrustStore(UA_CertificateGroup *certGroup, UA_TrustListDataType *trustList) {

    if(certGroup == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    UA_StatusCode retval = UA_STATUSCODE_GOOD;

    retval |= readCertificates(&trustList->trustedCertificates, &trustList->trustedCertificatesSize,

                               context->trustedCertFolder);

    retval |= readCertificates(&trustList->trustedCrls, &trustList->trustedCrlsSize,

                               context->trustedCrlFolder);

    retval |= readCertificates(&trustList->issuerCertificates, &trustList->issuerCertificatesSize,

                               context->issuerCertFolder);

    retval |= readCertificates(&trustList->issuerCrls, &trustList->issuerCrlsSize,

                               context->issuerCrlFolder);

    return retval;

}

static UA_StatusCode

reloadAndWriteTrustStore(UA_CertificateGroup *certGroup) {

    FileCertStore *context = (FileCertStore *)certGroup->context;

    UA_TrustListDataType trustList;

    UA_TrustListDataType_init(&trustList);

    trustList.specifiedLists = UA_TRUSTLISTMASKS_ALL;

    UA_StatusCode retval = readTrustStore(certGroup, &trustList);

    if(retval != UA_STATUSCODE_GOOD) {

        UA_TrustListDataType_clear(&trustList);

        return retval;

    }

    retval = context->store->setTrustList(context->store, &trustList);

    UA_TrustListDataType_clear(&trustList);

    return retval;

}

static UA_StatusCode

reloadTrustStore(UA_CertificateGroup *certGroup) {

    if(certGroup == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

 #ifdef __linux__

    FileCertStore *context = (FileCertStore *)certGroup->context;

    char buffer[BUF_LEN];

    const UA_Int64 length = (UA_Int64)read(context->inotifyFd, buffer, BUF_LEN);

    if(length == -1 && errno != EAGAIN)

        return UA_STATUSCODE_BADINTERNALERROR;

#else

    /* TODO: Implement a way to check for changes in the pki folder */

    const UA_Int64 length = 0;

#endif /* __linux__ */

    /* No events, which means no changes to the pki folder */

    /* If the nonblocking read() found no events to read, then

     * it returns -1 with errno set to EAGAIN. In that case,

     * we exit the loop. */

    if(length <= 0)

        return UA_STATUSCODE_GOOD;

    return reloadAndWriteTrustStore(certGroup);

}

static UA_StatusCode

writeCertificates(const UA_ByteString *list, size_t listSize,

                  const char *listPath, const char *fileExt) {

    /* Check parameter */

    if(listPath == NULL || fileExt == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    if(listSize > 0 && list == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    UA_StatusCode retval = UA_STATUSCODE_GOOD;

    for(size_t i = 0; i < listSize; i++) {

        /* Create filename to load */

        char filename[UA_PATH_MAX] = {0};

        retval = getCertFileName(listPath, fileExt, &list[i], filename, UA_PATH_MAX);

        if(retval != UA_STATUSCODE_GOOD)

            return retval;

        /* Store data in file */

        retval = writeByteStringToFile(filename, &list[i]);

        if(retval != UA_STATUSCODE_GOOD)

            return retval;

    }

    return retval;

}

static UA_StatusCode

writeTrustList(const UA_ByteString *list, size_t listSize,

               const UA_String path, const char *fileExt) {

    /* Check parameter */

    if(path.length == 0 || !fileExt)

        return UA_STATUSCODE_BADINTERNALERROR;

    if(listSize > 0 && list == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    char listPath[UA_PATH_MAX] = {0};

    int len = mp_snprintf(listPath, UA_PATH_MAX, "%.*s",

                          (int)path.length, (char*)path.data);

    if(len < 0 || len >= UA_PATH_MAX)

        return UA_STATUSCODE_BADINTERNALERROR;

    /* remove existing files in directory */

    UA_StatusCode retval = removeAllFilesFromDir(listPath, false);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    return writeCertificates(list, listSize, listPath, fileExt);

}

static UA_StatusCode

writeTrustStore(UA_CertificateGroup *certGroup, const UA_UInt32 trustListMask) {

    /* Check parameter */

    if(certGroup == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    UA_TrustListDataType trustList;

    UA_TrustListDataType_init(&trustList);

    trustList.specifiedLists = trustListMask;

    UA_StatusCode retval =

        context->store->getTrustList(context->store, &trustList);

    if(retval != UA_STATUSCODE_GOOD)

        goto cleanup;

    if(trustList.specifiedLists & UA_TRUSTLISTMASKS_TRUSTEDCERTIFICATES) {

        retval = writeTrustList(trustList.trustedCertificates,

                                trustList.trustedCertificatesSize, context->trustedCertFolder,

                                ".der");

        if(retval != UA_STATUSCODE_GOOD)

            goto cleanup;

    }

    if(trustList.specifiedLists & UA_TRUSTLISTMASKS_TRUSTEDCRLS) {

        retval = writeTrustList(trustList.trustedCrls,

                                trustList.trustedCrlsSize, context->trustedCrlFolder,

                                ".crl");

        if(retval != UA_STATUSCODE_GOOD)

            goto cleanup;

    }

    if(trustList.specifiedLists & UA_TRUSTLISTMASKS_ISSUERCERTIFICATES) {

        retval = writeTrustList(trustList.issuerCertificates,

                                trustList.issuerCertificatesSize, context->issuerCertFolder,

                                ".der");

        if(retval != UA_STATUSCODE_GOOD)

            goto cleanup;

    }

    if(trustList.specifiedLists & UA_TRUSTLISTMASKS_ISSUERCRLS) {

        retval = writeTrustList(trustList.issuerCrls,

                                trustList.issuerCrlsSize, context->issuerCrlFolder,

                                ".crl");

        if(retval != UA_STATUSCODE_GOOD)

            goto cleanup;

    }

cleanup:

    UA_TrustListDataType_clear(&trustList);

    return retval;

}

static UA_StatusCode

FileCertStore_setupStorePath(char *directory, char *rootDirectory,

                             size_t rootDirectorySize, UA_String *out,

                             const UA_Logger *logger) {

    char path[UA_PATH_MAX] = {0};

    int pathLen = mp_snprintf(path, UA_PATH_MAX, "%.*s%s",

                              (int)rootDirectorySize, rootDirectory, directory);

    if(pathLen < 0 || pathLen >= UA_PATH_MAX)

        return UA_STATUSCODE_BADINTERNALERROR;

    *out = UA_STRING_ALLOC(path);

    if(out->data == NULL)

        return UA_STATUSCODE_BADOUTOFMEMORY;

    if(mkpath(path, 0777) != 0) {

        UA_LOG_ERROR(logger, UA_LOGCATEGORY_APPLICATION,

                     "Could not create PKI directory %s (errno %i)", path, errno);

        return UA_STATUSCODE_BADINTERNALERROR;

    }

    return UA_STATUSCODE_GOOD;

}

static UA_StatusCode

FileCertStore_createPkiDirectory(UA_CertificateGroup *certGroup, const UA_String directory) {

    if(certGroup == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    if(!context)

        return UA_STATUSCODE_BADINTERNALERROR;

    char rootDirectory[UA_PATH_MAX] = {0};

    size_t rootDirectorySize = 0;

    if(directory.length <= 0 || directory.length >= UA_PATH_MAX)

        return UA_STATUSCODE_BADINTERNALERROR;

    memcpy(rootDirectory, directory.data, directory.length);

    rootDirectorySize = UA_strnlen(rootDirectory, UA_PATH_MAX);

    /* Add Certificate Group Id */

    UA_NodeId applCertGroup =

        UA_NODEID_NUMERIC(0, UA_NS0ID_SERVERCONFIGURATION_CERTIFICATEGROUPS_DEFAULTAPPLICATIONGROUP);

    UA_NodeId httpCertGroup =

        UA_NODEID_NUMERIC(0, UA_NS0ID_SERVERCONFIGURATION_CERTIFICATEGROUPS_DEFAULTHTTPSGROUP);

    UA_NodeId userTokenCertGroup =

        UA_NODEID_NUMERIC(0, UA_NS0ID_SERVERCONFIGURATION_CERTIFICATEGROUPS_DEFAULTUSERTOKENGROUP);

    if(UA_NodeId_equal(&certGroup->certificateGroupId, &applCertGroup)) {

        strncpy(&rootDirectory[rootDirectorySize], "/ApplCerts", UA_PATH_MAX - rootDirectorySize);

    } else if(UA_NodeId_equal(&certGroup->certificateGroupId, &httpCertGroup)) {

        strncpy(&rootDirectory[rootDirectorySize], "/HttpCerts", UA_PATH_MAX - rootDirectorySize);

    } else if(UA_NodeId_equal(&certGroup->certificateGroupId, &userTokenCertGroup)) {

        strncpy(&rootDirectory[rootDirectorySize], "/UserTokenCerts", UA_PATH_MAX - rootDirectorySize);

    } else {

        UA_String nodeIdStr;

        UA_String_init(&nodeIdStr);

        UA_NodeId_print(&certGroup->certificateGroupId, &nodeIdStr);

        strncpy(&rootDirectory[rootDirectorySize], (char *)nodeIdStr.data, UA_PATH_MAX - rootDirectorySize);

        UA_String_clear(&nodeIdStr);

    }

    rootDirectorySize = UA_strnlen(rootDirectory, UA_PATH_MAX);

    context->rootFolder = UA_STRING_ALLOC(rootDirectory);

    UA_StatusCode retval = UA_STATUSCODE_GOOD;

    retval |= FileCertStore_setupStorePath("/trusted/certs", rootDirectory,

                                           rootDirectorySize, &context->trustedCertFolder,

                                           certGroup->logging);

    retval |= FileCertStore_setupStorePath("/trusted/crl", rootDirectory,

                                           rootDirectorySize, &context->trustedCrlFolder,

                                           certGroup->logging);

    retval |= FileCertStore_setupStorePath("/issuer/certs", rootDirectory,

                                           rootDirectorySize, &context->issuerCertFolder,

                                           certGroup->logging);

    retval |= FileCertStore_setupStorePath("/issuer/crl", rootDirectory,

                                           rootDirectorySize, &context->issuerCrlFolder,

                                           certGroup->logging);

    retval |= FileCertStore_setupStorePath("/rejected/certs", rootDirectory,

                                           rootDirectorySize, &context->rejectedCertFolder,

                                           certGroup->logging);

    retval |= FileCertStore_setupStorePath("/own/certs", rootDirectory,

                                           rootDirectorySize, &context->ownCertFolder,

                                           certGroup->logging);

    retval |= FileCertStore_setupStorePath("/own/private", rootDirectory,

                                           rootDirectorySize, &context->ownKeyFolder,

                                           certGroup->logging);

    return retval;

}

#ifdef __linux__

static UA_StatusCode

FileCertStore_createInotifyEvent(UA_CertificateGroup *certGroup) {

    if(certGroup == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    context->inotifyFd = inotify_init1(IN_NONBLOCK);

    if(context->inotifyFd == -1)

        return UA_STATUSCODE_BADINTERNALERROR;

    char folder[UA_PATH_MAX] = {0};

    mp_snprintf(folder, UA_PATH_MAX, "%.*s",

                (int)context->rootFolder.length, (char*)context->rootFolder.data);

    int wd = inotify_add_watch(context->inotifyFd, folder, IN_ALL_EVENTS);

    if(wd == -1) {

        close(context->inotifyFd);

        context->inotifyFd = -1;

        return UA_STATUSCODE_BADINTERNALERROR;

    }

    mp_snprintf(folder, UA_PATH_MAX, "%.*s",

                (int)context->trustedCertFolder.length, (char*)context->trustedCertFolder.data);

    wd = inotify_add_watch(context->inotifyFd, folder, IN_ALL_EVENTS);

    if(wd == -1) {

        close(context->inotifyFd);

        context->inotifyFd = -1;

        return UA_STATUSCODE_BADINTERNALERROR;

    }

    return UA_STATUSCODE_GOOD;

}

#endif /* __linux__ */

static UA_StatusCode

FileCertStore_getTrustList(UA_CertificateGroup *certGroup, UA_TrustListDataType *trustList) {

    /* Check parameter */

    if(certGroup == NULL || trustList == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    /* It will only re-read the Cert store on the file system if there have been changes to files. */

    UA_StatusCode retval = reloadTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    return context->store->getTrustList(context->store, trustList);

}

static UA_StatusCode

FileCertStore_setTrustList(UA_CertificateGroup *certGroup, const UA_TrustListDataType *trustList) {

    /* Check parameter */

    if(certGroup == NULL || trustList == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    /* It will only re-read the Cert store on the file system if there have been changes to files. */

    UA_StatusCode retval = reloadTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    retval = context->store->setTrustList(context->store, trustList);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    return writeTrustStore(certGroup, trustList->specifiedLists);

}

static UA_StatusCode

FileCertStore_addToTrustList(UA_CertificateGroup *certGroup, const UA_TrustListDataType *trustList) {

    /* Check parameter */

    if(certGroup == NULL || trustList == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    /* It will only re-read the Cert store on the file system if there have been changes to files. */

    UA_StatusCode retval = reloadTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    retval = context->store->addToTrustList(context->store, trustList);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    return writeTrustStore(certGroup, trustList->specifiedLists);

}

static UA_StatusCode

FileCertStore_removeFromTrustList(UA_CertificateGroup *certGroup, const UA_TrustListDataType *trustList) {

    /* Check parameter */

    if(certGroup == NULL || trustList == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    /* It will only re-read the Cert store on the file system if there have been changes to files. */

    UA_StatusCode retval = reloadTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    retval = context->store->removeFromTrustList(context->store, trustList);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    return writeTrustStore(certGroup, trustList->specifiedLists);

}

static UA_StatusCode

FileCertStore_getRejectedList(UA_CertificateGroup *certGroup, UA_ByteString **rejectedList, size_t *rejectedListSize) {

    /* Check parameter */

    if(certGroup == NULL || rejectedList == NULL || rejectedListSize == NULL)

        return UA_STATUSCODE_BADINTERNALERROR;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    return context->store->getRejectedList(context->store, rejectedList, rejectedListSize);

}

static UA_StatusCode

FileCertStore_getCertificateCrls(UA_CertificateGroup *certGroup, const UA_ByteString *certificate,

                                 const UA_Boolean isTrusted, UA_ByteString **crls,

                                 size_t *crlsSize) {

    /* Check parameter */

    if(certGroup == NULL || certificate == NULL || crls == NULL) {

        return UA_STATUSCODE_BADINTERNALERROR;

    }

    FileCertStore *context = (FileCertStore *)certGroup->context;

    /* It will only re-read the Cert store on the file system if there have been changes to files. */

    UA_StatusCode retval = reloadTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD)

        return retval;

    return context->store->getCertificateCrls(context->store, certificate, isTrusted, crls, crlsSize);

}

static UA_StatusCode

FileCertStore_verifyCertificate(UA_CertificateGroup *certGroup, const UA_ByteString *certificate) {

    /* Check parameter */

    if(certGroup == NULL || certificate == NULL)

        return UA_STATUSCODE_BADINVALIDARGUMENT;

    FileCertStore *context = (FileCertStore *)certGroup->context;

    /* It will only re-read the Cert store on the file system if there have been changes to files. */

    UA_StatusCode retval = reloadTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD) {

        return retval;

    }

    retval = context->store->verifyCertificate(context->store, certificate);

    if(retval == UA_STATUSCODE_BADCERTIFICATEUNTRUSTED ||

       retval == UA_STATUSCODE_BADCERTIFICATEUSENOTALLOWED ||

       retval == UA_STATUSCODE_BADCERTIFICATEREVOCATIONUNKNOWN ||

       retval == UA_STATUSCODE_BADCERTIFICATEISSUERREVOCATIONUNKNOWN) {

        /* write rejectedList to filestore */

        UA_ByteString *rejectedList = NULL;

        size_t rejectedListSize = 0;

        context->store->getRejectedList(context->store, &rejectedList, &rejectedListSize);

        writeTrustList(rejectedList, rejectedListSize,

                       context->rejectedCertFolder, ".der");

        UA_Array_delete(rejectedList, rejectedListSize, &UA_TYPES[UA_TYPES_BYTESTRING]);

    }

    return retval;

}

static void

FileCertStore_clear(UA_CertificateGroup *certGroup) {

    /* check parameter */

    if(!certGroup || !certGroup->context)

        return;

    UA_NodeId_clear(&certGroup->certificateGroupId);

    FileCertStore *context = (FileCertStore *)certGroup->context;

    if(context->store) {

        context->store->clear(context->store);

        UA_free(context->store);

    }

    UA_String_clear(&context->trustedCertFolder);

    UA_String_clear(&context->trustedCrlFolder);

    UA_String_clear(&context->issuerCertFolder);

    UA_String_clear(&context->issuerCrlFolder);

    UA_String_clear(&context->rejectedCertFolder);

    UA_String_clear(&context->ownCertFolder);

    UA_String_clear(&context->ownKeyFolder);

    UA_String_clear(&context->rootFolder);

#ifdef __linux__

    if(context->inotifyFd > 0)

        close(context->inotifyFd);

#endif /* __linux__ */

    UA_free(context);

    certGroup->context = NULL;

}

UA_StatusCode

UA_CertificateGroup_Filestore(UA_CertificateGroup *certGroup,

                              UA_NodeId *certificateGroupId,

                              const UA_String storePath,

                              const UA_Logger *logger,

                              const UA_KeyValueMap *params) {

    if(certGroup == NULL || certificateGroupId == NULL) {

        return UA_STATUSCODE_BADINTERNALERROR;

    }

    UA_StatusCode retval = UA_STATUSCODE_GOOD;

    /* Clear if the plugin is already initialized */

    if(certGroup->clear)

        certGroup->clear(certGroup);

    UA_NodeId_copy(certificateGroupId, &certGroup->certificateGroupId);

    certGroup->logging = logger;

    certGroup->getTrustList = FileCertStore_getTrustList;

    certGroup->setTrustList = FileCertStore_setTrustList;

    certGroup->addToTrustList = FileCertStore_addToTrustList;

    certGroup->removeFromTrustList = FileCertStore_removeFromTrustList;

    certGroup->getRejectedList = FileCertStore_getRejectedList;

    certGroup->getCertificateCrls = FileCertStore_getCertificateCrls;

    certGroup->verifyCertificate = FileCertStore_verifyCertificate;

    certGroup->clear = FileCertStore_clear;

    /* Set PKI Store context data */

    FileCertStore *context = (FileCertStore *)UA_calloc(1, sizeof(FileCertStore));

    if(!context) {

        retval = UA_STATUSCODE_BADOUTOFMEMORY;

        goto cleanup;

    }

    certGroup->context = context;

    retval = FileCertStore_createPkiDirectory(certGroup, storePath);

    if(retval != UA_STATUSCODE_GOOD) {

        UA_LOG_ERROR(logger, UA_LOGCATEGORY_APPLICATION,

                     "Could not create the PKI directory structure");

        goto cleanup;

    }

    context->store = (UA_CertificateGroup*)UA_calloc(1, sizeof(UA_CertificateGroup));

    retval = UA_CertificateGroup_Memorystore(context->store, certificateGroupId, NULL, logger, params);

    if(retval != UA_STATUSCODE_GOOD) {

        UA_LOG_ERROR(logger, UA_LOGCATEGORY_APPLICATION,

                     "Could not initialize the PKI memory store");

        goto cleanup;

    }

#ifdef __linux__

    retval = FileCertStore_createInotifyEvent(certGroup);

    if(retval != UA_STATUSCODE_GOOD) {

        goto cleanup;

    }

#endif /* __linux__ */

    retval = reloadAndWriteTrustStore(certGroup);

    if(retval != UA_STATUSCODE_GOOD) {

        UA_LOG_ERROR(logger, UA_LOGCATEGORY_APPLICATION,

                     "Could not load the PKI trust store from the filestore");

        goto cleanup;

    }

    return UA_STATUSCODE_GOOD;

    cleanup:

        certGroup->clear(certGroup);

    return retval;

}

#endif /* defined(__linux__) || defined(UA_ARCHITECTURE_WIN32) */

#endif /* UA_ENABLE_ENCRYPTION */