/*

 * Copyright (C) 2003-2012 Free Software Foundation, Inc.

 * Copyright (C) 2002 Andrew McDonald

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "str.h"

#include "x509_int.h"

#include "common.h"

#include "errors.h"

#include "system.h"

/**

 * gnutls_x509_crt_check_email:

 * @cert: should contain an gnutls_x509_crt_t type

 * @email: A null terminated string that contains an email address (RFC822)

 * @flags: should be zero

 *

 * This function will check if the given certificate's subject matches

 * the given email address.

 *

 * Returns: non-zero for a successful match, and zero on failure.

 **/

unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email,

             unsigned int flags)

{

  char rfc822name[MAX_CN];

  size_t rfc822namesize;

  bool dn_fallback_allowed = true;

  int ret = 0;

  int i = 0;

  char *a_email;

  gnutls_datum_t out;

  /* convert the provided email to ACE-Labels domain. */

  ret = _gnutls_idna_email_map(email, strlen(email), &out);

  if (ret < 0) {

    _gnutls_debug_log("unable to convert email %s to IDNA format\n",

          email);

    a_email = (char *)email;

  } else {

    a_email = (char *)out.data;

  }

  /* try matching against:

   *  1) an address as an alternative name (subjectAltName) extension

   *     in the certificate

   *  2) the EMAIL field in the certificate

   *

   *  only try (2) if there is no subjectAltName extension of

   *  type RFC822Name, and there is a single EMAIL.

   */

  /* Check through all included subjectAltName extensions, comparing

   * against all those of type RFC822Name.

   */

  for (i = 0; !(ret < 0); i++) {

    rfc822namesize = sizeof(rfc822name);

    ret = gnutls_x509_crt_get_subject_alt_name(

      cert, i, rfc822name, &rfc822namesize, NULL);

    if (ret < 0) {

      if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {

        /* oversized SAN; proceed without DN fallback */

        _gnutls_debug_log("oversized SAN ignored, "

              "disabling DN fallback\n");

        dn_fallback_allowed = false;

        ret = 0;

        continue;

      }

      if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

        gnutls_assert();

      break;

    }

    if (ret == GNUTLS_SAN_RFC822NAME) {

      dn_fallback_allowed = false;

      if (memchr(rfc822name, '\0', rfc822namesize)) {

        _gnutls_debug_log(

          "certificate has %s with embedded null in rfc822name\n",

          rfc822name);

        continue;

      }

      if (!_gnutls_str_is_print(rfc822name, rfc822namesize)) {

        _gnutls_debug_log(

          "invalid (non-ASCII) email in certificate %.*s\n",

          (int)rfc822namesize, rfc822name);

        continue;

      }

      ret = _gnutls_hostname_compare(

        rfc822name, rfc822namesize, a_email,

        GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS);

      if (ret != 0) {

        ret = 1;

        goto cleanup;

      }

    }

  }

  if (dn_fallback_allowed) {

    /* did not get the necessary extension, use DN email instead */

    /* only a single one must be present */

    rfc822namesize = sizeof(rfc822name);

    ret = gnutls_x509_crt_get_dn_by_oid(cert,

                GNUTLS_OID_PKCS9_EMAIL, 1,

                0, rfc822name,

                &rfc822namesize);

    if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

      ret = 0;

      goto cleanup;

    }

    rfc822namesize = sizeof(rfc822name);

    ret = gnutls_x509_crt_get_dn_by_oid(cert,

                GNUTLS_OID_PKCS9_EMAIL, 0,

                0, rfc822name,

                &rfc822namesize);

    if (ret < 0) {

      ret = 0;

      goto cleanup;

    }

    if (memchr(rfc822name, '\0', rfc822namesize)) {

      _gnutls_debug_log(

        "certificate has EMAIL %s with embedded null in name\n",

        rfc822name);

      ret = 0;

      goto cleanup;

    }

    if (!_gnutls_str_is_print(rfc822name, rfc822namesize)) {

      _gnutls_debug_log(

        "invalid (non-ASCII) email in certificate DN %.*s\n",

        (int)rfc822namesize, rfc822name);

      ret = 0;

      goto cleanup;

    }

    ret = _gnutls_hostname_compare(

      rfc822name, rfc822namesize, a_email,

      GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS);

    if (ret != 0) {

      ret = 1;

      goto cleanup;

    }

  }

  /* not found a matching name

   */

  ret = 0;

cleanup:

  if (a_email != email) {

    gnutls_free(a_email);

  }

  return ret;

}