/*
 * Copyright (c) 2013 Sunil Nimmagadda <sunil@nimmagadda.net>
 * Copyright (c) 2006 Pierre-Yves Ritschard <pyr@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/stat.h>

#include <fcntl.h>
#include <syslog.h>
#include <unistd.h>

#include <openssl/ssl.h>
#include <openssl/engine.h>
#include <openssl/err.h>

#include "pop3d.h"
#include "ssl.h"

#define SSL_CIPHERS		"HIGH"
#define SSL_SESSION_TIMEOUT	300
#define CERTFILE		"/etc/ssl/server.crt"
#define KEYFILE			"/etc/ssl/private/server.key"

static char *ssl_load_file(const char *, off_t *);

void
ssl_init(void)
{
	/* SSL init */
	SSL_library_init();
	SSL_load_error_strings();
	OpenSSL_add_all_algorithms();

	/* Init hardware cryto engines. */
	ENGINE_load_builtin_engines();
	ENGINE_register_all_complete();
}

void *
ssl_setup(void)
{
	SSL_CTX *ctx = NULL;
	char	*cert, *key;
	off_t	cert_len, key_len;

	/* SSL context creation */
	ctx = SSL_CTX_new(SSLv23_server_method());
	if (ctx == NULL) {
		ssl_error("ssl_ctx_create");
		fatal("ssl_ctx_create: could not create SSL context");
	}

	SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
	SSL_CTX_set_timeout(ctx, SSL_SESSION_TIMEOUT);
	SSL_CTX_set_options(ctx,
	    SSL_OP_ALL | SSL_OP_NO_SSLv2 | SSL_OP_NO_TICKET);
	SSL_CTX_set_options(ctx,
	    SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION);

	/* SSL certificate, key loading */
	cert = ssl_load_file(CERTFILE, &cert_len);
	if (cert == NULL)
		fatal("ssl_load_file: Unable to load " CERTFILE);

	key = ssl_load_file(KEYFILE, &key_len);
	if (key == NULL)
		fatal("ssl_load_file: Unable to load " KEYFILE);

	if (!SSL_CTX_set_cipher_list(ctx, SSL_CIPHERS))
		goto err;

	if (!ssl_ctx_use_certificate_chain(ctx, cert, cert_len))
		goto err;

	else if (!ssl_ctx_use_private_key(ctx, key, key_len))
		goto err;

	else if (!SSL_CTX_check_private_key(ctx))
		goto err;

	return (ctx);

err:
	if (ctx != NULL)
		SSL_CTX_free(ctx);
	ssl_error("ssl_setup");
	fatal("ssl_setup: cannot set SSL up");
	return (NULL);
}

void *
pop3s_init(SSL_CTX *ctx, int fd)
{
	SSL *ssl;

	if ((ssl = SSL_new(ctx)) == NULL)
		fatal("SSL_new");

	if (SSL_set_fd(ssl, fd) == 0)
		fatal("SSL_set_fd");

	return (ssl);
}

static char *
ssl_load_file(const char *name, off_t *len)
{
	struct stat	st;
	off_t		size;
	char		*buf = NULL;
	int		fd;

	if ((fd = open(name, O_RDONLY)) == -1)
		return (NULL);

	if (fstat(fd, &st) != 0)
		goto fail;

	size = st.st_size;
	if ((buf = calloc(1, size + 1)) == NULL)
		goto fail;
	if (read(fd, buf, size) != size)
		goto fail;

	close(fd);

	*len = size;
	return (buf);

fail:
	if (buf != NULL)
		free(buf);

	close(fd);
	return (NULL);
}

void
ssl_error(const char *where)
{
	unsigned long	code;
	char		errbuf[128];
	extern int	debug;

	if (!debug)
		return;

	for (; (code = ERR_get_error()) != 0 ;) {
		ERR_error_string_n(code, errbuf, sizeof(errbuf));
		logit(LOG_DEBUG, "SSL library error: %s: %s", where, errbuf);
	}
}