/* c_rehash.c - Create hash symlinks for certificates

 * C implementation based on the original Perl and shell versions

 *

 * Copyright (c) 2013-2014 Timo Teräs <timo.teras@iki.fi>

 * All rights reserved.

 *

 * This software is licensed under the MIT License.

 * Full license available at: http://opensource.org/licenses/MIT

 */

#include <stdio.h>

#include <limits.h>

#include <string.h>

#include <unistd.h>

#include <dirent.h>

#include <sys/stat.h>

#include <openssl/evp.h>

#include <openssl/pem.h>

#include <openssl/x509.h>

#define MAX_COLLISIONS	256

#define countof(x) 	(sizeof(x) / sizeof(x[0]))

#if 0

#define DEBUG(args...) fprintf(stderr, args)

#else

#define DEBUG(args...)

#endif

struct entry_info {

	struct entry_info *next;

	char *filename;

	unsigned short old_id;

	unsigned char need_symlink;

	unsigned char digest[EVP_MAX_MD_SIZE];

};

struct bucket_info {

	struct bucket_info *next;

	struct entry_info *first_entry, *last_entry;

	unsigned int hash;

	unsigned short type;

	unsigned short num_needed;

};

enum Type {

	TYPE_CERT = 0,

	TYPE_CRL

};

static const char *symlink_extensions[] = { "", "r" };

static const char *file_extensions[] = { "pem", "crt", "cer", "crl" };

static int evpmdsize;

static const EVP_MD *evpmd;

static int do_hash_new = 1;

static int do_hash_old = 0;

static int do_remove_links = 1;

static int do_verbose = 0;

static struct bucket_info *hash_table[257];

static void bit_set(unsigned char *set, unsigned bit)

{

	set[bit / 8] |= 1 << (bit % 8);

}

static int bit_isset(unsigned char *set, unsigned bit)

{

	return set[bit / 8] & (1 << (bit % 8));

}

static void add_entry(

	int type, unsigned int hash,

	const char *filename, const unsigned char *digest,

	int need_symlink, unsigned short old_id)

{

	struct bucket_info *bi;

	struct entry_info *ei, *found = NULL;

	unsigned int ndx = (type + hash) % countof(hash_table);

	for (bi = hash_table[ndx]; bi; bi = bi->next)

		if (bi->type == type && bi->hash == hash)

			break;

	if (!bi) {

		bi = calloc(1, sizeof(*bi));

		if (!bi) return;

		bi->next = hash_table[ndx];

		bi->type = type;

		bi->hash = hash;

		hash_table[ndx] = bi;

	}

	for (ei = bi->first_entry; ei; ei = ei->next) {

		if (digest && memcmp(digest, ei->digest, evpmdsize) == 0) {

			fprintf(stderr,

				"WARNING: Skipping duplicate certificate in file %s\n",

				filename);

			return;

		}

		if (!strcmp(filename, ei->filename)) {

			found = ei;

			if (!digest) break;

		}

	}

	ei = found;

	if (!ei) {

		if (bi->num_needed >= MAX_COLLISIONS) return;

		ei = calloc(1, sizeof(*ei));

		if (!ei) return;

		ei->old_id = ~0;

		ei->filename = strdup(filename);

		if (bi->last_entry) bi->last_entry->next = ei;

		if (!bi->first_entry) bi->first_entry = ei;

		bi->last_entry = ei;

	}

	if (old_id < ei->old_id) ei->old_id = old_id;

	if (need_symlink && !ei->need_symlink) {

		ei->need_symlink = 1;

		bi->num_needed++;

		memcpy(ei->digest, digest, evpmdsize);

	}

}

static int handle_symlink(const char *filename, const char *fullpath)

{

	static char xdigit[] = {

		 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,-1,-1,-1,-1,-1,-1,

		-1,10,11,12,13,14,15,-1,-1,-1,-1,-1,-1,-1,-1,-1,

		-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,

		-1,10,11,12,13,14,15

	};

	char linktarget[NAME_MAX], *endptr;

	unsigned int hash = 0;

	unsigned char ch;

	int i, type, id;

	ssize_t n;

	for (i = 0; i < 8; i++) {

		ch = filename[i] - '0';

		if (ch >= countof(xdigit) || xdigit[ch] < 0)

			return -1;

		hash <<= 4;

		hash += xdigit[ch];

	}

	if (filename[i++] != '.') return -1;

	for (type = countof(symlink_extensions) - 1; type > 0; type--)

		if (strcasecmp(symlink_extensions[type], &filename[i]) == 0)

			break;

	i += strlen(symlink_extensions[type]);

	id = strtoul(&filename[i], &endptr, 10);

	if (*endptr != 0) return -1;

	n = readlink(fullpath, linktarget, sizeof(linktarget));

	if (n >= sizeof(linktarget) || n < 0) return -1;

	linktarget[n] = 0;

	DEBUG("Found existing symlink %s for %08x (%d), certname %s\n",

		filename, hash, type, linktarget);

	add_entry(type, hash, linktarget, NULL, 0, id);

	return 0;

}

static int handle_certificate(const char *filename, const char *fullpath)

{

	STACK_OF(X509_INFO) *inf;

	X509_INFO *x;

	BIO *b;

	const char *ext;

	unsigned char digest[EVP_MAX_MD_SIZE];

	X509_NAME *name = NULL;

	int type, ret = -1;

	size_t i;

	ext = strrchr(filename, '.');

	if (ext == NULL) return 0;

	for (i = 0; i < countof(file_extensions); i++) {

		if (strcasecmp(file_extensions[i], ext+1) == 0)

			break;

	}

	if (i >= countof(file_extensions)) return -1;

	b = BIO_new_file(fullpath, "r");

	if (!b) return -1;

	inf = PEM_X509_INFO_read_bio(b, NULL, NULL, NULL);

	BIO_free(b);

	if (!inf) return -1;

	if (sk_X509_INFO_num(inf) == 1) {

		x = sk_X509_INFO_value(inf, 0);

		if (x->x509) {

			type = TYPE_CERT;

			name = X509_get_subject_name(x->x509);

			X509_digest(x->x509, evpmd, digest, NULL);

		} else if (x->crl) {

			type = TYPE_CRL;

			name = X509_CRL_get_issuer(x->crl);

			X509_CRL_digest(x->crl, evpmd, digest, NULL);

		}

		if (name && do_hash_new)

			add_entry(type, X509_NAME_hash(name), filename, digest, 1, ~0);

		if (name && do_hash_old)

			add_entry(type, X509_NAME_hash_old(name), filename, digest, 1, ~0);

	} else {

		fprintf(stderr,

			"WARNING: %s does not contain exactly one certificate or CRL: skipping\n",

			filename);

	}

	sk_X509_INFO_pop_free(inf, X509_INFO_free);

	return ret;

}

static int hash_dir(const char *dirname)

{

	struct bucket_info *bi, *nextbi;

	struct entry_info *ei, *nextei;

	struct dirent *de;

	struct stat st;

	unsigned char idmask[MAX_COLLISIONS / 8];

	int n, nextid, buflen, ret = -1;

	const char *pathsep;

	char *buf;

	size_t i;

	DIR *d;

	if (access(dirname, R_OK|W_OK|X_OK) != 0) {

		fprintf(stderr,

			"ERROR: Access denied '%s'\n",

			dirname);

		return -1;

	}

	buflen = strlen(dirname);

	pathsep = (buflen && dirname[buflen-1] == '/') ? "" : "/";

	buflen += NAME_MAX + 2;

	buf = malloc(buflen);

	if (buf == NULL)

		goto err;

	if (do_verbose) printf("Doing %s\n", dirname);

	d = opendir(dirname);

	if (!d) goto err;

	while ((de = readdir(d)) != NULL) {

		if (snprintf(buf, buflen, "%s%s%s", dirname, pathsep, de->d_name) >= buflen)

			continue;

		if (lstat(buf, &st) < 0)

			continue;

		if (S_ISLNK(st.st_mode) && handle_symlink(de->d_name, buf) == 0)

			continue;

		handle_certificate(de->d_name, buf);

	}

	closedir(d);

	for (i = 0; i < countof(hash_table); i++) {

		for (bi = hash_table[i]; bi; bi = nextbi) {

			nextbi = bi->next;

			DEBUG("Type %d, hash %08x, num entries %d:\n", bi->type, bi->hash, bi->num_needed);

			nextid = 0;

			memset(idmask, 0, (bi->num_needed+7)/8);

			for (ei = bi->first_entry; ei; ei = ei->next)

				if (ei->old_id < bi->num_needed)

					bit_set(idmask, ei->old_id);

			for (ei = bi->first_entry; ei; ei = nextei) {

				nextei = ei->next;

				DEBUG("\t(old_id %d, need_symlink %d) Cert %s\n",

					ei->old_id, ei->need_symlink,

					ei->filename);

				if (ei->old_id < bi->num_needed) {

					/* Link exists, and is used as-is */

					snprintf(buf, buflen, "%08x.%s%d", bi->hash, symlink_extensions[bi->type], ei->old_id);

					if (do_verbose) printf("link %s -> %s\n", ei->filename, buf);

				} else if (ei->need_symlink) {

					/* New link needed (it may replace something) */

					while (bit_isset(idmask, nextid))

						nextid++;

					snprintf(buf, buflen, "%s%s%n%08x.%s%d",

						 dirname, pathsep, &n, bi->hash,

						 symlink_extensions[bi->type],

						 nextid);

					if (do_verbose) printf("link %s -> %s\n", ei->filename, &buf[n]);

					unlink(buf);

					symlink(ei->filename, buf);

				} else if (do_remove_links) {

					/* Link to be deleted */

					snprintf(buf, buflen, "%s%s%n%08x.%s%d",

						 dirname, pathsep, &n, bi->hash,

						 symlink_extensions[bi->type],

						 ei->old_id);

					if (do_verbose) printf("unlink %s\n", &buf[n]);

					unlink(buf);

				}

				free(ei->filename);

				free(ei);

			}

			free(bi);

		}

		hash_table[i] = NULL;

	}

	ret = 0;

err:

	free(buf);

	return ret;

}

static void c_rehash_usage(void)

{

	printf("\

usage: c_rehash <args> <dirs>\n\

\n\

-compat       - create new- and old-style hashed links\n\

-old          - use old-style hashing for generating links\n\

-h            - display this help\n\

-n            - do not remove existing links\n\

-v            - be more verbose\n\

\n");

}

int main(int argc, char **argv)

{

	const char *env, *opt;

	int i, numargs, r = 0;

	evpmd = EVP_sha1();

	evpmdsize = EVP_MD_size(evpmd);

	numargs = argc;

	for (i = 1; i < argc; i++) {

		if (argv[i][0] != '-') continue;

		if (strcmp(argv[i], "--") == 0) { argv[i] = 0; numargs--; break; }

		opt = &argv[i][1];

		if (strcmp(opt, "compat") == 0) {

			do_hash_new = do_hash_old = 1;

		} else if (strcmp(opt, "old") == 0) {

			do_hash_new = 0;

			do_hash_old = 1;

		} else if (strcmp(opt, "n") == 0) {

			do_remove_links = 0;

		} else if (strcmp(opt, "v") == 0) {

			do_verbose++;

		} else {

			if (strcmp(opt, "h") != 0)

				fprintf(stderr, "unknown option %s\n", argv[i]);

			c_rehash_usage();

			return 1;

		}

		argv[i] = 0;

		numargs--;

	}

	if (numargs > 1) {

		for (i = 1; i < argc; i++)

			if (argv[i]) r |= hash_dir(argv[i]);

	} else if ((env = getenv("SSL_CERT_DIR")) != NULL) {

		char *e, *m;

		m = strdup(env);

		for (e = strtok(m, ":"); e != NULL; e = strtok(NULL, ":"))

			r |= hash_dir(e);

		free(m);

	} else {

		r |= hash_dir("/etc/ssl/certs");

	}

	return r ? 2 : 0;

}