/*

 *  Licensed to the Apache Software Foundation (ASF) under one or more

 *  contributor license agreements.  See the NOTICE file distributed with

 *  this work for additional information regarding copyright ownership.

 *  The ASF licenses this file to You under the Apache License, Version 2.0

 *  (the "License"); you may not use this file except in compliance with

 *  the License.  You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 *  Unless required by applicable law or agreed to in writing, software

 *  distributed under the License is distributed on an "AS IS" BASIS,

 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 *  See the License for the specific language governing permissions and

 *  limitations under the License.

 */

package org.apache.tomcat.jni;

/** SSL

 *

 * @author Mladen Turk

 */

public final class SSL {

    /*

     * Type definitions mostly from mod_ssl

     */

    public static final int UNSET            = -1;

    /*

     * Define the certificate algorithm types

     */

    public static final int SSL_ALGO_UNKNOWN = 0;

    public static final int SSL_ALGO_RSA     = (1<<0);

    public static final int SSL_ALGO_DSA     = (1<<1);

    public static final int SSL_ALGO_ALL     = (SSL_ALGO_RSA|SSL_ALGO_DSA);

    public static final int SSL_AIDX_RSA     = 0;

    public static final int SSL_AIDX_DSA     = 1;

    public static final int SSL_AIDX_MAX     = 2;

    /*

     * Define IDs for the temporary RSA keys and DH params

     */

    public static final int SSL_TMP_KEY_RSA_512  = 0;

    public static final int SSL_TMP_KEY_RSA_1024 = 1;

    public static final int SSL_TMP_KEY_RSA_2048 = 2;

    public static final int SSL_TMP_KEY_RSA_4096 = 3;

    public static final int SSL_TMP_KEY_DH_512   = 4;

    public static final int SSL_TMP_KEY_DH_1024  = 5;

    public static final int SSL_TMP_KEY_DH_2048  = 6;

    public static final int SSL_TMP_KEY_DH_4096  = 7;

    public static final int SSL_TMP_KEY_MAX      = 8;

    /*

     * Define the SSL options

     */

    public static final int SSL_OPT_NONE           = 0;

    public static final int SSL_OPT_RELSET         = (1<<0);

    public static final int SSL_OPT_STDENVVARS     = (1<<1);

    public static final int SSL_OPT_EXPORTCERTDATA = (1<<3);

    public static final int SSL_OPT_FAKEBASICAUTH  = (1<<4);

    public static final int SSL_OPT_STRICTREQUIRE  = (1<<5);

    public static final int SSL_OPT_OPTRENEGOTIATE = (1<<6);

    public static final int SSL_OPT_ALL            = (SSL_OPT_STDENVVARS|SSL_OPT_EXPORTCERTDATA|SSL_OPT_FAKEBASICAUTH|SSL_OPT_STRICTREQUIRE|SSL_OPT_OPTRENEGOTIATE);

    /*

     * Define the SSL Protocol options

     */

    public static final int SSL_PROTOCOL_NONE  = 0;

    public static final int SSL_PROTOCOL_SSLV2 = (1<<0);

    public static final int SSL_PROTOCOL_SSLV3 = (1<<1);

    public static final int SSL_PROTOCOL_TLSV1 = (1<<2);

    public static final int SSL_PROTOCOL_ALL   = (SSL_PROTOCOL_SSLV2|SSL_PROTOCOL_SSLV3|SSL_PROTOCOL_TLSV1);

    /*

     * Define the SSL verify levels

     */

    public static final int SSL_CVERIFY_UNSET          = UNSET;

    public static final int SSL_CVERIFY_NONE           = 0;

    public static final int SSL_CVERIFY_OPTIONAL       = 1;

    public static final int SSL_CVERIFY_REQUIRE        = 2;

    public static final int SSL_CVERIFY_OPTIONAL_NO_CA = 3;

    /* Use either SSL_VERIFY_NONE or SSL_VERIFY_PEER, the last 2 options

     * are 'ored' with SSL_VERIFY_PEER if they are desired

     */

    public static final int SSL_VERIFY_NONE                 = 0;

    public static final int SSL_VERIFY_PEER                 = 1;

    public static final int SSL_VERIFY_FAIL_IF_NO_PEER_CERT = 2;

    public static final int SSL_VERIFY_CLIENT_ONCE          = 4;

    public static final int SSL_VERIFY_PEER_STRICT          = (SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT);

    public static final int SSL_OP_MICROSOFT_SESS_ID_BUG            = 0x00000001;

    public static final int SSL_OP_NETSCAPE_CHALLENGE_BUG           = 0x00000002;

    public static final int SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG = 0x00000008;

    public static final int SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG      = 0x00000010;

    public static final int SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER       = 0x00000020;

    public static final int SSL_OP_MSIE_SSLV2_RSA_PADDING           = 0x00000040;

    public static final int SSL_OP_SSLEAY_080_CLIENT_DH_BUG         = 0x00000080;

    public static final int SSL_OP_TLS_D5_BUG                       = 0x00000100;

    public static final int SSL_OP_TLS_BLOCK_PADDING_BUG            = 0x00000200;

    /* Disable SSL 3.0/TLS 1.0 CBC vulnerability workaround that was added

     * in OpenSSL 0.9.6d.  Usually (depending on the application protocol)

     * the workaround is not needed.  Unfortunately some broken SSL/TLS

     * implementations cannot handle it at all, which is why we include

     * it in SSL_OP_ALL. */

    public static final int SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS      = 0x00000800;

    /* SSL_OP_ALL: various bug workarounds that should be rather harmless.

     *             This used to be 0x000FFFFFL before 0.9.7. */

    public static final int SSL_OP_ALL                              = 0x00000FFF;

    /* As server, disallow session resumption on renegotiation */

    public static final int SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION = 0x00010000;

    /* If set, always create a new key when using tmp_dh parameters */

    public static final int SSL_OP_SINGLE_DH_USE                    = 0x00100000;

    /* Set to always use the tmp_rsa key when doing RSA operations,

     * even when this violates protocol specs */

    public static final int SSL_OP_EPHEMERAL_RSA                    = 0x00200000;

    /* Set on servers to choose the cipher according to the server's

     * preferences */

    public static final int SSL_OP_CIPHER_SERVER_PREFERENCE         = 0x00400000;

    /* If set, a server will allow a client to issue a SSLv3.0 version number

     * as latest version supported in the premaster secret, even when TLSv1.0

     * (version 3.1) was announced in the client hello. Normally this is

     * forbidden to prevent version rollback attacks. */

    public static final int SSL_OP_TLS_ROLLBACK_BUG                 = 0x00800000;

    public static final int SSL_OP_NO_SSLv2                         = 0x01000000;

    public static final int SSL_OP_NO_SSLv3                         = 0x02000000;

    public static final int SSL_OP_NO_TLSv1                         = 0x04000000;

    /* The next flag deliberately changes the ciphertest, this is a check

     * for the PKCS#1 attack */

    public static final int SSL_OP_PKCS1_CHECK_1                    = 0x08000000;

    public static final int SSL_OP_PKCS1_CHECK_2                    = 0x10000000;

    public static final int SSL_OP_NETSCAPE_CA_DN_BUG               = 0x20000000;

    public static final int SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG  = 0x40000000;

    public static final int SSL_CRT_FORMAT_UNDEF    = 0;

    public static final int SSL_CRT_FORMAT_ASN1     = 1;

    public static final int SSL_CRT_FORMAT_TEXT     = 2;

    public static final int SSL_CRT_FORMAT_PEM      = 3;

    public static final int SSL_CRT_FORMAT_NETSCAPE = 4;

    public static final int SSL_CRT_FORMAT_PKCS12   = 5;

    public static final int SSL_CRT_FORMAT_SMIME    = 6;

    public static final int SSL_CRT_FORMAT_ENGINE   = 7;

    public static final int SSL_MODE_CLIENT         = 0;

    public static final int SSL_MODE_SERVER         = 1;

    public static final int SSL_MODE_COMBINED       = 2;

    public static final int SSL_SHUTDOWN_TYPE_UNSET    = 0;

    public static final int SSL_SHUTDOWN_TYPE_STANDARD = 1;

    public static final int SSL_SHUTDOWN_TYPE_UNCLEAN  = 2;

    public static final int SSL_SHUTDOWN_TYPE_ACCURATE = 3;

    public static final int SSL_INFO_SESSION_ID                = 0x0001;

    public static final int SSL_INFO_CIPHER                    = 0x0002;

    public static final int SSL_INFO_CIPHER_USEKEYSIZE         = 0x0003;

    public static final int SSL_INFO_CIPHER_ALGKEYSIZE         = 0x0004;

    public static final int SSL_INFO_CIPHER_VERSION            = 0x0005;

    public static final int SSL_INFO_CIPHER_DESCRIPTION        = 0x0006;

    public static final int SSL_INFO_PROTOCOL                  = 0x0007;

    /* To obtain the CountryName of the Client Certificate Issuer

     * use the SSL_INFO_CLIENT_I_DN + SSL_INFO_DN_COUNTRYNAME

     */

    public static final int SSL_INFO_CLIENT_S_DN               = 0x0010;

    public static final int SSL_INFO_CLIENT_I_DN               = 0x0020;

    public static final int SSL_INFO_SERVER_S_DN               = 0x0040;

    public static final int SSL_INFO_SERVER_I_DN               = 0x0080;

    public static final int SSL_INFO_DN_COUNTRYNAME            = 0x0001;

    public static final int SSL_INFO_DN_STATEORPROVINCENAME    = 0x0002;

    public static final int SSL_INFO_DN_LOCALITYNAME           = 0x0003;

    public static final int SSL_INFO_DN_ORGANIZATIONNAME       = 0x0004;

    public static final int SSL_INFO_DN_ORGANIZATIONALUNITNAME = 0x0005;

    public static final int SSL_INFO_DN_COMMONNAME             = 0x0006;

    public static final int SSL_INFO_DN_TITLE                  = 0x0007;

    public static final int SSL_INFO_DN_INITIALS               = 0x0008;

    public static final int SSL_INFO_DN_GIVENNAME              = 0x0009;

    public static final int SSL_INFO_DN_SURNAME                = 0x000A;

    public static final int SSL_INFO_DN_DESCRIPTION            = 0x000B;

    public static final int SSL_INFO_DN_UNIQUEIDENTIFIER       = 0x000C;

    public static final int SSL_INFO_DN_EMAILADDRESS           = 0x000D;

    public static final int SSL_INFO_CLIENT_M_VERSION          = 0x0101;

    public static final int SSL_INFO_CLIENT_M_SERIAL           = 0x0102;

    public static final int SSL_INFO_CLIENT_V_START            = 0x0103;

    public static final int SSL_INFO_CLIENT_V_END              = 0x0104;

    public static final int SSL_INFO_CLIENT_A_SIG              = 0x0105;

    public static final int SSL_INFO_CLIENT_A_KEY              = 0x0106;

    public static final int SSL_INFO_CLIENT_CERT               = 0x0107;

    public static final int SSL_INFO_CLIENT_V_REMAIN           = 0x0108;

    public static final int SSL_INFO_SERVER_M_VERSION          = 0x0201;

    public static final int SSL_INFO_SERVER_M_SERIAL           = 0x0202;

    public static final int SSL_INFO_SERVER_V_START            = 0x0203;

    public static final int SSL_INFO_SERVER_V_END              = 0x0204;

    public static final int SSL_INFO_SERVER_A_SIG              = 0x0205;

    public static final int SSL_INFO_SERVER_A_KEY              = 0x0206;

    public static final int SSL_INFO_SERVER_CERT               = 0x0207;

    /* Return client certificate chain.

     * Add certificate chain number to that flag (0 ... verify depth)

     */

    public static final int SSL_INFO_CLIENT_CERT_CHAIN         = 0x0400;

    /* Return OpenSSL version number */

    public static native int version();

    /* Return OpenSSL version string */

    public static native String versionString();

    /**

     * Initialize OpenSSL support.

     * This function needs to be called once for the

     * lifetime of JVM. Library.init() has to be called before.

     * @param engine Support for external a Crypto Device ("engine"),

     *                usually

     * a hardware accellerator card for crypto operations.

     * @return APR status code

     */

    public static native int initialize(String engine);

    /**

      * Set source of entropy to use in SSL

      *  @param filename Filename containing random data

      */

    public static native boolean randSet(String filename);

    /**

     * Add content of the file to the PRNG

     * @param filename Filename containing random data.

     *        If null the default file will be tested.

     *        The seed file is $RANDFILE if that environment variable is

     *        set, $HOME/.rnd otherwise.

     *        In case both files are unavailable builtin

     *        random seed generator is used.

     */

    public static native boolean randLoad(String filename);

    /**

     * Writes a number of random bytes (currently 1024) to

     * file <code>filename</code> which can be used to initialize the PRNG

     * by calling randLoad in a later session.

     * @param filename Filename to save the data

     */

    public static native boolean randSave(String filename);

    /**

     * Creates random data to filename

     * @param filename Filename to save the data

     * @param len The length of random sequence in bytes

     * @param base64 Output the data in Base64 encoded format

     */

    public static native boolean randMake(String filename, int len,

                                          boolean base64);

    /**

     * Initialize new BIO

     * @param pool The pool to use.

     * @param callback BIOCallback to use

     * @return New BIO handle

     */

     public static native long newBIO(long pool, BIOCallback callback)

            throws Exception;

    /**

     * Close BIO and derefrence callback object

     * @param bio BIO to close and destroy.

     * @return APR Status code

     */

     public static native int closeBIO(long bio);

    /**

     * Set global Password callback for obtaining passwords.

     * @param callback PasswordCallback implementation to use.

     */

     public static native void setPasswordCallback(PasswordCallback callback);

    /**

     * Set global Password for decrypting certificates and keys.

     * @param password Password to use.

     */

     public static native void setPassword(String password);

    /**

     * Generate temporary RSA key.

     * <br />

     * Index can be one of:

     * <PRE>

     * SSL_TMP_KEY_RSA_512

     * SSL_TMP_KEY_RSA_1024

     * SSL_TMP_KEY_RSA_2048

     * SSL_TMP_KEY_RSA_4096

     * </PRE>

     * By default 512 and 1024 keys are generated on startup.

     * You can use a low priority thread to generate them on the fly.

     * @param idx temporary key index.

     */

    public static native boolean generateRSATempKey(int idx);

    /**

     * Load temporary DSA key from file

     * <br />

     * Index can be one of:

     * <PRE>

     * SSL_TMP_KEY_DH_512

     * SSL_TMP_KEY_DH_1024

     * SSL_TMP_KEY_DH_2048

     * SSL_TMP_KEY_DH_4096

     * </PRE>

     * @param idx temporary key index.

     * @param file File contatining DH params.

     */

    public static native boolean loadDSATempKey(int idx, String file);

    /**

     * Return last SSL error string

     */

    public static native String getLastError();

}