//
// Copyright (c) 2017-2026, Manticore Software LTD (https://manticoresearch.com)
// Copyright (c) 2001-2016, Andrew Aksyonoff
// Copyright (c) 2008-2016, Sphinx Technologies Inc
// All rights reserved
//
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License. You should have
// received a copy of the GPL license along with this program; if you
// did not, you can find it at http://www.gnu.org/
//

/// @file searchdssl.h
/// SSL 

#pragma once

#include "networking_daemon.h"

void ForceSsl();
const CSphString & GetSslCert();
const CSphString & GetSslKey();

constexpr int GCM_NONCE_LEN = 12;

bool EncryptGCM ( const VecTraits_T<BYTE> & dRawData, const CSphString & sUser, const VecTraits_T<BYTE> & dEncKey, const BYTE * pSrcNonce, int iHeadGap, CSphVector<BYTE> & dDstData, CSphString & sError );

class GcmUserKey_i
{
public:
	virtual ~GcmUserKey_i() = default;
	virtual std::optional < CSphFixedVector<BYTE> > Get ( const CSphString & sUser, CSphString & sError ) const = 0;
	virtual bool ValidateNonceReplay ( const BYTE * pNonce, CSphString & sError ) const = 0;
};

bool DecryptGCM ( const VecTraits_T<BYTE> & dEncryptedData, CSphVector<BYTE> & dDstData, CSphString & sUser, GcmUserKey_i & tKey, CSphString & sError );
bool MakeApiKdf ( const ByteBlob_t & tSalt, const ByteBlob_t & tPwd, CSphFixedVector<BYTE> & dRes, CSphString & sError );
bool MakeRandBuf ( VecTraits_T<BYTE> & dRes, CSphString & sError );
bool MakeRandBuf ( Str_t & sRes, CSphString & sError );
bool SecretEqual ( const VecTraits_T<BYTE> & dA, const VecTraits_T<BYTE> & dB );

#if WITH_SSL
	// Kept forward-declared so SSL consumers do not need to include OpenSSL headers.
	typedef struct bio_st BIO;

	// set SSL key, certificate and ca-certificate to be used in SSL, if required.
	// does NOT anyway initialize SSL library or call any of it's funcitons.
	void SetServerSSLKeys ( const CSphString & sSslCert,  const CSphString & sSslKey,  const CSphString & sSslCa );

	// Try to initialize SSL, if not yet done. Returns whether it is usable or not (i.e. - no lib, no keys, any error).
	// used to set 'switch-to-ssl' bit in mysql handshake depending from whether we can do it, or not.
	bool CheckWeCanUseSSL ( CSphString * pError=nullptr );

	// Replace pSource with it's SSL version.
	// any data not consumed from original source will be considered as part of ssl handshake.
	bool MakeSecureLayer ( std::unique_ptr<AsyncNetBuffer_c> & pSource );

	// Creates the SSL input buffer around a supplied BIO; used by SSL tests.
	std::unique_ptr<AsyncNetBuffer_c> MakeSslTestBuffer ( BIO * pSslBackend );

#else
	// these stubs work together with NOT including searchdsll.cpp into the final build
	inline void SetServerSSLKeys ( const CSphString &,  const CSphString &,  const CSphString & ) {}
	inline bool CheckWeCanUseSSL ( CSphString * pError=nullptr )
	{
		if ( pError )
			*pError="daemon built without SSL support";
		return false;
	}
	inline bool MakeSecureLayer ( std::unique_ptr<AsyncNetBuffer_c> & ) { return false; }

	void ForceSsl();
#endif
