#

# Copyright (c) 2009 Nokia Corporation and/or its subsidiary(-ies).

# All rights reserved.

# This component and the accompanying materials are made available

# under the terms of "Eclipse Public License v1.0"

# which accompanies this distribution, and is available

# at the URL "http://www.eclipse.org/legal/epl-v10.html".

#

# Initial Contributors:

# Nokia Corporation - initial contribution.

#

# Contributors:

#

# Description: 

#

##################################################################

##  Tool used to managing the security policies and the set of  ##

##  X.509 certificates used as trust anchors in verifying the   ##

##  authenticity of signing certificates used for signing       ##

##  java applications                                           ##

##                                                              ##

##  This tool can be used at two different phases:              ##

##  1) at ROM image creation time (used by variant engineers)   ##

##     before generating the variant ROM image and before       ##

##     using S60 Configuration tool.                            ##

##     When used at this phase,                                 ##

##     the tool instructs the ROM image creation process on     ##

##     which policies and certificates to include into the ROM  ##

##     image                                                    ##

##  2) after ROM image creation time. When used at this phase   ##

##     the tool generates deployment packages (SIS) to be       ##

##     installed into "already flashed ROM images"              ##

##                                                              ##

##  This tool assumes the existence of a S60 environment,       ##

##  therefore it must be used from within a S60 environment     ##

##################################################################

#use strict;

use Getopt::Std;

use XML::Simple;

use File::Spec;

use File::Copy;

# s60 specific paths

my $CERTS_BUILD_DIR_1                             = "/epoc32/data/z/private/200211dc/security/trustroots/device/certificates/";

my $CERTS_BUILD_DIR_2                             = "/epoc32/release/armv5/urel/z/private/200211dc/security/trustroots/device/certificates/";

my $POLICIES_BUILD_DIR_1                          = "/epoc32/data/z/resource/java/security/policies/";

my $POLICIES_BUILD_DIR_2                          = "/epoc32/release/armv5/urel/z/resource/java/security/policies/";

my $IBY_DIR                                       = "/epoc32/rom/include/core/app/";

my $IBY_TEST_DIR                                  = "/epoc32/rom/include/core/tools/";

my $CONFML_DATA_DIR                               = "/epoc32/rom/config/confml_data/s60/";

# global variables

my $config_file;

my $cert_to_remove;

my $policy_to_remove;

my $deployment_destination;

my $signing_cert;

my $signing_key;

my $add_header                                     = 0;

my $deploy                                         = 1;

my $iby_file_name;

my $iby_name;

my $sis_file_name;

my $pkg_file_name;

my $pkg_name;

my $package_type;

my $s60_version;

my $signed_sis                                     = "false";

my $ROM                                            = "rom";

my $SIS                                            = "sis";

my $openssl                                        = "openssl.exe";

my $METADATA_EXT                                   = ".metadata";

my $STATE_EXT                                      = ".state";

my $JAVA_IBY_FILENAME                              = "java.iby";

my $JAVA_TEST_IBY_FILENAME                         = "javatest.iby";

my $JAVA_VARIANT_CERTS_IBY_FILENAME                = "java_variant_certs.iby";

my $JAVA_VARIANT_CERTS_PKG_FILENAME                = "java_variant_certs.pkg";

my $JAVA_VARIANT_CERTS_SIS_FILENAME                = "java_variant_certs.sis";

my $JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME   = "java_variant_certs_policies.iby";

my $JAVA_VARIANT_CERTS_AND_POLICIES_PKG_FILENAME   = "java_variant_certs_policies.pkg";

my $JAVA_VARIANT_CERTS_AND_POLICIES_SIS_FILENAME   = "java_variant_certs_policies.sis";

my $JAVA_VARIANT_POLICY_IBY_FILENAME               = "java_variant_policy.iby";

my $JAVA_VARIANT_POLICY_PKG_FILENAME               = "java_variant_policy.pkg";

my $JAVA_VARIANT_POLICY_SIS_FILENAME               = "java_variant_policy.sis";

my $JAVA_CUSTOM_SECURITY_PKG_FILENAME              = "java_custom_security.pkg";

my $JAVA_CUSTOM_SECURITY_SIS_FILENAME              = "java_custom_security.sis";

my $NON_REMOVABLE_PACKAGE_TYPE                     = ",(0x2001FD68), 1,0,0, TYPE=PU,RU\n%{\"Nokia\"}\n:\"Nokia\"\n[0x1028315F], 0, 0, 0, {\"Series60ProductID\"}\n";

my $REMOVABLE_PACKAGE_TYPE                         = ",(0x2001FD68), 1,0,0, TYPE=SP,RU\n%{\"Nokia\"}\n:\"Nokia\"\n[0x1028315F], 0, 0, 0, {\"Series60ProductID\"}\n";

# IBY and PKG data

my $CERTS_DATACAGE                                 = "\\private\\200211dc\\security\\trustroots\\device\\certificates\\";

my $CERTS_DEST                                     = "\\resource\\java\\security\\trustroots\\";

my $CERTS_STATE_DATACAGE                           = "\\private\\200211dc\\security\\trustroots\\device\\state\\";

my $POLICIES_DATACAGE_SRC                          = "\\resource\\java\\security\\policies\\";

my $POLICIES_DATACAGE_SRC_5_0                      = "\\private\\102033E6\\resource\\security\\policies\\";

my $POLICIES_DATACAGE_DEST                         = "RESOURCE_FILES_DIR\\java\\security\\policies\\";

##############################################################

##  Displays the usage help                                 ##

##############################################################

sub usage

{

  system("cls");

  print "\nUsage:\n\javasecuritycustomizationtool.pl listcerts | addcerts | deploycerts | removecert <cert_name> | listpolicies | addpolicy | deploypolicy | removepolicy <policy_name> | addall | deployall | setpolicy | setwarningsmode \n";

  print "\nWhere:\n";

  print "listcerts       Lists all the X.509 certificates used as trust anchors in\n";

  print "                verifying the authenticity of signed java applications and\n";

  print "                also used in binding java applications to protection domains\n";

  print "addcerts        Adds new X.509 certificates into the existing collection\n";

  print "                of X.509 certificates used as trust anchors in verifying the\n";

  print "                authenticity of signed java applications and also used in\n";

  print "                binding java applications to protection domains\n";

  print "                The properties of the certificates to be added are specified\n";

  print "                by the file 'configdata.xml'\n";

  print "deploycerts     Creates a SIS package, containing new X.509 certificates,\n";

  print "                to be installed into a device having java security system in \n";

  print "                place. These new certificates are used as trust anchors in\n";

  print "                verifying the authenticity of signed java applications and\n";

  print "                also used in binding java applications to protection domains\n";

  print "                The properties of the certificates to be deployed are specified\n";

  print "                by the file 'configdata.xml'\n";

  print "removecert      Removes a single X.509 certificate from the existing collection\n";

  print "                of X.509 certificates used as trust anchors in verifying the\n";

  print "                authenticity of signed java applications and also used in\n";

  print "                binding java applications to protection domains\n";

  print "listpolicies    Lists all the policies used for granting permissions to java\n";

  print "                applications\n";

  print "addpolicy       Adds a new policy into the existing collection of policies\n";

  print "                used for granting permissions to java applications\n";

  print "                The properties of the policy to be added are specified\n";

  print "                by the file 'configdata.xml'\n";

  print "deploypolicy    Creates a SIS package, containing a new policy, to be\n";

  print "                installed into a device having java security system in place\n";

  print "                The properties of the policy to be deployed are specified by\n";

  print "                the file 'configdata.xml'\n";

  print "removepolicy    Removes a single policy from the collection of policies\n";

  print "                used for granting permissions to java applications\n";

  print "addall          Adds new X.509 certificates and a new policy into the existing\n";

  print "                collection of certificates/policies used for\n";

  print "                authentication/authorization of java applications. This is the\n";

  print "                equivalent of the combined command line arguments 'addcerts'\n";

  print "                and 'addpolicy'\n";

  print "deployall       Creates a SIS package, containing new X.509 certificates and a\n";

  print "                new policy, to be installed into a device having java security\n";

  print "                system in place. This is a the equivalent of the combined\n";

  print "                command line arguments 'deploycerts' and 'deploypolicy'\n";

  print "                The properties of the certificates and policy to be deployed\n";

  print "                are specified by the file 'configdata.xml'\n";

  print "setpolicy       Creates a SIS package, which selects the policy to be used for\n";

  print "                granting permissions to java applications. This SIS is to be\n";

  print "                installed into a device having java security system in place\n";

  print "                The name of the selected policy is specified by the file\n";

  print "                'configdata.xml'\n";

  print "setwarningsmode Creates a SIS package, which selects the mode used for handling\n";

  print "                security warnings. This SIS is to be installed into a device\n";

  print "                having java security system in place\n";

  print "                The warnings mode is specified by the file 'configdata.xml'\n";

  print "\n\nThis tool can be used at two different phases:\n";

  print "  1) at ROM image creation time (used by variant engineers) before generating\n";

  print "     the variant ROM image and before using S60 Configuration tool. Used at\n";

  print "     this phase the tool produces configuration data for the ROM image creation\n";

  print "     process. The command line arguments to be used at this phase are:\n";

  print "     'listcerts', 'addcerts', 'removecert', 'listpolicies', 'addpolicy',\n";

  print "     'removepolicy', and 'addall'\n";

  print "  2) after ROM image creation time. Used at this phase the tool generates\n";

  print "     deployment packages (SIS) to be installed into 'already flashed ROM\n";

  print "     images'. The command line arguments to be used at this phase are:\n"; 

  print "     'deploycerts', 'deploypolicy', 'setpolicy', 'setwarningsmode' and\n"; 

  print "     'deployall'\n";

  print "\nThis tool assumes the existence of a S60 environment, therefore it must be used\n";

  print "from within a S60 environment\n";

  exit;

}

##############################################################

##  Lists all the certificates                              ##

##############################################################

sub list_certs()

{

  @files = <$CERTS_BUILD_DIR_1*>;

  @certs;

  @domains;

  @paths;

  foreach $file (@files) {

    if (rindex($file, $METADATA_EXT) < 0)

    {

      $ext = rindex($file, ".");

      my $file_without_ext = substr($file, 0, $ext);

      $cert_name = substr($file, length("$CERTS_BUILD_DIR_1"));

      if (! grep {$_ eq $cert_name} @certs) {

        push(@certs, $cert_name);

        push(@paths, $CERTS_BUILD_DIR_1);

        open (METADATA_FILE, "$file_without_ext$METADATA_EXT") or die "Cannot open $file_without_ext$METADATA_EXT\n";

        my @metadata = <METADATA_FILE>;

        close(METADATA_FILE);

        my $domain;

        foreach $metadata_item (@metadata) {

            $metadata_item_key = substr($metadata_item, 0, rindex($metadata_item, "="));

	          if ($metadata_item_key eq "name")

	          {

	              $domain = substr($metadata_item, rindex($metadata_item, "=") + 1);

                push(@domains, $domain);

	              break;

	          }

        }

      }

    }

  }

  @files = <$CERTS_BUILD_DIR_2*>;

  foreach $file (@files) {

    if (rindex($file, $METADATA_EXT) < 0)

    {

      $ext = rindex($file, ".");

      my $file_without_ext = substr($file, 0, $ext);

      $cert_name = substr($file, length("$CERTS_BUILD_DIR_2"));

      if (! grep {$_ eq $cert_name} @certs) {

        push(@certs, $cert_name);

        push(@paths, $CERTS_BUILD_DIR_2);

        open (METADATA_FILE, "$file_without_ext$METADATA_EXT") or die "Cannot open $file_without_ext$METADATA_EXT\n";

        my @metadata = <METADATA_FILE>;

        close(METADATA_FILE);

        my $domain;

        foreach $metadata_item (@metadata) {

            $metadata_item_key = substr($metadata_item, 0, rindex($metadata_item, "="));

	          if ($metadata_item_key eq "name")

	          {

	              $domain = substr($metadata_item, rindex($metadata_item, "=") + 1);

                push(@domains, $domain);

	              break;

	          }

        }

      }

    }

  }

  # display only the files which are found inside java.iby or javatest.iby

  open (JAVA_IBY, "$IBY_DIR$JAVA_IBY_FILENAME");

  my @java_iby_lines = <JAVA_IBY>;

  close(JAVA_IBY);

  my @java_test_iby_lines;

  if (-f "$IBY_TEST_DIR$JAVA_TEST_IBY_FILENAME")

  {

      open (JAVA_TEST_IBY, "$IBY_TEST_DIR$JAVA_TEST_IBY_FILENAME");

      @java_test_iby_lines = <JAVA_TEST_IBY>;

      close(JAVA_TEST_IBY);

  }

  my @java_variant_certs_iby_lines;

  if (-f "$IBY_DIR$JAVA_VARIANT_CERTS_IBY_FILENAME")

  {

      open (JAVA_VARIANT_CERTS_IBY, "$IBY_DIR$JAVA_VARIANT_CERTS_IBY_FILENAME");

      @java_variant_certs_iby_lines = <JAVA_VARIANT_CERTS_IBY>;

      close(JAVA_VARIANT_CERTS_IBY);

  }

  my @java_variant_certs_policies_iby_lines;

  if (-f "$IBY_DIR$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME")

  {

      open (JAVA_VARIANT_CERTS_POLICIES_IBY, "$IBY_DIR$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME");

      @java_variant_certs_policies_iby_lines = <JAVA_VARIANT_CERTS_POLICIES_IBY>;

      close(JAVA_VARIANT_CERTS_POLICIES_IBY);

  }

  $index = 0;

  my $found = 0;

  foreach $cert (@certs) {

        $found = 0;

        foreach $java_iby_line (@java_iby_lines) {

            if (rindex($java_iby_line, $cert) >= 0) {

                $found = 1;

                last;

            }

        }

        if ($found == 0)

        {

            foreach $java_variant_certs_iby_line (@java_variant_certs_iby_lines) {

                if (rindex($java_variant_certs_iby_line, $cert) >= 0) {

                    $found = 1;

                    last;

                }

            }

        }

        if ($found == 0)

        {

            foreach $java_variant_certs_policies_iby_line (@java_variant_certs_policies_iby_lines) {

                if (rindex($java_variant_certs_policies_iby_line, $cert) >= 0) {

                    $found = 1;

                    last;

                }

            }

        }

        #if ($found == 0)

        #{

            #foreach $java_test_iby_line (@java_test_iby_lines) {

                #if (rindex($java_test_iby_line, $cert) >= 0) {

                    #$found = 1;

                    #last;

                #}

            #}

        #}

        if ($found == 1)

        {

            print "Certificate:\n";

            print "  Name: ", $cert , "\n";

            print "  Domain: ", $domains[$index];

            print "  Path: ", $paths[$index], "\n\n";

        }

        $index = $index + 1;

    }

}

##############################################################

##  Removes a certain certificate                           ##

##############################################################

sub remove_cert()

{

    if (! -f "$CERTS_BUILD_DIR_1$cert_to_remove")

    {

        print "\n\nERROR: ", $cert_to_remove, " not found.\n";

        exit;

    } else

    {

        $ext = rindex($cert_to_remove, ".");

        $file_without_ext = substr($cert_to_remove, 0, $ext);

        # modify java.iby

       	mkdir "tmp";

        open (JAVA_IBY, "$IBY_DIR$JAVA_IBY_FILENAME");

        open (JAVA_NEW_IBY, "+>tmp/$JAVA_IBY_FILENAME") or die "Cannot create tmp file (tmp/$JAVA_IBY_FILENAME)\n";

        my @java_iby_lines = <JAVA_IBY>;

        my $found = 0;

        foreach $java_iby_line (@java_iby_lines) {

            if (rindex($java_iby_line, $cert_to_remove) < 0 && rindex($java_iby_line, "$file_without_ext$METADATA_EXT") < 0)

            {

                print JAVA_NEW_IBY $java_iby_line;

            }

            else

            {

                $found = 1;

            }

        }

        close(JAVA_IBY);

        close(JAVA_NEW_IBY);

        move("tmp/$JAVA_IBY_FILENAME", "$IBY_DIR");

        if ($found == 0)

        {

            if (-f "$IBY_DIR$JAVA_VARIANT_CERTS_IBY_FILENAME")

            {

                open (JAVA_IBY, "$IBY_DIR$JAVA_VARIANT_CERTS_IBY_FILENAME");

                open (JAVA_NEW_IBY, "+>tmp/$JAVA_VARIANT_CERTS_IBY_FILENAME") or die "Cannot create tmp file (tmp/$JAVA_VARIANT_CERTS_IBY_FILENAME)\n";

                my @java_iby_lines = <JAVA_IBY>;

                my $found = 0;

                foreach $java_iby_line (@java_iby_lines) {

                    if (rindex($java_iby_line, $cert_to_remove) < 0 && rindex($java_iby_line, "$file_without_ext$METADATA_EXT") < 0)

                    {

                        print JAVA_NEW_IBY $java_iby_line;

                    }

                }

                close(JAVA_IBY);

                close(JAVA_NEW_IBY);

                move("tmp/$JAVA_VARIANT_CERTS_IBY_FILENAME", "$IBY_DIR");

            }         

            # check the combined iby file as well

            if (-f "$IBY_DIR$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME")

            {

                open (JAVA_IBY, "$IBY_DIR$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME");

                open (JAVA_NEW_IBY, "+>tmp/$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME") or die "Cannot create tmp file (tmp/$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME)\n";

                my @java_iby_lines = <JAVA_IBY>;

                my $found = 0;

                foreach $java_iby_line (@java_iby_lines) {

                    if (rindex($java_iby_line, $cert_to_remove) < 0 && rindex($java_iby_line, "$file_without_ext$METADATA_EXT") < 0)

                    {

                        print JAVA_NEW_IBY $java_iby_line;

                    }

                }

                close(JAVA_IBY);

                close(JAVA_NEW_IBY);

                move("tmp/$JAVA_VARIANT_CERTS_AND_POLICIES_IBY_FILENAME", "$IBY_DIR");

            }

        }

      	unlink("$CERTS_BUILD_DIR_1$cert_to_remove");

      	unlink("$CERTS_BUILD_DIR_1$file_without_ext$METADATA_EXT");

      	unlink("$CERTS_BUILD_DIR_2$cert_to_remove");

      	unlink("$CERTS_BUILD_DIR_2$file_without_ext$METADATA_EXT");

        system("rmdir tmp /s /q");

    }

}

##############################################################

##  Adds new certificates                                   ##

##############################################################

sub add_certs()

{

  $config_file = "./configdata.xml";

  my $xml = new XML::Simple(suppressempty => '');

  my $xmldata = $xml->XMLin($config_file, forcearray => 1);

  my $root_file;

  my $root_domain;

  my $root_canDelete;

  my $root_canDisable;

  my $root_file_without_ext;

  my $root_file_with_ext;

  my $root_state;

 	mkdir "tmp";

 	mkdir "tmp/certs/";

 	if ($deployment_destination eq $ROM)

 	{

    open (IBY_FILE, "+>tmp/$iby_file_name") or die "Cannot create tmp file (tmp/$iby_file_name)\n";

    print IBY_FILE   "#ifndef __" . "$iby_name" ."__\n#define __" . "$iby_name" ."__\n\n#include <data_caging_paths_for_iby.hrh>\n\n";

  }

  else

  {

    open (PKG_FILE, "+>tmp/$pkg_file_name") or die "Cannot create tmp file (tmp/$pkg_file_name)\n";

    print PKG_FILE   "&EN\n#{\"$pkg_name\"}" ."$package_type";

    open (POLICY_FILE, "+>tmp/update_certs") or die "Cannot create tmp file (tmp/update_certs)\n";

    close POLICY_FILE;

  }

  open (MIDPROOTSLIST_FILE, "+>tmp/midprootslist") or die "Cannot create temp file (tmp/certs/midprootslist)\n";

  foreach my $root (@{$xmldata->{root}}) {

      # read the xml node

      $root_file = $root->{file}->[0];

      $root_domain = $root->{domain}->[0];

      $root_canDelete = $root->{canDelete}->[0];

      $root_canDisable = $root->{canDisable}->[0];

     	if ($deployment_destination eq $SIS)

 	    {

          $root_state = $root->{state}->[0];

          if (($root_state ne "") && ($root_state ne "enabled") && ($root_state ne "disabled") && ($root_state ne "removed")) {

          	print "ERROR: The values for \"state\" can be either \"enabled\" or \"disabled\" or \"removed\". Please check the configuration file $config_file\n";

            close IBY_FILE;

            close PKG_FILE;

            system("rmdir tmp /s /q");

      	    exit;

        }

 	    }

      # validate the root file

     	if (! -f $root_file) {

        print "\nERROR: root file $root_file doesn't exist. Please check the configuration file $config_file\n";

        close IBY_FILE;

        close PKG_FILE;

        system("rmdir tmp /s /q");

        exit;

      }

      # validate start date of the root

      ($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst) = localtime(time);

      $current_year = $year + 1900;

      system("openssl x509 -inform DER -in $root_file -noout -startdate > tmp/startdate.txt");

      open(start_date_file, "tmp/startdate.txt"); 

      my @start_date = <start_date_file>;

      close(start_date_file);

      unlink("tmp/startdate.txt");

      @start_date_details = split(/ /, $start_date[0]);

      my $start_date_year = $start_date_details[3];

      if ($start_date_year > $current_year) {

        print "\nERROR: root $root_file not yet valid.\n";

        close IBY_FILE;

        close PKG_FILE;

        system("rmdir tmp /s /q");

        exit;

      }

      # validate end date of the root

      system("openssl x509 -inform DER -in $root_file -noout -enddate > tmp/enddate.txt");

      open(end_date_file, "tmp/enddate.txt"); 

      my @end_date = <end_date_file>;

      close(end_date_file);

      unlink("tmp/enddate.txt");

      @end_date_details = split(/ /, $end_date[0]);

      $year_index = 0;

      $found_items = 0;

      foreach $end_date_detail (@end_date_details) {

        if ($found_items == 3)

        {

            last;   

        }

        if ($end_date_detail ne "")

        {

           $found_items = $found_items + 1; 

        }

        $year_index = $year_index + 1;

      }

      my $end_date_year = $end_date_details[$year_index];

      if ($end_date_year < $current_year) {

        print "\nERROR: root $root_file is expired.\n";

        close IBY_FILE;

        close PKG_FILE;

        system("rmdir tmp /s /q");

        exit;

      }

      #validate the domain

      if (($root_domain ne "Manufacturer") && ($root_domain ne "Operator") && ($root_domain ne "OperatorExtra") && ($root_domain ne "IdentifiedThirdParty")) {

      	print "\nERROR: the values for \"domain\" can be either \"Manufacturer\" or \"Operator\" or \"OperatorExtra\" or \"IdentifiedThirdParty\". Please check the configuration file $config_file\n";

        close IBY_FILE;

        close PKG_FILE;

        system("rmdir tmp /s /q");

      	exit;

      }

      #validate the canDelete element

      if (($root_canDelete ne "") && ($root_canDelete ne "true") && ($root_canDelete ne "false")) {

      	print "\nERROR: the values for \"canDelete\" can be either \"true\" or \"false\". Please check the configuration file $config_file\n";

        close IBY_FILE;

        close PKG_FILE;

        system("rmdir tmp /s /q");

      	exit;

      }

      #validate the canDisable element

      if (($root_canDisable ne "") && ($root_canDisable ne "true") && ($root_canDisable ne "false")) {

      	print "ERROR: The values for \"canDisable\" can be either \"true\" or \"false\". Please check the configuration file $config_file\n";

        close IBY_FILE;

        close PKG_FILE;

        system("rmdir tmp /s /q");

      	exit;

      }

      # generate the cert metadata and copy the cert & metadata to a tmp folder

      system("openssl x509 -inform DER -in $root_file -noout -issuer_hash > tmp/hash.txt");

      open(hash_file, "tmp/hash.txt"); 

      my @lines = <hash_file>;

      close(hash_file);

      unlink("tmp/hash.txt");

      $start_index = rindex($root_file, "/");