// Copyright (c) 2001-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// App for resigning OCSP responses.
// 
//

#include <e32cons.h>
#include <f32file.h>
#include <asn1dec.h>
#include <asn1enc.h>
#include <x509cert.h>
#include <signed.h>
#include <bigint.h>
#include <asymmetric.h>
#include <hash.h>
#include <bacline.h>

#include "resign.h"

// CertTool command line parameters
_LIT(KResign, "-resign");
_LIT(KResignShort, "-r");

_LIT(KCreate, "-create");
_LIT(KCreateShort, "-c");

_LIT(KExtractResponse, "-e");
_LIT(KExtractResponseShort, "-extract");

CResign* CResign::NewLC()
	{
	CResign* resign = new(ELeave) CResign();
	CleanupStack::PushL(resign);
	resign->ConstructL();
	return resign;
	}
	
CResign* CResign::NewL()
	{
	CResign* resign = CResign::NewLC();
	CleanupStack::Pop(resign);
	return resign;
	}
		
CResign::CResign()
	{}
	
void CResign::ConstructL()
	{
	User::LeaveIfError(iFs.Connect());
	}

CResign::~CResign()
	{
	delete iArguments;
	iFs.Close();
	}

void CResign::ResignL(const TPtrC8& aSignedData,
			 TPtr8& aSignature,
			 RInteger& aModulus,
			 const RInteger& /*aPublicExponent*/,
			 RInteger& aPrivateExponent)
	{
	__UHEAP_MARK;
	// Build message digest
	CSHA1* hash = CSHA1::NewL();
	CleanupStack::PushL(hash);
	TPtrC8 digest = hash->Final(aSignedData);

	// Build ASN1 encoding of digestAlgId and digest..
	CASN1EncSequence* encAll = CASN1EncSequence::NewLC();

	// Build AlgID encoder (for SHA1)
	CASN1EncSequence* encAlgId = CASN1EncSequence::NewLC();

	CASN1EncObjectIdentifier* encObjId = CASN1EncObjectIdentifier::NewLC(KSHA1);
	encAlgId->AddChildL(encObjId);
	CleanupStack::Pop(); // encObjId, now owned by endAlgId

	CASN1EncNull* encNull = CASN1EncNull::NewLC();
	encAlgId->AddChildL(encNull);
	CleanupStack::Pop(); // encNull, now owned by endAlgId

	encAll->AddChildL(encAlgId);
	CleanupStack::Pop(); // endAlgId, now owned by encAll

	CASN1EncOctetString* encDigest = CASN1EncOctetString::NewLC(digest);
	encAll->AddChildL(encDigest);
	CleanupStack::Pop(); // encDigest, now owned by encAll

	HBufC8* digestInfo = HBufC8::NewMaxLC(encAll->LengthDER());
	TUint pos = 0;
	TPtr8 digestInfoPtr = digestInfo->Des();
	encAll->WriteDERL(digestInfoPtr, pos);

	__UHEAP_MARK;

	CRSAPrivateKeyStandard* rsaPriv = CRSAPrivateKeyStandard::NewLC(aModulus, aPrivateExponent);

	CRSAPKCS1v15Signer* signer = CRSAPKCS1v15Signer::NewLC(*rsaPriv);
	
	const CRSASignature* signature = signer->SignL(digestInfoPtr);
	
	HBufC8* theSignature = signature->S().BufferLC();
	aSignature.Copy(*theSignature);
	
	CleanupStack::PopAndDestroy(4, rsaPriv);

	__UHEAP_MARKEND;

	CleanupStack::PopAndDestroy(3, hash);
	
	__UHEAP_MARKEND;
	}

void CResign::DecodeDataL(TDes8& aResponse, const TDesC8& aKey)
	{
	__UHEAP_MARK;
	TASN1DecSequence seqDec;
	TInt pos = 0;

	// Get the signed data and signature portions of the response
	CArrayPtr<TASN1DecGeneric>* ocspResponseSeq = seqDec.DecodeDERLC(aResponse, pos, 2, 2);
	TPtrC8 responseBytes = ocspResponseSeq->At(1)->GetContentDER();
	CleanupStack::PopAndDestroy(ocspResponseSeq);

	pos = 0;
	CArrayPtr<TASN1DecGeneric>* responseBytesSeq = seqDec.DecodeDERLC(responseBytes, pos, 2, 2);
	TPtrC8 basicOCSPResponse = responseBytesSeq->At(1)->GetContentDER();
	CleanupStack::PopAndDestroy(responseBytesSeq);

	pos = 0;
	CArrayPtr<TASN1DecGeneric>* basicOCSPResponseSeq = seqDec.DecodeDERLC(basicOCSPResponse, pos, 3, 4);
	TPtrC8 responseData = basicOCSPResponseSeq->At(0)->Encoding();
	TPtrC8 signatureAlgorithm = basicOCSPResponseSeq->At(1)->Encoding();
	TPtrC8 signature = basicOCSPResponseSeq->At(2)->GetContentDER();
	CleanupStack::PopAndDestroy(basicOCSPResponseSeq);

	// Check that it's RSA with SHA1
	CX509SigningAlgorithmIdentifier* algId = CX509SigningAlgorithmIdentifier::NewLC(signatureAlgorithm);
	if (algId->DigestAlgorithm().Algorithm() != ESHA1
		|| algId->AsymmetricAlgorithm().Algorithm() != ERSA)
		{
		User::Leave(KErrNotSupported);
		}
	CleanupStack::PopAndDestroy(algId);

	// Get the modulus and private key portions of the key - only RSA supported

	// ASN1 .key files have 9 parts: version, modulus, public exponent, private exponent,
	// prime 1, prime2, exponent 1, exponent 2, coefficient
	// This is defined in PKCS1 (RFC 2313), the RSAPrivateKey ASN1 data structure
	pos = 0;
	CArrayPtr<TASN1DecGeneric>* keySeq = seqDec.DecodeDERLC(aKey, pos, 9, 9);
	TASN1DecInteger decInt;

	RInteger modulus = decInt.DecodeDERLongL(*keySeq->At(1));
	CleanupStack::PushL(modulus);

	RInteger publicExponent = decInt.DecodeDERLongL(*keySeq->At(2));
	CleanupStack::PushL(publicExponent);

	RInteger privateExponent = decInt.DecodeDERLongL(*keySeq->At(3));
	CleanupStack::PushL(privateExponent);

	// Cast constness off the signature - and skip the 'number of unused bits' octet
	TPtr8 sigEdit(CONST_CAST(TUint8*, signature.Ptr() + 1), signature.Length() - 1, signature.Length() - 1);

	// Pass data on for re-signing
	ResignL(responseData, sigEdit, modulus, publicExponent, privateExponent);

	CleanupStack::PopAndDestroy(3, &modulus); // The RIntegers
	CleanupStack::PopAndDestroy(keySeq);
	__UHEAP_MARKEND;
	}

void CResign::ProcessCommandLineL()
    {
	iArguments = CCommandLineArguments::NewL();
	
	if(iArguments->Count() > 1)
		{	
		TCommand command = ENone; 
		
		TPtrC args = iArguments->Arg(1);
		if ((args.Compare(KResign)==0) || (args.Compare(KResignShort)==0))
			{
			command = EResign;
			}	
		if ((args.Compare(KCreate)==0) || (args.Compare(KCreateShort)==0))
			{
			command = ECreate;
			}
		if ((args.Compare(KExtractResponse)==0) || (args.Compare(KExtractResponseShort)==0))
			{
			command = EExtract;
			}
		
		if(command != ENone)
			{
			HandleCommandL(command);
			}
		}
    }

void CResign::HandleCommandL(TCommand aCommand)
	{
	switch(aCommand)
		{
		case EResign:
			ResignFilesL();
			break;
			
		case ECreate:
			CreateDatFileL();
			break;
		
		case EExtract:
			ExtractResponseL();
			break;
		}
	}

void CResign::ResignFilesL()
	{
	__UHEAP_MARK;
	
	TPtrC responseFile(iArguments->Arg(2));
	TPtrC keyFile(iArguments->Arg(3));
	
	// Load the key
	RFile file;
	User::LeaveIfError(file.Open(iFs, keyFile, EFileRead | EFileShareAny));
	CleanupClosePushL(file);
	
	TInt keySize;
	User::LeaveIfError(file.Size(keySize));
	HBufC8* keyBuf = HBufC8::NewLC(keySize);
	TPtr8 key = keyBuf->Des();

	User::LeaveIfError(file.Read(key));
	
	// Open the logged response file

	RFileReadStream readStream;
	User::LeaveIfError(readStream.Open(iFs, responseFile, EFileRead | EFileShareAny));
	CleanupClosePushL(readStream);
	MStreamBuf* readBuf = readStream.Source();

	RFileWriteStream writeStream;
	User::LeaveIfError(writeStream.Open(iFs, responseFile, EFileWrite | EFileShareAny));
	CleanupClosePushL(writeStream);
	MStreamBuf* writeBuf = writeStream.Sink();

	TInt totalResponses = readStream.ReadUint32L();

	for (TInt i = 0 ; i < totalResponses ; ++i)
		{
		TInt responseSize = readStream.ReadUint32L();
		TStreamPos pos = readBuf->TellL(MStreamBuf::ERead);

		HBufC8* responseBuf = HBufC8::NewLC(responseSize);

		TPtr8 response = responseBuf->Des();
		readStream.ReadL(response);

		// resigning response
		DecodeDataL(response, key);

		writeBuf->SeekL(MStreamBuf::EWrite, pos);
		writeStream.WriteL(response);

		CleanupStack::PopAndDestroy(responseBuf);
		}
	
	CleanupStack::PopAndDestroy(4,&file); // close writeStream, readStream, keyBuf and file
	
	__UHEAP_MARKEND;
	}

void CResign::CreateDatFileL()
	{
	__UHEAP_MARK;
	
	
	// this path will fail if the directories are not already present.
	_LIT(KDatFile,"c:\\system\\tocsp\\responses\\response.dat");
	RFileWriteStream writeStream;
	User::LeaveIfError(writeStream.Replace(iFs, KDatFile, EFileWrite | EFileShareAny));
	CleanupClosePushL(writeStream);
	
	TInt fileCount = iArguments->Count(); 
	
	// total no of responses in this dat file
	writeStream.WriteInt32L(fileCount-2);
	RFile file;
	for(TInt i=2;i<fileCount;i++)
		{
		TPtrC responseFile(iArguments->Arg(i));
		// Load the response file
		User::LeaveIfError(file.Open(iFs, responseFile, EFileRead | EFileShareAny));
		CleanupClosePushL(file);
		
		TInt respSize = 0;
		User::LeaveIfError(file.Size(respSize));
		HBufC8* respBuf = HBufC8::NewLC(respSize);
		TPtr8 resp = respBuf->Des();
		User::LeaveIfError(file.Read(resp));
		
		writeStream.WriteInt32L(respSize);
		writeStream.WriteL(resp);
		
		CleanupStack::PopAndDestroy(2,&file); // respBuf and file
		}
	
	CleanupStack::PopAndDestroy(&writeStream);
	
	__UHEAP_MARKEND;
	}

void CResign::ExtractResponseL()
	{
	__UHEAP_MARK;
	
	TPtrC responseFile(iArguments->Arg(2));
	
	// Load the response file
	RFileReadStream respFile;
	User::LeaveIfError(respFile.Open(iFs, responseFile, EFileRead | EFileShareAny));
	CleanupClosePushL(respFile);
	
	// reading the transaction value.
	respFile.ReadInt32L();
	TInt respSize = respFile.ReadInt32L();
	
	HBufC8* respBuf = HBufC8::NewLC(respSize);
	TPtr8 resp = respBuf->Des();

	respFile.ReadL(resp, respSize);
	
	// this path will fail if the directories are not already present.
	_LIT(KDerFile,"c:\\system\\tocsp\\responses\\response.der");
	RFileWriteStream writeStream;
	User::LeaveIfError(writeStream.Replace(iFs, KDerFile, EFileWrite | EFileShareAny));
	CleanupClosePushL(writeStream);
	writeStream.WriteL(resp);
	
	CleanupStack::PopAndDestroy(3,&respFile); // writeStream, respBuf and respFile
	
	__UHEAP_MARKEND;

	}