#

# Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

# All rights reserved.

# This component and the accompanying materials are made available

# under the terms of the License "Eclipse Public License v1.0"

# which accompanies this distribution, and is available

# at the URL "http://www.eclipse.org/legal/epl-v10.html".

#

# Initial Contributors:

# Nokia Corporation - initial contribution.

#

# Contributors:

#

# Description: 

# Test tool used to make and sign SISX files signed by certificate

# chains of aribtrary lengths as defiend by a template file.

#

use warnings;

use strict;

use Getopt::Long;

my $CA_DIR=		"$ENV{'SECURITYSOURCEDIR'}\\installationservices\\switestfw\\testcertificates\\swi\\test\\tsisfile\\data\\signedsis";

my $CERTS_DIR=	"$ENV{'SECURITYSOURCEDIR'}\\installationservices\\switestfw\\testcertificates\\swi\\test\\tdevcerts\\certs";

my $REQS_DIR="reqs";

my $KEYS_DIR=	"$ENV{'SECURITYSOURCEDIR'}\\installationservices\\switestfw\\testcertificates\\swi\\test\\tdevcerts\\keys";

my $PKG_DIR="pkg";

my $SIS_DIR="sis";

my $TEMPLATE_DIR="templates";

my $UID_FILE="uid.txt";

my $SCRIPT_DIR="z:\\tswi\\tdevcerts\\scripts";

my $DATA_DIR="z:\\tswi\\tdevcerts\\data";

my $TMP_DIR="tmp";

my $DAYS="3650";

my $CREATE_CERTS="";

my $TDEVCERTS_SCRIPT_DIR="\\epoc32\\winscw\\c\\tswi\\tdevcerts\\scripts";

my $PLATFORM = '';

my $CONFIGURATION = '';

my $startDate = '';

my $endDate = '';

my $CA_TEXT=

'

subjectKeyIdentifier=hash

#authorityKeyIdentifier=keyid:always,issuer:always

basicConstraints=critical,CA:TRUE, pathlen:5

keyUsage=critical,keyCertSign

';

&main;

exit(0);

sub main() {

	my $section = '';

	my $packageTemplate = '';

	my @chains = ();

	my @files = ();

	my $installText = '';

	my $uninstallText = '';

	my $iniFile = '';

	my $name = '';

	GetOptions('platform=s' => \$PLATFORM,

			   'configuration=s' => \$CONFIGURATION,

			   'sis-dir=s' => \$SIS_DIR,

			   'days=s', \$DAYS,

			   'create-certs=s', \$CREATE_CERTS,

			   'startdate=s', \$startDate,

			   'enddate=s', \$endDate);

	if ($#ARGV < 0) {

		&usage;

	}

	my ($config) = @ARGV;

	open IN, $config or die "Cannot open $config\n";

	print "Processing $config...\n";

	while (<IN>) {

		chomp;

		s/<DATA_DIR>/${DATA_DIR}/g;

		s/<SCRIPT_DIR>/${SCRIPT_DIR}/g;

		s/<PLATFORM>/$PLATFORM/g;

		s/<CONFIGURATION>/$CONFIGURATION/g;

		# Extract section name

		if (/^\s*\[\w+\]/) {

			s/.*\[\s*(.*)\s*].*/$1/g;

			$section = lc;			

		}

    	elsif ($section eq "install") {

			$installText .= "$_\n";

	    }

      	elsif ($section eq "uninstall") {

			$uninstallText .= "$_\n";

	    }

		# Skip comments

     	elsif (/^\s*\#/) {

			next;

	    }

	    elsif (/\s*\w+\s*=.*/) { # Parse key/value pair

			my ($key, $value) = split /=/;

			$key =~ s/\s//g;			

			$key = lc($key);

			if ($section eq "chains") {

				if ($key =~ /chain\d+/) {

					parseChain($value, \@chains);

				}

			}

			elsif ($section eq "main") {

				if ($key eq 'template') {

					$packageTemplate = $value;

				}

				elsif ($key eq 'name') {

					$name = $value;

				}

                elsif ($key eq 'inifile') {

					$iniFile = $value;

				}

			}

			elsif ($section eq "files") {

				if ($key =~ /^\s*sis.*/) {

					my $componentUID = embeddedSIS($value);

					my $sisText = "\@\"${SIS_DIR}\\${PLATFORM}\\$value\",(${componentUID})\n";

					push @files, $sisText;

				}

				else {

					push @files, "$value\n";

				}

			}

     	}

	}

   close IN;	

   die "\'iniFile\' not defined in main section" unless $iniFile ne '';

   die "\'name\' not defined in main section" unless $name ne '';

   my @chainFiles;  # The combined chain files

   my @chainKeys;   # The keys for the leaf of each chain

   if ($CREATE_CERTS eq "install") {

	   print "\tCreating certificates \n";

	   my $chainNum = 0;

	   foreach my $chain (@chains) {

		   print "\tProcessing chain $chainNum\n";

		   buildChain($name, 

					  $chainNum, 

					  \@chainFiles,

					  \@chainKeys,

					  @$chain);

		   $chainNum++;

	   }

   }

   else

   {

	   print "\Using existing certificates \n";

	   my $chainNum = 0;

	   foreach my $chain (@chains) {

		   print "\tProcessing chain $chainNum\n";

		   enumChain($name, 

					 $chainNum, 

					 \@chainFiles,

					 \@chainKeys,

					 @$chain);

		   $chainNum++;

	   }

   }

   my $temp = $packageTemplate;

   $temp =~ s/.*\\(\w+).*/$1/;	

   my $packageFile = "${PKG_DIR}\\${name}.pkg";

   my $uid = getUID();

   buildPackage($PLATFORM, 

				$CONFIGURATION, 

				$uid,

				"${TEMPLATE_DIR}\\$packageTemplate", 

				$packageFile,

				@files);

   # Create unsigned SIS file

   mkdir("${SIS_DIR}\\${PLATFORM}");

   my $sisFile = "${SIS_DIR}\\${PLATFORM}\\${name}.sis";

   makesis($packageFile, $sisFile);

  for (my $i = 0; $i <= $#chainFiles; $i++) {

	  signsis("${sisFile}", "${sisFile}.tmp", $chainFiles[$i], $chainKeys[$i]);

	  unlink $sisFile;

	  rename "${sisFile}.tmp", "${sisFile}";

  }

  # Add install/uninstall script entries for this package

  addIniEntries("${TDEVCERTS_SCRIPT_DIR}\\$iniFile", 

				$uid, $name, $installText, $uninstallText, 

				"${TEMPLATE_DIR}\\$packageTemplate" );

}

sub buildChain(\$\$\$\$\@) {

	my ($name, $chainNum, $chainFiles, $chainKeys, @extensions) = @_;

	my $root = shift @extensions;

	my $certNum = 0;

	my $signingCert = "${CA_DIR}\\$root\\ca.pem";

	my $signingKey  = "${CA_DIR}\\$root\\ca.key.pem";

	my @chainElements = (); # List of cert filenames in the current chain

    print "\tbuildChain $name\n";

	# For each extension create a request for a certificate and

	# sign that request with the previous certificate, or the root

	# certificate for the first element

	foreach my $extension (@extensions) {

		my $isCA = $certNum < $#extensions;

	    print "\tCreating certificates \n";

		die "Cannot open extension file ext\\$extension.cfg\n"

			unless -e "ext/$extension.cfg";

		my $file = "${name}_${extension}.${chainNum}.${certNum}";

		my $subject = "/C=UK/O=Symbian/CN=Entity Cert ${name} ${extension} ${chainNum} ${certNum}";

		createRequest($isCA,

					  "${REQS_DIR}\\${file}.req.pem",

					  $subject,

					   "${KEYS_DIR}\\${file}.key.pem",

					  'openssl.cfg');

		signRequest($isCA, 

					"${REQS_DIR}\\${file}.req.pem",

					"${CERTS_DIR}\\${file}.cert.pem",

					$signingCert,

					$signingKey,

					"ext\\$extension.cfg");

		$signingCert = "${CERTS_DIR}\\${file}.cert.pem";

		$signingKey = "${KEYS_DIR}\\${file}.key.pem";

		push @chainElements, "${CERTS_DIR}\\${file}.cert.pem";

		$certNum++;

	}

	# Record the filename of the leaf signing key. This is needed by sisgnsis	

	push @$chainKeys, $signingKey; 

	# Concatenate all the certificates for signsis

	my $chainFile = "${CERTS_DIR}\\${name}_chain_${chainNum}.pem";

	push @$chainFiles, $chainFile;

	open OUT, ">$chainFile" or 

		die "Cannot write to $chainFile\n";

	foreach (reverse @chainElements) {

		open IN, $_ or 

			die "Cannot open $_\n";

		while (<IN>) {

			print OUT;

		}

		close IN;

	}

	close OUT;

}

sub enumChain(\$\$\$\$\@) {

	my ($name, $chainNum, $chainFiles, $chainKeys, @extensions) = @_;

	my $root = shift @extensions;

	my $signingKey  = "${CA_DIR}\\$root\\ca.key.pem";

    print "\tenumChain $name\n";

	my $certNum = $#extensions;

	if ( $certNum >= 0 )

	{

		my $extension = pop @extensions;

		my $file = "${name}_${extension}.${chainNum}.${certNum}";

		$signingKey = "${KEYS_DIR}\\${file}.key.pem";

	}

	# Record the filename of the leaf signing key. This is needed by sisgnsis	

	push @$chainKeys, $signingKey; 

	# Concatenate all the certificates for signsis

	my $chainFile = "${CERTS_DIR}\\${name}_chain_${chainNum}.pem";

	push @$chainFiles, $chainFile;

}

sub buildPackage(\$\$\$\$\$\@) {

	my ($PLATFORM, $CONFIGURATION, $packageUID, $packageTemplate, $packageFile, @files) = @_;

	my $packageUIDText = sprintf "0x%8.8x", $packageUID;

	print "\tCreating package $packageFile\n";

	open(IN, "${packageTemplate}") or

		die "Cannot open package file template $packageTemplate\n";

	open(OUT, ">$packageFile") or

		die "Cannot write to package file $packageFile\n";

	# Substitute the list of files for the place holder in the template

	# package file.

	while (<IN>) {

		s/\#\#PACKAGE_UID\#\#/${packageUIDText}/g;

		if (/\#\#FILES\#\#/) {

			foreach (@files) {

				# The SISX files have to be built for every supported

				# platform and configuration

				print OUT;

			}

		}

		else {

			print OUT;

		}

	}

	close IN;

	close OUT;

}

sub parseChain(\$\$) {

	my ($chainDesc, $chains) = @_;   

	my @elements = split(/,/, $chainDesc);

	push @$chains, \@elements;

}

sub createRequest(\$,\$\$\$\$) {

	my ($isCA, $requestFile, $subject, $keyFile, $config) = @_;

	my @args = ('openssl',

				'req',

				'-newkey',

				'rsa:512',

				'-nodes',

				'-out',

				$requestFile,

				'-keyout', 

				$keyFile,

				'-subj',

				$subject,

				'-config', 

				$config, 

				'-days', 

				'3650');

	system (@args) == 0 or

		die "Cannot create certificate request $requestFile\n";	

}

sub signRequest(\$\$\$\$\$) {

	my ($isCA, $requestFile, $certFile, $CAcert, $CAkey, $extfile) = @_;

	my $tmpFile = "${extfile}.tmp";

	my @args = ();

	my $demoCaDir = "$ENV{'SECURITYSOURCEDIR'}\\installationservices\\swi\\test\\tdevcerts\\demoCA";

	# Workaround to insert CA extensions 

	# Open SSL expects all the extensions to be kept together so we

	# can't just specify the CA bits in the request because otherwise

	# it will overwrite them

	system 'copy', $extfile, $tmpFile;

	system 'attrib', '-r', $tmpFile;

	if ($isCA) {

		open OUT, ">>$tmpFile" or die "Cannot open temporary file $tmpFile\n";

		print OUT $CA_TEXT;

		close OUT;

	}

	if ($startDate && $endDate) 

	{

		@args = ('openssl',

				'ca',

				'-in',

				$requestFile,

				'-out',

		 		$certFile,

				'-cert',

				$CAcert,

				'-keyfile',

				$CAkey,

				'-extfile',

				$tmpFile,

				'-startdate',

				$startDate,

				'-enddate',

				$endDate,

				'-batch',

				'-config',	

				$demoCaDir.'/'.'openssl.cfg');

		system (@args) == 0 or 			   

			   die "Cannot sign certificate request $requestFile\n";

		# Convert the generated certificate to x509 format if "openssl ca" command is used.

		@args = ( 'openssl',

				  'x509',

				  '-in',

				  $certFile,	

				  '-out',

				  $certFile);

		system (@args) == 0 or 			   

			   die "Cannot covert $certFile to x509 format.\n";

	}

	else

	{

		@args = ('openssl',

				'x509',

				'-req',

				'-in',

				$requestFile,

				'-out',

		 		$certFile,

				'-CA',

				$CAcert,

				'-CAkey',

				$CAkey,

				'-extfile',

				$tmpFile,

				'-days',

				"${DAYS}",

				'-CAcreateserial');

		system (@args) == 0 or 			   

			   die "Cannot sign certificate request $requestFile\n";

	}

	unlink $tmpFile;

}

sub makesis(\$\$) {

	my ($packageFile, $sisFile) = @_;

	print "\tCreating SIS file $sisFile\n";

	system 'makesis', $packageFile, $sisFile;

}

sub signsis(\$\$\$\$) {

	my ($input, $output, $certificate, $key) = @_;

	print "\tSigning $input with certchain=${certificate} key=${key}\n";

	system('signsis',

		   $input,

		   $output,

		   $certificate,

		   $key) == 0 or

			   die "Cannot sign SIS file $input $output $certificate $key\n";

}

sub usage {

	print STDERR "Usage: buildsis.pl --platform <platform> --configuration <udeb|urel> --sis-dir <sis dir> <test spec>\n";

	exit -1;

}

# Make sure each package has a unique UID by repeatedly adding one

# from a pre-determined base.

sub getUID {

	if (! -e "uid.txt.tmp") {

		system 'copy','uid.txt','uid.txt.tmp';

		system 'attrib','-r','uid.txt.tmp';

	}

	open IN, "uid.txt.tmp" or die "Cannot open uid.txt.tmp\n";

	my $uidText = <IN>;

	chomp $uidText;

	my $uid = hex($uidText);

	close IN;   

	die "Invalid uid = $uidText\n" unless $uid != 0;

	open OUT, ">uid.txt.tmp" or die "Cannot write to uid.txt.tmp\n";

	print OUT sprintf("0x%8.8x", $uid + 1);

	close OUT;

	return $uid;

}

# Add install & uninstall entries

sub addIniEntries(\$\$\$\$\$) {

	my ($iniFile, $uid, $name, $installText, $uninstallText, $template) = @_;

	print "\tAdding install entry to ${iniFile}\n";

	open OUT, ">>${iniFile}" or die "Cannot write to ${iniFile}\n";

	print OUT "[${name}]\n";

	print OUT "sis=${DATA_DIR}\\${name}.sis\n";

    print OUT "${installText}\n";

	open( TEMPLATE, "< $template") or

		die "Cannot open package file template $template\n";

	my @config = <TEMPLATE>;

	close TEMPLATE;

	print "\tAdding uninstall entry to ${iniFile}\n";

	print OUT "[u_${name}]\n";

	# If package uid not pre-defined, use auto-generated id for uninstall

	my $puid = grep ( /##PACKAGE_UID##/, @config );

	if ( $puid == 1 ) {

		print OUT "uid=";

		print OUT sprintf("%8.8x", $uid);

		print OUT "\n";

	} else {

		my @line = grep( /testprotpUID/, @config );

		$line[0] =~ m/#{"testprotpUID"},\s+\(0x(.*)\), 1, 2, 3, TYPE=/;

		print OUT "uid=$1\n";

	}

    print OUT "${uninstallText}\n";

	close OUT;

}

# Takes the name of an embedded SIS file and returns the text required 

# by the package body to embed this file.

# In addition, this function calculates the component uid of the package file

# by searching the package directory for a file which matches the name of the SIS 

# file.

sub embeddedSIS(\$) {

	my ($sisfile) = @_;

	my $absSISfile = "${SIS_DIR}\\${PLATFORM}\\$sisfile";

	die "Cannot find embedded sis file $absSISfile\n"