/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*

 * CMS miscellaneous utility functions.

 */

#include "cmslocal.h"

#include "cert.h"

#include "keyhi.h"

#include "secasn1.h"

#include "secitem.h"

#include "secoid.h"

#include "pk11func.h"

#include "secerr.h"

#include "sechash.h"

/*

 * NSS_CMSArray_SortByDER - sort array of objects by objects' DER encoding

 *

 * make sure that the order of the objects guarantees valid DER (which must be

 * in lexigraphically ascending order for a SET OF); if reordering is necessary it

 * will be done in place (in objs).

 */

SECStatus

NSS_CMSArray_SortByDER(void **objs, const SEC_ASN1Template *objtemplate, void **objs2)

{

    PLArenaPool *poolp;

    int num_objs;

    SECItem **enc_objs;

    SECStatus rv = SECFailure;

    int i;

    if (objs == NULL) /* already sorted */

        return SECSuccess;

    num_objs = NSS_CMSArray_Count((void **)objs);

    if (num_objs == 0 || num_objs == 1) /* already sorted. */

        return SECSuccess;

    poolp = PORT_NewArena(1024); /* arena for temporaries */

    if (poolp == NULL)

        return SECFailure; /* no memory; nothing we can do... */

    /*

     * Allocate arrays to hold the individual encodings which we will use

     * for comparisons and the reordered attributes as they are sorted.

     */

    enc_objs = (SECItem **)PORT_ArenaZAlloc(poolp, (num_objs + 1) * sizeof(SECItem *));

    if (enc_objs == NULL)

        goto loser;

    /* DER encode each individual object. */

    for (i = 0; i < num_objs; i++) {

        enc_objs[i] = SEC_ASN1EncodeItem(poolp, NULL, objs[i], objtemplate);

        if (enc_objs[i] == NULL)

            goto loser;

    }

    enc_objs[num_objs] = NULL;

    /* now compare and sort objs by the order of enc_objs */

    NSS_CMSArray_Sort((void **)enc_objs, NSS_CMSUtil_DERCompare, objs, objs2);

    rv = SECSuccess;

loser:

    PORT_FreeArena(poolp, PR_FALSE);

    return rv;

}

/*

 * NSS_CMSUtil_DERCompare - for use with NSS_CMSArray_Sort to

 *  sort arrays of SECItems containing DER

 */

int

NSS_CMSUtil_DERCompare(void *a, void *b)

{

    SECItem *der1 = (SECItem *)a;

    SECItem *der2 = (SECItem *)b;

    unsigned int j;

    /*

     * Find the lowest (lexigraphically) encoding.  One that is

     * shorter than all the rest is known to be "less" because each

     * attribute is of the same type (a SEQUENCE) and so thus the

     * first octet of each is the same, and the second octet is

     * the length (or the length of the length with the high bit

     * set, followed by the length, which also works out to always

     * order the shorter first).  Two (or more) that have the

     * same length need to be compared byte by byte until a mismatch

     * is found.

     */

    if (der1->len != der2->len)

        return (der1->len < der2->len) ? -1 : 1;

    for (j = 0; j < der1->len; j++) {

        if (der1->data[j] == der2->data[j])

            continue;

        return (der1->data[j] < der2->data[j]) ? -1 : 1;

    }

    return 0;

}

/*

 * NSS_CMSAlgArray_GetIndexByAlgID - find a specific algorithm in an array of

 * algorithms.

 *

 * algorithmArray - array of algorithm IDs

 * algid - algorithmid of algorithm to pick

 *

 * Returns:

 *  An integer containing the index of the algorithm in the array or -1 if

 *  algorithm was not found.

 */

int

NSS_CMSAlgArray_GetIndexByAlgID(SECAlgorithmID **algorithmArray, SECAlgorithmID *algid)

{

    int i;

    if (algorithmArray == NULL || algorithmArray[0] == NULL)

        return -1;

    for (i = 0; algorithmArray[i] != NULL; i++) {

        if (SECOID_CompareAlgorithmID(algorithmArray[i], algid) == SECEqual)

            break; /* bingo */

    }

    if (algorithmArray[i] == NULL)

        return -1; /* not found */

    return i;

}

/*

 * NSS_CMSAlgArray_GetIndexByAlgTag - find a specific algorithm in an array of

 * algorithms.

 *

 * algorithmArray - array of algorithm IDs

 * algtag - algorithm tag of algorithm to pick

 *

 * Returns:

 *  An integer containing the index of the algorithm in the array or -1 if

 *  algorithm was not found.

 */

int

NSS_CMSAlgArray_GetIndexByAlgTag(SECAlgorithmID **algorithmArray,

                                 SECOidTag algtag)

{

    SECOidData *algid;

    int i = -1;

    if (algorithmArray == NULL || algorithmArray[0] == NULL)

        return i;

#ifdef ORDER_N_SQUARED

    for (i = 0; algorithmArray[i] != NULL; i++) {

        algid = SECOID_FindOID(&(algorithmArray[i]->algorithm));

        if (algid->offset == algtag)

            break; /* bingo */

    }

#else

    algid = SECOID_FindOIDByTag(algtag);

    if (!algid)

        return i;

    for (i = 0; algorithmArray[i] != NULL; i++) {

        if (SECITEM_ItemsAreEqual(&algorithmArray[i]->algorithm, &algid->oid))

            break; /* bingo */

    }

#endif

    if (algorithmArray[i] == NULL)

        return -1; /* not found */

    return i;

}

/*

 * Map a sign algorithm to a digest algorithm.

 * This is used to handle incorrectly formatted packages sent to us

 * from Windows 2003.

 */

SECOidTag

NSS_CMSUtil_MapSignAlgs(SECOidTag signAlg)

{

    switch (signAlg) {

        case SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION:

            return SEC_OID_MD2;

            break;

        case SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION:

            return SEC_OID_MD5;

            break;

        case SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION:

        case SEC_OID_ANSIX962_ECDSA_SHA1_SIGNATURE:

        case SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST:

            return SEC_OID_SHA1;

            break;

        case SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION:

        case SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE:

            return SEC_OID_SHA256;

            break;

        case SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION:

        case SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE:

            return SEC_OID_SHA384;

            break;

        case SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION:

        case SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE:

            return SEC_OID_SHA512;

            break;

        default:

            break;

    }

    /* not one of the algtags incorrectly sent to us*/

    return signAlg;

}

const SECHashObject *

NSS_CMSUtil_GetHashObjByAlgID(SECAlgorithmID *algid)

{

    SECOidTag oidTag = SECOID_FindOIDTag(&(algid->algorithm));

    const SECHashObject *digobj = HASH_GetHashObjectByOidTag(oidTag);

    return digobj;

}

const SEC_ASN1Template *

NSS_CMSUtil_GetTemplateByTypeTag(SECOidTag type)

{

    const SEC_ASN1Template *template;

    extern const SEC_ASN1Template NSSCMSSignedDataTemplate[];

    extern const SEC_ASN1Template NSSCMSEnvelopedDataTemplate[];

    extern const SEC_ASN1Template NSSCMSEncryptedDataTemplate[];

    extern const SEC_ASN1Template NSSCMSDigestedDataTemplate[];

    switch (type) {

        case SEC_OID_PKCS7_SIGNED_DATA:

            template = NSSCMSSignedDataTemplate;

            break;

        case SEC_OID_PKCS7_ENVELOPED_DATA:

            template = NSSCMSEnvelopedDataTemplate;

            break;

        case SEC_OID_PKCS7_ENCRYPTED_DATA:

            template = NSSCMSEncryptedDataTemplate;

            break;

        case SEC_OID_PKCS7_DIGESTED_DATA:

            template = NSSCMSDigestedDataTemplate;

            break;

        default:

            template = NSS_CMSType_GetTemplate(type);

            break;

    }

    return template;

}

size_t

NSS_CMSUtil_GetSizeByTypeTag(SECOidTag type)

{

    size_t size;

    switch (type) {

        case SEC_OID_PKCS7_SIGNED_DATA:

            size = sizeof(NSSCMSSignedData);

            break;

        case SEC_OID_PKCS7_ENVELOPED_DATA:

            size = sizeof(NSSCMSEnvelopedData);

            break;

        case SEC_OID_PKCS7_ENCRYPTED_DATA:

            size = sizeof(NSSCMSEncryptedData);

            break;

        case SEC_OID_PKCS7_DIGESTED_DATA:

            size = sizeof(NSSCMSDigestedData);

            break;

        default:

            size = NSS_CMSType_GetContentSize(type);

            break;

    }

    return size;

}

NSSCMSContentInfo *

NSS_CMSContent_GetContentInfo(void *msg, SECOidTag type)

{

    NSSCMSContent c;

    NSSCMSContentInfo *cinfo = NULL;

    if (!msg)

        return cinfo;

    c.pointer = msg;

    switch (type) {

        case SEC_OID_PKCS7_SIGNED_DATA:

            cinfo = &(c.signedData->contentInfo);

            break;

        case SEC_OID_PKCS7_ENVELOPED_DATA:

            cinfo = &(c.envelopedData->contentInfo);

            break;

        case SEC_OID_PKCS7_ENCRYPTED_DATA:

            cinfo = &(c.encryptedData->contentInfo);

            break;

        case SEC_OID_PKCS7_DIGESTED_DATA:

            cinfo = &(c.digestedData->contentInfo);

            break;

        default:

            cinfo = NULL;

            if (NSS_CMSType_IsWrapper(type)) {

                cinfo = &(c.genericData->contentInfo);

            }

    }

    return cinfo;

}

const char *

NSS_CMSUtil_VerificationStatusToString(NSSCMSVerificationStatus vs)

{

    switch (vs) {

        case NSSCMSVS_Unverified:

            return "Unverified";

        case NSSCMSVS_GoodSignature:

            return "GoodSignature";

        case NSSCMSVS_BadSignature:

            return "BadSignature";

        case NSSCMSVS_DigestMismatch:

            return "DigestMismatch";

        case NSSCMSVS_SigningCertNotFound:

            return "SigningCertNotFound";

        case NSSCMSVS_SigningCertNotTrusted:

            return "SigningCertNotTrusted";

        case NSSCMSVS_SignatureAlgorithmUnknown:

            return "SignatureAlgorithmUnknown";

        case NSSCMSVS_SignatureAlgorithmUnsupported:

            return "SignatureAlgorithmUnsupported";

        case NSSCMSVS_MalformedSignature:

            return "MalformedSignature";

        case NSSCMSVS_ProcessingError:

            return "ProcessingError";

        default:

            return "Unknown";

    }

}

SECStatus

NSS_CMSDEREncode(NSSCMSMessage *cmsg, SECItem *input, SECItem *derOut,

                 PLArenaPool *arena)

{

    NSSCMSEncoderContext *ecx;

    SECStatus rv = SECSuccess;

    if (!cmsg || !derOut || !arena) {

        PORT_SetError(SEC_ERROR_INVALID_ARGS);

        return SECFailure;

    }

    ecx = NSS_CMSEncoder_Start(cmsg, 0, 0, derOut, arena, 0, 0, 0, 0, 0, 0);

    if (!ecx) {

        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

        return SECFailure;

    }

    if (input) {

        rv = NSS_CMSEncoder_Update(ecx, (const char *)input->data, input->len);

        if (rv) {

            PORT_SetError(SEC_ERROR_BAD_DATA);

        }

    }

    rv |= NSS_CMSEncoder_Finish(ecx);

    if (rv) {

        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

    }

    return rv;

}