/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "cert.h"

#include "certt.h"

#include "secder.h"

#include "keyhi.h"

#include "secitem.h"

#include "secasn1.h"

#include "secerr.h"

SEC_ASN1_MKSUB(SEC_AnyTemplate)

const SEC_ASN1Template CERT_AttributeTemplate[] = {

    { SEC_ASN1_SEQUENCE,

      0, NULL, sizeof(CERTAttribute) },

    { SEC_ASN1_OBJECT_ID, offsetof(CERTAttribute, attrType) },

    { SEC_ASN1_SET_OF | SEC_ASN1_XTRN, offsetof(CERTAttribute, attrValue),

      SEC_ASN1_SUB(SEC_AnyTemplate) },

    { 0 }

};

const SEC_ASN1Template CERT_SetOfAttributeTemplate[] = {

    { SEC_ASN1_SET_OF, 0, CERT_AttributeTemplate },

};

const SEC_ASN1Template CERT_CertificateRequestTemplate[] = {

    { SEC_ASN1_SEQUENCE,

      0, NULL, sizeof(CERTCertificateRequest) },

    { SEC_ASN1_INTEGER,

      offsetof(CERTCertificateRequest, version) },

    { SEC_ASN1_INLINE,

      offsetof(CERTCertificateRequest, subject),

      CERT_NameTemplate },

    { SEC_ASN1_INLINE,

      offsetof(CERTCertificateRequest, subjectPublicKeyInfo),

      CERT_SubjectPublicKeyInfoTemplate },

    { SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,

      offsetof(CERTCertificateRequest, attributes),

      CERT_SetOfAttributeTemplate },

    { 0 }

};

SEC_ASN1_CHOOSER_IMPLEMENT(CERT_CertificateRequestTemplate)

CERTCertificate *

CERT_CreateCertificate(unsigned long serialNumber,

                       CERTName *issuer,

                       CERTValidity *validity,

                       CERTCertificateRequest *req)

{

    CERTCertificate *c;

    int rv;

    PLArenaPool *arena;

    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);

    if (!arena) {

        return (0);

    }

    c = (CERTCertificate *)PORT_ArenaZAlloc(arena, sizeof(CERTCertificate));

    if (!c) {

        PORT_FreeArena(arena, PR_FALSE);

        return 0;

    }

    c->referenceCount = 1;

    c->arena = arena;

    /*

     * Default is a plain version 1.

     * If extensions are added, it will get changed as appropriate.

     */

    rv = DER_SetUInteger(arena, &c->version, SEC_CERTIFICATE_VERSION_1);

    if (rv)

        goto loser;

    rv = DER_SetUInteger(arena, &c->serialNumber, serialNumber);

    if (rv)

        goto loser;

    rv = CERT_CopyName(arena, &c->issuer, issuer);

    if (rv)

        goto loser;

    rv = CERT_CopyValidity(arena, &c->validity, validity);

    if (rv)

        goto loser;

    rv = CERT_CopyName(arena, &c->subject, &req->subject);

    if (rv)

        goto loser;

    rv = SECKEY_CopySubjectPublicKeyInfo(arena, &c->subjectPublicKeyInfo,

                                         &req->subjectPublicKeyInfo);

    if (rv)

        goto loser;

    return c;

loser:

    CERT_DestroyCertificate(c);

    return 0;

}

/************************************************************************/

/* It's clear from the comments that the original author of this

 * function expected the template for certificate requests to treat

 * the attributes as a SET OF ANY.  This function expected to be

 * passed an array of SECItems each of which contained an already encoded

 * Attribute.  But the cert request template does not treat the

 * Attributes as a SET OF ANY, and AFAIK never has.  Instead the template

 * encodes attributes as a SET OF xxxxxxx.  That is, it expects to encode

 * each of the Attributes, not have them pre-encoded.  Consequently an

 * array of SECItems containing encoded Attributes is of no value to this

 * function.  But we cannot change the signature of this public function.

 * It must continue to take SECItems.

 *

 * I have recoded this function so that each SECItem contains an

 * encoded cert extension.  The encoded cert extensions form the list for the

 * single attribute of the cert request. In this implementation there is at most

 * one attribute and it is always of type SEC_OID_PKCS9_EXTENSION_REQUEST.

 */

CERTCertificateRequest *

CERT_CreateCertificateRequest(CERTName *subject,

                              CERTSubjectPublicKeyInfo *spki,

                              SECItem **attributes)

{

    CERTCertificateRequest *certreq;

    PLArenaPool *arena;

    CERTAttribute *attribute;

    SECOidData *oidData;

    SECStatus rv;

    int i = 0;

    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);

    if (arena == NULL) {

        return NULL;

    }

    certreq = PORT_ArenaZNew(arena, CERTCertificateRequest);

    if (!certreq) {

        PORT_FreeArena(arena, PR_FALSE);

        return NULL;

    }

    /* below here it is safe to goto loser */

    certreq->arena = arena;

    rv = DER_SetUInteger(arena, &certreq->version,

                         SEC_CERTIFICATE_REQUEST_VERSION);

    if (rv != SECSuccess)

        goto loser;

    rv = CERT_CopyName(arena, &certreq->subject, subject);

    if (rv != SECSuccess)

        goto loser;

    rv = SECKEY_CopySubjectPublicKeyInfo(arena,

                                         &certreq->subjectPublicKeyInfo,

                                         spki);

    if (rv != SECSuccess)

        goto loser;

    certreq->attributes = PORT_ArenaZNewArray(arena, CERTAttribute *, 2);

    if (!certreq->attributes)

        goto loser;

    /* Copy over attribute information */

    if (!attributes || !attributes[0]) {

        /*

         ** Invent empty attribute information. According to the

         ** pkcs#10 spec, attributes has this ASN.1 type:

         **

         ** attributes [0] IMPLICIT Attributes

         **

         ** Which means, we should create a NULL terminated list

         ** with the first entry being NULL;

         */

        certreq->attributes[0] = NULL;

        return certreq;

    }

    /* allocate space for attributes */

    attribute = PORT_ArenaZNew(arena, CERTAttribute);

    if (!attribute)

        goto loser;

    oidData = SECOID_FindOIDByTag(SEC_OID_PKCS9_EXTENSION_REQUEST);

    PORT_Assert(oidData);

    if (!oidData)

        goto loser;

    rv = SECITEM_CopyItem(arena, &attribute->attrType, &oidData->oid);

    if (rv != SECSuccess)

        goto loser;

    for (i = 0; attributes[i] != NULL; i++)

        ;

    attribute->attrValue = PORT_ArenaZNewArray(arena, SECItem *, i + 1);

    if (!attribute->attrValue)

        goto loser;

    /* copy attributes */

    for (i = 0; attributes[i]; i++) {

        /*

        ** Attributes are a SetOf Attribute which implies

        ** lexigraphical ordering.  It is assumes that the

        ** attributes are passed in sorted.  If we need to

        ** add functionality to sort them, there is an

        ** example in the PKCS 7 code.

        */

        attribute->attrValue[i] = SECITEM_ArenaDupItem(arena, attributes[i]);

        if (!attribute->attrValue[i])

            goto loser;

    }

    certreq->attributes[0] = attribute;

    return certreq;

loser:

    CERT_DestroyCertificateRequest(certreq);

    return NULL;

}

void

CERT_DestroyCertificateRequest(CERTCertificateRequest *req)

{

    if (req && req->arena) {

        PORT_FreeArena(req->arena, PR_FALSE);

    }

    return;

}

static void

setCRExt(void *o, CERTCertExtension **exts)

{

    ((CERTCertificateRequest *)o)->attributes = (struct CERTAttributeStr **)exts;

}

/*

** Set up to start gathering cert extensions for a cert request.

** The list is created as CertExtensions and converted to an

** attribute list by CERT_FinishCRAttributes().

*/

extern void *cert_StartExtensions(void *owner, PLArenaPool *ownerArena,

                                  void (*setExts)(void *object, CERTCertExtension **exts));

void *

CERT_StartCertificateRequestAttributes(CERTCertificateRequest *req)

{

    return (cert_StartExtensions((void *)req, req->arena, setCRExt));

}

/*

** At entry req->attributes actually contains an list of cert extensions--

** req-attributes is overloaded until the list is DER encoded (the first

** ...EncodeItem() below).

** We turn this into an attribute list by encapsulating it

** in a PKCS 10 Attribute structure

*/

SECStatus

CERT_FinishCertificateRequestAttributes(CERTCertificateRequest *req)

{

    SECItem *extlist;

    SECOidData *oidrec;

    CERTAttribute *attribute;

    if (!req || !req->arena) {

        PORT_SetError(SEC_ERROR_INVALID_ARGS);

        return SECFailure;

    }

    if (req->attributes == NULL || req->attributes[0] == NULL)

        return SECSuccess;

    extlist = SEC_ASN1EncodeItem(req->arena, NULL, &req->attributes,

                                 SEC_ASN1_GET(CERT_SequenceOfCertExtensionTemplate));

    if (extlist == NULL)

        return (SECFailure);

    oidrec = SECOID_FindOIDByTag(SEC_OID_PKCS9_EXTENSION_REQUEST);

    if (oidrec == NULL)

        return SECFailure;

    /* now change the list of cert extensions into a list of attributes

     */

    req->attributes = PORT_ArenaZNewArray(req->arena, CERTAttribute *, 2);

    attribute = PORT_ArenaZNew(req->arena, CERTAttribute);

    if (req->attributes == NULL || attribute == NULL ||

        SECITEM_CopyItem(req->arena, &attribute->attrType, &oidrec->oid) != 0) {

        PORT_SetError(SEC_ERROR_NO_MEMORY);

        return SECFailure;

    }

    attribute->attrValue = PORT_ArenaZNewArray(req->arena, SECItem *, 2);

    if (attribute->attrValue == NULL)

        return SECFailure;

    attribute->attrValue[0] = extlist;

    attribute->attrValue[1] = NULL;

    req->attributes[0] = attribute;

    req->attributes[1] = NULL;

    return SECSuccess;

}

SECStatus

CERT_GetCertificateRequestExtensions(CERTCertificateRequest *req,

                                     CERTCertExtension ***exts)

{

    if (req == NULL || exts == NULL) {

        PORT_SetError(SEC_ERROR_INVALID_ARGS);

        return SECFailure;

    }

    if (req->attributes == NULL || *req->attributes == NULL)

        return SECSuccess;

    if ((*req->attributes)->attrValue == NULL) {

        PORT_SetError(SEC_ERROR_INVALID_ARGS);

        return SECFailure;

    }

    return (SEC_ASN1DecodeItem(req->arena, exts,

                               SEC_ASN1_GET(CERT_SequenceOfCertExtensionTemplate),

                               (*req->attributes)->attrValue[0]));

}