/*

 * PKCS15 emulation for JCOP4 Cards with NQ-Applet

 *

 * Copyright (C) 2021 jozsefd <jozsef.dojcsak@gmail.com>

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2.1 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this library; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

 */

#include <stdlib.h>

#include <string.h>

#include "internal.h"

#include "opensc.h"

#include "cards.h"

#include "common/compat_strlcpy.h"

#include "log.h"

#include "pkcs15.h"

static const char name_Card[] = "NQ-Applet";

static const char name_Vendor[] = "NXP";

static int get_nqapplet_certificate(sc_card_t *card, u8 data_id, struct sc_pkcs15_der *cert_info)

{

  int rv;

  u8 buffer[3072];

  size_t cb_buffer = sizeof(buffer);

  LOG_FUNC_CALLED(card->ctx);

  rv = sc_get_data(card, data_id, buffer, cb_buffer);

  LOG_TEST_RET(card->ctx, rv, "GET DATA failed");

  if (rv == 0) {

    LOG_TEST_RET(card->ctx, SC_ERROR_FILE_NOT_FOUND, "No certificate data returned");

  }

  if (cert_info != NULL) {

    free(cert_info->value);

    cert_info->value = malloc(rv);

    if (cert_info->value != NULL) {

      cert_info->len = rv;

      memcpy(cert_info->value, buffer, rv);

    }

  }

  LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);

}

static int add_nqapplet_pin(sc_pkcs15_card_t *p15card, const char *id, u8 reference)

{

  int rv;

  struct sc_pkcs15_auth_info pin_info;

  struct sc_pkcs15_object pin_obj;

  sc_card_t *card = p15card->card;

  LOG_FUNC_CALLED(card->ctx);

  memset(&pin_info, 0, sizeof(pin_info));

  memset(&pin_obj, 0, sizeof(pin_obj));

  sc_pkcs15_format_id(id, &pin_info.auth_id);

  pin_info.auth_type = SC_PKCS15_PIN_AUTH_TYPE_PIN;

  pin_info.attrs.pin.reference = reference;

  pin_info.attrs.pin.flags = SC_PKCS15_PIN_FLAG_INITIALIZED | SC_PKCS15_PIN_FLAG_CASE_SENSITIVE |

                             SC_PKCS15_PIN_TYPE_FLAGS_PIN_GLOBAL | SC_PKCS15_PIN_AUTH_TYPE_PIN;

  pin_info.attrs.pin.type = SC_PKCS15_PIN_TYPE_UTF8;

  pin_info.attrs.pin.min_length = 6;

  pin_info.attrs.pin.stored_length = 6;

  pin_info.attrs.pin.max_length = 6;

  pin_info.attrs.pin.pad_char = '\0';

  pin_info.tries_left = -1; // TODO

  pin_info.max_tries = 3;

  strlcpy(pin_obj.label, "UserPIN", sizeof(pin_obj.label));

  pin_obj.flags = SC_PKCS15_CO_FLAG_MODIFIABLE | SC_PKCS15_CO_FLAG_PRIVATE;

  rv = sc_pkcs15emu_add_pin_obj(p15card, &pin_obj, &pin_info);

  LOG_TEST_RET(card->ctx, rv, "sc_pkcs15emu_add_pin_obj failed");

  LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);

}

static int add_nqapplet_certificate(sc_pkcs15_card_t *p15card, const char *id, const char *name, u8 data_id)

{

  int rv;

  struct sc_pkcs15_cert_info cert_info;

  struct sc_pkcs15_object cert_obj;

  sc_card_t *card = p15card->card;

  LOG_FUNC_CALLED(card->ctx);

  memset(&cert_info, 0, sizeof(cert_info));

  memset(&cert_obj, 0, sizeof(cert_obj));

  sc_pkcs15_format_id(id, &cert_info.id);

  rv = get_nqapplet_certificate(card, data_id, &cert_info.value);

  LOG_TEST_RET(card->ctx, rv, "Failed to get certificate");

  strlcpy(cert_obj.label, name, sizeof(cert_obj.label));

  rv = sc_pkcs15emu_add_x509_cert(p15card, &cert_obj, &cert_info);

  LOG_TEST_RET(card->ctx, rv, "sc_pkcs15emu_add_x509_cert failed");

  LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);

}

static int add_nqapplet_private_key(sc_pkcs15_card_t *p15card, const char *id, int reference,

                                    const char *name, const char *pin_id, unsigned int usage)

{

  int rv;

  struct sc_pkcs15_prkey_info prkey_info;

  struct sc_pkcs15_object prkey_obj;

  sc_card_t *card = p15card->card;

  LOG_FUNC_CALLED(card->ctx);

  memset(&prkey_info, 0, sizeof(prkey_info));

  memset(&prkey_obj, 0, sizeof(prkey_obj));

  sc_pkcs15_format_id(id, &prkey_info.id);

  prkey_info.usage = usage;

  prkey_info.native = 1;

  prkey_info.key_reference = reference;

  prkey_info.modulus_length = 3072;

  strlcpy(prkey_obj.label, name, sizeof(prkey_obj.label));

  prkey_obj.flags = SC_PKCS15_CO_FLAG_PRIVATE;

  sc_pkcs15_format_id(pin_id, &prkey_obj.auth_id);

  rv = sc_pkcs15emu_add_rsa_prkey(p15card, &prkey_obj, &prkey_info);

  LOG_TEST_RET(card->ctx, rv, "sc_pkcs15emu_add_rsa_prkey failed");

  LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);

}

static int add_nqapplet_objects(sc_pkcs15_card_t *p15card)

{

  int rv;

  sc_card_t *card = p15card->card;

  LOG_FUNC_CALLED(card->ctx);

  // 1) User PIN

  rv = add_nqapplet_pin(p15card, "1", 0x01);

  LOG_TEST_RET(card->ctx, rv, "Failed to add PIN 1");

  // 2.1) C.CH.Auth

  rv = add_nqapplet_certificate(p15card, "1", "C.CH.Auth", 0x00);

  LOG_TEST_RET(card->ctx, rv, "Failed to add Auth. certificate");

  // 2.2) PrK.CH.Auth

  rv = add_nqapplet_private_key(p15card, "1", 0x01, "PrK.CH.Auth", "1",

                                SC_PKCS15_PRKEY_USAGE_SIGN | SC_PKCS15_PRKEY_USAGE_DECRYPT);

  LOG_TEST_RET(card->ctx, rv, "Failed to add Auth. private key");

  // 3.1) C.CH.Encr

  rv = add_nqapplet_certificate(p15card, "2", "C.CH.Encr", 0x01);

  if (rv == SC_SUCCESS) {

    // 3.2) PrK.CH.Encr

    rv = add_nqapplet_private_key(p15card, "2", 0x02, "PrK.CH.Encr", "1", SC_PKCS15_PRKEY_USAGE_DECRYPT);

    LOG_TEST_RET(card->ctx, rv, "Failed to add Encr. private key");

  } else {

    sc_log(p15card->card->ctx, "The card has no C.CH.Encr, ignoring CH.Encr container");

  }

  LOG_FUNC_RETURN(card->ctx, SC_SUCCESS);

}

int sc_pkcs15emu_nqapplet_init_ex(sc_pkcs15_card_t *p15card, struct sc_aid *aid)

{

  int rv = SC_ERROR_WRONG_CARD;

  sc_context_t *ctx;

  sc_card_t *card;

  if (!p15card || !p15card->card || !p15card->card->ctx) {

    return SC_ERROR_INVALID_ARGUMENTS;

  }

  card = p15card->card;

  ctx = card->ctx;

  SC_FUNC_CALLED(ctx, SC_LOG_DEBUG_NORMAL);

  if (card->type < SC_CARD_TYPE_NQ_APPLET || card->type > SC_CARD_TYPE_NQ_APPLET_RFID) {

    sc_log(p15card->card->ctx, "Unsupported card type: %d", card->type);

    return SC_ERROR_WRONG_CARD;

  }

  rv = add_nqapplet_objects(p15card);

  LOG_TEST_GOTO_ERR(ctx, rv, "Failed to add PKCS15");

  if (aid != NULL) {

    struct sc_file *file = sc_file_new();

    if (file != NULL) {

      /* PKCS11 depends on the file_app object, provide MF */

      sc_format_path("3f00", &file->path);

      sc_file_free(p15card->file_app);

      p15card->file_app = file;

    }

  }

  sc_pkcs15_free_tokeninfo(p15card->tokeninfo);

  p15card->tokeninfo = sc_pkcs15_tokeninfo_new();

  if (p15card->tokeninfo == NULL) {

    rv = SC_ERROR_OUT_OF_MEMORY;

    LOG_TEST_GOTO_ERR(ctx, rv, "unable to create tokeninfo struct");

  } else {

    char serial_hex[SC_MAX_SERIALNR * 2 + 2];

    sc_bin_to_hex(card->serialnr.value, card->serialnr.len, serial_hex, sizeof(serial_hex), 0);

    set_string(&p15card->tokeninfo->serial_number, serial_hex);

    set_string(&p15card->tokeninfo->label, name_Card);

    set_string(&p15card->tokeninfo->manufacturer_id, name_Vendor);

    p15card->tokeninfo->flags = SC_PKCS15_TOKEN_READONLY;

  }

  LOG_FUNC_RETURN(ctx, SC_SUCCESS);

err:

  sc_pkcs15_card_clear(p15card);

  LOG_FUNC_RETURN(ctx, rv);

}