/*
 *
 *    Copyright (c) 2013-2017 Nest Labs, Inc.
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

/**
 *    @file
 *      This file implements utility functions for outputting
 *      information related to Weave security.
 *
 *      @note These function symbols are only available when
 *            #WEAVE_CONFIG_ENABLE_SECURITY_DEBUG_FUNCS has been
 *            asserted.
 *
 */

#ifndef __STDC_FORMAT_MACROS
#define __STDC_FORMAT_MACROS
#endif

#include <inttypes.h>
#include <stdio.h>

#include <Weave/Core/WeaveCore.h>
#include <Weave/Profiles/security/WeaveSecurityDebug.h>
#include <Weave/Support/ErrorStr.h>

namespace nl {
namespace Weave {
namespace Profiles {
namespace Security {

using namespace nl::Weave::ASN1;
using namespace nl::Weave::TLV;
using namespace nl::Weave::Profiles;
using namespace nl::Weave::Crypto;

#if WEAVE_CONFIG_ENABLE_SECURITY_DEBUG_FUNCS

static void Indent(FILE *out, uint16_t count)
{
    while (count--)
        fputc(' ', out);
}

static void PrintHexField(FILE *out, const char *name, uint16_t indent, uint16_t count, const uint8_t *data)
{
    Indent(out, indent);
    fprintf(out, "%s: ", name);

    for (uint16_t i = 0; i < count; i++)
    {
        if (i % 16 == 0)
        {
            fprintf(out, "\n");
            Indent(out, indent + 2);
        }

        fprintf(out, "%02X ", data[i]);
    }

    fprintf(out, "\n");
}

static void PrintCertType(FILE *out, uint8_t certType)
{
    const char *certTypeStr;

    switch (certType)
    {
    case kCertType_NotSpecified:
        certTypeStr = "Not specified";
        break;
    case kCertType_General:
        certTypeStr = "General";
        break;
    case kCertType_Device:
        certTypeStr = "Device";
        break;
    case kCertType_ServiceEndpoint:
        certTypeStr = "Service Endpoint";
        break;
    case kCertType_FirmwareSigning:
        certTypeStr = "Firmware Signing";
        break;
    case kCertType_AccessToken:
        certTypeStr = "Access Token";
        break;
    case kCertType_CA:
        certTypeStr = "CA";
        break;
    default:
        if (certType < kCertType_AppDefinedBase)
            fprintf(out, "Unknown (0x%02X)", certType);
        else
            fprintf(out, "Application Defined (0x%02X)", certType);
        return;
    }

    fputs(certTypeStr, out);
}

NL_DLL_EXPORT void PrintCert(FILE *out, const WeaveCertificateData& cert, const WeaveCertificateSet *certSet, uint16_t indent, bool verbose)
{
    Indent(out, indent);
    fprintf(out, "Subject: ");
    if ((cert.CertFlags & kCertFlag_UnsupportedSubjectDN) == 0)
        PrintWeaveDN(out, cert.SubjectDN);
    else
        fprintf(out, "(unsupported DN format)");
    fprintf(out, "\n");

    Indent(out, indent);
    fprintf(out, "Issuer: ");
    if ((cert.CertFlags & kCertFlag_UnsupportedIssuerDN) == 0)
        PrintWeaveDN(out, cert.IssuerDN);
    else
        fprintf(out, "(unsupported DN format)");
    fprintf(out, "\n");

    if (cert.CertFlags & kCertFlag_ExtPresent_SubjectKeyId)
    {
        Indent(out, indent);
        fprintf(out, "Subject Key Id: ");
        for (uint16_t i = 0; i < cert.SubjectKeyId.Len; i++)
            fprintf(out, "%02X", cert.SubjectKeyId.Id[i]);
        fprintf(out, "\n");
    }

    if (cert.CertFlags & kCertFlag_ExtPresent_AuthKeyId)
    {
        Indent(out, indent);
        fprintf(out, "Authority Key Id: ");
        for (uint16_t i = 0; i < cert.AuthKeyId.Len; i++)
            fprintf(out, "%02X", cert.AuthKeyId.Id[i]);
        if (certSet != NULL)
        {
            WeaveCertificateData *authCert = certSet->FindCert(cert.AuthKeyId);
            if (authCert != NULL)
                fprintf(out, " (Cert %u)", (unsigned)(authCert - certSet->Certs));
            else
                fprintf(out, " (no match)");
        }
        fprintf(out, "\n");
    }

    Indent(out, indent);
    fprintf(out, "Validity:\n");
    Indent(out, indent + 2);
    fprintf(out, "Not Before: "); PrintPackedDate(out, cert.NotBeforeDate); fprintf(out, "\n");
    Indent(out, indent + 2);
    fprintf(out, "Not After: "); PrintPackedDate(out, cert.NotAfterDate); fprintf(out, "\n");

    Indent(out, indent);
    fprintf(out, "Type: ");
    PrintCertType(out, cert.CertType);
    fprintf(out, "\n");

    if (cert.CertFlags & kCertFlag_IsCA)
    {
        Indent(out, indent);
        fprintf(out, "Is CA: true\n");
    }

    if (cert.CertFlags & kCertFlag_PathLenConstPresent)
    {
        Indent(out, indent);
        fprintf(out, "Path Length Constraint: %u\n", (unsigned)cert.PathLenConstraint);
    }

    if (cert.CertFlags & kCertFlag_IsTrusted)
    {
        Indent(out, indent);
        fprintf(out, "Is Trusted: true\n");
    }

    if (cert.CertFlags & kCertFlag_ExtPresent_KeyUsage)
    {
        Indent(out, indent);
        fprintf(out, "Key Usage: ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_DigitalSignature)
            fprintf(out, "DigitalSignature ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_NonRepudiation)
            fprintf(out, "NonRepudiation ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_KeyEncipherment)
            fprintf(out, "KeyEncipherment ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_DataEncipherment)
            fprintf(out, "DataEncipherment ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_KeyAgreement)
            fprintf(out, "KeyAgreement ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_KeyCertSign)
            fprintf(out, "KeyCertSign ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_CRLSign)
            fprintf(out, "CRLSign ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_EncipherOnly)
            fprintf(out, "EncipherOnly ");
        if (cert.KeyUsageFlags & kKeyUsageFlag_DecipherOnly)
            fprintf(out, "DecipherOnly ");
        fprintf(out, "\n");
    }

    if (cert.CertFlags & kCertFlag_ExtPresent_ExtendedKeyUsage)
    {
        Indent(out, indent);
        fprintf(out, "Key Purpose: ");
        if (cert.KeyPurposeFlags & kKeyPurposeFlag_ServerAuth)
            fprintf(out, "ServerAuth ");
        if (cert.KeyPurposeFlags & kKeyPurposeFlag_ClientAuth)
            fprintf(out, "ClientAuth ");
        if (cert.KeyPurposeFlags & kKeyPurposeFlag_CodeSigning)
            fprintf(out, "CodeSigning ");
        if (cert.KeyPurposeFlags & kKeyPurposeFlag_EmailProtection)
            fprintf(out, "EmailProtection ");
        if (cert.KeyPurposeFlags & kKeyPurposeFlag_TimeStamping)
            fprintf(out, "TimeStamping ");
        if (cert.KeyPurposeFlags & kKeyPurposeFlag_OCSPSigning)
            fprintf(out, "OCSPSigning ");
        fprintf(out, "\n");
    }

    Indent(out, indent);
    fprintf(out, "Public Key Algorithm: %s\n", GetOIDName(cert.PubKeyAlgoOID));

    Indent(out, indent);
    fprintf(out, "Signature Algorithm: %s\n", GetOIDName(cert.SigAlgoOID));

    if (cert.PubKeyAlgoOID == kOID_PubKeyAlgo_ECPublicKey ||
        cert.PubKeyAlgoOID == kOID_PubKeyAlgo_ECDH ||
        cert.PubKeyAlgoOID == kOID_PubKeyAlgo_ECMQV)
    {
        Indent(out, indent);
        fprintf(out, "Curve Id: %s\n", GetOIDName(WeaveCurveIdToOID(cert.PubKeyCurveId)));

        if (verbose)
        {
            PrintHexField(out, "Public Key", indent, cert.PublicKey.EC.ECPointLen, cert.PublicKey.EC.ECPoint);

            Indent(out, indent);
            fprintf(out, "Signature:\n");
            PrintHexField(out, "r", indent + 2, cert.Signature.EC.RLen, cert.Signature.EC.R);
            PrintHexField(out, "s", indent + 2, cert.Signature.EC.SLen, cert.Signature.EC.S);
        }
    }
}

NL_DLL_EXPORT void PrintCertValidationResults(FILE *out, const WeaveCertificateSet& certSet, const ValidationContext& validContext, uint16_t indent)
{
    WEAVE_ERROR *certValidRes = validContext.CertValidationResults;

    for (uint8_t i = 0; i < certSet.CertCount && i < validContext.CertValidationResultsLen; i++)
    {
        const WeaveCertificateData& cert = certSet.Certs[i];
        Indent(out, indent);
        if (certValidRes[i] == WEAVE_NO_ERROR)
            printf("Cert %d: Validation successful\n", i);
        else if (certValidRes[i] == WEAVE_CERT_NOT_USED)
            printf("Cert %d: Not used during validation\n", i);
        else
            printf("Cert %d: %s\n", i, nl::ErrorStr(certValidRes[i]));
        PrintCert(out, cert, &certSet, indent + 2, false);
        if (&cert == validContext.TrustAnchor)
        {
            Indent(out, indent + 2);
            printf("Is Trust Anchor: true\n");
        }
        printf("\n");
    }
}

void PrintWeaveDN(FILE *out, const WeaveDN& dn)
{
    char valueStr[1024];
    const char *certDesc = NULL;

    if (IsWeaveIdX509Attr(dn.AttrOID))
    {
        snprintf(valueStr, sizeof(valueStr), "%016" PRIX64, dn.AttrValue.WeaveId);
        certDesc = DescribeWeaveCertId(dn.AttrOID, dn.AttrValue.WeaveId);
    }
    else
    {
        uint32_t len = dn.AttrValue.String.Len;
        if (len > sizeof(valueStr) - 1)
            len = sizeof(valueStr) - 1;
        memcpy(valueStr, dn.AttrValue.String.Value, len);
        valueStr[len] = 0;
    }

    fprintf(out, "%s=%s", nl::Weave::ASN1::GetOIDName((OID)dn.AttrOID), valueStr);
    if (certDesc != NULL)
        fprintf(out, " (%s)", certDesc);
}

void PrintPackedTime(FILE *out, uint32_t t)
{
    nl::Weave::ASN1::ASN1UniversalTime asn1Time;
    UnpackCertTime(t, asn1Time);
    fprintf(out, "%04" PRId16 "/%02" PRId8 "/%02" PRId8 " %02" PRId8 ":%02" PRId8 ":%02" PRId8 "",
            asn1Time.Year, asn1Time.Month, asn1Time.Day,
            asn1Time.Hour, asn1Time.Minute, asn1Time.Second);
}

void PrintPackedDate(FILE *out, uint16_t t)
{
    nl::Weave::ASN1::ASN1UniversalTime asn1Time;
    UnpackCertTime(PackedCertDateToTime(t), asn1Time);
    fprintf(out, "%04" PRId16 "/%02" PRId8 "/%02" PRId8,
            asn1Time.Year, asn1Time.Month, asn1Time.Day);
}

const char *DescribeWeaveCertId(OID attrOID, uint64_t weaveCertId)
{
    switch (attrOID)
    {
    case kOID_AttributeType_WeaveCAId:
        if (weaveCertId == 0x18B430EE00000001ULL)
            return "Nest Production Root";
        if (weaveCertId == 0x18B430EE00000002ULL)
            return "Nest Production Device CA";
        if (weaveCertId == 0x18B430EE00000003ULL)
            return "Nest Production Service Endpoint CA";
        if (weaveCertId == 0x18B430EE00000004ULL)
            return "Nest Production Firmware Signing CA";
        if (weaveCertId == 0x18B430EEEE000001ULL)
            return "Nest Development Root";
        if (weaveCertId == 0x18B430EEEE000002ULL)
            return "Nest Development Device CA";
        if (weaveCertId == 0x18B430EEEE000003ULL)
            return "Nest Development Service Endpoint CA";
        if (weaveCertId == 0x18B430EEEE000004ULL)
            return "Nest Development Firmware Signing CA";
        return NULL;
    case kOID_AttributeType_WeaveDeviceId:
        return "Device";
    case kOID_AttributeType_WeaveServiceEndpointId:
        if (weaveCertId == 0x18B4300200000001ULL)
            return "Nest Directory Endpoint";
        if (weaveCertId == 0x18B4300200000002ULL)
            return "Nest Software Update Endpoint";
        if (weaveCertId == 0x18B4300200000003ULL)
            return "Nest Data Management Endpoint";
        if (weaveCertId == 0x18B4300200000004ULL)
            return "Nest Log Upload Endpoint";
        if (weaveCertId == 0x18B4300200000005ULL)
            return "Nest Time Service Endpoint";
        if (weaveCertId == 0x18B4300200000010ULL)
            return "Nest Service Provisioning Endpoint";
        if (weaveCertId == 0x18B4300200000011ULL)
            return "Nest Weave Tunnel Endpoint";
        if (weaveCertId == 0x18B4300200000012ULL)
            return "Nest Service Router Endpoint";
        if (weaveCertId == 0x18B4300200000013ULL)
            return "Nest File Download Endpoint";
        if (weaveCertId == 0x18B4300200000014ULL)
            return "Nest Bastion Service Endpoint";
        return NULL;
    case kOID_AttributeType_WeaveSoftwarePublisherId:
        if (weaveCertId == 0x18B4300301000001ULL)
            return "Nest Production Firmware Signing";
        if (weaveCertId == 0x18B4300302000001ULL)
            return "Nest Development Firmware Signing";
    default:
        return NULL;
    }
}

#endif // WEAVE_CONFIG_ENABLE_SECURITY_DEBUG_FUNCS

} // namespace Security
} // namespace Profiles
} // namespace Weave
} // namespace nl