/*

 * Copyright 1997-2009 Sun Microsystems, Inc.  All Rights Reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Sun designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Sun in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,

 * CA 95054 USA or visit www.sun.com if you need additional information or

 * have any questions.

 */

package sun.security.tools;

import java.io.*;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.MessageDigest;

import java.security.Key;

import java.security.PublicKey;

import java.security.PrivateKey;

import java.security.Security;

import java.security.Signature;

import java.security.UnrecoverableEntryException;

import java.security.UnrecoverableKeyException;

import java.security.Principal;

import java.security.Provider;

import java.security.Identity;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.cert.X509Certificate;

import java.security.cert.CertificateException;

import java.text.Collator;

import java.text.MessageFormat;

import java.util.*;

import java.lang.reflect.Constructor;

import java.net.URL;

import java.net.URLClassLoader;

import sun.misc.BASE64Encoder;

import sun.security.util.ObjectIdentifier;

import sun.security.pkcs.PKCS10;

import sun.security.provider.IdentityDatabase;

import sun.security.provider.SystemSigner;

import sun.security.provider.SystemIdentity;

import sun.security.provider.X509Factory;

import sun.security.util.DerOutputStream;

import sun.security.util.Password;

import sun.security.util.PathList;

import javax.crypto.KeyGenerator;

import javax.crypto.SecretKey;

import javax.net.ssl.HostnameVerifier;

import javax.net.ssl.HttpsURLConnection;

import javax.net.ssl.SSLContext;

import javax.net.ssl.SSLSession;

import javax.net.ssl.TrustManager;

import javax.net.ssl.X509TrustManager;

import sun.misc.BASE64Decoder;

import sun.security.pkcs.PKCS10Attribute;

import sun.security.pkcs.PKCS9Attribute;

import sun.security.util.DerValue;

import sun.security.x509.*;

import static java.security.KeyStore.*;

/**

 * This tool manages keystores.

 *

 * @author Jan Luehe

 *

 *

 * @see java.security.KeyStore

 * @see sun.security.provider.KeyProtector

 * @see sun.security.provider.JavaKeyStore

 *

 * @since 1.2

 */

public final class KeyTool {

    private boolean debug = false;

    private int command = -1;

    private String sigAlgName = null;

    private String keyAlgName = null;

    private boolean verbose = false;

    private int keysize = -1;

    private boolean rfc = false;

    private long validity = (long)90;

    private String alias = null;

    private String dname = null;

    private String dest = null;

    private String filename = null;

    private String infilename = null;

    private String outfilename = null;

    private String srcksfname = null;

    // User-specified providers are added before any command is called.

    // However, they are not removed before the end of the main() method.

    // If you're calling KeyTool.main() directly in your own Java program,

    // please programtically add any providers you need and do not specify

    // them through the command line.

    private Set<Pair <String, String>> providers = null;

    private String storetype = null;

    private String srcProviderName = null;

    private String providerName = null;

    private String pathlist = null;

    private char[] storePass = null;

    private char[] storePassNew = null;

    private char[] keyPass = null;

    private char[] keyPassNew = null;

    private char[] newPass = null;

    private char[] destKeyPass = null;

    private char[] srckeyPass = null;

    private String ksfname = null;

    private File ksfile = null;

    private InputStream ksStream = null; // keystore stream

    private String sslserver = null;

    private KeyStore keyStore = null;

    private boolean token = false;

    private boolean nullStream = false;

    private boolean kssave = false;

    private boolean noprompt = false;

    private boolean trustcacerts = false;

    private boolean protectedPath = false;

    private boolean srcprotectedPath = false;

    private CertificateFactory cf = null;

    private KeyStore caks = null; // "cacerts" keystore

    private char[] srcstorePass = null;

    private String srcstoretype = null;

    private Set<char[]> passwords = new HashSet<char[]> ();

    private String startDate = null;

    private List <String> v3ext = new ArrayList <String> ();

    private static final int CERTREQ = 1;

    private static final int CHANGEALIAS = 2;

    private static final int DELETE = 3;

    private static final int EXPORTCERT = 4;

    private static final int GENKEYPAIR = 5;

    private static final int GENSECKEY = 6;

    // there is no HELP

    private static final int IDENTITYDB = 7;

    private static final int IMPORTCERT = 8;

    private static final int IMPORTKEYSTORE = 9;

    private static final int KEYCLONE = 10;

    private static final int KEYPASSWD = 11;

    private static final int LIST = 12;

    private static final int PRINTCERT = 13;

    private static final int SELFCERT = 14;

    private static final int STOREPASSWD = 15;

    private static final int GENCERT = 16;

    private static final int PRINTCERTREQ = 17;

    private static final Class[] PARAM_STRING = { String.class };

    private static final String JKS = "jks";

    private static final String NONE = "NONE";

    private static final String P11KEYSTORE = "PKCS11";

    private static final String P12KEYSTORE = "PKCS12";

    private final String keyAlias = "mykey";

    // for i18n

    private static final java.util.ResourceBundle rb =

        java.util.ResourceBundle.getBundle("sun.security.util.Resources");

    private static final Collator collator = Collator.getInstance();

    static {

        // this is for case insensitive string comparisons

        collator.setStrength(Collator.PRIMARY);

    };

    private KeyTool() { }

    public static void main(String[] args) throws Exception {

        KeyTool kt = new KeyTool();

        kt.run(args, System.out);

    }

    private void run(String[] args, PrintStream out) throws Exception {

        try {

            parseArgs(args);

            if (command != -1) {

                doCommands(out);

            }

        } catch (Exception e) {

            System.out.println(rb.getString("keytool error: ") + e);

            if (verbose) {

                e.printStackTrace(System.out);

            }

            if (!debug) {

                System.exit(1);

            } else {

                throw e;

            }

        } finally {

            for (char[] pass : passwords) {

                if (pass != null) {

                    Arrays.fill(pass, ' ');

                    pass = null;

                }

            }

            if (ksStream != null) {

                ksStream.close();

            }

        }

    }

    /**

     * Parse command line arguments.

     */

    void parseArgs(String[] args) {

        if (args.length == 0) {

            usage();

            return;

        }

        int i=0;

        for (i=0; (i < args.length) && args[i].startsWith("-"); i++) {

            String flags = args[i];

            /*

             * command modes

             */

            if (collator.compare(flags, "-certreq") == 0) {

                command = CERTREQ;

            } else if (collator.compare(flags, "-delete") == 0) {

                command = DELETE;

            } else if (collator.compare(flags, "-export") == 0 ||

                    collator.compare(flags, "-exportcert") == 0) {

                command = EXPORTCERT;

            } else if (collator.compare(flags, "-genkey") == 0 ||

                    collator.compare(flags, "-genkeypair") == 0) {

                command = GENKEYPAIR;

            } else if (collator.compare(flags, "-help") == 0) {

                usage();

                return;

            } else if (collator.compare(flags, "-identitydb") == 0) { // obsolete

                command = IDENTITYDB;

            } else if (collator.compare(flags, "-import") == 0 ||

                    collator.compare(flags, "-importcert") == 0) {

                command = IMPORTCERT;

            } else if (collator.compare(flags, "-keyclone") == 0) { // obsolete

                command = KEYCLONE;

            } else if (collator.compare(flags, "-changealias") == 0) {

                command = CHANGEALIAS;

            } else if (collator.compare(flags, "-keypasswd") == 0) {

                command = KEYPASSWD;

            } else if (collator.compare(flags, "-list") == 0) {

                command = LIST;

            } else if (collator.compare(flags, "-printcert") == 0) {

                command = PRINTCERT;

            } else if (collator.compare(flags, "-selfcert") == 0) {     // obsolete

                command = SELFCERT;

            } else if (collator.compare(flags, "-storepasswd") == 0) {

                command = STOREPASSWD;

            } else if (collator.compare(flags, "-importkeystore") == 0) {

                command = IMPORTKEYSTORE;

            } else if (collator.compare(flags, "-genseckey") == 0) {

                command = GENSECKEY;

            } else if (collator.compare(flags, "-gencert") == 0) {

                command = GENCERT;

            } else if (collator.compare(flags, "-printcertreq") == 0) {

                command = PRINTCERTREQ;

            }

            /*

             * specifiers

             */

            else if (collator.compare(flags, "-keystore") == 0 ||

                    collator.compare(flags, "-destkeystore") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                ksfname = args[i];

            } else if (collator.compare(flags, "-storepass") == 0 ||

                    collator.compare(flags, "-deststorepass") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                storePass = args[i].toCharArray();

                passwords.add(storePass);

            } else if (collator.compare(flags, "-storetype") == 0 ||

                    collator.compare(flags, "-deststoretype") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                storetype = args[i];

            } else if (collator.compare(flags, "-srcstorepass") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                srcstorePass = args[i].toCharArray();

                passwords.add(srcstorePass);

            } else if (collator.compare(flags, "-srcstoretype") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                srcstoretype = args[i];

            } else if (collator.compare(flags, "-srckeypass") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                srckeyPass = args[i].toCharArray();

                passwords.add(srckeyPass);

            } else if (collator.compare(flags, "-srcprovidername") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                srcProviderName = args[i];

            } else if (collator.compare(flags, "-providername") == 0 ||

                    collator.compare(flags, "-destprovidername") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                providerName = args[i];

            } else if (collator.compare(flags, "-providerpath") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                pathlist = args[i];

            } else if (collator.compare(flags, "-keypass") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                keyPass = args[i].toCharArray();

                passwords.add(keyPass);

            } else if (collator.compare(flags, "-new") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                newPass = args[i].toCharArray();

                passwords.add(newPass);

            } else if (collator.compare(flags, "-destkeypass") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                destKeyPass = args[i].toCharArray();

                passwords.add(destKeyPass);

            } else if (collator.compare(flags, "-alias") == 0 ||

                    collator.compare(flags, "-srcalias") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                alias = args[i];

            } else if (collator.compare(flags, "-dest") == 0 ||

                    collator.compare(flags, "-destalias") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                dest = args[i];

            } else if (collator.compare(flags, "-dname") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                dname = args[i];

            } else if (collator.compare(flags, "-keysize") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                keysize = Integer.parseInt(args[i]);

            } else if (collator.compare(flags, "-keyalg") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                keyAlgName = args[i];

            } else if (collator.compare(flags, "-sigalg") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                sigAlgName = args[i];

            } else if (collator.compare(flags, "-startdate") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                startDate = args[i];

            } else if (collator.compare(flags, "-validity") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                validity = Long.parseLong(args[i]);

            } else if (collator.compare(flags, "-ext") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                v3ext.add(args[i]);

            } else if (collator.compare(flags, "-file") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                filename = args[i];

            } else if (collator.compare(flags, "-infile") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                infilename = args[i];

            } else if (collator.compare(flags, "-outfile") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                outfilename = args[i];

            } else if (collator.compare(flags, "-sslserver") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                sslserver = args[i];

            } else if (collator.compare(flags, "-srckeystore") == 0) {

                if (++i == args.length) errorNeedArgument(flags);

                srcksfname = args[i];

            } else if ((collator.compare(flags, "-provider") == 0) ||

                        (collator.compare(flags, "-providerclass") == 0)) {

                if (++i == args.length) errorNeedArgument(flags);

                if (providers == null) {

                    providers = new HashSet<Pair <String, String>> (3);

                }

                String providerClass = args[i];

                String providerArg = null;

                if (args.length > (i+1)) {

                    flags = args[i+1];

                    if (collator.compare(flags, "-providerarg") == 0) {

                        if (args.length == (i+2)) errorNeedArgument(flags);

                        providerArg = args[i+2];

                        i += 2;

                    }

                }

                providers.add(

                        Pair.of(providerClass, providerArg));

            }

            /*

             * options

             */

            else if (collator.compare(flags, "-v") == 0) {

                verbose = true;

            } else if (collator.compare(flags, "-debug") == 0) {

                debug = true;

            } else if (collator.compare(flags, "-rfc") == 0) {

                rfc = true;

            } else if (collator.compare(flags, "-noprompt") == 0) {

                noprompt = true;

            } else if (collator.compare(flags, "-trustcacerts") == 0) {

                trustcacerts = true;

            } else if (collator.compare(flags, "-protected") == 0 ||

                    collator.compare(flags, "-destprotected") == 0) {

                protectedPath = true;

            } else if (collator.compare(flags, "-srcprotected") == 0) {

                srcprotectedPath = true;

            } else  {

                System.err.println(rb.getString("Illegal option:  ") + flags);

                tinyHelp();

            }

        }

        if (i<args.length) {

            MessageFormat form = new MessageFormat

                (rb.getString("Usage error, <arg> is not a legal command"));

            Object[] source = {args[i]};

            throw new RuntimeException(form.format(source));

        }

        if (command == -1) {

            System.err.println(rb.getString("Usage error: no command provided"));

            tinyHelp();

        }

    }

    boolean isKeyStoreRelated(int cmd) {

        return cmd != PRINTCERT && cmd != PRINTCERTREQ;

    }

    /**

     * Execute the commands.

     */

    void doCommands(PrintStream out) throws Exception {

        if (storetype == null) {

            storetype = KeyStore.getDefaultType();

        }

        storetype = KeyStoreUtil.niceStoreTypeName(storetype);

        if (srcstoretype == null) {

            srcstoretype = KeyStore.getDefaultType();

        }

        srcstoretype = KeyStoreUtil.niceStoreTypeName(srcstoretype);

        if (P11KEYSTORE.equalsIgnoreCase(storetype) ||

                KeyStoreUtil.isWindowsKeyStore(storetype)) {

            token = true;

            if (ksfname == null) {

                ksfname = NONE;

            }

        }

        if (NONE.equals(ksfname)) {

            nullStream = true;

        }

        if (token && !nullStream) {

            System.err.println(MessageFormat.format(rb.getString

                ("-keystore must be NONE if -storetype is {0}"), storetype));

            System.err.println();

            tinyHelp();

        }

        if (token &&

            (command == KEYPASSWD || command == STOREPASSWD)) {

            throw new UnsupportedOperationException(MessageFormat.format(rb.getString

                        ("-storepasswd and -keypasswd commands not supported " +

                        "if -storetype is {0}"), storetype));

        }

        if (P12KEYSTORE.equalsIgnoreCase(storetype) && command == KEYPASSWD) {

            throw new UnsupportedOperationException(rb.getString

                        ("-keypasswd commands not supported " +

                        "if -storetype is PKCS12"));

        }

        if (token && (keyPass != null || newPass != null || destKeyPass != null)) {

            throw new IllegalArgumentException(MessageFormat.format(rb.getString

                ("-keypass and -new " +

                "can not be specified if -storetype is {0}"), storetype));

        }

        if (protectedPath) {

            if (storePass != null || keyPass != null ||

                    newPass != null || destKeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if -protected is specified, " +

                        "then -storepass, -keypass, and -new " +

                        "must not be specified"));

            }

        }

        if (srcprotectedPath) {

            if (srcstorePass != null || srckeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if -srcprotected is specified, " +

                        "then -srcstorepass and -srckeypass " +

                        "must not be specified"));

            }

        }

        if (KeyStoreUtil.isWindowsKeyStore(storetype)) {

            if (storePass != null || keyPass != null ||

                    newPass != null || destKeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if keystore is not password protected, " +

                        "then -storepass, -keypass, and -new " +

                        "must not be specified"));

            }

        }

        if (KeyStoreUtil.isWindowsKeyStore(srcstoretype)) {

            if (srcstorePass != null || srckeyPass != null) {

                throw new IllegalArgumentException(rb.getString

                        ("if source keystore is not password protected, " +

                        "then -srcstorepass and -srckeypass " +

                        "must not be specified"));

            }