/*

 * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package com.oracle.security.ucrypto;

import java.util.Arrays;

import java.util.WeakHashMap;

import java.util.Collections;

import java.util.Map;

import java.security.AlgorithmParameters;

import java.security.InvalidAlgorithmParameterException;

import java.security.InvalidKeyException;

import java.security.Key;

import java.security.PublicKey;

import java.security.PrivateKey;

import java.security.spec.RSAPrivateCrtKeySpec;

import java.security.spec.RSAPublicKeySpec;

import java.security.interfaces.RSAKey;

import java.security.interfaces.RSAPrivateCrtKey;

import java.security.interfaces.RSAPublicKey;

import java.security.KeyFactory;

import java.security.NoSuchAlgorithmException;

import java.security.SecureRandom;

import java.security.spec.AlgorithmParameterSpec;

import java.security.spec.InvalidParameterSpecException;

import java.security.spec.InvalidKeySpecException;

import javax.crypto.BadPaddingException;

import javax.crypto.Cipher;

import javax.crypto.CipherSpi;

import javax.crypto.SecretKey;

import javax.crypto.IllegalBlockSizeException;

import javax.crypto.NoSuchPaddingException;

import javax.crypto.ShortBufferException;

import javax.crypto.spec.SecretKeySpec;

import sun.security.internal.spec.TlsRsaPremasterSecretParameterSpec;

import sun.security.util.KeyUtil;

/**

 * Asymmetric Cipher wrapper class utilizing ucrypto APIs. This class

 * currently supports

 * - RSA/ECB/NOPADDING

 * - RSA/ECB/PKCS1PADDING

 *

 * @since 1.9

 */

public class NativeRSACipher extends CipherSpi {

    // fields set in constructor

    private final UcryptoMech mech;

    private final int padLen;

    private final NativeRSAKeyFactory keyFactory;

    private AlgorithmParameterSpec spec;

    private SecureRandom random;

    // Keep a cache of RSA keys and their RSA NativeKey for reuse.

    // When the RSA key is gc'ed, we let NativeKey phatom references cleanup

    // the native allocation

    private static final Map<Key, NativeKey> keyList =

            Collections.synchronizedMap(new WeakHashMap<Key, NativeKey>());

    //

    // fields (re)set in every init()

    //

    private NativeKey key = null;

    private int outputSize = 0; // e.g. modulus size in bytes

    private boolean encrypt = true;

    private byte[] buffer;

    private int bufOfs = 0;

    // public implementation classes

    public static final class NoPadding extends NativeRSACipher {

        public NoPadding() throws NoSuchAlgorithmException {

            super(UcryptoMech.CRYPTO_RSA_X_509, 0);

        }

    }

    public static final class PKCS1Padding extends NativeRSACipher {

        public PKCS1Padding() throws NoSuchAlgorithmException {

            super(UcryptoMech.CRYPTO_RSA_PKCS, 11);

        }

    }

    NativeRSACipher(UcryptoMech mech, int padLen)

        throws NoSuchAlgorithmException {

        this.mech = mech;

        this.padLen = padLen;

        this.keyFactory = new NativeRSAKeyFactory();

    }

    @Override

    protected void engineSetMode(String mode) throws NoSuchAlgorithmException {

        // Disallow change of mode for now since currently it's explicitly

        // defined in transformation strings

        throw new NoSuchAlgorithmException("Unsupported mode " + mode);

    }

    // see JCE spec

    @Override

    protected void engineSetPadding(String padding)

            throws NoSuchPaddingException {

        // Disallow change of padding for now since currently it's explicitly

        // defined in transformation strings

        throw new NoSuchPaddingException("Unsupported padding " + padding);

    }

    // see JCE spec

    @Override

    protected int engineGetBlockSize() {

        return 0;

    }

    // see JCE spec

    @Override

    protected synchronized int engineGetOutputSize(int inputLen) {

        return outputSize;

    }

    // see JCE spec

    @Override

    protected byte[] engineGetIV() {

        return null;

    }

    // see JCE spec

    @Override

    protected AlgorithmParameters engineGetParameters() {

        return null;

    }

    @Override

    protected int engineGetKeySize(Key key) throws InvalidKeyException {

        if (!(key instanceof RSAKey)) {

            throw new InvalidKeyException("RSAKey required");

        }

        int n = ((RSAKey)key).getModulus().bitLength();

        // strip off the leading extra 0x00 byte prefix

        int realByteSize = (n + 7) >> 3;

        return realByteSize * 8;

    }

    // see JCE spec

    @Override

    protected synchronized void engineInit(int opmode, Key key, SecureRandom random)

            throws InvalidKeyException {

        try {

            engineInit(opmode, key, (AlgorithmParameterSpec)null, random);

        } catch (InvalidAlgorithmParameterException e) {

            throw new InvalidKeyException("init() failed", e);

        }

    }

    // see JCE spec

    @Override

    protected synchronized void engineInit(int opmode, Key newKey,

            AlgorithmParameterSpec params, SecureRandom random)

            throws InvalidKeyException, InvalidAlgorithmParameterException {

        if (newKey == null) {

            throw new InvalidKeyException("Key cannot be null");

        }

        if (opmode != Cipher.ENCRYPT_MODE &&

            opmode != Cipher.DECRYPT_MODE &&

            opmode != Cipher.WRAP_MODE &&

            opmode != Cipher.UNWRAP_MODE) {

            throw new InvalidAlgorithmParameterException

                ("Unsupported mode: " + opmode);

        }

        if (params != null) {

            if (!(params instanceof TlsRsaPremasterSecretParameterSpec)) {

                throw new InvalidAlgorithmParameterException(

                        "No Parameters can be specified");

            }

            spec = params;

            this.random = random;   // for TLS RSA premaster secret

        }

        boolean doEncrypt = (opmode == Cipher.ENCRYPT_MODE || opmode == Cipher.WRAP_MODE);

        // Make sure the proper opmode uses the proper key

        if (doEncrypt && (!(newKey instanceof RSAPublicKey))) {

            throw new InvalidKeyException("RSAPublicKey required for encryption");

        } else if (!doEncrypt && (!(newKey instanceof RSAPrivateCrtKey))) {

            throw new InvalidKeyException("RSAPrivateCrtKey required for decryption");

        }

        NativeKey nativeKey = null;

        // Check keyList cache for a nativeKey

        nativeKey = keyList.get(newKey);

        if (nativeKey == null) {

            // With no existing nativeKey for this newKey, create one

            if (doEncrypt) {

                RSAPublicKey publicKey = (RSAPublicKey) newKey;

                try {

                    nativeKey = (NativeKey) keyFactory.engineGeneratePublic

                        (new RSAPublicKeySpec(publicKey.getModulus(), publicKey.getPublicExponent()));

                } catch (InvalidKeySpecException ikse) {

                    throw new InvalidKeyException(ikse);

                }

            } else {

                RSAPrivateCrtKey privateKey = (RSAPrivateCrtKey) newKey;

                try {

                    nativeKey = (NativeKey) keyFactory.engineGeneratePrivate

                        (new RSAPrivateCrtKeySpec(privateKey.getModulus(),

                                                  privateKey.getPublicExponent(),

                                                  privateKey.getPrivateExponent(),

                                                  privateKey.getPrimeP(),

                                                  privateKey.getPrimeQ(),

                                                  privateKey.getPrimeExponentP(),

                                                  privateKey.getPrimeExponentQ(),

                                                  privateKey.getCrtCoefficient()));

                } catch (InvalidKeySpecException ikse) {

                    throw new InvalidKeyException(ikse);

                }

            }

            // Add nativeKey to keyList cache and associate it with newKey

            keyList.put(newKey, nativeKey);

        }

        init(doEncrypt, nativeKey);

    }

    // see JCE spec

    @Override

    protected synchronized void engineInit(int opmode, Key key, AlgorithmParameters params,

            SecureRandom random)

            throws InvalidKeyException, InvalidAlgorithmParameterException {

        if (params != null) {

            throw new InvalidAlgorithmParameterException("No Parameters can be specified");

        }

        engineInit(opmode, key, (AlgorithmParameterSpec) null, random);

    }

    // see JCE spec

    @Override

    protected synchronized byte[] engineUpdate(byte[] in, int inOfs, int inLen) {

        if (inLen > 0) {

            update(in, inOfs, inLen);

        }

        return null;

    }

    // see JCE spec

    @Override

    protected synchronized int engineUpdate(byte[] in, int inOfs, int inLen, byte[] out,

            int outOfs) throws ShortBufferException {

        if (out.length - outOfs < outputSize) {

            throw new ShortBufferException("Output buffer too small");

        }

        if (inLen > 0) {

            update(in, inOfs, inLen);

        }

        return 0;

    }

    // see JCE spec

    @Override

    protected synchronized byte[] engineDoFinal(byte[] in, int inOfs, int inLen)

            throws IllegalBlockSizeException, BadPaddingException {

        byte[] out = new byte[outputSize];

        try {

            // delegate to the other engineDoFinal(...) method

            int actualLen = engineDoFinal(in, inOfs, inLen, out, 0);

            if (actualLen != outputSize) {

                return Arrays.copyOf(out, actualLen);

            } else {

                return out;

            }

        } catch (ShortBufferException e) {

            throw new UcryptoException("Internal Error", e);

        }

    }

    // see JCE spec

    @Override

    protected synchronized int engineDoFinal(byte[] in, int inOfs, int inLen, byte[] out,

                                             int outOfs)

        throws ShortBufferException, IllegalBlockSizeException,

               BadPaddingException {

        if (inLen != 0) {

            update(in, inOfs, inLen);

        }

        return doFinal(out, outOfs, out.length - outOfs);

    }

    // see JCE spec

    @Override

    protected synchronized byte[] engineWrap(Key key) throws IllegalBlockSizeException,

                                                             InvalidKeyException {

        try {

            byte[] encodedKey = key.getEncoded();

            if ((encodedKey == null) || (encodedKey.length == 0)) {

                throw new InvalidKeyException("Cannot get an encoding of " +

                                              "the key to be wrapped");

            }

            if (encodedKey.length > buffer.length) {

                throw new InvalidKeyException("Key is too long for wrapping");

            }

            return engineDoFinal(encodedKey, 0, encodedKey.length);

        } catch (BadPaddingException e) {

            // Should never happen for key wrapping

            throw new UcryptoException("Internal Error", e);

        }

    }

    // see JCE spec

    @Override

    protected synchronized Key engineUnwrap(byte[] wrappedKey,

            String wrappedKeyAlgorithm, int wrappedKeyType)

            throws InvalidKeyException, NoSuchAlgorithmException {

        if (wrappedKey.length > buffer.length) {

            throw new InvalidKeyException("Key is too long for unwrapping");

        }

        boolean isTlsRsaPremasterSecret =

                wrappedKeyAlgorithm.equals("TlsRsaPremasterSecret");

        Exception failover = null;

        byte[] encodedKey = null;

        try {

            encodedKey = engineDoFinal(wrappedKey, 0, wrappedKey.length);

        } catch (BadPaddingException bpe) {

            if (isTlsRsaPremasterSecret) {

                failover = bpe;

            } else {

                throw new InvalidKeyException("Unwrapping failed", bpe);

            }

        } catch (Exception e) {

            throw new InvalidKeyException("Unwrapping failed", e);

        }

        if (isTlsRsaPremasterSecret) {

            if (!(spec instanceof TlsRsaPremasterSecretParameterSpec)) {

                throw new IllegalStateException(

                        "No TlsRsaPremasterSecretParameterSpec specified");

            }

            // polish the TLS premaster secret

            encodedKey = KeyUtil.checkTlsPreMasterSecretKey(

                ((TlsRsaPremasterSecretParameterSpec)spec).getClientVersion(),

                ((TlsRsaPremasterSecretParameterSpec)spec).getServerVersion(),

                random, encodedKey, (failover != null));

        }

        return NativeCipher.constructKey(wrappedKeyType,

                encodedKey, wrappedKeyAlgorithm);

    }

    /**

     * calls ucrypto_encrypt(...) or ucrypto_decrypt(...)

     * @returns the length of output or an negative error status code

     */

    private native static int nativeAtomic(int mech, boolean encrypt,

                                           long keyValue, int keyLength,

                                           byte[] in, int inLen,

                                           byte[] out, int ouOfs, int outLen);

    // do actual initialization

    private void init(boolean encrypt, NativeKey key) {

        this.encrypt = encrypt;

        this.key = key;

        try {

            this.outputSize = engineGetKeySize(key)/8;

        } catch (InvalidKeyException ike) {

            throw new UcryptoException("Internal Error", ike);

        }

        this.buffer = new byte[outputSize];

        this.bufOfs = 0;

    }

    // store the specified input into the internal buffer

    private void update(byte[] in, int inOfs, int inLen) {

        if ((inLen <= 0) || (in == null)) {

            return;

        }

        // buffer bytes internally until doFinal is called

        if ((bufOfs + inLen + (encrypt? padLen:0)) > buffer.length) {

            // lead to IllegalBlockSizeException when doFinal() is called

            bufOfs = buffer.length + 1;

            return;

        }

        System.arraycopy(in, inOfs, buffer, bufOfs, inLen);

        bufOfs += inLen;

    }

    // return the actual non-negative output length

    private int doFinal(byte[] out, int outOfs, int outLen)

            throws ShortBufferException, IllegalBlockSizeException,

            BadPaddingException {

        if (bufOfs > buffer.length) {

            throw new IllegalBlockSizeException(

                "Data must not be longer than " +

                (buffer.length - (encrypt ? padLen : 0)) + " bytes");

        }

        if (outLen < outputSize) {

            throw new ShortBufferException();

        }

        try {

            long keyValue = key.value();

            int k = nativeAtomic(mech.value(), encrypt, keyValue,

                                 key.length(), buffer, bufOfs,

                                 out, outOfs, outLen);

            if (k < 0) {

                if ( k == -16 || k == -64) {

                    // -16: CRYPTO_ENCRYPTED_DATA_INVALID

                    // -64: CKR_ENCRYPTED_DATA_INVALID, see bug 17459266

                    UcryptoException ue = new UcryptoException(16);

                    BadPaddingException bpe =

                        new BadPaddingException("Invalid encryption data");

                    bpe.initCause(ue);

                    throw bpe;

                }

                throw new UcryptoException(-k);

            }

            return k;

        } finally {

            bufOfs = 0;

        }

    }

}