/*

 * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.tools.keytool;

import java.io.*;

import java.security.CodeSigner;

import java.security.CryptoPrimitive;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.MessageDigest;

import java.security.Key;

import java.security.PublicKey;

import java.security.PrivateKey;

import java.security.Signature;

import java.security.Timestamp;

import java.security.UnrecoverableEntryException;

import java.security.UnrecoverableKeyException;

import java.security.Principal;

import java.security.cert.Certificate;

import java.security.cert.CertificateFactory;

import java.security.cert.CertStoreException;

import java.security.cert.CRL;

import java.security.cert.X509Certificate;

import java.security.cert.CertificateException;

import java.security.cert.URICertStoreParameters;

import java.text.Collator;

import java.text.MessageFormat;

import java.util.*;

import java.util.jar.JarEntry;

import java.util.jar.JarFile;

import java.math.BigInteger;

import java.net.URI;

import java.net.URL;

import java.net.URLClassLoader;

import java.security.cert.CertStore;

import java.security.cert.X509CRL;

import java.security.cert.X509CRLEntry;

import java.security.cert.X509CRLSelector;

import javax.security.auth.x500.X500Principal;

import java.util.Base64;

import sun.security.util.KeyUtil;

import sun.security.util.ObjectIdentifier;

import sun.security.pkcs10.PKCS10;

import sun.security.pkcs10.PKCS10Attribute;

import sun.security.provider.X509Factory;

import sun.security.provider.certpath.ssl.SSLServerCertStore;

import sun.security.util.Password;

import javax.crypto.KeyGenerator;

import javax.crypto.SecretKey;

import javax.crypto.SecretKeyFactory;

import javax.crypto.spec.PBEKeySpec;

import sun.security.pkcs.PKCS9Attribute;

import sun.security.tools.KeyStoreUtil;

import sun.security.tools.PathList;

import sun.security.util.DerValue;

import sun.security.util.Pem;

import sun.security.x509.*;

import static java.security.KeyStore.*;

import java.security.Security;

import static sun.security.tools.keytool.Main.Command.*;

import static sun.security.tools.keytool.Main.Option.*;

import sun.security.util.DisabledAlgorithmConstraints;

/**

 * This tool manages keystores.

 *

 * @author Jan Luehe

 *

 *

 * @see java.security.KeyStore

 * @see sun.security.provider.KeyProtector

 * @see sun.security.provider.JavaKeyStore

 *

 * @since 1.2

 */

public final class Main {

    private static final byte[] CRLF = new byte[] {'\r', '\n'};

    private boolean debug = false;

    private Command command = null;

    private String sigAlgName = null;

    private String keyAlgName = null;

    private boolean verbose = false;

    private int keysize = -1;

    private boolean rfc = false;

    private long validity = (long)90;

    private String alias = null;

    private String dname = null;

    private String dest = null;

    private String filename = null;

    private String infilename = null;

    private String outfilename = null;

    private String srcksfname = null;

    // User-specified providers are added before any command is called.

    // However, they are not removed before the end of the main() method.

    // If you're calling KeyTool.main() directly in your own Java program,

    // please programtically add any providers you need and do not specify

    // them through the command line.

    private Set<Pair <String, String>> providers = null;

    private Set<Pair <String, String>> providerClasses = null;

    private String storetype = null;

    private boolean hasStoretypeOption = false;

    private boolean hasSrcStoretypeOption = false;

    private String srcProviderName = null;

    private String providerName = null;

    private String pathlist = null;

    private char[] storePass = null;

    private char[] storePassNew = null;

    private char[] keyPass = null;

    private char[] keyPassNew = null;

    private char[] newPass = null;

    private char[] destKeyPass = null;

    private char[] srckeyPass = null;

    private String ksfname = null;

    private File ksfile = null;

    private InputStream ksStream = null; // keystore stream

    private String sslserver = null;

    private String jarfile = null;

    private KeyStore keyStore = null;

    private boolean token = false;

    private boolean nullStream = false;

    private boolean kssave = false;

    private boolean noprompt = false;

    private boolean trustcacerts = false;

    private boolean protectedPath = false;

    private boolean srcprotectedPath = false;

    private boolean cacerts = false;

    private boolean nowarn = false;

    private CertificateFactory cf = null;

    private KeyStore caks = null; // "cacerts" keystore

    private char[] srcstorePass = null;

    private String srcstoretype = null;

    private Set<char[]> passwords = new HashSet<>();

    private String startDate = null;

    private List<String> ids = new ArrayList<>();   // used in GENCRL

    private List<String> v3ext = new ArrayList<>();

    // Warnings on weak algorithms

    private List<String> weakWarnings = new ArrayList<>();

    private static final DisabledAlgorithmConstraints DISABLED_CHECK =

            new DisabledAlgorithmConstraints(

                    DisabledAlgorithmConstraints.PROPERTY_CERTPATH_DISABLED_ALGS);

    private static final Set<CryptoPrimitive> SIG_PRIMITIVE_SET = Collections

            .unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE));

    enum Command {

        CERTREQ("Generates.a.certificate.request",

            ALIAS, SIGALG, FILEOUT, KEYPASS, KEYSTORE, DNAME,

            EXT, STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        CHANGEALIAS("Changes.an.entry.s.alias",

            ALIAS, DESTALIAS, KEYPASS, KEYSTORE, CACERTS, STOREPASS,

            STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        DELETE("Deletes.an.entry",

            ALIAS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,

            PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        EXPORTCERT("Exports.certificate",

            RFC, ALIAS, FILEOUT, KEYSTORE, CACERTS, STOREPASS,

            STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        GENKEYPAIR("Generates.a.key.pair",

            ALIAS, KEYALG, KEYSIZE, SIGALG, DESTALIAS, DNAME,

            STARTDATE, EXT, VALIDITY, KEYPASS, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        GENSECKEY("Generates.a.secret.key",

            ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        GENCERT("Generates.certificate.from.a.certificate.request",

            RFC, INFILE, OUTFILE, ALIAS, SIGALG, DNAME,

            STARTDATE, EXT, VALIDITY, KEYPASS, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        IMPORTCERT("Imports.a.certificate.or.a.certificate.chain",

            NOPROMPT, TRUSTCACERTS, PROTECTED, ALIAS, FILEIN,

            KEYPASS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,

            PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V),

        IMPORTPASS("Imports.a.password",

            ALIAS, KEYPASS, KEYALG, KEYSIZE, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        IMPORTKEYSTORE("Imports.one.or.all.entries.from.another.keystore",

            SRCKEYSTORE, DESTKEYSTORE, SRCSTORETYPE,

            DESTSTORETYPE, SRCSTOREPASS, DESTSTOREPASS,

            SRCPROTECTED, DESTPROTECTED, SRCPROVIDERNAME, DESTPROVIDERNAME,

            SRCALIAS, DESTALIAS, SRCKEYPASS, DESTKEYPASS,

            NOPROMPT, ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH,

            V),

        KEYPASSWD("Changes.the.key.password.of.an.entry",

            ALIAS, KEYPASS, NEW, KEYSTORE, STOREPASS,

            STORETYPE, PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V),

        LIST("Lists.entries.in.a.keystore",

            RFC, ALIAS, KEYSTORE, CACERTS, STOREPASS, STORETYPE,

            PROVIDERNAME, ADDPROVIDER, PROVIDERCLASS,

            PROVIDERPATH, V, PROTECTED),

        PRINTCERT("Prints.the.content.of.a.certificate",

            RFC, FILEIN, SSLSERVER, JARFILE, V),

        PRINTCERTREQ("Prints.the.content.of.a.certificate.request",

            FILEIN, V),

        PRINTCRL("Prints.the.content.of.a.CRL.file",

            FILEIN, V),

        STOREPASSWD("Changes.the.store.password.of.a.keystore",

            NEW, KEYSTORE, CACERTS, STOREPASS, STORETYPE, PROVIDERNAME,

            ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),

        // Undocumented start here, KEYCLONE is used a marker in -help;

        KEYCLONE("Clones.a.key.entry",

            ALIAS, DESTALIAS, KEYPASS, NEW, STORETYPE,

            KEYSTORE, STOREPASS, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V),

        SELFCERT("Generates.a.self.signed.certificate",

            ALIAS, SIGALG, DNAME, STARTDATE, EXT, VALIDITY, KEYPASS,

            STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,

            ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V),

        GENCRL("Generates.CRL",

            RFC, FILEOUT, ID,

            ALIAS, SIGALG, KEYPASS, KEYSTORE,

            STOREPASS, STORETYPE, PROVIDERNAME, ADDPROVIDER,

            PROVIDERCLASS, PROVIDERPATH, V, PROTECTED),

        IDENTITYDB("Imports.entries.from.a.JDK.1.1.x.style.identity.database",

            FILEIN, STORETYPE, KEYSTORE, STOREPASS, PROVIDERNAME,

            ADDPROVIDER, PROVIDERCLASS, PROVIDERPATH, V);

        final String description;

        final Option[] options;

        final String name;

        String altName;     // "genkey" is altName for "genkeypair"

        Command(String d, Option... o) {

            description = d;

            options = o;

            name = "-" + name().toLowerCase(Locale.ENGLISH);

        }

        @Override

        public String toString() {

            return name;

        }

        public String getAltName() {

            return altName;

        }

        public void setAltName(String altName) {

            this.altName = altName;

        }

        public static Command getCommand(String cmd) {

            for (Command c: Command.values()) {

                if (collator.compare(cmd, c.name) == 0

                        || (c.altName != null

                            && collator.compare(cmd, c.altName) == 0)) {

                    return c;

                }

            }

            return null;

        }

    };

    static {

        Command.GENKEYPAIR.setAltName("-genkey");

        Command.IMPORTCERT.setAltName("-import");

        Command.EXPORTCERT.setAltName("-export");

        Command.IMPORTPASS.setAltName("-importpassword");

    }

    // If an option is allowed multiple times, remember to record it

    // in the optionsSet.contains() block in parseArgs().

    enum Option {

        ALIAS("alias", "<alias>", "alias.name.of.the.entry.to.process"),

        DESTALIAS("destalias", "<alias>", "destination.alias"),

        DESTKEYPASS("destkeypass", "<arg>", "destination.key.password"),

        DESTKEYSTORE("destkeystore", "<keystore>", "destination.keystore.name"),

        DESTPROTECTED("destprotected", null, "destination.keystore.password.protected"),

        DESTPROVIDERNAME("destprovidername", "<name>", "destination.keystore.provider.name"),

        DESTSTOREPASS("deststorepass", "<arg>", "destination.keystore.password"),

        DESTSTORETYPE("deststoretype", "<type>", "destination.keystore.type"),

        DNAME("dname", "<name>", "distinguished.name"),

        EXT("ext", "<value>", "X.509.extension"),

        FILEOUT("file", "<file>", "output.file.name"),

        FILEIN("file", "<file>", "input.file.name"),

        ID("id", "<id:reason>", "Serial.ID.of.cert.to.revoke"),

        INFILE("infile", "<file>", "input.file.name"),

        KEYALG("keyalg", "<alg>", "key.algorithm.name"),

        KEYPASS("keypass", "<arg>", "key.password"),

        KEYSIZE("keysize", "<size>", "key.bit.size"),

        KEYSTORE("keystore", "<keystore>", "keystore.name"),

        CACERTS("cacerts", null, "access.the.cacerts.keystore"),

        NEW("new", "<arg>", "new.password"),

        NOPROMPT("noprompt", null, "do.not.prompt"),

        OUTFILE("outfile", "<file>", "output.file.name"),

        PROTECTED("protected", null, "password.through.protected.mechanism"),

        PROVIDERCLASS("providerclass", "<class>\n[-providerarg <arg>]", "provider.class.option"),

        ADDPROVIDER("addprovider", "<name>\n[-providerarg <arg>]", "addprovider.option"),

        PROVIDERNAME("providername", "<name>", "provider.name"),

        PROVIDERPATH("providerpath", "<list>", "provider.classpath"),

        RFC("rfc", null, "output.in.RFC.style"),

        SIGALG("sigalg", "<alg>", "signature.algorithm.name"),

        SRCALIAS("srcalias", "<alias>", "source.alias"),

        SRCKEYPASS("srckeypass", "<arg>", "source.key.password"),

        SRCKEYSTORE("srckeystore", "<keystore>", "source.keystore.name"),

        SRCPROTECTED("srcprotected", null, "source.keystore.password.protected"),

        SRCPROVIDERNAME("srcprovidername", "<name>", "source.keystore.provider.name"),

        SRCSTOREPASS("srcstorepass", "<arg>", "source.keystore.password"),

        SRCSTORETYPE("srcstoretype", "<type>", "source.keystore.type"),

        SSLSERVER("sslserver", "<server[:port]>", "SSL.server.host.and.port"),

        JARFILE("jarfile", "<file>", "signed.jar.file"),

        STARTDATE("startdate", "<date>", "certificate.validity.start.date.time"),

        STOREPASS("storepass", "<arg>", "keystore.password"),

        STORETYPE("storetype", "<type>", "keystore.type"),

        TRUSTCACERTS("trustcacerts", null, "trust.certificates.from.cacerts"),

        V("v", null, "verbose.output"),

        VALIDITY("validity", "<days>", "validity.number.of.days");

        final String name, arg, description;

        Option(String name, String arg, String description) {

            this.name = name;

            this.arg = arg;

            this.description = description;

        }

        @Override

        public String toString() {

            return "-" + name;

        }

    };

    private static final String NONE = "NONE";

    private static final String P11KEYSTORE = "PKCS11";

    private static final String P12KEYSTORE = "PKCS12";

    private static final String keyAlias = "mykey";

    // for i18n

    private static final java.util.ResourceBundle rb =

        java.util.ResourceBundle.getBundle(

            "sun.security.tools.keytool.Resources");

    private static final Collator collator = Collator.getInstance();

    static {

        // this is for case insensitive string comparisons

        collator.setStrength(Collator.PRIMARY);

    };

    private Main() { }

    public static void main(String[] args) throws Exception {

        Main kt = new Main();

        kt.run(args, System.out);

    }

    private void run(String[] args, PrintStream out) throws Exception {

        try {

            args = parseArgs(args);

            if (command != null) {

                doCommands(out);

            }

        } catch (Exception e) {

            System.out.println(rb.getString("keytool.error.") + e);

            if (verbose) {

                e.printStackTrace(System.out);

            }

            if (!debug) {

                System.exit(1);

            } else {

                throw e;

            }

        } finally {

            printWeakWarnings(false);

            for (char[] pass : passwords) {

                if (pass != null) {

                    Arrays.fill(pass, ' ');

                    pass = null;

                }

            }

            if (ksStream != null) {

                ksStream.close();

            }

        }

    }

    /**

     * Parse command line arguments.

     */

    String[] parseArgs(String[] args) throws Exception {

        int i=0;

        boolean help = args.length == 0;

        String confFile = null;

        // Records all commands and options set. Used to check dups.

        Set<String> optionsSet = new HashSet<>();

        for (i=0; i < args.length; i++) {

            String flags = args[i];

            if (flags.startsWith("-")) {

                String lowerFlags = flags.toLowerCase(Locale.ROOT);

                if (optionsSet.contains(lowerFlags)) {

                    switch (lowerFlags) {

                        case "-ext":

                        case "-id":

                        case "-provider":

                        case "-addprovider":

                        case "-providerclass":

                        case "-providerarg":

                            // These options are allowed multiple times

                            break;

                        default:

                            weakWarnings.add(String.format(

                                    rb.getString("option.1.set.twice"),

                                    lowerFlags));

                    }

                } else {

                    optionsSet.add(lowerFlags);

                }

                if (collator.compare(flags, "-conf") == 0) {

                    if (i == args.length - 1) {

                        errorNeedArgument(flags);

                    }

                    confFile = args[++i];

                } else {

                    Command c = Command.getCommand(flags);

                    if (c != null) {

                        if (command == null) {

                            command = c;

                        } else {

                            throw new Exception(String.format(

                                    rb.getString("multiple.commands.1.2"),

                                    command.name, c.name));

                        }

                    }

                }

            }

        }

        if (confFile != null && command != null) {

            args = KeyStoreUtil.expandArgs("keytool", confFile,

                    command.toString(),

                    command.getAltName(), args);

        }

        debug = Arrays.stream(args).anyMatch(

                x -> collator.compare(x, "-debug") == 0);

        if (debug) {

            // No need to localize debug output

            System.out.println("Command line args: " +

                    Arrays.toString(args));

        }

        for (i=0; (i < args.length) && args[i].startsWith("-"); i++) {

            String flags = args[i];

            // Check if the last option needs an arg