/*

 * Copyright (c) 2003, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

// common infrastructure for SunPKCS11 tests

import java.io.BufferedReader;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.IOException;

import java.io.InputStream;

import java.io.InputStreamReader;

import java.io.StringReader;

import java.nio.charset.StandardCharsets;

import java.nio.file.Files;

import java.nio.file.Path;

import java.nio.file.Paths;

import java.security.AlgorithmParameters;

import java.security.InvalidAlgorithmParameterException;

import java.security.KeyPairGenerator;

import java.security.NoSuchProviderException;

import java.security.Policy;

import java.security.Provider;

import java.security.ProviderException;

import java.security.Security;

import java.security.spec.ECGenParameterSpec;

import java.security.spec.ECParameterSpec;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.HashMap;

import java.util.Iterator;

import java.util.List;

import java.util.Map;

import java.util.Optional;

import java.util.Properties;

import java.util.ServiceConfigurationError;

import java.util.ServiceLoader;

import java.util.Set;

import jdk.test.lib.artifacts.Artifact;

import jdk.test.lib.artifacts.ArtifactResolver;

import jdk.test.lib.artifacts.ArtifactResolverException;

public abstract class PKCS11Test {

    private boolean enableSM = false;

    static final Properties props = System.getProperties();

    static final String PKCS11 = "PKCS11";

    // directory of the test source

    static final String BASE = System.getProperty("test.src", ".");

    static final char SEP = File.separatorChar;

    private static final String DEFAULT_POLICY =

            BASE + SEP + ".." + SEP + "policy";

    // directory corresponding to BASE in the /closed hierarchy

    static final String CLOSED_BASE;

    static {

        // hack

        String absBase = new File(BASE).getAbsolutePath();

        int k = absBase.indexOf(SEP + "test" + SEP + "sun" + SEP);

        if (k < 0) k = 0;

        String p1 = absBase.substring(0, k + 6);

        String p2 = absBase.substring(k + 5);

        CLOSED_BASE = p1 + "closed" + p2;

        // set it as a system property to make it available in policy file

        System.setProperty("closed.base", CLOSED_BASE);

    }

    // NSS version info

    public static enum ECCState { None, Basic, Extended };

    static double nss_version = -1;

    static ECCState nss_ecc_status = ECCState.Extended;

    // The NSS library we need to search for in getNSSLibDir()

    // Default is "libsoftokn3.so", listed as "softokn3"

    // The other is "libnss3.so", listed as "nss3".

    static String nss_library = "softokn3";

    // NSS versions of each library.  It is simplier to keep nss_version

    // for quick checking for generic testing than many if-else statements.

    static double softoken3_version = -1;

    static double nss3_version = -1;

    static Provider pkcs11;

    // Goes through ServiceLoader instead of Provider.getInstance() since it

    // works on all platforms

    static {

        ServiceLoader sl = ServiceLoader.load(java.security.Provider.class);

        Iterator<Provider> iter = sl.iterator();

        Provider p = null;

        boolean found = false;

        while (iter.hasNext()) {

            try {

                p = iter.next();

                if (p.getName().equals("SunPKCS11")) {

                    found = true;

                    break;

                }

            } catch (Exception | ServiceConfigurationError e) {

                // ignore and move on to the next one

            }

        }

        // Nothing found through ServiceLoader; fall back to reflection

        if (!found) {

            try {

                Class clazz = Class.forName("sun.security.pkcs11.SunPKCS11");

                p = (Provider) clazz.newInstance();

            } catch (Exception ex) {

                ex.printStackTrace();

            }

        }

        pkcs11 = p;

    }

    /*

     * Use Solaris SPARC 11.2 or later to avoid an intermittent failure

     * when running SunPKCS11-Solaris (8044554)

     */

    static boolean isBadSolarisSparc(Provider p) {

        if ("SunPKCS11-Solaris".equals(p.getName()) && badSolarisSparc) {

            System.out.println("SunPKCS11-Solaris provider requires " +

                "Solaris SPARC 11.2 or later, skipping");

            return true;

        }

        return false;

    }

    // Return a SunPKCS11 provider configured with the specified config file

    static Provider getSunPKCS11(String config) throws Exception {

        if (pkcs11 == null) {

            throw new NoSuchProviderException("No PKCS11 provider available");

        }

        return pkcs11.configure(config);

    }

    public abstract void main(Provider p) throws Exception;

    protected boolean skipTest(Provider p) {

        return false;

    }

    private void premain(Provider p) throws Exception {

        if (skipTest(p)) {

            return;

        }

        // set a security manager and policy before a test case runs,

        // and disable them after the test case finished

        try {

            if (enableSM) {

                System.setSecurityManager(new SecurityManager());

            }

            long start = System.currentTimeMillis();

            System.out.printf(

                    "Running test with provider %s (security manager %s) ...%n",

                        p.getName(), enableSM ? "enabled" : "disabled");

            main(p);

            long stop = System.currentTimeMillis();

            System.out.println("Completed test with provider " + p.getName() +

                " (" + (stop - start) + " ms).");

        } finally {

            if (enableSM) {

                System.setSecurityManager(null);

            }

        }

    }

    public static void main(PKCS11Test test) throws Exception {

        main(test, null);

    }

    public static void main(PKCS11Test test, String[] args) throws Exception {

        if (args != null) {

            if (args.length > 0) {

                if ("sm".equals(args[0])) {

                    test.enableSM = true;

                } else {

                    throw new RuntimeException("Unknown Command, use 'sm' as "

                            + "first arguemtn to enable security manager");

                }

            }

            if (test.enableSM) {

                System.setProperty("java.security.policy",

                        (args.length > 1) ? BASE + SEP + args[1]

                                : DEFAULT_POLICY);

            }

        }

        Provider[] oldProviders = Security.getProviders();

        try {

            System.out.println("Beginning test run " + test.getClass().getName() + "...");

            testDefault(test);

            testNSS(test);

            testDeimos(test);

        } finally {

            // NOTE: Do not place a 'return' in any finally block

            // as it will suppress exceptions and hide test failures.

            Provider[] newProviders = Security.getProviders();

            boolean found = true;

            // Do not restore providers if nothing changed. This is especailly

            // useful for ./Provider/Login.sh, where a SecurityManager exists.

            if (oldProviders.length == newProviders.length) {

                found = false;

                for (int i = 0; i<oldProviders.length; i++) {

                    if (oldProviders[i] != newProviders[i]) {

                        found = true;

                        break;

                    }

                }

            }

            if (found) {

                for (Provider p: newProviders) {

                    Security.removeProvider(p.getName());

                }

                for (Provider p: oldProviders) {

                    Security.addProvider(p);

                }

            }

        }

    }

    public static void testDeimos(PKCS11Test test) throws Exception {

        if (new File("/opt/SUNWconn/lib/libpkcs11.so").isFile() == false ||

            "true".equals(System.getProperty("NO_DEIMOS"))) {

            return;

        }

        String base = getBase();

        String p11config = base + SEP + "nss" + SEP + "p11-deimos.txt";

        Provider p = getSunPKCS11(p11config);

        test.premain(p);

    }

    public static void testDefault(PKCS11Test test) throws Exception {

        // run test for default configured PKCS11 providers (if any)

        if ("true".equals(System.getProperty("NO_DEFAULT"))) {

            return;

        }

        Provider[] providers = Security.getProviders();

        for (int i = 0; i < providers.length; i++) {

            Provider p = providers[i];

            if (p.getName().startsWith("SunPKCS11-")) {

                test.premain(p);

            }

        }

    }

    private static String PKCS11_BASE;

    static {

        try {

            PKCS11_BASE = getBase();

        } catch (Exception e) {

            // ignore

        }

    }

    private final static String PKCS11_REL_PATH = "sun/security/pkcs11";

    public static String getBase() throws Exception {

        if (PKCS11_BASE != null) {

            return PKCS11_BASE;

        }

        File cwd = new File(System.getProperty("test.src", ".")).getCanonicalFile();

        while (true) {

            File file = new File(cwd, "TEST.ROOT");

            if (file.isFile()) {

                break;

            }

            cwd = cwd.getParentFile();

            if (cwd == null) {

                throw new Exception("Test root directory not found");

            }

        }

        PKCS11_BASE = new File(cwd, PKCS11_REL_PATH.replace('/', SEP)).getAbsolutePath();

        return PKCS11_BASE;

    }

    public static String getNSSLibDir() throws Exception {

        return getNSSLibDir(nss_library);

    }

    static String getNSSLibDir(String library) throws Exception {

        Path libPath = getNSSLibPath(library);

        if (libPath == null) {

            return null;

        }

        String libDir = String.valueOf(libPath.getParent()) + File.separatorChar;

        System.out.println("nssLibDir: " + libDir);

        System.setProperty("pkcs11test.nss.libdir", libDir);

        return libDir;

    }

    private static Path getNSSLibPath() throws Exception {

        return getNSSLibPath(nss_library);

    }

    static Path getNSSLibPath(String library) throws Exception {

        String osid = getOsId();

        String[] nssLibDirs = getNssLibPaths(osid);

        if (nssLibDirs == null) {

            System.out.println("Warning: unsupported OS: " + osid

                    + ", please initialize NSS librarys location firstly, skipping test");

            return null;

        }

        if (nssLibDirs.length == 0) {

            System.out.println("Warning: NSS not supported on this platform, skipping test");

            return null;

        }

        Path nssLibPath = null;

        for (String dir : nssLibDirs) {

            Path libPath = Paths.get(dir).resolve(System.mapLibraryName(library));

            if (Files.exists(libPath)) {

                nssLibPath = libPath;

                break;

            }

        }

        if (nssLibPath == null) {

            System.out.println("Warning: can't find NSS librarys on this machine, skipping test");

            return null;

        }

        return nssLibPath;

    }

    private static String getOsId() {

        String osName = props.getProperty("os.name");

        if (osName.startsWith("Win")) {

            osName = "Windows";

        } else if (osName.equals("Mac OS X")) {

            osName = "MacOSX";

        }

        String osid = osName + "-" + props.getProperty("os.arch") + "-"

                + props.getProperty("sun.arch.data.model");

        return osid;

    }

    static boolean isBadNSSVersion(Provider p) {

        double nssVersion = getNSSVersion();

        if (isNSS(p) && nssVersion >= 3.11 && nssVersion < 3.12) {

            System.out.println("NSS 3.11 has a DER issue that recent " +

                    "version do not, skipping");

            return true;

        }

        return false;

    }

    protected static void safeReload(String lib) throws Exception {

        try {

            System.load(lib);

        } catch (UnsatisfiedLinkError e) {

            if (e.getMessage().contains("already loaded")) {

                return;

            }

        }

    }

    static boolean loadNSPR(String libdir) throws Exception {

        // load NSS softoken dependencies in advance to avoid resolver issues

        String dir = libdir.endsWith(File.separator)

                     ? libdir

                     : libdir + File.separator;

        safeReload(dir + System.mapLibraryName("nspr4"));

        safeReload(dir + System.mapLibraryName("plc4"));

        safeReload(dir + System.mapLibraryName("plds4"));

        safeReload(dir + System.mapLibraryName("sqlite3"));

        safeReload(dir + System.mapLibraryName("nssutil3"));

        return true;

    }

    // Check the provider being used is NSS

    public static boolean isNSS(Provider p) {

        return p.getName().toUpperCase().equals("SUNPKCS11-NSS");

    }

    static double getNSSVersion() {

        if (nss_version == -1)

            getNSSInfo();

        return nss_version;

    }

    static ECCState getNSSECC() {

        if (nss_version == -1)

            getNSSInfo();

        return nss_ecc_status;

    }

    public static double getLibsoftokn3Version() {

        if (softoken3_version == -1)

            return getNSSInfo("softokn3");

        return softoken3_version;

    }

    public static double getLibnss3Version() {

        if (nss3_version == -1)

            return getNSSInfo("nss3");

        return nss3_version;

    }

    /* Read the library to find out the verison */

    static void getNSSInfo() {

        getNSSInfo(nss_library);

    }

    // Try to parse the version for the specified library.

    // Assuming the library contains either of the following patterns:

    // $Header: NSS <version>

    // Version: NSS <version>

    // Here, <version> stands for NSS version.

    static double getNSSInfo(String library) {

        // look for two types of headers in NSS libraries

        String nssHeader1 = "$Header: NSS";

        String nssHeader2 = "Version: NSS";

        boolean found = false;

        String s = null;

        int i = 0;

        Path libfile = null;

        if (library.compareTo("softokn3") == 0 && softoken3_version > -1)

            return softoken3_version;

        if (library.compareTo("nss3") == 0 && nss3_version > -1)

            return nss3_version;

        try {

            libfile = getNSSLibPath();

            if (libfile == null) {

                return 0.0;

            }

            try (InputStream is = Files.newInputStream(libfile)) {

                byte[] data = new byte[1000];

                int read = 0;

                while (is.available() > 0) {

                    if (read == 0) {

                        read = is.read(data, 0, 1000);

                    } else {

                        // Prepend last 100 bytes in case the header was split

                        // between the reads.

                        System.arraycopy(data, 900, data, 0, 100);

                        read = 100 + is.read(data, 100, 900);

                    }

                    s = new String(data, 0, read, StandardCharsets.US_ASCII);

                    i = s.indexOf(nssHeader1);

                    if (i > 0 || (i = s.indexOf(nssHeader2)) > 0) {

                        found = true;

                        // If the nssHeader is before 920 we can break, otherwise

                        // we may not have the whole header so do another read.  If

                        // no bytes are in the stream, that is ok, found is true.

                        if (i < 920) {

                            break;

                        }

                    }

                }

            }

        } catch (Exception e) {

            e.printStackTrace();

        }

        if (!found) {

            System.out.println("lib" + library +

                    " version not found, set to 0.0: " + libfile);

            nss_version = 0.0;

            return nss_version;

        }

        // the index after whitespace after nssHeader