/*

 * Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package sun.security.ssl;

import java.io.IOException;

import java.io.ByteArrayInputStream;

import java.nio.ByteBuffer;

import java.security.cert.Extension;

import java.security.cert.CertificateFactory;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.text.MessageFormat;

import java.util.ArrayList;

import java.util.List;

import java.util.Locale;

import javax.net.ssl.SSLProtocolException;

import sun.security.provider.certpath.OCSPResponse;

import sun.security.provider.certpath.ResponderId;

import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST;

import static sun.security.ssl.SSLExtension.CH_STATUS_REQUEST_V2;

import sun.security.ssl.SSLExtension.ExtensionConsumer;

import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST;

import static sun.security.ssl.SSLExtension.SH_STATUS_REQUEST_V2;

import sun.security.ssl.SSLExtension.SSLExtensionSpec;

import sun.security.ssl.SSLHandshake.HandshakeMessage;

import sun.security.util.DerInputStream;

import sun.security.util.DerValue;

import sun.security.util.HexDumpEncoder;

/**

 * Pack of "status_request" and "status_request_v2" extensions.

 */

final class CertStatusExtension {

    static final HandshakeProducer chNetworkProducer =

            new CHCertStatusReqProducer();

    static final ExtensionConsumer chOnLoadConsumer =

            new CHCertStatusReqConsumer();

    static final HandshakeProducer shNetworkProducer =

            new SHCertStatusReqProducer();

    static final ExtensionConsumer shOnLoadConsumer =

            new SHCertStatusReqConsumer();

    static final HandshakeProducer ctNetworkProducer =

            new CTCertStatusResponseProducer();

    static final ExtensionConsumer ctOnLoadConsumer =

            new CTCertStatusResponseConsumer();

    static final SSLStringize certStatusReqStringize =

            new CertStatusRequestStringize();

    static final HandshakeProducer chV2NetworkProducer =

            new CHCertStatusReqV2Producer();

    static final ExtensionConsumer chV2OnLoadConsumer =

            new CHCertStatusReqV2Consumer();

    static final HandshakeProducer shV2NetworkProducer =

            new SHCertStatusReqV2Producer();

    static final ExtensionConsumer shV2OnLoadConsumer =

            new SHCertStatusReqV2Consumer();

    static final SSLStringize certStatusReqV2Stringize =

            new CertStatusRequestsStringize();

    static final SSLStringize certStatusRespStringize =

            new CertStatusRespStringize();

    /**

     * The "status_request" extension.

     *

     * RFC6066 defines the TLS extension,"status_request" (type 0x5),

     * which allows the client to request that the server perform OCSP

     * on the client's behalf.

     *

     * The "extension data" field of this extension contains a

     * "CertificateStatusRequest" structure:

     *

     *      struct {

     *          CertificateStatusType status_type;

     *          select (status_type) {

     *              case ocsp: OCSPStatusRequest;

     *          } request;

     *      } CertificateStatusRequest;

     *

     *      enum { ocsp(1), (255) } CertificateStatusType;

     *

     *      struct {

     *          ResponderID responder_id_list<0..2^16-1>;

     *          Extensions  request_extensions;

     *      } OCSPStatusRequest;

     *

     *      opaque ResponderID<1..2^16-1>;

     *      opaque Extensions<0..2^16-1>;

     */

    static final class CertStatusRequestSpec implements SSLExtensionSpec {

        static final CertStatusRequestSpec DEFAULT =

                new CertStatusRequestSpec(OCSPStatusRequest.EMPTY_OCSP);

        final CertStatusRequest statusRequest;

        private CertStatusRequestSpec(CertStatusRequest statusRequest) {

            this.statusRequest = statusRequest;

        }

        private CertStatusRequestSpec(ByteBuffer buffer) throws IOException {

            // Is it a empty extension_data?

            if (buffer.remaining() == 0) {

                // server response

                this.statusRequest = null;

                return;

            }

            if (buffer.remaining() < 1) {

                throw new SSLProtocolException(

                    "Invalid status_request extension: insufficient data");

            }

            byte statusType = (byte)Record.getInt8(buffer);

            byte[] encoded = new byte[buffer.remaining()];

            if (encoded.length != 0) {

                buffer.get(encoded);

            }

            if (statusType == CertStatusRequestType.OCSP.id) {

                this.statusRequest = new OCSPStatusRequest(statusType, encoded);

            } else {

                if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                    SSLLogger.info(

                        "Unknown certificate status request " +

                        "(status type: " + statusType + ")");

                }

                this.statusRequest = new CertStatusRequest(statusType, encoded);

            }

        }

        @Override

        public String toString() {

            return statusRequest == null ?

                        "<empty>" : statusRequest.toString();

        }

    }

    /**

     * Defines the CertificateStatus response structure as outlined in

     * RFC 6066.  This will contain a status response type, plus a single,

     * non-empty OCSP response in DER-encoded form.

     *

     * struct {

     *     CertificateStatusType status_type;

     *     select (status_type) {

     *         case ocsp: OCSPResponse;

     *     } response;

     * } CertificateStatus;

     */

    static final class CertStatusResponseSpec implements SSLExtensionSpec {

        final CertStatusResponse statusResponse;

        private CertStatusResponseSpec(CertStatusResponse resp) {

            this.statusResponse = resp;

        }

        private CertStatusResponseSpec(ByteBuffer buffer) throws IOException {

            if (buffer.remaining() < 2) {

                throw new SSLProtocolException(

                    "Invalid status_request extension: insufficient data");

            }

            // Get the status type (1 byte) and response data (vector)

            byte type = (byte)Record.getInt8(buffer);

            byte[] respData = Record.getBytes24(buffer);

            // Create the CertStatusResponse based on the type

            if (type == CertStatusRequestType.OCSP.id) {

                this.statusResponse = new OCSPStatusResponse(type, respData);

            } else {

                if (SSLLogger.isOn && SSLLogger.isOn("ssl,handshake")) {

                    SSLLogger.info(

                        "Unknown certificate status response " +

                        "(status type: " + type + ")");

                }

                this.statusResponse = new CertStatusResponse(type, respData);

            }

        }

        @Override

        public String toString() {

            return statusResponse == null ?

                        "<empty>" : statusResponse.toString();

        }

    }

    private static final

            class CertStatusRequestStringize implements SSLStringize {

        @Override

        public String toString(ByteBuffer buffer) {

            try {

                return (new CertStatusRequestSpec(buffer)).toString();

            } catch (IOException ioe) {

                // For debug logging only, so please swallow exceptions.

                return ioe.getMessage();

            }

        }

    }

    private static final

            class CertStatusRespStringize implements SSLStringize {

        @Override

        public String toString(ByteBuffer buffer) {

            try {

                return (new CertStatusResponseSpec(buffer)).toString();

            } catch (IOException ioe) {

                 // For debug logging only, so please swallow exceptions.

                return ioe.getMessage();

            }

        }

    }

    static enum CertStatusRequestType {

        OCSP        ((byte)0x01,    "ocsp"),        // RFC 6066/6961

        OCSP_MULTI  ((byte)0x02,    "ocsp_multi");  // RFC 6961

        final byte id;

        final String name;

        private CertStatusRequestType(byte id, String name) {

            this.id = id;

            this.name = name;

        }

        /**

         * Returns the enum constant of the specified id (see RFC 6066).

         */

        static CertStatusRequestType valueOf(byte id) {

            for (CertStatusRequestType srt : CertStatusRequestType.values()) {

                if (srt.id == id) {

                    return srt;

                }

            }

            return null;

        }

        static String nameOf(byte id) {

            for (CertStatusRequestType srt : CertStatusRequestType.values()) {

                if (srt.id == id) {

                    return srt.name;

                }

            }

            return "UNDEFINED-CERT-STATUS-TYPE(" + id + ")";

        }

    }

    static class CertStatusRequest {

        final byte statusType;

        final byte[] encodedRequest;

        protected CertStatusRequest(byte statusType, byte[] encodedRequest) {

            this.statusType = statusType;

            this.encodedRequest = encodedRequest;

        }

        @Override

        public String toString() {

            MessageFormat messageFormat = new MessageFormat(

                "\"certificate status type\": {0}\n" +

                "\"encoded certificate status\": '{'\n" +

                "{1}\n" +

                "'}'",

                Locale.ENGLISH);

            HexDumpEncoder hexEncoder = new HexDumpEncoder();

            String encoded = hexEncoder.encodeBuffer(encodedRequest);

            Object[] messageFields = {

                CertStatusRequestType.nameOf(statusType),

                Utilities.indent(encoded)

            };

            return messageFormat.format(messageFields);

        }

    }

    /*

     * RFC6066 defines the TLS extension,"status_request" (type 0x5),

     * which allows the client to request that the server perform OCSP

     * on the client's behalf.

     *

     * The RFC defines an OCSPStatusRequest structure:

     *

     *      struct {

     *          ResponderID responder_id_list<0..2^16-1>;

     *          Extensions  request_extensions;

     *      } OCSPStatusRequest;

     */

    static final class OCSPStatusRequest extends CertStatusRequest {

        static final OCSPStatusRequest EMPTY_OCSP;

        static final OCSPStatusRequest EMPTY_OCSP_MULTI;

        final List<ResponderId> responderIds;

        final List<Extension> extensions;

        private final int ridListLen;

        private final int extListLen;

        static {

            OCSPStatusRequest ocspReq = null;

            OCSPStatusRequest multiReq = null;

            try {

                ocspReq = new OCSPStatusRequest(

                        CertStatusRequestType.OCSP.id,

                        new byte[] {0x00, 0x00, 0x00, 0x00});

                multiReq = new OCSPStatusRequest(

                    CertStatusRequestType.OCSP_MULTI.id,

                    new byte[] {0x00, 0x00, 0x00, 0x00});

            } catch (IOException ioe) {

                // unlikely

            }

            EMPTY_OCSP = ocspReq;

            EMPTY_OCSP_MULTI = multiReq;

        }

        private OCSPStatusRequest(byte statusType,

                byte[] encoded) throws IOException {

            super(statusType, encoded);

            if (encoded == null || encoded.length < 4) {

                                        //  2: length of responder_id_list

                                        // +2: length of request_extensions

                throw new SSLProtocolException(

                        "Invalid OCSP status request: insufficient data");

            }

            List<ResponderId> rids = new ArrayList<>();

            List<Extension> exts = new ArrayList<>();

            ByteBuffer m = ByteBuffer.wrap(encoded);

            this.ridListLen = Record.getInt16(m);

            if (m.remaining() < (ridListLen + 2)) {

                throw new SSLProtocolException(

                        "Invalid OCSP status request: insufficient data");

            }

            int ridListBytesRemaining = ridListLen;

            while (ridListBytesRemaining >= 2) {    // 2: length of responder_id

                byte[] ridBytes = Record.getBytes16(m);

                try {

                    rids.add(new ResponderId(ridBytes));

                } catch (IOException ioe) {

                    throw new SSLProtocolException(

                        "Invalid OCSP status request: invalid responder ID");

                }

                ridListBytesRemaining -= ridBytes.length + 2;

            }

            if (ridListBytesRemaining != 0) {

                    throw new SSLProtocolException(

                        "Invalid OCSP status request: incomplete data");

            }

            byte[] extListBytes = Record.getBytes16(m);

            this.extListLen = extListBytes.length;

            if (extListLen > 0) {

                try {

                    DerInputStream dis = new DerInputStream(extListBytes);

                    DerValue[] extSeqContents =

                            dis.getSequence(extListBytes.length);

                    for (DerValue extDerVal : extSeqContents) {

                        exts.add(new sun.security.x509.Extension(extDerVal));

                    }

                } catch (IOException ioe) {

                    throw new SSLProtocolException(

                        "Invalid OCSP status request: invalid extension");

                }

            }

            this.responderIds = rids;

            this.extensions = exts;

        }

        @Override

        public String toString() {

            MessageFormat messageFormat = new MessageFormat(

                "\"certificate status type\": {0}\n" +

                "\"OCSP status request\": '{'\n" +

                "{1}\n" +

                "'}'",

                Locale.ENGLISH);

            MessageFormat requestFormat = new MessageFormat(

                "\"responder_id\": {0}\n" +

                "\"request extensions\": '{'\n" +

                "{1}\n" +

                "'}'",

                Locale.ENGLISH);

            String ridStr = "<empty>";

            if (!responderIds.isEmpty()) {

                ridStr = responderIds.toString();

            }

            String extsStr = "<empty>";

            if (!extensions.isEmpty()) {

                StringBuilder extBuilder = new StringBuilder(512);

                boolean isFirst = true;

                for (Extension ext : this.extensions) {

                    if (isFirst) {

                        isFirst = false;

                    } else {

                        extBuilder.append(",\n");

                    }

                    extBuilder.append(

                            "{\n" + Utilities.indent(ext.toString()) + "}");

                }

                extsStr = extBuilder.toString();

            }

            Object[] requestFields = {

                    ridStr,

                    Utilities.indent(extsStr)

                };

            String ocspStatusRequest = requestFormat.format(requestFields);

            Object[] messageFields = {

                    CertStatusRequestType.nameOf(statusType),

                    Utilities.indent(ocspStatusRequest)

                };

            return messageFormat.format(messageFields);

        }

    }

    static class CertStatusResponse {

        final byte statusType;

        final byte[] encodedResponse;

        protected CertStatusResponse(byte statusType, byte[] respDer) {

            this.statusType = statusType;

            this.encodedResponse = respDer;

        }

        byte[] toByteArray() throws IOException {

            // Create a byte array large enough to handle the status_type

            // field (1) + OCSP length (3) + OCSP data (variable)

            byte[] outData = new byte[encodedResponse.length + 4];

            ByteBuffer buf = ByteBuffer.wrap(outData);

            Record.putInt8(buf, statusType);

            Record.putBytes24(buf, encodedResponse);

            return buf.array();

        }

        @Override

        public String toString() {

            MessageFormat messageFormat = new MessageFormat(

                "\"certificate status response type\": {0}\n" +

                "\"encoded certificate status\": '{'\n" +

                "{1}\n" +

                "'}'",

                Locale.ENGLISH);

            HexDumpEncoder hexEncoder = new HexDumpEncoder();

            String encoded = hexEncoder.encodeBuffer(encodedResponse);

            Object[] messageFields = {

                CertStatusRequestType.nameOf(statusType),

                Utilities.indent(encoded)

            };

            return messageFormat.format(messageFields);

        }