//

//  MYDecoder.m

//  Cloudy

//

//  Created by Jens Alfke on 1/16/08.

//  Copyright 2008 Jens Alfke. All rights reserved.

//

#import "MYDecoder.h"

#import "MYCrypto_Private.h"

#import "Test.h"

#import "MYErrorUtils.h"

@interface MYSigner ()

- (id) initWithDecoder: (CMSDecoderRef)decoder index: (size_t)index policy: (CFTypeRef)policy;

@end

@implementation MYDecoder

- (id) initWithData: (NSData*)data error: (NSError**)outError

{

    self = [self init];

    if( self ) {

        [self addData: data];

        [self finish];

        *outError = self.error;

        if( *outError ) {

            [self release];

            return nil;

        }

    }

    return self;

}

- (id) init

{

    self = [super init];

    if (self != nil) {

        OSStatus err = CMSDecoderCreate(&_decoder);

        if( err ) {

            [self release];

            self = nil;

        }

    }

    return self;

}

- (void) dealloc

{

    if( _decoder ) CFRelease(_decoder);

    if (_policy) CFRelease(_policy);

    [super dealloc];

}

- (BOOL) addData: (NSData*)data

{

    Assert(data);

    return !_error && checksave( CMSDecoderUpdateMessage(_decoder, data.bytes, data.length) );

}

- (BOOL) finish

{

    return !_error && checksave( CMSDecoderFinalizeMessage(_decoder) );

}

- (NSError*) error

{

    if( _error )

        return MYError(_error, NSOSStatusErrorDomain, 

                       @"%@", MYErrorName(NSOSStatusErrorDomain,_error));

    else

        return nil;

}

- (BOOL) useKeychain: (MYKeychain*)keychain

{

    return !_error && checksave( CMSDecoderSetSearchKeychain(_decoder, keychain.keychainRef) );

}

@synthesize policy=_policy;

- (NSData*) _dataFromFunction: (OSStatus (*)(CMSDecoderRef,CFDataRef*))function

{

    CFDataRef data=NULL;

    if( checksave( (*function)(_decoder, &data) ) )

       return [(NSData*)CFMakeCollectable(data) autorelease];

    else

        return nil;

}

- (NSData*) detachedContent

{

    return [self _dataFromFunction: &CMSDecoderCopyDetachedContent];

}

- (void) setDetachedContent: (NSData*)detachedContent

{

    if( ! _error )

        checksave( CMSDecoderSetDetachedContent(_decoder, (CFDataRef)detachedContent) );

}

- (CSSM_OID) contentType

{

    NSData *data = [self _dataFromFunction: &CMSDecoderCopyEncapsulatedContentType];

    return (CSSM_OID){data.length,(uint8*)data.bytes};      // safe since data is autoreleased

}

- (NSData*) content

{

    return [self _dataFromFunction: &CMSDecoderCopyContent];

}

- (BOOL) isSigned

{

    size_t n;

    return checksave( CMSDecoderGetNumSigners(_decoder, &n) ) && n > 0;

}

- (BOOL) isEncrypted

{

    Boolean isEncrypted;

    return check(CMSDecoderIsContentEncrypted(_decoder,&isEncrypted), @"CMSDecoderIsContentEncrypted")

        && isEncrypted;

}

- (NSArray*) signers

{

    size_t n;

    if( ! checksave( CMSDecoderGetNumSigners(_decoder, &n) ) )

        return nil;

    NSMutableArray *signers = [NSMutableArray arrayWithCapacity: n];

    for( size_t i=0; i<n; i++ ) {

        MYSigner *signer = [[MYSigner alloc] initWithDecoder: _decoder

                                                       index: i

                                                      policy: _policy];

        [signers addObject: signer];

        [signer release];

    }

    return signers;

}

- (NSArray*) certificates

{

    CFArrayRef certRefs = NULL;

    if( ! checksave( CMSDecoderCopyAllCerts(_decoder, &certRefs) ) || ! certRefs )

        return nil;

    unsigned n = CFArrayGetCount(certRefs);

    NSMutableArray *certs = [NSMutableArray arrayWithCapacity: n];

    for( unsigned i=0; i<n; i++ ) {

        SecCertificateRef certRef = (SecCertificateRef) CFArrayGetValueAtIndex(certRefs, i);

        [certs addObject: [MYCertificate certificateWithCertificateRef: certRef]];

    }

    CFRelease(certRefs);

    return certs;

}

- (NSString*) dump

{

    static const char * kStatusNames[kCMSSignerInvalidIndex+1] = {

        "kCMSSignerUnsigned", "kCMSSignerValid", "kCMSSignerNeedsDetachedContent",	

        "kCMSSignerInvalidSignature","kCMSSignerInvalidCert","kCMSSignerInvalidIndex"};			

    CSSM_OID contentType = self.contentType;

    NSMutableString *s = [NSMutableString stringWithFormat:  @"%@<%p>:\n"

                                                              "\tcontentType = %@ (\"%@\")\n"

                                                              "\tcontent = %u bytes\n"

                                                              "\tsigned=%i, encrypted=%i\n"

                                                              "\tpolicy=%@\n"

                                                              "\t%u certificates\n"

                                                              "\tsigners =\n",

                              self.class, self,

                              OIDAsString(contentType), @"??"/*nameOfOID(&contentType)*/,

                              self.content.length,

                              self.isSigned,self.isEncrypted,

                              MYPolicyGetName(_policy),

                              self.certificates.count];

    for( MYSigner *signer in self.signers ) {

        CMSSignerStatus status = signer.status;

        const char *statusName = (status<=kCMSSignerInvalidIndex) ?kStatusNames[status] :"??";

        [s appendFormat:@"\t\t- status = %s\n"

                         "\t\t  verifyResult = %@\n"

                         "\t\t  trust = %@\n"

                         "\t\t  cert = %@\n",

                 statusName,

                 (signer.verifyResult ?MYErrorName(NSOSStatusErrorDomain,signer.verifyResult)

                                      :@"OK"),

                 MYTrustDescribe(signer.trust),

                 signer.certificate];

    }

    return s;

}

@end

#pragma mark -

@implementation MYSigner : NSObject

#define kUncheckedStatus ((CMSSignerStatus)-1)

- (id) initWithDecoder: (CMSDecoderRef)decoder index: (size_t)index policy: (CFTypeRef)policy

{

    self = [super init];

    if( self ) {

        CFRetain(decoder);

        _decoder = decoder;

        _index = index;

        if(policy) _policy = CFRetain(policy);

        _status = kUncheckedStatus;

    }

    return self;

}

- (void) dealloc

{

    if(_decoder) CFRelease(_decoder);

    if(_policy) CFRelease(_policy);

    if(_trust) CFRelease(_trust);

    [super dealloc];

}

- (void) _getInfo {

    if (_status == kUncheckedStatus) {

        if( !check(CMSDecoderCopySignerStatus(_decoder, _index, _policy, (_policy!=nil),

                                              &_status, &_trust, &_verifyResult), 

                   @"CMSDecoderCopySignerStatus"))

            _status = kMYSignerStatusCheckFailed;

    }

}

- (CMSSignerStatus) status

{

    [self _getInfo];

    return _status;

}

- (OSStatus) verifyResult

{

    [self _getInfo];

    return _verifyResult;

}

- (SecTrustRef) trust

{

    [self _getInfo];

    return _trust;

}

- (NSString*) emailAddress

{

    // Don't let caller see the addr if they haven't checked validity & the signature's invalid:

    if (_status==kUncheckedStatus && self.status != kCMSSignerValid)

        return nil;

    CFStringRef email=NULL;

    if( CMSDecoderCopySignerEmailAddress(_decoder, _index, &email) == noErr )

        return [(NSString*)CFMakeCollectable(email) autorelease];

    return nil;

}

- (MYCertificate *) certificate

{

    // Don't let caller see the cert if they haven't checked validity & the signature's invalid:

    if (_status==kUncheckedStatus && self.status != kCMSSignerValid)

        return nil;

    SecCertificateRef certRef=NULL;

    OSStatus err = CMSDecoderCopySignerCert(_decoder, _index, &certRef);

    if( err == noErr )

        return [MYCertificate certificateWithCertificateRef: certRef];

    else {

        Warn(@"CMSDecoderCopySignerCert returned err %i",err);

        return nil;

    }

}

- (NSString*) description

{

    NSMutableString *desc = [NSMutableString stringWithFormat: @"%@[st=%i", self.class,(int)self.status];

    int verify = self.verifyResult;

    if( verify )

        [desc appendFormat: @"; verify error %i",verify];

    else {

        MYCertificate *cert = self.certificate;

        if( cert )

            [desc appendFormat: @"; %@",cert.commonName];

    }

    [desc appendString: @"]"];

    return desc;

}

@end

#pragma mark -

#pragma mark TEST CASE:

#if DEBUG

#import "MYEncoder.h"

#import "MYIdentity.h"

static void TestRoundTrip( NSString *title, NSData *source, MYIdentity *signer, MYCertificate *recipient )

{

    Log(@"Testing MYEncoder/Decoder %@...",title);

    NSError *error;

    NSData *encoded = [MYEncoder encodeData: source signer: signer recipient: recipient error: &error];

    CAssertEq(error,nil);

    CAssert([encoded length]);

    Log(@"MYEncoder encoded %u bytes into %u bytes", source.length,encoded.length);

    Log(@"Decoding...");

    MYDecoder *d = [[MYDecoder alloc] init];

    d.policy = [MYCertificate X509Policy];

    [d addData: encoded];

    [d finish];

    CAssertEq(d.error,nil);

    Log(@"%@", d.dump);

    CAssert(d.content);

    CAssert([d.content isEqual: source]);

    CAssertEq(d.detachedContent,nil);

    CAssertEq(d.isSigned,(signer!=nil));

    CAssertEq(d.isEncrypted,(recipient!=nil));

    if( signer ) {

        CAssert(d.certificates.count >= 1);     // may include extra parent certs

        CAssertEq(d.signers.count,1U);

        MYSigner *outSigner = [d.signers objectAtIndex: 0];

        CAssertEq(outSigner.status,(CMSSignerStatus)kCMSSignerValid);

        CAssertEq(outSigner.verifyResult,noErr);

        CAssert([outSigner.certificate isEqualToCertificate: signer]);

    } else {

        CAssertEq(d.certificates.count, 0U);

        CAssertEq(d.signers.count,0U);

    }

}

TestCase(MYDecoder) {

    RequireTestCase(MYEncoder);

    MYIdentity *me = [MYIdentity preferredIdentityForName: @"MYCryptoTest"];

    CAssert(me,@"No default identity has been set up in the Keychain");

    Log(@"Using %@", me);

    NSData *source = [NSData dataWithContentsOfFile: @"/Library/Desktop Pictures/Nature/Zen Garden.jpg"];

    CAssert(source);

    TestRoundTrip(@"signing",            source, me,  nil);

    TestRoundTrip(@"encryption",         source, nil, me);

    TestRoundTrip(@"signing+encryption", source, me,  me);

}

#endif DEBUG

/*

 Copyright (c) 2009, Jens Alfke <jens@mooseyard.com>. All rights reserved.

 Redistribution and use in source and binary forms, with or without modification, are permitted

 provided that the following conditions are met:

 * Redistributions of source code must retain the above copyright notice, this list of conditions

 and the following disclaimer.

 * Redistributions in binary form must reproduce the above copyright notice, this list of conditions

 and the following disclaimer in the documentation and/or other materials provided with the

 distribution.

 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR

 IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND 

 FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRI-

 BUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

 (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 

  PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 

 CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF 

 THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */