//

//  MYCertificate.m

//  MYCrypto

//

//  Created by Jens Alfke on 3/26/09.

//  Copyright 2009 Jens Alfke. All rights reserved.

//

#import "MYCertificate.h"

#import "MYCrypto_Private.h"

#import "MYDigest.h"

#import "MYErrorUtils.h"

#if !MYCRYPTO_USE_IPHONE_API

@implementation MYCertificate

/** Creates a MYCertificate object for an existing Keychain certificate reference. */

- (id) initWithCertificateRef: (SecCertificateRef)certificateRef {

    self = [super initWithKeychainItemRef: (SecKeychainItemRef)certificateRef];

    if (self) {

        _certificateRef = certificateRef;     // superclass has already CFRetained it

    }

    return self;

}

+ (MYCertificate*) certificateWithCertificateRef: (SecCertificateRef)certificateRef {

    return [[[self alloc] initWithCertificateRef: certificateRef] autorelease];

}

/** Creates a MYCertificate object from exported key data, but does not add it to any keychain. */

- (id) initWithCertificateData: (NSData*)data

                          type: (CSSM_CERT_TYPE) type

                      encoding: (CSSM_CERT_ENCODING) encoding

{

    Assert(data);

    CSSM_DATA cssmData = {.Data=(void*)data.bytes, .Length=data.length};

    SecCertificateRef certificateRef = NULL;

    if (!check(SecCertificateCreateFromData(&cssmData, type, encoding, &certificateRef),

        @"SecCertificateCreateFromData")) {

        [self release];

        return nil;

    }

    self = [self initWithCertificateRef: certificateRef];

    CFRelease(certificateRef);

    return self;

}

- (id) initWithCertificateData: (NSData*)data {

    return [self initWithCertificateData: data 

                                    type: CSSM_CERT_X_509v3 

                                encoding: CSSM_CERT_ENCODING_BER];

}

- (NSString*) description {

    return $sprintf(@"%@[%@ %@/%p]", 

                    [self class],

                    self.commonName,

                    self.certificateData.my_SHA1Digest.abbreviatedHexString,

                    _certificateRef);

}

- (BOOL)isEqualToCertificate:(MYCertificate*)cert {

    return [self isEqual: cert] || [self.certificateData isEqual: cert.certificateData];

}

+ (MYCertificate*) preferredCertificateForName: (NSString*)name {

    SecCertificateRef certRef = NULL;

    if (!check(SecCertificateCopyPreference((CFStringRef)name, 0, &certRef),

               @"SecCertificateCopyPreference"))

        return nil;

    return [[[MYCertificate alloc] initWithCertificateRef: certRef] autorelease];

}

- (BOOL) setPreferredCertificateForName: (NSString*)name {

    return check(SecCertificateSetPreference(_certificateRef, (CFStringRef)name, 0, NULL),

                 @"SecCertificateSetPreference");

}

@synthesize certificateRef=_certificateRef;

- (NSData*) certificateData {

    CSSM_DATA cssmData;

    if (!check(SecCertificateGetData(_certificateRef, &cssmData),

               @"SecCertificateGetData"))

        return nil;

    return [NSData dataWithBytes: cssmData.Data length: cssmData.Length];

}

- (MYPublicKey*) publicKey {

    SecKeyRef keyRef = NULL;

    if (!check(SecCertificateCopyPublicKey(_certificateRef, &keyRef),

               @"SecCertificateCopyPublicKey") || !keyRef)

        return nil;

    MYPublicKey *key = [[[MYPublicKey alloc] initWithKeyRef: keyRef] autorelease];

    CFRelease(keyRef);

    return key;

}

- (NSString*) commonName {

    CFStringRef name = NULL;

    if (!check(SecCertificateCopyCommonName(_certificateRef, &name),

               @"SecCertificateCopyCommonName") || !name)

        return nil;

    return [(id)CFMakeCollectable(name) autorelease];

}

- (NSArray*) emailAddresses {

    CFArrayRef addrs = NULL;

    if (!check(SecCertificateCopyEmailAddresses(_certificateRef, &addrs),

               @"SecCertificateCopyEmailAddresses") || !addrs)

        return nil;

    return [(id)CFMakeCollectable(addrs) autorelease];

}

#pragma mark -

#pragma mark TRUST/POLICY STUFF:

+ (SecPolicyRef) policyForOID: (CSSM_OID) policyOID {

    SecPolicySearchRef search;

    if (!check(SecPolicySearchCreate(CSSM_CERT_X_509v3, &policyOID, NULL, &search),

           @"SecPolicySearchCreate"))

        return nil;

    SecPolicyRef policy = NULL;

    if (!check(SecPolicySearchCopyNext(search, &policy), @"SecPolicySearchCopyNext"))

        policy = NULL;

    CFRelease(search);

    return policy;

}

+ (SecPolicyRef) X509Policy {

    static SecPolicyRef sX509Policy = NULL;

    if (!sX509Policy)

        sX509Policy = [self policyForOID: CSSMOID_APPLE_X509_BASIC];

    return sX509Policy;

}

+ (SecPolicyRef) SSLPolicy {

    static SecPolicyRef sSSLPolicy = NULL;

    if (!sSSLPolicy)

        sSSLPolicy = [self policyForOID: CSSMOID_APPLE_TP_SSL];

    return sSSLPolicy;

}

+ (SecPolicyRef) SMIMEPolicy {

    static SecPolicyRef sSMIMEPolicy = NULL;

    if (!sSMIMEPolicy)

        sSMIMEPolicy = [self policyForOID: CSSMOID_APPLE_TP_SMIME];

    return sSMIMEPolicy;

}

- (CSSM_CERT_TYPE) certificateType {

    CSSM_CERT_TYPE type = CSSM_CERT_UNKNOWN;

    if (!check(SecCertificateGetType(_certificateRef, &type), @"SecCertificateGetType"))

        type = CSSM_CERT_UNKNOWN;

    return type;

}

- (NSArray*) trustSettings {

    CFArrayRef settings = NULL;

    OSStatus err = SecTrustSettingsCopyTrustSettings(_certificateRef, kSecTrustSettingsDomainUser, 

                                                     &settings);

    if (err == errSecItemNotFound || !check(err,@"SecTrustSettingsCopyTrustSettings") || !settings)

        return nil;

    return [(id)CFMakeCollectable(settings) autorelease];

}

- (BOOL) setUserTrust: (SecTrustUserSetting)trustSetting

{

    if (trustSetting == kSecTrustResultProceed) {

        return check(SecTrustSettingsSetTrustSettings(_certificateRef, 

                                                      kSecTrustSettingsDomainUser, nil),

                     @"SecTrustSettingsSetTrustSettings");

    } else if (trustSetting == kSecTrustResultDeny) {

        OSStatus err = SecTrustSettingsRemoveTrustSettings(_certificateRef, 

                                                           kSecTrustSettingsDomainUser);

        return err == errSecItemNotFound || check(err, @"SecTrustSettingsRemoveTrustSettings");

    } else

        return paramErr;

}

@end

NSString* MYPolicyGetName( SecPolicyRef policy ) {

    if (!policy)

        return @"(null)";

    CSSM_OID oid = {};

    SecPolicyGetOID(policy, &oid);

    return $sprintf(@"SecPolicy[%@]", OIDAsString(oid));

}

NSString* MYTrustResultDescribe( SecTrustResultType result ) {

    static NSString* const kTrustResultNames[kSecTrustResultOtherError+1] = {

        @"Invalid",

        @"Proceed",

        @"Confirm",

        @"Deny",

        @"Unspecified",

        @"RecoverableTrustFailure",

        @"FatalTrustFailure",

        @"OtherError"

    };

    if (result>=0 && result <=kSecTrustResultOtherError)

        return kTrustResultNames[result];

    else

        return $sprintf(@"(Unknown trust result %i)", result);

}

NSString* MYTrustDescribe( SecTrustRef trust ) {

    SecTrustResultType result;

    CFArrayRef certChain=NULL;

    CSSM_TP_APPLE_EVIDENCE_INFO* statusChain;

    OSStatus err = SecTrustGetResult(trust, &result, &certChain, &statusChain);

    NSString *desc;

    if (err)

        desc = $sprintf(@"SecTrust[%p, err=%@]", trust, MYErrorName(NSOSStatusErrorDomain, err));

    else

        desc = $sprintf(@"SecTrust[%@, %u in chain]", 

                        MYTrustResultDescribe(result),

                        CFArrayGetCount(certChain));

    if (certChain) CFRelease(certChain);

    return desc;

}

TestCase(Trust) {

    Log(@"X.509 policy = %@", MYPolicyGetName([MYCertificate X509Policy]));

    Log(@"  SSL policy = %@", MYPolicyGetName([MYCertificate SSLPolicy]));

    Log(@"SMIME policy = %@", MYPolicyGetName([MYCertificate SMIMEPolicy]));

    for (MYCertificate *cert in [[MYKeychain defaultKeychain] enumerateCertificates]) {

        NSArray *settings = cert.trustSettings;

        if (settings)

            Log(@"---- %@ = %@", cert, settings);

    }

}

#endif !MYCRYPTO_USE_IPHONE_API