/* GenKeyCmd.java -- The genkey command handler of the keytool
   Copyright (C) 2006 Free Software Foundation, Inc.

This file is part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2, or (at your option)
any later version.

GNU Classpath is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

You should have received a copy of the GNU General Public License
along with GNU Classpath; see the file COPYING.  If not, write to the
Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301 USA.

Linking this library statically or dynamically with other modules is
making a combined work based on this library.  Thus, the terms and
conditions of the GNU General Public License cover the whole
combination.

As a special exception, the copyright holders of this library give you
permission to link this library with independent modules to produce an
executable, regardless of the license terms of these independent
modules, and to copy and distribute the resulting executable under
terms of your choice, provided that you also meet, for each linked
independent module, the terms and conditions of the license of that
module.  An independent module is a module which is not derived from
or based on this library.  If you modify this library, you may extend
this exception to your version of the library, but you are not
obligated to do so.  If you do not wish to do so, delete this
exception statement from your version. */


package gnu.classpath.tools.keytool;

import gnu.classpath.Configuration;
import gnu.classpath.tools.getopt.ClasspathToolParser;
import gnu.classpath.tools.getopt.Option;
import gnu.classpath.tools.getopt.OptionException;
import gnu.classpath.tools.getopt.OptionGroup;
import gnu.classpath.tools.getopt.Parser;
import gnu.java.security.util.Util;
import gnu.java.security.x509.X500DistinguishedName;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SignatureException;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.util.logging.Logger;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.TextInputCallback;
import javax.security.auth.callback.TextOutputCallback;
import javax.security.auth.callback.UnsupportedCallbackException;

/**
 * The <b>-genkey</b> keytool command handler is used to generate a key pair (a
 * public, and associated private keys). It then generates a self-signed X509 v1
 * certificate (authenticating the public key) and stores this certificate and
 * the private key in the key store associating both to a designated alias.
 * <p>
 * Possible options for this command are:
 * <p>
 * <dl>
 *      <dt>-alias ALIAS</dt>
 *      <dd>Every entry, be it a <i>Key Entry</i> or a <i>Trusted
 *      Certificate</i>, in a key store is uniquely identified by a user-defined
 *      <i>Alias</i> string. Use this option to specify the <i>Alias</i> to use
 *      when referring to an entry in the key store. Unless specified otherwise,
 *      a default value of <code>mykey</code> shall be used when this option is
 *      omitted from the command line.
 *      <p></dd>
 *      
 *      <dt>-keyalg ALGORITHM</dt>
 *      <dd>Use this option to specify the canonical name of the key-pair
 *      generation algorithm. The default value for this option is
 *      <code>DSS</code> (a synonym for the Digital Signature Algorithm also
 *      known as <code>DSA</code>).
 *      <p></dd>
 *      
 *      <dt>-keysize KEY_SIZE</dt>
 *      <dd>Use this option to specify the number of bits of the shared modulus
 *      (for both the public and private keys) to use when generating new keys.
 *      A default value of <code>1024</code> will be used if this option is
 *      omitted from the command line.
 *      <p></dd>
 *      
 *      <dt>-sigalg ALGORITHM</dt>
 *      <dd>The canonical name of the digital signature algorithm to use for
 *      signing certificates. If this option is omitted, a default value will be
 *      chosen based on the type of the key-pair; i.e. the algorithm that ends
 *      up being used by the <code>-keyalg</code> option. If the key-pair
 *      generation algorithm is <code>DSA</code>, the value for the signature
 *      algorithm will be <code>SHA1withDSA</code>. If on the other hand the
 *      key-pair generation algorithm is <code>RSA</code>, then the tool will
 *      use <code>MD5withRSA</code> as the signature algorithm.
 *      <p></dd>
 *      
 *      <dt>-dname NAME</dt>
 *      <dd>This a mandatory value for this command. If this option is omitted
 *      the tool will prompt you to enter a <i>Distinguished Name</i> to use as
 *      both the <i>Owner</i> and <i>Issuer</i> of the generated self-signed
 *      certificate.
 *      <p>
 *      The syntax of a valid value for this option MUST follow RFC-2253
 *      specifications. Namely the following components (with their accepted
 *      meaning) will be recognized. Note that the component name is case-
 *      insensitive:
 *      <dl>
 *              <dt>CN</dt>
 *              <dd>The Common Name; e.g. "host.domain.com"</dd>
 *              
 *              <dt>OU</dt>
 *              <dd>The Organizational Unit; e.g. "IT Department"</dd>
 *              
 *              <dt>O</dt>
 *              <dd>The Organization Name; e.g. "The Sample Company"</dd>
 *              
 *              <dt>L</dt>
 *              <dd>The Locality Name; e.g. "Sydney"</dd>
 *              
 *              <dt>ST</dt>
 *              <dd>The State Name; e.g. "New South Wales"</dd>
 *              
 *              <dt>C</dt>
 *              <dd>The 2-letter Country identifier; e.g. "AU"</dd>
 *      </dl>
 *      <p>
 *      When specified with a <code>-dname</code> option, each pair of component
 *      / value will be separated from the other with a comma. Each component
 *      and value pair MUST be separated by an equal sign. For example, the
 *      following is a valid DN value:
 *      <pre>
 *        CN=host.domain.com, O=The Sample Company, L=Sydney, ST=NSW, C=AU
 *      </pre>
 *      If this option is omitted, the tool will prompt you to enter the
 *      information through the console.
 *      <p></dd>
 *      
 *      <dt>-keypass PASSWORD</dt>
 *      <dd>Use this option to specify the password which the tool will use to
 *      protect the newly created Key Entry.
 *      <p>
 *      If this option is omitted, you will be prompted to provide a password.
 *      <p></dd>
 *      
 *      <dt>-validity DAY_COUNT</dt>
 *      
 *      <dt>-storetype STORE_TYPE</dt>
 *      <dd>Use this option to specify the type of the key store to use. The
 *      default value, if this option is omitted, is that of the property
 *      <code>keystore.type</code> in the security properties file, which is
 *      obtained by invoking the {@link java.security.KeyStore#getDefaultType()}
 *      static method.
 *      <p></dd>
 *      
 *      <dt>-keystore URL</dt>
 *      <dd>Use this option to specify the location of the key store to use.
 *      The default value is a file {@link java.net.URL} referencing the file
 *      named <code>.keystore</code> located in the path returned by the call to
 *      {@link java.lang.System#getProperty(String)} using <code>user.home</code>
 *      as argument.
 *      <p>
 *      If a URL was specified, but was found to be malformed --e.g. missing
 *      protocol element-- the tool will attempt to use the URL value as a file-
 *      name (with absolute or relative path-name) of a key store --as if the
 *      protocol was <code>file:</code>.
 *      <p></dd>
 *      
 *      <dt>-storepass PASSWORD</dt>
 *      <dd>Use this option to specify the password protecting the key store. If
 *      this option is omitted from the command line, you will be prompted to
 *      provide a password.
 *      <p></dd>
 *      
 *      <dt>-provider PROVIDER_CLASS_NAME</dt>
 *      <dd>A fully qualified class name of a Security Provider to add to the
 *      current list of Security Providers already installed in the JVM in-use.
 *      If a provider class is specified with this option, and was successfully
 *      added to the runtime --i.e. it was not already installed-- then the tool
 *      will attempt to removed this Security Provider before exiting.
 *      <p></dd>
 *      
 *      <dt>-v</dt>
 *      <dd>Use this option to enable more verbose output.</dd>
 * </dl>
 */
class GenKeyCmd extends Command
{
  private static final Logger log = Logger.getLogger(GenKeyCmd.class.getName());
  /** Default key size in bits. */
  private static final int DEFAULT_KEY_SIZE = 1024;

  protected String _alias;
  protected String _keyAlgorithm;
  protected String _keySizeStr;
  protected String _sigAlgorithm;
  protected String _dName;
  protected String _password;
  protected String _validityStr;
  protected String _ksType;
  protected String _ksURL;
  protected String _ksPassword;
  protected String _providerClassName;
  private int keySize;
  private X500DistinguishedName distinguishedName;
  private Parser cmdOptionsParser;

  // default 0-arguments constructor

  // public setters -----------------------------------------------------------

  /** @param alias the alias to use. */
  public void setAlias(String alias)
  {
    this._alias = alias;
  }

  /** @param algorithm the canonical name of the key-pair algorithm to use. */
  public void setKeyalg(String algorithm)
  {
    this._keyAlgorithm = algorithm;
  }

  /**
   * @param bits the string representation of the number of bits (a decimal
   *          positive integer) the modulus of the generated keys (private and
   *          public) should have.
   */
  public void setKeysize(String bits)
  {
    this._validityStr = bits;
  }

  /**
   * @param algorithm the canonical name of the digital signature algorithm to
   *          use.
   */
  public void setSigalg(String algorithm)
  {
    this._sigAlgorithm = algorithm;
  }

  /** @param name the distiniguished name to use. */
  public void setDname(String name)
  {
    this._dName = name;
  }

  /** @param password the (private) key password to use. */
  public void setKeypass(String password)
  {
    this._password = password;
  }

  /**
   * @param days the string representation of the number of days (a decimal,
   *          positive integer) to assign to the generated certificate.
   */
  public void setValidity(String days)
  {
    this._validityStr = days;
  }

  /** @param type the key-store type to use. */
  public void setStoretype(String type)
  {
    this._ksType = type;
  }

  /** @param url the key-store URL to use. */
  public void setKeystore(String url)
  {
    this._ksURL = url;
  }

  /** @param password the key-store password to use. */
  public void setStorepass(String password)
  {
    this._ksPassword = password;
  }

  /** @param className a security provider fully qualified class name to use. */
  public void setProvider(String className)
  {
    this._providerClassName = className;
  }

  // life-cycle methods -------------------------------------------------------

  void setup() throws Exception
  {
    setKeyStoreParams(true, _providerClassName, _ksType, _ksPassword, _ksURL);
    setAliasParam(_alias);
    setKeyPasswordParam(_password);
    setAlgorithmParams(_keyAlgorithm, _sigAlgorithm);
    setKeySize(_keySizeStr);
    setDName(_dName);
    setValidityParam(_validityStr);
    if (Configuration.DEBUG)
      {
        log.fine("-genkey handler will use the following options:"); //$NON-NLS-1$
        log.fine("  -alias=" + alias); //$NON-NLS-1$
        log.fine("  -keyalg=" + keyPairGenerator.getAlgorithm()); //$NON-NLS-1$
        log.fine("  -keysize=" + keySize); //$NON-NLS-1$
        log.fine("  -sigalg=" + signatureAlgorithm.getAlgorithm()); //$NON-NLS-1$
        log.fine("  -dname=" + distinguishedName); //$NON-NLS-1$
        log.fine("  -validity=" + validityInDays); //$NON-NLS-1$
        log.fine("  -storetype=" + storeType); //$NON-NLS-1$
        log.fine("  -keystore=" + storeURL); //$NON-NLS-1$
        log.fine("  -provider=" + provider); //$NON-NLS-1$
        log.fine("  -v=" + verbose); //$NON-NLS-1$
      }
  }

  void start() throws CertificateException, KeyStoreException,
      InvalidKeyException, SignatureException, IOException,
      NoSuchAlgorithmException
  {
    if (Configuration.DEBUG)
      {
        log.entering(this.getClass().getName(), "start"); //$NON-NLS-1$
        log.fine("About to generate key-pair..."); //$NON-NLS-1$
      }
    // 1. generate a new key-pair
    keyPairGenerator.initialize(keySize);
    KeyPair kp = keyPairGenerator.generateKeyPair();
    PublicKey publicKey = kp.getPublic();
    PrivateKey privateKey = kp.getPrivate();

    // 2. generate a self-signed certificate
    if (Configuration.DEBUG)
      log.fine("About to generate a self-signed certificate..."); //$NON-NLS-1$
    byte[] derBytes = getSelfSignedCertificate(distinguishedName,
                                               publicKey,
                                               privateKey);
    if (Configuration.DEBUG)
      log.fine(Util.dumpString(derBytes, "derBytes ")); //$NON-NLS-1$
    CertificateFactory x509Factory = CertificateFactory.getInstance(Main.X_509);
    ByteArrayInputStream bais = new ByteArrayInputStream(derBytes);
    Certificate certificate = x509Factory.generateCertificate(bais);
    if (Configuration.DEBUG)
      log.fine("certificate = " + certificate); //$NON-NLS-1$

    // 3. store it, w/ its private key, associating them to alias
    Certificate[] chain = new Certificate[] { certificate };
    if (Configuration.DEBUG)
      log.fine("About to store newly generated material in key store..."); //$NON-NLS-1$
    store.setKeyEntry(alias, privateKey, keyPasswordChars, chain);

    // 4. persist the key store
    saveKeyStore();
    if (Configuration.DEBUG)
      log.exiting(this.getClass().getName(), "start"); //$NON-NLS-1$
  }

  // own methods --------------------------------------------------------------

  Parser getParser()
  {
    if (Configuration.DEBUG)
      log.entering(this.getClass().getName(), "getParser"); //$NON-NLS-1$
    Parser result = new ClasspathToolParser(Main.GENKEY_CMD, true);
    result.setHeader(Messages.getString("GenKeyCmd.57")); //$NON-NLS-1$
    result.setFooter(Messages.getString("GenKeyCmd.58")); //$NON-NLS-1$
    OptionGroup options = new OptionGroup(Messages.getString("GenKeyCmd.59")); //$NON-NLS-1$
    options.add(new Option(Main.ALIAS_OPT,
                           Messages.getString("GenKeyCmd.60"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.61")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _alias = argument;
      }
    });
    options.add(new Option(Main.KEYALG_OPT,
                           Messages.getString("GenKeyCmd.62"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.63")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _keyAlgorithm = argument;
      }
    });
    options.add(new Option(Main.KEYSIZE_OPT,
                           Messages.getString("GenKeyCmd.64"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.65")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _keySizeStr = argument;
      }
    });
    options.add(new Option(Main.SIGALG_OPT,
                           Messages.getString("GenKeyCmd.66"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.63")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _sigAlgorithm = argument;
      }
    });
    options.add(new Option(Main.DNAME_OPT,
                           Messages.getString("GenKeyCmd.68"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.69")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _dName = argument;
      }
    });
    options.add(new Option(Main.KEYPASS_OPT,
                           Messages.getString("GenKeyCmd.70"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.71")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _password = argument;
      }
    });
    options.add(new Option(Main.VALIDITY_OPT,
                           Messages.getString("GenKeyCmd.72"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.73")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _validityStr = argument;
      }
    });
    options.add(new Option(Main.STORETYPE_OPT,
                           Messages.getString("GenKeyCmd.74"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.75")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _ksType = argument;
      }
    });
    options.add(new Option(Main.KEYSTORE_OPT,
                           Messages.getString("GenKeyCmd.76"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.77")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _ksURL = argument;
      }
    });
    options.add(new Option(Main.STOREPASS_OPT,
                           Messages.getString("GenKeyCmd.78"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.71")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _ksPassword = argument;
      }
    });
    options.add(new Option(Main.PROVIDER_OPT,
                           Messages.getString("GenKeyCmd.80"), //$NON-NLS-1$
                           Messages.getString("GenKeyCmd.81")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        _providerClassName = argument;
      }
    });
    options.add(new Option(Main.VERBOSE_OPT,
                           Messages.getString("GenKeyCmd.82")) //$NON-NLS-1$
    {
      public void parsed(String argument) throws OptionException
      {
        verbose = true;
      }
    });
    result.add(options);
    if (Configuration.DEBUG)
      log.exiting(this.getClass().getName(), "getParser", result); //$NON-NLS-1$
    return result;
  }

  /**
   * @param size the desired key size as a string.
   * @throws NumberFormatException if the string does not represent a valid
   *           decimal integer value.
   */
  private void setKeySize(String size)
  {
    if (size == null || size.trim().length() == 0)
      this.keySize = DEFAULT_KEY_SIZE;
    else
      {
        size = size.trim();
        keySize = Integer.parseInt(size);
        // When generating a DSA key pair, the key size must be in the range
        // from 512 to 1024 bits, and must be a multiple of 64. The default
        // key size for any algorithm is 1024 bits
        if (keySize < 1)
          throw new IllegalArgumentException(Messages.getString("GenKeyCmd.54")); //$NON-NLS-1$
      }
  }

  /**
   * @param name the X.500 distinguished name of the principal for whom the
   *          key/certificate are being generated.
   * @throws UnsupportedCallbackException if no implementation of a name
   *           callback is available.
   * @throws IOException if an I/O related exception occurs during the process.
   * @throws IllegalArgumentException if the designated, or captured, value is
   *           not a valid X.500 distinguished name.
   */
  private void setDName(String name) throws IOException,
      UnsupportedCallbackException
  {
    if (name != null && name.trim().length() > 0)
      name = name.trim();
    else
      {
        // prompt user to provide one
        String dnTxt = Messages.getString("GenKeyCmd.0"); //$NON-NLS-1$
        String oDefault =  Messages.getString("GenKeyCmd.6"); //$NON-NLS-1$
        String lDefault =  Messages.getString("GenKeyCmd.7"); //$NON-NLS-1$
        String stDefault = Messages.getString("GenKeyCmd.8"); //$NON-NLS-1$
        String cDefault =  Messages.getString("GenKeyCmd.9"); //$NON-NLS-1$
        String cnPrompt = Messages.getString("GenKeyCmd.10"); //$NON-NLS-1$
        String oPrompt =  Messages.getFormattedString("GenKeyCmd.11", oDefault); //$NON-NLS-1$
        String ouPrompt = Messages.getString("GenKeyCmd.13"); //$NON-NLS-1$
        String lPrompt =  Messages.getFormattedString("GenKeyCmd.14", lDefault); //$NON-NLS-1$
        String stPrompt = Messages.getFormattedString("GenKeyCmd.16", stDefault); //$NON-NLS-1$
        String cPrompt =  Messages.getFormattedString("GenKeyCmd.18", cDefault); //$NON-NLS-1$

        TextOutputCallback dnCB = new TextOutputCallback(TextOutputCallback.INFORMATION,
                                                         dnTxt);
        TextInputCallback cnCB = new TextInputCallback(cnPrompt);
        TextInputCallback oCB =  new TextInputCallback(oPrompt, oDefault);
        TextInputCallback ouCB = new TextInputCallback(ouPrompt);
        TextInputCallback lCB =  new TextInputCallback(lPrompt, lDefault);
        TextInputCallback sCB =  new TextInputCallback(stPrompt, stDefault);
        TextInputCallback cCB =  new TextInputCallback(cPrompt, cDefault);
        getCallbackHandler().handle(new Callback[] { dnCB, cnCB, oCB, ouCB, lCB, sCB, cCB });
        StringBuilder sb = new StringBuilder();

        // handle CN
        name = parseUserPrompt(cnCB);
        if (name != null && name.length() > 0)
          sb.append("CN=").append(name); //$NON-NLS-1$

        // handle O
        name = parseUserPrompt(oCB);
        if (name != null && name.length() > 0)
          sb.append(",O=").append(name); //$NON-NLS-1$

        // handle OU
        name = parseUserPrompt(ouCB);
        if (name != null && name.length() > 0)
          sb.append(",OU=").append(name.trim()); //$NON-NLS-1$

        // handle L
        name = parseUserPrompt(lCB);
        if (name != null && name.length() > 0)
          sb.append(",L=").append(name.trim()); //$NON-NLS-1$

        // handle ST
        name = parseUserPrompt(sCB);
        if (name != null && name.length() > 0)
          sb.append(",ST=").append(name.trim()); //$NON-NLS-1$

        // handle C
        name = parseUserPrompt(cCB);
        if (name != null && name.length() > 0)
          sb.append(",C=").append(name.trim()); //$NON-NLS-1$

        name = sb.toString().trim();
      }
    if (Configuration.DEBUG)
      log.fine("dName=[" + name + "]"); //$NON-NLS-1$ //$NON-NLS-2$
    distinguishedName = new X500DistinguishedName(name);
  }

  private String parseUserPrompt(TextInputCallback ticb)
  {
    String result = ticb.getText();
    if (result == null || result.trim().length() == 0)
      result = ticb.getDefaultText();
    else if (result.trim().equals(".")) //$NON-NLS-1$
      result = null;
    else
      result = result.trim();

    return result;
  }
}