/**
 * @file tlsSe050Client.cpp
 * @author NXP Semiconductors
 * @version 1.0
 * @par License
 *
 * Copyright 2019,2020 NXP
 * SPDX-License-Identifier: Apache-2.0
 *
 * @par Description:
 * Simple TLS client
 * - Fetch client certificate from provisioned SE
 * - Load OpenSSL engine
 * - Establish TLS connection (use client key pair provisioned in SE) and send message#1
 * - Close TLS connection
 * - Close comm. link of OpenSSL engine with SE
 * - Fetch client certificate from provisioned SE
 * - Re-open comm. link of OpenSSL engine with SE
 * - Establish TLS connection (use client key pair provisioned in SE) and send message#2
 * - Close TLS connection
 *
 * Precondition:
 * - SE (SE050 or A71CH) has been provisioned with appropriate credentials
 * - Server side has been setup and has been provisioned with appropriate credentials
 *
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <fcntl.h>
#include <openssl/ssl.h>
#include <openssl/engine.h>

#define SSS_USE_FTR_FILE
#define FTR_FILE_SYSTEM

#include "snw_common.h"

/* App version */
const int v_major = 0;
const int v_minor = 9;
const int v_patch = 2;

int certVerifyCb(int preverifyOk, X509_STORE_CTX *pX509CTX)
{
    char szData[256];
    X509 *cert = X509_STORE_CTX_get_current_cert(pX509CTX);
    int depth = X509_STORE_CTX_get_error_depth(pX509CTX);

    if (!preverifyOk) {
        int err = X509_STORE_CTX_get_error(pX509CTX);
        printf("Error with certificate at depth: %i\n", depth);
        X509_NAME_oneline(X509_get_issuer_name(cert), szData, 256);
        printf(" issuer = %s\n", szData);
        X509_NAME_oneline(X509_get_subject_name(cert), szData, 256);
        printf(" subject = %s\n", szData);
        printf(" err %i:%s\n", err, X509_verify_cert_error_string(err));
    }
    else {
        printf("Certificate at depth: %i\n", depth);
        X509_NAME_oneline(X509_get_issuer_name(cert), szData, 256);
        printf(" issuer = %s\n", szData);
        X509_NAME_oneline(X509_get_subject_name(cert), szData, 256);
        printf(" subject = %s\n", szData);
    }
    return preverifyOk;
}

#define MAX_DER_CERT_SIZE    1024
#define MAX_DATA_OBJECT_SIZE 1024

int main(int argc, char **argv)
{
    int nStatus = 0;
    ENGINE *e;
    const SSL_METHOD *method;
    SSL_CTX *pSSLContext;
    SSL *pSSLHandle;
    char pDestinationURL[256];
    int nDestinationPort = 8080;
    int nRet = SE_TLS_CLIENT_OK;
    int sockfd;
    char fileRootCA[256];
    char keyType[256];
    char fileClientKey[256];
    X509 *certRcv;
    char clientMessage[256];
    int clientMessageLen;
    char engineId[256];
    U8 clientCerDer[MAX_DER_CERT_SIZE];
    size_t clientCerDerLen = MAX_DER_CERT_SIZE;
    char clientCertFile[256]; // Optional filename of client certificate
    int certId = 0;
    U8 dataObject[MAX_DATA_OBJECT_SIZE];
    U16 dataObjectLen = MAX_DATA_OBJECT_SIZE;
    int objectIndex = 0;
    U16 dataOffset;
    U16 dataLen;
    U8 clientCerDer_2[MAX_DER_CERT_SIZE];
    size_t clientCerDer_2Len = MAX_DER_CERT_SIZE;
    ex_sss_boot_ctx_t gdirectSeSessionCtx;

    printf("%s (Rev.%d.%d.%d)\n", argv[0], v_major, v_minor, v_patch);

    // Evaluate command line arguments
    if (argc < 5 || argc > 7) {
        printf("Usage: %s <ipAddress:port> <EC|RSA> <caCert.pem> <clientKey.pem|clientKeyRef.pem> [<clientCert.pem>]\n", argv[0]);
        nRet = SE_TLS_CLIENT_CMDLINE_ARGS;
        goto leaving;
    }

    memset(&gdirectSeSessionCtx, 0, sizeof(ex_sss_boot_ctx_t));

    // Deal with first argument: <address|name>:<port>
    // ***********************************************
    {
        unsigned int i;
        int fColonFound = 0;
        int nSuccess;

        if (strlen(argv[1]) >= sizeof(pDestinationURL)) {
            // A bit too cautious (as port number may also be attached)
            nRet = SE_TLS_CLIENT_BUFFER_TOO_SMALL;
            goto leaving;
        }

        for (i = 0; i < strlen(argv[1]); i++) {
            if (argv[1][i] == ':') {
                strncpy(pDestinationURL, argv[1], i);
                pDestinationURL[i] = 0;
                fColonFound = 1;
                // printf("servername/address: %s\n", pDestinationURL);
                break;
            }
            else {
                // Simply copy the full argument
                strcpy(pDestinationURL, argv[1]);
            }
        }

        if ((fColonFound == 1) && (i != 0)) {
            nSuccess = sscanf(&argv[1][i], ":%5u[0-9]", (unsigned int *)&nDestinationPort);
            if (nSuccess != 1) {
                nRet = SE_TLS_CLIENT_ILLEGAL_PORT_NR;
                goto leaving;
            }
        }
        else {
            // Choose default value for port
            nDestinationPort = 8080;
        }
    }
    printf("\t servername:port = %s:%d\n", pDestinationURL, nDestinationPort);

    // Deal with second argument: key type (either EC or RSA for now)
    // ***************************************************************
    if (strlen(argv[2]) >= sizeof(keyType)) {
        nRet = SE_TLS_CLIENT_BUFFER_TOO_SMALL;
        goto leaving;
    }
    strcpy(keyType, argv[2]);
    if ( (strcmp(keyType, "RSA") != 0) && (strcmp(keyType, "EC") != 0) ) {
        printf("\t keyType: %s is not defined, choose from EC or RSA.\n", keyType);
        nRet = SE_TLS_CLIENT_CMDLINE_ARGS;
        goto leaving;
    }
    printf("\t keyType: %s\n", keyType);

    // Deal with third argument: root CA certificate
    // **********************************************
    if (strlen(argv[3]) >= sizeof(fileRootCA)) {
        nRet = SE_TLS_CLIENT_BUFFER_TOO_SMALL;
        goto leaving;
    }
    strcpy(fileRootCA, argv[3]);
    printf("\t rootCA: %s\n", fileRootCA);

    // Deal with fourth argument: key or reference key
    // **********************************************
    if (strlen(argv[4]) >= sizeof(fileClientKey)) {
        nRet = SE_TLS_CLIENT_BUFFER_TOO_SMALL;
        goto leaving;
    }
    strcpy(fileClientKey, argv[4]);
    printf("\t clientKey: %s\n", fileClientKey);

    // Deal with optional fifth argument
    // **********************************
    if (argc == 6) {
        if (strlen(argv[5]) >= sizeof(clientCertFile)) {
            nRet = SE_TLS_CLIENT_BUFFER_TOO_SMALL;
            goto leaving;
        }
        strcpy(clientCertFile, argv[5]);
        printf("\t clientCertFile: %s\n", clientCertFile);
    }
    else {
        clientCertFile[0] = 0;
    }

    strcpy(clientMessage, "Hello to Server from TLS client using credentials stored in Secure Element.\n");
    clientMessageLen = strlen(clientMessage);

    nRet = wrapConnectToSe(&gdirectSeSessionCtx);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Failed to connect to Secure Element.\n");
        goto leaving;
    }

    // Ensure the matching TLS Client certificate has been provisioned before running the demo
    if ( strcmp(keyType, "RSA") == 0)  {
        certId = OBJID_DEMO_RSA_TLS_CLIENT_CERT;
    }
    else if (strcmp(keyType, "EC") == 0) {
        certId = OBJID_DEMO_EC_TLS_CLIENT_CERT;
    }
    else {
        printf("Don't know about keyType %s (leaving)\n", keyType);
        goto leaving;
    }
// This initial certificate fetch fails on A71CH!
#if 1
    nRet = seGetClientCertificate(&(gdirectSeSessionCtx.ks), certId, clientCerDer, &clientCerDerLen);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Failed to retrieve client certificate.\n");
        goto leaving;
    }
#endif

    wrapDisconnectFromSe(&gdirectSeSessionCtx);

    SSL_load_error_strings();
    OpenSSL_add_all_algorithms();

    if (SSL_library_init() < 0) {
        nRet = SE_TLS_CLIENT_SSL_LIB_INIT_ERROR;
        goto leaving;
    }

#if (OPENSSL_VERSION_NUMBER < 0x10101000L)
    method = TLSv1_2_method();
#else
    method = TLS_method();
#endif

    if ((pSSLContext = SSL_CTX_new(method)) == NULL) {
        printf("SSL_CTX_new failed - Unable to create SSL Context\n");
        nRet = SE_TLS_CLIENT_SSL_INIT_ERROR;
        goto leaving;
    }

#if SSS_HAVE_A71CH
    strcpy(engineId, "e4sss_a71ch");
#elif SSS_HAVE_SE05X
    strcpy(engineId, "e4sss");
#endif

    if (!(e = ENGINE_by_id(engineId)))
    {
        fprintf(stderr, "Error finding OpenSSL Engine by id (id = %s)\n", engineId);
        nRet = SE_ERR_SE_LOADING_ENGINE_ERR;
        goto leaving;
    }
    else
    {
        unsigned int logLevel = 0x05;
        fprintf(stderr, "Setting log level OpenSSL-engine %s to 0x%02X.\n", engineId, logLevel);
        // Illustrates setting log level of e4sss engine.
        // 0x04 : Error message
        // 0x02 : Debug messages
        // 0x01 : Flow messages
        // (0x07 corresponds to all, which is the default)
        ENGINE_ctrl(e, ENGINE_CMD_BASE, logLevel, NULL, NULL);
    }

    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockfd == -1) {
        nRet = SE_TLS_CLIENT_TCP_SETUP_ERROR;
        goto leaving;
    }

    if (!SSL_CTX_load_verify_locations(pSSLContext, fileRootCA, NULL)) {
        nRet = SE_TLS_CLIENT_SSL_CERT_ERROR;
        goto leaving;
    }

    if (clientCertFile[0] != 0) {
        if (!SSL_CTX_use_certificate_file(pSSLContext, clientCertFile, SSL_FILETYPE_PEM)) {
            printf("Client Certificate (%s) Loading error.\n", clientCertFile);
            nRet = SE_TLS_CLIENT_SSL_CERT_ERROR;
            goto leaving;
        }
    }
    else if (!SSL_CTX_use_certificate_ASN1(pSSLContext, clientCerDerLen, clientCerDer)) {
        printf("Client Certificate Loading error.\n");
        nRet = SE_TLS_CLIENT_SSL_CERT_ERROR;
        goto leaving;
    }

    if (SSL_CTX_use_PrivateKey_file(pSSLContext, fileClientKey, SSL_FILETYPE_PEM) != 1){
        printf("Client Private Key Loading error.\n");
        nRet = SE_TLS_CLIENT_SSL_KEY_ERROR;
        goto leaving;
    }

    SSL_CTX_set_verify(pSSLContext, SSL_VERIFY_PEER, certVerifyCb);
    // SSL_CTX_set_verify(pSSLContext, SSL_VERIFY_PEER, NULL);

    pSSLHandle = SSL_new(pSSLContext);

    nRet = snwTcpConnect(sockfd, pDestinationURL, nDestinationPort);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("TCP Connection error.\n");
        goto leaving;
    }

    SSL_set_fd(pSSLHandle, sockfd);

    nRet = snwSetSocketNonBlocking(sockfd);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Unable to set the socket to Non-Blocking.\n");
        goto leaving;
    }

    nRet = snwSslConnect(pSSLHandle, sockfd, 2000);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Unable to establish ssl session.\n");
        goto leaving;
    }

    if (X509_V_OK != SSL_get_verify_result(pSSLHandle)) {
        printf("Server Certificate Verification failed");
        nRet = SE_TLS_CLIENT_SSL_CONNECT_ERROR;
        goto leaving;
    }

    // Ensure a valid certificate was returned, otherwise no certificate exchange happened!
    if (NULL == (certRcv = SSL_get_peer_certificate(pSSLHandle)) ) {
        printf(" No certificate exchange happened");
        nRet = SE_TLS_CLIENT_SSL_CONNECT_ERROR;
        goto leaving;
    }
    else {
        X509_NAME *subj;
        char szData[256];

        if ((subj = X509_get_subject_name(certRcv)) &&
                (X509_NAME_get_text_by_NID(subj, NID_commonName, szData, 256) > 0)) {
            printf("Peer Certificate CN: %s\n", szData);
        }
        X509_free(certRcv);
    }

    nRet = snwSslWrite(pSSLHandle, sockfd, (unsigned char *)clientMessage, &clientMessageLen, 2000);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Unable to send message to server: nRet = %d.\n", nRet);
        goto leaving;
    }

    nRet = SSL_shutdown(pSSLHandle);
    if (nRet == 0) {
        sleep(1);
        printf("SSL_shutdown: Repeat shutdown.\n");
        nRet = SSL_shutdown(pSSLHandle);
    }

    if (nRet == 1) {
        printf("SSL_shutdown: successful.\n");
        nRet = SE_TLS_CLIENT_OK;
    }
    else if (nRet == 0) {
        printf("SSL_shutdown: not yet finished (second attempt).\n");
    }
    else {
        int errorCode;
        errorCode = SSL_get_error(pSSLHandle, nRet);
        printf("SSL_shutdown: error on shutdown (nRet=%d, SSL_error_code=%d)\n",
            nRet, errorCode);
        // if (errorCode == SSL_ERROR_ZERO_RETURN )
    }

    nRet = SSL_clear(pSSLHandle);
    if (nRet == 0) {
        int errorCode;
        printf("SSL_clear failed.\n");
        errorCode = SSL_get_error(pSSLHandle, nRet);
        printf("errorCode: %d\n", errorCode);
    }
    else if (nRet == 1) {
        printf("SSL_clear successful.\n");
        nRet = SE_TLS_CLIENT_OK;
    }

    // NOTE: Close engine connection to SE via Engine control interface
    fprintf(stderr, "Close connection to secure element through Engine control interface (Engine=%s).\n", engineId);
    ENGINE_ctrl(e, ENGINE_CMD_BASE+2, 0, NULL, NULL);

    // To demonstrate one can alternate OpenSSL engine access and direct access
    // to the SE, another direct call to the SE
    printf("Re-establish connection to SE ...\n");

    nRet = wrapConnectToSe(&gdirectSeSessionCtx);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Failed to connect to Secure Element.\n");
        goto leaving;
    }

    printf("Successfully established connection to SE\n");
    {
        nRet = seGetClientCertificate(&(gdirectSeSessionCtx.ks), certId, clientCerDer_2, &clientCerDer_2Len);
        if (nRet != SE_TLS_CLIENT_OK) {
            printf("Failed to retrieve client certificate.\n");
            goto leaving;
        }
        snwPrintDataAsHex(clientCerDer_2, clientCerDer_2Len);
    }

    wrapDisconnectFromSe(&gdirectSeSessionCtx);

    // NOTE: Open engine connection to SE via Engine control interface
    fprintf(stderr, "Open connection to secure element through Engine control interface (Engine=%s).\n", engineId);
    ENGINE_ctrl(e, ENGINE_CMD_BASE+1, 0, NULL, NULL);

    if ((pSSLContext = SSL_CTX_new(method)) == NULL) {
        printf("SSL_CTX_new failed - Unable to create SSL Context\n");
        nRet = SE_TLS_CLIENT_SSL_INIT_ERROR;
        goto leaving;
    }

    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockfd == -1) {
        nRet = SE_TLS_CLIENT_TCP_SETUP_ERROR;
        goto leaving;
    }

    if (!SSL_CTX_load_verify_locations(pSSLContext, fileRootCA, NULL)) {
        nRet = SE_TLS_CLIENT_SSL_CERT_ERROR;
        goto leaving;
    }

    if (clientCertFile[0] != 0) {
        if (!SSL_CTX_use_certificate_file(pSSLContext, clientCertFile, SSL_FILETYPE_PEM)) {
            printf("Client Certificate (%s) Loading error.\n", clientCertFile);
            nRet = SE_TLS_CLIENT_SSL_CERT_ERROR;
            goto leaving;
        }
    }

    else if (!SSL_CTX_use_certificate_ASN1(pSSLContext, clientCerDer_2Len, clientCerDer_2)) {
        printf("Client Certificate Loading error.\n");
        nRet = SE_TLS_CLIENT_SSL_CERT_ERROR;
        goto leaving;
    }

    if (SSL_CTX_use_PrivateKey_file(pSSLContext, fileClientKey, SSL_FILETYPE_PEM) != 1){
        printf("Client Private Key Loading error.\n");
        nRet = SE_TLS_CLIENT_SSL_KEY_ERROR;
        goto leaving;
    }

    SSL_CTX_set_verify(pSSLContext, SSL_VERIFY_PEER, certVerifyCb);
    // SSL_CTX_set_verify(pSSLContext, SSL_VERIFY_PEER, NULL);

    pSSLHandle = SSL_new(pSSLContext);

    nRet = snwTcpConnect(sockfd, pDestinationURL, nDestinationPort);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("TCP Connection error.\n");
        goto leaving;
    }

    SSL_set_fd(pSSLHandle, sockfd);

    nRet = snwSetSocketNonBlocking(sockfd);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Unable to set the socket to Non-Blocking.\n");
        goto leaving;
    }

    nRet = snwSslConnect(pSSLHandle, sockfd, 2000);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Unable to establish ssl session.\n");
        goto leaving;
    }

    if (X509_V_OK != SSL_get_verify_result(pSSLHandle)) {
        printf("Server Certificate Verification failed");
        nRet = SE_TLS_CLIENT_SSL_CONNECT_ERROR;
        goto leaving;
    }

    // Ensure a valid certificate was returned, otherwise no certificate exchange happened!
    if (NULL == (certRcv = SSL_get_peer_certificate(pSSLHandle)) ) {
        printf(" No certificate exchange happened");
        nRet = SE_TLS_CLIENT_SSL_CONNECT_ERROR;
        goto leaving;
    }
    else {
        X509_NAME *subj;
        char szData[256];

        if ((subj = X509_get_subject_name(certRcv)) &&
                (X509_NAME_get_text_by_NID(subj, NID_commonName, szData, 256) > 0)) {
            printf("Peer Certificate CN: %s\n", szData);
        }
        X509_free(certRcv);
    }

    strcpy(clientMessage, "Another message from TLS client using credentials stored in Secure Element.\n");
    clientMessageLen = strlen(clientMessage);

    nRet = snwSslWrite(pSSLHandle, sockfd, (unsigned char *)clientMessage, &clientMessageLen, 2000);
    if (nRet != SE_TLS_CLIENT_OK) {
        printf("Unable to send message to server: nRet = %d.\n", nRet);
        goto leaving;
    }

    nRet = SSL_shutdown(pSSLHandle);
    if (nRet == 0) {
        sleep(1);
        printf("SSL_shutdown: Repeat shutdown.\n");
        nRet = SSL_shutdown(pSSLHandle);
    }

    if (nRet == 1) {
        printf("SSL_shutdown: successful.\n");
        nRet = SE_TLS_CLIENT_OK;
    }
    else if (nRet == 0) {
        printf("SSL_shutdown: not yet finished (second attempt).\n");
    }
    else {
        int errorCode;
        errorCode = SSL_get_error(pSSLHandle, nRet);
        printf("SSL_shutdown: error on shutdown (nRet=%d, SSL_error_code=%d)\n",
            nRet, errorCode);
        // if (errorCode == SSL_ERROR_ZERO_RETURN )
    }

    nRet = SSL_clear(pSSLHandle);
    if (nRet == 0) {
        int errorCode;
        printf("SSL_clear failed.\n");
        errorCode = SSL_get_error(pSSLHandle, nRet);
        printf("errorCode: %d\n", errorCode);
    }
    else if (nRet == 1) {
        printf("SSL_clear successful.\n");
        nRet = SE_TLS_CLIENT_OK;
    }

    printf("\n\t servername:port = %s:%d\n", pDestinationURL, nDestinationPort);
    printf("\t rootCA: %s\n", fileRootCA);
    // printf("\t Retrieved client certificate from SE (stored at index 0)\n");
    printf("\t clientKey: %s\n\n", fileClientKey);

leaving:
    printf("\n******** TLS Client Example (Credentials in Secure Element) = %s ********\n",
        (nRet == SE_TLS_CLIENT_OK) ? "Pass" : "Fail");
    nStatus = (nRet == SE_TLS_CLIENT_OK) ? OK_STATUS : FAILURE_STATUS;

    return nStatus;
}