#!/usr/bin/env python
# Copyright 2018 The Chromium Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import sys

sys.path += ['../..']

import gencerts


def add_excluded_name_constraints(cert, num_dns, num_ip, num_dirnames, num_uri):
  cert.get_extensions().set_property('nameConstraints', '@nameConstraints_info')
  constraints = cert.config.get_section('nameConstraints_info')
  for i in range(num_dns):
    constraints.set_property('excluded;DNS.%i' % (i + 1), 'x%i.test' % i)
  for i in range(num_ip):
    b, c = divmod(i, 256)
    a, b = divmod(b, 256)
    constraints.set_property(
      'excluded;IP.%i' % (i + 1), '11.%i.%i.%i/255.255.255.255' % (a, b, c)
    )
  for i in range(num_dirnames):
    section_name = 'nameConstraints_dirname_x%i' % (i + 1)
    dirname = cert.config.get_section(section_name)
    dirname.set_property('commonName', '"x%i' % i)
    constraints.set_property('excluded;dirName.%i' % (i + 1), section_name)
  for i in range(num_uri):
    constraints.set_property('excluded;URI.%i' % (i + 1), 'http://xest/%i' % i)


def add_permitted_name_constraints(
  cert, num_dns, num_ip, num_dirnames, num_uri
):
  cert.get_extensions().set_property('nameConstraints', '@nameConstraints_info')
  constraints = cert.config.get_section('nameConstraints_info')
  for i in range(num_dns):
    constraints.set_property('permitted;DNS.%i' % (i + 1), 't%i.test' % i)
  for i in range(num_ip):
    b, c = divmod(i, 256)
    a, b = divmod(b, 256)
    constraints.set_property(
      'permitted;IP.%i' % (i + 1), '10.%i.%i.%i/255.255.255.255' % (a, b, c)
    )
  for i in range(num_dirnames):
    section_name = 'nameConstraints_dirname_p%i' % (i + 1)
    dirname = cert.config.get_section(section_name)
    dirname.set_property('commonName', '"t%i' % i)
    constraints.set_property('permitted;dirName.%i' % (i + 1), section_name)
  for i in range(num_uri):
    constraints.set_property('permitted;URI.%i' % (i + 1), 'http://test/%i' % i)


def add_sans(cert, num_dns, num_ip, num_dirnames, num_uri):
  cert.get_extensions().set_property('subjectAltName', '@san_info')
  sans = cert.config.get_section('san_info')
  for i in range(num_dns):
    sans.set_property('DNS.%i' % (i + 1), 't%i.test' % i)
  for i in range(num_ip):
    b, c = divmod(i, 256)
    a, b = divmod(b, 256)
    sans.set_property('IP.%i' % (i + 1), '10.%i.%i.%i' % (a, b, c))
  for i in range(num_dirnames):
    section_name = 'san_dirname%i' % (i + 1)
    dirname = cert.config.get_section(section_name)
    dirname.set_property('commonName', '"t%i' % i)
    sans.set_property('dirName.%i' % (i + 1), section_name)
  for i in range(num_uri):
    sans.set_property('URI.%i' % (i + 1), 'http://test/%i' % i)


# Self-signed root certificate.
root = gencerts.create_self_signed_root_certificate('Root')

# Use the same keys for all the chains. Fewer key files to check in, and also
# gives stability against re-ordering of the calls to |make_chain|.
intermediate_key = gencerts.get_or_generate_rsa_key(
  2048, gencerts.create_key_path('Intermediate')
)
target_key = gencerts.get_or_generate_rsa_key(
  2048, gencerts.create_key_path('t0')
)


def make_chain(name, doc, excluded, permitted, sans):
  # Intermediate certificate.
  intermediate = gencerts.create_intermediate_certificate('Intermediate', root)
  intermediate.set_key(intermediate_key)
  add_excluded_name_constraints(intermediate, **excluded)
  add_permitted_name_constraints(intermediate, **permitted)

  # Target certificate.
  target = gencerts.create_end_entity_certificate('t0', intermediate)
  target.set_key(target_key)
  add_sans(target, **sans)

  chain = [target, intermediate, root]
  gencerts.write_chain(doc, chain, '%s.pem' % name)


make_chain(
  'ok-all-types',
  "A chain containing a large number of name constraints and names,\n"
  "but below the limit.",
  excluded=dict(num_dns=418, num_ip=418, num_dirnames=418, num_uri=1025),
  permitted=dict(num_dns=418, num_ip=418, num_dirnames=418, num_uri=1025),
  sans=dict(num_dns=418, num_ip=418, num_dirnames=417, num_uri=1025),
)

make_chain(
  'toomany-all-types',
  "A chain containing a large number of different types of name\n"
  "constraints and names, above the limit.",
  excluded=dict(num_dns=419, num_ip=419, num_dirnames=419, num_uri=0),
  permitted=dict(num_dns=419, num_ip=419, num_dirnames=419, num_uri=0),
  sans=dict(num_dns=419, num_ip=419, num_dirnames=418, num_uri=0),
)

make_chain(
  'toomany-dns-excluded',
  "A chain containing a large number of excluded DNS name\n"
  "constraints and DNS names, above the limit.",
  excluded=dict(num_dns=1025, num_ip=0, num_dirnames=0, num_uri=0),
  permitted=dict(num_dns=0, num_ip=0, num_dirnames=0, num_uri=0),
  sans=dict(num_dns=1024, num_ip=0, num_dirnames=0, num_uri=0),
)
make_chain(
  'toomany-ips-excluded',
  "A chain containing a large number of excluded IP name\n"
  "constraints and IP names, above the limit.",
  excluded=dict(num_dns=0, num_ip=1025, num_dirnames=0, num_uri=0),
  permitted=dict(num_dns=0, num_ip=0, num_dirnames=0, num_uri=0),
  sans=dict(num_dns=0, num_ip=1024, num_dirnames=0, num_uri=0),
)
make_chain(
  'toomany-dirnames-excluded',
  "A chain containing a large number of excluded directory name\n"
  "constraints and directory names, above the limit.",
  excluded=dict(num_dns=0, num_ip=0, num_dirnames=1025, num_uri=0),
  permitted=dict(num_dns=0, num_ip=0, num_dirnames=0, num_uri=0),
  sans=dict(num_dns=0, num_ip=0, num_dirnames=1024, num_uri=0),
)

make_chain(
  'toomany-dns-permitted',
  "A chain containing a large number of permitted DNS name\n"
  "constraints and DNS names, above the limit.",
  excluded=dict(num_dns=0, num_ip=0, num_dirnames=0, num_uri=0),
  permitted=dict(num_dns=1025, num_ip=0, num_dirnames=0, num_uri=0),
  sans=dict(num_dns=1024, num_ip=0, num_dirnames=0, num_uri=0),
)
make_chain(
  'toomany-ips-permitted',
  "A chain containing a large number of permitted IP name\n"
  "constraints and IP names, above the limit.",
  excluded=dict(num_dns=0, num_ip=0, num_dirnames=0, num_uri=0),
  permitted=dict(num_dns=0, num_ip=1025, num_dirnames=0, num_uri=0),
  sans=dict(num_dns=0, num_ip=1024, num_dirnames=0, num_uri=0),
)
make_chain(
  'toomany-dirnames-permitted',
  "A chain containing a large number of permitted directory name\n"
  "constraints and directory names, above the limit.",
  excluded=dict(num_dns=0, num_ip=0, num_dirnames=0, num_uri=0),
  permitted=dict(num_dns=0, num_ip=0, num_dirnames=1025, num_uri=0),
  sans=dict(num_dns=0, num_ip=0, num_dirnames=1024, num_uri=0),
)

make_chain(
  'ok-different-types-dns',
  "A chain containing a large number of name constraints and names,\n"
  "but of different types, thus not triggering the limit.",
  excluded=dict(num_dns=0, num_ip=1025, num_dirnames=1025, num_uri=1025),
  permitted=dict(num_dns=0, num_ip=1025, num_dirnames=1025, num_uri=1025),
  sans=dict(num_dns=1025, num_ip=0, num_dirnames=0, num_uri=0),
)
make_chain(
  'ok-different-types-ips',
  "A chain containing a large number of name constraints and names,\n"
  "but of different types, thus not triggering the limit.",
  excluded=dict(num_dns=1025, num_ip=0, num_dirnames=1025, num_uri=1025),
  permitted=dict(num_dns=1025, num_ip=0, num_dirnames=1025, num_uri=1025),
  sans=dict(num_dns=0, num_ip=1025, num_dirnames=0, num_uri=0),
)
make_chain(
  'ok-different-types-dirnames',
  "A chain containing a large number of name constraints and names,\n"
  "but of different types, thus not triggering the limit.",
  excluded=dict(num_dns=1025, num_ip=1025, num_dirnames=0, num_uri=1025),
  permitted=dict(num_dns=1025, num_ip=1025, num_dirnames=0, num_uri=1025),
  sans=dict(num_dns=0, num_ip=0, num_dirnames=1025, num_uri=0),
)