package test;

import com.objsys.asn1j.runtime.Asn1DerDecodeBuffer;
import com.objsys.asn1j.runtime.Asn1DerEncodeBuffer;
import com.objsys.asn1j.runtime.Asn1Exception;
import com.objsys.asn1j.runtime.Asn1Null;
import com.objsys.asn1j.runtime.Asn1OctetString;
import ru.CryptoPro.JCP.ASN.CertificateExtensions.GeneralName;
import ru.CryptoPro.JCP.ASN.PKIX1Explicit88.AlgorithmIdentifier;
import ru.CryptoPro.JCP.ASN.PKIX1Explicit88.CertificateSerialNumber;
import ru.CryptoPro.JCP.ASN.PKIX1Explicit88.Name;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.CertID;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.OCSPRequest;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.OCSPResponse;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.OCSPVersion;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.ReqCert;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.Request;
import ru.CryptoPro.JCP.ASN.PKIXOCSP.TBSRequest;
import ru.CryptoPro.JCP.ASN.PKIXOCSP._SeqOfRequest;
import ru.CryptoPro.JCP.JCP;
import ru.CryptoPro.JCP.params.OID;
import ru.CryptoPro.JCPRequest.GostCertificateRequest;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.SignatureException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.List;
import java.util.Map;

/** @author i.karpov */
public class CPOCSPClientTest {

	private static final String CP_OCSP_URL = "http://www.cryptopro.ru/ocspnc/ocsp.srf";
	private static final String CP_CA = "http://www.cryptopro.ru/certsrv/";

	public static void main(String[] args) throws Exception {
		X509Certificate cert = createPrvKeyAndCert();
		process(CP_OCSP_URL, cert);
	}

	private static X509Certificate createPrvKeyAndCert()
		  throws NoSuchProviderException, NoSuchAlgorithmException, IOException, CertificateException, SignatureException, InvalidKeyException {

		KeyPairGenerator kg = KeyPairGenerator.getInstance(JCP.GOST_DEGREE_NAME, JCP.PROVIDER_NAME);
		KeyPair keys = kg.generateKeyPair();

		GostCertificateRequest r = new GostCertificateRequest();
		r.setPublicKeyInfo(keys.getPublic());
		r.setSubjectInfo("CN=V.Pupkin, OU=Security, O=CryptoPro, C=RU");
		r.encodeAndSign(keys.getPrivate());
		byte[] encodedCert = r.getEncodedCert(CP_CA);
		X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509").generateCertificate(new ByteArrayInputStream(encodedCert));

		return cert;
	}


	private static void process(String ocspUrl, X509Certificate cert) throws Exception {
		OCSPRequest r = createOCSPRequest(cert);
		Asn1DerEncodeBuffer encodedData = new Asn1DerEncodeBuffer();
		r.encode(encodedData);
		byte[] data = encodedData.getMsgCopy();

		HttpURLConnection con = call(ocspUrl, data);

		OCSPResponse ocspResponse = new OCSPResponse();
		ocspResponse.decode(new Asn1DerDecodeBuffer(getData(con)));

		System.out.println("OCSP OK");
	}

	private static OCSPRequest createOCSPRequest(X509Certificate cert) throws Exception {
		TBSRequest tbsRequest = new TBSRequest();
		tbsRequest.version = new OCSPVersion(1);
		tbsRequest.requestorName = getSubjectName(cert);
		tbsRequest.requestList = createRequestList(new X509Certificate[]{cert});
		return new OCSPRequest(tbsRequest);
	}

	private static _SeqOfRequest createRequestList(X509Certificate[] certs) throws Exception {
		_SeqOfRequest requestList = new _SeqOfRequest(certs.length);
		for (int i = 0; i < certs.length; i++) {
			X509Certificate cert = certs[i];

			CertID certID = new CertID();
			certID.hashAlgorithm = getHashAlgId();
			certID.issuerNameHash = new Asn1OctetString(digest(cert.getIssuerX500Principal().getEncoded()));
			certID.issuerKeyHash = new Asn1OctetString(digest(cert.getPublicKey().getEncoded()));
			certID.serialNumber = new CertificateSerialNumber(cert.getSerialNumber());

			ReqCert reqCert = new ReqCert();
			reqCert.set_certID(certID);
			requestList.elements[i] = new Request(reqCert);
		}

		return requestList;
	}

	private static byte[] getData(HttpURLConnection connection) throws IOException {
		byte[] data = new byte[connection.getContentLength()];
		InputStream is = connection.getInputStream();
		try {
			is.read(data);
		} finally {
			is.close();
		}
		return data;
	}

	private static HttpURLConnection call(String ocspUrl, byte[] data) throws IOException {
		HttpURLConnection con = (HttpURLConnection) new URL(ocspUrl).openConnection();

		con.setDoOutput(true);
		con.setDoInput(true);
		con.setRequestMethod("POST");
		con.setRequestProperty("Content-Type", "application/ocsp-request");
		con.setRequestProperty("Accept", "application/ocsp-response");
		con.setRequestProperty("Content-length", String.valueOf(data.length));

		System.out.println("content-length:" + data.length + " bytes");

		OutputStream out = con.getOutputStream();
		try {
			out.write(data);
			out.flush();
		} finally {
			out.close();
		}

		if (con.getResponseCode() != HttpURLConnection.HTTP_OK) {
			System.out.println(con.getResponseMessage());
			Map<String, List<String>> headerFields = con.getHeaderFields();
			for (String s : headerFields.keySet()) {
				System.out.println("key:" + s + " val:" + headerFields.get(s));
			}

			throw new IOException("Received HTTP error: " + con.getResponseCode() + " - " + con.getResponseMessage());
		}

		return con;
	}

	private static GeneralName getSubjectName(X509Certificate cert) throws Asn1Exception, IOException {
		final byte[] encodedName = cert.getSubjectX500Principal().getEncoded();
		final Name name = new Name();
		name.decode(new Asn1DerDecodeBuffer(encodedName));

		GeneralName gn = new GeneralName();
		gn.set_directoryName(name);
		return gn;
	}

	private static AlgorithmIdentifier getHashAlgId() {
		AlgorithmIdentifier hashAlgId = new AlgorithmIdentifier(new OID(JCP.GOST_DIGEST_OID).value);
		hashAlgId.parameters = new Asn1Null();
		return hashAlgId;
	}

	private static byte[] digest(byte[] data) throws NoSuchAlgorithmException, NoSuchProviderException {
		MessageDigest digest = MessageDigest.getInstance(JCP.GOST_DIGEST_NAME, JCP.PROVIDER_NAME);
		digest.update(data);
		return digest.digest();
	}
}