// Author: L V K Subhash Rayudu Battina
// Date: 2025-04-03
// Description: Converts a modern pkcs12 cert to a legacy format and writes it to a file
// Pre-requisites: Ensure you system's openssl version is 3.0 or above
// Steps to compile: g++ -o pkcs12_converter pkcs12_modern_to_legacy_converter.cpp -lcrypto -L/opt/homebrew/opt/openssl@3/lib -I/opt/homebrew/opt/openssl@3/include
// Steps to execute: ./pkcs12_converter   

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

// Static global variables for OpenSSL providers
static OSSL_PROVIDER* legacyProvider = nullptr;
static OSSL_PROVIDER* defaultProvider = nullptr;

// Cleanup function to unload OpenSSL providers
static void cleanupOpenSSL() {
    if (legacyProvider) OSSL_PROVIDER_unload(legacyProvider);
    if (defaultProvider) OSSL_PROVIDER_unload(defaultProvider);
}

// Function to initialize OpenSSL and load providers
void initializeOpenSSL() {
    std::cout << "[INFO] Initializing OpenSSL..." << std::endl;

    // Check OpenSSL version compatibility
    if (OpenSSL_version_num() < 0x30000000L) {
        throw std::runtime_error("OpenSSL 3.0 or later is required to load the legacy provider");
    }

    // Load the legacy provider
    std::cout << "[INFO] Loading legacy provider..." << std::endl;
    legacyProvider = OSSL_PROVIDER_load(NULL, "legacy");
    if (!legacyProvider) {
        std::cerr << "[ERROR] Failed to load legacy provider. Ensure OpenSSL is configured correctly." << std::endl;
        throw std::runtime_error("Failed to load legacy provider");
    }

    // Load the default provider
    std::cout << "[INFO] Loading default provider..." << std::endl;
    defaultProvider = OSSL_PROVIDER_load(NULL, "default");
    if (!defaultProvider) {
        std::cerr << "[ERROR] Failed to load default provider. Ensure OpenSSL is configured correctly." << std::endl;
        throw std::runtime_error("Failed to load default provider");
    }

    // Unload providers at program exit to prevent resource leaks
    atexit(cleanupOpenSSL);

    std::cout << "[INFO] OpenSSL initialized with legacy and default providers loaded." << std::endl;
}

// Function to read a file into a vector of bytes
std::vector readFile(const std::string& filePath) {
    std::cout << "[INFO] Reading file: " << filePath << std::endl;
    std::ifstream file(filePath, std::ios::binary);
    if (!file) {
        throw std::runtime_error("Failed to open file: " + filePath);
    }
    std::vector data((std::istreambuf_iterator(file)), std::istreambuf_iterator());
    std::cout << "[INFO] Successfully read " << data.size() << " bytes from file: " << filePath << std::endl;
    return data;
}

// Function to write a vector of bytes to a file
void writeFile(const std::string& filePath, const std::vector& data) {
    std::cout << "[INFO] Writing to file: " << filePath << std::endl;
    std::ofstream file(filePath, std::ios::binary);
    if (!file) {
        throw std::runtime_error("Failed to write to file: " + filePath);
    }
    file.write(reinterpret_cast(data.data()), data.size());
    std::cout << "[INFO] Successfully wrote " << data.size() << " bytes to file: " << filePath << std::endl;
}

// Function to validate a PKCS#12 file
void validatePKCS12(const std::vector& pkcs12Data, const std::string& passphrase) {
    std::cout << "[INFO] Validating PKCS#12 file with passphrase: " << passphrase << std::endl;
    BIO* bio = BIO_new_mem_buf(pkcs12Data.data(), pkcs12Data.size());
    if (!bio) {
        throw std::runtime_error("Failed to create BIO for PKCS#12 data");
    }

    PKCS12* pkcs12 = d2i_PKCS12_bio(bio, nullptr);
    BIO_free(bio);
    if (!pkcs12) {
        throw std::runtime_error("Failed to parse PKCS#12 data");
    }

    EVP_PKEY* privateKey = nullptr;
    X509* certificate = nullptr;
    STACK_OF(X509)* caChain = nullptr;

    if (!PKCS12_parse(pkcs12, passphrase.c_str(), &privateKey, &certificate, &caChain)) {
        PKCS12_free(pkcs12);
        throw std::runtime_error("Failed to validate PKCS#12 with the provided passphrase");
    }

    std::cout << "[INFO] PKCS#12 file validated successfully." << std::endl;

    PKCS12_free(pkcs12);
    EVP_PKEY_free(privateKey);
    X509_free(certificate);
    sk_X509_pop_free(caChain, X509_free);
}

// Function to create a new PKCS#12 file with specific encryption algorithms
std::vector createPKCS12fromPKCS12(const std::vector& inputData, const std::string& passphrase) {
    std::cout << "[INFO] Creating new PKCS#12 file from input data..." << std::endl;

    // Parse the original PKCS#12 file
    std::cout << "[INFO] Parsing original PKCS#12 file..." << std::endl;
    BIO* bp = BIO_new_mem_buf(inputData.data(), (int)inputData.size());
    if (!bp) {
        throw std::runtime_error("Failed to create BIO for input data");
    }

    PKCS12* originalPKCS12 = NULL;
    d2i_PKCS12_bio(bp, &originalPKCS12);
    BIO_free(bp);
    if (!originalPKCS12) {
        throw std::runtime_error("Failed to parse PKCS#12 data");
    }

    EVP_PKEY* privateKey = nullptr;
    X509* x509 = nullptr;
    STACK_OF(X509)* caChain = NULL;

    if (!PKCS12_parse(originalPKCS12, passphrase.c_str(), &privateKey, &x509, &caChain)) {
        PKCS12_free(originalPKCS12);
        throw std::runtime_error("Failed to parse PKCS#12 with the original passphrase");
    }
    PKCS12_free(originalPKCS12);

    std::cout << "[INFO] Successfully parsed original PKCS#12 file." << std::endl;

    // Create a new PKCS#12 structure with the specified encryption algorithms
    std::cout << "[INFO] Creating new PKCS#12 structure..." << std::endl;
    int nid_key = NID_pbe_WithSHA1And3_Key_TripleDES_CBC;
    int nid_cert = NID_pbe_WithSHA1And40BitRC2_CBC;
    
    // Use SHA-1 as the MAC algorithm
    PKCS12* newPKCS12 = PKCS12_create_ex(
        passphrase.c_str(), "SampleCert", privateKey, x509,
        caChain, NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
        NID_pbe_WithSHA1And40BitRC2_CBC,
        PKCS12_DEFAULT_ITER, -1, 0, nullptr, nullptr
    );
    char* outPKCS12 = nullptr;
    int outPKCS12Len = 0;
    if (newPKCS12) {
        const char* pswd = passphrase.c_str();
        if (PKCS12_set_mac(newPKCS12, pswd, strlen(pswd), nullptr, 0, 1, EVP_sha1()) == 1) {
            int nP12Len = 0;
            BIO* outBioP12 = BIO_new(BIO_s_mem());
            i2d_PKCS12_bio(outBioP12, newPKCS12);
            nP12Len = BIO_pending(outBioP12);

            outPKCS12 = static_cast(calloc(1, nP12Len + 1));
            if (outPKCS12) {
                BIO_read(outBioP12, reinterpret_cast(outPKCS12), nP12Len);
                outPKCS12Len = nP12Len;
            } else {
                std::cerr << "[ERROR] Memory allocation failed for outPKCS12." << std::endl;
            }

            BIO_free(outBioP12);
        } else {
            std::cerr << "[ERROR] Failed to add P12 MAC." << std::endl;
        }

    } else {
        // EVP_PKEY_free(privateKey);
        // X509_free(x509);
        // sk_X509_pop_free(caChain, X509_free);
        std::cerr << "[ERROR] Failed to create P12." << std::endl;
        throw std::runtime_error("Failed to create new PKCS#12 structure");
    }

    // Serialize the new PKCS#12 structure to memory
    std::cout << "[INFO] Serializing new PKCS#12 structure..." << std::endl;
    BIO* outputBio = BIO_new(BIO_s_mem());
    if (!i2d_PKCS12_bio(outputBio, newPKCS12)) {
        PKCS12_free(newPKCS12);
        BIO_free(outputBio);
        EVP_PKEY_free(privateKey);
        X509_free(x509);
        sk_X509_pop_free(caChain, X509_free);
        throw std::runtime_error("Failed to serialize new PKCS#12 structure");
    }
    PKCS12_free(newPKCS12);

    char* outputData = nullptr;
    long outputLength = BIO_get_mem_data(outputBio, &outputData);
    std::vector result(outputData, outputData + outputLength);
    BIO_free(outputBio);

    std::cout << "[INFO] Successfully created new PKCS#12 file." << std::endl;

    // Free resources
    EVP_PKEY_free(privateKey);
    X509_free(x509);
    sk_X509_pop_free(caChain, X509_free);

    return result;
}

int GeneratePKCS12(char* passPhrase, char* friendlyName, EVP_PKEY* privateKey,
    X509* cert, STACK_OF(X509)* caCerts, char** outPKCS12, int* outPKCS12Len)
{
    // Load the legacy provider
    OSSL_PROVIDER* legacy = OSSL_PROVIDER_load(nullptr, "legacy");
    OSSL_PROVIDER* defaultProvider = OSSL_PROVIDER_load(nullptr, "default");

    if (legacy != nullptr) {
        PKCS12* p12OutCert = PKCS12_create_ex(
            passPhrase, friendlyName, privateKey, cert,
            caCerts, NID_pbe_WithSHA1And3_Key_TripleDES_CBC,
            NID_pbe_WithSHA1And40BitRC2_CBC,
            PKCS12_DEFAULT_ITER, -1, 0, nullptr, nullptr
        );

        if (p12OutCert) {
            const char* pswd = passPhrase;
            if (PKCS12_set_mac(p12OutCert, pswd, strlen(pswd), nullptr, 0, 1, EVP_sha1()) == 1) {
                int nP12Len = 0;
                BIO* outBioP12 = BIO_new(BIO_s_mem());
                i2d_PKCS12_bio(outBioP12, p12OutCert);
                nP12Len = BIO_pending(outBioP12);

                *outPKCS12 = static_cast(calloc(1, nP12Len + 1));
                if (*outPKCS12) {
                    BIO_read(outBioP12, *outPKCS12, nP12Len);
                    *outPKCS12Len = nP12Len;
                } else {
                    std::cerr << "[ERROR] Memory allocation failed for outPKCS12." << std::endl;
                }

                BIO_free(outBioP12);
            } else {
                std::cerr << "[ERROR] Failed to add P12 MAC." << std::endl;
            }

            PKCS12_free(p12OutCert);
        } else {
            std::cerr << "[ERROR] Failed to create P12." << std::endl;
        }

        OSSL_PROVIDER_unload(legacy);
        OSSL_PROVIDER_unload(defaultProvider);
    } else {
        char buf[256];
        unsigned long err = ERR_get_error();
        ERR_error_string_n(err, buf, sizeof(buf));
        std::cerr << "[ERROR] Failed to load provider - " << buf << std::endl;
    }

    return 0;
}

int main(int argc, char* argv[]) {
    if (argc != 4) {
        std::cerr << "[ERROR] Usage: " << argv[0] << "    " << std::endl;
        return 1;
    }

    const std::string inputFilePath = argv[1];
    const std::string outputFilePath = argv[2];
    const std::string passphrase = argv[3];

    try {
        std::cout << "[INFO] Starting PKCS#12 processing..." << std::endl;

        initializeOpenSSL();

        // Read the input PKCS#12 file
        std::vector inputData = readFile(inputFilePath);

        // Validate the original PKCS#12 file
        validatePKCS12(inputData, passphrase);

        // Create a new PKCS#12 file with the new passphrase
        std::vector outputData = createPKCS12fromPKCS12(inputData, passphrase);

        // Validate the modified PKCS#12 file
        validatePKCS12(outputData, passphrase);

        // Write the modified PKCS#12 file to disk
        writeFile(outputFilePath, outputData);

        std::cout << "[INFO] Successfully created new PKCS#12 file: " << outputFilePath << std::endl;
    } catch (const std::exception& ex) {
        std::cerr << "[ERROR] " << ex.what() << std::endl;
        return 1;
    }

    return 0;
}