<?php
/*************************************************************
# 076 License

Copyright (c) テクニカル諏訪子

Permission is hereby granted to any person obtaining a copy of the software
Little Beast (the "Software") to use, modify, merge, copy, publish, distribute,
sublicense, and/or sell copies of the Software, subject to the following conditions:

    1. **Origin Attribution**:
       - You must not misrepresent the origin of the Software; you must not claim
         you created the original Software.
       - If the Software is used in a product, you must either:
         a. Provide clear attribution in the product's documentation, user interface,
            or other visible areas, **OR**
         b. Pay the original developers a fee they specify in writing.
    2. **Usage Restriction**:
       - The Software, or any derivative works, dependencies, or libraries
         incorporating it, must not be used for censorship or to suppress freedom of
         speech, expression, or creativity. Prohibited uses include, but are not
         limited to:
         - Censorship of so-called "hate speech", visuals, non-mainstream opinions,
           ideas, or objective reality.
         - Tools or systems designed to restrict access to information or
           artistic works.
    3. **Notice Preservation**:
       - This license and the above copyright notice must remain intact in all copies
         of the source code.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
namespace Std\Lib\Crypto;

/**
 * ASN.1（DER）の読み書きとPEM
 *
 * 読む：
 *   $node = Asn1::parse($der);              // ['tag' => 0x30, 'value' => 中身, 'raw' => タグ・長さ・中身]
 *   foreach (Asn1::children($node) as $c) … // 構造型の中の要素
 * 書く：
 *   $der = Asn1::seq(Asn1::int(1), Asn1::oid('1.2.840.113549.1.1.1'), Asn1::null());
 */
class Asn1 {
  public const BOOLEAN = 0x01;
  public const INTEGER = 0x02;
  public const BIT_STRING = 0x03;
  public const OCTET_STRING = 0x04;
  public const NULL = 0x05;
  public const OID = 0x06;
  public const UTF8_STRING = 0x0C;
  public const PRINTABLE_STRING = 0x13;
  public const T61_STRING = 0x14;
  public const IA5_STRING = 0x16;
  public const UTC_TIME = 0x17;
  public const GENERALIZED_TIME = 0x18;
  public const UNIVERSAL_STRING = 0x1C;
  public const BMP_STRING = 0x1E;
  public const SEQUENCE = 0x30;
  public const SET = 0x31;

  private const MAX_DEPTH = 32;

  /**
   * DERの要素を1つ読む
   *
   * @param string $der  データ
   * @param int $pos  位置（読んだ分だけ進める）
   * @return array  tag（最初のバイト）、value（中身）、raw（全体）
   * @throws \UnexpectedValueException  壊れたDERの場合
   */
  public static function read(string $der, int &$pos): array {
    $len = strlen($der);
    if ($pos + 2 > $len) throw new \UnexpectedValueException('ASN.1：データが足りない');

    $start = $pos;
    $tag = ord($der[$pos++]);
    if (($tag & 0x1F) === 0x1F) throw new \UnexpectedValueException('ASN.1：長いタグは未対応');

    $l = ord($der[$pos++]);
    if ($l & 0x80) {
      $n = $l & 0x7F;
      if ($n === 0 || $n > 4 || $pos + $n > $len) throw new \UnexpectedValueException('ASN.1：不正な長さ');
      $l = 0;
      for ($i = 0; $i < $n; $i++) $l = ($l << 8) | ord($der[$pos++]);
    }
    if ($pos + $l > $len) throw new \UnexpectedValueException('ASN.1：長さがデータを超える');

    $value = substr($der, $pos, $l);
    $pos += $l;
    return ['tag' => $tag, 'value' => $value, 'raw' => substr($der, $start, $pos - $start)];
  }

  /**
   * DER全体を1つの要素として読む（後ろに余計なデータがあれば例外）
   *
   * @param string $der
   * @return array
   * @throws \UnexpectedValueException
   */
  public static function parse(string $der): array {
    $pos = 0;
    $node = self::read($der, $pos);
    if ($pos !== strlen($der)) throw new \UnexpectedValueException('ASN.1：余計なデータ');
    return $node;
  }

  /**
   * 構造型（SEQUENCE、SET、[n]等）の中の要素
   *
   * @param array $node
   * @return array  要素の配列
   * @throws \UnexpectedValueException
   */
  public static function children(array $node): array {
    if (!($node['tag'] & 0x20)) throw new \UnexpectedValueException('ASN.1：構造型ではない');
    $out = [];
    $pos = 0;
    $v = $node['value'];
    while ($pos < strlen($v)) $out[] = self::read($v, $pos);
    return $out;
  }

  /**
   * 種類を確認して、構造型の中の要素を返す
   *
   * @param array $node
   * @param int $tag  期待するタグ
   * @param int $min  最低の要素の数
   * @return array
   * @throws \UnexpectedValueException
   */
  public static function expect(array $node, int $tag, int $min = 0): array {
    if ($node['tag'] !== $tag) throw new \UnexpectedValueException(sprintf('ASN.1：0x%02Xを期待したが0x%02X', $tag, $node['tag']));
    $c = self::children($node);
    if (count($c) < $min) throw new \UnexpectedValueException('ASN.1：要素が足りない');
    return $c;
  }

  ///////////////
  // 値

  /** INTEGERを読む（2の補数） */
  public static function toInt(array $node): \GMP {
    if ($node['tag'] !== self::INTEGER || $node['value'] === '') throw new \UnexpectedValueException('ASN.1：INTEGERではない');
    $v = $node['value'];
    $n = gmp_import($v);
    if (ord($v[0]) & 0x80) $n = gmp_sub($n, gmp_pow(2, 8 * strlen($v)));
    return $n;
  }

  /** OBJECT IDENTIFIERを読む（「1.2.840.113549」の形） */
  public static function toOid(array $node): string {
    if ($node['tag'] !== self::OID || $node['value'] === '') throw new \UnexpectedValueException('ASN.1：OIDではない');
    $parts = [];
    $n = 0;
    $v = $node['value'];
    for ($i = 0; $i < strlen($v); $i++) {
      $b = ord($v[$i]);
      if ($n > (PHP_INT_MAX >> 7)) throw new \UnexpectedValueException('ASN.1：OIDが大き過ぎる');
      $n = ($n << 7) | ($b & 0x7F);
      if (!($b & 0x80)) {
        if (empty($parts)) {
          $first = min(2, intdiv($n, 40));
          $parts[] = $first;
          $parts[] = $n - 40 * $first;
        } else {
          $parts[] = $n;
        }
        $n = 0;
      }
    }
    return implode('.', $parts);
  }

  /** BIT STRINGの中身（未使用ビットの数のバイトを除く） */
  public static function toBits(array $node): string {
    if ($node['tag'] !== self::BIT_STRING || $node['value'] === '') throw new \UnexpectedValueException('ASN.1：BIT STRINGではない');
    return substr($node['value'], 1);
  }

  /** 文字列の型をUTF-8にする */
  public static function toString(array $node): string {
    $v = $node['value'];
    return match ($node['tag']) {
      self::BMP_STRING => mb_convert_encoding($v, 'UTF-8', 'UTF-16BE'),
      self::UNIVERSAL_STRING => mb_convert_encoding($v, 'UTF-8', 'UTF-32BE'),
      self::T61_STRING => mb_check_encoding($v, 'UTF-8') ? $v : mb_convert_encoding($v, 'UTF-8', 'ISO-8859-1'),
      default => $v,
    };
  }

  /** UTCTime・GeneralizedTimeをUNIX時間にする */
  public static function toTime(array $node): int {
    $v = $node['value'];
    if ($node['tag'] === self::UTC_TIME && preg_match('/^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/', $v, $m)) {
      $y = (int)$m[1];
      $y += $y < 50 ? 2000 : 1900;
    } else if ($node['tag'] === self::GENERALIZED_TIME && preg_match('/^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(?:\.\d+)?Z$/', $v, $m)) {
      $y = (int)$m[1];
    } else {
      throw new \UnexpectedValueException('ASN.1：未対応の時間');
    }
    return gmmktime((int)$m[4], (int)$m[5], (int)$m[6], (int)$m[2], (int)$m[3], $y);
  }

  ///////////////
  // 書く

  /** タグ・長さ・中身 */
  public static function tlv(int $tag, string $value): string {
    $l = strlen($value);
    if ($l < 0x80) return chr($tag).chr($l).$value;
    $b = ltrim(pack('N', $l), "\0");
    return chr($tag).chr(0x80 | strlen($b)).$b.$value;
  }

  public static function seq(string ...$items): string {
    return self::tlv(self::SEQUENCE, implode('', $items));
  }

  public static function set(string ...$items): string {
    return self::tlv(self::SET, implode('', $items));
  }

  /** INTEGER（負数も） */
  public static function int(\GMP|int $n): string {
    $n = $n instanceof \GMP ? $n : gmp_init($n);
    if (gmp_sign($n) >= 0) {
      $b = gmp_export($n);
      if ($b === '' || (ord($b[0]) & 0x80)) $b = "\0".$b;
      return self::tlv(self::INTEGER, $b);
    }
    $len = strlen(gmp_export(gmp_abs($n))) + 1;
    $b = substr(str_pad(gmp_export(gmp_add(gmp_pow(2, 8 * $len), $n)), $len, "\0", STR_PAD_LEFT), -$len);
    while (strlen($b) > 1 && $b[0] === "\xFF" && (ord($b[1]) & 0x80)) $b = substr($b, 1);
    return self::tlv(self::INTEGER, $b);
  }

  public static function oid(string $oid): string {
    $p = array_map('intval', explode('.', $oid));
    $out = '';
    $nums = array_merge([40 * $p[0] + $p[1]], array_slice($p, 2));
    foreach ($nums as $n) {
      $b = chr($n & 0x7F);
      for ($n >>= 7; $n > 0; $n >>= 7) $b = chr(0x80 | ($n & 0x7F)).$b;
      $out .= $b;
    }
    return self::tlv(self::OID, $out);
  }

  public static function null(): string {
    return "\x05\x00";
  }

  public static function bool(bool $v): string {
    return self::tlv(self::BOOLEAN, $v ? "\xFF" : "\x00");
  }

  public static function bits(string $v): string {
    return self::tlv(self::BIT_STRING, "\0".$v);
  }

  public static function octets(string $v): string {
    return self::tlv(self::OCTET_STRING, $v);
  }

  public static function utf8(string $v): string {
    return self::tlv(self::UTF8_STRING, $v);
  }

  /** 2050年までUTCTime、それ以降はGeneralizedTime（RFC 5280） */
  public static function time(int $t): string {
    $y = (int)gmdate('Y', $t);
    return $y < 2050 && $y >= 1950
      ? self::tlv(self::UTC_TIME, gmdate('ymdHis', $t).'Z')
      : self::tlv(self::GENERALIZED_TIME, gmdate('YmdHis', $t).'Z');
  }

  /** 明示的なタグ［n］ */
  public static function explicit(int $n, string $inner): string {
    return self::tlv(0xA0 | $n, $inner);
  }

  ///////////////
  // PEM

  /**
   * DERをPEMにする
   *
   * @param string $der
   * @param string $label  例：PRIVATE KEY、PUBLIC KEY、CERTIFICATE
   * @return string
   */
  public static function pem(string $der, string $label): string {
    return "-----BEGIN {$label}-----\n".chunk_split(base64_encode($der), 64, "\n")."-----END {$label}-----\n";
  }

  /**
   * PEMのブロックを全部読む
   *
   * @param string $text  PEM（複数のブロックも可）
   * @return array  ['label' => …, 'der' => …]の配列
   */
  public static function unpem(string $text): array {
    preg_match_all('/-----BEGIN ([A-Z0-9 ]+)-----\s*(.*?)-----END \1-----/s', $text, $m, PREG_SET_ORDER);
    $out = [];
    foreach ($m as $b) {
      // 「Proc-Type:」等のヘッダーがある（暗号化された）PEM
      if (str_contains($b[2], ':')) {
        $out[] = ['label' => $b[1], 'der' => '', 'encrypted' => true];
        continue;
      }
      $der = base64_decode(preg_replace('/\s+/', '', $b[2]), true);
      if ($der !== false) $out[] = ['label' => $b[1], 'der' => $der];
    }
    return $out;
  }
}