github.com/hxx258456/fabric-ca-gm@v0.0.3-0.20221111064038-a268ad7e3a37/internal/pkg/util/util.go

/*
Copyright IBM Corp. All Rights Reserved.

SPDX-License-Identifier: Apache-2.0
*/

package util

import (
	"bytes"
	"encoding/base64"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"io"
	"io/ioutil"
	"math/big"
	mrand "math/rand"
	"net/url"
	"os"
	"path"
	"path/filepath"
	"reflect"
	"regexp"
	"strings"
	"testing"
	"time"

	"gitee.com/zhaochuninhefei/zcgolog/zclog"
	http "github.com/hxx258456/ccgo/gmhttp"

	"github.com/hxx258456/ccgo/sm2"
	"github.com/hxx258456/ccgo/x509"
	"github.com/hxx258456/fabric-ca-gm/lib/caerrors"
	"github.com/hxx258456/fabric-gm/bccsp"
	"github.com/hxx258456/fabric-gm/bccsp/utils"
	"github.com/pkg/errors"
	"github.com/spf13/viper"
	"github.com/stretchr/testify/assert"
)

var (
	rnd = mrand.NewSource(time.Now().UnixNano())
	// ErrNotImplemented used to return errors for functions not implemented
	ErrNotImplemented = errors.New("NOT YET IMPLEMENTED")
)

const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
const (
	letterIdxBits = 6                    // 6 bits to represent a letter index
	letterIdxMask = 1<<letterIdxBits - 1 // All 1-bits, as many as letterIdxBits
	letterIdxMax  = 63 / letterIdxBits   // # of letter indices fitting in 63 bits
)

// SecretTag to tag a field as secret as in password, token
const SecretTag = "mask"

// URLRegex is the regular expression to check if a value is an URL
var URLRegex = regexp.MustCompile(`(ldap|http)s*://(\S+):(\S+)@`)

// RandomString returns a random string
func RandomString(n int) string {
	b := make([]byte, n)

	for i, cache, remain := n-1, rnd.Int63(), letterIdxMax; i >= 0; {
		if remain == 0 {
			cache, remain = rnd.Int63(), letterIdxMax
		}
		if idx := int(cache & letterIdxMask); idx < len(letterBytes) {
			b[i] = letterBytes[idx]
			i--
		}
		cache >>= letterIdxBits
		remain--
	}

	return string(b)
}

// ReadFile reads a file
func ReadFile(file string) ([]byte, error) {
	return ioutil.ReadFile(file)
}

// WriteFile writes a file
func WriteFile(file string, buf []byte, perm os.FileMode) error {
	dir := path.Dir(file)
	// Create the directory if it doesn't exist
	if _, err := os.Stat(dir); os.IsNotExist(err) {
		err = os.MkdirAll(dir, 0755)
		if err != nil {
			return errors.Wrapf(err, "Failed to create directory '%s' for file '%s'", dir, file)
		}
	}
	return ioutil.WriteFile(file, buf, perm)
}

// FileExists checks to see if a file exists
func FileExists(name string) bool {
	if _, err := os.Stat(name); err != nil {
		if os.IsNotExist(err) {
			return false
		}
	}
	return true
}

// Marshal to bytes
func Marshal(from interface{}, what string) ([]byte, error) {
	buf, err := json.Marshal(from)
	if err != nil {
		return nil, errors.Wrapf(err, "Failed to marshal %s", what)
	}
	return buf, nil
}

// Unmarshal from bytes
func Unmarshal(from []byte, to interface{}, what string) error {
	err := json.Unmarshal(from, to)
	if err != nil {
		return errors.Wrapf(err, "Failed to unmarshal %s", what)
	}
	return nil
}

// CreateToken creates a JWT-like token.
//  国密改造后只支持sm2公钥证书
// In a normal JWT token, the format of the token created is:
//      <algorithm,claims,signature>
// where each part is base64-encoded string separated by a period.
// In this JWT-like token, there are two differences:
// 1) the claims section is a certificate, so the format is:
//      <certificate,signature>
// 2) the signature uses the private key associated with the certificate,
//    and the signature is across both the certificate and the "body" argument,
//    which is the body of an HTTP request, though could be any arbitrary bytes.
// @param cert The pem-encoded certificate
// @param key The pem-encoded key
// @param method http method of the request
// @param uri URI of the request
// @param body The body of an HTTP request
func CreateToken(csp bccsp.BCCSP, cert []byte, key bccsp.Key, method, uri string, body []byte) (string, error) {
	x509Cert, err := GetX509CertificateFromPEM(cert)
	if err != nil {
		return "", err
	}
	publicKey := x509Cert.PublicKey

	var token string

	//The RSA Key Gen is commented right now as there is bccsp does
	switch publicKey.(type) {
	case *sm2.PublicKey:
		token, err = GenSM2Token(csp, cert, key, method, uri, body)
		if err != nil {
			return "", err
		}
		/*
			case *rsa.PublicKey:
				token, err = GenRSAToken(csp, cert, key, body)
				if err != nil {
					return "", err
				}
			case *ecdsa.PublicKey:
				token, err = GenSM2Token(csp, cert, key, method, uri, body)
				if err != nil {
					return "", err
				}
		*/
	default:
		return "", errors.New("internal/pkg/util/util.go CreateToken: 证书公钥类型不是sm2")
	}
	return token, nil
}

//GenSM2Token signs the http body and cert with SM2 using EC private key
func GenSM2Token(csp bccsp.BCCSP, cert []byte, key bccsp.Key, method, uri string, body []byte) (string, error) {
	b64body := B64Encode(body)
	b64cert := B64Encode(cert)
	b64uri := B64Encode([]byte(uri))
	payload := method + "." + b64uri + "." + b64body + "." + b64cert

	return genSM2Token(csp, key, b64cert, payload)
}

func genSM2Token(csp bccsp.BCCSP, key bccsp.Key, b64cert, payload string) (string, error) {
	digest, digestError := csp.Hash([]byte(payload), &bccsp.SM3Opts{})
	// fmt.Printf("===== internal/pkg/util/util.go genSM2Token digest: %v\n", digest)
	if digestError != nil {
		return "", errors.WithMessage(digestError, fmt.Sprintf("Hash failed on '%s'", payload))
	}

	ecSignature, err := csp.Sign(key, digest, nil)
	if err != nil {
		return "", errors.WithMessage(err, "BCCSP signature generation failure")
	}
	if len(ecSignature) == 0 {
		return "", errors.New("BCCSP signature creation failed. Signature must be different than nil")
	}

	b64sig := B64Encode(ecSignature)
	token := b64cert + "." + b64sig

	return token, nil

}

// 检查http请求携带的token是否有效，并返回对应的x509证书。
// VerifyTokenFromHttpRequest verifies token signed by SM2, ECDSA or RSA and
// returns the associated user ID
func VerifyTokenFromHttpRequest(csp bccsp.BCCSP, token string, method, uri string, body []byte, compMode1_3 bool) (*x509.Certificate, error) {
	if csp == nil {
		return nil, errors.New("BCCSP instance is not present")
	}
	// 解析出x509证书，base64转码的x509证书以及base64转码的签名
	x509Cert, b64Cert, b64Sig, err := decodeToken(token)
	if err != nil {
		return nil, err
	}
	// 对签名做base64解码
	sig, err := B64Decode(b64Sig)
	if err != nil {
		return nil, errors.WithMessage(err, "Invalid base64 encoded signature in token")
	}
	// 对body和url做base64转码
	b64Body := B64Encode(body)
	b64uri := B64Encode([]byte(uri))
	// 拼接签名内容
	sigString := method + "." + b64uri + "." + b64Body + "." + b64Cert
	// zclog.Infof("===== internal/pkg/util/util.go VerifyToken before csp .KeyImport csp : %T b64Body %s", csp, sigString)
	// sm2cert := ParseX509Certificate2Sm2(x509Cert)
	// 从x509证书解析出证书公钥
	certPubKey, err := csp.KeyImport(x509Cert, &bccsp.GMX509PublicKeyImportOpts{Temporary: true})
	// zclog.Infof("===== internal/pkg/util/util.go VerifyToken end csp .KeyImport certPubKey : %T", certPubKey)
	if err != nil {
		return nil, errors.WithMessage(err, "Public Key import into BCCSP failed with error")
	}
	if certPubKey == nil {
		return nil, errors.New("Public Key Cannot be imported into BCCSP")
	}
	//bccsp.X509PublicKeyImportOpts
	//Using default hash algo
	// 对签名消息做预散列
	digest, digestError := csp.Hash([]byte(sigString), &bccsp.SM3Opts{})
	// zclog.Debugf("===== digest: %v", digest)
	if digestError != nil {
		return nil, errors.WithMessage(digestError, "Message digest failed")
	}
	// zclog.Debugf("===== certPubKey类型: %T , sig: %v , digest: %s", certPubKey, sig, B64Encode(digest))
	// 使用证书公钥对sig做验签
	valid, validErr := csp.Verify(certPubKey, sig, digest, nil)
	if compMode1_3 && !valid {
		zclog.Debugf("===== 签名内容包含httpMethod与uri的验签失败,尝试签名内容只有body和证书的验签: %s", err)
		sigString := b64Body + "." + b64Cert
		digest, digestError := csp.Hash([]byte(sigString), &bccsp.SM3Opts{})
		if digestError != nil {
			return nil, errors.WithMessage(digestError, "Message digest failed")
		}
		valid, validErr = csp.Verify(certPubKey, sig, digest, nil)
	}
	if validErr != nil {
		return nil, errors.WithMessage(validErr, "===== internal/pkg/util/util.go VerifyToken: Token signature validation failure")
	}
	if !valid {
		return nil, errors.New("===== internal/pkg/util/util.go VerifyToken: Token signature validation failed")
	}
	return x509Cert, nil
}

// 将token解析为 x509证书、Base64转码的x509证书以及token签名。
// decodeToken extracts an X509 certificate and base64 encoded signature from a token
func decodeToken(token string) (*x509.Certificate, string, string, error) {
	if token == "" {
		return nil, "", "", errors.New("Invalid token; it is empty")
	}
	// 用"."切割token
	parts := strings.Split(token, ".")
	if len(parts) != 2 {
		return nil, "", "", errors.New("Invalid token format; expecting 2 parts separated by '.'")
	}
	// 对token第一部分做Base64解码
	b64cert := parts[0]
	certDecoded, err := B64Decode(b64cert)
	if err != nil {
		return nil, "", "", errors.WithMessage(err, "Failed to decode base64 encoded x509 cert")
	}
	// 解析出x509证书
	x509Cert, err := GetX509CertificateFromPEM(certDecoded)
	if err != nil {
		return nil, "", "", errors.WithMessage(err, "Error in parsing x509 certificate given block bytes")
	}
	return x509Cert, b64cert, parts[1], nil
}

//GetECPrivateKey get *sm2.PrivateKey from key pem
// 国密对应后只支持sm2私钥
func GetECPrivateKey(raw []byte) (*sm2.PrivateKey, error) {
	// decoded, _ := pem.Decode(raw)
	// if decoded == nil {
	// 	return nil, errors.New("Failed to decode the PEM-encoded ECDSA key")
	// }
	// ECprivKey, err := x509.ParseECPrivateKey(decoded.Bytes)
	ECprivKey, err := utils.PEMToSm2PrivateKey(raw, nil)
	if err != nil {
		return nil, err
	}
	return ECprivKey, err
	// key, err2 := x509.ParsePKCS8PrivateKey(decoded.Bytes)
	// if err2 == nil {
	// 	switch key := key.(type) {
	// 	case *ecdsa.PrivateKey:
	// 		return key, nil
	// 	case *rsa.PrivateKey:
	// 		return nil, errors.New("Expecting EC private key but found RSA private key")
	// 	default:
	// 		return nil, errors.New("Invalid private key type in PKCS#8 wrapping")
	// 	}
	// }
	// return nil, errors.Wrap(err2, "Failed parsing EC private key")
}

// 国密改造后只支持sm2
//GetRSAPrivateKey get *rsa.PrivateKey from key pem
// func GetRSAPrivateKey(raw []byte) (*rsa.PrivateKey, error) {
// 	decoded, _ := pem.Decode(raw)
// 	if decoded == nil {
// 		return nil, errors.New("Failed to decode the PEM-encoded RSA key")
// 	}
// 	RSAprivKey, err := x509.ParsePKCS1PrivateKey(decoded.Bytes)
// 	if err == nil {
// 		return RSAprivKey, nil
// 	}
// 	key, err2 := x509.ParsePKCS8PrivateKey(decoded.Bytes)
// 	if err2 == nil {
// 		switch key := key.(type) {
// 		// 添加了sm2分支判断
// 		case *sm2.PrivateKey, *ecdsa.PrivateKey:
// 			return nil, errors.New("Expecting RSA private key but found EC private key")
// 		case *rsa.PrivateKey:
// 			return key, nil
// 		default:
// 			return nil, errors.New("Invalid private key type in PKCS#8 wrapping")
// 		}
// 	}
// 	return nil, errors.Wrap(err, "Failed parsing RSA private key")
// }

// GetSM2PrivateKey get *sm2.PrivateKey from key pem
func GetSM2PrivateKey(raw []byte) (*sm2.PrivateKey, error) {
	// decoded, _ := pem.Decode(raw)
	// if decoded == nil {
	// 	return nil, errors.New("Failed to decode the PEM-encoded RSA key")
	// }
	// if key, err := x509.ParsePKCS8UnecryptedPrivateKey(decoded.Bytes); err == nil {
	// 	return key, nil
	// } else {
	// 	return nil, fmt.Errorf("tls: failed to parse private key %v", err)
	// }
	return utils.PEMToSm2PrivateKey(raw, nil)
}

// B64Encode base64 encodes bytes
func B64Encode(buf []byte) string {
	return base64.StdEncoding.EncodeToString(buf)
}

// B64Decode base64 decodes a string
func B64Decode(str string) (buf []byte, err error) {
	return base64.StdEncoding.DecodeString(str)
}

// HTTPRequestToString returns a string for an HTTP request for debugging
func HTTPRequestToString(req *http.Request) string {
	body, _ := ioutil.ReadAll(req.Body)
	req.Body = ioutil.NopCloser(bytes.NewReader(body))
	return fmt.Sprintf("%s %s\n%s",
		req.Method, req.URL, string(body))
}

// HTTPResponseToString returns a string for an HTTP response for debugging
func HTTPResponseToString(resp *http.Response) string {
	body, _ := ioutil.ReadAll(resp.Body)
	resp.Body = ioutil.NopCloser(bytes.NewReader(body))
	return fmt.Sprintf("statusCode=%d (%s)\n%s",
		resp.StatusCode, resp.Status, string(body))
}

// CreateClientHome will create a home directory if it does not exist
func CreateClientHome() (string, error) {
	zclog.Debug("===== CreateHome")
	home := filepath.Dir(GetDefaultConfigFile("fabric-ca-client"))

	if _, err := os.Stat(home); err != nil {
		if os.IsNotExist(err) {
			err := os.MkdirAll(home, 0755)
			if err != nil {
				return "", err
			}
		}
	}
	return home, nil
}

// GetDefaultConfigFile gets the default path for the config file to display in usage message
func GetDefaultConfigFile(cmdName string) string {
	if cmdName == "fabric-ca-server" {
		var fname = fmt.Sprintf("%s-config.yaml", cmdName)
		// First check home env variables
		home := "."
		envs := []string{"FABRIC_CA_SERVER_HOME", "FABRIC_CA_HOME", "CA_CFG_PATH"}
		for _, env := range envs {
			envVal := os.Getenv(env)
			if envVal != "" {
				home = envVal
				break
			}
		}
		return path.Join(home, fname)
	}

	var fname = fmt.Sprintf("%s-config.yaml", cmdName)
	// First check home env variables
	var home string
	envs := []string{"FABRIC_CA_CLIENT_HOME", "FABRIC_CA_HOME", "CA_CFG_PATH"}
	for _, env := range envs {
		envVal := os.Getenv(env)
		if envVal != "" {
			home = envVal
			return path.Join(home, fname)
		}
	}

	return path.Join(os.Getenv("HOME"), ".fabric-ca-client", fname)
}

// GetX509CertificateFromPEMFile gets an X509 certificate from a file
func GetX509CertificateFromPEMFile(file string) (*x509.Certificate, error) {
	return x509.ReadCertificateFromPemFile(file)
}

// GetX509CertificateFromPEM get an X509 certificate from bytes in PEM format
func GetX509CertificateFromPEM(cert []byte) (*x509.Certificate, error) {
	return x509.ReadCertificateFromPem(cert)
}

// GetX509CertificatesFromPEM returns X509 certificates from bytes in PEM format
func GetX509CertificatesFromPEM(pemBytes []byte) ([]*x509.Certificate, error) {
	chain := pemBytes
	var certs []*x509.Certificate
	for len(chain) > 0 {
		var block *pem.Block
		block, chain = pem.Decode(chain)
		if block == nil {
			break
		}
		x509Cert, err := x509.ParseCertificate(block.Bytes)
		if err != nil {
			return nil, errors.Wrap(err, "Error parsing certificate")
		}
		certs = append(certs, x509Cert)
	}
	return certs, nil
}

// GetCertificateDurationFromFile returns the validity duration for a certificate
// in a file.
func GetCertificateDurationFromFile(file string) (time.Duration, error) {
	cert, err := GetX509CertificateFromPEMFile(file)
	if err != nil {
		return 0, err
	}
	return GetCertificateDuration(cert), nil
}

// GetCertificateDuration returns the validity duration for a certificate
func GetCertificateDuration(cert *x509.Certificate) time.Duration {
	return cert.NotAfter.Sub(cert.NotBefore)
}

// GetEnrollmentIDFromPEM returns the EnrollmentID from a PEM buffer
func GetEnrollmentIDFromPEM(cert []byte) (string, error) {
	x509Cert, err := GetX509CertificateFromPEM(cert)
	if err != nil {
		return "", err
	}
	return GetEnrollmentIDFromX509Certificate(x509Cert), nil
}

// 从x509证书获取Subject.CommonName作为EnrollmentID返回。
// GetEnrollmentIDFromX509Certificate returns the EnrollmentID from the X509 certificate
func GetEnrollmentIDFromX509Certificate(cert *x509.Certificate) string {
	// cert.Subject.CommonName 是 EnrollmentID
	// 可见fabric-ca的证书格式依然是采用x509的CN,而不是SAN扩展信息。
	// 但go1.15之后,x509证书使用SAN代替CN,因此在生成fabric-ca的证书时要注意,CN和SAN都要设置。
	return cert.Subject.CommonName
}

// MakeFileAbs makes 'file' absolute relative to 'dir' if not already absolute
func MakeFileAbs(file, dir string) (string, error) {
	if file == "" {
		return "", nil
	}
	if filepath.IsAbs(file) {
		return file, nil
	}
	path, err := filepath.Abs(filepath.Join(dir, file))
	if err != nil {
		return "", errors.Wrapf(err, "Failed making '%s' absolute based on '%s'", file, dir)
	}
	return path, nil
}

// MakeFileNamesAbsolute makes all file names in the list absolute, relative to home
func MakeFileNamesAbsolute(files []*string, home string) error {
	for _, filePtr := range files {
		abs, err := MakeFileAbs(*filePtr, home)
		if err != nil {
			return err
		}
		*filePtr = abs
	}
	return nil
}

// Fatal logs a fatal message and exits
func Fatal(format string, v ...interface{}) {
	// log.Fatalf(format, v...)
	// os.Exit(1)
	zclog.Fatalf(format, v...)
}

// GetUser returns username and password from CLI input
func GetUser(v *viper.Viper) (string, string, error) {
	fabricCAServerURL := v.GetString("url")

	URL, err := url.Parse(fabricCAServerURL)
	if err != nil {
		return "", "", err
	}

	user := URL.User
	if user == nil {
		return "", "", errors.New("No username and password provided as part of the Fabric CA server URL")
	}

	eid := user.Username()
	if eid == "" {
		return "", "", errors.New("No username provided as part of URL")
	}

	pass, _ := user.Password()
	if pass == "" {
		return "", "", errors.New("No password provided as part of URL")
	}

	return eid, pass, nil
}

// GetSerialAsHex returns the serial number from certificate as hex format
func GetSerialAsHex(serial *big.Int) string {
	hex := fmt.Sprintf("%x", serial)
	return hex
}

// StructToString converts a struct to a string. If a field
// has a 'secret' tag, it is masked in the returned string
func StructToString(si interface{}) string {
	rval := reflect.ValueOf(si).Elem()
	tipe := rval.Type()
	var buffer bytes.Buffer
	buffer.WriteString("{ ")
	for i := 0; i < rval.NumField(); i++ {
		tf := tipe.Field(i)
		if !rval.FieldByName(tf.Name).CanSet() {
			continue // skip unexported fields
		}
		var fStr string
		tagv := tf.Tag.Get(SecretTag)
		if tagv == "password" || tagv == "username" {
			fStr = fmt.Sprintf("%s:**** ", tf.Name)
		} else if tagv == "url" {
			val, ok := rval.Field(i).Interface().(string)
			if ok {
				val = GetMaskedURL(val)
				fStr = fmt.Sprintf("%s:%v ", tf.Name, val)
			} else {
				fStr = fmt.Sprintf("%s:%v ", tf.Name, rval.Field(i).Interface())
			}
		} else {
			fStr = fmt.Sprintf("%s:%v ", tf.Name, rval.Field(i).Interface())
		}
		buffer.WriteString(fStr)
	}
	buffer.WriteString(" }")
	return buffer.String()
}

// GetMaskedURL returns masked URL. It masks username and password from the URL
// if present
func GetMaskedURL(url string) string {
	matches := URLRegex.FindStringSubmatch(url)

	// If there is a match, there should be four entries: 1 for
	// the match and 3 for submatches
	if len(matches) == 4 {
		matchIdxs := URLRegex.FindStringSubmatchIndex(url)
		matchStr := url[matchIdxs[0]:matchIdxs[1]]
		for idx := 2; idx < len(matches); idx++ {
			if matches[idx] != "" {
				matchStr = strings.Replace(matchStr, matches[idx], "****", 1)
			}
		}
		url = url[:matchIdxs[0]] + matchStr + url[matchIdxs[1]:]
	}
	return url
}

// NormalizeStringSlice checks for seperators
func NormalizeStringSlice(slice []string) []string {
	var normalizedSlice []string

	for _, item := range slice {
		// Remove surrounding brackets "[]" if specified
		if strings.HasPrefix(item, "[") && strings.HasSuffix(item, "]") {
			item = item[1 : len(item)-1]
		}
		// Split elements based on comma and add to normalized slice
		elems := strings.Split(item, ",")
		for _, elem := range elems {
			normalizedSlice = append(normalizedSlice, strings.TrimSpace(elem))
		}
	}
	return normalizedSlice
}

// NormalizeFileList provides absolute pathing for the list of files
func NormalizeFileList(files []string, homeDir string) ([]string, error) {
	var err error

	files = NormalizeStringSlice(files)

	for i, file := range files {
		files[i], err = MakeFileAbs(file, homeDir)
		if err != nil {
			return nil, err
		}
	}

	return files, nil
}

// CheckHostsInCert checks to see if host correctly inserted into certificate
func CheckHostsInCert(certFile string, hosts ...string) error {
	certBytes, err := ioutil.ReadFile(certFile)
	if err != nil {
		return errors.Wrapf(err, "Failed to read certificate file at '%s'", certFile)
	}

	cert, err := GetX509CertificateFromPEM(certBytes)
	if err != nil {
		return errors.Wrap(err, "Failed to get certificate")
	}

	// combine DNSNames and IPAddresses from cert
	sans := cert.DNSNames
	for _, ip := range cert.IPAddresses {
		sans = append(sans, ip.String())
	}
	for _, host := range hosts {
		if !containsString(sans, host) {
			return errors.Errorf("Host '%s' was not found in the certificate in file '%s'", host, certFile)
		}
	}
	return nil
}

func containsString(list []string, item string) bool {
	for _, elem := range list {
		if elem == item {
			return true
		}
	}
	return false
}

// Read reads from Reader into a byte array
func Read(r io.Reader, data []byte) ([]byte, error) {
	j := 0
	for {
		n, err := r.Read(data[j:])
		j = j + n
		if err != nil {
			if err == io.EOF {
				break
			}
			return nil, errors.Wrapf(err, "Read failure")
		}

		if (n == 0 && j == len(data)) || j > len(data) {
			return nil, errors.New("Size of requested data is too large")
		}
	}

	return data[:j], nil
}

// Hostname name returns the hostname of the machine
func Hostname() string {
	hostname, _ := os.Hostname()
	if hostname == "" {
		hostname = "localhost"
	}
	return hostname
}

// ValidateAndReturnAbsConf checks to see that there are no conflicts between the
// configuration file path and home directory. If no conflicts, returns back the absolute
// path for the configuration file and home directory.
func ValidateAndReturnAbsConf(configFilePath, homeDir, cmdName string) (string, string, error) {
	var err error
	var homeDirSet bool
	var configFileSet bool

	defaultConfig := GetDefaultConfigFile(cmdName) // Get the default configuration

	if configFilePath == "" {
		configFilePath = defaultConfig // If no config file path specified, use the default configuration file
	} else {
		configFileSet = true
	}

	if homeDir == "" {
		homeDir = filepath.Dir(defaultConfig) // If no home directory specified, use the default directory
	} else {
		homeDirSet = true
	}

	// Make the home directory absolute
	homeDir, err = filepath.Abs(homeDir)
	if err != nil {
		return "", "", errors.Wrap(err, "Failed to get full path of config file")
	}
	homeDir = strings.TrimRight(homeDir, "/")

	if configFileSet && homeDirSet {
		zclog.Warn("Using both --config and --home CLI flags; --config will take precedence")
	}

	if configFileSet {
		configFilePath, err = filepath.Abs(configFilePath)
		if err != nil {
			return "", "", errors.Wrap(err, "Failed to get full path of configuration file")
		}
		return configFilePath, filepath.Dir(configFilePath), nil
	}

	configFile := filepath.Join(homeDir, filepath.Base(defaultConfig)) // Join specified home directory with default config file name
	return configFile, homeDir, nil
}

// GetSliceFromList will return a slice from a list
func GetSliceFromList(split string, delim string) []string {
	return strings.Split(strings.Replace(split, " ", "", -1), delim)
}

//sm2 证书转换 x509 证书
func ParseSm2Certificate2X509(sm2Cert *x509.Certificate) *x509.Certificate {
	x509cert := &x509.Certificate{
		Raw:                     sm2Cert.Raw,
		RawTBSCertificate:       sm2Cert.RawTBSCertificate,
		RawSubjectPublicKeyInfo: sm2Cert.RawSubjectPublicKeyInfo,
		RawSubject:              sm2Cert.RawSubject,
		RawIssuer:               sm2Cert.RawIssuer,

		Signature:          sm2Cert.Signature,
		SignatureAlgorithm: x509.SignatureAlgorithm(sm2Cert.SignatureAlgorithm),

		PublicKeyAlgorithm: x509.PublicKeyAlgorithm(sm2Cert.PublicKeyAlgorithm),
		PublicKey:          sm2Cert.PublicKey,

		Version:      sm2Cert.Version,
		SerialNumber: sm2Cert.SerialNumber,
		Issuer:       sm2Cert.Issuer,
		Subject:      sm2Cert.Subject,
		NotBefore:    sm2Cert.NotBefore,
		NotAfter:     sm2Cert.NotAfter,
		KeyUsage:     x509.KeyUsage(sm2Cert.KeyUsage),

		Extensions: sm2Cert.Extensions,

		ExtraExtensions: sm2Cert.ExtraExtensions,

		UnhandledCriticalExtensions: sm2Cert.UnhandledCriticalExtensions,

		//ExtKeyUsage:	[]x509.ExtKeyUsage(sm2Cert.ExtKeyUsage) ,
		UnknownExtKeyUsage: sm2Cert.UnknownExtKeyUsage,

		BasicConstraintsValid: sm2Cert.BasicConstraintsValid,
		IsCA:                  sm2Cert.IsCA,
		MaxPathLen:            sm2Cert.MaxPathLen,
		// MaxPathLenZero indicates that BasicConstraintsValid==true and
		// MaxPathLen==0 should be interpreted as an actual maximum path length
		// of zero. Otherwise, that combination is interpreted as MaxPathLen
		// not being set.
		MaxPathLenZero: sm2Cert.MaxPathLenZero,

		SubjectKeyId:   sm2Cert.SubjectKeyId,
		AuthorityKeyId: sm2Cert.AuthorityKeyId,

		// RFC 5280, 4.2.2.1 (Authority Information Access)
		OCSPServer:            sm2Cert.OCSPServer,
		IssuingCertificateURL: sm2Cert.IssuingCertificateURL,

		// Subject Alternate Name values
		DNSNames:       sm2Cert.DNSNames,
		EmailAddresses: sm2Cert.EmailAddresses,
		IPAddresses:    sm2Cert.IPAddresses,

		// Name constraints
		PermittedDNSDomainsCritical: sm2Cert.PermittedDNSDomainsCritical,
		PermittedDNSDomains:         sm2Cert.PermittedDNSDomains,

		// CRL Distribution Points
		CRLDistributionPoints: sm2Cert.CRLDistributionPoints,

		PolicyIdentifiers: sm2Cert.PolicyIdentifiers,
	}
	for _, val := range sm2Cert.ExtKeyUsage {
		x509cert.ExtKeyUsage = append(x509cert.ExtKeyUsage, x509.ExtKeyUsage(val))
	}

	return x509cert
}

// // X509证书格式转换为 SM2证书格式
// func ParseX509Certificate2Sm2(x509Cert *x509.Certificate) *gm509.Certificate {
// 	sm2cert := &gm509.Certificate{
// 		Raw:                     x509Cert.Raw,
// 		RawTBSCertificate:       x509Cert.RawTBSCertificate,
// 		RawSubjectPublicKeyInfo: x509Cert.RawSubjectPublicKeyInfo,
// 		RawSubject:              x509Cert.RawSubject,
// 		RawIssuer:               x509Cert.RawIssuer,

// 		Signature:          x509Cert.Signature,
// 		SignatureAlgorithm: gm509.SignatureAlgorithm(x509Cert.SignatureAlgorithm),

// 		PublicKeyAlgorithm: gm509.PublicKeyAlgorithm(x509Cert.PublicKeyAlgorithm),
// 		PublicKey:          x509Cert.PublicKey,

// 		Version:      x509Cert.Version,
// 		SerialNumber: x509Cert.SerialNumber,
// 		Issuer:       x509Cert.Issuer,
// 		Subject:      x509Cert.Subject,
// 		NotBefore:    x509Cert.NotBefore,
// 		NotAfter:     x509Cert.NotAfter,
// 		KeyUsage:     gm509.KeyUsage(x509Cert.KeyUsage),

// 		Extensions: x509Cert.Extensions,

// 		ExtraExtensions: x509Cert.ExtraExtensions,

// 		UnhandledCriticalExtensions: x509Cert.UnhandledCriticalExtensions,

// 		//ExtKeyUsage:	[]x509.ExtKeyUsage(x509Cert.ExtKeyUsage) ,
// 		UnknownExtKeyUsage: x509Cert.UnknownExtKeyUsage,

// 		BasicConstraintsValid: x509Cert.BasicConstraintsValid,
// 		IsCA:                  x509Cert.IsCA,
// 		MaxPathLen:            x509Cert.MaxPathLen,
// 		// MaxPathLenZero indicates that BasicConstraintsValid==true and
// 		// MaxPathLen==0 should be interpreted as an actual maximum path length
// 		// of zero. Otherwise, that combination is interpreted as MaxPathLen
// 		// not being set.
// 		MaxPathLenZero: x509Cert.MaxPathLenZero,

// 		SubjectKeyId:   x509Cert.SubjectKeyId,
// 		AuthorityKeyId: x509Cert.AuthorityKeyId,

// 		// RFC 5280, 4.2.2.1 (Authority Information Access)
// 		OCSPServer:            x509Cert.OCSPServer,
// 		IssuingCertificateURL: x509Cert.IssuingCertificateURL,

// 		// Subject Alternate Name values
// 		DNSNames:       x509Cert.DNSNames,
// 		EmailAddresses: x509Cert.EmailAddresses,
// 		IPAddresses:    x509Cert.IPAddresses,

// 		// Name constraints
// 		PermittedDNSDomainsCritical: x509Cert.PermittedDNSDomainsCritical,
// 		PermittedDNSDomains:         x509Cert.PermittedDNSDomains,

// 		// CRL Distribution Points
// 		CRLDistributionPoints: x509Cert.CRLDistributionPoints,

// 		PolicyIdentifiers: x509Cert.PolicyIdentifiers,
// 	}
// 	for _, val := range x509Cert.ExtKeyUsage {
// 		sm2cert.ExtKeyUsage = append(sm2cert.ExtKeyUsage, gm509.ExtKeyUsage(val))
// 	}

// 	return sm2cert
// }

var providerName string

func IsGMConfig() bool {
	// TODO: 国密改造后暂时固定支持国密
	return true
	// if providerName == "" {
	// 	return false
	// }
	// if strings.ToUpper(providerName) == "GM" {
	// 	return true
	// }
	// return false
}

func SetProviderName(name string) {
	providerName = name
}

// ListContains looks through a comma separated list to see if a string exists
func ListContains(list, find string) bool {
	items := strings.Split(list, ",")
	for _, item := range items {
		item = strings.TrimPrefix(item, " ")
		if item == find {
			return true
		}
	}
	return false
}

//TODO:  move these out of production code

// FatalError will check to see if an error occurred if so it will cause the test cases exit
func FatalError(t *testing.T, err error, msg string, args ...interface{}) {
	if len(args) > 0 {
		msg = fmt.Sprintf(msg, args)
	}
	if !assert.NoError(t, err, msg) {
		t.Fatal(msg)
	}
}

// ErrorContains will check to see if an error occurred, if so it will check that it contains
// the appropriate error message
func ErrorContains(t *testing.T, err error, contains, msg string, args ...interface{}) {
	if len(args) > 0 {
		msg = fmt.Sprintf(msg, args)
	}
	if assert.Error(t, err, msg) {
		assert.Contains(t, caerrors.Print(err), contains)
	}
}