/*
 * Copyright (C) 2011 Collabora Ltd.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as
 * published by the Free Software Foundation; either version 2.1 of
 * the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this program; if not, see <http://www.gnu.org/licenses/>.
 *
 * Author: Stef Walter <stefw@collabora.co.uk>
 */

#include "config.h"

#include "gcr-certificate-request.h"
#include "gcr-key-mechanisms.h"
#include "gcr-subject-public-key.h"

#include "gcr/gcr-enum-types-base.h"
#include "gcr/gcr-oids.h"

#include <egg/egg-armor.h>
#include <egg/egg-asn1x.h>
#include <egg/egg-asn1-defs.h>
#include <egg/egg-dn.h>

#include <glib/gi18n-lib.h>

/**
 * SECTION:gcr-certificate-request
 * @title: GcrCertificateRequest
 * @short_description: Represents a certificate request
 *
 * This is an object that allows creation of certificate requests. A
 * certificate request is sent to a certificate authority to request an
 * X.509 certificate.
 *
 * Use gcr_certificate_request_prepare() to create a blank certificate
 * request for a given private key. Set the common name on the certificate
 * request with gcr_certificate_request_set_cn(), and then sign the request
 * with gcr_certificate_request_complete_async().
 */

/**
 * GcrCertificateRequest:
 *
 * Represents a certificate request.
 */

/**
 * GcrCertificateRequestFormat:
 * @GCR_CERTIFICATE_REQUEST_PKCS10: certificate request is in PKCS\#10 format
 *
 * The format of a certificate request. Currently only PKCS\#10 is supported.
 */

#define GCR_CERTIFICATE_REQUEST_CLASS(klass)       (G_TYPE_CHECK_CLASS_CAST ((klass), GCR_TYPE_CERTIFICATE_REQUEST, GcrCertificateRequestClass))
#define GCR_IS_CERTIFICATE_REQUEST_CLASS(klass)    (G_TYPE_CHECK_CLASS_TYPE ((klass), GCR_TYPE_CERTIFICATE_REQUEST))
#define GCR_CERTIFICATE_REQUEST_GET_CLASS(obj)     (G_TYPE_INSTANCE_GET_CLASS ((obj), GCR_TYPE_CERTIFICATE_REQUEST, GcrCertificateRequestClass))

typedef struct _GcrCertificateRequestClass GcrCertificateRequestClass;

struct _GcrCertificateRequest {
	GObject parent;

	GckObject *private_key;
	GNode *asn;
	gulong *mechanisms;
	gulong n_mechanisms;
};

struct _GcrCertificateRequestClass {
	GObjectClass parent_class;
};

enum {
	PROP_0,
	PROP_FORMAT,
	PROP_PRIVATE_KEY
};

/* Forward declarations */
G_DEFINE_TYPE (GcrCertificateRequest, gcr_certificate_request, G_TYPE_OBJECT);

/* When updating here, update prepare_to_be_signed() */
static const gulong RSA_MECHANISMS[] = {
	CKM_SHA1_RSA_PKCS,
	CKM_RSA_PKCS,
};

/* When updating here, update prepare_to_be_signed() */
static const gulong DSA_MECHANISMS[] = {
	CKM_DSA_SHA1,
	CKM_DSA,
};

static const gulong ALL_MECHANISMS[] = {
	CKM_SHA1_RSA_PKCS,
	CKM_DSA_SHA1,
	CKM_RSA_PKCS,
	CKM_DSA,
};

G_STATIC_ASSERT (sizeof (ALL_MECHANISMS) == sizeof (RSA_MECHANISMS) + sizeof (DSA_MECHANISMS));

static void
gcr_certificate_request_init (GcrCertificateRequest *self)
{

}

static void
gcr_certificate_request_constructed (GObject *obj)
{
	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);
	GNode *version;

	G_OBJECT_CLASS (gcr_certificate_request_parent_class)->constructed (obj);

	self->asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-10-CertificationRequest");
	g_return_if_fail (self->asn != NULL);

	/* Setup the version */
	version = egg_asn1x_node (self->asn, "certificationRequestInfo", "version", NULL);
	egg_asn1x_set_integer_as_ulong (version, 0);
}

static void
gcr_certificate_request_finalize (GObject *obj)
{
	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);

	egg_asn1x_destroy (self->asn);
	g_free (self->mechanisms);

	G_OBJECT_CLASS (gcr_certificate_request_parent_class)->finalize (obj);
}

static void
gcr_certificate_request_set_property (GObject *obj,
                                      guint prop_id,
                                      const GValue *value,
                                      GParamSpec *pspec)
{
	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);
	GcrCertificateRequestFormat format;

	switch (prop_id) {
	case PROP_PRIVATE_KEY:
		g_return_if_fail (self->private_key == NULL);
		self->private_key = g_value_dup_object (value);
		g_return_if_fail (GCK_IS_OBJECT (self->private_key));
		break;
	case PROP_FORMAT:
		format = g_value_get_enum (value);
		g_return_if_fail (format == GCR_CERTIFICATE_REQUEST_PKCS10);
		break;
	default:
		G_OBJECT_WARN_INVALID_PROPERTY_ID (obj, prop_id, pspec);
		break;
	}
}

static void
gcr_certificate_request_get_property (GObject *obj,
                                      guint prop_id,
                                      GValue *value,
                                      GParamSpec *pspec)
{
	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);

	switch (prop_id) {
	case PROP_PRIVATE_KEY:
		g_value_set_object (value, gcr_certificate_request_get_private_key (self));
		break;
	case PROP_FORMAT:
		g_value_set_enum (value, gcr_certificate_request_get_format (self));
		break;
	default:
		G_OBJECT_WARN_INVALID_PROPERTY_ID (obj, prop_id, pspec);
		break;
	}
}

static void
gcr_certificate_request_class_init (GcrCertificateRequestClass *klass)
{
	GObjectClass *gobject_class = G_OBJECT_CLASS (klass);

	gobject_class->constructed = gcr_certificate_request_constructed;
	gobject_class->finalize = gcr_certificate_request_finalize;
	gobject_class->set_property = gcr_certificate_request_set_property;
	gobject_class->get_property = gcr_certificate_request_get_property;

	/**
	 * GcrCertificateRequest:private-key:
	 *
	 * The private key that this certificate request is for.
	 */
	g_object_class_install_property (gobject_class, PROP_PRIVATE_KEY,
	            g_param_spec_object ("private-key", "Private key", "Private key for request",
	                                 GCK_TYPE_OBJECT, G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));

	/**
	 * GcrCertificateRequest:format:
	 *
	 * The format of the certificate request.
	 */
	g_object_class_install_property (gobject_class, PROP_FORMAT,
	              g_param_spec_enum ("format", "Format", "Format of certificate request",
	                                 GCR_TYPE_CERTIFICATE_REQUEST_FORMAT, GCR_CERTIFICATE_REQUEST_PKCS10,
	                                 G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
}

/**
 * gcr_certificate_request_prepare:
 * @format: the format for the certificate request
 * @private_key: the private key the the certificate is being requested for
 *
 * Create a new certificate request, in the given format for the private key.
 *
 * Returns: (transfer full): a new #GcrCertificate request
 */
GcrCertificateRequest *
gcr_certificate_request_prepare (GcrCertificateRequestFormat format,
                                 GckObject *private_key)
{
	g_return_val_if_fail (format == GCR_CERTIFICATE_REQUEST_PKCS10, NULL);
	g_return_val_if_fail (GCK_IS_OBJECT (private_key), NULL);

	return g_object_new (GCR_TYPE_CERTIFICATE_REQUEST,
	                     "format", format,
	                     "private-key", private_key,
	                     NULL);
}

/**
 * gcr_certificate_request_get_private_key:
 * @self: the certificate request
 *
 * Get the private key this certificate request is for.
 *
 * Returns: (transfer none): the private key,
 */
GckObject *
gcr_certificate_request_get_private_key (GcrCertificateRequest *self)
{
	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), NULL);
	return self->private_key;
}

/**
 * gcr_certificate_request_get_format:
 * @self: the certificate request
 *
 * Get the format of this certificate request.
 *
 * Returns: the format
 */
GcrCertificateRequestFormat
gcr_certificate_request_get_format (GcrCertificateRequest *self)
{
	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), 0);
	return GCR_CERTIFICATE_REQUEST_PKCS10;
}

/**
 * gcr_certificate_request_set_cn:
 * @self: the certificate request
 * @cn: common name to set on the request
 *
 * Set the common name encoded in the certificate request.
 */
void
gcr_certificate_request_set_cn (GcrCertificateRequest *self,
                                const gchar *cn)
{
	GNode *subject;
	GNode *dn;

	g_return_if_fail (GCR_IS_CERTIFICATE_REQUEST (self));
	g_return_if_fail (cn != NULL);

	subject = egg_asn1x_node (self->asn, "certificationRequestInfo", "subject", NULL);
	dn = egg_asn1x_node (subject, "rdnSequence", NULL);

	/* TODO: we shouldn't really be clearing this, but replacing CN */
	egg_asn1x_set_choice (subject, dn);
	egg_asn1x_clear (dn);
	egg_dn_add_string_part (dn, GCR_OID_NAME_CN, cn);
}

static GBytes *
hash_sha1_pkcs1 (GBytes *data)
{
	const guchar SHA1_ASN[15] = /* Object ID is 1.3.14.3.2.26 */
		{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,
		  0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };

	GChecksum *checksum;
	guchar *hash;
	gsize n_hash;
	gsize n_digest;

	n_digest = g_checksum_type_get_length (G_CHECKSUM_SHA1);
	n_hash = n_digest + sizeof (SHA1_ASN);
	hash = g_malloc (n_hash);
	memcpy (hash, SHA1_ASN, sizeof (SHA1_ASN));

	checksum = g_checksum_new (G_CHECKSUM_SHA1);
	g_checksum_update (checksum, g_bytes_get_data (data, NULL), g_bytes_get_size (data));
	g_checksum_get_digest (checksum, hash + sizeof (SHA1_ASN), &n_digest);
	g_checksum_free (checksum);

	return g_bytes_new_take (hash, n_hash);
}

static GBytes *
hash_sha1 (GBytes *data)
{
	GChecksum *checksum;
	guchar *hash;
	gsize n_hash;

	n_hash = g_checksum_type_get_length (G_CHECKSUM_SHA1);
	hash = g_malloc (n_hash);

	checksum = g_checksum_new (G_CHECKSUM_SHA1);
	g_checksum_update (checksum, g_bytes_get_data (data, NULL), g_bytes_get_size (data));
	g_checksum_get_digest (checksum, hash, &n_hash);
	g_checksum_free (checksum);

	return g_bytes_new_take (hash, n_hash);
}

static GBytes *
prepare_to_be_signed (GcrCertificateRequest *self,
                      GckMechanism *mechanism)
{
	GNode *node;
	GBytes *data;
	GBytes *hash;

	g_assert (mechanism != NULL);

	node = egg_asn1x_node (self->asn, "certificationRequestInfo", NULL);
	data = egg_asn1x_encode (node, NULL);

	mechanism->parameter = NULL;
	mechanism->n_parameter = 0;

	switch (mechanism->type) {
	case CKM_SHA1_RSA_PKCS:
	case CKM_DSA_SHA1:
		return data;

	case CKM_RSA_PKCS:
		hash = hash_sha1_pkcs1 (data);
		g_bytes_unref (data);
		return hash;

	case CKM_DSA:
		hash = hash_sha1 (data);
		g_bytes_unref (data);
		return hash;

	default:
		g_assert_not_reached ();
		return NULL;
	}
}

static gboolean
prepare_subject_public_key_and_mechanisms (GcrCertificateRequest *self,
                                           GNode *subject_public_key,
                                           GQuark *algorithm,
                                           const gulong **mechanisms,
                                           gsize *n_mechanisms,
                                           GError **error)
{
	GBytes *encoded;
	GNode *node;
	GQuark oid;

	g_assert (algorithm != NULL);
	g_assert (mechanisms != NULL);
	g_assert (n_mechanisms != NULL);

	encoded = egg_asn1x_encode (subject_public_key, NULL);
	g_return_val_if_fail (encoded != NULL, FALSE);

	node = egg_asn1x_node (subject_public_key, "algorithm", "algorithm", NULL);
	oid = egg_asn1x_get_oid_as_quark (node);

	if (oid == GCR_OID_PKIX1_RSA) {
		*mechanisms = RSA_MECHANISMS;
		*n_mechanisms = G_N_ELEMENTS (RSA_MECHANISMS);
		*algorithm = GCR_OID_PKIX1_SHA1_WITH_RSA;

	} else if (oid == GCR_OID_PKIX1_DSA) {
		*mechanisms = DSA_MECHANISMS;
		*n_mechanisms = G_N_ELEMENTS (DSA_MECHANISMS);
		*algorithm = GCR_OID_PKIX1_SHA1_WITH_DSA;

	} else {
		g_bytes_unref (encoded);
		g_set_error (error, GCR_DATA_ERROR, GCR_ERROR_UNRECOGNIZED,
		             _("Unsupported key type for certificate request"));
		return FALSE;
	}

	node = egg_asn1x_node (self->asn, "certificationRequestInfo", "subjectPKInfo", NULL);
	if (!egg_asn1x_decode (node, encoded))
		g_return_val_if_reached (FALSE);

	g_bytes_unref (encoded);
	return TRUE;
}

static void
encode_take_signature_into_request (GcrCertificateRequest *self,
                                    GQuark algorithm,
                                    GNode *subject_public_key,
                                    guchar *result,
                                    gsize n_result)
{
	GNode *params;
	GNode *node;

	node = egg_asn1x_node (self->asn, "signature", NULL);
	egg_asn1x_take_bits_as_raw (node, g_bytes_new_take (result, n_result), n_result * 8);

	node = egg_asn1x_node (self->asn, "signatureAlgorithm", "algorithm", NULL);
	egg_asn1x_set_oid_as_quark (node, algorithm);

	node = egg_asn1x_node (self->asn, "signatureAlgorithm", "parameters", NULL);
	params = egg_asn1x_node (subject_public_key, "algorithm", "parameters", NULL);
	egg_asn1x_set_any_from (node, params);
}

/**
 * gcr_certificate_request_complete:
 * @self: a certificate request
 * @cancellable: a cancellation object
 * @error: location to place an error on failure
 *
 * Complete and sign a certificate request, so that it can be encoded
 * and sent to a certificate authority.
 *
 * This call may block as it signs the request using the private key.
 *
 * Returns: whether certificate request was successfully completed or not
 */
gboolean
gcr_certificate_request_complete (GcrCertificateRequest *self,
                                  GCancellable *cancellable,
                                  GError **error)
{
	GNode *subject_public_key;
	const gulong *mechanisms;
	gsize n_mechanisms;
	GckMechanism mechanism = { 0, };
	GQuark algorithm = 0;
	GBytes *tbs;
	GckSession *session;
	guchar *signature;
	gsize n_signature;
	gboolean ret;

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), FALSE);
	g_return_val_if_fail (cancellable == NULL || G_CANCELLABLE (cancellable), FALSE);
	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

	subject_public_key = _gcr_subject_public_key_load (self->private_key,
	                                                   cancellable, error);
	if (subject_public_key == NULL)
		return FALSE;

	ret = prepare_subject_public_key_and_mechanisms (self, subject_public_key,
	                                                 &algorithm, &mechanisms,
	                                                 &n_mechanisms, error);

	if (!ret) {
		egg_asn1x_destroy (subject_public_key);
		return FALSE;
	}

	/* Figure out which mechanism to use */
	mechanism.type = _gcr_key_mechanisms_check (self->private_key, mechanisms,
	                                            n_mechanisms, CKA_SIGN,
	                                            cancellable, NULL);
	if (mechanism.type == GCK_INVALID) {
		egg_asn1x_destroy (subject_public_key);
		g_set_error (error, GCK_ERROR, CKR_KEY_TYPE_INCONSISTENT,
		             _("The key cannot be used to sign the request"));
		return FALSE;
	}

	tbs = prepare_to_be_signed (self, &mechanism);
	session = gck_object_get_session (self->private_key);
	signature = gck_session_sign_full (session, self->private_key, &mechanism,
	                                   g_bytes_get_data (tbs, NULL),
	                                   g_bytes_get_size (tbs),
	                                   &n_signature, cancellable, error);
	g_object_unref (session);
	g_bytes_unref (tbs);

	if (!signature) {
		egg_asn1x_destroy (subject_public_key);
		return FALSE;
	}

	encode_take_signature_into_request (self, algorithm, subject_public_key,
	                                    signature, n_signature);
	egg_asn1x_destroy (subject_public_key);
	return TRUE;
}

typedef struct {
	GcrCertificateRequest *request;
	GCancellable *cancellable;
	GQuark algorithm;
	GNode *subject_public_key;
	GckMechanism mechanism;
	GckSession *session;
	GBytes *tbs;
} CompleteClosure;

static void
complete_closure_free (gpointer data)
{
	CompleteClosure *closure = data;
	egg_asn1x_destroy (closure->subject_public_key);
	g_clear_object (&closure->request);
	g_clear_object (&closure->cancellable);
	g_clear_object (&closure->session);
	if (closure->tbs)
		g_bytes_unref (closure->tbs);
	g_free (closure);
}

static void
on_certificate_request_signed (GObject *source,
                               GAsyncResult *result,
                               gpointer user_data)
{
	GSimpleAsyncResult *res = G_SIMPLE_ASYNC_RESULT (user_data);
	CompleteClosure *closure = g_simple_async_result_get_op_res_gpointer (res);
	GError *error = NULL;
	guchar *signature;
	gsize n_signature;

	signature = gck_session_sign_finish (closure->session, result, &n_signature, &error);
	if (error == NULL) {
		encode_take_signature_into_request (closure->request,
		                                    closure->algorithm,
		                                    closure->subject_public_key,
		                                    signature, n_signature);

	} else {
		g_simple_async_result_take_error (res, error);
	}

	g_simple_async_result_complete (res);
	g_object_unref (res);
}

static void
on_mechanism_check (GObject *source,
                    GAsyncResult *result,
                    gpointer user_data)
{
	GSimpleAsyncResult *res = G_SIMPLE_ASYNC_RESULT (user_data);
	CompleteClosure *closure = g_simple_async_result_get_op_res_gpointer (res);

	closure->mechanism.type =  _gcr_key_mechanisms_check_finish (closure->request->private_key,
	                                                             result, NULL);
	if (closure->mechanism.type == GCK_INVALID) {
		g_simple_async_result_set_error (res, GCK_ERROR, CKR_KEY_TYPE_INCONSISTENT,
		                                 _("The key cannot be used to sign the request"));
		g_simple_async_result_complete (res);

	} else {
		closure->tbs = prepare_to_be_signed (closure->request, &closure->mechanism);
		gck_session_sign_async (closure->session,
		                        closure->request->private_key,
		                        &closure->mechanism,
		                        g_bytes_get_data (closure->tbs, NULL),
		                        g_bytes_get_size (closure->tbs),
		                        closure->cancellable,
		                        on_certificate_request_signed,
		                        g_object_ref (res));
	}

	g_object_unref (res);
}

static void
on_subject_public_key_loaded (GObject *source,
                              GAsyncResult *result,
                              gpointer user_data)
{
	GSimpleAsyncResult *res = G_SIMPLE_ASYNC_RESULT (user_data);
	CompleteClosure *closure = g_simple_async_result_get_op_res_gpointer (res);
	const gulong *mechanisms;
	gsize n_mechanisms;
	GError *error = NULL;

	closure->subject_public_key = _gcr_subject_public_key_load_finish (result, &error);
	if (error == NULL) {
		prepare_subject_public_key_and_mechanisms (closure->request,
		                                           closure->subject_public_key,
		                                           &closure->algorithm,
		                                           &mechanisms,
		                                           &n_mechanisms,
		                                           &error);
	}

	if (error != NULL) {
		g_simple_async_result_take_error (res, error);
		g_simple_async_result_complete (res);

	} else {
		_gcr_key_mechanisms_check_async (closure->request->private_key,
		                                 mechanisms, n_mechanisms, CKA_SIGN,
		                                 closure->cancellable, on_mechanism_check,
		                                 g_object_ref (res));
	}

	g_object_unref (res);
}

/**
 * gcr_certificate_request_complete_async:
 * @self: a certificate request
 * @cancellable: a cancellation object
 * @callback: called when the operation completes
 * @user_data: data to pass to the callback
 *
 * Asynchronously complete and sign a certificate request, so that it can
 * be encoded and sent to a certificate authority.
 *
 * This call will return immediately and complete later.
 */
void
gcr_certificate_request_complete_async (GcrCertificateRequest *self,
                                        GCancellable *cancellable,
                                        GAsyncReadyCallback callback,
                                        gpointer user_data)
{
	GSimpleAsyncResult *res;
	CompleteClosure *closure;

	g_return_if_fail (GCR_IS_CERTIFICATE_REQUEST (self));
	g_return_if_fail (cancellable == NULL || G_CANCELLABLE (cancellable));

	res = g_simple_async_result_new (G_OBJECT (self), callback, user_data,
	                                 gcr_certificate_request_complete_async);
	closure = g_new0 (CompleteClosure, 1);
	closure->cancellable = cancellable ? g_object_ref (cancellable) : NULL;
	closure->session = gck_object_get_session (self->private_key);
	closure->request = g_object_ref (self);
	g_simple_async_result_set_op_res_gpointer (res, closure, complete_closure_free);

	_gcr_subject_public_key_load_async (self->private_key, cancellable,
	                                    on_subject_public_key_loaded,
	                                    g_object_ref (res));

	g_object_unref (res);
}

/**
 * gcr_certificate_request_complete_finish:
 * @self: a certificate request
 * @result: result of the asynchronous operation
 * @error: location to place an error on failure
 *
 * Finish an asynchronous operation to complete and sign a certificate
 * request.
 *
 * Returns: whether certificate request was successfully completed or not
 */
gboolean
gcr_certificate_request_complete_finish (GcrCertificateRequest *self,
                                         GAsyncResult *result,
                                         GError **error)
{
	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), FALSE);
	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
	g_return_val_if_fail (g_simple_async_result_is_valid (result, G_OBJECT (self),
	                      gcr_certificate_request_complete_async), FALSE);

	if (g_simple_async_result_propagate_error (G_SIMPLE_ASYNC_RESULT (result), error))
		return FALSE;

	return TRUE;
}

/**
 * gcr_certificate_request_encode:
 * @self: a certificate request
 * @textual: whether to encode output as text
 * @length: location to place length of returned data
 *
 * Encode the certificate request. It must have been completed with
 * gcr_certificate_request_complete() or gcr_certificate_request_complete_async()
 *
 * If @textual is %FALSE, the output is a DER encoded certificate request.
 *
 * If @textual is %TRUE, the output is encoded as text. For PKCS\#10 requests this
 * is done using the OpenSSL style PEM encoding.
 *
 * Returns: (transfer full) (array length=length): the encoded certificate request
 */
guchar *
gcr_certificate_request_encode (GcrCertificateRequest *self,
                                gboolean textual,
                                gsize *length)
{
	GBytes *bytes;
	gpointer encoded;
	gpointer data;
	gsize size;

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), NULL);
	g_return_val_if_fail (length != NULL, NULL);

	bytes = egg_asn1x_encode (self->asn, NULL);
	if (bytes == NULL) {
		g_warning ("couldn't encode certificate request: %s",
		           egg_asn1x_message (self->asn));
		return NULL;
	}

	size = g_bytes_get_size (bytes);
	encoded = g_byte_array_free (g_bytes_unref_to_array (bytes), FALSE);

	if (textual) {
		data = egg_armor_write (encoded, size,
		                        g_quark_from_static_string ("CERTIFICATE REQUEST"),
		                        NULL, length);
		g_free (encoded);
		encoded = data;

	} else {
		*length = size;
	}

	return encoded;
}

/**
 * gcr_certificate_request_capable:
 * @private_key: a private key
 * @cancellable: cancellation object
 * @error: location to place an error
 *
 * Check whether #GcrCertificateRequest is capable of creating a request
 * for the given @private_key.
 *
 * Returns: whether a request can be created
 */
gboolean
gcr_certificate_request_capable (GckObject *private_key,
                                 GCancellable *cancellable,
                                 GError **error)
{
	g_return_val_if_fail (GCK_IS_OBJECT (private_key), FALSE);
	g_return_val_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable), FALSE);
	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

	return _gcr_key_mechanisms_check (private_key, ALL_MECHANISMS,
	                                  G_N_ELEMENTS (ALL_MECHANISMS),
	                                 CKA_SIGN, cancellable, error);
}

/**
 * gcr_certificate_request_capable_async:
 * @private_key: a private key
 * @cancellable: cancellation object
 * @callback: will be called when the operation completes
 * @user_data: data to be passed to callback
 *
 * Asynchronously check whether #GcrCertificateRequest is capable of creating
 * a request for the given @private_key.
 */
void
gcr_certificate_request_capable_async (GckObject *private_key,
                                       GCancellable *cancellable,
                                       GAsyncReadyCallback callback,
                                       gpointer user_data)
{
	g_return_if_fail (GCK_IS_OBJECT (private_key));
	g_return_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable));

	_gcr_key_mechanisms_check_async (private_key, ALL_MECHANISMS,
	                                 G_N_ELEMENTS (ALL_MECHANISMS),
	                                 CKA_SIGN, cancellable,
	                                 callback, user_data);
}

/**
 * gcr_certificate_request_capable_finish:
 * @result: asynchronous result
 * @error: location to place an error
 *
 * Get the result for asynchronously check whether #GcrCertificateRequest is
 * capable of creating a request for the given @private_key.
 *
 * Returns: whether a request can be created
 */
gboolean
gcr_certificate_request_capable_finish (GAsyncResult *result,
                                        GError **error)
{
	GObject *source;
	gulong mech;

	g_return_val_if_fail (G_IS_ASYNC_RESULT (result), FALSE);

	source = g_async_result_get_source_object (result);
	mech = _gcr_key_mechanisms_check_finish (GCK_OBJECT (source), result, error);
	g_object_unref (source);

	return mech != GCK_INVALID;
}