/*

* Copyright (c) 2002-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

#include "CCheckedCertStore.h"

#include <signed.h>

#include <x509cert.h>

#include <x509certext.h>

#include <wtlscert.h>

#include <x509keys.h>

#include <securityerr.h>

#include "certificateapps.h"

_LIT(KPanicCategory, "CCheckedCertStore");

#define assert(x) __ASSERT_ALWAYS((x), User::Panic(KPanicCategory, 1));

/////////////////////////////////////////////////////////////////////

//	CCheckedCertStore

/////////////////////////////////////////////////////////////////////

CCheckedCertStore::~CCheckedCertStore()

    {

    Cancel();

    Cleanup();

	// Release the cert store - no need to release the token since this would

	// have been done as part of MCTTokenInterface::Release()

    iCertStore.Release();

	iFs.Close();

    }

CCheckedCertStore::CCheckedCertStore(MCTCertStore& aTokenIF, RProperty& aProperty)

:	CActive(EPriorityStandard), 

	iCertStore(aTokenIF),

	iPSCertstoreChangePropertyRef(aProperty)	

    {

	// need to add reference since we now have the token

	iCertStore.Token().AddRef();

    }

CCheckedCertStore::CCheckedCertStore(MCTWritableCertStore& aTokenIF, RProperty& aProperty)

:	CActive(EPriorityStandard),

	iCertStore(aTokenIF),

	iWritableCertStore(&aTokenIF),

	iPSCertstoreChangePropertyRef(aProperty)

    {

	// need to add reference since we now have the token

	iCertStore.Token().AddRef();

    }

/*static*/ CCheckedCertStore* CCheckedCertStore::NewCheckedCertStoreL(MCTTokenInterface* aTokenIF, RProperty& aProperty)

    {

    assert(aTokenIF);

	MCTCertStore& tokenInterface = static_cast<MCTCertStore&>(*aTokenIF);

	CCheckedCertStore* me = new (ELeave) CCheckedCertStore(tokenInterface, aProperty);

    CleanupReleasePushL(*me);

    me->ConstructL();

    CleanupStack::Pop();

	return (me);

    }

/*static*/ CCheckedCertStore* CCheckedCertStore::NewCheckedWritableCertStoreL(MCTTokenInterface* aTokenIF, RProperty& aProperty)

    {

    assert(aTokenIF);

	MCTWritableCertStore& tokenInterface = static_cast<MCTWritableCertStore&>(*aTokenIF);

	CCheckedCertStore* me = new (ELeave) CCheckedCertStore(tokenInterface, aProperty);

    CleanupReleasePushL(*me);

    me->ConstructL();

    CleanupStack::Pop();

	return (me);

    }

void CCheckedCertStore::ConstructL()

    {

	User::LeaveIfError(iFs.Connect());	

	CActiveScheduler::Add(this);

    }

MCTToken& CCheckedCertStore::Token()

    {

	return iCertStore.Token();

    }

//	May require checking against the keystore *after* calling the server to complete

//	the List request

void CCheckedCertStore::List(RMPointerArray<CCTCertInfo>& aCerts, const CCertAttributeFilter& aFilter,

                             TRequestStatus& aStatus)

    {

    assert(iState == EIdleState);

    // Only allow filtering on key usage for user certs

    if (aFilter.iKeyUsage != EX509UsageAll &&

        (!aFilter.iOwnerTypeIsSet || EUserCertificate != aFilter.iOwnerType))

        {

        TRequestStatus* status = &aStatus;

        User::RequestComplete(status, KErrNotSupported);

        return;

        }

    // Store caller parameters for later reference

    iCallerCerts = &aCerts;

    iCallerFilter = &aFilter;

    aStatus = KRequestPending;

    iCallerStatus = &aStatus;

    iState = EList;

    iCertStore.List(aCerts, aFilter, iStatus);

    SetActive();

    }

void CCheckedCertStore::CancelList()

    {

    if (iState == EList ||

        iState == EInitKeyStoreForList ||

        iState == EGetKeyInfosForList)

        {

        Cancel();

        }

    }

void CCheckedCertStore::GetCert(CCTCertInfo*& aCertInfo, const TCTTokenObjectHandle& aHandle, 

                                TRequestStatus& aStatus)

    {

    assert(iState == EIdleState);

    iCertStore.GetCert(aCertInfo, aHandle, aStatus);

    }

void CCheckedCertStore::CancelGetCert()

    {

    iCertStore.CancelGetCert();

    }

void CCheckedCertStore::Applications(const CCTCertInfo& aCertInfo, RArray<TUid>& aApplications,

									 TRequestStatus& aStatus)

    {

    assert(iState == EIdleState);

    iCertStore.Applications(aCertInfo, aApplications, aStatus);

    }

void CCheckedCertStore::CancelApplications()

    {

    iCertStore.CancelApplications();

    }

void CCheckedCertStore::IsApplicable(const CCTCertInfo& aCertInfo, TUid aApplication, 

                                     TBool& aIsApplicable, TRequestStatus& aStatus)

    {

    assert(iState == EIdleState);

    iCertStore.IsApplicable(aCertInfo, aApplication, aIsApplicable, aStatus);

    }

void CCheckedCertStore::CancelIsApplicable()

    {

    iCertStore.CancelIsApplicable();

    }

void CCheckedCertStore::Trusted(const CCTCertInfo& aCertInfo, TBool& aTrusted, 

                                TRequestStatus& aStatus)

    {

    assert(iState == EIdleState);

    iCertStore.Trusted(aCertInfo, aTrusted, aStatus);

    }

void CCheckedCertStore::CancelTrusted()

    {

    iCertStore.CancelTrusted();

    }

void CCheckedCertStore::Retrieve(const CCTCertInfo& aCertInfo, TDes8& aEncodedCert, 

                                 TRequestStatus& aStatus)

    {

    assert(iState == EIdleState);

    iCertStore.Retrieve(aCertInfo, aEncodedCert, aStatus);

    }

void CCheckedCertStore::CancelRetrieve()

    {

    iCertStore.CancelRetrieve();

    }

void CCheckedCertStore::Add(const TDesC& aLabel, 

							TCertificateFormat aFormat,

                            TCertificateOwnerType aCertificateOwnerType, 

                            const TKeyIdentifier* aSubjectKeyId,

                            const TKeyIdentifier* aIssuerKeyId,

                            const TDesC8& aCert, 

                            TRequestStatus& aStatus)

    {

 	// default value for aDeletable = ETrue		

	Add( aLabel, aFormat, aCertificateOwnerType, aSubjectKeyId, 

			aIssuerKeyId, aCert, ETrue, aStatus );

    }

// new Add(.., TBool aDeletable, ..) method from MCTWritableCertStore

void CCheckedCertStore::Add( const TDesC& aLabel, 

							 TCertificateFormat aFormat,

                             TCertificateOwnerType aCertificateOwnerType, 

                             const TKeyIdentifier* aSubjectKeyId,

                             const TKeyIdentifier* aIssuerKeyId,

                             const TDesC8& aCert, 

                             const TBool aDeletable,

                             TRequestStatus& aStatus

                             )

    {

    assert(iWritableCertStore);

    assert(iState == EIdleState);

    TRAPD(err, DoAddL(	aLabel, 

    					aFormat,

    					aCertificateOwnerType, 

    					aSubjectKeyId, 

    					aIssuerKeyId, 

    					aCert, 

    					aDeletable,

    					aStatus		) );

	if (err != KErrNone)

		{

    	    Complete(err);

		}

	}

void CCheckedCertStore::DoAddL(	const TDesC& aLabel,

								TCertificateFormat aFormat,

                               	TCertificateOwnerType aCertificateOwnerType, 

                               	const TKeyIdentifier* aSubjectKeyId,

                               	const TKeyIdentifier* aIssuerKeyId,

                               	const TDesC8& aCert, 

                               	const TBool aDeletable,

                               	TRequestStatus& aStatus)

    {

    //	Store caller parameters for later use

	    aStatus			= KRequestPending;

	    iCallerStatus	= &aStatus;

	    iFormat 	 	= aFormat;

	    iCertificateOwnerType = aCertificateOwnerType;

	    iSubjectKeyId	= aSubjectKeyId;

	    iIssuerKeyId	= aIssuerKeyId;

		iDeletable  	= aDeletable;

	// Store (copy)  aCert (cert data) into iCertificate[:HBufC8]

	    assert(!iCertificate);

	    iCertificate = HBufC8::NewMaxL(aCert.Size());

	    TPtr8 theCert(iCertificate->Des());

	    theCert.FillZ();

	    theCert.Copy(aCert);

	// Store (copy) aLabel (cert label) into iCertLabel[:HBufC]

	    assert(!iCertLabel);

	    iCertLabel = HBufC::NewMaxL(aLabel.Length());

	    TPtr theLabel(iCertLabel->Des());

	    theLabel.FillZ();

	    theLabel.Copy(aLabel);

    //	Checks subject key ID with certificate data, and sets up key filter

    //	which is used later to determine whether there is a key with the

    //	appropriate subject and thus, if it is OK to add the certificate	

	    ComputeAndCheckSubjectKeyIdL();

    //	Is keystore checking required? Only if a user certificate

    if (EUserCertificate==aCertificateOwnerType)

		{

        	InitialiseKeyStoreL(EInitKeyStoreForAdd);

		}

    else

		{

        iState = EAdd;

        // try new method first

        iWritableCertStore->Add( *iCertLabel,			// call new method

        						 iFormat,

        						 iCertificateOwnerType,

                                 iSubjectKeyId,

                                 iIssuerKeyId,

                                 *iCertificate,

                                 iDeletable,			// with deletable param

                                 iStatus );                    

        SetActive();

		}

	}

void CCheckedCertStore::CancelAdd()

    {

    if (iState == EInitKeyStoreForAdd ||

        iState == EGetKeyInfosForAdd ||

        iState == EAdd || iState == EOldAdd )

        {

        Cancel();

        }

    }

void CCheckedCertStore::ComputeAndCheckSubjectKeyIdL()

    {

	switch (iFormat)

        {

		case EX509Certificate:

            {

			TPtr8 thePtr(iCertificate->Des());

			CX509Certificate* cert = CX509Certificate::NewLC(thePtr);

			TKeyUsageX509 x509Usage = EX509UsageNone;

			const CX509CertExtension* ext = cert->Extension(KKeyUsage);

			if (!ext)

                {

				x509Usage = EX509UsageAll;

                }

			else

                {

				CX509KeyUsageExt* keyUsageExt = CX509KeyUsageExt::NewLC(ext->Data());

				if (keyUsageExt->IsSet(EX509DigitalSignature))

					{

					x509Usage |= EX509UsageDigitalSignature;

					}

				if (keyUsageExt->IsSet(EX509NonRepudiation))

					{

					x509Usage |= EX509UsageNonRepudiation;

					}

				if (keyUsageExt->IsSet(EX509KeyEncipherment))

					{

					x509Usage |= EX509UsageKeyEncipherment;

					}

				if (keyUsageExt->IsSet(EX509DataEncipherment))

					{

					x509Usage |= EX509UsageDataEncipherment;

					}

				if (keyUsageExt->IsSet(EX509KeyAgreement))

					{

					x509Usage |= EX509UsageKeyAgreement;

					}

				if (keyUsageExt->IsSet(EX509KeyCertSign))

					{

					x509Usage |= EX509UsageKeyCertSign;

					}

				if (keyUsageExt->IsSet(EX509CRLSign))

					{

					x509Usage |= EX509UsageCRLSign;

					}

				if (keyUsageExt->IsSet(EX509EncipherOnly))

					{

					x509Usage |= EX509UsageEncipherOnly;

					}

				if (keyUsageExt->IsSet(EX509DecipherOnly))

					{

					x509Usage |= EX509UsageDecipherOnly;

					}

				CleanupStack::PopAndDestroy(keyUsageExt);

                }

			iKeyFilter.iUsage = KeyUsageX509ToPKCS15Private(x509Usage);

			iComputedSubjectKeyId.Zero();

			// For non-user ceriticates (i.e. CA certificates), we use the SubjectKeyIdentifier API, as it

			// tries to get the extension from cert., and calculates a value only if it is not found. This behaviour corresponds to the RFC.

			// For user ceritificates, the key identifier is used for matching key store with cert store, so we cannot use the value in the certificate itself.

			if (iCertificateOwnerType != EUserCertificate)

				{

				iComputedSubjectKeyId = cert->SubjectKeyIdentifierL();

				}

			else

				{

				// For non-CA certs, use the recommended method of computing it from RFC3280, section 4.2.1.2

				iComputedSubjectKeyId = cert->KeyIdentifierL();									

				}

			if (!iSubjectKeyId || *iSubjectKeyId == KNullDesC8)

                {

				iSubjectKeyId = &iComputedSubjectKeyId;

                }

			else if (iSubjectKeyId->Compare(iComputedSubjectKeyId)!=0)

                {//	Different subject ids

				User::Leave(KErrArgument);

                }

			CleanupStack::PopAndDestroy(cert);

            }	

            break;

        case EWTLSCertificate:

            {

            CCertificate* cert = CWTLSCertificate::NewLC(*iCertificate);

            iComputedSubjectKeyId = cert->KeyIdentifierL();

            if (!iSubjectKeyId || *iSubjectKeyId == KNullDesC8)

                {

                iSubjectKeyId = &iComputedSubjectKeyId;

                }

            else if (iSubjectKeyId->Compare(iComputedSubjectKeyId)!=0)

                {//	Different subject ids

                User::Leave(KErrArgument);

                }

            CleanupStack::PopAndDestroy(cert);

            }

            break;

        case EX509CertificateUrl:

            {

            iKeyFilter.iUsage = EPKCS15UsageAll;

            if (!iSubjectKeyId || *iSubjectKeyId == KNullDesC8)

                {

                User::Leave(KErrArgument);

                }

            }

            break;

        default:

            User::Leave(KErrNotSupported);	

            break;

        }

	iKeyFilter.iKeyId = *iSubjectKeyId;

    }

void CCheckedCertStore::Remove(const CCTCertInfo& aCertInfo, TRequestStatus& aStatus)

    {

    assert(iWritableCertStore);

    assert(iState == EIdleState);

    aStatus = KRequestPending;

    iCallerStatus = &aStatus;

    iState = ERemove;

    iWritableCertStore->Remove(aCertInfo, iStatus);

    SetActive();

    }

void CCheckedCertStore::CancelRemove()

    {

    if (iState == ERemove)

        {

        Cancel();

        }

    }

void CCheckedCertStore::SetApplicability(const CCTCertInfo& aCertInfo, const RArray<TUid>& aApplications, TRequestStatus &aStatus)

    {

    assert(iWritableCertStore);

    assert(iState == EIdleState);

    aStatus = KRequestPending;

    iCallerStatus = &aStatus;

    iState = ESetApplicability;

    iWritableCertStore->SetApplicability(aCertInfo, aApplications, iStatus);

    SetActive();

    }

void CCheckedCertStore::CancelSetApplicability()

    {

    if (iState == ESetApplicability)

        {

        Cancel();

        }    

    }

void CCheckedCertStore::SetTrust(const CCTCertInfo& aCertInfo, TBool aTrusted, TRequestStatus& aStatus)

    {

    assert(iWritableCertStore);

    assert(iState == EIdleState);

    aStatus = KRequestPending;

    iCallerStatus = &aStatus;

    iState = ESetTrust;

    iWritableCertStore->SetTrust(aCertInfo, aTrusted, iStatus);

    SetActive();

    }

void CCheckedCertStore::CancelSetTrust()

    {

    if (iState == ESetTrust)

        {

        Cancel();

        }        

    }

TInt CCheckedCertStore::RunError(TInt aError)

    {

    Complete(aError);

	return KErrNone;

    }

void CCheckedCertStore::DoCancel()

    {

	// (see notes on cancellation in CUnifiedCertStore::DoCancel)

	switch (iState)

		{

        case EGetKeyInfosForList:

        case EAdd:

		case ERemove:

		case ESetApplicability:

		case ESetTrust:

			if (iStatus == KRequestPending)

				{

				// Attempt to cancel outstanding request and pass status back to

				// client

				CancelOutstandingRequest();

				Complete(iStatus.Int());

				}

			else

				{

				// We've already been completed - call RunL() to process results

				// and complete client

				TRAPD(err, RunL());

				if (err != KErrNone)

					{

					RunError(err);

					}

				}

			break;

		default:

			CancelOutstandingRequest();

			Complete(KErrCancel);

			break;

		}	

	}

void CCheckedCertStore::CancelOutstandingRequest()

	{

    switch (iState)

        {

        case EList:

            iCertStore.CancelList();

            break;

        case EInitKeyStoreForAdd:

        case EInitKeyStoreForList:

            assert(iUnifiedKeyStore);

            iUnifiedKeyStore->CancelInitialize();

            break;

        case EGetKeyInfosForAdd:

        case EGetKeyInfosForList:

            assert(iUnifiedKeyStore);

            iUnifiedKeyStore->CancelList();

            break;

        case EAdd:

        case EOldAdd:

            assert(iWritableCertStore);

            iWritableCertStore->CancelAdd();

            break;

        case ERemove:

		    assert(iWritableCertStore);

   			iWritableCertStore->CancelRemove();

			break;

        case ESetApplicability:

		    assert(iWritableCertStore);

   			iWritableCertStore->CancelSetApplicability();

			break;

        case ESetTrust:

		    assert(iWritableCertStore);

   			iWritableCertStore->CancelSetTrust();

			break;

        default:

            assert(EFalse);

            break;            

        }

    Complete(KErrCancel);

    }

void CCheckedCertStore::RunL()

    {

    assert(iCallerStatus);

	// we allow only KErrNone OR, possibly, KErrNotSupported after new Add()

	// otherwise - Leave!

	if (iStatus!=KErrNone &&

	    !(iStatus==KErrNotSupported && iState==EAdd) &&

	    !(iStatus == KErrNotFound && (iState==EList || iState==EGetKeyInfosForList || iState==EInitKeyStoreForList)))

		{

    	User::Leave(iStatus.Int());

    	}

    switch (iState)

        {

        case EList:

            if (iCallerFilter->iKeyUsage == EX509UsageAll)

                {

                // No key usage filter, so we're done

                Complete(KErrNone);

                }

            else

                {

                // Set up key filter according list cert parameters

                if (iCallerFilter->iSubjectKeyIdIsSet)

                    {

                    iKeyFilter.iKeyId = iCallerFilter->iSubjectKeyId;

                    }

                else

                    {

                    iKeyFilter.iKeyId = KNullDesC8;

                    }

                iKeyFilter.iUsage = KeyUsageX509ToPKCS15Private(iCallerFilter->iKeyUsage);

                InitialiseKeyStoreL(EInitKeyStoreForList);

                }

            break;

        case EInitKeyStoreForAdd:

        case EInitKeyStoreForList:

            assert(iUnifiedKeyStore);

            iState = (iState == EInitKeyStoreForAdd) ? EGetKeyInfosForAdd : EGetKeyInfosForList;

            iUnifiedKeyStore->List(iKeyInfos, iKeyFilter, iStatus);			

            SetActive();

            break;

        case EGetKeyInfosForList:

            BuildCheckedCertificateListL();	//	Not async

            Complete(KErrNone);

            break;

        case EGetKeyInfosForAdd:

            // We have a filter list of keys - there should be one with

            // the appropriate subject if we are to add it

            if (iKeyInfos.Count() == 0)

                {

                //	The private key can't be found in any key store

                Complete(KErrPrivateKeyNotFound); 

                }

            else

                {

                //	OK to go ahead and add the key

                assert(iWritableCertStore);

                iState = EAdd;

                // try to use new Add(.., TBool aDeletable, ..)

                // if it's not supported it will return with

                // iStatus set to KErrNotSupported

                iWritableCertStore->Add( *iCertLabel,	// call new Add() method

                						 iFormat,

                						 iCertificateOwnerType,

                                         iSubjectKeyId,

                                         iIssuerKeyId,

                                         *iCertificate,

                                         iDeletable,  	// with deletable param

                                         iStatus);

                SetActive();

                }

            break;

        case EAdd:

         	if (iStatus!=KErrNotSupported)

         		{

 	     		// Set published property

 		      	iPSCertstoreChangePropertyRef.Set(KUnifiedCertStorePropertyCat, // category

  												EUnifiedCertStoreFlag,        // key

  	    										1);                           // value

		        // when here means MCTWritableCertStore was able to find 

		        // child's new Add(..,aDeletable,..) method

				// thus, ok and complete with whatever result it returned

			    Complete(iStatus.Int());

		        }

		    else

		       	{

				// here: call to the new Add() method above didn't work,

				// try to call old Add() method

			    iState = EOldAdd;

               	iStatus = KRequestPending;

               	iWritableCertStore->Add( *iCertLabel,	

                						 iFormat,

                						 iCertificateOwnerType,

                                         iSubjectKeyId,

                                         iIssuerKeyId,

                                         *iCertificate,

                                         iStatus);

                SetActive();                                         

               	} 

           	break;

        case EOldAdd:

        case ERemove:  

        case ESetApplicability:     

		case ESetTrust:              

      		// Set published property

 	      	iPSCertstoreChangePropertyRef.Set(KUnifiedCertStorePropertyCat, // category

											EUnifiedCertStoreFlag,        // key

 	      									1);                           // value      

            Complete(iStatus.Int());

            break;

        default:

            assert(EFalse);

            break;

        }

    }

void CCheckedCertStore::InitialiseKeyStoreL(TState aNextState)

    {

    assert(aNextState == EInitKeyStoreForAdd || aNextState == EInitKeyStoreForList);

	assert(!iUnifiedKeyStore);

	iUnifiedKeyStore = CUnifiedKeyStore::NewL(iFs);

    iUnifiedKeyStore->Initialize(iStatus);		

    iState = aNextState;

    SetActive();

    }

void CCheckedCertStore::BuildCheckedCertificateListL()

    {

	TInt certCount = iCallerCerts->Count();

    TInt keyCount = iKeyInfos.Count();

    // Iterate backwards through cert array so remove doesn't affect indicies

    for (TInt i = certCount - 1 ; i >= 0 ; --i)

        {

		CCTCertInfo* certInfo = (*iCallerCerts)[i];

        // It's problem in the certstore implementation if the list contains NULL pointers

        assert(certInfo); 

        // Check for key with corresponding id

		TBool accept = EFalse;

        for (TInt j = 0 ; j < keyCount ; ++j)

            {

            if (iKeyInfos[j]->ID()==certInfo->SubjectKeyId())

                {

                accept = ETrue;

                break;

                }

            }

        // If we don't have it, remove and release the cert info

        if (!accept)

            {

            iCallerCerts->Remove(i);

            certInfo->Release();

            }

        }

    }

void CCheckedCertStore::Complete(TInt aError)

    {

	if (iCallerStatus)

        {

		User::RequestComplete(iCallerStatus, aError);

        }

    Cleanup();

    }

void CCheckedCertStore::Cleanup()

    {

    //	Reset the state machine	

	iState = EIdleState;

	iKeyInfos.Close();

    iSubjectKeyId = NULL;

    iIssuerKeyId = NULL;

    delete iCertLabel;

    iCertLabel = NULL;

    delete iCertificate;

    iCertificate = NULL;

    delete iUnifiedKeyStore;

    iUnifiedKeyStore = 0;		

    iCallerCerts = NULL;

    iCallerFilter = NULL;

    }