/*

* Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

#include "pkixcertchainao.h"

#include "pkixCons.h"

#include <x509keys.h>

#include <pkixcertchain.h>

#include "x509constraintext.h"

CPKIXCertChainAO* CPKIXCertChainAO::NewL(MCertStore& aCertStore,

										 CPKIXCertChainBase &aPKIXCertChain,

										 const RPointerArray<CX509Certificate>& aRootCerts)

	{

	CPKIXCertChainAO* self = new(ELeave) CPKIXCertChainAO(aCertStore, aPKIXCertChain);

	CleanupStack::PushL(self);

	self->ConstructL(aRootCerts);

	CleanupStack::Pop(self);

	return self;

	}

CPKIXCertChainAO* CPKIXCertChainAO::NewL(MCertStore& aCertStore, 

										 CPKIXCertChainBase &aPKIXCertChain,

										 const TUid aClient)

	{

	return new(ELeave) CPKIXCertChainAO(aCertStore, aPKIXCertChain, aClient);

	}

CPKIXCertChainAO::~CPKIXCertChainAO()

	{

	Cancel();

	delete iRoots;

	delete iBuilder;

	delete iCertsFromStoreRoots;

	}

CPKIXCertChainAO::CPKIXCertChainAO(MCertStore& aCertStore,

								   CPKIXCertChainBase &aPKIXCertChain)

	: CActive(EPriorityNormal), iCertStore(&aCertStore), iPKIXCertChain(aPKIXCertChain)

	{

	CActiveScheduler::Add(this);

	}

CPKIXCertChainAO::CPKIXCertChainAO(MCertStore& aCertStore, 

								   CPKIXCertChainBase &aPKIXCertChain,

								   const TUid aClient)

	: CActive(EPriorityNormal), iCertStore(&aCertStore),

	  iPKIXCertChain(aPKIXCertChain), iClient(aClient)

	{

	CActiveScheduler::Add(this);

	}

void CPKIXCertChainAO::ConstructL(const RPointerArray<CX509Certificate>& aRootCerts)

	{

	CPKIXCertsFromClient* roots = CPKIXCertsFromClient::NewLC(aRootCerts);

	iRoots = CPKIXChainBuilder::NewL();

	iRoots->AddSourceL(roots);

	CleanupStack::Pop(roots);

	}

void CPKIXCertChainAO::RunL()

	{

	User::LeaveIfError(iStatus.Int());

	switch (iState)

		{

		case EAddRoots:

			HandleEAddRootsL();

			break;

		case ERootsInitialized:

			HandleERootsInitializedL();

			break;

		case EBuildChainStart:

			HandleEBuildChainStartL();

			break;

		case EBuildChainAddCandidateEnd:

			HandleEBuildChainAddCandidateEndL();

			break;

		case EBuildChainCertsFromStoreBegin:

			HandleEBuildChainCertsFromStoreBeginL();

			break;

		case EBuildChainCertsFromStoreEnd:

			HandleEBuildChainCertsFromStoreEndL();

			break;

		case EAddCandidateIntermediateCertsEnd:

			HandleEAddCandidateIntermediateCertsEndL();

			break;

		case EValidateEnd:

			HandleEValidateEndL();

			break;

		default:

			User::Panic(_L("CPKIXCertChainAO"), 1);

			break;

		}

	}

TInt CPKIXCertChainAO::RunError(TInt aError)

{

	iPKIXCertChain.RemoveLastCerts(iNumberOfAddedCertificates);

	iNumberOfAddedCertificates = 0;

	delete iRoots;

	iRoots = 0;

	delete iBuilder;

	iBuilder = 0;

	delete iCertsFromStoreRoots;

	iCertsFromStoreRoots = 0;

	iValidationResult->RemovePolicies();

	User::RequestComplete(iOriginalRequestStatus, aError);

	return KErrNone;

}

/**

 * Creates a list of all the certificates retrieved from the store based on the filter passed.  

 */

void CPKIXCertChainAO::HandleEAddRootsL()

	{

	__ASSERT_DEBUG(!iCertsFromStoreRoots, User::Panic(_L("CPKICCertChainAO"), 1));

	iCertsFromStoreRoots = CPKIXCertsFromStore::NewL(*iCertStore, iClient);

	iCertsFromStoreRoots->Initialize(iStatus);

	iState = ERootsInitialized;	

	SetActive();

	}

/**

 * Adds the list of certificates retrieved from the store, iRoots (CPKIXChainBuilder)

 * maintains a templatized list of all the certificates in MPKIXCertSource format.

 */

void CPKIXCertChainAO::HandleERootsInitializedL()

	{

	iRoots->AddSourceL(iCertsFromStoreRoots);

	// Ownership has been passed to iRoots

	iCertsFromStoreRoots = 0;

	iState = EBuildChainStart;

	TRequestStatus* status = &iStatus;

	User::RequestComplete(status, KErrNone);

	SetActive();

	}

void CPKIXCertChainAO::HandleEBuildChainStartL()

	{

	if ( false == iPKIXCertChain.ChainHasRoot())

		{

		if (iPKIXCertChain.Chain().Count() == 0)

			{

			iState = EValidateEnd;

			TRequestStatus* status = &iStatus;

			User::RequestComplete(status, KErrNone);

			}

		else

			{

			//1) look for an issuer that's a root

			iRoots->AddIssuer(iNumberOfAddedCertificates, iAddIssuerResult, iPKIXCertChain.Chain(), iStatus);

			iState = EBuildChainAddCandidateEnd;

			}

		}

	else

		{

		// This is the correct state as at this point the chain of certificate has been build upto a

		// root certificate.

		iState = EValidateEnd;

		TRequestStatus* status = &iStatus;

		User::RequestComplete(status, KErrNone);

		}

	SetActive();

	}

void CPKIXCertChainAO::HandleEBuildChainAddCandidateEndL()

	{

	if (iAddIssuerResult)

		{

		iPKIXCertChain.SetChainHasRoot(ETrue);

		iState = EValidateEnd;

		}

	else

		{

		//2) look for a non-root issuer in intermediate certs

		iBuilder = CPKIXChainBuilder::NewL();

		CPKIXCertsFromClient* serverCerts = CPKIXCertsFromClient::NewLC(iPKIXCertChain.IntermediateCerts());

		iBuilder->AddSourceL(serverCerts);

		CleanupStack::Pop(serverCerts);

		iState = EBuildChainCertsFromStoreBegin;

		}

	TRequestStatus* status = &iStatus;

	User::RequestComplete(status, KErrNone);

	SetActive();

	}

void CPKIXCertChainAO::HandleEBuildChainCertsFromStoreBeginL()

	{

	//3) look for a non-root issuer in the store

	iCertsFromStoreRoots = CPKIXCertsFromStore::NewL(*iCertStore);

	iCertsFromStoreRoots->Initialize(iStatus);

	iState = EBuildChainCertsFromStoreEnd;

	SetActive();

	}

void CPKIXCertChainAO::HandleEBuildChainCertsFromStoreEndL()

	{

	iBuilder->AddSourceL(iCertsFromStoreRoots);

	iCertsFromStoreRoots = 0;

	iBuilder->AddIssuer(iNumberOfAddedCertificates, iAddIssuerResult, iPKIXCertChain.Chain(), iStatus);

	iState = EAddCandidateIntermediateCertsEnd;

	SetActive();

	}

void CPKIXCertChainAO::HandleEAddCandidateIntermediateCertsEndL()

	{

	if (iAddIssuerResult)

		{

		// cert is a pointer to something we don't own

		CX509Certificate* cert = iPKIXCertChain.Chain().At(iPKIXCertChain.Chain().Count() - 1);

		/* If the issuer is not a self signed certificate then it cannot be trusted anchor for the chain 

		 * validation process, this means that we restart the certification validation process.

		 */ 

		if (!(cert->IsSelfSignedL()))

			{

			iState = EBuildChainStart;	

			}

		else

			{

			iState = EValidateEnd;			

			}

		}

	else

		{

		iState = EValidateEnd;	

		}

	delete iBuilder;

	iBuilder = 0;

	TRequestStatus* status = &iStatus;

	User::RequestComplete(status, KErrNone);

	SetActive();

	}

void CPKIXCertChainAO::HandleEValidateEndL()

	{

	InitParamsL();

	__ASSERT_DEBUG(iValidationResult, User::Panic(_L("CPKICCertChainAO"), 1));

	DoValidateL(*iValidationResult, iValidationTime, iInitialPolicies);

	User::RequestComplete(iOriginalRequestStatus, KErrNone);

	}

void CPKIXCertChainAO::DoCancel()

	{

	delete iRoots;

	iRoots = 0;

	delete iBuilder;

	iBuilder = 0;

	delete iCertsFromStoreRoots;

	iCertsFromStoreRoots = 0;

	User::RequestComplete(iOriginalRequestStatus, KErrCancel);

	}

void CPKIXCertChainAO::ValidateL(CPKIXValidationResultBase& aValidationResult,

								 const TTime& aValidationTime,								 

								 const CArrayPtr<HBufC>* aInitialPolicies,

								 TRequestStatus& aStatus)

	{

	aValidationResult.Reset();

	iValidationResult = &aValidationResult;

	iValidationTime = aValidationTime;

	iInitialPolicies = aInitialPolicies;

	iOriginalRequestStatus = &aStatus;

	iNumberOfAddedCertificates = 0;

	__ASSERT_ALWAYS(!IsActive(), User::Panic(_L("CPKICCertChainAO"), 1));

	if (!iRoots)

		{

		// If iRoots is 0, it means that the caller gave a uid and that

		// we must retrieve the trusted certificates from the different

		// stores

		iRoots = CPKIXChainBuilder::NewL();

		iState = EAddRoots;

		}

	else

		{

		// The caller gave a set of certificates it trusts,

		// so we don't have to retrieve anything from the stores

		iState = EBuildChainStart;

		}

	aStatus = KRequestPending;

	TRequestStatus *status = &iStatus;

	User::RequestComplete(status, KErrNone);

	SetActive();

	}

void CPKIXCertChainAO::CancelValidate()

	{

	Cancel();

	}

void CPKIXCertChainAO::InitParamsL()

/*

this function initialises signing key parameters for the certificates

-only DSA needs these at present

-we get the signing key, from the spki of the issuer

-if it's dsa, we look for params here

	-if we find them we initialise the cert with them

	-otherwise, we look in the issuer's issuer

		-if we don't find them there we give up.

*/

	{

	// If the root is DSA signed, set its parameters

	TInt count = iPKIXCertChain.Chain().Count();

	CX509Certificate* current = iPKIXCertChain.Chain().At(count-1);

	TAlgorithmId signingAlgorithm = current->SigningAlgorithm().AsymmetricAlgorithm().Algorithm();

	if (signingAlgorithm == EDSA)

		{

		const CSubjectPublicKeyInfo& key = current->PublicKey();

		SetParamsL(*current, key.EncodedParams());

		}

	// Also the rest of the chain

	for (TInt i = count - 2; i >= 0; i--)

		{

		current = iPKIXCertChain.Chain().At(i);

		TAlgorithmId signingAlgorithm = current->SigningAlgorithm().AsymmetricAlgorithm().Algorithm();

		if (signingAlgorithm == EDSA)

			{

			// Look down the chain for parameters

			for (TInt j = i+1; j < count; j++)

				{

				CX509Certificate* issuer = iPKIXCertChain.Chain().At(j);

				const CSubjectPublicKeyInfo& key = issuer->PublicKey();

				if (key.EncodedParams() != KNullDesC8 && key.AlgorithmId() == EDSA)

					{

					SetParamsL(*current, key.EncodedParams());

					break;

					}

				}

			}

		}

	}

void CPKIXCertChainAO::SetParamsL(CX509Certificate& aCert, const TPtrC8& aEncodedParams)

	{

	TX509KeyFactory factory;

	CDSAParameters* theDSAParams = factory.DSAParametersL(aEncodedParams);

	CleanupStack::PushL(theDSAParams);

	CSigningKeyParameters* params = CSigningKeyParameters::NewLC();

	params->SetDSAParamsL(*theDSAParams);

	aCert.SetParametersL(*params);

	CleanupStack::PopAndDestroy(2, theDSAParams);

	}

void CPKIXCertChainAO::DoValidateL(CPKIXValidationResultBase& aValidationResult,

								 const TTime& aValidationTime, 

								 const CArrayPtr<HBufC>* aInitialPolicies)

	{

	if (!iPKIXCertChain.ChainHasRoot())

		{

		aValidationResult.SetError(EChainHasNoRoot, 0);

		}

	else

		{

		CPKIXValidationState* state = CPKIXValidationState::NewLC(aValidationTime, iPKIXCertChain.Chain().Count(), aInitialPolicies);

		TRAPD(err, ProcessCertsL(*state, aValidationResult));

		//a leave here means either:

		//	-a validation error, in which case we've set the error field in result, or

		//	-some other error (e.g. OOM) in which case error is still EChainHasNoRoot

		if ((err != KErrNone) && ((aValidationResult.Error().iReason) == EChainHasNoRoot))

			//then we left with a non-validation-related error, so leave again...

			{

			User::Leave(err);

			}

		CleanupStack::PopAndDestroy(state);

		}

	}

// ProcessCertsL: This function validates a complete certificate 

//                chain. If an error occurs in this function the function

//                SetErrorAndLeaveL must be called. 

// 

// Note Do not use SetErrorAndLeaveL with EChainHasNoRoot (see TRAP code in 

// CPKIXCertChainAO::DoValidateL )             

void CPKIXCertChainAO::ProcessCertsL(CPKIXValidationState& aState,

									 CPKIXValidationResultBase& aResult) const

	{

	TPKIXPolicyConstraint policy(aState, aResult);

	TPKIXNameConstraint name(aState, aResult);

	TPKIXBasicConstraint basic(aState, aResult);

	TPKIXKeyUsageConstraint keyUsage(aState, aResult);

	for (; aState.iPos >= 0; aState.iPos--)

		{

		aState.iMaxPathLength--;

		if (aState.iMaxPathLength < aState.iPos)

			{

			aResult.SetErrorAndLeaveL(EPathTooLong, aState.iPos);

			}

		const CX509Certificate* current = iPKIXCertChain.Chain().At(aState.iPos);

		CCertificateValidationWarnings* certWarnings = CCertificateValidationWarnings::NewLC(aState.iPos);

		aResult.AppendCertificateValidationObjectL(*certWarnings);

		CleanupStack::Pop(certWarnings);

		CriticalExtsL(aState, *current);

		CheckCriticalExtsL(aState, aResult);

		CheckSignatureAndNameL(*current, aState, aResult);

		//!!!!NO!!checks for revocation at this time!!

		if (!(current->ValidityPeriod().Valid(aState.iValidationTime)))

			{

			//validity period invalid, now check how to report this

			if (iPKIXCertChain.ValidityPeriodCheckFatal())

				{

				aResult.SetErrorAndLeaveL(EDateOutOfRange, aState.iPos);

				}

			else

				{

				aResult.AppendWarningL(TValidationStatus(EDateOutOfRange, aState.iPos));

				}

			}

		policy.CheckCertPoliciesL(*current);

		name.CheckNameConstraintsL(*current);

		keyUsage.CheckKeyUsageL(*current);

		if (aState.iPos < (iPKIXCertChain.Chain().Count() - 1))

			{

			basic.CheckCertSubjectTypeL(*current);

			}

		basic.UpdatePathLengthConstraintsL(*current);

		name.UpdateNameConstraintsL(*current);

		policy.UpdatePolicyConstraintsL(*current);

		aState.iCriticalExts->Reset();

		}

	policy.FinishPolicyCheckL();

	//*copy* all policies from aState.iAuthorityConstrainedPolicies into aResult.iPolicies

	TInt policyCount = aState.iAuthorityConstrainedPolicies->Count();

	for (TInt i = 0; i < policyCount; i ++)

		{

		CX509CertPolicyInfo* policyInfo = CX509CertPolicyInfo::NewLC(*(aState.iAuthorityConstrainedPolicies->At(i)));

		aResult.AppendPolicyL(*policyInfo);

		CleanupStack::Pop(policyInfo);

		}

	aResult.SetError(EValidatedOK, 0);

	}

void CPKIXCertChainAO::CriticalExtsL(CPKIXValidationState& aState, 

									 const CX509Certificate& aCert) const

	{

	const CArrayPtrFlat<CX509CertExtension>& exts = aCert.Extensions();

	TInt count = exts.Count();

	for (TInt i = 0; i < count; i++)

		{

		CX509CertExtension* ext = exts.At(i);

		if (ext->Critical())

			{

			aState.iCriticalExts->AppendL(ext);

			}

		}	 

	}

void CPKIXCertChainAO::CheckSignatureAndNameL(const CX509Certificate& aCert, CPKIXValidationState& aState, 

											CPKIXValidationResultBase& aResult) const

	{

	TInt issuerPos = aState.iPos + 1;

	if (issuerPos == iPKIXCertChain.Chain().Count())

		//then it's the root

		{

		if (aCert.IssuerName().ExactMatchL(aCert.SubjectName()))

			//then it claims to be self signed, sig must verify

			{

			if (!(aCert.VerifySignatureL(aCert.PublicKey().KeyData())))

				{

				aResult.SetErrorAndLeaveL(ESignatureInvalid, aState.iPos);

				}

			}

		else

			//we generate a warning

			{

			aResult.AppendWarningL(TValidationStatus(ERootCertNotSelfSigned, aState.iPos));

			}

		}

	else

		//then it isn't the root: so names must chain & sigs must verify

		{

		const CX509Certificate* issuer = iPKIXCertChain.Chain().At(issuerPos);

		if (!(aCert.IssuerName().ExactMatchL(issuer->SubjectName())))

			{

			aResult.SetErrorAndLeaveL(ENamesDontChain, aState.iPos);

			}

		if (!(aCert.VerifySignatureL(issuer->PublicKey().KeyData())))

			{

			aResult.SetErrorAndLeaveL(ESignatureInvalid, aState.iPos);

			}

		}

	}

void CPKIXCertChainAO::CheckCriticalExtsL(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult) const

	{

	TBool foundUnrecognisedCritExt;

	// retrieve the supported list of critical extensions. If a critical extension is found whose OID matches an 

	// element in this set then certificate validation shall treat this as a warning instead of an error.

	const RPointerArray<TDesC>& supportedCritExt = iPKIXCertChain.SupportedCriticalExtensions();

	TInt count = aState.iCriticalExts->Count();

	TInt supportedCount = supportedCritExt.Count();

	for (TInt i = 0; i < count; i++)

		{

		foundUnrecognisedCritExt = ETrue;

		const CX509CertExtension* ext = aState.iCriticalExts->At(i);

		const TPtrC& extName = ext->Id();

		for (TInt j = 0; j < supportedCount; ++j)

			{

			if (extName == *supportedCritExt[j])

				{

				foundUnrecognisedCritExt = EFalse;

				HBufC* oid = extName.AllocLC();

				aResult.AppendCriticalExtensionWarningL(*oid);

				CleanupStack::Pop(oid);

				break;

				}

			}			

		if (extName == KExtendedKeyUsage)

			{

			aResult.AppendWarningL(TValidationStatus(ECriticalExtendedKeyUsage, aState.iPos));

			}

		else if (extName == KPolicyMapping)

			{

			aResult.AppendWarningL(TValidationStatus(ECriticalPolicyMapping, aState.iPos));

			}

		else if (extName == KInhibitAnyPolicy)

			{

			//ignore this in the same way

			}

		else if (extName == KDeviceIdListConstraint)

			{

			aResult.AppendWarningL(TValidationStatus(ECriticalDeviceId, aState.iPos));

			}

		else if(extName == KSidListConstraint)

			{

			aResult.AppendWarningL(TValidationStatus(ECriticalSid, aState.iPos));

			}

		else if(extName == KVidListConstraint)

			{

			aResult.AppendWarningL(TValidationStatus(ECriticalVid, aState.iPos));

			}

		else if(extName == KCapabilitiesConstraint)

			{

			aResult.AppendWarningL(TValidationStatus(ECriticalCapabilities, aState.iPos));

			}

		if (foundUnrecognisedCritExt)

			{

			aResult.SetErrorAndLeaveL(EUnrecognizedCriticalExtension, aState.iPos);

			}			

		}

	}