/*

 * Copyright (c) 1997-2010 Nokia Corporation and/or its subsidiary(-ies).

 * All rights reserved.

 * This component and the accompanying materials are made available

 * under the terms of the License "Eclipse Public License v1.0"

 * which accompanies this distribution, and is available

 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

 *

 * Initial Contributors:

 * Nokia Corporation - initial contribution.

 *

 * Contributors:

 *

 * Description: 

 *

 */

 #include "pkixchainbuilder.h"

 CPKIXChainBuilder* CPKIXChainBuilder::NewL()

 	{

 	CPKIXChainBuilder* s = CPKIXChainBuilder::NewLC();

 	CleanupStack::Pop(s);

 	return s;

 	}

 CPKIXChainBuilder* CPKIXChainBuilder::NewLC()

 	{

 	CPKIXChainBuilder* s = new (ELeave) CPKIXChainBuilder;

 	CleanupStack::PushL(s);

 	s->ConstructL();

 	return s;

 	}

 CPKIXChainBuilder::~CPKIXChainBuilder()

 	{

 	Cancel();

 	iSources.Close();

 	iCandidates.ResetAndDestroy();

 	iCandidates.Close();

 	}

 void CPKIXChainBuilder::AddSourceL(MPKIXCertSource* aSource)

 	{

 	User::LeaveIfError(iSources.Append(aSource));

 	}

 void CPKIXChainBuilder::AddIssuer(TInt& aNumberOfCertsAdded,

 								  TBool& aResult, 

 								  CArrayPtrFlat<CX509Certificate>& aChain, 

 								  TRequestStatus& aStatus)

 	{

 	iOriginalRequestStatus = &aStatus;

 	aStatus = KRequestPending;

 	iResult = &aResult;

 	iChain = &aChain;

 	iNumberOfCertsAdded = &aNumberOfCertsAdded;

 	iSubject = aChain[aChain.Count()-1];

 	__ASSERT_DEBUG(iSubject, User::Panic(_L("CPKICCertChainAO"), 1));

 	__ASSERT_DEBUG(!iCandidates.Count(), User::Panic(_L("CPKICCertChainAO"), 1));

 	iIndex = -1;

 	iState = EAddCandidate;

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 CPKIXChainBuilder::CPKIXChainBuilder()

 : CActive(EPriorityNormal)

 	{

 	CActiveScheduler::Add(this);

 	}

 void CPKIXChainBuilder::ConstructL()

 	{

 	}

 TBool CPKIXChainBuilder::ResolveIssuersL(CArrayPtr<CX509Certificate>& aChain,

 										 const RPointerArray<CX509Certificate>& aCandidates) const

 	{

 	//*this function attempts to figure out which certificate in aCandidates is the issuer of

 	//the last cert in the aChain, and adds a *copy* of the best guess to aChain

 	//*it assumes that the names match already

 	//*if it establishes that none are any good it returns EFalse

 	TInt count = aCandidates.Count();

 	if (count == 0)

 		{

 		return EFalse;

 		}

 	if (count == 1)

 		{

 		CX509Certificate* cert = CX509Certificate::NewLC(*aCandidates[0]);

 		aChain.AppendL(cert);

 		(*iNumberOfCertsAdded)++;

 		CleanupStack::Pop(cert);

 		return ETrue;

 		}

 	const CX509Certificate* current = aChain[aChain.Count() - 1];

 			//1)  look for SKI/AKI to distinguish

 	const CX509CertExtension* akiExt = current->Extension(KAuthorityKeyId);

 	if (akiExt)

 		{

 		const CX509AuthorityKeyIdExt* aki = CX509AuthorityKeyIdExt::NewLC(akiExt->Data());

 		TPtrC8 authorityKeyId = aki->KeyId();

 		if (authorityKeyId != KNullDesC8)

 			{

 			for (TInt i = 0; i < count; i++)

 				{

 				const CX509CertExtension* skiExt = (aCandidates[i])->Extension(KSubjectKeyId);

 				if (skiExt)

 					{

 					const CX509SubjectKeyIdExt* ski = CX509SubjectKeyIdExt::NewLC(skiExt->Data());

 					if (authorityKeyId == ski->KeyId())

 						{

 						CX509Certificate* issuer = CX509Certificate::NewLC(*aCandidates[i]);

 						aChain.AppendL(issuer);

 						(*iNumberOfCertsAdded)++;

 						CleanupStack::Pop();//issuer

 						CleanupStack::PopAndDestroy(2);//aki, ski

 						return ETrue;

 						}

 					else

 						{

 						CleanupStack::PopAndDestroy();//ski

 						}

 					}

 				}

 			}

 		//ok, we haven't got a key ID for the issuer, so try for a serial number instead...

 		else

 			{

 			TPtrC8 authoritySerialNo = aki->AuthorityCertSerialNumber();

 			for (TInt i = 0; i < count; i++)

 				{

 				const CX509Certificate* candidate = aCandidates[i];

 				if (authoritySerialNo == candidate->SerialNumber())

 					{

 					CX509Certificate* issuer = CX509Certificate::NewLC(*candidate);

 					aChain.AppendL(issuer);

 					(*iNumberOfCertsAdded)++;

 					CleanupStack::Pop();//issuer

 					CleanupStack::PopAndDestroy();//aki

 					return ETrue;

 					}

 				}

 			}

 		CleanupStack::PopAndDestroy();//aki

 		}

 	// If more then one subject matching candidates are found and they doesn't contain SKI/AKI,

 	// consider the most recently imported/added candidate as the issuer.

 	for(TInt index = count - 1; index >= 0; --index)

 		{

 		TTime currentTime;

 		// if secure time is not available then fall back to the insecure version.

 		if(currentTime.UniversalTimeSecure() == KErrNoSecureTime)

 			{

 			currentTime.UniversalTime();

 			}

 		CX509Certificate* cert = CX509Certificate::NewLC(*aCandidates[index]);

 		// SKI/AKI are optional in versions lower than 3. So, relax the candidate selection rules only for version 1 & 2

 		// If the recent candidate is not valid enough(cert expired), consider it's previous valid candidate.

 		if((cert->Version() < 3) && (cert->ValidityPeriod().Valid(currentTime)))

 			{				

 			aChain.AppendL(cert);

 			++(*iNumberOfCertsAdded);

 			CleanupStack::Pop(cert);

 			return ETrue;				

 			}

 		else

 			{

 			CleanupStack::PopAndDestroy(cert);

 			continue;

 			}			

 		}

 	return EFalse;

 	}

 void CPKIXChainBuilder::RunL()

 	{

 	User::LeaveIfError(iStatus.Int());

 	switch (iState)

 		{

 	case EAddCandidate:

 		iIndex++;

 		if (iIndex < iSources.Count())

 			{

 			iSources[iIndex]->CandidatesL(*iSubject, iCandidates, iStatus);

 			}

 		else

 			{

 			iState = EFinished;

 			TRequestStatus* status = &iStatus;

 			User::RequestComplete(status, KErrNone);

 			}

 		SetActive();

 		break;

 	case EFinished:

 		iState = EIdle;

 		*iResult = ResolveIssuersL(*iChain, iCandidates);

 		iCandidates.ResetAndDestroy();

 		User::RequestComplete(iOriginalRequestStatus, KErrNone);

 		break;

 	default:

 		User::Panic(_L("CPKIXChainBuilder"), 1);

 		break;

 		}

 	}

 void CPKIXChainBuilder::DoCancel()

 	{

 	int i = 0;

 	int end = iSources.Count();

 	while (i < end)

 		{

 		iSources[i]->CancelCandidates();

 		i++;

 		}

 	iCandidates.ResetAndDestroy();

 	User::RequestComplete(iOriginalRequestStatus, KErrCancel);

 	iState = EIdle;

 	}

 TInt CPKIXChainBuilder::RunError(TInt aError)

 	{

 	iState = EIdle;

 	iCandidates.ResetAndDestroy();

 	User::RequestComplete(iOriginalRequestStatus, aError);

 	return KErrNone;

 	}