/*

 * Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies).

 * All rights reserved.

 * This component and the accompanying materials are made available

 * under the terms of the License "Eclipse Public License v1.0"

 * which accompanies this distribution, and is available

 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

 *

 * Initial Contributors:

 * Nokia Corporation - initial contribution.

 *

 * Contributors:

 *

 * Description: 

 *

 */

 #include "pkixcertchainao.h"

 #include "pkixCons.h"

 #include <x509keys.h>

 #include <pkixcertchain.h>

 #include "x509constraintext.h"

 CPKIXCertChainAO* CPKIXCertChainAO::NewL(MCertStore& aCertStore,

 										 CPKIXCertChainBase &aPKIXCertChain,

 										 const RPointerArray<CX509Certificate>& aRootCerts)

 	{

 	CPKIXCertChainAO* self = new(ELeave) CPKIXCertChainAO(aCertStore, aPKIXCertChain);

 	CleanupStack::PushL(self);

 	self->ConstructL(aRootCerts);

 	CleanupStack::Pop(self);

 	return self;

 	}

 CPKIXCertChainAO* CPKIXCertChainAO::NewL(MCertStore& aCertStore, 

 										 CPKIXCertChainBase &aPKIXCertChain,

 										 const TUid aClient)

 	{

 	return new(ELeave) CPKIXCertChainAO(aCertStore, aPKIXCertChain, aClient);

 	}

 CPKIXCertChainAO::~CPKIXCertChainAO()

 	{

 	Cancel();

 	delete iRoots;

 	delete iBuilder;

 	delete iCertsFromStoreRoots;

 	}

 CPKIXCertChainAO::CPKIXCertChainAO(MCertStore& aCertStore,

 								   CPKIXCertChainBase &aPKIXCertChain)

 	: CActive(EPriorityNormal), iCertStore(&aCertStore), iPKIXCertChain(aPKIXCertChain)

 	{

 	CActiveScheduler::Add(this);

 	}

 CPKIXCertChainAO::CPKIXCertChainAO(MCertStore& aCertStore, 

 								   CPKIXCertChainBase &aPKIXCertChain,

 								   const TUid aClient)

 	: CActive(EPriorityNormal), iCertStore(&aCertStore),

 	  iPKIXCertChain(aPKIXCertChain), iClient(aClient)

 	{

 	CActiveScheduler::Add(this);

 	}

 void CPKIXCertChainAO::ConstructL(const RPointerArray<CX509Certificate>& aRootCerts)

 	{

 	CPKIXCertsFromClient* roots = CPKIXCertsFromClient::NewLC(aRootCerts);

 	iRoots = CPKIXChainBuilder::NewL();

 	iRoots->AddSourceL(roots);

 	CleanupStack::Pop(roots);

 	}

 void CPKIXCertChainAO::RunL()

 	{

 	User::LeaveIfError(iStatus.Int());

 	switch (iState)

 		{

 		case EAddRoots:

 			HandleEAddRootsL();

 			break;

 		case ERootsInitialized:

 			HandleERootsInitializedL();

 			break;

 		case EBuildChainStart:

 			HandleEBuildChainStartL();

 			break;

 		case EBuildChainAddCandidateEnd:

 			HandleEBuildChainAddCandidateEndL();

 			break;

 		case EBuildChainCertsFromStoreBegin:

 			HandleEBuildChainCertsFromStoreBeginL();

 			break;

 		case EBuildChainCertsFromStoreEnd:

 			HandleEBuildChainCertsFromStoreEndL();

 			break;

 		case EAddCandidateIntermediateCertsEnd:

 			HandleEAddCandidateIntermediateCertsEndL();

 			break;

 		case EValidateEnd:

 			HandleEValidateEndL();

 			break;

 		default:

 			User::Panic(_L("CPKIXCertChainAO"), 1);

 			break;

 		}

 	}

 TInt CPKIXCertChainAO::RunError(TInt aError)

 {

 	iPKIXCertChain.RemoveLastCerts(iNumberOfAddedCertificates);

 	iNumberOfAddedCertificates = 0;

 	delete iRoots;

 	iRoots = 0;

 	delete iBuilder;

 	iBuilder = 0;

 	delete iCertsFromStoreRoots;

 	iCertsFromStoreRoots = 0;

 	iValidationResult->RemovePolicies();

 	User::RequestComplete(iOriginalRequestStatus, aError);

 	return KErrNone;

 }

 /**

  * Creates a list of all the certificates retrieved from the store based on the filter passed.  

  */

 void CPKIXCertChainAO::HandleEAddRootsL()

 	{

 	__ASSERT_DEBUG(!iCertsFromStoreRoots, User::Panic(_L("CPKICCertChainAO"), 1));

 	iCertsFromStoreRoots = CPKIXCertsFromStore::NewL(*iCertStore, iClient);

 	iCertsFromStoreRoots->Initialize(iStatus);

 	iState = ERootsInitialized;	

 	SetActive();

 	}

 /**

  * Adds the list of certificates retrieved from the store, iRoots (CPKIXChainBuilder)

  * maintains a templatized list of all the certificates in MPKIXCertSource format.

  */

 void CPKIXCertChainAO::HandleERootsInitializedL()

 	{

 	iRoots->AddSourceL(iCertsFromStoreRoots);

 	// Ownership has been passed to iRoots

 	iCertsFromStoreRoots = 0;

 	iState = EBuildChainStart;

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 void CPKIXCertChainAO::HandleEBuildChainStartL()

 	{

 	if ( false == iPKIXCertChain.ChainHasRoot())

 		{

 		if (iPKIXCertChain.Chain().Count() == 0)

 			{

 			iState = EValidateEnd;

 			TRequestStatus* status = &iStatus;

 			User::RequestComplete(status, KErrNone);

 			}

 		else

 			{

 			//1) look for an issuer that's a root

 			iRoots->AddIssuer(iNumberOfAddedCertificates, iAddIssuerResult, iPKIXCertChain.Chain(), iStatus);

 			iState = EBuildChainAddCandidateEnd;

 			}

 		}

 	else

 		{

 		// This is the correct state as at this point the chain of certificate has been build upto a

 		// root certificate.

 		iState = EValidateEnd;

 		TRequestStatus* status = &iStatus;

 		User::RequestComplete(status, KErrNone);

 		}

 	SetActive();

 	}

 void CPKIXCertChainAO::HandleEBuildChainAddCandidateEndL()

 	{

 	if (iAddIssuerResult)

 		{

 		iPKIXCertChain.SetChainHasRoot(ETrue);

 		iState = EValidateEnd;

 		}

 	else

 		{

 		//2) look for a non-root issuer in intermediate certs

 		iBuilder = CPKIXChainBuilder::NewL();

 		CPKIXCertsFromClient* serverCerts = CPKIXCertsFromClient::NewLC(iPKIXCertChain.IntermediateCerts());

 		iBuilder->AddSourceL(serverCerts);

 		CleanupStack::Pop(serverCerts);

 		iState = EBuildChainCertsFromStoreBegin;

 		}

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 void CPKIXCertChainAO::HandleEBuildChainCertsFromStoreBeginL()

 	{

 	//3) look for a non-root issuer in the store

 	iCertsFromStoreRoots = CPKIXCertsFromStore::NewL(*iCertStore);

 	iCertsFromStoreRoots->Initialize(iStatus);

 	iState = EBuildChainCertsFromStoreEnd;

 	SetActive();

 	}

 void CPKIXCertChainAO::HandleEBuildChainCertsFromStoreEndL()

 	{

 	iBuilder->AddSourceL(iCertsFromStoreRoots);

 	iCertsFromStoreRoots = 0;

 	iBuilder->AddIssuer(iNumberOfAddedCertificates, iAddIssuerResult, iPKIXCertChain.Chain(), iStatus);

 	iState = EAddCandidateIntermediateCertsEnd;

 	SetActive();

 	}

 void CPKIXCertChainAO::HandleEAddCandidateIntermediateCertsEndL()

 	{

 	if (iAddIssuerResult)

 		{

 		// cert is a pointer to something we don't own

 		CX509Certificate* cert = iPKIXCertChain.Chain().At(iPKIXCertChain.Chain().Count() - 1);

 		/* If the issuer is not a self signed certificate then it cannot be trusted anchor for the chain 

 		 * validation process, this means that we restart the certification validation process.

 		 */ 

 		if (!(cert->IsSelfSignedL()))

 			{

 			iState = EBuildChainStart;	

 			}

 		else

 			{

 			iState = EValidateEnd;			

 			}

 		}

 	else

 		{

 		iState = EValidateEnd;	

 		}

 	delete iBuilder;

 	iBuilder = 0;

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 void CPKIXCertChainAO::HandleEValidateEndL()

 	{

 	InitParamsL();

 	__ASSERT_DEBUG(iValidationResult, User::Panic(_L("CPKICCertChainAO"), 1));

 	DoValidateL(*iValidationResult, iValidationTime, iInitialPolicies);

 	User::RequestComplete(iOriginalRequestStatus, KErrNone);

 	}

 void CPKIXCertChainAO::DoCancel()

 	{

 	delete iRoots;

 	iRoots = 0;

 	delete iBuilder;

 	iBuilder = 0;

 	delete iCertsFromStoreRoots;

 	iCertsFromStoreRoots = 0;

 	User::RequestComplete(iOriginalRequestStatus, KErrCancel);

 	}

 void CPKIXCertChainAO::ValidateL(CPKIXValidationResultBase& aValidationResult,

 								 const TTime& aValidationTime,								 

 								 const CArrayPtr<HBufC>* aInitialPolicies,

 								 TRequestStatus& aStatus)

 	{

 	aValidationResult.Reset();

 	iValidationResult = &aValidationResult;

 	iValidationTime = aValidationTime;

 	iInitialPolicies = aInitialPolicies;

 	iOriginalRequestStatus = &aStatus;

 	iNumberOfAddedCertificates = 0;

 	__ASSERT_ALWAYS(!IsActive(), User::Panic(_L("CPKICCertChainAO"), 1));

 	if (!iRoots)

 		{

 		// If iRoots is 0, it means that the caller gave a uid and that

 		// we must retrieve the trusted certificates from the different

 		// stores

 		iRoots = CPKIXChainBuilder::NewL();

 		iState = EAddRoots;

 		}

 	else

 		{

 		// The caller gave a set of certificates it trusts,

 		// so we don't have to retrieve anything from the stores

 		iState = EBuildChainStart;

 		}

 	aStatus = KRequestPending;

 	TRequestStatus *status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 void CPKIXCertChainAO::CancelValidate()

 	{

 	Cancel();

 	}

 void CPKIXCertChainAO::InitParamsL()

 /*

 this function initialises signing key parameters for the certificates

 -only DSA needs these at present

 -we get the signing key, from the spki of the issuer

 -if it's dsa, we look for params here

 	-if we find them we initialise the cert with them

 	-otherwise, we look in the issuer's issuer

 		-if we don't find them there we give up.

 */

 	{

 	// If the root is DSA signed, set its parameters

 	TInt count = iPKIXCertChain.Chain().Count();

 	CX509Certificate* current = iPKIXCertChain.Chain().At(count-1);

 	TAlgorithmId signingAlgorithm = current->SigningAlgorithm().AsymmetricAlgorithm().Algorithm();

 	if (signingAlgorithm == EDSA)

 		{

 		const CSubjectPublicKeyInfo& key = current->PublicKey();

 		SetParamsL(*current, key.EncodedParams());

 		}

 	// Also the rest of the chain

 	for (TInt i = count - 2; i >= 0; i--)

 		{

 		current = iPKIXCertChain.Chain().At(i);

 		TAlgorithmId signingAlgorithm = current->SigningAlgorithm().AsymmetricAlgorithm().Algorithm();

 		if (signingAlgorithm == EDSA)

 			{

 			// Look down the chain for parameters

 			for (TInt j = i+1; j < count; j++)

 				{

 				CX509Certificate* issuer = iPKIXCertChain.Chain().At(j);

 				const CSubjectPublicKeyInfo& key = issuer->PublicKey();

 				if (key.EncodedParams() != KNullDesC8 && key.AlgorithmId() == EDSA)

 					{

 					SetParamsL(*current, key.EncodedParams());

 					break;

 					}

 				}

 			}

 		}

 	}

 void CPKIXCertChainAO::SetParamsL(CX509Certificate& aCert, const TPtrC8& aEncodedParams)

 	{

 	TX509KeyFactory factory;

 	CDSAParameters* theDSAParams = factory.DSAParametersL(aEncodedParams);

 	CleanupStack::PushL(theDSAParams);

 	CSigningKeyParameters* params = CSigningKeyParameters::NewLC();

 	params->SetDSAParamsL(*theDSAParams);

 	aCert.SetParametersL(*params);

 	CleanupStack::PopAndDestroy(2, theDSAParams);

 	}

 void CPKIXCertChainAO::DoValidateL(CPKIXValidationResultBase& aValidationResult,

 								 const TTime& aValidationTime, 

 								 const CArrayPtr<HBufC>* aInitialPolicies)

 	{

 	if (!iPKIXCertChain.ChainHasRoot())

 		{

 		aValidationResult.SetError(EChainHasNoRoot, 0);

 		}

 	else

 		{

 		CPKIXValidationState* state = CPKIXValidationState::NewLC(aValidationTime, iPKIXCertChain.Chain().Count(), aInitialPolicies);

 		TRAPD(err, ProcessCertsL(*state, aValidationResult));

 		//a leave here means either:

 		//	-a validation error, in which case we've set the error field in result, or

 		//	-some other error (e.g. OOM) in which case error is still EChainHasNoRoot

 		if ((err != KErrNone) && ((aValidationResult.Error().iReason) == EChainHasNoRoot))

 			//then we left with a non-validation-related error, so leave again...

 			{

 			User::Leave(err);

 			}

 		CleanupStack::PopAndDestroy(state);

 		}

 	}

 // ProcessCertsL: This function validates a complete certificate 

 //                chain. If an error occurs in this function the function

 //                SetErrorAndLeaveL must be called. 

 // 

 // Note Do not use SetErrorAndLeaveL with EChainHasNoRoot (see TRAP code in 

 // CPKIXCertChainAO::DoValidateL )             

 void CPKIXCertChainAO::ProcessCertsL(CPKIXValidationState& aState,

 									 CPKIXValidationResultBase& aResult) const

 	{

 	TPKIXPolicyConstraint policy(aState, aResult);

 	TPKIXNameConstraint name(aState, aResult);

 	TPKIXBasicConstraint basic(aState, aResult);

 	TPKIXKeyUsageConstraint keyUsage(aState, aResult);

 	for (; aState.iPos >= 0; aState.iPos--)

 		{

 		aState.iMaxPathLength--;

 		if (aState.iMaxPathLength < aState.iPos)

 			{

 			aResult.SetErrorAndLeaveL(EPathTooLong, aState.iPos);

 			}

 		const CX509Certificate* current = iPKIXCertChain.Chain().At(aState.iPos);

 		CCertificateValidationWarnings* certWarnings = CCertificateValidationWarnings::NewLC(aState.iPos);

 		aResult.AppendCertificateValidationObjectL(*certWarnings);

 		CleanupStack::Pop(certWarnings);

 		CriticalExtsL(aState, *current);

 		CheckCriticalExtsL(aState, aResult);

 		CheckSignatureAndNameL(*current, aState, aResult);

 		//!!!!NO!!checks for revocation at this time!!

 		if (!(current->ValidityPeriod().Valid(aState.iValidationTime)))

 			{

 			//validity period invalid, now check how to report this

 			if (iPKIXCertChain.ValidityPeriodCheckFatal())

 				{

 				aResult.SetErrorAndLeaveL(EDateOutOfRange, aState.iPos);

 				}

 			else

 				{

 				aResult.AppendWarningL(TValidationStatus(EDateOutOfRange, aState.iPos));

 				}

 			}

 		policy.CheckCertPoliciesL(*current);

 		name.CheckNameConstraintsL(*current);

 		keyUsage.CheckKeyUsageL(*current);

 		if (aState.iPos < (iPKIXCertChain.Chain().Count() - 1))

 			{

 			basic.CheckCertSubjectTypeL(*current);

 			}

 		basic.UpdatePathLengthConstraintsL(*current);

 		name.UpdateNameConstraintsL(*current);

 		policy.UpdatePolicyConstraintsL(*current);

 		aState.iCriticalExts->Reset();

 		}

 	policy.FinishPolicyCheckL();

 	//*copy* all policies from aState.iAuthorityConstrainedPolicies into aResult.iPolicies

 	TInt policyCount = aState.iAuthorityConstrainedPolicies->Count();

 	for (TInt i = 0; i < policyCount; i ++)

 		{

 		CX509CertPolicyInfo* policyInfo = CX509CertPolicyInfo::NewLC(*(aState.iAuthorityConstrainedPolicies->At(i)));

 		aResult.AppendPolicyL(*policyInfo);

 		CleanupStack::Pop(policyInfo);

 		}

 	aResult.SetError(EValidatedOK, 0);

 	}

 void CPKIXCertChainAO::CriticalExtsL(CPKIXValidationState& aState, 

 									 const CX509Certificate& aCert) const

 	{

 	const CArrayPtrFlat<CX509CertExtension>& exts = aCert.Extensions();

 	TInt count = exts.Count();

 	for (TInt i = 0; i < count; i++)

 		{

 		CX509CertExtension* ext = exts.At(i);

 		if (ext->Critical())

 			{

 			aState.iCriticalExts->AppendL(ext);

 			}

 		}	 

 	}

 void CPKIXCertChainAO::CheckSignatureAndNameL(const CX509Certificate& aCert, CPKIXValidationState& aState, 

 											CPKIXValidationResultBase& aResult) const

 	{

 	TInt issuerPos = aState.iPos + 1;

 	if (issuerPos == iPKIXCertChain.Chain().Count())

 		//then it's the root

 		{

 		if (aCert.IssuerName().ExactMatchL(aCert.SubjectName()))

 			//then it claims to be self signed, sig must verify

 			{

 			if (!(aCert.VerifySignatureL(aCert.PublicKey().KeyData())))

 				{

 				aResult.SetErrorAndLeaveL(ESignatureInvalid, aState.iPos);

 				}

 			}

 		else

 			//we generate a warning

 			{

 			aResult.AppendWarningL(TValidationStatus(ERootCertNotSelfSigned, aState.iPos));

 			}

 		}

 	else

 		//then it isn't the root: so names must chain & sigs must verify

 		{

 		const CX509Certificate* issuer = iPKIXCertChain.Chain().At(issuerPos);

 		if (!(aCert.IssuerName().ExactMatchL(issuer->SubjectName())))

 			{

 			aResult.SetErrorAndLeaveL(ENamesDontChain, aState.iPos);

 			}

 		if (!(aCert.VerifySignatureL(issuer->PublicKey().KeyData())))

 			{

 			aResult.SetErrorAndLeaveL(ESignatureInvalid, aState.iPos);

 			}

 		}

 	}

 void CPKIXCertChainAO::CheckCriticalExtsL(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult) const

 	{

 	TBool foundUnrecognisedCritExt;

 	// retrieve the supported list of critical extensions. If a critical extension is found whose OID matches an 

 	// element in this set then certificate validation shall treat this as a warning instead of an error.

 	const RPointerArray<TDesC>& supportedCritExt = iPKIXCertChain.SupportedCriticalExtensions();

 	TInt count = aState.iCriticalExts->Count();

 	TInt supportedCount = supportedCritExt.Count();

 	for (TInt i = 0; i < count; i++)

 		{

 		foundUnrecognisedCritExt = ETrue;

 		const CX509CertExtension* ext = aState.iCriticalExts->At(i);

 		const TPtrC& extName = ext->Id();

 		for (TInt j = 0; j < supportedCount; ++j)

 			{

 			if (extName == *supportedCritExt[j])

 				{

 				foundUnrecognisedCritExt = EFalse;

 				HBufC* oid = extName.AllocLC();

 				aResult.AppendCriticalExtensionWarningL(*oid);

 				CleanupStack::Pop(oid);

 				break;

 				}

 			}			

 		if (extName == KExtendedKeyUsage)

 			{

 			aResult.AppendWarningL(TValidationStatus(ECriticalExtendedKeyUsage, aState.iPos));

 			}

 		else if (extName == KPolicyMapping)

 			{

 			aResult.AppendWarningL(TValidationStatus(ECriticalPolicyMapping, aState.iPos));

 			}

 		else if (extName == KInhibitAnyPolicy)

 			{

 			//ignore this in the same way

 			}

 		else if (extName == KDeviceIdListConstraint)

 			{

 			aResult.AppendWarningL(TValidationStatus(ECriticalDeviceId, aState.iPos));

 			}

 		else if(extName == KSidListConstraint)

 			{

 			aResult.AppendWarningL(TValidationStatus(ECriticalSid, aState.iPos));

 			}

 		else if(extName == KVidListConstraint)

 			{

 			aResult.AppendWarningL(TValidationStatus(ECriticalVid, aState.iPos));

 			}

 		else if(extName == KCapabilitiesConstraint)

 			{

 			aResult.AppendWarningL(TValidationStatus(ECriticalCapabilities, aState.iPos));

 			}

 		if (foundUnrecognisedCritExt)

 			{

 			aResult.SetErrorAndLeaveL(EUnrecognizedCriticalExtension, aState.iPos);

 			}			

 		}

 	}