/*

 * Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies).

 * All rights reserved.

 * This component and the accompanying materials are made available

 * under the terms of the License "Eclipse Public License v1.0"

 * which accompanies this distribution, and is available

 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

 *

 * Initial Contributors:

 * Nokia Corporation - initial contribution.

 *

 * Contributors:

 *

 * Description: 

 *

 */

 #include "wtlscertchainao.h"

 #include <asymmetric.h>

 #include <bigint.h>

 #include <ccertattributefilter.h>

 #include <cctcertinfo.h>

 CWTLSCertChainAO* CWTLSCertChainAO::NewL(RFs& aFs, 

 										 CWTLSCertChain& aWTLSCertChain,

 										 const CArrayPtr<CWTLSCertificate>& aRootCerts)

 	{

 	CWTLSCertChainAO* self = new(ELeave) CWTLSCertChainAO(aFs, aWTLSCertChain);

 	CleanupStack::PushL(self);

 	self->ConstructL(aRootCerts);

 	CleanupStack::Pop(self);

 	return self;

 	}

 CWTLSCertChainAO* CWTLSCertChainAO::NewL(RFs& aFs, 

 										 CWTLSCertChain& aWTLSCertChain,

 										 const TUid aClient)

 	{

 	return new(ELeave) CWTLSCertChainAO(aFs, aWTLSCertChain, aClient);

 	}

 CWTLSCertChainAO::~CWTLSCertChainAO()

 	{

 	Cancel();

 	delete iCertStoreManager;

 	delete iFilter;

 	delete iEncodedCertTemp;

 	iRootSubjectClientHashList.ResetAndDestroy();

 	iRootSubjectStoreHashList.Close();

 	iCertInfos.Close(); //In an RMPointerArray Close deletes all elements as 

 						//well as any personal allocated space

 	iRootsFromStore.ResetAndDestroy();

 	iRootsFromStore.Close();

 	iRootsFromClient.ResetAndDestroy();

 	}

 CWTLSCertChainAO::CWTLSCertChainAO(RFs& aFs, 

 								   CWTLSCertChain& aWTLSCertChain)

 	: CActive(EPriorityNormal), iFs(aFs), iWTLSCertChain(aWTLSCertChain), iEncodedCert(NULL, 0)

 	{

 	CActiveScheduler::Add(this);

 	}

 CWTLSCertChainAO::CWTLSCertChainAO(RFs& aFs, 

 								   CWTLSCertChain& aWTLSCertChain,

 								   const TUid aClient)

 	: CActive(0), iFs(aFs), iWTLSCertChain(aWTLSCertChain), iClient(aClient),

 		iEncodedCert(NULL, 0)

 	{

 	CActiveScheduler::Add(this);

 	}

 void CWTLSCertChainAO::ConstructL(const CArrayPtr<CWTLSCertificate>& aRootCerts)

 	{

 	for(TInt i=0; i< aRootCerts.Count(); i++)

 		{

 		CWTLSCertificate* root = CWTLSCertificate::NewLC(*(aRootCerts[i]));

 		User::LeaveIfError( iRootsFromClient.Append(root) );

 		CleanupStack::Pop(); //root

 		}

 	}

 void CWTLSCertChainAO::RunL()

 	{

 	//If any of my active objects complete with errors then we don't

 	//want to proceed

 	User::LeaveIfError(iStatus.Int());

 	switch (iState)

 		{

 		case EStoreManagerInitialization:

 			HandleEStoreManagerInitializationL();

 			break;

 		case EStoreManagerInitialized:

 			HandleEStoreManagerInitializedL();

 			break;

 		case EGetCertHashes:

 			HandleEGetCertHashesL();

 			break;

 		case EPruneList:

 			HandleEPruneListL();

 			break;

 		case EPruneListDone:

 			HandleEPruneListDoneL();

 			break;

 		case ECheckTCA:

 			HandleECheckTCAL();

 			break;

 		case EIsChainSelfSigned:

 			HandleEIsChainSelfSignedL();

 			break;

 		case ERetrieveRoots:

 			HandleERetrieveRootsL();

 			break;

 		case EAddRootToList:

 			HandleEAddRootToListL();

 			break;

 		case EFindRoot:

 			HandleEFindRootL();

 			break;

 		case EValidateEnd:

 			HandleEValidateEndL();

 			break;

 		default:

 			__ASSERT_DEBUG(EFalse, User::Panic(_L("CWTLSCertChainAO"), 1));

 			User::Leave(KErrArgument);

 			break;

 		}

 	}

 TInt CWTLSCertChainAO::RunError(TInt aError)

 	{

 	User::RequestComplete(iOriginalRequestStatus, aError);

 	delete iCertStoreManager;

 	iCertStoreManager = 0;

 	return 0;

 	}

 void CWTLSCertChainAO::DoCancel()

 	{

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrCancel);

 	if (iOriginalRequestStatus)

 		{

 		User::RequestComplete(iOriginalRequestStatus, KErrCancel);

 		}

 	}

 void CWTLSCertChainAO::Validate(CWTLSValidationResult& aValidationResult,

 								const TTime& aValidationTime,								 

 								TRequestStatus& aStatus)

 	{

 	iValidationResult = &aValidationResult;

 	iValidationResult->Reset();

 	iValidationTime = &aValidationTime;

 	iOriginalRequestStatus = &aStatus;

 	aStatus = KRequestPending;

 	__ASSERT_DEBUG(!IsActive(), User::Panic(_L("CWTLSCertChainAO"), 1));

 	__ASSERT_DEBUG(!iCertStoreManager, User::Panic(_L("CWTLSCertChainAO"), 1));

 	iState = EStoreManagerInitialization;

 	TRequestStatus *status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 TBool CWTLSCertChainAO::CheckSignatureAndNameL(const CWTLSCertificate& aCert, 

 											   CWTLSValidationResult& aResult,

 											   TInt aPos) const

 	{

 	TInt issuerPos = aPos + 1;

 	TBool res = EFalse;

 	if (issuerPos == iWTLSCertChain.iChain->Count())

 		//then it's the root

 		{

 		if (aCert.IssuerName().ExactMatchL(aCert.SubjectName()))

 			//then it claims to be self signed, sig must verify

 			{

 			if (aCert.VerifySignatureL(aCert.PublicKey().KeyData()))

 				{

 				res = ETrue;

 				}

 			else 

 				{

 				aResult.SetError(ESignatureInvalid, aPos);

 				}

 			}

 		else

 			{

 			aResult.AppendWarningL(TWTLSValidationStatus(ERootCertNotSelfSigned, aPos));

 			res = ETrue; //if its a warning we continue the validation process with the 

 						//warning duly noted so we can check for further warn/errors

 			}

 		}

 	else

 		//then it isn't the root: so names must chain & sigs must verify

 		{

 		const CWTLSCertificate* issuer = iWTLSCertChain.iChain->At(issuerPos);

 		TBool subject = EFalse;

 		TBool signature = EFalse;

 		subject = aCert.IssuerName().ExactMatchL(issuer->SubjectName());

 		if( !subject ) 

 			{

 			aResult.SetError(ENamesDontChain, aPos);

 			return EFalse;

 			}

 		signature = aCert.VerifySignatureL(issuer->PublicKey().KeyData());

 		if( !signature )

 			{

 			aResult.SetError(ESignatureInvalid, aPos);

 			return EFalse;

 			}

 		res = subject && signature;

 		}

 	return res;

 	}

 TBool CWTLSCertChainAO::CheckValidityPeriod(const CWTLSCertificate& aCert,

 											CWTLSValidationResult& aResult, 

 											const TTime aTime,

 											TInt aPos) const

 	{

 	if (aCert.ValidityPeriod().Valid(aTime))

 		{

 		return ETrue;

 		}

 	aResult.SetError(EDateOutOfRange, aPos);

 	return EFalse;

 	}

 void CWTLSCertChainAO::HandleEStoreManagerInitializationL()

 	{

 	iFilter = CCertAttributeFilter::NewL();

 	iFilter->SetFormat(EWTLSCertificate);

 	iFilter->SetUid(iClient);

 	iFilter->SetOwnerType(ECACertificate);

 	iCertStoreManager = CUnifiedCertStore::NewL(iFs, EFalse);

 	iCertStoreManager->Initialize(iStatus);

 	iState = EStoreManagerInitialized;

 	SetActive();

 	}

 void CWTLSCertChainAO::HandleEStoreManagerInitializedL()

 	{

 	iCertStoreManager->List(iCertInfos, *iFilter, iStatus);

 	iState = EGetCertHashes;

 	SetActive();

 	}

 void CWTLSCertChainAO::HandleEGetCertHashesL()

 	{

 	for(TInt i=0; i<iRootsFromClient.Count(); i++)

 		{

 		HBufC8* hash = &GeneratePublicKeyHashL( *(iRootsFromClient[i]));

 		CleanupStack::PushL(hash);

 		User::LeaveIfError( iRootSubjectClientHashList.Append(hash) );

 		CleanupStack::Pop(); //hash

 		}

 	for(TInt j=0; j < iCertInfos.Count(); j++ )

 		{

 		User::LeaveIfError( iRootSubjectStoreHashList.Append( &((iCertInfos[j])->SubjectKeyId()) ) );

 		}

 	iPruned = EFalse;	

 	iPrunedChainLength = iWTLSCertChain.iChain->Count();

 	iIndex = -1;

 	iState = EPruneList;

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 /* Walk through the canadiate list and compare the hash of the subjects with the previously

  * computed subject hash of certs from the CertStore and certs supplied by the client

  */

 void CWTLSCertChainAO::HandleEPruneListL()

 	{

 	iIndex++;

 	if(iIndex < iWTLSCertChain.iChain->Count() )

 		{

 		CWTLSCertificate* cert = iWTLSCertChain.iChain->At(iIndex);

 		HBufC8* hash = &GeneratePublicKeyHashL(*cert);

 		CleanupStack::PushL(hash);

 		for(TInt i=0; i < iRootSubjectClientHashList.Count(); i++)

 			{

 			if( (iRootSubjectClientHashList[i])->Compare(*hash) == 0 )

 				{

 				iPrunedChainLength = iIndex;

 				iPruned = ETrue;

 				break;

 				}

 			}

 		if(!iPruned)

 			{

 			for(TInt j=0; j<iRootSubjectStoreHashList.Count(); j++) 

 				{

 				if( (iRootSubjectStoreHashList[j])->Compare(*hash) == 0 )

 					{

 					iPrunedChainLength = iIndex;

 					iPruned = ETrue;

 					break;

 					}

 				}

 			}

 		CleanupStack::PopAndDestroy(hash);

 		if(iPruned)

 			{

 			iState = EPruneListDone;

 			}

 		else 

 			{

 			iState = EPruneList;

 			}

 		}

 	else

 		{

 		iState = EPruneListDone;

 		}

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 void CWTLSCertChainAO::HandleEPruneListDoneL()

 	{

 	if(iPruned) 

 		{

 		TInt count = iWTLSCertChain.iChain->Count();

 		for( TInt i=count - 1; i > iPrunedChainLength; i-- )

 			{

 			delete iWTLSCertChain.iChain->At(i);

 			iWTLSCertChain.iChain->Delete(i);

 			}

 		iWTLSCertChain.iChain->Compress();

 		}

 	iState = ECheckTCA;

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 //checks to see if each certificate in a chain has the authority to sign other certificates

 void CWTLSCertChainAO::HandleECheckTCAL()

 	{

 	TBool validChain = ETrue;

 	for( TInt i = 1; i < iWTLSCertChain.iChain->Count(); i++ ) 

 		//all intermediate certs (ie not EE certs and not self signed) need

 		// to have a field T=ca indicating that they can sign other certs

 		{

 		if( (iWTLSCertChain.iChain)->At(i)->IsTCAL() == EFalse && 

 			(iWTLSCertChain.iChain)->At(i)->IsSelfSignedL() == EFalse ) 

 			{

 			iValidationResult->SetError(ENotCACert, i);

 			User::RequestComplete(iOriginalRequestStatus, KErrNone);

 			validChain = EFalse;

 			break;

 			}

 		}

 	if(validChain && iPruned) 

 		{

 		//if we've pruned the list and the chain we have is valid,

 		//then our chain already has a root that we trust.

 		//therefore there is no need to retrieve one :)

 		//therefore goto validation

 		iState = EValidateEnd;

 		TRequestStatus *status = &iStatus;

 		User::RequestComplete(status, KErrNone);

 		SetActive();

 		}

 	else if(validChain) // ie && !iPruned

 		{

 		//if we haven't pruned but chain is valid then we're back a square one.

 		iState = EIsChainSelfSigned;

 		TRequestStatus *status = &iStatus;

 		User::RequestComplete(status, KErrNone);

 		SetActive();

 		}

 	}

 void CWTLSCertChainAO::HandleEIsChainSelfSignedL()

 	{

 	TInt last = iWTLSCertChain.iChain->Count() - 1;

 	if( iWTLSCertChain.iChain->At(last)->IsSelfSignedL() )

 		{

 		//if chained is self signed, and no earlier cert in the sequence was trusted

 		//then this is going to fail validation

 		//This is just an optimisation to avoid retrieving all the roots from the store

 		iValidationResult->SetError(EChainHasNoRoot, last);

 		User::RequestComplete(iOriginalRequestStatus, KErrNone);

 		}

 	else 

 		{

 		//standard chain -> need to find the appropriate trusted root for chain if it exists

 		iState = ERetrieveRoots;

 		iIndex = -1;

 		TRequestStatus* status = &iStatus;

 		User::RequestComplete(status, KErrNone);

 		SetActive();

 		}

 	}

 void CWTLSCertChainAO::HandleERetrieveRootsL()

 	{

 	iIndex++;	

 	if(iIndex < iCertInfos.Count() )

 		{

 		if( iEncodedCertTemp != NULL ) 

 			{

 			delete iEncodedCertTemp;

 			}

 		iEncodedCertTemp = HBufC8::NewMaxL( (iCertInfos[iIndex])->Size() );

 		iEncodedCert.Set( iEncodedCertTemp->Des() );

 		iCertStoreManager->Retrieve( *(iCertInfos[iIndex]), iEncodedCert, iStatus );

 		iState = EAddRootToList;

 		}

 	else 

 		{

 		iState = EFindRoot;

 		TRequestStatus* status = &iStatus;

 		User::RequestComplete(status, KErrNone);

 		}	

 	SetActive();

 	}

 void CWTLSCertChainAO::HandleEAddRootToListL()

 	{

 	//are we guarenteed that a cert from the store is a valid WTLScert?

 	//ie is this going to leave for reasons other than OOM?

 	CWTLSCertificate *cert = CWTLSCertificate::NewL( iEncodedCert );

 	User::LeaveIfError( iRootsFromStore.Append(cert) );

 	iState = ERetrieveRoots;

 	TRequestStatus* status = &iStatus;

 	User::RequestComplete(status, KErrNone);

 	SetActive();

 	}

 void CWTLSCertChainAO::HandleEFindRootL()

 	{

 	TInt last = iWTLSCertChain.iChain->Count() - 1;

 	const CWTLSName* issuerName = &(iWTLSCertChain.iChain->At(last)->IssuerName());

 	iFoundRoot = EFalse;

 	for(TInt i=0; i<iRootsFromClient.Count(); i++) 

 		{

 		if( issuerName->ExactMatchL( (iRootsFromClient[i])->SubjectName() ) )

 			{

 			iFoundRoot = ETrue;

 			CWTLSCertificate* cert = CWTLSCertificate::NewLC( *(iRootsFromClient[i]) );

 			iWTLSCertChain.iChain->AppendL( cert ); 

 			CleanupStack::Pop(cert);

 			break;

 			}

 		}

 	if(!iFoundRoot) 

 		{

 		for(TInt j=0; j<iRootsFromStore.Count(); j++)

 			{

 			if( issuerName->ExactMatchL( (iRootsFromStore[j])->SubjectName() ) )

 				{

 				iFoundRoot = ETrue;

 				CWTLSCertificate* cert = CWTLSCertificate::NewLC( *(iRootsFromStore[j]) );

 				iWTLSCertChain.iChain->AppendL( cert );

 				CleanupStack::Pop(cert);

 				break;

 				}

 			}

 		}

 	if(!iFoundRoot)

 		{

 		iValidationResult->SetError(EChainHasNoRoot, last);

 		User::RequestComplete(iOriginalRequestStatus, KErrNone);

 		}

 	else

 		{

 		iState = EValidateEnd;

 		TRequestStatus* status = &iStatus;

 		User::RequestComplete(status, KErrNone);

 		SetActive();

 		}

 	}

 void CWTLSCertChainAO::HandleEValidateEndL()

 	{

 	TInt i = iWTLSCertChain.iChain->Count() -1;//we can guarantee that chain has at least 1 cert

 	for (; i >= 0; i--)

 		{

 		const CWTLSCertificate* current = iWTLSCertChain.iChain->At(i);

 		if ((!CheckSignatureAndNameL(*current, *iValidationResult, i))	||

 			(!CheckValidityPeriod(*current, *iValidationResult, *iValidationTime, i)))

 			{

 			//these functions set the error internally if there is one

 			break;

 			}

 		}		

 	User::RequestComplete(iOriginalRequestStatus, KErrNone);

 	}

 HBufC8& CWTLSCertChainAO::GeneratePublicKeyHashL(const CWTLSCertificate& aCert) const

 	{

 	TWTLSKeyFactory keyFactory;

 	CRSAPublicKey* key = keyFactory.RSAPublicKeyL( aCert.PublicKey().KeyData() );

 	CleanupStack::PushL(key);

 	HBufC8* modulusBuffer = key->N().BufferLC();

 	CSHA1* sha1 = CSHA1::NewL();

 	CleanupStack::PushL(sha1);

 	TPtrC8 hash = sha1->Final(*modulusBuffer);

 	HBufC8* permHash = hash.AllocL();

 	CleanupStack::PopAndDestroy(3); //sha1, modulusBuffer, key

 	return *permHash;

 	}