/*

* Copyright (c) 2008 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:

*

*/

package com.nokia.mj.impl.security.midp.authentication;

import com.nokia.mj.impl.utils.Uid;

import com.nokia.mj.impl.utils.Tokenizer;

import com.nokia.mj.impl.security.common.InstallerSecurityException;

import com.nokia.mj.impl.security.common.RuntimeSecurityException;

import com.nokia.mj.impl.utils.InstallerDetailedErrorMessage;

import com.nokia.mj.impl.utils.InstallerErrorMessage;

import com.nokia.mj.impl.utils.OtaStatusCode;

import com.nokia.mj.impl.security.utils.SecurityErrorMessage;

import com.nokia.mj.impl.security.utils.SecurityDetailedErrorMessage;

import com.nokia.mj.impl.security.utils.TelUtils;

import com.nokia.mj.impl.security.midp.common.AuthenticationCredentials;

import com.nokia.mj.impl.security.midp.common.AuthenticationInfo;

import com.nokia.mj.impl.security.midp.common.AuthenticationAttribute;

import com.nokia.mj.impl.security.midp.common.SecurityAttributes;

import com.nokia.mj.impl.security.common.Certificate;

import com.nokia.mj.impl.security.common.SecurityCommsMessages;

import com.nokia.mj.impl.security.midp.common.ProtectionDomain;

import com.nokia.mj.impl.security.midp.common.SigningCertificate;

import com.nokia.mj.impl.security.midp.common.SigningInfo;

import com.nokia.mj.impl.security.midp.common.GeneralSecuritySettings;

import com.nokia.mj.impl.security.midp.storage.*;

import com.nokia.mj.impl.storage.StorageSession;

import com.nokia.mj.impl.rt.support.Jvm;

import com.nokia.mj.impl.rt.support.ApplicationInfo;

import com.nokia.mj.impl.security.utils.Logger;

import com.nokia.mj.impl.comms.CommsEndpoint;

import com.nokia.mj.impl.comms.CommsMessage;

import com.nokia.mj.impl.comms.exception.CommsException;

import com.nokia.mj.impl.fileutils.DriveUtilities;

import com.nokia.mj.impl.fileutils.DriveInfo;

import java.util.Hashtable;

import java.util.Vector;

/**

 * MIDP authentication is build around X.509 Public Key Infrastructure so that

 * MIDlet suites are signed using public key certificates and therefore

 * authenticated by verifying the authenticity of the MIDlet suite's signing

 * certificates with the help of trusted (root) certificates.

 * As a result of authentication a MIDlet suite is bound to a protection domain

 * which will be used as a criteria for granting the MIDlet access to protected

 * functionality.

 * This class is used for authenticating MIDlet suites.

 */

public final class AuthenticationModule

{

    static

    {

        Jvm.loadSystemLibrary("javasecurity");

    }

    /*

     * Hashtable containing the all of the authentication credentials

     * of different aplications being installed

     */

    private Hashtable iAuthCredentials;

    /*

     * Hashtable containing the selected authentication credentials of

     * different aplications being installed

     */

    private Hashtable iSelectedAuthCredentials;

    /*

     * Hashtable containing the ocsp checkers corresponding to

     * installation of various MIDlet suites

     */

    private Hashtable iOcspCheckers;

    /*

     * Hashtable containing the ocsp event listeners corresponding to

     * ocsp checks of various MIDlet suites

     */

    private Hashtable iOcspEventListeners;

    // self

    private static AuthenticationModule self;

    // data structure which holds the flags about different suites

    // being legacy suites or not; the flag info is available at

    // authentication JAD operation time, but not available at

    // authentication JAR operation time -> this hashtable carries

    // the flag between authenticating JAD and JAR operations for

    // same suite

    private static Hashtable iLegacySuiteFlags = new Hashtable();

    /**

     * The ocsp settings

     */

    private static OcspSettings iOcspSettings;

    private static OcspUserPreferences iOcspUserPreferences;

    /*

     * The security warnings mode

     */

    private static int iSecurityWarningsMode = GeneralSecuritySettings.UNINITIALIZED_SECURITY_MODE;

    /**

     * Creates an instance of the AuthenticationModule

     *

     * @return An instance of AuthenticationModule

     */

    public static AuthenticationModule getInstance()

    {

        if (self == null)

        {

            self = new AuthenticationModule();

        }

        return self;

    }

    /**

     * Authenticates a certain MIDlet suite. This method is called

     * when/if the JAD is available

     *

     * @param msUID    the UID if the MIDlet suite being authenticated

     * @param oldMSUID the UID if the MIDlet suite being updated

     *                 (if applicable)

     * @param authInfo the authentication info based on which the MIDlet suite

     *                 is authenticated

     * @return         a set of credentials assigned to the MIDlet suite

     */

    public AuthenticationCredentials[] authenticateJad(

        Uid msUID,

        Uid oldMSUID,

        AuthenticationInfo[] authInfo)

    {

        Vector allAuthCredentials = null;

        if (authInfo == null || authInfo.length == 0)

        {

            // this is untrusted MIDlet -> save the protection domain only

            allAuthCredentials = verifyUpdate(

                                     new Credentials[] {new Credentials("UnidentifiedThirdParty",

                                                                        ApplicationInfo.UNIDENTIFIED_THIRD_PARTY_DOMAIN,

                                                                        null, null, -1, null)

                                                       }, oldMSUID);

        }

        else

        {

            try

            {

                // save all the credentials as candidates -> after having the JAR,

                // based on its hash we will select the protection_domain,

                // root_hash and the validated_chain_indexes

                allAuthCredentials = verifyUpdate(

                                         authInfo[0].getLegacyInfo(),

                                         _validateChainsAndSignatures(authInfo), oldMSUID,

                                         true /* order the result */);

                // start an OCSP client if the ocsp checks are enabled

                if (performOcsp())

                {

                    // start the OCSP checks for all the succesfully validated chains

                    if (allAuthCredentials.size() > 0)

                    {

                        OcspData[] ocspData = new OcspData[allAuthCredentials.size()];

                        for (int i=0; i<allAuthCredentials.size(); i++)

                        {

                            Credentials authCredentials =

                                (Credentials)allAuthCredentials.elementAt(i);

                            // need to add the root the to chain when doing the ocsp checks

                            String[] certChain  = authInfo[(authCredentials

                                                            .validatedChainIndex - 1)].getCertChain();

                            String root = getRoot(authCredentials.rootHashValue);

                            if (root != null)

                            {

                                String[] completeCertChain =

                                    new String[certChain.length + 1];

                                int j;

                                for (j=0; j<certChain.length; j++)

                                {

                                    completeCertChain[j] = certChain[j];

                                }

                                completeCertChain[j] = root;

                                certChain = completeCertChain;

                            }

                            ocspData[i] = new OcspData(certChain);

                        }

                        // build the ocspChecker with the newly built cert chains

                        OcspChecker ocspChecker = new OcspChecker(ocspData,

                                iOcspSettings,

                                iOcspUserPreferences,

                                (OcspEventListener)iOcspEventListeners.get(msUID));

                        iOcspCheckers.put(msUID, ocspChecker);

                        // start the OCSP check

                        ocspChecker.start();

                    }

                }

            }

            catch (AuthenticationException e)

            {

                Logger.log(e);

                switch (e.getErrorCode())

                {

                case AuthenticationException.CONNECTION_TO_CAPTAIN_FAILED:

                case AuthenticationException.SENDING_MSG_TO_CAPTAIN_FAILED:

                    throw new InstallerSecurityException(

                        InstallerErrorMessage.INST_UNEXPECTED_ERR,

                        null, /* no params for short msg */

                        InstallerDetailedErrorMessage.INTERNAL_ERROR,

                        new String[] {"Internal communication problem."},

                        OtaStatusCode.INTERNAL_ERROR);

                case AuthenticationException.CERT_VERIFICATION_FAILED:

                case AuthenticationException.CERT_NOT_YET_VALID:

                case AuthenticationException.CERT_EXPIRED:

                case AuthenticationException.ROOT_CERT_IN_CHAIN:

                case AuthenticationException.MISSING_ROOT:

                case AuthenticationException.UNKNOWN_EXT_KEY_USAGE:

                    throw new InstallerSecurityException(

                        InstallerErrorMessage.INST_AUTHENTICATION_ERR,

                        null, /* no params for short msg */

                        InstallerDetailedErrorMessage.CERT_UNSUPPORTED,

                        null, /* no params for detailed msg */

                        OtaStatusCode.APPLICATION_AUTHENTICATION_FAILURE);

                case AuthenticationException.SIG_VERIFICATION_FAILED:

                    throw new InstallerSecurityException(

                        InstallerErrorMessage.INST_AUTHORIZATION_ERR,

                        null, /* no params for short msg */

                        InstallerDetailedErrorMessage.ATTR_HANDLING_FAILED,

                        new String[] {AuthenticationAttribute

                                      .SECOND_LEGACY_ATTRIBUTE_NAME

                                     },

                        OtaStatusCode.APPLICATION_AUTHORIZATION_FAILURE);

                case AuthenticationException.MISSING_DOMAIN_MAPPING:

                    throw new InstallerSecurityException(

                        InstallerErrorMessage.INST_AUTHORIZATION_ERR,

                        null, /* no params for short msg */

                        InstallerDetailedErrorMessage.CERT_UNSUPPORTED,

                        null, /* no params for detailed msg */

                        OtaStatusCode.APPLICATION_AUTHORIZATION_FAILURE);

                }

            }

        }

        iAuthCredentials.put(msUID, allAuthCredentials);

        Credentials[] credentials = new Credentials[allAuthCredentials.size()];

        allAuthCredentials.copyInto(credentials);

        Logger.logAuthenticationCredentials(allAuthCredentials);

        return credentials;

    }

    /**

     * Authenticates a certain MIDlet suite. This method is called

     * when the JAR is available

     *

     * @param storageSession the JavaStorage session to be used when

     *                       storing security data

     * @param msUID          the UID if the MIDlet suite being authenticated

     * @param oldMSUID       the UID if the MIDlet suite being updated

     *                       (if applicable)

     * @param appJARPath     the path to the JAR being authenticated

     */

        Uid msUID,

        Uid oldMSUID,

        String appJARPath,

        boolean drmContent)

    {

        AuthenticationStorageData data = null;

        try

        {

            Vector allAuthCredentials = (Vector)iAuthCredentials.get(msUID);

            String jarHash = null;

            try

            {

                jarHash = _computeHash(appJARPath);

            }catch(AuthenticationException e) {}

            if (jarHash == null || jarHash.length() == 0)

            {

                // could not compute hash for the given application

                Logger.logWarning("Could not compute hash for " + appJARPath);

                throw new InstallerSecurityException(

                    InstallerErrorMessage.INST_UNEXPECTED_ERR,

                    null, /* no params for short msg */

                    InstallerDetailedErrorMessage.INTERNAL_ERROR,

                    new String[] {"Could not compute hash for " + appJARPath},

                    OtaStatusCode.INTERNAL_ERROR);

            }

            if (allAuthCredentials == null

                    || (allAuthCredentials.size() == 1

                        && ((Credentials)allAuthCredentials.elementAt(0))

                        .getProtectionDomainCategory().equals(

                            ApplicationInfo.UNIDENTIFIED_THIRD_PARTY_DOMAIN)))

            {

                data = new AuthenticationStorageData(

                    "UnidentifiedThirdParty",

                    ApplicationInfo.UNIDENTIFIED_THIRD_PARTY_DOMAIN,

                    jarHash,

                    null /*rootHashValue*/,

                    null /*validatedChainIndexes*/,

                    null /* jarPath*/,

                    iSecurityWarningsMode);

                verifyUpdate(

                    oldMSUID);

            }

            else

            {

                // get the authentication credential candidates and select the right

                // domain/root_hash and validated_chain_index based on the hash of

                // the JAR

                String protectionDomainName = null;

                String protectionDomainCategory = null;

                String jarHashValue = null;

                String rootHashValue = null;

                Vector validatedChainIndexes = new Vector();

                if (selectedCredentials == null

                        || selectedCredentials.getProtectionDomainName() == null)

                {

                    if (!drmContent)

                    {

                        Logger.logWarning("Signature verification failure: the computed and the decrypted JAR hashes do not match");

                        throw new InstallerSecurityException(

                            InstallerErrorMessage.INST_AUTHORIZATION_ERR,

                            null, /* no params for short msg */

                            InstallerDetailedErrorMessage.ATTR_HANDLING_FAILED,

                            new String[] {AuthenticationAttribute

                                          .SECOND_LEGACY_ATTRIBUTE_NAME

                                         },

                            OtaStatusCode.APPLICATION_AUTHORIZATION_FAILURE);

                    }

                    else

                    {

                        // give it one more try

                        String drmJarHash = _drmDecryptAndComputeHash(appJARPath);

                        validatedChainIndexes.removeAllElements();

                        selectedCredentials = selectCredentials(drmJarHash, allAuthCredentials, validatedChainIndexes);

                        if (selectedCredentials == null

                                || selectedCredentials.getProtectionDomainName() == null)

                        {

                            Logger.logWarning("Signature verification failure: the computed and the decrypted JAR hashes do not match");

                            throw new InstallerSecurityException(

                                InstallerErrorMessage.INST_AUTHORIZATION_ERR,

                                null, /* no params for short msg */

                                InstallerDetailedErrorMessage.ATTR_HANDLING_FAILED,

                                new String[] {AuthenticationAttribute

                                              .SECOND_LEGACY_ATTRIBUTE_NAME

                                             },

                                OtaStatusCode.APPLICATION_AUTHORIZATION_FAILURE);

                        }

                        // re-set the jar hash to the hash of what acts as JAR

                        // (not the JAR from inside the DRM content), so no

                        // need to do the DRM decrypting when doing the

                        // tamper detection at runtime

                        selectedCredentials.jarHashValue = jarHash;

                    }

                }

                data = new AuthenticationStorageData(

                    selectedCredentials.getProtectionDomainName(),

                    selectedCredentials.getProtectionDomainCategory(),

                    selectedCredentials.jarHashValue,

                    selectedCredentials.rootHashValue,

                    validatedChainIndexes,

                    iSecurityWarningsMode);

            }

        }

        finally

        {

            // remove all the auth credentials with the selection

            if (data != null)

            {

                iSelectedAuthCredentials.put(msUID, data);

            }

        }

    }

    /**

     */

        Uid uid,

        Uid oldUid,

        ProtectionDomain protectionDomain,

        String appJARPath)

    {

        if (protectionDomain == null

                || (!protectionDomain.equals(ProtectionDomain.getManufacturerDomain())

                    && !protectionDomain.equals(ProtectionDomain.getOperatorDomain())

                    && !protectionDomain.equals(ProtectionDomain.getIdentifiedThirdPartyDomain())

                    && !protectionDomain.equals(ProtectionDomain.getUnidentifiedThirdPartyDomain())))

        {

            Logger.logWarning("Unknown protection domain " + protectionDomain);

            throw new InstallerSecurityException(

                InstallerErrorMessage.INST_UNEXPECTED_ERR,

                null, /* no params for short msg */

                InstallerDetailedErrorMessage.INTERNAL_ERROR,

                new String[] {"Unknown protection domain " + protectionDomain},

                OtaStatusCode.INTERNAL_ERROR);

        }

        String jarHash = null;

        try

        {

            jarHash = _computeHash(appJARPath);

        }catch(AuthenticationException e) {}

        if (jarHash == null || jarHash.length() == 0)

        {

            // could not compute hash for the given application

            Logger.logWarning("Could not compute hash for " + appJARPath);

            throw new InstallerSecurityException(

                InstallerErrorMessage.INST_UNEXPECTED_ERR,

                null, /* no params for short msg */

                InstallerDetailedErrorMessage.INTERNAL_ERROR,

                new String[] {"Could not compute hash for " + appJARPath},

                OtaStatusCode.INTERNAL_ERROR);

        }

        AuthenticationStorageData data = new AuthenticationStorageData(

            protectionDomain.getName(),

            protectionDomain.getCategory(),

            jarHash,

            null /*rootHashValue*/,

            null /*validatedChainIndexes*/,

            null /* jarPath*/,

            iSecurityWarningsMode);

        verifyUpdate(

            oldUid);

    }

    /**

     * Registers a listener for ocsp events corresponding to the

     * installation of a certain MIDlet suite

     *

     * @param aMsUid    the uid of the MIDlet suite on behalf

     *                  of which the listener is registered

     * @param aListener the ocsp events listener

     */

    public void registerOcspEventListener(Uid aMsUid,

                                          OcspEventListener aListener)

    {

        if (aMsUid != null && aListener != null)

        {

            Logger.log("OcspEventListener registered on behalf of the suite " + aMsUid.toString());

            iOcspEventListeners.put(aMsUid, aListener);

        }

    }

    /**

     * Unregisters the listener for ocsp events corresponding to the

     * installation of a certain MIDlet suite

     *

     * @param aMsUid    the uid of the MIDlet suite on behalf

     *                  of which the listener is unregistered

     */

    public void unregisterOcspEventListener(Uid aMsUid)

    {

        if (aMsUid != null)

        {

            Logger.log("OcspEventListener unregistered on behalf of the suite " + aMsUid.toString());

            iOcspEventListeners.remove(aMsUid);

        }

    }

    /**

     * Cancels any Ocsp checks (if any)

     *

     * @param msUid the UID if the MIDlet suite oh whose behalf the ocsp

     *              checks are canceled

     */

    public void cancelOcspCheck(Uid msUid)

    {

        OcspChecker ocspChecker = (OcspChecker)iOcspCheckers.get(msUid);

        if (ocspChecker != null)

        {

            ocspChecker.cancel();

        }

    }

    /**

     * Returns the signing info of certain application suite

     *

     * @param aAppSuiteName    the name of the application suite for which the

                               signing info is queried

     * @param aAppSuiteVersion the version of the application suite for which

     *                         the signing info is queried

     * @param aAppSuiteVendor  the vendor of the application suite for which

                               the signing info is queried

     * @return                 The signing info if the queried application

     *                         suite has been signed or NULL otherwise

     */

    public SigningInfo getSigningInfo(String aAppSuiteName,

                                      String aAppSuiteVersion,

                                      String aAppSuiteVendor)

    {

        SecurityStorage storage = new SecurityStorage();

        try

        {

            AuthenticationStorageData authData = storage.