/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 390 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

// INCLUDE FILES

#include "EapTlsPeapCertInterface.h"

#include "EapTlsPeapUtils.h"

#include <x509keys.h>

#include <x509cert.h>

#include "eap_tlv_message_data.h"

#include "eap_am_trace_symbian.h"

const TText8 KKeyStoreHandlePrefix[] = "EapTlsPeapKeyStoreHandler";

const TText8 KKeyStoreHandleKey[] = "CEapTlsPeapCertInterface KeyStore handle";

enum TAlgorithmAndSignedType

{

	ERSASign = 1,

	EDSASign,

	ERSASignWithFixedDH,

	EDSASignWithFixedDH,

	ERSASignWithEphemeralDH,

	EDSASignWithEphemeralDH

};

enum eap_type_tlspeap_stored_e

{

	eap_type_tlspeap_stored_keystore_handle = 1

};

// ================= MEMBER FUNCTIONS =======================

// Completition functions should be moved to abstract IF

CEapTlsPeapCertInterface* CEapTlsPeapCertInterface::NewL(abs_eap_am_tools_c* const aTools, 

											   eap_am_type_tls_peap_symbian_c* const aParent)

{

	CEapTlsPeapCertInterface* self = new(ELeave) CEapTlsPeapCertInterface(aTools, aParent);

	CleanupStack::PushL(self);

	self->ConstructL();

	CleanupStack::Pop();

	return self;

}

//--------------------------------------------------

CEapTlsPeapCertInterface::CEapTlsPeapCertInterface(abs_eap_am_tools_c* const aTools, eap_am_type_tls_peap_symbian_c* const aParent)

: CActive(CActive::EPriorityStandard)

,iParent(aParent)

,m_am_tools(aTools)

,iAllowedUserCerts(1)

,iEncodedCertificate(0)

,iCertPtr(0,0)

,iMatchingUserCertInfos(1)

,iCAIndex(0)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::ConstructL()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	User::LeaveIfError(iFs.Connect());

	CActiveScheduler::Add(this);		

	iValidationResult = CPKIXValidationResult::NewL();

	iEncodedCertificate = HBufC8::NewL(0);

	iCertPtr.Set(iEncodedCertificate->Des());	

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

CEapTlsPeapCertInterface::~CEapTlsPeapCertInterface()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	iMatchingUserCerts.ResetAndDestroy();

	iMatchingUserCertInfos.Reset();

	iAllowedUserCerts.Reset();

	iRootCerts.ResetAndDestroy();

	iUserCertChain.ResetAndDestroy();

	iCertAuthorities.ResetAndDestroy();

	TInt i(0);

	for (i = 0; i < iCertInfos.Count(); i++)

	{

		iCertInfos[i]->Release();

	}

	iCertInfos.Reset();

	for (i = 0; i < iKeyInfos.Count(); i++)

	{

		iKeyInfos[i]->Release();

	}

	iKeyInfos.Reset();

	delete iCertFilter;

	delete iCertStore;

	delete iCertChain;

	delete iValidationResult;

	delete iInputCertChain;	

	delete iEncodedCertificate;	

	delete iDataIn;

	delete iDataOut;

	delete iSignature;

	delete iPtrOut;

	delete iSignaturePtr;

	iFs.Close();	

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("CEapTlsPeapCertInterface::~CEapTlsPeapCertInterface(): returns\n")));

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::GetMatchingCertificatesL(

	const RArray<SCertEntry>& aAllowedUserCerts,

	const TBool aUseCertAuthoritiesFilter,

	EAP_TEMPLATE_CONST eap_array_c<eap_variable_data_c> * const aCertAuthorities,

	const TBool aUseCertTypesFilter,

	EAP_TEMPLATE_CONST eap_array_c<u8_t> * const aCertTypes,

	const TBool aUseAllowedCipherSuitesFilter,

	const RArray<TUint>& aAllowedCipherSuites)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	iUseCertAuthoritiesFilter = aUseCertAuthoritiesFilter;

	iUseCertTypesFilter = aUseCertTypesFilter;

	iUseAllowedCipherSuitesFilter = aUseAllowedCipherSuitesFilter;

	iAllowedUserCerts.Reset();

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("CEapTlsPeapCertInterface::GetMatchingCertificatesL: Total allowed user certs=%d\n"),

		aAllowedUserCerts.Count()));		

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("CEapTlsPeapCertInterface::GetMatchingCertificatesL:UseCertAuthoritiesFilter=%d, UseCertTypesFilter=%d, UseAllowedCipherSuitesFilter=%d\n"),

		iUseCertAuthoritiesFilter,iUseCertTypesFilter,iUseAllowedCipherSuitesFilter));		

	for (TInt j = 0; j < aAllowedUserCerts.Count(); j++)

	{

		iAllowedUserCerts.AppendL(aAllowedUserCerts[j]);

#if defined(_DEBUG) || defined(DEBUG)

		// This is just for the debug prints.

		TCertLabel tempLabel = iAllowedUserCerts[j].iLabel;

		TKeyIdentifier tempSubjectKeyId = iAllowedUserCerts[j].iSubjectKeyId;

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::GetMatchingCertificatesL: details of allowed user certs,Label=%S\n"),

		&tempLabel));		

		EAP_TRACE_DATA_DEBUG_SYMBIAN( ( "GetMatchingCertificatesL : Subject Key Id:",

		tempSubjectKeyId.Ptr(), tempSubjectKeyId.Size() ) );			

#endif

	}

	if (iCertAuthorities.Count() > 0)

	{

		iCertAuthorities.ResetAndDestroy();

	}

	if (aUseCertAuthoritiesFilter)

	{

		for (TUint i = 0; i < aCertAuthorities->get_object_count(); i++)

		{

			HBufC8* buf = HBufC8::NewLC((aCertAuthorities->get_object(i))->get_data_length());

			TPtr8 ptr = buf->Des();

			ptr.Copy((aCertAuthorities->get_object(i))->get_data((aCertAuthorities->get_object(i))->get_data_length()),

				(aCertAuthorities->get_object(i))->get_data_length());

			// Try to form distiguished name

			CX500DistinguishedName* tmp = 0;

			TRAPD(err, tmp = CX500DistinguishedName::NewL(ptr));

			if (err == KErrNone)

			{

				CleanupStack::PushL(tmp);

				// Distinguished name was found -> add it to array.

				User::LeaveIfError(iCertAuthorities.Append(tmp));

				CleanupStack::Pop(tmp);

			}

			CleanupStack::PopAndDestroy(buf);

		}

	}

	if (aUseCertTypesFilter)

	{

		iCertTypes = aCertTypes;

	}

	if (aUseAllowedCipherSuitesFilter)

	{	

		iRSACertsAllowed = EFalse; 

		iDSACertsAllowed = EFalse;

		for (TInt i = 0; i < aAllowedCipherSuites.Count(); i++)

		{

			if (EapTlsPeapUtils::CipherSuiteUseRSAKeys(static_cast<tls_cipher_suites_e>(aAllowedCipherSuites[i])))

			{

				iRSACertsAllowed = ETrue;

			}

			else if (EapTlsPeapUtils::CipherSuiteUseDSAKeys(static_cast<tls_cipher_suites_e>(aAllowedCipherSuites[i])))

			{

				iDSACertsAllowed = ETrue;

			}

		}

	}

	iState = EGetMatchingCertsInitStore;

	if (iCertStore == 0)

	{

		iCertStore = CUnifiedCertStore::NewL(iFs, false);

		iCertStore->Initialize(iStatus);		

	}

	else

	{

		TRequestStatus* status = &iStatus;

		User::RequestComplete(status, KErrNone);		

	}		

	SetActive();	

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::ReadCertificateL(SCertEntry& aCertInfo, const TBool aRetrieveChain)

{	

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	iCertInfo = aCertInfo;

	iRetrieveChain = aRetrieveChain;

	iState = EReadCertInitStore;

	if (iCertStore == 0)

	{

		iCertStore = CUnifiedCertStore::NewL(iFs, false);

		iCertStore->Initialize(iStatus);		

	}

	else

	{

		TRequestStatus* status = &iStatus;

		User::RequestComplete(status, KErrNone);		

	}		

	SetActive();			

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::ReadCACertificateL(SCertEntry& aCertInfo)

{	

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("CEapTlsPeapCertInterface::ReadCACertificateL.\n")));

	iCertInfo = aCertInfo;

	iState = EReadCACertInitStore;

	if (iCertStore == 0)

	{

		iCertStore = CUnifiedCertStore::NewL(iFs, false);

		iCertStore->Initialize(iStatus);		

	}

	else

	{

		TRequestStatus* status = &iStatus;

		User::RequestComplete(status, KErrNone);		

	}		

	SetActive();			

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::ValidateChainL(TDesC8& aCertChain, RArray<SCertEntry>& aAllowedCACerts)

{	

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);	

	iCAIndex = 0;

	iAllowedCACerts = aAllowedCACerts;

	delete iInputCertChain;

	iInputCertChain = 0;

	iInputCertChain = aCertChain.AllocL();

	iState = EValidateChainInitStore;

	if (iCertStore == 0)

	{

		iCertStore = CUnifiedCertStore::NewL(iFs, false);

		iCertStore->Initialize(iStatus);		

	}

	else

	{

		TRequestStatus* status = &iStatus;

		User::RequestComplete(status, KErrNone);		

	}

	SetActive();

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::DoCancel()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("CEapTlsPeapCertInterface::DoCancel()\n")));

	if (iCertStore != 0 && iCertStore->IsActive())

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iCertStore->CancelInitialize and other cancels()\n")));

		iCertStore->CancelInitialize();	

		iCertStore->CancelList();

		iCertStore->CancelGetCert();

		iCertStore->CancelRetrieve();

	}

	// We have to cancel singing if it is ongoing. Both for RSA and DSA.

	if(iRSASigner != 0)

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iRSASigner->CancelSign()\n")));

		iRSASigner->CancelSign();

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iRSASigner->Release()\n")));

		iRSASigner->Release(); // This seems to be needed.

	}

	if(iDSASigner != 0)

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iDSASigner->CancelSign()\n")));

		iDSASigner->CancelSign();

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iDSASigner->Release()\n")));

		iDSASigner->Release(); // This seems to be needed.		

	}

	// We have to cancel decrypting if it is ongoing.

	if(iDecryptor != 0)

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iDecryptor->CancelDecrypt()\n")));

		iDecryptor->CancelDecrypt();

	}

	if (iKeyStore != 0 && iKeyStore->IsActive())

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iKeyStore->CancelOpen()\n")));

		iKeyStore->CancelOpen();

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iKeyStore->Cancel()\n")));

		iKeyStore->Cancel();

	}

	if (iCertChain != 0)

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CEapTlsPeapCertInterface::DoCancel(): calls iCertChain->CancelValidate()\n")));

		iCertChain->CancelValidate();

	}

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("CEapTlsPeapCertInterface::DoCancel(): returns\n")));

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void CEapTlsPeapCertInterface::SignL(

	TKeyIdentifier& aKeyId,

	const TDesC8& aHashIn,

	const TUint aSignatureLength)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);	

	iKeyIdentifier = aKeyId;

	if (aHashIn.Size() > KMaxHashLength)

	{

		EAP_TRACE_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("ERROR: Illegal hash size to SignL.\n")));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		User::Leave(KErrGeneral);		

	}

	iHashIn.Copy(aHashIn);

	delete iSignature;

	iSignature = 0;

	// Allocate space for the signature

	iSignature = HBufC8::NewL(aSignatureLength);

	delete iSignaturePtr;

	iSignaturePtr = 0;

	iSignaturePtr = new(ELeave) TPtr8(iSignature->Des());

	EAP_TRACE_DATA_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("SignL: aKeyId"),

														   aKeyId.Ptr(),

														   aKeyId.Length()));

	EAP_TRACE_DATA_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("SignL: aHashIn"),

														   aHashIn.Ptr(),

														   aHashIn.Length()));

	if (iKeyStore == 0)

	{

		// Try to get the keystore class pointer from memory store

		eap_variable_data_c key(m_am_tools);

		eap_status_e status = key.set_copy_of_buffer(KKeyStoreHandlePrefix, sizeof(KKeyStoreHandlePrefix));

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			User::Leave(KErrNoMemory);

		}

		status = key.add_data(KKeyStoreHandleKey, sizeof(KKeyStoreHandleKey));

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			User::Leave(KErrNoMemory);

		}

		eap_tlv_message_data_c tlv_data(m_am_tools);

		status = m_am_tools->memory_store_get_data(&key, &tlv_data);

		if (status != eap_status_ok)

		{

			EAP_TRACE_DEBUG(

				m_am_tools,

				TRACE_FLAGS_DEFAULT,

				(EAPL("EAP_type_TLSPEAP: cannot get previous keystore handle.\n")));

			// At this point we can set the passphrase timeout because it the passphrase 

			// cache in the FS token server is still empty. Passphrase timeout setting clears 

			// the cache.

			iState = ESignInitStore;

			iKeyStore = CUnifiedKeyStore::NewL(iFs);

			iKeyStore->Initialize(iStatus);