/*

* Copyright (c) 1997-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

/**

 @file

 @released

 @internalTechnology

*/

#ifndef __SECURITYMANAGER_H__

#define __SECURITYMANAGER_H__

#include <e32base.h>

#include <securitydefs.h>

#include <ct/rmpointerarray.h>

#include <swi/msisuihandlers.h>

#include "swi/siscontroller.h"

#include "securitypolicy.h"

#include <pkixcertchain.h>

class CCTCertInfo;

class CSWICertStore;

class TCertMetaInfo;

namespace Swi 

{

class CChainValidator;

class CCertificateRetriever;

class CRevocationHandler;

class CHashContainer;

namespace Sis

	{

	class CSignatureCertificateChain;

	}

class MSisDataProvider;

enum TDevCertWarningState

	{

	ENoDevCerts	=0,

	EFoundDevCerts	=1,

	EDevCertsWarned =2	

	};	

/** 

 * The SecurityManager is the SWI component which takes care of the cryptographic

 * protections in the installation process. Specifically it verifies the signatures

 * in signed SISX files, validates their corresponding certificate chains,

 * builds the list of granted capabilities and enforces mandatory certificates

 * constraints. Moreover, driven from a compile time modifiable security policy,

 * enforces additional constraints on the valid certificates, e.g. Code Signing 

 * and other X509 extensions. It performs OCSP checks for the relevant certificate

 * chains as well. 

 * <P>

 * To accomplish its task the Security Manager relies on a number of helper 

 * classes:

 * <ul>

 *   <li> CCertificateRetriever to retrieve mandatory certificates

 *   <li> CSignatureVerifier to verify signatures

 *   <li> CChainValidator to validate PKIX certificate chains

 *   <li> CRevocationHandler to perform OCSP checks

 *   <li> CSecurityPolicy to access the compile time configurable security policy

 * </ul>

 * 

 * @released

 * @internalTechnology 

 */

class CSecurityManager : public CActive

	{

public: // life-cycle methods

	/**

	 * Constructs a new CSecurityManager object

	 *

	 * @return A new security manager

	 */

	IMPORT_C static CSecurityManager* NewL();

	/**

	 * Constructs a new CSecurityManager object and leaves it on the cleanup stack

	 *

	 * @return A new security manager

	 */

	IMPORT_C static CSecurityManager* NewLC();

	virtual ~CSecurityManager();

public: // from CActive 

	void RunL();

	void DoCancel();

	TInt RunError(TInt aError);	

public: // business methods

	/**

	 * This method verifies a SISX controller. It checks:

	 * <ul>

	 *   <li> Whether the controller is signed

	 *   <li> Whether at least a signature per certificate chain can be 

	 *        verified

	 *   <li> Whether at least a certificate chain can be validated 

	 *        successfully

	 *   <li> Whether we can meet all the mandatory certificate requirements

	 *   <li> Hands over a collection of capabilities the controller has been 

	 *        signed for

	 * </ul>

	 *

	 * @param aControllerBinary The raw controller data.

	 * @param aController       An instance of Sis::CController representing 

	 *                          the raw data

	 * @param aResultOut        A global result of the operation        

	 * @param aPkixResultsOut   A list of PKIX validation results. To each of 

	 *                          this corresponds an end entity certificate in 

	 *                          aCertsOut

	 * @param aCertsOut         A list of end entity certificates 

	 * @param aCapabilitySetOut The set of capabilities the controller has been

	 *                          signed for

	 * @param aAllowUnsigned    Receives policy flag that controls installation

	 *                          of unsigned SIS files

	 * @param aIsEmbeddedController Controller is embedded.

	 * @param aStatus           The client request status

	 * @param aCheckDateAndTime Indicates whether the validity periods of the certificates 

	 							in the chain are checked and verified.  A value of ETrue 

	 							indicates they are.

	 */

	IMPORT_C void VerifyControllerL(

					TDesC8& aControllerBinary, 

					const Sis::CController& aController, 

					TSignatureValidationResult* aResultOut,

					RPointerArray<CPKIXValidationResultBase>& aPkixResultsOut,

					RPointerArray<CX509Certificate>& aCertsOut,

					TCapabilitySet* aCapabilitySetOut,

					TBool& aAllowUnsigned,

					TBool& aIsEmbeddedController,

					TRequestStatus& aStatus,

					TBool aCheckDateAndTime = ETrue);

    /**

	 * This method verifies a SISX controller given a list of chain indices. 

	 * It checks:

	 * <ul>

	 *   <li> Whether the controller is signed

	 *   <li> Whether at least a signature per certificate chain can be 

	 *        verified

	 *   <li> Whether at least a certificate chain can be validated 

	 *        successfully

	 *   <li> Whether we can meet all the mandatory certificate requirements

	 *   <li> Hands over a collection of capabilities the controller has been 

	 *        signed for

	 * </ul>

	 *

	 * @param aControllerBinary The raw controller data.

	 * @param aController       An instance of Sis::CController representing 

	 *                          the raw data.

	 * @param aChainListIndices List of indices to chains to be validated.

	 * @param aResultOut        A global result of the operation.

	 * @param aPkixResultsOut   A list of PKIX validation results. To each of 

	 *                          this corresponds an end entity certificate in 

	 *                          aCertsOut.

	 * @param aCertsOut         A list of end entity certificates 

	 * @param aCapabilitySetOut The set of capabilities the controller has been

	 *                          signed for.

	 * @param aAllowUnsigned    Receives policy flag that controls installation

	 *                          of unsigned SIS files.

	 * @param aStatus           The client request status.

	 */		

	IMPORT_C void ReverifyControllerL(

					TDesC8& aControllerBinary, 

					const Sis::CController& aController, 

					const RArray<TInt>& aChainListIndices,

					TSignatureValidationResult* aResultOut,

					RPointerArray<CPKIXValidationResultBase>& aPkixResultsOut,

					RPointerArray<CX509Certificate>& aCertsOut,

					TCapabilitySet* aCapabilitySetOut,

					TBool& aAllowUnsigned,

					TRequestStatus& aStatus);

	/**

	 * Verifies the hash of a the data pointed to by a given data provider.

	 *

	 * @param aDataProvider A data provider which gives access to the file we want to check

	 * @param aDigest The digest of the data pointed to by the given data provider

	 *

	 * @return ETrue if the has could be verified, EFalse otherwise.

	 */								

	IMPORT_C TBool VerifyFileHashL(MSisDataProvider& aDataProvider,

								   const CHashContainer& aDigest);

	/**

	 * Perform an OCSP check on the certificate chain which have been 

	 * previously validated by a call to VerifyControllerL(). This method can 

	 * be called \b only after VerifyControllerL(). This makes the Security 

	 * Manager a stateful object. But this is better than requiring the caller

	 * to store all the intermediate data.

	 *

	 * @param aOcspUri              [in]  The default OCSP URI as specified by 

	 *                                    the UI or read from the policy.

	 * @param aIap					[in, out] The IAP to use for this connection 

	 *									  (zero means show dialog)

	 * @param aRevocationMessageOut [out] An output paramter containing the 

	 *                                    result of the check

	 * @param aOcspOutcomeOut       [out] A list of OCSP outcomes. To each of 

	 *                                    this corresponds a certificate in the 

	 *                                    \e aCertOut list.

	 * @param aCertOut              [out] A list of end entity certificates.

	 * @param aStatus               [in,out] The client status which will be 

	 *                                    completed upon termination.

	 */								

	IMPORT_C void PerformOcspL(const TDesC8&  aOcspUri, 

							   TUint32& aIap,

							   TRevocationDialogMessage* aRevocationMessageOut, 

							   RPointerArray<TOCSPOutcome>& aOcspOutcomeOut, 

							   RPointerArray<CX509Certificate>& aCertOut,

							   TRequestStatus& aStatus);

	/**

	 * Fills certificate info array from the X509 certificate array which was

	 * filled by the security manager.

	 *

	 * @param aCertificates [in]  Array of X509 certificates constructed from 

	 *                            controller.

	 * @param aCertInfos    [out] Array of certificate info objects.

	 */

	IMPORT_C static void FillCertInfoArrayL(

		const RPointerArray<CX509Certificate>& aCertificates,

		RPointerArray<CCertificateInfo>& aCertInfos);

	/**

	 * Retrieves end certificates from iController and stores them in 

	 * iCertificates.

	 *

	 * @param aController [in]  SIS controller object.

	 * @param aCerts      [out] Receives EE certificates from the controller.

	 */

	IMPORT_C void GetCertificatesFromControllerL(

		const Sis::CController& aController,

		RPointerArray<CX509Certificate>& aCerts);

	/**

	 * Returns the security policy associated with the security manager.

	 *

	 * @return The security policy object associated with the security manager.

	 */

	IMPORT_C CSecurityPolicy& SecurityPolicy() const;

	/**

	 * Returns the DeviceIDs retrieved from the Mobile.

	 *

	 * @return The array of the device IDs.

	 */

	IMPORT_C const RPointerArray<HBufC>& DeviceIDsInfo() const;

	/**

	 * Resets Security Manager's list of valid certificate chains.

	 * This is required to ensure that embedded SIS files do not include the certificate

	 * chains of their parent SIS file.

	 */

	IMPORT_C void ResetValidCertChains();	

	/** Calculates the hash of a file

	@param aDataProvider Provides access to the data from the file

	@param aAlgorithm The algorithm used to generate the hash

	@return A buffer containing the hash result

	*/

	IMPORT_C HBufC8* CalculateHashLC(MSisDataProvider& aDataProvider, CMessageDigest::THashId aAlgorithm);

	/**

	Set the devcert warning state.

	@param aDevCertWarningState developer mode certificate warning state

	@return none

	*/

	IMPORT_C void SetDevCertWarningState(TInt aDevCertWarningState);

	/**

	Get the devcert warning state.

	@param aDevCertWarningState developer mode certificate warning state

	@return none

	*/

	IMPORT_C TInt GetDevCertWarningState();

	/*

	 * This function sets the user provided list of root certs. These certs will be used

	 * for validation instead of fetching root certs from the certstore for validation.

	 *

	 * @param aX509CertArray caller provided list of root certs.

	 * @return none

	 */

	IMPORT_C void SetRootCerts(RPointerArray<CX509Certificate>* aX509CertArray);

protected: // Helper functions

	/**

	 * This helper function verifies a given certificate/signature block.

	 * The signature block structure is defined in 

	 * SGL.GT0188.251  Paragraph 4.3

	 * Each block may contain multiple signatures using different

	 * signature schemes.

	 *

	 * @param aChainIndex The index of the chain in iChains which is to be verified.

	 */

	void VerifyBlockL(TInt aChainIndex);

	/**

	 * This helper function calculates the size of the raw

	 * SISX controller data.

	 *

	 * @param iChainsToAdd How many certificate/signature chains to add to the size

	 *                     starting from the most internal one.

	 *

	 * @return The controller size (including iChainsToAdd certificate chains)

	 */

	TInt SignedSize(TInt iChainsToAdd) const;

	/**

	 * It reduces the count based on the given certificate from the iMandatoryCertDNCount (count of mandatory 

	 * certificates). If the certificate is not found nothing happens. Note 

	 * that for a controller to be successfully validated the iMandatoryCertDNCount must 

	 * be zero.

	 *

	 * @param aCertificate The certificate to be compared

	 */

	void UpdateListOfMissingRequiredCertsL(const CCertificate& aCertificate); 

	/**

	 * It update the given certificate to be validated by System upgrade if the certificate is found in the  

	 * trust anchors list. If the certificate is not found nothing happens. 

	 *

	 * @param aCertificate The certificate to be compared

	 */

	void UpdateSystemUpgradeCertStatusL(const CCertificate& aCertificate);

	/**

	 * Translates the set of TOCSPOutcome values into a single 

	 * TRevocationDialogMessage value and sets iRevocationMessage to this value.

	 */

	void ProcessOcspOutcomesL();

private:

	CSecurityManager();

	/**

	 * Second phase constructor for CSecurityManager. It attempts to construct

	 * a CSecurityPolicy object, consequently it accesses the security policy

	 * file. If for any reason no such file is present this method will leave.

	 * This renders impossible to create a security manager and, hence, to 

	 * perform an installation.

	 */

	void ConstructL();

private: // fields

	/**

	 * The list of SisSignatureCertificateChain blocks in the actual

	 * controller. Each of these must be validated.

	 *

	 */

	RPointerArray<Sis::CSignatureCertificateChain> iChains; // We do not own this!

	/**

	 * The list of the validation results. Each of this corresponds

	 * to the SisSignatureCertificateChain in iChains of corresponding

	 * index. This list is populated by VerifyBlockL(), the PKIX 

	 * validator sets the result during the validation process.

	 */

	RPointerArray<CPKIXValidationResultBase>* iValidationResultsOut;

	/**

	 * List of the successfully constructed PKIX chains.

	 * This list contains only the chains which have been

	 * successfully validated.

	 */

	RPointerArray<CX509Certificate>* iEndCertificatesOut;

	/**

	 * The total capabilities so far. This is the union of the

	 * capabilities of every root of every pkix chain which 

	 * has validated successfully.

	 */

	TCapabilitySet* 				 iTotalCapabilitiesOut;

	RPointerArray<TOCSPOutcome>*	 iOcspOutcomeOut;

	TRevocationDialogMessage*		 iRevocationMessage;

	TSignatureValidationResult* 	 iResult;

	/**

	 * Count of the mandatory certificates in the certstore.

	 * SISX files must be signed by chains which resolve

	 * to <b>all</b> of them. See SGL.GT0209.201

	 */

	TInt iMandatoryCertDNCount;

	/**

	 * A parsed version of the SisController which is signed.

	 * This is passed to us by the client. We need it to calculate

	 * the amount of data signed by each signature.

	 */

	const Sis::CController* iController;  // We do not own this!

	/**

	 * A raw version of the SisController which is signed.

	 * This is passed to us by the client. We need it to verify

	 * the signatures.

	 */

	TPtrC8 iRawController;

	/**

	 * A book keeping index pointing to the current certificate chain

	 * being examined. It starts from 0 (the innermost certificate chain

	 * in the controller)

	 */		

	TInt iCurrentChain;

	/** 

	 * A book keeping flag indicating whether any certificate chain has

	 * been validated successfully.

	 */

	TBool iHasValidated;

	/**

	 * The capability set associated with the root (if any) of the

	 * current certificate. This value is set by the chain validator.

	 */

	TCapabilitySet iCurrentCapabilities;

	/**

	 * The current PKIX chain which is being constructed.

	 */

	CPKIXCertChainBase* iCurrentPkixChain;

	/**

	 * A list of all the PKIX chains which have been successfully

	 * validated. If an OCSP check is requested, these chains will

	 * undergo the check.	

	 */

	RPointerArray<CPKIXCertChainBase> iValidPkixChains;

	/** 

	 * Access the SWIS security policy which drives some of our

	 * decision making. E.g. whether end certificated must contain

	 * a CodeSigning extension, etc.

	 */

	CSecurityPolicy* iSecPolicy;

	/**

	 * The underlying backend certificate store

	 */

	CSWICertStore* iCertStore;

	/**

	 * Helper class which retrieves all the <i>mandatory</i>

	 * certificates in the certstore.

	 */

	CCertificateRetriever* iCertificateRetriever;

	/**

	 * Helper class to validate a certificate chain. 

	 * It also collects the capabilities associated with

	 * its root (if any) and whether the root (if any) is

	 * marked as mandatory.

	 */

	CChainValidator* iChainValidator;

	/**

	 * Helper class which takes care of OCSP checks

	 */

	CRevocationHandler* iRevocationHandler;

 	/**

 	 * 

	 * A list of self-signed, untrusted root certificates

 	 * included in the chain currently being validated.

	 *

	 */ 

 	 RPointerArray<CX509Certificate> iUntrustedRoots;

     // A book keeping flag indicating at least one 

     // chain has validated that isn't self signed

     TBool iHasValidatedTrusted;

     // A list of all the roots in the SWI certstore

     RMPointerArray<CCTCertInfo> iTrustedRoots;

     TBool iIsEmbeddedController;

    /**

 	 * 

	 * A list chain indices to be validated by ReverifyControllerL.

	 *

	 */

     const RArray<TInt>* iChainListIndices;

	/** 

	 * The internal state of the security manager.

	 */

    enum TSecManState

	   {

	   // Verification and validation

	   EBuildCertificateList,

  	   EValidatingChain,