/*
* Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of the License "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description: 
*
*/


#include "signatureverifier.h"
#include "log.h"
#include <swi/sisinstallerrors.h>

#include <x509cert.h>
#include <x509keys.h> 
#include <hash.h> 
#include <asn1enc.h>
#include <x509keyencoder.h>

using namespace Swi;


//
// Life cycle methods
//

/*static*/ CSignatureVerifier* CSignatureVerifier::NewL()
	{
	CSignatureVerifier* self = CSignatureVerifier::NewLC();
	CleanupStack::Pop(self);
	return self;
	}

/*static*/ CSignatureVerifier* CSignatureVerifier::NewLC()
	{
	CSignatureVerifier* self = new(ELeave) CSignatureVerifier();
	CleanupStack::PushL(self);
	self->ConstructL();
	return self;
	}
    
CSignatureVerifier::~CSignatureVerifier()
	{
	}

CSignatureVerifier::CSignatureVerifier()
	{
	}

void CSignatureVerifier::ConstructL()
	{
	}


//
// Business Method
//

TBool CSignatureVerifier::VerifySignatureL(const TDesC& aSchemeOid, 
										   const CSubjectPublicKeyInfo& aPublicKey, 
										   const TPtrC8& aControllerData, 
										   const TDesC8& aSignatureData)
	{
	CMessageDigest* digester = CreateDigestL(aSchemeOid);	
	CleanupStack::PushL(digester);
	
	TPtrC8 digest = digester->Final(aControllerData);
	
	TX509KeyFactory keyFactory;
	TBool result = EFalse;
			
	switch (aPublicKey.AlgorithmId())
		{
		case ERSA :
			{
			DEBUG_PRINTF(_L8("Security Manager - Verifying RSA signature."));			
			
		    //  Get the public key  
		    CRSAPublicKey* publicKey = keyFactory.RSAPublicKeyL(aPublicKey.KeyData());
		    CleanupStack::PushL(publicKey);
		 
		    CRSAPKCS1v15Verifier* verifier = CRSAPKCS1v15Verifier::NewLC(*publicKey);
		 
		    RInteger sig = RInteger::NewL(aSignatureData);
		    CleanupStack::PushL(sig);
		    CRSASignature* theSignature = CRSASignature::NewL(sig);
		    CleanupStack::Pop(&sig);
		    CleanupStack::PushL(theSignature);
		    
			// Do the ASN1 thing
			TAlgorithmId digestAlgId = OidToIdL(aSchemeOid);
			CASN1EncBase* digestInfo = DigestInfoLC(digest, *publicKey, digestAlgId);

		    // DER encode it!
		    HBufC8* digestBuf = HBufC8::NewMaxLC(digestInfo->LengthDER());
		    TPtr8 oct(digestBuf->Des());
		    oct.FillZ();
		 	 
		    TUint writePos = 0;
		    digestInfo->WriteDERL(oct, writePos);		    
		 	     	    
		    result = verifier->VerifyL(*digestBuf, *theSignature);
		    
		    CleanupStack::PopAndDestroy(5, publicKey); //  digestBuf, digestInfo, theSignature
		                                               //  verifier, publicKey											
			}    
			break;

		case EDSA :
			{
			DEBUG_PRINTF(_L8("Security Manager - Verifying DSA signature."));					

			CDSAPublicKey* publicKey = keyFactory.DSAPublicKeyL(aPublicKey.EncodedParams(), 
																aPublicKey.KeyData());
			CleanupStack::PushL(publicKey);

			CVerifier<CDSASignature>* verifier = CDSAVerifier::NewL(*publicKey);
			CleanupStack::PushL(verifier);

			CDSASignature* sig = keyFactory.DSASignatureL(aSignatureData);
			CleanupStack::PushL(sig);
		
			result = verifier->VerifyL(digest, *sig);			

			CleanupStack::PopAndDestroy(3, publicKey); // verifier, sig, publicKey
			}
			break;
			
		default:
			{
			DEBUG_PRINTF(_L8("Security Manager - Signature scheme uses unsupported asymetric algorithm."));
			User::Leave(KErrNotSupported);
			}
		}
			
	CleanupStack::PopAndDestroy(digester);
	return result;
	}
	
	
//
// Helpers
//

CASN1EncSequence* CSignatureVerifier::DigestInfoLC(const TDesC8& digest, 
											   const CRSAPublicKey& publicKey, 
											   TAlgorithmId aDigestId)
     {
     CASN1EncSequence* seq = CASN1EncSequence::NewLC();
     
     // DigestAlgorithmIdentifier   
     TX509RSAKeyEncoder keyEncoder(publicKey, aDigestId);
     CASN1EncSequence* digestAlgID = keyEncoder.EncodeDigestAlgorithmLC();
 
     seq->AddAndPopChildL(digestAlgID); 
     
     // Actual message digest    
     CASN1EncOctetString* octet = CASN1EncOctetString::NewLC(digest);
     seq->AddAndPopChildL(octet);
     
     return seq;
     }

TAlgorithmId CSignatureVerifier::OidToIdL(const TDesC& aSchemeOid)
	{
	if ( (aSchemeOid.Compare(KSHA1WithRSA) != 0) &&
		(aSchemeOid.Compare(KDSAWithSHA1) != 0) )
		{
		User::Leave(KErrDigestNotSupported);
		}
	return ESHA1;
	}

CMessageDigest* CSignatureVerifier::CreateDigestL(const TDesC& aSchemeOid)
	{
	if ( (aSchemeOid.Compare(KSHA1WithRSA) != 0) &&
		(aSchemeOid.Compare(KDSAWithSHA1) != 0) )
		{
		DEBUG_PRINTF(_L8("Security Manager - Signature scheme uses unsupported hash algorithm."));
		User::Leave(KErrSignatureSchemeNotSupported); 
		}
	DEBUG_PRINTF(_L8("Security Manager - Signature scheme uses SHA1 hash algorithm"));
	return CMessageDigestFactory::NewDigestL(CMessageDigest::ESHA1);		
	}