/*

* Copyright (c) 2002-2004 Nokia Corporation and/or its subsidiary(-ies). 

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: Implementation of policymanagement components

*

*/

// INCLUDE FILES

#include "TrustedSession.h"

#include "XACMLconstants.h"

#include "PolicyEngineServer.h"

#include "PolicyParser.h"

#include "elements.h"

#include "DataTypes.h"

#include "debug.h"

#include "ErrorCodes.h"

#include <x509cert.h>

#include <tconvbase64.h>

const TChar KCASNDelimeter = '-';

_LIT( KSecureIdString, "SECUREID");

CTrustedSession::CTrustedSession()

	: iSessionTrust( EFalse)

{

}

// -----------------------------------------------------------------------------

// CTrustedSession::~CTrustedSession()

// -----------------------------------------------------------------------------

//

CTrustedSession::~CTrustedSession()

{

	delete iCASN;

}

// -----------------------------------------------------------------------------

// CTrustedSession::NewL()

// -----------------------------------------------------------------------------

//

CTrustedSession * CTrustedSession::NewL()

{

	CTrustedSession * self = new(ELeave) CTrustedSession();

	return self;

}

// -----------------------------------------------------------------------------

// CTrustedSession::IsSessionCertificated()

// -----------------------------------------------------------------------------

//

void CTrustedSession::MakeSessionTrustL( const RMessage2& aMessage)

{

	RDEBUG( "Policy Engine: Creating session trust");

	if ( iSessionTrust )

	{

		User::Leave( KErrAlreadyExists);

	}

	//Read certificate info to member

	TPckg<TCertInfo> certInfoPack( iSessionCertInfo);

	aMessage.ReadL(0, certInfoPack, 0);	

	//turn session trust on

	iSessionTrust = ETrue;	

	RDEBUG( "Policy Engine: Session trust created");

}

// -----------------------------------------------------------------------------

// CTrustedSession::IsSessionCertificated()

// -----------------------------------------------------------------------------

//

void CTrustedSession::RemoveSessionTrust()

{

	iSessionTrust = EFalse;

	delete iCASN;

	iCASN = NULL;

}

// -----------------------------------------------------------------------------

// CTrustedSession::IsSessionCertificated()

// -----------------------------------------------------------------------------

//

TCertInfo& CTrustedSession::SessionCertificate()

{

	return iSessionCertInfo;

}

// -----------------------------------------------------------------------------

// CTrustedSession::IsSessionCertificated()

// -----------------------------------------------------------------------------

//

TBool CTrustedSession::CertificatedSession() const

{

	return iSessionTrust;

}

// -----------------------------------------------------------------------------

// CTrustedSession::CASNForSessionL()

// -----------------------------------------------------------------------------

//

const TDesC8& CTrustedSession::CASNForSessionL()

{

	RDEBUG("PolicyEngineServer: CTrustedSession::CASNForSession");

	if ( !iCASN )

	{

		iCASN =	CCertificateMaps::CasnForCertInfoL( iSessionCertInfo );

	}

	RDEBUG8_2("PolicyEngineServer: Session CASN: %S", iCASN);

	return *iCASN;

}

// -----------------------------------------------------------------------------

// CTrustedSession::GetMappedTargetTrustedSubjectL()

// -----------------------------------------------------------------------------

//

void CTrustedSession::GetMappedTargetTrustedSubjectL(

	RPointerArray<HBufC8>& aTargetTrustedMappedSubjectArray, 

	CElementBase * aElement, TBool aUseEditedItems )

	{	

	RElementArray attributes;	

	CleanupClosePushL( attributes );

	aElement->FindAttributesL( ESubjectMatch, attributes );

	for( TInt i(0); i < attributes.Count(); i++ )

		{

		CMatchObject * matchObject = (CMatchObject*)attributes[ i ];		

		TElementReserver reserver( matchObject );

		CPolicyStorage::PolicyStorage()->CheckElementL( matchObject );

		//get attribute ids

		TDesC8& subjectAtt = matchObject->AttributeDesignator()->GetAttributeid();

		TDesC8& value = matchObject->AttributeValue()->Data()->Value();

		if( subjectAtt == PolicyEngineXACML::KCertificateMapped )

			{

			//Create new subject info

			CCertificateMaps::CSubjectInfo* tempInfo = new (ELeave) CCertificateMaps::CSubjectInfo();

			CleanupStack::PushL( tempInfo );

			//create suject info for it

			CCertificateMaps::CreateSubjectInfoL( tempInfo, value );

			//Search corresponding subject info from certificate storage

			HBufC8* casn = tempInfo->iCASN->AllocL();

			CleanupStack::PushL( casn );

			// do not delete info object

			CCertificateMaps::CSubjectInfo* info = CPolicyEngineServer::CertificateMaps()->FindSubjectL( *casn, aUseEditedItems );		

			if( info )

				{

				HBufC8* temp = info->iCASN->AllocL();

				aTargetTrustedMappedSubjectArray.Append( temp );

				}

			CleanupStack::PopAndDestroy( casn );

			CleanupStack::PopAndDestroy( tempInfo );

			}

		}

	CleanupStack::PopAndDestroy( &attributes );

	}

// -----------------------------------------------------------------------------

// CTrustedSession::GetTargetTrustedSubjectL()

// -----------------------------------------------------------------------------

//

HBufC8* CTrustedSession::GetTargetTrustedSubjectL( 

	CElementBase * aElement, TBool aUseEditedItems )

	{

	//find alias for certificate, find policy subjects

	RElementArray attributes;	

	CleanupClosePushL( attributes );

	aElement->FindAttributesL( ESubjectMatch, attributes );

	HBufC8* retVal = 0;

	for( TInt i(0); i < attributes.Count(); i++ )

		{

		CMatchObject * matchObject = (CMatchObject*)attributes[ i ];		

		TElementReserver reserver( matchObject );

		CPolicyStorage::PolicyStorage()->CheckElementL( matchObject );

		//get attribute ids

		TDesC8& subjectAtt = matchObject->AttributeDesignator()->GetAttributeid();

		TDesC8& value = matchObject->AttributeValue()->Data()->Value();

		//tempvalue contain trusted subject value (CASN or alias)

		HBufC8* tempValue = 0;

		if( subjectAtt == PolicyEngineXACML::KCertificate )

			{

			//Create new subject info

			CCertificateMaps::CSubjectInfo* tempInfo = new (ELeave) CCertificateMaps::CSubjectInfo();

			CleanupStack::PushL( tempInfo);

			//create suject info for it

			CCertificateMaps::CreateSubjectInfoL( tempInfo, value);

			//Search corresponding subject info from certificate storage

			tempValue = tempInfo->iCASN->AllocL();

			CleanupStack::PopAndDestroy( tempInfo );			 

			}

		else if( subjectAtt == PolicyLanguage::Constants::AutoCertificate )

			{

			//Create new subject info

			CCertificateMaps::CSubjectInfo* tempInfo = new (ELeave) CCertificateMaps::CSubjectInfo();

			CleanupStack::PushL( tempInfo );

			TCertInfo certInfo;

			TPckg<TCertInfo> pck( certInfo );

			TBase64 base64;

			User::LeaveIfError( base64.Decode( value, pck ) );	

			//create suject info for it

			CCertificateMaps::CreateSubjectInfoL( tempInfo, certInfo );

			//Search corresponding subject info from certificate storage

			tempValue = tempInfo->iCASN->AllocL();

			CleanupStack::PopAndDestroy( tempInfo );			

			}

		else if( subjectAtt == PolicyEngineXACML::KTrustedSubject)

			{

			tempValue = value.AllocL();

			}

		//evaluate temp value

		if( tempValue )

			{

			//Search corresponding subject info from certificate storage

			CCertificateMaps::CSubjectInfo* info = CPolicyEngineServer::CertificateMaps()->FindSubjectL( *tempValue, aUseEditedItems );		

			//if corresponding info found, realloc tempvalue with info->iCASN value			

			if( info )

				{

				delete tempValue;

				tempValue = NULL;

				tempValue = info->iCASN->AllocL();

				}			

			if( retVal )

				{

				//if retVal already exists and temp value doesn't match, break, delete buffers and set null to retval

				if ( *retVal != *tempValue )

					{

					delete retVal;

					retVal = 0;

					break;

					} 

				}

			else

				{

				//if retVal is not exist yet, create new one

				retVal = tempValue->AllocL();

				}

			delete tempValue;

			}

		}

	CleanupStack::PopAndDestroy( &attributes );

	return retVal;

	}

// -----------------------------------------------------------------------------

// CTrustedSession::IsCertificateMappingValidL()

// -----------------------------------------------------------------------------

//

TBool CTrustedSession::IsCertificateMappingValidL( CElementBase * aElement)

{

	//element is parsed and must be valid 

	__ASSERT_ALWAYS ( aElement, User::Panic(Panics::TrustedSessionManagerPanic, KErrCorrupt));

	//element type must be rule

	if ( aElement->ElementType() != ERule)

	{

		return EFalse;

	}

	CTarget * target = ((CRule*)aElement)->GetTarget();

	if ( !target)

	{

		return EFalse;

	}

	//Mapping rule target contains allways one CSubjects element

	if ( target->SubElementType( 0, 1) != ESubjects )

	{

		return EFalse;

	}

	CSubjects * subjects = (CSubjects*)target->Element(0);

	//Mapping subjects contains allways one CSubject element

	if ( subjects->SubElementType( 0, 1) != ESubject )

	{

		return EFalse;

	}

	CSubject * subject = (CSubject*)subjects->Element(0);

	//element type should be subjectmatch in all cases!

	if ( subject->SubElementType( 0, 2) != ESubjectMatch || 

		 subject->SubElementType( 1) != ESubjectMatch )

		{

			return EFalse;

		}

	//Get match objects

	CMatchObject* subject1 = (CMatchObject*) subject->Element(0);

	CMatchObject* subject2 = (CMatchObject*) subject->Element(1);

	//get attribute ids

	TDesC8& subjectAtt1 = subject1->AttributeDesignator()->GetAttributeid();

	TDesC8& subjectAtt2 = subject2->AttributeDesignator()->GetAttributeid();

	//certificate -> alias mapping

	if ( subjectAtt1 == PolicyEngineXACML::KCertificate && subjectAtt2 == PolicyEngineXACML::KAliasId)

	{

		CPolicyEngineServer::CertificateMaps()->BringUpToDateL();

		//Check that new alias is not already exist

		if ( CPolicyEngineServer::CertificateMaps()->IsAliasExistL( subject2->AttributeValue()->Data()->Value()))

		{

			return EFalse;

		}

		TDesC8& certificateValue = subject1->AttributeValue()->Data()->Value();

		//Leaves if certificate is not valid, otherwise just delete certificate

		CX509Certificate * cert = CCertificateMaps::ParseCertificateL( certificateValue); 

		delete cert;

		return ETrue;

	} 

	//certificate -> new certificate (certificate )

	if ( subjectAtt1 == PolicyEngineXACML::KCertificate && subjectAtt2 == PolicyEngineXACML::KCertificateMapped)

	{

		TDesC8& certificateValue = subject1->AttributeValue()->Data()->Value();

		TDesC8& certificateValueMapped = subject2->AttributeValue()->Data()->Value();

		//Leaves if certificate is not valid, otherwise just delete certificate

		CX509Certificate * cert = CCertificateMaps::ParseCertificateL( certificateValue); 

		delete cert;

		CX509Certificate * certMapped = CCertificateMaps::ParseCertificateL( certificateValueMapped); 

		delete certMapped;

		return ETrue;

	} 

	return EFalse;

}

// -----------------------------------------------------------------------------

// CTrustedSession::AddCertificateMappingL()

// -----------------------------------------------------------------------------

//

CElementBase* CTrustedSession::CreateCertificateMappingL( const TDesC8& aAlias )

{

	using namespace PolicyLanguage::Constants;

	using namespace PolicyLanguage::NativeLanguage;

	//Check that alias is valid (not allready exists)

	if ( CPolicyEngineServer::CertificateMaps()->IsAliasExistL( aAlias))

	{

		return 0;

	}

	//Ensures that CASN is valid...

	CASNForSessionL();

	//Create new mapping policy

	//first create id for new rule, format is auto_certificate+CASN

	HBufC8 * extId = HBufC8::NewLC( AutoCertificateLength + iCASN->Length() + 1);

	TPtr8 extIdPtr = extId->Des();

	extIdPtr.Append( AutoCertificate);

	extIdPtr.Append( '_');

	extIdPtr.Append( *iCASN);

	ReplaceIllegalCharacters( extIdPtr );

	//Check id

	if ( !CPolicyStorage::PolicyStorage()->IsRealIdValidL( extIdPtr))

	{

		CleanupStack::PopAndDestroy( extId);

		return 0;

	}

	//and assign rule to element

	CRule *rule = CRule::NewL();

	CleanupStack::PushL( rule);

	rule->SetRuleIdL( extIdPtr);

	rule->SetEffectL( Rule::Permit);

	//target

	CTarget * target = CTarget::NewL();

	CleanupStack::PushL( target);

	rule->AddElementL( 0, target);

	CleanupStack::Pop( target);

	//subjects

	CSubjects * subjects = CSubjects::NewL();

	CleanupStack::PushL( subjects );

	target->AddElementL( 0, subjects);

	CleanupStack::Pop( subjects );

	//subject

	CSubject * subject = CSubject::NewL();

	CleanupStack::PushL( subject );

	subjects->AddToElementListL( subject , ETrue);

	CleanupStack::Pop( subject );

	//first subjectmatch

	CMatchObject * match = new (ELeave) CMatchObject( ESubjectMatch);

	subject->AddToElementListL( match, ETrue);

	match->AddAttributeL( 0, MatchObject::MatchId, 

							 Functions::FunctionStringEqualId);

	//designator and value for certificate

	CSubjectAttributeDesignator * designator = CSubjectAttributeDesignator::NewL();

	match->AddElementL( 0, designator);

	designator->AddAttributeL( 0, AttributeDesignators::AttributeId, AutoCertificate);

	designator->AddAttributeL( 0, AttributeDesignators::DataType, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType);

	//serialize TCertInfo and decode it to base64 format

	TPckg<TCertInfo> pck( iSessionCertInfo);

	TBase64 base64;

	HBufC8 * base64coded = HBufC8::NewLC( pck.Length() * 3);

	TPtr8 base64Ptr = base64coded->Des();

	User::LeaveIfError( base64.PortableEncode( pck, base64Ptr));	

	CAttributeValue * aliasValue = CAttributeValue::NewL( base64Ptr, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType);

	CleanupStack::PopAndDestroy( base64coded);

	match->AddElementL( 0, aliasValue);

	//second subjectmatch

	match = new (ELeave) CMatchObject( ESubjectMatch);

	subject->AddToElementListL( match, ETrue);

	match->AddAttributeL( 0, MatchObject::MatchId, 

							 Functions::FunctionStringEqualId);

	//designator and value for alias

	designator = CSubjectAttributeDesignator::NewL();

	match->AddElementL( 0, designator);

	designator->AddAttributeL( 0, AttributeDesignators::AttributeId, PolicyEngineXACML::KAliasId);

	designator->AddAttributeL( 0, AttributeDesignators::DataType, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType);

	aliasValue = CAttributeValue::NewL( aAlias, PolicyLanguage::NativeLanguage::AttributeValues::StringDataType);

	match->AddElementL( 0, aliasValue);

	//Destroy objects....

	CleanupStack::Pop( rule);

	CleanupStack::PopAndDestroy( extId);

	return rule;

}

void CTrustedSession::ReplaceIllegalCharacters( TPtr8& aData )

	{

	RDEBUG("CTrustedSession::ReplaceIllegalCharacters()");

	TChar char1('/');

	TBuf8<10> buf;

	buf.Append( _L("_") );

	for(TInt i = 0;;i++)

		{

		TInt index = aData.Locate( char1 );

		if( index > KErrNotFound )

			{

			aData.Replace( index, 1, buf );

			}

		else

			{

			break;