/*
* Copyright (c) 2002-2004 Nokia Corporation and/or its subsidiary(-ies). 
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description: Implementation of terminalsecurity components
*
*/


// INCLUDE FILES

#include "TcTrustedSession.h"
#include "TcFileScan.h"
#include "TerminalControlClientServer.h"
#include <DMCert.h>
#include <SettingEnforcementInfo.h>
#include <PolicyEngineXACML.h>
#include "debug.h"
#include <featmgr.h>
// EXTERNAL DATA STRUCTURES
// EXTERNAL FUNCTION PROTOTYPES
// CONSTANTS
// MACROS


// LOCAL CONSTANTS AND MACROS
// MODULE DATA STRUCTURES
// LOCAL FUNCTION PROTOTYPES

// ==================== LOCAL FUNCTIONS ====================

// ================= MEMBER FUNCTIONS =======================

// -----------------------------------------------------------------------------
// CTcTrustedSession::~CTcTrustedSession
// -----------------------------------------------------------------------------
CTcTrustedSession::~CTcTrustedSession()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::~CTcTrustedSession");

    if( iFileScan != 0 )
        {
        delete iFileScan;
        }

    delete iProcessList;
    delete iProcessData;

	iPR.Close();
	iPE.Close();
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::ConstructL()
// -----------------------------------------------------------------------------
void CTcTrustedSession::ConstructL(TSecureId &aSID, TCertInfo &aCert)
    {
	RDEBUG("TerminalControl: CTcTrustedSession::ConstructL 1");

    DoConstructL();

    SetCertificate( aCert );

    iSecureId        = aSID;
    UpdateAccessLevelL();
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::ConstructL()
// -----------------------------------------------------------------------------
void CTcTrustedSession::ConstructL(TSecureId &aSID)
    {
	RDEBUG("TerminalControl: CTcTrustedSession::ConstructL 2");

    DoConstructL();

    iHasCertificate = EFalse;
    iSecureId        = aSID;
    UpdateAccessLevelL();
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::DoConstructL()
// -----------------------------------------------------------------------------
void CTcTrustedSession::DoConstructL()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::DoConstructL");

    User::LeaveIfError( iPE.Connect() );
    User::LeaveIfError( iPR.Open( iPE ) );

    iAccessLevel     = CTcTrustedSession::EAccessLevelNone;
	iProcessList     = 0;
	iProcessData     = 0;
	iFileScan        = 0;
	iRebootRequested = EFalse;
	iWipeRequested   = EFalse;
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::NewL()
// -----------------------------------------------------------------------------
CTcTrustedSession * CTcTrustedSession::NewL(TSecureId &aSID, TCertInfo &aCert)
{
	RDEBUG("TerminalControl: CTcTrustedSession::NewL");

	CTcTrustedSession * self = new(ELeave) CTcTrustedSession();
	CleanupStack::PushL( self );

	self->ConstructL( aSID, aCert );

	CleanupStack::Pop( self );
	return self;
}

// -----------------------------------------------------------------------------
// CTcTrustedSession::NewL()
// -----------------------------------------------------------------------------
CTcTrustedSession * CTcTrustedSession::NewL(TSecureId &aSID)
{
	RDEBUG("TerminalControl: CTcTrustedSession::NewL");

	CTcTrustedSession * self = new(ELeave) CTcTrustedSession();
	CleanupStack::PushL( self );

	self->ConstructL( aSID );

	CleanupStack::Pop( self );
	return self;
}

// -----------------------------------------------------------------------------
// CTcTrustedSession::SetAccessLevel()
// -----------------------------------------------------------------------------
void CTcTrustedSession::SetAccessLevel( TInt aAccessLevel )
    {
	RDEBUG_2("TerminalControl: CTcTrustedSession::SetAccessLevel: %d", (TInt)aAccessLevel);

    iAccessLevel = aAccessLevel;
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::Certificate()
// -----------------------------------------------------------------------------
TInt CTcTrustedSession::Certificate( TCertInfo& aCertInfo )
    {
	RDEBUG("TerminalControl: CTcTrustedSession::Certificate");

    if( iHasCertificate )
        {
        TPckg<TCertInfo> certp1( aCertInfo );
        TPckg<TCertInfo> certp2( iCertificate );
        certp1.Copy( certp2 );
        return KErrNone;
        }
    else
        {
        return KErrNotFound;
        }
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::SetCertificate()
// -----------------------------------------------------------------------------
void CTcTrustedSession::SetCertificate( TCertInfo& aCertInfo )
    {
	RDEBUG("TerminalControl: CTcTrustedSession::SetCertificate");

    TPckg<TCertInfo> certp1( aCertInfo );
    TPckg<TCertInfo> certp2( iCertificate );
    certp2.Copy( certp1 );

    iHasCertificate = ETrue;
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::SecureId()
// -----------------------------------------------------------------------------
TSecureId CTcTrustedSession::SecureId( )
    {
	RDEBUG("TerminalControl: CTcTrustedSession::SecureId");

    return iSecureId;
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::AccessLevel()
// -----------------------------------------------------------------------------
TInt CTcTrustedSession::AccessLevel()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::AccessLevel");

    return iAccessLevel;
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::FileScanL()
// -----------------------------------------------------------------------------
TInt CTcTrustedSession::FileScanL(const TDesC8 &aFileName, TBool aRecursive)
    {
	RDEBUG("TerminalControl: CTcTrustedSession::FileScanL");

    if( iFileScan == 0 )
        {
        iFileScan = CTcFileScan::NewL(); //new (ELeave) CTcFileScan();
        }
        
    iFileScan->FileScanL( aFileName, aRecursive );
    
    return KErrNone;
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::FileScanResultsL()
// -----------------------------------------------------------------------------
HBufC8* CTcTrustedSession::FileScanResultsL()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::FileScanResultsL");

    if( iFileScan == 0 )
        {
        return 0;
        }
        
    return iFileScan->GetCopyOfResultsL();
    }

// -----------------------------------------------------------------------------
// CTcTrustedSession::UpdateAccessLevelL()
// -----------------------------------------------------------------------------
void CTcTrustedSession::UpdateAccessLevelL()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::UpdateAccessLevelL");

	TInt aleave = KErrNone;
	TInt aerr   = KErrNone;  

	TInt accessLevel = CTcTrustedSession::EAccessLevelNone; 
	SetAccessLevel( accessLevel );
	//
	// Check third party application SID
	//		
	TRAP( aleave, CheckTerminalControl3rdPartySecureIDL() );
	if( KErrNone == aleave )
		{
		RDEBUG("TerminalControl: CTcTrustedSession::UpdateAccessLevelL granting application access rights.");
		accessLevel |= CTcTrustedSession::EAccessLevelApplication;
		}
		
	if( iHasCertificate )
	{
		aleave = KErrNone;
		aerr = KErrNone;

		//
		// Check third party application SID
		//
		TRAP( aleave, aerr = CheckTerminalControlPolicyL() );
		
		if( (KErrNone == aleave) && (KErrNone == aerr ))
			{
			RDEBUG("TerminalControl: CTcTrustedSession::UpdateAccessLevelL granting adapter access rights.");
			accessLevel |= CTcTrustedSession::EAccessLevelDMAdapter;
			}
	}

    SetAccessLevel( accessLevel );
    }

// -------------------------------------------------------------------------------------
// CTcTrustedSession::CheckTerminalControlPolicyL
// -------------------------------------------------------------------------------------   
TInt CTcTrustedSession::CheckTerminalControlPolicyL()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::CheckTerminalControlPolicyL");

    if( ! iHasCertificate )
        {
    	RDEBUG("TerminalControl: CTcTrustedSession::CheckTerminalControlPolicyL failed. There is no certificate.");
        return KErrAccessDenied;
        }

    /*
    If terminal control is not enforced (non-exclusive access), should we allow all connections?
    CSettingEnforcementInfo* enf = new (ELeave) CSettingEnforcementInfo();
    TBool enfed;
    enf->EnforcementActive( ETerminalSecurity, enfed ); //  change enf type when avail.
    delete enf;

    if( !enfed )
        {
        return KErrNone;
        }
    else
    */
        {
        //
        // Note: If certificate is not found, we return failure
        // Currently, main terminal control features are available through secure connection
        //
        TCertInfo ci;
        
        RDMCert dmcert;
        TInt ret = dmcert.Get( ci );

        if( KErrNone != ret )
            {
        	RDEBUG_2("**** TerminalControl: CTcTrustedSession::CheckTerminalControlPolicyL DMCert.Get failed with %d.", ret);
            return ret;
            }

        if( ! CertificatesAreEqual( iCertificate, ci ) )        
            {
    		RDEBUG("**** TerminalControl: CTcTrustedSession::CheckTerminalControlPolicyL ERROR Certificate mismatch!" );
            User::Leave( KErrArgument );
            }

        // Policy Engine Request
        TRequestContext context;
        TResponse response;
        context.AddSubjectAttributeL(
            PolicyEngineXACML::KTrustedSubject, ci
            );
        context.AddResourceAttributeL(
            PolicyEngineXACML::KResourceId,
            PolicyEngineXACML::KTerminalSecurityManagement,
            PolicyEngineXACML::KStringDataType
            );
        User::LeaveIfError( iPR.MakeRequest( context, response ) );
        TResponseValue resp = response.GetResponseValue();
		RDEBUG_2("TerminalControl: CTcTrustedSession::CheckTerminalControlPolicyL Policy check returned %d", (TInt)resp);
        switch( resp )
            {
            case EResponseDeny:
    	    case EResponseIndeterminate:
    	    case EResponseNotApplicable:
    	    default:
        	    return KErrAccessDenied;
    	    case EResponsePermit:
            	return KErrNone;

    	    }
        }
    }

// -------------------------------------------------------------------------------------
// CTcTrustedSession::CheckTerminalControl3rdPartySecureIDL
// -------------------------------------------------------------------------------------   
TInt CTcTrustedSession::CheckTerminalControl3rdPartySecureIDL()
    {
	RDEBUG("TerminalControl: CTcTrustedSession::CheckTerminalControl3rdPartySecureIDL");
    
    TRequestContext context;
    TResponse response;
    context.AddSubjectAttributeL(
        PolicyEngineXACML::KSubjectId, iSecureId
        );
    context.AddResourceAttributeL(
        PolicyEngineXACML::KResourceId,
        PolicyEngineXACML::KThirdPartySecureIds,
        PolicyEngineXACML::KStringDataType
        );
    User::LeaveIfError( iPR.MakeRequest( context, response ) );
    TResponseValue resp = response.GetResponseValue();
	RDEBUG_2("TerminalControl: CTcTrustedSession::CheckTerminalControl3rdPartySecureIDL Policy check returned %d", (TInt)resp);
    switch( resp )
        {
        case EResponsePermit:
        	return KErrNone;
        case EResponseDeny:
	    	case EResponseIndeterminate:
	    	case EResponseNotApplicable:
	    	default:
	    		User::Leave( KErrAccessDenied );
	    }
	    
	  return KErrAccessDenied;
    }

// -------------------------------------------------------------------------------------
// CTcTrustedSession::CertificatesAreEqual
// -------------------------------------------------------------------------------------   
TBool CTcTrustedSession::CertificatesAreEqual( const TCertInfo &aCert1, const TCertInfo &aCert2 )
    {
	RDEBUG("TerminalControl: CTcTrustedSession::CertificatesAreEqual");

    if( (aCert1.iFingerprint.Compare( aCert2.iFingerprint ) != 0) ||
        (aCert1.iSerialNo.Compare( aCert2.iSerialNo ) != 0) ||
        (aCert1.iPublicKey.Compare( aCert2.iPublicKey ) != 0) ||            
        (aCert1.iVersionNo    != aCert2.iVersionNo ) ||
        (aCert1.iPkAlg        != aCert2.iPkAlg ) ||
        (aCert1.iStartValDate != aCert2.iStartValDate ) ||
        (aCert1.iEndValDate   != aCert2.iEndValDate ) ||
        (aCert1.iDigAlg       != aCert2.iDigAlg ) ||
        (aCert1.iDNSName.Compare( aCert2.iDNSName ) != 0) ||

        (aCert1.iSubjectDNInfo.iCountry.Compare( aCert2.iSubjectDNInfo.iCountry ) != 0 ) ||
        (aCert1.iSubjectDNInfo.iOrganizationUnit.Compare( aCert2.iSubjectDNInfo.iOrganizationUnit ) != 0 ) ||
        (aCert1.iSubjectDNInfo.iOrganization.Compare( aCert2.iSubjectDNInfo.iOrganization ) != 0 ) ||
        (aCert1.iSubjectDNInfo.iCommonName.Compare( aCert2.iSubjectDNInfo.iCommonName ) != 0 ) ||
        (aCert1.iSubjectDNInfo.iLocality.Compare( aCert2.iSubjectDNInfo.iLocality ) != 0 ) ||

        (aCert1.iIssuerDNInfo.iCountry.Compare( aCert2.iIssuerDNInfo.iCountry ) != 0 ) ||
        (aCert1.iIssuerDNInfo.iOrganizationUnit.Compare( aCert2.iIssuerDNInfo.iOrganizationUnit ) != 0 ) ||
        (aCert1.iIssuerDNInfo.iOrganization.Compare( aCert2.iIssuerDNInfo.iOrganization ) != 0 ) ||
        (aCert1.iIssuerDNInfo.iCommonName.Compare( aCert2.iIssuerDNInfo.iCommonName ) != 0 ) ||
        (aCert1.iIssuerDNInfo.iLocality.Compare( aCert2.iIssuerDNInfo.iLocality ) != 0 )
        )
        {
        RDEBUG("**** TerminalControl: CTcTrustedSession::CertificatesAreEqual Certificates do NOT match");
        return EFalse;            
        }

    RDEBUG("TerminalControl: CTcTrustedSession::CertificatesAreEqual Certificates do match");
    return ETrue;
    }

// ----------------------------------------------------------------------------------------
// End of file