/*

* Copyright (c) 2003-2007 Nokia Corporation and/or its subsidiary(-ies). 

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:   Class that handles user input and launching of dialogs

*

*/

// INCLUDE FILES

#include <aknnotewrappers.h>        // Note dialogs

#include <aknmessagequerydialog.h>  // For CAknMessageQueryDialog

#include <StringLoader.h>           // For loading resource strings

#include <unifiedcertstore.h>       // For saving the certificates

#include <mctwritablecertstore.h>   // For saving the certificates

#include <sysutil.h>                // For FFSSpaceBelowCriticalLevelL(..)

#include <X509CertNameParser.h>     // For default label

#include <x509cert.h>               // For CX509Certificate

#include <wtlscert.h>               // For WTLSCertificate

#include <hash.h>                   // MD5 fingerprint

#include <certificateapps.h>

#include <mctkeystore.h>

#include <securityerr.h>

#include <asnpkcs.h>

#include <unifiedkeystore.h>

#include <x509certext.h>

#include <mctkeystore.h>

#include <TrustedSitesStore.h>

#include <CertSaver.rsg>

#include "CertSaverModel.h"

#include "CertSaverDocument.h"

#include "CertSaverAppUi.h"

#include "CertSaverSyncWrapper.h"

#include "certsaver.hrh"

#include "securityuisvariant.hrh"

// CONSTANTS

const TInt32 KWTLSTrusterUID( 268479059 );

const TInt32 KInternetTrusterUID( 268441661 );

const TInt32 KApplicationControllerTrusterUID( 268452523 );

const TInt32 KJavaInstallTrusterUID( 270506792 );

const TInt32 KOCSPTrusterUID( 268478646 );

const TInt32 KVPNUID( 270498195 );

const TInt KTrusterArrayInitSize( 2 );

const TInt KMaxLengthTextMeassageBody( 5000 );

const TInt KMaxLengthTextDateString( 11 );    // "dd/mm/yyyy0"

//Issuer and Owner max visible length

const TInt KMaxLengthTextCertIdentifierVisible( 1000 );

const TInt KAttempts( 3 );

const TInt KFingerprintLength( 50 );

_LIT( KCertSaverListBoxItemPrefix, "1\t" );

const TInt KItemBufLen = 2 + KMaxName;

_LIT( KPrivateKeyLabel, "PrivateKey " );

const TInt KPrivaKeyLabelLength( 50 );

_LIT( KDateString,"%D%M%Y%1%2%3" );

_LIT( KTimeString,"%-B%:0%J%:1%T%:2%S%:3%+B" );

_LIT( KSpace, " " );

_LIT( KDoubleEnter, "\n\n" );

_LIT( KEnter, "\n" );

const TUid KTrustedServerTokenUid = { 0x101FB66F };

const TUid KFileTokensUid = { 0x101F501A };

_LIT_SECURITY_POLICY_V1( KSymbianKeyStoreMgmtPolicy,

                         VID_DEFAULT, ECapabilityWriteUserData );

_LIT_SECURITY_POLICY_C1( KSymbianKeyStoreUsePolicy, ECapabilityReadUserData );

// ================= MEMBER FUNCTIONS =======================

// Destructor

CCertSaverModel::~CCertSaverModel()

    {

    delete iWrapper;

    iEntries.Close();

    delete iUnifiedCertStore;

    iTrusterUids.Close();

    }

// ----------------------------------------------------------

// CCertSaverModel::CCertSaverModel(

//    const CCertSaverDocument* aDocument, CCertSaverAppUi* aAppUi)

// ----------------------------------------------------------

//

CCertSaverModel::CCertSaverModel(

    CCertSaverAppUi* aAppUi,

    const CCertParser& aParser ):

    iAppUi( aAppUi ), iFs( iAppUi->CoeEnv()->FsSession() ), iParser( aParser ),

    iSavedCACertsCount( 0 ), iSavedKeysCount( 0 ),

    iSavedUserCertsCount( 0 ), iKeyAlreadyExists( EFalse )

    {

    }

// ----------------------------------------------------------

// CCertSaverModel::SaveCertificateL()

// ----------------------------------------------------------

//

void CCertSaverModel::SaveCertificateL(

            const CX509Certificate& aCertificate,

            const TCertificateOwnerType& aOwnerType,

            const TCertificateFormat& aCertFormat )

    {

    iCertOwnerType = aOwnerType;

    iCertFormat = aCertFormat;

    iNewCert = &aCertificate;

    if ( aOwnerType == EPeerCertificate )

        {

        TInt ret = QueryTrustedSiteL();

        if ( ret != KErrNone )

            {

             return;

            }

        }

    SaveCertL();

    }

// ----------------------------------------------------------

// CCertSaverModel::DoSavePrivateKeyL()

//

// ----------------------------------------------------------

//

void CCertSaverModel::DoSavePrivateKeyL( const TDesC8& aKey )

    {

    CheckFSSpaceL( aKey );

    TKeyIdentifier keyIdentifier;

    CDecPKCS8Data* pkcs8Data = TASN1DecPKCS8::DecodeDERL( aKey );

    CleanupStack::PushL( pkcs8Data );

    MPKCS8DecodedKeyPairData* keyPairData = pkcs8Data->KeyPairData();

    keyPairData->GetKeyIdentifierL( keyIdentifier );

    TTime startDate;

    TTime endDate;

    GetKeyValidityPeriodL( startDate, endDate, keyIdentifier );

    TInt err = KErrNone;

    CCTKeyInfo* keyInfo = NULL;

    TBuf<KPrivaKeyLabelLength> keyLabel( KPrivateKeyLabel );

    TKeyUsagePKCS15 keyUsage = KeyUsageL( keyIdentifier, pkcs8Data->Algorithm() );

    CleanupStack::PopAndDestroy( pkcs8Data );

    if (KeyAlreadyExistsL( startDate, endDate, keyIdentifier, keyUsage) )

        {

        User::Leave( KErrNone );

        }

    TInt accessType( 0 );

    accessType |= CCTKeyInfo::EExtractable;

    for ( TInt i = 0; i < KAttempts; i++ )

        {

        CreateKeyLabelL( keyLabel );

        // Should not use hardcoded index

        err = iWrapper->AddKey( 0, aKey, keyUsage, keyLabel,

            accessType, startDate, endDate, keyInfo );

        if ( err != KErrAlreadyExists )

            {

            i = KAttempts;

            }

        keyLabel.Zero();

        }

    TCTTokenObjectHandle handle;

    if ( keyInfo )

        {

        handle = keyInfo->Handle();

        keyInfo->Release();

        keyInfo = NULL;

        }

    switch ( err )

        {

        case KErrNone:

            {

            ++iSavedKeysCount;

            break;

            }

        case KErrKeySize:

        case KErrArgument:

            {

            ShowErrorNoteL( R_CERTSAVER_KEY_TYPE_NOT_SUPPORTED );

            User::Leave( KErrCancel );

            break;

            }

        case KErrKeyValidity:

            {

            ShowInformationNoteL( R_CERTSAVER_QTN_CM_PKCS12_EXPIRED );

            User::Leave( KErrCancel );

            }

        case KErrKeyUsage:

            {

            ShowErrorNoteL( R_CERTSAVER_PRIVATE_KEY_CORRUPTED );

            User::Leave( KErrCancel );

            break;

            }

        case KErrCancel:

        case KErrPermissionDenied:

            {

            ShowErrorNoteL( R_CERTSAVER_PKCS12_DISCARDED );

            User::Leave( KErrCancel );

            break;

            }

        case KErrCorrupt:

        case KErrEof:

            {

            ShowErrorNoteL( R_CERTSAVER_KEYSTORE_CORRUPTED );

            User::Leave( KErrCancel );

            break;

            }

        case KErrAlreadyExists:

            {

            User::Leave( KErrCancel );

            break;

            }

        default:

            {

            User::Leave( err );

            break;

            }

        }

    User::LeaveIfError(

        iWrapper->SetManagementPolicy( handle, KSymbianKeyStoreMgmtPolicy) );

    User::LeaveIfError(

        iWrapper->SetUsePolicy( handle, KSymbianKeyStoreUsePolicy ) );

    }

// ----------------------------------------------------------

// TBool CCertSaverModel::KeyAlreadyExistsL()

//

// ----------------------------------------------------------

//

TBool CCertSaverModel::KeyAlreadyExistsL(

    TTime& aStartDate,

    TTime& aEndDate,

    const TKeyIdentifier& aKeyIdentifier,

    TKeyUsagePKCS15& aKeyUsage )

    {

    TBool ret = EFalse;

    TCTKeyAttributeFilter keyFilter;

    keyFilter.iKeyAlgorithm = CKeyInfoBase::EInvalidAlgorithm;

    keyFilter.iKeyId = aKeyIdentifier;

    keyFilter.iPolicyFilter = TCTKeyAttributeFilter::EManageableKeys;

    keyFilter.iUsage = aKeyUsage;

    RMPointerArray<CCTKeyInfo> keyArray;

    TInt err = iWrapper->ListKeys( keyArray, keyFilter );

    CleanupClosePushL( keyArray );

    switch ( err )

        {

        case KErrNone:

            {

            break;

            }

        case KErrCorrupt:

        case KErrEof:

            {

            ShowErrorNoteL( R_CERTSAVER_KEYSTORE_CORRUPTED );

            User::Leave( KErrCancel );

            }

        default:

            {

            User::Leave( err );

            }

        }

    for ( TInt i = 0; ret == EFalse && i < keyArray.Count(); i++ )

        {

        if ( keyArray[i]->StartDate() == aStartDate &&

             keyArray[i]->EndDate() == aEndDate )

            {

            ret = ETrue;

            iKeyAlreadyExists = ETrue;

            }

        }

    CleanupStack::PopAndDestroy( &keyArray );

    return ret;

    }

// ----------------------------------------------------------

// CCertSaverModel::GetKeyValidityPeriodL()

//

// ----------------------------------------------------------

//

void CCertSaverModel::GetKeyValidityPeriodL(

    TTime& aStartDate,

    TTime& aEndDate,

    const TKeyIdentifier& aKeyIdentifier )

    {

    for ( TInt i = 0; i < iParser.UserCertificates().Count(); i++ )

        {

        const CX509Certificate* cert = iParser.UserCertificates().At( i );

        if ( cert->KeyIdentifierL() == aKeyIdentifier )

            {

            // Associated certificate found

            // In the first round aStartDate and aEndDate is initialised.

            if ( i == 0 || aStartDate > cert->ValidityPeriod().Start() )

                {

                aStartDate = cert->ValidityPeriod().Start();

                }

            if ( i == 0 || aEndDate < cert->ValidityPeriod().Finish() )

                {

                aEndDate = cert->ValidityPeriod().Finish();

                }

            }

        }

    }

// ----------------------------------------------------------

// CCertSaverModel::CreateKeyLabelL()

//

// ----------------------------------------------------------

//

void CCertSaverModel::CreateKeyLabelL( TDes& aLabel )

    {

    TTime time;

    time.UniversalTime();

    TBuf<KPrivaKeyLabelLength> dateBuf;

    time.FormatL( dateBuf, KDateString );

    aLabel.Append( dateBuf );

    dateBuf.Zero();

    aLabel.Append( KSpace );

    time.FormatL( dateBuf, KTimeString );

    aLabel.Append( dateBuf );

    }

// ----------------------------------------------------------

// CCertSaverModel::SavePrivateKeyL()

//

// ----------------------------------------------------------

//

void CCertSaverModel::SavePrivateKeyL()

    {

    if ( iParser.Keys().Count() <= 0 )

        {

        return;

        }

    if ( NULL == iWrapper )

        {

        iWrapper = CCertSaverSyncWrapper::NewL();

        }

    TInt err = iWrapper->InitializeKeyStoreL( iFs );

    TInt keyStoreCount = iWrapper->UnifiedKeyStore().KeyStoreManagerCount();

    if ( keyStoreCount <= 0 )

        {

        User::Leave( KErrCancel );

        }

    else

        {

        for ( TInt i = 0; i < keyStoreCount; ++i )

            {

            TUid uid =

            iWrapper->UnifiedKeyStore().KeyStoreManager(i).Token().TokenType().Type();

            if ( uid == TUid::Uid( KTokenTypeFileKeystore ) )

                // if this is not found, we use the first one,

                // which is already initialised

                {

                iSelectedKeyStore = i;

                }

            }

        }

    for ( TInt i = 0; i < iParser.Keys().Count(); i++ )

        {

        const HBufC8* key = iParser.Keys().At( i );

        TRAP(err, DoSavePrivateKeyL( *key ));

        User::LeaveIfError( err );

        }

    }

// ----------------------------------------------------------

// CCertSaverModel::KeyUsageL(

//    const TKeyIdentifier& aKeyIdentifier, TAlgorithmId aAlgorithm)

// ----------------------------------------------------------

//

TKeyUsagePKCS15 CCertSaverModel::KeyUsageL(

    const TKeyIdentifier& aKeyIdentifier,

    TAlgorithmId aAlgorithm )

    {

    TKeyUsagePKCS15 pkcs15KeyUsage = EPKCS15UsageNone;

    TKeyUsageX509 x509Usage = EX509UsageNone;

    for ( TInt i = 0; i < iParser.UserCertificates().Count(); i++ )

        {

        const CX509Certificate* cert = iParser.UserCertificates().At( i );

        if ( cert->KeyIdentifierL() == aKeyIdentifier )

            {

            const CX509CertExtension* ext = cert->Extension( KKeyUsage );

            if (ext)

                {

                CX509KeyUsageExt* keyUsageExt =

                    CX509KeyUsageExt::NewLC( ext->Data() );

                if ( keyUsageExt->IsSet( EX509DigitalSignature ) )

                  {

                  x509Usage |= EX509UsageDigitalSignature;

                  }

                if ( keyUsageExt->IsSet( EX509NonRepudiation ) )

                  {

                  x509Usage |= EX509UsageNonRepudiation;

                  }

                if ( keyUsageExt->IsSet( EX509KeyEncipherment ) )

                  {

                  x509Usage |= EX509UsageKeyEncipherment;

                  }

                if ( keyUsageExt->IsSet( EX509DataEncipherment ) )

                  {

                  x509Usage |= EX509UsageDataEncipherment;

                  }

                if ( keyUsageExt->IsSet( EX509KeyAgreement ) )

                  {

                  x509Usage |= EX509UsageKeyAgreement;

                  }

                if ( keyUsageExt->IsSet( EX509KeyCertSign ) )

                  {

                  x509Usage |= EX509UsageKeyCertSign;

                  }

                if ( keyUsageExt->IsSet( EX509CRLSign ) )

                  {

                  x509Usage |= EX509UsageCRLSign;

                  }

                if ( keyUsageExt->IsSet( EX509EncipherOnly ) )

                  {

                  x509Usage |= EX509UsageEncipherOnly;

                  }

                if ( keyUsageExt->IsSet( EX509DecipherOnly ) )

                  {

                  x509Usage |= EX509UsageDecipherOnly;

                  }

                CleanupStack::PopAndDestroy( keyUsageExt );

                }

            }

        }

    pkcs15KeyUsage = KeyUsageX509ToPKCS15Private( x509Usage );

    // If any certificate in the file did not include key usage,

    // let's use default values.

    if ( EPKCS15UsageNone == pkcs15KeyUsage )

        {

        switch ( aAlgorithm )

            {

            case ERSA:

                {

                pkcs15KeyUsage |= EPKCS15UsageSignSignRecover;

                pkcs15KeyUsage |= EPKCS15UsageDecryptUnwrap;

                break;

                }

            case EDSA:

                {

                pkcs15KeyUsage |= EPKCS15UsageSignSignRecover;

                break;

                }

            default:

                {

                break;

                }

            }

        }

    return pkcs15KeyUsage;

    }

// ----------------------------------------------------------

// CCertSaverModel::CheckFSSpaceL(

//    const TDesC8& aDataToSave)

// ----------------------------------------------------------

//

void CCertSaverModel::CheckFSSpaceL( const TDesC8& aDataToSave )

    {

    if (SysUtil::FFSSpaceBelowCriticalLevelL( &iFs, aDataToSave.Size() ))

        {

        HBufC* p = StringLoader::LoadLC( R_CERTSAVER_MEMORY );

        CAknErrorNote* note = new (ELeave) CAknErrorNote( ETrue );

        note->ExecuteLD( p->Des() );

        CleanupStack::PopAndDestroy( p );

        User::Leave( KErrExitApp );

        }

    }

// ----------------------------------------------------------

// CCertSaverModel::SaveCertL()

// Saves certificate

// ----------------------------------------------------------

//

void CCertSaverModel::SaveCertL()

  {

    if ( !CertificateOkL() )

        {

        User::Leave( KErrCancel );

        }

    HBufC* message = HBufC::NewLC( KMaxLengthTextMeassageBody );

    TPtr msgPtr = message->Des();

    ConstructMessageL( msgPtr );

    CAknMessageQueryDialog* dlg = CAknMessageQueryDialog::NewL( *message );

    CleanupStack::PopAndDestroy( message );

    CleanupStack::PushL( dlg );

    dlg->PrepareLC( R_MESSAGE_QUERY_DOSAVE );

    HBufC* header = StringLoader::LoadLC( R_CERTSAVER_DETAILS_HEADING );

    dlg->QueryHeading()->SetTextL( header->Des() );

    CleanupStack::PopAndDestroy( header );

    CleanupStack::Pop( dlg );

    TBool doSave = dlg->RunLD();

    if ( doSave && iCertOwnerType == ECACertificate )

        {

        // warn user about security risk