/*

* Copyright (c) 2006 Nokia Corporation and/or its subsidiary(-ies). 

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:   Implementation of DevCertKeyStoreServer

*

*/

#include <securityerr.h>

#include <asnpkcs.h>

#include <asn1enc.h>

#ifndef SYMBIAN_ENABLE_SPLIT_HEADERS

#include <x509keys.h>

#else

#include <x509keys.h>

#include <x509keyencoder.h>

#endif

#include <keyidentifierutil.h>

#include <mctauthobject.h>

#include <utf.h>

#include "DevCertKeyStoreServer.h"

#include "DevCertKeyStoreSession.h"

#include "DevCertKeyDataManager.h"

#include "DevCertKeyStoreConduit.h"

#include "DevCertKeyStoreSession.h"

#include "DevCertOpenedKeysSrv.h"

#include "DevTokenCliServ.h"

#include "DevCertCreateKey.h"

#include "DevCertOpenedKeys.h"

#include "DevTokenDataTypes.h"

#include "DevCertKeyStreamUtils.h"

#include "DevTokenUtil.h"

#include "DevCertKeyEncryptor.h"

#include "DevTokenPWManager.h"

// We don't currently allow any keys larger than 2048 bits.  It may be necessary to

// increase this limit in the future. 

const TUint KTheMinKeySize = 512;

const TUint KTheMaxKeySize = 2048;

// Security policies

_LIT_SECURITY_POLICY_C1(KImportRemoveSecurityPolicy, ECapabilityWriteDeviceData);

_LIT_SECURITY_POLICY_C1(KCreateSecurityPolicy, ECapabilityReadDeviceData);

_LIT_SECURITY_POLICY_C1(KOpenSecurityPolicy, ECapabilityReadDeviceData);

_LIT_SECURITY_POLICY_C1(KListSecurityPolicy, ECapabilityReadUserData);

// ======== MEMBER FUNCTIONS ========

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::NewL()

// ---------------------------------------------------------------------------

// 

CDevCertKeyStoreServer* CDevCertKeyStoreServer::NewL()

    {

    CDevCertKeyStoreServer* me = new (ELeave) CDevCertKeyStoreServer();

    CleanupStack::PushL(me);

    me->ConstructL();

    CleanupStack::Pop(me);

    return (me);

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::CDevCertKeyStoreServer()

// ---------------------------------------------------------------------------

//

CDevCertKeyStoreServer::CDevCertKeyStoreServer() :

	CActive(EPriorityStandard),

	iAction(EIdle),

	iExportBuf(NULL, 0)

    {

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::ConstructL()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::ConstructL()

    {

    iKeyDataManager = CDevCertKeyDataManager::NewL();

    iConduit = CDevCertKeyStoreConduit::NewL(*this);

    CActiveScheduler::Add(this);

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::~CDevCertKeyStoreServer()

// ---------------------------------------------------------------------------

//

CDevCertKeyStoreServer::~CDevCertKeyStoreServer()

    {

    Cancel();

    delete iKeyDataManager;

    delete iConduit;

    delete iKeyCreator;

    iSessions.Close();

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::CreateSessionL()

// ---------------------------------------------------------------------------

//

CDevCertKeyStoreSession* CDevCertKeyStoreServer::CreateSessionL()

    {

    CDevCertKeyStoreSession* session = CDevCertKeyStoreSession::NewL(*this );

    CleanupStack::PushL(session);

    User::LeaveIfError(iSessions.Append(session));

    CleanupStack::Pop(session);

    return session;

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::RemoveSession()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::RemoveSession(CDevCertKeyStoreSession& aSession)

    {

    if (iSession == &aSession) // just in case

        {

        iSession = NULL; 

        }

    for (TInt index = 0 ; index < iSessions.Count() ; ++index)

        {

        if (iSessions[index] == &aSession)

            {

            iSessions.Remove(index);

            return;

            }

        }

    User::Invariant();

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::ServiceRequestL()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::ServiceRequestL(const RMessage2& aMessage, CDevCertKeyStoreSession& aSession)

    {

    iMessage = &aMessage;

    iSession = &aSession;

    iConduit->ServiceRequestL(aMessage, aSession);

    }

//	From MCTKeyStore

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::ListL()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::ListL(const TCTKeyAttributeFilter& aFilter,

							  RPointerArray<CDevTokenKeyInfo>& aKeys)

    {

    ASSERT(iMessage);

    // Check the calling process has ReadUserData capability

    if (!KListSecurityPolicy.CheckPolicy(*iMessage))

        {

        User::Leave(KErrPermissionDenied);

        }

    TInt count = iKeyDataManager->Count();

    for (TInt i = 0; i < count; ++i)

        {

        const CDevCertKeyData* data = (*iKeyDataManager)[i];

        CDevTokenKeyInfo* info = iKeyDataManager->ReadKeyInfoLC(*data);

        if (KeyMatchesFilterL(*info, aFilter))

            {

            User::LeaveIfError(aKeys.Append(info));

            CleanupStack::Pop(info);

            }

        else

            {

            CleanupStack::PopAndDestroy(info);

            }

        }

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::KeyMatchesFilterL()

// ---------------------------------------------------------------------------

//

TBool CDevCertKeyStoreServer::KeyMatchesFilterL(const CDevTokenKeyInfo& aInfo,

										   const TCTKeyAttributeFilter& aFilter)

    {

    ASSERT(iMessage);

    if (aFilter.iKeyId.Length() && aFilter.iKeyId != aInfo.ID())

        {

        return EFalse;

        }

    if (aFilter.iUsage != EPKCS15UsageAll)

        {

        if ((aInfo.Usage() & aFilter.iUsage) == 0)

        return EFalse;

        }

    if (aFilter.iKeyAlgorithm != CCTKeyInfo::EInvalidAlgorithm && 

    aFilter.iKeyAlgorithm != aInfo.Algorithm())

        {

        return EFalse;

        }

    switch (aFilter.iPolicyFilter)

        {

        case TCTKeyAttributeFilter::EAllKeys:

        // All keys pass

        break;

        case TCTKeyAttributeFilter::EUsableKeys:

        if (!aInfo.UsePolicy().CheckPolicy(*iMessage))

            {

            return EFalse;

            }

        break;

        case TCTKeyAttributeFilter::EManageableKeys:

        if (!aInfo.ManagementPolicy().CheckPolicy(*iMessage))

            {

            return EFalse;

            }

        break;

        case TCTKeyAttributeFilter::EUsableOrManageableKeys:

        if (!aInfo.UsePolicy().CheckPolicy(*iMessage) &&

        !aInfo.ManagementPolicy().CheckPolicy(*iMessage))

            {

            return EFalse;

            }

        break;

        default:

        User::Leave(KErrArgument);

        }

    return ETrue;

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::GetKeyInfoL()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::GetKeyInfoL(TInt aObjectId, CDevTokenKeyInfo*& aInfo)

    {

    const CDevCertKeyData* keyData = iKeyDataManager->Lookup(aObjectId);

    if (!keyData)

        {

        User::Leave(KErrNotFound);

        }

    CDevTokenKeyInfo* result = iKeyDataManager->ReadKeyInfoLC(*keyData);

    if (!result->UsePolicy().CheckPolicy(*iMessage))

        {

        User::Leave(KErrPermissionDenied);

        }

    aInfo = result;

    CleanupStack::Pop(aInfo);

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::GetKeyLengthL()

// ---------------------------------------------------------------------------

//

TInt CDevCertKeyStoreServer::GetKeyLengthL(TInt aObjectId)

    {

    const CDevCertKeyData* keyData = iKeyDataManager->Lookup(aObjectId);

    if (!keyData)

        {

        User::Leave(KErrNotFound);

        }

    // this could be cached in memory (would break file format though)

    CDevTokenKeyInfo* keyInfo = iKeyDataManager->ReadKeyInfoLC(*keyData);

    TInt result = keyInfo->Size();

    CleanupStack::PopAndDestroy(keyInfo);

    return result;

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::OpenKeyL()

// ---------------------------------------------------------------------------

//

CDevCertOpenedKeySrv* CDevCertKeyStoreServer::OpenKeyL(TInt aHandle, TUid aOpenedKeyType)

    {

    ASSERT(iMessage);

    if (!KOpenSecurityPolicy.CheckPolicy(*iMessage))

        {

        User::Leave(KErrPermissionDenied);

        }

    const CDevCertKeyData *keyData = iKeyDataManager->Lookup(aHandle);

    if (!keyData)

        {

        User::Leave(KErrNotFound);

        }

    return CDevCertOpenedKeySrv::NewL( *keyData, aOpenedKeyType, *iMessage,*iKeyDataManager );						

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::ExportPublicL()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::ExportPublicL(TInt aObjectId,

									  TDes8& aOut)

    {

    const CDevCertKeyData* keyData = iKeyDataManager->Lookup(aObjectId);

    if (!keyData)

        {

        User::Leave(KErrNotFound);

        }

    CDevTokenKeyInfo* keyInfo = iKeyDataManager->ReadKeyInfoLC(*keyData);

    RStoreReadStream stream;

    iKeyDataManager->OpenPublicDataStreamLC(*keyData, stream);

    CDevTokenKeyInfo::EKeyAlgorithm keyAlgorithm = keyInfo->Algorithm();

    switch(keyAlgorithm)

        {

        case (CDevTokenKeyInfo::ERSA):

            {

            CRSAPublicKey* publicKey = NULL;

            CreateL(stream, publicKey);

            ASSERT(publicKey);

            CleanupStack::PushL(publicKey);

            TX509RSAKeyEncoder encoder(*publicKey, ESHA1);

            CASN1EncBase* encoded = encoder.EncodeKeyLC();

            if (encoded->LengthDER() > static_cast<TUint>(aOut.MaxLength()))

                {

                User::Leave(KErrOverflow);

                }

            //	Get the Public key DER encoding

            TUint pos=0;

            encoded->WriteDERL(aOut, pos);

            // WriteDERL does not set the length of the buffer, we do it ourselves			

            aOut.SetLength(encoded->LengthDER());			

            CleanupStack::PopAndDestroy(2, publicKey);

            }

        break;

        case (CDevTokenKeyInfo::EDSA):

            {

            CDSAPublicKey* publicKey = NULL;

            CreateL(stream, publicKey);

            ASSERT(publicKey);

            CleanupStack::PushL(publicKey);

            TX509DSAKeyEncoder encoder(*publicKey, ESHA1);

            CASN1EncBase* encoded = encoder.EncodeKeyLC();

            if (encoded->LengthDER() > static_cast<TUint>(aOut.MaxLength()))

                {

                User::Leave(KErrOverflow);

                }

            //	Get the Public key DER encoding

            TUint pos=0;

            encoded->WriteDERL(aOut, pos);

            // WriteDERL does not set the length of the buffer, we do it ourselves			

            aOut.SetLength(encoded->LengthDER());						

            CleanupStack::PopAndDestroy(2, publicKey);

            }

        break;

        case (CDevTokenKeyInfo::EDH):

        default:

        User::Leave(KErrKeyAlgorithm);

        break;

        }

    CleanupStack::PopAndDestroy(2, keyInfo); //stream, keyinfo

    }

//	From MCTKeyStoreManager

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::CheckKeyAttributes()

// ---------------------------------------------------------------------------

//

TInt CDevCertKeyStoreServer::CheckKeyAttributes(CDevTokenKeyInfo& aKey, TNewKeyOperation aOp)

    {

    ASSERT(iMessage);

    // Sort out the access rights

    TInt access = aKey.AccessType(); 

    // Only allow sensitive and extractable to be sepcified

    if (access & ~(CDevTokenKeyInfo::ESensitive | CDevTokenKeyInfo::EExtractable))

        {

        return KErrKeyAccess;

        }	

    // If it's sensitive and either created internally 

    // or imported from an encrypted source then it's always been sensitive

    if ((access & CDevTokenKeyInfo::ESensitive) &&

        (aOp == ENewKeyCreate))

        {

        access |= CDevTokenKeyInfo::EAlwaysSensitive;		

        }

    // If it's not extractable and it's created internally

    // then it's never been extractable

    if ((!(access & CDevTokenKeyInfo::EExtractable)) && aOp == ENewKeyCreate)

        {

        access |= CDevTokenKeyInfo::ENeverExtractable;		

        }

    aKey.SetAccessType(access);

    // check management policy allows the calling process to manage the key

    if (!aKey.ManagementPolicy().CheckPolicy(*iMessage))

        {

        return KErrArgument;

        }

    // check end date is not in the past

    TTime timeNow;

    timeNow.UniversalTime();

    if (aKey.EndDate().Int64() != 0 && aKey.EndDate() <= timeNow)

        {

        return KErrKeyValidity;

        }

    // We don't support non-repudiation, however we currently allow keys

    // to be created with this usage

    return KErrNone;

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::CheckKeyAlgorithmAndSize()

// ---------------------------------------------------------------------------

//

TInt CDevCertKeyStoreServer::CheckKeyAlgorithmAndSize(CDevTokenKeyInfo& aKey)

    {

    CDevTokenKeyInfo::EKeyAlgorithm keyAlgorithm = aKey.Algorithm();

    if ( ((keyAlgorithm!=CDevTokenKeyInfo::ERSA) && (keyAlgorithm!=CDevTokenKeyInfo::EDSA) && (keyAlgorithm!=CDevTokenKeyInfo::EDH) ))

        {

        return KErrKeyAlgorithm;

        }

    if (aKey.Size() < KTheMinKeySize || aKey.Size() > KTheMaxKeySize)

        {

        return KErrKeySize;

        }

    return KErrNone;

    }

// ---------------------------------------------------------------------------

// CDevCertKeyStoreServer::CreateKey()

// ---------------------------------------------------------------------------

//

void CDevCertKeyStoreServer::CreateKey(CDevTokenKeyInfo& aReturnedKey, TRequestStatus& aStatus)

    {

    ASSERT(iSession);

    ASSERT(iMessage);

    TInt err = KErrNone;

    // Check the calling process has WriteUserData capability

    if (!KCreateSecurityPolicy.CheckPolicy(*iMessage))

        {

        err = KErrPermissionDenied;

        }

    // Check the incoming information has been initialised correctly

    if (err == KErrNone)

        {

        err = CheckKeyAttributes(aReturnedKey, ENewKeyCreate);

        }

    if (err == KErrNone)

        {

        err = CheckKeyAlgorithmAndSize(aReturnedKey);

        }

    if (err != KErrNone)

        {

        TRequestStatus* status = &aStatus;

        User::RequestComplete(status, err);

        return;

        }

    // should make it local only if it's created in the keystore

    aReturnedKey.SetAccessType(aReturnedKey.AccessType() | CDevTokenKeyInfo::ELocal);