// Copyright (c) 2001-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// ocsp.h

// Header specifying client interface to the OCSP module.

// 

//

#ifndef OCSPREQUESTANDRESPONSE_H

#define OCSPREQUESTANDRESPONSE_H

/**

 * @file

 * @internalTechnology

 */

#include <e32base.h>

#include <signed.h>

#include <f32file.h>

#include <hash.h>

#include <x500dn.h>

#include <x509cert.h>

#include <ct/rmpointerarray.h>

#include <cctcertinfo.h>

#include <asn1enc.h>

#include <asn1dec.h>

#ifdef SYMBIAN_ENABLE_SPLIT_HEADERS

#include "ocsp.h"

#endif

#define KOCSPNonceBytes 16

// Default values for transport parameters

const TUint KTransportDefaultRequestRetryCount 	= 1;	// No retry

const TInt KTransportDefaultRequestTimeout 		= -1;	// Timeout disabled

class COCSPRequestCertInfo;

class COCSPResponseCertInfo;

class COCSPCertID;

class MOCSPTransport;

class COCSPResponse;

class COCSPTransportHandler;

class MOCSPAuthorisationScheme;

class COCSPTransaction;

class COCSPValidator;

class COCSPRequestCertInfo;

class COCSPResponseDecoder;

class CASN1EncBase;

class CASN1EncContainer;

class TASN1DecGeneric;

class CX509Certificate;

class CX509CertChain;

class CPKIXCertChainBase;

class COCSPParameters;

/**

 * Represents an OCSP protocol request.

 */

class COCSPRequest : public CBase

	{

public:

	/**

	 * Get the nonce used in the request.  Returns NULL if a nonce was not used.

	 */

	IMPORT_C const TDesC8* Nonce() const;

	/**

	 * Get the number of certificates used in a response

	 */

	IMPORT_C TInt CertCount() const;

	/**

	 * Get a COCSPRequestCertInfo object containing details about one of the

	 * certificates present in the request.

	 */

	IMPORT_C const COCSPRequestCertInfo& CertInfo(TUint aIndex) const;

public:

	// Not exported

	static COCSPRequest* NewLC(TBool aUseNonce);

	static COCSPRequest* NewL(TBool aUseNonce);

	~COCSPRequest();

	void AddCertificateL(const CX509Certificate& aSubject,

						 const CX509Certificate& aIssuer);

private:

	COCSPRequest();

	void ConstructL(TBool aUseNonce);

	HBufC8* iNonce;

	RPointerArray<const COCSPRequestCertInfo> iCertInfos;

	};

/**

 * Information about a certificate sent as part of an OCSP request.

 */

class COCSPRequestCertInfo : public CBase

	{

public:

	/**

	 * Get the certificate present in the request.

	 */

	IMPORT_C const CX509Certificate& Subject() const;

	/**

	 * Get the issuer of the certificate present in the request.

	 */

	IMPORT_C const CX509Certificate& Issuer() const;

public:

	// Not exported

	static COCSPRequestCertInfo* NewLC(

		const CX509Certificate& aSubject,

		const CX509Certificate& aIssuer);

	~COCSPRequestCertInfo();

	const COCSPCertID& CertID() const;

 private:

	COCSPRequestCertInfo(const CX509Certificate& aIssuer,

						 const CX509Certificate& aSubject);

	void ConstructL();

private:

	const CX509Certificate& iSubject;

	const CX509Certificate& iIssuer;

	COCSPCertID* iCertID;

	};

/**

 * Represents an OCSP protocol response.

 */

class COCSPResponse : public CSignedObject

	{

public:

	/**

	 * Get the number of certificates statuses present in the response.

	 */

	IMPORT_C TInt CertCount() const;

	/**

	 * Get a COCSPResponseCertInfo object containing details about one of the

	 * certificate statuses present in the response.

	 */

	IMPORT_C const COCSPResponseCertInfo& CertInfo(TUint aIndex) const;

	/**

	 * Get the producedAt time for the response.

	 */

	IMPORT_C TTime ProducedAt() const;

	/**

	 * Get the archiveCutoff time for the response, or NULL if it was not present.

	 */

	IMPORT_C const TTime* ArchiveCutoff() const;

public:

	// This class is created and initialised by the response decoder

	friend class COCSPResponseDecoder;

	~COCSPResponse();

	/**

	 * Get the index for the given cert, or KErrNotFound.

	 */

	TInt Find(const COCSPCertID& aCertID) const;

	// Enums to use in DataElementEncoding

	enum

		{

		ECertificateChain,

		ENonce,

		EResponderIDName,    // Only one of the ResponderIDs won't be NULL

		EResponderIDKeyHash

		};

  	// From CSignedObject

  	const TPtrC8* DataElementEncoding(const TUint aIndex) const;

private:

	COCSPResponse();

  	// From CSignedObject

	const TPtrC8 SignedDataL() const;

	void InternalizeL(RReadStream& aStream);

private:

	// Time of response, and of archiveCutoff extension (if present)

	TTime iProducedAt;

	TTime* iArchiveCutoff;

	// Value of nonce in response extension (if present)

	TPtrC8 iNonce;

	// Point to the signing certificates in the response

	TPtrC8 iSigningCerts;

	// Point to the signed portion of the data

	TPtrC8 iSignedData;

	// There are two ways the responder ID can be specified - only

	// one of these will be used

	TPtrC8 iResponderIDName;

	TPtrC8 iResponderIDKeyHash;

	RPointerArray<COCSPResponseCertInfo> iCertInfos;

	};

/**

 * Information about a certificate status, as given in OCSP response

 * singleResponse data item.

 */

class COCSPResponseCertInfo : public CBase

	{

public:

	IMPORT_C OCSP::TResult Status() const;

	IMPORT_C TTime ThisUpdate() const;

	IMPORT_C const TTime* NextUpdate() const;     // NULL if nextUpdate not set

	IMPORT_C const TTime* RevocationTime() const; // NULL if not revoked

public:

	static COCSPResponseCertInfo* NewLC(CArrayPtr<TASN1DecGeneric>& aItems);

	~COCSPResponseCertInfo();

	COCSPCertID& CertID() const;

private:

	void ConstructL(CArrayPtr<TASN1DecGeneric>& aItems);

private:

	OCSP::TResult iStatus;

	TTime iThisUpdate;

	TTime* iNextUpdate;

	TTime* iRevocationTime;

	COCSPCertID* iCertID;

	};

/**

	Utility class contains functions common to all validation

	schemes.

 */

namespace OCSPUtils

	{

	TBool IsAIAForOCSPPresentL(const CX509Certificate& aCert);

	TBool DoesResponderIdMatchCertL( const COCSPResponse& aResponse, 

											const CX509Certificate& aResponderCert);

	TBool DoesDNNameMatchL( 	const COCSPResponse& aResponse, const CX509Certificate& aCert);

	TBool DoesIssuerKeyMatchL(const COCSPResponse& aResponse, const CX509Certificate& aCert);

	TBool IsResponseSignedByCertL( COCSPResponse* aResponse, const CX509Certificate& aCert);

	TBool DoesCertHaveOCSPNoCheckExt( const CX509Certificate& aCert);

	TDesC8* ServerUriL(	const CX509Certificate& aCert, const COCSPParameters* aParameters );

	TBool IsUriAvailableL( const CX509Certificate& aCert, const COCSPParameters* aParameters );

	TDesC8* GetAIAL(const CX509Certificate& aCert);

	TBool DoesCertHaveOCSPSigningExtL(const CX509Certificate& aCert);

	CX509Certificate* GetResponderCertLC(const TDesC8& aEncodedCerts);

	}

// Base class interface for authorisation schemes, for plugging into the validator object

class MOCSPAuthorisationScheme

	{

public:

	virtual ~MOCSPAuthorisationScheme() {};

	virtual void ValidateL(

		OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,

		const TTime aValidationTime, TRequestStatus& aStatus,

		const COCSPRequest& aRequest) = 0;

	virtual void CancelValidate() = 0;

	// Returns the responder certificate. This method shall return valid responder

	// certificate for delegate and direct schemes, for the cadirect scheme although

	// the CA cert is the response cert but it returns NULL as the need for retrieving

	// this certificate is to further send it for OCSP checking, this logic is only valid 

	// for delegate and direct schemes.

	virtual const CX509Certificate* ResponderCert() const = 0;

	};

class CPKIXValidationResultBase;

class CCertAttributeFilter;

class MCertStore;

class COCSPDelegateAuthorisationScheme : public CActive, public MOCSPAuthorisationScheme

/**

	Implement part of S2.2.2 of RFC 2560.

	"a CA Designated Responder (Authorized Responder) who holds

	a specially marked certificate issued directly by the CA,

	indicating that the responder may issue OCSP responses for

	that CA."

*/

	{

public:

	IMPORT_C static COCSPDelegateAuthorisationScheme* NewLC(MCertStore& aCertStore);

	virtual ~COCSPDelegateAuthorisationScheme();

	virtual void ValidateL(

		OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,

		const TTime aValidationTime, TRequestStatus& aStatus,

		const COCSPRequest& aRequest);

	virtual void CancelValidate();

	const CX509Certificate* ResponderCert() const;

protected:

	virtual void RunL();

	virtual void DoCancel();

	TInt RunError(TInt aError);

private:

	COCSPDelegateAuthorisationScheme(MCertStore& aCertStore);

	void ConstructL();

	void ValidateDelegateCertL(const TDesC8& aResponseCertChain, const TTime aValidationTime);

	void OnChainValidationL();

	// searches on the basis of the issuer's subject name

	void ValidateFromRootsL();

	void OnRetrieveNextL();

	void OnRetrievingEntryL();

private:

	enum TDelegateAuthState

	{

	EOnChainValidation,

	ERetrieveNext,

	ERetrievingEntry,

	};

	/**

		This is a required argument for CPKIXCertChainBase, even

		though no certificates are used from the store.

	 */

	MCertStore& iCertStore;

	/**

		Pointer to client's OSCP status.  This object sets the

		status according to the result of the validation.  If

		the validation cannot be carried out, the default value

		is OCSP::EResponseSignatureValidationFailure.

	 */

	OCSP::TStatus* iOCSPStatus;

	/**

		Pointer to client's request status.  This is recorded

		on the call to Validate() and used to notify the client

		of completion later.

	 */

	TRequestStatus* iClientStatus;

	/**

		Array used to hold pointer to issuer cert.  This contains

		the pointer to the CA.

	 */

	RPointerArray<CX509Certificate> iRespSignIntCert;

	/**

		This object is used to chain the response signer back

		to the CA.

	 */

	CPKIXCertChainBase* iRespSignCertChainBase;

	/**

		The cert chain stores the validation result in

		this object.

		@see iRespSignCertChain;

	 */

	CPKIXValidationResultBase* iPKIXResultBase;

	/**

		Response from OCSP server.  Once it has been established

		that the certificate sent with the response is an authorised

		responder for the CA, the response is checked to ensure

		that it really is signed by that certificate.

		This is not const because, if DSA is used, then

		SetParametersL() will be called on the response before

		the signature is verified.

	 */

	COCSPResponse* iResponse;

	const COCSPRequest* iRequest;

	CCertAttributeFilter* iCertFilter;

	RMPointerArray<CCTCertInfo> iCertStoreEntries;

	TDelegateAuthState	iState;

	HBufC8* iEncodedCert;

	const CX509Certificate* iResponseCert;

	TInt iCertCount;

	TTime iValidationTime;

	TBool iValidateFromResponse;

	};

class COCSPCaDirectAuthorisationScheme : public CBase, public MOCSPAuthorisationScheme

/**

	Implement part of S2.2 of RFC 2560.

	"The key used to sign the response MUST belong to one of the following...

	-- the CA who issued the certificate in question"

*/

	{

public:

	IMPORT_C static COCSPCaDirectAuthorisationScheme* NewLC();

	const CX509Certificate* ResponderCert() const;

private:

	virtual void ValidateL(

		OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse,

		const TTime aValidationTime, TRequestStatus& aStatus,

		const COCSPRequest& aRequest);

	virtual void CancelValidate();

	TBool DoValidateL(

		const COCSPRequest& aRequest, COCSPResponse& aResponse);

	TBool CertChainMatchesCertL(

		const TDesC8& aCertChainData, const CX509Certificate& aCert);

	};

// Authorisation scheme taking a cert store UID, and allowing those cert chains

// with a root cert in the cert store valid for that UID

	/**

	Implement part of S2.2 of RFC 2560.

	"The key used to sign the response MUST belong to one of the following...

	-- a Trusted Responder whose public key is trusted by the requester"

*/

class COCSPDirectAuthorisationScheme : public CActive, public MOCSPAuthorisationScheme

	{

public:

	IMPORT_C static COCSPDirectAuthorisationScheme* NewLC(const TUid& aCertStoreUid, MCertStore& aCertStore);

	~COCSPDirectAuthorisationScheme();

	// From MOCSPAuthorisationScheme

	void ValidateL(OCSP::TStatus& aOCSPStatus, COCSPResponse& aResponse, 

		const TTime aValidationTime, TRequestStatus& aStatus,

		const COCSPRequest& aRequest);

	void CancelValidate();

	const CX509Certificate* ResponderCert() const;

protected:

	virtual void DoCancel();

	virtual void RunL();

	virtual TInt RunError(TInt aError);

private:

	void ConstructL();

	COCSPDirectAuthorisationScheme(const TUid& aCertStoreUid, MCertStore& aCertStore);

	TBool ValidateSignatureL();

	void ValidateFromRoots();

	void ValidateCertChainL(); 

	void StartValidateL();

	void OnValidateCertChainL();

	void OnListCertEntries();

	void OnRetrieveNextL();

	void OnRetrievingEntryL();

private:

	TUid iCertStoreUid;

	COCSPResponse* iResponse;

	CPKIXCertChainBase* iCertChain;

	TRequestStatus* iClientStatus;

	CPKIXValidationResultBase* iPKIXResult;

	OCSP::TStatus* iOCSPStatus;

	enum TStatus

		{

		EValidateCertChain, // waiting for cert chain validation to complete

		EListCertEntries,   // waiting listing to complete

		ERetrieveNext,      // get next cert entry

		ERetrievingEntry,   // waiting for entry retrieval to complete

		};

	TStatus iState;

	MCertStore& iCertStore;

	CCertAttributeFilter* iCertFilter;

	RMPointerArray<CCTCertInfo> iCertStoreEntries;