// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// Define generic methods which can be used accross the ocsp component.

// 

//

#include <asymmetrickeys.h>

#include <ocsp.h>

#include "oids.h"

#include <x509certext.h>

#include "ocsprequestandresponse.h"

namespace OCSPUtils

	{

	/**

		Checks whether the supplied certificate matches the responder

		ID in the supplied response.  This implements S3.2.3 of RFC2560.

		Note this does <em>not</em> mean the response is signed by the

		certificate's subject.  It just checks that the certificate's

		name, or a hash of its key, is present in the response's plaintext.

		@param	aResponse		Response whose responder ID should describe

								<var>aCert</var>.

		@param	aCert			Certificate whose name or key should be

								in the response.

		@return ETrue if the response's responder ID matches <var>aCert</var>,

			EFalse otherwise.

	 */

	TBool DoesResponderIdMatchCertL( const COCSPResponse& aResponse, 

												const CX509Certificate& aResponderCert)

		{	

		return (DoesIssuerKeyMatchL(aResponse,aResponderCert) || DoesDNNameMatchL(aResponse,aResponderCert));

		}

	TBool DoesDNNameMatchL( 	const COCSPResponse& aResponse, const CX509Certificate& aCert)

		{

		TBool result = EFalse;

		const TPtrC8* nameData = aResponse.DataElementEncoding(COCSPResponse::EResponderIDName);

		if (nameData)

			{

			CX500DistinguishedName* name = CX500DistinguishedName::NewLC(*nameData);

			if (aCert.SubjectName().ExactMatchL(*name))

				{

				result = ETrue;

				}

			CleanupStack::PopAndDestroy(name);

			}

		return result;

		}

	TBool DoesIssuerKeyMatchL(const COCSPResponse& aResponse, const CX509Certificate& aCert)

		{

		TBool result = EFalse;

		// check the responder's issuer key and verify that it is the same as the issuer cert

		const TPtrC8* keyHash = aResponse.DataElementEncoding(COCSPResponse::EResponderIDKeyHash);

		const TPtrC8* keyEncoding = aCert.DataElementEncoding(CX509Certificate::ESubjectPublicKeyInfo);

		if (!keyHash || !keyEncoding)

			{

			return result;

			}

		TASN1DecSequence decSeq;

		TInt pos = 0;

		CArrayPtrFlat<TASN1DecGeneric>* seq = decSeq.DecodeDERLC(*keyEncoding, pos, 2, KMaxTInt);

		TASN1DecBitString decBitStr;

		HBufC8* toHashData = decBitStr.ExtractOctetStringL(*seq->At(1));

		CleanupStack::PushL(toHashData);

		CSHA1* hashAlg = CSHA1::NewL();

		CleanupStack::PushL(hashAlg);

		TPtrC8 certKeyHash = hashAlg->Hash(*toHashData);

		if (certKeyHash == *keyHash)

			{

			// Public key hashes match

			result = ETrue;

			}

		CleanupStack::PopAndDestroy(3, seq); // hashAlg, toHashData, seq

		return result;

		}

	TBool IsResponseSignedByCertL(

		COCSPResponse* aResponse, const CX509Certificate& aCert)

	/**

		Checks whether the supplied response is signed by the supplied

		certificate.

		@param	aResponse		Response which should be signed by aCert.

		@param	aCert			Candidate certificate which may have been

								used to sign <var>aResponse</var>.

		@return ETrue if <var>aCert</var> is used to sign <var>aResponse</var>,

			EFalse otherwise.  Note <code>COCSPResponse</code> derives

			from <code>CSignedObject</code>.

	 */

		{

		if (aCert.PublicKey().AlgorithmId() == EDSA)

			{

			TX509KeyFactory factory;

			CDSAParameters* theDSAParams = factory.DSAParametersL(aCert.PublicKey().EncodedParams());

			CleanupStack::PushL(theDSAParams);

			CSigningKeyParameters* params = CSigningKeyParameters::NewLC();

			params->SetDSAParamsL(*theDSAParams);

			aResponse->SetParametersL(*params);

			CleanupStack::PopAndDestroy(2, theDSAParams);

			}

		return aResponse->VerifySignatureL(aCert.PublicKey().KeyData());

		}

	TBool DoesCertHaveOCSPNoCheckExt(const CX509Certificate& aCert)

	/**

		Test whether the supplied certificate has id-pkix-ocsp-nocheck

		in an extendedKeyUsage extension.  

		@param	aCert		Certificate to test for id-kp-OCSPSigning.

		@return				ETrue if the supplied certificate has an

							extendedKeyUsage extension which contains

							id-pkix-ocsp-nocheck.

	 */

		{

		return aCert.Extension(KOCSPOidNoCheck) != NULL;

		}

	/**

	 * Determine the URI of the OCSP server to use for a certificate.  Checks to see

	 * if there is an authority info access extension containing an access

	 * description with method oid id-ad-ocsp. If so, it copies the access

	 * description into a new descriptor which it stores in iURI.  Otherwise it

	 * returns iDefaultURI, which may be null.

	 */

	TDesC8* ServerUriL(const CX509Certificate& aCert, const COCSPParameters* aParameters )

		{

		TDesC8* uri = NULL;

		// check whether AIA is present or not:

		// if present and UseAIA is enabled the get the AIA extension.

		// if AIA is absent the else if part will handle it

		// if present and UseAIA is disabled, means that iUseGlobalOCSPUri is enabled,

		// do not leave with an error in this case the next case will handle this condition.

		if( aParameters->UseAIA() && OCSPUtils::IsAIAForOCSPPresentL(aCert) )

			{

			uri = OCSPUtils::GetAIAL(aCert);

			}

		else if( aParameters->DefaultURI() != KNullDesC8())

			{

			uri = aParameters->DefaultURI().AllocL();

			}

		// the extension is absent and iUseGlobalOCSPUri is disabled, it has reached this case

		// where neither is there an AIA in the cert nor is the global ocsp responder available,

		// this should leave with EInvalidURI but this has been done to maintain backward compatibility.

		else

			{

			User::Leave(KErrArgument);

			}

		return uri;

		}

	// check whether AIA is present or not:

	// if present and UseAIA is enabled then return true.

	// if default uri is not null return true.

	TBool IsUriAvailableL(const CX509Certificate& aCert, const COCSPParameters* aParameters )

		{

		return  ( aParameters->UseAIA() && OCSPUtils::IsAIAForOCSPPresentL(aCert) ) || 

				 ( aParameters->DefaultURI() != KNullDesC8() ) ;

		}

	TBool IsAIAForOCSPPresentL(const CX509Certificate& aCert)

		{

		TBool found = EFalse;

		const CX509CertExtension* ext = aCert.Extension(KAuthorityInfoAccess);

		if(ext)

			{

			CX509AuthInfoAccessExt* auth = CX509AuthInfoAccessExt::NewLC(ext->Data());

			for (TInt i = 0 ; i < auth->AccessDescriptions().Count() ; ++i)

				{

				const CX509AccessDescription* desc = auth->AccessDescriptions()[i];

				if (desc->Method() == KAccessMethodOCSP && desc->Location().Tag() == EX509URI )

					{

					found = ETrue;

					break;

					}

				} // end of for

			CleanupStack::PopAndDestroy(auth);

			}

		return found;

		}

	TDesC8* GetAIAL(const CX509Certificate& aCert)

		{

		TDesC8*	uri = NULL;

		const CX509CertExtension* ext = aCert.Extension(KAuthorityInfoAccess);

		if (ext)

			{

			CX509AuthInfoAccessExt* auth = CX509AuthInfoAccessExt::NewLC(ext->Data());

			for (TInt i = 0 ; i < auth->AccessDescriptions().Count() ; ++i)

				{

				const CX509AccessDescription* desc = auth->AccessDescriptions()[i];

				if (desc->Method() == KAccessMethodOCSP)

					{

					const CX509GeneralName& gn = desc->Location();

					if (gn.Tag() == EX509URI)

						{

						// Decode the general name rather than using CX509IPBaseURI, 

						// as this currently rejects some URIs

						TASN1DecIA5String encStr;

						TInt pos = 0;

						HBufC* suri = encStr.DecodeDERL(gn.Data(), pos);

						CleanupStack::PushL(suri);

						HBufC8* buf = HBufC8::NewL(suri->Length());

						uri = buf;

						buf->Des().Copy(*suri);

						CleanupStack::PopAndDestroy(suri);

						break;

						}

					}

				}

			CleanupStack::PopAndDestroy(auth);

			}

		return uri;

		}

	/**

		Test whether the supplied certificate has id-kp-OCSPSigning

		in an extendedKeyUsage extension.  This tests whether the

		certificate is a trusted responder, as defined in RFC 2560 S4.2.2.2.

		@param	aCert			Certificate to test for id-kp-OCSPSigning.

								This should be the certificate which was

								immediately signed by the CA which issued

								the certificate in question.

		@return					ETrue iff the supplied certificate has an

								extendedKeyUsage extension which contains

								id-kp-OCSPSigning.

	*/

	TBool DoesCertHaveOCSPSigningExtL(const CX509Certificate& aCert)

		{

		TBool found = EFalse;

		// check has extended key usage

		const CX509CertExtension* ekuExt = aCert.Extension(KExtendedKeyUsage);

		if (ekuExt != NULL)

			{	

			// get set of extended key usages

			const TDesC8& extData = ekuExt->Data();

			CX509ExtendedKeyUsageExt* extUses = CX509ExtendedKeyUsageExt::NewLC(extData);

			// check if id-kp-OCSPSigning is one of the uses

			const CArrayPtrFlat<HBufC>& usages = extUses->KeyUsages();

			TInt usageCount = usages.Count();

			for (TInt i = 0; i < usageCount; ++i)

				{

				if (*usages[i] == KOCSPOidOCSPSigning)

					{

					found = ETrue;

					break;

					}

				}

			CleanupStack::PopAndDestroy(extUses);

			}

		return found;

		}

	CX509Certificate* GetResponderCertLC(const TDesC8& aEncodedCerts)

		{

		// This specifies the position of the certificate which is to be retrieved from

		// the encoded certificate chain. As responder certificate would always be the 

		// end entity certificate, here we are retrieving the first one from the chain.

		TInt pos = 0;

		return CX509Certificate::NewLC(aEncodedCerts, pos);

		}

	} // OCSPUtils namespace