1 /*

     2 * Copyright (c) 2010 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description:  Server authentication failure operation in security dialog

    15 *

    16 */

    17 

    18 #include "securitydialogoperserverauthfail.h" // CServerAuthFailOperation

    19 #include "securitydialogoperationobserver.h" // MSecurityDialogOperationObserver

    20 #include "untrustedcertquery.h"         // CUntrustedCertQuery

    21 #include "../../DeviceToken/Inc/TrustedSitesStore.h" // CTrustSitesStore

    22 #include <mctwritablecertstore.h>       // MCTWritableCertStore

    23 #include <unifiedcertstore.h>           // CUnifiedCertStore

    24 #include <cctcertinfo.h>                // CCTCertInfo

    25 #include <x509cert.h>                   // CX509Certificate

    26 #include "securitydialogstrace.h"       // TRACE macro

    27 

    28 const TUid KTrustedSiteCertificatesTokenTypeUid = { 0x101FB66F };

    29 const TInt KMaxCommonNameLength = 64;   // from RFC3280

    30 

    31 

    32 // ======== MEMBER FUNCTIONS ========

    33 

    34 // ---------------------------------------------------------------------------

    35 // CServerAuthFailOperation::NewL()

    36 // ---------------------------------------------------------------------------

    37 //

    38 CServerAuthFailOperation* CServerAuthFailOperation::NewL(

    39         MSecurityDialogOperationObserver& aObserver, const RMessage2& aMessage,

    40         TInt aReplySlot )

    41     {

    42     TRACE( "CServerAuthFailOperation::NewL, aMessage 0x%08x", aMessage.Handle() );

    43     return new( ELeave ) CServerAuthFailOperation( aObserver, aMessage, aReplySlot );

    44     }

    45 

    46 // ---------------------------------------------------------------------------

    47 // CServerAuthFailOperation::~CServerAuthFailOperation()

    48 // ---------------------------------------------------------------------------

    49 //

    50 CServerAuthFailOperation::~CServerAuthFailOperation()

    51     {

    52     TRACE( "CServerAuthFailOperation::~CServerAuthFailOperation, begin" );

    53     Cancel();

    54 

    55     delete iUntrustedCertQuery;

    56     iUntrustedCertQuery = NULL;

    57 

    58     delete iInput;

    59     iInput = NULL;

    60     delete iCertLabel;

    61     iCertLabel = NULL;

    62     delete iServerName;

    63     iServerName = NULL;

    64 

    65     delete iCertStore;

    66     iCertStore = NULL;

    67     iTrustedSiteCertStore = NULL;   // not owned

    68 

    69     delete iCertAttributeFilter;

    70     iCertAttributeFilter = NULL;

    71     delete iRetrievedCertBuffer;

    72     iRetrievedCertBuffer = NULL;

    73 

    74     iCertInfos.Close();

    75     iFs.Close();

    76     TRACE( "CServerAuthFailOperation::~CServerAuthFailOperation, end" );

    77     }

    78 

    79 // ---------------------------------------------------------------------------

    80 // CServerAuthFailOperation::StartL()

    81 // ---------------------------------------------------------------------------

    82 //

    83 void CServerAuthFailOperation::StartL( const TDesC8& aBuffer )

    84     {

    85     TRACE( "CServerAuthFailOperation::StartL, begin" );

    86     __ASSERT_DEBUG( iInput == NULL, User::Invariant() );

    87     iInput = CServerAuthenticationFailureInput::NewL( aBuffer );

    88 

    89     iInput->GetEncodedCert( iEncodedServerCert );

    90 

    91     TPtrC8 serverName;

    92     iInput->GetServerName( serverName );

    93     __ASSERT_DEBUG( iServerName == NULL, User::Invariant() );

    94     iServerName = HBufC::NewL( serverName.Length() );

    95     iServerName->Des().Copy( serverName );

    96     TRACE( "CServerAuthFailOperation::StartL, iServerName=%S", iServerName );

    97 

    98     iAuthFailReason = iInput->FailureReason();

    99     TRACE( "CServerAuthFailOperation::StartL, iAuthFailReason=%d", iAuthFailReason );

   100 

   101     InitializeUnifiedCertStoreL();

   102     // This is async function, processing continues in RunL().

   103     // Basically trusted site certificates are fetched and the

   104     // server certificate is compared to them. If the server

   105     // certificate is already in trusted site cert store, then

   106     // connection is accepted silently. If it is not, then

   107     // untrusted certificate dialog is displayed.

   108     }

   109 

   110 // ---------------------------------------------------------------------------

   111 // CServerAuthFailOperation::CancelOperation()

   112 // ---------------------------------------------------------------------------

   113 //

   114 void CServerAuthFailOperation::CancelOperation()

   115     {

   116     TRACE( "CServerAuthFailOperation::CancelOperation, begin" );

   117     Cancel();

   118     if( iUntrustedCertQuery )

   119         {

   120         TRACE( "CServerAuthFailOperation::CancelOperation, cancelling untrusted query" );

   121         iUntrustedCertQuery->Cancel();

   122         }

   123     if( !iMessage.IsNull() )

   124         {

   125         TRACE( "CServerAuthFailOperation::CancelOperation, completing message 0x%08x",

   126                 iMessage.Handle() );

   127         iMessage.Complete( KErrCancel );

   128         }

   129     TRACE( "CServerAuthFailOperation::CancelOperation, end" );

   130     }

   131 

   132 // ---------------------------------------------------------------------------

   133 // CServerAuthFailOperation::RunL()

   134 // ---------------------------------------------------------------------------

   135 //

   136 void CServerAuthFailOperation::RunL()

   137     {

   138     TRACE( "CServerAuthFailOperation::RunL, iStatus.Int()=%d, iMode=%d",

   139             iStatus.Int(), iMode );

   140     User::LeaveIfError( iStatus.Int() );

   141     switch( iMode )

   142         {

   143         case EInitialiseCertStore:

   144             ProcessServerAuthorizationFailureL();

   145             break;

   146         case EListTrustedSiteCerts:

   147             RetrieveFirstTrustedSiteCertL();

   148             break;

   149         case ERetrieveTrustedSiteCert:

   150             if( IsRetrievedCertSameAsServerCertL() )

   151                 {

   152                 ReturnResultL( EContinue );

   153                 }

   154             else

   155                 {

   156                 RetrieveNextTrustedSiteCertL();

   157                 }

   158             break;

   159         case ESavingServerCert:

   160             SaveServerNameToTrustedSitesStoreL();

   161             ReturnResultL( EContinue );

   162             break;

   163         default:

   164             User::Leave( KErrGeneral );

   165             break;

   166         }

   167     TRACE( "CServerAuthFailOperation::RunL(), end" );

   168     }

   169 

   170 // ---------------------------------------------------------------------------

   171 // CServerAuthFailOperation::DoCancel()

   172 // ---------------------------------------------------------------------------

   173 //

   174 void CServerAuthFailOperation::DoCancel()

   175     {

   176     TRACE( "CServerAuthFailOperation::DoCancel, iMode=%d", iMode );

   177     switch( iMode )

   178         {

   179         case EInitialiseCertStore:

   180             if( iCertStore )

   181                 {

   182                 iCertStore->CancelInitialize();

   183                 }

   184             break;

   185         case EListTrustedSiteCerts:

   186             if( iTrustedSiteCertStore )

   187                 {

   188                 iTrustedSiteCertStore->CancelList();

   189                 }

   190             break;

   191         case ERetrieveTrustedSiteCert:

   192             if( iTrustedSiteCertStore )

   193                 {

   194                 iTrustedSiteCertStore->CancelRetrieve();

   195                 }

   196             break;

   197         case ESavingServerCert:

   198             if( iTrustedSiteCertStore )

   199                 {

   200                 iTrustedSiteCertStore->CancelAdd();

   201                 }

   202             break;

   203         default:

   204             break;

   205         }

   206     TRACE( "CServerAuthFailOperation::DoCancel, end" );

   207     }

   208 

   209 // ---------------------------------------------------------------------------

   210 // CServerAuthFailOperation::CServerAuthFailOperation()

   211 // ---------------------------------------------------------------------------

   212 //

   213 CServerAuthFailOperation::CServerAuthFailOperation(

   214         MSecurityDialogOperationObserver& aObserver, const RMessage2& aMessage,

   215         TInt aReplySlot ) : CSecurityDialogOperation( aObserver, aMessage, aReplySlot )

   216     {

   217     TRACE( "CServerAuthFailOperation::CServerAuthFailOperation" );

   218     }

   219 

   220 // ---------------------------------------------------------------------------

   221 // CServerAuthFailOperation::InitializeUnifiedCertStoreL()

   222 // ---------------------------------------------------------------------------

   223 //

   224 void CServerAuthFailOperation::InitializeUnifiedCertStoreL()

   225     {

   226     TRACE( "CServerAuthFailOperation::InitializeUnifiedCertStoreL" );

   227     User::LeaveIfError( iFs.Connect() );

   228     iCertStore = CUnifiedCertStore::NewL( iFs, ETrue );

   229 

   230     iCertStore->Initialize( iStatus );

   231     iMode = EInitialiseCertStore;

   232     SetActive();

   233     }

   234 

   235 // ---------------------------------------------------------------------------

   236 // CServerAuthFailOperation::ProcessServerAuthorizationFailureL()

   237 // ---------------------------------------------------------------------------

   238 //

   239 void CServerAuthFailOperation::ProcessServerAuthorizationFailureL()

   240     {

   241     TRACE( "CServerAuthFailOperation::ProcessServerAuthorizationFailureL" );

   242     OpenTrustedSiteCertificateStoreL();

   243     if( IsAlreadyTrustedSiteL() )

   244         {

   245         StartFetchingTrustedSiteCertsL();

   246         }

   247     else

   248         {

   249         ShowUntrustedCertificateDialogL();

   250         }

   251     }

   252 

   253 // ---------------------------------------------------------------------------

   254 // CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL()

   255 // ---------------------------------------------------------------------------

   256 //

   257 void CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL()

   258     {

   259     TRACE( "CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL, begin" );

   260     TInt count = iCertStore->WritableCertStoreCount();

   261     for( TInt index = 0; ( index < count ) && !iTrustedSiteCertStore; index++ )

   262         {

   263         MCTWritableCertStore* certstore = &( iCertStore->WritableCertStore( index ) );

   264         TUid tokenTypeUid = certstore->Token().Handle().iTokenTypeUid;

   265         if( tokenTypeUid == KTrustedSiteCertificatesTokenTypeUid )

   266             {

   267             iTrustedSiteCertStore = certstore;

   268             }

   269         }

   270     TRACE( "CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL, store 0x%08x",

   271             iTrustedSiteCertStore );

   272     }

   273 

   274 // ---------------------------------------------------------------------------

   275 // CServerAuthFailOperation::IsAlreadyTrustedSiteL()

   276 // ---------------------------------------------------------------------------

   277 //

   278 TBool CServerAuthFailOperation::IsAlreadyTrustedSiteL()

   279     {

   280     TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, begin" );

   281     TBool isTrustedSite = EFalse;

   282     if( iTrustedSiteCertStore )

   283         {

   284         CTrustSitesStore* trustedSitesStore = CTrustSitesStore::NewL();

   285         CleanupStack::PushL( trustedSitesStore );

   286 

   287         isTrustedSite = trustedSitesStore->IsTrustedSiteL( iEncodedServerCert, *iServerName );

   288         if( isTrustedSite )

   289             {

   290             TBool isExpiredAccepted = trustedSitesStore->IsOutOfDateAllowedL(

   291                     iEncodedServerCert, *iServerName );

   292             TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, isExpiredAccepted=%d",

   293                     isExpiredAccepted );

   294             if( !isExpiredAccepted && iAuthFailReason == EDateOutOfRange )

   295                 {

   296                 TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, not accepted" );

   297                 isTrustedSite = EFalse;

   298                 }

   299             }

   300 

   301         CleanupStack::PopAndDestroy( trustedSitesStore );

   302         }

   303     TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, isTrustedSite=%d", isTrustedSite );

   304     return isTrustedSite;

   305     }

   306 

   307 // ---------------------------------------------------------------------------

   308 // CServerAuthFailOperation::StartFetchingTrustedSiteCertsL()

   309 // ---------------------------------------------------------------------------

   310 //

   311 void CServerAuthFailOperation::StartFetchingTrustedSiteCertsL()

   312     {

   313     TRACE( "CServerAuthFailOperation::StartFetchingTrustedSiteCertsL" );

   314     __ASSERT_DEBUG( iCertAttributeFilter == NULL, User::Invariant() );

   315     iCertAttributeFilter = CCertAttributeFilter::NewL();

   316     iCertAttributeFilter->SetOwnerType( EPeerCertificate );

   317     __ASSERT_DEBUG( iTrustedSiteCertStore != NULL, User::Invariant() );

   318     iTrustedSiteCertStore->List( iCertInfos, *iCertAttributeFilter, iStatus );

   319     iMode = EListTrustedSiteCerts;

   320     SetActive();

   321     }

   322 

   323 // ---------------------------------------------------------------------------

   324 // CServerAuthFailOperation::ShowUntrustedCertificateDialogL()

   325 // ---------------------------------------------------------------------------

   326 //

   327 void CServerAuthFailOperation::ShowUntrustedCertificateDialogL()

   328     {

   329     TRACE( "CServerAuthFailOperation::ShowUntrustedCertificateDialogL, begin" );

   330 

   331     // If trusted site certstore open has failed, then it is not possible to save

   332     // the host name for permanent use. Hence, choice for permanent accept is not

   333     // displayed if trusted site certstore open has failed. Other restrictions for

   334     // permanent accept are defined in device dialog (UntrustedCertificateWidget).

   335     TBool isTrustedSiteCertStoreOpened = ( iTrustedSiteCertStore != NULL );

   336     __ASSERT_DEBUG( iUntrustedCertQuery == NULL, User::Invariant() );

   337     iUntrustedCertQuery = CUntrustedCertQuery::NewL( iAuthFailReason, iEncodedServerCert,

   338             *iServerName, isTrustedSiteCertStoreOpened );

   339 

   340     CUntrustedCertQuery::TResponse response = CUntrustedCertQuery::EQueryRejected;

   341     iUntrustedCertQuery->ShowQueryAndWaitForResponseL( response );

   342     switch( response )

   343         {

   344         case CUntrustedCertQuery::EQueryAccepted:

   345             ReturnResultL( EContinue );

   346             break;

   347         case CUntrustedCertQuery::EQueryAcceptedPermanently:

   348             SaveServerCertToTrustedSiteCertStoreL();

   349             break;

   350         case CUntrustedCertQuery::EQueryRejected:

   351         default:

   352             ReturnResultL( EStop );

   353             break;

   354         }

   355 

   356     TRACE( "CServerAuthFailOperation::ShowUntrustedCertificateDialogL, end" );

   357     }

   358 

   359 // ---------------------------------------------------------------------------

   360 // CServerAuthFailOperation::SaveServerCertToTrustedSiteCertStoreL()

   361 // ---------------------------------------------------------------------------

   362 //

   363 void CServerAuthFailOperation::SaveServerCertToTrustedSiteCertStoreL()

   364     {

   365     TRACE( "CServerAuthFailOperation::SaveServerCertToTrustedSiteCertStoreL" );

   366 

   367     __ASSERT_DEBUG( iCertLabel == NULL, User::Invariant() );

   368     CX509Certificate* serverCert = CX509Certificate::NewLC( iEncodedServerCert );

   369     const CX500DistinguishedName& dName = serverCert->SubjectName();

   370     HBufC* commonName = dName.ExtractFieldL( KX520CommonName );

   371     if( commonName )

   372         {

   373         CleanupStack::PushL( commonName );

   374         TInt commonNameLen = commonName->Length();

   375         if( commonNameLen > 0 && commonNameLen <= KMaxCommonNameLength )

   376             {

   377             iCertLabel = commonName->AllocL();

   378             }

   379         CleanupStack::PopAndDestroy( commonName );

   380         }

   381     CleanupStack::PopAndDestroy( serverCert );

   382 

   383     if( !iCertLabel )

   384         {

   385         iCertLabel = iServerName->AllocL();

   386         }

   387 

   388     iTrustedSiteCertStore->Add( *iCertLabel, EX509Certificate, EPeerCertificate,

   389             NULL, NULL, iEncodedServerCert, iStatus );

   390     iMode = ESavingServerCert;

   391     SetActive();

   392     }

   393 

   394 // ---------------------------------------------------------------------------

   395 // CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL()

   396 // ---------------------------------------------------------------------------

   397 //

   398 void CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL()

   399     {

   400     TRACE( "CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL, begin" );

   401     CTrustSitesStore* trustedSitesStore = CTrustSitesStore::NewL();

   402     CleanupStack::PushL( trustedSitesStore );

   403 

   404     // CTrustSitesStore::AddL() may leave or it may return an error code.

   405     // It leaves if parameters are incorrect, and it returns error code if

   406     // saving fails. Both kinds of errors are handled here in the same way.

   407     TInt err = trustedSitesStore->AddL( iEncodedServerCert, *iServerName );

   408     TRACE( "CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL, err=%d", err );

   409     User::LeaveIfError( err );

   410 

   411     CleanupStack::PopAndDestroy( trustedSitesStore );

   412     }

   413 

   414 // ---------------------------------------------------------------------------

   415 // CServerAuthFailOperation::ReturnResultL()

   416 // ---------------------------------------------------------------------------

   417 //

   418 void CServerAuthFailOperation::ReturnResultL( TServerAuthenticationFailureDialogResult aResult )

   419     {

   420     TRACE( "CServerAuthFailOperation::ReturnResultL, aResult=%d", aResult );

   421     TServerAuthenticationFailureOutputBuf output( aResult );

   422     iMessage.WriteL( iReplySlot, output );

   423     TRACE( "CServerAuthFailOperation::ReturnResultL, completing msg 0x%08x", iMessage.Handle() );

   424     iMessage.Complete( KErrNone );

   425     TRACE( "CServerAuthFailOperation::ReturnResultL, informing observer" );

   426     iObserver.OperationComplete();

   427     TRACE( "CServerAuthFailOperation::ReturnResultL, end" );

   428     }

   429 

   430 // ---------------------------------------------------------------------------

   431 // CServerAuthFailOperation::RetrieveFirstTrustedSiteCertL()

   432 // ---------------------------------------------------------------------------

   433 //

   434 void CServerAuthFailOperation::RetrieveFirstTrustedSiteCertL()

   435     {

   436     TRACE( "CServerAuthFailOperation::RetrieveFirstTrustedSiteCertL" );

   437     __ASSERT_DEBUG( iRetrievedCertBuffer == NULL, User::Invariant() );

   438     iRetrieveCertIndex = 0;

   439 

   440     RetrieveNextTrustedSiteCertL();

   441     }

   442 

   443 // ---------------------------------------------------------------------------

   444 // CServerAuthFailOperation::RetrieveNextTrustedSiteCertL()

   445 // ---------------------------------------------------------------------------

   446 //

   447 void CServerAuthFailOperation::RetrieveNextTrustedSiteCertL()

   448     {

   449     TRACE( "CServerAuthFailOperation::RetrieveNextTrustedSiteCertL" );

   450     if( iRetrieveCertIndex < iCertInfos.Count() )

   451         {

   452         CCTCertInfo& cert = *( iCertInfos[ iRetrieveCertIndex ] );

   453 

   454         if( iRetrievedCertBuffer )

   455             {

   456             delete iRetrievedCertBuffer;

   457             iRetrievedCertBuffer = NULL;

   458             }

   459         iRetrievedCertBuffer = HBufC8::NewL( cert.Size() );

   460         TPtr8 buffer = iRetrievedCertBuffer->Des();

   461 

   462         iTrustedSiteCertStore->Retrieve( cert, buffer, iStatus );

   463         iMode = ERetrieveTrustedSiteCert;

   464         SetActive();

   465         }

   466     else

   467         {

   468         ShowUntrustedCertificateDialogL();

   469         }

   470     }

   471 

   472 // ---------------------------------------------------------------------------

   473 // CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL()

   474 // ---------------------------------------------------------------------------

   475 //

   476 TBool CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL()

   477     {

   478     TRACE( "CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL, begin" );

   479     TBool isSame = EFalse;

   480     CX509Certificate* cert = CX509Certificate::NewLC( *iRetrievedCertBuffer );

   481 

   482     if( !iServerCertFingerprint )

   483         {

   484         CX509Certificate* serverCert = CX509Certificate::NewLC( iEncodedServerCert );

   485         iServerCertFingerprint = serverCert->Fingerprint().AllocL();

   486         CleanupStack::PopAndDestroy( serverCert );

   487         }

   488 

   489     if( cert->Fingerprint() == *iServerCertFingerprint )

   490         {

   491         isSame = ETrue;

   492         }

   493 

   494     CleanupStack::PopAndDestroy( cert );

   495     TRACE( "CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL, isSame=%d", isSame );

   496     return isSame;

   497     }

   498