// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// Define methods for authorisation scheme based on the CA who issued the certificate
// issues and signs the response.
// 
//

#include "ocsp.h"
#include "panic.h"
#include <pkixcertchain.h>
#include <asn1dec.h>
#include <x509keys.h>
#include <x509cert.h>
#include "ocsprequestandresponse.h"


EXPORT_C COCSPCaDirectAuthorisationScheme* COCSPCaDirectAuthorisationScheme::NewLC()
	{
	COCSPCaDirectAuthorisationScheme* self = new(ELeave) COCSPCaDirectAuthorisationScheme();
	CleanupStack::PushL(self);
	return self;
	}

/**
	Validate the response if it is signed by the CA.  The response can
	optionally contain a copy of the CA's certificate.
*/
void COCSPCaDirectAuthorisationScheme::ValidateL(OCSP::TStatus& aOCSPStatus,
	COCSPResponse& aResponse, const TTime /* aValidationTime */, TRequestStatus& aStatus,
	const COCSPRequest& aRequest)
	{
	TRequestStatus* validatorReqStatus = &aStatus;
	aOCSPStatus = OCSP::EResponseSignatureValidationFailure;

	// the OCSP requests are constructed in
	// COCSPClient::ConstructL that exactly one certificate
	// and its signer are sent in each request.
	// (RFC 2560 S4.1.1 allows multiple pairs)
	
	// check the response is actually signed by the CA
	// this effectively tests the same condition.
	// By assuming there is only one request / response pair,
	// there is no need to iterate through each response, which
	// simplifies this scheme's implementation.

	if (DoValidateL(aRequest, aResponse ))
		{
		aOCSPStatus = OCSP::EValid;
		}
	User::RequestComplete(validatorReqStatus, KErrNone);
	};

/**
	Checks if the response is signed by the CA.
	If the response has a certificate chain, it must contain
	exactly the CA cert.  It is acceptable for the response
	to have no certificate chain.

	The responder ID in the certificate must match the CA cert,
	and the whole response must be signed by the CA cert's signer.
*/
TBool COCSPCaDirectAuthorisationScheme::DoValidateL(
	const COCSPRequest& aRequest, COCSPResponse& aResponse)
{
	// check the response contains either zero or one certificates.
	// If the response contains a certificate, then it must be the
	// same as the CA.

	// get the intermediate which signed the EE
	const CX509Certificate& caCert = aRequest.CertInfo(0).Issuer();
	
	// Retrieves the chain from the response of the responder certificate
	// whic signed the response.
	const TPtrC8* certChainData = aResponse.DataElementEncoding(COCSPResponse::ECertificateChain);
	if (certChainData != 0)
		{
		if (! CertChainMatchesCertL(*certChainData, caCert))
			return EFalse;
		}

	return
			OCSPUtils::DoesResponderIdMatchCertL(aResponse, caCert)
		&&	OCSPUtils::IsResponseSignedByCertL(&aResponse, caCert);
}

/**
	Checks whether the encoded cert chain contains exactly
	one cert which matches the supplied cert.

	This is used to verify that, when a cert chain is sent with
	the response, it contains exactly the CA cert.

	@param	aCertChainData	DER-encoded certificate chain data
							extracted from response.
	@param	aCert			Certificate to look for.
	@return					ETrue if the certificate chain contains
							exactly one response which matches
							aCert; EFalse otherwise.
 */
TBool COCSPCaDirectAuthorisationScheme::CertChainMatchesCertL(
	const TDesC8& aCertChainData, const CX509Certificate& aCert)
	{
	// here we cannot assume that the response contains only the CA certificate,
	// which signed the response as that can be a subordinate CA, so the chain
	// can be like RCA(root CA) -> ICA(intermediate CA) -> SCA (sub-ordinate CA)
	// we need to retrieve the SCA for this verification.
	CX509Certificate* respCert = OCSPUtils::GetResponderCertLC(aCertChainData);
	TBool match = aCert.IsEqualL(*respCert);
	CleanupStack::PopAndDestroy(respCert);
	return match;
	}

/**
	This is a no-op because this implementation is not an
	active object.
 */
void COCSPCaDirectAuthorisationScheme::CancelValidate()
	{}

const CX509Certificate* COCSPCaDirectAuthorisationScheme::ResponderCert() const	
	{
	return NULL;
	}