// Copyright (c) 2001-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// Define methods for authorisation scheme based on locally configured
// authoritive root certs
// 
//

#include "ocsp.h"
#include "panic.h"
#include <pkixcertchain.h>
#include <asn1dec.h>
#include <x509keys.h>
#include <x509cert.h>
#include <mcertstore.h>
#include <ccertattributefilter.h>
#include "ocsprequestandresponse.h"

EXPORT_C COCSPDirectAuthorisationScheme* COCSPDirectAuthorisationScheme::NewLC(const TUid& aCertStoreUid, MCertStore& aCertStore)
	{
	COCSPDirectAuthorisationScheme* self = new(ELeave) COCSPDirectAuthorisationScheme(aCertStoreUid, aCertStore);
	CleanupStack::PushL(self);
	self->ConstructL();
	return self;
	}

COCSPDirectAuthorisationScheme::COCSPDirectAuthorisationScheme(const TUid& aCertStoreUid, MCertStore& aCertStore) :
	CActive(CActive::EPriorityStandard),
	iCertStoreUid(aCertStoreUid),
	iCertStore(aCertStore)
	{
	CActiveScheduler::Add(this);
	}


COCSPDirectAuthorisationScheme::~COCSPDirectAuthorisationScheme()
	{
	Cancel();
	delete iCertChain;
	delete iPKIXResult; 
	delete iCertFilter;
	delete iEncodedCertBuf;
	delete iEncodedCertPtr;
	iFs.Close();
	iCertStoreEntries.Close();
	delete iResponseCert;
	}


void COCSPDirectAuthorisationScheme::ConstructL()
	{
	iPKIXResult = CPKIXValidationResultBase::NewL();
	
	User::LeaveIfError(iFs.Connect());
	
	iCertFilter = CCertAttributeFilter::NewL();
	iCertFilter->SetOwnerType(ECACertificate);
	iCertFilter->SetUid(iCertStoreUid);
	iCertFilter->SetFormat(EX509Certificate);
	}

/**
 * Starts the process of validating the response.
 * The initial value of the OCSP Status is set to signature validation failure.
 */
void COCSPDirectAuthorisationScheme::ValidateL(OCSP::TStatus& aOCSPStatus,
	COCSPResponse& aResponse, const TTime aValidationTime, TRequestStatus& aStatus,
	const COCSPRequest& aRequest)
	{
	iValidationTime = aValidationTime;

	iClientStatus = &aStatus;
	*iClientStatus = KRequestPending;

	iResponse = &aResponse;
	iRequest = &aRequest;
	
	iOCSPStatus = &aOCSPStatus;
	*iOCSPStatus = OCSP::EResponseSignatureValidationFailure;
	
	// this object needs to be deleted if the same COCSPDirectAuthorisationScheme
	// object is used for validating more than one certificate via COCSPValidator
	delete iCertChain;
	iCertChain = NULL;
		
	StartValidateL();
	}


void COCSPDirectAuthorisationScheme::ValidateFromRoots()
//
// Certs for the chain were not included in the response.
// See if any of the root certs for the given Uid can do the job.
//
	{
	iCertStore.List(iCertStoreEntries, *iCertFilter, iStatus);
	iState = EListCertEntries;
	}

/**
 * If response contains responder's certificate, chain validation would be done till the CA 
 * certificate which should be located in the store.
 */
void COCSPDirectAuthorisationScheme::ValidateCertChainL()
	{
	__ASSERT_DEBUG(iCertChain, Panic(KErrCorrupt));

	iCertChain->ValidateL(*iPKIXResult, iValidationTime, iStatus);
	iState = EValidateCertChain;
	}

TBool COCSPDirectAuthorisationScheme::ValidateSignatureL()
	{
	__ASSERT_DEBUG(iCertChain, Panic(KErrCorrupt));

	// Validate against first cert in chain - must exist
	const CX509Certificate& eeCert = iCertChain->Cert(0);

	return	OCSPUtils::DoesResponderIdMatchCertL(*iResponse, eeCert)
		&&	OCSPUtils::IsResponseSignedByCertL(iResponse, eeCert);
	}

void COCSPDirectAuthorisationScheme::OnValidateCertChainL()
// Called when cert chain validation completes
	{
	if (iPKIXResult->Error().iReason == EValidatedOK)
		{
		if (ValidateSignatureL())
			{
			delete iResponseCert;
			iResponseCert = NULL;
			iResponseCert = CX509Certificate::NewL(iCertChain->Cert(0));
			*iOCSPStatus = OCSP::EValid;
			}
		}
	User::RequestComplete(iClientStatus, KErrNone);
	}
		

void COCSPDirectAuthorisationScheme::OnListCertEntries()
// Called when listing cert store entries completes
	{
	// trigger transitory state to start getting entries
	iCurEntry = -1;
	iState = ERetrieveNext;
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}


void COCSPDirectAuthorisationScheme::OnRetrieveNextL()
// Transitory state to retrieve next entry triggered
	{
	delete iEncodedCertBuf;
	iEncodedCertBuf = 0;
	delete iEncodedCertPtr;
	iEncodedCertPtr = 0;
	if (++iCurEntry < iCertStoreEntries.Count())
	// still more entries, get next one
		{
		CCTCertInfo* certInfo = iCertStoreEntries[iCurEntry];
		ASSERT(certInfo);

		iEncodedCertBuf = HBufC8::NewL(certInfo->Size());
		iEncodedCertPtr = new(ELeave) TPtr8(iEncodedCertBuf->Des());

		iCertStore.Retrieve(*certInfo, *iEncodedCertPtr, iStatus);
		
		iState = ERetrievingEntry;
		
		SetActive();
		}
	else
	// no more entries, bad news
		{
		User::RequestComplete(iClientStatus, KErrNone);
		}
	}

void COCSPDirectAuthorisationScheme::OnRetrievingEntryL()
// Called when retrieving an entry completes.
	{
	CX509Certificate* cert = CX509Certificate::NewLC(*iEncodedCertPtr);
	
	if (	OCSPUtils::DoesResponderIdMatchCertL(*iResponse, *cert)
		&&	OCSPUtils::IsResponseSignedByCertL(iResponse, *cert)
		&&	cert->ValidityPeriod().Valid(iValidationTime))
	// found a good one, job finished
		{
		delete iResponseCert;
		iResponseCert = NULL;
		CleanupStack::Pop(cert);
		iResponseCert = cert;
		*iOCSPStatus = OCSP::EValid;
		User::RequestComplete(iClientStatus, KErrNone);
		}
	else
	// wasn't good, try next one
		{
		iState = ERetrieveNext;
		TRequestStatus* status = &iStatus;
		User::RequestComplete(status, KErrNone);
		SetActive();
		CleanupStack::PopAndDestroy(cert);
		}
	
	}

void COCSPDirectAuthorisationScheme::RunL()
//
// Handles transitions from one state to the next
//
	{
	User::LeaveIfError(iStatus.Int());

	switch (iState)
		{
	case EValidateCertChain:
		OnValidateCertChainL();
		break;
	case EListCertEntries:
		OnListCertEntries();
		break;
	case ERetrieveNext:
		OnRetrieveNextL();
		break;
	case ERetrievingEntry:
		OnRetrievingEntryL();
		break;
	
	default:
		ASSERT(FALSE);
		}
	}

void COCSPDirectAuthorisationScheme::DoCancel()
//
// Cancel
//
	{
	switch (iState)
		{
	case EValidateCertChain:
		ASSERT(iCertChain);
		iCertChain->CancelValidate();
		break;
	case EListCertEntries:
		iCertStore.CancelList();
		break;
	case ERetrieveNext:
		// nothing to do, this is a transitory state
		break;
	case ERetrievingEntry:
		iCertStore.CancelRetrieve();
		break;
	default:
		ASSERT(FALSE);
		}
	if (iClientStatus)
		{
		User::RequestComplete(iClientStatus, KErrCancel);
		}
	}


TInt COCSPDirectAuthorisationScheme::RunError(TInt aError)
	{
	if(aError == KErrArgument)
		{
		User::RequestComplete(iClientStatus, KErrNone);
		}
	else
		{
		User::RequestComplete(iClientStatus, aError);
		}
	return KErrNone;
	}

/**
 * If the response contains the certificate which signed the response, create the certificate chain
 * till the responder certificate. Otherwise validate directly from root certificates contained 
 * in the store initialized by the client.
 */
void COCSPDirectAuthorisationScheme::StartValidateL()
	{
	const TPtrC8* certChainData = iResponse->DataElementEncoding(COCSPResponse::ECertificateChain);
	
	// Cert chain data was included in response
	if (certChainData)
		{
		iCertChain = CPKIXCertChainBase::NewL(iCertStore, *certChainData, iCertStoreUid);
		ValidateCertChainL();
		}
	else
		{
		// No cert chain in response - validate directly from root certs
		ValidateFromRoots();
		}
	SetActive();
	}

void COCSPDirectAuthorisationScheme::CancelValidate()
	{
	CActive::Cancel();
	}

const CX509Certificate* COCSPDirectAuthorisationScheme::ResponderCert() const	
	{
	return iResponseCert;
	}