// Copyright (c) 2003-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// requestencoder.cpp
// Implementation for OCSP response decoder object.
// See RFC2560 S4.2.1 for response specification.
// 
//

#include "responsedecoder.h"
#include "oids.h"
#include <ocsp.h>
#include <asn1dec.h>
#include <x509cert.h>
#include "ocsprequestandresponse.h"

// Enum values in DER encoding of response status
enum
	{
	ESuccessfulEncoding = 0,
	EMalformedRequestEncoding = 1,
	EInternalErrorEncoding = 2,
	ETryLaterEncoding = 3,
	ESigRequiredEncoding = 5,
	EUnauthorisedEncoding = 6
	};


// Tag values in DER encoded response data
const TUint KResponseBytesTag = 0;
const TUint KCertificatesTag = 0;

/** Version tag number in ResponseData, RFC2560, S4.2.1. */
const TUint KOcspResponseVersionTag = 0;

/**
	Supported OCSP response Version, RFC2560, S4.2.1.
	This is the integer value in Version, which means response
	format version 1.
 */
const TUint KOcspResponseVersion1 = 0;

const TUint KResponderIDNameTag = 1;
const TUint KResponderIDKeyHashTag = 2;
const TUint KResponseExtensionsTag = 1;


COCSPResponseDecoder* COCSPResponseDecoder::NewL(const TDesC8& aEncoding)
	{
	COCSPResponseDecoder* self = new (ELeave) COCSPResponseDecoder;
	CleanupStack::PushL(self);
	self->ConstructL(aEncoding);
	CleanupStack::Pop(self);
	return self;
	}


COCSPResponseDecoder::COCSPResponseDecoder()
	{
	}


COCSPResponseDecoder::~COCSPResponseDecoder()
	{
	delete iResponse;
	}


void COCSPResponseDecoder::ConstructL(const TDesC8& aEncoding)
	{
	iResponse = new (ELeave) COCSPResponse;
	
	// Populate CSignedObject data members
	iResponse->iKeyFactory = new (ELeave) TX509KeyFactory; // Unconventional class name
	iResponse->iEncoding = aEncoding.AllocL();
	
	TRAPD(error, DecodeOCSPResponseL(aEncoding));
	if (error == KErrArgument || error == KErrNotSupported)
		{
		// These arise from problems parsing the data in X509 or ASN1
		error = OCSP::EMalformedResponse;
		}
	
	if (error != KErrNone)
		{
		// Errors and our status codes go back to the client
		delete iResponse;
		iResponse = NULL;
		User::Leave(error);
		}
	}


COCSPResponse* COCSPResponseDecoder::TakeResponse()
	{
	COCSPResponse* result = iResponse;
	iResponse = NULL;
	return result;
	}


CArrayPtr<TASN1DecGeneric>* COCSPResponseDecoder::DecodeSequenceLC(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = NULL;
	
	// Check we've got a sequence
	TASN1DecGeneric decGen(aEncoding);
	decGen.InitL();
	if (decGen.Tag() != EASN1Sequence)
		{
		User::Leave(KErrArgument);
		}
	else
		{
		// Decode the sequence		
		TASN1DecSequence decSeq;
		items = decSeq.DecodeDERLC(decGen);
		}
	return items;
	}


CArrayPtr<TASN1DecGeneric>* COCSPResponseDecoder::DecodeSequenceLC(const TDesC8& aEncoding,
															const TInt aMinTerms,
															const TInt aMaxTerms)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding);
	TInt count = items->Count();
	if (count < aMinTerms || count > aMaxTerms)
		{
		User::Leave(KErrArgument);
		}

	return items;
	}


void COCSPResponseDecoder::DecodeOCSPResponseL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 1, 2);
	
	// Use integer decoding for enumerated
	TASN1DecInteger decInt;
	TInt status = decInt.DecodeDERShortL(*items->At(0));
	if (status == ESuccessfulEncoding)
		{
		if (items->Count() != 2)
			{
			User::Leave(OCSP::EMalformedResponse);
			}
		
		// Check tag on second part is [0]
		// We ignore any other parts in the sequence after that
		TASN1DecGeneric& responseBytesDec = *items->At(1);
		if (responseBytesDec.Tag() != KResponseBytesTag)
			{
			User::Leave(OCSP::EMalformedResponse);
			}
		
		// It's OK, so decode the response bytes object therein
		DecodeResponseBytesL(responseBytesDec.GetContentDER());
		}
	else
		{
		if (items->Count() != 1)
			{
			User::Leave(KErrArgument);
			}
		
		switch (status)
			{
			case EMalformedRequestEncoding:
				User::Leave(OCSP::EMalformedRequest);
			case EInternalErrorEncoding:
				User::Leave(OCSP::EServerInternalError);
				break;
			case ETryLaterEncoding:
				User::Leave(OCSP::ETryLater);
				break;
			case ESigRequiredEncoding:
				User::Leave(OCSP::ESignatureRequired);
				break;
			case EUnauthorisedEncoding:
				User::Leave(OCSP::EClientUnauthorised);
				break;
			default:
				User::Leave(OCSP::EMalformedResponse);
			}
		}
		CleanupStack::PopAndDestroy(); // items
	}


void COCSPResponseDecoder::DecodeResponseBytesL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 2, 2);

	TASN1DecObjectIdentifier decOid;
	HBufC* oid = decOid.DecodeDERL(*items->At(0));
	CleanupStack::PushL(oid);
	if (*oid != KOCSPOidBasic)
		{
		User::Leave(OCSP::EUnknownResponseType);
		}

	TASN1DecGeneric& response = *items->At(1);
	if (response.Tag() != EASN1OctetString)
		{
		User::Leave(OCSP::EMalformedResponse);
		}

	DecodeBasicOCSPResponseL(response.GetContentDER());

	CleanupStack::PopAndDestroy(2); // oid, items
	}


void COCSPResponseDecoder::DecodeBasicOCSPResponseL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 3, 4);

	// First, the ResponseData object
	DecodeResponseDataL(items->At(0)->Encoding());

	// Continue, with the AlgorithmIdentifier
	iResponse->iSigningAlgorithm = CX509SigningAlgorithmIdentifier::NewL(items->At(1)->Encoding());
	
	// Now move on to the signature
	TASN1DecBitString encBS;
	iResponse->iSignature = encBS.ExtractOctetStringL(*items->At(2));
	
	// And finally, the certs (if they're there)
	if (items->Count() == 4)
		{
		// Check explicit tag [0]
		TASN1DecGeneric& certsDec = *items->At(3);
		if (certsDec.Tag() != KCertificatesTag)
			{
			User::Leave(OCSP::EMalformedResponse);
			}
		
		// It's OK, so decode the response bytes object therein
		DecodeCertificatesL(certsDec.GetContentDER());
		}

	CleanupStack::PopAndDestroy(); // Cleans up items
	}


void COCSPResponseDecoder::DecodeCertificatesL(const TDesC8& aEncoding)
	{
	TASN1DecGeneric dec(aEncoding);
	dec.InitL();
	if (dec.Tag() != EASN1Sequence)
		{
		User::Leave(OCSP::EMalformedResponse);
		}
	
	// Just stores a reference to the encoding
	iResponse->iSigningCerts.Set(dec.GetContentDER());
	}


void COCSPResponseDecoder::DecodeResponseDataL(const TDesC8& aEncoding)
	{
	// This is the signed data
	iResponse->iSignedData.Set(aEncoding);
	
	// version and responseExtensions are optional
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 3, 5);
	
	TInt seqIndex = 0;		// index of currently-parsed item
	TASN1DecGeneric& item0 = *items->At(0);
	
	// If a version number is supplied, it must be the default version, v1,
	// which is encoded as an integer with value zero.  (The version should
	// not be sent at all if it has the default value - S11.5, ITU-Y X.690
	// (07/2002) ASN.1 encoding rules - but some servers can still send it.)
	if (item0.Class() == EContextSpecific && item0.Tag() == KOcspResponseVersionTag)
		{
		TASN1DecGeneric vDecGen(item0.GetContentDER());
		vDecGen.InitL();
		if (!(vDecGen.Class() == EUniversal && vDecGen.Tag() == EASN1Integer))
			{
			User::Leave(OCSP::EMalformedResponse);
			}
		
		TASN1DecInteger vDecInt;
		TInt version = vDecInt.DecodeDERShortL(vDecGen);
		if (version != KOcspResponseVersion1)
			{
			User::Leave(OCSP::EMalformedResponse);
			}
		++seqIndex;
		}
	
	TASN1DecGeneric& respIdDecGen = *items->At(seqIndex++);
	switch (respIdDecGen.Tag())
		{
		case KResponderIDNameTag:
			// Set to Name DER encoding
			iResponse->iResponderIDName.Set(respIdDecGen.GetContentDER());
			break;
		case KResponderIDKeyHashTag:
			{
			// Set to KeyHash to value within the octet string
			TASN1DecGeneric keyHashDecGen(respIdDecGen.GetContentDER());
			keyHashDecGen.InitL();
			iResponse->iResponderIDKeyHash.Set(keyHashDecGen.GetContentDER());
			break;
			}
		default:
			User::Leave(OCSP::EMalformedResponse);
		}
	
	
	// ProducedAt is a GeneralizedTime
	TASN1DecGeneralizedTime decGT;
	iResponse->iProducedAt = decGT.DecodeDERL(*items->At(seqIndex++));
	
	// Now the responses themselves
	DecodeResponsesL(items->At(seqIndex++)->Encoding());
	
	// Continue if extensions exist
	if (seqIndex < items->Count())
		{
		// Check tag on responseExtensions
		TASN1DecGeneric& extDecGen = *items->At(seqIndex++);
		if (extDecGen.Tag() != KResponseExtensionsTag)
			{
			User::Leave(OCSP::EMalformedResponse);
			}
		
		DecodeResponseExtensionsL(extDecGen.GetContentDER());
		}
	CleanupStack::PopAndDestroy(items);
	}


void COCSPResponseDecoder::DecodeResponseExtensionsL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding);
	TInt count = items->Count();
	for (TInt index = 0; index < count; ++index)
		{
		DecodeResponseExtensionL(items->At(index)->Encoding());
		}
	
	CleanupStack::PopAndDestroy(); // items
	}


void COCSPResponseDecoder::DecodeResponseExtensionL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 2, 3);
	
	// Get oid
	TASN1DecGeneric& oid = *items->At(0);
	if (oid.Tag() != EASN1ObjectIdentifier)
		{
		User::Leave(OCSP::EMalformedResponse);
		}
	
	TASN1DecObjectIdentifier oidDec;
	HBufC* oidVal = oidDec.DecodeDERL(oid);
	CleanupStack::PushL(oidVal);
	
	TBool critical = EFalse; // Default value of critical flag
	if (items->Count() == 3)
		{
		// The critical flag is specified - what does it say?
		TASN1DecBoolean decBool;
		critical = decBool.DecodeDERL(*items->At(1));
		}
	
	TASN1DecGeneric& extnVal = items->Count() == 3 ? *items->At(2) : *items->At(1);
	if (extnVal.Tag() != EASN1OctetString)
		{
		User::Leave(OCSP::EMalformedResponse);
		}
	
	// Check oid to decide what to do
	if (*oidVal == KOCSPOidNonce)
		{
		iResponse->iNonce.Set(extnVal.GetContentDER());
		}
	else if (*oidVal == KOCSPOidArchiveCutoff)
		{
		TASN1DecGeneralizedTime decGT;
		TInt pos = 0;
		iResponse->iArchiveCutoff = new (ELeave) TTime(decGT.DecodeDERL(extnVal.GetContentDER(), pos));
		}
	else if (critical)
		{
		// Didn't understand extension, and it was critical!  Erk!
		User::Leave(OCSP::EUnknownCriticalExtension);
		}
	
	CleanupStack::PopAndDestroy(2); // oidVal, items
	}


void COCSPResponseDecoder::DecodeResponsesL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding);
	TInt count = items->Count();
	for (TInt index = 0; index < count; ++index)
		{
		DecodeSingleResponseL(items->At(index)->Encoding());
		}

	CleanupStack::PopAndDestroy(); // items
	}


void COCSPResponseDecoder::DecodeSingleResponseL(const TDesC8& aEncoding)
	{
	CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 3, 5);

	COCSPResponseCertInfo* response = COCSPResponseCertInfo::NewLC(*items);
	User::LeaveIfError(iResponse->iCertInfos.Append(response));
	CleanupStack::Pop(response); // Now owned through iSingleResponses

	CleanupStack::PopAndDestroy(); // Clean up items
	}