/*

* Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:   PKI store and Certificate verification interface class

*                implementation for IKEv1 plug-in

*

*/

#include <x500dn.h>

#include <x509cert.h>

#include <asn1dec.h>

#include <utf.h>

#include "ikedebug.h"

#include "ikev1pkiservice.h"

#include "utlcrypto.h"

#include "ikecert.h"

#include "ikecaelem.h"

#include "ikepublickey.h"

#include "ikecalist.h"

#include "ikepkiutils.h"

#include "pkcs10.h"

#include "vpnapidefs.h"

#include "pkiutil.h"

#include "ikecertconst.h"

//

// CIkeV1PkiService Class

//

_LIT8(KEmptyString, "");

EXPORT_C CIkeV1PkiService* CIkeV1PkiService::NewL(

    CIkeData*             aIkeData,

    MIkeDebug&            aDebug

)

{

    CIkeV1PkiService* self =

        new (ELeave) CIkeV1PkiService(aIkeData, aDebug);

    CleanupStack::PushL(self);

    self->ConstructL();

    CleanupStack::Pop(self);

    return self;

}

CIkeV1PkiService::CIkeV1PkiService(

    CIkeData*            aIkeData,

    MIkeDebug&           aDebug

) :

    iOperation(KNoOperation),

    iIkeData(aIkeData),

    iCertPtr(NULL, 0),

    iCertBfrSize(2048),

    iDebug(aDebug)

{

}

void CIkeV1PkiService::ConstructL()

{

    User::LeaveIfError(iPkiService.Connect());

    // Set certificate store type to device certificate store,

    // if Own_cert_type is defined as "DEVICE"

    if ( iIkeData->iClientCertType != NULL )

    {

        TPtrC16 certStoreType = iIkeData->iClientCertType->GetData();

        if ( certStoreType.CompareF(_L("DEVICE")) == 0 )

        {

			User::LeaveIfError(iPkiService.SetStoreType(EPkiStoreTypeDevice));            

        }

        else

        {

			User::LeaveIfError(iPkiService.SetStoreType(EPkiStoreTypeUser));                    

        }

    }

    iTrustedCAList   = new (ELeave) CIkeCaList(2);

    iReadCertificate = HBufC8::NewL(iCertBfrSize);

    //The code assumes that these are not NULL.

    //Reallocated, when needed

    iSubjName = HBufC8::NewL(2);

    iRfc822Name = HBufC8::NewL(2);

}

EXPORT_C CIkeV1PkiService::~CIkeV1PkiService()

{

    if ( iApplUidList )

    {

        iApplUidList->Reset();

        delete iApplUidList;

    }

    if ( iCaCertList )

    {

        iCaCertList->Reset();

        delete iCaCertList;

    }

    delete iTrustedCAList;

    iCasTrustedByPeer.Reset();

    iCasTrustedByPeer.Close();

    delete iCaName;

    delete iCa1Name;

    delete iCa2Name;

    delete iReadCertificate;

    delete iSubjName;

    delete iRfc822Name;

    iPkiService.Close();

}

EXPORT_C TBool CIkeV1PkiService::ImportCACertsL(

    CArrayFixFlat<TCertInfo*> *aCAList

)

{

    DEBUG_LOG(_L("-> CIkeV1PkiService::ImportCACertsL"));

    //

    // Build trusted CA certificate list into CIkeV1PkiService object

    // aCAList call parameter array contains the list of trusted CA:s

    // (names in ASCII format).

    // Read corresponding certificate from PKI store and if found,

    // add a new element (=CIkeCaElem) into CIkeCaList

    //

    TBool Status = EFalse;

    if ( aCAList && aCAList->Count() )

    {

        delete iCaName;

        iCaName     = NULL;

        iCaName     = HBufC8::NewL(256);

        iCaNameList = aCAList;

        iCurrIndex  = 0;

        iOperation  = KBuildingCaList;

        Status = GetNextCaElemL();

    }

    return Status;

}

//

// CIkeV1PkiService::ReadCertWithNameL

// This method is used to read a certificate from the PKI store.

// Input parameters:

// -- const TDesC8& Trusted CA name

// -- TBool  aGetCACert

//    ETrue = Read a CA certificate; EFalse read an user certificate

// Output parameters:

// -- X509 certificate into iReadCertificate buffer

//

EXPORT_C TInt CIkeV1PkiService::ReadUserCertWithNameL(

    const TDesC8& aTrustedCaName, CIkeData* aIkeData, TBool aDnType)

{

    iIkeData = aIkeData;

    delete iCaName;

    iCaName = NULL;

    iCaName = HBufC8::NewL(aTrustedCaName.Length());

    iCaName->Des().Copy(aTrustedCaName);

    delete iReadCertificate;

    iReadCertificate=NULL;

    TInt Status = ReadCertificateL(*iCaName, EFalse);

    iUserCertDerType=aDnType;

    return Status;

}

EXPORT_C TInt CIkeV1PkiService::ReadChainL(CIkeData* aIkeData, const HBufC8* aCAName)

{

    iIkeData = aIkeData;

    delete iReadCertificate;

    iReadCertificate=NULL;

    //read own certificate

    TInt Status = ReadCertificateL(KEmptyString, EFalse);

    TInt StatusICA1 = KErrNotFound;

    TInt StatusICA2 = KErrNotFound;

    TInt StatusICA = KErrNotFound;

    if ( Status == KErrNone )

        {

        iReadCertificateOrig = HBufC8::NewL(iReadCertificate->Length());

        TPtr8 iReadCertCopy(iReadCertificateOrig->Des());

        iReadCertCopy.Copy(iReadCertificate->Des());

        delete iCaName;

        iCaName = NULL;

        iCaName =  IkeCert::GetCertificateFieldDERL(iReadCertificate, KIssuerName);

        //Read ICA2

        StatusICA2 = ReadCertificateL(KEmptyString, ETrue);

        if ( StatusICA2 != KErrNone)

            {

            delete iReadCertificateOrig;

            iReadCertificateOrig=NULL;

            return KErrNotFound;

            }

        }

    if ( Status == KErrNone && StatusICA2 == KErrNone)

        {

        delete iCaName;

        iCaName = NULL;

        iCaName =  IkeCert::GetCertificateFieldDERL(iReadCertificate, KIssuerName);

        delete iCa2Name;

        iCa2Name=NULL;

        iCa2Name = GetCertificate();

        CX500DistinguishedName* dn=NULL;

        CX500DistinguishedName* asn1DnNameofICaName = NULL;

        dn = CX500DistinguishedName::NewLC(*aCAName);

        asn1DnNameofICaName = CX500DistinguishedName::NewLC(*iCaName);

        if (  asn1DnNameofICaName->ExactMatchL(*dn)  )

            {

             StatusICA=KErrNone;

             //read ICA1

             StatusICA1 = ReadCertificateL(KEmptyString, ETrue);

             if ( StatusICA1 != KErrNone)

                 {

                 delete iReadCertificateOrig;

                 iReadCertificateOrig=NULL;

                 CleanupStack::PopAndDestroy(asn1DnNameofICaName);

                 asn1DnNameofICaName=NULL;

                 CleanupStack::PopAndDestroy(dn);

                 dn=NULL;

                 return KErrNotFound;

                 }

            }

        else

            {

            StatusICA1 = ReadCertificateL(KEmptyString, ETrue);

            if ( StatusICA1 == KErrNotFound)

                {

                delete iReadCertificateOrig;

                iReadCertificateOrig=NULL;

                CleanupStack::PopAndDestroy(asn1DnNameofICaName);

                asn1DnNameofICaName=NULL;

                CleanupStack::PopAndDestroy(dn);

                dn=NULL;

                return KVpnErrInvalidCaCertFile;

                }

            else

	            StatusICA1=KErrNone;

            }

        CleanupStack::PopAndDestroy(asn1DnNameofICaName);

        asn1DnNameofICaName=NULL;

        CleanupStack::PopAndDestroy(dn);

        dn=NULL;

        }

    if ( Status == KErrNone && StatusICA1 == KErrNone && StatusICA2 == KErrNone)

        {

        if ( StatusICA == KErrNotFound )

           {

           delete iCaName;

           iCaName = NULL;

           iCaName =  IkeCert::GetCertificateFieldDERL(iReadCertificate, KIssuerName);

           }

        delete iCa1Name;

        iCa1Name=NULL;

        iCa1Name = GetCertificate();

        CX500DistinguishedName* dn=NULL;

        CX500DistinguishedName* asn1DnNameofICaName = NULL;

        dn = CX500DistinguishedName::NewLC(*aCAName);

        asn1DnNameofICaName = CX500DistinguishedName::NewLC(*iCaName);

        if ( asn1DnNameofICaName->ExactMatchL(*dn) )

           {

           delete iCaName;

           iCaName=NULL;

           iCaName=HBufC8::NewL(aCAName->Length());

           iCaName->Des().Copy(*aCAName);

           TInt Status = ReadCertificateL(KEmptyString, ETrue);

           delete iCaName;

           iCaName = NULL;

           iCaName =  IkeCert::GetCertificateFieldDERL(iCa2Name, KSubjectName);

           delete iReadCertificate;

           iReadCertificate=iReadCertificateOrig;

           iReadCertificateOrig=NULL;

           CleanupStack::PopAndDestroy(asn1DnNameofICaName);

           asn1DnNameofICaName=NULL;

           CleanupStack::PopAndDestroy(dn);

           dn=NULL;

           if ( Status!=KErrNone )

               return KVpnErrInvalidCaCertFile;

           else    

	           return KErrNone;

           }

        else

           {

           delete iReadCertificate;

           iReadCertificate=iReadCertificateOrig;

           iReadCertificateOrig=NULL;

           delete iReadCertificateOrig; 

           delete iReadCertificate;

           iReadCertificate=NULL;

           CleanupStack::PopAndDestroy(asn1DnNameofICaName);

           asn1DnNameofICaName=NULL;

           CleanupStack::PopAndDestroy(dn);

           dn=NULL;

           return KErrNotFound;

           }

        }

     return KErrNotFound;

}

//

// CIkeV1PkiService::Ikev1SignatureL

// This method is used to compute IKEv1 signature with a specified private key.

// Actually a signature computed happens by referring the related certificate

// when the PKI store produces the signature with corresponding private key.

// Parameters:

// -- const TDesC8& aTrustedAuthority

//    Trusted CA name coded either in ASN1 (DN) format or ASCII format

// -- CIkeData* aHostData

//    Related IKE configuration section. Used to get IdentitySubjectName or

//    Identity Rfc822 Name information for actual PKI service ReadCertificateL

//    method call

// -- const TDesC8& aHashIn

//    Hash data signed (in matter of fact the hash data is simply

//    encrypted with private key)

// Return:

// -- TInt, sign length

//

EXPORT_C TInt CIkeV1PkiService::Ikev1SignatureL(

    const TDesC8&  aTrustedCaName,

    CIkeData*      aIkeData,

    const TDesC8&  aHashIn,

    TDes8&         aSignature

)

{

    iIkeData = aIkeData;

    return ComputeSignatureL(aTrustedCaName, aHashIn, aSignature, EFalse);

}

EXPORT_C CIkeCaList* CIkeV1PkiService::CaList()

{

    return iTrustedCAList;

}

EXPORT_C HBufC8* CIkeV1PkiService::GetCertificate()

{

    HBufC8* Cert = iReadCertificate;

    iReadCertificate = NULL;

    return Cert;

}

EXPORT_C HBufC8* CIkeV1PkiService::GetTrustedCA()

{

    HBufC8* Cert = iCaName;

    iCaName = NULL;

    return Cert;

}

EXPORT_C HBufC8* CIkeV1PkiService::GetTrustedICA1()

{

    HBufC8* Cert = iCa1Name;

    iCa1Name = NULL;

    return Cert;

}

EXPORT_C HBufC8* CIkeV1PkiService::GetTrustedICA2()

{

    HBufC8* Cert = iCa2Name;

    iCa2Name = NULL;

    return Cert;

}

TInt CIkeV1PkiService::ComputeSignatureL(

    const TDesC8&  aTrustedAuthority,

    const TDesC8&  aHashIn,

    TDes8&         aSignature,

    TBool          aRsaSignature

)

{

    DEBUG_LOG(_L("-> CIkeV1PkiService::ComputeSignatureL"));

    TPKIKeyAlgorithm keyAlgorithm = EPKIRSA;

    TUint keySize = InitUserCertIdentDataL();

    HBufC8* Asn1EncodedHash = NULL;

    TPtrC8 hashIn(aHashIn);

    if ( aRsaSignature )

    {

        //

        // Build PKCS1v15 format signature (ASN1 encoded)

        //

        Asn1EncodedHash = IkeCert::BuildPkcs1v15HashL(aHashIn);

        ASSERT( Asn1EncodedHash != NULL );        

        hashIn.Set(Asn1EncodedHash->Des());

    }

    TInt SignLth = 0;

    TInt err = iPkiService.Sign(aTrustedAuthority, *iSubjName, *iRfc822Name,

                                EX509DigitalSignature, keySize,

                                keyAlgorithm, hashIn, aSignature);

    if (err == KErrNone)

    {

        SignLth = aSignature.Length();

    }

    DEBUG_LOG2(_L("Sign returned %d, length=%d"), err, SignLth);

    User::LeaveIfError(err);

    delete Asn1EncodedHash;

    return SignLth;

}

TInt CIkeV1PkiService::ReadCertificateL(

    const TDesC8& aTrustedAuthority, TBool aGetCACert

)

{

    //

    // Read certificate from PKI store using pkiserviceapi

    //

    DEBUG_LOG(

        _L("-> ReadCertificateL(aTrustedAuthority, aGetCACert)")

    );

    TInt Status = KErrNone;

    TPKIKeyAlgorithm keyAlgorithm = EPKIRSA;

    TPKICertificateOwnerType ownerType;

    TUint keySize = 0;

    if (aGetCACert)

    {

        DEBUG_LOG(_L("Reading CA certificate"));

        ownerType = EPKICACertificate;

        //Init CA cert ident data.

        //aTrustedAuthority (issuer) checking for CA certs is not supported.

        if ( aTrustedAuthority.Length() == 0 )

            {

            delete iSubjName;

            iSubjName = NULL;

            iSubjName = iCaName->AllocL();

            iRfc822Name->Des().Zero();

            } 

      }

    else

    {

        DEBUG_LOG(_L("Reading User certificate"));

        ownerType = EPKIUserCertificate;

        keySize = InitUserCertIdentDataL();

    }

    for (;;)    // Only for easy exits...

    {

        if ( iReallocated )

        {

            //

            // Allocate a new buffer for ASN1 coded certificate read from

            // PKI store. Buffer size is now asked from pkiserviceapi

            //

            delete iReadCertificate;

            iReadCertificate = NULL;

            TInt RealCertSize;

            if ( iPkiService.GetRequiredBufferSize(RealCertSize) == KErrNone )

                iCertBfrSize = (RealCertSize | 0x3) + 1;

            // Try double size in error case

            else iCertBfrSize = (iCertBfrSize << 1);

        }

        if ( !iReadCertificate )

        {

            iReadCertificate=NULL;

            iReadCertificate = HBufC8::NewL(iCertBfrSize);

        }

        iCertPtr.Set(iReadCertificate->Des());