/*

* Copyright (c) 2003-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

* Provides static PKI-related helper functions 

* (such as building Distinguished Names)

*

*/

#include <x500dn.h>

#include <x509cert.h>

#include <x520ava.h>

#include <utf.h>

#include <x509keys.h>

#include "pkiutil.h"

#include "pkiserviceapi.h"

#include "pkcs10.h"

#include "ikepolparser.h"

HBufC* PkiUtil::CertSubjectNameL(const TDesC8& aCertData)

    {

    CX509Certificate* certificate = CX509Certificate::NewL(aCertData);

    CleanupStack::PushL(certificate);

    CX500DistinguishedName* subjectDn;

    subjectDn = CX500DistinguishedName::NewL(certificate->SubjectName());

    CleanupStack::PushL(subjectDn);

    HBufC* certDn = CertDnL(*subjectDn);

    CleanupStack::PopAndDestroy(2); // subjectDn, certificate

    return certDn;

    }

HBufC* PkiUtil::CertIssuerNameL(const TDesC8& aCertData)

    {

    CX509Certificate* certificate = CX509Certificate::NewL(aCertData);

    CleanupStack::PushL(certificate);

    CX500DistinguishedName* issuerDn;

    issuerDn = CX500DistinguishedName::NewL(certificate->IssuerName());

    CleanupStack::PushL(issuerDn);

    HBufC* certDn = CertDnL(*issuerDn);

    CleanupStack::PopAndDestroy(2); // issuerDn, certificate

    return certDn;

    }

HBufC* PkiUtil::CertDnL(const CX500DistinguishedName& aName)

    {

    TInt count = aName.Count();

    HBufC* certDn = HBufC::NewL(KCertDnSizeIncrement);

    CleanupStack::PushL(certDn);

    for (TInt i = 0; i < count; i++)

        {

        const CX520AttributeTypeAndValue& attribute = aName.Element(i);

        // Unsupported attribute is not appended (KErrNotSupported error)

        TRAPD( err, AppendAttributeL(certDn, attribute) );

        if ( err != KErrNotSupported )

            {

            User::LeaveIfError( err );

            }

        }

    CleanupStack::Pop(); // certDn

    return certDn;

    }

TInt PkiUtil::CertKeySizeL(const TDesC8& aCertData)

    {

    TInt keySize = 0;

    CX509Certificate* certificate = CX509Certificate::NewLC(aCertData);

    const CSubjectPublicKeyInfo& publicKeyInfo = certificate->PublicKey();

    const TPtrC8 keyData = publicKeyInfo.KeyData();

    TX509KeyFactory keyFactory;

    switch(publicKeyInfo.AlgorithmId())

        {

        case ERSA:

            {

            const CRSAPublicKey* keyRSA = keyFactory.RSAPublicKeyL(keyData);

            const TInteger&  n = keyRSA->N();

            keySize = n.BitCount();

            delete keyRSA;

            }

            break;

        case EDSA:

            {

            TPtrC8 params = publicKeyInfo.EncodedParams();

            const CDSAPublicKey* keyDSA =

                keyFactory.DSAPublicKeyL(params, keyData);

            const TInteger& y = keyDSA->Y();

            keySize = y.BitCount();

            delete keyDSA;

            }

            break;

        default:

            User::Leave(KErrNotSupported);

            break;

        }

    CleanupStack::PopAndDestroy(certificate);

    return keySize;

    }

void PkiUtil::AppendAttributeL(HBufC*& aBuf, const CX520AttributeTypeAndValue& aAttribute)

    {

    HBufC* attrName = AttributeTypeToNameL(aAttribute.Type());

    CleanupStack::PushL(attrName);

    HBufC* attrValue = aAttribute.ValueL();

    CleanupStack::PushL(attrValue);

    if ( aBuf->Length() )

        {

        // Append comma if not first attribute

        SmartAppendL(aBuf, KComma);

        }

    SmartAppendL(aBuf, attrName->Des());

    SmartAppendL(aBuf, KEquals);

    SmartAppendL(aBuf, attrValue->Des());

    CleanupStack::PopAndDestroy(2); // attrValue, attrName

    }

/*

   RFC 2253 (Lightweight Directory Access Protocol (v3):

   UTF-8 String Representation of Distinguished Names):

   "If the AttributeType is in a published table of attribute types

   associated with LDAP [4], then the type name string from that table

   is used, otherwise it is encoded as the dotted-decimal encoding of

   the AttributeType's OBJECT IDENTIFIER."

   RFC 2256 (A Summary of the X.500(96) User Schema for use with

   LDAPv3):

   "This document provides an overview of the attribute types and object

   classes defined by the ISO and ITU-T committees in the X.500

   documents, in particular those intended for use by directory

   clients."

   In essence, RFC 2256 lists the most common attribute types and their

   names.

   We choose to provide "user-friendly" name mapping for the following

   attribúte types:

   - countryName

   - organizationName

   - organizationalUnitName

   - localityName

   - stateOrProvinceName

   - commonName

   For other attribute types, we use a string representation of the OID

   as the attribute name.

*/

HBufC* PkiUtil::AttributeTypeToNameL(const TDesC &aType)

    {

    HBufC* name;

    if (aType.Compare(KX520CountryName) == 0)

        {

        name = KC().AllocL();

        }

    else if (aType.Compare(KX520OrganizationName) == 0)

        {

        name = KO().AllocL();

        }

    else if (aType.Compare(KX520OrganizationalUnitName) == 0)

        {

        name = KOU().AllocL();

        }

    else if (aType.Compare(KX520LocalityName) == 0)

        {

        name = KL().AllocL();

        }

    else if (aType.Compare(KX520StateOrProvinceName) == 0)

        {

        name = KST().AllocL();

        }

    else if (aType.Compare(KX520CommonName) == 0)

        {

        name = KCN().AllocL();

        }

    else

        {

        // Use the dotted-decimal encoding

        // of the OID as the attribute name

        name = aType.AllocL();

        }

    return name;

    }

void PkiUtil::SmartAppendL(HBufC*& aBuf, const TDesC& aText)

    {

    // Make sure that we have enough space for the new text

    TInt spaceLeft = aBuf->Des().MaxLength() - aBuf->Des().Length();

    if (aText.Length() > spaceLeft)

        {

        // Allocate enough space for the new text + some additional

        // free space so that allocations are not too frequent

        TInt newMaxLength = aBuf->Des().MaxLength() + aText.Length() + KCertDnSizeIncrement;

        aBuf = aBuf->ReAllocL(newMaxLength);

        }

    aBuf->Des().Append(aText);

    }

TCertStatus PkiUtil::CertStatusL(RPKIServiceAPI& aPkiService, const TDesC8& aTrustedCaDn,

                                 const TDesC8& aSubjectDnSuffix, const TDesC8& aRfc822NameFqdn,

                                 TUint aPrivKeyLength, TInt aCertRenewalThreshold)

    {

    // Try to find a user certificate with the

    // desired properties from the PKI store

    TAny* opContext;

    TRequestStatus status;

    TCertStatus certStatus;

    HBufC8* certData = HBufC8::NewL(KExpectedMaxCertSize);

    HBufC8* subjectNameString;

    _LIT8(KEmptyString, "");

    CleanupStack::PushL(certData);

    TPtr8 certDataPtr = certData->Des();

    aPkiService.ReadCertificateL(aTrustedCaDn, aSubjectDnSuffix, aRfc822NameFqdn, EPKIUserCertificate,

                                 aPrivKeyLength, EPKIRSA, certDataPtr,

                                 &opContext, status);

    User::WaitForRequest(status);

    aPkiService.Finalize(opContext);

    if (status.Int() == KPKIErrBufferTooShort)

        {

        TInt realCertSize;

        aPkiService.GetRequiredBufferSize(realCertSize);

        CleanupStack::PopAndDestroy(); //  certData

        certData = HBufC8::NewL(realCertSize);

        CleanupStack::PushL(certData);

        certDataPtr = certData->Des();

        aPkiService.ReadCertificateL(aTrustedCaDn, aSubjectDnSuffix, aRfc822NameFqdn, EPKIUserCertificate,

                                     aPrivKeyLength, EPKIRSA, certDataPtr,

                                     &opContext, status);

        User::WaitForRequest(status);

        aPkiService.Finalize(opContext);

        }

    // Make sure that the cert, if found, is valid

    if (status.Int() == KErrNone)

        {

        certStatus = PkiUtil::CertStatusL(*certData, aCertRenewalThreshold);

        }

    else //if not found, check wether certificate chain exists

        {

        certStatus = ECertNotFound;

        //checking if certificate chain is found

        CleanupStack::PopAndDestroy(); //  certData

        certData=NULL;

        certData = HBufC8::NewL(KExpectedMaxCertSize);

        CleanupStack::PushL(certData);

        certDataPtr = certData->Des();

        //user certificate

        aPkiService.ReadCertificateL(KEmptyString, aSubjectDnSuffix, aRfc822NameFqdn, EPKIUserCertificate,

                aPrivKeyLength, EPKIRSA, certDataPtr,

                &opContext, status);

        User::WaitForRequest(status);

        aPkiService.Finalize(opContext);

        if (status.Int() == KErrNone)

           {

            certStatus = PkiUtil::CertStatusL(*certData, aCertRenewalThreshold);

           }

        else

           {

           certStatus = ECertNotFound;

           CleanupStack::PopAndDestroy(certData);

           return certStatus;

           }

        //intermediate certificate level 2

        HBufC* issuerName=CertIssuerNameL(*certData);

        CleanupStack::PushL(issuerName);

        subjectNameString=To8BitL(*issuerName);

        CleanupStack::PopAndDestroy(issuerName);

        CleanupStack::PopAndDestroy(certData);

        certData=NULL;

        certData = HBufC8::NewL(KExpectedMaxCertSize);

        CleanupStack::PushL(certData);

        certDataPtr = certData->Des();

        CleanupStack::PushL(subjectNameString);

        aPkiService.ReadCertificateL(KEmptyString, *subjectNameString, aRfc822NameFqdn, EPKICACertificate,

                                    aPrivKeyLength, EPKIRSA, certDataPtr,

                                    &opContext, status);

        User::WaitForRequest(status);

        aPkiService.Finalize(opContext);

        if (status.Int() == KErrNone)

           {

            certStatus = PkiUtil::CertStatusL(*certData, aCertRenewalThreshold);

           }

        else

           {

           certStatus = ECertNotFound;

           CleanupStack::PopAndDestroy(subjectNameString);

           CleanupStack::PopAndDestroy(certData);

           return certStatus;

           }

        if ( subjectNameString->Compare(aTrustedCaDn) !=0 ) //checking if issuer is reached

            {

            //intermediate certificate level 1

            certStatus = ECertNotFound;

            CleanupStack::PopAndDestroy(subjectNameString);

            HBufC* issuerName=CertIssuerNameL(*certData);

            CleanupStack::PushL(issuerName);

            subjectNameString=To8BitL(*issuerName);

            CleanupStack::PopAndDestroy(issuerName);

            CleanupStack::PopAndDestroy(certData);

            certData = HBufC8::NewL(KExpectedMaxCertSize);

            CleanupStack::PushL(certData);

            certDataPtr = certData->Des();

            CleanupStack::PushL(subjectNameString);

            aPkiService.ReadCertificateL(KEmptyString, *subjectNameString, aRfc822NameFqdn, EPKICACertificate,

                                        aPrivKeyLength, EPKIRSA, certDataPtr,

                                        &opContext, status);

            User::WaitForRequest(status);

            aPkiService.Finalize(opContext);

            if (status.Int() == KErrNone)

                {

                certStatus = PkiUtil::CertStatusL(*certData, aCertRenewalThreshold);

                }

            else

                {

                certStatus = ECertNotFound;

                CleanupStack::PopAndDestroy(subjectNameString);

                CleanupStack::PopAndDestroy(certData);

                return certStatus;

                }

            }

        if ( subjectNameString->Compare(aTrustedCaDn) !=0 )  //checking if issuer is reached

            {

             //CA certificate

             certStatus = ECertNotFound;

             CleanupStack::PopAndDestroy(subjectNameString);

             HBufC* issuerName=CertIssuerNameL(*certData);

             CleanupStack::PushL(issuerName);

             subjectNameString=To8BitL(*issuerName);

             CleanupStack::PopAndDestroy(issuerName);

             CleanupStack::PopAndDestroy(certData);

             certData = HBufC8::NewL(KExpectedMaxCertSize);

             CleanupStack::PushL(certData);

             certDataPtr = certData->Des();

             CleanupStack::PushL(subjectNameString);

             aPkiService.ReadCertificateL(KEmptyString, *subjectNameString, aRfc822NameFqdn, EPKICACertificate,

                                          aPrivKeyLength, EPKIRSA, certDataPtr,

                                          &opContext, status);

             User::WaitForRequest(status);

             aPkiService.Finalize(opContext);

             if (status.Int() == KErrNone)

                 {

                 certStatus = PkiUtil::CertStatusL(*certData, aCertRenewalThreshold);

                 }

             CleanupStack::PopAndDestroy(subjectNameString);

             }

        else

             CleanupStack::PopAndDestroy(subjectNameString);

        }

    CleanupStack::PopAndDestroy(certData);

    return certStatus;

    }

TCertStatus PkiUtil::CertStatusL(const TDesC8& aCertData, TInt aCertRenewalThreshold)

    {

    CX509Certificate* certificate = CX509Certificate::NewL(aCertData);

    CleanupStack::PushL(certificate);

    TCertStatus status = CertStatusL(*certificate, aCertRenewalThreshold);

    CleanupStack::PopAndDestroy(certificate);

    return status;

    }

TCertStatus PkiUtil::CertStatusL(const CX509Certificate& aCert, TInt aCertRenewalThreshold)

    {

    TTime validationTime;

    validationTime.UniversalTime();

    TCertStatus certStatus = ECertValid;

    if (aCert.ValidityPeriod().Finish() <= validationTime)

        {

        certStatus = ECertExpired;

        }

    if (aCert.ValidityPeriod().Start() >= validationTime)

        {

        certStatus = ECertNotValidYet;

        }

    // Additional validity check - if a certificate renewal threshold

    // has been specified, it can cause an otherwise valid certificate

    // to be marked as expired. This is determined as follows:

    // - Calculate the entire lifetime of the certificate (entireLifetime)

    // - Calculate the passed lifetime of the certificate (passedLifetime)

    // - Calculate thresholdLifetime as aCertRenewalTreshold % * entireLifetime

    //   (i.e. (aCertRenewalTreshold / 100) * entireLifetime

    // - If passedLifetime > thresholdLifetime --> certificate expired

    if (certStatus == ECertValid && aCertRenewalThreshold >= 0)

        {

        TInt64 entireLifetime = aCert.ValidityPeriod().Finish().Int64() -

                                aCert.ValidityPeriod().Start().Int64();

        TInt64 passedLifetime = validationTime.Int64() -

                                aCert.ValidityPeriod().Start().Int64();

        TInt64 thresholdInPercents(aCertRenewalThreshold);

        TInt64 hundred(100);

        TInt64 tresholdLifetime = (thresholdInPercents * entireLifetime) / hundred;

        if (passedLifetime > tresholdLifetime)

            {

            certStatus = ECertExpired;

            }

        }

    return certStatus;

    }

CX509Certificate* PkiUtil::ReadCertificateLC(RPKIServiceAPI& aPkiService,

                                             const TPKIKeyIdentifier& aKeyId)

    {

    TAny* opContext;

    TRequestStatus status;

    HBufC8* certData = HBufC8::NewL(KExpectedMaxCertSize);

    CleanupStack::PushL(certData);

    TPtr8 certDataPtr = certData->Des();

    aPkiService.ReadCertificateL(aKeyId, certDataPtr,

                                 &opContext,

                                 status);

    User::WaitForRequest(status);

    aPkiService.Finalize(opContext);

    if (status.Int() == KPKIErrBufferTooShort)

        {

        TInt realCertSize;

        aPkiService.GetRequiredBufferSize(realCertSize);

        CleanupStack::PopAndDestroy(); //  certData

        certData = HBufC8::NewL(realCertSize);

        CleanupStack::PushL(certData);

        certDataPtr = certData->Des();

        aPkiService.ReadCertificateL(aKeyId, certDataPtr,

                                     &opContext,

                                     status);