/*

* Copyright (c) 2003-2007 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:   Policy importer

*

*/

#include "policyimporter.h"

#include "vpnapiservant.h"

#include "fileutil.h"

#include "policypatcher.h"

#include "policystore.h"

#include "vpnclientuids.h"

#include "vpnmanagerserverdefs.h"

#include "ikepolparser.h"

#include "pkiutil.h"

#include "cmmanagerutils.h"

#include "log_r6.h"

const TInt KDefaultKeySize(1024);

enum TImportState

    {

    EStateBeginPolicyImport = 1,

    EStateImportCaCert,

    EStateAfterImportCaCert,

    EStateImportPeerCert,

    EStateAfterImportPeerCert,

    EStateImportUserPrivKey,

    EStateAfterImportUserPrivKey,

    EStateAttachCertificate,

    EStateAfterAttachCertificate,

    EStateImportPinAndPol,

    EStateCreateVpnDestination,

    };

CPolicyImporter* CPolicyImporter::NewL(const RMessage2& aMessage, CVpnApiServant& aVpnApiServant,

                                       CPolicyStore& aPolicyStore, RFs& aFs)

    {

    LOG_("-> CPolicyImporter::NewL()");

    CPolicyImporter* self = new (ELeave) CPolicyImporter(aMessage, aVpnApiServant, aPolicyStore, aFs);

    CleanupStack::PushL(self);

    self->ConstructL();

    CleanupStack::Pop(); // self

    LOG_("<- CPolicyImporter::NewL()");

    return self;

    }

CPolicyImporter* CPolicyImporter::NewL(TRequestStatus& aStatus, CVpnApiServant& aVpnApiServant,

                                       CPolicyStore& aPolicyStore, RFs& aFs)

    {

    LOG_("-> CPolicyImporter::NewL()");

    CPolicyImporter* self = new (ELeave) CPolicyImporter(aStatus, aVpnApiServant, aPolicyStore, aFs);

    CleanupStack::PushL(self);

    self->ConstructL();

    CleanupStack::Pop(); // self

    LOG_("<- CPolicyImporter::NewL()");

    return self;

    }

CPolicyImporter::CPolicyImporter(const RMessage2& aMessage, CVpnApiServant& aVpnApiServant,

                                 CPolicyStore& aPolicyStore, RFs& aFs) :

    CActive(0), iMessage(aMessage), iVpnApiServant(aVpnApiServant),

    iPolicyStore(aPolicyStore), iFs(aFs), iFileUtil(aFs)

    {

    }

CPolicyImporter::CPolicyImporter(TRequestStatus& aStatus, CVpnApiServant& aVpnApiServant,

                                 CPolicyStore& aPolicyStore, RFs& aFs) :

    CActive(0), iExtStatus(&aStatus), iVpnApiServant(aVpnApiServant),

    iPolicyStore(aPolicyStore), iFs(aFs), iFileUtil(aFs)

    {

    }

void CPolicyImporter::ConstructL()

    {

    CActiveScheduler::Add(this);

    User::LeaveIfError(iPkiService.Connect());

    //Policy importer allow installation of

    //future and expired certificates.

    iPkiService.SetInformational(ETrue);

    }

CPolicyImporter::~CPolicyImporter()

    {

    LOG_("-> CPolicyImporter::~CPolicyImporter()");

    Cancel();

    iPkiService.Close();

    delete iPolicyIdList;

    delete iCurrIkeDataArray;

    delete iCurrCaCertList;

    delete iCurrPeerCertList;

    delete iCurrUserPrivKeyList;

    delete iCurrUserCertList;

    delete iCurrOtherCaCertList;

    delete iCertFileData;

    delete iKeyFileData;

    LOG_("<- CPolicyImporter::~CPolicyImporter()");

    }

TInt CPolicyImporter::RunError(TInt aError)

    {

    LOG_EVENT_2B(R_VPN_MSG_POLICY_INSTALL_FAIL, iNewPolicyId, NULL,

                 aError, iImportSinglePolicy);

    ImportComplete(aError);

    return KErrNone;

    }

void CPolicyImporter::RunL()

    {

    ChangeStateL();

    }

void CPolicyImporter::DoCancel()

    {

    CancelOngoingOperation();

    if (iImportSinglePolicy)

        {

        User::RequestComplete(iExtStatus, KErrCancel);

        }

    else

        {

        iMessage.Complete(KErrCancel);

        }

    CleanImportDirectory();

    }

void CPolicyImporter::GotoState(TInt aState)

    {

    LOG_1("-> CPolicyImporter::GotoState() STATE %d", aState);

    SetNextState(aState);

    SetActive();

    TRequestStatus* status = &iStatus;

    User::RequestComplete(status, KErrNone);

    LOG_("<- CPolicyImporter::GotoState()");

    }

void CPolicyImporter::SetCurrState(TInt aState)

    {

    iCurrState = aState;

    }

void CPolicyImporter::SetNextState(TInt aState)

    {

    iNextState = aState;

    }

TInt CPolicyImporter::CurrState()

    {

    return iCurrState;

    }

TInt CPolicyImporter::NextState()

    {

    return iNextState;

    }

void CPolicyImporter::ChangeStateL()

    {

    switch (NextState())

        {

        case EStateBeginPolicyImport:

            StateBeginPolicyImportL();

            break;

        case EStateImportCaCert:

            StateImportCaCertL();

            break;

        case EStateAfterImportCaCert:

            StateAfterImportCaCertL();

            break;

        case EStateImportPeerCert:

            StateImportPeerCertL();

            break;

        case EStateAfterImportPeerCert:

            StateAfterImportPeerCertL();

            break;

        case EStateImportUserPrivKey:

            StateImportUserPrivKeyL();

            break;

        case EStateAfterImportUserPrivKey:

            StateAfterImportUserPrivKeyL();

            break;

        case EStateAttachCertificate:

            StateAttachCertificateL();

            break;

        case EStateAfterAttachCertificate:

            StateAfterAttachCertificateL();

            break;

        case EStateImportPinAndPol:

            StateImportPinAndPolL();

            break;

        case EStateCreateVpnDestination:

            StateCreateVpnDestinationL();

            break;

        case EStateEndPolicyImport:

            StateEndPolicyImportL();

            break;

        default:

            User::Panic(KVpnManagerServer, EInvalidImportState);

            break;

        }

    }

void CPolicyImporter::CancelOngoingOperation()

    {

    switch (CurrState())

        {

        case EStateImportCaCert:

        case EStateImportPeerCert:

        case EStateImportUserPrivKey:

        case EStateAttachCertificate:

            iPkiService.CancelPendingOperation();

            iPkiService.Finalize(iPkiOpContext);

            break;

        default:

            break;

        }

    }

void CPolicyImporter::ImportComplete(TInt aReturnValue)

    {

    LOG_("-> CPolicyImporter::ImportComplete()");

    if (iImportSinglePolicy)

        {

        User::RequestComplete(iExtStatus, aReturnValue);

        }

    else

        {

        iMessage.Complete(aReturnValue);

        }

    CleanImportDirectory();

    iVpnApiServant.PolicyImportComplete();

    LOG_("<- CPolicyImporter::ImportComplete()");

    }

void CPolicyImporter::ImportPolicyL(const TDesC& aDir)

    {

    LOG_("-> CPolicyImporter::ImportPolicyL()");

    iImportSinglePolicy = EFalse;

    iNewPolicyId = &iPolicyId;

    DoImportPolicyL(aDir);

    LOG_("<- CPolicyImporter::ImportPolicyL()");

    }

void CPolicyImporter::ImportSinglePolicyL(const TDesC& aDir, TVpnPolicyId& aNewPolicyId)

    {

    LOG_("-> CPolicyImporter::ImportSinglePolicyL()");

    iImportSinglePolicy = ETrue;

    iNewPolicyId = &aNewPolicyId;

    DoImportPolicyL(aDir);

    LOG_("<- CPolicyImporter::ImportSinglePolicyL()");

    }

void CPolicyImporter::DoImportPolicyL(const TDesC& aDir)

    {

    LOG_("-> CPolicyImporter::DoImportPolicyL()");

    iImportDir.Copy(aDir);

    iCurrPolicyIdIndex = -1;

    BuildPolicyIdListL();

    if (iPolicyIdList->Count() == 0)

        {

        ImportComplete(KErrNone);

        return;

        }

    if (iImportSinglePolicy && iPolicyIdList->Count() != 1)

        {

        // We're supposed to import a single policy

        // only but the import directory contains

        // multiple policies...

        ImportComplete(KErrArgument);

        return;

        }

    // All is well, so begin import

    GotoState(EStateBeginPolicyImport);

    LOG_("<- CPolicyImporter::DoImportPolicyL()");

    }

void CPolicyImporter::StateBeginPolicyImportL()

    {

    SetCurrState(EStateBeginPolicyImport);

    iCurrPolicyIdIndex++;

    if (iCurrPolicyIdIndex == iPolicyIdList->Count())

        {

        ImportComplete(KErrNone);

        return;

        }

    iCurrPolicyId.Copy(iPolicyIdList->At(iCurrPolicyIdIndex));

    ParseIkeDataL();

    BuildCaCertListL();

    iCurrCaCertIndex = -1;

    BuildPeerCertListL();

    iCurrPeerCertIndex = -1;

    BuildUserPrivKeyAndUserCertListL();

    iCurrUserPrivKeyIndex = -1;

    iCurrUserCertIndex = -1;

    BuildOtherCaCertListL();

    iCurrOtherCaCertIndex=-1;

    GotoState(EStateImportCaCert);

    }

void CPolicyImporter::StateImportCaCertL()

    {

    LOG_("CPolicyImporter::StateImportCaCertL() entry");

    SetCurrState(EStateImportCaCert);

    iCurrCaCertIndex++;

    if (iCurrCaCertIndex == iCurrCaCertList->Count())

        {

        GotoState(EStateImportPeerCert);

        LOG_("CPolicyImporter::StateImportCaCertL() exit (all CA certs imported)");

        return;

        }

    delete iCertFileData;

    iCertFileData = NULL;

    iCertFileData = iFileUtil.LoadFileDataL(iCurrCaCertList->At(iCurrCaCertIndex));

    iPkiService.StoreCertificateL(EPKICACertificate, KDefaultKeySize, EPKIRSA, *iCertFileData,

                                  &iPkiOpContext, iStatus);

    SetNextState(EStateAfterImportCaCert);

    SetActive();

    LOG_("CPolicyImporter::StateImportCaCertL() exit");

    }

void CPolicyImporter::StateAfterImportCaCertL()

    {

    SetCurrState(EStateAfterImportCaCert);

    iPkiService.Finalize(iPkiOpContext);

    if (iStatus == KErrArgument)

        {

        User::Leave(KVpnErrInvalidCaCertFile);

        }

    else if (iStatus != KErrNone)

        {

        User::Leave(iStatus.Int());

        }

    // Set VPN trusted

    CX509Certificate* tempCert = CX509Certificate::NewLC(*iCertFileData);

    RArray<TUid> appArray;

    CleanupClosePushL(appArray);

    appArray.AppendL(TUid::Uid(KUidVpnManager));

    const TPtrC8* serialNumber = tempCert->DataElementEncoding(

        CX509Certificate::ESerialNumber);

    const TPtrC8* issuername = tempCert->DataElementEncoding(

        CX509Certificate::EIssuerName);

    iPkiService.SetApplicabilityL(

        *issuername,

        *serialNumber,

        appArray);

    CleanupStack::PopAndDestroy(2); // appArray, tempCert

    // Handle the next certificate, if present

    GotoState(EStateImportCaCert);

    }

void CPolicyImporter::StateImportPeerCertL()

    {

    LOG_("CPolicyImporter::StateImportOtherCaCertL() entry");

    SetCurrState(EStateImportPeerCert);

    iCurrOtherCaCertIndex++;

    if (iCurrOtherCaCertIndex == iCurrOtherCaCertList->Count())

        {

        GotoState(EStateImportUserPrivKey);

        LOG_("CPolicyImporter::StateImportOtherCaCertL() exit (all intermediate CAs imported)");

        return;

        }

    delete iCertFileData;

    iCertFileData = NULL;

    iCertFileData = iFileUtil.LoadFileDataL(iCurrOtherCaCertList->At(iCurrOtherCaCertIndex));

    CIkeData* data = iCurrIkeDataArray->At(iCurrIkeDataIndex);

    TPkiServiceStoreType storeType = GetStoreTypeL(data);

    iPkiService.SetStoreType(storeType);

    iPkiService.StoreCertificateL(EPKICACertificate, KDefaultKeySize, EPKIRSA, *iCertFileData,

                                  &iPkiOpContext, iStatus);

    SetNextState(EStateAfterImportPeerCert);

    SetActive();

    LOG_("CPolicyImporter::StateImportOtherCACertL() exit");

    }

void CPolicyImporter::StateAfterImportPeerCertL()

    {

    SetCurrState(EStateAfterImportPeerCert);

    iPkiService.Finalize(iPkiOpContext);

    if (iStatus != KErrNone)

        {

        User::Leave(iStatus.Int());

        }

    // Handle the next certificate, if present

    GotoState(EStateImportPeerCert);

    }

TPkiServiceStoreType CPolicyImporter::GetStoreTypeL(CIkeData* aData)

    {

    TPkiServiceStoreType ret(EPkiStoreTypeAny);

    if (aData->iClientCertType)

        {

        HBufC8* storename = aData->iClientCertType->GetAsciiDataL();

        CleanupStack::PushL(storename);

        LOG(Log::Printf(_L8("CPolicyImporter::BuildPeerCertListL() Store type defined in policy: %S\n"), &(*storename)));

        if (storename->Compare(_L8("DEVICE")) == 0)

            {

            LOG_("CPolicyImporter::BuildPeerCertListL() Policy uses DEVICE store\n");

            ret = EPkiStoreTypeDevice;

            }

        else

            {

            LOG_("CPolicyImporter::BuildPeerCertListL() Policy uses USER store\n");

            ret = EPkiStoreTypeUser;

            }

        CleanupStack::PopAndDestroy(storename);

        }

    else

        {

        LOG_("CPolicyImporter::GetStoreType() No store type specified in policy");

        }

    return ret;

    }

void CPolicyImporter::StateImportUserPrivKeyL()

    {

    LOG_("CPolicyImporter::StateImportUserPrivKeyL() entry");

    SetCurrState(EStateImportUserPrivKey);

    iCurrUserPrivKeyIndex++;

    if (iCurrUserPrivKeyIndex == iCurrUserPrivKeyList->Count())

        {

        GotoState(EStateImportPinAndPol);

        LOG_("CPolicyImporter::StateImportUserPrivKeyL() exit (all keys imported)");

        return;

        }

    delete iKeyFileData;

    iKeyFileData = NULL;

    iKeyFileData = iFileUtil.LoadFileDataL(iCurrUserPrivKeyList->At(iCurrUserPrivKeyIndex));

    CIkeData* data = iCurrIkeDataArray->At(iCurrIkeDataIndex);

    TPkiServiceStoreType storeType = GetStoreTypeL(data);

    iPkiService.SetStoreType(storeType);

    iPkiService.StoreKeypair(iCurrKeyId, *iKeyFileData, iStatus);

    SetNextState(EStateAfterImportUserPrivKey);

    SetActive();

    LOG_("CPolicyImporter::StateImportUserPrivKeyL() exit");

    }

void CPolicyImporter::StateAfterImportUserPrivKeyL()

    {

    SetCurrState(EStateAfterImportUserPrivKey);

    if (iStatus == KErrArgument || iStatus == KErrNotSupported)

        {

        User::Leave(KVpnErrInvalidUserPrivKeyFile);

        }

    else if (iStatus != KErrNone)

        {

        User::Leave(iStatus.Int());

        }

    // Attach user certificates to the imported private key

    iCurrIkeDataIndex = -1;

    GotoState(EStateAttachCertificate);