/*

* Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

* X509CERTEXT.H

* X509 extensions v2

* Common specific extensions:

* 1)	basic constraints

* 2)	alt name

* 3)	key usage

* 4)	name constraints

* 5)	policy constraints

* 6)	policies

* 7)	policy mapping

* 8)	authority key ID

* 9)	subject key ID

* 10)	extended key usage

* 11)	authority information access

* critical extension

* 12)   inhibit-any policy 

*

*/

/**

 @file 

 @publishedAll

 @released

*/

#if !defined (__X509CERTEXT_H__)

#define __X509CERTEXT_H__

#include <e32base.h>

#include <e32std.h>

#include <x509gn.h>

#ifndef SYMBIAN_ENABLE_SPLIT_HEADERS

#include <x509bitstring.h>

#endif

class RReadStream;

class RWriteStream;

class CX509BitString;

/** A list of values that defines what an X.509 key can be used for.

* These values can be ANDed together if a key has several usages. 

* 

* @since v7.0 */

enum TX509KeyUsage

	{

	/** A digital signature. */

	EX509DigitalSignature,

	/** Non repudiation. */

	EX509NonRepudiation,

	/** Key encipherment. */

	EX509KeyEncipherment,

	/** Data encipherment. */

	EX509DataEncipherment,

	/** Key agreement. */

	EX509KeyAgreement,

	/** Key certificate sign. */

	EX509KeyCertSign,

	/** CRL sign. */

	EX509CRLSign,

	/** Encipher only. */

	EX509EncipherOnly,

	/** Decipher only. */

	EX509DecipherOnly

	};

/** X509 Extension OIDs

* 

* @since v9.5 */

//OIDS for the extensions we define here...

_LIT(KBasicConstraints,"2.5.29.19");

_LIT(KSubjectAltName,"2.5.29.17");

_LIT(KIssuerAltName,"2.5.29.18");

_LIT(KKeyUsage,"2.5.29.15");

_LIT(KNameConstraints,"2.5.29.30");

_LIT(KPolicyConstraints,"2.5.29.36");

_LIT(KCertPolicies,"2.5.29.32");

_LIT(KPolicyMapping,"2.5.29.33");

_LIT(KAuthorityKeyId,"2.5.29.35");

_LIT(KSubjectKeyId,"2.5.29.14");

_LIT(KExtendedKeyUsage,"2.5.29.37");

_LIT(KAuthorityInfoAccess, "1.3.6.1.5.5.7.1.1");

_LIT(KInhibitAnyPolicy, "2.5.29.54");

// OIDs for access methods

_LIT(KAccessMethodOCSP, "1.3.6.1.5.5.7.48.1");

//deprecated OIDs we might still encounter

_LIT(KOldBasicConstraints,"2.5.29.10");

_LIT(KOldBasicConstraints2,"2.5.29.13");

_LIT(KOldSubjectAltName,"2.5.29.7");

_LIT(KOldIssuerAltName,"2.5.29.8");

_LIT(KOldNameConstraints,"2.5.29.11");

_LIT(KOldPolicyConstraints,"2.5.29.2");

_LIT(KOldPolicyConstraints2,"2.5.29.34");

_LIT(KOldCertPolicies,"2.5.29.3");

_LIT(KOldPolicyMapping,"2.5.29.5");

_LIT(KOldAuthorityKeyId,"2.5.29.1");

// Define OIDs for Symbian certificate constraints.

_LIT(KDeviceIdListConstraint,"1.2.826.0.1.1796587.1.1.1.1");

_LIT(KSidListConstraint,"1.2.826.0.1.1796587.1.1.1.4");

_LIT(KVidListConstraint,"1.2.826.0.1.1796587.1.1.1.5");

_LIT(KCapabilitiesConstraint,"1.2.826.0.1.1796587.1.1.1.6");

//1) basic constraints...

class CX509ExtensionBase : public CBase

/** A certificate extension base class. 

* 

* @since v6.0 */

	{

protected:

	/** Second-phase constructor.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The position from which to start decoding. */

	virtual void ConstructL(const TDesC8& aBinaryData, TInt& aPos);

	/** Implementation for second-phase construction.

	* 

	* This is called by ConstructL().

	* 

	* @param aBinaryData	The encoded binary representation. This is the same as

	* 						passed to ConstructL().

	* @param aPos			The position from which to start decoding. Note that the value

	* 						passed points, in effect, to the content, by passing the header data. */

	virtual void DoConstructL(const TDesC8& aBinaryData, TInt& aPos) = 0;

	};

class CX509BasicConstraintsExt : public CX509ExtensionBase

/** An X.509 certificate extension that defines basic constraints.

* 

* It indicates whether the certificate belongs to a Certificate Authority or 

* an end Entity. 

* 

* @since v6.0 */

	{

public:

	/** Creates a new CX509BasicConstraintsExt object from the specified 

	* buffer containing the binary coded representation.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509BasicConstraintsExt object. */

	IMPORT_C static CX509BasicConstraintsExt* NewL(const TDesC8& aBinaryData);

	/** Creates a new CX509BasicConstraintsExt object from the specified 

	* buffer containing the binary coded representation, and puts a pointer to it 

	* onto the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509BasicConstraintsExt object. */

	IMPORT_C static CX509BasicConstraintsExt* NewLC(const TDesC8& aBinaryData);

	/** Creates a new CX509BasicConstraintsExt object from the specified 

	* buffer containing the binary coded representation, starting at the specified 

	* offset.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509BasicConstraintsExt object. */

	IMPORT_C static CX509BasicConstraintsExt* NewL(const TDesC8& aBinaryData, TInt& aPos);

	/** Creates a new CX509BasicConstraintsExt object from the specified 

	* buffer containing the binary coded representation, starting at the specified 

	* offset, and puts a pointer to it onto the cleanup stack.

	*

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509BasicConstraintsExt object. */

	IMPORT_C static CX509BasicConstraintsExt* NewLC(const TDesC8& aBinaryData, TInt& aPos);

	/** Destructor.

	* 

	* Frees all resources owned by the object, prior to its destruction. */

	virtual ~CX509BasicConstraintsExt();

	/** Tests whether the certificate belongs to a Certificate Authority.

	* 

	* @return	ETrue, if the certificate belongs to a Certificate Authority; 

	* 			EFalse, otherwise. */

	IMPORT_C TBool IsCA() const;

	/** Gets the maximum number of certificates that can follow this one in the chain.

	* 

	* @return	The number of certificates. */

	IMPORT_C TInt MaxChainLength() const;//0 if not set

private:

	CX509BasicConstraintsExt();

	void DoConstructL(const TDesC8& aBinaryData, TInt& aPos);

	TBool iIsCA;

	TInt iMaxChainLen;

	};

//2) alt name

class CX509AltNameExt : public CX509ExtensionBase

/** An X.509 certificate extension that defines an alternate name.

* 

* It appears as an Issuer Alt Name extension or a Subject Alt Name extension 

* and is used to contain extra identifying information that will not fit into 

* a Distinguished Name.

* 

* It consists of an array of X.509 General Names.

*

* @since v6.0 */

	{

public:

	/** Creates a new CX509AltNameExt object from the specified 

	* buffer containing the binary coded representation.

	*

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509AltNameExt object. */

	IMPORT_C static CX509AltNameExt* NewL(const TDesC8& aBinaryData);

	/** Creates a new CX509AltNameExt object from the specified 

	* buffer containing the binary coded representation, and puts a pointer to it 

	* onto the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509AltNameExt object. */

	IMPORT_C static CX509AltNameExt* NewLC(const TDesC8& aBinaryData);

	/** Creates a new CX509AltNameExt object from the specified 

	* buffer containing the binary coded representation, starting at the specified 

	* offset.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509AltNameExt object. */

	IMPORT_C static CX509AltNameExt* NewL(const TDesC8& aBinaryData, TInt& aPos);

	/** Creates a new CX509AltNameExt object from the specified 

	* buffer containing the binary coded representation, starting at the specified 

	* offset, and puts a pointer to it onto the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509AltNameExt object. */

	IMPORT_C static CX509AltNameExt* NewLC(const TDesC8& aBinaryData, TInt& aPos);

	/** Destructor.

	* 

	* Frees all resources owned by the object, prior to its destruction. */

	 virtual ~CX509AltNameExt();

	/** Gets a reference to the array of general names that forms the alternate name 

	* extension.

	* 

	* @return	The array of general names. */

	IMPORT_C const CArrayPtrFlat<CX509GeneralName>& AltName() const;

	/** Checks whether the corressponding elements of two equally sized arrays of X.509 general names

	* match.

	*

	* @param aExt	An X.509 certificate extension object that defines an alternate name.

	* @return		TRUE if all the elements in the arrays match.

	*/

	IMPORT_C TBool Match(const CX509AltNameExt& aExt) const;

private:

	CX509AltNameExt();

	void DoConstructL(const TDesC8& aBinaryData, TInt& aPos);

	CArrayPtrFlat<CX509GeneralName>* iAuthorityName;

	};

class CX509KeyUsageExt : public CX509ExtensionBase

/** An X.509 certificate extension that defines the uses to which a key may be put.

* 

* @since v6.0 */

	{

public:

	/** Creates a new CX509KeyUsageExt object from the specified buffer 

	* containing the binary coded representation.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509KeyUsageExt object. */

	IMPORT_C static CX509KeyUsageExt* NewL(const TDesC8& aBinaryData);

	/** Creates a new CX509KeyUsageExt object from the specified buffer 

	* containing the binary coded representation, and puts a pointer to it onto 

	* the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509KeyUsageExt object. */

	IMPORT_C static CX509KeyUsageExt* NewLC(const TDesC8& aBinaryData);

	/** Creates a new CX509KeyUsageExt object from the specified buffer 

	* containing the binary coded representation, starting at the specified offset.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509KeyUsageExt object. */

	IMPORT_C static CX509KeyUsageExt* NewL(const TDesC8& aBinaryData, TInt& aPos);

	/** Creates a new CX509KeyUsageExt object from the specified buffer 

	* containing the binary coded representation, starting at the specified offset, 

	* and puts a pointer to it onto the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509KeyUsageExt object. */

	IMPORT_C static CX509KeyUsageExt* NewLC(const TDesC8& aBinaryData, TInt& aPos);

	/** Destructor.

	* 

	* Frees all resources owned by the object, prior to its destruction. */

	virtual ~CX509KeyUsageExt();

	/** Tests whether a particular usage is set in the extension.

	* 

	* 

	* @param aUsage	The usage.

	* @return		ETrue, if the specific usage is set in the extension; EFalse, otherwise. */

	IMPORT_C TBool IsSet(TX509KeyUsage aUsage) const;

private:

	CX509KeyUsageExt();

	void DoConstructL(const TDesC8& aBinaryData, TInt& aPos);

	CX509BitString* iData;

	};

//4) name constraints

class CX509GeneralSubtree : public CBase

/** Provides access to the general name and the min/max lengths of the subtree. 

* 

* @since v6.0 */

	{

public:

	/**

	 * @internalComponent

	 *  

	 * Creates a new CX509GeneralSubtree object from the specified buffer containing 

	 * the encoded binary representation.

	 * 

	 * @param aBinaryData	The encoded binary representation. 

	 * @return 		The new CX509GeneralSubtree object. 

	 **/

	static CX509GeneralSubtree* NewL(const TDesC8& aBinaryData);

	/** 

	 * @internalComponent

	 * 

	 * Creates a new CX509GeneralSubtree object from the specified buffer containing 

	 * the encoded binary representation, and puts a pointer to it onto the cleanup stack.

	 * 

	 * @param aBinaryData	The encoded binary representation. 

	 * @return 				The new CX509GeneralSubtree object. 

	 **/

	static CX509GeneralSubtree* NewLC(const TDesC8& aBinaryData);

	/** 

	 * @internalComponent

	 *

	 * Creates a new CX509GeneralSubtree object from the specified buffer containing 

	 * the encoded binary representation.

	 * 

	 * @param aBinaryData	The encoded binary representation.

	 * @param aPos			The position from which to start decoding. 

	 * @return 				The new CX509GeneralSubtree object. 

	 **/

	static CX509GeneralSubtree* NewL(const TDesC8& aBinaryData, TInt& aPos);

	/** 

	 * @internalComponent

	 *

	 * Creates a new CX509GeneralSubtree object from the specified buffer containing 

	 * the encoded binary representation, and puts a pointer to it onto the cleanup stack.

	 * 

	 * @param aBinaryData	The encoded binary representation.

	 * @param aPos			The position from which to start decoding.

	 * @return 				The new CX509GeneralSubtree object. 

	 **/

	static CX509GeneralSubtree* NewLC(const TDesC8& aBinaryData, TInt& aPos);

	/** Destructor.

	* 

	* Frees all resources owned by the object. */

	virtual ~CX509GeneralSubtree();

	/** Gets the general name.

	* 

	* @return	The general name. */

	IMPORT_C const CX509GeneralName& Name() const;

	/** Gets the minimum distance of the CX509GeneralSubtree object.

	* 

	* @return	The minimum distance of the CX509GeneralSubtree object. */

	IMPORT_C TInt MinDistance() const;

	/** Gets the maximum distance of the CX509GeneralSubtree object.

	* 

	* @return	The maximum distance of the CX509GeneralSubtree object. */

	IMPORT_C TInt MaxDistance() const;

private:

	CX509GeneralSubtree();

	void ConstructL(const TDesC8& aBinaryData, TInt& aPos);

	CX509GeneralName* iName;

	TInt iMaxDist;

	TInt iMinDist;

	};

class CX509NameConstraintsExt : public CX509ExtensionBase

/** An X.509 certificate extension that defines constraints on an entity's name.

* 

* This extension allows Certification Authorities to restrict or prevent the issuing 

* of certificates to entities whose names lie within a defined name space. 

*

*/

	{

public:

	/** Creates a new CX509NameConstraintsExt object from the specified 

	* buffer containing the binary coded representation.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509NameConstraintsExt object. */

	IMPORT_C static CX509NameConstraintsExt* NewL(const TDesC8& aBinaryData);

	/** Creates a new CX509NameConstraintsExt object from the specified 

	* buffer containing the binary coded representation, and puts a pointer to it 

	* onto the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @return				The new CX509NameConstraintsExt object. */

	IMPORT_C static CX509NameConstraintsExt* NewLC(const TDesC8& aBinaryData);

	/** Creates a new CX509NameConstraintsExt object from the specified 

	* buffer containing the binary coded representation, starting at the specified offset.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509NameConstraintsExt object. */

	IMPORT_C static CX509NameConstraintsExt* NewL(const TDesC8& aBinaryData, TInt& aPos);

	/** Creates a new CX509NameConstraintsExt object from the specified 

	* buffer containing the binary coded representation, starting at the specified 

	* offset, and puts a pointer to it onto the cleanup stack.

	* 

	* @param aBinaryData	The encoded binary representation.

	* @param aPos			The offset position from which to start decoding.

	* @return				The new CX509NameConstraintsExt object. */

	IMPORT_C static CX509NameConstraintsExt* NewLC(const TDesC8& aBinaryData, TInt& aPos);

	/** Destructor.

	* 

	* Frees all resources owned by the object, prior to its destruction. */

	IMPORT_C ~CX509NameConstraintsExt();

	/** Gets a reference to the array of exclusion subtree names.

	* 

	* No certificates after this one may contain names within the subtrees specified.

	* 

	* @return	The excluded subtrees. */

	IMPORT_C const CArrayPtrFlat<CX509GeneralSubtree>& ExcludedSubtrees() const;

	/** Gets a reference to the array of permitted subtree names.

	* 

	* All certificates after this one must contain names within the subtrees specified.

	* 

	* @return	The permitted subtrees. */

	IMPORT_C const CArrayPtrFlat<CX509GeneralSubtree>& PermittedSubtrees() const;

private:

	CX509NameConstraintsExt();

	void DoConstructL(const TDesC8& aBinaryData, TInt& aPos);

	void AddSubtreesL(CArrayPtrFlat<CX509GeneralSubtree>& aSubtrees, const TDesC8& aBinaryData);

	CArrayPtrFlat<CX509GeneralSubtree>* iExcludedSubtrees;

	CArrayPtrFlat<CX509GeneralSubtree>* iPermittedSubtrees;

	};

//5) policy constraints

class TX509PolicyConstraint

/** Defines whether a policy constraint applies.

* 

* Objects of this type are used by the X.509 certificate extension that constrains 

* the use of policies.

* 

* An object of this type encapsulates two pieces of information:

* @li	whether a specific policy applies to subsequent certificates

* @li	if a specific policy applies, the number of certificates that can follow the 

* 		current one before the policy constraint applies.