/*

* Copyright (c) 2006-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

#include "pkcs7signedobject.h"

#include <pkcs7contentinfo_v2.h>

#include "pkcs7excert.h"

#include "pkcs7signerinfo.h"

#include "pkcs7issuerserial.h"

#include "pkcs7asn1.h"

#include <asn1dec.h>

#include <x509cert.h>

#include <hash.h>

const TInt KSignedDataCertificates = 0;

const TInt KSignedDataRevocationLists = 1;

EXPORT_C CPKCS7SignedObject::~CPKCS7SignedObject(void)

	{

	iDigestAlgorithms.ResetAndDestroy();

	iCertificates.ResetAndDestroy();

	delete iContentInfo;

	iSignerInfo.ResetAndDestroy();

	for(TInt i = 0; i < KPKCS7MaxDataElements; i++)

		{

		delete iDataElements.At(i);

		}

	}

EXPORT_C CPKCS7SignedObject::CPKCS7SignedObject(void)

	{

	}

EXPORT_C CPKCS7SignedObject* CPKCS7SignedObject::NewLC(const CPKCS7ContentInfo& aContentInfo)

	{

	CPKCS7SignedObject* self = new (ELeave) CPKCS7SignedObject();

	CleanupStack::PushL(self);

	self->ConstructL(aContentInfo);

	return self;

	}

EXPORT_C CPKCS7SignedObject* CPKCS7SignedObject::NewL(const CPKCS7ContentInfo& aContentInfo)

	{

	CPKCS7SignedObject* self = NewLC(aContentInfo);

	CleanupStack::Pop(self);

	return self;

	}

EXPORT_C void CPKCS7SignedObject::ConstructL(const CPKCS7ContentInfo& aContentInfo)

	{

	if(aContentInfo.ContentType() != KPkcs7SignedData)

		{

		User::Leave(KErrArgument);

		}

	TASN1DecGeneric decGen(aContentInfo.ContentData());

	decGen.InitL();

	if(decGen.Tag() == EASN1Sequence)

		{

		InitSignedObjectL(decGen.Encoding());

	    DecodeSignedDataL(*iEncoding);

		}

	else

		{

	    User::Leave(KErrArgument);

		}

	}

EXPORT_C const TPtrC8 CPKCS7SignedObject::SignedDataL() const

	{

	return iContentInfo->ContentData();

	}

EXPORT_C void CPKCS7SignedObject::InternalizeL(RReadStream& /*aStream*/) 

	{

	User::Leave(KErrNotSupported);

	}

EXPORT_C const TPtrC8* CPKCS7SignedObject::DataElementEncoding(const TUint aIndex) const

	{

	return iDataElements.At(aIndex);

	}

EXPORT_C const RPointerArray<CX509AlgorithmIdentifier>& CPKCS7SignedObject::DigestAlgorithms() const

	{

	return iDigestAlgorithms;

	}

EXPORT_C TInt CPKCS7SignedObject::Version() const

	{

	return iVersion;

	}

EXPORT_C const CPKCS7ContentInfo& CPKCS7SignedObject::ContentInfo() const

	{

	return *iContentInfo;

	}

EXPORT_C const RPointerArray<CPKCS7ExtendedCertificateOrCertificate>& CPKCS7SignedObject::Certificates() const

	{

	return iCertificates;

	}

EXPORT_C const RPointerArray<CPKCS7SignerInfo>& CPKCS7SignedObject::SignerInfo() const

	{

	return iSignerInfo;

	}

void CPKCS7SignedObject::InitSignedObjectL(const TDesC8& aRawData)

	{

	// Populate CSignedObject data members

	iKeyFactory = new (ELeave) TX509KeyFactory;

	iEncoding = aRawData.AllocL();

	CSHA1* hash = CSHA1::NewL();

	CleanupStack::PushL(hash);

	iFingerprint = hash->Hash(Encoding()).AllocL();

	CleanupStack::PopAndDestroy(hash);

	}

void CPKCS7SignedObject::DecodeSignedDataL(const TDesC8& aRawData)

	{

	CArrayPtr<TASN1DecGeneric>* signedData = PKCS7ASN1::DecodeSequenceLC(aRawData, 4, KPKCS7MaxDataElements);

	TInt totalItems = signedData->Count();

	TASN1DecInteger decInt;

	// decodes version

	iDataElements.At(EVersionNumber) = new(ELeave) TPtrC8(signedData->At(0)->GetContentDER());

	iVersion = decInt.DecodeDERShortL(*signedData->At(0));	

	// decodes algorithms

	iDataElements.At(EDigestAlgorithms) = new(ELeave) TPtrC8(signedData->At(1)->GetContentDER());

	DecodeDigestAlgorithmsL(signedData->At(1)->Encoding());

	// decodes contentinfo

	iDataElements.At(EContentInfo) = new(ELeave) TPtrC8(signedData->At(2)->GetContentDER());

	iContentInfo = CPKCS7ContentInfo::NewL(signedData->At(2)->Encoding());

	// Checks for optional fields

	TInt pos = 3;	// Skip first non-optional fields

	do

		{

		const TASN1DecGeneric& currentItem = *signedData->At(pos);

		switch(currentItem.Tag())

			{

			case KSignedDataCertificates:

				{

				iDataElements.At(ECertificates) = new(ELeave) TPtrC8(currentItem.GetContentDER());

				DecodeCertificatesL(currentItem.Encoding());

				break;

				}

			case KSignedDataRevocationLists:

				{

				iDataElements.At(ERevocationLists) = new(ELeave) TPtrC8(currentItem.GetContentDER());

				DecodeRevocationListsL(currentItem.Encoding());

				break;

				}

			default:	// Non-optional field

				{

				break;

				}

			}

		pos++;

		}

	while(pos < totalItems);

	iDataElements.At(ESignedInfo) = new(ELeave) TPtrC8(signedData->At(totalItems-1)->GetContentDER());

	DecodeSignerInfoL(signedData->At(totalItems-1)->Encoding());

	CleanupStack::PopAndDestroy(signedData);

	}

void CPKCS7SignedObject::DecodeDigestAlgorithmsL(const TDesC8& aRawData)

	{

	CArrayPtr<TASN1DecGeneric>* algsData = PKCS7ASN1::DecodeSequenceLC(aRawData);

	TInt count = algsData->Count();

	CX509AlgorithmIdentifier* alIdent;

	for(TInt item = 0; item < count; item++)

		{

 		alIdent = CX509AlgorithmIdentifier::NewLC(algsData->At(item)->Encoding());

		User::LeaveIfError(iDigestAlgorithms.Append(alIdent));

		CleanupStack::Pop(alIdent);

		}

	CleanupStack::PopAndDestroy(algsData);

	}

void CPKCS7SignedObject::DecodeCertificatesL(const TDesC8& aRawData)

	{

	CArrayPtr<TASN1DecGeneric>* items = NULL;

	TASN1DecGeneric decGen(aRawData);

	decGen.InitL();

	TASN1DecSequence decSeq;

	// have to do manual decoding of sequence because field is optional

	items = decSeq.DecodeDERLC(decGen);

	TInt count = items->Count();

	CPKCS7ExtendedCertificateOrCertificate* certificate;

	for(TInt item = 0; item < count; item++)

		{

 		certificate = CPKCS7ExtendedCertificateOrCertificate::NewL(items->At(item)->Encoding());

		CleanupStack::PushL(certificate);

		User::LeaveIfError(iCertificates.Append(certificate));

		CleanupStack::Pop(certificate);

		}

	CleanupStack::PopAndDestroy(items);

	}

void CPKCS7SignedObject::DecodeRevocationListsL(const TDesC8& /*aRawData*/)

	{

	// not yet supported

	User::Leave(KErrNotSupported);

	}

void CPKCS7SignedObject::DecodeSignerInfoL(const TDesC8& aRawData)

	{

	CArrayPtr<TASN1DecGeneric>* signerInfo = PKCS7ASN1::DecodeSequenceLC(aRawData);

	TInt total = signerInfo->Count();

	CPKCS7SignerInfo* signer;

	for(TInt item = 0; item < total; item ++)

		{

		signer = CPKCS7SignerInfo::NewL(signerInfo->At(item)->Encoding());

		CleanupStack::PushL(signer);

		User::LeaveIfError(iSignerInfo.Append(signer));

		CleanupStack::Pop(signer);

		}

	CleanupStack::PopAndDestroy(signerInfo);

	}

EXPORT_C TBool CPKCS7SignedObject::ValidateSignerL(const CPKCS7SignerInfo& aSignerInfo, HBufC8*& aCertChainEncoding)

	{

	TInt certCount = iCertificates.Count();

	TInt endEntityPos = -1;

	TInt endEncodingSize = 0;

	TPtrC8 endEntityEncoding;

	TInt cert;

	TBool valid = EFalse;

	// looks for end entity certificate

	for(cert = 0; cert < certCount; cert++)

		{

		const CX509Certificate& certificate = iCertificates[cert]->Certificate();

		endEncodingSize+= certificate.Encoding().Length();

		if(certificate.IssuerName().ExactMatchL(aSignerInfo.IssuerAndSerialNumber().IssuerName()))

			{

			endEntityPos = cert;

			endEntityEncoding.Set(certificate.Encoding());

			valid = ValidateSignatureL(aSignerInfo, certificate);

			}

		}

	// checks if end entity was found

	if(endEntityPos != -1)

		{

		// builds the cert chain encoding by putting the end entity first then all remaining

		// certs

		aCertChainEncoding = HBufC8::NewLC(endEncodingSize);

		TPtr8 encodingPtr(aCertChainEncoding->Des());

		encodingPtr.Copy(endEntityEncoding);

		for(cert = 0; cert < certCount; cert++)

			{

			const CX509Certificate& certificate = iCertificates[cert]->Certificate();

			if(cert != endEntityPos)

				{

				encodingPtr.Append(certificate.Encoding());

				}

			}

		}

	else

		{

		User::Leave(KErrNotFound);

		}

	return valid;

	}

TBool CPKCS7SignedObject::ValidateSignatureL(const CPKCS7SignerInfo& aSignerInfo, const CX509Certificate& aEndEntityCert)

	{

	iSigningAlgorithm = CX509SigningAlgorithmIdentifier::NewL(aSignerInfo.DigestEncryptionAlgorithm(), aSignerInfo.DigestAlgorithm());

	if(iSignature)

		{

		delete iSignature;

		iSignature = NULL;

		}

	iSignature = aSignerInfo.EncryptedDigest().AllocL();

	return VerifySignatureL(aEndEntityCert.PublicKey().KeyData());

	}