/*

* Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

* CAuthServer implementation

*

*/

/**

 @file 

*/

#include <s32mem.h>

#include <s32file.h>

#include <ecom/ecom.h>

#include <pbedata.h>

#include <scs/cleanuputils.h>

#include "authserver_impl.h"

#include "authtransaction.h"

#include "authserver/aspubsubdefs.h"

#include "authserverutil.h"

using namespace AuthServer;

const TUint CAuthServer::iRangeCount = KPolicyRanges;

const TInt CAuthServer::iRanges[KPolicyRanges] = 

	{

	0,

	CScsServer::EBaseSession,

	CScsServer::EBaseSession |ERequireNoCapabilities, 		   // accessible by all clients.

	CScsServer::EBaseSession |ERequireReadUserData,		   	   // accessible by ReadUserData clients only.

	CScsServer::EBaseSession |ERequireWriteUserData,	   	   // accessible by WriteUserData clients only.

	CScsServer::EBaseSession |ERequireReadDeviceData, 	       // accessible by ReadDeviceData clients only.

	CScsServer::EBaseSession |ERequireWriteDeviceData,         // accessible by WriteDeviceData clients only.

	CScsServer::EBaseSession |ERequireTrustedUi,               // accessible by TrustedUi clients only.

	CScsServer::EBaseSession |ERequireReadDeviceAndUserData,   // accessible by clients with both

																// ReadUserData and ReadDeviceData.

	CScsServer::EBaseSession |ERequireCustomCheck,		       // Require custom check.

	CScsServer::EBaseSession |ELastService,

	CScsServer::EBaseMustAllow     			                   // SCS Internal.

	};

const TUint8 CAuthServer::iElementsIndex[iRangeCount] = 

	{

	CPolicyServer::ENotSupported,

	CPolicyServer::EAlwaysPass,

	0,  // all clients can have access 

	1,  // ReadUserData clients only

	2,  // WriteUserData clients only

	3,	// ReadDeviceData

	4,  // WriteDeviceData

	5,  // trusted ui

	6,  // ReadUserData and ReadDeviceData

	CPolicyServer::ECustomCheck,	// custom check

	CPolicyServer::EAlwaysPass, 

	CPolicyServer::EAlwaysPass, 

	};

const CPolicyServer::TPolicyElement CAuthServer::iPolicyElements[] = 

	{

	{_INIT_SECURITY_POLICY_C1(ECapability_None), CPolicyServer::EFailClient},

	{_INIT_SECURITY_POLICY_C1(ECapabilityReadUserData), CPolicyServer::EFailClient},

	{_INIT_SECURITY_POLICY_C1(ECapabilityWriteUserData), CPolicyServer::EFailClient},

	{_INIT_SECURITY_POLICY_C1(ECapabilityReadDeviceData), CPolicyServer::EFailClient}, 

	{_INIT_SECURITY_POLICY_C1(ECapabilityWriteDeviceData), CPolicyServer::EFailClient},

	{_INIT_SECURITY_POLICY_C1(ECapabilityTrustedUI), CPolicyServer::EFailClient},

	{_INIT_SECURITY_POLICY_C2(ECapabilityReadDeviceData, ECapabilityReadUserData), CPolicyServer::EFailClient},

	};

const CPolicyServer::TPolicy CAuthServer::iPolicy =

	{

		CPolicyServer::EAlwaysPass, // so that any client can connect	

		iRangeCount,                                   

		iRanges,

		iElementsIndex,

		iPolicyElements,

	};

_LIT_SECURITY_POLICY_S0(CAuthServer::iPropertyWritePolicy, KAuthServerSecureId.iUid);

_LIT_SECURITY_POLICY_PASS(CAuthServer::iPropertyReadPolicy);

inline CAuthServer::CAuthServer(CActive::TPriority aPriority)

	:CScsServer(TVersion(1,0,0), iPolicy, aPriority)

	{}

CAuthServer* CAuthServer::NewLC(CActive::TPriority aPriority)

	{

	CAuthServer* self = new(ELeave) CAuthServer(aPriority);

	CleanupStack::PushL(self);

	self->ConstructL();

	return self;

	}

void CAuthServer::ConstructL()

    {

    // Delay starting of shutdown timer till we finish construction since

    // loading of ECOM plugins takes a while

    CScsServer::ConstructL(0);

    TInt r;

    StartL(KAuthServerName);

	r = iFs.Connect();

    User::LeaveIfError(r);

    r = iFs.CreatePrivatePath(RFs::GetSystemDrive());

    User::LeaveIfError(r);

    // Retrieve the key size to be used for protection keys

	CPBEncryptElement* pbee = CPBEncryptElement::NewLC(_L(""));

    iKeySize = pbee->EncryptionData().AuthData().Key().Size();

    CleanupStack::PopAndDestroy(pbee);

    iAuthRepository = CAuthRepository::NewL();

	iAuthDb2 = CAuthDb2::NewL(iFs);

	iPluginMgr  = CPluginMgr::NewL();

    iPluginObserver = CPluginObserver::NewL(*iPluginMgr);

    iEvaluator = CEvaluator::NewL(this,this);

    iTrainingMgr = new (ELeave) CTrainingMgr(*iPluginMgr, *iAuthDb2, *iAuthRepository);

	TUid clientSid = {0};

	iParams = CAuthParams::NewL(0,

								EFalse,

								clientSid,

								EFalse,

								KNullDesC());

    CreatePropertiesL();

	FirstStartL();

	// Construction complete, now start the shutdown timer

	CScsServer::EnableShutdownTimerL(AuthServer::KDefaultShutdownDelay);

    }

CPolicyServer::TCustomResult CAuthServer::CustomSecurityCheckL(const RMessage2& aMessage, 

	TInt& /*aAction*/, TSecurityInfo& aMissing)

	{

	TInt KAuthParams = 1; 

	TInt paramsLen = aMessage.GetDesLength(KAuthParams);

	if(paramsLen != KErrBadDescriptor)

		{

		//Create a buffer.

		HBufC8* buffer = HBufC8::NewLC(paramsLen);

		TPtr8 bufDes(buffer->Des());

		aMessage.ReadL(EIpcArgument1, bufDes);

		//Internalize the params object.

		RDesReadStream readStream(*buffer);

		CleanupClosePushL(readStream);

		iParams->InternalizeL(readStream);

		CleanupStack::PopAndDestroy(2, buffer);

		}

	TBool clientKey = iParams->iClientKey;

	TBool withString = iParams->iWithString;

	TInt clientSid = iParams->iClientSid.iUid;

	if((!clientKey || withString || ((clientSid != aMessage.SecureId()) && clientSid != 0 )) && !(aMessage.HasCapability(ECapabilityReadUserData)))

		{

		// Missing ReadUserData capability.

		aMissing.iCaps.Set(ECapabilityReadUserData);

		return CPolicyServer::EFail;

		}	

	else

		{

		return CPolicyServer::EPass;	

		}

	}

/**

 * Creates and initialises the two AuthServer properties -

 * KUidAuthServerLastAuth and KUidAuthServerAuthChangeEvent.

 *

 **/

void CAuthServer::CreatePropertiesL()

	{

	// KUidAuthServerLastAuth

	TInt err1 = iAuthProperty.Define(KUidAuthServerLastAuth, RProperty::EText,

									iPropertyReadPolicy, iPropertyWritePolicy,

									sizeof(TLastAuth));

	User::LeaveIfError(iAuthProperty.Attach(KAuthServerSecureId,

											KUidAuthServerLastAuth));

	// KUidAuthServerAuthChangeEvent

	TInt err2 = iAuthEventProperty.Define(KUidAuthServerAuthChangeEvent,

									RProperty::EInt,

									iPropertyReadPolicy,

									iPropertyWritePolicy);

	User::LeaveIfError(iAuthEventProperty.Attach(KAuthServerSecureId,

												 KUidAuthServerAuthChangeEvent));

	if (err1 == KErrNone || err2 == KErrNone )

		{

		ClearPropertiesL();

		}

	}

void CAuthServer::ClearPropertiesL()

	{

	TLastAuth lastAuth;

	TPckg<TLastAuth> authPckg(lastAuth);

	User::LeaveIfError(iAuthProperty.Set(authPckg));

	User::LeaveIfError(iAuthEventProperty.Set(KUnknownIdentity));

	}

/**

 * Checks the number of identities in the database and iff zero asks the

 * training mgr to register the first identity.

 *

 * @leave KErrAuthServerCanNotCreateFirstId if the first identity cannot

 * be created

 **/

void CAuthServer::FirstStartL()

	{

	TInt numIds = iAuthDb2->NumIdentitiesL();

	if (numIds == 0)

		{

		TIdentityId id = 0;

		TPckg<TIdentityId> idPkg(id);

		TRandom::RandomL(idPkg);

		CProtectionKey* key = CProtectionKey::NewL(iKeySize);

		if (!iTrainingMgr->RegisterFirstIdentityL(id, *key))

			{

			User::Panic(KAuthServerShortName, EPanicNoFirstStartPlugin);

			}

		}

	}

CAuthServer::~CAuthServer()

	{

	delete iAuthRepository;

	delete iAuthTransaction;

	delete iTrainingMgr;

	delete iLastIdentity;

	delete iEvaluator;

	delete iPluginMgr;

	delete iPluginObserver;	

	delete iParams;

	if (iAuthDb2 != 0)

		{

		iAuthDb2->CompactIfRequired();

		delete iAuthDb2;

		}

	iFs.Close();

	REComSession::FinalClose();

	}

/**

 *  Creates a new session

 * @param aClientVersion the version of the connecting client

 * @param aMessage the connect message

 */

CScsSession* CAuthServer::DoNewSessionL(const RMessage2& /*aMessage*/)

	{

	return CAuthServerSession::NewL(*this);

	}

/**

 * Returns the last identity to be authenticated within the period 

 * currTime to currTime-timeout.  

 * 

 * @param currTime the current universal time

 * 

 * @param timeout the number of seconds within which the last

 * authentication should have been made

 *

 * @return 0 if there has been no previous authentications either in the

 * server lifetime or within the timeout period. 

 *

 * @return a pointer to the cached identity object

 **/

CIdentity* CAuthServer::CachedIdentity( const TTimeIntervalSeconds& aTimeOut)

    {

    // process request

    TTime currentTime;

	if(currentTime.UniversalTimeSecure() == KErrNoSecureTime)

		{

		// Fall back to nonsecure time. 

		currentTime.UniversalTime();

		}

    CIdentity* id = 0;

    TTimeIntervalSeconds timeSinceLast;

    currentTime.SecondsFrom(iLastAuthTime, timeSinceLast);    

    if (timeSinceLast.Int() >= 0 && timeSinceLast < aTimeOut)

		{

		id = iLastIdentity;

		}

    return id;

    }

/**

 *

 * @param aMessage the message to process

 **/

void CAuthServer::DeauthenticateL(const RMessage2& aMessage)

	{

	if (ServerBusy())

		{

		aMessage.Complete(KErrServerBusy);

		return;

		}

	delete iLastIdentity;

	iLastIdentity = 0;

	iLastAuthTime = 0L;

	ClearPropertiesL();	

	aMessage.Complete(KErrNone);

	}

HBufC* CAuthServer::StringOrNullLC(TBool aReturnString, TIdentityId aId)

    {

	HBufC* str = 0;

	if (aReturnString)

		{

		TRAPD(err, str = iAuthDb2->DescriptionL(aId));  

		if (!err)

			{

			CleanupStack::PushL(str);

			}

		}

	if (str == 0)

		{

		str = HBufC::NewLC(0);  

		}

	return str;

    }

void CAuthServer::AuthenticateL(const RMessage2& aMessage)

    {

	if (ServerBusy())

		{

		aMessage.Complete(KErrServerBusy);

		return;

		}

	TInt KAuthParams = 1; 

	TInt paramsLen = aMessage.GetDesLength(KAuthParams);

	if(paramsLen != KErrBadDescriptor)

		{

		//Create a buffer.

		HBufC8* buffer = HBufC8::NewLC(paramsLen);

		TPtr8 bufDes(buffer->Des());

		aMessage.ReadL(EIpcArgument1, bufDes);

		//Internalize the params object.

		RDesReadStream readStream(*buffer);

		CleanupClosePushL(readStream);

		iParams->InternalizeL(readStream);

		CleanupStack::PopAndDestroy(2, buffer);	

		}

	CIdentity* id = CachedIdentity(iParams->iTimeout);

	if (id == 0) // no valid cache available

		{

		const TInt KAuthExprParam = 0;

		// reconstruct the authentication expression

		TInt extLen = aMessage.GetDesLengthL(KAuthExprParam);

		HBufC8* extSrv = HBufC8::NewLC(extLen);

		TPtr8 desSrv8 = extSrv->Des();

		aMessage.ReadL(KAuthExprParam, desSrv8);

		RDesReadStream drs(desSrv8);

		CAuthExpression* authExpr = CAuthExpressionImpl::NewL(drs);

		// don't need the stream any more, so free it

		CleanupStack::PopAndDestroy(extSrv);

		CleanupStack::PushL(authExpr);

		const CAuthExpressionImpl* expr = static_cast<const CAuthExpressionImpl*>(authExpr);

		iAuthTransaction = CAuthTransaction::NewL(aMessage,

												  iParams->iClientKey,

												  iParams->iClientSid.iUid,

												  iParams->iWithString,

												  *iParams->iClientMessage,

												  expr);

		CleanupStack::Pop(authExpr);

		iEvaluator->Evaluate(expr);

		return;

        }

	else if (iParams->iClientKey && (id->Id() != KUnknownIdentity))

		{

		HBufC* str = StringOrNullLC(iParams->iWithString, id->Id());

		CIdentity* id2 = 0;

		TInt clientId = aMessage.SecureId();

		if(iParams->iClientSid.iUid != 0)

			{

			clientId = iParams->iClientSid.iUid;

			}

		id2 = CIdentity::NewL(id->Id(), id->Key().ClientKeyL(clientId), str);

		CleanupStack::Pop(str);

		CleanupStack::PushL(id2);

		// id pointer already stored as iLastIdentity

		id = id2; 

		}

	CompleteAuthenticationL(aMessage, id);

	if (id != iLastIdentity) 

		{

		// only clean up the allocated id if it has not been transferred to us.

		CleanupStack::PopAndDestroy(id);  

		}

	}

// -------- plugin lists --------

/**

	Build an array containing descriptions for the

	plugins available on the system and send it to

	the client.

	@param	aMessage		Message describing client

							request.

	@param	aFilter			Function which decides whether

							or not to include a plugin in the

							list.

 */

void CAuthServer::FilterPluginsL(

	const RMessage2& aMessage, CAuthServer::TInterfaceFilter aFilter)

	{

	RCPointerArray<const CPluginDesc> descs;

	GetDescriptionsFromEComLC(aFilter, descs);

	AuthServerUtil::SendDataPointerArrayL(aMessage, descs, 0);

	CleanupStack::PopAndDestroy(&descs);

	}

/**

	Populate the supplied array with plugin descriptions generated

	from the available ECOM plugins.

	@param	aFilter			Predicate function decides whether or not

							to include each plugin in the list.

	@param	aDescs			Array to populate.  When this function is

							called, any existing entries are removed.

							If this function leaves then any entries are

							removed from the array.  On success, the

							array is on the cleanup stack.

 */

void CAuthServer::GetDescriptionsFromEComLC(

	CAuthServer::TInterfaceFilter aFilter,

	RCPointerArray<const CPluginDesc>& aDescs)

	{

	aDescs.Reset();

	CleanupClosePushL(aDescs);

	// ownership of the data pointed by this array is with 

	// the plugin manager. 

	const RPointerArray<CImplementationInformation>& implInfo = iPluginMgr->ImplementationsL();

	TInt implCount = implInfo.Count();

	for (TInt i = 0; i < implCount; ++i)

		{

		// avoid RVCT warning C2874W: pi may be used before being set

		CAuthPluginInterface* pi = 0;

		TRAPD(r, pi = iPluginMgr->ImplementationL(i));

		// skip plugins which are not available

		if (KErrNone != r)

			continue;

		if (! (this->*aFilter)(*pi))

			{

			continue;

			}

		// get training status from db

		TAuthTrainingStatus ts = iAuthDb2->PluginStatusL(pi->Id());

		CPluginDesc* pd = CPluginDesc::NewL(

			pi->Id(), pi->Name(), pi->Type(),

			ts, pi->MinEntropy(),

			pi->FalsePositiveRate(), pi->FalseNegativeRate() );

		CleanupStack::PushL(pd);

		aDescs.AppendL(pd);

		CleanupStack::Pop(pd);

		}

	}

/**

	Build an array containing plugin descriptions for