/** 

 * XMLSec library

 *

 * X509 support

 *

 *

 * This is free software; see Copyright file in the source

 * distribution for preciese wording.

 * 

 * Copyright (C) 2002-2003 Aleksey Sanin <aleksey@aleksey.com>

 * Portion Copyright © 2009 Nokia Corporation and/or its subsidiary(-ies). All rights reserved. 

 */

#include "xmlsecc_config.h"

#ifndef XMLSEC_NO_X509

#include "xmlsecc_globals.h"

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <ctype.h>

#include <errno.h>

#include <libxml2_tree.h>

#include "xmlsec_xmlsec.h"

#include "xmlsec_xmltree.h"

#include "xmlsec_keys.h"

#include "xmlsec_keyinfo.h"

#include "xmlsec_keysmngr.h"

#include "xmlsec_base64.h"

#include "xmlsec_errors.h"

#include "xmlsecc_crypto.h"

#include "xmlsecc_x509wrapper.h"

#include "xmlsecc_x509.h"

#include "xmlsec_error_flag.h"

#define XMLSEC_OPENSSL_097

/**************************************************************************

 *

 * Internal SymbianCrypto X509 store CTX

 *

 *************************************************************************/

typedef struct _xmlSecSymbianCryptoX509StoreCtx		xmlSecSymbianCryptoX509StoreCtx, 

							*xmlSecSymbianCryptoX509StoreCtxPtr;

struct _xmlSecSymbianCryptoX509StoreCtx {

    X509_STORE* 	xst;

    STACK_OF(X509)* 	untrusted;

    STACK_OF(X509_CRL)* crls;

#if !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097)

    X509_VERIFY_PARAM * vpm;	    

#endif /* !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097) */

};	    

/****************************************************************************

 *

 * xmlSecSymbianCryptoKeyDataStoreX509Id:

 *

 * xmlSecSymbianCryptoX509StoreCtx is located after xmlSecTransform

 *

 ***************************************************************************/

#define xmlSecSymbianCryptoX509StoreGetCtx(store) \

    ((xmlSecSymbianCryptoX509StoreCtxPtr)(((xmlSecByte*)(store)) + \

				    sizeof(xmlSecKeyDataStoreKlass)))

#define xmlSecSymbianCryptoX509StoreSize	\

    (sizeof(xmlSecKeyDataStoreKlass) + sizeof(xmlSecSymbianCryptoX509StoreCtx))

static int		xmlSecSymbianCryptoX509StoreInitialize	(xmlSecKeyDataStorePtr store);

static void		xmlSecSymbianCryptoX509StoreFinalize		(xmlSecKeyDataStorePtr store);

static xmlSecKeyDataStoreKlass xmlSecSymbianCryptoX509StoreKlass = {

    sizeof(xmlSecKeyDataStoreKlass),

    xmlSecSymbianCryptoX509StoreSize,

    /* data */

    xmlSecNameX509Store,			/* const xmlChar* name; */ 

    /* constructors/destructor */

    xmlSecSymbianCryptoX509StoreInitialize,		/* xmlSecKeyDataStoreInitializeMethod initialize; */

    xmlSecSymbianCryptoX509StoreFinalize,		/* xmlSecKeyDataStoreFinalizeMethod finalize; */

    /* reserved for the future */

    NULL,					/* void* reserved0; */

    NULL,					/* void* reserved1; */

};

static int		xmlSecSymbianCryptoX509VerifyCrl			(X509_STORE* xst, 

									 X509_CRL *crl );

static X509*		xmlSecSymbianCryptoX509FindCert			(STACK_OF(X509) *certs,

									 xmlChar *subjectName,

									 xmlChar *issuerName, 

									 xmlChar *issuerSerial,

									 xmlChar *ski);

static X509*		xmlSecSymbianCryptoX509FindNextChainCert		(STACK_OF(X509) *chain, 

		    							 X509 *cert);

static int		xmlSecSymbianCryptoX509VerifyCertAgainstCrls		(STACK_OF(X509_CRL) *crls, 

								         X509* cert);

static X509_NAME*	xmlSecSymbianCryptoX509NameRead			(xmlSecByte *str, 

									 int len);

static int 		xmlSecSymbianCryptoX509NameStringRead			(xmlSecByte **str, 

									 int *strLen, 

									 xmlSecByte *res, 

									 int resLen, 

									 xmlSecByte delim, 

									 int ingoreTrailingSpaces);

static int		xmlSecSymbianCryptoX509NamesCompare			(X509_NAME *a,

									 X509_NAME *b);

static int 		xmlSecSymbianCryptoX509_NAME_cmp			(const X509_NAME *a, 

									 const X509_NAME *b);

/*

static int 		xmlSecSymbianCryptoX509_NAME_ENTRY_cmp		(const X509_NAME_ENTRY **a, 

									 const X509_NAME_ENTRY **b);

*/

/** 

 * xmlSecSymbianCryptoX509StoreGetKlass:

 * 

 * The SymbianCrypto X509 certificates key data store klass.

 *

 * Returns pointer to SymbianCrypto X509 certificates key data store klass.

 */

EXPORT_C

xmlSecKeyDataStoreId 

xmlSecSymbianCryptoX509StoreGetKlass(void) {

    return(&xmlSecSymbianCryptoX509StoreKlass);

}

/**

 * xmlSecSymbianCryptoX509StoreFindCert:

 * @store:		the pointer to X509 key data store klass.

 * @subjectName:	the desired certificate name.

 * @issuerName:		the desired certificate issuer name.

 * @issuerSerial:	the desired certificate issuer serial number.

 * @ski:		the desired certificate SKI.

 * @keyInfoCtx:		the pointer to <dsig:KeyInfo/> element processing context.

 *

 * Searches @store for a certificate that matches given criteria.

 *

 * Returns pointer to found certificate or NULL if certificate is not found

 * or an error occurs.

 */

EXPORT_C

X509* 

xmlSecSymbianCryptoX509StoreFindCert(xmlSecKeyDataStorePtr store, xmlChar *subjectName,

				xmlChar *issuerName, xmlChar *issuerSerial,

				xmlChar *ski, xmlSecKeyInfoCtx* keyInfoCtx) {

    xmlSecSymbianCryptoX509StoreCtxPtr ctx;

    X509* res = NULL;

    xmlSecAssert2(xmlSecKeyDataStoreCheckId(store, xmlSecSymbianCryptoX509StoreId), NULL);

    xmlSecAssert2(keyInfoCtx, NULL);

    ctx = xmlSecSymbianCryptoX509StoreGetCtx(store);

    xmlSecAssert2(ctx, NULL);

    if((!res) && (ctx->untrusted)) {

        res = xmlSecSymbianCryptoX509FindCert(ctx->untrusted, 

                                                            subjectName, 

                                                            issuerName, 

                                                            issuerSerial, 

                                                            ski);

    }

    return(res);

}

/**

 * xmlSecSymbianCryptoX509StoreVerify:

 * @store:		the pointer to X509 key data store klass.

 * @cert:		the untrusted key cert.

 *

 * Verifies @certs list.

 *

 * Returns Result of the verification

 */

EXPORT_C 

int 	

xmlSecSymbianCryptoX509StoreKeyCertVerify(xmlSecKeyDataStorePtr store, X509* cert) {

    xmlSecSymbianCryptoX509StoreCtxPtr ctx;

    X509* res = NULL;

    X509 *err_cert = NULL;

    char buf[256];

    int err = 0, depth;

    int i;

    int ret;

    xmlSecAssert2(xmlSecKeyDataStoreCheckId(store, xmlSecSymbianCryptoX509StoreId), NULL);

    xmlSecAssert2(cert, NULL);

    ctx = xmlSecSymbianCryptoX509StoreGetCtx(store);

    xmlSecAssert2(ctx, NULL);

    xmlSecAssert2(ctx->xst, NULL);

 if(!xmlSecCheckCertStoreFlag()) //SymbianCertStore Flag == FALSE

    {

    err = X509_STORE_certchain_init (ctx->xst, cert);

    if(err != 0) {

	xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "X509_STORE_certchain_init",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

	//goto done;

	    return -1;

        }       

    err = X509_STORE_certchain_validate(ctx->xst);

	if(err != 0) {

	xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "X509_STORE_certchain_init",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

	//goto done;

	    return -1;

        }	   

        return X509_STORE_certchain_getValidateResult(ctx->xst);    

    }

else    //SymbianCertStore Flag ==TRUE

    {  

        err = X509_STORE_certchain_init_fromCertStore(ctx->xst, cert);

        if(err != 0) {

	    xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "X509_STORE_certchain_init",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

	//goto done;

	    return -1;

        }

        err = X509_STORE_certchain_validate(ctx->xst);

        if(err != 0) {

	    xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "X509_STORE_certchain_init",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

	    //goto done;

	    return -1;

        }	          

        return X509_STORE_certchain_getValidateResult(ctx->xst);            

    } //else

}

/**

 * xmlSecSymbianCryptoX509StoreVerify:

 * @store:		the pointer to X509 key data store klass.

 * @certs:		the untrusted certificates stack.

 * @crls:		the crls stack.

 * @keyInfoCtx:		the pointer to <dsig:KeyInfo/> element processing context.

 *

 * Verifies @certs list.

 *

 * Returns pointer to the first verified certificate from @certs.

 */

EXPORT_C 

X509* 	

xmlSecSymbianCryptoX509StoreVerify(xmlSecKeyDataStorePtr store, XMLSEC_STACK_OF_X509* certs,

			     XMLSEC_STACK_OF_X509_CRL* crls, xmlSecKeyInfoCtx* keyInfoCtx) {

    xmlSecSymbianCryptoX509StoreCtxPtr ctx;

    STACK_OF(X509)* certs2 = NULL;	

    X509* res = NULL;

    X509* cert = NULL;

    X509 *err_cert = NULL;

    char buf[256];

    int err = 0, depth;

    int i;

    int ret;

    xmlSecAssert2(xmlSecKeyDataStoreCheckId(store, xmlSecSymbianCryptoX509StoreId), NULL);

    xmlSecAssert2(certs, NULL);

    xmlSecAssert2(keyInfoCtx, NULL);

    ctx = xmlSecSymbianCryptoX509StoreGetCtx(store);

    xmlSecAssert2(ctx, NULL);

    xmlSecAssert2(ctx->xst, NULL);

    err = X509_STORE_certchain_init (ctx->xst, certs);

    if(err != 0) {

	xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "X509_STORE_certchain_init",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

    }

    err = X509_STORE_certchain_validate(ctx->xst);

	if(err != 0) {

	xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "X509_STORE_certchain_init",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

    }	   

    ret = X509_STORE_certchain_getValidateResult(ctx->xst);

	if(ret == 1) {

		res = cert;

	}    

#ifdef XMLSEC_FUTURE_SUPPORT  

    /* dup certs */

    /*

    certs2 = sk_X509_dup(certs);

    if(certs2 == NULL) {

	xmlSecError(XMLSEC_ERRORS_HERE,

		    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

		    "sk_X509_dup",

		    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    XMLSEC_ERRORS_NO_MESSAGE);

	goto done;

    }

	*/

    /* add untrusted certs from the store */

#ifndef XMLSEC_NO_X509_UNTRUST    

    if(ctx->untrusted) {

	for(i = 0; i < sk_X509_num(ctx->untrusted); ++i) { 

	    ret = sk_X509_push(certs2, sk_X509_value(ctx->untrusted, i));

	    if(ret < 1) {

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "sk_X509_push",

			    XMLSEC_ERRORS_R_CRYPTO_FAILED,

			    XMLSEC_ERRORS_NO_MESSAGE);

		goto done;

	    }

	}

    }

#endif //XMLSEC_NO_X509_UNTRUST

#ifndef XMLSEC_NO_X509_CRL 

    /* dup crls but remove all non-verified */   

    if(crls) {

	crls2 = sk_X509_CRL_dup(crls);

	if(!crls2) {

	    xmlSecError(XMLSEC_ERRORS_HERE,

			xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			"sk_X509_CRL_dup",

			XMLSEC_ERRORS_R_CRYPTO_FAILED,

			XMLSEC_ERRORS_NO_MESSAGE);

	    goto done;

	}

	for(i = 0; i < sk_X509_CRL_num(crls2); ) { 

	    ret = xmlSecSymbianCryptoX509VerifyCrl(ctx->xst, sk_X509_CRL_value(crls2, i));

	    if(ret == 1) {

		++i;

	    } else if(ret == 0) {

		sk_X509_CRL_delete(crls2, i);

	    } else {

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "xmlSecSymbianCryptoX509VerifyCrl",

			    XMLSEC_ERRORS_R_XMLSEC_FAILED,

			    XMLSEC_ERRORS_NO_MESSAGE);

		goto done;

	    }

	}	

    }

    /* remove all revoked certs */

    for(i = 0; i < sk_X509_num(certs2);) { 

	cert = sk_X509_value(certs2, i);

	if(crls2) {

	    ret = xmlSecSymbianCryptoX509VerifyCertAgainstCrls(crls2, cert);

	    if(ret == 0) {

		sk_X509_delete(certs2, i);

		continue;

	    } else if(ret != 1) {

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "xmlSecSymbianCryptoX509VerifyCertAgainstCrls",

			    XMLSEC_ERRORS_R_XMLSEC_FAILED,

			    XMLSEC_ERRORS_NO_MESSAGE);

		goto done;

	    }

	}	    	    

	if(ctx->crls) {

	    ret = xmlSecSymbianCryptoX509VerifyCertAgainstCrls(ctx->crls, cert);

	    if(ret == 0) {

		sk_X509_delete(certs2, i);

		continue;

	    } else if(ret != 1) {

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "xmlSecSymbianCryptoX509VerifyCertAgainstCrls",

			    XMLSEC_ERRORS_R_XMLSEC_FAILED,

			    XMLSEC_ERRORS_NO_MESSAGE);

		goto done;

	    }

	}

	++i;

    }	

#endif //XMLSEC_NO_X509_CRL

    /* get one cert after another and try to verify */

    for(i = 0; i < sk_X509_num(certs2); ++i) { 

	cert = sk_X509_value(certs2, i);

	if(!xmlSecSymbianCryptoX509FindNextChainCert(certs2, cert)) {

	    X509_STORE_CTX xsc; 

#if !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097)

	    X509_VERIFY_PARAM * vpm = NULL;	    

	    unsigned long vpm_flags = 0;

	    vpm = X509_VERIFY_PARAM_new();

	    if(!vpm) {

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "X509_VERIFY_PARAM_new",

		    	    XMLSEC_ERRORS_R_CRYPTO_FAILED,

			    XMLSEC_ERRORS_NO_MESSAGE);

	        goto done;

	    }

	    vpm_flags = vpm->flags;

/*

	    vpm_flags &= (~X509_V_FLAG_X509_STRICT);

*/

	    vpm_flags &= (~X509_V_FLAG_CRL_CHECK);

	    X509_VERIFY_PARAM_set_depth(vpm, 9);  

	    X509_VERIFY_PARAM_set_flags(vpm, vpm_flags);

#endif /* !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097) */

	    X509_STORE_CTX_init (&xsc, ctx->xst, cert, certs2);

	    if(keyInfoCtx->certsVerificationTime > 0) {	

#if !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097)

		vpm_flags |= X509_V_FLAG_USE_CHECK_TIME;

	        X509_VERIFY_PARAM_set_time(vpm, keyInfoCtx->certsVerificationTime);

#endif /* !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097) */

		X509_STORE_CTX_set_time(&xsc, 0, keyInfoCtx->certsVerificationTime);

	    }

#if !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097)

	    X509_STORE_CTX_set0_param(&xsc, vpm);	    

#endif /* !defined(XMLSEC_OPENSSL_096) && !defined(XMLSEC_OPENSSL_097) */

	    ret 	= X509_verify_cert(&xsc); 

	    err_cert 	= X509_STORE_CTX_get_current_cert(&xsc);

	    err	 	= X509_STORE_CTX_get_error(&xsc);

	    depth	= X509_STORE_CTX_get_error_depth(&xsc);

	    X509_STORE_CTX_cleanup (&xsc);  

	    if(ret == 1) {

		res = cert;

		goto done;

	    } else if(ret < 0) {

		const char* err_msg;

		buf[0] = '\0';

	        X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof buf);

		err_msg = X509_verify_cert_error_string(err);

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "X509_verify_cert",

			    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    	    "subj=%s;err=%d;msg=%s", 

			    xmlSecErrorsSafeString(buf),

			    err, 

			    xmlSecErrorsSafeString(err_msg));

		goto done;

	    } else if(ret == 0) {

		const char* err_msg;

		buf[0] = '\0';

	        X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof buf);

		err_msg = X509_verify_cert_error_string(err);

		xmlSecError(XMLSEC_ERRORS_HERE,

			    xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			    "X509_verify_cert",

			    XMLSEC_ERRORS_R_CRYPTO_FAILED,

		    	    "subj=%s;err=%d;msg=%s", 

			    xmlSecErrorsSafeString(buf),

			    err, 

			    xmlSecErrorsSafeString(err_msg));

	    }

	}

    }

    /* if we came here then we found nothing. do we have any error? */

    if((err != 0) && (err_cert)) {

	const char* err_msg;

	err_msg = X509_verify_cert_error_string(err);

	switch (err) {

	case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:

	    X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, sizeof buf);

	    xmlSecError(XMLSEC_ERRORS_HERE,

			xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			NULL,

			XMLSEC_ERRORS_R_CERT_ISSUER_FAILED,

		        "err=%d;msg=%s;issuer=%s", 

			err, 

			xmlSecErrorsSafeString(err_msg),

			xmlSecErrorsSafeString(buf));

	    break;

	case X509_V_ERR_CERT_NOT_YET_VALID:

	case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:

	    xmlSecError(XMLSEC_ERRORS_HERE,

			xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			NULL,

			XMLSEC_ERRORS_R_CERT_NOT_YET_VALID,

			"err=%d;msg=%s", err,

			xmlSecErrorsSafeString(err_msg));

	    break;

	case X509_V_ERR_CERT_HAS_EXPIRED:

	case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:

	    xmlSecError(XMLSEC_ERRORS_HERE,

			xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			NULL,

			XMLSEC_ERRORS_R_CERT_HAS_EXPIRED,

			"err=%d;msg=%s", err,

			xmlSecErrorsSafeString(err_msg));

	    break;

	default:			

	    xmlSecError(XMLSEC_ERRORS_HERE,

			xmlSecErrorsSafeString(xmlSecKeyDataStoreGetName(store)),

			NULL,

			XMLSEC_ERRORS_R_CERT_VERIFY_FAILED,