/*

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

#include "certificatechain.h"

using namespace std;

CertificateChain::CertificateChain()

	:iDevCertificate (false) ,

	iDevCapabilities (0) ,

	iValidationStatus (EValidationSuccessful) 

	{

	}

bool CertificateChain::ValidateChain(const Options& aOptions , const string& aFile , const SWICertStore& aStore )

	{

	X509* endEntity = NULL ;

	X509* previous = NULL ; 

	X509* current = NULL;

	ASN1_UTCTIME* from = NULL ;

	ASN1_UTCTIME* to = NULL;

	char buf[KLength];

	int count = 0;

	int verify = 0;

	string issuer ; 

	bool isValid = false ;

	const char* fileName = aFile.c_str();

	FILE *fp = fopen(fileName,"r");

	if(fp == NULL)

		{

		throw EUnableToOpenFile ; 

		}

	do

		{

		current = PEM_read_X509 (fp, NULL, NULL, NULL);

		//end entity will hold the first certificate in the chain which signs the sis file.

		if(count == 0 && current)

			{

			endEntity = current;

			}

		if(current)

			{

			X509_NAME_oneline (X509_get_issuer_name (current) , buf , KLength);

			iCertificateChain.push_back(buf);

			X509_NAME_oneline (X509_get_subject_name (current), buf , KLength);

			iCertificateChain.push_back(buf);

			from = X509_get_notBefore (current);			

			to = X509_get_notAfter (current);

			ExtractCertValidityPeriod(*from , *to);

			//validity period status

			int validFrom = X509_cmp_current_time(from);

			int validTo = X509_cmp_current_time(to);

			//check whether "Valid From" is less than the current time and 

			//"Valid To" is greater than current time for each certificate in the chain.

			//If check fails,current time is not within certificate's validity period.

			if(validFrom >= 0 || validTo <= 0)

				{

				iValidationStatus = iValidationStatus | EValidityCheckFailure ;

				}

			//count is greater than one when there is more than 1 certificate in the chain	

			//so that the public key of the next certificate is used to verify the signature of 

			//previous certificate in the chain.

			if(count)

				{

				EVP_PKEY* pubKey = X509_get_pubkey(current);

				if (!pubKey)

					{

#ifdef DUMPCHAINVALIDITYTOOL

					cout << "no public key in certificate" << endl;

#endif

					fclose(fp);

					return false;

					}

				//Signature validation.

				if(count == 1)

					{

					verify = X509_verify(endEntity,pubKey);

					}

				else

					{

					verify = X509_verify(previous,pubKey);

					}

				if(!verify)

					{

					iValidationStatus = iValidationStatus | EBrokenChain ;

					}

				if(previous)

					{

					X509_free (previous);

					}

				previous = current;

				}

			count++;

			}

		}while(current);

	fclose(fp);

	CheckForChainValidity(iValidationStatus);

	//check whether end entity is devcert,self signed or others.

	iDevCertificate = CheckIfDevCert(*endEntity);

	if(iDevCertificate)

		{

#ifdef DUMPCHAINVALIDITYTOOL

		cout << "SIS File is signed with a Developer Certificate with Constraints :\n" << endl;

		cout << iDevConstraints << endl;

#endif

		}

	// end entity certificate is self signed

	else if(CheckIfSelfSigned(*endEntity))

		{

#ifdef DUMPCHAINVALIDITYTOOL

		cout << ": SIS File is signed by a Self Signed Certificate " << endl;

#endif

		}

	//check whether the last certificate in the chain is validated against the certstore.

	//if there is only 1 certificate in the chain .

	if(count == 1)

		{

		isValid = ValidateWithCertstore(*endEntity , aStore , issuer);

		}

	else 

		{

		isValid = ValidateWithCertstore(*previous , aStore , issuer);

		}

	if(previous)

		{

		X509_free (previous);

		previous = NULL ;

		}

	if(endEntity)

		{

		X509_free (endEntity);

		endEntity = NULL ; 

		}

	if(isValid)

		{

#ifdef DUMPCHAINVALIDITYTOOL	

		cout << "Is Validated By : " << issuer << endl << endl;

#endif

		return true;

		}

	return false;

	}

void CertificateChain::ExtractCertValidityPeriod(const ASN1_UTCTIME& aFrom , const ASN1_UTCTIME& aTo)

	{

	char date [12] = "xx/xx/xx";

	date [0] = aFrom . data [4];

	date [1] = aFrom . data [5];

	date [3] = aFrom . data [2];

	date [4] = aFrom . data [3];

	date [6] = aFrom . data [0];

	date [7] = aFrom . data [1];

	iCertificateChain.push_back(date);

	date [0] = aTo . data [4];

	date [1] = aTo . data [5];

	date [3] = aTo . data [2];

	date [4] = aTo . data [3];

	date [6] = aTo . data [0];

	date [7] = aTo . data [1];

	iCertificateChain.push_back(date);

	}

void CertificateChain::DisplaySigningChain(const StringVector& aSigningChain)

	{

	if(aSigningChain.size())

		{

		std::vector<std::string>::const_iterator chainIter = aSigningChain.begin();	

		do

			{

			cout << "Issued By : " << (*chainIter) << endl;

			++chainIter;

			cout << "Issued To : " << (*chainIter) << endl;

			++chainIter;

			cout << "Valid From : " << (*chainIter) << endl;

			++chainIter;

			cout << "Valid To : " << (*chainIter) << endl << endl;

			++chainIter;

			}while(chainIter != aSigningChain.end());	

		}

	}

bool CertificateChain::CheckIfDevCert(X509& aEndEntity) 

	{

	X509_EXTENSION* extension = NULL;

	ASN1_OCTET_STRING* extData = NULL;

	ASN1_OBJECT * asnObj = NULL;

	int	constraintCount = X509_get_ext_count(&aEndEntity);

	for(int k = 0 ; k < constraintCount ; k++)

		{

		extension = X509_get_ext(&aEndEntity, k);

		extData = X509_EXTENSION_get_data(extension);

		asnObj = X509_EXTENSION_get_object(extension);

		char buf[KLength];

		i2t_ASN1_OBJECT(buf, KLength, asnObj);

		//all the constraints in the vector are compared against the predefined ones.

		if(KDeviceIdListConstraint.compare(buf) == 0)

			{

			iDevConstraints.append("DeviceId Constraints :\n\n");

			string deviceId = ExtractDeviceConstaints(extData);

			//only if device id constraint is present in devcert,append value to iDevConstraints

			if(deviceId.length())

				{

				iDevConstraints.append(deviceId);

				}

			else

				{

				iDevConstraints.append("Empty Device Constraints List. \n");

				}

			}

		else if(KSidListConstraint.compare(buf) == 0)

			{

			iDevConstraints.append("\nSID Constraints :\n\n");

			string sid = ExtractASN1IntegerData(extData);

			if(sid.length())

				{

				iDevConstraints.append(sid);

				}

			else

				{

				iDevConstraints.append("Empty SID Constraints List. \n");

				}

			}

		else if(KVidListConstraint.compare(buf) == 0)

			{

			iDevConstraints.append("\nVID Constraints :\n\n");

			string vid = ExtractASN1IntegerData(extData);

			if(vid.length())

				{

				iDevConstraints.append(vid);

				}

			else

				{

				iDevConstraints.append("Empty VID Constraints List.\n");

				}

			}

		else if(KCapabilitiesConstraint.compare(buf) == 0)

			{

			iDevConstraints.append("\nCapabilities Constraints :\n\n");

			string capabilities = ExtractCapabilities(extData);

			if(capabilities.length())

				{

				iDevConstraints.append(capabilities);

				}

			else

				{

				iDevConstraints.append("Empty Capabilitites Constraints List. \n");

				}

			}

		}

	//if there are constaints with oid matching the predefined ones,they are devcerts

	if(iDevConstraints.length())

		{

		return true;

		}

	return false;

	}

bool CertificateChain::CheckIfSelfSigned(X509& aEndEntity) 

	{

	char buf[KLength] ;

	string issuer ;

	string subject ;

	X509_NAME_oneline (X509_get_issuer_name (&aEndEntity), buf, KLength);

	issuer = buf;

	X509_NAME_oneline (X509_get_subject_name (&aEndEntity), buf, KLength);

	subject = buf;

	if((issuer.compare(subject)) == 0)

		{

		EVP_PKEY* pubKey = X509_get_pubkey(&aEndEntity);

		if (!pubKey)

			{

#ifdef DUMPCHAINVALIDITYTOOL

			cout << "no public key in certificate" << endl;

#endif

			return false;

			}

		int verify = X509_verify(&aEndEntity, pubKey);

		if(verify)

			{

			return true;

			}

		}

	return false;

	}

bool CertificateChain::ValidateWithCertstore(X509& aPrevious, const SWICertStore& aStore , string& aIssuer)	

	{

	int verifyWithRoot = 0;

	const vector <X509*>& certStoreVector = aStore.GetRootCertVector();

	if(certStoreVector.size())

		{

		char buf[KLength];

		for(std::vector<X509*>::const_iterator root = certStoreVector.begin(); root != certStoreVector.end(); ++root)

			{

			EVP_PKEY* pubkey = X509_get_pubkey(*root);

			if (!pubkey)

				{

#ifdef DUMPCHAINVALIDITYTOOL

				cout << "no public key in certificate" << endl;

#endif

				return false;

				}

			verifyWithRoot = X509_verify(&aPrevious, pubkey);

			if(verifyWithRoot)

				{

				X509_NAME_oneline (X509_get_issuer_name (*root),buf, KLength);

				char* issued = strstr (buf, "/CN=");

				if (issued)

					{

					issued += 4;

					char* end = strchr (issued, '/');

					if (end)

						{

						*end = 0;

						}

					aIssuer=issued;

					string rootSignature((const char*)(aPrevious.signature->data) , (aPrevious.signature->length));

					iValidatedRootSignatures = rootSignature;

				}

				return true;

				}

			}

		}

	return false;

	}

void CertificateChain::CheckForChainValidity(const int& aValidationStatus)

	{

#ifdef DUMPCHAINVALIDITYTOOL

	cout << "Certificate Chain :" << endl << endl;

	switch(aValidationStatus)

		{

		case 0:

			{

			DisplaySigningChain(iCertificateChain);

			break;

			}

		case 1:

			{

			DisplaySigningChain(iCertificateChain);

			cout << "Invalid Certificate Chain : Validity Period Check Failed" << endl;

			break;

			}

		case 2:

			{

			DisplaySigningChain(iCertificateChain);

			cout << "Broken Chain : Signature Verification Failed" << endl;

			break;

			}

		case 3:

			{

			DisplaySigningChain(iCertificateChain);

			cout << "Signature Verification and Validity Period Check Failed " << endl;

			break;

			}

		default:

			{

			cout << "Error" << endl;

			break;

			}

		}

#endif

	}

string CertificateChain ::ExtractCapabilities(const ASN1_BIT_STRING* aString)

	{

	string capabilities;

	unsigned char* buf = aString->data;

	int dataLen = strlen((const char*)buf);

	if(dataLen)

		{

		// check the type is "bitstring",where 3 represents bitstring.

		if (*(buf++) != KDerBitStringTag)

			{

			throw ENotADerBitString;

			}

		// Find the length of the bitstring contained in this buffer

		unsigned long len = GetBitStringLength(&buf);

		// skip the padding length field

		buf++;

		int capability = 0;

		while (len--)

			{

			char c = *(buf++);		

			for (int j = KByteLength-1 ; j >= 0; --j)

				{

				if (c & (1 << j))

					{

					if (capability < KNumberOfCaps)

						{

						capabilities.append(CapabilityList[capability]);

						capabilities.append("\n"); 

						}

					else

						{

						capabilities.append("Unknown"+capability);

						}

					}

				capability++;

				}

			}

		}

	cout<<endl;

	return capabilities;

	}

string CertificateChain ::ExtractASN1IntegerData(const ASN1_BIT_STRING* aString)	

	{

	string sid;

	char buf[KByteLength];

	unsigned char* buffer = aString->data;

	int dataLen = strlen((const char*)buffer);

	if(dataLen)

		{

		// check the type is "sequence".

		if (*(buffer++) != KDerSequenceTag)

			{

			throw ENotADerSequence;

			}

		// Find the length of the bitstring contained in this buffer

		unsigned long len = GetBitStringLength(&buffer);

		//each value(sid or vid) has length is 6,so divide total length by 6,to get the no of (sid or vid)values.

		int dataLen = len/(KByteLength-2);

		int data = 0;

		while (dataLen--)

			{

			//check whether it is a DER Integer tag

			if(*(buffer++) != KDerIntegerTag)

				{

				throw ENotADerInteger;

				}

			//skip the integer header

			buffer++;

			//read the 4 bytes containing the actual data(sid or vid)

			for (int j = (KByteLength-5); j >= 0; --j)

				{

				char c =  *(buffer++);

				sprintf(buf,"%2.2x",c);

				sid.append(buf);

				}

			sid.append("\n");	

			}

		}

	return sid;

	}

string CertificateChain::ExtractDeviceConstaints(const ASN1_BIT_STRING* aString)

	{

	string deviceId;

	unsigned char* buffer = aString->data;

	int dataLength = strlen((const char*)buffer);

	if(dataLength)

		{

		// check whether the type is "sequence".

		if (*(buffer++) != KDerSequenceTag)

			{

			throw ENotADerSequence;

			}

		// Find the length of the bitstring contained in this buffer

		unsigned long len = GetBitStringLength(&buffer);

		//each device id length is 22,so divide total length of the utf8 string by 22,to get the number of device id's.

		int noOfDeviceId = len/KDeviceIdLength;

		int data = 0;

		while (noOfDeviceId--)

			{