/*

* Copyright (c) 1997-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

/**

 @file 

 @released

 @internalTechnology

*/

#include <f32file.h>

#include "securitymanager.h"

#include "swi/sishash.h"

#include "swi/sisdataprovider.h"

#include "swi/sissignaturealgorithm.h"

#include "swi/sissignaturecertificatechain.h"

#include "swi/siscertificatechain.h"

#include "swi/sisinfo.h"

#include "swi/sissupportedoptions.h"

#include "swi/sissupportedlanguages.h"

#include "swi/sisprerequisites.h"

#include "swi/sislogo.h"

#include "swi/sisproperties.h"

#include "swi/sisinstallblock.h"

#include "swi/sistruststatus.h"

#include "hashcontainer.h"

#include "certchainconstraints.h"

#include "devinfosupportclient.h"

#include "log.h"

// PKIX dependencies

#include <pkixcertchain.h>

#include <x509keys.h> 

#include <ocsp.h>

#include <securitydefsconst.h>

#include <ccertattributefilter.h>

#include <ct/mcttoken.h>

//#include <mctcertstore.h>

#include "cfstokentypeclient.h"

// Crypto dependencies

#include <hash.h>

#include <swicertstore.h>

// SecMan includes

#include "chainvalidator.h"

#include "certificateretriever.h"

#include "signatureverifier.h"

#include "securitypolicy.h"

#include "revocationhandler.h"

const TInt KFileBufferSize = 1024;  // 1k buffer used to read the data to be hashed

_LIT(KSecurityManagerName, "_Security_Manager_");

using namespace Swi;

//

// Life Cycle methods

//

EXPORT_C CSecurityManager* CSecurityManager::NewL()

	{

	CSecurityManager* self = CSecurityManager::NewLC();

	CleanupStack::Pop(self);

	return self;

	}

EXPORT_C CSecurityManager* CSecurityManager::NewLC()

	{

	CSecurityManager* self = new(ELeave) CSecurityManager();

	CleanupStack::PushL(self);

	self->ConstructL();

	return self;

	}

EXPORT_C CSecurityPolicy& CSecurityManager::SecurityPolicy() const

	{

	return *iSecPolicy;

	}

CSecurityManager::CSecurityManager() : CActive(EPriorityNormal) 

	{

	CActiveScheduler::Add(this);	

	}

CSecurityManager::~CSecurityManager()

	{	

	Deque();

	if (iCurrentPkixChain)

		{

		delete iCurrentPkixChain;

		}

	if (iCertStore)

		{

		iCertStore->Release();

		}

	if (iCertificateRetriever)

		{

		delete iCertificateRetriever;

		}

	if (iChainValidator)

		{

		delete iChainValidator;

		}

	if (iRevocationHandler)

		{

		delete iRevocationHandler;

		}

	iValidPkixChains.ResetAndDestroy();

	iUntrustedRoots.ResetAndDestroy();

	iDeviceIDs.ResetAndDestroy();

	TInt count = iTrustedRoots.Count();

	// Release certificates from the list

	for (TInt i = 0; i < count; ++i)

		{

		iTrustedRoots[0]->Release(); 

		iTrustedRoots.Remove(0);

		}

	iTrustedRoots.Close();	

	iCertMetaInfo.Reset();

	iFs.Close();

	}

void CSecurityManager::ConstructL()

	{	

	User::LeaveIfError(iFs.Connect());

	iSecPolicy = CSecurityPolicy::GetSecurityPolicyL();	

	iCertStore=CSWICertStore::NewL(iFs);

	}

//

// Active Objects methods

//

void CSecurityManager::RunL()

	{

	DEBUG_PRINTF3(_L8("Security Manager - RunL(). State: %d, Status: %d."),

		iState, iStatus.Int());

	if (iStatus.Int() != KErrNone)

		{

		User::Leave(iStatus.Int());     // Hop into RunError()

		}

	switch (iState)

		{ 			

		case ERetrievedTrustedRoots:

			{

			iCertMetaInfo.Reset();

			TInt trustedCertCount = iTrustedRoots.Count();

			for (TInt i = 0; i < trustedCertCount; ++i)

				{

				CCTCertInfo& certInfo=*iTrustedRoots[i];

				DEBUG_CODE_SECTION(			

					DEBUG_PRINTF2(_L("Security Manager - SWI certstore contains trust anchor certificate '%S'"),

						&(certInfo.Label()));

						);

				TCertMetaInfo metaInfo = iCertStore->CertMetaInfoL(certInfo);

				iCertMetaInfo.AppendL(metaInfo);

				if (metaInfo.iIsMandatory)		

					{

					iMandatoryCertDNCount++;

					DEBUG_CODE_SECTION(			

					DEBUG_PRINTF2(_L("Security Manager - SWI certstore contains mandatory certificate '%S'"),

						&(certInfo.Label()));

						);

					}

				if (metaInfo.iIsSystemUpgrade)		

					{

					DEBUG_CODE_SECTION(			

					DEBUG_PRINTF2(_L("Security Manager - SWI certstore contains system upgrade certificate '%S'"),

						&(certInfo.Label()));

						);

					}

				}

			// After we get here, we have retrieved mandatory certificates

			// We may have an unsigned sis file in which case we do not want to verify the block

			// since there isn't one, so bail here with the correct error

			if (iChains.Count() == 0)

					{

					if (iMandatoryCertDNCount == 0)

						{

						*iResult = ESignatureNotPresent; // No mandatory certs, so just say unsigned

						}

					else

						{

						*iResult = EMandatorySignatureMissing; // more important error code overrides

						}

					User::RequestComplete(iClientStatus, KErrNone);							

					break;

					}

			VerifyBlockL(iCurrentChain);			

			}

			break;

		case EValidatingChain :

			{

			CPKIXValidationResultBase* result = (*iValidationResultsOut)[iCurrentChain];

			::TValidationStatus resultStatus = result->Error(); 	

			DEBUG_PRINTF3(_L8("Security Manager - Certificate validation result was %d. (If applicable, error on certificate %d.)"),

				resultStatus.iReason, resultStatus.iCert);

			iCurrentChain++; // Next chain to validate

			if (resultStatus.iReason != EValidatedOK)

				{

				// we can discard the invalid cert chain

				delete iCurrentPkixChain;

				iCurrentPkixChain = NULL;

				// ooops

				if (iChains.Count() > iCurrentChain)   // This is the ValidateANY policy

					{

					VerifyBlockL(iCurrentChain);

					break;						

					}

				}

			else

				{

				iHasValidated = ETrue; // At least one chain has been validated! Hurrah!

				// check if a chain has validated that is not self signed

				if (*iResult != ESignatureSelfSigned)

					{

					iHasValidatedTrusted = ETrue;

					}

			    // From here on the chain has been validated successfully

			    iTotalCapabilitiesOut->Union(iCurrentCapabilities); // Update the total capabilities

			    // Reduce the count from the list of mandatory certs

			    UpdateListOfMissingRequiredCertsL(iCurrentPkixChain->Cert(iCurrentPkixChain->Count()-1));

				// Updage the System Upgrade status of the Certificate

				UpdateSystemUpgradeCertStatusL(iCurrentPkixChain->Cert(iCurrentPkixChain->Count()-1));

			    User::LeaveIfError(iValidPkixChains.Append(iCurrentPkixChain));

			    // this chain will be used for OCSP checking if required, so record it.

			    iController->AddChainIndex(iCurrentChain-1);

			    iCurrentPkixChain = NULL;

				}

			if (iCurrentChain == iChains.Count())

				{

				if (iMandatoryCertDNCount == 0)

					{

					// Mandatory certs prerequisites met				

					if (iHasValidated)

						{

						//Build the certificate chain constraints

						CCertChainConstraints* certChainConstraints(0);

						TRAPD(err, certChainConstraints=CCertChainConstraints::NewL(iValidPkixChains));

						if (err)

							{

							*iResult = ECertificateValidationError;

							User::RequestComplete(iClientStatus, KErrNone);

							return;

							}

						*iResult = iHasValidatedTrusted ? EValidationSucceeded : ESignatureSelfSigned;

						//Pass the certificate chain constraints ownership to controller

						Sis::CController* controller=const_cast<Sis::CController*>(iController);

						controller->SetCertChainConstraints(certChainConstraints);

						//Set the dev cert found flag if dev cert first time found

						if (iDevCertWarningState==ENoDevCerts && 

							(certChainConstraints->SIDsAreConstrained() 

							||certChainConstraints->VIDsAreConstrained()

							||certChainConstraints->DeviceIDsAreConstrained()

							||certChainConstraints->CapabilitiesAreConstrained()))

							{

							DEBUG_PRINTF(_L("Security Manager - At least one certificate chain contains a devcert."));

							iDevCertWarningState=EFoundDevCerts;

							}

						//Check if the device id is contrained and the device Id has been retrieved

						if (certChainConstraints->DeviceIDsAreConstrained() && iDeviceIDs.Count()==0)

							{

				 			//Retrieve and Save the device ID list then complete

				 			RDeviceInfo deviceInfo;

				 			User::LeaveIfError(deviceInfo.Connect());

				 			CleanupClosePushL(deviceInfo);

 							const RPointerArray<HBufC>& tempbuf=deviceInfo.DeviceIdsL();

				 			for (TInt i=0;i<tempbuf.Count();i++)

					 			{

					 			HBufC* element=tempbuf[i]->AllocLC();

				  				iDeviceIDs.AppendL(element);

				  				CleanupStack::Pop(element);	 				

					 			}

					 		CleanupStack::PopAndDestroy(&deviceInfo);					

							}						

						iState = EChecksDone;

						TRequestStatus* status = &iStatus;

						User::RequestComplete(status, KErrNone);

						SetActive();

						return;

						}

					}

				if (iMandatoryCertDNCount != 0)

					{

					*iResult = EMandatorySignatureMissing;  // We did not meet mandatory cert requirements!

					}

				else

					{

					if (!iHasValidated) 

						{

						*iResult = ECertificateValidationError; // No chain ever validated 

						}

					}

				User::RequestComplete(iClientStatus, KErrNone);							

				}

			else

				{

				VerifyBlockL(iCurrentChain);

				return;					

				}

			}

			break;

		case ERevalidatingChain:

			{

			TInt chainIndex = (*iChainListIndices)[iCurrentChain];

			CPKIXValidationResultBase* result = (*iValidationResultsOut)[iCurrentChain];

			::TValidationStatus resultStatus = result->Error(); 	

			DEBUG_PRINTF3(_L8("Security Manager - Certificate validation result was %d. (If applicable, error on certificate %d.)"),

				resultStatus.iReason, resultStatus.iCert);

			iCurrentChain++; // Next chain to validate

			if (resultStatus.iReason != EValidatedOK)

				{

				// We can discard the invalid chain.

				delete iCurrentPkixChain;

				iCurrentPkixChain = NULL;

				// ooops

				if (iChains.Count() > chainIndex)  	

					{ // This is the ValidateANY policy

					VerifyBlockL(chainIndex);

					break;						

					}

				}

			else

				{

				iHasValidated = ETrue; // At least one chain has been validated! Hurrah!

				// check if a chain has validated that is not self signed

				if (*iResult != ESignatureSelfSigned)

					{

					iHasValidatedTrusted = ETrue;

					}

				// From here on the chain has been validated successfully

				iTotalCapabilitiesOut->Union(iCurrentCapabilities); // Update the total capabilities

				// Reduce the count from the list of mandatory certs

				UpdateListOfMissingRequiredCertsL(iCurrentPkixChain->Cert(iCurrentPkixChain->Count()-1));

				// Updage the System Upgrade status of the Certificate

				UpdateSystemUpgradeCertStatusL(iCurrentPkixChain->Cert(iCurrentPkixChain->Count()-1));

				iValidPkixChains.AppendL(iCurrentPkixChain);

				iCurrentPkixChain = NULL;

				}

			if (chainIndex == iChains.Count())

				{

				if (iHasValidated)

					{

					//Build the certificate chain constraints

					CCertChainConstraints* certChainConstraints(0);

					TRAPD(err, certChainConstraints=CCertChainConstraints::NewL(iValidPkixChains));

					if (err)

						{

						*iResult = ECertificateValidationError;

						User::RequestComplete(iClientStatus, KErrNone);

						return;

						}

					else

						{

						*iResult = iHasValidatedTrusted ? EValidationSucceeded : ESignatureSelfSigned;								

						}

					//Pass the certificate chain constraints ownership to controller

					Sis::CController* controller=const_cast<Sis::CController*>(iController);

					controller->SetCertChainConstraints(certChainConstraints);

					//Check if the device id is contrained and the device Id has been retrieved

					if (certChainConstraints->DeviceIDsAreConstrained() && iDeviceIDs.Count()==0)

						{

				 		//Retrieve and Save the device ID list then complete

				 		RDeviceInfo deviceInfo;

				 		User::LeaveIfError(deviceInfo.Connect());

				 		CleanupClosePushL(deviceInfo);

 						const RPointerArray<HBufC>& tempbuf=deviceInfo.DeviceIdsL();

				 		for (TInt i=0;i<tempbuf.Count();i++)

					 		{

							HBufC* element=tempbuf[i]->AllocLC();

			  				iDeviceIDs.AppendL(element);

			  				CleanupStack::Pop(element);	 				

					 		}

					 	CleanupStack::PopAndDestroy(&deviceInfo);					

						}						

					iState = EChecksDone;

					TRequestStatus* status = &iStatus;

					User::RequestComplete(status, KErrNone);

					SetActive();

					return;

					}

				else

					{

					*iResult = ECertificateValidationError; // No chain ever validated 

					}

				User::RequestComplete(iClientStatus, KErrNone);							

				}

			else

				{

				VerifyBlockL(chainIndex);

				return;					

				}

			}

			break;

		case EOCSPCheck:

			{

			iState = EChecksDone;

			ProcessOcspOutcomesL();

			TRequestStatus* status = &iStatus;

			User::RequestComplete(status, KErrNone);

			SetActive();			

			}

			break;

		case EChecksDone:

			{

			// If the validation is done by certs passed by third party(API user)

			// instead of cert-store then even on successful validation

			// the result of validation is ESignatureSelfSigned. 

			// But if iUntrustedRoots count is not zero then the result is

			// really ESignatureSelfSigned.

			if (NULL != iRootCerts && iHasValidated)

				{

				*iResult = EValidationSucceeded;

				}

			// Complete the client and be happy

			User::RequestComplete(iClientStatus, KErrNone);			

			}

			break;

		default:

			{

			User::Panic(KSecurityManagerName, 1); 		

			}

		}

	}

void CSecurityManager::ProcessOcspOutcomesL() 

	{

	 // Identify the worst outcome overall, and the worst in each chain.

 	// The OCSP outcomes are in the same order as the valid chains and

 	// certificates within them, with the number of outcomes per chain

 	// one fewer than the number of certs in the chain.

	TInt numOutcomes=iRevocationHandler->TransactionCount();

	TInt currentChain = 0;

 	TInt chainErrorLevel = 0;

 	// Since the number of outcomes is 1 fewer than the number of certs in the

 	// PkixChain, the index for the last outcome of the first chain will be

 	// 2 lower than the number of certs in the chain.

 	TInt chainLastOutcomeIndex = iValidPkixChains[0]->Count() - 2;

 	TInt chainWorstOutcome = 0;

	// This variable is used to record the most serious error condition.

	TInt errorLevel = 0;

	DEBUG_PRINTF2(_L8("Security Manager - OCSP check complete. %d OCSP outcomes."), numOutcomes);

	for (TInt i=0; i<numOutcomes; i++)

		{

		const TOCSPOutcome& outcome=iRevocationHandler->Outcome(i);