/*

* Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

/**

 @file 

 @internalComponent

 @released

*/

#ifdef _MSC_VER

#pragma warning (disable: 4786)

#endif // _MSC_VER

#include <openssl/err.h>

#include <openssl/x509.h>

#include <iostream>

#include "commontypes.h"

#include "sisblob.h"

#include "signsis.h"

#include "sissignaturecertificatechain.h"

#include "sisinstallblock.h"

#include "sissignature.h" 

CSignSis::CSignSis(const std::wstring aSisFileName)

	{

	ERR_load_crypto_strings ();

	OpenSSL_add_all_algorithms ();

	OpenSSL_add_all_ciphers ();

	OpenSSL_add_all_digests ();

	iSisContents.Load(aSisFileName);

	Verify();

	}

void CSignSis::SignSis(	const std::wstring& aOutputFileName, 

						const std::wstring& aCertificate, 

						const std::wstring& aPrivateKey, 

						const std::wstring& aPassPhrase, 

						const CSISSignatureAlgorithm::TAlgorithm aAlgorithm)

	{

	CSignatureCertChainData scc;

	CSisSignatureCertificateChain certChain(scc);

	CSISController& controller = const_cast<CSISController&>(iSisContents.Controller());

	certChain.Sign(aAlgorithm, aCertificate, aPrivateKey, aPassPhrase, controller.RawBuffer(), controller.BufferSize());

	controller.AddSignatureChain(scc);

	Verify();

	iSisContents.PrepareCrcs();

	iSisContents.Save(aOutputFileName);

	}

void CSignSis::RemoveSignature(const std::wstring& aOutputFileName)

	{

	CSISController& controller = const_cast<CSISController&>(iSisContents.Controller());

	controller.RemoveSignature();

	Verify();

	iSisContents.PrepareCrcs();

	iSisContents.Save(aOutputFileName);

	}

void CSignSis::RemoveAllSignatures(const std::wstring& aOutputFileName)

	{

	CSISController& controller = const_cast<CSISController&>(iSisContents.Controller());

	int signatureCount = 0;

	do

		{

		controller.RemoveSignature();

		signatureCount = controller.SignatureCount();

		}while(signatureCount > 0);

	iSisContents.PrepareCrcs();

	iSisContents.Save(aOutputFileName);

	}

void CSignSis::Verify()

	{

	// Verify CSISContents

	iSisContents.Verify(iSisContents.LanguageCount());

	const CSISController& controller = iSisContents.Controller();

	int signatureCount = controller.SignatureCount();

	// Verify all the signatures

	for(int i = 0; i < signatureCount; ++i)

		{

		CSignatureCertChainData& scc = const_cast<CSignatureCertChainData&>(controller.SignatureCertChain(i));

		CSisSignatureCertificateChain certChain(scc);

		certChain.VerifySignature(&controller, controller.PostHeaderPos());

		}

	// Verify stored hash with hash calculated from the files

	// Skip the sis files with no data present (pre-installed apps)

	if(iSisContents.SisData().DataPresent())

		{

		// Check that the hash values stored in each file description correlate with the actual file data 

		// provided. This prevents a sis file being signed if it contains an incorrect hash. It 

		// thus prevents the situation where a malicious file with the specified hash can later be 

		// substituted into the signed sis file.   

		VerifyHashAgainstFileData(iSisContents.InstallBlock(), iSisContents.DataUnit());

		}

	}

void CSignSis::VerifyHashAgainstFileData(const CSISInstallBlock& aInstallBlock, const CSISDataUnit& aDataUnit)

	{

	TFileDescList fileList;

	aInstallBlock.GetFileList(fileList);

	for(int i = 0; i < fileList.size(); ++i)

		{

		const CSISFileDescription* fdesc = fileList[i];

		// Retrieve the stored hash data 

		const CSISHash& storedSisHash = fdesc->Hash();   

		CSISBlob storedDigestBlob = storedSisHash.Blob();

		TUint8* storedDigest = storedDigestBlob.Data();

		// Check if the algorithm is correct

 		CSISException::ThrowIf (!(storedSisHash.VerifyAlgorithm()), CSISException::EVerification, "unsupported hash algorithm");

		// First check if the hash exists (to cater for the FILENULL case)					

		if (storedDigest)  

			{

			// Make a call to compute the hash of the actual file data

			TSHADigest digest;

			const CSISFileData& fileData = aDataUnit.FileData(fdesc->FileIndex());

			CalculateHash(digest, fileData.Data (), fileData.UncompressedSize ());

			CSISHash computedSISHash;

			computedSISHash.SetHash(digest, SHA_DIGEST_LENGTH);

			// Extract the computed hash data 													

			CSISBlob computedBlob = computedSISHash.Blob();

			TUint8* computedDigest = computedBlob.Data();

		 	// The computed data shouldn't be Null (as it has already been determined that 

		 	// the stored digest is not Null)

			CSISException::ThrowIf ((!computedDigest), CSISException::EVerification, "computed hash data is NULL");	

			// The two hashes must match to ensure integrity of the sis file.

			CSISException::ThrowIf (!(computedBlob == storedDigestBlob), CSISException::EVerification, "Stored and computed hash values do not match");	

			}

		}

	}

CSignSis::~CSignSis()

	{

	EVP_cleanup ();

	ERR_free_strings ();

	}