/*
* Copyright (c) 2010 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description:  Server authentication failure operation in security dialog
*
*/

#include "securitydialogoperserverauthfail.h" // CServerAuthFailOperation
#include "securitydialogoperationobserver.h" // MSecurityDialogOperationObserver
#include "untrustedcertquery.h"         // CUntrustedCertQuery
#include "../../DeviceToken/Inc/TrustedSitesStore.h" // CTrustSitesStore
#include <mctwritablecertstore.h>       // MCTWritableCertStore
#include <unifiedcertstore.h>           // CUnifiedCertStore
#include <cctcertinfo.h>                // CCTCertInfo
#include <x509cert.h>                   // CX509Certificate
#include "securitydialogstrace.h"       // TRACE macro

const TUid KTrustedSiteCertificatesTokenTypeUid = { 0x101FB66F };
const TInt KMaxCommonNameLength = 64;   // from RFC3280


// ======== MEMBER FUNCTIONS ========

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::NewL()
// ---------------------------------------------------------------------------
//
CServerAuthFailOperation* CServerAuthFailOperation::NewL(
        MSecurityDialogOperationObserver& aObserver, const RMessage2& aMessage,
        TInt aReplySlot )
    {
    TRACE( "CServerAuthFailOperation::NewL, aMessage 0x%08x", aMessage.Handle() );
    return new( ELeave ) CServerAuthFailOperation( aObserver, aMessage, aReplySlot );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::~CServerAuthFailOperation()
// ---------------------------------------------------------------------------
//
CServerAuthFailOperation::~CServerAuthFailOperation()
    {
    TRACE( "CServerAuthFailOperation::~CServerAuthFailOperation, begin" );
    Cancel();

    delete iUntrustedCertQuery;
    iUntrustedCertQuery = NULL;

    delete iInput;
    iInput = NULL;
    delete iCertLabel;
    iCertLabel = NULL;
    delete iServerName;
    iServerName = NULL;

    delete iCertStore;
    iCertStore = NULL;
    iTrustedSiteCertStore = NULL;   // not owned

    delete iCertAttributeFilter;
    iCertAttributeFilter = NULL;
    delete iRetrievedCertBuffer;
    iRetrievedCertBuffer = NULL;

    iCertInfos.Close();
    iFs.Close();
    TRACE( "CServerAuthFailOperation::~CServerAuthFailOperation, end" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::StartL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::StartL( const TDesC8& aBuffer )
    {
    TRACE( "CServerAuthFailOperation::StartL, begin" );
    __ASSERT_DEBUG( iInput == NULL, User::Invariant() );
    iInput = CServerAuthenticationFailureInput::NewL( aBuffer );

    iInput->GetEncodedCert( iEncodedServerCert );

    TPtrC8 serverName;
    iInput->GetServerName( serverName );
    __ASSERT_DEBUG( iServerName == NULL, User::Invariant() );
    iServerName = HBufC::NewL( serverName.Length() );
    iServerName->Des().Copy( serverName );
    TRACE( "CServerAuthFailOperation::StartL, iServerName=%S", iServerName );

    iAuthFailReason = iInput->FailureReason();
    TRACE( "CServerAuthFailOperation::StartL, iAuthFailReason=%d", iAuthFailReason );

    InitializeUnifiedCertStoreL();
    // This is async function, processing continues in RunL().
    // Basically trusted site certificates are fetched and the
    // server certificate is compared to them. If the server
    // certificate is already in trusted site cert store, then
    // connection is accepted silently. If it is not, then
    // untrusted certificate dialog is displayed.
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::CancelOperation()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::CancelOperation()
    {
    TRACE( "CServerAuthFailOperation::CancelOperation, begin" );
    Cancel();
    if( iUntrustedCertQuery )
        {
        TRACE( "CServerAuthFailOperation::CancelOperation, cancelling untrusted query" );
        iUntrustedCertQuery->Cancel();
        }
    if( !iMessage.IsNull() )
        {
        TRACE( "CServerAuthFailOperation::CancelOperation, completing message 0x%08x",
                iMessage.Handle() );
        iMessage.Complete( KErrCancel );
        }
    TRACE( "CServerAuthFailOperation::CancelOperation, end" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::RunL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::RunL()
    {
    TRACE( "CServerAuthFailOperation::RunL, iStatus.Int()=%d, iMode=%d",
            iStatus.Int(), iMode );
    User::LeaveIfError( iStatus.Int() );
    switch( iMode )
        {
        case EInitialiseCertStore:
            ProcessServerAuthorizationFailureL();
            break;
        case EListTrustedSiteCerts:
            RetrieveFirstTrustedSiteCertL();
            break;
        case ERetrieveTrustedSiteCert:
            if( IsRetrievedCertSameAsServerCertL() )
                {
                ReturnResultL( EContinue );
                }
            else
                {
                RetrieveNextTrustedSiteCertL();
                }
            break;
        case ESavingServerCert:
            SaveServerNameToTrustedSitesStoreL();
            ReturnResultL( EContinue );
            break;
        default:
            User::Leave( KErrGeneral );
            break;
        }
    TRACE( "CServerAuthFailOperation::RunL(), end" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::DoCancel()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::DoCancel()
    {
    TRACE( "CServerAuthFailOperation::DoCancel, iMode=%d", iMode );
    switch( iMode )
        {
        case EInitialiseCertStore:
            if( iCertStore )
                {
                iCertStore->CancelInitialize();
                }
            break;
        case EListTrustedSiteCerts:
            if( iTrustedSiteCertStore )
                {
                iTrustedSiteCertStore->CancelList();
                }
            break;
        case ERetrieveTrustedSiteCert:
            if( iTrustedSiteCertStore )
                {
                iTrustedSiteCertStore->CancelRetrieve();
                }
            break;
        case ESavingServerCert:
            if( iTrustedSiteCertStore )
                {
                iTrustedSiteCertStore->CancelAdd();
                }
            break;
        default:
            break;
        }
    TRACE( "CServerAuthFailOperation::DoCancel, end" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::CServerAuthFailOperation()
// ---------------------------------------------------------------------------
//
CServerAuthFailOperation::CServerAuthFailOperation(
        MSecurityDialogOperationObserver& aObserver, const RMessage2& aMessage,
        TInt aReplySlot ) : CSecurityDialogOperation( aObserver, aMessage, aReplySlot )
    {
    TRACE( "CServerAuthFailOperation::CServerAuthFailOperation" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::InitializeUnifiedCertStoreL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::InitializeUnifiedCertStoreL()
    {
    TRACE( "CServerAuthFailOperation::InitializeUnifiedCertStoreL" );
    User::LeaveIfError( iFs.Connect() );
    iCertStore = CUnifiedCertStore::NewL( iFs, ETrue );

    iCertStore->Initialize( iStatus );
    iMode = EInitialiseCertStore;
    SetActive();
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::ProcessServerAuthorizationFailureL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::ProcessServerAuthorizationFailureL()
    {
    TRACE( "CServerAuthFailOperation::ProcessServerAuthorizationFailureL" );
    OpenTrustedSiteCertificateStoreL();
    if( IsAlreadyTrustedSiteL() )
        {
        StartFetchingTrustedSiteCertsL();
        }
    else
        {
        ShowUntrustedCertificateDialogL();
        }
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL()
    {
    TRACE( "CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL, begin" );
    TInt count = iCertStore->WritableCertStoreCount();
    for( TInt index = 0; ( index < count ) && !iTrustedSiteCertStore; index++ )
        {
        MCTWritableCertStore* certstore = &( iCertStore->WritableCertStore( index ) );
        TUid tokenTypeUid = certstore->Token().Handle().iTokenTypeUid;
        if( tokenTypeUid == KTrustedSiteCertificatesTokenTypeUid )
            {
            iTrustedSiteCertStore = certstore;
            }
        }
    TRACE( "CServerAuthFailOperation::OpenTrustedSiteCertificateStoreL, store 0x%08x",
            iTrustedSiteCertStore );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::IsAlreadyTrustedSiteL()
// ---------------------------------------------------------------------------
//
TBool CServerAuthFailOperation::IsAlreadyTrustedSiteL()
    {
    TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, begin" );
    TBool isTrustedSite = EFalse;
    if( iTrustedSiteCertStore )
        {
        CTrustSitesStore* trustedSitesStore = CTrustSitesStore::NewL();
        CleanupStack::PushL( trustedSitesStore );

        isTrustedSite = trustedSitesStore->IsTrustedSiteL( iEncodedServerCert, *iServerName );
        if( isTrustedSite )
            {
            TBool isExpiredAccepted = trustedSitesStore->IsOutOfDateAllowedL(
                    iEncodedServerCert, *iServerName );
            TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, isExpiredAccepted=%d",
                    isExpiredAccepted );
            if( !isExpiredAccepted && iAuthFailReason == EDateOutOfRange )
                {
                TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, not accepted" );
                isTrustedSite = EFalse;
                }
            }

        CleanupStack::PopAndDestroy( trustedSitesStore );
        }
    TRACE( "CServerAuthFailOperation::IsAlreadyTrustedSiteL, isTrustedSite=%d", isTrustedSite );
    return isTrustedSite;
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::StartFetchingTrustedSiteCertsL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::StartFetchingTrustedSiteCertsL()
    {
    TRACE( "CServerAuthFailOperation::StartFetchingTrustedSiteCertsL" );
    __ASSERT_DEBUG( iCertAttributeFilter == NULL, User::Invariant() );
    iCertAttributeFilter = CCertAttributeFilter::NewL();
    iCertAttributeFilter->SetOwnerType( EPeerCertificate );
    __ASSERT_DEBUG( iTrustedSiteCertStore != NULL, User::Invariant() );
    iTrustedSiteCertStore->List( iCertInfos, *iCertAttributeFilter, iStatus );
    iMode = EListTrustedSiteCerts;
    SetActive();
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::ShowUntrustedCertificateDialogL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::ShowUntrustedCertificateDialogL()
    {
    TRACE( "CServerAuthFailOperation::ShowUntrustedCertificateDialogL, begin" );

    // If trusted site certstore open has failed, then it is not possible to save
    // the host name for permanent use. Hence, choice for permanent accept is not
    // displayed if trusted site certstore open has failed. Other restrictions for
    // permanent accept are defined in device dialog (UntrustedCertificateWidget).
    TBool isTrustedSiteCertStoreOpened = ( iTrustedSiteCertStore != NULL );
    __ASSERT_DEBUG( iUntrustedCertQuery == NULL, User::Invariant() );
    iUntrustedCertQuery = CUntrustedCertQuery::NewL( iAuthFailReason, iEncodedServerCert,
            *iServerName, isTrustedSiteCertStoreOpened );

    CUntrustedCertQuery::TResponse response = CUntrustedCertQuery::EQueryRejected;
    iUntrustedCertQuery->ShowQueryAndWaitForResponseL( response );
    switch( response )
        {
        case CUntrustedCertQuery::EQueryAccepted:
            ReturnResultL( EContinue );
            break;
        case CUntrustedCertQuery::EQueryAcceptedPermanently:
            SaveServerCertToTrustedSiteCertStoreL();
            break;
        case CUntrustedCertQuery::EQueryRejected:
        default:
            ReturnResultL( EStop );
            break;
        }

    TRACE( "CServerAuthFailOperation::ShowUntrustedCertificateDialogL, end" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::SaveServerCertToTrustedSiteCertStoreL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::SaveServerCertToTrustedSiteCertStoreL()
    {
    TRACE( "CServerAuthFailOperation::SaveServerCertToTrustedSiteCertStoreL" );

    __ASSERT_DEBUG( iCertLabel == NULL, User::Invariant() );
    CX509Certificate* serverCert = CX509Certificate::NewLC( iEncodedServerCert );
    const CX500DistinguishedName& dName = serverCert->SubjectName();
    HBufC* commonName = dName.ExtractFieldL( KX520CommonName );
    if( commonName )
        {
        CleanupStack::PushL( commonName );
        TInt commonNameLen = commonName->Length();
        if( commonNameLen > 0 && commonNameLen <= KMaxCommonNameLength )
            {
            iCertLabel = commonName->AllocL();
            }
        CleanupStack::PopAndDestroy( commonName );
        }
    CleanupStack::PopAndDestroy( serverCert );

    if( !iCertLabel )
        {
        iCertLabel = iServerName->AllocL();
        }

    iTrustedSiteCertStore->Add( *iCertLabel, EX509Certificate, EPeerCertificate,
            NULL, NULL, iEncodedServerCert, iStatus );
    iMode = ESavingServerCert;
    SetActive();
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL()
    {
    TRACE( "CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL, begin" );
    CTrustSitesStore* trustedSitesStore = CTrustSitesStore::NewL();
    CleanupStack::PushL( trustedSitesStore );

    // CTrustSitesStore::AddL() may leave or it may return an error code.
    // It leaves if parameters are incorrect, and it returns error code if
    // saving fails. Both kinds of errors are handled here in the same way.
    TInt err = trustedSitesStore->AddL( iEncodedServerCert, *iServerName );
    TRACE( "CServerAuthFailOperation::SaveServerNameToTrustedSitesStoreL, err=%d", err );
    User::LeaveIfError( err );

    CleanupStack::PopAndDestroy( trustedSitesStore );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::ReturnResultL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::ReturnResultL( TServerAuthenticationFailureDialogResult aResult )
    {
    TRACE( "CServerAuthFailOperation::ReturnResultL, aResult=%d", aResult );
    TServerAuthenticationFailureOutputBuf output( aResult );
    iMessage.WriteL( iReplySlot, output );
    TRACE( "CServerAuthFailOperation::ReturnResultL, completing msg 0x%08x", iMessage.Handle() );
    iMessage.Complete( KErrNone );
    TRACE( "CServerAuthFailOperation::ReturnResultL, informing observer" );
    iObserver.OperationComplete();
    TRACE( "CServerAuthFailOperation::ReturnResultL, end" );
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::RetrieveFirstTrustedSiteCertL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::RetrieveFirstTrustedSiteCertL()
    {
    TRACE( "CServerAuthFailOperation::RetrieveFirstTrustedSiteCertL" );
    __ASSERT_DEBUG( iRetrievedCertBuffer == NULL, User::Invariant() );
    iRetrieveCertIndex = 0;

    RetrieveNextTrustedSiteCertL();
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::RetrieveNextTrustedSiteCertL()
// ---------------------------------------------------------------------------
//
void CServerAuthFailOperation::RetrieveNextTrustedSiteCertL()
    {
    TRACE( "CServerAuthFailOperation::RetrieveNextTrustedSiteCertL" );
    if( iRetrieveCertIndex < iCertInfos.Count() )
        {
        CCTCertInfo& cert = *( iCertInfos[ iRetrieveCertIndex ] );

        if( iRetrievedCertBuffer )
            {
            delete iRetrievedCertBuffer;
            iRetrievedCertBuffer = NULL;
            }
        iRetrievedCertBuffer = HBufC8::NewL( cert.Size() );
        TPtr8 buffer = iRetrievedCertBuffer->Des();

        iTrustedSiteCertStore->Retrieve( cert, buffer, iStatus );
        iMode = ERetrieveTrustedSiteCert;
        SetActive();
        }
    else
        {
        ShowUntrustedCertificateDialogL();
        }
    }

// ---------------------------------------------------------------------------
// CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL()
// ---------------------------------------------------------------------------
//
TBool CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL()
    {
    TRACE( "CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL, begin" );
    TBool isSame = EFalse;
    CX509Certificate* cert = CX509Certificate::NewLC( *iRetrievedCertBuffer );

    if( !iServerCertFingerprint )
        {
        CX509Certificate* serverCert = CX509Certificate::NewLC( iEncodedServerCert );
        iServerCertFingerprint = serverCert->Fingerprint().AllocL();
        CleanupStack::PopAndDestroy( serverCert );
        }

    if( cert->Fingerprint() == *iServerCertFingerprint )
        {
        isSame = ETrue;
        }

    CleanupStack::PopAndDestroy( cert );
    TRACE( "CServerAuthFailOperation::IsRetrievedCertSameAsServerCertL, isSame=%d", isSame );
    return isSame;
    }