1 /*

     2 * Copyright (c) 2008 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description:   PKCS#12 data handler

    15 *

    16 */

    17 

    18 

    19 

    20 #include <x509cert.h>

    21 #include <mpkcs12.h>

    22 

    23 #include <e32std.h>

    24 

    25 #include <securityerr.h>

    26 #include <sysutil.h>

    27 

    28 #include "pkcs12vpn.h"

    29 #include "logvpncommon.h"

    30 #include "vpnnotifierdefs.h"

    31 

    32 ///////////////////////////////////

    33 // Construction and destruction

    34 

    35 EXPORT_C CPKCS12Handler* CPKCS12Handler::NewL(RPKIServiceAPI& aPkiServiceApi)

    36     {

    37     LOG_("-> CPKCS12Handler::NewL()");

    38     CPKCS12Handler* self = NewLC(aPkiServiceApi);

    39     CleanupStack::Pop(self);

    40     LOG_("<- CPKCS12Handler::NewL()");

    41     return self;

    42     }

    43 

    44 EXPORT_C CPKCS12Handler* CPKCS12Handler::NewLC(RPKIServiceAPI& aPkiServiceApi)

    45     {

    46     LOG_("-> CPKCS12Handler::NewLC()");

    47     CPKCS12Handler* self = new (ELeave) CPKCS12Handler(aPkiServiceApi);

    48     CleanupStack::PushL(self);

    49     self->ConstructL();

    50     LOG_("<- CPKCS12Handler::NewLC()");

    51     return self;

    52     }

    53 

    54 

    55 EXPORT_C CPKCS12Handler* CPKCS12Handler::NewL()

    56     {

    57     LOG_("-> CPKCS12Handler::NewL(empty)");

    58     CPKCS12Handler* self = NewLC();

    59     CleanupStack::Pop(self);

    60     LOG_("<- CPKCS12Handler::NewL(empty)");

    61     return self;

    62     }

    63 

    64 EXPORT_C CPKCS12Handler* CPKCS12Handler::NewLC()

    65     {

    66     LOG_("-> CPKCS12Handler::NewLC(empty)");

    67     CPKCS12Handler* self = new (ELeave) CPKCS12Handler();

    68     CleanupStack::PushL(self);

    69     self->ConstructL();

    70     LOG_("<- CPKCS12Handler::NewLC(empty)");

    71     return self;

    72     }

    73 

    74 /**

    75  * Release resources.

    76  * Note: CPKCS12Handler's parent owns the RPKIServiceAPI instance

    77  */

    78 EXPORT_C CPKCS12Handler::~CPKCS12Handler() 

    79     {

    80     LOG_("-> CPKCS12Handler::~CPKCS12Handler()");

    81     iPkcsHandler->Release();

    82     iNotifier.Close();

    83     delete iPassword;

    84     delete iOutputDir;

    85 

    86     iFileOut.Close();

    87     iFs.Close();

    88 

    89     LOG_("<- CPKCS12Handler::~CPKCS12Handler()");

    90     }

    91 

    92 /**

    93  * Maintain a reference to an instance of PKI API provided by the caller

    94  */

    95 CPKCS12Handler::CPKCS12Handler(RPKIServiceAPI& aPkiServiceApi) : 

    96                 iPkiService(&aPkiServiceApi), iDeletable(ETrue)

    97     {

    98     LOG_("-> CPKCS12Handler::CPKCS12Handler(RPKIServiceAPI&)");

    99     LOG_("<- CPKCS12Handler::CPKCS12Handler(RPKIServiceAPI&)");

   100     }

   101 

   102 CPKCS12Handler::CPKCS12Handler()

   103     {

   104     LOG_("-> CPKCS12Handler::CPKCS12Handler()");

   105     LOG_("<- CPKCS12Handler::CPKCS12Handler()");

   106     }

   107 

   108 /**

   109  * Instantiate S60 PKCS#12 handler upon construction.

   110  */

   111 void CPKCS12Handler::ConstructL()

   112     {

   113     LOG_("-> CPKCS12Handler::ConstructL()");

   114 

   115     iPkcsHandler = PKCS12Factory::CreateL();

   116     User::LeaveIfError(iNotifier.Connect());

   117     User::LeaveIfError(iFs.Connect());

   118 

   119     LOG_("<- CPKCS12Handler::ConstructL() OK");

   120     }

   121 

   122 

   123 ///////////////////////////////////

   124 // Public methods

   125 

   126 EXPORT_C void CPKCS12Handler::SaveSecurityObjectsToDiskL(const TDesC8& aData,

   127                                                          const TDesC& aPwd,

   128                                                          const TDesC& aDir) 

   129     {

   130     LOG_("-> CPKCS12Handler::SaveSecurityObjectsToDiskL()");

   131 

   132     if (iOutputDir) 

   133         {

   134         delete iOutputDir;

   135         iOutputDir = NULL;

   136         }

   137 

   138     // Output dir needs to end with backslash

   139     iOutputDir = aDir.AllocL();

   140 

   141     LOG_1(" Using output dir: '%S'", iOutputDir);

   142 

   143     ExtractSecurityObjectsL(aData, aPwd);

   144 

   145     // Save CA/user certificates to disk

   146     SaveCertificatesToDiskL();

   147 

   148     // Save private keys to disk

   149     SaveKeysToDiskL();

   150 

   151     LOG_("<- CPKCS12Handler::SaveSecurityObjectsToDiskL()");

   152     }

   153 EXPORT_C void CPKCS12Handler::StorePKCS12ObjectL(const TDesC8& aData, 

   154                                                  const TDesC16& aPwd) 

   155     {

   156     LOG_("-> CPKCS12Handler::StorePKCS12ObjectL()");

   157 

   158     ExtractSecurityObjectsL(aData, aPwd);

   159 

   160     // Store CA certificates to PKI

   161     StoreCertificatesL();

   162 

   163     // Store private keys to PKI

   164     StoreKeyPairsL();

   165 

   166     // Attach related user certificates to PKI priv keys

   167     AttachCertificatesL();

   168 

   169     LOG_("<- CPKCS12Handler::StorePKCS12ObjectL() OK");

   170     }

   171 

   172 EXPORT_C void CPKCS12Handler::SetApplicability(const RArray<TUid>& aUids) 

   173     {

   174     LOG_("-> CPKCS12Handler::SetApplicability()");

   175     iApplications = &aUids;

   176     LOG_("<- CPKCS12Handler::SetApplicability()");

   177     }

   178 

   179 EXPORT_C void CPKCS12Handler::SetDeletable(TBool aDeletable) 

   180     {

   181     LOG_1("-> CPKCS12Handler::SetDeletable() Deletable: %d", aDeletable);

   182     iDeletable = aDeletable;

   183     LOG_("<- CPKCS12Handler::SetDeletable()");

   184     }

   185 

   186 

   187 

   188 

   189 ///////////////////////////////////

   190 // Internal methods

   191 

   192 void CPKCS12Handler::ExtractSecurityObjectsL(const TDesC8& aData, 

   193                                              const TDesC16& aPwd) 

   194     {

   195     LOG_("-> CPKCS12Handler::ExtractSecurityObjectsL()");

   196     if (iPassword) 

   197         {

   198         delete iPassword;

   199         iPassword = NULL;

   200         }

   201 

   202     // Make sure the data is in PKCS#12 format

   203     if (!VerifyType(aData)) 

   204         {

   205         LOG_("<- CPKCS12Handler::ExtractSecurityObjectsL() LEAVE (KErrNotSupported)");

   206         User::Leave(KErrArgument);

   207         }

   208         

   209     // If we have been provided with a valid password, then proceed

   210     // to decrypt / parse; otherwise, prompt for pwd.

   211     if (aPwd.Length() > 0)

   212         {

   213         iPassword = aPwd.AllocL();

   214         LOG_(" Password provided by OMADM...");

   215         }

   216     else 

   217         {

   218         LOG_(" No password provided, prompting the user for one");

   219 

   220         iPassword = QueryPasswordL();

   221         }

   222 

   223     // Keep asking for the password until user cancels or inputs the

   224     // correct password

   225     while (ETrue) 

   226         {

   227         if (iPassword)

   228             {

   229             LOG_1(" Non-NULL password '%S' in use, decrypting", iPassword);

   230             TRAPD(err, iPkcsHandler->ParseL(aData, *iPassword));

   231             if (err != KErrNone) 

   232                 {

   233                 LOG_(" Breaking news: Password proved a miserable failure! Program terminated abruptly!");

   234                 DisplayWrongPasswordNote();

   235                 delete iPassword;

   236                 iPassword = NULL;

   237                 iPassword = QueryPasswordL();

   238                 }

   239             else 

   240                 {

   241                 // Correct password provided by the user, 

   242                 // break free from the vicious cycle.

   243                 delete iPassword;

   244                 iPassword = NULL;

   245                 break;

   246                 }

   247             }

   248         else

   249             {

   250             // User got tired of guessing and resorted to cancel

   251             LOG_("<- CPKCS12Handler::ExtractSecurityObjectsL() LEAVE (KErrCancel)");

   252             User::Leave(KErrBadPassphrase);

   253             }

   254         }

   255 

   256     // Fetch references to keys and certs

   257     ExtractKeysAndCerts();

   258 

   259     LOG_("<- CPKCS12Handler::ExtractSecurityObjectsL()");

   260     }

   261 

   262 void CPKCS12Handler::SaveCertificatesToDiskL() 

   263     {

   264     LOG_("-> CPKCS12Handler::SaveCertificatesToDiskL()");

   265 

   266     TInt certCount(0);

   267 

   268     // first the CAs (if any; not required necessarily)

   269     if (iCACerts) 

   270         {

   271         certCount = iCACerts->Count();

   272         LOG_1(" Saving %d CA Certificates", certCount);

   273 

   274         for (TInt i = 0; i < certCount; i++)

   275             {

   276             CX509Certificate* cert = iCACerts->At(i);

   277 

   278             // Generate filename with running identifier

   279             // Use TFileName, because the function isn't stack

   280             // critical

   281             TFileName fn;

   282             fn.Format(KCAFileNameStem(), i+1);

   283 

   284             WriteToFileL(cert->Encoding(), fn);

   285             }

   286         }

   287     LOG(else LOG_(" No CA Certs found!"));

   288 

   289     // Then the user certs

   290     if (iUserCerts)

   291         {

   292         certCount = iUserCerts->Count();

   293         LOG_1(" Saving %d User Certificates", certCount);

   294 

   295         for (TInt i = 0; i < certCount; i++) 

   296             {

   297             CX509Certificate* cert = iUserCerts->At(i);

   298 

   299             TFileName fn;

   300             fn.Format(KUserCertFileNameStem(), i+1);

   301 

   302             WriteToFileL(cert->Encoding(), fn);

   303             }

   304         }

   305 

   306     LOG(else LOG_(" No User Certs found!"));

   307 

   308     LOG_("<- CPKCS12Handler::SaveCertificatesToDiskL()");

   309     }

   310 

   311 void CPKCS12Handler::SaveKeysToDiskL() 

   312     {

   313     LOG_("-> CPKCS12Handler::SaveKeysToDiskL()");

   314 

   315     if (iPrivKeys) 

   316         {

   317         TInt keycount = iPrivKeys->Count();

   318         LOG_1(" Saving %d Private Keys", keycount);

   319 

   320         for (TInt i = 0; i < keycount; i++) 

   321             {

   322             HBufC8* key = iPrivKeys->At(i);

   323             TPtrC8 keyPtr = *key;

   324 

   325             TFileName fn;

   326             fn.Format(KPrivateKeyFileNameStem(), i+1);

   327 

   328             WriteToFileL(keyPtr, fn);

   329             }

   330         }

   331     LOG(else LOG_(" No Private Keys found!"));

   332 

   333     LOG_("<- CPKCS12Handler::SaveKeysToDiskL()");

   334     }

   335 

   336 // Note: directory needs to end with a backslash

   337 // writes binary data

   338 void CPKCS12Handler::WriteToFileL(const TDesC8& aData, 

   339                                   const TDesC& aFileName) 

   340     {

   341     LOG_("-> CPKCS12Handler::WriteToFileL()");

   342 

   343     ASSERT(iOutputDir);

   344     ASSERT(aFileName.Length() > 0);

   345 

   346     // Disk space criticality check before attempting

   347     // to install

   348     if (SysUtil::FFSSpaceBelowCriticalLevelL(0, 0)) 

   349         {

   350         User::Leave(KErrDiskFull);

   351         }

   352 

   353     TFileName fn;

   354     fn.Append(*iOutputDir);

   355     fn.Append(aFileName);

   356 

   357     LOG_1(" Opening file: '%S'", &fn);

   358 

   359     TInt ret = iFileOut.Replace(iFs, fn, EFileWrite|EFileShareExclusive|EFileStream);

   360     

   361     LOG_1(" File open result: %d", ret);

   362 

   363     if (ret != KErrNone) 

   364         {

   365         User::Leave(ret);

   366         }

   367 

   368     LOG_(" Writing data");

   369 

   370     ret = iFileOut.Write(aData);

   371     LOG_1(" Write result: %d", ret);

   372 

   373     ret = iFileOut.Flush();

   374     LOG_1(" Flush result: %d", ret);

   375     

   376     iFileOut.Close();

   377     

   378     LOG_("<- CPKCS12Handler::WriteToFileL()");

   379     }

   380 

   381 TBool CPKCS12Handler::VerifyType(const TDesC8& aData) const

   382     {

   383     ASSERT(iPkcsHandler);

   384 

   385     LOG_("-> CPKCS12Handler::VerifyType()");

   386 

   387     TBool isPKCS12(EFalse);

   388 

   389     // Need to check the data length before IsPKCS12Data call,

   390     // otherwise an assert (instead of a more suitable) 

   391     // might occur

   392     if (aData.Length() >= KPKCS12DataMinLength) 

   393         {

   394         isPKCS12 = iPkcsHandler->IsPKCS12Data(aData);

   395         }

   396 

   397     LOG_1("<- CPKCS12Handler::VerifyType() RET: %d", isPKCS12);

   398     return isPKCS12;

   399     }

   400 

   401 void CPKCS12Handler::StoreKeyPairsL()

   402     {

   403     LOG_("-> CPKCS12Handler::StoreKeyPairsL()");

   404     

   405     TInt keycount = iPrivKeys->Count();

   406     

   407     for (TInt i = 0; i < keycount; i++) 

   408         {

   409         HBufC8* key = iPrivKeys->At(i);

   410         TPtrC8 keyPtr = *key;

   411         StoreSingleKeyL(*key);

   412         }

   413     

   414     LOG_("<- CPKCS12Handler::StoreKeyPairsL() OK");

   415     }

   416 

   417 /**

   418  * NOTE: It should be decided what to do in following cases:

   419  * 1. Key storage operation fails for a key (there can be multiple keys 

   420  *    within a PKCS#12 package)

   421  * 2. User cert attachment fails for a key (there can be multiple user 

   422  *    certificates for any given key)

   423  *

   424  * At the moment, the code leaves if anything unexpected occurs.

   425  * There is no rollback mechanism (anything that was added before

   426  * the failure will still be in PKI stores).

   427  *

   428  */

   429 void CPKCS12Handler::StoreSingleKeyL(const TDesC8& aKey) 

   430     {

   431     LOG_("-> CPKCS12Handler::StoreSingleKeyL()");

   432     

   433     // Setup initial values

   434     TRequestStatus requestStatus;

   435     TPKIKeyIdentifier keyId;

   436     

   437     // Perform asynchronous PKI operation synchronously

   438     iPkiService->StoreKeypair(keyId, aKey, requestStatus);

   439 

   440     User::WaitForRequest(requestStatus);

   441 

   442     // Check for operation status    

   443     TInt status = requestStatus.Int();

   444     if (status != KErrNone)

   445         {

   446         LOG_1("<- CPKCS12Handler::StoreSingleKeyL() LEAVE (%d)", status);

   447         User::Leave(status);

   448         }

   449 

   450     LOG_("<- CPKCS12Handler::StoreSingleKeyL() OK");

   451     }

   452 

   453 

   454 void CPKCS12Handler::AttachCertificatesL() 

   455     {

   456     LOG_("-> CPKCS12Handler::AttachCertificatesL()");

   457     TInt certCount = iUserCerts->Count();

   458     for (TInt i = 0; i < certCount; i++) 

   459         {

   460         CX509Certificate* cert = iUserCerts->At(i);

   461         TKeyIdentifier certKeyId = cert->KeyIdentifierL();

   462         

   463         // Note: KeyID parameter is effectively redundant

   464         // (it can always be fetched from CX509Certificate object)

   465         AttachCertificateL(cert, certKeyId);

   466 

   467         }

   468     LOG_("<- CPKCS12Handler::AttachCertificatesL() OK");

   469     }

   470 

   471 void CPKCS12Handler::StoreCertificatesL() 

   472     {

   473     LOG_("-> CPKCS12Handler::StoreCertificatesL()");

   474     TInt certCount = iCACerts->Count();

   475     for (TInt i = 0; i < certCount; i++)

   476         {

   477         CX509Certificate* cert = iCACerts->At(i);

   478         StoreCertificateL(cert);

   479         }

   480     LOG_("<- CPKCS12Handler::StoreCertificatesL() OK");

   481     }

   482 

   483 void CPKCS12Handler::StoreCertificateL(CX509Certificate* aCert)

   484     {

   485 

   486     LOG_("-> CPKCS12Handler::StoreCertificateL()");

   487 

   488     LOG_1(" Deletable: %d", iDeletable);

   489 

   490     TInt status = iPkiService->StoreCertificate(EPKICACertificate,

   491                                                 iDeletable,

   492                                                 0,

   493                                                 EPKIRSA,

   494                                                 aCert->Encoding());

   495 

   496     if (status) 

   497         {

   498         LOG_1("<- CPKCS12Handler::StoreCertificateL() LEAVE (%d)", status);

   499         User::Leave(status);

   500         }

   501 

   502     SetApplicabilityL(aCert);

   503 

   504     LOG_("<- CPKCS12Handler::StoreCertificateL() OK");

   505     }

   506 

   507 

   508 void CPKCS12Handler::AttachCertificateL(CX509Certificate* aCert, 

   509                                         const TPKIKeyIdentifier& aKeyId)

   510     {

   511 

   512     LOG_("-> CPKCS12Handler::AttachCertificateL()");

   513 

   514     TRequestStatus requestStatus;

   515     TAny* resArray(NULL);

   516 

   517     // Perform asynchronous PKI operation synchronously

   518     iPkiService->AttachCertificateL(aKeyId, DEFAULT_KEY_LEN, EPKIRSA, 

   519                                     aCert->Encoding(), &resArray, 

   520                                     requestStatus);

   521 

   522     User::WaitForRequest(requestStatus);

   523     iPkiService->Finalize(resArray);

   524 

   525     // Check for operation status    

   526     TInt status = requestStatus.Int();

   527     if (status != KErrNone)

   528         {

   529         LOG_1("<- CPKCS12Handler::AttachCertificateL() LEAVE: %d", status);

   530         User::Leave(status);

   531         }

   532 

   533     LOG_("<- CPKCS12Handler::AttachCertificateL() OK");

   534     }

   535 

   536 /**

   537  * Not in use currently -- is Applicability a meaningful parameter

   538  * for user certificates?

   539  */

   540 void CPKCS12Handler::SetApplicabilityL(CX509Certificate* aCert) 

   541     {

   542     LOG_("-> CPKCS12Handler::SetApplicabilityL()");

   543 

   544     if (aCert) 

   545         {

   546         // Only set applicability if there is atleast one applicability

   547         // setting defined

   548         if (iApplications && iApplications->Count() > 0)

   549             {

   550             LOG_(" Resolving subject  name");

   551 

   552             // Use subject name for CA certs

   553             const TPtrC8* issuerName = 

   554                 aCert->DataElementEncoding(CX509Certificate::EIssuerName);

   555             

   556             LOG_(" Resolving serial number");

   557             const TPtrC8* serialNumber = 

   558                 aCert->DataElementEncoding(CX509Certificate::ESerialNumber);

   559             

   560             LOG_(" Issuing PKI call");

   561             iPkiService->SetApplicabilityL(*issuerName, *serialNumber, *iApplications);

   562             }

   563         }

   564     else 

   565         {

   566         LOG_("<- CPKCS12Handler::SetApplicabilityL() Leave: NULL argument");

   567         User::Leave(KErrArgument);

   568         }

   569 

   570     LOG_("<- CPKCS12Handler::SetApplicabilityL() OK");

   571     }

   572 

   573 void CPKCS12Handler::ExtractKeysAndCerts() 

   574     {

   575     ASSERT(iPkcsHandler);

   576     iCACerts = &iPkcsHandler->CACertificates();

   577     iUserCerts = &iPkcsHandler->UserCertificates();

   578     iPrivKeys = &iPkcsHandler->PrivateKeys();

   579     }

   580 

   581 HBufC* CPKCS12Handler::QueryPasswordL()

   582     {

   583     LOG_("-> CPKCS12Handler::QueryPasswordL()");

   584     TRequestStatus status(KErrNone);

   585     LOG_(" SANITY2");

   586 

   587     HBufC* ret(NULL);

   588 

   589     TVpnDialogInfo dialogInfo(TVpnDialog::EPKCS12Password, 0);

   590 

   591     TPckgBuf<TVpnDialogInfo>                dialogInfoDes;

   592     TPckgBuf<TVpnDialogOutput>              dialogResponseDes;

   593 

   594 

   595     dialogInfoDes() = dialogInfo;

   596 

   597     iNotifier.StartNotifierAndGetResponse(status, KUidVpnDialogNotifier,

   598                                           dialogInfoDes, dialogResponseDes);

   599 

   600     // Wait until user has given the input

   601     LOG_(" Waiting for request");

   602     User::WaitForRequest(status);

   603     LOG_1(" Dialog terminated with status: %d", status.Int());

   604     

   605     if (status != KErrCancel && dialogResponseDes().iOutBuf.Length() >= 0)

   606         {

   607         LOG_(" Allocating");

   608         ret = dialogResponseDes().iOutBuf.AllocL();

   609         LOG_(" Canceling");

   610         iNotifier.CancelNotifier(KUidVpnDialogNotifier);

   611         LOG_1("<- CPKCS12Handler::QueryPasswordL() return: '%S'", ret);

   612         }

   613     else 

   614         {

   615         LOG_("<- CPKCS12Handler::QueryPasswordL() return: NULL");

   616         }

   617 

   618     return ret;

   619     }

   620  

   621 void CPKCS12Handler::DisplayWrongPasswordNote() 

   622     {

   623     LOG_("-> CPKCS12Handler::DisplayWrongPasswordNote()");

   624     TRequestStatus status(KErrNone);

   625 

   626     LOG_1(" Constructing dialoginfo, DID: %d", 

   627             TVpnNoteDialog::EVpnWrongPKCS12Password);

   628 

   629     TIPSecDialogInfo info(TNoteDialog::EInfo, 

   630                           TVpnNoteDialog::EVpnWrongPKCS12Password); //create the input information

   631     TPckgBuf<TIPSecDialogInfo> infoBuf(info); //package it in appropriate buf

   632     TPckgBuf<TIPSecDialogOutput> responseBuf; //create the buf to receive the response

   633     

   634     iNotifier.StartNotifierAndGetResponse(status, KUidVpnDialogNotifier,

   635                                           infoBuf, responseBuf);

   636     User::WaitForRequest(status);

   637 

   638     iNotifier.CancelNotifier(KUidVpnDialogNotifier);

   639 

   640     LOG_("<- CPKCS12Handler::DisplayWrongPasswordNote()");

   641     }

   642