/*
* Copyright (c) 2008 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description:   static method for certficate handling
*
*/




#ifndef IKEPKIUTILS_H
#define IKEPKIUTILS_H

#include <e32base.h>

class CX509Certificate;
class TCertPayloadIkev2;
class CIkeCaList;
class TCertificateISAKMP;
class TASN1DecGeneric;

class IkePkiUtils    
    {
public:

    /*
    * Verifies an IKEv2 signature with a public of
    * specified certificate
    * 
    * @param aSignature Signature data verified.
    * @param aAuthData Data signed.
    * @param aCert Certificate which contains the public key used for verification      
    * @result ETrue if signature is vefified OK, otherwise EFalse
    */
	IMPORT_C static TBool VerifyIkev2SignatureL(const TDesC8& aSignature, 
	                                            const TDesC8& aRefHash, 
	                                            const CX509Certificate& aCerts);
	         
	         
    /*    
    * Verifies an IKEv1 signature with a public of
    * specified certificate
    *    
    * @param aSignature Signature data verified.
    * @param aRefHash Hash data which has been signed (= Encrypted with private key)
    * @param aCert Certificate which contains the public key used for verification      
    * @result ETrue if signature is vefified OK, otherwise EFalse
    */	                                            
	IMPORT_C static TBool VerifyIkev1SignatureL(const TDesC8& aSignature, 
	                                            const TDesC8& aRefHash, 
	                                            const CX509Certificate& aCerts);

    /*
    * Gets IKE DER encoded Subject Name from the certificate and
    * copy it into specified buffer 
    * 
    * @param aCert Certificate object pointer
    * @param aSubjectName Reference to the subject name (returned)
    * @result ETrue if operation succeeded, otherwise EFalse
    */
    IMPORT_C static TBool GetCertSubjectNameDERL(const CX509Certificate* aCert, 
                                                 TDes8& aSubjectName);
                                                 
    /*
    * Gets IKE identity data from specified certificate
    * 
    * @param aIdType Specified IKE Identity type wanted.
    * @param aCertData Certificate data from where the specified Identity data is taken
    * @result The identity data buffer of NULL
    */
    IMPORT_C static HBufC8* GetIdentityFromCertL(TUint8 aIdType, const TDesC8& aCertData);
    
    
    /*
    * Ccertifies a specified IKE identity with
    * Certificate Identities
    *
    * @param aCert Verified user certificate
    * @param aId IKE identity data used by peer
    * @param aIdType IKE identity type 
    * @result ETrue if Identity is certified otherwise EFalse
    */
    IMPORT_C static TBool CertifyIdentityL(const CX509Certificate* aCert, 
                                           TDesC8& aId, TInt aIdType);


    /*
    * Verifies the user Certificate used by the IKE peer.
    * 
    * @param aCerts The array of IKE certificate payload(s) from where verified
    *               Certificate is found
    * @result A pointer to a verified X509 certificate or NULL 
    */
    IMPORT_C static CX509Certificate* VerifyCertificateL(const CArrayFixFlat<TCertPayloadIkev2*>& aCerts,
                                                         const CIkeCaList& aTrustedCAList);


    /*
    * Verifies the user Certificate used by the IKE peer.
    * 
    * @param aCerts The array of IKE certificate payload(s) from where verified
    *               Certificate is found
    * @result A pointer to a verified X509 certificate or NULL 
    */
    IMPORT_C static CX509Certificate* VerifyCertificateL(const CArrayFixFlat<const TCertificateISAKMP*>& aCerts,
                                                         const CIkeCaList& aTrustedCAList);

    IMPORT_C static CX509Certificate* VerifyCertChainL(const CArrayFixFlat<CX509Certificate*>& aCerts, CX509Certificate*& realUserCert,const CIkeCaList& aTrustedCAList);
    
private:
    static TBool VerifySignatureL(const TInt aIkeVersion, 
                                  const TDesC8& aSignature, 
                                  const TDesC8& aRefHash, 
                                  const CX509Certificate& aCert);     
     
    static CArrayPtrFlat<TASN1DecGeneric>* DecodeDERL(const TDesC8& aPtr, TInt& aPosition);     
    
  	/*
	* Verifies user certificate by taking the following actions:
	* -- Verify the signature of the user certificate with the public
	*    key of the CA certificate.
	* -- Check the validity of the user certificate 
	* -- Check that extension field of the user certificate are correct
	*/
    static CX509Certificate* VerifyX509CertificateL(const CX509Certificate& aCaCert, 
                                                    CX509Certificate& aCert);


    static CX509Certificate* FindCaCertificateL(const CX509Certificate& aUserCert, 
                                                const CIkeCaList& aTrustedCAList);
                                                
    static const CArrayFixFlat<TCertPayloadIkev2*>* CastCertArray(const CArrayFixFlat<const TCertificateISAKMP*>* aCerts);                                                

    
    
    
    };

#endif //IKEPKIUTILS_H