/*
* Copyright (c) 2007-2009 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description:   General utility methods for certificate handling
*
*/



#include <x509cert.h>

#include "ikecert.h"
#include "ikev1pkiservice.h"
#include "ikev2const.h"
#include "ikecaelem.h"
#include "ikecertconst.h"


const TUint8 Pkcs1v15Sha1Header[15] = {0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14};


TUint8* IkeCert::BERGetLengthL(TUint8* aP, TInt &aLen)
{
    ASSERT(aP);
	aP++;  // skip tag
	if (*aP <= 127) 
	{   
		aLen = *aP;
		aP++;
	}
	else if (*aP == 0x81)
	{
		aP++;
		aLen = *aP;
		aP++;
	}
	else if (*aP == 0x82)
	{
		aP++;
		aLen = *aP;
		aP++;
		aLen *= 256;
		aLen += *aP;
		aP++;
	}
	else {
		User::Leave(KErrGeneral);
	}
	return aP;
}


EXPORT_C HBufC8* IkeCert::GetCertificateFieldDERL(const CX509Certificate* aCert, TInt aField)
{
	if ( !aCert )
	   return NULL;	
	const TPtrC8 SignedData = aCert->SignedDataL();
	if ( SignedData.Length() == 0 )
	   return NULL;
	TUint8* Ptr = (TUint8*)SignedData.Ptr();
	TUint8* FieldPtr;
	HBufC8* FieldBfr = NULL;
	TInt length = 0;	
	 // begin sequence
	Ptr = IkeCert::BERGetLengthL(Ptr, length);
	// context specific a0 03
	if (*Ptr==0xa0)
		Ptr += 2; 
	// version
	if (*Ptr==2)
	{
		Ptr = IkeCert::BERGetLengthL(Ptr, length);
		Ptr += length;
	}
	// seq number
	if (*Ptr==2)
	{
		Ptr = IkeCert::BERGetLengthL(Ptr, length);
		Ptr += length;
	}
	// sign algorithm
	Ptr = IkeCert::BERGetLengthL(Ptr, length);
	Ptr += length;
	// issuer name
	FieldPtr = Ptr;
	Ptr = IkeCert::BERGetLengthL(Ptr, length);
	Ptr += length;
	if ( aField == KIssuerName )
	    {   
	       FieldBfr = HBufC8::NewL(Ptr - FieldPtr);
	       FieldBfr->Des().Copy(FieldPtr, (Ptr - FieldPtr));
	    }
	// validity period
	Ptr = IkeCert::BERGetLengthL(Ptr, length);
	Ptr += length;
	// subject name
	FieldPtr = Ptr;
	Ptr = IkeCert::BERGetLengthL(Ptr, length);
	Ptr += length;
	if ( aField == KSubjectName )
	{	
	   FieldBfr = HBufC8::NewL(Ptr - FieldPtr);
	   FieldBfr->Des().Copy(FieldPtr, (Ptr - FieldPtr));
	}
	// public key info	
	FieldPtr = Ptr;
	Ptr = IkeCert::BERGetLengthL(Ptr, length);
	Ptr += length;
	if ( aField == KPublicKeyInfo )
	{	
		FieldBfr = HBufC8::NewL(Ptr - FieldPtr);
		FieldBfr->Des().Copy(FieldPtr, (Ptr - FieldPtr));
	}

	return FieldBfr;
}	


HBufC8* IkeCert::BuildPkcs1v15HashL(const TDesC8 &aHashIn)
{
	//
	// Build Pkcs1v15 format ASN1 header for specified hash.
	// Current implementation supports only hash algorithm SHA1 so
	// the aHashIn length data MUST be exactly the length of SHA1 hash
	// (20 bytes) 
	//
	HBufC8* Pkcs1v15Hash = NULL;
	
	ASSERT( aHashIn.Length() == 20 );
	
   Pkcs1v15Hash = HBufC8::NewL(20 + sizeof(Pkcs1v15Sha1Header));
   if ( Pkcs1v15Hash )
   {
       Pkcs1v15Hash->Des().Copy((TUint8*)Pkcs1v15Sha1Header, sizeof(Pkcs1v15Sha1Header));
       Pkcs1v15Hash->Des().Append(aHashIn);
   }	   
	return Pkcs1v15Hash;
}


EXPORT_C HBufC8* IkeCert::GetCertificateFieldDERL(HBufC8* aCertBfr, TInt aField)
{
	if ( !aCertBfr )
	   return NULL;	
	CX509Certificate* Cert = CX509Certificate::NewL(*aCertBfr);
	CleanupStack::PushL(Cert);	
    HBufC8* Field  = IkeCert::GetCertificateFieldDERL(Cert, aField);
	CleanupStack::PopAndDestroy(Cert); 
	return Field;
}


TBool IkeCert::AltNameExistsL(const CX509Certificate *aX509Cert, const TDesC8 &aId)
{
    ASSERT(aX509Cert);
	const CX509CertExtension *AltNameExt = aX509Cert->Extension(KSubjectAltName);
	CX509GeneralName *NameId = CX509GeneralName::NewLC(aId);
	TBool found = EFalse;
	if (AltNameExt)
	{
		CX509AltNameExt* AltExt = CX509AltNameExt::NewLC(AltNameExt->Data());
		const CArrayPtrFlat<CX509GeneralName>&Names = AltExt->AltName();
		TInt Count = Names.Count();
		for (TInt i = 0; i < Count; i++)
		{
			const CX509GeneralName *Name = Names.At(i);
			if  (NameId->Tag()  == Name->Tag() &&
				 NameId->Data() == Name->Data())
			{
				found = ETrue;
				break;
			}
		}
		CleanupStack::PopAndDestroy(AltExt);
	}
	CleanupStack::PopAndDestroy(NameId);
	return found;
}


EXPORT_C HBufC8* IkeCert::GetSubjectAltNameDataL(const CX509Certificate* aX509Cert, TUint8 aIkeIdType)
{
    ASSERT(aX509Cert);
	HBufC8* Identity = NULL;
	const CX509CertExtension* AltNameExt = aX509Cert->Extension(KSubjectAltName);

	if ( AltNameExt )
	{
		TGNType SubjAltNameType;
		switch ( aIkeIdType )
		{
			case ID_IPV4_ADDR:
				SubjAltNameType = EX509IPAddress;
				break;
			case ID_FQDN:
				SubjAltNameType = EX509DNSName;
				break;
			case ID_RFC822_ADDR:
				SubjAltNameType = EX509RFC822Name;
				break;
			case ID_IPV6_ADDR:
				SubjAltNameType = EX509IPAddress;
				break;
			default:
				SubjAltNameType = EX509RFC822Name;
				break;
		}   
		CX509AltNameExt* AltExt = CX509AltNameExt::NewLC(AltNameExt->Data());
		const CArrayPtrFlat<CX509GeneralName>&Names = AltExt->AltName();
		TInt count = Names.Count();
		for (TInt i = 0; i < count; i++)
		{
			const CX509GeneralName *Name = Names.At(i);
			if  ( Name->Tag() == SubjAltNameType )
			{
				//
				// Allocate buffer and  Copy subject alt name data to it (type tag and length is not copied !)
				//
				Identity = HBufC8::NewL(Name->Data().Length() - 2);
				Identity->Des().Copy(((TUint8*)(Name->Data().Ptr()) + 2), (Name->Data().Length() - 2));
				break;
			}
		}
		CleanupStack::PopAndDestroy(AltExt); 

	}   
	return Identity;
}


TInt IkeCert::CheckValidityPeriod(const CX509Certificate& aCert, TInt aWarningMargin, TInt aErrorMargin )
{
	TInt  Status = KErrNone;
	TTime current;
	current.UniversalTime();
	TTimeIntervalSeconds ErrorMargin(aErrorMargin); 
	TTime StartTime  = aCert.ValidityPeriod().Start();
	TTime FinishTime = aCert.ValidityPeriod().Finish();
	if ( (current + ErrorMargin) < StartTime )
	{
		Status = KCertVerifyErrNotValidYet;
	}
	else
	{
		if (current > (FinishTime + ErrorMargin) )
		{
			Status = KCertVerifyErrExpired;
		}
		else
		{
		  //
		  // If a warning margin defined, check is the certificate within that
		  //
			if ( aWarningMargin )
			{
				TTimeIntervalSeconds WarningMargin(aWarningMargin);
				if ( (current + WarningMargin) > (FinishTime + ErrorMargin) ) {
					Status = KCertVerifyWithinMargin;             
				}   
			}   
		}       
	}

	return Status;
}   

//
// Verify certificate extensions
// 
TInt IkeCert::VerifyCertExtensionsL(const CX509Certificate& aX509Cert)
{
	TInt Status = KErrNone;
	const CArrayPtrFlat<CX509CertExtension>& CertExtensions = aX509Cert.Extensions();	
	CX509CertExtension* Extension;  
	TInt Count = CertExtensions.Count();
	TInt i     = 0;

	while ( i < Count )
	{
		Extension = CertExtensions.At(i);
		if ( Extension->Id() == KKeyUsage )
		{
		   //
		   // KeyUsage extension MUST have either digitalSignature or
		   // nonRepudiation bit set
		   //
			CX509KeyUsageExt* KeyUsage = CX509KeyUsageExt::NewL(Extension->Data());
			if ( !KeyUsage->IsSet(EX509DigitalSignature) && !KeyUsage->IsSet(EX509NonRepudiation) )
			{
				delete KeyUsage;  
				Status = KCertVerifyKeyUsageErr;
				break;
			}
			else delete KeyUsage;
		}
		else if ( Extension->Id() == KBasicConstraints )
		{
		   //
		   // BasicConstraints extension MUST NOT have CA indicator
		   //
			CX509BasicConstraintsExt* BasicConstraints = CX509BasicConstraintsExt::NewL(Extension->Data());
			if ( BasicConstraints->IsCA() )
			{
				delete BasicConstraints; 
				Status = KCertVerifyCACertificate;
				break;
			}
			else delete BasicConstraints;
		}	
		else if ( Extension->Id() != KSubjectAltName && Extension->Critical() )				
		{
		   //
		   // Unsupported critical section ==> Certificate NOT accepted 
		   //
			Status = KCertVerifyCriticalExt;
			break;
		}   	

		i++;
	}

	return Status;
}
          
    
void IkeCert::CleanupSequence(TAny* aArray)
    {
    ASSERT(aArray);
	CArrayPtrFlat<TASN1DecGeneric>* array = reinterpret_cast<CArrayPtrFlat<TASN1DecGeneric>*>(aArray);
    ASSERT(array);
	array->ResetAndDestroy();
	delete array;
    }