/*

* Copyright (c) 2004-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description: 

*

*/

#include "cfskeystoreserver.h"

#include "CKeyDataManager.h"

#include "CKeyStoreConduit.h"

#include "CKeyStoreSession.h"

#include "fstokencliserv.h"

#include "CCreateKey.h"

#include "OpenedKeys.h"

#include "keystorepassphrase.h"

#include "fsdatatypes.h"

#include "keystreamutils.h"

#include <fstokenutil.h>

#include <asnpkcs.h>

#include <pbedata.h>

#include <securityerr.h>

#include <pbe.h>

#include <asnpkcs.h>

#include <asn1enc.h>

#include <x509keys.h>

#include <keyidentifierutil.h>

#include <mctauthobject.h>

#include <utf.h>

// We don't currently allow any keys larger than 2048 bits.  It may be necessary to

// increase this limit in the future. 

const TUint KTheMinKeySize = 512;

const TUint KTheMaxKeySize = 2048;

// Security policies

_LIT_SECURITY_POLICY_C1(KSetTimeoutSecurityPolicy, ECapabilityWriteDeviceData);

_LIT_SECURITY_POLICY_C1(KCreateSecurityPolicy, ECapabilityWriteUserData);

_LIT_SECURITY_POLICY_C1(KListSecurityPolicy, ECapabilityReadUserData);

CFSKeyStoreServer* CFSKeyStoreServer::NewL()

	{

	CFSKeyStoreServer* me = new (ELeave) CFSKeyStoreServer();

	CleanupStack::PushL(me);

	me->ConstructL();

	CleanupStack::Pop(me);

	return (me);

	}

CFSKeyStoreServer::CFSKeyStoreServer() :

	CActive(EPriorityStandard),

	iAction(EIdle),

	iExportBuf(NULL, 0)

	{

	}

void CFSKeyStoreServer::ConstructL()

	{

	iKeyDataManager = CFileKeyDataManager::NewL();

	iConduit = CKeyStoreConduit::NewL(*this);

	CActiveScheduler::Add(this);

	}

CFSKeyStoreServer::~CFSKeyStoreServer()

	{

	Cancel();

	delete iKeyDataManager;

	delete iConduit;

	delete iKeyCreator;

	iSessions.Close();

	}

CKeyStoreSession* CFSKeyStoreServer::CreateSessionL()

	{

	CPassphraseManager* passMan = iKeyDataManager->CreatePassphraseManagerLC();

	CKeyStoreSession* session = CKeyStoreSession::NewL(*this, passMan);

	CleanupStack::Pop(passMan);

	CleanupStack::PushL(session);

	User::LeaveIfError(iSessions.Append(session));

	CleanupStack::Pop(session);

	return session;

	}

void CFSKeyStoreServer::RemoveSession(CKeyStoreSession& aSession)

	{

	if (iSession == &aSession) // just in case

		{

		iSession = NULL; 

		}

	for (TInt index = 0 ; index < iSessions.Count() ; ++index)

		{

		if (iSessions[index] == &aSession)

			{

			iSessions.Remove(index);

			return;

			}

		}

	User::Invariant();

	}

void CFSKeyStoreServer::ServiceRequestL(const RMessage2& aMessage, CKeyStoreSession& aSession)

	{

	iMessage = &aMessage;

	iSession = &aSession;

	iConduit->ServiceRequestL(aMessage, aSession);

	}

//	*********************************************************************************

//	From MCTKeyStore

//	*********************************************************************************

void CFSKeyStoreServer::ListL(const TCTKeyAttributeFilter& aFilter,

							  RPointerArray<CKeyInfo>& aKeys)

	{

	ASSERT(iMessage);

	// Check the calling process has ReadUserData capability

	if (!KListSecurityPolicy.CheckPolicy(*iMessage))

		{

		User::Leave(KErrPermissionDenied);

		}

	TInt count = iKeyDataManager->Count();

	for (TInt i = 0; i < count; ++i)

		{

		const CFileKeyData* data = (*iKeyDataManager)[i];

		CKeyInfo* info = iKeyDataManager->ReadKeyInfoLC(*data);

		if (KeyMatchesFilterL(*info, aFilter))

			{

			User::LeaveIfError(aKeys.Append(info));

			CleanupStack::Pop(info);

			}

		else

			{

			CleanupStack::PopAndDestroy(info);

			}

		}

	}

TBool CFSKeyStoreServer::KeyMatchesFilterL(const CKeyInfo& aInfo,

										   const TCTKeyAttributeFilter& aFilter)

	{

	ASSERT(iMessage);

	if (aFilter.iKeyId.Length() && aFilter.iKeyId != aInfo.ID())

		{

		return EFalse;

		}

	if (aFilter.iUsage != EPKCS15UsageAll)

		{

		if ((aInfo.Usage() & aFilter.iUsage) == 0)

			return EFalse;

		}

	if (aFilter.iKeyAlgorithm != CCTKeyInfo::EInvalidAlgorithm && 

		aFilter.iKeyAlgorithm != aInfo.Algorithm())

		{

		return EFalse;

		}

	switch (aFilter.iPolicyFilter)

		{

		case TCTKeyAttributeFilter::EAllKeys:

			// All keys pass

			break;

		case TCTKeyAttributeFilter::EUsableKeys:

			if (!aInfo.UsePolicy().CheckPolicy(*iMessage))

				{

				return EFalse;

				}

			break;

		case TCTKeyAttributeFilter::EManageableKeys:

			if (!aInfo.ManagementPolicy().CheckPolicy(*iMessage))

				{

				return EFalse;

				}

			break;

		case TCTKeyAttributeFilter::EUsableOrManageableKeys:

			if (!aInfo.UsePolicy().CheckPolicy(*iMessage) &&

				!aInfo.ManagementPolicy().CheckPolicy(*iMessage))

				{

				return EFalse;

				}

			break;

		default:

			User::Leave(KErrArgument);

		}

	return ETrue;

	}

void CFSKeyStoreServer::GetKeyInfoL(TInt aObjectId, CKeyInfo*& aInfo)

	{

	const CFileKeyData* keyData = iKeyDataManager->Lookup(aObjectId);

	if (!keyData)

		{

		User::Leave(KErrNotFound);

		}

	CKeyInfo* result = iKeyDataManager->ReadKeyInfoLC(*keyData);

	if (!result->UsePolicy().CheckPolicy(*iMessage))

		{

		User::Leave(KErrPermissionDenied);

		}

	aInfo = result;

	CleanupStack::Pop(aInfo);

	}

TInt CFSKeyStoreServer::GetKeyLengthL(TInt aObjectId)

	{

	const CFileKeyData* keyData = iKeyDataManager->Lookup(aObjectId);

	if (!keyData)

		{

		User::Leave(KErrNotFound);

		}

	// this could be cached in memory (would break file format though)

	CKeyInfo* keyInfo = iKeyDataManager->ReadKeyInfoLC(*keyData);

	TInt result = keyInfo->Size();

	CleanupStack::PopAndDestroy(keyInfo);

	return result;

	}

COpenedKey* CFSKeyStoreServer::OpenKeyL(TInt aHandle, TUid aOpenedKeyType)

	{

	ASSERT(iMessage);

	const CFileKeyData *keyData = iKeyDataManager->Lookup(aHandle);

	if (!keyData)

		{

		User::Leave(KErrNotFound);

		}

	return COpenedKey::NewL(*keyData, aOpenedKeyType, *iMessage,

							*iKeyDataManager, iSession->PassphraseManager());

	}

void CFSKeyStoreServer::ExportPublicL(TInt aObjectId,

									  TDes8& aOut)

	{

	const CFileKeyData* keyData = iKeyDataManager->Lookup(aObjectId);

	if (!keyData)

		{

		User::Leave(KErrNotFound);

		}

	CKeyInfo* keyInfo = iKeyDataManager->ReadKeyInfoLC(*keyData);

	RStoreReadStream stream;

	iKeyDataManager->OpenPublicDataStreamLC(*keyData, stream);

	CKeyInfo::EKeyAlgorithm keyAlgorithm = keyInfo->Algorithm();

	switch(keyAlgorithm)

		{

		case (CKeyInfo::ERSA):

			{

			CRSAPublicKey* publicKey = NULL;

			CreateL(stream, publicKey);

			ASSERT(publicKey);

			CleanupStack::PushL(publicKey);

			TX509RSAKeyEncoder encoder(*publicKey, ESHA1);

			CASN1EncBase* encoded = encoder.EncodeKeyLC();

			if (encoded->LengthDER() > static_cast<TUint>(aOut.MaxLength()))

				{

				User::Leave(KErrOverflow);

				}

			//	Get the Public key DER encoding

			TUint pos=0;

			encoded->WriteDERL(aOut, pos);

			// WriteDERL does not set the length of the buffer, we do it ourselves			

			aOut.SetLength(encoded->LengthDER());			

			CleanupStack::PopAndDestroy(2, publicKey);

			}

		break;

		case (CKeyInfo::EDSA):

			{

			CDSAPublicKey* publicKey = NULL;

			CreateL(stream, publicKey);

			ASSERT(publicKey);

			CleanupStack::PushL(publicKey);

			TX509DSAKeyEncoder encoder(*publicKey, ESHA1);

			CASN1EncBase* encoded = encoder.EncodeKeyLC();

			if (encoded->LengthDER() > static_cast<TUint>(aOut.MaxLength()))

				{

				User::Leave(KErrOverflow);

				}

			//	Get the Public key DER encoding

			TUint pos=0;

			encoded->WriteDERL(aOut, pos);

			// WriteDERL does not set the length of the buffer, we do it ourselves			

			aOut.SetLength(encoded->LengthDER());						

			CleanupStack::PopAndDestroy(2, publicKey);

			}

		break;

		case (CKeyInfo::EDH):

		default:

			User::Leave(KErrKeyAlgorithm);

			break;

	}

	CleanupStack::PopAndDestroy(2, keyInfo); //stream, keyinfo

	}

//	*********************************************************************************

//	From MCTKeyStoreManager

//	*********************************************************************************

TInt CFSKeyStoreServer::CheckKeyAttributes(CKeyInfo& aKey, TNewKeyOperation aOp)

	{

	ASSERT(iMessage);

	// Sort out the access rights

	TInt access = aKey.AccessType(); 

	// Only allow sensitive and extractable to be sepcified

	if (access & ~(CKeyInfo::ESensitive | CKeyInfo::EExtractable))

		{

		return KErrKeyAccess;

		}	

	// If it's sensitive and either created internally 

	// or imported from an encrypted source then it's always been sensitive

	if ((access & CKeyInfo::ESensitive) &&

		(aOp == ENewKeyCreate || aOp == ENewKeyImportEncrypted))

		{

		access |= CKeyInfo::EAlwaysSensitive;		

		}

	// If it's not extractable and it's created internally

	// then it's never been extractable

	if ((!(access & CKeyInfo::EExtractable)) && aOp == ENewKeyCreate)

		{

		access |= CKeyInfo::ENeverExtractable;		

		}

	aKey.SetAccessType(access);

	// check management policy allows the calling process to manage the key

	if (!aKey.ManagementPolicy().CheckPolicy(*iMessage))

		{

		return KErrArgument;

		}

	// check end date is not in the past

	TTime timeNow;

	timeNow.UniversalTime();

	if (aKey.EndDate().Int64() != 0 && aKey.EndDate() <= timeNow)

		{

		return KErrKeyValidity;

		}

	// We don't support non-repudiation, however we currently allow keys

	// to be created with this usage

	return KErrNone;

	}

TInt CFSKeyStoreServer::CheckKeyAlgorithmAndSize(CKeyInfo& aKey)

	{

	CKeyInfo::EKeyAlgorithm keyAlgorithm = aKey.Algorithm();

	if ( ((keyAlgorithm!=CKeyInfo::ERSA) && (keyAlgorithm!=CKeyInfo::EDSA) && (keyAlgorithm!=CKeyInfo::EDH) ))

		{

		return KErrKeyAlgorithm;

		}

	if (aKey.Size() < KTheMinKeySize || aKey.Size() > KTheMaxKeySize)

		{

		return KErrKeySize;

		}

	return KErrNone;

	}

void CFSKeyStoreServer::CreateKey(CKeyInfo& aReturnedKey, TRequestStatus& aStatus)

	{

	ASSERT(iSession);

	ASSERT(iMessage);

	TInt err = KErrNone;

	// Check the calling process has WriteUserData capability

	if (!KCreateSecurityPolicy.CheckPolicy(*iMessage))

		{

		err = KErrPermissionDenied;

		}

	// Check the incoming information has been initialised correctly

	if (err == KErrNone)

		{

		err = CheckKeyAttributes(aReturnedKey, ENewKeyCreate);

		}

	if (err == KErrNone)

		{

		err = CheckKeyAlgorithmAndSize(aReturnedKey);

		}

	if (err != KErrNone)

		{

		TRequestStatus* status = &aStatus;

		User::RequestComplete(status, err);

		return;

		}

	// DEF042306: Make it local only if it's created in the keystore

	aReturnedKey.SetAccessType(aReturnedKey.AccessType() | CKeyInfo::ELocal);

	if (iKeyDataManager->IsKeyAlreadyInStore(aReturnedKey.Label()))

		{

		TRequestStatus* status = &aStatus;

		User::RequestComplete(status, KErrAlreadyExists);

		return;

		}

	iCallerRequest = &aStatus;

	iKeyInfo = &aReturnedKey;

	GetKeystorePassphrase(ECreateKeyCreate);	

	}

void CFSKeyStoreServer::CancelCreateKey()

	{

	if (iAction == ECreateKeyCreate ||

		iAction == ECreateKeyFinal)

		{

		Cancel();

		}

	}

void CFSKeyStoreServer::DoCreateKeyL()

{

	__ASSERT_DEBUG(iAction==ECreateKeyCreate, PanicServer(EPanicECreateKeyNotReady));

	__ASSERT_DEBUG(iKeyInfo, PanicServer(EPanicNoClientData));

	if (iKeyCreator)

	{

		delete iKeyCreator;

		iKeyCreator = NULL;

	}

	iKeyCreator = new (ELeave) CKeyCreator();

	iStatus = KRequestPending;

	iAction = EKeyCreated;

	iKeyCreator->DoCreateKeyAsyncL(iKeyInfo->Algorithm(), iKeyInfo->Size(), iStatus);

	SetActive(); 

}

/**

 * Get the default passphrase for the store, or create one if it hasn't been set

 * yet.  This is used for key creation, import and export.

 *

 * Calls SetActive(), and sets the next state.

 */

void CFSKeyStoreServer::GetKeystorePassphrase(ECurrentAction aNextState)

	{

	ASSERT(iSession);

	TStreamId passphraseId = iKeyDataManager->DefaultPassphraseId();

	TInt timeout = iKeyDataManager->GetPassphraseTimeout();

	if (passphraseId == KNullStreamId)

		{

		iSession->PassphraseManager().CreatePassphrase(timeout, iPassphrase, iStatus);

		}

	else

		{

		iSession->PassphraseManager().GetPassphrase(passphraseId, timeout, iPassphrase, iStatus);

		}

	iAction = aNextState;

	SetActive();

	}

/**

 * Store a key.

 *

 * 

 *

 * This method is not transaction-safe, as if a leave occurs after key data has

 * been written to the store, it is not cleaned up.  Also, it shares most of its

 * code with PKCS8ToKeyL (and the same problem applied).  This should be

 * corrected by creating an interface for generic key data, including write

 * private key / write public key / get key identifier operations, which can be

 * passed to a single method in the key data manager to do the job of these two

 * methods.

 *

 * I'm not fixing this now because it's not a big problem for real-world use,

 * and I don't have the time to spend on it.

 *

 * - jc

 */

void CFSKeyStoreServer::DoStoreKeyL()

	{

	__ASSERT_DEBUG(iAction==ECreateKeyFinal, PanicServer(EPanicECreateKeyNotReady));

	__ASSERT_DEBUG(iKeyInfo, PanicServer(EPanicNoClientData));

	__ASSERT_DEBUG(iKeyCreator, PanicServer(ENoCreatedKeyData));

	ASSERT(iPassphrase);