/*
* Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of the License "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description: 
*
*/


#include "pkixcertchainao.h"
#include "pkixCons.h"
#include <x509keys.h>
#include <pkixcertchain.h>
#include "x509constraintext.h"

CPKIXCertChainAO* CPKIXCertChainAO::NewL(MCertStore& aCertStore,
										 CPKIXCertChainBase &aPKIXCertChain,
										 const RPointerArray<CX509Certificate>& aRootCerts)
	{
	CPKIXCertChainAO* self = new(ELeave) CPKIXCertChainAO(aCertStore, aPKIXCertChain);
	CleanupStack::PushL(self);
	self->ConstructL(aRootCerts);
	CleanupStack::Pop(self);
	return self;
	}

CPKIXCertChainAO* CPKIXCertChainAO::NewL(MCertStore& aCertStore, 
										 CPKIXCertChainBase &aPKIXCertChain,
										 const TUid aClient)
	{
	return new(ELeave) CPKIXCertChainAO(aCertStore, aPKIXCertChain, aClient);
	}

CPKIXCertChainAO::~CPKIXCertChainAO()
	{
	Cancel();

	delete iRoots;
	delete iBuilder;
	delete iCertsFromStoreRoots;
	}

CPKIXCertChainAO::CPKIXCertChainAO(MCertStore& aCertStore,
								   CPKIXCertChainBase &aPKIXCertChain)
	: CActive(EPriorityNormal), iCertStore(&aCertStore), iPKIXCertChain(aPKIXCertChain)
	{
	CActiveScheduler::Add(this);
	}

CPKIXCertChainAO::CPKIXCertChainAO(MCertStore& aCertStore, 
								   CPKIXCertChainBase &aPKIXCertChain,
								   const TUid aClient)
	: CActive(EPriorityNormal), iCertStore(&aCertStore),
	  iPKIXCertChain(aPKIXCertChain), iClient(aClient)
	{
	CActiveScheduler::Add(this);
	}

void CPKIXCertChainAO::ConstructL(const RPointerArray<CX509Certificate>& aRootCerts)
	{
	CPKIXCertsFromClient* roots = CPKIXCertsFromClient::NewLC(aRootCerts);
	iRoots = CPKIXChainBuilder::NewL();
	iRoots->AddSourceL(roots);
	CleanupStack::Pop(roots);
	}

void CPKIXCertChainAO::RunL()
	{
	User::LeaveIfError(iStatus.Int());

	switch (iState)
		{
		case EAddRoots:
			HandleEAddRootsL();
			break;

		case ERootsInitialized:
			HandleERootsInitializedL();
			break;

		case EBuildChainStart:
			HandleEBuildChainStartL();
			break;

		case EBuildChainAddCandidateEnd:
			HandleEBuildChainAddCandidateEndL();
			break;

		case EBuildChainCertsFromStoreBegin:
			HandleEBuildChainCertsFromStoreBeginL();
			break;

		case EBuildChainCertsFromStoreEnd:
			HandleEBuildChainCertsFromStoreEndL();
			break;

		case EAddCandidateIntermediateCertsEnd:
			HandleEAddCandidateIntermediateCertsEndL();
			break;

		case EValidateEnd:
			HandleEValidateEndL();
			break;

		default:
			User::Panic(_L("CPKIXCertChainAO"), 1);
			break;
		}
	}

TInt CPKIXCertChainAO::RunError(TInt aError)
{
	iPKIXCertChain.RemoveLastCerts(iNumberOfAddedCertificates);
	iNumberOfAddedCertificates = 0;

	delete iRoots;
	iRoots = 0;
		
	delete iBuilder;
	iBuilder = 0;
	delete iCertsFromStoreRoots;
	iCertsFromStoreRoots = 0;

	iValidationResult->RemovePolicies();

	User::RequestComplete(iOriginalRequestStatus, aError);
	return KErrNone;
}

/**
 * Creates a list of all the certificates retrieved from the store based on the filter passed.  
 */

void CPKIXCertChainAO::HandleEAddRootsL()
	{
	__ASSERT_DEBUG(!iCertsFromStoreRoots, User::Panic(_L("CPKICCertChainAO"), 1));
	iCertsFromStoreRoots = CPKIXCertsFromStore::NewL(*iCertStore, iClient);
	iCertsFromStoreRoots->Initialize(iStatus);
	iState = ERootsInitialized;	
	SetActive();
	}

/**
 * Adds the list of certificates retrieved from the store, iRoots (CPKIXChainBuilder)
 * maintains a templatized list of all the certificates in MPKIXCertSource format.
 */

void CPKIXCertChainAO::HandleERootsInitializedL()
	{
	iRoots->AddSourceL(iCertsFromStoreRoots);
	// Ownership has been passed to iRoots
	iCertsFromStoreRoots = 0;
	iState = EBuildChainStart;
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

void CPKIXCertChainAO::HandleEBuildChainStartL()
	{
	if ( false == iPKIXCertChain.ChainHasRoot())
		{
		if (iPKIXCertChain.Chain().Count() == 0)
			{
			iState = EValidateEnd;
			TRequestStatus* status = &iStatus;
			User::RequestComplete(status, KErrNone);
			}
		else
			{
			//1) look for an issuer that's a root
			iRoots->AddIssuer(iNumberOfAddedCertificates, iAddIssuerResult, iPKIXCertChain.Chain(), iStatus);
			iState = EBuildChainAddCandidateEnd;
			}
		}
	else
		{
		// This is the correct state as at this point the chain of certificate has been build upto a
		// root certificate.
		iState = EValidateEnd;
		TRequestStatus* status = &iStatus;
		User::RequestComplete(status, KErrNone);
		}
	SetActive();
	}

void CPKIXCertChainAO::HandleEBuildChainAddCandidateEndL()
	{
	if (iAddIssuerResult)
		{
		iPKIXCertChain.SetChainHasRoot(ETrue);
		iState = EValidateEnd;
		}
	else
		{
		//2) look for a non-root issuer in intermediate certs
		iBuilder = CPKIXChainBuilder::NewL();
		
		CPKIXCertsFromClient* serverCerts = CPKIXCertsFromClient::NewLC(iPKIXCertChain.IntermediateCerts());
		iBuilder->AddSourceL(serverCerts);
		CleanupStack::Pop(serverCerts);

		iState = EBuildChainCertsFromStoreBegin;
		}

	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

void CPKIXCertChainAO::HandleEBuildChainCertsFromStoreBeginL()
	{
	//3) look for a non-root issuer in the store
	iCertsFromStoreRoots = CPKIXCertsFromStore::NewL(*iCertStore);
	iCertsFromStoreRoots->Initialize(iStatus);
	iState = EBuildChainCertsFromStoreEnd;
	SetActive();
	}

void CPKIXCertChainAO::HandleEBuildChainCertsFromStoreEndL()
	{
	iBuilder->AddSourceL(iCertsFromStoreRoots);
	iCertsFromStoreRoots = 0;

	iBuilder->AddIssuer(iNumberOfAddedCertificates, iAddIssuerResult, iPKIXCertChain.Chain(), iStatus);
	iState = EAddCandidateIntermediateCertsEnd;
	SetActive();
	}

void CPKIXCertChainAO::HandleEAddCandidateIntermediateCertsEndL()
	{
	if (iAddIssuerResult)
		{
		// cert is a pointer to something we don't own
		CX509Certificate* cert = iPKIXCertChain.Chain().At(iPKIXCertChain.Chain().Count() - 1);
		
		/* If the issuer is not a self signed certificate then it cannot be trusted anchor for the chain 
		 * validation process, this means that we restart the certification validation process.
		 */ 
		
		if (!(cert->IsSelfSignedL()))
			{
			iState = EBuildChainStart;	
			}
		else
			{
			iState = EValidateEnd;			
			}
		}
	else
		{
		iState = EValidateEnd;	
		}

	delete iBuilder;
	iBuilder = 0;

	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

void CPKIXCertChainAO::HandleEValidateEndL()
	{
	InitParamsL();
	
	__ASSERT_DEBUG(iValidationResult, User::Panic(_L("CPKICCertChainAO"), 1));
	DoValidateL(*iValidationResult, iValidationTime, iInitialPolicies);

	User::RequestComplete(iOriginalRequestStatus, KErrNone);
	}

void CPKIXCertChainAO::DoCancel()
	{
	delete iRoots;
	iRoots = 0;

	delete iBuilder;
	iBuilder = 0;

	delete iCertsFromStoreRoots;
	iCertsFromStoreRoots = 0;

	User::RequestComplete(iOriginalRequestStatus, KErrCancel);
	}

void CPKIXCertChainAO::ValidateL(CPKIXValidationResultBase& aValidationResult,
								 const TTime& aValidationTime,								 
								 const CArrayPtr<HBufC>* aInitialPolicies,
								 TRequestStatus& aStatus)
	{
	aValidationResult.Reset();
	iValidationResult = &aValidationResult;
	iValidationTime = aValidationTime;
	iInitialPolicies = aInitialPolicies;
	iOriginalRequestStatus = &aStatus;
	iNumberOfAddedCertificates = 0;

	__ASSERT_ALWAYS(!IsActive(), User::Panic(_L("CPKICCertChainAO"), 1));

	if (!iRoots)
		{
		// If iRoots is 0, it means that the caller gave a uid and that
		// we must retrieve the trusted certificates from the different
		// stores
		iRoots = CPKIXChainBuilder::NewL();
		iState = EAddRoots;
		}
	else
		{
		// The caller gave a set of certificates it trusts,
		// so we don't have to retrieve anything from the stores
		iState = EBuildChainStart;
		}

	aStatus = KRequestPending;
	TRequestStatus *status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

void CPKIXCertChainAO::CancelValidate()
	{
	Cancel();
	}

void CPKIXCertChainAO::InitParamsL()
/*
this function initialises signing key parameters for the certificates
-only DSA needs these at present
-we get the signing key, from the spki of the issuer
-if it's dsa, we look for params here
	-if we find them we initialise the cert with them
	-otherwise, we look in the issuer's issuer
		-if we don't find them there we give up.
*/
	{
	
	// If the root is DSA signed, set its parameters

	TInt count = iPKIXCertChain.Chain().Count();
	
	CX509Certificate* current = iPKIXCertChain.Chain().At(count-1);
	TAlgorithmId signingAlgorithm = current->SigningAlgorithm().AsymmetricAlgorithm().Algorithm();
	
	if (signingAlgorithm == EDSA)
		{
		
		const CSubjectPublicKeyInfo& key = current->PublicKey();
		SetParamsL(*current, key.EncodedParams());
		
		}
	
	// Also the rest of the chain
	
	for (TInt i = count - 2; i >= 0; i--)
		{
		
		current = iPKIXCertChain.Chain().At(i);
		TAlgorithmId signingAlgorithm = current->SigningAlgorithm().AsymmetricAlgorithm().Algorithm();
		
		if (signingAlgorithm == EDSA)
			{
			
			// Look down the chain for parameters
			
			for (TInt j = i+1; j < count; j++)
				{
				
				CX509Certificate* issuer = iPKIXCertChain.Chain().At(j);
				const CSubjectPublicKeyInfo& key = issuer->PublicKey();
				if (key.EncodedParams() != KNullDesC8 && key.AlgorithmId() == EDSA)
					{
					SetParamsL(*current, key.EncodedParams());
					break;
					}
				
				}
			
			}
		
		}
	}

void CPKIXCertChainAO::SetParamsL(CX509Certificate& aCert, const TPtrC8& aEncodedParams)
	{
	TX509KeyFactory factory;
	CDSAParameters* theDSAParams = factory.DSAParametersL(aEncodedParams);
	CleanupStack::PushL(theDSAParams);
	
	CSigningKeyParameters* params = CSigningKeyParameters::NewLC();
	params->SetDSAParamsL(*theDSAParams);
	
	aCert.SetParametersL(*params);

	CleanupStack::PopAndDestroy(2, theDSAParams);
	}

void CPKIXCertChainAO::DoValidateL(CPKIXValidationResultBase& aValidationResult,
								 const TTime& aValidationTime, 
								 const CArrayPtr<HBufC>* aInitialPolicies)
	{
	if (!iPKIXCertChain.ChainHasRoot())
		{
		aValidationResult.SetError(EChainHasNoRoot, 0);
		}
	else
		{
		CPKIXValidationState* state = CPKIXValidationState::NewLC(aValidationTime, iPKIXCertChain.Chain().Count(), aInitialPolicies);
		TRAPD(err, ProcessCertsL(*state, aValidationResult));
		//a leave here means either:
		//	-a validation error, in which case we've set the error field in result, or
		//	-some other error (e.g. OOM) in which case error is still EChainHasNoRoot
		if ((err != KErrNone) && ((aValidationResult.Error().iReason) == EChainHasNoRoot))
			//then we left with a non-validation-related error, so leave again...
			{
			User::Leave(err);
			}
		CleanupStack::PopAndDestroy(state);
		}
	}

// ProcessCertsL: This function validates a complete certificate 
//                chain. If an error occurs in this function the function
//                SetErrorAndLeaveL must be called. 
// 
// Note Do not use SetErrorAndLeaveL with EChainHasNoRoot (see TRAP code in 
// CPKIXCertChainAO::DoValidateL )             
void CPKIXCertChainAO::ProcessCertsL(CPKIXValidationState& aState,
									 CPKIXValidationResultBase& aResult) const
	{
	TPKIXPolicyConstraint policy(aState, aResult);
	TPKIXNameConstraint name(aState, aResult);
	TPKIXBasicConstraint basic(aState, aResult);
	TPKIXKeyUsageConstraint keyUsage(aState, aResult);
	for (; aState.iPos >= 0; aState.iPos--)
		{
		aState.iMaxPathLength--;
		if (aState.iMaxPathLength < aState.iPos)
			{
			aResult.SetErrorAndLeaveL(EPathTooLong, aState.iPos);
			}
		const CX509Certificate* current = iPKIXCertChain.Chain().At(aState.iPos);
		CCertificateValidationWarnings* certWarnings = CCertificateValidationWarnings::NewLC(aState.iPos);
		aResult.AppendCertificateValidationObjectL(*certWarnings);
		CleanupStack::Pop(certWarnings);
		CriticalExtsL(aState, *current);
		CheckCriticalExtsL(aState, aResult);
		CheckSignatureAndNameL(*current, aState, aResult);
		//!!!!NO!!checks for revocation at this time!!
		
		if (!(current->ValidityPeriod().Valid(aState.iValidationTime)))
			{
			//validity period invalid, now check how to report this
			if (iPKIXCertChain.ValidityPeriodCheckFatal())
				{
				aResult.SetErrorAndLeaveL(EDateOutOfRange, aState.iPos);
				}
			else
				{
				aResult.AppendWarningL(TValidationStatus(EDateOutOfRange, aState.iPos));
				}
			}
		
		policy.CheckCertPoliciesL(*current);
		name.CheckNameConstraintsL(*current);
		keyUsage.CheckKeyUsageL(*current);
		if (aState.iPos < (iPKIXCertChain.Chain().Count() - 1))
			{
			basic.CheckCertSubjectTypeL(*current);
			}
		basic.UpdatePathLengthConstraintsL(*current);
		name.UpdateNameConstraintsL(*current);
		policy.UpdatePolicyConstraintsL(*current);
		aState.iCriticalExts->Reset();
		}
	policy.FinishPolicyCheckL();
	//*copy* all policies from aState.iAuthorityConstrainedPolicies into aResult.iPolicies
	TInt policyCount = aState.iAuthorityConstrainedPolicies->Count();
	for (TInt i = 0; i < policyCount; i ++)
		{
		CX509CertPolicyInfo* policyInfo = CX509CertPolicyInfo::NewLC(*(aState.iAuthorityConstrainedPolicies->At(i)));
		aResult.AppendPolicyL(*policyInfo);
		CleanupStack::Pop(policyInfo);
		}

	aResult.SetError(EValidatedOK, 0);
	}

void CPKIXCertChainAO::CriticalExtsL(CPKIXValidationState& aState, 
									 const CX509Certificate& aCert) const
	{
	const CArrayPtrFlat<CX509CertExtension>& exts = aCert.Extensions();
	TInt count = exts.Count();
	for (TInt i = 0; i < count; i++)
		{
		CX509CertExtension* ext = exts.At(i);
		if (ext->Critical())
			{
			aState.iCriticalExts->AppendL(ext);
			}
		}	 
	}

void CPKIXCertChainAO::CheckSignatureAndNameL(const CX509Certificate& aCert, CPKIXValidationState& aState, 
											CPKIXValidationResultBase& aResult) const
	{
	TInt issuerPos = aState.iPos + 1;
	if (issuerPos == iPKIXCertChain.Chain().Count())
		//then it's the root
		{
		if (aCert.IssuerName().ExactMatchL(aCert.SubjectName()))
			//then it claims to be self signed, sig must verify
			{
			if (!(aCert.VerifySignatureL(aCert.PublicKey().KeyData())))
				{
				aResult.SetErrorAndLeaveL(ESignatureInvalid, aState.iPos);
				}
			}
		else
			//we generate a warning
			{
			aResult.AppendWarningL(TValidationStatus(ERootCertNotSelfSigned, aState.iPos));
			}
		}
	else
		//then it isn't the root: so names must chain & sigs must verify
		{
		const CX509Certificate* issuer = iPKIXCertChain.Chain().At(issuerPos);
		if (!(aCert.IssuerName().ExactMatchL(issuer->SubjectName())))
			{
			aResult.SetErrorAndLeaveL(ENamesDontChain, aState.iPos);
			}
		if (!(aCert.VerifySignatureL(issuer->PublicKey().KeyData())))
			{
			aResult.SetErrorAndLeaveL(ESignatureInvalid, aState.iPos);
			}
		}
	}

void CPKIXCertChainAO::CheckCriticalExtsL(CPKIXValidationState& aState, CPKIXValidationResultBase& aResult) const
	{
	TBool foundUnrecognisedCritExt;
	
	// retrieve the supported list of critical extensions. If a critical extension is found whose OID matches an 
	// element in this set then certificate validation shall treat this as a warning instead of an error.
	const RPointerArray<TDesC>& supportedCritExt = iPKIXCertChain.SupportedCriticalExtensions();
	
	TInt count = aState.iCriticalExts->Count();
	TInt supportedCount = supportedCritExt.Count();
	for (TInt i = 0; i < count; i++)
		{
		foundUnrecognisedCritExt = ETrue;
		const CX509CertExtension* ext = aState.iCriticalExts->At(i);
		const TPtrC& extName = ext->Id();
		
		for (TInt j = 0; j < supportedCount; ++j)
			{
			if (extName == *supportedCritExt[j])
				{
				foundUnrecognisedCritExt = EFalse;
				HBufC* oid = extName.AllocLC();
				aResult.AppendCriticalExtensionWarningL(*oid);
				CleanupStack::Pop(oid);
				break;
				}
			}			
		
		if (extName == KExtendedKeyUsage)
			{
			aResult.AppendWarningL(TValidationStatus(ECriticalExtendedKeyUsage, aState.iPos));
			}
		else if (extName == KPolicyMapping)
			{
			aResult.AppendWarningL(TValidationStatus(ECriticalPolicyMapping, aState.iPos));
			}
		else if (extName == KInhibitAnyPolicy)
			{
			//ignore this in the same way
			}
		else if (extName == KDeviceIdListConstraint)
			{
			aResult.AppendWarningL(TValidationStatus(ECriticalDeviceId, aState.iPos));
			}
		else if(extName == KSidListConstraint)
			{
			aResult.AppendWarningL(TValidationStatus(ECriticalSid, aState.iPos));
			}
		else if(extName == KVidListConstraint)
			{
			aResult.AppendWarningL(TValidationStatus(ECriticalVid, aState.iPos));
			}
		else if(extName == KCapabilitiesConstraint)
			{
			aResult.AppendWarningL(TValidationStatus(ECriticalCapabilities, aState.iPos));
			}
		
		if (foundUnrecognisedCritExt)
			{
			aResult.SetErrorAndLeaveL(EUnrecognizedCriticalExtension, aState.iPos);
			}			
		
		}
	}