/*
* Copyright (c) 1998-2009 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of the License "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description: 
*
*/


#include "wtlscertchainao.h"
#include <asymmetric.h>
#include <bigint.h>
#include <ccertattributefilter.h>
#include <cctcertinfo.h>

CWTLSCertChainAO* CWTLSCertChainAO::NewL(RFs& aFs, 
										 CWTLSCertChain& aWTLSCertChain,
										 const CArrayPtr<CWTLSCertificate>& aRootCerts)
	{
	CWTLSCertChainAO* self = new(ELeave) CWTLSCertChainAO(aFs, aWTLSCertChain);
	CleanupStack::PushL(self);
	self->ConstructL(aRootCerts);
	CleanupStack::Pop(self);
	return self;
	}

CWTLSCertChainAO* CWTLSCertChainAO::NewL(RFs& aFs, 
										 CWTLSCertChain& aWTLSCertChain,
										 const TUid aClient)
	{
	return new(ELeave) CWTLSCertChainAO(aFs, aWTLSCertChain, aClient);
	}

CWTLSCertChainAO::~CWTLSCertChainAO()
	{
	Cancel();
	delete iCertStoreManager;
	delete iFilter;
	delete iEncodedCertTemp;
	iRootSubjectClientHashList.ResetAndDestroy();
	iRootSubjectStoreHashList.Close();
	iCertInfos.Close(); //In an RMPointerArray Close deletes all elements as 
						//well as any personal allocated space
	iRootsFromStore.ResetAndDestroy();
	iRootsFromStore.Close();
	iRootsFromClient.ResetAndDestroy();
	}

CWTLSCertChainAO::CWTLSCertChainAO(RFs& aFs, 
								   CWTLSCertChain& aWTLSCertChain)
	: CActive(EPriorityNormal), iFs(aFs), iWTLSCertChain(aWTLSCertChain), iEncodedCert(NULL, 0)
	{
	CActiveScheduler::Add(this);
	}

CWTLSCertChainAO::CWTLSCertChainAO(RFs& aFs, 
								   CWTLSCertChain& aWTLSCertChain,
								   const TUid aClient)
	: CActive(0), iFs(aFs), iWTLSCertChain(aWTLSCertChain), iClient(aClient),
		iEncodedCert(NULL, 0)
	{
	CActiveScheduler::Add(this);
	}

void CWTLSCertChainAO::ConstructL(const CArrayPtr<CWTLSCertificate>& aRootCerts)
	{
	for(TInt i=0; i< aRootCerts.Count(); i++)
		{
		CWTLSCertificate* root = CWTLSCertificate::NewLC(*(aRootCerts[i]));
		User::LeaveIfError( iRootsFromClient.Append(root) );
		CleanupStack::Pop(); //root
		}
	}

void CWTLSCertChainAO::RunL()
	{
	//If any of my active objects complete with errors then we don't
	//want to proceed
	User::LeaveIfError(iStatus.Int());

	switch (iState)
		{
		case EStoreManagerInitialization:
			HandleEStoreManagerInitializationL();
			break;

		case EStoreManagerInitialized:
			HandleEStoreManagerInitializedL();
			break;

		case EGetCertHashes:
			HandleEGetCertHashesL();
			break;

		case EPruneList:
			HandleEPruneListL();
			break;

		case EPruneListDone:
			HandleEPruneListDoneL();
			break;

		case ECheckTCA:
			HandleECheckTCAL();
			break;

		case EIsChainSelfSigned:
			HandleEIsChainSelfSignedL();
			break;

		case ERetrieveRoots:
			HandleERetrieveRootsL();
			break;

		case EAddRootToList:
			HandleEAddRootToListL();
			break;

		case EFindRoot:
			HandleEFindRootL();
			break;

		case EValidateEnd:
			HandleEValidateEndL();
			break;
		
		default:
			__ASSERT_DEBUG(EFalse, User::Panic(_L("CWTLSCertChainAO"), 1));
			User::Leave(KErrArgument);
			break;
		}
	}

TInt CWTLSCertChainAO::RunError(TInt aError)
	{
	User::RequestComplete(iOriginalRequestStatus, aError);

	delete iCertStoreManager;
	iCertStoreManager = 0;

	return 0;
	}

void CWTLSCertChainAO::DoCancel()
	{
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrCancel);
	if (iOriginalRequestStatus)
		{
		User::RequestComplete(iOriginalRequestStatus, KErrCancel);
		}
	}

void CWTLSCertChainAO::Validate(CWTLSValidationResult& aValidationResult,
								const TTime& aValidationTime,								 
								TRequestStatus& aStatus)
	{
	iValidationResult = &aValidationResult;
	iValidationResult->Reset();
	iValidationTime = &aValidationTime;
	iOriginalRequestStatus = &aStatus;
	aStatus = KRequestPending;

	__ASSERT_DEBUG(!IsActive(), User::Panic(_L("CWTLSCertChainAO"), 1));
	__ASSERT_DEBUG(!iCertStoreManager, User::Panic(_L("CWTLSCertChainAO"), 1));
	
	iState = EStoreManagerInitialization;
	TRequestStatus *status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

TBool CWTLSCertChainAO::CheckSignatureAndNameL(const CWTLSCertificate& aCert, 
											   CWTLSValidationResult& aResult,
											   TInt aPos) const
	{
	TInt issuerPos = aPos + 1;
	TBool res = EFalse;
	if (issuerPos == iWTLSCertChain.iChain->Count())
		//then it's the root
		{
		if (aCert.IssuerName().ExactMatchL(aCert.SubjectName()))
			//then it claims to be self signed, sig must verify
			{
			if (aCert.VerifySignatureL(aCert.PublicKey().KeyData()))
				{
				res = ETrue;
				}
			else 
				{
				aResult.SetError(ESignatureInvalid, aPos);
				}
			}
		else
			{
			aResult.AppendWarningL(TWTLSValidationStatus(ERootCertNotSelfSigned, aPos));
			res = ETrue; //if its a warning we continue the validation process with the 
						//warning duly noted so we can check for further warn/errors
			}
		}
	else
		//then it isn't the root: so names must chain & sigs must verify
		{
		const CWTLSCertificate* issuer = iWTLSCertChain.iChain->At(issuerPos);
		TBool subject = EFalse;
		TBool signature = EFalse;
		subject = aCert.IssuerName().ExactMatchL(issuer->SubjectName());
		if( !subject ) 
			{
			aResult.SetError(ENamesDontChain, aPos);
			return EFalse;
			}
		signature = aCert.VerifySignatureL(issuer->PublicKey().KeyData());
		if( !signature )
			{
			aResult.SetError(ESignatureInvalid, aPos);
			return EFalse;
			}
		res = subject && signature;
		}
	return res;
	}

TBool CWTLSCertChainAO::CheckValidityPeriod(const CWTLSCertificate& aCert,
											CWTLSValidationResult& aResult, 
											const TTime aTime,
											TInt aPos) const
	{
	if (aCert.ValidityPeriod().Valid(aTime))
		{
		return ETrue;
		}
	aResult.SetError(EDateOutOfRange, aPos);
	return EFalse;
	}

void CWTLSCertChainAO::HandleEStoreManagerInitializationL()
	{
	iFilter = CCertAttributeFilter::NewL();
	iFilter->SetFormat(EWTLSCertificate);
	iFilter->SetUid(iClient);
	iFilter->SetOwnerType(ECACertificate);

	iCertStoreManager = CUnifiedCertStore::NewL(iFs, EFalse);
	iCertStoreManager->Initialize(iStatus);

	iState = EStoreManagerInitialized;
	SetActive();
	}

void CWTLSCertChainAO::HandleEStoreManagerInitializedL()
	{
	iCertStoreManager->List(iCertInfos, *iFilter, iStatus);

	iState = EGetCertHashes;
	SetActive();
	}

void CWTLSCertChainAO::HandleEGetCertHashesL()
	{
	for(TInt i=0; i<iRootsFromClient.Count(); i++)
		{
		HBufC8* hash = &GeneratePublicKeyHashL( *(iRootsFromClient[i]));
		CleanupStack::PushL(hash);
		User::LeaveIfError( iRootSubjectClientHashList.Append(hash) );
		CleanupStack::Pop(); //hash
		}
	for(TInt j=0; j < iCertInfos.Count(); j++ )
		{
		User::LeaveIfError( iRootSubjectStoreHashList.Append( &((iCertInfos[j])->SubjectKeyId()) ) );
		}

	iPruned = EFalse;	
	iPrunedChainLength = iWTLSCertChain.iChain->Count();
	iIndex = -1;

	iState = EPruneList;
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

/* Walk through the canadiate list and compare the hash of the subjects with the previously
 * computed subject hash of certs from the CertStore and certs supplied by the client
 */
void CWTLSCertChainAO::HandleEPruneListL()
	{
	iIndex++;
	if(iIndex < iWTLSCertChain.iChain->Count() )
		{
		CWTLSCertificate* cert = iWTLSCertChain.iChain->At(iIndex);
		HBufC8* hash = &GeneratePublicKeyHashL(*cert);
		CleanupStack::PushL(hash);

		for(TInt i=0; i < iRootSubjectClientHashList.Count(); i++)
			{
			if( (iRootSubjectClientHashList[i])->Compare(*hash) == 0 )
				{
				iPrunedChainLength = iIndex;
				iPruned = ETrue;
				break;
				}
			}
		if(!iPruned)
			{
			for(TInt j=0; j<iRootSubjectStoreHashList.Count(); j++) 
				{
				if( (iRootSubjectStoreHashList[j])->Compare(*hash) == 0 )
					{
					iPrunedChainLength = iIndex;
					iPruned = ETrue;
					break;
					}
				}
			}
		CleanupStack::PopAndDestroy(hash);
		if(iPruned)
			{
			iState = EPruneListDone;
			}
		else 
			{
			iState = EPruneList;
			}
		}
	else
		{
		iState = EPruneListDone;
		}
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

void CWTLSCertChainAO::HandleEPruneListDoneL()
	{
	if(iPruned) 
		{
		TInt count = iWTLSCertChain.iChain->Count();
		for( TInt i=count - 1; i > iPrunedChainLength; i-- )
			{
			delete iWTLSCertChain.iChain->At(i);
			iWTLSCertChain.iChain->Delete(i);
			}
		iWTLSCertChain.iChain->Compress();
		}
	iState = ECheckTCA;
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

//checks to see if each certificate in a chain has the authority to sign other certificates
void CWTLSCertChainAO::HandleECheckTCAL()
	{
	TBool validChain = ETrue;
	for( TInt i = 1; i < iWTLSCertChain.iChain->Count(); i++ ) 
		//all intermediate certs (ie not EE certs and not self signed) need
		// to have a field T=ca indicating that they can sign other certs
		{
		if( (iWTLSCertChain.iChain)->At(i)->IsTCAL() == EFalse && 
			(iWTLSCertChain.iChain)->At(i)->IsSelfSignedL() == EFalse ) 
			{
			iValidationResult->SetError(ENotCACert, i);
			User::RequestComplete(iOriginalRequestStatus, KErrNone);
			validChain = EFalse;
			break;
			}
		}
	if(validChain && iPruned) 
		{
		//if we've pruned the list and the chain we have is valid,
		//then our chain already has a root that we trust.
		//therefore there is no need to retrieve one :)
		//therefore goto validation
		iState = EValidateEnd;
		TRequestStatus *status = &iStatus;
		User::RequestComplete(status, KErrNone);
		SetActive();
		}
	else if(validChain) // ie && !iPruned
		{
		//if we haven't pruned but chain is valid then we're back a square one.
		iState = EIsChainSelfSigned;
		TRequestStatus *status = &iStatus;
		User::RequestComplete(status, KErrNone);
		SetActive();
		}
	}

void CWTLSCertChainAO::HandleEIsChainSelfSignedL()
	{

	TInt last = iWTLSCertChain.iChain->Count() - 1;
	if( iWTLSCertChain.iChain->At(last)->IsSelfSignedL() )
		{
		//if chained is self signed, and no earlier cert in the sequence was trusted
		//then this is going to fail validation
		//This is just an optimisation to avoid retrieving all the roots from the store

		iValidationResult->SetError(EChainHasNoRoot, last);
		User::RequestComplete(iOriginalRequestStatus, KErrNone);
		}
	else 
		{
		//standard chain -> need to find the appropriate trusted root for chain if it exists
		iState = ERetrieveRoots;
		iIndex = -1;
		TRequestStatus* status = &iStatus;
		User::RequestComplete(status, KErrNone);
		SetActive();
		}
	}

void CWTLSCertChainAO::HandleERetrieveRootsL()
	{
	iIndex++;	
	if(iIndex < iCertInfos.Count() )
		{
		if( iEncodedCertTemp != NULL ) 
			{
			delete iEncodedCertTemp;
			}
		iEncodedCertTemp = HBufC8::NewMaxL( (iCertInfos[iIndex])->Size() );
		iEncodedCert.Set( iEncodedCertTemp->Des() );
		iCertStoreManager->Retrieve( *(iCertInfos[iIndex]), iEncodedCert, iStatus );
		iState = EAddRootToList;
		}
	else 
		{
		iState = EFindRoot;
		TRequestStatus* status = &iStatus;
		User::RequestComplete(status, KErrNone);
		}	
	SetActive();
	}

void CWTLSCertChainAO::HandleEAddRootToListL()
	{
	//are we guarenteed that a cert from the store is a valid WTLScert?
	//ie is this going to leave for reasons other than OOM?
	CWTLSCertificate *cert = CWTLSCertificate::NewL( iEncodedCert );
	User::LeaveIfError( iRootsFromStore.Append(cert) );

	iState = ERetrieveRoots;
	TRequestStatus* status = &iStatus;
	User::RequestComplete(status, KErrNone);
	SetActive();
	}

void CWTLSCertChainAO::HandleEFindRootL()
	{
	TInt last = iWTLSCertChain.iChain->Count() - 1;
	const CWTLSName* issuerName = &(iWTLSCertChain.iChain->At(last)->IssuerName());

	iFoundRoot = EFalse;
	for(TInt i=0; i<iRootsFromClient.Count(); i++) 
		{
		if( issuerName->ExactMatchL( (iRootsFromClient[i])->SubjectName() ) )
			{
			iFoundRoot = ETrue;
			CWTLSCertificate* cert = CWTLSCertificate::NewLC( *(iRootsFromClient[i]) );
			iWTLSCertChain.iChain->AppendL( cert ); 
			CleanupStack::Pop(cert);
			break;
			}
		}
	if(!iFoundRoot) 
		{
		for(TInt j=0; j<iRootsFromStore.Count(); j++)
			{
			if( issuerName->ExactMatchL( (iRootsFromStore[j])->SubjectName() ) )
				{
				iFoundRoot = ETrue;
				CWTLSCertificate* cert = CWTLSCertificate::NewLC( *(iRootsFromStore[j]) );
				iWTLSCertChain.iChain->AppendL( cert );
				CleanupStack::Pop(cert);
				break;
				}
			}
		}
	if(!iFoundRoot)
		{
		iValidationResult->SetError(EChainHasNoRoot, last);
		User::RequestComplete(iOriginalRequestStatus, KErrNone);
		}
	else
		{
		iState = EValidateEnd;
		TRequestStatus* status = &iStatus;
		User::RequestComplete(status, KErrNone);
		SetActive();
		}
	}

void CWTLSCertChainAO::HandleEValidateEndL()
	{
	TInt i = iWTLSCertChain.iChain->Count() -1;//we can guarantee that chain has at least 1 cert
	for (; i >= 0; i--)
		{
		const CWTLSCertificate* current = iWTLSCertChain.iChain->At(i);
		if ((!CheckSignatureAndNameL(*current, *iValidationResult, i))	||
			(!CheckValidityPeriod(*current, *iValidationResult, *iValidationTime, i)))
			{
			//these functions set the error internally if there is one
			break;
			}
		}		

	User::RequestComplete(iOriginalRequestStatus, KErrNone);
	}

HBufC8& CWTLSCertChainAO::GeneratePublicKeyHashL(const CWTLSCertificate& aCert) const
	{
	TWTLSKeyFactory keyFactory;
	CRSAPublicKey* key = keyFactory.RSAPublicKeyL( aCert.PublicKey().KeyData() );
	CleanupStack::PushL(key);
	HBufC8* modulusBuffer = key->N().BufferLC();
	CSHA1* sha1 = CSHA1::NewL();
	CleanupStack::PushL(sha1);
	TPtrC8 hash = sha1->Final(*modulusBuffer);
	HBufC8* permHash = hash.AllocL();
	CleanupStack::PopAndDestroy(3); //sha1, modulusBuffer, key
	return *permHash;
	}