//******************************************************************************************************
//  CertificatePolicyChecker.cs - Gbtc
//
//  Copyright © 2012, Grid Protection Alliance.  All Rights Reserved.
//
//  Licensed to the Grid Protection Alliance (GPA) under one or more contributor license agreements. See
//  the NOTICE file distributed with this work for additional information regarding copyright ownership.
//  The GPA licenses this file to you under the MIT License (MIT), the "License"; you may
//  not use this file except in compliance with the License. You may obtain a copy of the License at:
//
//      http://www.opensource.org/licenses/MIT
//
//  Unless agreed to in writing, the subject software distributed under the License is distributed on an
//  "AS-IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. Refer to the
//  License for the specific language governing permissions and limitations.
//
//  Code Modification History:
//  ----------------------------------------------------------------------------------------------------
//  11/07/2012 - Stephen C. Wills
//       Generated original version of source code.
//  12/14/2012 - Starlynn Danyelle Gilliam
//       Modified Header.
//
//******************************************************************************************************

using System.Collections.Generic;
using System.Linq;
using System.Net.Security;
using System.Security.Cryptography.X509Certificates;

namespace GSF.Net.Security
{
    /// <summary>
    /// Certificate checker that validates remote certificates based
    /// on certificate policies associated with each certificate.
    /// </summary>
    public class CertificatePolicyChecker : ICertificateChecker
    {
        #region [ Members ]

        // Fields
        private readonly Dictionary<X509Certificate, CertificatePolicy> m_trustedCertificates;
        private readonly CertificatePolicy m_defaultCertificatePolicy;
        private string m_reasonForFailure;

        #endregion

        #region [ Constructors ]

        /// <summary>
        /// Creates a new instance of the <see cref="CertificatePolicyChecker"/> class.
        /// </summary>
        public CertificatePolicyChecker()
        {
            m_trustedCertificates = new Dictionary<X509Certificate, CertificatePolicy>();
            m_defaultCertificatePolicy = new CertificatePolicy();
        }

        #endregion

        #region [ Properties ]

        /// <summary>
        /// Gets the default certificate policy used to validate
        /// certificates that do not have their own certificate policy.
        /// </summary>
        public CertificatePolicy DefaultCertificatePolicy
        {
            get
            {
                return m_defaultCertificatePolicy;
            }
        }

        /// <summary>
        /// Gets the reason why the remote certificate validation
        /// failed, or null if certificate validation did not fail.
        /// </summary>
        public string ReasonForFailure
        {
            get
            {
                return m_reasonForFailure;
            }
        }

        #endregion

        #region [ Methods ]

        /// <summary>
        /// Trusts the given certificate, using the default policy for validation.
        /// </summary>
        /// <param name="certificate">The certificate to be trusted.</param>
        public void Trust(X509Certificate certificate)
        {
            Trust(certificate, null);
        }

        /// <summary>
        /// Trusts the given certificate, using the given policy for validation.
        /// </summary>
        /// <param name="certificate">The certificate to be trusted.</param>
        /// <param name="policy">The policy by which to evaluate the certificate.</param>
        public void Trust(X509Certificate certificate, CertificatePolicy policy)
        {
            m_trustedCertificates[certificate] = policy;
        }

        /// <summary>
        /// Removes the given certificate from the list of trusted certificates.
        /// </summary>
        /// <param name="certificate">The certificate to be distrusted.</param>
        public void Distrust(X509Certificate certificate)
        {
            m_trustedCertificates.Remove(certificate);
        }

        /// <summary>
        /// Removes all certificates from the list of trusted certificates.
        /// </summary>
        public void DistrustAll()
        {
            m_trustedCertificates.Clear();
        }

        /// <summary>
        /// Verifies the remote certificate used for authentication.
        /// </summary>
        /// <param name="sender">An object that contains state information for this validation.</param>
        /// <param name="remoteCertificate">The certificate used to authenticate the remote party.</param>
        /// <param name="chain">The chain of certificate authorities associated with the remote certificate.</param>
        /// <param name="errors">One or more errors associated with the remote certificate.</param>
        /// <returns>A flag that determines whether the specified certificate is accepted for authentication.</returns>
        public bool ValidateRemoteCertificate(object sender, X509Certificate remoteCertificate, X509Chain chain, SslPolicyErrors errors)
        {
            X509Certificate trustedCertificate = GetTrustedCertificate(remoteCertificate);
            X509ChainStatusFlags chainFlags;
            CertificatePolicy policy;

            m_reasonForFailure = null;

            // If we cannot find a trusted certificate matching the remote
            // certificate, then remote certificate is not trusted
            if ((object)trustedCertificate == null)
            {
                m_reasonForFailure = "No matching certificate found in the list of trusted certificates.";
                return false;
            }

            // Get the policy for the remote certificate
            policy = m_trustedCertificates[trustedCertificate] ?? m_defaultCertificatePolicy;

            // If there were any errors, excepting the valid
            // policy errors, remote certificate is rejected
            if ((errors & ~policy.ValidPolicyErrors) != SslPolicyErrors.None)
            {
                m_reasonForFailure = string.Format("Policy errors encountered during validation: {0}", errors & ~policy.ValidPolicyErrors);
                return false;
            }

            // If an error is found at any part of the chain, excepting
            // valid chain flags, remote certificate is rejected
            chainFlags = chain.ChainStatus.Aggregate(X509ChainStatusFlags.NoError, (flags, status) => flags | (status.Status & ~policy.ValidChainFlags));

            if (chainFlags != X509ChainStatusFlags.NoError)
            {
                m_reasonForFailure = string.Format("Invalid chain flags found during validation: {0}", chainFlags);
                return false;
            }

            return true;
        }

        /// <summary>
        /// Searches the list of trusted certificates for a certificate that matches the given remote certificate. 
        /// </summary>
        /// <param name="remoteCertificate">Remote certificate to search for.</param>
        /// <returns>Trusted X509 certificate, if found; otherwise, <c>null</c>.</returns>
        public X509Certificate GetTrustedCertificate(X509Certificate remoteCertificate)
        {
            byte[] hash, key;
            bool hashMatch, keyMatch;

            if ((object)remoteCertificate != null)
            {
                hash = remoteCertificate.GetCertHash();
                key = remoteCertificate.GetPublicKey();

                foreach (X509Certificate trustedCertificate in m_trustedCertificates.Keys)
                {
                    hashMatch = hash.SequenceEqual(trustedCertificate.GetCertHash());
                    keyMatch = hashMatch && key.SequenceEqual(trustedCertificate.GetPublicKey());

                    if (keyMatch)
                        return trustedCertificate;
                }
            }

            return null;
        }

        #endregion
    }
}