// Copyright (c) 2007-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// Name          : RSIPSecChallengeResolver.cpp

// Part of       : SIPDigestPlugin

// Version       : SIP/6.0

//

#include "siperr.h"

#include "SipAssert.h"

#include "sipsecurityserverheader.h"

#include "sipauthenticateheaderbase.h"

#include "CSIPSecDigest.h"

#include "RSIPSecChallengeResolver.h"

#include "sipsecdigestcache.h"

#include "CSIPSecChallengeMD5.h"

#include "CSIPSecChallengeAKA.h"

#include "CSIPSecCredentials.h"

#include "sipresponse.h"

#include "sipsecplugincontext.h"

#include "sipstrings.h"

#include "sipstrconsts.h"

// CONSTANTS

const TInt KSIPSecMaxChallengesPerResponse( 10 );

// ============================ MEMBER FUNCTIONS ===============================

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::RSIPSecChallengeResolver

// -----------------------------------------------------------------------------

//

RSIPSecChallengeResolver::RSIPSecChallengeResolver(

	TSIPSecPluginCtxResponse& aContext,

	CSIPSecDigest& aMechanism ) :

	RPointerArray< CSIPSecChallenge >(),

   	iContext( &aContext ),

   	iMechanism( aMechanism )

    {

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::Close

// -----------------------------------------------------------------------------

//

void RSIPSecChallengeResolver::Close()

    {

    ResetAndDestroy();

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::OpenL

// -----------------------------------------------------------------------------

//

void RSIPSecChallengeResolver::OpenL( const MSIPSecUser& aUser )

    {

    CSIPResponse& response = iContext->SIPResponse();

    RStringF algorithm;

	RStringF qop;

	TBool digestInSecServer =

		GetDigestParamsFromSecurityServer( response, algorithm, qop );

    ResetAndDestroy();

    const RStringF proxyAuth =

    	SIPStrings::StringF( SipStrConsts::EProxyAuthenticateHeader );

    TBool digestInAuthHeaders( EFalse );

    TInt challengeCount = 0;    

    if ( response.HeaderCount( proxyAuth ) > 0 )

        {

    	TSglQueIter< CSIPHeaderBase > authHeaders =

    		response.Headers( proxyAuth );

    	FindAndCreateChallengesL( authHeaders, CSIPSecDigest::EProxy,

    	                          challengeCount, algorithm, qop, 

    	                          digestInAuthHeaders );

        }

    const RStringF wwwAuth =

    	SIPStrings::StringF( SipStrConsts::EWWWAuthenticateHeader );

    if ( response.HeaderCount( wwwAuth ) > 0 &&

    	 challengeCount < KSIPSecMaxChallengesPerResponse )

        {

    	TSglQueIter< CSIPHeaderBase > authHeaders = response.Headers( wwwAuth );

    	FindAndCreateChallengesL( authHeaders, CSIPSecDigest::EEndPoint, 

    	                          challengeCount, algorithm, qop,

    	                          digestInAuthHeaders );

        }

    PrepareCache( aUser );

	// If 401/407 has no www-authenticate or proxy-authenticate headers or all

	// challenges are ignored => error.

	if ( ( digestInSecServer || digestInAuthHeaders ) &&

		 ( response.ResponseCode() == 401 || response.ResponseCode() == 407 ) &&

		 Count() == 0 )

        {

        User::Leave( KErrSIPForbidden );

        }	

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::FindAndCreateChallengesL

// -----------------------------------------------------------------------------

//

void RSIPSecChallengeResolver::FindAndCreateChallengesL(

	TSglQueIter< CSIPHeaderBase >& aAuthHeaders,

	CSIPSecDigest::TChallengeType aType,

	TInt& aCount,

	RStringF aAlgorithm,

	RStringF aQop,

	TBool& aDigestInAuthHeaders )

    {

    while ( aAuthHeaders )

        {

        CSIPAuthenticateHeaderBase* header =

            static_cast< CSIPAuthenticateHeaderBase* >( aAuthHeaders++ );

        if ( IsDigestChallenge( *header ) )

            {

            aDigestInAuthHeaders = ETrue;

        	if ( IsValidChallenge( *header ) &&

        		 aCount < KSIPSecMaxChallengesPerResponse )

	        	{

	            CreateChallengeL( *header, aType, aCount, aAlgorithm, aQop );

	        	}

            }

        }

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::Pop

// -----------------------------------------------------------------------------

//

CSIPSecChallenge* RSIPSecChallengeResolver::Pop()

    {

    CSIPSecChallenge* challenge( NULL );

    if ( Count() > 0 )

        {

        challenge = ( *this )[ 0 ];

        Remove( 0 );

        }

    return challenge;

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::PrepareCache

// Ignore challenges that match a cache entry, but have different algorithm.

// Then check if any matching cache entries must be removed.

// -----------------------------------------------------------------------------

//

void RSIPSecChallengeResolver::PrepareCache( const MSIPSecUser& aUser )

    {

    TRegistrationId regId = iContext->RegistrationId();

    CSIPSecDigestCacheEntry* entry( NULL );

    CSIPSecCredentials* credentials( NULL );

    TInt i( 0 );

	// Start search from the end of the array, so if a challenge is removed, it

	// won't affect the position of challenges that haven't yet been checked.

	for ( i = Count() - 1; i >= 0; i-- )

        {

        CSIPSecChallenge* challenge = ( *this )[ i ];

        TSIPSecDigestCacheIterator iterator( *iContext );

        iContext->Cache().InitializeIterator( iterator );

        while ( ( entry = iterator.Next() ) != NULL && challenge )

            {

            credentials = static_cast< CSIPSecCredentials* >( entry );

			if ( credentials->DoesMatch( *challenge, aUser, regId ) &&

				 MixedAlgorithms( *credentials, *challenge ))

				{

    			Remove( i );

    			delete challenge;

    			challenge = NULL; // exits while-loop

				}

            }

        }

    for ( i = 0; i < Count(); i++ )

        {

        CSIPSecChallenge* challenge = ( *this )[ i ];

        TSIPSecDigestCacheIterator iterator( *iContext );

        iContext->Cache().InitializeIterator( iterator );

        while ( ( entry = iterator.Next() ) != NULL )

            {

            credentials = static_cast< CSIPSecCredentials* >( entry );

			if ( credentials->Type( *iContext ) == CSIPSecDigest::EProxy )

				{

				__SIP_ASSERT_RETURN(

					credentials->IsUsedByUser(iContext->SIPSecUser(),

											  ETrue,

											  regId ),

                  	KErrGeneral );

				}

            if ( credentials->DoesMatch( *challenge, aUser, regId ) &&

        		 credentials->ChallengeReceived( *challenge ) )

                {

                iContext->Cache().RemoveEntry( *credentials );

                }

            }

        }

	RemoveObsoleteAKAEntries();

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::RemoveObsoleteAKAEntries

// Don't compare SIPSec user. Cache can have only one CSIPSecSIMRecord,

// regardless of SIPSec user.

// -----------------------------------------------------------------------------

//

void RSIPSecChallengeResolver::RemoveObsoleteAKAEntries() const

	{

	for ( TInt i = 0; i < Count(); ++i )

        {

        CSIPSecChallenge* challenge = ( *this )[ i ];

    	if ( challenge->Algorithm().AlgorithmName() ==

    		 CSIPSecChallengeAKA::SupportedAlgorithm() )

    		{

    		iContext->Cache().ClearAKAEntriesWithOldRealm( challenge->Realm() );

    		}

        }

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::CreateChallengeL

// If qop exists, but has unknown value, ignore the challenge.

// -----------------------------------------------------------------------------

//

void

RSIPSecChallengeResolver::CreateChallengeL( CSIPAuthenticateHeaderBase& aHeader,

											CSIPSecDigest::TChallengeType aType,

											TInt& aCount,

											RStringF aAlgorithm,

											RStringF aQop )

	{

	CSIPSecRequestData::TQop qop = SelectQopL( aHeader, aQop );

	if ( qop != CSIPSecRequestData::EUnknown )

		{

	    SelectAlgorithm( aHeader, iMechanism.Algorithm(), aAlgorithm );

		aHeader.SetParamL( SIPStrings::StringF( SipStrConsts::EAlgorithm ),

						   aAlgorithm );

	    CSIPSecChallenge* challenge( NULL );

	    if ( aAlgorithm == CSIPSecChallengeMD5::SupportedAlgorithm() )

	        {

	        challenge = CSIPSecChallengeMD5::NewLC( aType, aHeader, qop );

	        }

	    if ( aAlgorithm == CSIPSecChallengeAKA::SupportedAlgorithm() )

	        {

	        challenge = CSIPSecChallengeAKA::NewLC( aType, aHeader, qop );

	        }

	    if ( challenge )

	        {

	        AppendL( challenge );

	        CleanupStack::Pop( challenge );

	        ++aCount;

	        }

		}

    }

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::IsValidDigestChallenge

// -----------------------------------------------------------------------------

//

TBool RSIPSecChallengeResolver::IsValidDigestChallenge(

	const CSIPAuthHeaderBase& aHeader )

	{

	return IsDigestChallenge( aHeader ) && IsValidChallenge( aHeader );

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::GetDigestParamsFromSecurityServer

// -----------------------------------------------------------------------------

//

TBool RSIPSecChallengeResolver::GetDigestParamsFromSecurityServer(

	CSIPResponse& aResponse,

	RStringF& aAlgorithm,

	RStringF& aQop )

	{

	const RStringF empty = SIPStrings::StringF( SipStrConsts::EEmpty );

	aAlgorithm = empty;

	aQop = empty;

	RStringF secServer =

		SIPStrings::StringF( SipStrConsts::ESecurityServerHeader );

	if ( aResponse.HasHeader( secServer ) )

		{

		TSglQueIter< CSIPHeaderBase > iter = aResponse.Headers( secServer );

		for ( CSIPHeaderBase* header = iter++; header; header = iter++ )

			{

			CSIPSecurityServerHeader* secServerHeader =

				static_cast< CSIPSecurityServerHeader* >( header );

			if ( secServerHeader->MechanismName().CompareF(

				KSIPSecDigestScheme ) == 0 )

				{

				aAlgorithm = secServerHeader->ParamValue(

					SIPStrings::StringF( SipStrConsts::EDigestAlgorithm ) );

				aQop = secServerHeader->ParamValue(

					SIPStrings::StringF( SipStrConsts::EDigestQop ) );

				return ETrue;

				}

			}

		}

	return EFalse;

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::SelectQopL

// Security-Server can have one qop value. If it has, use it. Challenge can have

// a list of qop values ("auth,auth-int"). Qop is not case-sensitive.

// -----------------------------------------------------------------------------

//

CSIPSecRequestData::TQop

RSIPSecChallengeResolver::SelectQopL( CSIPAuthenticateHeaderBase& aHeader,

									  RStringF aQopInSecurityServer ) const

	{

	if ( aQopInSecurityServer != SIPStrings::StringF( SipStrConsts::EEmpty ) )

		{

		if ( aQopInSecurityServer.DesC().CompareF( KSIPSecAuthInt ) == 0 )

			{

			return CSIPSecRequestData::EAuthInt;

			}

		if ( aQopInSecurityServer.DesC().CompareF( KSIPSecAuth ) == 0 )

			{

			return CSIPSecRequestData::EAuth;

			}

		}

	if ( !aHeader.HasParam( SIPStrings::StringF( SipStrConsts::EQop ) ) )

		{

		// No qop => accept, but "auth" is used later on.

		return CSIPSecRequestData::EDoesNotExist;

		}

	// If many values ("auth,auth-int"), use strongest ("auth-int")

	if ( aHeader.HasQopValueL( KSIPSecAuthInt ) )

		{

		return CSIPSecRequestData::EAuthInt;

		}

	if ( aHeader.HasQopValueL( KSIPSecAuth ) )

		{

		return CSIPSecRequestData::EAuth;

		}

	return CSIPSecRequestData::EUnknown;

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::SelectAlgorithm

// -----------------------------------------------------------------------------

//

void

RSIPSecChallengeResolver::SelectAlgorithm( const CSIPAuthHeaderBase& aHeader,

										   RStringF aDefaultAlgorithm,

										   RStringF& aAlgorithm )

	{

    const RStringF empty = SIPStrings::StringF( SipStrConsts::EEmpty );

    if ( aAlgorithm == empty )

		{

        // No algorithm in Security-Server, use challenge's algorithm

        aAlgorithm = aHeader.ParamValue(

        	SIPStrings::StringF( SipStrConsts::EAlgorithm ) );

		}

	if ( aAlgorithm == empty )

		{

		// Use the default algorithm. If it isn't set yet (security agreement

		// not yet done), assume MD5.

		if ( aDefaultAlgorithm == empty )

			{

			aAlgorithm = SIPStrings::StringF( SipStrConsts::EMD5 );

			}

		else

			{

        	aAlgorithm = aDefaultAlgorithm;

			}

		}

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::IsDigestChallenge

// Scheme is not case-sensitive.

// -----------------------------------------------------------------------------

//

TBool RSIPSecChallengeResolver::IsDigestChallenge(	

	const CSIPAuthHeaderBase& aHeader )

	{

	return aHeader.AuthScheme().DesC().CompareF( KSIPSecDigestScheme ) == 0;

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::IsValidChallenge

// -----------------------------------------------------------------------------

//

TBool RSIPSecChallengeResolver::IsValidChallenge(

	const CSIPAuthHeaderBase& aHeader )

	{

	return aHeader.HasParam( SIPStrings::StringF( SipStrConsts::ERealm ) ) &&

		   aHeader.HasParam( SIPStrings::StringF( SipStrConsts::ENonce ) );

	}

// -----------------------------------------------------------------------------

// RSIPSecChallengeResolver::MixedAlgorithms

// -----------------------------------------------------------------------------

//

TBool

RSIPSecChallengeResolver::MixedAlgorithms( CSIPSecCredentials& aCredentials,

										   CSIPSecChallenge& aChallenge ) const

	{

	RStringF alg = aCredentials.Challenge().Algorithm().AlgorithmName();

	RStringF challengeAlg = aChallenge.Algorithm().AlgorithmName();

	RStringF md5 = CSIPSecChallengeMD5::SupportedAlgorithm();

	RStringF aka = CSIPSecChallengeAKA::SupportedAlgorithm();

	return ( ( md5 == alg ) ^ ( md5 == challengeAlg ) ) &&

	       ( ( aka == alg ) ^ ( aka == challengeAlg ) );

	}