/*
* Copyright (c) 2007-2009 Nokia Corporation and/or its subsidiary(-ies).
* All rights reserved.
* This component and the accompanying materials are made available
* under the terms of "Eclipse Public License v1.0"
* which accompanies this distribution, and is available
* at the URL "http://www.eclipse.org/legal/epl-v10.html".
*
* Initial Contributors:
* Nokia Corporation - initial contribution.
*
* Contributors:
*
* Description:
* Name          : RSIPSecChallengeResolver.h
* Part of       : SIPSec/DigestPlugin
* Version       : SIP/6.0
*
*/




/**
 @internalComponent
*/

#ifndef __RSIPSEC_CHALLENGERESOLVER_H__
#define __RSIPSEC_CHALLENGERESOLVER_H__

// INCLUDES
#include <e32base.h>
#include "CSIPSecDigest.h"
#include "sipsecrequestdata.h"

// FORWARD DECLARATIONS
class MSIPSecUser;
class CSIPAuthHeaderBase;
class CSIPAuthenticateHeaderBase;
class CSIPSecChallenge;
class CSIPSecCredentials;
class TSIPSecPluginCtxResponse;
class RStringF;
class CSIPHeaderBase;
class CSIPResponse;

// RPointerArray doesn't have a destructor, and RSIPSecChallengeResolver
// doesn't have either.
//lint -e1510
			
/**
 * @brief Class represents stack of received challenges
 * 
 * @class RSIPSecChallengeResolver RSIPSecChallengeResolver.h
 *		  "RSIPSecChallengeResolver.h"
 *
 * This class extracts challenges from 401/407 response and stores them into a
 * form of stack. Challenges can then be handled one-by-one. After extraction
 * cache has been updated because of possible re-challenges. 
 */
class RSIPSecChallengeResolver : public RPointerArray< CSIPSecChallenge >
    {
public: // Constructors and destructor

    /*
     * Constructor
     * @param aContext SIP response context
     * @param aMechanism the mechanism
     */
    RSIPSecChallengeResolver( TSIPSecPluginCtxResponse& aContext,
    						  CSIPSecDigest& aMechanism );

public: // New functions

    /*
     * Opens resolver and creates challenges
     * @param aUser SIPSec user
     */
    void OpenL( const MSIPSecUser& aUser );

    /*
     * Closes resolver
     */
    void Close();
    
    /*
     * Pops a challenge.     
     * @return Challenge or NULL if no more challenges exist.
     *	Ownership is transferred.
     */
    CSIPSecChallenge* Pop();
    
    /*
     * If aResponse has a Security-Server header with mechanism Digest, the
     * values of algorithm and qop parameters from that header are copied into
     * aAlgorithm and aQop.
     * @param aResponse IN: SIP response
     * @param aAlgorithm OUT: algoritm value
     * @param aQop OUT: qop value
     * @return ETrue if aResponse has a Security-Server header with digest
     *		   mechanism. EFalse otherwise.
     */
	static TBool GetDigestParamsFromSecurityServer( CSIPResponse& aResponse,
												    RStringF& aAlgorithm,
												    RStringF& aQop );

	/*
     * Check if the header has a Digest challenge with realm and nonce.
     * @param aHeader Authenticate- or Authorization-header
     * @return ETrue Header has a valid challenge, EFalse otherwise
     */	
	static TBool IsValidDigestChallenge( const CSIPAuthHeaderBase& aHeader );

	/*
     * Selects the algorithm to use for the challenge in aHeader.
     * @param aHeader Header containing the challenge
     * @param aDefaultAlgorithm The used default algorith
     * @param aAlgorithm IN: algorithm in SIP response's Security-Server header
     *					 OUT: selected algorithm     
     */
	static void SelectAlgorithm( const CSIPAuthHeaderBase& aHeader,
								 RStringF aDefaultAlgorithm,
								 RStringF& aAlgorithm );

private: // New functions, for internal use

    /*
     * Finds and creates challenge based on SIP header
     * @param aAuthHeaders Authenticate headers
     * @param aType The challenge type
     * @param aCount Cumulative count of found challenges
     * @param aAlgorithm Algorithm value from Security-Server header, or empty
     *		  string if algorithm was not present in Security-Server
     * @param aQop qop value from Security-Server header, or empty string if
     *		  qop was not present in Security-Server
     * @param aDigestInAuthHeaders on return contains ETrue if some of the
     *        auth headers contained digest
     */
    void FindAndCreateChallengesL( TSglQueIter< CSIPHeaderBase >& aAuthHeaders,
                                   CSIPSecDigest::TChallengeType aType,
                                   TInt& aCount,
                                   RStringF aAlgorithm,
                                   RStringF aQop,
                                   TBool& aDigestInAuthHeaders );

    /*
     * Creates a challenge based on the SIP header.
     * @param aHeader authenticate header
     * @param aType The challenge type
     * @param aCount Cumulative count of found challenges
     * @param aAlgorithm Algorithm value from Security-Server header, or empty
     *		  string if algorithm was not present in Security-Server
     * @param aQop qop value from Security-Server header, or empty string if
     *		  qop was not present in Security-Server     
     */
    void CreateChallengeL( CSIPAuthenticateHeaderBase& aHeader,
                           CSIPSecDigest::TChallengeType aType,
                           TInt& aCount,
                           RStringF aAlgorithm,
						   RStringF aQop );

    /*
     * Prepares cache
     * @param aUser SIPSec user
     */
    void PrepareCache( const MSIPSecUser& aUser );	

	/*
     * Selects the qop to use with the challenge in aHeader.     
     * @param aHeader Authenticate header containing the challenge     
     * @param aQopInSecurityServer qop value from Security-Server header     
     * @return The selected qop to use
     */
	CSIPSecRequestData::TQop SelectQopL( CSIPAuthenticateHeaderBase& aHeader,
					  					 RStringF aQopInSecurityServer ) const;

	
	/*
     * Check if the header has a Digest challenge
     * @param aHeader Authenticate- or Authorization-header
     * @return ETrue Header has a challenge, EFalse otherwise
     */
	static TBool IsDigestChallenge( const CSIPAuthHeaderBase& aHeader );
	
	/*
     * Check if the header has realm and nonce.
     * @param aHeader Authenticate- or Authorization-header
     * @return ETrue Header has realm and nonce, EFalse otherwise
     */
	static TBool IsValidChallenge( const CSIPAuthHeaderBase& aHeader );
	
	/*
     * Check if either credentials or challenge has MD5 algorithm and the other
     * has AKAv1-MD5.
     * @param aCredentials IN: credentials in the cache
     * @param aChallenge IN: received challenge
     * @return ETrue If either credentials or challenge has MD5 algorithm and
     *	the other has AKAv1-MD5.
     */
	TBool MixedAlgorithms( CSIPSecCredentials& aCredentials,
						   CSIPSecChallenge& aChallenge ) const;

	/*
     * If there is an AKA challenge, remove such AKA entries from the cache, that
     * have different realm than in the challenge.
     */
	void RemoveObsoleteAKAEntries() const;

private: // Data

    // Not owned
    TSIPSecPluginCtxResponse* iContext;

    CSIPSecDigest& iMechanism;

#ifdef CPPUNIT_TEST
	friend class CSIPSecResolverTest;
#endif
    };

#endif //end of __RSIPSEC_CHALLENGERESOLVER_H__

// End of File