// Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// Name          : CSIPSecDigestPlugin.cpp
// Part of       : SIPDigestPlugin
// Version       : SIP/6.0
//



#include "SipLogs.h"
#include "siprequest.h"
#include "sipresponse.h"
#include "sipauthorizationheader.h"
#include "sipauthenticationinfoheader.h"
#include "sipsecurityclientheader.h"
#include "sipsecurityserverheader.h"
#include "sipsecurityverifyheader.h"
#include "sipstrings.h"
#include "sipstrconsts.h"
#include "SipSecUtils.h"
#include "tsipsecmechanisminitparams.h"
#include "CSIPSecDigestPlugin.h"
#include "sipsecdigestcontext.h"
#include "sipsecdigestcache.h"
#include "CSIPSecUserRecord.h"
#include "sipprivatecrkeys.h"
#include <centralrepository.h>


// ============================ MEMBER FUNCTIONS ===============================

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::NewL
// -----------------------------------------------------------------------------
//
CSIPSecDigestPlugin* CSIPSecDigestPlugin::NewL( TAny* aInitParams ) 
    {
    __ASSERT_ALWAYS( aInitParams, User::Leave( KErrArgument ) );
    				 
    TSIPSecMechanismInitParams* initParams =
    	static_cast<TSIPSecMechanismInitParams*>( aInitParams );
	CSIPSecDigestPlugin* self =
		new ( ELeave ) CSIPSecDigestPlugin( initParams->iEngineContext );
	CleanupStack::PushL( self );
	self->ConstructL( initParams->iTimer );
	CleanupStack::Pop( self );
	return self;
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::ConstructL
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::ConstructL( MTimerManager& aTimerMgr )
    {
    iDigestMechanism = CSIPSecDigest::NewL();
	iCache = CSIPSecDigestCache::NewL( aTimerMgr );

	CRepository* repository = CRepository::NewLC( KCRUidSIP );
	TInt emptyResponseAfterSqnFailure( 0 );
	if ( repository->Get(KSIPSendEmptyResponseParameterAfterSqnFailure,
		 				 emptyResponseAfterSqnFailure ) == KErrNone &&
		 emptyResponseAfterSqnFailure )
		{
		iSendEmptyResponseParameterAfterSqnFailure = ETrue;
		}
	CleanupStack::PopAndDestroy( repository );
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::CSIPSecDigestPlugin
// -----------------------------------------------------------------------------
//
CSIPSecDigestPlugin::CSIPSecDigestPlugin( MSIPSecEngineContext& aEngineContext )
  : iEngineContext( aEngineContext )
    {
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::~CSIPSecDigestPlugin
// -----------------------------------------------------------------------------
//
CSIPSecDigestPlugin::~CSIPSecDigestPlugin()
    {
    delete iDigestMechanism;
    delete iCache;
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::Name
// -----------------------------------------------------------------------------
//
const TDesC8& CSIPSecDigestPlugin::Name() const
    {
    return iDigestMechanism->Name();
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::InitializeSecurityClientL
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::InitializeSecurityClientL(
	CSIPSecurityClientHeader& aSecurityClient )
    {
    aSecurityClient.SetMechanismNameL( Name() );
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::ProcessSecurityVerifyL
// Find Security-Server and Security-Verify with a matching mechanism, and
// process them.
// A2 is computed from all Sec-Server headers, e.g.
// "Security-Server:ipsec-ike;q=0.1,tls;q=0.2". I.e. "Security-Server" followed
// by all mechanisms and parameters. Resulting digest-verify parameter is put to
// the Security-Verify header that has "digest" mechanism.
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::ProcessSecurityVerifyL(
	TSIPTransportParams& /*aTransportParams*/,
	CSIPRequest& aRequest,
	TInetAddr& /*aNextHop*/,
	const CUri8& aRemoteTarget,
	const TDesC8& aOutboundProxy,
	MSIPSecUser* aUser,
	TRegistrationId aRegistrationId,
	RPointerArray<CSIPSecurityServerHeader>& aSecurityServer,        
	RPointerArray<CSIPSecurityVerifyHeader>& aSecurityVerify )
    {
    __ASSERT_ALWAYS( aUser, User::Leave( KErrArgument ) );

	CSIPSecurityServerHeader* secServer = NULL;
	for ( TInt i = 0; i < aSecurityServer.Count() && !secServer; ++i )
		{
		if ( aSecurityServer[ i ]->MechanismName().CompareF( Name() ) == 0 )
            {
            secServer = aSecurityServer[ i ];
            }
		}
	__ASSERT_ALWAYS( secServer, User::Leave( KErrArgument ) );

	CSIPSecurityVerifyHeader* secVerify = NULL;
	for ( TInt j = 0; j < aSecurityVerify.Count() && !secVerify; ++j )
		{
		if ( aSecurityVerify[ j ]->MechanismName().CompareF( Name() ) == 0 )
            {
            secVerify = aSecurityVerify[ j ];
            }        
		}
	__ASSERT_ALWAYS( secVerify, User::Leave( KErrArgument ) );

    iDigestMechanism->InitializeL( *secServer );
    TSIPSecPluginCtxVerify secVerifyContext( *this, aRemoteTarget,
    										 aOutboundProxy, aRequest,
                                             *secVerify, aSecurityServer, 
                                             *aUser, aRegistrationId );
    TSIPSecDigestCacheIterator cacheIter( secVerifyContext );
    iCache->InitializeIterator( cacheIter );

    CSIPSecDigestCacheEntry* entry = NULL;
	while ( ( entry = cacheIter.Next() ) != NULL )
		{
		if ( entry->Match( secVerifyContext ) )
		    {
		    entry->HandleL( secVerifyContext );
    		return;
		    }
		}
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::AddSecurityParamsL
// Nothing is done for ACK.
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::AddSecurityParamsL(
	TSIPTransportParams& /*aTransportParams*/,
	CSIPRequest& aRequest,
	TRegistrationId aRegistrationId,
	TTransactionId aTransactionId,
	TInetAddr& /*aNextHop*/,
	const CUri8& aRemoteTarget,
	const TDesC8& aOutboundProxy,
	MSIPSecUser* aUser )
	{
	__ASSERT_ALWAYS( aUser, User::Leave( KErrArgument ) );	

	if ( SipSecUtils::Match( SipStrConsts::EAck, aRequest.Method() ) )
		{
		return;
		}

	TSIPSecPluginCtxRequest requestContext( *this,
											aRemoteTarget,
											aOutboundProxy,
											aRequest,
											*aUser,
											aRegistrationId,
											aTransactionId );
	TSIPSecDigestCacheIterator cacheIter( requestContext );
	iCache->InitializeIterator( cacheIter );

    // Cleanup
    CSIPAuthorizationHeader* nonDigestHeader = PrepareRequestL( aRequest );

	CSIPSecDigestCacheEntry* entry = NULL;
	while ( ( entry = cacheIter.Next() ) != NULL )
		{
		if ( nonDigestHeader &&
		     entry->Type( requestContext ) == CSIPSecDigest::EEndPoint )
		    {
		    User::LeaveIfError( aRequest.RemoveHeader( nonDigestHeader ) );
		    delete nonDigestHeader;
		    nonDigestHeader = NULL;
		    }

		entry->UpdateL( requestContext );
		}
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::PrepareRequestL
// Remove all Proxy-Authorization headers. Remove Authorization headers
// selectively, based on response value.
// -----------------------------------------------------------------------------
//
CSIPAuthorizationHeader*
CSIPSecDigestPlugin::PrepareRequestL( CSIPRequest& aRequest ) const
    {
    aRequest.DeleteHeaders(
    	SIPStrings::StringF( SipStrConsts::EProxyAuthorizationHeader ) );

    const RStringF auth =
    	SIPStrings::StringF( SipStrConsts::EAuthorizationHeader );

	CSIPAuthorizationHeader* nonDigestHeader = NULL;
    if ( aRequest.HeaderCount( auth ) > 0 )
        {
    	TSglQueIter<CSIPHeaderBase> authHeaders = aRequest.Headers( auth );

        CSIPAuthorizationHeader* header = NULL;
        while ( ( header =
                  static_cast<CSIPAuthorizationHeader*>( authHeaders++ ) )
                  != NULL )
            {
            if ( header->DesParamValue( SIPStrings::StringF(
            	SipStrConsts::EResponse ) ).Length() == 0 )
                {
                nonDigestHeader = header;
                }
            else
                {
                // This is created by digest plugin -> can be deleted now
    		    User::LeaveIfError( aRequest.RemoveHeader( header ) );
    		    delete header;
    		    header = NULL;
                }
            }
        }

    return nonDigestHeader;
    }    

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::ResponseReceivedL
// If 2xx, try to update with authentication info.
// -----------------------------------------------------------------------------
//
TBool CSIPSecDigestPlugin::ResponseReceivedL(
	TSIPTransportParams& /*aTransportParams*/,
	CSIPResponse& aResponse,
	CSIPRequest& aRequest,
	TRegistrationId aRegistrationId,
	TTransactionId aTransactionId,
	TInetAddr& /*aNextHop*/,
	const CUri8& aRemoteTarget,
	const TDesC8& aOutboundProxy,
	MSIPSecUser* aUser,
	MSIPSecSecurityMechanismObserver& aObserver )
    {
    __ASSERT_ALWAYS( aUser, User::Leave( KErrArgument ) );

	User::LeaveIfError( iCache->CountResponses( aResponse,
		aRequest,
		aTransactionId,
		iDigestMechanism->Algorithm() ) );

    if ( aResponse.ResponseCode() == 401 || // WWW Authorization
         aResponse.ResponseCode() == 407 || // Proxy Authorization
         aResponse.ResponseCode() == 494 )  // Security Agreement
   		{
        TSIPSecPluginCtxResponse respContext( *this,
    										  aRemoteTarget,
    										  aOutboundProxy,
    										  aResponse,
										      *iCache,
										      aObserver,
										      *aUser,
										      aRegistrationId,
										      aTransactionId );
		return iDigestMechanism->UpdateCacheL( respContext );
        }

	CSIPAuthenticationInfoHeader* authInfo( NULL );
    if ( ( aResponse.Type() == CSIPResponse::E2XX ) &&
         ( authInfo = AuthenticationInfo( aResponse ) ) != NULL )
        {
        TSIPSecPluginCtxInfo authInfoCtx( *this,
        								  aRemoteTarget,
        								  aOutboundProxy,
        								  aResponse,
        								  *authInfo,
									      *iCache,
									      aObserver,
									      *aUser,
									      aRegistrationId );
    	TSIPSecDigestCacheIterator cacheIterator( authInfoCtx );
    	iCache->InitializeIterator( cacheIterator );
		CSIPSecDigestCacheEntry* entry( NULL );

		while ( ( entry = cacheIterator.Next() ) != NULL )
			{
			// Let each matching cache entry handle the Authentication-Info
			entry->HandleL( authInfoCtx );
			}
        }
    return EFalse;
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::IsServerInitiatedSecAgreeAllowed
// -----------------------------------------------------------------------------
//
TBool CSIPSecDigestPlugin::IsServerInitiatedSecAgreeAllowed() const
	{
	return ETrue;
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::ParametersUpdatedL
// -----------------------------------------------------------------------------
//
TBool CSIPSecDigestPlugin::ParametersUpdatedL( MSIPSecUser* /*aUser*/ )
	{
	return EFalse;
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::CancelPendingOperations
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::CancelPendingOperations(
	MSIPSecSecurityMechanismObserver* aObserver )
    {
	iCache->CancelPendingOperations( aObserver );
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::ClearCache
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::ClearCache( MSIPSecUser* aUser )
    {
    if ( aUser )
    	{
    	iCache->ClearCache( *aUser );	
    	}
	iCache->CleanObservers();
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::SetCredentialsL
// Cache can have just one record for a realm and transaction id pair.
// SIPSec users with PassOnlyRealmsToUser == ETrue set aTransactionId to value
// KEmptyTransactionId. Correct operation is not guaranteed if several of them
// use the same realm.
//
// This function will eventually be removed and clients start to use
// SetCredentialsL( const MSIPSecUser& .. ) instead.
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::SetCredentialsL( TTransactionId aTransactionId,
                                           const TDesC8& aRealm,
                                           const TDesC8& aOutboundProxy, 
                                           const TDesC8& aUserName,
                                           const TDesC8& aPassword )
	{
	__ASSERT_ALWAYS( aRealm.Length() > 0, User::Leave( KErrArgument ) );

	CSIPSecUserRecord* record = iCache->SearchRecord( aRealm, aTransactionId );
	__ASSERT_ALWAYS( record != NULL, User::Leave( KErrNotFound ) );

	SetCredentialsToRecordL( *record, aOutboundProxy, aUserName, aPassword );
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::SetCredentialsL
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::SetCredentialsL( const MSIPSecUser& aUser,
                                           const TDesC8& aRealm,
                                           const TDesC8& aOutboundProxy, 
                                           const TDesC8& aUserName,
                                           const TDesC8& aPassword )
	{
	__ASSERT_ALWAYS( aRealm.Length() > 0, User::Leave( KErrArgument ) );	

	CSIPSecUserRecord* record = iCache->SearchRecord( aRealm, aUser );
	__ASSERT_ALWAYS( record != NULL, User::Leave( KErrNotFound ) );

	SetCredentialsToRecordL( *record, aOutboundProxy, aUserName, aPassword );
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::SetCredentialsToRecordL
// -----------------------------------------------------------------------------
//
void CSIPSecDigestPlugin::SetCredentialsToRecordL( CSIPSecUserRecord& aRecord,
												   const TDesC8& aOutboundProxy,
                                           		   const TDesC8& aUserName,
                                           		   const TDesC8& aPassword )
	{
	TBool valid = aRecord.SetUserCredentialsL( aUserName, aPassword );
	if ( valid )
	    {
		aRecord.SetOutboundProxyL( aOutboundProxy );

    	TSIPSecDigestCacheIterator cacheIterator;
    	iCache->InitializeIterator( cacheIterator );

		CSIPSecDigestCacheEntry* entry( NULL );
		while ( ( entry = cacheIterator.Next() ) != NULL )
			{
			entry->UpdateL( aRecord );
			}
	    }

	aRecord.Updated();

	if ( !valid )
		{
		iCache->ClearCache( aRecord, EFalse );
		}

    iCache->CleanObservers();
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::IgnoreChallenge
// If aTransactionId is KEmptyTransactionId removes cache entries with
// PassOnlyRealmsToUser == ETrue.
// -----------------------------------------------------------------------------
//
TInt CSIPSecDigestPlugin::IgnoreChallenge( TTransactionId aTransactionId,
                                           const TDesC8& aRealm,
                                           const MSIPSecUser* aTrustedUser )
	{
	return iCache->Cancel( aTransactionId, aRealm, aTrustedUser );
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::RemoveCredentials
// Only remove cache entries for which PassOnlyRealmsToUser == ETrue.
// -----------------------------------------------------------------------------
//
TInt CSIPSecDigestPlugin::RemoveCredentials( const TDesC8& aRealm )    
    {
    return iCache->Remove( aRealm );
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::EngineContext
// -----------------------------------------------------------------------------
//
MSIPSecEngineContext& CSIPSecDigestPlugin::EngineContext()
    {
    return iEngineContext;
    }

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::EmptyResponseAfterSqnFailure
// -----------------------------------------------------------------------------
//
TBool CSIPSecDigestPlugin::EmptyResponseAfterSqnFailure() const
	{
	return iSendEmptyResponseParameterAfterSqnFailure;
	}

// -----------------------------------------------------------------------------
// CSIPSecDigestPlugin::AuthenticationInfo
// -----------------------------------------------------------------------------
//
CSIPAuthenticationInfoHeader*
CSIPSecDigestPlugin::AuthenticationInfo( CSIPResponse& aResponse ) const
    {
    CSIPAuthenticationInfoHeader* header( NULL );

    if ( aResponse.Type() == CSIPResponse::E2XX )
        {
        const RStringF authInfo =
    		SIPStrings::StringF( SipStrConsts::EAuthenticationInfoHeader );
	    TInt count = aResponse.HeaderCount( authInfo );
	    if ( count > 0 )
	        {
	    	TSglQueIter< CSIPHeaderBase > headers =
	    		aResponse.Headers( authInfo );
    		for ( TInt i = 0; i < count; i++ )
                {
                header =
                	static_cast< CSIPAuthenticationInfoHeader* >( headers++ );
                }
	        }
        }

    return header;
    }