// Copyright (c) 2002-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

//

// System includes

#include <wsp/mwspproxyinfoprovider.h>

#include <http/framework/csecuritypolicy.h>

#include <http/framework/securitypolicypluginstrings.h>

#include <wsperror.h>

#include <http/framework/logging.h>

// Local includes

#include "tnwsswsptrhndpanic.h"

#include "mconnectioninfoprovider.h"

#include "testoom.h"

// Class signature

#include "cnwsswspsession.h"

const TInt KWtlsMaxFieldSize	= 256;

CNwssWspSession::~CNwssWspSession()

	{

	}

CNwssWspSession::CNwssWspSession(RStringPool& aStringPool,

								 MNwssWapServer& aWapStackProvider,

								 MConnectionInfoProvider& aConnInfoProvider,

								 MSecurityPolicy& aSecurityPolicy): 

	CActive(CActive::EPriorityStandard), iStringPool(aStringPool),

	iWapStackProvider(aWapStackProvider), iConnInfoProvider(aConnInfoProvider),

	iState(EDisconnected), iSecurityPolicy(aSecurityPolicy)

	{

	CActiveScheduler::Add(this);

	}

void CNwssWspSession::BaseConstructL()

	{

	// Add the security policy plug-in string table to the string pool

	__DEBUGTESTLEAVE

	iStringPool.OpenL(SecurityPolicyProperties::Table);

	}

void CNwssWspSession::InitiateProxyConnection()

	{

	if (iState == EDisconnected)

		CompleteSelf();

	}

CNwssWspSession::TState CNwssWspSession::State() const

	{

	return iState;

	}

TInt CNwssWspSession::SessionDisconnectedCallback()

	{

	TInt err = CloseWspSession();

	if (err == KErrNone)

		iState = EDisconnected;

	return err;

	}

void CNwssWspSession::RunL()

	{

	switch (iState)

		{

	case EDisconnected:

		{

		__LOG("--Running in state EDisconnected")

		// Make initial connection to the WAP Stack

		__DEBUGTESTLEAVE

		TBool useWtls = OpenWapProxyL();

		if (useWtls)

			iState = ESessionOpen;

		else

			iState = EReady;

		CompleteSelf();

		} break;

	case ESessionOpen:

		{

		__LOG("--Running in state ESessionOpen")

		// Do pre-handshake setup, followed by phase 1 of the connection

		__DEBUGTESTLEAVE

		DoWTLSConnectionPreHandshakeL();

		DoWTLSConnectionPhaseOne(ETrue);

		iHandshakeWasAnonymous = EFalse;

		iState = EDoingWtlsPhase1;

		} break;

	case EDoingWtlsPhase1:

		{

		__LOG("--Running in state EDoingWtlsPhase1")

		// Did phase 1 succeed?

		TInt completionCode = iStatus.Int();

		switch (completionCode)

			{

		case RWTLS::EHandshakeOk:

			{

			__LOG("--Phase 1 result is EHandshakeOK")

			__LOG("--indicates that an anonymous handshake was performed.");

			__LOG("--proceeding to check negotiated configuration")

			// The handshake is fully complete after one phase.  Since we always initiate a 2-phase

			// handshake, this indicates that anonymous key exchange suites were agreed.

			// Note - it would seem sensible to do a phase 2 to complete the handshake, since we initiated

			// it as 2 phase.  However doing so never works (ConnectPhase2() returns EErrGeneral). So we'll

			// have to consider the handshake complete now.

			// Store 'was anonymous' flag for the next AO iteration, where we will check against the policy

			// to ensure anonymous acceptable. 

			iHandshakeWasAnonymous = ETrue;

			iState = ECheckingNegotiated;

			CompleteSelf();

			} break;

		case RWTLS::EServerCertificateValid:

			{

			__LOG("--Phase 1 result is EServerCertificateValid")

			__LOG("--proceeding to do handshake phase 2")

			// Note - this error code indicates that the server certificate is valid, and that it

			// was verified by the WAP Stack against a root cert held on the device.  First get 

			// the server certificate in case the client asks to see it and then move to phase 2.

			__DEBUGTESTLEAVE

			GetServerCertL();

			DoWTLSConnectionPhaseTwo();

			iState = EDoingWtlsPhase2;

			} break;

        case RWTLS::EServerCertificateNotValid:

			{

			__LOG("--Phase 1 result is EServerCertificateNotValid")

			// Note - this error code indicates that although all fields of the server certificate

			// were valid, the WAP Stack couldn't verify the server identity against a root cert.

			// For a 2-phase (authenticating) handshake, this means we present the cert to the user

			// for verification

			__LOG("--proceeding to check untrusted server certificate")

			// Check the server cert before phase 2 of the handshake

			iState = ECheckingServerCert;

			__DEBUGTESTLEAVE

			GetServerCertL();

			ValidateUntrustedServerCertL();

			} break;

		case RWTLS::EHandshakeError:

		case RWTLS::EHandshakeUserAbort:

		case RWTLS::ECertificateRequested:

			{

#ifdef _DEBUG

			if (completionCode == RWTLS::EHandshakeError)

				{

				__LOG("--Phase 1 result is EHandshakeError")

				}

			else if (completionCode == RWTLS::EHandshakeUserAbort)

				{

				__LOG("--Phase 1 result is EHandshakeUserAbort")

				}

			else

				{

				// Presumably this refers to a client cert? Not supported by this client if that's the case.

				__LOG("--Phase 1 result is ECertificateRequested")

				}

#endif

			// Cancel phase 1 - the connect could not be established

			CancelWTLSConnectionPhaseOne();

			User::Leave(KWtlsErrPhase1HandshakeFailed);

			} break;

		default:

			{

			__LOG1("--Phase 1 result is unknown (%d)", completionCode)

			// Other error codes from completion of phase 1 connect

			if (completionCode >= 0)

				completionCode = KWtlsErrPhase1HandshakeFailed;

			User::Leave(completionCode);

			} break;

			}

		} break;

	case ECheckingServerCert:

		{

		__LOG("--Running in state ECheckingServerCert")

		// Was the server cert accepted? If not, leave

		TInt completionCode = iStatus.Int();

		__DEBUGTESTLEAVE

		User::LeaveIfError(completionCode);

		// Enter second phase of handshake

		DoWTLSConnectionPhaseTwo();

		iState = EDoingWtlsPhase2;

		} break;

	case EDoingWtlsPhase2:

		{

		__LOG("--Running in state EDoingWtlsPhase2")

		// Did phase 2 succeed? If not, leave

		TInt completionCode = iStatus.Int();

		__DEBUGTESTLEAVE

		if ( (completionCode != RWTLS::EHandshakeOk) &&

			 (iHandshakeWasAnonymous && (completionCode != RWTLS::EErrGeneral) ) )

			User::Leave( (completionCode > 0)?KWtlsErrPhase2HandshakeFailed:completionCode );

		// Move straight on to check the negotiated values

		iState = ECheckingNegotiated;

		CompleteSelf();

		} break;

	case ECheckingNegotiated:

		{

		__LOG("--Running in state ECheckingNegotiated")

		// Finalise the handshake by checking the negotiated settings

		__DEBUGTESTLEAVE

		DoWTLSConnectionPostHandshakeL();

		// Authenticating handshake has completed successfully

		iState = EReady;

		CompleteSelf();

		} break;

	case EReady:

		{

		__LOG("--Running in state EReady")

		// Can now complete the WSP session connection to the proxy

		__DEBUGTESTLEAVE

		CompleteProxyConnectionL();

		} break;

	default:

		{

		TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState);

		} break;

		}

	}

TInt CNwssWspSession::RunError(TInt aError)

	{

	__LOG1("--Handling WAP stack error code %d", aError)

	switch (iState)

		{

	case EDisconnected:

		{

		// Failed to open the WSP session

		DoRunError(aError);

		} break;

	case ESessionOpen:

		{

		DoRunError(KWtlsErrConfigurationFailed);

		} break;

	case EDoingWtlsPhase1:

		{

		// If error is KErrNotSupported then this is usually an error of insufficient crypto strength

		__ASSERT_DEBUG(aError != KErrNotSupported,

						TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInsufficientCryptoStrength));

		// Only expect an 'invalid server certificate' or 'phase 1 handshake failed' error in this state

		__ASSERT_DEBUG(aError == KWtlsErrInvalidServerCert || aError == KWtlsErrPhase1HandshakeFailed,

						TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState));

		DoRunError(aError);

		} break;

	case ECheckingServerCert:

		{

		// Only expect an 'invalid/untrusted server certificate' error in this state

		__ASSERT_DEBUG(aError == KWtlsErrInvalidServerCert || aError == KWtlsErrUntrustedServerCert,

						TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState));

		DoRunError(aError);

		} break;

	case EDoingWtlsPhase2:

		{

		DoRunError(KWtlsErrPhase2HandshakeFailed);

		} break;

	case ECheckingNegotiated:

		{

		DoRunError(KWtlsErrNegotiatedConfigRejected);

		} break;

	case EReady:

		{

		DoRunError(aError);

		} break;

	default:

		{

		// State machine screw-up!

		__ASSERT_DEBUG(ETrue, TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState));

		} break;

		}

	// State after handling an error returns to 'disconnected'

	iState = EDisconnected;

	return KErrNone;

	}

void CNwssWspSession::DoCancel()

	{

	// Some cancellations will return the state machine to EDisconnected

	switch (iState)

		{

	case EDoingWtlsPhase1:

		{

		// Outstanding request is the phase 1 connect

		CancelWTLSConnectionPhaseOne();

		iState = EDisconnected;

		} break;

	case ECheckingServerCert:

		{

		// Cancel the validation

		CancelValidateUntrustedServerCert();

		iState = EDisconnected;

		} break;

	case EDoingWtlsPhase2:

		{

		// Outstanding request is the phase 2 connect

		CancelWTLSConnectionPhaseTwo();

		iState = EDisconnected;

		} break;

	case EReady:

		{

		// Defer to sub-class.  The SubDoCancel() returns a flag if it wishes to move the state machine

		// back to 'disconnected'.

		if ( SubDoCancel() )

			iState = EDisconnected;

		} break;

	default:

		{

		// Other states do not require asynch request cancellation

		} break;

		}

	}

TBool CNwssWspSession::OpenWapProxyL()

	{

	// Get details of the desired WAP proxy from the client's connection info provider

	MWspProxyInfoProvider& prov = iConnInfoProvider.ProxyInfoProvider();

	const TDesC8& addr = prov.ProxyAddress();

	__LOG1("--Proxy Address is '%S'", &addr)

	TUint16 remPort = prov.RemotePort();

	__LOG1("--Remote Port is %d", remPort)

	TUint16 locPort = prov.LocalPort();

	__LOG1("--Local Port is %d", locPort)

	TWspBearer bearer = prov.Bearer();

	const TDesC8& svcCentNum = prov.ServiceCentreNumber();

	TWspSession sessSvc = prov.WspSessionService();

	__LOG1("--WSP Session Type is %d (0 = CO, 1 = CL)", sessSvc)

	TBool isSecure = prov.SecureConnection();

	__LOG1("--Security is %d (0 = off, 1 = on)", isSecure)

	// It is an error for ConnectReq() to be used when the proxy specifies a CL session!

	__ASSERT_ALWAYS(sessSvc == EWspConnectionOriented,

					TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EWrongSessionType));

	// Need to supply different parameters, according to whether the bearer is IP or

	// SMS

	TInt error = KErrNone;

	switch (bearer)

		{

		// scope enumerations to the global namespace since that's where they were

		// defined in <wapcli.h>  :(

	case ::EIP:

		{

		__LOG("--Bearer is IP")

		// Open the WSP CO connection with the WAP stack, using IP bearer

		error = OpenWspSession(addr, remPort, locPort, (TBearer)bearer, isSecure);	  

		} break;

	case ::EWAPSMS7:

	case ::EWAPSMS:

		{

		__LOG("--Bearer is SMS")

		__LOG1("--Service Centre Number is '%S'", &svcCentNum)

		// Open the WSP CO connection with the WAP stack, using SMS bearer

		error = OpenWspSession(svcCentNum, remPort, locPort, (TBearer)bearer, isSecure);	  

		} break;

	case ::ESMS7:

	case ::ESMS:

	case ::EAll:

	default:

		__ASSERT_DEBUG(ETrue, 

					   TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EWrongBearerType));

		}

	__LOG1("--RWSPCOConn::Open() returned with %d", error)

	__DEBUGTESTLEAVE

	User::LeaveIfError(error);

	// Return the secure flag, so the state machine can go on to make the WTLS

	// handshake if appropriate, for secure proxies

	return isSecure;

	}

void CNwssWspSession::MapToPanic(TInt aErrorCode) const

	{

	// Error handling is severe, since all WSP state management is expected to be done

	// in the client.

	TNwssWspTrHndPanic::TNwssWspTrHndPanicCode panic;

	switch (aErrorCode)

		{

		case RWAPConn::EBearerError:

			panic = TNwssWspTrHndPanic::EBearerError;

			break;

		case RWAPConn::EPortAlreadyBound:

			panic = TNwssWspTrHndPanic::EPortAlreadyBound;

			break;

		case RWAPConn::ECannotOpenPort:

			panic = TNwssWspTrHndPanic::ECannotOpenPort;

			break;

		case RWAPConn::ETooManyConnections:

			panic = TNwssWspTrHndPanic::ETooManyConnections;

			break;

		case RWAPConn::EBadConnection:

			panic = TNwssWspTrHndPanic::EBadConnection;

			break;

		case RWAPConn::EBufferTooSmall:

			panic = TNwssWspTrHndPanic::EBufferTooSmall;

			break;

		case RWSPCOConn::EBufferTooSmall:

			panic = TNwssWspTrHndPanic::EBufferTooSmall;

			break;

		case RWSPCOConn::EInvalidSession:

			panic = TNwssWspTrHndPanic::EInvalidSession;

			break;

		case RWSPCOConn::EInvalidTransaction:

			panic = TNwssWspTrHndPanic::EInvalidTransaction;

			break;

		case RWSPCOConn::EParameterError:

			panic = TNwssWspTrHndPanic::EParameterError;

			break;

		case RWSPCOConn::ESessionNotConnected:

			panic = TNwssWspTrHndPanic::ESessionNotConnected;

			break;

		case RWSPCOConn::ENotSupported:

			panic = TNwssWspTrHndPanic::ENotSupported;

			break;

		case RWSPCOConn::EInvalidState:

			panic = TNwssWspTrHndPanic::EInvalidState;

			break;

		case RWSPCOConn::ESessionClosed:

			panic = TNwssWspTrHndPanic::ESessionClosed;

			break;

		case RWSPCOConn::EMRUExceeded:

			panic = TNwssWspTrHndPanic::EMRUExceeded;

			break;

		case RWSPCOConn::EInvalidBufferSize:

			panic = TNwssWspTrHndPanic::EInvalidBufferSize;

			break;

		case RWSPCOConn::EDataNotAvailable:

			panic = TNwssWspTrHndPanic::EDataNotAvailable;

			break;

		case RWSPCOConn::EErrorTimeout:

			panic = TNwssWspTrHndPanic::EErrorTimeout;

			break;

	default:

		panic = TNwssWspTrHndPanic::EUnknownPanic;

		}

	TNwssWspTrHndPanic::Panic(panic);

	}

void CNwssWspSession::CompleteSelf()

	{

	if (!IsActive())

		{

		TRequestStatus* pStat = &iStatus;

		User::RequestComplete(pStat, KErrNone);

		SetActive();

		}

	}

void CNwssWspSession::DoWTLSConnectionPreHandshakeL()

	{

	// Set the Key Exchange Suites. There might be several desired cipher suites, so

	// they are returned as an array

	const RArray<TWtlsKeyExchangeSuite>& keyExchSuites = 

		iSecurityPolicy.GetWtlsKeyExchangeSuites();

	TInt idx = 0;

	const TInt numKeyExchSuites = keyExchSuites.Count();

	RWTLS::TKeyExchangeSuite stackSuite;

	RWTLS::TIdType stackIdType;

	for (idx = 0; idx < numKeyExchSuites; ++idx)

		{

		// Get the next suite, convert and set

		TWtlsKeyExchangeSuite suite = keyExchSuites[idx];

		stackSuite = (RWTLS::TKeyExchangeSuite)suite.iKeyExchangeSuite;

		stackIdType = (RWTLS::TIdType)suite.iKeyIdType;

#ifdef _DEBUG

		DumpKeyExchangeSuite(stackSuite, stackIdType, ETrue);

#endif

		__TESTOOMD(stkErr, WtlsHnd().SetKeyExchangeSuite(stackSuite, stackIdType, suite.iKeyId));

		if (stkErr < 0)

			{

			__LOG1("--RWTLS::SetKeyExchangeSuite returned %d", stkErr);

			__LOG1("--Offensive key ex suite is %d", suite.iKeyExchangeSuite);

			User::Leave(stkErr);

			}

		}

	// Set the Cipher Suites. There might be several desired cipher suites, so

	// they are returned as an array

	const RArray<TWtlsCipherSuite>& cipherSuites =

		iSecurityPolicy.GetWtlsCipherSuites();

	const TInt numCipherSuites = cipherSuites.Count();

	if(numCipherSuites>0)

		{

		// Make an array to pass in to RWTLS::SetCipherSuites

		RWTLS::CipherSuiteArray* stackSuites =

						new (ELeave) RWTLS::CipherSuiteArray(numCipherSuites);

		CleanupStack::PushL(stackSuites);

		for (idx = 0; idx < numCipherSuites; ++idx)

			{

			// Get the next suite, convert and append to the stack array

			TWtlsCipherSuite suite = cipherSuites[idx];

			RWTLS::TCipherSuite stackSuite;

			stackSuite.iBulkEncryptionAlgorithm =

				(RWTLS::TBulkEncryptionAlgorithm)suite.iBulkEncryptionAlgorithm;

			stackSuite.iMacAlgorithm =

				(RWTLS::TMacAlgorithm)suite.iMacAlgorithm;

#ifdef _DEBUG

			DumpCipherSuite(stackSuite, ETrue);

#endif

			stackSuites->AppendL(stackSuite);

			}

		__TESTOOMD(stkErr, WtlsHnd().SetCipherSuites(*stackSuites));

		if (stkErr < 0)

			{

			__LOG1("--RWTLS::SetCipherSuites returned %d", stkErr);

			User::Leave(stkErr);

			}