/*

* Copyright (c) 2003 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  Digest Authentication filter

*

*/

// INCLUDE FILES

#include <e32std.h>

#include <e32math.h>

#include <hash.h>

#include <http/rhttpsession.h>

#include <http/rhttptransaction.h>

#include <http/rhttpheaders.h>

#include <httpstringconstants.h>

#include <httperr.h>

// User Includes

#include "HttpFilterDigestAuthentication.h"

#include "HttpFilterAuthenticationLogger.h"

// EXTERNAL DATA STRUCTURES

// EXTERNAL FUNCTION PROTOTYPES

// CONSTANTS

// MACROS

// LOCAL CONSTANTS AND MACROS

// Length of a digest hash when represented in hex

const TInt KHashLength = 32;

// Length of a digest hash before converting to hex.

const TInt KRawHashLength = 16;

// Length of nonce-count

const TInt KNonceCountLength = 8;

_LIT8( KMd5AlgorithmStr, "MD5" );

_LIT8( KMd5SessAlgorithmStr, "MD5-sess" );

_LIT8( KQopAuthStr, "auth" );

_LIT8( KQopAuthIntStr, "auth-int" );

_LIT8( KAuthenticationInfoStr, "Authentication-Info" );

_LIT8( KColon, ":" );

// MODULE DATA STRUCTURES

// LOCAL FUNCTION PROTOTYPES

// FORWARD DECLARATIONS

// ============================= LOCAL FUNCTIONS ===============================

// -----------------------------------------------------------------------------

// PanicDigestAuthenticationFilter

// Panic

// Returns: void

// -----------------------------------------------------------------------------

//

void PanicDigestAuthenticationFilter( TInt aErr = 0 )

    {

    User::Panic( _L( "HTTP FILTER DIGEST AUTHENTICATION" ), aErr );

    }

// ============================ MEMBER FUNCTIONS ===============================

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::CHttpFilterDigestAuthentication

// C++ default constructor can NOT contain any code, that

// might leave.

// -----------------------------------------------------------------------------

//

CHttpFilterDigestAuthentication::CHttpFilterDigestAuthentication( RHTTPSession* aSession, TBool aIsProxy )

    : CHttpFilterAuthentication( aSession, aIsProxy )

    {

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::ConstructL

// Symbian 2nd phase constructor can leave.

// -----------------------------------------------------------------------------

//

void CHttpFilterDigestAuthentication::ConstructL( RHTTPSession aSession )

    {

    AUTHLOGGER_ENTERFN( "ConstructL" );

    CHttpFilterAuthentication::ConstructL( aSession );

    iOpaqueStr = iStringPool.StringF( HTTP::EOpaque, RHTTPSession::GetTable() );

    iNonceStr = iStringPool.StringF( HTTP::ENonce, RHTTPSession::GetTable() );

    iQopStr = iStringPool.StringF( HTTP::EQop, RHTTPSession::GetTable() );

    iStaleStr = iStringPool.StringF( HTTP::EStale, RHTTPSession::GetTable() );

    iMd5Str = iStringPool.OpenFStringL( KMd5AlgorithmStr );

    iMd5SessStr = iStringPool.OpenFStringL( KMd5SessAlgorithmStr );

    iQopAuthStr = iStringPool.OpenFStringL( KQopAuthStr );

    iAuthInfo = iStringPool.OpenFStringL( KAuthenticationInfoStr );

    aSession.FilterCollection().AddFilterL( *this,

                                            THTTPEvent::EGotResponseHeaders,

                                            iAuthInfo,

                                            HTTPStatus::EOk,

                                            EStatusCodeHandler + 1,

                                            iStringPool.StringF( HTTP::EAuthentication, RHTTPSession::GetTable() ) );

    AUTHLOGGER_WRITE( "CMD5::NewL" );

    iMD5Calculator = CMD5::NewL();

    AUTHLOGGER_LEAVEFN( "ConstructL" );

    }

// Destructor

CHttpFilterDigestAuthentication::~CHttpFilterDigestAuthentication()

    {

    iQopAuthStr.Close();

    iMd5SessStr.Close();

    iMd5Str.Close();

    iAuthInfo.Close();

    delete iMD5Calculator;

    // just in case...

    for( TInt i = 0; i < iDCredentials.Count(); ++i )

        {

        DRemoveCredentialsFromList( 0 );

        }

    iDCredentials.Close();

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::InstallFilterL

// Two-phased constructor. This function replaces NewL.

// -----------------------------------------------------------------------------

//

CHttpFilterDigestAuthentication* CHttpFilterDigestAuthentication::InstallFilterL( TAny* aAuthenticationParams )

    {

    AUTHLOGGER_CREATE;

    __ASSERT_DEBUG( aAuthenticationParams != NULL, PanicDigestAuthenticationFilter() );

    TAuthenticationParams* authParams = REINTERPRET_CAST( TAuthenticationParams*, aAuthenticationParams );

    __ASSERT_DEBUG( authParams->iSession != NULL, PanicDigestAuthenticationFilter() );

    CHttpFilterDigestAuthentication* filter = new ( ELeave ) CHttpFilterDigestAuthentication( authParams->iSession, authParams->iIsProxy );

    CleanupStack::PushL( filter );

    filter->ConstructL( *( authParams->iSession ) );

    CleanupStack::Pop( filter );

    return filter;

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::MHFRunL

// Process a transaction event.

// -----------------------------------------------------------------------------

//

void CHttpFilterDigestAuthentication::MHFRunL( RHTTPTransaction aTransaction,

        const THTTPEvent& aEvent )

    {

    switch ( aEvent.iStatus )

        {

        case THTTPEvent::ESubmit:

            {

            DSubmitL( aTransaction );

            break;

            }

        case THTTPEvent::EGotResponseHeaders:

            {

            if( aTransaction.Response().StatusCode() == HTTPStatus::EOk )

                {

                ParseAuthenticationInfoL( aTransaction );

                }

            else

                {

                DHandleTransactionL( aTransaction );

                }

            break;

            }

        default:

            {

            __ASSERT_DEBUG( EFalse, PanicDigestAuthenticationFilter() );

            break;

            }

        }

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::ParseAuthenticationInfoL

// -----------------------------------------------------------------------------

//

void CHttpFilterDigestAuthentication::ParseAuthenticationInfoL( RHTTPTransaction /*aTransaction*/ )

    {

    // TODO: parse and store nc-value

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::HandleTransactionL

// Provides a central point for all Transaction handling.

// -----------------------------------------------------------------------------

//

void CHttpFilterDigestAuthentication::DHandleTransactionL( RHTTPTransaction aTransaction )

    {

    AUTHLOGGER_ENTERFN( "DHandleTransactionL" );

    // Find if we have credentials in the transaction's properties, and remove them from the list

    // (but not from the properties)

    // Find if there are WWWAuthenticate or ProxyAuthenticate headers in the request,

    // and replace the realm property with what came from the request.

    THTTPHdrVal headerVal;

    TInt cred = KErrNotFound;

    TBool doDigest = EFalse;

    TBool stale( EFalse );

    if ( aTransaction.PropertySet().Property( iRealmStr, headerVal ) )

        {

        if ( iIsProxy )

            {

            // do nothing this time

            }

        else

            {

            cred = DFindCredentials( headerVal, aTransaction.Request().URI() );

            }

        }

    RStringF wwwAuthHeader = iStringPool.StringF( iHttpStringAuthenticate, RHTTPSession::GetTable() );

    RHTTPHeaders headers( aTransaction.Response().GetHeaderCollection() );

    if ( iIsProxy )

        {

        // do nothing this time

        }

    else

        {

        TInt headerPart = DFindHeaderPartToUseL( aTransaction );

        if ( headerPart != KErrNotFound )

            {

            THTTPHdrVal authTypeParam;

            if ( headers.GetField( wwwAuthHeader, headerPart, authTypeParam ) == KErrNone )

                // we need to store realm, opaque, nonce and qop values to

                // use them when resubmitting the request

                {

                THTTPHdrVal algorithmVal;

                THTTPHdrVal nonceVal;

                THTTPHdrVal realmVal;

                THTTPHdrVal opaqueVal;

                THTTPHdrVal staleVal;

                TInt algVal( KAlgUnknown );

                TInt authVal( KQopNone );

                aTransaction.PropertySet().RemoveProperty( iNonceStr );

                aTransaction.PropertySet().RemoveProperty( iRealmStr );

                aTransaction.PropertySet().RemoveProperty( iOpaqueStr );

                aTransaction.PropertySet().RemoveProperty( iQopStr );

                aTransaction.PropertySet().RemoveProperty( iStaleStr );

                if( !headers.GetParam( wwwAuthHeader, 

                                      iStringPool.StringF( HTTP::EAlgorithm, 

                                                      RHTTPSession::GetTable() ), 

                                      algorithmVal, 

                                      headerPart ) )

                    {

                    if( !algorithmVal.Str().DesC().CompareF( iMd5Str.DesC() ) )

                        {

                        algVal = KAlgMd5;

                        }

                    else if( !algorithmVal.Str().DesC().CompareF( iMd5SessStr.DesC() ) )

                        {

                        algVal = KAlgMd5Sess;

                        }

                    }

                authVal = CheckQop( headers, wwwAuthHeader, headerPart );

                headers.GetParam( wwwAuthHeader, iNonceStr, nonceVal, headerPart );

                headers.GetParam( wwwAuthHeader, iRealmStr, realmVal, headerPart );

                headers.GetParam( wwwAuthHeader, iOpaqueStr, opaqueVal, headerPart );

                headers.GetParam( wwwAuthHeader, iStaleStr, staleVal, headerPart );

                // There's only MD5 and MD5-sess algorithm and QoP-Auth support

                // Realm and Nonce values are mandatory. W/o them digest response is meaningless.

                if( ( authVal & KQopAuth || authVal == KQopNone )

                    && nonceVal.Type() == THTTPHdrVal::KStrVal

                    && realmVal.Type() == THTTPHdrVal::KStrVal )

                    {

                    aTransaction.PropertySet().SetPropertyL( iNonceStr, nonceVal );

                    aTransaction.PropertySet().SetPropertyL( iRealmStr, realmVal );

                    // Opaque

                    if( opaqueVal.Type() == THTTPHdrVal::KStrVal )

                        {

                        aTransaction.PropertySet().SetPropertyL( iOpaqueStr, opaqueVal );

                        }

                    // Qop

                    aTransaction.PropertySet().SetPropertyL( iQopStr, authVal );

                    // Algorithm

                    aTransaction.PropertySet().SetPropertyL( iStringPool.StringF( HTTP::EAlgorithm, 

                                                              RHTTPSession::GetTable() ), 

                                                              algVal );

                    _LIT8( KTrue, "TRUE" );

                    if( staleVal.Type() == THTTPHdrVal::KStrVal 

                        && !staleVal.Str().DesC().CompareF( KTrue ) )

                        // stale is true -> nonce expired

                        {

                        AUTHLOGGER_WRITE( "Stale found" );

                        __ASSERT_DEBUG( cred != KErrNotFound, PanicDigestAuthenticationFilter() );

                        // update nonce value

                        TDCredentials& creds = iDCredentials[cred];

                        iStringPool.String( creds.iNonce ).Close();

                        creds.iNonce = nonceVal.Str().Copy();

                        // indicate to engine that no uname/pwd dialog needed

                        staleVal.SetInt( 1 );

                        aTransaction.PropertySet().SetPropertyL( iStaleStr, staleVal );

                        stale = ETrue;

                        }

                    doDigest = ETrue;

                    }

                }

            }

        }

    if ( cred != KErrNotFound && !stale )

        // if stale is true credentials were ok, 

        // only the nonce value was expired.

        {

        DRemoveCredentialsFromList( cred );

        }

    if( !doDigest )

        //try with Basis

        {

        CHttpFilterAuthentication::HandleTransactionL( aTransaction );

        }

    AUTHLOGGER_LEAVEFN( "DHandleTransactionL" );

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::SubmitL

// -----------------------------------------------------------------------------

//

void CHttpFilterDigestAuthentication::DSubmitL( RHTTPTransaction aTransaction )

    {

    TInt cred = KErrNotFound;

    // Get credentials from URI, only for wwwAuthenticate

    // If there are credentials in the transaction properties, add them to the list

    DGetCredentialsFromPropertiesL( aTransaction );

    // just in case we always remove stale value from properties

    aTransaction.PropertySet().RemoveProperty( iStaleStr );

    if ( iIsProxy )

        {

        // do nothing this time

        }

    else

        {

        // If we have credentials for this URL, add them

        cred = DFindCredentialsForURI( aTransaction.Request().URI() );

        }

    if ( cred != KErrNotFound )

        {

        EncodeDigestAuthL( cred, aTransaction );

        }

    else

        // Do Basic

        {

        CHttpFilterAuthentication::SubmitL( aTransaction );

        }

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::DFindCredentials

// Search list for matching credentials.

// -----------------------------------------------------------------------------

//

TInt CHttpFilterDigestAuthentication::DFindCredentials( const RString& aRealm,

        const TUriC8& aURI )

    {

    TInt count = iDCredentials.Count();

    for ( TInt cred = 0; cred < count; ++cred )

        {

        if ( iDCredentials[ cred ].iRealm == aRealm )

            {

            TUriParser8 parser;

            parser.Parse( iStringPool.StringF( iDCredentials[ cred ].iURI ).DesC() );

            if ( !parser.Compare( aURI, EUriHost ) &&

                 ( ( !parser.Compare( aURI, EUriPort ) )

                   || ( !parser.IsPresent( EUriPort ) &&

                        !aURI.IsPresent( EUriPort ) ) ) )

                {

                AUTHLOGGER_WRITE_FORMAT( "Found cred(3): %d", cred );

                return cred;

                }

            }

        }

    return KErrNotFound;

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::DFindCredentialsForURI

// Searches list for credentials that can be used with this URI

// -----------------------------------------------------------------------------

//

TInt CHttpFilterDigestAuthentication::DFindCredentialsForURI( const TUriC8& aURI )

    {

    // Check if any of the stored URIs are the beginning of the URI

    // we're trying now. If they are, we can immediately attempt to

    // re-use the existing credentials.

    _LIT8 ( KSchemeEnd, "://" );

    TInt count = iDCredentials.Count();

    for ( TInt cred = 0; cred < count; ++cred )

        {

        const TPtrC8& transDes = aURI.UriDes();

        const TPtrC8& credDes =

            iStringPool.StringF( iDCredentials[ cred ].iURI ).DesC();

        TPtrC8 transNoSchemePtr( transDes );

        TPtrC8 credNoSchemePtr( credDes );

        if ( transNoSchemePtr.Find( KSchemeEnd() ) > 0 )

            {

            transNoSchemePtr.Set( transNoSchemePtr.Mid( transNoSchemePtr.Find( KSchemeEnd ) ) );

            }

        if ( credNoSchemePtr.Find( KSchemeEnd() ) > 0 )

            {

            credNoSchemePtr.Set( credNoSchemePtr.Mid( credNoSchemePtr.Find( KSchemeEnd ) ) );

            }

        if ( transNoSchemePtr.Length() >= credNoSchemePtr.Length() )

            {

            // The URI is long enough, which is a good start.

            if ( transNoSchemePtr.Left( credNoSchemePtr.Length() ).Compare( credNoSchemePtr ) == 0 )

                {

                // The descriptors match. Things are looking good. In

                // the interests of paranoia, if we haven't matched

                // the entire URI, check that the character after the

                // match is '/'.

                if ( transNoSchemePtr.Length() == credNoSchemePtr.Length() )

                    {

                    TBuf<256> temp16;

                    temp16.Copy(aURI.UriDes());

                    AUTHLOGGER_WRITE_FORMAT( "Found cred(1): %d", cred );

                    AUTHLOGGER_WRITE_FORMAT8( "uri: %S", &aURI.UriDes() );

                    return cred;

                    }

                else if ( transNoSchemePtr[ credNoSchemePtr.Length() ] == '/' )

                    {

                    AUTHLOGGER_WRITE_FORMAT( "Found cred(2): %d", cred );

                    AUTHLOGGER_WRITE_FORMAT8( "uri: %S", &aURI.UriDes() );

                    return cred;

                    }

                }

            }

        }

    AUTHLOGGER_WRITE( "cred not found" );

    return KErrNotFound;

    }

// -----------------------------------------------------------------------------

// CHttpFilterDigestAuthentication::FindHeaderPartToUseL

// Find the Authentication header.

// -----------------------------------------------------------------------------

//

TInt CHttpFilterDigestAuthentication::DFindHeaderPartToUseL( RHTTPTransaction aTransaction )

    {

    // While we're here, we check that all desired fields are there.

    RStringF wwwAuthenticate = iStringPool.StringF( iHttpStringAuthenticate, RHTTPSession::GetTable() );

    TInt lastGoodDigest = KErrNotFound;

    RHTTPHeaders headers = aTransaction.Response().GetHeaderCollection();

    const TInt parts = headers.FieldPartsL( wwwAuthenticate );

    for ( TInt ii = 0; ii < parts; ii++ )

        {

        THTTPHdrVal fieldVal; // The name of the current field.

        THTTPHdrVal hdrVal; //A scratch hdrVal

        switch ( fieldVal.StrF().Index( RHTTPSession::GetTable() ) )

            {

            case HTTP::EDigest:

                {

                if ( headers.GetParam( wwwAuthenticate, iRealmStr, hdrVal, ii ) == KErrNone )

                    {

                    lastGoodDigest = ii;

                    }

                }

                break;

            default:

                // We don't understand this, whatever it is. Ignore it.

                break;

            }