###########################################################################
# package Net::SIP::Request
# subclass from Net::SIP::Packet for managing the request packets
# has methods for creating ACK, CANCEL based on the request (and response)
# and for adding Digest authorization (md5+qop=auth only) to the
# request based on the requirements in the response
###########################################################################

use strict;
use warnings;

package Net::SIP::Request;
use base 'Net::SIP::Packet';
use Net::SIP::Debug;
use Net::SIP::Util 'invoke_callback';

use Digest::MD5 'md5_hex';

my %ResponseCode = (
	# Informational
	100 => 'Trying',
	180 => 'Ringing',
	181 => 'Call Is Being Forwarded',
	182 => 'Queued',
	183 => 'Session Progress',

	# Success
	200 => 'OK',

	# Redirection
	300 => 'Multiple Choices',
	301 => 'Moved Permanently',
	302 => 'Moved Temporarily',
	305 => 'Use Proxy',
	380 => 'Alternative Service',

	# Client-Error
	400 => 'Bad Request',
	401 => 'Unauthorized',
	402 => 'Payment Required',
	403 => 'Forbidden',
	404 => 'Not Found',
	405 => 'Method Not Allowed',
	406 => 'Not Acceptable',
	407 => 'Proxy Authentication Required',
	408 => 'Request Timeout',
	410 => 'Gone',
	413 => 'Request Entity Too Large',
	414 => 'Request-URI Too Large',
	415 => 'Unsupported Media Type',
	416 => 'Unsupported URI Scheme',
	420 => 'Bad Extension',
	421 => 'Extension Required',
	423 => 'Interval Too Brief',
	480 => 'Temporarily not available',
	481 => 'Call Leg/Transaction Does Not Exist',
	482 => 'Loop Detected',
	483 => 'Too Many Hops',
	484 => 'Address Incomplete',
	485 => 'Ambiguous',
	486 => 'Busy Here',
	487 => 'Request Terminated',
	488 => 'Not Acceptable Here',
	491 => 'Request Pending',
	493 => 'Undecipherable',

	# Server-Error
	500 => 'Internal Server Error',
	501 => 'Not Implemented',
	502 => 'Bad Gateway',
	503 => 'Service Unavailable',
	504 => 'Server Time-out',
	505 => 'SIP Version not supported',
	513 => 'Message Too Large',

	# Global-Failure
	600 => 'Busy Everywhere',
	603 => 'Decline',
	604 => 'Does not exist anywhere',
	606 => 'Not Acceptable',
);

###########################################################################
# Redefine methods from Net::SIP::Packet, no need to find out dynamically
###########################################################################
sub is_request  {1}
sub is_response {0}

###########################################################################
# Accessors for method and URI
###########################################################################
sub method      { return (shift->as_parts())[0] }
sub uri         { return (shift->as_parts())[1] }

sub set_uri {
	my Net::SIP::Request $self = shift;
	$self->_update_string;
	$self->{text} = shift;
}

###########################################################################
# set cseq
# Args: ($self,$number)
#   $number: new cseq number
# Returns: $self
###########################################################################
sub set_cseq {
	my Net::SIP::Request $self = shift;
	my $cseq = shift;
	$self->set_header( cseq => "$cseq ".$self->method );
	return $self;
}

###########################################################################
# create ack to response based on original request
# see RFC3261 "17.1.1.3 Construction of the ACK Request"
# Args: ($self,$response)
#  $response: Net::SIP::Response object for request $self
# Returns: $cancel
#  $ack: Net::SIP::Request object for ACK method
###########################################################################
sub create_ack {
	my Net::SIP::Request $self = shift;
	my $response = shift;
	# ACK uses cseq from request
	$self->cseq =~m{(\d+)};
	my $cseq = "$1 ACK";
	my %auth;
	for (qw(authorization proxy-authorization)) {
		my $v = scalar($self->get_header($_)) or next;
		$auth{$_} = $v;
	}
	my $header = {
		'call-id' => scalar($self->get_header('call-id')),
		from      => scalar($self->get_header('from')),
		# unlike CANCEL the 'to' header is from the response
		to        => [ $response->get_header('to') ],
		via       => [ ($self->get_header( 'via' ))[0] ],
		route     => [ $self->get_header( 'route' ) ],
		cseq      => $cseq,
		%auth,
	};
	return Net::SIP::Request->new( 'ACK',$self->uri,$header );
}

###########################################################################
# Create cancel for request
# Args: $self
# Returns: $cancel
#   $cancel: Net::SIP::Request containing CANCEL for $self
###########################################################################
sub create_cancel {
	my Net::SIP::Request $self = shift;
	# CANCEL uses cseq from request
	$self->cseq =~m{(\d+)};
	my $cseq = "$1 CANCEL";
	my %auth;
	for (qw(authorization proxy-authorization)) {
		my $v = scalar($self->get_header($_)) or next;
		$auth{$_} = $v;
	}
	my $header = {
		'call-id' => scalar($self->get_header('call-id')),
		from      => scalar($self->get_header('from')),
		# unlike ACK the 'to' header is from the original request
		to        => [ $self->get_header('to') ],
		via       => [ ($self->get_header( 'via' ))[0] ],
		route     => [ $self->get_header( 'route' ) ],
		cseq      => $cseq,
		%auth
	};
	return Net::SIP::Request->new( 'CANCEL',$self->uri,$header );
}

###########################################################################
# Create response to request
# Args: ($self,$code,[$msg],[$args,$body])
#   $code: numerical response code
#   $msg: msg for code, if arg not given it will be used from %ResponseCode
#   $args: additional args for SIP header
#   $body: body as string
# Returns: $response
#   $response: Net::SIP::Response
###########################################################################
sub create_response {
	my Net::SIP::Request $self = shift;
	my $code = shift;
	my ($msg,$args,$body) = ( defined $_[0] && ref($_[0]) ) ? (undef,@_):@_;
	$msg = $ResponseCode{$code} if ! defined $msg;
	my %header = (
		cseq      => scalar($self->get_header('cseq')),
		'call-id' => scalar($self->get_header('call-id')),
		from      => scalar($self->get_header('from')),
		to        => [ $self->get_header('to') ],
		'record-route'  => [ $self->get_header( 'record-route' ) ],
		via       => [ $self->get_header( 'via' ) ],
		$args ? %$args : ()
	);
	return Net::SIP::Response->new($code,$msg,\%header,$body);
}


###########################################################################
# Authorize Request based on credentials in response using
# Digest Authorization specified in RFC2617
# Args: ($self,$response,@args)
#   $response: Net::SIP::Response for $self which has code 401 or 407
#   @args: either [ $user,$pass ] if there is one user+pass for all realms
#       or { realm1 => [ $user,$pass ], realm2 => [...].. }
#       for different user,pass in different realms
#       or callback(realm)->[ user,pass ]
# Returns:  0|1
#    1: if (proxy-)=authorization headers were added to $self
#    0: if $self was not modified, e.g. no usable authenticate
#       headers were found
###########################################################################
sub authorize {
	my Net::SIP::Request $self = shift;
	my ($response,$user2pass) = @_;

	# find out format of user2pass
	my ($default_upw,$realm2upw,$cb_upw);
	if ( ref($user2pass) eq 'ARRAY' && ! ref( $user2pass->[0] )) {
		$default_upw = $user2pass;
	} elsif ( ref($user2pass) eq 'HASH' ) {
		$realm2upw = %$user2pass;
	} else {
		$cb_upw = $user2pass;
	}


	my $auth = 0;
	my %auth_map = (
		'proxy-authenticate' => 'proxy-authorization',
		'www-authenticate' => 'authorization',
	);

	while ( my ($req,$resp) = each %auth_map ) {
		my $existing_auth;
		if ( my @auth = $response->get_header_hashval( $req ) ) {
			foreach my $a (@auth) {
				my $h = $a->{parameter};

				# check if we already have an authorize header for this realm/opaque
				if ( ! $existing_auth ) {
					$existing_auth = {};
					foreach my $hdr ( $self->get_header_hashval( $resp )) {
						my @auth = grep { defined } map { $hdr->{parameter}{$_} }qw( realm opaque );
						$existing_auth->{ join( "\0",@auth ) } = 1;
					}
				}

				my @auth = grep { defined } map { $h->{$_} }qw( realm opaque );
				if ( $existing_auth->{ join( "\0",@auth ) } ) {
					# we have this auth header already, don't repeat
					next;
				}

				# RFC2617
				# we support only md5 (not md5-sess or other)
				# and only empty qop or qop=auth (not auth-int or other)

				if ( lc($a->{data}) ne 'digest'
					|| $h->{algorithm} && lc($h->{algorithm}) ne 'md5'
					|| $h->{qop} && $h->{qop} !~ m{(?:^|,\s*)auth(?:$|,)}i ) {
					no warnings;
					DEBUG(10,"unsupported authorization method $a->{data} method=$h->{method} qop=$h->{qop}");
					next;
				}
				my $realm = $h->{realm};
				my $upw =
					$cb_upw      ? invoke_callback( $cb_upw, $realm ) :
					$realm2upw   ? $realm2upw->{$realm} :
					$default_upw ? $default_upw :
					next;

				# for meaning of a1,a2... and for the full algorithm see RFC2617, 3.2.2
				my $a1 = join(':',$upw->[0],$realm,$upw->[1] ); # 3.2.2.2
				my $a2 = join(':',$self->method,$self->uri );   # 3.2.2.3, qop == auth|undef

				my %digest = (
					username => $upw->[0],
					realm => $realm,
					nonce => $h->{nonce},
					uri => $self->uri,
				);
				$digest{opaque} = $h->{opaque} if defined $h->{opaque};

				# 3.2.2.1
				if ( $h->{qop} ) {
					$h->{qop} = 'auth'; # in case it was 'auth,auth-int'
					my $nc = $digest{nc} = '00000001';
					my $cnonce = $digest{cnonce} = sprintf("%08x",rand(2**32));
					$digest{qop} = $h->{qop};
					$digest{response} = md5_hex( join(':',
						md5_hex($a1),
						$h->{nonce},
						$nc,
						$cnonce,
						$h->{qop},
						md5_hex($a2)
					));
				} else {
					# 3.2.2.1 compability with RFC2069
					$digest{response} = md5_hex( join(':',
						md5_hex($a1),
						$h->{nonce},
						md5_hex($a2),
					));
				}

				# RFC2617 has it's specific ideas what should be quoted and what not
				# so we assemble it manually
				my $header = qq[Digest username="$digest{username}",realm="$digest{realm}",].
					qq[nonce="$digest{nonce}",uri="$digest{uri}",response="$digest{response}"];
				$header.= qq[,opaque="$digest{opaque}"] if defined $digest{opaque};
				$header.= qq[,cnonce="$digest{cnonce}"] if defined $digest{cnonce};
				$header.= qq[,qop=$digest{qop}] if defined $digest{qop};
				$header.= qq[,nc=$digest{nc}] if defined $digest{nc};
				$self->add_header( $resp, $header );
				$auth++;
			}
		}
	}

	return if !$auth; # no usable authenticate headers found

	my ($rseq) = $response->cseq =~m{^(\d+)};
	$self->cseq =~m{^(\d+)(.*)};
	if ( defined $1 and $1 <= $rseq ) {
		# increase cseq, because this will be a new request, not a retransmit
		$self->set_header( cseq => ($rseq+1).$2 );
	}

	return 1;
}

1;