/*

 *

 *    Copyright (c) 2020-2021 Project CHIP Authors

 *    Copyright (c) 2013-2017 Nest Labs, Inc.

 *    All rights reserved.

 *

 *    Licensed under the Apache License, Version 2.0 (the "License");

 *    you may not use this file except in compliance with the License.

 *    You may obtain a copy of the License at

 *

 *        http://www.apache.org/licenses/LICENSE-2.0

 *

 *    Unless required by applicable law or agreed to in writing, software

 *    distributed under the License is distributed on an "AS IS" BASIS,

 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 *    See the License for the specific language governing permissions and

 *    limitations under the License.

 */

/**

 *    @file

 *      This file implements the CHIP Connection object that maintains a UDP connection.

 *      TODO This class should be extended to support TCP as well...

 *

 */

#include "SessionManager.h"

#include <algorithm>

#include <inttypes.h>

#include <string.h>

#include "transport/TraceMessage.h"

#include <app/util/basic-types.h>

#include <credentials/GroupDataProvider.h>

#include <inttypes.h>

#include <lib/core/CHIPKeyIds.h>

#include <lib/core/Global.h>

#include <lib/support/AutoRelease.h>

#include <lib/support/CodeUtils.h>

#include <lib/support/SafeInt.h>

#include <lib/support/logging/CHIPLogging.h>

#include <platform/CHIPDeviceLayer.h>

#include <protocols/Protocols.h>

#include <protocols/secure_channel/Constants.h>

#include <tracing/macros.h>

#include <transport/GroupPeerMessageCounter.h>

#include <transport/GroupSession.h>

#include <transport/SecureMessageCodec.h>

#include <transport/TracingStructs.h>

#include <transport/TransportMgr.h>

#include <transport/raw/GroupcastTesting.h>

namespace chip {

using System::PacketBufferHandle;

using Transport::GroupPeerTable;

using Transport::PeerAddress;

using Transport::SecureSession;

namespace {

Global<GroupPeerTable> gGroupPeerTable;

// Helper function that strips off the interface ID from a peer address that is

// not an IPv6 link-local address.  For any other address type we should rely on

// the device's routing table to route messages sent.  Forcing messages down a

// specific interface might fail with "no route to host".

void CorrectPeerAddressInterfaceID(Transport::PeerAddress & peerAddress)

{

    if (peerAddress.GetIPAddress().IsIPv6LinkLocal())

    {

        return;

    }

    peerAddress.SetInterface(Inet::InterfaceId::Null());

}

} // namespace

uint32_t EncryptedPacketBufferHandle::GetMessageCounter() const

{

    PacketHeader header;

    uint16_t headerSize = 0;

    CHIP_ERROR err      = header.Decode((*this)->Start(), (*this)->DataLength(), &headerSize);

    if (err == CHIP_NO_ERROR)

    {

        return header.GetMessageCounter();

    }

    ChipLogError(Inet, "Failed to decode EncryptedPacketBufferHandle header with error: %" CHIP_ERROR_FORMAT, err.Format());

    return 0;

}

SessionManager::SessionManager() : mState(State::kNotReady) {}

SessionManager::~SessionManager()

{

    this->Shutdown();

}

CHIP_ERROR SessionManager::Init(System::Layer * systemLayer, TransportMgrBase * transportMgr,

                                Transport::MessageCounterManagerInterface * messageCounterManager,

                                chip::PersistentStorageDelegate * storageDelegate, FabricTable * fabricTable,

                                Crypto::SessionKeystore & sessionKeystore)

{

    VerifyOrReturnError(mState == State::kNotReady, CHIP_ERROR_INCORRECT_STATE);

    VerifyOrReturnError(transportMgr != nullptr, CHIP_ERROR_INVALID_ARGUMENT);

    VerifyOrReturnError(storageDelegate != nullptr, CHIP_ERROR_INVALID_ARGUMENT);

    VerifyOrReturnError(fabricTable != nullptr, CHIP_ERROR_INVALID_ARGUMENT);

    ReturnErrorOnFailure(fabricTable->AddFabricDelegate(this));

    mState                 = State::kInitialized;

    mSystemLayer           = systemLayer;

    mTransportMgr          = transportMgr;

    mMessageCounterManager = messageCounterManager;

    mFabricTable           = fabricTable;

    mSessionKeystore       = &sessionKeystore;

    mSecureSessions.Init();

    mGlobalUnencryptedMessageCounter.Init();

    ReturnErrorOnFailure(mGroupClientCounter.Init(storageDelegate));

    mTransportMgr->SetSessionManager(this);

#if INET_CONFIG_ENABLE_TCP_ENDPOINT

    mConnCompleteCb = nullptr;

    mConnClosedCb   = nullptr;

#endif // INET_CONFIG_ENABLE_TCP_ENDPOINT

    // Ensure MessageStats struct is at default state on Init

    mMessageStats = MessageStats();

    return CHIP_NO_ERROR;

}

void SessionManager::Shutdown()

{

    if (mFabricTable != nullptr)

    {

        mFabricTable->RemoveFabricDelegate(this);

        mFabricTable = nullptr;

    }

    // Ensure that we don't create new sessions as we iterate our session table.

    mState = State::kNotReady;

    // Just in case some consumer forgot to do it, expire all our secure

    // sessions.  Note that this stands a good chance of crashing with a

    // null-deref if there are in fact any secure sessions left, since they will

    // try to notify their exchanges, which will then try to operate on

    // partially-shut-down objects.

    ExpireAllSecureSessions();

    // We don't have a safe way to check or affect the state of our

    // mUnauthenticatedSessions.  We can only hope they got shut down properly.

    mMessageCounterManager = nullptr;

    mSystemLayer  = nullptr;

    mTransportMgr = nullptr;

    mCB           = nullptr;

}

/**

 * @brief Notification that a fabric was removed.

 *        This function doesn't call ExpireAllSessionsForFabric

 *        since the CASE session might still be open to send a response

 *        on the removed fabric.

 */

void SessionManager::FabricRemoved(FabricIndex fabricIndex)

{

    TEMPORARY_RETURN_IGNORED gGroupPeerTable->FabricRemoved(fabricIndex);

}

CHIP_ERROR SessionManager::PrepareMessage(const SessionHandle & sessionHandle, PayloadHeader & payloadHeader,

                                          System::PacketBufferHandle && message, EncryptedPacketBufferHandle & preparedMessage)

{

    MATTER_TRACE_SCOPE("PrepareMessage", "SessionManager");

    VerifyOrReturnError(!message->HasChainedBuffer(), CHIP_ERROR_INVALID_MESSAGE_LENGTH);

    bool headerEncoded = false;

    PacketHeader packetHeader;

    bool isControlMsg = IsControlMessage(payloadHeader);

    if (isControlMsg)

    {

        packetHeader.SetSecureSessionControlMsg(true);

    }

    if (sessionHandle->AllowsLargePayload())

    {

        uint32_t maxPayload = sessionHandle->GetRemoteSessionParameters().GetMaxTCPPayloadSize();

        size_t remoteLimit  = (maxPayload > 0) ? static_cast<size_t>(maxPayload) : kLegacyDefaultMaxLargeAppMessageLen;

        size_t limit        = std::min(remoteLimit, kMaxLargeAppMessageLen);

        VerifyOrReturnError(message->TotalLength() <= limit, CHIP_ERROR_MESSAGE_TOO_LONG);

    }

    else

    {

        VerifyOrReturnError(message->TotalLength() <= kMaxAppMessageLen, CHIP_ERROR_MESSAGE_TOO_LONG);

    }

#if CHIP_PROGRESS_LOGGING

    NodeId destination;

    FabricIndex fabricIndex;

#endif // CHIP_PROGRESS_LOGGING

    NodeId sourceNodeId = kUndefinedNodeId;

    PeerAddress destination_address;

    switch (sessionHandle->GetSessionType())

    {

    case Transport::Session::SessionType::kGroupOutgoing: {

        auto groupSession = sessionHandle->AsOutgoingGroupSession();

        auto * groups     = Credentials::GetGroupDataProvider();

        VerifyOrReturnError(nullptr != groups, CHIP_ERROR_INTERNAL);

        const FabricInfo * fabric = mFabricTable->FindFabricWithIndex(groupSession->GetFabricIndex());

        VerifyOrReturnError(fabric != nullptr, CHIP_ERROR_INVALID_ARGUMENT);

        packetHeader.SetDestinationGroupId(groupSession->GetGroupId());

        packetHeader.SetMessageCounter(mGroupClientCounter.GetCounter(isControlMsg));

        TEMPORARY_RETURN_IGNORED mGroupClientCounter.IncrementCounter(isControlMsg);

        packetHeader.SetSessionType(Header::SessionType::kGroupSession);

        packetHeader.SetFlags(Header::SecFlagValues::kPrivacyFlag);

        sourceNodeId = fabric->GetNodeId();

        packetHeader.SetSourceNodeId(sourceNodeId);

        if (!packetHeader.IsValidGroupMsg())

        {

            return CHIP_ERROR_INTERNAL;

        }

        Credentials::GroupDataProvider::GroupInfo info;

        ReturnErrorOnFailure(groups->GetGroupInfo(groupSession->GetFabricIndex(), groupSession->GetGroupId(), info));

        destination_address = (info.UsePerGroupAddress())

            ? Transport::PeerAddress::BuildMatterPerGroupMulticastAddress(fabric->GetFabricId(), groupSession->GetGroupId())

            : Transport::PeerAddress::BuildMatterIanaMulticastAddress();

        Crypto::SymmetricKeyContext * keyContext =

            groups->GetKeyContext(groupSession->GetFabricIndex(), groupSession->GetGroupId());

        VerifyOrReturnError(nullptr != keyContext, CHIP_ERROR_INTERNAL);

        AutoRelease<Crypto::SymmetricKeyContext> keyContextOwner(keyContext);

        packetHeader.SetSessionId(keyContext->GetKeyHash());

        CryptoContext cryptoContext(keyContext);

        // Trace before any encryption

        MATTER_LOG_MESSAGE_SEND(chip::Tracing::OutgoingMessageType::kGroupMessage, &payloadHeader, &packetHeader,

                                chip::ByteSpan(message->Start(), message->TotalLength()),

                                /* messageTotalSize = */

                                (packetHeader.EncodeSizeBytes() + payloadHeader.EncodeSizeBytes() + message->TotalLength() +

                                 packetHeader.MICTagLength()));

        CHIP_TRACE_MESSAGE_SENT(payloadHeader, packetHeader, destination_address, message->Start(), message->TotalLength());

        CryptoContext::NonceStorage nonce;

        ReturnErrorOnFailure(

            CryptoContext::BuildNonce(nonce, packetHeader.GetSecurityFlags(), packetHeader.GetMessageCounter(), sourceNodeId));

        CHIP_ERROR err = SecureMessageCodec::Encrypt(cryptoContext, nonce, payloadHeader, packetHeader, message);

        ReturnErrorOnFailure(err);

        // Encode header now so we can privacy encrypt it

        ReturnErrorOnFailure(packetHeader.EncodeBeforeData(message));

        headerEncoded = true;

        // Begin privacy encrypt for appropriate header fields

        // Since we are not using chained buffers, the message data length should be equal to the total length

        VerifyOrReturnError(message->TotalLength() == message->DataLength(), CHIP_ERROR_INVALID_MESSAGE_LENGTH);

        uint8_t * data     = message->Start();

        size_t len         = message->TotalLength();

        uint16_t footerLen = packetHeader.MICTagLength();

        VerifyOrReturnError(footerLen <= len, CHIP_ERROR_INTERNAL);

        uint16_t taglen = 0;

        MessageAuthenticationCode mac;

        ReturnErrorOnFailure(mac.Decode(packetHeader, &data[len - footerLen], footerLen, &taglen));

        VerifyOrReturnError(taglen == footerLen, CHIP_ERROR_INTERNAL);

        // Pointer to the start of the privacy header within the message buffer.

        // The privacy header contains fields that need to be privacy-encrypted (e.g. Session ID, Message Counter).

        uint8_t * privacyHeader = packetHeader.PrivacyHeader(message->Start());

        size_t privacyLength    = packetHeader.PrivacyHeaderLength();

        // We must ensure that:

        // 1. The privacy header starts within the message buffer.

        // 2. The privacy header lies entirely within the encoded packet header bounds (to prevent encrypting payload).

        // 3. The packet header lies entirely within the valid message buffer bounds.

        //

        // (privacyHeader + privacyLength): Pointer to the end of the privacy header.

        // (message->Start() + packetHeader.EncodeSizeBytes()): Pointer to the end of the packet header.

        // (message->Start() + message->TotalLength()): Pointer to the end of the valid message data in the buffer.

        uint8_t * privacyHeaderEnd = (privacyHeader + privacyLength);

        uint8_t * headerEnd        = (message->Start() + packetHeader.EncodeSizeBytes());

        uint8_t * messageEnd       = (message->Start() + message->TotalLength());

        // Other fields such as message flags and session ID should exist in the header BEFORE the privacy fields,

        // so the start of the privacy header must be strictly after the message start

        VerifyOrReturnError(privacyHeader > message->Start(), CHIP_ERROR_INTERNAL);

        // When the message extensions (MX) security flag is set, this indicates that there will be a message extensions

        // portion of the header (with a non-zero length). This portion of the header exists after the privacy header end.

        // If the flag is not set, the end of the privacy header should be the end of the header itself.

        bool mxEnabled = packetHeader.GetSecurityFlags() & to_underlying(Header::SecFlagValues::kMsgExtensionFlag);

        if (mxEnabled)

        {

            VerifyOrReturnError(privacyHeaderEnd < headerEnd, CHIP_ERROR_INTERNAL);

        }

        else

        {

            VerifyOrReturnError(privacyHeaderEnd == headerEnd, CHIP_ERROR_INTERNAL);

        }

        VerifyOrReturnError(headerEnd < messageEnd, CHIP_ERROR_INTERNAL);

        ReturnErrorOnFailure(cryptoContext.PrivacyEncrypt(privacyHeader, privacyLength, privacyHeader, packetHeader, mac));

#if CHIP_PROGRESS_LOGGING

        destination = NodeIdFromGroupId(groupSession->GetGroupId());

        fabricIndex = groupSession->GetFabricIndex();

#endif // CHIP_PROGRESS_LOGGING

    }

    break;

    case Transport::Session::SessionType::kSecure: {

        SecureSession * session = sessionHandle->AsSecureSession();

        if (session == nullptr)

        {

            return CHIP_ERROR_NOT_CONNECTED;

        }

        MessageCounter & counter = session->GetSessionMessageCounter().GetLocalMessageCounter();

        uint32_t messageCounter;

        ReturnErrorOnFailure(counter.AdvanceAndConsume(messageCounter));

        packetHeader

            .SetMessageCounter(messageCounter)         //

            .SetSessionId(session->GetPeerSessionId()) //

            .SetSessionType(Header::SessionType::kUnicastSession);

        destination_address           = session->GetPeerAddress();

        CryptoContext & cryptoContext = session->GetCryptoContext();

        // Trace before any encryption

        MATTER_LOG_MESSAGE_SEND(chip::Tracing::OutgoingMessageType::kSecureSession, &payloadHeader, &packetHeader,

                                chip::ByteSpan(message->Start(), message->TotalLength()),

                                /* totalMessageSize = */

                                (packetHeader.EncodeSizeBytes() + payloadHeader.EncodeSizeBytes() + message->TotalLength() +

                                 packetHeader.MICTagLength()));

        CHIP_TRACE_MESSAGE_SENT(payloadHeader, packetHeader, destination_address, message->Start(), message->TotalLength());

        CryptoContext::NonceStorage nonce;

        sourceNodeId = session->GetLocalScopedNodeId().GetNodeId();

        ReturnErrorOnFailure(CryptoContext::BuildNonce(nonce, packetHeader.GetSecurityFlags(), messageCounter, sourceNodeId));

        ReturnErrorOnFailure(SecureMessageCodec::Encrypt(cryptoContext, nonce, payloadHeader, packetHeader, message));

#if CHIP_PROGRESS_LOGGING

        destination = session->GetPeerNodeId();

        fabricIndex = session->GetFabricIndex();

#endif // CHIP_PROGRESS_LOGGING

    }

    break;

    case Transport::Session::SessionType::kUnauthenticated: {

        MessageCounter & counter = mGlobalUnencryptedMessageCounter;

        uint32_t messageCounter;

        ReturnErrorOnFailure(counter.AdvanceAndConsume(messageCounter));

        packetHeader.SetMessageCounter(messageCounter);

        Transport::UnauthenticatedSession * session = sessionHandle->AsUnauthenticatedSession();

        switch (session->GetSessionRole())

        {

        case Transport::UnauthenticatedSession::SessionRole::kInitiator:

            packetHeader.SetSourceNodeId(session->GetEphemeralInitiatorNodeID());

            break;

        case Transport::UnauthenticatedSession::SessionRole::kResponder:

            packetHeader.SetDestinationNodeId(session->GetEphemeralInitiatorNodeID());

            break;

        }

        auto unauthenticated = sessionHandle->AsUnauthenticatedSession();

        destination_address  = unauthenticated->GetPeerAddress();

        // Trace after all headers are settled.

        MATTER_LOG_MESSAGE_SEND(chip::Tracing::OutgoingMessageType::kUnauthenticated, &payloadHeader, &packetHeader,

                                chip::ByteSpan(message->Start(), message->TotalLength()),

                                /* messageTotalSize = */ packetHeader.EncodeSizeBytes() + payloadHeader.EncodeSizeBytes() +

                                    message->TotalLength());

        CHIP_TRACE_MESSAGE_SENT(payloadHeader, packetHeader, destination_address, message->Start(), message->TotalLength());

        ReturnErrorOnFailure(payloadHeader.EncodeBeforeData(message));

#if CHIP_PROGRESS_LOGGING

        destination = kUndefinedNodeId;

        fabricIndex = kUndefinedFabricIndex;

        if (session->GetSessionRole() == Transport::UnauthenticatedSession::SessionRole::kResponder)

        {

            destination = session->GetEphemeralInitiatorNodeID();

        }

        else if (session->GetSessionRole() == Transport::UnauthenticatedSession::SessionRole::kInitiator)

        {

            sourceNodeId = session->GetEphemeralInitiatorNodeID();

        }

#endif // CHIP_PROGRESS_LOGGING

    }

    break;

    default:

        return CHIP_ERROR_INTERNAL;

    }

    if (!headerEncoded)

    {

        ReturnErrorOnFailure(packetHeader.EncodeBeforeData(message));

    }

#if CHIP_PROGRESS_LOGGING

    CompressedFabricId compressedFabricId = kUndefinedCompressedFabricId;

    if (fabricIndex != kUndefinedFabricIndex && mFabricTable != nullptr)

    {

        auto fabricInfo = mFabricTable->FindFabricWithIndex(fabricIndex);

        if (fabricInfo)

        {

            compressedFabricId = fabricInfo->GetCompressedFabricId();

        }

    }

    auto * protocolName = Protocols::GetProtocolName(payloadHeader.GetProtocolID());

    auto * msgTypeName  = Protocols::GetMessageTypeName(payloadHeader.GetProtocolID(), payloadHeader.GetMessageType());

    //

    // 32-bit value maximum = 10 chars + text preamble (6) + trailer (1) + null (1) + 2 buffer = 20

    //

    char ackBuf[20];

    ackBuf[0] = '\0';

    if (payloadHeader.GetAckMessageCounter().HasValue())

    {

        snprintf(ackBuf, sizeof(ackBuf), " (Ack:" ChipLogFormatMessageCounter ")", payloadHeader.GetAckMessageCounter().Value());

    }

    char addressStr[Transport::PeerAddress::kMaxToStringSize] = { 0 };

    destination_address.ToString(addressStr);

    // Work around pigweed not allowing more than 14 format args in a log

    // message when using tokenized logs.

    char typeStr[4 + 1 + 2 + 1];

    snprintf(typeStr, sizeof(typeStr), "%04X:%02X", payloadHeader.GetProtocolID().GetProtocolId(), payloadHeader.GetMessageType());

    // More work around pigweed not allowing more than 14 format args in a log

    // message when using tokenized logs.

    // ChipLogFormatExchangeId logs the numeric exchange ID (at most 5 chars,

    // since it's a uint16_t) and one char for initiator/responder.  Plus we

    // need a null-terminator.

    char exchangeStr[5 + 1 + 1];

    snprintf(exchangeStr, sizeof(exchangeStr), ChipLogFormatExchangeId, ChipLogValueExchangeIdFromSentHeader(payloadHeader));

    // More work around pigweed not allowing more than 14 format args in a log

    // message when using tokenized logs.

    // text(5) + source(16) + text(4) + fabricIndex(uint16_t, at most 5 chars) + text(1) + destination(16) + text(2) + compressed

    // fabric id(4) + text(1) + null-terminator

    char sourceDestinationStr[5 + 16 + 4 + 5 + 1 + 16 + 2 + 4 + 1 + 1];

    snprintf(sourceDestinationStr, sizeof(sourceDestinationStr), "from " ChipLogFormatX64 " to %u:" ChipLogFormatX64 " [%04X]",

             ChipLogValueX64(sourceNodeId), fabricIndex, ChipLogValueX64(destination), static_cast<uint16_t>(compressedFabricId));

    //

    // Legend that can be used to decode this log line can be found in messaging/README.md

    //

    ChipLogProgress(ExchangeManager,

                    "<<< [E:%s S:%u M:" ChipLogFormatMessageCounter "%s] (%s) Msg TX %s [%s] --- Type %s (%s:%s) (B:%u)",

                    exchangeStr, sessionHandle->SessionIdForLogging(), packetHeader.GetMessageCounter(), ackBuf,

                    Transport::GetSessionTypeString(sessionHandle), sourceDestinationStr, addressStr, typeStr, protocolName,

                    msgTypeName, static_cast<unsigned>(message->TotalLength()));

#endif

    preparedMessage = EncryptedPacketBufferHandle::MarkEncrypted(std::move(message));

    CountMessagesSent(sessionHandle, payloadHeader);

    return CHIP_NO_ERROR;

}

CHIP_ERROR SessionManager::SendPreparedMessage(const SessionHandle & sessionHandle,

                                               const EncryptedPacketBufferHandle & preparedMessage)

{

    VerifyOrReturnError(mState == State::kInitialized, CHIP_ERROR_INCORRECT_STATE);

    VerifyOrReturnError(!preparedMessage.IsNull(), CHIP_ERROR_INVALID_ARGUMENT);

    Transport::PeerAddress multicastAddress; // Only used for the group case

    const Transport::PeerAddress * destination;

    switch (sessionHandle->GetSessionType())

    {

    case Transport::Session::SessionType::kGroupOutgoing: {

        auto groupSession = sessionHandle->AsOutgoingGroupSession();

        const FabricInfo * fabric = mFabricTable->FindFabricWithIndex(groupSession->GetFabricIndex());

        VerifyOrReturnError(fabric != nullptr, CHIP_ERROR_INVALID_ARGUMENT);

        auto * groups = Credentials::GetGroupDataProvider();

        VerifyOrReturnError(nullptr != groups, CHIP_ERROR_INTERNAL);

        Credentials::GroupDataProvider::GroupInfo info;

        ReturnErrorOnFailure(groups->GetGroupInfo(groupSession->GetFabricIndex(), groupSession->GetGroupId(), info));

        multicastAddress = (info.UsePerGroupAddress())

            ? Transport::PeerAddress::BuildMatterPerGroupMulticastAddress(fabric->GetFabricId(), groupSession->GetGroupId())

            : Transport::PeerAddress::BuildMatterIanaMulticastAddress();

        destination      = &multicastAddress;

    }

    break;

    case Transport::Session::SessionType::kSecure: {

        // Find an active connection to the specified peer node

        SecureSession * secure = sessionHandle->AsSecureSession();

        // This marks any connection where we send data to as 'active'

        secure->MarkActive();

        destination = &secure->GetPeerAddress();

    }

    break;

    case Transport::Session::SessionType::kUnauthenticated: {

        auto unauthenticated = sessionHandle->AsUnauthenticatedSession();

        unauthenticated->MarkActive();

        destination = &unauthenticated->GetPeerAddress();

    }

    break;

    default:

        return CHIP_ERROR_INTERNAL;

    }

    PacketBufferHandle msgBuf = preparedMessage.CastToWritable();

    VerifyOrReturnError(!msgBuf.IsNull(), CHIP_ERROR_INVALID_ARGUMENT);

    VerifyOrReturnError(!msgBuf->HasChainedBuffer(), CHIP_ERROR_INVALID_MESSAGE_LENGTH);

#if CHIP_SYSTEM_CONFIG_MULTICAST_HOMING

    if (sessionHandle->GetSessionType() == Transport::Session::SessionType::kGroupOutgoing)

    {

        chip::Inet::InterfaceIterator interfaceIt;

        chip::Inet::InterfaceId interfaceId = chip::Inet::InterfaceId::Null();

        chip::Inet::IPAddress addr;

        bool interfaceFound = false;

        while (interfaceIt.Next())

        {

            if (interfaceIt.SupportsMulticast() && interfaceIt.IsUp())

            {

                char name[Inet::InterfaceId::kMaxIfNameLength];

                TEMPORARY_RETURN_IGNORED interfaceIt.GetInterfaceName(name, Inet::InterfaceId::kMaxIfNameLength);

                interfaceId = interfaceIt.GetInterfaceId();

                if (CHIP_NO_ERROR == interfaceId.GetLinkLocalAddr(&addr))

                {

                    ChipLogDetail(Inet, "Interface %s has a link local address", name);

                    interfaceFound             = true;

                    PacketBufferHandle tempBuf = msgBuf.CloneData();

                    VerifyOrReturnError(!tempBuf.IsNull(), CHIP_ERROR_INVALID_ARGUMENT);

                    VerifyOrReturnError(!tempBuf->HasChainedBuffer(), CHIP_ERROR_INVALID_MESSAGE_LENGTH);

                    destination = &(multicastAddress.SetInterface(interfaceId));

                    if (mTransportMgr != nullptr)

                    {

                        if (CHIP_NO_ERROR != mTransportMgr->SendMessage(*destination, std::move(tempBuf)))

                        {

                            ChipLogError(Inet, "Failed to send Multicast message on interface %s", name);

                        }

                        else

                        {

                            ChipLogDetail(Inet, "Successfully send Multicast message on interface %s", name);

                        }

                    }

                }

            }

        }

        if (!interfaceFound)

        {

            ChipLogError(Inet, "No valid Interface found.. Sending to the default one.. ");

        }

        else

        {

            // Always return No error, because we expect some interface to fails and others to always succeed (e.g. lo interface)

            return CHIP_NO_ERROR;

        }

    }

#endif // CHIP_SYSTEM_CONFIG_MULTICAST_HOMING

    if (mTransportMgr != nullptr)

    {

        CHIP_ERROR err = mTransportMgr->SendMessage(*destination, std::move(msgBuf));

#if CHIP_ERROR_LOGGING

        if (err != CHIP_NO_ERROR)

        {

            char addressStr[Transport::PeerAddress::kMaxToStringSize] = { 0 };

            destination->ToString(addressStr);

            ChipLogError(Inet, "SendMessage() to %s failed: %" CHIP_ERROR_FORMAT, addressStr, err.Format());

        }

#endif // CHIP_ERROR_LOGGING

        return err;

    }

    ChipLogError(Inet, "The transport manager is not initialized. Unable to send the message");

    return CHIP_ERROR_INCORRECT_STATE;

}

void SessionManager::ExpireAllSessions(const ScopedNodeId & node)

{

    ChipLogDetail(Inet, "Expiring all sessions for node " ChipLogFormatScopedNodeId "!!", ChipLogValueScopedNodeId(node));

    ForEachMatchingSession(node, [](auto * session) { session->MarkForEviction(); });

}

void SessionManager::ExpireAllSessionsForFabric(FabricIndex fabricIndex)

{

    ChipLogDetail(Inet, "Expiring all sessions for fabric 0x%x!!", static_cast<unsigned>(fabricIndex));

    ForEachMatchingSession(fabricIndex, [](auto * session) { session->MarkForEviction(); });

}

CHIP_ERROR SessionManager::ExpireAllSessionsOnLogicalFabric(const ScopedNodeId & node)

{

    ChipLogDetail(Inet, "Expiring all sessions to peer " ChipLogFormatScopedNodeId " that are on the same logical fabric!!",

                  ChipLogValueScopedNodeId(node));

    return ForEachMatchingSessionOnLogicalFabric(node, [](auto * session) { session->MarkForEviction(); });

}

CHIP_ERROR SessionManager::ExpireAllSessionsOnLogicalFabric(FabricIndex fabricIndex)

{

    ChipLogDetail(Inet, "Expiring all sessions on the same logical fabric as fabric 0x%x!!", static_cast<unsigned>(fabricIndex));

    return ForEachMatchingSessionOnLogicalFabric(fabricIndex, [](auto * session) { session->MarkForEviction(); });

}

void SessionManager::ExpireAllPASESessions()

{

    ChipLogDetail(Inet, "Expiring all PASE sessions");

    mSecureSessions.ForEachSession([&](auto session) {

        if (session->GetSecureSessionType() == Transport::SecureSession::Type::kPASE)

        {

            session->MarkForEviction();

        }

        return Loop::Continue;

    });

}

void SessionManager::ExpireAllSecureSessions()

{

    mSecureSessions.ForEachSession([&](auto session) {

        session->MarkForEviction();

        return Loop::Continue;

    });

}

void SessionManager::MarkSessionsAsDefunct(const ScopedNodeId & node, const Optional<Transport::SecureSession::Type> & type)

{

    mSecureSessions.ForEachSession([&node, &type](auto session) {

        if (session->IsActiveSession() && session->GetPeer() == node &&

            (!type.HasValue() || type.Value() == session->GetSecureSessionType()))

        {

            session->MarkAsDefunct();

        }

        return Loop::Continue;

    });

}

void SessionManager::UpdateAllSessionsPeerAddress(const ScopedNodeId & node, const Transport::PeerAddress & addr)

{

    mSecureSessions.ForEachSession([&node, &addr](auto session) {

        // Arguably we should only be updating active and defunct sessions, but there is no harm

        // in updating evicted sessions.

        if (session->GetPeer() == node && Transport::SecureSession::Type::kCASE == session->GetSecureSessionType())

        {

            session->SetPeerAddress(addr);

        }

        return Loop::Continue;

    });

}

Optional<SessionHandle> SessionManager::AllocateSession(SecureSession::Type secureSessionType,

                                                        const ScopedNodeId & sessionEvictionHint)

{

    VerifyOrReturnValue(mState == State::kInitialized, NullOptional);

    return mSecureSessions.CreateNewSecureSession(secureSessionType, sessionEvictionHint);

}

CHIP_ERROR SessionManager::InjectPaseSessionWithTestKey(SessionHolder & sessionHolder, uint16_t localSessionId, NodeId peerNodeId,

                                                        uint16_t peerSessionId, FabricIndex fabric,

                                                        const Transport::PeerAddress & peerAddress, CryptoContext::SessionRole role)

{

    NodeId localNodeId              = kUndefinedNodeId;

    Optional<SessionHandle> session = mSecureSessions.CreateNewSecureSessionForTest(

        chip::Transport::SecureSession::Type::kPASE, localSessionId, localNodeId, peerNodeId, CATValues{}, peerSessionId, fabric,

        GetLocalMRPConfig().ValueOr(GetDefaultMRPConfig()));

    VerifyOrReturnError(session.HasValue(), CHIP_ERROR_NO_MEMORY);

    SecureSession * secureSession = session.Value()->AsSecureSession();

    secureSession->SetPeerAddress(peerAddress);

    size_t secretLen = CHIP_CONFIG_TEST_SHARED_SECRET_LENGTH;

    ByteSpan secret(reinterpret_cast<const uint8_t *>(CHIP_CONFIG_TEST_SHARED_SECRET_VALUE), secretLen);

    ReturnErrorOnFailure(secureSession->GetCryptoContext().InitFromSecret(

        *mSessionKeystore, secret, ByteSpan(), CryptoContext::SessionInfoType::kSessionEstablishment, role));

    secureSession->GetSessionMessageCounter().GetPeerMessageCounter().SetCounter(Transport::PeerMessageCounter::kInitialSyncValue);

    sessionHolder.Grab(session.Value());

    return CHIP_NO_ERROR;

}

CHIP_ERROR SessionManager::InjectCaseSessionWithTestKey(SessionHolder & sessionHolder, uint16_t localSessionId,

                                                        uint16_t peerSessionId, NodeId localNodeId, NodeId peerNodeId,

                                                        FabricIndex fabric, const Transport::PeerAddress & peerAddress,

                                                        CryptoContext::SessionRole role, const CATValues & cats)

{

    Optional<SessionHandle> session = mSecureSessions.CreateNewSecureSessionForTest(

        chip::Transport::SecureSession::Type::kCASE, localSessionId, localNodeId, peerNodeId, cats, peerSessionId, fabric,

        GetLocalMRPConfig().ValueOr(GetDefaultMRPConfig()));

    VerifyOrReturnError(session.HasValue(), CHIP_ERROR_NO_MEMORY);

    SecureSession * secureSession = session.Value()->AsSecureSession();

    secureSession->SetPeerAddress(peerAddress);

    size_t secretLen = CHIP_CONFIG_TEST_SHARED_SECRET_LENGTH;

    ByteSpan secret(reinterpret_cast<const uint8_t *>(CHIP_CONFIG_TEST_SHARED_SECRET_VALUE), secretLen);

    ReturnErrorOnFailure(secureSession->GetCryptoContext().InitFromSecret(

        *mSessionKeystore, secret, ByteSpan(), CryptoContext::SessionInfoType::kSessionEstablishment, role));

    secureSession->GetSessionMessageCounter().GetPeerMessageCounter().SetCounter(Transport::PeerMessageCounter::kInitialSyncValue);

    sessionHolder.Grab(session.Value());

    return CHIP_NO_ERROR;

}

void SessionManager::OnMessageReceived(const PeerAddress & peerAddress, System::PacketBufferHandle && msg,

                                       Transport::MessageTransportContext * ctxt)

{

    PacketHeader partialPacketHeader;

    CHIP_ERROR err = partialPacketHeader.DecodeFixed(msg);

    if (err != CHIP_NO_ERROR)

    {

        ChipLogError(Inet, "Failed to decode packet header: %" CHIP_ERROR_FORMAT, err.Format());

        return;

    }

    if (partialPacketHeader.IsEncrypted())

    {

        if (partialPacketHeader.IsGroupSession())

        {

            SecureGroupMessageDispatch(partialPacketHeader, peerAddress, std::move(msg));

        }

        else

        {

            SecureUnicastMessageDispatch(partialPacketHeader, peerAddress, std::move(msg), ctxt);

        }

    }

    else

    {

        UnauthenticatedMessageDispatch(partialPacketHeader, peerAddress, std::move(msg), ctxt);

    }

}

#if INET_CONFIG_ENABLE_TCP_ENDPOINT

void SessionManager::HandleConnectionReceived(Transport::ActiveTCPConnectionState & conn)

{

    char peerAddrBuf[chip::Transport::PeerAddress::kMaxToStringSize];

    conn.mPeerAddr.ToString(peerAddrBuf);

    ChipLogProgress(Inet, "Received TCP connection request from %s.", peerAddrBuf);

    Transport::AppTCPConnectionCallbackCtxt * appTCPConnCbCtxt = conn.mAppState;

    if (appTCPConnCbCtxt != nullptr && appTCPConnCbCtxt->connReceivedCb != nullptr)

    {

        appTCPConnCbCtxt->connReceivedCb(conn);

    }

}

void SessionManager::HandleConnectionAttemptComplete(Transport::ActiveTCPConnectionHandle & conn, CHIP_ERROR conErr)

{

    VerifyOrReturn(!conn.IsNull());

    Transport::AppTCPConnectionCallbackCtxt * appTCPConnCbCtxt = conn->mAppState;

    bool callbackHandled                                       = false;

    if (appTCPConnCbCtxt != nullptr && appTCPConnCbCtxt->connCompleteCb != nullptr)

    {

        appTCPConnCbCtxt->connCompleteCb(conn, conErr);

        callbackHandled = true;

    }

    if ((mConnDelegate == nullptr || !mConnDelegate->OnTCPConnectionAttemptComplete(conn, conErr)) && !callbackHandled)

    {

        char peerAddrBuf[chip::Transport::PeerAddress::kMaxToStringSize];

        conn->mPeerAddr.ToString(peerAddrBuf);

        ChipLogProgress(Inet, "TCP Connection established with peer %s, but no registered handler.", peerAddrBuf);

    }

}

void SessionManager::HandleConnectionClosed(Transport::ActiveTCPConnectionState & conn, CHIP_ERROR conErr)

{

    Transport::AppTCPConnectionCallbackCtxt * appTCPConnCbCtxt = conn.mAppState;

    if (appTCPConnCbCtxt != nullptr && appTCPConnCbCtxt->connClosedCb != nullptr)

    {

        appTCPConnCbCtxt->connClosedCb(conn, conErr);

    }

    MarkSecureSessionOverTCPForEviction(conn, conErr);

    mUnauthenticatedSessions.MarkSessionOverTCPForEviction(conn);

}

CHIP_ERROR SessionManager::TCPConnect(const PeerAddress & peerAddress, Transport::AppTCPConnectionCallbackCtxt * appState,

                                      Transport::ActiveTCPConnectionHandle & peerConnState)

{

    char peerAddrBuf[chip::Transport::PeerAddress::kMaxToStringSize];

    peerAddress.ToString(peerAddrBuf);

    if (mTransportMgr != nullptr)

    {

        ChipLogProgress(Inet, "Connecting over TCP with peer at %s.", peerAddrBuf);

        return mTransportMgr->TCPConnect(peerAddress, appState, peerConnState);

    }

    ChipLogError(Inet, "The transport manager is not initialized. Unable to connect to peer at %s.", peerAddrBuf);

    return CHIP_ERROR_INCORRECT_STATE;

}

#endif // INET_CONFIG_ENABLE_TCP_ENDPOINT

void SessionManager::UnauthenticatedMessageDispatch(const PacketHeader & partialPacketHeader,

                                                    const Transport::PeerAddress & peerAddress, System::PacketBufferHandle && msg,

                                                    Transport::MessageTransportContext * ctxt)

{

    MATTER_TRACE_SCOPE("Unauthenticated Message Dispatch", "SessionManager");

#if INET_CONFIG_ENABLE_TCP_ENDPOINT

    if (peerAddress.GetTransportType() == Transport::Type::kTcp && ctxt->conn.IsNull())

    {

        ChipLogError(Inet, "Connection object is missing for received message.");

        return;

    }

#endif // INET_CONFIG_ENABLE_TCP_ENDPOINT

    // Drop unsecured messages with privacy enabled.

    if (partialPacketHeader.HasPrivacyFlag())

    {

        ChipLogError(Inet, "Dropping unauthenticated message with privacy flag set");

        return;

    }

    // Capture length before consuming headers.

    [[maybe_unused]] size_t messageTotalSize = msg->TotalLength();

    PacketHeader packetHeader;

    ReturnOnFailure(packetHeader.DecodeAndConsume(msg));

    Optional<NodeId> source      = packetHeader.GetSourceNodeId();

    Optional<NodeId> destination = packetHeader.GetDestinationNodeId();

    if ((source.HasValue() && destination.HasValue()) || (!source.HasValue() && !destination.HasValue()))

    {

        ChipLogProgress(Inet,

                        "Received malformed unsecure packet with source 0x" ChipLogFormatX64 " destination 0x" ChipLogFormatX64,

                        ChipLogValueX64(source.ValueOr(kUndefinedNodeId)), ChipLogValueX64(destination.ValueOr(kUndefinedNodeId)));

        return; // ephemeral node id is only assigned to the initiator, there should be one and only one node id exists.

    }

    Optional<SessionHandle> optionalSession;

    if (source.HasValue())

    {

        // Assume peer is the initiator, we are the responder.

        optionalSession = mUnauthenticatedSessions.FindOrAllocateResponder(source.Value(), GetDefaultMRPConfig(), peerAddress);

        if (!optionalSession.HasValue())

        {

            ChipLogError(Inet, "UnauthenticatedSession exhausted");

            return;

        }

    }

    else

    {

        // Assume peer is the responder, we are the initiator.

        optionalSession = mUnauthenticatedSessions.FindInitiator(destination.Value(), peerAddress);

        if (!optionalSession.HasValue())

        {

            ChipLogProgress(Inet, "Received unknown unsecure packet for initiator 0x" ChipLogFormatX64,

                            ChipLogValueX64(destination.Value()));

            return;

        }

    }

    const SessionHandle & session                        = optionalSession.Value();

    Transport::UnauthenticatedSession * unsecuredSession = session->AsUnauthenticatedSession();

    Transport::PeerAddress mutablePeerAddress            = peerAddress;

    CorrectPeerAddressInterfaceID(mutablePeerAddress);

    unsecuredSession->SetPeerAddress(mutablePeerAddress);

    SessionMessageDelegate::DuplicateMessage isDuplicate = SessionMessageDelegate::DuplicateMessage::No;

#if INET_CONFIG_ENABLE_TCP_ENDPOINT

    // Associate the unauthenticated session with the connection, if not done already.

    if (peerAddress.GetTransportType() == Transport::Type::kTcp)

    {

        Transport::ActiveTCPConnectionHandle sessionConn = unsecuredSession->GetTCPConnection();

        if (sessionConn.IsNull())

        {

            unsecuredSession->SetTCPConnection(ctxt->conn);

        }

        else

        {

            if (sessionConn != ctxt->conn)

            {

                ChipLogError(Inet, "Unauthenticated data received over TCP connection %p instead of %p. Dropping it!",

                             static_cast<const void *>(ctxt->conn), static_cast<const void *>(sessionConn));

                return;

            }

        }

    }

#endif // INET_CONFIG_ENABLE_TCP_ENDPOINT

    unsecuredSession->MarkActiveRx();

    PayloadHeader payloadHeader;

    ReturnOnFailure(payloadHeader.DecodeAndConsume(msg));

    // Verify message counter

    CHIP_ERROR err = unsecuredSession->GetPeerMessageCounter().VerifyUnencrypted(packetHeader.GetMessageCounter());

    if (err == CHIP_ERROR_DUPLICATE_MESSAGE_RECEIVED)

    {

        ChipLogDetail(Inet,

                      "Received a duplicate message with MessageCounter:" ChipLogFormatMessageCounter

                      " on exchange " ChipLogFormatExchangeId,

                      packetHeader.GetMessageCounter(), ChipLogValueExchangeIdFromReceivedHeader(payloadHeader));

        isDuplicate = SessionMessageDelegate::DuplicateMessage::Yes;

        err         = CHIP_NO_ERROR;

    }

    else

    {

        // VerifyUnencrypted always returns one of CHIP_NO_ERROR or

        // CHIP_ERROR_DUPLICATE_MESSAGE_RECEIVED.

        unsecuredSession->GetPeerMessageCounter().CommitUnencrypted(packetHeader.GetMessageCounter());

    }

    if (mCB != nullptr)

    {

        MATTER_LOG_MESSAGE_RECEIVED(chip::Tracing::IncomingMessageType::kUnauthenticated, &payloadHeader, &packetHeader,

                                    unsecuredSession, &peerAddress, chip::ByteSpan(msg->Start(), msg->TotalLength()),

                                    messageTotalSize);

        CHIP_TRACE_MESSAGE_RECEIVED(payloadHeader, packetHeader, unsecuredSession, peerAddress, msg->Start(), msg->TotalLength());

        CountMessagesReceived(session, payloadHeader);

        mCB->OnMessageReceived(packetHeader, payloadHeader, session, isDuplicate, std::move(msg));

    }

    else

    {

        ChipLogError(Inet, "Received UNSECURED message was not processed.");

    }

}

void SessionManager::SecureUnicastMessageDispatch(const PacketHeader & partialPacketHeader,

                                                  const Transport::PeerAddress & peerAddress, System::PacketBufferHandle && msg,

                                                  Transport::MessageTransportContext * ctxt)

{

    MATTER_TRACE_SCOPE("Secure Unicast Message Dispatch", "SessionManager");

    CHIP_ERROR err = CHIP_NO_ERROR;

#if INET_CONFIG_ENABLE_TCP_ENDPOINT

    if (peerAddress.GetTransportType() == Transport::Type::kTcp && ctxt->conn.IsNull())

    {

        ChipLogError(Inet, "Connection object is missing for received message.");

        return;

    }

#endif // INET_CONFIG_ENABLE_TCP_ENDPOINT

    Optional<SessionHandle> session = mSecureSessions.FindSecureSessionByLocalKey(partialPacketHeader.GetSessionId());

    if (!session.HasValue())

    {

        ChipLogError(Inet, "Data received on an unknown session (LSID=%d). Dropping it!", partialPacketHeader.GetSessionId());

        return;

    }

    Transport::SecureSession * secureSession = session.Value()->AsSecureSession();

#if INET_CONFIG_ENABLE_TCP_ENDPOINT

    // Associate the secure session with the connection, if not done already.

    if (peerAddress.GetTransportType() == Transport::Type::kTcp)

    {

        auto sessionConn = secureSession->GetTCPConnection();

        if (sessionConn.IsNull())