1 // Copyright (c) 2002-2009 Nokia Corporation and/or its subsidiary(-ies).

     2 // All rights reserved.

     3 // This component and the accompanying materials are made available

     4 // under the terms of "Eclipse Public License v1.0"

     5 // which accompanies this distribution, and is available

     6 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

     7 //

     8 // Initial Contributors:

     9 // Nokia Corporation - initial contribution.

    10 //

    11 // Contributors:

    12 //

    13 // Description:

    14 //

    15 

    16 

    17 // System includes

    18 #include <wsp/mwspproxyinfoprovider.h>

    19 #include <http/framework/csecuritypolicy.h>

    20 #include <http/framework/securitypolicypluginstrings.h>

    21 #include <wsperror.h>

    22 #include <http/framework/logging.h>

    23 

    24 // Local includes

    25 #include "tnwsswsptrhndpanic.h"

    26 #include "mconnectioninfoprovider.h"

    27 #include "testoom.h"

    28 

    29 // Class signature

    30 #include "cnwsswspsession.h"

    31 

    32 const TInt KWtlsMaxFieldSize	= 256;

    33 

    34 CNwssWspSession::~CNwssWspSession()

    35 	{

    36 	}

    37 

    38 CNwssWspSession::CNwssWspSession(RStringPool& aStringPool,

    39 								 MNwssWapServer& aWapStackProvider,

    40 								 MConnectionInfoProvider& aConnInfoProvider,

    41 								 MSecurityPolicy& aSecurityPolicy): 

    42 	CActive(CActive::EPriorityStandard), iStringPool(aStringPool),

    43 	iWapStackProvider(aWapStackProvider), iConnInfoProvider(aConnInfoProvider),

    44 	iState(EDisconnected), iSecurityPolicy(aSecurityPolicy)

    45 	{

    46 	CActiveScheduler::Add(this);

    47 	}

    48 

    49 void CNwssWspSession::BaseConstructL()

    50 	{

    51 	// Add the security policy plug-in string table to the string pool

    52 	__DEBUGTESTLEAVE

    53 	iStringPool.OpenL(SecurityPolicyProperties::Table);

    54 	}

    55 

    56 void CNwssWspSession::InitiateProxyConnection()

    57 	{

    58 	if (iState == EDisconnected)

    59 		CompleteSelf();

    60 	}

    61 

    62 CNwssWspSession::TState CNwssWspSession::State() const

    63 	{

    64 	return iState;

    65 	}

    66 

    67 

    68 TInt CNwssWspSession::SessionDisconnectedCallback()

    69 	{

    70 	TInt err = CloseWspSession();

    71 	if (err == KErrNone)

    72 		iState = EDisconnected;

    73 	return err;

    74 	}

    75 

    76 void CNwssWspSession::RunL()

    77 	{

    78 	switch (iState)

    79 		{

    80 	case EDisconnected:

    81 		{

    82 		__LOG("--Running in state EDisconnected")

    83 		// Make initial connection to the WAP Stack

    84 		__DEBUGTESTLEAVE

    85 		TBool useWtls = OpenWapProxyL();

    86 		if (useWtls)

    87 			iState = ESessionOpen;

    88 		else

    89 			iState = EReady;

    90 		CompleteSelf();

    91 		} break;

    92 	case ESessionOpen:

    93 		{

    94 		__LOG("--Running in state ESessionOpen")

    95 		// Do pre-handshake setup, followed by phase 1 of the connection

    96 		__DEBUGTESTLEAVE

    97 		DoWTLSConnectionPreHandshakeL();

    98 		DoWTLSConnectionPhaseOne(ETrue);

    99 		iHandshakeWasAnonymous = EFalse;

   100 		iState = EDoingWtlsPhase1;

   101 		} break;

   102 	case EDoingWtlsPhase1:

   103 		{

   104 		__LOG("--Running in state EDoingWtlsPhase1")

   105 		// Did phase 1 succeed?

   106 		TInt completionCode = iStatus.Int();

   107 		switch (completionCode)

   108 			{

   109 		case RWTLS::EHandshakeOk:

   110 			{

   111 			__LOG("--Phase 1 result is EHandshakeOK")

   112 			__LOG("--indicates that an anonymous handshake was performed.");

   113 			__LOG("--proceeding to check negotiated configuration")

   114 			// The handshake is fully complete after one phase.  Since we always initiate a 2-phase

   115 			// handshake, this indicates that anonymous key exchange suites were agreed.

   116 			// Note - it would seem sensible to do a phase 2 to complete the handshake, since we initiated

   117 			// it as 2 phase.  However doing so never works (ConnectPhase2() returns EErrGeneral). So we'll

   118 			// have to consider the handshake complete now.

   119 			

   120 			// Store 'was anonymous' flag for the next AO iteration, where we will check against the policy

   121 			// to ensure anonymous acceptable. 

   122 			iHandshakeWasAnonymous = ETrue;

   123 			iState = ECheckingNegotiated;

   124 			CompleteSelf();

   125 			} break;

   126 		case RWTLS::EServerCertificateValid:

   127 			{

   128 			__LOG("--Phase 1 result is EServerCertificateValid")

   129 			__LOG("--proceeding to do handshake phase 2")

   130 			// Note - this error code indicates that the server certificate is valid, and that it

   131 			// was verified by the WAP Stack against a root cert held on the device.  First get 

   132 			// the server certificate in case the client asks to see it and then move to phase 2.

   133 			__DEBUGTESTLEAVE

   134 			GetServerCertL();

   135 			DoWTLSConnectionPhaseTwo();

   136 			iState = EDoingWtlsPhase2;

   137 			} break;

   138         case RWTLS::EServerCertificateNotValid:

   139 			{

   140 			__LOG("--Phase 1 result is EServerCertificateNotValid")

   141 			// Note - this error code indicates that although all fields of the server certificate

   142 			// were valid, the WAP Stack couldn't verify the server identity against a root cert.

   143 			// For a 2-phase (authenticating) handshake, this means we present the cert to the user

   144 			// for verification

   145 			__LOG("--proceeding to check untrusted server certificate")

   146 			// Check the server cert before phase 2 of the handshake

   147 			iState = ECheckingServerCert;

   148 			__DEBUGTESTLEAVE

   149 			GetServerCertL();

   150 			ValidateUntrustedServerCertL();

   151 			} break;

   152 		case RWTLS::EHandshakeError:

   153 		case RWTLS::EHandshakeUserAbort:

   154 		case RWTLS::ECertificateRequested:

   155 			{

   156 #ifdef _DEBUG

   157 			if (completionCode == RWTLS::EHandshakeError)

   158 				{

   159 				__LOG("--Phase 1 result is EHandshakeError")

   160 				}

   161 			else if (completionCode == RWTLS::EHandshakeUserAbort)

   162 				{

   163 				__LOG("--Phase 1 result is EHandshakeUserAbort")

   164 				}

   165 			else

   166 				{

   167 				// Presumably this refers to a client cert? Not supported by this client if that's the case.

   168 				__LOG("--Phase 1 result is ECertificateRequested")

   169 				}

   170 #endif

   171 			// Cancel phase 1 - the connect could not be established

   172 			CancelWTLSConnectionPhaseOne();

   173 			User::Leave(KWtlsErrPhase1HandshakeFailed);

   174 			} break;

   175 		default:

   176 			{

   177 			__LOG1("--Phase 1 result is unknown (%d)", completionCode)

   178 			// Other error codes from completion of phase 1 connect

   179 			if (completionCode >= 0)

   180 				completionCode = KWtlsErrPhase1HandshakeFailed;

   181 			User::Leave(completionCode);

   182 			} break;

   183 			}

   184 		} break;

   185 	case ECheckingServerCert:

   186 		{

   187 		__LOG("--Running in state ECheckingServerCert")

   188 		// Was the server cert accepted? If not, leave

   189 		TInt completionCode = iStatus.Int();

   190 		__DEBUGTESTLEAVE

   191 		User::LeaveIfError(completionCode);

   192 

   193 		// Enter second phase of handshake

   194 		DoWTLSConnectionPhaseTwo();

   195 		iState = EDoingWtlsPhase2;

   196 		} break;

   197 	case EDoingWtlsPhase2:

   198 		{

   199 		__LOG("--Running in state EDoingWtlsPhase2")

   200 		// Did phase 2 succeed? If not, leave

   201 		TInt completionCode = iStatus.Int();

   202 		__DEBUGTESTLEAVE

   203 		if ( (completionCode != RWTLS::EHandshakeOk) &&

   204 			 (iHandshakeWasAnonymous && (completionCode != RWTLS::EErrGeneral) ) )

   205 			User::Leave( (completionCode > 0)?KWtlsErrPhase2HandshakeFailed:completionCode );

   206 

   207 		// Move straight on to check the negotiated values

   208 		iState = ECheckingNegotiated;

   209 		CompleteSelf();

   210 		} break;

   211 	case ECheckingNegotiated:

   212 		{

   213 		__LOG("--Running in state ECheckingNegotiated")

   214 		// Finalise the handshake by checking the negotiated settings

   215 		__DEBUGTESTLEAVE

   216 		DoWTLSConnectionPostHandshakeL();

   217 

   218 		// Authenticating handshake has completed successfully

   219 		iState = EReady;

   220 		CompleteSelf();

   221 		} break;

   222 	case EReady:

   223 		{

   224 		__LOG("--Running in state EReady")

   225 		// Can now complete the WSP session connection to the proxy

   226 		__DEBUGTESTLEAVE

   227 		CompleteProxyConnectionL();

   228 		} break;

   229 	default:

   230 		{

   231 		TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState);

   232 		} break;

   233 		}

   234 	}

   235 

   236 TInt CNwssWspSession::RunError(TInt aError)

   237 	{

   238 	__LOG1("--Handling WAP stack error code %d", aError)

   239 	switch (iState)

   240 		{

   241 	case EDisconnected:

   242 		{

   243 		// Failed to open the WSP session

   244 		DoRunError(aError);

   245 		} break;

   246 	case ESessionOpen:

   247 		{

   248 		DoRunError(KWtlsErrConfigurationFailed);

   249 		} break;

   250 	case EDoingWtlsPhase1:

   251 		{

   252 		// If error is KErrNotSupported then this is usually an error of insufficient crypto strength

   253 		__ASSERT_DEBUG(aError != KErrNotSupported,

   254 						TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInsufficientCryptoStrength));

   255 

   256 		// Only expect an 'invalid server certificate' or 'phase 1 handshake failed' error in this state

   257 		__ASSERT_DEBUG(aError == KWtlsErrInvalidServerCert || aError == KWtlsErrPhase1HandshakeFailed,

   258 						TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState));

   259 		DoRunError(aError);

   260 		} break;

   261 	case ECheckingServerCert:

   262 		{

   263 		// Only expect an 'invalid/untrusted server certificate' error in this state

   264 		__ASSERT_DEBUG(aError == KWtlsErrInvalidServerCert || aError == KWtlsErrUntrustedServerCert,

   265 						TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState));

   266 		DoRunError(aError);

   267 		} break;

   268 	case EDoingWtlsPhase2:

   269 		{

   270 		DoRunError(KWtlsErrPhase2HandshakeFailed);

   271 		} break;

   272 	case ECheckingNegotiated:

   273 		{

   274 		DoRunError(KWtlsErrNegotiatedConfigRejected);

   275 		} break;

   276 	case EReady:

   277 		{

   278 		DoRunError(aError);

   279 		} break;

   280 	default:

   281 		{

   282 		// State machine screw-up!

   283 		__ASSERT_DEBUG(ETrue, TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EInvalidState));

   284 		} break;

   285 		}

   286 

   287 	// State after handling an error returns to 'disconnected'

   288 	iState = EDisconnected;

   289 	return KErrNone;

   290 	}

   291 

   292 void CNwssWspSession::DoCancel()

   293 	{

   294 	// Some cancellations will return the state machine to EDisconnected

   295 	switch (iState)

   296 		{

   297 	case EDoingWtlsPhase1:

   298 		{

   299 		// Outstanding request is the phase 1 connect

   300 		CancelWTLSConnectionPhaseOne();

   301 		iState = EDisconnected;

   302 		} break;

   303 	case ECheckingServerCert:

   304 		{

   305 		// Cancel the validation

   306 		CancelValidateUntrustedServerCert();

   307 		iState = EDisconnected;

   308 		} break;

   309 	case EDoingWtlsPhase2:

   310 		{

   311 		// Outstanding request is the phase 2 connect

   312 		CancelWTLSConnectionPhaseTwo();

   313 		iState = EDisconnected;

   314 		} break;

   315 	case EReady:

   316 		{

   317 		// Defer to sub-class.  The SubDoCancel() returns a flag if it wishes to move the state machine

   318 		// back to 'disconnected'.

   319 		if ( SubDoCancel() )

   320 			iState = EDisconnected;

   321 		} break;

   322 	default:

   323 		{

   324 		// Other states do not require asynch request cancellation

   325 		} break;

   326 		}

   327 	}

   328 

   329 TBool CNwssWspSession::OpenWapProxyL()

   330 	{

   331 	// Get details of the desired WAP proxy from the client's connection info provider

   332 	MWspProxyInfoProvider& prov = iConnInfoProvider.ProxyInfoProvider();

   333 	const TDesC8& addr = prov.ProxyAddress();

   334 	__LOG1("--Proxy Address is '%S'", &addr)

   335 	TUint16 remPort = prov.RemotePort();

   336 	__LOG1("--Remote Port is %d", remPort)

   337 	TUint16 locPort = prov.LocalPort();

   338 	__LOG1("--Local Port is %d", locPort)

   339 	TWspBearer bearer = prov.Bearer();

   340 	const TDesC8& svcCentNum = prov.ServiceCentreNumber();

   341 	TWspSession sessSvc = prov.WspSessionService();

   342 	__LOG1("--WSP Session Type is %d (0 = CO, 1 = CL)", sessSvc)

   343 	TBool isSecure = prov.SecureConnection();

   344 	__LOG1("--Security is %d (0 = off, 1 = on)", isSecure)

   345 

   346 	// It is an error for ConnectReq() to be used when the proxy specifies a CL session!

   347 	__ASSERT_ALWAYS(sessSvc == EWspConnectionOriented,

   348 					TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EWrongSessionType));

   349 

   350 	// Need to supply different parameters, according to whether the bearer is IP or

   351 	// SMS

   352 	TInt error = KErrNone;

   353 	switch (bearer)

   354 		{

   355 		// scope enumerations to the global namespace since that's where they were

   356 		// defined in <wapcli.h>  :(

   357 	case ::EIP:

   358 		{

   359 		__LOG("--Bearer is IP")

   360 

   361 		// Open the WSP CO connection with the WAP stack, using IP bearer

   362 		error = OpenWspSession(addr, remPort, locPort, (TBearer)bearer, isSecure);	  

   363 		} break;

   364 	case ::EWAPSMS7:

   365 	case ::EWAPSMS:

   366 		{

   367 		__LOG("--Bearer is SMS")

   368 		__LOG1("--Service Centre Number is '%S'", &svcCentNum)

   369 

   370 		// Open the WSP CO connection with the WAP stack, using SMS bearer

   371 		error = OpenWspSession(svcCentNum, remPort, locPort, (TBearer)bearer, isSecure);	  

   372 		} break;

   373 	case ::ESMS7:

   374 	case ::ESMS:

   375 	case ::EAll:

   376 	default:

   377 		__ASSERT_DEBUG(ETrue, 

   378 					   TNwssWspTrHndPanic::Panic(TNwssWspTrHndPanic::EWrongBearerType));

   379 		}

   380 

   381 	__LOG1("--RWSPCOConn::Open() returned with %d", error)

   382 	__DEBUGTESTLEAVE

   383 	User::LeaveIfError(error);

   384 

   385 	// Return the secure flag, so the state machine can go on to make the WTLS

   386 	// handshake if appropriate, for secure proxies

   387 	return isSecure;

   388 	}

   389 

   390 void CNwssWspSession::MapToPanic(TInt aErrorCode) const

   391 	{

   392 	// Error handling is severe, since all WSP state management is expected to be done

   393 	// in the client.

   394 	TNwssWspTrHndPanic::TNwssWspTrHndPanicCode panic;

   395 	switch (aErrorCode)

   396 		{

   397 		case RWAPConn::EBearerError:

   398 			panic = TNwssWspTrHndPanic::EBearerError;

   399 			break;

   400 		case RWAPConn::EPortAlreadyBound:

   401 			panic = TNwssWspTrHndPanic::EPortAlreadyBound;

   402 			break;

   403 		case RWAPConn::ECannotOpenPort:

   404 			panic = TNwssWspTrHndPanic::ECannotOpenPort;

   405 			break;

   406 		case RWAPConn::ETooManyConnections:

   407 			panic = TNwssWspTrHndPanic::ETooManyConnections;

   408 			break;

   409 		case RWAPConn::EBadConnection:

   410 			panic = TNwssWspTrHndPanic::EBadConnection;

   411 			break;

   412 		case RWAPConn::EBufferTooSmall:

   413 			panic = TNwssWspTrHndPanic::EBufferTooSmall;

   414 			break;

   415 		case RWSPCOConn::EBufferTooSmall:

   416 			panic = TNwssWspTrHndPanic::EBufferTooSmall;

   417 			break;

   418 		case RWSPCOConn::EInvalidSession:

   419 			panic = TNwssWspTrHndPanic::EInvalidSession;

   420 			break;

   421 		case RWSPCOConn::EInvalidTransaction:

   422 			panic = TNwssWspTrHndPanic::EInvalidTransaction;

   423 			break;

   424 		case RWSPCOConn::EParameterError:

   425 			panic = TNwssWspTrHndPanic::EParameterError;

   426 			break;

   427 		case RWSPCOConn::ESessionNotConnected:

   428 			panic = TNwssWspTrHndPanic::ESessionNotConnected;

   429 			break;

   430 		case RWSPCOConn::ENotSupported:

   431 			panic = TNwssWspTrHndPanic::ENotSupported;

   432 			break;

   433 		case RWSPCOConn::EInvalidState:

   434 			panic = TNwssWspTrHndPanic::EInvalidState;

   435 			break;

   436 		case RWSPCOConn::ESessionClosed:

   437 			panic = TNwssWspTrHndPanic::ESessionClosed;

   438 			break;

   439 		case RWSPCOConn::EMRUExceeded:

   440 			panic = TNwssWspTrHndPanic::EMRUExceeded;

   441 			break;

   442 		case RWSPCOConn::EInvalidBufferSize:

   443 			panic = TNwssWspTrHndPanic::EInvalidBufferSize;

   444 			break;

   445 		case RWSPCOConn::EDataNotAvailable:

   446 			panic = TNwssWspTrHndPanic::EDataNotAvailable;

   447 			break;

   448 		case RWSPCOConn::EErrorTimeout:

   449 			panic = TNwssWspTrHndPanic::EErrorTimeout;

   450 			break;

   451 

   452 

   453 	default:

   454 		panic = TNwssWspTrHndPanic::EUnknownPanic;

   455 		}

   456 	TNwssWspTrHndPanic::Panic(panic);

   457 	}

   458 

   459 void CNwssWspSession::CompleteSelf()

   460 	{

   461 	if (!IsActive())

   462 		{

   463 		TRequestStatus* pStat = &iStatus;

   464 		User::RequestComplete(pStat, KErrNone);

   465 		SetActive();

   466 		}

   467 	}

   468 

   469 

   470 void CNwssWspSession::DoWTLSConnectionPreHandshakeL()

   471 	{

   472 	// Set the Key Exchange Suites. There might be several desired cipher suites, so

   473 	// they are returned as an array

   474 	const RArray<TWtlsKeyExchangeSuite>& keyExchSuites = 

   475 		iSecurityPolicy.GetWtlsKeyExchangeSuites();

   476 	TInt idx = 0;

   477 	const TInt numKeyExchSuites = keyExchSuites.Count();

   478 	RWTLS::TKeyExchangeSuite stackSuite;

   479 	RWTLS::TIdType stackIdType;

   480 	for (idx = 0; idx < numKeyExchSuites; ++idx)

   481 		{

   482 		// Get the next suite, convert and set

   483 		TWtlsKeyExchangeSuite suite = keyExchSuites[idx];

   484 		stackSuite = (RWTLS::TKeyExchangeSuite)suite.iKeyExchangeSuite;

   485 		stackIdType = (RWTLS::TIdType)suite.iKeyIdType;

   486 #ifdef _DEBUG

   487 		DumpKeyExchangeSuite(stackSuite, stackIdType, ETrue);

   488 #endif

   489 		__TESTOOMD(stkErr, WtlsHnd().SetKeyExchangeSuite(stackSuite, stackIdType, suite.iKeyId));

   490 		if (stkErr < 0)

   491 			{

   492 			__LOG1("--RWTLS::SetKeyExchangeSuite returned %d", stkErr);

   493 			__LOG1("--Offensive key ex suite is %d", suite.iKeyExchangeSuite);

   494 			User::Leave(stkErr);

   495 			}

   496 		}

   497 

   498 	// Set the Cipher Suites. There might be several desired cipher suites, so

   499 	// they are returned as an array

   500 	const RArray<TWtlsCipherSuite>& cipherSuites =

   501 		iSecurityPolicy.GetWtlsCipherSuites();

   502 	const TInt numCipherSuites = cipherSuites.Count();

   503 	if(numCipherSuites>0)

   504 		{

   505 		// Make an array to pass in to RWTLS::SetCipherSuites

   506 		RWTLS::CipherSuiteArray* stackSuites =

   507 						new (ELeave) RWTLS::CipherSuiteArray(numCipherSuites);

   508 		CleanupStack::PushL(stackSuites);

   509 		for (idx = 0; idx < numCipherSuites; ++idx)

   510 			{

   511 			// Get the next suite, convert and append to the stack array

   512 			TWtlsCipherSuite suite = cipherSuites[idx];

   513 			RWTLS::TCipherSuite stackSuite;

   514 			stackSuite.iBulkEncryptionAlgorithm =

   515 				(RWTLS::TBulkEncryptionAlgorithm)suite.iBulkEncryptionAlgorithm;

   516 			stackSuite.iMacAlgorithm =

   517 				(RWTLS::TMacAlgorithm)suite.iMacAlgorithm;

   518 #ifdef _DEBUG

   519 			DumpCipherSuite(stackSuite, ETrue);

   520 #endif

   521 			stackSuites->AppendL(stackSuite);

   522 			}

   523 		__TESTOOMD(stkErr, WtlsHnd().SetCipherSuites(*stackSuites));

   524 		if (stkErr < 0)

   525 			{

   526 			__LOG1("--RWTLS::SetCipherSuites returned %d", stkErr);

   527 			User::Leave(stkErr);

   528 			}

   529 

   530 		CleanupStack::PopAndDestroy(stackSuites);

   531 		}

   532 

   533 	// Set the Sequence Number Mode.

   534 	RString  seqNumModeValStr;

   535 	RString seqNumModePropName =

   536 		iStringPool.String(SecurityPolicyProperties::ESequenceNumberMode,

   537 							SecurityPolicyProperties::Table);

   538 

   539 	RStringF seqNumName = iStringPool.OpenFStringL(seqNumModePropName.DesC());

   540 	CleanupClosePushL(seqNumName);

   541 

   542 	TInt policyErr = iSecurityPolicy.GetNamedPolicyProperty(seqNumName,

   543 															seqNumModeValStr);

   544 	CleanupClosePushL(seqNumModeValStr);

   545 

   546 	if (policyErr == KErrNone)

   547 		{

   548 		RWTLS::TSequenceNumberMode stackMode;

   549 		switch (seqNumModeValStr.Index(SecurityPolicyProperties::Table))

   550 			{

   551 			case SecurityPolicyProperties::EImplicit:

   552 				stackMode = RWTLS::EImplicit;

   553 				break;

   554 			case SecurityPolicyProperties::EExplicit:

   555 				stackMode = RWTLS::EExplicit;

   556 				break;

   557 			case SecurityPolicyProperties::ENotUsed:

   558 			default:

   559 				stackMode = RWTLS::ENotUsed;

   560 				break;

   561 			}		

   562 #ifdef _DEBUG

   563 			DumpSequenceNumberMode(stackMode, ETrue);

   564 #endif

   565 		__TESTOOMD(stkErr, WtlsHnd().SetSequenceNumberMode(stackMode));

   566 		if (stkErr < 0)

   567 			{

   568 			__LOG1("--RWTLS::SetSequenceNumberMode returned %d", stkErr);

   569 			User::Leave(stkErr);

   570 			}

   571 		}

   572 	CleanupStack::PopAndDestroy(2); // seqNumName, seqNumModeValStr

   573 

   574 

   575 	// Set the Key Refresh Rate.

   576 	RString  keyRefreshRateValStr;

   577 

   578 	RString keyRefreshRatePropName =

   579 		iStringPool.String(SecurityPolicyProperties::EKeyRefreshRate,

   580 							SecurityPolicyProperties::Table);

   581 

   582 	RStringF refreshRateName = iStringPool.OpenFStringL(keyRefreshRatePropName.DesC());

   583 	CleanupClosePushL(refreshRateName);

   584 

   585 	policyErr = iSecurityPolicy.GetNamedPolicyProperty(refreshRateName,

   586 													   keyRefreshRateValStr);

   587 	CleanupClosePushL(keyRefreshRateValStr);

   588 

   589 	if (policyErr == KErrNone)

   590 		{

   591 		TUint8 stackKRR = 0;

   592 		TLex8 lexer(keyRefreshRateValStr.DesC());

   593 		User::LeaveIfError( lexer.Val(stackKRR, EDecimal) );

   594 #ifdef _DEBUG

   595 		DumpKeyRefreshRate(stackKRR, ETrue);

   596 #endif

   597 		__TESTOOMD(stkErr, WtlsHnd().SetKeyRefreshRate(stackKRR));

   598 		if (stkErr < 0)

   599 			{

   600 			__LOG1("--RWTLS::SetKeyRefreshRate returned %d", stkErr);

   601 			User::Leave(stkErr);

   602 			}

   603 		}

   604 	CleanupStack::PopAndDestroy(2); // refreshRateName, keyRefreshRateValStr

   605 

   606 

   607 	// Set the Shared Secret

   608 	RString  sharedSecretValStr;

   609 

   610 	RString sharedSecretPropName =

   611 		iStringPool.String(SecurityPolicyProperties::ESharedSecret,

   612 							SecurityPolicyProperties::Table);

   613 

   614 	RStringF sharedSecretName = iStringPool.OpenFStringL(sharedSecretPropName.DesC());

   615 	CleanupClosePushL(sharedSecretName);

   616 

   617 	policyErr = iSecurityPolicy.GetNamedPolicyProperty(sharedSecretName,

   618 													   sharedSecretValStr);

   619 	CleanupClosePushL(sharedSecretValStr);

   620 

   621 	if (policyErr == KErrNone)

   622 		{

   623 		const TDesC8& stackSS = sharedSecretValStr.DesC();

   624 #ifdef _DEBUG

   625 		DumpSharedSecret(stackSS);

   626 #endif

   627 		__TESTOOMD(stkErr, WtlsHnd().SetSharedSecret(stackSS));

   628 		if (stkErr < 0)

   629 			{

   630 			__LOG1("--RWTLS::SetSharedSecret returned %d", stkErr);

   631 			User::Leave(stkErr);

   632 			}

   633 		}

   634 	CleanupStack::PopAndDestroy(2); // sharedSecretName, sharedSecretValStr

   635 

   636 

   637 	// Set the Record Length Usage.

   638 	RString  recordLengthUsageValStr;

   639 

   640 	RString recordLengthUsagePropName =

   641 		iStringPool.String(SecurityPolicyProperties::ERecordLengthUsage,

   642 							SecurityPolicyProperties::Table);

   643 

   644 	RStringF recLenUsageName = iStringPool.OpenFStringL(recordLengthUsagePropName.DesC());

   645 	CleanupClosePushL(recLenUsageName);

   646 

   647 	policyErr = iSecurityPolicy.GetNamedPolicyProperty(recLenUsageName,

   648 													   recordLengthUsageValStr);

   649 	CleanupClosePushL(recordLengthUsageValStr);

   650 

   651 	if (policyErr == KErrNone)

   652 		{

   653 		TBool stackRLU = EFalse;

   654 		switch (recordLengthUsageValStr.Index(SecurityPolicyProperties::Table))

   655 			{

   656 			case SecurityPolicyProperties::EUsed:

   657 				stackRLU = ETrue;

   658 				break;

   659 			case SecurityPolicyProperties::ENotUsed:

   660 			default:

   661 				stackRLU = EFalse;

   662 				break;

   663 			}

   664 #ifdef _DEBUG

   665 		DumpRecordLengthUsage(stackRLU, ETrue);

   666 #endif

   667 		__TESTOOMD(stkErr, WtlsHnd().SetRecordLengthUsage(stackRLU));

   668 		if (stkErr < 0)

   669 			{

   670 			__LOG1("--RWTLS::SetRecordLengthUsage returned %d", stkErr);

   671 			User::Leave(stkErr);

   672 			}

   673 		}

   674 	CleanupStack::PopAndDestroy(2); // recLenUsageName, recordLengthUsageValStr

   675 	}

   676 

   677 

   678 void CNwssWspSession::DoWTLSConnectionPhaseOne(TBool aTwoPhaseHandshake)

   679 	{

   680 	WtlsHnd().Connect(iStatus, aTwoPhaseHandshake);

   681 	SetActive();

   682 	__LOG1("--WTLS::Connect(phase 1 of %d)", (aTwoPhaseHandshake?2:1));

   683 	}

   684 

   685 

   686 void CNwssWspSession::CancelWTLSConnectionPhaseOne()

   687 	{

   688 	WtlsHnd().CancelConnect();

   689 	__LOG("--WTLS - CancelConnect() phase 1");

   690 	}

   691 

   692 

   693 void CNwssWspSession::ValidateUntrustedServerCertL()

   694 	{

   695 	// Make request of security policy plugin for validation

   696 	iSecurityPolicy.ValidateUntrustedServerCert(iServerCert, iStatus);

   697 	SetActive();

   698 	}

   699 

   700 void CNwssWspSession::GetServerCertL()

   701 	{

   702 	iServerCertValid = EFalse;

   703 	// Create space for subject, issuer and fingerprint fields in cert info

   704 	TBuf8<KWtlsMaxFieldSize> subject;

   705 	TBuf8<KWtlsMaxFieldSize> issuer;

   706 	TBuf8<KWtlsMaxFieldSize> fingerprint;

   707 

   708 	RCertificate::TInfo wtlsCertInfo;

   709 #ifdef _DEBUG

   710 	// shut up some WINS UDEB compiler warnings...

   711 	wtlsCertInfo.iValidNotBefore = 0;

   712 	wtlsCertInfo.iValidNotAfter = 0;

   713 	wtlsCertInfo.iSubjectCharacterSet = 0;

   714 	wtlsCertInfo.iIssuerCharacterSet = 0;

   715 	wtlsCertInfo.iServerCertificateStatus = RCertificate::EOk;

   716 #endif

   717 	wtlsCertInfo.iSubject		= &subject;

   718 	wtlsCertInfo.iIssuer		= &issuer;

   719 	wtlsCertInfo.iFingerPrint	= &fingerprint;

   720 

   721 	// Get the certificate from the WAP stack

   722 	RCertificate wtlsCert = WtlsHnd().ServerCert();

   723 	__TESTOOMD(stkErr, wtlsCert.Info(wtlsCertInfo));

   724 	if (stkErr != KErrNone)

   725 		User::Leave(KWtlsErrInvalidServerCert);

   726 

   727 	// Convert to a form accepted by the security policy plugin

   728  	_LIT(KUnixEpochStart,"19700000:000000.000000");

   729 

   730 	// Start date

   731 	TTime startTime(KUnixEpochStart);

   732 	TTimeIntervalSeconds addTime = wtlsCertInfo.iValidNotBefore;

   733 	iServerCert.iStartValDate = startTime + addTime;

   734 

   735 	// End date

   736 	TTime endTime(KUnixEpochStart);

   737 	addTime = wtlsCertInfo.iValidNotAfter;

   738 	iServerCert.iEndValDate = endTime + addTime;

   739 

   740 	// Subject. Ignore the character set from the WTLS cert - it should be UTF-8

   741 	TInt len = Min((wtlsCertInfo.iSubject)->Length(),

   742 				   iServerCert.iSubjectDNInfo.iCommonName.MaxLength());

   743 	iServerCert.iSubjectDNInfo.iCommonName.Copy((wtlsCertInfo.iSubject)->Left(len));

   744 

   745 	// Issuer. Ignore the character set from the WTLS cert - it should be UTF-8

   746 	len = Min((wtlsCertInfo.iIssuer)->Length(),

   747 				   iServerCert.iIssuerDNInfo.iCommonName.MaxLength());

   748 	iServerCert.iIssuerDNInfo.iCommonName.Copy((wtlsCertInfo.iIssuer)->Left(len));

   749 

   750 	// Ignore server certificate status - no field exists for it in TCertInfo

   751 

   752 	// Fingerprint

   753 	len = Min((wtlsCertInfo.iFingerPrint)->Length(), iServerCert.iFingerprint.MaxLength());

   754 	iServerCert.iFingerprint.Copy((wtlsCertInfo.iFingerPrint)->Left(len));

   755 

   756 	// We have a complete TCertInfo

   757 	iServerCertValid = ETrue;

   758 

   759 	// Log certificate data

   760 	__LOG("--Server Certificate:");

   761 	__LOG("-----------------------------------");

   762 	__LOG1("--Subject:     %S", wtlsCertInfo.iSubject);

   763 	__LOG1("--Issuer:      %S", wtlsCertInfo.iIssuer);

   764 	__LOG1("--Fingerprint: %S", wtlsCertInfo.iFingerPrint);

   765 #ifdef _DEBUG

   766 	_LIT(KDateFormat,"%D%M%Y%/0%1%/1%2%/2%3%/3 %:0%H%:1%T%:2%S.%C%:3");

   767 	TBuf<40> dateTimeString;

   768 	TBuf8<40> dateTimeString8;

   769 	__DEBUGTESTLEAVE

   770 	iServerCert.iStartValDate.FormatL(dateTimeString, KDateFormat);

   771 	dateTimeString8.Copy(dateTimeString);

   772 	__LOG1("--Start Date:  %S", &dateTimeString8);

   773 	__DEBUGTESTLEAVE

   774 	iServerCert.iEndValDate.FormatL(dateTimeString, KDateFormat);

   775 	dateTimeString8.Copy(dateTimeString);

   776 	__LOG1("--Start Date:  %S", &dateTimeString8);

   777 #endif

   778 	__LOG("-----------------------------------");

   779 	}

   780 

   781 void CNwssWspSession::CancelValidateUntrustedServerCert()

   782 	{

   783 	iSecurityPolicy.CancelValidateUntrustedServerCert();

   784 	}

   785 

   786 void CNwssWspSession::DoWTLSConnectionPhaseTwo()

   787 	{

   788 	WtlsHnd().ConnectPhaseTwo(iStatus);

   789 	SetActive();

   790 	__LOG("--WTLS::Connect(phase 2 of 2)");

   791 	}

   792 

   793 

   794 void CNwssWspSession::CancelWTLSConnectionPhaseTwo()

   795 	{

   796 	WtlsHnd().CancelConnectPhaseTwo();

   797 	__LOG("--WTLS - CancelConnect() phase 2");

   798 	}

   799 

   800 

   801 void CNwssWspSession::DoWTLSConnectionPostHandshakeL()

   802 	{

   803 	TInt stkErr = KErrNone;

   804 	// Dump the negotiated cipher suite and sequence number mode (debug only)

   805 #ifdef _DEBUG

   806 	// Find out which cipher suite was negotiated

   807 	RWTLS::TCipherSuite cipherSuite;

   808 

   809 	// shut up some WINS UDEB compiler warnings

   810 	cipherSuite.iBulkEncryptionAlgorithm = RWTLS::EBulkNull;

   811 	cipherSuite.iMacAlgorithm = RWTLS::ESha_0;

   812 	__TESTOOM(stkErr, WtlsHnd().GetCipherSuite(cipherSuite));

   813 	if (stkErr)

   814 		{

   815 		__LOG1("--RWTLS::GetCipherSuite() returned %d", stkErr);

   816 		}

   817 	else

   818 		DumpCipherSuite(cipherSuite, EFalse);

   819 

   820 	// Find out which sequence number mode was negotiated

   821 	RWTLS::TSequenceNumberMode mode = RWTLS::ENotUsed;

   822 	__TESTOOM(stkErr, WtlsHnd().GetSequenceNumberMode(mode));

   823 	if (stkErr)

   824 		{

   825 		__LOG1("--RWTLS::GetSequenceNumberMode() returned %d", stkErr);

   826 		}

   827 	else

   828 		DumpSequenceNumberMode(mode, EFalse);

   829 #endif

   830 

   831 	// Find out which key exchange suite was negotiated

   832 	RWTLS::TKeyExchangeSuite keyExchSuite(RWTLS::ESharedSecret);

   833 	__TESTOOM(stkErr, WtlsHnd().GetKeyExchangeSuite(keyExchSuite));

   834 	if (stkErr == KErrNone)

   835 		{

   836 #ifdef _DEBUG

   837 		// Dump the negotiated key exch suite (debug only)

   838 		DumpKeyExchangeSuite(keyExchSuite, (RWTLS::TIdType)KErrNotFound, EFalse);

   839 #endif

   840 

   841 		// Figure out if we got an anonymous one or not.  Note, this is

   842 		// authoritative, so overwrite any flag set earlier.

   843 		switch (keyExchSuite)

   844 			{

   845 			case RWTLS::EDHAnon:

   846 			case RWTLS::EDHAnon512:

   847 			case RWTLS::EDHAnon768:

   848 			case RWTLS::ERsaAnon:

   849 			case RWTLS::ERsaAnon512:

   850 			case RWTLS::ERsaAnon768:

   851 			case RWTLS::EEcdhAnon:

   852 			case RWTLS::EEcdhAnon113:

   853 			case RWTLS::EEcdhAnon131:

   854 				iHandshakeWasAnonymous = ETrue;

   855 			default:

   856 				iHandshakeWasAnonymous = EFalse;

   857 				break;

   858 			}

   859 		}

   860 #ifdef _DEBUG

   861 	else

   862 		{

   863 		__LOG1("--RWTLS::GetKeyExchangeSuite() returned %d", stkErr);

   864 		}

   865 #endif

   866 

   867 	// If it's anonymous, and anonymous is not allowed, then reject now.

   868 	__DEBUGTESTLEAVE

   869 	if (iHandshakeWasAnonymous && !AnonymousAuthenticationAllowedL())

   870 		User::Leave(KWtlsErrNegotiatedConfigRejected);

   871 	}

   872 

   873 

   874 TBool CNwssWspSession::AnonymousAuthenticationAllowedL()

   875 	{

   876 	RString  anonAllowedValStr;

   877 	RString anonAllowedPropName =

   878 		iStringPool.String(SecurityPolicyProperties::EAnonymousAllowed,

   879 							SecurityPolicyProperties::Table);

   880 

   881 	__DEBUGTESTLEAVE

   882 	RStringF anonAllowName = iStringPool.OpenFStringL(anonAllowedPropName.DesC());

   883 

   884 	TInt policyErr = iSecurityPolicy.GetNamedPolicyProperty(anonAllowName,

   885 															anonAllowedValStr);

   886 	TBool retVal = ( (policyErr == KErrNone) &&

   887 					 (anonAllowedValStr == iStringPool.String(SecurityPolicyProperties::EAllowed,

   888 							SecurityPolicyProperties::Table) ) );

   889 

   890 	anonAllowedValStr.Close();

   891 	anonAllowName.Close();

   892 	return retVal;

   893 	}

   894 

   895 TInt CNwssWspSession::ServerCert(TCertInfo& aCertInfo)

   896 	{

   897 	TInt retVal = KErrNotSupported;

   898 	switch(iState)

   899 		{

   900 		case EDisconnected:

   901 		case ESessionOpen:

   902 		case EDoingWtlsPhase1:

   903 			retVal = KErrNotReady;

   904 			break;

   905 		case ECheckingServerCert:

   906 		case EDoingWtlsPhase2:

   907 		case ECheckingNegotiated:

   908 		case EReady:

   909 			if(iServerCertValid)

   910 				{

   911 				retVal = KErrNone;

   912 				aCertInfo = iServerCert;

   913 				}

   914 			break;

   915 		default:

   916 			break;

   917 		}

   918 

   919 	return retVal;

   920 	}

   921 

   922 #ifdef _DEBUG

   923 

   924 void CNwssWspSession::DumpCipherSuite(RWTLS::TCipherSuite aCipherSuite, TBool aRequested)

   925 	{

   926 	TBuf8<100> msg;

   927 	if (aRequested)

   928 		{

   929 		_LIT8(KCipherSuiteMsg, "--Requested cipher suite is: (");

   930 		msg.Append(KCipherSuiteMsg());

   931 		}

   932 	else

   933 		{

   934 		_LIT8(KCipherSuiteMsg, "--Negotiated cipher suite is: (");

   935 		msg.Append(KCipherSuiteMsg());

   936 		}

   937 	switch (aCipherSuite.iBulkEncryptionAlgorithm)

   938 		{

   939 		case RWTLS::EBulkNull:

   940 			msg.Append(_L("EBulkNull,"));

   941 			break;

   942 		case RWTLS::ERc5_cbc_40:

   943 			msg.Append(_L("ERc5_cbc_40,"));

   944 			break;

   945 		case RWTLS::ERc5_cbc_56:

   946 			msg.Append(_L("ERc5_cbc_56,"));

   947 			break;

   948 		case RWTLS::ERc5_cbc:

   949 			msg.Append(_L("ERc5_cbc,"));

   950 			break;

   951 		case RWTLS::EDes_cbc_40:

   952 			msg.Append(_L("EDes_cbc_40,"));

   953 			break;

   954 		case RWTLS::EDes_cbc:

   955 			msg.Append(_L("EDes_cbc,"));

   956 			break;

   957 		case RWTLS::E3Des_cbc_ede:

   958 			msg.Append(_L("E3Des_cbc_ede,"));

   959 			break;

   960 		case RWTLS::EIdea_cbc_40:

   961 			msg.Append(_L("EIdea_cbc_40,"));

   962 			break;

   963 		case RWTLS::EIdea_cbc_56:

   964 			msg.Append(_L("EIdea_cbc_56,"));

   965 			break;

   966 		case RWTLS::EIdea_cbc:

   967 			msg.Append(_L("EIdea_cbc,"));

   968 			break;

   969 		default:

   970 			msg.Append(_L("<Unknown bulk alg>,"));

   971 			break;

   972 		}

   973 	switch (aCipherSuite.iMacAlgorithm)

   974 		{

   975 		case RWTLS::ESha_0:

   976 			msg.Append(_L("ESha_0)"));

   977 			break;

   978 		case RWTLS::ESha_40:

   979 			msg.Append(_L("ESha_40)"));

   980 			break;

   981 		case RWTLS::ESha_80:

   982 			msg.Append(_L("ESha_80)"));

   983 			break;

   984 		case RWTLS::ESha:

   985 			msg.Append(_L("ESha)"));

   986 			break;

   987 		case RWTLS::ESha_xor_40:

   988 			msg.Append(_L("ESha_xor_40)"));

   989 			break;

   990 		case RWTLS::EMd5_40:

   991 			msg.Append(_L("EMd5_40)"));

   992 			break;

   993 		case RWTLS::EMd5_80:

   994 			msg.Append(_L("EMd5_40)"));

   995 			break;

   996 		case RWTLS::EMd5:

   997 			msg.Append(_L("EMd5)"));

   998 			break;

   999 		default:

  1000 			msg.Append(_L("<Unknown mac alg>)"));

  1001 			break;

  1002 		}

  1003 	__LOG1("%S", &msg);

  1004 	}

  1005 

  1006 void CNwssWspSession::DumpKeyExchangeSuite(RWTLS::TKeyExchangeSuite aKeyExchSuite, RWTLS::TIdType aStackIdType, TBool aRequested)

  1007 	{

  1008 	TBuf8<100> msg;

  1009 	if (aRequested)

  1010 		{

  1011 		_LIT8(KKeyExchSuiteMsg, "--Requested key exchange suite is: ");

  1012 		msg.Append(KKeyExchSuiteMsg());

  1013 		}

  1014 	else

  1015 		{

  1016 		_LIT8(KKeyExchSuiteMsg, "--Negotiated key exchange suite is: ");

  1017 		msg.Append(KKeyExchSuiteMsg());

  1018 		}

  1019 	switch (aKeyExchSuite)

  1020 		{

  1021 		case RWTLS::ESharedSecret:

  1022 			msg.Append(_L("(ESharedSecret,"));

  1023 			break;

  1024 		case RWTLS::EDHAnon:

  1025 			msg.Append(_L("(EDHAnon,"));

  1026 			break;

  1027 		case RWTLS::EDHAnon512:

  1028 			msg.Append(_L("(EDHAnon512,"));

  1029 			break;

  1030 		case RWTLS::EDHAnon768:

  1031 			msg.Append(_L("(EDHAnon768,"));

  1032 			break;

  1033 		case RWTLS::ERsaAnon:

  1034 			msg.Append(_L("(ERsaAnon,"));

  1035 			break;

  1036 		case RWTLS::ERsaAnon512:

  1037 			msg.Append(_L("(ERsaAnon512,"));

  1038 			break;

  1039 		case RWTLS::ERsaAnon768:

  1040 			msg.Append(_L("(ERsaAnon768,"));

  1041 			break;

  1042 		case RWTLS::ERsa:

  1043 			msg.Append(_L("(ERsa,"));

  1044 			break;

  1045 		case RWTLS::ERsa512:

  1046 			msg.Append(_L("(ERsa512,"));

  1047 			break;

  1048 		case RWTLS::ERsa768:

  1049 			msg.Append(_L("(ERsa768,"));

  1050 			break;

  1051 		case RWTLS::EEcdhAnon:

  1052 			msg.Append(_L("(EEcdhAnon,"));

  1053 			break;

  1054 		case RWTLS::EEcdhAnon113:

  1055 			msg.Append(_L("(EEcdhAnon113,"));

  1056 			break;

  1057 		case RWTLS::EEcdhAnon131:

  1058 			msg.Append(_L("(EEcdhAnon131,"));

  1059 			break;

  1060 		case RWTLS::EEcdhEcdsa:

  1061 			msg.Append(_L("(EEcdhEcdsa,"));

  1062 			break;

  1063 		default:

  1064 			msg.Append(_L("(<Unknown key exchange suite>,"));

  1065 			break;

  1066 		}

  1067 		switch (aStackIdType)

  1068 		{

  1069 		case RWTLS::EIdNull:

  1070 			msg.Append(_L("EIdNull)"));

  1071 			break;

  1072 		case RWTLS::EText:

  1073 			msg.Append(_L("EText)"));

  1074 			break;

  1075 		case RWTLS::EBinary:

  1076 			msg.Append(_L("EBinary)"));

  1077 			break;

  1078 		case RWTLS::EKeyHashSha:

  1079 			msg.Append(_L("EKeyHashSha)"));

  1080 			break;

  1081 		case RWTLS::EX509Name:

  1082 			msg.Append(_L("EX509Name)"));

  1083 			break;

  1084 		default:

  1085 			msg.Append(_L("<Unknown ID type>)"));

  1086 			break;

  1087 		}

  1088 	__LOG1("%S", &msg);

  1089 	}

  1090 

  1091 

  1092 void CNwssWspSession::DumpSequenceNumberMode(RWTLS::TSequenceNumberMode aSeqNumMode, TBool aRequested)

  1093 	{

  1094 	TBuf8<100> msg;

  1095 	if (aRequested)

  1096 		{

  1097 		_LIT8(KSeqNumModeMsg, "--Requested sequence number mode is: ");

  1098 		msg.Append(KSeqNumModeMsg());

  1099 		}

  1100 	else

  1101 		{

  1102 		_LIT8(KSeqNumModeMsg, "--Negotiated sequence number mode is: ");

  1103 		msg.Append(KSeqNumModeMsg());

  1104 		}

  1105 	switch (aSeqNumMode)

  1106 		{

  1107 		case RWTLS::ENotUsed: 

  1108 			msg.Append(_L("ENotUsed"));

  1109 			break;

  1110 		case RWTLS::EImplicit:

  1111 			msg.Append(_L("EImplicit"));

  1112 			break;

  1113 		case RWTLS::EExplicit:

  1114 			msg.Append(_L("EExplicit"));

  1115 			break;

  1116 		default:

  1117 			msg.Append(_L("<Unknown>"));

  1118 			break;

  1119 		}

  1120 	__LOG1("%S", &msg);

  1121 	}

  1122 

  1123 void CNwssWspSession::DumpKeyRefreshRate(TUint8 aKeyRefreshRate, TBool aRequested)

  1124 	{

  1125 	_LIT8(KReqKeyRefRateMsg, "--Requested key refresh rate is: %d");

  1126 	_LIT8(KNegKeyRefRateMsg, "--Negotiated key refresh rate is: %d");

  1127 	TBuf8<100> msg;

  1128 	if (aRequested)

  1129 		{

  1130 		msg.Format(KReqKeyRefRateMsg(), aKeyRefreshRate);

  1131 		}

  1132 	else

  1133 		{

  1134 		msg.Format(KNegKeyRefRateMsg(), aKeyRefreshRate);

  1135 		}