/*

* Copyright (c) 2005-2010 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:   IKEv1/IPSEC SA negotiation 

*

*/

#include <x509cert.h>

#include <x500dn.h>

#include <random.h>

#include <vpnlogmessages.rsg>

#include "ikev1negotiation.h"

#include "ikedebug.h"

#include "ikev1isakmpstream.h"

#include "ikev1timeout.h"

#include "ikev1payload.h"

#include "ikev1plugin.h"

#include "ikev1crack.h"

#include "ikev1trans.h"

#include "ipsecsadata.h"

#include "ipsecsalifetime.h"

#include "pfkeymsg.h"

#include "kmdapi.h"

#include "ikev1pkiservice.h"

#include "ikev1crypto.h"

#include "ikev1natdiscovery.h"

#include "ikev1private.h"

#include "vpnapidefs.h"

#include "ikepkiutils.h"

#include "vpnclientuids.h"

#include "ikecalist.h"

#include "ikecaelem.h"

#include "ikecert.h"

#include "ikev1pluginsession.h"

#include "ikesocketdefs.h"

#include "kmdeventloggerif.h"

#include "pfkeyextdatautil.h"

#include "ipsecsalist.h"

const TInt KSubjectName              = 1;

/////////////////////////////////////////////////////////////////////////////////

// CIkev1Negotiation related stuff

/////////////////////////////////////////////////////////////////////////////////

//

//Proto negotiation to send a informational payload and be destroyed

//

CIkev1Negotiation* CIkev1Negotiation::NewL( CIkev1PluginSession* aPluginSession,

                                            CPFKeySocketIf& aPFKeySocketIf,

                                            MIkeDebug& aDebug,

                                            const TInetAddr& aRemote,

                                            const TCookie& aInitiator,

                                            const TCookie& aResponder )

    {   	

	CIkev1Negotiation* self = new ( ELeave ) CIkev1Negotiation( aPluginSession,

                                                                aPFKeySocketIf,

                                                                aDebug );

	CleanupStack::PushL( self );

	self->iRemoteAddr = aRemote;

	self->iCookie_I = aInitiator;

	self->iCookie_R = aResponder;     

	self->iExchange = ISAKMP_EXCHANGE_INFO;   

	self->iDOI = IPSEC_DOI;

	self->iTimer = CIkev1Timeout::NewL( *self );	

	CleanupStack::Pop( self );	

	return self;

    }

CIkev1Negotiation* CIkev1Negotiation::NewL( CIkev1PluginSession* aPluginSession,

                                            CPFKeySocketIf& aPFKeySocketIf,

                                            MIkeDebug& aDebug,

                                            const TInetAddr& aRemote,

                                            const TCookie& aInitiator,

                                            TBool aAutoLogin ) 

    {

	CIkev1Negotiation* self = new ( ELeave ) CIkev1Negotiation( aPluginSession,

                                                                aPFKeySocketIf,

	                                                            aDebug,

	                                                            aRemote,

	                                                            aInitiator );

	CleanupStack::PushL( self );

    self->ConstructL( aAutoLogin );

    CleanupStack::Pop( self );

	return self;

    }

CIkev1Negotiation* CIkev1Negotiation::NewL( CIkev1PluginSession* aPluginSession,

                                            CPFKeySocketIf& aPFKeySocketIf,

                                            MIkeDebug& aDebug,

                                            TIkev1SAData* aIkev1SAdata,

                                            TUint aRole,

                                            const TPfkeyMessage *aReq )

    {

    CIkev1Negotiation* self = new ( ELeave ) CIkev1Negotiation( aPluginSession,

                                                                aPFKeySocketIf,

                                                                aDebug );

    CleanupStack::PushL( self );

    self->ConstructL( aIkev1SAdata, aRole, aReq );

    CleanupStack::Pop( self );

    return self;

    }

CIkev1Negotiation* CIkev1Negotiation::NewL( CIkev1PluginSession* aPluginSession,

                                            CPFKeySocketIf& aPFKeySocketIf,

                                            MIkeDebug& aDebug,

                                            const TInetAddr& aRemote,

                                            TBool aAutoLogin ) 

    {

	CIkev1Negotiation* self = new ( ELeave ) CIkev1Negotiation( aPluginSession,

                                                                aPFKeySocketIf,

	                                                            aDebug,

	                                                            aRemote );

	CleanupStack::PushL( self );

    self->iCookie_I = self->CreateCookieL();

    self->ConstructL( aAutoLogin );

    CleanupStack::Pop( self );

	return self;

    }

CIkev1Negotiation* CIkev1Negotiation::NewL( CIkev1PluginSession* aPluginSession,

                                            CPFKeySocketIf& aPFKeySocketIf,

                                            MIkeDebug& aDebug,

                                            const TInetAddr& aRemote,

                                            const TPfkeyMessage& aReq )

    {    

    CIkev1Negotiation* self = new (  ELeave ) CIkev1Negotiation( aPluginSession,

                                                                 aPFKeySocketIf,

                                                                 aDebug,

                                                                 aRemote );

    CleanupStack::PushL( self );

    self->iCookie_I = self->CreateCookieL();

    self->ConstructL( aReq );

    CleanupStack::Pop( self );

    return self;

    }

//

// Destructor

//

CIkev1Negotiation::~CIkev1Negotiation()

    {

    DEBUG_LOG1( _L("CIkev1Negotiation::~CIkev1Negotiation this=0x%x"), this );

    if ( iRole == INITIATOR &&

         iAcquirePending )

        {

        // Response with error to pending Acquire.

        AcquireSAErrorResponse( KKmdIkeNegotFailed );

        }

    delete iIpsecSaSpiRetriever;

    delete iSavedIkeMsgBfr;

    if( iPluginSession )

        { 		

	    iPluginSession->RemoveNegotiation( this );  

        }

    iCookie_I.FillZ(ISAKMP_COOKIE_SIZE);

    if(iTimer)

        {

        iTimer->Cancel();

        delete iTimer;

        }

    delete iOwnCert;

    delete iPeerX509Cert;

    delete iPeerTrustedCA;  // Peer trusted CA name 

    delete iICA1;

    delete iICA2;

    delete iPkiService;     // Trusted CA certificate list

    delete iOwnIdentPayload;

    //Keys

    delete iOwnKeys;        //structure containing the public and private keys

    delete iOwnPublicKey;   //Public Key

    //Phase_I Proposal

    TAttrib *attr;

    while ((attr = iProposal_I.iAttrList) != NULL)

    {

        iProposal_I.iAttrList = attr->iNext;

        delete attr;

    }

    delete iChosenProposal_I.iAttrList; //Only one transformation chosen

    //Phase_II proposals (include transformations)

    delete iProposal_IIList;

    //Phase_II chosen Proposal

    delete iChosenProp_IIList;

    delete iInboundSPIList;

    delete iCRACKneg;

    delete iTransactionNeg; // Transaction exchange 

    delete iInternalAddr;

    delete iNatDiscovery;

	delete iSARekeyInfo;

	delete iLastMsg;

	delete iDialog;

    delete iDialogInfo;

}

//

// CIkev1Negotiation

//  Constructor for remote initiated negotiation

//

CIkev1Negotiation::CIkev1Negotiation( CIkev1PluginSession* aPluginSession,

                                      CPFKeySocketIf& aPFKeySocketIf,

                                      MIkeDebug& aDebug,

                                      const TInetAddr& aRemote,

                                      const TCookie& aInitiator )

 : iCookie_I( aInitiator ),

   iRemoteAddr( aRemote ),

   iPluginSession( aPluginSession ),

   iPFKeySocketIf( aPFKeySocketIf ),

   iDebug( aDebug )

{

    DEBUG_LOG1( _L("CIkev1Negotiation::CIkev1Negotiation, RESPONDER this=0x%x"), this );

    iCookie_R.FillZ(ISAKMP_COOKIE_SIZE);

    iSAId = iPluginSession->GetSAId();

    iPluginSession->LinkNegotiation(this);         

    iRole = RESPONDER;

    iStage = 1; //next phase for the responder is 2

}

//

//  Constructor for local initiated negotiation

//

CIkev1Negotiation::CIkev1Negotiation( CIkev1PluginSession* aPluginSession,

                                      CPFKeySocketIf& aPFKeySocketIf,

                                      MIkeDebug& aDebug,

                                      const TInetAddr& aRemote )

 : iRemoteAddr( aRemote ),

   iPluginSession( aPluginSession ),

   iPFKeySocketIf( aPFKeySocketIf ),

   iDebug( aDebug )

{

    DEBUG_LOG1( _L("CIkev1Negotiation::CIkev1Negotiation, INITIATOR this=0x%x"), this );

    iCookie_I.FillZ(ISAKMP_COOKIE_SIZE);

    iCookie_R.FillZ(ISAKMP_COOKIE_SIZE);

    iSAId = iPluginSession->GetSAId();

    iPluginSession->LinkNegotiation(this);     

    iRole = INITIATOR;

    iStage = 0;

}

//

//  Constructor for Phase II initiated negotiations

//

CIkev1Negotiation::CIkev1Negotiation( CIkev1PluginSession* aPluginSession,

                                      CPFKeySocketIf& aPFKeySocketIf,

                                      MIkeDebug& aDebug )

 : iPluginSession( aPluginSession ),

   iPFKeySocketIf( aPFKeySocketIf ),

   iDebug( aDebug )

{ 

    DEBUG_LOG1( _L("CIkev1Negotiation::CIkev1Negotiation, this=0x%x"), this );

    iCookie_I.FillZ(ISAKMP_COOKIE_SIZE);

    iCookie_R.FillZ(ISAKMP_COOKIE_SIZE);    

    iSAId = iPluginSession->GetSAId();

    iPluginSession->LinkNegotiation(this); 

}

//Used when creating a negotiation as a RESPONDER!

//Used also when Initiator (= Phase 1 negotiation stated by the policy activation)

//Leaves if error detected

void CIkev1Negotiation::ConstructL(TBool aAutoLogin)

{

    iIpsecSaSpiRetriever = CIpsecSaSpiRetriever::NewL( *this,

                                                       iPFKeySocketIf );

    iAutoLogin = aAutoLogin;

    CommonConstructL();

}

//Used when an Acquire is received

//Leaves if error detected

void CIkev1Negotiation::ConstructL(const TPfkeyMessage &aReq)

{

    iIpsecSaSpiRetriever = CIpsecSaSpiRetriever::NewL( *this,

                                                       iPFKeySocketIf );

    CommonConstructL();     

    GetAcquireDataL(aReq);

}

//Used when initiating a new Phase II negotiation from a negotiated ISAKMP SA.

void CIkev1Negotiation::ConstructL( TIkev1SAData* aSA,

                                    TUint aRole,

                                    const TPfkeyMessage *aReq )

{

    iIpsecSaSpiRetriever = CIpsecSaSpiRetriever::NewL( *this,

                                                       iPFKeySocketIf );

    iPhase = PHASE_II;

    //Almost like common construct

    iTimer = CIkev1Timeout::NewL(*this);    

    //Phase II proposal lists

    iProposal_IIList = new (ELeave) CProposal_IIList(1);

    iRemoteAddr.SetPort(IKE_PORT);

    iSeq = aSA->iSeq;

    iLocalAddr  = aSA->iLocalAddr;

    iRemoteAddr = aSA->iRemoteAddr;         // Remote Address from peer

    iLastRemoteAddr = aSA->iDestinAddr;     // Remote Address last transmitted

    iLastIKEMsgInfo = aSA->iLastIKEMsgInfo;

    iLastMsg = HBufC8::NewL(4096);

    if ( aSA->iLastMsg != NULL )

        {        

        *iLastMsg = *aSA->iLastMsg;        

        }

    iRole = aRole;          // If we are initiator or responder

    //Header Data

    iCookie_I = aSA->iCookie_I; // Initiator Cookie (Used with responder to create KEYID)

    iCookie_R = aSA->iCookie_R; // Responder Cookie

    iPrevExchange = aSA->iPrevExchange;

    iExchange = IKE_QUICK_MODE;

    iMessageId = RandomMessageId();

    iFlags = aSA->iFlags;           // Flags in the msg header

//  iNotifyMessageId = aSA->iHdr.iNotifyMessageId;   // Message Id. for Informational Exchanges

    //SA Data

    iDOI = IPSEC_DOI;

    iChosenProposal_I.iProtocol = PROTO_ISAKMP;

    iChosenProposal_I.iProposalNum = 0;

//    iChosenProposal_I.iSPI.Copy(aSA->iChosenProposal_I.iSPI);

    iChosenProposal_I.iNumTransforms = 1;

    iChosenProposal_I.iAttrList = new (ELeave) TAttrib; //allocated now and deleted when destroying the obj

//  *iChosenProposal_I.iAttrList = *aSA->iChosenProposal_I.iAttrList;

    iChosenProposal_I.iAttrList->iEncrAlg = aSA->iEncrAlg;

    iChosenProposal_I.iAttrList->iHashAlg = aSA->iHashAlg;

    iChosenProposal_I.iAttrList->iGroupDesc = aSA->iGroupDesc;

    iChosenProposal_I.iAttrList->iGroupType = aSA->iGroupType;

    iChosenProposal_I.iAttrList->iKeyLength = aSA->iKeyLength;  

    if ( aSA->iLifeTimeSecs )

       iChosenProposal_I.iAttrList->iLifeDurationSecs.Copy((TUint8 *)&aSA->iLifeTimeSecs, sizeof(TUint32)); 

    if ( aSA->iLifeTimeKB )

        iChosenProposal_I.iAttrList->iLifeDurationKBytes.Copy((TUint8 *)&aSA->iLifeTimeKB, sizeof(TUint32));    

    iHostData = aSA->iIkeData;

    if ( iHostData->iCAList && iHostData->iCAList->Count() )

    {

        iPkiService = CIkeV1PkiService::NewL(iHostData, iDebug);                                           

    }   

    if (aRole == INITIATOR)

    {

        GetAcquireDataL(*aReq); //Data needed from the acquire

    }

    else    //RESPONDER 

    {

        iAcquireSeq = 1;        //msg Seq. number

    }

    //

    //NAT Traversal data

    //

    iFamiliarPeer   = aSA->iFamiliarPeer;

    iNAT_T_Required = aSA->iNAT_T_Required;

    //

    //Copy an Internal address object (if exists) to the new negotiation 

    //

    if ( aSA->iVirtualIp )

    {

       iInternalAddr = CInternalAddress::NewL(*(aSA->iVirtualIp));    

    }

    iNAT_D_Flags  = aSA->iNAT_D_Flags;  

    if ( iNAT_D_Flags ) {

       //

       // Use IETF specified NAT traversal

       //

       iNatDiscovery = CIkev1NatDiscovery::NewL(aSA->iNAT_D_Flags);

    }

    //Keys  (DH Generated public value when own)

    iSKEYID.Copy(aSA->iSKEYID);

    iSKEYID_d.Copy(aSA->iSKEYID_d);

    iSKEYID_a.Copy(aSA->iSKEYID_a);

    iSKEYID_e.Copy(aSA->iSKEYID_e);

    //IV used by des_cbc and des3_cbc is 8 but digest returns 16 bytes for MDx and 20 for SHS (first 8 used)

    iIV = aSA->iIV;     //normal IV

    iIVSize = iIV.Length(); 

    iLastIV = aSA->iLastIV; //Saves the last IV of PHASE_I to compute iNotifIV everytime

    //Nonces

//    iNONCE_I = aSA->iNONCE_I;

//    iNONCE_R = aSA->iNONCE_R;

    //

    // If the ISAKMP SA (=aSA) has been originally negotiated due the policy activation (iAutoLogin = ETrue)

    // The iLocalAddr maybe then undefined in aSA.

    // If local end is acting as an initiator, method GetAcquireDataL updates iLocalAddr in CIkev1Negotiation object.

    // In that case take iLocalAddr value from there and store it to CIsakmpSa (aSA) object.

    // If local end is acting as a responder, resolve iLocalAddr value.

    //

    if ( aSA->iAutoLogin )

    {

        if ( aRole == INITIATOR)    

             iLocalAddr = aSA->iLocalAddr;

        else User::LeaveIfError( iPluginSession->GetLocalAddress( iLocalAddr ) );

    }

    iDPDSupported = aSA->iDPDSupported;

    iSAId = aSA->iSAId;    // Reference to existin ISAKMP SA

    iStage = 1; //if initiator the stage will be set in a subsequent call to InitPhase_IIL()

}

//Leaves if error detected

void CIkev1Negotiation::CommonConstructL()

{

    iPhase = PHASE_I;

    iTimer = CIkev1Timeout::NewL(*this);    

    //Phase II proposal lists

    iProposal_IIList = new (ELeave) CProposal_IIList(1);

    iRemoteAddr.SetPort(IKE_PORT);

    iHostData = &iPluginSession->IkeData();

    if (!iHostData)

    {

        DEBUG_LOG(_L("The host has no data. Negotiation aborted"));

        User::Leave(KKmdIkeNoPolicyErr);

    }   

	if ( iHostData->iCAList && iHostData->iCAList->Count() )

	{

		iPkiService = CIkeV1PkiService::NewL(iHostData, iDebug);

		TInt stat ( EFalse );

		stat=ReadCAsL(iHostData->iCAList);  // Build trusted CA list

		if ( !stat )

		{

			SetErrorStatus( KVpnErrInvalidCaCertFile );

			User::Leave(KVpnErrInvalidCaCertFile);

		}

	}	

    iSendCert = iHostData->iAlwaysSendCert; //If true will always be sent, otherwise only with a CR

    //Proposals

    if (!BuildProposals1L())

    {

        SetFinished();

        User::Leave(KKmdIkePolicyFileErr); //if any error returns

    }

    iEncoding = X509_CERT_SIG;  //Only type in use

    iChosenProposal_I.iAttrList = new (ELeave) TAttrib; //allocated now and deleted when destroying the obj   

    User::LeaveIfError( iPluginSession->GetLocalAddress( iLocalAddr ) );

    //PFKEY data (is overwritten if initiator because we use the data given in the acquire

    iAcquireSeq = 1;//msg Seq. number of acquire needed for the UPDATE

    iSeq = 1;       //Sequence number for pfkey messages

	iLastRemoteAddr = iRemoteAddr;   // Used as destination address when sending data

#ifdef _DEBUG	

	TBuf<40> txt_addr;

    iRemoteAddr.OutputWithScope(txt_addr);

#endif            

    iLastMsg = HBufC8::NewL(4096);

    DEBUG_LOG1( _L("New negotiation with Host %S"),

            &txt_addr );

    if ( !iHostData->iUseNatProbing && iHostData->iEspUdpPort == 0 )

	{

       //

       // Use IETF specified NAT traversal

       //

       iNatDiscovery = CIkev1NatDiscovery::NewL(0);   

    }

	if ( iRole == RESPONDER )

	{

	   //

	   // Get base value internal address (=VPN virtual IP)

	   //

	   iInternalAddr = iPluginSession->InternalAddressL();

	}	

}