/*

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:   IKEv2/IPSEC SA negotiation

*

*/

#include <random.h>

#include <in_sock.h>

#include "ikev2Negotiation.h"

#include "ikedebug.h"

#include "ikev2natt.h"

#include "ikev2mobike.h"

#include "ikev2proposal.h"

#include "ikev2SAdata.h"

#include "ikev2pluginsession.h"

#include "ikev2pfkey.h"

#include "ikev2config.h"

#include "ikev2EapInterface.h"

#include "ikev2payloads.h"

#include "ikev2const.h"

#include "ikemsgrec.h"

#include "ipsecproposal.h"

#include "ipsecselectors.h"

#include "ikepolparser.h"

#include "kmdapi.h"

#include "ikecaelem.h"

#include "ikecalist.h"

#include "ikepkiutils.h"

#include "vpnapidefs.h"

#include "kmdeventloggerif.h"

#include "ipsecsalist.h"

#include "ikev2message.h"

#include "ikev2identity.h"

#include "ikev2acquire.h"

#include "ikev2expire.h"

#include "ikev2ipsecsarekeydata.h"

#include "ikev2messagesendqueue.h"

_LIT8(KIkev2PSKData, "Key Pad for IKEv2");

_LIT8(KZeroDesc, "");

CIkev2Negotiation* CIkev2Negotiation::NewL(CIkev2PluginSession& aIkeV2PlugInSession,

                                           CPFKeySocketIf& aPfKeySocketIf,

                                           MKmdEventLoggerIf& aEventLogger,

                                           CIkev2MessageSendQueue& aMessageSendQue,

                                           MIkeDebug& aDebug,

                                           CIkeData* aIkeData, 

                                           TUint32 aVpnIapId,

                                           TUint32 aSaId,

                                           TInetAddr aPhysicalInterfaceAddress,

                                           TInetAddr aRemoteAddress)

    {

    CIkev2Negotiation* self = new (ELeave) CIkev2Negotiation(aIkeV2PlugInSession, aPfKeySocketIf, 

                                                             aEventLogger, aMessageSendQue, 

                                                             aDebug, aSaId);

    CleanupStack::PushL(self);

    self->ConstructL();

    self->iHdr.iIkeData = aIkeData;

    self->iHdr.iVpnIapId = aVpnIapId;

    self->iProcessEvents     = ETrue;

    self->iHdr.iRemoteAddr = aRemoteAddress;

    self->iHdr.iRemoteAddr.SetPort(IKE_PORT);      

    //

    // Get IP address information for IKE SA negotiation

    // Remote address is taken from current IKE policy data (CIkeData)

    // Local address is resolved via IKE policy using policy handle

    //

    if ( self->iHdr.iRemoteAddr.IsUnspecified() )

    {        

        self->iHdr.iRemoteAddr = self->iHdr.iIkeData->iAddr;

        self->iHdr.iRemoteAddr.SetPort(IKE_PORT);

    }   

    self->iHdr.iDestinAddr = self->iHdr.iRemoteAddr;

    self->iHdr.iLocalAddr = aPhysicalInterfaceAddress;

    TInt Scope = self->iHdr.iRemoteAddr.Scope();

    if ( Scope )

        self->iHdr.iLocalAddr.SetScope(Scope); // Set local scope same with remote scope        

    CleanupStack::Pop(self);

    return self;

    }

CIkev2Negotiation* CIkev2Negotiation::NewL(CIkev2PluginSession& aIkeV2PlugInSession,

                                           CPFKeySocketIf& aPfKeySocketIf,

                                           MKmdEventLoggerIf& aEventLogger,

                                           CIkev2MessageSendQueue& aMessageSendQue,

                                           MIkeDebug& aDebug,

                                           TIkev2SAData& aIkev2SAdata)

    {

    CIkev2Negotiation* self = new (ELeave) CIkev2Negotiation(aIkeV2PlugInSession, aPfKeySocketIf, 

                                                             aEventLogger, aMessageSendQue, 

                                                             aDebug, aIkev2SAdata.SaId());

    CleanupStack::PushL(self);

    self->ConstructL();

    self->iHdr.Copy(aIkev2SAdata);

    self->iState = KStateIkeSaCompleted;

    CleanupStack::Pop(self);

    return self;

    }

CIkev2Negotiation::CIkev2Negotiation(CIkev2PluginSession& aIkeV2PlugInSession, CPFKeySocketIf& aPfKeySocketIf,

                                     MKmdEventLoggerIf& aEventLogger, CIkev2MessageSendQueue& aMessageSendQue,

                                     MIkeDebug& aDebug, TUint32 aSaId) 

: iChild(aDebug), iIkeV2PlugInSession(aIkeV2PlugInSession), iPfKeySocketIf(aPfKeySocketIf), 

  iEventLogger(aEventLogger), iMessageSendQue(aMessageSendQue),iDebug(aDebug), iDHGroupGuess(1) 

    {

    DEBUG_LOG1(_L("CIkev2Negotiation::CIkev2Negotiation: 0x%08x"), this);

    iHdr.SetSaId(aSaId);

    iHdr.iWindowSize = DEF_MSG_ID_WINDOW;        

    }   

void CIkev2Negotiation::ConstructL()

    {  

    iTimer = CIkev2RetransmitTimer::NewL(*this);    

    iSpiRetriever = CIpsecSaSpiRetriever::NewL(*this, iPfKeySocketIf);

    iIkeV2PlugInSession.LinkNegotiation(this); // <- takes ownership of this

    iProcessEvents = ETrue;

    }

CIkev2Negotiation::~CIkev2Negotiation()

    {

    delete iSpiRetriever;

    // Turn off event processing to prevent EAPVPNIF event

	iProcessEvents = EFalse;

    delete iTimer;

    DEBUG_LOG1(_L("CIkev2Negotiation::~CIkev2Negotiation: 0x%08x"), this);        

    iIkeV2PlugInSession.RemoveNegotiation(this);

    iHdr.CleanUp();

    //

    // Purge Acquire, Expire and Info message queues

    //

    CIkev2Acquire::PurgeQue(GetAcquireQue());

    CIkev2Expire::PurgeQue(GetExpireQue());

	delete iPeerCert;					   

    delete iSavedSaInit;

    delete iProposedSA;

    delete iDHKeys;

    delete iDHPublicPeer;

    delete iNonce_I;

    delete iNonce_R;

    delete iAuthMsgInit;

    delete iAuthMsgResp;

    delete iRemoteIdentity;

    delete iLocalIdentity;

    delete iNatNotify;

    delete iConfigMode;

    delete iEapPlugin;

    delete iPkiService; 

    delete iPresharedKey;

    delete iChildSaRequest;

    }

void CIkev2Negotiation::StartIkeSANegotiationL()

    {

    __ASSERT_DEBUG(iChildSaRequest == NULL, User::Invariant());

    //This method should be called only if we have IA in use.

    //Otherwise the negotiation should start with ProcessAcquire

    __ASSERT_DEBUG(iHdr.iIkeData->iUseInternalAddr, User::Invariant());

	//

	// This method is called when an IKE SA negotiation is started due

	// a RKMD::Activate() request with policy that uses IA.   

	//    

	iHdr.iInitiator = ETrue;

    LoadEapPluginL();

    GetNonceDataL(ETrue);

    CIkev2Acquire* Acquire = IpsecSelectors::BuildVirtualAcquireL(iIkeV2PlugInSession);

    CleanupStack::PushL(Acquire);

	if ( !InitPkiServiceL() )

	    {

	    //No PkiService Needed.

	    //Continue by requesting SPI for IPsecSA.	    

	    CIkev2Acquire::Link(Acquire, GetAcquireQue());    

        //

        // Get SPI for inbound SA with PFKEY GETSPI primitive

        //

        GetIpsecSPI(Acquire);

	    }

	else

	    {

	    iChildSaRequest = Acquire;

	    }

	CleanupStack::Pop(Acquire);	

	}

TBool CIkev2Negotiation::StartRespondingL(const ThdrISAKMP& aIkeMessage)

    {

	//

	// This method is called when local end is going to ACT as a

	// responder of an IKE SA negotiation.

	// Initialize PKI service usage, if needed. Because PKI service

	// initialisation is an asynchronous operation we must take a copy

	// of incoming IKE message from where it is processed when PKI

	// service initialisation is completed.

	//

	TBool Status( InitPkiServiceL() );

	if ( Status )

	    {

	    TInt MsgLth = (TInt)aIkeMessage.GetLength(); 	

	    delete iSavedSaInit;

	    iSavedSaInit = NULL;

	    iSavedSaInit = HBufC8::NewL(MsgLth);

	    iSavedSaInit->Des().Copy((TUint8*)&aIkeMessage, MsgLth);

	    }

	return !Status;

    }

void CIkev2Negotiation::StartIkeSADeleteL()

{

	//

	// This method is called when an IKE SA shall be deleted either due

	// IKE SA timeout or due a RKMD::Deactivate() request

	//

	BuildDeleteRequestL(NULL);

}

void CIkev2Negotiation::IkeSaCompletedL()

{

	//

	// This method is when an IKE SA negotiation has been succesfully

	// completed.

	// The following actions are taken:

	// -- Get Virtual IP from iConfigMode object, if present and

	//    modify IKE SA lifetime if Virtual Ip expiration time is

	//    shorter than configured iKE SA lifetime  

	// -- Create a new IKE SA object, if not a rekeyd IKE SA

	// -- If activation going, call IkeSaCompleted method in plug-in

	//

    TVPNAddress VirtualIp;

	if ( iConfigMode )

	{

	   VirtualIp = iConfigMode->VirtualIp();

	   iHdr.StoreVirtualIp(VirtualIp.iVPNIfAddr);

	   TUint32 ExpireTime = iConfigMode->ExpireTime();

	   if ( ExpireTime && (ExpireTime < iHdr.iLifetime) )

		   iHdr.iLifetime = ExpireTime;

	}	

	if(!iIkeV2PlugInSession.FindIkev2SA(iHdr.SaId(), KSaStateNotDefined, KSaStateNotDefined))

	    {

	    iIkeV2PlugInSession.CreateIkev2SAL(iHdr);	

	    }

	iIkeV2PlugInSession.IkeSaCompleted(KErrNone, VirtualIp);

	iEventLogger.LogEvent(MKmdEventLoggerIf::KLogInfo, R_VPN_MSG_VPN_GW_AUTH_OK, KErrNone, 

	                      iHdr.iVpnIapId, &iHdr.iRemoteAddr);

	iEventLogger.LogEvent(MKmdEventLoggerIf::KLogInfo, R_VPN_MSG_ADDR_INFO_FOR_VPN_AP,

                          iHdr.iNATFlags, iHdr.iVpnIapId,

                          (!VirtualIp.iVPNIfAddr.IsUnspecified() ? &(VirtualIp.iVPNIfAddr) : NULL));			

	if ( iChildSaRequest )

	{	

	   IpsecSANegotiatedL();

	}	

    if ( RequestsPending() )

	{	

	   ContinueIkeNegotiationL();

	}   

	else

	{	

       if ( !iHdr.iInitiator )

	   {	   

	       iIkeV2PlugInSession.StopResponding();

	       delete this;   // Current negotiation can be deleted

	   }

	   else iStopped = ETrue;

	}

}

void CIkev2Negotiation::IkeSaFailed(TInt Status)

    {

	//

	// This method is when a IKE SA negotiation has failed

	// The following actions are taken:

	//

    TVPNAddress dummyVirtualIp;

	iChildSaRequest = Ikev2Pfkey::DeleteInboundSPI(iHdr, iIkeV2PlugInSession, iChildSaRequest);	

	if ( !iHdr.iInitiator )

	    iIkeV2PlugInSession.StopResponding();

	if ( (iSendAttempt <= KMaxSendAttemps ) &&

	     ((iState == KStateIkeSaEapStarted) || 

	      (iState == KStateIkeSaEapGoing)))

		 iDeleteIkeSA = ETrue;

	else iStopped = ETrue;

	iEventLogger.LogEvent(MKmdEventLoggerIf::KLogError, R_VPN_MSG_REAL_IAP_ACT_FAILED, Status, 

	                      iHdr.iVpnIapId, &iHdr.iRemoteAddr);

    iIkeV2PlugInSession.IkeSaCompleted(Status, dummyVirtualIp);

    }

void CIkev2Negotiation::IpsecSANegotiatedL()

{

	//

	// This method is when an Ipsec SA negotiation has been succesfully

	// completed.

	// -- Update Ipsec SADB using PFKEY Update and Add primitives	

	// -- Find a new IKE SA object and queue Ipsec SA data into it

	// -- Try to start a new exchange from queue, if there is nothing

	//    to start in queues mark current negotiation stopped

	//

	iChild.iSrcSpecific = iChildSaRequest->SrcSpecific();  

	Ikev2Pfkey::UpdateIpsecSaDataBaseL(iHdr, iChild, iIkeV2PlugInSession, *iChildSaRequest);

	CIpsecSARekeyData* rekeyData = 

	    CIpsecSARekeyData::NewL(iChildSaRequest->ReplayWindow(),

                                iChildSaRequest->HardLifetime(),

                                iChildSaRequest->SoftLifetime(),

                                iChildSaRequest->TS_i(),

                                iChildSaRequest->TS_r(),

                                *iChildSaRequest->LocalId(),

                                *iChildSaRequest->RemoteId());

	iChild.PurgeKeyMaterial();	// Ipsec Keymaterial not saved into IKE SA

	iChild.DeleteRekeyData();

	iChild.iRekeyData = rekeyData;

	iIkeV2PlugInSession.UpdateIkev2SAL(&iHdr, &iChild);

	delete iChildSaRequest;

	iChildSaRequest = NULL;

	if ( RequestsPending() )	

	     ContinueIkeNegotiationL();

	else

	{	if ( iState == KStateIkeChildSAResponse )

		     delete this;

		else iStopped = ETrue;

	}	

}

void CIkev2Negotiation::ProcessIkeMessageL(const ThdrISAKMP& aIkeMessage, 

                                           const TInetAddr& aRemote, 

                                           TUint16 aLocalPort)

    {

	//

	// Start to process received IKE message by constructing a

	// CIkev2Payloads object. CIkev2Payloads construction takes also

	// care of the decryption of an Encrypted payload if present.  

	//    

	TBool Status( ETrue );

	CIkev2Payloads* IkeMsg = CIkev2Payloads::NewL(aIkeMessage, iHdr);

	CleanupStack::PushL(IkeMsg);				 	

    DEBUG_LOG2(_L("Process IKE message, SAID=%d, Msg ID=%d"),

            iHdr.SaId(), aIkeMessage.GetMessageId());	

	if ( IkeMsg->Status() )

	    {

	    //

	    //  An error occurred during IKE message parsing

	    //

	    SetNotifyCode(IkeMsg->Status());

        DEBUG_LOG1(_L("Error in parsing of received IKE message: %d"), IkeMsg->Status());

	    if ( !iHdr.iInitiator && iState == KStateIdle )

	        {

		    iStopped = ETrue;   // Negotiation object shall be released

	        }

	    else 

	        {

	        CheckNotifyCodeL(IkeMsg);

	        }

	    CleanupStack::PopAndDestroy(IkeMsg); // IkeMsg

	    return;

	    }

	if ( (iHdr.iNATFlags & (REMOTE_END_NAT + MOBIKE_USED)) && 

	    IkeMsg->Encrypted() )

	    {

	    //

	    // Received IKE message contains Encrypted payload. Save source

	    // IP as new destination IP to negotiation object

	    //

	    iHdr.iDestinAddr = aRemote;

	    iHdr.iDestinAddr.SetPort(FLOATED_IKE_PORT);

	    }	

	TPtrC8 ikeMsgDes((TUint8*)&aIkeMessage, aIkeMessage.GetLength());

	TInetAddr localAddr(iHdr.iLocalAddr);

	localAddr.SetPort(aLocalPort);

	TRACE_MSG(ikeMsgDes, aRemote, localAddr, 

              (CIkePcapTrace::TEncryptionType)iHdr.iEncrAlg);

	//

	// Process received IKE message according to Exchange type

	//

	switch ( aIkeMessage.GetExchange() )

	{

		case IKE_SA_INIT:

		    DEBUG_LOG(_L("IKE_SA_INIT message received"));

			Status = ProcessIkeSaInitL(IkeMsg, aRemote);

			if ( !Status )

			   IkeSaFailed(KKmdIkeNegotFailed);	

			break;

		case IKE_AUTH:

		    DEBUG_LOG(_L("IKE_AUTH message received"));

			Status = ProcessIkeAuthL(IkeMsg);

			if ( !Status )

			   IkeSaFailed(KKmdIkeAuthFailedErr);

			break;

		case CREATE_CHILD_SA:

		    DEBUG_LOG(_L("CREATE_CHILD_SA message received"));

			Status = ProcessChildSaL(IkeMsg);

			break;

		case INFORMATIONAL:

		    DEBUG_LOG(_L("INFORMATION message received"));

			Status = ProcessInfoMsgL(IkeMsg);			

			break;

		default:

		    DEBUG_LOG(_L("UNKNOWN message received\n"));

			Status = EFalse;  // Negotiation object shall be released			

			break;

	}

	if ( !Status )

	{

	   if ( iDeleteIkeSA )

	   {

		  //

		  // Used IKE SA shall be deleted due the fatal error occurred.

		  //

		   iDeleteIkeSA = EFalse;

		   iIkeV2PlugInSession.DeleteIkev2SA(iHdr.SaId());			   

		   BuildDeleteRequestL(NULL);

	   }

	   else

	   {	   

	       CheckNotifyCodeL(IkeMsg);

	   }	  

	}			

	CleanupStack::PopAndDestroy(IkeMsg);	

}

void CIkev2Negotiation::ProcessAcquireL(const TPfkeyMessage &aPfkeyMsg)

    {

	//

	// Process received PFKEY Acquire primitive

	// There is now the following possibilities:

	// -- There already exists an IKE SA so new IPSEC SA is negotiated

	//    using IKE_CHILD_SA exchange

	// -- The is no IKE SA yet.

	//    IPSEC SA can be negotiated concatenated during IKE_AUTH.	

	//    If Virtual IP is specified, the CP payload is used to get

	//    that virtual IP address. 

	//

	CIkev2Acquire* Acquire = CIkev2Acquire::NewL(aPfkeyMsg, iIkeV2PlugInSession.GetSAId(), 

	    GetLocalAddr(),

		Ikev2Proposal::GetDHGroup(iHdr.iIkeData->iGroupDesc_II), ImplicitChildSa());	

	if ( iState == KStateIdle )

	    {

		CleanupStack::PushL(Acquire);				 								

		LoadEapPluginL();		

		iHdr.iInitiator = ETrue;

		GetNonceDataL(ETrue);  // For IKE SA		

		if ( iHdr.iIkeData->iUseInternalAddr )

		    {

		    CArrayFix<TIkeV2TrafficSelector>* TsI = new (ELeave) CArrayFixFlat<TIkeV2TrafficSelector>(1);

		    CleanupStack::PushL(TsI);

		    TInetAddr StartIp;

			TInetAddr EndIp;	

			StartIp.SetAddress(KInetAddrNone);    // 0.0.0.0

			StartIp.SetPort(0);

			EndIp.SetAddress(KInetAddrAll);	      // 255.255.255.255

			EndIp.SetPort(0xffff);

			TIkeV2TrafficSelector ts(StartIp, EndIp, 

                                     aPfkeyMsg.iDstAddr.iExt->sadb_address_proto);

			TsI->AppendL(ts);			

			CleanupStack::Pop(TsI);

			Acquire->ReplaceTS_i(TsI);						

			Acquire->SetVirtualIp();						     						

		    }

		if ( InitPkiServiceL() )

		    {

		    // Store Acquire to wait PKI service init

			iChildSaRequest = Acquire;

			CleanupStack::Pop(Acquire); 			 							

			return;

		    }