// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// spdb.cpp - IPv6/IPv4 IPsec Security Policy Database (SPD)

// Implementation of the IPsec Security Policy Database (SPD)

//

/**

 @file spdb.cpp

*/

#include "epdb.h"

#include "spdb.h"

#include <networking/pfkeyv2.h>

#include "sa_spec.h"

#include <networking/ipsecerr.h>

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

#include <e32std.h>

#endif // SYMBIAN_IPSEC_VOIP_SUPPORT

#ifndef OLD_SELECTOR_ORDERING

/** @deprecated

* The old syntax allowed total mixing of "filter" and "selector"

* keywords. The new syntax requires the filter keywords (outbound,

* inbound, merge, final, etc.) to precede any real selectors.

* For backward compatibility, allow old deprecated ordering, if

* OLD_SELECTOR_ORDERING is defined.

*/

#define	OLD_SELECTOR_ORDERING 1

#endif

/**

* Static keyword macro.

*

* Store all keywords as "plain ascii" (narrow, not UNICODE)

*/

#define KEYWORD(s) {(sizeof(s)-1), (const TText8 *)s}

/**

* Keyword number macro.

*

* Generate enum name for the keyword 's'.

*/

#define	KEYENUM(s)	E_ ## s

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

// CPropList

CPropList::CPropList(TInt aGranularity) :

    CArrayFixFlat<CSecurityProposalSpec *>(aGranularity)

    {}

 CPropList* CPropList::NewL(TInt aGranularity)

    {

    CPropList* self = new (ELeave) CPropList(aGranularity);

    self->Construct(aGranularity);

    return self;

    }

 void CPropList::Construct(TInt /* aGranularity */)

    {}

CPropList::CPropList(CPropList* aSAList) :

    CArrayFixFlat<CSecurityProposalSpec *>(aSAList->Count())

    {}

CPropList* CPropList::NewL(CPropList* aSAList)

    {

    CPropList* self = new (ELeave) CPropList(aSAList);

    CleanupStack::PushL(self);

    self->ConstructL(aSAList);

    CleanupStack::Pop();

    return self;

    }

 void CPropList::ConstructL(CPropList* aSAList)

    {

    TInt count(aSAList->Count());

    }

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

class TKeyword

	/**

	* The keyword definition.

	*/

	{

public:

	TInt iLength;			//< Length of the keyword

	const TText8 *iWord;	//< The keyword

	};

static TInt Lookup(const TKeyword *const aList, const TInt aLength, const TDesC &aToken)

	/**

	* Lookup a keyword from list.

	*

	* @param aList		The list of keyword

	* @param aLength	The number of keywords in the list

	* @param aToken		The keyword to be looked for

	*

	* @return

	*	The index of the matched keyword, or aLength, if none matches.

	*/

	{

	const TInt token_length = aToken.Length();

	for (TInt i = 0; i < aLength; i++)

		{

		const TKeyword &key = aList[i];

		if (key.iLength == token_length)

			{

			// Use own matching loop (instead of Compare), because keywords

			// are stored as 8-bit strings (to make them compact).

			for (TInt k = token_length;;)

				{

				if (--k < 0)

					return i;	// Keyword matched!

				if (key.iWord[k] != aToken[k])

					break;		// No Match!

				}

			}

		}

	return aLength;

	}

typedef enum

	/**

	* Tokens of the IPsec policy syntax.

	*/

	{

	token_string,		//< Any string of non-white space and non-token characters.

	token_question,		//< Question mark: '?'

	token_equal,		//< Equal sign: '='

	token_comma,		//< Comma: ','

	token_brace_left,	//< Left brace: '{'

	token_brace_right,	//< Right brace: '}'

	token_par_left,		//< Left parens: '('

	token_par_right,	//< Right parens: ')'

	token_eof			//< End of policy string.

	} token_type;

class TParser : public TLex

	/**

	* Parser of the policy definition.

	*/

	{

public:

	TParser(CSecurityPolicy *aSP, const TDesC &aPolicy, REndPoints &aEp);

	void ParseL(TUint aStartOffset);

private:

	void ParseEndPointL();

	void SetAddressOrEndPointL(RIpAddress &aAddr, TInt aMask, TInt aError);

	void ParseAddressL(RIpAddress &aAddr, TInt aMask, TInt aError);

	void ParseAddressAndMaskL(RIpAddress &aAddr, RIpAddress& aMask);

	void ParseSecurityBundleL(RPolicyActions &aBundle, CTransportSelector *aTS);

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

	void ParseAssociationParametersL(CPolicySpec *aSpec);

#else 

	void ParseAssociationParametersL(TSecurityAssocSpec &aSpec);

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

	void ParseSelectorL(CPolicySelector *&aPs);

	token_type TransportSelectorL(CTransportSelector *& aTS);

	void ParseAssociationL();

	TAlgorithmMap *ParseAlgorithmReferenceL(TInt anInsert);

	TInt ParseAlgorithmMappingL(TAlgorithmClass aClass);

	token_type NextToken();

	void SkipSpaceAndMark();

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

	token_type CheckProposalCloseAndMoreProposals(TInt &aPropBraces);

	CSecurityProposalSpec* CreateProposalL(CPropList& aPropList);

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

	TPtrC iToken;			//< The current token.

	CSecurityPolicy *iSp;	//< The result of the parsing operation, The new policy

	REndPoints &iEp;		//< The End Point collection to use for the named endpoints.

	};

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

CSecurityProposalSpec* TParser::CreateProposalL(CPropList& aPropList)

	{

	CSecurityProposalSpec* prop = new(ELeave) CSecurityProposalSpec;

	prop->iType = SADB_SATYPE_UNSPEC;	

	aPropList.AppendL(prop);

	return prop;

	}

token_type TParser::CheckProposalCloseAndMoreProposals(TInt &aPropBraces)

	{

	token_type val;

	val=NextToken();

	if (val == token_brace_right )

		{

		if (--aPropBraces != -1)

		return NextToken();

		}

	return val;

	}

#endif // SYMBIAN_IPSEC_VOIP_SUPPORT

void TParser::SkipSpaceAndMark()

	/**

	* Skip white space and mark.

	*

	* Skip white space and comments. The '#' character

	* starts a comment that continues to the end of the line.

	* Syntactically, a comment is white space  (and terminates

	* token string.

	*

	* Set the mark on first character that is not white space.

	*/

	{

	TInt comment = 0;

	while (!Eos())

		{

		const TChar ch = Get();

		if (ch == '\n')

			comment = 0;

		else if (comment || ch == '#')

			comment = 1;

		else if (!ch.IsSpace())

			{

			UnGet();

			break;

			}

		}

	Mark();

	}

token_type TParser::NextToken()

	/**

	* Parse over the next token.

	*

	* Skip over white space and return the next token. The

	* parsing point is after the returned token. Set the

	* iToken to reference the returned token as a string.

	*

	* @return The token type

	*/

	{

	token_type val;

	SkipSpaceAndMark();

	if (Eos())

		val = token_eof;

	else

		{

		TChar ch = Get();

		if (ch == '{')

			val = token_brace_left;

		else if (ch == '}')

			val = token_brace_right;

		else if (ch == '(')

			val = token_par_left;

		else if (ch == ')')

			val = token_par_right;

		else if (ch == '=')

			val = token_equal;

		else if (ch == ',')

			val = token_comma;

		else if (ch == '?')

			val = token_question;

		else

			{

			val = token_string;

			while (!Eos())

				{

				ch = Peek();

				if (ch == '{' || ch == '}' ||

					ch == '(' || ch == ')' ||

					ch == '=' || ch == '#' ||

					ch == '?' || ch.IsSpace())

					break;

				Inc();

				}

			}

		}

	iToken.Set(MarkedToken());

	SkipSpaceAndMark();

	return val;

	}

TAlgorithmMap *TParser::ParseAlgorithmReferenceL(TInt aInsert)

	/**

	* Parse algorithm reference

	* @code [ library '.' ] algorithm

	* @endcode

	*

	* @param aInsert Create TAlgorithMap, if not found

	* @return The algorithm map.

	*/

	{

	_LIT(K_null, "null");

	if (NextToken() == token_string)

		{

		TInt dot = iToken.Locate('.');

		const TPtrC lib = dot < 0 ? (TPtrC&)KNullDesC() : iToken.Left(dot);

		TPtrC alg = dot < 0 ? iToken : iToken.Right(iToken.Length()-dot-1);

		if (alg.Compare(K_null) == 0)

			alg.Set(0,0);		// 'null' is a special algorithm name!

		TAlgorithmMap *map = iSp->FindAlg(lib, alg);

		if (map == NULL && aInsert)

			map = iSp->NewAlgL(lib, alg);

		return map;

		}

	// Ás this is syntax error, should probably report something..

	return NULL;

	}

TInt TParser::ParseAlgorithmMappingL(TAlgorithmClass aClass)

	/**

	* Parse algorithm mapping

	* @code ParseAlgorithmReferenceL '(' id ',' bits [',' dummy]* ')'

	* @endcode

	*

	* The library reference is followed by a list of numbers in

	* parentheses. The kernel side only needs one or two (for digest)

	* and rest are ignored (the other numbers may be used by the

	* key management or configuration tools).

	*

	* @param aClass Algorithm type (cipher or digest).

	* @return KErrNone if no errors.

	*/

	{

	TAlgorithmMap *map = ParseAlgorithmReferenceL(1);

	if (map && NextToken() == token_par_left)

		{

		TInt i, n;

		map->iClass = aClass;

		for (i = 0;;++i)

			{

			const TInt error = Val(n);

			if (error != KErrNone)

				return error;

			//

			// Only the first two integers are used by the

			// kernel IPSEC, pass other numbers silently.

			//

			if (i == 0)

				map->iId = n;

			else if (i == 1)

				map->iBits = n;

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

			if (map->iId == SADB_AALG_AES_XCBC_MAC)

				{

				map->iClass = EAlgorithmClass_Mac;

				}

#endif	// SYMBIAN_IPSEC_VOIP_SUPPORT			

			const TInt tok = NextToken();

			if (tok == token_par_right)

				break;

			else if (tok != token_comma)

				return KErrGeneral;

			}

		//

		// At least one number (id) must be present

		//

		if (i == 0)

			return KErrGeneral;

		}

	return KErrNone;

	}

void TParser::ParseEndPointL()

	/**

	* Parse Named End Point

	* @code name '=' '{' [ '?' ] ip-address '}'

	* @endcode

	*/

	{

	if (NextToken() != token_string)

		User::Leave(EIpsec_PolicySpecName);	// Endpoint name expeted!

	// Allocate a slot for the new association specification

	const TPtrC name(iToken);

	if (NextToken() != token_equal ||

		NextToken() != token_brace_left)

		User::Leave(EIpsec_PolicySyntaxError);

	TInt opt = 0;

	token_type val = NextToken();

	if (val == token_question)

		{

		opt = 1;

		val = NextToken();

		}

	TIpAddress addr;

	if (val == token_brace_right)

		addr.SetAddressNone();

	else

		{

		 if (val != token_string || addr.SetAddress(iToken) != KErrNone)

			User::Leave(EIpsec_PolicyIpAddressExpected);

		if (NextToken() != token_brace_right)

			User::Leave(EIpsec_PolicyCloseBraceExpected);

		}

	// Add RIpAddress handle to iEndPoints to keep the EP around

	// as long as this policy is loaded (if EP is attached to some

	// other objects, like SA, its life extends beyond the policy

	// life).

	const TInt index = iSp->iEndPoints.Count();

	User::LeaveIfError(iSp->iEndPoints.Append(RIpAddress()));

	User::LeaveIfError(iSp->iEndPoints[index].Open(iEp, name, addr, opt));

	}

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

void TParser::ParseAssociationParametersL(CPolicySpec *aPolicySpec)

#else

void TParser::ParseAssociationParametersL(TSecurityAssocSpec &aSpec)

#endif // SYMBIAN_IPSEC_VOIP_SUPPORT

	/**

	* Parse a sequence of association parameters

	* @code [ 'ah' | 'esp' | 'encrypt_alg' number | 'auth_alg' number |

	* 'identity' string | 'identity_remote' string | 'identity_local' string |

	* 'pfs' |

	* 'protocol_specific' | 'local_port_specific' | 'remote_port_specific' |

	* 'proxy_specific' | 'local_specific' | 'remote_specific' |

	* 'src_specific' | 'replay_win_len' number |

	* 'min_auth_bits' number | 'max_auth_bits' number |

	* 'min_encrypt_bits' number | 'max_encrypt_bits' number |

	* 'hard_lifetime_allocations' number | 'hard_lifetime_bytes' number |

	* 'hard_lifetime_addtime' number | 'hard_lifetime_usetime' number |

	* 'soft_lifetime_allocations' number | 'soft_lifetime_bytes' number |

	* 'soft_lifetime_addtime' number | 'soft_lifetime_usetime' number | 'proposal' ]+  '}'

	* @endcode

	*

	* Some parameters are just plain keyword, some have additional numeric

	* or string arguments. The parameter keywords can be in any order, but

	* each keyword can only appear once. At least one 'ah' or 'esp' must be

	* present.

	*

	* @param aSpec The specificantion to fill.

	*/

	{

	static const TKeyword list[] =

		{

		KEYWORD("ah"),

		KEYWORD("esp"),

		KEYWORD("encrypt_alg"),

		KEYWORD("auth_alg"),

		KEYWORD("identity"),

		KEYWORD("identity_remote"),

		KEYWORD("identity_local"),

		KEYWORD("pfs"),

		KEYWORD("protocol_specific"),

		KEYWORD("local_port_specific"),

		KEYWORD("remote_port_specific"),

		KEYWORD("proxy_specific"),	// -- kept for backward compatibility

		KEYWORD("local_specific"),

		KEYWORD("remote_specific"),

		KEYWORD("src_specific"),

		KEYWORD("replay_win_len"),

		KEYWORD("min_auth_bits"),

		KEYWORD("max_auth_bits"),

		KEYWORD("min_encrypt_bits"),

		KEYWORD("max_encrypt_bits"),

		KEYWORD("hard_lifetime_allocations"),

		KEYWORD("hard_lifetime_bytes"),

		KEYWORD("hard_lifetime_addtime"),

		KEYWORD("hard_lifetime_usetime"),

		KEYWORD("soft_lifetime_allocations"),

		KEYWORD("soft_lifetime_bytes"),

		KEYWORD("soft_lifetime_addtime"),

		KEYWORD("soft_lifetime_usetime")

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

		,KEYWORD("proposal")

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

		};

	enum	// Order must be exactly the same as above

		{

		KEYENUM(ah),

		KEYENUM(esp),

		KEYENUM(encrypt_alg),

		KEYENUM(auth_alg),

		KEYENUM(identity),

		KEYENUM(identity_remote),

		KEYENUM(identity_local),

		KEYENUM(pfs),

		KEYENUM(protocol_specific),

		KEYENUM(local_port_specific),

		KEYENUM(remote_port_specific),

		KEYENUM(proxy_specific),

		KEYENUM(local_specific),

		KEYENUM(remote_specific),

		KEYENUM(src_specific),

		KEYENUM(replay_win_len),

		KEYENUM(min_auth_bits),

		KEYENUM(max_auth_bits),

		KEYENUM(min_encrypt_bits),

		KEYENUM(max_encrypt_bits),

		KEYENUM(hard_lifetime_allocations),

		KEYENUM(hard_lifetime_bytes),

		KEYENUM(hard_lifetime_addtime),

		KEYENUM(hard_lifetime_usetime),

		KEYENUM(soft_lifetime_allocations),

		KEYENUM(soft_lifetime_bytes),

		KEYENUM(soft_lifetime_addtime),

		KEYENUM(soft_lifetime_usetime),

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

		KEYENUM(proposal),

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

		KEYENUM(max_parameters)

		};

	TInt sa_type_defined = 0;

	TInt error = KErrNone;

	token_type val;

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

	val = NextToken();

	TInt propasalsDefined=0;