// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// IPSecPolManUtil.cpp - IPSec Policy Manager Utilities

//

#include <in_sock.h>

#include "ipsecpolmanhandler.h"

#include "ipsecpolparser.h"

#include "ipsecpolapi.h"

//

// Build and write the strings to a policy file that tell that the clean

// tunnel mode IKE negotiation packets are accepted. For each gateway

// two strings are written: port 500 and port 4500.

// The format of strings are shown below. 10.10.10.10%2 is in this example

// an IPv4 gateway address, 255.255.255.255 is IPv4 full mask.

//

// remote 10.10.10.10%2 255.255.255.255 protocol 17 local_port  500

// remote 10.10.10.10%2 255.255.255.255 protocol 17 local_port 4500

//

//

TInt 

CIPSecPolicyManagerHandler::WriteTunnelModeIkeNegotiationStringsL(

    HBufC8*& aPolBfr)

    {

    TBuf8<1024> stringBuf;

    TInt err(KErrNone);

    // Create pointer array for gateway list

    RPointerArray<TInetAddr> gatewayList;

    CleanupClosePushL(gatewayList);

    // Set base for the selector list

    CSecurityPolicy* sp = iPieceData->Policies();

    CSelectorList* selectorList = sp->SelectorList();

    TInt selectorCount = selectorList->Count();

    // Loop through the selector list

    for (TInt i = 0; (i < selectorCount) && (err == KErrNone) ; i++)

        {

        CPolicySelector* policySelector = selectorList->At(i);

        TSecpolBundleIter iterl(policySelector->iBundle);

        CSecpolBundleItem* itemL = NULL;

        CSecpolBundleItem* itemWork;

        // Find the last item in bundle

        while ((itemWork = iterl++) != NULL)

            {

            if (!itemWork->iTunnel.IsUnspecified())

                itemL = itemWork;

            }

        // Add the address of the last gateway in the bundle

        // to the gateway list

        if (itemL)

            {

            // Search a matching element from the gateway list

            TInt count = gatewayList.Count();

            TInt j;

            for (j = 0; j < count && !itemL->iTunnel.Match(*gatewayList[j]); j++){}

            // Add a new element to the gateway list

            if (j==count)

                {

                TInt position = 0;

                gatewayList.Insert( &itemL->iTunnel, position);

                // Build two strings for policy file

                stringBuf.Zero();

                BuildTunnelModeIkeString(stringBuf,

                                         EInbound,

                                         500,

                                         itemL->iTunnel);

                BuildTunnelModeIkeString(stringBuf,

                                         EInbound,

                                         4500,

                                         itemL->iTunnel);

                // Write the string to file

                err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

                }

            }

        }

    CleanupStack::PopAndDestroy();

    return err;

    }

//

// Build a string that tells that the clean tunnel mode IKE

// negotiation packets are accepted:

// remote 10.10.10.10%2 255.255.255.255 protocol 17 local_port 500

//

//

void 

CIPSecPolicyManagerHandler::BuildTunnelModeIkeString(

    TDes8& aStringBuf,

    TInt aDirection,

    TInt aPort,

    TInetAddr& aGwAddr)

    {

    TBuf<60> addr;

    // Gateway IP address

    aStringBuf.Append(_L8(" remote "));

    aGwAddr.OutputWithScope(addr);

    aStringBuf.Append(addr);

    // Full mask, either IPv4 or IPv6

    if (aGwAddr.Family() == KAfInet || aGwAddr.IsV4Mapped())

        {

        if (!aGwAddr.Scope())

            {

            aStringBuf.Append(_L8(" 255.255.255.255 "));

            }

        else

            {

            aStringBuf.Append(_L8(" 255.255.255.255%-1 "));

            }

        }

    else

        {

        aStringBuf.Append(_L8(" FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF "));

        }

    // Protocol UDP

    aStringBuf.Append(_L8(" protocol 17 "));

    // Local or remote port

    if (aDirection == EInbound)

        {

        aStringBuf.Append(_L8(" local_port "));

        }

    else

        {

        aStringBuf.Append(_L8(" remote_port "));

        }

    // Port number

    aStringBuf.AppendFormat(_L8(" %d = { }\n"), aPort);

    }

//

// Build and write the strings to a policy file that tell that the clean

// transport mode IKE negotiation packets are accepted. For each

// transport mode selector two strings are written: port 500 and port 4500.

// The format of strings are shown below. 10.10.10.10%2 is in this example

// an IPv4 transport mode net, 255.255.255.0 is an IPv4 net mask.

//

// remote 10.10.10.10%2 255.255.255.0%-1 protocol UDP local_port  500

// remote 10.10.10.10%2 255.255.255.0%-1 protocol UDP local_port 4500

//

//

TInt 

CIPSecPolicyManagerHandler::WriteTransportModeIkeNegotiationStrings(

    HBufC8*& aPolBfr)

    {

    TInt err = KErrNone;

    //  Set base for the selector list

    CSecurityPolicy* sp = iPieceData->Policies();

    CSelectorList* selectorList = sp->SelectorList();

    TInt selectorCount = selectorList->Count();

    // Loop through the selector list

    for (TInt i = 0; i < selectorCount; i++)

        {

        CPolicySelector* policySelector = selectorList->At(i);

        if (policySelector->iBundle.IsEmpty())

            {

            continue;

            }

        TSecpolBundleIter iterl(policySelector->iBundle);

        CSecpolBundleItem* itemFirst = iterl;

        // Calculate the bundle count

        TInt bundleCount = 0;

        while ((iterl++) != NULL)

            {

            bundleCount++;

            }

        // Check that no gateway is specified, it means transport mode

        if (bundleCount == 1

            && itemFirst != NULL

            && itemFirst->iTunnel.IsUnspecified())

            {

            // Build two strings for policy file

            TBuf8<1024> stringBuf;

            stringBuf.Zero();

            BuildTransportModeIkeString(stringBuf,

                                        500,

                                        policySelector->iRemote,

                                        policySelector->iRemoteMask);

            BuildTransportModeIkeString(stringBuf,

                                        4500,

                                        policySelector->iRemote,

                                        policySelector->iRemoteMask);

            // Write the string to file

            err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

            }

        if (err != KErrNone)

            {

            break;

            }

        }

    return err;

    }

//

// Build a string that tells that the clean Transport mode IKE

// negotiation packets are accepted:

// remote 10.10.10.10%2 255.255.255.255%-1 protocol UDP local_port 500

//

//

void 

CIPSecPolicyManagerHandler::BuildTransportModeIkeString(

    TDes8& aStringBuf,

    TInt aPort,

    TInetAddr& aRemote,

    TInetAddr& aRemoteMask)

    {

    TBuf<60> addr;

    // Gateway IP address

    aStringBuf.Append(_L8(" remote "));

    aRemote.OutputWithScope(addr);

    aStringBuf.Append(addr);

    aStringBuf.Append(_L8(" "));

    // Mask

    aRemoteMask.OutputWithScope(addr);

    aStringBuf.Append(addr);

    aStringBuf.Append(_L8(" "));

    // Protocol UDP, local_port #, bypass action 

    aStringBuf.AppendFormat(_L8("protocol 17 local_port %d = { }\n"), aPort);

    }

//

// Build a string that tells that the clean DHCP protocol

// packets are accepted:

// outbound protocol 17 remote_port 67

// inbound  protocol 17 local_port 68

//

//

TInt 

CIPSecPolicyManagerHandler::BuildDhcpProtocolString( HBufC8*& aPolBfr)

    {

    TInt err = KErrNone;

    TBuf8<1024> stringBuf;

    // Outbound, protocol UDP, remote_port 67

    stringBuf.Append(_L8(" outbound protocol 17 remote_port 67 = { }\n"));

    // Inbound, protocol UDP, local_port 68

    stringBuf.Append(_L8(" inbound protocol 17 local_port 68 = { }\n"));

    // Write the string to file

    err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

    return err;

    }

//

// Build the strings that tell that clean MIPv4 protocol packets

// are accepted:

//

// *** outbound solicitation messages ***

// outbound remote 255.255.255.255 255.255 255.255 icmp_type 10

// outbound remote 224.0.0.2       255.255.255.255 icmp_type 10

//

// *** outbound Registration Request message ***

// outbound protocol 17 remote_port 434

//

// *** inbound Advertisement messages ***

// inbound local 255.255.255.255 255.255.255.255 icmp_type 9

// inbound local 224.0.0.1       255.255.255.255 icmp_type 9

//

// *** inbound Registration Reply message ***

// inbound protocol 17 local_port 434

//

//

TInt 

CIPSecPolicyManagerHandler::BuildMip4BypassSelectors( HBufC8*& aPolBfr)

    {

    TInt err = KErrNone;

    TBuf8<1024> stringBuf;

    // Outbound Solicitation message

    stringBuf.Append(_L8(" outbound "));

    stringBuf.Append(_L8(" remote "));

    stringBuf.Append(_L8(" 255.255.255.255 "));  // IP address

    stringBuf.Append(_L8(" 255.255.255.255 "));  // Mask

    stringBuf.Append(_L8(" icmp_type 10 = { }\n"));

    // Outbound Solicitation message

    stringBuf.Append(_L8(" outbound "));

    stringBuf.Append(_L8(" remote "));

    stringBuf.Append(_L8(" 224.0.0.2 "));

    stringBuf.Append(_L8(" 255.255.255.255 "));

    stringBuf.Append(_L8(" icmp_type 10 = { }\n"));

    // Outbound Registration Request message

    stringBuf.Append(_L8(" outbound "));

    stringBuf.Append(_L8(" protocol 17 "));

    stringBuf.Append(_L8(" remote_port 434 = { }\n"));

    // Inbound Advertisement message

    stringBuf.Append(_L8(" inbound "));

    stringBuf.Append(_L8(" local "));

    stringBuf.Append(_L8(" 255.255.255.255 "));

    stringBuf.Append(_L8(" 255.255.255.255 "));

    stringBuf.Append(_L8(" icmp_type 9 = { }\n"));

    // Inbound Advertisement message

    stringBuf.Append(_L8(" inbound "));

    stringBuf.Append(_L8(" local "));

    stringBuf.Append(_L8(" 224.0.0.1 "));

    stringBuf.Append(_L8(" 255.255.255.255 "));

    stringBuf.Append(_L8(" icmp_type 9 = { }\n"));

    // Inbound Registration Reply message

    stringBuf.Append(_L8(" inbound "));

    stringBuf.Append(_L8(" protocol 17 "));

    stringBuf.Append(_L8(" local_port 434 = { }\n"));

    // Write the string to file

    err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

    return err;

    }

//

//  Modify the SA names (SA = Security association) by appending

//  the SA name with suffix ZZ_n, where the n is the next policy

//  handle and zz_ is a separator

//

void 

CIPSecPolicyManagerHandler::MakeUniqueSANamesL()

    {

    CSecurityPolicy* policy = iPieceData->Policies();

    CArrayFixFlat<CPolicySpec *>* saList = policy->SAList();

    // Loop here until all SPDB SA names changed

    TInt i;

    TBuf8<100> buf;

    for (i = 0; i < saList->Count(); i++)

        {

        if (saList->At(i)->iSpectype == EPolSpecEP)

            {

            // TODO: Verify also that EndPoint names are unique

            continue;

            }

        // Copy an SA name to buf

        buf.Copy(saList->At(i)->iName->Des());

        buf.AppendFormat(_L8("zz_%d"), iCurrentPolicyHandle.iHandle + 1);

        // Delete the name bfr

        delete saList->At(i)->iName;

        saList->At(i)->iName = NULL;

        // Allocate a new bfr

        saList->At(i)->iName = HBufC8::NewL(buf.Length());

        // Set the new name buffer

        saList->At(i)->iName->Des().Copy(buf);

        }

    }

//

//  This function examines all selectors in the selector list and

//  creates for each selector a comparison word that is needed

//  to define the sequence of selectors in the file that is

//  sent to the IPSec protocol component. The comparison word

//  consists of the following parts:

//  -- byte 1 = 0

//  -- byte 2, bit 0 = 1 = port 500 or 4500 is defined in selector

//  -- byte 2, bit 0 = 1 = port 67 and 68 is defined in selector

//  -- byte 2, bit 0 = 1 = MIPv4 is defined by the selector

//  -- byte 2, bit 1 = 0

//  -- byte 4, bit 8 = 1 = all selectors have this bit on

//

//  The selector that has the greatest comparison word, is the first

//  in the sequence.

//

TInt 

CIPSecPolicyManagerHandler::BuildComparisonWord(CSelectorList* aSelList)

    {

    TInt count = aSelList->Count();

    TInt compWord(0);

    // Loop through the selector list

    for (TInt i = 0; i < count; i++)

        {

        CPolicySelector* policySelector = aSelList->At(i);

        compWord = 0;

        // Check if the local port 500 or 4500 is defined in selector, or

        // remote port 67 and local port 68 is defined, set a bit

        // in comparison word (IKE negotiation ports or DHCP ports)

        if ((policySelector->iLocal.Port() == 500

             || policySelector->iLocal.Port() == 4500)

            || (policySelector->iRemote.Port() == 67

                && policySelector->iLocal.Port() == 68))

            {

            compWord |= 0x00400000;

            }

        // Check if MIP4 protocol selectors:

        // -- IcmpType is 9 or 10

        //    or

        // -- iType is 9 or 10

        //    or

        //    protocol is 17 (UDP) and local port or remote_port is 434

        // and set a bit in comparison word

        if ((policySelector->iIcmpType == 9 || policySelector->iIcmpType == 10)

            || (policySelector->iType == 9 || policySelector->iType == 10)

            || (policySelector->iProtocol == 17

                && (policySelector->iRemote.Port() == 434

                    || policySelector->iLocal.Port() == 434)))

            {

            compWord |= 0x00400000;

            }

        // Each selector has at least this bit set on

        compWord |= 0x00000001;

        // Store comparison word to the selector

        policySelector->iCompWord = compWord;

        }

    return (KErrNone);

    }

//

//  This function examines all selectors in the selector list and

//  sets a unique sequence number to each selector. The sequence

//  numbers are used to define the sequence of selectors in a

//  file that is sent to the IPSec protocol component.

//  Each selector has a comparison word created previously.

//

//

TInt 

CIPSecPolicyManagerHandler::SetSequenceNumbers(CSelectorList* aSelList)

    {

    TInt count = aSelList->Count();

    TBool complete = EFalse;

    TInt currentSequenceNumber = 1;

    TUint32 currentHighValue;

    TInt j = 0;

    // Loop until each selector has a sequence number (exception:

    // ffffffff means deleted

    while (!complete)

        {

        currentHighValue = 0;

        // Loop through the selector list and search the selector that has

        // the highest value in comparison field

        for (TInt i = 0; i < count; i++)

            {

            CPolicySelector *policySelector = aSelList->At(i);

            if (policySelector->iSequenceNumber == -1)

                {

                continue;

                }

            if (policySelector->iSequenceNumber == 0 &&

                policySelector->iCompWord > currentHighValue )

                {

                j = i;

                currentHighValue = policySelector->iCompWord;

                }

            }

        // A round is complete

        if (currentHighValue == 0)

            {

            complete = ETrue;  // Each selector has a sequence number

            }

        else

            {

            CPolicySelector* tempSelector = aSelList->At(j);

            tempSelector->iSequenceNumber = currentSequenceNumber;

            currentSequenceNumber++;

            }

        }

    return 0;

    }

//

//  Compute either IPv4 or IPv6 mask length from a mask in TInetAddr

//

//

//

TInt 

CIPSecPolicyManagerHandler::CalculateMaskLength(TInetAddr& aMask)

    {

    TInt maskLength(0);

    if (aMask.Family() == KAfInet)

        {

        // 96 = corresponds now IPv6 size

        maskLength = 96 + MaskLength(aMask.Address());

        }

    else if (aMask.Family() == KAfInet6)

        {

        maskLength = MaskLength(aMask.Ip6Address());

        }

    return (maskLength);

    }

//

// MaskLength

// **********

// Borrowed from Tcpip6\src\iface.cpp

// Local utility, compute consecutive leftmost 1-bits from 32 bit integer

//

//

TInt 

CIPSecPolicyManagerHandler::MaskLength(TUint32 aAddr)

    {