// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// key_prt.cpp - IPv6/IPv4 IPSEC PFKEY protocol

//

#include "ipsec.h"

#include "sadb.h"

#include "sa_crypt.h"

#include <networking/pfkeyv2.h>

#include "pfkey.h"

#include "ipseclog.h"

#include <networking/in6_ipsec.h>

#include <es_prot_internal.h>

CProtocolBase *IPSEC::NewPfkeyL()

	/**

	* Return new instance of PFKEY protocol object.

	*

	* @return The PFKEY protocol.

	*/

	{

	return new (ELeave) CProtocolKey();

	}

void IPSEC::IdentifyPfkey(TServerProtocolDesc &aEntry)

	/**

	* Return PFKEY protocol description

	*

	* @retval aEntry The description

	*/

	{

	_LIT(Kpfkey, "pfkey");

	aEntry.iName = Kpfkey;

	aEntry.iAddrFamily = KAfIpsec;

	aEntry.iSockType = KSockRaw;

	aEntry.iProtocol = KProtocolKey;

	aEntry.iVersion = TVersion(1, 0, 0);

	aEntry.iByteOrder = ELittleEndian;

	aEntry.iServiceInfo = KSIConnectionLess | KSIMessageBased;

	aEntry.iNamingServices = 0;

	aEntry.iSecurity = KSocketNoSecurity;

	aEntry.iMessageSize = 0xffff;

	aEntry.iServiceTypeInfo = ESocketSupport | ENeedMBufs;

	aEntry.iNumSockets = KUnlimitedSockets;

	}

MAssociationManager *IPSEC::FindAssociationManager(const CProtocolBase *aProtocol, TUint aId)

	/**

	* Return MAssociationManager, if aProtocol is CProtocolKey instance.

	*

	* @param aProtocol	The protocol instance

		* @param aId The protocol Id

	* @return NULL, if aProtocol is not CProtocolKey, otherwise return MAssociationManager

	*/

	{

	if (aId == KProtocolKey)

		return (CProtocolKey *)aProtocol;

	return NULL;

	}

#pragma warning (disable:4355)

CProtocolKey::CProtocolKey() : iEngineAH(this), iEngineESP(this), iEngineNATT(this)

	/**

	* Constructor.

	*/

	{

	iSAPlist.SetOffset(_FOFF(CProviderKey,iSAPlink));

	}

#pragma warning (default:4355)

void CProtocolKey::Open()

	/**

	* Increase reference count.

	*

	* The specific implementation exists only, because MAssociationManager::Open()

	* must be mapped CProtocolBase::Open.

	*/

	{

	CProtocolBase::Open();

	}

void CProtocolKey::Close()

	/**

	* Descrease reference count.

	*

	* The specific implementation exists only, because MAssociationManager::Close()

	* must be mapped CProtocolBase::Close.

	*/

	{

	CProtocolBase::Close();

	}

CServProviderBase* CProtocolKey::NewSAPL(TUint aSockType)

	/**

	* Create new PFKEY SAP.

	*

	* @param aSockType == KSockRaw

	* @return CProviderKey instance

	*/

	{

	if (aSockType!=KSockRaw)

		User::Leave(KErrNotSupported);

	CProviderKey *pSAP = new (ELeave) CProviderKey(*this);

	iSAPlist.AddLast(*pSAP);

	return pSAP;

	}

CProtocolKey::~CProtocolKey()

	/**

	* Destructor.

	*/

	{

	// release End Points recorded by SetOpt

	for (TInt i = iEndPoints.Count(); --i >= 0; )

		{

		iEndPoints[i].Close();

		}

	iEndPoints.Close();

	delete iCrypto;		// Relese crypto libraries

	delete iTimer;		// Disconnect Timer system.

	//

	// Release Security Associations

	//

	for (TInt j = 0; j < HashSize(); ++j)

		while (iHash[j])

			{

			CSecurityAssoc *sa = iHash[j];

			iHash[j] = sa->iNext;

			delete sa;

			}

	// If assumptions are correct, iSAPlist should be empty!!

	ASSERT(iSAPlist.IsEmpty());

#if __WINS__

	LOG(Log::Printf(_L("CProtocolKey::~CProtocolKey() done IPSEC_OBJECT_COUNT=%d"), IPSEC_OBJECT_COUNT));

#endif

	}

void CProtocolKey::InitL(TDesC& /*aTag*/)

	/**

	* Initialize.

	*

	* Initialize the CProtocolKey. Create cryptographic library manager

	* and timer handler.

	*/

	{

	iCrypto = CIpsecCryptoManager::NewL();

	MAssociationManager *const mgr = this;

	iTimer = TimeoutFactory::NewL(1, mgr);

	}

// Unnecessary function, could use the default in CProtocolBase

void CProtocolKey::StartL()

	/**

	* StartL has nothing to do.

	*/

	{

	}

void CProtocolKey::BindToL(CProtocolBase* aProtocol)

	/**

	* Bind requests protocols "below".

	*

	* The PFKEY allows here only cryptographic libraries, which are

	* recognized from their protocol number #KProtocolCrypto .

	*

	* @param aProtocol The Cryptographic library.

	*/

	{

	ASSERT(this != aProtocol);

	// Find out the ID of given protocol object

	TUint id;

		{

		TServerProtocolDesc info;

		aProtocol->Identify(&info);

		id = info.iProtocol;

		}

	if (id == STATIC_CAST(TUint, KProtocolCrypto))

		iCrypto->AddLibraryL((CProtocolCrypto *)aProtocol);

	else

		User::Leave(KErrGeneral);	// Only Crypto libraries can be bound to PFKEY!

	}

void CProtocolKey::BindL(CProtocolBase * /*aProtocol*/, TUint /*id*/)

	/**

	* Bind request from a protocol "above".

	*

	* This is normally only used by the SECPOL protocol. The PFKEY

	* does not keep track of these binds, and thus it accepts

	* all BindL's as is (without any checks).

	*

	* @param aProtocol The protocol doing the bind.

	* @param id The protocol number

	*/

	{

	// This function is just to allow standard BindToL sequence

	// to complete, currently PFKEY is not insterested in keeping

	// track of who binds to it, thus nothing is done here.

	}

void CProtocolKey::Identify(TServerProtocolDesc *aInfo) const

	/**

	* Return PFKEY protocol description

	*

	* @retval aEntry The description

	*/

	{

	IPSEC::IdentifyPfkey(*aInfo);

	}

TInt CProtocolKey::GetOption(TUint aLevel, TUint aName, TDes8& aOption, CProtocolBase* /*aSourceProtocol*/)

	/**

	* Supported GetOpt's for the PFKEY socket

	*

	* PFKEY SAP GetOption calls this.

	*

	* @param aLevel The option level

	* @param aName	The option name

	* @param aOption The option argument

	* @param aSourceProtocol Not used.

	*

	* Get Named EndPoint:

	* @code aLevel = KSolIpsecControl, aName = KSoIpsecEndpoint, aOption = TNameRecord

	* @endcode

	*/

	{

	if (aLevel == KSolIpsecControl && aName == KSoIpsecEndpoint)

		{

		// A problematic option: the aOption is both input (iName) and output (iAddr)!

		// Return the address (TNameRecord::iAddr) of a named end point (TNameRecord::iName)

		// If the named endpoint does not exist, return KErrNotFound and set address to unspecified.

		if (aOption.Length() != sizeof(TNameRecord))

			return KErrArgument;

		TNameRecord &record = (TNameRecord &)*aOption.Ptr();

		// ** should check that TNameRecord::iName and iAddr are valid TBuf

		// ** descriptors which do not cause a panic, when accessed! How?

		RIpAddress ep;

		const TInt res = ep.Open(iEndPointCollection, record.iName);

		// (if Open fails, ep() return unspecified address)

		TInetAddr::Cast(record.iAddr).SetAddress(ep());

		TInetAddr::Cast(record.iAddr).SetScope(ep().iScope);

		// ep is closed implicitly by destructor

		return res;

		}

	return KErrNotSupported;

	}

TInt CProtocolKey::SetOption(TUint aLevel, TUint aName,const TDesC8& aOption, CProtocolBase* /*aSourceProtocol*/)

	/**

	* Supported SetOpt's for the PFKEY socket

	*

	* PFKEY SAP SetOption calls this.

	*

	* @param aLevel The option level

	* @param aName	The option name

	* @param aOption The option argument

	* @param aSourceProtocol Not used.

	*

	* Set Named EndPoint.

	* @code aLevel = KSolIpsecControl, aName = KSoIpsecEndpoint, aOption = TNameRecord

	* @endcode

	*/

	{

	if (aLevel == KSolIpsecControl && aName == KSoIpsecEndpoint)

		{

		// Set the named end point (TNameRecord::iName) to specified address (TNameRecord::iAddr).

		if (aOption.Length() != sizeof(TNameRecord))

			return KErrArgument;

		const TNameRecord &record = (const TNameRecord &)*aOption.Ptr();

		// ** should check that TNameRecord::iName and iAddr are valid TBuf

		// ** descriptors which do not cause a panic, when accessed! How?

		RIpAddress ep;

		TInt res = ep.Open(iEndPointCollection, record.iName, TIpAddress(record.iAddr));

		if (res != KErrNone)

			return res;

		// Need to look if this EP is already recorded

		// If the EP reference is not stored any other place, it would

		// get deleted automaticly. Thus, need to record the EP's that

		// have been set with SetOpt, so that they stay around even if

		// no other reference exist yet.

		const TInt count = iEndPoints.Count();

		for (TInt i = count; --i >= 0; )

			{

			if (&iEndPoints[i]() == &ep())	// (Compare TIpAddress pointers directly)

				return KErrNone;			// Already recorded, nothing else to do.

			}

		// Unfortunately RArray Append does not execute RIpAddress copy

		// constructor or assignment, need to do some arm twisting here...

		RIpAddress dummy;

		res = iEndPoints.Append(dummy);

		if (res == KErrNone)

			{

			// Try with assigment...

			iEndPoints[count] = ep;

			}

		return res;

		// ep is closed implicitly by destructor

		}

	return KErrNotSupported;

	}

void CProtocolKey::SetAlgorithms(CAlgorithmList*& aList)

	/**

	* Receive Algorithm map from the policy.

	*

	* @param aList The algorithm mapping.

	*/

	{

	ASSERT(iCrypto != NULL);	// Should never happen.

	iCrypto->SetAlgorithms(aList);

	}

void CProtocolKey::Deliver(const TPfkeyMessage &aMsg)

	/**

	* Deliver PFKEY Messages to SAP's that are willing to receive them.

	*

	* @param aMsg	The PFKEY message

	*/

	{

	CProviderKey* sap;

	TDblQueIter<CProviderKey> iter(iSAPlist);

	while (sap = iter++, sap != NULL)

		{

		sap->Deliver(aMsg);

		}

	LOG(aMsg.LogPrint(_L("---->"), iCrypto->Algorithms()));

	}

void CProtocolKey::DeliverRegistered(const TPfkeyMessage &aMsg)

	/**

	* Deliver PFKEY Messages selectively.

	*

	* Same as CProtocolKey::Deliver, but sends message only to SAP's that

	* have REGISTERED for this type of Security Associtation.

	*

	* @param aMsg	The PFKEY message

	*/

	{

	CProviderKey* sap;

	TDblQueIter<CProviderKey> iter(iSAPlist);

	TUint i = aMsg.iBase.iMsg->sadb_msg_satype;

	TUint8 m = (TUint8)(1 << (i % 8));

	i = i / 8;

	while (sap = iter++, sap != NULL)

		if (sap->iRegistered[i] & m)

			{

			sap->Deliver(aMsg);

			}

	LOG(aMsg.LogPrint(_L("---->"), iCrypto->Algorithms()));

	}