FCL/sf/os/networkingsrv: comparison networksecurity/ipsec/ipsec6/src/sc

equal deleted inserted replaced

-:abbed5a4b42a
+:8d540f55e491
-// Copyright (c) 2006-2009 Nokia Corporation and/or its subsidiary(-ies).
+// Copyright (c) 2006-2010 Nokia Corporation and/or its subsidiary(-ies).
 // All rights reserved.
 // This component and the accompanying materials are made available
 // under the terms of "Eclipse Public License v1.0"
 // which accompanies this distribution, and is available
 // at the URL "http://www.eclipse.org/legal/epl-v10.html".
 // sc_prt.cpp - IPv6/IPv4 security check protocol
 // An instance of a procotol that hooks into IP protocol instance,
 // performing IPSEC checking and processing to packets.
 //
+#include <featdiscovery.h>
+#include <featureuids.h>
 #include <posthook.h>
 #include <icmp6_hdr.h>
 #include <udp_hdr.h>
 #include <in_pkt.h>
 		CPolicyAction **aItems, RIpAddress *aSrc, TInt &aTunnels) const;
 	void UpdateTunnelInterface(RMBufRecvInfo &aInfo, const CSecurityAssoc *const aSa) /*const*/;
 	void CheckPacketId(RMBufHookPacket &aPacket);
 	TInt CheckFragmentPolicy();
+	void CheckExceptionSelector(TBool &aException_flag) const; //To support UMA
+	void CheckFeatureSupportL(TUid aFeature); //To check a Feature is enabled or not
 	MAssociationManager *iAssociationManager;
 	CProtocolIpsec *iProtocolIpsec;
 	MEventService *iEventService;
 	CSecurityPolicy* iPolicy;
 	TDblQue<CProviderSecpol> iSAPlist;
 	RSecurityAssociation iSA[KIpsecMaxNesting];	//< Used Security associations.
 	RIpAddress iTunnel[KIpsecMaxNesting];		//< Related tunnel addresses (outer source)
 	RIpAddress iMyself[KIpsecMaxNesting];		//< Related destination adresses (outer).
 	// List of incomplete fragmented packets.
 	CIpsecFragmentInfo *iFrags;					//< Unfinished fragments.
+	TBool iIPSecGANSupported; //To check whether FF_IPSEC_UMA_SUPPORT_ENABLE is defined and UMA supported
 	};
 void IPSEC::IdentifySecpol(TServerProtocolDesc &aEntry)
 	/**
 		buf.Append(_L("outbound "));
 		break;
 	default:
 		break;
 		}
+	//UMA support REQ417-40027
+	switch (aPS.iFilterData & KPolicyFilter_Exception)
+	    {
+	    case KPolicyFilter_Exception:
+	        buf.Append(_L("UMAExceptionTrafficSelector"));
+	        break;
+	    default:
+	        break;
+	    }
 	if (aPS.iInterface)
 		buf.AppendFormat(_L("if=%d "), aPS.iInterface->iInterfaceIndex);
 	for (CTransportSelector *ts = aPS.iTS; ts != NULL; ts = ts->iOr)
 		{
 		LogAddressSelector(buf, _L("remote="), ts->iData.iRemote(), ts->iMask.iRemote());
 	*/
 	{
 	TInt result = EIpsec_NoSelectorMatch;
 	aTunnels = 0;
 	TInt i = 0;
+	//UMA support REQ417-40027
+TBool exception_flag = EFalse;
+TBool exception_drop_flag = EFalse;
+if (iIPSecGANSupported)
+{
+//Check for exception selector being loaded or not. This is required for Drop mode policy
+//If policy is set as
+//                  inbound = drop
+//                  outbound = drop
+// then instead returning Excetion selectors should be checked.
+CheckExceptionSelector(exception_flag);
+}
 	for (CPolicySelector *ps = iPolicy->iSelectors; ps != NULL; ps = ps->iNext)
 		{
 		// 1. Check filtering
 		if (((aFilter.iFlags ^ ps->iFilterData) & ps->iFilterMask) ||
 			(ps->iInterface && ps->iInterface->iInterfaceIndex != aFilter.iIndex))
 			continue;	// -- this selector filtered out, try next.
 		// 2. check transport selectors (empty TS matches all)
 		if (ps->iTS == NULL || ps->iTS->Match(aKey))
 			{
 			if (ps->iFilterData & KPolicyFilter_DROP)
-				return EIpsec_NoSelectorMatch;
+{
+// UMA support REQ 417-40027
+if (iIPSecGANSupported && exception_flag)
+			       {
+//Work around for Exceptions
+exception_drop_flag = ETrue;
+break;
+			       }
+return EIpsec_NoSelectorMatch;
+}
 			const TInt N = ps->iActions.Count();
 			for (TInt k = 0; k < N; k++)
 				{
 				CPolicyAction *const action = ps->iActions[k];
 					AfterTunnelAction(aKey);
 					// Return list of source addresses, if the target array is supplied
 					if (aSrc)
 						aSrc[aTunnels] = aKey.iLocal;
 					aTunnels++;
-					}
+}//if action
-				}
+}//for
-			result = i;
+//UMA support REQ417-40027
-			if (ps->iFilterData & KPolicyFilter_FINAL)
+if(iIPSecGANSupported)
-				break;	// Final selector, no merge allowed!
+{
-			aFilter.iFlags |= KPolicyFilter_MERGE;	// Mark "merge only".
+if(!exception_drop_flag)
-			}
+	  		{
-		}
+//Check if drop mode is set with exception selectors...out from this result loop
-	return result;
+//and jump onto Expection selector handling.
+result = i;
+if (ps->iFilterData & KPolicyFilter_FINAL)
+break;  // Final selector, no merge allowed!
+aFilter.iFlags |= KPolicyFilter_MERGE;  // Mark "merge only".
+				}
+}
+else
+{
+result = i;
+if (ps->iFilterData & KPolicyFilter_FINAL)
+break;  // Final selector, no merge allowed!
+aFilter.iFlags |= KPolicyFilter_MERGE;  // Mark "merge only".
+}
+}
+}
+	if (iIPSecGANSupported)
+	    {
+if (result == EIpsec_NoSelectorMatch && exception_flag)
+{
+// No selector matches above. Check for Exception selector
+for (CPolicySelector *ps = iPolicy->iSelectors; ps != NULL; ps = ps->iNext)
+{
+if(((ps->iFilterData & KPolicyFilter_Exception) !=  KPolicyFilter_Exception))
+{
+//Skip till Exception selector is loaded
+continue;
+}//if
+else
+{
+if (ps->iInterface && ps->iInterface->iInterfaceIndex != aFilter.iIndex)
+{
+continue; ////Sanity Check;
+}
+if(aFilter.iFlags & KPolicyFilter_OUTBOUND )
+{
+//Check for Scopes for packet going out. Scope should be the tunnel end networkID configured for Tunnel need Exception
+TIpAddress iAddr = aKey.iLocal();
+TInt scope = iAddr.iScope;
+if(scope == ps->iScope_Exception)
+{
+LOG(Log::Printf(_L("Exception outbound- \n exception scope = %d\n, packet scope = %d\n"), ps->iScope_Exception, scope));
+result = NULL;
+break;
+}
+}//outbound filter
+if(aFilter.iFlags & KPolicyFilter_INBOUND)
+{
+//TODO comments
+TIpAddress iAddr = aKey.iRemote();
+TInt scope = iAddr.iScope;
+if(scope== ps->iScope_Exception)
+{
+LOG(Log::Printf(_L("Exception inbound- \n exception scope = %d\n ,packet scope = %d\n"), ps->iScope_Exception, scope));
+result = NULL;
+break;
+}
+}//INBOUND
+}//else
+}//for
+}//exception CHECK
+}///if (iIPSecGANSupported)
+		return result;
 	}
 MFlowHook *CProtocolSecpol::OpenL(TPacketHead &aHead, CFlowContext *aFlow)
 		}
 	iPktInfo.iLocal.Set(aHead.ip6.SrcAddr(), aHead.iSrcId);
 	iPktInfo.iRemote.Set(aHead.ip6.DstAddr(), aHead.iDstId);
 	CPolicyAction *items[KIpsecMaxNesting];		// Collected actions [0..count-1]
 	TInt tunnels = 0;
 	LOG(LogSelectorInfo(_L("OpenL\t"), iPktInfo, filter));
 	RPolicySelectorInfo final_info = iPktInfo;
 	TInt count = CollectBundle(filter, final_info, KIpsecMaxNesting, items, iMyself, tunnels);
 	if (count < 0)
 					break;
 				}
 			}
 		// Not an ICMP or normal ICMP, do the policy check with current info
 		}
+//Check for the UMA feature support
+CheckFeatureSupportL(NFeature::KFeatureIdFfIpsecUmaSupportEnable);
 	for (;;)
 		{
 		CPolicyAction *items[KIpsecMaxNesting];
 		TInt tunnels = 0;
 			TBuf<6> seq;
 			seq.AppendFormat(_L("%3d.\t"), ++i);
 			LogPolicySelector(seq, *ps);
 			if (ps->iFilterData & KPolicyFilter_DROP)
 				Log::Printf(_L("\t\t*DROP*"));
+			//UMA support REQ417-40027
+			if(ps->iFilterData & KPolicyFilter_Exception)
+			    Log::Printf(_L("\t\t = { UMAException %d }"),ps->iScope_Exception);
 			else if (N == 0)
 				Log::Printf(_L("\t\t*PASS*"));
 			else
 				{
 				for (TInt i = 0; i < N; ++i)
 				}
 			// Can allways call free (if Deliver() took the packet, this is NOP)
 			copy.Free();
 			}
 	}
+void CProtocolSecpol::CheckFeatureSupportL(TUid aFeature)
+{
+// Check Gan support from feature manager
+iIPSecGANSupported = CFeatureDiscovery::IsFeatureSupportedL(aFeature);
+if(iIPSecGANSupported != (TInt)ETrue)
+		{
+		LOG(Log::Printf(_L("CProtocolSecpol::CheckFeatureSupport Error Checking Feature Support ")));
+		}
+		else
+		{
+		LOG(Log::Printf(_L("CProtocolSecpol::CheckFeatureSupport %d Feature Supported %d"),aFeature,iIPSecGANSupported));
+		}
+}
+//UMA support
+//Check for exception selector being loaded or not. This is required for Drop mode policy
+//If policy is set as
+//                  inbound = drop
+//                  outbound = drop
+// then instead returning Excetion selectors should be checked.
+void CProtocolSecpol::CheckExceptionSelector(TBool &aException_flag) const
+{
+aException_flag = EFalse;
+if(iIPSecGANSupported)
+{
+for(CPolicySelector *policy_Exception = iPolicy->iSelectors; policy_Exception != NULL ; policy_Exception = policy_Exception->iNext)
+{
+if(((policy_Exception->iFilterData & KPolicyFilter_Exception) ==  KPolicyFilter_Exception))
+{
+aException_flag = ETrue;
+break;
+}//if
+}//for
+}//if
+else
+{
+LOG(Log::Printf(_L("CProtocolSecpol::CheckExceptionSelector  Feature is not Supported")));
+}
+}

branch	RCL_3
changeset 58	8d540f55e491
parent 57	abbed5a4b42a
child 75	c1029e558ef5