1 /*

     2 * Copyright (c) 2002-2004 Nokia Corporation and/or its subsidiary(-ies). 

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description: Implementation of policymanagement components

    15 *

    16 */

    17 

    18 

    19 // INCLUDE FILES

    20 

    21 #include "PolicyManager.h"

    22 #include "elements.h"

    23 #include "DataTypes.h"

    24 #include "PolicyParser.h"

    25 #include "ElementBase.h"

    26 #include "PolicyProcessor.h"

    27 #include "TrustedSession.h"

    28 #include "ErrorCodes.h"

    29 #include "OperationParser.h"

    30 #include "OperationParserConstants.h"

    31 #include "SettingEnforcementManager.h"

    32 #include "PolicyEngineServer.h"

    33 #include "PolicyEngineXACML.h"

    34 #include "debug.h"

    35 

    36 

    37 #include "DMUtilClient.h"

    38 #include <PolicyEngineClientServer.h>

    39 #include <ManagementContext.h>

    40 

    41 

    42 // CONSTANTS

    43 const TInt KMaxServerIdLength = 250;

    44 

    45 // -----------------------------------------------------------------------------

    46 // CPolicyManager::CPolicyManager()

    47 // -----------------------------------------------------------------------------

    48 //

    49 

    50 CPolicyManager::CPolicyManager( CPolicyProcessor * aPolicyProcessor)

    51 	: CActive( EPriorityLow),  iPolicyProcessor( aPolicyProcessor)

    52 {

    53 	iPolicyStorage = CPolicyStorage::PolicyStorage();

    54 }

    55 

    56 // -----------------------------------------------------------------------------

    57 // CPolicyManager::~CPolicyManager()

    58 // -----------------------------------------------------------------------------

    59 //

    60 

    61 CPolicyManager::~CPolicyManager()

    62 {

    63 	//CSettingEnforcementManager

    64 	delete iSEManager;

    65 

    66 	//descriptors used in operations 

    67 	delete iActiveChildList;

    68 	delete iActiveXACMLContent;

    69 	delete iActiveElementList;

    70 	delete iOperationParser;

    71 	delete iCurrentManagementCommand;

    72 	

    73 	CPolicyEngineServer::RemoveActiveObject( this);

    74 }

    75 

    76 // -----------------------------------------------------------------------------

    77 // CPolicyManager::ConstructL()

    78 // -----------------------------------------------------------------------------

    79 //

    80 void CPolicyManager::ConstructL()

    81 {

    82 	CPolicyEngineServer::AddActiveObjectL( this);

    83 	iSEManager = CSettingEnforcementManager::NewL();

    84 }

    85 

    86 // -----------------------------------------------------------------------------

    87 // CPolicyStorage::NewL()

    88 // -----------------------------------------------------------------------------

    89 //

    90 

    91 CPolicyManager * CPolicyManager::NewL( CPolicyProcessor * aPolicyProcessor)

    92 {

    93 	CPolicyManager * self = new(ELeave) CPolicyManager( aPolicyProcessor);

    94 	

    95 	CleanupStack::PushL( self);

    96 	self->ConstructL();

    97 	CleanupStack::Pop( self);

    98 	

    99 	return self;

   100 	

   101 }

   102 

   103 // -----------------------------------------------------------------------------

   104 // CPolicyManager::ExecuteOperationL()

   105 // -----------------------------------------------------------------------------

   106 //

   107 

   108 void CPolicyManager::ExecuteOperation( CTrustedSession * aSession, const RMessage2& aMessage)

   109 {

   110 	iMessage = &aMessage;

   111 

   112 	//Only one management session is accepted

   113 	if ( CPolicyEngineServer::StatusFlags()->iManagementActive )

   114 	{

   115 		CompleteOperation( KErrInUse);

   116 		return;

   117 	}

   118 	

   119 	CPolicyEngineServer::StatusFlags()->iManagementActive = ETrue;

   120 

   121 

   122 	//set pointer to trusted session and save reference to RMessage

   123 	iTrustedSession = aSession;

   124 	

   125 	//initialize states

   126 	iOperationStatus = 0;

   127 	iUseBearerCertificate = EFalse;

   128 	iCertificateUpdates = EFalse;

   129 

   130 	

   131 	//Add this active object active scheduler	

   132 	if ( !IsAdded())

   133 	{

   134 		CActiveScheduler::Add( this);

   135 	}

   136 	

   137 	//Complete own request

   138 	SetActive();

   139 	TRequestStatus * status = &iStatus;

   140 	User::RequestComplete( status, KErrNone);

   141 }

   142 

   143 

   144 

   145 // -----------------------------------------------------------------------------

   146 // CPolicyManager::RunL()

   147 // -----------------------------------------------------------------------------

   148 //

   149 

   150 void CPolicyManager::RunL()

   151 {

   152 	CPolicyEngineServer::SetActiveSubSession( this);	

   153 

   154 	//management operations are allowed only when server is free

   155  	if ( CPolicyEngineServer::StatusFlags()->iProcessorActive )

   156 	{

   157 		SetActive();

   158 		TRequestStatus * status = &iStatus;

   159 		User::RequestComplete( status, KErrNone);

   160 		return;		

   161 	}

   162 

   163 	if ( iOperationStatus == 0)

   164 	{

   165 		//Start management session for next operations

   166 		iPolicyStorage->StartCommitSessionL();

   167 	

   168 		iCurrentManagementCommand = HBufC8::NewL( iMessage->GetDesLength(0));

   169 		//Read policy description	

   170 		TPtr8 ptr = iCurrentManagementCommand->Des(); 

   171 		iMessage->ReadL(0, ptr, 0);

   172 		iOperationParser = COperationParser::NewL( ptr);

   173 	

   174 		//parse operations, "iMsg" stores error message

   175 		iOperationParser->ParseOperationsL( iMsg);

   176 	}

   177 	else if ( (iOperationStatus - 1) < iOperationParser->OperationCount())

   178 	{

   179 		//Execute operations, "this" is pointer to callback function 

   180 		iCertificateUpdates = EFalse;

   181 		iOperationParser->ExecuteL( iOperationStatus - 1, this);

   182 		

   183 		if ( iCertificateUpdates)

   184 		{

   185 			CPolicyEngineServer::CertificateMaps()->NewMappingsAvailable();

   186 		}			

   187 	}

   188 	

   189 	if ( iOperationStatus == iOperationParser->OperationCount() + 2)

   190 	{

   191 		//Finish management session and commit changes in repository

   192 		iMsg = ManagementErrors::OperationOk;

   193 		

   194 		if ( iStatus.Int() == KErrNone)

   195 		{

   196 			CommitChangesL();	

   197 			CompleteOperation( iStatus.Int());

   198 			CPolicyStorage::PolicyStorage()->ReleaseElements();

   199 		}

   200 		else

   201 		{

   202 			RunError( iStatus.Int());			

   203 		}

   204 		

   205 	}

   206 	else

   207 	if ( iOperationStatus == iOperationParser->OperationCount() + 1)

   208 	{

   209 		//Make setting enforcements...

   210 		MakeEnforcementL( KErrNone);

   211 	}

   212 	else

   213 	{

   214 		SetActive();

   215 		TRequestStatus * status = &iStatus;

   216 		User::RequestComplete( status, KErrNone);

   217 	}

   218 

   219 	iOperationStatus++;

   220 }

   221 

   222 // -----------------------------------------------------------------------------

   223 // CPolicyManager::DoCancel()

   224 // -----------------------------------------------------------------------------

   225 //

   226 

   227 void CPolicyManager::DoCancel()

   228 {

   229 	RunError( KErrAbort);

   230 }

   231 

   232 // -----------------------------------------------------------------------------

   233 // CPolicyManager::DoCancel()

   234 // -----------------------------------------------------------------------------

   235 //

   236 

   237 TInt CPolicyManager::RunError( TInt aError)

   238 {

   239 	RDEBUG("CPolicyManager::RunError");

   240 	RDEBUG8_2("Policy engine operation error message: %S", &iMsg);

   241 

   242 	//restores possible changes in policy storage

   243 	TRAPD( err, iPolicyStorage->CommitChangesL( EFalse))

   244 	

   245 	if ( err != KErrNone )

   246 	{

   247 		aError = err;	

   248 	}

   249 

   250 	//complete operation

   251 	CompleteOperation( aError);	

   252 	

   253 	return KErrNone;

   254 }

   255 

   256 // -----------------------------------------------------------------------------

   257 // CPolicyManager::MakeEnforcementL()

   258 // -----------------------------------------------------------------------------

   259 //

   260 

   261 void CPolicyManager::MakeEnforcementL( TInt aError)

   262 {

   263 	//initialize enforcement session

   264 	iSEManager->StartEnforcementSessionL( iStatus, iTrustedSession->SessionCertificate());

   265 

   266 	//get modified elements 

   267 	iPolicyStorage->GetEditedElementsL( iSEManager);

   268 	

   269 	//start enforcement session enforcement policies

   270 	if ( aError == KErrNone)

   271 	{

   272 		iSEManager->ExecuteEnforcementSessionL();

   273 	}

   274 

   275 	

   276 	//set active (waiting for enforcement completing)

   277 	SetActive();	

   278 }

   279 

   280 // -----------------------------------------------------------------------------

   281 // CPolicyManager::CompleteOperation()

   282 // -----------------------------------------------------------------------------

   283 //

   284 

   285 void CPolicyManager::CompleteOperation( TInt aError )

   286 	{

   287 	RDEBUG_2("CPolicyManager::CompleteOperation( %d )", aError );

   288 

   289 	if( aError != KErrNone && aError != KErrParser && KErrOpParser != aError && KErrPolicyManager != aError)

   290 		{

   291 		iMsg = KNullDesC8;

   292 		aError = KErrGeneral;

   293 		}

   294 	else

   295 		{

   296 		aError = KErrNone;

   297 		}

   298 

   299 	//finish storage session and enforcement session

   300 	iPolicyStorage->ResetEditableMemory();

   301 	iSEManager->EndEnforcementSession( KErrNone == aError );

   302 

   303 	if ( iCertificateUpdates )

   304 		{

   305 		CPolicyEngineServer::CertificateMaps()->NewMappingsAvailable();

   306 		}	

   307 

   308 	CPolicyEngineServer::StatusFlags()->iManagementActive = EFalse;

   309 	

   310 	//release resources

   311 	delete iOperationParser;

   312 	iOperationParser = NULL;

   313 	delete iCurrentManagementCommand;

   314 	iCurrentManagementCommand = NULL;

   315 

   316 	//write return message to client process

   317 	TParserResponse response( iMsg);

   318 	TPckgC<TParserResponse> retPack(response);

   319 	TRAPD( err, iMessage->WriteL( 1, retPack ) );

   320 	if( err != KErrNone )

   321 		{

   322 		iMessage->Complete( err );

   323 		return;

   324 		}

   325 

   326 	iMessage->Complete( aError);

   327 	}

   328 

   329 // -----------------------------------------------------------------------------

   330 // CPolicyManager::UpdateStateFlags()

   331 // -----------------------------------------------------------------------------

   332 //

   333 void CPolicyManager::UpdateStateFlagsL()

   334 {

   335 	RDEBUG("CPolicyManager::UpdateStateFlagsL - start");

   336 

   337 	RDMUtil dmutil;

   338 	User::LeaveIfError( dmutil.Connect());

   339 	CleanupClosePushL( dmutil);

   340 	TBool securityActive = EFalse;

   341 	User::LeaveIfError( dmutil.UpdatePolicyMngStatusFlags( EPolicyChanged));

   342 	

   343 	//Check is terminal security activated

   344 	CElementBase * iElement = iPolicyStorage->GetElementL( PolicyLanguage::Constants::RolesMappingPolicy);	

   345 	if (iElement)

   346 	{

   347 		TElementReserver reserver(iElement);

   348 

   349 		iPolicyStorage->CheckElementL(iElement);

   350 

   351 		

   352 		//check child elements, any rule child means that terminal security is acticated

   353 		for (TInt i(0); i < iElement->ElementCount(); i++) {

   354 			CElementBase * element = iElement->Element(i);

   355 

   356 			if (element->ElementType() == ERule) {

   357 				RDEBUG("CPolicyManager::UpdateStateFlagsL -> securityActive = ETrue");

   358 				securityActive = ETrue;

   359 				break;

   360 			}

   361 		}

   362 		reserver.Release();

   363 	}

   364 	

   365 	//update policy management flags	

   366 	if ( securityActive)

   367 	{

   368 		User::LeaveIfError( dmutil.UpdatePolicyMngStatusFlags( ETerminalSecurityActive));

   369 	}

   370 	else

   371 	{

   372 		User::LeaveIfError( dmutil.UpdatePolicyMngStatusFlags( ETerminalSecurityDeactive));

   373 	}

   374 

   375 	

   376 	CleanupStack::PopAndDestroy( &dmutil);

   377 

   378 	RDEBUG("CPolicyManager::UpdateStateFlagsL - end");

   379 }

   380 

   381 

   382 

   383 

   384 

   385 // -----------------------------------------------------------------------------

   386 // CPolicyManager::CommitChangesL()

   387 // -----------------------------------------------------------------------------

   388 //

   389 void CPolicyManager::CommitChangesL()

   390 {

   391 	//Accept or decline changes to storage...

   392 	iPolicyStorage->SaveEditableMemoryL();

   393 

   394 	//This ensures that enforcement settings are committed

   395 	iSEManager->CommitChanges();	

   396 		

   397 	//This ensures that all changes are commited (also enforcement)

   398 	iPolicyStorage->CommitChangesL( ETrue);	

   399 	

   400 	//update state flags

   401 	UpdateStateFlagsL();

   402 	

   403 	RDEBUG8_2("Policy engine operation message: %S", &iMsg);

   404 }

   405 

   406 

   407 // -----------------------------------------------------------------------------

   408 // CPolicyManager::NewPolicy()

   409 // -----------------------------------------------------------------------------

   410 //

   411 

   412 void CPolicyManager::NewElementL( const TInt& aLineOffset, const TDesC8& aTargetElement, const TDesC8& aElementDescription, const TBool& aUseBearerCertificate )

   413 {

   414 	RDEBUG("PolicyEngineServer: CPolicyManager::NewElementL");

   415 

   416 	//initialize policy parser...

   417 	CPolicyParser * parser = CPolicyParser::NewL( iPolicyStorage);

   418 	CleanupStack::PushL( parser);

   419 	parser->SetExternalIdChecked( KNoExternalIdConflictsAllowed);

   420 	parser->SetLineOffset( aLineOffset);

   421 	iUseBearerCertificate = aUseBearerCertificate;

   422 

   423 	//Parse native model from XACML description

   424 	TInt err(KErrNone);	

   425 	TBuf8<KMaxReturnMessageLength> msg;

   426 	CElementBase * element = parser->ParseXACMLObjects( err, aElementDescription, msg);	

   427 	CleanupStack::PopAndDestroy( parser); //Parser

   428 

   429 	if ( err != KErrNone )

   430 	{

   431 		iMsg = msg;

   432 		User::Leave( KErrParser);	

   433 	}

   434 	

   435 

   436 	//Add element to policy storage (storage take responsibility to delete object)

   437 	RDEBUG_2("PolicyEngineServer: Element parsed and id created(id %d)", element->GetId());

   438 

   439 	element->CreateIdL();

   440 	element->CreateExternalId();

   441 	iPolicyStorage->AddNewElementL( element);

   442 	TElementReserver newElement( element);

   443 		

   444 	//Check is the policy valid and if so, add element to temporary storage

   445 	AssignElementL( aTargetElement, element);

   446 	

   447 	newElement.Release();

   448 }

   449 

   450 // -----------------------------------------------------------------------------

   451 // CPolicyManager::ReplaceElementL()

   452 // -----------------------------------------------------------------------------

   453 //

   454 void CPolicyManager::ReplaceElementL( const TInt& aLineOffset, const TDesC8& aTargetElement, const TDesC8& aElementDescription )

   455 {

   456 	RDEBUG("PolicyEngineServer: CPolicyManager::ReplaceElementL");

   457 

   458 	//initialize policy parser...

   459 	CPolicyParser * parser = CPolicyParser::NewL( iPolicyStorage);

   460 	CleanupStack::PushL( parser);

   461 	parser->SetExternalIdChecked( KSameExternalIdAllowedForRoot);

   462 	parser->SetLineOffset( aLineOffset);

   463 

   464 	//Parse native model from XACML description

   465 	TInt err(KErrNone);	

   466 	TBuf8<KMaxReturnMessageLength> msg;

   467 	CElementBase * element = parser->ParseXACMLObjects( err, aElementDescription, msg);	

   468 	CleanupStack::PopAndDestroy( parser); //Parser

   469 

   470 	if ( err != KErrNone )

   471 	{

   472 		iMsg = msg;

   473 		User::Leave( KErrParser);	

   474 	}

   475 	

   476 

   477 	//Add element to policy storage (storage take responsibility to delete object)

   478 	RDEBUG_2("PolicyEngineServer: Element parsed and id created(id %d)", element->GetId());

   479 

   480 	element->CreateIdL();

   481 	element->CreateExternalId();

   482 	iPolicyStorage->AddNewElementL( element);

   483 	TElementReserver newElement( element);

   484 		

   485 	//Check is the policy valid and if so, add element to temporary storage

   486 	ReAssignElementL( aTargetElement, element);

   487 	

   488 	newElement.Release();

   489 	

   490 }

   491 

   492 

   493 // -----------------------------------------------------------------------------

   494 // CPolicyManager::AssignPolicyL()

   495 // -----------------------------------------------------------------------------

   496 //

   497 

   498 void CPolicyManager::AssignElementL( const TDesC8& aTargetElement, CElementBase * aElement)

   499 {

   500 	RDEBUG("PolicyEngineServer: CPolicyManager::AssignElementL");

   501 

   502 	//get parent element and load it

   503 	CElementBase * parentElement = iPolicyStorage->GetEditableElementL( aTargetElement);

   504 

   505 	//if parent eleemnt is valid

   506 	if ( !parentElement)

   507 	{

   508 		RDEBUG("PolicyEngineServer: Target element not found");

   509 		iMsg = ManagementErrors::ElementNotFound;

   510 		User::Leave( KErrPolicyManager);

   511 	}

   512 	

   513 	TElementReserver assignReserver( parentElement);

   514 	iPolicyStorage->CheckElementL( parentElement);

   515 

   516 	//add parant id to components

   517 	aElement->AddParentIdL( parentElement->GetId());

   518 

   519 	//Check is assignment acceptable

   520 	IsAssigmentAcceptableL( parentElement, aElement, ETrue);

   521 	assignReserver.Release();

   522 	

   523 

   524 	//Add element to parent element, check is assigment valid

   525 	parentElement->AddIdElementL( aElement);

   526 	parentElement->iElementState = EEditedElement;

   527 }

   528 

   529 // -----------------------------------------------------------------------------

   530 // CPolicyManager::AssignPolicyL()

   531 // -----------------------------------------------------------------------------

   532 //

   533 

   534 void CPolicyManager::ReAssignElementL( const TDesC8& aTargetElement, CElementBase * aElement)

   535 {

   536 	RDEBUG("PolicyEngineServer: CPolicyManager::ReAssignElementL");

   537 

   538 	//get replaced element and load it

   539 	CElementBase * replacedElement = iPolicyStorage->GetEditableElementL( aTargetElement);

   540 

   541 	//check that element is valid

   542 	if ( !replacedElement)

   543 	{

   544 		RDEBUG("PolicyEngineServer: Target element not found");

   545 		iMsg = ManagementErrors::ElementNotFound;

   546 		User::Leave( KErrPolicyManager);

   547 	}

   548 	

   549 	//Check element

   550 	TElementReserver assignReserver( replacedElement);

   551 	iPolicyStorage->CheckElementL( replacedElement);

   552 

   553 	//copy parents to new element

   554 	aElement->AddParentIdL( replacedElement->iParentId);

   555 		

   556 	//Get parent elements

   557 	CElementBase * parentElement = iPolicyStorage->GetEditableElementL( replacedElement->iParentId);

   558 	

   559 	//check that element is valid

   560 	if ( !parentElement)

   561 	{

   562 		iMsg = ManagementErrors::ElementNotFound;

   563 		User::Leave( KErrPolicyManager);

   564 	}

   565 		

   566 	//Check element

   567 	TElementReserver parentReserver( parentElement);

   568 	iPolicyStorage->CheckElementL( parentElement);

   569 

   570 	//Check is reassignment acceptable

   571 	IsAssigmentAcceptableL( parentElement, aElement, EFalse);

   572 

   573 	//remove child from parent child list

   574 	parentElement->RemoveChild( replacedElement->GetId());

   575 	

   576 	//Add element to parent element and mark to modified

   577 	parentElement->AddIdElementL( aElement);

   578 	parentElement->iElementState = EEditedElement;

   579 	

   580 	//When edited element list is committed all "EDeletedEditableElement"s will be deleted...

   581 	replacedElement->DeleteMarkRecursiveL();

   582 

   583 	

   584 	

   585 	

   586 	parentReserver.Release();

   587 	assignReserver.Release();

   588 }

   589 // -----------------------------------------------------------------------------

   590 // CPolicyManager::RemoveElementL()

   591 // -----------------------------------------------------------------------------

   592 //

   593 

   594 void CPolicyManager::RemoveElementL( const TDesC8& aTargetElement)

   595 {

   596 	RDEBUG("CPolicyManager::RemoveElementL");

   597 

   598 

   599 	iMsg = ManagementErrors::OperationOk;

   600 

   601 	//get parent element and load it

   602 	CElementBase * element = iPolicyStorage->GetEditableElementL( aTargetElement);

   603 	

   604 	//error if element not found

   605 	if ( !element )

   606 	{

   607 		RDEBUG("PolicyEngineServer: Target element not found");

   608 		iMsg = ManagementErrors::ElementNotFound;

   609 		User::Leave( KErrPolicyManager);	

   610 	}

   611 

   612 

   613 	TElementReserver elementReserver( element);

   614 	iPolicyStorage->CheckElementL( element);

   615 

   616 

   617 	if ( element->iParentId)

   618 	{

   619 		//Remove element reference from parent element

   620 

   621 		CElementBase * parentElement = iPolicyStorage->GetEditableElementL( element->iParentId);

   622 		__ASSERT_ALWAYS ( parentElement, User::Panic( Panics::PolicyManagerPanic, KErrGeneral));

   623 			

   624 		//check element, use editable cache

   625 		TElementReserver elementReserver( parentElement);

   626 		iPolicyStorage->CheckElementL( parentElement);

   627 		

   628 		IsRemoveAcceptableL( parentElement, element );

   629 

   630 		TInt err = parentElement->RemoveChild( element->GetId());

   631 	

   632 		if ( err != KErrNone )

   633 		{

   634 			User::Leave( KErrPolicyManager);	

   635 		}

   636 		

   637 		parentElement->iElementState = EEditedElement;

   638 		

   639 		elementReserver.Release();

   640 	}

   641 	

   642 	//When edited element list is committed all "EDeletedEditableElement" will be deleted...

   643 	element->DeleteMarkRecursiveL();

   644 	

   645 	elementReserver.Release();

   646 }

   647 

   648 

   649 // -----------------------------------------------------------------------------

   650 // CPolicyManager::IsAssigmentAcceptable()

   651 // -----------------------------------------------------------------------------

   652 //

   653 

   654 

   655 void CPolicyManager::IsAssigmentAcceptableL( CElementBase * aParentElement, CElementBase * aElement, TBool aNewElement)

   656 {

   657 	RDEBUG("CPolicyManager::IsAssigmentAcceptableL");

   658 

   659 	using namespace PolicyLanguage::Constants;

   660 	using namespace AttributeContainerHelper;

   661 	using namespace PolicyLanguage::NativeLanguage::AttributeValues;

   662 	

   663 	//return if policy check is not needed

   664 	NO_POLICY_CHECK_RETURN;

   665 	RDEBUG_3("CPolicyManager: Parent element (%d) element (%d)", aParentElement->GetId(), aElement->GetId());

   666 

   667 	HBufC8* extId = aParentElement->ExternalId();

   668 	TInt match = extId->CompareF( PolicyLanguage::Constants::RolesMappingPolicy );

   669 	if( (match == 0) && aNewElement )

   670 	{

   671 		RDEBUG("CPolicyManager: Parent element is RolesMappingPolicy. Adding trust for server");

   672 		TInt rolesElements = aParentElement->GetChildElementCountL();

   673 				

   674 		RDEBUG_2("CPolicyManager: rolesElements count (%d)", rolesElements);

   675 		if( rolesElements >= 1 )

   676 		{ 

   677 			RDEBUG("CPolicyManager: Trust already exists");

   678 			iMsg = ManagementErrors::AccessDenied;

   679 			User::Leave( KErrPolicyManager);

   680 		}				

   681 		RDEBUG("CPolicyManager: No trust created yet");

   682 	}

   683 	//setup request context

   684 	iPolicyProcessor->ResetRequestContext();

   685 	iPolicyProcessor->SetTargetElement( aElement);

   686 	iPolicyProcessor->SetSessionTrust( iTrustedSession);

   687 	

   688 	//attribute list for request attributes

   689 	RAttributeContainer attributes;

   690 	CleanupClosePushL( attributes);

   691 	

   692 	//action attributes for meta_policy_Set	

   693 	if ( aNewElement)

   694 	{

   695 		attributes.AppendL( EActionAttributes, CAttribute::NewL( PolicyEngineXACML::KActionId, AddPolicy, StringDataType));

   696 	}

   697 	else

   698 	{

   699 		attributes.AppendL( EActionAttributes, CAttribute::NewL( PolicyEngineXACML::KActionId, ReplacePolicy, StringDataType));

   700 	}

   701 

   702 	//Trusted subject is either trustedsubject of session or trustedsubject used in element to be added.

   703 	//In a cases where new element contains trustedsubject, it is used. Other cases sessions trustedsubject

   704 	

   705 	//Get new element subjectmatch-elements

   706 	RElementArray subjectMatches;

   707 	CleanupClosePushL( subjectMatches);

   708 	aElement->FindAttributesL( ESubjectMatch, subjectMatches);

   709 	

   710 	//util variables

   711 	TPtrC8 trustedSubject( KNullDesC8);

   712 	TBool oneTrustedSubject = EFalse;

   713 		

   714 	//add trusted subject from target element

   715 	for ( TInt i(0); i < subjectMatches.Count(); i++)

   716 	{

   717 		CMatchObject* subjectMatch = (CMatchObject*) subjectMatches[i];

   718 		

   719 		//check attribute id (Certificate id is also trusted subject!)

   720 		TPtrC8 attributeId = subjectMatch->AttributeDesignator()->GetAttributeid();

   721 		if ( attributeId == PolicyEngineXACML::KTrustedSubject || attributeId == PolicyEngineXACML::KCertificate  )

   722 		{

   723 			//Only one target policy is valid

   724 			if ( oneTrustedSubject && trustedSubject.Compare( subjectMatch->AttributeValue()->Data()->Value()) != 0)

   725 			{

   726 				iMsg = ParserErrors::InvalidElement;

   727 				User::Leave( KErrPolicyManager);				

   728 			}

   729 		

   730 			oneTrustedSubject = ETrue;

   731 

   732 			//add trusted subject to attribute list

   733 			trustedSubject.Set( subjectMatch->AttributeValue()->Data()->Value());

   734 			

   735 			//certificates have to be transformed to CASN form

   736 			if ( attributeId == PolicyEngineXACML::KCertificate)

   737 			{

   738 				//create CSubject info

   739 				CCertificateMaps::CSubjectInfo* info = new (ELeave) CCertificateMaps::CSubjectInfo();

   740 				CleanupStack::PushL( info);

   741 				

   742 				//parse CASN info from certificate and add TargetTrustedSubject attribute with CASN value				

   743 				CCertificateMaps::CreateSubjectInfoL( info, trustedSubject);

   744 				attributes.AppendL( ESubjectAttributes, CAttribute::NewL( TargetTrustedSubject, *info->iCASN, StringDataType));

   745 				CleanupStack::PopAndDestroy( info);

   746 			}

   747 			else

   748 			{

   749 				attributes.AppendL( ESubjectAttributes, CAttribute::NewL( TargetTrustedSubject, trustedSubject, StringDataType));

   750 			}

   751 			

   752 		}

   753 	}

   754 	CleanupStack::PopAndDestroy( &subjectMatches);	//subjectMatches

   755 	

   756 	

   757 	

   758 	if ( iUseBearerCertificate )

   759 	{

   760 		if ( !iTrustedSession->CertificatedSession())

   761 		{

   762 			RDEBUG("PolicyEngineServer: Certificated session is required");

   763 			//when bearer certificate is used, session must be certificated

   764 			iMsg = ManagementErrors::SessionMustBeCertificated;

   765 			User::Leave( KErrPolicyManager);				

   766 		}

   767 	

   768 		//add certificate mapping for alias, certificate (TCertInfo) is available inside of trusted session

   769 		CElementBase * rule = iTrustedSession->CreateCertificateMappingL( trustedSubject);

   770 		CleanupStack::PushL( rule);

   771 		

   772 		if ( !rule)

   773 		{

   774 			RDEBUG("PolicyEngineServer: Invalid certificate!");

   775 			iMsg = ManagementErrors::InvalidCertificateMapping;

   776 			User::Leave( KErrPolicyManager);

   777 		}

   778 		else

   779 		{

   780 			rule->CreateIdL();

   781 			rule->CreateExternalId();

   782 			iPolicyStorage->AddNewElementL( rule);

   783 			

   784 			RDEBUG_2("PolicyEngineServer: Auto certifate created (id %d)", rule->GetId());

   785 			

   786 			//add parant id to cert policy

   787 			CElementBase* certMappingPolicy = iPolicyStorage->GetEditableElementL( CertMappingPolicy);

   788 			//if element is not valid

   789 			if (!certMappingPolicy)

   790 			{

   791 				return;

   792 			}

   793 			TElementReserver certReserver( certMappingPolicy);

   794 			iPolicyStorage->CheckElementL( certMappingPolicy);

   795 

   796 			rule->AddParentIdL( certMappingPolicy->GetId());

   797 

   798 			//Add element to parent element, check is assigment valid

   799 			certMappingPolicy->AddIdElementL( rule);

   800 			certMappingPolicy->iElementState = EEditedElement;

   801 			

   802 						

   803 			certReserver.Release();		

   804 						

   805 			CPolicyEngineServer::CertificateMaps()->NewMappingsAvailable();

   806 			iCertificateUpdates = ETrue;			

   807 		}

   808 		CleanupStack::Pop( rule);	

   809 	}

   810 	

   811 

   812 	//add session trusted subject

   813 	if ( iTrustedSession->CertificatedSession())

   814 	{

   815 		attributes.AppendL( ESubjectAttributes, 

   816 				CAttribute::NewL( PolicyEngineXACML::KTrustedSubject, iTrustedSession->CASNForSessionL(), StringDataType));

   817 		attributes.AppendL( ESubjectAttributes, 

   818 				CAttribute::NewL( PolicyEngineXACML::KRoleId, iTrustedSession->CASNForSessionL(), StringDataType));

   819 	}

   820 	else

   821 	{

   822 		attributes.AppendL( ESubjectAttributes, 

   823 				CAttribute::NewL( PolicyEngineXACML::KSubjectId, iTrustedSession->SIDForSession(), StringDataType));

   824 	}

   825 

   826 	//certificate mapping must be checked first!! 

   827 	if ( *aParentElement->ExternalId() == CertMappingPolicy)

   828 	{

   829 		TBool validCertificate = EFalse;

   830 		TRAPD( err, validCertificate = iTrustedSession->IsCertificateMappingValidL( aElement))

   831 	

   832 		if ( !validCertificate || err != KErrNone)

   833 		{

   834 			RDEBUG("PolicyEngineServer: Invalid certificate mapping!");

   835 			iMsg = ManagementErrors::InvalidCertificateMapping;

   836 			User::Leave( KErrPolicyManager);

   837 		}

   838 		

   839 		iCertificateUpdates = ETrue;

   840 	}

   841 	

   842 	

   843 	//parent element for new policy

   844 	attributes.AppendL( EResourceAttributes, CAttribute::NewL( PolicyTargetAttr, *aParentElement->ExternalId(), StringDataType));

   845 

   846 	//make request

   847 	TMatchResponse response;

   848 

   849 	RDEBUG("CPolicyManager - Start request execution");

   850 	iPolicyProcessor->ExecuteRequestL( attributes, response);

   851 	RDEBUG("CPolicyManager - End request execution");

   852 		

   853 	CleanupStack::PopAndDestroy( &attributes);

   854 	RDEBUG("CPolicyManager - CleanupStack::PopAndDestroy( &attributes);");

   855 

   856 	if ( response != EPermit)

   857 	{

   858 		RDEBUG("CPolicyManager - Access denied");

   859 		iMsg = ManagementErrors::AccessDenied;

   860 		User::Leave( KErrPolicyManager);

   861 	}

   862 		

   863 	//add current DM session server id to list which defines server ids which DM operations are silent.

   864 	if ( iUseBearerCertificate)

   865 	{

   866 		AddSilentDMOperationServerIdL();

   867 	}

   868 		

   869 }

   870 	

   871 // -----------------------------------------------------------------------------

   872 // CPolicyManager::IdRemoveAcceptableL()

   873 // -----------------------------------------------------------------------------

   874 //

   875 

   876 void CPolicyManager::IsRemoveAcceptableL( CElementBase* aParentElement, CElementBase* aElement )

   877 	{

   878 	RDEBUG("CPolicyManager::IsRemoveAcceptableL");

   879 

   880 	using namespace PolicyLanguage::Constants;

   881 	using namespace AttributeContainerHelper;

   882 	using namespace PolicyLanguage::NativeLanguage::AttributeValues;

   883 

   884 	//return if policy check is not needed

   885 	NO_POLICY_CHECK_RETURN;

   886 	

   887 	//setup request context

   888 	iPolicyProcessor->ResetRequestContext();

   889 	iPolicyProcessor->SetTargetElement( aElement );

   890 	iPolicyProcessor->SetSessionTrust( iTrustedSession );

   891 	

   892 	//attribute list for request attributes

   893 	RAttributeContainer attributes;

   894 	CleanupClosePushL( attributes );

   895 	

   896 	//action attributes for meta_policy_Set	

   897 	attributes.AppendL( EActionAttributes, CAttribute::NewL( PolicyEngineXACML::KActionId, RemovePolicy, StringDataType));

   898 

   899 	//subject attributes for trusted sessions

   900 	if( iTrustedSession->CertificatedSession() )

   901 		{

   902 		attributes.AppendL( ESubjectAttributes, 

   903 				CAttribute::NewL( PolicyEngineXACML::KRoleId, iTrustedSession->CASNForSessionL(), StringDataType));

   904 		attributes.AppendL( ESubjectAttributes, 

   905 				CAttribute::NewL( PolicyEngineXACML::KTrustedSubject, iTrustedSession->CASNForSessionL(), StringDataType));

   906 		}

   907 	else

   908 		{

   909 		attributes.AppendL( ESubjectAttributes, 

   910 				CAttribute::NewL( PolicyEngineXACML::KSubjectId, iTrustedSession->SIDForSession(), StringDataType));

   911 		

   912 		}

   913 	

   914 	// ======= original certificate mapping ======================

   915 	//search trustedsubject from target element (element to be deleted)

   916 	HBufC8* targetTrustedSubject = iTrustedSession->GetTargetTrustedSubjectL( aElement, ETrue );	

   917 

   918 	//and target element trusted subject to request context....

   919 	if( targetTrustedSubject )

   920 		{

   921 		CleanupStack::PushL( targetTrustedSubject); 

   922 		attributes.AppendL( ESubjectAttributes, CAttribute::NewL( TargetTrustedSubject, *targetTrustedSubject, StringDataType));

   923 		CleanupStack::PopAndDestroy( targetTrustedSubject);

   924 		}

   925 	// ===========================================================

   926 	

   927 	

   928 	// ======= mapped certificates ===============================

   929 	// all certificate mappings, including mapped certificates, are under "cert_mapping_policy"

   930 	CElementBase* certMappings = iPolicyStorage->GetEditableElementL( _L8("cert_mapping_policy") );

   931 	if( certMappings )

   932 		{

   933 		TElementReserver mappedElementReserver( certMappings );

   934 		iPolicyStorage->CheckElementL( certMappings );

   935 	

   936 		RPointerArray<HBufC8> mappedTargetTrustedSubjects;

   937 		iTrustedSession->GetMappedTargetTrustedSubjectL( mappedTargetTrustedSubjects, certMappings, ETrue );

   938 		TInt count = mappedTargetTrustedSubjects.Count();

   939 		if( count )

   940 			{

   941 			for( TInt i = 0; i < count; i++ )

   942 				{

   943 				HBufC8* mappedTargetTrustedSubject = mappedTargetTrustedSubjects[ i ];

   944 				CleanupStack::PushL( mappedTargetTrustedSubject);

   945 				attributes.AppendL( ESubjectAttributes, CAttribute::NewL( PolicyEngineXACML::KCertificateMapped, *mappedTargetTrustedSubject, StringDataType));

   946 				CleanupStack::PopAndDestroy( mappedTargetTrustedSubject ); 

   947 				}

   948 			}

   949 	

   950 		mappedTargetTrustedSubjects.Close();

   951 		mappedElementReserver.Release();

   952 		}

   953 	// ===========================================================

   954 	

   955 	//parent element for new policy

   956 	attributes.AppendL( EResourceAttributes, CAttribute::NewL( PolicyTargetAttr, *aParentElement->ExternalId(), StringDataType));

   957 

   958 	//make request

   959 	TMatchResponse response;

   960 	iPolicyProcessor->ExecuteRequestL( attributes, response );

   961 	CleanupStack::PopAndDestroy( &attributes );

   962 

   963 	if( response != EPermit )

   964 		{

   965 		iMsg = ManagementErrors::AccessDenied;

   966 		User::Leave( KErrPolicyManager );

   967 		}	

   968 	}

   969 	

   970 

   971 // -----------------------------------------------------------------------------

   972 // CPolicyManager::GetElementListL()

   973 // -----------------------------------------------------------------------------

   974 //		

   975 void CPolicyManager::GetElementListL( const RMessage2& aMessage)

   976 {

   977 	

   978 	//element info is two phase operation...

   979 	if ( aMessage.Function() == EGetElementListLength)

   980 	{

   981 		//In first phase descriptor lengths are fetched

   982 

   983 		//Read element types

   984 		TElementType type;

   985 		TPckg<TElementType> typePack( type);

   986 		aMessage.ReadL(0, typePack, 0);

   987 		

   988 		//fetch element

   989 		CElementBase * element = iPolicyStorage->GetElementL( PolicyLanguage::Constants::RootElement);

   990 		

   991 		if ( element)

   992 		{

   993 			//reserve element and check it

   994 			TElementReserver elementReserver( element);

   995 			iPolicyStorage->CheckElementL( element);

   996 			

   997 			//get list length

   998 			TInt length = element->GetElementsListLengthL( type);

   999 	

  1000 			delete iActiveElementList;

  1001 			iActiveElementList = NULL;

  1002 			

  1003 			iActiveElementList = HBufC8::NewL( length);

  1004 			TPtr8 ptr = iActiveElementList->Des();

  1005 			element->GetElementsListL( type, ptr);

  1006 	

  1007 	

  1008 			//write values to client side

  1009 			TPckgC<TInt> intPack( length); 

  1010 			aMessage.WriteL(1, intPack);	

  1011 			

  1012 			elementReserver.Release();

  1013 		}

  1014 		else

  1015 		{

  1016 			User::Leave( KErrNotFound);

  1017 		}

  1018 	}

  1019 	else

  1020 	{

  1021 		// and in second phase descriptor are written to client side

  1022 		if ( iActiveElementList )

  1023 		{

  1024 			aMessage.WriteL(0, *iActiveElementList);	

  1025 		}

  1026 		

  1027 		//delete child list

  1028 		delete iActiveElementList;

  1029 		iActiveElementList = 0;

  1030 	}

  1031 	

  1032 }

  1033 	

  1034 	

  1035 	

  1036 // -----------------------------------------------------------------------------

  1037 // CPolicyManager::GetElementInfoL()

  1038 // -----------------------------------------------------------------------------

  1039 //

  1040 

  1041 

  1042 void CPolicyManager::GetElementInfoL( const RMessage2& aMessage)

  1043 {

  1044 

  1045 

  1046 	//element info is two phase operation...

  1047 	if ( aMessage.Function() == EGetElementDescriptionAndChildListLength)

  1048 	{

  1049 		//In first phase descriptor lengths are fetched

  1050 

  1051 		//Read element id

  1052 		TPtr8 id = HBufC8::NewLC( aMessage.GetDesLength(0))->Des(); 

  1053 		aMessage.ReadL(0, id, 0);

  1054 		

  1055 		//fetch element

  1056 		CElementBase * element = iPolicyStorage->GetElementL( id);

  1057 		

  1058 		if ( element)

  1059 		{

  1060 			//reserve element and check it

  1061 			TElementReserver elementReserver( element);

  1062 			iPolicyStorage->CheckElementL( element);

  1063 			

  1064 			//Create helper pack, which is delivered to client side			

  1065 			TElementInfoHelpPack helper;

  1066 			helper.iDescriptionLength = 0;

  1067 				

  1068 			//get description and child list		

  1069 			iActiveDescription = element->DescriptionL();

  1070 			if ( iActiveDescription)

  1071 			{

  1072 				helper.iDescriptionLength = iActiveDescription->Length();

  1073 			}

  1074 	

  1075 			helper.iChildListLength = element->GetChildListLengthL();

  1076 	

  1077 			//write values to client side

  1078 			TPckgC<TElementInfoHelpPack> helperPack( helper); 

  1079 			

  1080 			delete iActiveChildList;

  1081 			iActiveChildList = NULL;

  1082 			iActiveChildList = HBufC8::NewL( helper.iChildListLength); 

  1083 			TPtr8 ptr = iActiveChildList->Des();

  1084 			element->GetChildListL( ptr);

  1085 	

  1086 			aMessage.WriteL(1, helperPack);	

  1087 			

  1088 			elementReserver.Release();

  1089 		}

  1090 		else

  1091 		{

  1092 			User::Leave( KErrNotFound);

  1093 		}

  1094 		

  1095 		CleanupStack::PopAndDestroy();	//HBufC8

  1096 	}

  1097 	else

  1098 	{

  1099 		// and in second phase descriptor are written to client side

  1100 		if ( iActiveDescription)

  1101 		{

  1102 			aMessage.WriteL(0, *iActiveDescription);	

  1103 		}

  1104 

  1105 		if ( iActiveChildList)

  1106 		{

  1107 			aMessage.WriteL(1, *iActiveChildList);	

  1108 		}

  1109 

  1110 		

  1111 		//description is owned by descriptor element (do not delete)

  1112 		iActiveDescription = 0;

  1113 		//delete child list

  1114 		delete iActiveChildList;

  1115 		iActiveChildList = 0;

  1116 	}

  1117 }

  1118 

  1119 // -----------------------------------------------------------------------------

  1120 // CPolicyManager::GetElementXACMLDescriptionL()

  1121 // -----------------------------------------------------------------------------

  1122 //

  1123 

  1124 void CPolicyManager::GetElementXACMLDescriptionL( const RMessage2& aMessage)

  1125 {

  1126 	

  1127 

  1128 	//get element XACML description is two phase operation...

  1129 	if ( aMessage.Function() == EGetElementXACMLLength)

  1130 	{

  1131 		//Read element id

  1132 		TPtr8 id = HBufC8::NewLC( aMessage.GetDesLength(0))->Des(); 

  1133 		aMessage.ReadL(0, id, 0);

  1134 	

  1135 		//In first phase descriptor length is fetched.