/*

* Copyright (c) 1999-2009 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  Security policy module

*

*/

#include <es_sock.h>

#include <in_sock.h>

#include <networking/ipsecerr.h>

#include <vpnlogmessages.rsg>

#include "ikedebug.h"

#include "kmdeventloggerif.h"

#include "secpolpayload.h"

// CLASS HEADER

#include "secpolreader.h"

// ======== LOCAL FUNCTIONS ========

#ifdef _DEBUG

// ---------------------------------------------------------------------------

// Returns error description.

// ---------------------------------------------------------------------------

//

static const TPtrC IpsecError( TInt aReason )

    {

    switch ( aReason )

        {

        case EIpsec_RMBUF:              return _L("RMBUF operation failed unexcpectedly");

        //

        // AH and ESP

        //

        case EIpsec_CorruptPacketIn:    return _L("Truncated or corrupt packet or header");

        case EIpsec_CorruptPacketOut:   return _L("Corrupt packet after IPSEC operations");

        case EIpsec_EspInboundSA:       return _L("The inbound SA for ESP does not exist");

        case EIpsec_EspAuthentication:  return _L("Authentication check failed in ESP");

        case EIpsec_EspAuthAlg:         return _L("Required auth algorithm for ESP not available/installed");

        case EIpsec_EspEncrAlg:         return _L("Required encrypt algorithm for ESP not available/installed");

        case EIpsec_AhAuthAlg:          return _L("Required auth algorithm for AH not available/installed");    

        case EIpsec_AhInboundSA:        return _L("The inbound SA for AH does not exist");

        case EIpsec_AhIcvLength:        return _L("ICV length in packet does not match algorithm");

        case EIpsec_AhAuthentication:   return _L("Authentication check failed in AH");

        case EIpsec_PacketLength:       return _L("Invalid/corrupt length of the packet");

        case EIpsec_DataAlignment:      return _L("Data not aligned by block size (ESP)");

        case EIpsec_EspPadByte:         return _L("The ESP pad byte content is invalid");

        case EIpsec_EspPadLength:       return _L("The ESP pad length is corrupt (probably wrong key)");

        case EIpsec_ReplayDuplicate:    return _L("Duplicate packet (replay window test)");

        //

        // SECPOL

        //

        case EIpsec_OutboundNotFound:   return _L("Outbound SA does not exist, ACQUIRE started");

        case EIpsec_OutboundPending:    return _L("Outbooud SA does not exits, ACQUIRE pending");

        case EIpsec_NoSelectorMatch:    return _L("None of the policy selectors matched");

        case EIpsec_MaxTransforms:      return _L("Incoming packet exceed configured max limit of transforms");

        case EIpsec_TooFewTransforms:   return _L("Policy requires IPSEC, none or too little was present");

        case EIpsec_TunnelMismatch:     return _L("Tunnelmode does not match the policy");

        case EIpsec_MismatchedSA:       return _L("Applied SA does not match the policy");

        case EIpsec_UnrequiredSA:       return _L("Applied SA where policy has none");

        case EIpsec_TooManyTransforms:  return _L("Incoming packet had more transforms than policy requires");

        case EIpsec_NoBundle:           return _L("Incoming packet had transforms, but policy doesn't require any");

        //

        // IPv6 additions

        //

        case EIpsec_AhRMBufSplit:       return _L("Inbound AH processing failed (Memory?)");

        case EIpsec_AhPacketTooLong:    return _L("Outbound packet would exeed 2**16-1 with AH");

        case EIpsec_AhSequenceWrap:     return _L("Outbound sequence # wrapped around for this SA");

        case EIpsec_EspSequenceWrap:    return _L("Outbound sequence # wrapped around for this SA");

        case EIpsec_EspBadCipherBlockSize:  return _L("Configuration error, cipher block size must be < 256");

        case EIpsec_AcquireFailed:      return _L("Acquiring SA failed (no SA available or negotiated)");

        //

        // Detail reasons for SA not matching the SA spec in the policy

        // (replace one EIpsec_MismatchedSA with multiple detail errors)

        //

        case EIpsec_MismatchedDestination:  return _L("SA destination does not match (internal error?)");

        case EIpsec_MismatchedType:     return _L("SA Type (AH/ESP) does not match");

        case EIpsec_MismatchedPFS:      return _L("PFS bit is not same");

        case EIpsec_MismatchedAuthAlg:  return _L("Auth algorithm doesn't match");

        case EIpsec_MismatchedEncryptAlg:   return _L("Encrypt algorithm doesn't match");

        case EIpsec_MismatchReplayWindow:   return _L("ReplayWindow length is shorter than required");

        case EIpsec_MismatchSource:     return _L("source address does not match");

        case EIpsec_MismatchProxy:      return _L("proxy address does not match");

        case EIpsec_MismatchSourcePort: return _L("source port does not match");  

        case EIpsec_MismatchDestinationPort:return _L("destination port does not match");

        case EIpsec_MismatchProtocol:   return _L("protocol does not match");

        case EIpsec_MismatchSourceIdentity: return _L("source identity does not match");

        case EIpsec_MismatchDestinationIdentity: return _L("destination identity does not match");

        case EIpsec_BadCipherKey:       return _L("Key in SA is too short (for the algorithm) or is weak");

        case EIpsec_UnknownCipherNumber: return _L("Attempting to use algorithm number that is not known");

        case EIpsec_UnknownDigestNumber: return _L("Attempting to use algorithm number that is not known");

        case EIpsec_UnavailableCipher: return _L("No installed library implements the cipher");

        case EIpsec_UnavailableDigest: return _L("No installed library implements the digest");

        //

        // Temporary place for new errors

        //

        case EIpsec_IcmpError:  return _L("An ICMP error report containing AH or ESP (for INET6)");

        case EIpsec_LostSA:     return _L("An SA has been lost between Apply and Verify, expired? (for SECPOL)");

        case EIpsec_NoInnerSource: return _L("Cannot find inner-src for outbound packet when tunneling (for SECPOL)");

        //

        // Special code for NAT Traversal  

        //

        case EIpsec_NotANATTPacket: return _L("UDP packet is NOT a NAT Taversal packet");

        case EIpsec_FragmentMismatch: return _L("IPSEC on fragment is not same as before, packet dropped");

        default:

            return _L("Unknown reason");

        }

    }

#endif

// ======== MEMBER FUNCTIONS ========

// ---------------------------------------------------------------------------

// Two-phased constructor.

// ---------------------------------------------------------------------------

//

CSecpolReader* CSecpolReader::NewL( MKmdEventLoggerIf& aEventLogger,

                                    MIkeDebug& aDebug )

    {

    CSecpolReader* self = new (ELeave) CSecpolReader( aEventLogger,

                                                      aDebug );

    CleanupStack::PushL( self );    

    self->ConstructL();

    CleanupStack::Pop( self );

    return self;

    }

// ---------------------------------------------------------------------------

// Destructor.

// ---------------------------------------------------------------------------

//

CSecpolReader::~CSecpolReader()

    {

    DEBUG_LOG(_L("CSecpolReader::~CSecpolReader"));

    Cancel();

    iSocket.Close();

    iSocketServer.Close();        

    }

// ---------------------------------------------------------------------------

// Constructor.

// ---------------------------------------------------------------------------

//

CSecpolReader::CSecpolReader( MKmdEventLoggerIf& aEventLogger,

                              MIkeDebug& aDebug )

: CActive( EPriorityStandard ),

  iEventLogger( aEventLogger ),

  iDebug( aDebug )

    {

    CActiveScheduler::Add( this );

    }

// ---------------------------------------------------------------------------

// Second phase construction.

// ---------------------------------------------------------------------------

//

void CSecpolReader::ConstructL()

    {

    TInetAddr addr;

    User::LeaveIfError( iSocketServer.Connect() );

    User::LeaveIfError( iSocket.Open( iSocketServer, _L("secpol6") ) );

    addr.SetAddress( KInetAddrNone );

    addr.SetPort( 0 );

    User::LeaveIfError( iSocket.Bind( addr ) );

    iSocket.RecvFrom( iMsg, iAddr, 0, iStatus );

    SetActive();

    DEBUG_LOG(_L("CSecpolReader::ConstructL - constructed"));

    }

// ---------------------------------------------------------------------------

// Returns event logger.

// ---------------------------------------------------------------------------

//

MKmdEventLoggerIf& CSecpolReader::EventLogger()

    {

    return iEventLogger;

    }

// ---------------------------------------------------------------------------

// From class CActive

// Handles completion of asynchronous reading. 

// ---------------------------------------------------------------------------

//

void CSecpolReader::RunL()

    {        

#ifdef _DEBUG

    TBuf<40> buf;

    TBuf<1000> str;

	TInt protocol = -1;

#endif // _DEBUG    

    TInt  len = 0;

	TBool processEvent;

    TSecpolPayload packet( iMsg.Ptr() );

    DEBUG_LOG1(_L("Secpol read, status=%d"), iStatus.Int());

    __ASSERT_DEBUG( iStatus.Int() == KErrNone,

                    User::Invariant() );

    if ( iStatus.Int() == KErrNone )

        {

        switch ( packet.iIP4->Version() )

            {

            case 4:

    			processEvent = ((THdrIP4 *)packet.iRaw)->IsUnicast();

    			if ( processEvent )

    			    {	

#ifdef _DEBUG			

    			    ((THdrIP4 *)packet.iRaw)->Dump( str, iMsg.Length() );

    			    protocol = packet.iIP4->Protocol();

#endif // _DEBUG			   

    			    len = packet.iIP4->HeaderLength();

    			    }    

                    break;

            case 6:

    			processEvent = ((THdrIP6 *)packet.iRaw)->IsUnicast();

    			if ( processEvent )

    			    {	

#ifdef _DEBUG			

    			    ((THdrIP6 *)packet.iRaw)->Dump( str, iMsg.Length() );

    			    protocol = packet.iIP6->NextHeader();

#endif // _DEBUG			   

    			    len = packet.iIP6->HeaderLength();

    			    }    

                    break;

            default:

    			    processEvent = ETrue;

#ifdef _DEBUG			

    			    str.Format( _L("Unknown IP protocol version %d"),

    			                (TInt)packet.iIP4->Version() );

#endif // _DEBUG            

    			    break;

            }

    	if ( processEvent )

    	    {		 

    	    if ( len )

               {

               packet.iRaw += len;

#ifdef _DEBUG          

               packet.Dump( str, iMsg.Length()-len, protocol );

#endif // _DEBUG          

               }

#ifdef _DEBUG       

    	    str.Append( _L(" from ") );

    	    (TInetAddr::Cast(iAddr)).OutputWithScope( buf );

    	    str.Append( buf );

    	    str.Append( _L(" because ") );

    	    str.Append( IpsecError( iAddr.Port() ) );

    	    str.AppendFormat( _L(" (%d)"), iAddr.Port() );

    	    DEBUG_LOG(str);

#endif // _DEBUG       

    	    LOG_KMD_EVENT( MKmdEventLoggerIf::KLogWarning,

    	                   R_VPN_MSG_DATA_DROPPED_DUE_POLICY,

    	                   (TInt)iAddr.Port(),

    	                   0,

    	                   &iAddr );    	        	    

    	    }

        }

    iSocket.RecvFrom( iMsg, iAddr, 0, iStatus );  // start a new read

    SetActive();

    }

// ---------------------------------------------------------------------------

// From class CActive

// Handles cancellation of asynchronous reading. 

// ---------------------------------------------------------------------------

//

void CSecpolReader::DoCancel()

    {

    iSocket.CancelRecv();

    }