1 /*

     2 * Copyright (c) 2008-2009 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description:  IKEv1 plugin session

    15 *

    16 */

    17 

    18 

    19 #ifndef C_IKEV1PLUGINSESSION_H

    20 #define C_IKEV1PLUGINSESSION_H

    21 

    22 #include <in_sock.h>

    23 

    24 #include "vpnmandefs.h"

    25 #include "ikemsgheader.h"

    26 #include "ikepluginsessionif.h"

    27 #include "ikev1receiver.h"

    28 #include "ikev1sender.h"

    29 #include "ikesendqueueitem.h"

    30 

    31 // FORWARD DECLARATIONS

    32 class CIkev1Plugin;

    33 class CIkev1Dialog;

    34 class CIkev1Negotiation;

    35 class CIkev1PluginSession;

    36 class CInternalAddress;

    37 class TDeleteISAKMP;

    38 class CAuthDialogInfo;

    39 class CIkev1SA;

    40 class TIkev1SAData;

    41 class CSARekeyInfo;

    42 class TIpsecSPI;

    43 class MIkeDebug;

    44 class ThdrISAKMP;

    45 class TPfkeyMessage;

    46 class TIpsecSAData;

    47 class MKmdEventLoggerIf;

    48 class CIpsecSaSpecList;

    49 class CPFKeySocketIf;

    50 

    51 NONSHARABLE_CLASS(CIkev1PluginSession) : public CBase,

    52                                          public MIkePluginSessionIf,

    53                                          public MIkev1ReceiverCallback,

    54                                          public MIkev1SenderCallback

    55                                          

    56     {

    57 public:

    58     /**

    59      * Two-phased constructor.

    60      * @param aVpnIapId VPN IAP id

    61      * @param aVpnNetId VPN NET id

    62      * @param aVpnInterfaceIndex VPN interface index

    63      * @param aDataInterface Data interface

    64      * @param aPlugin IKE plugin

    65      * @param aPFKeySocketIf PF key socket interface

    66      * @param aDebug Debug trace interface

    67      */

    68     static CIkev1PluginSession* NewL( TUint32 aVpnIapId,

    69                                       TUint32 aVpnNetId,

    70                                       TUint32 aVpnInterfaceIndex,

    71                                       MIkeDataInterface& aDataInterface,

    72                                       CIkev1Plugin& aPlugin,

    73                                       CPFKeySocketIf& aPFKeySocketIf,

    74                                       MIkeDebug& aDebug );

    75     

    76     /**

    77      * Destructor.

    78      */

    79     ~CIkev1PluginSession();

    80             

    81     /**

    82      * Handles IKE SA deletion request.

    83      * @param aIkev1SaData IKEv1 SA data

    84      * @param aSilentClose Silent close

    85      */

    86     TBool DeleteIkeSA( TIkev1SAData* aIkev1SAdata,

    87                        TBool aSilentClose = EFalse );

    88         

    89     /**

    90      * Handles IKE SA rekeying request.

    91      * @param aIkev1SaData IKEv1 SA data

    92      * @param aSaRekeyInfo Rekey info

    93      */

    94     void RekeyIkeSAL( TIkev1SAData* aIkev1SaData,

    95                       CSARekeyInfo* aSaRekeyInfo );

    96         

    97     /**

    98      * Handles IKE SA keepalive request.

    99      * @param aIkev1SaData IKEv1 SA data

   100      */

   101     void KeepAliveIkeSAL( TIkev1SAData* aIkev1SaData );

   102     

   103     /**

   104      * Creates IKE SA.

   105      * @param aIkev1SaData IKEv1 SA data

   106      * @param aSaRekeyInfo Rekey info

   107      */

   108     void CreateIkev1SAL( TIkev1SAData& aIkev1SaData,

   109                          CSARekeyInfo* aSaRekeyInfo );                

   110 

   111     /**

   112      * Updates IKE SA.

   113      * @param aSaId SA id

   114      * @param aExpired Expired

   115      * @param aIkev1SaData IKEv1 SA data

   116      */

   117     void UpdateIkev1SAL( TUint32 aSaId,

   118                          TBool aExpired,

   119                          TIkev1SAData* aIkev1SaData = NULL );

   120     

   121     /**

   122      * Expires IKE SA.

   123      * @param aSaId SA id

   124      */

   125     void ExpireIkev1SA( TUint32 aSaId );         

   126     

   127     /**

   128      * Removes IKE SA.

   129      * @param aIkev1Sa IKE SA

   130      * @param aStatus Error status

   131      */

   132     void RemoveIkeSA( CIkev1SA* aIkev1Sa,

   133                       TInt aStatus );    

   134     

   135 // IKE SA find methods

   136     

   137     CIkev1SA* FindIkev1SA();

   138     CIkev1SA* FindIkev1SA( const TCookie& aCookie_I,

   139                            const TCookie& aCookie_R );

   140     CIkev1SA* FindIkev1SAWithId( TUint32 aSaId );

   141     CIkev1SA* FindIkev1SA( const TInetAddr& aAddr );

   142     CIkev1SA* FindIkev1SA( const TInetAddr& aAddr,

   143                            TUint32 aInboundSpi );

   144     

   145     TIkev1SAData* FindIkev1SAData();

   146     TIkev1SAData* FindIkev1SAData( const TCookie& aCookie_I,

   147                                    const TCookie& aCookie_R );

   148     TIkev1SAData* FindIkev1SAData( TUint32 aSaId );

   149     TIkev1SAData* FindIkev1SAData( const TInetAddr& aAddr,

   150                                    TUint32 aInboundSpi );

   151     TIkev1SAData* FindIkev1SADataWithAddr( const TInetAddr& aAddr );

   152 

   153     /**

   154      * Handles IPsec SA deletion request.

   155      * @param aIkev1SaData IKEv1 SA data

   156      * @param aIpsecSpi IPsec SPI

   157      */

   158     void DeleteIpsecSAL( TIkev1SAData* aIkev1SaData,

   159                          TIpsecSPI* aIpsecSpi );

   160     

   161     /**

   162      * Deletes IPsec SAs.

   163      * @param aSaId SA id

   164      */

   165     void DeleteIpsecSAs( TUint32 aSAId );

   166     

   167     /**

   168      * Deletes IPsec SPI.

   169      * @param aSaId SA id

   170      * @param aSpi SPI

   171      * @param aInbound Inbound

   172      */

   173     TBool DeleteIpsecSpi( TUint32 aSaId,

   174                           TUint32 aSpi,

   175                           TBool aInbound = EFalse );

   176         

   177     /**

   178      * Adds IPsec SPI to IKE SA.

   179      * @param aSaId SA id

   180      * @param aIpsecSpi IPsec SPI

   181      */

   182     void AddIpsecSPIToSAL( TUint32 aSaId,

   183                            TIpsecSPI& aIpsecSpi );

   184 

   185     /**

   186      * Returns dialog anchor.

   187      */

   188     CIkev1Dialog** DialogAnchor();

   189     

   190     /**

   191      * Returns debug trace interface.

   192      */

   193     MIkeDebug& Debug();

   194     

   195     /**

   196      * Gets SA id.

   197      */

   198     TUint32 GetSAId();     

   199           

   200     /**

   201      * Deletes ISAKMP SAs.

   202      * @param aDeletePayload Delete payload which identifies ISAKMP/IKE SA.

   203      * @param aInfoNegotiation Negotiation object used by CIkev1InfoNegotiation

   204      *                         object.

   205      */

   206     void DeleteISAKMPSAsL( TDeleteISAKMP* aDeletePayload,

   207                            const CIkev1Negotiation& aInfoNegotiation );

   208     

   209     /**

   210      * Requests sending of IKE message.

   211      * @param aIkeMsg IKE message

   212      * @param aDestAddr Destination IP address/port

   213      * @param aUseNatPort NAT used or not

   214      */

   215     void SendIkeMsgL( const TDesC8& aIkeMsg,

   216                       TInetAddr& aDestAddr,

   217                       TBool aUseNatPort );

   218 

   219     /**

   220      * Gets local IP address.

   221      * @param aAddr Local IP address (returned)

   222      * @return Error value

   223      */

   224     TInt GetLocalAddress( TInetAddr& aAddr );

   225             

   226     /**

   227      * Sends NAT keep-alive packet.

   228      * @param aDestAddr Destination IP address/port

   229      * @param Keep-alive data

   230      * @param aDscp DSCP value

   231      */

   232     void SendNatKeepAliveL( TInetAddr& aDestAddr,

   233                             const TDesC8& aData,

   234                             TUint8 aDscp );

   235     

   236     /**

   237      * Sends Nokia NAT keep-alive packet.

   238      * @param aDestAddr Destination IP address/port

   239      * @param Keep-alive data

   240      * @param aDscp DSCP value

   241      */

   242     void SendNokiaNatKeepAliveL( TInetAddr& aDestAddr,

   243                                  const TDesC8& aData,

   244                                  TUint8 aDscp );        

   245             

   246     /**

   247      * Handles completion of IKE SA establishment.

   248      * @param aStatus Completion status

   249      * @param aInternalAddress Internal address. Ownership transferred.

   250      */

   251     void IkeSaCompleted( TInt aStatus, 

   252                          CInternalAddress* aInternalAddress = NULL );

   253     

   254     /**

   255      * Deletes negotiation object.

   256      * @param aNegotiation Negotiation

   257      */

   258     void DeleteNegotiation( CIkev1Negotiation* aNegotiation );

   259     

   260     // Negotiation linking and finding methods

   261     void LinkNegotiation( CIkev1Negotiation* aNegotiation );

   262     CIkev1Negotiation* FirstNegotiation();

   263     CIkev1Negotiation* FindNegotiation( TUint32 aSaId );

   264     CIkev1Negotiation* FindNegotiation( TCookie aInit,

   265                                         TCookie aResp,

   266                                         TUint8 aExchange,

   267                                         TUint32 aMsgId ); 

   268     void RemoveNegotiation( CIkev1Negotiation* aNegotiation );    

   269 

   270     /**

   271      * Handles completion of authentication dialog processing.

   272      * @param aUserInfo User info

   273      * @return Error value

   274      */

   275     TInt AuthDialogCompletedL( CAuthDialogInfo* aUserInfo );  

   276     

   277     /**

   278      * Handles change of internal address.

   279      * @param aInternalAddr Internal address

   280      * @return Informs if internal address differs from existing internal address

   281      */

   282     TBool InternalAddressChangedL( const CInternalAddress& aInternalAddr );

   283     

   284     /**

   285       * Gets acceptable IPsec policies for specified selectors.

   286       * 

   287       * @param aLocalAddr IP address, including possible port, of the local end selector

   288       * @param aLocalMask Local end selector mask

   289       * @param aRemoteAddr IP address, including possible port, of the remote end selector

   290       * @param aRemoteMask Remote end selector mask

   291       * @param aProtocol Protocol id

   292       * @param aVpnNetId VPN net id

   293       */

   294      CIpsecSaSpecList* GetIpseSaSpecListLC( const TInetAddr& aLocalAddr, const TInetAddr& aLocalMask, 

   295                                             const TInetAddr& aRemoteAddr, const TInetAddr& aRemoteMask,

   296                                             TInt aProtocol );     

   297                             

   298     /**

   299      * Handles fatal error.

   300      * @param aStatus Error status

   301      */

   302     void HandleError( TInt aStatus );

   303     

   304     /**

   305      * Returns error status.

   306      * @return Error status

   307      */

   308     TInt ErrorStatus();

   309     

   310     /**

   311      * Sets error status.

   312      * @param aStatus Error status

   313      */

   314     void SetErrorStatus( TInt aStatus );

   315     

   316     /**

   317      * Returns VPN IAP id.

   318      * @return VPN IAP id

   319      */

   320     TUint32 VpnIapId();    

   321 

   322     /**

   323      * Returns VPN interface index.

   324      */

   325     TUint32 VpnInterfaceIndex();

   326     

   327     /**

   328      * Returns IKE policy data.

   329      * @return IKE policy data

   330      */

   331     CIkeData& IkeData();

   332 

   333     /**

   334      * Returns UID.

   335      * @return UID

   336      */

   337     TUint32 Uid();

   338 

   339     /**

   340      * Returns event logger interface.

   341      * @return Eveng logger interface

   342      */

   343     MKmdEventLoggerIf& EventLogger();

   344     

   345     /**

   346      * Returns internal address (NULL if does not exist).

   347      * @return Internal address. Ownership transferred.

   348      */

   349     CInternalAddress* InternalAddressL();    

   350     

   351 

   352 // PFKEY related methods

   353     

   354     /**

   355      * Matches destination address to remote address in IKE policy data.

   356      * @param aDestAddr Destination IP address

   357      * @return ETrue if matches. 

   358      */

   359     TBool MatchDestinationAddress( const TInetAddr& aDestAddr );

   360     

   361     /**

   362      * Handles received PFKEY message.

   363      * @param aPfkeyMessage PFKEY message

   364      */

   365     void PfkeyMessageReceived( const TPfkeyMessage& aPfkeyMessage );

   366 

   367 // Methods to build and send PFKEY API primitives to IPsec

   368     

   369     void GetIpsecSPI( TUint8 aType,

   370                       TUint32 aSeq,

   371                       TInetAddr& aSrc, 

   372                       TInetAddr& aDst );

   373     

   374     void AcquireSAError( TIpsecSAData& aSAData,

   375                          TInt aError );

   376     

   377     void UpdateSAL( TIpsecSAData& aSaData );

   378     

   379     void AddSAL( TIpsecSAData& aSaData );

   380     

   381     void DeleteIpsecSA( TIpsecSPI& aIpsecSpi );

   382     

   383     void DeleteIpsecSA( TUint32 aSPI,

   384                         TInetAddr& aSrc, 

   385                         TInetAddr& aDst,

   386                         TUint8 aProtocol );

   387         

   388 // from base class MIkePluginSessionIf

   389     

   390     /**

   391      * From MIkePluginSessionIf.

   392      * Starts negotiation with a peer.

   393      * @param aIkeData IKE policy data

   394      * @param aInternalAddress Internal address (returned)

   395      * @param aStatus Completion status (returned) 

   396      */

   397     void NegotiateWithHost( const CIkeData& aIkeData,

   398                             TVPNAddress& aInternalAddress,

   399                             TRequestStatus& aStatus );

   400     

   401     /**

   402      * From MIkePluginSessionIf.

   403      * Cancels negotiate request. DeleteSession() method needs to be called

   404      * after this method to delete session.

   405      */

   406     void CancelNegotiateWithHost();

   407     

   408     /**

   409      * From MIkePluginSessionIf.

   410      * Deletes session. IKE/IPSec SA:s are deleted.

   411      * @param aSilentClose Specified if a silent close in question (Delete

   412      * payloads not transmitted to peer)

   413      * @param aStatus Completion status (returned)

   414      */

   415     void DeleteSession( const TBool aSilentClose,

   416                         TRequestStatus& aStatus );

   417     

   418     /**

   419      * From MIkePluginSessionIf.

   420      * Cancels deletion requests. IKE/IPSec SA:s are deleted.

   421      */

   422     void CancelDeleteSession();

   423             

   424     /**

   425      * From MIkePluginSessionIf.

   426      * Requests notification about error condition.

   427      * @param aStatus Completion status (returned)

   428      */

   429     void NotifyError( TRequestStatus& aStatus );

   430     

   431     /**

   432      * From MIkePluginSessionIf.

   433      * Cancels error notification request.

   434      */

   435     void CancelNotifyError();

   436     

   437     /**

   438      * From MIkePluginSessionIf.

   439      * Requests notification about change of internal address.

   440      * @param aInternalAddress Internal address (returned)

   441      * @param aStatus KErrNone. Error condition needs to be indicated via

   442      *                NotifyError() method. (returned)

   443      */

   444     virtual void NotifyInternalAddressChanged( TVPNAddress& aInternalAddress,

   445                                                TRequestStatus& aStatus );

   446     

   447     /**

   448      * From MIkePluginSessionIf.

   449      * Cancels internal address change notification request.

   450      */

   451     void CancelNotifyInternalAddressChanged();

   452         

   453 // from base class MIkev1ReceiverCallback

   454 

   455     /**

   456      * From MIkev1ReceiverCallback.

   457      * Notification about received IKE message.

   458      * @param aIkeMsg IKE message

   459      * @param aSrcAddr Source IP address/port

   460      * @param aLocalPort Local port

   461      */

   462     void IkeMsgReceivedL( const ThdrISAKMP& aIkeMsg,

   463                           const TInetAddr& aSrcAddr,

   464                           TInt aLocalPort );

   465     

   466     /**

   467      * From MIkev1ReceiverCallback.

   468      * Notification about receive error.

   469      * @param aStatus Error value

   470      */

   471     void ReceiveError( TInt aError );

   472     

   473     

   474 // from base class MIkev1SenderCallback   

   475     

   476     /**

   477      * From MIkev1SenderCallback.

   478      * Notification about completion sending.

   479      * @param aStatus Completion status

   480      */

   481     void SendUdpDataCompleted( TInt aStatus );

   482     

   483 private:

   484     

   485     CIkev1PluginSession( TUint32 aVpnIapId,

   486                          TUint32 aVpnNetId,

   487                          TUint32 aVpnInterfaceIndex,

   488                          MIkeDataInterface& aDataInterface,

   489                          CIkev1Plugin& aPlugin,

   490                          CPFKeySocketIf& aPFKeySocketIf,

   491                          MIkeDebug& aDebug );

   492     void ConstructL();

   493     

   494     /**

   495      * Handles received PFKEY message.

   496      * @param aPfkeyMessage PFKEY message

   497      */

   498     void DoPfkeyMessageReceivedL( const TPfkeyMessage& aPfkeyMessage );

   499     

   500     /**

   501      * Deletes IKE SAs.

   502      * @param aSilentClose silent close

   503      * @return Deactivation started or not.

   504      */

   505     TBool DeleteSAsWithHost( TBool aSilentClose );

   506         

   507     /**

   508      * Requests sending of UDP data.

   509      * @param aUdpData UDP data. Ownership transferred.

   510      * @param aDestAddr Destination IP address/port

   511      * @param aLocalPort Local port

   512      * @param aDscp DSCP value

   513      */

   514     void DoSendUdpDataL( HBufC8* aUdpData,

   515                          const TInetAddr& aDestAddr,

   516                          TInt aLocalPort,

   517                          TUint8 aDscp );

   518     /**

   519      * Sends UDP data.

   520      * @param aUdpData UDP data. Ownership transferred.

   521      * @param aDestAddr Destination IP address/port

   522      * @param aLocalPort Local port

   523      * @param aDscp DSCP value

   524      */

   525     void DoSendUdpData( HBufC8* aUdpData,

   526                         const TInetAddr& aDestAddr,

   527                         TInt aLocalPort,

   528                         TUint8 aDscp );  

   529     

   530     /**

   531      * Handles starting of negotiation with a peer.

   532      * @param aIkeData IKE policy data

   533      */

   534     void DoNegotiateWithHostL( const CIkeData& aIkeData );

   535  

   536     /**

   537      * Handles fatal error.

   538      * @param aError Error status

   539      */

   540     void DoHandleError( TInt aError );

   541     

   542     /**

   543      * Handles completion of client's negotiate request.

   544      * @param aStatus Status

   545      */

   546     void DoCompleteNegotiateWithHost( TInt aStatus );

   547 

   548     /**

   549      * Handles completion of client's delete session request.

   550      * @param aStatus Status

   551      */

   552     void DoCompleteDeleteSession( TInt aStatus );

   553     

   554     /**

   555      * Handles completion of client's notify error request.

   556      * @param aStatus Status

   557      */

   558     void DoCompleteNotifyError( TInt aStatus );

   559     

   560     /**

   561      * Handles completion of client's notify internal address change request.

   562      * @param aStatus Status

   563      */

   564     void DoCompleteInternalAddressChanged( TInt aStatus );

   565     

   566     /**

   567      * Cancels data transfer.

   568      */    

   569     void DoCancelDataTransfer();

   570     

   571     /**

   572      * Empties send queue.

   573      */

   574     void DoEmptySendQueue();

   575     

   576 private: // data

   577     

   578     /**

   579      * VPN IAP id.

   580      * Own.

   581      */

   582     TUint32                     iVpnIapId;

   583 

   584     /**

   585      * VPN NET id.

   586      * Own.

   587      */

   588     TUint32                     iVpnNetId;

   589 

   590     /**

   591      * VPN interface index.

   592      * Own.

   593      */

   594     TInt                        iVpnInterfaceIndex;

   595 

   596     /**

   597      * IKE policy data.

   598      * Own.

   599      */

   600     CIkeData*                   iIkeData;

   601 

   602     /**

   603      * IKEv1 negotiations.

   604      * Own.

   605      */

   606     CIkev1Negotiation*          iFirstNegotiation;

   607 

   608     /**

   609      * Dialog wait queue. Used by CIkeDialog class.

   610      * Own.

   611      */

   612     CIkev1Dialog*               iDialogWaitQueue;  

   613 

   614     /**

   615      * SA id seed.

   616      * Own.

   617      */

   618     TUint32                     iSAIdSeed;            

   619     

   620     /**

   621      * IKE message send queue.

   622      * Own.

   623      */

   624     RArray<TIkeSendQueueItem>   iSendQueue;

   625     

   626     /**

   627      * IKEv1 SAs.

   628      * Own.

   629      */

   630     RPointerArray<CIkev1SA>     iIkev1SAs;

   631     

   632     /**

   633      * Local IP address.

   634      * Own.

   635      */

   636     TInetAddr                   iLocalAddr;

   637     

   638     /**

   639      * Receiver.

   640      * Own.

   641      */

   642     CIkev1Receiver*             iReceiver;

   643     

   644     /**

   645      * Sender.

   646      * Own.

   647      */

   648     CIkev1Sender*               iSender;

   649     

   650     /**

   651      * Internal address.

   652      * Own.

   653      */

   654     CInternalAddress*           iInternalAddress;

   655     

   656     /**

   657      * Error status.

   658      * Own.

   659      */

   660     TInt                        iErrorStatus;    

   661     

   662     /**

   663      * Client's negotiate requests status.

   664      * Not own.

   665      */

   666     TRequestStatus*             iClientStatusNegotiate;

   667     

   668     /**

   669      * Client's internal address variable for negotiate request.

   670      * Not own.

   671      */

   672     TVPNAddress*                iClientIaNegotiate;

   673 

   674     /**

   675      * Client's delete session requests status.

   676      * Not own.

   677      */

   678     TRequestStatus*             iClientStatusDelete;

   679     

   680     /**

   681      * Client's notify error requests status.

   682      * Not own.

   683      */

   684     TRequestStatus*             iClientStatusNotifyError;

   685     

   686     /**

   687      * Client's notify IA change requests status.

   688      * Not own.

   689      */

   690     TRequestStatus*             iClientStatusNotifyIaChange;

   691     

   692     /**

   693      * Client's internal address variable for notify request.

   694      * Not own.

   695      */

   696     TVPNAddress*                iClientIaNotify;

   697         

   698     /**

   699      * Data interface.

   700      * Not own.

   701      */

   702     MIkeDataInterface&          iDataInterface;

   703     

   704     /**

   705      * IKEv1 plugin.

   706      * Not own.

   707      */

   708     CIkev1Plugin&               iPlugin;

   709     

   710     /**

   711      * VPN PF key socket.

   712      * Not own.

   713      */

   714     CPFKeySocketIf&             iPFKeySocketIf;

   715     

   716     /**

   717      * Debug trace interface.

   718      * Not own.

   719      */

   720     MIkeDebug&                  iDebug;    

   721     };

   722 

   723 #endif // C_IKEV1PLUGINSESSION_H