1 /*

     2 * Copyright (c) 2002-2005 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description: IPSec policy parser main module.

    15 * A parser for IPsec policies. Converts textual IPsec policies into 

    16 * in-memory data structures and vice versa. 

    17 *

    18 */

    19 

    20 

    21 

    22 #include <e32std.h>

    23 #include <coeutils.h>

    24 

    25 #include "ipsecpolparser.h"

    26 #include "logvpncommon.h"

    27 

    28 // Policies Parsing

    29 

    30 // Symbian change - start

    31 #ifdef __VC32__

    32 #pragma warning(disable : 4097) // typedef-name used as synonym for class-name

    33 #endif

    34 // Symbian change - end

    35 

    36 EXPORT_C

    37 TPolicyParser::TPolicyParser(const TDesC &aPolicy) : TLex(aPolicy)

    38     {}

    39 

    40 EXPORT_C TInt

    41 TPolicyParser::ParseL(CIpSecurityPiece* aPieceData)

    42     {

    43     LOG_("TPolicyParser::ParseL()\n");

    44     TInt err(KErrNone);

    45     iLine = 1;

    46 

    47     CSecurityPolicy* sp = aPieceData->Policies();

    48     while (!err && NextToken() == token_string)

    49         {

    50         if (iToken.Compare(_L("sa")) == 0)

    51             {

    52             err = parse_sa_specL(sp);

    53             }

    54         else if (iToken.Compare(_L("ep")) == 0)

    55             {

    56             err = parse_ep_specL(sp);

    57             }

    58         else

    59             {

    60             err = parse_conn2saL(sp);

    61             }

    62         }

    63 

    64     if (!err && !Eos())

    65         {

    66         // Parsing didn't detect error, but not all parsed!

    67         err = KErrGeneral;

    68         }

    69 

    70     if (err)

    71         {

    72         if (iMsg.Length() > 0 && iMsg.Length() < 200)

    73             {

    74             aPieceData->iErrorInfo.Copy(iMsg);

    75             }

    76         }

    77 

    78     return (err);

    79     }

    80 

    81 EXPORT_C TInt

    82 TPolicyParser::BufferAppend(HBufC8*& aPolBfr, const TDesC8& aText)

    83     {

    84     LOG_("TPolicyParser::BufferAppend()\n");

    85     TInt err(KErrNone);

    86 

    87     // Make sure that we have enough space for the new text

    88     TInt spaceLeft = aPolBfr->Des().MaxLength() - aPolBfr->Des().Length();

    89     if (aText.Length() > spaceLeft)

    90         {

    91         // Allocate enough space for the new text + some additional

    92         // free space so that allocations are not too frequent

    93         TInt newMaxLength = aPolBfr->Des().MaxLength()

    94                             + aText.Length()

    95                             + KPolicyBufferSizeIncrement;

    96         HBufC8* tempBfr = aPolBfr->ReAlloc(newMaxLength);

    97         if (tempBfr != NULL)

    98             {

    99             aPolBfr = tempBfr;

   100             }

   101         else

   102             {

   103             return KErrNoMemory;

   104             }

   105         }

   106 

   107     aPolBfr->Des().Append(aText);

   108     return err;

   109     }

   110 

   111 EXPORT_C TInt

   112 TPolicyParser::Write(CSecurityPolicy *aSp,

   113                      HBufC8*& aPolBfr,

   114                      TBool aSortingOrder)

   115     {

   116     LOG_("TPolicyParser::Write()\n");

   117     TInt err = WriteSAs(aSp->SAList(), aPolBfr);

   118     if (err)

   119         {

   120         return err;

   121         }

   122     

   123     if (aSortingOrder)

   124         {

   125         err = WriteSelectorsInSortingOrder(aSp->SelectorList(),

   126                                            aPolBfr,

   127                                            aSortingOrder);

   128         }

   129     else

   130         {

   131         err = WriteSelectors(aSp->SelectorList(), aPolBfr, aSortingOrder);

   132         }

   133         

   134     return err;

   135     }

   136 

   137 TInt

   138 TPolicyParser::WriteSAs(CSAList* aSAList, HBufC8*& aPolBfr)

   139     {

   140     LOG_("TPolicyParser::WriteSAs()\n");

   141     TBuf8<1024> aux;

   142     TInt err(KErrNone);

   143     TInt count = aSAList->Count();

   144     for (TInt i = 0; i < count ; i++)

   145         {

   146         TextSA(aSAList->At(i), aux);

   147         err = BufferAppend(aPolBfr, aux);

   148         if (err != KErrNone)

   149             {

   150             return err;

   151             }

   152         }

   153     return KErrNone;

   154     }

   155 

   156 void

   157 TPolicyParser::TextSA(CPolicySpec* aSA, TDes8& aBuf)

   158     {

   159     LOG_("TPolicyParser::TextSA()\n");

   160     if (aSA->iSpectype == EPolSpecSA)

   161         {

   162         aBuf.Format(_L8("sa "));

   163         // SA name

   164         aBuf.Append(aSA->iName->Des());

   165         aBuf.Append(_L8(" = {\n"));

   166         switch (aSA->iSpec.iType)

   167             {

   168             case SADB_SATYPE_AH:

   169                 aBuf.Append(_L8(" ah\n"));

   170                 break;

   171             case SADB_SATYPE_ESP:

   172                 aBuf.Append(_L8(" esp\n"));

   173                 break;

   174             default:        //SADB_SATYPE_UNSPEC

   175                 aBuf.Append(_L8(" ???")); //Shouldn't happen

   176             }

   177 

   178         // Encryption Algorithm

   179 

   180 

   181 

   182         if (aSA->iSpec.iEalg != 0)

   183             {

   184             // Encryption Alg

   185             aBuf.AppendFormat(_L8(" encrypt_alg %d\n"), aSA->iSpec.iEalg);

   186             }

   187 

   188         if (aSA->iSpec.iEalgLen != 0)

   189             {

   190             aBuf.AppendFormat(_L8(" max_encrypt_bits %d\n"), aSA->iSpec.iEalgLen);

   191             }

   192 

   193         // Authentication Algorithm

   194         if (aSA->iSpec.iAalg != 0)

   195             {

   196             aBuf.AppendFormat(_L8(" auth_alg %d\n"), aSA->iSpec.iAalg);

   197             }

   198 

   199         if (aSA->iSpec.iAalgLen != 0)

   200             {

   201             aBuf.AppendFormat(_L8(" max_auth_bits %d\n"), aSA->iSpec.iAalgLen);

   202             }

   203 

   204         if (aSA->iSpec.iPfs != 0)

   205             {

   206             aBuf.Append(_L8(" pfs\n"));

   207             }

   208 

   209         if (aSA->iRemoteIdentity != NULL)

   210             {

   211             aBuf.Append(_L8(" identity_remote "));

   212             aBuf.Append(aSA->iRemoteIdentity->Des());

   213             aBuf.Append('\n');

   214             }

   215 

   216         if (aSA->iLocalIdentity != NULL)

   217             {

   218             aBuf.Append(_L8(" identity_local "));

   219             aBuf.Append(aSA->iLocalIdentity->Des());

   220             aBuf.Append('\n');

   221             }

   222 

   223         if (aSA->iSpec.iReplayWindowLength != 0)

   224             {

   225             aBuf.AppendFormat(_L8(" replay_win_len %d\n"),

   226                               aSA->iSpec.iReplayWindowLength);

   227             }

   228 

   229         if (aSA->iSpec.iMatchProtocol != 0)

   230             {

   231             aBuf.Append(_L8(" protocol_specific\n"));

   232             }

   233 

   234         if (aSA->iSpec.iMatchLocalPort != 0)

   235             {

   236             aBuf.Append(_L8(" local_port_specific\n"));

   237             }

   238 

   239         if (aSA->iSpec.iMatchRemotePort != 0)

   240             {

   241             aBuf.Append(_L8(" remote_port_specific\n"));

   242             }

   243 

   244         if (aSA->iSpec.iMatchProxy != 0)

   245             {

   246             aBuf.Append(_L8(" proxy_specific\n"));

   247             }

   248 

   249         if (aSA->iSpec.iMatchSrc != 0)

   250             {

   251             aBuf.Append(_L8(" src_specific\n"));

   252             }

   253 

   254         if (aSA->iSpec.iMatchLocal != 0)

   255             {

   256             aBuf.Append(_L8(" local_specific\n"));

   257             }

   258 

   259         if (aSA->iSpec.iMatchRemote != 0)

   260             {

   261             aBuf.Append(_L8(" remote_specific\n"));

   262             }

   263 

   264         if (aSA->iSpec.iHard.sadb_lifetime_allocations != 0)

   265             {

   266             aBuf.AppendFormat(_L8(" hard_lifetime_allocations %d\n"),

   267                               aSA->iSpec.iHard.sadb_lifetime_allocations);

   268             }

   269 

   270         if (aSA->iSpec.iHard.sadb_lifetime_bytes != 0)

   271             {

   272             aBuf.AppendFormat(_L8(" hard_lifetime_bytes %d\n"),

   273                               aSA->iSpec.iHard.sadb_lifetime_bytes);

   274             }

   275 

   276         if (aSA->iSpec.iHard.sadb_lifetime_addtime != 0)

   277             {

   278             aBuf.AppendFormat(_L8(" hard_lifetime_addtime %d\n"),

   279                               aSA->iSpec.iHard.sadb_lifetime_addtime);

   280             }

   281 

   282         if (aSA->iSpec.iHard.sadb_lifetime_usetime != 0)

   283             {

   284             aBuf.AppendFormat(_L8(" hard_lifetime_usetime %d\n"),

   285                               aSA->iSpec.iHard.sadb_lifetime_usetime);

   286             }

   287 

   288         if (aSA->iSpec.iSoft.sadb_lifetime_allocations != 0)

   289             {

   290             aBuf.AppendFormat(_L8(" soft_lifetime_allocations %d\n"),

   291                               aSA->iSpec.iSoft.sadb_lifetime_allocations);

   292             }

   293 

   294         if (aSA->iSpec.iSoft.sadb_lifetime_bytes != 0)

   295             {

   296             aBuf.AppendFormat(_L8(" soft_lifetime_bytes %d\n"),

   297                               aSA->iSpec.iSoft.sadb_lifetime_bytes);

   298             }

   299 

   300         if (aSA->iSpec.iSoft.sadb_lifetime_addtime != 0)

   301             {

   302             aBuf.AppendFormat(_L8(" soft_lifetime_addtime %d\n"),

   303                               aSA->iSpec.iSoft.sadb_lifetime_addtime);

   304             }

   305 

   306         if (aSA->iSpec.iSoft.sadb_lifetime_usetime != 0)

   307             {

   308             aBuf.AppendFormat(_L8(" soft_lifetime_usetime %d\n"),

   309                               aSA->iSpec.iSoft.sadb_lifetime_usetime);

   310             }

   311         aBuf.AppendFormat(_L8(" }\n\n"));

   312         }

   313     else

   314         {

   315         TBuf<39> addr;

   316         aBuf.Format(_L8("ep "));

   317 

   318         // EndPoint name

   319         aBuf.Append(aSA->iName->Des());

   320         aBuf.Append(_L8(" = {"));

   321 

   322         if (aSA->iEpSpec.iIsOptional)

   323             {

   324             aBuf.Append(_L8(" ? "));

   325             }

   326         aSA->iEpSpec.iEpAddr.OutputWithScope(addr);

   327         aBuf.Append(addr);

   328         aBuf.Append(_L8(" }\n\n"));

   329         }

   330     }

   331 

   332 TInt

   333 TPolicyParser::WriteSelectors(CSelectorList* aSelList,

   334                               HBufC8*& aPolBfr,

   335                               TBool /* aSortingOrder */)

   336     {

   337     LOG_("TPolicyParser::WriteSelectors()\n");

   338     TBuf8<1024> aux;

   339     TInt err(KErrNone);

   340     TInt count(aSelList->Count());

   341     for (TInt i = 0; i < count; i++)

   342         {

   343         aux.Zero();

   344         CPolicySelector* ps = aSelList->At(i);

   345 

   346         // Bypass the selector, if sequence number is 0xFFFFFFFF.

   347         // This sequence number indicates that the selector

   348         // is of type 'bypass/drop_everything_else'

   349         if (ps->iSequenceNumber == 0xFFFFFFFF)

   350             {

   351             continue;

   352             }

   353             

   354         // Convert selector to text format and print it into buffer 

   355         TextSel(ps, aux, EFalse);

   356         err = BufferAppend(aPolBfr, aux);

   357         if (err != KErrNone)

   358             {

   359             return err;

   360             }

   361         }

   362 

   363     // All selectors have been written

   364     err = BufferAppend(aPolBfr, (_L8("\n")));

   365     return (err);

   366     }

   367 

   368 ///////////////////////////////////////////////////////////////////

   369 //  This function writes the selectors to a file according

   370 //  to the sequence numbers available in the CPolicySelector.

   371 ///////////////////////////////////////////////////////////////////

   372 //

   373 TInt

   374 TPolicyParser::WriteSelectorsInSortingOrder(

   375     CSelectorList* aSelList,

   376     HBufC8*& aPolBfr,

   377     TBool /* aSortingOrder */)

   378     {

   379     LOG_("TPolicyParser::WriteSelectorsInSortingOrder()\n");

   380     TInt err(KErrNone);

   381     TInt count(aSelList->Count());

   382     TInt currentSequenceNumber(1);

   383 

   384     // Loop here until all selectors have been written

   385     TBool found = ETrue;

   386     while (found)

   387         {

   388         found = EFalse;

   389 

   390         // Loop through the selector list and search the

   391         // the selector corresponding to the current sequence number

   392         for (TInt i = 0; i < count; i++)

   393             {

   394             TBuf8<1024> aux;

   395             aux.Zero();

   396             CPolicySelector* ps = aSelList->At(i);

   397             

   398             if (ps->iSequenceNumber == currentSequenceNumber)

   399                 {

   400                 // Build a selector output string

   401                 TextSel(ps, aux, ETrue);

   402 

   403                 // Write a string to the file

   404                 err = BufferAppend(aPolBfr, aux);

   405                 if (err != KErrNone)

   406                     {

   407                     return err;

   408                     }

   409                 // Prepare for the next selector

   410                 currentSequenceNumber++;

   411                 found = ETrue;

   412                 break;

   413                 }

   414             }

   415         }

   416 

   417     // All selectors have been written

   418     err = BufferAppend(aPolBfr, (_L8("\n")));

   419     return (err);

   420     }

   421 

   422 ///////////////////////////////////////////////////////////////////

   423 // Prints the supplied selector into a given buffer in text format

   424 ///////////////////////////////////////////////////////////////////

   425 //

   426 void

   427 TPolicyParser::TextSel(CPolicySelector* aSel,

   428                        TDes8& aBuf,

   429                        TBool aOrdered)

   430     {

   431     LOG_("TPolicyParser::TextSel()\n");

   432     aBuf.Format(_L8(" "));

   433 

   434     if (aSel->iIsFinal)

   435         {

   436         aBuf.Append(_L8(" final "));

   437         }

   438 

   439     if (aSel->iIsMerge)

   440         {

   441         aBuf.Append(_L8(" merge "));

   442         }

   443 

   444     // NOTE:

   445     //  This is a kludge to save the global selector definition

   446     //  when policy is loaded/parsed and then finally cached into 

   447     //  a list in text format. When combined policy is build 

   448     //  before sending it to IPSEC6.PRT component, the selector

   449     //  list is ordered so this definition is then not included

   450     //  in the policy text that is sent into the protocol component

   451     if (aSel->iGlobalSelector && !aOrdered)

   452         {

   453         aBuf.Append(_L8(" scope:global "));

   454         }

   455 

   456     switch (aSel->iDirection)

   457         {

   458         default:

   459             break;

   460 

   461         case KPolicySelector_SYMMETRIC:

   462             break;

   463 

   464         case KPolicySelector_INBOUND:

   465             aBuf.Append(_L8(" inbound "));

   466             break;

   467 

   468         case KPolicySelector_OUTBOUND:

   469             aBuf.Append(_L8(" outbound "));

   470             break;

   471 

   472         case KPolicySelector_INTERFACE:

   473             TBuf8<20> name;

   474             name.Copy(aSel->iInterface);

   475             aBuf.Append(_L8(" if "));

   476             aBuf.Append(name);

   477             aBuf.Append(_L8(" "));

   478             break;

   479         }

   480 

   481     // Check if remote address exists and no interface name defined

   482     if (aSel->iDirection != KPolicySelector_INTERFACE 

   483         && aSel->iRemote.Family() != KAFUnspec)

   484         {

   485         TBuf<39> addr;

   486         TBuf<39> mask;

   487 

   488         aSel->iRemote.OutputWithScope(addr);

   489         aSel->iRemoteMask.OutputWithScope(mask);

   490         

   491         // Add remote address/mask with scope into the buffer        

   492         aBuf.Append(_L8(" remote "));

   493         aBuf.Append(addr);

   494         aBuf.Append(_L8(" "));

   495         aBuf.Append(mask);

   496         }

   497     else 

   498         {

   499         if (aSel->iRemSelEpName != NULL)

   500             {

   501             // Remote Endpoint name exists so add it into the buffer

   502             aBuf.Append(_L8(" remote "));

   503             aBuf.Append(aSel->iRemSelEpName->Des());

   504             }

   505         if (aSel->iRemMaskEpName != NULL)

   506             {

   507             aBuf.Append(_L8(" "));

   508             aBuf.Append(aSel->iRemMaskEpName->Des());

   509             }

   510         }

   511 

   512     // Check if local address exists and no interface name defined

   513     if (aSel->iDirection != KPolicySelector_INTERFACE 

   514         && aSel->iLocal.Family() != KAFUnspec)

   515         {

   516         TBuf<39> addr;

   517         TBuf<39> mask;

   518         

   519         aSel->iLocal.OutputWithScope(addr);

   520         aSel->iLocalMask.OutputWithScope(mask);

   521 

   522         // Add local address/mask with scope into the buffer        

   523         aBuf.Append(_L8(" local "));

   524         aBuf.Append(addr);

   525         aBuf.Append(_L8(" "));

   526         aBuf.Append(mask);

   527         }

   528     else 

   529         {

   530         if (aSel->iLocSelEpName != NULL)

   531             {

   532             // Local Endpoint name exists so add it into the buffer

   533             aBuf.Append(_L8(" local "));

   534             aBuf.Append(aSel->iLocSelEpName->Des());

   535             }

   536         if (aSel->iLocMaskEpName != NULL)

   537             {

   538             aBuf.Append(_L8(" "));

   539             aBuf.Append(aSel->iLocMaskEpName->Des());

   540             }

   541         }

   542 

   543     if (aSel->iProtocol != 0)

   544         {

   545         aBuf.AppendFormat(_L8(" protocol %d "), aSel->iProtocol);

   546         }

   547 

   548     if (aSel->iLocal.Port() != 0)

   549         {

   550         aBuf.AppendFormat(_L8(" local_port %d "), aSel->iLocal.Port());

   551         }

   552 

   553     if (aSel->iRemote.Port() != 0)

   554         {

   555         aBuf.AppendFormat(_L8(" remote_port %d "), aSel->iRemote.Port());

   556         }

   557 

   558     if (aSel->iIcmpType != -1)

   559         {

   560         aBuf.AppendFormat(_L8(" icmp_type %d "), aSel->iIcmpType);

   561         }

   562 

   563     if (aSel->iType != -1)

   564         {

   565         aBuf.AppendFormat(_L8(" type %d "), aSel->iType);

   566         }

   567 

   568     if (aSel->iIcmpCode != -1)

   569         {

   570         aBuf.AppendFormat(_L8(" icmp_code %d "), aSel->iIcmpCode);

   571         }

   572 

   573     if (aSel->iDropAction)

   574         {

   575         aBuf.Append(_L8(" = drop\n "));

   576         return ;

   577         }

   578 

   579     aBuf.Append(_L8(" = { "));

   580 

   581     TSecpolBundleIter iterl(aSel->iBundle);

   582     CSecpolBundleItem* iteml(NULL);

   583     while ((iteml = iterl++) != NULL)

   584         {

   585         if (iteml->iSpec != NULL)

   586             aBuf.Append(*iteml->iSpec->iName);

   587         else

   588             aBuf.Append(_L8(" tunnel"));

   589 

   590         aBuf.Append(_L8("("));

   591 

   592         if (!iteml->iTunnel.IsUnspecified())

   593             {

   594             TBuf<39> addr;

   595             iteml->iTunnel.OutputWithScope(addr);

   596             aBuf.Append(addr);

   597             }

   598         else if (iteml->iTunnelEpName != NULL)

   599             {

   600             aBuf.Append(iteml->iTunnelEpName->Des());

   601             }

   602         aBuf.Append(_L8(") "));

   603         }

   604 

   605     aBuf.Append(_L8(" }\n"));

   606     }

   607 

   608 void

   609 TPolicyParser::Error(TRefByValue<const TDesC> aFmt, ...)

   610     {

   611     VA_LIST list;

   612     VA_START(list, aFmt);

   613     iMsg.FormatList(aFmt, list);

   614     iMsg += (_L(" at line "));

   615     iMsg.AppendNum(iLine);

   616     };

   617 

   618 //

   619 // Skip white space and mark, including comments!

   620 //

   621 void

   622 TPolicyParser::SkipSpaceAndMark()

   623     {

   624     TChar ch;

   625     TInt comment = 0;

   626 

   627     while (!Eos())

   628         {

   629         ch = Get();

   630         if (ch == '\n')

   631             {

   632             iLine++;

   633             comment = 0;

   634             }

   635         else if (comment || ch == '#')

   636             comment = 1;

   637         else if (!ch.IsSpace())

   638             {

   639             UnGet();

   640             break;

   641             }

   642         }

   643     Mark();

   644     }

   645 

   646 //

   647 //

   648 token_type TPolicyParser::NextToken()

   649     {

   650     TChar ch;

   651     token_type val;

   652 

   653     SkipSpaceAndMark();

   654     if (Eos())

   655         {

   656         val = token_eof;

   657         }

   658     else

   659         {

   660         ch = Get();

   661         if (ch == '{')

   662             val = token_brace_left;

   663         else if (ch == '}')

   664             val = token_brace_right;

   665         else if (ch == '(')

   666             val = token_par_left;

   667         else if (ch == ')')

   668             val = token_par_right;

   669         else if (ch == '=')

   670             val = token_equal;

   671         else if (ch == ',')

   672             val = token_comma;

   673         else

   674             {

   675             val = token_string;

   676             while (!Eos())

   677                 {

   678                 ch = Peek();

   679                 if (ch == '{' || ch == '}' ||

   680                     ch == '(' || ch == ')' ||

   681                     ch == '=' || ch == '#' || ch.IsSpace())

   682                     break;

   683                 Inc();

   684                 }

   685             }

   686         }

   687     iToken.Set(MarkedToken());

   688     SkipSpaceAndMark();

   689     return (val);

   690     }

   691 

   692 TInt

   693 TPolicyParser::parse_sa_spec_paramsL(CPolicySpec& aSpec)

   694     {

   695     LOG_("TPolicyParser::parse_sa_spec_paramsL()\n");

   696     TInt sa_type_defined(0);

   697     TInt err(KErrNone);

   698     token_type val;

   699 

   700     while ((val = NextToken()) == token_string)

   701         {

   702         if (iToken.Compare(_L("ah")) == 0)

   703             {

   704             sa_type_defined++;

   705             aSpec.iSpec.iType = SADB_SATYPE_AH;

   706             }

   707         else if (iToken.Compare(_L("esp")) == 0)

   708             {

   709             sa_type_defined++;

   710             aSpec.iSpec.iType = SADB_SATYPE_ESP;

   711             }

   712         else if (iToken.Compare(_L("encrypt_alg")) == 0)

   713             {

   714             err = Val(aSpec.iSpec.iEalg, EDecimal);

   715             if ((err != KErrNone) || (aSpec.iSpec.iEalg > MAX_EALG_VALUE))

   716                 {

   717                 Error(_L("invalid encrypt alg %d"), (TUint)aSpec.iSpec.iEalg);

   718                 return (KErrGeneral);

   719                 }

   720             }

   721         else if (iToken.Compare(_L("max_encrypt_bits")) == 0)

   722             {

   723             err = Val(aSpec.iSpec.iEalgLen, EDecimal);

   724             if (err != KErrNone)

   725                 {

   726                 Error(_L("invalid encrypt alg key length %d"),

   727                       aSpec.iSpec.iEalgLen);

   728                 return (KErrGeneral);

   729                 }

   730             }

   731         else if (iToken.Compare(_L("auth_alg")) == 0)

   732             {

   733             err = Val(aSpec.iSpec.iAalg, EDecimal);

   734             if (err != KErrNone)

   735                 {

   736                 Error(_L("invalid auth alg %d"), aSpec.iSpec.iAalg);

   737                 return (KErrGeneral);

   738                 }

   739             }

   740         else if (iToken.Compare(_L("max_auth_bits")) == 0)

   741             {

   742             err = Val(aSpec.iSpec.iAalgLen, EDecimal);

   743             if (err != KErrNone)

   744                 {

   745                 Error(_L("invalid auth alg length %d"), aSpec.iSpec.iAalgLen);

   746                 return (KErrGeneral);

   747                 }

   748             }

   749         else if ((iToken.Compare(_L("identity")) == 0) ||

   750                  (iToken.Compare(_L("identity_remote")) == 0))

   751             {

   752             if (aSpec.iRemoteIdentity)

   753                 {

   754                 Error(_L("duplicate remote identity"));

   755                 err = KErrGeneral;

   756                 }

   757             else if ((val = NextToken()) == token_string)

   758                 {

   759                 aSpec.iRemoteIdentity = HBufC8::NewL(iToken.Length() + 1);

   760                 aSpec.iRemoteIdentity->Des().Copy(iToken);

   761                 }

   762             else

   763                 {

   764                 Error(_L("invalid remote identity value"));

   765                 err = KErrGeneral;

   766                 }

   767             }

   768         else if (iToken.Compare(_L("identity_local")) == 0)

   769             {

   770             if (aSpec.iLocalIdentity)

   771                 {

   772                 Error(_L("duplicate local identity"));

   773                 err = KErrGeneral;

   774                 }

   775             else if ((val = NextToken()) == token_string)

   776                 {

   777                 aSpec.iLocalIdentity = HBufC8::NewL(iToken.Length() + 1);

   778                 aSpec.iLocalIdentity->Des().Copy(iToken);

   779                 }

   780             else

   781                 {

   782                 Error(_L("invalid local identity value"));

   783                 err = KErrGeneral;

   784                 }

   785             }

   786         else if (iToken.Compare(_L("pfs")) == 0)

   787             {

   788             aSpec.iSpec.iPfs = 1;

   789             }

   790         else if (iToken.Compare(_L("connid_specific")) == 0)

   791             {

   792             // For backward compatibility

   793             aSpec.iSpec.iMatchProtocol = 1;

   794             aSpec.iSpec.iMatchRemotePort = 1;

   795             aSpec.iSpec.iMatchLocalPort = 1;

   796             }

   797         else if (iToken.Compare(_L("protocol_specific")) == 0)

   798             {

   799             aSpec.iSpec.iMatchProtocol = 1;

   800             }

   801         else if ((iToken.Compare(_L("src_port_specific")) == 0)

   802                  || (iToken.Compare(_L("local_port_specific")) == 0))

   803             {

   804             aSpec.iSpec.iMatchLocalPort = 1;

   805             }

   806         else if ((iToken.Compare(_L("dst_port_specific")) == 0)

   807                  || (iToken.Compare(_L("remote_port_specific")) == 0))

   808             {

   809             aSpec.iSpec.iMatchRemotePort = 1;

   810             }

   811         else if (iToken.Compare(_L("proxy_specific")) == 0)

   812             {

   813             aSpec.iSpec.iMatchProxy = 1;

   814             }

   815         else if (iToken.Compare(_L("src_specific")) == 0)

   816             {

   817             aSpec.iSpec.iMatchSrc = 1;

   818             }

   819         else if (iToken.Compare(_L("local_specific")) == 0)

   820             {

   821             aSpec.iSpec.iMatchLocal = 1;

   822             }

   823         else if (iToken.Compare(_L("remote_specific")) == 0)

   824             {

   825             aSpec.iSpec.iMatchRemote = 1;

   826             }

   827         else if (iToken.Compare(_L("replay_win_len")) == 0)

   828             {

   829             err = Val(aSpec.iSpec.iReplayWindowLength, EDecimal);

   830             }

   831         else if (iToken.Compare(_L("hard_lifetime_allocations")) == 0)

   832             {

   833             err = Val(aSpec.iSpec.iHard.sadb_lifetime_allocations, EDecimal);

   834             }

   835         else if (iToken.Compare(_L("hard_lifetime_bytes")) == 0)

   836             {

   837             err = Val(aSpec.iSpec.iHard.sadb_lifetime_bytes, EDecimal);

   838             }

   839         else if (iToken.Compare(_L("hard_lifetime_addtime")) == 0)

   840             {

   841             err = Val(aSpec.iSpec.iHard.sadb_lifetime_addtime, EDecimal);

   842             }

   843         else if (iToken.Compare(_L("hard_lifetime_usetime")) == 0)

   844             {

   845             err = Val(aSpec.iSpec.iHard.sadb_lifetime_usetime, EDecimal);

   846             }

   847         else if (iToken.Compare(_L("soft_lifetime_allocations")) == 0)

   848             {

   849             err = Val(aSpec.iSpec.iSoft.sadb_lifetime_allocations, EDecimal);

   850             }

   851         else if (iToken.Compare(_L("soft_lifetime_bytes")) == 0)

   852             {

   853             err = Val(aSpec.iSpec.iSoft.sadb_lifetime_bytes, EDecimal);

   854             }

   855         else if (iToken.Compare(_L("soft_lifetime_addtime")) == 0)

   856             {

   857             err = Val(aSpec.iSpec.iSoft.sadb_lifetime_addtime, EDecimal);

   858             }

   859         else if (iToken.Compare(_L("soft_lifetime_usetime")) == 0)

   860             {

   861             err = Val(aSpec.iSpec.iSoft.sadb_lifetime_usetime, EDecimal);

   862             }

   863         else

   864             {

   865             Error(_L("invalid keyword"));

   866             return (KErrGeneral);

   867             }

   868         if (err != KErrNone)

   869             {

   870             Error(_L("invalid numeric value"));

   871             return (err);

   872             }

   873         }

   874 

   875     if (val != token_brace_right)

   876         {

   877         Error(_L("right brace not found"));

   878         return (KErrGeneral);

   879         }

   880     else if (sa_type_defined < 1)

   881         {

   882         Error(_L("sa type not defined for sa"));

   883         return (KErrGeneral);

   884         }

   885     else if (sa_type_defined > 1)

   886         {

   887         Error(_L("sa type defined times for sa"));

   888         return (KErrGeneral);

   889         }

   890     else if ((aSpec.iSpec.iType == SADB_SATYPE_AH) && !aSpec.iSpec.iAalg)

   891         {

   892         Error(_L("auth alg not defined for sa"));

   893         return (KErrGeneral);

   894         }

   895     else if ((aSpec.iSpec.iType == SADB_SATYPE_ESP) && !aSpec.iSpec.iEalg)

   896         {

   897         Error(_L("encrypt alg not defined for sa"));

   898         return (KErrGeneral);

   899         }

   900     else if ((aSpec.iSpec.iType == SADB_SATYPE_UNSPEC) &&

   901              (aSpec.iSpec.iEalg || aSpec.iSpec.iAalg))

   902         {

   903         Error(_L("null SA cannot have any algorithms"));

   904         return (KErrGeneral);

   905         }

   906 

   907     return (KErrNone);

   908     }

   909 

   910 TInt

   911 TPolicyParser::parse_sa_specL(CSecurityPolicy* aSp)

   912     {

   913     LOG_("TPolicyParser::parse_sa_specL()\n");

   914     TInt err(KErrNone);

   915     CPolicySpec* spec(NULL);

   916 

   917     if (NextToken() != token_string)

   918         {

   919         Error(_L("Syntax error"));

   920         err = KErrGeneral;

   921         }

   922     else

   923         {

   924         spec = CPolicySpec::NewL(iToken);

   925         aSp->Add(spec);

   926 

   927         if (NextToken() != token_equal || NextToken() != token_brace_left)

   928             {

   929             Error(_L("Syntax error"));

   930             err = KErrGeneral;

   931             }

   932         else

   933             {

   934             err = parse_sa_spec_paramsL(*spec);

   935             }

   936         }

   937 

   938     return (err);

   939     }

   940 

   941 TInt

   942 TPolicyParser::parse_sa_spec_listL(TSecpolBundle& aBundle,

   943                                    CSecurityPolicy* aSp, TInt& aFQDNCount)

   944     {

   945     LOG_("TPolicyParser::parse_sa_spec_listL()\n");

   946     CSecpolBundleItem* item(NULL);

   947     CPolicySpec* spec(NULL);

   948     token_type val;

   949     TInt err(KErrNone);

   950 

   951     while ((val = NextToken()) == token_string)

   952         {

   953         // Find the SA transform specification from the given policy

   954         HBufC8 * hbuf = HBufC8::NewL(iToken.Length());

   955         hbuf->Des().Copy(iToken);

   956         spec = aSp->FindSpec(hbuf->Des());

   957         delete hbuf;

   958         hbuf = NULL;

   959         

   960         // A temporary(?) special kludge: if the keyword is 'tunnel'

   961         // assume this is a plain tunnel specification, without any

   962         // IPsec processing

   963         

   964         // NOTE: 

   965         //  This works only when the SA specification name is not 'tunnel

   966         //  ('tunnel' should be illegal name for SA specification to

   967         //   avoid confusion)

   968         if (!spec && iToken.Compare(_L("tunnel")))

   969             {

   970             Error(_L("sa or plain tunnel not defined"));

   971             err = KErrGeneral;

   972             break;

   973             }

   974 

   975         // Allocate memory for new bundle item

   976         item = new (ELeave) CSecpolBundleItem;

   977         CleanupStack::PushL(item);

   978 

   979         // Init bundle item by using the SA transform template found        

   980         item->iSpec = spec;

   981         

   982         // Read next token

   983         val = NextToken();

   984         

   985         // Check that '(' found

   986         if (val != token_par_left)

   987             {

   988             // Remove bundle item from the CleanupStack and set error code

   989             CleanupStack::PopAndDestroy();

   990             Error(_L("missing left parenthesis"));

   991             err = KErrGeneral;

   992             break;

   993             }

   994 

   995         // Read next token

   996         val = NextToken();

   997         

   998         // Check if tunnel specification is set

   999         if (val == token_string)

  1000             {

  1001             // Tunnel entry found so determine if name or plain address

  1002             if (aSp->SearchForEPNameL(iToken) == KErrNone)

  1003                 {

  1004                 // Tunnel name is set so copy it

  1005                 item->iTunnelEpName = HBufC8::NewL(iToken.Length());

  1006                 item->iTunnelEpName->Des().Copy(iToken);

  1007                 }

  1008             else

  1009                 {

  1010                 // Try to instantiate IP address -- if not possible,

  1011                 // consider the entry to represent an FQDN address,

  1012                 // which needs to be looked up via DNS later on.

  1013                 LOG_1("Found tunnel address: '%S'\n", &iToken);

  1014                 err = item->iTunnel.Input(iToken);

  1015                 if (err)

  1016                     {

  1017                     LOG_("Tunnel address invalid IP, assuming FQDN\n");

  1018                     item->iTunnelEpFQDN = iToken.AllocL();

  1019                     err = KErrNone;

  1020                     aFQDNCount++;

  1021                     }

  1022                 }

  1023 

  1024             LOG_("Parser proceeding to next token...\n");

  1025             // Read next token

  1026             val = NextToken();

  1027             }

  1028         

  1029         // Check that ')' terminates the definition correctly    

  1030         if (val != token_par_right)

  1031             {

  1032             // Remove bundle item from the CleanupStack and set error code

  1033             LOG_("Error: Closing parenthesis missing in ipsec policy section\n");

  1034             CleanupStack::PopAndDestroy();

  1035             Error(_L("missing right parenthesis"));

  1036             err = KErrGeneral;

  1037             break;

  1038             }

  1039 

  1040         LOG_("Adding bundle to the list\n");

  1041         // Remove bundle item from the CleanupStack and add it into the list

  1042         CleanupStack::Pop();

  1043         aBundle.AddLast(*item);

  1044         }

  1045 

  1046     // Check that terminating '}' is found

  1047     if (!err && val != token_brace_right)

  1048         {

  1049         LOG_("Error, missing right brace\n");

  1050         Error(_L("missing right brace"));

  1051         err = KErrGeneral;

  1052         }

  1053 

  1054     LOG_1("Exiting, with error code %d\n", err);

  1055 

  1056     return (err);

  1057     }

  1058 

  1059 TInt

  1060 TPolicyParser::parse_ip_addr_and_maskL(

  1061     TInetAddr& addr,

  1062     TInetAddr& mask,

  1063     HBufC8*& aSelEpName,

  1064     HBufC8*& aMaskEpName,

  1065     CSecurityPolicy* aSecPol)

  1066     {

  1067     LOG_("TPolicyParser::parse_ip_addr_and_maskL()\n");

  1068     TInt err(KErrNone);

  1069     if (NextToken() != token_string)

  1070         {

  1071         Error(_L("ip address not found"));

  1072         return (KErrGeneral);

  1073         }

  1074 

  1075     if (aSecPol->SearchForEPNameL(iToken) == KErrNone)

  1076         {

  1077         aSelEpName = HBufC8::NewL(iToken.Length());

  1078         aSelEpName->Des().Copy(iToken);

  1079         }

  1080     else

  1081         {

  1082         err = addr.Input(iToken);

  1083         if (err != 0)

  1084             {

  1085             Error(_L("invalid ip address "));

  1086             return (err);

  1087             }

  1088         }

  1089 

  1090     if (NextToken() != token_string)

  1091         {

  1092         Error(_L("address mask not found"));

  1093         return (KErrGeneral);

  1094         }

  1095 

  1096     if (aSecPol->SearchForEPNameL(iToken) == KErrNone)

  1097         {

  1098         aMaskEpName = HBufC8::NewL(iToken.Length());

  1099         aMaskEpName->Des().Copy(iToken);

  1100         }

  1101     else

  1102         {

  1103         err = mask.Input(iToken);

  1104         if (err != 0)

  1105             {

  1106             Error(_L("invalid address mask "));

  1107             return (err);

  1108             }

  1109         }

  1110 

  1111     return (KErrNone);

  1112     }

  1113 

  1114 ////////////////////////////////////////////////////////////

  1115 // Parse the endpoint name entry

  1116 ////////////////////////////////////////////////////////////

  1117 //

  1118 TInt

  1119 TPolicyParser::parse_ep_specL(CSecurityPolicy* aSp)

  1120     {

  1121     LOG_("TPolicyParser::parse_ep_specL()\n");

  1122     TInt err(KErrNone);

  1123     CPolicySpec* spec(NULL);

  1124 

  1125     if (NextToken() != token_string)

  1126         {

  1127         Error(_L("Syntax error"));

  1128         err = KErrGeneral;

  1129         }

  1130     else

  1131         {

  1132         spec = CPolicySpec::NewL(iToken, EPolSpecEP);

  1133         aSp->Add(spec);

  1134