1 /*

     2 * Copyright (c) 2002-2006 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description: 

    15 * Security policy database module. 

    16 * "Runtime" methods of "CSecurityPolicy" class.

    17 *

    18 */

    19 

    20 

    21 #include <networking/pfkeyv2.h>

    22 #include "spdb.h"

    23 #include "logvpncommon.h"

    24 

    25 //

    26 //  CPolicySelector

    27 //

    28 CPolicySelector::CPolicySelector()

    29     {}

    30 

    31 EXPORT_C CPolicySelector*

    32 CPolicySelector::NewL()

    33     {

    34     CPolicySelector* self = new (ELeave) CPolicySelector();

    35     self->Construct();

    36     return self;

    37     }

    38 

    39 EXPORT_C void

    40 CPolicySelector::Construct()

    41     {

    42     iIcmpType = -1;           // used, if != -1

    43     iType = -1;               // used, if != -1

    44     iIcmpCode = -1;           // used, if != -1

    45     iGlobalSelector = EFalse; // the global flag defaults to false

    46     iIsFinal = EFalse;

    47     iIsMerge = EFalse;

    48     iDirection = KPolicySelector_SYMMETRIC;

    49     iDropAction = EFalse;

    50     iProtocol = 0;

    51 

    52     // Init addresses to undefined    

    53     iLocal.SetFamily(KAFUnspec);

    54     iLocalMask.SetFamily(KAFUnspec);

    55     iRemote.SetFamily(KAFUnspec);

    56     iRemoteMask.SetFamily(KAFUnspec);

    57     

    58     // Clear interface name

    59     iInterface.Zero();

    60     

    61     // Init Endpoint names to NULL

    62     iLocSelEpName = NULL;

    63     iLocMaskEpName = NULL;

    64     iRemSelEpName = NULL;

    65     iRemMaskEpName = NULL;

    66     

    67     iSequenceNumber = 0;

    68     iCompWord = 0;

    69     }

    70 

    71 EXPORT_C CPolicySelector*

    72 CPolicySelector::NewL(CPolicySelector* aPS)

    73     {

    74     CPolicySelector* self = new (ELeave) CPolicySelector();

    75     CleanupStack::PushL(self);

    76     self->ConstructL(aPS);

    77     CleanupStack::Pop();

    78     return self;

    79     }

    80 

    81 EXPORT_C void

    82 CPolicySelector::ConstructL(CPolicySelector* aPS)

    83     {

    84     iDirection = aPS->iDirection;

    85     iRemote = aPS->iRemote;         // including port selector, if port non-zero

    86     iRemoteMask = aPS->iRemoteMask; // only address part used, as a mask

    87     iLocal = aPS->iLocal;           // including port selector, if port non-zero

    88     iLocalMask = aPS->iLocalMask;   // only address part used, as a mask

    89     iProtocol = aPS->iProtocol;     // used, if non-zero

    90     iIcmpType = aPS->iIcmpType;     // used, if != -1

    91     iType = aPS->iType;             // used, if != -1

    92     iIcmpCode = aPS->iIcmpCode;     // used, if != -1

    93     iGlobalSelector = aPS->iGlobalSelector;

    94     iIsFinal = aPS->iIsFinal;

    95     iIsMerge = aPS->iIsMerge;

    96     iDropAction = aPS->iDropAction;

    97     iInterface = aPS->iInterface;

    98     

    99     iSequenceNumber = aPS->iSequenceNumber;

   100     iCompWord = aPS->iSequenceNumber;

   101 

   102     // Copy EndPoint names    

   103     if (aPS->iLocSelEpName && aPS->iLocSelEpName->Length())

   104         {

   105         iLocSelEpName = HBufC8::NewL(aPS->iLocSelEpName->Length());

   106         *iLocSelEpName = *aPS->iLocSelEpName;

   107         }

   108     if (aPS->iLocMaskEpName && aPS->iLocMaskEpName->Length())

   109         {

   110         iLocMaskEpName = HBufC8::NewL(aPS->iLocMaskEpName->Length());

   111         *iLocMaskEpName = *aPS->iLocMaskEpName;

   112         }

   113     if (aPS->iRemSelEpName && aPS->iRemSelEpName->Length())

   114         {

   115         iRemSelEpName = HBufC8::NewL(aPS->iRemSelEpName->Length());

   116         *iRemSelEpName = *aPS->iRemSelEpName;

   117         }

   118     if (aPS->iRemMaskEpName && aPS->iRemMaskEpName->Length())

   119         {

   120         iRemMaskEpName = HBufC8::NewL(aPS->iRemMaskEpName->Length());

   121         *iRemMaskEpName = *aPS->iRemMaskEpName;

   122         }

   123 

   124     TSecpolBundleIter iterl(aPS->iBundle);

   125     CSecpolBundleItem* itemL(NULL);

   126     CSecpolBundleItem* newItemL(NULL);

   127     while ((itemL = iterl++) != NULL)

   128         {

   129         newItemL = new (ELeave) CSecpolBundleItem;

   130         

   131         // Points to the same SA

   132         newItemL->iSpec = itemL->iSpec;      

   133         

   134         // No need to fill iNext. Is filled when adding

   135         newItemL->iTunnel = itemL->iTunnel;  

   136         iBundle.AddLast(*newItemL);

   137         }

   138 

   139     iNext = aPS->iNext;

   140     }

   141 

   142 CSecpolBundleItem*

   143 CPolicySelector::FindBundleL(TInt aIndex)

   144     {

   145     TSecpolBundleIter iterL(iBundle);

   146     CSecpolBundleItem* itemL(NULL);

   147     CSecpolBundleItem* newItemL(NULL);

   148     TInt i = 0;

   149     while (((itemL = iterL++) != NULL) && (i < aIndex))

   150         {

   151         i++;

   152         }

   153 

   154     // The element exists. We create a copy

   155     if ((i == aIndex) && (itemL != NULL))    

   156         {

   157         newItemL = new (ELeave) CSecpolBundleItem;

   158         

   159         // Need a copy to have separed bundle lists

   160         newItemL->iSpec = itemL->iSpec;      

   161         

   162         // No need to fill iNext. Is filled when adding

   163         newItemL->iTunnel = itemL->iTunnel;  

   164         }

   165 

   166     return newItemL;

   167     }

   168 

   169 CSecpolBundleItem::~CSecpolBundleItem()

   170     {

   171     delete iTunnelEpName;

   172     delete iTunnelEpFQDN;

   173     }

   174 

   175 void CPolicySelector::GetFQDNAddressListL(CSecPolBundleList& aPolList) 

   176     {

   177     LOG_("CPolicySelector::GetFQDNAddressListL() entry\n");

   178     TSecpolBundleIter iterl(iBundle);

   179     CSecpolBundleItem* itemL(NULL);

   180     while ((itemL = iterl++) != NULL)

   181         {

   182         if (itemL->iTunnelEpFQDN) 

   183             {

   184             LOG_1("Found FQDN: '%S', appending to the list\n", &(*itemL->iTunnelEpFQDN));

   185             aPolList.AppendL(itemL);

   186             LOG_("Append complete\n");

   187             }

   188         else 

   189             {

   190             TBuf<40> addrstr;

   191             itemL->iTunnel.Output(addrstr);

   192             LOG_1("Found IP: '%S', no need to add\n", &addrstr);

   193             }

   194         }

   195     LOG_("CPolicySelector::GetFQDNAddressListL() exit\n");

   196     }

   197 

   198 EXPORT_C

   199 CPolicySelector::~CPolicySelector()

   200     {

   201     TSecpolBundleIter iterl(iBundle);

   202     CSecpolBundleItem* iteml(NULL);

   203     while ((iteml = iterl++) != NULL)

   204         {

   205         iBundle.Remove(*iteml);

   206         delete iteml;

   207         }

   208 

   209     delete iRemSelEpName;

   210     delete iRemMaskEpName;

   211     delete iLocMaskEpName;

   212     delete iLocSelEpName;

   213     }

   214 

   215 // Match a selector against the packet information

   216 //

   217 // Returns 0, if selector does not match the information

   218 //         1, if selector matches the information

   219 TInt

   220 CPolicySelector::Match(

   221     const TInetAddr &aSrc,         // The src address, and port if known

   222     const TInetAddr &aDst,         // The dst address, and port if known

   223     TInt aProtocol,                // Transport protocol, if > 0 (known)

   224     TInt aIcmpType,                // ICMP Type, if ICMP (-1 otherwise)

   225     TInt aIcmpCode,                // ICMP Code, if ICMP (-1 otherwise)

   226     TInt aType) const              // Type code, (-1 if not used)

   227     {

   228     return (aDst.Match(iRemote, iRemoteMask)

   229             && aSrc.Match(iLocal, iLocalMask)

   230             && (iProtocol == 0 || iProtocol == aProtocol)

   231             && (iRemote.Port() == 0 || iRemote.Port() == aDst.Port())

   232             && (iLocal.Port() == 0 || iLocal.Port() == aDst.Port())

   233             && (iIcmpType == -1 || iIcmpType == aIcmpType)

   234             && (iIcmpCode == -1 || iIcmpCode == aIcmpCode)

   235             && (iType == -1 || iType == aType));

   236     }

   237 

   238 // Checks if this policy is using this SA

   239 EXPORT_C TBool

   240 CPolicySelector::UseSA(CPolicySpec* aSA, TInetAddr* tunnel)

   241     {

   242     TSecpolBundleIter iterBundle(iBundle);

   243     CSecpolBundleItem* itemBundle(NULL);

   244 

   245     while ((itemBundle = iterBundle++) != NULL)

   246         {

   247         if (itemBundle->iSpec)

   248             {

   249             // SA used in a Policy. 2 SA cannot have the same name

   250             if (!(itemBundle->iSpec->iName->Compare(*aSA->iName)))

   251                 {

   252                 if (tunnel)

   253                     {

   254                     *tunnel = itemBundle->iTunnel;

   255                     }

   256                 return ETrue;

   257                 }

   258             }

   259         }

   260 

   261     return EFalse;  // This selector doesn't use the SA

   262     }

   263 

   264 //

   265 // CSAPairList: Translation table used when copying a policy

   266 CSAPairList::~CSAPairList()

   267     {

   268     TSAPairNode* next(NULL);

   269     TSAPairNode* node(iList);

   270     while (node)

   271         {

   272         next = node->iNext;

   273         delete node;

   274         node = next;

   275         }

   276     }

   277 

   278 //

   279 // Add at the begining to make it faster

   280 void

   281 CSAPairList::AddL(CPolicySpec* aOldSA, CPolicySpec* aNewSA)

   282     {

   283     TSAPairNode* node = new (ELeave) TSAPairNode;

   284     node->iOldSA = aOldSA;

   285     node->iNewSA = aNewSA;

   286     node->iNext = iList;

   287     iList = node;

   288     }

   289 

   290 CPolicySpec*

   291 CSAPairList::Translate(CPolicySpec* aOldSA)

   292     {

   293     TSAPairNode* node = iList;

   294     while (node)

   295         {

   296         if (node->iOldSA == aOldSA)

   297             return node->iNewSA;

   298         node = node->iNext;

   299         }

   300 

   301     // Not found

   302     return(NULL);

   303     }

   304 

   305 void CSecurityPolicy::GetFQDNAddressListL(CSecPolBundleList& aPolList) 

   306     {

   307     LOG_("CSecurityPolicy::GetFQDNAddressListL()\n");

   308     if (iSelectors) 

   309         {

   310         TInt count(iSelectors->Count());

   311         for (TInt i = 0; i < count; i++) 

   312             {

   313             iSelectors->At(i)->GetFQDNAddressListL(aPolList);

   314             }

   315         }

   316     }

   317 

   318 EXPORT_C

   319 CSecurityPolicy::CSecurityPolicy()

   320     {}

   321 

   322 EXPORT_C void

   323 CSecurityPolicy::ConstructL()

   324     {

   325     iSpecs = CSAList::NewL(1);

   326     iSelectors = CSelectorList::NewL(1);

   327     }

   328 

   329 // Creates a Security Policy from an existing one

   330 EXPORT_C void

   331 CSecurityPolicy::ConstructL(CSecurityPolicy* aSecPol)

   332     {

   333     // Creates a new SA List with new SA nodes!!!

   334     if (aSecPol->SAList()->Count() > 0)

   335         {

   336         iSpecs = CSAList::NewL(aSecPol->SAList());

   337         }

   338     else

   339         {

   340         iSpecs = CSAList::NewL(1);

   341         }

   342 

   343     // The selector bundles use references to the old SA nodes

   344     // so if we copy only the content we'll have invalid references.

   345     // Therefore, we need a translations tables from old nodes to new

   346     // ones to pass it to the selector constructor

   347     if (aSecPol->SelectorList()->Count() > 0)

   348         {

   349         CSAPairList* table = CreateTranslationTableL(aSecPol->SAList(), iSpecs);

   350         CleanupStack::PushL(table);

   351         iSelectors = CSelectorList::NewL(aSecPol->SelectorList(), table);

   352 

   353         // The table is not needed anymore

   354         CleanupStack::PopAndDestroy();

   355         }

   356     else

   357         {

   358         iSelectors = CSelectorList::NewL(1);

   359         }

   360     }

   361 

   362 CSAPairList*

   363 CSecurityPolicy::CreateTranslationTableL(

   364     CSAList* aOldSAList,

   365     CSAList* aNewSAList)

   366     {

   367     CSAPairList* table = new (ELeave) CSAPairList;

   368     CleanupStack::PushL(table);

   369     TInt count(aOldSAList->Count());

   370     for (TInt i = 0; i < count; i++)

   371         {

   372         table->AddL(aOldSAList->At(i), aNewSAList->At(i));

   373         }

   374     CleanupStack::Pop();

   375     return (table);

   376     }

   377 

   378 CSecurityPolicy::~CSecurityPolicy()

   379     {

   380     if (iSpecs)

   381         {

   382         // Deletes all the elems in the list

   383         TInt count(iSpecs->Count());

   384         for (TInt i = 0; i < count; i++) 

   385             {

   386             delete iSpecs->At(i);

   387             }

   388         delete iSpecs;

   389         iSpecs = NULL;

   390         }

   391 

   392     if (iSelectors)

   393         {

   394         // Deletes all the elems in the list

   395         TInt count(iSelectors->Count());

   396         for (TInt i = 0; i < count; i++) 

   397             {

   398             delete iSelectors->At(i);

   399             }

   400         delete iSelectors;

   401         iSelectors = NULL;

   402         }

   403     }

   404 

   405 TSecpolBundle*

   406 CSecurityPolicy::FindBundle(

   407     TUint aDirection,              // Direction flag

   408     const TInetAddr& aSrc,         // Source Address (and optionally port)

   409     const TInetAddr& aDst,         // Destination Address (and optionally port)

   410     TInt aProtocol,                // Transport protocol (if > 0)

   411     TInt aIcmpType,                // (if != -1)

   412     TInt aIcmpCode,                // (if != -1)

   413     TInt aType)                    // (if != -1)

   414     {

   415     TInt count(iSelectors->Count());

   416     for (TInt i = 0; i < count; i++)

   417         {

   418         CPolicySelector* selector = iSelectors->At(i);

   419         if ((selector->iDirection & aDirection)

   420             && selector->Match(aSrc, 

   421                                aDst, 

   422                                aProtocol, 

   423                                aIcmpType, 

   424                                aIcmpCode, 

   425                                aType))

   426             {

   427             return (&selector->iBundle);

   428             }

   429         }

   430 

   431     return (NULL);

   432     }

   433 

   434 TInt

   435 CSecurityPolicy::SearchForEPNameL(TDesC& aTokenString)

   436     {

   437     TInt err(KErrNotFound);

   438     HBufC8* name = HBufC8::NewL(aTokenString.Length());

   439     name->Des().Copy(aTokenString);

   440 

   441     // Iterate through the policy specification list

   442     TInt count(iSpecs->Count());

   443     for (TInt i = 0; i < count; i++)

   444         {

   445         CPolicySpec* polSpec = iSpecs->At(i);

   446         // Check if spesification type is EndPoint and name for it exists

   447         if (polSpec->iSpectype == EPolSpecEP && polSpec->iName)

   448             {

   449             // Compare EndPoint name against given name

   450             if (name->Des().Compare(polSpec->iName->Des()) == 0)

   451                 {

   452                 // Match found so set return value to success

   453                 err = KErrNone;

   454                 break;

   455                 }

   456             }

   457         }

   458 

   459     // Free memory allocated for name and then return

   460     delete name;

   461     return (err);

   462     }

   463 

   464 EXPORT_C CPolicySpec*

   465 CSecurityPolicy::FindSpec(const TDesC8& aName)

   466     {

   467     CPolicySpec* spec(NULL);

   468     TInt count(iSpecs->Count());

   469     for (TInt i = 0; i < count; i++)

   470         {

   471         spec = iSpecs->At(i);

   472         if ((*spec->iName).Compare(aName) == 0)

   473             {

   474             return spec;

   475             }

   476         }

   477     return (NULL);

   478     }

   479 

   480 //

   481 //  CPolicySpec

   482 //

   483 CPolicySpec::CPolicySpec()

   484     {}

   485 

   486 EXPORT_C CPolicySpec*

   487 CPolicySpec::NewL()

   488     {

   489     CPolicySpec* self = new (ELeave) CPolicySpec();

   490     self->Construct();

   491     return self;

   492     }

   493 

   494 EXPORT_C void

   495 CPolicySpec::Construct()

   496     {

   497     iEpSpec.iIsOptional = EFalse;

   498     iEpSpec.iEpAddr = NULL;

   499     }

   500 

   501 EXPORT_C CPolicySpec*

   502 CPolicySpec::NewL(TDesC& aName, TPolicySpecType iSpectype)

   503     {

   504     CPolicySpec* self = new (ELeave) CPolicySpec();

   505     CleanupStack::PushL(self);

   506     self->ConstructL(aName, iSpectype);

   507     CleanupStack::Pop();

   508     return self;

   509     }

   510 

   511 EXPORT_C void

   512 CPolicySpec::ConstructL(TDesC& aName, TPolicySpecType aSpectype)

   513     {

   514     iName = HBufC8::NewL(aName.Length());

   515     iName->Des().Copy(aName);

   516     iSpectype = aSpectype;

   517     }

   518 

   519 // Used to initialize with an existing CPolicySpec

   520 EXPORT_C CPolicySpec*

   521 CPolicySpec::NewL(CPolicySpec* aPolSpec)

   522     {

   523     CPolicySpec* self = new (ELeave) CPolicySpec();

   524     CleanupStack::PushL(self);

   525     self->ConstructL(aPolSpec);

   526     CleanupStack::Pop();

   527     return self;

   528     }

   529 

   530 EXPORT_C void

   531 CPolicySpec::ConstructL(CPolicySpec* aPolSpec)

   532     {

   533     // Always bigger than 0

   534     iName = HBufC8::NewL(aPolSpec->iName->Length()); 

   535     *iName = *aPolSpec->iName;

   536 

   537     if (aPolSpec->iRemoteIdentity)

   538         {

   539         iRemoteIdentity = HBufC8::NewL(aPolSpec->iRemoteIdentity->Length());

   540         *iRemoteIdentity = *aPolSpec->iRemoteIdentity;

   541         }

   542 

   543     if (aPolSpec->iLocalIdentity)

   544         {

   545         iLocalIdentity = HBufC8::NewL(aPolSpec->iLocalIdentity->Length());

   546         *iLocalIdentity = *aPolSpec->iLocalIdentity;

   547         }

   548     iSpec = aPolSpec->iSpec;

   549     // Even the queue position is cloned    

   550     iNext = aPolSpec->iNext;  

   551     }

   552 

   553 EXPORT_C

   554 CPolicySpec::~CPolicySpec()

   555     {

   556     delete iName;

   557     delete iRemoteIdentity;

   558     delete iLocalIdentity;

   559     }

   560 

   561 // CSAList

   562 CSAList::CSAList(TInt aGranularity) :

   563     CArrayFixFlat<CPolicySpec *>(aGranularity)

   564     {}

   565 

   566 EXPORT_C CSAList*

   567 CSAList::NewL(TInt aGranularity)

   568     {

   569     CSAList* self = new (ELeave) CSAList(aGranularity);

   570     self->Construct(aGranularity);

   571     return self;

   572     }

   573 

   574 EXPORT_C void

   575 CSAList::Construct(TInt /* aGranularity */)

   576     {}

   577 

   578 CSAList::CSAList(CSAList* aSAList) :

   579     CArrayFixFlat<CPolicySpec *>(aSAList->Count())

   580     {}

   581 

   582 EXPORT_C CSAList*

   583 CSAList::NewL(CSAList* aSAList)

   584     {

   585     CSAList* self = new (ELeave) CSAList(aSAList);

   586     CleanupStack::PushL(self);

   587     self->ConstructL(aSAList);

   588     CleanupStack::Pop();

   589     return self;

   590     }

   591 

   592 EXPORT_C void

   593 CSAList::ConstructL(CSAList* aSAList)

   594     {

   595     TInt count(aSAList->Count());

   596     for (TInt i = 0; i < count; i++)

   597         {

   598         CPolicySpec* policy = CPolicySpec::NewL(aSAList->At(i));

   599         CleanupStack::PushL(policy);

   600         AppendL(policy);

   601         CleanupStack::Pop();

   602         }

   603     }

   604 

   605 //

   606 // CSelectorList

   607 //

   608 CSelectorList::CSelectorList(TInt aGranularity) :

   609     CArrayFixFlat<CPolicySelector *>(aGranularity)

   610     {}

   611 

   612 EXPORT_C CSelectorList*

   613 CSelectorList::NewL(TInt aGranularity)

   614     {

   615     CSelectorList* self = new (ELeave) CSelectorList(aGranularity);

   616     self->Construct(aGranularity);

   617     return self;

   618     }

   619 

   620 EXPORT_C void

   621 CSelectorList::Construct(TInt /*aGranularity*/)

   622     {}

   623 

   624 CSelectorList::CSelectorList(CSelectorList* aSelList,

   625                              CSAPairList* /* aTable */) :

   626     CArrayFixFlat<CPolicySelector *>(aSelList->Count())

   627     {}

   628 

   629 EXPORT_C CSelectorList*

   630 CSelectorList::NewL(CSelectorList* aSelList,

   631                     CSAPairList* aTable)

   632     {

   633     CSelectorList* self = new (ELeave) CSelectorList(aSelList, aTable);

   634     CleanupStack::PushL(self);

   635     self->ConstructL(aSelList, aTable);

   636     CleanupStack::Pop();

   637     return self;

   638     }

   639 

   640 EXPORT_C void

   641 CSelectorList::ConstructL(CSelectorList* aSelList,

   642                           CSAPairList* aTable)

   643     {

   644     TInt count(aSelList->Count());

   645     for (TInt i = 0; i < count; i++)

   646         {

   647         CPolicySelector* selector = CPolicySelector::NewL(aSelList->At(i));

   648         // Bundle translation

   649         TSecpolBundleIter iterL(selector->iBundle);

   650         CSecpolBundleItem* itemL(NULL);

   651         while (((itemL = iterL++) != NULL))

   652             {

   653             if (itemL->iSpec)

   654                 {

   655                 itemL->iSpec = aTable->Translate(itemL->iSpec);

   656                 }

   657             }

   658 

   659         // Specs in the Bundle translated

   660         CleanupStack::PushL(selector);

   661         AppendL(selector);

   662         CleanupStack::Pop();

   663         }

   664     }

   665