// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// sa_spec.h - IPv6/IPv4 IPSEC security associations

// This file collects minimal definitions that need to be exported

// from the Security Associations Database into Security Policy

// database

//

/**

 @internalComponent

*/

#ifndef __SA_SPEC_H__

#define __SA_SPEC_H__

#include <ip6_hook.h>

#include "ipaddress.h"

#include <networking/pfkeyv2.h>

#include <networking/crypto.h>	// only for TAlgorithmClass, is this really necessary?

#include "epdb.h"

#include "ipseclog.h"

// Selector applies to inbound packets

const TUint KPolicyFilter_INBOUND = 0x1;

// Selector applies to outbound packets

const TUint KPolicyFilter_OUTBOUND = 0x2;

// Selector applies to both inbound and outbound packets

const TUint KPolicyFilter_SYMMETRIC =

	KPolicyFilter_INBOUND|KPolicyFilter_OUTBOUND;

// Indicate tunnel mode for Acquire and Verify (not really a filter).

const TUint KPolicyFilter_TUNNEL = 0x4;

// Selector can be merged with another matched selector.

const TUint KPolicyFilter_MERGE = 0x8;

// Negate selector -- drop if match occurs.

const TUint KPolicyFilter_DROP = 0x10;

// Final selector, do not look for "merge" selectors after this.

const TUint KPolicyFilter_FINAL = 0x20;

/**

* Ports is present in selector.

* The value indicates whether the content is actual port (1) or a packet

* type/code (0) from ICMP, MH or other similar protocols.

*/

const TUint KTransportSelector_PORTS = 0x1;

// Object tracking in the windows environment to

// help detecting possible memory leaks.

#if __WINS__ && _DEBUG

	extern int IPSEC_OBJECT_COUNT;

	#define	IPSEC_OBJECT_INC	++IPSEC_OBJECT_COUNT

	#define	IPSEC_OBJECT_DEC	--IPSEC_OBJECT_COUNT

	#define	IPSEC_OBJECT_TRACKING 1

// ..when desperate, use the following ..

//	#define	IPSEC_OBJECT_INC	do { Log::Printf(_L("INC[%u] %d"), (TInt)this, ++IPSEC_OBJECT_COUNT); } while (0)

//	#define	IPSEC_OBJECT_DEC	do { Log::Printf(_L("DEC[%u] %d"), (TInt)this, --IPSEC_OBJECT_COUNT); } while (0)

#else

	#define	IPSEC_OBJECT_INC

	#define	IPSEC_OBJECT_DEC

	#undef	IPSEC_OBJECT_TRACKING

#endif

class CIpsecReferenceCountObject : public CBase

	/**

	* The base class for all IPSEC reference count objects.

	*

	* Many IPSEC objects are implemented as "reference counted objects"

	* which automaticly delete self, when the last reference is removed.

	*

	* The contruction of the object is counted as one reference.

	* The Open() and Close() methods are not supposed to be overridden,

	* and are not defined "virtual". This base class attempts to be

	* as light as possible

	*

	* The destructor is virtual and private. The reference counted

	* objects are never deleted from outside, only from the Close()

	* method.

	*/

	{

public:

#ifdef IPSEC_OBJECT_TRACKING

	// Non-default constructor only needed for debugging

	CIpsecReferenceCountObject() 

		{

		IPSEC_OBJECT_INC;

		}

#endif

	inline void Open();

	inline TInt IsShared() const;

	void Close();

protected:

	virtual ~CIpsecReferenceCountObject()

		{

#ifdef IPSEC_OBJECT_TRACKING

		// Non-empty destructor only needed for debugging

		IPSEC_OBJECT_DEC;

#endif

		}

	TInt iRefs;

	};

void CIpsecReferenceCountObject::Open()

	/**

	* Increment reference count.

	*

	* Records an additional reference to the object.

	*/

	{

	++iRefs;

	}

TInt CIpsecReferenceCountObject::IsShared() const

	/**

	* Return the current reference count.

	*

	* The reference count works as implicit flag to

	* test whether object has more than one reference

	* to it (is shared).

	*

	* @li = 0, only one reference exist (not shared)

	* @li > 0, other references exist (object is shared)

	*

	* @return The reference count

	*/

	{

	return iRefs;

	}

class RPolicySelectorInfo

	/**

	* The policy selector information. This defines the IPSEC selector data layout,

	* as is used as basic component in the transport selectors. This is also the

	* basic information block, which is extracted from a packet (or flow).

	*/

	{

public:

	inline void FillZ();

	TUint8 iFlags;				//< Transport Selector flags (KTransportSelector_*)				

	TUint8 iProtocol;			//< IP Protocol code (0..255)

	TUint8 iReserved1;			//< Reverved for future use.(now for alignment only)

	TUint8 iReserved2;			//< Resevved for future use (now for alignment only)

	//

	TUint16 iPortRemote;		//< Remote port

	TUint16 iPortLocal;			//< Local port

	//

	RIpAddress iRemote;			//< Remote Address with scope id

	RIpAddress iLocal;			//< Local Address with scope id

	};

void RPolicySelectorInfo::FillZ()

	// Fill all fields with ZERO (including possible compiler generated padding)

	{

	TUint32 *const p = (TUint32 *)this;

	p[0] = p[1] = 0;	// iFlags, iProtocol, reserveds, iPortRemote, iPortLocal

	}

class TPolicyFilterInfo

	/**

	* The policy control and filter information.

	*

	* This defines the basic data for choosing the

	* selectors which are tested for transport selectors.

	* The filter can be based on

	*

	* - packet direction: inboud or outbound

	* - interface index

	*

	* This includes some other action controlling

	* flags, which affect the actions when the

	* selector matches.

	*

	* - merge

	* - final

	* - drop

	*

	*/

	{

public:

	TUint32 iFlags;		//< The KPolicyFilter_* flags.

	TUint32 iIndex;		//< The Interface Index.

	};

class CTransportSelector : public CIpsecReferenceCountObject

	/**

	* The Transport Selector.

	*

	* A transport selector is a list of basic selectors or'ed together.

	* The Transport Selector matches, if any of the basic selectors in

	* the list match.

	*

	* The basic transport selector is a reference counted object. The contruction

	* counts as the first reference and must be matched with corresponding

	* Close(). Record additional references with Open().

	*

	* The contruction automaticly increments the next Or'ed selector. Once

	* constructed, the selector is immutable. Aside from the reference count

	* house keeping, the content of the selector is constant.

	*/

	{

public:

	CTransportSelector(const RPolicySelectorInfo &aData, const RPolicySelectorInfo &aMask, CTransportSelector *const aOr);

	TInt Match(const RPolicySelectorInfo &aKey) const;

private:

	~CTransportSelector();

	TInt iRefs;				 				//< The reference count.

public:

	// immutable after construction

	const RPolicySelectorInfo iData;		//< The selector data (the values to check)

	const RPolicySelectorInfo iMask;		//< The selector mask (what values to check)

	CTransportSelector *const iOr;			//< Next alternative or NULL.

	};

//

// Mapping of low level types in pfkeyv2.h into more semantic names

// (This is to avoid a need to look many places in case pfkeyv2 changes)

//

typedef uint32_t TLifetimeAllocations;

typedef uint64_t TLifetimeBytes;

typedef uint64_t TLifetimeSeconds;

/**

// The default life time in seconds for larval SA's.

// Larvar SA is created by GETSPI (may also be used as a default for

// iLarvalLifetime in TSecurityAssocSpec).

*/

const TInt KLifetime_LARVAL_DEFAULT = 90;

class CIdentity : public CIpsecReferenceCountObject

	/**

	* A container for the Identity string.

	*/

	{

public:

	// Create and construct a new Identity block

	static CIdentity *NewL(const TDesC &aIdentity);

	static CIdentity *NewL(const TDesC8 &aIdentity, TUint16 aType);

	inline TUint16 Type() const	{return iType; }

	inline TInt Match(const CIdentity &aOther) const;

private:

	// Construct and destruct are private, triggered internally.

	CIdentity(TUint32 aLength) : iTypeLength(aLength) {};

	~CIdentity() {}

	TUint16 iType;						//< Type of the identity string (PREFIX, FQDN, USERFQDN)

	// //

	// *WARNING* *WARNING* *WARNING*

	// What now follows, is the TLitC8 structure.

	// The extra space is allocated only, if iTypeLength

	// is non-zero.

	// //

	// Why this TLitC8 "hack" instead of traditional

	// C construct with a "length" member and "fake buf[1]"?

	//

	// As far as layout, this is exactly the same. The TLitC8

	// "hack" only forces a Symbian specific layout. When a

	// descriptor is needed, it doesn't need to be constructed,

	// it's already existing and just returning a reference

	// to iTypeLength as TLitC8 is sufficient.

	// //

	const TUint iTypeLength;			//< TypeLength of TLitC8

public:

	inline const TDesC8 &Identity() const

		/**

		* Return the Identity string.

		*

		* @return The identity

		*/

		{

		return ((TLitC8<1> &)iTypeLength)();

		}

	};

TInt CIdentity::Match(const CIdentity &aOther) const

	/*

	* Return ETrue, if identities match.

	*

	* @param aOther The other identity

	* @return result of comparison.

	*/

	{

	return Identity() == aOther.Identity();

	}

// TLifetime, a help structure

class TLifetime

	{

public:

	TLifetime(const struct sadb_lifetime &aLifetime);

	static void Freeze(TTime &aTime, const TTime &aNow);

	TLifetime();

	// For current, these will count items used so far. For Hard and

	// Soft these will contain the limit values for the current

	// counts.

	// study: present unspecified limit with 0 or max value?

	TLifetimeAllocations iAllocations;	// Connections limit

	TLifetimeBytes iBytes;				// Transmitted bytes limit

	//

	// For Current, these will record the creation and first use times.

	// For Hard and Soft, these will record the expiration times (e.g.

	// simple comparison with the current time can be used to test for

	// expiration, and for returning CURRENT values to application, use

	// the SecondsFrom method with current.

	//

	TTime iAddtime;						// Lifetime limit from creation

	TTime iUsetime;						// Lifetime limit from first use

	};

class TSecurityAssocSpec

	/**

	* Security Association template.

	*

	* The TSecurityAssocSpec is a template for a Security Association.

	* This information and the information extracted from the packet is used

	* to locate a matching Security Association.

	*/

	{

public:

	TUint8 iType;				//< Security Association type (AH or ESP)

	TUint8 iAalg;				//< Authentication algorithm number

	TUint8 iEalg;				//< Encryption algorithm number

	TUint8 iReplayWindowLength;	//< Use Replay Window

	TUint iPfs:1;				//< "Perfect Forward Secresy" (PFS)

	/**

	* The SA is local address specicic.

	*

	* When set, the SA's is bound to a specific local

	* address. If not set, the SA can be used with any of

	* the currently valid own addresses.

	*

	* Note: The member name "iMatchSrc" is misleading.

	*/

	TUint iMatchSrc:1;

	// MatchProxy retained for backward compatibility

	TUint iMatchProxy:1;		//< (PFP) (deprecated) incoming == iMatchRemote, outgoing == iMatchLocal

	// The PFP (Populate From Packet) flags

	TUint iMatchLocal:1;		//< (PFP) Specific to local address of the packet

	TUint iMatchRemote:1;		//< (PFP) Specific to remote address of the packet

	TUint iMatchProtocol:1;		//< (PFP) Specific to protocol of the packet

	TUint iMatchLocalPort:1;	//< (PFP) Specific to local port of the packet

	TUint iMatchRemotePort:1;	//< (PFP) Specific to remtoe port of the packet

	// Identity references

	CIdentity *iIdentityLocal;	//< The local Identity

	CIdentity *iIdentityRemote;	//< The remote Identity

	// Limits for key lengths (for ACQUIRE only)

	TUint16 iMinAuthBits, iMaxAuthBits;			//< Required length of the authentication key

	TUint16 iMinEncryptBits, iMaxEncryptBits;	//< Required length of the encryption key

	/**

	* Max time for the Key Managers to handle ACQUIRE request.

	*

	* iLarvalLifetime specifies the maximum time to wait, after

	* an ACQUIRE request originating from this template is sent

	* to the key manager(s). This time should be long enough to

	* allow key manager to complete the negotiation for an

	* association.

	*

	* If not specified (=0), the default is #KLifetime_LARVAL_DEFAULT

	*/

	TUint iLarvalLifetime;

	// Required lifetimes

	struct sadb_lifetime iHard;	//< Hard Lifetime requirement (copied into ACQUIRE)

	struct sadb_lifetime iSoft;	//< Soft Lifetime requirement (copied into ACQUIRE)

	};

class TAlgorithmMap

	/**

	* Map symbolic algorithm name with algorithm number.

	*

	* The symbolic name of the algorithm identifies the implementation. That is, the name

	* given here is matched against the names advertised by the installed cryptograpchic

	* libaries. Each installed cryptographic library provides a list of supported algorithm

	* as names. This name is local concept.

	*

	* The algorithm number is the externally visible identification, which

	* is used by the key management negotiations (in IKE etc), and appears in PFKEY messages.

	*/

	{

public:

	TAlgorithmMap(TAlgorithmClass aClass, TInt anId, TInt aBits, const TDesC &aLibrary, const TDesC &aAlgorithm);

	TAlgorithmClass iClass;		//< Algorithm Class (digest, cipher, ...)

	TInt iId;					//< IPsec algorithm id number

	TInt iBits;					//< Actual # of bits to be used (digest only)

	/**

	* Name of the library instance.

	* If iLibrary is empty,

	* then the first matching algorithm from any of the

	* installed libraries is used.

	*/

	TProtocolName iLibrary;

	/**

	* Name of the algorithm.

	* If iAlgorithm is empty, then

	* this map entry describes a NULL algorithm. No libraries

	* are searched.

	*/

	TAlgorithmName iAlgorithm;

	};

class CAlgorithmList : public CArrayFixFlat<TAlgorithmMap>

	/**

	* List of potentially available algorithtms.

	*

	* CAlgorithmList is an array of TAlgorithmMap entries and provides methods

	* for finding a specific map and adding new mapping. The use of this information

	* is documented in more detail in connection of the Cryptographic library.

	*

	* The algorithm list defines all potentially available algorithms. The actual

	* set of available algorithms depends on currently installed crypto libraries.

	*/

	{

public:

	CAlgorithmList();

	void AddL(TAlgorithmClass aClass, TInt anId, TInt aBits, const TDesC &aLibrary, const TDesC &anAlg);

	TAlgorithmMap *Lookup(TAlgorithmClass aClass, TInt anAlg) const;

	TAlgorithmMap *Lookup(const TDesC &aLibrary, const TDesC &anAlg) const;

	};

class CSecurityAssoc;

class REndPoints;

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

class CPropList;

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

class MAssociationManager

	/**

	* The Security Association Database (SDB) interface as seen by Security Policy.

	*/

	{

public:

	virtual void Open() = 0;

	virtual void Close() = 0;

	/**

	* Acquire a new Security Association.

	*

	* SECPOL calls this when it needs a Security Association for a flow.

	*

	* If a matching Security Association already exists, it is returned.

	* Otherwise this generates a PFKEY ACQUIRE message for each registered

	* key management application and the function returns without SA.

	*

	* When not found, this creates a "larval egg SA" that will match any

	* future request with same parameters. This prevents generating multiple

	* ACQUIRE messages for the same security association.

	*

	* @retval aSa	located SA

	* @param aSpec	SA requirements

	* @param aPropList The list of (possibly multiple) proposals pertaining to the aSa

	* @param aTS	The traffic selector.

	* @param aSrc	the source address (of SA)

	* @param aDst	the destination address (of SA)

	* @param aInfo	the selector information

	* @param aTunnel True, when association is used in tunnel mode.

	* @returns

	* @li	KErrNone        SA found and returned.

	* @li	KRequestPending SA found (or created), but in LARVAL state

	* @li	KErrDied        the new larval SA expired (some weird problem)

	* @li	KErrNotFound    creating SA failed (parameters error? memory?)

	*/

	virtual TInt Acquire(

		CSecurityAssoc * &aSa,

		const TSecurityAssocSpec &aSpec,

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

		const CPropList *aPropList,

#endif //SYMBIAN_IPSEC_VOIP_SUPPORT

		const CTransportSelector *aTS,

		const RIpAddress &aSrc,

		const RIpAddress &aDst,

		const RPolicySelectorInfo &aInfo,

		TBool aTunnel) = 0;

	/**

	* Verify Security Association.

	*

	* SECPOL calls this to verify that the applied SA matches the

	* policy specification.

	*

	* @param aSa	the SA to be verified

	* @param aSpec	the required SA features

	* @param aSrc	the source address from the packet

	* @param aDst	the destination address of the packet

	* @param aInfo	the selector information

	*

	* @returns

	*	@li	KErrNone, when all is OK

	*	@li	error < 0, when something doesn't match

	*/

	virtual TInt Verify(

		const CSecurityAssoc *aSa,

		const TSecurityAssocSpec &aSpec,

#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

		const CPropList *aPropList,

#endif // SYMBIAN_IPSEC_VOIP_SUPPORT