// Copyright (c) 2006-2009 Nokia Corporation and/or its subsidiary(-ies).

// All rights reserved.

// This component and the accompanying materials are made available

// under the terms of "Eclipse Public License v1.0"

// which accompanies this distribution, and is available

// at the URL "http://www.eclipse.org/legal/epl-v10.html".

//

// Initial Contributors:

// Nokia Corporation - initial contribution.

//

// Contributors:

//

// Description:

// sc_prt.cpp - IPv6/IPv4 security check protocol

// An instance of a procotol that hooks into IP protocol instance,

// performing IPSEC checking and processing to packets.

//

#include <posthook.h>

#include <icmp6_hdr.h>

#include <udp_hdr.h>

#include <in_pkt.h>

#include <ext_hdr.h>

#include <in6_opt.h>

#include <in6_event.h>

#include <es_prot_internal.h>

#include "ipsec.h"

#include "sc.h"

#include "epdb.h"

#include "spdb.h"

#include "sadb.h"

#include <networking/ipsecerr.h>

#include "ipseclog.h"

#include "tunlintunl.h"

const TIp6Addr KOuterIsInner = {{{0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff}}};

class CProtocolIpsec;

class CIpsecHook;

/**

* Mobility Protocol id.

* (this should be in insock.h?)

*/

const TUint KProtocolInetMh = 135;

/**

* SCTP Protocol id

* (this should be in insock.h?)

*/

const TUint KProtocolInetSctp = 132;

/**

* Max number of nested IPSEC.

*/

const int KIpsecMaxNesting = 10;

/**

* Max number of fragment bookkeeping records.

*/

const TInt KIpsecMaxFragmentInfo = 10;

class RHookSA : public RSecurityAssociation

	/**

	* Security association handle.

	*

	* Extends the RSecurityAssociation handle to include a back link

	* to the CIpsecHook which actually contains the RHookSA

	* (for outbound processing)

	*/

	{

public:

	static void Callback(RSecurityAssociation &aAssociation);

	RHookSA(CFlowContext &aFlow, CPolicyAction *const aItem);

	/**

	* The last state of the association.

	*

	* iState is mainly used to detect whether initial

	* acquire failed, when SA dies. If PENDING at DEAD,

	* then SA died before ever becoming ready,

	*/

	TInt iState;

	CPolicyAction *const iItem;

private:

	CFlowContext &iFlow; // ..to change the flow state when SA state changes (see CallBack)

	};

class TUpperLayerSnoop

	/**

	* A snooping class.

	* A simple class to access the first 4 bytes of the packet.

	* This is used to snoop the upper layer information.

	*

	* Thus max "port offset" = 2 (because port is 16 bits),

	* and max "type/code offset = 3.

	*/

	{

public:

	// Basic

	inline static TInt MinHeaderLength() {return 4; }

	inline static TInt MaxHeaderLength() {return 4; }

	// Access values

	inline TUint16 Port(TUint8 aOff) const { return (i[aOff] << 8) + i[aOff+1]; }

	inline TUint8 Byte(TUint8 aOff) const { return i[aOff]; }

private:

	TUint8 i[4];

	};

class TSnoopHeader

	/**

	* Describes the positions of the port/type/code information in a protocol headers.

	*/

	{

public:

	TUint8 iProtocol;	//< 0..255

	TUint8 iSelector;	//< 0..3 (ports, localport, type+code, type)

	TUint8 iO1;			//< Offset of the source port [0..2] or type [0..3]),

	TUint8 iO2;			//< Offset of the destination port [0..2] or code [0..3])

	};

const TUint KLoadPorts = 0;	//< Load local and remote port

const TUint KLoadLocal = 1;	//< Load local port only

const TUint KLoadType = 2;	//< Load Type only (into local port as 'type << 8')

const TUint KLoadBoth = 3;	//< Load Type and code (into local port as 'type << 8 | code')

/**

* The list of currently known protocols.

*

* This table defines the "known protocols" for IPsec, and this must be updated

* if some new protocol uses ports or type/code system, and which needs to

* selected in IPsec selectors.

*/

static const TSnoopHeader snooper[] =

	{

		{ KProtocolInetUdp,		KLoadPorts,	0, 2 },	// UDP uses src and dst port

		{ KProtocolInetTcp,		KLoadPorts,	0, 2 },	// TCP uses src and dst port

		{ KProtocolInetIcmp,	KLoadBoth,	0, 1 },	// ICMPv4 uses type and code

		{ KProtocolInet6Icmp,	KLoadBoth,	0, 1 },	// ICMPv6 uses type and code

		{ KProtocolInetMh,		KLoadType,	2, 0 },	// Mobile IPv6 uses type

		{ KProtocolInetSctp,	KLoadPorts, 0, 2 }	// SCTP uses src and dst port

	};

static const TSnoopHeader *const snooper_end = &snooper[sizeof(snooper)/sizeof(snooper[0])];

class CIpsecHook : public CIpsecReferenceCountObject, public MFlowHook

	/**

	* The MFlowHook for outbound IPsec processing.

	*

	* An instance of this class is attached to the flows for which

	* IPsec processing is required.

	*

	* The allocation size of this object is variable and it depends

	* the required IPsec processing. The variable length information

	* is at the end of fixed member variables consists of two

	* arrays of structures as follows:

	* @code

	* RHookSA[iCount]		// The handles for IPsec associations

	* RIpAdddress[iTunnels]	// The src addresses of the tunnels (if iTunnels > 0)

	* @endcode

	*/

	{

private:

	CIpsecHook(

		MAssociationManager &aMgr,

		CFlowContext &aFlow,

		const RPolicySelectorInfo &aInfo,

		const TInt aCount,

		const TInt aTunnels);

	~CIpsecHook();

	RHookSA &Assoc(TInt aIndex) const

		{ return ((RHookSA *)(((char *)this) + sizeof(*this)))[aIndex]; }

	RIpAddress &Tunnel(TInt aIndex) const

		{ return ((RIpAddress *)&Assoc(iCount))[aIndex]; }

public:

	// for CProtocolSecpol

	static CIpsecHook *NewL(

		MAssociationManager &aMgr,

		CFlowContext &aFlow,

		const RPolicySelectorInfo &aInfo,

		TInt aCount, CPolicyAction **aItems,

		TInt aTunnels, const RIpAddress *aSrc);

	// MFlowHook

	void Open();

	TInt ReadyL(TPacketHead &aHead);

	TInt ApplyL(RMBufSendPacket &aPacket, RMBufSendInfo &aInfo);

	void Close();

private:

	// The internal state information

	MAssociationManager &iMgr;		//< The association manager.

	CFlowContext &iFlow;			//< The associated flow

	RPolicySelectorInfo iInfo;		//< The selector information extracted at OpenL

	const TUint8 iCount;        	//< Number of IPSEC actions (usually SA) to apply

	const TUint8 iTunnels;      	//< ..and how many of them include tunnel action

	// Followed by arrays of

	// - RHookSA[iCount]

	// - RIpAdddress[iTunnels]

	};

RHookSA::RHookSA(CFlowContext &aFlow, CPolicyAction *const aItem) : iItem(aItem), iFlow(aFlow)

	/**

	* Constructor.

	*

	* @param aFlow The flow.

	* @param aItem The action

	*/

	{

	iState = EFlow_PENDING;

	RSecurityAssociation::Init(Callback);

	aItem->Open();

	}

void RHookSA::Callback(RSecurityAssociation &aAssociation)

	/**

	*  Association has changed state.

	*

	* @param aAssociation The handle.

	*/

	{

	const RHookSA &assoc = (RHookSA &)aAssociation;

	switch (assoc.Status())

		{

		case SADB_SASTATE_MATURE:

		case SADB_SASTATE_DYING:

			// Either of these states means that SA is usable,

			// The previous state makes no difference.

			// In case of READY, should probably check all other

			// required SA's, and not try to wakeup the flow

			// until ALL of them are available. -- msa

			if (assoc.iState != KErrNone && assoc.iItem && assoc.iItem->iOptional)

				assoc.iFlow.SetChanged();	// When optional SA becomes available, "recompute" flow!

			assoc.iFlow.SetStatus(EFlow_READY);

			break;

		case SADB_SASTATE_DEAD:

			//

			// The SA is dead. Now it depends on the previous state

			// whether a new SA negotiation should be started or if

			// the flow should be shut down.

			if (assoc.iState == EFlow_PENDING)

				{

				//

				// Flow was waiting for negotiation, which expired

				//

				/* here the error value passed by the kmd server

				 * will be passed to the tcp/ip stack. This error

				 * value was set in the RSecurityAssociation class.

				 * 

				 */

				TInt errorValue = assoc.ReadErr();

				if(errorValue==EIpsec_Ok)

				    {

                       			 errorValue = EIpsec_AcquireFailed;

				    }

				assoc.iFlow.SetStatus(errorValue);

				break;

				}

			// SA was not a LARVAL SA. This means that a real SA

			// has just expired or been deleted for some reason,

			// the flow just needs to acquire a new SA.

			// *FALL THROUGH*

		default:

			// SA not available, but may be acquired, set/keep

			// the flow in pending state (a ReadyL call later

			// will activate the acquire, if needed).

			assoc.iFlow.SetStatus(EFlow_PENDING);

			break;

		}

	}

class TIpsecFragmentData

	/**

	* The state information for single IPsec transfor.

	*/

	{

public:

	RSecurityAssociation iSA;		//< The IPsec SA that was used

	TIpAddress iTunnel;				//< The outer Tunnel End Point (src).

	};

class CIpsecFragmentInfo : public CBase

	/**

	* The IPsec fragment tracking.

	*

	* When IPsec has been applied to tunneled fragments, it must

	* be guaranteed that all fragments are correctly protected

	* as required by the policy. However, the realy policy

	* requirement is only known after the final fragment has

	* arrived and when the full packet is available.

	*

	* This structure keeps track of applied IPsec for a

	* packet being assembled.

	*

	* This is variable sized object, and the tail end

	* is an array of state info:

	* @code TIpsecFragmentData[iCount]

	* @endcode

	*/

	{

private:

	CIpsecFragmentInfo(TUint aCount) : iCount(aCount) {}

public:

	static CIpsecFragmentInfo *New(TUint aCount);

	inline TIpsecFragmentData & operator[](TInt aIndex) const;

	~CIpsecFragmentInfo();

	CIpsecFragmentInfo *iNext;		//< The link to next info block.

	// Id + src + dst identify the fragment.

	TUint32 iId;					//< The fragment ID

	TIpAddress iSrc;				//< The (inner) source address

	TIpAddress iDst;				//< The (inner) destination address

	// The applied IPsec

	const TUint iCount;				//< The number of TIpsecFragmentData that follow after this.

	// Followed by array of TIpsecFragmentData[iCount]

	};

class CProtocolSecpol : public CProtocolPosthook, public MSecurityPolicyManager, MEventListener

	/**

	* Security Policy component of the IPsec.

	*

	* This protocol handles the Security Policy Database and also acts as a

	* hook for the IP layer.

	*/

	{

public:

	// ESOCK Protocol Basics

	CProtocolSecpol();

	~CProtocolSecpol();

	void BindToL(CProtocolBase *protocol);

	void Identify(TServerProtocolDesc *) const;

	CServProviderBase* NewSAPL(TUint aSockType);

	// for CProtocolIpsec (inbound transforms)

	TInt TransformL(RMBufHookPacket &aPacket, RMBufRecvInfo &aInfo);

	// Hook methods (inbound direction)

	TInt ApplyL(RMBufHookPacket &aPacket, RMBufRecvInfo &aInfo);

	// Hook methods (outbound direction)

	MFlowHook *OpenL(TPacketHead &aHead, CFlowContext *aFlow);

	// MEventListener

	void Notify(TUint aEventClass, TUint aEventType, const void *aData);

private:

	TUint32 GetInterfaceIndex(const TDesC &aName);

	TBool UpdateInterfaceIndex(const TDesC &aName, TUint32 aIndex);

	void FixupInterfaceIndexes(CSecurityPolicy *aPolicy);

	// Security Policy Management section

	inline CSecurityPolicy *Policy() const { return iPolicy; }

	TInt SetPolicy(const TDesC &aPolicy, TUint &aOffset);

	void Deliver(RMBufPacketBase& aPacket);

	void NetworkAttachedL();

	void NetworkDetached();

	void InterfaceAttached(const TDesC &aName, CNifIfBase *aIf);

	TInt SelectSource(const RIpAddress &aDst, RIpAddress &aSrc) const;

	TInt CollectBundle(TPolicyFilterInfo &aFilter, RPolicySelectorInfo &aKey, const TInt aMaxItems,

		CPolicyAction **aItems, RIpAddress *aSrc, TInt &aTunnels) const;

	void UpdateTunnelInterface(RMBufRecvInfo &aInfo, const CSecurityAssoc *const aSa) /*const*/;

	void CheckPacketId(RMBufHookPacket &aPacket);

	TInt CheckFragmentPolicy();

	MAssociationManager *iAssociationManager;

	CProtocolIpsec *iProtocolIpsec;

	MEventService *iEventService;

	CSecurityPolicy* iPolicy;

	TDblQue<CProviderSecpol> iSAPlist;

	//

	// The working space for incoming packet processing

	//

	TInt8 iCountSA;			//< Number of slots used from the arrays below

	TUint iIsFragment:1;	//< Current packet is a fragment.

	TUint iIsTunnelMode:1;	//< The last transform was in tunnel mode.

	TUint32 iPacketId;		//< Id of the current packet.

	TUint32 iId;			//< The fragment id.

	TIpAddress iSrc;		//< The currently effective src address of incoming packet

	TIpAddress iDst;		//< The currently effective dst address of incoming packet

	RPolicySelectorInfo iPktInfo;		//< Incoming packet info

	RSecurityAssociation iSA[KIpsecMaxNesting];	//< Used Security associations.

	RIpAddress iTunnel[KIpsecMaxNesting];		//< Related tunnel addresses (outer source)

	RIpAddress iMyself[KIpsecMaxNesting];		//< Related destination adresses (outer).

	// List of incomplete fragmented packets.

	CIpsecFragmentInfo *iFrags;					//< Unfinished fragments.

	};

void IPSEC::IdentifySecpol(TServerProtocolDesc &aEntry)

	/**

	* Return IPsec protocol description.

	*

	* @retval aEntry The protocol description.

	*/

	{

	_LIT(KSecpol, "secpol6");

	aEntry.iName = KSecpol;;

	aEntry.iAddrFamily = KAfIpsec;

	aEntry.iSockType = KSockRaw;

	aEntry.iProtocol = KProtocolSecpol;

	aEntry.iVersion = TVersion(1, 0, 0);

	aEntry.iByteOrder = ELittleEndian;

	aEntry.iServiceInfo = KSIConnectionLess | KSIMessageBased | KSIBroadcast;

	aEntry.iNamingServices = 0;

	aEntry.iSecurity = KSocketNoSecurity;

	aEntry.iMessageSize = 0xffff;

	aEntry.iServiceTypeInfo= ESocketSupport | ENeedMBufs;

	aEntry.iNumSockets = KUnlimitedSockets;

	}

CProtocolBase *IPSEC::NewSecpolL()

	/**

	* Create a new SECPOL protocol instance.

	*

	* @return The Secpol

	*/

	{

	return new (ELeave) CProtocolSecpol();

	}

//

static void NoCallback(RSecurityAssociation &)

	/** Dummy do nothing callback */

	{

	}

// CIpsecFragmentInfo

//

inline TIpsecFragmentData & CIpsecFragmentInfo::operator[](TInt aIndex) const

	/*

	* Return Nth fragment info.

	* @param aIndex The N value.

	*/

	{

	ASSERT((TUint)aIndex < iCount);

	return ((TIpsecFragmentData *)((char *)this + sizeof(*this)))[aIndex];

	}

CIpsecFragmentInfo *CIpsecFragmentInfo::New(TUint aCount)

	/**

	* Create a new fragment info.

	*

	* @param aCount The number of TIpsecFragmentData

	* @return Fragment info block.

	*/

	{

	CIpsecFragmentInfo *f = new (aCount * sizeof(TIpsecFragmentData)) CIpsecFragmentInfo(aCount);

	if (f)

		{

		for (TInt i = 0; i < f->iCount; ++i)

			(*f)[i].iSA.Init(NoCallback);

		}

	return f;

	}

CIpsecFragmentInfo::~CIpsecFragmentInfo()

	/**

	* Desctructor.

	*/

	{

	// Detach the security associations, if any

	for (TInt i = 0; i < iCount; ++i)

		{

		(*this)[i].iSA.None();

		}

	}

class CProtocolIpsec : public CIp6Hook

	/**

	* Internal protocol for ESP, AH, etc.

	*

	* Internal instance which gets to handle the

	* specific protocols AH, ESP and UPD for inbound

	* packets.

	*/

	{

public:

	CProtocolIpsec(CProtocolSecpol &aSecpol) : iSecpol(aSecpol)

		{};

	~CProtocolIpsec();

	void Identify(TServerProtocolDesc *aEntry) const

		{ IPSEC::IdentifySecpol(*aEntry); }

	TInt ApplyL(RMBufHookPacket &aPacket, RMBufRecvInfo &aInfo)

		{ return iSecpol.TransformL(aPacket, aInfo); }

	/**

	* The "master" parent.

	*

	* This "protocol" has no modifiable members, it borrows

	* everything from the parent CProtocolSecpol.

	*/

	CProtocolSecpol &iSecpol;

	};

CProtocolIpsec::~CProtocolIpsec()

	/**

	* Destructor.

	*

	* Cancel all binds with the network using CProtocolInet6Binder::Unbind(),

	* if the network is still attached

	*/

	{

	if (iSecpol.NetworkService())

		iSecpol.NetworkService()->Protocol()->Unbind(this, 0);

	}

//

#ifdef _LOG