// Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).
// All rights reserved.
// This component and the accompanying materials are made available
// under the terms of "Eclipse Public License v1.0"
// which accompanies this distribution, and is available
// at the URL "http://www.eclipse.org/legal/epl-v10.html".
//
// Initial Contributors:
// Nokia Corporation - initial contribution.
//
// Contributors:
//
// Description:
// pfkey.h - IPv6/IPv4 IPSEC KEY protocol family
//



/**
 @internalComponent
*/
#ifndef __PFKEY_H__
#define __PFKEY_H__

#include <es_prot.h>
#include "ipsec.h"
#include "sadb.h"
#include "epdb.h"

#include "ah_eng.h"
#include "esp_eng.h"
#include "ipip_eng.h"
#include "natt_eng.h"

class CProviderKey;

//
//  CProtocolKey
//
class CProtocolKey : public CProtocolBase, public MAssociationManager
	/**
	* The PFKEY protocol implementation.
	*
	* PFKEY protocol manages the PFKEY sockets and maintains the Security
	* Association Database (SAD).
	*
	* PFKEY protocol provides MAssociationManger API, which defines the
	* services for the SECPOL protocol and SAD.
	*/
	{
public:
	CProtocolKey();
	CProtocolKey& operator=(const CProtocolKey&);
	virtual ~CProtocolKey();
	virtual CServProviderBase *NewSAPL(TUint aProtocol);
	virtual void InitL(TDesC& aTag);
	virtual void StartL();
	virtual void BindToL(CProtocolBase *protocol);
	virtual void BindL(CProtocolBase *aProtocol, TUint id);
	virtual void Identify(TServerProtocolDesc *) const;

	virtual TInt GetOption(TUint aLevel, TUint aName, TDes8& aOption, CProtocolBase* aSourceProtocol=NULL);
	virtual TInt SetOption(TUint aLevel, TUint aName,const TDesC8& aOption, CProtocolBase* aSourceProtocol=NULL);
		
	virtual void Open();
	virtual void Close();

	// Methods to be used from the SECPOL
	TInt Acquire(
		CSecurityAssoc * &aSA,
		const TSecurityAssocSpec &aSpec,
#ifdef SYMBIAN_IPSEC_VOIP_SUPPORT		
		const CPropList *aPropList, 
#endif //SYMBIAN_IPSEC_VOIP_SUPPORT
		const CTransportSelector *aTS,
		const RIpAddress &aSrc,
		const RIpAddress &aDst,
		const RPolicySelectorInfo &aInfo,
		TBool aTunnel);

#ifdef	SYMBIAN_IPSEC_VOIP_SUPPORT	
		TInt Verify(	const CSecurityAssoc *aSA,	const TSecurityAssocSpec &aSpec,
		const CPropList *aPropList,
		const RIpAddress &aSrc,	const RIpAddress &aDst,	const RPolicySelectorInfo &aInfo);
#else
		TInt Verify(
		const CSecurityAssoc *aSA,
		const TSecurityAssocSpec &aSpec,
		const RIpAddress &aSrc,
		const RIpAddress &aDst,
		const RPolicySelectorInfo &aInfo);
#endif // SYMBIAN_IPSEC_VOIP_SUPPORT
				
	TInt ApplyL(	// Outbound
		CSecurityAssoc *aSa,
		RMBufSendPacket &aPacket,
		RMBufSendInfo &info,
		const TIpAddress &aTunnel);
	TInt ApplyL(	// Inbound
		CSecurityAssoc * &aSa,
		RMBufRecvPacket &aPacket,
		RMBufRecvInfo &info,
		TInt aProtocol,
		TIpAddress &aTunnel);
	TInt Overhead(const CSecurityAssoc *const aSa, const TIpAddress &aTunnel) const;
	void SetAlgorithms(CAlgorithmList*& aList);

	// Methods to be used from the CSecurityAssoc
	inline void TimerOn(CSecurityAssoc &aSa, TInt aDelta);
	void Expired(const CSecurityAssoc &aSa, TInt aType, const TLifetime &aLifetime);

	// Generic
	void Delete(CSecurityAssoc *aSa);
	CSecurityAssoc *Lookup(TUint8 aType, TUint32 aSPI, const TIpAddress &aDst) const;
	REndPoints &EndPointCollection() { return iEndPointCollection; }

	// PFKEYv2 main entry (called by CProviderKey
	TInt Exec(const TDesC8 &aMsg, CProviderKey *aSrc = NULL);
private:
	virtual CSecurityAssoc *Lookup(TUint8 aType, TUint32 aSPI, const TIpAddress &aDst, TInt &aHash) const;

	static CSecurityAssoc *FindEgg(CSecurityAssoc *sa,  const TPfkeyMessage &aMsg, const struct sadb_msg &aBase);

	// These ExecNNN methods are only used in key_msg.cpp (not intended for general use)
	TInt ExecGetSPI(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecUpdate(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecAdd(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecDelete(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc, TBool deliverMsg=ETrue);
	TInt ExecGet(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecAcquire(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecRegister(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecFlush(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	TInt ExecDump(TPfkeyMessage &aMsg, struct sadb_msg &aBase, CProviderKey *aSrc);
	void DumpSA(TPfkeyMessage &aKey, struct sadb_msg &aBase, CProviderKey *aDst, CSecurityAssoc *sa);
	//
	void Deliver(const TPfkeyMessage &aMsg);
	void DeliverRegistered(const TPfkeyMessage &aMsg);

	inline TInt HashSize() const;
	inline TInt Hash(const TIp6Addr &addr, TUint8 type) const;

	/**
	* The Security Association DataBase (SAD).
	*
	* The Collection of Security Associations
	* hashed by *remote address*. The size of the
	* hash is automatically controlled by the size
	* of this array. Feel free to place any other
	* magic constant (prime!) here, the code will adjust)
	*/
	CSecurityAssoc *iHash[111];

	MTimeoutManager *iTimer;		//< Timing services.
	TUint32 iSequenceNumber;		//< Current sequence number for the kernel originated PF_KEY msgs
	TDblQue<CProviderKey> iSAPlist;	//< Housekeeping of attached sockets (= SAP's)
	TIpsecAH iEngineAH;				//< IPsec Authentication engine
	TIpsecESP iEngineESP;			//< IPsec Encryption engine
	TIpsecIPIP iEngineIPIP;			//< IPsec IP-in-IP tunneling engine
	TIpsecNATT iEngineNATT;			//< IPsec NAT Traversal engine  
	CIpsecCryptoManager *iCrypto;	//< IPsec Crypto Library Manager
	REndPoints iEndPointCollection;	//< The named end point collection.
	RArray<RIpAddress> iEndPoints;	//< The SetOpt EP definitions
	RMBufAllocator iRMBufAllocator;   //< RMBufAllocator used in encryption/decryption operation
	};
	


void CProtocolKey::TimerOn(CSecurityAssoc &aSa, TInt aDelta)
	/**
	* Activate a timeout call on SA.
	*
	* @param aSa The security association
	* @param aDelta The delay in seconds.
	*/
	{
	iTimer->Set(aSa.iTimeout, aDelta);
	}

TInt CProtocolKey::HashSize() const
	/**
	* Return number of entries in the hash array.
	*/
	{
	return sizeof(iHash) / sizeof(iHash[0]);
	}
	
TInt CProtocolKey::Hash(const TIp6Addr &addr, TUint8 type) const
	/**
	* Compute hash value from IPv6 address and assocation type.
	*
	* Hash computes the hash value from IPv6 address (128 bits) and
	* association type code, return a pointer to the list of Security
	* Associations, which include all associations with this remote host
	* (the list may include associations with other hosts that map to
	* the same hash value!)
	*
	* @param addr The IPv6 address
	* @param type The association type (AH or ESP)
	* @return Index into hash table (iHash).
	*/
	{
	const TUint32 tmp =
				addr.u.iAddr32[0] ^
				addr.u.iAddr32[1] ^
				addr.u.iAddr32[2] ^
				addr.u.iAddr32[3];
	return ((tmp >> 16) ^ tmp ^ type) % HashSize();
	}


//
// PF_KEY Socket Provider Base
//

/**
* Max value for Security Association type.
*
* The maximum allowed value (for this implementation) for Security
* association type (AH, ESP, etc.) value. The pfkey2.h value
* SADB_SATYPE_MAX is not used. This allows compiled code to work even
* if some future PFKEY adds more types. The limit is now taken from
* the size of the sadb_msg_satype field (= uint8_t). Only needed in
* building a bitmap for a REGISTERED listener.
*/
const TUint KProviderKey_SATYPE_MAX = 255;

class CProviderKey: public CProviderIpsecBase
	/**
	* The PFKEY socket provider (SAP).
	*/
	{
public:
	CProviderKey(CProtocolKey& aProtocol);
	void Start();
	TUint Write(const TDesC8 &aDesc,TUint options, TSockAddr* aAddr=NULL);

	TInt SetOption(TUint level,TUint name, const TDesC8 &anOption);
	TInt GetOption(TUint level,TUint name,TDes8 &anOption) const;
public:
	// For CProtocolKey only
	void Deliver(const TPfkeyMessage &aMsg);
	TUint8 iRegistered[(KProviderKey_SATYPE_MAX+7)/8];	//< Registered to listen protocols (now only AH and ESP).
protected:
	CProtocolKey& iProtocol;		//< PFKEY protocol object
	};

#endif