1 // Copyright (c) 2005-2009 Nokia Corporation and/or its subsidiary(-ies).

     2 // All rights reserved.

     3 // This component and the accompanying materials are made available

     4 // under the terms of "Eclipse Public License v1.0"

     5 // which accompanies this distribution, and is available

     6 // at the URL "http://www.eclipse.org/legal/epl-v10.html".

     7 //

     8 // Initial Contributors:

     9 // Nokia Corporation - initial contribution.

    10 //

    11 // Contributors:

    12 //

    13 // Description:

    14 // IPSecPolManUtil.cpp - IPSec Policy Manager Utilities

    15 //

    16 

    17 #include <in_sock.h>

    18 

    19 #include "ipsecpolmanhandler.h"

    20 #include "ipsecpolparser.h"

    21 #include "ipsecpolapi.h"

    22 

    23 //

    24 // Build and write the strings to a policy file that tell that the clean

    25 // tunnel mode IKE negotiation packets are accepted. For each gateway

    26 // two strings are written: port 500 and port 4500.

    27 // The format of strings are shown below. 10.10.10.10%2 is in this example

    28 // an IPv4 gateway address, 255.255.255.255 is IPv4 full mask.

    29 //

    30 // remote 10.10.10.10%2 255.255.255.255 protocol 17 local_port  500

    31 // remote 10.10.10.10%2 255.255.255.255 protocol 17 local_port 4500

    32 //

    33 //

    34 TInt 

    35 CIPSecPolicyManagerHandler::WriteTunnelModeIkeNegotiationStringsL(

    36     HBufC8*& aPolBfr)

    37     {

    38     TBuf8<1024> stringBuf;

    39     TInt err(KErrNone);

    40 

    41     // Create pointer array for gateway list

    42     RPointerArray<TInetAddr> gatewayList;

    43     CleanupClosePushL(gatewayList);

    44 

    45     // Set base for the selector list

    46     CSecurityPolicy* sp = iPieceData->Policies();

    47     CSelectorList* selectorList = sp->SelectorList();

    48     TInt selectorCount = selectorList->Count();

    49 

    50     // Loop through the selector list

    51     for (TInt i = 0; (i < selectorCount) && (err == KErrNone) ; i++)

    52         {

    53         CPolicySelector* policySelector = selectorList->At(i);

    54         TSecpolBundleIter iterl(policySelector->iBundle);

    55         CSecpolBundleItem* itemL = NULL;

    56         CSecpolBundleItem* itemWork;

    57        

    58         // Find the last item in bundle

    59         while ((itemWork = iterl++) != NULL)

    60             {

    61             if (!itemWork->iTunnel.IsUnspecified())

    62                 itemL = itemWork;

    63             }

    64         // Add the address of the last gateway in the bundle

    65         // to the gateway list

    66         if (itemL)

    67             {

    68             // Search a matching element from the gateway list

    69             TInt count = gatewayList.Count();

    70             TInt j;

    71             for (j = 0; j < count && !itemL->iTunnel.Match(*gatewayList[j]); j++){}

    72             // Add a new element to the gateway list

    73             if (j==count)

    74                 {

    75                 TInt position = 0;

    76                 gatewayList.Insert( &itemL->iTunnel, position);

    77 

    78                 // Build two strings for policy file

    79                 stringBuf.Zero();

    80                 BuildTunnelModeIkeString(stringBuf,

    81                                          EInbound,

    82                                          500,

    83                                          itemL->iTunnel);

    84                 BuildTunnelModeIkeString(stringBuf,

    85                                          EInbound,

    86                                          4500,

    87                                          itemL->iTunnel);

    88 

    89                 // Write the string to file

    90                 err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

    91                 }

    92             }

    93         }

    94 

    95     CleanupStack::PopAndDestroy();

    96     return err;

    97     }

    98 //

    99 // Build a string that tells that the clean tunnel mode IKE

   100 // negotiation packets are accepted:

   101 // remote 10.10.10.10%2 255.255.255.255 protocol 17 local_port 500

   102 //

   103 //

   104 void 

   105 CIPSecPolicyManagerHandler::BuildTunnelModeIkeString(

   106     TDes8& aStringBuf,

   107     TInt aDirection,

   108     TInt aPort,

   109     TInetAddr& aGwAddr)

   110     {

   111     TBuf<60> addr;

   112 

   113     // Gateway IP address

   114     aStringBuf.Append(_L8(" remote "));

   115     aGwAddr.OutputWithScope(addr);

   116     aStringBuf.Append(addr);

   117 

   118     // Full mask, either IPv4 or IPv6

   119     if (aGwAddr.Family() == KAfInet || aGwAddr.IsV4Mapped())

   120         {

   121         if (!aGwAddr.Scope())

   122             {

   123             aStringBuf.Append(_L8(" 255.255.255.255 "));

   124             }

   125         else

   126             {

   127             aStringBuf.Append(_L8(" 255.255.255.255%-1 "));

   128             }

   129         }

   130     else

   131         {

   132         aStringBuf.Append(_L8(" FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF "));

   133         }

   134 

   135     // Protocol UDP

   136     aStringBuf.Append(_L8(" protocol 17 "));

   137 

   138     // Local or remote port

   139     if (aDirection == EInbound)

   140         {

   141         aStringBuf.Append(_L8(" local_port "));

   142         }

   143     else

   144         {

   145         aStringBuf.Append(_L8(" remote_port "));

   146         }

   147 

   148     // Port number

   149     aStringBuf.AppendFormat(_L8(" %d = { }\n"), aPort);

   150     }

   151 

   152 //

   153 // Build and write the strings to a policy file that tell that the clean

   154 // transport mode IKE negotiation packets are accepted. For each

   155 // transport mode selector two strings are written: port 500 and port 4500.

   156 // The format of strings are shown below. 10.10.10.10%2 is in this example

   157 // an IPv4 transport mode net, 255.255.255.0 is an IPv4 net mask.

   158 //

   159 // remote 10.10.10.10%2 255.255.255.0%-1 protocol UDP local_port  500

   160 // remote 10.10.10.10%2 255.255.255.0%-1 protocol UDP local_port 4500

   161 //

   162 //

   163 TInt 

   164 CIPSecPolicyManagerHandler::WriteTransportModeIkeNegotiationStrings(

   165     HBufC8*& aPolBfr)

   166     {

   167     TInt err = KErrNone;

   168 

   169     //  Set base for the selector list

   170     CSecurityPolicy* sp = iPieceData->Policies();

   171     CSelectorList* selectorList = sp->SelectorList();

   172     TInt selectorCount = selectorList->Count();

   173 

   174     // Loop through the selector list

   175     for (TInt i = 0; i < selectorCount; i++)

   176         {

   177         CPolicySelector* policySelector = selectorList->At(i);

   178         if (policySelector->iBundle.IsEmpty())

   179             {

   180             continue;

   181             }

   182         TSecpolBundleIter iterl(policySelector->iBundle);

   183         CSecpolBundleItem* itemFirst = iterl;

   184 

   185         // Calculate the bundle count

   186         TInt bundleCount = 0;

   187         while ((iterl++) != NULL)

   188             {

   189             bundleCount++;

   190             }

   191 

   192         // Check that no gateway is specified, it means transport mode

   193         if (bundleCount == 1

   194             && itemFirst != NULL

   195             && itemFirst->iTunnel.IsUnspecified())

   196             {

   197             // Build two strings for policy file

   198             TBuf8<1024> stringBuf;

   199             stringBuf.Zero();

   200             BuildTransportModeIkeString(stringBuf,

   201                                         500,

   202                                         policySelector->iRemote,

   203                                         policySelector->iRemoteMask);

   204             BuildTransportModeIkeString(stringBuf,

   205                                         4500,

   206                                         policySelector->iRemote,

   207                                         policySelector->iRemoteMask);

   208             // Write the string to file

   209             err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

   210             }

   211         if (err != KErrNone)

   212             {

   213             break;

   214             }

   215         }

   216     return err;

   217     }

   218 

   219 //

   220 // Build a string that tells that the clean Transport mode IKE

   221 // negotiation packets are accepted:

   222 // remote 10.10.10.10%2 255.255.255.255%-1 protocol UDP local_port 500

   223 //

   224 //

   225 void 

   226 CIPSecPolicyManagerHandler::BuildTransportModeIkeString(

   227     TDes8& aStringBuf,

   228     TInt aPort,

   229     TInetAddr& aRemote,

   230     TInetAddr& aRemoteMask)

   231     {

   232     TBuf<60> addr;

   233 

   234     // Gateway IP address

   235     aStringBuf.Append(_L8(" remote "));

   236     aRemote.OutputWithScope(addr);

   237     aStringBuf.Append(addr);

   238     aStringBuf.Append(_L8(" "));

   239 

   240     // Mask

   241     aRemoteMask.OutputWithScope(addr);

   242     aStringBuf.Append(addr);

   243     aStringBuf.Append(_L8(" "));

   244 

   245     // Protocol UDP, local_port #, bypass action 

   246     aStringBuf.AppendFormat(_L8("protocol 17 local_port %d = { }\n"), aPort);

   247     }

   248 

   249 //

   250 // Build a string that tells that the clean DHCP protocol

   251 // packets are accepted:

   252 // outbound protocol 17 remote_port 67

   253 // inbound  protocol 17 local_port 68

   254 //

   255 //

   256 TInt 

   257 CIPSecPolicyManagerHandler::BuildDhcpProtocolString( HBufC8*& aPolBfr)

   258     {

   259     TInt err = KErrNone;

   260     TBuf8<1024> stringBuf;

   261 

   262     // Outbound, protocol UDP, remote_port 67

   263     stringBuf.Append(_L8(" outbound protocol 17 remote_port 67 = { }\n"));

   264 

   265     // Inbound, protocol UDP, local_port 68

   266     stringBuf.Append(_L8(" inbound protocol 17 local_port 68 = { }\n"));

   267 

   268     // Write the string to file

   269     err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

   270     return err;

   271     }

   272 

   273 //

   274 // Build the strings that tell that clean MIPv4 protocol packets

   275 // are accepted:

   276 //

   277 // *** outbound solicitation messages ***

   278 // outbound remote 255.255.255.255 255.255 255.255 icmp_type 10

   279 // outbound remote 224.0.0.2       255.255.255.255 icmp_type 10

   280 //

   281 // *** outbound Registration Request message ***

   282 // outbound protocol 17 remote_port 434

   283 //

   284 // *** inbound Advertisement messages ***

   285 // inbound local 255.255.255.255 255.255.255.255 icmp_type 9

   286 // inbound local 224.0.0.1       255.255.255.255 icmp_type 9

   287 //

   288 // *** inbound Registration Reply message ***

   289 // inbound protocol 17 local_port 434

   290 //

   291 //

   292 TInt 

   293 CIPSecPolicyManagerHandler::BuildMip4BypassSelectors( HBufC8*& aPolBfr)

   294     {

   295     TInt err = KErrNone;

   296     TBuf8<1024> stringBuf;

   297 

   298     // Outbound Solicitation message

   299     stringBuf.Append(_L8(" outbound "));

   300     stringBuf.Append(_L8(" remote "));

   301     stringBuf.Append(_L8(" 255.255.255.255 "));  // IP address

   302     stringBuf.Append(_L8(" 255.255.255.255 "));  // Mask

   303     stringBuf.Append(_L8(" icmp_type 10 = { }\n"));

   304 

   305     // Outbound Solicitation message

   306     stringBuf.Append(_L8(" outbound "));

   307     stringBuf.Append(_L8(" remote "));

   308     stringBuf.Append(_L8(" 224.0.0.2 "));

   309     stringBuf.Append(_L8(" 255.255.255.255 "));

   310     stringBuf.Append(_L8(" icmp_type 10 = { }\n"));

   311 

   312     // Outbound Registration Request message

   313     stringBuf.Append(_L8(" outbound "));

   314     stringBuf.Append(_L8(" protocol 17 "));

   315     stringBuf.Append(_L8(" remote_port 434 = { }\n"));

   316 

   317     // Inbound Advertisement message

   318     stringBuf.Append(_L8(" inbound "));

   319     stringBuf.Append(_L8(" local "));

   320     stringBuf.Append(_L8(" 255.255.255.255 "));

   321     stringBuf.Append(_L8(" 255.255.255.255 "));

   322     stringBuf.Append(_L8(" icmp_type 9 = { }\n"));

   323 

   324     // Inbound Advertisement message

   325     stringBuf.Append(_L8(" inbound "));

   326     stringBuf.Append(_L8(" local "));

   327     stringBuf.Append(_L8(" 224.0.0.1 "));

   328     stringBuf.Append(_L8(" 255.255.255.255 "));

   329     stringBuf.Append(_L8(" icmp_type 9 = { }\n"));

   330 

   331     // Inbound Registration Reply message

   332     stringBuf.Append(_L8(" inbound "));

   333     stringBuf.Append(_L8(" protocol 17 "));

   334     stringBuf.Append(_L8(" local_port 434 = { }\n"));

   335 

   336     // Write the string to file

   337     err = TPolicyParser::BufferAppend(aPolBfr, stringBuf);

   338     return err;

   339     }

   340 

   341 //

   342 //  Modify the SA names (SA = Security association) by appending

   343 //  the SA name with suffix ZZ_n, where the n is the next policy

   344 //  handle and zz_ is a separator

   345 //

   346 void 

   347 CIPSecPolicyManagerHandler::MakeUniqueSANamesL()

   348     {

   349     CSecurityPolicy* policy = iPieceData->Policies();

   350     CArrayFixFlat<CPolicySpec *>* saList = policy->SAList();

   351 

   352     // Loop here until all SPDB SA names changed

   353     TInt i;

   354     TBuf8<100> buf;

   355     for (i = 0; i < saList->Count(); i++)

   356         {

   357         if (saList->At(i)->iSpectype == EPolSpecEP)

   358             {

   359             // TODO: Verify also that EndPoint names are unique

   360             continue;

   361             }

   362 

   363         // Copy an SA name to buf

   364         buf.Copy(saList->At(i)->iName->Des());

   365         buf.AppendFormat(_L8("zz_%d"), iCurrentPolicyHandle.iHandle + 1);

   366         // Delete the name bfr

   367         delete saList->At(i)->iName;

   368         saList->At(i)->iName = NULL;

   369         // Allocate a new bfr

   370         saList->At(i)->iName = HBufC8::NewL(buf.Length());

   371         // Set the new name buffer

   372         saList->At(i)->iName->Des().Copy(buf);

   373         }

   374     }

   375 

   376 //

   377 //  This function examines all selectors in the selector list and

   378 //  creates for each selector a comparison word that is needed

   379 //  to define the sequence of selectors in the file that is

   380 //  sent to the IPSec protocol component. The comparison word

   381 //  consists of the following parts:

   382 //  -- byte 1 = 0

   383 //  -- byte 2, bit 0 = 1 = port 500 or 4500 is defined in selector

   384 //  -- byte 2, bit 0 = 1 = port 67 and 68 is defined in selector

   385 //  -- byte 2, bit 0 = 1 = MIPv4 is defined by the selector

   386 //  -- byte 2, bit 1 = 0

   387 //  -- byte 4, bit 8 = 1 = all selectors have this bit on

   388 //

   389 //  The selector that has the greatest comparison word, is the first

   390 //  in the sequence.

   391 //

   392 TInt 

   393 CIPSecPolicyManagerHandler::BuildComparisonWord(CSelectorList* aSelList)

   394     {

   395     TInt count = aSelList->Count();

   396     TInt compWord(0);

   397 

   398     // Loop through the selector list

   399     for (TInt i = 0; i < count; i++)

   400         {

   401         CPolicySelector* policySelector = aSelList->At(i);

   402         compWord = 0;

   403 

   404         // Check if the local port 500 or 4500 is defined in selector, or

   405         // remote port 67 and local port 68 is defined, set a bit

   406         // in comparison word (IKE negotiation ports or DHCP ports)

   407         if ((policySelector->iLocal.Port() == 500

   408              || policySelector->iLocal.Port() == 4500)

   409             || (policySelector->iRemote.Port() == 67

   410                 && policySelector->iLocal.Port() == 68))

   411             {

   412             compWord |= 0x00400000;

   413             }

   414 

   415         // Check if MIP4 protocol selectors:

   416         // -- IcmpType is 9 or 10

   417         //    or

   418         // -- iType is 9 or 10

   419         //    or

   420         //    protocol is 17 (UDP) and local port or remote_port is 434

   421         // and set a bit in comparison word

   422         if ((policySelector->iIcmpType == 9 || policySelector->iIcmpType == 10)

   423             || (policySelector->iType == 9 || policySelector->iType == 10)

   424             || (policySelector->iProtocol == 17

   425                 && (policySelector->iRemote.Port() == 434

   426                     || policySelector->iLocal.Port() == 434)))

   427             {

   428             compWord |= 0x00400000;

   429             }

   430 

   431         // Each selector has at least this bit set on

   432         compWord |= 0x00000001;

   433 

   434         // Store comparison word to the selector

   435         policySelector->iCompWord = compWord;

   436         }

   437 

   438     return (KErrNone);

   439     }

   440 

   441 //

   442 //  This function examines all selectors in the selector list and

   443 //  sets a unique sequence number to each selector. The sequence

   444 //  numbers are used to define the sequence of selectors in a

   445 //  file that is sent to the IPSec protocol component.

   446 //  Each selector has a comparison word created previously.

   447 //

   448 //

   449 TInt 

   450 CIPSecPolicyManagerHandler::SetSequenceNumbers(CSelectorList* aSelList)

   451     {

   452     TInt count = aSelList->Count();

   453     TBool complete = EFalse;

   454     TInt currentSequenceNumber = 1;

   455     TUint32 currentHighValue;

   456     TInt j = 0;

   457 

   458     // Loop until each selector has a sequence number (exception:

   459     // ffffffff means deleted

   460     while (!complete)

   461         {

   462         currentHighValue = 0;

   463 

   464         // Loop through the selector list and search the selector that has

   465         // the highest value in comparison field

   466         for (TInt i = 0; i < count; i++)

   467             {

   468             CPolicySelector *policySelector = aSelList->At(i);

   469 

   470             if (policySelector->iSequenceNumber == -1)

   471                 {

   472                 continue;

   473                 }

   474 

   475             if (policySelector->iSequenceNumber == 0 &&

   476                 policySelector->iCompWord > currentHighValue )

   477                 {

   478                 j = i;

   479                 currentHighValue = policySelector->iCompWord;

   480                 }

   481             }

   482 

   483         // A round is complete

   484         if (currentHighValue == 0)

   485             {

   486             complete = ETrue;  // Each selector has a sequence number

   487             }

   488         else

   489             {

   490             CPolicySelector* tempSelector = aSelList->At(j);

   491             tempSelector->iSequenceNumber = currentSequenceNumber;

   492             currentSequenceNumber++;

   493             }

   494         }

   495     return 0;

   496     }

   497 

   498 //

   499 //  Compute either IPv4 or IPv6 mask length from a mask in TInetAddr

   500 //

   501 //

   502 //

   503 TInt 

   504 CIPSecPolicyManagerHandler::CalculateMaskLength(TInetAddr& aMask)

   505     {

   506     TInt maskLength(0);

   507     if (aMask.Family() == KAfInet)

   508         {

   509         // 96 = corresponds now IPv6 size

   510         maskLength = 96 + MaskLength(aMask.Address());

   511         }

   512     else if (aMask.Family() == KAfInet6)

   513         {

   514         maskLength = MaskLength(aMask.Ip6Address());

   515         }

   516     return (maskLength);

   517     }

   518 

   519 //

   520 // MaskLength

   521 // **********

   522 // Borrowed from Tcpip6\src\iface.cpp

   523 // Local utility, compute consecutive leftmost 1-bits from 32 bit integer

   524 //

   525 //

   526 TInt 

   527 CIPSecPolicyManagerHandler::MaskLength(TUint32 aAddr)

   528     {

   529     TInt count = 0;

   530     while (aAddr & 0x80000000)

   531         {

   532         count++;

   533         aAddr <<= 1;

   534         }

   535     return count;

   536     }

   537 

   538 //

   539 // MaskLength

   540 // **********

   541 // Borrowed from Tcpip6\src\iface.cpp

   542 // Computes mask length from IPv6 address

   543 //

   544 //

   545 TInt 

   546 CIPSecPolicyManagerHandler::MaskLength(const TIp6Addr &aAddr)

   547     {

   548     TInt count = 0;

   549     TInt len = (sizeof(aAddr.u.iAddr8) / sizeof(aAddr.u.iAddr8[0]));

   550     for (TUint i = 0; i < len; ++i)

   551         {

   552         if (aAddr.u.iAddr8[i] == 0xFF)

   553             {

   554             count += 8;

   555             }

   556         else

   557             {

   558             // Calls 32-bit routine

   559             count += MaskLength(aAddr.u.iAddr8[i] << 24);

   560             break;

   561             }

   562         }

   563     return count;

   564     }

   565 

   566 //

   567 // This function deletes from the policy the Inbound/Outbound

   568 // selector pairs by marking the selectors.

   569 //

   570 //

   571 void 

   572 CIPSecPolicyManagerHandler::DeleteExtraInboundOutboundSelectors()

   573     {

   574     // Set the base for the selector list

   575     CSecurityPolicy* sp = iPieceData->Policies();

   576     CSelectorList* list = sp->SelectorList();

   577     TInt count = list->Count();

   578 

   579     // Search a 'bypass/drop_everything_else' selectors and mark them.

   580     // These selectors will be deleted later when the objects are

   581     // converted to string format

   582     for (TInt i = 0; i < count; i++)

   583         {

   584         CPolicySelector* ps = list->At(i);

   585 

   586         if (IsBypassEverythingElse(*ps) || IsDropEverythingElse(*ps))

   587             {

   588             ps->iSequenceNumber = 0xffffffff;

   589             }

   590         }

   591     }

   592 

   593 //

   594 // This function adds the following selectors to the end of the

   595 // string format policy file:

   596 //  inbound = { }

   597 //  outbound = { }

   598 //

   599 // This occurs only if the current policies are in bypass mode.

   600 // Bypass mode means that the packets that do not match with any other

   601 // selector, are transferred without IPSec encapsulation.

   602 //

   603 //

   604 TInt 

   605 CIPSecPolicyManagerHandler::AddInboundOutboundSelectorPair()

   606     {

   607     TBuf8<128> stringBuf;

   608     TInt err(KErrNone);

   609 

   610     // If drop mode, return immediately

   611     if (iBypassOrDropMode == KDropMode)

   612         {

   613         return err;

   614         }

   615 

   616     // Add strings to work buffer

   617     if (iBypassOrDropMode & KInboundBypass)

   618         {

   619         stringBuf.Append(_L8(" inbound = { }\n"));

   620         }

   621     if (iBypassOrDropMode & KOutboundBypass)

   622         {

   623         stringBuf.Append(_L8(" outbound = { }\n"));

   624         }

   625 

   626     // Write the string to file

   627     err = TPolicyParser::BufferAppend(iPolBfr, stringBuf);

   628     return err;

   629     }

   630 

   631 //

   632 //  Find selector that matches with parameters given by a Key

   633 //  Management application. This function is a part of

   634 //  GetIPSecSAInfo API.

   635 //

   636 //

   637 CPolicySelector*

   638 CIPSecPolicyManagerHandler::FindMatchingSelector()

   639     {

   640     TInetAddr localAddr;

   641     TInetAddr remoteAddr;

   642 

   643     // Set the base for the selector list

   644     CSecurityPolicy* sp = iPieceData->Policies();

   645     CSelectorList* selectorList = sp->SelectorList();

   646     TInt selectorCount = selectorList->Count();

   647 

   648     // Build local subnetwork address if the mask defined

   649     if (!iSelectorInfo->iLocalMask.IsUnspecified())

   650         {

   651         if ((iSelectorInfo->iLocal.IsV4Mapped()) &&

   652             (!iSelectorInfo->iLocalMask.IsV4Mapped()))

   653             {

   654             iSelectorInfo->iLocalMask.ConvertToV4Mapped();

   655             }

   656         localAddr.SubNet(iSelectorInfo->iLocal, iSelectorInfo->iLocalMask);

   657         }

   658     else

   659         {

   660         // No mask, use host address

   661         localAddr = iSelectorInfo->iLocal;   

   662         }

   663         

   664     // Set scope too    

   665     localAddr.SetScope(iSelectorInfo->iLocal.Scope());  

   666 

   667     // Build remote subnetwork address if the mask defined

   668     if (!iSelectorInfo->iRemoteMask.IsUnspecified())

   669         {

   670         if ((iSelectorInfo->iRemote.IsV4Mapped()) &&

   671             (!iSelectorInfo->iRemoteMask.IsV4Mapped()))

   672             {

   673             iSelectorInfo->iRemoteMask.ConvertToV4Mapped();

   674             }

   675         remoteAddr.SubNet(iSelectorInfo->iRemote, iSelectorInfo->iRemoteMask);

   676         }

   677     else

   678         {

   679         // No mask, use host address

   680         remoteAddr = iSelectorInfo->iRemote;

   681         }

   682 

   683     // Set scope too

   684     remoteAddr.SetScope(iSelectorInfo->iRemote.Scope());

   685 

   686     // Find the matching selector

   687     for (TInt i = 0; i < selectorCount; i++)

   688         {

   689         CPolicySelector* policySelector = selectorList->At(i);

   690         TInetAddr polLocalMask = policySelector->iLocalMask;

   691         TInetAddr polRemoteMask = policySelector->iRemoteMask;

   692 

   693         // Skip 'bypass/drop_everything_else' or interface selectors

   694         if (IsBypassEverythingElse(*policySelector)

   695             || IsDropEverythingElse(*policySelector)

   696             || policySelector->iDirection == KPolicySelector_INTERFACE)

   697             {

   698             continue;

   699             }

   700 

   701         // Convert local mask of policy to V4Mapped

   702         if (policySelector->iLocal.IsV4Mapped() && !polLocalMask.IsV4Mapped())

   703             {

   704             polLocalMask.ConvertToV4Mapped();

   705             }

   706 

   707         // Convert remote mask of policy to V4Mapped

   708         if (policySelector->iRemote.IsV4Mapped() && !polRemoteMask.IsV4Mapped())

   709             {

   710             polRemoteMask.ConvertToV4Mapped();

   711             }

   712 

   713         // Check that protocol match if it is set

   714         if ((policySelector->iProtocol) && (iSelectorInfo->iProtocol))

   715             {

   716             if (policySelector->iProtocol != iSelectorInfo->iProtocol)

   717                 {

   718                 continue;

   719                 }

   720             }

   721             

   722         // Check that scope match if selector is 'scoped' ie. not global 

   723         if (!policySelector->iGlobalSelector)

   724             {

   725             if ((policySelector->iLocal.Scope() != localAddr.Scope())

   726                 || (policySelector->iRemote.Scope() != remoteAddr.Scope()))

   727                 {

   728                 continue;

   729                 }

   730             }

   731 

   732         // Check that local address/port match if address/port is set

   733         if (!policySelector->iLocal.IsUnspecified())

   734             {

   735             if (!policySelector->iLocal.Match(localAddr, polLocalMask)

   736                 || !policySelector->iLocal.CmpPort(iSelectorInfo->iLocal))

   737                 {

   738                 continue;

   739                 }

   740             }

   741 

   742         // Check that remote address/port match if address/port is set

   743         if (!policySelector->iRemote.IsUnspecified())

   744             {

   745             if (!policySelector->iRemote.Match(remoteAddr, polRemoteMask)

   746                 || !policySelector->iRemote.CmpPort(iSelectorInfo->iRemote))

   747                 {

   748                 continue;

   749                 }

   750             }

   751 

   752         // Matching selector found so return it            

   753         return (policySelector);

   754         }

   755 

   756     return (NULL);

   757     }

   758 

   759 //

   760 // CIPSecPolicyManagerHandler::FillSAInfoObject()

   761 //

   762 // Store SA parameters from TSecurityAssocSpec object to TIPSecSAInfo object. 

   763 // The Info object will be delivered to the Key Management application. 

   764 // The function is a part of the GetIPSecSAInfo API.

   765 //

   766 //

   767 void 

   768 CIPSecPolicyManagerHandler::FillSAInfoObject(

   769     CPolicySelector* aPolicySelector,

   770     TInt aIndex)

   771     {

   772     // Clear SA Transfrom template strings

   773     iSAInfo->iName.FillZ(KMaxName);

   774     iSAInfo->iName.SetLength(0);

   775     iSAInfo->iRemoteIdentity.FillZ(TIpsecSaSpec::KIpsecMaxIdentityLength);

   776     iSAInfo->iRemoteIdentity.SetLength(0);

   777     iSAInfo->iLocalIdentity.FillZ(TIpsecSaSpec::KIpsecMaxIdentityLength);

   778     iSAInfo->iLocalIdentity.SetLength(0);

   779 

   780     // Reset 'more SA exists' to default (none)

   781     iSAInfo->iMoreSasExist = EFalse;

   782  

   783     // Iterate through the action bundles to find the SA Transform template

   784     // that corresponds with the given index

   785     TSecpolBundleIter iter(aPolicySelector->iBundle);

   786     TInt count(0);

   787     while (iter)

   788         {

   789         CSecpolBundleItem* item = iter++;

   790 

   791         if (aIndex != count)

   792             {

   793             count++;

   794             continue;

   795             }

   796 

   797         // Corresponding bundle item found so use it to fill 

   798         // SA transform template

   799         

   800         TBool isLast = (!iter ? ETrue : EFalse);

   801         TBool isTunnelMode = (!item->iTunnel.IsUnspecified() || item->iTunnelEpName);

   802 

   803         iSAInfo->iTransportMode = !isTunnelMode;

   804         iSAInfo->iMoreSasExist = !isLast;

   805 

   806         // Check that SA specification exists

   807         

   808         //

   809         // NOTE:

   810         //  There is a kludge for testing the plain tunnel ie. there exists 

   811         //  no SA specification at all. The selector definition in the policy 

   812         //  is like:

   813         //

   814         //      remote 192.168.1.11 255.255.255.0 = { tunnel(10.66.77.1) }

   815         //

   816         //  and no SA definition exist that is named as 'tunnel'

   817         //

   818         if (item->iSpec)

   819             {

   820             TSecurityAssocSpec& spec = item->iSpec->iSpec;

   821             

   822 #ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

   823        	    iSAInfo->iType = item->iSpec->iPropList->At(0)->iType;

   824             iSAInfo->iAalg = item->iSpec->iPropList->At(0)->iAalg;

   825             iSAInfo->iAalgLen = item->iSpec->iPropList->At(0)->iAalgLen;

   826             iSAInfo->iEalg = item->iSpec->iPropList->At(0)->iEalg;

   827             iSAInfo->iEalgLen = item->iSpec->iPropList->At(0)->iEalgLen;

   828             iSAInfo->iReplayWindowLength = spec.iReplayWindowLength;

   829             iSAInfo->iPfs = spec.iPfs;

   830 

   831 	

   832 			iSAInfo->iHard.iBytes = item->iSpec->iPropList->At(0)->iHard.sadb_lifetime_bytes;

   833             iSAInfo->iHard.iAddTime = item->iSpec->iPropList->At(0)->iHard.sadb_lifetime_addtime;

   834             iSAInfo->iHard.iUseTime = item->iSpec->iPropList->At(0)->iHard.sadb_lifetime_usetime;

   835 

   836             iSAInfo->iSoft.iAllocations = item->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_allocations;

   837             iSAInfo->iSoft.iBytes = item->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_bytes;

   838             iSAInfo->iSoft.iAddTime = item->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_addtime;

   839             iSAInfo->iSoft.iUseTime = item->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_usetime;

   840 #else

   841             iSAInfo->iType = spec.iType;

   842             iSAInfo->iAalg = spec.iAalg;

   843             iSAInfo->iAalgLen = spec.iAalgLen;

   844             iSAInfo->iEalg = spec.iEalg;

   845             iSAInfo->iEalgLen = spec.iEalgLen;

   846             iSAInfo->iReplayWindowLength = spec.iReplayWindowLength;

   847             iSAInfo->iPfs = spec.iPfs;

   848 

   849             iSAInfo->iHard.iAllocations = spec.iHard.sadb_lifetime_allocations;

   850             iSAInfo->iHard.iBytes = spec.iHard.sadb_lifetime_bytes;

   851             iSAInfo->iHard.iAddTime = spec.iHard.sadb_lifetime_addtime;

   852             iSAInfo->iHard.iUseTime = spec.iHard.sadb_lifetime_usetime;

   853 

   854             iSAInfo->iSoft.iAllocations = spec.iSoft.sadb_lifetime_allocations;

   855             iSAInfo->iSoft.iBytes = spec.iSoft.sadb_lifetime_bytes;

   856             iSAInfo->iSoft.iAddTime = spec.iSoft.sadb_lifetime_addtime;

   857             iSAInfo->iSoft.iUseTime = spec.iSoft.sadb_lifetime_usetime;

   858 

   859 #endif //SYMBIAN_IPSEC_VOIP_SUPPORT

   860 

   861 			iSAInfo->iSrcSpecific = spec.iMatchSrc;

   862 

   863             if (item->iSpec->iName)

   864                 {

   865                 TInt len(item->iSpec->iName->Length());

   866                 if (len < KMaxName)

   867                     {

   868                     iSAInfo->iName.Copy(*item->iSpec->iName);

   869                     }

   870                 }

   871 

   872             if (item->iSpec->iRemoteIdentity)

   873                 {

   874                 TInt len(item->iSpec->iRemoteIdentity->Length());

   875                 if (len < TIpsecSaSpec::KIpsecMaxIdentityLength)

   876                     {

   877                     iSAInfo->iRemoteIdentity.Copy(*item->iSpec->iRemoteIdentity);

   878                     }

   879                 }

   880 

   881             if (item->iSpec->iLocalIdentity)

   882                 {

   883                 TInt len(item->iSpec->iLocalIdentity->Length());

   884                 if (len < TIpsecSaSpec::KIpsecMaxIdentityLength)

   885                     {

   886                     iSAInfo->iLocalIdentity.Copy(*item->iSpec->iLocalIdentity);

   887                     }

   888                 }

   889             }

   890 

   891         break;

   892         }

   893     }

   894 

   895 //

   896 // Returns TRUE if selector is of type 'bypass_everything_else'

   897 // TODO:

   898 //  This method should be included within CPolicySelector class

   899 //

   900 //

   901 TBool

   902 CIPSecPolicyManagerHandler::IsBypassEverythingElse(

   903     const CPolicySelector& aPolicySelector) const

   904     {

   905     return (aPolicySelector.iDirection != KPolicySelector_INTERFACE 

   906             && aPolicySelector.iRemote.Family() == KAFUnspec

   907             && aPolicySelector.iLocal.Family() == KAFUnspec

   908             && aPolicySelector.iRemote.Port() == 0

   909             && aPolicySelector.iLocal.Port() == 0

   910             && aPolicySelector.iProtocol == 0

   911             && aPolicySelector.iIcmpType < 0

   912             && aPolicySelector.iIcmpCode < 0

   913             && aPolicySelector.iType < 0

   914             && aPolicySelector.iBundle.IsEmpty()

   915             && !aPolicySelector.iDropAction);

   916     }

   917 

   918 //

   919 // Returns TRUE if selector is of type 'drop_everything_else'

   920 // TODO:

   921 //  This method should be included within CPolicySelector class

   922 //

   923 //

   924 TBool

   925 CIPSecPolicyManagerHandler::IsDropEverythingElse(

   926     const CPolicySelector& aPolicySelector) const

   927     {

   928     return (aPolicySelector.iDirection != KPolicySelector_INTERFACE

   929             && aPolicySelector.iRemote.Family() == KAFUnspec

   930             && aPolicySelector.iLocal.Family() == KAFUnspec

   931             && aPolicySelector.iRemote.Port() == 0

   932             && aPolicySelector.iLocal.Port() == 0

   933             && aPolicySelector.iProtocol == 0

   934             && aPolicySelector.iIcmpType < 0

   935             && aPolicySelector.iIcmpCode < 0

   936             && aPolicySelector.iType < 0

   937             && aPolicySelector.iBundle.IsEmpty()

   938             && aPolicySelector.iDropAction);

   939     }

   940 

   941 //

   942 // Returns TRUE if given selectors are of 'interface' type and the

   943 // name of interfaces are equal.

   944 // TODO:

   945 //  This method should be included within CPolicySelector class

   946 //

   947 //

   948 TBool

   949 CIPSecPolicyManagerHandler::IsEqualInterface(

   950     const CPolicySelector& aP1, 

   951     const CPolicySelector& aP2) const

   952     {

   953     return ((aP1.iDirection == KPolicySelector_INTERFACE)

   954             && (aP2.iDirection == KPolicySelector_INTERFACE)

   955             && (aP1.iInterface == aP2.iInterface));

   956     }

   957 

   958 //

   959 // Returns TRUE if the remote address of given selectors are equal.

   960 // TODO:

   961 //  This method should be included within CPolicySelector class

   962 //

   963 //

   964 TBool

   965 CIPSecPolicyManagerHandler::IsEqualRemoteAddress(

   966     const CPolicySelector& aP1, 

   967     const CPolicySelector& aP2) const

   968     {

   969     // Check if both addresses are set

   970     if ((aP1.iRemote.Family() == KAFUnspec) 

   971         || (aP2.iRemote.Family() == KAFUnspec))

   972         {

   973         return (EFalse);

   974         }

   975 

   976     // Check that both selectors are either global or scoped

   977     if (aP1.iGlobalSelector != aP2.iGlobalSelector)

   978         {

   979         return (EFalse);

   980         }

   981     

   982     // Check for address any and equal scope

   983     if (aP1.iRemote.IsUnspecified() && aP2.iRemote.IsUnspecified())

   984         {

   985         if (aP1.iGlobalSelector && aP2.iGlobalSelector)

   986             {

   987             return (ETrue);

   988             }

   989         if (aP1.iRemote.Scope() == aP2.iRemote.Scope())

   990             {

   991             return (ETrue);

   992             }

   993         }

   994         

   995     // Check for specific address and equal scope

   996     if ((!aP1.iRemote.IsUnspecified() && !aP2.iRemote.IsUnspecified())

   997         && aP1.iRemote.Match(aP2.iRemote)

   998         && aP1.iRemoteMask.Match(aP2.iRemoteMask))

   999         {

  1000         if (aP1.iGlobalSelector && aP2.iGlobalSelector)

  1001             {

  1002             return (ETrue);

  1003             }

  1004         if (aP1.iRemote.Scope() == aP2.iRemote.Scope())

  1005             {

  1006             return (ETrue);

  1007             }

  1008         }

  1009         

  1010     return (EFalse);

  1011     }

  1012 

  1013 //

  1014 // Returns TRUE if local address of given selectors are equal.

  1015 // TODO:

  1016 //  This method should be included within CPolicySelector class

  1017 //

  1018 //

  1019 TBool

  1020 CIPSecPolicyManagerHandler::IsEqualLocalAddress(

  1021     const CPolicySelector& aP1, 

  1022     const CPolicySelector& aP2) const

  1023     {

  1024     // Check that address is set

  1025     if ((aP1.iLocal.Family() == KAFUnspec) 

  1026         || (aP2.iLocal.Family() == KAFUnspec))

  1027         {

  1028         return (EFalse);

  1029         }

  1030 

  1031     // Check that both selectors are either global or scoped

  1032     if (aP1.iGlobalSelector != aP2.iGlobalSelector)

  1033         {

  1034         return (EFalse);

  1035         }

  1036     

  1037     // Check for address any and equal scope

  1038     if (aP1.iLocal.IsUnspecified() && aP2.iLocal.IsUnspecified())

  1039         {

  1040         if (aP1.iGlobalSelector && aP2.iGlobalSelector)

  1041             {

  1042             return (ETrue);

  1043             }

  1044         if (aP1.iLocal.Scope() == aP2.iLocal.Scope())

  1045             {

  1046             return (ETrue);

  1047             }

  1048         }

  1049         

  1050     // Check for specific address and equal scope

  1051     if ((!aP1.iLocal.IsUnspecified() && !aP2.iLocal.IsUnspecified())

  1052         && aP1.iLocal.Match(aP2.iLocal)

  1053         && aP1.iLocalMask.Match(aP2.iLocalMask))

  1054         {

  1055         if (aP1.iGlobalSelector && aP2.iGlobalSelector)

  1056             {

  1057             return (ETrue);

  1058             }

  1059         if (aP1.iLocal.Scope() == aP2.iLocal.Scope())

  1060             {

  1061             return (ETrue);

  1062             }

  1063         }

  1064         

  1065     return (EFalse);

  1066     }

  1067 

  1068 //

  1069 // Returns TRUE if given SA Transform templates are equal

  1070 // TODO:

  1071 //  This method should be included within TSecurityAssocSpec class.

  1072 //

  1073 //

  1074 #ifdef SYMBIAN_IPSEC_VOIP_SUPPORT

  1075 TBool

  1076 CIPSecPolicyManagerHandler::IsEqualSaSpec(CSecpolBundleItem* aS1, 

  1077                                           CSecpolBundleItem* aS2) const

  1078     {

  1079     if ((!aS1 && aS2) || (!aS2 && aS1))

  1080         return (EFalse);

  1081             

  1082     if (aS1 && aS2)

  1083         {

  1084         if((aS1->iSpec) && (aS1->iSpec->iPropList) && (aS2->iSpec) && (aS2->iSpec->iPropList))

  1085             {

  1086             if (aS1->iSpec->iPropList->At(0)->iType != aS2->iSpec->iPropList->At(0)->iType)

  1087                 return (EFalse);

  1088             if (aS1->iSpec->iPropList->At(0)->iAalg != aS2->iSpec->iPropList->At(0)->iAalg)

  1089                 return (EFalse);

  1090             if (aS1->iSpec->iPropList->At(0)->iAalgLen != aS2->iSpec->iPropList->At(0)->iAalgLen)

  1091                 return (EFalse);

  1092             if (aS1->iSpec->iPropList->At(0)->iEalg != aS2->iSpec->iPropList->At(0)->iEalg)

  1093                 return (EFalse);

  1094             if (aS1->iSpec->iPropList->At(0)->iEalgLen != aS2->iSpec->iPropList->At(0)->iEalgLen)

  1095                 return (EFalse);

  1096             if (aS1->iSpec->iSpec.iPfs != aS2->iSpec->iSpec.iPfs)

  1097                 return (EFalse);

  1098             if (aS1->iSpec->iSpec.iReplayWindowLength != aS2->iSpec->iSpec.iReplayWindowLength)

  1099                 return (EFalse);

  1100             

  1101             if (aS1->iSpec->iPropList->At(0)->iHard.sadb_lifetime_allocations != aS2->iSpec->iPropList->At(0)->iHard.sadb_lifetime_allocations)

  1102                 return (EFalse);

  1103             if (aS1->iSpec->iPropList->At(0)->iHard.sadb_lifetime_bytes != aS2->iSpec->iPropList->At(0)->iHard.sadb_lifetime_bytes)

  1104                 return (EFalse);

  1105             if (aS1->iSpec->iPropList->At(0)->iHard.sadb_lifetime_addtime != aS2->iSpec->iPropList->At(0)->iHard.sadb_lifetime_addtime)

  1106                 return (EFalse);

  1107             if (aS1->iSpec->iPropList->At(0)->iHard.sadb_lifetime_usetime != aS2->iSpec->iPropList->At(0)->iHard.sadb_lifetime_usetime)

  1108                 return (EFalse);

  1109             

  1110             if (aS1->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_allocations != aS2->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_allocations)

  1111                 return (EFalse);

  1112             if (aS1->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_bytes != aS2->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_bytes)

  1113                 return (EFalse);

  1114             if (aS1->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_addtime != aS2->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_addtime)

  1115                 return (EFalse);

  1116             if (aS1->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_usetime != aS2->iSpec->iPropList->At(0)->iSoft.sadb_lifetime_usetime)

  1117                 return (EFalse);

  1118             }

  1119         }

  1120         

  1121     return (ETrue);

  1122     }

  1123 #else

  1124 TBool

  1125 CIPSecPolicyManagerHandler::IsEqualSaSpec(TSecurityAssocSpec* aS1, 

  1126                                           TSecurityAssocSpec* aS2) const

  1127     {

  1128     if ((!aS1 && aS2) || (!aS2 && aS1))

  1129         return (EFalse);

  1130             

  1131     if (aS1 && aS2)

  1132         {

  1133         if (aS1->iType != aS2->iType)

  1134             return (EFalse);