-

1 files changed, 0 insertions, 728 deletions

diff --git a/branches/1.0/tinyIPSec/src/tipsec_vista.c b/branches/1.0/tinyIPSec/src/tipsec_vista.c
deleted file mode 100644
index b2b2f5f..0000000
--- a/branches/1.0/tinyIPSec/src/tipsec_vista.c
+++ /dev/null
@@ -1,728 +0,0 @@
-/*

-* Copyright (C) 2009-2010 Mamadou Diop.

-*

-* Contact: Mamadou Diop <diopmamadou(at)doubango.org>

-*	

-* This file is part of Open Source Doubango Framework.

-*

-* DOUBANGO is free software: you can redistribute it and/or modify

-* it under the terms of the GNU General Public License as published by

-* the Free Software Foundation, either version 3 of the License, or

-* (at your option) any later version.

-*	

-* DOUBANGO is distributed in the hope that it will be useful,

-* but WITHOUT ANY WARRANTY; without even the implied warranty of

-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

-* GNU General Public License for more details.

-*	

-* You should have received a copy of the GNU General Public License

-* along with DOUBANGO.

-*

-*/

-

-/**@file tipsec_vista.c

- * @brief Windows Vista/7 IPsec implementation using WFP.

- *

- * @author Mamadou Diop <diopmamadou(at)doubango.org>

- *

- * @date Created: Sat Nov 8 16:54:58 2009 mdiop

- */

-#include "tipsec_vista.h"

-

-/**@defgroup tipsec_vista_group IPSec Vista/7 implementation (WFP).

-* Supported algo: <b>hmac-md5-96</b> and <b>hmac-sha-1-96</b>.<br>

-* Supported ealg: <b>des-ede3-cbc</b>, <b>aes-cbc</b> and <b>null</b>.<br>

-* Supported mode: <b>transport</b> only.<br>

-* Supported proto: <b>ah</b> and <b>esp</b>.<br>

-* Supported IP proto: <b>tcp</b> and <b>udp</b>.<br>

-* Supported IP version: <b>IPv4</b> and <b>IPv6</b>.

-*/

-

-#if HAVE_IPSEC_VISTA

-

-#include "tsk_memory.h"

-#include "tsk_debug.h"

-

-#if defined(_MSC_VER)

-#	pragma comment(lib, "Fwpuclnt.lib")

-#endif

-

-#include <ws2tcpip.h>

-#include <Fwpmu.h>

-

-typedef FWP_BYTE_BLOB* PFWP_BYTE_BLOB;

-

-/**@ingroup tipsec_vista_group

-* @def TINYIPSEC_FILTER_NAME

-*/

-#define TINYIPSEC_FILTER_NAME					TEXT("tinyIPSEC")

-#define TINYIPSEC_PROVIDER_KEY					NULL

-

-/**@ingroup tipsec_vista_group

-* @def TINYIPSEC_SA_NUM_ENTRIES_TO_REQUEST

-*/

-/**@ingroup tipsec_vista_group

-* @def TINYIPSEC_SA_MAX_LIFETIME

-*/

-#define TINYIPSEC_SA_NUM_ENTRIES_TO_REQUEST		20

-#define TINYIPSEC_SA_MAX_LIFETIME				172799

-

-#define TINYIPSEC_VISTA_GET_ALGO(algo) (algo ==  algo_hmac_md5_96) ? IPSEC_AUTH_TRANSFORM_ID_HMAC_MD5_96 : IPSEC_AUTH_TRANSFORM_ID_HMAC_SHA_1_96

-#define TINYIPSEC_VISTA_GET_EALGO(ealg)	 (ealg == ealg_des_ede3_cbc) ? IPSEC_CIPHER_TRANSFORM_ID_CBC_3DES : ( (ealg == ealg_aes) ? IPSEC_CIPHER_TRANSFORM_ID_AES_128 : IPSEC_CIPHER_TRANSFORM_ID_NULL_NULL )

-#define TINYIPSEC_VISTA_GET_MODE(mode)	 (mode == mode_tun) ? IPSEC_TRAFFIC_TYPE_TUNNEL : IPSEC_TRAFFIC_TYPE_TRANSPORT

-#define TINYIPSEC_VISTA_GET_IPPROTO(ipproto)	 (ipproto == ipproto_tcp) ? IPPROTO_TCP : IPPROTO_UDP

-#define TINYIPSEC_VISTA_GET_IPVER(ipv6)	 (ipv6) ? FWP_IP_VERSION_V6 : FWP_IP_VERSION_V4

-#define TINYIPSEC_VISTA_GET_PROTO(proto)	 (proto == proto_ah) ? IPSEC_TRANSFORM_AH : ( (proto == proto_esp) ? IPSEC_TRANSFORM_ESP_AUTH : IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER );

-

-/* as WFP do not provide null encryption I define my own*/

-static const IPSEC_CIPHER_TRANSFORM_ID0 IPSEC_CIPHER_TRANSFORM_ID_NULL_NULL=

-{

-   (IPSEC_CIPHER_TYPE)NULL,

-   (IPSEC_CIPHER_TYPE)NULL

-};

-

-/**@ingroup tipsec_vista_group

-* IPSec context.

-*/

-typedef struct tipsec_context_vista_s

-{

-	TINYIPSEC_DECLARE_CONTEXT;

-	

-	UINT64 saId_us;

-	UINT64 saId_uc;

-

-	HANDLE engine;

-}

-tipsec_context_vista_t;

-

-/**@ingroup tipsec_vista_group

-*/

-#define TIPSEC_CONTEXT_VISTA(ctx) ((tipsec_context_vista_t*)(ctx))

-

-int tipsec_create_localSA(__in const tipsec_context_vista_t* context, __in tipsec_port_t local_port, __out tipsec_spi_t *spi, UINT64 *saId);

-int tipsec_boundSA(__in const tipsec_context_vista_t* context, __in UINT64 local_saId, __in tipsec_spi_t remote_spi, __in BOOLEAN toInbound);

-

-int tipsec_flush_all(const tipsec_context_vista_t* context);

-void DeleteSaContextAndFilters(__in HANDLE engine, __in UINT64 inFilterId, __in UINT64 outFilterId, __in UINT64 saId);

-

-/**@ingroup tipsec_vista_group

-*/

-int tipsec_start(tipsec_context_t* ctx)

-{

-	tipsec_context_vista_t* ctx_vista = TIPSEC_CONTEXT_VISTA(ctx);

-	int ret = -1;

-

-	if(!ctx_vista){

-		ret = -1;

-		goto bail;

-	}

-

-	if(TIPSEC_CONTEXT(ctx_vista)->started){

-		TSK_DEBUG_WARN("The IPSec context already started.");

-		ret = -2;

-		goto bail;

-	}

-

-	if(TIPSEC_CONTEXT(ctx_vista)->state != state_full){

-		TSK_DEBUG_ERROR("IPSec context is in the wrong state.");

-		ret = -3;

-		goto bail;

-	}

-

-	/* VERY IMPORTANT: The SA context functions must be called in a specific order:

-			(http://msdn.microsoft.com/en-us/library/bb540652(VS.85).aspx).

-		

-		IPsecSaContextCreate0 

-		IPsecSaContextGetSpi0 

-		IPsecSaContextAddInbound0 

-		IPsecSaContextAddOutbound0

-	*/

-

-	/* US <- PC */

-	if((ret = tipsec_boundSA(ctx_vista, ctx_vista->saId_us, TIPSEC_CONTEXT(ctx_vista)->spi_us, TRUE))){

-		TSK_DEBUG_ERROR("Failed to setup [US <- PC] SA.");

-		goto bail;

-	}

-	/* UC <- PS */

-	if((ret = tipsec_boundSA(ctx_vista, ctx_vista->saId_uc, TIPSEC_CONTEXT(ctx_vista)->spi_uc, TRUE))){

-		TSK_DEBUG_ERROR("Failed to setup [UC <- PS] SA.");

-		goto bail;

-	}

-

-	/* UC -> PS */

-	if((ret = tipsec_boundSA(ctx_vista, ctx_vista->saId_uc, TIPSEC_CONTEXT(ctx_vista)->spi_ps, FALSE))){

-		TSK_DEBUG_ERROR("Failed to setup [UC -> PS] SA.");

-		goto bail;

-	}

-	/* US -> PC */

-	if((ret = tipsec_boundSA(ctx_vista, ctx_vista->saId_us, TIPSEC_CONTEXT(ctx_vista)->spi_pc, FALSE))){

-		TSK_DEBUG_ERROR("Failed to setup [US -> PC] SA.");

-		goto bail;

-	}

-

-	// Set the state to active.

-	TIPSEC_CONTEXT(ctx_vista)->state = state_active;

-

-	TIPSEC_CONTEXT(ctx_vista)->started = 1;

-

-bail:

-	return ret;

-}

-

-/**@ingroup tipsec_vista_group

-*/

-int tipsec_set_local(tipsec_context_t* ctx, const char* addr_local, const char* addr_remote, tipsec_port_t port_uc, tipsec_port_t port_us)

-{

-	tipsec_context_vista_t* ctx_vista = TIPSEC_CONTEXT_VISTA(ctx);

-	int ret;

-

-	if(!ctx_vista){

-		ret = -1;

-		goto bail;

-	}

-

-	if(!addr_local || !port_uc || !port_us){

-		ret = -2;

-		goto bail;

-	}

-

-	if(!TIPSEC_CONTEXT(ctx_vista)->initialized){

-		TSK_DEBUG_ERROR("IPSec engine not initialized.");

-		ret = -3;

-		goto bail;

-	}

-

-	if(TIPSEC_CONTEXT(ctx_vista)->state != state_initial){

-		TSK_DEBUG_ERROR("IPSec context is in the wrong state.");

-		ret = -4;

-		goto bail;

-	}

-

-	TSK_FREE(TIPSEC_CONTEXT(ctx_vista)->addr_local);

-	TSK_FREE(TIPSEC_CONTEXT(ctx_vista)->addr_remote);

-

-	/* Set local IP */

-	if(TIPSEC_CONTEXT(ctx_vista)->use_ipv6){

-		TIPSEC_CONTEXT(ctx_vista)->addr_local = tsk_calloc(16, sizeof(uint8_t));

-		TIPSEC_CONTEXT(ctx_vista)->addr_remote = tsk_calloc(16, sizeof(uint8_t));

-

-		if ((ret = inet_pton(AF_INET6, addr_local, TIPSEC_CONTEXT(ctx_vista)->addr_local)) != 1 ){

-			TSK_DEBUG_ERROR("inet_pton(%s) have failed with error code [%x].", addr_local, ret);

-			goto bail;

-		} else ret = 0;

-		if ((ret = inet_pton(AF_INET6, addr_remote, TIPSEC_CONTEXT(ctx_vista)->addr_remote)) != 1 ){

-			TSK_DEBUG_ERROR("inet_pton(%s) have failed with error code [%x].", addr_remote, ret);

-			goto bail;

-		} else ret = 0;

-	}

-	else{

-		TIPSEC_CONTEXT(ctx_vista)->addr_local = tsk_calloc(4, sizeof(uint8_t));

-		TIPSEC_CONTEXT(ctx_vista)->addr_remote = tsk_calloc(4, sizeof(uint8_t));

-

-		if ((ret = inet_pton(AF_INET, addr_local, TIPSEC_CONTEXT(ctx_vista)->addr_local)) != 1 ){

-			TSK_DEBUG_ERROR("inet_pton(%s) have failed with error code [%x].", addr_local, ret);

-			goto bail;

-		} 

-		else {

-			*((UINT32*)TIPSEC_CONTEXT(ctx_vista)->addr_local) = ntohl(*((UINT32*)TIPSEC_CONTEXT(ctx_vista)->addr_local));

-			ret = 0;

-		}

-		if ((ret = inet_pton(AF_INET, addr_remote, TIPSEC_CONTEXT(ctx_vista)->addr_remote)) != 1 ){

-			TSK_DEBUG_ERROR("inet_pton(%s) have failed with error code [%x].", addr_remote, ret);

-			goto bail;

-		} 

-		else{

-			*((UINT32*)TIPSEC_CONTEXT(ctx_vista)->addr_remote) = ntohl(*((UINT32*)TIPSEC_CONTEXT(ctx_vista)->addr_remote));

-			ret = 0;

-		}

-	}

-

-	/* Set ports */

-	TIPSEC_CONTEXT(ctx_vista)->port_uc = port_uc;

-	TIPSEC_CONTEXT(ctx_vista)->port_us = port_us;

-	

-	if((ret = tipsec_create_localSA(ctx_vista, TIPSEC_CONTEXT(ctx_vista)->port_uc, &TIPSEC_CONTEXT(ctx_vista)->spi_uc, &ctx_vista->saId_uc))){

-		goto bail;

-	}

-

-	if((ret = tipsec_create_localSA(ctx_vista, TIPSEC_CONTEXT(ctx_vista)->port_us, &TIPSEC_CONTEXT(ctx_vista)->spi_us, &ctx_vista->saId_us))){

-		goto bail;

-	}

-

-	TIPSEC_CONTEXT(ctx_vista)->state = state_inbound;

-

-bail:

-

-	return ret;

-}

-

-/**@ingroup tipsec_vista_group

-*/

-int tipsec_set_keys(tipsec_context_t* ctx, const tipsec_key_t* ik, const tipsec_key_t* ck)

-{

-	if(!ctx || !ik || !ck){

-		return -1;

-	}

-

-	/* Compute ik and ck */

-	TIPSEC_CONTEXT(ctx)->ik = tsk_calloc(1, sizeof(FWP_BYTE_BLOB));

-	TIPSEC_CONTEXT(ctx)->ck = tsk_calloc(1, sizeof(FWP_BYTE_BLOB));

-

-	((PFWP_BYTE_BLOB)TIPSEC_CONTEXT(ctx)->ik)->data = tsk_calloc(1, TIPSEC_IK_LEN);

-	memcpy(((PFWP_BYTE_BLOB)TIPSEC_CONTEXT(ctx)->ik)->data, ik, TIPSEC_KEY_LEN);

-	((PFWP_BYTE_BLOB)TIPSEC_CONTEXT(ctx)->ik)->size = TIPSEC_KEY_LEN;

-

-	((PFWP_BYTE_BLOB)TIPSEC_CONTEXT(ctx)->ck)->data = tsk_calloc(1, TIPSEC_CK_LEN);

-	memcpy(((PFWP_BYTE_BLOB)TIPSEC_CONTEXT(ctx)->ck)->data, ck, TIPSEC_KEY_LEN);

-	((PFWP_BYTE_BLOB)TIPSEC_CONTEXT(ctx)->ck)->size = TIPSEC_KEY_LEN;

-

-	return 0;

-}

-

-/**@ingroup tipsec_vista_group

-*/

-int tipsec_set_remote(tipsec_context_t* ctx, tipsec_spi_t spi_pc, tipsec_spi_t spi_ps, tipsec_port_t port_pc, tipsec_port_t port_ps, tipsec_lifetime_t lifetime)

-{

-	tipsec_context_vista_t* ctx_vista = TIPSEC_CONTEXT_VISTA(ctx);

-	int ret = -1;

-

-	if(!ctx_vista){

-		ret = -1;

-		goto bail;

-	}

-

-	if(!lifetime || !port_pc || !port_ps){

-		ret = -2;

-		goto bail;

-	}

-

-	if(TIPSEC_CONTEXT(ctx_vista)->state != state_inbound){

-		TSK_DEBUG_ERROR("IPSec context is in the wrong state.");

-		ret = -3;

-		goto bail;

-	}

-

-	/* Set Lifetime */

-	TIPSEC_CONTEXT(ctx_vista)->lifetime = lifetime;

-

-	/* Set ports */

-	TIPSEC_CONTEXT(ctx_vista)->port_ps = port_ps;

-	TIPSEC_CONTEXT(ctx_vista)->port_pc = port_pc;

-

-	/* Set spis */

-	TIPSEC_CONTEXT(ctx_vista)->spi_ps = spi_ps;

-	TIPSEC_CONTEXT(ctx_vista)->spi_pc = spi_pc;

-

-	TIPSEC_CONTEXT(ctx_vista)->state = state_full;

-

-	ret = 0;

-

-bail:

-	return ret;

-}

-

-/**@ingroup tipsec_vista_group

-*/

-int tipsec_stop(tipsec_context_t* ctx)

-{

-	tipsec_context_vista_t* ctx_vista = TIPSEC_CONTEXT_VISTA(ctx);

-	int ret = -1;

-

-	if(!ctx_vista){

-		ret = -1;

-		goto bail;

-	}

-

-	if(!TIPSEC_CONTEXT(ctx_vista)->started){

-		TSK_DEBUG_WARN("The IPSec context not started.");

-		ret = -2;

-		goto bail;

-	}

-

-	/* Flush (delete) all SAs associated to tinyIPSEC */

-	tipsec_flush_all(ctx_vista);

-

-	TIPSEC_CONTEXT(ctx_vista)->started = 0;

-	TIPSEC_CONTEXT(ctx_vista)->state = state_initial;

-

-bail:

-	return ret;

-}

-

-int tipsec_create_localSA(__in const tipsec_context_vista_t* context, __in tipsec_port_t local_port, __out tipsec_spi_t *spi, UINT64 *saId)

-{

-	DWORD result = NO_ERROR;

-	UINT64 tmpInFilterId = 0, tmpOutFilterId = 0, tmpSaId = 0;

-	FWPM_FILTER0 filter;

-	IPSEC_TRAFFIC0 outTraffic;

-	IPSEC_GETSPI0 getSpi;

-	int ret = -1;

-	FWPM_FILTER_CONDITION0 conds[4];

-	conds[0].fieldKey = FWPM_CONDITION_IP_LOCAL_ADDRESS;

-	conds[0].matchType = FWP_MATCH_EQUAL;

-

-	*spi = 0;

-	*saId = 0;

-

-	if(TIPSEC_CONTEXT(context)->use_ipv6){

-		conds[0].conditionValue.type = FWP_BYTE_ARRAY16_TYPE;

-		conds[0].conditionValue.byteArray16 = (FWP_BYTE_ARRAY16*)TIPSEC_CONTEXT(context)->addr_local;

-	}

-	else{

-		conds[0].conditionValue.type = FWP_UINT32;

-		conds[0].conditionValue.uint32 = *((UINT32*)TIPSEC_CONTEXT(context)->addr_local);

-	}

-	conds[1].fieldKey = FWPM_CONDITION_IP_REMOTE_ADDRESS;

-	conds[1].matchType = FWP_MATCH_EQUAL;

-	if(TIPSEC_CONTEXT(context)->use_ipv6){

-		conds[1].conditionValue.type = FWP_BYTE_ARRAY16_TYPE;

-		conds[1].conditionValue.byteArray16 = (FWP_BYTE_ARRAY16*)TIPSEC_CONTEXT(context)->addr_remote;

-	}

-	else{

-		conds[1].conditionValue.type = FWP_UINT32;

-		conds[1].conditionValue.uint32 = *((UINT32*)TIPSEC_CONTEXT(context)->addr_remote);

-	}

-

-	conds[2].fieldKey = FWPM_CONDITION_IP_LOCAL_PORT;

-	conds[2].matchType = FWP_MATCH_EQUAL;

-	conds[2].conditionValue.type = FWP_UINT16;

-	conds[2].conditionValue.uint16 = local_port;

-

-	conds[3].fieldKey = FWPM_CONDITION_IP_PROTOCOL;

-	conds[3].matchType = FWP_MATCH_EQUAL;

-	conds[3].conditionValue.type = FWP_UINT8;

-	conds[3].conditionValue.uint16 = TINYIPSEC_VISTA_GET_IPPROTO(TIPSEC_CONTEXT(context)->ipproto);

-

-	// Fill in the common fields shared by both filters.

-	memset(&filter, 0, sizeof(filter));

-	// For MUI compatibility, object names should be indirect strings. See

-	// SHLoadIndirectString for details.

-	filter.displayData.name = (PWSTR)TINYIPSEC_FILTER_NAME;

-	// Link all objects to our provider. When multiple providers are installed

-	// on a computer, this makes it easy to determine who added what.

-	filter.providerKey = (GUID*)TINYIPSEC_PROVIDER_KEY;

-	filter.numFilterConditions = 4;

-	filter.filterCondition = conds;

-	filter.action.type = FWP_ACTION_CALLOUT_TERMINATING;

-	filter.flags = FWPM_FILTER_FLAG_NONE;

-	//filter.weight.type = FWP_EMPTY;

-

-	// Add the inbound filter.

-	filter.layerKey = (TIPSEC_CONTEXT(context)->use_ipv6) ? FWPM_LAYER_INBOUND_TRANSPORT_V6 : FWPM_LAYER_INBOUND_TRANSPORT_V4;

-	if(TIPSEC_CONTEXT(context)->mode == mode_tun){

-		filter.action.calloutKey = (TIPSEC_CONTEXT(context)->use_ipv6) ? FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6 : FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4;

-	}

-	else{

-		filter.action.calloutKey = (TIPSEC_CONTEXT(context)->use_ipv6) ? FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6 : FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4;

-	}

-	if((result = FwpmFilterAdd0(context->engine, &filter, NULL, &tmpInFilterId)) != ERROR_SUCCESS){

-		TSK_DEBUG_ERROR("FwpmFilterAdd0 (inbound) failed with error code [%x]", result);

-		goto CLEANUP;

-	}

-

-	// Add the outbound filter.

-	filter.layerKey = (TIPSEC_CONTEXT(context)->use_ipv6) ? FWPM_LAYER_OUTBOUND_TRANSPORT_V6 : FWPM_LAYER_OUTBOUND_TRANSPORT_V4;

-	if(TIPSEC_CONTEXT(context)->mode == mode_tun){

-		filter.action.calloutKey = (TIPSEC_CONTEXT(context)->use_ipv6) ? FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6 : FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4;

-	}

-	else{

-		filter.action.calloutKey = (TIPSEC_CONTEXT(context)->use_ipv6) ? FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6 : FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4;

-	}

-	if((result = FwpmFilterAdd0(context->engine, &filter, NULL, &tmpOutFilterId)) != ERROR_SUCCESS){

-		TSK_DEBUG_ERROR("FwpmFilterAdd0(outbound) failed with error code [%x]", result);

-		goto CLEANUP;

-	}

-

-	// Create the SA context using the outbound traffic descriptor.

-	memset(&outTraffic, 0, sizeof(outTraffic));

-	outTraffic.ipVersion = TINYIPSEC_VISTA_GET_IPVER(TIPSEC_CONTEXT(context)->use_ipv6);

-	if(TIPSEC_CONTEXT(context)->use_ipv6){

-		memcpy(outTraffic.localV6Address, TIPSEC_CONTEXT(context)->addr_local, 16);

-		memcpy(outTraffic.remoteV6Address, TIPSEC_CONTEXT(context)->addr_remote, 16);

-	}

-	else{

-		outTraffic.localV4Address = *((ULONG*)TIPSEC_CONTEXT(context)->addr_local);

-		outTraffic.remoteV4Address = *((ULONG*)TIPSEC_CONTEXT(context)->addr_remote);

-	}

-	outTraffic.trafficType = TINYIPSEC_VISTA_GET_MODE(TIPSEC_CONTEXT(context)->mode);

-	outTraffic.ipsecFilterId = tmpOutFilterId;

-	if((result = IPsecSaContextCreate0(context->engine, &outTraffic, NULL, &tmpSaId)) != ERROR_SUCCESS){

-		TSK_DEBUG_ERROR("IPsecSaContextCreate0 failed with error code [%x]", result);

-		goto CLEANUP;

-	}

-	

-	// Get the inbound SPI using the inbound traffic descriptor.

-	memset(&getSpi, 0, sizeof(getSpi));

-	getSpi.inboundIpsecTraffic.ipVersion = TINYIPSEC_VISTA_GET_IPVER(TIPSEC_CONTEXT(context)->use_ipv6);

-	if(TIPSEC_CONTEXT(context)->use_ipv6){

-		memcpy(getSpi.inboundIpsecTraffic.localV6Address, TIPSEC_CONTEXT(context)->addr_local, 16);

-		memcpy(getSpi.inboundIpsecTraffic.remoteV6Address, TIPSEC_CONTEXT(context)->addr_remote, 16);

-	}

-	else{

-		getSpi.inboundIpsecTraffic.localV4Address = *((ULONG*)TIPSEC_CONTEXT(context)->addr_local);

-		getSpi.inboundIpsecTraffic.remoteV4Address = *((ULONG*)TIPSEC_CONTEXT(context)->addr_remote);

-	}

-	getSpi.inboundIpsecTraffic.trafficType = TINYIPSEC_VISTA_GET_MODE(TIPSEC_CONTEXT(context)->mode);

-	getSpi.inboundIpsecTraffic.ipsecFilterId = tmpInFilterId;

-	getSpi.ipVersion = TINYIPSEC_VISTA_GET_IPVER(TIPSEC_CONTEXT(context)->use_ipv6);

-	if((result = IPsecSaContextGetSpi0(context->engine, tmpSaId, &getSpi, spi))){

-		TSK_DEBUG_ERROR("IPsecSaContextGetSpi0 failed with error code [%x]", result);

-		goto CLEANUP;

-	}

-

-	//// Return the various LUIDs to the caller, so he can clean up.

-	//*inFilterId = tmpInFilterId;

-	//*outFilterId = tmpOutFilterId;

-	*saId = tmpSaId;

-	

-CLEANUP:

-	if (result != NO_ERROR){

-		DeleteSaContextAndFilters(context->engine, tmpInFilterId, tmpOutFilterId, tmpSaId);

-	}else ret = 0;

-	

-	return ret;

-}

-

-int tipsec_boundSA(__in const tipsec_context_vista_t* context, __in UINT64 local_saId, __in tipsec_spi_t remote_spi, __in BOOLEAN toInbound)

-{

-	UINT32 i=0, j=0;

-	DWORD result = NO_ERROR;

-	IPSEC_SA0 sa;

-	IPSEC_SA_BUNDLE0 bundle;

-	IPSEC_SA_AUTH_INFORMATION0 authInfo;

-	PFWP_BYTE_BLOB ik = (PFWP_BYTE_BLOB)TIPSEC_CONTEXT(context)->ik;

-	PFWP_BYTE_BLOB ck = (PFWP_BYTE_BLOB)TIPSEC_CONTEXT(context)->ck;

-	

-	memset(&sa, 0, sizeof(sa));

-	sa.spi = remote_spi;

-	sa.saTransformType = TINYIPSEC_VISTA_GET_PROTO(TIPSEC_CONTEXT(context)->protocol);

-

-

-	//

-	//	Keys padding

-	//

-	if(TIPSEC_CONTEXT(context)->alg == algo_hmac_sha_1_96){

-		if(ik->size < TIPSEC_IK_LEN){

-			for(i = ik->size; i<TIPSEC_KEY_LEN; i++){

-				ik->data[i] = 0x00; /* Already done by "tsk_calloc" but ... */

-			}

-			ik->size = TIPSEC_IK_LEN;

-		}

-	}

-	if(TIPSEC_CONTEXT(context)->ealg == ealg_des_ede3_cbc){

-		if(ck->size < TIPSEC_CK_LEN){

-			for(i = ck->size; i<TIPSEC_CK_LEN; i++){

-				ck->data[i] = ck->data[j++];

-			}

-			ck->size = TIPSEC_CK_LEN;

-		}

-	}

-

-	//

-	//	In all case create Authentication info

-	//

-	memset(&authInfo, 0, sizeof(authInfo));

-	authInfo.authTransform.authTransformId = TINYIPSEC_VISTA_GET_ALGO(TIPSEC_CONTEXT(context)->alg);

-	authInfo.authKey = *ik;

-

-	if( sa.saTransformType == IPSEC_TRANSFORM_AH ){

-		sa.ahInformation = &authInfo;

-	}

-	else if( sa.saTransformType == IPSEC_TRANSFORM_ESP_AUTH ){

-		sa.espAuthInformation = &authInfo;

-	}

-	else if( sa.saTransformType == IPSEC_TRANSFORM_ESP_AUTH_AND_CIPHER ){

-		IPSEC_SA_CIPHER_INFORMATION0 cipherInfo;

-		IPSEC_SA_AUTH_AND_CIPHER_INFORMATION0 cipherAuthInfo;

-

-		memset(&cipherInfo, 0, sizeof(cipherInfo));

-		cipherInfo.cipherTransform.cipherTransformId = TINYIPSEC_VISTA_GET_EALGO(TIPSEC_CONTEXT(context)->ealg);

-		cipherInfo.cipherKey = *ck;

-		

-		memset(&cipherAuthInfo, 0, sizeof(cipherAuthInfo));

-		cipherAuthInfo.saAuthInformation = authInfo;

-		cipherAuthInfo.saCipherInformation = cipherInfo;

-

-		sa.espAuthAndCipherInformation = &cipherAuthInfo;

-	}

-	

-	memset(&bundle, 0, sizeof(bundle));

-	bundle.numSAs = 1;

-	bundle.saList = &sa;

-	bundle.ipVersion = TINYIPSEC_VISTA_GET_IPVER(TIPSEC_CONTEXT(context)->use_ipv6);

-	bundle.lifetime.lifetimeSeconds = (UINT32)((TIPSEC_CONTEXT(context)->lifetime > TINYIPSEC_SA_MAX_LIFETIME) ? TINYIPSEC_SA_MAX_LIFETIME : TIPSEC_CONTEXT(context)->lifetime);

-

-	/* From remote to local (inbound) ? */

-	if(toInbound){

-		if((result = IPsecSaContextAddInbound0(context->engine, local_saId, &bundle)) != ERROR_SUCCESS){

-			TSK_DEBUG_ERROR("IPsecSaContextAddInbound0 failed with error code [%x]", result);

-			goto CLEANUP;

-		}

-	}

-	else{

-		if((result = IPsecSaContextAddOutbound0(context->engine, local_saId, &bundle)) != ERROR_SUCCESS){

-			TSK_DEBUG_ERROR("IPsecSaContextAddOutbound0 failed with error code [%x]", result);

-			goto CLEANUP;

-		}

-	}	

-

-CLEANUP:

-	return (result == ERROR_SUCCESS) ? 0 : -1;

-}

-

-

-void DeleteSaContextAndFilters(__in HANDLE engine, __in UINT64 inFilterId, __in UINT64 outFilterId, __in UINT64 saId)

-{

-   DWORD result;

-

-   // Allow the LUIDs to be zero, so we can use this function to cleanup

-   // partial results.

-   if (saId != 0)

-   {

-      result = IPsecSaContextDeleteById0(engine, saId);

-      if (result != ERROR_SUCCESS)

-      {

-         // There's not much we can do if delete fails, so continue trying to

-         // clean up the remaining objects.

-         TSK_DEBUG_ERROR("IPsecSaContextDeleteById0 = 0x%08X\n", result);

-      }

-   }

-   if (outFilterId != 0)

-   {

-      result = FwpmFilterDeleteById0(engine, outFilterId);

-      if (result != ERROR_SUCCESS)

-      {

-         TSK_DEBUG_ERROR("FwpmFilterDeleteById0 = 0x%08X\n", result);

-      }

-   }

-   if (inFilterId != 0)

-   {

-      result = FwpmFilterDeleteById0(engine, inFilterId);

-      if (result != ERROR_SUCCESS)

-      {

-         TSK_DEBUG_ERROR("FwpmFilterDeleteById0 = 0x%08X\n", result);

-      }

-   }

-}

-

-int tipsec_flush_all(const tipsec_context_vista_t* context)

-{

-	UINT32 i;

-	int ret = -1;

-

-	if(context)

-	{

-		HANDLE enumHandle = NULL;

-		IPSEC_SA_DETAILS0** entries = NULL;

-		UINT32 numEntriesReturned = 0;

-		DWORD result;

-

-		if((result = IPsecSaCreateEnumHandle0(context->engine, NULL, &enumHandle)) != ERROR_SUCCESS){

-			TSK_DEBUG_ERROR("IPsecSaCreateEnumHandle0 failed with error code [%x].", result);

-			goto CLEANUP;

-		}

-		

-		if((result = IPsecSaEnum0(context->engine, enumHandle, TINYIPSEC_SA_NUM_ENTRIES_TO_REQUEST, &entries, &numEntriesReturned)) != ERROR_SUCCESS){

-			TSK_DEBUG_ERROR("IPsecSaEnum0 failed with error code [%x].", result);

-			goto CLEANUP;

-		}

-

-		for(i = 0; i<numEntriesReturned; i++)

-		{

-			IPSEC_SA_DETAILS0* entry = (entries)[i];

-			if( !wcscmp(entry->transportFilter->displayData.name, TINYIPSEC_FILTER_NAME))

-			{

-				if((result = FwpmFilterDeleteById0(context->engine, entry->transportFilter->filterId)) != ERROR_SUCCESS){

-					TSK_DEBUG_ERROR("FwpmFilterDeleteById0 failed with error code [%x].", result);

-					goto CLEANUP;

-				}

-			}

-		}

-

-		if((result = IPsecSaDestroyEnumHandle0(context->engine, enumHandle)) != ERROR_SUCCESS){

-			TSK_DEBUG_ERROR("IPsecSaDestroyEnumHandle0 failed with error code [%x].", result);

-			goto CLEANUP;

-		}

-		

-		TSK_DEBUG_INFO("All SAs have been flushed.");

-		ret = 0;

-

-	CLEANUP:

-		FwpmFreeMemory0((void**)entries);

-	}

-

-	return ret;

-}

-

-//=================================================================================================

-//	IPSec context object definition

-//

-static tsk_object_t* tipsec_context_ctor(tsk_object_t * self, va_list * app)

-{

-	tipsec_context_vista_t *context = self;

-	if(context){

-		DWORD code;

-	

-		TIPSEC_CONTEXT(context)->ipproto = va_arg(*app, tipsec_ipproto_t);

-		TIPSEC_CONTEXT(context)->use_ipv6 = va_arg(*app, int);

-		TIPSEC_CONTEXT(context)->mode = va_arg(*app, tipsec_mode_t);

-		TIPSEC_CONTEXT(context)->ealg = va_arg(*app, tipsec_ealgorithm_t);

-		TIPSEC_CONTEXT(context)->alg = va_arg(*app, tipsec_algorithm_t);

-		TIPSEC_CONTEXT(context)->protocol = va_arg(*app, tipsec_protocol_t);

-

-		/* Open engine */

-		if((code = FwpmEngineOpen0(NULL, RPC_C_AUTHN_WINNT, NULL, NULL, &context->engine))){

-			TIPSEC_CONTEXT(context)->initialized = tsk_false;

-			TSK_DEBUG_ERROR("FwpmEngineOpen0 failed with error code [%x].", code);

-		}

-		else{

-			TIPSEC_CONTEXT(context)->initialized = tsk_true;

-		}

-		

-		TIPSEC_CONTEXT(context)->state = state_initial;

-	}

-	return self;

-}

-

-static tsk_object_t* tipsec_context_dtor(tsk_object_t * self)

-{ 

-	tipsec_context_vista_t *context = self;

-	if(context)

-	{

-		DWORD code;

-

-		if(TIPSEC_CONTEXT(context)->started){

-			tipsec_stop(TIPSEC_CONTEXT(context));

-		}

-		

-		/* Close engine */

-		if((code = FwpmEngineClose0(context->engine))){

-			TSK_DEBUG_ERROR("FwpmEngineClose0 failed with error code [%x].", code);

-		}

-

-		TSK_FREE(TIPSEC_CONTEXT(context)->addr_local);

-		TSK_FREE(TIPSEC_CONTEXT(context)->addr_remote);

-		

-		TSK_FREE(TIPSEC_CONTEXT(context)->ik);

-		TSK_FREE(TIPSEC_CONTEXT(context)->ck);

-	}

-

-	return self;

-}

-

-static int tipsec_context_cmp(const tsk_object_t *obj1, const tsk_object_t *obj2)

-{

-	return-1;

-}

-

-static const tsk_object_def_t tipsec_context_def_s = 

-{

-	sizeof(tipsec_context_vista_t),

-	tipsec_context_ctor, 

-	tipsec_context_dtor,

-	tipsec_context_cmp, 

-};

-const void *tipsec_context_def_t = &tipsec_context_def_s;

-

-

-#endif /* HAVE_IPSEC_VISTA */