/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

* %version: 120.1.6 %

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 50 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

#include "eap_am_memory.h"

#include "eapol_key_state.h"

#include "eapol_key_header.h"

#include "eap_crypto_api.h"

#include "abs_eap_am_mutex.h"

#include "eap_state_notification.h"

#include "eap_automatic_variable.h"

#include "eapol_rsna_key_data_gtk_header.h"

#include "abs_eapol_core.h"

#include "abs_eapol_key_state.h"

#include "eap_core_retransmission.h"

#include "eapol_rsna_key_data_payloads.h"

#include "eap_buffer.h"

#include "eapol_session_key.h"

#include "eapol_key_state_string.h"

//--------------------------------------------------

// 

EAP_FUNC_EXPORT eap_status_e eapol_key_state_c::save_parameters(

	const eapol_key_authentication_type_e authentication_type,

	const eap_variable_data_c * const authenticator_RSNA_IE,

	const eap_variable_data_c * const supplicant_RSNA_IE,

	const eapol_RSNA_key_header_c::eapol_RSNA_cipher_e eapol_pairwise_cipher,

	const eapol_RSNA_key_header_c::eapol_RSNA_cipher_e eapol_group_cipher)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status(eap_status_process_general_error);

	m_authentication_type = authentication_type;

	m_eapol_pairwise_cipher = eapol_pairwise_cipher;

	m_eapol_group_cipher = eapol_group_cipher;

	eapol_key_state_string_c state_string;

	EAP_TRACE_DEBUG(

		m_am_tools, 

		TRACE_FLAGS_DEFAULT, 

		(EAPL("EAPOL_KEY: %s: eapol_key_state_c::save_parameters(): m_authentication_type=%s, ")

		 EAPL("m_eapol_pairwise_cipher=%d, m_eapol_group_cipher=%d.\n"),

		 (m_is_client == true) ? "client": "server",

		 state_string.get_eapol_key_authentication_type_string(m_authentication_type),

		 m_eapol_pairwise_cipher,

		 m_eapol_group_cipher));

	if (get_is_RSNA() == true

		|| get_is_WPA() == true

#if defined(EAP_USE_WPXM)

		|| get_is_WPXM() == true

#endif //#if defined(EAP_USE_WPXM)

		)

	{

		if (authenticator_RSNA_IE->get_is_valid_data() == true)

		{

			status = m_authenticator_RSNA_IE.set_copy_of_buffer(

				authenticator_RSNA_IE);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

			EAP_TRACE_DATA_DEBUG(

				m_am_tools,

				TRACE_FLAGS_DEFAULT,

				(EAPL("Authenticator RSN IE"),

				 get_authenticator_RSNA_IE()->get_data(

					 get_authenticator_RSNA_IE()->get_data_length()),

				 get_authenticator_RSNA_IE()->get_data_length()));

		}

		else

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_parameter);

		}

		if (supplicant_RSNA_IE->get_is_valid_data() == true)

		{

			status = m_supplicant_RSNA_IE.set_copy_of_buffer(

				supplicant_RSNA_IE);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

			EAP_TRACE_DATA_DEBUG(

				m_am_tools,

				TRACE_FLAGS_DEFAULT,

				(EAPL("Supplicant RSN IE"),

				get_supplicant_RSNA_IE()->get_data(

					get_supplicant_RSNA_IE()->get_data_length()),

				get_supplicant_RSNA_IE()->get_data_length()));

		}

		else

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_parameter);

		}

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

}

//--------------------------------------------------

// 

EAP_FUNC_EXPORT eap_status_e eapol_key_state_c::initialize(

	const eap_am_network_id_c * const receive_network_id,

	const eapol_key_authentication_type_e authentication_type,

	const eap_variable_data_c * const authenticator_RSNA_IE,

	const eap_variable_data_c * const supplicant_RSNA_IE,

	const eapol_RSNA_key_header_c::eapol_RSNA_cipher_e eapol_pairwise_cipher,

	const eapol_RSNA_key_header_c::eapol_RSNA_cipher_e eapol_group_cipher,

	const eap_variable_data_c * const pre_shared_key)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status(eap_status_process_general_error);

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	status = save_parameters(

		authentication_type,

		authenticator_RSNA_IE,

		supplicant_RSNA_IE,

		eapol_pairwise_cipher,

		eapol_group_cipher);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	if ((m_authentication_type == eapol_key_authentication_type_RSNA_PSK

		 || m_authentication_type == eapol_key_authentication_type_WPA_PSK)

		&& (pre_shared_key == 0

			|| pre_shared_key->get_is_valid_data() == false

			|| pre_shared_key->get_data_length() < EAPOL_RSNA_PMK_LENGTH_BYTES))

	{

		if (pre_shared_key != 0)

		{

			EAP_TRACE_ERROR(

				m_am_tools, 

				TRACE_FLAGS_EAPOL_KEY_DATA_ERROR, 

				(EAPL("ERROR: EAPOL_KEY: eapol_key_state_c::initialize(): illegal pre shared key 0x%08x, PSK length %d.\n"),

				 pre_shared_key->get_data(pre_shared_key->get_data_length()),

				pre_shared_key->get_data_length()));

		}

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_key_error);

	}

	else if (m_authentication_type == eapol_key_authentication_type_RSNA_EAP

		&& (m_eapol_pairwise_cipher == eapol_RSNA_key_header_c::eapol_RSNA_cipher_none))

	{

		EAP_TRACE_ERROR(

			m_am_tools, 

			TRACE_FLAGS_EAPOL_KEY_DATA_ERROR, 

			(EAPL("ERROR: EAPOL_KEY: eapol_key_state_c::initialize(): illegal pairwise cipher suite %d.\n"),

			m_eapol_pairwise_cipher));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_cipher_suite);

	}

	else if (m_authentication_type == eapol_key_authentication_type_RSNA_EAP

		&& (m_eapol_group_cipher == eapol_RSNA_key_header_c::eapol_RSNA_cipher_none))

	{

		EAP_TRACE_ERROR(

			m_am_tools, 

			TRACE_FLAGS_EAPOL_KEY_DATA_ERROR, 

			(EAPL("ERROR: EAPOL_KEY: eapol_key_state_c::initialize(): illegal group cipher suite %d.\n"),

			m_eapol_group_cipher));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_cipher_suite);

	}

	else if (m_authentication_type == eapol_key_authentication_type_WPA_EAP

		&& (m_eapol_pairwise_cipher == eapol_RSNA_key_header_c::eapol_RSNA_cipher_none))

	{

		EAP_TRACE_ERROR(

			m_am_tools, 

			TRACE_FLAGS_EAPOL_KEY_DATA_ERROR, 

			(EAPL("ERROR: EAPOL_KEY: eapol_key_state_c::initialize(): illegal pairwise cipher suite %d.\n"),

			m_eapol_pairwise_cipher));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_cipher_suite);

	}

	else if (m_authentication_type == eapol_key_authentication_type_WPA_EAP

		&& (m_eapol_group_cipher == eapol_RSNA_key_header_c::eapol_RSNA_cipher_none))

	{

		EAP_TRACE_ERROR(

			m_am_tools, 

			TRACE_FLAGS_EAPOL_KEY_DATA_ERROR, 

			(EAPL("ERROR: EAPOL_KEY: eapol_key_state_c::initialize(): illegal group cipher suite %d.\n"),

			m_eapol_group_cipher));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_cipher_suite);

	}

	else if (m_authentication_type == eapol_key_authentication_type_802_1X)

	{

		// OK, cannot check the pairwise and group ciphers.

		// AP will tell these in the EAPOL RC4 Key message.

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	status = set_mac_addresses(receive_network_id);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	set_eapol_key_state(eapol_key_state_none);

	m_eapol_key_handshake_type = eapol_key_handshake_type_none;

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	if (m_authentication_type == eapol_key_authentication_type_RSNA_PSK

		|| m_authentication_type == eapol_key_authentication_type_WPA_PSK)

	{

		// Here we swap the addresses.

		eap_am_network_id_c send_network_id(

			m_am_tools,

			receive_network_id->get_destination_id(),

			receive_network_id->get_source_id(),

			receive_network_id->get_type());

		if (send_network_id.get_is_valid_data() == false)

		{

			return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

		}

		status = set_pairwise_PMK(

			pre_shared_key,

			&send_network_id);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

	}

#if defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

	{

		m_is_associated = true;

		EAP_TRACE_DEBUG(

			m_am_tools, 

			TRACE_FLAGS_DEFAULT, 

			(EAPL("EAPOL_KEY: %s: eapol_key_state_c::initialize(): m_is_associated=%s.\n"),

			 (m_is_client == true) ? "client": "server",

			 (m_is_associated == true) ? "true": "false"));

	}

#endif //#if defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

	return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

}

//--------------------------------------------------

#if defined(USE_EAPOL_KEY_STATE) && defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

// 

EAP_FUNC_EXPORT eap_status_e eapol_key_state_c::initialize(

	const eap_am_network_id_c * const receive_network_id,

	const eapol_key_authentication_type_e authentication_type)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status(eap_status_process_general_error);

	reset();

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	m_authentication_type = authentication_type;

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	status = set_mac_addresses(receive_network_id);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	set_eapol_key_state(eapol_key_state_none);

	m_eapol_key_handshake_type = eapol_key_handshake_type_none;

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

#if defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

	// Creates SNonce. This is done here in early phase of authentication.

	// This will reduce the CPU load when time critical first message

	// of 4-Way handshake is processed.

	status = create_nonce(&m_SNonce, EAPOL_RSNA_NONCE_LENGTH_BYTES);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

#endif //#if defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

}

#endif //#if defined(USE_EAPOL_KEY_STATE) && defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

//--------------------------------------------------

// 

eap_status_e eapol_key_state_c::set_mac_addresses(

	const eap_am_network_id_c * const receive_network_id)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status(eap_status_process_general_error);

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	{

		const eap_variable_data_c * authenticator_MAC_address = 0;

		const eap_variable_data_c * supplicant_MAC_address = 0;

		if (m_is_client == true)

		{

			authenticator_MAC_address = receive_network_id->get_source_id();

			supplicant_MAC_address = receive_network_id->get_destination_id();

		}

		else

		{

			authenticator_MAC_address = receive_network_id->get_destination_id();

			supplicant_MAC_address = receive_network_id->get_source_id();

		}

		status = m_authenticator_MAC_address.set_copy_of_buffer(

			authenticator_MAC_address);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		status = m_supplicant_MAC_address.set_copy_of_buffer(

			supplicant_MAC_address);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	{

		const eap_variable_data_c * destination = 0;

		const eap_variable_data_c * source = 0;

		if (m_is_client == true)

		{

			destination = &m_authenticator_MAC_address;

			source = &m_supplicant_MAC_address;

		}

		else

		{

			destination = &m_supplicant_MAC_address;

			source = &m_authenticator_MAC_address;

		}

		eap_am_network_id_c send_network_id(m_am_tools,

			source,

			destination,

			eapol_ethernet_type_pae);

		status = m_send_network_id.set_copy_of_network_id(&send_network_id);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, status);

}

//--------------------------------------------------

// 

EAP_FUNC_EXPORT eapol_key_state_c::~eapol_key_state_c()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools, 

		TRACE_FLAGS_DEFAULT, 

		(EAPL("EAPOL_KEY: eapol_key_state_c::~eapol_key_state_c(): this = 0x%08x => 0x%08x.\n"),

		this,

		dynamic_cast<abs_eap_base_timer_c *>(this)));

	EAP_ASSERT(m_shutdown_was_called == true);

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

// 

EAP_FUNC_EXPORT eapol_key_state_c::eapol_key_state_c(

	abs_eap_am_tools_c * const tools,

	abs_eapol_key_state_c * const key_state_partner,

	abs_eapol_core_c * const eapol_partner,

	const bool is_client_when_true,

	const eap_am_network_id_c * const receive_network_id,

	const eapol_key_authentication_type_e authentication_type,

	const eap_variable_data_c * const authenticator_RSNA_IE,

	const eap_variable_data_c * const supplicant_RSNA_IE,

	const eapol_RSNA_key_header_c::eapol_RSNA_cipher_e eapol_pairwise_cipher,

	const eapol_RSNA_key_header_c::eapol_RSNA_cipher_e eapol_group_cipher,

	const eap_variable_data_c * const pre_shared_key)

	: m_am_tools(tools)

	, m_key_state_partner(key_state_partner)

	, m_eapol_partner(eapol_partner)

	, m_send_network_id(tools)

	, m_authenticator_RSNA_IE(tools)

	, m_unicast_cipher_suite_RSNA_IE(tools)

	, m_supplicant_RSNA_IE(tools)

	, m_received_PMKID(tools)

	, m_supplicant_MAC_address(tools)

	, m_authenticator_MAC_address(tools)

	, m_ANonce(tools)

	, m_SNonce(tools)

	, m_EAPOL_key_IV(tools)

	, m_pairwise_PMK_WPXK3(tools)

	, m_PMKID(tools)

	, m_transient_PTK(tools)

	, m_confirmation_KCK(tools)

	, m_encryption_KEK(tools)

	, m_temporal_TK(tools)

	, m_group_GTK(tools)

#if defined(EAP_USE_WPXM)

	, m_WPXM_WPXK1(tools)

	, m_WPXM_WPXK2(tools)

	, m_WPXM_WPXC(eapol_key_constant_wpxm_initial_wpxc_counter_value)

#endif //#if defined(EAP_USE_WPXM)

	, m_group_GTK_ID(0u)

	, m_group_GTK_Tx_bit(false)

	, m_eapol_header_offset(0ul)

	, m_MTU(0ul)

	, m_trailer_length(0ul)

	, m_retransmission(0)

	, m_retransmission_time(EAPOL_KEY_STATE_TIMER_RETRANSMISSION_TIMEOUT)

	, m_retransmission_counter(EAPOL_KEY_STATE_RETRANSMISSION_COUNTER)

	, m_handshake_timeout(EAPOL_KEY_STATE_TIMER_HANDSHAKE_TIMEOUT_TIMEOUT)

#if defined(EAP_USE_WPXM)

	, m_wpxm_reassociate_timeout(EAPOL_KEY_STATE_TIMER_REASSOCIATE_TIMEOUT)

	, m_EAPOL_WPXM_key_descriptor_type(eapol_key_descriptor_type_none)

#endif //#if defined(EAP_USE_WPXM)

	, m_authentication_type(authentication_type)

	, m_eapol_pairwise_cipher(eapol_pairwise_cipher)

	, m_eapol_group_cipher(eapol_group_cipher)

	, m_eapol_key_state(eapol_key_state_none)

	, m_eapol_key_handshake_type(eapol_key_handshake_type_none)

	, m_create_key_failure(eapol_key_state_none)

	, m_pmksa_caching_timeout(EAPOL_KEY_STATE_TIMER_PMKSA_CACHING_TIMEOUT)

	, m_key_reply_counter(0ul)

	, m_client_send_key_reply_counter(0ul)

	, m_is_client(is_client_when_true)

	, m_is_valid(false)

	, m_marked_removed(false)

	, m_shutdown_was_called(false)

	, m_allow_missing_PMKID_in_message_1(false)

	, m_skip_PMKID_key_data_in_message_1(false)

	, m_allow_non_zero_mic_and_reserved_in_message_1(false)

	, m_indicate_pmkid_to_lower_layer(false)

	, m_handshake_timeout_set(false)

	, m_server_TEST_group_key_update(false)

#if defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

	, m_is_associated(false)

#endif //#if defined(USE_EAPOL_KEY_STATE_OPTIMIZED_4_WAY_HANDSHAKE)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);