/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

* %version: 23 %

*/

#if !defined(_AKA_CORE_H_)

#define _AKA_CORE_H_

#include "eap_tools.h"

#include "eap_am_export.h"

#include "eap_base_type.h"

#include "eap_variable_data.h"

#include "eap_type_aka_header.h"

#include "eap_type_aka_types.h"

#include "eap_type_aka_payloads.h"

#include "eap_type_aka_state.h"

#include "eap_type_aka_initialized.h"

#include "abs_eap_base_timer.h"

#include "abs_eap_am_type_aka.h"

#include "eap_am_type_aka.h"

#include "eap_crypto_api.h"

#include "eap_master_session_key.h"

//--------------------------------------------------

/// This class is implementation of AKA EAP-type.

: public abs_eap_am_type_aka_c

, public abs_eap_base_timer_c

, public eap_base_type_c

{

private:

	//--------------------------------------------------

	/// This is pointer to the tools class.

	abs_eap_am_tools_c * const m_am_tools;

	/// This is pointer to adaptation module of AKA EAP type.

	eap_am_type_aka_c * const m_am_type_aka;

	/// HASH over all AKA-Identity messages.

	crypto_sha1_c m_checkcode;

	u32_t m_checkcode_update_count;

	eap_variable_data_c m_received_checkcode;

	eap_variable_data_c m_checkcode_saved_message;

	eap_array_c<eap_variable_data_c> m_all_payloads;

	eap_variable_data_c m_nonce_mt_file;

	eap_variable_data_c m_manual_username;

	eap_variable_data_c m_manual_realm;

	/// This is the automatic realm generated in AM of EAP-SIM.

	/// Note this could be invalid data when automatic realm is not used.

	/// The m_automatic_realm_read flag tells whether m_automatic_realm is read from AM of EAP-SIM.

	eap_variable_data_c m_automatic_realm;

	/// This flag tells whether automatic realm is read from AM of EAP-SIM.

	/// Note the data of m_automatic_realm could be invalid data when it is not used.

	bool m_automatic_realm_read;

	/// This is offset in bytes of the EAP-type header in the packet buffer.

	/// Offset is described in abs_eap_base_type_c::get_header_offset().

	u32_t m_aka_header_offset;

	/// This is maximum transfer unit in bytes.

	/// MTU is described in abs_eap_base_type_c::get_header_offset().

	u32_t m_MTU;

	/// This is length of the trailer in bytes.

	/// Trailer length is described in abs_eap_base_type_c::get_header_offset().

	u32_t m_trailer_length;

	u32_t m_length_of_mnc;

	/// This stores the current authentication type.

	/// Look at the m_identity_type too.

	eap_aka_authentication_type_e m_authentication_type;

	/// This stores the current identity type.

	/// NOTE there is one stupid case where m_identity_type is AKA_IDENTITY_TYPE_RE_AUTH_ID

	/// and m_authentication_type is AKA_AUTHENTICATION_TYPE_FULL_AUTH.

	/// Look at the Chapter "Fast Re-authentication Procedure when Counter is Too Small"

	/// in the EAP-SIM specification.

	/// Because of that illogical specification we need separate 

	/// attributes for authentication type and identity type.

	eap_type_aka_identity_type m_identity_type;

	/// This is the first client error.

	eap_aka_client_error_code_e m_client_error_code;

	/// This is saved AKA notificatoin code.

	/// If this value is eap_aka_notification_none, no notification is stored.

	eap_aka_notification_codes_e m_aka_notification_code;

	u32_t m_failure_message_delay_time;

	/// This indicates whether this object was generated successfully.

	bool m_is_valid;

	/// This indicates whether this object is client (true) or server (false).

	/// In terms of EAP-protocol whether this network entity is EAP-supplicant (true) or EAP-authenticator (false).

	bool m_is_client;

	/// True value of this flag indicates the EAP-Success packet must be received

	/// in successfull authentication of clien.

	/// This value is configured with EAP_AKA_wait_eap_success_packet.

	bool m_wait_eap_success_packet;

	/// True value of this flag indicates the identifier of the EAP-Response/Identity must be checked.

	/// This is not possible cases where identifier of the EAP-Request/Identity is generated by other network entities.

	bool m_check_identifier_of_eap_identity_response;

	/// True value means m_am_type_aka is allocated within eap_type_aka_c

	/// and m_am_type_aka must be freed in destructor.

	bool m_free_am_type_aka;

	/// True value means client responds to all re-transmitted EAP-AKA packets.

	/// False value means client does not respond to any re-transmitted EAP-AKA packets.

	bool m_client_responds_retransmitted_packets;

	/// True value means this is a test version of AKA.

	bool m_aka_test_version;

	/// True value means server refuses EAP-identity randomly.

	/// False value means does not refuse EAP-identity randomly.

	/// NOTE EAP_AKA_test_version option must be true also.

	bool m_aka_randomly_refuse_eap_identity;

	/// This flag forces check of NAI realm. Realm must be the same as given in EAP_AKA_manual_realm configuration option.

	/// Default value is false, check is not done by default.

	bool m_check_nai_realm;

	/// This is for testing purposes. True value will cause failed test of re-authentication counter.

	bool m_fail_reauthentication_counter_check;

	/// True value of this flag allows acception of EAP-Response/Identity.

	/// False value does not accept EAP-Response/Identity. Instead identity is queried

	/// in EAP-Request/AKA/Start with AT_ANY_ID_REQ attribute.

	bool m_accept_eap_identity_response;

	/// True value of this flag returns random

	/// identity on EAP-Response/Identity.

	/// False value returns real identity

	/// (IMSI, pseudonym or re-authentication identity).

	bool m_use_random_identity_on_eap_identity_response;

	/// This flag is set true when shutdown() function is called.

	bool m_shutdown_was_called;

	/// This flag is set true when reset() function is called.

	/// This flag prevent multiple subsequent calls of rset() function.

	bool m_reset_was_called;

	/// This flag tells whether the pseudonym identity could be used (true) or not (false).

	bool m_use_pseudonym_identity;

	/// This flag tells whether the re-authentication identity could be used (true) or not (false).

	bool m_use_reauthentication_identity;

	/// This is set true when erroneus packet is received.

	bool m_erroneus_packet_received;

	/// This is set true when AKA notification packet is received.

	bool m_aka_notification_packet_received;

	/// This flag allows use of Windows RAS identity in EAP-Identity/Response.

	/// EAP-Request/Start will include identity query attribute.

	bool m_use_manual_username;

	/// Default value is false. That will cause use of automatic realm.

	/// If this is true then

	/// cf_str_EAP_AKA_manual_realm is used as the realm.

	bool m_use_manual_realm;

	bool m_randomly_fail_successfull_authentication;

	bool m_allow_use_result_indication;

	bool m_use_result_indication;

	//--------------------------------------------------

	//--------------------------------------------------

	/// This attribute stores the valid AKA states (eap_type_aka_state_variable_e).

	/// Each eap_type_aka_state_variable_parameters_c includes the valid 

	/// AKA messages within the state.

	eap_type_aka_state_variable_parameters_c m_parameters[eap_type_aka_state_last_value];

	/// This is the current state.

	eap_type_aka_state_variable_e m_state;

	/// This is the saved previous state. On error case this is the state where continue.

	eap_type_aka_state_variable_e m_saved_previous_state;

	/// This is network identity of the sent packet from this handler.

	eap_am_network_id_c m_send_network_id;

	/// This is the NONCE_S. Server generates NONCE_S and sends it to client

	/// within the EAP-Request/AKA/Re-authentication message.

	eap_variable_data_c m_nonce_s;

	// - - - - - - - - - - - - - - - - - - - -

	/// Server sends IV to client within EAP-Request/AKA/Challenge message.

	/// The AT_IV payload is optional.

	aka_variable_data_c m_IV;

	/// EAP-Request/AKA/Challenge message must be saved until n*Kc and n*SRES are get from AKA.

	eap_variable_data_c m_saved_EAP_packet;

	// - - - - - - - - - - - - - - - - - - - -

	/// XKEY = SHA1(n*Kc| NONCE_MT)

	eap_variable_data_c m_XKEY;

	/// K_encr is the first 16 octets of generated Key_block:s.

	eap_variable_data_c m_K_encr;

	/// K_aut is the 16 octets after K_encr of generated Key_block:s.

	eap_variable_data_c m_K_aut;

	/// m_master_session_key is the 20 octets after m_K_aut of generated Key_block:s.

	eap_master_session_key_c m_master_session_key;

	// - - - - - - - - - - - - - - - - - - - -

	/// This is the real IMSI.

	eap_variable_data_c m_IMSI;

	/// This is the pseudonym for IMSI. This is used only if server supports use of pseudonym.

	eap_variable_data_c m_pseudonym;

	/// This is the reauthentication identity. This is used only if server supports use of reauthentication identity.

	eap_variable_data_c m_reauthentication_identity;

	/// This is identity used in authentication. This is real IMSI or pseudonym.

	/// Pseudonym is used only if server supports use of pseudonym.

	eap_variable_data_c m_identity;

	/// This is the NAI. Format is "username@realm".

	eap_variable_data_c m_NAI;

	eap_variable_data_c m_RAND;

	eap_variable_data_c m_AUTN;

	eap_variable_data_c m_RES;

	eap_variable_data_c m_2_digit_mnc_map_of_mcc_of_imsi_array;

	eap_variable_data_c m_uma_automatic_realm_prefix;

	bool m_use_uma_profile;

	/// Here is stored the received authentication vector.

	eap_type_aka_authentication_vector_c *m_authentication_vector;

	u32_t m_reauthentication_counter;

	aka_payload_AT_type_e m_include_identity_to_aka_identity_response;

	/// Identity of this type is included in start response.

	aka_payload_AT_type_e m_aka_identity_response_includes_identity;

	/// This flag indicates whether the EAP-Failure was received.

	/// On successfull authentication bogus EAP-Failure is ignored.

	bool m_failure_message_received;

	/// This flag indicated whether the authentication was successfull (true).

	bool m_authentication_finished_successfully;

	/// This variable stores the last used EAP-Identifier.

	/// Client will always send EAP-Response with this identifier.

	/// Server will always send EAP-Request with this identifier increased by one.

	/// Server increase this identifier after successfull packet send.

	u8_t m_last_eap_identifier;

	bool m_use_eap_expanded_type;

	//--------------------------------------------------

	//--------------------------------------------------

	/**

	 * This function initializes the allowed messages within one specific state.

	 */

				const eap_type_aka_state_variable_e state,

				const bool must_be_initiator,

				const bool must_be_responder,

				const aka_subtype_e type0,

				const aka_subtype_e type1,

				const aka_subtype_e type2,

				const aka_subtype_e type3,

				const aka_subtype_e type4);

	/**

	 * This function expands key and seed data to key_length of expansion.

	 *  expansion_0 = prf(key, seed | 0)

	 *  expansion_i = prf(key, expansion_i-1 | seed | i), where i = 1, 2...

	 */

		const u32_t key_length,

		eap_variable_data_c * const expansion,

		const eap_variable_data_c * const key,

		const eap_variable_data_c * const seed);

	/**

	 * This function returns the eap_type_aka_state_variable_parameters_c object of current state.

	 */

	//--------------------------------------------------

	//--------------------------------------------------

	/**

	 * This function generates a new NAI from domain and IMSI.

	 */

		eap_variable_data_c * const new_nai, ///< This is the new generated NAI.

		const bool use_manual_default_realm, ///< When true uses realm parameter, when false generates automatic realm.

		const eap_variable_data_c * const realm, ///< This is the domain part of the NAI.

		const eap_variable_data_c * const id_IMSI_or_pseydonym, ///< This is IMSI or pseudonym.

		const bool id_is_imsi, ///< This parameter tells whether id_IMSI_or_pseydonym is IMSI (true) or pseudonym (false).

		const eap_variable_data_c * const IMSI, ///< This parameter must be IMSI always.

		const eap_variable_data_c * const automatic_realm,

		const u32_t length_of_mnc

		);

	/**

	 * This function adds generic attribute payload to AKA message.

	 * @param aka is pointer to EAP header including AKA fields.

	 * @param maximum_buffer_size is the maximum length of sent packet.

	 * @param eap_header_size is length of EAP header.

	 * See also aka_header_c and eap_header_base_c.

	 * @param data_offset is the offset of inserted payloads in AKA EAP packet.

	 * It is the value of AKA sub-type data.

	 * @param data_free is the remaining free AKA data buffer size.

	 * @param buffer_free is the remaining free packet buffer size.

	 * @param buffer_offset is the offset from the begin of the packet buffer

	 * to the end of the last data payload.

	 * @param data_payload is the new payload to be added.

	 * @param data_payload_type is the attribute payload type to be added.

	 *

	 * See also eap_type_aka_c::update_payload_indexes().

	 *

	 * Format of the payload is as follows:

	 * @code

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * | AT type       | Payload Length|           Reserved            |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * | Any variable length payload                                   |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * @endcode

	 */

		aka_header_c * const aka,

		const u32_t maximum_buffer_size,

		const u32_t eap_header_size,

		u32_t * const data_offset,

		u32_t * const data_free,

		u32_t * const buffer_free,

		u32_t * const buffer_offset,

		const eap_variable_data_c * const data_payload,

		const aka_payload_AT_type_e data_payload_type);

	/**

	 * This function adds AUTS attribute payload to AKA message.

	 * @param aka is pointer to EAP header including AKA fields.

	 * @param maximum_buffer_size is the maximum length of sent packet.

	 * @param eap_header_size is length of EAP header.

	 * See also aka_header_c and eap_header_base_c.

	 * @param data_offset is the offset of inserted payloads in AKA EAP packet.

	 * It is the value of AKA sub-type data.

	 * @param data_free is the remaining free AKA data buffer size.

	 * @param buffer_free is the remaining free packet buffer size.

	 * @param buffer_offset is the offset from the begin of the packet buffer

	 * to the end of the last data payload.

	 * @param data_payload is the new payload to be added.

	 * @param data_payload_type is the attribute payload type to be added.

	 *

	 * See also eap_type_aka_c::update_payload_indexes().

	 *

	 * Format of the payload is as follows:

	 * @code

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * | AT type       | Payload Length|       AUTS ...                |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * | ... AUTS                                                      |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * @endcode

	 */

		aka_header_c * const aka,

		const u32_t aka_buffer_length,

		const u32_t eap_header_size,

		u32_t * const aka_data_offset,

		u32_t * const aka_data_free,

		u32_t * const packet_buffer_free,

		u32_t * const packet_buffer_offset,

		const eap_variable_data_c * const data_payload,

		const aka_payload_AT_type_e data_payload_type);

	/**

	 * This function adds RES attribute payload to AKA message.

	 * @param aka is pointer to EAP header including AKA fields.

	 * @param maximum_buffer_size is the maximum length of sent packet.

	 * @param eap_header_size is length of EAP header.

	 * See also aka_header_c and eap_header_base_c.

	 * @param data_offset is the offset of inserted payloads in AKA EAP packet.

	 * It is the value of AKA sub-type data.

	 * @param data_free is the remaining free AKA data buffer size.

	 * @param buffer_free is the remaining free packet buffer size.

	 * @param buffer_offset is the offset from the begin of the packet buffer

	 * to the end of the last data payload.

	 * @param RES is the RES payload to be added.

	 * @param data_payload_type is the attribute payload type to be added.

	 *

	 * See also eap_type_aka_c::update_payload_indexes().

	 *

	 * Format of the payload is as follows:

	 * @code

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * | AT_RES        | Length        |       RES Length in bits      |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * |                              RES ...

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * @endcode

	 */

		aka_header_c * const aka,

		const u32_t aka_buffer_length,

		const u32_t eap_header_size,

		u32_t * const aka_data_offset,

		u32_t * const aka_data_free,

		u32_t * const packet_buffer_free,

		u32_t * const packet_buffer_offset,

		const eap_variable_data_c * const RES,

		const aka_payload_AT_type_e data_payload_type);

	/**

	 * This function adds IMSI or pseudonym attribute payload to AKA message.

	 * @param aka is pointer to EAP header including AKA fields.

	 * @param maximum_buffer_size is the maximum length of sent packet.

	 * @param eap_header_size is length of EAP header.

	 * See also aka_header_c and eap_header_base_c.

	 * @param data_offset is the offset of inserted payloads in AKA EAP packet.

	 * It is the value of AKA sub-type data.

	 * @param data_free is the remaining free AKA data buffer size.

	 * @param buffer_free is the remaining free packet buffer size.

	 * @param buffer_offset is the offset from the begin of the packet buffer

	 * to the end of the last data payload.

	 * @param pseudonym_or_imsi is the IMSI or pseudonym payload to be added.

	 * @param data_payload_type is the attribute payload type to be added.

	 *

	 * See also eap_type_aka_c::update_payload_indexes().

	 *

	 * Format of the payload is as follows:

	 * @code

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * | AT_<type>     | Length        | Actual Pseudonym Length       |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * |                                                               |

	 * |                    Pseudonym or IMSI                          |

	 * |                                                               |

	 * |                                                               |

	 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 * @endcode

	 */

		aka_header_c * const aka,

		const u32_t maximum_buffer_size,

		const u32_t eap_header_size,

		u32_t * const data_offset,

		u32_t * const data_free,

		u32_t * const buffer_free,

		u32_t * const buffer_offset,

		const eap_variable_data_c * const pseudonym_or_imsi,