/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 135 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

#include "eap_am_memory.h"

#include "eap_am_export.h"

#include "eap_am_tools.h"

#include "eap_tools.h"

#include "eap_crypto_api.h"

#include "abs_tls_base_record.h"

#include "tls_base_record.h"

#include "tls_record.h"

#include "tls_am_services.h"

#include "tls_handshake_header.h"

#include "tls_peap_types.h"

#include "tls_message.h"

#include "eap_automatic_variable.h"

#include "eap_state_notification.h"

#include "eap_type_tls_peap_types.h"

#include "eap_header_string.h"

#if defined(USE_FAST_EAP_TYPE)

	#include "eap_fast_tlv_payloads.h"

#endif //#if defined(USE_FAST_EAP_TYPE)

#if defined(USE_EAP_TLS_SESSION_TICKET)

#include "tls_extension.h"

#endif // #if defined(USE_EAP_TLS_SESSION_TICKET)

//--------------------------------------------------

#define EAP_STATUS_RETURN_AND_CREATE_TLS_PROTOCOL_ALERT(tools, status) \

	EAP_STATUS_RETURN(tools, eap_status_return_and_create_tls_protocol_alert((status)))

eap_status_e tls_record_c::eap_status_return_and_create_tls_protocol_alert(

	const eap_status_e status)

{

	if (status != eap_status_ok

		&& status != eap_status_success

		&& status != eap_status_pending_request

		&& status != eap_status_drop_packet_quietly)

	{

		(void) create_tls_protocol_alert(tls_alert_description_none, tls_alert_level_none, status);

	}

	return EAP_STATUS_RETURN(m_am_tools, status);

}

//--------------------------------------------------

EAP_FUNC_EXPORT tls_record_c::~tls_record_c()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT,

					(EAPL("this = 0x%08x, %s: function: starts: tls_record_c::~tls_record_c(): m_am_tls_services")

					 EAPL(" = 0x%08x (validity %d).\n"),

					 this,

					 (m_is_client == true ? "client": "server"),

					 m_am_tls_services,

					 m_am_tls_services->get_is_valid()));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::~tls_record_c()");

	EAP_ASSERT(m_shutdown_was_called == true);

	completion_action_clenup();

	if (m_free_am_tls_services == true)

	{

		delete m_am_tls_services;

	}

	m_am_tls_services = 0;

	if (m_free_application == true)

	{

		delete m_application;

	}

	m_application = 0;

	reset_block_ciphers(true);

	reset_block_ciphers(false);

	reset_stream_ciphers(true);

	reset_stream_ciphers(false);

	reset_hmac_algorithms(true);

	reset_hmac_algorithms(false);

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

#if defined(_WIN32) && !defined(__GNUC__)

	#pragma warning( disable : 4355 ) // 'this' : used in base member initializer list

#endif

EAP_FUNC_EXPORT tls_record_c::tls_record_c(

	abs_eap_am_tools_c * const tools, ///< tools is pointer to the tools class. @see abs_eap_am_tools_c.

	tls_am_services_c * const am_tls_services, ///< This is pointer to adaptation module of TLS.

	const bool free_am_tls_services,

	tls_base_application_c * const application, ///< application is pointer to application object.

	const bool free_application,

	const bool is_client_when_true, ///< Indicates whether this is client (true) or server (false).

	const eap_type_value_e eap_type,

	const eap_am_network_id_c * const receive_network_id)

	: tls_base_record_c(tools /*, partner */)

	, m_am_tools(tools)

	, m_am_tls_services(am_tls_services)

	, m_free_am_tls_services(free_am_tls_services)

	, m_application(application)

	, m_free_application(free_application)

	, m_completion_queue(tools)

	, m_received_tls_message(tools, this, this, this, is_client_when_true)

	, m_new_tls_message(tools, this, this, this, is_client_when_true)

	, m_message_hash_md5(tools)

	, m_message_hash_sha1(tools)

	, m_message_hash_md5_certificate_verify(tools)

	, m_message_hash_sha1_certificate_verify(tools)

	, m_client_message_hash_md5_finished(tools)

	, m_client_message_hash_sha1_finished(tools)

	, m_server_message_hash_md5_finished(tools)

	, m_server_message_hash_sha1_finished(tools)

	, m_client_handshake_random_value(tools)

	, m_server_handshake_random_value(tools)

	, m_session_id(tools)

	, m_master_secret(tools)

	, m_eap_master_session_key(tools, eap_type)

	, m_new_send_mac_key(tools)

	, m_new_receive_mac_key(tools)

	, m_new_send_encryption_key(tools)

	, m_new_receive_encryption_key(tools)

	, m_new_send_iv(tools)

	, m_new_receive_iv(tools)

	, m_send_mac_key(tools)

	, m_receive_mac_key(tools)

	, m_send_encryption_key(tools)

	, m_receive_encryption_key(tools)

	, m_send_iv(tools)

	, m_receive_iv(tools)

	, m_session_key_seed(tools)

	, m_mschapv2_challenges(tools)

	, m_own_private_dhe_key(tools)

	, m_own_public_dhe_key(tools)

	, m_peer_public_dhe_key(tools)

	, m_shared_dh_key(tools)

	, m_dhe_prime(tools)

	, m_dhe_group_generator(tools)

	, m_signed_message_hash(tools)

	, m_premaster_secret(tools)

	, m_own_encrypted_premaster_secret(tools)

#if defined(USE_FAST_EAP_TYPE)

	, m_eap_fast_pac_key(tools)

#endif //#if defined(USE_FAST_EAP_TYPE)

	, m_proposed_cipher_suites(tools)

	, m_proposed_compression_methods(tools)

#if defined(USE_EAP_TLS_SESSION_TICKET)

	, m_supported_tls_extensions(tools)

	, m_received_tls_extensions(tools)

#endif // #if defined(USE_EAP_TLS_SESSION_TICKET)

	, m_NAI_realm(tools)

	, m_send_network_id(tools)

	, m_own_certificate_chain(tools)

	, m_own_certificate_types(tools)

	, m_own_certificate_authorities(tools)

	, m_peer_certificate_chain(tools)

	, m_peer_certificate_chain_result(eap_status_illegal_certificate)

	, m_verify_signature(eap_status_authentication_failure)

	, m_peer_certificate_types(tools)

	, m_peer_certificate_authorities(tools)

	, m_resumed_cipher_suite(tls_cipher_suites_none)

	, m_selected_cipher_suite(tls_cipher_suites_none)

	, m_selected_compression_method(tls_compression_method_none)

	, m_receive_cipher_suite(tls_cipher_suites_TLS_NULL_WITH_NULL_NULL)

	, m_receive_compression_method(tls_compression_method_null)

	, m_send_cipher_suite(tls_cipher_suites_TLS_NULL_WITH_NULL_NULL)

	, m_send_compression_method(tls_compression_method_null)

	, m_send_block_cipher(0)

	, m_receive_block_cipher(0)

	, m_send_stream_cipher(0)

	, m_receive_stream_cipher(0)

	, m_send_hmac_algorithm(0)

	, m_receive_hmac_algorithm(0)

	, m_send_record_sequence_number(0ul)

	, m_receive_record_sequence_number(0ul)

	, m_tls_peap_state(tls_peap_state_wait_tls_start)

	, m_tls_session_type(tls_session_type_none)

	, m_eap_type(eap_type)

	, m_peap_version(peap_version_none)

	, m_tunneled_eap_type_authentication_state(eap_state_none)

	, m_is_valid(false)

	, m_is_client(is_client_when_true)

	, m_allow_message_send(true)

	, m_already_in_completion_action_check(false)

	, m_already_in_process_tls_records(false)

	, m_pending_query_certificate_authorities_and_types(false)

	, m_pending_query_certificate_chain(false)

	, m_pending_query_cipher_suites_and_previous_session(false)

	, m_pending_query_dh_parameters(false)

	, m_pending_query_realm(false)

	, m_pending_select_cipher_suite_and_check_session_id(false)

	, m_pending_verify_certificate_chain(false)

	, m_pending_rsa_decrypt_with_private_key(false)

	, m_pending_rsa_encrypt_with_public_key(false)

	, m_pending_sign_with_private_key(false)

	, m_pending_verify_with_public_key(false)

	, m_pending_query_tunnel_PAC(false)

	, m_tls_peap_test_version(false)

	, m_key_material_generated(false)

	, m_tls_peap_server_authenticates_client_policy_flag(true)

	, m_tls_peap_server_authenticates_client_config_server(true)

	, m_tls_peap_server_authenticates_client_action(true)

	, m_tls_peap_server_requested_client_certificate(false)

	, m_could_send_fatal_alert_message(true)

	, m_could_send_warning_alert_message(true)

	, m_force_tls_message_send(false)

	, m_shutdown_was_called(false)

	, m_use_separate_tls_record(true)  // Some vendors seems to use only separate TLS-records. Windows RAS and FreeRadius works too with this.

	, m_use_extra_padding_length(false) // It seems that EAP-TLS of Microsoft Windows does not work with extra padding.

	, m_client_allows_empty_certificate_authorities_list(false)

	, m_server_sends_empty_certificate_authorities_list(false)

	, m_use_tppd_tls_peap(true)

	, m_use_tppd_peapv1_acknowledge_hack(false)

	, m_server_offers_new_session_id(true)

	, m_will_receive_new_session_ticket(false)

	, m_send_piggypacked_eap_identity_request(true)

#if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

	, m_tls_use_identity_privacy(false)

	, m_tls_identity_privacy_handshake_state(tls_identity_privacy_handshake_state_none)

#endif //#if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

#if defined(USE_FAST_EAP_TYPE)

	, m_eap_fast_allow_server_unauthenticated_provisioning_mode_ADHP(false)

	, m_remove_tunnel_pac(false)

#endif //#if defined(USE_FAST_EAP_TYPE)

	{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("TLS: this = 0x%08x, %s: function: starts: tls_record_c::tls_record_c(): "),

		 this,

		 (m_is_client == true ? "client": "server")));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::tls_record_c()");

	if (receive_network_id == 0

		|| receive_network_id->get_is_valid_data() == false)

	{

		// No need to delete anything here because it is done in destructor.

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	if (m_am_tls_services == 0

		|| m_am_tls_services->get_is_valid() == false)

	{

		EAP_TRACE_ERROR(m_am_tools, TRACE_FLAGS_TLS_PEAP_ERROR,

						(EAPL("ERROR: %s: function: tls_record_c::tls_record_c() failed,")

						 EAPL(" m_am_tls_services = 0x%08x (validity %d) is invalid.\n"),

						 (m_is_client == true ? "client": "server"),

						 m_am_tls_services, (m_am_tls_services != 0) ? m_am_tls_services->get_is_valid() : false));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	m_am_tls_services->set_tls_am_partner(this);

	// Here we swap the addresses.

	eap_am_network_id_c send_network_id(

		m_am_tools,

		receive_network_id->get_destination_id(),

		receive_network_id->get_source_id(),

		receive_network_id->get_type());

	eap_status_e status = m_send_network_id.set_copy_of_network_id(&send_network_id);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	if (get_is_tunneled_tls() == true

		&& m_application == 0)

	{

		// Application is required in tunneled mode.

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	if (m_application != 0)

	{

		m_application->set_application_partner(this);

	}

	if (m_is_client == false)

	{

		set_state(tls_peap_state_wait_handshake_type_client_hello);

	}

	set_is_valid();

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_record_c::reset_block_ciphers(const bool send_when_true)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (send_when_true == true)

	{

		delete m_send_block_cipher;

		m_send_block_cipher = 0;

	}

	else

	{

		delete m_receive_block_cipher;

		m_receive_block_cipher = 0;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_record_c::reset_stream_ciphers(const bool send_when_true)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (send_when_true == true)

	{

		delete m_send_stream_cipher;

		m_send_stream_cipher = 0;

	}

	else

	{

		delete m_receive_stream_cipher;

		m_receive_stream_cipher = 0;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_record_c::reset_hmac_algorithms(const bool send_when_true)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (send_when_true == true)

	{

		delete m_send_hmac_algorithm;

		m_send_hmac_algorithm = 0;

	}

	else

	{

		delete m_receive_hmac_algorithm;

		m_receive_hmac_algorithm = 0;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_record_c::set_state(const tls_peap_state_e state)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("TLS: this = 0x%08x, %s: state_function: starts: tls_record_c::set_state() from %s to %s\n"),

		 this,

		 (m_is_client == true ? "client": "server"),

		 eap_tls_trace_string_c::get_state_string(m_tls_peap_state),

		 eap_tls_trace_string_c::get_state_string(state)));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::set_state()");

	if (m_tls_peap_state != tls_peap_state_failure)

	{

		m_tls_peap_state = state;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT tls_peap_state_e tls_record_c::get_state() const

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return m_tls_peap_state;

}

//--------------------------------------------------

EAP_FUNC_EXPORT bool tls_record_c::verify_state(const tls_peap_state_e state)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	bool are_equal = false;

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("TLS: %s: state_function: starts: tls_record_c::verify_state(): (current state %s) %s (new state %s)\n"),

		 (m_is_client == true ? "client": "server"),

		 eap_tls_trace_string_c::get_state_string(m_tls_peap_state),

		 ((m_tls_peap_state == state) ? "==" : "!="),

		 eap_tls_trace_string_c::get_state_string(state)));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::verify_state()");

	if (m_tls_peap_state == state)

	{

		are_equal = true;

	}

	else

	{

		are_equal = false;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return are_equal;

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_record_c::set_is_valid()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	m_is_valid = true;

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT bool tls_record_c::get_is_tunneled_tls()

{

	return (

		m_eap_type == eap_type_peap

		|| m_eap_type == eap_type_ttls

#if defined(USE_FAST_EAP_TYPE)

		|| m_eap_type == eap_type_fast

#endif //#if defined(USE_FAST_EAP_TYPE)

		);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_record_c::set_peap_version(

	const peap_version_e peap_version,

	const bool use_tppd_tls_peap,

	const bool use_tppd_peapv1_acknowledge_hack)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	m_peap_version = peap_version;

	m_use_tppd_tls_peap = use_tppd_tls_peap;

	m_use_tppd_peapv1_acknowledge_hack = use_tppd_peapv1_acknowledge_hack;

	m_am_tls_services->set_peap_version(

		peap_version,

		use_tppd_tls_peap,

		use_tppd_peapv1_acknowledge_hack);

	if (m_application != 0)

	{

		m_application->set_peap_version(

			peap_version,

			use_tppd_tls_peap,

			use_tppd_peapv1_acknowledge_hack);

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e tls_record_c::configure()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("TLS: this = 0x%08x, %s: function: starts: tls_record_c::configure():\n"),

		 this,

		(m_is_client == true ? "client": "server")));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::configure()");