/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 604 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

// INCLUDE FILES

#include "eap_tools.h"

#include "eap_am_type_aka_symbian.h"

#include "eap_am_tools_symbian.h"

#include "eap_state_notification.h"

#include "EapAkaDbDefaults.h"

#include "EapAkaDbParameterNames.h"

#include "EapAkaDbUtils.h"

#include "EapTraceSymbian.h"

#include <d32dbms.h>	// For DBMS

#include <s32strm.h> 	// For RReadStream

#if defined (USE_EAP_TYPE_SERVER_AKA)

// These are needed only for the server and test environment (Plugin tester)

// Enable USE_EAP_TYPE_SERVER_AKA in eapol.mmh to build for test environment.

#include "eap_crypto_api.h"

#include "eap_am_aka_milenage_algorithm.h"

#endif // #if defined (USE_EAP_TYPE_SERVER_AKA)

#if defined (USE_EAP_AKA_INTERFACE) && !defined(__WINS__)

	#include "EapAkaInterface.h"	

#endif // End of #if defined (USE_EAP_AKA_INTERFACE) && !defined(__WINS__)

// This is needed for cf_str_EAP_AKA_2_digit_mnc_map_of_mcc_of_imsi_array.

#include "eap_type_aka_types.h"

const TUint AKA_IMSI_LENGTH = 15u;

const TUint KMaxSqlQueryLength = 512;

const TUint KMaxDBFieldNameLength = 255;

const TInt 	KDefaultColumnInView_One = 1; // For DB view.

const TInt 	KMicroSecsInASecond = 1000000; // 1000000 micro seconds is 1 second.

const u8_t EAP_AKA_DEFAULT_REAUTHENTICATION_REALM[] = "dymmy.reauth.org";

const u32_t EAP_AKA_DEFAULT_REAUTHENTICATION_REALM_LENGTH = sizeof(EAP_AKA_DEFAULT_REAUTHENTICATION_REALM)-1ul;

#if defined (USE_EAP_TYPE_SERVER_AKA) || defined(__WINS__)

const char TEST_IMSI[] = "244070100000001";

#endif

#if defined (USE_EAP_TYPE_SERVER_AKA)

// For the server side.

struct eap_aka_encryption_imsi_block_s

{

	u8_t id_type:1;

	u8_t imsi_length:7;

	u8_t imsi_and_padding[AKA_IMSI_LENGTH];

};

struct eap_aka_pseudonym_s

{

	u32_t encryption_key_index;

	union _IV

	{

		u8_t IV_8[EAP_AES_BLOCK_SIZE];

		u32_t IV_32[EAP_AES_BLOCK_SIZE/sizeof(u32_t)];

	} encryption_IV;

	eap_aka_encryption_imsi_block_s imsi_block;

	u8_t MAC[HMAC_SHA1_128_SIZE];

};

const u32_t ENCRYPTION_KEY_INDEX_SCRAMBLE_CONST = 0xa7b3c922;

#endif //#if defined (USE_EAP_TYPE_SERVER_AKA)

// ================= MEMBER FUNCTIONS =======================

eap_am_type_aka_symbian_c::eap_am_type_aka_symbian_c(

	abs_eap_am_tools_c * const tools,

	abs_eap_base_type_c * const partner,

	const TIndexType aIndexType,

	const TInt aIndex,

	const eap_type_value_e aTunnelingType,

	const bool aIsClient,

	const eap_am_network_id_c * const receive_network_id)

: eap_am_type_aka_c(tools)

, m_am_tools(static_cast<eap_am_tools_symbian_c*>(tools)) // Tools class must be of type eap_am_tools_symbian because

														  // this is Symbian specific code.

, m_partner(partner)

, m_nai_realm(tools)

, m_index_type(aIndexType)

, m_index(aIndex)

, m_tunneling_type(aTunnelingType)

, m_is_valid(false)

, m_is_client(aIsClient)

, m_stored_reauth_id(tools)

, m_stored_pseudonym(tools)

, m_previous_imsi(tools)

, m_stored_required_completion(eap_type_aka_complete_none)

, m_stored_received_eap_identifier(0)

, m_shutdown_was_called(false)

, m_aka_algorithm(0)

, m_aka_if(0)

, m_simulator_aka_K(tools)

, m_simulator_aka_OP(tools)

, m_simulator_aka_AMF(tools)

, m_authentication_vector(0)

, m_pseudonym_identity(tools)

, m_reauthentication_identity(tools)

, m_username(tools)

, m_receive_network_id(tools)

, m_IMSI(tools)

, m_required_identity(aka_payload_NONE)

, m_required_completion(eap_type_aka_complete_none)

, m_identity_type(AKA_IDENTITY_TYPE_NONE)

, m_completion_action(eap_type_aka_complete_none)

, m_next_eap_identifier(0)

, m_aka_authentication_vector_status(eap_aka_authentication_vector_status_ok)

, m_pseudonym_key_index(0u)

, m_pseudonym_key(tools)

, m_pseudonym_MAC_key(tools)

, m_prev_pseudonym_key(tools)

, m_prev_pseudonym_MAC_key(tools)

, m_pseudonym_key_use_count(0u)

, m_RAND(tools)

, m_AUTN(tools)

, m_max_session_time(0)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (receive_network_id != 0

		&& receive_network_id->get_is_valid_data() == true)

	{

		eap_status_e status = m_receive_network_id.set_copy_of_network_id(

			receive_network_id);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			(void)EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

			return;

		}

	}

	set_is_valid();

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

void eap_am_type_aka_symbian_c::ConstructL()

{

#if defined (USE_EAP_TYPE_SERVER_AKA)

	// For the server.

	m_aka_algorithm = new eap_am_aka_milenage_algorithm_c(m_am_tools, m_is_client);

	if (m_aka_algorithm == 0

		|| m_aka_algorithm->get_is_valid() == false)

	{

		if (m_aka_algorithm != 0)

		{

			m_aka_algorithm->shutdown();

		}

		delete m_aka_algorithm;

		m_aka_algorithm = 0;

		return;

	}

#endif // #if defined (USE_EAP_TYPE_SERVER_AKA)	

	// Open/create database

	EapAkaDbUtils::OpenDatabaseL(m_database, m_session, m_index_type, m_index, m_tunneling_type);	

	// SIM IMSI, RES, CK, IK and AUTS are queried from SIM using AKA interface. 

	// If this is not used then Nokia test algorithms and test values are used.

#if defined (USE_EAP_AKA_INTERFACE)	&& !defined(__WINS__)

	if (m_is_client == true)

	{

		m_aka_if = CEapAkaInterface::NewL(m_am_tools, this);

	} 

	else

	{

		EAP_TRACE_ERROR(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("ERROR: EAP-AKA server does not work at the moment in plugintester.\n")));

		User::Leave(KErrNotSupported);

	}

#endif //#if defined (USE_EAP_AKA_INTERFACE)	&& !defined(__WINS__)

}

//--------------------------------------------------

	abs_eap_am_tools_c * const aTools,

	abs_eap_base_type_c * const aPartner,

	const TIndexType aIndexType,

	const TInt aIndex,

	const eap_type_value_e aTunnelingType,

	const bool aIsClient,

	const eap_am_network_id_c * const receive_network_id)

{

	eap_am_type_aka_symbian_c* self = new(ELeave) eap_am_type_aka_symbian_c(

		aTools, 

		aPartner, 

		aIndexType, 

		aIndex, 

		aTunnelingType,

		aIsClient,

		receive_network_id);

	CleanupStack::PushL(self);

	self->ConstructL();

	if (self->get_is_valid() != true)

	{

		User::Leave(KErrGeneral);

	}

	CleanupStack::Pop();

	return self;

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_am_type_aka_symbian_c::~eap_am_type_aka_symbian_c()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools, 

		TRACE_FLAGS_DEFAULT, 

		(EAPL("eap_am_type_aka_symbian_c::~eap_am_type_aka_symbian_c(): this = 0x%08x\n"),

		this));

	m_database.Close();

	m_session.Close();

#if defined(USE_EAP_AKA_INTERFACE) && !defined(__WINS__)

	if (m_is_client == true)

	{

		delete m_aka_if;

	}

#endif

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e eap_am_type_aka_symbian_c::configure()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	{

		eap_status_e status = type_configure_read(

			cf_str_EAP_AKA_manual_realm.get_field(),

			&m_nai_realm);

		if (status == eap_status_ok

			&& m_nai_realm.get_is_valid_data() == true)

		{

			// OK NAI realm configured.

		}

		else

		{

			// No NAI realm configured.

			// Lets use dummy.

			status = m_nai_realm.set_copy_of_buffer(EAP_AKA_DEFAULT_REAUTHENTICATION_REALM,

				EAP_AKA_DEFAULT_REAUTHENTICATION_REALM_LENGTH);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

		}

	}

	{

		// Read Maximum Session Validity Time from the config file

		eap_variable_data_c sessionTimeFromFile(m_am_tools);

			cf_str_EAP_AKA_max_session_validity_time.get_field(),

			&sessionTimeFromFile);

		if (status == eap_status_ok

			&& sessionTimeFromFile.get_is_valid_data() == true

			&& sessionTimeFromFile.get_data_length() == sizeof(u32_t))

		{

			u32_t *session = reinterpret_cast<u32_t *>(sessionTimeFromFile.get_data());

			if (session != 0)

			{

				// Update the max session time (in micro seconds).

				// configuration file saves the time in seconds. We have to convert it to micro seconds.

				m_max_session_time = static_cast<TInt64>(*session) * static_cast<TInt64>(KMicroSecsInASecond);

			}

		}		

	}

#if defined (USE_EAP_TYPE_SERVER_AKA)

	// We have to set the values for K, OP and AMF in simulator.

	{

			cf_str_EAP_AKA_simulator_aka_k.get_field(),

			&m_simulator_aka_K);

		if (status == eap_status_ok

			&& m_simulator_aka_K.get_is_valid_data() == true

			&& m_simulator_aka_K.get_data_length() > 0ul

			&& m_simulator_aka_K.get_data(

				m_simulator_aka_K.get_data_length()) != 0)

		{

			// OK.

			eap_status_e status = m_aka_algorithm->set_simulator_aka_k(&m_simulator_aka_K);

			if (status != eap_status_ok)

			{

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

		}

		else

		{

			EAP_TRACE_DEBUG(

				m_am_tools,

				TRACE_FLAGS_DEFAULT,

				(EAPL("ERROR: illegal configuration value %s\n"),

				 cf_str_EAP_AKA_simulator_aka_k.get_field()->get_field()));

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_configure_field);

		}

	}

	{

			cf_str_EAP_AKA_simulator_aka_op.get_field(),

			&m_simulator_aka_OP);

		if (status == eap_status_ok

			&& m_simulator_aka_OP.get_is_valid_data() == true

			&& m_simulator_aka_OP.get_data_length() > 0ul

			&& m_simulator_aka_OP.get_data(

				m_simulator_aka_OP.get_data_length()) != 0)

		{

			// OK.

			eap_status_e status = m_aka_algorithm->set_simulator_aka_op(&m_simulator_aka_OP);

			if (status != eap_status_ok)

			{

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

		}

		else

		{

			EAP_TRACE_DEBUG(

				m_am_tools,

				TRACE_FLAGS_DEFAULT,

				(EAPL("ERROR: illegal configuration value %s\n"),

				 cf_str_EAP_AKA_simulator_aka_op.get_field()->get_field()));

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_configure_field);

		}

	}

	{

			cf_str_EAP_AKA_simulator_aka_amf.get_field(),

			&m_simulator_aka_AMF);

		if (status == eap_status_ok

			&& m_simulator_aka_AMF.get_is_valid_data() == true

			&& m_simulator_aka_AMF.get_data_length() == sizeof(u16_t)

			&& m_simulator_aka_AMF.get_data(

				m_simulator_aka_AMF.get_data_length()) != 0)

		{

			// OK.

			eap_status_e status = m_aka_algorithm->set_simulator_aka_amf(&m_simulator_aka_AMF);

			if (status != eap_status_ok)

			{

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

		}

		else

		{

			EAP_TRACE_DEBUG(

				m_am_tools,

				TRACE_FLAGS_DEFAULT,

				(EAPL("ERROR: illegal configuration value %s\n"),

				 cf_str_EAP_AKA_simulator_aka_amf.get_field()->get_field()));

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_configure_field);

		}

	}	

	if (m_pseudonym_key.get_is_valid_data() == false)

	{

		crypto_aes_c aes(m_am_tools);

		if (aes.get_is_valid() == false)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

		}

		// Note this function generates cryptographically strong random bytes.

		// Here we use those bytes as a secret encryption key.

		eap_status_e status = generate_encryption_IV(

			&m_pseudonym_key,

			aes.get_block_size());

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		status = generate_encryption_IV(

			&m_pseudonym_MAC_key,

			aes.get_block_size());

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		++m_pseudonym_key_index;

	}

#endif // #if defined (USE_EAP_TYPE_SERVER_AKA)

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return eap_status_ok;

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e eap_am_type_aka_symbian_c::reset()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return eap_status_ok;

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e eap_am_type_aka_symbian_c::shutdown()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("%s: eap_am_type_aka_symbian_c::shutdown(), m_shutdown_was_called=%d\n"),

		(m_is_client == true) ? "client": "server",

		m_shutdown_was_called));

	if (m_shutdown_was_called == true)

	{

		// Shutdown function was called already.

		return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

	}

	m_shutdown_was_called = true;

	if (m_aka_algorithm != 0)

	{

		m_aka_algorithm->shutdown();

		delete m_aka_algorithm;

		m_aka_algorithm = 0;

	}	

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return eap_status_ok;

}

//--------------------------------------------------

void eap_am_type_aka_symbian_c::send_error_notification(const eap_status_e error)

{

	// Here we swap the addresses.

	eap_am_network_id_c send_network_id(m_am_tools,

		m_receive_network_id.get_destination_id(),

		m_receive_network_id.get_source_id(),

		m_receive_network_id.get_type());

	// Notifies the lower level of an authentication error.

	eap_state_notification_c notification(

		m_am_tools,

		&send_network_id,

		m_is_client,

		eap_state_notification_eap,

		eap_protocol_layer_general,

		eap_type_aka,

		eap_state_none,

		eap_general_state_authentication_error,

		0,

		false);

	notification.set_authentication_error(error);