/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

* %version: %

*/

/**

 *  @mainpage EAP Core documentation.

 *  

 *  @section intro Introduction

 *  This is a EAP Core documentation generated by doxygen.

 *  First read <a href="../S60_3_1_EAP_Core.doc">S60_3_1_EAP_Core.doc</a>

 *  file from <a href="..">EAPOL/documentation</a> directory.

 *  Release notes are in file <a href="../../../../../wlan_linux/wlaneapol_linux/release_notes.txt">release_notes.txt</a>

 *  

 *  @section install Installation

 *  Installation instructions are in file <a href="../../../../../wlan_linux/wlaneapol_linux/readme.txt">EAPOL/readme.txt</a>.

 *  

 *  @section classes Most crucial classes

 *  The most crucial classes are eap_core_c, abs_eap_core_c,

 *  eap_base_type_c and abs_eap_base_type_c.

 *

 *  Header files are stored to a directory <a href="../../../include">EAPOL/include</a>.

 *  Implementation of eap_core_c class is in a file <a href="../../../core/eap_core.cpp">

 *  EAPOL/core/eap_core.cpp</a>. Implementation of eap_base_type_c class is in a file

 *  <a href="../../../common/eap_base_type.cpp">EAPOL/common/eap_base_type.cpp</a>.

 *  

 *  @section eap_types Implemented EAP-types

 *  

 *  @subsection GSMSIM EAP/SIM

 *  EAP/SIM implementation is in a directory

 *  <a href="../../../type/gsmsim">EAPOL/type/gsmsim</a>.

 *  EAP/SIM is specified in draft-haverinen-pppext-eap-sim-xx.txt.

 *  The most current is

 *  <a href="../../type/gsmsim/doc/rfc4186.txt">

 *  RFC 4186</a>.

 *  IETF drafts and RFC are stored to a directory <a href="../../type/gsmsim/doc">

 *  EAPOL/type/gsmsim/documentation</a>.

 *  The document

 *  <a href="../../type/gsmsim/doc/GSMSIM.doc">GSMSIM.doc</a>

 *  includes implementation notes of GSMSIM.

 *  

 *  @subsection EAP_AKA EAP/AKA

 *  EAP/AKA implementation is in a directory

 *  <a href="../../../type/aka">EAPOL/type/aka</a>.

 *  EAP/AKA is specified in draft-arkko-pppext-eap-aka-xx.txt.

 *  The most current is

 *  <a href="../../type/aka/doc/rfc4187.txt">

 *  RFC 4187</a>.

 *  IETF drafts are stored to a directory <a href="../../type/aka/doc">

 *  EAPOL/type/aka/documentation</a>.

 *  

 *  @subsection EAP_TLS_PEAP EAP/TLS, PEAP and TTLS

 *  Implementation design and architecture of EAP/TLS, PEAP and TTLS is in

 *  <a href="../../type/tls_peap/doc/EAP_TLS_PEAP.doc">EAP_TLS_PEAP.doc</a>

 *  file in <a href="../../type/tls_peap/doc">EAPOL/type/tls_peap/documentation</a> directory.

 *  EAP/TLS and PEAP implementation will be in a directory

 *  <a href="../../../type/tls_peap">EAPOL/type/tls_peap</a>.

 *  TLS is specified in <a href="../../type/tls_peap/doc/rfc2246.txt">rfc2246.txt</a>.

 *  EAP/TLS is specified in <a href="../../type/tls_peap/doc/rfc2716.txt">rfc2716.txt</a>.

 *  PEAPv2 is specified in <a href="../../type/tls_peap/doc/draft-josefsson-pppext-eap-tls-eap-08.txt">draft-josefsson-pppext-eap-tls-eap-08.txt</a>.

 *  PEAPv1 is specified in <a href="../../type/tls_peap/doc/draft-josefsson-pppext-eap-tls-eap-05.txt">draft-josefsson-pppext-eap-tls-eap-05.txt</a>.

 *  Windows XP- PEAPv0 is specified in <a href="../../type/tls_peap/doc/draft-kamath-pppext-peapv0-00.txt">draft-kamath-pppext-peapv0-00.txt</a>.

 *  TTLS is specified in <a href="../../type/tls_peap/doc/draft-ietf-pppext-eap-ttls-04.txt">draft-ietf-pppext-eap-ttls-04.txt</a>.

 *  

 *  @subsection EAP_MsChapv2 EAP/MsChapv2

 *  EAP/MsChapv2 implementation is in a directory

 *  <a href="../../../type/mschapv2">EAPOL/type/mschapv2</a>.

 *  EAP/MsChapv2 is specified in draft-kamath-pppext-eap-mschapv2-XX.txt, rfc2433.txt and rfc2759.txt.

 *  The most current is

 *  <a href="../../type/mschapv2/doc/draft-kamath-pppext-eap-mschapv2-01.txt">

 *  EAP/MsChapv2 draft version 2</a>.

 *  See also <a href="../../type/mschapv2/doc/rfc2433.txt">rfc2433.txt</a>

 *  and <a href="../../type/mschapv2/doc/rfc2759.txt">rfc2759.txt</a>.

 *  IETF drafts are stored to a directory <a href="../../type/mschapv2/doc">

 *  EAPOL/type/mschapv2/doc</a>.

 *  

 *  @subsection EAP_SecurID_GTC EAP/SecurID and GTC

 *  EAP/SecurID implementation is in a directory

 *  <a href="../../../type/securid">EAPOL/type/securid</a>.

 *  EAP/SecurID is specified in draft-josefsson-eap-securid-XX.txt.

 *  The most current is

 *  <a href="../../type/securid/doc/draft-josefsson-eap-securid-01.txt">

 *  EAP/SecurID draft version 1</a>.

 *  IETF drafts are stored to a directory <a href="../../type/securid/doc">

 *  EAPOL/type/securid/documentation</a>.

 *  

 *  @subsection EAP_LEAP EAP/LEAP

 *  EAP/LEAP implementation is in a directory

 *  <a href="../../../type/leap">EAPOL/type/leap</a>.

 *  EAP/LEAP documentation is not included here.

 *  

 *  @subsection SAE Experimental Security Association for EAPOL (not used)

 *  SAE implementation is in a directory <a href="../../../../../wlan_testing/wlaneapol_testing/SAE">EAPOL/SAE</a>.

 *  Document defining SAE is <a href="../../../../../wlan_testing/wlaneapol_testing/SAE/documentation/EAPOL_SA.doc">EAPOL_SA.doc</a>.

 *  This is a very experimental test implementation.

 *  Idea is to use Diffie-Hellman to create keys for a anonymous EAPOL tunnel.

 *  Any EAP-type could then run inside the tunnel.

 *  This fixes the problem of current EAPOL over WLAN.

 *  EAP was designed for poin to point environment and EAPOL to non-shared environment.

 *  

 *  NOTE SAE is not used anywhere.

 *

 *  @section Symbian Symbian Plug-in

 *  EAP Type Plug-in Architecture for Symbian is specified in

 *  <a href="../../am/type/symbian/plugin/doc/eap_plugin_architecture.doc">

 *  eap_plugin_architecture.doc</a>.

 *  

 */

#if !defined(_EAP_CORE_H_)

#define _EAP_CORE_H_

#include "eap_am_export.h"

#include "abs_eap_base_type.h"

#include "eap_core_map.h"

#include "eap_am_network_id.h"

#include "abs_eap_stack_interface.h"

#include "eap_configuration_field.h"

#include "abs_eap_core_map.h"

class abs_eap_core_c;

class abs_eap_am_tools_c;

class eap_core_retransmission_c;

class eap_base_type_c;

class eap_variable_data_c;

//--------------------------------------------------------------------------------------------------

/**

 *  @defgroup EAP_Core_config_options Configuration options of EAP Core.

 *  The following configuration options are read through abs_eap_base_type_c::read_configure() function.

 *  @{

 */

/**

 *  This is u32_t configuration option.

 *  This is the maximum count EAP CORE Authenticator resents message again.

 *  This is used in simulator testing.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_retransmission_counter,

	"EAP_CORE_retransmission_counter",

	eap_configure_type_u32_t,

	false);

/**

 *  This is u32_t configuration option.

 *  This is the time after EAP CORE Authenticator resents message again.

 *  This is used in simulator testing.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_retransmission_time,

	"EAP_CORE_retransmission_time",

	eap_configure_type_u32_t,

	false);

/**

 *  This is u32_t configuration option.

 *  This is the maximum time EAP authentication could succeed.

 *  This timeout is same for every EAP-type.

 *  You must define EAP-type spesific configuration

 *  if you need different timeout for your EAP-type.

 *  Authentication is terminated after this time elapses.

 *  Time is in milli secons.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_session_timeout,

	"EAP_CORE_session_timeout",

	eap_configure_type_u32_t,

	false);

/**

 *  This is optional and only valid for server.

 *  This allows different values for client and server.

 *  This is u32_t configuration option.

 *  This is the maximum time EAP authentication could succeed.

 *  This timeout is same for every EAP-type.

 *  You must define EAP-type spesific configuration

 *  if you need different timeout for your EAP-type.

 *  Authentication is terminated after this time elapses.

 *  Time is in milli secons.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_server_session_timeout,

	"EAP_CORE_server_session_timeout",

	eap_configure_type_u32_t,

	false);

/**

 * This is optional and only valid for server.

 * This is boolean configuration option.

 * This flag selects whether EAP-Success is send after state notification is forwarded to lower layer (true)

 * or EAP-Success is send before state notification is forwarded to lower layer (false).

 * Default value is false.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_send_eap_success_after_notification,

	"EAP_CORE_send_eap_success_after_notification",

	eap_configure_type_boolean,

	false);

/**

 *  This is u32_t configuration option.

 *  This is the time after EAP-Failure is handled.

 *  Zero means EAP-Failure is handled immediately.

 *  Time is in milli secons.

 *  The default value is EAP_CORE_FAILURE_RECEIVED_TIMEOUT.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_failure_received_timeout,

	"EAP_CORE_failure_received_timeout",

	eap_configure_type_u32_t,

	false);

#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

/**

 * This is u32_t configuration option.

 * This is the maximum time client wait EAP-Request/Identity and EAP-Request/type packets.

 * See EAP_CORE_WAIT_EAP_REQUEST_TYPE_ID.

 * Time is in milli seconds. 

 * The default value is EAP_CORE_WAIT_EAP_REQUEST_TYPE_TIMEOUT.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_wait_eap_request_type_timeout,

	"EAP_CORE_wait_eap_request_type_timeout",

	eap_configure_type_u32_t,

	false);

/**

 * This is optional and only valid for server.

 * This is boolean configuration option.

 * This flag selects whether EAP-Request/Identity is send (true) or not (false).

 * Default value is false.

 */

EAP_CONFIGURATION_FIELD(

	cf_str_EAP_CORE_skip_eap_request_identity,

	"EAP_CORE_skip_eap_request_identity",

	eap_configure_type_boolean,

	false);

#endif //#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

/** @} */ // End of group EAP_Core_config_options.

//--------------------------------------------------------------------------------------------------

/**

 * This is the timer ID used with abs_eap_am_tools_c::set_timer() and abs_eap_am_tools_c::cancel_timer().

 */

enum eap_core_timer_id

{

	EAP_CORE_TIMER_RETRANSMISSION_ID,            ///< This is time after a EAP-Request message is resent again. This is for testing purposes. See USE_EAP_CORE_RETRANSMISSION compilation flag.

#if defined(USE_EAP_CORE_SERVER)

	EAP_CORE_DELAYED_EAP_NAK_PROCESS_ID, ///< See EAP_CORE_DELAYED_EAP_NAK_PROCESS_TIMEOUT.

#endif //#if defined(USE_EAP_CORE_SERVER)

	EAP_CORE_SESSION_TIMEOUT_ID, ///< See EAP_CORE_TIMER_HANDLER_TIMEOUT_TIMEOUT.

	EAP_CORE_FAILURE_RECEIVED_ID, ///< See EAP_CORE_FAILURE_RECEIVED_TIMEOUT.

	EAP_CORE_REMOVE_SESSION_TIMEOUT_ID,  ///< See EAP_CORE_REMOVE_SESSION_TIMEOUT.

#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

	EAP_CORE_WAIT_EAP_REQUEST_TYPE_ID,   ///< See EAP_CORE_WAIT_EAP_REQUEST_TYPE_TIMEOUT.

#endif //#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

};

/**

 * This is time after a EAP-Failure message is handled.

 */

const u32_t EAP_CORE_FAILURE_RECEIVED_TIMEOUT = 2000ul;

#if defined(USE_EAP_CORE_SERVER)

/**

 * This is time after a EAP-Response/Nak message is processes.

 * We could wait if more suitable message is received.

 */

const u32_t EAP_CORE_DELAYED_EAP_NAK_PROCESS_TIMEOUT = 2000u;

#endif //#if defined(USE_EAP_CORE_SERVER)

/**

 * This is the size of the local send buffer. Please use atleast minimum ethernet packet length 60 bytes.

 */

const u32_t EAP_CORE_PACKET_BUFFER_LENGTH = 512u;

/**

 * Re-transmission is used to test protocols.

 * This is the maximum count EAP message is resent again.

 * This is used in simulator testing.

 * This is configurable parameter. See eap.conf EAP_CORE_retransmission_counter.

 */

const u32_t EAP_CORE_RETRANSMISSION_COUNTER = 5;

/**

 * Re-transmission is used to test protocols.

 * This is the time after EAP message is resent again.

 * This is used in simulator testing.

 * This is configurable parameter. See eap.conf EAP_CORE_retransmission_time.

 */

const u32_t EAP_CORE_RETRANSMISSION_TIME = 1000u; /* milli seconds */

/**

 * This is the maximum time EAP authentication could succeed.

 * Authentication is terminated after this time elapses.

 * This is configurable parameter. See eap.conf EAP_CORE_session_timeout.

 * See EAP_CORE_SESSION_TIMEOUT_ID.

 * Time is in milli seconds. 

 */

const u32_t EAP_CORE_SESSION_TIMEOUT = 120000u; /* milli seconds */

/**

 * This is the delay time after EAP-session is removed after authentication finished.

 * This is configurable parameter.

 * See EAP_CORE_REMOVE_SESSION_TIMEOUT_ID.

 * Time is in milli seconds. 

 */

const u32_t EAP_CORE_REMOVE_SESSION_TIMEOUT = 10000ul; /* milli seconds */

#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

/**

 * This is the maximum time client wait EAP-Request/Identity and EAP-Request/type packets.

 * See EAP_CORE_WAIT_EAP_REQUEST_TYPE_ID.

 * Time is in milli seconds. 

 */

const u32_t EAP_CORE_WAIT_EAP_REQUEST_TYPE_TIMEOUT = 5000ul; /* milli seconds */

#endif //#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

#if defined(USE_EAP_CORE_SERVER)

/**

 * This is default policy of EAP-Nak message.

 * False value means EAP-Nak is prosessed after a timeout.

 * True value means EAP-NAk is prosessed immediately.

 */

const bool EAP_CORE_PROCESS_EAP_NAK_IMMEDIATELY = true;

#endif //#if defined(USE_EAP_CORE_SERVER)

/// A eap_core_c class implements the basic functionality of EAP-type.

: public abs_eap_core_map_c

, public abs_eap_base_type_c

, public abs_eap_base_timer_c

, public abs_eap_stack_interface_c

{

private:

	//--------------------------------------------------

	/// This is back pointer to object which created this object.

	/// Packets are sent to the partner.

	abs_eap_core_c *m_partner;

	/// This is pointer to the tools class.

	abs_eap_am_tools_c * const m_am_tools;

	/// This stores eap_base_type objects using eap_variable_data selector.

	eap_core_map_c<eap_base_type_c, abs_eap_core_map_c, eap_variable_data_c> m_type_map;

	/// This stores the current EAP-type. When requested, we send our ID using 

	/// our default EAP-type. This is our best quess of other peer's EAP-type.

	/// Other peer will sent the real EAP-type later and we can NAK it then

	/// and send our own EAP-type. This is due the limitations of EAP-protocol.

	eap_type_value_e m_current_eap_type;

	/// This is our default EAP-type.

	eap_type_value_e m_default_eap_type;

	/// This is the queried EAP-identity.

	/// This is saved because other EAP-types may be load afterwards

	/// and they may query EAP-identity.

	eap_variable_data_c m_eap_identity;

	/// This is offset in bytes of the EAP-type header.

	u32_t m_eap_header_offset;

	/// This is maximum transfer unit in bytes.

	u32_t m_MTU;

	/// This is length of the trailer in bytes.

	u32_t m_trailer_length;

	/// This is network identity of the received packet.

	eap_am_network_id_c m_receive_network_id;

	/// Re-transmission is used to test protocols.

	/// This stores the information to resent a message. This is used for testing purposes.

	eap_core_retransmission_c *m_retransmission;

	/// Re-transmission is used to test protocols.

	/// This is the time after resent a message. This is used for testing purposes.

	u32_t m_retransmission_time;

	/// Re-transmission is used to test protocols.

	/// This is the maximum count of retransmission of one message. This is used for testing purposes.

	u32_t m_retransmission_counter;

	/// This is the maximum time authentication could succeed.

	/// Authentication is terminated after this time elapses.

	/// The EAP-type could change the timeout by calling set_session_timeout() function.

	u32_t m_session_timeout;

	u32_t m_eap_core_failure_received_timeout;

	u32_t m_remove_session_timeout;

#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

	u32_t m_wait_eap_request_type_timeout;

	bool m_wait_eap_request_type_timeout_set;

#endif //#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

	/// Latest received EAP-identifier. Used only for EAP-Request/Identity handling in client.

	/// Ensures that the EAP-Response/Identity is sent with the latest EAP-identifier.

	u8_t m_eap_identity_request_identifier_client;

	/// This indicates whether this object is client (true) or server (false).

	/// In terms of EAP-protocol whether this network entity is EAP-supplicant (true) or EAP-authenticator (false).

	bool m_is_client;

	/// This indicates whether the authentication role of this object is client (true) or server (false).

	/// In terms of EAP-protocol whether this network entitys authentication role is EAP-supplicant (true) or EAP-authenticator (false).

	/// NOTE the LEAP type changes authentication role during the authentication session.

	bool m_is_client_role;

	/// This indicates whether this object was generated successfully.

	bool m_is_valid;

	/// Client has initiated restart.

	bool m_client_restart_authentication_initiated;

	/// This flag indicates that this object is marked to removed asynchronously.

	/// The very same object could be taken use before the removing timer elapses.

	bool m_marked_removed;

	/// This flag prevents server receiving of multiple EAP-Response/Identity message.

	/// This is set true after the server accepts EAP-Response/Identity message.

	bool m_eap_identity_response_accepted;

	/// Function shutdown() is called already.

	bool m_shutdown_was_called;

	/// Server received EAP-Response from client. Server must not sent any other EAP-type. Server could send EAP-Failure or EAP-Success.

	/// Client sent a response. Client must not accept any other EAP-type.

	bool m_eap_type_response_sent;

	/// Tells whether this is tunneled EAP-session. For example inside PEAP or TTLS tunnel.

	/// This causes some changes to timeouts.

	bool m_is_tunneled_eap;

#if defined(USE_EAP_CORE_SERVER)

	/// If this flag is true EAP-Response/Nak is processed immediately.

	/// If this flag is false EAP-Response/Nak is processed after a timeout.

	/// There might be received more suitable EAP-Response.

	bool m_process_eap_nak_immediately;

	/// EAP-Response/Nak is initiated.

	bool m_nak_process_timer_active;

	/// This flag prevents server sending of multiple EAP-Request/Identity message.

	bool m_eap_identity_request_send;

	/// This is set true after the server receives EAP-Response/Identity message.

	bool m_eap_identity_response_received;

	/// This flag is set true after a EAP-Failure is sent.

	bool m_eap_failure_sent;

	/// This flag selects whether EAP-Success is send after state notification is forwarded to lower layer (true)

	/// or EAP-Success is send before state notification is forwarded to lower layer (false).

	bool m_send_eap_success_after_notification;

#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

	// This flag selects whether EAP-Request/Identity is send (true) or not (false).

	bool m_skip_eap_request_identity;

#endif //#if defined(USE_EAP_CORE_WAIT_REQUEST_TYPE_TIMER)

#endif //#if defined(USE_EAP_CORE_SERVER)

	bool m_use_eap_expanded_type;

	/// Some of the protocols terminates with EAP-Failure. This flag tells to ignore EAP-Failure.

	bool m_ignore_eap_failure;

	bool m_ignore_notifications;

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	/**