/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 99 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

#include "eap_am_memory.h"

#include "eap_tools.h"

#include "eap_type_mschapv2.h"

#include "eap_buffer.h"

#include "eap_master_session_key.h"

#include "eap_network_id_selector.h"

#include "eap_tlv_message_data.h"

#include "eap_automatic_variable.h"

#if defined(EAP_MSCHAPV2_SERVER)

eap_status_e eap_type_mschapv2_c::server_packet_process(

	eap_header_wr_c * const received_eap,

	const u32_t eap_packet_length)

{	

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status = eap_status_drop_packet_quietly;

#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	if (m_session.get_state() != eap_type_mschapv2_state_none

		&& m_use_implicit_challenge == false

		&& m_identifier != received_eap->get_identifier())

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	else

	{

		m_identifier = received_eap->get_identifier();

	}

#endif //#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	if (received_eap->get_type() == eap_type_identity)

	{

		status = handle_identity_response_message();

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	if (received_eap->get_code() == eap_code_success

		|| received_eap->get_code() == eap_code_failure)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	else if (received_eap->get_code() == eap_code_response) // Response

	{

		if (eap_packet_length <= eap_header_base_c::get_header_length())

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

		}

		// MsChapV2

		if (received_eap->get_type() == eap_type_mschapv2)

		{

			status = server_mschapv2_packet_process(

				received_eap,

				eap_packet_length);

		}

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, status);

}

#endif //#if defined(EAP_MSCHAPV2_SERVER)

#if defined(EAP_MSCHAPV2_SERVER)

eap_status_e eap_type_mschapv2_c::server_mschapv2_packet_process(

	eap_header_wr_c * const received_eap,

	const u32_t eap_packet_length)

{	

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status = eap_status_drop_packet_quietly;

	u32_t type_data_length = received_eap->get_type_data_length();

	mschapv2_header_c mschapv2_header(

		m_am_tools,

		received_eap->get_type_data_offset(0, type_data_length),

		type_data_length);

	if (mschapv2_header.check_header() != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	if (eap_packet_length <= eap_header_base_c::get_header_length())

	{

		EAP_TRACE_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("EAP_type_MSCHAPV2: illegal mschapv2 packet length\n")));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	if ((mschapv2_header.get_opcode() == mschapv2_opcode_response

		|| mschapv2_header.get_opcode() == mschapv2_opcode_change_password)

		&& type_data_length != mschapv2_header.get_ms_length())

	{

		EAP_TRACE_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT, (EAPL("EAP_type_MSCHAPV2: illegal mschapv2 packet length\n")));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	switch (mschapv2_header.get_opcode())

	{

	case mschapv2_opcode_response:

		status = server_handle_challenge_response(mschapv2_header);

		break;

	case mschapv2_opcode_success:

		status = server_handle_success_response();

		break;

	case mschapv2_opcode_failure:

		status = server_handle_failure_response();

		break;

	case mschapv2_opcode_change_password:

		status = server_handle_password_change(mschapv2_header);

		break;

	default:

		break;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, status);

}

#endif //#if defined(EAP_MSCHAPV2_SERVER)

#if defined(EAP_MSCHAPV2_SERVER)

bool eap_type_mschapv2_c::check_expired_password()

{

	if (m_do_password_expiration_tests == true)

	{

		if (m_password_expired == false)

		{

			m_password_expired = true;

		}

		else

		{

			m_password_expired = false;

		}

		return m_password_expired;

	}

	return false;

}

#endif //#if defined(EAP_MSCHAPV2_SERVER)

#if defined(EAP_MSCHAPV2_SERVER)

static const u8_t eap_mschapv2_challenge_response_message[] = "Message1";

static const u8_t eap_mschapv2_failure_message[] = "Message3";

eap_status_e eap_type_mschapv2_c::server_handle_challenge_response(mschapv2_header_c &machapv2_packet)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status = eap_status_header_corrupted;

	mschapv2_response_c response(

		m_am_tools,

		machapv2_packet.get_data(),

		machapv2_packet.get_data_length());

	if (response.get_is_valid() == false)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

	}

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): response packet:"),

		response.get_header_buffer(response.get_header_buffer_length()),

		response.get_header_buffer_length()));

	if (response.check_header() != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	if (!m_session.is_valid_state(eap_type_mschapv2_state_challenge_response))

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	// Check username

	m_am_tools->memmove(

		m_peer_challenge,

		response.get_peer_challenge(),

		EAP_MSCHAPV2_PEER_CHALLENGE_SIZE);

#if defined(USE_FAST_EAP_TYPE)

	if (m_use_EAP_FAST_challenge == true)

	{

		// Note the received authenticator challenge is zero bytes in EAP-FAST.

		if (m_client_EAP_FAST_challenge.get_is_valid_data() == false

			|| m_client_EAP_FAST_challenge.get_data_length() != EAP_MSCHAPV2_PEER_CHALLENGE_SIZE)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_authentication_failure);

		}

		m_am_tools->memmove(

			m_peer_challenge,

			m_client_EAP_FAST_challenge.get_data(),

			EAP_MSCHAPV2_PEER_CHALLENGE_SIZE);

		EAP_TRACE_DATA_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("client_handle_challenge_request(): EAP-FAST m_peer_challenge"),

			 m_peer_challenge,

			 EAP_MSCHAPV2_PEER_CHALLENGE_SIZE));

	}

#endif //#if defined(USE_FAST_EAP_TYPE)

	crypto_nt_hash_c nt_hash(m_am_tools);

	if (nt_hash.get_is_valid() == false)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

	}

	status = nt_hash.nt_password_hash(

		&m_password_utf8,

		&m_password_hash,

		EAP_MSCHAPV2_MD4_DIGEST_SIZE);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	status = nt_hash.hash_nt_password_hash(

		&m_password_hash,

		&m_password_hash_hash,

		EAP_MSCHAPV2_MD4_DIGEST_SIZE);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_password_utf8"),

		m_password_utf8.get_data(),

		m_password_utf8.get_data_length()));

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_authenticator_challenge"),

		m_authenticator_challenge,

		EAP_MSCHAPV2_AUTHENTICATOR_CHALLENGE_SIZE));

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_peer_challenge"),

		m_peer_challenge,

		EAP_MSCHAPV2_PEER_CHALLENGE_SIZE));

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_password_hash"),

		m_password_hash.get_data(),

		m_password_hash.get_data_length()));

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_username_utf8"),

		m_username_utf8.get_data(),

		m_username_utf8.get_data_length()));

	status = generate_nt_response(

		m_authenticator_challenge,

		m_peer_challenge,

		m_username_utf8.get_data(),

		m_username_utf8.get_data_length(),

		&m_password_hash,

		m_nt_response);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	EAP_TRACE_DATA_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_nt_response:"),

		m_nt_response,

		EAP_MSCHAPV2_NT_RESPONSE_SIZE));

	// Check peer_response == nt_response

	if (m_am_tools->memcmp(

		m_nt_response,

		response.get_nt_response(),

		EAP_MSCHAPV2_NT_RESPONSE_SIZE)

		== 0)

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): correct password\n")));

		// Is password expired?

		if (check_expired_password() == true)

		{

			m_error_code = EAP_MSCHAPV2_ERROR_PASSWD_EXPIRED;

			bool retry_allowed = true; // ?

			u32_t message_length = sizeof(eap_mschapv2_challenge_response_message) - 1;

			status = send_failure_request(

				retry_allowed,

				eap_mschapv2_challenge_response_message,

				message_length);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

			m_session.set_state(eap_type_mschapv2_state_challenge_response, eap_type_mschapv2_state_change_password_response);

			  // Any other restrictions?

			status = eap_status_ok;

		}

		else

		{

			u32_t message_length = sizeof(eap_mschapv2_challenge_response_message) - 1;

			status = send_success_request(

				eap_mschapv2_challenge_response_message,

				message_length);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

			m_session.set_state(eap_type_mschapv2_state_challenge_response, eap_type_mschapv2_state_success_response);

			status = eap_status_ok;

		}

	}

	else // Incorrect password

	{

		EAP_TRACE_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("ERROR: EAP_type_MSCHAPV2: server_handle_challenge_response(): incorrect password\n")));

		EAP_TRACE_DATA_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): m_nt_response:"),

			m_nt_response,

			EAP_MSCHAPV2_NT_RESPONSE_SIZE));

		EAP_TRACE_DATA_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("EAP_type_MSCHAPV2: server_handle_challenge_response(): response.get_nt_response():"),

			response.get_nt_response(),

			EAP_MSCHAPV2_NT_RESPONSE_SIZE));

		m_error_code = EAP_MSCHAPV2_ERROR_AUTHENTICATION_FAILURE;

		bool retry_allowed = true; // TEST

		u32_t message_length = sizeof(eap_mschapv2_failure_message) - 1;

		status = send_failure_request(

			retry_allowed,

			eap_mschapv2_failure_message,

			message_length);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

#if defined(USE_FAST_EAP_TYPE)

		if (m_use_EAP_FAST_challenge == true)

		{

			(void) send_error_notification(eap_status_tunnel_compromise_error);

		}

#endif //#if defined(USE_FAST_EAP_TYPE)

		m_session.set_state(eap_type_mschapv2_state_challenge_response, eap_type_mschapv2_state_challenge_response);

		status = eap_status_ok;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, status);

}

#endif //#if defined(EAP_MSCHAPV2_SERVER)

#if defined(EAP_MSCHAPV2_SERVER)

eap_status_e eap_type_mschapv2_c::server_handle_success_response()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	eap_status_e status = eap_status_drop_packet_quietly;

	if (m_session.is_valid_state(eap_type_mschapv2_state_success_response))

	{

		eap_master_session_key_c key(

			m_am_tools,

			eap_type_mschapv2);

		status = generate_session_key(&key);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		status = get_type_partner()->packet_data_crypto_keys(&m_send_network_id, &key);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		status = finish_successful_authentication();

		m_session.set_state(eap_type_mschapv2_state_success_response);

		status = eap_status_ok;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, status);

}

#endif //#if defined(EAP_MSCHAPV2_SERVER)

#if defined(EAP_MSCHAPV2_SERVER)

eap_status_e eap_type_mschapv2_c::server_handle_failure_response()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (m_session.is_valid_state(eap_type_mschapv2_state_failure_response))

	{

		finish_unsuccessful_authentication(false);

		m_session.set_state(eap_type_mschapv2_state_failure_response);

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

}

#endif //#if defined(EAP_MSCHAPV2_SERVER)

#if defined(EAP_MSCHAPV2_SERVER)

static const u8_t eap_mschapv2_password_change_message[] = "Message4";

eap_status_e eap_type_mschapv2_c::server_handle_password_change(mschapv2_header_c &machapv2_packet)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (!m_session.is_valid_state(eap_type_mschapv2_state_change_password_response))

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, eap_status_drop_packet_quietly);

	}

	if (machapv2_packet.get_data_length() < mschapv2_change_password_c::get_header_minimum_size())