/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

/*

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 124 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

#include "eap_am_memory.h"

#include "eap_tools.h"

#include "eap_am_tools.h"

#include "eap_core.h"

#include "eap_type_tls_peap_types.h"

#include "tls_record_header.h"

#include "abs_tls_base_application.h"

#include "tls_application_eap_core.h"

#include "tls_peap_types.h"

#include "tls_peap_tlv_header.h"

#include "eap_diameter_avp_header.h"

#include "eap_state_notification.h"

#include "eap_crypto_api.h"

#include "eap_header_string.h"

#include "abs_eap_am_mutex.h"

#include "eap_config.h"

#include "eapol_header.h"

#include "eap_network_id_selector.h"

#include "eap_tlv_message_data.h"

#include "eap_array_algorithms.h"

#include "eap_automatic_variable.h"

#include "eap_base_type.h"

#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	#include "eap_type_mschapv2_types.h"

	#include "eap_type_mschapv2_header.h"

#endif //#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

const u32_t TLV_NONCE_LENGTH = 32ul;

const u32_t TLV_MAC_LENGTH = 16ul;

const u32_t TLV_NONCE_OFFSET = 4ul;

const u32_t TLV_MAC_OFFSET = TLV_NONCE_OFFSET + TLV_NONCE_LENGTH;

const u32_t TLS_PEAP_V2_TK_OFFSET = 32ul;

const u32_t TLS_PEAP_V2_TK_LENGTH = 32ul;

const u32_t TLS_PEAP_V2_COMPOUND_MAC_KEY_LENGTH = 20ul;

const u32_t TLS_PEAP_V2_COMPOUND_SESSION_KEY_LENGTH = 128ul;

//-----------------------------------------------------------------------------------------

/// This is pseudo Ethernet and EAPOL header.

/// This is used in trace of tunneled EAP-packet.

const u8_t EAP_PSEUDO_ETHERNET_HEADER[] =

{

	0x50, 0x73, 0x65, 0x75, 0x64, 0x6f, 0x68, 0x65,

	0x61, 0x64, 0x65, 0x72, 0x88, 0x8e, 0x01, 0x00,

	0x00, 0x00

};

const u32_t EAP_PSEUDO_EAPOL_HEADER_OFFSET = 14ul;

//--------------------------------------------------

EAP_FUNC_EXPORT tls_application_eap_core_c::~tls_application_eap_core_c()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("%s: function: tls_application_eap_core_c::~tls_application_eap_core_c(): ")

		 EAPL("this = 0x%08x, m_eap_core")

		 EAPL(" = 0x%08x (validity %d).\n"),

		 (m_is_client == true ? "client": "server"),

		 this,

		 m_eap_core,

		 ((m_eap_core != 0) ? m_eap_core->get_is_valid(): true)));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_application_eap_core_c::~tls_application_eap_core_c()");

	EAP_ASSERT(m_shutdown_was_called == true);

	if (m_free_eap_core == true)

	{

		delete m_eap_core;

	}

	m_eap_core = 0;

	m_application_partner = 0;

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT tls_application_eap_core_c::tls_application_eap_core_c(

	abs_eap_am_tools_c * const tools,

	eap_core_c * const eap_core,

	const bool free_eap_core,

	const bool is_client_when_true,

	const eap_type_value_e eap_type,

	const eap_am_network_id_c * const receive_network_id)

	: m_am_tools(tools)

	, m_eap_core(eap_core)

	, m_free_eap_core(free_eap_core)

	, m_application_partner(0)

	, m_receive_network_id(tools)

	, m_eap_type(eap_type)

	, m_peap_version(peap_version_none)

	, m_peap_tunneled_eap_type(eap_type_none)

	, m_tunneled_eap_type_authentication_state(eap_state_none)

	, m_peapv2_tlv_payloads(tools)

	, m_peap_v2_client_nonce(tools)

	, m_peap_v2_server_nonce(tools)

	, m_peap_v2_IPMKn(tools)

	, m_peap_v2_ISKn(tools)

	, m_peap_v2_CMK_B1_server(tools)

	, m_peap_v2_CMK_B2_client(tools)

	, m_peap_v2_CSK(tools, eap_type)

	, m_accepted_tunneled_eap_types(tools)

	, m_pseudo_ethernet_header(tools)

	, m_ttls_received_payloads(tools)

	, m_ttls_message_type(eap_ttls_tunneled_message_type_none)

	, m_ttls_sent_eap_packet(tools)

#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	, m_ttls_user_name(tools)

	, m_ttls_implicit_challenge(tools)

	, m_ttls_tunneled_message_state(eap_ttls_tunneled_message_state_none)

#endif //#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	, m_error_probability(0UL)

	, m_received_eap_identifier(0u)

	, m_enable_random_errors(false)

	, m_manipulate_only_tunneled_messages(false)

	, m_is_valid(false)

	, m_is_client(is_client_when_true)

	, m_shutdown_was_called(false)

	, m_tls_session_type(tls_session_type_none)

	, m_peap_allow_tunneled_session_resumption(true)

	, m_use_tppd_tls_peap(true)

	, m_use_tppd_peapv1_acknowledge_hack(false)

#if defined(USE_EAP_PEAPV1_EXTENSIONS)

	, m_server_use_peapv1_extensions_request(false)

	, m_client_send_peapv1_extensions_response(false)

#endif //#if defined(USE_EAP_PEAPV1_EXTENSIONS)

#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	, m_tunneled_eap_in_ttls(true)

	, m_ttls_plain_ms_chap_v2_eap_identifier(0ul)

#endif //#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	, m_use_eap_expanded_type(false)

	, m_wait_plain_eap_success(true)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("PEAP: %s: function: tls_application_eap_core_c::tls_application_eap_core_c(): ")

		 EAPL("this = 0x%08x\n"),

		 (m_is_client == true ? "client": "server"),

		 this));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_application_eap_core_c::tls_application_eap_core_c()");

	if (m_eap_core == 0

		|| m_eap_core->get_is_valid() == false)

	{

		EAP_TRACE_ERROR(

			m_am_tools,

			TRACE_FLAGS_TLS_PEAP_ERROR,

			(EAPL("ERROR: %s: function: tls_application_eap_core_c() failed, ")

			 EAPL("m_eap_core is invalid.\n"),

						 (m_is_client == true ? "client": "server")));

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	m_eap_core->set_partner(this);

	eap_status_e status = m_receive_network_id.set_copy_of_network_id(receive_network_id);

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	status = m_pseudo_ethernet_header.set_copy_of_buffer(

		EAP_PSEUDO_ETHERNET_HEADER,

		sizeof(EAP_PSEUDO_ETHERNET_HEADER));

	if (status != eap_status_ok)

	{

		// Do not care of this error.

		// User will check the validity of m_pseudo_ethernet_header.

	}

	set_is_valid();

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_application_eap_core_c::set_is_valid()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	m_is_valid = true;

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT void tls_application_eap_core_c::set_peap_version(

	const peap_version_e peap_version,

	const bool use_tppd_tls_peap,

	const bool use_tppd_peapv1_acknowledge_hack)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("TLS: %s: message_function: tls_application_eap_core_c::set_peap_version()\n"),

		(m_is_client == true ? "client": "server")));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_application_eap_core_c::set_peap_version()");

	m_peap_version = peap_version;

	m_use_tppd_tls_peap = use_tppd_tls_peap;

	m_use_tppd_peapv1_acknowledge_hack = use_tppd_peapv1_acknowledge_hack;

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e tls_application_eap_core_c::configure()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools,

		TRACE_FLAGS_DEFAULT,

		(EAPL("PEAP: %s: function: tls_application_eap_core_c::configure(): ")

		 EAPL("this = 0x%08x\n"),

		 (m_is_client == true ? "client": "server"),

		 this));

	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_application_eap_core_c::configure()");

	eap_status_e status = eap_status_process_general_error;

	//----------------------------------------------------------

	{

		eap_variable_data_c tunneled_eap_type(m_am_tools);

		if (m_is_client == true)

		{

			status = get_application_partner()->read_configure(

				cf_str_PEAP_tunneled_eap_type_hex_data.get_field(),

				&tunneled_eap_type);

			if (status == eap_status_illegal_configure_type)

			{

				status = get_application_partner()->read_configure(

					cf_str_PEAP_tunneled_eap_type_u32_t.get_field(),

					&tunneled_eap_type);

			}

		}

#if defined(USE_EAP_CORE_SERVER)

		else

		{

			status = get_application_partner()->read_configure(

				cf_str_PEAP_server_tunneled_eap_type_hex_data.get_field(),

				&tunneled_eap_type);

			if (status == eap_status_illegal_configure_type)

			{

				status = get_application_partner()->read_configure(

					cf_str_PEAP_server_tunneled_eap_type_u32_t.get_field(),

					&tunneled_eap_type);

			}

		}

#endif //#if defined(USE_EAP_CORE_SERVER)

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		else if (tunneled_eap_type.get_data_length() == sizeof(u32_t)

			&& tunneled_eap_type.get_data(sizeof(u32_t)) != 0)

		{

			u32_t *p_eap_type = reinterpret_cast<u32_t *>(

				tunneled_eap_type.get_data(sizeof(u32_t)));

			if (p_eap_type != 0)

			{

				m_peap_tunneled_eap_type = static_cast<eap_type_ietf_values_e>(*p_eap_type);

			}

			else

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_configure_field);

			}

		}

		else if (tunneled_eap_type.get_data_length()

				 == eap_expanded_type_c::get_eap_expanded_type_size()

			&& tunneled_eap_type.get_data(tunneled_eap_type.get_data_length()) != 0)

		{

			eap_expanded_type_c eap_type(eap_type_none);

			status = eap_type.set_expanded_type_data(

				m_am_tools,

				&tunneled_eap_type);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

			status = eap_type.get_type_data(

				m_am_tools,

				&m_peap_tunneled_eap_type);

			if (status != eap_status_ok)

			{

				EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

				return EAP_STATUS_RETURN(m_am_tools, status);

			}

		}

		else

		{

			EAP_TRACE_DEBUG(

				m_am_tools, 

				TRACE_FLAGS_DEFAULT, 

				(EAPL("ERROR: %s: No tunneled EAP-type configured, %s.\n"),

				 (m_is_client == true ? "client": "server"),

				 cf_str_EAP_default_type_hex_data.get_field()->get_field()));

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_illegal_configure_field);

		}

#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

		{

			// This is special case.

			// We must tell to inner EAP-stack to use EAP-MsChapv2.

			m_tunneled_eap_in_ttls = false;

		}

#endif //#if defined(EAP_USE_TTLS_PLAIN_MS_CHAP_V2_HACK)

	}

	//----------------------------------------------------------

	{

		eap_variable_data_c allowed_eap_types(m_am_tools);

		const eap_configuration_field_c * field

			= cf_str_PEAP_accepted_tunneled_client_types_hex_data.get_field();

		if (m_is_client == false)

		{

			field = cf_str_PEAP_accepted_tunneled_server_types_hex_data.get_field();

		}

		eap_status_e status = read_configure(

			field,

			&allowed_eap_types);

		if (status == eap_status_ok

			&& allowed_eap_types.get_is_valid_data() == true)

		{

			// OK read.

			u32_t type_count = allowed_eap_types.get_data_length()

				/eap_expanded_type_c::get_eap_expanded_type_size();

			EAP_TRACE_DEBUG(

				m_am_tools, 

				TRACE_FLAGS_DEFAULT, 

				(EAPL("%s: tls_application_eap_core_c::configure(): Tunneled EAP-type count %d, hex data.\n"),

				 (m_is_client == true ? "client": "server"),

				 type_count));

			for (u32_t ind = 0ul; ind < type_count; ind++)

			{

				eap_type_value_e * const eap_type = new eap_type_value_e(eap_type_none);

				if (eap_type == 0)

				{

					EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

					return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

				}

				status = eap_expanded_type_c::read_type(

					m_am_tools,

					ind,

					allowed_eap_types.get_data(allowed_eap_types.get_data_length()),

					allowed_eap_types.get_data_length(),

					eap_type);

				if (status != eap_status_ok)

				{

					delete eap_type;

					EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

					return EAP_STATUS_RETURN(m_am_tools, status);

				}

				EAP_TRACE_DEBUG(

					m_am_tools, 

					TRACE_FLAGS_DEFAULT, 

					(EAPL("%s: tls_application_eap_core_c::configure(): allowed EAP-type %d.\n"),

					 (m_is_client == true ? "client": "server"),

					 convert_eap_type_to_u32_t(*eap_type)));

				status = m_accepted_tunneled_eap_types.add_object(eap_type, true);

				if (status != eap_status_ok)

				{

					EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

					return EAP_STATUS_RETURN(m_am_tools, status);

				}

			} // for()

		}

		else

		{

			// Try different configuration type.

			const eap_configuration_field_c * field

				= cf_str_PEAP_accepted_tunneled_client_types_u32array.get_field();

			if (m_is_client == false)

			{

				field = cf_str_PEAP_accepted_tunneled_server_types_u32array.get_field();

			}

			status = read_configure(

				field,

				&allowed_eap_types);

			if (status == eap_status_ok

				&& allowed_eap_types.get_is_valid_data() == true)

			{

				// OK read.

				u32_t type_count = allowed_eap_types.get_data_length()

					/ sizeof(u32_t);

				u32_t * const array = reinterpret_cast<u32_t *>(

					allowed_eap_types.get_data(type_count*sizeof(u32_t)));

				EAP_TRACE_DEBUG(

					m_am_tools, 

					TRACE_FLAGS_DEFAULT, 

					(EAPL("%s: tls_application_eap_core_c::configure(): Tunneled EAP-type count %d, u32array.\n"),

					 (m_is_client == true ? "client": "server"),

					 type_count));

				for (u32_t ind = 0ul; ind < type_count; ind++)

				{

					eap_type_value_e * const eap_type = new eap_type_value_e(eap_type_none);

					if (eap_type == 0)

					{

						EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

						return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

					}

					*eap_type = static_cast<eap_type_ietf_values_e>(array[ind]);

					EAP_TRACE_DEBUG(

						m_am_tools, 

						TRACE_FLAGS_DEFAULT, 

						(EAPL("%s: tls_application_eap_core_c::configure(): allowed EAP-type %d.\n"),

						 (m_is_client == true ? "client": "server"),

						 convert_eap_type_to_u32_t(*eap_type)));

					status = m_accepted_tunneled_eap_types.add_object(eap_type, true);

					if (status != eap_status_ok)

					{

						EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

						return EAP_STATUS_RETURN(m_am_tools, status);

					}

				} // for()

			}

		}

	}

	//----------------------------------------------------------

	{

		// Client and server configuration.

		eap_variable_data_c allow_tunneled_session_resumption(m_am_tools);

		status = read_configure(

			cf_str_PEAP_allow_tunneled_session_resumption.get_field(),

			&allow_tunneled_session_resumption);

		if (status == eap_status_ok

			&& allow_tunneled_session_resumption.get_is_valid_data() == true

			&& allow_tunneled_session_resumption.get_data_length() == sizeof(u32_t)

			&& allow_tunneled_session_resumption.get_data(sizeof(u32_t)) != 0)