/*

* Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of the License "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  EAP and WLAN authentication protocols.

*

*/

// This is enumeration of EAPOL source code.

#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

	#undef EAP_FILE_NUMBER_ENUM

	#define EAP_FILE_NUMBER_ENUM 67 

	#undef EAP_FILE_NUMBER_DATE 

	#define EAP_FILE_NUMBER_DATE 1127594498 

#endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

#include "eap_am_memory.h"

#include "eap_tools.h"

#include "eap_type_aka.h"

#include "eap_type_aka_header.h"

#include "eap_type_aka_payloads.h"

#include "abs_eap_am_type_aka.h"

#include "eap_crypto_api.h"

#include "eap_state_notification.h"

#include "abs_eap_am_mutex.h"

#include "eap_automatic_variable.h"

#include "eap_sort.h"

#include "eap_buffer.h"

#include "eap_config.h"

//--------------------------------------------------

/** @file */

// 

EAP_FUNC_EXPORT eap_type_aka_c::~eap_type_aka_c()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools, 

		TRACE_FLAGS_DEFAULT, 

		(EAPL("eap_type_aka_c::~eap_type_aka_c(): this = 0x%08x => 0x%08x\n"),

		this,

		dynamic_cast<abs_eap_base_timer_c *>(this)));

	EAP_ASSERT(m_shutdown_was_called == true);

	if (m_free_am_type_aka == true

		&& m_am_type_aka != 0)

	{

		delete m_am_type_aka;

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

#if defined(_WIN32) && !defined(__GNUC__)

	#pragma warning( disable : 4355 ) // 'this' : used in base member initializer list

#endif

// 

EAP_FUNC_EXPORT eap_type_aka_c::eap_type_aka_c(

	abs_eap_am_tools_c * const tools,

	abs_eap_base_type_c * const partner,

	eap_am_type_aka_c * const am_type_aka,

	const bool free_am_type_aka,

	const bool is_client_when_true,

	const eap_am_network_id_c * const receive_network_id)

	: eap_base_type_c(tools, partner)

	, m_am_tools(tools)

	, m_am_type_aka(am_type_aka)

	, m_checkcode(tools)

	, m_checkcode_update_count(0UL)

	, m_received_checkcode(tools)

	, m_checkcode_saved_message(tools)

	, m_all_payloads(tools)

	, m_nonce_mt_file(tools)

	, m_manual_username(tools)

	, m_manual_realm(tools)

	, m_automatic_realm(tools)

	, m_automatic_realm_read(false)

	, m_aka_header_offset(0u)

	, m_MTU(0u)

	, m_trailer_length(0u)

	, m_length_of_mnc(EAP_TYPE_AKA_DEFAULT_MNC_LENGTH_3_BYTES)

	, m_authentication_type(AKA_AUTHENTICATION_TYPE_NONE)

	, m_identity_type(AKA_IDENTITY_TYPE_NONE)

	, m_client_error_code(eap_aka_client_error_code_none)

	, m_aka_notification_code(eap_aka_notification_none)

	, m_failure_message_delay_time(EAP_TYPE_AKA_TIMER_TIMEOUT_VALUE_DELAY_FAILURE_MESSAGE_SENT)

	, m_is_valid(false)

	, m_is_client(is_client_when_true)

	, m_wait_eap_success_packet(true)

	, m_check_identifier_of_eap_identity_response(false)

	, m_free_am_type_aka(free_am_type_aka)

	, m_client_responds_retransmitted_packets(false)

	, m_aka_test_version(false)

	, m_aka_randomly_refuse_eap_identity(false)

	, m_check_nai_realm(false)

	, m_fail_reauthentication_counter_check(false)

	, m_accept_eap_identity_response(true)

	, m_use_random_identity_on_eap_identity_response(false)

	, m_shutdown_was_called(false)

	, m_reset_was_called(false)

	, m_use_pseudonym_identity(true)

	, m_use_reauthentication_identity(true)

	, m_erroneus_packet_received(false)

	, m_aka_notification_packet_received(false)

	, m_use_manual_username(false)

	, m_use_manual_realm(false)

	, m_randomly_fail_successfull_authentication(false)

	, m_allow_use_result_indication(true)

	, m_use_result_indication(false)

	, m_state(eap_type_aka_state_none)

	, m_saved_previous_state(eap_type_aka_state_none)

	, m_send_network_id(tools)

	, m_nonce_s(tools)

	, m_IV(tools)

	, m_saved_EAP_packet(tools)

	, m_XKEY(tools)

	, m_K_encr(tools)

	, m_K_aut(tools)

	, m_master_session_key(tools, eap_type_aka)

	, m_IMSI(tools)

	, m_pseudonym(tools)

	, m_reauthentication_identity(tools)

	, m_identity(tools)

	, m_NAI(tools)

	, m_RAND(tools)

	, m_AUTN(tools)

	, m_RES(tools)

	, m_2_digit_mnc_map_of_mcc_of_imsi_array(tools)

	, m_uma_automatic_realm_prefix(tools)

	, m_use_uma_profile(false)

	, m_authentication_vector(0)

	, m_reauthentication_counter(0u)

	, m_include_identity_to_aka_identity_response(aka_payload_NONE)

	, m_aka_identity_response_includes_identity(aka_payload_NONE)

	, m_failure_message_received(false)

	, m_authentication_finished_successfully(false)

	, m_last_eap_identifier(0)

	, m_use_eap_expanded_type(false)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	EAP_TRACE_DEBUG(

		m_am_tools, 

		TRACE_FLAGS_DEFAULT, 

		(EAPL("eap_type_aka_c::eap_type_aka_c(): this = 0x%08x => 0x%08x, ")

		 EAPL("partner 0x%08x, type partner 0x%08x, compiled %s %s\n"),

		 this,

		 dynamic_cast<abs_eap_base_timer_c *>(this),

		 partner,

		 get_type_partner(),

		__DATE__,

		__TIME__));

	if (m_am_type_aka == 0)

	{

		// Something wrong with AM.

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	m_am_type_aka->set_am_partner(this);

	if (m_checkcode.get_is_valid() == false

		|| m_received_checkcode.get_is_valid() == false

		|| m_checkcode_saved_message.get_is_valid() == false

		|| m_nonce_mt_file.get_is_valid() == false

		|| m_manual_username.get_is_valid() == false

		|| m_manual_realm.get_is_valid() == false

		|| m_send_network_id.get_is_valid() == false

		|| m_nonce_s.get_is_valid() == false

		|| m_IV.get_is_valid() == false

		|| m_saved_EAP_packet.get_is_valid() == false

		|| m_XKEY.get_is_valid() == false

		|| m_K_encr.get_is_valid() == false

		|| m_K_aut.get_is_valid() == false

		|| m_master_session_key.get_is_valid() == false

		|| m_IMSI.get_is_valid() == false

		|| m_pseudonym.get_is_valid() == false

		|| m_reauthentication_identity.get_is_valid() == false

		|| m_identity.get_is_valid() == false

		|| m_NAI.get_is_valid() == false

		|| m_RAND.get_is_valid() == false

		|| m_AUTN.get_is_valid() == false

		|| m_RES.get_is_valid() == false)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	eap_status_e status = checkcode_init();

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return;

	}

	// - - - - - - - - - - - - - - - - - - - - - - - - - - - -

	initialize_state(eap_type_aka_state_pending_kc_sres_query, false, false,

		aka_subtype_Notification,

		aka_subtype_Challenge, // Re-transmitted EAP-Request/AKA/Challenge is allowed.

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_pending_authentication_vector_query, false, false,

		aka_subtype_Notification,

		aka_subtype_Identity, // Note EAP-Response/AKA/Identity message is allowed here, eap_type_aka_c::handle_aka_identity_response_message() will drop EAP-Response/AKA/Identity message quietly.

		aka_subtype_Client_Error,

		aka_subtype_Challenge, // Re-transmitted EAP-Response/AKA/Challenge is allowed.

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_aka_identity_request, false, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_pseydonym_waiting_for_aka_identity_request, false, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_Re_authentication,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_imsi_waiting_for_aka_identity_request, false, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_aka_identity_response, true, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_Client_Error,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_notification_request_success, false, true,

		aka_subtype_Notification,

		aka_subtype_Challenge,

		aka_subtype_Re_authentication,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_notification_response_failure, true, false,

		aka_subtype_Notification,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_notification_response_success, true, false,

		aka_subtype_Notification,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_aka_identity_response_with_at_permanent_identity, true, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_Client_Error,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_aka_identity_response_with_at_full_auth_identity, true, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_Client_Error,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_aka_identity_response_with_at_any_identity, true, false,

		aka_subtype_Notification,

		aka_subtype_Identity,

		aka_subtype_Client_Error,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_analyse_aka_identity_request, false, false,

		aka_subtype_Notification,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_challenge_request, false, false,

		aka_subtype_Notification,

		aka_subtype_Challenge,

		aka_subtype_Identity,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_challenge_response, false, false,

		aka_subtype_Notification,

		aka_subtype_Challenge,

		aka_subtype_Identity,

		aka_subtype_Client_Error,

		aka_subtype_Synchronization_Failure);

	initialize_state(eap_type_aka_state_waiting_for_reauth_request, false, false,

		aka_subtype_Notification,

		aka_subtype_Re_authentication,

		aka_subtype_Identity,

		aka_subtype_Challenge, // This is allowed because, server could start full authentication.

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_reauth_response, false, false,

		aka_subtype_Notification,

		aka_subtype_Re_authentication,

		aka_subtype_Identity,

		aka_subtype_Client_Error,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_success, false, false,

		aka_subtype_Notification,

		aka_subtype_Challenge,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_waiting_for_success, false, false,

		aka_subtype_Notification,

		aka_subtype_Challenge,

		aka_subtype_Re_authentication,

		aka_subtype_NONE,

		aka_subtype_NONE);

	initialize_state(eap_type_aka_state_failure, false, false,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE,

		aka_subtype_NONE);

	{

		// Here we swap the addresses.

		eap_am_network_id_c send_network_id(m_am_tools,

			receive_network_id->get_destination_id(),

			receive_network_id->get_source_id(),

			receive_network_id->get_type());

		status = m_send_network_id.set_copy_of_network_id(&send_network_id);

		if (status != eap_status_ok

			|| m_send_network_id.get_is_valid_data() == false)

		{

			(void) EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

			return;

		}

	}

	set_is_valid();

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//-----------------------------------------------

//

void eap_type_aka_c::initialize_state(

				const eap_type_aka_state_variable_e state,

				const bool must_be_initiator,

				const bool must_be_responder,

				const aka_subtype_e type0,

				const aka_subtype_e type1,

				const aka_subtype_e type2,

				const aka_subtype_e type3,

				const aka_subtype_e type4)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	m_parameters[(state)].init_state(must_be_initiator, must_be_responder,

		type0, type1, type2, type3, type4);

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

}

//--------------------------------------------------

EAP_FUNC_EXPORT bool eap_type_aka_c::random_selection()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	crypto_random_c rand(m_am_tools);

	if (rand.get_is_valid() == false)

	{

		return false;

	}

	return (rand.get_rand_integer(0, 1) != 0);

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e eap_type_aka_c::checkcode_init()

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	m_checkcode_update_count = 0UL;

	m_received_checkcode.reset();

	m_checkcode_saved_message.reset();

	m_all_payloads.reset();

	eap_status_e status = m_checkcode.hash_init();

	if (status != eap_status_ok)

	{

		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

		return EAP_STATUS_RETURN(m_am_tools, status);

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, status);

}

//--------------------------------------------------

EAP_FUNC_EXPORT bool eap_type_aka_c::compare_payload_first_is_less(

	const aka_payload_AT_type_e * const first,

	const aka_payload_AT_type_e * const second,

	abs_eap_am_tools_c * const /* m_am_tools */)

{

	return *first < *second;

}

//--------------------------------------------------

EAP_FUNC_EXPORT eap_status_e eap_type_aka_c::checkcode_verify_payloads(

	aka_payloads_c * const p_aka_payloads)

{

	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

	if (p_aka_payloads != 0

		&& p_aka_payloads->get_all_payloads()->get_is_valid_data() == true)

	{

		EAP_TRACE_DATA_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL(" CHECKCODE plain payload array"),

			 p_aka_payloads->get_all_payloads()->get_data(p_aka_payloads->get_all_payloads()->get_data_length()),

			 p_aka_payloads->get_all_payloads()->get_data_length()));

		// This will sort the payload array of type aka_payload_AT_type_e in increasing order.

		// Comparing this payload array to previous payload arrays is then easy task.

		eap_status_e status = eap_sort_array<aka_payload_AT_type_e>(

			reinterpret_cast<aka_payload_AT_type_e *>(

				p_aka_payloads->get_all_payloads()->get_data(

					p_aka_payloads->get_all_payloads()->get_data_length())),

			p_aka_payloads->get_all_payloads()->get_data_length()/sizeof(aka_payload_AT_type_e),

			compare_payload_first_is_less,

			m_am_tools);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

		EAP_TRACE_DATA_DEBUG(

			m_am_tools,

			TRACE_FLAGS_DEFAULT,

			(EAPL("CHECKCODE sorted payload array"),

			 p_aka_payloads->get_all_payloads()->get_data(p_aka_payloads->get_all_payloads()->get_data_length()),

			 p_aka_payloads->get_all_payloads()->get_data_length()));

		for (u32_t ind = 0ul; ind < m_all_payloads.get_object_count(); ind++)

		{

			eap_variable_data_c * const payloads =  m_all_payloads.get_object(ind);

			if (payloads != 0)

			{

				if (payloads->compare(p_aka_payloads->get_all_payloads()) == 0)

				{

					// Message with these payloads have been seen already.

					EAP_TRACE_DEBUG(

						m_am_tools, 

						TRACE_FLAGS_DEFAULT|TRACE_TEST_VECTORS, 

						(EAPL("WARNING: message with these payloads have been seen already.\n")));

					EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

					return EAP_STATUS_RETURN(m_am_tools, eap_status_already_exists);

				}

			}

		}

		// Save this payload array.

		eap_variable_data_c * copy_attributes = p_aka_payloads->get_all_payloads()->copy();

		if (copy_attributes == 0)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, eap_status_allocation_error);

		}

		status = m_all_payloads.add_object(copy_attributes, true);

		if (status != eap_status_ok)

		{

			EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

			return EAP_STATUS_RETURN(m_am_tools, status);

		}

	}

	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

	return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

}