1 /*

     2 * Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of the License "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description:  EAP and WLAN authentication protocols.

    15 *

    16 */

    17 

    18 

    19 // This is enumeration of EAPOL source code.

    20 #if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

    21 	#undef EAP_FILE_NUMBER_ENUM

    22 	#define EAP_FILE_NUMBER_ENUM 135 

    23 	#undef EAP_FILE_NUMBER_DATE 

    24 	#define EAP_FILE_NUMBER_DATE 1127594498 

    25 #endif //#if defined(USE_EAP_MINIMUM_RELEASE_TRACES)

    26 

    27 

    28 

    29 #include "eap_am_memory.h"

    30 #include "eap_am_export.h"

    31 #include "eap_am_tools.h"

    32 #include "eap_tools.h"

    33 #include "eap_crypto_api.h"

    34 #include "abs_tls_base_record.h"

    35 #include "tls_base_record.h"

    36 #include "tls_record.h"

    37 #include "tls_am_services.h"

    38 #include "tls_handshake_header.h"

    39 #include "tls_peap_types.h"

    40 #include "tls_message.h"

    41 #include "eap_automatic_variable.h"

    42 #include "eap_state_notification.h"

    43 #include "eap_type_tls_peap_types.h"

    44 #include "eap_header_string.h"

    45 

    46 #if defined(USE_FAST_EAP_TYPE)

    47 	#include "eap_fast_tlv_payloads.h"

    48 #endif //#if defined(USE_FAST_EAP_TYPE)

    49 

    50 #if defined(USE_EAP_TLS_SESSION_TICKET)

    51 #include "tls_extension.h"

    52 #endif // #if defined(USE_EAP_TLS_SESSION_TICKET)

    53 

    54 //--------------------------------------------------

    55 

    56 #define EAP_STATUS_RETURN_AND_CREATE_TLS_PROTOCOL_ALERT(tools, status) \

    57 	EAP_STATUS_RETURN(tools, eap_status_return_and_create_tls_protocol_alert((status)))

    58 

    59 

    60 eap_status_e tls_record_c::eap_status_return_and_create_tls_protocol_alert(

    61 	const eap_status_e status)

    62 {

    63 	if (status != eap_status_ok

    64 		&& status != eap_status_success

    65 		&& status != eap_status_pending_request

    66 		&& status != eap_status_drop_packet_quietly)

    67 	{

    68 		(void) create_tls_protocol_alert(tls_alert_description_none, tls_alert_level_none, status);

    69 	}

    70 

    71 	return EAP_STATUS_RETURN(m_am_tools, status);

    72 }

    73 

    74 //--------------------------------------------------

    75 

    76 EAP_FUNC_EXPORT tls_record_c::~tls_record_c()

    77 {

    78 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

    79 

    80 	EAP_TRACE_DEBUG(m_am_tools, TRACE_FLAGS_DEFAULT,

    81 					(EAPL("this = 0x%08x, %s: function: starts: tls_record_c::~tls_record_c(): m_am_tls_services")

    82 					 EAPL(" = 0x%08x (validity %d).\n"),

    83 					 this,

    84 					 (m_is_client == true ? "client": "server"),

    85 					 m_am_tls_services,

    86 					 m_am_tls_services->get_is_valid()));

    87 

    88 	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::~tls_record_c()");

    89 

    90 	EAP_ASSERT(m_shutdown_was_called == true);

    91 

    92 	completion_action_clenup();

    93 

    94 	if (m_free_am_tls_services == true)

    95 	{

    96 		delete m_am_tls_services;

    97 	}

    98 	m_am_tls_services = 0;

    99 

   100 	if (m_free_application == true)

   101 	{

   102 		delete m_application;

   103 	}

   104 	m_application = 0;

   105 

   106 	reset_block_ciphers(true);

   107 	reset_block_ciphers(false);

   108 

   109 	reset_stream_ciphers(true);

   110 	reset_stream_ciphers(false);

   111 

   112 	reset_hmac_algorithms(true);

   113 	reset_hmac_algorithms(false);

   114 

   115 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   116 }

   117 

   118 //--------------------------------------------------

   119 

   120 #if defined(_WIN32) && !defined(__GNUC__)

   121 	#pragma warning( disable : 4355 ) // 'this' : used in base member initializer list

   122 #endif

   123 

   124 EAP_FUNC_EXPORT tls_record_c::tls_record_c(

   125 	abs_eap_am_tools_c * const tools, ///< tools is pointer to the tools class. @see abs_eap_am_tools_c.

   126 	tls_am_services_c * const am_tls_services, ///< This is pointer to adaptation module of TLS.

   127 	const bool free_am_tls_services,

   128 	tls_base_application_c * const application, ///< application is pointer to application object.

   129 	const bool free_application,

   130 	const bool is_client_when_true, ///< Indicates whether this is client (true) or server (false).

   131 	const eap_type_value_e eap_type,

   132 	const eap_am_network_id_c * const receive_network_id)

   133 	: tls_base_record_c(tools /*, partner */)

   134 	, m_am_tools(tools)

   135 	, m_am_tls_services(am_tls_services)

   136 	, m_free_am_tls_services(free_am_tls_services)

   137 	, m_application(application)

   138 	, m_free_application(free_application)

   139 	, m_completion_queue(tools)

   140 	, m_received_tls_message(tools, this, this, this, is_client_when_true)

   141 	, m_new_tls_message(tools, this, this, this, is_client_when_true)

   142 	, m_message_hash_md5(tools)

   143 	, m_message_hash_sha1(tools)

   144 	, m_message_hash_md5_certificate_verify(tools)

   145 	, m_message_hash_sha1_certificate_verify(tools)

   146 	, m_client_message_hash_md5_finished(tools)

   147 	, m_client_message_hash_sha1_finished(tools)

   148 	, m_server_message_hash_md5_finished(tools)

   149 	, m_server_message_hash_sha1_finished(tools)

   150 	, m_client_handshake_random_value(tools)

   151 	, m_server_handshake_random_value(tools)

   152 	, m_session_id(tools)

   153 	, m_master_secret(tools)

   154 	, m_eap_master_session_key(tools, eap_type)

   155 	, m_new_send_mac_key(tools)

   156 	, m_new_receive_mac_key(tools)

   157 	, m_new_send_encryption_key(tools)

   158 	, m_new_receive_encryption_key(tools)

   159 	, m_new_send_iv(tools)

   160 	, m_new_receive_iv(tools)

   161 	, m_send_mac_key(tools)

   162 	, m_receive_mac_key(tools)

   163 	, m_send_encryption_key(tools)

   164 	, m_receive_encryption_key(tools)

   165 	, m_send_iv(tools)

   166 	, m_receive_iv(tools)

   167 	, m_session_key_seed(tools)

   168 	, m_mschapv2_challenges(tools)

   169 	, m_own_private_dhe_key(tools)

   170 	, m_own_public_dhe_key(tools)

   171 	, m_peer_public_dhe_key(tools)

   172 	, m_shared_dh_key(tools)

   173 	, m_dhe_prime(tools)

   174 	, m_dhe_group_generator(tools)

   175 	, m_signed_message_hash(tools)

   176 	, m_premaster_secret(tools)

   177 	, m_own_encrypted_premaster_secret(tools)

   178 #if defined(USE_FAST_EAP_TYPE)

   179 	, m_eap_fast_pac_key(tools)

   180 #endif //#if defined(USE_FAST_EAP_TYPE)

   181 	, m_proposed_cipher_suites(tools)

   182 	, m_proposed_compression_methods(tools)

   183 #if defined(USE_EAP_TLS_SESSION_TICKET)

   184 	, m_supported_tls_extensions(tools)

   185 	, m_received_tls_extensions(tools)

   186 #endif // #if defined(USE_EAP_TLS_SESSION_TICKET)

   187 	, m_NAI_realm(tools)

   188 	, m_send_network_id(tools)

   189 	, m_own_certificate_chain(tools)

   190 	, m_own_certificate_types(tools)

   191 	, m_own_certificate_authorities(tools)

   192 	, m_peer_certificate_chain(tools)

   193 	, m_peer_certificate_chain_result(eap_status_illegal_certificate)

   194 	, m_verify_signature(eap_status_authentication_failure)

   195 	, m_peer_certificate_types(tools)

   196 	, m_peer_certificate_authorities(tools)

   197 	, m_resumed_cipher_suite(tls_cipher_suites_none)

   198 	, m_selected_cipher_suite(tls_cipher_suites_none)

   199 	, m_selected_compression_method(tls_compression_method_none)

   200 	, m_receive_cipher_suite(tls_cipher_suites_TLS_NULL_WITH_NULL_NULL)

   201 	, m_receive_compression_method(tls_compression_method_null)

   202 	, m_send_cipher_suite(tls_cipher_suites_TLS_NULL_WITH_NULL_NULL)

   203 	, m_send_compression_method(tls_compression_method_null)

   204 	, m_send_block_cipher(0)

   205 	, m_receive_block_cipher(0)

   206 	, m_send_stream_cipher(0)

   207 	, m_receive_stream_cipher(0)

   208 	, m_send_hmac_algorithm(0)

   209 	, m_receive_hmac_algorithm(0)

   210 	, m_send_record_sequence_number(0ul)

   211 	, m_receive_record_sequence_number(0ul)

   212 	, m_tls_peap_state(tls_peap_state_wait_tls_start)

   213 	, m_tls_session_type(tls_session_type_none)

   214 	, m_eap_type(eap_type)

   215 	, m_peap_version(peap_version_none)

   216 	, m_tunneled_eap_type_authentication_state(eap_state_none)

   217 	, m_is_valid(false)

   218 	, m_is_client(is_client_when_true)

   219 	, m_allow_message_send(true)

   220 	, m_already_in_completion_action_check(false)

   221 	, m_already_in_process_tls_records(false)

   222 	, m_pending_query_certificate_authorities_and_types(false)

   223 	, m_pending_query_certificate_chain(false)

   224 	, m_pending_query_cipher_suites_and_previous_session(false)

   225 	, m_pending_query_dh_parameters(false)

   226 	, m_pending_query_realm(false)

   227 	, m_pending_select_cipher_suite_and_check_session_id(false)

   228 	, m_pending_verify_certificate_chain(false)

   229 	, m_pending_rsa_decrypt_with_private_key(false)

   230 	, m_pending_rsa_encrypt_with_public_key(false)

   231 	, m_pending_sign_with_private_key(false)

   232 	, m_pending_verify_with_public_key(false)

   233 	, m_pending_query_tunnel_PAC(false)

   234 	, m_tls_peap_test_version(false)

   235 	, m_key_material_generated(false)

   236 	, m_tls_peap_server_authenticates_client_policy_flag(true)

   237 	, m_tls_peap_server_authenticates_client_config_server(true)

   238 	, m_tls_peap_server_authenticates_client_action(true)

   239 	, m_tls_peap_server_requested_client_certificate(false)

   240 	, m_could_send_fatal_alert_message(true)

   241 	, m_could_send_warning_alert_message(true)

   242 	, m_force_tls_message_send(false)

   243 	, m_shutdown_was_called(false)

   244 	, m_use_separate_tls_record(true)  // Some vendors seems to use only separate TLS-records. Windows RAS and FreeRadius works too with this.

   245 	, m_use_extra_padding_length(false) // It seems that EAP-TLS of Microsoft Windows does not work with extra padding.

   246 	, m_client_allows_empty_certificate_authorities_list(false)

   247 	, m_server_sends_empty_certificate_authorities_list(false)

   248 	, m_use_tppd_tls_peap(true)

   249 	, m_use_tppd_peapv1_acknowledge_hack(false)

   250 	, m_server_offers_new_session_id(true)

   251 	, m_will_receive_new_session_ticket(false)

   252 	, m_send_piggypacked_eap_identity_request(true)

   253 #if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

   254 	, m_tls_use_identity_privacy(false)

   255 	, m_tls_identity_privacy_handshake_state(tls_identity_privacy_handshake_state_none)

   256 #endif //#if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

   257 #if defined(USE_FAST_EAP_TYPE)

   258 	, m_eap_fast_allow_server_unauthenticated_provisioning_mode_ADHP(false)

   259 	, m_remove_tunnel_pac(false)

   260 #endif //#if defined(USE_FAST_EAP_TYPE)

   261 	{

   262 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   263 

   264 	EAP_TRACE_DEBUG(

   265 		m_am_tools,

   266 		TRACE_FLAGS_DEFAULT,

   267 		(EAPL("TLS: this = 0x%08x, %s: function: starts: tls_record_c::tls_record_c(): "),

   268 		 this,

   269 		 (m_is_client == true ? "client": "server")));

   270 

   271 	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::tls_record_c()");

   272 

   273 	if (receive_network_id == 0

   274 		|| receive_network_id->get_is_valid_data() == false)

   275 	{

   276 		// No need to delete anything here because it is done in destructor.

   277 		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   278 		return;

   279 	}

   280 

   281 	if (m_am_tls_services == 0

   282 		|| m_am_tls_services->get_is_valid() == false)

   283 	{

   284 		EAP_TRACE_ERROR(m_am_tools, TRACE_FLAGS_TLS_PEAP_ERROR,

   285 						(EAPL("ERROR: %s: function: tls_record_c::tls_record_c() failed,")

   286 						 EAPL(" m_am_tls_services = 0x%08x (validity %d) is invalid.\n"),

   287 						 (m_is_client == true ? "client": "server"),

   288 						 m_am_tls_services, (m_am_tls_services != 0) ? m_am_tls_services->get_is_valid() : false));

   289 		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   290 		return;

   291 	}

   292 	m_am_tls_services->set_tls_am_partner(this);

   293 

   294 	// Here we swap the addresses.

   295 	eap_am_network_id_c send_network_id(

   296 		m_am_tools,

   297 		receive_network_id->get_destination_id(),

   298 		receive_network_id->get_source_id(),

   299 		receive_network_id->get_type());

   300 

   301 	eap_status_e status = m_send_network_id.set_copy_of_network_id(&send_network_id);

   302 	if (status != eap_status_ok)

   303 	{

   304 		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   305 		return;

   306 	}

   307 

   308 	if (get_is_tunneled_tls() == true

   309 		&& m_application == 0)

   310 	{

   311 		// Application is required in tunneled mode.

   312 		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   313 		return;

   314 	}

   315 

   316 	if (m_application != 0)

   317 	{

   318 		m_application->set_application_partner(this);

   319 	}

   320 

   321 	if (m_is_client == false)

   322 	{

   323 		set_state(tls_peap_state_wait_handshake_type_client_hello);

   324 	}

   325 

   326 	set_is_valid();

   327 

   328 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   329 }

   330 

   331 //--------------------------------------------------

   332 

   333 EAP_FUNC_EXPORT void tls_record_c::reset_block_ciphers(const bool send_when_true)

   334 {

   335 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   336 

   337 	if (send_when_true == true)

   338 	{

   339 		delete m_send_block_cipher;

   340 		m_send_block_cipher = 0;

   341 	}

   342 	else

   343 	{

   344 		delete m_receive_block_cipher;

   345 		m_receive_block_cipher = 0;

   346 	}

   347 

   348 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   349 }

   350 

   351 //--------------------------------------------------

   352 

   353 EAP_FUNC_EXPORT void tls_record_c::reset_stream_ciphers(const bool send_when_true)

   354 {

   355 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   356 

   357 	if (send_when_true == true)

   358 	{

   359 		delete m_send_stream_cipher;

   360 		m_send_stream_cipher = 0;

   361 	}

   362 	else

   363 	{

   364 		delete m_receive_stream_cipher;

   365 		m_receive_stream_cipher = 0;

   366 	}

   367 

   368 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   369 }

   370 

   371 //--------------------------------------------------

   372 

   373 EAP_FUNC_EXPORT void tls_record_c::reset_hmac_algorithms(const bool send_when_true)

   374 {

   375 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   376 

   377 	if (send_when_true == true)

   378 	{

   379 		delete m_send_hmac_algorithm;

   380 		m_send_hmac_algorithm = 0;

   381 	}

   382 	else

   383 	{

   384 		delete m_receive_hmac_algorithm;

   385 		m_receive_hmac_algorithm = 0;

   386 	}

   387 

   388 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   389 }

   390 

   391 //--------------------------------------------------

   392 

   393 EAP_FUNC_EXPORT void tls_record_c::set_state(const tls_peap_state_e state)

   394 {

   395 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   396 

   397 	EAP_TRACE_DEBUG(

   398 		m_am_tools,

   399 		TRACE_FLAGS_DEFAULT,

   400 		(EAPL("TLS: this = 0x%08x, %s: state_function: starts: tls_record_c::set_state() from %s to %s\n"),

   401 		 this,

   402 		 (m_is_client == true ? "client": "server"),

   403 		 eap_tls_trace_string_c::get_state_string(m_tls_peap_state),

   404 		 eap_tls_trace_string_c::get_state_string(state)));

   405 

   406 	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::set_state()");

   407 

   408 	if (m_tls_peap_state != tls_peap_state_failure)

   409 	{

   410 		m_tls_peap_state = state;

   411 	}

   412 

   413 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   414 }

   415 

   416 //--------------------------------------------------

   417 

   418 EAP_FUNC_EXPORT tls_peap_state_e tls_record_c::get_state() const

   419 {

   420 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   421 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   422 	return m_tls_peap_state;

   423 }

   424 

   425 //--------------------------------------------------

   426 

   427 EAP_FUNC_EXPORT bool tls_record_c::verify_state(const tls_peap_state_e state)

   428 {

   429 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   430 

   431 	bool are_equal = false;

   432 

   433 	EAP_TRACE_DEBUG(

   434 		m_am_tools,

   435 		TRACE_FLAGS_DEFAULT,

   436 		(EAPL("TLS: %s: state_function: starts: tls_record_c::verify_state(): (current state %s) %s (new state %s)\n"),

   437 		 (m_is_client == true ? "client": "server"),

   438 		 eap_tls_trace_string_c::get_state_string(m_tls_peap_state),

   439 		 ((m_tls_peap_state == state) ? "==" : "!="),

   440 		 eap_tls_trace_string_c::get_state_string(state)));

   441 

   442 	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::verify_state()");

   443 

   444 	if (m_tls_peap_state == state)

   445 	{

   446 		are_equal = true;

   447 	}

   448 	else

   449 	{

   450 		are_equal = false;

   451 	}

   452 

   453 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   454 	return are_equal;

   455 }

   456 

   457 //--------------------------------------------------

   458 

   459 EAP_FUNC_EXPORT void tls_record_c::set_is_valid()

   460 {

   461 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   462 

   463 	m_is_valid = true;

   464 

   465 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   466 }

   467 

   468 //--------------------------------------------------

   469 

   470 EAP_FUNC_EXPORT bool tls_record_c::get_is_tunneled_tls()

   471 {

   472 	return (

   473 		m_eap_type == eap_type_peap

   474 		|| m_eap_type == eap_type_ttls

   475 #if defined(USE_FAST_EAP_TYPE)

   476 		|| m_eap_type == eap_type_fast

   477 #endif //#if defined(USE_FAST_EAP_TYPE)

   478 		);

   479 }

   480 

   481 //--------------------------------------------------

   482 

   483 EAP_FUNC_EXPORT void tls_record_c::set_peap_version(

   484 	const peap_version_e peap_version,

   485 	const bool use_tppd_tls_peap,

   486 	const bool use_tppd_peapv1_acknowledge_hack)

   487 {

   488 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   489 

   490 	m_peap_version = peap_version;

   491 

   492 	m_use_tppd_tls_peap = use_tppd_tls_peap;

   493 

   494 	m_use_tppd_peapv1_acknowledge_hack = use_tppd_peapv1_acknowledge_hack;

   495 

   496 	m_am_tls_services->set_peap_version(

   497 		peap_version,

   498 		use_tppd_tls_peap,

   499 		use_tppd_peapv1_acknowledge_hack);

   500 

   501 	if (m_application != 0)

   502 	{

   503 		m_application->set_peap_version(

   504 			peap_version,

   505 			use_tppd_tls_peap,

   506 			use_tppd_peapv1_acknowledge_hack);

   507 	}

   508 

   509 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   510 }

   511 

   512 //--------------------------------------------------

   513 

   514 EAP_FUNC_EXPORT eap_status_e tls_record_c::configure()

   515 {

   516 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

   517 

   518 	EAP_TRACE_DEBUG(

   519 		m_am_tools,

   520 		TRACE_FLAGS_DEFAULT,

   521 		(EAPL("TLS: this = 0x%08x, %s: function: starts: tls_record_c::configure():\n"),

   522 		 this,

   523 		(m_is_client == true ? "client": "server")));

   524 

   525 	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::configure()");

   526 

   527 	eap_status_e status = m_am_tls_services->configure();

   528 	if (status != eap_status_ok)

   529 	{

   530 		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   531 		return EAP_STATUS_RETURN(m_am_tools, status);

   532 	}

   533 

   534 	//----------------------------------------------------------

   535 

   536 	{

   537 		eap_variable_data_c test_version(m_am_tools);

   538 

   539 		status = get_type_partner()->read_configure(

   540 			cf_str_EAP_TLS_test_version.get_field(),

   541 			&test_version);

   542 		if (status == eap_status_ok

   543 			&& test_version.get_is_valid_data() == true

   544 			&& test_version.get_data_length() == sizeof(u32_t)

   545 			&& test_version.get_data(sizeof(u32_t)) != 0)

   546 		{

   547 			// This is optional value.

   548 			u32_t *flag = reinterpret_cast<u32_t *>(test_version.get_data(sizeof(u32_t)));

   549 			if (flag != 0)

   550 			{

   551 				if (*flag == 0)

   552 				{

   553 					m_tls_peap_test_version = false;

   554 				}

   555 				else

   556 				{

   557 					m_tls_peap_test_version = true;

   558 				}

   559 			}

   560 		}

   561 

   562 		status = eap_status_ok;

   563 	}

   564 

   565 	//----------------------------------------------------------

   566 

   567 	{

   568 		eap_variable_data_c use_separate_tls_record(m_am_tools);

   569 

   570 		status = get_type_partner()->read_configure(

   571 			cf_str_TLS_use_separate_tls_record.get_field(),

   572 			&use_separate_tls_record);

   573 		if (status == eap_status_ok

   574 			&& use_separate_tls_record.get_is_valid_data() == true

   575 			&& use_separate_tls_record.get_data_length() == sizeof(u32_t)

   576 			&& use_separate_tls_record.get_data(sizeof(u32_t)) != 0)

   577 		{

   578 			// This is optional value.

   579 			u32_t *flag = reinterpret_cast<u32_t *>(

   580 				use_separate_tls_record.get_data(sizeof(u32_t)));

   581 			if (flag != 0)

   582 			{

   583 				if (*flag == 0)

   584 				{

   585 					m_use_separate_tls_record = false;

   586 				}

   587 				else

   588 				{

   589 					m_use_separate_tls_record = true;

   590 				}

   591 			}

   592 		}

   593 

   594 		status = eap_status_ok;

   595 	}

   596 

   597 	//----------------------------------------------------------

   598 

   599 	if (m_is_client == false)

   600 	{

   601 		eap_variable_data_c server_offers_new_session_id(m_am_tools);

   602 

   603 		status = get_type_partner()->read_configure(

   604 			cf_str_TLS_server_offers_new_session_id.get_field(),

   605 			&server_offers_new_session_id);

   606 		if (status == eap_status_ok

   607 			&& server_offers_new_session_id.get_is_valid_data() == true

   608 			&& server_offers_new_session_id.get_data_length() == sizeof(u32_t)

   609 			&& server_offers_new_session_id.get_data(sizeof(u32_t)) != 0)

   610 		{

   611 			// This is optional value.

   612 			u32_t *flag = reinterpret_cast<u32_t *>(

   613 				server_offers_new_session_id.get_data(sizeof(u32_t)));

   614 			if (flag != 0)

   615 			{

   616 				if (*flag == 0)

   617 				{

   618 					m_server_offers_new_session_id = false;

   619 				}

   620 				else

   621 				{

   622 					m_server_offers_new_session_id = true;

   623 				}

   624 			}

   625 		}

   626 

   627 		status = eap_status_ok;

   628 	}

   629 

   630 	//----------------------------------------------------------

   631 

   632 	if (get_is_tunneled_tls() == true)

   633 	{

   634 		// Default function in PEAP and TTLS is only client authenticates server.

   635 		m_tls_peap_server_authenticates_client_config_server = false;

   636 	}

   637 

   638 	if (m_is_client == false)

   639 	{

   640 		eap_variable_data_c server_authenticates_client(m_am_tools);

   641 

   642 		status = get_type_partner()->read_configure(

   643 			cf_str_TLS_server_authenticates_client.get_field(),

   644 			&server_authenticates_client);

   645 		if (status == eap_status_ok

   646 			&& server_authenticates_client.get_is_valid_data() == true

   647 			&& server_authenticates_client.get_data_length() == sizeof(u32_t)

   648 			&& server_authenticates_client.get_data(sizeof(u32_t)) != 0)

   649 		{

   650 			// This is optional value.

   651 			u32_t *flag = reinterpret_cast<u32_t *>(

   652 				server_authenticates_client.get_data(sizeof(u32_t)));

   653 			if (flag != 0)

   654 			{

   655 				if (*flag == 0)

   656 				{

   657 					m_tls_peap_server_authenticates_client_config_server = false;

   658 				}

   659 				else

   660 				{

   661 					m_tls_peap_server_authenticates_client_config_server = true;

   662 				}

   663 			}

   664 		}

   665 

   666 		if (m_tls_peap_server_authenticates_client_config_server == false)

   667 		{

   668 			m_tls_peap_server_authenticates_client_action = false;

   669 		}

   670 

   671 		status = eap_status_ok;

   672 	}

   673 

   674 	//----------------------------------------------------------

   675 

   676 	if (get_is_tunneled_tls() == true)

   677 	{

   678 		// Default function in PEAP and TTLS is only client authenticates server.

   679 		m_tls_peap_server_authenticates_client_policy_flag = false;

   680 	}

   681 

   682 	if (m_is_client == true)

   683 	{

   684 		eap_variable_data_c server_authenticates_client(m_am_tools);

   685 

   686 		status = get_type_partner()->read_configure(

   687 			cf_str_TLS_server_authenticates_client_policy_in_client.get_field(),

   688 			&server_authenticates_client);

   689 		if (status == eap_status_ok

   690 			&& server_authenticates_client.get_is_valid_data() == true

   691 			&& server_authenticates_client.get_data_length() == sizeof(u32_t)

   692 			&& server_authenticates_client.get_data(sizeof(u32_t)) != 0)

   693 		{

   694 			// This is optional value.

   695 			u32_t *flag = reinterpret_cast<u32_t *>(

   696 				server_authenticates_client.get_data(sizeof(u32_t)));

   697 			if (flag != 0)

   698 			{

   699 				if (*flag == 0)

   700 				{

   701 					m_tls_peap_server_authenticates_client_policy_flag = false;

   702 				}

   703 				else

   704 				{

   705 					m_tls_peap_server_authenticates_client_policy_flag = true;

   706 				}

   707 			}

   708 		}

   709 

   710 		status = eap_status_ok;

   711 	}

   712 	else

   713 	{

   714 		eap_variable_data_c server_authenticates_client(m_am_tools);

   715 

   716 		status = get_type_partner()->read_configure(

   717 			cf_str_TLS_server_authenticates_client_policy_in_server.get_field(),

   718 			&server_authenticates_client);

   719 		if (status == eap_status_ok

   720 			&& server_authenticates_client.get_is_valid_data() == true

   721 			&& server_authenticates_client.get_data_length() == sizeof(u32_t)

   722 			&& server_authenticates_client.get_data(sizeof(u32_t)) != 0)

   723 		{

   724 			// This is optional value.

   725 			u32_t *flag = reinterpret_cast<u32_t *>(

   726 				server_authenticates_client.get_data(sizeof(u32_t)));

   727 			if (flag != 0)

   728 			{

   729 				if (*flag == 0)

   730 				{

   731 					m_tls_peap_server_authenticates_client_policy_flag = false;

   732 				}

   733 				else

   734 				{

   735 					m_tls_peap_server_authenticates_client_policy_flag = true;

   736 				}

   737 			}

   738 		}

   739 

   740 		status = eap_status_ok;

   741 	}

   742 

   743 	//----------------------------------------------------------

   744 

   745 	if (m_is_client == true)

   746 	{

   747 		eap_variable_data_c client_allows_empty_certificate_authorities_list(m_am_tools);

   748 

   749 		status = get_type_partner()->read_configure(

   750 			cf_str_TLS_client_allows_empty_certificate_authorities_list.get_field(),

   751 			&client_allows_empty_certificate_authorities_list);

   752 		if (status == eap_status_ok

   753 			&& client_allows_empty_certificate_authorities_list.get_is_valid_data() == true

   754 			&& client_allows_empty_certificate_authorities_list.get_data_length() == sizeof(u32_t)

   755 			&& client_allows_empty_certificate_authorities_list.get_data(sizeof(u32_t)) != 0)

   756 		{

   757 			// This is optional value.

   758 			u32_t *flag = reinterpret_cast<u32_t *>(

   759 				client_allows_empty_certificate_authorities_list.get_data(sizeof(u32_t)));

   760 			if (flag != 0)

   761 			{

   762 				if (*flag == 0)

   763 				{

   764 					m_client_allows_empty_certificate_authorities_list = false;

   765 				}

   766 				else

   767 				{

   768 					m_client_allows_empty_certificate_authorities_list = true;

   769 				}

   770 			}

   771 		}

   772 

   773 		status = eap_status_ok;

   774 	}

   775 	else

   776 	{

   777 		eap_variable_data_c server_sends_empty_certificate_authorities_list(m_am_tools);

   778 

   779 		status = get_type_partner()->read_configure(

   780 			cf_str_TLS_server_sends_empty_certificate_authorities_list.get_field(),

   781 			&server_sends_empty_certificate_authorities_list);

   782 		if (status == eap_status_ok

   783 			&& server_sends_empty_certificate_authorities_list.get_is_valid_data() == true

   784 			&& server_sends_empty_certificate_authorities_list.get_data_length() == sizeof(u32_t)

   785 			&& server_sends_empty_certificate_authorities_list.get_data(sizeof(u32_t)) != 0)

   786 		{

   787 			// This is optional value.

   788 			u32_t *flag = reinterpret_cast<u32_t *>(

   789 				server_sends_empty_certificate_authorities_list.get_data(sizeof(u32_t)));

   790 			if (flag != 0)

   791 			{

   792 				if (*flag == 0)

   793 				{

   794 					m_server_sends_empty_certificate_authorities_list = false;

   795 				}

   796 				else

   797 				{

   798 					m_server_sends_empty_certificate_authorities_list = true;

   799 				}

   800 			}

   801 		}

   802 

   803 		status = eap_status_ok;

   804 	}

   805 

   806 	//----------------------------------------------------------

   807 

   808 	if (m_is_client == false)

   809 	{

   810 		eap_variable_data_c send_piggypacked_eap_identity_request(m_am_tools);

   811 

   812 		status = get_type_partner()->read_configure(

   813 			cf_str_EAP_FAST_send_piggypacked_eap_identity_request.get_field(),

   814 			&send_piggypacked_eap_identity_request);

   815 		if (status == eap_status_ok

   816 			&& send_piggypacked_eap_identity_request.get_is_valid_data() == true

   817 			&& send_piggypacked_eap_identity_request.get_data_length() == sizeof(u32_t)

   818 			&& send_piggypacked_eap_identity_request.get_data(sizeof(u32_t)) != 0)

   819 		{

   820 			// This is optional value.

   821 			u32_t *flag = reinterpret_cast<u32_t *>(

   822 				send_piggypacked_eap_identity_request.get_data(sizeof(u32_t)));

   823 			if (flag != 0)

   824 			{

   825 				if (*flag == 0)

   826 				{

   827 					m_send_piggypacked_eap_identity_request = false;

   828 				}

   829 				else

   830 				{

   831 					m_send_piggypacked_eap_identity_request = true;

   832 				}

   833 			}

   834 		}

   835 

   836 		status = eap_status_ok;

   837 	}

   838 

   839 	//----------------------------------------------------------

   840 

   841 #if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

   842 

   843 	{

   844 		eap_variable_data_c tls_use_privacy(m_am_tools);

   845 

   846 		status = get_type_partner()->read_configure(

   847 			cf_str_EAP_TLS_PEAP_use_identity_privacy.get_field(),

   848 			&tls_use_privacy);

   849 		if (status == eap_status_ok

   850 			&& tls_use_privacy.get_is_valid_data() == true

   851 			&& tls_use_privacy.get_data_length() == sizeof(u32_t)

   852 			&& tls_use_privacy.get_data(sizeof(u32_t)) != 0)

   853 		{

   854 			// This is optional value.

   855 			u32_t *flag = reinterpret_cast<u32_t *>(

   856 				tls_use_privacy.get_data(sizeof(u32_t)));

   857 			if (flag != 0)

   858 			{

   859 				if (*flag == 0)

   860 				{

   861 					m_tls_use_identity_privacy = false;

   862 				}

   863 				else

   864 				{

   865 					m_tls_use_identity_privacy = true;

   866 				}

   867 			}

   868 		}

   869 

   870 		status = eap_status_ok;

   871 	}

   872 

   873 	if (m_is_client == false)

   874 	{

   875 		eap_variable_data_c tls_server_use_privacy(m_am_tools);

   876 

   877 		status = get_type_partner()->read_configure(

   878 			cf_str_EAP_TLS_PEAP_use_identity_privacy_server.get_field(),

   879 			&tls_server_use_privacy);

   880 		if (status == eap_status_ok

   881 			&& tls_server_use_privacy.get_is_valid_data() == true

   882 			&& tls_server_use_privacy.get_data_length() == sizeof(u32_t)

   883 			&& tls_server_use_privacy.get_data(sizeof(u32_t)) != 0)

   884 		{

   885 			// This is optional value.

   886 			u32_t *flag = reinterpret_cast<u32_t *>(

   887 				tls_server_use_privacy.get_data(sizeof(u32_t)));

   888 			if (flag != 0)

   889 			{

   890 				if (*flag == 0)

   891 				{

   892 					m_tls_use_identity_privacy = false;

   893 				}

   894 				else

   895 				{

   896 					m_tls_use_identity_privacy = true;

   897 				}

   898 			}

   899 		}

   900 

   901 		status = eap_status_ok;

   902 	}

   903 

   904 #endif //#if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

   905 

   906 	//----------------------------------------------------------

   907 

   908 #if defined(USE_FAST_EAP_TYPE)

   909 	if (m_eap_type == eap_type_fast)

   910 	{

   911 		// Client and server configuration.

   912 		{

   913 			eap_variable_data_c provisioning(m_am_tools);

   914 

   915 			status = get_type_partner()->read_configure(

   916 				cf_str_EAP_FAST_allow_server_unauthenticated_provisioning_mode_ADHP.get_field(),

   917 				&provisioning);

   918 			if (status == eap_status_ok

   919 				&& provisioning.get_is_valid_data() == true

   920 				&& provisioning.get_data_length() == sizeof(u32_t)

   921 				&& provisioning.get_data(sizeof(u32_t)) != 0)

   922 			{

   923 				// This is optional value.

   924 				u32_t *flag = reinterpret_cast<u32_t *>(

   925 					provisioning.get_data(sizeof(u32_t)));

   926 				if (flag != 0)

   927 				{

   928 					if (*flag == 0)

   929 					{

   930 						m_eap_fast_allow_server_unauthenticated_provisioning_mode_ADHP = false;

   931 					}

   932 					else

   933 					{

   934 						m_eap_fast_allow_server_unauthenticated_provisioning_mode_ADHP = true;

   935 					}

   936 				}

   937 			}

   938 

   939 			status = eap_status_ok;

   940 		}

   941 

   942 		{

   943 			eap_variable_data_c allow_server_authenticated_provisioning_mode(m_am_tools);

   944 

   945 			status = read_configure(

   946 				cf_str_EAP_FAST_allow_server_authenticated_provisioning_mode.get_field(),

   947 				&allow_server_authenticated_provisioning_mode);

   948 			if (status == eap_status_ok

   949 				&& allow_server_authenticated_provisioning_mode.get_is_valid_data() == true

   950 				&& allow_server_authenticated_provisioning_mode.get_data_length() == sizeof(u32_t)

   951 				&& allow_server_authenticated_provisioning_mode.get_data(sizeof(u32_t)) != 0)

   952 			{

   953 				// This is optional value.

   954 				u32_t *flag = reinterpret_cast<u32_t *>(

   955 					allow_server_authenticated_provisioning_mode.get_data(sizeof(u32_t)));

   956 				if (flag != 0)

   957 				{

   958 					if (*flag == 0)

   959 					{

   960 						m_fast_allow_server_authenticated_provisioning_mode = false;

   961 					}

   962 					else

   963 					{

   964 						m_fast_allow_server_authenticated_provisioning_mode = true;

   965 					}

   966 				}

   967 			}

   968 

   969 			status = eap_status_ok;

   970 		}

   971 

   972 	}

   973 #endif //#if defined(USE_EAP_TLS_IDENTITY_PRIVACY)

   974 

   975 	//----------------------------------------------------------

   976 

   977 	status = message_hash_init();

   978 	if (status != eap_status_ok)

   979 	{

   980 		EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   981 		return EAP_STATUS_RETURN(m_am_tools, status);

   982 	}

   983 

   984 	//----------------------------------------------------------

   985 

   986 	if (m_application != 0)

   987 	{

   988 		status = m_application->configure();

   989 	}

   990 	else

   991 	{

   992 		status = eap_status_ok;

   993 	}

   994 

   995 	//----------------------------------------------------------

   996 

   997 	EAP_TRACE_END(m_am_tools, TRACE_FLAGS_DEFAULT);

   998 	return EAP_STATUS_RETURN(m_am_tools, status);

   999 }

  1000 

  1001 //--------------------------------------------------

  1002 

  1003 EAP_FUNC_EXPORT eap_status_e tls_record_c::shutdown()

  1004 {

  1005 	EAP_TRACE_BEGIN(m_am_tools, TRACE_FLAGS_DEFAULT);

  1006 

  1007 	EAP_TRACE_DEBUG(

  1008 		m_am_tools,

  1009 		TRACE_FLAGS_DEFAULT,

  1010 		(EAPL("TLS: this = 0x%08x, %s: function: starts: tls_record_c::shutdown():\n"),

  1011 		 this,

  1012 		 (m_is_client == true ? "client": "server")));

  1013 

  1014 	EAP_TRACE_RETURN_STRING(m_am_tools, "returns: tls_record_c::shutdown()");

  1015 

  1016 	if (m_shutdown_was_called == true)

  1017 	{

  1018 		// Shutdown function was called already.

  1019 		return EAP_STATUS_RETURN(m_am_tools, eap_status_ok);

  1020 	}

  1021 	m_shutdown_was_called = true;

  1022 

  1023 	if (m_tls_peap_state != tls_peap_state_tls_success)

  1024 	{

  1025 		set_state(tls_peap_state_failure);

  1026 	}

  1027 

  1028 	eap_status_e status = eap_status_ok;

  1029 

  1030 	if (m_application != 0)

  1031 	{

  1032 		status = m_application->shutdown();

  1033 	}

  1034 

  1035 

  1036 	if (m_pending_query_certificate_authorities_and_types == true)

  1037 	{

  1038 		EAP_TRACE_DEBUG(

  1039 			m_am_tools,

  1040 			TRACE_FLAGS_DEFAULT,

  1041 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_query_certificate_authorities_and_types()\n")));

  1042 

  1043 		m_am_tls_services->cancel_query_certificate_authorities_and_types();

  1044 		m_pending_query_certificate_authorities_and_types = false;

  1045 	}

  1046 

  1047 	if (m_pending_query_certificate_chain == true)

  1048 	{

  1049 		EAP_TRACE_DEBUG(

  1050 			m_am_tools,

  1051 			TRACE_FLAGS_DEFAULT,

  1052 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_query_certificate_chain()\n")));

  1053 

  1054 		m_am_tls_services->cancel_query_certificate_chain();

  1055 		m_pending_query_certificate_chain = false;

  1056 	}

  1057 

  1058 	if (m_pending_query_cipher_suites_and_previous_session == true)

  1059 	{

  1060 		EAP_TRACE_DEBUG(

  1061 			m_am_tools,

  1062 			TRACE_FLAGS_DEFAULT,

  1063 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_query_cipher_suites_and_previous_session()\n")));

  1064 

  1065 		m_am_tls_services->cancel_query_cipher_suites_and_previous_session();

  1066 		m_pending_query_cipher_suites_and_previous_session = false;

  1067 	}

  1068 

  1069 	if (m_pending_query_dh_parameters == true)

  1070 	{

  1071 		EAP_TRACE_DEBUG(

  1072 			m_am_tools,

  1073 			TRACE_FLAGS_DEFAULT,

  1074 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_query_dh_parameters()\n")));

  1075 

  1076 		m_am_tls_services->cancel_query_dh_parameters();

  1077 		m_pending_query_dh_parameters = false;

  1078 	}

  1079 

  1080 	if (m_pending_query_realm == true)

  1081 	{

  1082 		EAP_TRACE_DEBUG(

  1083 			m_am_tools,

  1084 			TRACE_FLAGS_DEFAULT,

  1085 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_query_realm()\n")));

  1086 

  1087 		m_am_tls_services->cancel_query_realm();

  1088 		m_pending_query_realm = false;

  1089 	}

  1090 

  1091 	if (m_pending_select_cipher_suite_and_check_session_id == true)

  1092 	{

  1093 		EAP_TRACE_DEBUG(

  1094 			m_am_tools,

  1095 			TRACE_FLAGS_DEFAULT,

  1096 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_select_cipher_suite_and_check_session_id()\n")));

  1097 

  1098 		m_am_tls_services->cancel_select_cipher_suite_and_check_session_id();

  1099 		m_pending_select_cipher_suite_and_check_session_id = false;

  1100 	}

  1101 

  1102 	if (m_pending_verify_certificate_chain == true)

  1103 	{

  1104 		EAP_TRACE_DEBUG(

  1105 			m_am_tools,

  1106 			TRACE_FLAGS_DEFAULT,

  1107 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_verify_certificate_chain()\n")));

  1108 

  1109 		m_am_tls_services->cancel_verify_certificate_chain();

  1110 		m_pending_verify_certificate_chain = false;

  1111 	}

  1112 

  1113 	if (m_pending_rsa_decrypt_with_private_key == true)

  1114 	{

  1115 		EAP_TRACE_DEBUG(

  1116 			m_am_tools,

  1117 			TRACE_FLAGS_DEFAULT,

  1118 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_rsa_decrypt_with_private_key()\n")));

  1119 

  1120 		m_am_tls_services->cancel_rsa_decrypt_with_private_key();

  1121 		m_pending_rsa_decrypt_with_private_key = false;

  1122 	}

  1123 

  1124 	if (m_pending_rsa_encrypt_with_public_key == true)

  1125 	{

  1126 		EAP_TRACE_DEBUG(

  1127 			m_am_tools,

  1128 			TRACE_FLAGS_DEFAULT,

  1129 			(EAPL("TLS: function: tls_record_c::shutdown(): calls cancel_rsa_encrypt_with_public_key()\n")));

  1130 

  1131 		m_am_tls_services->cancel_rsa_encrypt_with_public_key();

  1132 		m_pending_rsa_encrypt_with_public_key = false;

  1133 	}

  1134