1 /*

     2 * Copyright (c) 2001-2006 Nokia Corporation and/or its subsidiary(-ies).

     3 * All rights reserved.

     4 * This component and the accompanying materials are made available

     5 * under the terms of the License "Eclipse Public License v1.0"

     6 * which accompanies this distribution, and is available

     7 * at the URL "http://www.eclipse.org/legal/epl-v10.html".

     8 *

     9 * Initial Contributors:

    10 * Nokia Corporation - initial contribution.

    11 *

    12 * Contributors:

    13 *

    14 * Description:  EAP and WLAN authentication protocols.

    15 *

    16 */

    17 

    18 

    19 

    20 

    21 #if !defined(_EAP_AM_TYPE_AKA_SYMBIAN_H_)

    22 #define _EAP_AM_TYPE_AKA_SYMBIAN_H_

    23 

    24 

    25 //  INCLUDES

    26 

    27 #include <EapType.h>

    28 #include <d32dbms.h>

    29 #include "eap_tools.h"

    30 #include "eap_am_export.h"

    31 #include "abs_eap_base_type.h"

    32 

    33 #include "eap_am_type_aka.h"

    34 #include "abs_eap_am_aka_algorithm.h"

    35 

    36 // FORWARD DECLARATIONS

    37 class eap_am_tools_symbian_c;

    38 class CEapAkaInterface;

    39 

    40 // For the server side.

    41 const u32_t MAX_PSEUDONYM_USE_COUNT = 1;

    42 const u32_t MAX_REAUTH_USE_COUNT = 3;

    43 

    44 

    45 // CLASS DECLARATION

    46 

    47 /**

    48 * Class that implements the operating system dependent portion of 

    49 * EAP AKA protocol for Symbian OS.

    50 */

    51 

    52 

    53 class EAP_EXPORT eap_am_type_aka_symbian_c

    54 : public CBase, public eap_am_type_aka_c

    55 {

    56 public:

    57 	//--------------------------------------------------

    58 	

    59 	EAP_FUNC_IMPORT static eap_am_type_aka_symbian_c* NewL(

    60 		abs_eap_am_tools_c * const aTools,

    61 		abs_eap_base_type_c * const aPartner,

    62 		const TIndexType aIndexType,

    63 		const TInt aIndex,

    64 		const eap_type_value_e aTunnelingType,

    65 		const bool aIsClient,

    66 		const eap_am_network_id_c * const receive_network_id);

    67 		

    68 	// 

    69 	EAP_FUNC_IMPORT virtual ~eap_am_type_aka_symbian_c();	

    70 	

    71 	

    72 	/**  From the parent eap_am_type_aka_c **/

    73 

    74 	EAP_FUNC_IMPORT eap_status_e configure();

    75 

    76 	EAP_FUNC_IMPORT eap_status_e reset();

    77 

    78 	/**

    79 	 * The shutdown() function is called before the destructor of the 

    80 	 * object is executed. During the function call the object 

    81 	 * could shutdown the operations, for example cancel timers.

    82 	 * Each derived class must define this function.

    83 	 */

    84 	EAP_FUNC_IMPORT eap_status_e shutdown();

    85 

    86 	/** AKA client calls this function.

    87 	 *  AKA AM could store copy of pseudonym identity to favourite place for future use.

    88 	 *  If parameter pseudonym is NULL pointer, AM should reset the existing pseudonym.

    89 	 */

    90 	EAP_FUNC_IMPORT eap_status_e store_pseudonym_id(

    91 		const eap_am_network_id_c * const send_network_id,

    92 		const eap_variable_data_c * const pseudonym);

    93 

    94 	/** AKA client calls this function.

    95 	 *  AKA AM could store copy of reauthentication identity to favourite place for future use.

    96 	 *  If parameter reauthentication_identity is NULL pointer, AM should reset the existing reauthentication identity.

    97 	 */

    98 	EAP_FUNC_IMPORT eap_status_e store_reauthentication_id(

    99 		const eap_am_network_id_c * const send_network_id,

   100 		const eap_variable_data_c * const reauthentication_identity);

   101 

   102 	/** AKA server and client calls this function.

   103 	 * In order to use re-authentication, the client and the server need to

   104 	 * store the following values: original XKEY, K_aut, K_encr, latest

   105 	 * counter value and the next re-authentication identity.

   106 	 * This function stores original XKEY, K_aut, K_encr and latest

   107 	 * counter value.

   108 	 */

   109 	EAP_FUNC_IMPORT eap_status_e store_reauth_parameters(

   110 		const eap_variable_data_c * const XKEY,

   111 		const eap_variable_data_c * const K_aut,

   112 		const eap_variable_data_c * const K_encr,

   113 		const u32_t reauth_counter);

   114 

   115 	/** AKA client calls this function.

   116 	 *  AKA AM could do finishing operations to databases etc. based on authentication status and type.

   117 	 */

   118 	EAP_FUNC_IMPORT eap_status_e authentication_finished(

   119 		const bool true_when_successfull,

   120 		const eap_aka_authentication_type_e authentication_type,

   121 		const eap_type_aka_identity_type identity_type);

   122 

   123 	/** AKA server and client calls this function.

   124 	 * In order to use re-authentication, the client and the server need to

   125 	 * store the following values: original XKEY, K_aut, K_encr, latest

   126 	 * counter value and the next re-authentication identity.

   127 	 */

   128 	EAP_FUNC_IMPORT eap_status_e query_reauth_parameters(

   129 		eap_variable_data_c * const XKEY,

   130 		eap_variable_data_c * const K_aut,

   131 		eap_variable_data_c * const K_encr,

   132 		u32_t * const reauth_counter);

   133 

   134 	/** AKA server and client calls this function.

   135 	 *  This function increases re-authentication counter after a successfull re-authentication.

   136 	 */

   137 	EAP_FUNC_IMPORT eap_status_e increase_reauth_counter();

   138 

   139 	/** AKA client calls this function.

   140 	 *  AM could copy IMSI or pseudonym to output parameters.

   141 	 *  AM must copy IMSI or pseudonym to output parameters.

   142 	 *  This function could be completed asyncronously with abs_eap_am_type_aka_c::complete_AKA_IMSI_or_pseudonym_or_reauthentication_id_query() function call.

   143 	 */

   144 	EAP_FUNC_IMPORT eap_status_e query_AKA_IMSI_or_pseudonym_or_reauthentication_id(

   145 		eap_variable_data_c * const IMSI,

   146 		eap_variable_data_c * const pseudonym_identity,

   147 		eap_variable_data_c * const reauthentication_identity,

   148 		eap_variable_data_c * const automatic_realm, ///< If this is not used, do not add any data to this parameter.

   149 		u32_t * const length_of_mnc,

   150 		const aka_payload_AT_type_e required_identity, ///< This parameter indicated the type of identity required.

   151 		const eap_type_aka_complete_e required_completion, ///< This parameter tells the required completion after this call is completed, if this is asyncronous. Use this value with abs_eap_am_type_aka_c::complete_AKA_IMSI_or_pseudonym_or_reauthentication_id_query() function call.

   152 		const u8_t received_eap_identifier ///< This is the EAP-identifier of the received EAP-request message. Use this value with abs_eap_am_type_aka_c::complete_AKA_IMSI_or_pseudonym_or_reauthentication_id_query() function call.

   153 		);

   154 

   155 	/** AKA client calls this function.

   156 	 *  This call cancels asyncronous query_AKA_IMSI_or_pseudonym_or_reauthentication_id() function call.

   157 	 *  AM must not complete query_AKA_IMSI_or_pseudonym_or_reauthentication_id()

   158 	 *  with abs_eap_am_type_aka_c::complete_AKA_IMSI_or_pseudonym_or_reauthentication_id_query() after

   159 	 *  cancel_AKA_IMSI_or_pseudonym_or_reauthentication_id_query() call.

   160 	 */

   161 	EAP_FUNC_IMPORT eap_status_e cancel_AKA_IMSI_or_pseudonym_or_reauthentication_id_query();

   162 

   163 

   164 	/** AKA client calls this function.

   165 	 *  Input parameter RAND and AUTN as input to AKA algorithm.

   166 	 *  AM could copy CK, IK and RES to output parameters.

   167 	 *  This function could be completed asyncronously with abs_eap_am_type_aka_c::complete_AKA_RES_query() function call.

   168 	 */

   169 	EAP_FUNC_IMPORT eap_status_e query_AKA_RES(

   170 		eap_type_aka_authentication_vector_c * const authentication_vector);

   171 

   172 	/** AKA client calls this function.

   173 	 *  This call cancels asyncronous query_AKA_RES() function call.

   174 	 *  AM must not complete query_AKA_RES()

   175 	 *  with abs_eap_am_type_aka_c::complete_AKA_RES_query() after

   176 	 *  cancel_AKA_RES_query() call.

   177 	 */

   178 	EAP_FUNC_IMPORT eap_status_e cancel_AKA_RES_query();

   179 

   180 	/** AKA client calls this function.

   181 	 *  Received AT_NOTIFICATION is handled in AM of AKA.

   182 	 *  AM could show localized message to user.

   183 	 */

   184 	EAP_FUNC_IMPORT eap_status_e handle_aka_notification(eap_aka_notification_codes_e aka_notification_code);

   185 

   186 	/** AKA server calls this function.

   187 	 *  AM could copy triplets to output parameters.

   188 	 *  This function could be completed asyncronously with abs_eap_am_type_aka_c::complete_AKA_authentication_vector_query() function call.

   189 	 */

   190 	EAP_FUNC_IMPORT eap_status_e query_AKA_authentication_vector(

   191 		const eap_variable_data_c * const username, ///< // This is payload AT_IDENTITY. If this is uninitialized then imsi must be initialized.

   192 		const u8_t next_eap_identifier,

   193 		eap_variable_data_c * const imsi, ///< This is the real IMSI. If this is uninitialized then username must be initialized and imsi will be initialized after this call.

   194 		eap_type_aka_authentication_vector_c * const authentication_vector,

   195 		eap_type_aka_identity_type * const type);

   196 

   197 	/** AKA server calls this function.

   198 	 *  This call cancels asyncronous query_AKA_authentication_vector() function call.

   199 	 *  AM must not complete query_AKA_authentication_vector() with abs_eap_am_type_aka_c::complete_AKA_authentication_vector_query() after

   200 	 *  cancel_AKA_authentication_vector_query() call.

   201 	 */

   202 	EAP_FUNC_IMPORT eap_status_e cancel_AKA_authentication_vector_query();

   203 

   204 	/** AKA server/client calls this function.

   205 	 *  This function call generates with a good source of

   206 	 *  randomness the initialization vector (AT_IV payload).

   207 	 */

   208 	EAP_FUNC_IMPORT eap_status_e generate_encryption_IV(

   209 		eap_variable_data_c * const encryption_IV,

   210 		const u32_t IV_length);

   211 

   212 	/** AKA server calls this function.

   213 	 *  New pseudonym identity is generated for IMSI.

   214 	 *  Algorithm is freely selected. Look at query_imsi_from_username().

   215 	 *  Pseudonym identity is copied to pseudonym_identity parameter.

   216 	 *  Maximum length of pseudonym is maximum_pseudonym_length bytes.

   217 	 */

   218 	EAP_FUNC_IMPORT eap_status_e generate_pseudonym_id(

   219 		const eap_am_network_id_c * const send_network_id,

   220 		const eap_variable_data_c * const imsi,

   221 		eap_variable_data_c * const pseudonym_identity,

   222 		const u32_t maximum_pseudonym_length);

   223 

   224 	/** AKA server calls this function.

   225 	 *  New reauthentication identity is generated for IMSI.

   226 	 *  Algorithm is freely selected. Look at query_imsi_from_username().

   227 	 *  Reauthentication identity is copied to pseudonym parameter.

   228 	 *  Maximum length of pseudonym is maximum_reauthentication_identity_length bytes.

   229 	 */

   230 	EAP_FUNC_IMPORT eap_status_e generate_reauthentication_id(

   231 		const eap_am_network_id_c * const send_network_id,

   232 		const eap_variable_data_c * const imsi,

   233 		eap_variable_data_c * const reauthentication_identity,

   234 		const u32_t maximum_reauthentication_identity_length);

   235 

   236 	/** AKA server calls this function.

   237 	 *  Server queries IMSI with username.

   238 	 *  Username could be IMSI, pseudonym or re-authentication identity.

   239 	 *  Adaptation module must verify which username is.

   240 	 *  Adaptation module could map IMSI and username as it wish.

   241 	 *  It can select any algorithm. Look at generate_pseudonym_id() and generate_reauthentication_id().

   242 	 *  Function must return IMSI and set the identity type of received username.

   243 	 */

   244 	EAP_FUNC_IMPORT eap_status_e query_imsi_from_username(

   245 		const u8_t next_eap_identifier,

   246 		const eap_am_network_id_c * const send_network_id,

   247 		const eap_variable_data_c * const username,

   248 		eap_variable_data_c * const imsi,

   249 		eap_type_aka_identity_type * const type,

   250 		const eap_type_aka_complete_e completion_action);

   251 

   252 	/** AKA server calls this function.

   253 	 *  Server queries re-syncronization.

   254 	 *  This function call is completed by complete_re_syncronization_query() function.

   255 	 */

   256 	EAP_FUNC_IMPORT eap_status_e query_re_syncronization(

   257 		const u8_t next_eap_identifier,

   258 		eap_type_aka_authentication_vector_c * const authentication_vector

   259 		);

   260 

   261 	/** AKA server calls this function.

   262 	 *  This call cancels asyncronous query_imsi_from_username() function call.

   263 	 *  AM must not complete query_imsi_from_username()

   264 	 *  with abs_eap_am_type_aka_c::complete_imsi_from_username() after

   265 	 *  cancel_imsi_from_username_query() call.

   266 	 */

   267 	EAP_FUNC_IMPORT eap_status_e cancel_imsi_from_username_query();

   268 

   269 	/**

   270 	 * The type_configure_read() function reads the configuration data identified

   271 	 * by the field string of field_length bytes length. Adaptation module must direct

   272 	 * the query to some persistent store.

   273 	 * @param field is generic configure string idenfying the required configure data.

   274 	 * @param field_length is length of the field string.

   275 	 * @param data is pointer to existing eap_variable_data object.

   276 	 */

   277 	EAP_FUNC_IMPORT eap_status_e type_configure_read(

   278 		const eap_configuration_field_c * const field,

   279 		eap_variable_data_c * const data);

   280 

   281 	/**

   282 	 * The type_configure_write() function writes the configuration data identified

   283 	 * by the field string of field_length bytes length. Adaptation module must direct

   284 	 * the action to some persistent store.

   285 	 * @param field is generic configure string idenfying the required configure data.

   286 	 * @param field_length is length of the field string.

   287 	 * @param data is pointer to existing eap_variable_data object.

   288 	 */

   289 	EAP_FUNC_IMPORT eap_status_e type_configure_write(

   290 		const eap_configuration_field_c * const field,

   291 		eap_variable_data_c * const data);		

   292 

   293 	EAP_FUNC_IMPORT void set_is_valid();

   294 

   295 	EAP_FUNC_IMPORT bool get_is_valid();

   296 	

   297 #if defined(__WINS__)

   298 	

   299 	EAP_FUNC_IMPORT eap_status_e query_SIM_imsi(

   300 		u8_t * const imsi, const u32_t max_length, u32_t * const imsi_length);

   301 		

   302 #endif //#if defined(__WINS__)

   303 	

   304 	EAP_FUNC_IMPORT eap_status_e complete_AKA_imsi_L(

   305 		const eap_variable_data_c * const IMSI,

   306 		const eap_status_e completion_status = eap_status_ok);

   307 		

   308 	EAP_FUNC_IMPORT eap_status_e complete_AKA_RES_L(

   309 		eap_variable_data_c * const aRES, 

   310 		eap_variable_data_c * const aCK,

   311 		eap_variable_data_c * const aIK,

   312 		eap_variable_data_c * const aAUTS,

   313 		eap_status_e authenticationStatus = eap_status_ok,

   314 		const eap_status_e completion_status = eap_status_ok);

   315 		

   316 	/**

   317 	 * Returns true if the full authenticated session is valid.

   318 	 * It finds the difference between current time and the 

   319 	 * last full authentication time. If the difference is less than the

   320 	 * Maximum Session Validity Time, then session is valid, returns true.

   321 	 * Otherwise returns false. 

   322 	 * Full authentication should be done if the session is not valid.

   323 	 */

   324 	EAP_FUNC_IMPORT bool is_session_valid();

   325 

   326 	//--------------------------------------------------

   327 protected:

   328 	//--------------------------------------------------

   329 

   330 	eap_am_type_aka_symbian_c(

   331 		abs_eap_am_tools_c * const tools,

   332 		abs_eap_base_type_c * const partner,

   333 		const TIndexType aIndexType,

   334 		const TInt aIndex,

   335 		const eap_type_value_e aTunnelingType,

   336 		const bool aIsClient,

   337 		const eap_am_network_id_c * const receive_network_id);

   338 	

   339 

   340 	void ConstructL();

   341 

   342 	//--------------------------------------------------

   343 

   344 private:

   345 

   346 	void type_configure_readL(

   347 		eap_config_string field,

   348 		const u32_t field_length,

   349 		eap_variable_data_c * const data);

   350 

   351 	void store_reauth_parametersL(

   352 		const eap_variable_data_c * const XKEY,

   353 		const eap_variable_data_c * const K_aut,

   354 		const eap_variable_data_c * const K_encr,

   355 		const u32_t reauth_counter);

   356 	

   357 	void query_reauth_parametersL(

   358 		eap_variable_data_c * const reauth_XKEY,

   359 		eap_variable_data_c * const reauth_K_aut,

   360 		eap_variable_data_c * const reauth_K_encr,

   361 		u32_t * const reauth_counter);

   362 

   363 	void increase_reauth_counterL();

   364 	

   365 	void query_AKA_IMSI_or_pseudonym_or_reauthentication_idL(

   366 		eap_variable_data_c * const IMSI,

   367 		eap_variable_data_c * const pseudonym_identity,

   368 		eap_variable_data_c * const reauthentication_identity,

   369 		eap_variable_data_c * const automatic_realm, ///< If this is not used, do not add any data to this parameter.

   370 		const aka_payload_AT_type_e required_identity,

   371 		const eap_type_aka_complete_e required_completion,

   372 		const u8_t received_eap_identifier);	

   373 

   374 	void store_pseudonym_idL(

   375 		const eap_am_network_id_c * const /*network_id*/,

   376 		const eap_variable_data_c * const pseudonym);

   377 

   378 	void store_reauthentication_idL(

   379 		const eap_am_network_id_c * const /*network_id*/,

   380 		const eap_variable_data_c * const /* reauthentication_id */);

   381 

   382 #if defined (USE_EAP_TYPE_SERVER_AKA)

   383 	// These functions are used only for server side.

   384 	

   385 	eap_status_e generate_identity(

   386 		const eap_type_aka_identity_type identity_type,

   387 		const eap_variable_data_c * const imsi,

   388 		eap_variable_data_c * const pseudonym,

   389 		const u32_t maximum_pseudonym_length);

   390 			

   391 	eap_status_e query_imsi_from_username_syncronous(

   392 		const u8_t next_eap_identifier,

   393 		const eap_am_network_id_c * const network_id,

   394 		const eap_variable_data_c * const username,

   395 		eap_variable_data_c * const imsi,

   396 		eap_type_aka_identity_type * const identity_type);		

   397 		

   398 #endif // #if defined (USE_EAP_TYPE_SERVER_AKA)		

   399 	

   400 	eap_status_e store_imsi(const eap_variable_data_c * const imsi);

   401 

   402 	void store_imsiL(const eap_variable_data_c * const imsi);

   403 			

   404 	eap_status_e check_is_valid_imsi( const eap_variable_data_c * const username );		

   405 

   406 	void send_error_notification(const eap_status_e error);

   407 	

   408 	/**

   409 	 * Returns true if the full authenticated session is valid.

   410 	 * It finds the difference between current time and the 

   411 	 * last full authentication time. If the difference is less than the

   412 	 * Maximum Session Validity Time, then session is valid, returns true.

   413 	 * Otherwise returns false. 

   414 	 * Full authentication should be done if the session is not valid.

   415 	 */

   416 	bool is_session_validL();

   417 	

   418 	/**

   419 	 * Stores current universal time as the the full authentication time

   420 	 * in the database. Returns KErrNone if storing succeeds.

   421 	 */

   422 	void store_authentication_timeL();

   423 

   424 private:

   425 	//--------------------------------------------------

   426 	RDbs m_session;

   427 	

   428 	RDbNamedDatabase m_database;	

   429 

   430 	eap_am_tools_symbian_c * const m_am_tools;

   431 

   432 	abs_eap_base_type_c * const m_partner;

   433 

   434 	eap_variable_data_c m_nai_realm;

   435 

   436 	TIndexType m_index_type;

   437 	

   438 	TInt m_index;

   439 

   440 	eap_type_value_e m_tunneling_type;

   441 

   442 	bool m_is_valid;

   443 

   444 	bool m_is_client;

   445 

   446 	eap_variable_data_c m_stored_reauth_id;

   447 	

   448 	eap_variable_data_c m_stored_pseudonym;

   449 	

   450 	eap_variable_data_c m_previous_imsi;

   451 

   452 	eap_type_aka_complete_e m_stored_required_completion;

   453 	

   454 	u8_t m_stored_received_eap_identifier;

   455 

   456 	bool m_shutdown_was_called;

   457 

   458 	abs_eap_am_aka_algorithm_c *m_aka_algorithm;

   459 	

   460 	CEapAkaInterface* m_aka_if;	

   461 	

   462 	eap_variable_data_c m_simulator_aka_K;

   463 	eap_variable_data_c m_simulator_aka_OP;

   464 	eap_variable_data_c m_simulator_aka_AMF;

   465 	

   466 	eap_type_aka_authentication_vector_c * m_authentication_vector;

   467 	

   468 	eap_variable_data_c m_pseudonym_identity;

   469 	eap_variable_data_c m_reauthentication_identity;

   470 	eap_variable_data_c m_username;

   471 	eap_am_network_id_c m_receive_network_id;

   472 

   473 	eap_variable_data_c m_IMSI;

   474 

   475 	aka_payload_AT_type_e m_required_identity;

   476 	eap_type_aka_complete_e m_required_completion;

   477 	eap_type_aka_identity_type m_identity_type;

   478 	eap_type_aka_complete_e m_completion_action;

   479 	u8_t m_next_eap_identifier;

   480 		

   481 	eap_aka_authentication_vector_status_e m_aka_authentication_vector_status;

   482 	u32_t m_pseudonym_key_index;

   483 	eap_variable_data_c m_pseudonym_key;

   484 	eap_variable_data_c m_pseudonym_MAC_key;

   485 	eap_variable_data_c m_prev_pseudonym_key;

   486 	eap_variable_data_c m_prev_pseudonym_MAC_key;

   487 	u32_t m_pseudonym_key_use_count;

   488 	

   489 	// These values are needed especially in the case of synchronization failure.

   490 	eap_variable_data_c m_RAND;

   491 	eap_variable_data_c m_AUTN;

   492 

   493 	// This holds the max session time read from the configuration file.

   494 	TInt64 m_max_session_time;

   495 	

   496 	// This is the vendor-type for tunneling EAP type.

   497 	// Valid for both expanded and non-expanded EAP types.

   498 	// This is used since m_tunneling_type can not be used in the same way 

   499 	// in expanded and non-expanded cases. 

   500 	// Unlike EAP type, Tunneling type is still non-expanded

   501 	// for both cases especially for using in the EAP databases.

   502 	u32_t m_tunneling_vendor_type;	

   503 	

   504 }; // class eap_am_type_aka_symbian_c

   505 

   506 

   507 #endif //#if !defined(_EAP_AM_TYPE_AKA_SYMBIAN_H_)

   508 

   509 //--------------------------------------------------

   510 

   511 

   512 

   513 // End of file