• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * EAP peer method: EAP-AKA (RFC 4187) and EAP-AKA' (RFC 5448)
3  * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "utils/base64.h"
13 #include "pcsc_funcs.h"
14 #include "crypto/crypto.h"
15 #include "crypto/sha1.h"
16 #include "crypto/sha256.h"
17 #include "crypto/milenage.h"
18 #include "eap_common/eap_sim_common.h"
19 #include "eap_config.h"
20 #include "eap_i.h"
21 
22 
23 struct eap_aka_data {
24 	u8 ik[EAP_AKA_IK_LEN], ck[EAP_AKA_CK_LEN], res[EAP_AKA_RES_MAX_LEN];
25 	size_t res_len;
26 	u8 nonce_s[EAP_SIM_NONCE_S_LEN];
27 	u8 mk[EAP_SIM_MK_LEN];
28 	u8 k_aut[EAP_AKA_PRIME_K_AUT_LEN];
29 	u8 k_encr[EAP_SIM_K_ENCR_LEN];
30 	u8 k_re[EAP_AKA_PRIME_K_RE_LEN]; /* EAP-AKA' only */
31 	u8 msk[EAP_SIM_KEYING_DATA_LEN];
32 	u8 emsk[EAP_EMSK_LEN];
33 	u8 rand[EAP_AKA_RAND_LEN], autn[EAP_AKA_AUTN_LEN];
34 	u8 auts[EAP_AKA_AUTS_LEN];
35 	u8 reauth_mac[EAP_SIM_MAC_LEN];
36 
37 	int num_id_req, num_notification;
38 	u8 *pseudonym;
39 	size_t pseudonym_len;
40 	u8 *reauth_id;
41 	size_t reauth_id_len;
42 	int reauth;
43 	unsigned int counter, counter_too_small;
44 	u8 *last_eap_identity;
45 	size_t last_eap_identity_len;
46 	enum {
47 		CONTINUE, RESULT_SUCCESS, SUCCESS, FAILURE
48 	} state;
49 
50 	struct wpabuf *id_msgs;
51 	int prev_id;
52 	int result_ind, use_result_ind;
53 	int use_pseudonym;
54 	u8 eap_method;
55 	u8 *network_name;
56 	size_t network_name_len;
57 	u16 kdf;
58 	int kdf_negotiation;
59 	u16 last_kdf_attrs[EAP_AKA_PRIME_KDF_MAX];
60 	size_t last_kdf_count;
61 	int error_code;
62 	struct crypto_rsa_key *imsi_privacy_key;
63 };
64 
65 
66 #ifndef CONFIG_NO_STDOUT_DEBUG
eap_aka_state_txt(int state)67 static const char * eap_aka_state_txt(int state)
68 {
69 	switch (state) {
70 	case CONTINUE:
71 		return "CONTINUE";
72 	case RESULT_SUCCESS:
73 		return "RESULT_SUCCESS";
74 	case SUCCESS:
75 		return "SUCCESS";
76 	case FAILURE:
77 		return "FAILURE";
78 	default:
79 		return "?";
80 	}
81 }
82 #endif /* CONFIG_NO_STDOUT_DEBUG */
83 
84 
eap_aka_state(struct eap_aka_data * data,int state)85 static void eap_aka_state(struct eap_aka_data *data, int state)
86 {
87 	wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
88 		   eap_aka_state_txt(data->state),
89 		   eap_aka_state_txt(state));
90 	data->state = state;
91 }
92 
93 
eap_aka_init(struct eap_sm * sm)94 static void * eap_aka_init(struct eap_sm *sm)
95 {
96 	struct eap_aka_data *data;
97 	const char *phase1 = eap_get_config_phase1(sm);
98 	struct eap_peer_config *config = eap_get_config(sm);
99 
100 	data = os_zalloc(sizeof(*data));
101 	if (data == NULL)
102 		return NULL;
103 
104 	data->eap_method = EAP_TYPE_AKA;
105 
106 	if (config && config->imsi_privacy_key) {
107 #ifdef CRYPTO_RSA_OAEP_SHA256
108 		data->imsi_privacy_key = crypto_rsa_key_read(
109 			config->imsi_privacy_key, false);
110 		if (!data->imsi_privacy_key) {
111 			wpa_printf(MSG_ERROR,
112 				   "EAP-AKA: Failed to read/parse IMSI privacy key %s",
113 				   config->imsi_privacy_key);
114 			os_free(data);
115 			return NULL;
116 		}
117 #else /* CRYPTO_RSA_OAEP_SHA256 */
118 		wpa_printf(MSG_ERROR,
119 			   "EAP-AKA: No support for imsi_privacy_key in the build");
120 		os_free(data);
121 		return NULL;
122 #endif /* CRYPTO_RSA_OAEP_SHA256 */
123 	}
124 
125 	/* Zero is a valid error code, so we need to initialize */
126 	data->error_code = NO_EAP_METHOD_ERROR;
127 
128 	eap_aka_state(data, CONTINUE);
129 	data->prev_id = -1;
130 
131 	data->result_ind = phase1 && os_strstr(phase1, "result_ind=1") != NULL;
132 
133 	data->use_pseudonym = !sm->init_phase2;
134 	if (config && config->anonymous_identity && data->use_pseudonym) {
135 		data->pseudonym = os_malloc(config->anonymous_identity_len);
136 		if (data->pseudonym) {
137 			os_memcpy(data->pseudonym, config->anonymous_identity,
138 				  config->anonymous_identity_len);
139 			data->pseudonym_len = config->anonymous_identity_len;
140 		}
141 	}
142 
143 	return data;
144 }
145 
146 
147 #ifdef EAP_AKA_PRIME
eap_aka_prime_init(struct eap_sm * sm)148 static void * eap_aka_prime_init(struct eap_sm *sm)
149 {
150 	struct eap_aka_data *data = eap_aka_init(sm);
151 	if (data == NULL)
152 		return NULL;
153 	data->eap_method = EAP_TYPE_AKA_PRIME;
154 	return data;
155 }
156 #endif /* EAP_AKA_PRIME */
157 
158 
eap_aka_clear_keys(struct eap_aka_data * data,int reauth)159 static void eap_aka_clear_keys(struct eap_aka_data *data, int reauth)
160 {
161 	if (!reauth) {
162 		os_memset(data->mk, 0, EAP_SIM_MK_LEN);
163 		os_memset(data->k_aut, 0, EAP_AKA_PRIME_K_AUT_LEN);
164 		os_memset(data->k_encr, 0, EAP_SIM_K_ENCR_LEN);
165 		os_memset(data->k_re, 0, EAP_AKA_PRIME_K_RE_LEN);
166 	}
167 	os_memset(data->msk, 0, EAP_SIM_KEYING_DATA_LEN);
168 	os_memset(data->emsk, 0, EAP_EMSK_LEN);
169 	os_memset(data->autn, 0, EAP_AKA_AUTN_LEN);
170 	os_memset(data->auts, 0, EAP_AKA_AUTS_LEN);
171 }
172 
173 
eap_aka_deinit(struct eap_sm * sm,void * priv)174 static void eap_aka_deinit(struct eap_sm *sm, void *priv)
175 {
176 	struct eap_aka_data *data = priv;
177 	if (data) {
178 		os_free(data->pseudonym);
179 		os_free(data->reauth_id);
180 		os_free(data->last_eap_identity);
181 		wpabuf_free(data->id_msgs);
182 		os_free(data->network_name);
183 		eap_aka_clear_keys(data, 0);
184 #ifdef CRYPTO_RSA_OAEP_SHA256
185 		crypto_rsa_key_free(data->imsi_privacy_key);
186 #endif /* CRYPTO_RSA_OAEP_SHA256 */
187 		os_free(data);
188 	}
189 }
190 
191 
eap_aka_ext_sim_req(struct eap_sm * sm,struct eap_aka_data * data)192 static int eap_aka_ext_sim_req(struct eap_sm *sm, struct eap_aka_data *data)
193 {
194 	char req[200], *pos, *end;
195 
196 	wpa_printf(MSG_DEBUG, "EAP-AKA: Use external USIM processing");
197 	pos = req;
198 	end = pos + sizeof(req);
199 	pos += os_snprintf(pos, end - pos, "UMTS-AUTH");
200 	pos += os_snprintf(pos, end - pos, ":");
201 	pos += wpa_snprintf_hex(pos, end - pos, data->rand, EAP_AKA_RAND_LEN);
202 	pos += os_snprintf(pos, end - pos, ":");
203 	wpa_snprintf_hex(pos, end - pos, data->autn, EAP_AKA_AUTN_LEN);
204 
205 	eap_sm_request_sim(sm, req);
206 	return 1;
207 }
208 
209 
eap_aka_ext_sim_result(struct eap_sm * sm,struct eap_aka_data * data,struct eap_peer_config * conf)210 static int eap_aka_ext_sim_result(struct eap_sm *sm, struct eap_aka_data *data,
211 				  struct eap_peer_config *conf)
212 {
213 	char *resp, *pos;
214 
215 	wpa_printf(MSG_DEBUG,
216 		   "EAP-AKA: Use result from external USIM processing");
217 
218 	resp = conf->external_sim_resp;
219 	conf->external_sim_resp = NULL;
220 
221 	if (os_strncmp(resp, "UMTS-AUTS:", 10) == 0) {
222 		pos = resp + 10;
223 		if (hexstr2bin(pos, data->auts, EAP_AKA_AUTS_LEN) < 0)
224 			goto invalid;
225 		wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: AUTS", data->auts,
226 				EAP_AKA_AUTS_LEN);
227 		os_free(resp);
228 		return -2;
229 	}
230 
231 	if (os_strncmp(resp, "UMTS-AUTH:", 10) != 0) {
232 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized external USIM processing response");
233 		os_free(resp);
234 		return -1;
235 	}
236 
237 	pos = resp + 10;
238 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: RAND", data->rand, EAP_AKA_RAND_LEN);
239 
240 	if (hexstr2bin(pos, data->ik, EAP_AKA_IK_LEN) < 0)
241 		goto invalid;
242 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", data->ik, EAP_AKA_IK_LEN);
243 	pos += EAP_AKA_IK_LEN * 2;
244 	if (*pos != ':')
245 		goto invalid;
246 	pos++;
247 
248 	if (hexstr2bin(pos, data->ck, EAP_AKA_CK_LEN) < 0)
249 		goto invalid;
250 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", data->ck, EAP_AKA_CK_LEN);
251 	pos += EAP_AKA_CK_LEN * 2;
252 	if (*pos != ':')
253 		goto invalid;
254 	pos++;
255 
256 	data->res_len = os_strlen(pos) / 2;
257 	if (data->res_len > EAP_AKA_RES_MAX_LEN) {
258 		data->res_len = 0;
259 		goto invalid;
260 	}
261 	if (hexstr2bin(pos, data->res, data->res_len) < 0)
262 		goto invalid;
263 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: RES", data->res, data->res_len);
264 
265 	os_free(resp);
266 	return 0;
267 
268 invalid:
269 	wpa_printf(MSG_DEBUG, "EAP-AKA: Invalid external USIM processing UMTS-AUTH response");
270 	os_free(resp);
271 	return -1;
272 }
273 
274 
eap_aka_umts_auth(struct eap_sm * sm,struct eap_aka_data * data)275 static int eap_aka_umts_auth(struct eap_sm *sm, struct eap_aka_data *data)
276 {
277 	struct eap_peer_config *conf;
278 
279 	wpa_printf(MSG_DEBUG, "EAP-AKA: UMTS authentication algorithm");
280 
281 	conf = eap_get_config(sm);
282 	if (conf == NULL)
283 		return -1;
284 
285 	if (sm->external_sim) {
286 		if (conf->external_sim_resp)
287 			return eap_aka_ext_sim_result(sm, data, conf);
288 		else
289 			return eap_aka_ext_sim_req(sm, data);
290 	}
291 
292 	if (conf->pcsc) {
293 		return scard_umts_auth(sm->scard_ctx, data->rand,
294 				       data->autn, data->res, &data->res_len,
295 				       data->ik, data->ck, data->auts);
296 	}
297 
298 #ifdef CONFIG_USIM_SIMULATOR
299 	if (conf->password) {
300 		u8 opc[16], k[16], sqn[6];
301 		const char *pos;
302 		wpa_printf(MSG_DEBUG, "EAP-AKA: Use internal Milenage "
303 			   "implementation for UMTS authentication");
304 		if (conf->password_len < 78) {
305 			wpa_printf(MSG_DEBUG, "EAP-AKA: invalid Milenage "
306 				   "password");
307 			return -1;
308 		}
309 		pos = (const char *) conf->password;
310 		if (hexstr2bin(pos, k, 16))
311 			return -1;
312 		pos += 32;
313 		if (*pos != ':')
314 			return -1;
315 		pos++;
316 
317 		if (hexstr2bin(pos, opc, 16))
318 			return -1;
319 		pos += 32;
320 		if (*pos != ':')
321 			return -1;
322 		pos++;
323 
324 		if (hexstr2bin(pos, sqn, 6))
325 			return -1;
326 
327 		return milenage_check(opc, k, sqn, data->rand, data->autn,
328 				      data->ik, data->ck,
329 				      data->res, &data->res_len, data->auts);
330 	}
331 #endif /* CONFIG_USIM_SIMULATOR */
332 
333 #ifdef CONFIG_USIM_HARDCODED
334 	wpa_printf(MSG_DEBUG, "EAP-AKA: Use hardcoded Kc and SRES values for "
335 		   "testing");
336 
337 	/* These hardcoded Kc and SRES values are used for testing.
338 	 * Could consider making them configurable. */
339 	os_memset(data->res, '2', EAP_AKA_RES_MAX_LEN);
340 	data->res_len = EAP_AKA_RES_MAX_LEN;
341 	os_memset(data->ik, '3', EAP_AKA_IK_LEN);
342 	os_memset(data->ck, '4', EAP_AKA_CK_LEN);
343 	{
344 		u8 autn[EAP_AKA_AUTN_LEN];
345 		os_memset(autn, '1', EAP_AKA_AUTN_LEN);
346 		if (os_memcmp_const(autn, data->autn, EAP_AKA_AUTN_LEN) != 0) {
347 			wpa_printf(MSG_WARNING, "EAP-AKA: AUTN did not match "
348 				   "with expected value");
349 			return -1;
350 		}
351 	}
352 #if 0
353 	{
354 		static int test_resync = 1;
355 		if (test_resync) {
356 			/* Test Resynchronization */
357 			test_resync = 0;
358 			return -2;
359 		}
360 	}
361 #endif
362 	return 0;
363 
364 #else /* CONFIG_USIM_HARDCODED */
365 
366 	wpa_printf(MSG_DEBUG, "EAP-AKA: No UMTS authentication algorithm "
367 		   "enabled");
368 	return -1;
369 
370 #endif /* CONFIG_USIM_HARDCODED */
371 }
372 
373 
374 #define CLEAR_PSEUDONYM	0x01
375 #define CLEAR_REAUTH_ID	0x02
376 #define CLEAR_EAP_ID	0x04
377 
eap_aka_clear_identities(struct eap_sm * sm,struct eap_aka_data * data,int id)378 static void eap_aka_clear_identities(struct eap_sm *sm,
379 				     struct eap_aka_data *data, int id)
380 {
381 	if ((id & CLEAR_PSEUDONYM) && data->pseudonym) {
382 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old pseudonym");
383 		os_free(data->pseudonym);
384 		data->pseudonym = NULL;
385 		data->pseudonym_len = 0;
386 		if (data->use_pseudonym)
387 			eap_set_anon_id(sm, NULL, 0);
388 	}
389 	if ((id & CLEAR_REAUTH_ID) && data->reauth_id) {
390 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old reauth_id");
391 		os_free(data->reauth_id);
392 		data->reauth_id = NULL;
393 		data->reauth_id_len = 0;
394 	}
395 	if ((id & CLEAR_EAP_ID) && data->last_eap_identity) {
396 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old eap_id");
397 		os_free(data->last_eap_identity);
398 		data->last_eap_identity = NULL;
399 		data->last_eap_identity_len = 0;
400 	}
401 }
402 
403 
eap_aka_learn_ids(struct eap_sm * sm,struct eap_aka_data * data,struct eap_sim_attrs * attr)404 static int eap_aka_learn_ids(struct eap_sm *sm, struct eap_aka_data *data,
405 			     struct eap_sim_attrs *attr)
406 {
407 	if (attr->next_pseudonym) {
408 		const u8 *identity = NULL;
409 		size_t identity_len = 0;
410 		const u8 *realm = NULL;
411 		size_t realm_len = 0;
412 
413 		wpa_hexdump_ascii(MSG_DEBUG,
414 				  "EAP-AKA: (encr) AT_NEXT_PSEUDONYM",
415 				  attr->next_pseudonym,
416 				  attr->next_pseudonym_len);
417 		os_free(data->pseudonym);
418 
419 		/* Get realm from identities to decorate pseudonym. */
420 		realm = eap_get_config_realm(sm, &realm_len);
421 
422 		data->pseudonym = os_malloc(attr->next_pseudonym_len +
423 					    realm_len);
424 		if (data->pseudonym == NULL) {
425 			wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
426 				   "next pseudonym");
427 			data->pseudonym_len = 0;
428 			return -1;
429 		}
430 		os_memcpy(data->pseudonym, attr->next_pseudonym,
431 			  attr->next_pseudonym_len);
432 		if (realm_len) {
433 			os_memcpy(data->pseudonym + attr->next_pseudonym_len,
434 				  realm, realm_len);
435 		}
436 		data->pseudonym_len = attr->next_pseudonym_len + realm_len;
437 		if (data->use_pseudonym)
438 			eap_set_anon_id(sm, data->pseudonym,
439 					data->pseudonym_len);
440 	}
441 
442 	if (attr->next_reauth_id) {
443 		os_free(data->reauth_id);
444 		data->reauth_id = os_memdup(attr->next_reauth_id,
445 					    attr->next_reauth_id_len);
446 		if (data->reauth_id == NULL) {
447 			wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
448 				   "next reauth_id");
449 			data->reauth_id_len = 0;
450 			return -1;
451 		}
452 		data->reauth_id_len = attr->next_reauth_id_len;
453 		wpa_hexdump_ascii(MSG_DEBUG,
454 				  "EAP-AKA: (encr) AT_NEXT_REAUTH_ID",
455 				  data->reauth_id,
456 				  data->reauth_id_len);
457 	}
458 
459 	return 0;
460 }
461 
462 
eap_aka_add_id_msg(struct eap_aka_data * data,const struct wpabuf * msg1,const struct wpabuf * msg2)463 static int eap_aka_add_id_msg(struct eap_aka_data *data,
464 			      const struct wpabuf *msg1,
465 			      const struct wpabuf *msg2)
466 {
467 	size_t len;
468 
469 	if (!msg1)
470 		return -1;
471 	len = wpabuf_len(msg1);
472 	if (msg2)
473 		len += wpabuf_len(msg2);
474 
475 	if (!data->id_msgs) {
476 		data->id_msgs = wpabuf_alloc(len);
477 		if (!data->id_msgs)
478 			return -1;
479 	} else if (wpabuf_resize(&data->id_msgs, len) < 0) {
480 		return -1;
481 	}
482 
483 	wpabuf_put_buf(data->id_msgs, msg1);
484 	if (msg2)
485 		wpabuf_put_buf(data->id_msgs, msg2);
486 
487 	return 0;
488 }
489 
490 
eap_aka_add_checkcode(struct eap_aka_data * data,struct eap_sim_msg * msg)491 static void eap_aka_add_checkcode(struct eap_aka_data *data,
492 				  struct eap_sim_msg *msg)
493 {
494 	const u8 *addr;
495 	size_t len;
496 	u8 hash[SHA256_MAC_LEN];
497 
498 	wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
499 
500 	if (data->id_msgs == NULL) {
501 		/*
502 		 * No EAP-AKA/Identity packets were exchanged - send empty
503 		 * checkcode.
504 		 */
505 		eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
506 		return;
507 	}
508 
509 	/* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
510 	addr = wpabuf_head(data->id_msgs);
511 	len = wpabuf_len(data->id_msgs);
512 	wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
513 #ifdef EAP_AKA_PRIME
514 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
515 		sha256_vector(1, &addr, &len, hash);
516 	else
517 #endif /* EAP_AKA_PRIME */
518 		sha1_vector(1, &addr, &len, hash);
519 
520 	eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
521 			data->eap_method == EAP_TYPE_AKA_PRIME ?
522 			EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN);
523 }
524 
525 
eap_aka_verify_checkcode(struct eap_aka_data * data,const u8 * checkcode,size_t checkcode_len)526 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
527 				    const u8 *checkcode, size_t checkcode_len)
528 {
529 	const u8 *addr;
530 	size_t len;
531 	u8 hash[SHA256_MAC_LEN];
532 	size_t hash_len;
533 
534 	if (checkcode == NULL)
535 		return -1;
536 
537 	if (data->id_msgs == NULL) {
538 		if (checkcode_len != 0) {
539 			wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
540 				   "indicates that AKA/Identity messages were "
541 				   "used, but they were not");
542 			return -1;
543 		}
544 		return 0;
545 	}
546 
547 	hash_len = data->eap_method == EAP_TYPE_AKA_PRIME ?
548 		EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN;
549 
550 	if (checkcode_len != hash_len) {
551 		wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
552 			   "indicates that AKA/Identity message were not "
553 			   "used, but they were");
554 		return -1;
555 	}
556 
557 	/* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
558 	addr = wpabuf_head(data->id_msgs);
559 	len = wpabuf_len(data->id_msgs);
560 #ifdef EAP_AKA_PRIME
561 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
562 		sha256_vector(1, &addr, &len, hash);
563 	else
564 #endif /* EAP_AKA_PRIME */
565 		sha1_vector(1, &addr, &len, hash);
566 
567 	if (os_memcmp_const(hash, checkcode, hash_len) != 0) {
568 		wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
569 		return -1;
570 	}
571 
572 	return 0;
573 }
574 
575 
eap_aka_client_error(struct eap_aka_data * data,u8 id,int err)576 static struct wpabuf * eap_aka_client_error(struct eap_aka_data *data, u8 id,
577 					    int err)
578 {
579 	struct eap_sim_msg *msg;
580 
581 	eap_aka_state(data, FAILURE);
582 	data->num_id_req = 0;
583 	data->num_notification = 0;
584 
585 	wpa_printf(MSG_DEBUG, "EAP-AKA: Send Client-Error (error code %d)",
586 		   err);
587 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
588 			       EAP_AKA_SUBTYPE_CLIENT_ERROR);
589 	eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
590 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
591 }
592 
593 
eap_aka_authentication_reject(struct eap_aka_data * data,u8 id)594 static struct wpabuf * eap_aka_authentication_reject(struct eap_aka_data *data,
595 						     u8 id)
596 {
597 	struct eap_sim_msg *msg;
598 
599 	eap_aka_state(data, FAILURE);
600 	data->num_id_req = 0;
601 	data->num_notification = 0;
602 
603 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Authentication-Reject "
604 		   "(id=%d)", id);
605 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
606 			       EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT);
607 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
608 }
609 
610 
eap_aka_synchronization_failure(struct eap_aka_data * data,u8 id,struct eap_sim_attrs * attr)611 static struct wpabuf * eap_aka_synchronization_failure(
612 	struct eap_aka_data *data, u8 id, struct eap_sim_attrs *attr)
613 {
614 	struct eap_sim_msg *msg;
615 
616 	data->num_id_req = 0;
617 	data->num_notification = 0;
618 
619 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Synchronization-Failure "
620 		   "(id=%d)", id);
621 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
622 			       EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE);
623 	wpa_printf(MSG_DEBUG, "   AT_AUTS");
624 	eap_sim_msg_add_full(msg, EAP_SIM_AT_AUTS, data->auts,
625 			     EAP_AKA_AUTS_LEN);
626 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
627 		size_t i;
628 
629 		for (i = 0; i < attr->kdf_count; i++) {
630 			wpa_printf(MSG_DEBUG, "   AT_KDF");
631 			eap_sim_msg_add(msg, EAP_SIM_AT_KDF, attr->kdf[i],
632 					NULL, 0);
633 		}
634 	}
635 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
636 }
637 
638 
639 #ifdef CRYPTO_RSA_OAEP_SHA256
640 static struct wpabuf *
eap_aka_encrypt_identity(struct crypto_rsa_key * imsi_privacy_key,const u8 * identity,size_t identity_len)641 eap_aka_encrypt_identity(struct crypto_rsa_key *imsi_privacy_key,
642 			 const u8 *identity, size_t identity_len)
643 {
644 	struct wpabuf *imsi_buf, *enc;
645 	char *b64;
646 	size_t b64_len;
647 
648 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Encrypt permanent identity",
649 			  identity, identity_len);
650 
651 	imsi_buf = wpabuf_alloc_copy(identity, identity_len);
652 	if (!imsi_buf)
653 		return NULL;
654 	enc = crypto_rsa_oaep_sha256_encrypt(imsi_privacy_key, imsi_buf);
655 	wpabuf_free(imsi_buf);
656 	if (!enc)
657 		return NULL;
658 
659 	b64 = base64_encode_no_lf(wpabuf_head(enc), wpabuf_len(enc), &b64_len);
660 	wpabuf_free(enc);
661 	if (!b64)
662 		return NULL;
663 
664 	enc = wpabuf_alloc(1 + b64_len);
665 	if (!enc) {
666 		os_free(b64);
667 		return NULL;
668 	}
669 	wpabuf_put_u8(enc, '\0');
670 	wpabuf_put_data(enc, b64, b64_len);
671 	os_free(b64);
672 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Encrypted permanent identity",
673 			  wpabuf_head(enc), wpabuf_len(enc));
674 
675 	return enc;
676 }
677 #endif /* CRYPTO_RSA_OAEP_SHA256 */
678 
679 
eap_aka_response_identity(struct eap_sm * sm,struct eap_aka_data * data,u8 id,enum eap_sim_id_req id_req)680 static struct wpabuf * eap_aka_response_identity(struct eap_sm *sm,
681 						 struct eap_aka_data *data,
682 						 u8 id,
683 						 enum eap_sim_id_req id_req)
684 {
685 	const u8 *identity = NULL;
686 	size_t identity_len = 0;
687 	struct eap_sim_msg *msg;
688 	struct wpabuf *enc_identity = NULL;
689 
690 	data->reauth = 0;
691 	if (id_req == ANY_ID && data->reauth_id) {
692 		identity = data->reauth_id;
693 		identity_len = data->reauth_id_len;
694 		data->reauth = 1;
695 	} else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
696 		   data->pseudonym &&
697 		   !eap_sim_anonymous_username(data->pseudonym,
698 					       data->pseudonym_len)) {
699 		identity = data->pseudonym;
700 		identity_len = data->pseudonym_len;
701 		eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
702 	} else if (id_req != NO_ID_REQ) {
703 		identity = eap_get_config_identity(sm, &identity_len);
704 		if (identity) {
705 			int ids = CLEAR_PSEUDONYM | CLEAR_REAUTH_ID;
706 
707 			if (data->pseudonym &&
708 			    eap_sim_anonymous_username(data->pseudonym,
709 						       data->pseudonym_len))
710 				ids &= ~CLEAR_PSEUDONYM;
711 			eap_aka_clear_identities(sm, data, ids);
712 		}
713 #ifdef CRYPTO_RSA_OAEP_SHA256
714 		if (identity && data->imsi_privacy_key) {
715 			enc_identity = eap_aka_encrypt_identity(
716 				data->imsi_privacy_key,
717 				identity, identity_len);
718 			if (!enc_identity) {
719 				wpa_printf(MSG_INFO,
720 					   "EAP-AKA: Failed to encrypt permanent identity");
721 				return eap_aka_client_error(
722 					data, id,
723 					EAP_AKA_UNABLE_TO_PROCESS_PACKET);
724 			}
725 			identity = wpabuf_head(enc_identity);
726 			identity_len = wpabuf_len(enc_identity);
727 		}
728 #endif /* CRYPTO_RSA_OAEP_SHA256 */
729 	}
730 	if (id_req != NO_ID_REQ)
731 		eap_aka_clear_identities(sm, data, CLEAR_EAP_ID);
732 
733 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Identity (id=%d)", id);
734 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
735 			       EAP_AKA_SUBTYPE_IDENTITY);
736 
737 	if (identity) {
738 		wpa_hexdump_ascii(MSG_DEBUG, "   AT_IDENTITY",
739 				  identity, identity_len);
740 		eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
741 				identity, identity_len);
742 	}
743 	wpabuf_free(enc_identity);
744 
745 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
746 }
747 
748 
eap_aka_response_challenge(struct eap_aka_data * data,u8 id)749 static struct wpabuf * eap_aka_response_challenge(struct eap_aka_data *data,
750 						  u8 id)
751 {
752 	struct eap_sim_msg *msg;
753 
754 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d)", id);
755 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
756 			       EAP_AKA_SUBTYPE_CHALLENGE);
757 	wpa_printf(MSG_DEBUG, "   AT_RES");
758 	eap_sim_msg_add(msg, EAP_SIM_AT_RES, data->res_len * 8,
759 			data->res, data->res_len);
760 	eap_aka_add_checkcode(data, msg);
761 	if (data->use_result_ind) {
762 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
763 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
764 	}
765 	wpa_printf(MSG_DEBUG, "   AT_MAC");
766 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
767 	return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, (u8 *) "",
768 				  0);
769 }
770 
771 
eap_aka_response_reauth(struct eap_aka_data * data,u8 id,int counter_too_small,const u8 * nonce_s)772 static struct wpabuf * eap_aka_response_reauth(struct eap_aka_data *data,
773 					       u8 id, int counter_too_small,
774 					       const u8 *nonce_s)
775 {
776 	struct eap_sim_msg *msg;
777 	unsigned int counter;
778 
779 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Reauthentication (id=%d)",
780 		   id);
781 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
782 			       EAP_AKA_SUBTYPE_REAUTHENTICATION);
783 	wpa_printf(MSG_DEBUG, "   AT_IV");
784 	wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
785 	eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
786 
787 	if (counter_too_small) {
788 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER_TOO_SMALL");
789 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
790 		counter = data->counter_too_small;
791 	} else
792 		counter = data->counter;
793 
794 	wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", counter);
795 	eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
796 
797 	if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
798 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
799 			   "AT_ENCR_DATA");
800 		eap_sim_msg_free(msg);
801 		return NULL;
802 	}
803 	eap_aka_add_checkcode(data, msg);
804 	if (data->use_result_ind) {
805 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
806 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
807 	}
808 	wpa_printf(MSG_DEBUG, "   AT_MAC");
809 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
810 	return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, nonce_s,
811 				  EAP_SIM_NONCE_S_LEN);
812 }
813 
814 
eap_aka_response_notification(struct eap_aka_data * data,u8 id,u16 notification)815 static struct wpabuf * eap_aka_response_notification(struct eap_aka_data *data,
816 						     u8 id, u16 notification)
817 {
818 	struct eap_sim_msg *msg;
819 	u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
820 
821 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Notification (id=%d)", id);
822 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
823 			       EAP_AKA_SUBTYPE_NOTIFICATION);
824 	if (k_aut && data->reauth) {
825 		wpa_printf(MSG_DEBUG, "   AT_IV");
826 		wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
827 		eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
828 					   EAP_SIM_AT_ENCR_DATA);
829 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", data->counter);
830 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
831 				NULL, 0);
832 		if (eap_sim_msg_add_encr_end(msg, data->k_encr,
833 					     EAP_SIM_AT_PADDING)) {
834 			wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
835 				   "AT_ENCR_DATA");
836 			eap_sim_msg_free(msg);
837 			return NULL;
838 		}
839 	}
840 	if (k_aut) {
841 		wpa_printf(MSG_DEBUG, "   AT_MAC");
842 		eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
843 	}
844 	return eap_sim_msg_finish(msg, data->eap_method, k_aut, (u8 *) "", 0);
845 }
846 
847 
eap_aka_process_identity(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)848 static struct wpabuf * eap_aka_process_identity(struct eap_sm *sm,
849 						struct eap_aka_data *data,
850 						u8 id,
851 						const struct wpabuf *reqData,
852 						struct eap_sim_attrs *attr)
853 {
854 	int id_error;
855 	struct wpabuf *buf;
856 
857 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Identity");
858 
859 	id_error = 0;
860 	switch (attr->id_req) {
861 	case NO_ID_REQ:
862 		break;
863 	case ANY_ID:
864 		if (data->num_id_req > 0)
865 			id_error++;
866 		data->num_id_req++;
867 		break;
868 	case FULLAUTH_ID:
869 		if (data->num_id_req > 1)
870 			id_error++;
871 		data->num_id_req++;
872 		break;
873 	case PERMANENT_ID:
874 		if (data->num_id_req > 2)
875 			id_error++;
876 		data->num_id_req++;
877 		break;
878 	}
879 	if (id_error) {
880 		wpa_printf(MSG_INFO, "EAP-AKA: Too many ID requests "
881 			   "used within one authentication");
882 		return eap_aka_client_error(data, id,
883 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
884 	}
885 
886 	buf = eap_aka_response_identity(sm, data, id, attr->id_req);
887 
888 	if (data->prev_id != id) {
889 		if (eap_aka_add_id_msg(data, reqData, buf) < 0) {
890 			wpa_printf(MSG_INFO,
891 				   "EAP-AKA: Failed to store ID messages");
892 			wpabuf_free(buf);
893 			return eap_aka_client_error(
894 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
895 		}
896 		data->prev_id = id;
897 	}
898 
899 	return buf;
900 }
901 
902 
eap_aka_verify_mac(struct eap_aka_data * data,const struct wpabuf * req,const u8 * mac,const u8 * extra,size_t extra_len)903 static int eap_aka_verify_mac(struct eap_aka_data *data,
904 			      const struct wpabuf *req,
905 			      const u8 *mac, const u8 *extra,
906 			      size_t extra_len)
907 {
908 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
909 		return eap_sim_verify_mac_sha256(data->k_aut, req, mac, extra,
910 						 extra_len);
911 	return eap_sim_verify_mac(data->k_aut, req, mac, extra, extra_len);
912 }
913 
914 
915 #ifdef EAP_AKA_PRIME
eap_aka_prime_kdf_select(struct eap_aka_data * data,u8 id,u16 kdf)916 static struct wpabuf * eap_aka_prime_kdf_select(struct eap_aka_data *data,
917 						u8 id, u16 kdf)
918 {
919 	struct eap_sim_msg *msg;
920 
921 	data->kdf_negotiation = 1;
922 	data->kdf = kdf;
923 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d) (KDF "
924 		   "select)", id);
925 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
926 			       EAP_AKA_SUBTYPE_CHALLENGE);
927 	wpa_printf(MSG_DEBUG, "   AT_KDF");
928 	eap_sim_msg_add(msg, EAP_SIM_AT_KDF, kdf, NULL, 0);
929 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
930 }
931 
932 
eap_aka_prime_kdf_neg(struct eap_aka_data * data,u8 id,struct eap_sim_attrs * attr)933 static struct wpabuf * eap_aka_prime_kdf_neg(struct eap_aka_data *data,
934 					     u8 id, struct eap_sim_attrs *attr)
935 {
936 	size_t i;
937 
938 	for (i = 0; i < attr->kdf_count; i++) {
939 		if (attr->kdf[i] == EAP_AKA_PRIME_KDF) {
940 			os_memcpy(data->last_kdf_attrs, attr->kdf,
941 				  sizeof(u16) * attr->kdf_count);
942 			data->last_kdf_count = attr->kdf_count;
943 			return eap_aka_prime_kdf_select(data, id,
944 							EAP_AKA_PRIME_KDF);
945 		}
946 	}
947 
948 	/* No matching KDF found - fail authentication as if AUTN had been
949 	 * incorrect */
950 	return eap_aka_authentication_reject(data, id);
951 }
952 
953 
eap_aka_prime_kdf_valid(struct eap_aka_data * data,struct eap_sim_attrs * attr)954 static int eap_aka_prime_kdf_valid(struct eap_aka_data *data,
955 				   struct eap_sim_attrs *attr)
956 {
957 	size_t i, j;
958 
959 	if (attr->kdf_count == 0)
960 		return 0;
961 
962 	/* The only allowed (and required) duplication of a KDF is the addition
963 	 * of the selected KDF into the beginning of the list. */
964 
965 	if (data->kdf_negotiation) {
966 		/* When the peer receives the new EAP-Request/AKA'-Challenge
967 		 * message, must check only requested change occurred in the
968 		 * list of AT_KDF attributes. If there are any other changes,
969 		 * the peer must behave like the case that AT_MAC had been
970 		 * incorrect and authentication is failed. These are defined in
971 		 * EAP-AKA' specification RFC 5448, Section 3.2. */
972 		if (attr->kdf[0] != data->kdf) {
973 			wpa_printf(MSG_WARNING, "EAP-AKA': The server did not "
974 				   "accept the selected KDF");
975 			return -1;
976 		}
977 
978 		if (attr->kdf_count > EAP_AKA_PRIME_KDF_MAX ||
979 		    attr->kdf_count != data->last_kdf_count + 1) {
980 			wpa_printf(MSG_WARNING,
981 				   "EAP-AKA': The length of KDF attributes is wrong");
982 			return -1;
983 		}
984 
985 		for (i = 1; i < attr->kdf_count; i++) {
986 			if (attr->kdf[i] != data->last_kdf_attrs[i - 1]) {
987 				wpa_printf(MSG_WARNING,
988 					   "EAP-AKA': The KDF attributes except selected KDF are not same as original one");
989 				return -1;
990 			}
991 		}
992 	}
993 
994 	for (i = data->kdf ? 1 : 0; i < attr->kdf_count; i++) {
995 		for (j = i + 1; j < attr->kdf_count; j++) {
996 			if (attr->kdf[i] == attr->kdf[j]) {
997 				wpa_printf(MSG_WARNING, "EAP-AKA': The server "
998 					   "included a duplicated KDF");
999 				return 0;
1000 			}
1001 		}
1002 	}
1003 
1004 	return 1;
1005 }
1006 #endif /* EAP_AKA_PRIME */
1007 
1008 
eap_aka_process_challenge(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1009 static struct wpabuf * eap_aka_process_challenge(struct eap_sm *sm,
1010 						 struct eap_aka_data *data,
1011 						 u8 id,
1012 						 const struct wpabuf *reqData,
1013 						 struct eap_sim_attrs *attr)
1014 {
1015 	const u8 *identity;
1016 	size_t identity_len;
1017 	int res;
1018 	struct eap_sim_attrs eattr;
1019 
1020 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Challenge");
1021 
1022 	if (attr->checkcode &&
1023 	    eap_aka_verify_checkcode(data, attr->checkcode,
1024 				     attr->checkcode_len)) {
1025 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1026 			   "message");
1027 #ifdef TEST_FUZZ
1028 		wpa_printf(MSG_INFO,
1029 			   "TEST: Ignore AT_CHECKCODE mismatch for fuzz testing");
1030 #else /* TEST_FUZZ */
1031 		return eap_aka_client_error(data, id,
1032 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1033 #endif /* TEST_FUZZ */
1034 	}
1035 
1036 #ifdef EAP_AKA_PRIME
1037 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1038 		if (!attr->kdf_input || attr->kdf_input_len == 0) {
1039 			wpa_printf(MSG_WARNING, "EAP-AKA': Challenge message "
1040 				   "did not include non-empty AT_KDF_INPUT");
1041 			/* Fail authentication as if AUTN had been incorrect */
1042 			return eap_aka_authentication_reject(data, id);
1043 		}
1044 		os_free(data->network_name);
1045 		data->network_name = os_memdup(attr->kdf_input,
1046 					       attr->kdf_input_len);
1047 		if (data->network_name == NULL) {
1048 			wpa_printf(MSG_WARNING, "EAP-AKA': No memory for "
1049 				   "storing Network Name");
1050 			return eap_aka_authentication_reject(data, id);
1051 		}
1052 		data->network_name_len = attr->kdf_input_len;
1053 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA': Network Name "
1054 				  "(AT_KDF_INPUT)",
1055 				  data->network_name, data->network_name_len);
1056 		/* TODO: check Network Name per 3GPP.33.402 */
1057 
1058 		res = eap_aka_prime_kdf_valid(data, attr);
1059 		if (res == 0)
1060 			return eap_aka_authentication_reject(data, id);
1061 		else if (res == -1)
1062 			return eap_aka_client_error(
1063 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1064 
1065 		if (attr->kdf[0] != EAP_AKA_PRIME_KDF)
1066 			return eap_aka_prime_kdf_neg(data, id, attr);
1067 
1068 		data->kdf = EAP_AKA_PRIME_KDF;
1069 		wpa_printf(MSG_DEBUG, "EAP-AKA': KDF %d selected", data->kdf);
1070 	}
1071 
1072 	if (data->eap_method == EAP_TYPE_AKA && attr->bidding) {
1073 		u16 flags = WPA_GET_BE16(attr->bidding);
1074 		if ((flags & EAP_AKA_BIDDING_FLAG_D) &&
1075 		    eap_allowed_method(sm, EAP_VENDOR_IETF,
1076 				       EAP_TYPE_AKA_PRIME)) {
1077 			wpa_printf(MSG_WARNING, "EAP-AKA: Bidding down from "
1078 				   "AKA' to AKA detected");
1079 			/* Fail authentication as if AUTN had been incorrect */
1080 			return eap_aka_authentication_reject(data, id);
1081 		}
1082 	}
1083 #endif /* EAP_AKA_PRIME */
1084 
1085 	data->reauth = 0;
1086 	if (!attr->mac || !attr->rand || !attr->autn) {
1087 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1088 			   "did not include%s%s%s",
1089 			   !attr->mac ? " AT_MAC" : "",
1090 			   !attr->rand ? " AT_RAND" : "",
1091 			   !attr->autn ? " AT_AUTN" : "");
1092 		return eap_aka_client_error(data, id,
1093 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1094 	}
1095 	os_memcpy(data->rand, attr->rand, EAP_AKA_RAND_LEN);
1096 	os_memcpy(data->autn, attr->autn, EAP_AKA_AUTN_LEN);
1097 
1098 	res = eap_aka_umts_auth(sm, data);
1099 	if (res == -1) {
1100 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1101 			   "failed (AUTN)");
1102 		return eap_aka_authentication_reject(data, id);
1103 	} else if (res == -2) {
1104 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1105 			   "failed (AUTN seq# -> AUTS)");
1106 		return eap_aka_synchronization_failure(data, id, attr);
1107 	} else if (res > 0) {
1108 		wpa_printf(MSG_DEBUG, "EAP-AKA: Wait for external USIM processing");
1109 		return NULL;
1110 	} else if (res) {
1111 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication failed");
1112 		return eap_aka_client_error(data, id,
1113 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1114 	}
1115 #ifdef EAP_AKA_PRIME
1116 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1117 		/* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
1118 		 * needed 6-octet SQN ^ AK for CK',IK' derivation */
1119 		u16 amf = WPA_GET_BE16(data->autn + 6);
1120 		if (!(amf & 0x8000)) {
1121 			wpa_printf(MSG_WARNING, "EAP-AKA': AMF separation bit "
1122 				   "not set (AMF=0x%4x)", amf);
1123 			return eap_aka_authentication_reject(data, id);
1124 		}
1125 		eap_aka_prime_derive_ck_ik_prime(data->ck, data->ik,
1126 						 data->autn,
1127 						 data->network_name,
1128 						 data->network_name_len);
1129 	}
1130 #endif /* EAP_AKA_PRIME */
1131 	if (data->last_eap_identity) {
1132 		identity = data->last_eap_identity;
1133 		identity_len = data->last_eap_identity_len;
1134 	} else if (data->pseudonym &&
1135 		   !eap_sim_anonymous_username(data->pseudonym,
1136 					       data->pseudonym_len)) {
1137 		identity = data->pseudonym;
1138 		identity_len = data->pseudonym_len;
1139 	} else {
1140 		struct eap_peer_config *config;
1141 
1142 		config = eap_get_config(sm);
1143 		if (config && config->imsi_identity) {
1144 			identity = config->imsi_identity;
1145 			identity_len = config->imsi_identity_len;
1146 		} else {
1147 			identity = eap_get_config_identity(sm, &identity_len);
1148 		}
1149 	}
1150 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
1151 			  "derivation", identity, identity_len);
1152 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1153 		eap_aka_prime_derive_keys(identity, identity_len, data->ik,
1154 					  data->ck, data->k_encr, data->k_aut,
1155 					  data->k_re, data->msk, data->emsk);
1156 	} else {
1157 		eap_aka_derive_mk(identity, identity_len, data->ik, data->ck,
1158 				  data->mk);
1159 		eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
1160 				    data->msk, data->emsk);
1161 	}
1162 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1163 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1164 			   "used invalid AT_MAC");
1165 #ifdef TEST_FUZZ
1166 		wpa_printf(MSG_INFO,
1167 			   "TEST: Ignore AT_MAC mismatch for fuzz testing");
1168 #else /* TEST_FUZZ */
1169 		return eap_aka_client_error(data, id,
1170 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1171 #endif /* TEST_FUZZ */
1172 	}
1173 
1174 	/* Old reauthentication identity must not be used anymore. In
1175 	 * other words, if no new identities are received, full
1176 	 * authentication will be used on next reauthentication (using
1177 	 * pseudonym identity or permanent identity). */
1178 	eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1179 
1180 	if (attr->encr_data) {
1181 		u8 *decrypted;
1182 		decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1183 					       attr->encr_data_len, attr->iv,
1184 					       &eattr, 0);
1185 		if (decrypted == NULL) {
1186 			return eap_aka_client_error(
1187 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1188 		}
1189 		eap_aka_learn_ids(sm, data, &eattr);
1190 		os_free(decrypted);
1191 	}
1192 
1193 	if (data->result_ind && attr->result_ind)
1194 		data->use_result_ind = 1;
1195 
1196 	if (data->state != FAILURE) {
1197 		eap_aka_state(data, data->use_result_ind ?
1198 			      RESULT_SUCCESS : SUCCESS);
1199 	}
1200 
1201 	data->num_id_req = 0;
1202 	data->num_notification = 0;
1203 	/* RFC 4187 specifies that counter is initialized to one after
1204 	 * fullauth, but initializing it to zero makes it easier to implement
1205 	 * reauth verification. */
1206 	data->counter = 0;
1207 	return eap_aka_response_challenge(data, id);
1208 }
1209 
1210 
eap_aka_process_notification_reauth(struct eap_aka_data * data,struct eap_sim_attrs * attr)1211 static int eap_aka_process_notification_reauth(struct eap_aka_data *data,
1212 					       struct eap_sim_attrs *attr)
1213 {
1214 	struct eap_sim_attrs eattr;
1215 	u8 *decrypted;
1216 
1217 	if (attr->encr_data == NULL || attr->iv == NULL) {
1218 		wpa_printf(MSG_WARNING, "EAP-AKA: Notification message after "
1219 			   "reauth did not include encrypted data");
1220 		return -1;
1221 	}
1222 
1223 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1224 				       attr->encr_data_len, attr->iv, &eattr,
1225 				       0);
1226 	if (decrypted == NULL) {
1227 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1228 			   "data from notification message");
1229 		return -1;
1230 	}
1231 
1232 	if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
1233 		wpa_printf(MSG_WARNING, "EAP-AKA: Counter in notification "
1234 			   "message does not match with counter in reauth "
1235 			   "message");
1236 		os_free(decrypted);
1237 		return -1;
1238 	}
1239 
1240 	os_free(decrypted);
1241 	return 0;
1242 }
1243 
1244 
eap_aka_process_notification_auth(struct eap_aka_data * data,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1245 static int eap_aka_process_notification_auth(struct eap_aka_data *data,
1246 					     const struct wpabuf *reqData,
1247 					     struct eap_sim_attrs *attr)
1248 {
1249 	if (attr->mac == NULL) {
1250 		wpa_printf(MSG_INFO, "EAP-AKA: no AT_MAC in after_auth "
1251 			   "Notification message");
1252 		return -1;
1253 	}
1254 
1255 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1256 		wpa_printf(MSG_WARNING, "EAP-AKA: Notification message "
1257 			   "used invalid AT_MAC");
1258 		return -1;
1259 	}
1260 
1261 	if (data->reauth &&
1262 	    eap_aka_process_notification_reauth(data, attr)) {
1263 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid notification "
1264 			   "message after reauth");
1265 		return -1;
1266 	}
1267 
1268 	return 0;
1269 }
1270 
1271 
eap_aka_process_notification(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1272 static struct wpabuf * eap_aka_process_notification(
1273 	struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1274 	const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1275 {
1276 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Notification");
1277 	if (data->num_notification > 0) {
1278 		wpa_printf(MSG_INFO, "EAP-AKA: too many notification "
1279 			   "rounds (only one allowed)");
1280 		return eap_aka_client_error(data, id,
1281 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1282 	}
1283 	data->num_notification++;
1284 	if (attr->notification == -1) {
1285 		wpa_printf(MSG_INFO, "EAP-AKA: no AT_NOTIFICATION in "
1286 			   "Notification message");
1287 		return eap_aka_client_error(data, id,
1288 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1289 	}
1290 
1291 	if ((attr->notification & 0x4000) == 0 &&
1292 	    eap_aka_process_notification_auth(data, reqData, attr)) {
1293 		return eap_aka_client_error(data, id,
1294 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1295 	}
1296 
1297 	eap_sim_report_notification(sm->msg_ctx, attr->notification, 1);
1298 	if (attr->notification >= 0 && attr->notification < 32768) {
1299 		data->error_code = attr->notification;
1300 		eap_aka_state(data, FAILURE);
1301 	} else if (attr->notification == EAP_SIM_SUCCESS &&
1302 		   data->state == RESULT_SUCCESS)
1303 		eap_aka_state(data, SUCCESS);
1304 	return eap_aka_response_notification(data, id, attr->notification);
1305 }
1306 
1307 
eap_aka_process_reauthentication(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1308 static struct wpabuf * eap_aka_process_reauthentication(
1309 	struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1310 	const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1311 {
1312 	struct eap_sim_attrs eattr;
1313 	u8 *decrypted;
1314 
1315 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Reauthentication");
1316 
1317 	if (attr->checkcode &&
1318 	    eap_aka_verify_checkcode(data, attr->checkcode,
1319 				     attr->checkcode_len)) {
1320 #ifdef TEST_FUZZ
1321 		wpa_printf(MSG_INFO,
1322 			   "TEST: Ignore AT_CHECKCODE mismatch for fuzz testing");
1323 #else /* TEST_FUZZ */
1324 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1325 			   "message");
1326 #endif /* TEST_FUZZ */
1327 		return eap_aka_client_error(data, id,
1328 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1329 	}
1330 
1331 	if (data->reauth_id == NULL) {
1332 		wpa_printf(MSG_WARNING, "EAP-AKA: Server is trying "
1333 			   "reauthentication, but no reauth_id available");
1334 		return eap_aka_client_error(data, id,
1335 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1336 	}
1337 
1338 	data->reauth = 1;
1339 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1340 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1341 			   "did not have valid AT_MAC");
1342 		return eap_aka_client_error(data, id,
1343 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1344 	}
1345 
1346 	/* At this stage the received MAC has been verified. Use this MAC for
1347 	 * reauth Session-Id calculation if all other checks pass.
1348 	 * The peer does not use the local MAC but the received MAC in deriving
1349 	 * Session-Id. */
1350 	os_memcpy(data->reauth_mac, attr->mac, EAP_SIM_MAC_LEN);
1351 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: Server MAC",
1352 		    data->reauth_mac, EAP_SIM_MAC_LEN);
1353 
1354 	if (attr->encr_data == NULL || attr->iv == NULL) {
1355 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1356 			   "message did not include encrypted data");
1357 		return eap_aka_client_error(data, id,
1358 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1359 	}
1360 
1361 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1362 				       attr->encr_data_len, attr->iv, &eattr,
1363 				       0);
1364 	if (decrypted == NULL) {
1365 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1366 			   "data from reauthentication message");
1367 		return eap_aka_client_error(data, id,
1368 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1369 	}
1370 
1371 	if (eattr.nonce_s == NULL || eattr.counter < 0) {
1372 		wpa_printf(MSG_INFO, "EAP-AKA: (encr) No%s%s in reauth packet",
1373 			   !eattr.nonce_s ? " AT_NONCE_S" : "",
1374 			   eattr.counter < 0 ? " AT_COUNTER" : "");
1375 		os_free(decrypted);
1376 		return eap_aka_client_error(data, id,
1377 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1378 	}
1379 
1380 	if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
1381 		struct wpabuf *res;
1382 		wpa_printf(MSG_INFO, "EAP-AKA: (encr) Invalid counter "
1383 			   "(%d <= %d)", eattr.counter, data->counter);
1384 		data->counter_too_small = eattr.counter;
1385 
1386 		/* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
1387 		 * reauth_id must not be used to start a new reauthentication.
1388 		 * However, since it was used in the last EAP-Response-Identity
1389 		 * packet, it has to saved for the following fullauth to be
1390 		 * used in MK derivation. */
1391 		os_free(data->last_eap_identity);
1392 		data->last_eap_identity = data->reauth_id;
1393 		data->last_eap_identity_len = data->reauth_id_len;
1394 		data->reauth_id = NULL;
1395 		data->reauth_id_len = 0;
1396 
1397 		res = eap_aka_response_reauth(data, id, 1, eattr.nonce_s);
1398 		os_free(decrypted);
1399 
1400 		return res;
1401 	}
1402 	data->counter = eattr.counter;
1403 
1404 	os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
1405 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: (encr) AT_NONCE_S",
1406 		    data->nonce_s, EAP_SIM_NONCE_S_LEN);
1407 
1408 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1409 		eap_aka_prime_derive_keys_reauth(data->k_re, data->counter,
1410 						 data->reauth_id,
1411 						 data->reauth_id_len,
1412 						 data->nonce_s,
1413 						 data->msk, data->emsk);
1414 	} else {
1415 		eap_sim_derive_keys_reauth(data->counter, data->reauth_id,
1416 					   data->reauth_id_len,
1417 					   data->nonce_s, data->mk,
1418 					   data->msk, data->emsk);
1419 	}
1420 	eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1421 	eap_aka_learn_ids(sm, data, &eattr);
1422 
1423 	if (data->result_ind && attr->result_ind)
1424 		data->use_result_ind = 1;
1425 
1426 	if (data->state != FAILURE) {
1427 		eap_aka_state(data, data->use_result_ind ?
1428 			      RESULT_SUCCESS : SUCCESS);
1429 	}
1430 
1431 	data->num_id_req = 0;
1432 	data->num_notification = 0;
1433 	if (data->counter > EAP_AKA_MAX_FAST_REAUTHS) {
1434 		wpa_printf(MSG_DEBUG, "EAP-AKA: Maximum number of "
1435 			   "fast reauths performed - force fullauth");
1436 		eap_aka_clear_identities(sm, data,
1437 					 CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1438 	}
1439 	os_free(decrypted);
1440 	return eap_aka_response_reauth(data, id, 0, data->nonce_s);
1441 }
1442 
1443 
eap_aka_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)1444 static struct wpabuf * eap_aka_process(struct eap_sm *sm, void *priv,
1445 				       struct eap_method_ret *ret,
1446 				       const struct wpabuf *reqData)
1447 {
1448 	struct eap_aka_data *data = priv;
1449 	const struct eap_hdr *req;
1450 	u8 subtype, id;
1451 	struct wpabuf *res;
1452 	const u8 *pos;
1453 	struct eap_sim_attrs attr;
1454 	size_t len;
1455 
1456 	wpa_hexdump_buf(MSG_DEBUG, "EAP-AKA: EAP data", reqData);
1457 	if (eap_get_config_identity(sm, &len) == NULL) {
1458 		wpa_printf(MSG_INFO, "EAP-AKA: Identity not configured");
1459 		eap_sm_request_identity(sm);
1460 		ret->ignore = true;
1461 		return NULL;
1462 	}
1463 
1464 	pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, reqData,
1465 			       &len);
1466 	if (pos == NULL || len < 3) {
1467 		ret->ignore = true;
1468 		return NULL;
1469 	}
1470 	req = wpabuf_head(reqData);
1471 	id = req->identifier;
1472 	len = be_to_host16(req->length);
1473 
1474 	ret->ignore = false;
1475 	ret->methodState = METHOD_MAY_CONT;
1476 	ret->decision = DECISION_FAIL;
1477 	ret->allowNotifications = true;
1478 
1479 	subtype = *pos++;
1480 	wpa_printf(MSG_DEBUG, "EAP-AKA: Subtype=%d", subtype);
1481 	pos += 2; /* Reserved */
1482 
1483 	if (eap_sim_parse_attr(pos, wpabuf_head_u8(reqData) + len, &attr,
1484 			       data->eap_method == EAP_TYPE_AKA_PRIME ? 2 : 1,
1485 			       0)) {
1486 		res = eap_aka_client_error(data, id,
1487 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1488 		goto done;
1489 	}
1490 
1491 	switch (subtype) {
1492 	case EAP_AKA_SUBTYPE_IDENTITY:
1493 		res = eap_aka_process_identity(sm, data, id, reqData, &attr);
1494 		break;
1495 	case EAP_AKA_SUBTYPE_CHALLENGE:
1496 		res = eap_aka_process_challenge(sm, data, id, reqData, &attr);
1497 		break;
1498 	case EAP_AKA_SUBTYPE_NOTIFICATION:
1499 		res = eap_aka_process_notification(sm, data, id, reqData,
1500 						   &attr);
1501 		break;
1502 	case EAP_AKA_SUBTYPE_REAUTHENTICATION:
1503 		res = eap_aka_process_reauthentication(sm, data, id, reqData,
1504 						       &attr);
1505 		break;
1506 	case EAP_AKA_SUBTYPE_CLIENT_ERROR:
1507 		wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Client-Error");
1508 		res = eap_aka_client_error(data, id,
1509 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1510 		break;
1511 	default:
1512 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown subtype=%d", subtype);
1513 		res = eap_aka_client_error(data, id,
1514 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1515 		break;
1516 	}
1517 
1518 done:
1519 	if (data->state == FAILURE) {
1520 		ret->decision = DECISION_FAIL;
1521 		ret->methodState = METHOD_DONE;
1522 	} else if (data->state == SUCCESS) {
1523 		ret->decision = data->use_result_ind ?
1524 			DECISION_UNCOND_SUCC : DECISION_COND_SUCC;
1525 		/*
1526 		 * It is possible for the server to reply with AKA
1527 		 * Notification, so we must allow the method to continue and
1528 		 * not only accept EAP-Success at this point.
1529 		 */
1530 		ret->methodState = data->use_result_ind ?
1531 			METHOD_DONE : METHOD_MAY_CONT;
1532 	} else if (data->state == RESULT_SUCCESS)
1533 		ret->methodState = METHOD_CONT;
1534 
1535 	if (ret->methodState == METHOD_DONE) {
1536 		ret->allowNotifications = false;
1537 	}
1538 
1539 	return res;
1540 }
1541 
1542 
eap_aka_has_reauth_data(struct eap_sm * sm,void * priv)1543 static bool eap_aka_has_reauth_data(struct eap_sm *sm, void *priv)
1544 {
1545 	struct eap_aka_data *data = priv;
1546 	return data->pseudonym || data->reauth_id;
1547 }
1548 
1549 
eap_aka_deinit_for_reauth(struct eap_sm * sm,void * priv)1550 static void eap_aka_deinit_for_reauth(struct eap_sm *sm, void *priv)
1551 {
1552 	struct eap_aka_data *data = priv;
1553 	eap_aka_clear_identities(sm, data, CLEAR_EAP_ID);
1554 	data->prev_id = -1;
1555 	wpabuf_free(data->id_msgs);
1556 	data->id_msgs = NULL;
1557 	data->use_result_ind = 0;
1558 	data->kdf_negotiation = 0;
1559 	eap_aka_clear_keys(data, 1);
1560 }
1561 
1562 
eap_aka_init_for_reauth(struct eap_sm * sm,void * priv)1563 static void * eap_aka_init_for_reauth(struct eap_sm *sm, void *priv)
1564 {
1565 	struct eap_aka_data *data = priv;
1566 	data->num_id_req = 0;
1567 	data->num_notification = 0;
1568 	eap_aka_state(data, CONTINUE);
1569 	return priv;
1570 }
1571 
1572 
eap_aka_get_identity(struct eap_sm * sm,void * priv,size_t * len)1573 static const u8 * eap_aka_get_identity(struct eap_sm *sm, void *priv,
1574 				       size_t *len)
1575 {
1576 	struct eap_aka_data *data = priv;
1577 
1578 	if (data->reauth_id) {
1579 		*len = data->reauth_id_len;
1580 		return data->reauth_id;
1581 	}
1582 
1583 	if (data->pseudonym) {
1584 		*len = data->pseudonym_len;
1585 		return data->pseudonym;
1586 	}
1587 
1588 	return NULL;
1589 }
1590 
1591 
eap_aka_isKeyAvailable(struct eap_sm * sm,void * priv)1592 static bool eap_aka_isKeyAvailable(struct eap_sm *sm, void *priv)
1593 {
1594 	struct eap_aka_data *data = priv;
1595 	return data->state == SUCCESS;
1596 }
1597 
1598 
eap_aka_getKey(struct eap_sm * sm,void * priv,size_t * len)1599 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1600 {
1601 	struct eap_aka_data *data = priv;
1602 	u8 *key;
1603 
1604 	if (data->state != SUCCESS)
1605 		return NULL;
1606 
1607 	key = os_memdup(data->msk, EAP_SIM_KEYING_DATA_LEN);
1608 	if (key == NULL)
1609 		return NULL;
1610 
1611 	*len = EAP_SIM_KEYING_DATA_LEN;
1612 
1613 	return key;
1614 }
1615 
1616 
eap_aka_get_session_id(struct eap_sm * sm,void * priv,size_t * len)1617 static u8 * eap_aka_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1618 {
1619 	struct eap_aka_data *data = priv;
1620 	u8 *id;
1621 
1622 	if (data->state != SUCCESS)
1623 		return NULL;
1624 
1625 	if (!data->reauth)
1626 		*len = 1 + EAP_AKA_RAND_LEN + EAP_AKA_AUTN_LEN;
1627 	else
1628 		*len = 1 + EAP_SIM_NONCE_S_LEN + EAP_SIM_MAC_LEN;
1629 	id = os_malloc(*len);
1630 	if (id == NULL)
1631 		return NULL;
1632 
1633 	id[0] = data->eap_method;
1634 	if (!data->reauth) {
1635 		os_memcpy(id + 1, data->rand, EAP_AKA_RAND_LEN);
1636 		os_memcpy(id + 1 + EAP_AKA_RAND_LEN, data->autn,
1637 			  EAP_AKA_AUTN_LEN);
1638 	} else {
1639 		os_memcpy(id + 1, data->nonce_s, EAP_SIM_NONCE_S_LEN);
1640 		os_memcpy(id + 1 + EAP_SIM_NONCE_S_LEN, data->reauth_mac,
1641 			  EAP_SIM_MAC_LEN);
1642 	}
1643 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: Derived Session-Id", id, *len);
1644 
1645 	return id;
1646 }
1647 
1648 
eap_aka_get_emsk(struct eap_sm * sm,void * priv,size_t * len)1649 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1650 {
1651 	struct eap_aka_data *data = priv;
1652 	u8 *key;
1653 
1654 	if (data->state != SUCCESS)
1655 		return NULL;
1656 
1657 	key = os_memdup(data->emsk, EAP_EMSK_LEN);
1658 	if (key == NULL)
1659 		return NULL;
1660 
1661 	*len = EAP_EMSK_LEN;
1662 
1663 	return key;
1664 }
1665 
1666 
eap_aka_get_error_code(void * priv)1667 static int eap_aka_get_error_code(void *priv)
1668 {
1669 	struct eap_aka_data *data = priv;
1670 	int current_data_error;
1671 
1672 	if (!data)
1673 		return NO_EAP_METHOD_ERROR;
1674 
1675 	current_data_error = data->error_code;
1676 
1677 	/* Now reset for next transaction */
1678 	data->error_code = NO_EAP_METHOD_ERROR;
1679 
1680 	return current_data_error;
1681 }
1682 
1683 
eap_peer_aka_register(void)1684 int eap_peer_aka_register(void)
1685 {
1686 	struct eap_method *eap;
1687 
1688 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1689 				    EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1690 	if (eap == NULL)
1691 		return -1;
1692 
1693 	eap->init = eap_aka_init;
1694 	eap->deinit = eap_aka_deinit;
1695 	eap->process = eap_aka_process;
1696 	eap->isKeyAvailable = eap_aka_isKeyAvailable;
1697 	eap->getKey = eap_aka_getKey;
1698 	eap->getSessionId = eap_aka_get_session_id;
1699 	eap->has_reauth_data = eap_aka_has_reauth_data;
1700 	eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1701 	eap->init_for_reauth = eap_aka_init_for_reauth;
1702 	eap->get_identity = eap_aka_get_identity;
1703 	eap->get_emsk = eap_aka_get_emsk;
1704 	eap->get_error_code = eap_aka_get_error_code;
1705 
1706 	return eap_peer_method_register(eap);
1707 }
1708 
1709 
1710 #ifdef EAP_AKA_PRIME
eap_peer_aka_prime_register(void)1711 int eap_peer_aka_prime_register(void)
1712 {
1713 	struct eap_method *eap;
1714 
1715 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1716 				    EAP_VENDOR_IETF, EAP_TYPE_AKA_PRIME,
1717 				    "AKA'");
1718 	if (eap == NULL)
1719 		return -1;
1720 
1721 	eap->init = eap_aka_prime_init;
1722 	eap->deinit = eap_aka_deinit;
1723 	eap->process = eap_aka_process;
1724 	eap->isKeyAvailable = eap_aka_isKeyAvailable;
1725 	eap->getKey = eap_aka_getKey;
1726 	eap->getSessionId = eap_aka_get_session_id;
1727 	eap->has_reauth_data = eap_aka_has_reauth_data;
1728 	eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1729 	eap->init_for_reauth = eap_aka_init_for_reauth;
1730 	eap->get_identity = eap_aka_get_identity;
1731 	eap->get_emsk = eap_aka_get_emsk;
1732 	eap->get_error_code = eap_aka_get_error_code;
1733 
1734 	return eap_peer_method_register(eap);
1735 }
1736 #endif /* EAP_AKA_PRIME */
1737