• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * EAP peer method: EAP-AKA (RFC 4187) and EAP-AKA' (RFC 5448)
3  * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "utils/base64.h"
13 #include "pcsc_funcs.h"
14 #include "crypto/crypto.h"
15 #include "crypto/sha1.h"
16 #include "crypto/sha256.h"
17 #include "crypto/milenage.h"
18 #include "eap_common/eap_sim_common.h"
19 #include "eap_config.h"
20 #include "eap_i.h"
21 
22 
23 struct eap_aka_data {
24 	u8 ik[EAP_AKA_IK_LEN], ck[EAP_AKA_CK_LEN], res[EAP_AKA_RES_MAX_LEN];
25 	size_t res_len;
26 	u8 nonce_s[EAP_SIM_NONCE_S_LEN];
27 	u8 mk[EAP_SIM_MK_LEN];
28 	u8 k_aut[EAP_AKA_PRIME_K_AUT_LEN];
29 	u8 k_encr[EAP_SIM_K_ENCR_LEN];
30 	u8 k_re[EAP_AKA_PRIME_K_RE_LEN]; /* EAP-AKA' only */
31 	u8 msk[EAP_SIM_KEYING_DATA_LEN];
32 	u8 emsk[EAP_EMSK_LEN];
33 	u8 rand[EAP_AKA_RAND_LEN], autn[EAP_AKA_AUTN_LEN];
34 	u8 auts[EAP_AKA_AUTS_LEN];
35 	u8 reauth_mac[EAP_SIM_MAC_LEN];
36 
37 	int num_id_req, num_notification;
38 	u8 *pseudonym;
39 	size_t pseudonym_len;
40 	u8 *reauth_id;
41 	size_t reauth_id_len;
42 	int reauth;
43 	unsigned int counter, counter_too_small;
44 	u8 *last_eap_identity;
45 	size_t last_eap_identity_len;
46 	enum {
47 		CONTINUE, RESULT_SUCCESS, SUCCESS, FAILURE
48 	} state;
49 
50 	struct wpabuf *id_msgs;
51 	int prev_id;
52 	int result_ind, use_result_ind;
53 	int use_pseudonym;
54 	u8 eap_method;
55 	u8 *network_name;
56 	size_t network_name_len;
57 	u16 kdf;
58 	int kdf_negotiation;
59 	u16 last_kdf_attrs[EAP_AKA_PRIME_KDF_MAX];
60 	size_t last_kdf_count;
61 	int error_code;
62 	struct crypto_rsa_key *imsi_privacy_key;
63 };
64 
65 
66 #ifndef CONFIG_NO_STDOUT_DEBUG
eap_aka_state_txt(int state)67 static const char * eap_aka_state_txt(int state)
68 {
69 	switch (state) {
70 	case CONTINUE:
71 		return "CONTINUE";
72 	case RESULT_SUCCESS:
73 		return "RESULT_SUCCESS";
74 	case SUCCESS:
75 		return "SUCCESS";
76 	case FAILURE:
77 		return "FAILURE";
78 	default:
79 		return "?";
80 	}
81 }
82 #endif /* CONFIG_NO_STDOUT_DEBUG */
83 
84 
eap_aka_state(struct eap_aka_data * data,int state)85 static void eap_aka_state(struct eap_aka_data *data, int state)
86 {
87 	wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
88 		   eap_aka_state_txt(data->state),
89 		   eap_aka_state_txt(state));
90 	data->state = state;
91 }
92 
93 
eap_aka_init(struct eap_sm * sm)94 static void * eap_aka_init(struct eap_sm *sm)
95 {
96 	struct eap_aka_data *data;
97 	const char *phase1 = eap_get_config_phase1(sm);
98 	struct eap_peer_config *config = eap_get_config(sm);
99 
100 	data = os_zalloc(sizeof(*data));
101 	if (data == NULL)
102 		return NULL;
103 
104 	data->eap_method = EAP_TYPE_AKA;
105 
106 	if (config && config->imsi_privacy_cert) {
107 #ifdef CRYPTO_RSA_OAEP_SHA256
108 		data->imsi_privacy_key = crypto_rsa_key_read(
109 			config->imsi_privacy_cert, false);
110 		if (!data->imsi_privacy_key) {
111 			wpa_printf(MSG_ERROR,
112 				   "EAP-AKA: Failed to read/parse IMSI privacy certificate %s",
113 				   config->imsi_privacy_cert);
114 			os_free(data);
115 			return NULL;
116 		}
117 #else /* CRYPTO_RSA_OAEP_SHA256 */
118 		wpa_printf(MSG_ERROR,
119 			   "EAP-AKA: No support for imsi_privacy_cert in the build");
120 		os_free(data);
121 		return NULL;
122 #endif /* CRYPTO_RSA_OAEP_SHA256 */
123 	}
124 
125 	/* Zero is a valid error code, so we need to initialize */
126 	data->error_code = NO_EAP_METHOD_ERROR;
127 
128 	eap_aka_state(data, CONTINUE);
129 	data->prev_id = -1;
130 
131 	data->result_ind = phase1 && os_strstr(phase1, "result_ind=1") != NULL;
132 
133 	data->use_pseudonym = !sm->init_phase2;
134 	if (config && config->anonymous_identity && data->use_pseudonym) {
135 		data->pseudonym = os_malloc(config->anonymous_identity_len);
136 		if (data->pseudonym) {
137 			os_memcpy(data->pseudonym, config->anonymous_identity,
138 				  config->anonymous_identity_len);
139 			data->pseudonym_len = config->anonymous_identity_len;
140 		}
141 	}
142 
143 	return data;
144 }
145 
146 
147 #ifdef EAP_AKA_PRIME
eap_aka_prime_init(struct eap_sm * sm)148 static void * eap_aka_prime_init(struct eap_sm *sm)
149 {
150 	struct eap_aka_data *data = eap_aka_init(sm);
151 	if (data == NULL)
152 		return NULL;
153 	data->eap_method = EAP_TYPE_AKA_PRIME;
154 	return data;
155 }
156 #endif /* EAP_AKA_PRIME */
157 
158 
eap_aka_clear_keys(struct eap_aka_data * data,int reauth)159 static void eap_aka_clear_keys(struct eap_aka_data *data, int reauth)
160 {
161 	if (!reauth) {
162 		os_memset(data->mk, 0, EAP_SIM_MK_LEN);
163 		os_memset(data->k_aut, 0, EAP_AKA_PRIME_K_AUT_LEN);
164 		os_memset(data->k_encr, 0, EAP_SIM_K_ENCR_LEN);
165 		os_memset(data->k_re, 0, EAP_AKA_PRIME_K_RE_LEN);
166 	}
167 	os_memset(data->msk, 0, EAP_SIM_KEYING_DATA_LEN);
168 	os_memset(data->emsk, 0, EAP_EMSK_LEN);
169 	os_memset(data->autn, 0, EAP_AKA_AUTN_LEN);
170 	os_memset(data->auts, 0, EAP_AKA_AUTS_LEN);
171 }
172 
173 
eap_aka_deinit(struct eap_sm * sm,void * priv)174 static void eap_aka_deinit(struct eap_sm *sm, void *priv)
175 {
176 	struct eap_aka_data *data = priv;
177 	if (data) {
178 		os_free(data->pseudonym);
179 		os_free(data->reauth_id);
180 		os_free(data->last_eap_identity);
181 		wpabuf_free(data->id_msgs);
182 		os_free(data->network_name);
183 		eap_aka_clear_keys(data, 0);
184 #ifdef CRYPTO_RSA_OAEP_SHA256
185 		crypto_rsa_key_free(data->imsi_privacy_key);
186 #endif /* CRYPTO_RSA_OAEP_SHA256 */
187 		os_free(data);
188 	}
189 }
190 
191 
eap_aka_ext_sim_req(struct eap_sm * sm,struct eap_aka_data * data)192 static int eap_aka_ext_sim_req(struct eap_sm *sm, struct eap_aka_data *data)
193 {
194 	char req[200], *pos, *end;
195 
196 	wpa_printf(MSG_DEBUG, "EAP-AKA: Use external USIM processing");
197 	pos = req;
198 	end = pos + sizeof(req);
199 	pos += os_snprintf(pos, end - pos, "UMTS-AUTH");
200 	pos += os_snprintf(pos, end - pos, ":");
201 	pos += wpa_snprintf_hex(pos, end - pos, data->rand, EAP_AKA_RAND_LEN);
202 	pos += os_snprintf(pos, end - pos, ":");
203 	wpa_snprintf_hex(pos, end - pos, data->autn, EAP_AKA_AUTN_LEN);
204 
205 	eap_sm_request_sim(sm, req);
206 	return 1;
207 }
208 
209 
eap_aka_ext_sim_result(struct eap_sm * sm,struct eap_aka_data * data,struct eap_peer_config * conf)210 static int eap_aka_ext_sim_result(struct eap_sm *sm, struct eap_aka_data *data,
211 				  struct eap_peer_config *conf)
212 {
213 	char *resp, *pos;
214 
215 	wpa_printf(MSG_DEBUG,
216 		   "EAP-AKA: Use result from external USIM processing");
217 
218 	resp = conf->external_sim_resp;
219 	conf->external_sim_resp = NULL;
220 
221 	if (os_strncmp(resp, "UMTS-AUTS:", 10) == 0) {
222 		pos = resp + 10;
223 		if (hexstr2bin(pos, data->auts, EAP_AKA_AUTS_LEN) < 0)
224 			goto invalid;
225 		wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: AUTS", data->auts,
226 				EAP_AKA_AUTS_LEN);
227 		os_free(resp);
228 		return -2;
229 	}
230 
231 	if (os_strncmp(resp, "UMTS-AUTH:", 10) != 0) {
232 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized external USIM processing response");
233 		os_free(resp);
234 		return -1;
235 	}
236 
237 	pos = resp + 10;
238 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: RAND", data->rand, EAP_AKA_RAND_LEN);
239 
240 	if (hexstr2bin(pos, data->ik, EAP_AKA_IK_LEN) < 0)
241 		goto invalid;
242 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", data->ik, EAP_AKA_IK_LEN);
243 	pos += EAP_AKA_IK_LEN * 2;
244 	if (*pos != ':')
245 		goto invalid;
246 	pos++;
247 
248 	if (hexstr2bin(pos, data->ck, EAP_AKA_CK_LEN) < 0)
249 		goto invalid;
250 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", data->ck, EAP_AKA_CK_LEN);
251 	pos += EAP_AKA_CK_LEN * 2;
252 	if (*pos != ':')
253 		goto invalid;
254 	pos++;
255 
256 	data->res_len = os_strlen(pos) / 2;
257 	if (data->res_len > EAP_AKA_RES_MAX_LEN) {
258 		data->res_len = 0;
259 		goto invalid;
260 	}
261 	if (hexstr2bin(pos, data->res, data->res_len) < 0)
262 		goto invalid;
263 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: RES", data->res, data->res_len);
264 
265 	os_free(resp);
266 	return 0;
267 
268 invalid:
269 	wpa_printf(MSG_DEBUG, "EAP-AKA: Invalid external USIM processing UMTS-AUTH response");
270 	os_free(resp);
271 	return -1;
272 }
273 
274 
eap_aka_umts_auth(struct eap_sm * sm,struct eap_aka_data * data)275 static int eap_aka_umts_auth(struct eap_sm *sm, struct eap_aka_data *data)
276 {
277 	struct eap_peer_config *conf;
278 
279 	wpa_printf(MSG_DEBUG, "EAP-AKA: UMTS authentication algorithm");
280 
281 	conf = eap_get_config(sm);
282 	if (conf == NULL)
283 		return -1;
284 
285 	if (sm->external_sim) {
286 		if (conf->external_sim_resp)
287 			return eap_aka_ext_sim_result(sm, data, conf);
288 		else
289 			return eap_aka_ext_sim_req(sm, data);
290 	}
291 
292 	if (conf->pcsc) {
293 		return scard_umts_auth(sm->scard_ctx, data->rand,
294 				       data->autn, data->res, &data->res_len,
295 				       data->ik, data->ck, data->auts);
296 	}
297 
298 #ifdef CONFIG_USIM_SIMULATOR
299 	if (conf->password) {
300 		u8 opc[16], k[16], sqn[6];
301 		const char *pos;
302 		wpa_printf(MSG_DEBUG, "EAP-AKA: Use internal Milenage "
303 			   "implementation for UMTS authentication");
304 		if (conf->password_len < 78) {
305 			wpa_printf(MSG_DEBUG, "EAP-AKA: invalid Milenage "
306 				   "password");
307 			return -1;
308 		}
309 		pos = (const char *) conf->password;
310 		if (hexstr2bin(pos, k, 16))
311 			return -1;
312 		pos += 32;
313 		if (*pos != ':')
314 			return -1;
315 		pos++;
316 
317 		if (hexstr2bin(pos, opc, 16))
318 			return -1;
319 		pos += 32;
320 		if (*pos != ':')
321 			return -1;
322 		pos++;
323 
324 		if (hexstr2bin(pos, sqn, 6))
325 			return -1;
326 
327 		return milenage_check(opc, k, sqn, data->rand, data->autn,
328 				      data->ik, data->ck,
329 				      data->res, &data->res_len, data->auts);
330 	}
331 #endif /* CONFIG_USIM_SIMULATOR */
332 
333 #ifdef CONFIG_USIM_HARDCODED
334 	wpa_printf(MSG_DEBUG, "EAP-AKA: Use hardcoded Kc and SRES values for "
335 		   "testing");
336 
337 	/* These hardcoded Kc and SRES values are used for testing.
338 	 * Could consider making them configurable. */
339 	os_memset(data->res, '2', EAP_AKA_RES_MAX_LEN);
340 	data->res_len = EAP_AKA_RES_MAX_LEN;
341 	os_memset(data->ik, '3', EAP_AKA_IK_LEN);
342 	os_memset(data->ck, '4', EAP_AKA_CK_LEN);
343 	{
344 		u8 autn[EAP_AKA_AUTN_LEN];
345 		os_memset(autn, '1', EAP_AKA_AUTN_LEN);
346 		if (os_memcmp_const(autn, data->autn, EAP_AKA_AUTN_LEN) != 0) {
347 			wpa_printf(MSG_WARNING, "EAP-AKA: AUTN did not match "
348 				   "with expected value");
349 			return -1;
350 		}
351 	}
352 #if 0
353 	{
354 		static int test_resync = 1;
355 		if (test_resync) {
356 			/* Test Resynchronization */
357 			test_resync = 0;
358 			return -2;
359 		}
360 	}
361 #endif
362 	return 0;
363 
364 #else /* CONFIG_USIM_HARDCODED */
365 
366 	wpa_printf(MSG_DEBUG, "EAP-AKA: No UMTS authentication algorithm "
367 		   "enabled");
368 	return -1;
369 
370 #endif /* CONFIG_USIM_HARDCODED */
371 }
372 
373 
374 #define CLEAR_PSEUDONYM	0x01
375 #define CLEAR_REAUTH_ID	0x02
376 #define CLEAR_EAP_ID	0x04
377 
eap_aka_clear_identities(struct eap_sm * sm,struct eap_aka_data * data,int id)378 static void eap_aka_clear_identities(struct eap_sm *sm,
379 				     struct eap_aka_data *data, int id)
380 {
381 	if ((id & CLEAR_PSEUDONYM) && data->pseudonym) {
382 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old pseudonym");
383 		os_free(data->pseudonym);
384 		data->pseudonym = NULL;
385 		data->pseudonym_len = 0;
386 		if (data->use_pseudonym)
387 			eap_set_anon_id(sm, NULL, 0);
388 	}
389 	if ((id & CLEAR_REAUTH_ID) && data->reauth_id) {
390 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old reauth_id");
391 		os_free(data->reauth_id);
392 		data->reauth_id = NULL;
393 		data->reauth_id_len = 0;
394 	}
395 	if ((id & CLEAR_EAP_ID) && data->last_eap_identity) {
396 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old eap_id");
397 		os_free(data->last_eap_identity);
398 		data->last_eap_identity = NULL;
399 		data->last_eap_identity_len = 0;
400 	}
401 }
402 
403 
eap_aka_learn_ids(struct eap_sm * sm,struct eap_aka_data * data,struct eap_sim_attrs * attr)404 static int eap_aka_learn_ids(struct eap_sm *sm, struct eap_aka_data *data,
405 			     struct eap_sim_attrs *attr)
406 {
407 	if (attr->next_pseudonym) {
408 		const u8 *identity = NULL;
409 		size_t identity_len = 0;
410 		const u8 *realm = NULL;
411 		size_t realm_len = 0;
412 
413 		wpa_hexdump_ascii(MSG_DEBUG,
414 				  "EAP-AKA: (encr) AT_NEXT_PSEUDONYM",
415 				  attr->next_pseudonym,
416 				  attr->next_pseudonym_len);
417 		os_free(data->pseudonym);
418 
419 		/* Get realm from identities to decorate pseudonym. */
420 		realm = eap_get_config_realm(sm, &realm_len);
421 
422 		data->pseudonym = os_malloc(attr->next_pseudonym_len +
423 					    realm_len);
424 		if (data->pseudonym == NULL) {
425 			wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
426 				   "next pseudonym");
427 			data->pseudonym_len = 0;
428 			return -1;
429 		}
430 		os_memcpy(data->pseudonym, attr->next_pseudonym,
431 			  attr->next_pseudonym_len);
432 		if (realm_len) {
433 			os_memcpy(data->pseudonym + attr->next_pseudonym_len,
434 				  realm, realm_len);
435 		}
436 		data->pseudonym_len = attr->next_pseudonym_len + realm_len;
437 		if (data->use_pseudonym)
438 			eap_set_anon_id(sm, data->pseudonym,
439 					data->pseudonym_len);
440 	}
441 
442 	if (attr->next_reauth_id) {
443 		os_free(data->reauth_id);
444 		data->reauth_id = os_memdup(attr->next_reauth_id,
445 					    attr->next_reauth_id_len);
446 		if (data->reauth_id == NULL) {
447 			wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
448 				   "next reauth_id");
449 			data->reauth_id_len = 0;
450 			return -1;
451 		}
452 		data->reauth_id_len = attr->next_reauth_id_len;
453 		wpa_hexdump_ascii(MSG_DEBUG,
454 				  "EAP-AKA: (encr) AT_NEXT_REAUTH_ID",
455 				  data->reauth_id,
456 				  data->reauth_id_len);
457 	}
458 
459 	return 0;
460 }
461 
462 
eap_aka_add_id_msg(struct eap_aka_data * data,const struct wpabuf * msg1,const struct wpabuf * msg2)463 static int eap_aka_add_id_msg(struct eap_aka_data *data,
464 			      const struct wpabuf *msg1,
465 			      const struct wpabuf *msg2)
466 {
467 	size_t len;
468 
469 	if (!msg1)
470 		return -1;
471 	len = wpabuf_len(msg1);
472 	if (msg2)
473 		len += wpabuf_len(msg2);
474 
475 	if (!data->id_msgs) {
476 		data->id_msgs = wpabuf_alloc(len);
477 		if (!data->id_msgs)
478 			return -1;
479 	} else if (wpabuf_resize(&data->id_msgs, len) < 0) {
480 		return -1;
481 	}
482 
483 	wpabuf_put_buf(data->id_msgs, msg1);
484 	if (msg2)
485 		wpabuf_put_buf(data->id_msgs, msg2);
486 
487 	return 0;
488 }
489 
490 
eap_aka_add_checkcode(struct eap_aka_data * data,struct eap_sim_msg * msg)491 static void eap_aka_add_checkcode(struct eap_aka_data *data,
492 				  struct eap_sim_msg *msg)
493 {
494 	const u8 *addr;
495 	size_t len;
496 	u8 hash[SHA256_MAC_LEN];
497 
498 	wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
499 
500 	if (data->id_msgs == NULL) {
501 		/*
502 		 * No EAP-AKA/Identity packets were exchanged - send empty
503 		 * checkcode.
504 		 */
505 		eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
506 		return;
507 	}
508 
509 	/* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
510 	addr = wpabuf_head(data->id_msgs);
511 	len = wpabuf_len(data->id_msgs);
512 	wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
513 #ifdef EAP_AKA_PRIME
514 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
515 		sha256_vector(1, &addr, &len, hash);
516 	else
517 #endif /* EAP_AKA_PRIME */
518 		sha1_vector(1, &addr, &len, hash);
519 
520 	eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
521 			data->eap_method == EAP_TYPE_AKA_PRIME ?
522 			EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN);
523 }
524 
525 
eap_aka_verify_checkcode(struct eap_aka_data * data,const u8 * checkcode,size_t checkcode_len)526 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
527 				    const u8 *checkcode, size_t checkcode_len)
528 {
529 	const u8 *addr;
530 	size_t len;
531 	u8 hash[SHA256_MAC_LEN];
532 	size_t hash_len;
533 
534 	if (checkcode == NULL)
535 		return -1;
536 
537 	if (data->id_msgs == NULL) {
538 		if (checkcode_len != 0) {
539 			wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
540 				   "indicates that AKA/Identity messages were "
541 				   "used, but they were not");
542 			return -1;
543 		}
544 		return 0;
545 	}
546 
547 	hash_len = data->eap_method == EAP_TYPE_AKA_PRIME ?
548 		EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN;
549 
550 	if (checkcode_len != hash_len) {
551 		wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
552 			   "indicates that AKA/Identity message were not "
553 			   "used, but they were");
554 		return -1;
555 	}
556 
557 	/* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
558 	addr = wpabuf_head(data->id_msgs);
559 	len = wpabuf_len(data->id_msgs);
560 #ifdef EAP_AKA_PRIME
561 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
562 		sha256_vector(1, &addr, &len, hash);
563 	else
564 #endif /* EAP_AKA_PRIME */
565 		sha1_vector(1, &addr, &len, hash);
566 
567 	if (os_memcmp_const(hash, checkcode, hash_len) != 0) {
568 		wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
569 		return -1;
570 	}
571 
572 	return 0;
573 }
574 
575 
eap_aka_client_error(struct eap_aka_data * data,u8 id,int err)576 static struct wpabuf * eap_aka_client_error(struct eap_aka_data *data, u8 id,
577 					    int err)
578 {
579 	struct eap_sim_msg *msg;
580 
581 	eap_aka_state(data, FAILURE);
582 	data->num_id_req = 0;
583 	data->num_notification = 0;
584 
585 	wpa_printf(MSG_DEBUG, "EAP-AKA: Send Client-Error (error code %d)",
586 		   err);
587 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
588 			       EAP_AKA_SUBTYPE_CLIENT_ERROR);
589 	eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
590 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
591 }
592 
593 
eap_aka_authentication_reject(struct eap_aka_data * data,u8 id)594 static struct wpabuf * eap_aka_authentication_reject(struct eap_aka_data *data,
595 						     u8 id)
596 {
597 	struct eap_sim_msg *msg;
598 
599 	eap_aka_state(data, FAILURE);
600 	data->num_id_req = 0;
601 	data->num_notification = 0;
602 
603 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Authentication-Reject "
604 		   "(id=%d)", id);
605 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
606 			       EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT);
607 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
608 }
609 
610 
eap_aka_synchronization_failure(struct eap_aka_data * data,u8 id,struct eap_sim_attrs * attr)611 static struct wpabuf * eap_aka_synchronization_failure(
612 	struct eap_aka_data *data, u8 id, struct eap_sim_attrs *attr)
613 {
614 	struct eap_sim_msg *msg;
615 
616 	data->num_id_req = 0;
617 	data->num_notification = 0;
618 
619 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Synchronization-Failure "
620 		   "(id=%d)", id);
621 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
622 			       EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE);
623 	wpa_printf(MSG_DEBUG, "   AT_AUTS");
624 	eap_sim_msg_add_full(msg, EAP_SIM_AT_AUTS, data->auts,
625 			     EAP_AKA_AUTS_LEN);
626 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
627 		size_t i;
628 
629 		for (i = 0; i < attr->kdf_count; i++) {
630 			wpa_printf(MSG_DEBUG, "   AT_KDF");
631 			eap_sim_msg_add(msg, EAP_SIM_AT_KDF, attr->kdf[i],
632 					NULL, 0);
633 		}
634 	}
635 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
636 }
637 
638 
639 #ifdef CRYPTO_RSA_OAEP_SHA256
640 static struct wpabuf *
eap_aka_encrypt_identity(struct crypto_rsa_key * imsi_privacy_key,const u8 * identity,size_t identity_len,const char * attr)641 eap_aka_encrypt_identity(struct crypto_rsa_key *imsi_privacy_key,
642 			 const u8 *identity, size_t identity_len,
643 			 const char *attr)
644 {
645 	struct wpabuf *imsi_buf, *enc;
646 	char *b64;
647 	size_t b64_len, len;
648 
649 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Encrypt permanent identity",
650 			  identity, identity_len);
651 
652 	imsi_buf = wpabuf_alloc_copy(identity, identity_len);
653 	if (!imsi_buf)
654 		return NULL;
655 	enc = crypto_rsa_oaep_sha256_encrypt(imsi_privacy_key, imsi_buf);
656 	wpabuf_free(imsi_buf);
657 	if (!enc)
658 		return NULL;
659 
660 	b64 = base64_encode_no_lf(wpabuf_head(enc), wpabuf_len(enc), &b64_len);
661 	wpabuf_free(enc);
662 	if (!b64)
663 		return NULL;
664 
665 	len = 1 + b64_len;
666 	if (attr)
667 		len += 1 + os_strlen(attr);
668 	enc = wpabuf_alloc(len);
669 	if (!enc) {
670 		os_free(b64);
671 		return NULL;
672 	}
673 	wpabuf_put_u8(enc, '\0');
674 	wpabuf_put_data(enc, b64, b64_len);
675 	os_free(b64);
676 	if (attr) {
677 		wpabuf_put_u8(enc, ',');
678 		wpabuf_put_str(enc, attr);
679 	}
680 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Encrypted permanent identity",
681 			  wpabuf_head(enc), wpabuf_len(enc));
682 
683 	return enc;
684 }
685 #endif /* CRYPTO_RSA_OAEP_SHA256 */
686 
687 
eap_aka_response_identity(struct eap_sm * sm,struct eap_aka_data * data,u8 id,enum eap_sim_id_req id_req)688 static struct wpabuf * eap_aka_response_identity(struct eap_sm *sm,
689 						 struct eap_aka_data *data,
690 						 u8 id,
691 						 enum eap_sim_id_req id_req)
692 {
693 	const u8 *identity = NULL;
694 	size_t identity_len = 0;
695 	struct eap_sim_msg *msg;
696 	struct wpabuf *enc_identity = NULL;
697 
698 	data->reauth = 0;
699 	if (id_req == ANY_ID && data->reauth_id) {
700 		identity = data->reauth_id;
701 		identity_len = data->reauth_id_len;
702 		data->reauth = 1;
703 	} else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
704 		   data->pseudonym &&
705 		   !eap_sim_anonymous_username(data->pseudonym,
706 					       data->pseudonym_len)) {
707 		identity = data->pseudonym;
708 		identity_len = data->pseudonym_len;
709 		eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
710 	} else if (id_req != NO_ID_REQ) {
711 		if (id_req == PERMANENT_ID && eap_get_config_strict_conservative_peer_mode(sm)) {
712 			wpa_printf(MSG_INFO, "EAP-AKA: permanent_id_req is denied in "
713 				   "the strict conservative peer mode");
714 			eap_notify_permanent_id_req_denied(sm);
715 			return eap_aka_client_error(data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
716 		}
717 		identity = eap_get_config_identity(sm, &identity_len);
718 		if (identity) {
719 			int ids = CLEAR_PSEUDONYM | CLEAR_REAUTH_ID;
720 
721 			if (data->pseudonym &&
722 			    eap_sim_anonymous_username(data->pseudonym,
723 						       data->pseudonym_len))
724 				ids &= ~CLEAR_PSEUDONYM;
725 			eap_aka_clear_identities(sm, data, ids);
726 		}
727 #ifdef CRYPTO_RSA_OAEP_SHA256
728 		if (identity && data->imsi_privacy_key) {
729 			struct eap_peer_config *config;
730 			const char *attr = NULL;
731 
732 			config = eap_get_config(sm);
733 			if (config)
734 				attr = config->imsi_privacy_attr;
735 			enc_identity = eap_aka_encrypt_identity(
736 				data->imsi_privacy_key,
737 				identity, identity_len, attr);
738 			if (!enc_identity) {
739 				wpa_printf(MSG_INFO,
740 					   "EAP-AKA: Failed to encrypt permanent identity");
741 				return eap_aka_client_error(
742 					data, id,
743 					EAP_AKA_UNABLE_TO_PROCESS_PACKET);
744 			}
745 			identity = wpabuf_head(enc_identity);
746 			identity_len = wpabuf_len(enc_identity);
747 		}
748 #endif /* CRYPTO_RSA_OAEP_SHA256 */
749 	}
750 	if (id_req != NO_ID_REQ)
751 		eap_aka_clear_identities(sm, data, CLEAR_EAP_ID);
752 
753 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Identity (id=%d)", id);
754 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
755 			       EAP_AKA_SUBTYPE_IDENTITY);
756 
757 	if (identity) {
758 		wpa_hexdump_ascii(MSG_DEBUG, "   AT_IDENTITY",
759 				  identity, identity_len);
760 		eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
761 				identity, identity_len);
762 	}
763 	wpabuf_free(enc_identity);
764 
765 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
766 }
767 
768 
eap_aka_response_challenge(struct eap_aka_data * data,u8 id)769 static struct wpabuf * eap_aka_response_challenge(struct eap_aka_data *data,
770 						  u8 id)
771 {
772 	struct eap_sim_msg *msg;
773 
774 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d)", id);
775 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
776 			       EAP_AKA_SUBTYPE_CHALLENGE);
777 	wpa_printf(MSG_DEBUG, "   AT_RES");
778 	eap_sim_msg_add(msg, EAP_SIM_AT_RES, data->res_len * 8,
779 			data->res, data->res_len);
780 	eap_aka_add_checkcode(data, msg);
781 	if (data->use_result_ind) {
782 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
783 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
784 	}
785 	wpa_printf(MSG_DEBUG, "   AT_MAC");
786 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
787 	return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, (u8 *) "",
788 				  0);
789 }
790 
791 
eap_aka_response_reauth(struct eap_aka_data * data,u8 id,int counter_too_small,const u8 * nonce_s)792 static struct wpabuf * eap_aka_response_reauth(struct eap_aka_data *data,
793 					       u8 id, int counter_too_small,
794 					       const u8 *nonce_s)
795 {
796 	struct eap_sim_msg *msg;
797 	unsigned int counter;
798 
799 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Reauthentication (id=%d)",
800 		   id);
801 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
802 			       EAP_AKA_SUBTYPE_REAUTHENTICATION);
803 	wpa_printf(MSG_DEBUG, "   AT_IV");
804 	wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
805 	eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
806 
807 	if (counter_too_small) {
808 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER_TOO_SMALL");
809 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
810 		counter = data->counter_too_small;
811 	} else
812 		counter = data->counter;
813 
814 	wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", counter);
815 	eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
816 
817 	if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
818 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
819 			   "AT_ENCR_DATA");
820 		eap_sim_msg_free(msg);
821 		return NULL;
822 	}
823 	eap_aka_add_checkcode(data, msg);
824 	if (data->use_result_ind) {
825 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
826 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
827 	}
828 	wpa_printf(MSG_DEBUG, "   AT_MAC");
829 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
830 	return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, nonce_s,
831 				  EAP_SIM_NONCE_S_LEN);
832 }
833 
834 
eap_aka_response_notification(struct eap_aka_data * data,u8 id,u16 notification)835 static struct wpabuf * eap_aka_response_notification(struct eap_aka_data *data,
836 						     u8 id, u16 notification)
837 {
838 	struct eap_sim_msg *msg;
839 	u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
840 
841 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Notification (id=%d)", id);
842 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
843 			       EAP_AKA_SUBTYPE_NOTIFICATION);
844 	if (k_aut && data->reauth) {
845 		wpa_printf(MSG_DEBUG, "   AT_IV");
846 		wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
847 		eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
848 					   EAP_SIM_AT_ENCR_DATA);
849 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", data->counter);
850 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
851 				NULL, 0);
852 		if (eap_sim_msg_add_encr_end(msg, data->k_encr,
853 					     EAP_SIM_AT_PADDING)) {
854 			wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
855 				   "AT_ENCR_DATA");
856 			eap_sim_msg_free(msg);
857 			return NULL;
858 		}
859 	}
860 	if (k_aut) {
861 		wpa_printf(MSG_DEBUG, "   AT_MAC");
862 		eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
863 	}
864 	return eap_sim_msg_finish(msg, data->eap_method, k_aut, (u8 *) "", 0);
865 }
866 
867 
eap_aka_process_identity(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)868 static struct wpabuf * eap_aka_process_identity(struct eap_sm *sm,
869 						struct eap_aka_data *data,
870 						u8 id,
871 						const struct wpabuf *reqData,
872 						struct eap_sim_attrs *attr)
873 {
874 	int id_error;
875 	struct wpabuf *buf;
876 
877 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Identity");
878 
879 	id_error = 0;
880 	switch (attr->id_req) {
881 	case NO_ID_REQ:
882 		break;
883 	case ANY_ID:
884 		if (data->num_id_req > 0)
885 			id_error++;
886 		data->num_id_req++;
887 		break;
888 	case FULLAUTH_ID:
889 		if (data->num_id_req > 1)
890 			id_error++;
891 		data->num_id_req++;
892 		break;
893 	case PERMANENT_ID:
894 		if (data->num_id_req > 2)
895 			id_error++;
896 		data->num_id_req++;
897 		break;
898 	}
899 	if (id_error) {
900 		wpa_printf(MSG_INFO, "EAP-AKA: Too many ID requests "
901 			   "used within one authentication");
902 		return eap_aka_client_error(data, id,
903 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
904 	}
905 
906 	buf = eap_aka_response_identity(sm, data, id, attr->id_req);
907 
908 	if (data->prev_id != id) {
909 		if (eap_aka_add_id_msg(data, reqData, buf) < 0) {
910 			wpa_printf(MSG_INFO,
911 				   "EAP-AKA: Failed to store ID messages");
912 			wpabuf_free(buf);
913 			return eap_aka_client_error(
914 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
915 		}
916 		data->prev_id = id;
917 	}
918 
919 	return buf;
920 }
921 
922 
eap_aka_verify_mac(struct eap_aka_data * data,const struct wpabuf * req,const u8 * mac,const u8 * extra,size_t extra_len)923 static int eap_aka_verify_mac(struct eap_aka_data *data,
924 			      const struct wpabuf *req,
925 			      const u8 *mac, const u8 *extra,
926 			      size_t extra_len)
927 {
928 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
929 		return eap_sim_verify_mac_sha256(data->k_aut, req, mac, extra,
930 						 extra_len);
931 	return eap_sim_verify_mac(data->k_aut, req, mac, extra, extra_len);
932 }
933 
934 
935 #ifdef EAP_AKA_PRIME
eap_aka_prime_kdf_select(struct eap_aka_data * data,u8 id,u16 kdf)936 static struct wpabuf * eap_aka_prime_kdf_select(struct eap_aka_data *data,
937 						u8 id, u16 kdf)
938 {
939 	struct eap_sim_msg *msg;
940 
941 	data->kdf_negotiation = 1;
942 	data->kdf = kdf;
943 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d) (KDF "
944 		   "select)", id);
945 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
946 			       EAP_AKA_SUBTYPE_CHALLENGE);
947 	wpa_printf(MSG_DEBUG, "   AT_KDF");
948 	eap_sim_msg_add(msg, EAP_SIM_AT_KDF, kdf, NULL, 0);
949 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
950 }
951 
952 
eap_aka_prime_kdf_neg(struct eap_aka_data * data,u8 id,struct eap_sim_attrs * attr)953 static struct wpabuf * eap_aka_prime_kdf_neg(struct eap_aka_data *data,
954 					     u8 id, struct eap_sim_attrs *attr)
955 {
956 	size_t i;
957 
958 	for (i = 0; i < attr->kdf_count; i++) {
959 		if (attr->kdf[i] == EAP_AKA_PRIME_KDF) {
960 			os_memcpy(data->last_kdf_attrs, attr->kdf,
961 				  sizeof(u16) * attr->kdf_count);
962 			data->last_kdf_count = attr->kdf_count;
963 			return eap_aka_prime_kdf_select(data, id,
964 							EAP_AKA_PRIME_KDF);
965 		}
966 	}
967 
968 	/* No matching KDF found - fail authentication as if AUTN had been
969 	 * incorrect */
970 	return eap_aka_authentication_reject(data, id);
971 }
972 
973 
eap_aka_prime_kdf_valid(struct eap_aka_data * data,struct eap_sim_attrs * attr)974 static int eap_aka_prime_kdf_valid(struct eap_aka_data *data,
975 				   struct eap_sim_attrs *attr)
976 {
977 	size_t i, j;
978 
979 	if (attr->kdf_count == 0)
980 		return 0;
981 
982 	/* The only allowed (and required) duplication of a KDF is the addition
983 	 * of the selected KDF into the beginning of the list. */
984 
985 	if (data->kdf_negotiation) {
986 		/* When the peer receives the new EAP-Request/AKA'-Challenge
987 		 * message, must check only requested change occurred in the
988 		 * list of AT_KDF attributes. If there are any other changes,
989 		 * the peer must behave like the case that AT_MAC had been
990 		 * incorrect and authentication is failed. These are defined in
991 		 * EAP-AKA' specification RFC 5448, Section 3.2. */
992 		if (attr->kdf[0] != data->kdf) {
993 			wpa_printf(MSG_WARNING, "EAP-AKA': The server did not "
994 				   "accept the selected KDF");
995 			return -1;
996 		}
997 
998 		if (attr->kdf_count > EAP_AKA_PRIME_KDF_MAX ||
999 		    attr->kdf_count != data->last_kdf_count + 1) {
1000 			wpa_printf(MSG_WARNING,
1001 				   "EAP-AKA': The length of KDF attributes is wrong");
1002 			return -1;
1003 		}
1004 
1005 		for (i = 1; i < attr->kdf_count; i++) {
1006 			if (attr->kdf[i] != data->last_kdf_attrs[i - 1]) {
1007 				wpa_printf(MSG_WARNING,
1008 					   "EAP-AKA': The KDF attributes except selected KDF are not same as original one");
1009 				return -1;
1010 			}
1011 		}
1012 	}
1013 
1014 	for (i = data->kdf ? 1 : 0; i < attr->kdf_count; i++) {
1015 		for (j = i + 1; j < attr->kdf_count; j++) {
1016 			if (attr->kdf[i] == attr->kdf[j]) {
1017 				wpa_printf(MSG_WARNING, "EAP-AKA': The server "
1018 					   "included a duplicated KDF");
1019 				return 0;
1020 			}
1021 		}
1022 	}
1023 
1024 	return 1;
1025 }
1026 #endif /* EAP_AKA_PRIME */
1027 
1028 
eap_aka_process_challenge(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1029 static struct wpabuf * eap_aka_process_challenge(struct eap_sm *sm,
1030 						 struct eap_aka_data *data,
1031 						 u8 id,
1032 						 const struct wpabuf *reqData,
1033 						 struct eap_sim_attrs *attr)
1034 {
1035 	const u8 *identity;
1036 	size_t identity_len;
1037 	int res;
1038 	struct eap_sim_attrs eattr;
1039 
1040 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Challenge");
1041 
1042 	if (attr->checkcode &&
1043 	    eap_aka_verify_checkcode(data, attr->checkcode,
1044 				     attr->checkcode_len)) {
1045 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1046 			   "message");
1047 #ifdef TEST_FUZZ
1048 		wpa_printf(MSG_INFO,
1049 			   "TEST: Ignore AT_CHECKCODE mismatch for fuzz testing");
1050 #else /* TEST_FUZZ */
1051 		return eap_aka_client_error(data, id,
1052 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1053 #endif /* TEST_FUZZ */
1054 	}
1055 
1056 #ifdef EAP_AKA_PRIME
1057 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1058 		if (!attr->kdf_input || attr->kdf_input_len == 0) {
1059 			wpa_printf(MSG_WARNING, "EAP-AKA': Challenge message "
1060 				   "did not include non-empty AT_KDF_INPUT");
1061 			/* Fail authentication as if AUTN had been incorrect */
1062 			return eap_aka_authentication_reject(data, id);
1063 		}
1064 		os_free(data->network_name);
1065 		data->network_name = os_memdup(attr->kdf_input,
1066 					       attr->kdf_input_len);
1067 		if (data->network_name == NULL) {
1068 			wpa_printf(MSG_WARNING, "EAP-AKA': No memory for "
1069 				   "storing Network Name");
1070 			return eap_aka_authentication_reject(data, id);
1071 		}
1072 		data->network_name_len = attr->kdf_input_len;
1073 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA': Network Name "
1074 				  "(AT_KDF_INPUT)",
1075 				  data->network_name, data->network_name_len);
1076 		/* TODO: check Network Name per 3GPP.33.402 */
1077 
1078 		res = eap_aka_prime_kdf_valid(data, attr);
1079 		if (res == 0)
1080 			return eap_aka_authentication_reject(data, id);
1081 		else if (res == -1)
1082 			return eap_aka_client_error(
1083 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1084 
1085 		if (attr->kdf[0] != EAP_AKA_PRIME_KDF)
1086 			return eap_aka_prime_kdf_neg(data, id, attr);
1087 
1088 		data->kdf = EAP_AKA_PRIME_KDF;
1089 		wpa_printf(MSG_DEBUG, "EAP-AKA': KDF %d selected", data->kdf);
1090 	}
1091 
1092 	if (data->eap_method == EAP_TYPE_AKA && attr->bidding) {
1093 		u16 flags = WPA_GET_BE16(attr->bidding);
1094 		if ((flags & EAP_AKA_BIDDING_FLAG_D) &&
1095 		    eap_allowed_method(sm, EAP_VENDOR_IETF,
1096 				       EAP_TYPE_AKA_PRIME)) {
1097 			wpa_printf(MSG_WARNING, "EAP-AKA: Bidding down from "
1098 				   "AKA' to AKA detected");
1099 			/* Fail authentication as if AUTN had been incorrect */
1100 			return eap_aka_authentication_reject(data, id);
1101 		}
1102 	}
1103 #endif /* EAP_AKA_PRIME */
1104 
1105 	data->reauth = 0;
1106 	if (!attr->mac || !attr->rand || !attr->autn) {
1107 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1108 			   "did not include%s%s%s",
1109 			   !attr->mac ? " AT_MAC" : "",
1110 			   !attr->rand ? " AT_RAND" : "",
1111 			   !attr->autn ? " AT_AUTN" : "");
1112 		return eap_aka_client_error(data, id,
1113 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1114 	}
1115 	os_memcpy(data->rand, attr->rand, EAP_AKA_RAND_LEN);
1116 	os_memcpy(data->autn, attr->autn, EAP_AKA_AUTN_LEN);
1117 
1118 	res = eap_aka_umts_auth(sm, data);
1119 	if (res == -1) {
1120 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1121 			   "failed (AUTN)");
1122 		return eap_aka_authentication_reject(data, id);
1123 	} else if (res == -2) {
1124 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1125 			   "failed (AUTN seq# -> AUTS)");
1126 		return eap_aka_synchronization_failure(data, id, attr);
1127 	} else if (res > 0) {
1128 		wpa_printf(MSG_DEBUG, "EAP-AKA: Wait for external USIM processing");
1129 		return NULL;
1130 	} else if (res) {
1131 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication failed");
1132 		return eap_aka_client_error(data, id,
1133 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1134 	}
1135 #ifdef EAP_AKA_PRIME
1136 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1137 		/* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
1138 		 * needed 6-octet SQN ^ AK for CK',IK' derivation */
1139 		u16 amf = WPA_GET_BE16(data->autn + 6);
1140 		if (!(amf & 0x8000)) {
1141 			wpa_printf(MSG_WARNING, "EAP-AKA': AMF separation bit "
1142 				   "not set (AMF=0x%4x)", amf);
1143 			return eap_aka_authentication_reject(data, id);
1144 		}
1145 		eap_aka_prime_derive_ck_ik_prime(data->ck, data->ik,
1146 						 data->autn,
1147 						 data->network_name,
1148 						 data->network_name_len);
1149 	}
1150 #endif /* EAP_AKA_PRIME */
1151 	if (data->last_eap_identity) {
1152 		identity = data->last_eap_identity;
1153 		identity_len = data->last_eap_identity_len;
1154 	} else if (data->pseudonym &&
1155 		   !eap_sim_anonymous_username(data->pseudonym,
1156 					       data->pseudonym_len)) {
1157 		identity = data->pseudonym;
1158 		identity_len = data->pseudonym_len;
1159 	} else {
1160 		struct eap_peer_config *config;
1161 
1162 		config = eap_get_config(sm);
1163 		if (config && config->imsi_identity) {
1164 			identity = config->imsi_identity;
1165 			identity_len = config->imsi_identity_len;
1166 		} else {
1167 			identity = eap_get_config_identity(sm, &identity_len);
1168 		}
1169 	}
1170 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
1171 			  "derivation", identity, identity_len);
1172 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1173 		eap_aka_prime_derive_keys(identity, identity_len, data->ik,
1174 					  data->ck, data->k_encr, data->k_aut,
1175 					  data->k_re, data->msk, data->emsk);
1176 	} else {
1177 		eap_aka_derive_mk(identity, identity_len, data->ik, data->ck,
1178 				  data->mk);
1179 		eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
1180 				    data->msk, data->emsk);
1181 	}
1182 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1183 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1184 			   "used invalid AT_MAC");
1185 #ifdef TEST_FUZZ
1186 		wpa_printf(MSG_INFO,
1187 			   "TEST: Ignore AT_MAC mismatch for fuzz testing");
1188 #else /* TEST_FUZZ */
1189 		return eap_aka_client_error(data, id,
1190 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1191 #endif /* TEST_FUZZ */
1192 	}
1193 
1194 	/* Old reauthentication identity must not be used anymore. In
1195 	 * other words, if no new identities are received, full
1196 	 * authentication will be used on next reauthentication (using
1197 	 * pseudonym identity or permanent identity). */
1198 	eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1199 
1200 	if (attr->encr_data) {
1201 		u8 *decrypted;
1202 		decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1203 					       attr->encr_data_len, attr->iv,
1204 					       &eattr, 0);
1205 		if (decrypted == NULL) {
1206 			return eap_aka_client_error(
1207 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1208 		}
1209 		eap_aka_learn_ids(sm, data, &eattr);
1210 		os_free(decrypted);
1211 	}
1212 
1213 	if (data->result_ind && attr->result_ind)
1214 		data->use_result_ind = 1;
1215 
1216 	if (data->state != FAILURE) {
1217 		eap_aka_state(data, data->use_result_ind ?
1218 			      RESULT_SUCCESS : SUCCESS);
1219 	}
1220 
1221 	data->num_id_req = 0;
1222 	data->num_notification = 0;
1223 	/* RFC 4187 specifies that counter is initialized to one after
1224 	 * fullauth, but initializing it to zero makes it easier to implement
1225 	 * reauth verification. */
1226 	data->counter = 0;
1227 	return eap_aka_response_challenge(data, id);
1228 }
1229 
1230 
eap_aka_process_notification_reauth(struct eap_aka_data * data,struct eap_sim_attrs * attr)1231 static int eap_aka_process_notification_reauth(struct eap_aka_data *data,
1232 					       struct eap_sim_attrs *attr)
1233 {
1234 	struct eap_sim_attrs eattr;
1235 	u8 *decrypted;
1236 
1237 	if (attr->encr_data == NULL || attr->iv == NULL) {
1238 		wpa_printf(MSG_WARNING, "EAP-AKA: Notification message after "
1239 			   "reauth did not include encrypted data");
1240 		return -1;
1241 	}
1242 
1243 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1244 				       attr->encr_data_len, attr->iv, &eattr,
1245 				       0);
1246 	if (decrypted == NULL) {
1247 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1248 			   "data from notification message");
1249 		return -1;
1250 	}
1251 
1252 	if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
1253 		wpa_printf(MSG_WARNING, "EAP-AKA: Counter in notification "
1254 			   "message does not match with counter in reauth "
1255 			   "message");
1256 		os_free(decrypted);
1257 		return -1;
1258 	}
1259 
1260 	os_free(decrypted);
1261 	return 0;
1262 }
1263 
1264 
eap_aka_process_notification_auth(struct eap_aka_data * data,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1265 static int eap_aka_process_notification_auth(struct eap_aka_data *data,
1266 					     const struct wpabuf *reqData,
1267 					     struct eap_sim_attrs *attr)
1268 {
1269 	if (attr->mac == NULL) {
1270 		wpa_printf(MSG_INFO, "EAP-AKA: no AT_MAC in after_auth "
1271 			   "Notification message");
1272 		return -1;
1273 	}
1274 
1275 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1276 		wpa_printf(MSG_WARNING, "EAP-AKA: Notification message "
1277 			   "used invalid AT_MAC");
1278 		return -1;
1279 	}
1280 
1281 	if (data->reauth &&
1282 	    eap_aka_process_notification_reauth(data, attr)) {
1283 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid notification "
1284 			   "message after reauth");
1285 		return -1;
1286 	}
1287 
1288 	return 0;
1289 }
1290 
1291 
eap_aka_process_notification(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1292 static struct wpabuf * eap_aka_process_notification(
1293 	struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1294 	const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1295 {
1296 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Notification");
1297 	if (data->num_notification > 0) {
1298 		wpa_printf(MSG_INFO, "EAP-AKA: too many notification "
1299 			   "rounds (only one allowed)");
1300 		return eap_aka_client_error(data, id,
1301 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1302 	}
1303 	data->num_notification++;
1304 	if (attr->notification == -1) {
1305 		wpa_printf(MSG_INFO, "EAP-AKA: no AT_NOTIFICATION in "
1306 			   "Notification message");
1307 		return eap_aka_client_error(data, id,
1308 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1309 	}
1310 
1311 	if ((attr->notification & 0x4000) == 0 &&
1312 	    eap_aka_process_notification_auth(data, reqData, attr)) {
1313 		return eap_aka_client_error(data, id,
1314 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1315 	}
1316 
1317 	eap_sim_report_notification(sm->msg_ctx, attr->notification, 1);
1318 	if (attr->notification >= 0 && attr->notification < 32768) {
1319 		data->error_code = attr->notification;
1320 		eap_aka_state(data, FAILURE);
1321 	} else if (attr->notification == EAP_SIM_SUCCESS &&
1322 		   data->state == RESULT_SUCCESS)
1323 		eap_aka_state(data, SUCCESS);
1324 	return eap_aka_response_notification(data, id, attr->notification);
1325 }
1326 
1327 
eap_aka_process_reauthentication(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1328 static struct wpabuf * eap_aka_process_reauthentication(
1329 	struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1330 	const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1331 {
1332 	struct eap_sim_attrs eattr;
1333 	u8 *decrypted;
1334 
1335 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Reauthentication");
1336 
1337 	if (attr->checkcode &&
1338 	    eap_aka_verify_checkcode(data, attr->checkcode,
1339 				     attr->checkcode_len)) {
1340 #ifdef TEST_FUZZ
1341 		wpa_printf(MSG_INFO,
1342 			   "TEST: Ignore AT_CHECKCODE mismatch for fuzz testing");
1343 #else /* TEST_FUZZ */
1344 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1345 			   "message");
1346 #endif /* TEST_FUZZ */
1347 		return eap_aka_client_error(data, id,
1348 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1349 	}
1350 
1351 	if (data->reauth_id == NULL) {
1352 		wpa_printf(MSG_WARNING, "EAP-AKA: Server is trying "
1353 			   "reauthentication, but no reauth_id available");
1354 		return eap_aka_client_error(data, id,
1355 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1356 	}
1357 
1358 	data->reauth = 1;
1359 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1360 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1361 			   "did not have valid AT_MAC");
1362 		return eap_aka_client_error(data, id,
1363 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1364 	}
1365 
1366 	/* At this stage the received MAC has been verified. Use this MAC for
1367 	 * reauth Session-Id calculation if all other checks pass.
1368 	 * The peer does not use the local MAC but the received MAC in deriving
1369 	 * Session-Id. */
1370 	os_memcpy(data->reauth_mac, attr->mac, EAP_SIM_MAC_LEN);
1371 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: Server MAC",
1372 		    data->reauth_mac, EAP_SIM_MAC_LEN);
1373 
1374 	if (attr->encr_data == NULL || attr->iv == NULL) {
1375 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1376 			   "message did not include encrypted data");
1377 		return eap_aka_client_error(data, id,
1378 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1379 	}
1380 
1381 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1382 				       attr->encr_data_len, attr->iv, &eattr,
1383 				       0);
1384 	if (decrypted == NULL) {
1385 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1386 			   "data from reauthentication message");
1387 		return eap_aka_client_error(data, id,
1388 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1389 	}
1390 
1391 	if (eattr.nonce_s == NULL || eattr.counter < 0) {
1392 		wpa_printf(MSG_INFO, "EAP-AKA: (encr) No%s%s in reauth packet",
1393 			   !eattr.nonce_s ? " AT_NONCE_S" : "",
1394 			   eattr.counter < 0 ? " AT_COUNTER" : "");
1395 		os_free(decrypted);
1396 		return eap_aka_client_error(data, id,
1397 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1398 	}
1399 
1400 	if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
1401 		struct wpabuf *res;
1402 		wpa_printf(MSG_INFO, "EAP-AKA: (encr) Invalid counter "
1403 			   "(%d <= %d)", eattr.counter, data->counter);
1404 		data->counter_too_small = eattr.counter;
1405 
1406 		/* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
1407 		 * reauth_id must not be used to start a new reauthentication.
1408 		 * However, since it was used in the last EAP-Response-Identity
1409 		 * packet, it has to saved for the following fullauth to be
1410 		 * used in MK derivation. */
1411 		os_free(data->last_eap_identity);
1412 		data->last_eap_identity = data->reauth_id;
1413 		data->last_eap_identity_len = data->reauth_id_len;
1414 		data->reauth_id = NULL;
1415 		data->reauth_id_len = 0;
1416 
1417 		res = eap_aka_response_reauth(data, id, 1, eattr.nonce_s);
1418 		os_free(decrypted);
1419 
1420 		return res;
1421 	}
1422 	data->counter = eattr.counter;
1423 
1424 	os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
1425 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: (encr) AT_NONCE_S",
1426 		    data->nonce_s, EAP_SIM_NONCE_S_LEN);
1427 
1428 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1429 		eap_aka_prime_derive_keys_reauth(data->k_re, data->counter,
1430 						 data->reauth_id,
1431 						 data->reauth_id_len,
1432 						 data->nonce_s,
1433 						 data->msk, data->emsk);
1434 	} else {
1435 		eap_sim_derive_keys_reauth(data->counter, data->reauth_id,
1436 					   data->reauth_id_len,
1437 					   data->nonce_s, data->mk,
1438 					   data->msk, data->emsk);
1439 	}
1440 	eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1441 	eap_aka_learn_ids(sm, data, &eattr);
1442 
1443 	if (data->result_ind && attr->result_ind)
1444 		data->use_result_ind = 1;
1445 
1446 	if (data->state != FAILURE) {
1447 		eap_aka_state(data, data->use_result_ind ?
1448 			      RESULT_SUCCESS : SUCCESS);
1449 	}
1450 
1451 	data->num_id_req = 0;
1452 	data->num_notification = 0;
1453 	if (data->counter > EAP_AKA_MAX_FAST_REAUTHS) {
1454 		wpa_printf(MSG_DEBUG, "EAP-AKA: Maximum number of "
1455 			   "fast reauths performed - force fullauth");
1456 		eap_aka_clear_identities(sm, data,
1457 					 CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1458 	}
1459 	os_free(decrypted);
1460 	return eap_aka_response_reauth(data, id, 0, data->nonce_s);
1461 }
1462 
1463 
eap_aka_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)1464 static struct wpabuf * eap_aka_process(struct eap_sm *sm, void *priv,
1465 				       struct eap_method_ret *ret,
1466 				       const struct wpabuf *reqData)
1467 {
1468 	struct eap_aka_data *data = priv;
1469 	const struct eap_hdr *req;
1470 	u8 subtype, id;
1471 	struct wpabuf *res;
1472 	const u8 *pos;
1473 	struct eap_sim_attrs attr;
1474 	size_t len;
1475 
1476 	wpa_hexdump_buf(MSG_DEBUG, "EAP-AKA: EAP data", reqData);
1477 	if (eap_get_config_identity(sm, &len) == NULL) {
1478 		wpa_printf(MSG_INFO, "EAP-AKA: Identity not configured");
1479 		eap_sm_request_identity(sm);
1480 		ret->ignore = true;
1481 		return NULL;
1482 	}
1483 
1484 	pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, reqData,
1485 			       &len);
1486 	if (pos == NULL || len < 3) {
1487 		ret->ignore = true;
1488 		return NULL;
1489 	}
1490 	req = wpabuf_head(reqData);
1491 	id = req->identifier;
1492 	len = be_to_host16(req->length);
1493 
1494 	ret->ignore = false;
1495 	ret->methodState = METHOD_MAY_CONT;
1496 	ret->decision = DECISION_FAIL;
1497 	ret->allowNotifications = true;
1498 
1499 	subtype = *pos++;
1500 	wpa_printf(MSG_DEBUG, "EAP-AKA: Subtype=%d", subtype);
1501 	pos += 2; /* Reserved */
1502 
1503 	if (eap_sim_parse_attr(pos, wpabuf_head_u8(reqData) + len, &attr,
1504 			       data->eap_method == EAP_TYPE_AKA_PRIME ? 2 : 1,
1505 			       0)) {
1506 		res = eap_aka_client_error(data, id,
1507 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1508 		goto done;
1509 	}
1510 
1511 	switch (subtype) {
1512 	case EAP_AKA_SUBTYPE_IDENTITY:
1513 		res = eap_aka_process_identity(sm, data, id, reqData, &attr);
1514 		break;
1515 	case EAP_AKA_SUBTYPE_CHALLENGE:
1516 		res = eap_aka_process_challenge(sm, data, id, reqData, &attr);
1517 		break;
1518 	case EAP_AKA_SUBTYPE_NOTIFICATION:
1519 		res = eap_aka_process_notification(sm, data, id, reqData,
1520 						   &attr);
1521 		break;
1522 	case EAP_AKA_SUBTYPE_REAUTHENTICATION:
1523 		res = eap_aka_process_reauthentication(sm, data, id, reqData,
1524 						       &attr);
1525 		break;
1526 	case EAP_AKA_SUBTYPE_CLIENT_ERROR:
1527 		wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Client-Error");
1528 		res = eap_aka_client_error(data, id,
1529 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1530 		break;
1531 	default:
1532 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown subtype=%d", subtype);
1533 		res = eap_aka_client_error(data, id,
1534 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1535 		break;
1536 	}
1537 
1538 done:
1539 	if (data->state == FAILURE) {
1540 		ret->decision = DECISION_FAIL;
1541 		ret->methodState = METHOD_DONE;
1542 	} else if (data->state == SUCCESS) {
1543 		ret->decision = data->use_result_ind ?
1544 			DECISION_UNCOND_SUCC : DECISION_COND_SUCC;
1545 		/*
1546 		 * It is possible for the server to reply with AKA
1547 		 * Notification, so we must allow the method to continue and
1548 		 * not only accept EAP-Success at this point.
1549 		 */
1550 		ret->methodState = data->use_result_ind ?
1551 			METHOD_DONE : METHOD_MAY_CONT;
1552 	} else if (data->state == RESULT_SUCCESS)
1553 		ret->methodState = METHOD_CONT;
1554 
1555 	if (ret->methodState == METHOD_DONE) {
1556 		ret->allowNotifications = false;
1557 	}
1558 
1559 	return res;
1560 }
1561 
1562 
eap_aka_has_reauth_data(struct eap_sm * sm,void * priv)1563 static bool eap_aka_has_reauth_data(struct eap_sm *sm, void *priv)
1564 {
1565 	struct eap_aka_data *data = priv;
1566 	return data->pseudonym || data->reauth_id;
1567 }
1568 
1569 
eap_aka_deinit_for_reauth(struct eap_sm * sm,void * priv)1570 static void eap_aka_deinit_for_reauth(struct eap_sm *sm, void *priv)
1571 {
1572 	struct eap_aka_data *data = priv;
1573 	eap_aka_clear_identities(sm, data, CLEAR_EAP_ID);
1574 	data->prev_id = -1;
1575 	wpabuf_free(data->id_msgs);
1576 	data->id_msgs = NULL;
1577 	data->use_result_ind = 0;
1578 	data->kdf_negotiation = 0;
1579 	eap_aka_clear_keys(data, 1);
1580 }
1581 
1582 
eap_aka_init_for_reauth(struct eap_sm * sm,void * priv)1583 static void * eap_aka_init_for_reauth(struct eap_sm *sm, void *priv)
1584 {
1585 	struct eap_aka_data *data = priv;
1586 	data->num_id_req = 0;
1587 	data->num_notification = 0;
1588 	eap_aka_state(data, CONTINUE);
1589 	return priv;
1590 }
1591 
1592 
eap_aka_get_identity(struct eap_sm * sm,void * priv,size_t * len)1593 static const u8 * eap_aka_get_identity(struct eap_sm *sm, void *priv,
1594 				       size_t *len)
1595 {
1596 	struct eap_aka_data *data = priv;
1597 
1598 	if (data->reauth_id) {
1599 		*len = data->reauth_id_len;
1600 		return data->reauth_id;
1601 	}
1602 
1603 	if (data->pseudonym) {
1604 		*len = data->pseudonym_len;
1605 		return data->pseudonym;
1606 	}
1607 
1608 	return NULL;
1609 }
1610 
1611 
eap_aka_isKeyAvailable(struct eap_sm * sm,void * priv)1612 static bool eap_aka_isKeyAvailable(struct eap_sm *sm, void *priv)
1613 {
1614 	struct eap_aka_data *data = priv;
1615 	return data->state == SUCCESS;
1616 }
1617 
1618 
eap_aka_getKey(struct eap_sm * sm,void * priv,size_t * len)1619 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1620 {
1621 	struct eap_aka_data *data = priv;
1622 	u8 *key;
1623 
1624 	if (data->state != SUCCESS)
1625 		return NULL;
1626 
1627 	key = os_memdup(data->msk, EAP_SIM_KEYING_DATA_LEN);
1628 	if (key == NULL)
1629 		return NULL;
1630 
1631 	*len = EAP_SIM_KEYING_DATA_LEN;
1632 
1633 	return key;
1634 }
1635 
1636 
eap_aka_get_session_id(struct eap_sm * sm,void * priv,size_t * len)1637 static u8 * eap_aka_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1638 {
1639 	struct eap_aka_data *data = priv;
1640 	u8 *id;
1641 
1642 	if (data->state != SUCCESS)
1643 		return NULL;
1644 
1645 	if (!data->reauth)
1646 		*len = 1 + EAP_AKA_RAND_LEN + EAP_AKA_AUTN_LEN;
1647 	else
1648 		*len = 1 + EAP_SIM_NONCE_S_LEN + EAP_SIM_MAC_LEN;
1649 	id = os_malloc(*len);
1650 	if (id == NULL)
1651 		return NULL;
1652 
1653 	id[0] = data->eap_method;
1654 	if (!data->reauth) {
1655 		os_memcpy(id + 1, data->rand, EAP_AKA_RAND_LEN);
1656 		os_memcpy(id + 1 + EAP_AKA_RAND_LEN, data->autn,
1657 			  EAP_AKA_AUTN_LEN);
1658 	} else {
1659 		os_memcpy(id + 1, data->nonce_s, EAP_SIM_NONCE_S_LEN);
1660 		os_memcpy(id + 1 + EAP_SIM_NONCE_S_LEN, data->reauth_mac,
1661 			  EAP_SIM_MAC_LEN);
1662 	}
1663 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: Derived Session-Id", id, *len);
1664 
1665 	return id;
1666 }
1667 
1668 
eap_aka_get_emsk(struct eap_sm * sm,void * priv,size_t * len)1669 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1670 {
1671 	struct eap_aka_data *data = priv;
1672 	u8 *key;
1673 
1674 	if (data->state != SUCCESS)
1675 		return NULL;
1676 
1677 	key = os_memdup(data->emsk, EAP_EMSK_LEN);
1678 	if (key == NULL)
1679 		return NULL;
1680 
1681 	*len = EAP_EMSK_LEN;
1682 
1683 	return key;
1684 }
1685 
1686 
eap_aka_get_error_code(void * priv)1687 static int eap_aka_get_error_code(void *priv)
1688 {
1689 	struct eap_aka_data *data = priv;
1690 	int current_data_error;
1691 
1692 	if (!data)
1693 		return NO_EAP_METHOD_ERROR;
1694 
1695 	current_data_error = data->error_code;
1696 
1697 	/* Now reset for next transaction */
1698 	data->error_code = NO_EAP_METHOD_ERROR;
1699 
1700 	return current_data_error;
1701 }
1702 
1703 
eap_peer_aka_register(void)1704 int eap_peer_aka_register(void)
1705 {
1706 	struct eap_method *eap;
1707 
1708 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1709 				    EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1710 	if (eap == NULL)
1711 		return -1;
1712 
1713 	eap->init = eap_aka_init;
1714 	eap->deinit = eap_aka_deinit;
1715 	eap->process = eap_aka_process;
1716 	eap->isKeyAvailable = eap_aka_isKeyAvailable;
1717 	eap->getKey = eap_aka_getKey;
1718 	eap->getSessionId = eap_aka_get_session_id;
1719 	eap->has_reauth_data = eap_aka_has_reauth_data;
1720 	eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1721 	eap->init_for_reauth = eap_aka_init_for_reauth;
1722 	eap->get_identity = eap_aka_get_identity;
1723 	eap->get_emsk = eap_aka_get_emsk;
1724 	eap->get_error_code = eap_aka_get_error_code;
1725 
1726 	return eap_peer_method_register(eap);
1727 }
1728 
1729 
1730 #ifdef EAP_AKA_PRIME
eap_peer_aka_prime_register(void)1731 int eap_peer_aka_prime_register(void)
1732 {
1733 	struct eap_method *eap;
1734 
1735 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1736 				    EAP_VENDOR_IETF, EAP_TYPE_AKA_PRIME,
1737 				    "AKA'");
1738 	if (eap == NULL)
1739 		return -1;
1740 
1741 	eap->init = eap_aka_prime_init;
1742 	eap->deinit = eap_aka_deinit;
1743 	eap->process = eap_aka_process;
1744 	eap->isKeyAvailable = eap_aka_isKeyAvailable;
1745 	eap->getKey = eap_aka_getKey;
1746 	eap->getSessionId = eap_aka_get_session_id;
1747 	eap->has_reauth_data = eap_aka_has_reauth_data;
1748 	eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1749 	eap->init_for_reauth = eap_aka_init_for_reauth;
1750 	eap->get_identity = eap_aka_get_identity;
1751 	eap->get_emsk = eap_aka_get_emsk;
1752 	eap->get_error_code = eap_aka_get_error_code;
1753 
1754 	return eap_peer_method_register(eap);
1755 }
1756 #endif /* EAP_AKA_PRIME */
1757