1 /*
2 * EAP peer method: EAP-AKA (RFC 4187)
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "eap_i.h"
19 #include "crypto.h"
20 #include "pcsc_funcs.h"
21 #include "eap_sim_common.h"
22
23
24 struct eap_aka_data {
25 u8 ik[EAP_AKA_IK_LEN], ck[EAP_AKA_CK_LEN], res[EAP_AKA_RES_MAX_LEN];
26 size_t res_len;
27 u8 nonce_s[EAP_SIM_NONCE_S_LEN];
28 u8 mk[EAP_SIM_MK_LEN];
29 u8 k_aut[EAP_SIM_K_AUT_LEN];
30 u8 k_encr[EAP_SIM_K_ENCR_LEN];
31 u8 msk[EAP_SIM_KEYING_DATA_LEN];
32 u8 emsk[EAP_EMSK_LEN];
33 u8 rand[EAP_AKA_RAND_LEN], autn[EAP_AKA_AUTN_LEN];
34 u8 auts[EAP_AKA_AUTS_LEN];
35
36 int num_id_req, num_notification;
37 u8 *pseudonym;
38 size_t pseudonym_len;
39 u8 *reauth_id;
40 size_t reauth_id_len;
41 int reauth;
42 unsigned int counter, counter_too_small;
43 u8 *last_eap_identity;
44 size_t last_eap_identity_len;
45 enum { CONTINUE, SUCCESS, FAILURE } state;
46 };
47
48
eap_aka_init(struct eap_sm * sm)49 static void * eap_aka_init(struct eap_sm *sm)
50 {
51 struct eap_aka_data *data;
52 data = os_zalloc(sizeof(*data));
53 if (data == NULL)
54 return NULL;
55
56 data->state = CONTINUE;
57
58 return data;
59 }
60
61
eap_aka_deinit(struct eap_sm * sm,void * priv)62 static void eap_aka_deinit(struct eap_sm *sm, void *priv)
63 {
64 struct eap_aka_data *data = priv;
65 if (data) {
66 os_free(data->pseudonym);
67 os_free(data->reauth_id);
68 os_free(data->last_eap_identity);
69 os_free(data);
70 }
71 }
72
73
eap_aka_umts_auth(struct eap_sm * sm,struct eap_aka_data * data)74 static int eap_aka_umts_auth(struct eap_sm *sm, struct eap_aka_data *data)
75 {
76 wpa_printf(MSG_DEBUG, "EAP-AKA: UMTS authentication algorithm");
77 #ifdef PCSC_FUNCS
78 return scard_umts_auth(sm->scard_ctx, data->rand,
79 data->autn, data->res, &data->res_len,
80 data->ik, data->ck, data->auts);
81 #else /* PCSC_FUNCS */
82 /* These hardcoded Kc and SRES values are used for testing.
83 * Could consider making them configurable. */
84 os_memset(data->res, '2', EAP_AKA_RES_MAX_LEN);
85 data->res_len = EAP_AKA_RES_MAX_LEN;
86 os_memset(data->ik, '3', EAP_AKA_IK_LEN);
87 os_memset(data->ck, '4', EAP_AKA_CK_LEN);
88 {
89 u8 autn[EAP_AKA_AUTN_LEN];
90 os_memset(autn, '1', EAP_AKA_AUTN_LEN);
91 if (os_memcmp(autn, data->autn, EAP_AKA_AUTN_LEN) != 0) {
92 wpa_printf(MSG_WARNING, "EAP-AKA: AUTN did not match "
93 "with expected value");
94 return -1;
95 }
96 }
97 #if 0
98 {
99 static int test_resync = 1;
100 if (test_resync) {
101 /* Test Resynchronization */
102 test_resync = 0;
103 return -2;
104 }
105 }
106 #endif
107 return 0;
108 #endif /* PCSC_FUNCS */
109 }
110
111
112 #define CLEAR_PSEUDONYM 0x01
113 #define CLEAR_REAUTH_ID 0x02
114 #define CLEAR_EAP_ID 0x04
115
eap_aka_clear_identities(struct eap_aka_data * data,int id)116 static void eap_aka_clear_identities(struct eap_aka_data *data, int id)
117 {
118 wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old%s%s%s",
119 id & CLEAR_PSEUDONYM ? " pseudonym" : "",
120 id & CLEAR_REAUTH_ID ? " reauth_id" : "",
121 id & CLEAR_EAP_ID ? " eap_id" : "");
122 if (id & CLEAR_PSEUDONYM) {
123 os_free(data->pseudonym);
124 data->pseudonym = NULL;
125 data->pseudonym_len = 0;
126 }
127 if (id & CLEAR_REAUTH_ID) {
128 os_free(data->reauth_id);
129 data->reauth_id = NULL;
130 data->reauth_id_len = 0;
131 }
132 if (id & CLEAR_EAP_ID) {
133 os_free(data->last_eap_identity);
134 data->last_eap_identity = NULL;
135 data->last_eap_identity_len = 0;
136 }
137 }
138
139
eap_aka_learn_ids(struct eap_aka_data * data,struct eap_sim_attrs * attr)140 static int eap_aka_learn_ids(struct eap_aka_data *data,
141 struct eap_sim_attrs *attr)
142 {
143 if (attr->next_pseudonym) {
144 os_free(data->pseudonym);
145 data->pseudonym = os_malloc(attr->next_pseudonym_len);
146 if (data->pseudonym == NULL) {
147 wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
148 "next pseudonym");
149 return -1;
150 }
151 os_memcpy(data->pseudonym, attr->next_pseudonym,
152 attr->next_pseudonym_len);
153 data->pseudonym_len = attr->next_pseudonym_len;
154 wpa_hexdump_ascii(MSG_DEBUG,
155 "EAP-AKA: (encr) AT_NEXT_PSEUDONYM",
156 data->pseudonym,
157 data->pseudonym_len);
158 }
159
160 if (attr->next_reauth_id) {
161 os_free(data->reauth_id);
162 data->reauth_id = os_malloc(attr->next_reauth_id_len);
163 if (data->reauth_id == NULL) {
164 wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
165 "next reauth_id");
166 return -1;
167 }
168 os_memcpy(data->reauth_id, attr->next_reauth_id,
169 attr->next_reauth_id_len);
170 data->reauth_id_len = attr->next_reauth_id_len;
171 wpa_hexdump_ascii(MSG_DEBUG,
172 "EAP-AKA: (encr) AT_NEXT_REAUTH_ID",
173 data->reauth_id,
174 data->reauth_id_len);
175 }
176
177 return 0;
178 }
179
180
eap_aka_client_error(struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen,int err)181 static u8 * eap_aka_client_error(struct eap_aka_data *data,
182 const struct eap_hdr *req,
183 size_t *respDataLen, int err)
184 {
185 struct eap_sim_msg *msg;
186
187 data->state = FAILURE;
188 data->num_id_req = 0;
189 data->num_notification = 0;
190
191 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
192 EAP_TYPE_AKA, EAP_AKA_SUBTYPE_CLIENT_ERROR);
193 eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
194 return eap_sim_msg_finish(msg, respDataLen, NULL, NULL, 0);
195 }
196
197
eap_aka_authentication_reject(struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen)198 static u8 * eap_aka_authentication_reject(struct eap_aka_data *data,
199 const struct eap_hdr *req,
200 size_t *respDataLen)
201 {
202 struct eap_sim_msg *msg;
203
204 data->state = FAILURE;
205 data->num_id_req = 0;
206 data->num_notification = 0;
207
208 wpa_printf(MSG_DEBUG, "Generating EAP-AKA Authentication-Reject "
209 "(id=%d)", req->identifier);
210 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
211 EAP_TYPE_AKA,
212 EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT);
213 return eap_sim_msg_finish(msg, respDataLen, NULL, NULL, 0);
214 }
215
216
eap_aka_synchronization_failure(struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen)217 static u8 * eap_aka_synchronization_failure(struct eap_aka_data *data,
218 const struct eap_hdr *req,
219 size_t *respDataLen)
220 {
221 struct eap_sim_msg *msg;
222
223 data->num_id_req = 0;
224 data->num_notification = 0;
225
226 wpa_printf(MSG_DEBUG, "Generating EAP-AKA Synchronization-Failure "
227 "(id=%d)", req->identifier);
228 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
229 EAP_TYPE_AKA,
230 EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE);
231 wpa_printf(MSG_DEBUG, " AT_AUTS");
232 eap_sim_msg_add_full(msg, EAP_SIM_AT_AUTS, data->auts,
233 EAP_AKA_AUTS_LEN);
234 return eap_sim_msg_finish(msg, respDataLen, NULL, NULL, 0);
235 }
236
237
eap_aka_response_identity(struct eap_sm * sm,struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen,enum eap_sim_id_req id_req)238 static u8 * eap_aka_response_identity(struct eap_sm *sm,
239 struct eap_aka_data *data,
240 const struct eap_hdr *req,
241 size_t *respDataLen,
242 enum eap_sim_id_req id_req)
243 {
244 const u8 *identity = NULL;
245 size_t identity_len = 0;
246 struct eap_sim_msg *msg;
247
248 data->reauth = 0;
249 if (id_req == ANY_ID && data->reauth_id) {
250 identity = data->reauth_id;
251 identity_len = data->reauth_id_len;
252 data->reauth = 1;
253 } else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
254 data->pseudonym) {
255 identity = data->pseudonym;
256 identity_len = data->pseudonym_len;
257 eap_aka_clear_identities(data, CLEAR_REAUTH_ID);
258 } else if (id_req != NO_ID_REQ) {
259 identity = eap_get_config_identity(sm, &identity_len);
260 if (identity) {
261 eap_aka_clear_identities(data, CLEAR_PSEUDONYM |
262 CLEAR_REAUTH_ID);
263 }
264 }
265 if (id_req != NO_ID_REQ)
266 eap_aka_clear_identities(data, CLEAR_EAP_ID);
267
268 wpa_printf(MSG_DEBUG, "Generating EAP-AKA Identity (id=%d)",
269 req->identifier);
270 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
271 EAP_TYPE_AKA, EAP_AKA_SUBTYPE_IDENTITY);
272
273 if (identity) {
274 wpa_hexdump_ascii(MSG_DEBUG, " AT_IDENTITY",
275 identity, identity_len);
276 eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
277 identity, identity_len);
278 }
279
280 return eap_sim_msg_finish(msg, respDataLen, NULL, NULL, 0);
281 }
282
283
eap_aka_response_challenge(struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen)284 static u8 * eap_aka_response_challenge(struct eap_aka_data *data,
285 const struct eap_hdr *req,
286 size_t *respDataLen)
287 {
288 struct eap_sim_msg *msg;
289
290 wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d)",
291 req->identifier);
292 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
293 EAP_TYPE_AKA, EAP_AKA_SUBTYPE_CHALLENGE);
294 wpa_printf(MSG_DEBUG, " AT_RES");
295 eap_sim_msg_add(msg, EAP_SIM_AT_RES, data->res_len * 8,
296 data->res, data->res_len);
297 wpa_printf(MSG_DEBUG, " AT_MAC");
298 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
299 return eap_sim_msg_finish(msg, respDataLen, data->k_aut, (u8 *) "", 0);
300 }
301
302
eap_aka_response_reauth(struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen,int counter_too_small,const u8 * nonce_s)303 static u8 * eap_aka_response_reauth(struct eap_aka_data *data,
304 const struct eap_hdr *req,
305 size_t *respDataLen, int counter_too_small,
306 const u8 *nonce_s)
307 {
308 struct eap_sim_msg *msg;
309 unsigned int counter;
310
311 wpa_printf(MSG_DEBUG, "Generating EAP-AKA Reauthentication (id=%d)",
312 req->identifier);
313 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
314 EAP_TYPE_AKA,
315 EAP_AKA_SUBTYPE_REAUTHENTICATION);
316 wpa_printf(MSG_DEBUG, " AT_IV");
317 wpa_printf(MSG_DEBUG, " AT_ENCR_DATA");
318 eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
319
320 if (counter_too_small) {
321 wpa_printf(MSG_DEBUG, " *AT_COUNTER_TOO_SMALL");
322 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
323 counter = data->counter_too_small;
324 } else
325 counter = data->counter;
326
327 wpa_printf(MSG_DEBUG, " *AT_COUNTER %d", counter);
328 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
329
330 if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
331 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
332 "AT_ENCR_DATA");
333 eap_sim_msg_free(msg);
334 return NULL;
335 }
336 wpa_printf(MSG_DEBUG, " AT_MAC");
337 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
338 return eap_sim_msg_finish(msg, respDataLen, data->k_aut, nonce_s,
339 EAP_SIM_NONCE_S_LEN);
340 }
341
342
eap_aka_response_notification(struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen,u16 notification)343 static u8 * eap_aka_response_notification(struct eap_aka_data *data,
344 const struct eap_hdr *req,
345 size_t *respDataLen,
346 u16 notification)
347 {
348 struct eap_sim_msg *msg;
349 u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
350
351 wpa_printf(MSG_DEBUG, "Generating EAP-AKA Notification (id=%d)",
352 req->identifier);
353 msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
354 EAP_TYPE_AKA, EAP_AKA_SUBTYPE_NOTIFICATION);
355 if (k_aut && data->reauth) {
356 wpa_printf(MSG_DEBUG, " AT_IV");
357 wpa_printf(MSG_DEBUG, " AT_ENCR_DATA");
358 eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
359 EAP_SIM_AT_ENCR_DATA);
360 wpa_printf(MSG_DEBUG, " *AT_COUNTER %d", data->counter);
361 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
362 NULL, 0);
363 if (eap_sim_msg_add_encr_end(msg, data->k_encr,
364 EAP_SIM_AT_PADDING)) {
365 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
366 "AT_ENCR_DATA");
367 eap_sim_msg_free(msg);
368 return NULL;
369 }
370 }
371 if (k_aut) {
372 wpa_printf(MSG_DEBUG, " AT_MAC");
373 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
374 }
375 return eap_sim_msg_finish(msg, respDataLen, k_aut, (u8 *) "", 0);
376 }
377
378
eap_aka_process_identity(struct eap_sm * sm,struct eap_aka_data * data,const struct eap_hdr * req,size_t * respDataLen,struct eap_sim_attrs * attr)379 static u8 * eap_aka_process_identity(struct eap_sm *sm,
380 struct eap_aka_data *data,
381 const struct eap_hdr *req,
382 size_t *respDataLen,
383 struct eap_sim_attrs *attr)
384 {
385 int id_error;
386
387 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Identity");
388
389 id_error = 0;
390 switch (attr->id_req) {
391 case NO_ID_REQ:
392 break;
393 case ANY_ID:
394 if (data->num_id_req > 0)
395 id_error++;
396 data->num_id_req++;
397 break;
398 case FULLAUTH_ID:
399 if (data->num_id_req > 1)
400 id_error++;
401 data->num_id_req++;
402 break;
403 case PERMANENT_ID:
404 if (data->num_id_req > 2)
405 id_error++;
406 data->num_id_req++;
407 break;
408 }
409 if (id_error) {
410 wpa_printf(MSG_INFO, "EAP-AKA: Too many ID requests "
411 "used within one authentication");
412 return eap_aka_client_error(data, req, respDataLen,
413 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
414 }
415
416 return eap_aka_response_identity(sm, data, req, respDataLen,
417 attr->id_req);
418 }
419
420
eap_aka_process_challenge(struct eap_sm * sm,struct eap_aka_data * data,const struct eap_hdr * req,size_t reqDataLen,size_t * respDataLen,struct eap_sim_attrs * attr)421 static u8 * eap_aka_process_challenge(struct eap_sm *sm,
422 struct eap_aka_data *data,
423 const struct eap_hdr *req,
424 size_t reqDataLen,
425 size_t *respDataLen,
426 struct eap_sim_attrs *attr)
427 {
428 const u8 *identity;
429 size_t identity_len;
430 int res;
431 struct eap_sim_attrs eattr;
432
433 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Challenge");
434 data->reauth = 0;
435 if (!attr->mac || !attr->rand || !attr->autn) {
436 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
437 "did not include%s%s%s",
438 !attr->mac ? " AT_MAC" : "",
439 !attr->rand ? " AT_RAND" : "",
440 !attr->autn ? " AT_AUTN" : "");
441 return eap_aka_client_error(data, req, respDataLen,
442 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
443 }
444 os_memcpy(data->rand, attr->rand, EAP_AKA_RAND_LEN);
445 os_memcpy(data->autn, attr->autn, EAP_AKA_AUTN_LEN);
446
447 res = eap_aka_umts_auth(sm, data);
448 if (res == -1) {
449 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
450 "failed (AUTN)");
451 return eap_aka_authentication_reject(data, req, respDataLen);
452 } else if (res == -2) {
453 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
454 "failed (AUTN seq# -> AUTS)");
455 return eap_aka_synchronization_failure(data, req, respDataLen);
456 } else if (res) {
457 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication failed");
458 return eap_aka_client_error(data, req, respDataLen,
459 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
460 }
461 if (data->last_eap_identity) {
462 identity = data->last_eap_identity;
463 identity_len = data->last_eap_identity_len;
464 } else if (data->pseudonym) {
465 identity = data->pseudonym;
466 identity_len = data->pseudonym_len;
467 } else
468 identity = eap_get_config_identity(sm, &identity_len);
469 wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
470 "derivation", identity, identity_len);
471 eap_aka_derive_mk(identity, identity_len, data->ik, data->ck,
472 data->mk);
473 eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
474 data->emsk);
475 if (eap_sim_verify_mac(data->k_aut, (const u8 *) req, reqDataLen,
476 attr->mac, (u8 *) "", 0)) {
477 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
478 "used invalid AT_MAC");
479 return eap_aka_client_error(data, req, respDataLen,
480 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
481 }
482
483 /* Old reauthentication and pseudonym identities must not be used
484 * anymore. In other words, if no new identities are received, full
485 * authentication will be used on next reauthentication. */
486 eap_aka_clear_identities(data, CLEAR_PSEUDONYM | CLEAR_REAUTH_ID |
487 CLEAR_EAP_ID);
488
489 if (attr->encr_data) {
490 u8 *decrypted;
491 decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
492 attr->encr_data_len, attr->iv,
493 &eattr, 0);
494 if (decrypted == NULL) {
495 return eap_aka_client_error(
496 data, req, respDataLen,
497 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
498 }
499 eap_aka_learn_ids(data, &eattr);
500 os_free(decrypted);
501 }
502
503 if (data->state != FAILURE)
504 data->state = SUCCESS;
505
506 data->num_id_req = 0;
507 data->num_notification = 0;
508 /* RFC 4187 specifies that counter is initialized to one after
509 * fullauth, but initializing it to zero makes it easier to implement
510 * reauth verification. */
511 data->counter = 0;
512 return eap_aka_response_challenge(data, req, respDataLen);
513 }
514
515
eap_aka_process_notification_reauth(struct eap_aka_data * data,struct eap_sim_attrs * attr)516 static int eap_aka_process_notification_reauth(struct eap_aka_data *data,
517 struct eap_sim_attrs *attr)
518 {
519 struct eap_sim_attrs eattr;
520 u8 *decrypted;
521
522 if (attr->encr_data == NULL || attr->iv == NULL) {
523 wpa_printf(MSG_WARNING, "EAP-AKA: Notification message after "
524 "reauth did not include encrypted data");
525 return -1;
526 }
527
528 decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
529 attr->encr_data_len, attr->iv, &eattr,
530 0);
531 if (decrypted == NULL) {
532 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
533 "data from notification message");
534 return -1;
535 }
536
537 if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
538 wpa_printf(MSG_WARNING, "EAP-AKA: Counter in notification "
539 "message does not match with counter in reauth "
540 "message");
541 os_free(decrypted);
542 return -1;
543 }
544
545 os_free(decrypted);
546 return 0;
547 }
548
549
eap_aka_process_notification_auth(struct eap_aka_data * data,const struct eap_hdr * req,size_t reqDataLen,struct eap_sim_attrs * attr)550 static int eap_aka_process_notification_auth(struct eap_aka_data *data,
551 const struct eap_hdr *req,
552 size_t reqDataLen,
553 struct eap_sim_attrs *attr)
554 {
555 if (attr->mac == NULL) {
556 wpa_printf(MSG_INFO, "EAP-AKA: no AT_MAC in after_auth "
557 "Notification message");
558 return -1;
559 }
560
561 if (eap_sim_verify_mac(data->k_aut, (const u8 *) req, reqDataLen,
562 attr->mac, (u8 *) "", 0)) {
563 wpa_printf(MSG_WARNING, "EAP-AKA: Notification message "
564 "used invalid AT_MAC");
565 return -1;
566 }
567
568 if (data->reauth &&
569 eap_aka_process_notification_reauth(data, attr)) {
570 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid notification "
571 "message after reauth");
572 return -1;
573 }
574
575 return 0;
576 }
577
578
eap_aka_process_notification(struct eap_sm * sm,struct eap_aka_data * data,const struct eap_hdr * req,size_t reqDataLen,size_t * respDataLen,struct eap_sim_attrs * attr)579 static u8 * eap_aka_process_notification(struct eap_sm *sm,
580 struct eap_aka_data *data,
581 const struct eap_hdr *req,
582 size_t reqDataLen,
583 size_t *respDataLen,
584 struct eap_sim_attrs *attr)
585 {
586 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Notification");
587 if (data->num_notification > 0) {
588 wpa_printf(MSG_INFO, "EAP-AKA: too many notification "
589 "rounds (only one allowed)");
590 return eap_aka_client_error(data, req, respDataLen,
591 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
592 }
593 data->num_notification++;
594 if (attr->notification == -1) {
595 wpa_printf(MSG_INFO, "EAP-AKA: no AT_NOTIFICATION in "
596 "Notification message");
597 return eap_aka_client_error(data, req, respDataLen,
598 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
599 }
600
601 if ((attr->notification & 0x4000) == 0 &&
602 eap_aka_process_notification_auth(data, req, reqDataLen, attr)) {
603 return eap_aka_client_error(data, req, respDataLen,
604 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
605 }
606
607 eap_sim_report_notification(sm->msg_ctx, attr->notification, 1);
608 if (attr->notification >= 0 && attr->notification < 32768) {
609 data->state = FAILURE;
610 }
611 return eap_aka_response_notification(data, req, respDataLen,
612 attr->notification);
613 }
614
615
eap_aka_process_reauthentication(struct eap_sm * sm,struct eap_aka_data * data,const struct eap_hdr * req,size_t reqDataLen,size_t * respDataLen,struct eap_sim_attrs * attr)616 static u8 * eap_aka_process_reauthentication(struct eap_sm *sm,
617 struct eap_aka_data *data,
618 const struct eap_hdr *req,
619 size_t reqDataLen,
620 size_t *respDataLen,
621 struct eap_sim_attrs *attr)
622 {
623 struct eap_sim_attrs eattr;
624 u8 *decrypted;
625
626 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Reauthentication");
627
628 if (data->reauth_id == NULL) {
629 wpa_printf(MSG_WARNING, "EAP-AKA: Server is trying "
630 "reauthentication, but no reauth_id available");
631 return eap_aka_client_error(data, req, respDataLen,
632 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
633 }
634
635 data->reauth = 1;
636 if (eap_sim_verify_mac(data->k_aut, (const u8 *) req, reqDataLen,
637 attr->mac, (u8 *) "", 0)) {
638 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
639 "did not have valid AT_MAC");
640 return eap_aka_client_error(data, req, respDataLen,
641 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
642 }
643
644 if (attr->encr_data == NULL || attr->iv == NULL) {
645 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
646 "message did not include encrypted data");
647 return eap_aka_client_error(data, req, respDataLen,
648 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
649 }
650
651 decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
652 attr->encr_data_len, attr->iv, &eattr,
653 0);
654 if (decrypted == NULL) {
655 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
656 "data from reauthentication message");
657 return eap_aka_client_error(data, req, respDataLen,
658 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
659 }
660
661 if (eattr.nonce_s == NULL || eattr.counter < 0) {
662 wpa_printf(MSG_INFO, "EAP-AKA: (encr) No%s%s in reauth packet",
663 !eattr.nonce_s ? " AT_NONCE_S" : "",
664 eattr.counter < 0 ? " AT_COUNTER" : "");
665 os_free(decrypted);
666 return eap_aka_client_error(data, req, respDataLen,
667 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
668 }
669
670 if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
671 u8 *res;
672 wpa_printf(MSG_INFO, "EAP-AKA: (encr) Invalid counter "
673 "(%d <= %d)", eattr.counter, data->counter);
674 data->counter_too_small = eattr.counter;
675
676 eap_sim_derive_keys_reauth(eattr.counter, data->reauth_id,
677 data->reauth_id_len, eattr.nonce_s,
678 data->mk, NULL, NULL);
679
680 /* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
681 * reauth_id must not be used to start a new reauthentication.
682 * However, since it was used in the last EAP-Response-Identity
683 * packet, it has to saved for the following fullauth to be
684 * used in MK derivation. */
685 os_free(data->last_eap_identity);
686 data->last_eap_identity = data->reauth_id;
687 data->last_eap_identity_len = data->reauth_id_len;
688 data->reauth_id = NULL;
689 data->reauth_id_len = 0;
690
691 res = eap_aka_response_reauth(data, req, respDataLen, 1,
692 eattr.nonce_s);
693 os_free(decrypted);
694
695 return res;
696 }
697 data->counter = eattr.counter;
698
699 os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
700 wpa_hexdump(MSG_DEBUG, "EAP-AKA: (encr) AT_NONCE_S",
701 data->nonce_s, EAP_SIM_NONCE_S_LEN);
702
703 eap_sim_derive_keys_reauth(data->counter,
704 data->reauth_id, data->reauth_id_len,
705 data->nonce_s, data->mk, data->msk,
706 data->emsk);
707 eap_aka_clear_identities(data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
708 eap_aka_learn_ids(data, &eattr);
709
710 if (data->state != FAILURE)
711 data->state = SUCCESS;
712
713 data->num_id_req = 0;
714 data->num_notification = 0;
715 if (data->counter > EAP_AKA_MAX_FAST_REAUTHS) {
716 wpa_printf(MSG_DEBUG, "EAP-AKA: Maximum number of "
717 "fast reauths performed - force fullauth");
718 eap_aka_clear_identities(data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
719 }
720 os_free(decrypted);
721 return eap_aka_response_reauth(data, req, respDataLen, 0,
722 data->nonce_s);
723 }
724
725
eap_aka_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const u8 * reqData,size_t reqDataLen,size_t * respDataLen)726 static u8 * eap_aka_process(struct eap_sm *sm, void *priv,
727 struct eap_method_ret *ret,
728 const u8 *reqData, size_t reqDataLen,
729 size_t *respDataLen)
730 {
731 struct eap_aka_data *data = priv;
732 const struct eap_hdr *req;
733 u8 subtype, *res;
734 const u8 *pos;
735 struct eap_sim_attrs attr;
736 size_t len;
737
738 wpa_hexdump(MSG_DEBUG, "EAP-AKA: EAP data", reqData, reqDataLen);
739 if (eap_get_config_identity(sm, &len) == NULL) {
740 wpa_printf(MSG_INFO, "EAP-AKA: Identity not configured");
741 eap_sm_request_identity(sm);
742 ret->ignore = TRUE;
743 return NULL;
744 }
745
746 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_AKA,
747 reqData, reqDataLen, &len);
748 if (pos == NULL || len < 1) {
749 ret->ignore = TRUE;
750 return NULL;
751 }
752 req = (const struct eap_hdr *) reqData;
753 len = be_to_host16(req->length);
754
755 ret->ignore = FALSE;
756 ret->methodState = METHOD_MAY_CONT;
757 ret->decision = DECISION_FAIL;
758 ret->allowNotifications = TRUE;
759
760 subtype = *pos++;
761 wpa_printf(MSG_DEBUG, "EAP-AKA: Subtype=%d", subtype);
762 pos += 2; /* Reserved */
763
764 if (eap_sim_parse_attr(pos, reqData + len, &attr, 1, 0)) {
765 res = eap_aka_client_error(data, req, respDataLen,
766 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
767 goto done;
768 }
769
770 switch (subtype) {
771 case EAP_AKA_SUBTYPE_IDENTITY:
772 res = eap_aka_process_identity(sm, data, req,
773 respDataLen, &attr);
774 break;
775 case EAP_AKA_SUBTYPE_CHALLENGE:
776 res = eap_aka_process_challenge(sm, data, req, len,
777 respDataLen, &attr);
778 break;
779 case EAP_AKA_SUBTYPE_NOTIFICATION:
780 res = eap_aka_process_notification(sm, data, req, len,
781 respDataLen, &attr);
782 break;
783 case EAP_AKA_SUBTYPE_REAUTHENTICATION:
784 res = eap_aka_process_reauthentication(sm, data, req, len,
785 respDataLen, &attr);
786 break;
787 case EAP_AKA_SUBTYPE_CLIENT_ERROR:
788 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Client-Error");
789 res = eap_aka_client_error(data, req, respDataLen,
790 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
791 break;
792 default:
793 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown subtype=%d", subtype);
794 res = eap_aka_client_error(data, req, respDataLen,
795 EAP_AKA_UNABLE_TO_PROCESS_PACKET);
796 break;
797 }
798
799 done:
800 if (data->state == FAILURE) {
801 ret->decision = DECISION_FAIL;
802 ret->methodState = METHOD_DONE;
803 } else if (data->state == SUCCESS) {
804 ret->decision = DECISION_COND_SUCC;
805 /*
806 * It is possible for the server to reply with AKA
807 * Notification, so we must allow the method to continue and
808 * not only accept EAP-Success at this point.
809 */
810 ret->methodState = METHOD_MAY_CONT;
811 }
812
813 if (ret->methodState == METHOD_DONE) {
814 ret->allowNotifications = FALSE;
815 }
816
817 return res;
818 }
819
820
eap_aka_has_reauth_data(struct eap_sm * sm,void * priv)821 static Boolean eap_aka_has_reauth_data(struct eap_sm *sm, void *priv)
822 {
823 struct eap_aka_data *data = priv;
824 return data->pseudonym || data->reauth_id;
825 }
826
827
eap_aka_deinit_for_reauth(struct eap_sm * sm,void * priv)828 static void eap_aka_deinit_for_reauth(struct eap_sm *sm, void *priv)
829 {
830 struct eap_aka_data *data = priv;
831 eap_aka_clear_identities(data, CLEAR_EAP_ID);
832 }
833
834
eap_aka_init_for_reauth(struct eap_sm * sm,void * priv)835 static void * eap_aka_init_for_reauth(struct eap_sm *sm, void *priv)
836 {
837 struct eap_aka_data *data = priv;
838 data->num_id_req = 0;
839 data->num_notification = 0;
840 data->state = CONTINUE;
841 return priv;
842 }
843
844
eap_aka_get_identity(struct eap_sm * sm,void * priv,size_t * len)845 static const u8 * eap_aka_get_identity(struct eap_sm *sm, void *priv,
846 size_t *len)
847 {
848 struct eap_aka_data *data = priv;
849
850 if (data->reauth_id) {
851 *len = data->reauth_id_len;
852 return data->reauth_id;
853 }
854
855 if (data->pseudonym) {
856 *len = data->pseudonym_len;
857 return data->pseudonym;
858 }
859
860 return NULL;
861 }
862
863
eap_aka_isKeyAvailable(struct eap_sm * sm,void * priv)864 static Boolean eap_aka_isKeyAvailable(struct eap_sm *sm, void *priv)
865 {
866 struct eap_aka_data *data = priv;
867 return data->state == SUCCESS;
868 }
869
870
eap_aka_getKey(struct eap_sm * sm,void * priv,size_t * len)871 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
872 {
873 struct eap_aka_data *data = priv;
874 u8 *key;
875
876 if (data->state != SUCCESS)
877 return NULL;
878
879 key = os_malloc(EAP_SIM_KEYING_DATA_LEN);
880 if (key == NULL)
881 return NULL;
882
883 *len = EAP_SIM_KEYING_DATA_LEN;
884 os_memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
885
886 return key;
887 }
888
889
eap_aka_get_emsk(struct eap_sm * sm,void * priv,size_t * len)890 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
891 {
892 struct eap_aka_data *data = priv;
893 u8 *key;
894
895 if (data->state != SUCCESS)
896 return NULL;
897
898 key = os_malloc(EAP_EMSK_LEN);
899 if (key == NULL)
900 return NULL;
901
902 *len = EAP_EMSK_LEN;
903 os_memcpy(key, data->emsk, EAP_EMSK_LEN);
904
905 return key;
906 }
907
908
eap_peer_aka_register(void)909 int eap_peer_aka_register(void)
910 {
911 struct eap_method *eap;
912 int ret;
913
914 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
915 EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
916 if (eap == NULL)
917 return -1;
918
919 eap->init = eap_aka_init;
920 eap->deinit = eap_aka_deinit;
921 eap->process = eap_aka_process;
922 eap->isKeyAvailable = eap_aka_isKeyAvailable;
923 eap->getKey = eap_aka_getKey;
924 eap->has_reauth_data = eap_aka_has_reauth_data;
925 eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
926 eap->init_for_reauth = eap_aka_init_for_reauth;
927 eap->get_identity = eap_aka_get_identity;
928 eap->get_emsk = eap_aka_get_emsk;
929
930 ret = eap_peer_method_register(eap);
931 if (ret)
932 eap_peer_method_free(eap);
933 return ret;
934 }
935