xref: /aosp_15_r20/external/wpa_supplicant_8/src/eap_peer/eap_aka.c (revision 03f9172ca588f91df233974f4258bab95191f931)
1 /*
2  * EAP peer method: EAP-AKA (RFC 4187) and EAP-AKA' (RFC 5448)
3  * Copyright (c) 2004-2012, Jouni Malinen <[email protected]>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "utils/base64.h"
13 #include "pcsc_funcs.h"
14 #include "crypto/crypto.h"
15 #include "crypto/sha1.h"
16 #include "crypto/sha256.h"
17 #include "crypto/milenage.h"
18 #include "eap_common/eap_sim_common.h"
19 #include "eap_config.h"
20 #include "eap_i.h"
21 
22 
23 struct eap_aka_data {
24 	u8 ik[EAP_AKA_IK_LEN], ck[EAP_AKA_CK_LEN], res[EAP_AKA_RES_MAX_LEN];
25 	size_t res_len;
26 	u8 nonce_s[EAP_SIM_NONCE_S_LEN];
27 	u8 mk[EAP_SIM_MK_LEN];
28 	u8 k_aut[EAP_AKA_PRIME_K_AUT_LEN];
29 	u8 k_encr[EAP_SIM_K_ENCR_LEN];
30 	u8 k_re[EAP_AKA_PRIME_K_RE_LEN]; /* EAP-AKA' only */
31 	u8 msk[EAP_SIM_KEYING_DATA_LEN];
32 	u8 emsk[EAP_EMSK_LEN];
33 	u8 rand[EAP_AKA_RAND_LEN], autn[EAP_AKA_AUTN_LEN];
34 	u8 auts[EAP_AKA_AUTS_LEN];
35 	u8 reauth_mac[EAP_SIM_MAC_LEN];
36 
37 	int num_id_req, num_notification;
38 	u8 *pseudonym;
39 	size_t pseudonym_len;
40 	u8 *reauth_id;
41 	size_t reauth_id_len;
42 	int reauth;
43 	unsigned int counter, counter_too_small;
44 	u8 *mk_identity;
45 	size_t mk_identity_len;
46 	enum {
47 		CONTINUE, RESULT_SUCCESS, SUCCESS, FAILURE
48 	} state;
49 
50 	struct wpabuf *id_msgs;
51 	int prev_id;
52 	int result_ind, use_result_ind;
53 	int use_pseudonym;
54 	u8 eap_method;
55 	u8 *network_name;
56 	size_t network_name_len;
57 	u16 kdf;
58 	int kdf_negotiation;
59 	u16 last_kdf_attrs[EAP_AKA_PRIME_KDF_MAX];
60 	size_t last_kdf_count;
61 	int error_code;
62 	struct crypto_rsa_key *imsi_privacy_key;
63 };
64 
65 
66 #ifndef CONFIG_NO_STDOUT_DEBUG
eap_aka_state_txt(int state)67 static const char * eap_aka_state_txt(int state)
68 {
69 	switch (state) {
70 	case CONTINUE:
71 		return "CONTINUE";
72 	case RESULT_SUCCESS:
73 		return "RESULT_SUCCESS";
74 	case SUCCESS:
75 		return "SUCCESS";
76 	case FAILURE:
77 		return "FAILURE";
78 	default:
79 		return "?";
80 	}
81 }
82 #endif /* CONFIG_NO_STDOUT_DEBUG */
83 
84 
eap_aka_state(struct eap_aka_data * data,int state)85 static void eap_aka_state(struct eap_aka_data *data, int state)
86 {
87 	wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
88 		   eap_aka_state_txt(data->state),
89 		   eap_aka_state_txt(state));
90 	data->state = state;
91 }
92 
93 
eap_aka_init(struct eap_sm * sm)94 static void * eap_aka_init(struct eap_sm *sm)
95 {
96 	struct eap_aka_data *data;
97 	const char *phase1 = eap_get_config_phase1(sm);
98 	struct eap_peer_config *config = eap_get_config(sm);
99 
100 	data = os_zalloc(sizeof(*data));
101 	if (data == NULL)
102 		return NULL;
103 
104 	data->eap_method = EAP_TYPE_AKA;
105 
106 	if (config && config->imsi_privacy_cert) {
107 #ifdef CRYPTO_RSA_OAEP_SHA256
108 		data->imsi_privacy_key = crypto_rsa_key_read(
109 			config->imsi_privacy_cert, false);
110 		if (!data->imsi_privacy_key) {
111 			wpa_printf(MSG_ERROR,
112 				   "EAP-AKA: Failed to read/parse IMSI privacy certificate %s",
113 				   config->imsi_privacy_cert);
114 			os_free(data);
115 			return NULL;
116 		}
117 #else /* CRYPTO_RSA_OAEP_SHA256 */
118 		wpa_printf(MSG_ERROR,
119 			   "EAP-AKA: No support for imsi_privacy_cert in the build");
120 		os_free(data);
121 		return NULL;
122 #endif /* CRYPTO_RSA_OAEP_SHA256 */
123 	}
124 
125 	/* Zero is a valid error code, so we need to initialize */
126 	data->error_code = NO_EAP_METHOD_ERROR;
127 
128 	eap_aka_state(data, CONTINUE);
129 	data->prev_id = -1;
130 
131 	data->result_ind = phase1 && os_strstr(phase1, "result_ind=1") != NULL;
132 
133 	data->use_pseudonym = !sm->init_phase2;
134 	if (config && config->anonymous_identity && data->use_pseudonym) {
135 		data->pseudonym = os_malloc(config->anonymous_identity_len);
136 		if (data->pseudonym) {
137 			os_memcpy(data->pseudonym, config->anonymous_identity,
138 				  config->anonymous_identity_len);
139 			data->pseudonym_len = config->anonymous_identity_len;
140 		}
141 	}
142 
143 	if (sm->identity) {
144 		/* Use the EAP-Response/Identity in MK derivation if AT_IDENTITY
145 		 * is not used. */
146 		data->mk_identity = os_memdup(sm->identity, sm->identity_len);
147 		data->mk_identity_len = sm->identity_len;
148 	}
149 
150 	return data;
151 }
152 
153 
154 #ifdef EAP_AKA_PRIME
eap_aka_prime_init(struct eap_sm * sm)155 static void * eap_aka_prime_init(struct eap_sm *sm)
156 {
157 	struct eap_aka_data *data = eap_aka_init(sm);
158 	if (data == NULL)
159 		return NULL;
160 	data->eap_method = EAP_TYPE_AKA_PRIME;
161 	return data;
162 }
163 #endif /* EAP_AKA_PRIME */
164 
165 
eap_aka_clear_keys(struct eap_aka_data * data,int reauth)166 static void eap_aka_clear_keys(struct eap_aka_data *data, int reauth)
167 {
168 	if (!reauth) {
169 		os_memset(data->mk, 0, EAP_SIM_MK_LEN);
170 		os_memset(data->k_aut, 0, EAP_AKA_PRIME_K_AUT_LEN);
171 		os_memset(data->k_encr, 0, EAP_SIM_K_ENCR_LEN);
172 		os_memset(data->k_re, 0, EAP_AKA_PRIME_K_RE_LEN);
173 	}
174 	os_memset(data->msk, 0, EAP_SIM_KEYING_DATA_LEN);
175 	os_memset(data->emsk, 0, EAP_EMSK_LEN);
176 	os_memset(data->autn, 0, EAP_AKA_AUTN_LEN);
177 	os_memset(data->auts, 0, EAP_AKA_AUTS_LEN);
178 }
179 
180 
eap_aka_deinit(struct eap_sm * sm,void * priv)181 static void eap_aka_deinit(struct eap_sm *sm, void *priv)
182 {
183 	struct eap_aka_data *data = priv;
184 	if (data) {
185 		os_free(data->pseudonym);
186 		os_free(data->reauth_id);
187 		os_free(data->mk_identity);
188 		wpabuf_free(data->id_msgs);
189 		os_free(data->network_name);
190 		eap_aka_clear_keys(data, 0);
191 #ifdef CRYPTO_RSA_OAEP_SHA256
192 		crypto_rsa_key_free(data->imsi_privacy_key);
193 #endif /* CRYPTO_RSA_OAEP_SHA256 */
194 		os_free(data);
195 	}
196 }
197 
198 
eap_aka_ext_sim_req(struct eap_sm * sm,struct eap_aka_data * data)199 static int eap_aka_ext_sim_req(struct eap_sm *sm, struct eap_aka_data *data)
200 {
201 	char req[200], *pos, *end;
202 
203 	wpa_printf(MSG_DEBUG, "EAP-AKA: Use external USIM processing");
204 	pos = req;
205 	end = pos + sizeof(req);
206 	pos += os_snprintf(pos, end - pos, "UMTS-AUTH");
207 	pos += os_snprintf(pos, end - pos, ":");
208 	pos += wpa_snprintf_hex(pos, end - pos, data->rand, EAP_AKA_RAND_LEN);
209 	pos += os_snprintf(pos, end - pos, ":");
210 	wpa_snprintf_hex(pos, end - pos, data->autn, EAP_AKA_AUTN_LEN);
211 
212 	eap_sm_request_sim(sm, req);
213 	return 1;
214 }
215 
216 
eap_aka_ext_sim_result(struct eap_sm * sm,struct eap_aka_data * data,struct eap_peer_config * conf)217 static int eap_aka_ext_sim_result(struct eap_sm *sm, struct eap_aka_data *data,
218 				  struct eap_peer_config *conf)
219 {
220 	char *resp, *pos;
221 
222 	wpa_printf(MSG_DEBUG,
223 		   "EAP-AKA: Use result from external USIM processing");
224 
225 	resp = conf->external_sim_resp;
226 	conf->external_sim_resp = NULL;
227 
228 	if (os_strncmp(resp, "UMTS-AUTS:", 10) == 0) {
229 		pos = resp + 10;
230 		if (hexstr2bin(pos, data->auts, EAP_AKA_AUTS_LEN) < 0)
231 			goto invalid;
232 		wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: AUTS", data->auts,
233 				EAP_AKA_AUTS_LEN);
234 		os_free(resp);
235 		return -2;
236 	}
237 
238 	if (os_strncmp(resp, "UMTS-AUTH:", 10) != 0) {
239 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized external USIM processing response");
240 		os_free(resp);
241 		return -1;
242 	}
243 
244 	pos = resp + 10;
245 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: RAND", data->rand, EAP_AKA_RAND_LEN);
246 
247 	if (hexstr2bin(pos, data->ik, EAP_AKA_IK_LEN) < 0)
248 		goto invalid;
249 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", data->ik, EAP_AKA_IK_LEN);
250 	pos += EAP_AKA_IK_LEN * 2;
251 	if (*pos != ':')
252 		goto invalid;
253 	pos++;
254 
255 	if (hexstr2bin(pos, data->ck, EAP_AKA_CK_LEN) < 0)
256 		goto invalid;
257 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", data->ck, EAP_AKA_CK_LEN);
258 	pos += EAP_AKA_CK_LEN * 2;
259 	if (*pos != ':')
260 		goto invalid;
261 	pos++;
262 
263 	data->res_len = os_strlen(pos) / 2;
264 	if (data->res_len > EAP_AKA_RES_MAX_LEN) {
265 		data->res_len = 0;
266 		goto invalid;
267 	}
268 	if (hexstr2bin(pos, data->res, data->res_len) < 0)
269 		goto invalid;
270 	wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: RES", data->res, data->res_len);
271 
272 	os_free(resp);
273 	return 0;
274 
275 invalid:
276 	wpa_printf(MSG_DEBUG, "EAP-AKA: Invalid external USIM processing UMTS-AUTH response");
277 	os_free(resp);
278 	return -1;
279 }
280 
281 
eap_aka_umts_auth(struct eap_sm * sm,struct eap_aka_data * data)282 static int eap_aka_umts_auth(struct eap_sm *sm, struct eap_aka_data *data)
283 {
284 	struct eap_peer_config *conf;
285 
286 	wpa_printf(MSG_DEBUG, "EAP-AKA: UMTS authentication algorithm");
287 
288 	conf = eap_get_config(sm);
289 	if (conf == NULL)
290 		return -1;
291 
292 	if (sm->external_sim) {
293 		if (conf->external_sim_resp)
294 			return eap_aka_ext_sim_result(sm, data, conf);
295 		else
296 			return eap_aka_ext_sim_req(sm, data);
297 	}
298 
299 	if (conf->pcsc) {
300 		return scard_umts_auth(sm->scard_ctx, data->rand,
301 				       data->autn, data->res, &data->res_len,
302 				       data->ik, data->ck, data->auts);
303 	}
304 
305 #ifdef CONFIG_USIM_SIMULATOR
306 	if (conf->password) {
307 		u8 opc[16], k[16], sqn[6];
308 		const char *pos;
309 		wpa_printf(MSG_DEBUG, "EAP-AKA: Use internal Milenage "
310 			   "implementation for UMTS authentication");
311 		if (conf->password_len < 78) {
312 			wpa_printf(MSG_DEBUG, "EAP-AKA: invalid Milenage "
313 				   "password");
314 			return -1;
315 		}
316 		pos = (const char *) conf->password;
317 		if (hexstr2bin(pos, k, 16))
318 			return -1;
319 		pos += 32;
320 		if (*pos != ':')
321 			return -1;
322 		pos++;
323 
324 		if (hexstr2bin(pos, opc, 16))
325 			return -1;
326 		pos += 32;
327 		if (*pos != ':')
328 			return -1;
329 		pos++;
330 
331 		if (hexstr2bin(pos, sqn, 6))
332 			return -1;
333 
334 		return milenage_check(opc, k, sqn, data->rand, data->autn,
335 				      data->ik, data->ck,
336 				      data->res, &data->res_len, data->auts);
337 	}
338 #endif /* CONFIG_USIM_SIMULATOR */
339 
340 #ifdef CONFIG_USIM_HARDCODED
341 	wpa_printf(MSG_DEBUG, "EAP-AKA: Use hardcoded Kc and SRES values for "
342 		   "testing");
343 
344 	/* These hardcoded Kc and SRES values are used for testing.
345 	 * Could consider making them configurable. */
346 	os_memset(data->res, '2', EAP_AKA_RES_MAX_LEN);
347 	data->res_len = EAP_AKA_RES_MAX_LEN;
348 	os_memset(data->ik, '3', EAP_AKA_IK_LEN);
349 	os_memset(data->ck, '4', EAP_AKA_CK_LEN);
350 	{
351 		u8 autn[EAP_AKA_AUTN_LEN];
352 		os_memset(autn, '1', EAP_AKA_AUTN_LEN);
353 		if (os_memcmp_const(autn, data->autn, EAP_AKA_AUTN_LEN) != 0) {
354 			wpa_printf(MSG_WARNING, "EAP-AKA: AUTN did not match "
355 				   "with expected value");
356 			return -1;
357 		}
358 	}
359 #if 0
360 	{
361 		static int test_resync = 1;
362 		if (test_resync) {
363 			/* Test Resynchronization */
364 			test_resync = 0;
365 			return -2;
366 		}
367 	}
368 #endif
369 	return 0;
370 
371 #else /* CONFIG_USIM_HARDCODED */
372 
373 	wpa_printf(MSG_DEBUG, "EAP-AKA: No UMTS authentication algorithm "
374 		   "enabled");
375 	return -1;
376 
377 #endif /* CONFIG_USIM_HARDCODED */
378 }
379 
380 
381 #define CLEAR_PSEUDONYM	0x01
382 #define CLEAR_REAUTH_ID	0x02
383 
eap_aka_clear_identities(struct eap_sm * sm,struct eap_aka_data * data,int id)384 static void eap_aka_clear_identities(struct eap_sm *sm,
385 				     struct eap_aka_data *data, int id)
386 {
387 	if ((id & CLEAR_PSEUDONYM) && data->pseudonym) {
388 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old pseudonym");
389 		os_free(data->pseudonym);
390 		data->pseudonym = NULL;
391 		data->pseudonym_len = 0;
392 		if (data->use_pseudonym)
393 			eap_set_anon_id(sm, NULL, 0);
394 	}
395 	if ((id & CLEAR_REAUTH_ID) && data->reauth_id) {
396 		wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old reauth_id");
397 		os_free(data->reauth_id);
398 		data->reauth_id = NULL;
399 		data->reauth_id_len = 0;
400 	}
401 }
402 
403 
eap_aka_learn_ids(struct eap_sm * sm,struct eap_aka_data * data,struct eap_sim_attrs * attr)404 static int eap_aka_learn_ids(struct eap_sm *sm, struct eap_aka_data *data,
405 			     struct eap_sim_attrs *attr)
406 {
407 	if (attr->next_pseudonym) {
408 		const u8 *identity = NULL;
409 		size_t identity_len = 0;
410 		const u8 *realm = NULL;
411 		size_t realm_len = 0;
412 
413 		wpa_hexdump_ascii(MSG_DEBUG,
414 				  "EAP-AKA: (encr) AT_NEXT_PSEUDONYM",
415 				  attr->next_pseudonym,
416 				  attr->next_pseudonym_len);
417 		os_free(data->pseudonym);
418 
419 		/* Get realm from identities to decorate pseudonym. */
420 		realm = eap_get_config_realm(sm, &realm_len);
421 
422 		data->pseudonym = os_malloc(attr->next_pseudonym_len +
423 					    realm_len);
424 		if (data->pseudonym == NULL) {
425 			wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
426 				   "next pseudonym");
427 			data->pseudonym_len = 0;
428 			return -1;
429 		}
430 		os_memcpy(data->pseudonym, attr->next_pseudonym,
431 			  attr->next_pseudonym_len);
432 		if (realm_len) {
433 			os_memcpy(data->pseudonym + attr->next_pseudonym_len,
434 				  realm, realm_len);
435 		}
436 		data->pseudonym_len = attr->next_pseudonym_len + realm_len;
437 		if (data->use_pseudonym)
438 			eap_set_anon_id(sm, data->pseudonym,
439 					data->pseudonym_len);
440 	}
441 
442 	if (attr->next_reauth_id) {
443 		os_free(data->reauth_id);
444 		data->reauth_id = os_memdup(attr->next_reauth_id,
445 					    attr->next_reauth_id_len);
446 		if (data->reauth_id == NULL) {
447 			wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
448 				   "next reauth_id");
449 			data->reauth_id_len = 0;
450 			return -1;
451 		}
452 		data->reauth_id_len = attr->next_reauth_id_len;
453 		wpa_hexdump_ascii(MSG_DEBUG,
454 				  "EAP-AKA: (encr) AT_NEXT_REAUTH_ID",
455 				  data->reauth_id,
456 				  data->reauth_id_len);
457 	}
458 
459 	return 0;
460 }
461 
462 
eap_aka_add_id_msg(struct eap_aka_data * data,const struct wpabuf * msg1,const struct wpabuf * msg2)463 static int eap_aka_add_id_msg(struct eap_aka_data *data,
464 			      const struct wpabuf *msg1,
465 			      const struct wpabuf *msg2)
466 {
467 	size_t len;
468 
469 	if (!msg1)
470 		return -1;
471 	len = wpabuf_len(msg1);
472 	if (msg2)
473 		len += wpabuf_len(msg2);
474 
475 	if (!data->id_msgs) {
476 		data->id_msgs = wpabuf_alloc(len);
477 		if (!data->id_msgs)
478 			return -1;
479 	} else if (wpabuf_resize(&data->id_msgs, len) < 0) {
480 		return -1;
481 	}
482 
483 	wpabuf_put_buf(data->id_msgs, msg1);
484 	if (msg2)
485 		wpabuf_put_buf(data->id_msgs, msg2);
486 
487 	return 0;
488 }
489 
490 
eap_aka_add_checkcode(struct eap_aka_data * data,struct eap_sim_msg * msg)491 static void eap_aka_add_checkcode(struct eap_aka_data *data,
492 				  struct eap_sim_msg *msg)
493 {
494 	const u8 *addr;
495 	size_t len;
496 	u8 hash[SHA256_MAC_LEN];
497 
498 	wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
499 
500 	if (data->id_msgs == NULL) {
501 		/*
502 		 * No EAP-AKA/Identity packets were exchanged - send empty
503 		 * checkcode.
504 		 */
505 		eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
506 		return;
507 	}
508 
509 	/* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
510 	addr = wpabuf_head(data->id_msgs);
511 	len = wpabuf_len(data->id_msgs);
512 	wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
513 #ifdef EAP_AKA_PRIME
514 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
515 		sha256_vector(1, &addr, &len, hash);
516 	else
517 #endif /* EAP_AKA_PRIME */
518 		sha1_vector(1, &addr, &len, hash);
519 
520 	eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
521 			data->eap_method == EAP_TYPE_AKA_PRIME ?
522 			EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN);
523 }
524 
525 
eap_aka_verify_checkcode(struct eap_aka_data * data,const u8 * checkcode,size_t checkcode_len)526 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
527 				    const u8 *checkcode, size_t checkcode_len)
528 {
529 	const u8 *addr;
530 	size_t len;
531 	u8 hash[SHA256_MAC_LEN];
532 	size_t hash_len;
533 
534 	if (checkcode == NULL)
535 		return -1;
536 
537 	if (data->id_msgs == NULL) {
538 		if (checkcode_len != 0) {
539 			wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
540 				   "indicates that AKA/Identity messages were "
541 				   "used, but they were not");
542 			return -1;
543 		}
544 		return 0;
545 	}
546 
547 	hash_len = data->eap_method == EAP_TYPE_AKA_PRIME ?
548 		EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN;
549 
550 	if (checkcode_len != hash_len) {
551 		wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
552 			   "indicates that AKA/Identity message were not "
553 			   "used, but they were");
554 		return -1;
555 	}
556 
557 	/* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
558 	addr = wpabuf_head(data->id_msgs);
559 	len = wpabuf_len(data->id_msgs);
560 #ifdef EAP_AKA_PRIME
561 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
562 		sha256_vector(1, &addr, &len, hash);
563 	else
564 #endif /* EAP_AKA_PRIME */
565 		sha1_vector(1, &addr, &len, hash);
566 
567 	if (os_memcmp_const(hash, checkcode, hash_len) != 0) {
568 		wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
569 		return -1;
570 	}
571 
572 	return 0;
573 }
574 
575 
eap_aka_client_error(struct eap_aka_data * data,u8 id,int err)576 static struct wpabuf * eap_aka_client_error(struct eap_aka_data *data, u8 id,
577 					    int err)
578 {
579 	struct eap_sim_msg *msg;
580 
581 	eap_aka_state(data, FAILURE);
582 	data->num_id_req = 0;
583 	data->num_notification = 0;
584 
585 	wpa_printf(MSG_DEBUG, "EAP-AKA: Send Client-Error (error code %d)",
586 		   err);
587 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
588 			       EAP_AKA_SUBTYPE_CLIENT_ERROR);
589 	eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
590 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
591 }
592 
593 
eap_aka_authentication_reject(struct eap_aka_data * data,u8 id)594 static struct wpabuf * eap_aka_authentication_reject(struct eap_aka_data *data,
595 						     u8 id)
596 {
597 	struct eap_sim_msg *msg;
598 
599 	eap_aka_state(data, FAILURE);
600 	data->num_id_req = 0;
601 	data->num_notification = 0;
602 
603 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Authentication-Reject "
604 		   "(id=%d)", id);
605 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
606 			       EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT);
607 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
608 }
609 
610 
eap_aka_synchronization_failure(struct eap_aka_data * data,u8 id,struct eap_sim_attrs * attr)611 static struct wpabuf * eap_aka_synchronization_failure(
612 	struct eap_aka_data *data, u8 id, struct eap_sim_attrs *attr)
613 {
614 	struct eap_sim_msg *msg;
615 
616 	data->num_id_req = 0;
617 	data->num_notification = 0;
618 
619 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Synchronization-Failure "
620 		   "(id=%d)", id);
621 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
622 			       EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE);
623 	wpa_printf(MSG_DEBUG, "   AT_AUTS");
624 	eap_sim_msg_add_full(msg, EAP_SIM_AT_AUTS, data->auts,
625 			     EAP_AKA_AUTS_LEN);
626 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
627 		size_t i;
628 
629 		for (i = 0; i < attr->kdf_count; i++) {
630 			wpa_printf(MSG_DEBUG, "   AT_KDF");
631 			eap_sim_msg_add(msg, EAP_SIM_AT_KDF, attr->kdf[i],
632 					NULL, 0);
633 		}
634 	}
635 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
636 }
637 
638 
639 #ifdef CRYPTO_RSA_OAEP_SHA256
640 static struct wpabuf *
eap_aka_encrypt_identity(struct crypto_rsa_key * imsi_privacy_key,const u8 * identity,size_t identity_len,const char * attr)641 eap_aka_encrypt_identity(struct crypto_rsa_key *imsi_privacy_key,
642 			 const u8 *identity, size_t identity_len,
643 			 const char *attr)
644 {
645 	struct wpabuf *imsi_buf, *enc;
646 	char *b64;
647 	size_t b64_len, len;
648 
649 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Encrypt permanent identity",
650 			  identity, identity_len);
651 
652 	imsi_buf = wpabuf_alloc_copy(identity, identity_len);
653 	if (!imsi_buf)
654 		return NULL;
655 	enc = crypto_rsa_oaep_sha256_encrypt(imsi_privacy_key, imsi_buf);
656 	wpabuf_free(imsi_buf);
657 	if (!enc)
658 		return NULL;
659 
660 	b64 = base64_encode_no_lf(wpabuf_head(enc), wpabuf_len(enc), &b64_len);
661 	wpabuf_free(enc);
662 	if (!b64)
663 		return NULL;
664 
665 	len = 1 + b64_len;
666 	if (attr)
667 		len += 1 + os_strlen(attr);
668 	enc = wpabuf_alloc(len);
669 	if (!enc) {
670 		os_free(b64);
671 		return NULL;
672 	}
673 	wpabuf_put_u8(enc, '\0');
674 	wpabuf_put_data(enc, b64, b64_len);
675 	os_free(b64);
676 	if (attr) {
677 		wpabuf_put_u8(enc, ',');
678 		wpabuf_put_str(enc, attr);
679 	}
680 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Encrypted permanent identity",
681 			  wpabuf_head(enc), wpabuf_len(enc));
682 
683 	return enc;
684 }
685 #endif /* CRYPTO_RSA_OAEP_SHA256 */
686 
687 
eap_aka_response_identity(struct eap_sm * sm,struct eap_aka_data * data,u8 id,enum eap_sim_id_req id_req)688 static struct wpabuf * eap_aka_response_identity(struct eap_sm *sm,
689 						 struct eap_aka_data *data,
690 						 u8 id,
691 						 enum eap_sim_id_req id_req)
692 {
693 	const u8 *identity = NULL;
694 	size_t identity_len = 0;
695 	struct eap_sim_msg *msg;
696 	struct wpabuf *enc_identity = NULL;
697 	struct eap_peer_config *config = NULL;
698 	bool use_imsi_identity = false;
699 
700 	data->reauth = 0;
701 	if (id_req == ANY_ID && data->reauth_id) {
702 		identity = data->reauth_id;
703 		identity_len = data->reauth_id_len;
704 		data->reauth = 1;
705 	} else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
706 		   data->pseudonym &&
707 		   !eap_sim_anonymous_username(data->pseudonym,
708 					       data->pseudonym_len)) {
709 		identity = data->pseudonym;
710 		identity_len = data->pseudonym_len;
711 		eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
712 	} else if (id_req != NO_ID_REQ) {
713 		if (id_req == PERMANENT_ID && eap_get_config_strict_conservative_peer_mode(sm)) {
714 			wpa_printf(MSG_INFO, "EAP-AKA: permanent_id_req is denied in "
715 				   "the strict conservative peer mode");
716 			eap_notify_permanent_id_req_denied(sm);
717 			return eap_aka_client_error(data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
718 		}
719 		identity = eap_get_config_identity(sm, &identity_len);
720 		if (identity) {
721 			int ids = CLEAR_PSEUDONYM | CLEAR_REAUTH_ID;
722 
723 			if (data->pseudonym &&
724 			    eap_sim_anonymous_username(data->pseudonym,
725 						       data->pseudonym_len))
726 				ids &= ~CLEAR_PSEUDONYM;
727 			eap_aka_clear_identities(sm, data, ids);
728 
729 			config = eap_get_config(sm);
730 			if (config && config->imsi_identity)
731 				use_imsi_identity = true;
732 		}
733 #ifdef CRYPTO_RSA_OAEP_SHA256
734 		if (identity && data->imsi_privacy_key) {
735 			const char *attr = NULL;
736 
737 			config = eap_get_config(sm);
738 			if (config)
739 				attr = config->imsi_privacy_attr;
740 			enc_identity = eap_aka_encrypt_identity(
741 				data->imsi_privacy_key,
742 				identity, identity_len, attr);
743 			if (!enc_identity) {
744 				wpa_printf(MSG_INFO,
745 					   "EAP-AKA: Failed to encrypt permanent identity");
746 				return eap_aka_client_error(
747 					data, id,
748 					EAP_AKA_UNABLE_TO_PROCESS_PACKET);
749 			}
750 			/* Use the real identity, not the encrypted one, in MK
751 			 * derivation. */
752 			os_free(data->mk_identity);
753 			data->mk_identity = os_memdup(identity, identity_len);
754 			data->mk_identity_len = identity_len;
755 			identity = wpabuf_head(enc_identity);
756 			identity_len = wpabuf_len(enc_identity);
757 		}
758 #endif /* CRYPTO_RSA_OAEP_SHA256 */
759 	}
760 
761 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Identity (id=%d)", id);
762 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
763 			       EAP_AKA_SUBTYPE_IDENTITY);
764 
765 	if (identity) {
766 		wpa_hexdump_ascii(MSG_DEBUG, "   AT_IDENTITY",
767 				  identity, identity_len);
768 		eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
769 				identity, identity_len);
770 		if (use_imsi_identity && config && config->imsi_identity) {
771 			/* Use the IMSI identity override, i.e., the not
772 			 * encrypted one, in MK derivation, when using
773 			 * externally encrypted identity in configuration. */
774 			os_free(data->mk_identity);
775 			data->mk_identity = os_memdup(
776 				config->imsi_identity,
777 				config->imsi_identity_len);
778 			data->mk_identity_len = config->imsi_identity_len;
779 		} else if (!enc_identity) {
780 			/* Use the last AT_IDENTITY value as the identity in
781 			 * MK derivation. */
782 			os_free(data->mk_identity);
783 			data->mk_identity = os_memdup(identity, identity_len);
784 			data->mk_identity_len = identity_len;
785 		}
786 	}
787 	wpabuf_free(enc_identity);
788 
789 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
790 }
791 
792 
eap_aka_response_challenge(struct eap_aka_data * data,u8 id)793 static struct wpabuf * eap_aka_response_challenge(struct eap_aka_data *data,
794 						  u8 id)
795 {
796 	struct eap_sim_msg *msg;
797 
798 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d)", id);
799 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
800 			       EAP_AKA_SUBTYPE_CHALLENGE);
801 	wpa_printf(MSG_DEBUG, "   AT_RES");
802 	eap_sim_msg_add(msg, EAP_SIM_AT_RES, data->res_len * 8,
803 			data->res, data->res_len);
804 	eap_aka_add_checkcode(data, msg);
805 	if (data->use_result_ind) {
806 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
807 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
808 	}
809 	wpa_printf(MSG_DEBUG, "   AT_MAC");
810 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
811 	return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, (u8 *) "",
812 				  0);
813 }
814 
815 
eap_aka_response_reauth(struct eap_aka_data * data,u8 id,int counter_too_small,const u8 * nonce_s)816 static struct wpabuf * eap_aka_response_reauth(struct eap_aka_data *data,
817 					       u8 id, int counter_too_small,
818 					       const u8 *nonce_s)
819 {
820 	struct eap_sim_msg *msg;
821 	unsigned int counter;
822 
823 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Reauthentication (id=%d)",
824 		   id);
825 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
826 			       EAP_AKA_SUBTYPE_REAUTHENTICATION);
827 	wpa_printf(MSG_DEBUG, "   AT_IV");
828 	wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
829 	eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
830 
831 	if (counter_too_small) {
832 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER_TOO_SMALL");
833 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
834 		counter = data->counter_too_small;
835 	} else
836 		counter = data->counter;
837 
838 	wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", counter);
839 	eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
840 
841 	if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
842 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
843 			   "AT_ENCR_DATA");
844 		eap_sim_msg_free(msg);
845 		return NULL;
846 	}
847 	eap_aka_add_checkcode(data, msg);
848 	if (data->use_result_ind) {
849 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
850 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
851 	}
852 	wpa_printf(MSG_DEBUG, "   AT_MAC");
853 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
854 	return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, nonce_s,
855 				  EAP_SIM_NONCE_S_LEN);
856 }
857 
858 
eap_aka_response_notification(struct eap_aka_data * data,u8 id,u16 notification)859 static struct wpabuf * eap_aka_response_notification(struct eap_aka_data *data,
860 						     u8 id, u16 notification)
861 {
862 	struct eap_sim_msg *msg;
863 	u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
864 
865 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Notification (id=%d)", id);
866 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
867 			       EAP_AKA_SUBTYPE_NOTIFICATION);
868 	if (k_aut && data->reauth) {
869 		wpa_printf(MSG_DEBUG, "   AT_IV");
870 		wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
871 		eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
872 					   EAP_SIM_AT_ENCR_DATA);
873 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", data->counter);
874 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
875 				NULL, 0);
876 		if (eap_sim_msg_add_encr_end(msg, data->k_encr,
877 					     EAP_SIM_AT_PADDING)) {
878 			wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
879 				   "AT_ENCR_DATA");
880 			eap_sim_msg_free(msg);
881 			return NULL;
882 		}
883 	}
884 	if (k_aut) {
885 		wpa_printf(MSG_DEBUG, "   AT_MAC");
886 		eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
887 	}
888 	return eap_sim_msg_finish(msg, data->eap_method, k_aut, (u8 *) "", 0);
889 }
890 
891 
eap_aka_process_identity(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)892 static struct wpabuf * eap_aka_process_identity(struct eap_sm *sm,
893 						struct eap_aka_data *data,
894 						u8 id,
895 						const struct wpabuf *reqData,
896 						struct eap_sim_attrs *attr)
897 {
898 	int id_error;
899 	struct wpabuf *buf;
900 
901 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Identity");
902 
903 	id_error = 0;
904 	switch (attr->id_req) {
905 	case NO_ID_REQ:
906 		break;
907 	case ANY_ID:
908 		if (data->num_id_req > 0)
909 			id_error++;
910 		data->num_id_req++;
911 		break;
912 	case FULLAUTH_ID:
913 		if (data->num_id_req > 1)
914 			id_error++;
915 		data->num_id_req++;
916 		break;
917 	case PERMANENT_ID:
918 		if (data->num_id_req > 2)
919 			id_error++;
920 		data->num_id_req++;
921 		break;
922 	}
923 	if (id_error) {
924 		wpa_printf(MSG_INFO, "EAP-AKA: Too many ID requests "
925 			   "used within one authentication");
926 		return eap_aka_client_error(data, id,
927 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
928 	}
929 
930 	buf = eap_aka_response_identity(sm, data, id, attr->id_req);
931 
932 	if (data->prev_id != id) {
933 		if (eap_aka_add_id_msg(data, reqData, buf) < 0) {
934 			wpa_printf(MSG_INFO,
935 				   "EAP-AKA: Failed to store ID messages");
936 			wpabuf_free(buf);
937 			return eap_aka_client_error(
938 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
939 		}
940 		data->prev_id = id;
941 	}
942 
943 	return buf;
944 }
945 
946 
eap_aka_verify_mac(struct eap_aka_data * data,const struct wpabuf * req,const u8 * mac,const u8 * extra,size_t extra_len)947 static int eap_aka_verify_mac(struct eap_aka_data *data,
948 			      const struct wpabuf *req,
949 			      const u8 *mac, const u8 *extra,
950 			      size_t extra_len)
951 {
952 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
953 		return eap_sim_verify_mac_sha256(data->k_aut, req, mac, extra,
954 						 extra_len);
955 	return eap_sim_verify_mac(data->k_aut, req, mac, extra, extra_len);
956 }
957 
958 
959 #ifdef EAP_AKA_PRIME
eap_aka_prime_kdf_select(struct eap_aka_data * data,u8 id,u16 kdf)960 static struct wpabuf * eap_aka_prime_kdf_select(struct eap_aka_data *data,
961 						u8 id, u16 kdf)
962 {
963 	struct eap_sim_msg *msg;
964 
965 	data->kdf_negotiation = 1;
966 	data->kdf = kdf;
967 	wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d) (KDF "
968 		   "select)", id);
969 	msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
970 			       EAP_AKA_SUBTYPE_CHALLENGE);
971 	wpa_printf(MSG_DEBUG, "   AT_KDF");
972 	eap_sim_msg_add(msg, EAP_SIM_AT_KDF, kdf, NULL, 0);
973 	return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
974 }
975 
976 
eap_aka_prime_kdf_neg(struct eap_aka_data * data,u8 id,struct eap_sim_attrs * attr)977 static struct wpabuf * eap_aka_prime_kdf_neg(struct eap_aka_data *data,
978 					     u8 id, struct eap_sim_attrs *attr)
979 {
980 	size_t i;
981 
982 	for (i = 0; i < attr->kdf_count; i++) {
983 		if (attr->kdf[i] == EAP_AKA_PRIME_KDF) {
984 			os_memcpy(data->last_kdf_attrs, attr->kdf,
985 				  sizeof(u16) * attr->kdf_count);
986 			data->last_kdf_count = attr->kdf_count;
987 			return eap_aka_prime_kdf_select(data, id,
988 							EAP_AKA_PRIME_KDF);
989 		}
990 	}
991 
992 	/* No matching KDF found - fail authentication as if AUTN had been
993 	 * incorrect */
994 	return eap_aka_authentication_reject(data, id);
995 }
996 
997 
eap_aka_prime_kdf_valid(struct eap_aka_data * data,struct eap_sim_attrs * attr)998 static int eap_aka_prime_kdf_valid(struct eap_aka_data *data,
999 				   struct eap_sim_attrs *attr)
1000 {
1001 	size_t i, j;
1002 
1003 	if (attr->kdf_count == 0)
1004 		return 0;
1005 
1006 	/* The only allowed (and required) duplication of a KDF is the addition
1007 	 * of the selected KDF into the beginning of the list. */
1008 
1009 	if (data->kdf_negotiation) {
1010 		/* When the peer receives the new EAP-Request/AKA'-Challenge
1011 		 * message, must check only requested change occurred in the
1012 		 * list of AT_KDF attributes. If there are any other changes,
1013 		 * the peer must behave like the case that AT_MAC had been
1014 		 * incorrect and authentication is failed. These are defined in
1015 		 * EAP-AKA' specification RFC 5448, Section 3.2. */
1016 		if (attr->kdf[0] != data->kdf) {
1017 			wpa_printf(MSG_WARNING, "EAP-AKA': The server did not "
1018 				   "accept the selected KDF");
1019 			return -1;
1020 		}
1021 
1022 		if (attr->kdf_count > EAP_AKA_PRIME_KDF_MAX ||
1023 		    attr->kdf_count != data->last_kdf_count + 1) {
1024 			wpa_printf(MSG_WARNING,
1025 				   "EAP-AKA': The length of KDF attributes is wrong");
1026 			return -1;
1027 		}
1028 
1029 		for (i = 1; i < attr->kdf_count; i++) {
1030 			if (attr->kdf[i] != data->last_kdf_attrs[i - 1]) {
1031 				wpa_printf(MSG_WARNING,
1032 					   "EAP-AKA': The KDF attributes except selected KDF are not same as original one");
1033 				return -1;
1034 			}
1035 		}
1036 	}
1037 
1038 	for (i = data->kdf ? 1 : 0; i < attr->kdf_count; i++) {
1039 		for (j = i + 1; j < attr->kdf_count; j++) {
1040 			if (attr->kdf[i] == attr->kdf[j]) {
1041 				wpa_printf(MSG_WARNING, "EAP-AKA': The server "
1042 					   "included a duplicated KDF");
1043 				return 0;
1044 			}
1045 		}
1046 	}
1047 
1048 	return 1;
1049 }
1050 #endif /* EAP_AKA_PRIME */
1051 
1052 
eap_aka_process_challenge(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1053 static struct wpabuf * eap_aka_process_challenge(struct eap_sm *sm,
1054 						 struct eap_aka_data *data,
1055 						 u8 id,
1056 						 const struct wpabuf *reqData,
1057 						 struct eap_sim_attrs *attr)
1058 {
1059 	const u8 *identity;
1060 	size_t identity_len;
1061 	int res;
1062 	struct eap_sim_attrs eattr;
1063 
1064 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Challenge");
1065 
1066 	if (attr->checkcode &&
1067 	    eap_aka_verify_checkcode(data, attr->checkcode,
1068 				     attr->checkcode_len)) {
1069 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1070 			   "message");
1071 #ifdef TEST_FUZZ
1072 		wpa_printf(MSG_INFO,
1073 			   "TEST: Ignore AT_CHECKCODE mismatch for fuzz testing");
1074 #else /* TEST_FUZZ */
1075 		return eap_aka_client_error(data, id,
1076 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1077 #endif /* TEST_FUZZ */
1078 	}
1079 
1080 #ifdef EAP_AKA_PRIME
1081 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1082 		if (!attr->kdf_input || attr->kdf_input_len == 0) {
1083 			wpa_printf(MSG_WARNING, "EAP-AKA': Challenge message "
1084 				   "did not include non-empty AT_KDF_INPUT");
1085 			/* Fail authentication as if AUTN had been incorrect */
1086 			return eap_aka_authentication_reject(data, id);
1087 		}
1088 		os_free(data->network_name);
1089 		data->network_name = os_memdup(attr->kdf_input,
1090 					       attr->kdf_input_len);
1091 		if (data->network_name == NULL) {
1092 			wpa_printf(MSG_WARNING, "EAP-AKA': No memory for "
1093 				   "storing Network Name");
1094 			return eap_aka_authentication_reject(data, id);
1095 		}
1096 		data->network_name_len = attr->kdf_input_len;
1097 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA': Network Name "
1098 				  "(AT_KDF_INPUT)",
1099 				  data->network_name, data->network_name_len);
1100 		/* TODO: check Network Name per 3GPP.33.402 */
1101 
1102 		res = eap_aka_prime_kdf_valid(data, attr);
1103 		if (res == 0)
1104 			return eap_aka_authentication_reject(data, id);
1105 		else if (res == -1)
1106 			return eap_aka_client_error(
1107 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1108 
1109 		if (attr->kdf[0] != EAP_AKA_PRIME_KDF)
1110 			return eap_aka_prime_kdf_neg(data, id, attr);
1111 
1112 		data->kdf = EAP_AKA_PRIME_KDF;
1113 		wpa_printf(MSG_DEBUG, "EAP-AKA': KDF %d selected", data->kdf);
1114 	}
1115 
1116 	if (data->eap_method == EAP_TYPE_AKA && attr->bidding) {
1117 		u16 flags = WPA_GET_BE16(attr->bidding);
1118 		if ((flags & EAP_AKA_BIDDING_FLAG_D) &&
1119 		    eap_allowed_method(sm, EAP_VENDOR_IETF,
1120 				       EAP_TYPE_AKA_PRIME)) {
1121 			wpa_printf(MSG_WARNING, "EAP-AKA: Bidding down from "
1122 				   "AKA' to AKA detected");
1123 			/* Fail authentication as if AUTN had been incorrect */
1124 			return eap_aka_authentication_reject(data, id);
1125 		}
1126 	}
1127 #endif /* EAP_AKA_PRIME */
1128 
1129 	data->reauth = 0;
1130 	if (!attr->mac || !attr->rand || !attr->autn) {
1131 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1132 			   "did not include%s%s%s",
1133 			   !attr->mac ? " AT_MAC" : "",
1134 			   !attr->rand ? " AT_RAND" : "",
1135 			   !attr->autn ? " AT_AUTN" : "");
1136 		return eap_aka_client_error(data, id,
1137 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1138 	}
1139 	os_memcpy(data->rand, attr->rand, EAP_AKA_RAND_LEN);
1140 	os_memcpy(data->autn, attr->autn, EAP_AKA_AUTN_LEN);
1141 
1142 	res = eap_aka_umts_auth(sm, data);
1143 	if (res == -1) {
1144 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1145 			   "failed (AUTN)");
1146 		return eap_aka_authentication_reject(data, id);
1147 	} else if (res == -2) {
1148 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1149 			   "failed (AUTN seq# -> AUTS)");
1150 		return eap_aka_synchronization_failure(data, id, attr);
1151 	} else if (res > 0) {
1152 		wpa_printf(MSG_DEBUG, "EAP-AKA: Wait for external USIM processing");
1153 		return NULL;
1154 	} else if (res) {
1155 		wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication failed");
1156 		return eap_aka_client_error(data, id,
1157 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1158 	}
1159 #ifdef EAP_AKA_PRIME
1160 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1161 		/* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
1162 		 * needed 6-octet SQN ^ AK for CK',IK' derivation */
1163 		u16 amf = WPA_GET_BE16(data->autn + 6);
1164 		if (!(amf & 0x8000)) {
1165 			wpa_printf(MSG_WARNING, "EAP-AKA': AMF separation bit "
1166 				   "not set (AMF=0x%4x)", amf);
1167 			return eap_aka_authentication_reject(data, id);
1168 		}
1169 		eap_aka_prime_derive_ck_ik_prime(data->ck, data->ik,
1170 						 data->autn,
1171 						 data->network_name,
1172 						 data->network_name_len);
1173 	}
1174 #endif /* EAP_AKA_PRIME */
1175 
1176 	identity = data->mk_identity;
1177 	identity_len = data->mk_identity_len;
1178 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
1179 			  "derivation", identity, identity_len);
1180 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1181 		eap_aka_prime_derive_keys(identity, identity_len, data->ik,
1182 					  data->ck, data->k_encr, data->k_aut,
1183 					  data->k_re, data->msk, data->emsk);
1184 	} else {
1185 		eap_aka_derive_mk(identity, identity_len, data->ik, data->ck,
1186 				  data->mk);
1187 		eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
1188 				    data->msk, data->emsk);
1189 	}
1190 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1191 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1192 			   "used invalid AT_MAC");
1193 #ifdef TEST_FUZZ
1194 		wpa_printf(MSG_INFO,
1195 			   "TEST: Ignore AT_MAC mismatch for fuzz testing");
1196 #else /* TEST_FUZZ */
1197 		return eap_aka_client_error(data, id,
1198 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1199 #endif /* TEST_FUZZ */
1200 	}
1201 
1202 	/* Old reauthentication identity must not be used anymore. In
1203 	 * other words, if no new identities are received, full
1204 	 * authentication will be used on next reauthentication (using
1205 	 * pseudonym identity or permanent identity). */
1206 	eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
1207 
1208 	if (attr->encr_data) {
1209 		u8 *decrypted;
1210 		decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1211 					       attr->encr_data_len, attr->iv,
1212 					       &eattr, 0);
1213 		if (decrypted == NULL) {
1214 			return eap_aka_client_error(
1215 				data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1216 		}
1217 		eap_aka_learn_ids(sm, data, &eattr);
1218 		os_free(decrypted);
1219 	}
1220 
1221 	if (data->result_ind && attr->result_ind)
1222 		data->use_result_ind = 1;
1223 
1224 	if (data->state != FAILURE) {
1225 		eap_aka_state(data, data->use_result_ind ?
1226 			      RESULT_SUCCESS : SUCCESS);
1227 	}
1228 
1229 	data->num_id_req = 0;
1230 	data->num_notification = 0;
1231 	/* RFC 4187 specifies that counter is initialized to one after
1232 	 * fullauth, but initializing it to zero makes it easier to implement
1233 	 * reauth verification. */
1234 	data->counter = 0;
1235 	return eap_aka_response_challenge(data, id);
1236 }
1237 
1238 
eap_aka_process_notification_reauth(struct eap_aka_data * data,struct eap_sim_attrs * attr)1239 static int eap_aka_process_notification_reauth(struct eap_aka_data *data,
1240 					       struct eap_sim_attrs *attr)
1241 {
1242 	struct eap_sim_attrs eattr;
1243 	u8 *decrypted;
1244 
1245 	if (attr->encr_data == NULL || attr->iv == NULL) {
1246 		wpa_printf(MSG_WARNING, "EAP-AKA: Notification message after "
1247 			   "reauth did not include encrypted data");
1248 		return -1;
1249 	}
1250 
1251 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1252 				       attr->encr_data_len, attr->iv, &eattr,
1253 				       0);
1254 	if (decrypted == NULL) {
1255 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1256 			   "data from notification message");
1257 		return -1;
1258 	}
1259 
1260 	if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
1261 		wpa_printf(MSG_WARNING, "EAP-AKA: Counter in notification "
1262 			   "message does not match with counter in reauth "
1263 			   "message");
1264 		os_free(decrypted);
1265 		return -1;
1266 	}
1267 
1268 	os_free(decrypted);
1269 	return 0;
1270 }
1271 
1272 
eap_aka_process_notification_auth(struct eap_aka_data * data,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1273 static int eap_aka_process_notification_auth(struct eap_aka_data *data,
1274 					     const struct wpabuf *reqData,
1275 					     struct eap_sim_attrs *attr)
1276 {
1277 	if (attr->mac == NULL) {
1278 		wpa_printf(MSG_INFO, "EAP-AKA: no AT_MAC in after_auth "
1279 			   "Notification message");
1280 		return -1;
1281 	}
1282 
1283 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1284 		wpa_printf(MSG_WARNING, "EAP-AKA: Notification message "
1285 			   "used invalid AT_MAC");
1286 		return -1;
1287 	}
1288 
1289 	if (data->reauth &&
1290 	    eap_aka_process_notification_reauth(data, attr)) {
1291 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid notification "
1292 			   "message after reauth");
1293 		return -1;
1294 	}
1295 
1296 	return 0;
1297 }
1298 
1299 
eap_aka_process_notification(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1300 static struct wpabuf * eap_aka_process_notification(
1301 	struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1302 	const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1303 {
1304 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Notification");
1305 	if (data->num_notification > 0) {
1306 		wpa_printf(MSG_INFO, "EAP-AKA: too many notification "
1307 			   "rounds (only one allowed)");
1308 		return eap_aka_client_error(data, id,
1309 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1310 	}
1311 	data->num_notification++;
1312 	if (attr->notification == -1) {
1313 		wpa_printf(MSG_INFO, "EAP-AKA: no AT_NOTIFICATION in "
1314 			   "Notification message");
1315 		return eap_aka_client_error(data, id,
1316 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1317 	}
1318 
1319 	if ((attr->notification & 0x4000) == 0 &&
1320 	    eap_aka_process_notification_auth(data, reqData, attr)) {
1321 		return eap_aka_client_error(data, id,
1322 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1323 	}
1324 
1325 	eap_sim_report_notification(sm->msg_ctx, attr->notification, 1);
1326 	if (attr->notification >= 0 && attr->notification < 32768) {
1327 		data->error_code = attr->notification;
1328 		eap_aka_state(data, FAILURE);
1329 	} else if (attr->notification == EAP_SIM_SUCCESS &&
1330 		   data->state == RESULT_SUCCESS)
1331 		eap_aka_state(data, SUCCESS);
1332 	return eap_aka_response_notification(data, id, attr->notification);
1333 }
1334 
1335 
eap_aka_process_reauthentication(struct eap_sm * sm,struct eap_aka_data * data,u8 id,const struct wpabuf * reqData,struct eap_sim_attrs * attr)1336 static struct wpabuf * eap_aka_process_reauthentication(
1337 	struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1338 	const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1339 {
1340 	struct eap_sim_attrs eattr;
1341 	u8 *decrypted;
1342 
1343 	wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Reauthentication");
1344 
1345 	if (attr->checkcode &&
1346 	    eap_aka_verify_checkcode(data, attr->checkcode,
1347 				     attr->checkcode_len)) {
1348 #ifdef TEST_FUZZ
1349 		wpa_printf(MSG_INFO,
1350 			   "TEST: Ignore AT_CHECKCODE mismatch for fuzz testing");
1351 #else /* TEST_FUZZ */
1352 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1353 			   "message");
1354 #endif /* TEST_FUZZ */
1355 		return eap_aka_client_error(data, id,
1356 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1357 	}
1358 
1359 	if (data->reauth_id == NULL) {
1360 		wpa_printf(MSG_WARNING, "EAP-AKA: Server is trying "
1361 			   "reauthentication, but no reauth_id available");
1362 		return eap_aka_client_error(data, id,
1363 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1364 	}
1365 
1366 	data->reauth = 1;
1367 	if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1368 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1369 			   "did not have valid AT_MAC");
1370 		return eap_aka_client_error(data, id,
1371 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1372 	}
1373 
1374 	/* At this stage the received MAC has been verified. Use this MAC for
1375 	 * reauth Session-Id calculation if all other checks pass.
1376 	 * The peer does not use the local MAC but the received MAC in deriving
1377 	 * Session-Id. */
1378 	os_memcpy(data->reauth_mac, attr->mac, EAP_SIM_MAC_LEN);
1379 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: Server MAC",
1380 		    data->reauth_mac, EAP_SIM_MAC_LEN);
1381 
1382 	if (attr->encr_data == NULL || attr->iv == NULL) {
1383 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1384 			   "message did not include encrypted data");
1385 		return eap_aka_client_error(data, id,
1386 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1387 	}
1388 
1389 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1390 				       attr->encr_data_len, attr->iv, &eattr,
1391 				       0);
1392 	if (decrypted == NULL) {
1393 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1394 			   "data from reauthentication message");
1395 		return eap_aka_client_error(data, id,
1396 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1397 	}
1398 
1399 	if (eattr.nonce_s == NULL || eattr.counter < 0) {
1400 		wpa_printf(MSG_INFO, "EAP-AKA: (encr) No%s%s in reauth packet",
1401 			   !eattr.nonce_s ? " AT_NONCE_S" : "",
1402 			   eattr.counter < 0 ? " AT_COUNTER" : "");
1403 		os_free(decrypted);
1404 		return eap_aka_client_error(data, id,
1405 					    EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1406 	}
1407 
1408 	if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
1409 		struct wpabuf *res;
1410 		wpa_printf(MSG_INFO, "EAP-AKA: (encr) Invalid counter "
1411 			   "(%d <= %d)", eattr.counter, data->counter);
1412 		data->counter_too_small = eattr.counter;
1413 
1414 		/* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
1415 		 * reauth_id must not be used to start a new reauthentication.
1416 		 */
1417 		eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
1418 
1419 		res = eap_aka_response_reauth(data, id, 1, eattr.nonce_s);
1420 		os_free(decrypted);
1421 
1422 		return res;
1423 	}
1424 	data->counter = eattr.counter;
1425 
1426 	os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
1427 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: (encr) AT_NONCE_S",
1428 		    data->nonce_s, EAP_SIM_NONCE_S_LEN);
1429 
1430 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1431 		eap_aka_prime_derive_keys_reauth(data->k_re, data->counter,
1432 						 data->reauth_id,
1433 						 data->reauth_id_len,
1434 						 data->nonce_s,
1435 						 data->msk, data->emsk);
1436 	} else {
1437 		eap_sim_derive_keys_reauth(data->counter, data->reauth_id,
1438 					   data->reauth_id_len,
1439 					   data->nonce_s, data->mk,
1440 					   data->msk, data->emsk);
1441 	}
1442 	eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
1443 	eap_aka_learn_ids(sm, data, &eattr);
1444 
1445 	if (data->result_ind && attr->result_ind)
1446 		data->use_result_ind = 1;
1447 
1448 	if (data->state != FAILURE) {
1449 		eap_aka_state(data, data->use_result_ind ?
1450 			      RESULT_SUCCESS : SUCCESS);
1451 	}
1452 
1453 	data->num_id_req = 0;
1454 	data->num_notification = 0;
1455 	if (data->counter > EAP_AKA_MAX_FAST_REAUTHS) {
1456 		wpa_printf(MSG_DEBUG, "EAP-AKA: Maximum number of "
1457 			   "fast reauths performed - force fullauth");
1458 		eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
1459 	}
1460 	os_free(decrypted);
1461 	return eap_aka_response_reauth(data, id, 0, data->nonce_s);
1462 }
1463 
1464 
eap_aka_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)1465 static struct wpabuf * eap_aka_process(struct eap_sm *sm, void *priv,
1466 				       struct eap_method_ret *ret,
1467 				       const struct wpabuf *reqData)
1468 {
1469 	struct eap_aka_data *data = priv;
1470 	const struct eap_hdr *req;
1471 	u8 subtype, id;
1472 	struct wpabuf *res;
1473 	const u8 *pos;
1474 	struct eap_sim_attrs attr;
1475 	size_t len;
1476 
1477 	wpa_hexdump_buf(MSG_DEBUG, "EAP-AKA: EAP data", reqData);
1478 	if (eap_get_config_identity(sm, &len) == NULL) {
1479 		wpa_printf(MSG_INFO, "EAP-AKA: Identity not configured");
1480 		eap_sm_request_identity(sm);
1481 		ret->ignore = true;
1482 		return NULL;
1483 	}
1484 
1485 	pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, reqData,
1486 			       &len);
1487 	if (pos == NULL || len < 3) {
1488 		ret->ignore = true;
1489 		return NULL;
1490 	}
1491 	req = wpabuf_head(reqData);
1492 	id = req->identifier;
1493 	len = be_to_host16(req->length);
1494 
1495 	ret->ignore = false;
1496 	ret->methodState = METHOD_MAY_CONT;
1497 	ret->decision = DECISION_FAIL;
1498 	ret->allowNotifications = true;
1499 
1500 	subtype = *pos++;
1501 	wpa_printf(MSG_DEBUG, "EAP-AKA: Subtype=%d", subtype);
1502 	pos += 2; /* Reserved */
1503 
1504 	if (eap_sim_parse_attr(pos, wpabuf_head_u8(reqData) + len, &attr,
1505 			       data->eap_method == EAP_TYPE_AKA_PRIME ? 2 : 1,
1506 			       0)) {
1507 		res = eap_aka_client_error(data, id,
1508 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1509 		goto done;
1510 	}
1511 
1512 	switch (subtype) {
1513 	case EAP_AKA_SUBTYPE_IDENTITY:
1514 		res = eap_aka_process_identity(sm, data, id, reqData, &attr);
1515 		break;
1516 	case EAP_AKA_SUBTYPE_CHALLENGE:
1517 		res = eap_aka_process_challenge(sm, data, id, reqData, &attr);
1518 		break;
1519 	case EAP_AKA_SUBTYPE_NOTIFICATION:
1520 		res = eap_aka_process_notification(sm, data, id, reqData,
1521 						   &attr);
1522 		break;
1523 	case EAP_AKA_SUBTYPE_REAUTHENTICATION:
1524 		res = eap_aka_process_reauthentication(sm, data, id, reqData,
1525 						       &attr);
1526 		break;
1527 	case EAP_AKA_SUBTYPE_CLIENT_ERROR:
1528 		wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Client-Error");
1529 		res = eap_aka_client_error(data, id,
1530 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1531 		break;
1532 	default:
1533 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown subtype=%d", subtype);
1534 		res = eap_aka_client_error(data, id,
1535 					   EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1536 		break;
1537 	}
1538 
1539 done:
1540 	if (data->state == FAILURE) {
1541 		ret->decision = DECISION_FAIL;
1542 		ret->methodState = METHOD_DONE;
1543 	} else if (data->state == SUCCESS) {
1544 		ret->decision = data->use_result_ind ?
1545 			DECISION_UNCOND_SUCC : DECISION_COND_SUCC;
1546 		/*
1547 		 * It is possible for the server to reply with AKA
1548 		 * Notification, so we must allow the method to continue and
1549 		 * not only accept EAP-Success at this point.
1550 		 */
1551 		ret->methodState = data->use_result_ind ?
1552 			METHOD_DONE : METHOD_MAY_CONT;
1553 	} else if (data->state == RESULT_SUCCESS)
1554 		ret->methodState = METHOD_CONT;
1555 
1556 	if (ret->methodState == METHOD_DONE) {
1557 		ret->allowNotifications = false;
1558 	}
1559 
1560 	return res;
1561 }
1562 
1563 
eap_aka_has_reauth_data(struct eap_sm * sm,void * priv)1564 static bool eap_aka_has_reauth_data(struct eap_sm *sm, void *priv)
1565 {
1566 	struct eap_aka_data *data = priv;
1567 	return data->pseudonym || data->reauth_id;
1568 }
1569 
1570 
eap_aka_deinit_for_reauth(struct eap_sm * sm,void * priv)1571 static void eap_aka_deinit_for_reauth(struct eap_sm *sm, void *priv)
1572 {
1573 	struct eap_aka_data *data = priv;
1574 
1575 	os_free(data->mk_identity);
1576 	data->mk_identity = NULL;
1577 	data->mk_identity_len = 0;
1578 	data->prev_id = -1;
1579 	wpabuf_free(data->id_msgs);
1580 	data->id_msgs = NULL;
1581 	data->use_result_ind = 0;
1582 	data->kdf_negotiation = 0;
1583 	eap_aka_clear_keys(data, 1);
1584 }
1585 
1586 
eap_aka_init_for_reauth(struct eap_sm * sm,void * priv)1587 static void * eap_aka_init_for_reauth(struct eap_sm *sm, void *priv)
1588 {
1589 	struct eap_aka_data *data = priv;
1590 
1591 	if (sm->identity) {
1592 		/* Use the EAP-Response/Identity in MK derivation if AT_IDENTITY
1593 		 * is not used. */
1594 		os_free(data->mk_identity);
1595 		data->mk_identity = os_memdup(sm->identity, sm->identity_len);
1596 		data->mk_identity_len = sm->identity_len;
1597 	}
1598 
1599 	data->num_id_req = 0;
1600 	data->num_notification = 0;
1601 	eap_aka_state(data, CONTINUE);
1602 	return priv;
1603 }
1604 
1605 
eap_aka_get_identity(struct eap_sm * sm,void * priv,size_t * len)1606 static const u8 * eap_aka_get_identity(struct eap_sm *sm, void *priv,
1607 				       size_t *len)
1608 {
1609 	struct eap_aka_data *data = priv;
1610 
1611 	if (data->reauth_id) {
1612 		*len = data->reauth_id_len;
1613 		return data->reauth_id;
1614 	}
1615 
1616 	if (data->pseudonym) {
1617 		*len = data->pseudonym_len;
1618 		return data->pseudonym;
1619 	}
1620 
1621 	return NULL;
1622 }
1623 
1624 
eap_aka_isKeyAvailable(struct eap_sm * sm,void * priv)1625 static bool eap_aka_isKeyAvailable(struct eap_sm *sm, void *priv)
1626 {
1627 	struct eap_aka_data *data = priv;
1628 	return data->state == SUCCESS;
1629 }
1630 
1631 
eap_aka_getKey(struct eap_sm * sm,void * priv,size_t * len)1632 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1633 {
1634 	struct eap_aka_data *data = priv;
1635 	u8 *key;
1636 
1637 	if (data->state != SUCCESS)
1638 		return NULL;
1639 
1640 	key = os_memdup(data->msk, EAP_SIM_KEYING_DATA_LEN);
1641 	if (key == NULL)
1642 		return NULL;
1643 
1644 	*len = EAP_SIM_KEYING_DATA_LEN;
1645 
1646 	return key;
1647 }
1648 
1649 
eap_aka_get_session_id(struct eap_sm * sm,void * priv,size_t * len)1650 static u8 * eap_aka_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1651 {
1652 	struct eap_aka_data *data = priv;
1653 	u8 *id;
1654 
1655 	if (data->state != SUCCESS)
1656 		return NULL;
1657 
1658 	if (!data->reauth)
1659 		*len = 1 + EAP_AKA_RAND_LEN + EAP_AKA_AUTN_LEN;
1660 	else
1661 		*len = 1 + EAP_SIM_NONCE_S_LEN + EAP_SIM_MAC_LEN;
1662 	id = os_malloc(*len);
1663 	if (id == NULL)
1664 		return NULL;
1665 
1666 	id[0] = data->eap_method;
1667 	if (!data->reauth) {
1668 		os_memcpy(id + 1, data->rand, EAP_AKA_RAND_LEN);
1669 		os_memcpy(id + 1 + EAP_AKA_RAND_LEN, data->autn,
1670 			  EAP_AKA_AUTN_LEN);
1671 	} else {
1672 		os_memcpy(id + 1, data->nonce_s, EAP_SIM_NONCE_S_LEN);
1673 		os_memcpy(id + 1 + EAP_SIM_NONCE_S_LEN, data->reauth_mac,
1674 			  EAP_SIM_MAC_LEN);
1675 	}
1676 	wpa_hexdump(MSG_DEBUG, "EAP-AKA: Derived Session-Id", id, *len);
1677 
1678 	return id;
1679 }
1680 
1681 
eap_aka_get_emsk(struct eap_sm * sm,void * priv,size_t * len)1682 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1683 {
1684 	struct eap_aka_data *data = priv;
1685 	u8 *key;
1686 
1687 	if (data->state != SUCCESS)
1688 		return NULL;
1689 
1690 	key = os_memdup(data->emsk, EAP_EMSK_LEN);
1691 	if (key == NULL)
1692 		return NULL;
1693 
1694 	*len = EAP_EMSK_LEN;
1695 
1696 	return key;
1697 }
1698 
1699 
eap_aka_get_error_code(void * priv)1700 static int eap_aka_get_error_code(void *priv)
1701 {
1702 	struct eap_aka_data *data = priv;
1703 	int current_data_error;
1704 
1705 	if (!data)
1706 		return NO_EAP_METHOD_ERROR;
1707 
1708 	current_data_error = data->error_code;
1709 
1710 	/* Now reset for next transaction */
1711 	data->error_code = NO_EAP_METHOD_ERROR;
1712 
1713 	return current_data_error;
1714 }
1715 
1716 
eap_peer_aka_register(void)1717 int eap_peer_aka_register(void)
1718 {
1719 	struct eap_method *eap;
1720 
1721 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1722 				    EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1723 	if (eap == NULL)
1724 		return -1;
1725 
1726 	eap->init = eap_aka_init;
1727 	eap->deinit = eap_aka_deinit;
1728 	eap->process = eap_aka_process;
1729 	eap->isKeyAvailable = eap_aka_isKeyAvailable;
1730 	eap->getKey = eap_aka_getKey;
1731 	eap->getSessionId = eap_aka_get_session_id;
1732 	eap->has_reauth_data = eap_aka_has_reauth_data;
1733 	eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1734 	eap->init_for_reauth = eap_aka_init_for_reauth;
1735 	eap->get_identity = eap_aka_get_identity;
1736 	eap->get_emsk = eap_aka_get_emsk;
1737 	eap->get_error_code = eap_aka_get_error_code;
1738 
1739 	return eap_peer_method_register(eap);
1740 }
1741 
1742 
1743 #ifdef EAP_AKA_PRIME
eap_peer_aka_prime_register(void)1744 int eap_peer_aka_prime_register(void)
1745 {
1746 	struct eap_method *eap;
1747 
1748 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1749 				    EAP_VENDOR_IETF, EAP_TYPE_AKA_PRIME,
1750 				    "AKA'");
1751 	if (eap == NULL)
1752 		return -1;
1753 
1754 	eap->init = eap_aka_prime_init;
1755 	eap->deinit = eap_aka_deinit;
1756 	eap->process = eap_aka_process;
1757 	eap->isKeyAvailable = eap_aka_isKeyAvailable;
1758 	eap->getKey = eap_aka_getKey;
1759 	eap->getSessionId = eap_aka_get_session_id;
1760 	eap->has_reauth_data = eap_aka_has_reauth_data;
1761 	eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1762 	eap->init_for_reauth = eap_aka_init_for_reauth;
1763 	eap->get_identity = eap_aka_get_identity;
1764 	eap->get_emsk = eap_aka_get_emsk;
1765 	eap->get_error_code = eap_aka_get_error_code;
1766 
1767 	return eap_peer_method_register(eap);
1768 }
1769 #endif /* EAP_AKA_PRIME */
1770