?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Expand PMF_FN_* macros.
[netbsd-mini2440.git] / dist / wpa / src / eap_common / eap_sim_common.c
blob02d20caf4ef2e1cee0fe20ec8784559660138fe7
1 /*
2 * EAP peer/server: EAP-SIM/AKA shared routines
3 * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "eap_common/eap_defs.h"
19 #include "sha1.h"
20 #include "crypto.h"
21 #include "aes_wrap.h"
22 #include "wpabuf.h"
23 #include "eap_common/eap_sim_common.h"
24
25
26 static int eap_sim_prf(const u8 *key, u8 *x, size_t xlen)
27 {
28 return fips186_2_prf(key, EAP_SIM_MK_LEN, x, xlen);
29 }
30
31
32 void eap_sim_derive_mk(const u8 *identity, size_t identity_len,
33 const u8 *nonce_mt, u16 selected_version,
34 const u8 *ver_list, size_t ver_list_len,
35 int num_chal, const u8 *kc, u8 *mk)
36 {
37 u8 sel_ver[2];
38 const unsigned char *addr[5];
39 size_t len[5];
40
41 addr[0] = identity;
42 len[0] = identity_len;
43 addr[1] = kc;
44 len[1] = num_chal * EAP_SIM_KC_LEN;
45 addr[2] = nonce_mt;
46 len[2] = EAP_SIM_NONCE_MT_LEN;
47 addr[3] = ver_list;
48 len[3] = ver_list_len;
49 addr[4] = sel_ver;
50 len[4] = 2;
51
52 WPA_PUT_BE16(sel_ver, selected_version);
53
54 /* MK = SHA1(Identity|n*Kc|NONCE_MT|Version List|Selected Version) */
55 sha1_vector(5, addr, len, mk);
56 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: MK", mk, EAP_SIM_MK_LEN);
57 }
58
59
60 void eap_aka_derive_mk(const u8 *identity, size_t identity_len,
61 const u8 *ik, const u8 *ck, u8 *mk)
62 {
63 const u8 *addr[3];
64 size_t len[3];
65
66 addr[0] = identity;
67 len[0] = identity_len;
68 addr[1] = ik;
69 len[1] = EAP_AKA_IK_LEN;
70 addr[2] = ck;
71 len[2] = EAP_AKA_CK_LEN;
72
73 /* MK = SHA1(Identity|IK|CK) */
74 sha1_vector(3, addr, len, mk);
75 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", ik, EAP_AKA_IK_LEN);
76 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", ck, EAP_AKA_CK_LEN);
77 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: MK", mk, EAP_SIM_MK_LEN);
78 }
79
80
81 int eap_sim_derive_keys(const u8 *mk, u8 *k_encr, u8 *k_aut, u8 *msk, u8 *emsk)
82 {
83 u8 buf[EAP_SIM_K_ENCR_LEN + EAP_SIM_K_AUT_LEN +
84 EAP_SIM_KEYING_DATA_LEN + EAP_EMSK_LEN], *pos;
85 if (eap_sim_prf(mk, buf, sizeof(buf)) < 0) {
86 wpa_printf(MSG_ERROR, "EAP-SIM: Failed to derive keys");
87 return -1;
88 }
89 pos = buf;
90 os_memcpy(k_encr, pos, EAP_SIM_K_ENCR_LEN);
91 pos += EAP_SIM_K_ENCR_LEN;
92 os_memcpy(k_aut, pos, EAP_SIM_K_AUT_LEN);
93 pos += EAP_SIM_K_AUT_LEN;
94 os_memcpy(msk, pos, EAP_SIM_KEYING_DATA_LEN);
95 pos += EAP_SIM_KEYING_DATA_LEN;
96 os_memcpy(emsk, pos, EAP_EMSK_LEN);
97
98 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: K_encr",
99 k_encr, EAP_SIM_K_ENCR_LEN);
100 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: K_aut",
101 k_aut, EAP_SIM_K_AUT_LEN);
102 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: keying material (MSK)",
103 msk, EAP_SIM_KEYING_DATA_LEN);
104 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: EMSK", emsk, EAP_EMSK_LEN);
105 os_memset(buf, 0, sizeof(buf));
106
107 return 0;
108 }
109
110
111 int eap_sim_derive_keys_reauth(u16 _counter,
112 const u8 *identity, size_t identity_len,
113 const u8 *nonce_s, const u8 *mk, u8 *msk,
114 u8 *emsk)
115 {
116 u8 xkey[SHA1_MAC_LEN];
117 u8 buf[EAP_SIM_KEYING_DATA_LEN + EAP_EMSK_LEN + 32];
118 u8 counter[2];
119 const u8 *addr[4];
120 size_t len[4];
121
122 while (identity_len > 0 && identity[identity_len - 1] == 0) {
123 wpa_printf(MSG_DEBUG, "EAP-SIM: Workaround - drop null "
124 "character from the end of identity");
125 identity_len--;
126 }
127 addr[0] = identity;
128 len[0] = identity_len;
129 addr[1] = counter;
130 len[1] = 2;
131 addr[2] = nonce_s;
132 len[2] = EAP_SIM_NONCE_S_LEN;
133 addr[3] = mk;
134 len[3] = EAP_SIM_MK_LEN;
135
136 WPA_PUT_BE16(counter, _counter);
137
138 wpa_printf(MSG_DEBUG, "EAP-SIM: Deriving keying data from reauth");
139 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM: Identity",
140 identity, identity_len);
141 wpa_hexdump(MSG_DEBUG, "EAP-SIM: counter", counter, 2);
142 wpa_hexdump(MSG_DEBUG, "EAP-SIM: NONCE_S", nonce_s,
143 EAP_SIM_NONCE_S_LEN);
144 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: MK", mk, EAP_SIM_MK_LEN);
145
146 /* XKEY' = SHA1(Identity|counter|NONCE_S|MK) */
147 sha1_vector(4, addr, len, xkey);
148 wpa_hexdump(MSG_DEBUG, "EAP-SIM: XKEY'", xkey, SHA1_MAC_LEN);
149
150 if (eap_sim_prf(xkey, buf, sizeof(buf)) < 0) {
151 wpa_printf(MSG_ERROR, "EAP-SIM: Failed to derive keys");
152 return -1;
153 }
154 if (msk) {
155 os_memcpy(msk, buf, EAP_SIM_KEYING_DATA_LEN);
156 wpa_hexdump(MSG_DEBUG, "EAP-SIM: keying material (MSK)",
157 msk, EAP_SIM_KEYING_DATA_LEN);
158 }
159 if (emsk) {
160 os_memcpy(emsk, buf + EAP_SIM_KEYING_DATA_LEN, EAP_EMSK_LEN);
161 wpa_hexdump(MSG_DEBUG, "EAP-SIM: EMSK", emsk, EAP_EMSK_LEN);
162 }
163 os_memset(buf, 0, sizeof(buf));
164
165 return 0;
166 }
167
168
169 int eap_sim_verify_mac(const u8 *k_aut, const struct wpabuf *req,
170 const u8 *mac, const u8 *extra, size_t extra_len)
171 {
172 unsigned char hmac[SHA1_MAC_LEN];
173 const u8 *addr[2];
174 size_t len[2];
175 u8 *tmp;
176
177 if (mac == NULL || wpabuf_len(req) < EAP_SIM_MAC_LEN ||
178 mac < wpabuf_head_u8(req) ||
179 mac > wpabuf_head_u8(req) + wpabuf_len(req) - EAP_SIM_MAC_LEN)
180 return -1;
181
182 tmp = os_malloc(wpabuf_len(req));
183 if (tmp == NULL)
184 return -1;
185
186 addr[0] = tmp;
187 len[0] = wpabuf_len(req);
188 addr[1] = extra;
189 len[1] = extra_len;
190
191 /* HMAC-SHA1-128 */
192 os_memcpy(tmp, wpabuf_head(req), wpabuf_len(req));
193 os_memset(tmp + (mac - wpabuf_head_u8(req)), 0, EAP_SIM_MAC_LEN);
194 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC - msg",
195 tmp, wpabuf_len(req));
196 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC - extra data",
197 extra, extra_len);
198 wpa_hexdump_key(MSG_MSGDUMP, "EAP-SIM: Verify MAC - K_aut",
199 k_aut, EAP_SIM_K_AUT_LEN);
200 hmac_sha1_vector(k_aut, EAP_SIM_K_AUT_LEN, 2, addr, len, hmac);
201 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC: MAC",
202 hmac, EAP_SIM_MAC_LEN);
203 os_free(tmp);
204
205 return (os_memcmp(hmac, mac, EAP_SIM_MAC_LEN) == 0) ? 0 : 1;
206 }
207
208
209 void eap_sim_add_mac(const u8 *k_aut, const u8 *msg, size_t msg_len, u8 *mac,
210 const u8 *extra, size_t extra_len)
211 {
212 unsigned char hmac[SHA1_MAC_LEN];
213 const u8 *addr[2];
214 size_t len[2];
215
216 addr[0] = msg;
217 len[0] = msg_len;
218 addr[1] = extra;
219 len[1] = extra_len;
220
221 /* HMAC-SHA1-128 */
222 os_memset(mac, 0, EAP_SIM_MAC_LEN);
223 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC - msg", msg, msg_len);
224 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC - extra data",
225 extra, extra_len);
226 wpa_hexdump_key(MSG_MSGDUMP, "EAP-SIM: Add MAC - K_aut",
227 k_aut, EAP_SIM_K_AUT_LEN);
228 hmac_sha1_vector(k_aut, EAP_SIM_K_AUT_LEN, 2, addr, len, hmac);
229 os_memcpy(mac, hmac, EAP_SIM_MAC_LEN);
230 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC: MAC",
231 mac, EAP_SIM_MAC_LEN);
232 }
233
234
235 int eap_sim_parse_attr(const u8 *start, const u8 *end,
236 struct eap_sim_attrs *attr, int aka, int encr)
237 {
238 const u8 *pos = start, *apos;
239 size_t alen, plen, i, list_len;
240
241 os_memset(attr, 0, sizeof(*attr));
242 attr->id_req = NO_ID_REQ;
243 attr->notification = -1;
244 attr->counter = -1;
245 attr->selected_version = -1;
246 attr->client_error_code = -1;
247
248 while (pos < end) {
249 if (pos + 2 > end) {
250 wpa_printf(MSG_INFO, "EAP-SIM: Attribute overflow(1)");
251 return -1;
252 }
253 wpa_printf(MSG_MSGDUMP, "EAP-SIM: Attribute: Type=%d Len=%d",
254 pos[0], pos[1] * 4);
255 if (pos + pos[1] * 4 > end) {
256 wpa_printf(MSG_INFO, "EAP-SIM: Attribute overflow "
257 "(pos=%p len=%d end=%p)",
258 pos, pos[1] * 4, end);
259 return -1;
260 }
261 if (pos[1] == 0) {
262 wpa_printf(MSG_INFO, "EAP-SIM: Attribute underflow");
263 return -1;
264 }
265 apos = pos + 2;
266 alen = pos[1] * 4 - 2;
267 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Attribute data",
268 apos, alen);
269
270 switch (pos[0]) {
271 case EAP_SIM_AT_RAND:
272 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RAND");
273 apos += 2;
274 alen -= 2;
275 if ((!aka && (alen % GSM_RAND_LEN)) ||
276 (aka && alen != EAP_AKA_RAND_LEN)) {
277 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_RAND"
278 " (len %lu)",
279 (unsigned long) alen);
280 return -1;
281 }
282 attr->rand = apos;
283 attr->num_chal = alen / GSM_RAND_LEN;
284 break;
285 case EAP_SIM_AT_AUTN:
286 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_AUTN");
287 if (!aka) {
288 wpa_printf(MSG_DEBUG, "EAP-SIM: "
289 "Unexpected AT_AUTN");
290 return -1;
291 }
292 apos += 2;
293 alen -= 2;
294 if (alen != EAP_AKA_AUTN_LEN) {
295 wpa_printf(MSG_INFO, "EAP-AKA: Invalid AT_AUTN"
296 " (len %lu)",
297 (unsigned long) alen);
298 return -1;
299 }
300 attr->autn = apos;
301 break;
302 case EAP_SIM_AT_PADDING:
303 if (!encr) {
304 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
305 "AT_PADDING");
306 return -1;
307 }
308 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) AT_PADDING");
309 for (i = 2; i < alen; i++) {
310 if (apos[i] != 0) {
311 wpa_printf(MSG_INFO, "EAP-SIM: (encr) "
312 "AT_PADDING used a non-zero"
313 " padding byte");
314 wpa_hexdump(MSG_DEBUG, "EAP-SIM: "
315 "(encr) padding bytes",
316 apos + 2, alen - 2);
317 return -1;
318 }
319 }
320 break;
321 case EAP_SIM_AT_NONCE_MT:
322 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_NONCE_MT");
323 if (alen != 2 + EAP_SIM_NONCE_MT_LEN) {
324 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
325 "AT_NONCE_MT length");
326 return -1;
327 }
328 attr->nonce_mt = apos + 2;
329 break;
330 case EAP_SIM_AT_PERMANENT_ID_REQ:
331 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_PERMANENT_ID_REQ");
332 attr->id_req = PERMANENT_ID;
333 break;
334 case EAP_SIM_AT_MAC:
335 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_MAC");
336 if (alen != 2 + EAP_SIM_MAC_LEN) {
337 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_MAC "
338 "length");
339 return -1;
340 }
341 attr->mac = apos + 2;
342 break;
343 case EAP_SIM_AT_NOTIFICATION:
344 if (alen != 2) {
345 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
346 "AT_NOTIFICATION length %lu",
347 (unsigned long) alen);
348 return -1;
349 }
350 attr->notification = apos[0] * 256 + apos[1];
351 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_NOTIFICATION %d",
352 attr->notification);
353 break;
354 case EAP_SIM_AT_ANY_ID_REQ:
355 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_ANY_ID_REQ");
356 attr->id_req = ANY_ID;
357 break;
358 case EAP_SIM_AT_IDENTITY:
359 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_IDENTITY");
360 attr->identity = apos + 2;
361 attr->identity_len = alen - 2;
362 break;
363 case EAP_SIM_AT_VERSION_LIST:
364 if (aka) {
365 wpa_printf(MSG_DEBUG, "EAP-AKA: "
366 "Unexpected AT_VERSION_LIST");
367 return -1;
368 }
369 list_len = apos[0] * 256 + apos[1];
370 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_VERSION_LIST");
371 if (list_len < 2 || list_len > alen - 2) {
372 wpa_printf(MSG_WARNING, "EAP-SIM: Invalid "
373 "AT_VERSION_LIST (list_len=%lu "
374 "attr_len=%lu)",
375 (unsigned long) list_len,
376 (unsigned long) alen);
377 return -1;
378 }
379 attr->version_list = apos + 2;
380 attr->version_list_len = list_len;
381 break;
382 case EAP_SIM_AT_SELECTED_VERSION:
383 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_SELECTED_VERSION");
384 if (alen != 2) {
385 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
386 "AT_SELECTED_VERSION length %lu",
387 (unsigned long) alen);
388 return -1;
389 }
390 attr->selected_version = apos[0] * 256 + apos[1];
391 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_SELECTED_VERSION "
392 "%d", attr->selected_version);
393 break;
394 case EAP_SIM_AT_FULLAUTH_ID_REQ:
395 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_FULLAUTH_ID_REQ");
396 attr->id_req = FULLAUTH_ID;
397 break;
398 case EAP_SIM_AT_COUNTER:
399 if (!encr) {
400 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
401 "AT_COUNTER");
402 return -1;
403 }
404 if (alen != 2) {
405 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
406 "AT_COUNTER (alen=%lu)",
407 (unsigned long) alen);
408 return -1;
409 }
410 attr->counter = apos[0] * 256 + apos[1];
411 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) AT_COUNTER %d",
412 attr->counter);
413 break;
414 case EAP_SIM_AT_COUNTER_TOO_SMALL:
415 if (!encr) {
416 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
417 "AT_COUNTER_TOO_SMALL");
418 return -1;
419 }
420 if (alen != 2) {
421 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
422 "AT_COUNTER_TOO_SMALL (alen=%lu)",
423 (unsigned long) alen);
424 return -1;
425 }
426 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
427 "AT_COUNTER_TOO_SMALL");
428 attr->counter_too_small = 1;
429 break;
430 case EAP_SIM_AT_NONCE_S:
431 if (!encr) {
432 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
433 "AT_NONCE_S");
434 return -1;
435 }
436 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
437 "AT_NONCE_S");
438 if (alen != 2 + EAP_SIM_NONCE_S_LEN) {
439 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
440 "AT_NONCE_S (alen=%lu)",
441 (unsigned long) alen);
442 return -1;
443 }
444 attr->nonce_s = apos + 2;
445 break;
446 case EAP_SIM_AT_CLIENT_ERROR_CODE:
447 if (alen != 2) {
448 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
449 "AT_CLIENT_ERROR_CODE length %lu",
450 (unsigned long) alen);
451 return -1;
452 }
453 attr->client_error_code = apos[0] * 256 + apos[1];
454 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_CLIENT_ERROR_CODE "
455 "%d", attr->client_error_code);
456 break;
457 case EAP_SIM_AT_IV:
458 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_IV");
459 if (alen != 2 + EAP_SIM_MAC_LEN) {
460 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_IV "
461 "length %lu", (unsigned long) alen);
462 return -1;
463 }
464 attr->iv = apos + 2;
465 break;
466 case EAP_SIM_AT_ENCR_DATA:
467 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_ENCR_DATA");
468 attr->encr_data = apos + 2;
469 attr->encr_data_len = alen - 2;
470 if (attr->encr_data_len % 16) {
471 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
472 "AT_ENCR_DATA length %lu",
473 (unsigned long)
474 attr->encr_data_len);
475 return -1;
476 }
477 break;
478 case EAP_SIM_AT_NEXT_PSEUDONYM:
479 if (!encr) {
480 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
481 "AT_NEXT_PSEUDONYM");
482 return -1;
483 }
484 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
485 "AT_NEXT_PSEUDONYM");
486 plen = apos[0] * 256 + apos[1];
487 if (plen > alen - 2) {
488 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid"
489 " AT_NEXT_PSEUDONYM (actual"
490 " len %lu, attr len %lu)",
491 (unsigned long) plen,
492 (unsigned long) alen);
493 return -1;
494 }
495 attr->next_pseudonym = pos + 4;
496 attr->next_pseudonym_len = plen;
497 break;
498 case EAP_SIM_AT_NEXT_REAUTH_ID:
499 if (!encr) {
500 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
501 "AT_NEXT_REAUTH_ID");
502 return -1;
503 }
504 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
505 "AT_NEXT_REAUTH_ID");
506 plen = apos[0] * 256 + apos[1];
507 if (plen > alen - 2) {
508 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid"
509 " AT_NEXT_REAUTH_ID (actual"
510 " len %lu, attr len %lu)",
511 (unsigned long) plen,
512 (unsigned long) alen);
513 return -1;
514 }
515 attr->next_reauth_id = pos + 4;
516 attr->next_reauth_id_len = plen;
517 break;
518 case EAP_SIM_AT_RES:
519 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RES");
520 apos += 2;
521 alen -= 2;
522 if (!aka || alen < EAP_AKA_MIN_RES_LEN ||
523 alen > EAP_AKA_MAX_RES_LEN) {
524 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_RES "
525 "(len %lu)",
526 (unsigned long) alen);
527 return -1;
528 }
529 attr->res = apos;
530 attr->res_len = alen;
531 break;
532 case EAP_SIM_AT_AUTS:
533 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_AUTS");
534 if (!aka) {
535 wpa_printf(MSG_DEBUG, "EAP-SIM: "
536 "Unexpected AT_AUTS");
537 return -1;
538 }
539 if (alen != EAP_AKA_AUTS_LEN) {
540 wpa_printf(MSG_INFO, "EAP-AKA: Invalid AT_AUTS"
541 " (len %lu)",
542 (unsigned long) alen);
543 return -1;
544 }
545 attr->auts = apos;
546 break;
547 case EAP_SIM_AT_CHECKCODE:
548 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_CHECKCODE");
549 if (!aka) {
550 wpa_printf(MSG_DEBUG, "EAP-SIM: "
551 "Unexpected AT_CHECKCODE");
552 return -1;
553 }
554 apos += 2;
555 alen -= 2;
556 if (alen != 0 && alen != EAP_AKA_CHECKCODE_LEN) {
557 wpa_printf(MSG_INFO, "EAP-AKA: Invalid "
558 "AT_CHECKCODE (len %lu)",
559 (unsigned long) alen);
560 return -1;
561 }
562 attr->checkcode = apos;
563 attr->checkcode_len = alen;
564 break;
565 case EAP_SIM_AT_RESULT_IND:
566 if (encr) {
567 wpa_printf(MSG_ERROR, "EAP-SIM: Encrypted "
568 "AT_RESULT_IND");
569 return -1;
570 }
571 if (alen != 2) {
572 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
573 "AT_RESULT_IND (alen=%lu)",
574 (unsigned long) alen);
575 return -1;
576 }
577 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RESULT_IND");
578 attr->result_ind = 1;
579 break;
580 default:
581 if (pos[0] < 128) {
582 wpa_printf(MSG_INFO, "EAP-SIM: Unrecognized "
583 "non-skippable attribute %d",
584 pos[0]);
585 return -1;
586 }
587
588 wpa_printf(MSG_DEBUG, "EAP-SIM: Unrecognized skippable"
589 " attribute %d ignored", pos[0]);
590 break;
591 }
592
593 pos += pos[1] * 4;
594 }
595
596 wpa_printf(MSG_DEBUG, "EAP-SIM: Attributes parsed successfully "
597 "(aka=%d encr=%d)", aka, encr);
598
599 return 0;
600 }
601
602
603 u8 * eap_sim_parse_encr(const u8 *k_encr, const u8 *encr_data,
604 size_t encr_data_len, const u8 *iv,
605 struct eap_sim_attrs *attr, int aka)
606 {
607 u8 *decrypted;
608
609 if (!iv) {
610 wpa_printf(MSG_INFO, "EAP-SIM: Encrypted data, but no IV");
611 return NULL;
612 }
613
614 decrypted = os_malloc(encr_data_len);
615 if (decrypted == NULL)
616 return NULL;
617 os_memcpy(decrypted, encr_data, encr_data_len);
618
619 if (aes_128_cbc_decrypt(k_encr, iv, decrypted, encr_data_len)) {
620 os_free(decrypted);
621 return NULL;
622 }
623 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Decrypted AT_ENCR_DATA",
624 decrypted, encr_data_len);
625
626 if (eap_sim_parse_attr(decrypted, decrypted + encr_data_len, attr,
627 aka, 1)) {
628 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Failed to parse "
629 "decrypted AT_ENCR_DATA");
630 os_free(decrypted);
631 return NULL;
632 }
633
634 return decrypted;
635 }
636
637
638 #define EAP_SIM_INIT_LEN 128
639
640 struct eap_sim_msg {
641 struct wpabuf *buf;
642 size_t mac, iv, encr; /* index from buf */
643 };
644
645
646 struct eap_sim_msg * eap_sim_msg_init(int code, int id, int type, int subtype)
647 {
648 struct eap_sim_msg *msg;
649 struct eap_hdr *eap;
650 u8 *pos;
651
652 msg = os_zalloc(sizeof(*msg));
653 if (msg == NULL)
654 return NULL;
655
656 msg->buf = wpabuf_alloc(EAP_SIM_INIT_LEN);
657 if (msg->buf == NULL) {
658 os_free(msg);
659 return NULL;
660 }
661 eap = wpabuf_put(msg->buf, sizeof(*eap));
662 eap->code = code;
663 eap->identifier = id;
664
665 pos = wpabuf_put(msg->buf, 4);
666 *pos++ = type;
667 *pos++ = subtype;
668 *pos++ = 0; /* Reserved */
669 *pos++ = 0; /* Reserved */
670
671 return msg;
672 }
673
674
675 struct wpabuf * eap_sim_msg_finish(struct eap_sim_msg *msg, const u8 *k_aut,
676 const u8 *extra, size_t extra_len)
677 {
678 struct eap_hdr *eap;
679 struct wpabuf *buf;
680
681 if (msg == NULL)
682 return NULL;
683
684 eap = wpabuf_mhead(msg->buf);
685 eap->length = host_to_be16(wpabuf_len(msg->buf));
686
687 if (k_aut && msg->mac) {
688 eap_sim_add_mac(k_aut, (u8 *) wpabuf_head(msg->buf),
689 wpabuf_len(msg->buf),
690 (u8 *) wpabuf_mhead(msg->buf) + msg->mac,
691 extra, extra_len);
692 }
693
694 buf = msg->buf;
695 os_free(msg);
696 return buf;
697 }
698
699
700 void eap_sim_msg_free(struct eap_sim_msg *msg)
701 {
702 if (msg) {
703 wpabuf_free(msg->buf);
704 os_free(msg);
705 }
706 }
707
708
709 u8 * eap_sim_msg_add_full(struct eap_sim_msg *msg, u8 attr,
710 const u8 *data, size_t len)
711 {
712 int attr_len = 2 + len;
713 int pad_len;
714 u8 *start;
715
716 if (msg == NULL)
717 return NULL;
718
719 pad_len = (4 - attr_len % 4) % 4;
720 attr_len += pad_len;
721 if (wpabuf_resize(&msg->buf, attr_len))
722 return NULL;
723 start = wpabuf_put(msg->buf, 0);
724 wpabuf_put_u8(msg->buf, attr);
725 wpabuf_put_u8(msg->buf, attr_len / 4);
726 wpabuf_put_data(msg->buf, data, len);
727 if (pad_len)
728 os_memset(wpabuf_put(msg->buf, pad_len), 0, pad_len);
729 return start;
730 }
731
732
733 u8 * eap_sim_msg_add(struct eap_sim_msg *msg, u8 attr, u16 value,
734 const u8 *data, size_t len)
735 {
736 int attr_len = 4 + len;
737 int pad_len;
738 u8 *start;
739
740 if (msg == NULL)
741 return NULL;
742
743 pad_len = (4 - attr_len % 4) % 4;
744 attr_len += pad_len;
745 if (wpabuf_resize(&msg->buf, attr_len))
746 return NULL;
747 start = wpabuf_put(msg->buf, 0);
748 wpabuf_put_u8(msg->buf, attr);
749 wpabuf_put_u8(msg->buf, attr_len / 4);
750 wpabuf_put_be16(msg->buf, value);
751 if (data)
752 wpabuf_put_data(msg->buf, data, len);
753 else
754 wpabuf_put(msg->buf, len);
755 if (pad_len)
756 os_memset(wpabuf_put(msg->buf, pad_len), 0, pad_len);
757 return start;
758 }
759
760
761 u8 * eap_sim_msg_add_mac(struct eap_sim_msg *msg, u8 attr)
762 {
763 u8 *pos = eap_sim_msg_add(msg, attr, 0, NULL, EAP_SIM_MAC_LEN);
764 if (pos)
765 msg->mac = (pos - wpabuf_head_u8(msg->buf)) + 4;
766 return pos;
767 }
768
769
770 int eap_sim_msg_add_encr_start(struct eap_sim_msg *msg, u8 attr_iv,
771 u8 attr_encr)
772 {
773 u8 *pos = eap_sim_msg_add(msg, attr_iv, 0, NULL, EAP_SIM_IV_LEN);
774 if (pos == NULL)
775 return -1;
776 msg->iv = (pos - wpabuf_head_u8(msg->buf)) + 4;
777 if (os_get_random(wpabuf_mhead_u8(msg->buf) + msg->iv,
778 EAP_SIM_IV_LEN)) {
779 msg->iv = 0;
780 return -1;
781 }
782
783 pos = eap_sim_msg_add(msg, attr_encr, 0, NULL, 0);
784 if (pos == NULL) {
785 msg->iv = 0;
786 return -1;
787 }
788 msg->encr = pos - wpabuf_head_u8(msg->buf);
789
790 return 0;
791 }
792
793
794 int eap_sim_msg_add_encr_end(struct eap_sim_msg *msg, u8 *k_encr, int attr_pad)
795 {
796 size_t encr_len;
797
798 if (msg == NULL || k_encr == NULL || msg->iv == 0 || msg->encr == 0)
799 return -1;
800
801 encr_len = wpabuf_len(msg->buf) - msg->encr - 4;
802 if (encr_len % 16) {
803 u8 *pos;
804 int pad_len = 16 - (encr_len % 16);
805 if (pad_len < 4) {
806 wpa_printf(MSG_WARNING, "EAP-SIM: "
807 "eap_sim_msg_add_encr_end - invalid pad_len"
808 " %d", pad_len);
809 return -1;
810 }
811 wpa_printf(MSG_DEBUG, " *AT_PADDING");
812 pos = eap_sim_msg_add(msg, attr_pad, 0, NULL, pad_len - 4);
813 if (pos == NULL)
814 return -1;
815 os_memset(pos + 4, 0, pad_len - 4);
816 encr_len += pad_len;
817 }
818 wpa_printf(MSG_DEBUG, " (AT_ENCR_DATA data len %lu)",
819 (unsigned long) encr_len);
820 wpabuf_mhead_u8(msg->buf)[msg->encr + 1] = encr_len / 4 + 1;
821 return aes_128_cbc_encrypt(k_encr, wpabuf_head_u8(msg->buf) + msg->iv,
822 wpabuf_mhead_u8(msg->buf) + msg->encr + 4,
823 encr_len);
824 }
825
826
827 void eap_sim_report_notification(void *msg_ctx, int notification, int aka)
828 {
829 #ifndef CONFIG_NO_STDOUT_DEBUG
830 const char *type = aka ? "AKA" : "SIM";
831 #endif /* CONFIG_NO_STDOUT_DEBUG */
832
833 switch (notification) {
834 case EAP_SIM_GENERAL_FAILURE_AFTER_AUTH:
835 wpa_printf(MSG_WARNING, "EAP-%s: General failure "
836 "notification (after authentication)", type);
837 break;
838 case EAP_SIM_TEMPORARILY_DENIED:
839 wpa_printf(MSG_WARNING, "EAP-%s: Failure notification: "
840 "User has been temporarily denied access to the "
841 "requested service", type);
842 break;
843 case EAP_SIM_NOT_SUBSCRIBED:
844 wpa_printf(MSG_WARNING, "EAP-%s: Failure notification: "
845 "User has not subscribed to the requested service",
846 type);
847 break;
848 case EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH:
849 wpa_printf(MSG_WARNING, "EAP-%s: General failure "
850 "notification (before authentication)", type);
851 break;
852 case EAP_SIM_SUCCESS:
853 wpa_printf(MSG_INFO, "EAP-%s: Successful authentication "
854 "notification", type);
855 break;
856 default:
857 if (notification >= 32768) {
858 wpa_printf(MSG_INFO, "EAP-%s: Unrecognized "
859 "non-failure notification %d",
860 type, notification);
861 } else {
862 wpa_printf(MSG_WARNING, "EAP-%s: Unrecognized "
863 "failure notification %d",
864 type, notification);
865 }
866 }
867 }
NetBSD on the FriendlyARM MINI2440