contrib/wpa_supplicant/pcsc_funcs.c

   1 /*
   2  * WPA Supplicant / PC/SC smartcard interface for USIM, GSM SIM
   3  * Copyright (c) 2004-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include <stdlib.h>
  16 #include <stdio.h>
  17 #include <string.h>
  18 #include <winscard.h>
  19
  20 #include "common.h"
  21 #include "wpa_supplicant.h"
  22 #include "pcsc_funcs.h"
  23
  24
  25 /* See ETSI GSM 11.11 and ETSI TS 102 221 for details.
  26  * SIM commands:
  27  * Command APDU: CLA INS P1 P2 P3 Data
  28  *   CLA (class of instruction): A0 for GSM, 00 for USIM
  29  *   INS (instruction)
  30  *   P1 P2 P3 (parameters, P3 = length of Data)
  31  * Response APDU: Data SW1 SW2
  32  *   SW1 SW2 (Status words)
  33  * Commands (INS P1 P2 P3):
  34  *   SELECT: A4 00 00 02 <file_id, 2 bytes>
  35  *   GET RESPONSE: C0 00 00 <len>
  36  *   RUN GSM ALG: 88 00 00 00 <RAND len = 10>
  37  *   RUN UMTS ALG: 88 00 81 <len=0x22> data: 0x10 | RAND | 0x10 | AUTN
  38  *      P1 = ID of alg in card
  39  *      P2 = ID of secret key
  40  *   READ BINARY: B0 <offset high> <offset low> <len>
  41  *   VERIFY CHV: 20 00 <CHV number> 08
  42  *   CHANGE CHV: 24 00 <CHV number> 10
  43  *   DISABLE CHV: 26 00 01 08
  44  *   ENABLE CHV: 28 00 01 08
  45  *   UNBLOCK CHV: 2C 00 <00=CHV1, 02=CHV2> 10
  46  *   SLEEP: FA 00 00 00
  47  */
  48
  49 /* GSM SIM commands */
  50 #define SIM_CMD_SELECT                  0xa0, 0xa4, 0x00, 0x00, 0x02
  51 #define SIM_CMD_RUN_GSM_ALG             0xa0, 0x88, 0x00, 0x00, 0x10
  52 #define SIM_CMD_GET_RESPONSE            0xa0, 0xc0, 0x00, 0x00
  53 #define SIM_CMD_READ_BIN                0xa0, 0xb0, 0x00, 0x00
  54 #define SIM_CMD_VERIFY_CHV1             0xa0, 0x20, 0x00, 0x01, 0x08
  55
  56 /* USIM commands */
  57 #define USIM_CLA                        0x00
  58 #define USIM_CMD_RUN_UMTS_ALG           0x00, 0x88, 0x00, 0x81, 0x22
  59 #define USIM_CMD_GET_RESPONSE           0x00, 0xc0, 0x00, 0x00
  60
  61 #define USIM_FSP_TEMPL_TAG              0x62
  62
  63 #define USIM_TLV_FILE_DESC              0x82
  64 #define USIM_TLV_FILE_ID                0x83
  65 #define USIM_TLV_DF_NAME                0x84
  66 #define USIM_TLV_PROPR_INFO             0xA5
  67 #define USIM_TLV_LIFE_CYCLE_STATUS      0x8A
  68 #define USIM_TLV_FILE_SIZE              0x80
  69 #define USIM_TLV_TOTAL_FILE_SIZE        0x81
  70 #define USIM_TLV_PIN_STATUS_TEMPLATE    0xC6
  71 #define USIM_TLV_SHORT_FILE_ID          0x88
  72
  73 #define USIM_PS_DO_TAG                  0x90
  74
  75 #define AKA_RAND_LEN 16
  76 #define AKA_AUTN_LEN 16
  77 #define AKA_AUTS_LEN 14
  78 #define RES_MAX_LEN 16
  79 #define IK_LEN 16
  80 #define CK_LEN 16
  81
  82
  83 typedef enum { SCARD_GSM_SIM, SCARD_USIM } sim_types;
  84
  85 struct scard_data {
  86         long ctx;
  87         long card;
  88         unsigned long protocol;
  89         sim_types sim_type;
  90         int pin1_required;
  91 };
  92
  93
  94 static int _scard_select_file(struct scard_data *scard, unsigned short file_id,
  95                               unsigned char *buf, size_t *buf_len,
  96                               sim_types sim_type, unsigned char *aid);
  97 static int scard_select_file(struct scard_data *scard, unsigned short file_id,
  98                              unsigned char *buf, size_t *buf_len);
  99 static int scard_verify_pin(struct scard_data *scard, const char *pin);
 100
 101
 102 static int scard_parse_fsp_templ(unsigned char *buf, size_t buf_len,
 103                                  int *ps_do, int *file_len)
 104 {
 105                 unsigned char *pos, *end;
 106
 107                 if (ps_do)
 108                         *ps_do = -1;
 109                 if (file_len)
 110                         *file_len = -1;
 111
 112                 pos = buf;
 113                 end = pos + buf_len;
 114                 if (*pos != USIM_FSP_TEMPL_TAG) {
 115                         wpa_printf(MSG_DEBUG, "SCARD: file header did not "
 116                                    "start with FSP template tag");
 117                         return -1;
 118                 }
 119                 pos++;
 120                 if (pos >= end)
 121                         return -1;
 122                 if ((pos + pos[0]) < end)
 123                         end = pos + 1 + pos[0];
 124                 pos++;
 125                 wpa_hexdump(MSG_DEBUG, "SCARD: file header FSP template",
 126                             pos, end - pos);
 127
 128                 while (pos + 1 < end) {
 129                         wpa_printf(MSG_MSGDUMP, "SCARD: file header TLV "
 130                                    "0x%02x len=%d", pos[0], pos[1]);
 131                         if (pos + 2 + pos[1] > end)
 132                                 break;
 133
 134                         if (pos[0] == USIM_TLV_FILE_SIZE &&
 135                             (pos[1] == 1 || pos[1] == 2) && file_len) {
 136                                 if (pos[1] == 1)
 137                                         *file_len = (int) pos[2];
 138                                 else
 139                                         *file_len = ((int) pos[2] << 8) |
 140                                                 (int) pos[3];
 141                                 wpa_printf(MSG_DEBUG, "SCARD: file_size=%d",
 142                                            *file_len);
 143                         }
 144
 145                         if (pos[0] == USIM_TLV_PIN_STATUS_TEMPLATE &&
 146                             pos[1] >= 2 && pos[2] == USIM_PS_DO_TAG &&
 147                             pos[3] >= 1 && ps_do) {
 148                                 wpa_printf(MSG_DEBUG, "SCARD: PS_DO=0x%02x",
 149                                            pos[4]);
 150                                 *ps_do = (int) pos[4];
 151                         }
 152
 153                         pos += 2 + pos[1];
 154
 155                         if (pos == end)
 156                                 return 0;
 157                 }
 158                 return -1;
 159 }
 160
 161
 162 static int scard_pin_needed(struct scard_data *scard,
 163                             unsigned char *hdr, size_t hlen)
 164 {
 165         if (scard->sim_type == SCARD_GSM_SIM) {
 166                 if (hlen > SCARD_CHV1_OFFSET &&
 167                     !(hdr[SCARD_CHV1_OFFSET] & SCARD_CHV1_FLAG))
 168                         return 1;
 169                 return 0;
 170         }
 171
 172         if (scard->sim_type == SCARD_USIM) {
 173                 int ps_do;
 174                 if (scard_parse_fsp_templ(hdr, hlen, &ps_do, NULL))
 175                         return -1;
 176                 /* TODO: there could be more than one PS_DO entry because of
 177                  * multiple PINs in key reference.. */
 178                 if (ps_do)
 179                         return 1;
 180         }
 181
 182         return -1;
 183 }
 184
 185
 186 struct scard_data * scard_init(scard_sim_type sim_type)
 187 {
 188         long ret, len;
 189         struct scard_data *scard;
 190         char *readers = NULL;
 191         char buf[100];
 192         size_t blen;
 193
 194         wpa_printf(MSG_DEBUG, "SCARD: initializing smart card interface");
 195         scard = malloc(sizeof(*scard));
 196         if (scard == NULL)
 197                 return NULL;
 198         memset(scard, 0, sizeof(*scard));
 199
 200         ret = SCardEstablishContext(SCARD_SCOPE_SYSTEM, NULL, NULL,
 201                                     &scard->ctx);
 202         if (ret != SCARD_S_SUCCESS) {
 203                 wpa_printf(MSG_DEBUG, "SCARD: Could not establish smart card "
 204                            "context (err=%ld)", ret);
 205                 goto failed;
 206         }
 207
 208         ret = SCardListReaders(scard->ctx, NULL, NULL, &len);
 209         if (ret != SCARD_S_SUCCESS) {
 210                 wpa_printf(MSG_DEBUG, "SCARD: SCardListReaders failed "
 211                            "(err=%ld)", ret);
 212                 goto failed;
 213         }
 214
 215         readers = malloc(len);
 216         if (readers == NULL) {
 217                 printf("malloc failed\n");
 218                 goto failed;
 219         }
 220
 221         ret = SCardListReaders(scard->ctx, NULL, readers, &len);
 222         if (ret != SCARD_S_SUCCESS) {
 223                 wpa_printf(MSG_DEBUG, "SCARD: SCardListReaders failed(2) "
 224                            "(err=%ld)", ret);
 225                 goto failed;
 226         }
 227         if (len < 3) {
 228                 wpa_printf(MSG_WARNING, "SCARD: No smart card readers "
 229                            "available.");
 230                 goto failed;
 231         }
 232         /* readers is a list of available reader. Last entry is terminated with
 233          * double NUL.
 234          * TODO: add support for selecting the reader; now just use the first
 235          * one.. */
 236         wpa_printf(MSG_DEBUG, "SCARD: Selected reader='%s'", readers);
 237
 238         ret = SCardConnect(scard->ctx, readers, SCARD_SHARE_SHARED,
 239                            SCARD_PROTOCOL_T0, &scard->card, &scard->protocol);
 240         if (ret != SCARD_S_SUCCESS) {
 241                 if (ret == SCARD_E_NO_SMARTCARD)
 242                         wpa_printf(MSG_INFO, "No smart card inserted.");
 243                 else
 244                         wpa_printf(MSG_WARNING, "SCardConnect err=%lx", ret);
 245                 goto failed;
 246         }
 247
 248         free(readers);
 249         readers = NULL;
 250
 251         wpa_printf(MSG_DEBUG, "SCARD: card=%ld active_protocol=%lu",
 252                    scard->card, scard->protocol);
 253
 254         blen = sizeof(buf);
 255
 256         scard->sim_type = SCARD_GSM_SIM;
 257         if (sim_type == SCARD_USIM_ONLY || sim_type == SCARD_TRY_BOTH) {
 258                 wpa_printf(MSG_DEBUG, "SCARD: verifying USIM support");
 259                 if (_scard_select_file(scard, SCARD_FILE_MF, buf, &blen,
 260                                        SCARD_USIM, NULL)) {
 261                         wpa_printf(MSG_DEBUG, "SCARD: USIM is not supported");
 262                         if (sim_type == SCARD_USIM_ONLY)
 263                                 goto failed;
 264                         wpa_printf(MSG_DEBUG, "SCARD: Trying to use GSM SIM");
 265                         scard->sim_type = SCARD_GSM_SIM;
 266                 } else {
 267                         wpa_printf(MSG_DEBUG, "SCARD: USIM is supported");
 268                         scard->sim_type = SCARD_USIM;
 269                 }
 270         }
 271
 272         if (scard->sim_type == SCARD_GSM_SIM) {
 273                 blen = sizeof(buf);
 274                 if (scard_select_file(scard, SCARD_FILE_MF, buf, &blen)) {
 275                         wpa_printf(MSG_DEBUG, "SCARD: Failed to read MF");
 276                         goto failed;
 277                 }
 278
 279                 blen = sizeof(buf);
 280                 if (scard_select_file(scard, SCARD_FILE_GSM_DF, buf, &blen)) {
 281                         wpa_printf(MSG_DEBUG, "SCARD: Failed to read GSM DF");
 282                         goto failed;
 283                 }
 284         } else {
 285                 /* Select based on AID = 3G RID */
 286                 blen = sizeof(buf);
 287                 if (_scard_select_file(scard, 0, buf, &blen, scard->sim_type,
 288                                        "\xA0\x00\x00\x00\x87")) {
 289                         wpa_printf(MSG_DEBUG, "SCARD: Failed to read 3G RID "
 290                                    "AID");
 291                         goto failed;
 292                 }
 293         }
 294
 295         /* Verify whether CHV1 (PIN1) is needed to access the card. */
 296         if (scard_pin_needed(scard, buf, blen)) {
 297                 scard->pin1_required = 1;
 298                 wpa_printf(MSG_DEBUG, "PIN1 needed for SIM access");
 299         }
 300
 301         return scard;
 302
 303 failed:
 304         free(readers);
 305         scard_deinit(scard);
 306         return NULL;
 307 }
 308
 309
 310 int scard_set_pin(struct scard_data *scard, const char *pin)
 311 {
 312         if (scard == NULL)
 313                 return -1;
 314
 315         /* Verify whether CHV1 (PIN1) is needed to access the card. */
 316         if (scard->pin1_required) {
 317                 if (pin == NULL) {
 318                         wpa_printf(MSG_DEBUG, "No PIN configured for SIM "
 319                                    "access");
 320                         return -1;
 321                 }
 322                 if (scard_verify_pin(scard, pin)) {
 323                         wpa_printf(MSG_INFO, "PIN verification failed for "
 324                                 "SIM access");
 325                         return -1;
 326                 }
 327         }
 328
 329         return 0;
 330 }
 331
 332
 333 void scard_deinit(struct scard_data *scard)
 334 {
 335         long ret;
 336
 337         if (scard == NULL)
 338                 return;
 339
 340         wpa_printf(MSG_DEBUG, "SCARD: deinitializing smart card interface");
 341         if (scard->card) {
 342                 ret = SCardDisconnect(scard->card, SCARD_UNPOWER_CARD);
 343                 if (ret != SCARD_S_SUCCESS) {
 344                         wpa_printf(MSG_DEBUG, "SCARD: Failed to disconnect "
 345                                    "smart card (err=%ld)", ret);
 346                 }
 347         }
 348
 349         if (scard->ctx) {
 350                 ret = SCardReleaseContext(scard->ctx);
 351                 if (ret != SCARD_S_SUCCESS) {
 352                         wpa_printf(MSG_DEBUG, "Failed to release smart card "
 353                                    "context (err=%ld)", ret);
 354                 }
 355         }
 356         free(scard);
 357 }
 358
 359
 360 static long scard_transmit(struct scard_data *scard,
 361                            unsigned char *send, size_t send_len,
 362                            unsigned char *recv, size_t *recv_len)
 363 {
 364         long ret;
 365         unsigned long rlen;
 366
 367         wpa_hexdump_key(MSG_DEBUG, "SCARD: scard_transmit: send",
 368                         send, send_len);
 369         rlen = *recv_len;
 370         ret = SCardTransmit(scard->card,
 371                             scard->protocol == SCARD_PROTOCOL_T1 ?
 372                             SCARD_PCI_T1 : SCARD_PCI_T0,
 373                             send, (unsigned long) send_len,
 374                             NULL, recv, &rlen);
 375         *recv_len = rlen;
 376         if (ret == SCARD_S_SUCCESS) {
 377                 wpa_hexdump(MSG_DEBUG, "SCARD: scard_transmit: recv",
 378                             recv, rlen);
 379         } else {
 380                 wpa_printf(MSG_WARNING, "SCARD: SCardTransmit failed "
 381                            "(err=0x%lx)", ret);
 382         }
 383         return ret;
 384 }
 385
 386
 387 static int _scard_select_file(struct scard_data *scard, unsigned short file_id,
 388                               unsigned char *buf, size_t *buf_len,
 389                               sim_types sim_type, unsigned char *aid)
 390 {
 391         long ret;
 392         unsigned char resp[3];
 393         unsigned char cmd[10] = { SIM_CMD_SELECT };
 394         int cmdlen;
 395         unsigned char get_resp[5] = { SIM_CMD_GET_RESPONSE };
 396         size_t len, rlen;
 397
 398         if (sim_type == SCARD_USIM) {
 399                 cmd[0] = USIM_CLA;
 400                 cmd[3] = 0x04;
 401                 get_resp[0] = USIM_CLA;
 402         }
 403
 404         wpa_printf(MSG_DEBUG, "SCARD: select file %04x", file_id);
 405         if (aid) {
 406                 cmd[2] = 0x04; /* Select by AID */
 407                 cmd[4] = 5; /* len */
 408                 memcpy(cmd + 5, aid, 5);
 409                 cmdlen = 10;
 410         } else {
 411                 cmd[5] = file_id >> 8;
 412                 cmd[6] = file_id & 0xff;
 413                 cmdlen = 7;
 414         }
 415         len = sizeof(resp);
 416         ret = scard_transmit(scard, cmd, cmdlen, resp, &len);
 417         if (ret != SCARD_S_SUCCESS) {
 418                 wpa_printf(MSG_WARNING, "SCARD: SCardTransmit failed "
 419                            "(err=0x%lx)", ret);
 420                 return -1;
 421         }
 422
 423         if (len != 2) {
 424                 wpa_printf(MSG_WARNING, "SCARD: unexpected resp len "
 425                            "%d (expected 2)", (int) len);
 426                 return -1;
 427         }
 428
 429         if (resp[0] == 0x98 && resp[1] == 0x04) {
 430                 /* Security status not satisfied (PIN_WLAN) */
 431                 wpa_printf(MSG_WARNING, "SCARD: Security status not satisfied "
 432                            "(PIN_WLAN)");
 433                 return -1;
 434         }
 435
 436         if (resp[0] == 0x6e) {
 437                 wpa_printf(MSG_DEBUG, "SCARD: used CLA not supported");
 438                 return -1;
 439         }
 440
 441         if (resp[0] != 0x6c && resp[0] != 0x9f && resp[0] != 0x61) {
 442                 wpa_printf(MSG_WARNING, "SCARD: unexpected response 0x%02x "
 443                            "(expected 0x61, 0x6c, or 0x9f)", resp[0]);
 444                 return -1;
 445         }
 446         /* Normal ending of command; resp[1] bytes available */
 447         get_resp[4] = resp[1];
 448         wpa_printf(MSG_DEBUG, "SCARD: trying to get response (%d bytes)",
 449                    resp[1]);
 450
 451         rlen = *buf_len;
 452         ret = scard_transmit(scard, get_resp, sizeof(get_resp), buf, &rlen);
 453         if (ret == SCARD_S_SUCCESS) {
 454                 *buf_len = resp[1] < rlen ? resp[1] : rlen;
 455                 return 0;
 456         }
 457
 458         wpa_printf(MSG_WARNING, "SCARD: SCardTransmit err=0x%lx\n", ret);
 459         return -1;
 460 }
 461
 462
 463 static int scard_select_file(struct scard_data *scard, unsigned short file_id,
 464                              unsigned char *buf, size_t *buf_len)
 465 {
 466         return _scard_select_file(scard, file_id, buf, buf_len,
 467                                   scard->sim_type, NULL);
 468 }
 469
 470
 471 static int scard_read_file(struct scard_data *scard,
 472                            unsigned char *data, size_t len)
 473 {
 474         char cmd[5] = { SIM_CMD_READ_BIN, len };
 475         size_t blen = len + 3;
 476         unsigned char *buf;
 477         long ret;
 478
 479         buf = malloc(blen);
 480         if (buf == NULL)
 481                 return -1;
 482
 483         if (scard->sim_type == SCARD_USIM)
 484                 cmd[0] = USIM_CLA;
 485         ret = scard_transmit(scard, cmd, sizeof(cmd), buf, &blen);
 486         if (ret != SCARD_S_SUCCESS) {
 487                 free(buf);
 488                 return -2;
 489         }
 490         if (blen != len + 2) {
 491                 wpa_printf(MSG_DEBUG, "SCARD: file read returned unexpected "
 492                            "length %d (expected %d)", blen, len + 2);
 493                 free(buf);
 494                 return -3;
 495         }
 496
 497         if (buf[len] != 0x90 || buf[len + 1] != 0x00) {
 498                 wpa_printf(MSG_DEBUG, "SCARD: file read returned unexpected "
 499                            "status %02x %02x (expected 90 00)",
 500                            buf[len], buf[len + 1]);
 501                 free(buf);
 502                 return -4;
 503         }
 504
 505         memcpy(data, buf, len);
 506         free(buf);
 507
 508         return 0;
 509 }
 510
 511
 512 static int scard_verify_pin(struct scard_data *scard, const char *pin)
 513 {
 514         long ret;
 515         unsigned char resp[3];
 516         char cmd[5 + 8] = { SIM_CMD_VERIFY_CHV1 };
 517         size_t len;
 518
 519         wpa_printf(MSG_DEBUG, "SCARD: verifying PIN");
 520
 521         if (pin == NULL || strlen(pin) > 8)
 522                 return -1;
 523
 524         if (scard->sim_type == SCARD_USIM)
 525                 cmd[0] = USIM_CLA;
 526         memcpy(cmd + 5, pin, strlen(pin));
 527         memset(cmd + 5 + strlen(pin), 0xff, 8 - strlen(pin));
 528
 529         len = sizeof(resp);
 530         ret = scard_transmit(scard, cmd, sizeof(cmd), resp, &len);
 531         if (ret != SCARD_S_SUCCESS)
 532                 return -2;
 533
 534         if (len != 2 || resp[0] != 0x90 || resp[1] != 0x00) {
 535                 wpa_printf(MSG_WARNING, "SCARD: PIN verification failed");
 536                 return -1;
 537         }
 538
 539         wpa_printf(MSG_DEBUG, "SCARD: PIN verified successfully");
 540         return 0;
 541 }
 542
 543
 544 int scard_get_imsi(struct scard_data *scard, char *imsi, size_t *len)
 545 {
 546         char buf[100];
 547         size_t blen, imsilen;
 548         char *pos;
 549         int i;
 550
 551         wpa_printf(MSG_DEBUG, "SCARD: reading IMSI from (GSM) EF-IMSI");
 552         blen = sizeof(buf);
 553         if (scard_select_file(scard, SCARD_FILE_GSM_EF_IMSI, buf, &blen))
 554                 return -1;
 555         if (blen < 4) {
 556                 wpa_printf(MSG_WARNING, "SCARD: too short (GSM) EF-IMSI "
 557                            "header (len=%d)", blen);
 558                 return -2;
 559         }
 560
 561         if (scard->sim_type == SCARD_GSM_SIM) {
 562                 blen = (buf[2] << 8) | buf[3];
 563         } else {
 564                 int file_size;
 565                 if (scard_parse_fsp_templ(buf, blen, NULL, &file_size))
 566                         return -3;
 567                 blen = file_size;
 568         }
 569         if (blen < 2 || blen > sizeof(buf)) {
 570                 wpa_printf(MSG_DEBUG, "SCARD: invalid IMSI file length=%d",
 571                            blen);
 572                 return -3;
 573         }
 574
 575         imsilen = (blen - 2) * 2 + 1;
 576         wpa_printf(MSG_DEBUG, "SCARD: IMSI file length=%d imsilen=%d",
 577                    blen, imsilen);
 578         if (blen < 2 || imsilen > *len) {
 579                 *len = imsilen;
 580                 return -4;
 581         }
 582
 583         if (scard_read_file(scard, buf, blen))
 584                 return -5;
 585
 586         pos = imsi;
 587         *pos++ = '0' + (buf[1] >> 4 & 0x0f);
 588         for (i = 2; i < blen; i++) {
 589                 unsigned char digit;
 590
 591                 digit = buf[i] & 0x0f;
 592                 if (digit < 10)
 593                         *pos++ = '0' + digit;
 594                 else
 595                         imsilen--;
 596
 597                 digit = buf[i] >> 4 & 0x0f;
 598                 if (digit < 10)
 599                         *pos++ = '0' + digit;
 600                 else
 601                         imsilen--;
 602         }
 603         *len = imsilen;
 604
 605         return 0;
 606 }
 607
 608
 609 int scard_gsm_auth(struct scard_data *scard, unsigned char *rand,
 610                    unsigned char *sres, unsigned char *kc)
 611 {
 612         unsigned char cmd[5 + 1 + 16] = { SIM_CMD_RUN_GSM_ALG };
 613         int cmdlen;
 614         unsigned char get_resp[5] = { SIM_CMD_GET_RESPONSE };
 615         unsigned char resp[3], buf[12 + 3 + 2];
 616         size_t len;
 617         long ret;
 618
 619         if (scard == NULL)
 620                 return -1;
 621
 622         wpa_hexdump(MSG_DEBUG, "SCARD: GSM auth - RAND", rand, 16);
 623         if (scard->sim_type == SCARD_GSM_SIM) {
 624                 cmdlen = 5 + 16;
 625                 memcpy(cmd + 5, rand, 16);
 626         } else {
 627                 cmdlen = 5 + 1 + 16;
 628                 cmd[0] = USIM_CLA;
 629                 cmd[3] = 0x80;
 630                 cmd[4] = 17;
 631                 cmd[5] = 16;
 632                 memcpy(cmd + 6, rand, 16);
 633         }
 634         len = sizeof(resp);
 635         ret = scard_transmit(scard, cmd, cmdlen, resp, &len);
 636         if (ret != SCARD_S_SUCCESS)
 637                 return -2;
 638
 639         if ((scard->sim_type == SCARD_GSM_SIM &&
 640              (len != 2 || resp[0] != 0x9f || resp[1] != 0x0c)) ||
 641             (scard->sim_type == SCARD_USIM &&
 642              (len != 2 || resp[0] != 0x61 || resp[1] != 0x0e))) {
 643                 wpa_printf(MSG_WARNING, "SCARD: unexpected response for GSM "
 644                            "auth request (len=%d resp=%02x %02x)",
 645                            len, resp[0], resp[1]);
 646                 return -3;
 647         }
 648         get_resp[4] = resp[1];
 649
 650         len = sizeof(buf);
 651         ret = scard_transmit(scard, get_resp, sizeof(get_resp), buf, &len);
 652         if (ret != SCARD_S_SUCCESS)
 653                 return -4;
 654
 655         if (scard->sim_type == SCARD_GSM_SIM) {
 656                 if (len != 4 + 8 + 2) {
 657                         wpa_printf(MSG_WARNING, "SCARD: unexpected data "
 658                                    "length for GSM auth (len=%d, expected 14)",
 659                                    len);
 660                         return -5;
 661                 }
 662                 memcpy(sres, buf, 4);
 663                 memcpy(kc, buf + 4, 8);
 664         } else {
 665                 if (len != 1 + 4 + 1 + 8 + 2) {
 666                         wpa_printf(MSG_WARNING, "SCARD: unexpected data "
 667                                    "length for USIM auth (len=%d, "
 668                                    "expected 16)", len);
 669                         return -5;
 670                 }
 671                 if (buf[0] != 4 || buf[5] != 8) {
 672                         wpa_printf(MSG_WARNING, "SCARD: unexpected SREC/Kc "
 673                                    "length (%d %d, expected 4 8)",
 674                                    buf[0], buf[5]);
 675                 }
 676                 memcpy(sres, buf + 1, 4);
 677                 memcpy(kc, buf + 6, 8);
 678         }
 679
 680         wpa_hexdump(MSG_DEBUG, "SCARD: GSM auth - SRES", sres, 4);
 681         wpa_hexdump(MSG_DEBUG, "SCARD: GSM auth - Kc", kc, 8);
 682
 683         return 0;
 684 }
 685
 686
 687 int scard_umts_auth(struct scard_data *scard, unsigned char *rand,
 688                     unsigned char *autn, unsigned char *res, size_t *res_len,
 689                     unsigned char *ik, unsigned char *ck, unsigned char *auts)
 690 {
 691         unsigned char cmd[5 + 1 + AKA_RAND_LEN + 1 + AKA_AUTN_LEN] =
 692                 { USIM_CMD_RUN_UMTS_ALG };
 693         int cmdlen;
 694         unsigned char get_resp[5] = { USIM_CMD_GET_RESPONSE };
 695         unsigned char resp[3], buf[64], *pos, *end;
 696         size_t len;
 697         long ret;
 698
 699         if (scard == NULL)
 700                 return -1;
 701
 702         if (scard->sim_type == SCARD_GSM_SIM) {
 703                 wpa_printf(MSG_ERROR, "SCARD: Non-USIM card - cannot do UMTS "
 704                            "auth");
 705                 return -1;
 706         }
 707
 708         wpa_hexdump(MSG_DEBUG, "SCARD: UMTS auth - RAND", rand, AKA_RAND_LEN);
 709         wpa_hexdump(MSG_DEBUG, "SCARD: UMTS auth - AUTN", autn, AKA_AUTN_LEN);
 710         cmdlen = 5 + 1 + AKA_RAND_LEN + 1 + AKA_AUTN_LEN;
 711         cmd[5] = AKA_RAND_LEN;
 712         memcpy(cmd + 6, rand, AKA_RAND_LEN);
 713         cmd[6 + AKA_RAND_LEN] = AKA_AUTN_LEN;
 714         memcpy(cmd + 6 + AKA_RAND_LEN + 1, autn, AKA_AUTN_LEN);
 715
 716         len = sizeof(resp);
 717         ret = scard_transmit(scard, cmd, sizeof(cmd), resp, &len);
 718         if (ret != SCARD_S_SUCCESS)
 719                 return -1;
 720
 721         if (len >= 0 && len <= sizeof(resp))
 722                 wpa_hexdump(MSG_DEBUG, "SCARD: UMTS alg response", resp, len);
 723
 724         if (len == 2 && resp[0] == 0x98 && resp[1] == 0x62) {
 725                 wpa_printf(MSG_WARNING, "SCARD: UMTS auth failed - "
 726                            "MAC != XMAC");
 727                 return -1;
 728         } else if (len != 2 || resp[0] != 0x61) {
 729                 wpa_printf(MSG_WARNING, "SCARD: unexpected response for UMTS "
 730                            "auth request (len=%d resp=%02x %02x)",
 731                            len, resp[0], resp[1]);
 732                 return -1;
 733         }
 734         get_resp[4] = resp[1];
 735
 736         len = sizeof(buf);
 737         ret = scard_transmit(scard, get_resp, sizeof(get_resp), buf, &len);
 738         if (ret != SCARD_S_SUCCESS || len < 0 || len > sizeof(buf))
 739                 return -1;
 740
 741         wpa_hexdump(MSG_DEBUG, "SCARD: UMTS get response result", buf, len);
 742         if (len >= 2 + AKA_AUTS_LEN && buf[0] == 0xdc &&
 743             buf[1] == AKA_AUTS_LEN) {
 744                 wpa_printf(MSG_DEBUG, "SCARD: UMTS Synchronization-Failure");
 745                 memcpy(auts, buf + 2, AKA_AUTS_LEN);
 746                 wpa_hexdump(MSG_DEBUG, "SCARD: AUTS", auts, AKA_AUTS_LEN);
 747                 return -2;
 748         } else if (len >= 6 + IK_LEN + CK_LEN && buf[0] == 0xdb) {
 749                 pos = buf + 1;
 750                 end = buf + len;
 751
 752                 /* RES */
 753                 if (pos[0] > RES_MAX_LEN || pos + pos[0] > end) {
 754                         wpa_printf(MSG_DEBUG, "SCARD: Invalid RES");
 755                         return -1;
 756                 }
 757                 *res_len = *pos++;
 758                 memcpy(res, pos, *res_len);
 759                 pos += *res_len;
 760                 wpa_hexdump(MSG_DEBUG, "SCARD: RES", res, *res_len);
 761
 762                 /* CK */
 763                 if (pos[0] != CK_LEN || pos + CK_LEN > end) {
 764                         wpa_printf(MSG_DEBUG, "SCARD: Invalid CK");
 765                         return -1;
 766                 }
 767                 pos++;
 768                 memcpy(ck, pos, CK_LEN);
 769                 pos += CK_LEN;
 770                 wpa_hexdump(MSG_DEBUG, "SCARD: CK", ck, CK_LEN);
 771
 772                 /* IK */
 773                 if (pos[0] != IK_LEN || pos + IK_LEN > end) {
 774                         wpa_printf(MSG_DEBUG, "SCARD: Invalid IK");
 775                         return -1;
 776                 }
 777                 pos++;
 778                 memcpy(ik, pos, IK_LEN);
 779                 pos += IK_LEN;
 780                 wpa_hexdump(MSG_DEBUG, "SCARD: IK", ik, IK_LEN);
 781
 782                 return 0;
 783         }
 784
 785         wpa_printf(MSG_DEBUG, "SCARD: Unrecognized response");
 786         return -1;
 787 }