contrib/wpa/src/eap_peer/eap_aka.c

   1 /*
   2  * EAP peer method: EAP-AKA (RFC 4187) and EAP-AKA' (RFC 5448)
   3  * Copyright (c) 2004-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "pcsc_funcs.h"
  13 #include "crypto/crypto.h"
  14 #include "crypto/sha1.h"
  15 #include "crypto/sha256.h"
  16 #include "crypto/milenage.h"
  17 #include "eap_common/eap_sim_common.h"
  18 #include "eap_config.h"
  19 #include "eap_i.h"
  20
  21
  22 struct eap_aka_data {
  23         u8 ik[EAP_AKA_IK_LEN], ck[EAP_AKA_CK_LEN], res[EAP_AKA_RES_MAX_LEN];
  24         size_t res_len;
  25         u8 nonce_s[EAP_SIM_NONCE_S_LEN];
  26         u8 mk[EAP_SIM_MK_LEN];
  27         u8 k_aut[EAP_AKA_PRIME_K_AUT_LEN];
  28         u8 k_encr[EAP_SIM_K_ENCR_LEN];
  29         u8 k_re[EAP_AKA_PRIME_K_RE_LEN]; /* EAP-AKA' only */
  30         u8 msk[EAP_SIM_KEYING_DATA_LEN];
  31         u8 emsk[EAP_EMSK_LEN];
  32         u8 rand[EAP_AKA_RAND_LEN], autn[EAP_AKA_AUTN_LEN];
  33         u8 auts[EAP_AKA_AUTS_LEN];
  34
  35         int num_id_req, num_notification;
  36         u8 *pseudonym;
  37         size_t pseudonym_len;
  38         u8 *reauth_id;
  39         size_t reauth_id_len;
  40         int reauth;
  41         unsigned int counter, counter_too_small;
  42         u8 *last_eap_identity;
  43         size_t last_eap_identity_len;
  44         enum {
  45                 CONTINUE, RESULT_SUCCESS, SUCCESS, FAILURE
  46         } state;
  47
  48         struct wpabuf *id_msgs;
  49         int prev_id;
  50         int result_ind, use_result_ind;
  51         int use_pseudonym;
  52         u8 eap_method;
  53         u8 *network_name;
  54         size_t network_name_len;
  55         u16 kdf;
  56         int kdf_negotiation;
  57         u16 last_kdf_attrs[EAP_AKA_PRIME_KDF_MAX];
  58         size_t last_kdf_count;
  59         int error_code;
  60 };
  61
  62
  63 #ifndef CONFIG_NO_STDOUT_DEBUG
  64 static const char * eap_aka_state_txt(int state)
  65 {
  66         switch (state) {
  67         case CONTINUE:
  68                 return "CONTINUE";
  69         case RESULT_SUCCESS:
  70                 return "RESULT_SUCCESS";
  71         case SUCCESS:
  72                 return "SUCCESS";
  73         case FAILURE:
  74                 return "FAILURE";
  75         default:
  76                 return "?";
  77         }
  78 }
  79 #endif /* CONFIG_NO_STDOUT_DEBUG */
  80
  81
  82 static void eap_aka_state(struct eap_aka_data *data, int state)
  83 {
  84         wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
  85                    eap_aka_state_txt(data->state),
  86                    eap_aka_state_txt(state));
  87         data->state = state;
  88 }
  89
  90
  91 static void * eap_aka_init(struct eap_sm *sm)
  92 {
  93         struct eap_aka_data *data;
  94         const char *phase1 = eap_get_config_phase1(sm);
  95         struct eap_peer_config *config = eap_get_config(sm);
  96
  97         data = os_zalloc(sizeof(*data));
  98         if (data == NULL)
  99                 return NULL;
 100
 101         data->eap_method = EAP_TYPE_AKA;
 102
 103         /* Zero is a valid error code, so we need to initialize */
 104         data->error_code = NO_EAP_METHOD_ERROR;
 105
 106         eap_aka_state(data, CONTINUE);
 107         data->prev_id = -1;
 108
 109         data->result_ind = phase1 && os_strstr(phase1, "result_ind=1") != NULL;
 110
 111         data->use_pseudonym = !sm->init_phase2;
 112         if (config && config->anonymous_identity && data->use_pseudonym) {
 113                 data->pseudonym = os_malloc(config->anonymous_identity_len);
 114                 if (data->pseudonym) {
 115                         os_memcpy(data->pseudonym, config->anonymous_identity,
 116                                   config->anonymous_identity_len);
 117                         data->pseudonym_len = config->anonymous_identity_len;
 118                 }
 119         }
 120
 121         return data;
 122 }
 123
 124
 125 #ifdef EAP_AKA_PRIME
 126 static void * eap_aka_prime_init(struct eap_sm *sm)
 127 {
 128         struct eap_aka_data *data = eap_aka_init(sm);
 129         if (data == NULL)
 130                 return NULL;
 131         data->eap_method = EAP_TYPE_AKA_PRIME;
 132         return data;
 133 }
 134 #endif /* EAP_AKA_PRIME */
 135
 136
 137 static void eap_aka_clear_keys(struct eap_aka_data *data, int reauth)
 138 {
 139         if (!reauth) {
 140                 os_memset(data->mk, 0, EAP_SIM_MK_LEN);
 141                 os_memset(data->k_aut, 0, EAP_AKA_PRIME_K_AUT_LEN);
 142                 os_memset(data->k_encr, 0, EAP_SIM_K_ENCR_LEN);
 143                 os_memset(data->k_re, 0, EAP_AKA_PRIME_K_RE_LEN);
 144         }
 145         os_memset(data->msk, 0, EAP_SIM_KEYING_DATA_LEN);
 146         os_memset(data->emsk, 0, EAP_EMSK_LEN);
 147         os_memset(data->autn, 0, EAP_AKA_AUTN_LEN);
 148         os_memset(data->auts, 0, EAP_AKA_AUTS_LEN);
 149 }
 150
 151
 152 static void eap_aka_deinit(struct eap_sm *sm, void *priv)
 153 {
 154         struct eap_aka_data *data = priv;
 155         if (data) {
 156                 os_free(data->pseudonym);
 157                 os_free(data->reauth_id);
 158                 os_free(data->last_eap_identity);
 159                 wpabuf_free(data->id_msgs);
 160                 os_free(data->network_name);
 161                 eap_aka_clear_keys(data, 0);
 162                 os_free(data);
 163         }
 164 }
 165
 166
 167 static int eap_aka_ext_sim_req(struct eap_sm *sm, struct eap_aka_data *data)
 168 {
 169         char req[200], *pos, *end;
 170
 171         wpa_printf(MSG_DEBUG, "EAP-AKA: Use external USIM processing");
 172         pos = req;
 173         end = pos + sizeof(req);
 174         pos += os_snprintf(pos, end - pos, "UMTS-AUTH");
 175         pos += os_snprintf(pos, end - pos, ":");
 176         pos += wpa_snprintf_hex(pos, end - pos, data->rand, EAP_AKA_RAND_LEN);
 177         pos += os_snprintf(pos, end - pos, ":");
 178         wpa_snprintf_hex(pos, end - pos, data->autn, EAP_AKA_AUTN_LEN);
 179
 180         eap_sm_request_sim(sm, req);
 181         return 1;
 182 }
 183
 184
 185 static int eap_aka_ext_sim_result(struct eap_sm *sm, struct eap_aka_data *data,
 186                                   struct eap_peer_config *conf)
 187 {
 188         char *resp, *pos;
 189
 190         wpa_printf(MSG_DEBUG,
 191                    "EAP-AKA: Use result from external USIM processing");
 192
 193         resp = conf->external_sim_resp;
 194         conf->external_sim_resp = NULL;
 195
 196         if (os_strncmp(resp, "UMTS-AUTS:", 10) == 0) {
 197                 pos = resp + 10;
 198                 if (hexstr2bin(pos, data->auts, EAP_AKA_AUTS_LEN) < 0)
 199                         goto invalid;
 200                 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: AUTS", data->auts,
 201                                 EAP_AKA_AUTS_LEN);
 202                 os_free(resp);
 203                 return -2;
 204         }
 205
 206         if (os_strncmp(resp, "UMTS-AUTH:", 10) != 0) {
 207                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized external USIM processing response");
 208                 os_free(resp);
 209                 return -1;
 210         }
 211
 212         pos = resp + 10;
 213         wpa_hexdump(MSG_DEBUG, "EAP-AKA: RAND", data->rand, EAP_AKA_RAND_LEN);
 214
 215         if (hexstr2bin(pos, data->ik, EAP_AKA_IK_LEN) < 0)
 216                 goto invalid;
 217         wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", data->ik, EAP_AKA_IK_LEN);
 218         pos += EAP_AKA_IK_LEN * 2;
 219         if (*pos != ':')
 220                 goto invalid;
 221         pos++;
 222
 223         if (hexstr2bin(pos, data->ck, EAP_AKA_CK_LEN) < 0)
 224                 goto invalid;
 225         wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", data->ck, EAP_AKA_CK_LEN);
 226         pos += EAP_AKA_CK_LEN * 2;
 227         if (*pos != ':')
 228                 goto invalid;
 229         pos++;
 230
 231         data->res_len = os_strlen(pos) / 2;
 232         if (data->res_len > EAP_AKA_RES_MAX_LEN) {
 233                 data->res_len = 0;
 234                 goto invalid;
 235         }
 236         if (hexstr2bin(pos, data->res, data->res_len) < 0)
 237                 goto invalid;
 238         wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: RES", data->res, data->res_len);
 239
 240         os_free(resp);
 241         return 0;
 242
 243 invalid:
 244         wpa_printf(MSG_DEBUG, "EAP-AKA: Invalid external USIM processing UMTS-AUTH response");
 245         os_free(resp);
 246         return -1;
 247 }
 248
 249
 250 static int eap_aka_umts_auth(struct eap_sm *sm, struct eap_aka_data *data)
 251 {
 252         struct eap_peer_config *conf;
 253
 254         wpa_printf(MSG_DEBUG, "EAP-AKA: UMTS authentication algorithm");
 255
 256         conf = eap_get_config(sm);
 257         if (conf == NULL)
 258                 return -1;
 259
 260         if (sm->external_sim) {
 261                 if (conf->external_sim_resp)
 262                         return eap_aka_ext_sim_result(sm, data, conf);
 263                 else
 264                         return eap_aka_ext_sim_req(sm, data);
 265         }
 266
 267         if (conf->pcsc) {
 268                 return scard_umts_auth(sm->scard_ctx, data->rand,
 269                                        data->autn, data->res, &data->res_len,
 270                                        data->ik, data->ck, data->auts);
 271         }
 272
 273 #ifdef CONFIG_USIM_SIMULATOR
 274         if (conf->password) {
 275                 u8 opc[16], k[16], sqn[6];
 276                 const char *pos;
 277                 wpa_printf(MSG_DEBUG, "EAP-AKA: Use internal Milenage "
 278                            "implementation for UMTS authentication");
 279                 if (conf->password_len < 78) {
 280                         wpa_printf(MSG_DEBUG, "EAP-AKA: invalid Milenage "
 281                                    "password");
 282                         return -1;
 283                 }
 284                 pos = (const char *) conf->password;
 285                 if (hexstr2bin(pos, k, 16))
 286                         return -1;
 287                 pos += 32;
 288                 if (*pos != ':')
 289                         return -1;
 290                 pos++;
 291
 292                 if (hexstr2bin(pos, opc, 16))
 293                         return -1;
 294                 pos += 32;
 295                 if (*pos != ':')
 296                         return -1;
 297                 pos++;
 298
 299                 if (hexstr2bin(pos, sqn, 6))
 300                         return -1;
 301
 302                 return milenage_check(opc, k, sqn, data->rand, data->autn,
 303                                       data->ik, data->ck,
 304                                       data->res, &data->res_len, data->auts);
 305         }
 306 #endif /* CONFIG_USIM_SIMULATOR */
 307
 308 #ifdef CONFIG_USIM_HARDCODED
 309         wpa_printf(MSG_DEBUG, "EAP-AKA: Use hardcoded Kc and SRES values for "
 310                    "testing");
 311
 312         /* These hardcoded Kc and SRES values are used for testing.
 313          * Could consider making them configurable. */
 314         os_memset(data->res, '2', EAP_AKA_RES_MAX_LEN);
 315         data->res_len = EAP_AKA_RES_MAX_LEN;
 316         os_memset(data->ik, '3', EAP_AKA_IK_LEN);
 317         os_memset(data->ck, '4', EAP_AKA_CK_LEN);
 318         {
 319                 u8 autn[EAP_AKA_AUTN_LEN];
 320                 os_memset(autn, '1', EAP_AKA_AUTN_LEN);
 321                 if (os_memcmp_const(autn, data->autn, EAP_AKA_AUTN_LEN) != 0) {
 322                         wpa_printf(MSG_WARNING, "EAP-AKA: AUTN did not match "
 323                                    "with expected value");
 324                         return -1;
 325                 }
 326         }
 327 #if 0
 328         {
 329                 static int test_resync = 1;
 330                 if (test_resync) {
 331                         /* Test Resynchronization */
 332                         test_resync = 0;
 333                         return -2;
 334                 }
 335         }
 336 #endif
 337         return 0;
 338
 339 #else /* CONFIG_USIM_HARDCODED */
 340
 341         wpa_printf(MSG_DEBUG, "EAP-AKA: No UMTS authentication algorithm "
 342                    "enabled");
 343         return -1;
 344
 345 #endif /* CONFIG_USIM_HARDCODED */
 346 }
 347
 348
 349 #define CLEAR_PSEUDONYM 0x01
 350 #define CLEAR_REAUTH_ID 0x02
 351 #define CLEAR_EAP_ID    0x04
 352
 353 static void eap_aka_clear_identities(struct eap_sm *sm,
 354                                      struct eap_aka_data *data, int id)
 355 {
 356         if ((id & CLEAR_PSEUDONYM) && data->pseudonym) {
 357                 wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old pseudonym");
 358                 os_free(data->pseudonym);
 359                 data->pseudonym = NULL;
 360                 data->pseudonym_len = 0;
 361                 if (data->use_pseudonym)
 362                         eap_set_anon_id(sm, NULL, 0);
 363         }
 364         if ((id & CLEAR_REAUTH_ID) && data->reauth_id) {
 365                 wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old reauth_id");
 366                 os_free(data->reauth_id);
 367                 data->reauth_id = NULL;
 368                 data->reauth_id_len = 0;
 369         }
 370         if ((id & CLEAR_EAP_ID) && data->last_eap_identity) {
 371                 wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old eap_id");
 372                 os_free(data->last_eap_identity);
 373                 data->last_eap_identity = NULL;
 374                 data->last_eap_identity_len = 0;
 375         }
 376 }
 377
 378
 379 static int eap_aka_learn_ids(struct eap_sm *sm, struct eap_aka_data *data,
 380                              struct eap_sim_attrs *attr)
 381 {
 382         if (attr->next_pseudonym) {
 383                 const u8 *identity = NULL;
 384                 size_t identity_len = 0;
 385                 const u8 *realm = NULL;
 386                 size_t realm_len = 0;
 387
 388                 wpa_hexdump_ascii(MSG_DEBUG,
 389                                   "EAP-AKA: (encr) AT_NEXT_PSEUDONYM",
 390                                   attr->next_pseudonym,
 391                                   attr->next_pseudonym_len);
 392                 os_free(data->pseudonym);
 393                 /* Look for the realm of the permanent identity */
 394                 identity = eap_get_config_identity(sm, &identity_len);
 395                 if (identity) {
 396                         for (realm = identity, realm_len = identity_len;
 397                              realm_len > 0; realm_len--, realm++) {
 398                                 if (*realm == '@')
 399                                         break;
 400                         }
 401                 }
 402                 data->pseudonym = os_malloc(attr->next_pseudonym_len +
 403                                             realm_len);
 404                 if (data->pseudonym == NULL) {
 405                         wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
 406                                    "next pseudonym");
 407                         data->pseudonym_len = 0;
 408                         return -1;
 409                 }
 410                 os_memcpy(data->pseudonym, attr->next_pseudonym,
 411                           attr->next_pseudonym_len);
 412                 if (realm_len) {
 413                         os_memcpy(data->pseudonym + attr->next_pseudonym_len,
 414                                   realm, realm_len);
 415                 }
 416                 data->pseudonym_len = attr->next_pseudonym_len + realm_len;
 417                 if (data->use_pseudonym)
 418                         eap_set_anon_id(sm, data->pseudonym,
 419                                         data->pseudonym_len);
 420         }
 421
 422         if (attr->next_reauth_id) {
 423                 os_free(data->reauth_id);
 424                 data->reauth_id = os_memdup(attr->next_reauth_id,
 425                                             attr->next_reauth_id_len);
 426                 if (data->reauth_id == NULL) {
 427                         wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
 428                                    "next reauth_id");
 429                         data->reauth_id_len = 0;
 430                         return -1;
 431                 }
 432                 data->reauth_id_len = attr->next_reauth_id_len;
 433                 wpa_hexdump_ascii(MSG_DEBUG,
 434                                   "EAP-AKA: (encr) AT_NEXT_REAUTH_ID",
 435                                   data->reauth_id,
 436                                   data->reauth_id_len);
 437         }
 438
 439         return 0;
 440 }
 441
 442
 443 static int eap_aka_add_id_msg(struct eap_aka_data *data,
 444                               const struct wpabuf *msg)
 445 {
 446         if (msg == NULL)
 447                 return -1;
 448
 449         if (data->id_msgs == NULL) {
 450                 data->id_msgs = wpabuf_dup(msg);
 451                 return data->id_msgs == NULL ? -1 : 0;
 452         }
 453
 454         if (wpabuf_resize(&data->id_msgs, wpabuf_len(msg)) < 0)
 455                 return -1;
 456         wpabuf_put_buf(data->id_msgs, msg);
 457
 458         return 0;
 459 }
 460
 461
 462 static void eap_aka_add_checkcode(struct eap_aka_data *data,
 463                                   struct eap_sim_msg *msg)
 464 {
 465         const u8 *addr;
 466         size_t len;
 467         u8 hash[SHA256_MAC_LEN];
 468
 469         wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
 470
 471         if (data->id_msgs == NULL) {
 472                 /*
 473                  * No EAP-AKA/Identity packets were exchanged - send empty
 474                  * checkcode.
 475                  */
 476                 eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
 477                 return;
 478         }
 479
 480         /* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
 481         addr = wpabuf_head(data->id_msgs);
 482         len = wpabuf_len(data->id_msgs);
 483         wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
 484 #ifdef EAP_AKA_PRIME
 485         if (data->eap_method == EAP_TYPE_AKA_PRIME)
 486                 sha256_vector(1, &addr, &len, hash);
 487         else
 488 #endif /* EAP_AKA_PRIME */
 489                 sha1_vector(1, &addr, &len, hash);
 490
 491         eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
 492                         data->eap_method == EAP_TYPE_AKA_PRIME ?
 493                         EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN);
 494 }
 495
 496
 497 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
 498                                     const u8 *checkcode, size_t checkcode_len)
 499 {
 500         const u8 *addr;
 501         size_t len;
 502         u8 hash[SHA256_MAC_LEN];
 503         size_t hash_len;
 504
 505         if (checkcode == NULL)
 506                 return -1;
 507
 508         if (data->id_msgs == NULL) {
 509                 if (checkcode_len != 0) {
 510                         wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
 511                                    "indicates that AKA/Identity messages were "
 512                                    "used, but they were not");
 513                         return -1;
 514                 }
 515                 return 0;
 516         }
 517
 518         hash_len = data->eap_method == EAP_TYPE_AKA_PRIME ?
 519                 EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN;
 520
 521         if (checkcode_len != hash_len) {
 522                 wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
 523                            "indicates that AKA/Identity message were not "
 524                            "used, but they were");
 525                 return -1;
 526         }
 527
 528         /* Checkcode is SHA1/SHA256 hash over all EAP-AKA/Identity packets. */
 529         addr = wpabuf_head(data->id_msgs);
 530         len = wpabuf_len(data->id_msgs);
 531 #ifdef EAP_AKA_PRIME
 532         if (data->eap_method == EAP_TYPE_AKA_PRIME)
 533                 sha256_vector(1, &addr, &len, hash);
 534         else
 535 #endif /* EAP_AKA_PRIME */
 536                 sha1_vector(1, &addr, &len, hash);
 537
 538         if (os_memcmp_const(hash, checkcode, hash_len) != 0) {
 539                 wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
 540                 return -1;
 541         }
 542
 543         return 0;
 544 }
 545
 546
 547 static struct wpabuf * eap_aka_client_error(struct eap_aka_data *data, u8 id,
 548                                             int err)
 549 {
 550         struct eap_sim_msg *msg;
 551
 552         eap_aka_state(data, FAILURE);
 553         data->num_id_req = 0;
 554         data->num_notification = 0;
 555
 556         wpa_printf(MSG_DEBUG, "EAP-AKA: Send Client-Error (error code %d)",
 557                    err);
 558         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 559                                EAP_AKA_SUBTYPE_CLIENT_ERROR);
 560         eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
 561         return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
 562 }
 563
 564
 565 static struct wpabuf * eap_aka_authentication_reject(struct eap_aka_data *data,
 566                                                      u8 id)
 567 {
 568         struct eap_sim_msg *msg;
 569
 570         eap_aka_state(data, FAILURE);
 571         data->num_id_req = 0;
 572         data->num_notification = 0;
 573
 574         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Authentication-Reject "
 575                    "(id=%d)", id);
 576         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 577                                EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT);
 578         return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
 579 }
 580
 581
 582 static struct wpabuf * eap_aka_synchronization_failure(
 583         struct eap_aka_data *data, u8 id, struct eap_sim_attrs *attr)
 584 {
 585         struct eap_sim_msg *msg;
 586
 587         data->num_id_req = 0;
 588         data->num_notification = 0;
 589
 590         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Synchronization-Failure "
 591                    "(id=%d)", id);
 592         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 593                                EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE);
 594         wpa_printf(MSG_DEBUG, "   AT_AUTS");
 595         eap_sim_msg_add_full(msg, EAP_SIM_AT_AUTS, data->auts,
 596                              EAP_AKA_AUTS_LEN);
 597         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 598                 size_t i;
 599
 600                 for (i = 0; i < attr->kdf_count; i++) {
 601                         wpa_printf(MSG_DEBUG, "   AT_KDF");
 602                         eap_sim_msg_add(msg, EAP_SIM_AT_KDF, attr->kdf[i],
 603                                         NULL, 0);
 604                 }
 605         }
 606         return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
 607 }
 608
 609
 610 static struct wpabuf * eap_aka_response_identity(struct eap_sm *sm,
 611                                                  struct eap_aka_data *data,
 612                                                  u8 id,
 613                                                  enum eap_sim_id_req id_req)
 614 {
 615         const u8 *identity = NULL;
 616         size_t identity_len = 0;
 617         struct eap_sim_msg *msg;
 618
 619         data->reauth = 0;
 620         if (id_req == ANY_ID && data->reauth_id) {
 621                 identity = data->reauth_id;
 622                 identity_len = data->reauth_id_len;
 623                 data->reauth = 1;
 624         } else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
 625                    data->pseudonym) {
 626                 identity = data->pseudonym;
 627                 identity_len = data->pseudonym_len;
 628                 eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID);
 629         } else if (id_req != NO_ID_REQ) {
 630                 identity = eap_get_config_identity(sm, &identity_len);
 631                 if (identity) {
 632                         eap_aka_clear_identities(sm, data, CLEAR_PSEUDONYM |
 633                                                  CLEAR_REAUTH_ID);
 634                 }
 635         }
 636         if (id_req != NO_ID_REQ)
 637                 eap_aka_clear_identities(sm, data, CLEAR_EAP_ID);
 638
 639         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Identity (id=%d)", id);
 640         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 641                                EAP_AKA_SUBTYPE_IDENTITY);
 642
 643         if (identity) {
 644                 wpa_hexdump_ascii(MSG_DEBUG, "   AT_IDENTITY",
 645                                   identity, identity_len);
 646                 eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
 647                                 identity, identity_len);
 648         }
 649
 650         return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
 651 }
 652
 653
 654 static struct wpabuf * eap_aka_response_challenge(struct eap_aka_data *data,
 655                                                   u8 id)
 656 {
 657         struct eap_sim_msg *msg;
 658
 659         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d)", id);
 660         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 661                                EAP_AKA_SUBTYPE_CHALLENGE);
 662         wpa_printf(MSG_DEBUG, "   AT_RES");
 663         eap_sim_msg_add(msg, EAP_SIM_AT_RES, data->res_len * 8,
 664                         data->res, data->res_len);
 665         eap_aka_add_checkcode(data, msg);
 666         if (data->use_result_ind) {
 667                 wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 668                 eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 669         }
 670         wpa_printf(MSG_DEBUG, "   AT_MAC");
 671         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 672         return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, (u8 *) "",
 673                                   0);
 674 }
 675
 676
 677 static struct wpabuf * eap_aka_response_reauth(struct eap_aka_data *data,
 678                                                u8 id, int counter_too_small,
 679                                                const u8 *nonce_s)
 680 {
 681         struct eap_sim_msg *msg;
 682         unsigned int counter;
 683
 684         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Reauthentication (id=%d)",
 685                    id);
 686         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 687                                EAP_AKA_SUBTYPE_REAUTHENTICATION);
 688         wpa_printf(MSG_DEBUG, "   AT_IV");
 689         wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 690         eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
 691
 692         if (counter_too_small) {
 693                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER_TOO_SMALL");
 694                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
 695                 counter = data->counter_too_small;
 696         } else
 697                 counter = data->counter;
 698
 699         wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", counter);
 700         eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
 701
 702         if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
 703                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 704                            "AT_ENCR_DATA");
 705                 eap_sim_msg_free(msg);
 706                 return NULL;
 707         }
 708         eap_aka_add_checkcode(data, msg);
 709         if (data->use_result_ind) {
 710                 wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 711                 eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 712         }
 713         wpa_printf(MSG_DEBUG, "   AT_MAC");
 714         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 715         return eap_sim_msg_finish(msg, data->eap_method, data->k_aut, nonce_s,
 716                                   EAP_SIM_NONCE_S_LEN);
 717 }
 718
 719
 720 static struct wpabuf * eap_aka_response_notification(struct eap_aka_data *data,
 721                                                      u8 id, u16 notification)
 722 {
 723         struct eap_sim_msg *msg;
 724         u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
 725
 726         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Notification (id=%d)", id);
 727         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 728                                EAP_AKA_SUBTYPE_NOTIFICATION);
 729         if (k_aut && data->reauth) {
 730                 wpa_printf(MSG_DEBUG, "   AT_IV");
 731                 wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 732                 eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
 733                                            EAP_SIM_AT_ENCR_DATA);
 734                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", data->counter);
 735                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
 736                                 NULL, 0);
 737                 if (eap_sim_msg_add_encr_end(msg, data->k_encr,
 738                                              EAP_SIM_AT_PADDING)) {
 739                         wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 740                                    "AT_ENCR_DATA");
 741                         eap_sim_msg_free(msg);
 742                         return NULL;
 743                 }
 744         }
 745         if (k_aut) {
 746                 wpa_printf(MSG_DEBUG, "   AT_MAC");
 747                 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 748         }
 749         return eap_sim_msg_finish(msg, data->eap_method, k_aut, (u8 *) "", 0);
 750 }
 751
 752
 753 static struct wpabuf * eap_aka_process_identity(struct eap_sm *sm,
 754                                                 struct eap_aka_data *data,
 755                                                 u8 id,
 756                                                 const struct wpabuf *reqData,
 757                                                 struct eap_sim_attrs *attr)
 758 {
 759         int id_error;
 760         struct wpabuf *buf;
 761
 762         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Identity");
 763
 764         id_error = 0;
 765         switch (attr->id_req) {
 766         case NO_ID_REQ:
 767                 break;
 768         case ANY_ID:
 769                 if (data->num_id_req > 0)
 770                         id_error++;
 771                 data->num_id_req++;
 772                 break;
 773         case FULLAUTH_ID:
 774                 if (data->num_id_req > 1)
 775                         id_error++;
 776                 data->num_id_req++;
 777                 break;
 778         case PERMANENT_ID:
 779                 if (data->num_id_req > 2)
 780                         id_error++;
 781                 data->num_id_req++;
 782                 break;
 783         }
 784         if (id_error) {
 785                 wpa_printf(MSG_INFO, "EAP-AKA: Too many ID requests "
 786                            "used within one authentication");
 787                 return eap_aka_client_error(data, id,
 788                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 789         }
 790
 791         buf = eap_aka_response_identity(sm, data, id, attr->id_req);
 792
 793         if (data->prev_id != id) {
 794                 eap_aka_add_id_msg(data, reqData);
 795                 eap_aka_add_id_msg(data, buf);
 796                 data->prev_id = id;
 797         }
 798
 799         return buf;
 800 }
 801
 802
 803 static int eap_aka_verify_mac(struct eap_aka_data *data,
 804                               const struct wpabuf *req,
 805                               const u8 *mac, const u8 *extra,
 806                               size_t extra_len)
 807 {
 808         if (data->eap_method == EAP_TYPE_AKA_PRIME)
 809                 return eap_sim_verify_mac_sha256(data->k_aut, req, mac, extra,
 810                                                  extra_len);
 811         return eap_sim_verify_mac(data->k_aut, req, mac, extra, extra_len);
 812 }
 813
 814
 815 #ifdef EAP_AKA_PRIME
 816 static struct wpabuf * eap_aka_prime_kdf_select(struct eap_aka_data *data,
 817                                                 u8 id, u16 kdf)
 818 {
 819         struct eap_sim_msg *msg;
 820
 821         data->kdf_negotiation = 1;
 822         data->kdf = kdf;
 823         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d) (KDF "
 824                    "select)", id);
 825         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, data->eap_method,
 826                                EAP_AKA_SUBTYPE_CHALLENGE);
 827         wpa_printf(MSG_DEBUG, "   AT_KDF");
 828         eap_sim_msg_add(msg, EAP_SIM_AT_KDF, kdf, NULL, 0);
 829         return eap_sim_msg_finish(msg, data->eap_method, NULL, NULL, 0);
 830 }
 831
 832
 833 static struct wpabuf * eap_aka_prime_kdf_neg(struct eap_aka_data *data,
 834                                              u8 id, struct eap_sim_attrs *attr)
 835 {
 836         size_t i;
 837
 838         for (i = 0; i < attr->kdf_count; i++) {
 839                 if (attr->kdf[i] == EAP_AKA_PRIME_KDF) {
 840                         os_memcpy(data->last_kdf_attrs, attr->kdf,
 841                                   sizeof(u16) * attr->kdf_count);
 842                         data->last_kdf_count = attr->kdf_count;
 843                         return eap_aka_prime_kdf_select(data, id,
 844                                                         EAP_AKA_PRIME_KDF);
 845                 }
 846         }
 847
 848         /* No matching KDF found - fail authentication as if AUTN had been
 849          * incorrect */
 850         return eap_aka_authentication_reject(data, id);
 851 }
 852
 853
 854 static int eap_aka_prime_kdf_valid(struct eap_aka_data *data,
 855                                    struct eap_sim_attrs *attr)
 856 {
 857         size_t i, j;
 858
 859         if (attr->kdf_count == 0)
 860                 return 0;
 861
 862         /* The only allowed (and required) duplication of a KDF is the addition
 863          * of the selected KDF into the beginning of the list. */
 864
 865         if (data->kdf_negotiation) {
 866                 /* When the peer receives the new EAP-Request/AKA'-Challenge
 867                  * message, must check only requested change occurred in the
 868                  * list of AT_KDF attributes. If there are any other changes,
 869                  * the peer must behave like the case that AT_MAC had been
 870                  * incorrect and authentication is failed. These are defined in
 871                  * EAP-AKA' specification RFC 5448, Section 3.2. */
 872                 if (attr->kdf[0] != data->kdf) {
 873                         wpa_printf(MSG_WARNING, "EAP-AKA': The server did not "
 874                                    "accept the selected KDF");
 875                         return -1;
 876                 }
 877
 878                 if (attr->kdf_count > EAP_AKA_PRIME_KDF_MAX ||
 879                     attr->kdf_count != data->last_kdf_count + 1) {
 880                         wpa_printf(MSG_WARNING,
 881                                    "EAP-AKA': The length of KDF attributes is wrong");
 882                         return -1;
 883                 }
 884
 885                 for (i = 1; i < attr->kdf_count; i++) {
 886                         if (attr->kdf[i] != data->last_kdf_attrs[i - 1]) {
 887                                 wpa_printf(MSG_WARNING,
 888                                            "EAP-AKA': The KDF attributes except selected KDF are not same as original one");
 889                                 return -1;
 890                         }
 891                 }
 892         }
 893
 894         for (i = data->kdf ? 1 : 0; i < attr->kdf_count; i++) {
 895                 for (j = i + 1; j < attr->kdf_count; j++) {
 896                         if (attr->kdf[i] == attr->kdf[j]) {
 897                                 wpa_printf(MSG_WARNING, "EAP-AKA': The server "
 898                                            "included a duplicated KDF");
 899                                 return 0;
 900                         }
 901                 }
 902         }
 903
 904         return 1;
 905 }
 906 #endif /* EAP_AKA_PRIME */
 907
 908
 909 static struct wpabuf * eap_aka_process_challenge(struct eap_sm *sm,
 910                                                  struct eap_aka_data *data,
 911                                                  u8 id,
 912                                                  const struct wpabuf *reqData,
 913                                                  struct eap_sim_attrs *attr)
 914 {
 915         const u8 *identity;
 916         size_t identity_len;
 917         int res;
 918         struct eap_sim_attrs eattr;
 919
 920         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Challenge");
 921
 922         if (attr->checkcode &&
 923             eap_aka_verify_checkcode(data, attr->checkcode,
 924                                      attr->checkcode_len)) {
 925                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
 926                            "message");
 927                 return eap_aka_client_error(data, id,
 928                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 929         }
 930
 931 #ifdef EAP_AKA_PRIME
 932         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 933                 if (!attr->kdf_input || attr->kdf_input_len == 0) {
 934                         wpa_printf(MSG_WARNING, "EAP-AKA': Challenge message "
 935                                    "did not include non-empty AT_KDF_INPUT");
 936                         /* Fail authentication as if AUTN had been incorrect */
 937                         return eap_aka_authentication_reject(data, id);
 938                 }
 939                 os_free(data->network_name);
 940                 data->network_name = os_memdup(attr->kdf_input,
 941                                                attr->kdf_input_len);
 942                 if (data->network_name == NULL) {
 943                         wpa_printf(MSG_WARNING, "EAP-AKA': No memory for "
 944                                    "storing Network Name");
 945                         return eap_aka_authentication_reject(data, id);
 946                 }
 947                 data->network_name_len = attr->kdf_input_len;
 948                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA': Network Name "
 949                                   "(AT_KDF_INPUT)",
 950                                   data->network_name, data->network_name_len);
 951                 /* TODO: check Network Name per 3GPP.33.402 */
 952
 953                 res = eap_aka_prime_kdf_valid(data, attr);
 954                 if (res == 0)
 955                         return eap_aka_authentication_reject(data, id);
 956                 else if (res == -1)
 957                         return eap_aka_client_error(
 958                                 data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 959
 960                 if (attr->kdf[0] != EAP_AKA_PRIME_KDF)
 961                         return eap_aka_prime_kdf_neg(data, id, attr);
 962
 963                 data->kdf = EAP_AKA_PRIME_KDF;
 964                 wpa_printf(MSG_DEBUG, "EAP-AKA': KDF %d selected", data->kdf);
 965         }
 966
 967         if (data->eap_method == EAP_TYPE_AKA && attr->bidding) {
 968                 u16 flags = WPA_GET_BE16(attr->bidding);
 969                 if ((flags & EAP_AKA_BIDDING_FLAG_D) &&
 970                     eap_allowed_method(sm, EAP_VENDOR_IETF,
 971                                        EAP_TYPE_AKA_PRIME)) {
 972                         wpa_printf(MSG_WARNING, "EAP-AKA: Bidding down from "
 973                                    "AKA' to AKA detected");
 974                         /* Fail authentication as if AUTN had been incorrect */
 975                         return eap_aka_authentication_reject(data, id);
 976                 }
 977         }
 978 #endif /* EAP_AKA_PRIME */
 979
 980         data->reauth = 0;
 981         if (!attr->mac || !attr->rand || !attr->autn) {
 982                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
 983                            "did not include%s%s%s",
 984                            !attr->mac ? " AT_MAC" : "",
 985                            !attr->rand ? " AT_RAND" : "",
 986                            !attr->autn ? " AT_AUTN" : "");
 987                 return eap_aka_client_error(data, id,
 988                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 989         }
 990         os_memcpy(data->rand, attr->rand, EAP_AKA_RAND_LEN);
 991         os_memcpy(data->autn, attr->autn, EAP_AKA_AUTN_LEN);
 992
 993         res = eap_aka_umts_auth(sm, data);
 994         if (res == -1) {
 995                 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
 996                            "failed (AUTN)");
 997                 return eap_aka_authentication_reject(data, id);
 998         } else if (res == -2) {
 999                 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
1000                            "failed (AUTN seq# -> AUTS)");
1001                 return eap_aka_synchronization_failure(data, id, attr);
1002         } else if (res > 0) {
1003                 wpa_printf(MSG_DEBUG, "EAP-AKA: Wait for external USIM processing");
1004                 return NULL;
1005         } else if (res) {
1006                 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication failed");
1007                 return eap_aka_client_error(data, id,
1008                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1009         }
1010 #ifdef EAP_AKA_PRIME
1011         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1012                 /* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
1013                  * needed 6-octet SQN ^ AK for CK',IK' derivation */
1014                 u16 amf = WPA_GET_BE16(data->autn + 6);
1015                 if (!(amf & 0x8000)) {
1016                         wpa_printf(MSG_WARNING, "EAP-AKA': AMF separation bit "
1017                                    "not set (AMF=0x%4x)", amf);
1018                         return eap_aka_authentication_reject(data, id);
1019                 }
1020                 eap_aka_prime_derive_ck_ik_prime(data->ck, data->ik,
1021                                                  data->autn,
1022                                                  data->network_name,
1023                                                  data->network_name_len);
1024         }
1025 #endif /* EAP_AKA_PRIME */
1026         if (data->last_eap_identity) {
1027                 identity = data->last_eap_identity;
1028                 identity_len = data->last_eap_identity_len;
1029         } else if (data->pseudonym) {
1030                 identity = data->pseudonym;
1031                 identity_len = data->pseudonym_len;
1032         } else {
1033                 struct eap_peer_config *config;
1034
1035                 config = eap_get_config(sm);
1036                 if (config && config->imsi_identity) {
1037                         identity = config->imsi_identity;
1038                         identity_len = config->imsi_identity_len;
1039                 } else {
1040                         identity = eap_get_config_identity(sm, &identity_len);
1041                 }
1042         }
1043         wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
1044                           "derivation", identity, identity_len);
1045         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1046                 eap_aka_prime_derive_keys(identity, identity_len, data->ik,
1047                                           data->ck, data->k_encr, data->k_aut,
1048                                           data->k_re, data->msk, data->emsk);
1049         } else {
1050                 eap_aka_derive_mk(identity, identity_len, data->ik, data->ck,
1051                                   data->mk);
1052                 eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
1053                                     data->msk, data->emsk);
1054         }
1055         if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1056                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
1057                            "used invalid AT_MAC");
1058                 return eap_aka_client_error(data, id,
1059                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1060         }
1061
1062         /* Old reauthentication identity must not be used anymore. In
1063          * other words, if no new identities are received, full
1064          * authentication will be used on next reauthentication (using
1065          * pseudonym identity or permanent identity). */
1066         eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1067
1068         if (attr->encr_data) {
1069                 u8 *decrypted;
1070                 decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1071                                                attr->encr_data_len, attr->iv,
1072                                                &eattr, 0);
1073                 if (decrypted == NULL) {
1074                         return eap_aka_client_error(
1075                                 data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1076                 }
1077                 eap_aka_learn_ids(sm, data, &eattr);
1078                 os_free(decrypted);
1079         }
1080
1081         if (data->result_ind && attr->result_ind)
1082                 data->use_result_ind = 1;
1083
1084         if (data->state != FAILURE) {
1085                 eap_aka_state(data, data->use_result_ind ?
1086                               RESULT_SUCCESS : SUCCESS);
1087         }
1088
1089         data->num_id_req = 0;
1090         data->num_notification = 0;
1091         /* RFC 4187 specifies that counter is initialized to one after
1092          * fullauth, but initializing it to zero makes it easier to implement
1093          * reauth verification. */
1094         data->counter = 0;
1095         return eap_aka_response_challenge(data, id);
1096 }
1097
1098
1099 static int eap_aka_process_notification_reauth(struct eap_aka_data *data,
1100                                                struct eap_sim_attrs *attr)
1101 {
1102         struct eap_sim_attrs eattr;
1103         u8 *decrypted;
1104
1105         if (attr->encr_data == NULL || attr->iv == NULL) {
1106                 wpa_printf(MSG_WARNING, "EAP-AKA: Notification message after "
1107                            "reauth did not include encrypted data");
1108                 return -1;
1109         }
1110
1111         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1112                                        attr->encr_data_len, attr->iv, &eattr,
1113                                        0);
1114         if (decrypted == NULL) {
1115                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1116                            "data from notification message");
1117                 return -1;
1118         }
1119
1120         if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
1121                 wpa_printf(MSG_WARNING, "EAP-AKA: Counter in notification "
1122                            "message does not match with counter in reauth "
1123                            "message");
1124                 os_free(decrypted);
1125                 return -1;
1126         }
1127
1128         os_free(decrypted);
1129         return 0;
1130 }
1131
1132
1133 static int eap_aka_process_notification_auth(struct eap_aka_data *data,
1134                                              const struct wpabuf *reqData,
1135                                              struct eap_sim_attrs *attr)
1136 {
1137         if (attr->mac == NULL) {
1138                 wpa_printf(MSG_INFO, "EAP-AKA: no AT_MAC in after_auth "
1139                            "Notification message");
1140                 return -1;
1141         }
1142
1143         if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1144                 wpa_printf(MSG_WARNING, "EAP-AKA: Notification message "
1145                            "used invalid AT_MAC");
1146                 return -1;
1147         }
1148
1149         if (data->reauth &&
1150             eap_aka_process_notification_reauth(data, attr)) {
1151                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid notification "
1152                            "message after reauth");
1153                 return -1;
1154         }
1155
1156         return 0;
1157 }
1158
1159
1160 static struct wpabuf * eap_aka_process_notification(
1161         struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1162         const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1163 {
1164         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Notification");
1165         if (data->num_notification > 0) {
1166                 wpa_printf(MSG_INFO, "EAP-AKA: too many notification "
1167                            "rounds (only one allowed)");
1168                 return eap_aka_client_error(data, id,
1169                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1170         }
1171         data->num_notification++;
1172         if (attr->notification == -1) {
1173                 wpa_printf(MSG_INFO, "EAP-AKA: no AT_NOTIFICATION in "
1174                            "Notification message");
1175                 return eap_aka_client_error(data, id,
1176                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1177         }
1178
1179         if ((attr->notification & 0x4000) == 0 &&
1180             eap_aka_process_notification_auth(data, reqData, attr)) {
1181                 return eap_aka_client_error(data, id,
1182                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1183         }
1184
1185         eap_sim_report_notification(sm->msg_ctx, attr->notification, 1);
1186         if (attr->notification >= 0 && attr->notification < 32768) {
1187                 data->error_code = attr->notification;
1188                 eap_aka_state(data, FAILURE);
1189         } else if (attr->notification == EAP_SIM_SUCCESS &&
1190                    data->state == RESULT_SUCCESS)
1191                 eap_aka_state(data, SUCCESS);
1192         return eap_aka_response_notification(data, id, attr->notification);
1193 }
1194
1195
1196 static struct wpabuf * eap_aka_process_reauthentication(
1197         struct eap_sm *sm, struct eap_aka_data *data, u8 id,
1198         const struct wpabuf *reqData, struct eap_sim_attrs *attr)
1199 {
1200         struct eap_sim_attrs eattr;
1201         u8 *decrypted;
1202
1203         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Reauthentication");
1204
1205         if (attr->checkcode &&
1206             eap_aka_verify_checkcode(data, attr->checkcode,
1207                                      attr->checkcode_len)) {
1208                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
1209                            "message");
1210                 return eap_aka_client_error(data, id,
1211                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1212         }
1213
1214         if (data->reauth_id == NULL) {
1215                 wpa_printf(MSG_WARNING, "EAP-AKA: Server is trying "
1216                            "reauthentication, but no reauth_id available");
1217                 return eap_aka_client_error(data, id,
1218                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1219         }
1220
1221         data->reauth = 1;
1222         if (eap_aka_verify_mac(data, reqData, attr->mac, (u8 *) "", 0)) {
1223                 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1224                            "did not have valid AT_MAC");
1225                 return eap_aka_client_error(data, id,
1226                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1227         }
1228
1229         if (attr->encr_data == NULL || attr->iv == NULL) {
1230                 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1231                            "message did not include encrypted data");
1232                 return eap_aka_client_error(data, id,
1233                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1234         }
1235
1236         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1237                                        attr->encr_data_len, attr->iv, &eattr,
1238                                        0);
1239         if (decrypted == NULL) {
1240                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1241                            "data from reauthentication message");
1242                 return eap_aka_client_error(data, id,
1243                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1244         }
1245
1246         if (eattr.nonce_s == NULL || eattr.counter < 0) {
1247                 wpa_printf(MSG_INFO, "EAP-AKA: (encr) No%s%s in reauth packet",
1248                            !eattr.nonce_s ? " AT_NONCE_S" : "",
1249                            eattr.counter < 0 ? " AT_COUNTER" : "");
1250                 os_free(decrypted);
1251                 return eap_aka_client_error(data, id,
1252                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1253         }
1254
1255         if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
1256                 struct wpabuf *res;
1257                 wpa_printf(MSG_INFO, "EAP-AKA: (encr) Invalid counter "
1258                            "(%d <= %d)", eattr.counter, data->counter);
1259                 data->counter_too_small = eattr.counter;
1260
1261                 /* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
1262                  * reauth_id must not be used to start a new reauthentication.
1263                  * However, since it was used in the last EAP-Response-Identity
1264                  * packet, it has to saved for the following fullauth to be
1265                  * used in MK derivation. */
1266                 os_free(data->last_eap_identity);
1267                 data->last_eap_identity = data->reauth_id;
1268                 data->last_eap_identity_len = data->reauth_id_len;
1269                 data->reauth_id = NULL;
1270                 data->reauth_id_len = 0;
1271
1272                 res = eap_aka_response_reauth(data, id, 1, eattr.nonce_s);
1273                 os_free(decrypted);
1274
1275                 return res;
1276         }
1277         data->counter = eattr.counter;
1278
1279         os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
1280         wpa_hexdump(MSG_DEBUG, "EAP-AKA: (encr) AT_NONCE_S",
1281                     data->nonce_s, EAP_SIM_NONCE_S_LEN);
1282
1283         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1284                 eap_aka_prime_derive_keys_reauth(data->k_re, data->counter,
1285                                                  data->reauth_id,
1286                                                  data->reauth_id_len,
1287                                                  data->nonce_s,
1288                                                  data->msk, data->emsk);
1289         } else {
1290                 eap_sim_derive_keys_reauth(data->counter, data->reauth_id,
1291                                            data->reauth_id_len,
1292                                            data->nonce_s, data->mk,
1293                                            data->msk, data->emsk);
1294         }
1295         eap_aka_clear_identities(sm, data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1296         eap_aka_learn_ids(sm, data, &eattr);
1297
1298         if (data->result_ind && attr->result_ind)
1299                 data->use_result_ind = 1;
1300
1301         if (data->state != FAILURE) {
1302                 eap_aka_state(data, data->use_result_ind ?
1303                               RESULT_SUCCESS : SUCCESS);
1304         }
1305
1306         data->num_id_req = 0;
1307         data->num_notification = 0;
1308         if (data->counter > EAP_AKA_MAX_FAST_REAUTHS) {
1309                 wpa_printf(MSG_DEBUG, "EAP-AKA: Maximum number of "
1310                            "fast reauths performed - force fullauth");
1311                 eap_aka_clear_identities(sm, data,
1312                                          CLEAR_REAUTH_ID | CLEAR_EAP_ID);
1313         }
1314         os_free(decrypted);
1315         return eap_aka_response_reauth(data, id, 0, data->nonce_s);
1316 }
1317
1318
1319 static struct wpabuf * eap_aka_process(struct eap_sm *sm, void *priv,
1320                                        struct eap_method_ret *ret,
1321                                        const struct wpabuf *reqData)
1322 {
1323         struct eap_aka_data *data = priv;
1324         const struct eap_hdr *req;
1325         u8 subtype, id;
1326         struct wpabuf *res;
1327         const u8 *pos;
1328         struct eap_sim_attrs attr;
1329         size_t len;
1330
1331         wpa_hexdump_buf(MSG_DEBUG, "EAP-AKA: EAP data", reqData);
1332         if (eap_get_config_identity(sm, &len) == NULL) {
1333                 wpa_printf(MSG_INFO, "EAP-AKA: Identity not configured");
1334                 eap_sm_request_identity(sm);
1335                 ret->ignore = TRUE;
1336                 return NULL;
1337         }
1338
1339         pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, reqData,
1340                                &len);
1341         if (pos == NULL || len < 3) {
1342                 ret->ignore = TRUE;
1343                 return NULL;
1344         }
1345         req = wpabuf_head(reqData);
1346         id = req->identifier;
1347         len = be_to_host16(req->length);
1348
1349         ret->ignore = FALSE;
1350         ret->methodState = METHOD_MAY_CONT;
1351         ret->decision = DECISION_FAIL;
1352         ret->allowNotifications = TRUE;
1353
1354         subtype = *pos++;
1355         wpa_printf(MSG_DEBUG, "EAP-AKA: Subtype=%d", subtype);
1356         pos += 2; /* Reserved */
1357
1358         if (eap_sim_parse_attr(pos, wpabuf_head_u8(reqData) + len, &attr,
1359                                data->eap_method == EAP_TYPE_AKA_PRIME ? 2 : 1,
1360                                0)) {
1361                 res = eap_aka_client_error(data, id,
1362                                            EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1363                 goto done;
1364         }
1365
1366         switch (subtype) {
1367         case EAP_AKA_SUBTYPE_IDENTITY:
1368                 res = eap_aka_process_identity(sm, data, id, reqData, &attr);
1369                 break;
1370         case EAP_AKA_SUBTYPE_CHALLENGE:
1371                 res = eap_aka_process_challenge(sm, data, id, reqData, &attr);
1372                 break;
1373         case EAP_AKA_SUBTYPE_NOTIFICATION:
1374                 res = eap_aka_process_notification(sm, data, id, reqData,
1375                                                    &attr);
1376                 break;
1377         case EAP_AKA_SUBTYPE_REAUTHENTICATION:
1378                 res = eap_aka_process_reauthentication(sm, data, id, reqData,
1379                                                        &attr);
1380                 break;
1381         case EAP_AKA_SUBTYPE_CLIENT_ERROR:
1382                 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Client-Error");
1383                 res = eap_aka_client_error(data, id,
1384                                            EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1385                 break;
1386         default:
1387                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown subtype=%d", subtype);
1388                 res = eap_aka_client_error(data, id,
1389                                            EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1390                 break;
1391         }
1392
1393 done:
1394         if (data->state == FAILURE) {
1395                 ret->decision = DECISION_FAIL;
1396                 ret->methodState = METHOD_DONE;
1397         } else if (data->state == SUCCESS) {
1398                 ret->decision = data->use_result_ind ?
1399                         DECISION_UNCOND_SUCC : DECISION_COND_SUCC;
1400                 /*
1401                  * It is possible for the server to reply with AKA
1402                  * Notification, so we must allow the method to continue and
1403                  * not only accept EAP-Success at this point.
1404                  */
1405                 ret->methodState = data->use_result_ind ?
1406                         METHOD_DONE : METHOD_MAY_CONT;
1407         } else if (data->state == RESULT_SUCCESS)
1408                 ret->methodState = METHOD_CONT;
1409
1410         if (ret->methodState == METHOD_DONE) {
1411                 ret->allowNotifications = FALSE;
1412         }
1413
1414         return res;
1415 }
1416
1417
1418 static Boolean eap_aka_has_reauth_data(struct eap_sm *sm, void *priv)
1419 {
1420         struct eap_aka_data *data = priv;
1421         return data->pseudonym || data->reauth_id;
1422 }
1423
1424
1425 static void eap_aka_deinit_for_reauth(struct eap_sm *sm, void *priv)
1426 {
1427         struct eap_aka_data *data = priv;
1428         eap_aka_clear_identities(sm, data, CLEAR_EAP_ID);
1429         data->prev_id = -1;
1430         wpabuf_free(data->id_msgs);
1431         data->id_msgs = NULL;
1432         data->use_result_ind = 0;
1433         data->kdf_negotiation = 0;
1434         eap_aka_clear_keys(data, 1);
1435 }
1436
1437
1438 static void * eap_aka_init_for_reauth(struct eap_sm *sm, void *priv)
1439 {
1440         struct eap_aka_data *data = priv;
1441         data->num_id_req = 0;
1442         data->num_notification = 0;
1443         eap_aka_state(data, CONTINUE);
1444         return priv;
1445 }
1446
1447
1448 static const u8 * eap_aka_get_identity(struct eap_sm *sm, void *priv,
1449                                        size_t *len)
1450 {
1451         struct eap_aka_data *data = priv;
1452
1453         if (data->reauth_id) {
1454                 *len = data->reauth_id_len;
1455                 return data->reauth_id;
1456         }
1457
1458         if (data->pseudonym) {
1459                 *len = data->pseudonym_len;
1460                 return data->pseudonym;
1461         }
1462
1463         return NULL;
1464 }
1465
1466
1467 static Boolean eap_aka_isKeyAvailable(struct eap_sm *sm, void *priv)
1468 {
1469         struct eap_aka_data *data = priv;
1470         return data->state == SUCCESS;
1471 }
1472
1473
1474 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1475 {
1476         struct eap_aka_data *data = priv;
1477         u8 *key;
1478
1479         if (data->state != SUCCESS)
1480                 return NULL;
1481
1482         key = os_memdup(data->msk, EAP_SIM_KEYING_DATA_LEN);
1483         if (key == NULL)
1484                 return NULL;
1485
1486         *len = EAP_SIM_KEYING_DATA_LEN;
1487
1488         return key;
1489 }
1490
1491
1492 static u8 * eap_aka_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1493 {
1494         struct eap_aka_data *data = priv;
1495         u8 *id;
1496
1497         if (data->state != SUCCESS)
1498                 return NULL;
1499
1500         *len = 1 + EAP_AKA_RAND_LEN + EAP_AKA_AUTN_LEN;
1501         id = os_malloc(*len);
1502         if (id == NULL)
1503                 return NULL;
1504
1505         id[0] = data->eap_method;
1506         os_memcpy(id + 1, data->rand, EAP_AKA_RAND_LEN);
1507         os_memcpy(id + 1 + EAP_AKA_RAND_LEN, data->autn, EAP_AKA_AUTN_LEN);
1508         wpa_hexdump(MSG_DEBUG, "EAP-AKA: Derived Session-Id", id, *len);
1509
1510         return id;
1511 }
1512
1513
1514 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1515 {
1516         struct eap_aka_data *data = priv;
1517         u8 *key;
1518
1519         if (data->state != SUCCESS)
1520                 return NULL;
1521
1522         key = os_memdup(data->emsk, EAP_EMSK_LEN);
1523         if (key == NULL)
1524                 return NULL;
1525
1526         *len = EAP_EMSK_LEN;
1527
1528         return key;
1529 }
1530
1531
1532 static int eap_aka_get_error_code(void *priv)
1533 {
1534         struct eap_aka_data *data = priv;
1535         int current_data_error;
1536
1537         if (!data)
1538                 return NO_EAP_METHOD_ERROR;
1539
1540         current_data_error = data->error_code;
1541
1542         /* Now reset for next transaction */
1543         data->error_code = NO_EAP_METHOD_ERROR;
1544
1545         return current_data_error;
1546 }
1547
1548
1549 int eap_peer_aka_register(void)
1550 {
1551         struct eap_method *eap;
1552
1553         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1554                                     EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1555         if (eap == NULL)
1556                 return -1;
1557
1558         eap->init = eap_aka_init;
1559         eap->deinit = eap_aka_deinit;
1560         eap->process = eap_aka_process;
1561         eap->isKeyAvailable = eap_aka_isKeyAvailable;
1562         eap->getKey = eap_aka_getKey;
1563         eap->getSessionId = eap_aka_get_session_id;
1564         eap->has_reauth_data = eap_aka_has_reauth_data;
1565         eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1566         eap->init_for_reauth = eap_aka_init_for_reauth;
1567         eap->get_identity = eap_aka_get_identity;
1568         eap->get_emsk = eap_aka_get_emsk;
1569         eap->get_error_code = eap_aka_get_error_code;
1570
1571         return eap_peer_method_register(eap);
1572 }
1573
1574
1575 #ifdef EAP_AKA_PRIME
1576 int eap_peer_aka_prime_register(void)
1577 {
1578         struct eap_method *eap;
1579
1580         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1581                                     EAP_VENDOR_IETF, EAP_TYPE_AKA_PRIME,
1582                                     "AKA'");
1583         if (eap == NULL)
1584                 return -1;
1585
1586         eap->init = eap_aka_prime_init;
1587         eap->deinit = eap_aka_deinit;
1588         eap->process = eap_aka_process;
1589         eap->isKeyAvailable = eap_aka_isKeyAvailable;
1590         eap->getKey = eap_aka_getKey;
1591         eap->getSessionId = eap_aka_get_session_id;
1592         eap->has_reauth_data = eap_aka_has_reauth_data;
1593         eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1594         eap->init_for_reauth = eap_aka_init_for_reauth;
1595         eap->get_identity = eap_aka_get_identity;
1596         eap->get_emsk = eap_aka_get_emsk;
1597         eap->get_error_code = eap_aka_get_error_code;
1598
1599         return eap_peer_method_register(eap);
1600 }
1601 #endif /* EAP_AKA_PRIME */