contrib/hostapd/eap_aka.c

   1 /*
   2  * hostapd / EAP-AKA (RFC 4187)
   3  * Copyright (c) 2005-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "hostapd.h"
  18 #include "common.h"
  19 #include "crypto.h"
  20 #include "eap_i.h"
  21 #include "eap_sim_common.h"
  22 #include "eap_sim_db.h"
  23
  24
  25 struct eap_aka_data {
  26         u8 mk[EAP_SIM_MK_LEN];
  27         u8 nonce_s[EAP_SIM_NONCE_S_LEN];
  28         u8 k_aut[EAP_SIM_K_AUT_LEN];
  29         u8 k_encr[EAP_SIM_K_ENCR_LEN];
  30         u8 msk[EAP_SIM_KEYING_DATA_LEN];
  31         u8 emsk[EAP_EMSK_LEN];
  32         u8 rand[EAP_AKA_RAND_LEN];
  33         u8 autn[EAP_AKA_AUTN_LEN];
  34         u8 ck[EAP_AKA_CK_LEN];
  35         u8 ik[EAP_AKA_IK_LEN];
  36         u8 res[EAP_AKA_RES_MAX_LEN];
  37         size_t res_len;
  38         enum {
  39                 IDENTITY, CHALLENGE, REAUTH, NOTIFICATION, SUCCESS, FAILURE
  40         } state;
  41         char *next_pseudonym;
  42         char *next_reauth_id;
  43         u16 counter;
  44         struct eap_sim_reauth *reauth;
  45         int auts_reported; /* whether the current AUTS has been reported to the
  46                             * eap_sim_db */
  47         u16 notification;
  48 };
  49
  50
  51 static void eap_aka_determine_identity(struct eap_sm *sm,
  52                                        struct eap_aka_data *data,
  53                                        int before_identity, int after_reauth);
  54
  55
  56 static const char * eap_aka_state_txt(int state)
  57 {
  58         switch (state) {
  59         case IDENTITY:
  60                 return "IDENTITY";
  61         case CHALLENGE:
  62                 return "CHALLENGE";
  63         case REAUTH:
  64                 return "REAUTH";
  65         case SUCCESS:
  66                 return "SUCCESS";
  67         case FAILURE:
  68                 return "FAILURE";
  69         case NOTIFICATION:
  70                 return "NOTIFICATION";
  71         default:
  72                 return "Unknown?!";
  73         }
  74 }
  75
  76
  77 static void eap_aka_state(struct eap_aka_data *data, int state)
  78 {
  79         wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
  80                    eap_aka_state_txt(data->state),
  81                    eap_aka_state_txt(state));
  82         data->state = state;
  83 }
  84
  85
  86 static void * eap_aka_init(struct eap_sm *sm)
  87 {
  88         struct eap_aka_data *data;
  89
  90         if (sm->eap_sim_db_priv == NULL) {
  91                 wpa_printf(MSG_WARNING, "EAP-AKA: eap_sim_db not configured");
  92                 return NULL;
  93         }
  94
  95         data = wpa_zalloc(sizeof(*data));
  96         if (data == NULL)
  97                 return NULL;
  98         data->state = IDENTITY;
  99         eap_aka_determine_identity(sm, data, 1, 0);
 100
 101         return data;
 102 }
 103
 104
 105 static void eap_aka_reset(struct eap_sm *sm, void *priv)
 106 {
 107         struct eap_aka_data *data = priv;
 108         free(data->next_pseudonym);
 109         free(data->next_reauth_id);
 110         free(data);
 111 }
 112
 113
 114 static u8 * eap_aka_build_identity(struct eap_sm *sm,
 115                                    struct eap_aka_data *data,
 116                                    int id, size_t *reqDataLen)
 117 {
 118         struct eap_sim_msg *msg;
 119
 120         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Identity");
 121         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 122                                EAP_AKA_SUBTYPE_IDENTITY);
 123         if (eap_sim_db_identity_known(sm->eap_sim_db_priv, sm->identity,
 124                                       sm->identity_len)) {
 125                 wpa_printf(MSG_DEBUG, "   AT_PERMANENT_ID_REQ");
 126                 eap_sim_msg_add(msg, EAP_SIM_AT_PERMANENT_ID_REQ, 0, NULL, 0);
 127         } else {
 128                 /*
 129                  * RFC 4187, Chap. 4.1.4 recommends that identity from EAP is
 130                  * ignored and the AKA/Identity is used to request the
 131                  * identity.
 132                  */
 133                 wpa_printf(MSG_DEBUG, "   AT_ANY_ID_REQ");
 134                 eap_sim_msg_add(msg, EAP_SIM_AT_ANY_ID_REQ, 0, NULL, 0);
 135         }
 136         return eap_sim_msg_finish(msg, reqDataLen, NULL, NULL, 0);
 137 }
 138
 139
 140 static int eap_aka_build_encr(struct eap_sm *sm, struct eap_aka_data *data,
 141                               struct eap_sim_msg *msg, u16 counter,
 142                               const u8 *nonce_s)
 143 {
 144         free(data->next_pseudonym);
 145         data->next_pseudonym =
 146                 eap_sim_db_get_next_pseudonym(sm->eap_sim_db_priv, 1);
 147         free(data->next_reauth_id);
 148         if (data->counter <= EAP_AKA_MAX_FAST_REAUTHS) {
 149                 data->next_reauth_id =
 150                         eap_sim_db_get_next_reauth_id(sm->eap_sim_db_priv, 1);
 151         } else {
 152                 wpa_printf(MSG_DEBUG, "EAP-AKA: Max fast re-authentication "
 153                            "count exceeded - force full authentication");
 154                 data->next_reauth_id = NULL;
 155         }
 156
 157         if (data->next_pseudonym == NULL && data->next_reauth_id == NULL &&
 158             counter == 0 && nonce_s == NULL)
 159                 return 0;
 160
 161         wpa_printf(MSG_DEBUG, "   AT_IV");
 162         wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 163         eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
 164
 165         if (counter > 0) {
 166                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)", counter);
 167                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
 168         }
 169
 170         if (nonce_s) {
 171                 wpa_printf(MSG_DEBUG, "   *AT_NONCE_S");
 172                 eap_sim_msg_add(msg, EAP_SIM_AT_NONCE_S, 0, nonce_s,
 173                                 EAP_SIM_NONCE_S_LEN);
 174         }
 175
 176         if (data->next_pseudonym) {
 177                 wpa_printf(MSG_DEBUG, "   *AT_NEXT_PSEUDONYM (%s)",
 178                            data->next_pseudonym);
 179                 eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_PSEUDONYM,
 180                                 strlen(data->next_pseudonym),
 181                                 (u8 *) data->next_pseudonym,
 182                                 strlen(data->next_pseudonym));
 183         }
 184
 185         if (data->next_reauth_id) {
 186                 wpa_printf(MSG_DEBUG, "   *AT_NEXT_REAUTH_ID (%s)",
 187                            data->next_reauth_id);
 188                 eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_REAUTH_ID,
 189                                 strlen(data->next_reauth_id),
 190                                 (u8 *) data->next_reauth_id,
 191                                 strlen(data->next_reauth_id));
 192         }
 193
 194         if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
 195                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 196                            "AT_ENCR_DATA");
 197                 return -1;
 198         }
 199
 200         return 0;
 201 }
 202
 203
 204 static u8 * eap_aka_build_challenge(struct eap_sm *sm,
 205                                     struct eap_aka_data *data,
 206                                     int id, size_t *reqDataLen)
 207 {
 208         struct eap_sim_msg *msg;
 209
 210         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Challenge");
 211         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 212                                EAP_AKA_SUBTYPE_CHALLENGE);
 213         wpa_printf(MSG_DEBUG, "   AT_RAND");
 214         eap_sim_msg_add(msg, EAP_SIM_AT_RAND, 0, data->rand, EAP_AKA_RAND_LEN);
 215         eap_sim_msg_add(msg, EAP_SIM_AT_AUTN, 0, data->autn, EAP_AKA_AUTN_LEN);
 216
 217         if (eap_aka_build_encr(sm, data, msg, 0, NULL)) {
 218                 eap_sim_msg_free(msg);
 219                 return NULL;
 220         }
 221
 222         wpa_printf(MSG_DEBUG, "   AT_MAC");
 223         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 224         return eap_sim_msg_finish(msg, reqDataLen, data->k_aut, NULL, 0);
 225 }
 226
 227
 228 static u8 * eap_aka_build_reauth(struct eap_sm *sm,
 229                                  struct eap_aka_data *data,
 230                                  int id, size_t *reqDataLen)
 231 {
 232         struct eap_sim_msg *msg;
 233
 234         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Re-authentication");
 235
 236         if (hostapd_get_rand(data->nonce_s, EAP_SIM_NONCE_S_LEN))
 237                 return NULL;
 238         wpa_hexdump_key(MSG_MSGDUMP, "EAP-AKA: NONCE_S",
 239                         data->nonce_s, EAP_SIM_NONCE_S_LEN);
 240
 241         eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
 242                             data->emsk);
 243         eap_sim_derive_keys_reauth(data->counter, sm->identity,
 244                                    sm->identity_len, data->nonce_s, data->mk,
 245                                    data->msk, data->emsk);
 246
 247         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 248                                EAP_AKA_SUBTYPE_REAUTHENTICATION);
 249
 250         if (eap_aka_build_encr(sm, data, msg, data->counter, data->nonce_s)) {
 251                 eap_sim_msg_free(msg);
 252                 return NULL;
 253         }
 254
 255         wpa_printf(MSG_DEBUG, "   AT_MAC");
 256         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 257         return eap_sim_msg_finish(msg, reqDataLen, data->k_aut, NULL, 0);
 258 }
 259
 260
 261 static u8 * eap_aka_build_notification(struct eap_sm *sm,
 262                                        struct eap_aka_data *data,
 263                                        int id, size_t *reqDataLen)
 264 {
 265         struct eap_sim_msg *msg;
 266
 267         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Notification");
 268         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 269                                EAP_AKA_SUBTYPE_NOTIFICATION);
 270         wpa_printf(MSG_DEBUG, "   AT_NOTIFICATION");
 271         eap_sim_msg_add(msg, EAP_SIM_AT_NOTIFICATION, data->notification,
 272                         NULL, 0);
 273         return eap_sim_msg_finish(msg, reqDataLen, NULL, NULL, 0);
 274 }
 275
 276
 277 static u8 * eap_aka_buildReq(struct eap_sm *sm, void *priv, int id,
 278                              size_t *reqDataLen)
 279 {
 280         struct eap_aka_data *data = priv;
 281
 282         data->auts_reported = 0;
 283         switch (data->state) {
 284         case IDENTITY:
 285                 return eap_aka_build_identity(sm, data, id, reqDataLen);
 286         case CHALLENGE:
 287                 return eap_aka_build_challenge(sm, data, id, reqDataLen);
 288         case REAUTH:
 289                 return eap_aka_build_reauth(sm, data, id, reqDataLen);
 290         case NOTIFICATION:
 291                 return eap_aka_build_notification(sm, data, id, reqDataLen);
 292         default:
 293                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
 294                            "buildReq", data->state);
 295                 break;
 296         }
 297         return NULL;
 298 }
 299
 300
 301 static Boolean eap_aka_check(struct eap_sm *sm, void *priv,
 302                              u8 *respData, size_t respDataLen)
 303 {
 304         struct eap_hdr *resp;
 305         u8 *pos;
 306
 307         resp = (struct eap_hdr *) respData;
 308         pos = (u8 *) (resp + 1);
 309         if (respDataLen < sizeof(*resp) + 4 || *pos != EAP_TYPE_AKA ||
 310             (ntohs(resp->length)) > respDataLen) {
 311                 wpa_printf(MSG_INFO, "EAP-AKA: Invalid frame");
 312                 return TRUE;
 313         }
 314
 315         return FALSE;
 316 }
 317
 318
 319 static Boolean eap_aka_subtype_ok(struct eap_aka_data *data, u8 subtype)
 320 {
 321         if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR ||
 322             subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT)
 323                 return FALSE;
 324
 325         switch (data->state) {
 326         case IDENTITY:
 327                 if (subtype != EAP_AKA_SUBTYPE_IDENTITY) {
 328                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 329                                    "subtype %d", subtype);
 330                         return TRUE;
 331                 }
 332                 break;
 333         case CHALLENGE:
 334                 if (subtype != EAP_AKA_SUBTYPE_CHALLENGE &&
 335                     subtype != EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
 336                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 337                                    "subtype %d", subtype);
 338                         return TRUE;
 339                 }
 340                 break;
 341         case REAUTH:
 342                 if (subtype != EAP_AKA_SUBTYPE_REAUTHENTICATION) {
 343                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 344                                    "subtype %d", subtype);
 345                         return TRUE;
 346                 }
 347                 break;
 348         case NOTIFICATION:
 349                 if (subtype != EAP_AKA_SUBTYPE_NOTIFICATION) {
 350                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 351                                    "subtype %d", subtype);
 352                         return TRUE;
 353                 }
 354                 break;
 355         default:
 356                 wpa_printf(MSG_INFO, "EAP-AKA: Unexpected state (%d) for "
 357                            "processing a response", data->state);
 358                 return TRUE;
 359         }
 360
 361         return FALSE;
 362 }
 363
 364
 365 static void eap_aka_determine_identity(struct eap_sm *sm,
 366                                        struct eap_aka_data *data,
 367                                        int before_identity, int after_reauth)
 368 {
 369         const u8 *identity;
 370         size_t identity_len;
 371         int res;
 372
 373         identity = NULL;
 374         identity_len = 0;
 375
 376         if (after_reauth && data->reauth) {
 377                 identity = data->reauth->identity;
 378                 identity_len = data->reauth->identity_len;
 379         } else if (sm->identity && sm->identity_len > 0 &&
 380                    sm->identity[0] == EAP_AKA_PERMANENT_PREFIX) {
 381                 identity = sm->identity;
 382                 identity_len = sm->identity_len;
 383         } else {
 384                 identity = eap_sim_db_get_permanent(sm->eap_sim_db_priv,
 385                                                     sm->identity,
 386                                                     sm->identity_len,
 387                                                     &identity_len);
 388                 if (identity == NULL) {
 389                         data->reauth = eap_sim_db_get_reauth_entry(
 390                                 sm->eap_sim_db_priv, sm->identity,
 391                                 sm->identity_len);
 392                         if (data->reauth) {
 393                                 wpa_printf(MSG_DEBUG, "EAP-AKA: Using fast "
 394                                            "re-authentication");
 395                                 identity = data->reauth->identity;
 396                                 identity_len = data->reauth->identity_len;
 397                                 data->counter = data->reauth->counter;
 398                                 memcpy(data->mk, data->reauth->mk,
 399                                        EAP_SIM_MK_LEN);
 400                         }
 401                 }
 402         }
 403
 404         if (identity == NULL ||
 405             eap_sim_db_identity_known(sm->eap_sim_db_priv, sm->identity,
 406                                       sm->identity_len) < 0) {
 407                 if (before_identity) {
 408                         wpa_printf(MSG_DEBUG, "EAP-AKA: Permanent user name "
 409                                    "not known - send AKA-Identity request");
 410                         eap_aka_state(data, IDENTITY);
 411                         return;
 412                 } else {
 413                         wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown whether the "
 414                                    "permanent user name is known; try to use "
 415                                    "it");
 416                         /* eap_sim_db_get_aka_auth() will report failure, if
 417                          * this identity is not known. */
 418                 }
 419         }
 420
 421         wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity",
 422                           identity, identity_len);
 423
 424         if (!after_reauth && data->reauth) {
 425                 eap_aka_state(data, REAUTH);
 426                 return;
 427         }
 428
 429         res = eap_sim_db_get_aka_auth(sm->eap_sim_db_priv, identity,
 430                                       identity_len, data->rand, data->autn,
 431                                       data->ik, data->ck, data->res,
 432                                       &data->res_len, sm);
 433         if (res == EAP_SIM_DB_PENDING) {
 434                 wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
 435                            "not yet available - pending request");
 436                 sm->method_pending = METHOD_PENDING_WAIT;
 437                 return;
 438         }
 439
 440         data->reauth = NULL;
 441         data->counter = 0; /* reset re-auth counter since this is full auth */
 442
 443         if (res != 0) {
 444                 wpa_printf(MSG_INFO, "EAP-AKA: Failed to get AKA "
 445                            "authentication data for the peer");
 446                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 447                 eap_aka_state(data, NOTIFICATION);
 448                 return;
 449         }
 450         if (sm->method_pending == METHOD_PENDING_WAIT) {
 451                 wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
 452                            "available - abort pending wait");
 453                 sm->method_pending = METHOD_PENDING_NONE;
 454         }
 455
 456         identity_len = sm->identity_len;
 457         while (identity_len > 0 && sm->identity[identity_len - 1] == '\0') {
 458                 wpa_printf(MSG_DEBUG, "EAP-AKA: Workaround - drop last null "
 459                            "character from identity");
 460                 identity_len--;
 461         }
 462         wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity for MK derivation",
 463                           sm->identity, identity_len);
 464
 465         eap_aka_derive_mk(sm->identity, identity_len, data->ik, data->ck,
 466                           data->mk);
 467         eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
 468                             data->emsk);
 469
 470         eap_aka_state(data, CHALLENGE);
 471 }
 472
 473
 474 static void eap_aka_process_identity(struct eap_sm *sm,
 475                                      struct eap_aka_data *data,
 476                                      u8 *respData, size_t respDataLen,
 477                                      struct eap_sim_attrs *attr)
 478 {
 479         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Identity");
 480
 481         if (attr->mac || attr->iv || attr->encr_data) {
 482                 wpa_printf(MSG_WARNING, "EAP-AKA: Unexpected attribute "
 483                            "received in EAP-Response/AKA-Identity");
 484                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 485                 eap_aka_state(data, NOTIFICATION);
 486                 return;
 487         }
 488
 489         if (attr->identity) {
 490                 free(sm->identity);
 491                 sm->identity = malloc(attr->identity_len);
 492                 if (sm->identity) {
 493                         memcpy(sm->identity, attr->identity,
 494                                attr->identity_len);
 495                         sm->identity_len = attr->identity_len;
 496                 }
 497         }
 498
 499         eap_aka_determine_identity(sm, data, 0, 0);
 500 }
 501
 502
 503 static void eap_aka_process_challenge(struct eap_sm *sm,
 504                                       struct eap_aka_data *data,
 505                                       u8 *respData, size_t respDataLen,
 506                                       struct eap_sim_attrs *attr)
 507 {
 508         const u8 *identity;
 509         size_t identity_len;
 510
 511         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Challenge");
 512
 513         if (attr->mac == NULL ||
 514             eap_sim_verify_mac(data->k_aut, respData, respDataLen, attr->mac,
 515                                NULL, 0)) {
 516                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
 517                            "did not include valid AT_MAC");
 518                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 519                 eap_aka_state(data, NOTIFICATION);
 520                 return;
 521         }
 522
 523         if (attr->res == NULL || attr->res_len != data->res_len ||
 524             memcmp(attr->res, data->res, data->res_len) != 0) {
 525                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message did not "
 526                            "include valid AT_RES");
 527                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 528                 eap_aka_state(data, NOTIFICATION);
 529                 return;
 530         }
 531
 532         wpa_printf(MSG_DEBUG, "EAP-AKA: Challenge response includes the "
 533                    "correct AT_MAC");
 534         eap_aka_state(data, SUCCESS);
 535
 536         identity = eap_sim_db_get_permanent(sm->eap_sim_db_priv, sm->identity,
 537                                             sm->identity_len, &identity_len);
 538         if (identity == NULL) {
 539                 identity = sm->identity;
 540                 identity_len = sm->identity_len;
 541         }
 542
 543         if (data->next_pseudonym) {
 544                 eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, identity,
 545                                          identity_len,
 546                                          data->next_pseudonym);
 547                 data->next_pseudonym = NULL;
 548         }
 549         if (data->next_reauth_id) {
 550                 eap_sim_db_add_reauth(sm->eap_sim_db_priv, identity,
 551                                       identity_len,
 552                                       data->next_reauth_id, data->counter + 1,
 553                                       data->mk);
 554                 data->next_reauth_id = NULL;
 555         }
 556 }
 557
 558
 559 static void eap_aka_process_sync_failure(struct eap_sm *sm,
 560                                          struct eap_aka_data *data,
 561                                          u8 *respData, size_t respDataLen,
 562                                          struct eap_sim_attrs *attr)
 563 {
 564         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Synchronization-Failure");
 565
 566         if (attr->auts == NULL) {
 567                 wpa_printf(MSG_WARNING, "EAP-AKA: Synchronization-Failure "
 568                            "message did not include valid AT_AUTS");
 569                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 570                 eap_aka_state(data, NOTIFICATION);
 571                 return;
 572         }
 573
 574         /* Avoid re-reporting AUTS when processing pending EAP packet by
 575          * maintaining a local flag stating whether this AUTS has already been
 576          * reported. */
 577         if (!data->auts_reported &&
 578             eap_sim_db_resynchronize(sm->eap_sim_db_priv, sm->identity,
 579                                      sm->identity_len, attr->auts,
 580                                      data->rand)) {
 581                 wpa_printf(MSG_WARNING, "EAP-AKA: Resynchronization failed");
 582                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 583                 eap_aka_state(data, NOTIFICATION);
 584                 return;
 585         }
 586         data->auts_reported = 1;
 587
 588         /* Try again after resynchronization */
 589         eap_aka_determine_identity(sm, data, 0, 0);
 590 }
 591
 592
 593 static void eap_aka_process_reauth(struct eap_sm *sm,
 594                                    struct eap_aka_data *data,
 595                                    u8 *respData, size_t respDataLen,
 596                                    struct eap_sim_attrs *attr)
 597 {
 598         struct eap_sim_attrs eattr;
 599         u8 *decrypted = NULL;
 600         const u8 *identity, *id2;
 601         size_t identity_len, id2_len;
 602
 603         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Reauthentication");
 604
 605         if (attr->mac == NULL ||
 606             eap_sim_verify_mac(data->k_aut, respData, respDataLen, attr->mac,
 607                                data->nonce_s, EAP_SIM_NONCE_S_LEN)) {
 608                 wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
 609                            "did not include valid AT_MAC");
 610                 goto fail;
 611         }
 612
 613         if (attr->encr_data == NULL || attr->iv == NULL) {
 614                 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
 615                            "message did not include encrypted data");
 616                 goto fail;
 617         }
 618
 619         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 620                                        attr->encr_data_len, attr->iv, &eattr,
 621                                        0);
 622         if (decrypted == NULL) {
 623                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
 624                            "data from reauthentication message");
 625                 goto fail;
 626         }
 627
 628         if (eattr.counter != data->counter) {
 629                 wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
 630                            "used incorrect counter %u, expected %u",
 631                            eattr.counter, data->counter);
 632                 goto fail;
 633         }
 634         free(decrypted);
 635         decrypted = NULL;
 636
 637         wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response includes "
 638                    "the correct AT_MAC");
 639
 640         if (eattr.counter_too_small) {
 641                 wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response "
 642                            "included AT_COUNTER_TOO_SMALL - starting full "
 643                            "authentication");
 644                 eap_aka_determine_identity(sm, data, 0, 1);
 645                 return;
 646         }
 647
 648         eap_aka_state(data, SUCCESS);
 649
 650         if (data->reauth) {
 651                 identity = data->reauth->identity;
 652                 identity_len = data->reauth->identity_len;
 653         } else {
 654                 identity = sm->identity;
 655                 identity_len = sm->identity_len;
 656         }
 657
 658         id2 = eap_sim_db_get_permanent(sm->eap_sim_db_priv, identity,
 659                                        identity_len, &id2_len);
 660         if (id2) {
 661                 identity = id2;
 662                 identity_len = id2_len;
 663         }
 664
 665         if (data->next_pseudonym) {
 666                 eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, identity,
 667                                          identity_len, data->next_pseudonym);
 668                 data->next_pseudonym = NULL;
 669         }
 670         if (data->next_reauth_id) {
 671                 eap_sim_db_add_reauth(sm->eap_sim_db_priv, identity,
 672                                       identity_len, data->next_reauth_id,
 673                                       data->counter + 1, data->mk);
 674                 data->next_reauth_id = NULL;
 675         } else {
 676                 eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
 677                 data->reauth = NULL;
 678         }
 679
 680         return;
 681
 682 fail:
 683         data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 684         eap_aka_state(data, NOTIFICATION);
 685         eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
 686         data->reauth = NULL;
 687         free(decrypted);
 688 }
 689
 690
 691 static void eap_aka_process_client_error(struct eap_sm *sm,
 692                                          struct eap_aka_data *data,
 693                                          u8 *respData, size_t respDataLen,
 694                                          struct eap_sim_attrs *attr)
 695 {
 696         wpa_printf(MSG_DEBUG, "EAP-AKA: Client reported error %d",
 697                    attr->client_error_code);
 698         eap_aka_state(data, FAILURE);
 699 }
 700
 701
 702 static void eap_aka_process_authentication_reject(
 703         struct eap_sm *sm, struct eap_aka_data *data,
 704         u8 *respData, size_t respDataLen, struct eap_sim_attrs *attr)
 705 {
 706         wpa_printf(MSG_DEBUG, "EAP-AKA: Client rejected authentication");
 707         eap_aka_state(data, FAILURE);
 708 }
 709
 710
 711 static void eap_aka_process_notification(struct eap_sm *sm,
 712                                          struct eap_aka_data *data,
 713                                          u8 *respData, size_t respDataLen,
 714                                          struct eap_sim_attrs *attr)
 715 {
 716         wpa_printf(MSG_DEBUG, "EAP-AKA: Client replied to notification");
 717         eap_aka_state(data, FAILURE);
 718 }
 719
 720
 721 static void eap_aka_process(struct eap_sm *sm, void *priv,
 722                             u8 *respData, size_t respDataLen)
 723 {
 724         struct eap_aka_data *data = priv;
 725         struct eap_hdr *resp;
 726         u8 *pos, subtype;
 727         size_t len;
 728         struct eap_sim_attrs attr;
 729
 730         resp = (struct eap_hdr *) respData;
 731         pos = (u8 *) (resp + 1);
 732         subtype = pos[1];
 733
 734         if (eap_aka_subtype_ok(data, subtype)) {
 735                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized or unexpected "
 736                            "EAP-AKA Subtype in EAP Response");
 737                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 738                 eap_aka_state(data, NOTIFICATION);
 739                 return;
 740         }
 741
 742         len = be_to_host16(resp->length);
 743         pos += 4;
 744
 745         if (eap_sim_parse_attr(pos, respData + len, &attr, 1, 0)) {
 746                 wpa_printf(MSG_DEBUG, "EAP-AKA: Failed to parse attributes");
 747                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 748                 eap_aka_state(data, NOTIFICATION);
 749                 return;
 750         }
 751
 752         if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR) {
 753                 eap_aka_process_client_error(sm, data, respData, len, &attr);
 754                 return;
 755         }
 756
 757         if (subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT) {
 758                 eap_aka_process_authentication_reject(sm, data, respData, len,
 759                                                       &attr);
 760                 return;
 761         }
 762
 763         switch (data->state) {
 764         case IDENTITY:
 765                 eap_aka_process_identity(sm, data, respData, len, &attr);
 766                 break;
 767         case CHALLENGE:
 768                 if (subtype == EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
 769                         eap_aka_process_sync_failure(sm, data, respData, len,
 770                                                      &attr);
 771                 } else {
 772                         eap_aka_process_challenge(sm, data, respData, len,
 773                                                   &attr);
 774                 }
 775                 break;
 776         case REAUTH:
 777                 eap_aka_process_reauth(sm, data, respData, len, &attr);
 778                 break;
 779         case NOTIFICATION:
 780                 eap_aka_process_notification(sm, data, respData, len, &attr);
 781                 break;
 782         default:
 783                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
 784                            "process", data->state);
 785                 break;
 786         }
 787 }
 788
 789
 790 static Boolean eap_aka_isDone(struct eap_sm *sm, void *priv)
 791 {
 792         struct eap_aka_data *data = priv;
 793         return data->state == SUCCESS || data->state == FAILURE;
 794 }
 795
 796
 797 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
 798 {
 799         struct eap_aka_data *data = priv;
 800         u8 *key;
 801
 802         if (data->state != SUCCESS)
 803                 return NULL;
 804
 805         key = malloc(EAP_SIM_KEYING_DATA_LEN);
 806         if (key == NULL)
 807                 return NULL;
 808         memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
 809         *len = EAP_SIM_KEYING_DATA_LEN;
 810         return key;
 811 }
 812
 813
 814 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 815 {
 816         struct eap_aka_data *data = priv;
 817         u8 *key;
 818
 819         if (data->state != SUCCESS)
 820                 return NULL;
 821
 822         key = malloc(EAP_EMSK_LEN);
 823         if (key == NULL)
 824                 return NULL;
 825         memcpy(key, data->emsk, EAP_EMSK_LEN);
 826         *len = EAP_EMSK_LEN;
 827         return key;
 828 }
 829
 830
 831 static Boolean eap_aka_isSuccess(struct eap_sm *sm, void *priv)
 832 {
 833         struct eap_aka_data *data = priv;
 834         return data->state == SUCCESS;
 835 }
 836
 837
 838 int eap_server_aka_register(void)
 839 {
 840         struct eap_method *eap;
 841         int ret;
 842
 843         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
 844                                       EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
 845         if (eap == NULL)
 846                 return -1;
 847
 848         eap->init = eap_aka_init;
 849         eap->reset = eap_aka_reset;
 850         eap->buildReq = eap_aka_buildReq;
 851         eap->check = eap_aka_check;
 852         eap->process = eap_aka_process;
 853         eap->isDone = eap_aka_isDone;
 854         eap->getKey = eap_aka_getKey;
 855         eap->isSuccess = eap_aka_isSuccess;
 856         eap->get_emsk = eap_aka_get_emsk;
 857
 858         ret = eap_server_method_register(eap);
 859         if (ret)
 860                 eap_server_method_free(eap);
 861         return ret;
 862 }