contrib/wpa_supplicant/eap_sim.c

   1 /*
   2  * EAP peer method: EAP-SIM (RFC 4186)
   3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_i.h"
  19 #include "config_ssid.h"
  20 #include "crypto.h"
  21 #include "pcsc_funcs.h"
  22 #include "eap_sim_common.h"
  23
  24
  25 struct eap_sim_data {
  26         u8 *ver_list;
  27         size_t ver_list_len;
  28         int selected_version;
  29         size_t min_num_chal, num_chal;
  30
  31         u8 kc[3][EAP_SIM_KC_LEN];
  32         u8 sres[3][EAP_SIM_SRES_LEN];
  33         u8 nonce_mt[EAP_SIM_NONCE_MT_LEN], nonce_s[EAP_SIM_NONCE_S_LEN];
  34         u8 mk[EAP_SIM_MK_LEN];
  35         u8 k_aut[EAP_SIM_K_AUT_LEN];
  36         u8 k_encr[EAP_SIM_K_ENCR_LEN];
  37         u8 msk[EAP_SIM_KEYING_DATA_LEN];
  38         u8 emsk[EAP_EMSK_LEN];
  39         u8 rand[3][GSM_RAND_LEN];
  40
  41         int num_id_req, num_notification;
  42         u8 *pseudonym;
  43         size_t pseudonym_len;
  44         u8 *reauth_id;
  45         size_t reauth_id_len;
  46         int reauth;
  47         unsigned int counter, counter_too_small;
  48         u8 *last_eap_identity;
  49         size_t last_eap_identity_len;
  50         enum { CONTINUE, SUCCESS, FAILURE } state;
  51 };
  52
  53
  54 static void * eap_sim_init(struct eap_sm *sm)
  55 {
  56         struct eap_sim_data *data;
  57         struct wpa_ssid *config = eap_get_config(sm);
  58
  59         data = os_zalloc(sizeof(*data));
  60         if (data == NULL)
  61                 return NULL;
  62
  63         if (hostapd_get_rand(data->nonce_mt, EAP_SIM_NONCE_MT_LEN)) {
  64                 wpa_printf(MSG_WARNING, "EAP-SIM: Failed to get random data "
  65                            "for NONCE_MT");
  66                 os_free(data);
  67                 return NULL;
  68         }
  69
  70         data->min_num_chal = 2;
  71         if (config && config->phase1) {
  72                 char *pos = os_strstr(config->phase1, "sim_min_num_chal=");
  73                 if (pos) {
  74                         data->min_num_chal = atoi(pos + 17);
  75                         if (data->min_num_chal < 2 || data->min_num_chal > 3) {
  76                                 wpa_printf(MSG_WARNING, "EAP-SIM: Invalid "
  77                                            "sim_min_num_chal configuration "
  78                                            "(%lu, expected 2 or 3)",
  79                                            (unsigned long) data->min_num_chal);
  80                                 os_free(data);
  81                                 return NULL;
  82                         }
  83                         wpa_printf(MSG_DEBUG, "EAP-SIM: Set minimum number of "
  84                                    "challenges to %lu",
  85                                    (unsigned long) data->min_num_chal);
  86                 }
  87         }
  88
  89         data->state = CONTINUE;
  90
  91         return data;
  92 }
  93
  94
  95 static void eap_sim_deinit(struct eap_sm *sm, void *priv)
  96 {
  97         struct eap_sim_data *data = priv;
  98         if (data) {
  99                 os_free(data->ver_list);
 100                 os_free(data->pseudonym);
 101                 os_free(data->reauth_id);
 102                 os_free(data->last_eap_identity);
 103                 os_free(data);
 104         }
 105 }
 106
 107
 108 static int eap_sim_gsm_auth(struct eap_sm *sm, struct eap_sim_data *data)
 109 {
 110         wpa_printf(MSG_DEBUG, "EAP-SIM: GSM authentication algorithm");
 111 #ifdef PCSC_FUNCS
 112         if (scard_gsm_auth(sm->scard_ctx, data->rand[0],
 113                            data->sres[0], data->kc[0]) ||
 114             scard_gsm_auth(sm->scard_ctx, data->rand[1],
 115                            data->sres[1], data->kc[1]) ||
 116             (data->num_chal > 2 &&
 117              scard_gsm_auth(sm->scard_ctx, data->rand[2],
 118                             data->sres[2], data->kc[2]))) {
 119                 wpa_printf(MSG_DEBUG, "EAP-SIM: GSM SIM authentication could "
 120                            "not be completed");
 121                 return -1;
 122         }
 123 #else /* PCSC_FUNCS */
 124         /* These hardcoded Kc and SRES values are used for testing. RAND to
 125          * KC/SREC mapping is very bogus as far as real authentication is
 126          * concerned, but it is quite useful for cases where the AS is rotating
 127          * the order of pre-configured values. */
 128         {
 129                 size_t i;
 130                 for (i = 0; i < data->num_chal; i++) {
 131                         if (data->rand[i][0] == 0xaa) {
 132                                 os_memcpy(data->kc[i],
 133                                           "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7",
 134                                           EAP_SIM_KC_LEN);
 135                                 os_memcpy(data->sres[i], "\xd1\xd2\xd3\xd4",
 136                                           EAP_SIM_SRES_LEN);
 137                         } else if (data->rand[i][0] == 0xbb) {
 138                                 os_memcpy(data->kc[i],
 139                                           "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7",
 140                                           EAP_SIM_KC_LEN);
 141                                 os_memcpy(data->sres[i], "\xe1\xe2\xe3\xe4",
 142                                           EAP_SIM_SRES_LEN);
 143                         } else {
 144                                 os_memcpy(data->kc[i],
 145                                           "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7",
 146                                           EAP_SIM_KC_LEN);
 147                                 os_memcpy(data->sres[i], "\xf1\xf2\xf3\xf4",
 148                                           EAP_SIM_SRES_LEN);
 149                         }
 150                 }
 151         }
 152 #endif /* PCSC_FUNCS */
 153         return 0;
 154 }
 155
 156
 157 static int eap_sim_supported_ver(int version)
 158 {
 159         return version == EAP_SIM_VERSION;
 160 }
 161
 162
 163 #define CLEAR_PSEUDONYM 0x01
 164 #define CLEAR_REAUTH_ID 0x02
 165 #define CLEAR_EAP_ID    0x04
 166
 167 static void eap_sim_clear_identities(struct eap_sim_data *data, int id)
 168 {
 169         wpa_printf(MSG_DEBUG, "EAP-SIM: forgetting old%s%s%s",
 170                    id & CLEAR_PSEUDONYM ? " pseudonym" : "",
 171                    id & CLEAR_REAUTH_ID ? " reauth_id" : "",
 172                    id & CLEAR_EAP_ID ? " eap_id" : "");
 173         if (id & CLEAR_PSEUDONYM) {
 174                 os_free(data->pseudonym);
 175                 data->pseudonym = NULL;
 176                 data->pseudonym_len = 0;
 177         }
 178         if (id & CLEAR_REAUTH_ID) {
 179                 os_free(data->reauth_id);
 180                 data->reauth_id = NULL;
 181                 data->reauth_id_len = 0;
 182         }
 183         if (id & CLEAR_EAP_ID) {
 184                 os_free(data->last_eap_identity);
 185                 data->last_eap_identity = NULL;
 186                 data->last_eap_identity_len = 0;
 187         }
 188 }
 189
 190
 191 static int eap_sim_learn_ids(struct eap_sim_data *data,
 192                              struct eap_sim_attrs *attr)
 193 {
 194         if (attr->next_pseudonym) {
 195                 os_free(data->pseudonym);
 196                 data->pseudonym = os_malloc(attr->next_pseudonym_len);
 197                 if (data->pseudonym == NULL) {
 198                         wpa_printf(MSG_INFO, "EAP-SIM: (encr) No memory for "
 199                                    "next pseudonym");
 200                         return -1;
 201                 }
 202                 os_memcpy(data->pseudonym, attr->next_pseudonym,
 203                           attr->next_pseudonym_len);
 204                 data->pseudonym_len = attr->next_pseudonym_len;
 205                 wpa_hexdump_ascii(MSG_DEBUG,
 206                                   "EAP-SIM: (encr) AT_NEXT_PSEUDONYM",
 207                                   data->pseudonym,
 208                                   data->pseudonym_len);
 209         }
 210
 211         if (attr->next_reauth_id) {
 212                 os_free(data->reauth_id);
 213                 data->reauth_id = os_malloc(attr->next_reauth_id_len);
 214                 if (data->reauth_id == NULL) {
 215                         wpa_printf(MSG_INFO, "EAP-SIM: (encr) No memory for "
 216                                    "next reauth_id");
 217                         return -1;
 218                 }
 219                 os_memcpy(data->reauth_id, attr->next_reauth_id,
 220                           attr->next_reauth_id_len);
 221                 data->reauth_id_len = attr->next_reauth_id_len;
 222                 wpa_hexdump_ascii(MSG_DEBUG,
 223                                   "EAP-SIM: (encr) AT_NEXT_REAUTH_ID",
 224                                   data->reauth_id,
 225                                   data->reauth_id_len);
 226         }
 227
 228         return 0;
 229 }
 230
 231
 232 static u8 * eap_sim_client_error(struct eap_sim_data *data,
 233                                  const struct eap_hdr *req,
 234                                  size_t *respDataLen, int err)
 235 {
 236         struct eap_sim_msg *msg;
 237
 238         data->state = FAILURE;
 239         data->num_id_req = 0;
 240         data->num_notification = 0;
 241
 242         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
 243                                EAP_TYPE_SIM, EAP_SIM_SUBTYPE_CLIENT_ERROR);
 244         eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
 245         return eap_sim_msg_finish(msg, respDataLen, NULL, NULL, 0);
 246 }
 247
 248
 249 static u8 * eap_sim_response_start(struct eap_sm *sm,
 250                                    struct eap_sim_data *data,
 251                                    const struct eap_hdr *req,
 252                                    size_t *respDataLen,
 253                                    enum eap_sim_id_req id_req)
 254 {
 255         const u8 *identity = NULL;
 256         size_t identity_len = 0;
 257         struct eap_sim_msg *msg;
 258
 259         data->reauth = 0;
 260         if (id_req == ANY_ID && data->reauth_id) {
 261                 identity = data->reauth_id;
 262                 identity_len = data->reauth_id_len;
 263                 data->reauth = 1;
 264         } else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
 265                    data->pseudonym) {
 266                 identity = data->pseudonym;
 267                 identity_len = data->pseudonym_len;
 268                 eap_sim_clear_identities(data, CLEAR_REAUTH_ID);
 269         } else if (id_req != NO_ID_REQ) {
 270                 identity = eap_get_config_identity(sm, &identity_len);
 271                 if (identity) {
 272                         eap_sim_clear_identities(data, CLEAR_PSEUDONYM |
 273                                                  CLEAR_REAUTH_ID);
 274                 }
 275         }
 276         if (id_req != NO_ID_REQ)
 277                 eap_sim_clear_identities(data, CLEAR_EAP_ID);
 278
 279         wpa_printf(MSG_DEBUG, "Generating EAP-SIM Start (id=%d)",
 280                    req->identifier);
 281         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
 282                                EAP_TYPE_SIM, EAP_SIM_SUBTYPE_START);
 283         if (!data->reauth) {
 284                 wpa_hexdump(MSG_DEBUG, "   AT_NONCE_MT",
 285                             data->nonce_mt, EAP_SIM_NONCE_MT_LEN);
 286                 eap_sim_msg_add(msg, EAP_SIM_AT_NONCE_MT, 0,
 287                                 data->nonce_mt, EAP_SIM_NONCE_MT_LEN);
 288                 wpa_printf(MSG_DEBUG, "   AT_SELECTED_VERSION %d",
 289                            data->selected_version);
 290                 eap_sim_msg_add(msg, EAP_SIM_AT_SELECTED_VERSION,
 291                                 data->selected_version, NULL, 0);
 292         }
 293
 294         if (identity) {
 295                 wpa_hexdump_ascii(MSG_DEBUG, "   AT_IDENTITY",
 296                                   identity, identity_len);
 297                 eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
 298                                 identity, identity_len);
 299         }
 300
 301         return eap_sim_msg_finish(msg, respDataLen, NULL, NULL, 0);
 302 }
 303
 304
 305 static u8 * eap_sim_response_challenge(struct eap_sim_data *data,
 306                                        const struct eap_hdr *req,
 307                                        size_t *respDataLen)
 308 {
 309         struct eap_sim_msg *msg;
 310
 311         wpa_printf(MSG_DEBUG, "Generating EAP-SIM Challenge (id=%d)",
 312                    req->identifier);
 313         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
 314                                EAP_TYPE_SIM, EAP_SIM_SUBTYPE_CHALLENGE);
 315         wpa_printf(MSG_DEBUG, "   AT_MAC");
 316         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 317         return eap_sim_msg_finish(msg, respDataLen, data->k_aut,
 318                                   (u8 *) data->sres,
 319                                   data->num_chal * EAP_SIM_SRES_LEN);
 320 }
 321
 322
 323 static u8 * eap_sim_response_reauth(struct eap_sim_data *data,
 324                                     const struct eap_hdr *req,
 325                                     size_t *respDataLen, int counter_too_small)
 326 {
 327         struct eap_sim_msg *msg;
 328         unsigned int counter;
 329
 330         wpa_printf(MSG_DEBUG, "Generating EAP-SIM Reauthentication (id=%d)",
 331                    req->identifier);
 332         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
 333                                EAP_TYPE_SIM,
 334                                EAP_SIM_SUBTYPE_REAUTHENTICATION);
 335         wpa_printf(MSG_DEBUG, "   AT_IV");
 336         wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 337         eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
 338
 339         if (counter_too_small) {
 340                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER_TOO_SMALL");
 341                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
 342                 counter = data->counter_too_small;
 343         } else
 344                 counter = data->counter;
 345
 346         wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", counter);
 347         eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
 348
 349         if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
 350                 wpa_printf(MSG_WARNING, "EAP-SIM: Failed to encrypt "
 351                            "AT_ENCR_DATA");
 352                 eap_sim_msg_free(msg);
 353                 return NULL;
 354         }
 355         wpa_printf(MSG_DEBUG, "   AT_MAC");
 356         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 357         return eap_sim_msg_finish(msg, respDataLen, data->k_aut, data->nonce_s,
 358                                   EAP_SIM_NONCE_S_LEN);
 359 }
 360
 361
 362 static u8 * eap_sim_response_notification(struct eap_sim_data *data,
 363                                           const struct eap_hdr *req,
 364                                           size_t *respDataLen,
 365                                           u16 notification)
 366 {
 367         struct eap_sim_msg *msg;
 368         u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
 369
 370         wpa_printf(MSG_DEBUG, "Generating EAP-SIM Notification (id=%d)",
 371                    req->identifier);
 372         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, req->identifier,
 373                                EAP_TYPE_SIM, EAP_SIM_SUBTYPE_NOTIFICATION);
 374         wpa_printf(MSG_DEBUG, "   AT_NOTIFICATION");
 375         eap_sim_msg_add(msg, EAP_SIM_AT_NOTIFICATION, notification, NULL, 0);
 376         if (k_aut && data->reauth) {
 377                 wpa_printf(MSG_DEBUG, "   AT_IV");
 378                 wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 379                 eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
 380                                            EAP_SIM_AT_ENCR_DATA);
 381                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", data->counter);
 382                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
 383                                 NULL, 0);
 384                 if (eap_sim_msg_add_encr_end(msg, data->k_encr,
 385                                              EAP_SIM_AT_PADDING)) {
 386                         wpa_printf(MSG_WARNING, "EAP-SIM: Failed to encrypt "
 387                                    "AT_ENCR_DATA");
 388                         eap_sim_msg_free(msg);
 389                         return NULL;
 390                 }
 391         }
 392         if (k_aut) {
 393                 wpa_printf(MSG_DEBUG, "   AT_MAC");
 394                 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 395         }
 396         return eap_sim_msg_finish(msg, respDataLen, k_aut, (u8 *) "", 0);
 397 }
 398
 399
 400 static u8 * eap_sim_process_start(struct eap_sm *sm, struct eap_sim_data *data,
 401                                   const struct eap_hdr *req,
 402                                   size_t *respDataLen,
 403                                   struct eap_sim_attrs *attr)
 404 {
 405         int selected_version = -1, id_error;
 406         size_t i;
 407         u8 *pos;
 408
 409         wpa_printf(MSG_DEBUG, "EAP-SIM: subtype Start");
 410         if (attr->version_list == NULL) {
 411                 wpa_printf(MSG_INFO, "EAP-SIM: No AT_VERSION_LIST in "
 412                            "SIM/Start");
 413                 return eap_sim_client_error(data, req, respDataLen,
 414                                             EAP_SIM_UNSUPPORTED_VERSION);
 415         }
 416
 417         os_free(data->ver_list);
 418         data->ver_list = os_malloc(attr->version_list_len);
 419         if (data->ver_list == NULL) {
 420                 wpa_printf(MSG_DEBUG, "EAP-SIM: Failed to allocate "
 421                            "memory for version list");
 422                 return eap_sim_client_error(data, req, respDataLen,
 423                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 424         }
 425         os_memcpy(data->ver_list, attr->version_list, attr->version_list_len);
 426         data->ver_list_len = attr->version_list_len;
 427         pos = data->ver_list;
 428         for (i = 0; i < data->ver_list_len / 2; i++) {
 429                 int ver = pos[0] * 256 + pos[1];
 430                 pos += 2;
 431                 if (eap_sim_supported_ver(ver)) {
 432                         selected_version = ver;
 433                         break;
 434                 }
 435         }
 436         if (selected_version < 0) {
 437                 wpa_printf(MSG_INFO, "EAP-SIM: Could not find a supported "
 438                            "version");
 439                 return eap_sim_client_error(data, req, respDataLen,
 440                                             EAP_SIM_UNSUPPORTED_VERSION);
 441         }
 442         wpa_printf(MSG_DEBUG, "EAP-SIM: Selected Version %d",
 443                    selected_version);
 444         data->selected_version = selected_version;
 445
 446         id_error = 0;
 447         switch (attr->id_req) {
 448         case NO_ID_REQ:
 449                 break;
 450         case ANY_ID:
 451                 if (data->num_id_req > 0)
 452                         id_error++;
 453                 data->num_id_req++;
 454                 break;
 455         case FULLAUTH_ID:
 456                 if (data->num_id_req > 1)
 457                         id_error++;
 458                 data->num_id_req++;
 459                 break;
 460         case PERMANENT_ID:
 461                 if (data->num_id_req > 2)
 462                         id_error++;
 463                 data->num_id_req++;
 464                 break;
 465         }
 466         if (id_error) {
 467                 wpa_printf(MSG_INFO, "EAP-SIM: Too many ID requests "
 468                            "used within one authentication");
 469                 return eap_sim_client_error(data, req, respDataLen,
 470                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 471         }
 472
 473         return eap_sim_response_start(sm, data, req, respDataLen,
 474                                       attr->id_req);
 475 }
 476
 477
 478 static u8 * eap_sim_process_challenge(struct eap_sm *sm,
 479                                       struct eap_sim_data *data,
 480                                       const struct eap_hdr *req,
 481                                       size_t reqDataLen,
 482                                       size_t *respDataLen,
 483                                       struct eap_sim_attrs *attr)
 484 {
 485         const u8 *identity;
 486         size_t identity_len;
 487         struct eap_sim_attrs eattr;
 488
 489         wpa_printf(MSG_DEBUG, "EAP-SIM: subtype Challenge");
 490         data->reauth = 0;
 491         if (!attr->mac || !attr->rand) {
 492                 wpa_printf(MSG_WARNING, "EAP-SIM: Challenge message "
 493                            "did not include%s%s",
 494                            !attr->mac ? " AT_MAC" : "",
 495                            !attr->rand ? " AT_RAND" : "");
 496                 return eap_sim_client_error(data, req, respDataLen,
 497                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 498         }
 499
 500         wpa_printf(MSG_DEBUG, "EAP-SIM: %lu challenges",
 501                    (unsigned long) attr->num_chal);
 502         if (attr->num_chal < data->min_num_chal) {
 503                 wpa_printf(MSG_INFO, "EAP-SIM: Insufficient number of "
 504                            "challenges (%lu)", (unsigned long) attr->num_chal);
 505                 return eap_sim_client_error(data, req, respDataLen,
 506                                             EAP_SIM_INSUFFICIENT_NUM_OF_CHAL);
 507         }
 508         if (attr->num_chal > 3) {
 509                 wpa_printf(MSG_INFO, "EAP-SIM: Too many challenges "
 510                            "(%lu)", (unsigned long) attr->num_chal);
 511                 return eap_sim_client_error(data, req, respDataLen,
 512                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 513         }
 514
 515         /* Verify that RANDs are different */
 516         if (os_memcmp(attr->rand, attr->rand + GSM_RAND_LEN,
 517                    GSM_RAND_LEN) == 0 ||
 518             (attr->num_chal > 2 &&
 519              (os_memcmp(attr->rand, attr->rand + 2 * GSM_RAND_LEN,
 520                         GSM_RAND_LEN) == 0 ||
 521               os_memcmp(attr->rand + GSM_RAND_LEN,
 522                         attr->rand + 2 * GSM_RAND_LEN,
 523                         GSM_RAND_LEN) == 0))) {
 524                 wpa_printf(MSG_INFO, "EAP-SIM: Same RAND used multiple times");
 525                 return eap_sim_client_error(data, req, respDataLen,
 526                                             EAP_SIM_RAND_NOT_FRESH);
 527         }
 528
 529         os_memcpy(data->rand, attr->rand, attr->num_chal * GSM_RAND_LEN);
 530         data->num_chal = attr->num_chal;
 531
 532         if (eap_sim_gsm_auth(sm, data)) {
 533                 wpa_printf(MSG_WARNING, "EAP-SIM: GSM authentication failed");
 534                 return eap_sim_client_error(data, req, respDataLen,
 535                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 536         }
 537         if (data->last_eap_identity) {
 538                 identity = data->last_eap_identity;
 539                 identity_len = data->last_eap_identity_len;
 540         } else if (data->pseudonym) {
 541                 identity = data->pseudonym;
 542                 identity_len = data->pseudonym_len;
 543         } else
 544                 identity = eap_get_config_identity(sm, &identity_len);
 545         wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM: Selected identity for MK "
 546                           "derivation", identity, identity_len);
 547         eap_sim_derive_mk(identity, identity_len, data->nonce_mt,
 548                           data->selected_version, data->ver_list,
 549                           data->ver_list_len, data->num_chal,
 550                           (const u8 *) data->kc, data->mk);
 551         eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
 552                             data->emsk);
 553         if (eap_sim_verify_mac(data->k_aut, (const u8 *) req, reqDataLen,
 554                                attr->mac, data->nonce_mt,
 555                                EAP_SIM_NONCE_MT_LEN)) {
 556                 wpa_printf(MSG_WARNING, "EAP-SIM: Challenge message "
 557                            "used invalid AT_MAC");
 558                 return eap_sim_client_error(data, req, respDataLen,
 559                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 560         }
 561
 562         /* Old reauthentication and pseudonym identities must not be used
 563          * anymore. In other words, if no new identities are received, full
 564          * authentication will be used on next reauthentication. */
 565         eap_sim_clear_identities(data, CLEAR_PSEUDONYM | CLEAR_REAUTH_ID |
 566                                  CLEAR_EAP_ID);
 567
 568         if (attr->encr_data) {
 569                 u8 *decrypted;
 570                 decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 571                                                attr->encr_data_len, attr->iv,
 572                                                &eattr, 0);
 573                 if (decrypted == NULL) {
 574                         return eap_sim_client_error(
 575                                 data, req, respDataLen,
 576                                 EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 577                 }
 578                 eap_sim_learn_ids(data, &eattr);
 579                 os_free(decrypted);
 580         }
 581
 582         if (data->state != FAILURE)
 583                 data->state = SUCCESS;
 584
 585         data->num_id_req = 0;
 586         data->num_notification = 0;
 587         /* RFC 4186 specifies that counter is initialized to one after
 588          * fullauth, but initializing it to zero makes it easier to implement
 589          * reauth verification. */
 590         data->counter = 0;
 591         return eap_sim_response_challenge(data, req, respDataLen);
 592 }
 593
 594
 595 static int eap_sim_process_notification_reauth(struct eap_sim_data *data,
 596                                                struct eap_sim_attrs *attr)
 597 {
 598         struct eap_sim_attrs eattr;
 599         u8 *decrypted;
 600
 601         if (attr->encr_data == NULL || attr->iv == NULL) {
 602                 wpa_printf(MSG_WARNING, "EAP-SIM: Notification message after "
 603                            "reauth did not include encrypted data");
 604                 return -1;
 605         }
 606
 607         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 608                                        attr->encr_data_len, attr->iv, &eattr,
 609                                        0);
 610         if (decrypted == NULL) {
 611                 wpa_printf(MSG_WARNING, "EAP-SIM: Failed to parse encrypted "
 612                            "data from notification message");
 613                 return -1;
 614         }
 615
 616         if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
 617                 wpa_printf(MSG_WARNING, "EAP-SIM: Counter in notification "
 618                            "message does not match with counter in reauth "
 619                            "message");
 620                 os_free(decrypted);
 621                 return -1;
 622         }
 623
 624         os_free(decrypted);
 625         return 0;
 626 }
 627
 628
 629 static int eap_sim_process_notification_auth(struct eap_sim_data *data,
 630                                              const struct eap_hdr *req,
 631                                              size_t reqDataLen,
 632                                              struct eap_sim_attrs *attr)
 633 {
 634         if (attr->mac == NULL) {
 635                 wpa_printf(MSG_INFO, "EAP-SIM: no AT_MAC in after_auth "
 636                            "Notification message");
 637                 return -1;
 638         }
 639
 640         if (eap_sim_verify_mac(data->k_aut, (u8 *) req, reqDataLen, attr->mac,
 641                                (u8 *) "", 0)) {
 642                 wpa_printf(MSG_WARNING, "EAP-SIM: Notification message "
 643                            "used invalid AT_MAC");
 644                 return -1;
 645         }
 646
 647         if (data->reauth &&
 648             eap_sim_process_notification_reauth(data, attr)) {
 649                 wpa_printf(MSG_WARNING, "EAP-SIM: Invalid notification "
 650                            "message after reauth");
 651                 return -1;
 652         }
 653
 654         return 0;
 655 }
 656
 657
 658 static u8 * eap_sim_process_notification(struct eap_sm *sm,
 659                                          struct eap_sim_data *data,
 660                                          const struct eap_hdr *req,
 661                                          size_t reqDataLen,
 662                                          size_t *respDataLen,
 663                                          struct eap_sim_attrs *attr)
 664 {
 665         wpa_printf(MSG_DEBUG, "EAP-SIM: subtype Notification");
 666         if (data->num_notification > 0) {
 667                 wpa_printf(MSG_INFO, "EAP-SIM: too many notification "
 668                            "rounds (only one allowed)");
 669                 return eap_sim_client_error(data, req, respDataLen,
 670                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 671         }
 672         data->num_notification++;
 673         if (attr->notification == -1) {
 674                 wpa_printf(MSG_INFO, "EAP-SIM: no AT_NOTIFICATION in "
 675                            "Notification message");
 676                 return eap_sim_client_error(data, req, respDataLen,
 677                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 678         }
 679
 680         if ((attr->notification & 0x4000) == 0 &&
 681             eap_sim_process_notification_auth(data, req, reqDataLen, attr)) {
 682                 return eap_sim_client_error(data, req, respDataLen,
 683                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 684         }
 685
 686         eap_sim_report_notification(sm->msg_ctx, attr->notification, 0);
 687         if (attr->notification >= 0 && attr->notification < 32768) {
 688                 data->state = FAILURE;
 689         }
 690         return eap_sim_response_notification(data, req, respDataLen,
 691                                              attr->notification);
 692 }
 693
 694
 695 static u8 * eap_sim_process_reauthentication(struct eap_sm *sm,
 696                                              struct eap_sim_data *data,
 697                                              const struct eap_hdr *req,
 698                                              size_t reqDataLen,
 699                                              size_t *respDataLen,
 700                                              struct eap_sim_attrs *attr)
 701 {
 702         struct eap_sim_attrs eattr;
 703         u8 *decrypted;
 704
 705         wpa_printf(MSG_DEBUG, "EAP-SIM: subtype Reauthentication");
 706
 707         if (data->reauth_id == NULL) {
 708                 wpa_printf(MSG_WARNING, "EAP-SIM: Server is trying "
 709                            "reauthentication, but no reauth_id available");
 710                 return eap_sim_client_error(data, req, respDataLen,
 711                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 712         }
 713
 714         data->reauth = 1;
 715         if (eap_sim_verify_mac(data->k_aut, (const u8 *) req, reqDataLen,
 716                                attr->mac, (u8 *) "", 0)) {
 717                 wpa_printf(MSG_WARNING, "EAP-SIM: Reauthentication "
 718                            "did not have valid AT_MAC");
 719                 return eap_sim_client_error(data, req, respDataLen,
 720                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 721         }
 722
 723         if (attr->encr_data == NULL || attr->iv == NULL) {
 724                 wpa_printf(MSG_WARNING, "EAP-SIM: Reauthentication "
 725                            "message did not include encrypted data");
 726                 return eap_sim_client_error(data, req, respDataLen,
 727                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 728         }
 729
 730         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 731                                        attr->encr_data_len, attr->iv, &eattr,
 732                                        0);
 733         if (decrypted == NULL) {
 734                 wpa_printf(MSG_WARNING, "EAP-SIM: Failed to parse encrypted "
 735                            "data from reauthentication message");
 736                 return eap_sim_client_error(data, req, respDataLen,
 737                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 738         }
 739
 740         if (eattr.nonce_s == NULL || eattr.counter < 0) {
 741                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) No%s%s in reauth packet",
 742                            !eattr.nonce_s ? " AT_NONCE_S" : "",
 743                            eattr.counter < 0 ? " AT_COUNTER" : "");
 744                 os_free(decrypted);
 745                 return eap_sim_client_error(data, req, respDataLen,
 746                                             EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 747         }
 748
 749         if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
 750                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid counter "
 751                            "(%d <= %d)", eattr.counter, data->counter);
 752                 data->counter_too_small = eattr.counter;
 753                 /* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
 754                  * reauth_id must not be used to start a new reauthentication.
 755                  * However, since it was used in the last EAP-Response-Identity
 756                  * packet, it has to saved for the following fullauth to be
 757                  * used in MK derivation. */
 758                 os_free(data->last_eap_identity);
 759                 data->last_eap_identity = data->reauth_id;
 760                 data->last_eap_identity_len = data->reauth_id_len;
 761                 data->reauth_id = NULL;
 762                 data->reauth_id_len = 0;
 763                 os_free(decrypted);
 764                 return eap_sim_response_reauth(data, req, respDataLen, 1);
 765         }
 766         data->counter = eattr.counter;
 767
 768         os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
 769         wpa_hexdump(MSG_DEBUG, "EAP-SIM: (encr) AT_NONCE_S",
 770                     data->nonce_s, EAP_SIM_NONCE_S_LEN);
 771
 772         eap_sim_derive_keys_reauth(data->counter,
 773                                    data->reauth_id, data->reauth_id_len,
 774                                    data->nonce_s, data->mk, data->msk,
 775                                    data->emsk);
 776         eap_sim_clear_identities(data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
 777         eap_sim_learn_ids(data, &eattr);
 778
 779         if (data->state != FAILURE)
 780                 data->state = SUCCESS;
 781
 782         data->num_id_req = 0;
 783         data->num_notification = 0;
 784         if (data->counter > EAP_SIM_MAX_FAST_REAUTHS) {
 785                 wpa_printf(MSG_DEBUG, "EAP-SIM: Maximum number of "
 786                            "fast reauths performed - force fullauth");
 787                 eap_sim_clear_identities(data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
 788         }
 789         os_free(decrypted);
 790         return eap_sim_response_reauth(data, req, respDataLen, 0);
 791 }
 792
 793
 794 static u8 * eap_sim_process(struct eap_sm *sm, void *priv,
 795                             struct eap_method_ret *ret,
 796                             const u8 *reqData, size_t reqDataLen,
 797                             size_t *respDataLen)
 798 {
 799         struct eap_sim_data *data = priv;
 800         const struct eap_hdr *req;
 801         u8 subtype, *res;
 802         const u8 *pos;
 803         struct eap_sim_attrs attr;
 804         size_t len;
 805
 806         wpa_hexdump(MSG_DEBUG, "EAP-SIM: EAP data", reqData, reqDataLen);
 807         if (eap_get_config_identity(sm, &len) == NULL) {
 808                 wpa_printf(MSG_INFO, "EAP-SIM: Identity not configured");
 809                 eap_sm_request_identity(sm);
 810                 ret->ignore = TRUE;
 811                 return NULL;
 812         }
 813
 814         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_SIM,
 815                                reqData, reqDataLen, &len);
 816         if (pos == NULL || len < 1) {
 817                 ret->ignore = TRUE;
 818                 return NULL;
 819         }
 820         req = (const struct eap_hdr *) reqData;
 821         len = be_to_host16(req->length);
 822
 823         ret->ignore = FALSE;
 824         ret->methodState = METHOD_MAY_CONT;
 825         ret->decision = DECISION_FAIL;
 826         ret->allowNotifications = TRUE;
 827
 828         subtype = *pos++;
 829         wpa_printf(MSG_DEBUG, "EAP-SIM: Subtype=%d", subtype);
 830         pos += 2; /* Reserved */
 831
 832         if (eap_sim_parse_attr(pos, reqData + len, &attr, 0, 0)) {
 833                 res = eap_sim_client_error(data, req, respDataLen,
 834                                            EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 835                 goto done;
 836         }
 837
 838         switch (subtype) {
 839         case EAP_SIM_SUBTYPE_START:
 840                 res = eap_sim_process_start(sm, data, req,
 841                                             respDataLen, &attr);
 842                 break;
 843         case EAP_SIM_SUBTYPE_CHALLENGE:
 844                 res = eap_sim_process_challenge(sm, data, req, len,
 845                                                 respDataLen, &attr);
 846                 break;
 847         case EAP_SIM_SUBTYPE_NOTIFICATION:
 848                 res = eap_sim_process_notification(sm, data, req, len,
 849                                                    respDataLen, &attr);
 850                 break;
 851         case EAP_SIM_SUBTYPE_REAUTHENTICATION:
 852                 res = eap_sim_process_reauthentication(sm, data, req, len,
 853                                                        respDataLen, &attr);
 854                 break;
 855         case EAP_SIM_SUBTYPE_CLIENT_ERROR:
 856                 wpa_printf(MSG_DEBUG, "EAP-SIM: subtype Client-Error");
 857                 res = eap_sim_client_error(data, req, respDataLen,
 858                                            EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 859                 break;
 860         default:
 861                 wpa_printf(MSG_DEBUG, "EAP-SIM: Unknown subtype=%d", subtype);
 862                 res = eap_sim_client_error(data, req, respDataLen,
 863                                            EAP_SIM_UNABLE_TO_PROCESS_PACKET);
 864                 break;
 865         }
 866
 867 done:
 868         if (data->state == FAILURE) {
 869                 ret->decision = DECISION_FAIL;
 870                 ret->methodState = METHOD_DONE;
 871         } else if (data->state == SUCCESS) {
 872                 ret->decision = DECISION_COND_SUCC;
 873                 ret->methodState = METHOD_DONE;
 874         }
 875
 876         if (ret->methodState == METHOD_DONE) {
 877                 ret->allowNotifications = FALSE;
 878         }
 879
 880         return res;
 881 }
 882
 883
 884 static Boolean eap_sim_has_reauth_data(struct eap_sm *sm, void *priv)
 885 {
 886         struct eap_sim_data *data = priv;
 887         return data->pseudonym || data->reauth_id;
 888 }
 889
 890
 891 static void eap_sim_deinit_for_reauth(struct eap_sm *sm, void *priv)
 892 {
 893         struct eap_sim_data *data = priv;
 894         eap_sim_clear_identities(data, CLEAR_EAP_ID);
 895 }
 896
 897
 898 static void * eap_sim_init_for_reauth(struct eap_sm *sm, void *priv)
 899 {
 900         struct eap_sim_data *data = priv;
 901         if (hostapd_get_rand(data->nonce_mt, EAP_SIM_NONCE_MT_LEN)) {
 902                 wpa_printf(MSG_WARNING, "EAP-SIM: Failed to get random data "
 903                            "for NONCE_MT");
 904                 os_free(data);
 905                 return NULL;
 906         }
 907         data->num_id_req = 0;
 908         data->num_notification = 0;
 909         data->state = CONTINUE;
 910         return priv;
 911 }
 912
 913
 914 static const u8 * eap_sim_get_identity(struct eap_sm *sm, void *priv,
 915                                        size_t *len)
 916 {
 917         struct eap_sim_data *data = priv;
 918
 919         if (data->reauth_id) {
 920                 *len = data->reauth_id_len;
 921                 return data->reauth_id;
 922         }
 923
 924         if (data->pseudonym) {
 925                 *len = data->pseudonym_len;
 926                 return data->pseudonym;
 927         }
 928
 929         return NULL;
 930 }
 931
 932
 933 static Boolean eap_sim_isKeyAvailable(struct eap_sm *sm, void *priv)
 934 {
 935         struct eap_sim_data *data = priv;
 936         return data->state == SUCCESS;
 937 }
 938
 939
 940 static u8 * eap_sim_getKey(struct eap_sm *sm, void *priv, size_t *len)
 941 {
 942         struct eap_sim_data *data = priv;
 943         u8 *key;
 944
 945         if (data->state != SUCCESS)
 946                 return NULL;
 947
 948         key = os_malloc(EAP_SIM_KEYING_DATA_LEN);
 949         if (key == NULL)
 950                 return NULL;
 951
 952         *len = EAP_SIM_KEYING_DATA_LEN;
 953         os_memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
 954
 955         return key;
 956 }
 957
 958
 959 static u8 * eap_sim_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 960 {
 961         struct eap_sim_data *data = priv;
 962         u8 *key;
 963
 964         if (data->state != SUCCESS)
 965                 return NULL;
 966
 967         key = os_malloc(EAP_EMSK_LEN);
 968         if (key == NULL)
 969                 return NULL;
 970
 971         *len = EAP_EMSK_LEN;
 972         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
 973
 974         return key;
 975 }
 976
 977
 978 int eap_peer_sim_register(void)
 979 {
 980         struct eap_method *eap;
 981         int ret;
 982
 983         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
 984                                     EAP_VENDOR_IETF, EAP_TYPE_SIM, "SIM");
 985         if (eap == NULL)
 986                 return -1;
 987
 988         eap->init = eap_sim_init;
 989         eap->deinit = eap_sim_deinit;
 990         eap->process = eap_sim_process;
 991         eap->isKeyAvailable = eap_sim_isKeyAvailable;
 992         eap->getKey = eap_sim_getKey;
 993         eap->has_reauth_data = eap_sim_has_reauth_data;
 994         eap->deinit_for_reauth = eap_sim_deinit_for_reauth;
 995         eap->init_for_reauth = eap_sim_init_for_reauth;
 996         eap->get_identity = eap_sim_get_identity;
 997         eap->get_emsk = eap_sim_get_emsk;
 998
 999         ret = eap_peer_method_register(eap);
1000         if (ret)
1001                 eap_peer_method_free(eap);
1002         return ret;
1003 }