contrib/wpa_supplicant/eap_sim_common.c

   1 /*
   2  * EAP peer: EAP-SIM/AKA shared routines
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_i.h"
  19 #include "sha1.h"
  20 #include "crypto.h"
  21 #include "aes_wrap.h"
  22 #include "eap_sim_common.h"
  23
  24
  25 static int eap_sim_prf(const u8 *key, u8 *x, size_t xlen)
  26 {
  27         return fips186_2_prf(key, EAP_SIM_MK_LEN, x, xlen);
  28 }
  29
  30
  31 void eap_sim_derive_mk(const u8 *identity, size_t identity_len,
  32                        const u8 *nonce_mt, u16 selected_version,
  33                        const u8 *ver_list, size_t ver_list_len,
  34                        int num_chal, const u8 *kc, u8 *mk)
  35 {
  36         u8 sel_ver[2];
  37         const unsigned char *addr[5];
  38         size_t len[5];
  39
  40         addr[0] = identity;
  41         len[0] = identity_len;
  42         addr[1] = kc;
  43         len[1] = num_chal * EAP_SIM_KC_LEN;
  44         addr[2] = nonce_mt;
  45         len[2] = EAP_SIM_NONCE_MT_LEN;
  46         addr[3] = ver_list;
  47         len[3] = ver_list_len;
  48         addr[4] = sel_ver;
  49         len[4] = 2;
  50
  51         WPA_PUT_BE16(sel_ver, selected_version);
  52
  53         /* MK = SHA1(Identity|n*Kc|NONCE_MT|Version List|Selected Version) */
  54         sha1_vector(5, addr, len, mk);
  55         wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: MK", mk, EAP_SIM_MK_LEN);
  56 }
  57
  58
  59 void eap_aka_derive_mk(const u8 *identity, size_t identity_len,
  60                        const u8 *ik, const u8 *ck, u8 *mk)
  61 {
  62         const u8 *addr[3];
  63         size_t len[3];
  64
  65         addr[0] = identity;
  66         len[0] = identity_len;
  67         addr[1] = ik;
  68         len[1] = EAP_AKA_IK_LEN;
  69         addr[2] = ck;
  70         len[2] = EAP_AKA_CK_LEN;
  71
  72         /* MK = SHA1(Identity|IK|CK) */
  73         sha1_vector(3, addr, len, mk);
  74         wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", ik, EAP_AKA_IK_LEN);
  75         wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", ck, EAP_AKA_CK_LEN);
  76         wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: MK", mk, EAP_SIM_MK_LEN);
  77 }
  78
  79
  80 int eap_sim_derive_keys(const u8 *mk, u8 *k_encr, u8 *k_aut, u8 *msk, u8 *emsk)
  81 {
  82         u8 buf[EAP_SIM_K_ENCR_LEN + EAP_SIM_K_AUT_LEN +
  83                EAP_SIM_KEYING_DATA_LEN + EAP_EMSK_LEN], *pos;
  84         if (eap_sim_prf(mk, buf, sizeof(buf)) < 0) {
  85                 wpa_printf(MSG_ERROR, "EAP-SIM: Failed to derive keys");
  86                 return -1;
  87         }
  88         pos = buf;
  89         os_memcpy(k_encr, pos, EAP_SIM_K_ENCR_LEN);
  90         pos += EAP_SIM_K_ENCR_LEN;
  91         os_memcpy(k_aut, pos, EAP_SIM_K_AUT_LEN);
  92         pos += EAP_SIM_K_AUT_LEN;
  93         os_memcpy(msk, pos, EAP_SIM_KEYING_DATA_LEN);
  94         pos += EAP_SIM_KEYING_DATA_LEN;
  95         os_memcpy(emsk, pos, EAP_EMSK_LEN);
  96
  97         wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: K_encr",
  98                         k_encr, EAP_SIM_K_ENCR_LEN);
  99         wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: K_aut",
 100                         k_aut, EAP_SIM_K_AUT_LEN);
 101         wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: keying material (MSK)",
 102                         msk, EAP_SIM_KEYING_DATA_LEN);
 103         wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: EMSK", emsk, EAP_EMSK_LEN);
 104         os_memset(buf, 0, sizeof(buf));
 105
 106         return 0;
 107 }
 108
 109
 110 int eap_sim_derive_keys_reauth(u16 _counter,
 111                                const u8 *identity, size_t identity_len,
 112                                const u8 *nonce_s, const u8 *mk, u8 *msk,
 113                                u8 *emsk)
 114 {
 115         u8 xkey[SHA1_MAC_LEN];
 116         u8 buf[EAP_SIM_KEYING_DATA_LEN + EAP_EMSK_LEN + 32];
 117         u8 counter[2];
 118         const u8 *addr[4];
 119         size_t len[4];
 120
 121         while (identity_len > 0 && identity[identity_len - 1] == 0) {
 122                 wpa_printf(MSG_DEBUG, "EAP-SIM: Workaround - drop null "
 123                            "character from the end of identity");
 124                 identity_len--;
 125         }
 126         addr[0] = identity;
 127         len[0] = identity_len;
 128         addr[1] = counter;
 129         len[1] = 2;
 130         addr[2] = nonce_s;
 131         len[2] = EAP_SIM_NONCE_S_LEN;
 132         addr[3] = mk;
 133         len[3] = EAP_SIM_MK_LEN;
 134
 135         WPA_PUT_BE16(counter, _counter);
 136
 137         wpa_printf(MSG_DEBUG, "EAP-SIM: Deriving keying data from reauth");
 138         wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM: Identity",
 139                           identity, identity_len);
 140         wpa_hexdump(MSG_DEBUG, "EAP-SIM: counter", counter, 2);
 141         wpa_hexdump(MSG_DEBUG, "EAP-SIM: NONCE_S", nonce_s,
 142                     EAP_SIM_NONCE_S_LEN);
 143         wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: MK", mk, EAP_SIM_MK_LEN);
 144
 145         /* XKEY' = SHA1(Identity|counter|NONCE_S|MK) */
 146         sha1_vector(4, addr, len, xkey);
 147         wpa_hexdump(MSG_DEBUG, "EAP-SIM: XKEY'", xkey, SHA1_MAC_LEN);
 148
 149         if (eap_sim_prf(xkey, buf, sizeof(buf)) < 0) {
 150                 wpa_printf(MSG_ERROR, "EAP-SIM: Failed to derive keys");
 151                 return -1;
 152         }
 153         if (msk) {
 154                 os_memcpy(msk, buf, EAP_SIM_KEYING_DATA_LEN);
 155                 wpa_hexdump(MSG_DEBUG, "EAP-SIM: keying material (MSK)",
 156                             msk, EAP_SIM_KEYING_DATA_LEN);
 157         }
 158         if (emsk) {
 159                 os_memcpy(emsk, buf + EAP_SIM_KEYING_DATA_LEN, EAP_EMSK_LEN);
 160                 wpa_hexdump(MSG_DEBUG, "EAP-SIM: EMSK", emsk, EAP_EMSK_LEN);
 161         }
 162         os_memset(buf, 0, sizeof(buf));
 163
 164         return 0;
 165 }
 166
 167
 168 int eap_sim_verify_mac(const u8 *k_aut, const u8 *req, size_t req_len,
 169                        const u8 *mac, const u8 *extra, size_t extra_len)
 170 {
 171         unsigned char hmac[SHA1_MAC_LEN];
 172         const u8 *addr[2];
 173         size_t len[2];
 174         u8 *tmp;
 175
 176         if (mac == NULL || req_len < EAP_SIM_MAC_LEN || mac < req ||
 177             mac > req + req_len - EAP_SIM_MAC_LEN)
 178                 return -1;
 179
 180         tmp = os_malloc(req_len);
 181         if (tmp == NULL)
 182                 return -1;
 183
 184         addr[0] = tmp;
 185         len[0] = req_len;
 186         addr[1] = extra;
 187         len[1] = extra_len;
 188
 189         /* HMAC-SHA1-128 */
 190         os_memcpy(tmp, req, req_len);
 191         os_memset(tmp + (mac - req), 0, EAP_SIM_MAC_LEN);
 192         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC - msg", tmp, req_len);
 193         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC - extra data",
 194                     extra, extra_len);
 195         wpa_hexdump_key(MSG_MSGDUMP, "EAP-SIM: Verify MAC - K_aut",
 196                         k_aut, EAP_SIM_K_AUT_LEN);
 197         hmac_sha1_vector(k_aut, EAP_SIM_K_AUT_LEN, 2, addr, len, hmac);
 198         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC: MAC",
 199                     hmac, EAP_SIM_MAC_LEN);
 200         os_free(tmp);
 201
 202         return (os_memcmp(hmac, mac, EAP_SIM_MAC_LEN) == 0) ? 0 : 1;
 203 }
 204
 205
 206 void eap_sim_add_mac(const u8 *k_aut, u8 *msg, size_t msg_len, u8 *mac,
 207                      const u8 *extra, size_t extra_len)
 208 {
 209         unsigned char hmac[SHA1_MAC_LEN];
 210         const u8 *addr[2];
 211         size_t len[2];
 212
 213         addr[0] = msg;
 214         len[0] = msg_len;
 215         addr[1] = extra;
 216         len[1] = extra_len;
 217
 218         /* HMAC-SHA1-128 */
 219         os_memset(mac, 0, EAP_SIM_MAC_LEN);
 220         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC - msg", msg, msg_len);
 221         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC - extra data",
 222                     extra, extra_len);
 223         wpa_hexdump_key(MSG_MSGDUMP, "EAP-SIM: Add MAC - K_aut",
 224                         k_aut, EAP_SIM_K_AUT_LEN);
 225         hmac_sha1_vector(k_aut, EAP_SIM_K_AUT_LEN, 2, addr, len, hmac);
 226         os_memcpy(mac, hmac, EAP_SIM_MAC_LEN);
 227         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC: MAC",
 228                     mac, EAP_SIM_MAC_LEN);
 229 }
 230
 231
 232 int eap_sim_parse_attr(const u8 *start, const u8 *end,
 233                        struct eap_sim_attrs *attr, int aka, int encr)
 234 {
 235         const u8 *pos = start, *apos;
 236         size_t alen, plen, i, list_len;
 237
 238         os_memset(attr, 0, sizeof(*attr));
 239         attr->id_req = NO_ID_REQ;
 240         attr->notification = -1;
 241         attr->counter = -1;
 242         attr->selected_version = -1;
 243         attr->client_error_code = -1;
 244
 245         while (pos < end) {
 246                 if (pos + 2 > end) {
 247                         wpa_printf(MSG_INFO, "EAP-SIM: Attribute overflow(1)");
 248                         return -1;
 249                 }
 250                 wpa_printf(MSG_MSGDUMP, "EAP-SIM: Attribute: Type=%d Len=%d",
 251                            pos[0], pos[1] * 4);
 252                 if (pos + pos[1] * 4 > end) {
 253                         wpa_printf(MSG_INFO, "EAP-SIM: Attribute overflow "
 254                                    "(pos=%p len=%d end=%p)",
 255                                    pos, pos[1] * 4, end);
 256                         return -1;
 257                 }
 258                 if (pos[1] == 0) {
 259                         wpa_printf(MSG_INFO, "EAP-SIM: Attribute underflow");
 260                         return -1;
 261                 }
 262                 apos = pos + 2;
 263                 alen = pos[1] * 4 - 2;
 264                 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Attribute data",
 265                             apos, alen);
 266
 267                 switch (pos[0]) {
 268                 case EAP_SIM_AT_RAND:
 269                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RAND");
 270                         apos += 2;
 271                         alen -= 2;
 272                         if ((!aka && (alen % GSM_RAND_LEN)) ||
 273                             (aka && alen != EAP_AKA_RAND_LEN)) {
 274                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_RAND"
 275                                            " (len %lu)",
 276                                            (unsigned long) alen);
 277                                 return -1;
 278                         }
 279                         attr->rand = apos;
 280                         attr->num_chal = alen / GSM_RAND_LEN;
 281                         break;
 282                 case EAP_SIM_AT_AUTN:
 283                         wpa_printf(MSG_DEBUG, "EAP-AKA: AT_AUTN");
 284                         if (!aka) {
 285                                 wpa_printf(MSG_DEBUG, "EAP-SIM: "
 286                                            "Unexpected AT_AUTN");
 287                                 return -1;
 288                         }
 289                         apos += 2;
 290                         alen -= 2;
 291                         if (alen != EAP_AKA_AUTN_LEN) {
 292                                 wpa_printf(MSG_INFO, "EAP-AKA: Invalid AT_AUTN"
 293                                            " (len %lu)",
 294                                            (unsigned long) alen);
 295                                 return -1;
 296                         }
 297                         attr->autn = apos;
 298                         break;
 299                 case EAP_SIM_AT_PADDING:
 300                         if (!encr) {
 301                                 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
 302                                            "AT_PADDING");
 303                                 return -1;
 304                         }
 305                         wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) AT_PADDING");
 306                         for (i = 2; i < alen; i++) {
 307                                 if (apos[i] != 0) {
 308                                         wpa_printf(MSG_INFO, "EAP-SIM: (encr) "
 309                                                    "AT_PADDING used a non-zero"
 310                                                    " padding byte");
 311                                         wpa_hexdump(MSG_DEBUG, "EAP-SIM: "
 312                                                     "(encr) padding bytes",
 313                                                     apos + 2, alen - 2);
 314                                         return -1;
 315                                 }
 316                         }
 317                         break;
 318                 case EAP_SIM_AT_NONCE_MT:
 319                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_NONCE_MT");
 320                         if (alen != 2 + EAP_SIM_NONCE_MT_LEN) {
 321                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
 322                                            "AT_NONCE_MT length");
 323                                 return -1;
 324                         }
 325                         attr->nonce_mt = apos + 2;
 326                         break;
 327                 case EAP_SIM_AT_PERMANENT_ID_REQ:
 328                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_PERMANENT_ID_REQ");
 329                         attr->id_req = PERMANENT_ID;
 330                         break;
 331                 case EAP_SIM_AT_MAC:
 332                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_MAC");
 333                         if (alen != 2 + EAP_SIM_MAC_LEN) {
 334                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_MAC "
 335                                            "length");
 336                                 return -1;
 337                         }
 338                         attr->mac = apos + 2;
 339                         break;
 340                 case EAP_SIM_AT_NOTIFICATION:
 341                         if (alen != 2) {
 342                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
 343                                            "AT_NOTIFICATION length %lu",
 344                                            (unsigned long) alen);
 345                                 return -1;
 346                         }
 347                         attr->notification = apos[0] * 256 + apos[1];
 348                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_NOTIFICATION %d",
 349                                    attr->notification);
 350                         break;
 351                 case EAP_SIM_AT_ANY_ID_REQ:
 352                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_ANY_ID_REQ");
 353                         attr->id_req = ANY_ID;
 354                         break;
 355                 case EAP_SIM_AT_IDENTITY:
 356                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_IDENTITY");
 357                         attr->identity = apos + 2;
 358                         attr->identity_len = alen - 2;
 359                         break;
 360                 case EAP_SIM_AT_VERSION_LIST:
 361                         if (aka) {
 362                                 wpa_printf(MSG_DEBUG, "EAP-AKA: "
 363                                            "Unexpected AT_VERSION_LIST");
 364                                 return -1;
 365                         }
 366                         list_len = apos[0] * 256 + apos[1];
 367                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_VERSION_LIST");
 368                         if (list_len < 2 || list_len > alen - 2) {
 369                                 wpa_printf(MSG_WARNING, "EAP-SIM: Invalid "
 370                                            "AT_VERSION_LIST (list_len=%lu "
 371                                            "attr_len=%lu)",
 372                                            (unsigned long) list_len,
 373                                            (unsigned long) alen);
 374                                 return -1;
 375                         }
 376                         attr->version_list = apos + 2;
 377                         attr->version_list_len = list_len;
 378                         break;
 379                 case EAP_SIM_AT_SELECTED_VERSION:
 380                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_SELECTED_VERSION");
 381                         if (alen != 2) {
 382                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
 383                                            "AT_SELECTED_VERSION length %lu",
 384                                            (unsigned long) alen);
 385                                 return -1;
 386                         }
 387                         attr->selected_version = apos[0] * 256 + apos[1];
 388                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_SELECTED_VERSION "
 389                                    "%d", attr->selected_version);
 390                         break;
 391                 case EAP_SIM_AT_FULLAUTH_ID_REQ:
 392                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_FULLAUTH_ID_REQ");
 393                         attr->id_req = FULLAUTH_ID;
 394                         break;
 395                 case EAP_SIM_AT_COUNTER:
 396                         if (!encr) {
 397                                 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
 398                                            "AT_COUNTER");
 399                                 return -1;
 400                         }
 401                         if (alen != 2) {
 402                                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
 403                                            "AT_COUNTER (alen=%lu)",
 404                                            (unsigned long) alen);
 405                                 return -1;
 406                         }
 407                         attr->counter = apos[0] * 256 + apos[1];
 408                         wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) AT_COUNTER %d",
 409                                    attr->counter);
 410                         break;
 411                 case EAP_SIM_AT_COUNTER_TOO_SMALL:
 412                         if (!encr) {
 413                                 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
 414                                            "AT_COUNTER_TOO_SMALL");
 415                                 return -1;
 416                         }
 417                         if (alen != 2) {
 418                                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
 419                                            "AT_COUNTER_TOO_SMALL (alen=%lu)",
 420                                            (unsigned long) alen);
 421                                 return -1;
 422                         }
 423                         wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
 424                                    "AT_COUNTER_TOO_SMALL");
 425                         attr->counter_too_small = 1;
 426                         break;
 427                 case EAP_SIM_AT_NONCE_S:
 428                         if (!encr) {
 429                                 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
 430                                            "AT_NONCE_S");
 431                                 return -1;
 432                         }
 433                         wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
 434                                    "AT_NONCE_S");
 435                         if (alen != 2 + EAP_SIM_NONCE_S_LEN) {
 436                                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
 437                                            "AT_NONCE_S (alen=%lu)",
 438                                            (unsigned long) alen);
 439                                 return -1;
 440                         }
 441                         attr->nonce_s = apos + 2;
 442                         break;
 443                 case EAP_SIM_AT_CLIENT_ERROR_CODE:
 444                         if (alen != 2) {
 445                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
 446                                            "AT_CLIENT_ERROR_CODE length %lu",
 447                                            (unsigned long) alen);
 448                                 return -1;
 449                         }
 450                         attr->client_error_code = apos[0] * 256 + apos[1];
 451                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_CLIENT_ERROR_CODE "
 452                                    "%d", attr->client_error_code);
 453                         break;
 454                 case EAP_SIM_AT_IV:
 455                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_IV");
 456                         if (alen != 2 + EAP_SIM_MAC_LEN) {
 457                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_IV "
 458                                            "length %lu", (unsigned long) alen);
 459                                 return -1;
 460                         }
 461                         attr->iv = apos + 2;
 462                         break;
 463                 case EAP_SIM_AT_ENCR_DATA:
 464                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_ENCR_DATA");
 465                         attr->encr_data = apos + 2;
 466                         attr->encr_data_len = alen - 2;
 467                         if (attr->encr_data_len % 16) {
 468                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
 469                                            "AT_ENCR_DATA length %lu",
 470                                            (unsigned long)
 471                                            attr->encr_data_len);
 472                                 return -1;
 473                         }
 474                         break;
 475                 case EAP_SIM_AT_NEXT_PSEUDONYM:
 476                         if (!encr) {
 477                                 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
 478                                            "AT_NEXT_PSEUDONYM");
 479                                 return -1;
 480                         }
 481                         wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
 482                                    "AT_NEXT_PSEUDONYM");
 483                         plen = apos[0] * 256 + apos[1];
 484                         if (plen > alen - 2) {
 485                                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid"
 486                                            " AT_NEXT_PSEUDONYM (actual"
 487                                            " len %lu, attr len %lu)",
 488                                            (unsigned long) plen,
 489                                            (unsigned long) alen);
 490                                 return -1;
 491                         }
 492                         attr->next_pseudonym = pos + 4;
 493                         attr->next_pseudonym_len = plen;
 494                         break;
 495                 case EAP_SIM_AT_NEXT_REAUTH_ID:
 496                         if (!encr) {
 497                                 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
 498                                            "AT_NEXT_REAUTH_ID");
 499                                 return -1;
 500                         }
 501                         wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
 502                                    "AT_NEXT_REAUTH_ID");
 503                         plen = apos[0] * 256 + apos[1];
 504                         if (plen > alen - 2) {
 505                                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid"
 506                                            " AT_NEXT_REAUTH_ID (actual"
 507                                            " len %lu, attr len %lu)",
 508                                            (unsigned long) plen,
 509                                            (unsigned long) alen);
 510                                 return -1;
 511                         }
 512                         attr->next_reauth_id = pos + 4;
 513                         attr->next_reauth_id_len = plen;
 514                         break;
 515                 case EAP_SIM_AT_RES:
 516                         wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RES");
 517                         apos += 2;
 518                         alen -= 2;
 519                         if (!aka || alen < EAP_AKA_MIN_RES_LEN ||
 520                             alen > EAP_AKA_MAX_RES_LEN) {
 521                                 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_RES "
 522                                            "(len %lu)",
 523                                            (unsigned long) alen);
 524                                 return -1;
 525                         }
 526                         attr->res = apos;
 527                         attr->res_len = alen;
 528                         break;
 529                 case EAP_SIM_AT_AUTS:
 530                         wpa_printf(MSG_DEBUG, "EAP-AKA: AT_AUTS");
 531                         if (!aka) {
 532                                 wpa_printf(MSG_DEBUG, "EAP-SIM: "
 533                                            "Unexpected AT_AUTS");
 534                                 return -1;
 535                         }
 536                         if (alen != EAP_AKA_AUTS_LEN) {
 537                                 wpa_printf(MSG_INFO, "EAP-AKA: Invalid AT_AUTS"
 538                                            " (len %lu)",
 539                                            (unsigned long) alen);
 540                                 return -1;
 541                         }
 542                         attr->auts = apos;
 543                         break;
 544                 default:
 545                         if (pos[0] < 128) {
 546                                 wpa_printf(MSG_INFO, "EAP-SIM: Unrecognized "
 547                                            "non-skippable attribute %d",
 548                                            pos[0]);
 549                                 return -1;
 550                         }
 551
 552                         wpa_printf(MSG_DEBUG, "EAP-SIM: Unrecognized skippable"
 553                                    " attribute %d ignored", pos[0]);
 554                         break;
 555                 }
 556
 557                 pos += pos[1] * 4;
 558         }
 559
 560         wpa_printf(MSG_DEBUG, "EAP-SIM: Attributes parsed successfully "
 561                    "(aka=%d encr=%d)", aka, encr);
 562
 563         return 0;
 564 }
 565
 566
 567 u8 * eap_sim_parse_encr(const u8 *k_encr, const u8 *encr_data,
 568                         size_t encr_data_len, const u8 *iv,
 569                         struct eap_sim_attrs *attr, int aka)
 570 {
 571         u8 *decrypted;
 572
 573         if (!iv) {
 574                 wpa_printf(MSG_INFO, "EAP-SIM: Encrypted data, but no IV");
 575                 return NULL;
 576         }
 577
 578         decrypted = os_malloc(encr_data_len);
 579         if (decrypted == NULL)
 580                 return NULL;
 581         os_memcpy(decrypted, encr_data, encr_data_len);
 582
 583         aes_128_cbc_decrypt(k_encr, iv, decrypted, encr_data_len);
 584         wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Decrypted AT_ENCR_DATA",
 585                     decrypted, encr_data_len);
 586
 587         if (eap_sim_parse_attr(decrypted, decrypted + encr_data_len, attr,
 588                                aka, 1)) {
 589                 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Failed to parse "
 590                            "decrypted AT_ENCR_DATA");
 591                 os_free(decrypted);
 592                 return NULL;
 593         }
 594
 595         return decrypted;
 596 }
 597
 598
 599 #define EAP_SIM_INIT_LEN 128
 600
 601 struct eap_sim_msg {
 602         u8 *buf;
 603         size_t buf_len, used;
 604         size_t mac, iv, encr; /* index from buf */
 605 };
 606
 607
 608 struct eap_sim_msg * eap_sim_msg_init(int code, int id, int type, int subtype)
 609 {
 610         struct eap_sim_msg *msg;
 611         struct eap_hdr *eap;
 612         u8 *pos;
 613
 614         msg = os_zalloc(sizeof(*msg));
 615         if (msg == NULL)
 616                 return NULL;
 617
 618         msg->buf = os_zalloc(EAP_SIM_INIT_LEN);
 619         if (msg->buf == NULL) {
 620                 os_free(msg);
 621                 return NULL;
 622         }
 623         msg->buf_len = EAP_SIM_INIT_LEN;
 624         eap = (struct eap_hdr *) msg->buf;
 625         eap->code = code;
 626         eap->identifier = id;
 627         msg->used = sizeof(*eap);
 628
 629         pos = (u8 *) (eap + 1);
 630         *pos++ = type;
 631         *pos++ = subtype;
 632         *pos++ = 0; /* Reserved */
 633         *pos++ = 0; /* Reserved */
 634         msg->used += 4;
 635
 636         return msg;
 637 }
 638
 639
 640 u8 * eap_sim_msg_finish(struct eap_sim_msg *msg, size_t *len, const u8 *k_aut,
 641                         const u8 *extra, size_t extra_len)
 642 {
 643         struct eap_hdr *eap;
 644         u8 *buf;
 645
 646         if (msg == NULL)
 647                 return NULL;
 648
 649         eap = (struct eap_hdr *) msg->buf;
 650         eap->length = host_to_be16(msg->used);
 651
 652         if (k_aut && msg->mac) {
 653                 eap_sim_add_mac(k_aut, msg->buf, msg->used,
 654                                 msg->buf + msg->mac, extra, extra_len);
 655         }
 656
 657         *len = msg->used;
 658         buf = msg->buf;
 659         os_free(msg);
 660         return buf;
 661 }
 662
 663
 664 void eap_sim_msg_free(struct eap_sim_msg *msg)
 665 {
 666         if (msg) {
 667                 os_free(msg->buf);
 668                 os_free(msg);
 669         }
 670 }
 671
 672
 673 static int eap_sim_msg_resize(struct eap_sim_msg *msg, size_t add_len)
 674 {
 675         if (msg->used + add_len > msg->buf_len) {
 676                 u8 *nbuf = os_realloc(msg->buf, msg->used + add_len);
 677                 if (nbuf == NULL)
 678                         return -1;
 679                 msg->buf = nbuf;
 680                 msg->buf_len = msg->used + add_len;
 681         }
 682         return 0;
 683 }
 684
 685
 686 u8 * eap_sim_msg_add_full(struct eap_sim_msg *msg, u8 attr,
 687                           const u8 *data, size_t len)
 688 {
 689         int attr_len = 2 + len;
 690         int pad_len;
 691         u8 *start, *pos;
 692
 693         if (msg == NULL)
 694                 return NULL;
 695
 696         pad_len = (4 - attr_len % 4) % 4;
 697         attr_len += pad_len;
 698         if (eap_sim_msg_resize(msg, attr_len))
 699                 return NULL;
 700         start = pos = msg->buf + msg->used;
 701         *pos++ = attr;
 702         *pos++ = attr_len / 4;
 703         os_memcpy(pos, data, len);
 704         if (pad_len) {
 705                 pos += len;
 706                 os_memset(pos, 0, pad_len);
 707         }
 708         msg->used += attr_len;
 709         return start;
 710 }
 711
 712
 713 u8 * eap_sim_msg_add(struct eap_sim_msg *msg, u8 attr, u16 value,
 714                      const u8 *data, size_t len)
 715 {
 716         int attr_len = 4 + len;
 717         int pad_len;
 718         u8 *start, *pos;
 719
 720         if (msg == NULL)
 721                 return NULL;
 722
 723         pad_len = (4 - attr_len % 4) % 4;
 724         attr_len += pad_len;
 725         if (eap_sim_msg_resize(msg, attr_len))
 726                 return NULL;
 727         start = pos = msg->buf + msg->used;
 728         *pos++ = attr;
 729         *pos++ = attr_len / 4;
 730         WPA_PUT_BE16(pos, value);
 731         pos += 2;
 732         if (data)
 733                 os_memcpy(pos, data, len);
 734         if (pad_len) {
 735                 pos += len;
 736                 os_memset(pos, 0, pad_len);
 737         }
 738         msg->used += attr_len;
 739         return start;
 740 }
 741
 742
 743 u8 * eap_sim_msg_add_mac(struct eap_sim_msg *msg, u8 attr)
 744 {
 745         u8 *pos = eap_sim_msg_add(msg, attr, 0, NULL, EAP_SIM_MAC_LEN);
 746         if (pos)
 747                 msg->mac = (pos - msg->buf) + 4;
 748         return pos;
 749 }
 750
 751
 752 int eap_sim_msg_add_encr_start(struct eap_sim_msg *msg, u8 attr_iv,
 753                                u8 attr_encr)
 754 {
 755         u8 *pos = eap_sim_msg_add(msg, attr_iv, 0, NULL, EAP_SIM_IV_LEN);
 756         if (pos == NULL)
 757                 return -1;
 758         msg->iv = (pos - msg->buf) + 4;
 759         if (hostapd_get_rand(msg->buf + msg->iv, EAP_SIM_IV_LEN)) {
 760                 msg->iv = 0;
 761                 return -1;
 762         }
 763
 764         pos = eap_sim_msg_add(msg, attr_encr, 0, NULL, 0);
 765         if (pos == NULL) {
 766                 msg->iv = 0;
 767                 return -1;
 768         }
 769         msg->encr = pos - msg->buf;
 770
 771         return 0;
 772 }
 773
 774
 775 int eap_sim_msg_add_encr_end(struct eap_sim_msg *msg, u8 *k_encr, int attr_pad)
 776 {
 777         size_t encr_len;
 778
 779         if (msg == NULL || k_encr == NULL || msg->iv == 0 || msg->encr == 0)
 780                 return -1;
 781
 782         encr_len = msg->used - msg->encr - 4;
 783         if (encr_len % 16) {
 784                 u8 *pos;
 785                 int pad_len = 16 - (encr_len % 16);
 786                 if (pad_len < 4) {
 787                         wpa_printf(MSG_WARNING, "EAP-SIM: "
 788                                    "eap_sim_msg_add_encr_end - invalid pad_len"
 789                                    " %d", pad_len);
 790                         return -1;
 791                 }
 792                 wpa_printf(MSG_DEBUG, "   *AT_PADDING");
 793                 pos = eap_sim_msg_add(msg, attr_pad, 0, NULL, pad_len - 4);
 794                 if (pos == NULL)
 795                         return -1;
 796                 os_memset(pos + 4, 0, pad_len - 4);
 797                 encr_len += pad_len;
 798         }
 799         wpa_printf(MSG_DEBUG, "   (AT_ENCR_DATA data len %lu)",
 800                    (unsigned long) encr_len);
 801         msg->buf[msg->encr + 1] = encr_len / 4 + 1;
 802         aes_128_cbc_encrypt(k_encr, msg->buf + msg->iv,
 803                             msg->buf + msg->encr + 4, encr_len);
 804
 805         return 0;
 806 }
 807
 808
 809 void eap_sim_report_notification(void *msg_ctx, int notification, int aka)
 810 {
 811 #ifndef CONFIG_NO_STDOUT_DEBUG
 812         const char *type = aka ? "AKA" : "SIM";
 813 #endif /* CONFIG_NO_STDOUT_DEBUG */
 814
 815         switch (notification) {
 816         case EAP_SIM_GENERAL_FAILURE_AFTER_AUTH:
 817                 wpa_printf(MSG_WARNING, "EAP-%s: General failure "
 818                            "notification (after authentication)", type);
 819                 break;
 820         case EAP_SIM_TEMPORARILY_DENIED:
 821                 wpa_printf(MSG_WARNING, "EAP-%s: Failure notification: "
 822                            "User has been temporarily denied access to the "
 823                            "requested service", type);
 824                 break;
 825         case EAP_SIM_NOT_SUBSCRIBED:
 826                 wpa_printf(MSG_WARNING, "EAP-%s: Failure notification: "
 827                            "User has not subscribed to the requested service",
 828                            type);
 829                 break;
 830         case EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH:
 831                 wpa_printf(MSG_WARNING, "EAP-%s: General failure "
 832                            "notification (before authentication)", type);
 833                 break;
 834         case EAP_SIM_SUCCESS:
 835                 wpa_printf(MSG_INFO, "EAP-%s: Successful authentication "
 836                            "notification", type);
 837                 break;
 838         default:
 839                 if (notification >= 32768) {
 840                         wpa_printf(MSG_INFO, "EAP-%s: Unrecognized "
 841                                    "non-failure notification %d",
 842                                    type, notification);
 843                 } else {
 844                         wpa_printf(MSG_WARNING, "EAP-%s: Unrecognized "
 845                                    "failure notification %d",
 846                                    type, notification);
 847                 }
 848         }
 849 }