src/eap_peer/eap_aka.c

   1 /*
   2  * EAP peer method: EAP-AKA (RFC 4187)
   3  * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_peer/eap_i.h"
  19 #include "pcsc_funcs.h"
  20 #include "eap_common/eap_sim_common.h"
  21 #include "sha1.h"
  22 #include "crypto.h"
  23 #include "eap_peer/eap_config.h"
  24 #ifdef CONFIG_USIM_SIMULATOR
  25 #include "hlr_auc_gw/milenage.h"
  26 #endif /* CONFIG_USIM_SIMULATOR */
  27
  28
  29 struct eap_aka_data {
  30         u8 ik[EAP_AKA_IK_LEN], ck[EAP_AKA_CK_LEN], res[EAP_AKA_RES_MAX_LEN];
  31         size_t res_len;
  32         u8 nonce_s[EAP_SIM_NONCE_S_LEN];
  33         u8 mk[EAP_SIM_MK_LEN];
  34         u8 k_aut[EAP_SIM_K_AUT_LEN];
  35         u8 k_encr[EAP_SIM_K_ENCR_LEN];
  36         u8 msk[EAP_SIM_KEYING_DATA_LEN];
  37         u8 emsk[EAP_EMSK_LEN];
  38         u8 rand[EAP_AKA_RAND_LEN], autn[EAP_AKA_AUTN_LEN];
  39         u8 auts[EAP_AKA_AUTS_LEN];
  40
  41         int num_id_req, num_notification;
  42         u8 *pseudonym;
  43         size_t pseudonym_len;
  44         u8 *reauth_id;
  45         size_t reauth_id_len;
  46         int reauth;
  47         unsigned int counter, counter_too_small;
  48         u8 *last_eap_identity;
  49         size_t last_eap_identity_len;
  50         enum {
  51                 CONTINUE, RESULT_SUCCESS, RESULT_FAILURE, SUCCESS, FAILURE
  52         } state;
  53
  54         struct wpabuf *id_msgs;
  55         int prev_id;
  56         int result_ind, use_result_ind;
  57 };
  58
  59
  60 #ifndef CONFIG_NO_STDOUT_DEBUG
  61 static const char * eap_aka_state_txt(int state)
  62 {
  63         switch (state) {
  64         case CONTINUE:
  65                 return "CONTINUE";
  66         case RESULT_SUCCESS:
  67                 return "RESULT_SUCCESS";
  68         case RESULT_FAILURE:
  69                 return "RESULT_FAILURE";
  70         case SUCCESS:
  71                 return "SUCCESS";
  72         case FAILURE:
  73                 return "FAILURE";
  74         default:
  75                 return "?";
  76         }
  77 }
  78 #endif /* CONFIG_NO_STDOUT_DEBUG */
  79
  80
  81 static void eap_aka_state(struct eap_aka_data *data, int state)
  82 {
  83         wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
  84                    eap_aka_state_txt(data->state),
  85                    eap_aka_state_txt(state));
  86         data->state = state;
  87 }
  88
  89
  90 static void * eap_aka_init(struct eap_sm *sm)
  91 {
  92         struct eap_aka_data *data;
  93         const char *phase1 = eap_get_config_phase1(sm);
  94
  95         data = os_zalloc(sizeof(*data));
  96         if (data == NULL)
  97                 return NULL;
  98
  99         eap_aka_state(data, CONTINUE);
 100         data->prev_id = -1;
 101
 102         data->result_ind = phase1 && os_strstr(phase1, "result_ind=1") != NULL;
 103
 104         return data;
 105 }
 106
 107
 108 static void eap_aka_deinit(struct eap_sm *sm, void *priv)
 109 {
 110         struct eap_aka_data *data = priv;
 111         if (data) {
 112                 os_free(data->pseudonym);
 113                 os_free(data->reauth_id);
 114                 os_free(data->last_eap_identity);
 115                 wpabuf_free(data->id_msgs);
 116                 os_free(data);
 117         }
 118 }
 119
 120
 121 static int eap_aka_umts_auth(struct eap_sm *sm, struct eap_aka_data *data)
 122 {
 123         struct eap_peer_config *conf;
 124
 125         wpa_printf(MSG_DEBUG, "EAP-AKA: UMTS authentication algorithm");
 126
 127         conf = eap_get_config(sm);
 128         if (conf == NULL)
 129                 return -1;
 130         if (conf->pcsc) {
 131                 return scard_umts_auth(sm->scard_ctx, data->rand,
 132                                        data->autn, data->res, &data->res_len,
 133                                        data->ik, data->ck, data->auts);
 134         }
 135
 136 #ifdef CONFIG_USIM_SIMULATOR
 137         if (conf->password) {
 138                 u8 opc[16], k[16], sqn[6];
 139                 const char *pos;
 140                 wpa_printf(MSG_DEBUG, "EAP-AKA: Use internal Milenage "
 141                            "implementation for UMTS authentication");
 142                 if (conf->password_len < 78) {
 143                         wpa_printf(MSG_DEBUG, "EAP-AKA: invalid Milenage "
 144                                    "password");
 145                         return -1;
 146                 }
 147                 pos = (const char *) conf->password;
 148                 if (hexstr2bin(pos, k, 16))
 149                         return -1;
 150                 pos += 32;
 151                 if (*pos != ':')
 152                         return -1;
 153                 pos++;
 154
 155                 if (hexstr2bin(pos, opc, 16))
 156                         return -1;
 157                 pos += 32;
 158                 if (*pos != ':')
 159                         return -1;
 160                 pos++;
 161
 162                 if (hexstr2bin(pos, sqn, 6))
 163                         return -1;
 164
 165                 return milenage_check(opc, k, sqn, data->rand, data->autn,
 166                                       data->ik, data->ck,
 167                                       data->res, &data->res_len, data->auts);
 168         }
 169 #endif /* CONFIG_USIM_SIMULATOR */
 170
 171 #ifdef CONFIG_USIM_HARDCODED
 172         wpa_printf(MSG_DEBUG, "EAP-AKA: Use hardcoded Kc and SRES values for "
 173                    "testing");
 174
 175         /* These hardcoded Kc and SRES values are used for testing.
 176          * Could consider making them configurable. */
 177         os_memset(data->res, '2', EAP_AKA_RES_MAX_LEN);
 178         data->res_len = EAP_AKA_RES_MAX_LEN;
 179         os_memset(data->ik, '3', EAP_AKA_IK_LEN);
 180         os_memset(data->ck, '4', EAP_AKA_CK_LEN);
 181         {
 182                 u8 autn[EAP_AKA_AUTN_LEN];
 183                 os_memset(autn, '1', EAP_AKA_AUTN_LEN);
 184                 if (os_memcmp(autn, data->autn, EAP_AKA_AUTN_LEN) != 0) {
 185                         wpa_printf(MSG_WARNING, "EAP-AKA: AUTN did not match "
 186                                    "with expected value");
 187                         return -1;
 188                 }
 189         }
 190 #if 0
 191         {
 192                 static int test_resync = 1;
 193                 if (test_resync) {
 194                         /* Test Resynchronization */
 195                         test_resync = 0;
 196                         return -2;
 197                 }
 198         }
 199 #endif
 200         return 0;
 201
 202 #else /* CONFIG_USIM_HARDCODED */
 203
 204         wpa_printf(MSG_DEBUG, "EAP-AKA: No UMTS authentication algorith "
 205                    "enabled");
 206         return -1;
 207
 208 #endif /* CONFIG_USIM_HARDCODED */
 209 }
 210
 211
 212 #define CLEAR_PSEUDONYM 0x01
 213 #define CLEAR_REAUTH_ID 0x02
 214 #define CLEAR_EAP_ID    0x04
 215
 216 static void eap_aka_clear_identities(struct eap_aka_data *data, int id)
 217 {
 218         wpa_printf(MSG_DEBUG, "EAP-AKA: forgetting old%s%s%s",
 219                    id & CLEAR_PSEUDONYM ? " pseudonym" : "",
 220                    id & CLEAR_REAUTH_ID ? " reauth_id" : "",
 221                    id & CLEAR_EAP_ID ? " eap_id" : "");
 222         if (id & CLEAR_PSEUDONYM) {
 223                 os_free(data->pseudonym);
 224                 data->pseudonym = NULL;
 225                 data->pseudonym_len = 0;
 226         }
 227         if (id & CLEAR_REAUTH_ID) {
 228                 os_free(data->reauth_id);
 229                 data->reauth_id = NULL;
 230                 data->reauth_id_len = 0;
 231         }
 232         if (id & CLEAR_EAP_ID) {
 233                 os_free(data->last_eap_identity);
 234                 data->last_eap_identity = NULL;
 235                 data->last_eap_identity_len = 0;
 236         }
 237 }
 238
 239
 240 static int eap_aka_learn_ids(struct eap_aka_data *data,
 241                              struct eap_sim_attrs *attr)
 242 {
 243         if (attr->next_pseudonym) {
 244                 os_free(data->pseudonym);
 245                 data->pseudonym = os_malloc(attr->next_pseudonym_len);
 246                 if (data->pseudonym == NULL) {
 247                         wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
 248                                    "next pseudonym");
 249                         return -1;
 250                 }
 251                 os_memcpy(data->pseudonym, attr->next_pseudonym,
 252                           attr->next_pseudonym_len);
 253                 data->pseudonym_len = attr->next_pseudonym_len;
 254                 wpa_hexdump_ascii(MSG_DEBUG,
 255                                   "EAP-AKA: (encr) AT_NEXT_PSEUDONYM",
 256                                   data->pseudonym,
 257                                   data->pseudonym_len);
 258         }
 259
 260         if (attr->next_reauth_id) {
 261                 os_free(data->reauth_id);
 262                 data->reauth_id = os_malloc(attr->next_reauth_id_len);
 263                 if (data->reauth_id == NULL) {
 264                         wpa_printf(MSG_INFO, "EAP-AKA: (encr) No memory for "
 265                                    "next reauth_id");
 266                         return -1;
 267                 }
 268                 os_memcpy(data->reauth_id, attr->next_reauth_id,
 269                           attr->next_reauth_id_len);
 270                 data->reauth_id_len = attr->next_reauth_id_len;
 271                 wpa_hexdump_ascii(MSG_DEBUG,
 272                                   "EAP-AKA: (encr) AT_NEXT_REAUTH_ID",
 273                                   data->reauth_id,
 274                                   data->reauth_id_len);
 275         }
 276
 277         return 0;
 278 }
 279
 280
 281 static int eap_aka_add_id_msg(struct eap_aka_data *data,
 282                               const struct wpabuf *msg)
 283 {
 284         if (msg == NULL)
 285                 return -1;
 286
 287         if (data->id_msgs == NULL) {
 288                 data->id_msgs = wpabuf_dup(msg);
 289                 return data->id_msgs == NULL ? -1 : 0;
 290         }
 291
 292         if (wpabuf_resize(&data->id_msgs, wpabuf_len(msg)) < 0)
 293                 return -1;
 294         wpabuf_put_buf(data->id_msgs, msg);
 295
 296         return 0;
 297 }
 298
 299
 300 static void eap_aka_add_checkcode(struct eap_aka_data *data,
 301                                   struct eap_sim_msg *msg)
 302 {
 303         const u8 *addr;
 304         size_t len;
 305         u8 hash[SHA1_MAC_LEN];
 306
 307         wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
 308
 309         if (data->id_msgs == NULL) {
 310                 /*
 311                  * No EAP-AKA/Identity packets were exchanged - send empty
 312                  * checkcode.
 313                  */
 314                 eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
 315                 return;
 316         }
 317
 318         /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
 319         addr = wpabuf_head(data->id_msgs);
 320         len = wpabuf_len(data->id_msgs);
 321         wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
 322         sha1_vector(1, &addr, &len, hash);
 323
 324         eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
 325                         EAP_AKA_CHECKCODE_LEN);
 326 }
 327
 328
 329 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
 330                                     const u8 *checkcode, size_t checkcode_len)
 331 {
 332         const u8 *addr;
 333         size_t len;
 334         u8 hash[SHA1_MAC_LEN];
 335
 336         if (checkcode == NULL)
 337                 return -1;
 338
 339         if (data->id_msgs == NULL) {
 340                 if (checkcode_len != 0) {
 341                         wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
 342                                    "indicates that AKA/Identity messages were "
 343                                    "used, but they were not");
 344                         return -1;
 345                 }
 346                 return 0;
 347         }
 348
 349         if (checkcode_len != EAP_AKA_CHECKCODE_LEN) {
 350                 wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from server "
 351                            "indicates that AKA/Identity message were not "
 352                            "used, but they were");
 353                 return -1;
 354         }
 355
 356         /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
 357         addr = wpabuf_head(data->id_msgs);
 358         len = wpabuf_len(data->id_msgs);
 359         sha1_vector(1, &addr, &len, hash);
 360
 361         if (os_memcmp(hash, checkcode, EAP_AKA_CHECKCODE_LEN) != 0) {
 362                 wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
 363                 return -1;
 364         }
 365
 366         return 0;
 367 }
 368
 369
 370 static struct wpabuf * eap_aka_client_error(struct eap_aka_data *data, u8 id,
 371                                             int err)
 372 {
 373         struct eap_sim_msg *msg;
 374
 375         eap_aka_state(data, FAILURE);
 376         data->num_id_req = 0;
 377         data->num_notification = 0;
 378
 379         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 380                                EAP_AKA_SUBTYPE_CLIENT_ERROR);
 381         eap_sim_msg_add(msg, EAP_SIM_AT_CLIENT_ERROR_CODE, err, NULL, 0);
 382         return eap_sim_msg_finish(msg, NULL, NULL, 0);
 383 }
 384
 385
 386 static struct wpabuf * eap_aka_authentication_reject(struct eap_aka_data *data,
 387                                                      u8 id)
 388 {
 389         struct eap_sim_msg *msg;
 390
 391         eap_aka_state(data, FAILURE);
 392         data->num_id_req = 0;
 393         data->num_notification = 0;
 394
 395         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Authentication-Reject "
 396                    "(id=%d)", id);
 397         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 398                                EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT);
 399         return eap_sim_msg_finish(msg, NULL, NULL, 0);
 400 }
 401
 402
 403 static struct wpabuf * eap_aka_synchronization_failure(
 404         struct eap_aka_data *data, u8 id)
 405 {
 406         struct eap_sim_msg *msg;
 407
 408         data->num_id_req = 0;
 409         data->num_notification = 0;
 410
 411         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Synchronization-Failure "
 412                    "(id=%d)", id);
 413         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 414                                EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE);
 415         wpa_printf(MSG_DEBUG, "   AT_AUTS");
 416         eap_sim_msg_add_full(msg, EAP_SIM_AT_AUTS, data->auts,
 417                              EAP_AKA_AUTS_LEN);
 418         return eap_sim_msg_finish(msg, NULL, NULL, 0);
 419 }
 420
 421
 422 static struct wpabuf * eap_aka_response_identity(struct eap_sm *sm,
 423                                                  struct eap_aka_data *data,
 424                                                  u8 id,
 425                                                  enum eap_sim_id_req id_req)
 426 {
 427         const u8 *identity = NULL;
 428         size_t identity_len = 0;
 429         struct eap_sim_msg *msg;
 430
 431         data->reauth = 0;
 432         if (id_req == ANY_ID && data->reauth_id) {
 433                 identity = data->reauth_id;
 434                 identity_len = data->reauth_id_len;
 435                 data->reauth = 1;
 436         } else if ((id_req == ANY_ID || id_req == FULLAUTH_ID) &&
 437                    data->pseudonym) {
 438                 identity = data->pseudonym;
 439                 identity_len = data->pseudonym_len;
 440                 eap_aka_clear_identities(data, CLEAR_REAUTH_ID);
 441         } else if (id_req != NO_ID_REQ) {
 442                 identity = eap_get_config_identity(sm, &identity_len);
 443                 if (identity) {
 444                         eap_aka_clear_identities(data, CLEAR_PSEUDONYM |
 445                                                  CLEAR_REAUTH_ID);
 446                 }
 447         }
 448         if (id_req != NO_ID_REQ)
 449                 eap_aka_clear_identities(data, CLEAR_EAP_ID);
 450
 451         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Identity (id=%d)", id);
 452         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 453                                EAP_AKA_SUBTYPE_IDENTITY);
 454
 455         if (identity) {
 456                 wpa_hexdump_ascii(MSG_DEBUG, "   AT_IDENTITY",
 457                                   identity, identity_len);
 458                 eap_sim_msg_add(msg, EAP_SIM_AT_IDENTITY, identity_len,
 459                                 identity, identity_len);
 460         }
 461
 462         return eap_sim_msg_finish(msg, NULL, NULL, 0);
 463 }
 464
 465
 466 static struct wpabuf * eap_aka_response_challenge(struct eap_aka_data *data,
 467                                                   u8 id)
 468 {
 469         struct eap_sim_msg *msg;
 470
 471         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Challenge (id=%d)", id);
 472         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 473                                EAP_AKA_SUBTYPE_CHALLENGE);
 474         wpa_printf(MSG_DEBUG, "   AT_RES");
 475         eap_sim_msg_add(msg, EAP_SIM_AT_RES, data->res_len * 8,
 476                         data->res, data->res_len);
 477         eap_aka_add_checkcode(data, msg);
 478         if (data->use_result_ind) {
 479                 wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 480                 eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 481         }
 482         wpa_printf(MSG_DEBUG, "   AT_MAC");
 483         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 484         return eap_sim_msg_finish(msg, data->k_aut, (u8 *) "", 0);
 485 }
 486
 487
 488 static struct wpabuf * eap_aka_response_reauth(struct eap_aka_data *data,
 489                                                u8 id, int counter_too_small,
 490                                                const u8 *nonce_s)
 491 {
 492         struct eap_sim_msg *msg;
 493         unsigned int counter;
 494
 495         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Reauthentication (id=%d)",
 496                    id);
 497         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 498                                EAP_AKA_SUBTYPE_REAUTHENTICATION);
 499         wpa_printf(MSG_DEBUG, "   AT_IV");
 500         wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 501         eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
 502
 503         if (counter_too_small) {
 504                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER_TOO_SMALL");
 505                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER_TOO_SMALL, 0, NULL, 0);
 506                 counter = data->counter_too_small;
 507         } else
 508                 counter = data->counter;
 509
 510         wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", counter);
 511         eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
 512
 513         if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
 514                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 515                            "AT_ENCR_DATA");
 516                 eap_sim_msg_free(msg);
 517                 return NULL;
 518         }
 519         eap_aka_add_checkcode(data, msg);
 520         if (data->use_result_ind) {
 521                 wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 522                 eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 523         }
 524         wpa_printf(MSG_DEBUG, "   AT_MAC");
 525         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 526         return eap_sim_msg_finish(msg, data->k_aut, nonce_s,
 527                                   EAP_SIM_NONCE_S_LEN);
 528 }
 529
 530
 531 static struct wpabuf * eap_aka_response_notification(struct eap_aka_data *data,
 532                                                      u8 id, u16 notification)
 533 {
 534         struct eap_sim_msg *msg;
 535         u8 *k_aut = (notification & 0x4000) == 0 ? data->k_aut : NULL;
 536
 537         wpa_printf(MSG_DEBUG, "Generating EAP-AKA Notification (id=%d)", id);
 538         msg = eap_sim_msg_init(EAP_CODE_RESPONSE, id, EAP_TYPE_AKA,
 539                                EAP_AKA_SUBTYPE_NOTIFICATION);
 540         if (k_aut && data->reauth) {
 541                 wpa_printf(MSG_DEBUG, "   AT_IV");
 542                 wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 543                 eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
 544                                            EAP_SIM_AT_ENCR_DATA);
 545                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER %d", data->counter);
 546                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
 547                                 NULL, 0);
 548                 if (eap_sim_msg_add_encr_end(msg, data->k_encr,
 549                                              EAP_SIM_AT_PADDING)) {
 550                         wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 551                                    "AT_ENCR_DATA");
 552                         eap_sim_msg_free(msg);
 553                         return NULL;
 554                 }
 555         }
 556         if (k_aut) {
 557                 wpa_printf(MSG_DEBUG, "   AT_MAC");
 558                 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 559         }
 560         return eap_sim_msg_finish(msg, k_aut, (u8 *) "", 0);
 561 }
 562
 563
 564 static struct wpabuf * eap_aka_process_identity(struct eap_sm *sm,
 565                                                 struct eap_aka_data *data,
 566                                                 u8 id,
 567                                                 const struct wpabuf *reqData,
 568                                                 struct eap_sim_attrs *attr)
 569 {
 570         int id_error;
 571         struct wpabuf *buf;
 572
 573         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Identity");
 574
 575         id_error = 0;
 576         switch (attr->id_req) {
 577         case NO_ID_REQ:
 578                 break;
 579         case ANY_ID:
 580                 if (data->num_id_req > 0)
 581                         id_error++;
 582                 data->num_id_req++;
 583                 break;
 584         case FULLAUTH_ID:
 585                 if (data->num_id_req > 1)
 586                         id_error++;
 587                 data->num_id_req++;
 588                 break;
 589         case PERMANENT_ID:
 590                 if (data->num_id_req > 2)
 591                         id_error++;
 592                 data->num_id_req++;
 593                 break;
 594         }
 595         if (id_error) {
 596                 wpa_printf(MSG_INFO, "EAP-AKA: Too many ID requests "
 597                            "used within one authentication");
 598                 return eap_aka_client_error(data, id,
 599                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 600         }
 601
 602         buf = eap_aka_response_identity(sm, data, id, attr->id_req);
 603
 604         if (data->prev_id != id) {
 605                 eap_aka_add_id_msg(data, reqData);
 606                 eap_aka_add_id_msg(data, buf);
 607                 data->prev_id = id;
 608         }
 609
 610         return buf;
 611 }
 612
 613
 614 static struct wpabuf * eap_aka_process_challenge(struct eap_sm *sm,
 615                                                  struct eap_aka_data *data,
 616                                                  u8 id,
 617                                                  const struct wpabuf *reqData,
 618                                                  struct eap_sim_attrs *attr)
 619 {
 620         const u8 *identity;
 621         size_t identity_len;
 622         int res;
 623         struct eap_sim_attrs eattr;
 624
 625         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Challenge");
 626
 627         if (attr->checkcode &&
 628             eap_aka_verify_checkcode(data, attr->checkcode,
 629                                      attr->checkcode_len)) {
 630                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
 631                            "message");
 632                 return eap_aka_client_error(data, id,
 633                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 634         }
 635
 636         data->reauth = 0;
 637         if (!attr->mac || !attr->rand || !attr->autn) {
 638                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
 639                            "did not include%s%s%s",
 640                            !attr->mac ? " AT_MAC" : "",
 641                            !attr->rand ? " AT_RAND" : "",
 642                            !attr->autn ? " AT_AUTN" : "");
 643                 return eap_aka_client_error(data, id,
 644                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 645         }
 646         os_memcpy(data->rand, attr->rand, EAP_AKA_RAND_LEN);
 647         os_memcpy(data->autn, attr->autn, EAP_AKA_AUTN_LEN);
 648
 649         res = eap_aka_umts_auth(sm, data);
 650         if (res == -1) {
 651                 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
 652                            "failed (AUTN)");
 653                 return eap_aka_authentication_reject(data, id);
 654         } else if (res == -2) {
 655                 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication "
 656                            "failed (AUTN seq# -> AUTS)");
 657                 return eap_aka_synchronization_failure(data, id);
 658         } else if (res) {
 659                 wpa_printf(MSG_WARNING, "EAP-AKA: UMTS authentication failed");
 660                 return eap_aka_client_error(data, id,
 661                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 662         }
 663         if (data->last_eap_identity) {
 664                 identity = data->last_eap_identity;
 665                 identity_len = data->last_eap_identity_len;
 666         } else if (data->pseudonym) {
 667                 identity = data->pseudonym;
 668                 identity_len = data->pseudonym_len;
 669         } else
 670                 identity = eap_get_config_identity(sm, &identity_len);
 671         wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Selected identity for MK "
 672                           "derivation", identity, identity_len);
 673         eap_aka_derive_mk(identity, identity_len, data->ik, data->ck,
 674                           data->mk);
 675         eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
 676                             data->emsk);
 677         if (eap_sim_verify_mac(data->k_aut, reqData, attr->mac, (u8 *) "", 0))
 678         {
 679                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
 680                            "used invalid AT_MAC");
 681                 return eap_aka_client_error(data, id,
 682                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 683         }
 684
 685         /* Old reauthentication and pseudonym identities must not be used
 686          * anymore. In other words, if no new identities are received, full
 687          * authentication will be used on next reauthentication. */
 688         eap_aka_clear_identities(data, CLEAR_PSEUDONYM | CLEAR_REAUTH_ID |
 689                                  CLEAR_EAP_ID);
 690
 691         if (attr->encr_data) {
 692                 u8 *decrypted;
 693                 decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 694                                                attr->encr_data_len, attr->iv,
 695                                                &eattr, 0);
 696                 if (decrypted == NULL) {
 697                         return eap_aka_client_error(
 698                                 data, id, EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 699                 }
 700                 eap_aka_learn_ids(data, &eattr);
 701                 os_free(decrypted);
 702         }
 703
 704         if (data->result_ind && attr->result_ind)
 705                 data->use_result_ind = 1;
 706
 707         if (data->state != FAILURE && data->state != RESULT_FAILURE) {
 708                 eap_aka_state(data, data->use_result_ind ?
 709                               RESULT_SUCCESS : SUCCESS);
 710         }
 711
 712         data->num_id_req = 0;
 713         data->num_notification = 0;
 714         /* RFC 4187 specifies that counter is initialized to one after
 715          * fullauth, but initializing it to zero makes it easier to implement
 716          * reauth verification. */
 717         data->counter = 0;
 718         return eap_aka_response_challenge(data, id);
 719 }
 720
 721
 722 static int eap_aka_process_notification_reauth(struct eap_aka_data *data,
 723                                                struct eap_sim_attrs *attr)
 724 {
 725         struct eap_sim_attrs eattr;
 726         u8 *decrypted;
 727
 728         if (attr->encr_data == NULL || attr->iv == NULL) {
 729                 wpa_printf(MSG_WARNING, "EAP-AKA: Notification message after "
 730                            "reauth did not include encrypted data");
 731                 return -1;
 732         }
 733
 734         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 735                                        attr->encr_data_len, attr->iv, &eattr,
 736                                        0);
 737         if (decrypted == NULL) {
 738                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
 739                            "data from notification message");
 740                 return -1;
 741         }
 742
 743         if (eattr.counter < 0 || (size_t) eattr.counter != data->counter) {
 744                 wpa_printf(MSG_WARNING, "EAP-AKA: Counter in notification "
 745                            "message does not match with counter in reauth "
 746                            "message");
 747                 os_free(decrypted);
 748                 return -1;
 749         }
 750
 751         os_free(decrypted);
 752         return 0;
 753 }
 754
 755
 756 static int eap_aka_process_notification_auth(struct eap_aka_data *data,
 757                                              const struct wpabuf *reqData,
 758                                              struct eap_sim_attrs *attr)
 759 {
 760         if (attr->mac == NULL) {
 761                 wpa_printf(MSG_INFO, "EAP-AKA: no AT_MAC in after_auth "
 762                            "Notification message");
 763                 return -1;
 764         }
 765
 766         if (eap_sim_verify_mac(data->k_aut, reqData, attr->mac, (u8 *) "", 0))
 767         {
 768                 wpa_printf(MSG_WARNING, "EAP-AKA: Notification message "
 769                            "used invalid AT_MAC");
 770                 return -1;
 771         }
 772
 773         if (data->reauth &&
 774             eap_aka_process_notification_reauth(data, attr)) {
 775                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid notification "
 776                            "message after reauth");
 777                 return -1;
 778         }
 779
 780         return 0;
 781 }
 782
 783
 784 static struct wpabuf * eap_aka_process_notification(
 785         struct eap_sm *sm, struct eap_aka_data *data, u8 id,
 786         const struct wpabuf *reqData, struct eap_sim_attrs *attr)
 787 {
 788         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Notification");
 789         if (data->num_notification > 0) {
 790                 wpa_printf(MSG_INFO, "EAP-AKA: too many notification "
 791                            "rounds (only one allowed)");
 792                 return eap_aka_client_error(data, id,
 793                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 794         }
 795         data->num_notification++;
 796         if (attr->notification == -1) {
 797                 wpa_printf(MSG_INFO, "EAP-AKA: no AT_NOTIFICATION in "
 798                            "Notification message");
 799                 return eap_aka_client_error(data, id,
 800                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 801         }
 802
 803         if ((attr->notification & 0x4000) == 0 &&
 804             eap_aka_process_notification_auth(data, reqData, attr)) {
 805                 return eap_aka_client_error(data, id,
 806                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 807         }
 808
 809         eap_sim_report_notification(sm->msg_ctx, attr->notification, 1);
 810         if (attr->notification >= 0 && attr->notification < 32768) {
 811                 eap_aka_state(data, FAILURE);
 812         } else if (attr->notification == EAP_SIM_SUCCESS &&
 813                    data->state == RESULT_SUCCESS)
 814                 eap_aka_state(data, SUCCESS);
 815         return eap_aka_response_notification(data, id, attr->notification);
 816 }
 817
 818
 819 static struct wpabuf * eap_aka_process_reauthentication(
 820         struct eap_sm *sm, struct eap_aka_data *data, u8 id,
 821         const struct wpabuf *reqData, struct eap_sim_attrs *attr)
 822 {
 823         struct eap_sim_attrs eattr;
 824         u8 *decrypted;
 825
 826         wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Reauthentication");
 827
 828         if (attr->checkcode &&
 829             eap_aka_verify_checkcode(data, attr->checkcode,
 830                                      attr->checkcode_len)) {
 831                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
 832                            "message");
 833                 return eap_aka_client_error(data, id,
 834                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 835         }
 836
 837         if (data->reauth_id == NULL) {
 838                 wpa_printf(MSG_WARNING, "EAP-AKA: Server is trying "
 839                            "reauthentication, but no reauth_id available");
 840                 return eap_aka_client_error(data, id,
 841                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 842         }
 843
 844         data->reauth = 1;
 845         if (eap_sim_verify_mac(data->k_aut, reqData, attr->mac, (u8 *) "", 0))
 846         {
 847                 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
 848                            "did not have valid AT_MAC");
 849                 return eap_aka_client_error(data, id,
 850                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 851         }
 852
 853         if (attr->encr_data == NULL || attr->iv == NULL) {
 854                 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
 855                            "message did not include encrypted data");
 856                 return eap_aka_client_error(data, id,
 857                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 858         }
 859
 860         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 861                                        attr->encr_data_len, attr->iv, &eattr,
 862                                        0);
 863         if (decrypted == NULL) {
 864                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
 865                            "data from reauthentication message");
 866                 return eap_aka_client_error(data, id,
 867                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 868         }
 869
 870         if (eattr.nonce_s == NULL || eattr.counter < 0) {
 871                 wpa_printf(MSG_INFO, "EAP-AKA: (encr) No%s%s in reauth packet",
 872                            !eattr.nonce_s ? " AT_NONCE_S" : "",
 873                            eattr.counter < 0 ? " AT_COUNTER" : "");
 874                 os_free(decrypted);
 875                 return eap_aka_client_error(data, id,
 876                                             EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 877         }
 878
 879         if (eattr.counter < 0 || (size_t) eattr.counter <= data->counter) {
 880                 struct wpabuf *res;
 881                 wpa_printf(MSG_INFO, "EAP-AKA: (encr) Invalid counter "
 882                            "(%d <= %d)", eattr.counter, data->counter);
 883                 data->counter_too_small = eattr.counter;
 884
 885                 eap_sim_derive_keys_reauth(eattr.counter, data->reauth_id,
 886                                            data->reauth_id_len, eattr.nonce_s,
 887                                            data->mk, NULL, NULL);
 888
 889                 /* Reply using Re-auth w/ AT_COUNTER_TOO_SMALL. The current
 890                  * reauth_id must not be used to start a new reauthentication.
 891                  * However, since it was used in the last EAP-Response-Identity
 892                  * packet, it has to saved for the following fullauth to be
 893                  * used in MK derivation. */
 894                 os_free(data->last_eap_identity);
 895                 data->last_eap_identity = data->reauth_id;
 896                 data->last_eap_identity_len = data->reauth_id_len;
 897                 data->reauth_id = NULL;
 898                 data->reauth_id_len = 0;
 899
 900                 res = eap_aka_response_reauth(data, id, 1, eattr.nonce_s);
 901                 os_free(decrypted);
 902
 903                 return res;
 904         }
 905         data->counter = eattr.counter;
 906
 907         os_memcpy(data->nonce_s, eattr.nonce_s, EAP_SIM_NONCE_S_LEN);
 908         wpa_hexdump(MSG_DEBUG, "EAP-AKA: (encr) AT_NONCE_S",
 909                     data->nonce_s, EAP_SIM_NONCE_S_LEN);
 910
 911         eap_sim_derive_keys_reauth(data->counter,
 912                                    data->reauth_id, data->reauth_id_len,
 913                                    data->nonce_s, data->mk, data->msk,
 914                                    data->emsk);
 915         eap_aka_clear_identities(data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
 916         eap_aka_learn_ids(data, &eattr);
 917
 918         if (data->result_ind && attr->result_ind)
 919                 data->use_result_ind = 1;
 920
 921         if (data->state != FAILURE && data->state != RESULT_FAILURE) {
 922                 eap_aka_state(data, data->use_result_ind ?
 923                               RESULT_SUCCESS : SUCCESS);
 924         }
 925
 926         data->num_id_req = 0;
 927         data->num_notification = 0;
 928         if (data->counter > EAP_AKA_MAX_FAST_REAUTHS) {
 929                 wpa_printf(MSG_DEBUG, "EAP-AKA: Maximum number of "
 930                            "fast reauths performed - force fullauth");
 931                 eap_aka_clear_identities(data, CLEAR_REAUTH_ID | CLEAR_EAP_ID);
 932         }
 933         os_free(decrypted);
 934         return eap_aka_response_reauth(data, id, 0, data->nonce_s);
 935 }
 936
 937
 938 static struct wpabuf * eap_aka_process(struct eap_sm *sm, void *priv,
 939                                        struct eap_method_ret *ret,
 940                                        const struct wpabuf *reqData)
 941 {
 942         struct eap_aka_data *data = priv;
 943         const struct eap_hdr *req;
 944         u8 subtype, id;
 945         struct wpabuf *res;
 946         const u8 *pos;
 947         struct eap_sim_attrs attr;
 948         size_t len;
 949
 950         wpa_hexdump_buf(MSG_DEBUG, "EAP-AKA: EAP data", reqData);
 951         if (eap_get_config_identity(sm, &len) == NULL) {
 952                 wpa_printf(MSG_INFO, "EAP-AKA: Identity not configured");
 953                 eap_sm_request_identity(sm);
 954                 ret->ignore = TRUE;
 955                 return NULL;
 956         }
 957
 958         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_AKA, reqData, &len);
 959         if (pos == NULL || len < 1) {
 960                 ret->ignore = TRUE;
 961                 return NULL;
 962         }
 963         req = wpabuf_head(reqData);
 964         id = req->identifier;
 965         len = be_to_host16(req->length);
 966
 967         ret->ignore = FALSE;
 968         ret->methodState = METHOD_MAY_CONT;
 969         ret->decision = DECISION_FAIL;
 970         ret->allowNotifications = TRUE;
 971
 972         subtype = *pos++;
 973         wpa_printf(MSG_DEBUG, "EAP-AKA: Subtype=%d", subtype);
 974         pos += 2; /* Reserved */
 975
 976         if (eap_sim_parse_attr(pos, wpabuf_head_u8(reqData) + len, &attr, 1,
 977                                0)) {
 978                 res = eap_aka_client_error(data, id,
 979                                            EAP_AKA_UNABLE_TO_PROCESS_PACKET);
 980                 goto done;
 981         }
 982
 983         switch (subtype) {
 984         case EAP_AKA_SUBTYPE_IDENTITY:
 985                 res = eap_aka_process_identity(sm, data, id, reqData, &attr);
 986                 break;
 987         case EAP_AKA_SUBTYPE_CHALLENGE:
 988                 res = eap_aka_process_challenge(sm, data, id, reqData, &attr);
 989                 break;
 990         case EAP_AKA_SUBTYPE_NOTIFICATION:
 991                 res = eap_aka_process_notification(sm, data, id, reqData,
 992                                                    &attr);
 993                 break;
 994         case EAP_AKA_SUBTYPE_REAUTHENTICATION:
 995                 res = eap_aka_process_reauthentication(sm, data, id, reqData,
 996                                                        &attr);
 997                 break;
 998         case EAP_AKA_SUBTYPE_CLIENT_ERROR:
 999                 wpa_printf(MSG_DEBUG, "EAP-AKA: subtype Client-Error");
1000                 res = eap_aka_client_error(data, id,
1001                                            EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1002                 break;
1003         default:
1004                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown subtype=%d", subtype);
1005                 res = eap_aka_client_error(data, id,
1006                                            EAP_AKA_UNABLE_TO_PROCESS_PACKET);
1007                 break;
1008         }
1009
1010 done:
1011         if (data->state == FAILURE) {
1012                 ret->decision = DECISION_FAIL;
1013                 ret->methodState = METHOD_DONE;
1014         } else if (data->state == SUCCESS) {
1015                 ret->decision = data->use_result_ind ?
1016                         DECISION_UNCOND_SUCC : DECISION_COND_SUCC;
1017                 /*
1018                  * It is possible for the server to reply with AKA
1019                  * Notification, so we must allow the method to continue and
1020                  * not only accept EAP-Success at this point.
1021                  */
1022                 ret->methodState = data->use_result_ind ?
1023                         METHOD_DONE : METHOD_MAY_CONT;
1024         } else if (data->state == RESULT_FAILURE)
1025                 ret->methodState = METHOD_CONT;
1026         else if (data->state == RESULT_SUCCESS)
1027                 ret->methodState = METHOD_CONT;
1028
1029         if (ret->methodState == METHOD_DONE) {
1030                 ret->allowNotifications = FALSE;
1031         }
1032
1033         return res;
1034 }
1035
1036
1037 static Boolean eap_aka_has_reauth_data(struct eap_sm *sm, void *priv)
1038 {
1039         struct eap_aka_data *data = priv;
1040         return data->pseudonym || data->reauth_id;
1041 }
1042
1043
1044 static void eap_aka_deinit_for_reauth(struct eap_sm *sm, void *priv)
1045 {
1046         struct eap_aka_data *data = priv;
1047         eap_aka_clear_identities(data, CLEAR_EAP_ID);
1048         data->prev_id = -1;
1049         wpabuf_free(data->id_msgs);
1050         data->id_msgs = NULL;
1051         data->use_result_ind = 0;
1052 }
1053
1054
1055 static void * eap_aka_init_for_reauth(struct eap_sm *sm, void *priv)
1056 {
1057         struct eap_aka_data *data = priv;
1058         data->num_id_req = 0;
1059         data->num_notification = 0;
1060         eap_aka_state(data, CONTINUE);
1061         return priv;
1062 }
1063
1064
1065 static const u8 * eap_aka_get_identity(struct eap_sm *sm, void *priv,
1066                                        size_t *len)
1067 {
1068         struct eap_aka_data *data = priv;
1069
1070         if (data->reauth_id) {
1071                 *len = data->reauth_id_len;
1072                 return data->reauth_id;
1073         }
1074
1075         if (data->pseudonym) {
1076                 *len = data->pseudonym_len;
1077                 return data->pseudonym;
1078         }
1079
1080         return NULL;
1081 }
1082
1083
1084 static Boolean eap_aka_isKeyAvailable(struct eap_sm *sm, void *priv)
1085 {
1086         struct eap_aka_data *data = priv;
1087         return data->state == SUCCESS;
1088 }
1089
1090
1091 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1092 {
1093         struct eap_aka_data *data = priv;
1094         u8 *key;
1095
1096         if (data->state != SUCCESS)
1097                 return NULL;
1098
1099         key = os_malloc(EAP_SIM_KEYING_DATA_LEN);
1100         if (key == NULL)
1101                 return NULL;
1102
1103         *len = EAP_SIM_KEYING_DATA_LEN;
1104         os_memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
1105
1106         return key;
1107 }
1108
1109
1110 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1111 {
1112         struct eap_aka_data *data = priv;
1113         u8 *key;
1114
1115         if (data->state != SUCCESS)
1116                 return NULL;
1117
1118         key = os_malloc(EAP_EMSK_LEN);
1119         if (key == NULL)
1120                 return NULL;
1121
1122         *len = EAP_EMSK_LEN;
1123         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
1124
1125         return key;
1126 }
1127
1128
1129 int eap_peer_aka_register(void)
1130 {
1131         struct eap_method *eap;
1132         int ret;
1133
1134         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1135                                     EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1136         if (eap == NULL)
1137                 return -1;
1138
1139         eap->init = eap_aka_init;
1140         eap->deinit = eap_aka_deinit;
1141         eap->process = eap_aka_process;
1142         eap->isKeyAvailable = eap_aka_isKeyAvailable;
1143         eap->getKey = eap_aka_getKey;
1144         eap->has_reauth_data = eap_aka_has_reauth_data;
1145         eap->deinit_for_reauth = eap_aka_deinit_for_reauth;
1146         eap->init_for_reauth = eap_aka_init_for_reauth;
1147         eap->get_identity = eap_aka_get_identity;
1148         eap->get_emsk = eap_aka_get_emsk;
1149
1150         ret = eap_peer_method_register(eap);
1151         if (ret)
1152                 eap_peer_method_free(eap);
1153         return ret;
1154 }