2 * eapsimlib.c based upon draft-haverinen-pppext-eap-sim-11.txt.
4 * The development of the EAP/SIM support was funded by Internet Foundation
5 * Austria (http://www.nic.at/ipa).
7 * code common to EAP-SIM clients and to servers.
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 2 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
25 * Copyright 2000-2003,2006 The FreeRADIUS server project
26 * Copyright 2003 Michael Richardson <mcr@sandelman.ottawa.on.ca>
30 * EAP-SIM PACKET FORMAT
31 * ------- ------ ------
33 * EAP Request and Response Packet Format
34 * --- ------- --- -------- ------ ------
36 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
37 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
38 * | Code | Identifier | Length |
39 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
40 * | Type | SIM-Type | SIM-Length | value ... |
41 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
43 * with SIM-Type/SIM-Length/Value... repeating. SIM-Length is in units
44 * of 32 bits, and includes the Sim-Type/Sim-Length fields.
46 * The SIM-Type's are mapped to ATTRIBUTE_EAP_SIM_BASE+Sim-type and
47 * unmapped by these functions.
51 #include <freeradius-devel/ident.h>
54 #include <freeradius-devel/libradius.h>
55 #include "eap_types.h"
57 #include <freeradius-devel/sha1.h>
60 * given a radius request with many attribues in the EAP-SIM range, build
61 * them all into a single EAP-SIM body.
64 int map_eapsim_basictypes(RADIUS_PACKET *r, EAP_PACKET *ep)
68 uint8_t *encodedmsg, *attr;
69 unsigned int id, eapcode;
70 unsigned char *macspace, *append;
72 unsigned char subtype;
79 * encodedmsg is now an EAP-SIM message.
80 * it might be too big for putting into an EAP-Type-SIM
83 vp = pairfind(r->vps, ATTRIBUTE_EAP_SIM_SUBTYPE, 0, TAG_ANY);
86 subtype = eapsim_start;
90 subtype = vp->vp_integer;
93 vp = pairfind(r->vps, ATTRIBUTE_EAP_ID, 0, TAG_ANY);
96 id = ((int)getpid() & 0xff);
103 vp = pairfind(r->vps, ATTRIBUTE_EAP_CODE, 0, TAG_ANY);
106 eapcode = PW_EAP_REQUEST;
110 eapcode = vp->vp_integer;
115 * take a walk through the attribute list to see how much space
116 * that we need to encode all of this.
119 for(vp = r->vps; vp != NULL; vp = vp->next)
124 if(vp->attribute < ATTRIBUTE_EAP_SIM_BASE ||
125 vp->attribute >= ATTRIBUTE_EAP_SIM_BASE+256)
133 * the AT_MAC attribute is a bit different, when we get to this
134 * attribute, we pull the contents out, save it for later
135 * processing, set the size to 16 bytes (plus 2 bytes padding).
137 * At this point, we only care about the size.
139 if(vp->attribute == ATTRIBUTE_EAP_SIM_BASE+PW_EAP_SIM_MAC) {
143 /* round up to next multiple of 4, after taking in
144 * account the type and length bytes
146 roundedlen = (vplen + 2 + 3) & ~3;
147 encoded_size += roundedlen;
150 if (ep->code != PW_EAP_SUCCESS)
152 ep->id = (id & 0xff);
153 ep->type.type = PW_EAP_SIM;
156 * if no attributes were found, do very little.
159 if(encoded_size == 0)
161 encodedmsg = malloc(3);
162 /* FIX: could be NULL */
164 encodedmsg[0]=subtype;
169 ep->type.data = encodedmsg;
176 * figured out the length, so malloc some space for the results.
178 * Note that we do not bother going through an "EAP" stage, which
179 * is a bit strange compared to the unmap, which expects to see
180 * an EAP-SIM virtual attributes.
182 * EAP is 1-code, 1-identifier, 2-length, 1-type = 5 overhead.
184 * SIM code adds a subtype, and 2 bytes of reserved = 3.
188 /* malloc space for it */
191 encodedmsg = malloc(encoded_size);
192 if (encodedmsg == NULL) {
193 radlog(L_ERR, "eapsim: out of memory allocating %d bytes", encoded_size+5);
196 memset(encodedmsg, 0, encoded_size);
199 * now walk the attributes again, sticking them in.
201 * we go three bytes into the encoded message, because there are two
202 * bytes of reserved, and we will fill the "subtype" in later.
207 for(vp = r->vps; vp != NULL; vp = vp->next)
211 if(vp->attribute < ATTRIBUTE_EAP_SIM_BASE ||
212 vp->attribute >= ATTRIBUTE_EAP_SIM_BASE+256)
218 * the AT_MAC attribute is a bit different, when we get to this
219 * attribute, we pull the contents out, save it for later
220 * processing, set the size to 16 bytes (plus 2 bytes padding).
222 * At this point, we put in zeros, and remember where the
225 if(vp->attribute == ATTRIBUTE_EAP_SIM_BASE+PW_EAP_SIM_MAC) {
227 memset(&attr[2], 0, 18);
229 append = vp->vp_octets;
230 appendlen = vp->length;
233 roundedlen = (vp->length + 2 + 3) & ~3;
234 memset(attr, 0, roundedlen);
235 memcpy(&attr[2], vp->vp_strvalue, vp->length);
237 attr[0] = vp->attribute - ATTRIBUTE_EAP_SIM_BASE;
238 attr[1] = roundedlen >> 2;
243 encodedmsg[0] = subtype;
245 ep->type.length = encoded_size;
246 ep->type.data = encodedmsg;
249 * if macspace was set and we have a key,
250 * then we should calculate the HMAC-SHA1 of the resulting EAP-SIM
251 * packet, appended with the value of append.
253 vp = pairfind(r->vps, ATTRIBUTE_EAP_SIM_KEY, 0, TAG_ANY);
254 if(macspace != NULL && vp != NULL)
256 unsigned char *buffer;
258 uint16_t hmaclen, total_length = 0;
259 unsigned char sha1digest[20];
261 total_length = EAP_HEADER_LEN + 1 + encoded_size;
262 hmaclen = total_length + appendlen;
263 buffer = (unsigned char *)malloc(hmaclen);
264 hdr = (eap_packet_t *)buffer;
266 radlog(L_ERR, "rlm_eap: out of memory");
271 hdr->code = eapcode & 0xFF;
272 hdr->id = (id & 0xFF);
273 total_length = htons(total_length);
274 memcpy(hdr->length, &total_length, sizeof(total_length));
276 hdr->data[0] = PW_EAP_SIM;
279 memcpy(&hdr->data[1], encodedmsg, encoded_size);
282 memcpy(&hdr->data[encoded_size+1], append, appendlen);
285 fr_hmac_sha1(buffer, hmaclen,
286 vp->vp_octets, vp->length,
289 /* done with the buffer, free it */
292 /* now copy the digest to where it belongs in the AT_MAC */
293 /* note that it is truncated to 128-bits */
294 memcpy(macspace, sha1digest, 16);
297 /* if we had an AT_MAC and no key, then fail */
298 if(macspace != NULL && vp == NULL)
300 if(encodedmsg != NULL)
309 * given a radius request with an EAP-SIM body, decode it into TLV pairs
311 * return value is TRUE if it succeeded, false if there was something
312 * wrong and the packet should be discarded.
315 int unmap_eapsim_basictypes(RADIUS_PACKET *r,
316 uint8_t *attr, unsigned int attrlen)
319 int eapsim_attribute;
320 unsigned int eapsim_len;
321 int es_attribute_count;
323 es_attribute_count=0;
325 /* big enough to have even a single attribute */
327 radlog(L_ERR, "eap: EAP-Sim attribute too short: %d < 2", attrlen);
331 newvp = paircreate(ATTRIBUTE_EAP_SIM_SUBTYPE, 0, PW_TYPE_INTEGER);
332 if (!newvp) return 0;
333 newvp->vp_integer = attr[0];
335 pairadd(&(r->vps), newvp);
340 /* now, loop processing each attribute that we find */
344 radlog(L_ERR, "eap: EAP-Sim attribute %d too short: %d < 2", es_attribute_count, attrlen);
348 eapsim_attribute = attr[0];
349 eapsim_len = attr[1] * 4;
351 if(eapsim_len > attrlen) {
352 radlog(L_ERR, "eap: EAP-Sim attribute %d (no.%d) has length longer than data (%d > %d)"
354 , es_attribute_count, eapsim_len, attrlen);
358 if(eapsim_len > MAX_STRING_LEN) {
359 eapsim_len = MAX_STRING_LEN;
361 if (eapsim_len < 2) {
362 radlog(L_ERR, "eap: EAP-Sim attribute %d (no.%d) has length too small",
363 eapsim_attribute, es_attribute_count);
367 newvp = paircreate(eapsim_attribute+ATTRIBUTE_EAP_SIM_BASE, 0, PW_TYPE_OCTETS);
368 memcpy(newvp->vp_strvalue, &attr[2], eapsim_len-2);
369 newvp->length = eapsim_len-2;
370 pairadd(&(r->vps), newvp);
373 /* advance pointers, decrement length */
375 attrlen -= eapsim_len;
376 es_attribute_count++;
382 * calculate the MAC for the EAP message, given the key.
383 * The "extra" will be appended to the EAP message and included in the
388 eapsim_checkmac(VALUE_PAIR *rvps,
389 uint8_t key[EAPSIM_AUTH_SIZE],
390 uint8_t *extra, int extralen,
399 mac = pairfind(rvps, ATTRIBUTE_EAP_SIM_BASE+PW_EAP_SIM_MAC, 0, TAG_ANY);
402 || mac->length != 18) {
403 /* can't check a packet with no AT_MAC attribute */
407 /* get original copy of EAP message, note that it was sanitized
408 * to have a valid length, which we depend upon.
410 e = eap_vp2packet(rvps);
417 /* make copy big enough for everything */
418 elen = e->length[0] * 256 + e->length[1];
419 len = elen + extralen;
421 buffer = malloc(len);
428 memcpy(buffer, e, elen);
429 memcpy(buffer+elen, extra, extralen);
432 * now look for the AT_MAC attribute in the copy of the buffer
433 * and make sure that the checksum is zero.
439 /* first attribute is 8 bytes into the EAP packet.
440 * 4 bytes for EAP, 1 for type, 1 for subtype, 2 reserved.
443 while(attr < (buffer+elen)) {
444 if(attr[0] == PW_EAP_SIM_MAC) {
445 /* zero the data portion, after making sure
446 * the size is >=5. Maybe future versions.
447 * will use more bytes, so be liberal.
453 memset(&attr[4], 0, (attr[1]-1)*4);
455 /* advance the pointer */
460 /* now, HMAC-SHA1 it with the key. */
461 fr_hmac_sha1(buffer, len,
465 if(memcmp(&mac->vp_strvalue[2], calcmac, 16) == 0) {
478 * definitions changed to take a buffer for unknowns
479 * as this is more thread safe.
481 const char *simstates[]={ "init", "start", NULL };
483 const char *sim_state2name(enum eapsim_clientstates state,
487 if(state >= eapsim_client_maxstates)
489 snprintf(statenamebuf, statenamebuflen,
490 "eapstate:%d", state);
495 return simstates[state];
499 const char *subtypes[]={ "subtype0", "subtype1", "subtype2", "subtype3",
500 "subtype4", "subtype5", "subtype6", "subtype7",
501 "subtype8", "subtype9",
509 const char *sim_subtype2name(enum eapsim_subtype subtype,
510 char *subtypenamebuf,
511 int subtypenamebuflen)
513 if(subtype >= eapsim_max_subtype)
515 snprintf(subtypenamebuf, subtypenamebuflen,
516 "illegal-subtype:%d", subtype);
517 return subtypenamebuf;
521 return subtypes[subtype];