1 /*
2 * EAP peer/server: EAP-SIM/AKA/AKA' shared routines
3 * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "common.h"
12 #include "wpabuf.h"
13 #include "crypto/aes_wrap.h"
14 #include "crypto/crypto.h"
15 #include "crypto/sha1.h"
16 #include "crypto/sha256.h"
17 #include "crypto/random.h"
18 #include "eap_common/eap_defs.h"
19 #include "eap_common/eap_sim_common.h"
20
21
eap_sim_prf(const u8 * key,u8 * x,size_t xlen)22 static int eap_sim_prf(const u8 *key, u8 *x, size_t xlen)
23 {
24 return fips186_2_prf(key, EAP_SIM_MK_LEN, x, xlen);
25 }
26
27
eap_sim_derive_mk(const u8 * identity,size_t identity_len,const u8 * nonce_mt,u16 selected_version,const u8 * ver_list,size_t ver_list_len,int num_chal,const u8 * kc,u8 * mk)28 void eap_sim_derive_mk(const u8 *identity, size_t identity_len,
29 const u8 *nonce_mt, u16 selected_version,
30 const u8 *ver_list, size_t ver_list_len,
31 int num_chal, const u8 *kc, u8 *mk)
32 {
33 u8 sel_ver[2];
34 const unsigned char *addr[5];
35 size_t len[5];
36
37 addr[0] = identity;
38 len[0] = identity_len;
39 addr[1] = kc;
40 len[1] = num_chal * EAP_SIM_KC_LEN;
41 addr[2] = nonce_mt;
42 len[2] = EAP_SIM_NONCE_MT_LEN;
43 addr[3] = ver_list;
44 len[3] = ver_list_len;
45 addr[4] = sel_ver;
46 len[4] = 2;
47
48 WPA_PUT_BE16(sel_ver, selected_version);
49
50 /* MK = SHA1(Identity|n*Kc|NONCE_MT|Version List|Selected Version) */
51 sha1_vector(5, addr, len, mk);
52 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: MK", mk, EAP_SIM_MK_LEN);
53 }
54
55
eap_aka_derive_mk(const u8 * identity,size_t identity_len,const u8 * ik,const u8 * ck,u8 * mk)56 void eap_aka_derive_mk(const u8 *identity, size_t identity_len,
57 const u8 *ik, const u8 *ck, u8 *mk)
58 {
59 const u8 *addr[3];
60 size_t len[3];
61
62 addr[0] = identity;
63 len[0] = identity_len;
64 addr[1] = ik;
65 len[1] = EAP_AKA_IK_LEN;
66 addr[2] = ck;
67 len[2] = EAP_AKA_CK_LEN;
68
69 /* MK = SHA1(Identity|IK|CK) */
70 sha1_vector(3, addr, len, mk);
71 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: IK", ik, EAP_AKA_IK_LEN);
72 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: CK", ck, EAP_AKA_CK_LEN);
73 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA: MK", mk, EAP_SIM_MK_LEN);
74 }
75
76
eap_sim_derive_keys(const u8 * mk,u8 * k_encr,u8 * k_aut,u8 * msk,u8 * emsk)77 int eap_sim_derive_keys(const u8 *mk, u8 *k_encr, u8 *k_aut, u8 *msk, u8 *emsk)
78 {
79 u8 buf[EAP_SIM_K_ENCR_LEN + EAP_SIM_K_AUT_LEN +
80 EAP_SIM_KEYING_DATA_LEN + EAP_EMSK_LEN], *pos;
81 if (eap_sim_prf(mk, buf, sizeof(buf)) < 0) {
82 wpa_printf(MSG_ERROR, "EAP-SIM: Failed to derive keys");
83 return -1;
84 }
85 pos = buf;
86 os_memcpy(k_encr, pos, EAP_SIM_K_ENCR_LEN);
87 pos += EAP_SIM_K_ENCR_LEN;
88 os_memcpy(k_aut, pos, EAP_SIM_K_AUT_LEN);
89 pos += EAP_SIM_K_AUT_LEN;
90 os_memcpy(msk, pos, EAP_SIM_KEYING_DATA_LEN);
91 pos += EAP_SIM_KEYING_DATA_LEN;
92 os_memcpy(emsk, pos, EAP_EMSK_LEN);
93
94 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: K_encr",
95 k_encr, EAP_SIM_K_ENCR_LEN);
96 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: K_aut",
97 k_aut, EAP_SIM_K_AUT_LEN);
98 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: keying material (MSK)",
99 msk, EAP_SIM_KEYING_DATA_LEN);
100 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: EMSK", emsk, EAP_EMSK_LEN);
101 os_memset(buf, 0, sizeof(buf));
102
103 return 0;
104 }
105
106
eap_sim_derive_keys_reauth(u16 _counter,const u8 * identity,size_t identity_len,const u8 * nonce_s,const u8 * mk,u8 * msk,u8 * emsk)107 int eap_sim_derive_keys_reauth(u16 _counter,
108 const u8 *identity, size_t identity_len,
109 const u8 *nonce_s, const u8 *mk, u8 *msk,
110 u8 *emsk)
111 {
112 u8 xkey[SHA1_MAC_LEN];
113 u8 buf[EAP_SIM_KEYING_DATA_LEN + EAP_EMSK_LEN + 32];
114 u8 counter[2];
115 const u8 *addr[4];
116 size_t len[4];
117
118 while (identity_len > 0 && identity[identity_len - 1] == 0) {
119 wpa_printf(MSG_DEBUG, "EAP-SIM: Workaround - drop null "
120 "character from the end of identity");
121 identity_len--;
122 }
123 addr[0] = identity;
124 len[0] = identity_len;
125 addr[1] = counter;
126 len[1] = 2;
127 addr[2] = nonce_s;
128 len[2] = EAP_SIM_NONCE_S_LEN;
129 addr[3] = mk;
130 len[3] = EAP_SIM_MK_LEN;
131
132 WPA_PUT_BE16(counter, _counter);
133
134 wpa_printf(MSG_DEBUG, "EAP-SIM: Deriving keying data from reauth");
135 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM: Identity",
136 identity, identity_len);
137 wpa_hexdump(MSG_DEBUG, "EAP-SIM: counter", counter, 2);
138 wpa_hexdump(MSG_DEBUG, "EAP-SIM: NONCE_S", nonce_s,
139 EAP_SIM_NONCE_S_LEN);
140 wpa_hexdump_key(MSG_DEBUG, "EAP-SIM: MK", mk, EAP_SIM_MK_LEN);
141
142 /* XKEY' = SHA1(Identity|counter|NONCE_S|MK) */
143 sha1_vector(4, addr, len, xkey);
144 wpa_hexdump(MSG_DEBUG, "EAP-SIM: XKEY'", xkey, SHA1_MAC_LEN);
145
146 if (eap_sim_prf(xkey, buf, sizeof(buf)) < 0) {
147 wpa_printf(MSG_ERROR, "EAP-SIM: Failed to derive keys");
148 return -1;
149 }
150 if (msk) {
151 os_memcpy(msk, buf, EAP_SIM_KEYING_DATA_LEN);
152 wpa_hexdump(MSG_DEBUG, "EAP-SIM: keying material (MSK)",
153 msk, EAP_SIM_KEYING_DATA_LEN);
154 }
155 if (emsk) {
156 os_memcpy(emsk, buf + EAP_SIM_KEYING_DATA_LEN, EAP_EMSK_LEN);
157 wpa_hexdump(MSG_DEBUG, "EAP-SIM: EMSK", emsk, EAP_EMSK_LEN);
158 }
159 os_memset(buf, 0, sizeof(buf));
160
161 return 0;
162 }
163
164
eap_sim_verify_mac(const u8 * k_aut,const struct wpabuf * req,const u8 * mac,const u8 * extra,size_t extra_len)165 int eap_sim_verify_mac(const u8 *k_aut, const struct wpabuf *req,
166 const u8 *mac, const u8 *extra, size_t extra_len)
167 {
168 unsigned char hmac[SHA1_MAC_LEN];
169 const u8 *addr[2];
170 size_t len[2];
171 u8 *tmp;
172
173 if (mac == NULL || wpabuf_len(req) < EAP_SIM_MAC_LEN ||
174 mac < wpabuf_head_u8(req) ||
175 mac > wpabuf_head_u8(req) + wpabuf_len(req) - EAP_SIM_MAC_LEN)
176 return -1;
177
178 tmp = os_memdup(wpabuf_head(req), wpabuf_len(req));
179 if (tmp == NULL)
180 return -1;
181
182 addr[0] = tmp;
183 len[0] = wpabuf_len(req);
184 addr[1] = extra;
185 len[1] = extra_len;
186
187 /* HMAC-SHA1-128 */
188 os_memset(tmp + (mac - wpabuf_head_u8(req)), 0, EAP_SIM_MAC_LEN);
189 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC - msg",
190 tmp, wpabuf_len(req));
191 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC - extra data",
192 extra, extra_len);
193 wpa_hexdump_key(MSG_MSGDUMP, "EAP-SIM: Verify MAC - K_aut",
194 k_aut, EAP_SIM_K_AUT_LEN);
195 hmac_sha1_vector(k_aut, EAP_SIM_K_AUT_LEN, 2, addr, len, hmac);
196 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Verify MAC: MAC",
197 hmac, EAP_SIM_MAC_LEN);
198 os_free(tmp);
199
200 return (os_memcmp_const(hmac, mac, EAP_SIM_MAC_LEN) == 0) ? 0 : 1;
201 }
202
203
eap_sim_add_mac(const u8 * k_aut,const u8 * msg,size_t msg_len,u8 * mac,const u8 * extra,size_t extra_len)204 void eap_sim_add_mac(const u8 *k_aut, const u8 *msg, size_t msg_len, u8 *mac,
205 const u8 *extra, size_t extra_len)
206 {
207 unsigned char hmac[SHA1_MAC_LEN];
208 const u8 *addr[2];
209 size_t len[2];
210
211 addr[0] = msg;
212 len[0] = msg_len;
213 addr[1] = extra;
214 len[1] = extra_len;
215
216 /* HMAC-SHA1-128 */
217 os_memset(mac, 0, EAP_SIM_MAC_LEN);
218 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC - msg", msg, msg_len);
219 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC - extra data",
220 extra, extra_len);
221 wpa_hexdump_key(MSG_MSGDUMP, "EAP-SIM: Add MAC - K_aut",
222 k_aut, EAP_SIM_K_AUT_LEN);
223 hmac_sha1_vector(k_aut, EAP_SIM_K_AUT_LEN, 2, addr, len, hmac);
224 os_memcpy(mac, hmac, EAP_SIM_MAC_LEN);
225 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Add MAC: MAC",
226 mac, EAP_SIM_MAC_LEN);
227 }
228
229
230 #if defined(EAP_AKA_PRIME) || defined(EAP_SERVER_AKA_PRIME)
prf_prime(const u8 * k,const char * seed1,const u8 * seed2,size_t seed2_len,const u8 * seed3,size_t seed3_len,u8 * res,size_t res_len)231 static void prf_prime(const u8 *k, const char *seed1,
232 const u8 *seed2, size_t seed2_len,
233 const u8 *seed3, size_t seed3_len,
234 u8 *res, size_t res_len)
235 {
236 const u8 *addr[5];
237 size_t len[5];
238 u8 hash[SHA256_MAC_LEN];
239 u8 iter;
240
241 /*
242 * PRF'(K,S) = T1 | T2 | T3 | T4 | ...
243 * T1 = HMAC-SHA-256 (K, S | 0x01)
244 * T2 = HMAC-SHA-256 (K, T1 | S | 0x02)
245 * T3 = HMAC-SHA-256 (K, T2 | S | 0x03)
246 * T4 = HMAC-SHA-256 (K, T3 | S | 0x04)
247 * ...
248 */
249
250 addr[0] = hash;
251 len[0] = 0;
252 addr[1] = (const u8 *) seed1;
253 len[1] = os_strlen(seed1);
254 addr[2] = seed2;
255 len[2] = seed2_len;
256 addr[3] = seed3;
257 len[3] = seed3_len;
258 addr[4] = &iter;
259 len[4] = 1;
260
261 iter = 0;
262 while (res_len) {
263 size_t hlen;
264 iter++;
265 hmac_sha256_vector(k, 32, 5, addr, len, hash);
266 len[0] = SHA256_MAC_LEN;
267 hlen = res_len > SHA256_MAC_LEN ? SHA256_MAC_LEN : res_len;
268 os_memcpy(res, hash, hlen);
269 res += hlen;
270 res_len -= hlen;
271 }
272 }
273
274
eap_aka_prime_derive_keys(const u8 * identity,size_t identity_len,const u8 * ik,const u8 * ck,u8 * k_encr,u8 * k_aut,u8 * k_re,u8 * msk,u8 * emsk)275 void eap_aka_prime_derive_keys(const u8 *identity, size_t identity_len,
276 const u8 *ik, const u8 *ck, u8 *k_encr,
277 u8 *k_aut, u8 *k_re, u8 *msk, u8 *emsk)
278 {
279 u8 key[EAP_AKA_IK_LEN + EAP_AKA_CK_LEN];
280 u8 keys[EAP_SIM_K_ENCR_LEN + EAP_AKA_PRIME_K_AUT_LEN +
281 EAP_AKA_PRIME_K_RE_LEN + EAP_MSK_LEN + EAP_EMSK_LEN];
282 u8 *pos;
283
284 /*
285 * MK = PRF'(IK'|CK',"EAP-AKA'"|Identity)
286 * K_encr = MK[0..127]
287 * K_aut = MK[128..383]
288 * K_re = MK[384..639]
289 * MSK = MK[640..1151]
290 * EMSK = MK[1152..1663]
291 */
292
293 os_memcpy(key, ik, EAP_AKA_IK_LEN);
294 os_memcpy(key + EAP_AKA_IK_LEN, ck, EAP_AKA_CK_LEN);
295
296 prf_prime(key, "EAP-AKA'", identity, identity_len, NULL, 0,
297 keys, sizeof(keys));
298
299 pos = keys;
300 os_memcpy(k_encr, pos, EAP_SIM_K_ENCR_LEN);
301 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': K_encr",
302 k_encr, EAP_SIM_K_ENCR_LEN);
303 pos += EAP_SIM_K_ENCR_LEN;
304
305 os_memcpy(k_aut, pos, EAP_AKA_PRIME_K_AUT_LEN);
306 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': K_aut",
307 k_aut, EAP_AKA_PRIME_K_AUT_LEN);
308 pos += EAP_AKA_PRIME_K_AUT_LEN;
309
310 os_memcpy(k_re, pos, EAP_AKA_PRIME_K_RE_LEN);
311 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': K_re",
312 k_re, EAP_AKA_PRIME_K_RE_LEN);
313 pos += EAP_AKA_PRIME_K_RE_LEN;
314
315 os_memcpy(msk, pos, EAP_MSK_LEN);
316 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': MSK", msk, EAP_MSK_LEN);
317 pos += EAP_MSK_LEN;
318
319 os_memcpy(emsk, pos, EAP_EMSK_LEN);
320 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': EMSK", emsk, EAP_EMSK_LEN);
321 }
322
323
eap_aka_prime_derive_keys_reauth(const u8 * k_re,u16 counter,const u8 * identity,size_t identity_len,const u8 * nonce_s,u8 * msk,u8 * emsk)324 int eap_aka_prime_derive_keys_reauth(const u8 *k_re, u16 counter,
325 const u8 *identity, size_t identity_len,
326 const u8 *nonce_s, u8 *msk, u8 *emsk)
327 {
328 u8 seed3[2 + EAP_SIM_NONCE_S_LEN];
329 u8 keys[EAP_MSK_LEN + EAP_EMSK_LEN];
330 u8 *pos;
331
332 /*
333 * MK = PRF'(K_re,"EAP-AKA' re-auth"|Identity|counter|NONCE_S)
334 * MSK = MK[0..511]
335 * EMSK = MK[512..1023]
336 */
337
338 WPA_PUT_BE16(seed3, counter);
339 os_memcpy(seed3 + 2, nonce_s, EAP_SIM_NONCE_S_LEN);
340
341 prf_prime(k_re, "EAP-AKA' re-auth", identity, identity_len,
342 seed3, sizeof(seed3),
343 keys, sizeof(keys));
344
345 pos = keys;
346 os_memcpy(msk, pos, EAP_MSK_LEN);
347 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': MSK", msk, EAP_MSK_LEN);
348 pos += EAP_MSK_LEN;
349
350 os_memcpy(emsk, pos, EAP_EMSK_LEN);
351 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': EMSK", emsk, EAP_EMSK_LEN);
352
353 os_memset(keys, 0, sizeof(keys));
354
355 return 0;
356 }
357
358
eap_sim_verify_mac_sha256(const u8 * k_aut,const struct wpabuf * req,const u8 * mac,const u8 * extra,size_t extra_len)359 int eap_sim_verify_mac_sha256(const u8 *k_aut, const struct wpabuf *req,
360 const u8 *mac, const u8 *extra, size_t extra_len)
361 {
362 unsigned char hmac[SHA256_MAC_LEN];
363 const u8 *addr[2];
364 size_t len[2];
365 u8 *tmp;
366
367 if (mac == NULL || wpabuf_len(req) < EAP_SIM_MAC_LEN ||
368 mac < wpabuf_head_u8(req) ||
369 mac > wpabuf_head_u8(req) + wpabuf_len(req) - EAP_SIM_MAC_LEN)
370 return -1;
371
372 tmp = os_memdup(wpabuf_head(req), wpabuf_len(req));
373 if (tmp == NULL)
374 return -1;
375
376 addr[0] = tmp;
377 len[0] = wpabuf_len(req);
378 addr[1] = extra;
379 len[1] = extra_len;
380
381 /* HMAC-SHA-256-128 */
382 os_memset(tmp + (mac - wpabuf_head_u8(req)), 0, EAP_SIM_MAC_LEN);
383 wpa_hexdump(MSG_MSGDUMP, "EAP-AKA': Verify MAC - msg",
384 tmp, wpabuf_len(req));
385 wpa_hexdump(MSG_MSGDUMP, "EAP-AKA': Verify MAC - extra data",
386 extra, extra_len);
387 wpa_hexdump_key(MSG_MSGDUMP, "EAP-AKA': Verify MAC - K_aut",
388 k_aut, EAP_AKA_PRIME_K_AUT_LEN);
389 hmac_sha256_vector(k_aut, EAP_AKA_PRIME_K_AUT_LEN, 2, addr, len, hmac);
390 wpa_hexdump(MSG_MSGDUMP, "EAP-AKA': Verify MAC: MAC",
391 hmac, EAP_SIM_MAC_LEN);
392 os_free(tmp);
393
394 return (os_memcmp_const(hmac, mac, EAP_SIM_MAC_LEN) == 0) ? 0 : 1;
395 }
396
397
eap_sim_add_mac_sha256(const u8 * k_aut,const u8 * msg,size_t msg_len,u8 * mac,const u8 * extra,size_t extra_len)398 void eap_sim_add_mac_sha256(const u8 *k_aut, const u8 *msg, size_t msg_len,
399 u8 *mac, const u8 *extra, size_t extra_len)
400 {
401 unsigned char hmac[SHA256_MAC_LEN];
402 const u8 *addr[2];
403 size_t len[2];
404
405 addr[0] = msg;
406 len[0] = msg_len;
407 addr[1] = extra;
408 len[1] = extra_len;
409
410 /* HMAC-SHA-256-128 */
411 os_memset(mac, 0, EAP_SIM_MAC_LEN);
412 wpa_hexdump(MSG_MSGDUMP, "EAP-AKA': Add MAC - msg", msg, msg_len);
413 wpa_hexdump(MSG_MSGDUMP, "EAP-AKA': Add MAC - extra data",
414 extra, extra_len);
415 wpa_hexdump_key(MSG_MSGDUMP, "EAP-AKA': Add MAC - K_aut",
416 k_aut, EAP_AKA_PRIME_K_AUT_LEN);
417 hmac_sha256_vector(k_aut, EAP_AKA_PRIME_K_AUT_LEN, 2, addr, len, hmac);
418 os_memcpy(mac, hmac, EAP_SIM_MAC_LEN);
419 wpa_hexdump(MSG_MSGDUMP, "EAP-AKA': Add MAC: MAC",
420 mac, EAP_SIM_MAC_LEN);
421 }
422
423
eap_aka_prime_derive_ck_ik_prime(u8 * ck,u8 * ik,const u8 * sqn_ak,const u8 * network_name,size_t network_name_len)424 void eap_aka_prime_derive_ck_ik_prime(u8 *ck, u8 *ik, const u8 *sqn_ak,
425 const u8 *network_name,
426 size_t network_name_len)
427 {
428 u8 key[EAP_AKA_CK_LEN + EAP_AKA_IK_LEN];
429 u8 hash[SHA256_MAC_LEN];
430 const u8 *addr[5];
431 size_t len[5];
432 u8 fc;
433 u8 l0[2], l1[2];
434
435 /* 3GPP TS 33.402 V8.0.0
436 * (CK', IK') = F(CK, IK, <access network identity>)
437 */
438 /* TODO: CK', IK' generation should really be moved into the actual
439 * AKA procedure with network name passed in there and option to use
440 * AMF separation bit = 1 (3GPP TS 33.401). */
441
442 /* Change Request 33.402 CR 0033 to version 8.1.1 from
443 * 3GPP TSG-SA WG3 Meeting #53 in September 2008:
444 *
445 * CK' || IK' = HMAC-SHA-256(Key, S)
446 * S = FC || P0 || L0 || P1 || L1 || ... || Pn || Ln
447 * Key = CK || IK
448 * FC = 0x20
449 * P0 = access network identity (3GPP TS 24.302)
450 * L0 = length of acceess network identity (2 octets, big endian)
451 * P1 = SQN xor AK (if AK is not used, AK is treaded as 000..0
452 * L1 = 0x00 0x06
453 */
454
455 fc = 0x20;
456
457 wpa_printf(MSG_DEBUG, "EAP-AKA': Derive (CK',IK') from (CK,IK)");
458 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': CK", ck, EAP_AKA_CK_LEN);
459 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': IK", ik, EAP_AKA_IK_LEN);
460 wpa_printf(MSG_DEBUG, "EAP-AKA': FC = 0x%x", fc);
461 wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA': P0 = Access network identity",
462 network_name, network_name_len);
463 wpa_hexdump(MSG_DEBUG, "EAP-AKA': P1 = SQN xor AK", sqn_ak, 6);
464
465 os_memcpy(key, ck, EAP_AKA_CK_LEN);
466 os_memcpy(key + EAP_AKA_CK_LEN, ik, EAP_AKA_IK_LEN);
467 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': Key = CK || IK",
468 key, sizeof(key));
469
470 addr[0] = &fc;
471 len[0] = 1;
472 addr[1] = network_name;
473 len[1] = network_name_len;
474 WPA_PUT_BE16(l0, network_name_len);
475 addr[2] = l0;
476 len[2] = 2;
477 addr[3] = sqn_ak;
478 len[3] = 6;
479 WPA_PUT_BE16(l1, 6);
480 addr[4] = l1;
481 len[4] = 2;
482
483 hmac_sha256_vector(key, sizeof(key), 5, addr, len, hash);
484 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': KDF output (CK' || IK')",
485 hash, sizeof(hash));
486
487 os_memcpy(ck, hash, EAP_AKA_CK_LEN);
488 os_memcpy(ik, hash + EAP_AKA_CK_LEN, EAP_AKA_IK_LEN);
489 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': CK'", ck, EAP_AKA_CK_LEN);
490 wpa_hexdump_key(MSG_DEBUG, "EAP-AKA': IK'", ik, EAP_AKA_IK_LEN);
491 }
492 #endif /* EAP_AKA_PRIME || EAP_SERVER_AKA_PRIME */
493
494
eap_sim_parse_attr(const u8 * start,const u8 * end,struct eap_sim_attrs * attr,int aka,int encr)495 int eap_sim_parse_attr(const u8 *start, const u8 *end,
496 struct eap_sim_attrs *attr, int aka, int encr)
497 {
498 const u8 *pos = start, *apos;
499 size_t alen, plen, i, list_len;
500
501 os_memset(attr, 0, sizeof(*attr));
502 attr->id_req = NO_ID_REQ;
503 attr->notification = -1;
504 attr->counter = -1;
505 attr->selected_version = -1;
506 attr->client_error_code = -1;
507
508 while (pos < end) {
509 if (pos + 2 > end) {
510 wpa_printf(MSG_INFO, "EAP-SIM: Attribute overflow(1)");
511 return -1;
512 }
513 wpa_printf(MSG_MSGDUMP, "EAP-SIM: Attribute: Type=%d Len=%d",
514 pos[0], pos[1] * 4);
515 if (pos + pos[1] * 4 > end) {
516 wpa_printf(MSG_INFO, "EAP-SIM: Attribute overflow "
517 "(pos=%p len=%d end=%p)",
518 pos, pos[1] * 4, end);
519 return -1;
520 }
521 if (pos[1] == 0) {
522 wpa_printf(MSG_INFO, "EAP-SIM: Attribute underflow");
523 return -1;
524 }
525 apos = pos + 2;
526 alen = pos[1] * 4 - 2;
527 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Attribute data",
528 apos, alen);
529
530 switch (pos[0]) {
531 case EAP_SIM_AT_RAND:
532 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RAND");
533 apos += 2;
534 alen -= 2;
535 if ((!aka && (alen % GSM_RAND_LEN)) ||
536 (aka && alen != EAP_AKA_RAND_LEN)) {
537 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_RAND"
538 " (len %lu)",
539 (unsigned long) alen);
540 return -1;
541 }
542 attr->rand = apos;
543 attr->num_chal = alen / GSM_RAND_LEN;
544 break;
545 case EAP_SIM_AT_AUTN:
546 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_AUTN");
547 if (!aka) {
548 wpa_printf(MSG_DEBUG, "EAP-SIM: "
549 "Unexpected AT_AUTN");
550 return -1;
551 }
552 apos += 2;
553 alen -= 2;
554 if (alen != EAP_AKA_AUTN_LEN) {
555 wpa_printf(MSG_INFO, "EAP-AKA: Invalid AT_AUTN"
556 " (len %lu)",
557 (unsigned long) alen);
558 return -1;
559 }
560 attr->autn = apos;
561 break;
562 case EAP_SIM_AT_PADDING:
563 if (!encr) {
564 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
565 "AT_PADDING");
566 return -1;
567 }
568 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) AT_PADDING");
569 for (i = 2; i < alen; i++) {
570 if (apos[i] != 0) {
571 wpa_printf(MSG_INFO, "EAP-SIM: (encr) "
572 "AT_PADDING used a non-zero"
573 " padding byte");
574 wpa_hexdump(MSG_DEBUG, "EAP-SIM: "
575 "(encr) padding bytes",
576 apos + 2, alen - 2);
577 return -1;
578 }
579 }
580 break;
581 case EAP_SIM_AT_NONCE_MT:
582 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_NONCE_MT");
583 if (alen != 2 + EAP_SIM_NONCE_MT_LEN) {
584 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
585 "AT_NONCE_MT length");
586 return -1;
587 }
588 attr->nonce_mt = apos + 2;
589 break;
590 case EAP_SIM_AT_PERMANENT_ID_REQ:
591 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_PERMANENT_ID_REQ");
592 attr->id_req = PERMANENT_ID;
593 break;
594 case EAP_SIM_AT_MAC:
595 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_MAC");
596 if (alen != 2 + EAP_SIM_MAC_LEN) {
597 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_MAC "
598 "length");
599 return -1;
600 }
601 attr->mac = apos + 2;
602 break;
603 case EAP_SIM_AT_NOTIFICATION:
604 if (alen != 2) {
605 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
606 "AT_NOTIFICATION length %lu",
607 (unsigned long) alen);
608 return -1;
609 }
610 attr->notification = apos[0] * 256 + apos[1];
611 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_NOTIFICATION %d",
612 attr->notification);
613 break;
614 case EAP_SIM_AT_ANY_ID_REQ:
615 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_ANY_ID_REQ");
616 attr->id_req = ANY_ID;
617 break;
618 case EAP_SIM_AT_IDENTITY:
619 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_IDENTITY");
620 plen = WPA_GET_BE16(apos);
621 apos += 2;
622 alen -= 2;
623 if (plen > alen) {
624 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
625 "AT_IDENTITY (Actual Length %lu, "
626 "remaining length %lu)",
627 (unsigned long) plen,
628 (unsigned long) alen);
629 return -1;
630 }
631
632 attr->identity = apos;
633 attr->identity_len = plen;
634 break;
635 case EAP_SIM_AT_VERSION_LIST:
636 if (aka) {
637 wpa_printf(MSG_DEBUG, "EAP-AKA: "
638 "Unexpected AT_VERSION_LIST");
639 return -1;
640 }
641 list_len = apos[0] * 256 + apos[1];
642 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_VERSION_LIST");
643 if (list_len < 2 || list_len > alen - 2) {
644 wpa_printf(MSG_WARNING, "EAP-SIM: Invalid "
645 "AT_VERSION_LIST (list_len=%lu "
646 "attr_len=%lu)",
647 (unsigned long) list_len,
648 (unsigned long) alen);
649 return -1;
650 }
651 attr->version_list = apos + 2;
652 attr->version_list_len = list_len;
653 break;
654 case EAP_SIM_AT_SELECTED_VERSION:
655 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_SELECTED_VERSION");
656 if (alen != 2) {
657 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
658 "AT_SELECTED_VERSION length %lu",
659 (unsigned long) alen);
660 return -1;
661 }
662 attr->selected_version = apos[0] * 256 + apos[1];
663 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_SELECTED_VERSION "
664 "%d", attr->selected_version);
665 break;
666 case EAP_SIM_AT_FULLAUTH_ID_REQ:
667 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_FULLAUTH_ID_REQ");
668 attr->id_req = FULLAUTH_ID;
669 break;
670 case EAP_SIM_AT_COUNTER:
671 if (!encr) {
672 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
673 "AT_COUNTER");
674 return -1;
675 }
676 if (alen != 2) {
677 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
678 "AT_COUNTER (alen=%lu)",
679 (unsigned long) alen);
680 return -1;
681 }
682 attr->counter = apos[0] * 256 + apos[1];
683 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) AT_COUNTER %d",
684 attr->counter);
685 break;
686 case EAP_SIM_AT_COUNTER_TOO_SMALL:
687 if (!encr) {
688 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
689 "AT_COUNTER_TOO_SMALL");
690 return -1;
691 }
692 if (alen != 2) {
693 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
694 "AT_COUNTER_TOO_SMALL (alen=%lu)",
695 (unsigned long) alen);
696 return -1;
697 }
698 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
699 "AT_COUNTER_TOO_SMALL");
700 attr->counter_too_small = 1;
701 break;
702 case EAP_SIM_AT_NONCE_S:
703 if (!encr) {
704 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
705 "AT_NONCE_S");
706 return -1;
707 }
708 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
709 "AT_NONCE_S");
710 if (alen != 2 + EAP_SIM_NONCE_S_LEN) {
711 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid "
712 "AT_NONCE_S (alen=%lu)",
713 (unsigned long) alen);
714 return -1;
715 }
716 attr->nonce_s = apos + 2;
717 break;
718 case EAP_SIM_AT_CLIENT_ERROR_CODE:
719 if (alen != 2) {
720 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
721 "AT_CLIENT_ERROR_CODE length %lu",
722 (unsigned long) alen);
723 return -1;
724 }
725 attr->client_error_code = apos[0] * 256 + apos[1];
726 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_CLIENT_ERROR_CODE "
727 "%d", attr->client_error_code);
728 break;
729 case EAP_SIM_AT_IV:
730 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_IV");
731 if (alen != 2 + EAP_SIM_MAC_LEN) {
732 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_IV "
733 "length %lu", (unsigned long) alen);
734 return -1;
735 }
736 attr->iv = apos + 2;
737 break;
738 case EAP_SIM_AT_ENCR_DATA:
739 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_ENCR_DATA");
740 attr->encr_data = apos + 2;
741 attr->encr_data_len = alen - 2;
742 if (attr->encr_data_len % 16) {
743 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
744 "AT_ENCR_DATA length %lu",
745 (unsigned long)
746 attr->encr_data_len);
747 return -1;
748 }
749 break;
750 case EAP_SIM_AT_NEXT_PSEUDONYM:
751 if (!encr) {
752 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
753 "AT_NEXT_PSEUDONYM");
754 return -1;
755 }
756 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
757 "AT_NEXT_PSEUDONYM");
758 plen = apos[0] * 256 + apos[1];
759 if (plen > alen - 2) {
760 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid"
761 " AT_NEXT_PSEUDONYM (actual"
762 " len %lu, attr len %lu)",
763 (unsigned long) plen,
764 (unsigned long) alen);
765 return -1;
766 }
767 attr->next_pseudonym = pos + 4;
768 attr->next_pseudonym_len = plen;
769 break;
770 case EAP_SIM_AT_NEXT_REAUTH_ID:
771 if (!encr) {
772 wpa_printf(MSG_ERROR, "EAP-SIM: Unencrypted "
773 "AT_NEXT_REAUTH_ID");
774 return -1;
775 }
776 wpa_printf(MSG_DEBUG, "EAP-SIM: (encr) "
777 "AT_NEXT_REAUTH_ID");
778 plen = apos[0] * 256 + apos[1];
779 if (plen > alen - 2) {
780 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Invalid"
781 " AT_NEXT_REAUTH_ID (actual"
782 " len %lu, attr len %lu)",
783 (unsigned long) plen,
784 (unsigned long) alen);
785 return -1;
786 }
787 attr->next_reauth_id = pos + 4;
788 attr->next_reauth_id_len = plen;
789 break;
790 case EAP_SIM_AT_RES:
791 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RES");
792 attr->res_len_bits = WPA_GET_BE16(apos);
793 apos += 2;
794 alen -= 2;
795 if (!aka || alen < EAP_AKA_MIN_RES_LEN ||
796 alen > EAP_AKA_MAX_RES_LEN) {
797 wpa_printf(MSG_INFO, "EAP-SIM: Invalid AT_RES "
798 "(len %lu)",
799 (unsigned long) alen);
800 return -1;
801 }
802 attr->res = apos;
803 attr->res_len = alen;
804 break;
805 case EAP_SIM_AT_AUTS:
806 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_AUTS");
807 if (!aka) {
808 wpa_printf(MSG_DEBUG, "EAP-SIM: "
809 "Unexpected AT_AUTS");
810 return -1;
811 }
812 if (alen != EAP_AKA_AUTS_LEN) {
813 wpa_printf(MSG_INFO, "EAP-AKA: Invalid AT_AUTS"
814 " (len %lu)",
815 (unsigned long) alen);
816 return -1;
817 }
818 attr->auts = apos;
819 break;
820 case EAP_SIM_AT_CHECKCODE:
821 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_CHECKCODE");
822 if (!aka) {
823 wpa_printf(MSG_DEBUG, "EAP-SIM: "
824 "Unexpected AT_CHECKCODE");
825 return -1;
826 }
827 apos += 2;
828 alen -= 2;
829 if (alen != 0 && alen != EAP_AKA_CHECKCODE_LEN &&
830 alen != EAP_AKA_PRIME_CHECKCODE_LEN) {
831 wpa_printf(MSG_INFO, "EAP-AKA: Invalid "
832 "AT_CHECKCODE (len %lu)",
833 (unsigned long) alen);
834 return -1;
835 }
836 attr->checkcode = apos;
837 attr->checkcode_len = alen;
838 break;
839 case EAP_SIM_AT_RESULT_IND:
840 if (encr) {
841 wpa_printf(MSG_ERROR, "EAP-SIM: Encrypted "
842 "AT_RESULT_IND");
843 return -1;
844 }
845 if (alen != 2) {
846 wpa_printf(MSG_INFO, "EAP-SIM: Invalid "
847 "AT_RESULT_IND (alen=%lu)",
848 (unsigned long) alen);
849 return -1;
850 }
851 wpa_printf(MSG_DEBUG, "EAP-SIM: AT_RESULT_IND");
852 attr->result_ind = 1;
853 break;
854 #if defined(EAP_AKA_PRIME) || defined(EAP_SERVER_AKA_PRIME)
855 case EAP_SIM_AT_KDF_INPUT:
856 if (aka != 2) {
857 wpa_printf(MSG_INFO, "EAP-AKA: Unexpected "
858 "AT_KDF_INPUT");
859 return -1;
860 }
861
862 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_KDF_INPUT");
863 plen = WPA_GET_BE16(apos);
864 apos += 2;
865 alen -= 2;
866 if (plen > alen) {
867 wpa_printf(MSG_INFO, "EAP-AKA': Invalid "
868 "AT_KDF_INPUT (Actual Length %lu, "
869 "remaining length %lu)",
870 (unsigned long) plen,
871 (unsigned long) alen);
872 return -1;
873 }
874 attr->kdf_input = apos;
875 attr->kdf_input_len = plen;
876 break;
877 case EAP_SIM_AT_KDF:
878 if (aka != 2) {
879 wpa_printf(MSG_INFO, "EAP-AKA: Unexpected "
880 "AT_KDF");
881 return -1;
882 }
883
884 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_KDF");
885 if (alen != 2) {
886 wpa_printf(MSG_INFO, "EAP-AKA': Invalid "
887 "AT_KDF (len %lu)",
888 (unsigned long) alen);
889 return -1;
890 }
891 if (attr->kdf_count == EAP_AKA_PRIME_KDF_MAX) {
892 wpa_printf(MSG_DEBUG, "EAP-AKA': Too many "
893 "AT_KDF attributes - ignore this");
894 break;
895 }
896 attr->kdf[attr->kdf_count] = WPA_GET_BE16(apos);
897 attr->kdf_count++;
898 break;
899 case EAP_SIM_AT_BIDDING:
900 wpa_printf(MSG_DEBUG, "EAP-AKA: AT_BIDDING");
901 if (alen != 2) {
902 wpa_printf(MSG_INFO, "EAP-AKA: Invalid "
903 "AT_BIDDING (len %lu)",
904 (unsigned long) alen);
905 return -1;
906 }
907 attr->bidding = apos;
908 break;
909 #endif /* EAP_AKA_PRIME || EAP_SERVER_AKA_PRIME */
910 default:
911 if (pos[0] < 128) {
912 wpa_printf(MSG_INFO, "EAP-SIM: Unrecognized "
913 "non-skippable attribute %d",
914 pos[0]);
915 return -1;
916 }
917
918 wpa_printf(MSG_DEBUG, "EAP-SIM: Unrecognized skippable"
919 " attribute %d ignored", pos[0]);
920 break;
921 }
922
923 pos += pos[1] * 4;
924 }
925
926 wpa_printf(MSG_DEBUG, "EAP-SIM: Attributes parsed successfully "
927 "(aka=%d encr=%d)", aka, encr);
928
929 return 0;
930 }
931
932
eap_sim_parse_encr(const u8 * k_encr,const u8 * encr_data,size_t encr_data_len,const u8 * iv,struct eap_sim_attrs * attr,int aka)933 u8 * eap_sim_parse_encr(const u8 *k_encr, const u8 *encr_data,
934 size_t encr_data_len, const u8 *iv,
935 struct eap_sim_attrs *attr, int aka)
936 {
937 u8 *decrypted;
938
939 if (!iv) {
940 wpa_printf(MSG_INFO, "EAP-SIM: Encrypted data, but no IV");
941 return NULL;
942 }
943
944 decrypted = os_memdup(encr_data, encr_data_len);
945 if (decrypted == NULL)
946 return NULL;
947
948 #ifdef TEST_FUZZ
949 wpa_printf(MSG_INFO,
950 "TEST: Skip AES-128-CBC decryption for fuzz testing");
951 #else /* TEST_FUZZ */
952 if (aes_128_cbc_decrypt(k_encr, iv, decrypted, encr_data_len)) {
953 os_free(decrypted);
954 return NULL;
955 }
956 #endif /* TEST_FUZZ */
957 wpa_hexdump(MSG_MSGDUMP, "EAP-SIM: Decrypted AT_ENCR_DATA",
958 decrypted, encr_data_len);
959
960 if (eap_sim_parse_attr(decrypted, decrypted + encr_data_len, attr,
961 aka, 1)) {
962 wpa_printf(MSG_INFO, "EAP-SIM: (encr) Failed to parse "
963 "decrypted AT_ENCR_DATA");
964 os_free(decrypted);
965 return NULL;
966 }
967
968 return decrypted;
969 }
970
971
972 #define EAP_SIM_INIT_LEN 128
973
974 struct eap_sim_msg {
975 struct wpabuf *buf;
976 size_t mac, iv, encr; /* index from buf */
977 };
978
979
eap_sim_msg_init(int code,int id,int type,int subtype)980 struct eap_sim_msg * eap_sim_msg_init(int code, int id, int type, int subtype)
981 {
982 struct eap_sim_msg *msg;
983 struct eap_hdr *eap;
984 u8 *pos;
985
986 msg = os_zalloc(sizeof(*msg));
987 if (msg == NULL)
988 return NULL;
989
990 msg->buf = wpabuf_alloc(EAP_SIM_INIT_LEN);
991 if (msg->buf == NULL) {
992 os_free(msg);
993 return NULL;
994 }
995 eap = wpabuf_put(msg->buf, sizeof(*eap));
996 eap->code = code;
997 eap->identifier = id;
998
999 pos = wpabuf_put(msg->buf, 4);
1000 *pos++ = type;
1001 *pos++ = subtype;
1002 *pos++ = 0; /* Reserved */
1003 *pos++ = 0; /* Reserved */
1004
1005 return msg;
1006 }
1007
1008
eap_sim_msg_finish(struct eap_sim_msg * msg,int type,const u8 * k_aut,const u8 * extra,size_t extra_len)1009 struct wpabuf * eap_sim_msg_finish(struct eap_sim_msg *msg, int type,
1010 const u8 *k_aut,
1011 const u8 *extra, size_t extra_len)
1012 {
1013 struct eap_hdr *eap;
1014 struct wpabuf *buf;
1015
1016 if (msg == NULL)
1017 return NULL;
1018
1019 eap = wpabuf_mhead(msg->buf);
1020 eap->length = host_to_be16(wpabuf_len(msg->buf));
1021
1022 #if defined(EAP_AKA_PRIME) || defined(EAP_SERVER_AKA_PRIME)
1023 if (k_aut && msg->mac && type == EAP_TYPE_AKA_PRIME) {
1024 eap_sim_add_mac_sha256(k_aut, (u8 *) wpabuf_head(msg->buf),
1025 wpabuf_len(msg->buf),
1026 (u8 *) wpabuf_mhead(msg->buf) +
1027 msg->mac, extra, extra_len);
1028 } else
1029 #endif /* EAP_AKA_PRIME || EAP_SERVER_AKA_PRIME */
1030 if (k_aut && msg->mac) {
1031 eap_sim_add_mac(k_aut, (u8 *) wpabuf_head(msg->buf),
1032 wpabuf_len(msg->buf),
1033 (u8 *) wpabuf_mhead(msg->buf) + msg->mac,
1034 extra, extra_len);
1035 }
1036
1037 buf = msg->buf;
1038 os_free(msg);
1039 return buf;
1040 }
1041
1042
eap_sim_msg_free(struct eap_sim_msg * msg)1043 void eap_sim_msg_free(struct eap_sim_msg *msg)
1044 {
1045 if (msg) {
1046 wpabuf_free(msg->buf);
1047 os_free(msg);
1048 }
1049 }
1050
1051
eap_sim_msg_add_full(struct eap_sim_msg * msg,u8 attr,const u8 * data,size_t len)1052 u8 * eap_sim_msg_add_full(struct eap_sim_msg *msg, u8 attr,
1053 const u8 *data, size_t len)
1054 {
1055 int attr_len = 2 + len;
1056 int pad_len;
1057 u8 *start;
1058
1059 if (msg == NULL)
1060 return NULL;
1061
1062 pad_len = (4 - attr_len % 4) % 4;
1063 attr_len += pad_len;
1064 if (wpabuf_resize(&msg->buf, attr_len))
1065 return NULL;
1066 start = wpabuf_put(msg->buf, 0);
1067 wpabuf_put_u8(msg->buf, attr);
1068 wpabuf_put_u8(msg->buf, attr_len / 4);
1069 wpabuf_put_data(msg->buf, data, len);
1070 if (pad_len)
1071 os_memset(wpabuf_put(msg->buf, pad_len), 0, pad_len);
1072 return start;
1073 }
1074
1075
eap_sim_msg_add(struct eap_sim_msg * msg,u8 attr,u16 value,const u8 * data,size_t len)1076 u8 * eap_sim_msg_add(struct eap_sim_msg *msg, u8 attr, u16 value,
1077 const u8 *data, size_t len)
1078 {
1079 int attr_len = 4 + len;
1080 int pad_len;
1081 u8 *start;
1082
1083 if (msg == NULL)
1084 return NULL;
1085
1086 pad_len = (4 - attr_len % 4) % 4;
1087 attr_len += pad_len;
1088 if (wpabuf_resize(&msg->buf, attr_len))
1089 return NULL;
1090 start = wpabuf_put(msg->buf, 0);
1091 wpabuf_put_u8(msg->buf, attr);
1092 wpabuf_put_u8(msg->buf, attr_len / 4);
1093 wpabuf_put_be16(msg->buf, value);
1094 if (data)
1095 wpabuf_put_data(msg->buf, data, len);
1096 else
1097 wpabuf_put(msg->buf, len);
1098 if (pad_len)
1099 os_memset(wpabuf_put(msg->buf, pad_len), 0, pad_len);
1100 return start;
1101 }
1102
1103
eap_sim_msg_add_mac(struct eap_sim_msg * msg,u8 attr)1104 u8 * eap_sim_msg_add_mac(struct eap_sim_msg *msg, u8 attr)
1105 {
1106 u8 *pos = eap_sim_msg_add(msg, attr, 0, NULL, EAP_SIM_MAC_LEN);
1107 if (pos)
1108 msg->mac = (pos - wpabuf_head_u8(msg->buf)) + 4;
1109 return pos;
1110 }
1111
1112
eap_sim_msg_add_encr_start(struct eap_sim_msg * msg,u8 attr_iv,u8 attr_encr)1113 int eap_sim_msg_add_encr_start(struct eap_sim_msg *msg, u8 attr_iv,
1114 u8 attr_encr)
1115 {
1116 u8 *pos = eap_sim_msg_add(msg, attr_iv, 0, NULL, EAP_SIM_IV_LEN);
1117 if (pos == NULL)
1118 return -1;
1119 msg->iv = (pos - wpabuf_head_u8(msg->buf)) + 4;
1120 if (random_get_bytes(wpabuf_mhead_u8(msg->buf) + msg->iv,
1121 EAP_SIM_IV_LEN)) {
1122 msg->iv = 0;
1123 return -1;
1124 }
1125
1126 pos = eap_sim_msg_add(msg, attr_encr, 0, NULL, 0);
1127 if (pos == NULL) {
1128 msg->iv = 0;
1129 return -1;
1130 }
1131 msg->encr = pos - wpabuf_head_u8(msg->buf);
1132
1133 return 0;
1134 }
1135
1136
eap_sim_msg_add_encr_end(struct eap_sim_msg * msg,u8 * k_encr,int attr_pad)1137 int eap_sim_msg_add_encr_end(struct eap_sim_msg *msg, u8 *k_encr, int attr_pad)
1138 {
1139 size_t encr_len;
1140
1141 if (msg == NULL || k_encr == NULL || msg->iv == 0 || msg->encr == 0)
1142 return -1;
1143
1144 encr_len = wpabuf_len(msg->buf) - msg->encr - 4;
1145 if (encr_len % 16) {
1146 u8 *pos;
1147 int pad_len = 16 - (encr_len % 16);
1148 if (pad_len < 4) {
1149 wpa_printf(MSG_WARNING, "EAP-SIM: "
1150 "eap_sim_msg_add_encr_end - invalid pad_len"
1151 " %d", pad_len);
1152 return -1;
1153 }
1154 wpa_printf(MSG_DEBUG, " *AT_PADDING");
1155 pos = eap_sim_msg_add(msg, attr_pad, 0, NULL, pad_len - 4);
1156 if (pos == NULL)
1157 return -1;
1158 os_memset(pos + 4, 0, pad_len - 4);
1159 encr_len += pad_len;
1160 }
1161 wpa_printf(MSG_DEBUG, " (AT_ENCR_DATA data len %lu)",
1162 (unsigned long) encr_len);
1163 wpabuf_mhead_u8(msg->buf)[msg->encr + 1] = encr_len / 4 + 1;
1164 return aes_128_cbc_encrypt(k_encr, wpabuf_head_u8(msg->buf) + msg->iv,
1165 wpabuf_mhead_u8(msg->buf) + msg->encr + 4,
1166 encr_len);
1167 }
1168
1169
eap_sim_report_notification(void * msg_ctx,int notification,int aka)1170 void eap_sim_report_notification(void *msg_ctx, int notification, int aka)
1171 {
1172 #ifndef CONFIG_NO_STDOUT_DEBUG
1173 const char *type = aka ? "AKA" : "SIM";
1174 #endif /* CONFIG_NO_STDOUT_DEBUG */
1175
1176 switch (notification) {
1177 case EAP_SIM_GENERAL_FAILURE_AFTER_AUTH:
1178 wpa_printf(MSG_WARNING, "EAP-%s: General failure "
1179 "notification (after authentication)", type);
1180 break;
1181 case EAP_SIM_TEMPORARILY_DENIED:
1182 wpa_printf(MSG_WARNING, "EAP-%s: Failure notification: "
1183 "User has been temporarily denied access to the "
1184 "requested service", type);
1185 break;
1186 case EAP_SIM_NOT_SUBSCRIBED:
1187 wpa_printf(MSG_WARNING, "EAP-%s: Failure notification: "
1188 "User has not subscribed to the requested service",
1189 type);
1190 break;
1191 case EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH:
1192 wpa_printf(MSG_WARNING, "EAP-%s: General failure "
1193 "notification (before authentication)", type);
1194 break;
1195 case EAP_SIM_SUCCESS:
1196 wpa_printf(MSG_INFO, "EAP-%s: Successful authentication "
1197 "notification", type);
1198 break;
1199 default:
1200 if (notification >= 32768) {
1201 wpa_printf(MSG_INFO, "EAP-%s: Unrecognized "
1202 "non-failure notification %d",
1203 type, notification);
1204 } else {
1205 wpa_printf(MSG_WARNING, "EAP-%s: Unrecognized "
1206 "failure notification %d",
1207 type, notification);
1208 }
1209 }
1210 }
1211
1212
get_last_char(const u8 * val,size_t len,char c)1213 static const u8 * get_last_char(const u8 *val, size_t len, char c)
1214 {
1215 while (len > 0) {
1216 const u8 *pos = &val[len - 1];
1217
1218 if (*pos == (u8) c)
1219 return pos;
1220 len--;
1221 }
1222
1223 return NULL;
1224 }
1225
1226
eap_sim_anonymous_username(const u8 * id,size_t id_len)1227 int eap_sim_anonymous_username(const u8 *id, size_t id_len)
1228 {
1229 static const char *anonymous_id_prefix = "anonymous@";
1230 const u8 *decorated;
1231 size_t anonymous_id_len = os_strlen(anonymous_id_prefix);
1232
1233 if (id_len > anonymous_id_len &&
1234 os_memcmp(id, anonymous_id_prefix, anonymous_id_len) == 0)
1235 return 1; /* 'anonymous@realm' */
1236
1237 if (id_len > anonymous_id_len + 1 &&
1238 os_memcmp(id + 1, anonymous_id_prefix, anonymous_id_len) == 0)
1239 return 1; /* 'Xanonymous@realm' where X is an EAP method code */
1240
1241 if (id_len > 1 && id[0] == '@')
1242 return 1; /* '@realm' */
1243
1244 /* RFC 7542 decorated username, for example:
1245 * homerealm.example.org!anonymous@otherrealm.example.net */
1246 decorated = get_last_char(id, id_len, '!');
1247 if (decorated) {
1248 decorated++;
1249 return eap_sim_anonymous_username(decorated,
1250 id + id_len - decorated);
1251 }
1252
1253 return 0;
1254 }
1255
