src/eap_server/eap_server_aka.c

   1 /*
   2  * hostapd / EAP-AKA (RFC 4187) and EAP-AKA' (RFC 5448)
   3  * Copyright (c) 2005-2012, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/sha256.h"
  13 #include "crypto/crypto.h"
  14 #include "crypto/random.h"
  15 #include "eap_common/eap_sim_common.h"
  16 #include "eap_server/eap_i.h"
  17 #include "eap_server/eap_sim_db.h"
  18
  19
  20 struct eap_aka_data {
  21         u8 mk[EAP_SIM_MK_LEN];
  22         u8 nonce_s[EAP_SIM_NONCE_S_LEN];
  23         u8 k_aut[EAP_AKA_PRIME_K_AUT_LEN];
  24         u8 k_encr[EAP_SIM_K_ENCR_LEN];
  25         u8 k_re[EAP_AKA_PRIME_K_RE_LEN]; /* EAP-AKA' only */
  26         u8 msk[EAP_SIM_KEYING_DATA_LEN];
  27         u8 emsk[EAP_EMSK_LEN];
  28         u8 rand[EAP_AKA_RAND_LEN];
  29         u8 autn[EAP_AKA_AUTN_LEN];
  30         u8 ck[EAP_AKA_CK_LEN];
  31         u8 ik[EAP_AKA_IK_LEN];
  32         u8 res[EAP_AKA_RES_MAX_LEN];
  33         size_t res_len;
  34         enum {
  35                 IDENTITY, CHALLENGE, REAUTH, NOTIFICATION, SUCCESS, FAILURE
  36         } state;
  37         char *next_pseudonym;
  38         char *next_reauth_id;
  39         u16 counter;
  40         struct eap_sim_reauth *reauth;
  41         int auts_reported; /* whether the current AUTS has been reported to the
  42                             * eap_sim_db */
  43         u16 notification;
  44         int use_result_ind;
  45
  46         struct wpabuf *id_msgs;
  47         int pending_id;
  48         u8 eap_method;
  49         u8 *network_name;
  50         size_t network_name_len;
  51         u16 kdf;
  52         int identity_round;
  53         char permanent[20]; /* Permanent username */
  54 };
  55
  56
  57 static void eap_aka_fullauth(struct eap_sm *sm, struct eap_aka_data *data);
  58
  59
  60 static const char * eap_aka_state_txt(int state)
  61 {
  62         switch (state) {
  63         case IDENTITY:
  64                 return "IDENTITY";
  65         case CHALLENGE:
  66                 return "CHALLENGE";
  67         case REAUTH:
  68                 return "REAUTH";
  69         case SUCCESS:
  70                 return "SUCCESS";
  71         case FAILURE:
  72                 return "FAILURE";
  73         case NOTIFICATION:
  74                 return "NOTIFICATION";
  75         default:
  76                 return "Unknown?!";
  77         }
  78 }
  79
  80
  81 static void eap_aka_state(struct eap_aka_data *data, int state)
  82 {
  83         wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
  84                    eap_aka_state_txt(data->state),
  85                    eap_aka_state_txt(state));
  86         data->state = state;
  87 }
  88
  89
  90 static int eap_aka_check_identity_reauth(struct eap_sm *sm,
  91                                          struct eap_aka_data *data,
  92                                          const char *username)
  93 {
  94         if (data->eap_method == EAP_TYPE_AKA_PRIME &&
  95             username[0] != EAP_AKA_PRIME_REAUTH_ID_PREFIX)
  96                 return 0;
  97         if (data->eap_method == EAP_TYPE_AKA &&
  98             username[0] != EAP_AKA_REAUTH_ID_PREFIX)
  99                 return 0;
 100
 101         wpa_printf(MSG_DEBUG, "EAP-AKA: Reauth username '%s'", username);
 102         data->reauth = eap_sim_db_get_reauth_entry(sm->eap_sim_db_priv,
 103                                                    username);
 104         if (data->reauth == NULL) {
 105                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown reauth identity - "
 106                            "request full auth identity");
 107                 /* Remain in IDENTITY state for another round */
 108                 return 0;
 109         }
 110
 111         wpa_printf(MSG_DEBUG, "EAP-AKA: Using fast re-authentication");
 112         os_strlcpy(data->permanent, data->reauth->permanent,
 113                    sizeof(data->permanent));
 114         data->counter = data->reauth->counter;
 115         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 116                 os_memcpy(data->k_encr, data->reauth->k_encr,
 117                           EAP_SIM_K_ENCR_LEN);
 118                 os_memcpy(data->k_aut, data->reauth->k_aut,
 119                           EAP_AKA_PRIME_K_AUT_LEN);
 120                 os_memcpy(data->k_re, data->reauth->k_re,
 121                           EAP_AKA_PRIME_K_RE_LEN);
 122         } else {
 123                 os_memcpy(data->mk, data->reauth->mk, EAP_SIM_MK_LEN);
 124         }
 125
 126         eap_aka_state(data, REAUTH);
 127         return 1;
 128 }
 129
 130
 131 static void eap_aka_check_identity(struct eap_sm *sm,
 132                                    struct eap_aka_data *data)
 133 {
 134         char *username;
 135
 136         /* Check if we already know the identity from EAP-Response/Identity */
 137
 138         username = sim_get_username(sm->identity, sm->identity_len);
 139         if (username == NULL)
 140                 return;
 141
 142         if (eap_aka_check_identity_reauth(sm, data, username) > 0) {
 143                 os_free(username);
 144                 /*
 145                  * Since re-auth username was recognized, skip AKA/Identity
 146                  * exchange.
 147                  */
 148                 return;
 149         }
 150
 151         if ((data->eap_method == EAP_TYPE_AKA_PRIME &&
 152              username[0] == EAP_AKA_PRIME_PSEUDONYM_PREFIX) ||
 153             (data->eap_method == EAP_TYPE_AKA &&
 154              username[0] == EAP_AKA_PSEUDONYM_PREFIX)) {
 155                 const char *permanent;
 156                 wpa_printf(MSG_DEBUG, "EAP-AKA: Pseudonym username '%s'",
 157                            username);
 158                 permanent = eap_sim_db_get_permanent(
 159                         sm->eap_sim_db_priv, username);
 160                 if (permanent == NULL) {
 161                         os_free(username);
 162                         wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown pseudonym "
 163                                    "identity - request permanent identity");
 164                         /* Remain in IDENTITY state for another round */
 165                         return;
 166                 }
 167                 os_strlcpy(data->permanent, permanent,
 168                            sizeof(data->permanent));
 169                 /*
 170                  * Since pseudonym username was recognized, skip AKA/Identity
 171                  * exchange.
 172                  */
 173                 eap_aka_fullauth(sm, data);
 174         }
 175
 176         os_free(username);
 177 }
 178
 179
 180 static void * eap_aka_init(struct eap_sm *sm)
 181 {
 182         struct eap_aka_data *data;
 183
 184         if (sm->eap_sim_db_priv == NULL) {
 185                 wpa_printf(MSG_WARNING, "EAP-AKA: eap_sim_db not configured");
 186                 return NULL;
 187         }
 188
 189         data = os_zalloc(sizeof(*data));
 190         if (data == NULL)
 191                 return NULL;
 192
 193         data->eap_method = EAP_TYPE_AKA;
 194
 195         data->state = IDENTITY;
 196         data->pending_id = -1;
 197         eap_aka_check_identity(sm, data);
 198
 199         return data;
 200 }
 201
 202
 203 #ifdef EAP_SERVER_AKA_PRIME
 204 static void * eap_aka_prime_init(struct eap_sm *sm)
 205 {
 206         struct eap_aka_data *data;
 207         /* TODO: make ANID configurable; see 3GPP TS 24.302 */
 208         char *network_name = "WLAN";
 209
 210         if (sm->eap_sim_db_priv == NULL) {
 211                 wpa_printf(MSG_WARNING, "EAP-AKA: eap_sim_db not configured");
 212                 return NULL;
 213         }
 214
 215         data = os_zalloc(sizeof(*data));
 216         if (data == NULL)
 217                 return NULL;
 218
 219         data->eap_method = EAP_TYPE_AKA_PRIME;
 220         data->network_name = (u8 *) os_strdup(network_name);
 221         if (data->network_name == NULL) {
 222                 os_free(data);
 223                 return NULL;
 224         }
 225
 226         data->network_name_len = os_strlen(network_name);
 227
 228         data->state = IDENTITY;
 229         data->pending_id = -1;
 230         eap_aka_check_identity(sm, data);
 231
 232         return data;
 233 }
 234 #endif /* EAP_SERVER_AKA_PRIME */
 235
 236
 237 static void eap_aka_reset(struct eap_sm *sm, void *priv)
 238 {
 239         struct eap_aka_data *data = priv;
 240         os_free(data->next_pseudonym);
 241         os_free(data->next_reauth_id);
 242         wpabuf_free(data->id_msgs);
 243         os_free(data->network_name);
 244         os_free(data);
 245 }
 246
 247
 248 static int eap_aka_add_id_msg(struct eap_aka_data *data,
 249                               const struct wpabuf *msg)
 250 {
 251         if (msg == NULL)
 252                 return -1;
 253
 254         if (data->id_msgs == NULL) {
 255                 data->id_msgs = wpabuf_dup(msg);
 256                 return data->id_msgs == NULL ? -1 : 0;
 257         }
 258
 259         if (wpabuf_resize(&data->id_msgs, wpabuf_len(msg)) < 0)
 260                 return -1;
 261         wpabuf_put_buf(data->id_msgs, msg);
 262
 263         return 0;
 264 }
 265
 266
 267 static void eap_aka_add_checkcode(struct eap_aka_data *data,
 268                                   struct eap_sim_msg *msg)
 269 {
 270         const u8 *addr;
 271         size_t len;
 272         u8 hash[SHA256_MAC_LEN];
 273
 274         wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
 275
 276         if (data->id_msgs == NULL) {
 277                 /*
 278                  * No EAP-AKA/Identity packets were exchanged - send empty
 279                  * checkcode.
 280                  */
 281                 eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
 282                 return;
 283         }
 284
 285         /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
 286         addr = wpabuf_head(data->id_msgs);
 287         len = wpabuf_len(data->id_msgs);
 288         wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
 289         if (data->eap_method == EAP_TYPE_AKA_PRIME)
 290                 sha256_vector(1, &addr, &len, hash);
 291         else
 292                 sha1_vector(1, &addr, &len, hash);
 293
 294         eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
 295                         data->eap_method == EAP_TYPE_AKA_PRIME ?
 296                         EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN);
 297 }
 298
 299
 300 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
 301                                     const u8 *checkcode, size_t checkcode_len)
 302 {
 303         const u8 *addr;
 304         size_t len;
 305         u8 hash[SHA256_MAC_LEN];
 306         size_t hash_len;
 307
 308         if (checkcode == NULL)
 309                 return -1;
 310
 311         if (data->id_msgs == NULL) {
 312                 if (checkcode_len != 0) {
 313                         wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from peer "
 314                                    "indicates that AKA/Identity messages were "
 315                                    "used, but they were not");
 316                         return -1;
 317                 }
 318                 return 0;
 319         }
 320
 321         hash_len = data->eap_method == EAP_TYPE_AKA_PRIME ?
 322                 EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN;
 323
 324         if (checkcode_len != hash_len) {
 325                 wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from peer indicates "
 326                            "that AKA/Identity message were not used, but they "
 327                            "were");
 328                 return -1;
 329         }
 330
 331         /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
 332         addr = wpabuf_head(data->id_msgs);
 333         len = wpabuf_len(data->id_msgs);
 334         if (data->eap_method == EAP_TYPE_AKA_PRIME)
 335                 sha256_vector(1, &addr, &len, hash);
 336         else
 337                 sha1_vector(1, &addr, &len, hash);
 338
 339         if (os_memcmp(hash, checkcode, hash_len) != 0) {
 340                 wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
 341                 return -1;
 342         }
 343
 344         return 0;
 345 }
 346
 347
 348 static struct wpabuf * eap_aka_build_identity(struct eap_sm *sm,
 349                                               struct eap_aka_data *data, u8 id)
 350 {
 351         struct eap_sim_msg *msg;
 352         struct wpabuf *buf;
 353
 354         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Identity");
 355         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
 356                                EAP_AKA_SUBTYPE_IDENTITY);
 357         data->identity_round++;
 358         if (data->identity_round == 1) {
 359                 /*
 360                  * RFC 4187, Chap. 4.1.4 recommends that identity from EAP is
 361                  * ignored and the AKA/Identity is used to request the
 362                  * identity.
 363                  */
 364                 wpa_printf(MSG_DEBUG, "   AT_ANY_ID_REQ");
 365                 eap_sim_msg_add(msg, EAP_SIM_AT_ANY_ID_REQ, 0, NULL, 0);
 366         } else if (data->identity_round > 3) {
 367                 /* Cannot use more than three rounds of Identity messages */
 368                 eap_sim_msg_free(msg);
 369                 return NULL;
 370         } else if (sm->identity && sm->identity_len > 0 &&
 371                    (sm->identity[0] == EAP_AKA_REAUTH_ID_PREFIX ||
 372                     sm->identity[0] == EAP_AKA_PRIME_REAUTH_ID_PREFIX)) {
 373                 /* Reauth id may have expired - try fullauth */
 374                 wpa_printf(MSG_DEBUG, "   AT_FULLAUTH_ID_REQ");
 375                 eap_sim_msg_add(msg, EAP_SIM_AT_FULLAUTH_ID_REQ, 0, NULL, 0);
 376         } else {
 377                 wpa_printf(MSG_DEBUG, "   AT_PERMANENT_ID_REQ");
 378                 eap_sim_msg_add(msg, EAP_SIM_AT_PERMANENT_ID_REQ, 0, NULL, 0);
 379         }
 380         buf = eap_sim_msg_finish(msg, NULL, NULL, 0);
 381         if (eap_aka_add_id_msg(data, buf) < 0) {
 382                 wpabuf_free(buf);
 383                 return NULL;
 384         }
 385         data->pending_id = id;
 386         return buf;
 387 }
 388
 389
 390 static int eap_aka_build_encr(struct eap_sm *sm, struct eap_aka_data *data,
 391                               struct eap_sim_msg *msg, u16 counter,
 392                               const u8 *nonce_s)
 393 {
 394         os_free(data->next_pseudonym);
 395         if (nonce_s == NULL) {
 396                 data->next_pseudonym =
 397                         eap_sim_db_get_next_pseudonym(
 398                                 sm->eap_sim_db_priv,
 399                                 data->eap_method == EAP_TYPE_AKA_PRIME ?
 400                                 EAP_SIM_DB_AKA_PRIME : EAP_SIM_DB_AKA);
 401         } else {
 402                 /* Do not update pseudonym during re-authentication */
 403                 data->next_pseudonym = NULL;
 404         }
 405         os_free(data->next_reauth_id);
 406         if (data->counter <= EAP_AKA_MAX_FAST_REAUTHS) {
 407                 data->next_reauth_id =
 408                         eap_sim_db_get_next_reauth_id(
 409                                 sm->eap_sim_db_priv,
 410                                 data->eap_method == EAP_TYPE_AKA_PRIME ?
 411                                 EAP_SIM_DB_AKA_PRIME : EAP_SIM_DB_AKA);
 412         } else {
 413                 wpa_printf(MSG_DEBUG, "EAP-AKA: Max fast re-authentication "
 414                            "count exceeded - force full authentication");
 415                 data->next_reauth_id = NULL;
 416         }
 417
 418         if (data->next_pseudonym == NULL && data->next_reauth_id == NULL &&
 419             counter == 0 && nonce_s == NULL)
 420                 return 0;
 421
 422         wpa_printf(MSG_DEBUG, "   AT_IV");
 423         wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 424         eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
 425
 426         if (counter > 0) {
 427                 wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)", counter);
 428                 eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
 429         }
 430
 431         if (nonce_s) {
 432                 wpa_printf(MSG_DEBUG, "   *AT_NONCE_S");
 433                 eap_sim_msg_add(msg, EAP_SIM_AT_NONCE_S, 0, nonce_s,
 434                                 EAP_SIM_NONCE_S_LEN);
 435         }
 436
 437         if (data->next_pseudonym) {
 438                 wpa_printf(MSG_DEBUG, "   *AT_NEXT_PSEUDONYM (%s)",
 439                            data->next_pseudonym);
 440                 eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_PSEUDONYM,
 441                                 os_strlen(data->next_pseudonym),
 442                                 (u8 *) data->next_pseudonym,
 443                                 os_strlen(data->next_pseudonym));
 444         }
 445
 446         if (data->next_reauth_id) {
 447                 wpa_printf(MSG_DEBUG, "   *AT_NEXT_REAUTH_ID (%s)",
 448                            data->next_reauth_id);
 449                 eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_REAUTH_ID,
 450                                 os_strlen(data->next_reauth_id),
 451                                 (u8 *) data->next_reauth_id,
 452                                 os_strlen(data->next_reauth_id));
 453         }
 454
 455         if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
 456                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 457                            "AT_ENCR_DATA");
 458                 return -1;
 459         }
 460
 461         return 0;
 462 }
 463
 464
 465 static struct wpabuf * eap_aka_build_challenge(struct eap_sm *sm,
 466                                                struct eap_aka_data *data,
 467                                                u8 id)
 468 {
 469         struct eap_sim_msg *msg;
 470
 471         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Challenge");
 472         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
 473                                EAP_AKA_SUBTYPE_CHALLENGE);
 474         wpa_printf(MSG_DEBUG, "   AT_RAND");
 475         eap_sim_msg_add(msg, EAP_SIM_AT_RAND, 0, data->rand, EAP_AKA_RAND_LEN);
 476         wpa_printf(MSG_DEBUG, "   AT_AUTN");
 477         eap_sim_msg_add(msg, EAP_SIM_AT_AUTN, 0, data->autn, EAP_AKA_AUTN_LEN);
 478         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 479                 if (data->kdf) {
 480                         /* Add the selected KDF into the beginning */
 481                         wpa_printf(MSG_DEBUG, "   AT_KDF");
 482                         eap_sim_msg_add(msg, EAP_SIM_AT_KDF, data->kdf,
 483                                         NULL, 0);
 484                 }
 485                 wpa_printf(MSG_DEBUG, "   AT_KDF");
 486                 eap_sim_msg_add(msg, EAP_SIM_AT_KDF, EAP_AKA_PRIME_KDF,
 487                                 NULL, 0);
 488                 wpa_printf(MSG_DEBUG, "   AT_KDF_INPUT");
 489                 eap_sim_msg_add(msg, EAP_SIM_AT_KDF_INPUT,
 490                                 data->network_name_len,
 491                                 data->network_name, data->network_name_len);
 492         }
 493
 494         if (eap_aka_build_encr(sm, data, msg, 0, NULL)) {
 495                 eap_sim_msg_free(msg);
 496                 return NULL;
 497         }
 498
 499         eap_aka_add_checkcode(data, msg);
 500
 501         if (sm->eap_sim_aka_result_ind) {
 502                 wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 503                 eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 504         }
 505
 506 #ifdef EAP_SERVER_AKA_PRIME
 507         if (data->eap_method == EAP_TYPE_AKA) {
 508                 u16 flags = 0;
 509                 int i;
 510                 int aka_prime_preferred = 0;
 511
 512                 i = 0;
 513                 while (sm->user && i < EAP_MAX_METHODS &&
 514                        (sm->user->methods[i].vendor != EAP_VENDOR_IETF ||
 515                         sm->user->methods[i].method != EAP_TYPE_NONE)) {
 516                         if (sm->user->methods[i].vendor == EAP_VENDOR_IETF) {
 517                                 if (sm->user->methods[i].method ==
 518                                     EAP_TYPE_AKA)
 519                                         break;
 520                                 if (sm->user->methods[i].method ==
 521                                     EAP_TYPE_AKA_PRIME) {
 522                                         aka_prime_preferred = 1;
 523                                         break;
 524                                 }
 525                         }
 526                         i++;
 527                 }
 528
 529                 if (aka_prime_preferred)
 530                         flags |= EAP_AKA_BIDDING_FLAG_D;
 531                 eap_sim_msg_add(msg, EAP_SIM_AT_BIDDING, flags, NULL, 0);
 532         }
 533 #endif /* EAP_SERVER_AKA_PRIME */
 534
 535         wpa_printf(MSG_DEBUG, "   AT_MAC");
 536         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 537         return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
 538 }
 539
 540
 541 static struct wpabuf * eap_aka_build_reauth(struct eap_sm *sm,
 542                                             struct eap_aka_data *data, u8 id)
 543 {
 544         struct eap_sim_msg *msg;
 545
 546         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Re-authentication");
 547
 548         if (random_get_bytes(data->nonce_s, EAP_SIM_NONCE_S_LEN))
 549                 return NULL;
 550         wpa_hexdump_key(MSG_MSGDUMP, "EAP-AKA: NONCE_S",
 551                         data->nonce_s, EAP_SIM_NONCE_S_LEN);
 552
 553         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 554                 eap_aka_prime_derive_keys_reauth(data->k_re, data->counter,
 555                                                  sm->identity,
 556                                                  sm->identity_len,
 557                                                  data->nonce_s,
 558                                                  data->msk, data->emsk);
 559         } else {
 560                 eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
 561                                     data->msk, data->emsk);
 562                 eap_sim_derive_keys_reauth(data->counter, sm->identity,
 563                                            sm->identity_len, data->nonce_s,
 564                                            data->mk, data->msk, data->emsk);
 565         }
 566
 567         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
 568                                EAP_AKA_SUBTYPE_REAUTHENTICATION);
 569
 570         if (eap_aka_build_encr(sm, data, msg, data->counter, data->nonce_s)) {
 571                 eap_sim_msg_free(msg);
 572                 return NULL;
 573         }
 574
 575         eap_aka_add_checkcode(data, msg);
 576
 577         if (sm->eap_sim_aka_result_ind) {
 578                 wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 579                 eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 580         }
 581
 582         wpa_printf(MSG_DEBUG, "   AT_MAC");
 583         eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 584         return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
 585 }
 586
 587
 588 static struct wpabuf * eap_aka_build_notification(struct eap_sm *sm,
 589                                                   struct eap_aka_data *data,
 590                                                   u8 id)
 591 {
 592         struct eap_sim_msg *msg;
 593
 594         wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Notification");
 595         msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
 596                                EAP_AKA_SUBTYPE_NOTIFICATION);
 597         wpa_printf(MSG_DEBUG, "   AT_NOTIFICATION (%d)", data->notification);
 598         eap_sim_msg_add(msg, EAP_SIM_AT_NOTIFICATION, data->notification,
 599                         NULL, 0);
 600         if (data->use_result_ind) {
 601                 if (data->reauth) {
 602                         wpa_printf(MSG_DEBUG, "   AT_IV");
 603                         wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 604                         eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
 605                                                    EAP_SIM_AT_ENCR_DATA);
 606                         wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)",
 607                                    data->counter);
 608                         eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
 609                                         NULL, 0);
 610
 611                         if (eap_sim_msg_add_encr_end(msg, data->k_encr,
 612                                                      EAP_SIM_AT_PADDING)) {
 613                                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to "
 614                                            "encrypt AT_ENCR_DATA");
 615                                 eap_sim_msg_free(msg);
 616                                 return NULL;
 617                         }
 618                 }
 619
 620                 wpa_printf(MSG_DEBUG, "   AT_MAC");
 621                 eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 622         }
 623         return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
 624 }
 625
 626
 627 static struct wpabuf * eap_aka_buildReq(struct eap_sm *sm, void *priv, u8 id)
 628 {
 629         struct eap_aka_data *data = priv;
 630
 631         data->auts_reported = 0;
 632         switch (data->state) {
 633         case IDENTITY:
 634                 return eap_aka_build_identity(sm, data, id);
 635         case CHALLENGE:
 636                 return eap_aka_build_challenge(sm, data, id);
 637         case REAUTH:
 638                 return eap_aka_build_reauth(sm, data, id);
 639         case NOTIFICATION:
 640                 return eap_aka_build_notification(sm, data, id);
 641         default:
 642                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
 643                            "buildReq", data->state);
 644                 break;
 645         }
 646         return NULL;
 647 }
 648
 649
 650 static Boolean eap_aka_check(struct eap_sm *sm, void *priv,
 651                              struct wpabuf *respData)
 652 {
 653         struct eap_aka_data *data = priv;
 654         const u8 *pos;
 655         size_t len;
 656
 657         pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, respData,
 658                                &len);
 659         if (pos == NULL || len < 3) {
 660                 wpa_printf(MSG_INFO, "EAP-AKA: Invalid frame");
 661                 return TRUE;
 662         }
 663
 664         return FALSE;
 665 }
 666
 667
 668 static Boolean eap_aka_subtype_ok(struct eap_aka_data *data, u8 subtype)
 669 {
 670         if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR ||
 671             subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT)
 672                 return FALSE;
 673
 674         switch (data->state) {
 675         case IDENTITY:
 676                 if (subtype != EAP_AKA_SUBTYPE_IDENTITY) {
 677                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 678                                    "subtype %d", subtype);
 679                         return TRUE;
 680                 }
 681                 break;
 682         case CHALLENGE:
 683                 if (subtype != EAP_AKA_SUBTYPE_CHALLENGE &&
 684                     subtype != EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
 685                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 686                                    "subtype %d", subtype);
 687                         return TRUE;
 688                 }
 689                 break;
 690         case REAUTH:
 691                 if (subtype != EAP_AKA_SUBTYPE_REAUTHENTICATION) {
 692                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 693                                    "subtype %d", subtype);
 694                         return TRUE;
 695                 }
 696                 break;
 697         case NOTIFICATION:
 698                 if (subtype != EAP_AKA_SUBTYPE_NOTIFICATION) {
 699                         wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 700                                    "subtype %d", subtype);
 701                         return TRUE;
 702                 }
 703                 break;
 704         default:
 705                 wpa_printf(MSG_INFO, "EAP-AKA: Unexpected state (%d) for "
 706                            "processing a response", data->state);
 707                 return TRUE;
 708         }
 709
 710         return FALSE;
 711 }
 712
 713
 714 static void eap_aka_determine_identity(struct eap_sm *sm,
 715                                        struct eap_aka_data *data)
 716 {
 717         char *username;
 718
 719         wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity",
 720                           sm->identity, sm->identity_len);
 721
 722         username = sim_get_username(sm->identity, sm->identity_len);
 723         if (username == NULL) {
 724                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 725                 eap_aka_state(data, NOTIFICATION);
 726                 return;
 727         }
 728
 729         if (eap_aka_check_identity_reauth(sm, data, username) > 0) {
 730                 os_free(username);
 731                 return;
 732         }
 733
 734         if ((data->eap_method == EAP_TYPE_AKA_PRIME &&
 735              username[0] == EAP_AKA_PRIME_PSEUDONYM_PREFIX) ||
 736             (data->eap_method == EAP_TYPE_AKA &&
 737              username[0] == EAP_AKA_PSEUDONYM_PREFIX)) {
 738                 const char *permanent;
 739                 wpa_printf(MSG_DEBUG, "EAP-AKA: Pseudonym username '%s'",
 740                            username);
 741                 permanent = eap_sim_db_get_permanent(
 742                         sm->eap_sim_db_priv, username);
 743                 os_free(username);
 744                 if (permanent == NULL) {
 745                         wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown pseudonym "
 746                                    "identity - request permanent identity");
 747                         /* Remain in IDENTITY state for another round */
 748                         return;
 749                 }
 750                 os_strlcpy(data->permanent, permanent,
 751                            sizeof(data->permanent));
 752         } else if ((data->eap_method == EAP_TYPE_AKA_PRIME &&
 753                     username[0] == EAP_AKA_PRIME_PERMANENT_PREFIX) ||
 754                    (data->eap_method == EAP_TYPE_AKA &&
 755                     username[0] == EAP_AKA_PERMANENT_PREFIX)) {
 756                 wpa_printf(MSG_DEBUG, "EAP-AKA: Permanent username '%s'",
 757                            username);
 758                 os_strlcpy(data->permanent, username, sizeof(data->permanent));
 759                 os_free(username);
 760         } else {
 761                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized username '%s'",
 762                            username);
 763                 os_free(username);
 764                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 765                 eap_aka_state(data, NOTIFICATION);
 766                 return;
 767         }
 768
 769         eap_aka_fullauth(sm, data);
 770 }
 771
 772
 773 static void eap_aka_fullauth(struct eap_sm *sm, struct eap_aka_data *data)
 774 {
 775         size_t identity_len;
 776         int res;
 777
 778         res = eap_sim_db_get_aka_auth(sm->eap_sim_db_priv, data->permanent,
 779                                       data->rand, data->autn, data->ik,
 780                                       data->ck, data->res, &data->res_len, sm);
 781         if (res == EAP_SIM_DB_PENDING) {
 782                 wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
 783                            "not yet available - pending request");
 784                 sm->method_pending = METHOD_PENDING_WAIT;
 785                 return;
 786         }
 787
 788 #ifdef EAP_SERVER_AKA_PRIME
 789         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 790                 /* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
 791                  * needed 6-octet SQN ^AK for CK',IK' derivation */
 792                 eap_aka_prime_derive_ck_ik_prime(data->ck, data->ik,
 793                                                  data->autn,
 794                                                  data->network_name,
 795                                                  data->network_name_len);
 796         }
 797 #endif /* EAP_SERVER_AKA_PRIME */
 798
 799         data->reauth = NULL;
 800         data->counter = 0; /* reset re-auth counter since this is full auth */
 801
 802         if (res != 0) {
 803                 wpa_printf(MSG_INFO, "EAP-AKA: Failed to get AKA "
 804                            "authentication data for the peer");
 805                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 806                 eap_aka_state(data, NOTIFICATION);
 807                 return;
 808         }
 809         if (sm->method_pending == METHOD_PENDING_WAIT) {
 810                 wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
 811                            "available - abort pending wait");
 812                 sm->method_pending = METHOD_PENDING_NONE;
 813         }
 814
 815         identity_len = sm->identity_len;
 816         while (identity_len > 0 && sm->identity[identity_len - 1] == '\0') {
 817                 wpa_printf(MSG_DEBUG, "EAP-AKA: Workaround - drop last null "
 818                            "character from identity");
 819                 identity_len--;
 820         }
 821         wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity for MK derivation",
 822                           sm->identity, identity_len);
 823
 824         if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 825                 eap_aka_prime_derive_keys(sm->identity, identity_len, data->ik,
 826                                           data->ck, data->k_encr, data->k_aut,
 827                                           data->k_re, data->msk, data->emsk);
 828         } else {
 829                 eap_aka_derive_mk(sm->identity, identity_len, data->ik,
 830                                   data->ck, data->mk);
 831                 eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
 832                                     data->msk, data->emsk);
 833         }
 834
 835         eap_aka_state(data, CHALLENGE);
 836 }
 837
 838
 839 static void eap_aka_process_identity(struct eap_sm *sm,
 840                                      struct eap_aka_data *data,
 841                                      struct wpabuf *respData,
 842                                      struct eap_sim_attrs *attr)
 843 {
 844         u8 *new_identity;
 845
 846         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Identity");
 847
 848         if (attr->mac || attr->iv || attr->encr_data) {
 849                 wpa_printf(MSG_WARNING, "EAP-AKA: Unexpected attribute "
 850                            "received in EAP-Response/AKA-Identity");
 851                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 852                 eap_aka_state(data, NOTIFICATION);
 853                 return;
 854         }
 855
 856         /*
 857          * We always request identity with AKA/Identity, so the peer is
 858          * required to have replied with one.
 859          */
 860         if (!attr->identity || attr->identity_len == 0) {
 861                 wpa_printf(MSG_DEBUG, "EAP-AKA: Peer did not provide any "
 862                            "identity");
 863                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 864                 eap_aka_state(data, NOTIFICATION);
 865                 return;
 866         }
 867
 868         new_identity = os_malloc(attr->identity_len);
 869         if (new_identity == NULL) {
 870                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 871                 eap_aka_state(data, NOTIFICATION);
 872                 return;
 873         }
 874         os_free(sm->identity);
 875         sm->identity = new_identity;
 876         os_memcpy(sm->identity, attr->identity, attr->identity_len);
 877         sm->identity_len = attr->identity_len;
 878
 879         eap_aka_determine_identity(sm, data);
 880         if (eap_get_id(respData) == data->pending_id) {
 881                 data->pending_id = -1;
 882                 eap_aka_add_id_msg(data, respData);
 883         }
 884 }
 885
 886
 887 static int eap_aka_verify_mac(struct eap_aka_data *data,
 888                               const struct wpabuf *req,
 889                               const u8 *mac, const u8 *extra,
 890                               size_t extra_len)
 891 {
 892         if (data->eap_method == EAP_TYPE_AKA_PRIME)
 893                 return eap_sim_verify_mac_sha256(data->k_aut, req, mac, extra,
 894                                                  extra_len);
 895         return eap_sim_verify_mac(data->k_aut, req, mac, extra, extra_len);
 896 }
 897
 898
 899 static void eap_aka_process_challenge(struct eap_sm *sm,
 900                                       struct eap_aka_data *data,
 901                                       struct wpabuf *respData,
 902                                       struct eap_sim_attrs *attr)
 903 {
 904         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Challenge");
 905
 906 #ifdef EAP_SERVER_AKA_PRIME
 907 #if 0
 908         /* KDF negotiation; to be enabled only after more than one KDF is
 909          * supported */
 910         if (data->eap_method == EAP_TYPE_AKA_PRIME &&
 911             attr->kdf_count == 1 && attr->mac == NULL) {
 912                 if (attr->kdf[0] != EAP_AKA_PRIME_KDF) {
 913                         wpa_printf(MSG_WARNING, "EAP-AKA': Peer selected "
 914                                    "unknown KDF");
 915                         data->notification =
 916                                 EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 917                         eap_aka_state(data, NOTIFICATION);
 918                         return;
 919                 }
 920
 921                 data->kdf = attr->kdf[0];
 922
 923                 /* Allow negotiation to continue with the selected KDF by
 924                  * sending another Challenge message */
 925                 wpa_printf(MSG_DEBUG, "EAP-AKA': KDF %d selected", data->kdf);
 926                 return;
 927         }
 928 #endif
 929 #endif /* EAP_SERVER_AKA_PRIME */
 930
 931         if (attr->checkcode &&
 932             eap_aka_verify_checkcode(data, attr->checkcode,
 933                                      attr->checkcode_len)) {
 934                 wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
 935                            "message");
 936                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 937                 eap_aka_state(data, NOTIFICATION);
 938                 return;
 939         }
 940         if (attr->mac == NULL ||
 941             eap_aka_verify_mac(data, respData, attr->mac, NULL, 0)) {
 942                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
 943                            "did not include valid AT_MAC");
 944                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 945                 eap_aka_state(data, NOTIFICATION);
 946                 return;
 947         }
 948
 949         /*
 950          * AT_RES is padded, so verify that there is enough room for RES and
 951          * that the RES length in bits matches with the expected RES.
 952          */
 953         if (attr->res == NULL || attr->res_len < data->res_len ||
 954             attr->res_len_bits != data->res_len * 8 ||
 955             os_memcmp(attr->res, data->res, data->res_len) != 0) {
 956                 wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message did not "
 957                            "include valid AT_RES (attr len=%lu, res len=%lu "
 958                            "bits, expected %lu bits)",
 959                            (unsigned long) attr->res_len,
 960                            (unsigned long) attr->res_len_bits,
 961                            (unsigned long) data->res_len * 8);
 962                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 963                 eap_aka_state(data, NOTIFICATION);
 964                 return;
 965         }
 966
 967         wpa_printf(MSG_DEBUG, "EAP-AKA: Challenge response includes the "
 968                    "correct AT_MAC");
 969         if (sm->eap_sim_aka_result_ind && attr->result_ind) {
 970                 data->use_result_ind = 1;
 971                 data->notification = EAP_SIM_SUCCESS;
 972                 eap_aka_state(data, NOTIFICATION);
 973         } else
 974                 eap_aka_state(data, SUCCESS);
 975
 976         if (data->next_pseudonym) {
 977                 eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, data->permanent,
 978                                          data->next_pseudonym);
 979                 data->next_pseudonym = NULL;
 980         }
 981         if (data->next_reauth_id) {
 982                 if (data->eap_method == EAP_TYPE_AKA_PRIME) {
 983 #ifdef EAP_SERVER_AKA_PRIME
 984                         eap_sim_db_add_reauth_prime(sm->eap_sim_db_priv,
 985                                                     data->permanent,
 986                                                     data->next_reauth_id,
 987                                                     data->counter + 1,
 988                                                     data->k_encr, data->k_aut,
 989                                                     data->k_re);
 990 #endif /* EAP_SERVER_AKA_PRIME */
 991                 } else {
 992                         eap_sim_db_add_reauth(sm->eap_sim_db_priv,
 993                                               data->permanent,
 994                                               data->next_reauth_id,
 995                                               data->counter + 1,
 996                                               data->mk);
 997                 }
 998                 data->next_reauth_id = NULL;
 999         }
1000 }
1001
1002
1003 static void eap_aka_process_sync_failure(struct eap_sm *sm,
1004                                          struct eap_aka_data *data,
1005                                          struct wpabuf *respData,
1006                                          struct eap_sim_attrs *attr)
1007 {
1008         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Synchronization-Failure");
1009
1010         if (attr->auts == NULL) {
1011                 wpa_printf(MSG_WARNING, "EAP-AKA: Synchronization-Failure "
1012                            "message did not include valid AT_AUTS");
1013                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1014                 eap_aka_state(data, NOTIFICATION);
1015                 return;
1016         }
1017
1018         /* Avoid re-reporting AUTS when processing pending EAP packet by
1019          * maintaining a local flag stating whether this AUTS has already been
1020          * reported. */
1021         if (!data->auts_reported &&
1022             eap_sim_db_resynchronize(sm->eap_sim_db_priv, data->permanent,
1023                                      attr->auts, data->rand)) {
1024                 wpa_printf(MSG_WARNING, "EAP-AKA: Resynchronization failed");
1025                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1026                 eap_aka_state(data, NOTIFICATION);
1027                 return;
1028         }
1029         data->auts_reported = 1;
1030
1031         /* Remain in CHALLENGE state to re-try after resynchronization */
1032 }
1033
1034
1035 static void eap_aka_process_reauth(struct eap_sm *sm,
1036                                    struct eap_aka_data *data,
1037                                    struct wpabuf *respData,
1038                                    struct eap_sim_attrs *attr)
1039 {
1040         struct eap_sim_attrs eattr;
1041         u8 *decrypted = NULL;
1042
1043         wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Reauthentication");
1044
1045         if (attr->mac == NULL ||
1046             eap_aka_verify_mac(data, respData, attr->mac, data->nonce_s,
1047                                EAP_SIM_NONCE_S_LEN)) {
1048                 wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
1049                            "did not include valid AT_MAC");
1050                 goto fail;
1051         }
1052
1053         if (attr->encr_data == NULL || attr->iv == NULL) {
1054                 wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
1055                            "message did not include encrypted data");
1056                 goto fail;
1057         }
1058
1059         decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
1060                                        attr->encr_data_len, attr->iv, &eattr,
1061                                        0);
1062         if (decrypted == NULL) {
1063                 wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
1064                            "data from reauthentication message");
1065                 goto fail;
1066         }
1067
1068         if (eattr.counter != data->counter) {
1069                 wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
1070                            "used incorrect counter %u, expected %u",
1071                            eattr.counter, data->counter);
1072                 goto fail;
1073         }
1074         os_free(decrypted);
1075         decrypted = NULL;
1076
1077         wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response includes "
1078                    "the correct AT_MAC");
1079
1080         if (eattr.counter_too_small) {
1081                 wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response "
1082                            "included AT_COUNTER_TOO_SMALL - starting full "
1083                            "authentication");
1084                 eap_aka_fullauth(sm, data);
1085                 return;
1086         }
1087
1088         if (sm->eap_sim_aka_result_ind && attr->result_ind) {
1089                 data->use_result_ind = 1;
1090                 data->notification = EAP_SIM_SUCCESS;
1091                 eap_aka_state(data, NOTIFICATION);
1092         } else
1093                 eap_aka_state(data, SUCCESS);
1094
1095         if (data->next_reauth_id) {
1096                 if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1097 #ifdef EAP_SERVER_AKA_PRIME
1098                         eap_sim_db_add_reauth_prime(sm->eap_sim_db_priv,
1099                                                     data->permanent,
1100                                                     data->next_reauth_id,
1101                                                     data->counter + 1,
1102                                                     data->k_encr, data->k_aut,
1103                                                     data->k_re);
1104 #endif /* EAP_SERVER_AKA_PRIME */
1105                 } else {
1106                         eap_sim_db_add_reauth(sm->eap_sim_db_priv,
1107                                               data->permanent,
1108                                               data->next_reauth_id,
1109                                               data->counter + 1,
1110                                               data->mk);
1111                 }
1112                 data->next_reauth_id = NULL;
1113         } else {
1114                 eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
1115                 data->reauth = NULL;
1116         }
1117
1118         return;
1119
1120 fail:
1121         data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1122         eap_aka_state(data, NOTIFICATION);
1123         eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
1124         data->reauth = NULL;
1125         os_free(decrypted);
1126 }
1127
1128
1129 static void eap_aka_process_client_error(struct eap_sm *sm,
1130                                          struct eap_aka_data *data,
1131                                          struct wpabuf *respData,
1132                                          struct eap_sim_attrs *attr)
1133 {
1134         wpa_printf(MSG_DEBUG, "EAP-AKA: Client reported error %d",
1135                    attr->client_error_code);
1136         if (data->notification == EAP_SIM_SUCCESS && data->use_result_ind)
1137                 eap_aka_state(data, SUCCESS);
1138         else
1139                 eap_aka_state(data, FAILURE);
1140 }
1141
1142
1143 static void eap_aka_process_authentication_reject(
1144         struct eap_sm *sm, struct eap_aka_data *data,
1145         struct wpabuf *respData, struct eap_sim_attrs *attr)
1146 {
1147         wpa_printf(MSG_DEBUG, "EAP-AKA: Client rejected authentication");
1148         eap_aka_state(data, FAILURE);
1149 }
1150
1151
1152 static void eap_aka_process_notification(struct eap_sm *sm,
1153                                          struct eap_aka_data *data,
1154                                          struct wpabuf *respData,
1155                                          struct eap_sim_attrs *attr)
1156 {
1157         wpa_printf(MSG_DEBUG, "EAP-AKA: Client replied to notification");
1158         if (data->notification == EAP_SIM_SUCCESS && data->use_result_ind)
1159                 eap_aka_state(data, SUCCESS);
1160         else
1161                 eap_aka_state(data, FAILURE);
1162 }
1163
1164
1165 static void eap_aka_process(struct eap_sm *sm, void *priv,
1166                             struct wpabuf *respData)
1167 {
1168         struct eap_aka_data *data = priv;
1169         const u8 *pos, *end;
1170         u8 subtype;
1171         size_t len;
1172         struct eap_sim_attrs attr;
1173
1174         pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, respData,
1175                                &len);
1176         if (pos == NULL || len < 3)
1177                 return;
1178
1179         end = pos + len;
1180         subtype = *pos;
1181         pos += 3;
1182
1183         if (eap_aka_subtype_ok(data, subtype)) {
1184                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized or unexpected "
1185                            "EAP-AKA Subtype in EAP Response");
1186                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1187                 eap_aka_state(data, NOTIFICATION);
1188                 return;
1189         }
1190
1191         if (eap_sim_parse_attr(pos, end, &attr,
1192                                data->eap_method == EAP_TYPE_AKA_PRIME ? 2 : 1,
1193                                0)) {
1194                 wpa_printf(MSG_DEBUG, "EAP-AKA: Failed to parse attributes");
1195                 data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1196                 eap_aka_state(data, NOTIFICATION);
1197                 return;
1198         }
1199
1200         if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR) {
1201                 eap_aka_process_client_error(sm, data, respData, &attr);
1202                 return;
1203         }
1204
1205         if (subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT) {
1206                 eap_aka_process_authentication_reject(sm, data, respData,
1207                                                       &attr);
1208                 return;
1209         }
1210
1211         switch (data->state) {
1212         case IDENTITY:
1213                 eap_aka_process_identity(sm, data, respData, &attr);
1214                 break;
1215         case CHALLENGE:
1216                 if (subtype == EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
1217                         eap_aka_process_sync_failure(sm, data, respData,
1218                                                      &attr);
1219                 } else {
1220                         eap_aka_process_challenge(sm, data, respData, &attr);
1221                 }
1222                 break;
1223         case REAUTH:
1224                 eap_aka_process_reauth(sm, data, respData, &attr);
1225                 break;
1226         case NOTIFICATION:
1227                 eap_aka_process_notification(sm, data, respData, &attr);
1228                 break;
1229         default:
1230                 wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
1231                            "process", data->state);
1232                 break;
1233         }
1234 }
1235
1236
1237 static Boolean eap_aka_isDone(struct eap_sm *sm, void *priv)
1238 {
1239         struct eap_aka_data *data = priv;
1240         return data->state == SUCCESS || data->state == FAILURE;
1241 }
1242
1243
1244 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1245 {
1246         struct eap_aka_data *data = priv;
1247         u8 *key;
1248
1249         if (data->state != SUCCESS)
1250                 return NULL;
1251
1252         key = os_malloc(EAP_SIM_KEYING_DATA_LEN);
1253         if (key == NULL)
1254                 return NULL;
1255         os_memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
1256         *len = EAP_SIM_KEYING_DATA_LEN;
1257         return key;
1258 }
1259
1260
1261 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1262 {
1263         struct eap_aka_data *data = priv;
1264         u8 *key;
1265
1266         if (data->state != SUCCESS)
1267                 return NULL;
1268
1269         key = os_malloc(EAP_EMSK_LEN);
1270         if (key == NULL)
1271                 return NULL;
1272         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
1273         *len = EAP_EMSK_LEN;
1274         return key;
1275 }
1276
1277
1278 static Boolean eap_aka_isSuccess(struct eap_sm *sm, void *priv)
1279 {
1280         struct eap_aka_data *data = priv;
1281         return data->state == SUCCESS;
1282 }
1283
1284
1285 int eap_server_aka_register(void)
1286 {
1287         struct eap_method *eap;
1288         int ret;
1289
1290         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1291                                       EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1292         if (eap == NULL)
1293                 return -1;
1294
1295         eap->init = eap_aka_init;
1296         eap->reset = eap_aka_reset;
1297         eap->buildReq = eap_aka_buildReq;
1298         eap->check = eap_aka_check;
1299         eap->process = eap_aka_process;
1300         eap->isDone = eap_aka_isDone;
1301         eap->getKey = eap_aka_getKey;
1302         eap->isSuccess = eap_aka_isSuccess;
1303         eap->get_emsk = eap_aka_get_emsk;
1304
1305         ret = eap_server_method_register(eap);
1306         if (ret)
1307                 eap_server_method_free(eap);
1308         return ret;
1309 }
1310
1311
1312 #ifdef EAP_SERVER_AKA_PRIME
1313 int eap_server_aka_prime_register(void)
1314 {
1315         struct eap_method *eap;
1316         int ret;
1317
1318         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1319                                       EAP_VENDOR_IETF, EAP_TYPE_AKA_PRIME,
1320                                       "AKA'");
1321         if (eap == NULL)
1322                 return -1;
1323
1324         eap->init = eap_aka_prime_init;
1325         eap->reset = eap_aka_reset;
1326         eap->buildReq = eap_aka_buildReq;
1327         eap->check = eap_aka_check;
1328         eap->process = eap_aka_process;
1329         eap->isDone = eap_aka_isDone;
1330         eap->getKey = eap_aka_getKey;
1331         eap->isSuccess = eap_aka_isSuccess;
1332         eap->get_emsk = eap_aka_get_emsk;
1333
1334         ret = eap_server_method_register(eap);
1335         if (ret)
1336                 eap_server_method_free(eap);
1337
1338         return ret;
1339 }
1340 #endif /* EAP_SERVER_AKA_PRIME */