xref: /freebsd/contrib/wpa/src/eap_server/eap_server_aka.c (revision 10b9d77bf1ccf2f3affafa6261692cb92cf7e992)
1 /*
2  * hostapd / EAP-AKA (RFC 4187) and EAP-AKA' (draft-arkko-eap-aka-kdf)
3  * Copyright (c) 2005-2008, Jouni Malinen <j@w1.fi>
4  *
5  * This program is free software; you can redistribute it and/or modify
6  * it under the terms of the GNU General Public License version 2 as
7  * published by the Free Software Foundation.
8  *
9  * Alternatively, this software may be distributed under the terms of BSD
10  * license.
11  *
12  * See README and COPYING for more details.
13  */
14 
15 #include "includes.h"
16 
17 #include "common.h"
18 #include "crypto/sha256.h"
19 #include "crypto/crypto.h"
20 #include "eap_common/eap_sim_common.h"
21 #include "eap_server/eap_i.h"
22 #include "eap_server/eap_sim_db.h"
23 
24 
25 struct eap_aka_data {
26 	u8 mk[EAP_SIM_MK_LEN];
27 	u8 nonce_s[EAP_SIM_NONCE_S_LEN];
28 	u8 k_aut[EAP_AKA_PRIME_K_AUT_LEN];
29 	u8 k_encr[EAP_SIM_K_ENCR_LEN];
30 	u8 k_re[EAP_AKA_PRIME_K_RE_LEN]; /* EAP-AKA' only */
31 	u8 msk[EAP_SIM_KEYING_DATA_LEN];
32 	u8 emsk[EAP_EMSK_LEN];
33 	u8 rand[EAP_AKA_RAND_LEN];
34 	u8 autn[EAP_AKA_AUTN_LEN];
35 	u8 ck[EAP_AKA_CK_LEN];
36 	u8 ik[EAP_AKA_IK_LEN];
37 	u8 res[EAP_AKA_RES_MAX_LEN];
38 	size_t res_len;
39 	enum {
40 		IDENTITY, CHALLENGE, REAUTH, NOTIFICATION, SUCCESS, FAILURE
41 	} state;
42 	char *next_pseudonym;
43 	char *next_reauth_id;
44 	u16 counter;
45 	struct eap_sim_reauth *reauth;
46 	int auts_reported; /* whether the current AUTS has been reported to the
47 			    * eap_sim_db */
48 	u16 notification;
49 	int use_result_ind;
50 
51 	struct wpabuf *id_msgs;
52 	int pending_id;
53 	u8 eap_method;
54 	u8 *network_name;
55 	size_t network_name_len;
56 	u16 kdf;
57 };
58 
59 
60 static void eap_aka_determine_identity(struct eap_sm *sm,
61 				       struct eap_aka_data *data,
62 				       int before_identity, int after_reauth);
63 
64 
65 static const char * eap_aka_state_txt(int state)
66 {
67 	switch (state) {
68 	case IDENTITY:
69 		return "IDENTITY";
70 	case CHALLENGE:
71 		return "CHALLENGE";
72 	case REAUTH:
73 		return "REAUTH";
74 	case SUCCESS:
75 		return "SUCCESS";
76 	case FAILURE:
77 		return "FAILURE";
78 	case NOTIFICATION:
79 		return "NOTIFICATION";
80 	default:
81 		return "Unknown?!";
82 	}
83 }
84 
85 
86 static void eap_aka_state(struct eap_aka_data *data, int state)
87 {
88 	wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
89 		   eap_aka_state_txt(data->state),
90 		   eap_aka_state_txt(state));
91 	data->state = state;
92 }
93 
94 
95 static void * eap_aka_init(struct eap_sm *sm)
96 {
97 	struct eap_aka_data *data;
98 
99 	if (sm->eap_sim_db_priv == NULL) {
100 		wpa_printf(MSG_WARNING, "EAP-AKA: eap_sim_db not configured");
101 		return NULL;
102 	}
103 
104 	data = os_zalloc(sizeof(*data));
105 	if (data == NULL)
106 		return NULL;
107 
108 	data->eap_method = EAP_TYPE_AKA;
109 
110 	data->state = IDENTITY;
111 	eap_aka_determine_identity(sm, data, 1, 0);
112 	data->pending_id = -1;
113 
114 	return data;
115 }
116 
117 
118 #ifdef EAP_SERVER_AKA_PRIME
119 static void * eap_aka_prime_init(struct eap_sm *sm)
120 {
121 	struct eap_aka_data *data;
122 	/* TODO: make ANID configurable; see 3GPP TS 24.302 */
123 	char *network_name = "WLAN";
124 
125 	if (sm->eap_sim_db_priv == NULL) {
126 		wpa_printf(MSG_WARNING, "EAP-AKA: eap_sim_db not configured");
127 		return NULL;
128 	}
129 
130 	data = os_zalloc(sizeof(*data));
131 	if (data == NULL)
132 		return NULL;
133 
134 	data->eap_method = EAP_TYPE_AKA_PRIME;
135 	data->network_name = os_malloc(os_strlen(network_name));
136 	if (data->network_name == NULL) {
137 		os_free(data);
138 		return NULL;
139 	}
140 
141 	data->network_name_len = os_strlen(network_name);
142 	os_memcpy(data->network_name, network_name, data->network_name_len);
143 
144 	data->state = IDENTITY;
145 	eap_aka_determine_identity(sm, data, 1, 0);
146 	data->pending_id = -1;
147 
148 	return data;
149 }
150 #endif /* EAP_SERVER_AKA_PRIME */
151 
152 
153 static void eap_aka_reset(struct eap_sm *sm, void *priv)
154 {
155 	struct eap_aka_data *data = priv;
156 	os_free(data->next_pseudonym);
157 	os_free(data->next_reauth_id);
158 	wpabuf_free(data->id_msgs);
159 	os_free(data->network_name);
160 	os_free(data);
161 }
162 
163 
164 static int eap_aka_add_id_msg(struct eap_aka_data *data,
165 			      const struct wpabuf *msg)
166 {
167 	if (msg == NULL)
168 		return -1;
169 
170 	if (data->id_msgs == NULL) {
171 		data->id_msgs = wpabuf_dup(msg);
172 		return data->id_msgs == NULL ? -1 : 0;
173 	}
174 
175 	if (wpabuf_resize(&data->id_msgs, wpabuf_len(msg)) < 0)
176 		return -1;
177 	wpabuf_put_buf(data->id_msgs, msg);
178 
179 	return 0;
180 }
181 
182 
183 static void eap_aka_add_checkcode(struct eap_aka_data *data,
184 				  struct eap_sim_msg *msg)
185 {
186 	const u8 *addr;
187 	size_t len;
188 	u8 hash[SHA256_MAC_LEN];
189 
190 	wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
191 
192 	if (data->id_msgs == NULL) {
193 		/*
194 		 * No EAP-AKA/Identity packets were exchanged - send empty
195 		 * checkcode.
196 		 */
197 		eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
198 		return;
199 	}
200 
201 	/* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
202 	addr = wpabuf_head(data->id_msgs);
203 	len = wpabuf_len(data->id_msgs);
204 	wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
205 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
206 		sha256_vector(1, &addr, &len, hash);
207 	else
208 		sha1_vector(1, &addr, &len, hash);
209 
210 	eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
211 			data->eap_method == EAP_TYPE_AKA_PRIME ?
212 			EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN);
213 }
214 
215 
216 static int eap_aka_verify_checkcode(struct eap_aka_data *data,
217 				    const u8 *checkcode, size_t checkcode_len)
218 {
219 	const u8 *addr;
220 	size_t len;
221 	u8 hash[SHA256_MAC_LEN];
222 	size_t hash_len;
223 
224 	if (checkcode == NULL)
225 		return -1;
226 
227 	if (data->id_msgs == NULL) {
228 		if (checkcode_len != 0) {
229 			wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from peer "
230 				   "indicates that AKA/Identity messages were "
231 				   "used, but they were not");
232 			return -1;
233 		}
234 		return 0;
235 	}
236 
237 	hash_len = data->eap_method == EAP_TYPE_AKA_PRIME ?
238 		EAP_AKA_PRIME_CHECKCODE_LEN : EAP_AKA_CHECKCODE_LEN;
239 
240 	if (checkcode_len != hash_len) {
241 		wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from peer indicates "
242 			   "that AKA/Identity message were not used, but they "
243 			   "were");
244 		return -1;
245 	}
246 
247 	/* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
248 	addr = wpabuf_head(data->id_msgs);
249 	len = wpabuf_len(data->id_msgs);
250 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
251 		sha256_vector(1, &addr, &len, hash);
252 	else
253 		sha1_vector(1, &addr, &len, hash);
254 
255 	if (os_memcmp(hash, checkcode, hash_len) != 0) {
256 		wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
257 		return -1;
258 	}
259 
260 	return 0;
261 }
262 
263 
264 static struct wpabuf * eap_aka_build_identity(struct eap_sm *sm,
265 					      struct eap_aka_data *data, u8 id)
266 {
267 	struct eap_sim_msg *msg;
268 	struct wpabuf *buf;
269 
270 	wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Identity");
271 	msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
272 			       EAP_AKA_SUBTYPE_IDENTITY);
273 	if (eap_sim_db_identity_known(sm->eap_sim_db_priv, sm->identity,
274 				      sm->identity_len)) {
275 		wpa_printf(MSG_DEBUG, "   AT_PERMANENT_ID_REQ");
276 		eap_sim_msg_add(msg, EAP_SIM_AT_PERMANENT_ID_REQ, 0, NULL, 0);
277 	} else {
278 		/*
279 		 * RFC 4187, Chap. 4.1.4 recommends that identity from EAP is
280 		 * ignored and the AKA/Identity is used to request the
281 		 * identity.
282 		 */
283 		wpa_printf(MSG_DEBUG, "   AT_ANY_ID_REQ");
284 		eap_sim_msg_add(msg, EAP_SIM_AT_ANY_ID_REQ, 0, NULL, 0);
285 	}
286 	buf = eap_sim_msg_finish(msg, NULL, NULL, 0);
287 	if (eap_aka_add_id_msg(data, buf) < 0) {
288 		wpabuf_free(buf);
289 		return NULL;
290 	}
291 	data->pending_id = id;
292 	return buf;
293 }
294 
295 
296 static int eap_aka_build_encr(struct eap_sm *sm, struct eap_aka_data *data,
297 			      struct eap_sim_msg *msg, u16 counter,
298 			      const u8 *nonce_s)
299 {
300 	os_free(data->next_pseudonym);
301 	data->next_pseudonym =
302 		eap_sim_db_get_next_pseudonym(sm->eap_sim_db_priv, 1);
303 	os_free(data->next_reauth_id);
304 	if (data->counter <= EAP_AKA_MAX_FAST_REAUTHS) {
305 		data->next_reauth_id =
306 			eap_sim_db_get_next_reauth_id(sm->eap_sim_db_priv, 1);
307 	} else {
308 		wpa_printf(MSG_DEBUG, "EAP-AKA: Max fast re-authentication "
309 			   "count exceeded - force full authentication");
310 		data->next_reauth_id = NULL;
311 	}
312 
313 	if (data->next_pseudonym == NULL && data->next_reauth_id == NULL &&
314 	    counter == 0 && nonce_s == NULL)
315 		return 0;
316 
317 	wpa_printf(MSG_DEBUG, "   AT_IV");
318 	wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
319 	eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
320 
321 	if (counter > 0) {
322 		wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)", counter);
323 		eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
324 	}
325 
326 	if (nonce_s) {
327 		wpa_printf(MSG_DEBUG, "   *AT_NONCE_S");
328 		eap_sim_msg_add(msg, EAP_SIM_AT_NONCE_S, 0, nonce_s,
329 				EAP_SIM_NONCE_S_LEN);
330 	}
331 
332 	if (data->next_pseudonym) {
333 		wpa_printf(MSG_DEBUG, "   *AT_NEXT_PSEUDONYM (%s)",
334 			   data->next_pseudonym);
335 		eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_PSEUDONYM,
336 				os_strlen(data->next_pseudonym),
337 				(u8 *) data->next_pseudonym,
338 				os_strlen(data->next_pseudonym));
339 	}
340 
341 	if (data->next_reauth_id) {
342 		wpa_printf(MSG_DEBUG, "   *AT_NEXT_REAUTH_ID (%s)",
343 			   data->next_reauth_id);
344 		eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_REAUTH_ID,
345 				os_strlen(data->next_reauth_id),
346 				(u8 *) data->next_reauth_id,
347 				os_strlen(data->next_reauth_id));
348 	}
349 
350 	if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
351 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
352 			   "AT_ENCR_DATA");
353 		return -1;
354 	}
355 
356 	return 0;
357 }
358 
359 
360 static struct wpabuf * eap_aka_build_challenge(struct eap_sm *sm,
361 					       struct eap_aka_data *data,
362 					       u8 id)
363 {
364 	struct eap_sim_msg *msg;
365 
366 	wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Challenge");
367 	msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
368 			       EAP_AKA_SUBTYPE_CHALLENGE);
369 	wpa_printf(MSG_DEBUG, "   AT_RAND");
370 	eap_sim_msg_add(msg, EAP_SIM_AT_RAND, 0, data->rand, EAP_AKA_RAND_LEN);
371 	wpa_printf(MSG_DEBUG, "   AT_AUTN");
372 	eap_sim_msg_add(msg, EAP_SIM_AT_AUTN, 0, data->autn, EAP_AKA_AUTN_LEN);
373 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
374 		if (data->kdf) {
375 			/* Add the selected KDF into the beginning */
376 			wpa_printf(MSG_DEBUG, "   AT_KDF");
377 			eap_sim_msg_add(msg, EAP_SIM_AT_KDF, data->kdf,
378 					NULL, 0);
379 		}
380 		wpa_printf(MSG_DEBUG, "   AT_KDF");
381 		eap_sim_msg_add(msg, EAP_SIM_AT_KDF, EAP_AKA_PRIME_KDF,
382 				NULL, 0);
383 		wpa_printf(MSG_DEBUG, "   AT_KDF_INPUT");
384 		eap_sim_msg_add(msg, EAP_SIM_AT_KDF_INPUT,
385 				data->network_name_len,
386 				data->network_name, data->network_name_len);
387 	}
388 
389 	if (eap_aka_build_encr(sm, data, msg, 0, NULL)) {
390 		eap_sim_msg_free(msg);
391 		return NULL;
392 	}
393 
394 	eap_aka_add_checkcode(data, msg);
395 
396 	if (sm->eap_sim_aka_result_ind) {
397 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
398 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
399 	}
400 
401 #ifdef EAP_SERVER_AKA_PRIME
402 	if (data->eap_method == EAP_TYPE_AKA) {
403 		u16 flags = 0;
404 		int i;
405 		int aka_prime_preferred = 0;
406 
407 		i = 0;
408 		while (sm->user && i < EAP_MAX_METHODS &&
409 		       (sm->user->methods[i].vendor != EAP_VENDOR_IETF ||
410 			sm->user->methods[i].method != EAP_TYPE_NONE)) {
411 			if (sm->user->methods[i].vendor == EAP_VENDOR_IETF) {
412 				if (sm->user->methods[i].method ==
413 				    EAP_TYPE_AKA)
414 					break;
415 				if (sm->user->methods[i].method ==
416 				    EAP_TYPE_AKA_PRIME) {
417 					aka_prime_preferred = 1;
418 					break;
419 				}
420 			}
421 			i++;
422 		}
423 
424 		if (aka_prime_preferred)
425 			flags |= EAP_AKA_BIDDING_FLAG_D;
426 		eap_sim_msg_add(msg, EAP_SIM_AT_BIDDING, flags, NULL, 0);
427 	}
428 #endif /* EAP_SERVER_AKA_PRIME */
429 
430 	wpa_printf(MSG_DEBUG, "   AT_MAC");
431 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
432 	return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
433 }
434 
435 
436 static struct wpabuf * eap_aka_build_reauth(struct eap_sm *sm,
437 					    struct eap_aka_data *data, u8 id)
438 {
439 	struct eap_sim_msg *msg;
440 
441 	wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Re-authentication");
442 
443 	if (os_get_random(data->nonce_s, EAP_SIM_NONCE_S_LEN))
444 		return NULL;
445 	wpa_hexdump_key(MSG_MSGDUMP, "EAP-AKA: NONCE_S",
446 			data->nonce_s, EAP_SIM_NONCE_S_LEN);
447 
448 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
449 		eap_aka_prime_derive_keys_reauth(data->k_re, data->counter,
450 						 sm->identity,
451 						 sm->identity_len,
452 						 data->nonce_s,
453 						 data->msk, data->emsk);
454 	} else {
455 		eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
456 				    data->msk, data->emsk);
457 		eap_sim_derive_keys_reauth(data->counter, sm->identity,
458 					   sm->identity_len, data->nonce_s,
459 					   data->mk, data->msk, data->emsk);
460 	}
461 
462 	msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
463 			       EAP_AKA_SUBTYPE_REAUTHENTICATION);
464 
465 	if (eap_aka_build_encr(sm, data, msg, data->counter, data->nonce_s)) {
466 		eap_sim_msg_free(msg);
467 		return NULL;
468 	}
469 
470 	eap_aka_add_checkcode(data, msg);
471 
472 	if (sm->eap_sim_aka_result_ind) {
473 		wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
474 		eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
475 	}
476 
477 	wpa_printf(MSG_DEBUG, "   AT_MAC");
478 	eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
479 	return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
480 }
481 
482 
483 static struct wpabuf * eap_aka_build_notification(struct eap_sm *sm,
484 						  struct eap_aka_data *data,
485 						  u8 id)
486 {
487 	struct eap_sim_msg *msg;
488 
489 	wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Notification");
490 	msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, data->eap_method,
491 			       EAP_AKA_SUBTYPE_NOTIFICATION);
492 	wpa_printf(MSG_DEBUG, "   AT_NOTIFICATION (%d)", data->notification);
493 	eap_sim_msg_add(msg, EAP_SIM_AT_NOTIFICATION, data->notification,
494 			NULL, 0);
495 	if (data->use_result_ind) {
496 		if (data->reauth) {
497 			wpa_printf(MSG_DEBUG, "   AT_IV");
498 			wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
499 			eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
500 						   EAP_SIM_AT_ENCR_DATA);
501 			wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)",
502 				   data->counter);
503 			eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
504 					NULL, 0);
505 
506 			if (eap_sim_msg_add_encr_end(msg, data->k_encr,
507 						     EAP_SIM_AT_PADDING)) {
508 				wpa_printf(MSG_WARNING, "EAP-AKA: Failed to "
509 					   "encrypt AT_ENCR_DATA");
510 				eap_sim_msg_free(msg);
511 				return NULL;
512 			}
513 		}
514 
515 		wpa_printf(MSG_DEBUG, "   AT_MAC");
516 		eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
517 	}
518 	return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
519 }
520 
521 
522 static struct wpabuf * eap_aka_buildReq(struct eap_sm *sm, void *priv, u8 id)
523 {
524 	struct eap_aka_data *data = priv;
525 
526 	data->auts_reported = 0;
527 	switch (data->state) {
528 	case IDENTITY:
529 		return eap_aka_build_identity(sm, data, id);
530 	case CHALLENGE:
531 		return eap_aka_build_challenge(sm, data, id);
532 	case REAUTH:
533 		return eap_aka_build_reauth(sm, data, id);
534 	case NOTIFICATION:
535 		return eap_aka_build_notification(sm, data, id);
536 	default:
537 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
538 			   "buildReq", data->state);
539 		break;
540 	}
541 	return NULL;
542 }
543 
544 
545 static Boolean eap_aka_check(struct eap_sm *sm, void *priv,
546 			     struct wpabuf *respData)
547 {
548 	struct eap_aka_data *data = priv;
549 	const u8 *pos;
550 	size_t len;
551 
552 	pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, respData,
553 			       &len);
554 	if (pos == NULL || len < 3) {
555 		wpa_printf(MSG_INFO, "EAP-AKA: Invalid frame");
556 		return TRUE;
557 	}
558 
559 	return FALSE;
560 }
561 
562 
563 static Boolean eap_aka_subtype_ok(struct eap_aka_data *data, u8 subtype)
564 {
565 	if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR ||
566 	    subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT)
567 		return FALSE;
568 
569 	switch (data->state) {
570 	case IDENTITY:
571 		if (subtype != EAP_AKA_SUBTYPE_IDENTITY) {
572 			wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
573 				   "subtype %d", subtype);
574 			return TRUE;
575 		}
576 		break;
577 	case CHALLENGE:
578 		if (subtype != EAP_AKA_SUBTYPE_CHALLENGE &&
579 		    subtype != EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
580 			wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
581 				   "subtype %d", subtype);
582 			return TRUE;
583 		}
584 		break;
585 	case REAUTH:
586 		if (subtype != EAP_AKA_SUBTYPE_REAUTHENTICATION) {
587 			wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
588 				   "subtype %d", subtype);
589 			return TRUE;
590 		}
591 		break;
592 	case NOTIFICATION:
593 		if (subtype != EAP_AKA_SUBTYPE_NOTIFICATION) {
594 			wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
595 				   "subtype %d", subtype);
596 			return TRUE;
597 		}
598 		break;
599 	default:
600 		wpa_printf(MSG_INFO, "EAP-AKA: Unexpected state (%d) for "
601 			   "processing a response", data->state);
602 		return TRUE;
603 	}
604 
605 	return FALSE;
606 }
607 
608 
609 static void eap_aka_determine_identity(struct eap_sm *sm,
610 				       struct eap_aka_data *data,
611 				       int before_identity, int after_reauth)
612 {
613 	const u8 *identity;
614 	size_t identity_len;
615 	int res;
616 
617 	identity = NULL;
618 	identity_len = 0;
619 
620 	if (after_reauth && data->reauth) {
621 		identity = data->reauth->identity;
622 		identity_len = data->reauth->identity_len;
623 	} else if (sm->identity && sm->identity_len > 0 &&
624 		   sm->identity[0] == EAP_AKA_PERMANENT_PREFIX) {
625 		identity = sm->identity;
626 		identity_len = sm->identity_len;
627 	} else {
628 		identity = eap_sim_db_get_permanent(sm->eap_sim_db_priv,
629 						    sm->identity,
630 						    sm->identity_len,
631 						    &identity_len);
632 		if (identity == NULL) {
633 			data->reauth = eap_sim_db_get_reauth_entry(
634 				sm->eap_sim_db_priv, sm->identity,
635 				sm->identity_len);
636 			if (data->reauth &&
637 			    data->reauth->aka_prime !=
638 			    (data->eap_method == EAP_TYPE_AKA_PRIME)) {
639 				wpa_printf(MSG_DEBUG, "EAP-AKA: Reauth data "
640 					   "was for different AKA version");
641 				data->reauth = NULL;
642 			}
643 			if (data->reauth) {
644 				wpa_printf(MSG_DEBUG, "EAP-AKA: Using fast "
645 					   "re-authentication");
646 				identity = data->reauth->identity;
647 				identity_len = data->reauth->identity_len;
648 				data->counter = data->reauth->counter;
649 				if (data->eap_method == EAP_TYPE_AKA_PRIME) {
650 					os_memcpy(data->k_encr,
651 						  data->reauth->k_encr,
652 						  EAP_SIM_K_ENCR_LEN);
653 					os_memcpy(data->k_aut,
654 						  data->reauth->k_aut,
655 						  EAP_AKA_PRIME_K_AUT_LEN);
656 					os_memcpy(data->k_re,
657 						  data->reauth->k_re,
658 						  EAP_AKA_PRIME_K_RE_LEN);
659 				} else {
660 					os_memcpy(data->mk, data->reauth->mk,
661 						  EAP_SIM_MK_LEN);
662 				}
663 			}
664 		}
665 	}
666 
667 	if (identity == NULL ||
668 	    eap_sim_db_identity_known(sm->eap_sim_db_priv, sm->identity,
669 				      sm->identity_len) < 0) {
670 		if (before_identity) {
671 			wpa_printf(MSG_DEBUG, "EAP-AKA: Permanent user name "
672 				   "not known - send AKA-Identity request");
673 			eap_aka_state(data, IDENTITY);
674 			return;
675 		} else {
676 			wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown whether the "
677 				   "permanent user name is known; try to use "
678 				   "it");
679 			/* eap_sim_db_get_aka_auth() will report failure, if
680 			 * this identity is not known. */
681 		}
682 	}
683 
684 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity",
685 			  identity, identity_len);
686 
687 	if (!after_reauth && data->reauth) {
688 		eap_aka_state(data, REAUTH);
689 		return;
690 	}
691 
692 	res = eap_sim_db_get_aka_auth(sm->eap_sim_db_priv, identity,
693 				      identity_len, data->rand, data->autn,
694 				      data->ik, data->ck, data->res,
695 				      &data->res_len, sm);
696 	if (res == EAP_SIM_DB_PENDING) {
697 		wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
698 			   "not yet available - pending request");
699 		sm->method_pending = METHOD_PENDING_WAIT;
700 		return;
701 	}
702 
703 #ifdef EAP_SERVER_AKA_PRIME
704 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
705 		/* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
706 		 * needed 6-octet SQN ^AK for CK',IK' derivation */
707 		eap_aka_prime_derive_ck_ik_prime(data->ck, data->ik,
708 						 data->autn,
709 						 data->network_name,
710 						 data->network_name_len);
711 	}
712 #endif /* EAP_SERVER_AKA_PRIME */
713 
714 	data->reauth = NULL;
715 	data->counter = 0; /* reset re-auth counter since this is full auth */
716 
717 	if (res != 0) {
718 		wpa_printf(MSG_INFO, "EAP-AKA: Failed to get AKA "
719 			   "authentication data for the peer");
720 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
721 		eap_aka_state(data, NOTIFICATION);
722 		return;
723 	}
724 	if (sm->method_pending == METHOD_PENDING_WAIT) {
725 		wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
726 			   "available - abort pending wait");
727 		sm->method_pending = METHOD_PENDING_NONE;
728 	}
729 
730 	identity_len = sm->identity_len;
731 	while (identity_len > 0 && sm->identity[identity_len - 1] == '\0') {
732 		wpa_printf(MSG_DEBUG, "EAP-AKA: Workaround - drop last null "
733 			   "character from identity");
734 		identity_len--;
735 	}
736 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity for MK derivation",
737 			  sm->identity, identity_len);
738 
739 	if (data->eap_method == EAP_TYPE_AKA_PRIME) {
740 		eap_aka_prime_derive_keys(identity, identity_len, data->ik,
741 					  data->ck, data->k_encr, data->k_aut,
742 					  data->k_re, data->msk, data->emsk);
743 	} else {
744 		eap_aka_derive_mk(sm->identity, identity_len, data->ik,
745 				  data->ck, data->mk);
746 		eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut,
747 				    data->msk, data->emsk);
748 	}
749 
750 	eap_aka_state(data, CHALLENGE);
751 }
752 
753 
754 static void eap_aka_process_identity(struct eap_sm *sm,
755 				     struct eap_aka_data *data,
756 				     struct wpabuf *respData,
757 				     struct eap_sim_attrs *attr)
758 {
759 	wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Identity");
760 
761 	if (attr->mac || attr->iv || attr->encr_data) {
762 		wpa_printf(MSG_WARNING, "EAP-AKA: Unexpected attribute "
763 			   "received in EAP-Response/AKA-Identity");
764 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
765 		eap_aka_state(data, NOTIFICATION);
766 		return;
767 	}
768 
769 	if (attr->identity) {
770 		os_free(sm->identity);
771 		sm->identity = os_malloc(attr->identity_len);
772 		if (sm->identity) {
773 			os_memcpy(sm->identity, attr->identity,
774 				  attr->identity_len);
775 			sm->identity_len = attr->identity_len;
776 		}
777 	}
778 
779 	eap_aka_determine_identity(sm, data, 0, 0);
780 	if (eap_get_id(respData) == data->pending_id) {
781 		data->pending_id = -1;
782 		eap_aka_add_id_msg(data, respData);
783 	}
784 }
785 
786 
787 static int eap_aka_verify_mac(struct eap_aka_data *data,
788 			      const struct wpabuf *req,
789 			      const u8 *mac, const u8 *extra,
790 			      size_t extra_len)
791 {
792 	if (data->eap_method == EAP_TYPE_AKA_PRIME)
793 		return eap_sim_verify_mac_sha256(data->k_aut, req, mac, extra,
794 						 extra_len);
795 	return eap_sim_verify_mac(data->k_aut, req, mac, extra, extra_len);
796 }
797 
798 
799 static void eap_aka_process_challenge(struct eap_sm *sm,
800 				      struct eap_aka_data *data,
801 				      struct wpabuf *respData,
802 				      struct eap_sim_attrs *attr)
803 {
804 	const u8 *identity;
805 	size_t identity_len;
806 
807 	wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Challenge");
808 
809 #ifdef EAP_SERVER_AKA_PRIME
810 #if 0
811 	/* KDF negotiation; to be enabled only after more than one KDF is
812 	 * supported */
813 	if (data->eap_method == EAP_TYPE_AKA_PRIME &&
814 	    attr->kdf_count == 1 && attr->mac == NULL) {
815 		if (attr->kdf[0] != EAP_AKA_PRIME_KDF) {
816 			wpa_printf(MSG_WARNING, "EAP-AKA': Peer selected "
817 				   "unknown KDF");
818 			data->notification =
819 				EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
820 			eap_aka_state(data, NOTIFICATION);
821 			return;
822 		}
823 
824 		data->kdf = attr->kdf[0];
825 
826 		/* Allow negotiation to continue with the selected KDF by
827 		 * sending another Challenge message */
828 		wpa_printf(MSG_DEBUG, "EAP-AKA': KDF %d selected", data->kdf);
829 		return;
830 	}
831 #endif
832 #endif /* EAP_SERVER_AKA_PRIME */
833 
834 	if (attr->checkcode &&
835 	    eap_aka_verify_checkcode(data, attr->checkcode,
836 				     attr->checkcode_len)) {
837 		wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
838 			   "message");
839 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
840 		eap_aka_state(data, NOTIFICATION);
841 		return;
842 	}
843 	if (attr->mac == NULL ||
844 	    eap_aka_verify_mac(data, respData, attr->mac, NULL, 0)) {
845 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
846 			   "did not include valid AT_MAC");
847 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
848 		eap_aka_state(data, NOTIFICATION);
849 		return;
850 	}
851 
852 	/*
853 	 * AT_RES is padded, so verify that there is enough room for RES and
854 	 * that the RES length in bits matches with the expected RES.
855 	 */
856 	if (attr->res == NULL || attr->res_len < data->res_len ||
857 	    attr->res_len_bits != data->res_len * 8 ||
858 	    os_memcmp(attr->res, data->res, data->res_len) != 0) {
859 		wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message did not "
860 			   "include valid AT_RES (attr len=%lu, res len=%lu "
861 			   "bits, expected %lu bits)",
862 			   (unsigned long) attr->res_len,
863 			   (unsigned long) attr->res_len_bits,
864 			   (unsigned long) data->res_len * 8);
865 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
866 		eap_aka_state(data, NOTIFICATION);
867 		return;
868 	}
869 
870 	wpa_printf(MSG_DEBUG, "EAP-AKA: Challenge response includes the "
871 		   "correct AT_MAC");
872 	if (sm->eap_sim_aka_result_ind && attr->result_ind) {
873 		data->use_result_ind = 1;
874 		data->notification = EAP_SIM_SUCCESS;
875 		eap_aka_state(data, NOTIFICATION);
876 	} else
877 		eap_aka_state(data, SUCCESS);
878 
879 	identity = eap_sim_db_get_permanent(sm->eap_sim_db_priv, sm->identity,
880 					    sm->identity_len, &identity_len);
881 	if (identity == NULL) {
882 		identity = sm->identity;
883 		identity_len = sm->identity_len;
884 	}
885 
886 	if (data->next_pseudonym) {
887 		eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, identity,
888 					 identity_len,
889 					 data->next_pseudonym);
890 		data->next_pseudonym = NULL;
891 	}
892 	if (data->next_reauth_id) {
893 		if (data->eap_method == EAP_TYPE_AKA_PRIME) {
894 #ifdef EAP_SERVER_AKA_PRIME
895 			eap_sim_db_add_reauth_prime(sm->eap_sim_db_priv,
896 						    identity,
897 						    identity_len,
898 						    data->next_reauth_id,
899 						    data->counter + 1,
900 						    data->k_encr, data->k_aut,
901 						    data->k_re);
902 #endif /* EAP_SERVER_AKA_PRIME */
903 		} else {
904 			eap_sim_db_add_reauth(sm->eap_sim_db_priv, identity,
905 					      identity_len,
906 					      data->next_reauth_id,
907 					      data->counter + 1,
908 					      data->mk);
909 		}
910 		data->next_reauth_id = NULL;
911 	}
912 }
913 
914 
915 static void eap_aka_process_sync_failure(struct eap_sm *sm,
916 					 struct eap_aka_data *data,
917 					 struct wpabuf *respData,
918 					 struct eap_sim_attrs *attr)
919 {
920 	wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Synchronization-Failure");
921 
922 	if (attr->auts == NULL) {
923 		wpa_printf(MSG_WARNING, "EAP-AKA: Synchronization-Failure "
924 			   "message did not include valid AT_AUTS");
925 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
926 		eap_aka_state(data, NOTIFICATION);
927 		return;
928 	}
929 
930 	/* Avoid re-reporting AUTS when processing pending EAP packet by
931 	 * maintaining a local flag stating whether this AUTS has already been
932 	 * reported. */
933 	if (!data->auts_reported &&
934 	    eap_sim_db_resynchronize(sm->eap_sim_db_priv, sm->identity,
935 				     sm->identity_len, attr->auts,
936 				     data->rand)) {
937 		wpa_printf(MSG_WARNING, "EAP-AKA: Resynchronization failed");
938 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
939 		eap_aka_state(data, NOTIFICATION);
940 		return;
941 	}
942 	data->auts_reported = 1;
943 
944 	/* Try again after resynchronization */
945 	eap_aka_determine_identity(sm, data, 0, 0);
946 }
947 
948 
949 static void eap_aka_process_reauth(struct eap_sm *sm,
950 				   struct eap_aka_data *data,
951 				   struct wpabuf *respData,
952 				   struct eap_sim_attrs *attr)
953 {
954 	struct eap_sim_attrs eattr;
955 	u8 *decrypted = NULL;
956 	const u8 *identity, *id2;
957 	size_t identity_len, id2_len;
958 
959 	wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Reauthentication");
960 
961 	if (attr->mac == NULL ||
962 	    eap_aka_verify_mac(data, respData, attr->mac, data->nonce_s,
963 			       EAP_SIM_NONCE_S_LEN)) {
964 		wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
965 			   "did not include valid AT_MAC");
966 		goto fail;
967 	}
968 
969 	if (attr->encr_data == NULL || attr->iv == NULL) {
970 		wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
971 			   "message did not include encrypted data");
972 		goto fail;
973 	}
974 
975 	decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
976 				       attr->encr_data_len, attr->iv, &eattr,
977 				       0);
978 	if (decrypted == NULL) {
979 		wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
980 			   "data from reauthentication message");
981 		goto fail;
982 	}
983 
984 	if (eattr.counter != data->counter) {
985 		wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
986 			   "used incorrect counter %u, expected %u",
987 			   eattr.counter, data->counter);
988 		goto fail;
989 	}
990 	os_free(decrypted);
991 	decrypted = NULL;
992 
993 	wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response includes "
994 		   "the correct AT_MAC");
995 
996 	if (eattr.counter_too_small) {
997 		wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response "
998 			   "included AT_COUNTER_TOO_SMALL - starting full "
999 			   "authentication");
1000 		eap_aka_determine_identity(sm, data, 0, 1);
1001 		return;
1002 	}
1003 
1004 	if (sm->eap_sim_aka_result_ind && attr->result_ind) {
1005 		data->use_result_ind = 1;
1006 		data->notification = EAP_SIM_SUCCESS;
1007 		eap_aka_state(data, NOTIFICATION);
1008 	} else
1009 		eap_aka_state(data, SUCCESS);
1010 
1011 	if (data->reauth) {
1012 		identity = data->reauth->identity;
1013 		identity_len = data->reauth->identity_len;
1014 	} else {
1015 		identity = sm->identity;
1016 		identity_len = sm->identity_len;
1017 	}
1018 
1019 	id2 = eap_sim_db_get_permanent(sm->eap_sim_db_priv, identity,
1020 				       identity_len, &id2_len);
1021 	if (id2) {
1022 		identity = id2;
1023 		identity_len = id2_len;
1024 	}
1025 
1026 	if (data->next_pseudonym) {
1027 		eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, identity,
1028 					 identity_len, data->next_pseudonym);
1029 		data->next_pseudonym = NULL;
1030 	}
1031 	if (data->next_reauth_id) {
1032 		if (data->eap_method == EAP_TYPE_AKA_PRIME) {
1033 #ifdef EAP_SERVER_AKA_PRIME
1034 			eap_sim_db_add_reauth_prime(sm->eap_sim_db_priv,
1035 						    identity,
1036 						    identity_len,
1037 						    data->next_reauth_id,
1038 						    data->counter + 1,
1039 						    data->k_encr, data->k_aut,
1040 						    data->k_re);
1041 #endif /* EAP_SERVER_AKA_PRIME */
1042 		} else {
1043 			eap_sim_db_add_reauth(sm->eap_sim_db_priv, identity,
1044 					      identity_len,
1045 					      data->next_reauth_id,
1046 					      data->counter + 1,
1047 					      data->mk);
1048 		}
1049 		data->next_reauth_id = NULL;
1050 	} else {
1051 		eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
1052 		data->reauth = NULL;
1053 	}
1054 
1055 	return;
1056 
1057 fail:
1058 	data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1059 	eap_aka_state(data, NOTIFICATION);
1060 	eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
1061 	data->reauth = NULL;
1062 	os_free(decrypted);
1063 }
1064 
1065 
1066 static void eap_aka_process_client_error(struct eap_sm *sm,
1067 					 struct eap_aka_data *data,
1068 					 struct wpabuf *respData,
1069 					 struct eap_sim_attrs *attr)
1070 {
1071 	wpa_printf(MSG_DEBUG, "EAP-AKA: Client reported error %d",
1072 		   attr->client_error_code);
1073 	if (data->notification == EAP_SIM_SUCCESS && data->use_result_ind)
1074 		eap_aka_state(data, SUCCESS);
1075 	else
1076 		eap_aka_state(data, FAILURE);
1077 }
1078 
1079 
1080 static void eap_aka_process_authentication_reject(
1081 	struct eap_sm *sm, struct eap_aka_data *data,
1082 	struct wpabuf *respData, struct eap_sim_attrs *attr)
1083 {
1084 	wpa_printf(MSG_DEBUG, "EAP-AKA: Client rejected authentication");
1085 	eap_aka_state(data, FAILURE);
1086 }
1087 
1088 
1089 static void eap_aka_process_notification(struct eap_sm *sm,
1090 					 struct eap_aka_data *data,
1091 					 struct wpabuf *respData,
1092 					 struct eap_sim_attrs *attr)
1093 {
1094 	wpa_printf(MSG_DEBUG, "EAP-AKA: Client replied to notification");
1095 	if (data->notification == EAP_SIM_SUCCESS && data->use_result_ind)
1096 		eap_aka_state(data, SUCCESS);
1097 	else
1098 		eap_aka_state(data, FAILURE);
1099 }
1100 
1101 
1102 static void eap_aka_process(struct eap_sm *sm, void *priv,
1103 			    struct wpabuf *respData)
1104 {
1105 	struct eap_aka_data *data = priv;
1106 	const u8 *pos, *end;
1107 	u8 subtype;
1108 	size_t len;
1109 	struct eap_sim_attrs attr;
1110 
1111 	pos = eap_hdr_validate(EAP_VENDOR_IETF, data->eap_method, respData,
1112 			       &len);
1113 	if (pos == NULL || len < 3)
1114 		return;
1115 
1116 	end = pos + len;
1117 	subtype = *pos;
1118 	pos += 3;
1119 
1120 	if (eap_aka_subtype_ok(data, subtype)) {
1121 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized or unexpected "
1122 			   "EAP-AKA Subtype in EAP Response");
1123 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1124 		eap_aka_state(data, NOTIFICATION);
1125 		return;
1126 	}
1127 
1128 	if (eap_sim_parse_attr(pos, end, &attr,
1129 			       data->eap_method == EAP_TYPE_AKA_PRIME ? 2 : 1,
1130 			       0)) {
1131 		wpa_printf(MSG_DEBUG, "EAP-AKA: Failed to parse attributes");
1132 		data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
1133 		eap_aka_state(data, NOTIFICATION);
1134 		return;
1135 	}
1136 
1137 	if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR) {
1138 		eap_aka_process_client_error(sm, data, respData, &attr);
1139 		return;
1140 	}
1141 
1142 	if (subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT) {
1143 		eap_aka_process_authentication_reject(sm, data, respData,
1144 						      &attr);
1145 		return;
1146 	}
1147 
1148 	switch (data->state) {
1149 	case IDENTITY:
1150 		eap_aka_process_identity(sm, data, respData, &attr);
1151 		break;
1152 	case CHALLENGE:
1153 		if (subtype == EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
1154 			eap_aka_process_sync_failure(sm, data, respData,
1155 						     &attr);
1156 		} else {
1157 			eap_aka_process_challenge(sm, data, respData, &attr);
1158 		}
1159 		break;
1160 	case REAUTH:
1161 		eap_aka_process_reauth(sm, data, respData, &attr);
1162 		break;
1163 	case NOTIFICATION:
1164 		eap_aka_process_notification(sm, data, respData, &attr);
1165 		break;
1166 	default:
1167 		wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
1168 			   "process", data->state);
1169 		break;
1170 	}
1171 }
1172 
1173 
1174 static Boolean eap_aka_isDone(struct eap_sm *sm, void *priv)
1175 {
1176 	struct eap_aka_data *data = priv;
1177 	return data->state == SUCCESS || data->state == FAILURE;
1178 }
1179 
1180 
1181 static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
1182 {
1183 	struct eap_aka_data *data = priv;
1184 	u8 *key;
1185 
1186 	if (data->state != SUCCESS)
1187 		return NULL;
1188 
1189 	key = os_malloc(EAP_SIM_KEYING_DATA_LEN);
1190 	if (key == NULL)
1191 		return NULL;
1192 	os_memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
1193 	*len = EAP_SIM_KEYING_DATA_LEN;
1194 	return key;
1195 }
1196 
1197 
1198 static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1199 {
1200 	struct eap_aka_data *data = priv;
1201 	u8 *key;
1202 
1203 	if (data->state != SUCCESS)
1204 		return NULL;
1205 
1206 	key = os_malloc(EAP_EMSK_LEN);
1207 	if (key == NULL)
1208 		return NULL;
1209 	os_memcpy(key, data->emsk, EAP_EMSK_LEN);
1210 	*len = EAP_EMSK_LEN;
1211 	return key;
1212 }
1213 
1214 
1215 static Boolean eap_aka_isSuccess(struct eap_sm *sm, void *priv)
1216 {
1217 	struct eap_aka_data *data = priv;
1218 	return data->state == SUCCESS;
1219 }
1220 
1221 
1222 int eap_server_aka_register(void)
1223 {
1224 	struct eap_method *eap;
1225 	int ret;
1226 
1227 	eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1228 				      EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
1229 	if (eap == NULL)
1230 		return -1;
1231 
1232 	eap->init = eap_aka_init;
1233 	eap->reset = eap_aka_reset;
1234 	eap->buildReq = eap_aka_buildReq;
1235 	eap->check = eap_aka_check;
1236 	eap->process = eap_aka_process;
1237 	eap->isDone = eap_aka_isDone;
1238 	eap->getKey = eap_aka_getKey;
1239 	eap->isSuccess = eap_aka_isSuccess;
1240 	eap->get_emsk = eap_aka_get_emsk;
1241 
1242 	ret = eap_server_method_register(eap);
1243 	if (ret)
1244 		eap_server_method_free(eap);
1245 	return ret;
1246 }
1247 
1248 
1249 #ifdef EAP_SERVER_AKA_PRIME
1250 int eap_server_aka_prime_register(void)
1251 {
1252 	struct eap_method *eap;
1253 	int ret;
1254 
1255 	eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1256 				      EAP_VENDOR_IETF, EAP_TYPE_AKA_PRIME,
1257 				      "AKA'");
1258 	if (eap == NULL)
1259 		return -1;
1260 
1261 	eap->init = eap_aka_prime_init;
1262 	eap->reset = eap_aka_reset;
1263 	eap->buildReq = eap_aka_buildReq;
1264 	eap->check = eap_aka_check;
1265 	eap->process = eap_aka_process;
1266 	eap->isDone = eap_aka_isDone;
1267 	eap->getKey = eap_aka_getKey;
1268 	eap->isSuccess = eap_aka_isSuccess;
1269 	eap->get_emsk = eap_aka_get_emsk;
1270 
1271 	ret = eap_server_method_register(eap);
1272 	if (ret)
1273 		eap_server_method_free(eap);
1274 
1275 	return ret;
1276 }
1277 #endif /* EAP_SERVER_AKA_PRIME */
1278