Annotation of embedaddon/strongswan/src/libcharon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c, revision 1.1
1.1 ! misho 1: /*
! 2: * Copyright (C) 2008-2009 Martin Willi
! 3: * HSR Hochschule fuer Technik Rapperswil
! 4: *
! 5: * This program is free software; you can redistribute it and/or modify it
! 6: * under the terms of the GNU General Public License as published by the
! 7: * Free Software Foundation; either version 2 of the License, or (at your
! 8: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
! 9: *
! 10: * This program is distributed in the hope that it will be useful, but
! 11: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
! 12: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
! 13: * for more details.
! 14: */
! 15:
! 16: #include "eap_aka_3gpp2_card.h"
! 17:
! 18: #include <daemon.h>
! 19:
! 20: typedef struct private_eap_aka_3gpp2_card_t private_eap_aka_3gpp2_card_t;
! 21:
! 22: /**
! 23: * Private data of an eap_aka_3gpp2_card_t object.
! 24: */
! 25: struct private_eap_aka_3gpp2_card_t {
! 26:
! 27: /**
! 28: * Public eap_aka_3gpp2_card_t interface.
! 29: */
! 30: eap_aka_3gpp2_card_t public;
! 31:
! 32: /**
! 33: * AKA functions
! 34: */
! 35: eap_aka_3gpp2_functions_t *f;
! 36:
! 37: /**
! 38: * do sequence number checking?
! 39: */
! 40: bool seq_check;
! 41:
! 42: /**
! 43: * SQN stored in this pseudo-USIM
! 44: */
! 45: char sqn[AKA_SQN_LEN];
! 46: };
! 47:
! 48: /**
! 49: * Functions from eap_aka_3gpp2_provider.c
! 50: */
! 51: bool eap_aka_3gpp2_get_k(identification_t *id, char k[AKA_K_LEN]);
! 52: void eap_aka_3gpp2_get_sqn(char sqn[AKA_SQN_LEN], int offset);
! 53:
! 54: METHOD(simaka_card_t, get_quintuplet, status_t,
! 55: private_eap_aka_3gpp2_card_t *this, identification_t *id,
! 56: char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN],
! 57: char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len)
! 58: {
! 59: char *amf, *mac;
! 60: char k[AKA_K_LEN], ak[AKA_AK_LEN], sqn[AKA_SQN_LEN], xmac[AKA_MAC_LEN];
! 61:
! 62: if (!eap_aka_3gpp2_get_k(id, k))
! 63: {
! 64: DBG1(DBG_IKE, "no EAP key found for %Y to authenticate with AKA", id);
! 65: return FAILED;
! 66: }
! 67:
! 68: /* AUTN = SQN xor AK | AMF | MAC */
! 69: DBG3(DBG_IKE, "received autn %b", autn, AKA_AUTN_LEN);
! 70: DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN);
! 71: DBG3(DBG_IKE, "using rand %b", rand, AKA_RAND_LEN);
! 72: memcpy(sqn, autn, AKA_SQN_LEN);
! 73: amf = autn + AKA_SQN_LEN;
! 74: mac = autn + AKA_SQN_LEN + AKA_AMF_LEN;
! 75:
! 76: /* XOR anonymity key AK into SQN to decrypt it */
! 77: if (!this->f->f5(this->f, k, rand, ak))
! 78: {
! 79: return FAILED;
! 80: }
! 81: DBG3(DBG_IKE, "using ak %b", ak, AKA_AK_LEN);
! 82: memxor(sqn, ak, AKA_SQN_LEN);
! 83: DBG3(DBG_IKE, "using sqn %b", sqn, AKA_SQN_LEN);
! 84:
! 85: /* calculate expected MAC and compare against received one */
! 86: if (!this->f->f1(this->f, k, rand, sqn, amf, xmac))
! 87: {
! 88: return FAILED;
! 89: }
! 90: if (!memeq_const(mac, xmac, AKA_MAC_LEN))
! 91: {
! 92: DBG1(DBG_IKE, "received MAC does not match XMAC");
! 93: DBG3(DBG_IKE, "MAC %b\nXMAC %b", mac, AKA_MAC_LEN, xmac, AKA_MAC_LEN);
! 94: return FAILED;
! 95: }
! 96:
! 97: if (this->seq_check && memcmp(this->sqn, sqn, AKA_SQN_LEN) >= 0)
! 98: {
! 99: DBG3(DBG_IKE, "received SQN %b\ncurrent SQN %b",
! 100: sqn, AKA_SQN_LEN, this->sqn, AKA_SQN_LEN);
! 101: return INVALID_STATE;
! 102: }
! 103:
! 104: /* update stored SQN to the received one */
! 105: memcpy(this->sqn, sqn, AKA_SQN_LEN);
! 106:
! 107: /* CK/IK, calculate RES */
! 108: if (!this->f->f3(this->f, k, rand, ck) ||
! 109: !this->f->f4(this->f, k, rand, ik) ||
! 110: !this->f->f2(this->f, k, rand, res))
! 111: {
! 112: return FAILED;
! 113: }
! 114: *res_len = AKA_RES_MAX;
! 115:
! 116: return SUCCESS;
! 117: }
! 118:
! 119: METHOD(simaka_card_t, resync, bool,
! 120: private_eap_aka_3gpp2_card_t *this, identification_t *id,
! 121: char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN])
! 122: {
! 123: char amf[AKA_AMF_LEN], k[AKA_K_LEN], aks[AKA_AK_LEN], macs[AKA_MAC_LEN];
! 124:
! 125: if (!eap_aka_3gpp2_get_k(id, k))
! 126: {
! 127: DBG1(DBG_IKE, "no EAP key found for %Y to resync AKA", id);
! 128: return FALSE;
! 129: }
! 130:
! 131: /* AMF is set to zero in resync */
! 132: memset(amf, 0, AKA_AMF_LEN);
! 133: if (!this->f->f5star(this->f, k, rand, aks) ||
! 134: !this->f->f1star(this->f, k, rand, this->sqn, amf, macs))
! 135: {
! 136: return FALSE;
! 137: }
! 138: /* AUTS = SQN xor AKS | MACS */
! 139: memcpy(auts, this->sqn, AKA_SQN_LEN);
! 140: memxor(auts, aks, AKA_AK_LEN);
! 141: memcpy(auts + AKA_AK_LEN, macs, AKA_MAC_LEN);
! 142:
! 143: return TRUE;
! 144: }
! 145:
! 146: METHOD(eap_aka_3gpp2_card_t, destroy, void,
! 147: private_eap_aka_3gpp2_card_t *this)
! 148: {
! 149: free(this);
! 150: }
! 151:
! 152: /**
! 153: * See header
! 154: */
! 155: eap_aka_3gpp2_card_t *eap_aka_3gpp2_card_create(eap_aka_3gpp2_functions_t *f)
! 156: {
! 157: private_eap_aka_3gpp2_card_t *this;
! 158:
! 159: INIT(this,
! 160: .public = {
! 161: .card = {
! 162: .get_triplet = (void*)return_false,
! 163: .get_quintuplet = _get_quintuplet,
! 164: .resync = _resync,
! 165: .get_pseudonym = (void*)return_null,
! 166: .set_pseudonym = (void*)nop,
! 167: .get_reauth = (void*)return_null,
! 168: .set_reauth = (void*)nop,
! 169: },
! 170: .destroy = _destroy,
! 171: },
! 172: .f = f,
! 173: .seq_check = lib->settings->get_bool(lib->settings,
! 174: "%s.plugins.eap-aka-3gpp2.seq_check",
! 175: #ifdef SEQ_CHECK /* handle legacy compile time configuration as default */
! 176: TRUE,
! 177: #else /* !SEQ_CHECK */
! 178: FALSE,
! 179: #endif /* SEQ_CHECK */
! 180: lib->ns),
! 181: );
! 182:
! 183: eap_aka_3gpp2_get_sqn(this->sqn, 0);
! 184:
! 185: return &this->public;
! 186: }
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to eap_aka_3gpp2_card.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libcharon / plugins / eap_aka_3gpp2