2 * hostapd / EAP-AKA (RFC 4187) and EAP-AKA' (RFC 5448)
3 * Copyright (c) 2005-2012, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include "crypto/sha256.h"
13 #include "crypto/crypto.h"
14 #include "crypto/random.h"
15 #include "eap_common/eap_sim_common.h"
16 #include "eap_server/eap_i.h"
17 #include "eap_server/eap_sim_db.h"
21 u8 mk
[EAP_SIM_MK_LEN
];
22 u8 nonce_s
[EAP_SIM_NONCE_S_LEN
];
23 u8 k_aut
[EAP_AKA_PRIME_K_AUT_LEN
];
24 u8 k_encr
[EAP_SIM_K_ENCR_LEN
];
25 u8 k_re
[EAP_AKA_PRIME_K_RE_LEN
]; /* EAP-AKA' only */
26 u8 msk
[EAP_SIM_KEYING_DATA_LEN
];
27 u8 emsk
[EAP_EMSK_LEN
];
28 u8 rand
[EAP_AKA_RAND_LEN
];
29 u8 autn
[EAP_AKA_AUTN_LEN
];
30 u8 ck
[EAP_AKA_CK_LEN
];
31 u8 ik
[EAP_AKA_IK_LEN
];
32 u8 res
[EAP_AKA_RES_MAX_LEN
];
33 u8 reauth_mac
[EAP_SIM_MAC_LEN
];
36 IDENTITY
, CHALLENGE
, REAUTH
, NOTIFICATION
, SUCCESS
, FAILURE
41 struct eap_sim_reauth
*reauth
;
42 int auts_reported
; /* whether the current AUTS has been reported to the
47 struct wpabuf
*id_msgs
;
51 size_t network_name_len
;
54 char permanent
[20]; /* Permanent username */
58 static void eap_aka_fullauth(struct eap_sm
*sm
, struct eap_aka_data
*data
);
61 static const char * eap_aka_state_txt(int state
)
75 return "NOTIFICATION";
82 static void eap_aka_state(struct eap_aka_data
*data
, int state
)
84 wpa_printf(MSG_DEBUG
, "EAP-AKA: %s -> %s",
85 eap_aka_state_txt(data
->state
),
86 eap_aka_state_txt(state
));
91 static int eap_aka_check_identity_reauth(struct eap_sm
*sm
,
92 struct eap_aka_data
*data
,
95 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
&&
96 username
[0] != EAP_AKA_PRIME_REAUTH_ID_PREFIX
)
98 if (data
->eap_method
== EAP_TYPE_AKA
&&
99 username
[0] != EAP_AKA_REAUTH_ID_PREFIX
)
102 wpa_printf(MSG_DEBUG
, "EAP-AKA: Reauth username '%s'", username
);
103 data
->reauth
= eap_sim_db_get_reauth_entry(sm
->eap_sim_db_priv
,
105 if (data
->reauth
== NULL
) {
106 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unknown reauth identity - "
107 "request full auth identity");
108 /* Remain in IDENTITY state for another round */
112 wpa_printf(MSG_DEBUG
, "EAP-AKA: Using fast re-authentication");
113 os_strlcpy(data
->permanent
, data
->reauth
->permanent
,
114 sizeof(data
->permanent
));
115 data
->counter
= data
->reauth
->counter
;
116 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
117 os_memcpy(data
->k_encr
, data
->reauth
->k_encr
,
119 os_memcpy(data
->k_aut
, data
->reauth
->k_aut
,
120 EAP_AKA_PRIME_K_AUT_LEN
);
121 os_memcpy(data
->k_re
, data
->reauth
->k_re
,
122 EAP_AKA_PRIME_K_RE_LEN
);
124 os_memcpy(data
->mk
, data
->reauth
->mk
, EAP_SIM_MK_LEN
);
127 eap_aka_state(data
, REAUTH
);
132 static void eap_aka_check_identity(struct eap_sm
*sm
,
133 struct eap_aka_data
*data
)
137 /* Check if we already know the identity from EAP-Response/Identity */
139 username
= sim_get_username(sm
->identity
, sm
->identity_len
);
140 if (username
== NULL
)
143 if (eap_aka_check_identity_reauth(sm
, data
, username
) > 0) {
146 * Since re-auth username was recognized, skip AKA/Identity
152 if ((data
->eap_method
== EAP_TYPE_AKA_PRIME
&&
153 username
[0] == EAP_AKA_PRIME_PSEUDONYM_PREFIX
) ||
154 (data
->eap_method
== EAP_TYPE_AKA
&&
155 username
[0] == EAP_AKA_PSEUDONYM_PREFIX
)) {
156 const char *permanent
;
157 wpa_printf(MSG_DEBUG
, "EAP-AKA: Pseudonym username '%s'",
159 permanent
= eap_sim_db_get_permanent(
160 sm
->eap_sim_db_priv
, username
);
161 if (permanent
== NULL
) {
163 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unknown pseudonym "
164 "identity - request permanent identity");
165 /* Remain in IDENTITY state for another round */
168 os_strlcpy(data
->permanent
, permanent
,
169 sizeof(data
->permanent
));
171 * Since pseudonym username was recognized, skip AKA/Identity
174 eap_aka_fullauth(sm
, data
);
181 static void * eap_aka_init(struct eap_sm
*sm
)
183 struct eap_aka_data
*data
;
185 if (sm
->eap_sim_db_priv
== NULL
) {
186 wpa_printf(MSG_WARNING
, "EAP-AKA: eap_sim_db not configured");
190 data
= os_zalloc(sizeof(*data
));
194 data
->eap_method
= EAP_TYPE_AKA
;
196 data
->state
= IDENTITY
;
197 data
->pending_id
= -1;
198 eap_aka_check_identity(sm
, data
);
204 #ifdef EAP_SERVER_AKA_PRIME
205 static void * eap_aka_prime_init(struct eap_sm
*sm
)
207 struct eap_aka_data
*data
;
208 /* TODO: make ANID configurable; see 3GPP TS 24.302 */
209 char *network_name
= "WLAN";
211 if (sm
->eap_sim_db_priv
== NULL
) {
212 wpa_printf(MSG_WARNING
, "EAP-AKA: eap_sim_db not configured");
216 data
= os_zalloc(sizeof(*data
));
220 data
->eap_method
= EAP_TYPE_AKA_PRIME
;
221 data
->network_name
= (u8
*) os_strdup(network_name
);
222 if (data
->network_name
== NULL
) {
227 data
->network_name_len
= os_strlen(network_name
);
229 data
->state
= IDENTITY
;
230 data
->pending_id
= -1;
231 eap_aka_check_identity(sm
, data
);
235 #endif /* EAP_SERVER_AKA_PRIME */
238 static void eap_aka_reset(struct eap_sm
*sm
, void *priv
)
240 struct eap_aka_data
*data
= priv
;
241 os_free(data
->next_pseudonym
);
242 os_free(data
->next_reauth_id
);
243 wpabuf_free(data
->id_msgs
);
244 os_free(data
->network_name
);
245 bin_clear_free(data
, sizeof(*data
));
249 static int eap_aka_add_id_msg(struct eap_aka_data
*data
,
250 const struct wpabuf
*msg
)
255 if (data
->id_msgs
== NULL
) {
256 data
->id_msgs
= wpabuf_dup(msg
);
257 return data
->id_msgs
== NULL
? -1 : 0;
260 if (wpabuf_resize(&data
->id_msgs
, wpabuf_len(msg
)) < 0)
262 wpabuf_put_buf(data
->id_msgs
, msg
);
268 static void eap_aka_add_checkcode(struct eap_aka_data
*data
,
269 struct eap_sim_msg
*msg
)
273 u8 hash
[SHA256_MAC_LEN
];
275 wpa_printf(MSG_DEBUG
, " AT_CHECKCODE");
277 if (data
->id_msgs
== NULL
) {
279 * No EAP-AKA/Identity packets were exchanged - send empty
282 eap_sim_msg_add(msg
, EAP_SIM_AT_CHECKCODE
, 0, NULL
, 0);
286 /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
287 addr
= wpabuf_head(data
->id_msgs
);
288 len
= wpabuf_len(data
->id_msgs
);
289 wpa_hexdump(MSG_MSGDUMP
, "EAP-AKA: AT_CHECKCODE data", addr
, len
);
290 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
)
291 sha256_vector(1, &addr
, &len
, hash
);
293 sha1_vector(1, &addr
, &len
, hash
);
295 eap_sim_msg_add(msg
, EAP_SIM_AT_CHECKCODE
, 0, hash
,
296 data
->eap_method
== EAP_TYPE_AKA_PRIME
?
297 EAP_AKA_PRIME_CHECKCODE_LEN
: EAP_AKA_CHECKCODE_LEN
);
301 static int eap_aka_verify_checkcode(struct eap_aka_data
*data
,
302 const u8
*checkcode
, size_t checkcode_len
)
306 u8 hash
[SHA256_MAC_LEN
];
309 if (checkcode
== NULL
)
312 if (data
->id_msgs
== NULL
) {
313 if (checkcode_len
!= 0) {
314 wpa_printf(MSG_DEBUG
, "EAP-AKA: Checkcode from peer "
315 "indicates that AKA/Identity messages were "
316 "used, but they were not");
322 hash_len
= data
->eap_method
== EAP_TYPE_AKA_PRIME
?
323 EAP_AKA_PRIME_CHECKCODE_LEN
: EAP_AKA_CHECKCODE_LEN
;
325 if (checkcode_len
!= hash_len
) {
326 wpa_printf(MSG_DEBUG
, "EAP-AKA: Checkcode from peer indicates "
327 "that AKA/Identity message were not used, but they "
332 /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
333 addr
= wpabuf_head(data
->id_msgs
);
334 len
= wpabuf_len(data
->id_msgs
);
335 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
)
336 sha256_vector(1, &addr
, &len
, hash
);
338 sha1_vector(1, &addr
, &len
, hash
);
340 if (os_memcmp_const(hash
, checkcode
, hash_len
) != 0) {
341 wpa_printf(MSG_DEBUG
, "EAP-AKA: Mismatch in AT_CHECKCODE");
349 static struct wpabuf
* eap_aka_build_identity(struct eap_sm
*sm
,
350 struct eap_aka_data
*data
, u8 id
)
352 struct eap_sim_msg
*msg
;
355 wpa_printf(MSG_DEBUG
, "EAP-AKA: Generating Identity");
356 msg
= eap_sim_msg_init(EAP_CODE_REQUEST
, id
, data
->eap_method
,
357 EAP_AKA_SUBTYPE_IDENTITY
);
358 data
->identity_round
++;
359 if (data
->identity_round
== 1) {
361 * RFC 4187, Chap. 4.1.4 recommends that identity from EAP is
362 * ignored and the AKA/Identity is used to request the
365 wpa_printf(MSG_DEBUG
, " AT_ANY_ID_REQ");
366 eap_sim_msg_add(msg
, EAP_SIM_AT_ANY_ID_REQ
, 0, NULL
, 0);
367 } else if (data
->identity_round
> 3) {
368 /* Cannot use more than three rounds of Identity messages */
369 eap_sim_msg_free(msg
);
371 } else if (sm
->identity
&& sm
->identity_len
> 0 &&
372 (sm
->identity
[0] == EAP_AKA_REAUTH_ID_PREFIX
||
373 sm
->identity
[0] == EAP_AKA_PRIME_REAUTH_ID_PREFIX
)) {
374 /* Reauth id may have expired - try fullauth */
375 wpa_printf(MSG_DEBUG
, " AT_FULLAUTH_ID_REQ");
376 eap_sim_msg_add(msg
, EAP_SIM_AT_FULLAUTH_ID_REQ
, 0, NULL
, 0);
378 wpa_printf(MSG_DEBUG
, " AT_PERMANENT_ID_REQ");
379 eap_sim_msg_add(msg
, EAP_SIM_AT_PERMANENT_ID_REQ
, 0, NULL
, 0);
381 buf
= eap_sim_msg_finish(msg
, data
->eap_method
, NULL
, NULL
, 0);
382 if (eap_aka_add_id_msg(data
, buf
) < 0) {
386 data
->pending_id
= id
;
391 static int eap_aka_build_encr(struct eap_sm
*sm
, struct eap_aka_data
*data
,
392 struct eap_sim_msg
*msg
, u16 counter
,
395 os_free(data
->next_pseudonym
);
396 if (!(sm
->eap_sim_id
& 0x01)) {
397 /* Use of pseudonyms disabled in configuration */
398 data
->next_pseudonym
= NULL
;
399 } else if (!nonce_s
) {
400 data
->next_pseudonym
=
401 eap_sim_db_get_next_pseudonym(
403 data
->eap_method
== EAP_TYPE_AKA_PRIME
?
404 EAP_SIM_DB_AKA_PRIME
: EAP_SIM_DB_AKA
);
406 /* Do not update pseudonym during re-authentication */
407 data
->next_pseudonym
= NULL
;
409 os_free(data
->next_reauth_id
);
410 if (!(sm
->eap_sim_id
& 0x02)) {
411 /* Use of fast reauth disabled in configuration */
412 data
->next_reauth_id
= NULL
;
413 } else if (data
->counter
<= EAP_AKA_MAX_FAST_REAUTHS
) {
414 data
->next_reauth_id
=
415 eap_sim_db_get_next_reauth_id(
417 data
->eap_method
== EAP_TYPE_AKA_PRIME
?
418 EAP_SIM_DB_AKA_PRIME
: EAP_SIM_DB_AKA
);
420 wpa_printf(MSG_DEBUG
, "EAP-AKA: Max fast re-authentication "
421 "count exceeded - force full authentication");
422 data
->next_reauth_id
= NULL
;
425 if (data
->next_pseudonym
== NULL
&& data
->next_reauth_id
== NULL
&&
426 counter
== 0 && nonce_s
== NULL
)
429 wpa_printf(MSG_DEBUG
, " AT_IV");
430 wpa_printf(MSG_DEBUG
, " AT_ENCR_DATA");
431 eap_sim_msg_add_encr_start(msg
, EAP_SIM_AT_IV
, EAP_SIM_AT_ENCR_DATA
);
434 wpa_printf(MSG_DEBUG
, " *AT_COUNTER (%u)", counter
);
435 eap_sim_msg_add(msg
, EAP_SIM_AT_COUNTER
, counter
, NULL
, 0);
439 wpa_printf(MSG_DEBUG
, " *AT_NONCE_S");
440 eap_sim_msg_add(msg
, EAP_SIM_AT_NONCE_S
, 0, nonce_s
,
441 EAP_SIM_NONCE_S_LEN
);
444 if (data
->next_pseudonym
) {
445 wpa_printf(MSG_DEBUG
, " *AT_NEXT_PSEUDONYM (%s)",
446 data
->next_pseudonym
);
447 eap_sim_msg_add(msg
, EAP_SIM_AT_NEXT_PSEUDONYM
,
448 os_strlen(data
->next_pseudonym
),
449 (u8
*) data
->next_pseudonym
,
450 os_strlen(data
->next_pseudonym
));
453 if (data
->next_reauth_id
) {
454 wpa_printf(MSG_DEBUG
, " *AT_NEXT_REAUTH_ID (%s)",
455 data
->next_reauth_id
);
456 eap_sim_msg_add(msg
, EAP_SIM_AT_NEXT_REAUTH_ID
,
457 os_strlen(data
->next_reauth_id
),
458 (u8
*) data
->next_reauth_id
,
459 os_strlen(data
->next_reauth_id
));
462 if (eap_sim_msg_add_encr_end(msg
, data
->k_encr
, EAP_SIM_AT_PADDING
)) {
463 wpa_printf(MSG_WARNING
, "EAP-AKA: Failed to encrypt "
472 static struct wpabuf
* eap_aka_build_challenge(struct eap_sm
*sm
,
473 struct eap_aka_data
*data
,
476 struct eap_sim_msg
*msg
;
478 wpa_printf(MSG_DEBUG
, "EAP-AKA: Generating Challenge");
479 msg
= eap_sim_msg_init(EAP_CODE_REQUEST
, id
, data
->eap_method
,
480 EAP_AKA_SUBTYPE_CHALLENGE
);
481 wpa_printf(MSG_DEBUG
, " AT_RAND");
482 eap_sim_msg_add(msg
, EAP_SIM_AT_RAND
, 0, data
->rand
, EAP_AKA_RAND_LEN
);
483 wpa_printf(MSG_DEBUG
, " AT_AUTN");
484 eap_sim_msg_add(msg
, EAP_SIM_AT_AUTN
, 0, data
->autn
, EAP_AKA_AUTN_LEN
);
485 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
487 /* Add the selected KDF into the beginning */
488 wpa_printf(MSG_DEBUG
, " AT_KDF");
489 eap_sim_msg_add(msg
, EAP_SIM_AT_KDF
, data
->kdf
,
492 wpa_printf(MSG_DEBUG
, " AT_KDF");
493 eap_sim_msg_add(msg
, EAP_SIM_AT_KDF
, EAP_AKA_PRIME_KDF
,
495 wpa_printf(MSG_DEBUG
, " AT_KDF_INPUT");
496 eap_sim_msg_add(msg
, EAP_SIM_AT_KDF_INPUT
,
497 data
->network_name_len
,
498 data
->network_name
, data
->network_name_len
);
501 if (eap_aka_build_encr(sm
, data
, msg
, 0, NULL
)) {
502 eap_sim_msg_free(msg
);
506 eap_aka_add_checkcode(data
, msg
);
508 if (sm
->eap_sim_aka_result_ind
) {
509 wpa_printf(MSG_DEBUG
, " AT_RESULT_IND");
510 eap_sim_msg_add(msg
, EAP_SIM_AT_RESULT_IND
, 0, NULL
, 0);
513 #ifdef EAP_SERVER_AKA_PRIME
514 if (data
->eap_method
== EAP_TYPE_AKA
) {
517 int aka_prime_preferred
= 0;
520 while (sm
->user
&& i
< EAP_MAX_METHODS
&&
521 (sm
->user
->methods
[i
].vendor
!= EAP_VENDOR_IETF
||
522 sm
->user
->methods
[i
].method
!= EAP_TYPE_NONE
)) {
523 if (sm
->user
->methods
[i
].vendor
== EAP_VENDOR_IETF
) {
524 if (sm
->user
->methods
[i
].method
==
527 if (sm
->user
->methods
[i
].method
==
528 EAP_TYPE_AKA_PRIME
) {
529 aka_prime_preferred
= 1;
536 if (aka_prime_preferred
)
537 flags
|= EAP_AKA_BIDDING_FLAG_D
;
538 eap_sim_msg_add(msg
, EAP_SIM_AT_BIDDING
, flags
, NULL
, 0);
540 #endif /* EAP_SERVER_AKA_PRIME */
542 wpa_printf(MSG_DEBUG
, " AT_MAC");
543 eap_sim_msg_add_mac(msg
, EAP_SIM_AT_MAC
);
544 return eap_sim_msg_finish(msg
, data
->eap_method
, data
->k_aut
, NULL
, 0);
548 static struct wpabuf
* eap_aka_build_reauth(struct eap_sm
*sm
,
549 struct eap_aka_data
*data
, u8 id
)
551 struct eap_sim_msg
*msg
;
554 wpa_printf(MSG_DEBUG
, "EAP-AKA: Generating Re-authentication");
556 if (random_get_bytes(data
->nonce_s
, EAP_SIM_NONCE_S_LEN
))
558 wpa_hexdump_key(MSG_MSGDUMP
, "EAP-AKA: NONCE_S",
559 data
->nonce_s
, EAP_SIM_NONCE_S_LEN
);
561 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
562 eap_aka_prime_derive_keys_reauth(data
->k_re
, data
->counter
,
566 data
->msk
, data
->emsk
);
568 eap_sim_derive_keys(data
->mk
, data
->k_encr
, data
->k_aut
,
569 data
->msk
, data
->emsk
);
570 eap_sim_derive_keys_reauth(data
->counter
, sm
->identity
,
571 sm
->identity_len
, data
->nonce_s
,
572 data
->mk
, data
->msk
, data
->emsk
);
575 msg
= eap_sim_msg_init(EAP_CODE_REQUEST
, id
, data
->eap_method
,
576 EAP_AKA_SUBTYPE_REAUTHENTICATION
);
578 if (eap_aka_build_encr(sm
, data
, msg
, data
->counter
, data
->nonce_s
)) {
579 eap_sim_msg_free(msg
);
583 eap_aka_add_checkcode(data
, msg
);
585 if (sm
->eap_sim_aka_result_ind
) {
586 wpa_printf(MSG_DEBUG
, " AT_RESULT_IND");
587 eap_sim_msg_add(msg
, EAP_SIM_AT_RESULT_IND
, 0, NULL
, 0);
590 wpa_printf(MSG_DEBUG
, " AT_MAC");
591 eap_sim_msg_add_mac(msg
, EAP_SIM_AT_MAC
);
592 buf
= eap_sim_msg_finish(msg
, data
->eap_method
, data
->k_aut
, NULL
, 0);
594 /* Remember this MAC before sending it to the peer. This MAC is used for
595 * Session-Id calculation after receiving response from the peer and
596 * after all other checks pass. */
597 os_memcpy(data
->reauth_mac
,
598 wpabuf_head_u8(buf
) + wpabuf_len(buf
) - EAP_SIM_MAC_LEN
,
605 static struct wpabuf
* eap_aka_build_notification(struct eap_sm
*sm
,
606 struct eap_aka_data
*data
,
609 struct eap_sim_msg
*msg
;
611 wpa_printf(MSG_DEBUG
, "EAP-AKA: Generating Notification");
612 msg
= eap_sim_msg_init(EAP_CODE_REQUEST
, id
, data
->eap_method
,
613 EAP_AKA_SUBTYPE_NOTIFICATION
);
614 wpa_printf(MSG_DEBUG
, " AT_NOTIFICATION (%d)", data
->notification
);
615 eap_sim_msg_add(msg
, EAP_SIM_AT_NOTIFICATION
, data
->notification
,
617 if (data
->use_result_ind
) {
619 wpa_printf(MSG_DEBUG
, " AT_IV");
620 wpa_printf(MSG_DEBUG
, " AT_ENCR_DATA");
621 eap_sim_msg_add_encr_start(msg
, EAP_SIM_AT_IV
,
622 EAP_SIM_AT_ENCR_DATA
);
623 wpa_printf(MSG_DEBUG
, " *AT_COUNTER (%u)",
625 eap_sim_msg_add(msg
, EAP_SIM_AT_COUNTER
, data
->counter
,
628 if (eap_sim_msg_add_encr_end(msg
, data
->k_encr
,
629 EAP_SIM_AT_PADDING
)) {
630 wpa_printf(MSG_WARNING
, "EAP-AKA: Failed to "
631 "encrypt AT_ENCR_DATA");
632 eap_sim_msg_free(msg
);
637 wpa_printf(MSG_DEBUG
, " AT_MAC");
638 eap_sim_msg_add_mac(msg
, EAP_SIM_AT_MAC
);
640 return eap_sim_msg_finish(msg
, data
->eap_method
, data
->k_aut
, NULL
, 0);
644 static struct wpabuf
* eap_aka_buildReq(struct eap_sm
*sm
, void *priv
, u8 id
)
646 struct eap_aka_data
*data
= priv
;
648 data
->auts_reported
= 0;
649 switch (data
->state
) {
651 return eap_aka_build_identity(sm
, data
, id
);
653 return eap_aka_build_challenge(sm
, data
, id
);
655 return eap_aka_build_reauth(sm
, data
, id
);
657 return eap_aka_build_notification(sm
, data
, id
);
659 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unknown state %d in "
660 "buildReq", data
->state
);
667 static Boolean
eap_aka_check(struct eap_sm
*sm
, void *priv
,
668 struct wpabuf
*respData
)
670 struct eap_aka_data
*data
= priv
;
674 pos
= eap_hdr_validate(EAP_VENDOR_IETF
, data
->eap_method
, respData
,
676 if (pos
== NULL
|| len
< 3) {
677 wpa_printf(MSG_INFO
, "EAP-AKA: Invalid frame");
685 static Boolean
eap_aka_subtype_ok(struct eap_aka_data
*data
, u8 subtype
)
687 if (subtype
== EAP_AKA_SUBTYPE_CLIENT_ERROR
||
688 subtype
== EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT
)
691 switch (data
->state
) {
693 if (subtype
!= EAP_AKA_SUBTYPE_IDENTITY
) {
694 wpa_printf(MSG_INFO
, "EAP-AKA: Unexpected response "
695 "subtype %d", subtype
);
700 if (subtype
!= EAP_AKA_SUBTYPE_CHALLENGE
&&
701 subtype
!= EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE
) {
702 wpa_printf(MSG_INFO
, "EAP-AKA: Unexpected response "
703 "subtype %d", subtype
);
708 if (subtype
!= EAP_AKA_SUBTYPE_REAUTHENTICATION
) {
709 wpa_printf(MSG_INFO
, "EAP-AKA: Unexpected response "
710 "subtype %d", subtype
);
715 if (subtype
!= EAP_AKA_SUBTYPE_NOTIFICATION
) {
716 wpa_printf(MSG_INFO
, "EAP-AKA: Unexpected response "
717 "subtype %d", subtype
);
722 wpa_printf(MSG_INFO
, "EAP-AKA: Unexpected state (%d) for "
723 "processing a response", data
->state
);
731 static void eap_aka_determine_identity(struct eap_sm
*sm
,
732 struct eap_aka_data
*data
)
736 wpa_hexdump_ascii(MSG_DEBUG
, "EAP-AKA: Identity",
737 sm
->identity
, sm
->identity_len
);
739 username
= sim_get_username(sm
->identity
, sm
->identity_len
);
740 if (username
== NULL
) {
741 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
742 eap_aka_state(data
, NOTIFICATION
);
746 if (eap_aka_check_identity_reauth(sm
, data
, username
) > 0) {
751 if (((data
->eap_method
== EAP_TYPE_AKA_PRIME
&&
752 username
[0] == EAP_AKA_PRIME_REAUTH_ID_PREFIX
) ||
753 (data
->eap_method
== EAP_TYPE_AKA
&&
754 username
[0] == EAP_AKA_REAUTH_ID_PREFIX
)) &&
755 data
->identity_round
== 1) {
756 /* Remain in IDENTITY state for another round to request full
757 * auth identity since we did not recognize reauth id */
762 if ((data
->eap_method
== EAP_TYPE_AKA_PRIME
&&
763 username
[0] == EAP_AKA_PRIME_PSEUDONYM_PREFIX
) ||
764 (data
->eap_method
== EAP_TYPE_AKA
&&
765 username
[0] == EAP_AKA_PSEUDONYM_PREFIX
)) {
766 const char *permanent
;
767 wpa_printf(MSG_DEBUG
, "EAP-AKA: Pseudonym username '%s'",
769 permanent
= eap_sim_db_get_permanent(
770 sm
->eap_sim_db_priv
, username
);
772 if (permanent
== NULL
) {
773 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unknown pseudonym "
774 "identity - request permanent identity");
775 /* Remain in IDENTITY state for another round */
778 os_strlcpy(data
->permanent
, permanent
,
779 sizeof(data
->permanent
));
780 } else if ((data
->eap_method
== EAP_TYPE_AKA_PRIME
&&
781 username
[0] == EAP_AKA_PRIME_PERMANENT_PREFIX
) ||
782 (data
->eap_method
== EAP_TYPE_AKA
&&
783 username
[0] == EAP_AKA_PERMANENT_PREFIX
)) {
784 wpa_printf(MSG_DEBUG
, "EAP-AKA: Permanent username '%s'",
786 os_strlcpy(data
->permanent
, username
, sizeof(data
->permanent
));
789 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unrecognized username '%s'",
792 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
793 eap_aka_state(data
, NOTIFICATION
);
797 eap_aka_fullauth(sm
, data
);
801 static void eap_aka_fullauth(struct eap_sm
*sm
, struct eap_aka_data
*data
)
806 res
= eap_sim_db_get_aka_auth(sm
->eap_sim_db_priv
, data
->permanent
,
807 data
->rand
, data
->autn
, data
->ik
,
808 data
->ck
, data
->res
, &data
->res_len
, sm
);
809 if (res
== EAP_SIM_DB_PENDING
) {
810 wpa_printf(MSG_DEBUG
, "EAP-AKA: AKA authentication data "
811 "not yet available - pending request");
812 sm
->method_pending
= METHOD_PENDING_WAIT
;
816 if (data
->permanent
[0] == EAP_AKA_PERMANENT_PREFIX
||
817 data
->permanent
[0] == EAP_AKA_PRIME_PERMANENT_PREFIX
)
818 os_strlcpy(sm
->imsi
, &data
->permanent
[1], sizeof(sm
->imsi
));
820 #ifdef EAP_SERVER_AKA_PRIME
821 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
822 /* Note: AUTN = (SQN ^ AK) || AMF || MAC which gives us the
823 * needed 6-octet SQN ^AK for CK',IK' derivation */
824 eap_aka_prime_derive_ck_ik_prime(data
->ck
, data
->ik
,
827 data
->network_name_len
);
829 #endif /* EAP_SERVER_AKA_PRIME */
832 data
->counter
= 0; /* reset re-auth counter since this is full auth */
835 wpa_printf(MSG_INFO
, "EAP-AKA: Failed to get AKA "
836 "authentication data for the peer");
837 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
838 eap_aka_state(data
, NOTIFICATION
);
841 if (sm
->method_pending
== METHOD_PENDING_WAIT
) {
842 wpa_printf(MSG_DEBUG
, "EAP-AKA: AKA authentication data "
843 "available - abort pending wait");
844 sm
->method_pending
= METHOD_PENDING_NONE
;
847 identity_len
= sm
->identity_len
;
848 while (identity_len
> 0 && sm
->identity
[identity_len
- 1] == '\0') {
849 wpa_printf(MSG_DEBUG
, "EAP-AKA: Workaround - drop last null "
850 "character from identity");
853 wpa_hexdump_ascii(MSG_DEBUG
, "EAP-AKA: Identity for MK derivation",
854 sm
->identity
, identity_len
);
856 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
857 eap_aka_prime_derive_keys(sm
->identity
, identity_len
, data
->ik
,
858 data
->ck
, data
->k_encr
, data
->k_aut
,
859 data
->k_re
, data
->msk
, data
->emsk
);
861 eap_aka_derive_mk(sm
->identity
, identity_len
, data
->ik
,
863 eap_sim_derive_keys(data
->mk
, data
->k_encr
, data
->k_aut
,
864 data
->msk
, data
->emsk
);
867 eap_aka_state(data
, CHALLENGE
);
871 static void eap_aka_process_identity(struct eap_sm
*sm
,
872 struct eap_aka_data
*data
,
873 struct wpabuf
*respData
,
874 struct eap_sim_attrs
*attr
)
878 wpa_printf(MSG_DEBUG
, "EAP-AKA: Processing Identity");
880 if (attr
->mac
|| attr
->iv
|| attr
->encr_data
) {
881 wpa_printf(MSG_WARNING
, "EAP-AKA: Unexpected attribute "
882 "received in EAP-Response/AKA-Identity");
883 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
884 eap_aka_state(data
, NOTIFICATION
);
889 * We always request identity with AKA/Identity, so the peer is
890 * required to have replied with one.
892 if (!attr
->identity
|| attr
->identity_len
== 0) {
893 wpa_printf(MSG_DEBUG
, "EAP-AKA: Peer did not provide any "
895 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
896 eap_aka_state(data
, NOTIFICATION
);
900 new_identity
= os_malloc(attr
->identity_len
);
901 if (new_identity
== NULL
) {
902 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
903 eap_aka_state(data
, NOTIFICATION
);
906 os_free(sm
->identity
);
907 sm
->identity
= new_identity
;
908 os_memcpy(sm
->identity
, attr
->identity
, attr
->identity_len
);
909 sm
->identity_len
= attr
->identity_len
;
911 eap_aka_determine_identity(sm
, data
);
912 if (eap_get_id(respData
) == data
->pending_id
) {
913 data
->pending_id
= -1;
914 eap_aka_add_id_msg(data
, respData
);
919 static int eap_aka_verify_mac(struct eap_aka_data
*data
,
920 const struct wpabuf
*req
,
921 const u8
*mac
, const u8
*extra
,
924 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
)
925 return eap_sim_verify_mac_sha256(data
->k_aut
, req
, mac
, extra
,
927 return eap_sim_verify_mac(data
->k_aut
, req
, mac
, extra
, extra_len
);
931 static void eap_aka_process_challenge(struct eap_sm
*sm
,
932 struct eap_aka_data
*data
,
933 struct wpabuf
*respData
,
934 struct eap_sim_attrs
*attr
)
936 wpa_printf(MSG_DEBUG
, "EAP-AKA: Processing Challenge");
938 #ifdef EAP_SERVER_AKA_PRIME
940 /* KDF negotiation; to be enabled only after more than one KDF is
942 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
&&
943 attr
->kdf_count
== 1 && attr
->mac
== NULL
) {
944 if (attr
->kdf
[0] != EAP_AKA_PRIME_KDF
) {
945 wpa_printf(MSG_WARNING
, "EAP-AKA': Peer selected "
948 EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
949 eap_aka_state(data
, NOTIFICATION
);
953 data
->kdf
= attr
->kdf
[0];
955 /* Allow negotiation to continue with the selected KDF by
956 * sending another Challenge message */
957 wpa_printf(MSG_DEBUG
, "EAP-AKA': KDF %d selected", data
->kdf
);
961 #endif /* EAP_SERVER_AKA_PRIME */
963 if (attr
->checkcode
&&
964 eap_aka_verify_checkcode(data
, attr
->checkcode
,
965 attr
->checkcode_len
)) {
966 wpa_printf(MSG_WARNING
, "EAP-AKA: Invalid AT_CHECKCODE in the "
968 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
969 eap_aka_state(data
, NOTIFICATION
);
972 if (attr
->mac
== NULL
||
973 eap_aka_verify_mac(data
, respData
, attr
->mac
, NULL
, 0)) {
974 wpa_printf(MSG_WARNING
, "EAP-AKA: Challenge message "
975 "did not include valid AT_MAC");
976 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
977 eap_aka_state(data
, NOTIFICATION
);
982 * AT_RES is padded, so verify that there is enough room for RES and
983 * that the RES length in bits matches with the expected RES.
985 if (attr
->res
== NULL
|| attr
->res_len
< data
->res_len
||
986 attr
->res_len_bits
!= data
->res_len
* 8 ||
987 os_memcmp_const(attr
->res
, data
->res
, data
->res_len
) != 0) {
988 wpa_printf(MSG_WARNING
, "EAP-AKA: Challenge message did not "
989 "include valid AT_RES (attr len=%lu, res len=%lu "
990 "bits, expected %lu bits)",
991 (unsigned long) attr
->res_len
,
992 (unsigned long) attr
->res_len_bits
,
993 (unsigned long) data
->res_len
* 8);
994 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
995 eap_aka_state(data
, NOTIFICATION
);
999 wpa_printf(MSG_DEBUG
, "EAP-AKA: Challenge response includes the "
1001 if (sm
->eap_sim_aka_result_ind
&& attr
->result_ind
) {
1002 data
->use_result_ind
= 1;
1003 data
->notification
= EAP_SIM_SUCCESS
;
1004 eap_aka_state(data
, NOTIFICATION
);
1006 eap_aka_state(data
, SUCCESS
);
1008 if (data
->next_pseudonym
) {
1009 eap_sim_db_add_pseudonym(sm
->eap_sim_db_priv
, data
->permanent
,
1010 data
->next_pseudonym
);
1011 data
->next_pseudonym
= NULL
;
1013 if (data
->next_reauth_id
) {
1014 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
1015 #ifdef EAP_SERVER_AKA_PRIME
1016 eap_sim_db_add_reauth_prime(sm
->eap_sim_db_priv
,
1018 data
->next_reauth_id
,
1020 data
->k_encr
, data
->k_aut
,
1022 #endif /* EAP_SERVER_AKA_PRIME */
1024 eap_sim_db_add_reauth(sm
->eap_sim_db_priv
,
1026 data
->next_reauth_id
,
1030 data
->next_reauth_id
= NULL
;
1035 static void eap_aka_process_sync_failure(struct eap_sm
*sm
,
1036 struct eap_aka_data
*data
,
1037 struct wpabuf
*respData
,
1038 struct eap_sim_attrs
*attr
)
1040 wpa_printf(MSG_DEBUG
, "EAP-AKA: Processing Synchronization-Failure");
1042 if (attr
->auts
== NULL
) {
1043 wpa_printf(MSG_WARNING
, "EAP-AKA: Synchronization-Failure "
1044 "message did not include valid AT_AUTS");
1045 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
1046 eap_aka_state(data
, NOTIFICATION
);
1050 /* Avoid re-reporting AUTS when processing pending EAP packet by
1051 * maintaining a local flag stating whether this AUTS has already been
1053 if (!data
->auts_reported
&&
1054 eap_sim_db_resynchronize(sm
->eap_sim_db_priv
, data
->permanent
,
1055 attr
->auts
, data
->rand
)) {
1056 wpa_printf(MSG_WARNING
, "EAP-AKA: Resynchronization failed");
1057 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
1058 eap_aka_state(data
, NOTIFICATION
);
1061 data
->auts_reported
= 1;
1063 /* Remain in CHALLENGE state to re-try after resynchronization */
1064 eap_aka_fullauth(sm
, data
);
1068 static void eap_aka_process_reauth(struct eap_sm
*sm
,
1069 struct eap_aka_data
*data
,
1070 struct wpabuf
*respData
,
1071 struct eap_sim_attrs
*attr
)
1073 struct eap_sim_attrs eattr
;
1074 u8
*decrypted
= NULL
;
1076 wpa_printf(MSG_DEBUG
, "EAP-AKA: Processing Reauthentication");
1078 if (attr
->mac
== NULL
||
1079 eap_aka_verify_mac(data
, respData
, attr
->mac
, data
->nonce_s
,
1080 EAP_SIM_NONCE_S_LEN
)) {
1081 wpa_printf(MSG_WARNING
, "EAP-AKA: Re-authentication message "
1082 "did not include valid AT_MAC");
1086 if (attr
->encr_data
== NULL
|| attr
->iv
== NULL
) {
1087 wpa_printf(MSG_WARNING
, "EAP-AKA: Reauthentication "
1088 "message did not include encrypted data");
1092 decrypted
= eap_sim_parse_encr(data
->k_encr
, attr
->encr_data
,
1093 attr
->encr_data_len
, attr
->iv
, &eattr
,
1095 if (decrypted
== NULL
) {
1096 wpa_printf(MSG_WARNING
, "EAP-AKA: Failed to parse encrypted "
1097 "data from reauthentication message");
1101 if (eattr
.counter
!= data
->counter
) {
1102 wpa_printf(MSG_WARNING
, "EAP-AKA: Re-authentication message "
1103 "used incorrect counter %u, expected %u",
1104 eattr
.counter
, data
->counter
);
1110 wpa_printf(MSG_DEBUG
, "EAP-AKA: Re-authentication response includes "
1111 "the correct AT_MAC");
1113 if (eattr
.counter_too_small
) {
1114 wpa_printf(MSG_DEBUG
, "EAP-AKA: Re-authentication response "
1115 "included AT_COUNTER_TOO_SMALL - starting full "
1117 eap_aka_fullauth(sm
, data
);
1121 if (sm
->eap_sim_aka_result_ind
&& attr
->result_ind
) {
1122 data
->use_result_ind
= 1;
1123 data
->notification
= EAP_SIM_SUCCESS
;
1124 eap_aka_state(data
, NOTIFICATION
);
1126 eap_aka_state(data
, SUCCESS
);
1128 if (data
->next_reauth_id
) {
1129 if (data
->eap_method
== EAP_TYPE_AKA_PRIME
) {
1130 #ifdef EAP_SERVER_AKA_PRIME
1131 eap_sim_db_add_reauth_prime(sm
->eap_sim_db_priv
,
1133 data
->next_reauth_id
,
1135 data
->k_encr
, data
->k_aut
,
1137 #endif /* EAP_SERVER_AKA_PRIME */
1139 eap_sim_db_add_reauth(sm
->eap_sim_db_priv
,
1141 data
->next_reauth_id
,
1145 data
->next_reauth_id
= NULL
;
1147 eap_sim_db_remove_reauth(sm
->eap_sim_db_priv
, data
->reauth
);
1148 data
->reauth
= NULL
;
1154 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
1155 eap_aka_state(data
, NOTIFICATION
);
1156 eap_sim_db_remove_reauth(sm
->eap_sim_db_priv
, data
->reauth
);
1157 data
->reauth
= NULL
;
1162 static void eap_aka_process_client_error(struct eap_sm
*sm
,
1163 struct eap_aka_data
*data
,
1164 struct wpabuf
*respData
,
1165 struct eap_sim_attrs
*attr
)
1167 wpa_printf(MSG_DEBUG
, "EAP-AKA: Client reported error %d",
1168 attr
->client_error_code
);
1169 if (data
->notification
== EAP_SIM_SUCCESS
&& data
->use_result_ind
)
1170 eap_aka_state(data
, SUCCESS
);
1172 eap_aka_state(data
, FAILURE
);
1176 static void eap_aka_process_authentication_reject(
1177 struct eap_sm
*sm
, struct eap_aka_data
*data
,
1178 struct wpabuf
*respData
, struct eap_sim_attrs
*attr
)
1180 wpa_printf(MSG_DEBUG
, "EAP-AKA: Client rejected authentication");
1181 eap_aka_state(data
, FAILURE
);
1185 static void eap_aka_process_notification(struct eap_sm
*sm
,
1186 struct eap_aka_data
*data
,
1187 struct wpabuf
*respData
,
1188 struct eap_sim_attrs
*attr
)
1190 wpa_printf(MSG_DEBUG
, "EAP-AKA: Client replied to notification");
1191 if (data
->notification
== EAP_SIM_SUCCESS
&& data
->use_result_ind
)
1192 eap_aka_state(data
, SUCCESS
);
1194 eap_aka_state(data
, FAILURE
);
1198 static void eap_aka_process(struct eap_sm
*sm
, void *priv
,
1199 struct wpabuf
*respData
)
1201 struct eap_aka_data
*data
= priv
;
1202 const u8
*pos
, *end
;
1205 struct eap_sim_attrs attr
;
1207 pos
= eap_hdr_validate(EAP_VENDOR_IETF
, data
->eap_method
, respData
,
1209 if (pos
== NULL
|| len
< 3)
1216 if (eap_aka_subtype_ok(data
, subtype
)) {
1217 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unrecognized or unexpected "
1218 "EAP-AKA Subtype in EAP Response");
1219 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
1220 eap_aka_state(data
, NOTIFICATION
);
1224 if (eap_sim_parse_attr(pos
, end
, &attr
,
1225 data
->eap_method
== EAP_TYPE_AKA_PRIME
? 2 : 1,
1227 wpa_printf(MSG_DEBUG
, "EAP-AKA: Failed to parse attributes");
1228 data
->notification
= EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH
;
1229 eap_aka_state(data
, NOTIFICATION
);
1233 if (subtype
== EAP_AKA_SUBTYPE_CLIENT_ERROR
) {
1234 eap_aka_process_client_error(sm
, data
, respData
, &attr
);
1238 if (subtype
== EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT
) {
1239 eap_aka_process_authentication_reject(sm
, data
, respData
,
1244 switch (data
->state
) {
1246 eap_aka_process_identity(sm
, data
, respData
, &attr
);
1249 if (subtype
== EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE
) {
1250 eap_aka_process_sync_failure(sm
, data
, respData
,
1253 eap_aka_process_challenge(sm
, data
, respData
, &attr
);
1257 eap_aka_process_reauth(sm
, data
, respData
, &attr
);
1260 eap_aka_process_notification(sm
, data
, respData
, &attr
);
1263 wpa_printf(MSG_DEBUG
, "EAP-AKA: Unknown state %d in "
1264 "process", data
->state
);
1270 static Boolean
eap_aka_isDone(struct eap_sm
*sm
, void *priv
)
1272 struct eap_aka_data
*data
= priv
;
1273 return data
->state
== SUCCESS
|| data
->state
== FAILURE
;
1277 static u8
* eap_aka_getKey(struct eap_sm
*sm
, void *priv
, size_t *len
)
1279 struct eap_aka_data
*data
= priv
;
1282 if (data
->state
!= SUCCESS
)
1285 key
= os_memdup(data
->msk
, EAP_SIM_KEYING_DATA_LEN
);
1288 *len
= EAP_SIM_KEYING_DATA_LEN
;
1293 static u8
* eap_aka_get_emsk(struct eap_sm
*sm
, void *priv
, size_t *len
)
1295 struct eap_aka_data
*data
= priv
;
1298 if (data
->state
!= SUCCESS
)
1301 key
= os_memdup(data
->emsk
, EAP_EMSK_LEN
);
1304 *len
= EAP_EMSK_LEN
;
1309 static Boolean
eap_aka_isSuccess(struct eap_sm
*sm
, void *priv
)
1311 struct eap_aka_data
*data
= priv
;
1312 return data
->state
== SUCCESS
;
1316 static u8
* eap_aka_get_session_id(struct eap_sm
*sm
, void *priv
, size_t *len
)
1318 struct eap_aka_data
*data
= priv
;
1321 if (data
->state
!= SUCCESS
)
1325 *len
= 1 + EAP_AKA_RAND_LEN
+ EAP_AKA_AUTN_LEN
;
1327 *len
= 1 + EAP_SIM_NONCE_S_LEN
+ EAP_SIM_MAC_LEN
;
1328 id
= os_malloc(*len
);
1332 id
[0] = data
->eap_method
;
1333 if (!data
->reauth
) {
1334 os_memcpy(id
+ 1, data
->rand
, EAP_AKA_RAND_LEN
);
1335 os_memcpy(id
+ 1 + EAP_AKA_RAND_LEN
, data
->autn
,
1338 os_memcpy(id
+ 1, data
->nonce_s
, EAP_SIM_NONCE_S_LEN
);
1339 os_memcpy(id
+ 1 + EAP_SIM_NONCE_S_LEN
, data
->reauth_mac
,
1342 wpa_hexdump(MSG_DEBUG
, "EAP-AKA: Derived Session-Id", id
, *len
);
1348 int eap_server_aka_register(void)
1350 struct eap_method
*eap
;
1352 eap
= eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION
,
1353 EAP_VENDOR_IETF
, EAP_TYPE_AKA
, "AKA");
1357 eap
->init
= eap_aka_init
;
1358 eap
->reset
= eap_aka_reset
;
1359 eap
->buildReq
= eap_aka_buildReq
;
1360 eap
->check
= eap_aka_check
;
1361 eap
->process
= eap_aka_process
;
1362 eap
->isDone
= eap_aka_isDone
;
1363 eap
->getKey
= eap_aka_getKey
;
1364 eap
->isSuccess
= eap_aka_isSuccess
;
1365 eap
->get_emsk
= eap_aka_get_emsk
;
1366 eap
->getSessionId
= eap_aka_get_session_id
;
1368 return eap_server_method_register(eap
);
1372 #ifdef EAP_SERVER_AKA_PRIME
1373 int eap_server_aka_prime_register(void)
1375 struct eap_method
*eap
;
1377 eap
= eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION
,
1378 EAP_VENDOR_IETF
, EAP_TYPE_AKA_PRIME
,
1383 eap
->init
= eap_aka_prime_init
;
1384 eap
->reset
= eap_aka_reset
;
1385 eap
->buildReq
= eap_aka_buildReq
;
1386 eap
->check
= eap_aka_check
;
1387 eap
->process
= eap_aka_process
;
1388 eap
->isDone
= eap_aka_isDone
;
1389 eap
->getKey
= eap_aka_getKey
;
1390 eap
->isSuccess
= eap_aka_isSuccess
;
1391 eap
->get_emsk
= eap_aka_get_emsk
;
1392 eap
->getSessionId
= eap_aka_get_session_id
;
1394 return eap_server_method_register(eap
);
1396 #endif /* EAP_SERVER_AKA_PRIME */