From: Arran Cudbard-Bell Date: Thu, 1 Apr 2021 16:32:15 +0000 (+0100) Subject: Move checkcode calculations from state machine to module X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3d1b2d9532a31e1c3f59a6dd68fc53577155ee0b;p=thirdparty%2Ffreeradius-server.git Move checkcode calculations from state machine to module --- diff --git a/src/lib/eap_aka_sim/base.h b/src/lib/eap_aka_sim/base.h index 64e8b5608b6..4e59dfc2e8b 100644 --- a/src/lib/eap_aka_sim/base.h +++ b/src/lib/eap_aka_sim/base.h @@ -285,7 +285,7 @@ int fr_aka_sim_crypto_init_checkcode(TALLOC_CTX *ctx, fr_aka_sim_checkcode_t ** int fr_aka_sim_crypto_update_checkcode(fr_aka_sim_checkcode_t *checkcode, eap_packet_t *eap_packet); -ssize_t fr_aka_sim_crypto_finalise_checkcode(uint8_t *out, fr_aka_sim_checkcode_t **checkcode); +ssize_t fr_aka_sim_crypto_finalise_checkcode(TALLOC_CTX *ctx, uint8_t **out, fr_aka_sim_checkcode_t *checkcode); ssize_t fr_aka_sim_crypto_sign_packet(uint8_t out[static AKA_SIM_MAC_DIGEST_SIZE], eap_packet_t *eap_packet, bool zero_mac, diff --git a/src/lib/eap_aka_sim/crypto.c b/src/lib/eap_aka_sim/crypto.c index 4a283b3872c..2b5512e6621 100644 --- a/src/lib/eap_aka_sim/crypto.c +++ b/src/lib/eap_aka_sim/crypto.c @@ -179,26 +179,28 @@ int fr_aka_sim_crypto_update_checkcode(fr_aka_sim_checkcode_t *checkcode, eap_pa /** Write out the final checkcode value * - * @param[out] out Where to write the checkcode value. Must be at least 20 + * @param[in] ctx ctx to allocate buffer containing the checkcode. + * @param[out] out talloced buffer containing the checkcode. * bytes if MD was SHA1, or 32 bytes if MD was SHA256. * @param[in,out] checkcode structure to get final digest from and to tree. * @return * - <= 0 on failure. * - > 0 the number of bytes written to out. */ -ssize_t fr_aka_sim_crypto_finalise_checkcode(uint8_t *out, fr_aka_sim_checkcode_t **checkcode) +ssize_t fr_aka_sim_crypto_finalise_checkcode(TALLOC_CTX *ctx, uint8_t **out, fr_aka_sim_checkcode_t *checkcode) { - unsigned int len; + size_t len; + uint8_t *buff; - if (EVP_DigestFinal_ex((*checkcode)->md_ctx, out, &len) != 1) { + len = (size_t)EVP_MD_CTX_size((*checkcode).md_ctx); + MEM(buff = talloc_array(ctx, uint8_t, len)); + if (EVP_DigestFinal_ex((*checkcode).md_ctx, buff, NULL) != 1) { tls_strerror_printf("Failed finalising checkcode digest"); - TALLOC_FREE(*checkcode); return -1; } + *out = buff; - TALLOC_FREE(*checkcode); - - return len; + return (size_t)len; } /** Locate the start of the AT_MAC value in the buffer diff --git a/src/lib/eap_aka_sim/module.c b/src/lib/eap_aka_sim/module.c index 091e376414e..7e2230c1693 100644 --- a/src/lib/eap_aka_sim/module.c +++ b/src/lib/eap_aka_sim/module.c @@ -64,6 +64,7 @@ static unlang_action_t mod_encode(rlm_rcode_t *p_result, module_ctx_t const *mct fr_aka_sim_ctx_t encode_ctx; uint8_t const *request_hmac_extra = NULL; size_t request_hmac_extra_len = 0; + fr_pair_t *vp; int ret; /* @@ -105,9 +106,6 @@ static unlang_action_t mod_encode(rlm_rcode_t *p_result, module_ctx_t const *mct return UNLANG_ACTION_CALCULATE_RESULT; } - RDEBUG2("Encoding attributes"); - log_request_pair_list(L_DBG_LVL_2, request, NULL, &request->reply_pairs, NULL); - /* * It's not an EAP-Success or an EAP-Failure * it's a real EAP-SIM/AKA/AKA' response. @@ -132,25 +130,21 @@ static unlang_action_t mod_encode(rlm_rcode_t *p_result, module_ctx_t const *mct * of request we're sending. */ switch (subtype_vp->vp_uint16) { - case FR_SUBTYPE_VALUE_SIM_START: case FR_SUBTYPE_VALUE_AKA_IDENTITY: - { - fr_pair_t *id_vp; - + case FR_SUBTYPE_VALUE_SIM_START: if (RDEBUG_ENABLED2) break; /* * Figure out if the state machine is * requesting an ID. */ - if ((id_vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_any_id_req)) || - (id_vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_fullauth_id_req)) || - (id_vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_permanent_id_req))) { - RDEBUG2("Sending EAP-Request/%pV (%s)", &subtype_vp->data, id_vp->da->name); + if ((vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_any_id_req)) || + (vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_fullauth_id_req)) || + (vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_permanent_id_req))) { + RDEBUG2("Sending EAP-Request/%pV (%s)", &subtype_vp->data, vp->da->name); } else { RDEBUG2("Sending EAP-Request/%pV", &subtype_vp->data); } - } break; /* @@ -164,29 +158,39 @@ static unlang_action_t mod_encode(rlm_rcode_t *p_result, module_ctx_t const *mct * it should have used that. */ case FR_SUBTYPE_VALUE_AKA_CHALLENGE: - { - fr_pair_t *bidding_vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_bidding); + vp = fr_pair_find_by_da(&request->reply_pairs, attr_eap_aka_sim_bidding); /* * Explicit NO */ if (inst->aka.send_at_bidding_prefer_prime_is_set && !inst->aka.send_at_bidding_prefer_prime) { - if (bidding_vp) pair_delete_reply(attr_eap_aka_sim_bidding); + if (vp) pair_delete_reply(attr_eap_aka_sim_bidding); /* * Implicit or explicit YES */ } else if (inst->aka.send_at_bidding_prefer_prime) { - MEM(pair_append_reply(&bidding_vp, attr_eap_aka_sim_bidding) >= 0); - bidding_vp->vp_uint16 = FR_BIDDING_VALUE_PREFER_AKA_PRIME; + MEM(pair_append_reply(&vp, attr_eap_aka_sim_bidding) >= 0); + vp->vp_uint16 = FR_BIDDING_VALUE_PREFER_AKA_PRIME; } - } FALL_THROUGH; case FR_SUBTYPE_VALUE_SIM_CHALLENGE: case FR_SUBTYPE_VALUE_AKA_SIM_REAUTHENTICATION: - { - fr_pair_t *vp; + /* + * Include our copy of the checkcode if we've been + * calculating it. + */ + if (mod_session->checkcode_state) { + uint8_t *checkcode; + + MEM(pair_update_reply(&vp, attr_eap_aka_sim_checkcode) >= 0); + if (fr_aka_sim_crypto_finalise_checkcode(vp, &checkcode, mod_session->checkcode_state) < 0) { + RPWDEBUG("Failed calculating checkcode"); + pair_delete_reply(vp); + } + fr_pair_value_memdup_buffer_shallow(vp, checkcode, false); /* Buffer already in the correct ctx */ + } /* * Extra data to append to the packet when signing. @@ -228,7 +232,6 @@ static unlang_action_t mod_encode(rlm_rcode_t *p_result, module_ctx_t const *mct } fr_assert(mod_session->ctx.k_encr && mod_session->ctx.k_aut); - } FALL_THROUGH; default: @@ -241,10 +244,34 @@ static unlang_action_t mod_encode(rlm_rcode_t *p_result, module_ctx_t const *mct encode_ctx.hmac_extra = request_hmac_extra; encode_ctx.hmac_extra_len = request_hmac_extra_len; + RDEBUG2("Encoding attributes"); + log_request_pair_list(L_DBG_LVL_2, request, NULL, &request->reply_pairs, NULL); ret = fr_aka_sim_encode(request, &request->reply_pairs, &encode_ctx); - if (ret <= 0) { /* No valid packets have length 0 */ - RPEDEBUG("Failed encoding response"); - RETURN_MODULE_FAIL; + if (ret <= 0) RETURN_MODULE_FAIL; + + switch (subtype_vp->vp_uint16) { + case FR_SUBTYPE_VALUE_AKA_IDENTITY: + /* + * Ingest the identity message into the checkcode + */ + if (mod_session->ctx.checkcode_md) { + RDEBUG2("Updating checkcode"); + if (!mod_session->checkcode_state && + (fr_aka_sim_crypto_init_checkcode(mod_session, &mod_session->checkcode_state, + mod_session->ctx.checkcode_md) < 0)) { + RPWDEBUG("Failed initialising checkcode"); + break; + } + + if (fr_aka_sim_crypto_update_checkcode(mod_session->checkcode_state, + eap_session->this_round->request) < 0) { + RPWDEBUG("Failed updating checkcode"); + } + } + break; + + default: + break; } return UNLANG_ACTION_CALCULATE_RESULT; /* rcode is already correct */ @@ -312,10 +339,53 @@ unlang_action_t eap_aka_sim_process(rlm_rcode_t *p_result, module_ctx_t const *m } subtype_vp = fr_pair_find_by_da(&request->request_pairs, attr_eap_aka_sim_subtype); - if (subtype_vp) { - RDEBUG2("Received EAP-Response/%pV", &(subtype_vp)->data); - } else { - REDEBUG2("Missing Sub-Type"); + if (!subtype_vp) { + REDEBUG2("Missing Sub-Type"); /* Let the state machine enter the right state */ + break; + } + + RDEBUG2("Received EAP-Response/%pV", &(subtype_vp)->data); + + switch (subtype_vp->vp_uint16) { + /* + * Ingest the identity message into the checkcode + */ + case FR_SUBTYPE_VALUE_AKA_IDENTITY: + if (mod_session->checkcode_state) { + RDEBUG2("Updating checkcode"); + if (fr_aka_sim_crypto_update_checkcode(mod_session->checkcode_state, + eap_session->this_round->response) < 0) { + RPWDEBUG("Failed updating checkcode"); + } + } + break; + + case FR_SUBTYPE_VALUE_AKA_CHALLENGE: + case FR_SUBTYPE_VALUE_AKA_SIM_REAUTHENTICATION: + /* + * Include our copy of the checkcode if we've been + * calculating it. This is put in the control list + * so the state machine can check they're identical. + * + * This lets us simulate checkcode failures easily + * when testing the state machine. + */ + if (mod_session->checkcode_state) { + uint8_t *checkcode; + fr_pair_t *vp; + + MEM(pair_update_control(&vp, attr_eap_aka_sim_checkcode) >= 0); + if (fr_aka_sim_crypto_finalise_checkcode(vp, &checkcode, mod_session->checkcode_state) < 0) { + RPWDEBUG("Failed calculating checkcode"); + pair_delete_control(vp); + } + fr_pair_value_memdup_buffer_shallow(vp, checkcode, false); /* Buffer already in the correct ctx */ + + } + break; + + default: + break; } break; } diff --git a/src/lib/eap_aka_sim/module.h b/src/lib/eap_aka_sim/module.h index 0e990614309..a900ea38eb0 100644 --- a/src/lib/eap_aka_sim/module.h +++ b/src/lib/eap_aka_sim/module.h @@ -73,6 +73,7 @@ typedef struct { ///< before validating. size_t response_hmac_extra_len; + fr_aka_sim_checkcode_t *checkcode_state; //!< Digest of all identity packets we've seen. fr_aka_sim_ctx_t ctx; } eap_aka_sim_mod_session_t; diff --git a/src/lib/eap_aka_sim/state_machine.c b/src/lib/eap_aka_sim/state_machine.c index e5b148a3a53..c4179a6483a 100644 --- a/src/lib/eap_aka_sim/state_machine.c +++ b/src/lib/eap_aka_sim/state_machine.c @@ -501,6 +501,52 @@ static int identity_to_permanent_identity(request_t *request, fr_pair_t *in, eap return 0; } +/** Check &control.checkcode matches &reply.checkcode + * + * @param[in] request The current request. + * @return + * - 1 if the check was skipped. + * - 0 if the check was successful. + * - -1 if the check failed. + */ +static int checkcode_validate(request_t *request) +{ + fr_pair_t *peer_checkcode, *our_checkcode; + /* + * Checkcode validation + * + * The actual cryptographic calculations are + * done by the calling module, we just check + * the result. + */ + our_checkcode = fr_pair_find_by_da(&request->control_pairs, attr_eap_aka_sim_checkcode); + if (our_checkcode) { + /* + * If the peer doesn't include a checkcode then that + * means they don't support it, and we can't validate + * their view of the identity packets. + */ + peer_checkcode = fr_pair_find_by_da(&request->request_pairs, attr_eap_aka_sim_checkcode); + if (peer_checkcode) { + if (fr_pair_cmp(peer_checkcode, our_checkcode) == 0) { + RDEBUG2("Received checkcode matches calculated checkcode"); + return 0; + } else { + REDEBUG("Received checkcode does not match calculated checkcode"); + RHEXDUMP_INLINE2(peer_checkcode->vp_octets, peer_checkcode->vp_length, "Received"); + RHEXDUMP_INLINE2(our_checkcode->vp_octets, our_checkcode->vp_length, "Expected"); + return -1; + } + /* + * Only print something if we calculated a checkcode + */ + } else { + RDEBUG2("Peer didn't include AT_CHECKCODE, skipping checkcode validation"); + } + } + return 1; +} + /** Set the crypto identity from a received identity * */ @@ -1551,10 +1597,6 @@ RESUME(recv_common_reauthentication_response) ssize_t slen; fr_pair_t *mac; -#if 0 - *checkcode; -#endif - SECTION_RCODE_PROCESS; mac = fr_pair_find_by_da(&request->request_pairs, attr_eap_aka_sim_mac); @@ -1592,37 +1634,10 @@ RESUME(recv_common_reauthentication_response) goto failure; } -#if 0 - /* - * If the peer doesn't include a checkcode then that - * means they don't support it, and we can't validate - * their view of the identity packets. - */ - checkcode = fr_pair_find_by_da(&request->request_pairs, attr_eap_aka_sim_checkcode); - if (checkcode) { - if (checkcode->vp_length != eap_aka_sim_session->checkcode_len) { - REDEBUG("Received checkcode's length (%zu) does not match calculated checkcode's length (%zu)", - checkcode->vp_length, eap_aka_sim_session->checkcode_len); - goto failure; - } - - if (memcmp(checkcode->vp_octets, eap_aka_sim_session->checkcode, - eap_aka_sim_session->checkcode_len) == 0) { - RDEBUG2("Received checkcode matches calculated checkcode"); - } else { - REDEBUG("Received checkcode does not match calculated checkcode"); - RHEXDUMP_INLINE2(checkcode->vp_octets, checkcode->vp_length, "Received"); - RHEXDUMP_INLINE2(eap_aka_sim_session->checkcode, - eap_aka_sim_session->checkcode_len, "Expected"); - goto failure; - } /* - * Only print something if we calculated a checkcode + * Validate the checkcode */ - } else if (eap_aka_sim_session->checkcode_len > 0){ - RDEBUG2("Peer didn't include AT_CHECKCODE, skipping checkcode validation"); - } -#endif + if (checkcode_validate(request) < 0) goto failure; /* * Check to see if the supplicant sent @@ -1841,41 +1856,6 @@ static unlang_action_t common_reauthentication_request_compose(rlm_rcode_t *p_re MEM(pair_update_reply(&vp, attr_eap_aka_sim_mac) >= 0); fr_pair_value_memdup(vp, NULL, 0, false); -#if 0 - /* - * If there's no checkcode_md we're not doing - * checkcodes. - */ - if (eap_aka_sim_session->checkcode_md) { - /* - * If we have checkcode data, send that to the peer - * in AT_CHECKCODE for validation. - */ - if (eap_aka_sim_session->checkcode_state) { - ssize_t slen; - - slen = fr_aka_sim_crypto_finalise_checkcode(eap_aka_sim_session->checkcode, - &eap_aka_sim_session->checkcode_state); - if (slen < 0) { - RPEDEBUG("Failed calculating checkcode"); - goto failure; - } - eap_aka_sim_session->checkcode_len = slen; - - MEM(pair_update_reply(&vp, attr_eap_aka_sim_checkcode) >= 0); - fr_pair_value_memdup(vp, eap_aka_sim_session->checkcode, slen, false); - /* - * If we don't have checkcode data, then we exchanged - * no identity packets, so checkcode is zero. - */ - } else { - MEM(pair_update_reply(&vp, attr_eap_aka_sim_checkcode) >= 0); - fr_pair_value_memdup(vp, NULL, 0, false); - eap_aka_sim_session->checkcode_len = 0; - } - } -#endif - /* * We've sent the challenge so the peer should now be able * to accept encrypted attributes. @@ -2172,9 +2152,7 @@ RESUME(recv_aka_challenge_response) uint8_t calc_mac[AKA_SIM_MAC_DIGEST_SIZE]; ssize_t slen; fr_pair_t *vp = NULL, *mac; -#if 0 - *checkcode; -#endif + SECTION_RCODE_PROCESS; @@ -2213,39 +2191,9 @@ RESUME(recv_aka_challenge_response) } /* - * If the peer doesn't include a checkcode then that - * means they don't support it, and we can't validate - * their view of the identity packets. + * Validate the checkcode */ -#if 0 - if (eap_aka_sim_session->checkcode_md) { - checkcode = fr_pair_find_by_da(&request->request_pairs, attr_eap_aka_sim_checkcode); - if (checkcode) { - if (checkcode->vp_length != eap_aka_sim_session->checkcode_len) { - REDEBUG("Received checkcode's length (%zu) does not match " - "calculated checkcode's length (%zu)", - checkcode->vp_length, eap_aka_sim_session->checkcode_len); - goto failure; - } - - if (memcmp(checkcode->vp_octets, - eap_aka_sim_session->checkcode, eap_aka_sim_session->checkcode_len) == 0) { - RDEBUG2("Received checkcode matches calculated checkcode"); - } else { - REDEBUG("Received checkcode does not match calculated checkcode"); - RHEXDUMP_INLINE2(checkcode->vp_octets, checkcode->vp_length, "Received"); - RHEXDUMP_INLINE2(eap_aka_sim_session->checkcode, - eap_aka_sim_session->checkcode_len, "Expected"); - goto failure; - } - /* - * Only print something if we calculated a checkcode - */ - } else if (eap_aka_sim_session->checkcode_len > 0){ - RDEBUG2("Peer didn't include AT_CHECKCODE, skipping checkcode validation"); - } - } -#endif + if (checkcode_validate(request) < 0) goto failure; vp = fr_pair_find_by_da(&request->request_pairs, attr_eap_aka_sim_res); if (!vp) { @@ -2525,35 +2473,6 @@ RESUME(send_aka_challenge_request) MEM(pair_update_reply(&vp, attr_eap_aka_sim_mac) >= 0); fr_pair_value_memdup(vp, NULL, 0, false); -#if 0 - /* - * If we have checkcode data, send that to the peer - * in AT_CHECKCODE for validation. - */ - if (eap_aka_sim_session->checkcode_state) { - ssize_t slen; - - slen = fr_aka_sim_crypto_finalise_checkcode(eap_aka_sim_session->checkcode, - &eap_aka_sim_session->checkcode_state); - if (slen < 0) { - RPEDEBUG("Failed calculating checkcode"); - goto failure; - } - eap_aka_sim_session->checkcode_len = slen; - - MEM(pair_update_reply(&vp, attr_eap_aka_sim_checkcode) >= 0); - fr_pair_value_memdup(vp, eap_aka_sim_session->checkcode, slen, false); - /* - * If we don't have checkcode data, then we exchanged - * no identity packets, so AT_CHECKCODE is zero. - */ - } else { - MEM(pair_update_reply(&vp, attr_eap_aka_sim_checkcode) >= 0); - fr_pair_value_memdup(vp, NULL, 0, false); - eap_aka_sim_session->checkcode_len = 0; - } -#endif - /* * We've sent the challenge so the peer should now be able * to accept encrypted attributes. @@ -2913,21 +2832,6 @@ RESUME(recv_aka_identity_response) SECTION_RCODE_PROCESS; -#if 0 - /* - * Digest the identity response - */ - if (eap_aka_sim_session->checkcode_md) { - // TODO: Need another way of doing this - if (fr_aka_sim_crypto_update_checkcode(eap_aka_sim_session->checkcode_state, - eap_session->this_round->response) < 0) { - RPEDEBUG("Failed updating checkcode"); - failure: - return STATE_TRANSITION(common_failure_notification); - } - } -#endif - /* * See if the user wants us to request another * identity. @@ -3140,26 +3044,6 @@ RESUME(send_aka_identity_request) */ common_reply(request, eap_aka_sim_session, FR_SUBTYPE_VALUE_AKA_IDENTITY); -#if 0 - /* - * Digest the packet contents, updating our checkcode. - */ - if (eap_aka_sim_session->checkcode_md) { - if (!eap_aka_sim_session->checkcode_state && - fr_aka_sim_crypto_init_checkcode(eap_aka_sim_session, &eap_aka_sim_session->checkcode_state, - eap_aka_sim_session->checkcode_md) < 0) { - RPEDEBUG("Failed initialising checkcode"); - goto failure; - } - // TODO: Need another way of doing this - if (fr_aka_sim_crypto_update_checkcode(eap_aka_sim_session->checkcode_state, - eap_session->this_round->request) < 0) { - RPEDEBUG("Failed updating checkcode"); - goto failure; - } - } -#endif - RETURN_MODULE_HANDLED; } @@ -3582,7 +3466,7 @@ RESUME(recv_common_identity_response) running = AKA_SIM_METHOD_HINT_SIM; eap_aka_sim_session->type = FR_EAP_METHOD_SIM; - eap_aka_sim_session->mac_md = EVP_sha1(); /* no checkcode support, so no checkcode_md */ + eap_aka_sim_session->mac_md = EVP_sha1(); break; case FR_EAP_METHOD_AKA: @@ -3591,7 +3475,7 @@ RESUME(recv_common_identity_response) running = AKA_SIM_METHOD_HINT_AKA; eap_aka_sim_session->type = FR_EAP_METHOD_AKA; - eap_aka_sim_session->checkcode_md = eap_aka_sim_session->mac_md = EVP_sha1(); + eap_aka_sim_session->mac_md = EVP_sha1(); break; case FR_EAP_METHOD_AKA_PRIME: @@ -3601,7 +3485,7 @@ RESUME(recv_common_identity_response) eap_aka_sim_session->type = FR_EAP_METHOD_AKA_PRIME; eap_aka_sim_session->kdf = FR_KDF_VALUE_PRIME_WITH_CK_PRIME_IK_PRIME; - eap_aka_sim_session->checkcode_md = eap_aka_sim_session->mac_md = EVP_sha256(); + eap_aka_sim_session->mac_md = EVP_sha256(); break; default: diff --git a/src/lib/eap_aka_sim/state_machine.h b/src/lib/eap_aka_sim/state_machine.h index cd5a4602525..de5140baea0 100644 --- a/src/lib/eap_aka_sim/state_machine.h +++ b/src/lib/eap_aka_sim/state_machine.h @@ -97,13 +97,6 @@ struct eap_aka_sim_session_s { fr_aka_sim_keys_t keys; //!< Various EAP-AKA/AKA'/SIMkeys. - EVP_MD const *checkcode_md; //!< Message digest we use to generate the - ///< checkcode. EVP_sha1() for EAP-AKA/SIM, - ///< EVP_sha256() for EAP-AKA'. - fr_aka_sim_checkcode_t *checkcode_state; //!< Digest of all identity packets we've seen. - uint8_t checkcode[32]; //!< Checkcode we calculated. - size_t checkcode_len; //!< 0, 20 or 32 bytes. - uint16_t kdf; //!< The key derivation function used to derive ///< session keys. @@ -225,9 +218,6 @@ typedef struct { ///< EVP_sha1() for EAP-AKA, EVP_sha256() ///< for EAP-AKA'. - EVP_MD const *checkcode_md; //!< The hmac used for validating packets - ///< checkcodes. - eap_aka_sim_actions_t actions; //!< Pre-compiled virtual server sections. } eap_aka_sim_process_conf_t; diff --git a/src/modules/rlm_eap/types/rlm_eap_aka/eap_aka.h b/src/modules/rlm_eap/types/rlm_eap_aka/eap_aka.h index 4a46d40d18a..f405dad5ad2 100644 --- a/src/modules/rlm_eap/types/rlm_eap_aka/eap_aka.h +++ b/src/modules/rlm_eap/types/rlm_eap_aka/eap_aka.h @@ -123,13 +123,6 @@ typedef struct { bool send_at_bidding; //!< Indicate that we prefer EAP-AKA' and ///< include an AT_BIDDING attribute. - EVP_MD const *checkcode_md; //!< Message digest we use to generate the - ///< checkcode. EVP_sha1() for EAP-AKA, - ///< EVP_sha256() for EAP-AKA'. - fr_sim_checkcode_t *checkcode_state; //!< Digest of all identity packets we've seen. - uint8_t checkcode[32]; //!< Checkcode we calculated. - size_t checkcode_len; //!< 0, 20 or 32 bytes. - EVP_MD const *mac_md; //!< HMAC-MD we use to generate the MAC. ///< EVP_sha1() for EAP-AKA, EVP_sha256() ///< for EAP-AKA'.