← Back to branch summary

~ubuntu-branches/ubuntu/vivid/wpasupplicant/vivid

« back to all changes in this revision

Viewing changes to src/eap_server/eap_aka.c

  • Committer: Bazaar Package Importer
  • Author(s): Kel Modderman
  • Date: 2008-03-12 20:03:04 UTC
  • mfrom: (1.1.10 upstream)
  • mto: This revision was merged to the branch mainline in revision 4.
  • Revision ID: james.westby@ubuntu.com-20080312200304-4331y9wj46pdd34z
Tags: 0.6.3-1
http://bugs.debian.org/466910
* New upstream release.
* Drop patches applied upstream:
  - debian/patches/30_wpa_gui_qt4_eventhistoryui_rework.patch
  - debian/patches/31_wpa_gui_qt4_eventhistory_always_scrollbar.patch
  - debian/patches/32_wpa_gui_qt4_eventhistory_scroll_with_events.patch
  - debian/patches/40_dbus_ssid_data.patch
* Tidy up the clean target of debian/rules. Now that the madwifi headers are
  handled differently we no longer need to do any cleanup.
* Fix formatting error in debian/ifupdown/wpa_action.8 to make lintian
  quieter.
* Add patch to fix formatting errors in manpages build from sgml source. Use
  <emphasis> tags to hightlight keywords instead of surrounding them in
  strong quotes.
  - debian/patches/41_manpage_format_fixes.patch
* wpasupplicant binary package no longer suggests pcscd, guessnet, iproute
  or wireless-tools, nor does it recommend dhcp3-client. These are not
  needed.
* Add debian/patches/10_silence_siocsiwauth_icotl_failure.patch to disable
  ioctl failure messages that occur under normal conditions.
* Cherry pick two upstream git commits concerning the dbus interface:
  - debian/patches/11_avoid_dbus_version_namespace.patch
  - debian/patches/12_fix_potential_use_after_free.patch
* Add debian/patches/42_manpage_explain_available_drivers.patch to explain
  that not all of the driver backends are available in the provided
  wpa_supplicant binary, and that the canonical list of supported driver
  backends can be retrieved from the wpa_supplicant -h (help) output.
  (Closes: #466910)
* Add debian/patches/20_wpa_gui_qt4_disable_link_prl.patch to remove
  link_prl CONFIG compile flag added by qmake-qt4 >= 4.3.4-2 to avoid excess
  linking.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/eap_server/eap_aka.c
 
1
/*
 
2
 * hostapd / EAP-AKA (RFC 4187)
 
3
 * Copyright (c) 2005-2008, Jouni Malinen <j@w1.fi>
 
4
 *
 
5
 * This program is free software; you can redistribute it and/or modify
 
6
 * it under the terms of the GNU General Public License version 2 as
 
7
 * published by the Free Software Foundation.
 
8
 *
 
9
 * Alternatively, this software may be distributed under the terms of BSD
 
10
 * license.
 
11
 *
 
12
 * See README and COPYING for more details.
 
13
 */
 
14
 
 
15
#include "includes.h"
 
16
 
 
17
#include "common.h"
 
18
#include "eap_server/eap_i.h"
 
19
#include "eap_common/eap_sim_common.h"
 
20
#include "eap_server/eap_sim_db.h"
 
21
#include "sha1.h"
 
22
#include "crypto.h"
 
23
 
 
24
 
 
25
struct eap_aka_data {
 
26
        u8 mk[EAP_SIM_MK_LEN];
 
27
        u8 nonce_s[EAP_SIM_NONCE_S_LEN];
 
28
        u8 k_aut[EAP_SIM_K_AUT_LEN];
 
29
        u8 k_encr[EAP_SIM_K_ENCR_LEN];
 
30
        u8 msk[EAP_SIM_KEYING_DATA_LEN];
 
31
        u8 emsk[EAP_EMSK_LEN];
 
32
        u8 rand[EAP_AKA_RAND_LEN];
 
33
        u8 autn[EAP_AKA_AUTN_LEN];
 
34
        u8 ck[EAP_AKA_CK_LEN];
 
35
        u8 ik[EAP_AKA_IK_LEN];
 
36
        u8 res[EAP_AKA_RES_MAX_LEN];
 
37
        size_t res_len;
 
38
        enum {
 
39
                IDENTITY, CHALLENGE, REAUTH, NOTIFICATION, SUCCESS, FAILURE
 
40
        } state;
 
41
        char *next_pseudonym;
 
42
        char *next_reauth_id;
 
43
        u16 counter;
 
44
        struct eap_sim_reauth *reauth;
 
45
        int auts_reported; /* whether the current AUTS has been reported to the
 
46
                            * eap_sim_db */
 
47
        u16 notification;
 
48
        int use_result_ind;
 
49
 
 
50
        struct wpabuf *id_msgs;
 
51
        int pending_id;
 
52
};
 
53
 
 
54
 
 
55
static void eap_aka_determine_identity(struct eap_sm *sm,
 
56
                                       struct eap_aka_data *data,
 
57
                                       int before_identity, int after_reauth);
 
58
 
 
59
 
 
60
static const char * eap_aka_state_txt(int state)
 
61
{
 
62
        switch (state) {
 
63
        case IDENTITY:
 
64
                return "IDENTITY";
 
65
        case CHALLENGE:
 
66
                return "CHALLENGE";
 
67
        case REAUTH:
 
68
                return "REAUTH";
 
69
        case SUCCESS:
 
70
                return "SUCCESS";
 
71
        case FAILURE:
 
72
                return "FAILURE";
 
73
        case NOTIFICATION:
 
74
                return "NOTIFICATION";
 
75
        default:
 
76
                return "Unknown?!";
 
77
        }
 
78
}
 
79
 
 
80
 
 
81
static void eap_aka_state(struct eap_aka_data *data, int state)
 
82
{
 
83
        wpa_printf(MSG_DEBUG, "EAP-AKA: %s -> %s",
 
84
                   eap_aka_state_txt(data->state),
 
85
                   eap_aka_state_txt(state));
 
86
        data->state = state;
 
87
}
 
88
 
 
89
 
 
90
static void * eap_aka_init(struct eap_sm *sm)
 
91
{
 
92
        struct eap_aka_data *data;
 
93
 
 
94
        if (sm->eap_sim_db_priv == NULL) {
 
95
                wpa_printf(MSG_WARNING, "EAP-AKA: eap_sim_db not configured");
 
96
                return NULL;
 
97
        }
 
98
 
 
99
        data = os_zalloc(sizeof(*data));
 
100
        if (data == NULL)
 
101
                return NULL;
 
102
        data->state = IDENTITY;
 
103
        eap_aka_determine_identity(sm, data, 1, 0);
 
104
        data->pending_id = -1;
 
105
 
 
106
        return data;
 
107
}
 
108
 
 
109
 
 
110
static void eap_aka_reset(struct eap_sm *sm, void *priv)
 
111
{
 
112
        struct eap_aka_data *data = priv;
 
113
        os_free(data->next_pseudonym);
 
114
        os_free(data->next_reauth_id);
 
115
        wpabuf_free(data->id_msgs);
 
116
        os_free(data);
 
117
}
 
118
 
 
119
 
 
120
static int eap_aka_add_id_msg(struct eap_aka_data *data,
 
121
                              const struct wpabuf *msg)
 
122
{
 
123
        if (msg == NULL)
 
124
                return -1;
 
125
 
 
126
        if (data->id_msgs == NULL) {
 
127
                data->id_msgs = wpabuf_dup(msg);
 
128
                return data->id_msgs == NULL ? -1 : 0;
 
129
        }
 
130
 
 
131
        if (wpabuf_resize(&data->id_msgs, wpabuf_len(msg)) < 0)
 
132
                return -1;
 
133
        wpabuf_put_buf(data->id_msgs, msg);
 
134
 
 
135
        return 0;
 
136
}
 
137
 
 
138
 
 
139
static void eap_aka_add_checkcode(struct eap_aka_data *data,
 
140
                                  struct eap_sim_msg *msg)
 
141
{
 
142
        const u8 *addr;
 
143
        size_t len;
 
144
        u8 hash[SHA1_MAC_LEN];
 
145
 
 
146
        wpa_printf(MSG_DEBUG, "   AT_CHECKCODE");
 
147
 
 
148
        if (data->id_msgs == NULL) {
 
149
                /*
 
150
                 * No EAP-AKA/Identity packets were exchanged - send empty
 
151
                 * checkcode.
 
152
                 */
 
153
                eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, NULL, 0);
 
154
                return;
 
155
        }
 
156
 
 
157
        /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
 
158
        addr = wpabuf_head(data->id_msgs);
 
159
        len = wpabuf_len(data->id_msgs);
 
160
        wpa_hexdump(MSG_MSGDUMP, "EAP-AKA: AT_CHECKCODE data", addr, len);
 
161
        sha1_vector(1, &addr, &len, hash);
 
162
 
 
163
        eap_sim_msg_add(msg, EAP_SIM_AT_CHECKCODE, 0, hash,
 
164
                        EAP_AKA_CHECKCODE_LEN);
 
165
}
 
166
 
 
167
 
 
168
static int eap_aka_verify_checkcode(struct eap_aka_data *data,
 
169
                                    const u8 *checkcode, size_t checkcode_len)
 
170
{
 
171
        const u8 *addr;
 
172
        size_t len;
 
173
        u8 hash[SHA1_MAC_LEN];
 
174
 
 
175
        if (checkcode == NULL)
 
176
                return -1;
 
177
 
 
178
        if (data->id_msgs == NULL) {
 
179
                if (checkcode_len != 0) {
 
180
                        wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from peer "
 
181
                                   "indicates that AKA/Identity messages were "
 
182
                                   "used, but they were not");
 
183
                        return -1;
 
184
                }
 
185
                return 0;
 
186
        }
 
187
 
 
188
        if (checkcode_len != EAP_AKA_CHECKCODE_LEN) {
 
189
                wpa_printf(MSG_DEBUG, "EAP-AKA: Checkcode from peer indicates "
 
190
                           "that AKA/Identity message were not used, but they "
 
191
                           "were");
 
192
                return -1;
 
193
        }
 
194
 
 
195
        /* Checkcode is SHA1 hash over all EAP-AKA/Identity packets. */
 
196
        addr = wpabuf_head(data->id_msgs);
 
197
        len = wpabuf_len(data->id_msgs);
 
198
        sha1_vector(1, &addr, &len, hash);
 
199
 
 
200
        if (os_memcmp(hash, checkcode, EAP_AKA_CHECKCODE_LEN) != 0) {
 
201
                wpa_printf(MSG_DEBUG, "EAP-AKA: Mismatch in AT_CHECKCODE");
 
202
                return -1;
 
203
        }
 
204
 
 
205
        return 0;
 
206
}
 
207
 
 
208
 
 
209
static struct wpabuf * eap_aka_build_identity(struct eap_sm *sm,
 
210
                                              struct eap_aka_data *data, u8 id)
 
211
{
 
212
        struct eap_sim_msg *msg;
 
213
        struct wpabuf *buf;
 
214
 
 
215
        wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Identity");
 
216
        msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 
217
                               EAP_AKA_SUBTYPE_IDENTITY);
 
218
        if (eap_sim_db_identity_known(sm->eap_sim_db_priv, sm->identity,
 
219
                                      sm->identity_len)) {
 
220
                wpa_printf(MSG_DEBUG, "   AT_PERMANENT_ID_REQ");
 
221
                eap_sim_msg_add(msg, EAP_SIM_AT_PERMANENT_ID_REQ, 0, NULL, 0);
 
222
        } else {
 
223
                /*
 
224
                 * RFC 4187, Chap. 4.1.4 recommends that identity from EAP is
 
225
                 * ignored and the AKA/Identity is used to request the
 
226
                 * identity.
 
227
                 */
 
228
                wpa_printf(MSG_DEBUG, "   AT_ANY_ID_REQ");
 
229
                eap_sim_msg_add(msg, EAP_SIM_AT_ANY_ID_REQ, 0, NULL, 0);
 
230
        }
 
231
        buf = eap_sim_msg_finish(msg, NULL, NULL, 0);
 
232
        if (eap_aka_add_id_msg(data, buf) < 0) {
 
233
                wpabuf_free(buf);
 
234
                return NULL;
 
235
        }
 
236
        data->pending_id = id;
 
237
        return buf;
 
238
}
 
239
 
 
240
 
 
241
static int eap_aka_build_encr(struct eap_sm *sm, struct eap_aka_data *data,
 
242
                              struct eap_sim_msg *msg, u16 counter,
 
243
                              const u8 *nonce_s)
 
244
{
 
245
        os_free(data->next_pseudonym);
 
246
        data->next_pseudonym =
 
247
                eap_sim_db_get_next_pseudonym(sm->eap_sim_db_priv, 1);
 
248
        os_free(data->next_reauth_id);
 
249
        if (data->counter <= EAP_AKA_MAX_FAST_REAUTHS) {
 
250
                data->next_reauth_id =
 
251
                        eap_sim_db_get_next_reauth_id(sm->eap_sim_db_priv, 1);
 
252
        } else {
 
253
                wpa_printf(MSG_DEBUG, "EAP-AKA: Max fast re-authentication "
 
254
                           "count exceeded - force full authentication");
 
255
                data->next_reauth_id = NULL;
 
256
        }
 
257
 
 
258
        if (data->next_pseudonym == NULL && data->next_reauth_id == NULL &&
 
259
            counter == 0 && nonce_s == NULL)
 
260
                return 0;
 
261
 
 
262
        wpa_printf(MSG_DEBUG, "   AT_IV");
 
263
        wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 
264
        eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV, EAP_SIM_AT_ENCR_DATA);
 
265
 
 
266
        if (counter > 0) {
 
267
                wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)", counter);
 
268
                eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, counter, NULL, 0);
 
269
        }
 
270
 
 
271
        if (nonce_s) {
 
272
                wpa_printf(MSG_DEBUG, "   *AT_NONCE_S");
 
273
                eap_sim_msg_add(msg, EAP_SIM_AT_NONCE_S, 0, nonce_s,
 
274
                                EAP_SIM_NONCE_S_LEN);
 
275
        }
 
276
 
 
277
        if (data->next_pseudonym) {
 
278
                wpa_printf(MSG_DEBUG, "   *AT_NEXT_PSEUDONYM (%s)",
 
279
                           data->next_pseudonym);
 
280
                eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_PSEUDONYM,
 
281
                                os_strlen(data->next_pseudonym),
 
282
                                (u8 *) data->next_pseudonym,
 
283
                                os_strlen(data->next_pseudonym));
 
284
        }
 
285
 
 
286
        if (data->next_reauth_id) {
 
287
                wpa_printf(MSG_DEBUG, "   *AT_NEXT_REAUTH_ID (%s)",
 
288
                           data->next_reauth_id);
 
289
                eap_sim_msg_add(msg, EAP_SIM_AT_NEXT_REAUTH_ID,
 
290
                                os_strlen(data->next_reauth_id),
 
291
                                (u8 *) data->next_reauth_id,
 
292
                                os_strlen(data->next_reauth_id));
 
293
        }
 
294
 
 
295
        if (eap_sim_msg_add_encr_end(msg, data->k_encr, EAP_SIM_AT_PADDING)) {
 
296
                wpa_printf(MSG_WARNING, "EAP-AKA: Failed to encrypt "
 
297
                           "AT_ENCR_DATA");
 
298
                return -1;
 
299
        }
 
300
 
 
301
        return 0;
 
302
}
 
303
 
 
304
 
 
305
static struct wpabuf * eap_aka_build_challenge(struct eap_sm *sm,
 
306
                                               struct eap_aka_data *data,
 
307
                                               u8 id)
 
308
{
 
309
        struct eap_sim_msg *msg;
 
310
 
 
311
        wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Challenge");
 
312
        msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 
313
                               EAP_AKA_SUBTYPE_CHALLENGE);
 
314
        wpa_printf(MSG_DEBUG, "   AT_RAND");
 
315
        eap_sim_msg_add(msg, EAP_SIM_AT_RAND, 0, data->rand, EAP_AKA_RAND_LEN);
 
316
        eap_sim_msg_add(msg, EAP_SIM_AT_AUTN, 0, data->autn, EAP_AKA_AUTN_LEN);
 
317
 
 
318
        if (eap_aka_build_encr(sm, data, msg, 0, NULL)) {
 
319
                eap_sim_msg_free(msg);
 
320
                return NULL;
 
321
        }
 
322
 
 
323
        eap_aka_add_checkcode(data, msg);
 
324
 
 
325
        if (sm->eap_sim_aka_result_ind) {
 
326
                wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 
327
                eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 
328
        }
 
329
 
 
330
        wpa_printf(MSG_DEBUG, "   AT_MAC");
 
331
        eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 
332
        return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
 
333
}
 
334
 
 
335
 
 
336
static struct wpabuf * eap_aka_build_reauth(struct eap_sm *sm,
 
337
                                            struct eap_aka_data *data, u8 id)
 
338
{
 
339
        struct eap_sim_msg *msg;
 
340
 
 
341
        wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Re-authentication");
 
342
 
 
343
        if (os_get_random(data->nonce_s, EAP_SIM_NONCE_S_LEN))
 
344
                return NULL;
 
345
        wpa_hexdump_key(MSG_MSGDUMP, "EAP-AKA: NONCE_S",
 
346
                        data->nonce_s, EAP_SIM_NONCE_S_LEN);
 
347
 
 
348
        eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
 
349
                            data->emsk);
 
350
        eap_sim_derive_keys_reauth(data->counter, sm->identity,
 
351
                                   sm->identity_len, data->nonce_s, data->mk,
 
352
                                   data->msk, data->emsk);
 
353
 
 
354
        msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 
355
                               EAP_AKA_SUBTYPE_REAUTHENTICATION);
 
356
 
 
357
        if (eap_aka_build_encr(sm, data, msg, data->counter, data->nonce_s)) {
 
358
                eap_sim_msg_free(msg);
 
359
                return NULL;
 
360
        }
 
361
 
 
362
        eap_aka_add_checkcode(data, msg);
 
363
 
 
364
        if (sm->eap_sim_aka_result_ind) {
 
365
                wpa_printf(MSG_DEBUG, "   AT_RESULT_IND");
 
366
                eap_sim_msg_add(msg, EAP_SIM_AT_RESULT_IND, 0, NULL, 0);
 
367
        }
 
368
 
 
369
        wpa_printf(MSG_DEBUG, "   AT_MAC");
 
370
        eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 
371
        return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
 
372
}
 
373
 
 
374
 
 
375
static struct wpabuf * eap_aka_build_notification(struct eap_sm *sm,
 
376
                                                  struct eap_aka_data *data,
 
377
                                                  u8 id)
 
378
{
 
379
        struct eap_sim_msg *msg;
 
380
 
 
381
        wpa_printf(MSG_DEBUG, "EAP-AKA: Generating Notification");
 
382
        msg = eap_sim_msg_init(EAP_CODE_REQUEST, id, EAP_TYPE_AKA,
 
383
                               EAP_AKA_SUBTYPE_NOTIFICATION);
 
384
        wpa_printf(MSG_DEBUG, "   AT_NOTIFICATION (%d)", data->notification);
 
385
        eap_sim_msg_add(msg, EAP_SIM_AT_NOTIFICATION, data->notification,
 
386
                        NULL, 0);
 
387
        if (data->use_result_ind) {
 
388
                if (data->reauth) {
 
389
                        wpa_printf(MSG_DEBUG, "   AT_IV");
 
390
                        wpa_printf(MSG_DEBUG, "   AT_ENCR_DATA");
 
391
                        eap_sim_msg_add_encr_start(msg, EAP_SIM_AT_IV,
 
392
                                                   EAP_SIM_AT_ENCR_DATA);
 
393
                        wpa_printf(MSG_DEBUG, "   *AT_COUNTER (%u)",
 
394
                                   data->counter);
 
395
                        eap_sim_msg_add(msg, EAP_SIM_AT_COUNTER, data->counter,
 
396
                                        NULL, 0);
 
397
 
 
398
                        if (eap_sim_msg_add_encr_end(msg, data->k_encr,
 
399
                                                     EAP_SIM_AT_PADDING)) {
 
400
                                wpa_printf(MSG_WARNING, "EAP-AKA: Failed to "
 
401
                                           "encrypt AT_ENCR_DATA");
 
402
                                eap_sim_msg_free(msg);
 
403
                                return NULL;
 
404
                        }
 
405
                }
 
406
 
 
407
                wpa_printf(MSG_DEBUG, "   AT_MAC");
 
408
                eap_sim_msg_add_mac(msg, EAP_SIM_AT_MAC);
 
409
        }
 
410
        return eap_sim_msg_finish(msg, data->k_aut, NULL, 0);
 
411
}
 
412
 
 
413
 
 
414
static struct wpabuf * eap_aka_buildReq(struct eap_sm *sm, void *priv, u8 id)
 
415
{
 
416
        struct eap_aka_data *data = priv;
 
417
 
 
418
        data->auts_reported = 0;
 
419
        switch (data->state) {
 
420
        case IDENTITY:
 
421
                return eap_aka_build_identity(sm, data, id);
 
422
        case CHALLENGE:
 
423
                return eap_aka_build_challenge(sm, data, id);
 
424
        case REAUTH:
 
425
                return eap_aka_build_reauth(sm, data, id);
 
426
        case NOTIFICATION:
 
427
                return eap_aka_build_notification(sm, data, id);
 
428
        default:
 
429
                wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
 
430
                           "buildReq", data->state);
 
431
                break;
 
432
        }
 
433
        return NULL;
 
434
}
 
435
 
 
436
 
 
437
static Boolean eap_aka_check(struct eap_sm *sm, void *priv,
 
438
                             struct wpabuf *respData)
 
439
{
 
440
        const u8 *pos;
 
441
        size_t len;
 
442
 
 
443
        pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_AKA, respData, &len);
 
444
        if (pos == NULL || len < 3) {
 
445
                wpa_printf(MSG_INFO, "EAP-AKA: Invalid frame");
 
446
                return TRUE;
 
447
        }
 
448
 
 
449
        return FALSE;
 
450
}
 
451
 
 
452
 
 
453
static Boolean eap_aka_subtype_ok(struct eap_aka_data *data, u8 subtype)
 
454
{
 
455
        if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR ||
 
456
            subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT)
 
457
                return FALSE;
 
458
 
 
459
        switch (data->state) {
 
460
        case IDENTITY:
 
461
                if (subtype != EAP_AKA_SUBTYPE_IDENTITY) {
 
462
                        wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 
463
                                   "subtype %d", subtype);
 
464
                        return TRUE;
 
465
                }
 
466
                break;
 
467
        case CHALLENGE:
 
468
                if (subtype != EAP_AKA_SUBTYPE_CHALLENGE &&
 
469
                    subtype != EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
 
470
                        wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 
471
                                   "subtype %d", subtype);
 
472
                        return TRUE;
 
473
                }
 
474
                break;
 
475
        case REAUTH:
 
476
                if (subtype != EAP_AKA_SUBTYPE_REAUTHENTICATION) {
 
477
                        wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 
478
                                   "subtype %d", subtype);
 
479
                        return TRUE;
 
480
                }
 
481
                break;
 
482
        case NOTIFICATION:
 
483
                if (subtype != EAP_AKA_SUBTYPE_NOTIFICATION) {
 
484
                        wpa_printf(MSG_INFO, "EAP-AKA: Unexpected response "
 
485
                                   "subtype %d", subtype);
 
486
                        return TRUE;
 
487
                }
 
488
                break;
 
489
        default:
 
490
                wpa_printf(MSG_INFO, "EAP-AKA: Unexpected state (%d) for "
 
491
                           "processing a response", data->state);
 
492
                return TRUE;
 
493
        }
 
494
 
 
495
        return FALSE;
 
496
}
 
497
 
 
498
 
 
499
static void eap_aka_determine_identity(struct eap_sm *sm,
 
500
                                       struct eap_aka_data *data,
 
501
                                       int before_identity, int after_reauth)
 
502
{
 
503
        const u8 *identity;
 
504
        size_t identity_len;
 
505
        int res;
 
506
 
 
507
        identity = NULL;
 
508
        identity_len = 0;
 
509
 
 
510
        if (after_reauth && data->reauth) {
 
511
                identity = data->reauth->identity;
 
512
                identity_len = data->reauth->identity_len;
 
513
        } else if (sm->identity && sm->identity_len > 0 &&
 
514
                   sm->identity[0] == EAP_AKA_PERMANENT_PREFIX) {
 
515
                identity = sm->identity;
 
516
                identity_len = sm->identity_len;
 
517
        } else {
 
518
                identity = eap_sim_db_get_permanent(sm->eap_sim_db_priv,
 
519
                                                    sm->identity,
 
520
                                                    sm->identity_len,
 
521
                                                    &identity_len);
 
522
                if (identity == NULL) {
 
523
                        data->reauth = eap_sim_db_get_reauth_entry(
 
524
                                sm->eap_sim_db_priv, sm->identity,
 
525
                                sm->identity_len);
 
526
                        if (data->reauth) {
 
527
                                wpa_printf(MSG_DEBUG, "EAP-AKA: Using fast "
 
528
                                           "re-authentication");
 
529
                                identity = data->reauth->identity;
 
530
                                identity_len = data->reauth->identity_len;
 
531
                                data->counter = data->reauth->counter;
 
532
                                os_memcpy(data->mk, data->reauth->mk,
 
533
                                          EAP_SIM_MK_LEN);
 
534
                        }
 
535
                }
 
536
        }
 
537
 
 
538
        if (identity == NULL ||
 
539
            eap_sim_db_identity_known(sm->eap_sim_db_priv, sm->identity,
 
540
                                      sm->identity_len) < 0) {
 
541
                if (before_identity) {
 
542
                        wpa_printf(MSG_DEBUG, "EAP-AKA: Permanent user name "
 
543
                                   "not known - send AKA-Identity request");
 
544
                        eap_aka_state(data, IDENTITY);
 
545
                        return;
 
546
                } else {
 
547
                        wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown whether the "
 
548
                                   "permanent user name is known; try to use "
 
549
                                   "it");
 
550
                        /* eap_sim_db_get_aka_auth() will report failure, if
 
551
                         * this identity is not known. */
 
552
                }
 
553
        }
 
554
 
 
555
        wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity",
 
556
                          identity, identity_len);
 
557
 
 
558
        if (!after_reauth && data->reauth) {
 
559
                eap_aka_state(data, REAUTH);
 
560
                return;
 
561
        }
 
562
 
 
563
        res = eap_sim_db_get_aka_auth(sm->eap_sim_db_priv, identity,
 
564
                                      identity_len, data->rand, data->autn,
 
565
                                      data->ik, data->ck, data->res,
 
566
                                      &data->res_len, sm);
 
567
        if (res == EAP_SIM_DB_PENDING) {
 
568
                wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
 
569
                           "not yet available - pending request");
 
570
                sm->method_pending = METHOD_PENDING_WAIT;
 
571
                return;
 
572
        }
 
573
 
 
574
        data->reauth = NULL;
 
575
        data->counter = 0; /* reset re-auth counter since this is full auth */
 
576
 
 
577
        if (res != 0) {
 
578
                wpa_printf(MSG_INFO, "EAP-AKA: Failed to get AKA "
 
579
                           "authentication data for the peer");
 
580
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
581
                eap_aka_state(data, NOTIFICATION);
 
582
                return;
 
583
        }
 
584
        if (sm->method_pending == METHOD_PENDING_WAIT) {
 
585
                wpa_printf(MSG_DEBUG, "EAP-AKA: AKA authentication data "
 
586
                           "available - abort pending wait");
 
587
                sm->method_pending = METHOD_PENDING_NONE;
 
588
        }
 
589
 
 
590
        identity_len = sm->identity_len;
 
591
        while (identity_len > 0 && sm->identity[identity_len - 1] == '\0') {
 
592
                wpa_printf(MSG_DEBUG, "EAP-AKA: Workaround - drop last null "
 
593
                           "character from identity");
 
594
                identity_len--;
 
595
        }
 
596
        wpa_hexdump_ascii(MSG_DEBUG, "EAP-AKA: Identity for MK derivation",
 
597
                          sm->identity, identity_len);
 
598
 
 
599
        eap_aka_derive_mk(sm->identity, identity_len, data->ik, data->ck,
 
600
                          data->mk);
 
601
        eap_sim_derive_keys(data->mk, data->k_encr, data->k_aut, data->msk,
 
602
                            data->emsk);
 
603
 
 
604
        eap_aka_state(data, CHALLENGE);
 
605
}
 
606
 
 
607
 
 
608
static void eap_aka_process_identity(struct eap_sm *sm,
 
609
                                     struct eap_aka_data *data,
 
610
                                     struct wpabuf *respData,
 
611
                                     struct eap_sim_attrs *attr)
 
612
{
 
613
        wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Identity");
 
614
 
 
615
        if (attr->mac || attr->iv || attr->encr_data) {
 
616
                wpa_printf(MSG_WARNING, "EAP-AKA: Unexpected attribute "
 
617
                           "received in EAP-Response/AKA-Identity");
 
618
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
619
                eap_aka_state(data, NOTIFICATION);
 
620
                return;
 
621
        }
 
622
 
 
623
        if (attr->identity) {
 
624
                os_free(sm->identity);
 
625
                sm->identity = os_malloc(attr->identity_len);
 
626
                if (sm->identity) {
 
627
                        os_memcpy(sm->identity, attr->identity,
 
628
                                  attr->identity_len);
 
629
                        sm->identity_len = attr->identity_len;
 
630
                }
 
631
        }
 
632
 
 
633
        eap_aka_determine_identity(sm, data, 0, 0);
 
634
        if (eap_get_id(respData) == data->pending_id) {
 
635
                data->pending_id = -1;
 
636
                eap_aka_add_id_msg(data, respData);
 
637
        }
 
638
}
 
639
 
 
640
 
 
641
static void eap_aka_process_challenge(struct eap_sm *sm,
 
642
                                      struct eap_aka_data *data,
 
643
                                      struct wpabuf *respData,
 
644
                                      struct eap_sim_attrs *attr)
 
645
{
 
646
        const u8 *identity;
 
647
        size_t identity_len;
 
648
 
 
649
        wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Challenge");
 
650
 
 
651
        if (attr->checkcode &&
 
652
            eap_aka_verify_checkcode(data, attr->checkcode,
 
653
                                     attr->checkcode_len)) {
 
654
                wpa_printf(MSG_WARNING, "EAP-AKA: Invalid AT_CHECKCODE in the "
 
655
                           "message");
 
656
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
657
                eap_aka_state(data, NOTIFICATION);
 
658
                return;
 
659
        }
 
660
        if (attr->mac == NULL ||
 
661
            eap_sim_verify_mac(data->k_aut, respData, attr->mac, NULL, 0)) {
 
662
                wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message "
 
663
                           "did not include valid AT_MAC");
 
664
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
665
                eap_aka_state(data, NOTIFICATION);
 
666
                return;
 
667
        }
 
668
 
 
669
        if (attr->res == NULL || attr->res_len != data->res_len ||
 
670
            os_memcmp(attr->res, data->res, data->res_len) != 0) {
 
671
                wpa_printf(MSG_WARNING, "EAP-AKA: Challenge message did not "
 
672
                           "include valid AT_RES");
 
673
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
674
                eap_aka_state(data, NOTIFICATION);
 
675
                return;
 
676
        }
 
677
 
 
678
        wpa_printf(MSG_DEBUG, "EAP-AKA: Challenge response includes the "
 
679
                   "correct AT_MAC");
 
680
        if (sm->eap_sim_aka_result_ind && attr->result_ind) {
 
681
                data->use_result_ind = 1;
 
682
                data->notification = EAP_SIM_SUCCESS;
 
683
                eap_aka_state(data, NOTIFICATION);
 
684
        } else
 
685
                eap_aka_state(data, SUCCESS);
 
686
 
 
687
        identity = eap_sim_db_get_permanent(sm->eap_sim_db_priv, sm->identity,
 
688
                                            sm->identity_len, &identity_len);
 
689
        if (identity == NULL) {
 
690
                identity = sm->identity;
 
691
                identity_len = sm->identity_len;
 
692
        }
 
693
 
 
694
        if (data->next_pseudonym) {
 
695
                eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, identity,
 
696
                                         identity_len,
 
697
                                         data->next_pseudonym);
 
698
                data->next_pseudonym = NULL;
 
699
        }
 
700
        if (data->next_reauth_id) {
 
701
                eap_sim_db_add_reauth(sm->eap_sim_db_priv, identity,
 
702
                                      identity_len,
 
703
                                      data->next_reauth_id, data->counter + 1,
 
704
                                      data->mk);
 
705
                data->next_reauth_id = NULL;
 
706
        }
 
707
}
 
708
 
 
709
 
 
710
static void eap_aka_process_sync_failure(struct eap_sm *sm,
 
711
                                         struct eap_aka_data *data,
 
712
                                         struct wpabuf *respData,
 
713
                                         struct eap_sim_attrs *attr)
 
714
{
 
715
        wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Synchronization-Failure");
 
716
 
 
717
        if (attr->auts == NULL) {
 
718
                wpa_printf(MSG_WARNING, "EAP-AKA: Synchronization-Failure "
 
719
                           "message did not include valid AT_AUTS");
 
720
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
721
                eap_aka_state(data, NOTIFICATION);
 
722
                return;
 
723
        }
 
724
 
 
725
        /* Avoid re-reporting AUTS when processing pending EAP packet by
 
726
         * maintaining a local flag stating whether this AUTS has already been
 
727
         * reported. */
 
728
        if (!data->auts_reported &&
 
729
            eap_sim_db_resynchronize(sm->eap_sim_db_priv, sm->identity,
 
730
                                     sm->identity_len, attr->auts,
 
731
                                     data->rand)) {
 
732
                wpa_printf(MSG_WARNING, "EAP-AKA: Resynchronization failed");
 
733
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
734
                eap_aka_state(data, NOTIFICATION);
 
735
                return;
 
736
        }
 
737
        data->auts_reported = 1;
 
738
 
 
739
        /* Try again after resynchronization */
 
740
        eap_aka_determine_identity(sm, data, 0, 0);
 
741
}
 
742
 
 
743
 
 
744
static void eap_aka_process_reauth(struct eap_sm *sm,
 
745
                                   struct eap_aka_data *data,
 
746
                                   struct wpabuf *respData,
 
747
                                   struct eap_sim_attrs *attr)
 
748
{
 
749
        struct eap_sim_attrs eattr;
 
750
        u8 *decrypted = NULL;
 
751
        const u8 *identity, *id2;
 
752
        size_t identity_len, id2_len;
 
753
 
 
754
        wpa_printf(MSG_DEBUG, "EAP-AKA: Processing Reauthentication");
 
755
 
 
756
        if (attr->mac == NULL ||
 
757
            eap_sim_verify_mac(data->k_aut, respData, attr->mac, data->nonce_s,
 
758
                               EAP_SIM_NONCE_S_LEN)) {
 
759
                wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
 
760
                           "did not include valid AT_MAC");
 
761
                goto fail;
 
762
        }
 
763
 
 
764
        if (attr->encr_data == NULL || attr->iv == NULL) {
 
765
                wpa_printf(MSG_WARNING, "EAP-AKA: Reauthentication "
 
766
                           "message did not include encrypted data");
 
767
                goto fail;
 
768
        }
 
769
 
 
770
        decrypted = eap_sim_parse_encr(data->k_encr, attr->encr_data,
 
771
                                       attr->encr_data_len, attr->iv, &eattr,
 
772
                                       0);
 
773
        if (decrypted == NULL) {
 
774
                wpa_printf(MSG_WARNING, "EAP-AKA: Failed to parse encrypted "
 
775
                           "data from reauthentication message");
 
776
                goto fail;
 
777
        }
 
778
 
 
779
        if (eattr.counter != data->counter) {
 
780
                wpa_printf(MSG_WARNING, "EAP-AKA: Re-authentication message "
 
781
                           "used incorrect counter %u, expected %u",
 
782
                           eattr.counter, data->counter);
 
783
                goto fail;
 
784
        }
 
785
        os_free(decrypted);
 
786
        decrypted = NULL;
 
787
 
 
788
        wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response includes "
 
789
                   "the correct AT_MAC");
 
790
 
 
791
        if (eattr.counter_too_small) {
 
792
                wpa_printf(MSG_DEBUG, "EAP-AKA: Re-authentication response "
 
793
                           "included AT_COUNTER_TOO_SMALL - starting full "
 
794
                           "authentication");
 
795
                eap_aka_determine_identity(sm, data, 0, 1);
 
796
                return;
 
797
        }
 
798
 
 
799
        if (sm->eap_sim_aka_result_ind && attr->result_ind) {
 
800
                data->use_result_ind = 1;
 
801
                data->notification = EAP_SIM_SUCCESS;
 
802
                eap_aka_state(data, NOTIFICATION);
 
803
        } else
 
804
                eap_aka_state(data, SUCCESS);
 
805
 
 
806
        if (data->reauth) {
 
807
                identity = data->reauth->identity;
 
808
                identity_len = data->reauth->identity_len;
 
809
        } else {
 
810
                identity = sm->identity;
 
811
                identity_len = sm->identity_len;
 
812
        }
 
813
 
 
814
        id2 = eap_sim_db_get_permanent(sm->eap_sim_db_priv, identity,
 
815
                                       identity_len, &id2_len);
 
816
        if (id2) {
 
817
                identity = id2;
 
818
                identity_len = id2_len;
 
819
        }
 
820
 
 
821
        if (data->next_pseudonym) {
 
822
                eap_sim_db_add_pseudonym(sm->eap_sim_db_priv, identity,
 
823
                                         identity_len, data->next_pseudonym);
 
824
                data->next_pseudonym = NULL;
 
825
        }
 
826
        if (data->next_reauth_id) {
 
827
                eap_sim_db_add_reauth(sm->eap_sim_db_priv, identity,
 
828
                                      identity_len, data->next_reauth_id,
 
829
                                      data->counter + 1, data->mk);
 
830
                data->next_reauth_id = NULL;
 
831
        } else {
 
832
                eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
 
833
                data->reauth = NULL;
 
834
        }
 
835
 
 
836
        return;
 
837
 
 
838
fail:
 
839
        data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
840
        eap_aka_state(data, NOTIFICATION);
 
841
        eap_sim_db_remove_reauth(sm->eap_sim_db_priv, data->reauth);
 
842
        data->reauth = NULL;
 
843
        os_free(decrypted);
 
844
}
 
845
 
 
846
 
 
847
static void eap_aka_process_client_error(struct eap_sm *sm,
 
848
                                         struct eap_aka_data *data,
 
849
                                         struct wpabuf *respData,
 
850
                                         struct eap_sim_attrs *attr)
 
851
{
 
852
        wpa_printf(MSG_DEBUG, "EAP-AKA: Client reported error %d",
 
853
                   attr->client_error_code);
 
854
        if (data->notification == EAP_SIM_SUCCESS && data->use_result_ind)
 
855
                eap_aka_state(data, SUCCESS);
 
856
        else
 
857
                eap_aka_state(data, FAILURE);
 
858
}
 
859
 
 
860
 
 
861
static void eap_aka_process_authentication_reject(
 
862
        struct eap_sm *sm, struct eap_aka_data *data,
 
863
        struct wpabuf *respData, struct eap_sim_attrs *attr)
 
864
{
 
865
        wpa_printf(MSG_DEBUG, "EAP-AKA: Client rejected authentication");
 
866
        eap_aka_state(data, FAILURE);
 
867
}
 
868
 
 
869
 
 
870
static void eap_aka_process_notification(struct eap_sm *sm,
 
871
                                         struct eap_aka_data *data,
 
872
                                         struct wpabuf *respData,
 
873
                                         struct eap_sim_attrs *attr)
 
874
{
 
875
        wpa_printf(MSG_DEBUG, "EAP-AKA: Client replied to notification");
 
876
        if (data->notification == EAP_SIM_SUCCESS && data->use_result_ind)
 
877
                eap_aka_state(data, SUCCESS);
 
878
        else
 
879
                eap_aka_state(data, FAILURE);
 
880
}
 
881
 
 
882
 
 
883
static void eap_aka_process(struct eap_sm *sm, void *priv,
 
884
                            struct wpabuf *respData)
 
885
{
 
886
        struct eap_aka_data *data = priv;
 
887
        const u8 *pos, *end;
 
888
        u8 subtype;
 
889
        size_t len;
 
890
        struct eap_sim_attrs attr;
 
891
 
 
892
        pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_AKA, respData, &len);
 
893
        if (pos == NULL || len < 3)
 
894
                return;
 
895
 
 
896
        end = pos + len;
 
897
        subtype = *pos;
 
898
        pos += 3;
 
899
 
 
900
        if (eap_aka_subtype_ok(data, subtype)) {
 
901
                wpa_printf(MSG_DEBUG, "EAP-AKA: Unrecognized or unexpected "
 
902
                           "EAP-AKA Subtype in EAP Response");
 
903
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
904
                eap_aka_state(data, NOTIFICATION);
 
905
                return;
 
906
        }
 
907
 
 
908
        if (eap_sim_parse_attr(pos, end, &attr, 1, 0)) {
 
909
                wpa_printf(MSG_DEBUG, "EAP-AKA: Failed to parse attributes");
 
910
                data->notification = EAP_SIM_GENERAL_FAILURE_BEFORE_AUTH;
 
911
                eap_aka_state(data, NOTIFICATION);
 
912
                return;
 
913
        }
 
914
 
 
915
        if (subtype == EAP_AKA_SUBTYPE_CLIENT_ERROR) {
 
916
                eap_aka_process_client_error(sm, data, respData, &attr);
 
917
                return;
 
918
        }
 
919
 
 
920
        if (subtype == EAP_AKA_SUBTYPE_AUTHENTICATION_REJECT) {
 
921
                eap_aka_process_authentication_reject(sm, data, respData,
 
922
                                                      &attr);
 
923
                return;
 
924
        }
 
925
 
 
926
        switch (data->state) {
 
927
        case IDENTITY:
 
928
                eap_aka_process_identity(sm, data, respData, &attr);
 
929
                break;
 
930
        case CHALLENGE:
 
931
                if (subtype == EAP_AKA_SUBTYPE_SYNCHRONIZATION_FAILURE) {
 
932
                        eap_aka_process_sync_failure(sm, data, respData,
 
933
                                                     &attr);
 
934
                } else {
 
935
                        eap_aka_process_challenge(sm, data, respData, &attr);
 
936
                }
 
937
                break;
 
938
        case REAUTH:
 
939
                eap_aka_process_reauth(sm, data, respData, &attr);
 
940
                break;
 
941
        case NOTIFICATION:
 
942
                eap_aka_process_notification(sm, data, respData, &attr);
 
943
                break;
 
944
        default:
 
945
                wpa_printf(MSG_DEBUG, "EAP-AKA: Unknown state %d in "
 
946
                           "process", data->state);
 
947
                break;
 
948
        }
 
949
}
 
950
 
 
951
 
 
952
static Boolean eap_aka_isDone(struct eap_sm *sm, void *priv)
 
953
{
 
954
        struct eap_aka_data *data = priv;
 
955
        return data->state == SUCCESS || data->state == FAILURE;
 
956
}
 
957
 
 
958
 
 
959
static u8 * eap_aka_getKey(struct eap_sm *sm, void *priv, size_t *len)
 
960
{
 
961
        struct eap_aka_data *data = priv;
 
962
        u8 *key;
 
963
 
 
964
        if (data->state != SUCCESS)
 
965
                return NULL;
 
966
 
 
967
        key = os_malloc(EAP_SIM_KEYING_DATA_LEN);
 
968
        if (key == NULL)
 
969
                return NULL;
 
970
        os_memcpy(key, data->msk, EAP_SIM_KEYING_DATA_LEN);
 
971
        *len = EAP_SIM_KEYING_DATA_LEN;
 
972
        return key;
 
973
}
 
974
 
 
975
 
 
976
static u8 * eap_aka_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
 
977
{
 
978
        struct eap_aka_data *data = priv;
 
979
        u8 *key;
 
980
 
 
981
        if (data->state != SUCCESS)
 
982
                return NULL;
 
983
 
 
984
        key = os_malloc(EAP_EMSK_LEN);
 
985
        if (key == NULL)
 
986
                return NULL;
 
987
        os_memcpy(key, data->emsk, EAP_EMSK_LEN);
 
988
        *len = EAP_EMSK_LEN;
 
989
        return key;
 
990
}
 
991
 
 
992
 
 
993
static Boolean eap_aka_isSuccess(struct eap_sm *sm, void *priv)
 
994
{
 
995
        struct eap_aka_data *data = priv;
 
996
        return data->state == SUCCESS;
 
997
}
 
998
 
 
999
 
 
1000
int eap_server_aka_register(void)
 
1001
{
 
1002
        struct eap_method *eap;
 
1003
        int ret;
 
1004
 
 
1005
        eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
 
1006
                                      EAP_VENDOR_IETF, EAP_TYPE_AKA, "AKA");
 
1007
        if (eap == NULL)
 
1008
                return -1;
 
1009
 
 
1010
        eap->init = eap_aka_init;
 
1011
        eap->reset = eap_aka_reset;
 
1012
        eap->buildReq = eap_aka_buildReq;
 
1013
        eap->check = eap_aka_check;
 
1014
        eap->process = eap_aka_process;
 
1015
        eap->isDone = eap_aka_isDone;
 
1016
        eap->getKey = eap_aka_getKey;
 
1017
        eap->isSuccess = eap_aka_isSuccess;
 
1018
        eap->get_emsk = eap_aka_get_emsk;
 
1019
 
 
1020
        ret = eap_server_method_register(eap);
 
1021
        if (ret)
 
1022
                eap_server_method_free(eap);
 
1023
        return ret;
 
1024
}