denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support variable RES length in AKA quintuplets

Browse Source
This commit is contained in:
Martin Willi
2009-11-12 10:34:02 +01:00
parent 15b65bf15d
commit 1a86be6e48
14 changed files with 57 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/sa/authenticators/eap/sim_manager.c
+10 -7
View File
@@ -90,7 +90,8 @@ static bool card_get_triplet(private_sim_manager_t *this, identification_t *id,
static status_t card_get_quintuplet(private_sim_manager_t *this,
identification_t *id, char rand[AKA_RAND_LEN],
char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN],
char ik[AKA_IK_LEN], char res[AKA_RES_LEN])
char ik[AKA_IK_LEN], char res[AKA_RES_MAX],
int *res_len)
{
enumerator_t *enumerator;
sim_card_t *card;
@@ -100,7 +101,7 @@ static status_t card_get_quintuplet(private_sim_manager_t *this,
enumerator = this->cards->create_enumerator(this->cards);
while (enumerator->enumerate(enumerator, &card))
{
status = card->get_quintuplet(card, id, rand, autn, ck, ik, res);
status = card->get_quintuplet(card, id, rand, autn, ck, ik, res, res_len);
if (status != FAILED)
{ /* try next on error, but not on INVALID_STATE */
enumerator->destroy(enumerator);
@@ -276,8 +277,9 @@ static bool provider_get_triplet(private_sim_manager_t *this,
*/
static bool provider_get_quintuplet(private_sim_manager_t *this,
identification_t *id, char rand[AKA_RAND_LEN],
char xres[AKA_RES_LEN], char ck[AKA_CK_LEN],
char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN])
char xres[AKA_RES_MAX], int *xres_len,
char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
char autn[AKA_AUTN_LEN])
{
enumerator_t *enumerator;
sim_provider_t *provider;
@@ -286,7 +288,8 @@ static bool provider_get_quintuplet(private_sim_manager_t *this,
enumerator = this->providers->create_enumerator(this->providers);
while (enumerator->enumerate(enumerator, &provider))
{
if (provider->get_quintuplet(provider, id, rand, xres, ck, ik, autn))
if (provider->get_quintuplet(provider, id, rand, xres, xres_len,
ck, ik, autn))
{
enumerator->destroy(enumerator);
return TRUE;
@@ -439,7 +442,7 @@ sim_manager_t *sim_manager_create()
this->public.add_card = (void(*)(sim_manager_t*, sim_card_t *card))add_card;
this->public.remove_card = (void(*)(sim_manager_t*, sim_card_t *card))remove_card;
this->public.card_get_triplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))card_get_triplet;
this->public.card_get_quintuplet = (status_t(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_LEN]))card_get_quintuplet;
this->public.card_get_quintuplet = (status_t(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char res[AKA_RES_MAX], int *res_len))card_get_quintuplet;
this->public.card_resync = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))card_resync;
this->public.card_set_pseudonym = (void(*)(sim_manager_t*, identification_t *id, identification_t *pseudonym))card_set_pseudonym;
this->public.card_get_pseudonym = (identification_t*(*)(sim_manager_t*, identification_t *id))card_get_pseudonym;
@@ -448,7 +451,7 @@ sim_manager_t *sim_manager_create()
this->public.add_provider = (void(*)(sim_manager_t*, sim_provider_t *provider))add_provider;
this->public.remove_provider = (void(*)(sim_manager_t*, sim_provider_t *provider))remove_provider;
this->public.provider_get_triplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[SIM_RAND_LEN], char sres[SIM_SRES_LEN], char kc[SIM_KC_LEN]))provider_get_triplet;
this->public.provider_get_quintuplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_LEN], char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))provider_get_quintuplet;
this->public.provider_get_quintuplet = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char xres[AKA_RES_MAX], int *xres_len, char ck[AKA_CK_LEN], char ik[AKA_IK_LEN], char autn[AKA_AUTN_LEN]))provider_get_quintuplet;
this->public.provider_resync = (bool(*)(sim_manager_t*, identification_t *id, char rand[AKA_RAND_LEN], char auts[AKA_AUTS_LEN]))provider_resync;
this->public.provider_is_pseudonym = (identification_t*(*)(sim_manager_t*, identification_t *id))provider_is_pseudonym;
this->public.provider_gen_pseudonym = (identification_t*(*)(sim_manager_t*, identification_t *id))provider_gen_pseudonym;
src/charon/sa/authenticators/eap/sim_manager.h
+19 -5
View File
@@ -34,7 +34,7 @@ typedef struct sim_provider_t sim_provider_t;
#define SIM_KC_LEN 8
#define AKA_RAND_LEN 16
#define AKA_RES_LEN 16
#define AKA_RES_MAX 16
#define AKA_CK_LEN 16
#define AKA_IK_LEN 16
#define AKA_AUTN_LEN 16
@@ -68,6 +68,10 @@ struct sim_card_t {
*
* If the received sequence number (in autn) is out of sync, INVALID_STATE
* is returned.
* The RES value is the only one with variable length. Pass a buffer
* of at least AKA_RES_MAX, the actual number of bytes is written to the
* res_len value. While the standard would allow any bit length between
* 32 and 128 bits, we support only full bytes for now.
*
* @param id permanent identity to request quintuplet for
* @param rand random value rand
@@ -75,12 +79,13 @@ struct sim_card_t {
* @param ck buffer receiving encryption key ck
* @param ik buffer receiving integrity key ik
* @param res buffer receiving authentication result res
* @param res_len nubmer of bytes written to res buffer
* @return SUCCESS, FAILED, or INVALID_STATE if out of sync
*/
status_t (*get_quintuplet)(sim_card_t *this, identification_t *id,
char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN],
char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
char res[AKA_RES_LEN]);
char res[AKA_RES_MAX], int *res_len);
/**
* Calculate AUTS from RAND for AKA resynchronization.
@@ -161,16 +166,23 @@ struct sim_provider_t {
/**
* Create a challenge for AKA authentication.
*
* The XRES value is the only one with variable length. Pass a buffer
* of at least AKA_RES_MAX, the actual number of bytes is written to the
* xres_len value. While the standard would allow any bit length between
* 32 and 128 bits, we support only full bytes for now.
*
* @param id permanent identity of peer to create challenge for
* @param rand buffer receiving random value rand
* @param xres buffer receiving expected authentication result xres
* @param xres_len nubmer of bytes written to xres buffer
* @param ck buffer receiving encryption key ck
* @param ik buffer receiving integrity key ik
* @param autn authentication token autn
* @return TRUE if quintuplet generated successfully
*/
bool (*get_quintuplet)(sim_provider_t *this, identification_t *id,
char rand[AKA_RAND_LEN], char xres[AKA_RES_LEN],
char rand[AKA_RAND_LEN],
char xres[AKA_RES_MAX], int *xres_len,
char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
char autn[AKA_AUTN_LEN]);
@@ -266,12 +278,13 @@ struct sim_manager_t {
* @param ck buffer receiving encryption key ck
* @param ik buffer receiving integrity key ik
* @param res buffer receiving authentication result res
* @param res_len nubmer of bytes written to res buffer
* @return SUCCESS, FAILED, or INVALID_STATE if out of sync
*/
status_t (*card_get_quintuplet)(sim_manager_t *this, identification_t *id,
char rand[AKA_RAND_LEN], char autn[AKA_AUTN_LEN],
char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
char res[AKA_RES_LEN]);
char res[AKA_RES_MAX], int *res_len);
/**
* Calculate resynchronization data on one of the registered SIM cards.
@@ -365,7 +378,8 @@ struct sim_manager_t {
* @return TRUE if quintuplet received, FALSE if no match found
*/
bool (*provider_get_quintuplet)(sim_manager_t *this, identification_t *id,
char rand[AKA_RAND_LEN], char xres[AKA_RES_LEN],
char rand[AKA_RAND_LEN],
char xres[AKA_RES_MAX], int *xres_len,
char ck[AKA_CK_LEN], char ik[AKA_IK_LEN],
char autn[AKA_AUTN_LEN]);