eap-aka-3gpp: Fix SQN generation

As `tv_sec` is a `time_t`, i.e. typically 64 bits, assigning the result
of `htonl()` leaves the upper 32 bits zero.  Copying from the
`sizeof(time_t) - 4` offset then copies those zeroes on little-endian
systems, which is not what was intended according to the comments.
Another issue was that the type of `tv_usec`, `suseconds_t`, is typically
a `long`, i.e. signed, so shifting the maximum value 0x000f423f (999'999)
by 12 bits technically overflows this.  The cast fixes that.

Fixes: 1aba82bfd7 ("eap-aka-3gpp: Add plugin that implements 3GPP MILENAGE algorithm in software")
This commit is contained in:
Tobias Brunner
2026-07-23 10:26:08 +02:00
parent eec3164b41
commit 371c35612c
@@ -106,14 +106,15 @@ bool eap_aka_3gpp_get_k_opc(identification_t *id, uint8_t k[AKA_K_LEN],
void eap_aka_3gpp_get_sqn(uint8_t sqn[AKA_SQN_LEN], int offset)
{
timeval_t time;
uint32_t sec, usec;
gettimeofday(&time, NULL);
/* set sqn to an integer containing 4 bytes seconds + 2 bytes usecs */
time.tv_sec = htonl(time.tv_sec + offset);
sec = htonl((uint32_t)(time.tv_sec + offset));
/* usec's are never larger than 0x000f423f, so we shift the 12 first bits */
time.tv_usec = htonl(time.tv_usec << 12);
memcpy(sqn, (uint8_t*)&time.tv_sec + sizeof(time_t) - 4, 4);
memcpy(sqn + 4, &time.tv_usec, 2);
usec = htonl((uint32_t)time.tv_usec << 12);
memcpy(sqn, &sec, 4);
memcpy(sqn + 4, &usec, 2);
}
static bool f1andf1star(private_eap_aka_3gpp_functions_t *this,