eap-aka-3gpp: Fix SQN generation
As `tv_sec` is a `time_t`, i.e. typically 64 bits, assigning the result
of `htonl()` leaves the upper 32 bits zero. Copying from the
`sizeof(time_t) - 4` offset then copies those zeroes on little-endian
systems, which is not what was intended according to the comments.
Another issue was that the type of `tv_usec`, `suseconds_t`, is typically
a `long`, i.e. signed, so shifting the maximum value 0x000f423f (999'999)
by 12 bits technically overflows this. The cast fixes that.
Fixes: 1aba82bfd7 ("eap-aka-3gpp: Add plugin that implements 3GPP MILENAGE algorithm in software")
This commit is contained in:
@@ -106,14 +106,15 @@ bool eap_aka_3gpp_get_k_opc(identification_t *id, uint8_t k[AKA_K_LEN],
|
||||
void eap_aka_3gpp_get_sqn(uint8_t sqn[AKA_SQN_LEN], int offset)
|
||||
{
|
||||
timeval_t time;
|
||||
uint32_t sec, usec;
|
||||
|
||||
gettimeofday(&time, NULL);
|
||||
/* set sqn to an integer containing 4 bytes seconds + 2 bytes usecs */
|
||||
time.tv_sec = htonl(time.tv_sec + offset);
|
||||
sec = htonl((uint32_t)(time.tv_sec + offset));
|
||||
/* usec's are never larger than 0x000f423f, so we shift the 12 first bits */
|
||||
time.tv_usec = htonl(time.tv_usec << 12);
|
||||
memcpy(sqn, (uint8_t*)&time.tv_sec + sizeof(time_t) - 4, 4);
|
||||
memcpy(sqn + 4, &time.tv_usec, 2);
|
||||
usec = htonl((uint32_t)time.tv_usec << 12);
|
||||
memcpy(sqn, &sec, 4);
|
||||
memcpy(sqn + 4, &usec, 2);
|
||||
}
|
||||
|
||||
static bool f1andf1star(private_eap_aka_3gpp_functions_t *this,
|
||||
|
||||
Reference in New Issue
Block a user