From 655728621bcdd00f5cadfe2b47c718b251eed778 Mon Sep 17 00:00:00 2001 From: Martin Willi Date: Thu, 8 Oct 2009 17:25:44 +0200 Subject: [PATCH] Use constants instead of sizeof(), sizeof() does not work for function arguments --- src/charon/plugins/eap_aka/eap_aka.c | 36 ++++++++-------- .../eap_aka_3gpp2/eap_aka_3gpp2_card.c | 37 ++++++++-------- .../eap_aka_3gpp2/eap_aka_3gpp2_functions.c | 42 +++++++++---------- .../eap_aka_3gpp2/eap_aka_3gpp2_provider.c | 32 +++++++------- 4 files changed, 76 insertions(+), 71 deletions(-) diff --git a/src/charon/plugins/eap_aka/eap_aka.c b/src/charon/plugins/eap_aka/eap_aka.c index f7a1e2d91..f15ff924f 100644 --- a/src/charon/plugins/eap_aka/eap_aka.c +++ b/src/charon/plugins/eap_aka/eap_aka.c @@ -240,19 +240,20 @@ static void derive_keys(private_eap_aka_t *this, identification_t *id, chunk_t ck, chunk_t ik) { char mk[MK_LEN]; - chunk_t tmp, k_auth; + chunk_t tmp, k_auth, identity; /* MK = SHA1( Identity | IK | CK ) */ - DBG3(DBG_IKE, "Identity|IK|CK => %#B|%#B|%#B", &id->get_encoding, &ik, &ck); - this->sha1->get_hash(this->sha1, id->get_encoding(id), NULL); + identity = id->get_encoding(id); + DBG3(DBG_IKE, "Identity %B", &identity); + this->sha1->get_hash(this->sha1, identity, NULL); this->sha1->get_hash(this->sha1, ik, NULL); this->sha1->get_hash(this->sha1, ck, mk); - DBG3(DBG_IKE, "MK %b", mk, sizeof(mk)); + DBG3(DBG_IKE, "MK %b", mk, MK_LEN); /* K_encr | K_auth | MSK | EMSK = prf(0) | prf(0) * FIPS PRF has 320 bit block size, we need 160 byte for keys * => run prf four times */ - this->prf->set_key(this->prf, chunk_create(mk, sizeof(mk))); + this->prf->set_key(this->prf, chunk_create(mk, MK_LEN)); tmp = chunk_alloca(this->prf->get_block_size(this->prf) * 4); this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr); this->prf->get_bytes(this->prf, chunk_empty, tmp.ptr + tmp.len / 4 * 1); @@ -270,7 +271,7 @@ static void derive_keys(private_eap_aka_t *this, identification_t *id, DBG3(DBG_IKE, "PRF res %B", &tmp); DBG3(DBG_IKE, "K_auth %B", &k_auth); - DBG3(DBG_IKE, "MSK %b", this->msk, sizeof(this->msk)); + DBG3(DBG_IKE, "MSK %b", this->msk, MSK_LEN); this->derived = TRUE; } @@ -517,12 +518,13 @@ static status_t server_initiate(private_eap_aka_t *this, eap_payload_t **out) return FAILED; } - derive_keys(this, this->peer, chunk_create(ck, sizeof(ck)), - chunk_create(ik, sizeof(ik))); + derive_keys(this, this->peer, chunk_create(ck, AKA_CK_LEN), + chunk_create(ik, AKA_IK_LEN)); *out = build_aka_payload(this, EAP_REQUEST, get_identifier(), AKA_CHALLENGE, - AT_RAND, this->rand, AT_AUTN, autn, AT_MAC, - chunk_empty, AT_END); + AT_RAND, chunk_create(this->rand, AKA_RAND_LEN), + AT_AUTN, chunk_create(autn, AKA_AUTN_LEN), + AT_MAC, chunk_empty, AT_END); return NEED_MORE; } @@ -646,10 +648,10 @@ static status_t server_process_challenge(private_eap_aka_t *this, eap_payload_t } /* compare received RES against stored precalculated XRES */ - if (!chunk_equals(res, chunk_create(this->res, sizeof(this->res)))) + if (!chunk_equals(res, chunk_create(this->res, AKA_RES_LEN))) { DBG1(DBG_IKE, "received RES does not match XRES"); - DBG3(DBG_IKE, "RES %B XRES %b", &res, this->res, sizeof(this->res)); + DBG3(DBG_IKE, "RES %B XRES %b", &res, this->res, AKA_RES_LEN); return FAILED; } return SUCCESS; @@ -774,7 +776,7 @@ static status_t peer_process_challenge(private_eap_aka_t *this, { *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_SYNCHRONIZATION_FAILURE, - AT_AUTS, chunk_create(auts, sizeof(auts)), AT_END); + AT_AUTS, chunk_create(auts, AKA_AUTS_LEN), AT_END); DBG1(DBG_IKE, "received SQN invalid, sending %N", aka_subtype_names, AKA_SYNCHRONIZATION_FAILURE); return NEED_MORE; @@ -788,8 +790,8 @@ static status_t peer_process_challenge(private_eap_aka_t *this, return NEED_MORE; } - derive_keys(this, this->peer, chunk_create(ck, sizeof(ck)), - chunk_create(ik, sizeof(ik))); + derive_keys(this, this->peer, chunk_create(ck, AKA_CK_LEN), + chunk_create(ik, AKA_IK_LEN)); /* verify EAP message MAC AT_MAC */ DBG3(DBG_IKE, "verifying AT_MAC signature of %B", &message); @@ -804,7 +806,7 @@ static status_t peer_process_challenge(private_eap_aka_t *this, } *out = build_aka_payload(this, EAP_RESPONSE, identifier, AKA_CHALLENGE, - AT_RES, chunk_create(res, sizeof(res)), + AT_RES, chunk_create(res, AKA_RES_LEN), AT_MAC, chunk_empty, AT_END); return NEED_MORE; } @@ -1001,7 +1003,7 @@ static status_t get_msk(private_eap_aka_t *this, chunk_t *msk) { if (this->derived) { - *msk = chunk_create(this->msk, sizeof(this->msk)); + *msk = chunk_create(this->msk, MSK_LEN); return SUCCESS; } return FAILED; diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c index 8fa5ce98b..7c25e20a4 100644 --- a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c +++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c @@ -65,48 +65,47 @@ static status_t get_quintuplet(private_eap_aka_3gpp2_card_t *this, if (!eap_aka_3gpp2_get_k(imsi, k)) { DBG1(DBG_IKE, "no EAP key found for %Y to authenticate with AKA", imsi); - return FALSE; + return FAILED; } /* AUTN = SQN xor AK | AMF | MAC */ - DBG3(DBG_IKE, "received autn %b", autn, sizeof(autn)); - DBG3(DBG_IKE, "using K %b", k, sizeof(k)); - DBG3(DBG_IKE, "using rand %b", rand, sizeof(rand)); - memcpy(sqn, autn, sizeof(sqn)); - amf = autn + sizeof(sqn); - mac = autn + sizeof(sqn) + AKA_AMF_LEN; + DBG3(DBG_IKE, "received autn %b", autn, AKA_AUTN_LEN); + DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN); + DBG3(DBG_IKE, "using rand %b", rand, AKA_RAND_LEN); + memcpy(sqn, autn, AKA_SQN_LEN); + amf = autn + AKA_SQN_LEN; + mac = autn + AKA_SQN_LEN + AKA_AMF_LEN; /* XOR anonymity key AK into SQN to decrypt it */ this->f->f5(this->f, k, rand, ak); - DBG3(DBG_IKE, "using ak %b", ak, sizeof(ak)); - memxor(sqn, ak, sizeof(sqn)); - DBG3(DBG_IKE, "using sqn %b", sqn, sizeof(sqn)); + DBG3(DBG_IKE, "using ak %b", ak, AKA_AK_LEN); + memxor(sqn, ak, AKA_SQN_LEN); + DBG3(DBG_IKE, "using sqn %b", sqn, AKA_SQN_LEN); /* calculate expected MAC and compare against received one */ this->f->f1(this->f, k, rand, sqn, amf, xmac); - if (!memeq(mac, xmac, sizeof(xmac))) + if (!memeq(mac, xmac, AKA_MAC_LEN)) { DBG1(DBG_IKE, "received MAC does not match XMAC"); DBG3(DBG_IKE, "MAC %b\nXMAC %b", mac, AKA_MAC_LEN, xmac, AKA_MAC_LEN); return FAILED; } - if (this->seq_check && memcmp(this->sqn, sqn, sizeof(sqn)) >= 0) + if (this->seq_check && memcmp(this->sqn, sqn, AKA_SQN_LEN) >= 0) { DBG3(DBG_IKE, "received SQN %b\ncurrent SQN %b", - sqn, sizeof(sqn), this->sqn, sizeof(this->sqn)); + sqn, AKA_SQN_LEN, this->sqn, AKA_SQN_LEN); return INVALID_STATE; } /* update stored SQN to the received one */ - memcpy(this->sqn, sqn, sizeof(sqn)); + memcpy(this->sqn, sqn, AKA_SQN_LEN); /* CK/IK */ this->f->f3(this->f, k, rand, ck); this->f->f4(this->f, k, rand, ik); /* calculate RES */ this->f->f2(this->f, k, rand, res); - DBG3(DBG_IKE, "calculated rand %b", res, sizeof(res)); return SUCCESS; } @@ -126,13 +125,13 @@ static bool resync(private_eap_aka_3gpp2_card_t *this, identification_t *imsi, } /* AMF is set to zero in resync */ - memset(amf, 0, sizeof(amf)); + memset(amf, 0, AKA_AMF_LEN); this->f->f5star(this->f, k, rand, aks); this->f->f1star(this->f, k, rand, this->sqn, amf, macs); /* AUTS = SQN xor AKS | MACS */ - memcpy(auts, this->sqn, sizeof(this->sqn)); - memxor(auts, aks, sizeof(aks)); - memcpy(auts + sizeof(aks), macs, sizeof(macs)); + memcpy(auts, this->sqn, AKA_SQN_LEN); + memxor(auts, aks, AKA_AK_LEN); + memcpy(auts + AKA_AK_LEN, macs, AKA_MAC_LEN); return TRUE; } diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c index 10b9c5c83..2307c551e 100644 --- a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c +++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_functions.c @@ -174,8 +174,8 @@ static void step3(prf_t *prf, u_char k[AKA_K_LEN], u_char payload[AKA_PAYLOAD_LEN], u_int8_t h[HASH_SIZE_SHA1]) { /* use the keyed hasher to build the hash */ - prf->set_key(prf, chunk_create(k, sizeof(k))); - prf->get_bytes(prf, chunk_create(payload, sizeof(payload)), h); + prf->set_key(prf, chunk_create(k, AKA_K_LEN)); + prf->get_bytes(prf, chunk_create(payload, AKA_PAYLOAD_LEN), h); } /** @@ -191,7 +191,7 @@ static void step4(u_char x[HASH_SIZE_SHA1]) mpz_init(bm); mpz_init(gm); - mpz_import(xm, sizeof(x), 1, 1, 1, 0, x); + mpz_import(xm, HASH_SIZE_SHA1, 1, 1, 1, 0, x); mpz_import(am, sizeof(a), 1, 1, 1, 0, a); mpz_import(bm, sizeof(b), 1, 1, 1, 0, b); mpz_import(gm, sizeof(g), 1, 1, 1, 0, g); @@ -200,7 +200,7 @@ static void step4(u_char x[HASH_SIZE_SHA1]) mpz_add_poly(xm, bm, xm); mpz_mod_poly(xm, xm, gm); - mpz_export(x, NULL, 1, sizeof(x), 1, 0, xm); + mpz_export(x, NULL, 1, HASH_SIZE_SHA1, 1, 0, xm); mpz_clear(xm); mpz_clear(am); @@ -220,10 +220,10 @@ static void fx(prf_t *prf, u_char f, u_char k[AKA_K_LEN], for (i = 0; i < 2; i++) { - memset(payload, 0x5c, sizeof(payload)); + memset(payload, 0x5c, AKA_PAYLOAD_LEN); payload[11] ^= f; memxor(payload + 12, fmk.ptr, fmk.len); - memxor(payload + 24, rand, sizeof(rand)); + memxor(payload + 24, rand, AKA_RAND_LEN); payload[3] ^= i; payload[19] ^= i; @@ -250,16 +250,16 @@ static void f1x(prf_t *prf, u_int8_t f, u_char k[AKA_K_LEN], u_char payload[AKA_PAYLOAD_LEN]; u_char h[HASH_SIZE_SHA1]; - memset(payload, 0x5c, sizeof(payload)); + memset(payload, 0x5c, AKA_PAYLOAD_LEN); payload[11] ^= f; memxor(payload + 12, fmk.ptr, fmk.len); - memxor(payload + 16, rand, sizeof(rand)); - memxor(payload + 34, sqn, sizeof(sqn)); - memxor(payload + 42, amf, sizeof(amf)); + memxor(payload + 16, rand, AKA_RAND_LEN); + memxor(payload + 34, sqn, AKA_SQN_LEN); + memxor(payload + 42, amf, AKA_AMF_LEN); step3(prf, k, payload, h); step4(h); - memcpy(mac, h, sizeof(mac)); + memcpy(mac, h, AKA_MAC_LEN); } /** @@ -271,14 +271,14 @@ static void f5x(prf_t *prf, u_char f, u_char k[AKA_K_LEN], u_char payload[AKA_PAYLOAD_LEN]; u_char h[HASH_SIZE_SHA1]; - memset(payload, 0x5c, sizeof(payload)); + memset(payload, 0x5c, AKA_PAYLOAD_LEN); payload[11] ^= f; memxor(payload + 12, fmk.ptr, fmk.len); - memxor(payload + 16, rand, sizeof(rand)); + memxor(payload + 16, rand, AKA_RAND_LEN); step3(prf, k, payload, h); step4(h); - memcpy(ak, h, sizeof(ak)); + memcpy(ak, h, AKA_AK_LEN); } /** @@ -289,7 +289,7 @@ static void f1(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char amf[AKA_AMF_LEN], u_char mac[AKA_MAC_LEN]) { f1x(this->prf, F1, k, rand, sqn, amf, mac); - DBG3(DBG_IKE, "MAC %b", mac, sizeof(mac)); + DBG3(DBG_IKE, "MAC %b", mac, AKA_MAC_LEN); } /** @@ -300,7 +300,7 @@ static void f1star(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char amf[AKA_AMF_LEN], u_char macs[AKA_MAC_LEN]) { f1x(this->prf, F1STAR, k, rand, sqn, amf, macs); - DBG3(DBG_IKE, "MACS %b", macs, sizeof(macs)); + DBG3(DBG_IKE, "MACS %b", macs, AKA_MAC_LEN); } /** @@ -310,7 +310,7 @@ static void f2(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char res[AKA_RES_LEN]) { fx(this->prf, F2, k, rand, res); - DBG3(DBG_IKE, "RES %b", res, sizeof(res)); + DBG3(DBG_IKE, "RES %b", res, AKA_RES_LEN); } /** @@ -320,7 +320,7 @@ static void f3(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char ck[AKA_CK_LEN]) { fx(this->prf, F3, k, rand, ck); - DBG3(DBG_IKE, "CK %b", ck, sizeof(ck)); + DBG3(DBG_IKE, "CK %b", ck, AKA_CK_LEN); } /** @@ -330,7 +330,7 @@ static void f4(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char ik[AKA_IK_LEN]) { fx(this->prf, F4, k, rand, ik); - DBG3(DBG_IKE, "IK %b", ik, sizeof(ik)); + DBG3(DBG_IKE, "IK %b", ik, AKA_IK_LEN); } /** @@ -340,7 +340,7 @@ static void f5(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char ak[AKA_AK_LEN]) { f5x(this->prf, F5, k, rand, ak); - DBG3(DBG_IKE, "AK %b", ak, sizeof(ak)); + DBG3(DBG_IKE, "AK %b", ak, AKA_AK_LEN); } /** @@ -350,7 +350,7 @@ static void f5star(private_eap_aka_3gpp2_functions_t *this, u_char k[AKA_K_LEN], u_char rand[AKA_RAND_LEN], u_char aks[AKA_AK_LEN]) { f5x(this->prf, F5STAR, k, rand, aks); - DBG3(DBG_IKE, "AKS %b", aks, sizeof(aks)); + DBG3(DBG_IKE, "AKS %b", aks, AKA_AK_LEN); } diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c index de87f0538..af20ead38 100644 --- a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c +++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_provider.c @@ -51,16 +51,19 @@ bool eap_aka_3gpp2_get_k(identification_t *id, char k[AKA_K_LEN]) { shared_key_t *shared; chunk_t key; + identification_t *any; + any = identification_create_from_encoding(ID_ANY, chunk_empty); shared = charon->credentials->get_shared(charon->credentials, - SHARED_EAP, id, NULL); + SHARED_EAP, id, any); + any->destroy(any); if (shared == NULL) { return FALSE; } key = shared->get_key(shared); - memset(k, '\0', sizeof(k)); - memcpy(k, key.ptr, min(key.len, sizeof(k))); + memset(k, '\0', AKA_K_LEN); + memcpy(k, key.ptr, min(key.len, AKA_K_LEN)); shared->destroy(shared); return TRUE; } @@ -110,6 +113,9 @@ static bool get_quintuplet(private_eap_aka_3gpp2_provider_t *this, return FALSE; } + DBG3(DBG_IKE, "generated rand %b", rand, AKA_RAND_LEN); + DBG3(DBG_IKE, "using K %b", k, AKA_K_LEN); + /* MAC */ this->f->f1(this->f, k, rand, this->sqn, amf, mac); /* AK */ @@ -117,16 +123,14 @@ static bool get_quintuplet(private_eap_aka_3gpp2_provider_t *this, /* XRES as expected from client */ this->f->f2(this->f, k, rand, xres); /* AUTN = (SQN xor AK) || AMF || MAC */ - memcpy(autn, this->sqn, sizeof(this->sqn)); - memxor(autn, ak, sizeof(ak)); - memcpy(autn + sizeof(this->sqn), amf, sizeof(amf)); - memcpy(autn + sizeof(this->sqn) + sizeof(amf), mac, sizeof(mac)); - DBG3(DBG_IKE, "AUTN %b", autn, sizeof(autn)); + memcpy(autn, this->sqn, AKA_SQN_LEN); + memxor(autn, ak, AKA_AK_LEN); + memcpy(autn + AKA_SQN_LEN, amf, AKA_AMF_LEN); + memcpy(autn + AKA_SQN_LEN + AKA_AMF_LEN, mac, AKA_MAC_LEN); + DBG3(DBG_IKE, "AUTN %b", autn, AKA_AUTN_LEN); /* CK/IK */ this->f->f3(this->f, k, rand, ck); - DBG3(DBG_IKE, "CK %b", ck, sizeof(ck)); this->f->f4(this->f, k, rand, ik); - DBG3(DBG_IKE, "IK %b", ik, sizeof(ik)); return TRUE; } @@ -151,16 +155,16 @@ static bool resync(private_eap_aka_3gpp2_provider_t *this, sqn = auts; macs = auts + AKA_SQN_LEN; this->f->f5star(this->f, k, rand, aks); - memxor(sqn, aks, sizeof(aks)); + memxor(sqn, aks, AKA_AK_LEN); /* verify XMACS, AMF of zero is used in resynchronization */ - memset(amf, 0, sizeof(amf)); + memset(amf, 0, AKA_AMF_LEN); this->f->f1star(this->f, k, rand, sqn, amf, xmacs); - if (!memeq(macs, xmacs, sizeof(xmacs))) + if (!memeq(macs, xmacs, AKA_MAC_LEN)) { DBG1(DBG_IKE, "received MACS does not match XMACS"); DBG3(DBG_IKE, "MACS %b XMACS %b", - macs, AKA_MAC_LEN, xmacs, sizeof(xmacs)); + macs, AKA_MAC_LEN, xmacs, AKA_MAC_LEN); return FALSE; } /* update stored SQN to received SQN + 1 */