jeltz
/
hostap
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

EAP-SIM peer: Do not accept SIM/Challenge without SIM/Start 

EAP-SIM full authentication starts with one or more SIM/Start rounds, so
reject an unexpected SIM/Challenge round without any preceeding
SIM/Start rounds to avoid unexpected behavior. In practice, an attempt
to start with SIM/Challenge would have resulted in different MK being
derived and the Challenge message getting rejected due to mismatching
AT_MAC unless the misbehaving server has access to valid Kc, so the end
result is identical, but it is cleaner to reject the unexpected message
explicitly to avoid any risk of trying to proceed without NONCE_MT.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2019-12-23 23:59:16 +02:00
parent 2636362717
commit 07fe134d9c
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/eap_peer/eap_sim.c
View File

@ -44,7 +44,7 @@ struct eap_sim_data {
u8 *last_eap_identity;
size_t last_eap_identity_len;
enum {
CONTINUE, RESULT_SUCCESS, SUCCESS, FAILURE
CONTINUE, START_DONE, RESULT_SUCCESS, SUCCESS, FAILURE
} state;
int result_ind, use_result_ind;
int use_pseudonym;
@ -58,6 +58,8 @@ static const char * eap_sim_state_txt(int state)
switch (state) {
case CONTINUE:
return "CONTINUE";
case START_DONE:
return "START_DONE";
case RESULT_SUCCESS:
return "RESULT_SUCCESS";
case SUCCESS:
@ -486,6 +488,7 @@ static struct wpabuf * eap_sim_response_start(struct eap_sm *sm,
const u8 *identity = NULL;
size_t identity_len = 0;
struct eap_sim_msg *msg;
struct wpabuf *resp;
data->reauth = 0;
if (id_req == ANY_ID && data->reauth_id) {
@ -535,7 +538,10 @@ static struct wpabuf * eap_sim_response_start(struct eap_sm *sm,
identity, identity_len);
}
return eap_sim_msg_finish(msg, EAP_TYPE_SIM, NULL, NULL, 0);
resp = eap_sim_msg_finish(msg, EAP_TYPE_SIM, NULL, NULL, 0);
if (resp)
eap_sim_state(data, START_DONE);
return resp;
}
@ -721,6 +727,13 @@ static struct wpabuf * eap_sim_process_challenge(struct eap_sm *sm,
int res;
wpa_printf(MSG_DEBUG, "EAP-SIM: subtype Challenge");
if (data->state != START_DONE) {
wpa_printf(MSG_DEBUG,
"EAP-SIM: Unexpected Challenge in state %s",
eap_sim_state_txt(data->state));
return eap_sim_client_error(data, id,
EAP_SIM_UNABLE_TO_PROCESS_PACKET);
}
data->reauth = 0;
if (!attr->mac || !attr->rand) {
wpa_printf(MSG_WARNING, "EAP-SIM: Challenge message "