2
* hostapd / EAP-SIM database/authenticator gateway
3
* Copyright (c) 2005-2007, Jouni Malinen <j@w1.fi>
5
* This program is free software; you can redistribute it and/or modify
6
* it under the terms of the GNU General Public License version 2 as
7
* published by the Free Software Foundation.
9
* Alternatively, this software may be distributed under the terms of BSD
12
* See README and COPYING for more details.
14
* This is an example implementation of the EAP-SIM/AKA database/authentication
15
* gateway interface that is using an external program as an SS7 gateway to
16
* GSM/UMTS authentication center (HLR/AuC). hlr_auc_gw is an example
17
* implementation of such a gateway program. This eap_sim_db.c takes care of
18
* EAP-SIM/AKA pseudonyms and re-auth identities. It can be used with different
19
* gateway implementations for HLR/AuC access. Alternatively, it can also be
20
* completely replaced if the in-memory database of pseudonyms/re-auth
21
* identities is not suitable for some cases.
28
#include "eap_common/eap_sim_common.h"
29
#include "eap_server/eap_sim_db.h"
32
struct eap_sim_pseudonym {
33
struct eap_sim_pseudonym *next;
39
struct eap_sim_db_pending {
40
struct eap_sim_db_pending *next;
43
enum { PENDING, SUCCESS, FAILURE } state;
45
struct os_time timestamp;
49
u8 kc[EAP_SIM_MAX_CHAL][EAP_SIM_KC_LEN];
50
u8 sres[EAP_SIM_MAX_CHAL][EAP_SIM_SRES_LEN];
51
u8 rand[EAP_SIM_MAX_CHAL][GSM_RAND_LEN];
55
u8 rand[EAP_AKA_RAND_LEN];
56
u8 autn[EAP_AKA_AUTN_LEN];
57
u8 ik[EAP_AKA_IK_LEN];
58
u8 ck[EAP_AKA_CK_LEN];
59
u8 res[EAP_AKA_RES_MAX_LEN];
65
struct eap_sim_db_data {
69
void (*get_complete_cb)(void *ctx, void *session_ctx);
71
struct eap_sim_pseudonym *pseudonyms;
72
struct eap_sim_reauth *reauths;
73
struct eap_sim_db_pending *pending;
77
static struct eap_sim_db_pending *
78
eap_sim_db_get_pending(struct eap_sim_db_data *data, const u8 *imsi,
79
size_t imsi_len, int aka)
81
struct eap_sim_db_pending *entry, *prev = NULL;
83
entry = data->pending;
85
if (entry->aka == aka && entry->imsi_len == imsi_len &&
86
memcmp(entry->imsi, imsi, imsi_len) == 0) {
88
prev->next = entry->next;
90
data->pending = entry->next;
100
static void eap_sim_db_add_pending(struct eap_sim_db_data *data,
101
struct eap_sim_db_pending *entry)
103
entry->next = data->pending;
104
data->pending = entry;
108
static void eap_sim_db_sim_resp_auth(struct eap_sim_db_data *data,
109
const char *imsi, char *buf)
111
char *start, *end, *pos;
112
struct eap_sim_db_pending *entry;
116
* SIM-RESP-AUTH <IMSI> Kc(i):SRES(i):RAND(i) ...
117
* SIM-RESP-AUTH <IMSI> FAILURE
118
* (IMSI = ASCII string, Kc/SRES/RAND = hex string)
121
entry = eap_sim_db_get_pending(data, (u8 *) imsi, strlen(imsi), 0);
123
wpa_printf(MSG_DEBUG, "EAP-SIM DB: No pending entry for the "
124
"received message found");
129
if (strncmp(start, "FAILURE", 7) == 0) {
130
wpa_printf(MSG_DEBUG, "EAP-SIM DB: External server reported "
132
entry->state = FAILURE;
133
eap_sim_db_add_pending(data, entry);
134
data->get_complete_cb(data->ctx, entry->cb_session_ctx);
139
while (num_chal < EAP_SIM_MAX_CHAL) {
140
end = strchr(start, ' ');
144
pos = strchr(start, ':');
148
if (hexstr2bin(start, entry->u.sim.kc[num_chal],
153
pos = strchr(start, ':');
157
if (hexstr2bin(start, entry->u.sim.sres[num_chal],
162
if (hexstr2bin(start, entry->u.sim.rand[num_chal],
172
entry->u.sim.num_chal = num_chal;
174
entry->state = SUCCESS;
175
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Authentication data parsed "
176
"successfully - callback");
177
eap_sim_db_add_pending(data, entry);
178
data->get_complete_cb(data->ctx, entry->cb_session_ctx);
182
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
187
static void eap_sim_db_aka_resp_auth(struct eap_sim_db_data *data,
188
const char *imsi, char *buf)
191
struct eap_sim_db_pending *entry;
194
* AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES>
195
* AKA-RESP-AUTH <IMSI> FAILURE
196
* (IMSI = ASCII string, RAND/AUTN/IK/CK/RES = hex string)
199
entry = eap_sim_db_get_pending(data, (u8 *) imsi, strlen(imsi), 1);
201
wpa_printf(MSG_DEBUG, "EAP-SIM DB: No pending entry for the "
202
"received message found");
207
if (strncmp(start, "FAILURE", 7) == 0) {
208
wpa_printf(MSG_DEBUG, "EAP-SIM DB: External server reported "
210
entry->state = FAILURE;
211
eap_sim_db_add_pending(data, entry);
212
data->get_complete_cb(data->ctx, entry->cb_session_ctx);
216
end = strchr(start, ' ');
220
if (hexstr2bin(start, entry->u.aka.rand, EAP_AKA_RAND_LEN))
224
end = strchr(start, ' ');
228
if (hexstr2bin(start, entry->u.aka.autn, EAP_AKA_AUTN_LEN))
232
end = strchr(start, ' ');
236
if (hexstr2bin(start, entry->u.aka.ik, EAP_AKA_IK_LEN))
240
end = strchr(start, ' ');
244
if (hexstr2bin(start, entry->u.aka.ck, EAP_AKA_CK_LEN))
248
end = strchr(start, ' ');
256
entry->u.aka.res_len = (end - start) / 2;
257
if (entry->u.aka.res_len > EAP_AKA_RES_MAX_LEN) {
258
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Too long RES");
259
entry->u.aka.res_len = 0;
262
if (hexstr2bin(start, entry->u.aka.res, entry->u.aka.res_len))
265
entry->state = SUCCESS;
266
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Authentication data parsed "
267
"successfully - callback");
268
eap_sim_db_add_pending(data, entry);
269
data->get_complete_cb(data->ctx, entry->cb_session_ctx);
273
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
278
static void eap_sim_db_receive(int sock, void *eloop_ctx, void *sock_ctx)
280
struct eap_sim_db_data *data = eloop_ctx;
281
char buf[1000], *pos, *cmd, *imsi;
284
res = recv(sock, buf, sizeof(buf), 0);
287
wpa_hexdump_ascii_key(MSG_MSGDUMP, "EAP-SIM DB: Received from an "
288
"external source", (u8 *) buf, res);
291
if (res >= (int) sizeof(buf))
292
res = sizeof(buf) - 1;
295
if (data->get_complete_cb == NULL) {
296
wpa_printf(MSG_DEBUG, "EAP-SIM DB: No get_complete_cb "
301
/* <cmd> <IMSI> ... */
304
pos = strchr(cmd, ' ');
309
pos = strchr(imsi, ' ');
313
wpa_printf(MSG_DEBUG, "EAP-SIM DB: External response=%s for IMSI %s",
316
if (strcmp(cmd, "SIM-RESP-AUTH") == 0)
317
eap_sim_db_sim_resp_auth(data, imsi, pos + 1);
318
else if (strcmp(cmd, "AKA-RESP-AUTH") == 0)
319
eap_sim_db_aka_resp_auth(data, imsi, pos + 1);
321
wpa_printf(MSG_INFO, "EAP-SIM DB: Unknown external response "
326
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
330
static int eap_sim_db_open_socket(struct eap_sim_db_data *data)
332
struct sockaddr_un addr;
333
static int counter = 0;
335
if (strncmp(data->fname, "unix:", 5) != 0)
338
data->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
339
if (data->sock < 0) {
340
perror("socket(eap_sim_db)");
344
memset(&addr, 0, sizeof(addr));
345
addr.sun_family = AF_UNIX;
346
snprintf(addr.sun_path, sizeof(addr.sun_path),
347
"/tmp/eap_sim_db_%d-%d", getpid(), counter++);
348
data->local_sock = strdup(addr.sun_path);
349
if (bind(data->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
350
perror("bind(eap_sim_db)");
356
memset(&addr, 0, sizeof(addr));
357
addr.sun_family = AF_UNIX;
358
os_strlcpy(addr.sun_path, data->fname + 5, sizeof(addr.sun_path));
359
if (connect(data->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
360
perror("connect(eap_sim_db)");
361
wpa_hexdump_ascii(MSG_INFO, "HLR/AuC GW socket",
362
(u8 *) addr.sun_path, strlen(addr.sun_path));
368
eloop_register_read_sock(data->sock, eap_sim_db_receive, data, NULL);
374
static void eap_sim_db_close_socket(struct eap_sim_db_data *data)
376
if (data->sock >= 0) {
377
eloop_unregister_read_sock(data->sock);
381
if (data->local_sock) {
382
unlink(data->local_sock);
383
free(data->local_sock);
384
data->local_sock = NULL;
390
* eap_sim_db_init - Initialize EAP-SIM DB / authentication gateway interface
391
* @config: Configuration data (e.g., file name)
392
* @get_complete_cb: Callback function for reporting availability of triplets
393
* @ctx: Context pointer for get_complete_cb
394
* Returns: Pointer to a private data structure or %NULL on failure
396
void * eap_sim_db_init(const char *config,
397
void (*get_complete_cb)(void *ctx, void *session_ctx),
400
struct eap_sim_db_data *data;
402
data = os_zalloc(sizeof(*data));
407
data->get_complete_cb = get_complete_cb;
409
data->fname = strdup(config);
410
if (data->fname == NULL)
413
if (strncmp(data->fname, "unix:", 5) == 0) {
414
if (eap_sim_db_open_socket(data))
421
eap_sim_db_close_socket(data);
428
static void eap_sim_db_free_pseudonym(struct eap_sim_pseudonym *p)
436
static void eap_sim_db_free_reauth(struct eap_sim_reauth *r)
445
* eap_sim_db_deinit - Deinitialize EAP-SIM DB/authentication gw interface
446
* @priv: Private data pointer from eap_sim_db_init()
448
void eap_sim_db_deinit(void *priv)
450
struct eap_sim_db_data *data = priv;
451
struct eap_sim_pseudonym *p, *prev;
452
struct eap_sim_reauth *r, *prevr;
453
struct eap_sim_db_pending *pending, *prev_pending;
455
eap_sim_db_close_socket(data);
458
p = data->pseudonyms;
462
eap_sim_db_free_pseudonym(prev);
469
eap_sim_db_free_reauth(prevr);
472
pending = data->pending;
474
prev_pending = pending;
475
pending = pending->next;
483
static int eap_sim_db_send(struct eap_sim_db_data *data, const char *msg,
488
if (send(data->sock, msg, len, 0) < 0) {
490
perror("send[EAP-SIM DB UNIX]");
493
if (_errno == ENOTCONN || _errno == EDESTADDRREQ || _errno == EINVAL ||
494
_errno == ECONNREFUSED) {
495
/* Try to reconnect */
496
eap_sim_db_close_socket(data);
497
if (eap_sim_db_open_socket(data) < 0)
499
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Reconnected to the "
501
if (send(data->sock, msg, len, 0) < 0) {
502
perror("send[EAP-SIM DB UNIX]");
511
static void eap_sim_db_expire_pending(struct eap_sim_db_data *data)
513
/* TODO: add limit for maximum length for pending list; remove latest
514
* (i.e., last) entry from the list if the limit is reached; could also
515
* use timeout to expire pending entries */
520
* eap_sim_db_get_gsm_triplets - Get GSM triplets
521
* @priv: Private data pointer from eap_sim_db_init()
522
* @identity: User name identity
523
* @identity_len: Length of identity in bytes
524
* @max_chal: Maximum number of triplets
525
* @_rand: Buffer for RAND values
526
* @kc: Buffer for Kc values
527
* @sres: Buffer for SRES values
528
* @cb_session_ctx: Session callback context for get_complete_cb()
529
* Returns: Number of triplets received (has to be less than or equal to
530
* max_chal), -1 (EAP_SIM_DB_FAILURE) on error (e.g., user not found), or
531
* -2 (EAP_SIM_DB_PENDING) if results are not yet available. In this case, the
532
* callback function registered with eap_sim_db_init() will be called once the
533
* results become available.
535
* In most cases, the user name is '1' | IMSI, i.e., 1 followed by the IMSI in
538
* When using an external server for GSM triplets, this function can always
539
* start a request and return EAP_SIM_DB_PENDING immediately if authentication
540
* triplets are not available. Once the triplets are received, callback
541
* function registered with eap_sim_db_init() is called to notify EAP state
542
* machine to reprocess the message. This eap_sim_db_get_gsm_triplets()
543
* function will then be called again and the newly received triplets will then
544
* be given to the caller.
546
int eap_sim_db_get_gsm_triplets(void *priv, const u8 *identity,
547
size_t identity_len, int max_chal,
548
u8 *_rand, u8 *kc, u8 *sres,
549
void *cb_session_ctx)
551
struct eap_sim_db_data *data = priv;
552
struct eap_sim_db_pending *entry;
557
if (identity_len < 2 || identity[0] != EAP_SIM_PERMANENT_PREFIX ||
558
identity_len + 1 > sizeof(entry->imsi)) {
559
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: unexpected identity",
560
identity, identity_len);
561
return EAP_SIM_DB_FAILURE;
565
for (i = 0; i < identity_len; i++) {
566
if (identity[i] == '@') {
571
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Get GSM triplets for IMSI",
572
identity, identity_len);
574
entry = eap_sim_db_get_pending(data, identity, identity_len, 0);
577
if (entry->state == FAILURE) {
578
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
581
return EAP_SIM_DB_FAILURE;
584
if (entry->state == PENDING) {
585
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
587
eap_sim_db_add_pending(data, entry);
588
return EAP_SIM_DB_PENDING;
591
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
592
"%d challenges", entry->u.sim.num_chal);
593
num_chal = entry->u.sim.num_chal;
594
if (num_chal > max_chal)
596
memcpy(_rand, entry->u.sim.rand, num_chal * GSM_RAND_LEN);
597
memcpy(sres, entry->u.sim.sres, num_chal * EAP_SIM_SRES_LEN);
598
memcpy(kc, entry->u.sim.kc, num_chal * EAP_SIM_KC_LEN);
603
if (data->sock < 0) {
604
if (eap_sim_db_open_socket(data) < 0)
605
return EAP_SIM_DB_FAILURE;
608
len = snprintf(msg, sizeof(msg), "SIM-REQ-AUTH ");
609
if (len < 0 || len + identity_len >= sizeof(msg))
610
return EAP_SIM_DB_FAILURE;
611
memcpy(msg + len, identity, identity_len);
613
ret = snprintf(msg + len, sizeof(msg) - len, " %d", max_chal);
614
if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
615
return EAP_SIM_DB_FAILURE;
618
wpa_hexdump(MSG_DEBUG, "EAP-SIM DB: requesting SIM authentication "
619
"data for IMSI", identity, identity_len);
620
if (eap_sim_db_send(data, msg, len) < 0)
621
return EAP_SIM_DB_FAILURE;
623
entry = os_zalloc(sizeof(*entry));
625
return EAP_SIM_DB_FAILURE;
627
os_get_time(&entry->timestamp);
628
memcpy(entry->imsi, identity, identity_len);
629
entry->imsi_len = identity_len;
630
entry->cb_session_ctx = cb_session_ctx;
631
entry->state = PENDING;
632
eap_sim_db_add_pending(data, entry);
633
eap_sim_db_expire_pending(data);
635
return EAP_SIM_DB_PENDING;
639
static struct eap_sim_pseudonym *
640
eap_sim_db_get_pseudonym(struct eap_sim_db_data *data, const u8 *identity,
645
struct eap_sim_pseudonym *p;
647
if (identity_len == 0 ||
648
(identity[0] != EAP_SIM_PSEUDONYM_PREFIX &&
649
identity[0] != EAP_AKA_PSEUDONYM_PREFIX))
652
/* Remove possible realm from identity */
654
while (len < identity_len) {
655
if (identity[len] == '@')
660
pseudonym = malloc(len + 1);
661
if (pseudonym == NULL)
663
memcpy(pseudonym, identity, len);
664
pseudonym[len] = '\0';
666
p = data->pseudonyms;
668
if (strcmp(p->pseudonym, pseudonym) == 0)
679
static struct eap_sim_pseudonym *
680
eap_sim_db_get_pseudonym_id(struct eap_sim_db_data *data, const u8 *identity,
683
struct eap_sim_pseudonym *p;
685
if (identity_len == 0 ||
686
(identity[0] != EAP_SIM_PERMANENT_PREFIX &&
687
identity[0] != EAP_AKA_PERMANENT_PREFIX))
690
p = data->pseudonyms;
692
if (identity_len == p->identity_len &&
693
memcmp(p->identity, identity, identity_len) == 0)
702
static struct eap_sim_reauth *
703
eap_sim_db_get_reauth(struct eap_sim_db_data *data, const u8 *identity,
708
struct eap_sim_reauth *r;
710
if (identity_len == 0 ||
711
(identity[0] != EAP_SIM_REAUTH_ID_PREFIX &&
712
identity[0] != EAP_AKA_REAUTH_ID_PREFIX))
715
/* Remove possible realm from identity */
717
while (len < identity_len) {
718
if (identity[len] == '@')
723
reauth_id = malloc(len + 1);
724
if (reauth_id == NULL)
726
memcpy(reauth_id, identity, len);
727
reauth_id[len] = '\0';
731
if (strcmp(r->reauth_id, reauth_id) == 0)
742
static struct eap_sim_reauth *
743
eap_sim_db_get_reauth_id(struct eap_sim_db_data *data, const u8 *identity,
746
struct eap_sim_pseudonym *p;
747
struct eap_sim_reauth *r;
749
if (identity_len == 0)
752
p = eap_sim_db_get_pseudonym(data, identity, identity_len);
754
p = eap_sim_db_get_pseudonym_id(data, identity, identity_len);
756
identity = p->identity;
757
identity_len = p->identity_len;
762
if (identity_len == r->identity_len &&
763
memcmp(r->identity, identity, identity_len) == 0)
773
* eap_sim_db_identity_known - Verify whether the given identity is known
774
* @priv: Private data pointer from eap_sim_db_init()
775
* @identity: User name identity
776
* @identity_len: Length of identity in bytes
777
* Returns: 0 if the user is found or -1 on failure
779
* In most cases, the user name is ['0','1'] | IMSI, i.e., 1 followed by the
780
* IMSI in ASCII format, ['2','3'] | pseudonym, or ['4','5'] | reauth_id.
782
int eap_sim_db_identity_known(void *priv, const u8 *identity,
785
struct eap_sim_db_data *data = priv;
787
if (identity == NULL || identity_len < 2)
790
if (identity[0] == EAP_SIM_PSEUDONYM_PREFIX ||
791
identity[0] == EAP_AKA_PSEUDONYM_PREFIX) {
792
struct eap_sim_pseudonym *p =
793
eap_sim_db_get_pseudonym(data, identity, identity_len);
797
if (identity[0] == EAP_SIM_REAUTH_ID_PREFIX ||
798
identity[0] == EAP_AKA_REAUTH_ID_PREFIX) {
799
struct eap_sim_reauth *r =
800
eap_sim_db_get_reauth(data, identity, identity_len);
804
if (identity[0] != EAP_SIM_PERMANENT_PREFIX &&
805
identity[0] != EAP_AKA_PERMANENT_PREFIX) {
806
/* Unknown identity prefix */
810
/* TODO: Should consider asking HLR/AuC gateway whether this permanent
811
* identity is known. If it is, EAP-SIM/AKA can skip identity request.
812
* In case of EAP-AKA, this would reduce number of needed round-trips.
813
* Ideally, this would be done with one wait, i.e., just request
814
* authentication data and store it for the next use. This would then
815
* need to use similar pending-request functionality as the normal
816
* request for authentication data at later phase.
822
static char * eap_sim_db_get_next(struct eap_sim_db_data *data, char prefix)
824
char *id, *pos, *end;
827
if (hostapd_get_rand(buf, sizeof(buf)))
829
id = malloc(sizeof(buf) * 2 + 2);
834
end = id + sizeof(buf) * 2 + 2;
836
pos += wpa_snprintf_hex(pos, end - pos, buf, sizeof(buf));
843
* eap_sim_db_get_next_pseudonym - EAP-SIM DB: Get next pseudonym
844
* @priv: Private data pointer from eap_sim_db_init()
845
* @aka: Using EAP-AKA instead of EAP-SIM
846
* Returns: Next pseudonym (allocated string) or %NULL on failure
848
* This function is used to generate a pseudonym for EAP-SIM. The returned
849
* pseudonym is not added to database at this point; it will need to be added
850
* with eap_sim_db_add_pseudonym() once the authentication has been completed
851
* successfully. Caller is responsible for freeing the returned buffer.
853
char * eap_sim_db_get_next_pseudonym(void *priv, int aka)
855
struct eap_sim_db_data *data = priv;
856
return eap_sim_db_get_next(data, aka ? EAP_AKA_PSEUDONYM_PREFIX :
857
EAP_SIM_PSEUDONYM_PREFIX);
862
* eap_sim_db_get_next_reauth_id - EAP-SIM DB: Get next reauth_id
863
* @priv: Private data pointer from eap_sim_db_init()
864
* @aka: Using EAP-AKA instead of EAP-SIM
865
* Returns: Next reauth_id (allocated string) or %NULL on failure
867
* This function is used to generate a fast re-authentication identity for
868
* EAP-SIM. The returned reauth_id is not added to database at this point; it
869
* will need to be added with eap_sim_db_add_reauth() once the authentication
870
* has been completed successfully. Caller is responsible for freeing the
873
char * eap_sim_db_get_next_reauth_id(void *priv, int aka)
875
struct eap_sim_db_data *data = priv;
876
return eap_sim_db_get_next(data, aka ? EAP_AKA_REAUTH_ID_PREFIX :
877
EAP_SIM_REAUTH_ID_PREFIX);
882
* eap_sim_db_add_pseudonym - EAP-SIM DB: Add new pseudonym
883
* @priv: Private data pointer from eap_sim_db_init()
884
* @identity: Identity of the user (may be permanent identity or pseudonym)
885
* @identity_len: Length of identity
886
* @pseudonym: Pseudonym for this user. This needs to be an allocated buffer,
887
* e.g., return value from eap_sim_db_get_next_pseudonym(). Caller must not
889
* Returns: 0 on success, -1 on failure
891
* This function adds a new pseudonym for EAP-SIM user. EAP-SIM DB is
892
* responsible of freeing pseudonym buffer once it is not needed anymore.
894
int eap_sim_db_add_pseudonym(void *priv, const u8 *identity,
895
size_t identity_len, char *pseudonym)
897
struct eap_sim_db_data *data = priv;
898
struct eap_sim_pseudonym *p;
899
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Add pseudonym for identity",
900
identity, identity_len);
901
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pseudonym: %s", pseudonym);
903
/* TODO: could store last two pseudonyms */
904
p = eap_sim_db_get_pseudonym(data, identity, identity_len);
906
p = eap_sim_db_get_pseudonym_id(data, identity, identity_len);
909
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Replacing previous "
910
"pseudonym: %s", p->pseudonym);
912
p->pseudonym = pseudonym;
916
p = os_zalloc(sizeof(*p));
922
p->next = data->pseudonyms;
923
p->identity = malloc(identity_len);
924
if (p->identity == NULL) {
929
memcpy(p->identity, identity, identity_len);
930
p->identity_len = identity_len;
931
p->pseudonym = pseudonym;
932
data->pseudonyms = p;
934
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Added new pseudonym entry");
940
* eap_sim_db_add_reauth - EAP-SIM DB: Add new re-authentication entry
941
* @priv: Private data pointer from eap_sim_db_init()
942
* @identity: Identity of the user (may be permanent identity or pseudonym)
943
* @identity_len: Length of identity
944
* @reauth_id: reauth_id for this user. This needs to be an allocated buffer,
945
* e.g., return value from eap_sim_db_get_next_reauth_id(). Caller must not
947
* @mk: 16-byte MK from the previous full authentication
948
* Returns: 0 on success, -1 on failure
950
* This function adds a new re-authentication entry for an EAP-SIM user.
951
* EAP-SIM DB is responsible of freeing reauth_id buffer once it is not needed
954
int eap_sim_db_add_reauth(void *priv, const u8 *identity,
955
size_t identity_len, char *reauth_id, u16 counter,
958
struct eap_sim_db_data *data = priv;
959
struct eap_sim_reauth *r;
960
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Add reauth_id for identity",
961
identity, identity_len);
962
wpa_printf(MSG_DEBUG, "EAP-SIM DB: reauth_id: %s", reauth_id);
964
r = eap_sim_db_get_reauth(data, identity, identity_len);
966
r = eap_sim_db_get_reauth_id(data, identity, identity_len);
969
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Replacing previous "
970
"reauth_id: %s", r->reauth_id);
972
r->reauth_id = reauth_id;
974
r = os_zalloc(sizeof(*r));
980
r->next = data->reauths;
981
r->identity = malloc(identity_len);
982
if (r->identity == NULL) {
987
memcpy(r->identity, identity, identity_len);
988
r->identity_len = identity_len;
989
r->reauth_id = reauth_id;
991
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Added new reauth entry");
994
r->counter = counter;
995
memcpy(r->mk, mk, EAP_SIM_MK_LEN);
1002
* eap_sim_db_get_permanent - EAP-SIM DB: Get permanent identity
1003
* @priv: Private data pointer from eap_sim_db_init()
1004
* @identity: Identity of the user (may be permanent identity or pseudonym)
1005
* @identity_len: Length of identity
1006
* @len: Buffer for length of the returned permanent identity
1007
* Returns: Pointer to the permanent identity, or %NULL if not found
1009
const u8 * eap_sim_db_get_permanent(void *priv, const u8 *identity,
1010
size_t identity_len, size_t *len)
1012
struct eap_sim_db_data *data = priv;
1013
struct eap_sim_pseudonym *p;
1015
if (identity == NULL)
1018
p = eap_sim_db_get_pseudonym(data, identity, identity_len);
1020
p = eap_sim_db_get_pseudonym_id(data, identity, identity_len);
1024
*len = p->identity_len;
1030
* eap_sim_db_get_reauth_entry - EAP-SIM DB: Get re-authentication entry
1031
* @priv: Private data pointer from eap_sim_db_init()
1032
* @identity: Identity of the user (may be permanent identity, pseudonym, or
1034
* @identity_len: Length of identity
1035
* @len: Buffer for length of the returned permanent identity
1036
* Returns: Pointer to the re-auth entry, or %NULL if not found
1038
struct eap_sim_reauth *
1039
eap_sim_db_get_reauth_entry(void *priv, const u8 *identity,
1040
size_t identity_len)
1042
struct eap_sim_db_data *data = priv;
1043
struct eap_sim_reauth *r;
1045
if (identity == NULL)
1047
r = eap_sim_db_get_reauth(data, identity, identity_len);
1049
r = eap_sim_db_get_reauth_id(data, identity, identity_len);
1055
* eap_sim_db_remove_reauth - EAP-SIM DB: Remove re-authentication entry
1056
* @priv: Private data pointer from eap_sim_db_init()
1057
* @reauth: Pointer to re-authentication entry from
1058
* eap_sim_db_get_reauth_entry()
1060
void eap_sim_db_remove_reauth(void *priv, struct eap_sim_reauth *reauth)
1062
struct eap_sim_db_data *data = priv;
1063
struct eap_sim_reauth *r, *prev = NULL;
1068
prev->next = r->next;
1070
data->reauths = r->next;
1071
eap_sim_db_free_reauth(r);
1081
* eap_sim_db_get_aka_auth - Get AKA authentication values
1082
* @priv: Private data pointer from eap_sim_db_init()
1083
* @identity: User name identity
1084
* @identity_len: Length of identity in bytes
1085
* @_rand: Buffer for RAND value
1086
* @autn: Buffer for AUTN value
1087
* @ik: Buffer for IK value
1088
* @ck: Buffer for CK value
1089
* @res: Buffer for RES value
1090
* @res_len: Buffer for RES length
1091
* @cb_session_ctx: Session callback context for get_complete_cb()
1092
* Returns: 0 on success, -1 (EAP_SIM_DB_FAILURE) on error (e.g., user not
1093
* found), or -2 (EAP_SIM_DB_PENDING) if results are not yet available. In this
1094
* case, the callback function registered with eap_sim_db_init() will be
1095
* called once the results become available.
1097
* In most cases, the user name is '0' | IMSI, i.e., 0 followed by the IMSI in
1100
* When using an external server for AKA authentication, this function can
1101
* always start a request and return EAP_SIM_DB_PENDING immediately if
1102
* authentication triplets are not available. Once the authentication data are
1103
* received, callback function registered with eap_sim_db_init() is called to
1104
* notify EAP state machine to reprocess the message. This
1105
* eap_sim_db_get_aka_auth() function will then be called again and the newly
1106
* received triplets will then be given to the caller.
1108
int eap_sim_db_get_aka_auth(void *priv, const u8 *identity,
1109
size_t identity_len, u8 *_rand, u8 *autn, u8 *ik,
1110
u8 *ck, u8 *res, size_t *res_len,
1111
void *cb_session_ctx)
1113
struct eap_sim_db_data *data = priv;
1114
struct eap_sim_db_pending *entry;
1119
if (identity_len < 2 || identity == NULL ||
1120
identity[0] != EAP_AKA_PERMANENT_PREFIX ||
1121
identity_len + 1 > sizeof(entry->imsi)) {
1122
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: unexpected identity",
1123
identity, identity_len);
1124
return EAP_SIM_DB_FAILURE;
1128
for (i = 0; i < identity_len; i++) {
1129
if (identity[i] == '@') {
1134
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Get AKA auth for IMSI",
1135
identity, identity_len);
1137
entry = eap_sim_db_get_pending(data, identity, identity_len, 1);
1139
if (entry->state == FAILURE) {
1141
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failure");
1142
return EAP_SIM_DB_FAILURE;
1145
if (entry->state == PENDING) {
1146
eap_sim_db_add_pending(data, entry);
1147
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending");
1148
return EAP_SIM_DB_PENDING;
1151
wpa_printf(MSG_DEBUG, "EAP-SIM DB: Returning successfully "
1152
"received authentication data");
1153
memcpy(_rand, entry->u.aka.rand, EAP_AKA_RAND_LEN);
1154
memcpy(autn, entry->u.aka.autn, EAP_AKA_AUTN_LEN);
1155
memcpy(ik, entry->u.aka.ik, EAP_AKA_IK_LEN);
1156
memcpy(ck, entry->u.aka.ck, EAP_AKA_CK_LEN);
1157
memcpy(res, entry->u.aka.res, EAP_AKA_RES_MAX_LEN);
1158
*res_len = entry->u.aka.res_len;
1163
if (data->sock < 0) {
1164
if (eap_sim_db_open_socket(data) < 0)
1165
return EAP_SIM_DB_FAILURE;
1168
len = snprintf(msg, sizeof(msg), "AKA-REQ-AUTH ");
1169
if (len < 0 || len + identity_len >= sizeof(msg))
1170
return EAP_SIM_DB_FAILURE;
1171
memcpy(msg + len, identity, identity_len);
1172
len += identity_len;
1174
wpa_hexdump(MSG_DEBUG, "EAP-SIM DB: requesting AKA authentication "
1175
"data for IMSI", identity, identity_len);
1176
if (eap_sim_db_send(data, msg, len) < 0)
1177
return EAP_SIM_DB_FAILURE;
1179
entry = os_zalloc(sizeof(*entry));
1181
return EAP_SIM_DB_FAILURE;
1183
os_get_time(&entry->timestamp);
1185
memcpy(entry->imsi, identity, identity_len);
1186
entry->imsi_len = identity_len;
1187
entry->cb_session_ctx = cb_session_ctx;
1188
entry->state = PENDING;
1189
eap_sim_db_add_pending(data, entry);
1190
eap_sim_db_expire_pending(data);
1192
return EAP_SIM_DB_PENDING;
1197
* eap_sim_db_resynchronize - Resynchronize AKA AUTN
1198
* @priv: Private data pointer from eap_sim_db_init()
1199
* @identity: User name identity
1200
* @identity_len: Length of identity in bytes
1201
* @auts: AUTS value from the peer
1202
* @_rand: RAND value used in the rejected message
1203
* Returns: 0 on success, -1 on failure
1205
* This function is called when the peer reports synchronization failure in the
1206
* AUTN value by sending AUTS. The AUTS and RAND values should be sent to
1207
* HLR/AuC to allow it to resynchronize with the peer. After this,
1208
* eap_sim_db_get_aka_auth() will be called again to to fetch updated
1209
* RAND/AUTN values for the next challenge.
1211
int eap_sim_db_resynchronize(void *priv, const u8 *identity,
1212
size_t identity_len, const u8 *auts,
1215
struct eap_sim_db_data *data = priv;
1217
if (identity_len < 2 || identity[0] != EAP_AKA_PERMANENT_PREFIX ||
1218
identity_len > 20) {
1219
wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: unexpected identity",
1220
identity, identity_len);
1224
if (data->sock >= 0) {
1228
len = snprintf(msg, sizeof(msg), "AKA-AUTS ");
1229
if (len < 0 || len + identity_len - 1 >= sizeof(msg))
1231
memcpy(msg + len, identity + 1, identity_len - 1);
1232
len += identity_len - 1;
1234
ret = snprintf(msg + len, sizeof(msg) - len, " ");
1235
if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
1238
len += wpa_snprintf_hex(msg + len, sizeof(msg) - len,
1239
auts, EAP_AKA_AUTS_LEN);
1240
ret = snprintf(msg + len, sizeof(msg) - len, " ");
1241
if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
1244
len += wpa_snprintf_hex(msg + len, sizeof(msg) - len,
1245
_rand, EAP_AKA_RAND_LEN);
1246
wpa_hexdump(MSG_DEBUG, "EAP-SIM DB: reporting AKA AUTS for "
1247
"IMSI", identity + 1, identity_len - 1);
1248
if (eap_sim_db_send(data, msg, len) < 0)
added
removed
src/eap_server/eap_sim_db.c
