2 * hostapd / EAP-SIM database/authenticator gateway
3 * Copyright (c) 2005-2006, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
14 * This is an example implementation of the EAP-SIM/AKA database/authentication
15 * gateway interface that is using an external program as an SS7 gateway to
16 * GSM/UMTS authentication center (HLR/AuC). hlr_auc_gw is an example
17 * implementation of such a gateway program. This eap_sim_db.c takes care of
18 * EAP-SIM/AKA pseudonyms and re-auth identities. It can be used with different
19 * gateway implementations for HLR/AuC access. Alternatively, it can also be
20 * completely replaced if the in-memory database of pseudonyms/re-auth
21 * identities is not suitable for some cases.
28 #include "eap_sim_common.h"
29 #include "eap_sim_db.h"
32 struct eap_sim_pseudonym {
33 struct eap_sim_pseudonym *next;
39 struct eap_sim_db_pending {
40 struct eap_sim_db_pending *next;
43 enum { PENDING, SUCCESS, FAILURE } state;
45 struct os_time timestamp;
49 u8 kc[EAP_SIM_MAX_CHAL][EAP_SIM_KC_LEN];
50 u8 sres[EAP_SIM_MAX_CHAL][EAP_SIM_SRES_LEN];
51 u8 rand[EAP_SIM_MAX_CHAL][GSM_RAND_LEN];
55 u8 rand[EAP_AKA_RAND_LEN];
56 u8 autn[EAP_AKA_AUTN_LEN];
57 u8 ik[EAP_AKA_IK_LEN];
58 u8 ck[EAP_AKA_CK_LEN];
59 u8 res[EAP_AKA_RES_MAX_LEN];
65 struct eap_sim_db_data {
69 void (*get_complete_cb)(void *ctx, void *session_ctx);
71 struct eap_sim_pseudonym *pseudonyms;
72 struct eap_sim_reauth *reauths;
73 struct eap_sim_db_pending *pending;
77 static struct eap_sim_db_pending *
78 eap_sim_db_get_pending(struct eap_sim_db_data *data, const u8 *imsi,
79 size_t imsi_len, int aka)
81 struct eap_sim_db_pending *entry, *prev = NULL;
83 entry = data->pending;
85 if (entry->aka == aka && entry->imsi_len == imsi_len &&
86 memcmp(entry->imsi, imsi, imsi_len) == 0) {
88 prev->next = entry->next;
90 data->pending = entry->next;
100 static void eap_sim_db_add_pending(struct eap_sim_db_data *data,
101 struct eap_sim_db_pending *entry)
103 entry->next = data->pending;
104 data->pending = entry;
108 static void eap_sim_db_sim_resp_auth(struct eap_sim_db_data *data,
109 const char *imsi, char *buf)
111 char *start, *end, *pos;
112 struct eap_sim_db_pending *entry;
116 * SIM-RESP-AUTH <IMSI> Kc(i):SRES(i):RAND(i) ...
117 * SIM-RESP-AUTH <IMSI> FAILURE
118 * (IMSI = ASCII string, Kc/SRES/RAND = hex string)
121 entry = eap_sim_db_get_pending(data, (u8 *) imsi, strlen(imsi), 0);
123 wpa_printf(MSG_DEBUG, "EAP-SIM DB: No pending entry for the "
124 "received message found");
129 if (strncmp(start, "FAILURE", 7) == 0) {
130 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External server reported "
132 entry->state = FAILURE;
133 eap_sim_db_add_pending(data, entry);
134 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
139 while (num_chal < EAP_SIM_MAX_CHAL) {
140 end = strchr(start, ' ');
144 pos = strchr(start, ':');
148 if (hexstr2bin(start, entry->u.sim.kc[num_chal],
153 pos = strchr(start, ':');
157 if (hexstr2bin(start, entry->u.sim.sres[num_chal],
162 if (hexstr2bin(start, entry->u.sim.rand[num_chal],
172 entry->u.sim.num_chal = num_chal;
174 entry->state = SUCCESS;
175 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Authentication data parsed "
176 "successfully - callback");
177 eap_sim_db_add_pending(data, entry);
178 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
182 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
187 static void eap_sim_db_aka_resp_auth(struct eap_sim_db_data *data,
188 const char *imsi, char *buf)
191 struct eap_sim_db_pending *entry;
194 * AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES>
195 * AKA-RESP-AUTH <IMSI> FAILURE
196 * (IMSI = ASCII string, RAND/AUTN/IK/CK/RES = hex string)
199 entry = eap_sim_db_get_pending(data, (u8 *) imsi, strlen(imsi), 1);
201 wpa_printf(MSG_DEBUG, "EAP-SIM DB: No pending entry for the "
202 "received message found");
207 if (strncmp(start, "FAILURE", 7) == 0) {
208 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External server reported "
210 entry->state = FAILURE;
211 eap_sim_db_add_pending(data, entry);
212 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
216 end = strchr(start, ' ');
220 if (hexstr2bin(start, entry->u.aka.rand, EAP_AKA_RAND_LEN))
224 end = strchr(start, ' ');
228 if (hexstr2bin(start, entry->u.aka.autn, EAP_AKA_AUTN_LEN))
232 end = strchr(start, ' ');
236 if (hexstr2bin(start, entry->u.aka.ik, EAP_AKA_IK_LEN))
240 end = strchr(start, ' ');
244 if (hexstr2bin(start, entry->u.aka.ck, EAP_AKA_CK_LEN))
248 end = strchr(start, ' ');
256 entry->u.aka.res_len = (end - start) / 2;
257 if (entry->u.aka.res_len > EAP_AKA_RES_MAX_LEN) {
258 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Too long RES");
259 entry->u.aka.res_len = 0;
262 if (hexstr2bin(start, entry->u.aka.res, entry->u.aka.res_len))
265 entry->state = SUCCESS;
266 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Authentication data parsed "
267 "successfully - callback");
268 eap_sim_db_add_pending(data, entry);
269 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
273 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
278 static void eap_sim_db_receive(int sock, void *eloop_ctx, void *sock_ctx)
280 struct eap_sim_db_data *data = eloop_ctx;
281 char buf[1000], *pos, *cmd, *imsi;
284 res = recv(sock, buf, sizeof(buf), 0);
287 wpa_hexdump_ascii_key(MSG_MSGDUMP, "EAP-SIM DB: Received from an "
288 "external source", (u8 *) buf, res);
291 if (res >= (int) sizeof(buf))
292 res = sizeof(buf) - 1;
295 if (data->get_complete_cb == NULL) {
296 wpa_printf(MSG_DEBUG, "EAP-SIM DB: No get_complete_cb "
301 /* <cmd> <IMSI> ... */
304 pos = strchr(cmd, ' ');
309 pos = strchr(imsi, ' ');
313 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External response=%s for IMSI %s",
316 if (strcmp(cmd, "SIM-RESP-AUTH") == 0)
317 eap_sim_db_sim_resp_auth(data, imsi, pos + 1);
318 else if (strcmp(cmd, "AKA-RESP-AUTH") == 0)
319 eap_sim_db_aka_resp_auth(data, imsi, pos + 1);
321 wpa_printf(MSG_INFO, "EAP-SIM DB: Unknown external response "
326 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
330 static int eap_sim_db_open_socket(struct eap_sim_db_data *data)
332 struct sockaddr_un addr;
333 static int counter = 0;
335 if (strncmp(data->fname, "unix:", 5) != 0)
338 data->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
339 if (data->sock < 0) {
340 perror("socket(eap_sim_db)");
344 memset(&addr, 0, sizeof(addr));
345 addr.sun_family = AF_UNIX;
346 snprintf(addr.sun_path, sizeof(addr.sun_path),
347 "/tmp/eap_sim_db_%d-%d", getpid(), counter++);
348 data->local_sock = strdup(addr.sun_path);
349 if (bind(data->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
350 perror("bind(eap_sim_db)");
356 memset(&addr, 0, sizeof(addr));
357 addr.sun_family = AF_UNIX;
358 snprintf(addr.sun_path, sizeof(addr.sun_path), "%s", data->fname + 5);
359 if (connect(data->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
360 perror("connect(eap_sim_db)");
361 wpa_hexdump_ascii(MSG_INFO, "HLR/AuC GW socket",
362 (u8 *) addr.sun_path, strlen(addr.sun_path));
368 eloop_register_read_sock(data->sock, eap_sim_db_receive, data, NULL);
374 static void eap_sim_db_close_socket(struct eap_sim_db_data *data)
376 if (data->sock >= 0) {
377 eloop_unregister_read_sock(data->sock);
381 if (data->local_sock) {
382 unlink(data->local_sock);
383 free(data->local_sock);
384 data->local_sock = NULL;
390 * eap_sim_db_init - Initialize EAP-SIM DB / authentication gateway interface
391 * @config: Configuration data (e.g., file name)
392 * @get_complete_cb: Callback function for reporting availability of triplets
393 * @ctx: Context pointer for get_complete_cb
394 * Returns: Pointer to a private data structure or %NULL on failure
396 void * eap_sim_db_init(const char *config,
397 void (*get_complete_cb)(void *ctx, void *session_ctx),
400 struct eap_sim_db_data *data;
402 data = wpa_zalloc(sizeof(*data));
407 data->get_complete_cb = get_complete_cb;
409 data->fname = strdup(config);
410 if (data->fname == NULL)
413 if (strncmp(data->fname, "unix:", 5) == 0) {
414 if (eap_sim_db_open_socket(data))
421 eap_sim_db_close_socket(data);
428 static void eap_sim_db_free_pseudonym(struct eap_sim_pseudonym *p)
436 static void eap_sim_db_free_reauth(struct eap_sim_reauth *r)
445 * eap_sim_db_deinit - Deinitialize EAP-SIM DB/authentication gw interface
446 * @priv: Private data pointer from eap_sim_db_init()
448 void eap_sim_db_deinit(void *priv)
450 struct eap_sim_db_data *data = priv;
451 struct eap_sim_pseudonym *p, *prev;
452 struct eap_sim_reauth *r, *prevr;
453 struct eap_sim_db_pending *pending, *prev_pending;
455 eap_sim_db_close_socket(data);
458 p = data->pseudonyms;
462 eap_sim_db_free_pseudonym(prev);
469 eap_sim_db_free_reauth(prevr);
472 pending = data->pending;
474 prev_pending = pending;
475 pending = pending->next;
483 static int eap_sim_db_send(struct eap_sim_db_data *data, const char *msg,
488 if (send(data->sock, msg, len, 0) < 0) {
490 perror("send[EAP-SIM DB UNIX]");
493 if (_errno == ENOTCONN || _errno == EDESTADDRREQ || _errno == EINVAL ||
494 _errno == ECONNREFUSED) {
495 /* Try to reconnect */
496 eap_sim_db_close_socket(data);
497 if (eap_sim_db_open_socket(data) < 0)
499 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Reconnected to the "
501 if (send(data->sock, msg, len, 0) < 0) {
502 perror("send[EAP-SIM DB UNIX]");
511 static void eap_sim_db_expire_pending(struct eap_sim_db_data *data)
513 /* TODO: add limit for maximum length for pending list; remove latest
514 * (i.e., last) entry from the list if the limit is reached; could also
515 * use timeout to expire pending entries */
520 * eap_sim_db_get_gsm_triplets - Get GSM triplets
521 * @priv: Private data pointer from eap_sim_db_init()
522 * @identity: User name identity
523 * @identity_len: Length of identity in bytes
524 * @max_chal: Maximum number of triplets
525 * @_rand: Buffer for RAND values
526 * @kc: Buffer for Kc values
527 * @sres: Buffer for SRES values
528 * @cb_session_ctx: Session callback context for get_complete_cb()
529 * Returns: Number of triplets received (has to be less than or equal to
530 * max_chal), -1 (EAP_SIM_DB_FAILURE) on error (e.g., user not found), or
531 * -2 (EAP_SIM_DB_PENDING) if results are not yet available. In this case, the
532 * callback function registered with eap_sim_db_init() will be called once the
533 * results become available.
535 * In most cases, the user name is '1' | IMSI, i.e., 1 followed by the IMSI in
538 * When using an external server for GSM triplets, this function can always
539 * start a request and return EAP_SIM_DB_PENDING immediately if authentication
540 * triplets are not available. Once the triplets are received, callback
541 * function registered with eap_sim_db_init() is called to notify EAP state
542 * machine to reprocess the message. This eap_sim_db_get_gsm_triplets()
543 * function will then be called again and the newly received triplets will then
544 * be given to the caller.
546 int eap_sim_db_get_gsm_triplets(void *priv, const u8 *identity,
547 size_t identity_len, int max_chal,
548 u8 *_rand, u8 *kc, u8 *sres,
549 void *cb_session_ctx)
551 struct eap_sim_db_data *data = priv;
552 struct eap_sim_db_pending *entry;
557 if (identity_len < 2 || identity[0] != EAP_SIM_PERMANENT_PREFIX ||
558 identity_len + 1 > sizeof(entry->imsi)) {
559 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: unexpected identity",
560 identity, identity_len);
561 return EAP_SIM_DB_FAILURE;
565 for (i = 0; i < identity_len; i++) {
566 if (identity[i] == '@') {
571 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Get GSM triplets for IMSI",
572 identity, identity_len);
574 entry = eap_sim_db_get_pending(data, identity, identity_len, 0);
577 if (entry->state == FAILURE) {
578 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
581 return EAP_SIM_DB_FAILURE;
584 if (entry->state == PENDING) {
585 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
587 eap_sim_db_add_pending(data, entry);
588 return EAP_SIM_DB_PENDING;
591 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
592 "%d challenges", entry->u.sim.num_chal);
593 num_chal = entry->u.sim.num_chal;
594 if (num_chal > max_chal)
596 memcpy(_rand, entry->u.sim.rand, num_chal * GSM_RAND_LEN);
597 memcpy(sres, entry->u.sim.sres, num_chal * EAP_SIM_SRES_LEN);
598 memcpy(kc, entry->u.sim.kc, num_chal * EAP_SIM_KC_LEN);
603 if (data->sock < 0) {
604 if (eap_sim_db_open_socket(data) < 0)
605 return EAP_SIM_DB_FAILURE;
608 len = snprintf(msg, sizeof(msg), "SIM-REQ-AUTH ");
609 if (len < 0 || len + identity_len >= sizeof(msg))
610 return EAP_SIM_DB_FAILURE;
611 memcpy(msg + len, identity, identity_len);
613 ret = snprintf(msg + len, sizeof(msg) - len, " %d", max_chal);
614 if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
615 return EAP_SIM_DB_FAILURE;
618 wpa_hexdump(MSG_DEBUG, "EAP-SIM DB: requesting SIM authentication "
619 "data for IMSI", identity, identity_len);
620 if (eap_sim_db_send(data, msg, len) < 0)
621 return EAP_SIM_DB_FAILURE;
623 entry = wpa_zalloc(sizeof(*entry));
625 return EAP_SIM_DB_FAILURE;
627 os_get_time(&entry->timestamp);
628 memcpy(entry->imsi, identity, identity_len);
629 entry->imsi_len = identity_len;
630 entry->cb_session_ctx = cb_session_ctx;
631 entry->state = PENDING;
632 eap_sim_db_add_pending(data, entry);
633 eap_sim_db_expire_pending(data);
635 return EAP_SIM_DB_PENDING;
639 static struct eap_sim_pseudonym *
640 eap_sim_db_get_pseudonym(struct eap_sim_db_data *data, const u8 *identity,
645 struct eap_sim_pseudonym *p;
647 if (identity_len == 0 ||
648 (identity[0] != EAP_SIM_PSEUDONYM_PREFIX &&
649 identity[0] != EAP_AKA_PSEUDONYM_PREFIX))
652 /* Remove possible realm from identity */
654 while (len < identity_len) {
655 if (identity[len] == '@')
660 pseudonym = malloc(len + 1);
661 if (pseudonym == NULL)
663 memcpy(pseudonym, identity, len);
664 pseudonym[len] = '\0';
666 p = data->pseudonyms;
668 if (strcmp(p->pseudonym, pseudonym) == 0)
679 static struct eap_sim_pseudonym *
680 eap_sim_db_get_pseudonym_id(struct eap_sim_db_data *data, const u8 *identity,
683 struct eap_sim_pseudonym *p;
685 if (identity_len == 0 ||
686 (identity[0] != EAP_SIM_PERMANENT_PREFIX &&
687 identity[0] != EAP_AKA_PERMANENT_PREFIX))
690 p = data->pseudonyms;
692 if (identity_len == p->identity_len &&
693 memcmp(p->identity, identity, identity_len) == 0)
702 static struct eap_sim_reauth *
703 eap_sim_db_get_reauth(struct eap_sim_db_data *data, const u8 *identity,
708 struct eap_sim_reauth *r;
710 if (identity_len == 0 ||
711 (identity[0] != EAP_SIM_REAUTH_ID_PREFIX &&
712 identity[0] != EAP_AKA_REAUTH_ID_PREFIX))
715 /* Remove possible realm from identity */
717 while (len < identity_len) {
718 if (identity[len] == '@')
723 reauth_id = malloc(len + 1);
724 if (reauth_id == NULL)
726 memcpy(reauth_id, identity, len);
727 reauth_id[len] = '\0';
731 if (strcmp(r->reauth_id, reauth_id) == 0)
742 static struct eap_sim_reauth *
743 eap_sim_db_get_reauth_id(struct eap_sim_db_data *data, const u8 *identity,
746 struct eap_sim_pseudonym *p;
747 struct eap_sim_reauth *r;
749 if (identity_len == 0)
752 p = eap_sim_db_get_pseudonym(data, identity, identity_len);
754 p = eap_sim_db_get_pseudonym_id(data, identity, identity_len);
756 identity = p->identity;
757 identity_len = p->identity_len;
762 if (identity_len == r->identity_len &&
763 memcmp(r->identity, identity, identity_len) == 0)
773 * eap_sim_db_identity_known - Verify whether the given identity is known
774 * @priv: Private data pointer from eap_sim_db_init()
775 * @identity: User name identity
776 * @identity_len: Length of identity in bytes
777 * Returns: 0 if the user is found or -1 on failure
779 * In most cases, the user name is ['0','1'] | IMSI, i.e., 1 followed by the
780 * IMSI in ASCII format, ['2','3'] | pseudonym, or ['4','5'] | reauth_id.
782 int eap_sim_db_identity_known(void *priv, const u8 *identity,
785 struct eap_sim_db_data *data = priv;
787 if (identity == NULL || identity_len < 2)
790 if (identity[0] == EAP_SIM_PSEUDONYM_PREFIX ||
791 identity[0] == EAP_AKA_PSEUDONYM_PREFIX) {
792 struct eap_sim_pseudonym *p =
793 eap_sim_db_get_pseudonym(data, identity, identity_len);
797 if (identity[0] == EAP_SIM_REAUTH_ID_PREFIX ||
798 identity[0] == EAP_AKA_REAUTH_ID_PREFIX) {
799 struct eap_sim_reauth *r =
800 eap_sim_db_get_reauth(data, identity, identity_len);
804 if (identity[0] != EAP_SIM_PERMANENT_PREFIX &&
805 identity[0] != EAP_AKA_PERMANENT_PREFIX) {
806 /* Unknown identity prefix */
810 /* TODO: Should consider asking HLR/AuC gateway whether this permanent
811 * identity is known. If it is, EAP-SIM/AKA can skip identity request.
812 * In case of EAP-AKA, this would reduce number of needed round-trips.
813 * Ideally, this would be done with one wait, i.e., just request
814 * authentication data and store it for the next use. This would then
815 * need to use similar pending-request functionality as the normal
816 * request for authentication data at later phase.
822 static char * eap_sim_db_get_next(struct eap_sim_db_data *data, char prefix)
824 char *id, *pos, *end;
827 if (hostapd_get_rand(buf, sizeof(buf)))
829 id = malloc(sizeof(buf) * 2 + 2);
834 end = id + sizeof(buf) * 2 + 2;
836 pos += wpa_snprintf_hex(pos, end - pos, buf, sizeof(buf));
843 * eap_sim_db_get_next_pseudonym - EAP-SIM DB: Get next pseudonym
844 * @priv: Private data pointer from eap_sim_db_init()
845 * @aka: Using EAP-AKA instead of EAP-SIM
846 * Returns: Next pseudonym (allocated string) or %NULL on failure
848 * This function is used to generate a pseudonym for EAP-SIM. The returned
849 * pseudonym is not added to database at this point; it will need to be added
850 * with eap_sim_db_add_pseudonym() once the authentication has been completed
851 * successfully. Caller is responsible for freeing the returned buffer.
853 char * eap_sim_db_get_next_pseudonym(void *priv, int aka)
855 struct eap_sim_db_data *data = priv;
856 return eap_sim_db_get_next(data, aka ? EAP_AKA_PSEUDONYM_PREFIX :
857 EAP_SIM_PSEUDONYM_PREFIX);
862 * eap_sim_db_get_next_reauth_id - EAP-SIM DB: Get next reauth_id
863 * @priv: Private data pointer from eap_sim_db_init()
864 * @aka: Using EAP-AKA instead of EAP-SIM
865 * Returns: Next reauth_id (allocated string) or %NULL on failure
867 * This function is used to generate a fast re-authentication identity for
868 * EAP-SIM. The returned reauth_id is not added to database at this point; it
869 * will need to be added with eap_sim_db_add_reauth() once the authentication
870 * has been completed successfully. Caller is responsible for freeing the
873 char * eap_sim_db_get_next_reauth_id(void *priv, int aka)
875 struct eap_sim_db_data *data = priv;
876 return eap_sim_db_get_next(data, aka ? EAP_AKA_REAUTH_ID_PREFIX :
877 EAP_SIM_REAUTH_ID_PREFIX);
882 * eap_sim_db_add_pseudonym - EAP-SIM DB: Add new pseudonym
883 * @priv: Private data pointer from eap_sim_db_init()
884 * @identity: Identity of the user (may be permanent identity or pseudonym)
885 * @identity_len: Length of identity
886 * @pseudonym: Pseudonym for this user. This needs to be an allocated buffer,
887 * e.g., return value from eap_sim_db_get_next_pseudonym(). Caller must not
889 * Returns: 0 on success, -1 on failure
891 * This function adds a new pseudonym for EAP-SIM user. EAP-SIM DB is
892 * responsible of freeing pseudonym buffer once it is not needed anymore.
894 int eap_sim_db_add_pseudonym(void *priv, const u8 *identity,
895 size_t identity_len, char *pseudonym)
897 struct eap_sim_db_data *data = priv;
898 struct eap_sim_pseudonym *p;
899 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Add pseudonym for identity",
900 identity, identity_len);
901 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pseudonym: %s", pseudonym);
903 /* TODO: could store last two pseudonyms */
904 p = eap_sim_db_get_pseudonym(data, identity, identity_len);
906 p = eap_sim_db_get_pseudonym_id(data, identity, identity_len);
909 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Replacing previous "
910 "pseudonym: %s", p->pseudonym);
912 p->pseudonym = pseudonym;
916 p = wpa_zalloc(sizeof(*p));
922 p->next = data->pseudonyms;
923 p->identity = malloc(identity_len);
924 if (p->identity == NULL) {
929 memcpy(p->identity, identity, identity_len);
930 p->identity_len = identity_len;
931 p->pseudonym = pseudonym;
932 data->pseudonyms = p;
934 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Added new pseudonym entry");
940 * eap_sim_db_add_reauth - EAP-SIM DB: Add new re-authentication entry
941 * @priv: Private data pointer from eap_sim_db_init()
942 * @identity: Identity of the user (may be permanent identity or pseudonym)
943 * @identity_len: Length of identity
944 * @reauth_id: reauth_id for this user. This needs to be an allocated buffer,
945 * e.g., return value from eap_sim_db_get_next_reauth_id(). Caller must not
947 * @mk: 16-byte MK from the previous full authentication
948 * Returns: 0 on success, -1 on failure
950 * This function adds a new re-authentication entry for an EAP-SIM user.
951 * EAP-SIM DB is responsible of freeing reauth_id buffer once it is not needed
954 int eap_sim_db_add_reauth(void *priv, const u8 *identity,
955 size_t identity_len, char *reauth_id, u16 counter,
958 struct eap_sim_db_data *data = priv;
959 struct eap_sim_reauth *r;
960 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Add reauth_id for identity",
961 identity, identity_len);
962 wpa_printf(MSG_DEBUG, "EAP-SIM DB: reauth_id: %s", reauth_id);
964 r = eap_sim_db_get_reauth(data, identity, identity_len);
966 r = eap_sim_db_get_reauth_id(data, identity, identity_len);
969 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Replacing previous "
970 "reauth_id: %s", r->reauth_id);
972 r->reauth_id = reauth_id;
974 r = wpa_zalloc(sizeof(*r));
980 r->next = data->reauths;
981 r->identity = malloc(identity_len);
982 if (r->identity == NULL) {
987 memcpy(r->identity, identity, identity_len);
988 r->identity_len = identity_len;
989 r->reauth_id = reauth_id;
991 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Added new reauth entry");
994 r->counter = counter;
995 memcpy(r->mk, mk, EAP_SIM_MK_LEN);
1002 * eap_sim_db_get_permanent - EAP-SIM DB: Get permanent identity
1003 * @priv: Private data pointer from eap_sim_db_init()
1004 * @identity: Identity of the user (may be permanent identity or pseudonym)
1005 * @identity_len: Length of identity
1006 * @len: Buffer for length of the returned permanent identity
1007 * Returns: Pointer to the permanent identity, or %NULL if not found
1009 const u8 * eap_sim_db_get_permanent(void *priv, const u8 *identity,
1010 size_t identity_len, size_t *len)
1012 struct eap_sim_db_data *data = priv;
1013 struct eap_sim_pseudonym *p;
1015 if (identity == NULL)
1018 p = eap_sim_db_get_pseudonym(data, identity, identity_len);
1020 p = eap_sim_db_get_pseudonym_id(data, identity, identity_len);
1024 *len = p->identity_len;
1030 * eap_sim_db_get_reauth_entry - EAP-SIM DB: Get re-authentication entry
1031 * @priv: Private data pointer from eap_sim_db_init()
1032 * @identity: Identity of the user (may be permanent identity, pseudonym, or
1034 * @identity_len: Length of identity
1035 * @len: Buffer for length of the returned permanent identity
1036 * Returns: Pointer to the re-auth entry, or %NULL if not found
1038 struct eap_sim_reauth *
1039 eap_sim_db_get_reauth_entry(void *priv, const u8 *identity,
1040 size_t identity_len)
1042 struct eap_sim_db_data *data = priv;
1043 struct eap_sim_reauth *r;
1045 if (identity == NULL)
1047 r = eap_sim_db_get_reauth(data, identity, identity_len);
1049 r = eap_sim_db_get_reauth_id(data, identity, identity_len);
1055 * eap_sim_db_remove_reauth - EAP-SIM DB: Remove re-authentication entry
1056 * @priv: Private data pointer from eap_sim_db_init()
1057 * @reauth: Pointer to re-authentication entry from
1058 * eap_sim_db_get_reauth_entry()
1060 void eap_sim_db_remove_reauth(void *priv, struct eap_sim_reauth *reauth)
1062 struct eap_sim_db_data *data = priv;
1063 struct eap_sim_reauth *r, *prev = NULL;
1068 prev->next = r->next;
1070 data->reauths = r->next;
1071 eap_sim_db_free_reauth(r);
1081 * eap_sim_db_get_aka_auth - Get AKA authentication values
1082 * @priv: Private data pointer from eap_sim_db_init()
1083 * @identity: User name identity
1084 * @identity_len: Length of identity in bytes
1085 * @_rand: Buffer for RAND value
1086 * @autn: Buffer for AUTN value
1087 * @ik: Buffer for IK value
1088 * @ck: Buffer for CK value
1089 * @res: Buffer for RES value
1090 * @res_len: Buffer for RES length
1091 * @cb_session_ctx: Session callback context for get_complete_cb()
1092 * Returns: 0 on success, -1 (EAP_SIM_DB_FAILURE) on error (e.g., user not
1093 * found), or -2 (EAP_SIM_DB_PENDING) if results are not yet available. In this
1094 * case, the callback function registered with eap_sim_db_init() will be
1095 * called once the results become available.
1097 * In most cases, the user name is '0' | IMSI, i.e., 0 followed by the IMSI in
1100 * When using an external server for AKA authentication, this function can
1101 * always start a request and return EAP_SIM_DB_PENDING immediately if
1102 * authentication triplets are not available. Once the authentication data are
1103 * received, callback function registered with eap_sim_db_init() is called to
1104 * notify EAP state machine to reprocess the message. This
1105 * eap_sim_db_get_aka_auth() function will then be called again and the newly
1106 * received triplets will then be given to the caller.
1108 int eap_sim_db_get_aka_auth(void *priv, const u8 *identity,
1109 size_t identity_len, u8 *_rand, u8 *autn, u8 *ik,
1110 u8 *ck, u8 *res, size_t *res_len,
1111 void *cb_session_ctx)
1113 struct eap_sim_db_data *data = priv;
1114 struct eap_sim_db_pending *entry;
1119 if (identity_len < 2 || identity == NULL ||
1120 identity[0] != EAP_AKA_PERMANENT_PREFIX ||
1121 identity_len + 1 > sizeof(entry->imsi)) {
1122 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: unexpected identity",
1123 identity, identity_len);
1124 return EAP_SIM_DB_FAILURE;
1128 for (i = 0; i < identity_len; i++) {
1129 if (identity[i] == '@') {
1134 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: Get AKA auth for IMSI",
1135 identity, identity_len);
1137 entry = eap_sim_db_get_pending(data, identity, identity_len, 1);
1139 if (entry->state == FAILURE) {
1141 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failure");
1142 return EAP_SIM_DB_FAILURE;
1145 if (entry->state == PENDING) {
1146 eap_sim_db_add_pending(data, entry);
1147 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending");
1148 return EAP_SIM_DB_PENDING;
1151 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Returning successfully "
1152 "received authentication data");
1153 memcpy(_rand, entry->u.aka.rand, EAP_AKA_RAND_LEN);
1154 memcpy(autn, entry->u.aka.autn, EAP_AKA_AUTN_LEN);
1155 memcpy(ik, entry->u.aka.ik, EAP_AKA_IK_LEN);
1156 memcpy(ck, entry->u.aka.ck, EAP_AKA_CK_LEN);
1157 memcpy(res, entry->u.aka.res, EAP_AKA_RES_MAX_LEN);
1158 *res_len = entry->u.aka.res_len;
1163 if (data->sock < 0) {
1164 if (eap_sim_db_open_socket(data) < 0)
1165 return EAP_SIM_DB_FAILURE;
1168 len = snprintf(msg, sizeof(msg), "AKA-REQ-AUTH ");
1169 if (len < 0 || len + identity_len >= sizeof(msg))
1170 return EAP_SIM_DB_FAILURE;
1171 memcpy(msg + len, identity, identity_len);
1172 len += identity_len;
1174 wpa_hexdump(MSG_DEBUG, "EAP-SIM DB: requesting AKA authentication "
1175 "data for IMSI", identity, identity_len);
1176 if (eap_sim_db_send(data, msg, len) < 0)
1177 return EAP_SIM_DB_FAILURE;
1179 entry = wpa_zalloc(sizeof(*entry));
1181 return EAP_SIM_DB_FAILURE;
1183 os_get_time(&entry->timestamp);
1185 memcpy(entry->imsi, identity, identity_len);
1186 entry->imsi_len = identity_len;
1187 entry->cb_session_ctx = cb_session_ctx;
1188 entry->state = PENDING;
1189 eap_sim_db_add_pending(data, entry);
1190 eap_sim_db_expire_pending(data);
1192 return EAP_SIM_DB_PENDING;
1197 * eap_sim_db_resynchronize - Resynchronize AKA AUTN
1198 * @priv: Private data pointer from eap_sim_db_init()
1199 * @identity: User name identity
1200 * @identity_len: Length of identity in bytes
1201 * @auts: AUTS value from the peer
1202 * @_rand: RAND value used in the rejected message
1203 * Returns: 0 on success, -1 on failure
1205 * This function is called when the peer reports synchronization failure in the
1206 * AUTN value by sending AUTS. The AUTS and RAND values should be sent to
1207 * HLR/AuC to allow it to resynchronize with the peer. After this,
1208 * eap_sim_db_get_aka_auth() will be called again to to fetch updated
1209 * RAND/AUTN values for the next challenge.
1211 int eap_sim_db_resynchronize(void *priv, const u8 *identity,
1212 size_t identity_len, const u8 *auts,
1215 struct eap_sim_db_data *data = priv;
1217 if (identity_len < 2 || identity[0] != EAP_AKA_PERMANENT_PREFIX ||
1218 identity_len > 20) {
1219 wpa_hexdump_ascii(MSG_DEBUG, "EAP-SIM DB: unexpected identity",
1220 identity, identity_len);
1224 if (data->sock >= 0) {
1228 len = snprintf(msg, sizeof(msg), "AKA-AUTS ");
1229 if (len < 0 || len + identity_len - 1 >= sizeof(msg))
1231 memcpy(msg + len, identity + 1, identity_len - 1);
1232 len += identity_len - 1;
1234 ret = snprintf(msg + len, sizeof(msg) - len, " ");
1235 if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
1238 len += wpa_snprintf_hex(msg + len, sizeof(msg) - len,
1239 auts, EAP_AKA_AUTS_LEN);
1240 ret = snprintf(msg + len, sizeof(msg) - len, " ");
1241 if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
1244 len += wpa_snprintf_hex(msg + len, sizeof(msg) - len,
1245 _rand, EAP_AKA_RAND_LEN);
1246 wpa_hexdump(MSG_DEBUG, "EAP-SIM DB: reporting AKA AUTS for "
1247 "IMSI", identity + 1, identity_len - 1);
1248 if (eap_sim_db_send(data, msg, len) < 0)