2 * hostapd / EAP-SIM database/authenticator gateway
3 * Copyright (c) 2005-2010, 2012, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
8 * This is an example implementation of the EAP-SIM/AKA database/authentication
9 * gateway interface that is using an external program as an SS7 gateway to
10 * GSM/UMTS authentication center (HLR/AuC). hlr_auc_gw is an example
11 * implementation of such a gateway program. This eap_sim_db.c takes care of
12 * EAP-SIM/AKA pseudonyms and re-auth identities. It can be used with different
13 * gateway implementations for HLR/AuC access. Alternatively, it can also be
14 * completely replaced if the in-memory database of pseudonyms/re-auth
15 * identities is not suitable for some cases.
22 #endif /* CONFIG_SQLITE */
25 #include "crypto/random.h"
26 #include "eap_common/eap_sim_common.h"
27 #include "eap_server/eap_sim_db.h"
30 struct eap_sim_pseudonym {
31 struct eap_sim_pseudonym *next;
32 char *permanent; /* permanent username */
33 char *pseudonym; /* pseudonym username */
36 struct eap_sim_db_pending {
37 struct eap_sim_db_pending *next;
39 enum { PENDING, SUCCESS, FAILURE } state;
44 u8 kc[EAP_SIM_MAX_CHAL][EAP_SIM_KC_LEN];
45 u8 sres[EAP_SIM_MAX_CHAL][EAP_SIM_SRES_LEN];
46 u8 rand[EAP_SIM_MAX_CHAL][GSM_RAND_LEN];
50 u8 rand[EAP_AKA_RAND_LEN];
51 u8 autn[EAP_AKA_AUTN_LEN];
52 u8 ik[EAP_AKA_IK_LEN];
53 u8 ck[EAP_AKA_CK_LEN];
54 u8 res[EAP_AKA_RES_MAX_LEN];
60 struct eap_sim_db_data {
64 void (*get_complete_cb)(void *ctx, void *session_ctx);
66 struct eap_sim_pseudonym *pseudonyms;
67 struct eap_sim_reauth *reauths;
68 struct eap_sim_db_pending *pending;
71 char db_tmp_identity[100];
72 char db_tmp_pseudonym_str[100];
73 struct eap_sim_pseudonym db_tmp_pseudonym;
74 struct eap_sim_reauth db_tmp_reauth;
75 #endif /* CONFIG_SQLITE */
81 static int db_table_exists(sqlite3 *db, const char *name)
84 os_snprintf(cmd, sizeof(cmd), "SELECT 1 FROM %s;", name);
85 return sqlite3_exec(db, cmd, NULL, NULL, NULL) == SQLITE_OK;
89 static int db_table_create_pseudonym(sqlite3 *db)
93 "CREATE TABLE pseudonyms("
94 " permanent CHAR(21) PRIMARY KEY,"
95 " pseudonym CHAR(21) NOT NULL"
98 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Adding database table for "
99 "pseudonym information");
100 if (sqlite3_exec(db, sql, NULL, NULL, &err) != SQLITE_OK) {
101 wpa_printf(MSG_ERROR, "EAP-SIM DB: SQLite error: %s", err);
110 static int db_table_create_reauth(sqlite3 *db)
114 "CREATE TABLE reauth("
115 " permanent CHAR(21) PRIMARY KEY,"
116 " reauth_id CHAR(21) NOT NULL,"
124 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Adding database table for "
125 "reauth information");
126 if (sqlite3_exec(db, sql, NULL, NULL, &err) != SQLITE_OK) {
127 wpa_printf(MSG_ERROR, "EAP-SIM DB: SQLite error: %s", err);
136 static sqlite3 * db_open(const char *db_file)
140 if (sqlite3_open(db_file, &db)) {
141 wpa_printf(MSG_ERROR, "EAP-SIM DB: Failed to open database "
142 "%s: %s", db_file, sqlite3_errmsg(db));
147 if (!db_table_exists(db, "pseudonyms") &&
148 db_table_create_pseudonym(db) < 0) {
153 if (!db_table_exists(db, "reauth") &&
154 db_table_create_reauth(db) < 0) {
163 static int valid_db_string(const char *str)
165 const char *pos = str;
167 if ((*pos < '0' || *pos > '9') &&
168 (*pos < 'a' || *pos > 'f'))
176 static int db_add_pseudonym(struct eap_sim_db_data *data,
177 const char *permanent, char *pseudonym)
182 if (!valid_db_string(permanent) || !valid_db_string(pseudonym)) {
187 os_snprintf(cmd, sizeof(cmd), "INSERT OR REPLACE INTO pseudonyms "
188 "(permanent, pseudonym) VALUES ('%s', '%s');",
189 permanent, pseudonym);
191 if (sqlite3_exec(data->sqlite_db, cmd, NULL, NULL, &err) != SQLITE_OK)
193 wpa_printf(MSG_ERROR, "EAP-SIM DB: SQLite error: %s", err);
202 static int get_pseudonym_cb(void *ctx, int argc, char *argv[], char *col[])
204 struct eap_sim_db_data *data = ctx;
207 for (i = 0; i < argc; i++) {
208 if (os_strcmp(col[i], "permanent") == 0 && argv[i]) {
209 os_strlcpy(data->db_tmp_identity, argv[i],
210 sizeof(data->db_tmp_identity));
219 db_get_pseudonym(struct eap_sim_db_data *data, const char *pseudonym)
223 if (!valid_db_string(pseudonym))
225 os_memset(&data->db_tmp_identity, 0, sizeof(data->db_tmp_identity));
226 os_snprintf(cmd, sizeof(cmd),
227 "SELECT permanent FROM pseudonyms WHERE pseudonym='%s';",
229 if (sqlite3_exec(data->sqlite_db, cmd, get_pseudonym_cb, data, NULL) !=
232 if (data->db_tmp_identity[0] == '\0')
234 return data->db_tmp_identity;
238 static int db_add_reauth(struct eap_sim_db_data *data, const char *permanent,
239 char *reauth_id, u16 counter, const u8 *mk,
240 const u8 *k_encr, const u8 *k_aut, const u8 *k_re)
242 char cmd[2000], *pos, *end;
245 if (!valid_db_string(permanent) || !valid_db_string(reauth_id)) {
251 end = pos + sizeof(cmd);
252 pos += os_snprintf(pos, end - pos, "INSERT OR REPLACE INTO reauth "
253 "(permanent, reauth_id, counter%s%s%s%s) "
254 "VALUES ('%s', '%s', %u",
256 k_encr ? ", k_encr" : "",
257 k_aut ? ", k_aut" : "",
258 k_re ? ", k_re" : "",
259 permanent, reauth_id, counter);
263 pos += os_snprintf(pos, end - pos, ", '");
264 pos += wpa_snprintf_hex(pos, end - pos, mk, EAP_SIM_MK_LEN);
265 pos += os_snprintf(pos, end - pos, "'");
269 pos += os_snprintf(pos, end - pos, ", '");
270 pos += wpa_snprintf_hex(pos, end - pos, k_encr,
272 pos += os_snprintf(pos, end - pos, "'");
276 pos += os_snprintf(pos, end - pos, ", '");
277 pos += wpa_snprintf_hex(pos, end - pos, k_aut,
278 EAP_AKA_PRIME_K_AUT_LEN);
279 pos += os_snprintf(pos, end - pos, "'");
283 pos += os_snprintf(pos, end - pos, ", '");
284 pos += wpa_snprintf_hex(pos, end - pos, k_re,
285 EAP_AKA_PRIME_K_RE_LEN);
286 pos += os_snprintf(pos, end - pos, "'");
289 os_snprintf(pos, end - pos, ");");
291 if (sqlite3_exec(data->sqlite_db, cmd, NULL, NULL, &err) != SQLITE_OK)
293 wpa_printf(MSG_ERROR, "EAP-SIM DB: SQLite error: %s", err);
302 static int get_reauth_cb(void *ctx, int argc, char *argv[], char *col[])
304 struct eap_sim_db_data *data = ctx;
306 struct eap_sim_reauth *reauth = &data->db_tmp_reauth;
308 for (i = 0; i < argc; i++) {
309 if (os_strcmp(col[i], "permanent") == 0 && argv[i]) {
310 os_strlcpy(data->db_tmp_identity, argv[i],
311 sizeof(data->db_tmp_identity));
312 reauth->permanent = data->db_tmp_identity;
313 } else if (os_strcmp(col[i], "counter") == 0 && argv[i]) {
314 reauth->counter = atoi(argv[i]);
315 } else if (os_strcmp(col[i], "mk") == 0 && argv[i]) {
316 hexstr2bin(argv[i], reauth->mk, sizeof(reauth->mk));
317 } else if (os_strcmp(col[i], "k_encr") == 0 && argv[i]) {
318 hexstr2bin(argv[i], reauth->k_encr,
319 sizeof(reauth->k_encr));
320 } else if (os_strcmp(col[i], "k_aut") == 0 && argv[i]) {
321 hexstr2bin(argv[i], reauth->k_aut,
322 sizeof(reauth->k_aut));
323 } else if (os_strcmp(col[i], "k_re") == 0 && argv[i]) {
324 hexstr2bin(argv[i], reauth->k_re,
325 sizeof(reauth->k_re));
333 static struct eap_sim_reauth *
334 db_get_reauth(struct eap_sim_db_data *data, const char *reauth_id)
338 if (!valid_db_string(reauth_id))
340 os_memset(&data->db_tmp_reauth, 0, sizeof(data->db_tmp_reauth));
341 os_strlcpy(data->db_tmp_pseudonym_str, reauth_id,
342 sizeof(data->db_tmp_pseudonym_str));
343 data->db_tmp_reauth.reauth_id = data->db_tmp_pseudonym_str;
344 os_snprintf(cmd, sizeof(cmd),
345 "SELECT * FROM reauth WHERE reauth_id='%s';", reauth_id);
346 if (sqlite3_exec(data->sqlite_db, cmd, get_reauth_cb, data, NULL) !=
349 if (data->db_tmp_reauth.permanent == NULL)
351 return &data->db_tmp_reauth;
355 static void db_remove_reauth(struct eap_sim_db_data *data,
356 struct eap_sim_reauth *reauth)
360 if (!valid_db_string(reauth->permanent))
362 os_snprintf(cmd, sizeof(cmd),
363 "DELETE FROM reauth WHERE permanent='%s';",
365 sqlite3_exec(data->sqlite_db, cmd, NULL, NULL, NULL);
368 #endif /* CONFIG_SQLITE */
371 static struct eap_sim_db_pending *
372 eap_sim_db_get_pending(struct eap_sim_db_data *data, const char *imsi, int aka)
374 struct eap_sim_db_pending *entry, *prev = NULL;
376 entry = data->pending;
378 if (entry->aka == aka && os_strcmp(entry->imsi, imsi) == 0) {
380 prev->next = entry->next;
382 data->pending = entry->next;
392 static void eap_sim_db_add_pending(struct eap_sim_db_data *data,
393 struct eap_sim_db_pending *entry)
395 entry->next = data->pending;
396 data->pending = entry;
400 static void eap_sim_db_sim_resp_auth(struct eap_sim_db_data *data,
401 const char *imsi, char *buf)
403 char *start, *end, *pos;
404 struct eap_sim_db_pending *entry;
408 * SIM-RESP-AUTH <IMSI> Kc(i):SRES(i):RAND(i) ...
409 * SIM-RESP-AUTH <IMSI> FAILURE
410 * (IMSI = ASCII string, Kc/SRES/RAND = hex string)
413 entry = eap_sim_db_get_pending(data, imsi, 0);
415 wpa_printf(MSG_DEBUG, "EAP-SIM DB: No pending entry for the "
416 "received message found");
421 if (os_strncmp(start, "FAILURE", 7) == 0) {
422 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External server reported "
424 entry->state = FAILURE;
425 eap_sim_db_add_pending(data, entry);
426 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
431 while (num_chal < EAP_SIM_MAX_CHAL) {
432 end = os_strchr(start, ' ');
436 pos = os_strchr(start, ':');
440 if (hexstr2bin(start, entry->u.sim.kc[num_chal],
445 pos = os_strchr(start, ':');
449 if (hexstr2bin(start, entry->u.sim.sres[num_chal],
454 if (hexstr2bin(start, entry->u.sim.rand[num_chal],
464 entry->u.sim.num_chal = num_chal;
466 entry->state = SUCCESS;
467 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Authentication data parsed "
468 "successfully - callback");
469 eap_sim_db_add_pending(data, entry);
470 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
474 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
479 static void eap_sim_db_aka_resp_auth(struct eap_sim_db_data *data,
480 const char *imsi, char *buf)
483 struct eap_sim_db_pending *entry;
486 * AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES>
487 * AKA-RESP-AUTH <IMSI> FAILURE
488 * (IMSI = ASCII string, RAND/AUTN/IK/CK/RES = hex string)
491 entry = eap_sim_db_get_pending(data, imsi, 1);
493 wpa_printf(MSG_DEBUG, "EAP-SIM DB: No pending entry for the "
494 "received message found");
499 if (os_strncmp(start, "FAILURE", 7) == 0) {
500 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External server reported "
502 entry->state = FAILURE;
503 eap_sim_db_add_pending(data, entry);
504 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
508 end = os_strchr(start, ' ');
512 if (hexstr2bin(start, entry->u.aka.rand, EAP_AKA_RAND_LEN))
516 end = os_strchr(start, ' ');
520 if (hexstr2bin(start, entry->u.aka.autn, EAP_AKA_AUTN_LEN))
524 end = os_strchr(start, ' ');
528 if (hexstr2bin(start, entry->u.aka.ik, EAP_AKA_IK_LEN))
532 end = os_strchr(start, ' ');
536 if (hexstr2bin(start, entry->u.aka.ck, EAP_AKA_CK_LEN))
540 end = os_strchr(start, ' ');
548 entry->u.aka.res_len = (end - start) / 2;
549 if (entry->u.aka.res_len > EAP_AKA_RES_MAX_LEN) {
550 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Too long RES");
551 entry->u.aka.res_len = 0;
554 if (hexstr2bin(start, entry->u.aka.res, entry->u.aka.res_len))
557 entry->state = SUCCESS;
558 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Authentication data parsed "
559 "successfully - callback");
560 eap_sim_db_add_pending(data, entry);
561 data->get_complete_cb(data->ctx, entry->cb_session_ctx);
565 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
570 static void eap_sim_db_receive(int sock, void *eloop_ctx, void *sock_ctx)
572 struct eap_sim_db_data *data = eloop_ctx;
573 char buf[1000], *pos, *cmd, *imsi;
576 res = recv(sock, buf, sizeof(buf), 0);
579 wpa_hexdump_ascii_key(MSG_MSGDUMP, "EAP-SIM DB: Received from an "
580 "external source", (u8 *) buf, res);
583 if (res >= (int) sizeof(buf))
584 res = sizeof(buf) - 1;
587 if (data->get_complete_cb == NULL) {
588 wpa_printf(MSG_DEBUG, "EAP-SIM DB: No get_complete_cb "
593 /* <cmd> <IMSI> ... */
596 pos = os_strchr(cmd, ' ');
601 pos = os_strchr(imsi, ' ');
605 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External response=%s for IMSI %s",
608 if (os_strcmp(cmd, "SIM-RESP-AUTH") == 0)
609 eap_sim_db_sim_resp_auth(data, imsi, pos + 1);
610 else if (os_strcmp(cmd, "AKA-RESP-AUTH") == 0)
611 eap_sim_db_aka_resp_auth(data, imsi, pos + 1);
613 wpa_printf(MSG_INFO, "EAP-SIM DB: Unknown external response "
618 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failed to parse response string");
622 static int eap_sim_db_open_socket(struct eap_sim_db_data *data)
624 struct sockaddr_un addr;
625 static int counter = 0;
627 if (os_strncmp(data->fname, "unix:", 5) != 0)
630 data->sock = socket(PF_UNIX, SOCK_DGRAM, 0);
631 if (data->sock < 0) {
632 wpa_printf(MSG_INFO, "socket(eap_sim_db): %s", strerror(errno));
636 os_memset(&addr, 0, sizeof(addr));
637 addr.sun_family = AF_UNIX;
638 os_snprintf(addr.sun_path, sizeof(addr.sun_path),
639 "/tmp/eap_sim_db_%d-%d", getpid(), counter++);
640 os_free(data->local_sock);
641 data->local_sock = os_strdup(addr.sun_path);
642 if (data->local_sock == NULL) {
647 if (bind(data->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
648 wpa_printf(MSG_INFO, "bind(eap_sim_db): %s", strerror(errno));
654 os_memset(&addr, 0, sizeof(addr));
655 addr.sun_family = AF_UNIX;
656 os_strlcpy(addr.sun_path, data->fname + 5, sizeof(addr.sun_path));
657 if (connect(data->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
658 wpa_printf(MSG_INFO, "connect(eap_sim_db): %s",
660 wpa_hexdump_ascii(MSG_INFO, "HLR/AuC GW socket",
661 (u8 *) addr.sun_path,
662 os_strlen(addr.sun_path));
665 unlink(data->local_sock);
666 os_free(data->local_sock);
667 data->local_sock = NULL;
671 eloop_register_read_sock(data->sock, eap_sim_db_receive, data, NULL);
677 static void eap_sim_db_close_socket(struct eap_sim_db_data *data)
679 if (data->sock >= 0) {
680 eloop_unregister_read_sock(data->sock);
684 if (data->local_sock) {
685 unlink(data->local_sock);
686 os_free(data->local_sock);
687 data->local_sock = NULL;
693 * eap_sim_db_init - Initialize EAP-SIM DB / authentication gateway interface
694 * @config: Configuration data (e.g., file name)
695 * @get_complete_cb: Callback function for reporting availability of triplets
696 * @ctx: Context pointer for get_complete_cb
697 * Returns: Pointer to a private data structure or %NULL on failure
699 struct eap_sim_db_data *
700 eap_sim_db_init(const char *config,
701 void (*get_complete_cb)(void *ctx, void *session_ctx),
704 struct eap_sim_db_data *data;
707 data = os_zalloc(sizeof(*data));
712 data->get_complete_cb = get_complete_cb;
714 data->fname = os_strdup(config);
715 if (data->fname == NULL)
717 pos = os_strstr(data->fname, " db=");
722 data->sqlite_db = db_open(pos);
723 if (data->sqlite_db == NULL)
725 #endif /* CONFIG_SQLITE */
728 if (os_strncmp(data->fname, "unix:", 5) == 0) {
729 if (eap_sim_db_open_socket(data)) {
730 wpa_printf(MSG_DEBUG, "EAP-SIM DB: External database "
731 "connection not available - will retry "
739 eap_sim_db_close_socket(data);
740 os_free(data->fname);
746 static void eap_sim_db_free_pseudonym(struct eap_sim_pseudonym *p)
748 os_free(p->permanent);
749 os_free(p->pseudonym);
754 static void eap_sim_db_free_reauth(struct eap_sim_reauth *r)
756 os_free(r->permanent);
757 os_free(r->reauth_id);
763 * eap_sim_db_deinit - Deinitialize EAP-SIM DB/authentication gw interface
764 * @priv: Private data pointer from eap_sim_db_init()
766 void eap_sim_db_deinit(void *priv)
768 struct eap_sim_db_data *data = priv;
769 struct eap_sim_pseudonym *p, *prev;
770 struct eap_sim_reauth *r, *prevr;
771 struct eap_sim_db_pending *pending, *prev_pending;
774 if (data->sqlite_db) {
775 sqlite3_close(data->sqlite_db);
776 data->sqlite_db = NULL;
778 #endif /* CONFIG_SQLITE */
780 eap_sim_db_close_socket(data);
781 os_free(data->fname);
783 p = data->pseudonyms;
787 eap_sim_db_free_pseudonym(prev);
794 eap_sim_db_free_reauth(prevr);
797 pending = data->pending;
799 prev_pending = pending;
800 pending = pending->next;
801 os_free(prev_pending);
808 static int eap_sim_db_send(struct eap_sim_db_data *data, const char *msg,
813 if (send(data->sock, msg, len, 0) < 0) {
815 wpa_printf(MSG_INFO, "send[EAP-SIM DB UNIX]: %s",
819 if (_errno == ENOTCONN || _errno == EDESTADDRREQ || _errno == EINVAL ||
820 _errno == ECONNREFUSED) {
821 /* Try to reconnect */
822 eap_sim_db_close_socket(data);
823 if (eap_sim_db_open_socket(data) < 0)
825 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Reconnected to the "
827 if (send(data->sock, msg, len, 0) < 0) {
828 wpa_printf(MSG_INFO, "send[EAP-SIM DB UNIX]: %s",
838 static void eap_sim_db_expire_pending(struct eap_sim_db_data *data)
840 /* TODO: add limit for maximum length for pending list; remove latest
841 * (i.e., last) entry from the list if the limit is reached; could also
842 * use timeout to expire pending entries */
847 * eap_sim_db_get_gsm_triplets - Get GSM triplets
848 * @data: Private data pointer from eap_sim_db_init()
849 * @username: Permanent username (prefix | IMSI)
850 * @max_chal: Maximum number of triplets
851 * @_rand: Buffer for RAND values
852 * @kc: Buffer for Kc values
853 * @sres: Buffer for SRES values
854 * @cb_session_ctx: Session callback context for get_complete_cb()
855 * Returns: Number of triplets received (has to be less than or equal to
856 * max_chal), -1 (EAP_SIM_DB_FAILURE) on error (e.g., user not found), or
857 * -2 (EAP_SIM_DB_PENDING) if results are not yet available. In this case, the
858 * callback function registered with eap_sim_db_init() will be called once the
859 * results become available.
861 * When using an external server for GSM triplets, this function can always
862 * start a request and return EAP_SIM_DB_PENDING immediately if authentication
863 * triplets are not available. Once the triplets are received, callback
864 * function registered with eap_sim_db_init() is called to notify EAP state
865 * machine to reprocess the message. This eap_sim_db_get_gsm_triplets()
866 * function will then be called again and the newly received triplets will then
867 * be given to the caller.
869 int eap_sim_db_get_gsm_triplets(struct eap_sim_db_data *data,
870 const char *username, int max_chal,
871 u8 *_rand, u8 *kc, u8 *sres,
872 void *cb_session_ctx)
874 struct eap_sim_db_pending *entry;
880 if (username == NULL || username[0] != EAP_SIM_PERMANENT_PREFIX ||
881 username[1] == '\0' || os_strlen(username) > sizeof(entry->imsi)) {
882 wpa_printf(MSG_DEBUG, "EAP-SIM DB: unexpected username '%s'",
884 return EAP_SIM_DB_FAILURE;
887 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Get GSM triplets for IMSI '%s'",
890 entry = eap_sim_db_get_pending(data, imsi, 0);
893 if (entry->state == FAILURE) {
894 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
897 return EAP_SIM_DB_FAILURE;
900 if (entry->state == PENDING) {
901 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
903 eap_sim_db_add_pending(data, entry);
904 return EAP_SIM_DB_PENDING;
907 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending entry -> "
908 "%d challenges", entry->u.sim.num_chal);
909 num_chal = entry->u.sim.num_chal;
910 if (num_chal > max_chal)
912 os_memcpy(_rand, entry->u.sim.rand, num_chal * GSM_RAND_LEN);
913 os_memcpy(sres, entry->u.sim.sres,
914 num_chal * EAP_SIM_SRES_LEN);
915 os_memcpy(kc, entry->u.sim.kc, num_chal * EAP_SIM_KC_LEN);
920 if (data->sock < 0) {
921 if (eap_sim_db_open_socket(data) < 0)
922 return EAP_SIM_DB_FAILURE;
925 imsi_len = os_strlen(imsi);
926 len = os_snprintf(msg, sizeof(msg), "SIM-REQ-AUTH ");
927 if (len < 0 || len + imsi_len >= sizeof(msg))
928 return EAP_SIM_DB_FAILURE;
929 os_memcpy(msg + len, imsi, imsi_len);
931 ret = os_snprintf(msg + len, sizeof(msg) - len, " %d", max_chal);
932 if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
933 return EAP_SIM_DB_FAILURE;
936 wpa_printf(MSG_DEBUG, "EAP-SIM DB: requesting SIM authentication "
937 "data for IMSI '%s'", imsi);
938 if (eap_sim_db_send(data, msg, len) < 0)
939 return EAP_SIM_DB_FAILURE;
941 entry = os_zalloc(sizeof(*entry));
943 return EAP_SIM_DB_FAILURE;
945 os_strlcpy(entry->imsi, imsi, sizeof(entry->imsi));
946 entry->cb_session_ctx = cb_session_ctx;
947 entry->state = PENDING;
948 eap_sim_db_add_pending(data, entry);
949 eap_sim_db_expire_pending(data);
951 return EAP_SIM_DB_PENDING;
955 static char * eap_sim_db_get_next(struct eap_sim_db_data *data, char prefix)
957 char *id, *pos, *end;
960 if (random_get_bytes(buf, sizeof(buf)))
962 id = os_malloc(sizeof(buf) * 2 + 2);
967 end = id + sizeof(buf) * 2 + 2;
969 pos += wpa_snprintf_hex(pos, end - pos, buf, sizeof(buf));
976 * eap_sim_db_get_next_pseudonym - EAP-SIM DB: Get next pseudonym
977 * @data: Private data pointer from eap_sim_db_init()
978 * @method: EAP method (SIM/AKA/AKA')
979 * Returns: Next pseudonym (allocated string) or %NULL on failure
981 * This function is used to generate a pseudonym for EAP-SIM. The returned
982 * pseudonym is not added to database at this point; it will need to be added
983 * with eap_sim_db_add_pseudonym() once the authentication has been completed
984 * successfully. Caller is responsible for freeing the returned buffer.
986 char * eap_sim_db_get_next_pseudonym(struct eap_sim_db_data *data,
987 enum eap_sim_db_method method)
989 char prefix = EAP_SIM_REAUTH_ID_PREFIX;
993 prefix = EAP_SIM_PSEUDONYM_PREFIX;
996 prefix = EAP_AKA_PSEUDONYM_PREFIX;
998 case EAP_SIM_DB_AKA_PRIME:
999 prefix = EAP_AKA_PRIME_PSEUDONYM_PREFIX;
1003 return eap_sim_db_get_next(data, prefix);
1008 * eap_sim_db_get_next_reauth_id - EAP-SIM DB: Get next reauth_id
1009 * @data: Private data pointer from eap_sim_db_init()
1010 * @method: EAP method (SIM/AKA/AKA')
1011 * Returns: Next reauth_id (allocated string) or %NULL on failure
1013 * This function is used to generate a fast re-authentication identity for
1014 * EAP-SIM. The returned reauth_id is not added to database at this point; it
1015 * will need to be added with eap_sim_db_add_reauth() once the authentication
1016 * has been completed successfully. Caller is responsible for freeing the
1019 char * eap_sim_db_get_next_reauth_id(struct eap_sim_db_data *data,
1020 enum eap_sim_db_method method)
1022 char prefix = EAP_SIM_REAUTH_ID_PREFIX;
1025 case EAP_SIM_DB_SIM:
1026 prefix = EAP_SIM_REAUTH_ID_PREFIX;
1028 case EAP_SIM_DB_AKA:
1029 prefix = EAP_AKA_REAUTH_ID_PREFIX;
1031 case EAP_SIM_DB_AKA_PRIME:
1032 prefix = EAP_AKA_PRIME_REAUTH_ID_PREFIX;
1036 return eap_sim_db_get_next(data, prefix);
1041 * eap_sim_db_add_pseudonym - EAP-SIM DB: Add new pseudonym
1042 * @data: Private data pointer from eap_sim_db_init()
1043 * @permanent: Permanent username
1044 * @pseudonym: Pseudonym for this user. This needs to be an allocated buffer,
1045 * e.g., return value from eap_sim_db_get_next_pseudonym(). Caller must not
1047 * Returns: 0 on success, -1 on failure
1049 * This function adds a new pseudonym for EAP-SIM user. EAP-SIM DB is
1050 * responsible of freeing pseudonym buffer once it is not needed anymore.
1052 int eap_sim_db_add_pseudonym(struct eap_sim_db_data *data,
1053 const char *permanent, char *pseudonym)
1055 struct eap_sim_pseudonym *p;
1056 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Add pseudonym '%s' for permanent "
1057 "username '%s'", pseudonym, permanent);
1059 /* TODO: could store last two pseudonyms */
1060 #ifdef CONFIG_SQLITE
1061 if (data->sqlite_db)
1062 return db_add_pseudonym(data, permanent, pseudonym);
1063 #endif /* CONFIG_SQLITE */
1064 for (p = data->pseudonyms; p; p = p->next) {
1065 if (os_strcmp(permanent, p->permanent) == 0)
1069 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Replacing previous "
1070 "pseudonym: %s", p->pseudonym);
1071 os_free(p->pseudonym);
1072 p->pseudonym = pseudonym;
1076 p = os_zalloc(sizeof(*p));
1082 p->next = data->pseudonyms;
1083 p->permanent = os_strdup(permanent);
1084 if (p->permanent == NULL) {
1089 p->pseudonym = pseudonym;
1090 data->pseudonyms = p;
1092 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Added new pseudonym entry");
1097 static struct eap_sim_reauth *
1098 eap_sim_db_add_reauth_data(struct eap_sim_db_data *data,
1099 const char *permanent,
1100 char *reauth_id, u16 counter)
1102 struct eap_sim_reauth *r;
1104 for (r = data->reauths; r; r = r->next) {
1105 if (os_strcmp(r->permanent, permanent) == 0)
1110 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Replacing previous "
1111 "reauth_id: %s", r->reauth_id);
1112 os_free(r->reauth_id);
1113 r->reauth_id = reauth_id;
1115 r = os_zalloc(sizeof(*r));
1121 r->next = data->reauths;
1122 r->permanent = os_strdup(permanent);
1123 if (r->permanent == NULL) {
1128 r->reauth_id = reauth_id;
1130 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Added new reauth entry");
1133 r->counter = counter;
1140 * eap_sim_db_add_reauth - EAP-SIM DB: Add new re-authentication entry
1141 * @priv: Private data pointer from eap_sim_db_init()
1142 * @permanent: Permanent username
1143 * @identity_len: Length of identity
1144 * @reauth_id: reauth_id for this user. This needs to be an allocated buffer,
1145 * e.g., return value from eap_sim_db_get_next_reauth_id(). Caller must not
1147 * @counter: AT_COUNTER value for fast re-authentication
1148 * @mk: 16-byte MK from the previous full authentication or %NULL
1149 * Returns: 0 on success, -1 on failure
1151 * This function adds a new re-authentication entry for an EAP-SIM user.
1152 * EAP-SIM DB is responsible of freeing reauth_id buffer once it is not needed
1155 int eap_sim_db_add_reauth(struct eap_sim_db_data *data, const char *permanent,
1156 char *reauth_id, u16 counter, const u8 *mk)
1158 struct eap_sim_reauth *r;
1160 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Add reauth_id '%s' for permanent "
1161 "identity '%s'", reauth_id, permanent);
1163 #ifdef CONFIG_SQLITE
1164 if (data->sqlite_db)
1165 return db_add_reauth(data, permanent, reauth_id, counter, mk,
1167 #endif /* CONFIG_SQLITE */
1168 r = eap_sim_db_add_reauth_data(data, permanent, reauth_id, counter);
1172 os_memcpy(r->mk, mk, EAP_SIM_MK_LEN);
1178 #ifdef EAP_SERVER_AKA_PRIME
1180 * eap_sim_db_add_reauth_prime - EAP-AKA' DB: Add new re-authentication entry
1181 * @data: Private data pointer from eap_sim_db_init()
1182 * @permanent: Permanent username
1183 * @reauth_id: reauth_id for this user. This needs to be an allocated buffer,
1184 * e.g., return value from eap_sim_db_get_next_reauth_id(). Caller must not
1186 * @counter: AT_COUNTER value for fast re-authentication
1187 * @k_encr: K_encr from the previous full authentication
1188 * @k_aut: K_aut from the previous full authentication
1189 * @k_re: 32-byte K_re from the previous full authentication
1190 * Returns: 0 on success, -1 on failure
1192 * This function adds a new re-authentication entry for an EAP-AKA' user.
1193 * EAP-SIM DB is responsible of freeing reauth_id buffer once it is not needed
1196 int eap_sim_db_add_reauth_prime(struct eap_sim_db_data *data,
1197 const char *permanent, char *reauth_id,
1198 u16 counter, const u8 *k_encr,
1199 const u8 *k_aut, const u8 *k_re)
1201 struct eap_sim_reauth *r;
1203 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Add reauth_id '%s' for permanent "
1204 "identity '%s'", reauth_id, permanent);
1206 #ifdef CONFIG_SQLITE
1207 if (data->sqlite_db)
1208 return db_add_reauth(data, permanent, reauth_id, counter, NULL,
1209 k_encr, k_aut, k_re);
1210 #endif /* CONFIG_SQLITE */
1211 r = eap_sim_db_add_reauth_data(data, permanent, reauth_id, counter);
1215 os_memcpy(r->k_encr, k_encr, EAP_SIM_K_ENCR_LEN);
1216 os_memcpy(r->k_aut, k_aut, EAP_AKA_PRIME_K_AUT_LEN);
1217 os_memcpy(r->k_re, k_re, EAP_AKA_PRIME_K_RE_LEN);
1221 #endif /* EAP_SERVER_AKA_PRIME */
1225 * eap_sim_db_get_permanent - EAP-SIM DB: Get permanent identity
1226 * @data: Private data pointer from eap_sim_db_init()
1227 * @pseudonym: Pseudonym username
1228 * Returns: Pointer to permanent username or %NULL if not found
1231 eap_sim_db_get_permanent(struct eap_sim_db_data *data, const char *pseudonym)
1233 struct eap_sim_pseudonym *p;
1235 #ifdef CONFIG_SQLITE
1236 if (data->sqlite_db)
1237 return db_get_pseudonym(data, pseudonym);
1238 #endif /* CONFIG_SQLITE */
1240 p = data->pseudonyms;
1242 if (os_strcmp(p->pseudonym, pseudonym) == 0)
1243 return p->permanent;
1252 * eap_sim_db_get_reauth_entry - EAP-SIM DB: Get re-authentication entry
1253 * @data: Private data pointer from eap_sim_db_init()
1254 * @reauth_id: Fast re-authentication username
1255 * Returns: Pointer to the re-auth entry, or %NULL if not found
1257 struct eap_sim_reauth *
1258 eap_sim_db_get_reauth_entry(struct eap_sim_db_data *data,
1259 const char *reauth_id)
1261 struct eap_sim_reauth *r;
1263 #ifdef CONFIG_SQLITE
1264 if (data->sqlite_db)
1265 return db_get_reauth(data, reauth_id);
1266 #endif /* CONFIG_SQLITE */
1270 if (os_strcmp(r->reauth_id, reauth_id) == 0)
1280 * eap_sim_db_remove_reauth - EAP-SIM DB: Remove re-authentication entry
1281 * @data: Private data pointer from eap_sim_db_init()
1282 * @reauth: Pointer to re-authentication entry from
1283 * eap_sim_db_get_reauth_entry()
1285 void eap_sim_db_remove_reauth(struct eap_sim_db_data *data,
1286 struct eap_sim_reauth *reauth)
1288 struct eap_sim_reauth *r, *prev = NULL;
1289 #ifdef CONFIG_SQLITE
1290 if (data->sqlite_db) {
1291 db_remove_reauth(data, reauth);
1294 #endif /* CONFIG_SQLITE */
1299 prev->next = r->next;
1301 data->reauths = r->next;
1302 eap_sim_db_free_reauth(r);
1312 * eap_sim_db_get_aka_auth - Get AKA authentication values
1313 * @data: Private data pointer from eap_sim_db_init()
1314 * @username: Permanent username (prefix | IMSI)
1315 * @_rand: Buffer for RAND value
1316 * @autn: Buffer for AUTN value
1317 * @ik: Buffer for IK value
1318 * @ck: Buffer for CK value
1319 * @res: Buffer for RES value
1320 * @res_len: Buffer for RES length
1321 * @cb_session_ctx: Session callback context for get_complete_cb()
1322 * Returns: 0 on success, -1 (EAP_SIM_DB_FAILURE) on error (e.g., user not
1323 * found), or -2 (EAP_SIM_DB_PENDING) if results are not yet available. In this
1324 * case, the callback function registered with eap_sim_db_init() will be
1325 * called once the results become available.
1327 * When using an external server for AKA authentication, this function can
1328 * always start a request and return EAP_SIM_DB_PENDING immediately if
1329 * authentication triplets are not available. Once the authentication data are
1330 * received, callback function registered with eap_sim_db_init() is called to
1331 * notify EAP state machine to reprocess the message. This
1332 * eap_sim_db_get_aka_auth() function will then be called again and the newly
1333 * received triplets will then be given to the caller.
1335 int eap_sim_db_get_aka_auth(struct eap_sim_db_data *data, const char *username,
1336 u8 *_rand, u8 *autn, u8 *ik, u8 *ck,
1337 u8 *res, size_t *res_len, void *cb_session_ctx)
1339 struct eap_sim_db_pending *entry;
1345 if (username == NULL ||
1346 (username[0] != EAP_AKA_PERMANENT_PREFIX &&
1347 username[0] != EAP_AKA_PRIME_PERMANENT_PREFIX) ||
1348 username[1] == '\0' || os_strlen(username) > sizeof(entry->imsi)) {
1349 wpa_printf(MSG_DEBUG, "EAP-SIM DB: unexpected username '%s'",
1351 return EAP_SIM_DB_FAILURE;
1353 imsi = username + 1;
1354 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Get AKA auth for IMSI '%s'",
1357 entry = eap_sim_db_get_pending(data, imsi, 1);
1359 if (entry->state == FAILURE) {
1361 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Failure");
1362 return EAP_SIM_DB_FAILURE;
1365 if (entry->state == PENDING) {
1366 eap_sim_db_add_pending(data, entry);
1367 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Pending");
1368 return EAP_SIM_DB_PENDING;
1371 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Returning successfully "
1372 "received authentication data");
1373 os_memcpy(_rand, entry->u.aka.rand, EAP_AKA_RAND_LEN);
1374 os_memcpy(autn, entry->u.aka.autn, EAP_AKA_AUTN_LEN);
1375 os_memcpy(ik, entry->u.aka.ik, EAP_AKA_IK_LEN);
1376 os_memcpy(ck, entry->u.aka.ck, EAP_AKA_CK_LEN);
1377 os_memcpy(res, entry->u.aka.res, EAP_AKA_RES_MAX_LEN);
1378 *res_len = entry->u.aka.res_len;
1383 if (data->sock < 0) {
1384 if (eap_sim_db_open_socket(data) < 0)
1385 return EAP_SIM_DB_FAILURE;
1388 imsi_len = os_strlen(imsi);
1389 len = os_snprintf(msg, sizeof(msg), "AKA-REQ-AUTH ");
1390 if (len < 0 || len + imsi_len >= sizeof(msg))
1391 return EAP_SIM_DB_FAILURE;
1392 os_memcpy(msg + len, imsi, imsi_len);
1395 wpa_printf(MSG_DEBUG, "EAP-SIM DB: requesting AKA authentication "
1396 "data for IMSI '%s'", imsi);
1397 if (eap_sim_db_send(data, msg, len) < 0)
1398 return EAP_SIM_DB_FAILURE;
1400 entry = os_zalloc(sizeof(*entry));
1402 return EAP_SIM_DB_FAILURE;
1405 os_strlcpy(entry->imsi, imsi, sizeof(entry->imsi));
1406 entry->cb_session_ctx = cb_session_ctx;
1407 entry->state = PENDING;
1408 eap_sim_db_add_pending(data, entry);
1409 eap_sim_db_expire_pending(data);
1411 return EAP_SIM_DB_PENDING;
1416 * eap_sim_db_resynchronize - Resynchronize AKA AUTN
1417 * @data: Private data pointer from eap_sim_db_init()
1418 * @username: Permanent username
1419 * @auts: AUTS value from the peer
1420 * @_rand: RAND value used in the rejected message
1421 * Returns: 0 on success, -1 on failure
1423 * This function is called when the peer reports synchronization failure in the
1424 * AUTN value by sending AUTS. The AUTS and RAND values should be sent to
1425 * HLR/AuC to allow it to resynchronize with the peer. After this,
1426 * eap_sim_db_get_aka_auth() will be called again to to fetch updated
1427 * RAND/AUTN values for the next challenge.
1429 int eap_sim_db_resynchronize(struct eap_sim_db_data *data,
1430 const char *username,
1431 const u8 *auts, const u8 *_rand)
1436 if (username == NULL ||
1437 (username[0] != EAP_AKA_PERMANENT_PREFIX &&
1438 username[0] != EAP_AKA_PRIME_PERMANENT_PREFIX) ||
1439 username[1] == '\0' || os_strlen(username) > 20) {
1440 wpa_printf(MSG_DEBUG, "EAP-SIM DB: unexpected username '%s'",
1444 imsi = username + 1;
1445 wpa_printf(MSG_DEBUG, "EAP-SIM DB: Get AKA auth for IMSI '%s'",
1448 if (data->sock >= 0) {
1452 imsi_len = os_strlen(imsi);
1453 len = os_snprintf(msg, sizeof(msg), "AKA-AUTS ");
1454 if (len < 0 || len + imsi_len >= sizeof(msg))
1456 os_memcpy(msg + len, imsi, imsi_len);
1459 ret = os_snprintf(msg + len, sizeof(msg) - len, " ");
1460 if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
1463 len += wpa_snprintf_hex(msg + len, sizeof(msg) - len,
1464 auts, EAP_AKA_AUTS_LEN);
1465 ret = os_snprintf(msg + len, sizeof(msg) - len, " ");
1466 if (ret < 0 || (size_t) ret >= sizeof(msg) - len)
1469 len += wpa_snprintf_hex(msg + len, sizeof(msg) - len,
1470 _rand, EAP_AKA_RAND_LEN);
1471 wpa_printf(MSG_DEBUG, "EAP-SIM DB: reporting AKA AUTS for "
1473 if (eap_sim_db_send(data, msg, len) < 0)
1482 * sim_get_username - Extract username from SIM identity
1483 * @identity: Identity
1484 * @identity_len: Identity length
1485 * Returns: Allocated buffer with the username part of the identity
1487 * Caller is responsible for freeing the returned buffer with os_free().
1489 char * sim_get_username(const u8 *identity, size_t identity_len)
1493 if (identity == NULL)
1496 for (pos = 0; pos < identity_len; pos++) {
1497 if (identity[pos] == '@' || identity[pos] == '\0')
1501 return dup_binstr(identity, pos);