hlr_auc_gw.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026
  1. /*
  2. * HLR/AuC testing gateway for hostapd EAP-SIM/AKA database/authenticator
  3. * Copyright (c) 2005-2007, 2012, Jouni Malinen <j@w1.fi>
  4. *
  5. * This software may be distributed under the terms of the BSD license.
  6. * See README for more details.
  7. *
  8. * This is an example implementation of the EAP-SIM/AKA database/authentication
  9. * gateway interface to HLR/AuC. It is expected to be replaced with an
  10. * implementation of SS7 gateway to GSM/UMTS authentication center (HLR/AuC) or
  11. * a local implementation of SIM triplet and AKA authentication data generator.
  12. *
  13. * hostapd will send SIM/AKA authentication queries over a UNIX domain socket
  14. * to and external program, e.g., this hlr_auc_gw. This interface uses simple
  15. * text-based format:
  16. *
  17. * EAP-SIM / GSM triplet query/response:
  18. * SIM-REQ-AUTH <IMSI> <max_chal>
  19. * SIM-RESP-AUTH <IMSI> Kc1:SRES1:RAND1 Kc2:SRES2:RAND2 [Kc3:SRES3:RAND3]
  20. * SIM-RESP-AUTH <IMSI> FAILURE
  21. *
  22. * EAP-AKA / UMTS query/response:
  23. * AKA-REQ-AUTH <IMSI>
  24. * AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES>
  25. * AKA-RESP-AUTH <IMSI> FAILURE
  26. *
  27. * EAP-AKA / UMTS AUTS (re-synchronization):
  28. * AKA-AUTS <IMSI> <AUTS> <RAND>
  29. *
  30. * IMSI and max_chal are sent as an ASCII string,
  31. * Kc/SRES/RAND/AUTN/IK/CK/RES/AUTS as hex strings.
  32. *
  33. * The example implementation here reads GSM authentication triplets from a
  34. * text file in IMSI:Kc:SRES:RAND format, IMSI in ASCII, other fields as hex
  35. * strings. This is used to simulate an HLR/AuC. As such, it is not very useful
  36. * for real life authentication, but it is useful both as an example
  37. * implementation and for EAP-SIM/AKA/AKA' testing.
  38. *
  39. * SQN generation follows the not time-based Profile 2 described in
  40. * 3GPP TS 33.102 Annex C.3.2. The length of IND is 5 bits by default, but this
  41. * can be changed with a command line options if needed.
  42. */
  43. #include "includes.h"
  44. #include <sys/un.h>
  45. #ifdef CONFIG_SQLITE
  46. #include <sqlite3.h>
  47. #endif /* CONFIG_SQLITE */
  48. #include "common.h"
  49. #include "crypto/milenage.h"
  50. #include "crypto/random.h"
  51. static const char *default_socket_path = "/tmp/hlr_auc_gw.sock";
  52. static const char *socket_path;
  53. static int serv_sock = -1;
  54. static char *milenage_file = NULL;
  55. static int update_milenage = 0;
  56. static int sqn_changes = 0;
  57. static int ind_len = 5;
  58. /* GSM triplets */
  59. struct gsm_triplet {
  60. struct gsm_triplet *next;
  61. char imsi[20];
  62. u8 kc[8];
  63. u8 sres[4];
  64. u8 _rand[16];
  65. };
  66. static struct gsm_triplet *gsm_db = NULL, *gsm_db_pos = NULL;
  67. /* OPc and AMF parameters for Milenage (Example algorithms for AKA). */
  68. struct milenage_parameters {
  69. struct milenage_parameters *next;
  70. char imsi[20];
  71. u8 ki[16];
  72. u8 opc[16];
  73. u8 amf[2];
  74. u8 sqn[6];
  75. };
  76. static struct milenage_parameters *milenage_db = NULL;
  77. #define EAP_SIM_MAX_CHAL 3
  78. #define EAP_AKA_RAND_LEN 16
  79. #define EAP_AKA_AUTN_LEN 16
  80. #define EAP_AKA_AUTS_LEN 14
  81. #define EAP_AKA_RES_MAX_LEN 16
  82. #define EAP_AKA_IK_LEN 16
  83. #define EAP_AKA_CK_LEN 16
  84. #ifdef CONFIG_SQLITE
  85. static sqlite3 *sqlite_db = NULL;
  86. static struct milenage_parameters db_tmp_milenage;
  87. static int db_table_exists(sqlite3 *db, const char *name)
  88. {
  89. char cmd[128];
  90. os_snprintf(cmd, sizeof(cmd), "SELECT 1 FROM %s;", name);
  91. return sqlite3_exec(db, cmd, NULL, NULL, NULL) == SQLITE_OK;
  92. }
  93. static int db_table_create_milenage(sqlite3 *db)
  94. {
  95. char *err = NULL;
  96. const char *sql =
  97. "CREATE TABLE milenage("
  98. " imsi INTEGER PRIMARY KEY NOT NULL,"
  99. " ki CHAR(32) NOT NULL,"
  100. " opc CHAR(32) NOT NULL,"
  101. " amf CHAR(4) NOT NULL,"
  102. " sqn CHAR(12) NOT NULL"
  103. ");";
  104. printf("Adding database table for milenage information\n");
  105. if (sqlite3_exec(db, sql, NULL, NULL, &err) != SQLITE_OK) {
  106. printf("SQLite error: %s\n", err);
  107. sqlite3_free(err);
  108. return -1;
  109. }
  110. return 0;
  111. }
  112. static sqlite3 * db_open(const char *db_file)
  113. {
  114. sqlite3 *db;
  115. if (sqlite3_open(db_file, &db)) {
  116. printf("Failed to open database %s: %s\n",
  117. db_file, sqlite3_errmsg(db));
  118. sqlite3_close(db);
  119. return NULL;
  120. }
  121. if (!db_table_exists(db, "milenage") &&
  122. db_table_create_milenage(db) < 0) {
  123. sqlite3_close(db);
  124. return NULL;
  125. }
  126. return db;
  127. }
  128. static int get_milenage_cb(void *ctx, int argc, char *argv[], char *col[])
  129. {
  130. struct milenage_parameters *m = ctx;
  131. int i;
  132. for (i = 0; i < argc; i++) {
  133. if (os_strcmp(col[i], "ki") == 0 && argv[i] &&
  134. hexstr2bin(argv[i], m->ki, sizeof(m->ki))) {
  135. printf("Invalid ki value in database\n");
  136. return -1;
  137. }
  138. if (os_strcmp(col[i], "opc") == 0 && argv[i] &&
  139. hexstr2bin(argv[i], m->opc, sizeof(m->opc))) {
  140. printf("Invalid opcvalue in database\n");
  141. return -1;
  142. }
  143. if (os_strcmp(col[i], "amf") == 0 && argv[i] &&
  144. hexstr2bin(argv[i], m->amf, sizeof(m->amf))) {
  145. printf("Invalid amf value in database\n");
  146. return -1;
  147. }
  148. if (os_strcmp(col[i], "sqn") == 0 && argv[i] &&
  149. hexstr2bin(argv[i], m->sqn, sizeof(m->sqn))) {
  150. printf("Invalid sqn value in database\n");
  151. return -1;
  152. }
  153. }
  154. return 0;
  155. }
  156. static struct milenage_parameters * db_get_milenage(const char *imsi_txt)
  157. {
  158. char cmd[128];
  159. unsigned long long imsi;
  160. os_memset(&db_tmp_milenage, 0, sizeof(db_tmp_milenage));
  161. imsi = atoll(imsi_txt);
  162. os_snprintf(db_tmp_milenage.imsi, sizeof(db_tmp_milenage.imsi),
  163. "%llu", imsi);
  164. os_snprintf(cmd, sizeof(cmd),
  165. "SELECT ki,opc,amf,sqn FROM milenage WHERE imsi=%llu;",
  166. imsi);
  167. if (sqlite3_exec(sqlite_db, cmd, get_milenage_cb, &db_tmp_milenage,
  168. NULL) != SQLITE_OK)
  169. return NULL;
  170. return &db_tmp_milenage;
  171. }
  172. static int db_update_milenage_sqn(struct milenage_parameters *m)
  173. {
  174. char cmd[128], val[13], *pos;
  175. pos = val;
  176. pos += wpa_snprintf_hex(pos, sizeof(val), m->sqn, 6);
  177. *pos = '\0';
  178. os_snprintf(cmd, sizeof(cmd),
  179. "UPDATE milenage SET sqn='%s' WHERE imsi=%s;",
  180. val, m->imsi);
  181. if (sqlite3_exec(sqlite_db, cmd, NULL, NULL, NULL) != SQLITE_OK) {
  182. printf("Failed to update SQN in database for IMSI %s\n",
  183. m->imsi);
  184. return -1;
  185. }
  186. return 0;
  187. }
  188. #endif /* CONFIG_SQLITE */
  189. static int open_socket(const char *path)
  190. {
  191. struct sockaddr_un addr;
  192. int s;
  193. s = socket(PF_UNIX, SOCK_DGRAM, 0);
  194. if (s < 0) {
  195. perror("socket(PF_UNIX)");
  196. return -1;
  197. }
  198. memset(&addr, 0, sizeof(addr));
  199. addr.sun_family = AF_UNIX;
  200. os_strlcpy(addr.sun_path, path, sizeof(addr.sun_path));
  201. if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
  202. perror("hlr-auc-gw: bind(PF_UNIX)");
  203. close(s);
  204. return -1;
  205. }
  206. return s;
  207. }
  208. static int read_gsm_triplets(const char *fname)
  209. {
  210. FILE *f;
  211. char buf[200], *pos, *pos2;
  212. struct gsm_triplet *g = NULL;
  213. int line, ret = 0;
  214. if (fname == NULL)
  215. return -1;
  216. f = fopen(fname, "r");
  217. if (f == NULL) {
  218. printf("Could not open GSM tripler data file '%s'\n", fname);
  219. return -1;
  220. }
  221. line = 0;
  222. while (fgets(buf, sizeof(buf), f)) {
  223. line++;
  224. /* Parse IMSI:Kc:SRES:RAND */
  225. buf[sizeof(buf) - 1] = '\0';
  226. if (buf[0] == '#')
  227. continue;
  228. pos = buf;
  229. while (*pos != '\0' && *pos != '\n')
  230. pos++;
  231. if (*pos == '\n')
  232. *pos = '\0';
  233. pos = buf;
  234. if (*pos == '\0')
  235. continue;
  236. g = os_zalloc(sizeof(*g));
  237. if (g == NULL) {
  238. ret = -1;
  239. break;
  240. }
  241. /* IMSI */
  242. pos2 = strchr(pos, ':');
  243. if (pos2 == NULL) {
  244. printf("%s:%d - Invalid IMSI (%s)\n",
  245. fname, line, pos);
  246. ret = -1;
  247. break;
  248. }
  249. *pos2 = '\0';
  250. if (strlen(pos) >= sizeof(g->imsi)) {
  251. printf("%s:%d - Too long IMSI (%s)\n",
  252. fname, line, pos);
  253. ret = -1;
  254. break;
  255. }
  256. os_strlcpy(g->imsi, pos, sizeof(g->imsi));
  257. pos = pos2 + 1;
  258. /* Kc */
  259. pos2 = strchr(pos, ':');
  260. if (pos2 == NULL) {
  261. printf("%s:%d - Invalid Kc (%s)\n", fname, line, pos);
  262. ret = -1;
  263. break;
  264. }
  265. *pos2 = '\0';
  266. if (strlen(pos) != 16 || hexstr2bin(pos, g->kc, 8)) {
  267. printf("%s:%d - Invalid Kc (%s)\n", fname, line, pos);
  268. ret = -1;
  269. break;
  270. }
  271. pos = pos2 + 1;
  272. /* SRES */
  273. pos2 = strchr(pos, ':');
  274. if (pos2 == NULL) {
  275. printf("%s:%d - Invalid SRES (%s)\n", fname, line,
  276. pos);
  277. ret = -1;
  278. break;
  279. }
  280. *pos2 = '\0';
  281. if (strlen(pos) != 8 || hexstr2bin(pos, g->sres, 4)) {
  282. printf("%s:%d - Invalid SRES (%s)\n", fname, line,
  283. pos);
  284. ret = -1;
  285. break;
  286. }
  287. pos = pos2 + 1;
  288. /* RAND */
  289. pos2 = strchr(pos, ':');
  290. if (pos2)
  291. *pos2 = '\0';
  292. if (strlen(pos) != 32 || hexstr2bin(pos, g->_rand, 16)) {
  293. printf("%s:%d - Invalid RAND (%s)\n", fname, line,
  294. pos);
  295. ret = -1;
  296. break;
  297. }
  298. pos = pos2 + 1;
  299. g->next = gsm_db;
  300. gsm_db = g;
  301. g = NULL;
  302. }
  303. os_free(g);
  304. fclose(f);
  305. return ret;
  306. }
  307. static struct gsm_triplet * get_gsm_triplet(const char *imsi)
  308. {
  309. struct gsm_triplet *g = gsm_db_pos;
  310. while (g) {
  311. if (strcmp(g->imsi, imsi) == 0) {
  312. gsm_db_pos = g->next;
  313. return g;
  314. }
  315. g = g->next;
  316. }
  317. g = gsm_db;
  318. while (g && g != gsm_db_pos) {
  319. if (strcmp(g->imsi, imsi) == 0) {
  320. gsm_db_pos = g->next;
  321. return g;
  322. }
  323. g = g->next;
  324. }
  325. return NULL;
  326. }
  327. static int read_milenage(const char *fname)
  328. {
  329. FILE *f;
  330. char buf[200], *pos, *pos2;
  331. struct milenage_parameters *m = NULL;
  332. int line, ret = 0;
  333. if (fname == NULL)
  334. return -1;
  335. f = fopen(fname, "r");
  336. if (f == NULL) {
  337. printf("Could not open Milenage data file '%s'\n", fname);
  338. return -1;
  339. }
  340. line = 0;
  341. while (fgets(buf, sizeof(buf), f)) {
  342. line++;
  343. /* Parse IMSI Ki OPc AMF SQN */
  344. buf[sizeof(buf) - 1] = '\0';
  345. if (buf[0] == '#')
  346. continue;
  347. pos = buf;
  348. while (*pos != '\0' && *pos != '\n')
  349. pos++;
  350. if (*pos == '\n')
  351. *pos = '\0';
  352. pos = buf;
  353. if (*pos == '\0')
  354. continue;
  355. m = os_zalloc(sizeof(*m));
  356. if (m == NULL) {
  357. ret = -1;
  358. break;
  359. }
  360. /* IMSI */
  361. pos2 = strchr(pos, ' ');
  362. if (pos2 == NULL) {
  363. printf("%s:%d - Invalid IMSI (%s)\n",
  364. fname, line, pos);
  365. ret = -1;
  366. break;
  367. }
  368. *pos2 = '\0';
  369. if (strlen(pos) >= sizeof(m->imsi)) {
  370. printf("%s:%d - Too long IMSI (%s)\n",
  371. fname, line, pos);
  372. ret = -1;
  373. break;
  374. }
  375. os_strlcpy(m->imsi, pos, sizeof(m->imsi));
  376. pos = pos2 + 1;
  377. /* Ki */
  378. pos2 = strchr(pos, ' ');
  379. if (pos2 == NULL) {
  380. printf("%s:%d - Invalid Ki (%s)\n", fname, line, pos);
  381. ret = -1;
  382. break;
  383. }
  384. *pos2 = '\0';
  385. if (strlen(pos) != 32 || hexstr2bin(pos, m->ki, 16)) {
  386. printf("%s:%d - Invalid Ki (%s)\n", fname, line, pos);
  387. ret = -1;
  388. break;
  389. }
  390. pos = pos2 + 1;
  391. /* OPc */
  392. pos2 = strchr(pos, ' ');
  393. if (pos2 == NULL) {
  394. printf("%s:%d - Invalid OPc (%s)\n", fname, line, pos);
  395. ret = -1;
  396. break;
  397. }
  398. *pos2 = '\0';
  399. if (strlen(pos) != 32 || hexstr2bin(pos, m->opc, 16)) {
  400. printf("%s:%d - Invalid OPc (%s)\n", fname, line, pos);
  401. ret = -1;
  402. break;
  403. }
  404. pos = pos2 + 1;
  405. /* AMF */
  406. pos2 = strchr(pos, ' ');
  407. if (pos2 == NULL) {
  408. printf("%s:%d - Invalid AMF (%s)\n", fname, line, pos);
  409. ret = -1;
  410. break;
  411. }
  412. *pos2 = '\0';
  413. if (strlen(pos) != 4 || hexstr2bin(pos, m->amf, 2)) {
  414. printf("%s:%d - Invalid AMF (%s)\n", fname, line, pos);
  415. ret = -1;
  416. break;
  417. }
  418. pos = pos2 + 1;
  419. /* SQN */
  420. pos2 = strchr(pos, ' ');
  421. if (pos2)
  422. *pos2 = '\0';
  423. if (strlen(pos) != 12 || hexstr2bin(pos, m->sqn, 6)) {
  424. printf("%s:%d - Invalid SEQ (%s)\n", fname, line, pos);
  425. ret = -1;
  426. break;
  427. }
  428. pos = pos2 + 1;
  429. m->next = milenage_db;
  430. milenage_db = m;
  431. m = NULL;
  432. }
  433. os_free(m);
  434. fclose(f);
  435. return ret;
  436. }
  437. static void update_milenage_file(const char *fname)
  438. {
  439. FILE *f, *f2;
  440. char buf[500], *pos;
  441. char *end = buf + sizeof(buf);
  442. struct milenage_parameters *m;
  443. size_t imsi_len;
  444. f = fopen(fname, "r");
  445. if (f == NULL) {
  446. printf("Could not open Milenage data file '%s'\n", fname);
  447. return;
  448. }
  449. snprintf(buf, sizeof(buf), "%s.new", fname);
  450. f2 = fopen(buf, "w");
  451. if (f2 == NULL) {
  452. printf("Could not write Milenage data file '%s'\n", buf);
  453. fclose(f);
  454. return;
  455. }
  456. while (fgets(buf, sizeof(buf), f)) {
  457. /* IMSI Ki OPc AMF SQN */
  458. buf[sizeof(buf) - 1] = '\0';
  459. pos = strchr(buf, ' ');
  460. if (buf[0] == '#' || pos == NULL || pos - buf >= 20)
  461. goto no_update;
  462. imsi_len = pos - buf;
  463. for (m = milenage_db; m; m = m->next) {
  464. if (strncmp(buf, m->imsi, imsi_len) == 0 &&
  465. m->imsi[imsi_len] == '\0')
  466. break;
  467. }
  468. if (!m)
  469. goto no_update;
  470. pos = buf;
  471. pos += snprintf(pos, end - pos, "%s ", m->imsi);
  472. pos += wpa_snprintf_hex(pos, end - pos, m->ki, 16);
  473. *pos++ = ' ';
  474. pos += wpa_snprintf_hex(pos, end - pos, m->opc, 16);
  475. *pos++ = ' ';
  476. pos += wpa_snprintf_hex(pos, end - pos, m->amf, 2);
  477. *pos++ = ' ';
  478. pos += wpa_snprintf_hex(pos, end - pos, m->sqn, 6);
  479. *pos++ = '\n';
  480. no_update:
  481. fprintf(f2, "%s", buf);
  482. }
  483. fclose(f2);
  484. fclose(f);
  485. snprintf(buf, sizeof(buf), "%s.bak", fname);
  486. if (rename(fname, buf) < 0) {
  487. perror("rename");
  488. return;
  489. }
  490. snprintf(buf, sizeof(buf), "%s.new", fname);
  491. if (rename(buf, fname) < 0) {
  492. perror("rename");
  493. return;
  494. }
  495. }
  496. static struct milenage_parameters * get_milenage(const char *imsi)
  497. {
  498. struct milenage_parameters *m = milenage_db;
  499. while (m) {
  500. if (strcmp(m->imsi, imsi) == 0)
  501. break;
  502. m = m->next;
  503. }
  504. #ifdef CONFIG_SQLITE
  505. if (!m)
  506. m = db_get_milenage(imsi);
  507. #endif /* CONFIG_SQLITE */
  508. return m;
  509. }
  510. static void sim_req_auth(int s, struct sockaddr_un *from, socklen_t fromlen,
  511. char *imsi)
  512. {
  513. int count, max_chal, ret;
  514. char *pos;
  515. char reply[1000], *rpos, *rend;
  516. struct milenage_parameters *m;
  517. struct gsm_triplet *g;
  518. reply[0] = '\0';
  519. pos = strchr(imsi, ' ');
  520. if (pos) {
  521. *pos++ = '\0';
  522. max_chal = atoi(pos);
  523. if (max_chal < 1 || max_chal < EAP_SIM_MAX_CHAL)
  524. max_chal = EAP_SIM_MAX_CHAL;
  525. } else
  526. max_chal = EAP_SIM_MAX_CHAL;
  527. rend = &reply[sizeof(reply)];
  528. rpos = reply;
  529. ret = snprintf(rpos, rend - rpos, "SIM-RESP-AUTH %s", imsi);
  530. if (ret < 0 || ret >= rend - rpos)
  531. return;
  532. rpos += ret;
  533. m = get_milenage(imsi);
  534. if (m) {
  535. u8 _rand[16], sres[4], kc[8];
  536. for (count = 0; count < max_chal; count++) {
  537. if (random_get_bytes(_rand, 16) < 0)
  538. return;
  539. gsm_milenage(m->opc, m->ki, _rand, sres, kc);
  540. *rpos++ = ' ';
  541. rpos += wpa_snprintf_hex(rpos, rend - rpos, kc, 8);
  542. *rpos++ = ':';
  543. rpos += wpa_snprintf_hex(rpos, rend - rpos, sres, 4);
  544. *rpos++ = ':';
  545. rpos += wpa_snprintf_hex(rpos, rend - rpos, _rand, 16);
  546. }
  547. *rpos = '\0';
  548. goto send;
  549. }
  550. count = 0;
  551. while (count < max_chal && (g = get_gsm_triplet(imsi))) {
  552. if (strcmp(g->imsi, imsi) != 0)
  553. continue;
  554. if (rpos < rend)
  555. *rpos++ = ' ';
  556. rpos += wpa_snprintf_hex(rpos, rend - rpos, g->kc, 8);
  557. if (rpos < rend)
  558. *rpos++ = ':';
  559. rpos += wpa_snprintf_hex(rpos, rend - rpos, g->sres, 4);
  560. if (rpos < rend)
  561. *rpos++ = ':';
  562. rpos += wpa_snprintf_hex(rpos, rend - rpos, g->_rand, 16);
  563. count++;
  564. }
  565. if (count == 0) {
  566. printf("No GSM triplets found for %s\n", imsi);
  567. ret = snprintf(rpos, rend - rpos, " FAILURE");
  568. if (ret < 0 || ret >= rend - rpos)
  569. return;
  570. rpos += ret;
  571. }
  572. send:
  573. printf("Send: %s\n", reply);
  574. if (sendto(s, reply, rpos - reply, 0,
  575. (struct sockaddr *) from, fromlen) < 0)
  576. perror("send");
  577. }
  578. static void inc_sqn(u8 *sqn)
  579. {
  580. u64 val, seq, ind;
  581. /*
  582. * SQN = SEQ | IND = SEQ1 | SEQ2 | IND
  583. *
  584. * The mechanism used here is not time-based, so SEQ2 is void and
  585. * SQN = SEQ1 | IND. The length of IND is ind_len bits and the length
  586. * of SEQ1 is 48 - ind_len bits.
  587. */
  588. /* Increment both SEQ and IND by one */
  589. val = ((u64) WPA_GET_BE32(sqn) << 16) | ((u64) WPA_GET_BE16(sqn + 4));
  590. seq = (val >> ind_len) + 1;
  591. ind = (val + 1) & ((1 << ind_len) - 1);
  592. val = (seq << ind_len) | ind;
  593. WPA_PUT_BE32(sqn, val >> 16);
  594. WPA_PUT_BE16(sqn + 4, val & 0xffff);
  595. }
  596. static void aka_req_auth(int s, struct sockaddr_un *from, socklen_t fromlen,
  597. char *imsi)
  598. {
  599. /* AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES> */
  600. char reply[1000], *pos, *end;
  601. u8 _rand[EAP_AKA_RAND_LEN];
  602. u8 autn[EAP_AKA_AUTN_LEN];
  603. u8 ik[EAP_AKA_IK_LEN];
  604. u8 ck[EAP_AKA_CK_LEN];
  605. u8 res[EAP_AKA_RES_MAX_LEN];
  606. size_t res_len;
  607. int ret;
  608. struct milenage_parameters *m;
  609. int failed = 0;
  610. m = get_milenage(imsi);
  611. if (m) {
  612. if (random_get_bytes(_rand, EAP_AKA_RAND_LEN) < 0)
  613. return;
  614. res_len = EAP_AKA_RES_MAX_LEN;
  615. inc_sqn(m->sqn);
  616. #ifdef CONFIG_SQLITE
  617. db_update_milenage_sqn(m);
  618. #endif /* CONFIG_SQLITE */
  619. sqn_changes = 1;
  620. printf("AKA: Milenage with SQN=%02x%02x%02x%02x%02x%02x\n",
  621. m->sqn[0], m->sqn[1], m->sqn[2],
  622. m->sqn[3], m->sqn[4], m->sqn[5]);
  623. milenage_generate(m->opc, m->amf, m->ki, m->sqn, _rand,
  624. autn, ik, ck, res, &res_len);
  625. } else {
  626. printf("Unknown IMSI: %s\n", imsi);
  627. #ifdef AKA_USE_FIXED_TEST_VALUES
  628. printf("Using fixed test values for AKA\n");
  629. memset(_rand, '0', EAP_AKA_RAND_LEN);
  630. memset(autn, '1', EAP_AKA_AUTN_LEN);
  631. memset(ik, '3', EAP_AKA_IK_LEN);
  632. memset(ck, '4', EAP_AKA_CK_LEN);
  633. memset(res, '2', EAP_AKA_RES_MAX_LEN);
  634. res_len = EAP_AKA_RES_MAX_LEN;
  635. #else /* AKA_USE_FIXED_TEST_VALUES */
  636. failed = 1;
  637. #endif /* AKA_USE_FIXED_TEST_VALUES */
  638. }
  639. pos = reply;
  640. end = &reply[sizeof(reply)];
  641. ret = snprintf(pos, end - pos, "AKA-RESP-AUTH %s ", imsi);
  642. if (ret < 0 || ret >= end - pos)
  643. return;
  644. pos += ret;
  645. if (failed) {
  646. ret = snprintf(pos, end - pos, "FAILURE");
  647. if (ret < 0 || ret >= end - pos)
  648. return;
  649. pos += ret;
  650. goto done;
  651. }
  652. pos += wpa_snprintf_hex(pos, end - pos, _rand, EAP_AKA_RAND_LEN);
  653. *pos++ = ' ';
  654. pos += wpa_snprintf_hex(pos, end - pos, autn, EAP_AKA_AUTN_LEN);
  655. *pos++ = ' ';
  656. pos += wpa_snprintf_hex(pos, end - pos, ik, EAP_AKA_IK_LEN);
  657. *pos++ = ' ';
  658. pos += wpa_snprintf_hex(pos, end - pos, ck, EAP_AKA_CK_LEN);
  659. *pos++ = ' ';
  660. pos += wpa_snprintf_hex(pos, end - pos, res, res_len);
  661. done:
  662. printf("Send: %s\n", reply);
  663. if (sendto(s, reply, pos - reply, 0, (struct sockaddr *) from,
  664. fromlen) < 0)
  665. perror("send");
  666. }
  667. static void aka_auts(int s, struct sockaddr_un *from, socklen_t fromlen,
  668. char *imsi)
  669. {
  670. char *auts, *__rand;
  671. u8 _auts[EAP_AKA_AUTS_LEN], _rand[EAP_AKA_RAND_LEN], sqn[6];
  672. struct milenage_parameters *m;
  673. /* AKA-AUTS <IMSI> <AUTS> <RAND> */
  674. auts = strchr(imsi, ' ');
  675. if (auts == NULL)
  676. return;
  677. *auts++ = '\0';
  678. __rand = strchr(auts, ' ');
  679. if (__rand == NULL)
  680. return;
  681. *__rand++ = '\0';
  682. printf("AKA-AUTS: IMSI=%s AUTS=%s RAND=%s\n", imsi, auts, __rand);
  683. if (hexstr2bin(auts, _auts, EAP_AKA_AUTS_LEN) ||
  684. hexstr2bin(__rand, _rand, EAP_AKA_RAND_LEN)) {
  685. printf("Could not parse AUTS/RAND\n");
  686. return;
  687. }
  688. m = get_milenage(imsi);
  689. if (m == NULL) {
  690. printf("Unknown IMSI: %s\n", imsi);
  691. return;
  692. }
  693. if (milenage_auts(m->opc, m->ki, _rand, _auts, sqn)) {
  694. printf("AKA-AUTS: Incorrect MAC-S\n");
  695. } else {
  696. memcpy(m->sqn, sqn, 6);
  697. printf("AKA-AUTS: Re-synchronized: "
  698. "SQN=%02x%02x%02x%02x%02x%02x\n",
  699. sqn[0], sqn[1], sqn[2], sqn[3], sqn[4], sqn[5]);
  700. #ifdef CONFIG_SQLITE
  701. db_update_milenage_sqn(m);
  702. #endif /* CONFIG_SQLITE */
  703. sqn_changes = 1;
  704. }
  705. }
  706. static int process(int s)
  707. {
  708. char buf[1000];
  709. struct sockaddr_un from;
  710. socklen_t fromlen;
  711. ssize_t res;
  712. fromlen = sizeof(from);
  713. res = recvfrom(s, buf, sizeof(buf), 0, (struct sockaddr *) &from,
  714. &fromlen);
  715. if (res < 0) {
  716. perror("recvfrom");
  717. return -1;
  718. }
  719. if (res == 0)
  720. return 0;
  721. if ((size_t) res >= sizeof(buf))
  722. res = sizeof(buf) - 1;
  723. buf[res] = '\0';
  724. printf("Received: %s\n", buf);
  725. if (strncmp(buf, "SIM-REQ-AUTH ", 13) == 0)
  726. sim_req_auth(s, &from, fromlen, buf + 13);
  727. else if (strncmp(buf, "AKA-REQ-AUTH ", 13) == 0)
  728. aka_req_auth(s, &from, fromlen, buf + 13);
  729. else if (strncmp(buf, "AKA-AUTS ", 9) == 0)
  730. aka_auts(s, &from, fromlen, buf + 9);
  731. else
  732. printf("Unknown request: %s\n", buf);
  733. return 0;
  734. }
  735. static void cleanup(void)
  736. {
  737. struct gsm_triplet *g, *gprev;
  738. struct milenage_parameters *m, *prev;
  739. if (update_milenage && milenage_file && sqn_changes)
  740. update_milenage_file(milenage_file);
  741. g = gsm_db;
  742. while (g) {
  743. gprev = g;
  744. g = g->next;
  745. os_free(gprev);
  746. }
  747. m = milenage_db;
  748. while (m) {
  749. prev = m;
  750. m = m->next;
  751. os_free(prev);
  752. }
  753. close(serv_sock);
  754. unlink(socket_path);
  755. #ifdef CONFIG_SQLITE
  756. if (sqlite_db) {
  757. sqlite3_close(sqlite_db);
  758. sqlite_db = NULL;
  759. }
  760. #endif /* CONFIG_SQLITE */
  761. }
  762. static void handle_term(int sig)
  763. {
  764. printf("Signal %d - terminate\n", sig);
  765. exit(0);
  766. }
  767. static void usage(void)
  768. {
  769. printf("HLR/AuC testing gateway for hostapd EAP-SIM/AKA "
  770. "database/authenticator\n"
  771. "Copyright (c) 2005-2007, 2012, Jouni Malinen <j@w1.fi>\n"
  772. "\n"
  773. "usage:\n"
  774. "hlr_auc_gw [-hu] [-s<socket path>] [-g<triplet file>] "
  775. "[-m<milenage file>] \\\n"
  776. " [-D<DB file>] [-i<IND len in bits>]\n"
  777. "\n"
  778. "options:\n"
  779. " -h = show this usage help\n"
  780. " -u = update SQN in Milenage file on exit\n"
  781. " -s<socket path> = path for UNIX domain socket\n"
  782. " (default: %s)\n"
  783. " -g<triplet file> = path for GSM authentication triplets\n"
  784. " -m<milenage file> = path for Milenage keys\n"
  785. " -D<DB file> = path to SQLite database\n"
  786. " -i<IND len in bits> = IND length for SQN (default: 5)\n",
  787. default_socket_path);
  788. }
  789. int main(int argc, char *argv[])
  790. {
  791. int c;
  792. char *gsm_triplet_file = NULL;
  793. char *sqlite_db_file = NULL;
  794. if (os_program_init())
  795. return -1;
  796. socket_path = default_socket_path;
  797. for (;;) {
  798. c = getopt(argc, argv, "D:g:hi:m:s:u");
  799. if (c < 0)
  800. break;
  801. switch (c) {
  802. case 'D':
  803. #ifdef CONFIG_SQLITE
  804. sqlite_db_file = optarg;
  805. break;
  806. #else /* CONFIG_SQLITE */
  807. printf("No SQLite support included in the build\n");
  808. return -1;
  809. #endif /* CONFIG_SQLITE */
  810. case 'g':
  811. gsm_triplet_file = optarg;
  812. break;
  813. case 'h':
  814. usage();
  815. return 0;
  816. case 'i':
  817. ind_len = atoi(optarg);
  818. if (ind_len < 0 || ind_len > 32) {
  819. printf("Invalid IND length\n");
  820. return -1;
  821. }
  822. break;
  823. case 'm':
  824. milenage_file = optarg;
  825. break;
  826. case 's':
  827. socket_path = optarg;
  828. break;
  829. case 'u':
  830. update_milenage = 1;
  831. break;
  832. default:
  833. usage();
  834. return -1;
  835. }
  836. }
  837. if (!gsm_triplet_file && !milenage_file && !sqlite_db_file) {
  838. usage();
  839. return -1;
  840. }
  841. #ifdef CONFIG_SQLITE
  842. if (sqlite_db_file && (sqlite_db = db_open(sqlite_db_file)) == NULL)
  843. return -1;
  844. #endif /* CONFIG_SQLITE */
  845. if (gsm_triplet_file && read_gsm_triplets(gsm_triplet_file) < 0)
  846. return -1;
  847. if (milenage_file && read_milenage(milenage_file) < 0)
  848. return -1;
  849. serv_sock = open_socket(socket_path);
  850. if (serv_sock < 0)
  851. return -1;
  852. printf("Listening for requests on %s\n", socket_path);
  853. atexit(cleanup);
  854. signal(SIGTERM, handle_term);
  855. signal(SIGINT, handle_term);
  856. for (;;)
  857. process(serv_sock);
  858. #ifdef CONFIG_SQLITE
  859. if (sqlite_db) {
  860. sqlite3_close(sqlite_db);
  861. sqlite_db = NULL;
  862. }
  863. #endif /* CONFIG_SQLITE */
  864. os_program_deinit();
  865. return 0;
  866. }