[thirdparty/hostap.git] / hostapd / hlr_auc_gw.c

/*
 * HLR/AuC testing gateway for hostapd EAP-SIM/AKA database/authenticator
 * Copyright (c) 2005-2007, 2012, Jouni Malinen <j@w1.fi>
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 *
 * This is an example implementation of the EAP-SIM/AKA database/authentication
 * gateway interface to HLR/AuC. It is expected to be replaced with an
 * implementation of SS7 gateway to GSM/UMTS authentication center (HLR/AuC) or
 * a local implementation of SIM triplet and AKA authentication data generator.
 *
 * hostapd will send SIM/AKA authentication queries over a UNIX domain socket
 * to and external program, e.g., this hlr_auc_gw. This interface uses simple
 * text-based format:
 *
 * EAP-SIM / GSM triplet query/response:
 * SIM-REQ-AUTH <IMSI> <max_chal>
 * SIM-RESP-AUTH <IMSI> Kc1:SRES1:RAND1 Kc2:SRES2:RAND2 [Kc3:SRES3:RAND3]
 * SIM-RESP-AUTH <IMSI> FAILURE
 *
 * EAP-AKA / UMTS query/response:
 * AKA-REQ-AUTH <IMSI>
 * AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES>
 * AKA-RESP-AUTH <IMSI> FAILURE
 *
 * EAP-AKA / UMTS AUTS (re-synchronization):
 * AKA-AUTS <IMSI> <AUTS> <RAND>
 *
 * IMSI and max_chal are sent as an ASCII string,
 * Kc/SRES/RAND/AUTN/IK/CK/RES/AUTS as hex strings.
 *
 * The example implementation here reads GSM authentication triplets from a
 * text file in IMSI:Kc:SRES:RAND format, IMSI in ASCII, other fields as hex
 * strings. This is used to simulate an HLR/AuC. As such, it is not very useful
 * for real life authentication, but it is useful both as an example
 * implementation and for EAP-SIM/AKA/AKA' testing.
 *
 * SQN generation follows the not time-based Profile 2 described in
 * 3GPP TS 33.102 Annex C.3.2. The length of IND is 5 bits by default, but this
 * can be changed with a command line options if needed.
 */

#include "includes.h"
#include <sys/un.h>

#include "common.h"
#include "crypto/milenage.h"
#include "crypto/random.h"

static const char *default_socket_path = "/tmp/hlr_auc_gw.sock";
static const char *socket_path;
static int serv_sock = -1;
static char *milenage_file = NULL;
static int update_milenage = 0;
static int sqn_changes = 0;
static int ind_len = 5;

/* GSM triplets */
struct gsm_triplet {
	struct gsm_triplet *next;
	char imsi[20];
	u8 kc[8];
	u8 sres[4];
	u8 _rand[16];
};

static struct gsm_triplet *gsm_db = NULL, *gsm_db_pos = NULL;

/* OPc and AMF parameters for Milenage (Example algorithms for AKA). */
struct milenage_parameters {
	struct milenage_parameters *next;
	char imsi[20];
	u8 ki[16];
	u8 opc[16];
	u8 amf[2];
	u8 sqn[6];
};

static struct milenage_parameters *milenage_db = NULL;

#define EAP_SIM_MAX_CHAL 3

#define EAP_AKA_RAND_LEN 16
#define EAP_AKA_AUTN_LEN 16
#define EAP_AKA_AUTS_LEN 14
#define EAP_AKA_RES_MAX_LEN 16
#define EAP_AKA_IK_LEN 16
#define EAP_AKA_CK_LEN 16


static int open_socket(const char *path)
{
	struct sockaddr_un addr;
	int s;

	s = socket(PF_UNIX, SOCK_DGRAM, 0);
	if (s < 0) {
		perror("socket(PF_UNIX)");
		return -1;
	}

	memset(&addr, 0, sizeof(addr));
	addr.sun_family = AF_UNIX;
	os_strlcpy(addr.sun_path, path, sizeof(addr.sun_path));
	if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
		perror("hlr-auc-gw: bind(PF_UNIX)");
		close(s);
		return -1;
	}

	return s;
}


static int read_gsm_triplets(const char *fname)
{
	FILE *f;
	char buf[200], *pos, *pos2;
	struct gsm_triplet *g = NULL;
	int line, ret = 0;

	if (fname == NULL)
		return -1;

	f = fopen(fname, "r");
	if (f == NULL) {
		printf("Could not open GSM tripler data file '%s'\n", fname);
		return -1;
	}

	line = 0;
	while (fgets(buf, sizeof(buf), f)) {
		line++;

		/* Parse IMSI:Kc:SRES:RAND */
		buf[sizeof(buf) - 1] = '\0';
		if (buf[0] == '#')
			continue;
		pos = buf;
		while (*pos != '\0' && *pos != '\n')
			pos++;
		if (*pos == '\n')
			*pos = '\0';
		pos = buf;
		if (*pos == '\0')
			continue;

		g = os_zalloc(sizeof(*g));
		if (g == NULL) {
			ret = -1;
			break;
		}

		/* IMSI */
		pos2 = strchr(pos, ':');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid IMSI (%s)\n",
			       fname, line, pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) >= sizeof(g->imsi)) {
			printf("%s:%d - Too long IMSI (%s)\n",
			       fname, line, pos);
			ret = -1;
			break;
		}
		os_strlcpy(g->imsi, pos, sizeof(g->imsi));
		pos = pos2 + 1;

		/* Kc */
		pos2 = strchr(pos, ':');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid Kc (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) != 16 || hexstr2bin(pos, g->kc, 8)) {
			printf("%s:%d - Invalid Kc (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		/* SRES */
		pos2 = strchr(pos, ':');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid SRES (%s)\n", fname, line,
			       pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) != 8 || hexstr2bin(pos, g->sres, 4)) {
			printf("%s:%d - Invalid SRES (%s)\n", fname, line,
			       pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		/* RAND */
		pos2 = strchr(pos, ':');
		if (pos2)
			*pos2 = '\0';
		if (strlen(pos) != 32 || hexstr2bin(pos, g->_rand, 16)) {
			printf("%s:%d - Invalid RAND (%s)\n", fname, line,
			       pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		g->next = gsm_db;
		gsm_db = g;
		g = NULL;
	}
	os_free(g);

	fclose(f);

	return ret;
}


static struct gsm_triplet * get_gsm_triplet(const char *imsi)
{
	struct gsm_triplet *g = gsm_db_pos;

	while (g) {
		if (strcmp(g->imsi, imsi) == 0) {
			gsm_db_pos = g->next;
			return g;
		}
		g = g->next;
	}

	g = gsm_db;
	while (g && g != gsm_db_pos) {
		if (strcmp(g->imsi, imsi) == 0) {
			gsm_db_pos = g->next;
			return g;
		}
		g = g->next;
	}

	return NULL;
}


static int read_milenage(const char *fname)
{
	FILE *f;
	char buf[200], *pos, *pos2;
	struct milenage_parameters *m = NULL;
	int line, ret = 0;

	if (fname == NULL)
		return -1;

	f = fopen(fname, "r");
	if (f == NULL) {
		printf("Could not open Milenage data file '%s'\n", fname);
		return -1;
	}

	line = 0;
	while (fgets(buf, sizeof(buf), f)) {
		line++;

		/* Parse IMSI Ki OPc AMF SQN */
		buf[sizeof(buf) - 1] = '\0';
		if (buf[0] == '#')
			continue;
		pos = buf;
		while (*pos != '\0' && *pos != '\n')
			pos++;
		if (*pos == '\n')
			*pos = '\0';
		pos = buf;
		if (*pos == '\0')
			continue;

		m = os_zalloc(sizeof(*m));
		if (m == NULL) {
			ret = -1;
			break;
		}

		/* IMSI */
		pos2 = strchr(pos, ' ');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid IMSI (%s)\n",
			       fname, line, pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) >= sizeof(m->imsi)) {
			printf("%s:%d - Too long IMSI (%s)\n",
			       fname, line, pos);
			ret = -1;
			break;
		}
		os_strlcpy(m->imsi, pos, sizeof(m->imsi));
		pos = pos2 + 1;

		/* Ki */
		pos2 = strchr(pos, ' ');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid Ki (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) != 32 || hexstr2bin(pos, m->ki, 16)) {
			printf("%s:%d - Invalid Ki (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		/* OPc */
		pos2 = strchr(pos, ' ');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid OPc (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) != 32 || hexstr2bin(pos, m->opc, 16)) {
			printf("%s:%d - Invalid OPc (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		/* AMF */
		pos2 = strchr(pos, ' ');
		if (pos2 == NULL) {
			printf("%s:%d - Invalid AMF (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		*pos2 = '\0';
		if (strlen(pos) != 4 || hexstr2bin(pos, m->amf, 2)) {
			printf("%s:%d - Invalid AMF (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		/* SQN */
		pos2 = strchr(pos, ' ');
		if (pos2)
			*pos2 = '\0';
		if (strlen(pos) != 12 || hexstr2bin(pos, m->sqn, 6)) {
			printf("%s:%d - Invalid SEQ (%s)\n", fname, line, pos);
			ret = -1;
			break;
		}
		pos = pos2 + 1;

		m->next = milenage_db;
		milenage_db = m;
		m = NULL;
	}
	os_free(m);

	fclose(f);

	return ret;
}


static void update_milenage_file(const char *fname)
{
	FILE *f, *f2;
	char buf[500], *pos;
	char *end = buf + sizeof(buf);
	struct milenage_parameters *m;
	size_t imsi_len;

	f = fopen(fname, "r");
	if (f == NULL) {
		printf("Could not open Milenage data file '%s'\n", fname);
		return;
	}

	snprintf(buf, sizeof(buf), "%s.new", fname);
	f2 = fopen(buf, "w");
	if (f2 == NULL) {
		printf("Could not write Milenage data file '%s'\n", buf);
		fclose(f);
		return;
	}

	while (fgets(buf, sizeof(buf), f)) {
		/* IMSI Ki OPc AMF SQN */
		buf[sizeof(buf) - 1] = '\0';

		pos = strchr(buf, ' ');
		if (buf[0] == '#' || pos == NULL || pos - buf >= 20)
			goto no_update;

		imsi_len = pos - buf;

		for (m = milenage_db; m; m = m->next) {
			if (strncmp(buf, m->imsi, imsi_len) == 0 &&
			    m->imsi[imsi_len] == '\0')
				break;
		}

		if (!m)
			goto no_update;

		pos = buf;
		pos += snprintf(pos, end - pos, "%s ", m->imsi);
		pos += wpa_snprintf_hex(pos, end - pos, m->ki, 16);
		*pos++ = ' ';
		pos += wpa_snprintf_hex(pos, end - pos, m->opc, 16);
		*pos++ = ' ';
		pos += wpa_snprintf_hex(pos, end - pos, m->amf, 2);
		*pos++ = ' ';
		pos += wpa_snprintf_hex(pos, end - pos, m->sqn, 6);
		*pos++ = '\n';

	no_update:
		fprintf(f2, "%s", buf);
	}

	fclose(f2);
	fclose(f);

	snprintf(buf, sizeof(buf), "%s.bak", fname);
	if (rename(fname, buf) < 0) {
		perror("rename");
		return;
	}

	snprintf(buf, sizeof(buf), "%s.new", fname);
	if (rename(buf, fname) < 0) {
		perror("rename");
		return;
	}

}


static struct milenage_parameters * get_milenage(const char *imsi)
{
	struct milenage_parameters *m = milenage_db;

	while (m) {
		if (strcmp(m->imsi, imsi) == 0)
			break;
		m = m->next;
	}

	return m;
}


static void sim_req_auth(int s, struct sockaddr_un *from, socklen_t fromlen,
			 char *imsi)
{
	int count, max_chal, ret;
	char *pos;
	char reply[1000], *rpos, *rend;
	struct milenage_parameters *m;
	struct gsm_triplet *g;

	reply[0] = '\0';

	pos = strchr(imsi, ' ');
	if (pos) {
		*pos++ = '\0';
		max_chal = atoi(pos);
		if (max_chal < 1 || max_chal < EAP_SIM_MAX_CHAL)
			max_chal = EAP_SIM_MAX_CHAL;
	} else
		max_chal = EAP_SIM_MAX_CHAL;

	rend = &reply[sizeof(reply)];
	rpos = reply;
	ret = snprintf(rpos, rend - rpos, "SIM-RESP-AUTH %s", imsi);
	if (ret < 0 || ret >= rend - rpos)
		return;
	rpos += ret;

	m = get_milenage(imsi);
	if (m) {
		u8 _rand[16], sres[4], kc[8];
		for (count = 0; count < max_chal; count++) {
			if (random_get_bytes(_rand, 16) < 0)
				return;
			gsm_milenage(m->opc, m->ki, _rand, sres, kc);
			*rpos++ = ' ';
			rpos += wpa_snprintf_hex(rpos, rend - rpos, kc, 8);
			*rpos++ = ':';
			rpos += wpa_snprintf_hex(rpos, rend - rpos, sres, 4);
			*rpos++ = ':';
			rpos += wpa_snprintf_hex(rpos, rend - rpos, _rand, 16);
		}
		*rpos = '\0';
		goto send;
	}

	count = 0;
	while (count < max_chal && (g = get_gsm_triplet(imsi))) {
		if (strcmp(g->imsi, imsi) != 0)
			continue;

		if (rpos < rend)
			*rpos++ = ' ';
		rpos += wpa_snprintf_hex(rpos, rend - rpos, g->kc, 8);
		if (rpos < rend)
			*rpos++ = ':';
		rpos += wpa_snprintf_hex(rpos, rend - rpos, g->sres, 4);
		if (rpos < rend)
			*rpos++ = ':';
		rpos += wpa_snprintf_hex(rpos, rend - rpos, g->_rand, 16);
		count++;
	}

	if (count == 0) {
		printf("No GSM triplets found for %s\n", imsi);
		ret = snprintf(rpos, rend - rpos, " FAILURE");
		if (ret < 0 || ret >= rend - rpos)
			return;
		rpos += ret;
	}

send:
	printf("Send: %s\n", reply);
	if (sendto(s, reply, rpos - reply, 0,
		   (struct sockaddr *) from, fromlen) < 0)
		perror("send");
}


static void inc_sqn(u8 *sqn)
{
	u64 val, seq, ind;

	/*
	 * SQN = SEQ | IND = SEQ1 | SEQ2 | IND
	 *
	 * The mechanism used here is not time-based, so SEQ2 is void and
	 * SQN = SEQ1 | IND. The length of IND is ind_len bits and the length
	 * of SEQ1 is 48 - ind_len bits.
	 */

	/* Increment both SEQ and IND by one */
	val = ((u64) WPA_GET_BE32(sqn) << 16) | ((u64) WPA_GET_BE16(sqn + 4));
	seq = (val >> ind_len) + 1;
	ind = (val + 1) & ((1 << ind_len) - 1);
	val = (seq << ind_len) | ind;
	WPA_PUT_BE32(sqn, val >> 16);
	WPA_PUT_BE16(sqn + 4, val & 0xffff);
}


static void aka_req_auth(int s, struct sockaddr_un *from, socklen_t fromlen,
			 char *imsi)
{
	/* AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES> */
	char reply[1000], *pos, *end;
	u8 _rand[EAP_AKA_RAND_LEN];
	u8 autn[EAP_AKA_AUTN_LEN];
	u8 ik[EAP_AKA_IK_LEN];
	u8 ck[EAP_AKA_CK_LEN];
	u8 res[EAP_AKA_RES_MAX_LEN];
	size_t res_len;
	int ret;
	struct milenage_parameters *m;

	m = get_milenage(imsi);
	if (m) {
		if (random_get_bytes(_rand, EAP_AKA_RAND_LEN) < 0)
			return;
		res_len = EAP_AKA_RES_MAX_LEN;
		inc_sqn(m->sqn);
		sqn_changes = 1;
		printf("AKA: Milenage with SQN=%02x%02x%02x%02x%02x%02x\n",
		       m->sqn[0], m->sqn[1], m->sqn[2],
		       m->sqn[3], m->sqn[4], m->sqn[5]);
		milenage_generate(m->opc, m->amf, m->ki, m->sqn, _rand,
				  autn, ik, ck, res, &res_len);
	} else {
		printf("Unknown IMSI: %s\n", imsi);
#ifdef AKA_USE_FIXED_TEST_VALUES
		printf("Using fixed test values for AKA\n");
		memset(_rand, '0', EAP_AKA_RAND_LEN);
		memset(autn, '1', EAP_AKA_AUTN_LEN);
		memset(ik, '3', EAP_AKA_IK_LEN);
		memset(ck, '4', EAP_AKA_CK_LEN);
		memset(res, '2', EAP_AKA_RES_MAX_LEN);
		res_len = EAP_AKA_RES_MAX_LEN;
#else /* AKA_USE_FIXED_TEST_VALUES */
		return;
#endif /* AKA_USE_FIXED_TEST_VALUES */
	}

	pos = reply;
	end = &reply[sizeof(reply)];
	ret = snprintf(pos, end - pos, "AKA-RESP-AUTH %s ", imsi);
	if (ret < 0 || ret >= end - pos)
		return;
	pos += ret;
	pos += wpa_snprintf_hex(pos, end - pos, _rand, EAP_AKA_RAND_LEN);
	*pos++ = ' ';
	pos += wpa_snprintf_hex(pos, end - pos, autn, EAP_AKA_AUTN_LEN);
	*pos++ = ' ';
	pos += wpa_snprintf_hex(pos, end - pos, ik, EAP_AKA_IK_LEN);
	*pos++ = ' ';
	pos += wpa_snprintf_hex(pos, end - pos, ck, EAP_AKA_CK_LEN);
	*pos++ = ' ';
	pos += wpa_snprintf_hex(pos, end - pos, res, res_len);

	printf("Send: %s\n", reply);

	if (sendto(s, reply, pos - reply, 0, (struct sockaddr *) from,
		   fromlen) < 0)
		perror("send");
}


static void aka_auts(int s, struct sockaddr_un *from, socklen_t fromlen,
		     char *imsi)
{
	char *auts, *__rand;
	u8 _auts[EAP_AKA_AUTS_LEN], _rand[EAP_AKA_RAND_LEN], sqn[6];
	struct milenage_parameters *m;

	/* AKA-AUTS <IMSI> <AUTS> <RAND> */

	auts = strchr(imsi, ' ');
	if (auts == NULL)
		return;
	*auts++ = '\0';

	__rand = strchr(auts, ' ');
	if (__rand == NULL)
		return;
	*__rand++ = '\0';

	printf("AKA-AUTS: IMSI=%s AUTS=%s RAND=%s\n", imsi, auts, __rand);
	if (hexstr2bin(auts, _auts, EAP_AKA_AUTS_LEN) ||
	    hexstr2bin(__rand, _rand, EAP_AKA_RAND_LEN)) {
		printf("Could not parse AUTS/RAND\n");
		return;
	}

	m = get_milenage(imsi);
	if (m == NULL) {
		printf("Unknown IMSI: %s\n", imsi);
		return;
	}

	if (milenage_auts(m->opc, m->ki, _rand, _auts, sqn)) {
		printf("AKA-AUTS: Incorrect MAC-S\n");
	} else {
		memcpy(m->sqn, sqn, 6);
		printf("AKA-AUTS: Re-synchronized: "
		       "SQN=%02x%02x%02x%02x%02x%02x\n",
		       sqn[0], sqn[1], sqn[2], sqn[3], sqn[4], sqn[5]);
		sqn_changes = 1;
	}
}


static int process(int s)
{
	char buf[1000];
	struct sockaddr_un from;
	socklen_t fromlen;
	ssize_t res;

	fromlen = sizeof(from);
	res = recvfrom(s, buf, sizeof(buf), 0, (struct sockaddr *) &from,
		       &fromlen);
	if (res < 0) {
		perror("recvfrom");
		return -1;
	}

	if (res == 0)
		return 0;

	if ((size_t) res >= sizeof(buf))
		res = sizeof(buf) - 1;
	buf[res] = '\0';

	printf("Received: %s\n", buf);

	if (strncmp(buf, "SIM-REQ-AUTH ", 13) == 0)
		sim_req_auth(s, &from, fromlen, buf + 13);
	else if (strncmp(buf, "AKA-REQ-AUTH ", 13) == 0)
		aka_req_auth(s, &from, fromlen, buf + 13);
	else if (strncmp(buf, "AKA-AUTS ", 9) == 0)
		aka_auts(s, &from, fromlen, buf + 9);
	else
		printf("Unknown request: %s\n", buf);

	return 0;
}


static void cleanup(void)
{
	struct gsm_triplet *g, *gprev;
	struct milenage_parameters *m, *prev;

	if (update_milenage && milenage_file && sqn_changes)
		update_milenage_file(milenage_file);

	g = gsm_db;
	while (g) {
		gprev = g;
		g = g->next;
		os_free(gprev);
	}

	m = milenage_db;
	while (m) {
		prev = m;
		m = m->next;
		os_free(prev);
	}

	close(serv_sock);
	unlink(socket_path);
}


static void handle_term(int sig)
{
	printf("Signal %d - terminate\n", sig);
	exit(0);
}


static void usage(void)
{
	printf("HLR/AuC testing gateway for hostapd EAP-SIM/AKA "
	       "database/authenticator\n"
	       "Copyright (c) 2005-2007, 2012, Jouni Malinen <j@w1.fi>\n"
	       "\n"
	       "usage:\n"
	       "hlr_auc_gw [-hu] [-s<socket path>] [-g<triplet file>] "
	       "[-m<milenage file>] \\\n"
	       "        [-i<IND len in bits>]\n"
	       "\n"
	       "options:\n"
	       "  -h = show this usage help\n"
	       "  -u = update SQN in Milenage file on exit\n"
	       "  -s<socket path> = path for UNIX domain socket\n"
	       "                    (default: %s)\n"
	       "  -g<triplet file> = path for GSM authentication triplets\n"
	       "  -m<milenage file> = path for Milenage keys\n"
	       "  -i<IND len in bits> = IND length for SQN (default: 5)\n",
	       default_socket_path);
}


int main(int argc, char *argv[])
{
	int c;
	char *gsm_triplet_file = NULL;

	if (os_program_init())
		return -1;

	socket_path = default_socket_path;

	for (;;) {
		c = getopt(argc, argv, "g:hi:m:s:u");
		if (c < 0)
			break;
		switch (c) {
		case 'g':
			gsm_triplet_file = optarg;
			break;
		case 'h':
			usage();
			return 0;
		case 'i':
			ind_len = atoi(optarg);
			if (ind_len < 0 || ind_len > 32) {
				printf("Invalid IND length\n");
				return -1;
			}
			break;
		case 'm':
			milenage_file = optarg;
			break;
		case 's':
			socket_path = optarg;
			break;
		case 'u':
			update_milenage = 1;
			break;
		default:
			usage();
			return -1;
		}
	}

	if (gsm_triplet_file && read_gsm_triplets(gsm_triplet_file) < 0)
		return -1;

	if (milenage_file && read_milenage(milenage_file) < 0)
		return -1;

	serv_sock = open_socket(socket_path);
	if (serv_sock < 0)
		return -1;

	printf("Listening for requests on %s\n", socket_path);

	atexit(cleanup);
	signal(SIGTERM, handle_term);
	signal(SIGINT, handle_term);

	for (;;)
		process(serv_sock);

	os_program_deinit();

	return 0;
}
Commit	Line	Data
6fc6879b JM	1	/*
6fc6879b JM	2	* HLR/AuC testing gateway for hostapd EAP-SIM/AKA database/authenticator
53368613	3	* Copyright (c) 2005-2007, 2012, Jouni Malinen <j@w1.fi>
6fc6879b	4	*
0f3d578e JM	5	* This software may be distributed under the terms of the BSD license.
0f3d578e JM	6	* See README for more details.
6fc6879b JM	7	*
	8	* This is an example implementation of the EAP-SIM/AKA database/authentication
	9	* gateway interface to HLR/AuC. It is expected to be replaced with an
	10	* implementation of SS7 gateway to GSM/UMTS authentication center (HLR/AuC) or
	11	* a local implementation of SIM triplet and AKA authentication data generator.
	12	*
	13	* hostapd will send SIM/AKA authentication queries over a UNIX domain socket
	14	* to and external program, e.g., this hlr_auc_gw. This interface uses simple
	15	* text-based format:
	16	*
	17	* EAP-SIM / GSM triplet query/response:
	18	* SIM-REQ-AUTH <IMSI> <max_chal>
	19	* SIM-RESP-AUTH <IMSI> Kc1:SRES1:RAND1 Kc2:SRES2:RAND2 [Kc3:SRES3:RAND3]
	20	* SIM-RESP-AUTH <IMSI> FAILURE
	21	*
	22	* EAP-AKA / UMTS query/response:
	23	* AKA-REQ-AUTH <IMSI>
	24	* AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES>
	25	* AKA-RESP-AUTH <IMSI> FAILURE
	26	*
	27	* EAP-AKA / UMTS AUTS (re-synchronization):
	28	* AKA-AUTS <IMSI> <AUTS> <RAND>
	29	*
	30	* IMSI and max_chal are sent as an ASCII string,
	31	* Kc/SRES/RAND/AUTN/IK/CK/RES/AUTS as hex strings.
	32	*
	33	* The example implementation here reads GSM authentication triplets from a
	34	* text file in IMSI:Kc:SRES:RAND format, IMSI in ASCII, other fields as hex
	35	* strings. This is used to simulate an HLR/AuC. As such, it is not very useful
	36	* for real life authentication, but it is useful both as an example
5daba48c JM	37	* implementation and for EAP-SIM/AKA/AKA' testing.
	38	*
	39	* SQN generation follows the not time-based Profile 2 described in
	40	* 3GPP TS 33.102 Annex C.3.2. The length of IND is 5 bits by default, but this
	41	* can be changed with a command line options if needed.
6fc6879b JM	42	*/
	43
	44	#include "includes.h"
	45	#include <sys/un.h>
	46
	47	#include "common.h"
43df4cc2	48	#include "crypto/milenage.h"
3642c431	49	#include "crypto/random.h"
6fc6879b JM	50
	51	static const char *default_socket_path = "/tmp/hlr_auc_gw.sock";
	52	static const char *socket_path;
	53	static int serv_sock = -1;
53368613 JM	54	static char *milenage_file = NULL;
	55	static int update_milenage = 0;
	56	static int sqn_changes = 0;
5daba48c	57	static int ind_len = 5;
6fc6879b JM	58
	59	/* GSM triplets */
	60	struct gsm_triplet {
	61	struct gsm_triplet *next;
	62	char imsi[20];
	63	u8 kc[8];
	64	u8 sres[4];
	65	u8 _rand[16];
	66	};
	67
	68	static struct gsm_triplet gsm_db = NULL, gsm_db_pos = NULL;
	69
	70	/* OPc and AMF parameters for Milenage (Example algorithms for AKA). */
	71	struct milenage_parameters {
	72	struct milenage_parameters *next;
	73	char imsi[20];
	74	u8 ki[16];
	75	u8 opc[16];
	76	u8 amf[2];
	77	u8 sqn[6];
	78	};
	79
	80	static struct milenage_parameters *milenage_db = NULL;
	81
	82	#define EAP_SIM_MAX_CHAL 3
	83
	84	#define EAP_AKA_RAND_LEN 16
	85	#define EAP_AKA_AUTN_LEN 16
	86	#define EAP_AKA_AUTS_LEN 14
	87	#define EAP_AKA_RES_MAX_LEN 16
	88	#define EAP_AKA_IK_LEN 16
	89	#define EAP_AKA_CK_LEN 16
	90
	91
	92	static int open_socket(const char *path)
	93	{
	94	struct sockaddr_un addr;
	95	int s;
	96
	97	s = socket(PF_UNIX, SOCK_DGRAM, 0);
	98	if (s < 0) {
	99	perror("socket(PF_UNIX)");
	100	return -1;
	101	}
	102
	103	memset(&addr, 0, sizeof(addr));
	104	addr.sun_family = AF_UNIX;
	105	os_strlcpy(addr.sun_path, path, sizeof(addr.sun_path));
	106	if (bind(s, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
9d053747	107	perror("hlr-auc-gw: bind(PF_UNIX)");
6fc6879b JM	108	close(s);
	109	return -1;
	110	}
	111
	112	return s;
	113	}
	114
	115
	116	static int read_gsm_triplets(const char *fname)
	117	{
	118	FILE *f;
	119	char buf[200], pos, pos2;
	120	struct gsm_triplet *g = NULL;
	121	int line, ret = 0;
	122
	123	if (fname == NULL)
	124	return -1;
	125
	126	f = fopen(fname, "r");
	127	if (f == NULL) {
	128	printf("Could not open GSM tripler data file '%s'\n", fname);
	129	return -1;
	130	}
	131
	132	line = 0;
	133	while (fgets(buf, sizeof(buf), f)) {
	134	line++;
	135
	136	/* Parse IMSI:Kc:SRES:RAND */
	137	buf[sizeof(buf) - 1] = '\0';
	138	if (buf[0] == '#')
	139	continue;
	140	pos = buf;
	141	while (pos != '\0' && pos != '\n')
	142	pos++;
	143	if (*pos == '\n')
	144	*pos = '\0';
	145	pos = buf;
	146	if (*pos == '\0')
	147	continue;
	148
	149	g = os_zalloc(sizeof(*g));
	150	if (g == NULL) {
	151	ret = -1;
	152	break;
	153	}
	154
	155	/* IMSI */
	156	pos2 = strchr(pos, ':');
	157	if (pos2 == NULL) {
	158	printf("%s:%d - Invalid IMSI (%s)\n",
	159	fname, line, pos);
	160	ret = -1;
	161	break;
	162	}
	163	*pos2 = '\0';
	164	if (strlen(pos) >= sizeof(g->imsi)) {
	165	printf("%s:%d - Too long IMSI (%s)\n",
	166	fname, line, pos);
	167	ret = -1;
	168	break;
	169	}
	170	os_strlcpy(g->imsi, pos, sizeof(g->imsi));
	171	pos = pos2 + 1;
172
173	/* Kc */
174	pos2 = strchr(pos, ':');
175	if (pos2 == NULL) {
176	printf("%s:%d - Invalid Kc (%s)\n", fname, line, pos);
177	ret = -1;
178	break;
179	}
180	*pos2 = '\0';
181	if (strlen(pos) != 16 \|\| hexstr2bin(pos, g->kc, 8)) {
182	printf("%s:%d - Invalid Kc (%s)\n", fname, line, pos);
183	ret = -1;
184	break;
185	}
186	pos = pos2 + 1;
187
188	/* SRES */
189	pos2 = strchr(pos, ':');
190	if (pos2 == NULL) {
191	printf("%s:%d - Invalid SRES (%s)\n", fname, line,
192	pos);
193	ret = -1;
194	break;
195	}
196	*pos2 = '\0';
197	if (strlen(pos) != 8 \|\| hexstr2bin(pos, g->sres, 4)) {
198	printf("%s:%d - Invalid SRES (%s)\n", fname, line,
199	pos);
200	ret = -1;
201	break;
202	}
203	pos = pos2 + 1;
204
205	/* RAND */
206	pos2 = strchr(pos, ':');
207	if (pos2)
208	*pos2 = '\0';
209	if (strlen(pos) != 32 \|\| hexstr2bin(pos, g->_rand, 16)) {
210	printf("%s:%d - Invalid RAND (%s)\n", fname, line,
211	pos);
212	ret = -1;
213	break;
214	}
215	pos = pos2 + 1;
216
217	g->next = gsm_db;
218	gsm_db = g;
219	g = NULL;
220	}
057a92ec	221	os_free(g);
6fc6879b JM	222
	223	fclose(f);
	224
	225	return ret;
	226	}
	227
	228
	229	static struct gsm_triplet * get_gsm_triplet(const char *imsi)
	230	{
	231	struct gsm_triplet *g = gsm_db_pos;
	232
	233	while (g) {
	234	if (strcmp(g->imsi, imsi) == 0) {
	235	gsm_db_pos = g->next;
	236	return g;
	237	}
	238	g = g->next;
	239	}
	240
	241	g = gsm_db;
	242	while (g && g != gsm_db_pos) {
	243	if (strcmp(g->imsi, imsi) == 0) {
	244	gsm_db_pos = g->next;
	245	return g;
	246	}
	247	g = g->next;
	248	}
	249
	250	return NULL;
	251	}
	252
	253
	254	static int read_milenage(const char *fname)
	255	{
	256	FILE *f;
	257	char buf[200], pos, pos2;
	258	struct milenage_parameters *m = NULL;
	259	int line, ret = 0;
	260
	261	if (fname == NULL)
	262	return -1;
	263
	264	f = fopen(fname, "r");
	265	if (f == NULL) {
	266	printf("Could not open Milenage data file '%s'\n", fname);
	267	return -1;
	268	}
	269
	270	line = 0;
	271	while (fgets(buf, sizeof(buf), f)) {
	272	line++;
	273
	274	/* Parse IMSI Ki OPc AMF SQN */
	275	buf[sizeof(buf) - 1] = '\0';
	276	if (buf[0] == '#')
	277	continue;
	278	pos = buf;
	279	while (pos != '\0' && pos != '\n')
	280	pos++;
	281	if (*pos == '\n')
	282	*pos = '\0';
	283	pos = buf;
	284	if (*pos == '\0')
	285	continue;
286
287	m = os_zalloc(sizeof(*m));
288	if (m == NULL) {
289	ret = -1;
290	break;
291	}
292
293	/* IMSI */
294	pos2 = strchr(pos, ' ');
295	if (pos2 == NULL) {
296	printf("%s:%d - Invalid IMSI (%s)\n",
297	fname, line, pos);
298	ret = -1;
299	break;
300	}
301	*pos2 = '\0';
302	if (strlen(pos) >= sizeof(m->imsi)) {
303	printf("%s:%d - Too long IMSI (%s)\n",
304	fname, line, pos);
305	ret = -1;
306	break;
307	}
308	os_strlcpy(m->imsi, pos, sizeof(m->imsi));
309	pos = pos2 + 1;
310
311	/* Ki */
312	pos2 = strchr(pos, ' ');
313	if (pos2 == NULL) {
314	printf("%s:%d - Invalid Ki (%s)\n", fname, line, pos);
315	ret = -1;
316	break;
317	}
318	*pos2 = '\0';
319	if (strlen(pos) != 32 \|\| hexstr2bin(pos, m->ki, 16)) {
320	printf("%s:%d - Invalid Ki (%s)\n", fname, line, pos);
321	ret = -1;
322	break;
323	}
324	pos = pos2 + 1;
325
326	/* OPc */
327	pos2 = strchr(pos, ' ');
328	if (pos2 == NULL) {
329	printf("%s:%d - Invalid OPc (%s)\n", fname, line, pos);
330	ret = -1;
331	break;
332	}
333	*pos2 = '\0';
334	if (strlen(pos) != 32 \|\| hexstr2bin(pos, m->opc, 16)) {
335	printf("%s:%d - Invalid OPc (%s)\n", fname, line, pos);
336	ret = -1;
337	break;
338	}
339	pos = pos2 + 1;
340
341	/* AMF */
342	pos2 = strchr(pos, ' ');
343	if (pos2 == NULL) {
344	printf("%s:%d - Invalid AMF (%s)\n", fname, line, pos);
345	ret = -1;
346	break;
347	}
348	*pos2 = '\0';
349	if (strlen(pos) != 4 \|\| hexstr2bin(pos, m->amf, 2)) {
350	printf("%s:%d - Invalid AMF (%s)\n", fname, line, pos);
351	ret = -1;
352	break;
353	}
354	pos = pos2 + 1;
355
356	/* SQN */
357	pos2 = strchr(pos, ' ');
358	if (pos2)
359	*pos2 = '\0';
360	if (strlen(pos) != 12 \|\| hexstr2bin(pos, m->sqn, 6)) {
361	printf("%s:%d - Invalid SEQ (%s)\n", fname, line, pos);
362	ret = -1;
363	break;
364	}
365	pos = pos2 + 1;
366
367	m->next = milenage_db;
368	milenage_db = m;
369	m = NULL;
370	}
057a92ec	371	os_free(m);
6fc6879b JM	372
	373	fclose(f);
	374
	375	return ret;
	376	}
	377
	378
53368613 JM	379	static void update_milenage_file(const char *fname)
	380	{
	381	FILE f, f2;
	382	char buf[500], *pos;
	383	char *end = buf + sizeof(buf);
	384	struct milenage_parameters *m;
	385	size_t imsi_len;
	386
	387	f = fopen(fname, "r");
	388	if (f == NULL) {
	389	printf("Could not open Milenage data file '%s'\n", fname);
	390	return;
	391	}
	392
	393	snprintf(buf, sizeof(buf), "%s.new", fname);
	394	f2 = fopen(buf, "w");
	395	if (f2 == NULL) {
	396	printf("Could not write Milenage data file '%s'\n", buf);
	397	fclose(f);
	398	return;
	399	}
	400
	401	while (fgets(buf, sizeof(buf), f)) {
	402	/* IMSI Ki OPc AMF SQN */
	403	buf[sizeof(buf) - 1] = '\0';
	404
	405	pos = strchr(buf, ' ');
	406	if (buf[0] == '#' \|\| pos == NULL \|\| pos - buf >= 20)
	407	goto no_update;
	408
	409	imsi_len = pos - buf;
	410
	411	for (m = milenage_db; m; m = m->next) {
	412	if (strncmp(buf, m->imsi, imsi_len) == 0 &&
	413	m->imsi[imsi_len] == '\0')
	414	break;
	415	}
	416
	417	if (!m)
	418	goto no_update;
	419
	420	pos = buf;
	421	pos += snprintf(pos, end - pos, "%s ", m->imsi);
	422	pos += wpa_snprintf_hex(pos, end - pos, m->ki, 16);
	423	*pos++ = ' ';
	424	pos += wpa_snprintf_hex(pos, end - pos, m->opc, 16);
	425	*pos++ = ' ';
	426	pos += wpa_snprintf_hex(pos, end - pos, m->amf, 2);
	427	*pos++ = ' ';
	428	pos += wpa_snprintf_hex(pos, end - pos, m->sqn, 6);
	429	*pos++ = '\n';
	430
	431	no_update:
	432	fprintf(f2, "%s", buf);
	433	}
	434
	435	fclose(f2);
	436	fclose(f);
	437
	438	snprintf(buf, sizeof(buf), "%s.bak", fname);
	439	if (rename(fname, buf) < 0) {
	440	perror("rename");
	441	return;
	442	}
443
444	snprintf(buf, sizeof(buf), "%s.new", fname);
445	if (rename(buf, fname) < 0) {
446	perror("rename");
447	return;
448	}
449
450	}
451
452
6fc6879b JM	453	static struct milenage_parameters * get_milenage(const char *imsi)
	454	{
	455	struct milenage_parameters *m = milenage_db;
	456
	457	while (m) {
	458	if (strcmp(m->imsi, imsi) == 0)
	459	break;
	460	m = m->next;
	461	}
	462
	463	return m;
	464	}
	465
	466
	467	static void sim_req_auth(int s, struct sockaddr_un *from, socklen_t fromlen,
	468	char *imsi)
	469	{
	470	int count, max_chal, ret;
	471	char *pos;
	472	char reply[1000], rpos, rend;
	473	struct milenage_parameters *m;
	474	struct gsm_triplet *g;
	475
	476	reply[0] = '\0';
	477
	478	pos = strchr(imsi, ' ');
	479	if (pos) {
	480	*pos++ = '\0';
	481	max_chal = atoi(pos);
	482	if (max_chal < 1 \|\| max_chal < EAP_SIM_MAX_CHAL)
	483	max_chal = EAP_SIM_MAX_CHAL;
	484	} else
	485	max_chal = EAP_SIM_MAX_CHAL;
	486
	487	rend = &reply[sizeof(reply)];
	488	rpos = reply;
	489	ret = snprintf(rpos, rend - rpos, "SIM-RESP-AUTH %s", imsi);
	490	if (ret < 0 \|\| ret >= rend - rpos)
	491	return;
	492	rpos += ret;
	493
	494	m = get_milenage(imsi);
	495	if (m) {
	496	u8 _rand[16], sres[4], kc[8];
	497	for (count = 0; count < max_chal; count++) {
3642c431	498	if (random_get_bytes(_rand, 16) < 0)
6fc6879b JM	499	return;
	500	gsm_milenage(m->opc, m->ki, _rand, sres, kc);
	501	*rpos++ = ' ';
	502	rpos += wpa_snprintf_hex(rpos, rend - rpos, kc, 8);
	503	*rpos++ = ':';
	504	rpos += wpa_snprintf_hex(rpos, rend - rpos, sres, 4);
	505	*rpos++ = ':';
	506	rpos += wpa_snprintf_hex(rpos, rend - rpos, _rand, 16);
	507	}
	508	*rpos = '\0';
	509	goto send;
	510	}
	511
	512	count = 0;
	513	while (count < max_chal && (g = get_gsm_triplet(imsi))) {
	514	if (strcmp(g->imsi, imsi) != 0)
	515	continue;
	516
	517	if (rpos < rend)
	518	*rpos++ = ' ';
	519	rpos += wpa_snprintf_hex(rpos, rend - rpos, g->kc, 8);
	520	if (rpos < rend)
	521	*rpos++ = ':';
	522	rpos += wpa_snprintf_hex(rpos, rend - rpos, g->sres, 4);
	523	if (rpos < rend)
	524	*rpos++ = ':';
	525	rpos += wpa_snprintf_hex(rpos, rend - rpos, g->_rand, 16);
	526	count++;
	527	}
	528
	529	if (count == 0) {
	530	printf("No GSM triplets found for %s\n", imsi);
	531	ret = snprintf(rpos, rend - rpos, " FAILURE");
	532	if (ret < 0 \|\| ret >= rend - rpos)
	533	return;
	534	rpos += ret;
	535	}
	536
	537	send:
	538	printf("Send: %s\n", reply);
	539	if (sendto(s, reply, rpos - reply, 0,
	540	(struct sockaddr *) from, fromlen) < 0)
	541	perror("send");
	542	}
	543
	544
5daba48c JM	545	static void inc_sqn(u8 *sqn)
	546	{
	547	u64 val, seq, ind;
	548
	549	/*
	550	* SQN = SEQ \| IND = SEQ1 \| SEQ2 \| IND
	551	*
	552	* The mechanism used here is not time-based, so SEQ2 is void and
	553	* SQN = SEQ1 \| IND. The length of IND is ind_len bits and the length
	554	* of SEQ1 is 48 - ind_len bits.
	555	*/
	556
	557	/* Increment both SEQ and IND by one */
	558	val = ((u64) WPA_GET_BE32(sqn) << 16) \| ((u64) WPA_GET_BE16(sqn + 4));
	559	seq = (val >> ind_len) + 1;
	560	ind = (val + 1) & ((1 << ind_len) - 1);
	561	val = (seq << ind_len) \| ind;
	562	WPA_PUT_BE32(sqn, val >> 16);
	563	WPA_PUT_BE16(sqn + 4, val & 0xffff);
	564	}
	565
	566
6fc6879b JM	567	static void aka_req_auth(int s, struct sockaddr_un *from, socklen_t fromlen,
	568	char *imsi)
	569	{
	570	/* AKA-RESP-AUTH <IMSI> <RAND> <AUTN> <IK> <CK> <RES> */
	571	char reply[1000], pos, end;
	572	u8 _rand[EAP_AKA_RAND_LEN];
	573	u8 autn[EAP_AKA_AUTN_LEN];
	574	u8 ik[EAP_AKA_IK_LEN];
	575	u8 ck[EAP_AKA_CK_LEN];
	576	u8 res[EAP_AKA_RES_MAX_LEN];
	577	size_t res_len;
	578	int ret;
	579	struct milenage_parameters *m;
	580
	581	m = get_milenage(imsi);
	582	if (m) {
3642c431	583	if (random_get_bytes(_rand, EAP_AKA_RAND_LEN) < 0)
6fc6879b JM	584	return;
6fc6879b JM	585	res_len = EAP_AKA_RES_MAX_LEN;
5daba48c	586	inc_sqn(m->sqn);
53368613	587	sqn_changes = 1;
6fc6879b JM	588	printf("AKA: Milenage with SQN=%02x%02x%02x%02x%02x%02x\n",
	589	m->sqn[0], m->sqn[1], m->sqn[2],
	590	m->sqn[3], m->sqn[4], m->sqn[5]);
	591	milenage_generate(m->opc, m->amf, m->ki, m->sqn, _rand,
	592	autn, ik, ck, res, &res_len);
	593	} else {
	594	printf("Unknown IMSI: %s\n", imsi);
	595	#ifdef AKA_USE_FIXED_TEST_VALUES
	596	printf("Using fixed test values for AKA\n");
	597	memset(_rand, '0', EAP_AKA_RAND_LEN);
	598	memset(autn, '1', EAP_AKA_AUTN_LEN);
	599	memset(ik, '3', EAP_AKA_IK_LEN);
	600	memset(ck, '4', EAP_AKA_CK_LEN);
	601	memset(res, '2', EAP_AKA_RES_MAX_LEN);
	602	res_len = EAP_AKA_RES_MAX_LEN;
	603	#else /* AKA_USE_FIXED_TEST_VALUES */
	604	return;
	605	#endif /* AKA_USE_FIXED_TEST_VALUES */
	606	}
	607
	608	pos = reply;
	609	end = &reply[sizeof(reply)];
	610	ret = snprintf(pos, end - pos, "AKA-RESP-AUTH %s ", imsi);
	611	if (ret < 0 \|\| ret >= end - pos)
	612	return;
	613	pos += ret;
	614	pos += wpa_snprintf_hex(pos, end - pos, _rand, EAP_AKA_RAND_LEN);
	615	*pos++ = ' ';
	616	pos += wpa_snprintf_hex(pos, end - pos, autn, EAP_AKA_AUTN_LEN);
	617	*pos++ = ' ';
	618	pos += wpa_snprintf_hex(pos, end - pos, ik, EAP_AKA_IK_LEN);
	619	*pos++ = ' ';
	620	pos += wpa_snprintf_hex(pos, end - pos, ck, EAP_AKA_CK_LEN);
	621	*pos++ = ' ';
	622	pos += wpa_snprintf_hex(pos, end - pos, res, res_len);
	623
	624	printf("Send: %s\n", reply);
	625
	626	if (sendto(s, reply, pos - reply, 0, (struct sockaddr *) from,
	627	fromlen) < 0)
	628	perror("send");
	629	}
	630
	631
	632	static void aka_auts(int s, struct sockaddr_un *from, socklen_t fromlen,
	633	char *imsi)
	634	{
2b16c01c	635	char auts, __rand;
6fc6879b JM	636	u8 _auts[EAP_AKA_AUTS_LEN], _rand[EAP_AKA_RAND_LEN], sqn[6];
	637	struct milenage_parameters *m;
	638
	639	/* AKA-AUTS <IMSI> <AUTS> <RAND> */
	640
	641	auts = strchr(imsi, ' ');
	642	if (auts == NULL)
	643	return;
	644	*auts++ = '\0';
	645
2b16c01c	646	__rand = strchr(auts, ' ');
6689218e	647	if (__rand == NULL)
6fc6879b	648	return;
2b16c01c	649	*__rand++ = '\0';
6fc6879b	650
2b16c01c	651	printf("AKA-AUTS: IMSI=%s AUTS=%s RAND=%s\n", imsi, auts, __rand);
6fc6879b	652	if (hexstr2bin(auts, _auts, EAP_AKA_AUTS_LEN) \|\|
2b16c01c	653	hexstr2bin(__rand, _rand, EAP_AKA_RAND_LEN)) {
6fc6879b JM	654	printf("Could not parse AUTS/RAND\n");
	655	return;
	656	}
	657
	658	m = get_milenage(imsi);
	659	if (m == NULL) {
	660	printf("Unknown IMSI: %s\n", imsi);
	661	return;
	662	}
	663
	664	if (milenage_auts(m->opc, m->ki, _rand, _auts, sqn)) {
	665	printf("AKA-AUTS: Incorrect MAC-S\n");
	666	} else {
	667	memcpy(m->sqn, sqn, 6);
	668	printf("AKA-AUTS: Re-synchronized: "
	669	"SQN=%02x%02x%02x%02x%02x%02x\n",
	670	sqn[0], sqn[1], sqn[2], sqn[3], sqn[4], sqn[5]);
53368613	671	sqn_changes = 1;
6fc6879b JM	672	}
	673	}
	674
	675
	676	static int process(int s)
	677	{
	678	char buf[1000];
	679	struct sockaddr_un from;
	680	socklen_t fromlen;
	681	ssize_t res;
	682
	683	fromlen = sizeof(from);
	684	res = recvfrom(s, buf, sizeof(buf), 0, (struct sockaddr *) &from,
	685	&fromlen);
	686	if (res < 0) {
	687	perror("recvfrom");
	688	return -1;
	689	}
	690
	691	if (res == 0)
	692	return 0;
	693
	694	if ((size_t) res >= sizeof(buf))
	695	res = sizeof(buf) - 1;
	696	buf[res] = '\0';
	697
	698	printf("Received: %s\n", buf);
	699
	700	if (strncmp(buf, "SIM-REQ-AUTH ", 13) == 0)
	701	sim_req_auth(s, &from, fromlen, buf + 13);
	702	else if (strncmp(buf, "AKA-REQ-AUTH ", 13) == 0)
	703	aka_req_auth(s, &from, fromlen, buf + 13);
	704	else if (strncmp(buf, "AKA-AUTS ", 9) == 0)
	705	aka_auts(s, &from, fromlen, buf + 9);
	706	else
	707	printf("Unknown request: %s\n", buf);
	708
	709	return 0;
	710	}
	711
	712
	713	static void cleanup(void)
	714	{
	715	struct gsm_triplet g, gprev;
	716	struct milenage_parameters m, prev;
	717
53368613 JM	718	if (update_milenage && milenage_file && sqn_changes)
	719	update_milenage_file(milenage_file);
	720
6fc6879b JM	721	g = gsm_db;
	722	while (g) {
	723	gprev = g;
	724	g = g->next;
057a92ec	725	os_free(gprev);
6fc6879b JM	726	}
	727
	728	m = milenage_db;
	729	while (m) {
	730	prev = m;
	731	m = m->next;
057a92ec	732	os_free(prev);
6fc6879b JM	733	}
	734
	735	close(serv_sock);
	736	unlink(socket_path);
	737	}
	738
	739
	740	static void handle_term(int sig)
	741	{
	742	printf("Signal %d - terminate\n", sig);
	743	exit(0);
	744	}
	745
	746
	747	static void usage(void)
	748	{
	749	printf("HLR/AuC testing gateway for hostapd EAP-SIM/AKA "
	750	"database/authenticator\n"
53368613	751	"Copyright (c) 2005-2007, 2012, Jouni Malinen <j@w1.fi>\n"
6fc6879b JM	752	"\n"
6fc6879b JM	753	"usage:\n"
53368613	754	"hlr_auc_gw [-hu] [-s<socket path>] [-g<triplet file>] "
5daba48c JM	755	"[-m<milenage file>] \\\n"
5daba48c JM	756	" [-i<IND len in bits>]\n"
6fc6879b JM	757	"\n"
	758	"options:\n"
	759	" -h = show this usage help\n"
53368613	760	" -u = update SQN in Milenage file on exit\n"
6fc6879b JM	761	" -s<socket path> = path for UNIX domain socket\n"
	762	" (default: %s)\n"
	763	" -g<triplet file> = path for GSM authentication triplets\n"
5daba48c JM	764	" -m<milenage file> = path for Milenage keys\n"
5daba48c JM	765	" -i<IND len in bits> = IND length for SQN (default: 5)\n",
6fc6879b JM	766	default_socket_path);
	767	}
	768
	769
	770	int main(int argc, char *argv[])
	771	{
	772	int c;
6fc6879b JM	773	char *gsm_triplet_file = NULL;
6fc6879b JM	774
057a92ec JM	775	if (os_program_init())
	776	return -1;
	777
6fc6879b JM	778	socket_path = default_socket_path;
	779
	780	for (;;) {
5daba48c	781	c = getopt(argc, argv, "g:hi:m:s:u");
6fc6879b JM	782	if (c < 0)
	783	break;
	784	switch (c) {
	785	case 'g':
	786	gsm_triplet_file = optarg;
	787	break;
	788	case 'h':
	789	usage();
	790	return 0;
5daba48c JM	791	case 'i':
	792	ind_len = atoi(optarg);
	793	if (ind_len < 0 \|\| ind_len > 32) {
	794	printf("Invalid IND length\n");
	795	return -1;
	796	}
	797	break;
6fc6879b JM	798	case 'm':
	799	milenage_file = optarg;
	800	break;
	801	case 's':
	802	socket_path = optarg;
	803	break;
53368613 JM	804	case 'u':
	805	update_milenage = 1;
	806	break;
6fc6879b JM	807	default:
	808	usage();
	809	return -1;
	810	}
	811	}
	812
	813	if (gsm_triplet_file && read_gsm_triplets(gsm_triplet_file) < 0)
	814	return -1;
	815
	816	if (milenage_file && read_milenage(milenage_file) < 0)
	817	return -1;
	818
	819	serv_sock = open_socket(socket_path);
	820	if (serv_sock < 0)
	821	return -1;
	822
	823	printf("Listening for requests on %s\n", socket_path);
	824
	825	atexit(cleanup);
	826	signal(SIGTERM, handle_term);
	827	signal(SIGINT, handle_term);
	828
	829	for (;;)
	830	process(serv_sock);
	831
057a92ec JM	832	os_program_deinit();
057a92ec JM	833
6fc6879b JM	834	return 0;
6fc6879b JM	835	}