Move around identity tags to accomodate AKA-Prime's requirement of '6' to identify...

This means we can no longer identify 3GPP pseudonyms

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index 12f5c33614e72f2f9a546553dccd867d9b55ff3e..d86e1f5bd1e71dc64f5200cc4406cb8445d8363b 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -385,14 +385,14 @@ ATTRIBUTE SIM-Method-Hint                         1203    integer
 VALUE          SIM-Method-Hint         Unknown                 0
 VALUE          SIM-Method-Hint         SIM                     1
 VALUE          SIM-Method-Hint         AKA                     2
+VALUE          SIM-Method-Hint         AKA-Prime               3
 
 ATTRIBUTE      SIM-Identity-Type                       1204    integer
 
 VALUE          SIM-Identity-Type       Unknown                 0
 VALUE          SIM-Identity-Type       Permanent               1
 VALUE          SIM-Identity-Type       Pseudonym               2
-VALUE          SIM-Identity-Type       3GPP-Pseudonym          3
-VALUE          SIM-Identity-Type       Fastauth                4
+VALUE          SIM-Identity-Type       Fastauth                3
 
 #
 #      Range:  1210-1219

diff --git a/src/modules/rlm_eap/lib/sim/id.c b/src/modules/rlm_eap/lib/sim/id.c
index c9f0cb90be35f9190e4f514e882f2e3d86d35a47..229b89e2ab85380ebd25535c0de08315c87ae8e8 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/id.c
+++ b/src/modules/rlm_eap/lib/sim/id.c
@@ -135,7 +135,6 @@ ssize_t fr_sim_3gpp_root_nai_domain_mcc_mnc(uint16_t *mnc, uint16_t *mcc,
   *                                    this ID or which one to start.
   * @param[out] type   What type of identity this is:
   *    - SIM_ID_TYPE_PERMANENT         if the ID is an IMSI.
-  *    - SIM_ID_TYPE_3GPP_PSEUDONYM    if the ID is a 3GPP pseudonym (not validated).
   *    - SIM_ID_TYPE_PSEUDONYM         if the ID is a freeform pseudonym.
   *    - SIM_ID_TYPE_FASTAUTH          if the ID is a fastauth identity.
   *    - SIM_ID_TYPE_UNKNOWN           if we can't determine what sort of ID this is.
@@ -163,71 +162,64 @@ int fr_sim_id_type(fr_sim_id_type_t *type, fr_sim_method_hint_t *hint,
 
                if (i == id_len) {
                        switch (id[0]) {
-                       case SIM_ID_TAG_PERMANENT_AKA:
-                               *hint = SIM_METHOD_HINT_AKA;
-                               *type = SIM_ID_TYPE_PERMANENT;  /* All digits */
-                               return 0;
+
 
                        case SIM_ID_TAG_PERMANENT_SIM:
                                *hint = SIM_METHOD_HINT_SIM;
                                *type = SIM_ID_TYPE_PERMANENT;  /* All digits */
                                return 0;
 
-                       default:
-                               break;
-                       }
-
-               }
-       }
-
-       /*
-        *      3GPP Pseudonym
-        */
-       if (id_len == SIM_3GPP_PSEUDONYM_LEN) {
-               for (i = 1; i < id_len; i++) if (!fr_is_base64(id[i])) break;
-
-               if (i == id_len) {
-                       switch (id[0]) {
-                       case SIM_ID_TAG_3GPP_PSEUDONYM_AKA:
+                       case SIM_ID_TAG_PERMANENT_AKA:
                                *hint = SIM_METHOD_HINT_AKA;
-                               *type = SIM_ID_TYPE_3GPP_PSEUDONYM;
+                               *type = SIM_ID_TYPE_PERMANENT;  /* All digits */
                                return 0;
 
-                       case SIM_ID_TAG_3GPP_PSEUDONYM_SIM:
-                               *hint = SIM_METHOD_HINT_SIM;
-                               *type = SIM_ID_TYPE_3GPP_PSEUDONYM;
+                       case SIM_ID_TAG_PERMANENT_AKA_PRIME:
+                               *hint = SIM_METHOD_HINT_AKA_PRIME;
+                               *type = SIM_ID_TYPE_PERMANENT;  /* All Digits */
                                return 0;
 
                        default:
                                break;
                        }
+
                }
        }
 
        /*
-        *      User assigned pseudonym
+        *      Pseudonym
         */
        switch (id[0]) {
+       case SIM_ID_TAG_PSEUDONYM_SIM:
+               *hint = SIM_METHOD_HINT_SIM;
+               *type = SIM_ID_TYPE_PSEUDONYM;
+               return 0;
+
        case SIM_ID_TAG_PSEUDONYM_AKA:
                *hint = SIM_METHOD_HINT_AKA;
                *type = SIM_ID_TYPE_PSEUDONYM;
                return 0;
 
-       case SIM_ID_TAG_PSEUDONYM_SIM:
-               *hint = SIM_METHOD_HINT_SIM;
+       case SIM_ID_TAG_PSEUDONYM_AKA_PRIME:
+               *hint = SIM_METHOD_HINT_AKA_PRIME;
                *type = SIM_ID_TYPE_PSEUDONYM;
                return 0;
 
        /*
         *      Fast reauth identity
         */
+       case SIM_ID_TAG_FASTAUTH_SIM:
+               *hint = SIM_METHOD_HINT_SIM;
+               *type = SIM_ID_TYPE_FASTAUTH;
+               return 0;
+
        case SIM_ID_TAG_FASTAUTH_AKA:
                *hint = SIM_METHOD_HINT_AKA;
                *type = SIM_ID_TYPE_FASTAUTH;
                return 0;
 
-       case SIM_ID_TAG_FASTAUTH_SIM:
-               *hint = SIM_METHOD_HINT_SIM;
+       case SIM_ID_TAG_FASTAUTH_AKA_PRIME:
+               *hint = SIM_METHOD_HINT_AKA_PRIME;
                *type = SIM_ID_TYPE_FASTAUTH;
                return 0;
 

diff --git a/src/modules/rlm_eap/lib/sim/id.h b/src/modules/rlm_eap/lib/sim/id.h
index 2e5c64f6ddb7069fe737020b88bea387884391c5..5a3357c565bc9d8cf2a7490f2e4e3f2a3037163e 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/id.h
+++ b/src/modules/rlm_eap/lib/sim/id.h
@@ -36,8 +36,9 @@ typedef enum {
        SIM_METHOD_HINT_UNKNOWN                 = 0,    //!< We don't know what method the identity hints at.
        SIM_METHOD_HINT_SIM                     = 1,    //!< The identity hints the supplicant wants to use
                                                        ///< EAP-SIM.
-       SIM_METHOD_HINT_AKA                     = 2     //!< The identity hints the supplicant wants to use
+       SIM_METHOD_HINT_AKA                     = 2,    //!< The identity hints the supplicant wants to use
                                                        ///< EAP-AKA.
+       SIM_METHOD_HINT_AKA_PRIME               = 3
 } fr_sim_method_hint_t;
 
 /** SIM/AKA identity type hints
@@ -48,21 +49,27 @@ typedef enum {
        SIM_ID_TYPE_UNKNOWN                     = 0,    //!< We don't know what type of identity this is.
        SIM_ID_TYPE_PERMANENT                   = 1,    //!< This is a permanent identity (the IMSI of the SIM).
        SIM_ID_TYPE_PSEUDONYM                   = 2,    //!< This is a custom pseudonym.
-       SIM_ID_TYPE_3GPP_PSEUDONYM              = 3,    //!< This is a reversibly encrypted 3gpp pseudonym.
-       SIM_ID_TYPE_FASTAUTH                    = 4     //!< This is a fastauth (session-resumption) id.
+       SIM_ID_TYPE_FASTAUTH                    = 5     //!< This is a fastauth (session-resumption) id.
 } fr_sim_id_type_t;
 
 typedef enum {
-       SIM_ID_TAG_PERMANENT_AKA                = '0',
-       SIM_ID_TAG_PERMANENT_SIM                = '1',
-       SIM_ID_TAG_PSEUDONYM_AKA                = '2',
-       SIM_ID_TAG_PSEUDONYM_SIM                = '3',
-       SIM_ID_TAG_3GPP_PSEUDONYM_AKA           = '6',
-       SIM_ID_TAG_3GPP_PSEUDONYM_SIM           = '7',
-       SIM_ID_TAG_FASTAUTH_AKA                 = '4',
-       SIM_ID_TAG_FASTAUTH_SIM                 = '5'
+       SIM_ID_TAG_PERMANENT_SIM                = '1',  //!< IMSI, and hint that client wants to do EAP-SIM
+       SIM_ID_TAG_PSEUDONYM_SIM                = '4',  //!< Pseudonym, continue EAP-SIM
+       SIM_ID_TAG_FASTAUTH_SIM                 = '5',  //!< Fastauth, continue EAP-SIM
+
+       SIM_ID_TAG_PERMANENT_AKA                = '0',  //!< IMSI, and hint that client wants to do EAP-AKA
+       SIM_ID_TAG_PSEUDONYM_AKA                = '2',  //!< Pseudonym, continue EAP-AKA
+       SIM_ID_TAG_FASTAUTH_AKA                 = '3',  //!< Fastauth, continue EAP-AKA
+
+       SIM_ID_TAG_PERMANENT_AKA_PRIME          = '6',  //!< IMSI, and hint that client wants to do EAP-AKA-Prime.
+       SIM_ID_TAG_PSEUDONYM_AKA_PRIME          = '7',  //!< Pseudonym, continue EAP-AKA-Prime
+       SIM_ID_TAG_FASTAUTH_AKA_PRIME           = '8'   //!< Fastuath, continue EAP-AKA-Prime
 } fr_sim_id_tag_t;
 
+#define SIM_ID_TAG_PSEUDONYM_SIM_B64           56
+#define SIM_ID_TAG_PSEUDONYM_AKA_B64           54
+#define SIM_ID_TAG_PSEUDONYM_AKA_PRIME_B64     59
+
 size_t         fr_sim_id_user_len(char const *nai, size_t nai_len);
 
 char const     *fr_sim_domain(char const *nai, size_t nai_len);

diff --git a/src/modules/rlm_eap/lib/sim/xlat.c b/src/modules/rlm_eap/lib/sim/xlat.c
index a05f211edd82b2feae90874398717c01de1da5f0..6d58420f123b7b109d77b12c339475d053f499af 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/xlat.c
+++ b/src/modules/rlm_eap/lib/sim/xlat.c
@@ -270,14 +270,18 @@ static ssize_t sim_xlat_3gpp_pseudonym_decrypt_nai(TALLOC_CTX *ctx, char **out,
 
        tag = fr_sim_id_3gpp_pseudonym_tag(id);
        switch (tag) {
-       case 59:                /* 7 in the base64 alphabet (SIM) */
+       case SIM_ID_TAG_PSEUDONYM_SIM_B64:
                out_tag = SIM_ID_TAG_PERMANENT_SIM;
                break;
 
-       case 58:                /* 6 in the base64 alphabet (AKA) */
+       case SIM_ID_TAG_PSEUDONYM_AKA_B64:
                out_tag = SIM_ID_TAG_PERMANENT_AKA;
                break;
 
+       case SIM_ID_TAG_PSEUDONYM_AKA_PRIME_B64:
+               out_tag = SIM_ID_TAG_PERMANENT_AKA_PRIME;
+               break;
+
        default:
                REDEBUG2("Unexpected tag value (%u) in SIM ID \"%pS\"", tag, id);
                return -1;
@@ -405,11 +409,15 @@ static ssize_t sim_xlat_3gpp_pseudonym_encrypt_nai(TALLOC_CTX *ctx, char **out,
 
        switch (method_hint) {
        case SIM_METHOD_HINT_SIM:
-               tag = 59;       /* 7 in the base64 alphabet */
+               tag = SIM_ID_TAG_PSEUDONYM_SIM_B64;
                break;
 
        case SIM_METHOD_HINT_AKA:
-               tag = 58;       /* 6 in the base64 alphabet */
+               tag = SIM_ID_TAG_PSEUDONYM_AKA_B64;
+               break;
+
+       case SIM_METHOD_HINT_AKA_PRIME:
+               tag = SIM_ID_TAG_PSEUDONYM_AKA_PRIME_B64;
                break;
 
        case SIM_METHOD_HINT_UNKNOWN:

diff --git a/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c b/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c
index 666ea588f5ea1786b1c3f4d1dde5d731e77f54a5..f80c466e34bb8244493576b5f83c9255b25b0304 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c
+++ b/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c
@@ -509,7 +509,6 @@ static rlm_rcode_t mod_session_init(UNUSED void *instance, eap_session_t *eap_se
         *      These types need to be transformed into something
         *      usable before we can do anything.
         */
-       case SIM_ID_TYPE_3GPP_PSEUDONYM:
        case SIM_ID_TYPE_PSEUDONYM:
        case SIM_ID_TYPE_FASTAUTH:
        case SIM_ID_TYPE_UNKNOWN:

diff --git a/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang b/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang
index 8e33beb1dd470adbccdbee5e0d120da3c55e67a6..3c12a8333d619ebff7c42dc869b29a1b941007ed 100644 (file)
--- a/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang
+++ b/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang
@@ -32,7 +32,7 @@ if ("%{sim_id_method:&control:User-Name}" != 'AKA') {
 #
 #  Can we identify the encrypted blob correctly?
 #
-if ("%{sim_id_type:&control:User-Name}" != '3GPP-Pseudonym') {
+if ("%{sim_id_type:&control:User-Name}" != 'Pseudonym') {
        test_fail
 } else {
        test_pass

diff --git a/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang b/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang
index 1c7d7c54184033fe69aaaa5ce16c3292bae2cfde..52fe29ed7db33f1471cee1b7c93fd2d1387fb0af 100644 (file)
--- a/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang
+++ b/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang
@@ -32,7 +32,7 @@ if ("%{sim_id_method:&control:User-Name}" != 'SIM') {
 #
 #  Can we identify the encrypted blob correctly?
 #
-if ("%{sim_id_type:&control:User-Name}" != '3GPP-Pseudonym') {
+if ("%{sim_id_type:&control:User-Name}" != 'Pseudonym') {
        test_fail
 } else {
        test_pass