From: Arran Cudbard-Bell Date: Mon, 4 Dec 2017 11:29:47 +0000 (+0000) Subject: Move around identity tags to accomodate AKA-Prime's requirement of '6' to identify... X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4396bfdeb15b070c3c1b57e4440f218f0657a480;p=thirdparty%2Ffreeradius-server.git Move around identity tags to accomodate AKA-Prime's requirement of '6' to identify the permanent ID This means we can no longer identify 3GPP pseudonyms --- diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal index 12f5c33614e..d86e1f5bd1e 100644 --- a/share/dictionary.freeradius.internal +++ b/share/dictionary.freeradius.internal @@ -385,14 +385,14 @@ ATTRIBUTE SIM-Method-Hint 1203 integer VALUE SIM-Method-Hint Unknown 0 VALUE SIM-Method-Hint SIM 1 VALUE SIM-Method-Hint AKA 2 +VALUE SIM-Method-Hint AKA-Prime 3 ATTRIBUTE SIM-Identity-Type 1204 integer VALUE SIM-Identity-Type Unknown 0 VALUE SIM-Identity-Type Permanent 1 VALUE SIM-Identity-Type Pseudonym 2 -VALUE SIM-Identity-Type 3GPP-Pseudonym 3 -VALUE SIM-Identity-Type Fastauth 4 +VALUE SIM-Identity-Type Fastauth 3 # # Range: 1210-1219 diff --git a/src/modules/rlm_eap/lib/sim/id.c b/src/modules/rlm_eap/lib/sim/id.c index c9f0cb90be3..229b89e2ab8 100644 --- a/src/modules/rlm_eap/lib/sim/id.c +++ b/src/modules/rlm_eap/lib/sim/id.c @@ -135,7 +135,6 @@ ssize_t fr_sim_3gpp_root_nai_domain_mcc_mnc(uint16_t *mnc, uint16_t *mcc, * this ID or which one to start. * @param[out] type What type of identity this is: * - SIM_ID_TYPE_PERMANENT if the ID is an IMSI. - * - SIM_ID_TYPE_3GPP_PSEUDONYM if the ID is a 3GPP pseudonym (not validated). * - SIM_ID_TYPE_PSEUDONYM if the ID is a freeform pseudonym. * - SIM_ID_TYPE_FASTAUTH if the ID is a fastauth identity. * - SIM_ID_TYPE_UNKNOWN if we can't determine what sort of ID this is. @@ -163,71 +162,64 @@ int fr_sim_id_type(fr_sim_id_type_t *type, fr_sim_method_hint_t *hint, if (i == id_len) { switch (id[0]) { - case SIM_ID_TAG_PERMANENT_AKA: - *hint = SIM_METHOD_HINT_AKA; - *type = SIM_ID_TYPE_PERMANENT; /* All digits */ - return 0; + case SIM_ID_TAG_PERMANENT_SIM: *hint = SIM_METHOD_HINT_SIM; *type = SIM_ID_TYPE_PERMANENT; /* All digits */ return 0; - default: - break; - } - - } - } - - /* - * 3GPP Pseudonym - */ - if (id_len == SIM_3GPP_PSEUDONYM_LEN) { - for (i = 1; i < id_len; i++) if (!fr_is_base64(id[i])) break; - - if (i == id_len) { - switch (id[0]) { - case SIM_ID_TAG_3GPP_PSEUDONYM_AKA: + case SIM_ID_TAG_PERMANENT_AKA: *hint = SIM_METHOD_HINT_AKA; - *type = SIM_ID_TYPE_3GPP_PSEUDONYM; + *type = SIM_ID_TYPE_PERMANENT; /* All digits */ return 0; - case SIM_ID_TAG_3GPP_PSEUDONYM_SIM: - *hint = SIM_METHOD_HINT_SIM; - *type = SIM_ID_TYPE_3GPP_PSEUDONYM; + case SIM_ID_TAG_PERMANENT_AKA_PRIME: + *hint = SIM_METHOD_HINT_AKA_PRIME; + *type = SIM_ID_TYPE_PERMANENT; /* All Digits */ return 0; default: break; } + } } /* - * User assigned pseudonym + * Pseudonym */ switch (id[0]) { + case SIM_ID_TAG_PSEUDONYM_SIM: + *hint = SIM_METHOD_HINT_SIM; + *type = SIM_ID_TYPE_PSEUDONYM; + return 0; + case SIM_ID_TAG_PSEUDONYM_AKA: *hint = SIM_METHOD_HINT_AKA; *type = SIM_ID_TYPE_PSEUDONYM; return 0; - case SIM_ID_TAG_PSEUDONYM_SIM: - *hint = SIM_METHOD_HINT_SIM; + case SIM_ID_TAG_PSEUDONYM_AKA_PRIME: + *hint = SIM_METHOD_HINT_AKA_PRIME; *type = SIM_ID_TYPE_PSEUDONYM; return 0; /* * Fast reauth identity */ + case SIM_ID_TAG_FASTAUTH_SIM: + *hint = SIM_METHOD_HINT_SIM; + *type = SIM_ID_TYPE_FASTAUTH; + return 0; + case SIM_ID_TAG_FASTAUTH_AKA: *hint = SIM_METHOD_HINT_AKA; *type = SIM_ID_TYPE_FASTAUTH; return 0; - case SIM_ID_TAG_FASTAUTH_SIM: - *hint = SIM_METHOD_HINT_SIM; + case SIM_ID_TAG_FASTAUTH_AKA_PRIME: + *hint = SIM_METHOD_HINT_AKA_PRIME; *type = SIM_ID_TYPE_FASTAUTH; return 0; diff --git a/src/modules/rlm_eap/lib/sim/id.h b/src/modules/rlm_eap/lib/sim/id.h index 2e5c64f6ddb..5a3357c565b 100644 --- a/src/modules/rlm_eap/lib/sim/id.h +++ b/src/modules/rlm_eap/lib/sim/id.h @@ -36,8 +36,9 @@ typedef enum { SIM_METHOD_HINT_UNKNOWN = 0, //!< We don't know what method the identity hints at. SIM_METHOD_HINT_SIM = 1, //!< The identity hints the supplicant wants to use ///< EAP-SIM. - SIM_METHOD_HINT_AKA = 2 //!< The identity hints the supplicant wants to use + SIM_METHOD_HINT_AKA = 2, //!< The identity hints the supplicant wants to use ///< EAP-AKA. + SIM_METHOD_HINT_AKA_PRIME = 3 } fr_sim_method_hint_t; /** SIM/AKA identity type hints @@ -48,21 +49,27 @@ typedef enum { SIM_ID_TYPE_UNKNOWN = 0, //!< We don't know what type of identity this is. SIM_ID_TYPE_PERMANENT = 1, //!< This is a permanent identity (the IMSI of the SIM). SIM_ID_TYPE_PSEUDONYM = 2, //!< This is a custom pseudonym. - SIM_ID_TYPE_3GPP_PSEUDONYM = 3, //!< This is a reversibly encrypted 3gpp pseudonym. - SIM_ID_TYPE_FASTAUTH = 4 //!< This is a fastauth (session-resumption) id. + SIM_ID_TYPE_FASTAUTH = 5 //!< This is a fastauth (session-resumption) id. } fr_sim_id_type_t; typedef enum { - SIM_ID_TAG_PERMANENT_AKA = '0', - SIM_ID_TAG_PERMANENT_SIM = '1', - SIM_ID_TAG_PSEUDONYM_AKA = '2', - SIM_ID_TAG_PSEUDONYM_SIM = '3', - SIM_ID_TAG_3GPP_PSEUDONYM_AKA = '6', - SIM_ID_TAG_3GPP_PSEUDONYM_SIM = '7', - SIM_ID_TAG_FASTAUTH_AKA = '4', - SIM_ID_TAG_FASTAUTH_SIM = '5' + SIM_ID_TAG_PERMANENT_SIM = '1', //!< IMSI, and hint that client wants to do EAP-SIM + SIM_ID_TAG_PSEUDONYM_SIM = '4', //!< Pseudonym, continue EAP-SIM + SIM_ID_TAG_FASTAUTH_SIM = '5', //!< Fastauth, continue EAP-SIM + + SIM_ID_TAG_PERMANENT_AKA = '0', //!< IMSI, and hint that client wants to do EAP-AKA + SIM_ID_TAG_PSEUDONYM_AKA = '2', //!< Pseudonym, continue EAP-AKA + SIM_ID_TAG_FASTAUTH_AKA = '3', //!< Fastauth, continue EAP-AKA + + SIM_ID_TAG_PERMANENT_AKA_PRIME = '6', //!< IMSI, and hint that client wants to do EAP-AKA-Prime. + SIM_ID_TAG_PSEUDONYM_AKA_PRIME = '7', //!< Pseudonym, continue EAP-AKA-Prime + SIM_ID_TAG_FASTAUTH_AKA_PRIME = '8' //!< Fastuath, continue EAP-AKA-Prime } fr_sim_id_tag_t; +#define SIM_ID_TAG_PSEUDONYM_SIM_B64 56 +#define SIM_ID_TAG_PSEUDONYM_AKA_B64 54 +#define SIM_ID_TAG_PSEUDONYM_AKA_PRIME_B64 59 + size_t fr_sim_id_user_len(char const *nai, size_t nai_len); char const *fr_sim_domain(char const *nai, size_t nai_len); diff --git a/src/modules/rlm_eap/lib/sim/xlat.c b/src/modules/rlm_eap/lib/sim/xlat.c index a05f211edd8..6d58420f123 100644 --- a/src/modules/rlm_eap/lib/sim/xlat.c +++ b/src/modules/rlm_eap/lib/sim/xlat.c @@ -270,14 +270,18 @@ static ssize_t sim_xlat_3gpp_pseudonym_decrypt_nai(TALLOC_CTX *ctx, char **out, tag = fr_sim_id_3gpp_pseudonym_tag(id); switch (tag) { - case 59: /* 7 in the base64 alphabet (SIM) */ + case SIM_ID_TAG_PSEUDONYM_SIM_B64: out_tag = SIM_ID_TAG_PERMANENT_SIM; break; - case 58: /* 6 in the base64 alphabet (AKA) */ + case SIM_ID_TAG_PSEUDONYM_AKA_B64: out_tag = SIM_ID_TAG_PERMANENT_AKA; break; + case SIM_ID_TAG_PSEUDONYM_AKA_PRIME_B64: + out_tag = SIM_ID_TAG_PERMANENT_AKA_PRIME; + break; + default: REDEBUG2("Unexpected tag value (%u) in SIM ID \"%pS\"", tag, id); return -1; @@ -405,11 +409,15 @@ static ssize_t sim_xlat_3gpp_pseudonym_encrypt_nai(TALLOC_CTX *ctx, char **out, switch (method_hint) { case SIM_METHOD_HINT_SIM: - tag = 59; /* 7 in the base64 alphabet */ + tag = SIM_ID_TAG_PSEUDONYM_SIM_B64; break; case SIM_METHOD_HINT_AKA: - tag = 58; /* 6 in the base64 alphabet */ + tag = SIM_ID_TAG_PSEUDONYM_AKA_B64; + break; + + case SIM_METHOD_HINT_AKA_PRIME: + tag = SIM_ID_TAG_PSEUDONYM_AKA_PRIME_B64; break; case SIM_METHOD_HINT_UNKNOWN: diff --git a/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c b/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c index 666ea588f5e..f80c466e34b 100644 --- a/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c +++ b/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c @@ -509,7 +509,6 @@ static rlm_rcode_t mod_session_init(UNUSED void *instance, eap_session_t *eap_se * These types need to be transformed into something * usable before we can do anything. */ - case SIM_ID_TYPE_3GPP_PSEUDONYM: case SIM_ID_TYPE_PSEUDONYM: case SIM_ID_TYPE_FASTAUTH: case SIM_ID_TYPE_UNKNOWN: diff --git a/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang b/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang index 8e33beb1dd4..3c12a8333d6 100644 --- a/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang +++ b/src/tests/modules/eap_sim/sim_xlat_id_aka.unlang @@ -32,7 +32,7 @@ if ("%{sim_id_method:&control:User-Name}" != 'AKA') { # # Can we identify the encrypted blob correctly? # -if ("%{sim_id_type:&control:User-Name}" != '3GPP-Pseudonym') { +if ("%{sim_id_type:&control:User-Name}" != 'Pseudonym') { test_fail } else { test_pass diff --git a/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang b/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang index 1c7d7c54184..52fe29ed7db 100644 --- a/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang +++ b/src/tests/modules/eap_sim/sim_xlat_id_sim.unlang @@ -32,7 +32,7 @@ if ("%{sim_id_method:&control:User-Name}" != 'SIM') { # # Can we identify the encrypted blob correctly? # -if ("%{sim_id_type:&control:User-Name}" != '3GPP-Pseudonym') { +if ("%{sim_id_type:&control:User-Name}" != 'Pseudonym') { test_fail } else { test_pass