18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * EAP-IKEv2 peer (RFC 5106) 38d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_i.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_common/eap_ikev2_common.h" 148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "ikev2.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct eap_ikev2_data { 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct ikev2_responder_data ikev2; 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt enum { WAIT_START, PROC_MSG, WAIT_FRAG_ACK, DONE, FAIL } state; 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *in_buf; 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *out_buf; 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t out_used; 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t fragment_size; 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int keys_ready; 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 keymat[EAP_MSK_LEN + EAP_EMSK_LEN]; 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int keymat_ok; 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}; 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic const char * eap_ikev2_state_txt(int state) 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (state) { 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case WAIT_START: 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "WAIT_START"; 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case PROC_MSG: 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "PROC_MSG"; 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case WAIT_FRAG_ACK: 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "WAIT_FRAG_ACK"; 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case DONE: 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "DONE"; 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FAIL: 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "FAIL"; 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "?"; 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_state(struct eap_ikev2_data *data, int state) 508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: %s -> %s", 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state_txt(data->state), 538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state_txt(state)); 548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = state; 558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void * eap_ikev2_init(struct eap_sm *sm) 598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data; 618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *identity, *password; 628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t identity_len, password_len; 638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt identity = eap_get_config_identity(sm, &identity_len); 658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (identity == NULL) { 668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-IKEV2: No identity available"); 678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data = os_zalloc(sizeof(*data)); 718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data == NULL) 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = WAIT_START; 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->fragment_size = IKEV2_FRAGMENT_SIZE; 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.state = SA_INIT; 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.peer_auth = PEER_AUTH_SECRET; 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.key_pad = (u8 *) os_strdup("Key Pad for EAP-IKEv2"); 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->ikev2.key_pad == NULL) 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto failed; 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.key_pad_len = 21; 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.IDr = os_malloc(identity_len); 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->ikev2.IDr == NULL) 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto failed; 848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(data->ikev2.IDr, identity, identity_len); 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.IDr_len = identity_len; 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt password = eap_get_config_password(sm, &password_len); 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (password) { 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.shared_secret = os_malloc(password_len); 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->ikev2.shared_secret == NULL) 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto failed; 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(data->ikev2.shared_secret, password, password_len); 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.shared_secret_len = password_len; 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data; 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtfailed: 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_responder_deinit(&data->ikev2); 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_deinit(struct eap_sm *sm, void *priv) 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->in_buf); 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->out_buf); 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_responder_deinit(&data->ikev2); 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_peer_keymat(struct eap_ikev2_data *data) 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_derive_keymat( 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.prf, &data->ikev2.keys, 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.i_nonce, data->ikev2.i_nonce_len, 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.r_nonce, data->ikev2.r_nonce_len, 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat) < 0) { 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Failed to " 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "derive key material"); 1248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 1258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat_ok = 1; 1278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 1288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_build_msg(struct eap_ikev2_data *data, 1328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method_ret *ret, u8 id) 1338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *resp; 1358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags; 1368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t send_len, plen, icv_len = 0; 1378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = FALSE; 1398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Generating Response"); 1408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->allowNotifications = TRUE; 1418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = 0; 1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len = wpabuf_len(data->out_buf) - data->out_used; 1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (1 + send_len > data->fragment_size) { 1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len = data->fragment_size - 1; 1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_MORE_FRAGMENTS; 1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_used == 0) { 1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_LENGTH_INCLUDED; 1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len -= 4; 1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CCNS_PL 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Some issues figuring out the length of the message if Message Length 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * field not included?! */ 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (!(flags & IKEV2_FLAGS_LENGTH_INCLUDED)) 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_LENGTH_INCLUDED; 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CCNS_PL */ 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen = 1 + send_len; 1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) 1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen += 4; 1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->keys_ready) { 1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct ikev2_integ_alg *integ; 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Add Integrity Checksum " 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Data"); 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_ICV_INCLUDED; 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt integ = ikev2_get_integ(data->ikev2.proposal.integ); 1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (integ == NULL) { 1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unknown INTEG " 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "transform / cannot generate ICV"); 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt icv_len = integ->hash_len; 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen += icv_len; 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, plen, 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_CODE_RESPONSE, id); 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (resp == NULL) 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(resp, flags); /* Flags */ 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_be32(resp, wpabuf_len(data->out_buf)); 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(resp, wpabuf_head_u8(data->out_buf) + data->out_used, 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len); 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used += send_len; 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_ICV_INCLUDED) { 1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *msg = wpabuf_head(resp); 1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len = wpabuf_len(resp); 1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_integ_hash(data->ikev2.proposal.integ, 1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.keys.SK_ar, 1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.keys.SK_integ_len, 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg, len, wpabuf_put(resp, icv_len)); 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->methodState = METHOD_MAY_CONT; 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->decision = DECISION_FAIL; 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_used == wpabuf_len(data->out_buf)) { 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Sending out %lu bytes " 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(message sent completely)", 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) send_len); 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->out_buf); 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_buf = NULL; 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used = 0; 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->ikev2.state) { 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case SA_AUTH: 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* SA_INIT was sent out, so message have to be 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * integrity protected from now on. */ 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keys_ready = 1; 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case IKEV2_DONE: 2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->methodState = METHOD_DONE; 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == FAIL) 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->decision = DECISION_COND_SUCC; 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Authentication " 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "completed successfully"); 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_peer_keymat(data)) 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, DONE); 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case IKEV2_FAILED: 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Authentication " 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "failed"); 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->methodState = METHOD_DONE; 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->decision = DECISION_FAIL; 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Sending out %lu bytes " 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(%lu more to send)", (unsigned long) send_len, 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_len(data->out_buf) - 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used); 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, WAIT_FRAG_ACK); 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return resp; 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_icv(struct eap_ikev2_data *data, 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct wpabuf *reqData, 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags, const u8 *pos, const u8 **end) 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_ICV_INCLUDED) { 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int icv_len = eap_ikev2_validate_icv( 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.integ, &data->ikev2.keys, 1, 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt reqData, pos, *end); 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (icv_len < 0) 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Hide Integrity Checksum Data from further processing */ 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *end -= icv_len; 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else if (data->keys_ready) { 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have " 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "included integrity checksum"); 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_cont(struct eap_ikev2_data *data, 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *buf, size_t len) 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Process continuation of a pending message */ 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len > wpabuf_tailroom(data->in_buf)) { 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Fragment overflow"); 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(data->in_buf, buf, len); 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received %lu bytes, waiting " 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "for %lu bytes more", (unsigned long) len, 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_tailroom(data->in_buf)); 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_process_fragment(struct eap_ikev2_data *data, 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method_ret *ret, 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 id, u8 flags, 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u32 message_length, 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *buf, size_t len) 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Process a fragment that is not the last one of the message */ 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL && !(flags & IKEV2_FLAGS_LENGTH_INCLUDED)) { 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No Message Length field in " 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "a fragmented packet"); 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* First fragment of the message */ 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = wpabuf_alloc(message_length); 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No memory for " 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "message"); 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(data->in_buf, buf, len); 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received %lu bytes in first " 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "fragment, waiting for %lu bytes more", 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) len, 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_tailroom(data->in_buf)); 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_frag_ack(id, EAP_CODE_RESPONSE); 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_process(struct eap_sm *sm, void *priv, 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method_ret *ret, 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct wpabuf *reqData) 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *start, *pos, *end; 3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 3298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags, id; 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u32 message_length = 0; 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf tmpbuf; 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, reqData, &len); 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) { 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt id = eap_get_id(reqData); 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt start = pos; 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = start + len; 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len == 0) 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = 0; /* fragment ack */ 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = *pos++; 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_process_icv(data, reqData, flags, pos, &end) < 0) { 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) { 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (end - pos < 4) { 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Message underflow"); 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length = WPA_GET_BE32(pos); 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 4; 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (message_length < (u32) (end - pos)) { 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Invalid Message " 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Length (%d; %ld remaining in this msg)", 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length, (long) (end - pos)); 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received packet: Flags 0x%x " 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Message Length %u", flags, message_length); 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == WAIT_FRAG_ACK) { 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CCNS_PL 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len > 1) /* Empty Flags field included in ACK */ 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#else /* CCNS_PL */ 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len != 0) 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CCNS_PL */ 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt { 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unexpected payload " 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "in WAIT_FRAG_ACK state"); 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Fragment acknowledged"); 3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, PROC_MSG); 3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_msg(data, ret, id); 3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf && eap_ikev2_process_cont(data, pos, end - pos) < 0) { 3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret->ignore = TRUE; 3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_MORE_FRAGMENTS) { 3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_process_fragment(data, ret, id, flags, 3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length, pos, 4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end - pos); 4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Wrap unfragmented messages as wpabuf without extra copy */ 4058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_set(&tmpbuf, pos, end - pos); 4068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = &tmpbuf; 4078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ikev2_responder_process(&data->ikev2, data->in_buf) < 0) { 4108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == &tmpbuf) 4118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = NULL; 4128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf != &tmpbuf) 4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->in_buf); 4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = NULL; 4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_buf == NULL) { 4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_buf = ikev2_responder_build(&data->ikev2); 4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_buf == NULL) { 4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Failed to generate " 4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "IKEv2 message"); 4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used = 0; 4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, PROC_MSG); 4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_msg(data, ret, id); 4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_isKeyAvailable(struct eap_sm *sm, void *priv) 4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == DONE && data->keymat_ok; 4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_ikev2_getKey(struct eap_sm *sm, void *priv, size_t *len) 4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != DONE || !data->keymat_ok) 4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(EAP_MSK_LEN); 4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(key, data->keymat, EAP_MSK_LEN); 4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = EAP_MSK_LEN; 4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_ikev2_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != DONE || !data->keymat_ok) 4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(EAP_EMSK_LEN); 4698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(key, data->keymat + EAP_MSK_LEN, EAP_EMSK_LEN); 4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = EAP_EMSK_LEN; 4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint eap_peer_ikev2_register(void) 4798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method *eap; 4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int ret; 4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_VENDOR_IETF, EAP_TYPE_IKEV2, 4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "IKEV2"); 4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap == NULL) 4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->init = eap_ikev2_init; 4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->deinit = eap_ikev2_deinit; 4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->process = eap_ikev2_process; 4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isKeyAvailable = eap_ikev2_isKeyAvailable; 4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->getKey = eap_ikev2_getKey; 4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->get_emsk = eap_ikev2_get_emsk; 4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret = eap_peer_method_register(eap); 4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ret) 4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_peer_method_free(eap); 4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return ret; 5008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 501