eap_server_ikev2.c revision 8d520ff1dc2da35cdca849e982051b86468016d8
18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * EAP-IKEv2 server (RFC 5106) 38d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 58d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This program is free software; you can redistribute it and/or modify 68d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * it under the terms of the GNU General Public License version 2 as 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * published by the Free Software Foundation. 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Alternatively, this software may be distributed under the terms of BSD 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * license. 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * See README and COPYING for more details. 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_i.h" 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_common/eap_ikev2_common.h" 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "ikev2.h" 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct eap_ikev2_data { 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct ikev2_initiator_data ikev2; 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt enum { MSG, FRAG_ACK, WAIT_FRAG_ACK, DONE, FAIL } state; 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *in_buf; 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *out_buf; 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t out_used; 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t fragment_size; 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int keys_ready; 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 keymat[EAP_MSK_LEN + EAP_EMSK_LEN]; 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int keymat_ok; 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}; 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic const u8 * eap_ikev2_get_shared_secret(void *ctx, const u8 *IDr, 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t IDr_len, 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t *secret_len) 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_sm *sm = ctx; 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (IDr == NULL) { 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No IDr received - default " 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "to user identity from EAP-Identity"); 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt IDr = sm->identity; 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt IDr_len = sm->identity_len; 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_user_get(sm, IDr, IDr_len, 0) < 0 || sm->user == NULL || 508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sm->user->password == NULL) { 518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No user entry found"); 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *secret_len = sm->user->password_len; 568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return sm->user->password; 578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic const char * eap_ikev2_state_txt(int state) 618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (state) { 638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case MSG: 648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "MSG"; 658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FRAG_ACK: 668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "FRAG_ACK"; 678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case WAIT_FRAG_ACK: 688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "WAIT_FRAG_ACK"; 698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case DONE: 708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "DONE"; 718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FAIL: 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "FAIL"; 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "?"; 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_state(struct eap_ikev2_data *data, int state) 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: %s -> %s", 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state_txt(data->state), 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state_txt(state)); 848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = state; 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void * eap_ikev2_init(struct eap_sm *sm) 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data; 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data = os_zalloc(sizeof(*data)); 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data == NULL) 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = MSG; 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->fragment_size = sm->fragment_size > 0 ? sm->fragment_size : 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt IKEV2_FRAGMENT_SIZE; 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.state = SA_INIT; 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.peer_auth = PEER_AUTH_SECRET; 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.key_pad = (u8 *) os_strdup("Key Pad for EAP-IKEv2"); 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->ikev2.key_pad == NULL) 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto failed; 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.key_pad_len = 21; 1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* TODO: make proposals configurable */ 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.proposal_num = 1; 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.integ = AUTH_HMAC_SHA1_96; 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.prf = PRF_HMAC_SHA1; 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.encr = ENCR_AES_CBC; 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.dh = DH_GROUP2_1024BIT_MODP; 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.IDi = (u8 *) os_strdup("hostapd"); 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.IDi_len = 7; 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.get_shared_secret = eap_ikev2_get_shared_secret; 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.cb_ctx = sm; 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data; 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtfailed: 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_initiator_deinit(&data->ikev2); 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_reset(struct eap_sm *sm, void *priv) 1288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 1308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->in_buf); 1318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->out_buf); 1328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_initiator_deinit(&data->ikev2); 1338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 1348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_build_msg(struct eap_ikev2_data *data, u8 id) 1388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *req; 1408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags; 1418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t send_len, plen, icv_len = 0; 1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Generating Request"); 1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = 0; 1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len = wpabuf_len(data->out_buf) - data->out_used; 1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (1 + send_len > data->fragment_size) { 1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len = data->fragment_size - 1; 1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_MORE_FRAGMENTS; 1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_used == 0) { 1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_LENGTH_INCLUDED; 1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len -= 4; 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen = 1 + send_len; 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen += 4; 1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->keys_ready) { 1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct ikev2_integ_alg *integ; 1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Add Integrity Checksum " 1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Data"); 1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_ICV_INCLUDED; 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt integ = ikev2_get_integ(data->ikev2.proposal.integ); 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (integ == NULL) { 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unknown INTEG " 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "transform / cannot generate ICV"); 1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt icv_len = integ->hash_len; 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen += icv_len; 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, plen, 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_CODE_REQUEST, id); 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (req == NULL) 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, flags); /* Flags */ 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_be32(req, wpabuf_len(data->out_buf)); 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(req, wpabuf_head_u8(data->out_buf) + data->out_used, 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len); 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used += send_len; 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_ICV_INCLUDED) { 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *msg = wpabuf_head(req); 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len = wpabuf_len(req); 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_integ_hash(data->ikev2.proposal.integ, 1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.keys.SK_ai, 1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.keys.SK_integ_len, 1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg, len, wpabuf_put(req, icv_len)); 1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_used == wpabuf_len(data->out_buf)) { 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Sending out %lu bytes " 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(message sent completely)", 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) send_len); 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->out_buf); 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_buf = NULL; 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used = 0; 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Sending out %lu bytes " 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(%lu more to send)", (unsigned long) send_len, 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_len(data->out_buf) - 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used); 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, WAIT_FRAG_ACK); 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return req; 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_buildReq(struct eap_sm *sm, void *priv, u8 id) 2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->state) { 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case MSG: 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_buf == NULL) { 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_buf = ikev2_initiator_build(&data->ikev2); 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_buf == NULL) { 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Failed to " 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "generate IKEv2 message"); 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used = 0; 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* pass through */ 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case WAIT_FRAG_ACK: 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_msg(data, id); 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FRAG_ACK: 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_frag_ack(id, EAP_CODE_REQUEST); 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unexpected state %d in " 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "buildReq", data->state); 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_check(struct eap_sm *sm, void *priv, 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos; 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, respData, 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) { 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-IKEV2: Invalid frame"); 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return TRUE; 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return FALSE; 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_icv(struct eap_ikev2_data *data, 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct wpabuf *respData, 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags, const u8 *pos, const u8 **end) 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_ICV_INCLUDED) { 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int icv_len = eap_ikev2_validate_icv( 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.integ, &data->ikev2.keys, 0, 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt respData, pos, *end); 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (icv_len < 0) 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Hide Integrity Checksum Data from further processing */ 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *end -= icv_len; 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else if (data->keys_ready) { 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have " 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "included integrity checksum"); 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_cont(struct eap_ikev2_data *data, 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *buf, size_t len) 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Process continuation of a pending message */ 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len > wpabuf_tailroom(data->in_buf)) { 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Fragment overflow"); 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(data->in_buf, buf, len); 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received %lu bytes, waiting for %lu " 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "bytes more", (unsigned long) len, 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_tailroom(data->in_buf)); 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_fragment(struct eap_ikev2_data *data, 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags, u32 message_length, 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *buf, size_t len) 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Process a fragment that is not the last one of the message */ 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL && !(flags & IKEV2_FLAGS_LENGTH_INCLUDED)) { 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No Message Length field in " 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "a fragmented packet"); 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* First fragment of the message */ 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = wpabuf_alloc(message_length); 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No memory for " 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "message"); 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(data->in_buf, buf, len); 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received %lu bytes in first " 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "fragment, waiting for %lu bytes more", 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) len, 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_tailroom(data->in_buf)); 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_server_keymat(struct eap_ikev2_data *data) 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_derive_keymat( 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.prf, &data->ikev2.keys, 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.i_nonce, data->ikev2.i_nonce_len, 3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.r_nonce, data->ikev2.r_nonce_len, 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat) < 0) { 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Failed to derive " 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "key material"); 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat_ok = 1; 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_process(struct eap_sm *sm, void *priv, 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *start, *pos, *end; 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags; 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u32 message_length = 0; 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf tmpbuf; 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, respData, 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; /* Should not happen; message already verified */ 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt start = pos; 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = start + len; 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len == 0) { 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* fragment ack */ 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = 0; 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = *pos++; 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_process_icv(data, respData, flags, pos, &end) < 0) { 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) { 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (end - pos < 4) { 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Message underflow"); 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length = WPA_GET_BE32(pos); 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 4; 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (message_length < (u32) (end - pos)) { 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Invalid Message " 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Length (%d; %ld remaining in this msg)", 3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length, (long) (end - pos)); 3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received packet: Flags 0x%x " 3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Message Length %u", flags, message_length); 3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == WAIT_FRAG_ACK) { 3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len != 0) { 3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unexpected payload " 3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "in WAIT_FRAG_ACK state"); 4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Fragment acknowledged"); 4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, MSG); 4058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf && eap_ikev2_process_cont(data, pos, end - pos) < 0) { 4098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_MORE_FRAGMENTS) { 4148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_process_fragment(data, flags, message_length, 4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos, end - pos) < 0) 4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FRAG_ACK); 4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else if (data->state == FRAG_ACK) { 4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-TNC: All fragments received"); 4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = MSG; 4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Wrap unfragmented messages as wpabuf without extra copy */ 4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_set(&tmpbuf, pos, end - pos); 4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = &tmpbuf; 4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ikev2_initiator_process(&data->ikev2, data->in_buf) < 0) { 4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == &tmpbuf) 4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = NULL; 4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->ikev2.state) { 4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case SA_AUTH: 4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* SA_INIT was sent out, so message have to be 4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * integrity protected from now on. */ 4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keys_ready = 1; 4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case IKEV2_DONE: 4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == FAIL) 4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Authentication completed " 4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "successfully"); 4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_server_keymat(data)) 4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, DONE); 4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf != &tmpbuf) 4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->in_buf); 4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = NULL; 4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_isDone(struct eap_sm *sm, void *priv) 4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == DONE || data->state == FAIL; 4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_isSuccess(struct eap_sm *sm, void *priv) 4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == DONE && data->ikev2.state == IKEV2_DONE && 4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat_ok; 4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_ikev2_getKey(struct eap_sm *sm, void *priv, size_t *len) 4798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != DONE || !data->keymat_ok) 4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(EAP_MSK_LEN); 4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(key, data->keymat, EAP_MSK_LEN); 4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = EAP_MSK_LEN; 4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_ikev2_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 5008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != DONE || !data->keymat_ok) 5028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 5038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(EAP_EMSK_LEN); 5058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 5068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(key, data->keymat + EAP_MSK_LEN, EAP_EMSK_LEN); 5078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = EAP_EMSK_LEN; 5088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 5118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint eap_server_ikev2_register(void) 5158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method *eap; 5178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int ret; 5188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, 5208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_VENDOR_IETF, EAP_TYPE_IKEV2, 5218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "IKEV2"); 5228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap == NULL) 5238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->init = eap_ikev2_init; 5268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->reset = eap_ikev2_reset; 5278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->buildReq = eap_ikev2_buildReq; 5288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->check = eap_ikev2_check; 5298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->process = eap_ikev2_process; 5308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isDone = eap_ikev2_isDone; 5318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->getKey = eap_ikev2_getKey; 5328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isSuccess = eap_ikev2_isSuccess; 5338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->get_emsk = eap_ikev2_get_emsk; 5348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret = eap_server_method_register(eap); 5368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ret) 5378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_server_method_free(eap); 5388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return ret; 5398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 540