eap_server_ikev2.c revision c5ec7f57ead87efa365800228aa0b09a12d9e6c4
18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * EAP-IKEv2 server (RFC 5106) 38d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_i.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_common/eap_ikev2_common.h" 148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "ikev2.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct eap_ikev2_data { 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct ikev2_initiator_data ikev2; 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt enum { MSG, FRAG_ACK, WAIT_FRAG_ACK, DONE, FAIL } state; 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *in_buf; 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *out_buf; 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t out_used; 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t fragment_size; 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int keys_ready; 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 keymat[EAP_MSK_LEN + EAP_EMSK_LEN]; 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int keymat_ok; 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}; 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic const u8 * eap_ikev2_get_shared_secret(void *ctx, const u8 *IDr, 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t IDr_len, 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t *secret_len) 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_sm *sm = ctx; 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (IDr == NULL) { 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No IDr received - default " 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "to user identity from EAP-Identity"); 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt IDr = sm->identity; 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt IDr_len = sm->identity_len; 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_user_get(sm, IDr, IDr_len, 0) < 0 || sm->user == NULL || 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sm->user->password == NULL) { 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No user entry found"); 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *secret_len = sm->user->password_len; 508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return sm->user->password; 518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic const char * eap_ikev2_state_txt(int state) 558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (state) { 578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case MSG: 588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "MSG"; 598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FRAG_ACK: 608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "FRAG_ACK"; 618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case WAIT_FRAG_ACK: 628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "WAIT_FRAG_ACK"; 638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case DONE: 648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "DONE"; 658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FAIL: 668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "FAIL"; 678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return "?"; 698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_state(struct eap_ikev2_data *data, int state) 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: %s -> %s", 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state_txt(data->state), 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state_txt(state)); 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = state; 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void * eap_ikev2_init(struct eap_sm *sm) 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data; 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data = os_zalloc(sizeof(*data)); 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data == NULL) 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = MSG; 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->fragment_size = sm->fragment_size > 0 ? sm->fragment_size : 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt IKEV2_FRAGMENT_SIZE; 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.state = SA_INIT; 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.peer_auth = PEER_AUTH_SECRET; 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.key_pad = (u8 *) os_strdup("Key Pad for EAP-IKEv2"); 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->ikev2.key_pad == NULL) 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt goto failed; 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.key_pad_len = 21; 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* TODO: make proposals configurable */ 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.proposal_num = 1; 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.integ = AUTH_HMAC_SHA1_96; 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.prf = PRF_HMAC_SHA1; 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.encr = ENCR_AES_CBC; 1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.dh = DH_GROUP2_1024BIT_MODP; 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.IDi = (u8 *) os_strdup("hostapd"); 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.IDi_len = 7; 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.get_shared_secret = eap_ikev2_get_shared_secret; 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.cb_ctx = sm; 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data; 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtfailed: 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_initiator_deinit(&data->ikev2); 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_reset(struct eap_sm *sm, void *priv) 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 1248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->in_buf); 1258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->out_buf); 1268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_initiator_deinit(&data->ikev2); 1278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 1288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_build_msg(struct eap_ikev2_data *data, u8 id) 1328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *req; 1348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags; 1358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t send_len, plen, icv_len = 0; 1368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Generating Request"); 1388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = 0; 1408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len = wpabuf_len(data->out_buf) - data->out_used; 1418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (1 + send_len > data->fragment_size) { 1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len = data->fragment_size - 1; 1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_MORE_FRAGMENTS; 1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_used == 0) { 1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_LENGTH_INCLUDED; 1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len -= 4; 1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen = 1 + send_len; 1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) 1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen += 4; 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->keys_ready) { 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct ikev2_integ_alg *integ; 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Add Integrity Checksum " 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Data"); 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags |= IKEV2_FLAGS_ICV_INCLUDED; 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt integ = ikev2_get_integ(data->ikev2.proposal.integ); 1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (integ == NULL) { 1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unknown INTEG " 1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "transform / cannot generate ICV"); 1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt icv_len = integ->hash_len; 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt plen += icv_len; 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, plen, 1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_CODE_REQUEST, id); 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (req == NULL) 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, flags); /* Flags */ 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_be32(req, wpabuf_len(data->out_buf)); 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(req, wpabuf_head_u8(data->out_buf) + data->out_used, 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt send_len); 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used += send_len; 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_ICV_INCLUDED) { 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *msg = wpabuf_head(req); 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len = wpabuf_len(req); 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ikev2_integ_hash(data->ikev2.proposal.integ, 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.keys.SK_ai, 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.keys.SK_integ_len, 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg, len, wpabuf_put(req, icv_len)); 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_used == wpabuf_len(data->out_buf)) { 1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Sending out %lu bytes " 1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(message sent completely)", 1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) send_len); 1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->out_buf); 1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_buf = NULL; 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used = 0; 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Sending out %lu bytes " 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "(%lu more to send)", (unsigned long) send_len, 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_len(data->out_buf) - 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used); 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, WAIT_FRAG_ACK); 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return req; 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_ikev2_buildReq(struct eap_sm *sm, void *priv, u8 id) 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->state) { 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case MSG: 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_buf == NULL) { 2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_buf = ikev2_initiator_build(&data->ikev2); 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->out_buf == NULL) { 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Failed to " 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "generate IKEv2 message"); 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->out_used = 0; 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* pass through */ 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case WAIT_FRAG_ACK: 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_msg(data, id); 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FRAG_ACK: 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_ikev2_build_frag_ack(id, EAP_CODE_REQUEST); 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unexpected state %d in " 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "buildReq", data->state); 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_check(struct eap_sm *sm, void *priv, 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos; 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, respData, 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) { 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-IKEV2: Invalid frame"); 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return TRUE; 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return FALSE; 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_icv(struct eap_ikev2_data *data, 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct wpabuf *respData, 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags, const u8 *pos, const u8 **end) 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_ICV_INCLUDED) { 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int icv_len = eap_ikev2_validate_icv( 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.integ, &data->ikev2.keys, 0, 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt respData, pos, *end); 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (icv_len < 0) 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Hide Integrity Checksum Data from further processing */ 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *end -= icv_len; 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else if (data->keys_ready) { 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have " 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "included integrity checksum"); 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_cont(struct eap_ikev2_data *data, 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *buf, size_t len) 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Process continuation of a pending message */ 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len > wpabuf_tailroom(data->in_buf)) { 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Fragment overflow"); 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(data->in_buf, buf, len); 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received %lu bytes, waiting for %lu " 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "bytes more", (unsigned long) len, 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_tailroom(data->in_buf)); 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_process_fragment(struct eap_ikev2_data *data, 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags, u32 message_length, 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *buf, size_t len) 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Process a fragment that is not the last one of the message */ 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL && !(flags & IKEV2_FLAGS_LENGTH_INCLUDED)) { 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No Message Length field in " 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "a fragmented packet"); 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* First fragment of the message */ 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = wpabuf_alloc(message_length); 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: No memory for " 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "message"); 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(data->in_buf, buf, len); 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received %lu bytes in first " 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "fragment, waiting for %lu bytes more", 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) len, 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) wpabuf_tailroom(data->in_buf)); 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int eap_ikev2_server_keymat(struct eap_ikev2_data *data) 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_derive_keymat( 3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.proposal.prf, &data->ikev2.keys, 3298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.i_nonce, data->ikev2.i_nonce_len, 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->ikev2.r_nonce, data->ikev2.r_nonce_len, 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat) < 0) { 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Failed to derive " 3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "key material"); 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat_ok = 1; 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_ikev2_process(struct eap_sm *sm, void *priv, 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *start, *pos, *end; 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags; 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u32 message_length = 0; 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf tmpbuf; 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_IKEV2, respData, 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL) 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; /* Should not happen; message already verified */ 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt start = pos; 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = start + len; 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len == 0) { 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* fragment ack */ 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = 0; 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = *pos++; 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_process_icv(data, respData, flags, pos, &end) < 0) { 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_LENGTH_INCLUDED) { 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (end - pos < 4) { 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Message underflow"); 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length = WPA_GET_BE32(pos); 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 4; 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (message_length < (u32) (end - pos)) { 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Invalid Message " 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Length (%d; %ld remaining in this msg)", 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt message_length, (long) (end - pos)); 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Received packet: Flags 0x%x " 3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Message Length %u", flags, message_length); 3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == WAIT_FRAG_ACK) { 3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len != 0) { 3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Unexpected payload " 3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "in WAIT_FRAG_ACK state"); 3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Fragment acknowledged"); 3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, MSG); 3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf && eap_ikev2_process_cont(data, pos, end - pos) < 0) { 4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (flags & IKEV2_FLAGS_MORE_FRAGMENTS) { 4088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_process_fragment(data, flags, message_length, 4098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos, end - pos) < 0) 4108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 4128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FRAG_ACK); 4138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else if (data->state == FRAG_ACK) { 4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-TNC: All fragments received"); 4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = MSG; 4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == NULL) { 4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Wrap unfragmented messages as wpabuf without extra copy */ 4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_set(&tmpbuf, pos, end - pos); 4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = &tmpbuf; 4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ikev2_initiator_process(&data->ikev2, data->in_buf) < 0) { 4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf == &tmpbuf) 4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = NULL; 4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, FAIL); 4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->ikev2.state) { 4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case SA_AUTH: 4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* SA_INIT was sent out, so message have to be 4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * integrity protected from now on. */ 4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keys_ready = 1; 4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case IKEV2_DONE: 4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == FAIL) 4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-IKEV2: Authentication completed " 4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "successfully"); 4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap_ikev2_server_keymat(data)) 4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_ikev2_state(data, DONE); 4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->in_buf != &tmpbuf) 4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_free(data->in_buf); 4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->in_buf = NULL; 4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_isDone(struct eap_sm *sm, void *priv) 4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == DONE || data->state == FAIL; 4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_ikev2_isSuccess(struct eap_sm *sm, void *priv) 4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == DONE && data->ikev2.state == IKEV2_DONE && 4688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->keymat_ok; 4698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_ikev2_getKey(struct eap_sm *sm, void *priv, size_t *len) 4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != DONE || !data->keymat_ok) 4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(EAP_MSK_LEN); 4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(key, data->keymat, EAP_MSK_LEN); 4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = EAP_MSK_LEN; 4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_ikev2_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_ikev2_data *data = priv; 4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != DONE || !data->keymat_ok) 4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(EAP_EMSK_LEN); 4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key) { 5008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(key, data->keymat + EAP_MSK_LEN, EAP_EMSK_LEN); 5018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = EAP_EMSK_LEN; 5028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 5058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint eap_server_ikev2_register(void) 5098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method *eap; 5118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int ret; 5128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, 5148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_VENDOR_IETF, EAP_TYPE_IKEV2, 5158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "IKEV2"); 5168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap == NULL) 5178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->init = eap_ikev2_init; 5208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->reset = eap_ikev2_reset; 5218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->buildReq = eap_ikev2_buildReq; 5228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->check = eap_ikev2_check; 5238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->process = eap_ikev2_process; 5248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isDone = eap_ikev2_isDone; 5258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->getKey = eap_ikev2_getKey; 5268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isSuccess = eap_ikev2_isSuccess; 5278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->get_emsk = eap_ikev2_get_emsk; 5288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret = eap_server_method_register(eap); 5308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ret) 5318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_server_method_free(eap); 5328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return ret; 5338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 534