1105068Sphk/* 2105068Sphk * IKEv2 responder (RFC 4306) for EAP-IKEV2 3105068Sphk * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 4105068Sphk * 5105068Sphk * This software may be distributed under the terms of the BSD license. 6105068Sphk * See README for more details. 7105068Sphk */ 8105068Sphk 9105068Sphk#include "includes.h" 10105068Sphk 11105068Sphk#include "common.h" 12105068Sphk#include "crypto/dh_groups.h" 13105068Sphk#include "crypto/random.h" 14105068Sphk#include "ikev2.h" 15105068Sphk 16105068Sphk 17105068Sphkvoid ikev2_responder_deinit(struct ikev2_responder_data *data) 18105068Sphk{ 19105068Sphk ikev2_free_keys(&data->keys); 20105068Sphk wpabuf_free(data->i_dh_public); 21105068Sphk wpabuf_free(data->r_dh_private); 22105068Sphk os_free(data->IDi); 23105068Sphk os_free(data->IDr); 24105068Sphk os_free(data->shared_secret); 25105068Sphk wpabuf_free(data->i_sign_msg); 26105068Sphk wpabuf_free(data->r_sign_msg); 27105068Sphk os_free(data->key_pad); 28105068Sphk} 29105068Sphk 30105068Sphk 31105068Sphkstatic int ikev2_derive_keys(struct ikev2_responder_data *data) 32105068Sphk{ 33105068Sphk u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN]; 34105068Sphk size_t buf_len, pad_len; 35105068Sphk struct wpabuf *shared; 36116196Sobrien const struct ikev2_integ_alg *integ; 37116196Sobrien const struct ikev2_prf_alg *prf; 38116196Sobrien const struct ikev2_encr_alg *encr; 39105068Sphk int ret; 40105068Sphk const u8 *addr[2]; 41105068Sphk size_t len[2]; 42105068Sphk 43105068Sphk /* RFC 4306, Sect. 2.14 */ 44105068Sphk 45105068Sphk integ = ikev2_get_integ(data->proposal.integ); 46105068Sphk prf = ikev2_get_prf(data->proposal.prf); 47105068Sphk encr = ikev2_get_encr(data->proposal.encr); 48105068Sphk if (integ == NULL || prf == NULL || encr == NULL) { 49105068Sphk wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal"); 50113892Sphk return -1; 51105068Sphk } 52105068Sphk 53105068Sphk shared = dh_derive_shared(data->i_dh_public, data->r_dh_private, 54112511Sphk data->dh); 55112511Sphk if (shared == NULL) 56112511Sphk return -1; 57112511Sphk 58105068Sphk /* Construct Ni | Nr | SPIi | SPIr */ 59105068Sphk 60112709Sphk buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN; 61112511Sphk buf = os_malloc(buf_len); 62105068Sphk if (buf == NULL) { 63113892Sphk wpabuf_free(shared); 64113892Sphk return -1; 65105068Sphk } 66105068Sphk 67112534Sphk pos = buf; 68126080Sphk os_memcpy(pos, data->i_nonce, data->i_nonce_len); 69126080Sphk pos += data->i_nonce_len; 70112534Sphk os_memcpy(pos, data->r_nonce, data->r_nonce_len); 71112534Sphk pos += data->r_nonce_len; 72105068Sphk os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN); 73105068Sphk pos += IKEV2_SPI_LEN; 74112534Sphk os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN); 75105068Sphk#ifdef CCNS_PL 76105068Sphk#if __BYTE_ORDER == __LITTLE_ENDIAN 77105068Sphk { 78112534Sphk int i; 79112534Sphk u8 *tmp = pos - IKEV2_SPI_LEN; 80112709Sphk /* Incorrect byte re-ordering on little endian hosts.. */ 81112709Sphk for (i = 0; i < IKEV2_SPI_LEN; i++) 82112709Sphk *tmp++ = data->i_spi[IKEV2_SPI_LEN - 1 - i]; 83112709Sphk for (i = 0; i < IKEV2_SPI_LEN; i++) 84105068Sphk *tmp++ = data->r_spi[IKEV2_SPI_LEN - 1 - i]; 85105068Sphk } 86112511Sphk#endif 87112511Sphk#endif /* CCNS_PL */ 88112511Sphk 89112511Sphk /* SKEYSEED = prf(Ni | Nr, g^ir) */ 90112709Sphk /* Use zero-padding per RFC 4306, Sect. 2.14 */ 91113892Sphk pad_len = data->dh->prime_len - wpabuf_len(shared); 92112511Sphk#ifdef CCNS_PL 93113892Sphk /* Shared secret is not zero-padded correctly */ 94112511Sphk pad_len = 0; 95115624Sphk#endif /* CCNS_PL */ 96115624Sphk pad = os_zalloc(pad_len ? pad_len : 1); 97115624Sphk if (pad == NULL) { 98115624Sphk wpabuf_free(shared); 99144789Spjd os_free(buf); 100144789Spjd return -1; 101144789Spjd } 102144789Spjd 103115624Sphk addr[0] = pad; 104115624Sphk len[0] = pad_len; 105115624Sphk addr[1] = wpabuf_head(shared); 106115624Sphk len[1] = wpabuf_len(shared); 107115624Sphk if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len, 108115949Sphk 2, addr, len, skeyseed) < 0) { 109115624Sphk wpabuf_free(shared); 110115624Sphk os_free(buf); 111115624Sphk os_free(pad); 112144789Spjd return -1; 113112511Sphk } 114112511Sphk os_free(pad); 115112511Sphk wpabuf_free(shared); 116112511Sphk 117112511Sphk /* DH parameters are not needed anymore, so free them */ 118112511Sphk wpabuf_free(data->i_dh_public); 119112511Sphk data->i_dh_public = NULL; 120115624Sphk wpabuf_free(data->r_dh_private); 121112511Sphk data->r_dh_private = NULL; 122112511Sphk 123112511Sphk wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED", 124112511Sphk skeyseed, prf->hash_len); 125112511Sphk 126115624Sphk ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len, 127112511Sphk &data->keys); 128115624Sphk os_free(buf); 129115624Sphk return ret; 130112511Sphk} 131112511Sphk 132112511Sphk 133112511Sphkstatic int ikev2_parse_transform(struct ikev2_proposal_data *prop, 134112511Sphk const u8 *pos, const u8 *end) 135112511Sphk{ 136115624Sphk int transform_len; 137112709Sphk const struct ikev2_transform *t; 138112511Sphk u16 transform_id; 139115624Sphk const u8 *tend; 140112709Sphk 141112511Sphk if (end - pos < (int) sizeof(*t)) { 142112511Sphk wpa_printf(MSG_INFO, "IKEV2: Too short transform"); 143115624Sphk return -1; 144112709Sphk } 145115624Sphk 146115624Sphk t = (const struct ikev2_transform *) pos; 147115624Sphk transform_len = WPA_GET_BE16(t->transform_length); 148112709Sphk if (transform_len < (int) sizeof(*t) || pos + transform_len > end) { 149112709Sphk wpa_printf(MSG_INFO, "IKEV2: Invalid transform length %d", 150115624Sphk transform_len); 151115624Sphk return -1; 152115624Sphk } 153115624Sphk tend = pos + transform_len; 154115624Sphk 155115624Sphk transform_id = WPA_GET_BE16(t->transform_id); 156115624Sphk 157115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: Transform:"); 158115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Transform Length: %d " 159112709Sphk "Transform Type: %d Transform ID: %d", 160115624Sphk t->type, transform_len, t->transform_type, transform_id); 161115624Sphk 162112511Sphk if (t->type != 0 && t->type != 3) { 163112709Sphk wpa_printf(MSG_INFO, "IKEV2: Unexpected Transform type"); 164115624Sphk return -1; 165112709Sphk } 166112511Sphk 167112709Sphk pos = (const u8 *) (t + 1); 168112709Sphk if (pos < tend) { 169112511Sphk wpa_hexdump(MSG_DEBUG, "IKEV2: Transform Attributes", 170112511Sphk pos, tend - pos); 171112511Sphk } 172112709Sphk 173115624Sphk switch (t->transform_type) { 174140367Sphk case IKEV2_TRANSFORM_ENCR: 175115624Sphk if (ikev2_get_encr(transform_id)) { 176115624Sphk if (transform_id == ENCR_AES_CBC) { 177115624Sphk if (tend - pos != 4) { 178115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: No " 179115624Sphk "Transform Attr for AES"); 180115624Sphk break; 181115624Sphk } 182115624Sphk#ifdef CCNS_PL 183115624Sphk if (WPA_GET_BE16(pos) != 0x001d /* ?? */) { 184115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: Not a " 185115624Sphk "Key Size attribute for " 186115624Sphk "AES"); 187115624Sphk break; 188115624Sphk } 189112511Sphk#else /* CCNS_PL */ 190115624Sphk if (WPA_GET_BE16(pos) != 0x800e) { 191115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: Not a " 192115624Sphk "Key Size attribute for " 193115624Sphk "AES"); 194115624Sphk break; 195115624Sphk } 196115624Sphk#endif /* CCNS_PL */ 197115624Sphk if (WPA_GET_BE16(pos + 2) != 128) { 198115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: " 199115624Sphk "Unsupported AES key size " 200115624Sphk "%d bits", 201115624Sphk WPA_GET_BE16(pos + 2)); 202115624Sphk break; 203115624Sphk } 204115624Sphk } 205115624Sphk prop->encr = transform_id; 206115624Sphk } 207115624Sphk break; 208115624Sphk case IKEV2_TRANSFORM_PRF: 209115624Sphk if (ikev2_get_prf(transform_id)) 210115624Sphk prop->prf = transform_id; 211115624Sphk break; 212112511Sphk case IKEV2_TRANSFORM_INTEG: 213115624Sphk if (ikev2_get_integ(transform_id)) 214112511Sphk prop->integ = transform_id; 215112511Sphk break; 216112511Sphk case IKEV2_TRANSFORM_DH: 217114531Sphk if (dh_groups_get(transform_id)) 218114531Sphk prop->dh = transform_id; 219114531Sphk break; 220114531Sphk } 221115624Sphk 222115624Sphk return transform_len; 223114531Sphk} 224115624Sphk 225114531Sphk 226115624Sphkstatic int ikev2_parse_proposal(struct ikev2_proposal_data *prop, 227115624Sphk const u8 *pos, const u8 *end) 228115624Sphk{ 229114531Sphk const u8 *pend, *ppos; 230114531Sphk int proposal_len, i; 231115624Sphk const struct ikev2_proposal *p; 232114531Sphk 233114531Sphk if (end - pos < (int) sizeof(*p)) { 234114531Sphk wpa_printf(MSG_INFO, "IKEV2: Too short proposal"); 235112709Sphk return -1; 236112511Sphk } 237112511Sphk 238115624Sphk /* FIX: AND processing if multiple proposals use the same # */ 239112709Sphk 240112511Sphk p = (const struct ikev2_proposal *) pos; 241115624Sphk proposal_len = WPA_GET_BE16(p->proposal_length); 242115624Sphk if (proposal_len < (int) sizeof(*p) || pos + proposal_len > end) { 243115624Sphk wpa_printf(MSG_INFO, "IKEV2: Invalid proposal length %d", 244115624Sphk proposal_len); 245115624Sphk return -1; 246112511Sphk } 247112511Sphk wpa_printf(MSG_DEBUG, "IKEV2: SAi1 Proposal # %d", 248112511Sphk p->proposal_num); 249115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Proposal Length: %d " 250115624Sphk " Protocol ID: %d", 251115624Sphk p->type, proposal_len, p->protocol_id); 252115624Sphk wpa_printf(MSG_DEBUG, "IKEV2: SPI Size: %d Transforms: %d", 253112709Sphk p->spi_size, p->num_transforms); 254112709Sphk 255112709Sphk if (p->type != 0 && p->type != 2) { 256112709Sphk wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal type"); 257115624Sphk return -1; 258115624Sphk } 259115624Sphk 260115624Sphk if (p->protocol_id != IKEV2_PROTOCOL_IKE) { 261112511Sphk wpa_printf(MSG_DEBUG, "IKEV2: Unexpected Protocol ID " 262117150Sphk "(only IKE allowed for EAP-IKEv2)"); 263115624Sphk return -1; 264112511Sphk } 265115624Sphk 266112511Sphk if (p->proposal_num != prop->proposal_num) { 267112511Sphk if (p->proposal_num == prop->proposal_num + 1) 268112511Sphk prop->proposal_num = p->proposal_num; 269112511Sphk else { 270112511Sphk wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal #"); 271157581Smarcel return -1; 272157581Smarcel } 273157581Smarcel } 274114670Sphk 275115624Sphk ppos = (const u8 *) (p + 1); 276114670Sphk pend = pos + proposal_len; 277114670Sphk if (ppos + p->spi_size > pend) { 278114670Sphk wpa_printf(MSG_INFO, "IKEV2: Not enough room for SPI " 279114670Sphk "in proposal"); 280114670Sphk return -1; 281114670Sphk } 282157581Smarcel if (p->spi_size) { 283157581Smarcel wpa_hexdump(MSG_DEBUG, "IKEV2: SPI", 284157581Smarcel ppos, p->spi_size); 285115624Sphk ppos += p->spi_size; 286157581Smarcel } 287157581Smarcel 288114670Sphk /* 289115624Sphk * For initial IKE_SA negotiation, SPI Size MUST be zero; for 290157581Smarcel * subsequent negotiations, it must be 8 for IKE. We only support 291114670Sphk * initial case for now. 292157581Smarcel */ 293114670Sphk if (p->spi_size != 0) { 294114670Sphk wpa_printf(MSG_INFO, "IKEV2: Unexpected SPI Size"); 295157581Smarcel return -1; 296157581Smarcel } 297157581Smarcel 298157581Smarcel if (p->num_transforms == 0) { 299157581Smarcel wpa_printf(MSG_INFO, "IKEV2: At least one transform required"); 300157581Smarcel return -1; 301157581Smarcel } 302157581Smarcel 303157581Smarcel for (i = 0; i < (int) p->num_transforms; i++) { 304157581Smarcel int tlen = ikev2_parse_transform(prop, ppos, pend); 305157581Smarcel if (tlen < 0) 306157581Smarcel return -1; 307157581Smarcel ppos += tlen; 308157581Smarcel } 309157581Smarcel 310157581Smarcel if (ppos != pend) { 311157581Smarcel wpa_printf(MSG_INFO, "IKEV2: Unexpected data after " 312157581Smarcel "transforms"); 313112709Sphk return -1; 314112709Sphk } 315112709Sphk 316115624Sphk return proposal_len; 317112709Sphk} 318112709Sphk 319112709Sphk 320112709Sphkstatic int ikev2_process_sai1(struct ikev2_responder_data *data, 321112709Sphk const u8 *sai1, size_t sai1_len) 322112709Sphk{ 323112709Sphk struct ikev2_proposal_data prop; 324112709Sphk const u8 *pos, *end; 325112709Sphk int found = 0; 326115624Sphk 327112709Sphk /* Security Association Payloads: <Proposals> */ 328115624Sphk 329112709Sphk if (sai1 == NULL) { 330112709Sphk wpa_printf(MSG_INFO, "IKEV2: SAi1 not received"); 331112709Sphk return -1; 332112709Sphk } 333112709Sphk 334115624Sphk os_memset(&prop, 0, sizeof(prop)); 335115624Sphk prop.proposal_num = 1; 336115624Sphk 337115624Sphk pos = sai1; 338115624Sphk end = sai1 + sai1_len; 339115624Sphk 340115624Sphk while (pos < end) { 341115624Sphk int plen; 342115624Sphk 343115624Sphk prop.integ = -1; 344115624Sphk prop.prf = -1; 345115624Sphk prop.encr = -1; 346115624Sphk prop.dh = -1; 347115624Sphk plen = ikev2_parse_proposal(&prop, pos, end); 348115624Sphk if (plen < 0) 349115624Sphk return -1; 350115624Sphk 351115624Sphk if (!found && prop.integ != -1 && prop.prf != -1 && 352115624Sphk prop.encr != -1 && prop.dh != -1) { 353115624Sphk os_memcpy(&data->proposal, &prop, sizeof(prop)); 354115624Sphk data->dh = dh_groups_get(prop.dh); 355115624Sphk found = 1; 356115624Sphk } 357115624Sphk 358115624Sphk pos += plen; 359115624Sphk } 360115624Sphk 361113893Sphk if (pos != end) { 362113893Sphk wpa_printf(MSG_INFO, "IKEV2: Unexpected data after proposals"); 363113893Sphk return -1; 364113893Sphk } 365113893Sphk 366113893Sphk if (!found) { 367113893Sphk wpa_printf(MSG_INFO, "IKEV2: No acceptable proposal found"); 368113893Sphk return -1; 369113893Sphk } 370113893Sphk 371113893Sphk wpa_printf(MSG_DEBUG, "IKEV2: Accepted proposal #%d: ENCR:%d PRF:%d " 372113893Sphk "INTEG:%d D-H:%d", data->proposal.proposal_num, 373113893Sphk data->proposal.encr, data->proposal.prf, 374113893Sphk data->proposal.integ, data->proposal.dh); 375113893Sphk 376113893Sphk return 0; 377115624Sphk} 378115624Sphk 379112709Sphk 380115624Sphkstatic int ikev2_process_kei(struct ikev2_responder_data *data, 381112709Sphk const u8 *kei, size_t kei_len) 382112709Sphk{ 383115624Sphk u16 group; 384112709Sphk 385112709Sphk /* 386112709Sphk * Key Exchange Payload: 387115624Sphk * DH Group # (16 bits) 388112709Sphk * RESERVED (16 bits) 389112709Sphk * Key Exchange Data (Diffie-Hellman public value) 390112709Sphk */ 391112709Sphk 392112709Sphk if (kei == NULL) { 393115624Sphk wpa_printf(MSG_INFO, "IKEV2: KEi not received"); 394115624Sphk return -1; 395112709Sphk } 396115624Sphk 397112709Sphk if (kei_len < 4 + 96) { 398112709Sphk wpa_printf(MSG_INFO, "IKEV2: Too show Key Exchange Payload"); 399112709Sphk return -1; 400115624Sphk } 401115958Sphk 402115958Sphk group = WPA_GET_BE16(kei); 403115958Sphk wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u", group); 404115958Sphk 405115958Sphk if (group != data->proposal.dh) { 406115958Sphk wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u does not match " 407115958Sphk "with the selected proposal (%u)", 408115958Sphk group, data->proposal.dh); 409112709Sphk /* Reject message with Notify payload of type 410112709Sphk * INVALID_KE_PAYLOAD (RFC 4306, Sect. 3.4) */ 411112709Sphk data->error_type = INVALID_KE_PAYLOAD; 412112709Sphk data->state = NOTIFY; 413112709Sphk return -1; 414112709Sphk } 415115624Sphk 416115624Sphk if (data->dh == NULL) { 417112709Sphk wpa_printf(MSG_INFO, "IKEV2: Unsupported DH group"); 418115624Sphk return -1; 419112709Sphk } 420112709Sphk 421115624Sphk /* RFC 4306, Section 3.4: 422112709Sphk * The length of DH public value MUST be equal to the length of the 423112709Sphk * prime modulus. 424115850Sphk */ 425115850Sphk if (kei_len - 4 != data->dh->prime_len) { 426115850Sphk wpa_printf(MSG_INFO, "IKEV2: Invalid DH public value length " 427112709Sphk "%ld (expected %ld)", 428112709Sphk (long) (kei_len - 4), (long) data->dh->prime_len); 429112709Sphk return -1; 430112709Sphk } 431115624Sphk 432115624Sphk wpabuf_free(data->i_dh_public); 433112709Sphk data->i_dh_public = wpabuf_alloc(kei_len - 4); 434112709Sphk if (data->i_dh_public == NULL) 435115624Sphk return -1; 436115624Sphk wpabuf_put_data(data->i_dh_public, kei + 4, kei_len - 4); 437112709Sphk 438112709Sphk wpa_hexdump_buf(MSG_DEBUG, "IKEV2: KEi Diffie-Hellman Public Value", 439115624Sphk data->i_dh_public); 440115624Sphk 441115726Sphk return 0; 442115726Sphk} 443115624Sphk 444115726Sphk 445150304Smarcelstatic int ikev2_process_ni(struct ikev2_responder_data *data, 446150304Smarcel const u8 *ni, size_t ni_len) 447150304Smarcel{ 448150304Smarcel if (ni == NULL) { 449115624Sphk wpa_printf(MSG_INFO, "IKEV2: Ni not received"); 450150304Smarcel return -1; 451150304Smarcel } 452150304Smarcel 453150304Smarcel if (ni_len < IKEV2_NONCE_MIN_LEN || ni_len > IKEV2_NONCE_MAX_LEN) { 454150304Smarcel wpa_printf(MSG_INFO, "IKEV2: Invalid Ni length %ld", 455112709Sphk (long) ni_len); 456112709Sphk return -1; 457112709Sphk } 458112709Sphk 459113876Sphk#ifdef CCNS_PL 460130585Sphk /* Zeros are removed incorrectly from the beginning of the nonces */ 461112511Sphk while (ni_len > 1 && *ni == 0) { 462112709Sphk ni_len--; 463136839Sphk ni++; 464112511Sphk } 465112511Sphk#endif /* CCNS_PL */ 466115624Sphk 467115624Sphk data->i_nonce_len = ni_len; 468112709Sphk os_memcpy(data->i_nonce, ni, ni_len); 469115624Sphk wpa_hexdump(MSG_MSGDUMP, "IKEV2: Ni", 470112511Sphk data->i_nonce, data->i_nonce_len); 471112709Sphk 472112709Sphk return 0; 473112709Sphk} 474112709Sphk 475112709Sphk 476112709Sphkstatic int ikev2_process_sa_init(struct ikev2_responder_data *data, 477112709Sphk const struct ikev2_hdr *hdr, 478112709Sphk struct ikev2_payloads *pl) 479112709Sphk{ 480115624Sphk if (ikev2_process_sai1(data, pl->sa, pl->sa_len) < 0 || 481112709Sphk ikev2_process_kei(data, pl->ke, pl->ke_len) < 0 || 482112876Sphk ikev2_process_ni(data, pl->nonce, pl->nonce_len) < 0) 483112876Sphk return -1; 484115624Sphk 485115624Sphk os_memcpy(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN); 486115624Sphk 487115624Sphk return 0; 488112709Sphk} 489144789Spjd 490144789Spjd 491144789Spjdstatic int ikev2_process_idi(struct ikev2_responder_data *data, 492144789Spjd const u8 *idi, size_t idi_len) 493115624Sphk{ 494136839Sphk u8 id_type; 495114531Sphk 496136839Sphk if (idi == NULL) { 497112511Sphk wpa_printf(MSG_INFO, "IKEV2: No IDi received"); 498112511Sphk return -1; 499112511Sphk } 500130585Sphk 501105068Sphk if (idi_len < 4) { 502105068Sphk wpa_printf(MSG_INFO, "IKEV2: Too short IDi payload"); 503105068Sphk return -1; 504105068Sphk } 505112511Sphk 506112511Sphk id_type = idi[0]; 507112511Sphk idi += 4; 508105068Sphk idi_len -= 4; 509115624Sphk 510105068Sphk wpa_printf(MSG_DEBUG, "IKEV2: IDi ID Type %d", id_type); 511105068Sphk wpa_hexdump_ascii(MSG_DEBUG, "IKEV2: IDi", idi, idi_len); 512105068Sphk os_free(data->IDi); 513105068Sphk data->IDi = os_malloc(idi_len); 514105068Sphk if (data->IDi == NULL) 515 return -1; 516 os_memcpy(data->IDi, idi, idi_len); 517 data->IDi_len = idi_len; 518 data->IDi_type = id_type; 519 520 return 0; 521} 522 523 524static int ikev2_process_cert(struct ikev2_responder_data *data, 525 const u8 *cert, size_t cert_len) 526{ 527 u8 cert_encoding; 528 529 if (cert == NULL) { 530 if (data->peer_auth == PEER_AUTH_CERT) { 531 wpa_printf(MSG_INFO, "IKEV2: No Certificate received"); 532 return -1; 533 } 534 return 0; 535 } 536 537 if (cert_len < 1) { 538 wpa_printf(MSG_INFO, "IKEV2: No Cert Encoding field"); 539 return -1; 540 } 541 542 cert_encoding = cert[0]; 543 cert++; 544 cert_len--; 545 546 wpa_printf(MSG_DEBUG, "IKEV2: Cert Encoding %d", cert_encoding); 547 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Certificate Data", cert, cert_len); 548 549 /* TODO: validate certificate */ 550 551 return 0; 552} 553 554 555static int ikev2_process_auth_cert(struct ikev2_responder_data *data, 556 u8 method, const u8 *auth, size_t auth_len) 557{ 558 if (method != AUTH_RSA_SIGN) { 559 wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication " 560 "method %d", method); 561 return -1; 562 } 563 564 /* TODO: validate AUTH */ 565 return 0; 566} 567 568 569static int ikev2_process_auth_secret(struct ikev2_responder_data *data, 570 u8 method, const u8 *auth, 571 size_t auth_len) 572{ 573 u8 auth_data[IKEV2_MAX_HASH_LEN]; 574 const struct ikev2_prf_alg *prf; 575 576 if (method != AUTH_SHARED_KEY_MIC) { 577 wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication " 578 "method %d", method); 579 return -1; 580 } 581 582 /* msg | Nr | prf(SK_pi,IDi') */ 583 if (ikev2_derive_auth_data(data->proposal.prf, data->i_sign_msg, 584 data->IDi, data->IDi_len, data->IDi_type, 585 &data->keys, 1, data->shared_secret, 586 data->shared_secret_len, 587 data->r_nonce, data->r_nonce_len, 588 data->key_pad, data->key_pad_len, 589 auth_data) < 0) { 590 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data"); 591 return -1; 592 } 593 594 wpabuf_free(data->i_sign_msg); 595 data->i_sign_msg = NULL; 596 597 prf = ikev2_get_prf(data->proposal.prf); 598 if (prf == NULL) 599 return -1; 600 601 if (auth_len != prf->hash_len || 602 os_memcmp(auth, auth_data, auth_len) != 0) { 603 wpa_printf(MSG_INFO, "IKEV2: Invalid Authentication Data"); 604 wpa_hexdump(MSG_DEBUG, "IKEV2: Received Authentication Data", 605 auth, auth_len); 606 wpa_hexdump(MSG_DEBUG, "IKEV2: Expected Authentication Data", 607 auth_data, prf->hash_len); 608 data->error_type = AUTHENTICATION_FAILED; 609 data->state = NOTIFY; 610 return -1; 611 } 612 613 wpa_printf(MSG_DEBUG, "IKEV2: Server authenticated successfully " 614 "using shared keys"); 615 616 return 0; 617} 618 619 620static int ikev2_process_auth(struct ikev2_responder_data *data, 621 const u8 *auth, size_t auth_len) 622{ 623 u8 auth_method; 624 625 if (auth == NULL) { 626 wpa_printf(MSG_INFO, "IKEV2: No Authentication Payload"); 627 return -1; 628 } 629 630 if (auth_len < 4) { 631 wpa_printf(MSG_INFO, "IKEV2: Too short Authentication " 632 "Payload"); 633 return -1; 634 } 635 636 auth_method = auth[0]; 637 auth += 4; 638 auth_len -= 4; 639 640 wpa_printf(MSG_DEBUG, "IKEV2: Auth Method %d", auth_method); 641 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Authentication Data", auth, auth_len); 642 643 switch (data->peer_auth) { 644 case PEER_AUTH_CERT: 645 return ikev2_process_auth_cert(data, auth_method, auth, 646 auth_len); 647 case PEER_AUTH_SECRET: 648 return ikev2_process_auth_secret(data, auth_method, auth, 649 auth_len); 650 } 651 652 return -1; 653} 654 655 656static int ikev2_process_sa_auth_decrypted(struct ikev2_responder_data *data, 657 u8 next_payload, 658 u8 *payload, size_t payload_len) 659{ 660 struct ikev2_payloads pl; 661 662 wpa_printf(MSG_DEBUG, "IKEV2: Processing decrypted payloads"); 663 664 if (ikev2_parse_payloads(&pl, next_payload, payload, payload + 665 payload_len) < 0) { 666 wpa_printf(MSG_INFO, "IKEV2: Failed to parse decrypted " 667 "payloads"); 668 return -1; 669 } 670 671 if (ikev2_process_idi(data, pl.idi, pl.idi_len) < 0 || 672 ikev2_process_cert(data, pl.cert, pl.cert_len) < 0 || 673 ikev2_process_auth(data, pl.auth, pl.auth_len) < 0) 674 return -1; 675 676 return 0; 677} 678 679 680static int ikev2_process_sa_auth(struct ikev2_responder_data *data, 681 const struct ikev2_hdr *hdr, 682 struct ikev2_payloads *pl) 683{ 684 u8 *decrypted; 685 size_t decrypted_len; 686 int ret; 687 688 decrypted = ikev2_decrypt_payload(data->proposal.encr, 689 data->proposal.integ, 690 &data->keys, 1, hdr, pl->encrypted, 691 pl->encrypted_len, &decrypted_len); 692 if (decrypted == NULL) 693 return -1; 694 695 ret = ikev2_process_sa_auth_decrypted(data, pl->encr_next_payload, 696 decrypted, decrypted_len); 697 os_free(decrypted); 698 699 return ret; 700} 701 702 703static int ikev2_validate_rx_state(struct ikev2_responder_data *data, 704 u8 exchange_type, u32 message_id) 705{ 706 switch (data->state) { 707 case SA_INIT: 708 /* Expect to receive IKE_SA_INIT: HDR, SAi1, KEi, Ni */ 709 if (exchange_type != IKE_SA_INIT) { 710 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 711 "%u in SA_INIT state", exchange_type); 712 return -1; 713 } 714 if (message_id != 0) { 715 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 716 "in SA_INIT state", message_id); 717 return -1; 718 } 719 break; 720 case SA_AUTH: 721 /* Expect to receive IKE_SA_AUTH: 722 * HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,] 723 * AUTH, SAi2, TSi, TSr} 724 */ 725 if (exchange_type != IKE_SA_AUTH) { 726 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 727 "%u in SA_AUTH state", exchange_type); 728 return -1; 729 } 730 if (message_id != 1) { 731 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 732 "in SA_AUTH state", message_id); 733 return -1; 734 } 735 break; 736 case CHILD_SA: 737 if (exchange_type != CREATE_CHILD_SA) { 738 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 739 "%u in CHILD_SA state", exchange_type); 740 return -1; 741 } 742 if (message_id != 2) { 743 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 744 "in CHILD_SA state", message_id); 745 return -1; 746 } 747 break; 748 case NOTIFY: 749 case IKEV2_DONE: 750 case IKEV2_FAILED: 751 return -1; 752 } 753 754 return 0; 755} 756 757 758int ikev2_responder_process(struct ikev2_responder_data *data, 759 const struct wpabuf *buf) 760{ 761 const struct ikev2_hdr *hdr; 762 u32 length, message_id; 763 const u8 *pos, *end; 764 struct ikev2_payloads pl; 765 766 wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)", 767 (unsigned long) wpabuf_len(buf)); 768 769 if (wpabuf_len(buf) < sizeof(*hdr)) { 770 wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR"); 771 return -1; 772 } 773 774 data->error_type = 0; 775 hdr = (const struct ikev2_hdr *) wpabuf_head(buf); 776 end = wpabuf_head_u8(buf) + wpabuf_len(buf); 777 message_id = WPA_GET_BE32(hdr->message_id); 778 length = WPA_GET_BE32(hdr->length); 779 780 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Initiator's SPI", 781 hdr->i_spi, IKEV2_SPI_LEN); 782 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI", 783 hdr->r_spi, IKEV2_SPI_LEN); 784 wpa_printf(MSG_DEBUG, "IKEV2: Next Payload: %u Version: 0x%x " 785 "Exchange Type: %u", 786 hdr->next_payload, hdr->version, hdr->exchange_type); 787 wpa_printf(MSG_DEBUG, "IKEV2: Message ID: %u Length: %u", 788 message_id, length); 789 790 if (hdr->version != IKEV2_VERSION) { 791 wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x " 792 "(expected 0x%x)", hdr->version, IKEV2_VERSION); 793 return -1; 794 } 795 796 if (length != wpabuf_len(buf)) { 797 wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != " 798 "RX: %lu)", (unsigned long) length, 799 (unsigned long) wpabuf_len(buf)); 800 return -1; 801 } 802 803 if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0) 804 return -1; 805 806 if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) != 807 IKEV2_HDR_INITIATOR) { 808 wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x", 809 hdr->flags); 810 return -1; 811 } 812 813 if (data->state != SA_INIT) { 814 if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) { 815 wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA " 816 "Initiator's SPI"); 817 return -1; 818 } 819 if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) { 820 wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA " 821 "Responder's SPI"); 822 return -1; 823 } 824 } 825 826 pos = (const u8 *) (hdr + 1); 827 if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0) 828 return -1; 829 830 if (data->state == SA_INIT) { 831 data->last_msg = LAST_MSG_SA_INIT; 832 if (ikev2_process_sa_init(data, hdr, &pl) < 0) { 833 if (data->state == NOTIFY) 834 return 0; 835 return -1; 836 } 837 wpabuf_free(data->i_sign_msg); 838 data->i_sign_msg = wpabuf_dup(buf); 839 } 840 841 if (data->state == SA_AUTH) { 842 data->last_msg = LAST_MSG_SA_AUTH; 843 if (ikev2_process_sa_auth(data, hdr, &pl) < 0) { 844 if (data->state == NOTIFY) 845 return 0; 846 return -1; 847 } 848 } 849 850 return 0; 851} 852 853 854static void ikev2_build_hdr(struct ikev2_responder_data *data, 855 struct wpabuf *msg, u8 exchange_type, 856 u8 next_payload, u32 message_id) 857{ 858 struct ikev2_hdr *hdr; 859 860 wpa_printf(MSG_DEBUG, "IKEV2: Adding HDR"); 861 862 /* HDR - RFC 4306, Sect. 3.1 */ 863 hdr = wpabuf_put(msg, sizeof(*hdr)); 864 os_memcpy(hdr->i_spi, data->i_spi, IKEV2_SPI_LEN); 865 os_memcpy(hdr->r_spi, data->r_spi, IKEV2_SPI_LEN); 866 hdr->next_payload = next_payload; 867 hdr->version = IKEV2_VERSION; 868 hdr->exchange_type = exchange_type; 869 hdr->flags = IKEV2_HDR_RESPONSE; 870 WPA_PUT_BE32(hdr->message_id, message_id); 871} 872 873 874static int ikev2_build_sar1(struct ikev2_responder_data *data, 875 struct wpabuf *msg, u8 next_payload) 876{ 877 struct ikev2_payload_hdr *phdr; 878 size_t plen; 879 struct ikev2_proposal *p; 880 struct ikev2_transform *t; 881 882 wpa_printf(MSG_DEBUG, "IKEV2: Adding SAr1 payload"); 883 884 /* SAr1 - RFC 4306, Sect. 2.7 and 3.3 */ 885 phdr = wpabuf_put(msg, sizeof(*phdr)); 886 phdr->next_payload = next_payload; 887 phdr->flags = 0; 888 889 p = wpabuf_put(msg, sizeof(*p)); 890#ifdef CCNS_PL 891 /* Seems to require that the Proposal # is 1 even though RFC 4306 892 * Sect 3.3.1 has following requirement "When a proposal is accepted, 893 * all of the proposal numbers in the SA payload MUST be the same and 894 * MUST match the number on the proposal sent that was accepted.". 895 */ 896 p->proposal_num = 1; 897#else /* CCNS_PL */ 898 p->proposal_num = data->proposal.proposal_num; 899#endif /* CCNS_PL */ 900 p->protocol_id = IKEV2_PROTOCOL_IKE; 901 p->num_transforms = 4; 902 903 t = wpabuf_put(msg, sizeof(*t)); 904 t->type = 3; 905 t->transform_type = IKEV2_TRANSFORM_ENCR; 906 WPA_PUT_BE16(t->transform_id, data->proposal.encr); 907 if (data->proposal.encr == ENCR_AES_CBC) { 908 /* Transform Attribute: Key Len = 128 bits */ 909#ifdef CCNS_PL 910 wpabuf_put_be16(msg, 0x001d); /* ?? */ 911#else /* CCNS_PL */ 912 wpabuf_put_be16(msg, 0x800e); /* AF=1, AttrType=14 */ 913#endif /* CCNS_PL */ 914 wpabuf_put_be16(msg, 128); /* 128-bit key */ 915 } 916 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) t; 917 WPA_PUT_BE16(t->transform_length, plen); 918 919 t = wpabuf_put(msg, sizeof(*t)); 920 t->type = 3; 921 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 922 t->transform_type = IKEV2_TRANSFORM_PRF; 923 WPA_PUT_BE16(t->transform_id, data->proposal.prf); 924 925 t = wpabuf_put(msg, sizeof(*t)); 926 t->type = 3; 927 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 928 t->transform_type = IKEV2_TRANSFORM_INTEG; 929 WPA_PUT_BE16(t->transform_id, data->proposal.integ); 930 931 t = wpabuf_put(msg, sizeof(*t)); 932 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 933 t->transform_type = IKEV2_TRANSFORM_DH; 934 WPA_PUT_BE16(t->transform_id, data->proposal.dh); 935 936 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) p; 937 WPA_PUT_BE16(p->proposal_length, plen); 938 939 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 940 WPA_PUT_BE16(phdr->payload_length, plen); 941 942 return 0; 943} 944 945 946static int ikev2_build_ker(struct ikev2_responder_data *data, 947 struct wpabuf *msg, u8 next_payload) 948{ 949 struct ikev2_payload_hdr *phdr; 950 size_t plen; 951 struct wpabuf *pv; 952 953 wpa_printf(MSG_DEBUG, "IKEV2: Adding KEr payload"); 954 955 pv = dh_init(data->dh, &data->r_dh_private); 956 if (pv == NULL) { 957 wpa_printf(MSG_DEBUG, "IKEV2: Failed to initialize DH"); 958 return -1; 959 } 960 961 /* KEr - RFC 4306, Sect. 3.4 */ 962 phdr = wpabuf_put(msg, sizeof(*phdr)); 963 phdr->next_payload = next_payload; 964 phdr->flags = 0; 965 966 wpabuf_put_be16(msg, data->proposal.dh); /* DH Group # */ 967 wpabuf_put(msg, 2); /* RESERVED */ 968 /* 969 * RFC 4306, Sect. 3.4: possible zero padding for public value to 970 * match the length of the prime. 971 */ 972 wpabuf_put(msg, data->dh->prime_len - wpabuf_len(pv)); 973 wpabuf_put_buf(msg, pv); 974 wpabuf_free(pv); 975 976 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 977 WPA_PUT_BE16(phdr->payload_length, plen); 978 return 0; 979} 980 981 982static int ikev2_build_nr(struct ikev2_responder_data *data, 983 struct wpabuf *msg, u8 next_payload) 984{ 985 struct ikev2_payload_hdr *phdr; 986 size_t plen; 987 988 wpa_printf(MSG_DEBUG, "IKEV2: Adding Nr payload"); 989 990 /* Nr - RFC 4306, Sect. 3.9 */ 991 phdr = wpabuf_put(msg, sizeof(*phdr)); 992 phdr->next_payload = next_payload; 993 phdr->flags = 0; 994 wpabuf_put_data(msg, data->r_nonce, data->r_nonce_len); 995 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 996 WPA_PUT_BE16(phdr->payload_length, plen); 997 return 0; 998} 999 1000 1001static int ikev2_build_idr(struct ikev2_responder_data *data, 1002 struct wpabuf *msg, u8 next_payload) 1003{ 1004 struct ikev2_payload_hdr *phdr; 1005 size_t plen; 1006 1007 wpa_printf(MSG_DEBUG, "IKEV2: Adding IDr payload"); 1008 1009 if (data->IDr == NULL) { 1010 wpa_printf(MSG_INFO, "IKEV2: No IDr available"); 1011 return -1; 1012 } 1013 1014 /* IDr - RFC 4306, Sect. 3.5 */ 1015 phdr = wpabuf_put(msg, sizeof(*phdr)); 1016 phdr->next_payload = next_payload; 1017 phdr->flags = 0; 1018 wpabuf_put_u8(msg, ID_KEY_ID); 1019 wpabuf_put(msg, 3); /* RESERVED */ 1020 wpabuf_put_data(msg, data->IDr, data->IDr_len); 1021 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1022 WPA_PUT_BE16(phdr->payload_length, plen); 1023 return 0; 1024} 1025 1026 1027static int ikev2_build_auth(struct ikev2_responder_data *data, 1028 struct wpabuf *msg, u8 next_payload) 1029{ 1030 struct ikev2_payload_hdr *phdr; 1031 size_t plen; 1032 const struct ikev2_prf_alg *prf; 1033 1034 wpa_printf(MSG_DEBUG, "IKEV2: Adding AUTH payload"); 1035 1036 prf = ikev2_get_prf(data->proposal.prf); 1037 if (prf == NULL) 1038 return -1; 1039 1040 /* Authentication - RFC 4306, Sect. 3.8 */ 1041 phdr = wpabuf_put(msg, sizeof(*phdr)); 1042 phdr->next_payload = next_payload; 1043 phdr->flags = 0; 1044 wpabuf_put_u8(msg, AUTH_SHARED_KEY_MIC); 1045 wpabuf_put(msg, 3); /* RESERVED */ 1046 1047 /* msg | Ni | prf(SK_pr,IDr') */ 1048 if (ikev2_derive_auth_data(data->proposal.prf, data->r_sign_msg, 1049 data->IDr, data->IDr_len, ID_KEY_ID, 1050 &data->keys, 0, data->shared_secret, 1051 data->shared_secret_len, 1052 data->i_nonce, data->i_nonce_len, 1053 data->key_pad, data->key_pad_len, 1054 wpabuf_put(msg, prf->hash_len)) < 0) { 1055 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data"); 1056 return -1; 1057 } 1058 wpabuf_free(data->r_sign_msg); 1059 data->r_sign_msg = NULL; 1060 1061 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1062 WPA_PUT_BE16(phdr->payload_length, plen); 1063 return 0; 1064} 1065 1066 1067static int ikev2_build_notification(struct ikev2_responder_data *data, 1068 struct wpabuf *msg, u8 next_payload) 1069{ 1070 struct ikev2_payload_hdr *phdr; 1071 size_t plen; 1072 1073 wpa_printf(MSG_DEBUG, "IKEV2: Adding Notification payload"); 1074 1075 if (data->error_type == 0) { 1076 wpa_printf(MSG_INFO, "IKEV2: No Notify Message Type " 1077 "available"); 1078 return -1; 1079 } 1080 1081 /* Notify - RFC 4306, Sect. 3.10 */ 1082 phdr = wpabuf_put(msg, sizeof(*phdr)); 1083 phdr->next_payload = next_payload; 1084 phdr->flags = 0; 1085#ifdef CCNS_PL 1086 wpabuf_put_u8(msg, 1); /* Protocol ID: IKE_SA notification */ 1087#else /* CCNS_PL */ 1088 wpabuf_put_u8(msg, 0); /* Protocol ID: no existing SA */ 1089#endif /* CCNS_PL */ 1090 wpabuf_put_u8(msg, 0); /* SPI Size */ 1091 wpabuf_put_be16(msg, data->error_type); 1092 1093 switch (data->error_type) { 1094 case INVALID_KE_PAYLOAD: 1095 if (data->proposal.dh == -1) { 1096 wpa_printf(MSG_INFO, "IKEV2: No DH Group selected for " 1097 "INVALID_KE_PAYLOAD notifications"); 1098 return -1; 1099 } 1100 wpabuf_put_be16(msg, data->proposal.dh); 1101 wpa_printf(MSG_DEBUG, "IKEV2: INVALID_KE_PAYLOAD - request " 1102 "DH Group #%d", data->proposal.dh); 1103 break; 1104 case AUTHENTICATION_FAILED: 1105 /* no associated data */ 1106 break; 1107 default: 1108 wpa_printf(MSG_INFO, "IKEV2: Unsupported Notify Message Type " 1109 "%d", data->error_type); 1110 return -1; 1111 } 1112 1113 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1114 WPA_PUT_BE16(phdr->payload_length, plen); 1115 return 0; 1116} 1117 1118 1119static struct wpabuf * ikev2_build_sa_init(struct ikev2_responder_data *data) 1120{ 1121 struct wpabuf *msg; 1122 1123 /* build IKE_SA_INIT: HDR, SAr1, KEr, Nr, [CERTREQ], [SK{IDr}] */ 1124 1125 if (os_get_random(data->r_spi, IKEV2_SPI_LEN)) 1126 return NULL; 1127 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI", 1128 data->r_spi, IKEV2_SPI_LEN); 1129 1130 data->r_nonce_len = IKEV2_NONCE_MIN_LEN; 1131 if (random_get_bytes(data->r_nonce, data->r_nonce_len)) 1132 return NULL; 1133#ifdef CCNS_PL 1134 /* Zeros are removed incorrectly from the beginning of the nonces in 1135 * key derivation; as a workaround, make sure Nr does not start with 1136 * zero.. */ 1137 if (data->r_nonce[0] == 0) 1138 data->r_nonce[0] = 1; 1139#endif /* CCNS_PL */ 1140 wpa_hexdump(MSG_DEBUG, "IKEV2: Nr", data->r_nonce, data->r_nonce_len); 1141 1142 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1500); 1143 if (msg == NULL) 1144 return NULL; 1145 1146 ikev2_build_hdr(data, msg, IKE_SA_INIT, IKEV2_PAYLOAD_SA, 0); 1147 if (ikev2_build_sar1(data, msg, IKEV2_PAYLOAD_KEY_EXCHANGE) || 1148 ikev2_build_ker(data, msg, IKEV2_PAYLOAD_NONCE) || 1149 ikev2_build_nr(data, msg, data->peer_auth == PEER_AUTH_SECRET ? 1150 IKEV2_PAYLOAD_ENCRYPTED : 1151 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) { 1152 wpabuf_free(msg); 1153 return NULL; 1154 } 1155 1156 if (ikev2_derive_keys(data)) { 1157 wpabuf_free(msg); 1158 return NULL; 1159 } 1160 1161 if (data->peer_auth == PEER_AUTH_CERT) { 1162 /* TODO: CERTREQ with SHA-1 hashes of Subject Public Key Info 1163 * for trust agents */ 1164 } 1165 1166 if (data->peer_auth == PEER_AUTH_SECRET) { 1167 struct wpabuf *plain = wpabuf_alloc(data->IDr_len + 1000); 1168 if (plain == NULL) { 1169 wpabuf_free(msg); 1170 return NULL; 1171 } 1172 if (ikev2_build_idr(data, plain, 1173 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1174 ikev2_build_encrypted(data->proposal.encr, 1175 data->proposal.integ, 1176 &data->keys, 0, msg, plain, 1177 IKEV2_PAYLOAD_IDr)) { 1178 wpabuf_free(plain); 1179 wpabuf_free(msg); 1180 return NULL; 1181 } 1182 wpabuf_free(plain); 1183 } 1184 1185 ikev2_update_hdr(msg); 1186 1187 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_INIT)", msg); 1188 1189 data->state = SA_AUTH; 1190 1191 wpabuf_free(data->r_sign_msg); 1192 data->r_sign_msg = wpabuf_dup(msg); 1193 1194 return msg; 1195} 1196 1197 1198static struct wpabuf * ikev2_build_sa_auth(struct ikev2_responder_data *data) 1199{ 1200 struct wpabuf *msg, *plain; 1201 1202 /* build IKE_SA_AUTH: HDR, SK {IDr, [CERT,] AUTH} */ 1203 1204 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1000); 1205 if (msg == NULL) 1206 return NULL; 1207 ikev2_build_hdr(data, msg, IKE_SA_AUTH, IKEV2_PAYLOAD_ENCRYPTED, 1); 1208 1209 plain = wpabuf_alloc(data->IDr_len + 1000); 1210 if (plain == NULL) { 1211 wpabuf_free(msg); 1212 return NULL; 1213 } 1214 1215 if (ikev2_build_idr(data, plain, IKEV2_PAYLOAD_AUTHENTICATION) || 1216 ikev2_build_auth(data, plain, IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1217 ikev2_build_encrypted(data->proposal.encr, data->proposal.integ, 1218 &data->keys, 0, msg, plain, 1219 IKEV2_PAYLOAD_IDr)) { 1220 wpabuf_free(plain); 1221 wpabuf_free(msg); 1222 return NULL; 1223 } 1224 wpabuf_free(plain); 1225 1226 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_AUTH)", msg); 1227 1228 data->state = IKEV2_DONE; 1229 1230 return msg; 1231} 1232 1233 1234static struct wpabuf * ikev2_build_notify(struct ikev2_responder_data *data) 1235{ 1236 struct wpabuf *msg; 1237 1238 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + 1000); 1239 if (msg == NULL) 1240 return NULL; 1241 if (data->last_msg == LAST_MSG_SA_AUTH) { 1242 /* HDR, SK{N} */ 1243 struct wpabuf *plain = wpabuf_alloc(100); 1244 if (plain == NULL) { 1245 wpabuf_free(msg); 1246 return NULL; 1247 } 1248 ikev2_build_hdr(data, msg, IKE_SA_AUTH, 1249 IKEV2_PAYLOAD_ENCRYPTED, 1); 1250 if (ikev2_build_notification(data, plain, 1251 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1252 ikev2_build_encrypted(data->proposal.encr, 1253 data->proposal.integ, 1254 &data->keys, 0, msg, plain, 1255 IKEV2_PAYLOAD_NOTIFICATION)) { 1256 wpabuf_free(plain); 1257 wpabuf_free(msg); 1258 return NULL; 1259 } 1260 data->state = IKEV2_FAILED; 1261 } else { 1262 /* HDR, N */ 1263 ikev2_build_hdr(data, msg, IKE_SA_INIT, 1264 IKEV2_PAYLOAD_NOTIFICATION, 0); 1265 if (ikev2_build_notification(data, msg, 1266 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) { 1267 wpabuf_free(msg); 1268 return NULL; 1269 } 1270 data->state = SA_INIT; 1271 } 1272 1273 ikev2_update_hdr(msg); 1274 1275 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (Notification)", 1276 msg); 1277 1278 return msg; 1279} 1280 1281 1282struct wpabuf * ikev2_responder_build(struct ikev2_responder_data *data) 1283{ 1284 switch (data->state) { 1285 case SA_INIT: 1286 return ikev2_build_sa_init(data); 1287 case SA_AUTH: 1288 return ikev2_build_sa_auth(data); 1289 case CHILD_SA: 1290 return NULL; 1291 case NOTIFY: 1292 return ikev2_build_notify(data); 1293 case IKEV2_DONE: 1294 case IKEV2_FAILED: 1295 return NULL; 1296 } 1297 return NULL; 1298} 1299