ikev2.c revision 214734
155714Skris/* 2296465Sdelphij * IKEv2 responder (RFC 4306) for EAP-IKEV2 3296465Sdelphij * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 4160814Ssimon * 555714Skris * This program is free software; you can redistribute it and/or modify 655714Skris * it under the terms of the GNU General Public License version 2 as 7160814Ssimon * published by the Free Software Foundation. 855714Skris * 955714Skris * Alternatively, this software may be distributed under the terms of BSD 1055714Skris * license. 1155714Skris * 1255714Skris * See README and COPYING for more details. 1355714Skris */ 14296465Sdelphij 1555714Skris#include "includes.h" 1655714Skris 1755714Skris#include "common.h" 1855714Skris#include "crypto/dh_groups.h" 1955714Skris#include "ikev2.h" 2055714Skris 2155714Skris 2255714Skrisvoid ikev2_responder_deinit(struct ikev2_responder_data *data) 2355714Skris{ 2455714Skris ikev2_free_keys(&data->keys); 2555714Skris wpabuf_free(data->i_dh_public); 2655714Skris wpabuf_free(data->r_dh_private); 2755714Skris os_free(data->IDi); 2855714Skris os_free(data->IDr); 2955714Skris os_free(data->shared_secret); 3055714Skris wpabuf_free(data->i_sign_msg); 3155714Skris wpabuf_free(data->r_sign_msg); 3255714Skris os_free(data->key_pad); 3355714Skris} 3455714Skris 3555714Skris 3655714Skrisstatic int ikev2_derive_keys(struct ikev2_responder_data *data) 3755714Skris{ 3855714Skris u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN]; 3955714Skris size_t buf_len, pad_len; 4055714Skris struct wpabuf *shared; 4155714Skris const struct ikev2_integ_alg *integ; 4255714Skris const struct ikev2_prf_alg *prf; 4355714Skris const struct ikev2_encr_alg *encr; 4455714Skris int ret; 4555714Skris const u8 *addr[2]; 4655714Skris size_t len[2]; 4755714Skris 4855714Skris /* RFC 4306, Sect. 2.14 */ 4955714Skris 5055714Skris integ = ikev2_get_integ(data->proposal.integ); 5155714Skris prf = ikev2_get_prf(data->proposal.prf); 5255714Skris encr = ikev2_get_encr(data->proposal.encr); 5355714Skris if (integ == NULL || prf == NULL || encr == NULL) { 5455714Skris wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal"); 5555714Skris return -1; 5655714Skris } 5755714Skris 5855714Skris shared = dh_derive_shared(data->i_dh_public, data->r_dh_private, 5955714Skris data->dh); 6055714Skris if (shared == NULL) 6155714Skris return -1; 6255714Skris 6355714Skris /* Construct Ni | Nr | SPIi | SPIr */ 6455714Skris 6555714Skris buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN; 66160814Ssimon buf = os_malloc(buf_len); 6755714Skris if (buf == NULL) { 6855714Skris wpabuf_free(shared); 69296465Sdelphij return -1; 70109998Smarkm } 7168651Skris 72296465Sdelphij pos = buf; 7355714Skris os_memcpy(pos, data->i_nonce, data->i_nonce_len); 74160814Ssimon pos += data->i_nonce_len; 75160814Ssimon os_memcpy(pos, data->r_nonce, data->r_nonce_len); 76160814Ssimon pos += data->r_nonce_len; 77160814Ssimon os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN); 78160814Ssimon pos += IKEV2_SPI_LEN; 7955714Skris os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN); 8055714Skris#ifdef CCNS_PL 8155714Skris#if __BYTE_ORDER == __LITTLE_ENDIAN 82296465Sdelphij { 8355714Skris int i; 84296465Sdelphij u8 *tmp = pos - IKEV2_SPI_LEN; 85296465Sdelphij /* Incorrect byte re-ordering on little endian hosts.. */ 86296465Sdelphij for (i = 0; i < IKEV2_SPI_LEN; i++) 87296465Sdelphij *tmp++ = data->i_spi[IKEV2_SPI_LEN - 1 - i]; 88296465Sdelphij for (i = 0; i < IKEV2_SPI_LEN; i++) 89296465Sdelphij *tmp++ = data->r_spi[IKEV2_SPI_LEN - 1 - i]; 90296465Sdelphij } 91296465Sdelphij#endif 92296465Sdelphij#endif /* CCNS_PL */ 93296465Sdelphij 94296465Sdelphij /* SKEYSEED = prf(Ni | Nr, g^ir) */ 95296465Sdelphij /* Use zero-padding per RFC 4306, Sect. 2.14 */ 96296465Sdelphij pad_len = data->dh->prime_len - wpabuf_len(shared); 97296465Sdelphij#ifdef CCNS_PL 98296465Sdelphij /* Shared secret is not zero-padded correctly */ 99296465Sdelphij pad_len = 0; 100296465Sdelphij#endif /* CCNS_PL */ 101296465Sdelphij pad = os_zalloc(pad_len ? pad_len : 1); 102296465Sdelphij if (pad == NULL) { 103296465Sdelphij wpabuf_free(shared); 104296465Sdelphij os_free(buf); 105296465Sdelphij return -1; 106296465Sdelphij } 107296465Sdelphij 108296465Sdelphij addr[0] = pad; 10955714Skris len[0] = pad_len; 11055714Skris addr[1] = wpabuf_head(shared); 11155714Skris len[1] = wpabuf_len(shared); 112296465Sdelphij if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len, 113296465Sdelphij 2, addr, len, skeyseed) < 0) { 114296465Sdelphij wpabuf_free(shared); 115296465Sdelphij os_free(buf); 11655714Skris os_free(pad); 11755714Skris return -1; 11855714Skris } 11955714Skris os_free(pad); 12055714Skris wpabuf_free(shared); 121296465Sdelphij 122296465Sdelphij /* DH parameters are not needed anymore, so free them */ 123296465Sdelphij wpabuf_free(data->i_dh_public); 124296465Sdelphij data->i_dh_public = NULL; 125296465Sdelphij wpabuf_free(data->r_dh_private); 126296465Sdelphij data->r_dh_private = NULL; 127296465Sdelphij 128296465Sdelphij wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED", 129296465Sdelphij skeyseed, prf->hash_len); 13055714Skris 13155714Skris ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len, 13255714Skris &data->keys); 133296465Sdelphij os_free(buf); 13455714Skris return ret; 135296465Sdelphij} 136296465Sdelphij 137296465Sdelphij 13855714Skrisstatic int ikev2_parse_transform(struct ikev2_proposal_data *prop, 13955714Skris const u8 *pos, const u8 *end) 14055714Skris{ 141296465Sdelphij int transform_len; 14255714Skris const struct ikev2_transform *t; 143296465Sdelphij u16 transform_id; 144296465Sdelphij const u8 *tend; 145296465Sdelphij 14655714Skris if (end - pos < (int) sizeof(*t)) { 14755714Skris wpa_printf(MSG_INFO, "IKEV2: Too short transform"); 14855714Skris return -1; 14955714Skris } 150296465Sdelphij 151296465Sdelphij t = (const struct ikev2_transform *) pos; 152296465Sdelphij transform_len = WPA_GET_BE16(t->transform_length); 153296465Sdelphij if (transform_len < (int) sizeof(*t) || pos + transform_len > end) { 154296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Invalid transform length %d", 155296465Sdelphij transform_len); 156296465Sdelphij return -1; 157296465Sdelphij } 158296465Sdelphij tend = pos + transform_len; 15955714Skris 16055714Skris transform_id = WPA_GET_BE16(t->transform_id); 16155714Skris 16255714Skris wpa_printf(MSG_DEBUG, "IKEV2: Transform:"); 163296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Transform Length: %d " 164296465Sdelphij "Transform Type: %d Transform ID: %d", 165296465Sdelphij t->type, transform_len, t->transform_type, transform_id); 166296465Sdelphij 167296465Sdelphij if (t->type != 0 && t->type != 3) { 168296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Transform type"); 169296465Sdelphij return -1; 170296465Sdelphij } 171296465Sdelphij 17255714Skris pos = (const u8 *) (t + 1); 17355714Skris if (pos < tend) { 17455714Skris wpa_hexdump(MSG_DEBUG, "IKEV2: Transform Attributes", 17555714Skris pos, tend - pos); 176296465Sdelphij } 177296465Sdelphij 178296465Sdelphij switch (t->transform_type) { 179296465Sdelphij case IKEV2_TRANSFORM_ENCR: 180296465Sdelphij if (ikev2_get_encr(transform_id)) { 181296465Sdelphij if (transform_id == ENCR_AES_CBC) { 182296465Sdelphij if (tend - pos != 4) { 183296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: No " 184296465Sdelphij "Transform Attr for AES"); 185296465Sdelphij break; 186296465Sdelphij } 187296465Sdelphij#ifdef CCNS_PL 188296465Sdelphij if (WPA_GET_BE16(pos) != 0x001d /* ?? */) { 189296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Not a " 190109998Smarkm "Key Size attribute for " 191296465Sdelphij "AES"); 192296465Sdelphij break; 193296465Sdelphij } 194296465Sdelphij#else /* CCNS_PL */ 195296465Sdelphij if (WPA_GET_BE16(pos) != 0x800e) { 196109998Smarkm wpa_printf(MSG_DEBUG, "IKEV2: Not a " 197296465Sdelphij "Key Size attribute for " 198296465Sdelphij "AES"); 199296465Sdelphij break; 200296465Sdelphij } 201109998Smarkm#endif /* CCNS_PL */ 202296465Sdelphij if (WPA_GET_BE16(pos + 2) != 128) { 203296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: " 204296465Sdelphij "Unsupported AES key size " 205296465Sdelphij "%d bits", 206296465Sdelphij WPA_GET_BE16(pos + 2)); 20755714Skris break; 208296465Sdelphij } 209296465Sdelphij } 210109998Smarkm prop->encr = transform_id; 211296465Sdelphij } 212296465Sdelphij break; 213296465Sdelphij case IKEV2_TRANSFORM_PRF: 214296465Sdelphij if (ikev2_get_prf(transform_id)) 215296465Sdelphij prop->prf = transform_id; 216296465Sdelphij break; 217296465Sdelphij case IKEV2_TRANSFORM_INTEG: 218296465Sdelphij if (ikev2_get_integ(transform_id)) 219296465Sdelphij prop->integ = transform_id; 220296465Sdelphij break; 22155714Skris case IKEV2_TRANSFORM_DH: 22255714Skris if (dh_groups_get(transform_id)) 22355714Skris prop->dh = transform_id; 224296465Sdelphij break; 22555714Skris } 226296465Sdelphij 227296465Sdelphij return transform_len; 228296465Sdelphij} 229296465Sdelphij 230296465Sdelphij 231296465Sdelphijstatic int ikev2_parse_proposal(struct ikev2_proposal_data *prop, 232296465Sdelphij const u8 *pos, const u8 *end) 233296465Sdelphij{ 234296465Sdelphij const u8 *pend, *ppos; 23555714Skris int proposal_len, i; 23655714Skris const struct ikev2_proposal *p; 23755714Skris 23855714Skris if (end - pos < (int) sizeof(*p)) { 239296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Too short proposal"); 240296465Sdelphij return -1; 241296465Sdelphij } 242296465Sdelphij 243296465Sdelphij /* FIX: AND processing if multiple proposals use the same # */ 244296465Sdelphij 245296465Sdelphij p = (const struct ikev2_proposal *) pos; 246296465Sdelphij proposal_len = WPA_GET_BE16(p->proposal_length); 247296465Sdelphij if (proposal_len < (int) sizeof(*p) || pos + proposal_len > end) { 248296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Invalid proposal length %d", 249296465Sdelphij proposal_len); 250296465Sdelphij return -1; 251296465Sdelphij } 252296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: SAi1 Proposal # %d", 253296465Sdelphij p->proposal_num); 254296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Proposal Length: %d " 255296465Sdelphij " Protocol ID: %d", 256296465Sdelphij p->type, proposal_len, p->protocol_id); 257296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: SPI Size: %d Transforms: %d", 25855714Skris p->spi_size, p->num_transforms); 25955714Skris 26055714Skris if (p->type != 0 && p->type != 2) { 26155714Skris wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal type"); 262296465Sdelphij return -1; 263296465Sdelphij } 264296465Sdelphij 265296465Sdelphij if (p->protocol_id != IKEV2_PROTOCOL_IKE) { 266296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Unexpected Protocol ID " 267296465Sdelphij "(only IKE allowed for EAP-IKEv2)"); 268296465Sdelphij return -1; 26955714Skris } 27055714Skris 271296465Sdelphij if (p->proposal_num != prop->proposal_num) { 272296465Sdelphij if (p->proposal_num == prop->proposal_num + 1) 27355714Skris prop->proposal_num = p->proposal_num; 274296465Sdelphij else { 275296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal #"); 276296465Sdelphij return -1; 27755714Skris } 278109998Smarkm } 27955714Skris 280296465Sdelphij ppos = (const u8 *) (p + 1); 281296465Sdelphij pend = pos + proposal_len; 282296465Sdelphij if (ppos + p->spi_size > pend) { 283296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Not enough room for SPI " 284296465Sdelphij "in proposal"); 285296465Sdelphij return -1; 286296465Sdelphij } 287296465Sdelphij if (p->spi_size) { 288296465Sdelphij wpa_hexdump(MSG_DEBUG, "IKEV2: SPI", 289296465Sdelphij ppos, p->spi_size); 290296465Sdelphij ppos += p->spi_size; 291296465Sdelphij } 29255714Skris 293296465Sdelphij /* 294296465Sdelphij * For initial IKE_SA negotiation, SPI Size MUST be zero; for 295296465Sdelphij * subsequent negotiations, it must be 8 for IKE. We only support 296296465Sdelphij * initial case for now. 297296465Sdelphij */ 298296465Sdelphij if (p->spi_size != 0) { 299296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected SPI Size"); 300296465Sdelphij return -1; 301296465Sdelphij } 302296465Sdelphij 303296465Sdelphij if (p->num_transforms == 0) { 304296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: At least one transform required"); 305296465Sdelphij return -1; 306296465Sdelphij } 307296465Sdelphij 308296465Sdelphij for (i = 0; i < (int) p->num_transforms; i++) { 309100928Snectar int tlen = ikev2_parse_transform(prop, ppos, pend); 310296465Sdelphij if (tlen < 0) 31155714Skris return -1; 312296465Sdelphij ppos += tlen; 313296465Sdelphij } 314296465Sdelphij 315296465Sdelphij if (ppos != pend) { 316296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected data after " 317296465Sdelphij "transforms"); 318296465Sdelphij return -1; 319296465Sdelphij } 32055714Skris 321296465Sdelphij return proposal_len; 322296465Sdelphij} 323296465Sdelphij 324296465Sdelphij 325296465Sdelphijstatic int ikev2_process_sai1(struct ikev2_responder_data *data, 326100928Snectar const u8 *sai1, size_t sai1_len) 327296465Sdelphij{ 32855714Skris struct ikev2_proposal_data prop; 329296465Sdelphij const u8 *pos, *end; 330296465Sdelphij int found = 0; 331296465Sdelphij 332296465Sdelphij /* Security Association Payloads: <Proposals> */ 333296465Sdelphij 334296465Sdelphij if (sai1 == NULL) { 335296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: SAi1 not received"); 336296465Sdelphij return -1; 337296465Sdelphij } 33855714Skris 339296465Sdelphij os_memset(&prop, 0, sizeof(prop)); 340296465Sdelphij prop.proposal_num = 1; 34155714Skris 342296465Sdelphij pos = sai1; 343296465Sdelphij end = sai1 + sai1_len; 344100928Snectar 345296465Sdelphij while (pos < end) { 34655714Skris int plen; 347296465Sdelphij 348296465Sdelphij prop.integ = -1; 349296465Sdelphij prop.prf = -1; 350296465Sdelphij prop.encr = -1; 351296465Sdelphij prop.dh = -1; 352296465Sdelphij plen = ikev2_parse_proposal(&prop, pos, end); 353296465Sdelphij if (plen < 0) 354296465Sdelphij return -1; 355100928Snectar 356296465Sdelphij if (!found && prop.integ != -1 && prop.prf != -1 && 35755714Skris prop.encr != -1 && prop.dh != -1) { 358296465Sdelphij os_memcpy(&data->proposal, &prop, sizeof(prop)); 359296465Sdelphij data->dh = dh_groups_get(prop.dh); 360296465Sdelphij found = 1; 361296465Sdelphij } 362296465Sdelphij 363296465Sdelphij pos += plen; 364296465Sdelphij } 365296465Sdelphij 36655714Skris if (pos != end) { 367296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected data after proposals"); 368296465Sdelphij return -1; 369296465Sdelphij } 370296465Sdelphij 37155714Skris if (!found) { 37255714Skris wpa_printf(MSG_INFO, "IKEV2: No acceptable proposal found"); 37355714Skris return -1; 37455714Skris } 37555714Skris 37655714Skris wpa_printf(MSG_DEBUG, "IKEV2: Accepted proposal #%d: ENCR:%d PRF:%d " 377296465Sdelphij "INTEG:%d D-H:%d", data->proposal.proposal_num, 378296465Sdelphij data->proposal.encr, data->proposal.prf, 379296465Sdelphij data->proposal.integ, data->proposal.dh); 380296465Sdelphij 381296465Sdelphij return 0; 382296465Sdelphij} 383296465Sdelphij 384296465Sdelphij 385296465Sdelphijstatic int ikev2_process_kei(struct ikev2_responder_data *data, 386296465Sdelphij const u8 *kei, size_t kei_len) 387296465Sdelphij{ 388296465Sdelphij u16 group; 389296465Sdelphij 390296465Sdelphij /* 391296465Sdelphij * Key Exchange Payload: 39255714Skris * DH Group # (16 bits) 39355714Skris * RESERVED (16 bits) 39455714Skris * Key Exchange Data (Diffie-Hellman public value) 39555714Skris */ 396296465Sdelphij 397296465Sdelphij if (kei == NULL) { 398296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: KEi not received"); 399296465Sdelphij return -1; 40055714Skris } 40155714Skris 40255714Skris if (kei_len < 4 + 96) { 40355714Skris wpa_printf(MSG_INFO, "IKEV2: Too show Key Exchange Payload"); 404296465Sdelphij return -1; 405296465Sdelphij } 406296465Sdelphij 407296465Sdelphij group = WPA_GET_BE16(kei); 408296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u", group); 409296465Sdelphij 410296465Sdelphij if (group != data->proposal.dh) { 411296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u does not match " 412296465Sdelphij "with the selected proposal (%u)", 413296465Sdelphij group, data->proposal.dh); 414296465Sdelphij /* Reject message with Notify payload of type 415296465Sdelphij * INVALID_KE_PAYLOAD (RFC 4306, Sect. 3.4) */ 416296465Sdelphij data->error_type = INVALID_KE_PAYLOAD; 417296465Sdelphij data->state = NOTIFY; 418296465Sdelphij return -1; 419296465Sdelphij } 420296465Sdelphij 42168651Skris if (data->dh == NULL) { 422296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unsupported DH group"); 42368651Skris return -1; 42468651Skris } 425296465Sdelphij 42655714Skris /* RFC 4306, Section 3.4: 42755714Skris * The length of DH public value MUST be equal to the lenght of the 428296465Sdelphij * prime modulus. 429296465Sdelphij */ 43055714Skris if (kei_len - 4 != data->dh->prime_len) { 43155714Skris wpa_printf(MSG_INFO, "IKEV2: Invalid DH public value length " 43255714Skris "%ld (expected %ld)", 43355714Skris (long) (kei_len - 4), (long) data->dh->prime_len); 434296465Sdelphij return -1; 435296465Sdelphij } 436296465Sdelphij 437296465Sdelphij wpabuf_free(data->i_dh_public); 438296465Sdelphij data->i_dh_public = wpabuf_alloc(kei_len - 4); 439296465Sdelphij if (data->i_dh_public == NULL) 440296465Sdelphij return -1; 441296465Sdelphij wpabuf_put_data(data->i_dh_public, kei + 4, kei_len - 4); 442296465Sdelphij 443296465Sdelphij wpa_hexdump_buf(MSG_DEBUG, "IKEV2: KEi Diffie-Hellman Public Value", 44468651Skris data->i_dh_public); 445296465Sdelphij 44668651Skris return 0; 447296465Sdelphij} 448296465Sdelphij 449296465Sdelphij 45068651Skrisstatic int ikev2_process_ni(struct ikev2_responder_data *data, 451296465Sdelphij const u8 *ni, size_t ni_len) 45268651Skris{ 453296465Sdelphij if (ni == NULL) { 454296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Ni not received"); 455296465Sdelphij return -1; 456296465Sdelphij } 457296465Sdelphij 458296465Sdelphij if (ni_len < IKEV2_NONCE_MIN_LEN || ni_len > IKEV2_NONCE_MAX_LEN) { 459296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Invalid Ni length %ld", 460296465Sdelphij (long) ni_len); 461296465Sdelphij return -1; 46255714Skris } 463296465Sdelphij 464296465Sdelphij#ifdef CCNS_PL 465296465Sdelphij /* Zeros are removed incorrectly from the beginning of the nonces */ 466296465Sdelphij while (ni_len > 1 && *ni == 0) { 467296465Sdelphij ni_len--; 468296465Sdelphij ni++; 46955714Skris } 470296465Sdelphij#endif /* CCNS_PL */ 471296465Sdelphij 472296465Sdelphij data->i_nonce_len = ni_len; 473296465Sdelphij os_memcpy(data->i_nonce, ni, ni_len); 474296465Sdelphij wpa_hexdump(MSG_MSGDUMP, "IKEV2: Ni", 475296465Sdelphij data->i_nonce, data->i_nonce_len); 47655714Skris 477296465Sdelphij return 0; 478296465Sdelphij} 47955714Skris 480296465Sdelphij 481296465Sdelphijstatic int ikev2_process_sa_init(struct ikev2_responder_data *data, 48255714Skris const struct ikev2_hdr *hdr, 483296465Sdelphij struct ikev2_payloads *pl) 48455714Skris{ 485296465Sdelphij if (ikev2_process_sai1(data, pl->sa, pl->sa_len) < 0 || 486296465Sdelphij ikev2_process_kei(data, pl->ke, pl->ke_len) < 0 || 487296465Sdelphij ikev2_process_ni(data, pl->nonce, pl->nonce_len) < 0) 488296465Sdelphij return -1; 489296465Sdelphij 49055714Skris os_memcpy(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN); 491296465Sdelphij 492296465Sdelphij return 0; 493296465Sdelphij} 494296465Sdelphij 49555714Skris 49655714Skrisstatic int ikev2_process_idi(struct ikev2_responder_data *data, 49755714Skris const u8 *idi, size_t idi_len) 498296465Sdelphij{ 499296465Sdelphij u8 id_type; 50055714Skris 50155714Skris if (idi == NULL) { 50255714Skris wpa_printf(MSG_INFO, "IKEV2: No IDi received"); 50355714Skris return -1; 504296465Sdelphij } 505296465Sdelphij 506296465Sdelphij if (idi_len < 4) { 507296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Too short IDi payload"); 508296465Sdelphij return -1; 509296465Sdelphij } 510296465Sdelphij 511296465Sdelphij id_type = idi[0]; 512296465Sdelphij idi += 4; 51355714Skris idi_len -= 4; 51468651Skris 515296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: IDi ID Type %d", id_type); 51668651Skris wpa_hexdump_ascii(MSG_DEBUG, "IKEV2: IDi", idi, idi_len); 517296465Sdelphij os_free(data->IDi); 51868651Skris data->IDi = os_malloc(idi_len); 51968651Skris if (data->IDi == NULL) 52068651Skris return -1; 52168651Skris os_memcpy(data->IDi, idi, idi_len); 522296465Sdelphij data->IDi_len = idi_len; 523296465Sdelphij data->IDi_type = id_type; 524296465Sdelphij 525296465Sdelphij return 0; 526296465Sdelphij} 527296465Sdelphij 52868651Skris 52968651Skrisstatic int ikev2_process_cert(struct ikev2_responder_data *data, 530194206Ssimon const u8 *cert, size_t cert_len) 531194206Ssimon{ 532296465Sdelphij u8 cert_encoding; 533296465Sdelphij 534296465Sdelphij if (cert == NULL) { 535296465Sdelphij if (data->peer_auth == PEER_AUTH_CERT) { 536296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: No Certificate received"); 537296465Sdelphij return -1; 538296465Sdelphij } 539296465Sdelphij return 0; 540296465Sdelphij } 541296465Sdelphij 542296465Sdelphij if (cert_len < 1) { 543296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: No Cert Encoding field"); 544296465Sdelphij return -1; 545296465Sdelphij } 546296465Sdelphij 547296465Sdelphij cert_encoding = cert[0]; 548296465Sdelphij cert++; 549296465Sdelphij cert_len--; 550194206Ssimon 551194206Ssimon wpa_printf(MSG_DEBUG, "IKEV2: Cert Encoding %d", cert_encoding); 55268651Skris wpa_hexdump(MSG_MSGDUMP, "IKEV2: Certificate Data", cert, cert_len); 55368651Skris 554296465Sdelphij /* TODO: validate certificate */ 555296465Sdelphij 556296465Sdelphij return 0; 557296465Sdelphij} 558296465Sdelphij 559296465Sdelphij 560296465Sdelphijstatic int ikev2_process_auth_cert(struct ikev2_responder_data *data, 561296465Sdelphij u8 method, const u8 *auth, size_t auth_len) 562296465Sdelphij{ 56368651Skris if (method != AUTH_RSA_SIGN) { 56468651Skris wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication " 565109998Smarkm "method %d", method); 56668651Skris return -1; 567296465Sdelphij } 568296465Sdelphij 569296465Sdelphij /* TODO: validate AUTH */ 570296465Sdelphij return 0; 571296465Sdelphij} 572296465Sdelphij 573296465Sdelphij 574296465Sdelphijstatic int ikev2_process_auth_secret(struct ikev2_responder_data *data, 575296465Sdelphij u8 method, const u8 *auth, 576296465Sdelphij size_t auth_len) 577296465Sdelphij{ 578296465Sdelphij u8 auth_data[IKEV2_MAX_HASH_LEN]; 579296465Sdelphij const struct ikev2_prf_alg *prf; 580296465Sdelphij 581296465Sdelphij if (method != AUTH_SHARED_KEY_MIC) { 582296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication " 583296465Sdelphij "method %d", method); 584296465Sdelphij return -1; 585296465Sdelphij } 586296465Sdelphij 587296465Sdelphij /* msg | Nr | prf(SK_pi,IDi') */ 588296465Sdelphij if (ikev2_derive_auth_data(data->proposal.prf, data->i_sign_msg, 589296465Sdelphij data->IDi, data->IDi_len, data->IDi_type, 59068651Skris &data->keys, 1, data->shared_secret, 59168651Skris data->shared_secret_len, 59268651Skris data->r_nonce, data->r_nonce_len, 59368651Skris data->key_pad, data->key_pad_len, 594296465Sdelphij auth_data) < 0) { 59568651Skris wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data"); 59668651Skris return -1; 597296465Sdelphij } 59868651Skris 599296465Sdelphij wpabuf_free(data->i_sign_msg); 600296465Sdelphij data->i_sign_msg = NULL; 601296465Sdelphij 602296465Sdelphij prf = ikev2_get_prf(data->proposal.prf); 603296465Sdelphij if (prf == NULL) 604296465Sdelphij return -1; 605296465Sdelphij 606296465Sdelphij if (auth_len != prf->hash_len || 607296465Sdelphij os_memcmp(auth, auth_data, auth_len) != 0) { 608296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Invalid Authentication Data"); 609296465Sdelphij wpa_hexdump(MSG_DEBUG, "IKEV2: Received Authentication Data", 610296465Sdelphij auth, auth_len); 611296465Sdelphij wpa_hexdump(MSG_DEBUG, "IKEV2: Expected Authentication Data", 612296465Sdelphij auth_data, prf->hash_len); 613296465Sdelphij data->error_type = AUTHENTICATION_FAILED; 614296465Sdelphij data->state = NOTIFY; 615296465Sdelphij return -1; 616296465Sdelphij } 617296465Sdelphij 618296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Server authenticated successfully " 61968651Skris "using shared keys"); 62068651Skris 621296465Sdelphij return 0; 62268651Skris} 623296465Sdelphij 62468651Skris 625160814Ssimonstatic int ikev2_process_auth(struct ikev2_responder_data *data, 626296465Sdelphij const u8 *auth, size_t auth_len) 627296465Sdelphij{ 628296465Sdelphij u8 auth_method; 629160814Ssimon 630160814Ssimon if (auth == NULL) { 631160814Ssimon wpa_printf(MSG_INFO, "IKEV2: No Authentication Payload"); 632296465Sdelphij return -1; 633296465Sdelphij } 634296465Sdelphij 635296465Sdelphij if (auth_len < 4) { 636160814Ssimon wpa_printf(MSG_INFO, "IKEV2: Too short Authentication " 637296465Sdelphij "Payload"); 638160814Ssimon return -1; 639296465Sdelphij } 640160814Ssimon 641296465Sdelphij auth_method = auth[0]; 642296465Sdelphij auth += 4; 643160814Ssimon auth_len -= 4; 644296465Sdelphij 645296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Auth Method %d", auth_method); 646296465Sdelphij wpa_hexdump(MSG_MSGDUMP, "IKEV2: Authentication Data", auth, auth_len); 647296465Sdelphij 648296465Sdelphij switch (data->peer_auth) { 649296465Sdelphij case PEER_AUTH_CERT: 650296465Sdelphij return ikev2_process_auth_cert(data, auth_method, auth, 651296465Sdelphij auth_len); 652296465Sdelphij case PEER_AUTH_SECRET: 653160814Ssimon return ikev2_process_auth_secret(data, auth_method, auth, 654160814Ssimon auth_len); 655296465Sdelphij } 656296465Sdelphij 657296465Sdelphij return -1; 658296465Sdelphij} 659296465Sdelphij 660296465Sdelphij 661296465Sdelphijstatic int ikev2_process_sa_auth_decrypted(struct ikev2_responder_data *data, 662296465Sdelphij u8 next_payload, 663296465Sdelphij u8 *payload, size_t payload_len) 664296465Sdelphij{ 665296465Sdelphij struct ikev2_payloads pl; 666296465Sdelphij 667296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Processing decrypted payloads"); 668160814Ssimon 669296465Sdelphij if (ikev2_parse_payloads(&pl, next_payload, payload, payload + 670160814Ssimon payload_len) < 0) { 671296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Failed to parse decrypted " 672296465Sdelphij "payloads"); 673160814Ssimon return -1; 674296465Sdelphij } 675160814Ssimon 676296465Sdelphij if (ikev2_process_idi(data, pl.idi, pl.idi_len) < 0 || 677296465Sdelphij ikev2_process_cert(data, pl.cert, pl.cert_len) < 0 || 678160814Ssimon ikev2_process_auth(data, pl.auth, pl.auth_len) < 0) 679296465Sdelphij return -1; 680296465Sdelphij 681160814Ssimon return 0; 682296465Sdelphij} 683296465Sdelphij 684296465Sdelphij 685296465Sdelphijstatic int ikev2_process_sa_auth(struct ikev2_responder_data *data, 686296465Sdelphij const struct ikev2_hdr *hdr, 687160814Ssimon struct ikev2_payloads *pl) 688296465Sdelphij{ 689160814Ssimon u8 *decrypted; 690296465Sdelphij size_t decrypted_len; 691296465Sdelphij int ret; 692296465Sdelphij 693296465Sdelphij decrypted = ikev2_decrypt_payload(data->proposal.encr, 694296465Sdelphij data->proposal.integ, 695296465Sdelphij &data->keys, 1, hdr, pl->encrypted, 696296465Sdelphij pl->encrypted_len, &decrypted_len); 697160814Ssimon if (decrypted == NULL) 698167612Ssimon return -1; 699296465Sdelphij 700296465Sdelphij ret = ikev2_process_sa_auth_decrypted(data, pl->encr_next_payload, 701160814Ssimon decrypted, decrypted_len); 702296465Sdelphij os_free(decrypted); 703296465Sdelphij 704296465Sdelphij return ret; 705296465Sdelphij} 706296465Sdelphij 707296465Sdelphij 708296465Sdelphijstatic int ikev2_validate_rx_state(struct ikev2_responder_data *data, 709296465Sdelphij u8 exchange_type, u32 message_id) 710296465Sdelphij{ 711296465Sdelphij switch (data->state) { 712160814Ssimon case SA_INIT: 713160814Ssimon /* Expect to receive IKE_SA_INIT: HDR, SAi1, KEi, Ni */ 714296465Sdelphij if (exchange_type != IKE_SA_INIT) { 715296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 716296465Sdelphij "%u in SA_INIT state", exchange_type); 717296465Sdelphij return -1; 718296465Sdelphij } 719296465Sdelphij if (message_id != 0) { 720296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 721296465Sdelphij "in SA_INIT state", message_id); 722296465Sdelphij return -1; 723296465Sdelphij } 724296465Sdelphij break; 725296465Sdelphij case SA_AUTH: 726296465Sdelphij /* Expect to receive IKE_SA_AUTH: 727160814Ssimon * HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,] 728160814Ssimon * AUTH, SAi2, TSi, TSr} 729296465Sdelphij */ 730296465Sdelphij if (exchange_type != IKE_SA_AUTH) { 731296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 732296465Sdelphij "%u in SA_AUTH state", exchange_type); 733296465Sdelphij return -1; 734296465Sdelphij } 735296465Sdelphij if (message_id != 1) { 736296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 737296465Sdelphij "in SA_AUTH state", message_id); 738160814Ssimon return -1; 739160814Ssimon } 740296465Sdelphij break; 741296465Sdelphij case CHILD_SA: 742296465Sdelphij if (exchange_type != CREATE_CHILD_SA) { 743296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 744296465Sdelphij "%u in CHILD_SA state", exchange_type); 745296465Sdelphij return -1; 746296465Sdelphij } 747296465Sdelphij if (message_id != 2) { 748296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 749296465Sdelphij "in CHILD_SA state", message_id); 750296465Sdelphij return -1; 751296465Sdelphij } 752160814Ssimon break; 753296465Sdelphij case NOTIFY: 754160814Ssimon case IKEV2_DONE: 755296465Sdelphij case IKEV2_FAILED: 756296465Sdelphij return -1; 757296465Sdelphij } 758296465Sdelphij 759296465Sdelphij return 0; 760296465Sdelphij} 761296465Sdelphij 762296465Sdelphij 763296465Sdelphijint ikev2_responder_process(struct ikev2_responder_data *data, 764296465Sdelphij const struct wpabuf *buf) 765296465Sdelphij{ 766296465Sdelphij const struct ikev2_hdr *hdr; 767296465Sdelphij u32 length, message_id; 768296465Sdelphij const u8 *pos, *end; 769296465Sdelphij struct ikev2_payloads pl; 770296465Sdelphij 771296465Sdelphij wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)", 772296465Sdelphij (unsigned long) wpabuf_len(buf)); 773296465Sdelphij 774296465Sdelphij if (wpabuf_len(buf) < sizeof(*hdr)) { 775296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR"); 776296465Sdelphij return -1; 777296465Sdelphij } 778296465Sdelphij 779296465Sdelphij data->error_type = 0; 780296465Sdelphij hdr = (const struct ikev2_hdr *) wpabuf_head(buf); 781296465Sdelphij end = wpabuf_head_u8(buf) + wpabuf_len(buf); 782296465Sdelphij message_id = WPA_GET_BE32(hdr->message_id); 783296465Sdelphij length = WPA_GET_BE32(hdr->length); 784160814Ssimon 785296465Sdelphij wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Initiator's SPI", 786160814Ssimon hdr->i_spi, IKEV2_SPI_LEN); 787296465Sdelphij wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI", 788296465Sdelphij hdr->r_spi, IKEV2_SPI_LEN); 789296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Next Payload: %u Version: 0x%x " 790296465Sdelphij "Exchange Type: %u", 791296465Sdelphij hdr->next_payload, hdr->version, hdr->exchange_type); 792296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Message ID: %u Length: %u", 793296465Sdelphij message_id, length); 794296465Sdelphij 795296465Sdelphij if (hdr->version != IKEV2_VERSION) { 796296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x " 797296465Sdelphij "(expected 0x%x)", hdr->version, IKEV2_VERSION); 798296465Sdelphij return -1; 799160814Ssimon } 800296465Sdelphij 801296465Sdelphij if (length != wpabuf_len(buf)) { 802160814Ssimon wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != " 803160814Ssimon "RX: %lu)", (unsigned long) length, 804296465Sdelphij (unsigned long) wpabuf_len(buf)); 805296465Sdelphij return -1; 806296465Sdelphij } 807296465Sdelphij 808296465Sdelphij if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0) 809296465Sdelphij return -1; 810296465Sdelphij 811296465Sdelphij if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) != 812296465Sdelphij IKEV2_HDR_INITIATOR) { 813296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x", 814296465Sdelphij hdr->flags); 815296465Sdelphij return -1; 816296465Sdelphij } 817296465Sdelphij 818296465Sdelphij if (data->state != SA_INIT) { 819296465Sdelphij if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) { 820296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA " 821296465Sdelphij "Initiator's SPI"); 822296465Sdelphij return -1; 823296465Sdelphij } 824296465Sdelphij if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) { 825296465Sdelphij wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA " 826296465Sdelphij "Responder's SPI"); 827296465Sdelphij return -1; 828296465Sdelphij } 829296465Sdelphij } 830296465Sdelphij 831296465Sdelphij pos = (const u8 *) (hdr + 1); 832296465Sdelphij if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0) 833296465Sdelphij return -1; 834296465Sdelphij 835296465Sdelphij if (data->state == SA_INIT) { 836296465Sdelphij data->last_msg = LAST_MSG_SA_INIT; 837160814Ssimon if (ikev2_process_sa_init(data, hdr, &pl) < 0) { 838296465Sdelphij if (data->state == NOTIFY) 839296465Sdelphij return 0; 840160814Ssimon return -1; 841160814Ssimon } 842160814Ssimon wpabuf_free(data->i_sign_msg); 843296465Sdelphij data->i_sign_msg = wpabuf_dup(buf); 844296465Sdelphij } 845296465Sdelphij 846296465Sdelphij if (data->state == SA_AUTH) { 847296465Sdelphij data->last_msg = LAST_MSG_SA_AUTH; 848296465Sdelphij if (ikev2_process_sa_auth(data, hdr, &pl) < 0) { 849296465Sdelphij if (data->state == NOTIFY) 850296465Sdelphij return 0; 851296465Sdelphij return -1; 852296465Sdelphij } 853296465Sdelphij } 854296465Sdelphij 855296465Sdelphij return 0; 856296465Sdelphij} 857296465Sdelphij 858296465Sdelphij 859296465Sdelphijstatic void ikev2_build_hdr(struct ikev2_responder_data *data, 860296465Sdelphij struct wpabuf *msg, u8 exchange_type, 861296465Sdelphij u8 next_payload, u32 message_id) 862296465Sdelphij{ 863296465Sdelphij struct ikev2_hdr *hdr; 864160814Ssimon 865296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Adding HDR"); 866296465Sdelphij 867296465Sdelphij /* HDR - RFC 4306, Sect. 3.1 */ 868296465Sdelphij hdr = wpabuf_put(msg, sizeof(*hdr)); 869296465Sdelphij os_memcpy(hdr->i_spi, data->i_spi, IKEV2_SPI_LEN); 870296465Sdelphij os_memcpy(hdr->r_spi, data->r_spi, IKEV2_SPI_LEN); 871296465Sdelphij hdr->next_payload = next_payload; 872296465Sdelphij hdr->version = IKEV2_VERSION; 873160814Ssimon hdr->exchange_type = exchange_type; 874296465Sdelphij hdr->flags = IKEV2_HDR_RESPONSE; 875296465Sdelphij WPA_PUT_BE32(hdr->message_id, message_id); 876296465Sdelphij} 877296465Sdelphij 878296465Sdelphij 879296465Sdelphijstatic int ikev2_build_sar1(struct ikev2_responder_data *data, 880296465Sdelphij struct wpabuf *msg, u8 next_payload) 881160814Ssimon{ 882296465Sdelphij struct ikev2_payload_hdr *phdr; 883160814Ssimon size_t plen; 884296465Sdelphij struct ikev2_proposal *p; 885296465Sdelphij struct ikev2_transform *t; 886160814Ssimon 887296465Sdelphij wpa_printf(MSG_DEBUG, "IKEV2: Adding SAr1 payload"); 888296465Sdelphij 889296465Sdelphij /* SAr1 - RFC 4306, Sect. 2.7 and 3.3 */ 890296465Sdelphij phdr = wpabuf_put(msg, sizeof(*phdr)); 891296465Sdelphij phdr->next_payload = next_payload; 892296465Sdelphij phdr->flags = 0; 893160814Ssimon 894296465Sdelphij p = wpabuf_put(msg, sizeof(*p)); 895160814Ssimon#ifdef CCNS_PL 896296465Sdelphij /* Seems to require that the Proposal # is 1 even though RFC 4306 897160814Ssimon * Sect 3.3.1 has following requirement "When a proposal is accepted, 898296465Sdelphij * all of the proposal numbers in the SA payload MUST be the same and 899296465Sdelphij * MUST match the number on the proposal sent that was accepted.". 900296465Sdelphij */ 901296465Sdelphij p->proposal_num = 1; 902296465Sdelphij#else /* CCNS_PL */ 903296465Sdelphij p->proposal_num = data->proposal.proposal_num; 904296465Sdelphij#endif /* CCNS_PL */ 905296465Sdelphij p->protocol_id = IKEV2_PROTOCOL_IKE; 906296465Sdelphij p->num_transforms = 4; 907160814Ssimon 908296465Sdelphij t = wpabuf_put(msg, sizeof(*t)); 909296465Sdelphij t->type = 3; 910296465Sdelphij t->transform_type = IKEV2_TRANSFORM_ENCR; 911 WPA_PUT_BE16(t->transform_id, data->proposal.encr); 912 if (data->proposal.encr == ENCR_AES_CBC) { 913 /* Transform Attribute: Key Len = 128 bits */ 914#ifdef CCNS_PL 915 wpabuf_put_be16(msg, 0x001d); /* ?? */ 916#else /* CCNS_PL */ 917 wpabuf_put_be16(msg, 0x800e); /* AF=1, AttrType=14 */ 918#endif /* CCNS_PL */ 919 wpabuf_put_be16(msg, 128); /* 128-bit key */ 920 } 921 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) t; 922 WPA_PUT_BE16(t->transform_length, plen); 923 924 t = wpabuf_put(msg, sizeof(*t)); 925 t->type = 3; 926 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 927 t->transform_type = IKEV2_TRANSFORM_PRF; 928 WPA_PUT_BE16(t->transform_id, data->proposal.prf); 929 930 t = wpabuf_put(msg, sizeof(*t)); 931 t->type = 3; 932 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 933 t->transform_type = IKEV2_TRANSFORM_INTEG; 934 WPA_PUT_BE16(t->transform_id, data->proposal.integ); 935 936 t = wpabuf_put(msg, sizeof(*t)); 937 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 938 t->transform_type = IKEV2_TRANSFORM_DH; 939 WPA_PUT_BE16(t->transform_id, data->proposal.dh); 940 941 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) p; 942 WPA_PUT_BE16(p->proposal_length, plen); 943 944 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 945 WPA_PUT_BE16(phdr->payload_length, plen); 946 947 return 0; 948} 949 950 951static int ikev2_build_ker(struct ikev2_responder_data *data, 952 struct wpabuf *msg, u8 next_payload) 953{ 954 struct ikev2_payload_hdr *phdr; 955 size_t plen; 956 struct wpabuf *pv; 957 958 wpa_printf(MSG_DEBUG, "IKEV2: Adding KEr payload"); 959 960 pv = dh_init(data->dh, &data->r_dh_private); 961 if (pv == NULL) { 962 wpa_printf(MSG_DEBUG, "IKEV2: Failed to initialize DH"); 963 return -1; 964 } 965 966 /* KEr - RFC 4306, Sect. 3.4 */ 967 phdr = wpabuf_put(msg, sizeof(*phdr)); 968 phdr->next_payload = next_payload; 969 phdr->flags = 0; 970 971 wpabuf_put_be16(msg, data->proposal.dh); /* DH Group # */ 972 wpabuf_put(msg, 2); /* RESERVED */ 973 /* 974 * RFC 4306, Sect. 3.4: possible zero padding for public value to 975 * match the length of the prime. 976 */ 977 wpabuf_put(msg, data->dh->prime_len - wpabuf_len(pv)); 978 wpabuf_put_buf(msg, pv); 979 wpabuf_free(pv); 980 981 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 982 WPA_PUT_BE16(phdr->payload_length, plen); 983 return 0; 984} 985 986 987static int ikev2_build_nr(struct ikev2_responder_data *data, 988 struct wpabuf *msg, u8 next_payload) 989{ 990 struct ikev2_payload_hdr *phdr; 991 size_t plen; 992 993 wpa_printf(MSG_DEBUG, "IKEV2: Adding Nr payload"); 994 995 /* Nr - RFC 4306, Sect. 3.9 */ 996 phdr = wpabuf_put(msg, sizeof(*phdr)); 997 phdr->next_payload = next_payload; 998 phdr->flags = 0; 999 wpabuf_put_data(msg, data->r_nonce, data->r_nonce_len); 1000 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1001 WPA_PUT_BE16(phdr->payload_length, plen); 1002 return 0; 1003} 1004 1005 1006static int ikev2_build_idr(struct ikev2_responder_data *data, 1007 struct wpabuf *msg, u8 next_payload) 1008{ 1009 struct ikev2_payload_hdr *phdr; 1010 size_t plen; 1011 1012 wpa_printf(MSG_DEBUG, "IKEV2: Adding IDr payload"); 1013 1014 if (data->IDr == NULL) { 1015 wpa_printf(MSG_INFO, "IKEV2: No IDr available"); 1016 return -1; 1017 } 1018 1019 /* IDr - RFC 4306, Sect. 3.5 */ 1020 phdr = wpabuf_put(msg, sizeof(*phdr)); 1021 phdr->next_payload = next_payload; 1022 phdr->flags = 0; 1023 wpabuf_put_u8(msg, ID_KEY_ID); 1024 wpabuf_put(msg, 3); /* RESERVED */ 1025 wpabuf_put_data(msg, data->IDr, data->IDr_len); 1026 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1027 WPA_PUT_BE16(phdr->payload_length, plen); 1028 return 0; 1029} 1030 1031 1032static int ikev2_build_auth(struct ikev2_responder_data *data, 1033 struct wpabuf *msg, u8 next_payload) 1034{ 1035 struct ikev2_payload_hdr *phdr; 1036 size_t plen; 1037 const struct ikev2_prf_alg *prf; 1038 1039 wpa_printf(MSG_DEBUG, "IKEV2: Adding AUTH payload"); 1040 1041 prf = ikev2_get_prf(data->proposal.prf); 1042 if (prf == NULL) 1043 return -1; 1044 1045 /* Authentication - RFC 4306, Sect. 3.8 */ 1046 phdr = wpabuf_put(msg, sizeof(*phdr)); 1047 phdr->next_payload = next_payload; 1048 phdr->flags = 0; 1049 wpabuf_put_u8(msg, AUTH_SHARED_KEY_MIC); 1050 wpabuf_put(msg, 3); /* RESERVED */ 1051 1052 /* msg | Ni | prf(SK_pr,IDr') */ 1053 if (ikev2_derive_auth_data(data->proposal.prf, data->r_sign_msg, 1054 data->IDr, data->IDr_len, ID_KEY_ID, 1055 &data->keys, 0, data->shared_secret, 1056 data->shared_secret_len, 1057 data->i_nonce, data->i_nonce_len, 1058 data->key_pad, data->key_pad_len, 1059 wpabuf_put(msg, prf->hash_len)) < 0) { 1060 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data"); 1061 return -1; 1062 } 1063 wpabuf_free(data->r_sign_msg); 1064 data->r_sign_msg = NULL; 1065 1066 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1067 WPA_PUT_BE16(phdr->payload_length, plen); 1068 return 0; 1069} 1070 1071 1072static int ikev2_build_notification(struct ikev2_responder_data *data, 1073 struct wpabuf *msg, u8 next_payload) 1074{ 1075 struct ikev2_payload_hdr *phdr; 1076 size_t plen; 1077 1078 wpa_printf(MSG_DEBUG, "IKEV2: Adding Notification payload"); 1079 1080 if (data->error_type == 0) { 1081 wpa_printf(MSG_INFO, "IKEV2: No Notify Message Type " 1082 "available"); 1083 return -1; 1084 } 1085 1086 /* Notify - RFC 4306, Sect. 3.10 */ 1087 phdr = wpabuf_put(msg, sizeof(*phdr)); 1088 phdr->next_payload = next_payload; 1089 phdr->flags = 0; 1090#ifdef CCNS_PL 1091 wpabuf_put_u8(msg, 1); /* Protocol ID: IKE_SA notification */ 1092#else /* CCNS_PL */ 1093 wpabuf_put_u8(msg, 0); /* Protocol ID: no existing SA */ 1094#endif /* CCNS_PL */ 1095 wpabuf_put_u8(msg, 0); /* SPI Size */ 1096 wpabuf_put_be16(msg, data->error_type); 1097 1098 switch (data->error_type) { 1099 case INVALID_KE_PAYLOAD: 1100 if (data->proposal.dh == -1) { 1101 wpa_printf(MSG_INFO, "IKEV2: No DH Group selected for " 1102 "INVALID_KE_PAYLOAD notifications"); 1103 return -1; 1104 } 1105 wpabuf_put_be16(msg, data->proposal.dh); 1106 wpa_printf(MSG_DEBUG, "IKEV2: INVALID_KE_PAYLOAD - request " 1107 "DH Group #%d", data->proposal.dh); 1108 break; 1109 case AUTHENTICATION_FAILED: 1110 /* no associated data */ 1111 break; 1112 default: 1113 wpa_printf(MSG_INFO, "IKEV2: Unsupported Notify Message Type " 1114 "%d", data->error_type); 1115 return -1; 1116 } 1117 1118 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1119 WPA_PUT_BE16(phdr->payload_length, plen); 1120 return 0; 1121} 1122 1123 1124static struct wpabuf * ikev2_build_sa_init(struct ikev2_responder_data *data) 1125{ 1126 struct wpabuf *msg; 1127 1128 /* build IKE_SA_INIT: HDR, SAr1, KEr, Nr, [CERTREQ], [SK{IDr}] */ 1129 1130 if (os_get_random(data->r_spi, IKEV2_SPI_LEN)) 1131 return NULL; 1132 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI", 1133 data->r_spi, IKEV2_SPI_LEN); 1134 1135 data->r_nonce_len = IKEV2_NONCE_MIN_LEN; 1136 if (os_get_random(data->r_nonce, data->r_nonce_len)) 1137 return NULL; 1138#ifdef CCNS_PL 1139 /* Zeros are removed incorrectly from the beginning of the nonces in 1140 * key derivation; as a workaround, make sure Nr does not start with 1141 * zero.. */ 1142 if (data->r_nonce[0] == 0) 1143 data->r_nonce[0] = 1; 1144#endif /* CCNS_PL */ 1145 wpa_hexdump(MSG_DEBUG, "IKEV2: Nr", data->r_nonce, data->r_nonce_len); 1146 1147 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1500); 1148 if (msg == NULL) 1149 return NULL; 1150 1151 ikev2_build_hdr(data, msg, IKE_SA_INIT, IKEV2_PAYLOAD_SA, 0); 1152 if (ikev2_build_sar1(data, msg, IKEV2_PAYLOAD_KEY_EXCHANGE) || 1153 ikev2_build_ker(data, msg, IKEV2_PAYLOAD_NONCE) || 1154 ikev2_build_nr(data, msg, data->peer_auth == PEER_AUTH_SECRET ? 1155 IKEV2_PAYLOAD_ENCRYPTED : 1156 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) { 1157 wpabuf_free(msg); 1158 return NULL; 1159 } 1160 1161 if (ikev2_derive_keys(data)) { 1162 wpabuf_free(msg); 1163 return NULL; 1164 } 1165 1166 if (data->peer_auth == PEER_AUTH_CERT) { 1167 /* TODO: CERTREQ with SHA-1 hashes of Subject Public Key Info 1168 * for trust agents */ 1169 } 1170 1171 if (data->peer_auth == PEER_AUTH_SECRET) { 1172 struct wpabuf *plain = wpabuf_alloc(data->IDr_len + 1000); 1173 if (plain == NULL) { 1174 wpabuf_free(msg); 1175 return NULL; 1176 } 1177 if (ikev2_build_idr(data, plain, 1178 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1179 ikev2_build_encrypted(data->proposal.encr, 1180 data->proposal.integ, 1181 &data->keys, 0, msg, plain, 1182 IKEV2_PAYLOAD_IDr)) { 1183 wpabuf_free(plain); 1184 wpabuf_free(msg); 1185 return NULL; 1186 } 1187 wpabuf_free(plain); 1188 } 1189 1190 ikev2_update_hdr(msg); 1191 1192 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_INIT)", msg); 1193 1194 data->state = SA_AUTH; 1195 1196 wpabuf_free(data->r_sign_msg); 1197 data->r_sign_msg = wpabuf_dup(msg); 1198 1199 return msg; 1200} 1201 1202 1203static struct wpabuf * ikev2_build_sa_auth(struct ikev2_responder_data *data) 1204{ 1205 struct wpabuf *msg, *plain; 1206 1207 /* build IKE_SA_AUTH: HDR, SK {IDr, [CERT,] AUTH} */ 1208 1209 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1000); 1210 if (msg == NULL) 1211 return NULL; 1212 ikev2_build_hdr(data, msg, IKE_SA_AUTH, IKEV2_PAYLOAD_ENCRYPTED, 1); 1213 1214 plain = wpabuf_alloc(data->IDr_len + 1000); 1215 if (plain == NULL) { 1216 wpabuf_free(msg); 1217 return NULL; 1218 } 1219 1220 if (ikev2_build_idr(data, plain, IKEV2_PAYLOAD_AUTHENTICATION) || 1221 ikev2_build_auth(data, plain, IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1222 ikev2_build_encrypted(data->proposal.encr, data->proposal.integ, 1223 &data->keys, 0, msg, plain, 1224 IKEV2_PAYLOAD_IDr)) { 1225 wpabuf_free(plain); 1226 wpabuf_free(msg); 1227 return NULL; 1228 } 1229 wpabuf_free(plain); 1230 1231 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_AUTH)", msg); 1232 1233 data->state = IKEV2_DONE; 1234 1235 return msg; 1236} 1237 1238 1239static struct wpabuf * ikev2_build_notify(struct ikev2_responder_data *data) 1240{ 1241 struct wpabuf *msg; 1242 1243 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + 1000); 1244 if (msg == NULL) 1245 return NULL; 1246 if (data->last_msg == LAST_MSG_SA_AUTH) { 1247 /* HDR, SK{N} */ 1248 struct wpabuf *plain = wpabuf_alloc(100); 1249 if (plain == NULL) { 1250 wpabuf_free(msg); 1251 return NULL; 1252 } 1253 ikev2_build_hdr(data, msg, IKE_SA_AUTH, 1254 IKEV2_PAYLOAD_ENCRYPTED, 1); 1255 if (ikev2_build_notification(data, plain, 1256 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1257 ikev2_build_encrypted(data->proposal.encr, 1258 data->proposal.integ, 1259 &data->keys, 0, msg, plain, 1260 IKEV2_PAYLOAD_NOTIFICATION)) { 1261 wpabuf_free(plain); 1262 wpabuf_free(msg); 1263 return NULL; 1264 } 1265 data->state = IKEV2_FAILED; 1266 } else { 1267 /* HDR, N */ 1268 ikev2_build_hdr(data, msg, IKE_SA_INIT, 1269 IKEV2_PAYLOAD_NOTIFICATION, 0); 1270 if (ikev2_build_notification(data, msg, 1271 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) { 1272 wpabuf_free(msg); 1273 return NULL; 1274 } 1275 data->state = SA_INIT; 1276 } 1277 1278 ikev2_update_hdr(msg); 1279 1280 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (Notification)", 1281 msg); 1282 1283 return msg; 1284} 1285 1286 1287struct wpabuf * ikev2_responder_build(struct ikev2_responder_data *data) 1288{ 1289 switch (data->state) { 1290 case SA_INIT: 1291 return ikev2_build_sa_init(data); 1292 case SA_AUTH: 1293 return ikev2_build_sa_auth(data); 1294 case CHILD_SA: 1295 return NULL; 1296 case NOTIFY: 1297 return ikev2_build_notify(data); 1298 case IKEV2_DONE: 1299 case IKEV2_FAILED: 1300 return NULL; 1301 } 1302 return NULL; 1303} 1304