• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1  /*
2   * IKEv2 responder (RFC 4306) for EAP-IKEV2
3   * Copyright (c) 2007, Jouni Malinen <j@w1.fi>
4   *
5   * This software may be distributed under the terms of the BSD license.
6   * See README for more details.
7   */
8  
9  #include "includes.h"
10  
11  #include "common.h"
12  #include "crypto/dh_groups.h"
13  #include "crypto/random.h"
14  #include "ikev2.h"
15  
16  
ikev2_responder_deinit(struct ikev2_responder_data * data)17  void ikev2_responder_deinit(struct ikev2_responder_data *data)
18  {
19  	ikev2_free_keys(&data->keys);
20  	wpabuf_free(data->i_dh_public);
21  	wpabuf_free(data->r_dh_private);
22  	os_free(data->IDi);
23  	os_free(data->IDr);
24  	os_free(data->shared_secret);
25  	wpabuf_free(data->i_sign_msg);
26  	wpabuf_free(data->r_sign_msg);
27  	os_free(data->key_pad);
28  }
29  
30  
ikev2_derive_keys(struct ikev2_responder_data * data)31  static int ikev2_derive_keys(struct ikev2_responder_data *data)
32  {
33  	u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN];
34  	size_t buf_len, pad_len;
35  	struct wpabuf *shared;
36  	const struct ikev2_integ_alg *integ;
37  	const struct ikev2_prf_alg *prf;
38  	const struct ikev2_encr_alg *encr;
39  	int ret;
40  	const u8 *addr[2];
41  	size_t len[2];
42  
43  	/* RFC 4306, Sect. 2.14 */
44  
45  	integ = ikev2_get_integ(data->proposal.integ);
46  	prf = ikev2_get_prf(data->proposal.prf);
47  	encr = ikev2_get_encr(data->proposal.encr);
48  	if (integ == NULL || prf == NULL || encr == NULL) {
49  		wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal");
50  		return -1;
51  	}
52  
53  	shared = dh_derive_shared(data->i_dh_public, data->r_dh_private,
54  				  data->dh);
55  	if (shared == NULL)
56  		return -1;
57  
58  	/* Construct Ni | Nr | SPIi | SPIr */
59  
60  	buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN;
61  	buf = os_malloc(buf_len);
62  	if (buf == NULL) {
63  		wpabuf_free(shared);
64  		return -1;
65  	}
66  
67  	pos = buf;
68  	os_memcpy(pos, data->i_nonce, data->i_nonce_len);
69  	pos += data->i_nonce_len;
70  	os_memcpy(pos, data->r_nonce, data->r_nonce_len);
71  	pos += data->r_nonce_len;
72  	os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN);
73  	pos += IKEV2_SPI_LEN;
74  	os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN);
75  
76  	/* SKEYSEED = prf(Ni | Nr, g^ir) */
77  	/* Use zero-padding per RFC 4306, Sect. 2.14 */
78  	pad_len = data->dh->prime_len - wpabuf_len(shared);
79  	pad = os_zalloc(pad_len ? pad_len : 1);
80  	if (pad == NULL) {
81  		wpabuf_free(shared);
82  		os_free(buf);
83  		return -1;
84  	}
85  
86  	addr[0] = pad;
87  	len[0] = pad_len;
88  	addr[1] = wpabuf_head(shared);
89  	len[1] = wpabuf_len(shared);
90  	if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len,
91  			   2, addr, len, skeyseed) < 0) {
92  		wpabuf_free(shared);
93  		os_free(buf);
94  		os_free(pad);
95  		return -1;
96  	}
97  	os_free(pad);
98  	wpabuf_free(shared);
99  
100  	/* DH parameters are not needed anymore, so free them */
101  	wpabuf_free(data->i_dh_public);
102  	data->i_dh_public = NULL;
103  	wpabuf_free(data->r_dh_private);
104  	data->r_dh_private = NULL;
105  
106  	wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED",
107  			skeyseed, prf->hash_len);
108  
109  	ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len,
110  				   &data->keys);
111  	os_free(buf);
112  	return ret;
113  }
114  
115  
ikev2_parse_transform(struct ikev2_proposal_data * prop,const u8 * pos,const u8 * end)116  static int ikev2_parse_transform(struct ikev2_proposal_data *prop,
117  				 const u8 *pos, const u8 *end)
118  {
119  	int transform_len;
120  	const struct ikev2_transform *t;
121  	u16 transform_id;
122  	const u8 *tend;
123  
124  	if (end - pos < (int) sizeof(*t)) {
125  		wpa_printf(MSG_INFO, "IKEV2: Too short transform");
126  		return -1;
127  	}
128  
129  	t = (const struct ikev2_transform *) pos;
130  	transform_len = WPA_GET_BE16(t->transform_length);
131  	if (transform_len < (int) sizeof(*t) || transform_len > end - pos) {
132  		wpa_printf(MSG_INFO, "IKEV2: Invalid transform length %d",
133  			   transform_len);
134  		return -1;
135  	}
136  	tend = pos + transform_len;
137  
138  	transform_id = WPA_GET_BE16(t->transform_id);
139  
140  	wpa_printf(MSG_DEBUG, "IKEV2:   Transform:");
141  	wpa_printf(MSG_DEBUG, "IKEV2:     Type: %d  Transform Length: %d  "
142  		   "Transform Type: %d  Transform ID: %d",
143  		   t->type, transform_len, t->transform_type, transform_id);
144  
145  	if (t->type != 0 && t->type != 3) {
146  		wpa_printf(MSG_INFO, "IKEV2: Unexpected Transform type");
147  		return -1;
148  	}
149  
150  	pos = (const u8 *) (t + 1);
151  	if (pos < tend) {
152  		wpa_hexdump(MSG_DEBUG, "IKEV2:     Transform Attributes",
153  			    pos, tend - pos);
154  	}
155  
156  	switch (t->transform_type) {
157  	case IKEV2_TRANSFORM_ENCR:
158  		if (ikev2_get_encr(transform_id)) {
159  			if (transform_id == ENCR_AES_CBC) {
160  				if (tend - pos != 4) {
161  					wpa_printf(MSG_DEBUG, "IKEV2: No "
162  						   "Transform Attr for AES");
163  					break;
164  				}
165  				if (WPA_GET_BE16(pos) != 0x800e) {
166  					wpa_printf(MSG_DEBUG, "IKEV2: Not a "
167  						   "Key Size attribute for "
168  						   "AES");
169  					break;
170  				}
171  				if (WPA_GET_BE16(pos + 2) != 128) {
172  					wpa_printf(MSG_DEBUG, "IKEV2: "
173  						   "Unsupported AES key size "
174  						   "%d bits",
175  						   WPA_GET_BE16(pos + 2));
176  					break;
177  				}
178  			}
179  			prop->encr = transform_id;
180  		}
181  		break;
182  	case IKEV2_TRANSFORM_PRF:
183  		if (ikev2_get_prf(transform_id))
184  			prop->prf = transform_id;
185  		break;
186  	case IKEV2_TRANSFORM_INTEG:
187  		if (ikev2_get_integ(transform_id))
188  			prop->integ = transform_id;
189  		break;
190  	case IKEV2_TRANSFORM_DH:
191  		if (dh_groups_get(transform_id))
192  			prop->dh = transform_id;
193  		break;
194  	}
195  
196  	return transform_len;
197  }
198  
199  
ikev2_parse_proposal(struct ikev2_proposal_data * prop,const u8 * pos,const u8 * end)200  static int ikev2_parse_proposal(struct ikev2_proposal_data *prop,
201  				const u8 *pos, const u8 *end)
202  {
203  	const u8 *pend, *ppos;
204  	int proposal_len, i;
205  	const struct ikev2_proposal *p;
206  
207  	if (end - pos < (int) sizeof(*p)) {
208  		wpa_printf(MSG_INFO, "IKEV2: Too short proposal");
209  		return -1;
210  	}
211  
212  	/* FIX: AND processing if multiple proposals use the same # */
213  
214  	p = (const struct ikev2_proposal *) pos;
215  	proposal_len = WPA_GET_BE16(p->proposal_length);
216  	if (proposal_len < (int) sizeof(*p) || proposal_len > end - pos) {
217  		wpa_printf(MSG_INFO, "IKEV2: Invalid proposal length %d",
218  			   proposal_len);
219  		return -1;
220  	}
221  	wpa_printf(MSG_DEBUG, "IKEV2: SAi1 Proposal # %d",
222  		   p->proposal_num);
223  	wpa_printf(MSG_DEBUG, "IKEV2:   Type: %d  Proposal Length: %d "
224  		   " Protocol ID: %d",
225  		   p->type, proposal_len, p->protocol_id);
226  	wpa_printf(MSG_DEBUG, "IKEV2:   SPI Size: %d  Transforms: %d",
227  		   p->spi_size, p->num_transforms);
228  
229  	if (p->type != 0 && p->type != 2) {
230  		wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal type");
231  		return -1;
232  	}
233  
234  	if (p->protocol_id != IKEV2_PROTOCOL_IKE) {
235  		wpa_printf(MSG_DEBUG, "IKEV2: Unexpected Protocol ID "
236  			   "(only IKE allowed for EAP-IKEv2)");
237  		return -1;
238  	}
239  
240  	if (p->proposal_num != prop->proposal_num) {
241  		if (p->proposal_num == prop->proposal_num + 1)
242  			prop->proposal_num = p->proposal_num;
243  		else {
244  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal #");
245  			return -1;
246  		}
247  	}
248  
249  	ppos = (const u8 *) (p + 1);
250  	pend = pos + proposal_len;
251  	if (p->spi_size > pend - ppos) {
252  		wpa_printf(MSG_INFO, "IKEV2: Not enough room for SPI "
253  			   "in proposal");
254  		return -1;
255  	}
256  	if (p->spi_size) {
257  		wpa_hexdump(MSG_DEBUG, "IKEV2:    SPI",
258  			    ppos, p->spi_size);
259  		ppos += p->spi_size;
260  	}
261  
262  	/*
263  	 * For initial IKE_SA negotiation, SPI Size MUST be zero; for
264  	 * subsequent negotiations, it must be 8 for IKE. We only support
265  	 * initial case for now.
266  	 */
267  	if (p->spi_size != 0) {
268  		wpa_printf(MSG_INFO, "IKEV2: Unexpected SPI Size");
269  		return -1;
270  	}
271  
272  	if (p->num_transforms == 0) {
273  		wpa_printf(MSG_INFO, "IKEV2: At least one transform required");
274  		return -1;
275  	}
276  
277  	for (i = 0; i < (int) p->num_transforms; i++) {
278  		int tlen = ikev2_parse_transform(prop, ppos, pend);
279  		if (tlen < 0)
280  			return -1;
281  		ppos += tlen;
282  	}
283  
284  	if (ppos != pend) {
285  		wpa_printf(MSG_INFO, "IKEV2: Unexpected data after "
286  			   "transforms");
287  		return -1;
288  	}
289  
290  	return proposal_len;
291  }
292  
293  
ikev2_process_sai1(struct ikev2_responder_data * data,const u8 * sai1,size_t sai1_len)294  static int ikev2_process_sai1(struct ikev2_responder_data *data,
295  			      const u8 *sai1, size_t sai1_len)
296  {
297  	struct ikev2_proposal_data prop;
298  	const u8 *pos, *end;
299  	int found = 0;
300  
301  	/* Security Association Payloads: <Proposals> */
302  
303  	if (sai1 == NULL) {
304  		wpa_printf(MSG_INFO, "IKEV2: SAi1 not received");
305  		return -1;
306  	}
307  
308  	os_memset(&prop, 0, sizeof(prop));
309  	prop.proposal_num = 1;
310  
311  	pos = sai1;
312  	end = sai1 + sai1_len;
313  
314  	while (pos < end) {
315  		int plen;
316  
317  		prop.integ = -1;
318  		prop.prf = -1;
319  		prop.encr = -1;
320  		prop.dh = -1;
321  		plen = ikev2_parse_proposal(&prop, pos, end);
322  		if (plen < 0)
323  			return -1;
324  
325  		if (!found && prop.integ != -1 && prop.prf != -1 &&
326  		    prop.encr != -1 && prop.dh != -1) {
327  			os_memcpy(&data->proposal, &prop, sizeof(prop));
328  			data->dh = dh_groups_get(prop.dh);
329  			found = 1;
330  		}
331  
332  		pos += plen;
333  	}
334  
335  	if (pos != end) {
336  		wpa_printf(MSG_INFO, "IKEV2: Unexpected data after proposals");
337  		return -1;
338  	}
339  
340  	if (!found) {
341  		wpa_printf(MSG_INFO, "IKEV2: No acceptable proposal found");
342  		return -1;
343  	}
344  
345  	wpa_printf(MSG_DEBUG, "IKEV2: Accepted proposal #%d: ENCR:%d PRF:%d "
346  		   "INTEG:%d D-H:%d", data->proposal.proposal_num,
347  		   data->proposal.encr, data->proposal.prf,
348  		   data->proposal.integ, data->proposal.dh);
349  
350  	return 0;
351  }
352  
353  
ikev2_process_kei(struct ikev2_responder_data * data,const u8 * kei,size_t kei_len)354  static int ikev2_process_kei(struct ikev2_responder_data *data,
355  			     const u8 *kei, size_t kei_len)
356  {
357  	u16 group;
358  
359  	/*
360  	 * Key Exchange Payload:
361  	 * DH Group # (16 bits)
362  	 * RESERVED (16 bits)
363  	 * Key Exchange Data (Diffie-Hellman public value)
364  	 */
365  
366  	if (kei == NULL) {
367  		wpa_printf(MSG_INFO, "IKEV2: KEi not received");
368  		return -1;
369  	}
370  
371  	if (kei_len < 4 + 96) {
372  		wpa_printf(MSG_INFO, "IKEV2: Too short Key Exchange Payload");
373  		return -1;
374  	}
375  
376  	group = WPA_GET_BE16(kei);
377  	wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u", group);
378  
379  	if (group != data->proposal.dh) {
380  		wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u does not match "
381  			   "with the selected proposal (%u)",
382  			   group, data->proposal.dh);
383  		/* Reject message with Notify payload of type
384  		 * INVALID_KE_PAYLOAD (RFC 4306, Sect. 3.4) */
385  		data->error_type = INVALID_KE_PAYLOAD;
386  		data->state = NOTIFY;
387  		return -1;
388  	}
389  
390  	if (data->dh == NULL) {
391  		wpa_printf(MSG_INFO, "IKEV2: Unsupported DH group");
392  		return -1;
393  	}
394  
395  	/* RFC 4306, Section 3.4:
396  	 * The length of DH public value MUST be equal to the length of the
397  	 * prime modulus.
398  	 */
399  	if (kei_len - 4 != data->dh->prime_len) {
400  		wpa_printf(MSG_INFO, "IKEV2: Invalid DH public value length "
401  			   "%ld (expected %ld)",
402  			   (long) (kei_len - 4), (long) data->dh->prime_len);
403  		return -1;
404  	}
405  
406  	wpabuf_free(data->i_dh_public);
407  	data->i_dh_public = wpabuf_alloc(kei_len - 4);
408  	if (data->i_dh_public == NULL)
409  		return -1;
410  	wpabuf_put_data(data->i_dh_public, kei + 4, kei_len - 4);
411  
412  	wpa_hexdump_buf(MSG_DEBUG, "IKEV2: KEi Diffie-Hellman Public Value",
413  			data->i_dh_public);
414  
415  	return 0;
416  }
417  
418  
ikev2_process_ni(struct ikev2_responder_data * data,const u8 * ni,size_t ni_len)419  static int ikev2_process_ni(struct ikev2_responder_data *data,
420  			    const u8 *ni, size_t ni_len)
421  {
422  	if (ni == NULL) {
423  		wpa_printf(MSG_INFO, "IKEV2: Ni not received");
424  		return -1;
425  	}
426  
427  	if (ni_len < IKEV2_NONCE_MIN_LEN || ni_len > IKEV2_NONCE_MAX_LEN) {
428  		wpa_printf(MSG_INFO, "IKEV2: Invalid Ni length %ld",
429  		           (long) ni_len);
430  		return -1;
431  	}
432  
433  	data->i_nonce_len = ni_len;
434  	os_memcpy(data->i_nonce, ni, ni_len);
435  	wpa_hexdump(MSG_MSGDUMP, "IKEV2: Ni",
436  		    data->i_nonce, data->i_nonce_len);
437  
438  	return 0;
439  }
440  
441  
ikev2_process_sa_init(struct ikev2_responder_data * data,const struct ikev2_hdr * hdr,struct ikev2_payloads * pl)442  static int ikev2_process_sa_init(struct ikev2_responder_data *data,
443  				 const struct ikev2_hdr *hdr,
444  				 struct ikev2_payloads *pl)
445  {
446  	if (ikev2_process_sai1(data, pl->sa, pl->sa_len) < 0 ||
447  	    ikev2_process_kei(data, pl->ke, pl->ke_len) < 0 ||
448  	    ikev2_process_ni(data, pl->nonce, pl->nonce_len) < 0)
449  		return -1;
450  
451  	os_memcpy(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN);
452  
453  	return 0;
454  }
455  
456  
ikev2_process_idi(struct ikev2_responder_data * data,const u8 * idi,size_t idi_len)457  static int ikev2_process_idi(struct ikev2_responder_data *data,
458  			     const u8 *idi, size_t idi_len)
459  {
460  	u8 id_type;
461  
462  	if (idi == NULL) {
463  		wpa_printf(MSG_INFO, "IKEV2: No IDi received");
464  		return -1;
465  	}
466  
467  	if (idi_len < 4) {
468  		wpa_printf(MSG_INFO, "IKEV2: Too short IDi payload");
469  		return -1;
470  	}
471  
472  	id_type = idi[0];
473  	idi += 4;
474  	idi_len -= 4;
475  
476  	wpa_printf(MSG_DEBUG, "IKEV2: IDi ID Type %d", id_type);
477  	wpa_hexdump_ascii(MSG_DEBUG, "IKEV2: IDi", idi, idi_len);
478  	os_free(data->IDi);
479  	data->IDi = os_memdup(idi, idi_len);
480  	if (data->IDi == NULL)
481  		return -1;
482  	data->IDi_len = idi_len;
483  	data->IDi_type = id_type;
484  
485  	return 0;
486  }
487  
488  
ikev2_process_cert(struct ikev2_responder_data * data,const u8 * cert,size_t cert_len)489  static int ikev2_process_cert(struct ikev2_responder_data *data,
490  			      const u8 *cert, size_t cert_len)
491  {
492  	u8 cert_encoding;
493  
494  	if (cert == NULL) {
495  		if (data->peer_auth == PEER_AUTH_CERT) {
496  			wpa_printf(MSG_INFO, "IKEV2: No Certificate received");
497  			return -1;
498  		}
499  		return 0;
500  	}
501  
502  	if (cert_len < 1) {
503  		wpa_printf(MSG_INFO, "IKEV2: No Cert Encoding field");
504  		return -1;
505  	}
506  
507  	cert_encoding = cert[0];
508  	cert++;
509  	cert_len--;
510  
511  	wpa_printf(MSG_DEBUG, "IKEV2: Cert Encoding %d", cert_encoding);
512  	wpa_hexdump(MSG_MSGDUMP, "IKEV2: Certificate Data", cert, cert_len);
513  
514  	/* TODO: validate certificate */
515  
516  	return 0;
517  }
518  
519  
ikev2_process_auth_cert(struct ikev2_responder_data * data,u8 method,const u8 * auth,size_t auth_len)520  static int ikev2_process_auth_cert(struct ikev2_responder_data *data,
521  				   u8 method, const u8 *auth, size_t auth_len)
522  {
523  	if (method != AUTH_RSA_SIGN) {
524  		wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication "
525  			   "method %d", method);
526  		return -1;
527  	}
528  
529  	/* TODO: validate AUTH */
530  	return 0;
531  }
532  
533  
ikev2_process_auth_secret(struct ikev2_responder_data * data,u8 method,const u8 * auth,size_t auth_len)534  static int ikev2_process_auth_secret(struct ikev2_responder_data *data,
535  				     u8 method, const u8 *auth,
536  				     size_t auth_len)
537  {
538  	u8 auth_data[IKEV2_MAX_HASH_LEN];
539  	const struct ikev2_prf_alg *prf;
540  
541  	if (method != AUTH_SHARED_KEY_MIC) {
542  		wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication "
543  			   "method %d", method);
544  		return -1;
545  	}
546  
547  	/* msg | Nr | prf(SK_pi,IDi') */
548  	if (ikev2_derive_auth_data(data->proposal.prf, data->i_sign_msg,
549  				   data->IDi, data->IDi_len, data->IDi_type,
550  				   &data->keys, 1, data->shared_secret,
551  				   data->shared_secret_len,
552  				   data->r_nonce, data->r_nonce_len,
553  				   data->key_pad, data->key_pad_len,
554  				   auth_data) < 0) {
555  		wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data");
556  		return -1;
557  	}
558  
559  	wpabuf_free(data->i_sign_msg);
560  	data->i_sign_msg = NULL;
561  
562  	prf = ikev2_get_prf(data->proposal.prf);
563  	if (prf == NULL)
564  		return -1;
565  
566  	if (auth_len != prf->hash_len ||
567  	    os_memcmp_const(auth, auth_data, auth_len) != 0) {
568  		wpa_printf(MSG_INFO, "IKEV2: Invalid Authentication Data");
569  		wpa_hexdump(MSG_DEBUG, "IKEV2: Received Authentication Data",
570  			    auth, auth_len);
571  		wpa_hexdump(MSG_DEBUG, "IKEV2: Expected Authentication Data",
572  			    auth_data, prf->hash_len);
573  		data->error_type = AUTHENTICATION_FAILED;
574  		data->state = NOTIFY;
575  		return -1;
576  	}
577  
578  	wpa_printf(MSG_DEBUG, "IKEV2: Server authenticated successfully "
579  		   "using shared keys");
580  
581  	return 0;
582  }
583  
584  
ikev2_process_auth(struct ikev2_responder_data * data,const u8 * auth,size_t auth_len)585  static int ikev2_process_auth(struct ikev2_responder_data *data,
586  			      const u8 *auth, size_t auth_len)
587  {
588  	u8 auth_method;
589  
590  	if (auth == NULL) {
591  		wpa_printf(MSG_INFO, "IKEV2: No Authentication Payload");
592  		return -1;
593  	}
594  
595  	if (auth_len < 4) {
596  		wpa_printf(MSG_INFO, "IKEV2: Too short Authentication "
597  			   "Payload");
598  		return -1;
599  	}
600  
601  	auth_method = auth[0];
602  	auth += 4;
603  	auth_len -= 4;
604  
605  	wpa_printf(MSG_DEBUG, "IKEV2: Auth Method %d", auth_method);
606  	wpa_hexdump(MSG_MSGDUMP, "IKEV2: Authentication Data", auth, auth_len);
607  
608  	switch (data->peer_auth) {
609  	case PEER_AUTH_CERT:
610  		return ikev2_process_auth_cert(data, auth_method, auth,
611  					       auth_len);
612  	case PEER_AUTH_SECRET:
613  		return ikev2_process_auth_secret(data, auth_method, auth,
614  						 auth_len);
615  	}
616  
617  	return -1;
618  }
619  
620  
ikev2_process_sa_auth_decrypted(struct ikev2_responder_data * data,u8 next_payload,u8 * payload,size_t payload_len)621  static int ikev2_process_sa_auth_decrypted(struct ikev2_responder_data *data,
622  					   u8 next_payload,
623  					   u8 *payload, size_t payload_len)
624  {
625  	struct ikev2_payloads pl;
626  
627  	wpa_printf(MSG_DEBUG, "IKEV2: Processing decrypted payloads");
628  
629  	if (ikev2_parse_payloads(&pl, next_payload, payload, payload +
630  				 payload_len) < 0) {
631  		wpa_printf(MSG_INFO, "IKEV2: Failed to parse decrypted "
632  			   "payloads");
633  		return -1;
634  	}
635  
636  	if (ikev2_process_idi(data, pl.idi, pl.idi_len) < 0 ||
637  	    ikev2_process_cert(data, pl.cert, pl.cert_len) < 0 ||
638  	    ikev2_process_auth(data, pl.auth, pl.auth_len) < 0)
639  		return -1;
640  
641  	return 0;
642  }
643  
644  
ikev2_process_sa_auth(struct ikev2_responder_data * data,const struct ikev2_hdr * hdr,struct ikev2_payloads * pl)645  static int ikev2_process_sa_auth(struct ikev2_responder_data *data,
646  				 const struct ikev2_hdr *hdr,
647  				 struct ikev2_payloads *pl)
648  {
649  	u8 *decrypted;
650  	size_t decrypted_len;
651  	int ret;
652  
653  	decrypted = ikev2_decrypt_payload(data->proposal.encr,
654  					  data->proposal.integ,
655  					  &data->keys, 1, hdr, pl->encrypted,
656  					  pl->encrypted_len, &decrypted_len);
657  	if (decrypted == NULL)
658  		return -1;
659  
660  	ret = ikev2_process_sa_auth_decrypted(data, pl->encr_next_payload,
661  					      decrypted, decrypted_len);
662  	os_free(decrypted);
663  
664  	return ret;
665  }
666  
667  
ikev2_validate_rx_state(struct ikev2_responder_data * data,u8 exchange_type,u32 message_id)668  static int ikev2_validate_rx_state(struct ikev2_responder_data *data,
669  				   u8 exchange_type, u32 message_id)
670  {
671  	switch (data->state) {
672  	case SA_INIT:
673  		/* Expect to receive IKE_SA_INIT: HDR, SAi1, KEi, Ni */
674  		if (exchange_type != IKE_SA_INIT) {
675  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
676  				   "%u in SA_INIT state", exchange_type);
677  			return -1;
678  		}
679  		if (message_id != 0) {
680  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
681  				   "in SA_INIT state", message_id);
682  			return -1;
683  		}
684  		break;
685  	case SA_AUTH:
686  		/* Expect to receive IKE_SA_AUTH:
687  		 * HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
688  		 *	AUTH, SAi2, TSi, TSr}
689  		 */
690  		if (exchange_type != IKE_SA_AUTH) {
691  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
692  				   "%u in SA_AUTH state", exchange_type);
693  			return -1;
694  		}
695  		if (message_id != 1) {
696  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
697  				   "in SA_AUTH state", message_id);
698  			return -1;
699  		}
700  		break;
701  	case CHILD_SA:
702  		if (exchange_type != CREATE_CHILD_SA) {
703  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
704  				   "%u in CHILD_SA state", exchange_type);
705  			return -1;
706  		}
707  		if (message_id != 2) {
708  			wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
709  				   "in CHILD_SA state", message_id);
710  			return -1;
711  		}
712  		break;
713  	case NOTIFY:
714  	case IKEV2_DONE:
715  	case IKEV2_FAILED:
716  		return -1;
717  	}
718  
719  	return 0;
720  }
721  
722  
ikev2_responder_process(struct ikev2_responder_data * data,const struct wpabuf * buf)723  int ikev2_responder_process(struct ikev2_responder_data *data,
724  			    const struct wpabuf *buf)
725  {
726  	const struct ikev2_hdr *hdr;
727  	u32 length, message_id;
728  	const u8 *pos, *end;
729  	struct ikev2_payloads pl;
730  
731  	wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)",
732  		   (unsigned long) wpabuf_len(buf));
733  
734  	if (wpabuf_len(buf) < sizeof(*hdr)) {
735  		wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR");
736  		return -1;
737  	}
738  
739  	data->error_type = 0;
740  	hdr = (const struct ikev2_hdr *) wpabuf_head(buf);
741  	end = wpabuf_head_u8(buf) + wpabuf_len(buf);
742  	message_id = WPA_GET_BE32(hdr->message_id);
743  	length = WPA_GET_BE32(hdr->length);
744  
745  	wpa_hexdump(MSG_DEBUG, "IKEV2:   IKE_SA Initiator's SPI",
746  		    hdr->i_spi, IKEV2_SPI_LEN);
747  	wpa_hexdump(MSG_DEBUG, "IKEV2:   IKE_SA Responder's SPI",
748  		    hdr->r_spi, IKEV2_SPI_LEN);
749  	wpa_printf(MSG_DEBUG, "IKEV2:   Next Payload: %u  Version: 0x%x  "
750  		   "Exchange Type: %u",
751  		   hdr->next_payload, hdr->version, hdr->exchange_type);
752  	wpa_printf(MSG_DEBUG, "IKEV2:   Message ID: %u  Length: %u",
753  		   message_id, length);
754  
755  	if (hdr->version != IKEV2_VERSION) {
756  		wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x "
757  			   "(expected 0x%x)", hdr->version, IKEV2_VERSION);
758  		return -1;
759  	}
760  
761  	if (length != wpabuf_len(buf)) {
762  		wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != "
763  			   "RX: %lu)", (unsigned long) length,
764  			   (unsigned long) wpabuf_len(buf));
765  		return -1;
766  	}
767  
768  	if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0)
769  		return -1;
770  
771  	if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) !=
772  	    IKEV2_HDR_INITIATOR) {
773  		wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x",
774  			   hdr->flags);
775  		return -1;
776  	}
777  
778  	if (data->state != SA_INIT) {
779  		if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) {
780  			wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "
781  				   "Initiator's SPI");
782  			return -1;
783  		}
784  		if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) {
785  			wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "
786  				   "Responder's SPI");
787  			return -1;
788  		}
789  	}
790  
791  	pos = (const u8 *) (hdr + 1);
792  	if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0)
793  		return -1;
794  
795  	if (data->state == SA_INIT) {
796  		data->last_msg = LAST_MSG_SA_INIT;
797  		if (ikev2_process_sa_init(data, hdr, &pl) < 0) {
798  			if (data->state == NOTIFY)
799  				return 0;
800  			return -1;
801  		}
802  		wpabuf_free(data->i_sign_msg);
803  		data->i_sign_msg = wpabuf_dup(buf);
804  	}
805  
806  	if (data->state == SA_AUTH) {
807  		data->last_msg = LAST_MSG_SA_AUTH;
808  		if (ikev2_process_sa_auth(data, hdr, &pl) < 0) {
809  			if (data->state == NOTIFY)
810  				return 0;
811  			return -1;
812  		}
813  	}
814  
815  	return 0;
816  }
817  
818  
ikev2_build_hdr(struct ikev2_responder_data * data,struct wpabuf * msg,u8 exchange_type,u8 next_payload,u32 message_id)819  static void ikev2_build_hdr(struct ikev2_responder_data *data,
820  			    struct wpabuf *msg, u8 exchange_type,
821  			    u8 next_payload, u32 message_id)
822  {
823  	struct ikev2_hdr *hdr;
824  
825  	wpa_printf(MSG_DEBUG, "IKEV2: Adding HDR");
826  
827  	/* HDR - RFC 4306, Sect. 3.1 */
828  	hdr = wpabuf_put(msg, sizeof(*hdr));
829  	os_memcpy(hdr->i_spi, data->i_spi, IKEV2_SPI_LEN);
830  	os_memcpy(hdr->r_spi, data->r_spi, IKEV2_SPI_LEN);
831  	hdr->next_payload = next_payload;
832  	hdr->version = IKEV2_VERSION;
833  	hdr->exchange_type = exchange_type;
834  	hdr->flags = IKEV2_HDR_RESPONSE;
835  	WPA_PUT_BE32(hdr->message_id, message_id);
836  }
837  
838  
ikev2_build_sar1(struct ikev2_responder_data * data,struct wpabuf * msg,u8 next_payload)839  static int ikev2_build_sar1(struct ikev2_responder_data *data,
840  			    struct wpabuf *msg, u8 next_payload)
841  {
842  	struct ikev2_payload_hdr *phdr;
843  	size_t plen;
844  	struct ikev2_proposal *p;
845  	struct ikev2_transform *t;
846  
847  	wpa_printf(MSG_DEBUG, "IKEV2: Adding SAr1 payload");
848  
849  	/* SAr1 - RFC 4306, Sect. 2.7 and 3.3 */
850  	phdr = wpabuf_put(msg, sizeof(*phdr));
851  	phdr->next_payload = next_payload;
852  	phdr->flags = 0;
853  
854  	p = wpabuf_put(msg, sizeof(*p));
855  	p->proposal_num = data->proposal.proposal_num;
856  	p->protocol_id = IKEV2_PROTOCOL_IKE;
857  	p->num_transforms = 4;
858  
859  	t = wpabuf_put(msg, sizeof(*t));
860  	t->type = 3;
861  	t->transform_type = IKEV2_TRANSFORM_ENCR;
862  	WPA_PUT_BE16(t->transform_id, data->proposal.encr);
863  	if (data->proposal.encr == ENCR_AES_CBC) {
864  		/* Transform Attribute: Key Len = 128 bits */
865  		wpabuf_put_be16(msg, 0x800e); /* AF=1, AttrType=14 */
866  		wpabuf_put_be16(msg, 128); /* 128-bit key */
867  	}
868  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) t;
869  	WPA_PUT_BE16(t->transform_length, plen);
870  
871  	t = wpabuf_put(msg, sizeof(*t));
872  	t->type = 3;
873  	WPA_PUT_BE16(t->transform_length, sizeof(*t));
874  	t->transform_type = IKEV2_TRANSFORM_PRF;
875  	WPA_PUT_BE16(t->transform_id, data->proposal.prf);
876  
877  	t = wpabuf_put(msg, sizeof(*t));
878  	t->type = 3;
879  	WPA_PUT_BE16(t->transform_length, sizeof(*t));
880  	t->transform_type = IKEV2_TRANSFORM_INTEG;
881  	WPA_PUT_BE16(t->transform_id, data->proposal.integ);
882  
883  	t = wpabuf_put(msg, sizeof(*t));
884  	WPA_PUT_BE16(t->transform_length, sizeof(*t));
885  	t->transform_type = IKEV2_TRANSFORM_DH;
886  	WPA_PUT_BE16(t->transform_id, data->proposal.dh);
887  
888  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) p;
889  	WPA_PUT_BE16(p->proposal_length, plen);
890  
891  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
892  	WPA_PUT_BE16(phdr->payload_length, plen);
893  
894  	return 0;
895  }
896  
897  
ikev2_build_ker(struct ikev2_responder_data * data,struct wpabuf * msg,u8 next_payload)898  static int ikev2_build_ker(struct ikev2_responder_data *data,
899  			   struct wpabuf *msg, u8 next_payload)
900  {
901  	struct ikev2_payload_hdr *phdr;
902  	size_t plen;
903  	struct wpabuf *pv;
904  
905  	wpa_printf(MSG_DEBUG, "IKEV2: Adding KEr payload");
906  
907  	pv = dh_init(data->dh, &data->r_dh_private);
908  	if (pv == NULL) {
909  		wpa_printf(MSG_DEBUG, "IKEV2: Failed to initialize DH");
910  		return -1;
911  	}
912  
913  	/* KEr - RFC 4306, Sect. 3.4 */
914  	phdr = wpabuf_put(msg, sizeof(*phdr));
915  	phdr->next_payload = next_payload;
916  	phdr->flags = 0;
917  
918  	wpabuf_put_be16(msg, data->proposal.dh); /* DH Group # */
919  	wpabuf_put(msg, 2); /* RESERVED */
920  	/*
921  	 * RFC 4306, Sect. 3.4: possible zero padding for public value to
922  	 * match the length of the prime.
923  	 */
924  	wpabuf_put(msg, data->dh->prime_len - wpabuf_len(pv));
925  	wpabuf_put_buf(msg, pv);
926  	wpabuf_free(pv);
927  
928  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
929  	WPA_PUT_BE16(phdr->payload_length, plen);
930  	return 0;
931  }
932  
933  
ikev2_build_nr(struct ikev2_responder_data * data,struct wpabuf * msg,u8 next_payload)934  static int ikev2_build_nr(struct ikev2_responder_data *data,
935  			  struct wpabuf *msg, u8 next_payload)
936  {
937  	struct ikev2_payload_hdr *phdr;
938  	size_t plen;
939  
940  	wpa_printf(MSG_DEBUG, "IKEV2: Adding Nr payload");
941  
942  	/* Nr - RFC 4306, Sect. 3.9 */
943  	phdr = wpabuf_put(msg, sizeof(*phdr));
944  	phdr->next_payload = next_payload;
945  	phdr->flags = 0;
946  	wpabuf_put_data(msg, data->r_nonce, data->r_nonce_len);
947  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
948  	WPA_PUT_BE16(phdr->payload_length, plen);
949  	return 0;
950  }
951  
952  
ikev2_build_idr(struct ikev2_responder_data * data,struct wpabuf * msg,u8 next_payload)953  static int ikev2_build_idr(struct ikev2_responder_data *data,
954  			   struct wpabuf *msg, u8 next_payload)
955  {
956  	struct ikev2_payload_hdr *phdr;
957  	size_t plen;
958  
959  	wpa_printf(MSG_DEBUG, "IKEV2: Adding IDr payload");
960  
961  	if (data->IDr == NULL) {
962  		wpa_printf(MSG_INFO, "IKEV2: No IDr available");
963  		return -1;
964  	}
965  
966  	/* IDr - RFC 4306, Sect. 3.5 */
967  	phdr = wpabuf_put(msg, sizeof(*phdr));
968  	phdr->next_payload = next_payload;
969  	phdr->flags = 0;
970  	wpabuf_put_u8(msg, ID_KEY_ID);
971  	wpabuf_put(msg, 3); /* RESERVED */
972  	wpabuf_put_data(msg, data->IDr, data->IDr_len);
973  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
974  	WPA_PUT_BE16(phdr->payload_length, plen);
975  	return 0;
976  }
977  
978  
ikev2_build_auth(struct ikev2_responder_data * data,struct wpabuf * msg,u8 next_payload)979  static int ikev2_build_auth(struct ikev2_responder_data *data,
980  			    struct wpabuf *msg, u8 next_payload)
981  {
982  	struct ikev2_payload_hdr *phdr;
983  	size_t plen;
984  	const struct ikev2_prf_alg *prf;
985  
986  	wpa_printf(MSG_DEBUG, "IKEV2: Adding AUTH payload");
987  
988  	prf = ikev2_get_prf(data->proposal.prf);
989  	if (prf == NULL)
990  		return -1;
991  
992  	/* Authentication - RFC 4306, Sect. 3.8 */
993  	phdr = wpabuf_put(msg, sizeof(*phdr));
994  	phdr->next_payload = next_payload;
995  	phdr->flags = 0;
996  	wpabuf_put_u8(msg, AUTH_SHARED_KEY_MIC);
997  	wpabuf_put(msg, 3); /* RESERVED */
998  
999  	/* msg | Ni | prf(SK_pr,IDr') */
1000  	if (ikev2_derive_auth_data(data->proposal.prf, data->r_sign_msg,
1001  				   data->IDr, data->IDr_len, ID_KEY_ID,
1002  				   &data->keys, 0, data->shared_secret,
1003  				   data->shared_secret_len,
1004  				   data->i_nonce, data->i_nonce_len,
1005  				   data->key_pad, data->key_pad_len,
1006  				   wpabuf_put(msg, prf->hash_len)) < 0) {
1007  		wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data");
1008  		return -1;
1009  	}
1010  	wpabuf_free(data->r_sign_msg);
1011  	data->r_sign_msg = NULL;
1012  
1013  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
1014  	WPA_PUT_BE16(phdr->payload_length, plen);
1015  	return 0;
1016  }
1017  
1018  
ikev2_build_notification(struct ikev2_responder_data * data,struct wpabuf * msg,u8 next_payload)1019  static int ikev2_build_notification(struct ikev2_responder_data *data,
1020  				    struct wpabuf *msg, u8 next_payload)
1021  {
1022  	struct ikev2_payload_hdr *phdr;
1023  	size_t plen;
1024  
1025  	wpa_printf(MSG_DEBUG, "IKEV2: Adding Notification payload");
1026  
1027  	if (data->error_type == 0) {
1028  		wpa_printf(MSG_INFO, "IKEV2: No Notify Message Type "
1029  			   "available");
1030  		return -1;
1031  	}
1032  
1033  	/* Notify - RFC 4306, Sect. 3.10 */
1034  	phdr = wpabuf_put(msg, sizeof(*phdr));
1035  	phdr->next_payload = next_payload;
1036  	phdr->flags = 0;
1037  	wpabuf_put_u8(msg, 0); /* Protocol ID: no existing SA */
1038  	wpabuf_put_u8(msg, 0); /* SPI Size */
1039  	wpabuf_put_be16(msg, data->error_type);
1040  
1041  	switch (data->error_type) {
1042  	case INVALID_KE_PAYLOAD:
1043  		if (data->proposal.dh == -1) {
1044  			wpa_printf(MSG_INFO, "IKEV2: No DH Group selected for "
1045  				   "INVALID_KE_PAYLOAD notifications");
1046  			return -1;
1047  		}
1048  		wpabuf_put_be16(msg, data->proposal.dh);
1049  		wpa_printf(MSG_DEBUG, "IKEV2: INVALID_KE_PAYLOAD - request "
1050  			   "DH Group #%d", data->proposal.dh);
1051  		break;
1052  	case AUTHENTICATION_FAILED:
1053  		/* no associated data */
1054  		break;
1055  	default:
1056  		wpa_printf(MSG_INFO, "IKEV2: Unsupported Notify Message Type "
1057  			   "%d", data->error_type);
1058  		return -1;
1059  	}
1060  
1061  	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
1062  	WPA_PUT_BE16(phdr->payload_length, plen);
1063  	return 0;
1064  }
1065  
1066  
ikev2_build_sa_init(struct ikev2_responder_data * data)1067  static struct wpabuf * ikev2_build_sa_init(struct ikev2_responder_data *data)
1068  {
1069  	struct wpabuf *msg;
1070  
1071  	/* build IKE_SA_INIT: HDR, SAr1, KEr, Nr, [CERTREQ], [SK{IDr}] */
1072  
1073  	if (os_get_random(data->r_spi, IKEV2_SPI_LEN))
1074  		return NULL;
1075  	wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI",
1076  		    data->r_spi, IKEV2_SPI_LEN);
1077  
1078  	data->r_nonce_len = IKEV2_NONCE_MIN_LEN;
1079  	if (random_get_bytes(data->r_nonce, data->r_nonce_len))
1080  		return NULL;
1081  	wpa_hexdump(MSG_DEBUG, "IKEV2: Nr", data->r_nonce, data->r_nonce_len);
1082  
1083  	msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1500);
1084  	if (msg == NULL)
1085  		return NULL;
1086  
1087  	ikev2_build_hdr(data, msg, IKE_SA_INIT, IKEV2_PAYLOAD_SA, 0);
1088  	if (ikev2_build_sar1(data, msg, IKEV2_PAYLOAD_KEY_EXCHANGE) ||
1089  	    ikev2_build_ker(data, msg, IKEV2_PAYLOAD_NONCE) ||
1090  	    ikev2_build_nr(data, msg, data->peer_auth == PEER_AUTH_SECRET ?
1091  			   IKEV2_PAYLOAD_ENCRYPTED :
1092  			   IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) {
1093  		wpabuf_free(msg);
1094  		return NULL;
1095  	}
1096  
1097  	if (ikev2_derive_keys(data)) {
1098  		wpabuf_free(msg);
1099  		return NULL;
1100  	}
1101  
1102  	if (data->peer_auth == PEER_AUTH_CERT) {
1103  		/* TODO: CERTREQ with SHA-1 hashes of Subject Public Key Info
1104  		 * for trust agents */
1105  	}
1106  
1107  	if (data->peer_auth == PEER_AUTH_SECRET) {
1108  		struct wpabuf *plain = wpabuf_alloc(data->IDr_len + 1000);
1109  		if (plain == NULL) {
1110  			wpabuf_free(msg);
1111  			return NULL;
1112  		}
1113  		if (ikev2_build_idr(data, plain,
1114  				    IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
1115  		    ikev2_build_encrypted(data->proposal.encr,
1116  					  data->proposal.integ,
1117  					  &data->keys, 0, msg, plain,
1118  					  IKEV2_PAYLOAD_IDr)) {
1119  			wpabuf_free(plain);
1120  			wpabuf_free(msg);
1121  			return NULL;
1122  		}
1123  		wpabuf_free(plain);
1124  	}
1125  
1126  	ikev2_update_hdr(msg);
1127  
1128  	wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_INIT)", msg);
1129  
1130  	data->state = SA_AUTH;
1131  
1132  	wpabuf_free(data->r_sign_msg);
1133  	data->r_sign_msg = wpabuf_dup(msg);
1134  
1135  	return msg;
1136  }
1137  
1138  
ikev2_build_sa_auth(struct ikev2_responder_data * data)1139  static struct wpabuf * ikev2_build_sa_auth(struct ikev2_responder_data *data)
1140  {
1141  	struct wpabuf *msg, *plain;
1142  
1143  	/* build IKE_SA_AUTH: HDR, SK {IDr, [CERT,] AUTH} */
1144  
1145  	msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1000);
1146  	if (msg == NULL)
1147  		return NULL;
1148  	ikev2_build_hdr(data, msg, IKE_SA_AUTH, IKEV2_PAYLOAD_ENCRYPTED, 1);
1149  
1150  	plain = wpabuf_alloc(data->IDr_len + 1000);
1151  	if (plain == NULL) {
1152  		wpabuf_free(msg);
1153  		return NULL;
1154  	}
1155  
1156  	if (ikev2_build_idr(data, plain, IKEV2_PAYLOAD_AUTHENTICATION) ||
1157  	    ikev2_build_auth(data, plain, IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
1158  	    ikev2_build_encrypted(data->proposal.encr, data->proposal.integ,
1159  				  &data->keys, 0, msg, plain,
1160  				  IKEV2_PAYLOAD_IDr)) {
1161  		wpabuf_free(plain);
1162  		wpabuf_free(msg);
1163  		return NULL;
1164  	}
1165  	wpabuf_free(plain);
1166  
1167  	wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_AUTH)", msg);
1168  
1169  	data->state = IKEV2_DONE;
1170  
1171  	return msg;
1172  }
1173  
1174  
ikev2_build_notify(struct ikev2_responder_data * data)1175  static struct wpabuf * ikev2_build_notify(struct ikev2_responder_data *data)
1176  {
1177  	struct wpabuf *msg;
1178  
1179  	msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + 1000);
1180  	if (msg == NULL)
1181  		return NULL;
1182  	if (data->last_msg == LAST_MSG_SA_AUTH) {
1183  		/* HDR, SK{N} */
1184  		struct wpabuf *plain = wpabuf_alloc(100);
1185  		if (plain == NULL) {
1186  			wpabuf_free(msg);
1187  			return NULL;
1188  		}
1189  		ikev2_build_hdr(data, msg, IKE_SA_AUTH,
1190  				IKEV2_PAYLOAD_ENCRYPTED, 1);
1191  		if (ikev2_build_notification(data, plain,
1192  					     IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
1193  		    ikev2_build_encrypted(data->proposal.encr,
1194  					  data->proposal.integ,
1195  					  &data->keys, 0, msg, plain,
1196  					  IKEV2_PAYLOAD_NOTIFICATION)) {
1197  			wpabuf_free(plain);
1198  			wpabuf_free(msg);
1199  			return NULL;
1200  		}
1201  		wpabuf_free(plain);
1202  		data->state = IKEV2_FAILED;
1203  	} else {
1204  		/* HDR, N */
1205  		ikev2_build_hdr(data, msg, IKE_SA_INIT,
1206  				IKEV2_PAYLOAD_NOTIFICATION, 0);
1207  		if (ikev2_build_notification(data, msg,
1208  					     IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) {
1209  			wpabuf_free(msg);
1210  			return NULL;
1211  		}
1212  		data->state = SA_INIT;
1213  	}
1214  
1215  	ikev2_update_hdr(msg);
1216  
1217  	wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (Notification)",
1218  			msg);
1219  
1220  	return msg;
1221  }
1222  
1223  
ikev2_responder_build(struct ikev2_responder_data * data)1224  struct wpabuf * ikev2_responder_build(struct ikev2_responder_data *data)
1225  {
1226  	switch (data->state) {
1227  	case SA_INIT:
1228  		return ikev2_build_sa_init(data);
1229  	case SA_AUTH:
1230  		return ikev2_build_sa_auth(data);
1231  	case CHILD_SA:
1232  		return NULL;
1233  	case NOTIFY:
1234  		return ikev2_build_notify(data);
1235  	case IKEV2_DONE:
1236  	case IKEV2_FAILED:
1237  		return NULL;
1238  	}
1239  	return NULL;
1240  }
1241