1 /* 2 * IKEv2 responder (RFC 4306) for EAP-IKEV2 3 * Copyright (c) 2007, Jouni Malinen <j@w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "crypto/dh_groups.h" 19 #include "crypto/random.h" 20 #include "ikev2.h" 21 22 23 void ikev2_responder_deinit(struct ikev2_responder_data *data) 24 { 25 ikev2_free_keys(&data->keys); 26 wpabuf_free(data->i_dh_public); 27 wpabuf_free(data->r_dh_private); 28 os_free(data->IDi); 29 os_free(data->IDr); 30 os_free(data->shared_secret); 31 wpabuf_free(data->i_sign_msg); 32 wpabuf_free(data->r_sign_msg); 33 os_free(data->key_pad); 34 } 35 36 37 static int ikev2_derive_keys(struct ikev2_responder_data *data) 38 { 39 u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN]; 40 size_t buf_len, pad_len; 41 struct wpabuf *shared; 42 const struct ikev2_integ_alg *integ; 43 const struct ikev2_prf_alg *prf; 44 const struct ikev2_encr_alg *encr; 45 int ret; 46 const u8 *addr[2]; 47 size_t len[2]; 48 49 /* RFC 4306, Sect. 2.14 */ 50 51 integ = ikev2_get_integ(data->proposal.integ); 52 prf = ikev2_get_prf(data->proposal.prf); 53 encr = ikev2_get_encr(data->proposal.encr); 54 if (integ == NULL || prf == NULL || encr == NULL) { 55 wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal"); 56 return -1; 57 } 58 59 shared = dh_derive_shared(data->i_dh_public, data->r_dh_private, 60 data->dh); 61 if (shared == NULL) 62 return -1; 63 64 /* Construct Ni | Nr | SPIi | SPIr */ 65 66 buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN; 67 buf = os_malloc(buf_len); 68 if (buf == NULL) { 69 wpabuf_free(shared); 70 return -1; 71 } 72 73 pos = buf; 74 os_memcpy(pos, data->i_nonce, data->i_nonce_len); 75 pos += data->i_nonce_len; 76 os_memcpy(pos, data->r_nonce, data->r_nonce_len); 77 pos += data->r_nonce_len; 78 os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN); 79 pos += IKEV2_SPI_LEN; 80 os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN); 81 #ifdef CCNS_PL 82 #if __BYTE_ORDER == __LITTLE_ENDIAN 83 { 84 int i; 85 u8 *tmp = pos - IKEV2_SPI_LEN; 86 /* Incorrect byte re-ordering on little endian hosts.. */ 87 for (i = 0; i < IKEV2_SPI_LEN; i++) 88 *tmp++ = data->i_spi[IKEV2_SPI_LEN - 1 - i]; 89 for (i = 0; i < IKEV2_SPI_LEN; i++) 90 *tmp++ = data->r_spi[IKEV2_SPI_LEN - 1 - i]; 91 } 92 #endif 93 #endif /* CCNS_PL */ 94 95 /* SKEYSEED = prf(Ni | Nr, g^ir) */ 96 /* Use zero-padding per RFC 4306, Sect. 2.14 */ 97 pad_len = data->dh->prime_len - wpabuf_len(shared); 98 #ifdef CCNS_PL 99 /* Shared secret is not zero-padded correctly */ 100 pad_len = 0; 101 #endif /* CCNS_PL */ 102 pad = os_zalloc(pad_len ? pad_len : 1); 103 if (pad == NULL) { 104 wpabuf_free(shared); 105 os_free(buf); 106 return -1; 107 } 108 109 addr[0] = pad; 110 len[0] = pad_len; 111 addr[1] = wpabuf_head(shared); 112 len[1] = wpabuf_len(shared); 113 if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len, 114 2, addr, len, skeyseed) < 0) { 115 wpabuf_free(shared); 116 os_free(buf); 117 os_free(pad); 118 return -1; 119 } 120 os_free(pad); 121 wpabuf_free(shared); 122 123 /* DH parameters are not needed anymore, so free them */ 124 wpabuf_free(data->i_dh_public); 125 data->i_dh_public = NULL; 126 wpabuf_free(data->r_dh_private); 127 data->r_dh_private = NULL; 128 129 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED", 130 skeyseed, prf->hash_len); 131 132 ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len, 133 &data->keys); 134 os_free(buf); 135 return ret; 136 } 137 138 139 static int ikev2_parse_transform(struct ikev2_proposal_data *prop, 140 const u8 *pos, const u8 *end) 141 { 142 int transform_len; 143 const struct ikev2_transform *t; 144 u16 transform_id; 145 const u8 *tend; 146 147 if (end - pos < (int) sizeof(*t)) { 148 wpa_printf(MSG_INFO, "IKEV2: Too short transform"); 149 return -1; 150 } 151 152 t = (const struct ikev2_transform *) pos; 153 transform_len = WPA_GET_BE16(t->transform_length); 154 if (transform_len < (int) sizeof(*t) || pos + transform_len > end) { 155 wpa_printf(MSG_INFO, "IKEV2: Invalid transform length %d", 156 transform_len); 157 return -1; 158 } 159 tend = pos + transform_len; 160 161 transform_id = WPA_GET_BE16(t->transform_id); 162 163 wpa_printf(MSG_DEBUG, "IKEV2: Transform:"); 164 wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Transform Length: %d " 165 "Transform Type: %d Transform ID: %d", 166 t->type, transform_len, t->transform_type, transform_id); 167 168 if (t->type != 0 && t->type != 3) { 169 wpa_printf(MSG_INFO, "IKEV2: Unexpected Transform type"); 170 return -1; 171 } 172 173 pos = (const u8 *) (t + 1); 174 if (pos < tend) { 175 wpa_hexdump(MSG_DEBUG, "IKEV2: Transform Attributes", 176 pos, tend - pos); 177 } 178 179 switch (t->transform_type) { 180 case IKEV2_TRANSFORM_ENCR: 181 if (ikev2_get_encr(transform_id)) { 182 if (transform_id == ENCR_AES_CBC) { 183 if (tend - pos != 4) { 184 wpa_printf(MSG_DEBUG, "IKEV2: No " 185 "Transform Attr for AES"); 186 break; 187 } 188 #ifdef CCNS_PL 189 if (WPA_GET_BE16(pos) != 0x001d /* ?? */) { 190 wpa_printf(MSG_DEBUG, "IKEV2: Not a " 191 "Key Size attribute for " 192 "AES"); 193 break; 194 } 195 #else /* CCNS_PL */ 196 if (WPA_GET_BE16(pos) != 0x800e) { 197 wpa_printf(MSG_DEBUG, "IKEV2: Not a " 198 "Key Size attribute for " 199 "AES"); 200 break; 201 } 202 #endif /* CCNS_PL */ 203 if (WPA_GET_BE16(pos + 2) != 128) { 204 wpa_printf(MSG_DEBUG, "IKEV2: " 205 "Unsupported AES key size " 206 "%d bits", 207 WPA_GET_BE16(pos + 2)); 208 break; 209 } 210 } 211 prop->encr = transform_id; 212 } 213 break; 214 case IKEV2_TRANSFORM_PRF: 215 if (ikev2_get_prf(transform_id)) 216 prop->prf = transform_id; 217 break; 218 case IKEV2_TRANSFORM_INTEG: 219 if (ikev2_get_integ(transform_id)) 220 prop->integ = transform_id; 221 break; 222 case IKEV2_TRANSFORM_DH: 223 if (dh_groups_get(transform_id)) 224 prop->dh = transform_id; 225 break; 226 } 227 228 return transform_len; 229 } 230 231 232 static int ikev2_parse_proposal(struct ikev2_proposal_data *prop, 233 const u8 *pos, const u8 *end) 234 { 235 const u8 *pend, *ppos; 236 int proposal_len, i; 237 const struct ikev2_proposal *p; 238 239 if (end - pos < (int) sizeof(*p)) { 240 wpa_printf(MSG_INFO, "IKEV2: Too short proposal"); 241 return -1; 242 } 243 244 /* FIX: AND processing if multiple proposals use the same # */ 245 246 p = (const struct ikev2_proposal *) pos; 247 proposal_len = WPA_GET_BE16(p->proposal_length); 248 if (proposal_len < (int) sizeof(*p) || pos + proposal_len > end) { 249 wpa_printf(MSG_INFO, "IKEV2: Invalid proposal length %d", 250 proposal_len); 251 return -1; 252 } 253 wpa_printf(MSG_DEBUG, "IKEV2: SAi1 Proposal # %d", 254 p->proposal_num); 255 wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Proposal Length: %d " 256 " Protocol ID: %d", 257 p->type, proposal_len, p->protocol_id); 258 wpa_printf(MSG_DEBUG, "IKEV2: SPI Size: %d Transforms: %d", 259 p->spi_size, p->num_transforms); 260 261 if (p->type != 0 && p->type != 2) { 262 wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal type"); 263 return -1; 264 } 265 266 if (p->protocol_id != IKEV2_PROTOCOL_IKE) { 267 wpa_printf(MSG_DEBUG, "IKEV2: Unexpected Protocol ID " 268 "(only IKE allowed for EAP-IKEv2)"); 269 return -1; 270 } 271 272 if (p->proposal_num != prop->proposal_num) { 273 if (p->proposal_num == prop->proposal_num + 1) 274 prop->proposal_num = p->proposal_num; 275 else { 276 wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal #"); 277 return -1; 278 } 279 } 280 281 ppos = (const u8 *) (p + 1); 282 pend = pos + proposal_len; 283 if (ppos + p->spi_size > pend) { 284 wpa_printf(MSG_INFO, "IKEV2: Not enough room for SPI " 285 "in proposal"); 286 return -1; 287 } 288 if (p->spi_size) { 289 wpa_hexdump(MSG_DEBUG, "IKEV2: SPI", 290 ppos, p->spi_size); 291 ppos += p->spi_size; 292 } 293 294 /* 295 * For initial IKE_SA negotiation, SPI Size MUST be zero; for 296 * subsequent negotiations, it must be 8 for IKE. We only support 297 * initial case for now. 298 */ 299 if (p->spi_size != 0) { 300 wpa_printf(MSG_INFO, "IKEV2: Unexpected SPI Size"); 301 return -1; 302 } 303 304 if (p->num_transforms == 0) { 305 wpa_printf(MSG_INFO, "IKEV2: At least one transform required"); 306 return -1; 307 } 308 309 for (i = 0; i < (int) p->num_transforms; i++) { 310 int tlen = ikev2_parse_transform(prop, ppos, pend); 311 if (tlen < 0) 312 return -1; 313 ppos += tlen; 314 } 315 316 if (ppos != pend) { 317 wpa_printf(MSG_INFO, "IKEV2: Unexpected data after " 318 "transforms"); 319 return -1; 320 } 321 322 return proposal_len; 323 } 324 325 326 static int ikev2_process_sai1(struct ikev2_responder_data *data, 327 const u8 *sai1, size_t sai1_len) 328 { 329 struct ikev2_proposal_data prop; 330 const u8 *pos, *end; 331 int found = 0; 332 333 /* Security Association Payloads: <Proposals> */ 334 335 if (sai1 == NULL) { 336 wpa_printf(MSG_INFO, "IKEV2: SAi1 not received"); 337 return -1; 338 } 339 340 os_memset(&prop, 0, sizeof(prop)); 341 prop.proposal_num = 1; 342 343 pos = sai1; 344 end = sai1 + sai1_len; 345 346 while (pos < end) { 347 int plen; 348 349 prop.integ = -1; 350 prop.prf = -1; 351 prop.encr = -1; 352 prop.dh = -1; 353 plen = ikev2_parse_proposal(&prop, pos, end); 354 if (plen < 0) 355 return -1; 356 357 if (!found && prop.integ != -1 && prop.prf != -1 && 358 prop.encr != -1 && prop.dh != -1) { 359 os_memcpy(&data->proposal, &prop, sizeof(prop)); 360 data->dh = dh_groups_get(prop.dh); 361 found = 1; 362 } 363 364 pos += plen; 365 } 366 367 if (pos != end) { 368 wpa_printf(MSG_INFO, "IKEV2: Unexpected data after proposals"); 369 return -1; 370 } 371 372 if (!found) { 373 wpa_printf(MSG_INFO, "IKEV2: No acceptable proposal found"); 374 return -1; 375 } 376 377 wpa_printf(MSG_DEBUG, "IKEV2: Accepted proposal #%d: ENCR:%d PRF:%d " 378 "INTEG:%d D-H:%d", data->proposal.proposal_num, 379 data->proposal.encr, data->proposal.prf, 380 data->proposal.integ, data->proposal.dh); 381 382 return 0; 383 } 384 385 386 static int ikev2_process_kei(struct ikev2_responder_data *data, 387 const u8 *kei, size_t kei_len) 388 { 389 u16 group; 390 391 /* 392 * Key Exchange Payload: 393 * DH Group # (16 bits) 394 * RESERVED (16 bits) 395 * Key Exchange Data (Diffie-Hellman public value) 396 */ 397 398 if (kei == NULL) { 399 wpa_printf(MSG_INFO, "IKEV2: KEi not received"); 400 return -1; 401 } 402 403 if (kei_len < 4 + 96) { 404 wpa_printf(MSG_INFO, "IKEV2: Too show Key Exchange Payload"); 405 return -1; 406 } 407 408 group = WPA_GET_BE16(kei); 409 wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u", group); 410 411 if (group != data->proposal.dh) { 412 wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u does not match " 413 "with the selected proposal (%u)", 414 group, data->proposal.dh); 415 /* Reject message with Notify payload of type 416 * INVALID_KE_PAYLOAD (RFC 4306, Sect. 3.4) */ 417 data->error_type = INVALID_KE_PAYLOAD; 418 data->state = NOTIFY; 419 return -1; 420 } 421 422 if (data->dh == NULL) { 423 wpa_printf(MSG_INFO, "IKEV2: Unsupported DH group"); 424 return -1; 425 } 426 427 /* RFC 4306, Section 3.4: 428 * The length of DH public value MUST be equal to the length of the 429 * prime modulus. 430 */ 431 if (kei_len - 4 != data->dh->prime_len) { 432 wpa_printf(MSG_INFO, "IKEV2: Invalid DH public value length " 433 "%ld (expected %ld)", 434 (long) (kei_len - 4), (long) data->dh->prime_len); 435 return -1; 436 } 437 438 wpabuf_free(data->i_dh_public); 439 data->i_dh_public = wpabuf_alloc(kei_len - 4); 440 if (data->i_dh_public == NULL) 441 return -1; 442 wpabuf_put_data(data->i_dh_public, kei + 4, kei_len - 4); 443 444 wpa_hexdump_buf(MSG_DEBUG, "IKEV2: KEi Diffie-Hellman Public Value", 445 data->i_dh_public); 446 447 return 0; 448 } 449 450 451 static int ikev2_process_ni(struct ikev2_responder_data *data, 452 const u8 *ni, size_t ni_len) 453 { 454 if (ni == NULL) { 455 wpa_printf(MSG_INFO, "IKEV2: Ni not received"); 456 return -1; 457 } 458 459 if (ni_len < IKEV2_NONCE_MIN_LEN || ni_len > IKEV2_NONCE_MAX_LEN) { 460 wpa_printf(MSG_INFO, "IKEV2: Invalid Ni length %ld", 461 (long) ni_len); 462 return -1; 463 } 464 465 #ifdef CCNS_PL 466 /* Zeros are removed incorrectly from the beginning of the nonces */ 467 while (ni_len > 1 && *ni == 0) { 468 ni_len--; 469 ni++; 470 } 471 #endif /* CCNS_PL */ 472 473 data->i_nonce_len = ni_len; 474 os_memcpy(data->i_nonce, ni, ni_len); 475 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Ni", 476 data->i_nonce, data->i_nonce_len); 477 478 return 0; 479 } 480 481 482 static int ikev2_process_sa_init(struct ikev2_responder_data *data, 483 const struct ikev2_hdr *hdr, 484 struct ikev2_payloads *pl) 485 { 486 if (ikev2_process_sai1(data, pl->sa, pl->sa_len) < 0 || 487 ikev2_process_kei(data, pl->ke, pl->ke_len) < 0 || 488 ikev2_process_ni(data, pl->nonce, pl->nonce_len) < 0) 489 return -1; 490 491 os_memcpy(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN); 492 493 return 0; 494 } 495 496 497 static int ikev2_process_idi(struct ikev2_responder_data *data, 498 const u8 *idi, size_t idi_len) 499 { 500 u8 id_type; 501 502 if (idi == NULL) { 503 wpa_printf(MSG_INFO, "IKEV2: No IDi received"); 504 return -1; 505 } 506 507 if (idi_len < 4) { 508 wpa_printf(MSG_INFO, "IKEV2: Too short IDi payload"); 509 return -1; 510 } 511 512 id_type = idi[0]; 513 idi += 4; 514 idi_len -= 4; 515 516 wpa_printf(MSG_DEBUG, "IKEV2: IDi ID Type %d", id_type); 517 wpa_hexdump_ascii(MSG_DEBUG, "IKEV2: IDi", idi, idi_len); 518 os_free(data->IDi); 519 data->IDi = os_malloc(idi_len); 520 if (data->IDi == NULL) 521 return -1; 522 os_memcpy(data->IDi, idi, idi_len); 523 data->IDi_len = idi_len; 524 data->IDi_type = id_type; 525 526 return 0; 527 } 528 529 530 static int ikev2_process_cert(struct ikev2_responder_data *data, 531 const u8 *cert, size_t cert_len) 532 { 533 u8 cert_encoding; 534 535 if (cert == NULL) { 536 if (data->peer_auth == PEER_AUTH_CERT) { 537 wpa_printf(MSG_INFO, "IKEV2: No Certificate received"); 538 return -1; 539 } 540 return 0; 541 } 542 543 if (cert_len < 1) { 544 wpa_printf(MSG_INFO, "IKEV2: No Cert Encoding field"); 545 return -1; 546 } 547 548 cert_encoding = cert[0]; 549 cert++; 550 cert_len--; 551 552 wpa_printf(MSG_DEBUG, "IKEV2: Cert Encoding %d", cert_encoding); 553 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Certificate Data", cert, cert_len); 554 555 /* TODO: validate certificate */ 556 557 return 0; 558 } 559 560 561 static int ikev2_process_auth_cert(struct ikev2_responder_data *data, 562 u8 method, const u8 *auth, size_t auth_len) 563 { 564 if (method != AUTH_RSA_SIGN) { 565 wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication " 566 "method %d", method); 567 return -1; 568 } 569 570 /* TODO: validate AUTH */ 571 return 0; 572 } 573 574 575 static int ikev2_process_auth_secret(struct ikev2_responder_data *data, 576 u8 method, const u8 *auth, 577 size_t auth_len) 578 { 579 u8 auth_data[IKEV2_MAX_HASH_LEN]; 580 const struct ikev2_prf_alg *prf; 581 582 if (method != AUTH_SHARED_KEY_MIC) { 583 wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication " 584 "method %d", method); 585 return -1; 586 } 587 588 /* msg | Nr | prf(SK_pi,IDi') */ 589 if (ikev2_derive_auth_data(data->proposal.prf, data->i_sign_msg, 590 data->IDi, data->IDi_len, data->IDi_type, 591 &data->keys, 1, data->shared_secret, 592 data->shared_secret_len, 593 data->r_nonce, data->r_nonce_len, 594 data->key_pad, data->key_pad_len, 595 auth_data) < 0) { 596 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data"); 597 return -1; 598 } 599 600 wpabuf_free(data->i_sign_msg); 601 data->i_sign_msg = NULL; 602 603 prf = ikev2_get_prf(data->proposal.prf); 604 if (prf == NULL) 605 return -1; 606 607 if (auth_len != prf->hash_len || 608 os_memcmp(auth, auth_data, auth_len) != 0) { 609 wpa_printf(MSG_INFO, "IKEV2: Invalid Authentication Data"); 610 wpa_hexdump(MSG_DEBUG, "IKEV2: Received Authentication Data", 611 auth, auth_len); 612 wpa_hexdump(MSG_DEBUG, "IKEV2: Expected Authentication Data", 613 auth_data, prf->hash_len); 614 data->error_type = AUTHENTICATION_FAILED; 615 data->state = NOTIFY; 616 return -1; 617 } 618 619 wpa_printf(MSG_DEBUG, "IKEV2: Server authenticated successfully " 620 "using shared keys"); 621 622 return 0; 623 } 624 625 626 static int ikev2_process_auth(struct ikev2_responder_data *data, 627 const u8 *auth, size_t auth_len) 628 { 629 u8 auth_method; 630 631 if (auth == NULL) { 632 wpa_printf(MSG_INFO, "IKEV2: No Authentication Payload"); 633 return -1; 634 } 635 636 if (auth_len < 4) { 637 wpa_printf(MSG_INFO, "IKEV2: Too short Authentication " 638 "Payload"); 639 return -1; 640 } 641 642 auth_method = auth[0]; 643 auth += 4; 644 auth_len -= 4; 645 646 wpa_printf(MSG_DEBUG, "IKEV2: Auth Method %d", auth_method); 647 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Authentication Data", auth, auth_len); 648 649 switch (data->peer_auth) { 650 case PEER_AUTH_CERT: 651 return ikev2_process_auth_cert(data, auth_method, auth, 652 auth_len); 653 case PEER_AUTH_SECRET: 654 return ikev2_process_auth_secret(data, auth_method, auth, 655 auth_len); 656 } 657 658 return -1; 659 } 660 661 662 static int ikev2_process_sa_auth_decrypted(struct ikev2_responder_data *data, 663 u8 next_payload, 664 u8 *payload, size_t payload_len) 665 { 666 struct ikev2_payloads pl; 667 668 wpa_printf(MSG_DEBUG, "IKEV2: Processing decrypted payloads"); 669 670 if (ikev2_parse_payloads(&pl, next_payload, payload, payload + 671 payload_len) < 0) { 672 wpa_printf(MSG_INFO, "IKEV2: Failed to parse decrypted " 673 "payloads"); 674 return -1; 675 } 676 677 if (ikev2_process_idi(data, pl.idi, pl.idi_len) < 0 || 678 ikev2_process_cert(data, pl.cert, pl.cert_len) < 0 || 679 ikev2_process_auth(data, pl.auth, pl.auth_len) < 0) 680 return -1; 681 682 return 0; 683 } 684 685 686 static int ikev2_process_sa_auth(struct ikev2_responder_data *data, 687 const struct ikev2_hdr *hdr, 688 struct ikev2_payloads *pl) 689 { 690 u8 *decrypted; 691 size_t decrypted_len; 692 int ret; 693 694 decrypted = ikev2_decrypt_payload(data->proposal.encr, 695 data->proposal.integ, 696 &data->keys, 1, hdr, pl->encrypted, 697 pl->encrypted_len, &decrypted_len); 698 if (decrypted == NULL) 699 return -1; 700 701 ret = ikev2_process_sa_auth_decrypted(data, pl->encr_next_payload, 702 decrypted, decrypted_len); 703 os_free(decrypted); 704 705 return ret; 706 } 707 708 709 static int ikev2_validate_rx_state(struct ikev2_responder_data *data, 710 u8 exchange_type, u32 message_id) 711 { 712 switch (data->state) { 713 case SA_INIT: 714 /* Expect to receive IKE_SA_INIT: HDR, SAi1, KEi, Ni */ 715 if (exchange_type != IKE_SA_INIT) { 716 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 717 "%u in SA_INIT state", exchange_type); 718 return -1; 719 } 720 if (message_id != 0) { 721 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 722 "in SA_INIT state", message_id); 723 return -1; 724 } 725 break; 726 case SA_AUTH: 727 /* Expect to receive IKE_SA_AUTH: 728 * HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,] 729 * AUTH, SAi2, TSi, TSr} 730 */ 731 if (exchange_type != IKE_SA_AUTH) { 732 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 733 "%u in SA_AUTH state", exchange_type); 734 return -1; 735 } 736 if (message_id != 1) { 737 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 738 "in SA_AUTH state", message_id); 739 return -1; 740 } 741 break; 742 case CHILD_SA: 743 if (exchange_type != CREATE_CHILD_SA) { 744 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type " 745 "%u in CHILD_SA state", exchange_type); 746 return -1; 747 } 748 if (message_id != 2) { 749 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u " 750 "in CHILD_SA state", message_id); 751 return -1; 752 } 753 break; 754 case NOTIFY: 755 case IKEV2_DONE: 756 case IKEV2_FAILED: 757 return -1; 758 } 759 760 return 0; 761 } 762 763 764 int ikev2_responder_process(struct ikev2_responder_data *data, 765 const struct wpabuf *buf) 766 { 767 const struct ikev2_hdr *hdr; 768 u32 length, message_id; 769 const u8 *pos, *end; 770 struct ikev2_payloads pl; 771 772 wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)", 773 (unsigned long) wpabuf_len(buf)); 774 775 if (wpabuf_len(buf) < sizeof(*hdr)) { 776 wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR"); 777 return -1; 778 } 779 780 data->error_type = 0; 781 hdr = (const struct ikev2_hdr *) wpabuf_head(buf); 782 end = wpabuf_head_u8(buf) + wpabuf_len(buf); 783 message_id = WPA_GET_BE32(hdr->message_id); 784 length = WPA_GET_BE32(hdr->length); 785 786 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Initiator's SPI", 787 hdr->i_spi, IKEV2_SPI_LEN); 788 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI", 789 hdr->r_spi, IKEV2_SPI_LEN); 790 wpa_printf(MSG_DEBUG, "IKEV2: Next Payload: %u Version: 0x%x " 791 "Exchange Type: %u", 792 hdr->next_payload, hdr->version, hdr->exchange_type); 793 wpa_printf(MSG_DEBUG, "IKEV2: Message ID: %u Length: %u", 794 message_id, length); 795 796 if (hdr->version != IKEV2_VERSION) { 797 wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x " 798 "(expected 0x%x)", hdr->version, IKEV2_VERSION); 799 return -1; 800 } 801 802 if (length != wpabuf_len(buf)) { 803 wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != " 804 "RX: %lu)", (unsigned long) length, 805 (unsigned long) wpabuf_len(buf)); 806 return -1; 807 } 808 809 if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0) 810 return -1; 811 812 if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) != 813 IKEV2_HDR_INITIATOR) { 814 wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x", 815 hdr->flags); 816 return -1; 817 } 818 819 if (data->state != SA_INIT) { 820 if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) { 821 wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA " 822 "Initiator's SPI"); 823 return -1; 824 } 825 if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) { 826 wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA " 827 "Responder's SPI"); 828 return -1; 829 } 830 } 831 832 pos = (const u8 *) (hdr + 1); 833 if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0) 834 return -1; 835 836 if (data->state == SA_INIT) { 837 data->last_msg = LAST_MSG_SA_INIT; 838 if (ikev2_process_sa_init(data, hdr, &pl) < 0) { 839 if (data->state == NOTIFY) 840 return 0; 841 return -1; 842 } 843 wpabuf_free(data->i_sign_msg); 844 data->i_sign_msg = wpabuf_dup(buf); 845 } 846 847 if (data->state == SA_AUTH) { 848 data->last_msg = LAST_MSG_SA_AUTH; 849 if (ikev2_process_sa_auth(data, hdr, &pl) < 0) { 850 if (data->state == NOTIFY) 851 return 0; 852 return -1; 853 } 854 } 855 856 return 0; 857 } 858 859 860 static void ikev2_build_hdr(struct ikev2_responder_data *data, 861 struct wpabuf *msg, u8 exchange_type, 862 u8 next_payload, u32 message_id) 863 { 864 struct ikev2_hdr *hdr; 865 866 wpa_printf(MSG_DEBUG, "IKEV2: Adding HDR"); 867 868 /* HDR - RFC 4306, Sect. 3.1 */ 869 hdr = wpabuf_put(msg, sizeof(*hdr)); 870 os_memcpy(hdr->i_spi, data->i_spi, IKEV2_SPI_LEN); 871 os_memcpy(hdr->r_spi, data->r_spi, IKEV2_SPI_LEN); 872 hdr->next_payload = next_payload; 873 hdr->version = IKEV2_VERSION; 874 hdr->exchange_type = exchange_type; 875 hdr->flags = IKEV2_HDR_RESPONSE; 876 WPA_PUT_BE32(hdr->message_id, message_id); 877 } 878 879 880 static int ikev2_build_sar1(struct ikev2_responder_data *data, 881 struct wpabuf *msg, u8 next_payload) 882 { 883 struct ikev2_payload_hdr *phdr; 884 size_t plen; 885 struct ikev2_proposal *p; 886 struct ikev2_transform *t; 887 888 wpa_printf(MSG_DEBUG, "IKEV2: Adding SAr1 payload"); 889 890 /* SAr1 - RFC 4306, Sect. 2.7 and 3.3 */ 891 phdr = wpabuf_put(msg, sizeof(*phdr)); 892 phdr->next_payload = next_payload; 893 phdr->flags = 0; 894 895 p = wpabuf_put(msg, sizeof(*p)); 896 #ifdef CCNS_PL 897 /* Seems to require that the Proposal # is 1 even though RFC 4306 898 * Sect 3.3.1 has following requirement "When a proposal is accepted, 899 * all of the proposal numbers in the SA payload MUST be the same and 900 * MUST match the number on the proposal sent that was accepted.". 901 */ 902 p->proposal_num = 1; 903 #else /* CCNS_PL */ 904 p->proposal_num = data->proposal.proposal_num; 905 #endif /* CCNS_PL */ 906 p->protocol_id = IKEV2_PROTOCOL_IKE; 907 p->num_transforms = 4; 908 909 t = wpabuf_put(msg, sizeof(*t)); 910 t->type = 3; 911 t->transform_type = IKEV2_TRANSFORM_ENCR; 912 WPA_PUT_BE16(t->transform_id, data->proposal.encr); 913 if (data->proposal.encr == ENCR_AES_CBC) { 914 /* Transform Attribute: Key Len = 128 bits */ 915 #ifdef CCNS_PL 916 wpabuf_put_be16(msg, 0x001d); /* ?? */ 917 #else /* CCNS_PL */ 918 wpabuf_put_be16(msg, 0x800e); /* AF=1, AttrType=14 */ 919 #endif /* CCNS_PL */ 920 wpabuf_put_be16(msg, 128); /* 128-bit key */ 921 } 922 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) t; 923 WPA_PUT_BE16(t->transform_length, plen); 924 925 t = wpabuf_put(msg, sizeof(*t)); 926 t->type = 3; 927 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 928 t->transform_type = IKEV2_TRANSFORM_PRF; 929 WPA_PUT_BE16(t->transform_id, data->proposal.prf); 930 931 t = wpabuf_put(msg, sizeof(*t)); 932 t->type = 3; 933 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 934 t->transform_type = IKEV2_TRANSFORM_INTEG; 935 WPA_PUT_BE16(t->transform_id, data->proposal.integ); 936 937 t = wpabuf_put(msg, sizeof(*t)); 938 WPA_PUT_BE16(t->transform_length, sizeof(*t)); 939 t->transform_type = IKEV2_TRANSFORM_DH; 940 WPA_PUT_BE16(t->transform_id, data->proposal.dh); 941 942 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) p; 943 WPA_PUT_BE16(p->proposal_length, plen); 944 945 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 946 WPA_PUT_BE16(phdr->payload_length, plen); 947 948 return 0; 949 } 950 951 952 static int ikev2_build_ker(struct ikev2_responder_data *data, 953 struct wpabuf *msg, u8 next_payload) 954 { 955 struct ikev2_payload_hdr *phdr; 956 size_t plen; 957 struct wpabuf *pv; 958 959 wpa_printf(MSG_DEBUG, "IKEV2: Adding KEr payload"); 960 961 pv = dh_init(data->dh, &data->r_dh_private); 962 if (pv == NULL) { 963 wpa_printf(MSG_DEBUG, "IKEV2: Failed to initialize DH"); 964 return -1; 965 } 966 967 /* KEr - RFC 4306, Sect. 3.4 */ 968 phdr = wpabuf_put(msg, sizeof(*phdr)); 969 phdr->next_payload = next_payload; 970 phdr->flags = 0; 971 972 wpabuf_put_be16(msg, data->proposal.dh); /* DH Group # */ 973 wpabuf_put(msg, 2); /* RESERVED */ 974 /* 975 * RFC 4306, Sect. 3.4: possible zero padding for public value to 976 * match the length of the prime. 977 */ 978 wpabuf_put(msg, data->dh->prime_len - wpabuf_len(pv)); 979 wpabuf_put_buf(msg, pv); 980 wpabuf_free(pv); 981 982 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 983 WPA_PUT_BE16(phdr->payload_length, plen); 984 return 0; 985 } 986 987 988 static int ikev2_build_nr(struct ikev2_responder_data *data, 989 struct wpabuf *msg, u8 next_payload) 990 { 991 struct ikev2_payload_hdr *phdr; 992 size_t plen; 993 994 wpa_printf(MSG_DEBUG, "IKEV2: Adding Nr payload"); 995 996 /* Nr - RFC 4306, Sect. 3.9 */ 997 phdr = wpabuf_put(msg, sizeof(*phdr)); 998 phdr->next_payload = next_payload; 999 phdr->flags = 0; 1000 wpabuf_put_data(msg, data->r_nonce, data->r_nonce_len); 1001 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1002 WPA_PUT_BE16(phdr->payload_length, plen); 1003 return 0; 1004 } 1005 1006 1007 static int ikev2_build_idr(struct ikev2_responder_data *data, 1008 struct wpabuf *msg, u8 next_payload) 1009 { 1010 struct ikev2_payload_hdr *phdr; 1011 size_t plen; 1012 1013 wpa_printf(MSG_DEBUG, "IKEV2: Adding IDr payload"); 1014 1015 if (data->IDr == NULL) { 1016 wpa_printf(MSG_INFO, "IKEV2: No IDr available"); 1017 return -1; 1018 } 1019 1020 /* IDr - RFC 4306, Sect. 3.5 */ 1021 phdr = wpabuf_put(msg, sizeof(*phdr)); 1022 phdr->next_payload = next_payload; 1023 phdr->flags = 0; 1024 wpabuf_put_u8(msg, ID_KEY_ID); 1025 wpabuf_put(msg, 3); /* RESERVED */ 1026 wpabuf_put_data(msg, data->IDr, data->IDr_len); 1027 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1028 WPA_PUT_BE16(phdr->payload_length, plen); 1029 return 0; 1030 } 1031 1032 1033 static int ikev2_build_auth(struct ikev2_responder_data *data, 1034 struct wpabuf *msg, u8 next_payload) 1035 { 1036 struct ikev2_payload_hdr *phdr; 1037 size_t plen; 1038 const struct ikev2_prf_alg *prf; 1039 1040 wpa_printf(MSG_DEBUG, "IKEV2: Adding AUTH payload"); 1041 1042 prf = ikev2_get_prf(data->proposal.prf); 1043 if (prf == NULL) 1044 return -1; 1045 1046 /* Authentication - RFC 4306, Sect. 3.8 */ 1047 phdr = wpabuf_put(msg, sizeof(*phdr)); 1048 phdr->next_payload = next_payload; 1049 phdr->flags = 0; 1050 wpabuf_put_u8(msg, AUTH_SHARED_KEY_MIC); 1051 wpabuf_put(msg, 3); /* RESERVED */ 1052 1053 /* msg | Ni | prf(SK_pr,IDr') */ 1054 if (ikev2_derive_auth_data(data->proposal.prf, data->r_sign_msg, 1055 data->IDr, data->IDr_len, ID_KEY_ID, 1056 &data->keys, 0, data->shared_secret, 1057 data->shared_secret_len, 1058 data->i_nonce, data->i_nonce_len, 1059 data->key_pad, data->key_pad_len, 1060 wpabuf_put(msg, prf->hash_len)) < 0) { 1061 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data"); 1062 return -1; 1063 } 1064 wpabuf_free(data->r_sign_msg); 1065 data->r_sign_msg = NULL; 1066 1067 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1068 WPA_PUT_BE16(phdr->payload_length, plen); 1069 return 0; 1070 } 1071 1072 1073 static int ikev2_build_notification(struct ikev2_responder_data *data, 1074 struct wpabuf *msg, u8 next_payload) 1075 { 1076 struct ikev2_payload_hdr *phdr; 1077 size_t plen; 1078 1079 wpa_printf(MSG_DEBUG, "IKEV2: Adding Notification payload"); 1080 1081 if (data->error_type == 0) { 1082 wpa_printf(MSG_INFO, "IKEV2: No Notify Message Type " 1083 "available"); 1084 return -1; 1085 } 1086 1087 /* Notify - RFC 4306, Sect. 3.10 */ 1088 phdr = wpabuf_put(msg, sizeof(*phdr)); 1089 phdr->next_payload = next_payload; 1090 phdr->flags = 0; 1091 #ifdef CCNS_PL 1092 wpabuf_put_u8(msg, 1); /* Protocol ID: IKE_SA notification */ 1093 #else /* CCNS_PL */ 1094 wpabuf_put_u8(msg, 0); /* Protocol ID: no existing SA */ 1095 #endif /* CCNS_PL */ 1096 wpabuf_put_u8(msg, 0); /* SPI Size */ 1097 wpabuf_put_be16(msg, data->error_type); 1098 1099 switch (data->error_type) { 1100 case INVALID_KE_PAYLOAD: 1101 if (data->proposal.dh == -1) { 1102 wpa_printf(MSG_INFO, "IKEV2: No DH Group selected for " 1103 "INVALID_KE_PAYLOAD notifications"); 1104 return -1; 1105 } 1106 wpabuf_put_be16(msg, data->proposal.dh); 1107 wpa_printf(MSG_DEBUG, "IKEV2: INVALID_KE_PAYLOAD - request " 1108 "DH Group #%d", data->proposal.dh); 1109 break; 1110 case AUTHENTICATION_FAILED: 1111 /* no associated data */ 1112 break; 1113 default: 1114 wpa_printf(MSG_INFO, "IKEV2: Unsupported Notify Message Type " 1115 "%d", data->error_type); 1116 return -1; 1117 } 1118 1119 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr; 1120 WPA_PUT_BE16(phdr->payload_length, plen); 1121 return 0; 1122 } 1123 1124 1125 static struct wpabuf * ikev2_build_sa_init(struct ikev2_responder_data *data) 1126 { 1127 struct wpabuf *msg; 1128 1129 /* build IKE_SA_INIT: HDR, SAr1, KEr, Nr, [CERTREQ], [SK{IDr}] */ 1130 1131 if (os_get_random(data->r_spi, IKEV2_SPI_LEN)) 1132 return NULL; 1133 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI", 1134 data->r_spi, IKEV2_SPI_LEN); 1135 1136 data->r_nonce_len = IKEV2_NONCE_MIN_LEN; 1137 if (random_get_bytes(data->r_nonce, data->r_nonce_len)) 1138 return NULL; 1139 #ifdef CCNS_PL 1140 /* Zeros are removed incorrectly from the beginning of the nonces in 1141 * key derivation; as a workaround, make sure Nr does not start with 1142 * zero.. */ 1143 if (data->r_nonce[0] == 0) 1144 data->r_nonce[0] = 1; 1145 #endif /* CCNS_PL */ 1146 wpa_hexdump(MSG_DEBUG, "IKEV2: Nr", data->r_nonce, data->r_nonce_len); 1147 1148 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1500); 1149 if (msg == NULL) 1150 return NULL; 1151 1152 ikev2_build_hdr(data, msg, IKE_SA_INIT, IKEV2_PAYLOAD_SA, 0); 1153 if (ikev2_build_sar1(data, msg, IKEV2_PAYLOAD_KEY_EXCHANGE) || 1154 ikev2_build_ker(data, msg, IKEV2_PAYLOAD_NONCE) || 1155 ikev2_build_nr(data, msg, data->peer_auth == PEER_AUTH_SECRET ? 1156 IKEV2_PAYLOAD_ENCRYPTED : 1157 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) { 1158 wpabuf_free(msg); 1159 return NULL; 1160 } 1161 1162 if (ikev2_derive_keys(data)) { 1163 wpabuf_free(msg); 1164 return NULL; 1165 } 1166 1167 if (data->peer_auth == PEER_AUTH_CERT) { 1168 /* TODO: CERTREQ with SHA-1 hashes of Subject Public Key Info 1169 * for trust agents */ 1170 } 1171 1172 if (data->peer_auth == PEER_AUTH_SECRET) { 1173 struct wpabuf *plain = wpabuf_alloc(data->IDr_len + 1000); 1174 if (plain == NULL) { 1175 wpabuf_free(msg); 1176 return NULL; 1177 } 1178 if (ikev2_build_idr(data, plain, 1179 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1180 ikev2_build_encrypted(data->proposal.encr, 1181 data->proposal.integ, 1182 &data->keys, 0, msg, plain, 1183 IKEV2_PAYLOAD_IDr)) { 1184 wpabuf_free(plain); 1185 wpabuf_free(msg); 1186 return NULL; 1187 } 1188 wpabuf_free(plain); 1189 } 1190 1191 ikev2_update_hdr(msg); 1192 1193 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_INIT)", msg); 1194 1195 data->state = SA_AUTH; 1196 1197 wpabuf_free(data->r_sign_msg); 1198 data->r_sign_msg = wpabuf_dup(msg); 1199 1200 return msg; 1201 } 1202 1203 1204 static struct wpabuf * ikev2_build_sa_auth(struct ikev2_responder_data *data) 1205 { 1206 struct wpabuf *msg, *plain; 1207 1208 /* build IKE_SA_AUTH: HDR, SK {IDr, [CERT,] AUTH} */ 1209 1210 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1000); 1211 if (msg == NULL) 1212 return NULL; 1213 ikev2_build_hdr(data, msg, IKE_SA_AUTH, IKEV2_PAYLOAD_ENCRYPTED, 1); 1214 1215 plain = wpabuf_alloc(data->IDr_len + 1000); 1216 if (plain == NULL) { 1217 wpabuf_free(msg); 1218 return NULL; 1219 } 1220 1221 if (ikev2_build_idr(data, plain, IKEV2_PAYLOAD_AUTHENTICATION) || 1222 ikev2_build_auth(data, plain, IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1223 ikev2_build_encrypted(data->proposal.encr, data->proposal.integ, 1224 &data->keys, 0, msg, plain, 1225 IKEV2_PAYLOAD_IDr)) { 1226 wpabuf_free(plain); 1227 wpabuf_free(msg); 1228 return NULL; 1229 } 1230 wpabuf_free(plain); 1231 1232 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_AUTH)", msg); 1233 1234 data->state = IKEV2_DONE; 1235 1236 return msg; 1237 } 1238 1239 1240 static struct wpabuf * ikev2_build_notify(struct ikev2_responder_data *data) 1241 { 1242 struct wpabuf *msg; 1243 1244 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + 1000); 1245 if (msg == NULL) 1246 return NULL; 1247 if (data->last_msg == LAST_MSG_SA_AUTH) { 1248 /* HDR, SK{N} */ 1249 struct wpabuf *plain = wpabuf_alloc(100); 1250 if (plain == NULL) { 1251 wpabuf_free(msg); 1252 return NULL; 1253 } 1254 ikev2_build_hdr(data, msg, IKE_SA_AUTH, 1255 IKEV2_PAYLOAD_ENCRYPTED, 1); 1256 if (ikev2_build_notification(data, plain, 1257 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) || 1258 ikev2_build_encrypted(data->proposal.encr, 1259 data->proposal.integ, 1260 &data->keys, 0, msg, plain, 1261 IKEV2_PAYLOAD_NOTIFICATION)) { 1262 wpabuf_free(plain); 1263 wpabuf_free(msg); 1264 return NULL; 1265 } 1266 data->state = IKEV2_FAILED; 1267 } else { 1268 /* HDR, N */ 1269 ikev2_build_hdr(data, msg, IKE_SA_INIT, 1270 IKEV2_PAYLOAD_NOTIFICATION, 0); 1271 if (ikev2_build_notification(data, msg, 1272 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) { 1273 wpabuf_free(msg); 1274 return NULL; 1275 } 1276 data->state = SA_INIT; 1277 } 1278 1279 ikev2_update_hdr(msg); 1280 1281 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (Notification)", 1282 msg); 1283 1284 return msg; 1285 } 1286 1287 1288 struct wpabuf * ikev2_responder_build(struct ikev2_responder_data *data) 1289 { 1290 switch (data->state) { 1291 case SA_INIT: 1292 return ikev2_build_sa_init(data); 1293 case SA_AUTH: 1294 return ikev2_build_sa_auth(data); 1295 case CHILD_SA: 1296 return NULL; 1297 case NOTIFY: 1298 return ikev2_build_notify(data); 1299 case IKEV2_DONE: 1300 case IKEV2_FAILED: 1301 return NULL; 1302 } 1303 return NULL; 1304 } 1305