Home | History | Annotate | Download | only in eap_peer
      1 /*
      2  * IKEv2 responder (RFC 4306) for EAP-IKEV2
      3  * Copyright (c) 2007, Jouni Malinen <j (at) w1.fi>
      4  *
      5  * This software may be distributed under the terms of the BSD license.
      6  * See README for more details.
      7  */
      8 
      9 #include "includes.h"
     10 
     11 #include "common.h"
     12 #include "crypto/dh_groups.h"
     13 #include "crypto/random.h"
     14 #include "ikev2.h"
     15 
     16 
     17 void ikev2_responder_deinit(struct ikev2_responder_data *data)
     18 {
     19 	ikev2_free_keys(&data->keys);
     20 	wpabuf_free(data->i_dh_public);
     21 	wpabuf_free(data->r_dh_private);
     22 	os_free(data->IDi);
     23 	os_free(data->IDr);
     24 	os_free(data->shared_secret);
     25 	wpabuf_free(data->i_sign_msg);
     26 	wpabuf_free(data->r_sign_msg);
     27 	os_free(data->key_pad);
     28 }
     29 
     30 
     31 static int ikev2_derive_keys(struct ikev2_responder_data *data)
     32 {
     33 	u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN];
     34 	size_t buf_len, pad_len;
     35 	struct wpabuf *shared;
     36 	const struct ikev2_integ_alg *integ;
     37 	const struct ikev2_prf_alg *prf;
     38 	const struct ikev2_encr_alg *encr;
     39 	int ret;
     40 	const u8 *addr[2];
     41 	size_t len[2];
     42 
     43 	/* RFC 4306, Sect. 2.14 */
     44 
     45 	integ = ikev2_get_integ(data->proposal.integ);
     46 	prf = ikev2_get_prf(data->proposal.prf);
     47 	encr = ikev2_get_encr(data->proposal.encr);
     48 	if (integ == NULL || prf == NULL || encr == NULL) {
     49 		wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal");
     50 		return -1;
     51 	}
     52 
     53 	shared = dh_derive_shared(data->i_dh_public, data->r_dh_private,
     54 				  data->dh);
     55 	if (shared == NULL)
     56 		return -1;
     57 
     58 	/* Construct Ni | Nr | SPIi | SPIr */
     59 
     60 	buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN;
     61 	buf = os_malloc(buf_len);
     62 	if (buf == NULL) {
     63 		wpabuf_free(shared);
     64 		return -1;
     65 	}
     66 
     67 	pos = buf;
     68 	os_memcpy(pos, data->i_nonce, data->i_nonce_len);
     69 	pos += data->i_nonce_len;
     70 	os_memcpy(pos, data->r_nonce, data->r_nonce_len);
     71 	pos += data->r_nonce_len;
     72 	os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN);
     73 	pos += IKEV2_SPI_LEN;
     74 	os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN);
     75 
     76 	/* SKEYSEED = prf(Ni | Nr, g^ir) */
     77 	/* Use zero-padding per RFC 4306, Sect. 2.14 */
     78 	pad_len = data->dh->prime_len - wpabuf_len(shared);
     79 	pad = os_zalloc(pad_len ? pad_len : 1);
     80 	if (pad == NULL) {
     81 		wpabuf_free(shared);
     82 		os_free(buf);
     83 		return -1;
     84 	}
     85 
     86 	addr[0] = pad;
     87 	len[0] = pad_len;
     88 	addr[1] = wpabuf_head(shared);
     89 	len[1] = wpabuf_len(shared);
     90 	if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len,
     91 			   2, addr, len, skeyseed) < 0) {
     92 		wpabuf_free(shared);
     93 		os_free(buf);
     94 		os_free(pad);
     95 		return -1;
     96 	}
     97 	os_free(pad);
     98 	wpabuf_free(shared);
     99 
    100 	/* DH parameters are not needed anymore, so free them */
    101 	wpabuf_free(data->i_dh_public);
    102 	data->i_dh_public = NULL;
    103 	wpabuf_free(data->r_dh_private);
    104 	data->r_dh_private = NULL;
    105 
    106 	wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED",
    107 			skeyseed, prf->hash_len);
    108 
    109 	ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len,
    110 				   &data->keys);
    111 	os_free(buf);
    112 	return ret;
    113 }
    114 
    115 
    116 static int ikev2_parse_transform(struct ikev2_proposal_data *prop,
    117 				 const u8 *pos, const u8 *end)
    118 {
    119 	int transform_len;
    120 	const struct ikev2_transform *t;
    121 	u16 transform_id;
    122 	const u8 *tend;
    123 
    124 	if (end - pos < (int) sizeof(*t)) {
    125 		wpa_printf(MSG_INFO, "IKEV2: Too short transform");
    126 		return -1;
    127 	}
    128 
    129 	t = (const struct ikev2_transform *) pos;
    130 	transform_len = WPA_GET_BE16(t->transform_length);
    131 	if (transform_len < (int) sizeof(*t) || transform_len > end - pos) {
    132 		wpa_printf(MSG_INFO, "IKEV2: Invalid transform length %d",
    133 			   transform_len);
    134 		return -1;
    135 	}
    136 	tend = pos + transform_len;
    137 
    138 	transform_id = WPA_GET_BE16(t->transform_id);
    139 
    140 	wpa_printf(MSG_DEBUG, "IKEV2:   Transform:");
    141 	wpa_printf(MSG_DEBUG, "IKEV2:     Type: %d  Transform Length: %d  "
    142 		   "Transform Type: %d  Transform ID: %d",
    143 		   t->type, transform_len, t->transform_type, transform_id);
    144 
    145 	if (t->type != 0 && t->type != 3) {
    146 		wpa_printf(MSG_INFO, "IKEV2: Unexpected Transform type");
    147 		return -1;
    148 	}
    149 
    150 	pos = (const u8 *) (t + 1);
    151 	if (pos < tend) {
    152 		wpa_hexdump(MSG_DEBUG, "IKEV2:     Transform Attributes",
    153 			    pos, tend - pos);
    154 	}
    155 
    156 	switch (t->transform_type) {
    157 	case IKEV2_TRANSFORM_ENCR:
    158 		if (ikev2_get_encr(transform_id)) {
    159 			if (transform_id == ENCR_AES_CBC) {
    160 				if (tend - pos != 4) {
    161 					wpa_printf(MSG_DEBUG, "IKEV2: No "
    162 						   "Transform Attr for AES");
    163 					break;
    164 				}
    165 				if (WPA_GET_BE16(pos) != 0x800e) {
    166 					wpa_printf(MSG_DEBUG, "IKEV2: Not a "
    167 						   "Key Size attribute for "
    168 						   "AES");
    169 					break;
    170 				}
    171 				if (WPA_GET_BE16(pos + 2) != 128) {
    172 					wpa_printf(MSG_DEBUG, "IKEV2: "
    173 						   "Unsupported AES key size "
    174 						   "%d bits",
    175 						   WPA_GET_BE16(pos + 2));
    176 					break;
    177 				}
    178 			}
    179 			prop->encr = transform_id;
    180 		}
    181 		break;
    182 	case IKEV2_TRANSFORM_PRF:
    183 		if (ikev2_get_prf(transform_id))
    184 			prop->prf = transform_id;
    185 		break;
    186 	case IKEV2_TRANSFORM_INTEG:
    187 		if (ikev2_get_integ(transform_id))
    188 			prop->integ = transform_id;
    189 		break;
    190 	case IKEV2_TRANSFORM_DH:
    191 		if (dh_groups_get(transform_id))
    192 			prop->dh = transform_id;
    193 		break;
    194 	}
    195 
    196 	return transform_len;
    197 }
    198 
    199 
    200 static int ikev2_parse_proposal(struct ikev2_proposal_data *prop,
    201 				const u8 *pos, const u8 *end)
    202 {
    203 	const u8 *pend, *ppos;
    204 	int proposal_len, i;
    205 	const struct ikev2_proposal *p;
    206 
    207 	if (end - pos < (int) sizeof(*p)) {
    208 		wpa_printf(MSG_INFO, "IKEV2: Too short proposal");
    209 		return -1;
    210 	}
    211 
    212 	/* FIX: AND processing if multiple proposals use the same # */
    213 
    214 	p = (const struct ikev2_proposal *) pos;
    215 	proposal_len = WPA_GET_BE16(p->proposal_length);
    216 	if (proposal_len < (int) sizeof(*p) || proposal_len > end - pos) {
    217 		wpa_printf(MSG_INFO, "IKEV2: Invalid proposal length %d",
    218 			   proposal_len);
    219 		return -1;
    220 	}
    221 	wpa_printf(MSG_DEBUG, "IKEV2: SAi1 Proposal # %d",
    222 		   p->proposal_num);
    223 	wpa_printf(MSG_DEBUG, "IKEV2:   Type: %d  Proposal Length: %d "
    224 		   " Protocol ID: %d",
    225 		   p->type, proposal_len, p->protocol_id);
    226 	wpa_printf(MSG_DEBUG, "IKEV2:   SPI Size: %d  Transforms: %d",
    227 		   p->spi_size, p->num_transforms);
    228 
    229 	if (p->type != 0 && p->type != 2) {
    230 		wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal type");
    231 		return -1;
    232 	}
    233 
    234 	if (p->protocol_id != IKEV2_PROTOCOL_IKE) {
    235 		wpa_printf(MSG_DEBUG, "IKEV2: Unexpected Protocol ID "
    236 			   "(only IKE allowed for EAP-IKEv2)");
    237 		return -1;
    238 	}
    239 
    240 	if (p->proposal_num != prop->proposal_num) {
    241 		if (p->proposal_num == prop->proposal_num + 1)
    242 			prop->proposal_num = p->proposal_num;
    243 		else {
    244 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal #");
    245 			return -1;
    246 		}
    247 	}
    248 
    249 	ppos = (const u8 *) (p + 1);
    250 	pend = pos + proposal_len;
    251 	if (p->spi_size > pend - ppos) {
    252 		wpa_printf(MSG_INFO, "IKEV2: Not enough room for SPI "
    253 			   "in proposal");
    254 		return -1;
    255 	}
    256 	if (p->spi_size) {
    257 		wpa_hexdump(MSG_DEBUG, "IKEV2:    SPI",
    258 			    ppos, p->spi_size);
    259 		ppos += p->spi_size;
    260 	}
    261 
    262 	/*
    263 	 * For initial IKE_SA negotiation, SPI Size MUST be zero; for
    264 	 * subsequent negotiations, it must be 8 for IKE. We only support
    265 	 * initial case for now.
    266 	 */
    267 	if (p->spi_size != 0) {
    268 		wpa_printf(MSG_INFO, "IKEV2: Unexpected SPI Size");
    269 		return -1;
    270 	}
    271 
    272 	if (p->num_transforms == 0) {
    273 		wpa_printf(MSG_INFO, "IKEV2: At least one transform required");
    274 		return -1;
    275 	}
    276 
    277 	for (i = 0; i < (int) p->num_transforms; i++) {
    278 		int tlen = ikev2_parse_transform(prop, ppos, pend);
    279 		if (tlen < 0)
    280 			return -1;
    281 		ppos += tlen;
    282 	}
    283 
    284 	if (ppos != pend) {
    285 		wpa_printf(MSG_INFO, "IKEV2: Unexpected data after "
    286 			   "transforms");
    287 		return -1;
    288 	}
    289 
    290 	return proposal_len;
    291 }
    292 
    293 
    294 static int ikev2_process_sai1(struct ikev2_responder_data *data,
    295 			      const u8 *sai1, size_t sai1_len)
    296 {
    297 	struct ikev2_proposal_data prop;
    298 	const u8 *pos, *end;
    299 	int found = 0;
    300 
    301 	/* Security Association Payloads: <Proposals> */
    302 
    303 	if (sai1 == NULL) {
    304 		wpa_printf(MSG_INFO, "IKEV2: SAi1 not received");
    305 		return -1;
    306 	}
    307 
    308 	os_memset(&prop, 0, sizeof(prop));
    309 	prop.proposal_num = 1;
    310 
    311 	pos = sai1;
    312 	end = sai1 + sai1_len;
    313 
    314 	while (pos < end) {
    315 		int plen;
    316 
    317 		prop.integ = -1;
    318 		prop.prf = -1;
    319 		prop.encr = -1;
    320 		prop.dh = -1;
    321 		plen = ikev2_parse_proposal(&prop, pos, end);
    322 		if (plen < 0)
    323 			return -1;
    324 
    325 		if (!found && prop.integ != -1 && prop.prf != -1 &&
    326 		    prop.encr != -1 && prop.dh != -1) {
    327 			os_memcpy(&data->proposal, &prop, sizeof(prop));
    328 			data->dh = dh_groups_get(prop.dh);
    329 			found = 1;
    330 		}
    331 
    332 		pos += plen;
    333 	}
    334 
    335 	if (pos != end) {
    336 		wpa_printf(MSG_INFO, "IKEV2: Unexpected data after proposals");
    337 		return -1;
    338 	}
    339 
    340 	if (!found) {
    341 		wpa_printf(MSG_INFO, "IKEV2: No acceptable proposal found");
    342 		return -1;
    343 	}
    344 
    345 	wpa_printf(MSG_DEBUG, "IKEV2: Accepted proposal #%d: ENCR:%d PRF:%d "
    346 		   "INTEG:%d D-H:%d", data->proposal.proposal_num,
    347 		   data->proposal.encr, data->proposal.prf,
    348 		   data->proposal.integ, data->proposal.dh);
    349 
    350 	return 0;
    351 }
    352 
    353 
    354 static int ikev2_process_kei(struct ikev2_responder_data *data,
    355 			     const u8 *kei, size_t kei_len)
    356 {
    357 	u16 group;
    358 
    359 	/*
    360 	 * Key Exchange Payload:
    361 	 * DH Group # (16 bits)
    362 	 * RESERVED (16 bits)
    363 	 * Key Exchange Data (Diffie-Hellman public value)
    364 	 */
    365 
    366 	if (kei == NULL) {
    367 		wpa_printf(MSG_INFO, "IKEV2: KEi not received");
    368 		return -1;
    369 	}
    370 
    371 	if (kei_len < 4 + 96) {
    372 		wpa_printf(MSG_INFO, "IKEV2: Too short Key Exchange Payload");
    373 		return -1;
    374 	}
    375 
    376 	group = WPA_GET_BE16(kei);
    377 	wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u", group);
    378 
    379 	if (group != data->proposal.dh) {
    380 		wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u does not match "
    381 			   "with the selected proposal (%u)",
    382 			   group, data->proposal.dh);
    383 		/* Reject message with Notify payload of type
    384 		 * INVALID_KE_PAYLOAD (RFC 4306, Sect. 3.4) */
    385 		data->error_type = INVALID_KE_PAYLOAD;
    386 		data->state = NOTIFY;
    387 		return -1;
    388 	}
    389 
    390 	if (data->dh == NULL) {
    391 		wpa_printf(MSG_INFO, "IKEV2: Unsupported DH group");
    392 		return -1;
    393 	}
    394 
    395 	/* RFC 4306, Section 3.4:
    396 	 * The length of DH public value MUST be equal to the length of the
    397 	 * prime modulus.
    398 	 */
    399 	if (kei_len - 4 != data->dh->prime_len) {
    400 		wpa_printf(MSG_INFO, "IKEV2: Invalid DH public value length "
    401 			   "%ld (expected %ld)",
    402 			   (long) (kei_len - 4), (long) data->dh->prime_len);
    403 		return -1;
    404 	}
    405 
    406 	wpabuf_free(data->i_dh_public);
    407 	data->i_dh_public = wpabuf_alloc(kei_len - 4);
    408 	if (data->i_dh_public == NULL)
    409 		return -1;
    410 	wpabuf_put_data(data->i_dh_public, kei + 4, kei_len - 4);
    411 
    412 	wpa_hexdump_buf(MSG_DEBUG, "IKEV2: KEi Diffie-Hellman Public Value",
    413 			data->i_dh_public);
    414 
    415 	return 0;
    416 }
    417 
    418 
    419 static int ikev2_process_ni(struct ikev2_responder_data *data,
    420 			    const u8 *ni, size_t ni_len)
    421 {
    422 	if (ni == NULL) {
    423 		wpa_printf(MSG_INFO, "IKEV2: Ni not received");
    424 		return -1;
    425 	}
    426 
    427 	if (ni_len < IKEV2_NONCE_MIN_LEN || ni_len > IKEV2_NONCE_MAX_LEN) {
    428 		wpa_printf(MSG_INFO, "IKEV2: Invalid Ni length %ld",
    429 		           (long) ni_len);
    430 		return -1;
    431 	}
    432 
    433 	data->i_nonce_len = ni_len;
    434 	os_memcpy(data->i_nonce, ni, ni_len);
    435 	wpa_hexdump(MSG_MSGDUMP, "IKEV2: Ni",
    436 		    data->i_nonce, data->i_nonce_len);
    437 
    438 	return 0;
    439 }
    440 
    441 
    442 static int ikev2_process_sa_init(struct ikev2_responder_data *data,
    443 				 const struct ikev2_hdr *hdr,
    444 				 struct ikev2_payloads *pl)
    445 {
    446 	if (ikev2_process_sai1(data, pl->sa, pl->sa_len) < 0 ||
    447 	    ikev2_process_kei(data, pl->ke, pl->ke_len) < 0 ||
    448 	    ikev2_process_ni(data, pl->nonce, pl->nonce_len) < 0)
    449 		return -1;
    450 
    451 	os_memcpy(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN);
    452 
    453 	return 0;
    454 }
    455 
    456 
    457 static int ikev2_process_idi(struct ikev2_responder_data *data,
    458 			     const u8 *idi, size_t idi_len)
    459 {
    460 	u8 id_type;
    461 
    462 	if (idi == NULL) {
    463 		wpa_printf(MSG_INFO, "IKEV2: No IDi received");
    464 		return -1;
    465 	}
    466 
    467 	if (idi_len < 4) {
    468 		wpa_printf(MSG_INFO, "IKEV2: Too short IDi payload");
    469 		return -1;
    470 	}
    471 
    472 	id_type = idi[0];
    473 	idi += 4;
    474 	idi_len -= 4;
    475 
    476 	wpa_printf(MSG_DEBUG, "IKEV2: IDi ID Type %d", id_type);
    477 	wpa_hexdump_ascii(MSG_DEBUG, "IKEV2: IDi", idi, idi_len);
    478 	os_free(data->IDi);
    479 	data->IDi = os_malloc(idi_len);
    480 	if (data->IDi == NULL)
    481 		return -1;
    482 	os_memcpy(data->IDi, idi, idi_len);
    483 	data->IDi_len = idi_len;
    484 	data->IDi_type = id_type;
    485 
    486 	return 0;
    487 }
    488 
    489 
    490 static int ikev2_process_cert(struct ikev2_responder_data *data,
    491 			      const u8 *cert, size_t cert_len)
    492 {
    493 	u8 cert_encoding;
    494 
    495 	if (cert == NULL) {
    496 		if (data->peer_auth == PEER_AUTH_CERT) {
    497 			wpa_printf(MSG_INFO, "IKEV2: No Certificate received");
    498 			return -1;
    499 		}
    500 		return 0;
    501 	}
    502 
    503 	if (cert_len < 1) {
    504 		wpa_printf(MSG_INFO, "IKEV2: No Cert Encoding field");
    505 		return -1;
    506 	}
    507 
    508 	cert_encoding = cert[0];
    509 	cert++;
    510 	cert_len--;
    511 
    512 	wpa_printf(MSG_DEBUG, "IKEV2: Cert Encoding %d", cert_encoding);
    513 	wpa_hexdump(MSG_MSGDUMP, "IKEV2: Certificate Data", cert, cert_len);
    514 
    515 	/* TODO: validate certificate */
    516 
    517 	return 0;
    518 }
    519 
    520 
    521 static int ikev2_process_auth_cert(struct ikev2_responder_data *data,
    522 				   u8 method, const u8 *auth, size_t auth_len)
    523 {
    524 	if (method != AUTH_RSA_SIGN) {
    525 		wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication "
    526 			   "method %d", method);
    527 		return -1;
    528 	}
    529 
    530 	/* TODO: validate AUTH */
    531 	return 0;
    532 }
    533 
    534 
    535 static int ikev2_process_auth_secret(struct ikev2_responder_data *data,
    536 				     u8 method, const u8 *auth,
    537 				     size_t auth_len)
    538 {
    539 	u8 auth_data[IKEV2_MAX_HASH_LEN];
    540 	const struct ikev2_prf_alg *prf;
    541 
    542 	if (method != AUTH_SHARED_KEY_MIC) {
    543 		wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication "
    544 			   "method %d", method);
    545 		return -1;
    546 	}
    547 
    548 	/* msg | Nr | prf(SK_pi,IDi') */
    549 	if (ikev2_derive_auth_data(data->proposal.prf, data->i_sign_msg,
    550 				   data->IDi, data->IDi_len, data->IDi_type,
    551 				   &data->keys, 1, data->shared_secret,
    552 				   data->shared_secret_len,
    553 				   data->r_nonce, data->r_nonce_len,
    554 				   data->key_pad, data->key_pad_len,
    555 				   auth_data) < 0) {
    556 		wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data");
    557 		return -1;
    558 	}
    559 
    560 	wpabuf_free(data->i_sign_msg);
    561 	data->i_sign_msg = NULL;
    562 
    563 	prf = ikev2_get_prf(data->proposal.prf);
    564 	if (prf == NULL)
    565 		return -1;
    566 
    567 	if (auth_len != prf->hash_len ||
    568 	    os_memcmp_const(auth, auth_data, auth_len) != 0) {
    569 		wpa_printf(MSG_INFO, "IKEV2: Invalid Authentication Data");
    570 		wpa_hexdump(MSG_DEBUG, "IKEV2: Received Authentication Data",
    571 			    auth, auth_len);
    572 		wpa_hexdump(MSG_DEBUG, "IKEV2: Expected Authentication Data",
    573 			    auth_data, prf->hash_len);
    574 		data->error_type = AUTHENTICATION_FAILED;
    575 		data->state = NOTIFY;
    576 		return -1;
    577 	}
    578 
    579 	wpa_printf(MSG_DEBUG, "IKEV2: Server authenticated successfully "
    580 		   "using shared keys");
    581 
    582 	return 0;
    583 }
    584 
    585 
    586 static int ikev2_process_auth(struct ikev2_responder_data *data,
    587 			      const u8 *auth, size_t auth_len)
    588 {
    589 	u8 auth_method;
    590 
    591 	if (auth == NULL) {
    592 		wpa_printf(MSG_INFO, "IKEV2: No Authentication Payload");
    593 		return -1;
    594 	}
    595 
    596 	if (auth_len < 4) {
    597 		wpa_printf(MSG_INFO, "IKEV2: Too short Authentication "
    598 			   "Payload");
    599 		return -1;
    600 	}
    601 
    602 	auth_method = auth[0];
    603 	auth += 4;
    604 	auth_len -= 4;
    605 
    606 	wpa_printf(MSG_DEBUG, "IKEV2: Auth Method %d", auth_method);
    607 	wpa_hexdump(MSG_MSGDUMP, "IKEV2: Authentication Data", auth, auth_len);
    608 
    609 	switch (data->peer_auth) {
    610 	case PEER_AUTH_CERT:
    611 		return ikev2_process_auth_cert(data, auth_method, auth,
    612 					       auth_len);
    613 	case PEER_AUTH_SECRET:
    614 		return ikev2_process_auth_secret(data, auth_method, auth,
    615 						 auth_len);
    616 	}
    617 
    618 	return -1;
    619 }
    620 
    621 
    622 static int ikev2_process_sa_auth_decrypted(struct ikev2_responder_data *data,
    623 					   u8 next_payload,
    624 					   u8 *payload, size_t payload_len)
    625 {
    626 	struct ikev2_payloads pl;
    627 
    628 	wpa_printf(MSG_DEBUG, "IKEV2: Processing decrypted payloads");
    629 
    630 	if (ikev2_parse_payloads(&pl, next_payload, payload, payload +
    631 				 payload_len) < 0) {
    632 		wpa_printf(MSG_INFO, "IKEV2: Failed to parse decrypted "
    633 			   "payloads");
    634 		return -1;
    635 	}
    636 
    637 	if (ikev2_process_idi(data, pl.idi, pl.idi_len) < 0 ||
    638 	    ikev2_process_cert(data, pl.cert, pl.cert_len) < 0 ||
    639 	    ikev2_process_auth(data, pl.auth, pl.auth_len) < 0)
    640 		return -1;
    641 
    642 	return 0;
    643 }
    644 
    645 
    646 static int ikev2_process_sa_auth(struct ikev2_responder_data *data,
    647 				 const struct ikev2_hdr *hdr,
    648 				 struct ikev2_payloads *pl)
    649 {
    650 	u8 *decrypted;
    651 	size_t decrypted_len;
    652 	int ret;
    653 
    654 	decrypted = ikev2_decrypt_payload(data->proposal.encr,
    655 					  data->proposal.integ,
    656 					  &data->keys, 1, hdr, pl->encrypted,
    657 					  pl->encrypted_len, &decrypted_len);
    658 	if (decrypted == NULL)
    659 		return -1;
    660 
    661 	ret = ikev2_process_sa_auth_decrypted(data, pl->encr_next_payload,
    662 					      decrypted, decrypted_len);
    663 	os_free(decrypted);
    664 
    665 	return ret;
    666 }
    667 
    668 
    669 static int ikev2_validate_rx_state(struct ikev2_responder_data *data,
    670 				   u8 exchange_type, u32 message_id)
    671 {
    672 	switch (data->state) {
    673 	case SA_INIT:
    674 		/* Expect to receive IKE_SA_INIT: HDR, SAi1, KEi, Ni */
    675 		if (exchange_type != IKE_SA_INIT) {
    676 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
    677 				   "%u in SA_INIT state", exchange_type);
    678 			return -1;
    679 		}
    680 		if (message_id != 0) {
    681 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
    682 				   "in SA_INIT state", message_id);
    683 			return -1;
    684 		}
    685 		break;
    686 	case SA_AUTH:
    687 		/* Expect to receive IKE_SA_AUTH:
    688 		 * HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
    689 		 *	AUTH, SAi2, TSi, TSr}
    690 		 */
    691 		if (exchange_type != IKE_SA_AUTH) {
    692 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
    693 				   "%u in SA_AUTH state", exchange_type);
    694 			return -1;
    695 		}
    696 		if (message_id != 1) {
    697 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
    698 				   "in SA_AUTH state", message_id);
    699 			return -1;
    700 		}
    701 		break;
    702 	case CHILD_SA:
    703 		if (exchange_type != CREATE_CHILD_SA) {
    704 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
    705 				   "%u in CHILD_SA state", exchange_type);
    706 			return -1;
    707 		}
    708 		if (message_id != 2) {
    709 			wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
    710 				   "in CHILD_SA state", message_id);
    711 			return -1;
    712 		}
    713 		break;
    714 	case NOTIFY:
    715 	case IKEV2_DONE:
    716 	case IKEV2_FAILED:
    717 		return -1;
    718 	}
    719 
    720 	return 0;
    721 }
    722 
    723 
    724 int ikev2_responder_process(struct ikev2_responder_data *data,
    725 			    const struct wpabuf *buf)
    726 {
    727 	const struct ikev2_hdr *hdr;
    728 	u32 length, message_id;
    729 	const u8 *pos, *end;
    730 	struct ikev2_payloads pl;
    731 
    732 	wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)",
    733 		   (unsigned long) wpabuf_len(buf));
    734 
    735 	if (wpabuf_len(buf) < sizeof(*hdr)) {
    736 		wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR");
    737 		return -1;
    738 	}
    739 
    740 	data->error_type = 0;
    741 	hdr = (const struct ikev2_hdr *) wpabuf_head(buf);
    742 	end = wpabuf_head_u8(buf) + wpabuf_len(buf);
    743 	message_id = WPA_GET_BE32(hdr->message_id);
    744 	length = WPA_GET_BE32(hdr->length);
    745 
    746 	wpa_hexdump(MSG_DEBUG, "IKEV2:   IKE_SA Initiator's SPI",
    747 		    hdr->i_spi, IKEV2_SPI_LEN);
    748 	wpa_hexdump(MSG_DEBUG, "IKEV2:   IKE_SA Responder's SPI",
    749 		    hdr->r_spi, IKEV2_SPI_LEN);
    750 	wpa_printf(MSG_DEBUG, "IKEV2:   Next Payload: %u  Version: 0x%x  "
    751 		   "Exchange Type: %u",
    752 		   hdr->next_payload, hdr->version, hdr->exchange_type);
    753 	wpa_printf(MSG_DEBUG, "IKEV2:   Message ID: %u  Length: %u",
    754 		   message_id, length);
    755 
    756 	if (hdr->version != IKEV2_VERSION) {
    757 		wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x "
    758 			   "(expected 0x%x)", hdr->version, IKEV2_VERSION);
    759 		return -1;
    760 	}
    761 
    762 	if (length != wpabuf_len(buf)) {
    763 		wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != "
    764 			   "RX: %lu)", (unsigned long) length,
    765 			   (unsigned long) wpabuf_len(buf));
    766 		return -1;
    767 	}
    768 
    769 	if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0)
    770 		return -1;
    771 
    772 	if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) !=
    773 	    IKEV2_HDR_INITIATOR) {
    774 		wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x",
    775 			   hdr->flags);
    776 		return -1;
    777 	}
    778 
    779 	if (data->state != SA_INIT) {
    780 		if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) {
    781 			wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "
    782 				   "Initiator's SPI");
    783 			return -1;
    784 		}
    785 		if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) {
    786 			wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "
    787 				   "Responder's SPI");
    788 			return -1;
    789 		}
    790 	}
    791 
    792 	pos = (const u8 *) (hdr + 1);
    793 	if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0)
    794 		return -1;
    795 
    796 	if (data->state == SA_INIT) {
    797 		data->last_msg = LAST_MSG_SA_INIT;
    798 		if (ikev2_process_sa_init(data, hdr, &pl) < 0) {
    799 			if (data->state == NOTIFY)
    800 				return 0;
    801 			return -1;
    802 		}
    803 		wpabuf_free(data->i_sign_msg);
    804 		data->i_sign_msg = wpabuf_dup(buf);
    805 	}
    806 
    807 	if (data->state == SA_AUTH) {
    808 		data->last_msg = LAST_MSG_SA_AUTH;
    809 		if (ikev2_process_sa_auth(data, hdr, &pl) < 0) {
    810 			if (data->state == NOTIFY)
    811 				return 0;
    812 			return -1;
    813 		}
    814 	}
    815 
    816 	return 0;
    817 }
    818 
    819 
    820 static void ikev2_build_hdr(struct ikev2_responder_data *data,
    821 			    struct wpabuf *msg, u8 exchange_type,
    822 			    u8 next_payload, u32 message_id)
    823 {
    824 	struct ikev2_hdr *hdr;
    825 
    826 	wpa_printf(MSG_DEBUG, "IKEV2: Adding HDR");
    827 
    828 	/* HDR - RFC 4306, Sect. 3.1 */
    829 	hdr = wpabuf_put(msg, sizeof(*hdr));
    830 	os_memcpy(hdr->i_spi, data->i_spi, IKEV2_SPI_LEN);
    831 	os_memcpy(hdr->r_spi, data->r_spi, IKEV2_SPI_LEN);
    832 	hdr->next_payload = next_payload;
    833 	hdr->version = IKEV2_VERSION;
    834 	hdr->exchange_type = exchange_type;
    835 	hdr->flags = IKEV2_HDR_RESPONSE;
    836 	WPA_PUT_BE32(hdr->message_id, message_id);
    837 }
    838 
    839 
    840 static int ikev2_build_sar1(struct ikev2_responder_data *data,
    841 			    struct wpabuf *msg, u8 next_payload)
    842 {
    843 	struct ikev2_payload_hdr *phdr;
    844 	size_t plen;
    845 	struct ikev2_proposal *p;
    846 	struct ikev2_transform *t;
    847 
    848 	wpa_printf(MSG_DEBUG, "IKEV2: Adding SAr1 payload");
    849 
    850 	/* SAr1 - RFC 4306, Sect. 2.7 and 3.3 */
    851 	phdr = wpabuf_put(msg, sizeof(*phdr));
    852 	phdr->next_payload = next_payload;
    853 	phdr->flags = 0;
    854 
    855 	p = wpabuf_put(msg, sizeof(*p));
    856 	p->proposal_num = data->proposal.proposal_num;
    857 	p->protocol_id = IKEV2_PROTOCOL_IKE;
    858 	p->num_transforms = 4;
    859 
    860 	t = wpabuf_put(msg, sizeof(*t));
    861 	t->type = 3;
    862 	t->transform_type = IKEV2_TRANSFORM_ENCR;
    863 	WPA_PUT_BE16(t->transform_id, data->proposal.encr);
    864 	if (data->proposal.encr == ENCR_AES_CBC) {
    865 		/* Transform Attribute: Key Len = 128 bits */
    866 		wpabuf_put_be16(msg, 0x800e); /* AF=1, AttrType=14 */
    867 		wpabuf_put_be16(msg, 128); /* 128-bit key */
    868 	}
    869 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) t;
    870 	WPA_PUT_BE16(t->transform_length, plen);
    871 
    872 	t = wpabuf_put(msg, sizeof(*t));
    873 	t->type = 3;
    874 	WPA_PUT_BE16(t->transform_length, sizeof(*t));
    875 	t->transform_type = IKEV2_TRANSFORM_PRF;
    876 	WPA_PUT_BE16(t->transform_id, data->proposal.prf);
    877 
    878 	t = wpabuf_put(msg, sizeof(*t));
    879 	t->type = 3;
    880 	WPA_PUT_BE16(t->transform_length, sizeof(*t));
    881 	t->transform_type = IKEV2_TRANSFORM_INTEG;
    882 	WPA_PUT_BE16(t->transform_id, data->proposal.integ);
    883 
    884 	t = wpabuf_put(msg, sizeof(*t));
    885 	WPA_PUT_BE16(t->transform_length, sizeof(*t));
    886 	t->transform_type = IKEV2_TRANSFORM_DH;
    887 	WPA_PUT_BE16(t->transform_id, data->proposal.dh);
    888 
    889 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) p;
    890 	WPA_PUT_BE16(p->proposal_length, plen);
    891 
    892 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
    893 	WPA_PUT_BE16(phdr->payload_length, plen);
    894 
    895 	return 0;
    896 }
    897 
    898 
    899 static int ikev2_build_ker(struct ikev2_responder_data *data,
    900 			   struct wpabuf *msg, u8 next_payload)
    901 {
    902 	struct ikev2_payload_hdr *phdr;
    903 	size_t plen;
    904 	struct wpabuf *pv;
    905 
    906 	wpa_printf(MSG_DEBUG, "IKEV2: Adding KEr payload");
    907 
    908 	pv = dh_init(data->dh, &data->r_dh_private);
    909 	if (pv == NULL) {
    910 		wpa_printf(MSG_DEBUG, "IKEV2: Failed to initialize DH");
    911 		return -1;
    912 	}
    913 
    914 	/* KEr - RFC 4306, Sect. 3.4 */
    915 	phdr = wpabuf_put(msg, sizeof(*phdr));
    916 	phdr->next_payload = next_payload;
    917 	phdr->flags = 0;
    918 
    919 	wpabuf_put_be16(msg, data->proposal.dh); /* DH Group # */
    920 	wpabuf_put(msg, 2); /* RESERVED */
    921 	/*
    922 	 * RFC 4306, Sect. 3.4: possible zero padding for public value to
    923 	 * match the length of the prime.
    924 	 */
    925 	wpabuf_put(msg, data->dh->prime_len - wpabuf_len(pv));
    926 	wpabuf_put_buf(msg, pv);
    927 	wpabuf_free(pv);
    928 
    929 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
    930 	WPA_PUT_BE16(phdr->payload_length, plen);
    931 	return 0;
    932 }
    933 
    934 
    935 static int ikev2_build_nr(struct ikev2_responder_data *data,
    936 			  struct wpabuf *msg, u8 next_payload)
    937 {
    938 	struct ikev2_payload_hdr *phdr;
    939 	size_t plen;
    940 
    941 	wpa_printf(MSG_DEBUG, "IKEV2: Adding Nr payload");
    942 
    943 	/* Nr - RFC 4306, Sect. 3.9 */
    944 	phdr = wpabuf_put(msg, sizeof(*phdr));
    945 	phdr->next_payload = next_payload;
    946 	phdr->flags = 0;
    947 	wpabuf_put_data(msg, data->r_nonce, data->r_nonce_len);
    948 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
    949 	WPA_PUT_BE16(phdr->payload_length, plen);
    950 	return 0;
    951 }
    952 
    953 
    954 static int ikev2_build_idr(struct ikev2_responder_data *data,
    955 			   struct wpabuf *msg, u8 next_payload)
    956 {
    957 	struct ikev2_payload_hdr *phdr;
    958 	size_t plen;
    959 
    960 	wpa_printf(MSG_DEBUG, "IKEV2: Adding IDr payload");
    961 
    962 	if (data->IDr == NULL) {
    963 		wpa_printf(MSG_INFO, "IKEV2: No IDr available");
    964 		return -1;
    965 	}
    966 
    967 	/* IDr - RFC 4306, Sect. 3.5 */
    968 	phdr = wpabuf_put(msg, sizeof(*phdr));
    969 	phdr->next_payload = next_payload;
    970 	phdr->flags = 0;
    971 	wpabuf_put_u8(msg, ID_KEY_ID);
    972 	wpabuf_put(msg, 3); /* RESERVED */
    973 	wpabuf_put_data(msg, data->IDr, data->IDr_len);
    974 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
    975 	WPA_PUT_BE16(phdr->payload_length, plen);
    976 	return 0;
    977 }
    978 
    979 
    980 static int ikev2_build_auth(struct ikev2_responder_data *data,
    981 			    struct wpabuf *msg, u8 next_payload)
    982 {
    983 	struct ikev2_payload_hdr *phdr;
    984 	size_t plen;
    985 	const struct ikev2_prf_alg *prf;
    986 
    987 	wpa_printf(MSG_DEBUG, "IKEV2: Adding AUTH payload");
    988 
    989 	prf = ikev2_get_prf(data->proposal.prf);
    990 	if (prf == NULL)
    991 		return -1;
    992 
    993 	/* Authentication - RFC 4306, Sect. 3.8 */
    994 	phdr = wpabuf_put(msg, sizeof(*phdr));
    995 	phdr->next_payload = next_payload;
    996 	phdr->flags = 0;
    997 	wpabuf_put_u8(msg, AUTH_SHARED_KEY_MIC);
    998 	wpabuf_put(msg, 3); /* RESERVED */
    999 
   1000 	/* msg | Ni | prf(SK_pr,IDr') */
   1001 	if (ikev2_derive_auth_data(data->proposal.prf, data->r_sign_msg,
   1002 				   data->IDr, data->IDr_len, ID_KEY_ID,
   1003 				   &data->keys, 0, data->shared_secret,
   1004 				   data->shared_secret_len,
   1005 				   data->i_nonce, data->i_nonce_len,
   1006 				   data->key_pad, data->key_pad_len,
   1007 				   wpabuf_put(msg, prf->hash_len)) < 0) {
   1008 		wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data");
   1009 		return -1;
   1010 	}
   1011 	wpabuf_free(data->r_sign_msg);
   1012 	data->r_sign_msg = NULL;
   1013 
   1014 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
   1015 	WPA_PUT_BE16(phdr->payload_length, plen);
   1016 	return 0;
   1017 }
   1018 
   1019 
   1020 static int ikev2_build_notification(struct ikev2_responder_data *data,
   1021 				    struct wpabuf *msg, u8 next_payload)
   1022 {
   1023 	struct ikev2_payload_hdr *phdr;
   1024 	size_t plen;
   1025 
   1026 	wpa_printf(MSG_DEBUG, "IKEV2: Adding Notification payload");
   1027 
   1028 	if (data->error_type == 0) {
   1029 		wpa_printf(MSG_INFO, "IKEV2: No Notify Message Type "
   1030 			   "available");
   1031 		return -1;
   1032 	}
   1033 
   1034 	/* Notify - RFC 4306, Sect. 3.10 */
   1035 	phdr = wpabuf_put(msg, sizeof(*phdr));
   1036 	phdr->next_payload = next_payload;
   1037 	phdr->flags = 0;
   1038 	wpabuf_put_u8(msg, 0); /* Protocol ID: no existing SA */
   1039 	wpabuf_put_u8(msg, 0); /* SPI Size */
   1040 	wpabuf_put_be16(msg, data->error_type);
   1041 
   1042 	switch (data->error_type) {
   1043 	case INVALID_KE_PAYLOAD:
   1044 		if (data->proposal.dh == -1) {
   1045 			wpa_printf(MSG_INFO, "IKEV2: No DH Group selected for "
   1046 				   "INVALID_KE_PAYLOAD notifications");
   1047 			return -1;
   1048 		}
   1049 		wpabuf_put_be16(msg, data->proposal.dh);
   1050 		wpa_printf(MSG_DEBUG, "IKEV2: INVALID_KE_PAYLOAD - request "
   1051 			   "DH Group #%d", data->proposal.dh);
   1052 		break;
   1053 	case AUTHENTICATION_FAILED:
   1054 		/* no associated data */
   1055 		break;
   1056 	default:
   1057 		wpa_printf(MSG_INFO, "IKEV2: Unsupported Notify Message Type "
   1058 			   "%d", data->error_type);
   1059 		return -1;
   1060 	}
   1061 
   1062 	plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
   1063 	WPA_PUT_BE16(phdr->payload_length, plen);
   1064 	return 0;
   1065 }
   1066 
   1067 
   1068 static struct wpabuf * ikev2_build_sa_init(struct ikev2_responder_data *data)
   1069 {
   1070 	struct wpabuf *msg;
   1071 
   1072 	/* build IKE_SA_INIT: HDR, SAr1, KEr, Nr, [CERTREQ], [SK{IDr}] */
   1073 
   1074 	if (os_get_random(data->r_spi, IKEV2_SPI_LEN))
   1075 		return NULL;
   1076 	wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI",
   1077 		    data->r_spi, IKEV2_SPI_LEN);
   1078 
   1079 	data->r_nonce_len = IKEV2_NONCE_MIN_LEN;
   1080 	if (random_get_bytes(data->r_nonce, data->r_nonce_len))
   1081 		return NULL;
   1082 	wpa_hexdump(MSG_DEBUG, "IKEV2: Nr", data->r_nonce, data->r_nonce_len);
   1083 
   1084 	msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1500);
   1085 	if (msg == NULL)
   1086 		return NULL;
   1087 
   1088 	ikev2_build_hdr(data, msg, IKE_SA_INIT, IKEV2_PAYLOAD_SA, 0);
   1089 	if (ikev2_build_sar1(data, msg, IKEV2_PAYLOAD_KEY_EXCHANGE) ||
   1090 	    ikev2_build_ker(data, msg, IKEV2_PAYLOAD_NONCE) ||
   1091 	    ikev2_build_nr(data, msg, data->peer_auth == PEER_AUTH_SECRET ?
   1092 			   IKEV2_PAYLOAD_ENCRYPTED :
   1093 			   IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) {
   1094 		wpabuf_free(msg);
   1095 		return NULL;
   1096 	}
   1097 
   1098 	if (ikev2_derive_keys(data)) {
   1099 		wpabuf_free(msg);
   1100 		return NULL;
   1101 	}
   1102 
   1103 	if (data->peer_auth == PEER_AUTH_CERT) {
   1104 		/* TODO: CERTREQ with SHA-1 hashes of Subject Public Key Info
   1105 		 * for trust agents */
   1106 	}
   1107 
   1108 	if (data->peer_auth == PEER_AUTH_SECRET) {
   1109 		struct wpabuf *plain = wpabuf_alloc(data->IDr_len + 1000);
   1110 		if (plain == NULL) {
   1111 			wpabuf_free(msg);
   1112 			return NULL;
   1113 		}
   1114 		if (ikev2_build_idr(data, plain,
   1115 				    IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
   1116 		    ikev2_build_encrypted(data->proposal.encr,
   1117 					  data->proposal.integ,
   1118 					  &data->keys, 0, msg, plain,
   1119 					  IKEV2_PAYLOAD_IDr)) {
   1120 			wpabuf_free(plain);
   1121 			wpabuf_free(msg);
   1122 			return NULL;
   1123 		}
   1124 		wpabuf_free(plain);
   1125 	}
   1126 
   1127 	ikev2_update_hdr(msg);
   1128 
   1129 	wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_INIT)", msg);
   1130 
   1131 	data->state = SA_AUTH;
   1132 
   1133 	wpabuf_free(data->r_sign_msg);
   1134 	data->r_sign_msg = wpabuf_dup(msg);
   1135 
   1136 	return msg;
   1137 }
   1138 
   1139 
   1140 static struct wpabuf * ikev2_build_sa_auth(struct ikev2_responder_data *data)
   1141 {
   1142 	struct wpabuf *msg, *plain;
   1143 
   1144 	/* build IKE_SA_AUTH: HDR, SK {IDr, [CERT,] AUTH} */
   1145 
   1146 	msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1000);
   1147 	if (msg == NULL)
   1148 		return NULL;
   1149 	ikev2_build_hdr(data, msg, IKE_SA_AUTH, IKEV2_PAYLOAD_ENCRYPTED, 1);
   1150 
   1151 	plain = wpabuf_alloc(data->IDr_len + 1000);
   1152 	if (plain == NULL) {
   1153 		wpabuf_free(msg);
   1154 		return NULL;
   1155 	}
   1156 
   1157 	if (ikev2_build_idr(data, plain, IKEV2_PAYLOAD_AUTHENTICATION) ||
   1158 	    ikev2_build_auth(data, plain, IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
   1159 	    ikev2_build_encrypted(data->proposal.encr, data->proposal.integ,
   1160 				  &data->keys, 0, msg, plain,
   1161 				  IKEV2_PAYLOAD_IDr)) {
   1162 		wpabuf_free(plain);
   1163 		wpabuf_free(msg);
   1164 		return NULL;
   1165 	}
   1166 	wpabuf_free(plain);
   1167 
   1168 	wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_AUTH)", msg);
   1169 
   1170 	data->state = IKEV2_DONE;
   1171 
   1172 	return msg;
   1173 }
   1174 
   1175 
   1176 static struct wpabuf * ikev2_build_notify(struct ikev2_responder_data *data)
   1177 {
   1178 	struct wpabuf *msg;
   1179 
   1180 	msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + 1000);
   1181 	if (msg == NULL)
   1182 		return NULL;
   1183 	if (data->last_msg == LAST_MSG_SA_AUTH) {
   1184 		/* HDR, SK{N} */
   1185 		struct wpabuf *plain = wpabuf_alloc(100);
   1186 		if (plain == NULL) {
   1187 			wpabuf_free(msg);
   1188 			return NULL;
   1189 		}
   1190 		ikev2_build_hdr(data, msg, IKE_SA_AUTH,
   1191 				IKEV2_PAYLOAD_ENCRYPTED, 1);
   1192 		if (ikev2_build_notification(data, plain,
   1193 					     IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
   1194 		    ikev2_build_encrypted(data->proposal.encr,
   1195 					  data->proposal.integ,
   1196 					  &data->keys, 0, msg, plain,
   1197 					  IKEV2_PAYLOAD_NOTIFICATION)) {
   1198 			wpabuf_free(plain);
   1199 			wpabuf_free(msg);
   1200 			return NULL;
   1201 		}
   1202 		wpabuf_free(plain);
   1203 		data->state = IKEV2_FAILED;
   1204 	} else {
   1205 		/* HDR, N */
   1206 		ikev2_build_hdr(data, msg, IKE_SA_INIT,
   1207 				IKEV2_PAYLOAD_NOTIFICATION, 0);
   1208 		if (ikev2_build_notification(data, msg,
   1209 					     IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) {
   1210 			wpabuf_free(msg);
   1211 			return NULL;
   1212 		}
   1213 		data->state = SA_INIT;
   1214 	}
   1215 
   1216 	ikev2_update_hdr(msg);
   1217 
   1218 	wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (Notification)",
   1219 			msg);
   1220 
   1221 	return msg;
   1222 }
   1223 
   1224 
   1225 struct wpabuf * ikev2_responder_build(struct ikev2_responder_data *data)
   1226 {
   1227 	switch (data->state) {
   1228 	case SA_INIT:
   1229 		return ikev2_build_sa_init(data);
   1230 	case SA_AUTH:
   1231 		return ikev2_build_sa_auth(data);
   1232 	case CHILD_SA:
   1233 		return NULL;
   1234 	case NOTIFY:
   1235 		return ikev2_build_notify(data);
   1236 	case IKEV2_DONE:
   1237 	case IKEV2_FAILED:
   1238 		return NULL;
   1239 	}
   1240 	return NULL;
   1241 }
   1242