LCOV - code coverage report
Current view: top level - eap_common - ikev2_common.c (source / functions) Hit Total Coverage
Test: hostapd hwsim test run 1412854115 Lines: 270 370 73.0 %
Date: 2014-10-09 Functions: 16 16 100.0 %

          Line data    Source code
       1             : /*
       2             :  * IKEv2 common routines for initiator and responder
       3             :  * Copyright (c) 2007, Jouni Malinen <j@w1.fi>
       4             :  *
       5             :  * This software may be distributed under the terms of the BSD license.
       6             :  * See README for more details.
       7             :  */
       8             : 
       9             : #include "includes.h"
      10             : 
      11             : #include "common.h"
      12             : #include "crypto/crypto.h"
      13             : #include "crypto/md5.h"
      14             : #include "crypto/sha1.h"
      15             : #include "crypto/random.h"
      16             : #include "ikev2_common.h"
      17             : 
      18             : 
      19             : static struct ikev2_integ_alg ikev2_integ_algs[] = {
      20             :         { AUTH_HMAC_SHA1_96, 20, 12 },
      21             :         { AUTH_HMAC_MD5_96, 16, 12 }
      22             : };
      23             : 
      24             : #define NUM_INTEG_ALGS ARRAY_SIZE(ikev2_integ_algs)
      25             : 
      26             : 
      27             : static struct ikev2_prf_alg ikev2_prf_algs[] = {
      28             :         { PRF_HMAC_SHA1, 20, 20 },
      29             :         { PRF_HMAC_MD5, 16, 16 }
      30             : };
      31             : 
      32             : #define NUM_PRF_ALGS ARRAY_SIZE(ikev2_prf_algs)
      33             : 
      34             : 
      35             : static struct ikev2_encr_alg ikev2_encr_algs[] = {
      36             :         { ENCR_AES_CBC, 16, 16 }, /* only 128-bit keys supported for now */
      37             :         { ENCR_3DES, 24, 8 }
      38             : };
      39             : 
      40             : #define NUM_ENCR_ALGS ARRAY_SIZE(ikev2_encr_algs)
      41             : 
      42             : 
      43          18 : const struct ikev2_integ_alg * ikev2_get_integ(int id)
      44             : {
      45             :         size_t i;
      46             : 
      47          18 :         for (i = 0; i < NUM_INTEG_ALGS; i++) {
      48          18 :                 if (ikev2_integ_algs[i].id == id)
      49          18 :                         return &ikev2_integ_algs[i];
      50             :         }
      51             : 
      52           0 :         return NULL;
      53             : }
      54             : 
      55             : 
      56          14 : int ikev2_integ_hash(int alg, const u8 *key, size_t key_len, const u8 *data,
      57             :                      size_t data_len, u8 *hash)
      58             : {
      59             :         u8 tmphash[IKEV2_MAX_HASH_LEN];
      60             : 
      61          14 :         switch (alg) {
      62             :         case AUTH_HMAC_SHA1_96:
      63          14 :                 if (key_len != 20)
      64           0 :                         return -1;
      65          14 :                 hmac_sha1(key, key_len, data, data_len, tmphash);
      66          14 :                 os_memcpy(hash, tmphash, 12);
      67          14 :                 break;
      68             :         case AUTH_HMAC_MD5_96:
      69           0 :                 if (key_len != 16)
      70           0 :                         return -1;
      71           0 :                 hmac_md5(key, key_len, data, data_len, tmphash);
      72           0 :                 os_memcpy(hash, tmphash, 12);
      73           0 :                 break;
      74             :         default:
      75           0 :                 return -1;
      76             :         }
      77             : 
      78          14 :         return 0;
      79             : }
      80             : 
      81             : 
      82          16 : const struct ikev2_prf_alg * ikev2_get_prf(int id)
      83             : {
      84             :         size_t i;
      85             : 
      86          16 :         for (i = 0; i < NUM_PRF_ALGS; i++) {
      87          16 :                 if (ikev2_prf_algs[i].id == id)
      88          16 :                         return &ikev2_prf_algs[i];
      89             :         }
      90             : 
      91           0 :         return NULL;
      92             : }
      93             : 
      94             : 
      95          42 : int ikev2_prf_hash(int alg, const u8 *key, size_t key_len,
      96             :                    size_t num_elem, const u8 *addr[], const size_t *len,
      97             :                    u8 *hash)
      98             : {
      99          42 :         switch (alg) {
     100             :         case PRF_HMAC_SHA1:
     101          42 :                 hmac_sha1_vector(key, key_len, num_elem, addr, len, hash);
     102          42 :                 break;
     103             :         case PRF_HMAC_MD5:
     104           0 :                 hmac_md5_vector(key, key_len, num_elem, addr, len, hash);
     105           0 :                 break;
     106             :         default:
     107           0 :                 return -1;
     108             :         }
     109             : 
     110          42 :         return 0;
     111             : }
     112             : 
     113             : 
     114           4 : int ikev2_prf_plus(int alg, const u8 *key, size_t key_len,
     115             :                    const u8 *data, size_t data_len,
     116             :                    u8 *out, size_t out_len)
     117             : {
     118             :         u8 hash[IKEV2_MAX_HASH_LEN];
     119             :         size_t hash_len;
     120             :         u8 iter, *pos, *end;
     121             :         const u8 *addr[3];
     122             :         size_t len[3];
     123             :         const struct ikev2_prf_alg *prf;
     124             :         int res;
     125             : 
     126           4 :         prf = ikev2_get_prf(alg);
     127           4 :         if (prf == NULL)
     128           0 :                 return -1;
     129           4 :         hash_len = prf->hash_len;
     130             : 
     131           4 :         addr[0] = hash;
     132           4 :         len[0] = hash_len;
     133           4 :         addr[1] = data;
     134           4 :         len[1] = data_len;
     135           4 :         addr[2] = &iter;
     136           4 :         len[2] = 1;
     137             : 
     138           4 :         pos = out;
     139           4 :         end = out + out_len;
     140           4 :         iter = 1;
     141          36 :         while (pos < end) {
     142             :                 size_t clen;
     143          28 :                 if (iter == 1)
     144           4 :                         res = ikev2_prf_hash(alg, key, key_len, 2, &addr[1],
     145             :                                              &len[1], hash);
     146             :                 else
     147          24 :                         res = ikev2_prf_hash(alg, key, key_len, 3, addr, len,
     148             :                                              hash);
     149          28 :                 if (res < 0)
     150           0 :                         return -1;
     151          28 :                 clen = hash_len;
     152          28 :                 if ((int) clen > end - pos)
     153           4 :                         clen = end - pos;
     154          28 :                 os_memcpy(pos, hash, clen);
     155          28 :                 pos += clen;
     156          28 :                 iter++;
     157             :         }
     158             : 
     159           4 :         return 0;
     160             : }
     161             : 
     162             : 
     163          10 : const struct ikev2_encr_alg * ikev2_get_encr(int id)
     164             : {
     165             :         size_t i;
     166             : 
     167          10 :         for (i = 0; i < NUM_ENCR_ALGS; i++) {
     168          10 :                 if (ikev2_encr_algs[i].id == id)
     169          10 :                         return &ikev2_encr_algs[i];
     170             :         }
     171             : 
     172           0 :         return NULL;
     173             : }
     174             : 
     175             : 
     176           2 : int ikev2_encr_encrypt(int alg, const u8 *key, size_t key_len, const u8 *iv,
     177             :                        const u8 *plain, u8 *crypt, size_t len)
     178             : {
     179             :         struct crypto_cipher *cipher;
     180             :         int encr_alg;
     181             : 
     182           2 :         switch (alg) {
     183             :         case ENCR_3DES:
     184           0 :                 encr_alg = CRYPTO_CIPHER_ALG_3DES;
     185           0 :                 break;
     186             :         case ENCR_AES_CBC:
     187           2 :                 encr_alg = CRYPTO_CIPHER_ALG_AES;
     188           2 :                 break;
     189             :         default:
     190           0 :                 wpa_printf(MSG_DEBUG, "IKEV2: Unsupported encr alg %d", alg);
     191           0 :                 return -1;
     192             :         }
     193             : 
     194           2 :         cipher = crypto_cipher_init(encr_alg, iv, key, key_len);
     195           2 :         if (cipher == NULL) {
     196           0 :                 wpa_printf(MSG_INFO, "IKEV2: Failed to initialize cipher");
     197           0 :                 return -1;
     198             :         }
     199             : 
     200           2 :         if (crypto_cipher_encrypt(cipher, plain, crypt, len) < 0) {
     201           0 :                 wpa_printf(MSG_INFO, "IKEV2: Encryption failed");
     202           0 :                 crypto_cipher_deinit(cipher);
     203           0 :                 return -1;
     204             :         }
     205           2 :         crypto_cipher_deinit(cipher);
     206             : 
     207           2 :         return 0;
     208             : }
     209             : 
     210             : 
     211           4 : int ikev2_encr_decrypt(int alg, const u8 *key, size_t key_len, const u8 *iv,
     212             :                        const u8 *crypt, u8 *plain, size_t len)
     213             : {
     214             :         struct crypto_cipher *cipher;
     215             :         int encr_alg;
     216             : 
     217           4 :         switch (alg) {
     218             :         case ENCR_3DES:
     219           0 :                 encr_alg = CRYPTO_CIPHER_ALG_3DES;
     220           0 :                 break;
     221             :         case ENCR_AES_CBC:
     222           4 :                 encr_alg = CRYPTO_CIPHER_ALG_AES;
     223           4 :                 break;
     224             :         default:
     225           0 :                 wpa_printf(MSG_DEBUG, "IKEV2: Unsupported encr alg %d", alg);
     226           0 :                 return -1;
     227             :         }
     228             : 
     229           4 :         cipher = crypto_cipher_init(encr_alg, iv, key, key_len);
     230           4 :         if (cipher == NULL) {
     231           0 :                 wpa_printf(MSG_INFO, "IKEV2: Failed to initialize cipher");
     232           0 :                 return -1;
     233             :         }
     234             : 
     235           4 :         if (crypto_cipher_decrypt(cipher, crypt, plain, len) < 0) {
     236           0 :                 wpa_printf(MSG_INFO, "IKEV2: Decryption failed");
     237           0 :                 crypto_cipher_deinit(cipher);
     238           0 :                 return -1;
     239             :         }
     240           4 :         crypto_cipher_deinit(cipher);
     241             : 
     242           4 :         return 0;
     243             : }
     244             : 
     245             : 
     246           8 : int ikev2_parse_payloads(struct ikev2_payloads *payloads,
     247             :                          u8 next_payload, const u8 *pos, const u8 *end)
     248             : {
     249             :         const struct ikev2_payload_hdr *phdr;
     250             : 
     251           8 :         os_memset(payloads, 0, sizeof(*payloads));
     252             : 
     253          32 :         while (next_payload != IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) {
     254             :                 int plen, pdatalen;
     255             :                 const u8 *pdata;
     256          16 :                 wpa_printf(MSG_DEBUG, "IKEV2: Processing payload %u",
     257             :                            next_payload);
     258          16 :                 if (end - pos < (int) sizeof(*phdr)) {
     259           0 :                         wpa_printf(MSG_INFO, "IKEV2:   Too short message for "
     260             :                                    "payload header (left=%ld)",
     261             :                                    (long) (end - pos));
     262             :                 }
     263          16 :                 phdr = (const struct ikev2_payload_hdr *) pos;
     264          16 :                 plen = WPA_GET_BE16(phdr->payload_length);
     265          16 :                 if (plen < (int) sizeof(*phdr) || pos + plen > end) {
     266           0 :                         wpa_printf(MSG_INFO, "IKEV2:   Invalid payload header "
     267             :                                    "length %d", plen);
     268           0 :                         return -1;
     269             :                 }
     270             : 
     271          32 :                 wpa_printf(MSG_DEBUG, "IKEV2:   Next Payload: %u  Flags: 0x%x"
     272             :                            "  Payload Length: %d",
     273          32 :                            phdr->next_payload, phdr->flags, plen);
     274             : 
     275          16 :                 pdata = (const u8 *) (phdr + 1);
     276          16 :                 pdatalen = plen - sizeof(*phdr);
     277             : 
     278          16 :                 switch (next_payload) {
     279             :                 case IKEV2_PAYLOAD_SA:
     280           2 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: Security "
     281             :                                    "Association");
     282           2 :                         payloads->sa = pdata;
     283           2 :                         payloads->sa_len = pdatalen;
     284           2 :                         break;
     285             :                 case IKEV2_PAYLOAD_KEY_EXCHANGE:
     286           2 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: Key "
     287             :                                    "Exchange");
     288           2 :                         payloads->ke = pdata;
     289           2 :                         payloads->ke_len = pdatalen;
     290           2 :                         break;
     291             :                 case IKEV2_PAYLOAD_IDi:
     292           0 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: IDi");
     293           0 :                         payloads->idi = pdata;
     294           0 :                         payloads->idi_len = pdatalen;
     295           0 :                         break;
     296             :                 case IKEV2_PAYLOAD_IDr:
     297           4 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: IDr");
     298           4 :                         payloads->idr = pdata;
     299           4 :                         payloads->idr_len = pdatalen;
     300           4 :                         break;
     301             :                 case IKEV2_PAYLOAD_CERTIFICATE:
     302           0 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: Certificate");
     303           0 :                         payloads->cert = pdata;
     304           0 :                         payloads->cert_len = pdatalen;
     305           0 :                         break;
     306             :                 case IKEV2_PAYLOAD_AUTHENTICATION:
     307           2 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: "
     308             :                                    "Authentication");
     309           2 :                         payloads->auth = pdata;
     310           2 :                         payloads->auth_len = pdatalen;
     311           2 :                         break;
     312             :                 case IKEV2_PAYLOAD_NONCE:
     313           2 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: Nonce");
     314           2 :                         payloads->nonce = pdata;
     315           2 :                         payloads->nonce_len = pdatalen;
     316           2 :                         break;
     317             :                 case IKEV2_PAYLOAD_ENCRYPTED:
     318           4 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: Encrypted");
     319           4 :                         payloads->encrypted = pdata;
     320           4 :                         payloads->encrypted_len = pdatalen;
     321           4 :                         break;
     322             :                 case IKEV2_PAYLOAD_NOTIFICATION:
     323           0 :                         wpa_printf(MSG_DEBUG, "IKEV2:   Payload: "
     324             :                                    "Notification");
     325           0 :                         payloads->notification = pdata;
     326           0 :                         payloads->notification_len = pdatalen;
     327           0 :                         break;
     328             :                 default:
     329           0 :                         if (phdr->flags & IKEV2_PAYLOAD_FLAGS_CRITICAL) {
     330           0 :                                 wpa_printf(MSG_INFO, "IKEV2:   Unsupported "
     331             :                                            "critical payload %u - reject the "
     332             :                                            "entire message", next_payload);
     333           0 :                                 return -1;
     334             :                         } else {
     335           0 :                                 wpa_printf(MSG_DEBUG, "IKEV2:   Skipped "
     336             :                                            "unsupported payload %u",
     337             :                                            next_payload);
     338             :                         }
     339             :                 }
     340             : 
     341          20 :                 if (next_payload == IKEV2_PAYLOAD_ENCRYPTED &&
     342           4 :                     pos + plen == end) {
     343             :                         /*
     344             :                          * Next Payload in the case of Encrypted Payload is
     345             :                          * actually the payload type for the first embedded
     346             :                          * payload.
     347             :                          */
     348           4 :                         payloads->encr_next_payload = phdr->next_payload;
     349           4 :                         next_payload = IKEV2_PAYLOAD_NO_NEXT_PAYLOAD;
     350             :                 } else
     351          12 :                         next_payload = phdr->next_payload;
     352             : 
     353          16 :                 pos += plen;
     354             :         }
     355             : 
     356           8 :         if (pos != end) {
     357           0 :                 wpa_printf(MSG_INFO, "IKEV2: Unexpected extra data after "
     358             :                            "payloads");
     359           0 :                 return -1;
     360             :         }
     361             : 
     362           8 :         return 0;
     363             : }
     364             : 
     365             : 
     366           4 : int ikev2_derive_auth_data(int prf_alg, const struct wpabuf *sign_msg,
     367             :                            const u8 *ID, size_t ID_len, u8 ID_type,
     368             :                            struct ikev2_keys *keys, int initiator,
     369             :                            const u8 *shared_secret, size_t shared_secret_len,
     370             :                            const u8 *nonce, size_t nonce_len,
     371             :                            const u8 *key_pad, size_t key_pad_len,
     372             :                            u8 *auth_data)
     373             : {
     374             :         size_t sign_len, buf_len;
     375             :         u8 *sign_data, *pos, *buf, hash[IKEV2_MAX_HASH_LEN];
     376             :         const struct ikev2_prf_alg *prf;
     377           4 :         const u8 *SK_p = initiator ? keys->SK_pi : keys->SK_pr;
     378             : 
     379           4 :         prf = ikev2_get_prf(prf_alg);
     380           4 :         if (sign_msg == NULL || ID == NULL || SK_p == NULL ||
     381           4 :             shared_secret == NULL || nonce == NULL || prf == NULL)
     382           0 :                 return -1;
     383             : 
     384             :         /* prf(SK_pi/r,IDi/r') */
     385           4 :         buf_len = 4 + ID_len;
     386           4 :         buf = os_zalloc(buf_len);
     387           4 :         if (buf == NULL)
     388           0 :                 return -1;
     389           4 :         buf[0] = ID_type;
     390           4 :         os_memcpy(buf + 4, ID, ID_len);
     391           4 :         if (ikev2_prf_hash(prf->id, SK_p, keys->SK_prf_len,
     392             :                            1, (const u8 **) &buf, &buf_len, hash) < 0) {
     393           0 :                 os_free(buf);
     394           0 :                 return -1;
     395             :         }
     396           4 :         os_free(buf);
     397             : 
     398             :         /* sign_data = msg | Nr/i | prf(SK_pi/r,IDi/r') */
     399           4 :         sign_len = wpabuf_len(sign_msg) + nonce_len + prf->hash_len;
     400           4 :         sign_data = os_malloc(sign_len);
     401           4 :         if (sign_data == NULL)
     402           0 :                 return -1;
     403           4 :         pos = sign_data;
     404           4 :         os_memcpy(pos, wpabuf_head(sign_msg), wpabuf_len(sign_msg));
     405           4 :         pos += wpabuf_len(sign_msg);
     406           4 :         os_memcpy(pos, nonce, nonce_len);
     407           4 :         pos += nonce_len;
     408           4 :         os_memcpy(pos, hash, prf->hash_len);
     409             : 
     410             :         /* AUTH = prf(prf(Shared Secret, key pad, sign_data) */
     411           4 :         if (ikev2_prf_hash(prf->id, shared_secret, shared_secret_len, 1,
     412           4 :                            &key_pad, &key_pad_len, hash) < 0 ||
     413           4 :             ikev2_prf_hash(prf->id, hash, prf->hash_len, 1,
     414             :                            (const u8 **) &sign_data, &sign_len, auth_data) < 0)
     415             :         {
     416           0 :                 os_free(sign_data);
     417           0 :                 return -1;
     418             :         }
     419           4 :         os_free(sign_data);
     420             : 
     421           4 :         return 0;
     422             : }
     423             : 
     424             : 
     425           4 : u8 * ikev2_decrypt_payload(int encr_id, int integ_id,
     426             :                            struct ikev2_keys *keys, int initiator,
     427             :                            const struct ikev2_hdr *hdr,
     428             :                            const u8 *encrypted, size_t encrypted_len,
     429             :                            size_t *res_len)
     430             : {
     431             :         size_t iv_len;
     432             :         const u8 *pos, *end, *iv, *integ;
     433             :         u8 hash[IKEV2_MAX_HASH_LEN], *decrypted;
     434             :         size_t decrypted_len, pad_len;
     435             :         const struct ikev2_integ_alg *integ_alg;
     436             :         const struct ikev2_encr_alg *encr_alg;
     437           4 :         const u8 *SK_e = initiator ? keys->SK_ei : keys->SK_er;
     438           4 :         const u8 *SK_a = initiator ? keys->SK_ai : keys->SK_ar;
     439             : 
     440           4 :         if (encrypted == NULL) {
     441           0 :                 wpa_printf(MSG_INFO, "IKEV2: No Encrypted payload in SA_AUTH");
     442           0 :                 return NULL;
     443             :         }
     444             : 
     445           4 :         encr_alg = ikev2_get_encr(encr_id);
     446           4 :         if (encr_alg == NULL) {
     447           0 :                 wpa_printf(MSG_INFO, "IKEV2: Unsupported encryption type");
     448           0 :                 return NULL;
     449             :         }
     450           4 :         iv_len = encr_alg->block_size;
     451             : 
     452           4 :         integ_alg = ikev2_get_integ(integ_id);
     453           4 :         if (integ_alg == NULL) {
     454           0 :                 wpa_printf(MSG_INFO, "IKEV2: Unsupported intergrity type");
     455           0 :                 return NULL;
     456             :         }
     457             : 
     458           4 :         if (encrypted_len < iv_len + 1 + integ_alg->hash_len) {
     459           0 :                 wpa_printf(MSG_INFO, "IKEV2: No room for IV or Integrity "
     460             :                           "Checksum");
     461           0 :                 return NULL;
     462             :         }
     463             : 
     464           4 :         iv = encrypted;
     465           4 :         pos = iv + iv_len;
     466           4 :         end = encrypted + encrypted_len;
     467           4 :         integ = end - integ_alg->hash_len;
     468             : 
     469           4 :         if (SK_a == NULL) {
     470           0 :                 wpa_printf(MSG_INFO, "IKEV2: No SK_a available");
     471           0 :                 return NULL;
     472             :         }
     473           4 :         if (ikev2_integ_hash(integ_id, SK_a, keys->SK_integ_len,
     474             :                              (const u8 *) hdr,
     475           4 :                              integ - (const u8 *) hdr, hash) < 0) {
     476           0 :                 wpa_printf(MSG_INFO, "IKEV2: Failed to calculate integrity "
     477             :                            "hash");
     478           0 :                 return NULL;
     479             :         }
     480           4 :         if (os_memcmp_const(integ, hash, integ_alg->hash_len) != 0) {
     481           0 :                 wpa_printf(MSG_INFO, "IKEV2: Incorrect Integrity Checksum "
     482             :                            "Data");
     483           0 :                 return NULL;
     484             :         }
     485             : 
     486           4 :         if (SK_e == NULL) {
     487           0 :                 wpa_printf(MSG_INFO, "IKEV2: No SK_e available");
     488           0 :                 return NULL;
     489             :         }
     490             : 
     491           4 :         decrypted_len = integ - pos;
     492           4 :         decrypted = os_malloc(decrypted_len);
     493           4 :         if (decrypted == NULL)
     494           0 :                 return NULL;
     495             : 
     496           4 :         if (ikev2_encr_decrypt(encr_alg->id, SK_e, keys->SK_encr_len, iv, pos,
     497             :                                decrypted, decrypted_len) < 0) {
     498           0 :                 os_free(decrypted);
     499           0 :                 return NULL;
     500             :         }
     501             : 
     502           4 :         pad_len = decrypted[decrypted_len - 1];
     503           4 :         if (decrypted_len < pad_len + 1) {
     504           0 :                 wpa_printf(MSG_INFO, "IKEV2: Invalid padding in encrypted "
     505             :                            "payload");
     506           0 :                 os_free(decrypted);
     507           0 :                 return NULL;
     508             :         }
     509             : 
     510           4 :         decrypted_len -= pad_len + 1;
     511             : 
     512           4 :         *res_len = decrypted_len;
     513           4 :         return decrypted;
     514             : }
     515             : 
     516             : 
     517           4 : void ikev2_update_hdr(struct wpabuf *msg)
     518             : {
     519             :         struct ikev2_hdr *hdr;
     520             : 
     521             :         /* Update lenth field in HDR */
     522           4 :         hdr = wpabuf_mhead(msg);
     523           4 :         WPA_PUT_BE32(hdr->length, wpabuf_len(msg));
     524           4 : }
     525             : 
     526             : 
     527           2 : int ikev2_build_encrypted(int encr_id, int integ_id, struct ikev2_keys *keys,
     528             :                           int initiator, struct wpabuf *msg,
     529             :                           struct wpabuf *plain, u8 next_payload)
     530             : {
     531             :         struct ikev2_payload_hdr *phdr;
     532             :         size_t plen;
     533             :         size_t iv_len, pad_len;
     534             :         u8 *icv, *iv;
     535             :         const struct ikev2_integ_alg *integ_alg;
     536             :         const struct ikev2_encr_alg *encr_alg;
     537           2 :         const u8 *SK_e = initiator ? keys->SK_ei : keys->SK_er;
     538           2 :         const u8 *SK_a = initiator ? keys->SK_ai : keys->SK_ar;
     539             : 
     540           2 :         wpa_printf(MSG_DEBUG, "IKEV2: Adding Encrypted payload");
     541             : 
     542             :         /* Encr - RFC 4306, Sect. 3.14 */
     543             : 
     544           2 :         encr_alg = ikev2_get_encr(encr_id);
     545           2 :         if (encr_alg == NULL) {
     546           0 :                 wpa_printf(MSG_INFO, "IKEV2: Unsupported encryption type");
     547           0 :                 return -1;
     548             :         }
     549           2 :         iv_len = encr_alg->block_size;
     550             : 
     551           2 :         integ_alg = ikev2_get_integ(integ_id);
     552           2 :         if (integ_alg == NULL) {
     553           0 :                 wpa_printf(MSG_INFO, "IKEV2: Unsupported intergrity type");
     554           0 :                 return -1;
     555             :         }
     556             : 
     557           2 :         if (SK_e == NULL) {
     558           0 :                 wpa_printf(MSG_INFO, "IKEV2: No SK_e available");
     559           0 :                 return -1;
     560             :         }
     561             : 
     562           2 :         if (SK_a == NULL) {
     563           0 :                 wpa_printf(MSG_INFO, "IKEV2: No SK_a available");
     564           0 :                 return -1;
     565             :         }
     566             : 
     567           2 :         phdr = wpabuf_put(msg, sizeof(*phdr));
     568           2 :         phdr->next_payload = next_payload;
     569           2 :         phdr->flags = 0;
     570             : 
     571           2 :         iv = wpabuf_put(msg, iv_len);
     572           2 :         if (random_get_bytes(iv, iv_len)) {
     573           0 :                 wpa_printf(MSG_INFO, "IKEV2: Could not generate IV");
     574           0 :                 return -1;
     575             :         }
     576             : 
     577           2 :         pad_len = iv_len - (wpabuf_len(plain) + 1) % iv_len;
     578           2 :         if (pad_len == iv_len)
     579           0 :                 pad_len = 0;
     580           2 :         wpabuf_put(plain, pad_len);
     581           2 :         wpabuf_put_u8(plain, pad_len);
     582             : 
     583           4 :         if (ikev2_encr_encrypt(encr_alg->id, SK_e, keys->SK_encr_len, iv,
     584           2 :                                wpabuf_head(plain), wpabuf_mhead(plain),
     585             :                                wpabuf_len(plain)) < 0)
     586           0 :                 return -1;
     587             : 
     588           2 :         wpabuf_put_buf(msg, plain);
     589             : 
     590             :         /* Need to update all headers (Length fields) prior to hash func */
     591           2 :         icv = wpabuf_put(msg, integ_alg->hash_len);
     592           2 :         plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
     593           2 :         WPA_PUT_BE16(phdr->payload_length, plen);
     594             : 
     595           2 :         ikev2_update_hdr(msg);
     596             : 
     597           4 :         return ikev2_integ_hash(integ_id, SK_a, keys->SK_integ_len,
     598           2 :                                 wpabuf_head(msg),
     599           2 :                                 wpabuf_len(msg) - integ_alg->hash_len, icv);
     600             : 
     601             :         return 0;
     602             : }
     603             : 
     604             : 
     605           2 : int ikev2_keys_set(struct ikev2_keys *keys)
     606             : {
     607           8 :         return keys->SK_d && keys->SK_ai && keys->SK_ar && keys->SK_ei &&
     608           6 :                 keys->SK_er && keys->SK_pi && keys->SK_pr;
     609             : }
     610             : 
     611             : 
     612           4 : void ikev2_free_keys(struct ikev2_keys *keys)
     613             : {
     614           4 :         os_free(keys->SK_d);
     615           4 :         os_free(keys->SK_ai);
     616           4 :         os_free(keys->SK_ar);
     617           4 :         os_free(keys->SK_ei);
     618           4 :         os_free(keys->SK_er);
     619           4 :         os_free(keys->SK_pi);
     620           4 :         os_free(keys->SK_pr);
     621           4 :         keys->SK_d = keys->SK_ai = keys->SK_ar = keys->SK_ei = keys->SK_er =
     622           4 :                 keys->SK_pi = keys->SK_pr = NULL;
     623           4 : }
     624             : 
     625             : 
     626           2 : int ikev2_derive_sk_keys(const struct ikev2_prf_alg *prf,
     627             :                          const struct ikev2_integ_alg *integ,
     628             :                          const struct ikev2_encr_alg *encr,
     629             :                          const u8 *skeyseed, const u8 *data, size_t data_len,
     630             :                          struct ikev2_keys *keys)
     631             : {
     632             :         u8 *keybuf, *pos;
     633             :         size_t keybuf_len;
     634             : 
     635             :         /*
     636             :          * {SK_d | SK_ai | SK_ar | SK_ei | SK_er | SK_pi | SK_pr } =
     637             :          *      prf+(SKEYSEED, Ni | Nr | SPIi | SPIr )
     638             :          */
     639           2 :         ikev2_free_keys(keys);
     640           2 :         keys->SK_d_len = prf->key_len;
     641           2 :         keys->SK_integ_len = integ->key_len;
     642           2 :         keys->SK_encr_len = encr->key_len;
     643           2 :         keys->SK_prf_len = prf->key_len;
     644             : 
     645           6 :         keybuf_len = keys->SK_d_len + 2 * keys->SK_integ_len +
     646           4 :                 2 * keys->SK_encr_len + 2 * keys->SK_prf_len;
     647           2 :         keybuf = os_malloc(keybuf_len);
     648           2 :         if (keybuf == NULL)
     649           0 :                 return -1;
     650             : 
     651           2 :         if (ikev2_prf_plus(prf->id, skeyseed, prf->hash_len,
     652             :                            data, data_len, keybuf, keybuf_len)) {
     653           0 :                 os_free(keybuf);
     654           0 :                 return -1;
     655             :         }
     656             : 
     657           2 :         pos = keybuf;
     658             : 
     659           2 :         keys->SK_d = os_malloc(keys->SK_d_len);
     660           2 :         if (keys->SK_d) {
     661           2 :                 os_memcpy(keys->SK_d, pos, keys->SK_d_len);
     662           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_d",
     663           2 :                                 keys->SK_d, keys->SK_d_len);
     664             :         }
     665           2 :         pos += keys->SK_d_len;
     666             : 
     667           2 :         keys->SK_ai = os_malloc(keys->SK_integ_len);
     668           2 :         if (keys->SK_ai) {
     669           2 :                 os_memcpy(keys->SK_ai, pos, keys->SK_integ_len);
     670           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_ai",
     671           2 :                                 keys->SK_ai, keys->SK_integ_len);
     672             :         }
     673           2 :         pos += keys->SK_integ_len;
     674             : 
     675           2 :         keys->SK_ar = os_malloc(keys->SK_integ_len);
     676           2 :         if (keys->SK_ar) {
     677           2 :                 os_memcpy(keys->SK_ar, pos, keys->SK_integ_len);
     678           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_ar",
     679           2 :                                 keys->SK_ar, keys->SK_integ_len);
     680             :         }
     681           2 :         pos += keys->SK_integ_len;
     682             : 
     683           2 :         keys->SK_ei = os_malloc(keys->SK_encr_len);
     684           2 :         if (keys->SK_ei) {
     685           2 :                 os_memcpy(keys->SK_ei, pos, keys->SK_encr_len);
     686           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_ei",
     687           2 :                                 keys->SK_ei, keys->SK_encr_len);
     688             :         }
     689           2 :         pos += keys->SK_encr_len;
     690             : 
     691           2 :         keys->SK_er = os_malloc(keys->SK_encr_len);
     692           2 :         if (keys->SK_er) {
     693           2 :                 os_memcpy(keys->SK_er, pos, keys->SK_encr_len);
     694           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_er",
     695           2 :                                 keys->SK_er, keys->SK_encr_len);
     696             :         }
     697           2 :         pos += keys->SK_encr_len;
     698             : 
     699           2 :         keys->SK_pi = os_malloc(keys->SK_prf_len);
     700           2 :         if (keys->SK_pi) {
     701           2 :                 os_memcpy(keys->SK_pi, pos, keys->SK_prf_len);
     702           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_pi",
     703           2 :                                 keys->SK_pi, keys->SK_prf_len);
     704             :         }
     705           2 :         pos += keys->SK_prf_len;
     706             : 
     707           2 :         keys->SK_pr = os_malloc(keys->SK_prf_len);
     708           2 :         if (keys->SK_pr) {
     709           2 :                 os_memcpy(keys->SK_pr, pos, keys->SK_prf_len);
     710           4 :                 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SK_pr",
     711           2 :                                 keys->SK_pr, keys->SK_prf_len);
     712             :         }
     713             : 
     714           2 :         os_free(keybuf);
     715             : 
     716           2 :         if (!ikev2_keys_set(keys)) {
     717           0 :                 ikev2_free_keys(keys);
     718           0 :                 return -1;
     719             :         }
     720             : 
     721           2 :         return 0;
     722             : }

Generated by: LCOV version 1.10