?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Use common driver code for Linux hwaddr get/set
[hostap-gosc2009.git] / src / eap_peer / ikev2.c
blob309a331124eb86a306f0994d019d0e6044cdb80c
1 /*
2 * IKEv2 responder (RFC 4306) for EAP-IKEV2
3 * Copyright (c) 2007, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "crypto/dh_groups.h"
19 #include "ikev2.h"
20
21
22 void ikev2_responder_deinit(struct ikev2_responder_data *data)
23 {
24 ikev2_free_keys(&data->keys);
25 wpabuf_free(data->i_dh_public);
26 wpabuf_free(data->r_dh_private);
27 os_free(data->IDi);
28 os_free(data->IDr);
29 os_free(data->shared_secret);
30 wpabuf_free(data->i_sign_msg);
31 wpabuf_free(data->r_sign_msg);
32 os_free(data->key_pad);
33 }
34
35
36 static int ikev2_derive_keys(struct ikev2_responder_data *data)
37 {
38 u8 *buf, *pos, *pad, skeyseed[IKEV2_MAX_HASH_LEN];
39 size_t buf_len, pad_len;
40 struct wpabuf *shared;
41 const struct ikev2_integ_alg *integ;
42 const struct ikev2_prf_alg *prf;
43 const struct ikev2_encr_alg *encr;
44 int ret;
45 const u8 *addr[2];
46 size_t len[2];
47
48 /* RFC 4306, Sect. 2.14 */
49
50 integ = ikev2_get_integ(data->proposal.integ);
51 prf = ikev2_get_prf(data->proposal.prf);
52 encr = ikev2_get_encr(data->proposal.encr);
53 if (integ == NULL || prf == NULL || encr == NULL) {
54 wpa_printf(MSG_INFO, "IKEV2: Unsupported proposal");
55 return -1;
56 }
57
58 shared = dh_derive_shared(data->i_dh_public, data->r_dh_private,
59 data->dh);
60 if (shared == NULL)
61 return -1;
62
63 /* Construct Ni | Nr | SPIi | SPIr */
64
65 buf_len = data->i_nonce_len + data->r_nonce_len + 2 * IKEV2_SPI_LEN;
66 buf = os_malloc(buf_len);
67 if (buf == NULL) {
68 wpabuf_free(shared);
69 return -1;
70 }
71
72 pos = buf;
73 os_memcpy(pos, data->i_nonce, data->i_nonce_len);
74 pos += data->i_nonce_len;
75 os_memcpy(pos, data->r_nonce, data->r_nonce_len);
76 pos += data->r_nonce_len;
77 os_memcpy(pos, data->i_spi, IKEV2_SPI_LEN);
78 pos += IKEV2_SPI_LEN;
79 os_memcpy(pos, data->r_spi, IKEV2_SPI_LEN);
80 #ifdef CCNS_PL
81 #if __BYTE_ORDER == __LITTLE_ENDIAN
82 {
83 int i;
84 u8 *tmp = pos - IKEV2_SPI_LEN;
85 /* Incorrect byte re-ordering on little endian hosts.. */
86 for (i = 0; i < IKEV2_SPI_LEN; i++)
87 *tmp++ = data->i_spi[IKEV2_SPI_LEN - 1 - i];
88 for (i = 0; i < IKEV2_SPI_LEN; i++)
89 *tmp++ = data->r_spi[IKEV2_SPI_LEN - 1 - i];
90 }
91 #endif
92 #endif /* CCNS_PL */
93
94 /* SKEYSEED = prf(Ni | Nr, g^ir) */
95 /* Use zero-padding per RFC 4306, Sect. 2.14 */
96 pad_len = data->dh->prime_len - wpabuf_len(shared);
97 #ifdef CCNS_PL
98 /* Shared secret is not zero-padded correctly */
99 pad_len = 0;
100 #endif /* CCNS_PL */
101 pad = os_zalloc(pad_len ? pad_len : 1);
102 if (pad == NULL) {
103 wpabuf_free(shared);
104 os_free(buf);
105 return -1;
106 }
107
108 addr[0] = pad;
109 len[0] = pad_len;
110 addr[1] = wpabuf_head(shared);
111 len[1] = wpabuf_len(shared);
112 if (ikev2_prf_hash(prf->id, buf, data->i_nonce_len + data->r_nonce_len,
113 2, addr, len, skeyseed) < 0) {
114 wpabuf_free(shared);
115 os_free(buf);
116 os_free(pad);
117 return -1;
118 }
119 os_free(pad);
120 wpabuf_free(shared);
121
122 /* DH parameters are not needed anymore, so free them */
123 wpabuf_free(data->i_dh_public);
124 data->i_dh_public = NULL;
125 wpabuf_free(data->r_dh_private);
126 data->r_dh_private = NULL;
127
128 wpa_hexdump_key(MSG_DEBUG, "IKEV2: SKEYSEED",
129 skeyseed, prf->hash_len);
130
131 ret = ikev2_derive_sk_keys(prf, integ, encr, skeyseed, buf, buf_len,
132 &data->keys);
133 os_free(buf);
134 return ret;
135 }
136
137
138 static int ikev2_parse_transform(struct ikev2_proposal_data *prop,
139 const u8 *pos, const u8 *end)
140 {
141 int transform_len;
142 const struct ikev2_transform *t;
143 u16 transform_id;
144 const u8 *tend;
145
146 if (end - pos < (int) sizeof(*t)) {
147 wpa_printf(MSG_INFO, "IKEV2: Too short transform");
148 return -1;
149 }
150
151 t = (const struct ikev2_transform *) pos;
152 transform_len = WPA_GET_BE16(t->transform_length);
153 if (transform_len < (int) sizeof(*t) || pos + transform_len > end) {
154 wpa_printf(MSG_INFO, "IKEV2: Invalid transform length %d",
155 transform_len);
156 return -1;
157 }
158 tend = pos + transform_len;
159
160 transform_id = WPA_GET_BE16(t->transform_id);
161
162 wpa_printf(MSG_DEBUG, "IKEV2: Transform:");
163 wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Transform Length: %d "
164 "Transform Type: %d Transform ID: %d",
165 t->type, transform_len, t->transform_type, transform_id);
166
167 if (t->type != 0 && t->type != 3) {
168 wpa_printf(MSG_INFO, "IKEV2: Unexpected Transform type");
169 return -1;
170 }
171
172 pos = (const u8 *) (t + 1);
173 if (pos < tend) {
174 wpa_hexdump(MSG_DEBUG, "IKEV2: Transform Attributes",
175 pos, tend - pos);
176 }
177
178 switch (t->transform_type) {
179 case IKEV2_TRANSFORM_ENCR:
180 if (ikev2_get_encr(transform_id)) {
181 if (transform_id == ENCR_AES_CBC) {
182 if (tend - pos != 4) {
183 wpa_printf(MSG_DEBUG, "IKEV2: No "
184 "Transform Attr for AES");
185 break;
186 }
187 #ifdef CCNS_PL
188 if (WPA_GET_BE16(pos) != 0x001d /* ?? */) {
189 wpa_printf(MSG_DEBUG, "IKEV2: Not a "
190 "Key Size attribute for "
191 "AES");
192 break;
193 }
194 #else /* CCNS_PL */
195 if (WPA_GET_BE16(pos) != 0x800e) {
196 wpa_printf(MSG_DEBUG, "IKEV2: Not a "
197 "Key Size attribute for "
198 "AES");
199 break;
200 }
201 #endif /* CCNS_PL */
202 if (WPA_GET_BE16(pos + 2) != 128) {
203 wpa_printf(MSG_DEBUG, "IKEV2: "
204 "Unsupported AES key size "
205 "%d bits",
206 WPA_GET_BE16(pos + 2));
207 break;
208 }
209 }
210 prop->encr = transform_id;
211 }
212 break;
213 case IKEV2_TRANSFORM_PRF:
214 if (ikev2_get_prf(transform_id))
215 prop->prf = transform_id;
216 break;
217 case IKEV2_TRANSFORM_INTEG:
218 if (ikev2_get_integ(transform_id))
219 prop->integ = transform_id;
220 break;
221 case IKEV2_TRANSFORM_DH:
222 if (dh_groups_get(transform_id))
223 prop->dh = transform_id;
224 break;
225 }
226
227 return transform_len;
228 }
229
230
231 static int ikev2_parse_proposal(struct ikev2_proposal_data *prop,
232 const u8 *pos, const u8 *end)
233 {
234 const u8 *pend, *ppos;
235 int proposal_len, i;
236 const struct ikev2_proposal *p;
237
238 if (end - pos < (int) sizeof(*p)) {
239 wpa_printf(MSG_INFO, "IKEV2: Too short proposal");
240 return -1;
241 }
242
243 /* FIX: AND processing if multiple proposals use the same # */
244
245 p = (const struct ikev2_proposal *) pos;
246 proposal_len = WPA_GET_BE16(p->proposal_length);
247 if (proposal_len < (int) sizeof(*p) || pos + proposal_len > end) {
248 wpa_printf(MSG_INFO, "IKEV2: Invalid proposal length %d",
249 proposal_len);
250 return -1;
251 }
252 wpa_printf(MSG_DEBUG, "IKEV2: SAi1 Proposal # %d",
253 p->proposal_num);
254 wpa_printf(MSG_DEBUG, "IKEV2: Type: %d Proposal Length: %d "
255 " Protocol ID: %d",
256 p->type, proposal_len, p->protocol_id);
257 wpa_printf(MSG_DEBUG, "IKEV2: SPI Size: %d Transforms: %d",
258 p->spi_size, p->num_transforms);
259
260 if (p->type != 0 && p->type != 2) {
261 wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal type");
262 return -1;
263 }
264
265 if (p->protocol_id != IKEV2_PROTOCOL_IKE) {
266 wpa_printf(MSG_DEBUG, "IKEV2: Unexpected Protocol ID "
267 "(only IKE allowed for EAP-IKEv2)");
268 return -1;
269 }
270
271 if (p->proposal_num != prop->proposal_num) {
272 if (p->proposal_num == prop->proposal_num + 1)
273 prop->proposal_num = p->proposal_num;
274 else {
275 wpa_printf(MSG_INFO, "IKEV2: Unexpected Proposal #");
276 return -1;
277 }
278 }
279
280 ppos = (const u8 *) (p + 1);
281 pend = pos + proposal_len;
282 if (ppos + p->spi_size > pend) {
283 wpa_printf(MSG_INFO, "IKEV2: Not enough room for SPI "
284 "in proposal");
285 return -1;
286 }
287 if (p->spi_size) {
288 wpa_hexdump(MSG_DEBUG, "IKEV2: SPI",
289 ppos, p->spi_size);
290 ppos += p->spi_size;
291 }
292
293 /*
294 * For initial IKE_SA negotiation, SPI Size MUST be zero; for
295 * subsequent negotiations, it must be 8 for IKE. We only support
296 * initial case for now.
297 */
298 if (p->spi_size != 0) {
299 wpa_printf(MSG_INFO, "IKEV2: Unexpected SPI Size");
300 return -1;
301 }
302
303 if (p->num_transforms == 0) {
304 wpa_printf(MSG_INFO, "IKEV2: At least one transform required");
305 return -1;
306 }
307
308 for (i = 0; i < (int) p->num_transforms; i++) {
309 int tlen = ikev2_parse_transform(prop, ppos, pend);
310 if (tlen < 0)
311 return -1;
312 ppos += tlen;
313 }
314
315 if (ppos != pend) {
316 wpa_printf(MSG_INFO, "IKEV2: Unexpected data after "
317 "transforms");
318 return -1;
319 }
320
321 return proposal_len;
322 }
323
324
325 static int ikev2_process_sai1(struct ikev2_responder_data *data,
326 const u8 *sai1, size_t sai1_len)
327 {
328 struct ikev2_proposal_data prop;
329 const u8 *pos, *end;
330 int found = 0;
331
332 /* Security Association Payloads: <Proposals> */
333
334 if (sai1 == NULL) {
335 wpa_printf(MSG_INFO, "IKEV2: SAi1 not received");
336 return -1;
337 }
338
339 os_memset(&prop, 0, sizeof(prop));
340 prop.proposal_num = 1;
341
342 pos = sai1;
343 end = sai1 + sai1_len;
344
345 while (pos < end) {
346 int plen;
347
348 prop.integ = -1;
349 prop.prf = -1;
350 prop.encr = -1;
351 prop.dh = -1;
352 plen = ikev2_parse_proposal(&prop, pos, end);
353 if (plen < 0)
354 return -1;
355
356 if (!found && prop.integ != -1 && prop.prf != -1 &&
357 prop.encr != -1 && prop.dh != -1) {
358 os_memcpy(&data->proposal, &prop, sizeof(prop));
359 data->dh = dh_groups_get(prop.dh);
360 found = 1;
361 }
362
363 pos += plen;
364 }
365
366 if (pos != end) {
367 wpa_printf(MSG_INFO, "IKEV2: Unexpected data after proposals");
368 return -1;
369 }
370
371 if (!found) {
372 wpa_printf(MSG_INFO, "IKEV2: No acceptable proposal found");
373 return -1;
374 }
375
376 wpa_printf(MSG_DEBUG, "IKEV2: Accepted proposal #%d: ENCR:%d PRF:%d "
377 "INTEG:%d D-H:%d", data->proposal.proposal_num,
378 data->proposal.encr, data->proposal.prf,
379 data->proposal.integ, data->proposal.dh);
380
381 return 0;
382 }
383
384
385 static int ikev2_process_kei(struct ikev2_responder_data *data,
386 const u8 *kei, size_t kei_len)
387 {
388 u16 group;
389
390 /*
391 * Key Exchange Payload:
392 * DH Group # (16 bits)
393 * RESERVED (16 bits)
394 * Key Exchange Data (Diffie-Hellman public value)
395 */
396
397 if (kei == NULL) {
398 wpa_printf(MSG_INFO, "IKEV2: KEi not received");
399 return -1;
400 }
401
402 if (kei_len < 4 + 96) {
403 wpa_printf(MSG_INFO, "IKEV2: Too show Key Exchange Payload");
404 return -1;
405 }
406
407 group = WPA_GET_BE16(kei);
408 wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u", group);
409
410 if (group != data->proposal.dh) {
411 wpa_printf(MSG_DEBUG, "IKEV2: KEi DH Group #%u does not match "
412 "with the selected proposal (%u)",
413 group, data->proposal.dh);
414 /* Reject message with Notify payload of type
415 * INVALID_KE_PAYLOAD (RFC 4306, Sect. 3.4) */
416 data->error_type = INVALID_KE_PAYLOAD;
417 data->state = NOTIFY;
418 return -1;
419 }
420
421 if (data->dh == NULL) {
422 wpa_printf(MSG_INFO, "IKEV2: Unsupported DH group");
423 return -1;
424 }
425
426 /* RFC 4306, Section 3.4:
427 * The length of DH public value MUST be equal to the lenght of the
428 * prime modulus.
429 */
430 if (kei_len - 4 != data->dh->prime_len) {
431 wpa_printf(MSG_INFO, "IKEV2: Invalid DH public value length "
432 "%ld (expected %ld)",
433 (long) (kei_len - 4), (long) data->dh->prime_len);
434 return -1;
435 }
436
437 wpabuf_free(data->i_dh_public);
438 data->i_dh_public = wpabuf_alloc(kei_len - 4);
439 if (data->i_dh_public == NULL)
440 return -1;
441 wpabuf_put_data(data->i_dh_public, kei + 4, kei_len - 4);
442
443 wpa_hexdump_buf(MSG_DEBUG, "IKEV2: KEi Diffie-Hellman Public Value",
444 data->i_dh_public);
445
446 return 0;
447 }
448
449
450 static int ikev2_process_ni(struct ikev2_responder_data *data,
451 const u8 *ni, size_t ni_len)
452 {
453 if (ni == NULL) {
454 wpa_printf(MSG_INFO, "IKEV2: Ni not received");
455 return -1;
456 }
457
458 if (ni_len < IKEV2_NONCE_MIN_LEN || ni_len > IKEV2_NONCE_MAX_LEN) {
459 wpa_printf(MSG_INFO, "IKEV2: Invalid Ni length %ld",
460 (long) ni_len);
461 return -1;
462 }
463
464 #ifdef CCNS_PL
465 /* Zeros are removed incorrectly from the beginning of the nonces */
466 while (ni_len > 1 && *ni == 0) {
467 ni_len--;
468 ni++;
469 }
470 #endif /* CCNS_PL */
471
472 data->i_nonce_len = ni_len;
473 os_memcpy(data->i_nonce, ni, ni_len);
474 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Ni",
475 data->i_nonce, data->i_nonce_len);
476
477 return 0;
478 }
479
480
481 static int ikev2_process_sa_init(struct ikev2_responder_data *data,
482 const struct ikev2_hdr *hdr,
483 struct ikev2_payloads *pl)
484 {
485 if (ikev2_process_sai1(data, pl->sa, pl->sa_len) < 0 ||
486 ikev2_process_kei(data, pl->ke, pl->ke_len) < 0 ||
487 ikev2_process_ni(data, pl->nonce, pl->nonce_len) < 0)
488 return -1;
489
490 os_memcpy(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN);
491
492 return 0;
493 }
494
495
496 static int ikev2_process_idi(struct ikev2_responder_data *data,
497 const u8 *idi, size_t idi_len)
498 {
499 u8 id_type;
500
501 if (idi == NULL) {
502 wpa_printf(MSG_INFO, "IKEV2: No IDi received");
503 return -1;
504 }
505
506 if (idi_len < 4) {
507 wpa_printf(MSG_INFO, "IKEV2: Too short IDi payload");
508 return -1;
509 }
510
511 id_type = idi[0];
512 idi += 4;
513 idi_len -= 4;
514
515 wpa_printf(MSG_DEBUG, "IKEV2: IDi ID Type %d", id_type);
516 wpa_hexdump_ascii(MSG_DEBUG, "IKEV2: IDi", idi, idi_len);
517 os_free(data->IDi);
518 data->IDi = os_malloc(idi_len);
519 if (data->IDi == NULL)
520 return -1;
521 os_memcpy(data->IDi, idi, idi_len);
522 data->IDi_len = idi_len;
523 data->IDi_type = id_type;
524
525 return 0;
526 }
527
528
529 static int ikev2_process_cert(struct ikev2_responder_data *data,
530 const u8 *cert, size_t cert_len)
531 {
532 u8 cert_encoding;
533
534 if (cert == NULL) {
535 if (data->peer_auth == PEER_AUTH_CERT) {
536 wpa_printf(MSG_INFO, "IKEV2: No Certificate received");
537 return -1;
538 }
539 return 0;
540 }
541
542 if (cert_len < 1) {
543 wpa_printf(MSG_INFO, "IKEV2: No Cert Encoding field");
544 return -1;
545 }
546
547 cert_encoding = cert[0];
548 cert++;
549 cert_len--;
550
551 wpa_printf(MSG_DEBUG, "IKEV2: Cert Encoding %d", cert_encoding);
552 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Certificate Data", cert, cert_len);
553
554 /* TODO: validate certificate */
555
556 return 0;
557 }
558
559
560 static int ikev2_process_auth_cert(struct ikev2_responder_data *data,
561 u8 method, const u8 *auth, size_t auth_len)
562 {
563 if (method != AUTH_RSA_SIGN) {
564 wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication "
565 "method %d", method);
566 return -1;
567 }
568
569 /* TODO: validate AUTH */
570 return 0;
571 }
572
573
574 static int ikev2_process_auth_secret(struct ikev2_responder_data *data,
575 u8 method, const u8 *auth,
576 size_t auth_len)
577 {
578 u8 auth_data[IKEV2_MAX_HASH_LEN];
579 const struct ikev2_prf_alg *prf;
580
581 if (method != AUTH_SHARED_KEY_MIC) {
582 wpa_printf(MSG_INFO, "IKEV2: Unsupported authentication "
583 "method %d", method);
584 return -1;
585 }
586
587 /* msg | Nr | prf(SK_pi,IDi') */
588 if (ikev2_derive_auth_data(data->proposal.prf, data->i_sign_msg,
589 data->IDi, data->IDi_len, data->IDi_type,
590 &data->keys, 1, data->shared_secret,
591 data->shared_secret_len,
592 data->r_nonce, data->r_nonce_len,
593 data->key_pad, data->key_pad_len,
594 auth_data) < 0) {
595 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data");
596 return -1;
597 }
598
599 wpabuf_free(data->i_sign_msg);
600 data->i_sign_msg = NULL;
601
602 prf = ikev2_get_prf(data->proposal.prf);
603 if (prf == NULL)
604 return -1;
605
606 if (auth_len != prf->hash_len ||
607 os_memcmp(auth, auth_data, auth_len) != 0) {
608 wpa_printf(MSG_INFO, "IKEV2: Invalid Authentication Data");
609 wpa_hexdump(MSG_DEBUG, "IKEV2: Received Authentication Data",
610 auth, auth_len);
611 wpa_hexdump(MSG_DEBUG, "IKEV2: Expected Authentication Data",
612 auth_data, prf->hash_len);
613 data->error_type = AUTHENTICATION_FAILED;
614 data->state = NOTIFY;
615 return -1;
616 }
617
618 wpa_printf(MSG_DEBUG, "IKEV2: Server authenticated successfully "
619 "using shared keys");
620
621 return 0;
622 }
623
624
625 static int ikev2_process_auth(struct ikev2_responder_data *data,
626 const u8 *auth, size_t auth_len)
627 {
628 u8 auth_method;
629
630 if (auth == NULL) {
631 wpa_printf(MSG_INFO, "IKEV2: No Authentication Payload");
632 return -1;
633 }
634
635 if (auth_len < 4) {
636 wpa_printf(MSG_INFO, "IKEV2: Too short Authentication "
637 "Payload");
638 return -1;
639 }
640
641 auth_method = auth[0];
642 auth += 4;
643 auth_len -= 4;
644
645 wpa_printf(MSG_DEBUG, "IKEV2: Auth Method %d", auth_method);
646 wpa_hexdump(MSG_MSGDUMP, "IKEV2: Authentication Data", auth, auth_len);
647
648 switch (data->peer_auth) {
649 case PEER_AUTH_CERT:
650 return ikev2_process_auth_cert(data, auth_method, auth,
651 auth_len);
652 case PEER_AUTH_SECRET:
653 return ikev2_process_auth_secret(data, auth_method, auth,
654 auth_len);
655 }
656
657 return -1;
658 }
659
660
661 static int ikev2_process_sa_auth_decrypted(struct ikev2_responder_data *data,
662 u8 next_payload,
663 u8 *payload, size_t payload_len)
664 {
665 struct ikev2_payloads pl;
666
667 wpa_printf(MSG_DEBUG, "IKEV2: Processing decrypted payloads");
668
669 if (ikev2_parse_payloads(&pl, next_payload, payload, payload +
670 payload_len) < 0) {
671 wpa_printf(MSG_INFO, "IKEV2: Failed to parse decrypted "
672 "payloads");
673 return -1;
674 }
675
676 if (ikev2_process_idi(data, pl.idi, pl.idi_len) < 0 ||
677 ikev2_process_cert(data, pl.cert, pl.cert_len) < 0 ||
678 ikev2_process_auth(data, pl.auth, pl.auth_len) < 0)
679 return -1;
680
681 return 0;
682 }
683
684
685 static int ikev2_process_sa_auth(struct ikev2_responder_data *data,
686 const struct ikev2_hdr *hdr,
687 struct ikev2_payloads *pl)
688 {
689 u8 *decrypted;
690 size_t decrypted_len;
691 int ret;
692
693 decrypted = ikev2_decrypt_payload(data->proposal.encr,
694 data->proposal.integ,
695 &data->keys, 1, hdr, pl->encrypted,
696 pl->encrypted_len, &decrypted_len);
697 if (decrypted == NULL)
698 return -1;
699
700 ret = ikev2_process_sa_auth_decrypted(data, pl->encr_next_payload,
701 decrypted, decrypted_len);
702 os_free(decrypted);
703
704 return ret;
705 }
706
707
708 static int ikev2_validate_rx_state(struct ikev2_responder_data *data,
709 u8 exchange_type, u32 message_id)
710 {
711 switch (data->state) {
712 case SA_INIT:
713 /* Expect to receive IKE_SA_INIT: HDR, SAi1, KEi, Ni */
714 if (exchange_type != IKE_SA_INIT) {
715 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
716 "%u in SA_INIT state", exchange_type);
717 return -1;
718 }
719 if (message_id != 0) {
720 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
721 "in SA_INIT state", message_id);
722 return -1;
723 }
724 break;
725 case SA_AUTH:
726 /* Expect to receive IKE_SA_AUTH:
727 * HDR, SK {IDi, [CERT,] [CERTREQ,] [IDr,]
728 * AUTH, SAi2, TSi, TSr}
729 */
730 if (exchange_type != IKE_SA_AUTH) {
731 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
732 "%u in SA_AUTH state", exchange_type);
733 return -1;
734 }
735 if (message_id != 1) {
736 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
737 "in SA_AUTH state", message_id);
738 return -1;
739 }
740 break;
741 case CHILD_SA:
742 if (exchange_type != CREATE_CHILD_SA) {
743 wpa_printf(MSG_INFO, "IKEV2: Unexpected Exchange Type "
744 "%u in CHILD_SA state", exchange_type);
745 return -1;
746 }
747 if (message_id != 2) {
748 wpa_printf(MSG_INFO, "IKEV2: Unexpected Message ID %u "
749 "in CHILD_SA state", message_id);
750 return -1;
751 }
752 break;
753 case NOTIFY:
754 case IKEV2_DONE:
755 case IKEV2_FAILED:
756 return -1;
757 }
758
759 return 0;
760 }
761
762
763 int ikev2_responder_process(struct ikev2_responder_data *data,
764 const struct wpabuf *buf)
765 {
766 const struct ikev2_hdr *hdr;
767 u32 length, message_id;
768 const u8 *pos, *end;
769 struct ikev2_payloads pl;
770
771 wpa_printf(MSG_MSGDUMP, "IKEV2: Received message (len %lu)",
772 (unsigned long) wpabuf_len(buf));
773
774 if (wpabuf_len(buf) < sizeof(*hdr)) {
775 wpa_printf(MSG_INFO, "IKEV2: Too short frame to include HDR");
776 return -1;
777 }
778
779 data->error_type = 0;
780 hdr = (const struct ikev2_hdr *) wpabuf_head(buf);
781 end = wpabuf_head_u8(buf) + wpabuf_len(buf);
782 message_id = WPA_GET_BE32(hdr->message_id);
783 length = WPA_GET_BE32(hdr->length);
784
785 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Initiator's SPI",
786 hdr->i_spi, IKEV2_SPI_LEN);
787 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI",
788 hdr->r_spi, IKEV2_SPI_LEN);
789 wpa_printf(MSG_DEBUG, "IKEV2: Next Payload: %u Version: 0x%x "
790 "Exchange Type: %u",
791 hdr->next_payload, hdr->version, hdr->exchange_type);
792 wpa_printf(MSG_DEBUG, "IKEV2: Message ID: %u Length: %u",
793 message_id, length);
794
795 if (hdr->version != IKEV2_VERSION) {
796 wpa_printf(MSG_INFO, "IKEV2: Unsupported HDR version 0x%x "
797 "(expected 0x%x)", hdr->version, IKEV2_VERSION);
798 return -1;
799 }
800
801 if (length != wpabuf_len(buf)) {
802 wpa_printf(MSG_INFO, "IKEV2: Invalid length (HDR: %lu != "
803 "RX: %lu)", (unsigned long) length,
804 (unsigned long) wpabuf_len(buf));
805 return -1;
806 }
807
808 if (ikev2_validate_rx_state(data, hdr->exchange_type, message_id) < 0)
809 return -1;
810
811 if ((hdr->flags & (IKEV2_HDR_INITIATOR | IKEV2_HDR_RESPONSE)) !=
812 IKEV2_HDR_INITIATOR) {
813 wpa_printf(MSG_INFO, "IKEV2: Unexpected Flags value 0x%x",
814 hdr->flags);
815 return -1;
816 }
817
818 if (data->state != SA_INIT) {
819 if (os_memcmp(data->i_spi, hdr->i_spi, IKEV2_SPI_LEN) != 0) {
820 wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "
821 "Initiator's SPI");
822 return -1;
823 }
824 if (os_memcmp(data->r_spi, hdr->r_spi, IKEV2_SPI_LEN) != 0) {
825 wpa_printf(MSG_INFO, "IKEV2: Unexpected IKE_SA "
826 "Responder's SPI");
827 return -1;
828 }
829 }
830
831 pos = (const u8 *) (hdr + 1);
832 if (ikev2_parse_payloads(&pl, hdr->next_payload, pos, end) < 0)
833 return -1;
834
835 if (data->state == SA_INIT) {
836 data->last_msg = LAST_MSG_SA_INIT;
837 if (ikev2_process_sa_init(data, hdr, &pl) < 0) {
838 if (data->state == NOTIFY)
839 return 0;
840 return -1;
841 }
842 wpabuf_free(data->i_sign_msg);
843 data->i_sign_msg = wpabuf_dup(buf);
844 }
845
846 if (data->state == SA_AUTH) {
847 data->last_msg = LAST_MSG_SA_AUTH;
848 if (ikev2_process_sa_auth(data, hdr, &pl) < 0) {
849 if (data->state == NOTIFY)
850 return 0;
851 return -1;
852 }
853 }
854
855 return 0;
856 }
857
858
859 static void ikev2_build_hdr(struct ikev2_responder_data *data,
860 struct wpabuf *msg, u8 exchange_type,
861 u8 next_payload, u32 message_id)
862 {
863 struct ikev2_hdr *hdr;
864
865 wpa_printf(MSG_DEBUG, "IKEV2: Adding HDR");
866
867 /* HDR - RFC 4306, Sect. 3.1 */
868 hdr = wpabuf_put(msg, sizeof(*hdr));
869 os_memcpy(hdr->i_spi, data->i_spi, IKEV2_SPI_LEN);
870 os_memcpy(hdr->r_spi, data->r_spi, IKEV2_SPI_LEN);
871 hdr->next_payload = next_payload;
872 hdr->version = IKEV2_VERSION;
873 hdr->exchange_type = exchange_type;
874 hdr->flags = IKEV2_HDR_RESPONSE;
875 WPA_PUT_BE32(hdr->message_id, message_id);
876 }
877
878
879 static int ikev2_build_sar1(struct ikev2_responder_data *data,
880 struct wpabuf *msg, u8 next_payload)
881 {
882 struct ikev2_payload_hdr *phdr;
883 size_t plen;
884 struct ikev2_proposal *p;
885 struct ikev2_transform *t;
886
887 wpa_printf(MSG_DEBUG, "IKEV2: Adding SAr1 payload");
888
889 /* SAr1 - RFC 4306, Sect. 2.7 and 3.3 */
890 phdr = wpabuf_put(msg, sizeof(*phdr));
891 phdr->next_payload = next_payload;
892 phdr->flags = 0;
893
894 p = wpabuf_put(msg, sizeof(*p));
895 #ifdef CCNS_PL
896 /* Seems to require that the Proposal # is 1 even though RFC 4306
897 * Sect 3.3.1 has following requirement "When a proposal is accepted,
898 * all of the proposal numbers in the SA payload MUST be the same and
899 * MUST match the number on the proposal sent that was accepted.".
900 */
901 p->proposal_num = 1;
902 #else /* CCNS_PL */
903 p->proposal_num = data->proposal.proposal_num;
904 #endif /* CCNS_PL */
905 p->protocol_id = IKEV2_PROTOCOL_IKE;
906 p->num_transforms = 4;
907
908 t = wpabuf_put(msg, sizeof(*t));
909 t->type = 3;
910 t->transform_type = IKEV2_TRANSFORM_ENCR;
911 WPA_PUT_BE16(t->transform_id, data->proposal.encr);
912 if (data->proposal.encr == ENCR_AES_CBC) {
913 /* Transform Attribute: Key Len = 128 bits */
914 #ifdef CCNS_PL
915 wpabuf_put_be16(msg, 0x001d); /* ?? */
916 #else /* CCNS_PL */
917 wpabuf_put_be16(msg, 0x800e); /* AF=1, AttrType=14 */
918 #endif /* CCNS_PL */
919 wpabuf_put_be16(msg, 128); /* 128-bit key */
920 }
921 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) t;
922 WPA_PUT_BE16(t->transform_length, plen);
923
924 t = wpabuf_put(msg, sizeof(*t));
925 t->type = 3;
926 WPA_PUT_BE16(t->transform_length, sizeof(*t));
927 t->transform_type = IKEV2_TRANSFORM_PRF;
928 WPA_PUT_BE16(t->transform_id, data->proposal.prf);
929
930 t = wpabuf_put(msg, sizeof(*t));
931 t->type = 3;
932 WPA_PUT_BE16(t->transform_length, sizeof(*t));
933 t->transform_type = IKEV2_TRANSFORM_INTEG;
934 WPA_PUT_BE16(t->transform_id, data->proposal.integ);
935
936 t = wpabuf_put(msg, sizeof(*t));
937 WPA_PUT_BE16(t->transform_length, sizeof(*t));
938 t->transform_type = IKEV2_TRANSFORM_DH;
939 WPA_PUT_BE16(t->transform_id, data->proposal.dh);
940
941 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) p;
942 WPA_PUT_BE16(p->proposal_length, plen);
943
944 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
945 WPA_PUT_BE16(phdr->payload_length, plen);
946
947 return 0;
948 }
949
950
951 static int ikev2_build_ker(struct ikev2_responder_data *data,
952 struct wpabuf *msg, u8 next_payload)
953 {
954 struct ikev2_payload_hdr *phdr;
955 size_t plen;
956 struct wpabuf *pv;
957
958 wpa_printf(MSG_DEBUG, "IKEV2: Adding KEr payload");
959
960 pv = dh_init(data->dh, &data->r_dh_private);
961 if (pv == NULL) {
962 wpa_printf(MSG_DEBUG, "IKEV2: Failed to initialize DH");
963 return -1;
964 }
965
966 /* KEr - RFC 4306, Sect. 3.4 */
967 phdr = wpabuf_put(msg, sizeof(*phdr));
968 phdr->next_payload = next_payload;
969 phdr->flags = 0;
970
971 wpabuf_put_be16(msg, data->proposal.dh); /* DH Group # */
972 wpabuf_put(msg, 2); /* RESERVED */
973 /*
974 * RFC 4306, Sect. 3.4: possible zero padding for public value to
975 * match the length of the prime.
976 */
977 wpabuf_put(msg, data->dh->prime_len - wpabuf_len(pv));
978 wpabuf_put_buf(msg, pv);
979 wpabuf_free(pv);
980
981 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
982 WPA_PUT_BE16(phdr->payload_length, plen);
983 return 0;
984 }
985
986
987 static int ikev2_build_nr(struct ikev2_responder_data *data,
988 struct wpabuf *msg, u8 next_payload)
989 {
990 struct ikev2_payload_hdr *phdr;
991 size_t plen;
992
993 wpa_printf(MSG_DEBUG, "IKEV2: Adding Nr payload");
994
995 /* Nr - RFC 4306, Sect. 3.9 */
996 phdr = wpabuf_put(msg, sizeof(*phdr));
997 phdr->next_payload = next_payload;
998 phdr->flags = 0;
999 wpabuf_put_data(msg, data->r_nonce, data->r_nonce_len);
1000 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
1001 WPA_PUT_BE16(phdr->payload_length, plen);
1002 return 0;
1003 }
1004
1005
1006 static int ikev2_build_idr(struct ikev2_responder_data *data,
1007 struct wpabuf *msg, u8 next_payload)
1008 {
1009 struct ikev2_payload_hdr *phdr;
1010 size_t plen;
1011
1012 wpa_printf(MSG_DEBUG, "IKEV2: Adding IDr payload");
1013
1014 if (data->IDr == NULL) {
1015 wpa_printf(MSG_INFO, "IKEV2: No IDr available");
1016 return -1;
1017 }
1018
1019 /* IDr - RFC 4306, Sect. 3.5 */
1020 phdr = wpabuf_put(msg, sizeof(*phdr));
1021 phdr->next_payload = next_payload;
1022 phdr->flags = 0;
1023 wpabuf_put_u8(msg, ID_KEY_ID);
1024 wpabuf_put(msg, 3); /* RESERVED */
1025 wpabuf_put_data(msg, data->IDr, data->IDr_len);
1026 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
1027 WPA_PUT_BE16(phdr->payload_length, plen);
1028 return 0;
1029 }
1030
1031
1032 static int ikev2_build_auth(struct ikev2_responder_data *data,
1033 struct wpabuf *msg, u8 next_payload)
1034 {
1035 struct ikev2_payload_hdr *phdr;
1036 size_t plen;
1037 const struct ikev2_prf_alg *prf;
1038
1039 wpa_printf(MSG_DEBUG, "IKEV2: Adding AUTH payload");
1040
1041 prf = ikev2_get_prf(data->proposal.prf);
1042 if (prf == NULL)
1043 return -1;
1044
1045 /* Authentication - RFC 4306, Sect. 3.8 */
1046 phdr = wpabuf_put(msg, sizeof(*phdr));
1047 phdr->next_payload = next_payload;
1048 phdr->flags = 0;
1049 wpabuf_put_u8(msg, AUTH_SHARED_KEY_MIC);
1050 wpabuf_put(msg, 3); /* RESERVED */
1051
1052 /* msg | Ni | prf(SK_pr,IDr') */
1053 if (ikev2_derive_auth_data(data->proposal.prf, data->r_sign_msg,
1054 data->IDr, data->IDr_len, ID_KEY_ID,
1055 &data->keys, 0, data->shared_secret,
1056 data->shared_secret_len,
1057 data->i_nonce, data->i_nonce_len,
1058 data->key_pad, data->key_pad_len,
1059 wpabuf_put(msg, prf->hash_len)) < 0) {
1060 wpa_printf(MSG_INFO, "IKEV2: Could not derive AUTH data");
1061 return -1;
1062 }
1063 wpabuf_free(data->r_sign_msg);
1064 data->r_sign_msg = NULL;
1065
1066 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
1067 WPA_PUT_BE16(phdr->payload_length, plen);
1068 return 0;
1069 }
1070
1071
1072 static int ikev2_build_notification(struct ikev2_responder_data *data,
1073 struct wpabuf *msg, u8 next_payload)
1074 {
1075 struct ikev2_payload_hdr *phdr;
1076 size_t plen;
1077
1078 wpa_printf(MSG_DEBUG, "IKEV2: Adding Notification payload");
1079
1080 if (data->error_type == 0) {
1081 wpa_printf(MSG_INFO, "IKEV2: No Notify Message Type "
1082 "available");
1083 return -1;
1084 }
1085
1086 /* Notify - RFC 4306, Sect. 3.10 */
1087 phdr = wpabuf_put(msg, sizeof(*phdr));
1088 phdr->next_payload = next_payload;
1089 phdr->flags = 0;
1090 #ifdef CCNS_PL
1091 wpabuf_put_u8(msg, 1); /* Protocol ID: IKE_SA notification */
1092 #else /* CCNS_PL */
1093 wpabuf_put_u8(msg, 0); /* Protocol ID: no existing SA */
1094 #endif /* CCNS_PL */
1095 wpabuf_put_u8(msg, 0); /* SPI Size */
1096 wpabuf_put_be16(msg, data->error_type);
1097
1098 switch (data->error_type) {
1099 case INVALID_KE_PAYLOAD:
1100 if (data->proposal.dh == -1) {
1101 wpa_printf(MSG_INFO, "IKEV2: No DH Group selected for "
1102 "INVALID_KE_PAYLOAD notifications");
1103 return -1;
1104 }
1105 wpabuf_put_be16(msg, data->proposal.dh);
1106 wpa_printf(MSG_DEBUG, "IKEV2: INVALID_KE_PAYLOAD - request "
1107 "DH Group #%d", data->proposal.dh);
1108 break;
1109 case AUTHENTICATION_FAILED:
1110 /* no associated data */
1111 break;
1112 default:
1113 wpa_printf(MSG_INFO, "IKEV2: Unsupported Notify Message Type "
1114 "%d", data->error_type);
1115 return -1;
1116 }
1117
1118 plen = (u8 *) wpabuf_put(msg, 0) - (u8 *) phdr;
1119 WPA_PUT_BE16(phdr->payload_length, plen);
1120 return 0;
1121 }
1122
1123
1124 static struct wpabuf * ikev2_build_sa_init(struct ikev2_responder_data *data)
1125 {
1126 struct wpabuf *msg;
1127
1128 /* build IKE_SA_INIT: HDR, SAr1, KEr, Nr, [CERTREQ], [SK{IDr}] */
1129
1130 if (os_get_random(data->r_spi, IKEV2_SPI_LEN))
1131 return NULL;
1132 wpa_hexdump(MSG_DEBUG, "IKEV2: IKE_SA Responder's SPI",
1133 data->r_spi, IKEV2_SPI_LEN);
1134
1135 data->r_nonce_len = IKEV2_NONCE_MIN_LEN;
1136 if (os_get_random(data->r_nonce, data->r_nonce_len))
1137 return NULL;
1138 #ifdef CCNS_PL
1139 /* Zeros are removed incorrectly from the beginning of the nonces in
1140 * key derivation; as a workaround, make sure Nr does not start with
1141 * zero.. */
1142 if (data->r_nonce[0] == 0)
1143 data->r_nonce[0] = 1;
1144 #endif /* CCNS_PL */
1145 wpa_hexdump(MSG_DEBUG, "IKEV2: Nr", data->r_nonce, data->r_nonce_len);
1146
1147 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1500);
1148 if (msg == NULL)
1149 return NULL;
1150
1151 ikev2_build_hdr(data, msg, IKE_SA_INIT, IKEV2_PAYLOAD_SA, 0);
1152 if (ikev2_build_sar1(data, msg, IKEV2_PAYLOAD_KEY_EXCHANGE) ||
1153 ikev2_build_ker(data, msg, IKEV2_PAYLOAD_NONCE) ||
1154 ikev2_build_nr(data, msg, data->peer_auth == PEER_AUTH_SECRET ?
1155 IKEV2_PAYLOAD_ENCRYPTED :
1156 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) {
1157 wpabuf_free(msg);
1158 return NULL;
1159 }
1160
1161 if (ikev2_derive_keys(data)) {
1162 wpabuf_free(msg);
1163 return NULL;
1164 }
1165
1166 if (data->peer_auth == PEER_AUTH_CERT) {
1167 /* TODO: CERTREQ with SHA-1 hashes of Subject Public Key Info
1168 * for trust agents */
1169 }
1170
1171 if (data->peer_auth == PEER_AUTH_SECRET) {
1172 struct wpabuf *plain = wpabuf_alloc(data->IDr_len + 1000);
1173 if (plain == NULL) {
1174 wpabuf_free(msg);
1175 return NULL;
1176 }
1177 if (ikev2_build_idr(data, plain,
1178 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
1179 ikev2_build_encrypted(data->proposal.encr,
1180 data->proposal.integ,
1181 &data->keys, 0, msg, plain,
1182 IKEV2_PAYLOAD_IDr)) {
1183 wpabuf_free(plain);
1184 wpabuf_free(msg);
1185 return NULL;
1186 }
1187 wpabuf_free(plain);
1188 }
1189
1190 ikev2_update_hdr(msg);
1191
1192 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_INIT)", msg);
1193
1194 data->state = SA_AUTH;
1195
1196 wpabuf_free(data->r_sign_msg);
1197 data->r_sign_msg = wpabuf_dup(msg);
1198
1199 return msg;
1200 }
1201
1202
1203 static struct wpabuf * ikev2_build_sa_auth(struct ikev2_responder_data *data)
1204 {
1205 struct wpabuf *msg, *plain;
1206
1207 /* build IKE_SA_AUTH: HDR, SK {IDr, [CERT,] AUTH} */
1208
1209 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + data->IDr_len + 1000);
1210 if (msg == NULL)
1211 return NULL;
1212 ikev2_build_hdr(data, msg, IKE_SA_AUTH, IKEV2_PAYLOAD_ENCRYPTED, 1);
1213
1214 plain = wpabuf_alloc(data->IDr_len + 1000);
1215 if (plain == NULL) {
1216 wpabuf_free(msg);
1217 return NULL;
1218 }
1219
1220 if (ikev2_build_idr(data, plain, IKEV2_PAYLOAD_AUTHENTICATION) ||
1221 ikev2_build_auth(data, plain, IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
1222 ikev2_build_encrypted(data->proposal.encr, data->proposal.integ,
1223 &data->keys, 0, msg, plain,
1224 IKEV2_PAYLOAD_IDr)) {
1225 wpabuf_free(plain);
1226 wpabuf_free(msg);
1227 return NULL;
1228 }
1229 wpabuf_free(plain);
1230
1231 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (SA_AUTH)", msg);
1232
1233 data->state = IKEV2_DONE;
1234
1235 return msg;
1236 }
1237
1238
1239 static struct wpabuf * ikev2_build_notify(struct ikev2_responder_data *data)
1240 {
1241 struct wpabuf *msg;
1242
1243 msg = wpabuf_alloc(sizeof(struct ikev2_hdr) + 1000);
1244 if (msg == NULL)
1245 return NULL;
1246 if (data->last_msg == LAST_MSG_SA_AUTH) {
1247 /* HDR, SK{N} */
1248 struct wpabuf *plain = wpabuf_alloc(100);
1249 if (plain == NULL) {
1250 wpabuf_free(msg);
1251 return NULL;
1252 }
1253 ikev2_build_hdr(data, msg, IKE_SA_AUTH,
1254 IKEV2_PAYLOAD_ENCRYPTED, 1);
1255 if (ikev2_build_notification(data, plain,
1256 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD) ||
1257 ikev2_build_encrypted(data->proposal.encr,
1258 data->proposal.integ,
1259 &data->keys, 0, msg, plain,
1260 IKEV2_PAYLOAD_NOTIFICATION)) {
1261 wpabuf_free(plain);
1262 wpabuf_free(msg);
1263 return NULL;
1264 }
1265 data->state = IKEV2_FAILED;
1266 } else {
1267 /* HDR, N */
1268 ikev2_build_hdr(data, msg, IKE_SA_INIT,
1269 IKEV2_PAYLOAD_NOTIFICATION, 0);
1270 if (ikev2_build_notification(data, msg,
1271 IKEV2_PAYLOAD_NO_NEXT_PAYLOAD)) {
1272 wpabuf_free(msg);
1273 return NULL;
1274 }
1275 data->state = SA_INIT;
1276 }
1277
1278 ikev2_update_hdr(msg);
1279
1280 wpa_hexdump_buf(MSG_MSGDUMP, "IKEV2: Sending message (Notification)",
1281 msg);
1282
1283 return msg;
1284 }
1285
1286
1287 struct wpabuf * ikev2_responder_build(struct ikev2_responder_data *data)
1288 {
1289 switch (data->state) {
1290 case SA_INIT:
1291 return ikev2_build_sa_init(data);
1292 case SA_AUTH:
1293 return ikev2_build_sa_auth(data);
1294 case CHILD_SA:
1295 return NULL;
1296 case NOTIFY:
1297 return ikev2_build_notify(data);
1298 case IKEV2_DONE:
1299 case IKEV2_FAILED:
1300 return NULL;
1301 }
1302 return NULL;
1303 }