DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

EAP-IKEv2: Allow frag ack without integrity checksum

Browse source 
RFC 5106 is not exactly clear on the requirements for the "no data"
packet that is used to acknowledge a fragmented message. Allow it to be
processed without the integrity checksum data field since it is possible
to interpret the RFC as this not being included. This fixes reassembly
of fragmented frames after keys have been derived.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2014-05-11 20:40:44 +03:00
parent 46e094bd6f
commit c876dcd70f
2 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/eap_peer/eap_ikev2.c
View file

@ -251,7 +251,8 @@ static struct wpabuf * eap_ikev2_build_msg(struct eap_ikev2_data *data,
static int eap_ikev2_process_icv(struct eap_ikev2_data *data, static int eap_ikev2_process_icv(struct eap_ikev2_data *data,
const struct wpabuf *reqData, const struct wpabuf *reqData,
u8 flags, const u8 *pos, const u8 **end) u8 flags, const u8 *pos, const u8 **end,
int frag_ack)
{ {
if (flags & IKEV2_FLAGS_ICV_INCLUDED) { if (flags & IKEV2_FLAGS_ICV_INCLUDED) {
int icv_len = eap_ikev2_validate_icv( int icv_len = eap_ikev2_validate_icv(
@ -261,7 +262,7 @@ static int eap_ikev2_process_icv(struct eap_ikev2_data *data,
return -1; return -1;
/* Hide Integrity Checksum Data from further processing */ /* Hide Integrity Checksum Data from further processing */
*end -= icv_len; *end -= icv_len;
} else if (data->keys_ready) { } else if (data->keys_ready && !frag_ack) {
wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have " wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have "
"included integrity checksum"); "included integrity checksum");
return -1; return -1;
@ -351,7 +352,9 @@ static struct wpabuf * eap_ikev2_process(struct eap_sm *sm, void *priv,
else else
flags = *pos++; flags = *pos++;
if (eap_ikev2_process_icv(data, reqData, flags, pos, &end) < 0) { if (eap_ikev2_process_icv(data, reqData, flags, pos, &end,
data->state == WAIT_FRAG_ACK && len == 0) < 0)
{
ret->ignore = TRUE; ret->ignore = TRUE;
return NULL; return NULL;
} }

9
src/eap_server/eap_server_ikev2.c
View file

@ -256,7 +256,8 @@ static Boolean eap_ikev2_check(struct eap_sm *sm, void *priv,
static int eap_ikev2_process_icv(struct eap_ikev2_data *data, static int eap_ikev2_process_icv(struct eap_ikev2_data *data,
const struct wpabuf *respData, const struct wpabuf *respData,
u8 flags, const u8 *pos, const u8 **end) u8 flags, const u8 *pos, const u8 **end,
int frag_ack)
{ {
if (flags & IKEV2_FLAGS_ICV_INCLUDED) { if (flags & IKEV2_FLAGS_ICV_INCLUDED) {
int icv_len = eap_ikev2_validate_icv( int icv_len = eap_ikev2_validate_icv(
@ -266,7 +267,7 @@ static int eap_ikev2_process_icv(struct eap_ikev2_data *data,
return -1; return -1;
/* Hide Integrity Checksum Data from further processing */ /* Hide Integrity Checksum Data from further processing */
*end -= icv_len; *end -= icv_len;
} else if (data->keys_ready) { } else if (data->keys_ready && !frag_ack) {
wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have " wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have "
"included integrity checksum"); "included integrity checksum");
return -1; return -1;
@ -365,7 +366,9 @@ static void eap_ikev2_process(struct eap_sm *sm, void *priv,
} else } else
flags = *pos++; flags = *pos++;
if (eap_ikev2_process_icv(data, respData, flags, pos, &end) < 0) { if (eap_ikev2_process_icv(data, respData, flags, pos, &end,
data->state == WAIT_FRAG_ACK && len == 0) < 0)
{
eap_ikev2_state(data, FAIL); eap_ikev2_state(data, FAIL);
return; return;
} }