aboutsummaryrefslogtreecommitdiffstats
path: root/src/eap_server/eap_server_ikev2.c
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2014-05-11 17:40:44 (GMT)
committerJouni Malinen <j@w1.fi>2014-05-11 19:47:25 (GMT)
commitc876dcd70f8b3fa14f3c37c84dfcf802af0bc0e4 (patch)
tree7e66ec26e4abbcf59f4c8b4376725b2e90def8f7 /src/eap_server/eap_server_ikev2.c
parent46e094bd6fddebd3017bed7df8106364b020ea55 (diff)
downloadhostap-c876dcd70f8b3fa14f3c37c84dfcf802af0bc0e4.zip
hostap-c876dcd70f8b3fa14f3c37c84dfcf802af0bc0e4.tar.gz
hostap-c876dcd70f8b3fa14f3c37c84dfcf802af0bc0e4.tar.bz2
EAP-IKEv2: Allow frag ack without integrity checksum
RFC 5106 is not exactly clear on the requirements for the "no data" packet that is used to acknowledge a fragmented message. Allow it to be processed without the integrity checksum data field since it is possible to interpret the RFC as this not being included. This fixes reassembly of fragmented frames after keys have been derived. Signed-off-by: Jouni Malinen <j@w1.fi>
Diffstat (limited to 'src/eap_server/eap_server_ikev2.c')
-rw-r--r--src/eap_server/eap_server_ikev2.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/src/eap_server/eap_server_ikev2.c b/src/eap_server/eap_server_ikev2.c
index 1ada0c8..3e32cc9 100644
--- a/src/eap_server/eap_server_ikev2.c
+++ b/src/eap_server/eap_server_ikev2.c
@@ -256,7 +256,8 @@ static Boolean eap_ikev2_check(struct eap_sm *sm, void *priv,
static int eap_ikev2_process_icv(struct eap_ikev2_data *data,
const struct wpabuf *respData,
- u8 flags, const u8 *pos, const u8 **end)
+ u8 flags, const u8 *pos, const u8 **end,
+ int frag_ack)
{
if (flags & IKEV2_FLAGS_ICV_INCLUDED) {
int icv_len = eap_ikev2_validate_icv(
@@ -266,7 +267,7 @@ static int eap_ikev2_process_icv(struct eap_ikev2_data *data,
return -1;
/* Hide Integrity Checksum Data from further processing */
*end -= icv_len;
- } else if (data->keys_ready) {
+ } else if (data->keys_ready && !frag_ack) {
wpa_printf(MSG_INFO, "EAP-IKEV2: The message should have "
"included integrity checksum");
return -1;
@@ -365,7 +366,9 @@ static void eap_ikev2_process(struct eap_sm *sm, void *priv,
} else
flags = *pos++;
- if (eap_ikev2_process_icv(data, respData, flags, pos, &end) < 0) {
+ if (eap_ikev2_process_icv(data, respData, flags, pos, &end,
+ data->state == WAIT_FRAG_ACK && len == 0) < 0)
+ {
eap_ikev2_state(data, FAIL);
return;
}