Support EAP-only authentication for mutual and key deriving EAP methods

src/charon/sa/authenticators/authenticator.h

@@ -127,6 +127,16 @@ struct authenticator_t {
 	 */
 	status_t (*build)(authenticator_t *this, message_t *message);
 
+	/**
+	 * Check if the authenticator is capable of mutual authentication.
+	 *
+	 * Some authenticator authenticate both peers, e.g. EAP. To support
+	 * mutual authentication with only a single authenticator (EAP-only
+	 * authentication), it must be mutual. This method is invoked in ike_auth
+	 * to check if the given authenticator is capable of doing so.
+	 */
+	bool (*is_mutual)(authenticator_t *this);
+
 	/**
 	 * Destroy authenticator instance.
 	 */

src/charon/sa/authenticators/eap_authenticator.c

@@ -72,6 +72,11 @@ struct private_eap_authenticator_t {
 	 */
 	bool eap_complete;
 
+	/**
+	 * Set if we require mutual EAP due EAP-only authentication
+	 */
+	bool require_mutual;
+
 	/**
 	 * authentication payload verified successfully
 	 */
@@ -526,6 +531,15 @@ static status_t process_client(private_eap_authenticator_t *this,
 		{
 			return FAILED;
 		}
+		if (this->require_mutual && !this->method->is_mutual(this->method))
+		{	/* we require mutual authentication due to EAP-only */
+			u_int32_t vendor;
+
+			DBG1(DBG_IKE, "EAP-only authentication requires a mutual and "
+				 "MSK deriving EAP method, but %N is not",
+				 eap_type_names, this->method->get_type(this->method, &vendor));
+			return FAILED;
+		}
 		return SUCCESS;
 	}
 
@@ -607,6 +621,16 @@ static status_t build_client(private_eap_authenticator_t *this,
 	return NEED_MORE;
 }
 
+/**
+ * Implementation of authenticator_t.is_mutual.
+ */
+static bool is_mutual(private_eap_authenticator_t *this)
+{
+	/* we don't know yet, but insist on it after EAP is complete */
+	this->require_mutual = TRUE;
+	return TRUE;
+}
+
 /**
  * Implementation of authenticator_t.destroy.
  */
@@ -630,6 +654,7 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
 
 	this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build_client;
 	this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_client;
+	this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))is_mutual;
 	this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
 
 	this->ike_sa = ike_sa;
@@ -643,6 +668,7 @@ eap_authenticator_t *eap_authenticator_create_builder(ike_sa_t *ike_sa,
 	this->eap_complete = FALSE;
 	this->auth_complete = FALSE;
 	this->eap_identity = NULL;
+	this->require_mutual = FALSE;
 
 	return &this->public;
 }
@@ -658,6 +684,7 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
 
 	this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))build_server;
 	this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process_server;
+	this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))is_mutual;
 	this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
 
 	this->ike_sa = ike_sa;
@@ -671,6 +698,7 @@ eap_authenticator_t *eap_authenticator_create_verifier(ike_sa_t *ike_sa,
 	this->eap_complete = FALSE;
 	this->auth_complete = FALSE;
 	this->eap_identity = NULL;
+	this->require_mutual = FALSE;
 
 	return &this->public;
 }

src/charon/sa/authenticators/psk_authenticator.c

@@ -169,6 +169,7 @@ psk_authenticator_t *psk_authenticator_create_builder(ike_sa_t *ike_sa,
 
 	this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
 	this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
+	this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
 	this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
 
 	this->ike_sa = ike_sa;
@@ -188,6 +189,7 @@ psk_authenticator_t *psk_authenticator_create_verifier(ike_sa_t *ike_sa,
 
 	this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *messageh))return_failed;
 	this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
+	this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
 	this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
 
 	this->ike_sa = ike_sa;

src/charon/sa/authenticators/pubkey_authenticator.c

@@ -234,6 +234,7 @@ pubkey_authenticator_t *pubkey_authenticator_create_builder(ike_sa_t *ike_sa,
 
 	this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))build;
 	this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))return_failed;
+	this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
 	this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
 
 	this->ike_sa = ike_sa;
@@ -253,6 +254,7 @@ pubkey_authenticator_t *pubkey_authenticator_create_verifier(ike_sa_t *ike_sa,
 
 	this->public.authenticator.build = (status_t(*)(authenticator_t*, message_t *message))return_failed;
 	this->public.authenticator.process = (status_t(*)(authenticator_t*, message_t *message))process;
+	this->public.authenticator.is_mutual = (bool(*)(authenticator_t*))return_false;
 	this->public.authenticator.destroy = (void(*)(authenticator_t*))destroy;
 
 	this->ike_sa = ike_sa;