- fixed encryption bug
[strongswan.git] / Source / charon / encoding / payloads / encryption_payload.c
1 /**
2 * @file encryption_payload.c
3 *
4 * @brief Implementation of encryption_payload_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 /* offsetof macro */
24 #include <stddef.h>
25
26 #include "encryption_payload.h"
27
28 #include <encoding/payloads/encodings.h>
29 #include <utils/allocator.h>
30 #include <utils/linked_list.h>
31 #include <encoding/generator.h>
32 #include <encoding/parser.h>
33 #include <utils/iterator.h>
34 #include <utils/randomizer.h>
35 #include <transforms/signers/signer.h>
36
37
38
39
40 typedef struct private_encryption_payload_t private_encryption_payload_t;
41
42 /**
43 * Private data of an encryption_payload_t' Object.
44 *
45 */
46 struct private_encryption_payload_t {
47 /**
48 * Public encryption_payload_t interface.
49 */
50 encryption_payload_t public;
51
52 /**
53 * There is no next payload for an encryption payload,
54 * since encryption payload MUST be the last one.
55 * next_payload means here the first payload of the
56 * contained, encrypted payload.
57 */
58 u_int8_t next_payload;
59
60 /**
61 * Critical flag.
62 */
63 bool critical;
64
65 /**
66 * Length of this payload
67 */
68 u_int16_t payload_length;
69
70 /**
71 * Chunk containing the iv, data, padding,
72 * and (an eventually not calculated) signature.
73 */
74 chunk_t encrypted;
75
76 /**
77 * Chunk containing the data in decrypted (unpadded) form.
78 */
79 chunk_t decrypted;
80
81 /**
82 * Signer set by set_signer.
83 */
84 signer_t *signer;
85
86 /**
87 * Crypter, supplied by encrypt/decrypt
88 */
89 crypter_t *crypter;
90
91 /**
92 * Contained payloads of this encrpytion_payload.
93 */
94 linked_list_t *payloads;
95
96 /**
97 * @brief Computes the length of this payload.
98 *
99 * @param this calling private_encryption_payload_t object
100 */
101 void (*compute_length) (private_encryption_payload_t *this);
102
103 /**
104 * @brief Generate payloads (unencrypted) in chunk decrypted.
105 *
106 * @param this calling private_encryption_payload_t object
107 */
108 void (*generate) (private_encryption_payload_t *this);
109 status_t (*parse) (private_encryption_payload_t *this);
110 };
111
112 /**
113 * Encoding rules to parse or generate a IKEv2-Encryption Payload.
114 *
115 * The defined offsets are the positions in a object of type
116 * private_encryption_payload_t.
117 *
118 */
119 encoding_rule_t encryption_payload_encodings[] = {
120 /* 1 Byte next payload type, stored in the field next_payload */
121 { U_INT_8, offsetof(private_encryption_payload_t, next_payload) },
122 /* the critical bit */
123 { FLAG, offsetof(private_encryption_payload_t, critical) },
124 /* 7 Bit reserved bits, nowhere stored */
125 { RESERVED_BIT, 0 },
126 { RESERVED_BIT, 0 },
127 { RESERVED_BIT, 0 },
128 { RESERVED_BIT, 0 },
129 { RESERVED_BIT, 0 },
130 { RESERVED_BIT, 0 },
131 { RESERVED_BIT, 0 },
132 /* Length of the whole encryption payload*/
133 { PAYLOAD_LENGTH, offsetof(private_encryption_payload_t, payload_length) },
134 /* encrypted data, stored in a chunk. contains iv, data, padding */
135 { ENCRYPTED_DATA, offsetof(private_encryption_payload_t, encrypted) },
136 };
137
138 /*
139 1 2 3
140 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
141 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
142 ! Next Payload !C! RESERVED ! Payload Length !
143 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
144 ! Initialization Vector !
145 ! (length is block size for encryption algorithm) !
146 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
147 ! Encrypted IKE Payloads !
148 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
149 ! ! Padding (0-255 octets) !
150 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
151 ! ! Pad Length !
152 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
153 ~ Integrity Checksum Data ~
154 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
155 */
156
157 /**
158 * Implementation of payload_t.verify.
159 */
160 static status_t verify(private_encryption_payload_t *this)
161 {
162 return SUCCESS;
163 }
164
165 /**
166 * Implementation of payload_t.destroy.
167 */
168 static void destroy(private_encryption_payload_t *this)
169 {
170 /* all proposals are getting destroyed */
171 while (this->payloads->get_count(this->payloads) > 0)
172 {
173 payload_t *current_payload;
174 this->payloads->remove_last(this->payloads,(void **)&current_payload);
175 current_payload->destroy(current_payload);
176 }
177 this->payloads->destroy(this->payloads);
178 allocator_free(this->encrypted.ptr);
179 allocator_free(this->decrypted.ptr);
180 allocator_free(this);
181 }
182
183 /**
184 * Implementation of payload_t.get_encoding_rules.
185 */
186 static void get_encoding_rules(private_encryption_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
187 {
188 *rules = encryption_payload_encodings;
189 *rule_count = sizeof(encryption_payload_encodings) / sizeof(encoding_rule_t);
190 }
191
192 /**
193 * Implementation of payload_t.get_type.
194 */
195 static payload_type_t get_type(private_encryption_payload_t *this)
196 {
197 return ENCRYPTED;
198 }
199
200 /**
201 * Implementation of payload_t.get_next_type.
202 */
203 static payload_type_t get_next_type(private_encryption_payload_t *this)
204 {
205 /* returns first contained payload here */
206 return (this->next_payload);
207 }
208
209 /**
210 * Implementation of payload_t.set_next_type.
211 */
212 static void set_next_type(private_encryption_payload_t *this, payload_type_t type)
213 {
214 /* set next type is not allowed, since this payload MUST be the last one
215 * and so nothing is done in here*/
216 }
217
218 /**
219 * Implementation of payload_t.get_length.
220 */
221 static size_t get_length(private_encryption_payload_t *this)
222 {
223 this->compute_length(this);
224 return this->payload_length;
225 }
226
227 /**
228 * Implementation of payload_t.create_payload_iterator.
229 */
230 static iterator_t *create_payload_iterator (private_encryption_payload_t *this, bool forward)
231 {
232 return (this->payloads->create_iterator(this->payloads, forward));
233 }
234
235 /**
236 * Implementation of payload_t.add_payload.
237 */
238 static void add_payload(private_encryption_payload_t *this, payload_t *payload)
239 {
240 payload_t *last_payload;
241 if (this->payloads->get_count(this->payloads) > 0)
242 {
243 this->payloads->get_last(this->payloads,(void **) &last_payload);
244 last_payload->set_next_type(last_payload, payload->get_type(payload));
245 }
246 else
247 {
248 this->next_payload = payload->get_type(payload);
249 }
250 payload->set_next_type(payload, NO_PAYLOAD);
251 this->payloads->insert_last(this->payloads, (void*)payload);
252 this->compute_length(this);
253 }
254
255 /**
256 * Implementation of encryption_payload_t.encrypt.
257 */
258 static status_t encrypt(private_encryption_payload_t *this)
259 {
260 chunk_t iv, padding, to_crypt, result;
261 randomizer_t *randomizer;
262 status_t status;
263 size_t block_size;
264
265 if (this->signer == NULL || this->crypter == NULL)
266 {
267 return INVALID_STATE;
268 }
269
270 /* for random data in iv and padding */
271 randomizer = randomizer_create();
272
273 /* build payload chunk */
274 this->generate(this);
275
276 /* build padding */
277 block_size = this->crypter->get_block_size(this->crypter);
278 padding.len = block_size - ((this->decrypted.len + 1) % block_size);
279 randomizer->allocate_pseudo_random_bytes(randomizer, padding.len, &padding);
280
281 /* concatenate payload data, padding, padding len */
282 to_crypt.len = this->decrypted.len + padding.len + 1;
283 to_crypt.ptr = allocator_alloc(to_crypt.len);
284
285 memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
286 memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
287 *(to_crypt.ptr + to_crypt.len - 1) = padding.len;
288
289 /* build iv */
290 iv.len = block_size;
291 randomizer->allocate_pseudo_random_bytes(randomizer, iv.len, &iv);
292 randomizer->destroy(randomizer);
293
294 /* encrypt to_crypt chunk */
295 allocator_free(this->encrypted.ptr);
296 status = this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
297 allocator_free(padding.ptr);
298 allocator_free(to_crypt.ptr);
299 if (status != SUCCESS)
300 {
301 allocator_free(iv.ptr);
302 return status;
303 }
304
305 /* build encrypted result with iv and signature */
306 this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
307 allocator_free(this->encrypted.ptr);
308 this->encrypted.ptr = allocator_alloc(this->encrypted.len);
309
310 /* fill in result, signature is left out */
311 memcpy(this->encrypted.ptr, iv.ptr, iv.len);
312 memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
313
314 allocator_free(result.ptr);
315 allocator_free(iv.ptr);
316 return SUCCESS;
317 }
318
319 /**
320 * Implementation of encryption_payload_t.encrypt.
321 */
322 static status_t decrypt(private_encryption_payload_t *this)
323 {
324 chunk_t iv, concatenated;
325 u_int8_t padding_length;
326 status_t status;
327
328 if (this->signer == NULL || this->crypter == NULL)
329 {
330 return INVALID_STATE;
331 }
332
333 /* get IV */
334 iv.len = this->crypter->get_block_size(this->crypter);
335 iv.ptr = this->encrypted.ptr;
336
337 /* point concatenated to data + padding + padding_length*/
338 concatenated.ptr = this->encrypted.ptr + iv.len;
339 concatenated.len = this->encrypted.len - iv.len - this->signer->get_block_size(this->signer);
340
341 /* check the size of input:
342 * concatenated must be at least on block_size of crypter
343 */
344 if (concatenated.len < iv.len)
345 {
346 return FAILED;
347 }
348
349 /* free previus data, if any */
350 allocator_free(this->decrypted.ptr);
351
352 status = this->crypter->decrypt(this->crypter, concatenated, iv, &(this->decrypted));
353 if (status != SUCCESS)
354 {
355 return FAILED;
356 }
357
358 /* get padding length, sits just bevore signature */
359 padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
360 /* add one byte to the padding length, since the padding_length field is not included */
361 padding_length++;
362 this->decrypted.len -= padding_length;
363
364 /* check size again */
365 if (padding_length > concatenated.len || this->decrypted.len < 0)
366 {
367 /* decryption failed :-/ */
368 return FAILED;
369 }
370
371 /* free padding */
372 this->decrypted.ptr = allocator_realloc(this->decrypted.ptr, this->decrypted.len);
373
374 this->parse(this);
375
376 return SUCCESS;
377 }
378
379 /**
380 * Implementation of encryption_payload_t.set_transforms.
381 */
382 static void set_transforms(private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer)
383 {
384 this->signer = signer;
385 this->crypter = crypter;
386 }
387
388 /**
389 * Implementation of encryption_payload_t.build_signature.
390 */
391 static status_t build_signature(private_encryption_payload_t *this, chunk_t data)
392 {
393 chunk_t data_without_sig = data;
394 chunk_t sig;
395
396 if (this->signer == NULL)
397 {
398 return INVALID_STATE;
399 }
400
401 sig.len = this->signer->get_block_size(this->signer);
402 data_without_sig.len -= sig.len;
403 sig.ptr = data.ptr + data_without_sig.len;
404 this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
405 return SUCCESS;
406 }
407
408 /**
409 * Implementation of encryption_payload_t.verify_signature.
410 */
411 static status_t verify_signature(private_encryption_payload_t *this, chunk_t data)
412 {
413 chunk_t sig, data_without_sig;
414 bool valid;
415
416 if (this->signer == NULL)
417 {
418 return INVALID_STATE;
419 }
420 /* find signature in data chunk */
421 sig.len = this->signer->get_block_size(this->signer);
422 if (data.len <= sig.len)
423 {
424 return FAILED;
425 }
426 sig.ptr = data.ptr + data.len - sig.len;
427
428 /* verify it */
429 data_without_sig.len = data.len - sig.len;
430 data_without_sig.ptr = data.ptr;
431 this->signer->verify_signature(this->signer, data_without_sig, sig, &valid);
432
433 if (!valid)
434 {
435 return FAILED;
436 }
437
438 return SUCCESS;
439 }
440
441 /**
442 * Implementation of private_encryption_payload_t.generate.
443 */
444 static void generate(private_encryption_payload_t *this)
445 {
446 payload_t *current_payload, *next_payload;
447 generator_t *generator;
448 iterator_t *iterator;
449
450 /* recalculate length before generating */
451 this->compute_length(this);
452
453 /* create iterator */
454 iterator = this->payloads->create_iterator(this->payloads, TRUE);
455
456 /* get first payload */
457 if (iterator->has_next(iterator))
458 {
459 iterator->current(iterator, (void**)&current_payload);
460 this->next_payload = current_payload->get_type(current_payload);
461 }
462 else
463 {
464 /* no paylads? */
465 allocator_free(this->decrypted.ptr);
466 this->decrypted = CHUNK_INITIALIZER;
467 iterator->destroy(iterator);
468 return;
469 }
470
471 generator = generator_create();
472
473 /* build all payload, except last */
474 while(iterator->has_next(iterator))
475 {
476 iterator->current(iterator, (void**)&next_payload);
477 current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
478 generator->generate_payload(generator, current_payload);
479 current_payload = next_payload;
480 }
481 iterator->destroy(iterator);
482
483 /* build last payload */
484 current_payload->set_next_type(current_payload, NO_PAYLOAD);
485 generator->generate_payload(generator, current_payload);
486
487 /* free already generated data */
488 allocator_free(this->decrypted.ptr);
489
490 generator->write_to_chunk(generator, &(this->decrypted));
491 generator->destroy(generator);
492 }
493
494 /**
495 * Implementation of private_encryption_payload_t.parse.
496 */
497 static status_t parse(private_encryption_payload_t *this)
498 {
499 parser_t *parser;
500 status_t status;
501 payload_type_t current_payload_type;
502
503 /* check if there is decrypted data */
504 if (this->decrypted.ptr == NULL)
505 {
506 return INVALID_STATE;
507 }
508
509 /* build a parser on the decrypted data */
510 parser = parser_create(this->decrypted);
511
512 current_payload_type = this->next_payload;
513 /* parse all payloads */
514 while (current_payload_type != NO_PAYLOAD)
515 {
516 payload_t *current_payload;
517
518 status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
519 if (status != SUCCESS)
520 {
521 parser->destroy(parser);
522 return PARSE_ERROR;
523 }
524
525 status = current_payload->verify(current_payload);
526 if (status != SUCCESS)
527 {
528 parser->destroy(parser);
529 return VERIFY_ERROR;
530 }
531
532 /* get next payload type */
533 current_payload_type = current_payload->get_next_type(current_payload);
534
535 this->payloads->insert_last(this->payloads,current_payload);
536 }
537 parser->destroy(parser);
538 return SUCCESS;
539 }
540
541 /**
542 * Implementation of private_encryption_payload_t.compute_length.
543 */
544 static void compute_length(private_encryption_payload_t *this)
545 {
546 iterator_t *iterator;
547 size_t block_size, length = 0;
548 iterator = this->payloads->create_iterator(this->payloads, TRUE);
549
550 /* count payload length */
551 while (iterator->has_next(iterator))
552 {
553 payload_t *current_payload;
554 iterator->current(iterator, (void **) &current_payload);
555 length += current_payload->get_length(current_payload);
556 }
557 iterator->destroy(iterator);
558
559 if (this->crypter && this->signer)
560 {
561 /* append one byte for padding length */
562 length++;
563 /* append padding */
564 block_size = this->crypter->get_block_size(this->crypter);
565 length += block_size - length % block_size;
566 /* add iv */
567 length += block_size;
568 /* add signature */
569 length += this->signer->get_block_size(this->signer);
570 }
571 length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
572 this->payload_length = length;
573 }
574
575 /*
576 * Described in header
577 */
578 encryption_payload_t *encryption_payload_create()
579 {
580 private_encryption_payload_t *this = allocator_alloc_thing(private_encryption_payload_t);
581
582 /* payload_t interface functions */
583 this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
584 this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
585 this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
586 this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
587 this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
588 this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
589 this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
590
591 /* public functions */
592 this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator;
593 this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload;
594 this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt;
595 this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt;
596 this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms;
597 this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature;
598 this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
599 this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
600
601 /* private functions */
602 this->compute_length = compute_length;
603 this->generate = generate;
604 this->parse = parse;
605
606 /* set default values of the fields */
607 this->critical = TRUE;
608 this->next_payload = NO_PAYLOAD;
609 this->payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH;
610 this->encrypted = CHUNK_INITIALIZER;
611 this->decrypted = CHUNK_INITIALIZER;
612 this->signer = NULL;
613 this->crypter = NULL;
614 this->payloads = linked_list_create();
615
616 return (&(this->public));
617 }
618
619