4acfa61cfe57f3bd9f3dea59b925369f7d10dea4
[strongswan.git] / Source / charon / encoding / payloads / encryption_payload.c
1 /**
2 * @file encryption_payload.c
3 *
4 * @brief Implementation of encryption_payload_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 /* offsetof macro */
24 #include <stddef.h>
25
26 #include "encryption_payload.h"
27
28 #include <encoding/payloads/encodings.h>
29 #include <utils/allocator.h>
30 #include <utils/linked_list.h>
31 #include <encoding/generator.h>
32 #include <encoding/parser.h>
33 #include <utils/iterator.h>
34 #include <utils/randomizer.h>
35 #include <transforms/signers/signer.h>
36
37
38
39
40 typedef struct private_encryption_payload_t private_encryption_payload_t;
41
42 /**
43 * Private data of an encryption_payload_t' Object.
44 *
45 */
46 struct private_encryption_payload_t {
47 /**
48 * Public encryption_payload_t interface.
49 */
50 encryption_payload_t public;
51
52 /**
53 * There is no next payload for an encryption payload,
54 * since encryption payload MUST be the last one.
55 * next_payload means here the first payload of the
56 * contained, encrypted payload.
57 */
58 u_int8_t next_payload;
59
60 /**
61 * Critical flag.
62 */
63 bool critical;
64
65 /**
66 * Length of this payload
67 */
68 u_int16_t payload_length;
69
70 /**
71 * Chunk containing the iv, data, padding,
72 * and (an eventually not calculated) signature.
73 */
74 chunk_t encrypted;
75
76 /**
77 * Chunk containing the data in decrypted (unpadded) form.
78 */
79 chunk_t decrypted;
80
81 /**
82 * Signer set by set_signer.
83 */
84 signer_t *signer;
85
86 /**
87 * Crypter, supplied by encrypt/decrypt
88 */
89 crypter_t *crypter;
90
91 /**
92 * Contained payloads of this encrpytion_payload.
93 */
94 linked_list_t *payloads;
95
96 /**
97 * @brief Computes the length of this payload.
98 *
99 * @param this calling private_encryption_payload_t object
100 */
101 void (*compute_length) (private_encryption_payload_t *this);
102
103 /**
104 * @brief Generate payloads (unencrypted) in chunk decrypted.
105 *
106 * @param this calling private_encryption_payload_t object
107 */
108 void (*generate) (private_encryption_payload_t *this);
109 status_t (*parse) (private_encryption_payload_t *this);
110 };
111
112 /**
113 * Encoding rules to parse or generate a IKEv2-Encryption Payload.
114 *
115 * The defined offsets are the positions in a object of type
116 * private_encryption_payload_t.
117 *
118 */
119 encoding_rule_t encryption_payload_encodings[] = {
120 /* 1 Byte next payload type, stored in the field next_payload */
121 { U_INT_8, offsetof(private_encryption_payload_t, next_payload) },
122 /* the critical bit */
123 { FLAG, offsetof(private_encryption_payload_t, critical) },
124 /* 7 Bit reserved bits, nowhere stored */
125 { RESERVED_BIT, 0 },
126 { RESERVED_BIT, 0 },
127 { RESERVED_BIT, 0 },
128 { RESERVED_BIT, 0 },
129 { RESERVED_BIT, 0 },
130 { RESERVED_BIT, 0 },
131 { RESERVED_BIT, 0 },
132 /* Length of the whole encryption payload*/
133 { PAYLOAD_LENGTH, offsetof(private_encryption_payload_t, payload_length) },
134 /* encrypted data, stored in a chunk. contains iv, data, padding */
135 { ENCRYPTED_DATA, offsetof(private_encryption_payload_t, encrypted) },
136 };
137
138 /*
139 1 2 3
140 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
141 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
142 ! Next Payload !C! RESERVED ! Payload Length !
143 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
144 ! Initialization Vector !
145 ! (length is block size for encryption algorithm) !
146 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
147 ! Encrypted IKE Payloads !
148 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
149 ! ! Padding (0-255 octets) !
150 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
151 ! ! Pad Length !
152 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
153 ~ Integrity Checksum Data ~
154 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
155 */
156
157 /**
158 * Implementation of payload_t.verify.
159 */
160 static status_t verify(private_encryption_payload_t *this)
161 {
162 // int proposal_number = 1;
163 status_t status;
164 // iterator_t *iterator;
165 // bool first = TRUE;
166 //
167 // if (this->critical)
168 // {
169 // /* critical bit set! */
170 // return FAILED;
171 // }
172 //
173 // /* check proposal numbering */
174 // status = this->proposals->create_iterator(this->proposals,&iterator,TRUE);
175 // if (status != SUCCESS)
176 // {
177 // return status;
178 // }
179 //
180 // while(iterator->has_next(iterator))
181 // {
182 // proposal_substructure_t *current_proposal;
183 // status = iterator->current(iterator,(void **)&current_proposal);
184 // {
185 // break;
186 // }
187 // if (current_proposal->get_proposal_number(current_proposal) > proposal_number)
188 // {
189 // if (first)
190 // {
191 // /* first number must be 1 */
192 // status = FAILED;
193 // break;
194 // }
195 //
196 // if (current_proposal->get_proposal_number(current_proposal) != (proposal_number + 1))
197 // {
198 // /* must be only one more then previous proposal */
199 // status = FAILED;
200 // break;
201 // }
202 // }
203 // else if (current_proposal->get_proposal_number(current_proposal) < proposal_number)
204 // {
205 // iterator->destroy(iterator);
206 // /* must not be smaller then proceeding one */
207 // status = FAILED;
208 // break;
209 // }
210 // first = FALSE;
211 // }
212 //
213 // iterator->destroy(iterator);
214 return status;
215 }
216
217 /**
218 * Implementation of payload_t.destroy.
219 */
220 static void destroy(private_encryption_payload_t *this)
221 {
222 /* all proposals are getting destroyed */
223 while (this->payloads->get_count(this->payloads) > 0)
224 {
225 payload_t *current_payload;
226 this->payloads->remove_last(this->payloads,(void **)&current_payload);
227 current_payload->destroy(current_payload);
228 }
229 this->payloads->destroy(this->payloads);
230 allocator_free(this->encrypted.ptr);
231 allocator_free(this->decrypted.ptr);
232 allocator_free(this);
233 }
234
235 /**
236 * Implementation of payload_t.get_encoding_rules.
237 */
238 static void get_encoding_rules(private_encryption_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
239 {
240 *rules = encryption_payload_encodings;
241 *rule_count = sizeof(encryption_payload_encodings) / sizeof(encoding_rule_t);
242 }
243
244 /**
245 * Implementation of payload_t.get_type.
246 */
247 static payload_type_t get_type(private_encryption_payload_t *this)
248 {
249 return ENCRYPTED;
250 }
251
252 /**
253 * Implementation of payload_t.get_next_type.
254 */
255 static payload_type_t get_next_type(private_encryption_payload_t *this)
256 {
257 /* returns first contained payload here */
258 return (this->next_payload);
259 }
260
261 /**
262 * Implementation of payload_t.set_next_type.
263 */
264 static void set_next_type(private_encryption_payload_t *this, payload_type_t type)
265 {
266 /* set next type is not allowed, since this payload MUST be the last one
267 * and so nothing is done in here*/
268 }
269
270 /**
271 * Implementation of payload_t.get_length.
272 */
273 static size_t get_length(private_encryption_payload_t *this)
274 {
275 this->compute_length(this);
276 return this->payload_length;
277 }
278
279 /**
280 * Implementation of payload_t.create_payload_iterator.
281 */
282 static iterator_t *create_payload_iterator (private_encryption_payload_t *this, bool forward)
283 {
284 return (this->payloads->create_iterator(this->payloads, forward));
285 }
286
287 /**
288 * Implementation of payload_t.add_payload.
289 */
290 static void add_payload(private_encryption_payload_t *this, payload_t *payload)
291 {
292 payload_t *last_payload;
293 if (this->payloads->get_count(this->payloads) > 0)
294 {
295 this->payloads->get_last(this->payloads,(void **) &last_payload);
296 last_payload->set_next_type(last_payload, payload->get_type(payload));
297 }
298 else
299 {
300 this->next_payload = payload->get_type(payload);
301 }
302 payload->set_next_type(payload, NO_PAYLOAD);
303 this->payloads->insert_last(this->payloads, (void*)payload);
304 this->compute_length(this);
305 }
306
307 /**
308 * Implementation of encryption_payload_t.encrypt.
309 */
310 static status_t encrypt(private_encryption_payload_t *this)
311 {
312 chunk_t iv, padding, to_crypt, result;
313 randomizer_t *randomizer;
314 status_t status;
315 size_t block_size;
316
317 if (this->signer == NULL || this->crypter == NULL)
318 {
319 return INVALID_STATE;
320 }
321
322 /* for random data in iv and padding */
323 randomizer = randomizer_create();
324
325 /* build payload chunk */
326 this->generate(this);
327
328 /* build padding */
329 block_size = this->crypter->get_block_size(this->crypter);
330 padding.len = block_size - ((this->decrypted.len + 1) % block_size);
331 randomizer->allocate_pseudo_random_bytes(randomizer, padding.len, &padding);
332
333 /* concatenate payload data, padding, padding len */
334 to_crypt.len = this->decrypted.len + padding.len + 1;
335 to_crypt.ptr = allocator_alloc(to_crypt.len);
336
337 memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
338 memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
339 *(to_crypt.ptr + to_crypt.len - 1) = padding.len;
340
341 /* build iv */
342 iv.len = block_size;
343 randomizer->allocate_pseudo_random_bytes(randomizer, iv.len, &iv);
344 randomizer->destroy(randomizer);
345
346 /* encrypt to_crypt chunk */
347 allocator_free(this->encrypted.ptr);
348 status = this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
349 allocator_free(padding.ptr);
350 allocator_free(to_crypt.ptr);
351 if (status != SUCCESS)
352 {
353 allocator_free(iv.ptr);
354 return status;
355 }
356
357 /* build encrypted result with iv and signature */
358 this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
359 allocator_free(this->encrypted.ptr);
360 this->encrypted.ptr = allocator_alloc(this->encrypted.len);
361
362 /* fill in result, signature is left out */
363 memcpy(this->encrypted.ptr, iv.ptr, iv.len);
364 memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
365
366 allocator_free(result.ptr);
367 allocator_free(iv.ptr);
368 return SUCCESS;
369 }
370
371 /**
372 * Implementation of encryption_payload_t.encrypt.
373 */
374 static status_t decrypt(private_encryption_payload_t *this)
375 {
376 chunk_t iv, concatenated;
377 u_int8_t padding_length;
378 status_t status;
379
380 if (this->signer == NULL || this->crypter == NULL)
381 {
382 return INVALID_STATE;
383 }
384
385 /* get IV */
386 iv.len = this->crypter->get_block_size(this->crypter);
387 iv.ptr = this->encrypted.ptr;
388
389 /* point concatenated to data + padding + padding_length*/
390 concatenated.ptr = this->encrypted.ptr + iv.len;
391 concatenated.len = this->encrypted.len - iv.len - this->signer->get_block_size(this->signer);
392
393 /* check the size of input:
394 * concatenated must be at least on block_size of crypter
395 */
396 if (concatenated.len < iv.len)
397 {
398 return FAILED;
399 }
400
401 /* free previus data, if any */
402 allocator_free(this->decrypted.ptr);
403
404 status = this->crypter->decrypt(this->crypter, concatenated, iv, &(this->decrypted));
405 if (status != SUCCESS)
406 {
407 return FAILED;
408 }
409
410 /* get padding length, sits just bevore signature */
411 padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
412 /* add one byte to the padding length, since the padding_length field is not included */
413 padding_length++;
414 this->decrypted.len -= padding_length;
415
416 /* check size again */
417 if (padding_length > concatenated.len || this->decrypted.len < 0)
418 {
419 /* decryption failed :-/ */
420 return FAILED;
421 }
422
423 /* free padding */
424 this->decrypted.ptr = allocator_realloc(this->decrypted.ptr, this->decrypted.len);
425
426 this->parse(this);
427
428 return SUCCESS;
429 }
430
431 /**
432 * Implementation of encryption_payload_t.set_transforms.
433 */
434 static void set_transforms(private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer)
435 {
436 this->signer = signer;
437 this->crypter = crypter;
438 }
439
440 /**
441 * Implementation of encryption_payload_t.build_signature.
442 */
443 static status_t build_signature(private_encryption_payload_t *this, chunk_t data)
444 {
445 chunk_t data_without_sig = data;
446 chunk_t sig;
447
448 if (this->signer == NULL)
449 {
450 return INVALID_STATE;
451 }
452
453 sig.len = this->signer->get_block_size(this->signer);
454 data_without_sig.len -= sig.len;
455 sig.ptr = data.ptr + data_without_sig.len;
456 this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
457 return SUCCESS;
458 }
459
460 /**
461 * Implementation of encryption_payload_t.verify_signature.
462 */
463 static status_t verify_signature(private_encryption_payload_t *this, chunk_t data)
464 {
465 chunk_t sig, data_without_sig;
466 bool valid;
467
468 if (this->signer == NULL)
469 {
470 return INVALID_STATE;
471 }
472 /* find signature in data chunk */
473 sig.len = this->signer->get_block_size(this->signer);
474 if (data.len <= sig.len)
475 {
476 return FAILED;
477 }
478 sig.ptr = data.ptr + data.len - sig.len;
479
480 /* verify it */
481 data_without_sig.len = data.len - sig.len;
482 data_without_sig.ptr = data.ptr;
483 this->signer->verify_signature(this->signer, data_without_sig, sig, &valid);
484
485 if (!valid)
486 {
487 return FAILED;
488 }
489
490 return SUCCESS;
491 }
492
493 /**
494 * Implementation of private_encryption_payload_t.generate.
495 */
496 static void generate(private_encryption_payload_t *this)
497 {
498 payload_t *current_payload, *next_payload;
499 generator_t *generator;
500 iterator_t *iterator;
501
502 /* recalculate length before generating */
503 this->compute_length(this);
504
505 /* create iterator */
506 iterator = this->payloads->create_iterator(this->payloads, TRUE);
507
508 /* get first payload */
509 if (iterator->has_next(iterator))
510 {
511 iterator->current(iterator, (void**)&current_payload);
512 this->next_payload = current_payload->get_type(current_payload);
513 }
514 else
515 {
516 /* no paylads? */
517 allocator_free(this->decrypted.ptr);
518 this->decrypted = CHUNK_INITIALIZER;
519 iterator->destroy(iterator);
520 return;
521 }
522
523 generator = generator_create();
524
525 /* build all payload, except last */
526 while(iterator->has_next(iterator))
527 {
528 iterator->current(iterator, (void**)&next_payload);
529 current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
530 generator->generate_payload(generator, current_payload);
531 current_payload = next_payload;
532 }
533 iterator->destroy(iterator);
534
535 /* build last payload */
536 current_payload->set_next_type(current_payload, NO_PAYLOAD);
537 generator->generate_payload(generator, current_payload);
538
539 /* free already generated data */
540 allocator_free(this->decrypted.ptr);
541
542 generator->write_to_chunk(generator, &(this->decrypted));
543 generator->destroy(generator);
544 }
545
546 /**
547 * Implementation of private_encryption_payload_t.parse.
548 */
549 static status_t parse(private_encryption_payload_t *this)
550 {
551 parser_t *parser;
552 status_t status;
553 payload_type_t current_payload_type;
554
555 /* check if there is decrypted data */
556 if (this->decrypted.ptr == NULL)
557 {
558 return INVALID_STATE;
559 }
560
561 /* build a parser on the decrypted data */
562 parser = parser_create(this->decrypted);
563
564 current_payload_type = this->next_payload;
565 /* parse all payloads */
566 while (current_payload_type != NO_PAYLOAD)
567 {
568 payload_t *current_payload;
569
570 status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
571 if (status != SUCCESS)
572 {
573 parser->destroy(parser);
574 return PARSE_ERROR;
575 }
576
577 status = current_payload->verify(current_payload);
578 if (status != SUCCESS)
579 {
580 parser->destroy(parser);
581 return VERIFY_ERROR;
582 }
583
584 /* get next payload type */
585 current_payload_type = current_payload->get_next_type(current_payload);
586
587 this->payloads->insert_last(this->payloads,current_payload);
588 }
589 parser->destroy(parser);
590 return SUCCESS;
591 }
592
593 /**
594 * Implementation of private_encryption_payload_t.compute_length.
595 */
596 static void compute_length(private_encryption_payload_t *this)
597 {
598 iterator_t *iterator;
599 size_t block_size, length = 0;
600 iterator = this->payloads->create_iterator(this->payloads, TRUE);
601
602 /* count payload length */
603 while (iterator->has_next(iterator))
604 {
605 payload_t *current_payload;
606 iterator->current(iterator, (void **) &current_payload);
607 length += current_payload->get_length(current_payload);
608 }
609 iterator->destroy(iterator);
610
611 if (this->crypter && this->signer)
612 {
613 /* append one byte for padding length */
614 length++;
615 /* append padding */
616 block_size = this->crypter->get_block_size(this->crypter);
617 length += block_size - length % block_size;
618 /* add iv */
619 length += block_size;
620 /* add signature */
621 length += this->signer->get_block_size(this->signer);
622 }
623 length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
624 this->payload_length = length;
625 }
626
627 /*
628 * Described in header
629 */
630 encryption_payload_t *encryption_payload_create()
631 {
632 private_encryption_payload_t *this = allocator_alloc_thing(private_encryption_payload_t);
633
634 /* payload_t interface functions */
635 this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
636 this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
637 this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
638 this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
639 this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
640 this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
641 this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
642
643 /* public functions */
644 this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator;
645 this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload;
646 this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt;
647 this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt;
648 this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms;
649 this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature;
650 this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
651 this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
652
653 /* private functions */
654 this->compute_length = compute_length;
655 this->generate = generate;
656 this->parse = parse;
657
658 /* set default values of the fields */
659 this->critical = TRUE;
660 this->next_payload = NO_PAYLOAD;
661 this->payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH;
662 this->encrypted = CHUNK_INITIALIZER;
663 this->decrypted = CHUNK_INITIALIZER;
664 this->signer = NULL;
665 this->crypter = NULL;
666 this->payloads = linked_list_create();
667
668 return (&(this->public));
669 }
670
671