- fixed message decryption
[strongswan.git] / Source / charon / encoding / payloads / encryption_payload.c
1 /**
2 * @file encryption_payload.c
3 *
4 * @brief Implementation of encryption_payload_t.
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 /* offsetof macro */
24 #include <stddef.h>
25
26 #include "encryption_payload.h"
27
28 #include <encoding/payloads/encodings.h>
29 #include <utils/allocator.h>
30 #include <utils/linked_list.h>
31 #include <encoding/generator.h>
32 #include <encoding/parser.h>
33 #include <utils/iterator.h>
34 #include <utils/randomizer.h>
35 #include <transforms/signers/signer.h>
36
37
38
39
40 typedef struct private_encryption_payload_t private_encryption_payload_t;
41
42 /**
43 * Private data of an encryption_payload_t' Object.
44 *
45 */
46 struct private_encryption_payload_t {
47 /**
48 * Public encryption_payload_t interface.
49 */
50 encryption_payload_t public;
51
52 /**
53 * There is no next payload for an encryption payload,
54 * since encryption payload MUST be the last one.
55 * next_payload means here the first payload of the
56 * contained, encrypted payload.
57 */
58 u_int8_t next_payload;
59
60 /**
61 * Critical flag.
62 */
63 bool critical;
64
65 /**
66 * Length of this payload
67 */
68 u_int16_t payload_length;
69
70 /**
71 * Chunk containing the iv, data, padding,
72 * and (an eventually not calculated) signature.
73 */
74 chunk_t encrypted;
75
76 /**
77 * Chunk containing the data in decrypted (unpadded) form.
78 */
79 chunk_t decrypted;
80
81 /**
82 * Signer set by set_signer.
83 */
84 signer_t *signer;
85
86 /**
87 * Crypter, supplied by encrypt/decrypt
88 */
89 crypter_t *crypter;
90
91 /**
92 * Contained payloads of this encrpytion_payload.
93 */
94 linked_list_t *payloads;
95
96 /**
97 * @brief Computes the length of this payload.
98 *
99 * @param this calling private_encryption_payload_t object
100 */
101 void (*compute_length) (private_encryption_payload_t *this);
102
103 /**
104 * @brief Generate payloads (unencrypted) in chunk decrypted.
105 *
106 * @param this calling private_encryption_payload_t object
107 */
108 void (*generate) (private_encryption_payload_t *this);
109 status_t (*parse) (private_encryption_payload_t *this);
110 };
111
112 /**
113 * Encoding rules to parse or generate a IKEv2-Encryption Payload.
114 *
115 * The defined offsets are the positions in a object of type
116 * private_encryption_payload_t.
117 *
118 */
119 encoding_rule_t encryption_payload_encodings[] = {
120 /* 1 Byte next payload type, stored in the field next_payload */
121 { U_INT_8, offsetof(private_encryption_payload_t, next_payload) },
122 /* the critical bit */
123 { FLAG, offsetof(private_encryption_payload_t, critical) },
124 /* 7 Bit reserved bits, nowhere stored */
125 { RESERVED_BIT, 0 },
126 { RESERVED_BIT, 0 },
127 { RESERVED_BIT, 0 },
128 { RESERVED_BIT, 0 },
129 { RESERVED_BIT, 0 },
130 { RESERVED_BIT, 0 },
131 { RESERVED_BIT, 0 },
132 /* Length of the whole encryption payload*/
133 { PAYLOAD_LENGTH, offsetof(private_encryption_payload_t, payload_length) },
134 /* encrypted data, stored in a chunk. contains iv, data, padding */
135 { ENCRYPTED_DATA, offsetof(private_encryption_payload_t, encrypted) },
136 };
137
138 /*
139 1 2 3
140 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
141 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
142 ! Next Payload !C! RESERVED ! Payload Length !
143 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
144 ! Initialization Vector !
145 ! (length is block size for encryption algorithm) !
146 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
147 ! Encrypted IKE Payloads !
148 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
149 ! ! Padding (0-255 octets) !
150 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
151 ! ! Pad Length !
152 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
153 ~ Integrity Checksum Data ~
154 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
155 */
156
157 /**
158 * Implementation of payload_t.verify.
159 */
160 static status_t verify(private_encryption_payload_t *this)
161 {
162 return SUCCESS;
163 }
164
165 /**
166 * Implementation of payload_t.destroy.
167 */
168 static void destroy(private_encryption_payload_t *this)
169 {
170 /* all proposals are getting destroyed */
171 while (this->payloads->get_count(this->payloads) > 0)
172 {
173 payload_t *current_payload;
174 this->payloads->remove_last(this->payloads,(void **)&current_payload);
175 current_payload->destroy(current_payload);
176 }
177 this->payloads->destroy(this->payloads);
178 allocator_free(this->encrypted.ptr);
179 allocator_free(this->decrypted.ptr);
180 allocator_free(this);
181 }
182
183 /**
184 * Implementation of payload_t.get_encoding_rules.
185 */
186 static void get_encoding_rules(private_encryption_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
187 {
188 *rules = encryption_payload_encodings;
189 *rule_count = sizeof(encryption_payload_encodings) / sizeof(encoding_rule_t);
190 }
191
192 /**
193 * Implementation of payload_t.get_type.
194 */
195 static payload_type_t get_type(private_encryption_payload_t *this)
196 {
197 return ENCRYPTED;
198 }
199
200 /**
201 * Implementation of payload_t.get_next_type.
202 */
203 static payload_type_t get_next_type(private_encryption_payload_t *this)
204 {
205 /* returns first contained payload here */
206 return (this->next_payload);
207 }
208
209 /**
210 * Implementation of payload_t.set_next_type.
211 */
212 static void set_next_type(private_encryption_payload_t *this, payload_type_t type)
213 {
214 /* set next type is not allowed, since this payload MUST be the last one
215 * and so nothing is done in here*/
216 }
217
218 /**
219 * Implementation of payload_t.get_length.
220 */
221 static size_t get_length(private_encryption_payload_t *this)
222 {
223 this->compute_length(this);
224 return this->payload_length;
225 }
226
227 /**
228 * Implementation of payload_t.create_payload_iterator.
229 */
230 static iterator_t *create_payload_iterator (private_encryption_payload_t *this, bool forward)
231 {
232 return (this->payloads->create_iterator(this->payloads, forward));
233 }
234
235 /**
236 * Implementation of payload_t.add_payload.
237 */
238 static void add_payload(private_encryption_payload_t *this, payload_t *payload)
239 {
240 payload_t *last_payload;
241 if (this->payloads->get_count(this->payloads) > 0)
242 {
243 this->payloads->get_last(this->payloads,(void **) &last_payload);
244 last_payload->set_next_type(last_payload, payload->get_type(payload));
245 }
246 else
247 {
248 this->next_payload = payload->get_type(payload);
249 }
250 payload->set_next_type(payload, NO_PAYLOAD);
251 this->payloads->insert_last(this->payloads, (void*)payload);
252 this->compute_length(this);
253 }
254
255 /**
256 * Implementation of encryption_payload_t.remove_first_payload.
257 */
258 static status_t remove_first_payload(private_encryption_payload_t *this, payload_t **payload)
259 {
260 return this->payloads->remove_first(this->payloads, (void**)payload);
261 }
262
263 /**
264 * Implementation of encryption_payload_t.get_payload_count.
265 */
266 static size_t get_payload_count(private_encryption_payload_t *this)
267 {
268 return this->payloads->get_count(this->payloads);
269 }
270
271
272 /**
273 * Implementation of encryption_payload_t.encrypt.
274 */
275 static status_t encrypt(private_encryption_payload_t *this)
276 {
277 chunk_t iv, padding, to_crypt, result;
278 randomizer_t *randomizer;
279 status_t status;
280 size_t block_size;
281
282 if (this->signer == NULL || this->crypter == NULL)
283 {
284 return INVALID_STATE;
285 }
286
287 /* for random data in iv and padding */
288 randomizer = randomizer_create();
289
290 /* build payload chunk */
291 this->generate(this);
292
293 /* build padding */
294 block_size = this->crypter->get_block_size(this->crypter);
295 padding.len = block_size - ((this->decrypted.len + 1) % block_size);
296 randomizer->allocate_pseudo_random_bytes(randomizer, padding.len, &padding);
297
298 /* concatenate payload data, padding, padding len */
299 to_crypt.len = this->decrypted.len + padding.len + 1;
300 to_crypt.ptr = allocator_alloc(to_crypt.len);
301
302 memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
303 memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
304 *(to_crypt.ptr + to_crypt.len - 1) = padding.len;
305
306 /* build iv */
307 iv.len = block_size;
308 randomizer->allocate_pseudo_random_bytes(randomizer, iv.len, &iv);
309 randomizer->destroy(randomizer);
310
311 /* encrypt to_crypt chunk */
312 allocator_free(this->encrypted.ptr);
313 status = this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
314 allocator_free(padding.ptr);
315 allocator_free(to_crypt.ptr);
316 if (status != SUCCESS)
317 {
318 allocator_free(iv.ptr);
319 return status;
320 }
321
322 /* build encrypted result with iv and signature */
323 this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
324 allocator_free(this->encrypted.ptr);
325 this->encrypted.ptr = allocator_alloc(this->encrypted.len);
326
327 /* fill in result, signature is left out */
328 memcpy(this->encrypted.ptr, iv.ptr, iv.len);
329 memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
330
331 allocator_free(result.ptr);
332 allocator_free(iv.ptr);
333 return SUCCESS;
334 }
335
336 /**
337 * Implementation of encryption_payload_t.encrypt.
338 */
339 static status_t decrypt(private_encryption_payload_t *this)
340 {
341 chunk_t iv, concatenated;
342 u_int8_t padding_length;
343 status_t status;
344
345 if (this->signer == NULL || this->crypter == NULL)
346 {
347 return INVALID_STATE;
348 }
349
350 /* get IV */
351 iv.len = this->crypter->get_block_size(this->crypter);
352 iv.ptr = this->encrypted.ptr;
353
354 /* point concatenated to data + padding + padding_length*/
355 concatenated.ptr = this->encrypted.ptr + iv.len;
356 concatenated.len = this->encrypted.len - iv.len - this->signer->get_block_size(this->signer);
357
358 /* check the size of input:
359 * concatenated must be at least on block_size of crypter
360 */
361 if (concatenated.len < iv.len)
362 {
363 return FAILED;
364 }
365
366 /* free previus data, if any */
367 allocator_free(this->decrypted.ptr);
368
369 status = this->crypter->decrypt(this->crypter, concatenated, iv, &(this->decrypted));
370 if (status != SUCCESS)
371 {
372 return FAILED;
373 }
374
375 /* get padding length, sits just bevore signature */
376 padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
377 /* add one byte to the padding length, since the padding_length field is not included */
378 padding_length++;
379 this->decrypted.len -= padding_length;
380
381 /* check size again */
382 if (padding_length > concatenated.len || this->decrypted.len < 0)
383 {
384 /* decryption failed :-/ */
385 return FAILED;
386 }
387
388 /* free padding */
389 this->decrypted.ptr = allocator_realloc(this->decrypted.ptr, this->decrypted.len);
390
391 this->parse(this);
392
393 return SUCCESS;
394 }
395
396 /**
397 * Implementation of encryption_payload_t.set_transforms.
398 */
399 static void set_transforms(private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer)
400 {
401 this->signer = signer;
402 this->crypter = crypter;
403 }
404
405 /**
406 * Implementation of encryption_payload_t.build_signature.
407 */
408 static status_t build_signature(private_encryption_payload_t *this, chunk_t data)
409 {
410 chunk_t data_without_sig = data;
411 chunk_t sig;
412
413 if (this->signer == NULL)
414 {
415 return INVALID_STATE;
416 }
417
418 sig.len = this->signer->get_block_size(this->signer);
419 data_without_sig.len -= sig.len;
420 sig.ptr = data.ptr + data_without_sig.len;
421 this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
422 return SUCCESS;
423 }
424
425 /**
426 * Implementation of encryption_payload_t.verify_signature.
427 */
428 static status_t verify_signature(private_encryption_payload_t *this, chunk_t data)
429 {
430 chunk_t sig, data_without_sig;
431 bool valid;
432
433 if (this->signer == NULL)
434 {
435 return INVALID_STATE;
436 }
437 /* find signature in data chunk */
438 sig.len = this->signer->get_block_size(this->signer);
439 if (data.len <= sig.len)
440 {
441 return FAILED;
442 }
443 sig.ptr = data.ptr + data.len - sig.len;
444
445 /* verify it */
446 data_without_sig.len = data.len - sig.len;
447 data_without_sig.ptr = data.ptr;
448 this->signer->verify_signature(this->signer, data_without_sig, sig, &valid);
449
450 if (!valid)
451 {
452 return FAILED;
453 }
454
455 return SUCCESS;
456 }
457
458 /**
459 * Implementation of private_encryption_payload_t.generate.
460 */
461 static void generate(private_encryption_payload_t *this)
462 {
463 payload_t *current_payload, *next_payload;
464 generator_t *generator;
465 iterator_t *iterator;
466
467 /* recalculate length before generating */
468 this->compute_length(this);
469
470 /* create iterator */
471 iterator = this->payloads->create_iterator(this->payloads, TRUE);
472
473 /* get first payload */
474 if (iterator->has_next(iterator))
475 {
476 iterator->current(iterator, (void**)&current_payload);
477 this->next_payload = current_payload->get_type(current_payload);
478 }
479 else
480 {
481 /* no paylads? */
482 allocator_free(this->decrypted.ptr);
483 this->decrypted = CHUNK_INITIALIZER;
484 iterator->destroy(iterator);
485 return;
486 }
487
488 generator = generator_create();
489
490 /* build all payload, except last */
491 while(iterator->has_next(iterator))
492 {
493 iterator->current(iterator, (void**)&next_payload);
494 current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
495 generator->generate_payload(generator, current_payload);
496 current_payload = next_payload;
497 }
498 iterator->destroy(iterator);
499
500 /* build last payload */
501 current_payload->set_next_type(current_payload, NO_PAYLOAD);
502 generator->generate_payload(generator, current_payload);
503
504 /* free already generated data */
505 allocator_free(this->decrypted.ptr);
506
507 generator->write_to_chunk(generator, &(this->decrypted));
508 generator->destroy(generator);
509 }
510
511 /**
512 * Implementation of private_encryption_payload_t.parse.
513 */
514 static status_t parse(private_encryption_payload_t *this)
515 {
516 parser_t *parser;
517 status_t status;
518 payload_type_t current_payload_type;
519
520 /* check if there is decrypted data */
521 if (this->decrypted.ptr == NULL)
522 {
523 return INVALID_STATE;
524 }
525
526 /* build a parser on the decrypted data */
527 parser = parser_create(this->decrypted);
528
529 current_payload_type = this->next_payload;
530 /* parse all payloads */
531 while (current_payload_type != NO_PAYLOAD)
532 {
533 payload_t *current_payload;
534
535 status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
536 if (status != SUCCESS)
537 {
538 parser->destroy(parser);
539 return PARSE_ERROR;
540 }
541
542 status = current_payload->verify(current_payload);
543 if (status != SUCCESS)
544 {
545 parser->destroy(parser);
546 return VERIFY_ERROR;
547 }
548
549 /* get next payload type */
550 current_payload_type = current_payload->get_next_type(current_payload);
551
552 this->payloads->insert_last(this->payloads,current_payload);
553 }
554 parser->destroy(parser);
555 return SUCCESS;
556 }
557
558 /**
559 * Implementation of private_encryption_payload_t.compute_length.
560 */
561 static void compute_length(private_encryption_payload_t *this)
562 {
563 iterator_t *iterator;
564 size_t block_size, length = 0;
565 iterator = this->payloads->create_iterator(this->payloads, TRUE);
566
567 /* count payload length */
568 while (iterator->has_next(iterator))
569 {
570 payload_t *current_payload;
571 iterator->current(iterator, (void **) &current_payload);
572 length += current_payload->get_length(current_payload);
573 }
574 iterator->destroy(iterator);
575
576 if (this->crypter && this->signer)
577 {
578 /* append one byte for padding length */
579 length++;
580 /* append padding */
581 block_size = this->crypter->get_block_size(this->crypter);
582 length += block_size - length % block_size;
583 /* add iv */
584 length += block_size;
585 /* add signature */
586 length += this->signer->get_block_size(this->signer);
587 }
588 length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
589 this->payload_length = length;
590 }
591
592 /*
593 * Described in header
594 */
595 encryption_payload_t *encryption_payload_create()
596 {
597 private_encryption_payload_t *this = allocator_alloc_thing(private_encryption_payload_t);
598
599 /* payload_t interface functions */
600 this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
601 this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
602 this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
603 this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
604 this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
605 this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
606 this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
607
608 /* public functions */
609 this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator;
610 this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload;
611 this->public.remove_first_payload = (status_t (*)(encryption_payload_t*, payload_t **)) remove_first_payload;
612 this->public.get_payload_count = (size_t (*)(encryption_payload_t*)) get_payload_count;
613
614 this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt;
615 this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt;
616 this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms;
617 this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature;
618 this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
619 this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
620
621 /* private functions */
622 this->compute_length = compute_length;
623 this->generate = generate;
624 this->parse = parse;
625
626 /* set default values of the fields */
627 this->critical = TRUE;
628 this->next_payload = NO_PAYLOAD;
629 this->payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH;
630 this->encrypted = CHUNK_INITIALIZER;
631 this->decrypted = CHUNK_INITIALIZER;
632 this->signer = NULL;
633 this->crypter = NULL;
634 this->payloads = linked_list_create();
635
636 return (&(this->public));
637 }
638
639