src/charon-tkm/src/tkm/tkm_keymat.c

   1 /*
   2  * Copyrigth (C) 2012 Reto Buerki
   3  * Copyright (C) 2012 Adrian-Ken Rueegsegger
   4  * Hochschule fuer Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <daemon.h>
  18 #include <tkm/constants.h>
  19 #include <tkm/client.h>
  20
  21 #include "tkm.h"
  22 #include "tkm_types.h"
  23 #include "tkm_utils.h"
  24 #include "tkm_diffie_hellman.h"
  25 #include "tkm_keymat.h"
  26
  27 typedef struct private_tkm_keymat_t private_tkm_keymat_t;
  28
  29 /**
  30  * Private data of a keymat_t object.
  31  */
  32 struct private_tkm_keymat_t {
  33
  34         /**
  35          * Public tkm_keymat_t interface.
  36          */
  37         tkm_keymat_t public;
  38
  39         /**
  40          * IKE_SA Role, initiator or responder.
  41          */
  42         bool initiator;
  43
  44         /**
  45          * Inbound AEAD.
  46          */
  47         aead_t *aead_in;
  48
  49         /**
  50          * Outbound AEAD.
  51          */
  52         aead_t *aead_out;
  53
  54         /**
  55          * ISA context id.
  56          */
  57         isa_id_type isa_ctx_id;
  58
  59         /**
  60          * AE context id.
  61          */
  62         ae_id_type ae_ctx_id;
  63
  64         /**
  65          * AUTH payload chunk.
  66          */
  67         chunk_t auth_payload;
  68
  69         /**
  70          * Peer init message chunk.
  71          */
  72         chunk_t other_init_msg;
  73
  74 };
  75
  76 /**
  77  * Create AEAD transforms from given key chunks.
  78  *
  79  * @param in                    inbound AEAD transform to allocate, NULL if failed
  80  * @param out                   outbound AEAD transform to allocate, NULL if failed
  81  * @param sk_ai                 SK_ai key chunk
  82  * @param sk_ar                 SK_ar key chunk
  83  * @param sk_ei                 SK_ei key chunk
  84  * @param sk_er                 SK_er key chunk
  85  * @param enc_alg               encryption algorithm to use
  86  * @param int_alg               integrity algorithm to use
  87  * @param key_size              encryption key size in bytes
  88  * @param initiator             TRUE if initiator
  89  */
  90 static void aead_create_from_keys(aead_t **in, aead_t **out,
  91            const chunk_t * const sk_ai, const chunk_t * const sk_ar,
  92            const chunk_t * const sk_ei, const chunk_t * const sk_er,
  93            const u_int16_t enc_alg, const u_int16_t int_alg,
  94            const u_int16_t key_size, bool initiator)
  95 {
  96         *in = *out = NULL;
  97
  98         signer_t * const signer_i = lib->crypto->create_signer(lib->crypto, int_alg);
  99         signer_t * const signer_r = lib->crypto->create_signer(lib->crypto, int_alg);
 100         if (signer_i == NULL || signer_r == NULL)
 101         {
 102                 DBG1(DBG_IKE, "%N %N not supported!",
 103                          transform_type_names, INTEGRITY_ALGORITHM,
 104                          integrity_algorithm_names, int_alg);
 105                 return;
 106         }
 107         crypter_t * const crypter_i = lib->crypto->create_crypter(lib->crypto,
 108                         enc_alg, key_size);
 109         crypter_t * const crypter_r = lib->crypto->create_crypter(lib->crypto,
 110                         enc_alg, key_size);
 111         if (crypter_i == NULL || crypter_r == NULL)
 112         {
 113                 signer_i->destroy(signer_i);
 114                 signer_r->destroy(signer_r);
 115                 DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
 116                          transform_type_names, ENCRYPTION_ALGORITHM,
 117                          encryption_algorithm_names, enc_alg, key_size);
 118                 return;
 119         }
 120
 121         DBG4(DBG_IKE, "Sk_ai %B", sk_ai);
 122         if (!signer_i->set_key(signer_i, *sk_ai))
 123         {
 124                 return;
 125         }
 126         DBG4(DBG_IKE, "Sk_ar %B", sk_ar);
 127         if (!signer_r->set_key(signer_r, *sk_ar))
 128         {
 129                 return;
 130         }
 131         DBG4(DBG_IKE, "Sk_ei %B", sk_ei);
 132         if (!crypter_i->set_key(crypter_i, *sk_ei))
 133         {
 134                 return;
 135         }
 136         DBG4(DBG_IKE, "Sk_er %B", sk_er);
 137         if (!crypter_r->set_key(crypter_r, *sk_er))
 138         {
 139                 return;
 140         }
 141
 142         if (initiator)
 143         {
 144                 *in = aead_create(crypter_r, signer_r);
 145                 *out = aead_create(crypter_i, signer_i);
 146         }
 147         else
 148         {
 149                 *in = aead_create(crypter_i, signer_i);
 150                 *out = aead_create(crypter_r, signer_r);
 151         }
 152 }
 153
 154 METHOD(keymat_t, get_version, ike_version_t,
 155         private_tkm_keymat_t *this)
 156 {
 157         return IKEV2;
 158 }
 159
 160 METHOD(keymat_t, create_dh, diffie_hellman_t*,
 161         private_tkm_keymat_t *this, diffie_hellman_group_t group)
 162 {
 163         return lib->crypto->create_dh(lib->crypto, group);
 164 }
 165
 166 METHOD(keymat_t, create_nonce_gen, nonce_gen_t*,
 167         private_tkm_keymat_t *this)
 168 {
 169         return lib->crypto->create_nonce_gen(lib->crypto);
 170 }
 171
 172 METHOD(keymat_v2_t, derive_ike_keys, bool,
 173         private_tkm_keymat_t *this, proposal_t *proposal, diffie_hellman_t *dh,
 174         chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
 175         pseudo_random_function_t rekey_function, chunk_t rekey_skd)
 176 {
 177         /* Check encryption and integrity algorithms */
 178         u_int16_t enc_alg, int_alg, key_size;
 179         if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_alg, &key_size))
 180         {
 181                 DBG1(DBG_IKE, "no %N selected", transform_type_names,
 182                                 ENCRYPTION_ALGORITHM);
 183                 return FALSE;
 184         }
 185         if (encryption_algorithm_is_aead(enc_alg))
 186         {
 187                 DBG1(DBG_IKE, "AEAD algorithm %N not supported",
 188                            encryption_algorithm_names, enc_alg);
 189                 return FALSE;
 190         }
 191         if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_alg, NULL))
 192         {
 193                 DBG1(DBG_IKE, "no %N selected", transform_type_names,
 194                                 INTEGRITY_ALGORITHM);
 195                 return FALSE;
 196         }
 197         if (!(enc_alg == ENCR_AES_CBC && key_size == 256 &&
 198                         int_alg == AUTH_HMAC_SHA2_512_256))
 199         {
 200                 DBG1(DBG_IKE, "the TKM only supports aes256-sha512 at the moment, please"
 201                                 " update your configuration");
 202                 return FALSE;
 203         }
 204
 205         DBG2(DBG_IKE, "using %N for encryption, %N for integrity",
 206                         encryption_algorithm_names, enc_alg,
 207                         integrity_algorithm_names, int_alg);
 208
 209         /* Acquire nonce context id */
 210         chunk_t * const nonce = this->initiator ? &nonce_i : &nonce_r;
 211         const uint64_t nc_id = tkm->chunk_map->get_id(tkm->chunk_map, nonce);
 212         if (!nc_id)
 213         {
 214                 DBG1(DBG_IKE, "unable to acquire context id for nonce");
 215                 return FALSE;
 216         }
 217
 218         /* Get DH context id */
 219         tkm_diffie_hellman_t * const tkm_dh = (tkm_diffie_hellman_t *)dh;
 220         const dh_id_type dh_id = tkm_dh->get_id(tkm_dh);
 221
 222         nonce_type nonce_rem;
 223         u_int64_t spi_loc, spi_rem;
 224
 225         if (this->initiator)
 226         {
 227                 chunk_to_sequence(&nonce_r, &nonce_rem, sizeof(nonce_type));
 228                 spi_loc = id->get_initiator_spi(id);
 229                 spi_rem = id->get_responder_spi(id);
 230         }
 231         else
 232         {
 233                 chunk_to_sequence(&nonce_i, &nonce_rem, sizeof(nonce_type));
 234                 spi_loc = id->get_responder_spi(id);
 235                 spi_rem = id->get_initiator_spi(id);
 236         }
 237
 238         result_type res;
 239         key_type sk_ai, sk_ar, sk_ei, sk_er;
 240         if (rekey_function == PRF_UNDEFINED)
 241         {
 242                 this->ae_ctx_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_AE);
 243                 if (!this->ae_ctx_id)
 244                 {
 245                         DBG1(DBG_IKE, "unable to acquire ae context id");
 246                         return FALSE;
 247                 }
 248                 DBG1(DBG_IKE, "deriving IKE keys (nc: %llu, dh: %llu, spi_loc: %llx, "
 249                          "spi_rem: %llx)", nc_id, dh_id, spi_loc, spi_rem);
 250                 res = ike_isa_create(this->isa_ctx_id, this->ae_ctx_id, 1, dh_id, nc_id,
 251                                                          nonce_rem, this->initiator, spi_loc, spi_rem,
 252                                                          &sk_ai, &sk_ar, &sk_ei, &sk_er);
 253         }
 254         else
 255         {
 256                 if (rekey_skd.ptr == NULL || rekey_skd.len != sizeof(isa_info_t))
 257                 {
 258                         DBG1(DBG_IKE, "unable to retrieve parent isa info");
 259                         return FALSE;
 260                 }
 261                 const isa_info_t isa_info = *((isa_info_t *)(rekey_skd.ptr));
 262                 DBG1(DBG_IKE, "deriving IKE keys (parent_isa: %llu, ae: %llu, nc: %llu,"
 263                          "dh: %llu, spi_loc: %llx, spi_rem: %llx)", isa_info.parent_isa_id,
 264                          isa_info.ae_id, nc_id, dh_id, spi_loc, spi_rem);
 265                 this->ae_ctx_id = isa_info.ae_id;
 266                 res = ike_isa_create_child(this->isa_ctx_id, isa_info.parent_isa_id, 1,
 267                                                                    dh_id, nc_id, nonce_rem, this->initiator,
 268                                                                    spi_loc, spi_rem, &sk_ai, &sk_ar, &sk_ei,
 269                                                                    &sk_er);
 270                 chunk_free(&rekey_skd);
 271         }
 272
 273         if (res != TKM_OK)
 274         {
 275                 DBG1(DBG_IKE, "key derivation failed (isa: %llu)", this->isa_ctx_id);
 276                 return FALSE;
 277         }
 278
 279         chunk_t c_ai, c_ar, c_ei, c_er;
 280         sequence_to_chunk(sk_ai.data, sk_ai.size, &c_ai);
 281         sequence_to_chunk(sk_ar.data, sk_ar.size, &c_ar);
 282         sequence_to_chunk(sk_ei.data, sk_ei.size, &c_ei);
 283         sequence_to_chunk(sk_er.data, sk_er.size, &c_er);
 284
 285         aead_create_from_keys(&this->aead_in, &this->aead_out,
 286                         &c_ai, &c_ar, &c_ei, &c_er,
 287                         enc_alg, int_alg, key_size / 8, this->initiator);
 288
 289         chunk_clear(&c_ai);
 290         chunk_clear(&c_ar);
 291         chunk_clear(&c_ei);
 292         chunk_clear(&c_er);
 293
 294         if (!this->aead_in || !this->aead_out)
 295         {
 296                 DBG1(DBG_IKE, "could not initialize AEAD transforms");
 297                 return FALSE;
 298         }
 299
 300         /* TODO: Add failure handler (see keymat_v2.c) */
 301
 302         tkm->chunk_map->remove(tkm->chunk_map, nonce);
 303         if (ike_nc_reset(nc_id) != TKM_OK)
 304         {
 305                 DBG1(DBG_IKE, "failed to reset nonce context %llu", nc_id);
 306         }
 307         tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_NONCE, nc_id);
 308
 309         return TRUE;
 310 }
 311
 312 METHOD(keymat_v2_t, derive_child_keys, bool,
 313         private_tkm_keymat_t *this, proposal_t *proposal, diffie_hellman_t *dh,
 314         chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i,
 315         chunk_t *encr_r, chunk_t *integ_r)
 316 {
 317         esa_info_t *esa_info_i, *esa_info_r;
 318
 319         dh_id_type dh_id = 0;
 320         if (dh)
 321         {
 322                 dh_id = ((tkm_diffie_hellman_t *)dh)->get_id((tkm_diffie_hellman_t *)dh);
 323         }
 324
 325         INIT(esa_info_i,
 326                  .isa_id = this->isa_ctx_id,
 327                  .spi_r = proposal->get_spi(proposal),
 328                  .nonce_i = chunk_clone(nonce_i),
 329                  .nonce_r = chunk_clone(nonce_r),
 330                  .is_encr_r = FALSE,
 331                  .dh_id = dh_id,
 332         );
 333
 334         INIT(esa_info_r,
 335                  .isa_id = this->isa_ctx_id,
 336                  .spi_r = proposal->get_spi(proposal),
 337                  .nonce_i = chunk_clone(nonce_i),
 338                  .nonce_r = chunk_clone(nonce_r),
 339                  .is_encr_r = TRUE,
 340                  .dh_id = dh_id,
 341         );
 342
 343         DBG1(DBG_CHD, "passing on esa info (isa: %llu, spi_r: %x, dh_id: %llu)",
 344                  esa_info_i->isa_id, ntohl(esa_info_i->spi_r), esa_info_i->dh_id);
 345
 346         /* store ESA info in encr_i/r, which is passed to add_sa */
 347         *encr_i = chunk_create((u_char *)esa_info_i, sizeof(esa_info_t));
 348         *encr_r = chunk_create((u_char *)esa_info_r, sizeof(esa_info_t));
 349         *integ_i = chunk_empty;
 350         *integ_r = chunk_empty;
 351
 352         return TRUE;
 353 }
 354
 355 METHOD(keymat_t, get_aead, aead_t*,
 356         private_tkm_keymat_t *this, bool in)
 357 {
 358         return in ? this->aead_in : this->aead_out;
 359 }
 360
 361 METHOD(keymat_v2_t, get_auth_octets, bool,
 362         private_tkm_keymat_t *this, bool verify, chunk_t ike_sa_init,
 363         chunk_t nonce, identification_t *id, char reserved[3], chunk_t *octets)
 364 {
 365         if (verify)
 366         {
 367                 /* store peer init message for authentication step */
 368                 this->other_init_msg = chunk_clone(ike_sa_init);
 369                 *octets = chunk_empty;
 370                 return TRUE;
 371         }
 372
 373         sign_info_t *sign;
 374         INIT(sign,
 375                  .isa_id = this->isa_ctx_id,
 376                  .init_message = chunk_clone(ike_sa_init),
 377         );
 378
 379         /*
 380          * store signature info in AUTH octets, which is passed to the private key
 381          * sign() operation
 382          */
 383         *octets = chunk_create((u_char *)sign, sizeof(sign_info_t));
 384         return TRUE;
 385 }
 386
 387 METHOD(keymat_v2_t, get_skd, pseudo_random_function_t,
 388         private_tkm_keymat_t *this, chunk_t *skd)
 389 {
 390         isa_info_t *isa_info;
 391
 392         INIT(isa_info,
 393                  .parent_isa_id = this->isa_ctx_id,
 394                  .ae_id = this->ae_ctx_id,
 395         );
 396
 397         *skd = chunk_create((u_char *)isa_info, sizeof(isa_info_t));
 398
 399         /*
 400          * remove ae context id, since control has now been handed over to the new
 401          * IKE SA keymat
 402          */
 403         this->ae_ctx_id = 0;
 404         return PRF_HMAC_SHA2_512;
 405 }
 406
 407 METHOD(keymat_v2_t, get_psk_sig, bool,
 408         private_tkm_keymat_t *this, bool verify, chunk_t ike_sa_init, chunk_t nonce,
 409         chunk_t secret, identification_t *id, char reserved[3], chunk_t *sig)
 410 {
 411         return FALSE;
 412 }
 413
 414 METHOD(keymat_t, destroy, void,
 415         private_tkm_keymat_t *this)
 416 {
 417         if (ike_isa_reset(this->isa_ctx_id) != TKM_OK)
 418         {
 419                 DBG1(DBG_IKE, "failed to reset ISA context %d", this->isa_ctx_id);
 420         }
 421         tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_ISA, this->isa_ctx_id);
 422         /* only reset ae context if set */
 423         if (this->ae_ctx_id != 0)
 424         {
 425                 if (ike_ae_reset(this->ae_ctx_id) != TKM_OK)
 426                 {
 427                         DBG1(DBG_IKE, "failed to reset AE context %d", this->ae_ctx_id);
 428                 }
 429                 tkm->idmgr->release_id(tkm->idmgr, TKM_CTX_AE, this->ae_ctx_id);
 430         }
 431
 432         DESTROY_IF(this->aead_in);
 433         DESTROY_IF(this->aead_out);
 434         chunk_free(&this->auth_payload);
 435         chunk_free(&this->other_init_msg);
 436         free(this);
 437 }
 438
 439 METHOD(tkm_keymat_t, get_isa_id, isa_id_type,
 440         private_tkm_keymat_t *this)
 441 {
 442         return this->isa_ctx_id;
 443 }
 444
 445 METHOD(tkm_keymat_t, set_auth_payload, void,
 446         private_tkm_keymat_t *this, const chunk_t * const payload)
 447 {
 448         this->auth_payload = chunk_clone(*payload);
 449 }
 450
 451 METHOD(tkm_keymat_t, get_auth_payload, chunk_t*,
 452         private_tkm_keymat_t *this)
 453 {
 454         return &this->auth_payload;
 455 }
 456
 457 METHOD(tkm_keymat_t, get_peer_init_msg, chunk_t*,
 458         private_tkm_keymat_t *this)
 459 {
 460         return &this->other_init_msg;
 461 }
 462
 463 /**
 464  * See header.
 465  */
 466 tkm_keymat_t *tkm_keymat_create(bool initiator)
 467 {
 468         private_tkm_keymat_t *this;
 469
 470         INIT(this,
 471                 .public = {
 472                         .keymat_v2 = {
 473                                 .keymat = {
 474                                         .get_version = _get_version,
 475                                         .create_dh = _create_dh,
 476                                         .create_nonce_gen = _create_nonce_gen,
 477                                         .get_aead = _get_aead,
 478                                         .destroy = _destroy,
 479                                 },
 480                                 .derive_ike_keys = _derive_ike_keys,
 481                                 .derive_child_keys = _derive_child_keys,
 482                                 .get_skd = _get_skd,
 483                                 .get_auth_octets = _get_auth_octets,
 484                                 .get_psk_sig = _get_psk_sig,
 485                         },
 486                         .get_isa_id = _get_isa_id,
 487                         .set_auth_payload = _set_auth_payload,
 488                         .get_auth_payload = _get_auth_payload,
 489                         .get_peer_init_msg = _get_peer_init_msg,
 490                 },
 491                 .initiator = initiator,
 492                 .isa_ctx_id = tkm->idmgr->acquire_id(tkm->idmgr, TKM_CTX_ISA),
 493                 .ae_ctx_id = 0,
 494                 .auth_payload = chunk_empty,
 495                 .other_init_msg = chunk_empty,
 496         );
 497
 498         if (!this->isa_ctx_id)
 499         {
 500                 free(this);
 501                 return NULL;
 502         }
 503
 504         return &this->public;
 505 }