c61fb86833797353b46e2eda2511229adf57ba4f
[strongswan.git] / src / libcharon / encoding / payloads / encrypted_payload.c
1 /*
2 * Copyright (C) 2011-2014 Tobias Brunner
3 * Copyright (C) 2005-2010 Martin Willi
4 * Copyright (C) 2010 revosec AG
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include <stddef.h>
20 #include <string.h>
21
22 #include "encrypted_payload.h"
23
24 #include <daemon.h>
25 #include <encoding/payloads/encodings.h>
26 #include <collections/linked_list.h>
27 #include <encoding/parser.h>
28
29 typedef struct private_encrypted_payload_t private_encrypted_payload_t;
30
31 struct private_encrypted_payload_t {
32
33 /**
34 * Public encrypted_payload_t interface.
35 */
36 encrypted_payload_t public;
37
38 /**
39 * There is no next payload for an encrypted payload,
40 * since encrypted payload MUST be the last one.
41 * next_payload means here the first payload of the
42 * contained, encrypted payload.
43 */
44 u_int8_t next_payload;
45
46 /**
47 * Flags, including reserved bits
48 */
49 u_int8_t flags;
50
51 /**
52 * Length of this payload
53 */
54 u_int16_t payload_length;
55
56 /**
57 * Chunk containing the IV, plain, padding and ICV.
58 */
59 chunk_t encrypted;
60
61 /**
62 * AEAD transform to use
63 */
64 aead_t *aead;
65
66 /**
67 * Contained payloads
68 */
69 linked_list_t *payloads;
70
71 /**
72 * Type of payload, PLV2_ENCRYPTED or PLV1_ENCRYPTED
73 */
74 payload_type_t type;
75 };
76
77 /**
78 * Encoding rules to parse or generate a IKEv2-Encrypted Payload.
79 *
80 * The defined offsets are the positions in a object of type
81 * private_encrypted_payload_t.
82 */
83 static encoding_rule_t encodings_v2[] = {
84 /* 1 Byte next payload type, stored in the field next_payload */
85 { U_INT_8, offsetof(private_encrypted_payload_t, next_payload) },
86 /* Critical and 7 reserved bits, all stored for reconstruction */
87 { U_INT_8, offsetof(private_encrypted_payload_t, flags) },
88 /* Length of the whole encrypted payload*/
89 { PAYLOAD_LENGTH, offsetof(private_encrypted_payload_t, payload_length) },
90 /* encrypted data, stored in a chunk. contains iv, data, padding */
91 { CHUNK_DATA, offsetof(private_encrypted_payload_t, encrypted) },
92 };
93
94 /*
95 1 2 3
96 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
97 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
98 ! Next Payload !C! RESERVED ! Payload Length !
99 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
100 ! Initialization Vector !
101 ! (length is block size for encryption algorithm) !
102 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
103 ! Encrypted IKE Payloads !
104 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
105 ! ! Padding (0-255 octets) !
106 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
107 ! ! Pad Length !
108 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
109 ~ Integrity Checksum Data ~
110 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
111 */
112
113 /**
114 * Encoding rules to parse or generate a complete encrypted IKEv1 message.
115 *
116 * The defined offsets are the positions in a object of type
117 * private_encrypted_payload_t.
118 */
119 static encoding_rule_t encodings_v1[] = {
120 /* encrypted data, stored in a chunk */
121 { ENCRYPTED_DATA, offsetof(private_encrypted_payload_t, encrypted) },
122 };
123
124 /*
125 1 2 3
126 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
127 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
128 ! Encrypted IKE Payloads !
129 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
130 ! ! Padding (0-255 octets) !
131 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
132 */
133
134 METHOD(payload_t, verify, status_t,
135 private_encrypted_payload_t *this)
136 {
137 return SUCCESS;
138 }
139
140 METHOD(payload_t, get_encoding_rules, int,
141 private_encrypted_payload_t *this, encoding_rule_t **rules)
142 {
143 if (this->type == PLV2_ENCRYPTED)
144 {
145 *rules = encodings_v2;
146 return countof(encodings_v2);
147 }
148 *rules = encodings_v1;
149 return countof(encodings_v1);
150 }
151
152 METHOD(payload_t, get_header_length, int,
153 private_encrypted_payload_t *this)
154 {
155 if (this->type == PLV2_ENCRYPTED)
156 {
157 return 4;
158 }
159 return 0;
160 }
161
162 METHOD(payload_t, get_type, payload_type_t,
163 private_encrypted_payload_t *this)
164 {
165 return this->type;
166 }
167
168 METHOD(payload_t, get_next_type, payload_type_t,
169 private_encrypted_payload_t *this)
170 {
171 return this->next_payload;
172 }
173
174 METHOD(payload_t, set_next_type, void,
175 private_encrypted_payload_t *this, payload_type_t type)
176 {
177 /* the next payload is set during add, still allow this for IKEv1 */
178 this->next_payload = type;
179 }
180
181 /**
182 * Get length of encryption/integrity overhead for the given plaintext length
183 */
184 static size_t compute_overhead(aead_t *aead, size_t len)
185 {
186 size_t bs, overhead;
187
188 /* padding */
189 bs = aead->get_block_size(aead);
190 overhead = bs - (len % bs);
191 /* add iv */
192 overhead += aead->get_iv_size(aead);
193 /* add icv */
194 overhead += aead->get_icv_size(aead);
195 return overhead;
196 }
197
198 /**
199 * Compute the length of the whole payload
200 */
201 static void compute_length(private_encrypted_payload_t *this)
202 {
203 enumerator_t *enumerator;
204 payload_t *payload;
205 size_t length = 0;
206
207 if (this->encrypted.len)
208 {
209 length = this->encrypted.len;
210 }
211 else
212 {
213 enumerator = this->payloads->create_enumerator(this->payloads);
214 while (enumerator->enumerate(enumerator, &payload))
215 {
216 length += payload->get_length(payload);
217 }
218 enumerator->destroy(enumerator);
219
220 if (this->aead)
221 {
222 length += compute_overhead(this->aead, length);
223 }
224 }
225 length += get_header_length(this);
226 this->payload_length = length;
227 }
228
229 METHOD2(payload_t, encrypted_payload_t, get_length, size_t,
230 private_encrypted_payload_t *this)
231 {
232 compute_length(this);
233 return this->payload_length;
234 }
235
236 METHOD(encrypted_payload_t, add_payload, void,
237 private_encrypted_payload_t *this, payload_t *payload)
238 {
239 payload_t *last_payload;
240
241 if (this->payloads->get_count(this->payloads) > 0)
242 {
243 this->payloads->get_last(this->payloads, (void **)&last_payload);
244 last_payload->set_next_type(last_payload, payload->get_type(payload));
245 }
246 else
247 {
248 this->next_payload = payload->get_type(payload);
249 }
250 payload->set_next_type(payload, PL_NONE);
251 this->payloads->insert_last(this->payloads, payload);
252 compute_length(this);
253 }
254
255 METHOD(encrypted_payload_t, remove_payload, payload_t *,
256 private_encrypted_payload_t *this)
257 {
258 payload_t *payload;
259
260 if (this->payloads->remove_first(this->payloads,
261 (void**)&payload) == SUCCESS)
262 {
263 return payload;
264 }
265 return NULL;
266 }
267
268 /**
269 * Generate payload before encryption
270 */
271 static chunk_t generate(private_encrypted_payload_t *this,
272 generator_t *generator)
273 {
274 payload_t *current, *next;
275 enumerator_t *enumerator;
276 u_int32_t *lenpos;
277 chunk_t chunk = chunk_empty;
278
279 enumerator = this->payloads->create_enumerator(this->payloads);
280 if (enumerator->enumerate(enumerator, &current))
281 {
282 this->next_payload = current->get_type(current);
283
284 while (enumerator->enumerate(enumerator, &next))
285 {
286 current->set_next_type(current, next->get_type(next));
287 generator->generate_payload(generator, current);
288 current = next;
289 }
290 current->set_next_type(current, PL_NONE);
291 generator->generate_payload(generator, current);
292
293 chunk = generator->get_chunk(generator, &lenpos);
294 DBG2(DBG_ENC, "generated content in encrypted payload");
295 }
296 enumerator->destroy(enumerator);
297 return chunk;
298 }
299
300 METHOD(encrypted_payload_t, generate_payloads, void,
301 private_encrypted_payload_t *this, generator_t *generator)
302 {
303 generate(this, generator);
304 }
305
306 /**
307 * Append the encrypted payload header to the associated data
308 */
309 static chunk_t append_header(private_encrypted_payload_t *this, chunk_t assoc)
310 {
311 struct {
312 u_int8_t next_payload;
313 u_int8_t flags;
314 u_int16_t length;
315 } __attribute__((packed)) header = {
316 .next_payload = this->next_payload,
317 .flags = this->flags,
318 .length = htons(get_length(this)),
319 };
320 return chunk_cat("cc", assoc, chunk_from_thing(header));
321 }
322
323 /**
324 * Encrypts the data in plain and returns it in an allocated chunk.
325 */
326 static status_t encrypt_content(char *label, aead_t *aead, u_int64_t mid,
327 chunk_t plain, chunk_t assoc, chunk_t *encrypted)
328 {
329 chunk_t iv, padding, icv, crypt;
330 iv_gen_t *iv_gen;
331 rng_t *rng;
332 size_t bs;
333
334 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
335 if (!rng)
336 {
337 DBG1(DBG_ENC, "encrypting %s failed, no RNG found", label);
338 return NOT_SUPPORTED;
339 }
340
341 iv_gen = aead->get_iv_gen(aead);
342 if (!iv_gen)
343 {
344 DBG1(DBG_ENC, "encrypting %s failed, no IV generator", label);
345 return NOT_SUPPORTED;
346 }
347
348 bs = aead->get_block_size(aead);
349 /* we need at least one byte padding to store the padding length */
350 padding.len = bs - (plain.len % bs);
351 iv.len = aead->get_iv_size(aead);
352 icv.len = aead->get_icv_size(aead);
353
354 /* prepare data to authenticate-encrypt:
355 * | IV | plain | padding | ICV |
356 * \____crypt______/ ^
357 * | /
358 * v /
359 * assoc -> + ------->/
360 */
361 *encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
362 iv.ptr = encrypted->ptr;
363 memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
364 plain.ptr = iv.ptr + iv.len;
365 padding.ptr = plain.ptr + plain.len;
366 icv.ptr = padding.ptr + padding.len;
367 crypt = chunk_create(plain.ptr, plain.len + padding.len);
368
369 if (!iv_gen->get_iv(iv_gen, mid, iv.len, iv.ptr) ||
370 !rng->get_bytes(rng, padding.len - 1, padding.ptr))
371 {
372 DBG1(DBG_ENC, "encrypting %s failed, no IV or padding", label);
373 rng->destroy(rng);
374
375 return FAILED;
376 }
377 padding.ptr[padding.len - 1] = padding.len - 1;
378 rng->destroy(rng);
379
380 DBG3(DBG_ENC, "%s encryption:", label);
381 DBG3(DBG_ENC, "IV %B", &iv);
382 DBG3(DBG_ENC, "plain %B", &plain);
383 DBG3(DBG_ENC, "padding %B", &padding);
384 DBG3(DBG_ENC, "assoc %B", &assoc);
385
386 if (!aead->encrypt(aead, crypt, assoc, iv, NULL))
387 {
388 return FAILED;
389 }
390 DBG3(DBG_ENC, "encrypted %B", &crypt);
391 DBG3(DBG_ENC, "ICV %B", &icv);
392 return SUCCESS;
393 }
394
395 METHOD(encrypted_payload_t, encrypt, status_t,
396 private_encrypted_payload_t *this, u_int64_t mid, chunk_t assoc)
397 {
398 generator_t *generator;
399 chunk_t plain;
400 status_t status;
401
402 if (this->aead == NULL)
403 {
404 DBG1(DBG_ENC, "encrypting encrypted payload failed, transform missing");
405 return INVALID_STATE;
406 }
407
408 free(this->encrypted.ptr);
409 generator = generator_create();
410 plain = generate(this, generator);
411 assoc = append_header(this, assoc);
412 status = encrypt_content("encrypted payload", this->aead, mid, plain, assoc,
413 &this->encrypted);
414 generator->destroy(generator);
415 free(assoc.ptr);
416 return status;
417 }
418
419 METHOD(encrypted_payload_t, encrypt_v1, status_t,
420 private_encrypted_payload_t *this, u_int64_t mid, chunk_t iv)
421 {
422 generator_t *generator;
423 chunk_t plain, padding;
424 size_t bs;
425
426 if (this->aead == NULL)
427 {
428 DBG1(DBG_ENC, "encryption failed, transform missing");
429 return INVALID_STATE;
430 }
431
432 generator = generator_create();
433 plain = generate(this, generator);
434 bs = this->aead->get_block_size(this->aead);
435 padding.len = bs - (plain.len % bs);
436
437 /* prepare data to encrypt:
438 * | plain | padding | */
439 free(this->encrypted.ptr);
440 this->encrypted = chunk_alloc(plain.len + padding.len);
441 memcpy(this->encrypted.ptr, plain.ptr, plain.len);
442 plain.ptr = this->encrypted.ptr;
443 padding.ptr = plain.ptr + plain.len;
444 memset(padding.ptr, 0, padding.len);
445 generator->destroy(generator);
446
447 DBG3(DBG_ENC, "encrypting payloads:");
448 DBG3(DBG_ENC, "IV %B", &iv);
449 DBG3(DBG_ENC, "plain %B", &plain);
450 DBG3(DBG_ENC, "padding %B", &padding);
451
452 if (!this->aead->encrypt(this->aead, this->encrypted, chunk_empty, iv, NULL))
453 {
454 return FAILED;
455 }
456
457 DBG3(DBG_ENC, "encrypted %B", &this->encrypted);
458
459 return SUCCESS;
460 }
461
462 /**
463 * Parse the payloads after decryption.
464 */
465 static status_t parse(private_encrypted_payload_t *this, chunk_t plain)
466 {
467 parser_t *parser;
468 payload_type_t type;
469
470 parser = parser_create(plain);
471 type = this->next_payload;
472 while (type != PL_NONE)
473 {
474 payload_t *payload;
475
476 if (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len)
477 {
478 DBG1(DBG_ENC, "invalid %N payload length, decryption failed?",
479 payload_type_names, type);
480 parser->destroy(parser);
481 return PARSE_ERROR;
482 }
483 if (parser->parse_payload(parser, type, &payload) != SUCCESS)
484 {
485 parser->destroy(parser);
486 return PARSE_ERROR;
487 }
488 if (payload->verify(payload) != SUCCESS)
489 {
490 DBG1(DBG_ENC, "%N verification failed",
491 payload_type_names, payload->get_type(payload));
492 payload->destroy(payload);
493 parser->destroy(parser);
494 return VERIFY_ERROR;
495 }
496 type = payload->get_next_type(payload);
497 this->payloads->insert_last(this->payloads, payload);
498 }
499 parser->destroy(parser);
500 DBG2(DBG_ENC, "parsed content of encrypted payload");
501 return SUCCESS;
502 }
503
504 /**
505 * Decrypts the given data in-place and returns a chunk pointing to the
506 * resulting plaintext.
507 */
508 static status_t decrypt_content(char *label, aead_t *aead, chunk_t encrypted,
509 chunk_t assoc, chunk_t *plain)
510 {
511 chunk_t iv, padding, icv, crypt;
512 size_t bs;
513
514 /* prepare data to authenticate-decrypt:
515 * | IV | plain | padding | ICV |
516 * \____crypt______/ ^
517 * | /
518 * v /
519 * assoc -> + ------->/
520 */
521 bs = aead->get_block_size(aead);
522 iv.len = aead->get_iv_size(aead);
523 iv.ptr = encrypted.ptr;
524 icv.len = aead->get_icv_size(aead);
525 icv.ptr = encrypted.ptr + encrypted.len - icv.len;
526 crypt.ptr = iv.ptr + iv.len;
527 crypt.len = encrypted.len - iv.len;
528
529 if (iv.len + icv.len > encrypted.len ||
530 (crypt.len - icv.len) % bs)
531 {
532 DBG1(DBG_ENC, "decrypting %s payload failed, invalid length", label);
533 return FAILED;
534 }
535
536 DBG3(DBG_ENC, "%s decryption:", label);
537 DBG3(DBG_ENC, "IV %B", &iv);
538 DBG3(DBG_ENC, "encrypted %B", &crypt);
539 DBG3(DBG_ENC, "ICV %B", &icv);
540 DBG3(DBG_ENC, "assoc %B", &assoc);
541
542 if (!aead->decrypt(aead, crypt, assoc, iv, NULL))
543 {
544 DBG1(DBG_ENC, "verifying %s integrity failed", label);
545 return FAILED;
546 }
547
548 *plain = chunk_create(crypt.ptr, crypt.len - icv.len);
549 padding.len = plain->ptr[plain->len - 1] + 1;
550 if (padding.len > plain->len)
551 {
552 DBG1(DBG_ENC, "decrypting %s failed, padding invalid %B", label,
553 &crypt);
554 return PARSE_ERROR;
555 }
556 plain->len -= padding.len;
557 padding.ptr = plain->ptr + plain->len;
558
559 DBG3(DBG_ENC, "plain %B", plain);
560 DBG3(DBG_ENC, "padding %B", &padding);
561 return SUCCESS;
562 }
563
564 METHOD(encrypted_payload_t, decrypt, status_t,
565 private_encrypted_payload_t *this, chunk_t assoc)
566 {
567 chunk_t plain;
568 status_t status;
569
570 if (this->aead == NULL)
571 {
572 DBG1(DBG_ENC, "decrypting encrypted payload failed, transform missing");
573 return INVALID_STATE;
574 }
575
576 assoc = append_header(this, assoc);
577 status = decrypt_content("encrypted payload", this->aead, this->encrypted,
578 assoc, &plain);
579 free(assoc.ptr);
580
581 if (status != SUCCESS)
582 {
583 return status;
584 }
585 return parse(this, plain);
586 }
587
588 METHOD(encrypted_payload_t, decrypt_plain, status_t,
589 private_encrypted_payload_t *this, chunk_t assoc)
590 {
591 if (!this->encrypted.ptr)
592 {
593 return FAILED;
594 }
595 return parse(this, this->encrypted);
596 }
597
598 METHOD(encrypted_payload_t, decrypt_v1, status_t,
599 private_encrypted_payload_t *this, chunk_t iv)
600 {
601 if (this->aead == NULL)
602 {
603 DBG1(DBG_ENC, "decryption failed, transform missing");
604 return INVALID_STATE;
605 }
606
607 /* data must be a multiple of block size */
608 if (iv.len != this->aead->get_block_size(this->aead) ||
609 this->encrypted.len < iv.len || this->encrypted.len % iv.len)
610 {
611 DBG1(DBG_ENC, "decryption failed, invalid length");
612 return FAILED;
613 }
614
615 DBG3(DBG_ENC, "decrypting payloads:");
616 DBG3(DBG_ENC, "encrypted %B", &this->encrypted);
617
618 if (!this->aead->decrypt(this->aead, this->encrypted, chunk_empty, iv, NULL))
619 {
620 return FAILED;
621 }
622
623 DBG3(DBG_ENC, "plain %B", &this->encrypted);
624
625 return parse(this, this->encrypted);
626 }
627
628 METHOD(encrypted_payload_t, set_transform, void,
629 private_encrypted_payload_t *this, aead_t* aead)
630 {
631 this->aead = aead;
632 }
633
634 METHOD2(payload_t, encrypted_payload_t, destroy, void,
635 private_encrypted_payload_t *this)
636 {
637 this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
638 free(this->encrypted.ptr);
639 free(this);
640 }
641
642 /*
643 * Described in header
644 */
645 encrypted_payload_t *encrypted_payload_create(payload_type_t type)
646 {
647 private_encrypted_payload_t *this;
648
649 INIT(this,
650 .public = {
651 .payload_interface = {
652 .verify = _verify,
653 .get_encoding_rules = _get_encoding_rules,
654 .get_header_length = _get_header_length,
655 .get_length = _get_length,
656 .get_next_type = _get_next_type,
657 .set_next_type = _set_next_type,
658 .get_type = _get_type,
659 .destroy = _destroy,
660 },
661 .get_length = _get_length,
662 .add_payload = _add_payload,
663 .remove_payload = _remove_payload,
664 .generate_payloads = _generate_payloads,
665 .set_transform = _set_transform,
666 .encrypt = _encrypt,
667 .decrypt = _decrypt,
668 .destroy = _destroy,
669 },
670 .next_payload = PL_NONE,
671 .payloads = linked_list_create(),
672 .type = type,
673 );
674 this->payload_length = get_header_length(this);
675
676 if (type == PLV1_ENCRYPTED)
677 {
678 this->public.encrypt = _encrypt_v1;
679 this->public.decrypt = _decrypt_v1;
680 }
681
682 return &this->public;
683 }
684
685 /*
686 * Described in header
687 */
688 encrypted_payload_t *encrypted_payload_create_from_plain(payload_type_t next,
689 chunk_t plain)
690 {
691 private_encrypted_payload_t *this;
692
693 this = (private_encrypted_payload_t*)encrypted_payload_create(PLV2_ENCRYPTED);
694 this->public.decrypt = _decrypt_plain;
695 this->next_payload = next;
696 this->encrypted = plain;
697 compute_length(this);
698
699 return &this->public;
700 }