ike: Rename encryption_payload to encrypted_payload
[strongswan.git] / src / libcharon / encoding / payloads / encrypted_payload.c
1 /*
2 * Copyright (C) 2005-2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 * Copyright (C) 2011 Tobias Brunner
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include <stddef.h>
20 #include <string.h>
21
22 #include "encrypted_payload.h"
23
24 #include <daemon.h>
25 #include <encoding/payloads/encodings.h>
26 #include <collections/linked_list.h>
27 #include <encoding/generator.h>
28 #include <encoding/parser.h>
29
30 typedef struct private_encrypted_payload_t private_encrypted_payload_t;
31
32 struct private_encrypted_payload_t {
33
34 /**
35 * Public encrypted_payload_t interface.
36 */
37 encrypted_payload_t public;
38
39 /**
40 * There is no next payload for an encrypted payload,
41 * since encrypted payload MUST be the last one.
42 * next_payload means here the first payload of the
43 * contained, encrypted payload.
44 */
45 u_int8_t next_payload;
46
47 /**
48 * Flags, including reserved bits
49 */
50 u_int8_t flags;
51
52 /**
53 * Length of this payload
54 */
55 u_int16_t payload_length;
56
57 /**
58 * Chunk containing the IV, plain, padding and ICV.
59 */
60 chunk_t encrypted;
61
62 /**
63 * AEAD transform to use
64 */
65 aead_t *aead;
66
67 /**
68 * Contained payloads
69 */
70 linked_list_t *payloads;
71
72 /**
73 * Type of payload, PLV2_ENCRYPTED or PLV1_ENCRYPTED
74 */
75 payload_type_t type;
76 };
77
78 /**
79 * Encoding rules to parse or generate a IKEv2-Encrypted Payload.
80 *
81 * The defined offsets are the positions in a object of type
82 * private_encrypted_payload_t.
83 */
84 static encoding_rule_t encodings_v2[] = {
85 /* 1 Byte next payload type, stored in the field next_payload */
86 { U_INT_8, offsetof(private_encrypted_payload_t, next_payload) },
87 /* Critical and 7 reserved bits, all stored for reconstruction */
88 { U_INT_8, offsetof(private_encrypted_payload_t, flags) },
89 /* Length of the whole encrypted payload*/
90 { PAYLOAD_LENGTH, offsetof(private_encrypted_payload_t, payload_length) },
91 /* encrypted data, stored in a chunk. contains iv, data, padding */
92 { CHUNK_DATA, offsetof(private_encrypted_payload_t, encrypted) },
93 };
94
95 /*
96 1 2 3
97 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
98 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
99 ! Next Payload !C! RESERVED ! Payload Length !
100 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
101 ! Initialization Vector !
102 ! (length is block size for encryption algorithm) !
103 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
104 ! Encrypted IKE Payloads !
105 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
106 ! ! Padding (0-255 octets) !
107 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
108 ! ! Pad Length !
109 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
110 ~ Integrity Checksum Data ~
111 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
112 */
113
114 /**
115 * Encoding rules to parse or generate a complete encrypted IKEv1 message.
116 *
117 * The defined offsets are the positions in a object of type
118 * private_encrypted_payload_t.
119 */
120 static encoding_rule_t encodings_v1[] = {
121 /* encrypted data, stored in a chunk */
122 { ENCRYPTED_DATA, offsetof(private_encrypted_payload_t, encrypted) },
123 };
124
125 /*
126 1 2 3
127 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
128 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
129 ! Encrypted IKE Payloads !
130 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
131 ! ! Padding (0-255 octets) !
132 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
133 */
134
135 METHOD(payload_t, verify, status_t,
136 private_encrypted_payload_t *this)
137 {
138 return SUCCESS;
139 }
140
141 METHOD(payload_t, get_encoding_rules, int,
142 private_encrypted_payload_t *this, encoding_rule_t **rules)
143 {
144 if (this->type == PLV2_ENCRYPTED)
145 {
146 *rules = encodings_v2;
147 return countof(encodings_v2);
148 }
149 *rules = encodings_v1;
150 return countof(encodings_v1);
151 }
152
153 METHOD(payload_t, get_header_length, int,
154 private_encrypted_payload_t *this)
155 {
156 if (this->type == PLV2_ENCRYPTED)
157 {
158 return 4;
159 }
160 return 0;
161 }
162
163 METHOD(payload_t, get_type, payload_type_t,
164 private_encrypted_payload_t *this)
165 {
166 return this->type;
167 }
168
169 METHOD(payload_t, get_next_type, payload_type_t,
170 private_encrypted_payload_t *this)
171 {
172 return this->next_payload;
173 }
174
175 METHOD(payload_t, set_next_type, void,
176 private_encrypted_payload_t *this, payload_type_t type)
177 {
178 /* the next payload is set during add, still allow this for IKEv1 */
179 this->next_payload = type;
180 }
181
182 /**
183 * Compute the length of the whole payload
184 */
185 static void compute_length(private_encrypted_payload_t *this)
186 {
187 enumerator_t *enumerator;
188 payload_t *payload;
189 size_t bs, length = 0;
190
191 if (this->encrypted.len)
192 {
193 length = this->encrypted.len;
194 }
195 else
196 {
197 enumerator = this->payloads->create_enumerator(this->payloads);
198 while (enumerator->enumerate(enumerator, &payload))
199 {
200 length += payload->get_length(payload);
201 }
202 enumerator->destroy(enumerator);
203
204 if (this->aead)
205 {
206 /* append padding */
207 bs = this->aead->get_block_size(this->aead);
208 length += bs - (length % bs);
209 /* add iv */
210 length += this->aead->get_iv_size(this->aead);
211 /* add icv */
212 length += this->aead->get_icv_size(this->aead);
213 }
214 }
215 length += get_header_length(this);
216 this->payload_length = length;
217 }
218
219 METHOD2(payload_t, encrypted_payload_t, get_length, size_t,
220 private_encrypted_payload_t *this)
221 {
222 compute_length(this);
223 return this->payload_length;
224 }
225
226 METHOD(encrypted_payload_t, add_payload, void,
227 private_encrypted_payload_t *this, payload_t *payload)
228 {
229 payload_t *last_payload;
230
231 if (this->payloads->get_count(this->payloads) > 0)
232 {
233 this->payloads->get_last(this->payloads, (void **)&last_payload);
234 last_payload->set_next_type(last_payload, payload->get_type(payload));
235 }
236 else
237 {
238 this->next_payload = payload->get_type(payload);
239 }
240 payload->set_next_type(payload, PL_NONE);
241 this->payloads->insert_last(this->payloads, payload);
242 compute_length(this);
243 }
244
245 METHOD(encrypted_payload_t, remove_payload, payload_t *,
246 private_encrypted_payload_t *this)
247 {
248 payload_t *payload;
249
250 if (this->payloads->remove_first(this->payloads,
251 (void**)&payload) == SUCCESS)
252 {
253 return payload;
254 }
255 return NULL;
256 }
257
258 /**
259 * Generate payload before encryption
260 */
261 static chunk_t generate(private_encrypted_payload_t *this,
262 generator_t *generator)
263 {
264 payload_t *current, *next;
265 enumerator_t *enumerator;
266 u_int32_t *lenpos;
267 chunk_t chunk = chunk_empty;
268
269 enumerator = this->payloads->create_enumerator(this->payloads);
270 if (enumerator->enumerate(enumerator, &current))
271 {
272 this->next_payload = current->get_type(current);
273
274 while (enumerator->enumerate(enumerator, &next))
275 {
276 current->set_next_type(current, next->get_type(next));
277 generator->generate_payload(generator, current);
278 current = next;
279 }
280 current->set_next_type(current, PL_NONE);
281 generator->generate_payload(generator, current);
282
283 chunk = generator->get_chunk(generator, &lenpos);
284 DBG2(DBG_ENC, "generated content in encrypted payload");
285 }
286 enumerator->destroy(enumerator);
287 return chunk;
288 }
289
290 /**
291 * Append the encrypted payload header to the associated data
292 */
293 static chunk_t append_header(private_encrypted_payload_t *this, chunk_t assoc)
294 {
295 struct {
296 u_int8_t next_payload;
297 u_int8_t flags;
298 u_int16_t length;
299 } __attribute__((packed)) header = {
300 .next_payload = this->next_payload,
301 .flags = this->flags,
302 .length = htons(get_length(this)),
303 };
304 return chunk_cat("cc", assoc, chunk_from_thing(header));
305 }
306
307 METHOD(encrypted_payload_t, encrypt, status_t,
308 private_encrypted_payload_t *this, u_int64_t mid, chunk_t assoc)
309 {
310 chunk_t iv, plain, padding, icv, crypt;
311 generator_t *generator;
312 iv_gen_t *iv_gen;
313 rng_t *rng;
314 size_t bs;
315
316 if (this->aead == NULL)
317 {
318 DBG1(DBG_ENC, "encrypting encrypted payload failed, transform missing");
319 return INVALID_STATE;
320 }
321
322 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
323 if (!rng)
324 {
325 DBG1(DBG_ENC, "encrypting encrypted payload failed, no RNG found");
326 return NOT_SUPPORTED;
327 }
328
329 iv_gen = this->aead->get_iv_gen(this->aead);
330 if (!iv_gen)
331 {
332 DBG1(DBG_ENC, "encrypting encrypted payload failed, no IV generator");
333 return NOT_SUPPORTED;
334 }
335
336 assoc = append_header(this, assoc);
337
338 generator = generator_create();
339 plain = generate(this, generator);
340 bs = this->aead->get_block_size(this->aead);
341 /* we need at least one byte padding to store the padding length */
342 padding.len = bs - (plain.len % bs);
343 iv.len = this->aead->get_iv_size(this->aead);
344 icv.len = this->aead->get_icv_size(this->aead);
345
346 /* prepare data to authenticate-encrypt:
347 * | IV | plain | padding | ICV |
348 * \____crypt______/ ^
349 * | /
350 * v /
351 * assoc -> + ------->/
352 */
353 free(this->encrypted.ptr);
354 this->encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
355 iv.ptr = this->encrypted.ptr;
356 memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
357 plain.ptr = iv.ptr + iv.len;
358 padding.ptr = plain.ptr + plain.len;
359 icv.ptr = padding.ptr + padding.len;
360 crypt = chunk_create(plain.ptr, plain.len + padding.len);
361 generator->destroy(generator);
362
363 if (!iv_gen->get_iv(iv_gen, mid, iv.len, iv.ptr) ||
364 !rng->get_bytes(rng, padding.len - 1, padding.ptr))
365 {
366 DBG1(DBG_ENC, "encrypting encrypted payload failed, no IV or padding");
367 rng->destroy(rng);
368 free(assoc.ptr);
369 return FAILED;
370 }
371 padding.ptr[padding.len - 1] = padding.len - 1;
372 rng->destroy(rng);
373
374 DBG3(DBG_ENC, "encrypted payload encryption:");
375 DBG3(DBG_ENC, "IV %B", &iv);
376 DBG3(DBG_ENC, "plain %B", &plain);
377 DBG3(DBG_ENC, "padding %B", &padding);
378 DBG3(DBG_ENC, "assoc %B", &assoc);
379
380 if (!this->aead->encrypt(this->aead, crypt, assoc, iv, NULL))
381 {
382 free(assoc.ptr);
383 return FAILED;
384 }
385
386 DBG3(DBG_ENC, "encrypted %B", &crypt);
387 DBG3(DBG_ENC, "ICV %B", &icv);
388
389 free(assoc.ptr);
390
391 return SUCCESS;
392 }
393
394 METHOD(encrypted_payload_t, encrypt_v1, status_t,
395 private_encrypted_payload_t *this, u_int64_t mid, chunk_t iv)
396 {
397 generator_t *generator;
398 chunk_t plain, padding;
399 size_t bs;
400
401 if (this->aead == NULL)
402 {
403 DBG1(DBG_ENC, "encryption failed, transform missing");
404 return INVALID_STATE;
405 }
406
407 generator = generator_create();
408 plain = generate(this, generator);
409 bs = this->aead->get_block_size(this->aead);
410 padding.len = bs - (plain.len % bs);
411
412 /* prepare data to encrypt:
413 * | plain | padding | */
414 free(this->encrypted.ptr);
415 this->encrypted = chunk_alloc(plain.len + padding.len);
416 memcpy(this->encrypted.ptr, plain.ptr, plain.len);
417 plain.ptr = this->encrypted.ptr;
418 padding.ptr = plain.ptr + plain.len;
419 memset(padding.ptr, 0, padding.len);
420 generator->destroy(generator);
421
422 DBG3(DBG_ENC, "encrypting payloads:");
423 DBG3(DBG_ENC, "IV %B", &iv);
424 DBG3(DBG_ENC, "plain %B", &plain);
425 DBG3(DBG_ENC, "padding %B", &padding);
426
427 if (!this->aead->encrypt(this->aead, this->encrypted, chunk_empty, iv, NULL))
428 {
429 return FAILED;
430 }
431
432 DBG3(DBG_ENC, "encrypted %B", &this->encrypted);
433
434 return SUCCESS;
435 }
436
437 /**
438 * Parse the payloads after decryption.
439 */
440 static status_t parse(private_encrypted_payload_t *this, chunk_t plain)
441 {
442 parser_t *parser;
443 payload_type_t type;
444
445 parser = parser_create(plain);
446 type = this->next_payload;
447 while (type != PL_NONE)
448 {
449 payload_t *payload;
450
451 if (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len)
452 {
453 DBG1(DBG_ENC, "invalid %N payload length, decryption failed?",
454 payload_type_names, type);
455 parser->destroy(parser);
456 return PARSE_ERROR;
457 }
458 if (parser->parse_payload(parser, type, &payload) != SUCCESS)
459 {
460 parser->destroy(parser);
461 return PARSE_ERROR;
462 }
463 if (payload->verify(payload) != SUCCESS)
464 {
465 DBG1(DBG_ENC, "%N verification failed",
466 payload_type_names, payload->get_type(payload));
467 payload->destroy(payload);
468 parser->destroy(parser);
469 return VERIFY_ERROR;
470 }
471 type = payload->get_next_type(payload);
472 this->payloads->insert_last(this->payloads, payload);
473 }
474 parser->destroy(parser);
475 DBG2(DBG_ENC, "parsed content of encrypted payload");
476 return SUCCESS;
477 }
478
479 METHOD(encrypted_payload_t, decrypt, status_t,
480 private_encrypted_payload_t *this, chunk_t assoc)
481 {
482 chunk_t iv, plain, padding, icv, crypt;
483 size_t bs;
484
485 if (this->aead == NULL)
486 {
487 DBG1(DBG_ENC, "decrypting encrypted payload failed, transform missing");
488 return INVALID_STATE;
489 }
490
491 /* prepare data to authenticate-decrypt:
492 * | IV | plain | padding | ICV |
493 * \____crypt______/ ^
494 * | /
495 * v /
496 * assoc -> + ------->/
497 */
498
499 bs = this->aead->get_block_size(this->aead);
500 iv.len = this->aead->get_iv_size(this->aead);
501 iv.ptr = this->encrypted.ptr;
502 icv.len = this->aead->get_icv_size(this->aead);
503 icv.ptr = this->encrypted.ptr + this->encrypted.len - icv.len;
504 crypt.ptr = iv.ptr + iv.len;
505 crypt.len = this->encrypted.len - iv.len;
506
507 if (iv.len + icv.len > this->encrypted.len ||
508 (crypt.len - icv.len) % bs)
509 {
510 DBG1(DBG_ENC, "decrypting encrypted payload failed, invalid length");
511 return FAILED;
512 }
513
514 assoc = append_header(this, assoc);
515
516 DBG3(DBG_ENC, "encrypted payload decryption:");
517 DBG3(DBG_ENC, "IV %B", &iv);
518 DBG3(DBG_ENC, "encrypted %B", &crypt);
519 DBG3(DBG_ENC, "ICV %B", &icv);
520 DBG3(DBG_ENC, "assoc %B", &assoc);
521
522 if (!this->aead->decrypt(this->aead, crypt, assoc, iv, NULL))
523 {
524 DBG1(DBG_ENC, "verifying encrypted payload integrity failed");
525 free(assoc.ptr);
526 return FAILED;
527 }
528 free(assoc.ptr);
529
530 plain = chunk_create(crypt.ptr, crypt.len - icv.len);
531 padding.len = plain.ptr[plain.len - 1] + 1;
532 if (padding.len > plain.len)
533 {
534 DBG1(DBG_ENC, "decrypting encrypted payload failed, "
535 "padding invalid %B", &crypt);
536 return PARSE_ERROR;
537 }
538 plain.len -= padding.len;
539 padding.ptr = plain.ptr + plain.len;
540
541 DBG3(DBG_ENC, "plain %B", &plain);
542 DBG3(DBG_ENC, "padding %B", &padding);
543
544 return parse(this, plain);
545 }
546
547 METHOD(encrypted_payload_t, decrypt_v1, status_t,
548 private_encrypted_payload_t *this, chunk_t iv)
549 {
550 if (this->aead == NULL)
551 {
552 DBG1(DBG_ENC, "decryption failed, transform missing");
553 return INVALID_STATE;
554 }
555
556 /* data must be a multiple of block size */
557 if (iv.len != this->aead->get_block_size(this->aead) ||
558 this->encrypted.len < iv.len || this->encrypted.len % iv.len)
559 {
560 DBG1(DBG_ENC, "decryption failed, invalid length");
561 return FAILED;
562 }
563
564 DBG3(DBG_ENC, "decrypting payloads:");
565 DBG3(DBG_ENC, "encrypted %B", &this->encrypted);
566
567 if (!this->aead->decrypt(this->aead, this->encrypted, chunk_empty, iv, NULL))
568 {
569 return FAILED;
570 }
571
572 DBG3(DBG_ENC, "plain %B", &this->encrypted);
573
574 return parse(this, this->encrypted);
575 }
576
577 METHOD(encrypted_payload_t, set_transform, void,
578 private_encrypted_payload_t *this, aead_t* aead)
579 {
580 this->aead = aead;
581 }
582
583 METHOD2(payload_t, encrypted_payload_t, destroy, void,
584 private_encrypted_payload_t *this)
585 {
586 this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
587 free(this->encrypted.ptr);
588 free(this);
589 }
590
591 /*
592 * Described in header
593 */
594 encrypted_payload_t *encrypted_payload_create(payload_type_t type)
595 {
596 private_encrypted_payload_t *this;
597
598 INIT(this,
599 .public = {
600 .payload_interface = {
601 .verify = _verify,
602 .get_encoding_rules = _get_encoding_rules,
603 .get_header_length = _get_header_length,
604 .get_length = _get_length,
605 .get_next_type = _get_next_type,
606 .set_next_type = _set_next_type,
607 .get_type = _get_type,
608 .destroy = _destroy,
609 },
610 .get_length = _get_length,
611 .add_payload = _add_payload,
612 .remove_payload = _remove_payload,
613 .set_transform = _set_transform,
614 .encrypt = _encrypt,
615 .decrypt = _decrypt,
616 .destroy = _destroy,
617 },
618 .next_payload = PL_NONE,
619 .payloads = linked_list_create(),
620 .type = type,
621 );
622 this->payload_length = get_header_length(this);
623
624 if (type == PLV1_ENCRYPTED)
625 {
626 this->public.encrypt = _encrypt_v1;
627 this->public.decrypt = _decrypt_v1;
628 }
629
630 return &this->public;
631 }