encrypted_payload: Extract some utility functions
[strongswan.git] / src / libcharon / encoding / payloads / encrypted_payload.c
1 /*
2 * Copyright (C) 2011-2014 Tobias Brunner
3 * Copyright (C) 2005-2010 Martin Willi
4 * Copyright (C) 2010 revosec AG
5 * Copyright (C) 2005 Jan Hutter
6 * Hochschule fuer Technik Rapperswil
7 *
8 * This program is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2 of the License, or (at your
11 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
12 *
13 * This program is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
15 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 * for more details.
17 */
18
19 #include <stddef.h>
20 #include <string.h>
21
22 #include "encrypted_payload.h"
23
24 #include <daemon.h>
25 #include <encoding/payloads/encodings.h>
26 #include <collections/linked_list.h>
27 #include <encoding/generator.h>
28 #include <encoding/parser.h>
29
30 typedef struct private_encrypted_payload_t private_encrypted_payload_t;
31
32 struct private_encrypted_payload_t {
33
34 /**
35 * Public encrypted_payload_t interface.
36 */
37 encrypted_payload_t public;
38
39 /**
40 * There is no next payload for an encrypted payload,
41 * since encrypted payload MUST be the last one.
42 * next_payload means here the first payload of the
43 * contained, encrypted payload.
44 */
45 u_int8_t next_payload;
46
47 /**
48 * Flags, including reserved bits
49 */
50 u_int8_t flags;
51
52 /**
53 * Length of this payload
54 */
55 u_int16_t payload_length;
56
57 /**
58 * Chunk containing the IV, plain, padding and ICV.
59 */
60 chunk_t encrypted;
61
62 /**
63 * AEAD transform to use
64 */
65 aead_t *aead;
66
67 /**
68 * Contained payloads
69 */
70 linked_list_t *payloads;
71
72 /**
73 * Type of payload, PLV2_ENCRYPTED or PLV1_ENCRYPTED
74 */
75 payload_type_t type;
76 };
77
78 /**
79 * Encoding rules to parse or generate a IKEv2-Encrypted Payload.
80 *
81 * The defined offsets are the positions in a object of type
82 * private_encrypted_payload_t.
83 */
84 static encoding_rule_t encodings_v2[] = {
85 /* 1 Byte next payload type, stored in the field next_payload */
86 { U_INT_8, offsetof(private_encrypted_payload_t, next_payload) },
87 /* Critical and 7 reserved bits, all stored for reconstruction */
88 { U_INT_8, offsetof(private_encrypted_payload_t, flags) },
89 /* Length of the whole encrypted payload*/
90 { PAYLOAD_LENGTH, offsetof(private_encrypted_payload_t, payload_length) },
91 /* encrypted data, stored in a chunk. contains iv, data, padding */
92 { CHUNK_DATA, offsetof(private_encrypted_payload_t, encrypted) },
93 };
94
95 /*
96 1 2 3
97 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
98 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
99 ! Next Payload !C! RESERVED ! Payload Length !
100 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
101 ! Initialization Vector !
102 ! (length is block size for encryption algorithm) !
103 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
104 ! Encrypted IKE Payloads !
105 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
106 ! ! Padding (0-255 octets) !
107 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
108 ! ! Pad Length !
109 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
110 ~ Integrity Checksum Data ~
111 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
112 */
113
114 /**
115 * Encoding rules to parse or generate a complete encrypted IKEv1 message.
116 *
117 * The defined offsets are the positions in a object of type
118 * private_encrypted_payload_t.
119 */
120 static encoding_rule_t encodings_v1[] = {
121 /* encrypted data, stored in a chunk */
122 { ENCRYPTED_DATA, offsetof(private_encrypted_payload_t, encrypted) },
123 };
124
125 /*
126 1 2 3
127 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
128 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
129 ! Encrypted IKE Payloads !
130 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
131 ! ! Padding (0-255 octets) !
132 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
133 */
134
135 METHOD(payload_t, verify, status_t,
136 private_encrypted_payload_t *this)
137 {
138 return SUCCESS;
139 }
140
141 METHOD(payload_t, get_encoding_rules, int,
142 private_encrypted_payload_t *this, encoding_rule_t **rules)
143 {
144 if (this->type == PLV2_ENCRYPTED)
145 {
146 *rules = encodings_v2;
147 return countof(encodings_v2);
148 }
149 *rules = encodings_v1;
150 return countof(encodings_v1);
151 }
152
153 METHOD(payload_t, get_header_length, int,
154 private_encrypted_payload_t *this)
155 {
156 if (this->type == PLV2_ENCRYPTED)
157 {
158 return 4;
159 }
160 return 0;
161 }
162
163 METHOD(payload_t, get_type, payload_type_t,
164 private_encrypted_payload_t *this)
165 {
166 return this->type;
167 }
168
169 METHOD(payload_t, get_next_type, payload_type_t,
170 private_encrypted_payload_t *this)
171 {
172 return this->next_payload;
173 }
174
175 METHOD(payload_t, set_next_type, void,
176 private_encrypted_payload_t *this, payload_type_t type)
177 {
178 /* the next payload is set during add, still allow this for IKEv1 */
179 this->next_payload = type;
180 }
181
182 /**
183 * Get length of encryption/integrity overhead for the given plaintext length
184 */
185 static size_t compute_overhead(aead_t *aead, size_t len)
186 {
187 size_t bs, overhead;
188
189 /* padding */
190 bs = aead->get_block_size(aead);
191 overhead = bs - (len % bs);
192 /* add iv */
193 overhead += aead->get_iv_size(aead);
194 /* add icv */
195 overhead += aead->get_icv_size(aead);
196 return overhead;
197 }
198
199 /**
200 * Compute the length of the whole payload
201 */
202 static void compute_length(private_encrypted_payload_t *this)
203 {
204 enumerator_t *enumerator;
205 payload_t *payload;
206 size_t length = 0;
207
208 if (this->encrypted.len)
209 {
210 length = this->encrypted.len;
211 }
212 else
213 {
214 enumerator = this->payloads->create_enumerator(this->payloads);
215 while (enumerator->enumerate(enumerator, &payload))
216 {
217 length += payload->get_length(payload);
218 }
219 enumerator->destroy(enumerator);
220
221 if (this->aead)
222 {
223 length += compute_overhead(this->aead, length);
224 }
225 }
226 length += get_header_length(this);
227 this->payload_length = length;
228 }
229
230 METHOD2(payload_t, encrypted_payload_t, get_length, size_t,
231 private_encrypted_payload_t *this)
232 {
233 compute_length(this);
234 return this->payload_length;
235 }
236
237 METHOD(encrypted_payload_t, add_payload, void,
238 private_encrypted_payload_t *this, payload_t *payload)
239 {
240 payload_t *last_payload;
241
242 if (this->payloads->get_count(this->payloads) > 0)
243 {
244 this->payloads->get_last(this->payloads, (void **)&last_payload);
245 last_payload->set_next_type(last_payload, payload->get_type(payload));
246 }
247 else
248 {
249 this->next_payload = payload->get_type(payload);
250 }
251 payload->set_next_type(payload, PL_NONE);
252 this->payloads->insert_last(this->payloads, payload);
253 compute_length(this);
254 }
255
256 METHOD(encrypted_payload_t, remove_payload, payload_t *,
257 private_encrypted_payload_t *this)
258 {
259 payload_t *payload;
260
261 if (this->payloads->remove_first(this->payloads,
262 (void**)&payload) == SUCCESS)
263 {
264 return payload;
265 }
266 return NULL;
267 }
268
269 /**
270 * Generate payload before encryption
271 */
272 static chunk_t generate(private_encrypted_payload_t *this,
273 generator_t *generator)
274 {
275 payload_t *current, *next;
276 enumerator_t *enumerator;
277 u_int32_t *lenpos;
278 chunk_t chunk = chunk_empty;
279
280 enumerator = this->payloads->create_enumerator(this->payloads);
281 if (enumerator->enumerate(enumerator, &current))
282 {
283 this->next_payload = current->get_type(current);
284
285 while (enumerator->enumerate(enumerator, &next))
286 {
287 current->set_next_type(current, next->get_type(next));
288 generator->generate_payload(generator, current);
289 current = next;
290 }
291 current->set_next_type(current, PL_NONE);
292 generator->generate_payload(generator, current);
293
294 chunk = generator->get_chunk(generator, &lenpos);
295 DBG2(DBG_ENC, "generated content in encrypted payload");
296 }
297 enumerator->destroy(enumerator);
298 return chunk;
299 }
300
301 /**
302 * Append the encrypted payload header to the associated data
303 */
304 static chunk_t append_header(private_encrypted_payload_t *this, chunk_t assoc)
305 {
306 struct {
307 u_int8_t next_payload;
308 u_int8_t flags;
309 u_int16_t length;
310 } __attribute__((packed)) header = {
311 .next_payload = this->next_payload,
312 .flags = this->flags,
313 .length = htons(get_length(this)),
314 };
315 return chunk_cat("cc", assoc, chunk_from_thing(header));
316 }
317
318 /**
319 * Encrypts the data in plain and returns it in an allocated chunk.
320 */
321 static status_t encrypt_content(char *label, aead_t *aead, u_int64_t mid,
322 chunk_t plain, chunk_t assoc, chunk_t *encrypted)
323 {
324 chunk_t iv, padding, icv, crypt;
325 iv_gen_t *iv_gen;
326 rng_t *rng;
327 size_t bs;
328
329 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
330 if (!rng)
331 {
332 DBG1(DBG_ENC, "encrypting %s failed, no RNG found", label);
333 return NOT_SUPPORTED;
334 }
335
336 iv_gen = aead->get_iv_gen(aead);
337 if (!iv_gen)
338 {
339 DBG1(DBG_ENC, "encrypting %s failed, no IV generator", label);
340 return NOT_SUPPORTED;
341 }
342
343 bs = aead->get_block_size(aead);
344 /* we need at least one byte padding to store the padding length */
345 padding.len = bs - (plain.len % bs);
346 iv.len = aead->get_iv_size(aead);
347 icv.len = aead->get_icv_size(aead);
348
349 /* prepare data to authenticate-encrypt:
350 * | IV | plain | padding | ICV |
351 * \____crypt______/ ^
352 * | /
353 * v /
354 * assoc -> + ------->/
355 */
356 *encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
357 iv.ptr = encrypted->ptr;
358 memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
359 plain.ptr = iv.ptr + iv.len;
360 padding.ptr = plain.ptr + plain.len;
361 icv.ptr = padding.ptr + padding.len;
362 crypt = chunk_create(plain.ptr, plain.len + padding.len);
363
364 if (!iv_gen->get_iv(iv_gen, mid, iv.len, iv.ptr) ||
365 !rng->get_bytes(rng, padding.len - 1, padding.ptr))
366 {
367 DBG1(DBG_ENC, "encrypting %s failed, no IV or padding", label);
368 rng->destroy(rng);
369
370 return FAILED;
371 }
372 padding.ptr[padding.len - 1] = padding.len - 1;
373 rng->destroy(rng);
374
375 DBG3(DBG_ENC, "%s encryption:", label);
376 DBG3(DBG_ENC, "IV %B", &iv);
377 DBG3(DBG_ENC, "plain %B", &plain);
378 DBG3(DBG_ENC, "padding %B", &padding);
379 DBG3(DBG_ENC, "assoc %B", &assoc);
380
381 if (!aead->encrypt(aead, crypt, assoc, iv, NULL))
382 {
383 return FAILED;
384 }
385 DBG3(DBG_ENC, "encrypted %B", &crypt);
386 DBG3(DBG_ENC, "ICV %B", &icv);
387 return SUCCESS;
388 }
389
390 METHOD(encrypted_payload_t, encrypt, status_t,
391 private_encrypted_payload_t *this, u_int64_t mid, chunk_t assoc)
392 {
393 generator_t *generator;
394 chunk_t plain;
395 status_t status;
396
397 if (this->aead == NULL)
398 {
399 DBG1(DBG_ENC, "encrypting encrypted payload failed, transform missing");
400 return INVALID_STATE;
401 }
402
403 free(this->encrypted.ptr);
404 generator = generator_create();
405 plain = generate(this, generator);
406 assoc = append_header(this, assoc);
407 status = encrypt_content("encrypted payload", this->aead, mid, plain, assoc,
408 &this->encrypted);
409 generator->destroy(generator);
410 free(assoc.ptr);
411 return status;
412 }
413
414 METHOD(encrypted_payload_t, encrypt_v1, status_t,
415 private_encrypted_payload_t *this, u_int64_t mid, chunk_t iv)
416 {
417 generator_t *generator;
418 chunk_t plain, padding;
419 size_t bs;
420
421 if (this->aead == NULL)
422 {
423 DBG1(DBG_ENC, "encryption failed, transform missing");
424 return INVALID_STATE;
425 }
426
427 generator = generator_create();
428 plain = generate(this, generator);
429 bs = this->aead->get_block_size(this->aead);
430 padding.len = bs - (plain.len % bs);
431
432 /* prepare data to encrypt:
433 * | plain | padding | */
434 free(this->encrypted.ptr);
435 this->encrypted = chunk_alloc(plain.len + padding.len);
436 memcpy(this->encrypted.ptr, plain.ptr, plain.len);
437 plain.ptr = this->encrypted.ptr;
438 padding.ptr = plain.ptr + plain.len;
439 memset(padding.ptr, 0, padding.len);
440 generator->destroy(generator);
441
442 DBG3(DBG_ENC, "encrypting payloads:");
443 DBG3(DBG_ENC, "IV %B", &iv);
444 DBG3(DBG_ENC, "plain %B", &plain);
445 DBG3(DBG_ENC, "padding %B", &padding);
446
447 if (!this->aead->encrypt(this->aead, this->encrypted, chunk_empty, iv, NULL))
448 {
449 return FAILED;
450 }
451
452 DBG3(DBG_ENC, "encrypted %B", &this->encrypted);
453
454 return SUCCESS;
455 }
456
457 /**
458 * Parse the payloads after decryption.
459 */
460 static status_t parse(private_encrypted_payload_t *this, chunk_t plain)
461 {
462 parser_t *parser;
463 payload_type_t type;
464
465 parser = parser_create(plain);
466 type = this->next_payload;
467 while (type != PL_NONE)
468 {
469 payload_t *payload;
470
471 if (plain.len < 4 || untoh16(plain.ptr + 2) > plain.len)
472 {
473 DBG1(DBG_ENC, "invalid %N payload length, decryption failed?",
474 payload_type_names, type);
475 parser->destroy(parser);
476 return PARSE_ERROR;
477 }
478 if (parser->parse_payload(parser, type, &payload) != SUCCESS)
479 {
480 parser->destroy(parser);
481 return PARSE_ERROR;
482 }
483 if (payload->verify(payload) != SUCCESS)
484 {
485 DBG1(DBG_ENC, "%N verification failed",
486 payload_type_names, payload->get_type(payload));
487 payload->destroy(payload);
488 parser->destroy(parser);
489 return VERIFY_ERROR;
490 }
491 type = payload->get_next_type(payload);
492 this->payloads->insert_last(this->payloads, payload);
493 }
494 parser->destroy(parser);
495 DBG2(DBG_ENC, "parsed content of encrypted payload");
496 return SUCCESS;
497 }
498
499 /**
500 * Decrypts the given data in-place and returns a chunk pointing to the
501 * resulting plaintext.
502 */
503 static status_t decrypt_content(char *label, aead_t *aead, chunk_t encrypted,
504 chunk_t assoc, chunk_t *plain)
505 {
506 chunk_t iv, padding, icv, crypt;
507 size_t bs;
508
509 /* prepare data to authenticate-decrypt:
510 * | IV | plain | padding | ICV |
511 * \____crypt______/ ^
512 * | /
513 * v /
514 * assoc -> + ------->/
515 */
516 bs = aead->get_block_size(aead);
517 iv.len = aead->get_iv_size(aead);
518 iv.ptr = encrypted.ptr;
519 icv.len = aead->get_icv_size(aead);
520 icv.ptr = encrypted.ptr + encrypted.len - icv.len;
521 crypt.ptr = iv.ptr + iv.len;
522 crypt.len = encrypted.len - iv.len;
523
524 if (iv.len + icv.len > encrypted.len ||
525 (crypt.len - icv.len) % bs)
526 {
527 DBG1(DBG_ENC, "decrypting %s payload failed, invalid length", label);
528 return FAILED;
529 }
530
531 DBG3(DBG_ENC, "%s decryption:", label);
532 DBG3(DBG_ENC, "IV %B", &iv);
533 DBG3(DBG_ENC, "encrypted %B", &crypt);
534 DBG3(DBG_ENC, "ICV %B", &icv);
535 DBG3(DBG_ENC, "assoc %B", &assoc);
536
537 if (!aead->decrypt(aead, crypt, assoc, iv, NULL))
538 {
539 DBG1(DBG_ENC, "verifying %s integrity failed", label);
540 return FAILED;
541 }
542
543 *plain = chunk_create(crypt.ptr, crypt.len - icv.len);
544 padding.len = plain->ptr[plain->len - 1] + 1;
545 if (padding.len > plain->len)
546 {
547 DBG1(DBG_ENC, "decrypting %s failed, padding invalid %B", label,
548 &crypt);
549 return PARSE_ERROR;
550 }
551 plain->len -= padding.len;
552 padding.ptr = plain->ptr + plain->len;
553
554 DBG3(DBG_ENC, "plain %B", plain);
555 DBG3(DBG_ENC, "padding %B", &padding);
556 return SUCCESS;
557 }
558
559 METHOD(encrypted_payload_t, decrypt, status_t,
560 private_encrypted_payload_t *this, chunk_t assoc)
561 {
562 chunk_t plain;
563 status_t status;
564
565 if (this->aead == NULL)
566 {
567 DBG1(DBG_ENC, "decrypting encrypted payload failed, transform missing");
568 return INVALID_STATE;
569 }
570
571 assoc = append_header(this, assoc);
572 status = decrypt_content("encrypted payload", this->aead, this->encrypted,
573 assoc, &plain);
574 free(assoc.ptr);
575
576 if (status != SUCCESS)
577 {
578 return status;
579 }
580 return parse(this, plain);
581 }
582
583 METHOD(encrypted_payload_t, decrypt_v1, status_t,
584 private_encrypted_payload_t *this, chunk_t iv)
585 {
586 if (this->aead == NULL)
587 {
588 DBG1(DBG_ENC, "decryption failed, transform missing");
589 return INVALID_STATE;
590 }
591
592 /* data must be a multiple of block size */
593 if (iv.len != this->aead->get_block_size(this->aead) ||
594 this->encrypted.len < iv.len || this->encrypted.len % iv.len)
595 {
596 DBG1(DBG_ENC, "decryption failed, invalid length");
597 return FAILED;
598 }
599
600 DBG3(DBG_ENC, "decrypting payloads:");
601 DBG3(DBG_ENC, "encrypted %B", &this->encrypted);
602
603 if (!this->aead->decrypt(this->aead, this->encrypted, chunk_empty, iv, NULL))
604 {
605 return FAILED;
606 }
607
608 DBG3(DBG_ENC, "plain %B", &this->encrypted);
609
610 return parse(this, this->encrypted);
611 }
612
613 METHOD(encrypted_payload_t, set_transform, void,
614 private_encrypted_payload_t *this, aead_t* aead)
615 {
616 this->aead = aead;
617 }
618
619 METHOD2(payload_t, encrypted_payload_t, destroy, void,
620 private_encrypted_payload_t *this)
621 {
622 this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
623 free(this->encrypted.ptr);
624 free(this);
625 }
626
627 /*
628 * Described in header
629 */
630 encrypted_payload_t *encrypted_payload_create(payload_type_t type)
631 {
632 private_encrypted_payload_t *this;
633
634 INIT(this,
635 .public = {
636 .payload_interface = {
637 .verify = _verify,
638 .get_encoding_rules = _get_encoding_rules,
639 .get_header_length = _get_header_length,
640 .get_length = _get_length,
641 .get_next_type = _get_next_type,
642 .set_next_type = _set_next_type,
643 .get_type = _get_type,
644 .destroy = _destroy,
645 },
646 .get_length = _get_length,
647 .add_payload = _add_payload,
648 .remove_payload = _remove_payload,
649 .set_transform = _set_transform,
650 .encrypt = _encrypt,
651 .decrypt = _decrypt,
652 .destroy = _destroy,
653 },
654 .next_payload = PL_NONE,
655 .payloads = linked_list_create(),
656 .type = type,
657 );
658 this->payload_length = get_header_length(this);
659
660 if (type == PLV1_ENCRYPTED)
661 {
662 this->public.encrypt = _encrypt_v1;
663 this->public.decrypt = _decrypt_v1;
664 }
665
666 return &this->public;
667 }