bb9969d0bd6e144240f8bcf485e953ddbd448ee5
[strongswan.git] / src / libcharon / encoding / payloads / encryption_payload.c
1 /*
2 * Copyright (C) 2005-2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 * Copyright (C) 2005 Jan Hutter
5 * Hochschule fuer Technik Rapperswil
6 *
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by the
9 * Free Software Foundation; either version 2 of the License, or (at your
10 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 *
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
14 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
15 * for more details.
16 */
17
18 #include <stddef.h>
19 #include <string.h>
20
21 #include "encryption_payload.h"
22
23 #include <daemon.h>
24 #include <encoding/payloads/encodings.h>
25 #include <utils/linked_list.h>
26 #include <encoding/generator.h>
27 #include <encoding/parser.h>
28
29 typedef struct private_encryption_payload_t private_encryption_payload_t;
30
31 /**
32 * Private data of an encryption_payload_t' Object.
33 *
34 */
35 struct private_encryption_payload_t {
36
37 /**
38 * Public encryption_payload_t interface.
39 */
40 encryption_payload_t public;
41
42 /**
43 * There is no next payload for an encryption payload,
44 * since encryption payload MUST be the last one.
45 * next_payload means here the first payload of the
46 * contained, encrypted payload.
47 */
48 u_int8_t next_payload;
49
50 /**
51 * Flags, including reserved bits
52 */
53 u_int8_t flags;
54
55 /**
56 * Length of this payload
57 */
58 u_int16_t payload_length;
59
60 /**
61 * Chunk containing the IV, plain, padding and ICV.
62 */
63 chunk_t encrypted;
64
65 /**
66 * AEAD transform to use
67 */
68 aead_t *aead;
69
70 /**
71 * Contained payloads
72 */
73 linked_list_t *payloads;
74 };
75
76 /**
77 * Encoding rules to parse or generate a IKEv2-Encryption Payload.
78 *
79 * The defined offsets are the positions in a object of type
80 * private_encryption_payload_t.
81 */
82 static encoding_rule_t encodings[] = {
83 /* 1 Byte next payload type, stored in the field next_payload */
84 { U_INT_8, offsetof(private_encryption_payload_t, next_payload) },
85 /* Critical and 7 reserved bits, all stored for reconstruction */
86 { U_INT_8, offsetof(private_encryption_payload_t, flags) },
87 /* Length of the whole encryption payload*/
88 { PAYLOAD_LENGTH, offsetof(private_encryption_payload_t, payload_length) },
89 /* encrypted data, stored in a chunk. contains iv, data, padding */
90 { CHUNK_DATA, offsetof(private_encryption_payload_t, encrypted) },
91 };
92
93 /*
94 1 2 3
95 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
96 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
97 ! Next Payload !C! RESERVED ! Payload Length !
98 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
99 ! Initialization Vector !
100 ! (length is block size for encryption algorithm) !
101 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
102 ! Encrypted IKE Payloads !
103 + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
104 ! ! Padding (0-255 octets) !
105 +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
106 ! ! Pad Length !
107 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
108 ~ Integrity Checksum Data ~
109 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
110 */
111
112 METHOD(payload_t, verify, status_t,
113 private_encryption_payload_t *this)
114 {
115 return SUCCESS;
116 }
117
118 METHOD(payload_t, get_encoding_rules, int,
119 private_encryption_payload_t *this, encoding_rule_t **rules)
120 {
121 *rules = encodings;
122 return countof(encodings);
123 }
124
125 METHOD(payload_t, get_header_length, int,
126 private_encryption_payload_t *this)
127 {
128 return 4;
129 }
130
131 METHOD(payload_t, get_type, payload_type_t,
132 private_encryption_payload_t *this)
133 {
134 return ENCRYPTED;
135 }
136
137 METHOD(payload_t, get_next_type, payload_type_t,
138 private_encryption_payload_t *this)
139 {
140 return this->next_payload;
141 }
142
143 METHOD(payload_t, set_next_type, void,
144 private_encryption_payload_t *this, payload_type_t type)
145 {
146 /* the next payload is set during add */
147 }
148
149 /**
150 * Compute the length of the whole payload
151 */
152 static void compute_length(private_encryption_payload_t *this)
153 {
154 enumerator_t *enumerator;
155 payload_t *payload;
156 size_t bs, length = 0;
157
158 if (this->encrypted.len)
159 {
160 length = this->encrypted.len;
161 }
162 else
163 {
164 enumerator = this->payloads->create_enumerator(this->payloads);
165 while (enumerator->enumerate(enumerator, &payload))
166 {
167 length += payload->get_length(payload);
168 }
169 enumerator->destroy(enumerator);
170
171 if (this->aead)
172 {
173 /* append padding */
174 bs = this->aead->get_block_size(this->aead);
175 length += bs - (length % bs);
176 /* add iv */
177 length += this->aead->get_iv_size(this->aead);
178 /* add icv */
179 length += this->aead->get_icv_size(this->aead);
180 }
181 }
182 length += get_header_length(this);
183 this->payload_length = length;
184 }
185
186 METHOD2(payload_t, encryption_payload_t, get_length, size_t,
187 private_encryption_payload_t *this)
188 {
189 compute_length(this);
190 return this->payload_length;
191 }
192
193 METHOD(encryption_payload_t, add_payload, void,
194 private_encryption_payload_t *this, payload_t *payload)
195 {
196 payload_t *last_payload;
197
198 if (this->payloads->get_count(this->payloads) > 0)
199 {
200 this->payloads->get_last(this->payloads, (void **)&last_payload);
201 last_payload->set_next_type(last_payload, payload->get_type(payload));
202 }
203 else
204 {
205 this->next_payload = payload->get_type(payload);
206 }
207 payload->set_next_type(payload, NO_PAYLOAD);
208 this->payloads->insert_last(this->payloads, payload);
209 compute_length(this);
210 }
211
212 METHOD(encryption_payload_t, remove_payload, payload_t *,
213 private_encryption_payload_t *this)
214 {
215 payload_t *payload;
216
217 if (this->payloads->remove_first(this->payloads,
218 (void**)&payload) == SUCCESS)
219 {
220 return payload;
221 }
222 return NULL;
223 }
224
225 /**
226 * Generate payload before encryption
227 */
228 static chunk_t generate(private_encryption_payload_t *this,
229 generator_t *generator)
230 {
231 payload_t *current, *next;
232 enumerator_t *enumerator;
233 u_int32_t *lenpos;
234 chunk_t chunk = chunk_empty;
235
236 enumerator = this->payloads->create_enumerator(this->payloads);
237 if (enumerator->enumerate(enumerator, &current))
238 {
239 this->next_payload = current->get_type(current);
240
241 while (enumerator->enumerate(enumerator, &next))
242 {
243 current->set_next_type(current, next->get_type(next));
244 generator->generate_payload(generator, current);
245 current = next;
246 }
247 current->set_next_type(current, NO_PAYLOAD);
248 generator->generate_payload(generator, current);
249
250 chunk = generator->get_chunk(generator, &lenpos);
251 DBG2(DBG_ENC, "generated content in encryption payload");
252 }
253 enumerator->destroy(enumerator);
254 return chunk;
255 }
256
257 /**
258 * Append the encryption payload header to the associated data
259 */
260 static chunk_t append_header(private_encryption_payload_t *this, chunk_t assoc)
261 {
262 struct {
263 u_int8_t next_payload;
264 u_int8_t flags;
265 u_int16_t length;
266 } __attribute__((packed)) header = {
267 .next_payload = this->next_payload,
268 .flags = this->flags,
269 .length = htons(get_length(this)),
270 };
271 return chunk_cat("cc", assoc, chunk_from_thing(header));
272 }
273
274 METHOD(encryption_payload_t, encrypt, bool,
275 private_encryption_payload_t *this, chunk_t assoc)
276 {
277 chunk_t iv, plain, padding, icv, crypt;
278 generator_t *generator;
279 rng_t *rng;
280 size_t bs;
281
282 if (this->aead == NULL)
283 {
284 DBG1(DBG_ENC, "encrypting encryption payload failed, transform missing");
285 return FALSE;
286 }
287
288 rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
289 if (!rng)
290 {
291 DBG1(DBG_ENC, "encrypting encryption payload failed, no RNG found");
292 return FALSE;
293 }
294
295 assoc = append_header(this, assoc);
296
297 generator = generator_create();
298 plain = generate(this, generator);
299 bs = this->aead->get_block_size(this->aead);
300 /* we need at least one byte padding to store the padding length */
301 padding.len = bs - (plain.len % bs);
302 iv.len = this->aead->get_iv_size(this->aead);
303 icv.len = this->aead->get_icv_size(this->aead);
304
305 /* prepare data to authenticate-encrypt:
306 * | IV | plain | padding | ICV |
307 * \____crypt______/ ^
308 * | /
309 * v /
310 * assoc -> + ------->/
311 */
312 free(this->encrypted.ptr);
313 this->encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
314 iv.ptr = this->encrypted.ptr;
315 memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
316 plain.ptr = iv.ptr + iv.len;
317 padding.ptr = plain.ptr + plain.len;
318 icv.ptr = padding.ptr + padding.len;
319 crypt = chunk_create(plain.ptr, plain.len + padding.len);
320 generator->destroy(generator);
321
322 rng->get_bytes(rng, iv.len, iv.ptr);
323 rng->get_bytes(rng, padding.len - 1, padding.ptr);
324 padding.ptr[padding.len - 1] = padding.len - 1;
325 rng->destroy(rng);
326
327 DBG3(DBG_ENC, "encryption payload encryption:");
328 DBG3(DBG_ENC, "IV %B", &iv);
329 DBG3(DBG_ENC, "plain %B", &plain);
330 DBG3(DBG_ENC, "padding %B", &padding);
331 DBG3(DBG_ENC, "assoc %B", &assoc);
332
333 this->aead->encrypt(this->aead, crypt, assoc, iv, NULL);
334
335 DBG3(DBG_ENC, "encrypted %B", &crypt);
336 DBG3(DBG_ENC, "ICV %B", &icv);
337
338 free(assoc.ptr);
339
340 return TRUE;
341 }
342
343 /**
344 * Parse the payloads after decryption.
345 */
346 static status_t parse(private_encryption_payload_t *this, chunk_t plain)
347 {
348 parser_t *parser;
349 payload_type_t type;
350
351 parser = parser_create(plain);
352 type = this->next_payload;
353 while (type != NO_PAYLOAD)
354 {
355 payload_t *payload;
356
357 if (parser->parse_payload(parser, type, &payload) != SUCCESS)
358 {
359 parser->destroy(parser);
360 return PARSE_ERROR;
361 }
362 if (payload->verify(payload) != SUCCESS)
363 {
364 DBG1(DBG_ENC, "%N verification failed",
365 payload_type_names, payload->get_type(payload));
366 payload->destroy(payload);
367 parser->destroy(parser);
368 return VERIFY_ERROR;
369 }
370 type = payload->get_next_type(payload);
371 this->payloads->insert_last(this->payloads, payload);
372 }
373 parser->destroy(parser);
374 DBG2(DBG_ENC, "parsed content of encryption payload");
375 return SUCCESS;
376 }
377
378 METHOD(encryption_payload_t, decrypt, status_t,
379 private_encryption_payload_t *this, chunk_t assoc)
380 {
381 chunk_t iv, plain, padding, icv, crypt;
382 size_t bs;
383
384 if (this->aead == NULL)
385 {
386 DBG1(DBG_ENC, "decrypting encryption payload failed, transform missing");
387 return INVALID_STATE;
388 }
389
390 /* prepare data to authenticate-decrypt:
391 * | IV | plain | padding | ICV |
392 * \____crypt______/ ^
393 * | /
394 * v /
395 * assoc -> + ------->/
396 */
397
398 bs = this->aead->get_block_size(this->aead);
399 iv.len = this->aead->get_iv_size(this->aead);
400 iv.ptr = this->encrypted.ptr;
401 icv.len = this->aead->get_icv_size(this->aead);
402 icv.ptr = this->encrypted.ptr + this->encrypted.len - icv.len;
403 crypt.ptr = iv.ptr + iv.len;
404 crypt.len = this->encrypted.len - iv.len;
405
406 if (iv.len + icv.len > this->encrypted.len ||
407 (crypt.len - icv.len) % bs)
408 {
409 DBG1(DBG_ENC, "decrypting encryption payload failed, invalid length");
410 return FAILED;
411 }
412
413 assoc = append_header(this, assoc);
414
415 DBG3(DBG_ENC, "encryption payload decryption:");
416 DBG3(DBG_ENC, "IV %B", &iv);
417 DBG3(DBG_ENC, "encrypted %B", &crypt);
418 DBG3(DBG_ENC, "ICV %B", &icv);
419 DBG3(DBG_ENC, "assoc %B", &assoc);
420
421 if (!this->aead->decrypt(this->aead, crypt, assoc, iv, NULL))
422 {
423 DBG1(DBG_ENC, "verifying encryption payload integrity failed");
424 free(assoc.ptr);
425 return FAILED;
426 }
427 free(assoc.ptr);
428
429 plain = chunk_create(crypt.ptr, crypt.len - icv.len);
430 padding.len = plain.ptr[plain.len - 1] + 1;
431 if (padding.len > plain.len)
432 {
433 DBG1(DBG_ENC, "decrypting encryption payload failed, "
434 "padding invalid %B", &crypt);
435 return PARSE_ERROR;
436 }
437 plain.len -= padding.len;
438 padding.ptr = plain.ptr + plain.len;
439
440 DBG3(DBG_ENC, "plain %B", &plain);
441 DBG3(DBG_ENC, "padding %B", &padding);
442
443 return parse(this, plain);
444 }
445
446 METHOD(encryption_payload_t, set_transform, void,
447 private_encryption_payload_t *this, aead_t* aead)
448 {
449 this->aead = aead;
450 }
451
452 METHOD2(payload_t, encryption_payload_t, destroy, void,
453 private_encryption_payload_t *this)
454 {
455 this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
456 free(this->encrypted.ptr);
457 free(this);
458 }
459
460 /*
461 * Described in header
462 */
463 encryption_payload_t *encryption_payload_create()
464 {
465 private_encryption_payload_t *this;
466
467 INIT(this,
468 .public = {
469 .payload_interface = {
470 .verify = _verify,
471 .get_encoding_rules = _get_encoding_rules,
472 .get_header_length = _get_header_length,
473 .get_length = _get_length,
474 .get_next_type = _get_next_type,
475 .set_next_type = _set_next_type,
476 .get_type = _get_type,
477 .destroy = _destroy,
478 },
479 .get_length = _get_length,
480 .add_payload = _add_payload,
481 .remove_payload = _remove_payload,
482 .set_transform = _set_transform,
483 .encrypt = _encrypt,
484 .decrypt = _decrypt,
485 .destroy = _destroy,
486 },
487 .next_payload = NO_PAYLOAD,
488 .payload_length = get_header_length(this),
489 .payloads = linked_list_create(),
490 );
491
492 return &this->public;
493 }