projects / strongswan.git / blob
? search:


eb642109bb7ebd3c48fb3946c5d6660c786b716e
[strongswan.git] / src / libcharon / sa / ikev1 / keymat_v1.c
1 /*
2 * Copyright (C) 2011 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "keymat_v1.h"
17
18 #include <daemon.h>
19 #include <encoding/generator.h>
20 #include <encoding/payloads/nonce_payload.h>
21 #include <collections/linked_list.h>
22
23 typedef struct private_keymat_v1_t private_keymat_v1_t;
24
25 /**
26 * Max. number of IVs to track.
27 */
28 #define MAX_IV 3
29
30 /**
31 * Max. number of Quick Modes to track.
32 */
33 #define MAX_QM 2
34
35 /**
36 * Data stored for IVs
37 */
38 typedef struct {
39 /** message ID */
40 u_int32_t mid;
41 /** current IV */
42 chunk_t iv;
43 /** last block of encrypted message */
44 chunk_t last_block;
45 } iv_data_t;
46
47 /**
48 * Private data of an keymat_t object.
49 */
50 struct private_keymat_v1_t {
51
52 /**
53 * Public keymat_v1_t interface.
54 */
55 keymat_v1_t public;
56
57 /**
58 * IKE_SA Role, initiator or responder
59 */
60 bool initiator;
61
62 /**
63 * General purpose PRF
64 */
65 prf_t *prf;
66
67 /**
68 * PRF to create Phase 1 HASH payloads
69 */
70 prf_t *prf_auth;
71
72 /**
73 * Crypter wrapped in an aead_t interface
74 */
75 aead_t *aead;
76
77 /**
78 * Hasher used for IV generation (and other things like e.g. NAT-T)
79 */
80 hasher_t *hasher;
81
82 /**
83 * Key used for authentication during main mode
84 */
85 chunk_t skeyid;
86
87 /**
88 * Key to derive key material from for non-ISAKMP SAs, rekeying
89 */
90 chunk_t skeyid_d;
91
92 /**
93 * Key used for authentication after main mode
94 */
95 chunk_t skeyid_a;
96
97 /**
98 * Phase 1 IV
99 */
100 iv_data_t phase1_iv;
101
102 /**
103 * Keep track of IVs for exchanges after phase 1. We store only a limited
104 * number of IVs in an MRU sort of way. Stores iv_data_t objects.
105 */
106 linked_list_t *ivs;
107
108 /**
109 * Keep track of Nonces during Quick Mode exchanges. Only a limited number
110 * of QMs are tracked at the same time. Stores qm_data_t objects.
111 */
112 linked_list_t *qms;
113 };
114
115
116 /**
117 * Destroy an iv_data_t object.
118 */
119 static void iv_data_destroy(iv_data_t *this)
120 {
121 chunk_free(&this->last_block);
122 chunk_free(&this->iv);
123 free(this);
124 }
125
126 /**
127 * Data stored for Quick Mode exchanges
128 */
129 typedef struct {
130 /** message ID */
131 u_int32_t mid;
132 /** Ni_b (Nonce from first message) */
133 chunk_t n_i;
134 /** Nr_b (Nonce from second message) */
135 chunk_t n_r;
136 } qm_data_t;
137
138 /**
139 * Destroy a qm_data_t object.
140 */
141 static void qm_data_destroy(qm_data_t *this)
142 {
143 chunk_free(&this->n_i);
144 chunk_free(&this->n_r);
145 free(this);
146 }
147
148 /**
149 * Constants used in key derivation.
150 */
151 static const chunk_t octet_0 = chunk_from_chars(0x00);
152 static const chunk_t octet_1 = chunk_from_chars(0x01);
153 static const chunk_t octet_2 = chunk_from_chars(0x02);
154
155 /**
156 * Simple aead_t implementation without support for authentication.
157 */
158 typedef struct {
159 /** implements aead_t interface */
160 aead_t aead;
161 /** crypter to be used */
162 crypter_t *crypter;
163 } private_aead_t;
164
165
166 METHOD(aead_t, encrypt, bool,
167 private_aead_t *this, chunk_t plain, chunk_t assoc, chunk_t iv,
168 chunk_t *encrypted)
169 {
170 return this->crypter->encrypt(this->crypter, plain, iv, encrypted);
171 }
172
173 METHOD(aead_t, decrypt, bool,
174 private_aead_t *this, chunk_t encrypted, chunk_t assoc, chunk_t iv,
175 chunk_t *plain)
176 {
177 return this->crypter->decrypt(this->crypter, encrypted, iv, plain);
178 }
179
180 METHOD(aead_t, get_block_size, size_t,
181 private_aead_t *this)
182 {
183 return this->crypter->get_block_size(this->crypter);
184 }
185
186 METHOD(aead_t, get_icv_size, size_t,
187 private_aead_t *this)
188 {
189 return 0;
190 }
191
192 METHOD(aead_t, get_iv_size, size_t,
193 private_aead_t *this)
194 {
195 /* in order to create the messages properly we return 0 here */
196 return 0;
197 }
198
199 METHOD(aead_t, get_key_size, size_t,
200 private_aead_t *this)
201 {
202 return this->crypter->get_key_size(this->crypter);
203 }
204
205 METHOD(aead_t, set_key, bool,
206 private_aead_t *this, chunk_t key)
207 {
208 return this->crypter->set_key(this->crypter, key);
209 }
210
211 METHOD(aead_t, aead_destroy, void,
212 private_aead_t *this)
213 {
214 this->crypter->destroy(this->crypter);
215 free(this);
216 }
217
218 /**
219 * Expand SKEYID_e according to Appendix B in RFC 2409.
220 * TODO-IKEv1: verify keys (e.g. for weak keys, see Appendix B)
221 */
222 static bool expand_skeyid_e(chunk_t skeyid_e, size_t key_size, prf_t *prf,
223 chunk_t *ka)
224 {
225 size_t block_size;
226 chunk_t seed;
227 int i;
228
229 if (skeyid_e.len >= key_size)
230 { /* no expansion required, reduce to key_size */
231 skeyid_e.len = key_size;
232 *ka = skeyid_e;
233 return TRUE;
234 }
235 block_size = prf->get_block_size(prf);
236 *ka = chunk_alloc((key_size / block_size + 1) * block_size);
237 ka->len = key_size;
238
239 /* Ka = K1 | K2 | ..., K1 = prf(SKEYID_e, 0), K2 = prf(SKEYID_e, K1) ... */
240 if (!prf->set_key(prf, skeyid_e))
241 {
242 chunk_clear(ka);
243 chunk_clear(&skeyid_e);
244 return FALSE;
245 }
246 seed = octet_0;
247 for (i = 0; i < key_size; i += block_size)
248 {
249 if (!prf->get_bytes(prf, seed, ka->ptr + i))
250 {
251 chunk_clear(ka);
252 chunk_clear(&skeyid_e);
253 return FALSE;
254 }
255 seed = chunk_create(ka->ptr + i, block_size);
256 }
257 chunk_clear(&skeyid_e);
258 return TRUE;
259 }
260
261 /**
262 * Create a simple implementation of the aead_t interface which only encrypts
263 * or decrypts data.
264 */
265 static aead_t *create_aead(proposal_t *proposal, prf_t *prf, chunk_t skeyid_e)
266 {
267 private_aead_t *this;
268 u_int16_t alg, key_size;
269 crypter_t *crypter;
270 chunk_t ka;
271
272 if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &alg,
273 &key_size))
274 {
275 DBG1(DBG_IKE, "no %N selected",
276 transform_type_names, ENCRYPTION_ALGORITHM);
277 return NULL;
278 }
279 crypter = lib->crypto->create_crypter(lib->crypto, alg, key_size / 8);
280 if (!crypter)
281 {
282 DBG1(DBG_IKE, "%N %N (key size %d) not supported!",
283 transform_type_names, ENCRYPTION_ALGORITHM,
284 encryption_algorithm_names, alg, key_size);
285 return NULL;
286 }
287 key_size = crypter->get_key_size(crypter);
288 if (!expand_skeyid_e(skeyid_e, crypter->get_key_size(crypter), prf, &ka))
289 {
290 return NULL;
291 }
292 DBG4(DBG_IKE, "encryption key Ka %B", &ka);
293 if (!crypter->set_key(crypter, ka))
294 {
295 chunk_clear(&ka);
296 return NULL;
297 }
298 chunk_clear(&ka);
299
300 INIT(this,
301 .aead = {
302 .encrypt = _encrypt,
303 .decrypt = _decrypt,
304 .get_block_size = _get_block_size,
305 .get_icv_size = _get_icv_size,
306 .get_iv_size = _get_iv_size,
307 .get_key_size = _get_key_size,
308 .set_key = _set_key,
309 .destroy = _aead_destroy,
310 },
311 .crypter = crypter,
312 );
313 return &this->aead;
314 }
315
316 /**
317 * Converts integrity algorithm to PRF algorithm
318 */
319 static u_int16_t auth_to_prf(u_int16_t alg)
320 {
321 switch (alg)
322 {
323 case AUTH_HMAC_SHA1_96:
324 return PRF_HMAC_SHA1;
325 case AUTH_HMAC_SHA2_256_128:
326 return PRF_HMAC_SHA2_256;
327 case AUTH_HMAC_SHA2_384_192:
328 return PRF_HMAC_SHA2_384;
329 case AUTH_HMAC_SHA2_512_256:
330 return PRF_HMAC_SHA2_512;
331 case AUTH_HMAC_MD5_96:
332 return PRF_HMAC_MD5;
333 case AUTH_AES_XCBC_96:
334 return PRF_AES128_XCBC;
335 default:
336 return PRF_UNDEFINED;
337 }
338 }
339
340 /**
341 * Converts integrity algorithm to hash algorithm
342 */
343 static u_int16_t auth_to_hash(u_int16_t alg)
344 {
345 switch (alg)
346 {
347 case AUTH_HMAC_SHA1_96:
348 return HASH_SHA1;
349 case AUTH_HMAC_SHA2_256_128:
350 return HASH_SHA256;
351 case AUTH_HMAC_SHA2_384_192:
352 return HASH_SHA384;
353 case AUTH_HMAC_SHA2_512_256:
354 return HASH_SHA512;
355 case AUTH_HMAC_MD5_96:
356 return HASH_MD5;
357 default:
358 return HASH_UNKNOWN;
359 }
360 }
361
362 /**
363 * Adjust the key length for PRF algorithms that expect a fixed key length.
364 */
365 static void adjust_keylen(u_int16_t alg, chunk_t *key)
366 {
367 switch (alg)
368 {
369 case PRF_AES128_XCBC:
370 /* while rfc4434 defines variable keys for AES-XCBC, rfc3664 does
371 * not and therefore fixed key semantics apply to XCBC for key
372 * derivation. */
373 key->len = min(key->len, 16);
374 break;
375 default:
376 /* all other algorithms use variable key length */
377 break;
378 }
379 }
380
381 METHOD(keymat_v1_t, derive_ike_keys, bool,
382 private_keymat_v1_t *this, proposal_t *proposal, diffie_hellman_t *dh,
383 chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
384 auth_method_t auth, shared_key_t *shared_key)
385 {
386 chunk_t g_xy, g_xi, g_xr, dh_me, spi_i, spi_r, nonces, data, skeyid_e;
387 chunk_t skeyid;
388 u_int16_t alg;
389
390 spi_i = chunk_alloca(sizeof(u_int64_t));
391 spi_r = chunk_alloca(sizeof(u_int64_t));
392
393 if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &alg, NULL))
394 { /* no PRF negotiated, use HMAC version of integrity algorithm instead */
395 if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL)
396 || (alg = auth_to_prf(alg)) == PRF_UNDEFINED)
397 {
398 DBG1(DBG_IKE, "no %N selected",
399 transform_type_names, PSEUDO_RANDOM_FUNCTION);
400 return FALSE;
401 }
402 }
403 this->prf = lib->crypto->create_prf(lib->crypto, alg);
404 if (!this->prf)
405 {
406 DBG1(DBG_IKE, "%N %N not supported!",
407 transform_type_names, PSEUDO_RANDOM_FUNCTION,
408 pseudo_random_function_names, alg);
409 return FALSE;
410 }
411 if (this->prf->get_block_size(this->prf) <
412 this->prf->get_key_size(this->prf))
413 { /* TODO-IKEv1: support PRF output expansion (RFC 2409, Appendix B) */
414 DBG1(DBG_IKE, "expansion of %N %N output not supported!",
415 transform_type_names, PSEUDO_RANDOM_FUNCTION,
416 pseudo_random_function_names, alg);
417 return FALSE;
418 }
419
420 if (dh->get_shared_secret(dh, &g_xy) != SUCCESS)
421 {
422 return FALSE;
423 }
424 DBG4(DBG_IKE, "shared Diffie Hellman secret %B", &g_xy);
425
426 *((u_int64_t*)spi_i.ptr) = id->get_initiator_spi(id);
427 *((u_int64_t*)spi_r.ptr) = id->get_responder_spi(id);
428 nonces = chunk_cata("cc", nonce_i, nonce_r);
429
430 switch (auth)
431 {
432 case AUTH_PSK:
433 case AUTH_XAUTH_INIT_PSK:
434 { /* SKEYID = prf(pre-shared-key, Ni_b | Nr_b) */
435 chunk_t psk;
436 if (!shared_key)
437 {
438 chunk_clear(&g_xy);
439 return FALSE;
440 }
441 psk = shared_key->get_key(shared_key);
442 adjust_keylen(alg, &psk);
443 if (!this->prf->set_key(this->prf, psk) ||
444 !this->prf->allocate_bytes(this->prf, nonces, &skeyid))
445 {
446 chunk_clear(&g_xy);
447 return FALSE;
448 }
449 break;
450 }
451 case AUTH_RSA:
452 case AUTH_ECDSA_256:
453 case AUTH_ECDSA_384:
454 case AUTH_ECDSA_521:
455 case AUTH_XAUTH_INIT_RSA:
456 case AUTH_XAUTH_RESP_RSA:
457 case AUTH_HYBRID_INIT_RSA:
458 case AUTH_HYBRID_RESP_RSA:
459 {
460 if (!this->prf->set_key(this->prf, nonces) ||
461 !this->prf->allocate_bytes(this->prf, g_xy, &skeyid))
462 {
463 chunk_clear(&g_xy);
464 return FALSE;
465 }
466 break;
467 }
468 default:
469 /* TODO-IKEv1: implement key derivation for other schemes */
470 /* authentication class not supported */
471 chunk_clear(&g_xy);
472 return FALSE;
473 }
474 adjust_keylen(alg, &skeyid);
475 DBG4(DBG_IKE, "SKEYID %B", &skeyid);
476
477 /* SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0) */
478 data = chunk_cat("cccc", g_xy, spi_i, spi_r, octet_0);
479 if (!this->prf->set_key(this->prf, skeyid) ||
480 !this->prf->allocate_bytes(this->prf, data, &this->skeyid_d))
481 {
482 chunk_clear(&g_xy);
483 chunk_clear(&data);
484 return FALSE;
485 }
486 chunk_clear(&data);
487 DBG4(DBG_IKE, "SKEYID_d %B", &this->skeyid_d);
488
489 /* SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1) */
490 data = chunk_cat("ccccc", this->skeyid_d, g_xy, spi_i, spi_r, octet_1);
491 if (!this->prf->allocate_bytes(this->prf, data, &this->skeyid_a))
492 {
493 chunk_clear(&g_xy);
494 chunk_clear(&data);
495 return FALSE;
496 }
497 chunk_clear(&data);
498 DBG4(DBG_IKE, "SKEYID_a %B", &this->skeyid_a);
499
500 /* SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2) */
501 data = chunk_cat("ccccc", this->skeyid_a, g_xy, spi_i, spi_r, octet_2);
502 if (!this->prf->allocate_bytes(this->prf, data, &skeyid_e))
503 {
504 chunk_clear(&g_xy);
505 chunk_clear(&data);
506 return FALSE;
507 }
508 chunk_clear(&data);
509 DBG4(DBG_IKE, "SKEYID_e %B", &skeyid_e);
510
511 chunk_clear(&g_xy);
512
513 switch (auth)
514 {
515 case AUTH_ECDSA_256:
516 alg = PRF_HMAC_SHA2_256;
517 break;
518 case AUTH_ECDSA_384:
519 alg = PRF_HMAC_SHA2_384;
520 break;
521 case AUTH_ECDSA_521:
522 alg = PRF_HMAC_SHA2_512;
523 break;
524 default:
525 /* use proposal algorithm */
526 break;
527 }
528 this->prf_auth = lib->crypto->create_prf(lib->crypto, alg);
529 if (!this->prf_auth)
530 {
531 DBG1(DBG_IKE, "%N %N not supported!",
532 transform_type_names, PSEUDO_RANDOM_FUNCTION,
533 pseudo_random_function_names, alg);
534 chunk_clear(&skeyid);
535 return FALSE;
536 }
537 if (!this->prf_auth->set_key(this->prf_auth, skeyid))
538 {
539 chunk_clear(&skeyid);
540 return FALSE;
541 }
542 chunk_clear(&skeyid);
543
544 this->aead = create_aead(proposal, this->prf, skeyid_e);
545 if (!this->aead)
546 {
547 return FALSE;
548 }
549 if (!this->hasher && !this->public.create_hasher(&this->public, proposal))
550 {
551 return FALSE;
552 }
553
554 dh->get_my_public_value(dh, &dh_me);
555 g_xi = this->initiator ? dh_me : dh_other;
556 g_xr = this->initiator ? dh_other : dh_me;
557
558 /* initial IV = hash(g^xi | g^xr) */
559 data = chunk_cata("cc", g_xi, g_xr);
560 chunk_free(&dh_me);
561 if (!this->hasher->allocate_hash(this->hasher, data, &this->phase1_iv.iv))
562 {
563 return FALSE;
564 }
565 if (this->phase1_iv.iv.len > this->aead->get_block_size(this->aead))
566 {
567 this->phase1_iv.iv.len = this->aead->get_block_size(this->aead);
568 }
569 DBG4(DBG_IKE, "initial IV %B", &this->phase1_iv.iv);
570
571 return TRUE;
572 }
573
574 METHOD(keymat_v1_t, derive_child_keys, bool,
575 private_keymat_v1_t *this, proposal_t *proposal, diffie_hellman_t *dh,
576 u_int32_t spi_i, u_int32_t spi_r, chunk_t nonce_i, chunk_t nonce_r,
577 chunk_t *encr_i, chunk_t *integ_i, chunk_t *encr_r, chunk_t *integ_r)
578 {
579 u_int16_t enc_alg, int_alg, enc_size = 0, int_size = 0;
580 u_int8_t protocol;
581 prf_plus_t *prf_plus;
582 chunk_t seed, secret = chunk_empty;
583 bool success = FALSE;
584
585 if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM,
586 &enc_alg, &enc_size))
587 {
588 DBG2(DBG_CHD, " using %N for encryption",
589 encryption_algorithm_names, enc_alg);
590
591 if (!enc_size)
592 {
593 enc_size = keymat_get_keylen_encr(enc_alg);
594 }
595 if (enc_alg != ENCR_NULL && !enc_size)
596 {
597 DBG1(DBG_CHD, "no keylength defined for %N",
598 encryption_algorithm_names, enc_alg);
599 return FALSE;
600 }
601 /* to bytes */
602 enc_size /= 8;
603
604 /* CCM/GCM/CTR/GMAC needs additional bytes */
605 switch (enc_alg)
606 {
607 case ENCR_AES_CCM_ICV8:
608 case ENCR_AES_CCM_ICV12:
609 case ENCR_AES_CCM_ICV16:
610 case ENCR_CAMELLIA_CCM_ICV8:
611 case ENCR_CAMELLIA_CCM_ICV12:
612 case ENCR_CAMELLIA_CCM_ICV16:
613 enc_size += 3;
614 break;
615 case ENCR_AES_GCM_ICV8:
616 case ENCR_AES_GCM_ICV12:
617 case ENCR_AES_GCM_ICV16:
618 case ENCR_AES_CTR:
619 case ENCR_NULL_AUTH_AES_GMAC:
620 enc_size += 4;
621 break;
622 default:
623 break;
624 }
625 }
626
627 if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM,
628 &int_alg, &int_size))
629 {
630 DBG2(DBG_CHD, " using %N for integrity",
631 integrity_algorithm_names, int_alg);
632
633 if (!int_size)
634 {
635 int_size = keymat_get_keylen_integ(int_alg);
636 }
637 if (!int_size)
638 {
639 DBG1(DBG_CHD, "no keylength defined for %N",
640 integrity_algorithm_names, int_alg);
641 return FALSE;
642 }
643 /* to bytes */
644 int_size /= 8;
645 }
646
647 /* KEYMAT = prf+(SKEYID_d, [ g(qm)^xy | ] protocol | SPI | Ni_b | Nr_b) */
648 if (!this->prf->set_key(this->prf, this->skeyid_d))
649 {
650 return FALSE;
651 }
652 protocol = proposal->get_protocol(proposal);
653 if (dh)
654 {
655 if (dh->get_shared_secret(dh, &secret) != SUCCESS)
656 {
657 return FALSE;
658 }
659 DBG4(DBG_CHD, "DH secret %B", &secret);
660 }
661
662 *encr_r = *integ_r = *encr_i = *integ_i = chunk_empty;
663 seed = chunk_cata("ccccc", secret, chunk_from_thing(protocol),
664 chunk_from_thing(spi_r), nonce_i, nonce_r);
665 DBG4(DBG_CHD, "initiator SA seed %B", &seed);
666
667 prf_plus = prf_plus_create(this->prf, FALSE, seed);
668 if (!prf_plus ||
669 !prf_plus->allocate_bytes(prf_plus, enc_size, encr_i) ||
670 !prf_plus->allocate_bytes(prf_plus, int_size, integ_i))
671 {
672 goto failure;
673 }
674
675 seed = chunk_cata("ccccc", secret, chunk_from_thing(protocol),
676 chunk_from_thing(spi_i), nonce_i, nonce_r);
677 DBG4(DBG_CHD, "responder SA seed %B", &seed);
678 prf_plus->destroy(prf_plus);
679 prf_plus = prf_plus_create(this->prf, FALSE, seed);
680 if (!prf_plus ||
681 !prf_plus->allocate_bytes(prf_plus, enc_size, encr_r) ||
682 !prf_plus->allocate_bytes(prf_plus, int_size, integ_r))
683 {
684 goto failure;
685 }
686
687 if (enc_size)
688 {
689 DBG4(DBG_CHD, "encryption initiator key %B", encr_i);
690 DBG4(DBG_CHD, "encryption responder key %B", encr_r);
691 }
692 if (int_size)
693 {
694 DBG4(DBG_CHD, "integrity initiator key %B", integ_i);
695 DBG4(DBG_CHD, "integrity responder key %B", integ_r);
696 }
697 success = TRUE;
698
699 failure:
700 if (!success)
701 {
702 chunk_clear(encr_i);
703 chunk_clear(integ_i);
704 chunk_clear(encr_r);
705 chunk_clear(integ_r);
706 }
707 DESTROY_IF(prf_plus);
708 chunk_clear(&secret);
709
710 return success;
711 }
712
713 METHOD(keymat_v1_t, create_hasher, bool,
714 private_keymat_v1_t *this, proposal_t *proposal)
715 {
716 u_int16_t alg;
717 if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &alg, NULL) ||
718 (alg = auth_to_hash(alg)) == HASH_UNKNOWN)
719 {
720 DBG1(DBG_IKE, "no %N selected", transform_type_names, HASH_ALGORITHM);
721 return FALSE;
722 }
723 this->hasher = lib->crypto->create_hasher(lib->crypto, alg);
724 if (!this->hasher)
725 {
726 DBG1(DBG_IKE, "%N %N not supported!",
727 transform_type_names, HASH_ALGORITHM,
728 hash_algorithm_names, alg);
729 return FALSE;
730 }
731 return TRUE;
732 }
733
734 METHOD(keymat_v1_t, get_hasher, hasher_t*,
735 private_keymat_v1_t *this)
736 {
737 return this->hasher;
738 }
739
740 METHOD(keymat_v1_t, get_hash, bool,
741 private_keymat_v1_t *this, bool initiator, chunk_t dh, chunk_t dh_other,
742 ike_sa_id_t *ike_sa_id, chunk_t sa_i, chunk_t id, chunk_t *hash)
743 {
744 chunk_t data;
745 u_int64_t spi, spi_other;
746
747 /* HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b )
748 * HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b )
749 */
750 if (initiator)
751 {
752 spi = ike_sa_id->get_initiator_spi(ike_sa_id);
753 spi_other = ike_sa_id->get_responder_spi(ike_sa_id);
754 }
755 else
756 {
757 spi_other = ike_sa_id->get_initiator_spi(ike_sa_id);
758 spi = ike_sa_id->get_responder_spi(ike_sa_id);
759 }
760 data = chunk_cat("cccccc", dh, dh_other,
761 chunk_from_thing(spi), chunk_from_thing(spi_other),
762 sa_i, id);
763
764 DBG3(DBG_IKE, "HASH_%c data %B", initiator ? 'I' : 'R', &data);
765
766 if (!this->prf_auth->allocate_bytes(this->prf_auth, data, hash))
767 {
768 free(data.ptr);
769 return FALSE;
770 }
771
772 DBG3(DBG_IKE, "HASH_%c %B", initiator ? 'I' : 'R', hash);
773
774 free(data.ptr);
775 return TRUE;
776 }
777
778 /**
779 * Get the nonce value found in the given message.
780 * Returns FALSE if none is found.
781 */
782 static bool get_nonce(message_t *message, chunk_t *n)
783 {
784 nonce_payload_t *nonce;
785 nonce = (nonce_payload_t*)message->get_payload(message, NONCE_V1);
786 if (nonce)
787 {
788 *n = nonce->get_nonce(nonce);
789 return TRUE;
790 }
791 return FALSE;
792 }
793
794 /**
795 * Generate the message data in order to generate the hashes.
796 */
797 static chunk_t get_message_data(message_t *message, generator_t *generator)
798 {
799 payload_t *payload, *next;
800 enumerator_t *enumerator;
801 u_int32_t *lenpos;
802
803 if (message->is_encoded(message))
804 { /* inbound, although the message is generated, we cannot access the
805 * cleartext message data, so generate it anyway */
806 enumerator = message->create_payload_enumerator(message);
807 while (enumerator->enumerate(enumerator, &payload))
808 {
809 if (payload->get_type(payload) == HASH_V1)
810 {
811 continue;
812 }
813 generator->generate_payload(generator, payload);
814 }
815 enumerator->destroy(enumerator);
816 }
817 else
818 {
819 /* outbound, generate the payloads (there is no HASH payload yet) */
820 enumerator = message->create_payload_enumerator(message);
821 if (enumerator->enumerate(enumerator, &payload))
822 {
823 while (enumerator->enumerate(enumerator, &next))
824 {
825 payload->set_next_type(payload, next->get_type(next));
826 generator->generate_payload(generator, payload);
827 payload = next;
828 }
829 payload->set_next_type(payload, NO_PAYLOAD);
830 generator->generate_payload(generator, payload);
831 }
832 enumerator->destroy(enumerator);
833 }
834 return generator->get_chunk(generator, &lenpos);
835 }
836
837 /**
838 * Try to find data about a Quick Mode with the given message ID,
839 * if none is found, state is generated.
840 */
841 static qm_data_t *lookup_quick_mode(private_keymat_v1_t *this, u_int32_t mid)
842 {
843 enumerator_t *enumerator;
844 qm_data_t *qm, *found = NULL;
845
846 enumerator = this->qms->create_enumerator(this->qms);
847 while (enumerator->enumerate(enumerator, &qm))
848 {
849 if (qm->mid == mid)
850 { /* state gets moved to the front of the list */
851 this->qms->remove_at(this->qms, enumerator);
852 found = qm;
853 break;
854 }
855 }
856 enumerator->destroy(enumerator);
857 if (!found)
858 {
859 INIT(found,
860 .mid = mid,
861 );
862 }
863 this->qms->insert_first(this->qms, found);
864 /* remove least recently used state if maximum reached */
865 if (this->qms->get_count(this->qms) > MAX_QM &&
866 this->qms->remove_last(this->qms, (void**)&qm) == SUCCESS)
867 {
868 qm_data_destroy(qm);
869 }
870 return found;
871 }
872
873 METHOD(keymat_v1_t, get_hash_phase2, bool,
874 private_keymat_v1_t *this, message_t *message, chunk_t *hash)
875 {
876 u_int32_t mid, mid_n;
877 chunk_t data = chunk_empty;
878 bool add_message = TRUE;
879 char *name = "Hash";
880
881 if (!this->prf)
882 { /* no keys derived yet */
883 return FALSE;
884 }
885
886 mid = message->get_message_id(message);
887 mid_n = htonl(mid);
888
889 /* Hashes are simple for most exchanges in Phase 2:
890 * Hash = prf(SKEYID_a, M-ID | Complete message after HASH payload)
891 * For Quick Mode there are three hashes:
892 * Hash(1) = same as above
893 * Hash(2) = prf(SKEYID_a, M-ID | Ni_b | Message after HASH payload)
894 * Hash(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b)
895 * So, for Quick Mode we keep track of the nonce values.
896 */
897 switch (message->get_exchange_type(message))
898 {
899 case QUICK_MODE:
900 {
901 qm_data_t *qm = lookup_quick_mode(this, mid);
902 if (!qm->n_i.ptr)
903 { /* Hash(1) = prf(SKEYID_a, M-ID | Message after HASH payload) */
904 name = "Hash(1)";
905 if (!get_nonce(message, &qm->n_i))
906 {
907 return FALSE;
908 }
909 data = chunk_from_thing(mid_n);
910 }
911 else if (!qm->n_r.ptr)
912 { /* Hash(2) = prf(SKEYID_a, M-ID | Ni_b | Message after HASH) */
913 name = "Hash(2)";
914 if (!get_nonce(message, &qm->n_r))
915 {
916 return FALSE;
917 }
918 data = chunk_cata("cc", chunk_from_thing(mid_n), qm->n_i);
919 }
920 else
921 { /* Hash(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
922 name = "Hash(3)";
923 data = chunk_cata("cccc", octet_0, chunk_from_thing(mid_n),
924 qm->n_i, qm->n_r);
925 add_message = FALSE;
926 /* we don't need the state anymore */
927 this->qms->remove(this->qms, qm, NULL);
928 qm_data_destroy(qm);
929 }
930 break;
931 }
932 case TRANSACTION:
933 case INFORMATIONAL_V1:
934 /* Hash = prf(SKEYID_a, M-ID | Message after HASH payload) */
935 data = chunk_from_thing(mid_n);
936 break;
937 default:
938 return FALSE;
939 }
940 if (!this->prf->set_key(this->prf, this->skeyid_a))
941 {
942 return FALSE;
943 }
944 if (add_message)
945 {
946 generator_t *generator;
947 chunk_t msg;
948
949 generator = generator_create_no_dbg();
950 msg = get_message_data(message, generator);
951 if (!this->prf->allocate_bytes(this->prf, data, NULL) ||
952 !this->prf->allocate_bytes(this->prf, msg, hash))
953 {
954 generator->destroy(generator);
955 return FALSE;
956 }
957 generator->destroy(generator);
958 }
959 else
960 {
961 if (!this->prf->allocate_bytes(this->prf, data, hash))
962 {
963 return FALSE;
964 }
965 }
966 DBG3(DBG_IKE, "%s %B", name, hash);
967 return TRUE;
968 }
969
970 /**
971 * Generate an IV
972 */
973 static bool generate_iv(private_keymat_v1_t *this, iv_data_t *iv)
974 {
975 if (iv->mid == 0 || iv->iv.ptr)
976 { /* use last block of previous encrypted message */
977 chunk_free(&iv->iv);
978 iv->iv = iv->last_block;
979 iv->last_block = chunk_empty;
980 }
981 else
982 {
983 /* initial phase 2 IV = hash(last_phase1_block | mid) */
984 u_int32_t net;;
985 chunk_t data;
986
987 net = htonl(iv->mid);
988 data = chunk_cata("cc", this->phase1_iv.iv, chunk_from_thing(net));
989 if (!this->hasher->allocate_hash(this->hasher, data, &iv->iv))
990 {
991 return FALSE;
992 }
993 if (iv->iv.len > this->aead->get_block_size(this->aead))
994 {
995 iv->iv.len = this->aead->get_block_size(this->aead);
996 }
997 }
998 DBG4(DBG_IKE, "next IV for MID %u %B", iv->mid, &iv->iv);
999 return TRUE;
1000 }
1001
1002 /**
1003 * Try to find an IV for the given message ID, if not found, generate it.
1004 */
1005 static iv_data_t *lookup_iv(private_keymat_v1_t *this, u_int32_t mid)
1006 {
1007 enumerator_t *enumerator;
1008 iv_data_t *iv, *found = NULL;
1009
1010 if (mid == 0)
1011 {
1012 return &this->phase1_iv;
1013 }
1014
1015 enumerator = this->ivs->create_enumerator(this->ivs);
1016 while (enumerator->enumerate(enumerator, &iv))
1017 {
1018 if (iv->mid == mid)
1019 { /* IV gets moved to the front of the list */
1020 this->ivs->remove_at(this->ivs, enumerator);
1021 found = iv;
1022 break;
1023 }
1024 }
1025 enumerator->destroy(enumerator);
1026 if (!found)
1027 {
1028 INIT(found,
1029 .mid = mid,
1030 );
1031 if (!generate_iv(this, found))
1032 {
1033 iv_data_destroy(found);
1034 return NULL;
1035 }
1036 }
1037 this->ivs->insert_first(this->ivs, found);
1038 /* remove least recently used IV if maximum reached */
1039 if (this->ivs->get_count(this->ivs) > MAX_IV &&
1040 this->ivs->remove_last(this->ivs, (void**)&iv) == SUCCESS)
1041 {
1042 iv_data_destroy(iv);
1043 }
1044 return found;
1045 }
1046
1047 METHOD(keymat_v1_t, get_iv, bool,
1048 private_keymat_v1_t *this, u_int32_t mid, chunk_t *out)
1049 {
1050 iv_data_t *iv;
1051
1052 iv = lookup_iv(this, mid);
1053 if (iv)
1054 {
1055 *out = iv->iv;
1056 return TRUE;
1057 }
1058 return FALSE;
1059 }
1060
1061 METHOD(keymat_v1_t, update_iv, bool,
1062 private_keymat_v1_t *this, u_int32_t mid, chunk_t last_block)
1063 {
1064 iv_data_t *iv = lookup_iv(this, mid);
1065 if (iv)
1066 { /* update last block */
1067 chunk_free(&iv->last_block);
1068 iv->last_block = chunk_clone(last_block);
1069 return TRUE;
1070 }
1071 return FALSE;
1072 }
1073
1074 METHOD(keymat_v1_t, confirm_iv, bool,
1075 private_keymat_v1_t *this, u_int32_t mid)
1076 {
1077 iv_data_t *iv = lookup_iv(this, mid);
1078 if (iv)
1079 {
1080 return generate_iv(this, iv);
1081 }
1082 return FALSE;
1083 }
1084
1085 METHOD(keymat_t, get_version, ike_version_t,
1086 private_keymat_v1_t *this)
1087 {
1088 return IKEV1;
1089 }
1090
1091 METHOD(keymat_t, create_dh, diffie_hellman_t*,
1092 private_keymat_v1_t *this, diffie_hellman_group_t group)
1093 {
1094 return lib->crypto->create_dh(lib->crypto, group);
1095 }
1096
1097 METHOD(keymat_t, create_nonce_gen, nonce_gen_t*,
1098 private_keymat_v1_t *this)
1099 {
1100 return lib->crypto->create_nonce_gen(lib->crypto);
1101 }
1102
1103 METHOD(keymat_t, get_aead, aead_t*,
1104 private_keymat_v1_t *this, bool in)
1105 {
1106 return this->aead;
1107 }
1108
1109 METHOD(keymat_t, destroy, void,
1110 private_keymat_v1_t *this)
1111 {
1112 DESTROY_IF(this->prf);
1113 DESTROY_IF(this->prf_auth);
1114 DESTROY_IF(this->aead);
1115 DESTROY_IF(this->hasher);
1116 chunk_clear(&this->skeyid_d);
1117 chunk_clear(&this->skeyid_a);
1118 chunk_free(&this->phase1_iv.iv);
1119 chunk_free(&this->phase1_iv.last_block);
1120 this->ivs->destroy_function(this->ivs, (void*)iv_data_destroy);
1121 this->qms->destroy_function(this->qms, (void*)qm_data_destroy);
1122 free(this);
1123 }
1124
1125 /**
1126 * See header
1127 */
1128 keymat_v1_t *keymat_v1_create(bool initiator)
1129 {
1130 private_keymat_v1_t *this;
1131
1132 INIT(this,
1133 .public = {
1134 .keymat = {
1135 .get_version = _get_version,
1136 .create_dh = _create_dh,
1137 .create_nonce_gen = _create_nonce_gen,
1138 .get_aead = _get_aead,
1139 .destroy = _destroy,
1140 },
1141 .derive_ike_keys = _derive_ike_keys,
1142 .derive_child_keys = _derive_child_keys,
1143 .create_hasher = _create_hasher,
1144 .get_hasher = _get_hasher,
1145 .get_hash = _get_hash,
1146 .get_hash_phase2 = _get_hash_phase2,
1147 .get_iv = _get_iv,
1148 .update_iv = _update_iv,
1149 .confirm_iv = _confirm_iv,
1150 },
1151 .ivs = linked_list_create(),
1152 .qms = linked_list_create(),
1153 .initiator = initiator,
1154 );
1155
1156 return &this->public;
1157 }
strongSwan - IPsec VPN