removing svn keyword $Id$ from all files
[strongswan.git] / src / libstrongswan / plugins / openssl / openssl_crypter.c
1 /*
2 * Copyright (C) 2008 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "openssl_crypter.h"
17
18 #include <openssl/evp.h>
19
20 typedef struct private_openssl_crypter_t private_openssl_crypter_t;
21
22 /**
23 * Private data of openssl_crypter_t
24 */
25 struct private_openssl_crypter_t {
26
27 /**
28 * Public part of this class.
29 */
30 openssl_crypter_t public;
31
32 /*
33 * the key
34 */
35 chunk_t key;
36
37 /*
38 * the cipher to use
39 */
40 const EVP_CIPHER *cipher;
41 };
42
43 /**
44 * Mapping from the algorithms defined in IKEv2 to
45 * OpenSSL algorithm names and their key length
46 */
47 typedef struct {
48 /**
49 * Identifier specified in IKEv2
50 */
51 int ikev2_id;
52
53 /**
54 * Name of the algorithm, as used in OpenSSL
55 */
56 char *name;
57
58 /**
59 * Minimum valid key length in bytes
60 */
61 size_t key_size_min;
62
63 /**
64 * Maximum valid key length in bytes
65 */
66 size_t key_size_max;
67 } openssl_algorithm_t;
68
69 #define END_OF_LIST -1
70
71 /**
72 * Algorithms for encryption
73 */
74 static openssl_algorithm_t encryption_algs[] = {
75 /* {ENCR_DES_IV64, "***", 0, 0}, */
76 {ENCR_DES, "des", 8, 8}, /* 64 bits */
77 {ENCR_3DES, "des3", 24, 24}, /* 192 bits */
78 {ENCR_RC5, "rc5", 5, 255}, /* 40 to 2040 bits, RFC 2451 */
79 {ENCR_IDEA, "idea", 16, 16}, /* 128 bits, RFC 2451 */
80 {ENCR_CAST, "cast", 5, 16}, /* 40 to 128 bits, RFC 2451 */
81 {ENCR_BLOWFISH, "blowfish", 5, 56}, /* 40 to 448 bits, RFC 2451 */
82 /* {ENCR_3IDEA, "***", 0, 0}, */
83 /* {ENCR_DES_IV32, "***", 0, 0}, */
84 /* {ENCR_NULL, "***", 0, 0}, */ /* handled separately */
85 /* {ENCR_AES_CBC, "***", 0, 0}, */ /* handled separately */
86 /* {ENCR_AES_CTR, "***", 0, 0}, */ /* disabled in evp.h */
87 {END_OF_LIST, NULL, 0, 0},
88 };
89
90 /**
91 * Look up an OpenSSL algorithm name and validate its key size
92 */
93 static char* lookup_algorithm(openssl_algorithm_t *openssl_algo,
94 u_int16_t ikev2_algo, size_t *key_size)
95 {
96 while (openssl_algo->ikev2_id != END_OF_LIST)
97 {
98 if (ikev2_algo == openssl_algo->ikev2_id)
99 {
100 /* set the key size if it is not set */
101 if (*key_size == 0 &&
102 (openssl_algo->key_size_min == openssl_algo->key_size_max))
103 {
104 *key_size = openssl_algo->key_size_min;
105 }
106
107 /* validate key size */
108 if (*key_size < openssl_algo->key_size_min ||
109 *key_size > openssl_algo->key_size_max)
110 {
111 return NULL;
112 }
113 return openssl_algo->name;
114 }
115 openssl_algo++;
116 }
117 return NULL;
118 }
119
120 static void crypt(private_openssl_crypter_t *this, chunk_t data,
121 chunk_t iv, chunk_t *dst, int enc)
122 {
123 int len;
124 u_char *out;
125
126 out = data.ptr;
127 if (dst)
128 {
129 *dst = chunk_alloc(data.len);
130 out = dst->ptr;
131 }
132 EVP_CIPHER_CTX ctx;
133 EVP_CIPHER_CTX_init(&ctx);
134 EVP_CipherInit_ex(&ctx, this->cipher, NULL, this->key.ptr, iv.ptr, enc);
135 EVP_CIPHER_CTX_set_padding(&ctx, 0); /* disable padding */
136 EVP_CipherUpdate(&ctx, out, &len, data.ptr, data.len);
137 EVP_CipherFinal_ex(&ctx, out, &len); /* since padding is disabled this does nothing */
138 EVP_CIPHER_CTX_cleanup(&ctx);
139 }
140
141 /**
142 * Implementation of crypter_t.decrypt.
143 */
144 static void decrypt(private_openssl_crypter_t *this, chunk_t data,
145 chunk_t iv, chunk_t *dst)
146 {
147 crypt(this, data, iv, dst, 0);
148 }
149
150
151 /**
152 * Implementation of crypter_t.encrypt.
153 */
154 static void encrypt (private_openssl_crypter_t *this, chunk_t data,
155 chunk_t iv, chunk_t *dst)
156 {
157 crypt(this, data, iv, dst, 1);
158 }
159
160 /**
161 * Implementation of crypter_t.get_block_size.
162 */
163 static size_t get_block_size(private_openssl_crypter_t *this)
164 {
165 return this->cipher->block_size;
166 }
167
168 /**
169 * Implementation of crypter_t.get_key_size.
170 */
171 static size_t get_key_size(private_openssl_crypter_t *this)
172 {
173 return this->key.len;
174 }
175
176 /**
177 * Implementation of crypter_t.set_key.
178 */
179 static void set_key(private_openssl_crypter_t *this, chunk_t key)
180 {
181 memcpy(this->key.ptr, key.ptr, min(key.len, this->key.len));
182 }
183
184 /**
185 * Implementation of crypter_t.destroy.
186 */
187 static void destroy (private_openssl_crypter_t *this)
188 {
189 free(this->key.ptr);
190 free(this);
191 }
192
193 /*
194 * Described in header
195 */
196 openssl_crypter_t *openssl_crypter_create(encryption_algorithm_t algo,
197 size_t key_size)
198 {
199 private_openssl_crypter_t *this;
200
201 this = malloc_thing(private_openssl_crypter_t);
202
203 switch (algo)
204 {
205 case ENCR_NULL:
206 this->cipher = EVP_enc_null();
207 break;
208 case ENCR_AES_CBC:
209 switch (key_size)
210 {
211 case 16: /* AES 128 */
212 this->cipher = EVP_get_cipherbyname("aes128");
213 break;
214 case 24: /* AES-192 */
215 this->cipher = EVP_get_cipherbyname("aes192");
216 break;
217 case 32: /* AES-256 */
218 this->cipher = EVP_get_cipherbyname("aes256");
219 break;
220 default:
221 free(this);
222 return NULL;
223 }
224 break;
225 case ENCR_DES_ECB:
226 this->cipher = EVP_des_ecb();
227 break;
228 default:
229 {
230 char* name = lookup_algorithm(encryption_algs, algo, &key_size);
231 if (!name)
232 {
233 /* algo unavailable or key_size invalid */
234 free(this);
235 return NULL;
236 }
237 this->cipher = EVP_get_cipherbyname(name);
238 break;
239 }
240 }
241
242 if (!this->cipher)
243 {
244 /* OpenSSL does not support the requested algo */
245 free(this);
246 return NULL;
247 }
248
249 this->key = chunk_alloc(key_size);
250
251 this->public.crypter_interface.encrypt = (void (*) (crypter_t *, chunk_t,chunk_t, chunk_t *)) encrypt;
252 this->public.crypter_interface.decrypt = (void (*) (crypter_t *, chunk_t , chunk_t, chunk_t *)) decrypt;
253 this->public.crypter_interface.get_block_size = (size_t (*) (crypter_t *)) get_block_size;
254 this->public.crypter_interface.get_key_size = (size_t (*) (crypter_t *)) get_key_size;
255 this->public.crypter_interface.set_key = (void (*) (crypter_t *,chunk_t)) set_key;
256 this->public.crypter_interface.destroy = (void (*) (crypter_t *)) destroy;
257
258 return &this->public;
259 }