Add dedicated getter for the IV size to the crypter_t interface
[strongswan.git] / src / libstrongswan / plugins / openssl / openssl_crypter.c
1 /*
2 * Copyright (C) 2008 Tobias Brunner
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "openssl_crypter.h"
17
18 #include <openssl/evp.h>
19
20 typedef struct private_openssl_crypter_t private_openssl_crypter_t;
21
22 /**
23 * Private data of openssl_crypter_t
24 */
25 struct private_openssl_crypter_t {
26
27 /**
28 * Public part of this class.
29 */
30 openssl_crypter_t public;
31
32 /*
33 * the key
34 */
35 chunk_t key;
36
37 /*
38 * the cipher to use
39 */
40 const EVP_CIPHER *cipher;
41 };
42
43 /**
44 * Mapping from the algorithms defined in IKEv2 to
45 * OpenSSL algorithm names and their key length
46 */
47 typedef struct {
48 /**
49 * Identifier specified in IKEv2
50 */
51 int ikev2_id;
52
53 /**
54 * Name of the algorithm, as used in OpenSSL
55 */
56 char *name;
57
58 /**
59 * Minimum valid key length in bytes
60 */
61 size_t key_size_min;
62
63 /**
64 * Maximum valid key length in bytes
65 */
66 size_t key_size_max;
67 } openssl_algorithm_t;
68
69 #define END_OF_LIST -1
70
71 /**
72 * Algorithms for encryption
73 */
74 static openssl_algorithm_t encryption_algs[] = {
75 /* {ENCR_DES_IV64, "***", 0, 0}, */
76 {ENCR_DES, "des", 8, 8}, /* 64 bits */
77 {ENCR_3DES, "des3", 24, 24}, /* 192 bits */
78 {ENCR_RC5, "rc5", 5, 255}, /* 40 to 2040 bits, RFC 2451 */
79 {ENCR_IDEA, "idea", 16, 16}, /* 128 bits, RFC 2451 */
80 {ENCR_CAST, "cast", 5, 16}, /* 40 to 128 bits, RFC 2451 */
81 {ENCR_BLOWFISH, "blowfish", 5, 56}, /* 40 to 448 bits, RFC 2451 */
82 /* {ENCR_3IDEA, "***", 0, 0}, */
83 /* {ENCR_DES_IV32, "***", 0, 0}, */
84 /* {ENCR_NULL, "***", 0, 0}, */ /* handled separately */
85 /* {ENCR_AES_CBC, "***", 0, 0}, */ /* handled separately */
86 /* {ENCR_CAMELLIA_CBC, "***", 0, 0}, */ /* handled separately */
87 /* {ENCR_AES_CTR, "***", 0, 0}, */ /* disabled in evp.h */
88 {END_OF_LIST, NULL, 0, 0},
89 };
90
91 /**
92 * Look up an OpenSSL algorithm name and validate its key size
93 */
94 static char* lookup_algorithm(openssl_algorithm_t *openssl_algo,
95 u_int16_t ikev2_algo, size_t *key_size)
96 {
97 while (openssl_algo->ikev2_id != END_OF_LIST)
98 {
99 if (ikev2_algo == openssl_algo->ikev2_id)
100 {
101 /* set the key size if it is not set */
102 if (*key_size == 0 &&
103 (openssl_algo->key_size_min == openssl_algo->key_size_max))
104 {
105 *key_size = openssl_algo->key_size_min;
106 }
107
108 /* validate key size */
109 if (*key_size < openssl_algo->key_size_min ||
110 *key_size > openssl_algo->key_size_max)
111 {
112 return NULL;
113 }
114 return openssl_algo->name;
115 }
116 openssl_algo++;
117 }
118 return NULL;
119 }
120
121 /**
122 * Do the actual en/decryption in an EVP context
123 */
124 static void crypt(private_openssl_crypter_t *this, chunk_t data, chunk_t iv,
125 chunk_t *dst, int enc)
126 {
127 int len;
128 u_char *out;
129
130 out = data.ptr;
131 if (dst)
132 {
133 *dst = chunk_alloc(data.len);
134 out = dst->ptr;
135 }
136 EVP_CIPHER_CTX ctx;
137 EVP_CIPHER_CTX_init(&ctx);
138 EVP_CipherInit_ex(&ctx, this->cipher, NULL, NULL, NULL, enc);
139 EVP_CIPHER_CTX_set_padding(&ctx, 0); /* disable padding */
140 EVP_CIPHER_CTX_set_key_length(&ctx, this->key.len);
141 EVP_CipherInit_ex(&ctx, NULL, NULL, this->key.ptr, iv.ptr, enc);
142 EVP_CipherUpdate(&ctx, out, &len, data.ptr, data.len);
143 EVP_CipherFinal_ex(&ctx, out + len, &len); /* since padding is disabled this does nothing */
144 EVP_CIPHER_CTX_cleanup(&ctx);
145 }
146
147 METHOD(crypter_t, decrypt, void,
148 private_openssl_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst)
149 {
150 crypt(this, data, iv, dst, 0);
151 }
152
153 METHOD(crypter_t, encrypt, void,
154 private_openssl_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst)
155 {
156 crypt(this, data, iv, dst, 1);
157 }
158
159 METHOD(crypter_t, get_block_size, size_t,
160 private_openssl_crypter_t *this)
161 {
162 return this->cipher->block_size;
163 }
164
165 METHOD(crypter_t, get_iv_size, size_t,
166 private_openssl_crypter_t *this)
167 {
168 return this->cipher->block_size;
169 }
170
171 METHOD(crypter_t, get_key_size, size_t,
172 private_openssl_crypter_t *this)
173 {
174 return this->key.len;
175 }
176
177 METHOD(crypter_t, set_key, void,
178 private_openssl_crypter_t *this, chunk_t key)
179 {
180 memcpy(this->key.ptr, key.ptr, min(key.len, this->key.len));
181 }
182
183 METHOD(crypter_t, destroy, void,
184 private_openssl_crypter_t *this)
185 {
186 free(this->key.ptr);
187 free(this);
188 }
189
190 /*
191 * Described in header
192 */
193 openssl_crypter_t *openssl_crypter_create(encryption_algorithm_t algo,
194 size_t key_size)
195 {
196 private_openssl_crypter_t *this;
197
198 INIT(this,
199 .public.crypter = {
200 .encrypt = _encrypt,
201 .decrypt = _decrypt,
202 .get_block_size = _get_block_size,
203 .get_iv_size = _get_iv_size,
204 .get_key_size = _get_key_size,
205 .set_key = _set_key,
206 .destroy = _destroy,
207 },
208 );
209
210 switch (algo)
211 {
212 case ENCR_NULL:
213 this->cipher = EVP_enc_null();
214 break;
215 case ENCR_AES_CBC:
216 switch (key_size)
217 {
218 case 16: /* AES 128 */
219 this->cipher = EVP_get_cipherbyname("aes128");
220 break;
221 case 24: /* AES-192 */
222 this->cipher = EVP_get_cipherbyname("aes192");
223 break;
224 case 32: /* AES-256 */
225 this->cipher = EVP_get_cipherbyname("aes256");
226 break;
227 default:
228 free(this);
229 return NULL;
230 }
231 break;
232 case ENCR_CAMELLIA_CBC:
233 switch (key_size)
234 {
235 case 16: /* CAMELLIA 128 */
236 this->cipher = EVP_get_cipherbyname("camellia128");
237 break;
238 case 24: /* CAMELLIA 192 */
239 this->cipher = EVP_get_cipherbyname("camellia192");
240 break;
241 case 32: /* CAMELLIA 256 */
242 this->cipher = EVP_get_cipherbyname("camellia256");
243 break;
244 default:
245 free(this);
246 return NULL;
247 }
248 break;
249 case ENCR_DES_ECB:
250 this->cipher = EVP_des_ecb();
251 break;
252 default:
253 {
254 char* name = lookup_algorithm(encryption_algs, algo, &key_size);
255 if (!name)
256 {
257 /* algo unavailable or key_size invalid */
258 free(this);
259 return NULL;
260 }
261 this->cipher = EVP_get_cipherbyname(name);
262 break;
263 }
264 }
265
266 if (!this->cipher)
267 {
268 /* OpenSSL does not support the requested algo */
269 free(this);
270 return NULL;
271 }
272
273 this->key = chunk_alloc(key_size);
274
275 return &this->public;
276 }