Moved TLS stack to its own library
[strongswan.git] / src / libtls / tls_protection.c
1 /*
2 * Copyright (C) 2010 Martin Willi
3 * Copyright (C) 2010 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "tls_protection.h"
17
18 #include <debug.h>
19
20 typedef struct private_tls_protection_t private_tls_protection_t;
21
22 /**
23 * Private data of an tls_protection_t object.
24 */
25 struct private_tls_protection_t {
26
27 /**
28 * Public tls_protection_t interface.
29 */
30 tls_protection_t public;
31
32 /**
33 * TLS context
34 */
35 tls_t *tls;
36
37 /**
38 * Upper layer, TLS record compression
39 */
40 tls_compression_t *compression;
41
42 /**
43 * RNG if we generate IVs ourself
44 */
45 rng_t *rng;
46
47 /**
48 * Sequence number of incoming records
49 */
50 u_int32_t seq_in;
51
52 /**
53 * Sequence number for outgoing records
54 */
55 u_int32_t seq_out;
56
57 /**
58 * Signer instance for inbound traffic
59 */
60 signer_t *signer_in;
61
62 /**
63 * Signer instance for outbound traffic
64 */
65 signer_t *signer_out;
66
67 /**
68 * Crypter instance for inbound traffic
69 */
70 crypter_t *crypter_in;
71
72 /**
73 * Crypter instance for outbound traffic
74 */
75 crypter_t *crypter_out;
76
77 /**
78 * Current IV for input decryption
79 */
80 chunk_t iv_in;
81
82 /**
83 * Current IV for output decryption
84 */
85 chunk_t iv_out;
86 };
87
88 /**
89 * Create the header to append to the record data to create the MAC
90 */
91 static chunk_t sigheader(u_int32_t seq, u_int8_t type,
92 u_int16_t version, u_int16_t length)
93 {
94 /* we only support 32 bit sequence numbers, but TLS uses 64 bit */
95 u_int32_t seq_high = 0;
96
97 seq = htonl(seq);
98 version = htons(version);
99 length = htons(length);
100
101 return chunk_cat("ccccc", chunk_from_thing(seq_high),
102 chunk_from_thing(seq), chunk_from_thing(type),
103 chunk_from_thing(version), chunk_from_thing(length));
104 }
105
106 METHOD(tls_protection_t, process, status_t,
107 private_tls_protection_t *this, tls_content_type_t type, chunk_t data)
108 {
109 if (this->crypter_in)
110 {
111 chunk_t iv, next_iv = chunk_empty;
112 u_int8_t bs, padding_length;
113
114 bs = this->crypter_in->get_block_size(this->crypter_in);
115 if (data.len < bs || data.len % bs)
116 {
117 DBG1(DBG_IKE, "encrypted TLS record not multiple of block size");
118 return FAILED;
119 }
120 if (this->iv_in.len)
121 { /* < TLSv1.1 uses IV from key derivation/last block */
122 iv = this->iv_in;
123 next_iv = chunk_clone(chunk_create(data.ptr + data.len - bs, bs));
124 }
125 else
126 { /* TLSv1.1 uses random IVs, prepended to record */
127 iv = chunk_create(data.ptr, bs);
128 data = chunk_skip(data, bs);
129 if (data.len < bs)
130 {
131 DBG1(DBG_IKE, "TLS record too short to decrypt");
132 return FAILED;
133 }
134 }
135 this->crypter_in->decrypt(this->crypter_in, data, iv, NULL);
136
137 if (next_iv.len)
138 { /* next record IV is last ciphertext block of this record */
139 memcpy(this->iv_in.ptr, next_iv.ptr, next_iv.len);
140 free(next_iv.ptr);
141 }
142
143 padding_length = data.ptr[data.len - 1];
144 if (padding_length >= data.len)
145 {
146 DBG1(DBG_IKE, "invalid TLS record padding");
147 return FAILED;
148 }
149 data.len -= padding_length + 1;
150 }
151 if (this->signer_in)
152 {
153 chunk_t mac, macdata, header;
154 u_int8_t bs;
155
156 bs = this->signer_in->get_block_size(this->signer_in);
157 if (data.len <= bs)
158 {
159 DBG1(DBG_IKE, "TLS record too short to verify MAC");
160 return FAILED;
161 }
162 mac = chunk_skip(data, data.len - bs);
163 data.len -= bs;
164
165 header = sigheader(this->seq_in, type,
166 this->tls->get_version(this->tls), data.len);
167 macdata = chunk_cat("mc", header, data);
168 if (!this->signer_in->verify_signature(this->signer_in, macdata, mac))
169 {
170 DBG1(DBG_IKE, "TLS record MAC verification failed");
171 free(macdata.ptr);
172 return FAILED;
173 }
174 free(macdata.ptr);
175 }
176
177 if (type == TLS_CHANGE_CIPHER_SPEC)
178 {
179 this->seq_in = 0;
180 }
181 else
182 {
183 this->seq_in++;
184 }
185 return this->compression->process(this->compression, type, data);
186 }
187
188 METHOD(tls_protection_t, build, status_t,
189 private_tls_protection_t *this, tls_content_type_t *type, chunk_t *data)
190 {
191 status_t status;
192
193 status = this->compression->build(this->compression, type, data);
194 if (*type == TLS_CHANGE_CIPHER_SPEC)
195 {
196 this->seq_out = 0;
197 return status;
198 }
199
200 if (status == NEED_MORE)
201 {
202 if (this->signer_out)
203 {
204 chunk_t mac, header;
205
206 header = sigheader(this->seq_out, *type,
207 this->tls->get_version(this->tls), data->len);
208 this->signer_out->get_signature(this->signer_out, header, NULL);
209 free(header.ptr);
210 this->signer_out->allocate_signature(this->signer_out, *data, &mac);
211 if (this->crypter_out)
212 {
213 chunk_t padding, iv;
214 u_int8_t bs, padding_length;
215
216 bs = this->crypter_out->get_block_size(this->crypter_out);
217 padding_length = bs - ((data->len + mac.len + 1) % bs);
218
219 padding = chunk_alloca(padding_length);
220 memset(padding.ptr, padding_length, padding.len);
221
222 if (this->iv_out.len)
223 { /* < TLSv1.1 uses IV from key derivation/last block */
224 iv = this->iv_out;
225 }
226 else
227 { /* TLSv1.1 uses random IVs, prepended to record */
228 if (!this->rng)
229 {
230 DBG1(DBG_IKE, "no RNG supported to generate TLS IV");
231 free(data->ptr);
232 return FAILED;
233 }
234 this->rng->allocate_bytes(this->rng, bs, &iv);
235 }
236
237 *data = chunk_cat("mmcc", *data, mac, padding,
238 chunk_from_thing(padding_length));
239 /* encrypt inline */
240 this->crypter_out->encrypt(this->crypter_out, *data, iv, NULL);
241
242 if (this->iv_out.len)
243 { /* next record IV is last ciphertext block of this record */
244 memcpy(this->iv_out.ptr, data->ptr - this->iv_out.len,
245 this->iv_out.len);
246 }
247 else
248 { /* prepend IV */
249 *data = chunk_cat("mm", iv, *data);
250 }
251 }
252 else
253 { /* NULL encryption */
254 *data = chunk_cat("mm", *data, mac);
255 }
256 }
257 }
258 this->seq_out++;
259 return status;
260 }
261
262 METHOD(tls_protection_t, set_cipher, void,
263 private_tls_protection_t *this, bool inbound, signer_t *signer,
264 crypter_t *crypter, chunk_t iv)
265 {
266 if (inbound)
267 {
268 this->signer_in = signer;
269 this->crypter_in = crypter;
270 this->iv_in = iv;
271 }
272 else
273 {
274 this->signer_out = signer;
275 this->crypter_out = crypter;
276 this->iv_out = iv;
277 if (!iv.len)
278 { /* generate IVs if none given */
279 this->rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
280 }
281 }
282 }
283
284 METHOD(tls_protection_t, destroy, void,
285 private_tls_protection_t *this)
286 {
287 DESTROY_IF(this->rng);
288 free(this);
289 }
290
291 /**
292 * See header
293 */
294 tls_protection_t *tls_protection_create(tls_t *tls,
295 tls_compression_t *compression)
296 {
297 private_tls_protection_t *this;
298
299 INIT(this,
300 .public = {
301 .process = _process,
302 .build = _build,
303 .set_cipher = _set_cipher,
304 .destroy = _destroy,
305 },
306 .tls = tls,
307 .compression = compression,
308 );
309
310 return &this->public;
311 }