src/libtls/tls_protection.c

   1 /*
   2  * Copyright (C) 2010 Martin Willi
   3  * Copyright (C) 2010 revosec AG
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "tls_protection.h"
  17
  18 #include <debug.h>
  19
  20 typedef struct private_tls_protection_t private_tls_protection_t;
  21
  22 /**
  23  * Private data of an tls_protection_t object.
  24  */
  25 struct private_tls_protection_t {
  26
  27         /**
  28          * Public tls_protection_t interface.
  29          */
  30         tls_protection_t public;
  31
  32         /**
  33          * TLS context
  34          */
  35         tls_t *tls;
  36
  37         /**
  38          * Upper layer, TLS record compression
  39          */
  40         tls_compression_t *compression;
  41
  42         /**
  43          * RNG if we generate IVs ourself
  44          */
  45         rng_t *rng;
  46
  47         /**
  48          * Sequence number of incoming records
  49          */
  50         u_int32_t seq_in;
  51
  52         /**
  53          * Sequence number for outgoing records
  54          */
  55         u_int32_t seq_out;
  56
  57         /**
  58          * Signer instance for inbound traffic
  59          */
  60         signer_t *signer_in;
  61
  62         /**
  63          * Signer instance for outbound traffic
  64          */
  65         signer_t *signer_out;
  66
  67         /**
  68          * Crypter instance for inbound traffic
  69          */
  70         crypter_t *crypter_in;
  71
  72         /**
  73          * Crypter instance for outbound traffic
  74          */
  75         crypter_t *crypter_out;
  76
  77         /**
  78          * Current IV for input decryption
  79          */
  80         chunk_t iv_in;
  81
  82         /**
  83          * Current IV for output decryption
  84          */
  85         chunk_t iv_out;
  86 };
  87
  88 /**
  89  * Create the header to append to the record data to create the MAC
  90  */
  91 static chunk_t sigheader(u_int32_t seq, u_int8_t type,
  92                                                  u_int16_t version, u_int16_t length)
  93 {
  94         /* we only support 32 bit sequence numbers, but TLS uses 64 bit */
  95         u_int32_t seq_high = 0;
  96
  97         seq = htonl(seq);
  98         version = htons(version);
  99         length = htons(length);
 100
 101         return chunk_cat("ccccc", chunk_from_thing(seq_high),
 102                                         chunk_from_thing(seq), chunk_from_thing(type),
 103                                         chunk_from_thing(version), chunk_from_thing(length));
 104 }
 105
 106 METHOD(tls_protection_t, process, status_t,
 107         private_tls_protection_t *this, tls_content_type_t type, chunk_t data)
 108 {
 109         if (this->crypter_in)
 110         {
 111                 chunk_t iv, next_iv = chunk_empty;
 112                 u_int8_t bs, padding_length;
 113
 114                 bs = this->crypter_in->get_block_size(this->crypter_in);
 115                 if (data.len < bs || data.len % bs)
 116                 {
 117                         DBG1(DBG_IKE, "encrypted TLS record not multiple of block size");
 118                         return FAILED;
 119                 }
 120                 if (this->iv_in.len)
 121                 {       /* < TLSv1.1 uses IV from key derivation/last block */
 122                         iv = this->iv_in;
 123                         next_iv = chunk_clone(chunk_create(data.ptr + data.len - bs, bs));
 124                 }
 125                 else
 126                 {       /* TLSv1.1 uses random IVs, prepended to record */
 127                         iv = chunk_create(data.ptr, bs);
 128                         data = chunk_skip(data, bs);
 129                         if (data.len < bs)
 130                         {
 131                                 DBG1(DBG_IKE, "TLS record too short to decrypt");
 132                                 return FAILED;
 133                         }
 134                 }
 135                 this->crypter_in->decrypt(this->crypter_in, data, iv, NULL);
 136
 137                 if (next_iv.len)
 138                 {       /* next record IV is last ciphertext block of this record */
 139                         memcpy(this->iv_in.ptr, next_iv.ptr, next_iv.len);
 140                         free(next_iv.ptr);
 141                 }
 142
 143                 padding_length = data.ptr[data.len - 1];
 144                 if (padding_length >= data.len)
 145                 {
 146                         DBG1(DBG_IKE, "invalid TLS record padding");
 147                         return FAILED;
 148                 }
 149                 data.len -= padding_length + 1;
 150         }
 151         if (this->signer_in)
 152         {
 153                 chunk_t mac, macdata, header;
 154                 u_int8_t bs;
 155
 156                 bs = this->signer_in->get_block_size(this->signer_in);
 157                 if (data.len <= bs)
 158                 {
 159                         DBG1(DBG_IKE, "TLS record too short to verify MAC");
 160                         return FAILED;
 161                 }
 162                 mac = chunk_skip(data, data.len - bs);
 163                 data.len -= bs;
 164
 165                 header = sigheader(this->seq_in, type,
 166                                                    this->tls->get_version(this->tls), data.len);
 167                 macdata = chunk_cat("mc", header, data);
 168                 if (!this->signer_in->verify_signature(this->signer_in, macdata, mac))
 169                 {
 170                         DBG1(DBG_IKE, "TLS record MAC verification failed");
 171                         free(macdata.ptr);
 172                         return FAILED;
 173                 }
 174                 free(macdata.ptr);
 175         }
 176
 177         if (type == TLS_CHANGE_CIPHER_SPEC)
 178         {
 179                 this->seq_in = 0;
 180         }
 181         else
 182         {
 183                 this->seq_in++;
 184         }
 185         return this->compression->process(this->compression, type, data);
 186 }
 187
 188 METHOD(tls_protection_t, build, status_t,
 189         private_tls_protection_t *this, tls_content_type_t *type, chunk_t *data)
 190 {
 191         status_t status;
 192
 193         status = this->compression->build(this->compression, type, data);
 194         if (*type == TLS_CHANGE_CIPHER_SPEC)
 195         {
 196                 this->seq_out = 0;
 197                 return status;
 198         }
 199
 200         if (status == NEED_MORE)
 201         {
 202                 if (this->signer_out)
 203                 {
 204                         chunk_t mac, header;
 205
 206                         header = sigheader(this->seq_out, *type,
 207                                                            this->tls->get_version(this->tls), data->len);
 208                         this->signer_out->get_signature(this->signer_out, header, NULL);
 209                         free(header.ptr);
 210                         this->signer_out->allocate_signature(this->signer_out, *data, &mac);
 211                         if (this->crypter_out)
 212                         {
 213                                 chunk_t padding, iv;
 214                                 u_int8_t bs, padding_length;
 215
 216                                 bs = this->crypter_out->get_block_size(this->crypter_out);
 217                                 padding_length = bs - ((data->len + mac.len + 1) % bs);
 218
 219                                 padding = chunk_alloca(padding_length);
 220                                 memset(padding.ptr, padding_length, padding.len);
 221
 222                                 if (this->iv_out.len)
 223                                 {       /* < TLSv1.1 uses IV from key derivation/last block */
 224                                         iv = this->iv_out;
 225                                 }
 226                                 else
 227                                 {       /* TLSv1.1 uses random IVs, prepended to record */
 228                                         if (!this->rng)
 229                                         {
 230                                                 DBG1(DBG_IKE, "no RNG supported to generate TLS IV");
 231                                                 free(data->ptr);
 232                                                 return FAILED;
 233                                         }
 234                                         this->rng->allocate_bytes(this->rng, bs, &iv);
 235                                 }
 236
 237                                 *data = chunk_cat("mmcc", *data, mac, padding,
 238                                                                   chunk_from_thing(padding_length));
 239                                 /* encrypt inline */
 240                                 this->crypter_out->encrypt(this->crypter_out, *data, iv, NULL);
 241
 242                                 if (this->iv_out.len)
 243                                 {       /* next record IV is last ciphertext block of this record */
 244                                         memcpy(this->iv_out.ptr, data->ptr - this->iv_out.len,
 245                                                    this->iv_out.len);
 246                                 }
 247                                 else
 248                                 {       /* prepend IV */
 249                                         *data = chunk_cat("mm", iv, *data);
 250                                 }
 251                         }
 252                         else
 253                         {       /* NULL encryption */
 254                                 *data = chunk_cat("mm", *data, mac);
 255                         }
 256                 }
 257         }
 258         this->seq_out++;
 259         return status;
 260 }
 261
 262 METHOD(tls_protection_t, set_cipher, void,
 263         private_tls_protection_t *this, bool inbound, signer_t *signer,
 264         crypter_t *crypter, chunk_t iv)
 265 {
 266         if (inbound)
 267         {
 268                 this->signer_in = signer;
 269                 this->crypter_in = crypter;
 270                 this->iv_in = iv;
 271         }
 272         else
 273         {
 274                 this->signer_out = signer;
 275                 this->crypter_out = crypter;
 276                 this->iv_out = iv;
 277                 if (!iv.len)
 278                 {       /* generate IVs if none given */
 279                         this->rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 280                 }
 281         }
 282 }
 283
 284 METHOD(tls_protection_t, destroy, void,
 285         private_tls_protection_t *this)
 286 {
 287         DESTROY_IF(this->rng);
 288         free(this);
 289 }
 290
 291 /**
 292  * See header
 293  */
 294 tls_protection_t *tls_protection_create(tls_t *tls,
 295                                                                                 tls_compression_t *compression)
 296 {
 297         private_tls_protection_t *this;
 298
 299         INIT(this,
 300                 .public = {
 301                         .process = _process,
 302                         .build = _build,
 303                         .set_cipher = _set_cipher,
 304                         .destroy = _destroy,
 305                 },
 306                 .tls = tls,
 307                 .compression = compression,
 308         );
 309
 310         return &this->public;
 311 }