status output of 3DES_CBC without key length
[strongswan.git] / src / pluto / ike_alg.c
index 5056e82..30a69d3 100644 (file)
@@ -22,7 +22,9 @@
 #include <ipsec_policy.h>
 
 #include <library.h>
+#include <debug.h>
 #include <crypto/hashers/hasher.h>
+#include <crypto/crypters/crypter.h>
 #include <crypto/prfs/prf.h>
 
 #include "constants.h"
@@ -42,7 +44,7 @@
 
 #define return_on(var, val) do { var=val;goto return_out; } while(0);
 
-/*
+/**
  * IKE algorithm list handling - registration and lookup
  */
 
 
 static struct ike_alg *ike_alg_base[IKE_ALG_MAX+1] = {NULL, NULL};
 
-/*
- * return ike_algo object by {type, id}
+/**
+ * Return ike_algo object by {type, id}
  */
-static struct ike_alg *
-ike_alg_find(u_int algo_type, u_int algo_id, u_int keysize __attribute__((unused)))
+static struct ike_alg *ike_alg_find(u_int algo_type, u_int algo_id,
+                                                                       u_int keysize __attribute__((unused)))
 {
        struct ike_alg *e = ike_alg_base[algo_type];
 
@@ -65,11 +67,10 @@ ike_alg_find(u_int algo_type, u_int algo_id, u_int keysize __attribute__((unused
        return (e != NULL && e->algo_id == algo_id) ? e : NULL;
 }
 
-/*
+/**
  * "raw" ike_alg list adding function
  */
-int
-ike_alg_add(struct ike_alg* a)
+int ike_alg_add(struct ike_alg* a)
 {
        if (a->algo_type > IKE_ALG_MAX)
        {
@@ -98,105 +99,42 @@ ike_alg_add(struct ike_alg* a)
        }
 }
 
-/*
- * get IKE hash algorithm
+/**
+ * Get IKE hash algorithm
  */
 struct hash_desc *ike_alg_get_hasher(u_int alg)
 {
        return (struct hash_desc *) ike_alg_find(IKE_ALG_HASH, alg, 0);
 }
 
-/*
- * get IKE encryption algorithm
+/**
+ * Get IKE encryption algorithm
  */
 struct encrypt_desc *ike_alg_get_encrypter(u_int alg)
 {
        return (struct encrypt_desc *) ike_alg_find(IKE_ALG_ENCRYPT, alg, 0);
 }
 
-/*
- * check if IKE hash algorithm is present
+/**
+ * Check if IKE hash algorithm is present
  */
-bool
-ike_alg_hash_present(u_int halg)
+bool ike_alg_hash_present(u_int halg)
 {
        return ike_alg_get_hasher(halg) != NULL;
 }
 
-/*
+/**
  * check if IKE encryption algorithm is present
  */
-bool
-ike_alg_enc_present(u_int ealg)
+bool ike_alg_enc_present(u_int ealg)
 {
        return ike_alg_get_encrypter(ealg) != NULL;
 }
 
-/*
- * Validate and register IKE hash algorithm object
- */
-int
-ike_alg_register_hash(struct hash_desc *hash_desc)
-{
-       const char *alg_name = NULL;
-       int ret = 0;
-
-       if (hash_desc->algo_id > OAKLEY_HASH_MAX)
-       {
-               plog ("ike_alg: hash alg=%d > max=%d"
-                               , hash_desc->algo_id, OAKLEY_HASH_MAX);
-               return_on(ret,-EINVAL);
-       }
-
-       alg_name = enum_name(&oakley_hash_names, hash_desc->algo_id);
-       if (!alg_name)
-       {
-               plog ("ike_alg: hash alg=%d not found in constants.c:oakley_hash_names"
-                         , hash_desc->algo_id);
-               alg_name = "<NULL>";
-       }
-
-return_out:
-       if (ret == 0)
-               ret = ike_alg_add((struct ike_alg *)hash_desc);
-
-       plog("ike_alg: Activating %s hash: %s"
-               ,alg_name, ret == 0 ? "Ok" : "FAILED");
-
-       return ret;
-}
-
-/*
- * Validate and register IKE encryption algorithm object
- */
-int
-ike_alg_register_enc(struct encrypt_desc *enc_desc)
-{
-       int ret = ike_alg_add((struct ike_alg *)enc_desc);
-
-       const char *alg_name = enum_name(&oakley_enc_names, enc_desc->algo_id);
-
-       char alg_number[20];
-       
-       /* algorithm is not listed in oakley_enc_names */
-       if (alg_name == NULL)
-       {
-               snprintf(alg_number, sizeof(alg_number), "OAKLEY_ID_%d"
-                       , enc_desc->algo_id);
-               alg_name = alg_number;
-       }
-
-       plog("ike_alg: Activating %s encryption: %s"
-               , alg_name, ret == 0 ? "Ok" : "FAILED");
-
-       return ret;
-}
-
-/*
+/**
  * Get pfsgroup for this connection
  */
-const struct oakley_group_desc *
-ike_alg_pfsgroup(struct connection *c, lset_t policy)
+const struct oakley_group_desc *ike_alg_pfsgroup(struct connection *c, lset_t policy)
 {
        const struct oakley_group_desc * ret = NULL;
 
@@ -207,11 +145,10 @@ ike_alg_pfsgroup(struct connection *c, lset_t policy)
        return ret;
 }
 
-/*
+/**
  * Create an OAKLEY proposal based on alg_info and policy
  */
-struct db_context *
-ike_alg_db_new(struct alg_info_ike *ai , lset_t policy)
+struct db_context *ike_alg_db_new(struct alg_info_ike *ai , lset_t policy)
 {
        struct db_context *db_ctx = NULL;
        struct ike_info *ike_info;
@@ -318,11 +255,10 @@ fail:
        return db_ctx;
 }
 
-/*
+/**
  * Show registered IKE algorithms
  */
-void
-ike_alg_list(void)
+void ike_alg_list(void)
 {
        u_int i;
        struct ike_alg *a;
@@ -374,57 +310,106 @@ ike_alg_list(void)
        }
 }
 
-/*  Show IKE algorithms for
- *    - this connection (result from ike= string)
- *    - newest SA
+/**
+ * Show IKE algorithms for this connection (result from ike= string)
+ * and newest SA
  */
-void
-ike_alg_show_connection(struct connection *c, const char *instance)
+void ike_alg_show_connection(struct connection *c, const char *instance)
 {
-       char buf[256];
-       struct state *st;
+       struct state *st = state_with_serialno(c->newest_isakmp_sa);
 
-       if (c->alg_info_ike)
+       if (st)
        {
-               alg_info_snprint(buf, sizeof(buf)-1, (struct alg_info *)c->alg_info_ike);
-               whack_log(RC_COMMENT
-                               , "\"%s\"%s:   IKE algorithms wanted: %s"
-                               , c->name
-                               , instance
-                               , buf
-               );
+               if (st->st_oakley.encrypt == OAKLEY_3DES_CBC)
+               {
+                       whack_log(RC_COMMENT,
+                                       "\"%s\"%s:   IKE proposal: %s/%s/%s",
+                                       c->name, instance,
+                                       enum_show(&oakley_enc_names, st->st_oakley.encrypt),
+                                       enum_show(&oakley_hash_names, st->st_oakley.hash),
+                                       enum_show(&oakley_group_names, st->st_oakley.group->group)
+                       );
+               }
+               else
+               {
+                       whack_log(RC_COMMENT,
+                                       "\"%s\"%s:   IKE proposal: %s_%u/%s/%s",
+                                       c->name, instance,
+                                       enum_show(&oakley_enc_names, st->st_oakley.encrypt),
+                                       st->st_oakley.enckeylen,
+                                       enum_show(&oakley_hash_names, st->st_oakley.hash),
+                                       enum_show(&oakley_group_names, st->st_oakley.group->group)
+                       );
+               }
+       }
+}
 
-               alg_info_snprint_ike(buf, sizeof(buf)-1, c->alg_info_ike);
-               whack_log(RC_COMMENT
-                               , "\"%s\"%s:   IKE algorithms found:  %s"
-                               , c->name
-                               , instance
-                               , buf
-               );
+/**
+ * Apply a suite of testvectors to an encryption algorithm
+ */
+static bool ike_encrypt_test(const struct encrypt_desc *desc)
+{
+       bool encrypt_results = TRUE;
+
+       if (desc->enc_testvectors == NULL)
+       {
+               plog("  %s encryption self-test not available",
+                        enum_name(&oakley_enc_names, desc->algo_id));
        }
+       else
+       {
+               int i;
+               encryption_algorithm_t enc_alg;
 
-       st = state_with_serialno(c->newest_isakmp_sa);
-       if (st)
-               whack_log(RC_COMMENT
-                               , "\"%s\"%s:   IKE algorithm newest: %s_%d-%s-%s"
-                               , c->name
-                               , instance
-                               , enum_show(&oakley_enc_names, st->st_oakley.encrypt)
-                               +7 /* strlen("OAKLEY_") */
-                               /* , st->st_oakley.encrypter->keydeflen */
-                               , st->st_oakley.enckeylen
-                               , enum_show(&oakley_hash_names, st->st_oakley.hash)
-                               +7 /* strlen("OAKLEY_") */
-                               , enum_show(&oakley_group_names, st->st_oakley.group->group)
-                               +13 /* strlen("OAKLEY_GROUP_") */
-               );
+               enc_alg = oakley_to_encryption_algorithm(desc->algo_id);
+       
+               for (i = 0; desc->enc_testvectors[i].key != NULL; i++)
+               {
+                       bool result;
+                       crypter_t *crypter;
+                       chunk_t key =    { (u_char*)desc->enc_testvectors[i].key,
+                                                                           desc->enc_testvectors[i].key_size };
+                       chunk_t plain =  { (u_char*)desc->enc_testvectors[i].plain,
+                                                                           desc->enc_testvectors[i].data_size};
+                       chunk_t cipher = { (u_char*)desc->enc_testvectors[i].cipher,
+                                                                           desc->enc_testvectors[i].data_size};
+                       chunk_t encrypted = chunk_empty;
+                       chunk_t decrypted = chunk_empty;
+                       chunk_t iv;
+
+                       crypter = lib->crypto->create_crypter(lib->crypto, enc_alg, key.len);
+                       if (crypter == NULL)
+                       {
+                               plog("  %s encryption function not available",
+                                        enum_name(&oakley_enc_names, desc->algo_id));
+                               return FALSE;
+                       }
+                       iv = chunk_create((u_char*)desc->enc_testvectors[i].iv,
+                                                         crypter->get_block_size(crypter));
+                       crypter->set_key(crypter, key);
+                       crypter->decrypt(crypter, cipher, iv, &decrypted);
+                       result = chunk_equals(decrypted, plain);
+                       crypter->encrypt(crypter, plain, iv, &encrypted);
+                       result &= chunk_equals(encrypted, cipher);
+                       DBG(DBG_CRYPT,
+                               DBG_log("  enc testvector %d: %s", i, result ? "ok":"failed")
+                       )
+                       encrypt_results &= result;
+                       crypter->destroy(crypter);
+                       free(encrypted.ptr);
+                       free(decrypted.ptr);
+               }
+               plog("  %s encryption self-test %s",
+                        enum_name(&oakley_enc_names, desc->algo_id),
+                        encrypt_results ? "passed":"failed");
+       }
+       return encrypt_results;
 }
 
-/*
+/**
  * Apply a suite of testvectors to a hash algorithm
  */
-static bool
-ike_hash_test(const struct hash_desc *desc)
+static bool ike_hash_test(const struct hash_desc *desc)
 {
        bool hash_results = TRUE;
        bool hmac_results = TRUE;
@@ -452,7 +437,7 @@ ike_hash_test(const struct hash_desc *desc)
                for (i = 0; desc->hash_testvectors[i].msg_digest != NULL; i++)
                {
                        u_char digest[MAX_DIGEST_LEN];
-                       chunk_t msg = { desc->hash_testvectors[i].msg,
+                       chunk_t msg = { (u_char*)desc->hash_testvectors[i].msg,
                                                        desc->hash_testvectors[i].msg_size };
                        bool result;
 
@@ -483,9 +468,9 @@ ike_hash_test(const struct hash_desc *desc)
                for (i = 0; desc->hmac_testvectors[i].hmac != NULL; i++)
                {
                        u_char digest[MAX_DIGEST_LEN];
-                       chunk_t key = { desc->hmac_testvectors[i].key,
+                       chunk_t key = { (u_char*)desc->hmac_testvectors[i].key,
                                                        desc->hmac_testvectors[i].key_size };
-                       chunk_t msg = { desc->hmac_testvectors[i].msg,
+                       chunk_t msg = { (u_char*)desc->hmac_testvectors[i].msg,
                                                        desc->hmac_testvectors[i].msg_size };
                        prf_t *prf;
                        bool result;
@@ -513,23 +498,22 @@ ike_hash_test(const struct hash_desc *desc)
        return hash_results && hmac_results;
 }
 
-/*
+/**
  * Apply test vectors to registered encryption and hash algorithms
  */
-bool
-ike_alg_test(void)
+bool ike_alg_test(void)
 {
        bool all_results = TRUE;
        struct ike_alg *a;
-
-       plog("Testing registered IKE encryption algorithms:");
+       
+       plog("Testing registered IKE crypto algorithms:");
 
        for (a = ike_alg_base[IKE_ALG_ENCRYPT]; a != NULL; a = a->algo_next)
        {
-               plog("  %s self-test not available", enum_name(&oakley_enc_names, a->algo_id));
-       }
+               struct encrypt_desc *desc = (struct encrypt_desc*)a;
 
-       plog("Testing registered IKE hash algorithms:");
+               all_results &= ike_encrypt_test(desc);
+       }
 
        for (a = ike_alg_base[IKE_ALG_HASH]; a != NULL; a = a->algo_next)
        {
@@ -545,12 +529,11 @@ ike_alg_test(void)
        return all_results;
 }
 
-/*
+/**
  * ML: make F_STRICT logic consider enc,hash/auth,modp algorithms
  */
-bool
-ike_alg_ok_final(u_int ealg, u_int key_len, u_int aalg, u_int group
-, struct alg_info_ike *alg_info_ike)
+bool ike_alg_ok_final(u_int ealg, u_int key_len, u_int aalg, u_int group,
+                                         struct alg_info_ike *alg_info_ike)
 {
        /*
         * simple test to discard low key_len, will accept it only