--- /dev/null
+/*
+ * Copyright (C) 2014 Tobias Brunner
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup encrypted_fragment_payload encrypted_fragment_payload
+ * @{ @ingroup payloads
+ */
+
+#ifndef ENCRYPTED_FRAGMENT_PAYLOAD_H_
+#define ENCRYPTED_FRAGMENT_PAYLOAD_H_
+
+typedef struct encrypted_fragment_payload_t encrypted_fragment_payload_t;
+
+#include <encoding/payloads/encrypted_payload.h>
+
+/**
+ * The Encrypted Fragment Payload as described in RFC 7383
+ *
+ * The implementation is located in encrypted_payload.c as it is very similar.
+ */
+struct encrypted_fragment_payload_t {
+
+ /**
+ * Implements payload_t interface.
+ */
+ encrypted_payload_t encrypted;
+
+ /**
+ * Get the fragment number.
+ *
+ * @return fragment number
+ */
+ u_int16_t (*get_fragment_number)(encrypted_fragment_payload_t *this);
+
+ /**
+ * Get the total number of fragments.
+ *
+ * @return total number of fragments
+ */
+ u_int16_t (*get_total_fragments)(encrypted_fragment_payload_t *this);
+
+ /**
+ * Get the (decrypted) content of this payload.
+ *
+ * @return internal payload data
+ */
+ chunk_t (*get_content)(encrypted_fragment_payload_t *this);
+
+ /**
+ * Destroys an encrypted_fragment_payload_t object.
+ */
+ void (*destroy)(encrypted_fragment_payload_t *this);
+};
+
+/**
+ * Creates an empty encrypted_fragment_payload_t object.
+ *
+ * @return encrypted_fragment_payload_t object
+ */
+encrypted_fragment_payload_t *encrypted_fragment_payload_create();
+
+/**
+ * Creates an encrypted fragment payload from the given data.
+ *
+ * @param num fragment number (first one should be 1)
+ * @param total total number of fragments
+ * @param data fragment data (gets cloned)
+ * @return encrypted_fragment_payload_t object
+ */
+encrypted_fragment_payload_t *encrypted_fragment_payload_create_from_data(
+ u_int16_t num, u_int16_t total, chunk_t data);
+
+#endif /** ENCRYPTED_FRAGMENT_PAYLOAD_H_ @}*/
#include <string.h>
#include "encrypted_payload.h"
+#include "encrypted_fragment_payload.h"
#include <daemon.h>
#include <encoding/payloads/encodings.h>
#include <encoding/parser.h>
typedef struct private_encrypted_payload_t private_encrypted_payload_t;
+typedef struct private_encrypted_fragment_payload_t private_encrypted_fragment_payload_t;
struct private_encrypted_payload_t {
payload_type_t type;
};
+struct private_encrypted_fragment_payload_t {
+
+ /**
+ * Public interface.
+ */
+ encrypted_fragment_payload_t public;
+
+ /**
+ * The first fragment contains the type of the first payload contained in
+ * the original encrypted payload, for all other fragments it MUST be set
+ * to zero.
+ */
+ u_int8_t next_payload;
+
+ /**
+ * Flags, including reserved bits
+ */
+ u_int8_t flags;
+
+ /**
+ * Length of this payload
+ */
+ u_int16_t payload_length;
+
+ /**
+ * Chunk containing the IV, plain, padding and ICV.
+ */
+ chunk_t encrypted;
+
+ /**
+ * Fragment number
+ */
+ u_int16_t fragment_number;
+
+ /**
+ * Total fragments
+ */
+ u_int16_t total_fragments;
+
+ /**
+ * AEAD transform to use
+ */
+ aead_t *aead;
+
+ /**
+ * Chunk containing the plain packet data.
+ */
+ chunk_t plain;
+};
+
/**
* Encoding rules to parse or generate a IKEv2-Encrypted Payload.
*
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
+/**
+ * Encoding rules to parse or generate an IKEv2-Encrypted Fragment Payload.
+ *
+ * The defined offsets are the positions in a object of type
+ * private_encrypted_payload_t.
+ */
+static encoding_rule_t encodings_fragment[] = {
+ /* 1 Byte next payload type, stored in the field next_payload */
+ { U_INT_8, offsetof(private_encrypted_fragment_payload_t, next_payload) },
+ /* Critical and 7 reserved bits, all stored for reconstruction */
+ { U_INT_8, offsetof(private_encrypted_fragment_payload_t, flags) },
+ /* Length of the whole encryption payload*/
+ { PAYLOAD_LENGTH, offsetof(private_encrypted_fragment_payload_t, payload_length) },
+ /* Fragment number */
+ { U_INT_16, offsetof(private_encrypted_fragment_payload_t, fragment_number) },
+ /* Total number of fragments */
+ { U_INT_16, offsetof(private_encrypted_fragment_payload_t, total_fragments) },
+ /* encrypted data, stored in a chunk. contains iv, data, padding */
+ { CHUNK_DATA, offsetof(private_encrypted_fragment_payload_t, encrypted) },
+};
+
+/*
+ 1 2 3
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ ! Next Payload !C! RESERVED ! Payload Length !
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ ! Fragment Number | Total Fragments !
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ ! Initialization Vector !
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ ! Encrypted IKE Payloads !
+ + +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ ! ! Padding (0-255 octets) !
+ +-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+
+ ! ! Pad Length !
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+ ~ Integrity Checksum Data ~
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+*/
+
METHOD(payload_t, verify, status_t,
private_encrypted_payload_t *this)
{
return &this->public;
}
+
+METHOD(payload_t, frag_verify, status_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ if (!this->fragment_number || !this->total_fragments ||
+ this->fragment_number > this->total_fragments)
+ {
+ DBG1(DBG_ENC, "invalid fragment number (%u) or total fragments (%u)",
+ this->fragment_number, this->total_fragments);
+ return FAILED;
+ }
+ if (this->fragment_number > 1 && this->next_payload != 0)
+ {
+ DBG1(DBG_ENC, "invalid next payload (%u) for fragment %u, ignored",
+ this->next_payload, this->fragment_number);
+ this->next_payload = 0;
+ }
+ return SUCCESS;
+}
+
+METHOD(payload_t, frag_get_encoding_rules, int,
+ private_encrypted_fragment_payload_t *this, encoding_rule_t **rules)
+{
+ *rules = encodings_fragment;
+ return countof(encodings_fragment);
+}
+
+METHOD(payload_t, frag_get_header_length, int,
+ private_encrypted_fragment_payload_t *this)
+{
+ return 8;
+}
+
+METHOD(payload_t, frag_get_type, payload_type_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ return PLV2_FRAGMENT;
+}
+
+METHOD(payload_t, frag_get_next_type, payload_type_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ return this->next_payload;
+}
+
+METHOD(payload_t, frag_set_next_type, void,
+ private_encrypted_fragment_payload_t *this, payload_type_t type)
+{
+ if (this->fragment_number == 1 && this->next_payload == PL_NONE)
+ {
+ this->next_payload = type;
+ }
+}
+
+METHOD2(payload_t, encrypted_payload_t, frag_get_length, size_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ if (this->encrypted.len)
+ {
+ this->payload_length = this->encrypted.len;
+ }
+ else
+ {
+ this->payload_length = this->plain.len;
+
+ if (this->aead)
+ {
+ this->payload_length += compute_overhead(this->aead,
+ this->payload_length);
+ }
+ }
+ this->payload_length += frag_get_header_length(this);
+ return this->payload_length;
+}
+
+METHOD(encrypted_fragment_payload_t, get_fragment_number, u_int16_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ return this->fragment_number;
+}
+
+METHOD(encrypted_fragment_payload_t, get_total_fragments, u_int16_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ return this->total_fragments;
+}
+
+METHOD(encrypted_fragment_payload_t, frag_get_content, chunk_t,
+ private_encrypted_fragment_payload_t *this)
+{
+ return this->plain;
+}
+
+METHOD(encrypted_payload_t, frag_add_payload, void,
+ private_encrypted_fragment_payload_t *this, payload_t* payload)
+{
+ payload->destroy(payload);
+}
+
+METHOD(encrypted_payload_t, frag_set_transform, void,
+ private_encrypted_fragment_payload_t *this, aead_t* aead)
+{
+ this->aead = aead;
+}
+
+/**
+ * Append the encrypted fragment payload header to the associated data
+ */
+static chunk_t append_header_frag(private_encrypted_fragment_payload_t *this,
+ chunk_t assoc)
+{
+ struct {
+ u_int8_t next_payload;
+ u_int8_t flags;
+ u_int16_t length;
+ u_int16_t fragment_number;
+ u_int16_t total_fragments;
+ } __attribute__((packed)) header = {
+ .next_payload = this->next_payload,
+ .flags = this->flags,
+ .length = htons(frag_get_length(this)),
+ .fragment_number = htons(this->fragment_number),
+ .total_fragments = htons(this->total_fragments),
+ };
+ return chunk_cat("cc", assoc, chunk_from_thing(header));
+}
+
+METHOD(encrypted_payload_t, frag_encrypt, status_t,
+ private_encrypted_fragment_payload_t *this, u_int64_t mid, chunk_t assoc)
+{
+ status_t status;
+
+ if (!this->aead)
+ {
+ DBG1(DBG_ENC, "encrypting encrypted fragment payload failed, "
+ "transform missing");
+ return INVALID_STATE;
+ }
+ free(this->encrypted.ptr);
+ assoc = append_header_frag(this, assoc);
+ status = encrypt_content("encrypted fragment payload", this->aead, mid,
+ this->plain, assoc, &this->encrypted);
+ free(assoc.ptr);
+ return status;
+}
+
+METHOD(encrypted_payload_t, frag_decrypt, status_t,
+ private_encrypted_fragment_payload_t *this, chunk_t assoc)
+{
+ status_t status;
+
+ if (!this->aead)
+ {
+ DBG1(DBG_ENC, "decrypting encrypted fragment payload failed, "
+ "transform missing");
+ return INVALID_STATE;
+ }
+ free(this->plain.ptr);
+ assoc = append_header_frag(this, assoc);
+ status = decrypt_content("encrypted fragment payload", this->aead,
+ this->encrypted, assoc, &this->plain);
+ this->plain = chunk_clone(this->plain);
+ free(assoc.ptr);
+ return status;
+}
+
+METHOD2(payload_t, encrypted_payload_t, frag_destroy, void,
+ private_encrypted_fragment_payload_t *this)
+{
+ free(this->encrypted.ptr);
+ free(this->plain.ptr);
+ free(this);
+}
+
+/*
+ * Described in header
+ */
+encrypted_fragment_payload_t *encrypted_fragment_payload_create()
+{
+ private_encrypted_fragment_payload_t *this;
+
+ INIT(this,
+ .public = {
+ .encrypted = {
+ .payload_interface = {
+ .verify = _frag_verify,
+ .get_encoding_rules = _frag_get_encoding_rules,
+ .get_header_length = _frag_get_header_length,
+ .get_length = _frag_get_length,
+ .get_next_type = _frag_get_next_type,
+ .set_next_type = _frag_set_next_type,
+ .get_type = _frag_get_type,
+ .destroy = _frag_destroy,
+ },
+ .get_length = _frag_get_length,
+ .add_payload = _frag_add_payload,
+ .remove_payload = (void*)return_null,
+ .generate_payloads = nop,
+ .set_transform = _frag_set_transform,
+ .encrypt = _frag_encrypt,
+ .decrypt = _frag_decrypt,
+ .destroy = _frag_destroy,
+ },
+ .get_fragment_number = _get_fragment_number,
+ .get_total_fragments = _get_total_fragments,
+ .get_content = _frag_get_content,
+ },
+ .next_payload = PL_NONE,
+ );
+ this->payload_length = frag_get_header_length(this);
+
+ return &this->public;
+}
+
+/*
+ * Described in header
+ */
+encrypted_fragment_payload_t *encrypted_fragment_payload_create_from_data(
+ u_int16_t num, u_int16_t total, chunk_t plain)
+{
+ private_encrypted_fragment_payload_t *this;
+
+ this = (private_encrypted_fragment_payload_t*)encrypted_fragment_payload_create();
+ this->fragment_number = num;
+ this->total_fragments = total;
+ this->plain = chunk_clone(plain);
+
+ return &this->public;
+}
#include <encoding/payloads/cert_payload.h>
#include <encoding/payloads/certreq_payload.h>
#include <encoding/payloads/encrypted_payload.h>
+#include <encoding/payloads/encrypted_fragment_payload.h>
#include <encoding/payloads/ts_payload.h>
#include <encoding/payloads/delete_payload.h>
#include <encoding/payloads/vendor_id_payload.h>
ENUM_NEXT(payload_type_names, PLV1_NAT_D, PLV1_NAT_OA, PLV1_CONFIGURATION,
"NAT_D_V1",
"NAT_OA_V1");
-ENUM_NEXT(payload_type_names, PLV2_SECURITY_ASSOCIATION, PLV2_GSPM, PLV1_NAT_OA,
+ENUM_NEXT(payload_type_names, PLV2_SECURITY_ASSOCIATION, PLV2_FRAGMENT, PLV1_NAT_OA,
"SECURITY_ASSOCIATION",
"KEY_EXCHANGE",
"ID_INITIATOR",
"ENCRYPTED",
"CONFIGURATION",
"EAP",
- "GSPM");
+ "GSPM",
+ "GROUP_ID",
+ "GROUP_SECURITY_ASSOCIATION",
+ "KEY_DOWNLOAD",
+ "ENCRYPTED_FRAGMENT");
#ifdef ME
-ENUM_NEXT(payload_type_names, PLV2_ID_PEER, PLV2_ID_PEER, PLV2_GSPM,
+ENUM_NEXT(payload_type_names, PLV2_ID_PEER, PLV2_ID_PEER, PLV2_FRAGMENT,
"ID_PEER");
ENUM_NEXT(payload_type_names, PLV1_NAT_D_DRAFT_00_03, PLV1_FRAGMENT, PLV2_ID_PEER,
"NAT_D_DRAFT_V1",
"NAT_OA_DRAFT_V1",
"FRAGMENT");
#else
-ENUM_NEXT(payload_type_names, PLV1_NAT_D_DRAFT_00_03, PLV1_FRAGMENT, PLV2_GSPM,
+ENUM_NEXT(payload_type_names, PLV1_NAT_D_DRAFT_00_03, PLV1_FRAGMENT, PLV2_FRAGMENT,
"NAT_D_DRAFT_V1",
"NAT_OA_DRAFT_V1",
"FRAGMENT");
ENUM_NEXT(payload_type_short_names, PLV1_NAT_D, PLV1_NAT_OA, PLV1_CONFIGURATION,
"NAT-D",
"NAT-OA");
-ENUM_NEXT(payload_type_short_names, PLV2_SECURITY_ASSOCIATION, PLV2_GSPM, PLV1_NAT_OA,
+ENUM_NEXT(payload_type_short_names, PLV2_SECURITY_ASSOCIATION, PLV2_FRAGMENT, PLV1_NAT_OA,
"SA",
"KE",
"IDi",
"E",
"CP",
"EAP",
- "GSPM");
+ "GSPM",
+ "IDg",
+ "GSA",
+ "KD",
+ "EF");
#ifdef ME
-ENUM_NEXT(payload_type_short_names, PLV2_ID_PEER, PLV2_ID_PEER, PLV2_GSPM,
+ENUM_NEXT(payload_type_short_names, PLV2_ID_PEER, PLV2_ID_PEER, PLV2_FRAGMENT,
"IDp");
ENUM_NEXT(payload_type_short_names, PLV1_NAT_D_DRAFT_00_03, PLV1_FRAGMENT, PLV2_ID_PEER,
"NAT-D",
"NAT-OA",
"FRAG");
#else
-ENUM_NEXT(payload_type_short_names, PLV1_NAT_D_DRAFT_00_03, PLV1_FRAGMENT, PLV2_GSPM,
+ENUM_NEXT(payload_type_short_names, PLV1_NAT_D_DRAFT_00_03, PLV1_FRAGMENT, PLV2_FRAGMENT,
"NAT-D",
"NAT-OA",
"FRAG");
return (payload_t*)encrypted_payload_create(type);
case PLV1_FRAGMENT:
return (payload_t*)fragment_payload_create();
+ case PLV2_FRAGMENT:
+ return (payload_t*)encrypted_fragment_payload_create();
default:
return (payload_t*)unknown_payload_create(type);
}
{
return TRUE;
}
- if (type >= PLV2_SECURITY_ASSOCIATION && type <= PLV2_EAP)
+ if (type >= PLV1_SECURITY_ASSOCIATION && type <= PLV1_CONFIGURATION)
{
return TRUE;
}
- if (type >= PLV1_SECURITY_ASSOCIATION && type <= PLV1_CONFIGURATION)
+ if (type >= PLV1_NAT_D && type <= PLV1_NAT_OA)
{
return TRUE;
}
- if (type >= PLV1_NAT_D && type <= PLV1_NAT_OA)
+ if (type >= PLV2_SECURITY_ASSOCIATION && type <= PLV2_EAP)
+ {
+ return TRUE;
+ }
+ if (type == PLV2_FRAGMENT)
{
return TRUE;
}
projects / strongswan.git / commitdiff