FD.io VPP  v20.09-64-g4f7b92f0a
Vector Packet Processing
wireguard_noise.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Doc.ai and/or its affiliates.
3  * Copyright (c) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>.
4  * Copyright (c) 2019-2020 Matt Dunwoodie <ncon@noconroy.net>.
5  * Licensed under the Apache License, Version 2.0 (the "License");
6  * you may not use this file except in compliance with the License.
7  * You may obtain a copy of the License at:
8  *
9  * http://www.apache.org/licenses/LICENSE-2.0
10  *
11  * Unless required by applicable law or agreed to in writing, software
12  * distributed under the License is distributed on an "AS IS" BASIS,
13  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  * See the License for the specific language governing permissions and
15  * limitations under the License.
16  */
17 
18 #include <openssl/hmac.h>
19 #include <wireguard/wireguard.h>
20 
21 /* This implements Noise_IKpsk2:
22  *
23  * <- s
24  * ******
25  * -> e, es, s, ss, {t}
26  * <- e, ee, se, psk, {}
27  */
28 
30 
31 /* Private functions */
34  noise_keypair_t **);
37 
38 static uint64_t noise_counter_send (noise_counter_t *);
39 static bool noise_counter_recv (noise_counter_t *, uint64_t);
40 
41 static void noise_kdf (uint8_t *, uint8_t *, uint8_t *, const uint8_t *,
42  size_t, size_t, size_t, size_t,
43  const uint8_t[NOISE_HASH_LEN]);
44 static bool noise_mix_dh (uint8_t[NOISE_HASH_LEN],
45  uint8_t[NOISE_SYMMETRIC_KEY_LEN],
46  const uint8_t[NOISE_PUBLIC_KEY_LEN],
47  const uint8_t[NOISE_PUBLIC_KEY_LEN]);
48 static bool noise_mix_ss (uint8_t ck[NOISE_HASH_LEN],
50  const uint8_t ss[NOISE_PUBLIC_KEY_LEN]);
51 static void noise_mix_hash (uint8_t[NOISE_HASH_LEN], const uint8_t *, size_t);
52 static void noise_mix_psk (uint8_t[NOISE_HASH_LEN],
53  uint8_t[NOISE_HASH_LEN],
54  uint8_t[NOISE_SYMMETRIC_KEY_LEN],
55  const uint8_t[NOISE_SYMMETRIC_KEY_LEN]);
56 static void noise_param_init (uint8_t[NOISE_HASH_LEN],
57  uint8_t[NOISE_HASH_LEN],
58  const uint8_t[NOISE_PUBLIC_KEY_LEN]);
59 
60 static void noise_msg_encrypt (vlib_main_t * vm, uint8_t *, uint8_t *, size_t,
61  uint32_t key_idx, uint8_t[NOISE_HASH_LEN]);
62 static bool noise_msg_decrypt (vlib_main_t * vm, uint8_t *, uint8_t *, size_t,
63  uint32_t key_idx, uint8_t[NOISE_HASH_LEN]);
64 static void noise_msg_ephemeral (uint8_t[NOISE_HASH_LEN],
65  uint8_t[NOISE_HASH_LEN],
66  const uint8_t src[NOISE_PUBLIC_KEY_LEN]);
67 
68 static void noise_tai64n_now (uint8_t[NOISE_TIMESTAMP_LEN]);
69 
70 static void secure_zero_memory (void *v, size_t n);
71 
72 /* Set/Get noise parameters */
73 void
74 noise_local_init (noise_local_t * l, struct noise_upcall *upcall)
75 {
76  clib_memset (l, 0, sizeof (*l));
77  l->l_upcall = *upcall;
78 }
79 
80 bool
82  const uint8_t private[NOISE_PUBLIC_KEY_LEN])
83 {
84  clib_memcpy (l->l_private, private, NOISE_PUBLIC_KEY_LEN);
85 
86  return curve25519_gen_public (l->l_public, private);
87 }
88 
89 void
90 noise_remote_init (noise_remote_t * r, uint32_t peer_pool_idx,
91  const uint8_t public[NOISE_PUBLIC_KEY_LEN],
92  u32 noise_local_idx)
93 {
94  clib_memset (r, 0, sizeof (*r));
95  clib_memcpy (r->r_public, public, NOISE_PUBLIC_KEY_LEN);
97  r->r_peer_idx = peer_pool_idx;
98  r->r_local_idx = noise_local_idx;
100 
102 }
103 
104 void
106 {
108 
109  if (!curve25519_gen_shared (r->r_ss, l->l_private, r->r_public))
111 
113  secure_zero_memory (&r->r_handshake, sizeof (r->r_handshake));
114 }
115 
116 /* Handshake functions */
117 bool
119  uint32_t * s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN],
120  uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN],
121  uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN])
122 {
123  noise_handshake_t *hs = &r->r_handshake;
125  uint8_t _key[NOISE_SYMMETRIC_KEY_LEN];
126  uint32_t key_idx;
127  uint8_t *key;
128  int ret = false;
129 
130  key_idx =
131  vnet_crypto_key_add (vm, VNET_CRYPTO_ALG_CHACHA20_POLY1305, _key,
133  key = vnet_crypto_get_key (key_idx)->data;
134 
135  noise_param_init (hs->hs_ck, hs->hs_hash, r->r_public);
136 
137  /* e */
139  if (!curve25519_gen_public (ue, hs->hs_e))
140  goto error;
141  noise_msg_ephemeral (hs->hs_ck, hs->hs_hash, ue);
142 
143  /* es */
144  if (!noise_mix_dh (hs->hs_ck, key, hs->hs_e, r->r_public))
145  goto error;
146 
147  /* s */
148  noise_msg_encrypt (vm, es, l->l_public, NOISE_PUBLIC_KEY_LEN, key_idx,
149  hs->hs_hash);
150 
151  /* ss */
152  if (!noise_mix_ss (hs->hs_ck, key, r->r_ss))
153  goto error;
154 
155  /* {t} */
156  noise_tai64n_now (ets);
157  noise_msg_encrypt (vm, ets, ets, NOISE_TIMESTAMP_LEN, key_idx, hs->hs_hash);
161  *s_idx = hs->hs_local_index;
162  ret = true;
163 error:
165  vnet_crypto_key_del (vm, key_idx);
166  return ret;
167 }
168 
169 bool
171  noise_remote_t ** rp, uint32_t s_idx,
172  uint8_t ue[NOISE_PUBLIC_KEY_LEN],
173  uint8_t es[NOISE_PUBLIC_KEY_LEN +
175  uint8_t ets[NOISE_TIMESTAMP_LEN +
177 {
178  noise_remote_t *r;
180  uint8_t _key[NOISE_SYMMETRIC_KEY_LEN];
181  uint8_t r_public[NOISE_PUBLIC_KEY_LEN];
183  u32 key_idx;
184  uint8_t *key;
185  int ret = false;
186 
187  key_idx =
188  vnet_crypto_key_add (vm, VNET_CRYPTO_ALG_CHACHA20_POLY1305, _key,
190  key = vnet_crypto_get_key (key_idx)->data;
191 
192  noise_param_init (hs.hs_ck, hs.hs_hash, l->l_public);
193 
194  /* e */
195  noise_msg_ephemeral (hs.hs_ck, hs.hs_hash, ue);
196 
197  /* es */
198  if (!noise_mix_dh (hs.hs_ck, key, l->l_private, ue))
199  goto error;
200 
201  /* s */
202 
203  if (!noise_msg_decrypt (vm, r_public, es,
204  NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN, key_idx,
205  hs.hs_hash))
206  goto error;
207 
208  /* Lookup the remote we received from */
209  if ((r = l->l_upcall.u_remote_get (r_public)) == NULL)
210  goto error;
211 
212  /* ss */
213  if (!noise_mix_ss (hs.hs_ck, key, r->r_ss))
214  goto error;
215 
216  /* {t} */
217  if (!noise_msg_decrypt (vm, timestamp, ets,
219  hs.hs_hash))
220  goto error;
221  ;
222 
224  hs.hs_local_index = 0;
225  hs.hs_remote_index = s_idx;
226  clib_memcpy (hs.hs_e, ue, NOISE_PUBLIC_KEY_LEN);
227 
228  /* Replay */
229  if (clib_memcmp (timestamp, r->r_timestamp, NOISE_TIMESTAMP_LEN) > 0)
231  else
232  goto error;
233 
234  /* Flood attack */
236  r->r_last_init = vlib_time_now (vm);
237  else
238  goto error;
239 
240  /* Ok, we're happy to accept this initiation now */
242  r->r_handshake = hs;
243  *rp = r;
244  ret = true;
245 
246 error:
248  vnet_crypto_key_del (vm, key_idx);
249  secure_zero_memory (&hs, sizeof (hs));
250  return ret;
251 }
252 
253 bool
255  uint32_t * r_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN],
256  uint8_t en[0 + NOISE_AUTHTAG_LEN])
257 {
258  noise_handshake_t *hs = &r->r_handshake;
259  uint8_t _key[NOISE_SYMMETRIC_KEY_LEN];
260  uint8_t e[NOISE_PUBLIC_KEY_LEN];
261  uint32_t key_idx;
262  uint8_t *key;
263  int ret = false;
264 
265  key_idx =
266  vnet_crypto_key_add (vm, VNET_CRYPTO_ALG_CHACHA20_POLY1305, _key,
268  key = vnet_crypto_get_key (key_idx)->data;
269 
270  if (hs->hs_state != CONSUMED_INITIATION)
271  goto error;
272 
273  /* e */
275  if (!curve25519_gen_public (ue, e))
276  goto error;
277  noise_msg_ephemeral (hs->hs_ck, hs->hs_hash, ue);
278 
279  /* ee */
280  if (!noise_mix_dh (hs->hs_ck, NULL, e, hs->hs_e))
281  goto error;
282 
283  /* se */
284  if (!noise_mix_dh (hs->hs_ck, NULL, e, r->r_public))
285  goto error;
286 
287  /* psk */
288  noise_mix_psk (hs->hs_ck, hs->hs_hash, key, r->r_psk);
289 
290  /* {} */
291  noise_msg_encrypt (vm, en, NULL, 0, key_idx, hs->hs_hash);
292 
293 
296  *r_idx = hs->hs_remote_index;
297  *s_idx = hs->hs_local_index;
298  ret = true;
299 error:
301  vnet_crypto_key_del (vm, key_idx);
302  secure_zero_memory (e, NOISE_PUBLIC_KEY_LEN);
303  return ret;
304 }
305 
306 bool
308  uint32_t r_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN],
309  uint8_t en[0 + NOISE_AUTHTAG_LEN])
310 {
313  uint8_t _key[NOISE_SYMMETRIC_KEY_LEN];
314  uint8_t preshared_key[NOISE_PUBLIC_KEY_LEN];
315  uint32_t key_idx;
316  uint8_t *key;
317  int ret = false;
318 
319  key_idx =
320  vnet_crypto_key_add (vm, VNET_CRYPTO_ALG_CHACHA20_POLY1305, _key,
322  key = vnet_crypto_get_key (key_idx)->data;
323 
324  hs = r->r_handshake;
325  clib_memcpy (preshared_key, r->r_psk, NOISE_SYMMETRIC_KEY_LEN);
326 
327  if (hs.hs_state != CREATED_INITIATION || hs.hs_local_index != r_idx)
328  goto error;
329 
330  /* e */
331  noise_msg_ephemeral (hs.hs_ck, hs.hs_hash, ue);
332 
333  /* ee */
334  if (!noise_mix_dh (hs.hs_ck, NULL, hs.hs_e, ue))
335  goto error;
336 
337  /* se */
338  if (!noise_mix_dh (hs.hs_ck, NULL, l->l_private, ue))
339  goto error;
340 
341  /* psk */
342  noise_mix_psk (hs.hs_ck, hs.hs_hash, key, preshared_key);
343 
344  /* {} */
345 
346  if (!noise_msg_decrypt
347  (vm, NULL, en, 0 + NOISE_AUTHTAG_LEN, key_idx, hs.hs_hash))
348  goto error;
349 
350 
351  hs.hs_remote_index = s_idx;
352 
353  if (r->r_handshake.hs_state == hs.hs_state &&
355  {
356  r->r_handshake = hs;
358  ret = true;
359  }
360 error:
361  secure_zero_memory (&hs, sizeof (hs));
363  vnet_crypto_key_del (vm, key_idx);
364  return ret;
365 }
366 
367 bool
369 {
370  noise_handshake_t *hs = &r->r_handshake;
371  noise_keypair_t kp, *next, *current, *previous;
372 
373  uint8_t key_send[NOISE_SYMMETRIC_KEY_LEN];
374  uint8_t key_recv[NOISE_SYMMETRIC_KEY_LEN];
375 
376  /* We now derive the keypair from the handshake */
377  if (hs->hs_state == CONSUMED_RESPONSE)
378  {
379  kp.kp_is_initiator = 1;
380  noise_kdf (key_send, key_recv, NULL, NULL,
382  hs->hs_ck);
383  }
384  else if (hs->hs_state == CREATED_RESPONSE)
385  {
386  kp.kp_is_initiator = 0;
387  noise_kdf (key_recv, key_send, NULL, NULL,
389  hs->hs_ck);
390  }
391  else
392  {
393  return false;
394  }
395 
396  kp.kp_valid = 1;
398  VNET_CRYPTO_ALG_CHACHA20_POLY1305,
399  key_send, NOISE_SYMMETRIC_KEY_LEN);
401  VNET_CRYPTO_ALG_CHACHA20_POLY1305,
402  key_recv, NOISE_SYMMETRIC_KEY_LEN);
405  kp.kp_birthdate = vlib_time_now (vm);
406  clib_memset (&kp.kp_ctr, 0, sizeof (kp.kp_ctr));
407 
408  /* Now we need to add_new_keypair */
410  next = r->r_next;
411  current = r->r_current;
412  previous = r->r_previous;
413 
414  if (kp.kp_is_initiator)
415  {
416  if (next != NULL)
417  {
418  r->r_next = NULL;
419  r->r_previous = next;
420  noise_remote_keypair_free (vm, r, &current);
421  }
422  else
423  {
424  r->r_previous = current;
425  }
426 
427  noise_remote_keypair_free (vm, r, &previous);
428 
430  *r->r_current = kp;
431  }
432  else
433  {
434  noise_remote_keypair_free (vm, r, &next);
435  r->r_previous = NULL;
436  noise_remote_keypair_free (vm, r, &previous);
437 
439  *r->r_next = kp;
440  }
442 
443  secure_zero_memory (&r->r_handshake, sizeof (r->r_handshake));
444 
445  secure_zero_memory (&kp, sizeof (kp));
446  return true;
447 }
448 
449 void
451 {
453  secure_zero_memory (&r->r_handshake, sizeof (r->r_handshake));
454 
456  noise_remote_keypair_free (vm, r, &r->r_next);
459  r->r_next = NULL;
460  r->r_current = NULL;
461  r->r_previous = NULL;
463 }
464 
465 void
467 {
469  if (r->r_next != NULL)
470  r->r_next->kp_valid = 0;
471  if (r->r_current != NULL)
472  r->r_current->kp_valid = 0;
474 }
475 
476 bool
478 {
479  noise_keypair_t *kp;
480  int ret;
481 
483  if ((kp = r->r_current) == NULL ||
484  !kp->kp_valid ||
488  ret = false;
489  else
490  ret = true;
492  return ret;
493 }
494 
495 static bool
497  u8 * src,
498  u32 src_len,
499  u8 * dst,
500  u8 * aad,
501  u32 aad_len,
502  u64 nonce,
503  vnet_crypto_op_id_t op_id,
504  vnet_crypto_key_index_t key_index)
505 {
506  vnet_crypto_op_t _op, *op = &_op;
507  u8 iv[12];
508  u8 tag_[NOISE_AUTHTAG_LEN] = { };
509  u8 src_[] = { };
510 
511  clib_memset (iv, 0, 12);
512  clib_memcpy (iv + 4, &nonce, sizeof (nonce));
513 
514  vnet_crypto_op_init (op, op_id);
515 
517  if (op_id == VNET_CRYPTO_OP_CHACHA20_POLY1305_DEC)
518  {
519  op->tag = src + src_len - NOISE_AUTHTAG_LEN;
520  src_len -= NOISE_AUTHTAG_LEN;
521  }
522  else
523  op->tag = tag_;
524 
525  op->src = !src ? src_ : src;
526  op->len = src_len;
527 
528  op->dst = dst;
529  op->key_index = key_index;
530  op->aad = aad;
531  op->aad_len = aad_len;
532  op->iv = iv;
533 
534  vnet_crypto_process_ops (vm, op, 1);
535  if (op_id == VNET_CRYPTO_OP_CHACHA20_POLY1305_ENC)
536  {
537  clib_memcpy (dst + src_len, op->tag, NOISE_AUTHTAG_LEN);
538  }
539 
540  return (op->status == VNET_CRYPTO_OP_STATUS_COMPLETED);
541 }
542 
545  uint64_t * nonce, uint8_t * src, size_t srclen,
546  uint8_t * dst)
547 {
548  noise_keypair_t *kp;
549  enum noise_state_crypt ret = SC_FAILED;
550 
552  if ((kp = r->r_current) == NULL)
553  goto error;
554 
555  /* We confirm that our values are within our tolerances. We want:
556  * - a valid keypair
557  * - our keypair to be less than REJECT_AFTER_TIME seconds old
558  * - our receive counter to be less than REJECT_AFTER_MESSAGES
559  * - our send counter to be less than REJECT_AFTER_MESSAGES
560  */
561  if (!kp->kp_valid ||
564  ((*nonce = noise_counter_send (&kp->kp_ctr)) > REJECT_AFTER_MESSAGES))
565  goto error;
566 
567  /* We encrypt into the same buffer, so the caller must ensure that buf
568  * has NOISE_AUTHTAG_LEN bytes to store the MAC. The nonce and index
569  * are passed back out to the caller through the provided data pointer. */
570  *r_idx = kp->kp_remote_index;
571 
572  chacha20poly1305_calc (vm, src, srclen, dst, NULL, 0, *nonce,
573  VNET_CRYPTO_OP_CHACHA20_POLY1305_ENC,
574  kp->kp_send_index);
575 
576  /* If our values are still within tolerances, but we are approaching
577  * the tolerances, we notify the caller with ESTALE that they should
578  * establish a new keypair. The current keypair can continue to be used
579  * until the tolerances are hit. We notify if:
580  * - our send counter is valid and not less than REKEY_AFTER_MESSAGES
581  * - we're the initiator and our keypair is older than
582  * REKEY_AFTER_TIME seconds */
583  ret = SC_KEEP_KEY_FRESH;
584  if ((kp->kp_valid && *nonce >= REKEY_AFTER_MESSAGES) ||
585  (kp->kp_is_initiator &&
587  goto error;
588 
589  ret = SC_OK;
590 error:
592  return ret;
593 }
594 
597  uint64_t nonce, uint8_t * src, size_t srclen,
598  uint8_t * dst)
599 {
600  noise_keypair_t *kp;
601  enum noise_state_crypt ret = SC_FAILED;
603 
604  if (r->r_current != NULL && r->r_current->kp_local_index == r_idx)
605  {
606  kp = r->r_current;
607  }
608  else if (r->r_previous != NULL && r->r_previous->kp_local_index == r_idx)
609  {
610  kp = r->r_previous;
611  }
612  else if (r->r_next != NULL && r->r_next->kp_local_index == r_idx)
613  {
614  kp = r->r_next;
615  }
616  else
617  {
618  goto error;
619  }
620 
621  /* We confirm that our values are within our tolerances. These values
622  * are the same as the encrypt routine.
623  *
624  * kp_ctr isn't locked here, we're happy to accept a racy read. */
627  goto error;
628 
629  /* Decrypt, then validate the counter. We don't want to validate the
630  * counter before decrypting as we do not know the message is authentic
631  * prior to decryption. */
632  if (!chacha20poly1305_calc (vm, src, srclen, dst, NULL, 0, nonce,
633  VNET_CRYPTO_OP_CHACHA20_POLY1305_DEC,
634  kp->kp_recv_index))
635  goto error;
636 
637  if (!noise_counter_recv (&kp->kp_ctr, nonce))
638  goto error;
639 
640  /* If we've received the handshake confirming data packet then move the
641  * next keypair into current. If we do slide the next keypair in, then
642  * we skip the REKEY_AFTER_TIME_RECV check. This is safe to do as a
643  * data packet can't confirm a session that we are an INITIATOR of. */
644  if (kp == r->r_next)
645  {
648  if (kp == r->r_next && kp->kp_local_index == r_idx)
649  {
651  r->r_previous = r->r_current;
652  r->r_current = r->r_next;
653  r->r_next = NULL;
654 
655  ret = SC_CONN_RESET;
658  goto error;
659  }
662  }
663 
664  /* Similar to when we encrypt, we want to notify the caller when we
665  * are approaching our tolerances. We notify if:
666  * - we're the initiator and the current keypair is older than
667  * REKEY_AFTER_TIME_RECV seconds. */
668  ret = SC_KEEP_KEY_FRESH;
669  kp = r->r_current;
670  if (kp != NULL &&
671  kp->kp_valid &&
672  kp->kp_is_initiator &&
674  goto error;
675 
676  ret = SC_OK;
677 error:
679  return ret;
680 }
681 
682 /* Private functions - these should not be called outside this file under any
683  * circumstances. */
684 static noise_keypair_t *
686 {
687  noise_keypair_t *kp;
688  kp = clib_mem_alloc (sizeof (*kp));
689  return kp;
690 }
691 
692 static void
694  noise_keypair_t ** kp)
695 {
697  struct noise_upcall *u = &local->l_upcall;
698  if (*kp)
699  {
700  u->u_index_drop ((*kp)->kp_local_index);
701  vnet_crypto_key_del (vm, (*kp)->kp_send_index);
702  vnet_crypto_key_del (vm, (*kp)->kp_recv_index);
703  clib_mem_free (*kp);
704  }
705 }
706 
707 static uint32_t
709 {
711  struct noise_upcall *u = &local->l_upcall;
712  return u->u_index_set (r);
713 }
714 
715 static void
717 {
718  noise_handshake_t *hs = &r->r_handshake;
720  struct noise_upcall *u = &local->l_upcall;
721  if (hs->hs_state != HS_ZEROED)
722  u->u_index_drop (hs->hs_local_index);
723 }
724 
725 static uint64_t
727 {
728  uint64_t ret;
729  ret = ctr->c_send++;
730  return ret;
731 }
732 
733 static bool
734 noise_counter_recv (noise_counter_t * ctr, uint64_t recv)
735 {
736  uint64_t i, top, index_recv, index_ctr;
737  unsigned long bit;
738  bool ret = false;
739 
740  /* Check that the recv counter is valid */
741  if (ctr->c_recv >= REJECT_AFTER_MESSAGES || recv >= REJECT_AFTER_MESSAGES)
742  goto error;
743 
744  /* If the packet is out of the window, invalid */
745  if (recv + COUNTER_WINDOW_SIZE < ctr->c_recv)
746  goto error;
747 
748  /* If the new counter is ahead of the current counter, we'll need to
749  * zero out the bitmap that has previously been used */
750  index_recv = recv / COUNTER_BITS;
751  index_ctr = ctr->c_recv / COUNTER_BITS;
752 
753  if (recv > ctr->c_recv)
754  {
755  top = clib_min (index_recv - index_ctr, COUNTER_NUM);
756  for (i = 1; i <= top; i++)
757  ctr->c_backtrack[(i + index_ctr) & (COUNTER_NUM - 1)] = 0;
758  ctr->c_recv = recv;
759  }
760 
761  index_recv %= COUNTER_NUM;
762  bit = 1ul << (recv % COUNTER_BITS);
763 
764  if (ctr->c_backtrack[index_recv] & bit)
765  goto error;
766 
767  ctr->c_backtrack[index_recv] |= bit;
768 
769  ret = true;
770 error:
771  return ret;
772 }
773 
774 static void
775 noise_kdf (uint8_t * a, uint8_t * b, uint8_t * c, const uint8_t * x,
776  size_t a_len, size_t b_len, size_t c_len, size_t x_len,
777  const uint8_t ck[NOISE_HASH_LEN])
778 {
779  uint8_t out[BLAKE2S_HASH_SIZE + 1];
780  uint8_t sec[BLAKE2S_HASH_SIZE];
781 
782  /* Extract entropy from "x" into sec */
783  u32 l = 0;
784  HMAC (EVP_blake2s256 (), ck, NOISE_HASH_LEN, x, x_len, sec, &l);
785  ASSERT (l == BLAKE2S_HASH_SIZE);
786  if (a == NULL || a_len == 0)
787  goto out;
788 
789  /* Expand first key: key = sec, data = 0x1 */
790  out[0] = 1;
791  HMAC (EVP_blake2s256 (), sec, BLAKE2S_HASH_SIZE, out, 1, out, &l);
792  ASSERT (l == BLAKE2S_HASH_SIZE);
793  clib_memcpy (a, out, a_len);
794 
795  if (b == NULL || b_len == 0)
796  goto out;
797 
798  /* Expand second key: key = sec, data = "a" || 0x2 */
799  out[BLAKE2S_HASH_SIZE] = 2;
800  HMAC (EVP_blake2s256 (), sec, BLAKE2S_HASH_SIZE, out, BLAKE2S_HASH_SIZE + 1,
801  out, &l);
802  ASSERT (l == BLAKE2S_HASH_SIZE);
803  clib_memcpy (b, out, b_len);
804 
805  if (c == NULL || c_len == 0)
806  goto out;
807 
808  /* Expand third key: key = sec, data = "b" || 0x3 */
809  out[BLAKE2S_HASH_SIZE] = 3;
810  HMAC (EVP_blake2s256 (), sec, BLAKE2S_HASH_SIZE, out, BLAKE2S_HASH_SIZE + 1,
811  out, &l);
812  ASSERT (l == BLAKE2S_HASH_SIZE);
813 
814  clib_memcpy (c, out, c_len);
815 
816 out:
817  /* Clear sensitive data from stack */
820 }
821 
822 static bool
824  uint8_t key[NOISE_SYMMETRIC_KEY_LEN],
825  const uint8_t private[NOISE_PUBLIC_KEY_LEN],
826  const uint8_t public[NOISE_PUBLIC_KEY_LEN])
827 {
828  uint8_t dh[NOISE_PUBLIC_KEY_LEN];
829  if (!curve25519_gen_shared (dh, private, public))
830  return false;
831  noise_kdf (ck, key, NULL, dh,
832  NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN,
833  ck);
834  secure_zero_memory (dh, NOISE_PUBLIC_KEY_LEN);
835  return true;
836 }
837 
838 static bool
840  uint8_t key[NOISE_SYMMETRIC_KEY_LEN],
841  const uint8_t ss[NOISE_PUBLIC_KEY_LEN])
842 {
843  static uint8_t null_point[NOISE_PUBLIC_KEY_LEN];
844  if (clib_memcmp (ss, null_point, NOISE_PUBLIC_KEY_LEN) == 0)
845  return false;
846  noise_kdf (ck, key, NULL, ss,
847  NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN,
848  ck);
849  return true;
850 }
851 
852 static void
853 noise_mix_hash (uint8_t hash[NOISE_HASH_LEN], const uint8_t * src,
854  size_t src_len)
855 {
856  blake2s_state_t blake;
857 
858  blake2s_init (&blake, NOISE_HASH_LEN);
859  blake2s_update (&blake, hash, NOISE_HASH_LEN);
860  blake2s_update (&blake, src, src_len);
861  blake2s_final (&blake, hash, NOISE_HASH_LEN);
862 }
863 
864 static void
865 noise_mix_psk (uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN],
866  uint8_t key[NOISE_SYMMETRIC_KEY_LEN],
867  const uint8_t psk[NOISE_SYMMETRIC_KEY_LEN])
868 {
869  uint8_t tmp[NOISE_HASH_LEN];
870 
871  noise_kdf (ck, tmp, key, psk,
872  NOISE_HASH_LEN, NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN,
873  NOISE_SYMMETRIC_KEY_LEN, ck);
874  noise_mix_hash (hash, tmp, NOISE_HASH_LEN);
875  secure_zero_memory (tmp, NOISE_HASH_LEN);
876 }
877 
878 static void
879 noise_param_init (uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN],
880  const uint8_t s[NOISE_PUBLIC_KEY_LEN])
881 {
882  blake2s_state_t blake;
883 
884  blake2s (ck, NOISE_HASH_LEN, (uint8_t *) NOISE_HANDSHAKE_NAME,
885  strlen (NOISE_HANDSHAKE_NAME), NULL, 0);
886 
887  blake2s_init (&blake, NOISE_HASH_LEN);
888  blake2s_update (&blake, ck, NOISE_HASH_LEN);
889  blake2s_update (&blake, (uint8_t *) NOISE_IDENTIFIER_NAME,
890  strlen (NOISE_IDENTIFIER_NAME));
891  blake2s_final (&blake, hash, NOISE_HASH_LEN);
892 
893  noise_mix_hash (hash, s, NOISE_PUBLIC_KEY_LEN);
894 }
895 
896 static void
897 noise_msg_encrypt (vlib_main_t * vm, uint8_t * dst, uint8_t * src,
898  size_t src_len, uint32_t key_idx,
899  uint8_t hash[NOISE_HASH_LEN])
900 {
901  /* Nonce always zero for Noise_IK */
902  chacha20poly1305_calc (vm, src, src_len, dst, hash, NOISE_HASH_LEN, 0,
903  VNET_CRYPTO_OP_CHACHA20_POLY1305_ENC, key_idx);
904  noise_mix_hash (hash, dst, src_len + NOISE_AUTHTAG_LEN);
905 }
906 
907 static bool
908 noise_msg_decrypt (vlib_main_t * vm, uint8_t * dst, uint8_t * src,
909  size_t src_len, uint32_t key_idx,
910  uint8_t hash[NOISE_HASH_LEN])
911 {
912  /* Nonce always zero for Noise_IK */
913  if (!chacha20poly1305_calc (vm, src, src_len, dst, hash, NOISE_HASH_LEN, 0,
914  VNET_CRYPTO_OP_CHACHA20_POLY1305_DEC, key_idx))
915  return false;
916  noise_mix_hash (hash, src, src_len);
917  return true;
918 }
919 
920 static void
921 noise_msg_ephemeral (uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN],
922  const uint8_t src[NOISE_PUBLIC_KEY_LEN])
923 {
924  noise_mix_hash (hash, src, NOISE_PUBLIC_KEY_LEN);
925  noise_kdf (ck, NULL, NULL, src, NOISE_HASH_LEN, 0, 0,
926  NOISE_PUBLIC_KEY_LEN, ck);
927 }
928 
929 static void
931 {
932  uint32_t unix_sec;
933  uint32_t unix_nanosec;
934 
935  uint64_t sec;
936  uint32_t nsec;
937 
938  unix_time_now_nsec_fraction (&unix_sec, &unix_nanosec);
939 
940  /* Round down the nsec counter to limit precise timing leak. */
941  unix_nanosec &= REJECT_INTERVAL_MASK;
942 
943  /* https://cr.yp.to/libtai/tai64.html */
944  sec = htobe64 (0x400000000000000aULL + unix_sec);
945  nsec = htobe32 (unix_nanosec);
946 
947  /* memcpy to output buffer, assuming output could be unaligned. */
948  clib_memcpy (output, &sec, sizeof (sec));
949  clib_memcpy (output + sizeof (sec), &nsec, sizeof (nsec));
950 }
951 
952 static void
953 secure_zero_memory (void *v, size_t n)
954 {
955  static void *(*const volatile memset_v) (void *, int, size_t) = &memset;
956  memset_v (v, 0, n);
957 }
958 
959 /*
960  * fd.io coding-style-patch-verification: ON
961  *
962  * Local Variables:
963  * eval: (c-set-style "gnu")
964  * End:
965  */
u32 vnet_crypto_process_ops(vlib_main_t *vm, vnet_crypto_op_t ops[], u32 n_ops)
Definition: crypto.c:99
uint32_t r_local_idx
static void clib_rwlock_reader_lock(clib_rwlock_t *p)
Definition: lock.h:167
static bool noise_msg_decrypt(vlib_main_t *vm, uint8_t *, uint8_t *, size_t, uint32_t key_idx, uint8_t[NOISE_HASH_LEN])
bool noise_create_initiation(vlib_main_t *vm, noise_remote_t *r, uint32_t *s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t es[NOISE_PUBLIC_KEY_LEN+NOISE_AUTHTAG_LEN], uint8_t ets[NOISE_TIMESTAMP_LEN+NOISE_AUTHTAG_LEN])
uint32_t hs_local_index
#define REJECT_AFTER_TIME
#define clib_min(x, y)
Definition: clib.h:327
enum noise_state_crypt noise_remote_encrypt(vlib_main_t *vm, noise_remote_t *r, uint32_t *r_idx, uint64_t *nonce, uint8_t *src, size_t srclen, uint8_t *dst)
a
Definition: bitmap.h:538
static void clib_rwlock_writer_lock(clib_rwlock_t *p)
Definition: lock.h:190
#define NOISE_TIMESTAMP_LEN
#define COUNTER_NUM
noise_state_crypt
void noise_local_init(noise_local_t *l, struct noise_upcall *upcall)
#define NOISE_AUTHTAG_LEN
#define NOISE_HANDSHAKE_NAME
unsigned long u64
Definition: types.h:89
void noise_remote_expire_current(noise_remote_t *r)
bool noise_remote_ready(noise_remote_t *r)
#define NOISE_IDENTIFIER_NAME
clib_memset(h->entries, 0, sizeof(h->entries[0]) *entries)
static f64 vlib_time_now(vlib_main_t *vm)
Definition: main.h:333
static void noise_param_init(uint8_t[NOISE_HASH_LEN], uint8_t[NOISE_HASH_LEN], const uint8_t[NOISE_PUBLIC_KEY_LEN])
vl_api_address_t src
Definition: gre.api:54
uint8_t hs_hash[NOISE_HASH_LEN]
static void noise_tai64n_now(uint8_t[NOISE_TIMESTAMP_LEN])
vlib_main_t * vm
Definition: in2out_ed.c:1582
uint8_t r_timestamp[NOISE_TIMESTAMP_LEN]
uint8_t hs_ck[NOISE_HASH_LEN]
#define NOISE_HASH_LEN
static uint32_t noise_remote_handshake_index_get(noise_remote_t *)
uint8_t r_public[NOISE_PUBLIC_KEY_LEN]
void noise_remote_init(noise_remote_t *r, uint32_t peer_pool_idx, const uint8_t public[NOISE_PUBLIC_KEY_LEN], u32 noise_local_idx)
unsigned char u8
Definition: types.h:56
#define clib_memcpy(d, s, n)
Definition: string.h:180
bool noise_remote_begin_session(vlib_main_t *vm, noise_remote_t *r)
static void noise_mix_hash(uint8_t[NOISE_HASH_LEN], const uint8_t *, size_t)
uint32_t kp_local_index
vnet_crypto_key_index_t kp_send_index
static_always_inline void vnet_crypto_op_init(vnet_crypto_op_t *op, vnet_crypto_op_id_t type)
Definition: crypto.h:496
void noise_remote_clear(vlib_main_t *vm, noise_remote_t *r)
bool noise_create_response(vlib_main_t *vm, noise_remote_t *r, uint32_t *s_idx, uint32_t *r_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0+NOISE_AUTHTAG_LEN])
static void noise_msg_ephemeral(uint8_t[NOISE_HASH_LEN], uint8_t[NOISE_HASH_LEN], const uint8_t src[NOISE_PUBLIC_KEY_LEN])
unsigned int u32
Definition: types.h:88
#define REKEY_AFTER_TIME
static void unix_time_now_nsec_fraction(u32 *sec, u32 *nsec)
Definition: time.h:282
u32 vnet_crypto_key_add(vlib_main_t *vm, vnet_crypto_alg_t alg, u8 *data, u16 length)
Definition: crypto.c:345
static void noise_kdf(uint8_t *, uint8_t *, uint8_t *, const uint8_t *, size_t, size_t, size_t, size_t, const uint8_t[NOISE_HASH_LEN])
#define NOISE_PUBLIC_KEY_LEN
static noise_keypair_t * noise_remote_keypair_allocate(noise_remote_t *)
static void clib_rwlock_init(clib_rwlock_t *p)
Definition: lock.h:150
static u8 iv[]
Definition: aes_cbc.c:24
static void clib_rwlock_reader_unlock(clib_rwlock_t *p)
Definition: lock.h:182
#define REKEY_AFTER_TIME_RECV
#define NOISE_SYMMETRIC_KEY_LEN
static uint64_t noise_counter_send(noise_counter_t *)
struct noise_local::noise_upcall l_upcall
void vnet_crypto_key_del(vlib_main_t *vm, vnet_crypto_key_index_t index)
Definition: crypto.c:371
unsigned long c_backtrack[COUNTER_NUM]
bool noise_local_set_private(noise_local_t *l, const uint8_t private[NOISE_PUBLIC_KEY_LEN])
vl_api_address_t dst
Definition: gre.api:55
uint8_t r_psk[NOISE_SYMMETRIC_KEY_LEN]
uint8_t l_public[NOISE_PUBLIC_KEY_LEN]
vnet_crypto_key_index_t kp_recv_index
enum noise_state_hs hs_state
static void clib_rwlock_writer_unlock(clib_rwlock_t *p)
Definition: lock.h:204
static bool wg_birthdate_has_expired(f64 birthday_seconds, f64 expiration_seconds)
svmdb_client_t * c
noise_remote_t *(* u_remote_get)(const uint8_t[NOISE_PUBLIC_KEY_LEN])
#define clib_memcmp(s1, s2, m1)
Definition: string.h:720
sll srl srl sll sra u16x4 i
Definition: vector_sse42.h:317
vl_api_ikev2_sa_transform_t dh
static bool noise_mix_ss(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], const uint8_t ss[NOISE_PUBLIC_KEY_LEN])
#define REJECT_AFTER_MESSAGES
static void noise_remote_keypair_free(vlib_main_t *vm, noise_remote_t *, noise_keypair_t **)
bool noise_consume_response(vlib_main_t *vm, noise_remote_t *r, uint32_t s_idx, uint32_t r_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0+NOISE_AUTHTAG_LEN])
static bool noise_mix_dh(uint8_t[NOISE_HASH_LEN], uint8_t[NOISE_SYMMETRIC_KEY_LEN], const uint8_t[NOISE_PUBLIC_KEY_LEN], const uint8_t[NOISE_PUBLIC_KEY_LEN])
bool noise_consume_initiation(vlib_main_t *vm, noise_local_t *l, noise_remote_t **rp, uint32_t s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t es[NOISE_PUBLIC_KEY_LEN+NOISE_AUTHTAG_LEN], uint8_t ets[NOISE_TIMESTAMP_LEN+NOISE_AUTHTAG_LEN])
#define ASSERT(truth)
uint32_t r_peer_idx
uint8_t r_ss[NOISE_PUBLIC_KEY_LEN]
noise_keypair_t * r_previous
static void clib_mem_free(void *p)
Definition: mem.h:215
#define REJECT_INTERVAL_MASK
u32 vnet_crypto_key_index_t
Definition: crypto.h:346
bool curve25519_gen_secret(u8 secret_key[CURVE25519_KEY_SIZE])
Definition: wireguard_key.c:85
uint32_t kp_remote_index
uint32_t hs_remote_index
static void * clib_mem_alloc(uword size)
Definition: mem.h:157
typedef key
Definition: ipsec_types.api:85
#define REJECT_INTERVAL
uint8_t l_private[NOISE_PUBLIC_KEY_LEN]
static_always_inline vnet_crypto_key_t * vnet_crypto_get_key(vnet_crypto_key_index_t index)
Definition: crypto.h:516
uint32_t(* u_index_set)(noise_remote_t *)
int blake2s_final(blake2s_state_t *S, void *out, size_t outlen)
Definition: blake2s.c:267
clib_rwlock_t r_keypair_lock
bool curve25519_gen_public(u8 public_key[CURVE25519_KEY_SIZE], const u8 secret_key[CURVE25519_KEY_SIZE])
Definition: wireguard_key.c:67
noise_keypair_t * r_current
vnet_crypto_op_status_t status
Definition: crypto.h:235
noise_handshake_t r_handshake
f64 timestamp
Definition: vpe_types.api:27
int blake2s(void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen)
Definition: blake2s.c:292
vnet_crypto_op_id_t
Definition: crypto.h:196
static bool chacha20poly1305_calc(vlib_main_t *vm, u8 *src, u32 src_len, u8 *dst, u8 *aad, u32 aad_len, u64 nonce, vnet_crypto_op_id_t op_id, vnet_crypto_key_index_t key_index)
int blake2s_update(blake2s_state_t *S, const void *pin, size_t inlen)
Definition: blake2s.c:237
uint8_t hs_e[NOISE_PUBLIC_KEY_LEN]
int blake2s_init(blake2s_state_t *S, size_t outlen)
Definition: blake2s.c:105
static_always_inline noise_local_t * noise_local_get(uint32_t locali)
enum noise_state_crypt noise_remote_decrypt(vlib_main_t *vm, noise_remote_t *r, uint32_t r_idx, uint64_t nonce, uint8_t *src, size_t srclen, uint8_t *dst)
noise_counter_t kp_ctr
static bool noise_counter_recv(noise_counter_t *, uint64_t)
static void secure_zero_memory(void *v, size_t n)
#define COUNTER_BITS
bool curve25519_gen_shared(u8 shared_key[CURVE25519_KEY_SIZE], const u8 secret_key[CURVE25519_KEY_SIZE], const u8 basepoint[CURVE25519_KEY_SIZE])
Definition: wireguard_key.c:21
noise_local_t * noise_local_pool
#define REKEY_AFTER_MESSAGES
void(* u_index_drop)(uint32_t)
static void noise_msg_encrypt(vlib_main_t *vm, uint8_t *, uint8_t *, size_t, uint32_t key_idx, uint8_t[NOISE_HASH_LEN])
static void noise_mix_psk(uint8_t[NOISE_HASH_LEN], uint8_t[NOISE_HASH_LEN], uint8_t[NOISE_SYMMETRIC_KEY_LEN], const uint8_t[NOISE_SYMMETRIC_KEY_LEN])
noise_keypair_t * r_next
static void noise_remote_handshake_index_drop(noise_remote_t *)
void noise_remote_precompute(noise_remote_t *r)