1 /*
2  * ngtcp2
3  *
4  * Copyright (c) 2017 ngtcp2 contributors
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining
7  * a copy of this software and associated documentation files (the
8  * "Software"), to deal in the Software without restriction, including
9  * without limitation the rights to use, copy, modify, merge, publish,
10  * distribute, sublicense, and/or sell copies of the Software, and to
11  * permit persons to whom the Software is furnished to do so, subject to
12  * the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be
15  * included in all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
18  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
19  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
20  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
21  * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
22  * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
23  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
24  */
25 #include "ngtcp2_ppe.h"
26 
27 #include <string.h>
28 #include <assert.h>
29 
30 #include "ngtcp2_str.h"
31 #include "ngtcp2_conv.h"
32 
ngtcp2_ppe_init(ngtcp2_ppe * ppe,uint8_t * out,size_t outlen,ngtcp2_crypto_cc * cc)33 void ngtcp2_ppe_init(ngtcp2_ppe *ppe, uint8_t *out, size_t outlen,
34                      ngtcp2_crypto_cc *cc) {
35   ngtcp2_buf_init(&ppe->buf, out, outlen);
36 
37   ppe->hdlen = 0;
38   ppe->len_offset = 0;
39   ppe->pkt_num_offset = 0;
40   ppe->pkt_numlen = 0;
41   ppe->pkt_num = 0;
42   ppe->sample_offset = 0;
43   ppe->cc = cc;
44 }
45 
ngtcp2_ppe_encode_hd(ngtcp2_ppe * ppe,const ngtcp2_pkt_hd * hd)46 int ngtcp2_ppe_encode_hd(ngtcp2_ppe *ppe, const ngtcp2_pkt_hd *hd) {
47   ngtcp2_ssize rv;
48   ngtcp2_buf *buf = &ppe->buf;
49   ngtcp2_crypto_cc *cc = ppe->cc;
50 
51   if (ngtcp2_buf_left(buf) < cc->aead.max_overhead) {
52     return NGTCP2_ERR_NOBUF;
53   }
54 
55   if (hd->flags & NGTCP2_PKT_FLAG_LONG_FORM) {
56     ppe->len_offset = 1 + 4 + 1 + hd->dcid.datalen + 1 + hd->scid.datalen;
57     if (hd->type == NGTCP2_PKT_INITIAL) {
58       ppe->len_offset += ngtcp2_put_varint_len(hd->token.len) + hd->token.len;
59     }
60     ppe->pkt_num_offset = ppe->len_offset + 2;
61     rv = ngtcp2_pkt_encode_hd_long(
62         buf->last, ngtcp2_buf_left(buf) - cc->aead.max_overhead, hd);
63   } else {
64     ppe->pkt_num_offset = 1 + hd->dcid.datalen;
65     rv = ngtcp2_pkt_encode_hd_short(
66         buf->last, ngtcp2_buf_left(buf) - cc->aead.max_overhead, hd);
67   }
68   if (rv < 0) {
69     return (int)rv;
70   }
71 
72   ppe->sample_offset = ppe->pkt_num_offset + 4;
73 
74   buf->last += rv;
75 
76   ppe->pkt_numlen = hd->pkt_numlen;
77   ppe->hdlen = (size_t)rv;
78 
79   ppe->pkt_num = hd->pkt_num;
80 
81   return 0;
82 }
83 
ngtcp2_ppe_encode_frame(ngtcp2_ppe * ppe,ngtcp2_frame * fr)84 int ngtcp2_ppe_encode_frame(ngtcp2_ppe *ppe, ngtcp2_frame *fr) {
85   ngtcp2_ssize rv;
86   ngtcp2_buf *buf = &ppe->buf;
87   ngtcp2_crypto_cc *cc = ppe->cc;
88 
89   if (ngtcp2_buf_left(buf) < cc->aead.max_overhead) {
90     return NGTCP2_ERR_NOBUF;
91   }
92 
93   rv = ngtcp2_pkt_encode_frame(
94       buf->last, ngtcp2_buf_left(buf) - cc->aead.max_overhead, fr);
95   if (rv < 0) {
96     return (int)rv;
97   }
98 
99   buf->last += rv;
100 
101   return 0;
102 }
103 
ngtcp2_ppe_final(ngtcp2_ppe * ppe,const uint8_t ** ppkt)104 ngtcp2_ssize ngtcp2_ppe_final(ngtcp2_ppe *ppe, const uint8_t **ppkt) {
105   ngtcp2_buf *buf = &ppe->buf;
106   ngtcp2_crypto_cc *cc = ppe->cc;
107   uint8_t *payload = buf->begin + ppe->hdlen;
108   size_t payloadlen = ngtcp2_buf_len(buf) - ppe->hdlen;
109   uint8_t mask[NGTCP2_HP_SAMPLELEN];
110   uint8_t *p;
111   size_t i;
112   int rv;
113 
114   assert(cc->encrypt);
115   assert(cc->hp_mask);
116 
117   if (ppe->len_offset) {
118     ngtcp2_put_varint14(
119         buf->begin + ppe->len_offset,
120         (uint16_t)(payloadlen + ppe->pkt_numlen + cc->aead.max_overhead));
121   }
122 
123   ngtcp2_crypto_create_nonce(ppe->nonce, cc->ckm->iv.base, cc->ckm->iv.len,
124                              ppe->pkt_num);
125 
126   rv = cc->encrypt(payload, &cc->aead, &cc->ckm->aead_ctx, payload, payloadlen,
127                    ppe->nonce, cc->ckm->iv.len, buf->begin, ppe->hdlen);
128   if (rv != 0) {
129     return NGTCP2_ERR_CALLBACK_FAILURE;
130   }
131 
132   buf->last = payload + payloadlen + cc->aead.max_overhead;
133 
134   /* TODO Check that we have enough space to get sample */
135   assert(ppe->sample_offset + NGTCP2_HP_SAMPLELEN <= ngtcp2_buf_len(buf));
136 
137   rv = cc->hp_mask(mask, &cc->hp, &cc->hp_ctx, buf->begin + ppe->sample_offset);
138   if (rv != 0) {
139     return NGTCP2_ERR_CALLBACK_FAILURE;
140   }
141 
142   p = buf->begin;
143   if (*p & NGTCP2_HEADER_FORM_BIT) {
144     *p = (uint8_t)(*p ^ (mask[0] & 0x0f));
145   } else {
146     *p = (uint8_t)(*p ^ (mask[0] & 0x1f));
147   }
148 
149   p = buf->begin + ppe->pkt_num_offset;
150   for (i = 0; i < ppe->pkt_numlen; ++i) {
151     *(p + i) ^= mask[i + 1];
152   }
153 
154   if (ppkt != NULL) {
155     *ppkt = buf->begin;
156   }
157 
158   return (ngtcp2_ssize)ngtcp2_buf_len(buf);
159 }
160 
ngtcp2_ppe_left(ngtcp2_ppe * ppe)161 size_t ngtcp2_ppe_left(ngtcp2_ppe *ppe) {
162   ngtcp2_crypto_cc *cc = ppe->cc;
163 
164   if (ngtcp2_buf_left(&ppe->buf) < cc->aead.max_overhead) {
165     return 0;
166   }
167 
168   return ngtcp2_buf_left(&ppe->buf) - cc->aead.max_overhead;
169 }
170 
ngtcp2_ppe_pktlen(ngtcp2_ppe * ppe)171 size_t ngtcp2_ppe_pktlen(ngtcp2_ppe *ppe) {
172   ngtcp2_crypto_cc *cc = ppe->cc;
173 
174   return ngtcp2_buf_len(&ppe->buf) + cc->aead.max_overhead;
175 }
176 
ngtcp2_ppe_padding(ngtcp2_ppe * ppe)177 size_t ngtcp2_ppe_padding(ngtcp2_ppe *ppe) {
178   ngtcp2_crypto_cc *cc = ppe->cc;
179   ngtcp2_buf *buf = &ppe->buf;
180   size_t len;
181 
182   assert(ngtcp2_buf_left(buf) >= cc->aead.max_overhead);
183 
184   len = ngtcp2_buf_left(buf) - cc->aead.max_overhead;
185   memset(buf->last, 0, len);
186   buf->last += len;
187 
188   return len;
189 }
190 
ngtcp2_ppe_padding_hp_sample(ngtcp2_ppe * ppe)191 size_t ngtcp2_ppe_padding_hp_sample(ngtcp2_ppe *ppe) {
192   ngtcp2_crypto_cc *cc = ppe->cc;
193   ngtcp2_buf *buf = &ppe->buf;
194   size_t max_samplelen;
195   size_t len = 0;
196 
197   assert(cc->aead.max_overhead);
198 
199   max_samplelen =
200       ngtcp2_buf_len(buf) + cc->aead.max_overhead - ppe->sample_offset;
201   if (max_samplelen < NGTCP2_HP_SAMPLELEN) {
202     len = NGTCP2_HP_SAMPLELEN - max_samplelen;
203     assert(ngtcp2_ppe_left(ppe) >= len);
204     memset(buf->last, 0, len);
205     buf->last += len;
206   }
207 
208   return len;
209 }
210 
ngtcp2_ppe_padding_size(ngtcp2_ppe * ppe,size_t n)211 size_t ngtcp2_ppe_padding_size(ngtcp2_ppe *ppe, size_t n) {
212   ngtcp2_crypto_cc *cc = ppe->cc;
213   ngtcp2_buf *buf = &ppe->buf;
214   size_t pktlen = ngtcp2_buf_len(buf) + cc->aead.max_overhead;
215   size_t len;
216 
217   if (pktlen >= n) {
218     return 0;
219   }
220 
221   len = n - pktlen;
222   buf->last = ngtcp2_setmem(buf->last, 0, len);
223 
224   return len;
225 }
226 
ngtcp2_ppe_ensure_hp_sample(ngtcp2_ppe * ppe)227 int ngtcp2_ppe_ensure_hp_sample(ngtcp2_ppe *ppe) {
228   ngtcp2_buf *buf = &ppe->buf;
229   return ngtcp2_buf_left(buf) >= (4 - ppe->pkt_numlen) + NGTCP2_HP_SAMPLELEN;
230 }
231