1 /* 2 * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 3 * Copyright (C) 2019-2020 Matt Dunwoodie <ncon@noconroy.net> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <sys/types.h> 19 #include <sys/systm.h> 20 #include <sys/param.h> 21 #include <sys/atomic.h> 22 #include <sys/rwlock.h> 23 24 #include <crypto/blake2s.h> 25 #include <crypto/curve25519.h> 26 #include <crypto/chachapoly.h> 27 28 #include <net/wg_noise.h> 29 30 /* Private functions */ 31 static struct noise_keypair * 32 noise_remote_keypair_allocate(struct noise_remote *); 33 static void 34 noise_remote_keypair_free(struct noise_remote *, 35 struct noise_keypair *); 36 static uint32_t noise_remote_handshake_index_get(struct noise_remote *); 37 static void noise_remote_handshake_index_drop(struct noise_remote *); 38 39 static uint64_t noise_counter_send(struct noise_counter *); 40 static int noise_counter_recv(struct noise_counter *, uint64_t); 41 42 static void noise_kdf(uint8_t *, uint8_t *, uint8_t *, const uint8_t *, 43 size_t, size_t, size_t, size_t, 44 const uint8_t [NOISE_HASH_LEN]); 45 static int noise_mix_dh( 46 uint8_t [NOISE_HASH_LEN], 47 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 48 const uint8_t [NOISE_PUBLIC_KEY_LEN], 49 const uint8_t [NOISE_PUBLIC_KEY_LEN]); 50 static int noise_mix_ss( 51 uint8_t ck[NOISE_HASH_LEN], 52 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 53 const uint8_t ss[NOISE_PUBLIC_KEY_LEN]); 54 static void noise_mix_hash( 55 uint8_t [NOISE_HASH_LEN], 56 const uint8_t *, 57 size_t); 58 static void noise_mix_psk( 59 uint8_t [NOISE_HASH_LEN], 60 uint8_t [NOISE_HASH_LEN], 61 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 62 const uint8_t [NOISE_SYMMETRIC_KEY_LEN]); 63 static void noise_param_init( 64 uint8_t [NOISE_HASH_LEN], 65 uint8_t [NOISE_HASH_LEN], 66 const uint8_t [NOISE_PUBLIC_KEY_LEN]); 67 68 static void noise_msg_encrypt(uint8_t *, const uint8_t *, size_t, 69 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 70 uint8_t [NOISE_HASH_LEN]); 71 static int noise_msg_decrypt(uint8_t *, const uint8_t *, size_t, 72 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 73 uint8_t [NOISE_HASH_LEN]); 74 static void noise_msg_ephemeral( 75 uint8_t [NOISE_HASH_LEN], 76 uint8_t [NOISE_HASH_LEN], 77 const uint8_t src[NOISE_PUBLIC_KEY_LEN]); 78 79 static void noise_tai64n_now(uint8_t [NOISE_TIMESTAMP_LEN]); 80 static int noise_timer_expired(struct timespec *, time_t, long); 81 82 /* Set/Get noise parameters */ 83 void 84 noise_local_init(struct noise_local *l, struct noise_upcall *upcall) 85 { 86 bzero(l, sizeof(*l)); 87 rw_init(&l->l_identity_lock, "noise_local_identity"); 88 l->l_upcall = *upcall; 89 } 90 91 void 92 noise_local_lock_identity(struct noise_local *l) 93 { 94 rw_enter_write(&l->l_identity_lock); 95 } 96 97 void 98 noise_local_unlock_identity(struct noise_local *l) 99 { 100 rw_exit_write(&l->l_identity_lock); 101 } 102 103 int 104 noise_local_set_private(struct noise_local *l, 105 uint8_t private[NOISE_PUBLIC_KEY_LEN]) 106 { 107 rw_assert_wrlock(&l->l_identity_lock); 108 109 memcpy(l->l_private, private, NOISE_PUBLIC_KEY_LEN); 110 curve25519_clamp_secret(l->l_private); 111 l->l_has_identity = curve25519_generate_public(l->l_public, private); 112 113 return l->l_has_identity ? 0 : ENXIO; 114 } 115 116 int 117 noise_local_keys(struct noise_local *l, uint8_t public[NOISE_PUBLIC_KEY_LEN], 118 uint8_t private[NOISE_PUBLIC_KEY_LEN]) 119 { 120 int ret = 0; 121 rw_enter_read(&l->l_identity_lock); 122 if (l->l_has_identity) { 123 if (public != NULL) 124 memcpy(public, l->l_public, NOISE_PUBLIC_KEY_LEN); 125 if (private != NULL) 126 memcpy(private, l->l_private, NOISE_PUBLIC_KEY_LEN); 127 } else { 128 ret = ENXIO; 129 } 130 rw_exit_read(&l->l_identity_lock); 131 return ret; 132 } 133 134 void 135 noise_remote_init(struct noise_remote *r, uint8_t public[NOISE_PUBLIC_KEY_LEN], 136 struct noise_local *l) 137 { 138 bzero(r, sizeof(*r)); 139 memcpy(r->r_public, public, NOISE_PUBLIC_KEY_LEN); 140 rw_init(&r->r_handshake_lock, "noise_handshake"); 141 rw_init(&r->r_keypair_lock, "noise_keypair"); 142 143 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[0], kp_entry); 144 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[1], kp_entry); 145 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[2], kp_entry); 146 147 KASSERT(l != NULL); 148 r->r_local = l; 149 150 rw_enter_write(&l->l_identity_lock); 151 noise_remote_precompute(r); 152 rw_exit_write(&l->l_identity_lock); 153 } 154 155 int 156 noise_remote_set_psk(struct noise_remote *r, 157 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 158 { 159 int same; 160 rw_enter_write(&r->r_handshake_lock); 161 same = !timingsafe_bcmp(r->r_psk, psk, NOISE_SYMMETRIC_KEY_LEN); 162 if (!same) { 163 memcpy(r->r_psk, psk, NOISE_SYMMETRIC_KEY_LEN); 164 } 165 rw_exit_write(&r->r_handshake_lock); 166 return same ? EEXIST : 0; 167 } 168 169 int 170 noise_remote_keys(struct noise_remote *r, uint8_t public[NOISE_PUBLIC_KEY_LEN], 171 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 172 { 173 static uint8_t null_psk[NOISE_SYMMETRIC_KEY_LEN]; 174 int ret; 175 176 if (public != NULL) 177 memcpy(public, r->r_public, NOISE_PUBLIC_KEY_LEN); 178 179 rw_enter_read(&r->r_handshake_lock); 180 if (psk != NULL) 181 memcpy(psk, r->r_psk, NOISE_SYMMETRIC_KEY_LEN); 182 ret = timingsafe_bcmp(r->r_psk, null_psk, NOISE_SYMMETRIC_KEY_LEN); 183 rw_exit_read(&r->r_handshake_lock); 184 185 /* If r_psk != null_psk return 0, else ENOENT (no psk) */ 186 return ret ? 0 : ENOENT; 187 } 188 189 void 190 noise_remote_precompute(struct noise_remote *r) 191 { 192 struct noise_local *l = r->r_local; 193 rw_assert_wrlock(&l->l_identity_lock); 194 if (!l->l_has_identity) 195 bzero(r->r_ss, NOISE_PUBLIC_KEY_LEN); 196 else if (!curve25519(r->r_ss, l->l_private, r->r_public)) 197 bzero(r->r_ss, NOISE_PUBLIC_KEY_LEN); 198 199 rw_enter_write(&r->r_handshake_lock); 200 noise_remote_handshake_index_drop(r); 201 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 202 rw_exit_write(&r->r_handshake_lock); 203 } 204 205 /* Handshake functions */ 206 int 207 noise_create_initiation(struct noise_remote *r, uint32_t *s_idx, 208 uint8_t ue[NOISE_PUBLIC_KEY_LEN], 209 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN], 210 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]) 211 { 212 struct noise_handshake *hs = &r->r_handshake; 213 struct noise_local *l = r->r_local; 214 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 215 int ret = EINVAL; 216 217 rw_enter_read(&l->l_identity_lock); 218 rw_enter_write(&r->r_handshake_lock); 219 if (!l->l_has_identity) 220 goto error; 221 noise_param_init(hs->hs_ck, hs->hs_hash, r->r_public); 222 223 /* e */ 224 curve25519_generate_secret(hs->hs_e); 225 if (curve25519_generate_public(ue, hs->hs_e) == 0) 226 goto error; 227 noise_msg_ephemeral(hs->hs_ck, hs->hs_hash, ue); 228 229 /* es */ 230 if (noise_mix_dh(hs->hs_ck, key, hs->hs_e, r->r_public) != 0) 231 goto error; 232 233 /* s */ 234 noise_msg_encrypt(es, l->l_public, 235 NOISE_PUBLIC_KEY_LEN, key, hs->hs_hash); 236 237 /* ss */ 238 if (noise_mix_ss(hs->hs_ck, key, r->r_ss) != 0) 239 goto error; 240 241 /* {t} */ 242 noise_tai64n_now(ets); 243 noise_msg_encrypt(ets, ets, 244 NOISE_TIMESTAMP_LEN, key, hs->hs_hash); 245 246 noise_remote_handshake_index_drop(r); 247 hs->hs_state = CREATED_INITIATION; 248 hs->hs_local_index = noise_remote_handshake_index_get(r); 249 *s_idx = hs->hs_local_index; 250 ret = 0; 251 error: 252 rw_exit_write(&r->r_handshake_lock); 253 rw_exit_read(&l->l_identity_lock); 254 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 255 return ret; 256 } 257 258 int 259 noise_consume_initiation(struct noise_local *l, struct noise_remote **rp, 260 uint32_t s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], 261 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN], 262 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]) 263 { 264 struct noise_remote *r; 265 struct noise_handshake hs; 266 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 267 uint8_t r_public[NOISE_PUBLIC_KEY_LEN]; 268 uint8_t timestamp[NOISE_TIMESTAMP_LEN]; 269 int ret = EINVAL; 270 271 rw_enter_read(&l->l_identity_lock); 272 if (!l->l_has_identity) 273 goto error; 274 noise_param_init(hs.hs_ck, hs.hs_hash, l->l_public); 275 276 /* e */ 277 noise_msg_ephemeral(hs.hs_ck, hs.hs_hash, ue); 278 279 /* es */ 280 if (noise_mix_dh(hs.hs_ck, key, l->l_private, ue) != 0) 281 goto error; 282 283 /* s */ 284 if (noise_msg_decrypt(r_public, es, 285 NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 286 goto error; 287 288 /* Lookup the remote we received from */ 289 if ((r = l->l_upcall.u_remote_get(l->l_upcall.u_arg, r_public)) == NULL) 290 goto error; 291 292 /* ss */ 293 if (noise_mix_ss(hs.hs_ck, key, r->r_ss) != 0) 294 goto error; 295 296 /* {t} */ 297 if (noise_msg_decrypt(timestamp, ets, 298 NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 299 goto error; 300 301 hs.hs_state = CONSUMED_INITIATION; 302 hs.hs_local_index = 0; 303 hs.hs_remote_index = s_idx; 304 memcpy(hs.hs_e, ue, NOISE_PUBLIC_KEY_LEN); 305 306 /* We have successfully computed the same results, now we ensure that 307 * this is not an initiation replay, or a flood attack */ 308 rw_enter_write(&r->r_handshake_lock); 309 310 /* Replay */ 311 if (memcmp(timestamp, r->r_timestamp, NOISE_TIMESTAMP_LEN) > 0) 312 memcpy(r->r_timestamp, timestamp, NOISE_TIMESTAMP_LEN); 313 else 314 goto error_set; 315 /* Flood attack */ 316 if (noise_timer_expired(&r->r_last_init, 0, REJECT_INTERVAL)) 317 getnanouptime(&r->r_last_init); 318 else 319 goto error_set; 320 321 /* Ok, we're happy to accept this initiation now */ 322 noise_remote_handshake_index_drop(r); 323 r->r_handshake = hs; 324 *rp = r; 325 ret = 0; 326 error_set: 327 rw_exit_write(&r->r_handshake_lock); 328 error: 329 rw_exit_read(&l->l_identity_lock); 330 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 331 explicit_bzero(&hs, sizeof(hs)); 332 return ret; 333 } 334 335 int 336 noise_create_response(struct noise_remote *r, uint32_t *s_idx, uint32_t *r_idx, 337 uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0 + NOISE_AUTHTAG_LEN]) 338 { 339 struct noise_handshake *hs = &r->r_handshake; 340 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 341 uint8_t e[NOISE_PUBLIC_KEY_LEN]; 342 int ret = EINVAL; 343 344 rw_enter_read(&r->r_local->l_identity_lock); 345 rw_enter_write(&r->r_handshake_lock); 346 347 if (hs->hs_state != CONSUMED_INITIATION) 348 goto error; 349 350 /* e */ 351 curve25519_generate_secret(e); 352 if (curve25519_generate_public(ue, e) == 0) 353 goto error; 354 noise_msg_ephemeral(hs->hs_ck, hs->hs_hash, ue); 355 356 /* ee */ 357 if (noise_mix_dh(hs->hs_ck, NULL, e, hs->hs_e) != 0) 358 goto error; 359 360 /* se */ 361 if (noise_mix_dh(hs->hs_ck, NULL, e, r->r_public) != 0) 362 goto error; 363 364 /* psk */ 365 noise_mix_psk(hs->hs_ck, hs->hs_hash, key, r->r_psk); 366 367 /* {} */ 368 noise_msg_encrypt(en, NULL, 0, key, hs->hs_hash); 369 370 hs->hs_state = CREATED_RESPONSE; 371 hs->hs_local_index = noise_remote_handshake_index_get(r); 372 *r_idx = hs->hs_remote_index; 373 *s_idx = hs->hs_local_index; 374 ret = 0; 375 error: 376 rw_exit_write(&r->r_handshake_lock); 377 rw_exit_read(&r->r_local->l_identity_lock); 378 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 379 explicit_bzero(e, NOISE_PUBLIC_KEY_LEN); 380 return ret; 381 } 382 383 int 384 noise_consume_response(struct noise_remote *r, uint32_t s_idx, uint32_t r_idx, 385 uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0 + NOISE_AUTHTAG_LEN]) 386 { 387 struct noise_local *l = r->r_local; 388 struct noise_handshake hs; 389 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 390 uint8_t preshared_key[NOISE_PUBLIC_KEY_LEN]; 391 int ret = EINVAL; 392 393 rw_enter_read(&l->l_identity_lock); 394 if (!l->l_has_identity) 395 goto error; 396 397 rw_enter_read(&r->r_handshake_lock); 398 hs = r->r_handshake; 399 memcpy(preshared_key, r->r_psk, NOISE_SYMMETRIC_KEY_LEN); 400 rw_exit_read(&r->r_handshake_lock); 401 402 if (hs.hs_state != CREATED_INITIATION || 403 hs.hs_local_index != r_idx) 404 goto error; 405 406 /* e */ 407 noise_msg_ephemeral(hs.hs_ck, hs.hs_hash, ue); 408 409 /* ee */ 410 if (noise_mix_dh(hs.hs_ck, NULL, hs.hs_e, ue) != 0) 411 goto error; 412 413 /* se */ 414 if (noise_mix_dh(hs.hs_ck, NULL, l->l_private, ue) != 0) 415 goto error; 416 417 /* psk */ 418 noise_mix_psk(hs.hs_ck, hs.hs_hash, key, preshared_key); 419 420 /* {} */ 421 if (noise_msg_decrypt(NULL, en, 422 0 + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 423 goto error; 424 425 hs.hs_remote_index = s_idx; 426 427 rw_enter_write(&r->r_handshake_lock); 428 if (r->r_handshake.hs_state == hs.hs_state && 429 r->r_handshake.hs_local_index == hs.hs_local_index) { 430 r->r_handshake = hs; 431 r->r_handshake.hs_state = CONSUMED_RESPONSE; 432 ret = 0; 433 } 434 rw_exit_write(&r->r_handshake_lock); 435 error: 436 rw_exit_read(&l->l_identity_lock); 437 explicit_bzero(&hs, sizeof(hs)); 438 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 439 return ret; 440 } 441 442 int 443 noise_remote_begin_session(struct noise_remote *r) 444 { 445 struct noise_handshake *hs = &r->r_handshake; 446 struct noise_keypair kp, *next, *current, *previous; 447 448 rw_enter_write(&r->r_handshake_lock); 449 450 /* We now derive the keypair from the handshake */ 451 if (hs->hs_state == CONSUMED_RESPONSE) { 452 kp.kp_is_initiator = 1; 453 noise_kdf(kp.kp_send, kp.kp_recv, NULL, NULL, 454 NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, 0, 455 hs->hs_ck); 456 } else if (hs->hs_state == CREATED_RESPONSE) { 457 kp.kp_is_initiator = 0; 458 noise_kdf(kp.kp_recv, kp.kp_send, NULL, NULL, 459 NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, 0, 460 hs->hs_ck); 461 } else { 462 rw_exit_write(&r->r_keypair_lock); 463 return EINVAL; 464 } 465 466 kp.kp_valid = 1; 467 kp.kp_local_index = hs->hs_local_index; 468 kp.kp_remote_index = hs->hs_remote_index; 469 getnanouptime(&kp.kp_birthdate); 470 rw_init(&kp.kp_ctr.c_lock, "noise_counter"); 471 bzero(&kp.kp_ctr, sizeof(kp.kp_ctr)); 472 473 /* Now we need to add_new_keypair */ 474 rw_enter_write(&r->r_keypair_lock); 475 next = r->r_next; 476 current = r->r_current; 477 previous = r->r_previous; 478 479 if (kp.kp_is_initiator) { 480 if (next != NULL) { 481 r->r_next = NULL; 482 r->r_previous = next; 483 noise_remote_keypair_free(r, current); 484 } else { 485 r->r_previous = current; 486 } 487 488 noise_remote_keypair_free(r, previous); 489 490 r->r_current = noise_remote_keypair_allocate(r); 491 *r->r_current = kp; 492 } else { 493 noise_remote_keypair_free(r, next); 494 r->r_previous = NULL; 495 noise_remote_keypair_free(r, previous); 496 497 r->r_next = noise_remote_keypair_allocate(r); 498 *r->r_next = kp; 499 } 500 rw_exit_write(&r->r_keypair_lock); 501 502 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 503 rw_exit_write(&r->r_handshake_lock); 504 505 explicit_bzero(&kp, sizeof(kp)); 506 return 0; 507 } 508 509 void 510 noise_remote_clear(struct noise_remote *r) 511 { 512 rw_enter_write(&r->r_handshake_lock); 513 noise_remote_handshake_index_drop(r); 514 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 515 rw_exit_write(&r->r_handshake_lock); 516 517 rw_enter_write(&r->r_keypair_lock); 518 noise_remote_keypair_free(r, r->r_next); 519 noise_remote_keypair_free(r, r->r_current); 520 noise_remote_keypair_free(r, r->r_previous); 521 r->r_next = NULL; 522 r->r_current = NULL; 523 r->r_previous = NULL; 524 rw_exit_write(&r->r_keypair_lock); 525 } 526 527 void 528 noise_remote_expire_current(struct noise_remote *r) 529 { 530 rw_enter_write(&r->r_keypair_lock); 531 if (r->r_next != NULL) 532 r->r_next->kp_valid = 0; 533 if (r->r_current != NULL) 534 r->r_current->kp_valid = 0; 535 rw_exit_write(&r->r_keypair_lock); 536 } 537 538 int 539 noise_remote_ready(struct noise_remote *r) 540 { 541 struct noise_keypair *kp; 542 int ret; 543 544 rw_enter_read(&r->r_keypair_lock); 545 /* kp_ctr isn't locked here, we're happy to accept a racy read. */ 546 if ((kp = r->r_current) == NULL || 547 !kp->kp_valid || 548 noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 549 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES || 550 kp->kp_ctr.c_send >= REJECT_AFTER_MESSAGES) 551 ret = EINVAL; 552 else 553 ret = 0; 554 rw_exit_read(&r->r_keypair_lock); 555 return ret; 556 } 557 558 int 559 noise_remote_encrypt(struct noise_remote *r, uint32_t *r_idx, uint64_t *nonce, 560 uint8_t *buf, size_t buflen) 561 { 562 struct noise_keypair *kp; 563 int ret = EINVAL; 564 565 rw_enter_read(&r->r_keypair_lock); 566 if ((kp = r->r_current) == NULL) 567 goto error; 568 569 /* We confirm that our values are within our tolerances. We want: 570 * - a valid keypair 571 * - our keypair to be less than REJECT_AFTER_TIME seconds old 572 * - our receive counter to be less than REJECT_AFTER_MESSAGES 573 * - our send counter to be less than REJECT_AFTER_MESSAGES 574 * 575 * kp_ctr isn't locked here, we're happy to accept a racy read. */ 576 if (!kp->kp_valid || 577 noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 578 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES || 579 ((*nonce = noise_counter_send(&kp->kp_ctr)) > REJECT_AFTER_MESSAGES)) 580 goto error; 581 582 /* We encrypt into the same buffer, so the caller must ensure that buf 583 * has NOISE_AUTHTAG_LEN bytes to store the MAC. The nonce and index 584 * are passed back out to the caller through the provided data pointer. */ 585 *r_idx = kp->kp_remote_index; 586 chacha20poly1305_encrypt(buf, buf, buflen, 587 NULL, 0, *nonce, kp->kp_send); 588 589 /* If our values are still within tolerances, but we are approaching 590 * the tolerances, we notify the caller with ESTALE that they should 591 * establish a new keypair. The current keypair can continue to be used 592 * until the tolerances are hit. We notify if: 593 * - our send counter is valid and not less than REKEY_AFTER_MESSAGES 594 * - we're the initiator and our keypair is older than 595 * REKEY_AFTER_TIME seconds */ 596 ret = ESTALE; 597 if ((kp->kp_valid && *nonce >= REKEY_AFTER_MESSAGES) || 598 (kp->kp_is_initiator && 599 noise_timer_expired(&kp->kp_birthdate, REKEY_AFTER_TIME, 0))) 600 goto error; 601 602 ret = 0; 603 error: 604 rw_exit_read(&r->r_keypair_lock); 605 return ret; 606 } 607 608 int 609 noise_remote_decrypt(struct noise_remote *r, uint32_t r_idx, uint64_t nonce, 610 uint8_t *buf, size_t buflen) 611 { 612 struct noise_keypair *kp; 613 int ret = EINVAL; 614 615 /* We retrieve the keypair corresponding to the provided index. We 616 * attempt the current keypair first as that is most likely. We also 617 * want to make sure that the keypair is valid as it would be 618 * catastrophic to decrypt against a zero'ed keypair. */ 619 rw_enter_read(&r->r_keypair_lock); 620 621 if (r->r_current != NULL && r->r_current->kp_local_index == r_idx) { 622 kp = r->r_current; 623 } else if (r->r_previous != NULL && r->r_previous->kp_local_index == r_idx) { 624 kp = r->r_previous; 625 } else if (r->r_next != NULL && r->r_next->kp_local_index == r_idx) { 626 kp = r->r_next; 627 } else { 628 goto error; 629 } 630 631 /* We confirm that our values are within our tolerances. These values 632 * are the same as the encrypt routine. 633 * 634 * kp_ctr isn't locked here, we're happy to accept a racy read. */ 635 if (noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 636 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES) 637 goto error; 638 639 /* Decrypt, then validate the counter. We don't want to validate the 640 * counter before decrypting as we do not know the message is authentic 641 * prior to decryption. */ 642 if (chacha20poly1305_decrypt(buf, buf, buflen, 643 NULL, 0, nonce, kp->kp_recv) == 0) 644 goto error; 645 646 if (noise_counter_recv(&kp->kp_ctr, nonce) != 0) 647 goto error; 648 649 /* If we've received the handshake confirming data packet then move the 650 * next keypair into current. If we do slide the next keypair in, then 651 * we skip the REKEY_AFTER_TIME_RECV check. This is safe to do as a 652 * data packet can't confirm a session that we are an INITIATOR of. */ 653 if (kp == r->r_next) { 654 rw_exit_read(&r->r_keypair_lock); 655 rw_enter_write(&r->r_keypair_lock); 656 if (kp == r->r_next && kp->kp_local_index == r_idx) { 657 noise_remote_keypair_free(r, r->r_previous); 658 r->r_previous = r->r_current; 659 r->r_current = r->r_next; 660 r->r_next = NULL; 661 662 ret = ECONNRESET; 663 goto error; 664 } 665 rw_enter(&r->r_keypair_lock, RW_DOWNGRADE); 666 } 667 668 /* Similar to when we encrypt, we want to notify the caller when we 669 * are approaching our tolerances. We notify if: 670 * - we're the initiator and the current keypair is older than 671 * REKEY_AFTER_TIME_RECV seconds. */ 672 ret = ESTALE; 673 kp = r->r_current; 674 if (kp != NULL && 675 kp->kp_valid && 676 kp->kp_is_initiator && 677 noise_timer_expired(&kp->kp_birthdate, REKEY_AFTER_TIME_RECV, 0)) 678 goto error; 679 680 ret = 0; 681 682 error: 683 rw_exit(&r->r_keypair_lock); 684 return ret; 685 } 686 687 /* Private functions - these should not be called outside this file under any 688 * circumstances. */ 689 static struct noise_keypair * 690 noise_remote_keypair_allocate(struct noise_remote *r) 691 { 692 struct noise_keypair *kp; 693 kp = SLIST_FIRST(&r->r_unused_keypairs); 694 SLIST_REMOVE_HEAD(&r->r_unused_keypairs, kp_entry); 695 return kp; 696 } 697 698 static void 699 noise_remote_keypair_free(struct noise_remote *r, struct noise_keypair *kp) 700 { 701 struct noise_upcall *u = &r->r_local->l_upcall; 702 if (kp != NULL) { 703 SLIST_INSERT_HEAD(&r->r_unused_keypairs, kp, kp_entry); 704 u->u_index_drop(u->u_arg, kp->kp_local_index); 705 bzero(kp->kp_send, sizeof(kp->kp_send)); 706 bzero(kp->kp_recv, sizeof(kp->kp_recv)); 707 } 708 } 709 710 static uint32_t 711 noise_remote_handshake_index_get(struct noise_remote *r) 712 { 713 struct noise_upcall *u = &r->r_local->l_upcall; 714 return u->u_index_set(u->u_arg, r); 715 } 716 717 static void 718 noise_remote_handshake_index_drop(struct noise_remote *r) 719 { 720 struct noise_handshake *hs = &r->r_handshake; 721 struct noise_upcall *u = &r->r_local->l_upcall; 722 rw_assert_wrlock(&r->r_handshake_lock); 723 if (hs->hs_state != HS_ZEROED) 724 u->u_index_drop(u->u_arg, hs->hs_local_index); 725 } 726 727 static uint64_t 728 noise_counter_send(struct noise_counter *ctr) 729 { 730 #ifdef __LP64__ 731 return atomic_inc_long_nv((u_long *)&ctr->c_send) - 1; 732 #else 733 uint64_t ret; 734 rw_enter_write(&ctr->c_lock); 735 ret = ctr->c_send++; 736 rw_exit_write(&ctr->c_lock); 737 return ret; 738 #endif 739 } 740 741 static int 742 noise_counter_recv(struct noise_counter *ctr, uint64_t recv) 743 { 744 uint64_t i, top, index_recv, index_ctr; 745 unsigned long bit; 746 int ret = EEXIST; 747 748 rw_enter_write(&ctr->c_lock); 749 750 /* Check that the recv counter is valid */ 751 if (ctr->c_recv >= REJECT_AFTER_MESSAGES || 752 recv >= REJECT_AFTER_MESSAGES) 753 goto error; 754 755 /* If the packet is out of the window, invalid */ 756 if (recv + COUNTER_WINDOW_SIZE < ctr->c_recv) 757 goto error; 758 759 /* If the new counter is ahead of the current counter, we'll need to 760 * zero out the bitmap that has previously been used */ 761 index_recv = recv / COUNTER_BITS; 762 index_ctr = ctr->c_recv / COUNTER_BITS; 763 764 if (recv > ctr->c_recv) { 765 top = MIN(index_recv - index_ctr, COUNTER_NUM); 766 for (i = 1; i <= top; i++) 767 ctr->c_backtrack[ 768 (i + index_ctr) & (COUNTER_NUM - 1)] = 0; 769 ctr->c_recv = recv; 770 } 771 772 index_recv %= COUNTER_NUM; 773 bit = 1ul << (recv % COUNTER_BITS); 774 775 if (ctr->c_backtrack[index_recv] & bit) 776 goto error; 777 778 ctr->c_backtrack[index_recv] |= bit; 779 780 ret = 0; 781 error: 782 rw_exit_write(&ctr->c_lock); 783 return ret; 784 } 785 786 static void 787 noise_kdf(uint8_t *a, uint8_t *b, uint8_t *c, const uint8_t *x, 788 size_t a_len, size_t b_len, size_t c_len, size_t x_len, 789 const uint8_t ck[NOISE_HASH_LEN]) 790 { 791 uint8_t out[BLAKE2S_HASH_SIZE + 1]; 792 uint8_t sec[BLAKE2S_HASH_SIZE]; 793 794 #ifdef DIAGNOSTIC 795 KASSERT(a_len <= BLAKE2S_HASH_SIZE && b_len <= BLAKE2S_HASH_SIZE && 796 c_len <= BLAKE2S_HASH_SIZE); 797 KASSERT(!(b || b_len || c || c_len) || (a && a_len)); 798 KASSERT(!(c || c_len) || (b && b_len)); 799 #endif 800 801 /* Extract entropy from "x" into sec */ 802 blake2s_hmac(sec, x, ck, BLAKE2S_HASH_SIZE, x_len, NOISE_HASH_LEN); 803 804 if (a == NULL || a_len == 0) 805 goto out; 806 807 /* Expand first key: key = sec, data = 0x1 */ 808 out[0] = 1; 809 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, 1, BLAKE2S_HASH_SIZE); 810 memcpy(a, out, a_len); 811 812 if (b == NULL || b_len == 0) 813 goto out; 814 815 /* Expand second key: key = sec, data = "a" || 0x2 */ 816 out[BLAKE2S_HASH_SIZE] = 2; 817 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, BLAKE2S_HASH_SIZE + 1, 818 BLAKE2S_HASH_SIZE); 819 memcpy(b, out, b_len); 820 821 if (c == NULL || c_len == 0) 822 goto out; 823 824 /* Expand third key: key = sec, data = "b" || 0x3 */ 825 out[BLAKE2S_HASH_SIZE] = 3; 826 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, BLAKE2S_HASH_SIZE + 1, 827 BLAKE2S_HASH_SIZE); 828 memcpy(c, out, c_len); 829 830 out: 831 /* Clear sensitive data from stack */ 832 explicit_bzero(sec, BLAKE2S_HASH_SIZE); 833 explicit_bzero(out, BLAKE2S_HASH_SIZE + 1); 834 } 835 836 static int 837 noise_mix_dh(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 838 const uint8_t private[NOISE_PUBLIC_KEY_LEN], 839 const uint8_t public[NOISE_PUBLIC_KEY_LEN]) 840 { 841 uint8_t dh[NOISE_PUBLIC_KEY_LEN]; 842 843 if (!curve25519(dh, private, public)) 844 return EINVAL; 845 noise_kdf(ck, key, NULL, dh, 846 NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN, ck); 847 explicit_bzero(dh, NOISE_PUBLIC_KEY_LEN); 848 return 0; 849 } 850 851 static int 852 noise_mix_ss(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 853 const uint8_t ss[NOISE_PUBLIC_KEY_LEN]) 854 { 855 static uint8_t null_point[NOISE_PUBLIC_KEY_LEN]; 856 if (timingsafe_bcmp(ss, null_point, NOISE_PUBLIC_KEY_LEN) == 0) 857 return ENOENT; 858 noise_kdf(ck, key, NULL, ss, 859 NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN, ck); 860 return 0; 861 } 862 863 static void 864 noise_mix_hash(uint8_t hash[NOISE_HASH_LEN], const uint8_t *src, 865 size_t src_len) 866 { 867 struct blake2s_state blake; 868 869 blake2s_init(&blake, NOISE_HASH_LEN); 870 blake2s_update(&blake, hash, NOISE_HASH_LEN); 871 blake2s_update(&blake, src, src_len); 872 blake2s_final(&blake, hash); 873 } 874 875 static void 876 noise_mix_psk(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 877 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 878 const uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 879 { 880 uint8_t tmp[NOISE_HASH_LEN]; 881 882 noise_kdf(ck, tmp, key, psk, 883 NOISE_HASH_LEN, NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 884 NOISE_SYMMETRIC_KEY_LEN, ck); 885 noise_mix_hash(hash, tmp, NOISE_HASH_LEN); 886 explicit_bzero(tmp, NOISE_HASH_LEN); 887 } 888 889 static void 890 noise_param_init(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 891 const uint8_t s[NOISE_PUBLIC_KEY_LEN]) 892 { 893 struct blake2s_state blake; 894 895 blake2s(ck, (uint8_t *)NOISE_HANDSHAKE_NAME, NULL, 896 NOISE_HASH_LEN, strlen(NOISE_HANDSHAKE_NAME), 0); 897 blake2s_init(&blake, NOISE_HASH_LEN); 898 blake2s_update(&blake, ck, NOISE_HASH_LEN); 899 blake2s_update(&blake, (uint8_t *)NOISE_IDENTIFIER_NAME, 900 strlen(NOISE_IDENTIFIER_NAME)); 901 blake2s_final(&blake, hash); 902 903 noise_mix_hash(hash, s, NOISE_PUBLIC_KEY_LEN); 904 } 905 906 static void 907 noise_msg_encrypt(uint8_t *dst, const uint8_t *src, size_t src_len, 908 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], uint8_t hash[NOISE_HASH_LEN]) 909 { 910 /* Nonce always zero for Noise_IK */ 911 chacha20poly1305_encrypt(dst, src, src_len, 912 hash, NOISE_HASH_LEN, 0, key); 913 noise_mix_hash(hash, dst, src_len + NOISE_AUTHTAG_LEN); 914 } 915 916 static int 917 noise_msg_decrypt(uint8_t *dst, const uint8_t *src, size_t src_len, 918 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], uint8_t hash[NOISE_HASH_LEN]) 919 { 920 /* Nonce always zero for Noise_IK */ 921 if (!chacha20poly1305_decrypt(dst, src, src_len, 922 hash, NOISE_HASH_LEN, 0, key)) 923 return EINVAL; 924 noise_mix_hash(hash, src, src_len); 925 return 0; 926 } 927 928 static void 929 noise_msg_ephemeral(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 930 const uint8_t src[NOISE_PUBLIC_KEY_LEN]) 931 { 932 noise_mix_hash(hash, src, NOISE_PUBLIC_KEY_LEN); 933 noise_kdf(ck, NULL, NULL, src, NOISE_HASH_LEN, 0, 0, 934 NOISE_PUBLIC_KEY_LEN, ck); 935 } 936 937 static void 938 noise_tai64n_now(uint8_t output[NOISE_TIMESTAMP_LEN]) 939 { 940 struct timespec time; 941 uint64_t sec; 942 uint32_t nsec; 943 944 getnanotime(&time); 945 946 /* Round down the nsec counter to limit precise timing leak. */ 947 time.tv_nsec &= REJECT_INTERVAL_MASK; 948 949 /* https://cr.yp.to/libtai/tai64.html */ 950 sec = htobe64(0x400000000000000aULL + time.tv_sec); 951 nsec = htobe32(time.tv_nsec); 952 953 /* memcpy to output buffer, assuming output could be unaligned. */ 954 memcpy(output, &sec, sizeof(sec)); 955 memcpy(output + sizeof(sec), &nsec, sizeof(nsec)); 956 } 957 958 static int 959 noise_timer_expired(struct timespec *birthdate, time_t sec, long nsec) 960 { 961 struct timespec uptime; 962 struct timespec expire = { .tv_sec = sec, .tv_nsec = nsec }; 963 964 /* We don't really worry about a zeroed birthdate, to avoid the extra 965 * check on every encrypt/decrypt. This does mean that r_last_init 966 * check may fail if getnanouptime is < REJECT_INTERVAL from 0. */ 967 968 getnanouptime(&uptime); 969 timespecadd(birthdate, &expire, &expire); 970 return timespeccmp(&uptime, &expire, >) ? ETIMEDOUT : 0; 971 } 972 973 #ifdef WGTEST 974 975 #define MESSAGE_LEN 64 976 #define LARGE_MESSAGE_LEN 1420 977 978 #define T_LIM (COUNTER_WINDOW_SIZE + 1) 979 #define T_INIT do { \ 980 bzero(&ctr, sizeof(ctr)); \ 981 rw_init(&ctr.c_lock, "counter"); \ 982 } while (0) 983 #define T(num, v, e) do { \ 984 if (noise_counter_recv(&ctr, v) != e) { \ 985 printf("%s, test %d: failed.\n", __func__, num); \ 986 return; \ 987 } \ 988 } while (0) 989 #define T_FAILED(test) do { \ 990 printf("%s %s: failed\n", __func__, test); \ 991 return; \ 992 } while (0) 993 #define T_PASSED printf("%s: passed.\n", __func__) 994 995 static struct noise_local al, bl; 996 static struct noise_remote ar, br; 997 998 static struct noise_initiation { 999 uint32_t s_idx; 1000 uint8_t ue[NOISE_PUBLIC_KEY_LEN]; 1001 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN]; 1002 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]; 1003 } init; 1004 1005 static struct noise_response { 1006 uint32_t s_idx; 1007 uint32_t r_idx; 1008 uint8_t ue[NOISE_PUBLIC_KEY_LEN]; 1009 uint8_t en[0 + NOISE_AUTHTAG_LEN]; 1010 } resp; 1011 1012 static uint64_t nonce; 1013 static uint32_t index; 1014 static uint8_t data[MESSAGE_LEN + NOISE_AUTHTAG_LEN]; 1015 static uint8_t largedata[LARGE_MESSAGE_LEN + NOISE_AUTHTAG_LEN]; 1016 1017 static struct noise_remote * 1018 upcall_get(void *x0, uint8_t *x1) { return x0; } 1019 static uint32_t 1020 upcall_set(void *x0, struct noise_remote *x1) { return 5; } 1021 static void 1022 upcall_drop(void *x0, uint32_t x1) { } 1023 1024 static void 1025 noise_counter_test() 1026 { 1027 struct noise_counter ctr; 1028 int i; 1029 1030 T_INIT; 1031 /* T(test number, nonce, expected_response) */ 1032 T( 1, 0, 0); 1033 T( 2, 1, 0); 1034 T( 3, 1, EEXIST); 1035 T( 4, 9, 0); 1036 T( 5, 8, 0); 1037 T( 6, 7, 0); 1038 T( 7, 7, EEXIST); 1039 T( 8, T_LIM, 0); 1040 T( 9, T_LIM - 1, 0); 1041 T(10, T_LIM - 1, EEXIST); 1042 T(11, T_LIM - 2, 0); 1043 T(12, 2, 0); 1044 T(13, 2, EEXIST); 1045 T(14, T_LIM + 16, 0); 1046 T(15, 3, EEXIST); 1047 T(16, T_LIM + 16, EEXIST); 1048 T(17, T_LIM * 4, 0); 1049 T(18, T_LIM * 4 - (T_LIM - 1), 0); 1050 T(19, 10, EEXIST); 1051 T(20, T_LIM * 4 - T_LIM, EEXIST); 1052 T(21, T_LIM * 4 - (T_LIM + 1), EEXIST); 1053 T(22, T_LIM * 4 - (T_LIM - 2), 0); 1054 T(23, T_LIM * 4 + 1 - T_LIM, EEXIST); 1055 T(24, 0, EEXIST); 1056 T(25, REJECT_AFTER_MESSAGES, EEXIST); 1057 T(26, REJECT_AFTER_MESSAGES - 1, 0); 1058 T(27, REJECT_AFTER_MESSAGES, EEXIST); 1059 T(28, REJECT_AFTER_MESSAGES - 1, EEXIST); 1060 T(29, REJECT_AFTER_MESSAGES - 2, 0); 1061 T(30, REJECT_AFTER_MESSAGES + 1, EEXIST); 1062 T(31, REJECT_AFTER_MESSAGES + 2, EEXIST); 1063 T(32, REJECT_AFTER_MESSAGES - 2, EEXIST); 1064 T(33, REJECT_AFTER_MESSAGES - 3, 0); 1065 T(34, 0, EEXIST); 1066 1067 T_INIT; 1068 for (i = 1; i <= COUNTER_WINDOW_SIZE; ++i) 1069 T(35, i, 0); 1070 T(36, 0, 0); 1071 T(37, 0, EEXIST); 1072 1073 T_INIT; 1074 for (i = 2; i <= COUNTER_WINDOW_SIZE + 1; ++i) 1075 T(38, i, 0); 1076 T(39, 1, 0); 1077 T(40, 0, EEXIST); 1078 1079 T_INIT; 1080 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 0;) 1081 T(41, i, 0); 1082 1083 T_INIT; 1084 for (i = COUNTER_WINDOW_SIZE + 2; i-- > 1;) 1085 T(42, i, 0); 1086 T(43, 0, EEXIST); 1087 1088 T_INIT; 1089 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 1;) 1090 T(44, i, 0); 1091 T(45, COUNTER_WINDOW_SIZE + 1, 0); 1092 T(46, 0, EEXIST); 1093 1094 T_INIT; 1095 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 1;) 1096 T(47, i, 0); 1097 T(48, 0, 0); 1098 T(49, COUNTER_WINDOW_SIZE + 1, 0); 1099 1100 T_PASSED; 1101 } 1102 1103 static void 1104 noise_handshake_init(struct noise_local *al, struct noise_remote *ar, 1105 struct noise_local *bl, struct noise_remote *br) 1106 { 1107 uint8_t apriv[NOISE_PUBLIC_KEY_LEN], bpriv[NOISE_PUBLIC_KEY_LEN]; 1108 uint8_t apub[NOISE_PUBLIC_KEY_LEN], bpub[NOISE_PUBLIC_KEY_LEN]; 1109 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]; 1110 1111 struct noise_upcall upcall = { 1112 .u_arg = NULL, 1113 .u_remote_get = upcall_get, 1114 .u_index_set = upcall_set, 1115 .u_index_drop = upcall_drop, 1116 }; 1117 1118 upcall.u_arg = ar; 1119 noise_local_init(al, &upcall); 1120 upcall.u_arg = br; 1121 noise_local_init(bl, &upcall); 1122 1123 arc4random_buf(apriv, NOISE_PUBLIC_KEY_LEN); 1124 arc4random_buf(bpriv, NOISE_PUBLIC_KEY_LEN); 1125 1126 noise_local_lock_identity(al); 1127 noise_local_set_private(al, apriv); 1128 noise_local_unlock_identity(al); 1129 1130 noise_local_lock_identity(bl); 1131 noise_local_set_private(bl, bpriv); 1132 noise_local_unlock_identity(bl); 1133 1134 noise_local_keys(al, apub, NULL); 1135 noise_local_keys(bl, bpub, NULL); 1136 1137 noise_remote_init(ar, bpub, al); 1138 noise_remote_init(br, apub, bl); 1139 1140 arc4random_buf(psk, NOISE_SYMMETRIC_KEY_LEN); 1141 noise_remote_set_psk(ar, psk); 1142 noise_remote_set_psk(br, psk); 1143 } 1144 1145 static void 1146 noise_handshake_test() 1147 { 1148 struct noise_remote *r; 1149 int i; 1150 1151 noise_handshake_init(&al, &ar, &bl, &br); 1152 1153 /* Create initiation */ 1154 if (noise_create_initiation(&ar, &init.s_idx, 1155 init.ue, init.es, init.ets) != 0) 1156 T_FAILED("create_initiation"); 1157 1158 /* Check encrypted (es) validation */ 1159 for (i = 0; i < sizeof(init.es); i++) { 1160 init.es[i] = ~init.es[i]; 1161 if (noise_consume_initiation(&bl, &r, init.s_idx, 1162 init.ue, init.es, init.ets) != EINVAL) 1163 T_FAILED("consume_initiation_es"); 1164 init.es[i] = ~init.es[i]; 1165 } 1166 1167 /* Check encrypted (ets) validation */ 1168 for (i = 0; i < sizeof(init.ets); i++) { 1169 init.ets[i] = ~init.ets[i]; 1170 if (noise_consume_initiation(&bl, &r, init.s_idx, 1171 init.ue, init.es, init.ets) != EINVAL) 1172 T_FAILED("consume_initiation_ets"); 1173 init.ets[i] = ~init.ets[i]; 1174 } 1175 1176 /* Consume initiation properly */ 1177 if (noise_consume_initiation(&bl, &r, init.s_idx, 1178 init.ue, init.es, init.ets) != 0) 1179 T_FAILED("consume_initiation"); 1180 if (r != &br) 1181 T_FAILED("remote_lookup"); 1182 1183 /* Replay initiation */ 1184 if (noise_consume_initiation(&bl, &r, init.s_idx, 1185 init.ue, init.es, init.ets) != EINVAL) 1186 T_FAILED("consume_initiation_replay"); 1187 if (r != &br) 1188 T_FAILED("remote_lookup_r_unchanged"); 1189 1190 /* Create response */ 1191 if (noise_create_response(&br, &resp.s_idx, 1192 &resp.r_idx, resp.ue, resp.en) != 0) 1193 T_FAILED("create_response"); 1194 1195 /* Check encrypted (en) validation */ 1196 for (i = 0; i < sizeof(resp.en); i++) { 1197 resp.en[i] = ~resp.en[i]; 1198 if (noise_consume_response(&ar, resp.s_idx, 1199 resp.r_idx, resp.ue, resp.en) != EINVAL) 1200 T_FAILED("consume_response_en"); 1201 resp.en[i] = ~resp.en[i]; 1202 } 1203 1204 /* Consume response properly */ 1205 if (noise_consume_response(&ar, resp.s_idx, 1206 resp.r_idx, resp.ue, resp.en) != 0) 1207 T_FAILED("consume_response"); 1208 1209 /* Derive keys on both sides */ 1210 if (noise_remote_begin_session(&ar) != 0) 1211 T_FAILED("promote_ar"); 1212 if (noise_remote_begin_session(&br) != 0) 1213 T_FAILED("promote_br"); 1214 1215 for (i = 0; i < MESSAGE_LEN; i++) 1216 data[i] = i; 1217 1218 /* Since bob is responder, he must not encrypt until confirmed */ 1219 if (noise_remote_encrypt(&br, &index, &nonce, 1220 data, MESSAGE_LEN) != EINVAL) 1221 T_FAILED("encrypt_kci_wait"); 1222 1223 /* Alice now encrypt and gets bob to decrypt */ 1224 if (noise_remote_encrypt(&ar, &index, &nonce, 1225 data, MESSAGE_LEN) != 0) 1226 T_FAILED("encrypt_akp"); 1227 if (noise_remote_decrypt(&br, index, nonce, 1228 data, MESSAGE_LEN + NOISE_AUTHTAG_LEN) != ECONNRESET) 1229 T_FAILED("decrypt_bkp"); 1230 1231 for (i = 0; i < MESSAGE_LEN; i++) 1232 if (data[i] != i) 1233 T_FAILED("decrypt_message_akp_bkp"); 1234 1235 /* Now bob has received confirmation, he can encrypt */ 1236 if (noise_remote_encrypt(&br, &index, &nonce, 1237 data, MESSAGE_LEN) != 0) 1238 T_FAILED("encrypt_kci_ready"); 1239 if (noise_remote_decrypt(&ar, index, nonce, 1240 data, MESSAGE_LEN + NOISE_AUTHTAG_LEN) != 0) 1241 T_FAILED("decrypt_akp"); 1242 1243 for (i = 0; i < MESSAGE_LEN; i++) 1244 if (data[i] != i) 1245 T_FAILED("decrypt_message_bkp_akp"); 1246 1247 T_PASSED; 1248 } 1249 1250 static void 1251 noise_speed_test() 1252 { 1253 #define SPEED_ITER (1<<16) 1254 struct timespec start, end; 1255 struct noise_remote *r; 1256 int nsec, i; 1257 1258 #define NSEC 1000000000 1259 #define T_TIME_START(iter, size) do { \ 1260 printf("%s %d %d byte encryptions\n", __func__, iter, size); \ 1261 nanouptime(&start); \ 1262 } while (0) 1263 #define T_TIME_END(iter, size) do { \ 1264 nanouptime(&end); \ 1265 timespecsub(&end, &start, &end); \ 1266 nsec = (end.tv_sec * NSEC + end.tv_nsec) / iter; \ 1267 printf("%s %d nsec/iter, %d iter/sec, %d byte/sec\n", \ 1268 __func__, nsec, NSEC / nsec, NSEC / nsec * size); \ 1269 } while (0) 1270 #define T_TIME_START_SINGLE(name) do { \ 1271 printf("%s %s\n", __func__, name); \ 1272 nanouptime(&start); \ 1273 } while (0) 1274 #define T_TIME_END_SINGLE() do { \ 1275 nanouptime(&end); \ 1276 timespecsub(&end, &start, &end); \ 1277 nsec = (end.tv_sec * NSEC + end.tv_nsec); \ 1278 printf("%s %d nsec/iter, %d iter/sec\n", \ 1279 __func__, nsec, NSEC / nsec); \ 1280 } while (0) 1281 1282 noise_handshake_init(&al, &ar, &bl, &br); 1283 1284 T_TIME_START_SINGLE("create_initiation"); 1285 if (noise_create_initiation(&ar, &init.s_idx, 1286 init.ue, init.es, init.ets) != 0) 1287 T_FAILED("create_initiation"); 1288 T_TIME_END_SINGLE(); 1289 1290 T_TIME_START_SINGLE("consume_initiation"); 1291 if (noise_consume_initiation(&bl, &r, init.s_idx, 1292 init.ue, init.es, init.ets) != 0) 1293 T_FAILED("consume_initiation"); 1294 T_TIME_END_SINGLE(); 1295 1296 T_TIME_START_SINGLE("create_response"); 1297 if (noise_create_response(&br, &resp.s_idx, 1298 &resp.r_idx, resp.ue, resp.en) != 0) 1299 T_FAILED("create_response"); 1300 T_TIME_END_SINGLE(); 1301 1302 T_TIME_START_SINGLE("consume_response"); 1303 if (noise_consume_response(&ar, resp.s_idx, 1304 resp.r_idx, resp.ue, resp.en) != 0) 1305 T_FAILED("consume_response"); 1306 T_TIME_END_SINGLE(); 1307 1308 /* Derive keys on both sides */ 1309 T_TIME_START_SINGLE("derive_keys"); 1310 if (noise_remote_begin_session(&ar) != 0) 1311 T_FAILED("begin_ar"); 1312 T_TIME_END_SINGLE(); 1313 if (noise_remote_begin_session(&br) != 0) 1314 T_FAILED("begin_br"); 1315 1316 /* Small data encryptions */ 1317 T_TIME_START(SPEED_ITER, MESSAGE_LEN); 1318 for (i = 0; i < SPEED_ITER; i++) { 1319 if (noise_remote_encrypt(&ar, &index, &nonce, 1320 data, MESSAGE_LEN) != 0) 1321 T_FAILED("encrypt_akp"); 1322 } 1323 T_TIME_END(SPEED_ITER, MESSAGE_LEN); 1324 1325 1326 /* Large data encryptions */ 1327 T_TIME_START(SPEED_ITER, LARGE_MESSAGE_LEN); 1328 for (i = 0; i < SPEED_ITER; i++) { 1329 if (noise_remote_encrypt(&ar, &index, &nonce, 1330 largedata, LARGE_MESSAGE_LEN) != 0) 1331 T_FAILED("encrypt_akp"); 1332 } 1333 T_TIME_END(SPEED_ITER, LARGE_MESSAGE_LEN); 1334 } 1335 1336 void 1337 noise_test() 1338 { 1339 noise_counter_test(); 1340 noise_handshake_test(); 1341 noise_speed_test(); 1342 } 1343 1344 #endif /* WGTEST */ 1345