1 /* $OpenBSD: wg_noise.c,v 1.6 2023/02/03 18:31:17 miod Exp $ */ 2 /* 3 * Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. 4 * Copyright (C) 2019-2020 Matt Dunwoodie <ncon@noconroy.net> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <sys/types.h> 20 #include <sys/systm.h> 21 #include <sys/param.h> 22 #include <sys/atomic.h> 23 #include <sys/rwlock.h> 24 25 #include <crypto/blake2s.h> 26 #include <crypto/curve25519.h> 27 #include <crypto/chachapoly.h> 28 29 #include <net/wg_noise.h> 30 31 /* Private functions */ 32 static struct noise_keypair * 33 noise_remote_keypair_allocate(struct noise_remote *); 34 static void 35 noise_remote_keypair_free(struct noise_remote *, 36 struct noise_keypair *); 37 static uint32_t noise_remote_handshake_index_get(struct noise_remote *); 38 static void noise_remote_handshake_index_drop(struct noise_remote *); 39 40 static uint64_t noise_counter_send(struct noise_counter *); 41 static int noise_counter_recv(struct noise_counter *, uint64_t); 42 43 static void noise_kdf(uint8_t *, uint8_t *, uint8_t *, const uint8_t *, 44 size_t, size_t, size_t, size_t, 45 const uint8_t [NOISE_HASH_LEN]); 46 static int noise_mix_dh( 47 uint8_t [NOISE_HASH_LEN], 48 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 49 const uint8_t [NOISE_PUBLIC_KEY_LEN], 50 const uint8_t [NOISE_PUBLIC_KEY_LEN]); 51 static int noise_mix_ss( 52 uint8_t ck[NOISE_HASH_LEN], 53 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 54 const uint8_t ss[NOISE_PUBLIC_KEY_LEN]); 55 static void noise_mix_hash( 56 uint8_t [NOISE_HASH_LEN], 57 const uint8_t *, 58 size_t); 59 static void noise_mix_psk( 60 uint8_t [NOISE_HASH_LEN], 61 uint8_t [NOISE_HASH_LEN], 62 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 63 const uint8_t [NOISE_SYMMETRIC_KEY_LEN]); 64 static void noise_param_init( 65 uint8_t [NOISE_HASH_LEN], 66 uint8_t [NOISE_HASH_LEN], 67 const uint8_t [NOISE_PUBLIC_KEY_LEN]); 68 69 static void noise_msg_encrypt(uint8_t *, const uint8_t *, size_t, 70 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 71 uint8_t [NOISE_HASH_LEN]); 72 static int noise_msg_decrypt(uint8_t *, const uint8_t *, size_t, 73 uint8_t [NOISE_SYMMETRIC_KEY_LEN], 74 uint8_t [NOISE_HASH_LEN]); 75 static void noise_msg_ephemeral( 76 uint8_t [NOISE_HASH_LEN], 77 uint8_t [NOISE_HASH_LEN], 78 const uint8_t src[NOISE_PUBLIC_KEY_LEN]); 79 80 static void noise_tai64n_now(uint8_t [NOISE_TIMESTAMP_LEN]); 81 static int noise_timer_expired(struct timespec *, time_t, long); 82 83 /* Set/Get noise parameters */ 84 void 85 noise_local_init(struct noise_local *l, struct noise_upcall *upcall) 86 { 87 bzero(l, sizeof(*l)); 88 rw_init(&l->l_identity_lock, "noise_local_identity"); 89 l->l_upcall = *upcall; 90 } 91 92 void 93 noise_local_lock_identity(struct noise_local *l) 94 { 95 rw_enter_write(&l->l_identity_lock); 96 } 97 98 void 99 noise_local_unlock_identity(struct noise_local *l) 100 { 101 rw_exit_write(&l->l_identity_lock); 102 } 103 104 int 105 noise_local_set_private(struct noise_local *l, 106 uint8_t private[NOISE_PUBLIC_KEY_LEN]) 107 { 108 rw_assert_wrlock(&l->l_identity_lock); 109 110 memcpy(l->l_private, private, NOISE_PUBLIC_KEY_LEN); 111 curve25519_clamp_secret(l->l_private); 112 l->l_has_identity = curve25519_generate_public(l->l_public, private); 113 114 return l->l_has_identity ? 0 : ENXIO; 115 } 116 117 int 118 noise_local_keys(struct noise_local *l, uint8_t public[NOISE_PUBLIC_KEY_LEN], 119 uint8_t private[NOISE_PUBLIC_KEY_LEN]) 120 { 121 int ret = 0; 122 rw_enter_read(&l->l_identity_lock); 123 if (l->l_has_identity) { 124 if (public != NULL) 125 memcpy(public, l->l_public, NOISE_PUBLIC_KEY_LEN); 126 if (private != NULL) 127 memcpy(private, l->l_private, NOISE_PUBLIC_KEY_LEN); 128 } else { 129 ret = ENXIO; 130 } 131 rw_exit_read(&l->l_identity_lock); 132 return ret; 133 } 134 135 void 136 noise_remote_init(struct noise_remote *r, uint8_t public[NOISE_PUBLIC_KEY_LEN], 137 struct noise_local *l) 138 { 139 bzero(r, sizeof(*r)); 140 memcpy(r->r_public, public, NOISE_PUBLIC_KEY_LEN); 141 rw_init(&r->r_handshake_lock, "noise_handshake"); 142 rw_init(&r->r_keypair_lock, "noise_keypair"); 143 144 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[0], kp_entry); 145 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[1], kp_entry); 146 SLIST_INSERT_HEAD(&r->r_unused_keypairs, &r->r_keypair[2], kp_entry); 147 148 KASSERT(l != NULL); 149 r->r_local = l; 150 151 rw_enter_write(&l->l_identity_lock); 152 noise_remote_precompute(r); 153 rw_exit_write(&l->l_identity_lock); 154 } 155 156 int 157 noise_remote_set_psk(struct noise_remote *r, 158 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 159 { 160 int same; 161 rw_enter_write(&r->r_handshake_lock); 162 same = !timingsafe_bcmp(r->r_psk, psk, NOISE_SYMMETRIC_KEY_LEN); 163 if (!same) { 164 memcpy(r->r_psk, psk, NOISE_SYMMETRIC_KEY_LEN); 165 } 166 rw_exit_write(&r->r_handshake_lock); 167 return same ? EEXIST : 0; 168 } 169 170 int 171 noise_remote_keys(struct noise_remote *r, uint8_t public[NOISE_PUBLIC_KEY_LEN], 172 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 173 { 174 static uint8_t null_psk[NOISE_SYMMETRIC_KEY_LEN]; 175 int ret; 176 177 if (public != NULL) 178 memcpy(public, r->r_public, NOISE_PUBLIC_KEY_LEN); 179 180 rw_enter_read(&r->r_handshake_lock); 181 if (psk != NULL) 182 memcpy(psk, r->r_psk, NOISE_SYMMETRIC_KEY_LEN); 183 ret = timingsafe_bcmp(r->r_psk, null_psk, NOISE_SYMMETRIC_KEY_LEN); 184 rw_exit_read(&r->r_handshake_lock); 185 186 /* If r_psk != null_psk return 0, else ENOENT (no psk) */ 187 return ret ? 0 : ENOENT; 188 } 189 190 void 191 noise_remote_precompute(struct noise_remote *r) 192 { 193 struct noise_local *l = r->r_local; 194 rw_assert_wrlock(&l->l_identity_lock); 195 if (!l->l_has_identity) 196 bzero(r->r_ss, NOISE_PUBLIC_KEY_LEN); 197 else if (!curve25519(r->r_ss, l->l_private, r->r_public)) 198 bzero(r->r_ss, NOISE_PUBLIC_KEY_LEN); 199 200 rw_enter_write(&r->r_handshake_lock); 201 noise_remote_handshake_index_drop(r); 202 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 203 rw_exit_write(&r->r_handshake_lock); 204 } 205 206 /* Handshake functions */ 207 int 208 noise_create_initiation(struct noise_remote *r, uint32_t *s_idx, 209 uint8_t ue[NOISE_PUBLIC_KEY_LEN], 210 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN], 211 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]) 212 { 213 struct noise_handshake *hs = &r->r_handshake; 214 struct noise_local *l = r->r_local; 215 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 216 int ret = EINVAL; 217 218 rw_enter_read(&l->l_identity_lock); 219 rw_enter_write(&r->r_handshake_lock); 220 if (!l->l_has_identity) 221 goto error; 222 noise_param_init(hs->hs_ck, hs->hs_hash, r->r_public); 223 224 /* e */ 225 curve25519_generate_secret(hs->hs_e); 226 if (curve25519_generate_public(ue, hs->hs_e) == 0) 227 goto error; 228 noise_msg_ephemeral(hs->hs_ck, hs->hs_hash, ue); 229 230 /* es */ 231 if (noise_mix_dh(hs->hs_ck, key, hs->hs_e, r->r_public) != 0) 232 goto error; 233 234 /* s */ 235 noise_msg_encrypt(es, l->l_public, 236 NOISE_PUBLIC_KEY_LEN, key, hs->hs_hash); 237 238 /* ss */ 239 if (noise_mix_ss(hs->hs_ck, key, r->r_ss) != 0) 240 goto error; 241 242 /* {t} */ 243 noise_tai64n_now(ets); 244 noise_msg_encrypt(ets, ets, 245 NOISE_TIMESTAMP_LEN, key, hs->hs_hash); 246 247 noise_remote_handshake_index_drop(r); 248 hs->hs_state = CREATED_INITIATION; 249 hs->hs_local_index = noise_remote_handshake_index_get(r); 250 *s_idx = hs->hs_local_index; 251 ret = 0; 252 error: 253 rw_exit_write(&r->r_handshake_lock); 254 rw_exit_read(&l->l_identity_lock); 255 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 256 return ret; 257 } 258 259 int 260 noise_consume_initiation(struct noise_local *l, struct noise_remote **rp, 261 uint32_t s_idx, uint8_t ue[NOISE_PUBLIC_KEY_LEN], 262 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN], 263 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]) 264 { 265 struct noise_remote *r; 266 struct noise_handshake hs; 267 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 268 uint8_t r_public[NOISE_PUBLIC_KEY_LEN]; 269 uint8_t timestamp[NOISE_TIMESTAMP_LEN]; 270 int ret = EINVAL; 271 272 rw_enter_read(&l->l_identity_lock); 273 if (!l->l_has_identity) 274 goto error; 275 noise_param_init(hs.hs_ck, hs.hs_hash, l->l_public); 276 277 /* e */ 278 noise_msg_ephemeral(hs.hs_ck, hs.hs_hash, ue); 279 280 /* es */ 281 if (noise_mix_dh(hs.hs_ck, key, l->l_private, ue) != 0) 282 goto error; 283 284 /* s */ 285 if (noise_msg_decrypt(r_public, es, 286 NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 287 goto error; 288 289 /* Lookup the remote we received from */ 290 if ((r = l->l_upcall.u_remote_get(l->l_upcall.u_arg, r_public)) == NULL) 291 goto error; 292 293 /* ss */ 294 if (noise_mix_ss(hs.hs_ck, key, r->r_ss) != 0) 295 goto error; 296 297 /* {t} */ 298 if (noise_msg_decrypt(timestamp, ets, 299 NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 300 goto error; 301 302 memcpy(hs.hs_e, ue, NOISE_PUBLIC_KEY_LEN); 303 304 /* We have successfully computed the same results, now we ensure that 305 * this is not an initiation replay, or a flood attack */ 306 rw_enter_write(&r->r_handshake_lock); 307 308 /* Replay */ 309 if (memcmp(timestamp, r->r_timestamp, NOISE_TIMESTAMP_LEN) > 0) 310 memcpy(r->r_timestamp, timestamp, NOISE_TIMESTAMP_LEN); 311 else 312 goto error_set; 313 /* Flood attack */ 314 if (noise_timer_expired(&r->r_last_init, 0, REJECT_INTERVAL)) 315 getnanouptime(&r->r_last_init); 316 else 317 goto error_set; 318 319 /* Ok, we're happy to accept this initiation now */ 320 noise_remote_handshake_index_drop(r); 321 hs.hs_state = CONSUMED_INITIATION; 322 hs.hs_local_index = noise_remote_handshake_index_get(r); 323 hs.hs_remote_index = s_idx; 324 r->r_handshake = hs; 325 *rp = r; 326 ret = 0; 327 error_set: 328 rw_exit_write(&r->r_handshake_lock); 329 error: 330 rw_exit_read(&l->l_identity_lock); 331 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 332 explicit_bzero(&hs, sizeof(hs)); 333 return ret; 334 } 335 336 int 337 noise_create_response(struct noise_remote *r, uint32_t *s_idx, uint32_t *r_idx, 338 uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0 + NOISE_AUTHTAG_LEN]) 339 { 340 struct noise_handshake *hs = &r->r_handshake; 341 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 342 uint8_t e[NOISE_PUBLIC_KEY_LEN]; 343 int ret = EINVAL; 344 345 rw_enter_read(&r->r_local->l_identity_lock); 346 rw_enter_write(&r->r_handshake_lock); 347 348 if (hs->hs_state != CONSUMED_INITIATION) 349 goto error; 350 351 /* e */ 352 curve25519_generate_secret(e); 353 if (curve25519_generate_public(ue, e) == 0) 354 goto error; 355 noise_msg_ephemeral(hs->hs_ck, hs->hs_hash, ue); 356 357 /* ee */ 358 if (noise_mix_dh(hs->hs_ck, NULL, e, hs->hs_e) != 0) 359 goto error; 360 361 /* se */ 362 if (noise_mix_dh(hs->hs_ck, NULL, e, r->r_public) != 0) 363 goto error; 364 365 /* psk */ 366 noise_mix_psk(hs->hs_ck, hs->hs_hash, key, r->r_psk); 367 368 /* {} */ 369 noise_msg_encrypt(en, NULL, 0, key, hs->hs_hash); 370 371 hs->hs_state = CREATED_RESPONSE; 372 *r_idx = hs->hs_remote_index; 373 *s_idx = hs->hs_local_index; 374 ret = 0; 375 error: 376 rw_exit_write(&r->r_handshake_lock); 377 rw_exit_read(&r->r_local->l_identity_lock); 378 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 379 explicit_bzero(e, NOISE_PUBLIC_KEY_LEN); 380 return ret; 381 } 382 383 int 384 noise_consume_response(struct noise_remote *r, uint32_t s_idx, uint32_t r_idx, 385 uint8_t ue[NOISE_PUBLIC_KEY_LEN], uint8_t en[0 + NOISE_AUTHTAG_LEN]) 386 { 387 struct noise_local *l = r->r_local; 388 struct noise_handshake hs; 389 uint8_t key[NOISE_SYMMETRIC_KEY_LEN]; 390 uint8_t preshared_key[NOISE_PUBLIC_KEY_LEN]; 391 int ret = EINVAL; 392 393 rw_enter_read(&l->l_identity_lock); 394 if (!l->l_has_identity) 395 goto error; 396 397 rw_enter_read(&r->r_handshake_lock); 398 hs = r->r_handshake; 399 memcpy(preshared_key, r->r_psk, NOISE_SYMMETRIC_KEY_LEN); 400 rw_exit_read(&r->r_handshake_lock); 401 402 if (hs.hs_state != CREATED_INITIATION || 403 hs.hs_local_index != r_idx) 404 goto error; 405 406 /* e */ 407 noise_msg_ephemeral(hs.hs_ck, hs.hs_hash, ue); 408 409 /* ee */ 410 if (noise_mix_dh(hs.hs_ck, NULL, hs.hs_e, ue) != 0) 411 goto error; 412 413 /* se */ 414 if (noise_mix_dh(hs.hs_ck, NULL, l->l_private, ue) != 0) 415 goto error; 416 417 /* psk */ 418 noise_mix_psk(hs.hs_ck, hs.hs_hash, key, preshared_key); 419 420 /* {} */ 421 if (noise_msg_decrypt(NULL, en, 422 0 + NOISE_AUTHTAG_LEN, key, hs.hs_hash) != 0) 423 goto error; 424 425 hs.hs_remote_index = s_idx; 426 427 rw_enter_write(&r->r_handshake_lock); 428 if (r->r_handshake.hs_state == hs.hs_state && 429 r->r_handshake.hs_local_index == hs.hs_local_index) { 430 r->r_handshake = hs; 431 r->r_handshake.hs_state = CONSUMED_RESPONSE; 432 ret = 0; 433 } 434 rw_exit_write(&r->r_handshake_lock); 435 error: 436 rw_exit_read(&l->l_identity_lock); 437 explicit_bzero(&hs, sizeof(hs)); 438 explicit_bzero(key, NOISE_SYMMETRIC_KEY_LEN); 439 return ret; 440 } 441 442 int 443 noise_remote_begin_session(struct noise_remote *r) 444 { 445 struct noise_handshake *hs = &r->r_handshake; 446 struct noise_keypair kp, *next, *current, *previous; 447 448 rw_enter_write(&r->r_handshake_lock); 449 450 /* We now derive the keypair from the handshake */ 451 if (hs->hs_state == CONSUMED_RESPONSE) { 452 kp.kp_is_initiator = 1; 453 noise_kdf(kp.kp_send, kp.kp_recv, NULL, NULL, 454 NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, 0, 455 hs->hs_ck); 456 } else if (hs->hs_state == CREATED_RESPONSE) { 457 kp.kp_is_initiator = 0; 458 noise_kdf(kp.kp_recv, kp.kp_send, NULL, NULL, 459 NOISE_SYMMETRIC_KEY_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, 0, 460 hs->hs_ck); 461 } else { 462 rw_exit_write(&r->r_handshake_lock); 463 return EINVAL; 464 } 465 466 kp.kp_valid = 1; 467 kp.kp_local_index = hs->hs_local_index; 468 kp.kp_remote_index = hs->hs_remote_index; 469 getnanouptime(&kp.kp_birthdate); 470 bzero(&kp.kp_ctr, sizeof(kp.kp_ctr)); 471 rw_init(&kp.kp_ctr.c_lock, "noise_counter"); 472 473 /* Now we need to add_new_keypair */ 474 rw_enter_write(&r->r_keypair_lock); 475 next = r->r_next; 476 current = r->r_current; 477 previous = r->r_previous; 478 479 if (kp.kp_is_initiator) { 480 if (next != NULL) { 481 r->r_next = NULL; 482 r->r_previous = next; 483 noise_remote_keypair_free(r, current); 484 } else { 485 r->r_previous = current; 486 } 487 488 noise_remote_keypair_free(r, previous); 489 490 r->r_current = noise_remote_keypair_allocate(r); 491 *r->r_current = kp; 492 } else { 493 noise_remote_keypair_free(r, next); 494 r->r_previous = NULL; 495 noise_remote_keypair_free(r, previous); 496 497 r->r_next = noise_remote_keypair_allocate(r); 498 *r->r_next = kp; 499 } 500 rw_exit_write(&r->r_keypair_lock); 501 502 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 503 rw_exit_write(&r->r_handshake_lock); 504 505 explicit_bzero(&kp, sizeof(kp)); 506 return 0; 507 } 508 509 void 510 noise_remote_clear(struct noise_remote *r) 511 { 512 rw_enter_write(&r->r_handshake_lock); 513 noise_remote_handshake_index_drop(r); 514 explicit_bzero(&r->r_handshake, sizeof(r->r_handshake)); 515 rw_exit_write(&r->r_handshake_lock); 516 517 rw_enter_write(&r->r_keypair_lock); 518 noise_remote_keypair_free(r, r->r_next); 519 noise_remote_keypair_free(r, r->r_current); 520 noise_remote_keypair_free(r, r->r_previous); 521 r->r_next = NULL; 522 r->r_current = NULL; 523 r->r_previous = NULL; 524 rw_exit_write(&r->r_keypair_lock); 525 } 526 527 void 528 noise_remote_expire_current(struct noise_remote *r) 529 { 530 rw_enter_write(&r->r_keypair_lock); 531 if (r->r_next != NULL) 532 r->r_next->kp_valid = 0; 533 if (r->r_current != NULL) 534 r->r_current->kp_valid = 0; 535 rw_exit_write(&r->r_keypair_lock); 536 } 537 538 int 539 noise_remote_ready(struct noise_remote *r) 540 { 541 struct noise_keypair *kp; 542 int ret; 543 544 rw_enter_read(&r->r_keypair_lock); 545 /* kp_ctr isn't locked here, we're happy to accept a racy read. */ 546 if ((kp = r->r_current) == NULL || 547 !kp->kp_valid || 548 noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 549 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES || 550 kp->kp_ctr.c_send >= REJECT_AFTER_MESSAGES) 551 ret = EINVAL; 552 else 553 ret = 0; 554 rw_exit_read(&r->r_keypair_lock); 555 return ret; 556 } 557 558 int 559 noise_remote_encrypt(struct noise_remote *r, uint32_t *r_idx, uint64_t *nonce, 560 uint8_t *buf, size_t buflen) 561 { 562 struct noise_keypair *kp; 563 int ret = EINVAL; 564 565 rw_enter_read(&r->r_keypair_lock); 566 if ((kp = r->r_current) == NULL) 567 goto error; 568 569 /* We confirm that our values are within our tolerances. We want: 570 * - a valid keypair 571 * - our keypair to be less than REJECT_AFTER_TIME seconds old 572 * - our receive counter to be less than REJECT_AFTER_MESSAGES 573 * - our send counter to be less than REJECT_AFTER_MESSAGES 574 * 575 * kp_ctr isn't locked here, we're happy to accept a racy read. */ 576 if (!kp->kp_valid || 577 noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 578 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES || 579 ((*nonce = noise_counter_send(&kp->kp_ctr)) > REJECT_AFTER_MESSAGES)) 580 goto error; 581 582 /* We encrypt into the same buffer, so the caller must ensure that buf 583 * has NOISE_AUTHTAG_LEN bytes to store the MAC. The nonce and index 584 * are passed back out to the caller through the provided data pointer. */ 585 *r_idx = kp->kp_remote_index; 586 chacha20poly1305_encrypt(buf, buf, buflen, 587 NULL, 0, *nonce, kp->kp_send); 588 589 /* If our values are still within tolerances, but we are approaching 590 * the tolerances, we notify the caller with ESTALE that they should 591 * establish a new keypair. The current keypair can continue to be used 592 * until the tolerances are hit. We notify if: 593 * - our send counter is valid and not less than REKEY_AFTER_MESSAGES 594 * - we're the initiator and our keypair is older than 595 * REKEY_AFTER_TIME seconds */ 596 ret = ESTALE; 597 if ((kp->kp_valid && *nonce >= REKEY_AFTER_MESSAGES) || 598 (kp->kp_is_initiator && 599 noise_timer_expired(&kp->kp_birthdate, REKEY_AFTER_TIME, 0))) 600 goto error; 601 602 ret = 0; 603 error: 604 rw_exit_read(&r->r_keypair_lock); 605 return ret; 606 } 607 608 int 609 noise_remote_decrypt(struct noise_remote *r, uint32_t r_idx, uint64_t nonce, 610 uint8_t *buf, size_t buflen) 611 { 612 struct noise_keypair *kp; 613 int ret = EINVAL; 614 615 /* We retrieve the keypair corresponding to the provided index. We 616 * attempt the current keypair first as that is most likely. We also 617 * want to make sure that the keypair is valid as it would be 618 * catastrophic to decrypt against a zero'ed keypair. */ 619 rw_enter_read(&r->r_keypair_lock); 620 621 if (r->r_current != NULL && r->r_current->kp_local_index == r_idx) { 622 kp = r->r_current; 623 } else if (r->r_previous != NULL && r->r_previous->kp_local_index == r_idx) { 624 kp = r->r_previous; 625 } else if (r->r_next != NULL && r->r_next->kp_local_index == r_idx) { 626 kp = r->r_next; 627 } else { 628 goto error; 629 } 630 631 /* We confirm that our values are within our tolerances. These values 632 * are the same as the encrypt routine. 633 * 634 * kp_ctr isn't locked here, we're happy to accept a racy read. */ 635 if (noise_timer_expired(&kp->kp_birthdate, REJECT_AFTER_TIME, 0) || 636 kp->kp_ctr.c_recv >= REJECT_AFTER_MESSAGES) 637 goto error; 638 639 /* Decrypt, then validate the counter. We don't want to validate the 640 * counter before decrypting as we do not know the message is authentic 641 * prior to decryption. */ 642 if (chacha20poly1305_decrypt(buf, buf, buflen, 643 NULL, 0, nonce, kp->kp_recv) == 0) 644 goto error; 645 646 if (noise_counter_recv(&kp->kp_ctr, nonce) != 0) 647 goto error; 648 649 /* If we've received the handshake confirming data packet then move the 650 * next keypair into current. If we do slide the next keypair in, then 651 * we skip the REKEY_AFTER_TIME_RECV check. This is safe to do as a 652 * data packet can't confirm a session that we are an INITIATOR of. */ 653 if (kp == r->r_next) { 654 rw_exit_read(&r->r_keypair_lock); 655 rw_enter_write(&r->r_keypair_lock); 656 if (kp == r->r_next && kp->kp_local_index == r_idx) { 657 noise_remote_keypair_free(r, r->r_previous); 658 r->r_previous = r->r_current; 659 r->r_current = r->r_next; 660 r->r_next = NULL; 661 662 ret = ECONNRESET; 663 goto error; 664 } 665 rw_enter(&r->r_keypair_lock, RW_DOWNGRADE); 666 } 667 668 /* Similar to when we encrypt, we want to notify the caller when we 669 * are approaching our tolerances. We notify if: 670 * - we're the initiator and the current keypair is older than 671 * REKEY_AFTER_TIME_RECV seconds. */ 672 ret = ESTALE; 673 kp = r->r_current; 674 if (kp != NULL && 675 kp->kp_valid && 676 kp->kp_is_initiator && 677 noise_timer_expired(&kp->kp_birthdate, REKEY_AFTER_TIME_RECV, 0)) 678 goto error; 679 680 ret = 0; 681 682 error: 683 rw_exit(&r->r_keypair_lock); 684 return ret; 685 } 686 687 /* Private functions - these should not be called outside this file under any 688 * circumstances. */ 689 static struct noise_keypair * 690 noise_remote_keypair_allocate(struct noise_remote *r) 691 { 692 struct noise_keypair *kp; 693 kp = SLIST_FIRST(&r->r_unused_keypairs); 694 SLIST_REMOVE_HEAD(&r->r_unused_keypairs, kp_entry); 695 return kp; 696 } 697 698 static void 699 noise_remote_keypair_free(struct noise_remote *r, struct noise_keypair *kp) 700 { 701 struct noise_upcall *u = &r->r_local->l_upcall; 702 if (kp != NULL) { 703 SLIST_INSERT_HEAD(&r->r_unused_keypairs, kp, kp_entry); 704 u->u_index_drop(u->u_arg, kp->kp_local_index); 705 bzero(kp->kp_send, sizeof(kp->kp_send)); 706 bzero(kp->kp_recv, sizeof(kp->kp_recv)); 707 } 708 } 709 710 static uint32_t 711 noise_remote_handshake_index_get(struct noise_remote *r) 712 { 713 struct noise_upcall *u = &r->r_local->l_upcall; 714 return u->u_index_set(u->u_arg, r); 715 } 716 717 static void 718 noise_remote_handshake_index_drop(struct noise_remote *r) 719 { 720 struct noise_handshake *hs = &r->r_handshake; 721 struct noise_upcall *u = &r->r_local->l_upcall; 722 rw_assert_wrlock(&r->r_handshake_lock); 723 if (hs->hs_state != HS_ZEROED) 724 u->u_index_drop(u->u_arg, hs->hs_local_index); 725 } 726 727 static uint64_t 728 noise_counter_send(struct noise_counter *ctr) 729 { 730 #ifdef __LP64__ 731 return atomic_inc_long_nv((u_long *)&ctr->c_send) - 1; 732 #else 733 uint64_t ret; 734 rw_enter_write(&ctr->c_lock); 735 ret = ctr->c_send++; 736 rw_exit_write(&ctr->c_lock); 737 return ret; 738 #endif 739 } 740 741 static int 742 noise_counter_recv(struct noise_counter *ctr, uint64_t recv) 743 { 744 uint64_t i, top, index_recv, index_ctr; 745 unsigned long bit; 746 int ret = EEXIST; 747 748 rw_enter_write(&ctr->c_lock); 749 750 /* Check that the recv counter is valid */ 751 if (ctr->c_recv >= REJECT_AFTER_MESSAGES || 752 recv >= REJECT_AFTER_MESSAGES) 753 goto error; 754 755 /* If the packet is out of the window, invalid */ 756 if (recv + COUNTER_WINDOW_SIZE < ctr->c_recv) 757 goto error; 758 759 /* If the new counter is ahead of the current counter, we'll need to 760 * zero out the bitmap that has previously been used */ 761 index_recv = recv / COUNTER_BITS; 762 index_ctr = ctr->c_recv / COUNTER_BITS; 763 764 if (recv > ctr->c_recv) { 765 top = MIN(index_recv - index_ctr, COUNTER_NUM); 766 for (i = 1; i <= top; i++) 767 ctr->c_backtrack[ 768 (i + index_ctr) & (COUNTER_NUM - 1)] = 0; 769 ctr->c_recv = recv; 770 } 771 772 index_recv %= COUNTER_NUM; 773 bit = 1ul << (recv % COUNTER_BITS); 774 775 if (ctr->c_backtrack[index_recv] & bit) 776 goto error; 777 778 ctr->c_backtrack[index_recv] |= bit; 779 780 ret = 0; 781 error: 782 rw_exit_write(&ctr->c_lock); 783 return ret; 784 } 785 786 static void 787 noise_kdf(uint8_t *a, uint8_t *b, uint8_t *c, const uint8_t *x, 788 size_t a_len, size_t b_len, size_t c_len, size_t x_len, 789 const uint8_t ck[NOISE_HASH_LEN]) 790 { 791 uint8_t out[BLAKE2S_HASH_SIZE + 1]; 792 uint8_t sec[BLAKE2S_HASH_SIZE]; 793 794 KASSERT(a_len <= BLAKE2S_HASH_SIZE && b_len <= BLAKE2S_HASH_SIZE && 795 c_len <= BLAKE2S_HASH_SIZE); 796 KASSERT(!(b || b_len || c || c_len) || (a && a_len)); 797 KASSERT(!(c || c_len) || (b && b_len)); 798 799 /* Extract entropy from "x" into sec */ 800 blake2s_hmac(sec, x, ck, BLAKE2S_HASH_SIZE, x_len, NOISE_HASH_LEN); 801 802 if (a == NULL || a_len == 0) 803 goto out; 804 805 /* Expand first key: key = sec, data = 0x1 */ 806 out[0] = 1; 807 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, 1, BLAKE2S_HASH_SIZE); 808 memcpy(a, out, a_len); 809 810 if (b == NULL || b_len == 0) 811 goto out; 812 813 /* Expand second key: key = sec, data = "a" || 0x2 */ 814 out[BLAKE2S_HASH_SIZE] = 2; 815 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, BLAKE2S_HASH_SIZE + 1, 816 BLAKE2S_HASH_SIZE); 817 memcpy(b, out, b_len); 818 819 if (c == NULL || c_len == 0) 820 goto out; 821 822 /* Expand third key: key = sec, data = "b" || 0x3 */ 823 out[BLAKE2S_HASH_SIZE] = 3; 824 blake2s_hmac(out, out, sec, BLAKE2S_HASH_SIZE, BLAKE2S_HASH_SIZE + 1, 825 BLAKE2S_HASH_SIZE); 826 memcpy(c, out, c_len); 827 828 out: 829 /* Clear sensitive data from stack */ 830 explicit_bzero(sec, BLAKE2S_HASH_SIZE); 831 explicit_bzero(out, BLAKE2S_HASH_SIZE + 1); 832 } 833 834 static int 835 noise_mix_dh(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 836 const uint8_t private[NOISE_PUBLIC_KEY_LEN], 837 const uint8_t public[NOISE_PUBLIC_KEY_LEN]) 838 { 839 uint8_t dh[NOISE_PUBLIC_KEY_LEN]; 840 841 if (!curve25519(dh, private, public)) 842 return EINVAL; 843 noise_kdf(ck, key, NULL, dh, 844 NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN, ck); 845 explicit_bzero(dh, NOISE_PUBLIC_KEY_LEN); 846 return 0; 847 } 848 849 static int 850 noise_mix_ss(uint8_t ck[NOISE_HASH_LEN], uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 851 const uint8_t ss[NOISE_PUBLIC_KEY_LEN]) 852 { 853 static uint8_t null_point[NOISE_PUBLIC_KEY_LEN]; 854 if (timingsafe_bcmp(ss, null_point, NOISE_PUBLIC_KEY_LEN) == 0) 855 return ENOENT; 856 noise_kdf(ck, key, NULL, ss, 857 NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 0, NOISE_PUBLIC_KEY_LEN, ck); 858 return 0; 859 } 860 861 static void 862 noise_mix_hash(uint8_t hash[NOISE_HASH_LEN], const uint8_t *src, 863 size_t src_len) 864 { 865 struct blake2s_state blake; 866 867 blake2s_init(&blake, NOISE_HASH_LEN); 868 blake2s_update(&blake, hash, NOISE_HASH_LEN); 869 blake2s_update(&blake, src, src_len); 870 blake2s_final(&blake, hash); 871 } 872 873 static void 874 noise_mix_psk(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 875 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], 876 const uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]) 877 { 878 uint8_t tmp[NOISE_HASH_LEN]; 879 880 noise_kdf(ck, tmp, key, psk, 881 NOISE_HASH_LEN, NOISE_HASH_LEN, NOISE_SYMMETRIC_KEY_LEN, 882 NOISE_SYMMETRIC_KEY_LEN, ck); 883 noise_mix_hash(hash, tmp, NOISE_HASH_LEN); 884 explicit_bzero(tmp, NOISE_HASH_LEN); 885 } 886 887 static void 888 noise_param_init(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 889 const uint8_t s[NOISE_PUBLIC_KEY_LEN]) 890 { 891 struct blake2s_state blake; 892 893 blake2s(ck, (uint8_t *)NOISE_HANDSHAKE_NAME, NULL, 894 NOISE_HASH_LEN, strlen(NOISE_HANDSHAKE_NAME), 0); 895 blake2s_init(&blake, NOISE_HASH_LEN); 896 blake2s_update(&blake, ck, NOISE_HASH_LEN); 897 blake2s_update(&blake, (uint8_t *)NOISE_IDENTIFIER_NAME, 898 strlen(NOISE_IDENTIFIER_NAME)); 899 blake2s_final(&blake, hash); 900 901 noise_mix_hash(hash, s, NOISE_PUBLIC_KEY_LEN); 902 } 903 904 static void 905 noise_msg_encrypt(uint8_t *dst, const uint8_t *src, size_t src_len, 906 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], uint8_t hash[NOISE_HASH_LEN]) 907 { 908 /* Nonce always zero for Noise_IK */ 909 chacha20poly1305_encrypt(dst, src, src_len, 910 hash, NOISE_HASH_LEN, 0, key); 911 noise_mix_hash(hash, dst, src_len + NOISE_AUTHTAG_LEN); 912 } 913 914 static int 915 noise_msg_decrypt(uint8_t *dst, const uint8_t *src, size_t src_len, 916 uint8_t key[NOISE_SYMMETRIC_KEY_LEN], uint8_t hash[NOISE_HASH_LEN]) 917 { 918 /* Nonce always zero for Noise_IK */ 919 if (!chacha20poly1305_decrypt(dst, src, src_len, 920 hash, NOISE_HASH_LEN, 0, key)) 921 return EINVAL; 922 noise_mix_hash(hash, src, src_len); 923 return 0; 924 } 925 926 static void 927 noise_msg_ephemeral(uint8_t ck[NOISE_HASH_LEN], uint8_t hash[NOISE_HASH_LEN], 928 const uint8_t src[NOISE_PUBLIC_KEY_LEN]) 929 { 930 noise_mix_hash(hash, src, NOISE_PUBLIC_KEY_LEN); 931 noise_kdf(ck, NULL, NULL, src, NOISE_HASH_LEN, 0, 0, 932 NOISE_PUBLIC_KEY_LEN, ck); 933 } 934 935 static void 936 noise_tai64n_now(uint8_t output[NOISE_TIMESTAMP_LEN]) 937 { 938 struct timespec time; 939 uint64_t sec; 940 uint32_t nsec; 941 942 getnanotime(&time); 943 944 /* Round down the nsec counter to limit precise timing leak. */ 945 time.tv_nsec &= REJECT_INTERVAL_MASK; 946 947 /* https://cr.yp.to/libtai/tai64.html */ 948 sec = htobe64(0x400000000000000aULL + time.tv_sec); 949 nsec = htobe32(time.tv_nsec); 950 951 /* memcpy to output buffer, assuming output could be unaligned. */ 952 memcpy(output, &sec, sizeof(sec)); 953 memcpy(output + sizeof(sec), &nsec, sizeof(nsec)); 954 } 955 956 static int 957 noise_timer_expired(struct timespec *birthdate, time_t sec, long nsec) 958 { 959 struct timespec uptime; 960 struct timespec expire = { .tv_sec = sec, .tv_nsec = nsec }; 961 962 /* We don't really worry about a zeroed birthdate, to avoid the extra 963 * check on every encrypt/decrypt. This does mean that r_last_init 964 * check may fail if getnanouptime is < REJECT_INTERVAL from 0. */ 965 966 getnanouptime(&uptime); 967 timespecadd(birthdate, &expire, &expire); 968 return timespeccmp(&uptime, &expire, >) ? ETIMEDOUT : 0; 969 } 970 971 #ifdef WGTEST 972 973 #define MESSAGE_LEN 64 974 #define LARGE_MESSAGE_LEN 1420 975 976 #define T_LIM (COUNTER_WINDOW_SIZE + 1) 977 #define T_INIT do { \ 978 bzero(&ctr, sizeof(ctr)); \ 979 rw_init(&ctr.c_lock, "counter"); \ 980 } while (0) 981 #define T(num, v, e) do { \ 982 if (noise_counter_recv(&ctr, v) != e) { \ 983 printf("%s, test %d: failed.\n", __func__, num); \ 984 return; \ 985 } \ 986 } while (0) 987 #define T_FAILED(test) do { \ 988 printf("%s %s: failed\n", __func__, test); \ 989 return; \ 990 } while (0) 991 #define T_PASSED printf("%s: passed.\n", __func__) 992 993 static struct noise_local al, bl; 994 static struct noise_remote ar, br; 995 996 static struct noise_initiation { 997 uint32_t s_idx; 998 uint8_t ue[NOISE_PUBLIC_KEY_LEN]; 999 uint8_t es[NOISE_PUBLIC_KEY_LEN + NOISE_AUTHTAG_LEN]; 1000 uint8_t ets[NOISE_TIMESTAMP_LEN + NOISE_AUTHTAG_LEN]; 1001 } init; 1002 1003 static struct noise_response { 1004 uint32_t s_idx; 1005 uint32_t r_idx; 1006 uint8_t ue[NOISE_PUBLIC_KEY_LEN]; 1007 uint8_t en[0 + NOISE_AUTHTAG_LEN]; 1008 } resp; 1009 1010 static uint64_t nonce; 1011 static uint32_t index; 1012 static uint8_t data[MESSAGE_LEN + NOISE_AUTHTAG_LEN]; 1013 static uint8_t largedata[LARGE_MESSAGE_LEN + NOISE_AUTHTAG_LEN]; 1014 1015 static struct noise_remote * 1016 upcall_get(void *x0, uint8_t *x1) { return x0; } 1017 static uint32_t 1018 upcall_set(void *x0, struct noise_remote *x1) { return 5; } 1019 static void 1020 upcall_drop(void *x0, uint32_t x1) { } 1021 1022 static void 1023 noise_counter_test() 1024 { 1025 struct noise_counter ctr; 1026 int i; 1027 1028 T_INIT; 1029 /* T(test number, nonce, expected_response) */ 1030 T( 1, 0, 0); 1031 T( 2, 1, 0); 1032 T( 3, 1, EEXIST); 1033 T( 4, 9, 0); 1034 T( 5, 8, 0); 1035 T( 6, 7, 0); 1036 T( 7, 7, EEXIST); 1037 T( 8, T_LIM, 0); 1038 T( 9, T_LIM - 1, 0); 1039 T(10, T_LIM - 1, EEXIST); 1040 T(11, T_LIM - 2, 0); 1041 T(12, 2, 0); 1042 T(13, 2, EEXIST); 1043 T(14, T_LIM + 16, 0); 1044 T(15, 3, EEXIST); 1045 T(16, T_LIM + 16, EEXIST); 1046 T(17, T_LIM * 4, 0); 1047 T(18, T_LIM * 4 - (T_LIM - 1), 0); 1048 T(19, 10, EEXIST); 1049 T(20, T_LIM * 4 - T_LIM, EEXIST); 1050 T(21, T_LIM * 4 - (T_LIM + 1), EEXIST); 1051 T(22, T_LIM * 4 - (T_LIM - 2), 0); 1052 T(23, T_LIM * 4 + 1 - T_LIM, EEXIST); 1053 T(24, 0, EEXIST); 1054 T(25, REJECT_AFTER_MESSAGES, EEXIST); 1055 T(26, REJECT_AFTER_MESSAGES - 1, 0); 1056 T(27, REJECT_AFTER_MESSAGES, EEXIST); 1057 T(28, REJECT_AFTER_MESSAGES - 1, EEXIST); 1058 T(29, REJECT_AFTER_MESSAGES - 2, 0); 1059 T(30, REJECT_AFTER_MESSAGES + 1, EEXIST); 1060 T(31, REJECT_AFTER_MESSAGES + 2, EEXIST); 1061 T(32, REJECT_AFTER_MESSAGES - 2, EEXIST); 1062 T(33, REJECT_AFTER_MESSAGES - 3, 0); 1063 T(34, 0, EEXIST); 1064 1065 T_INIT; 1066 for (i = 1; i <= COUNTER_WINDOW_SIZE; ++i) 1067 T(35, i, 0); 1068 T(36, 0, 0); 1069 T(37, 0, EEXIST); 1070 1071 T_INIT; 1072 for (i = 2; i <= COUNTER_WINDOW_SIZE + 1; ++i) 1073 T(38, i, 0); 1074 T(39, 1, 0); 1075 T(40, 0, EEXIST); 1076 1077 T_INIT; 1078 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 0;) 1079 T(41, i, 0); 1080 1081 T_INIT; 1082 for (i = COUNTER_WINDOW_SIZE + 2; i-- > 1;) 1083 T(42, i, 0); 1084 T(43, 0, EEXIST); 1085 1086 T_INIT; 1087 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 1;) 1088 T(44, i, 0); 1089 T(45, COUNTER_WINDOW_SIZE + 1, 0); 1090 T(46, 0, EEXIST); 1091 1092 T_INIT; 1093 for (i = COUNTER_WINDOW_SIZE + 1; i-- > 1;) 1094 T(47, i, 0); 1095 T(48, 0, 0); 1096 T(49, COUNTER_WINDOW_SIZE + 1, 0); 1097 1098 T_PASSED; 1099 } 1100 1101 static void 1102 noise_handshake_init(struct noise_local *al, struct noise_remote *ar, 1103 struct noise_local *bl, struct noise_remote *br) 1104 { 1105 uint8_t apriv[NOISE_PUBLIC_KEY_LEN], bpriv[NOISE_PUBLIC_KEY_LEN]; 1106 uint8_t apub[NOISE_PUBLIC_KEY_LEN], bpub[NOISE_PUBLIC_KEY_LEN]; 1107 uint8_t psk[NOISE_SYMMETRIC_KEY_LEN]; 1108 1109 struct noise_upcall upcall = { 1110 .u_arg = NULL, 1111 .u_remote_get = upcall_get, 1112 .u_index_set = upcall_set, 1113 .u_index_drop = upcall_drop, 1114 }; 1115 1116 upcall.u_arg = ar; 1117 noise_local_init(al, &upcall); 1118 upcall.u_arg = br; 1119 noise_local_init(bl, &upcall); 1120 1121 arc4random_buf(apriv, NOISE_PUBLIC_KEY_LEN); 1122 arc4random_buf(bpriv, NOISE_PUBLIC_KEY_LEN); 1123 1124 noise_local_lock_identity(al); 1125 noise_local_set_private(al, apriv); 1126 noise_local_unlock_identity(al); 1127 1128 noise_local_lock_identity(bl); 1129 noise_local_set_private(bl, bpriv); 1130 noise_local_unlock_identity(bl); 1131 1132 noise_local_keys(al, apub, NULL); 1133 noise_local_keys(bl, bpub, NULL); 1134 1135 noise_remote_init(ar, bpub, al); 1136 noise_remote_init(br, apub, bl); 1137 1138 arc4random_buf(psk, NOISE_SYMMETRIC_KEY_LEN); 1139 noise_remote_set_psk(ar, psk); 1140 noise_remote_set_psk(br, psk); 1141 } 1142 1143 static void 1144 noise_handshake_test() 1145 { 1146 struct noise_remote *r; 1147 int i; 1148 1149 noise_handshake_init(&al, &ar, &bl, &br); 1150 1151 /* Create initiation */ 1152 if (noise_create_initiation(&ar, &init.s_idx, 1153 init.ue, init.es, init.ets) != 0) 1154 T_FAILED("create_initiation"); 1155 1156 /* Check encrypted (es) validation */ 1157 for (i = 0; i < sizeof(init.es); i++) { 1158 init.es[i] = ~init.es[i]; 1159 if (noise_consume_initiation(&bl, &r, init.s_idx, 1160 init.ue, init.es, init.ets) != EINVAL) 1161 T_FAILED("consume_initiation_es"); 1162 init.es[i] = ~init.es[i]; 1163 } 1164 1165 /* Check encrypted (ets) validation */ 1166 for (i = 0; i < sizeof(init.ets); i++) { 1167 init.ets[i] = ~init.ets[i]; 1168 if (noise_consume_initiation(&bl, &r, init.s_idx, 1169 init.ue, init.es, init.ets) != EINVAL) 1170 T_FAILED("consume_initiation_ets"); 1171 init.ets[i] = ~init.ets[i]; 1172 } 1173 1174 /* Consume initiation properly */ 1175 if (noise_consume_initiation(&bl, &r, init.s_idx, 1176 init.ue, init.es, init.ets) != 0) 1177 T_FAILED("consume_initiation"); 1178 if (r != &br) 1179 T_FAILED("remote_lookup"); 1180 1181 /* Replay initiation */ 1182 if (noise_consume_initiation(&bl, &r, init.s_idx, 1183 init.ue, init.es, init.ets) != EINVAL) 1184 T_FAILED("consume_initiation_replay"); 1185 if (r != &br) 1186 T_FAILED("remote_lookup_r_unchanged"); 1187 1188 /* Create response */ 1189 if (noise_create_response(&br, &resp.s_idx, 1190 &resp.r_idx, resp.ue, resp.en) != 0) 1191 T_FAILED("create_response"); 1192 1193 /* Check encrypted (en) validation */ 1194 for (i = 0; i < sizeof(resp.en); i++) { 1195 resp.en[i] = ~resp.en[i]; 1196 if (noise_consume_response(&ar, resp.s_idx, 1197 resp.r_idx, resp.ue, resp.en) != EINVAL) 1198 T_FAILED("consume_response_en"); 1199 resp.en[i] = ~resp.en[i]; 1200 } 1201 1202 /* Consume response properly */ 1203 if (noise_consume_response(&ar, resp.s_idx, 1204 resp.r_idx, resp.ue, resp.en) != 0) 1205 T_FAILED("consume_response"); 1206 1207 /* Derive keys on both sides */ 1208 if (noise_remote_begin_session(&ar) != 0) 1209 T_FAILED("promote_ar"); 1210 if (noise_remote_begin_session(&br) != 0) 1211 T_FAILED("promote_br"); 1212 1213 for (i = 0; i < MESSAGE_LEN; i++) 1214 data[i] = i; 1215 1216 /* Since bob is responder, he must not encrypt until confirmed */ 1217 if (noise_remote_encrypt(&br, &index, &nonce, 1218 data, MESSAGE_LEN) != EINVAL) 1219 T_FAILED("encrypt_kci_wait"); 1220 1221 /* Alice now encrypt and gets bob to decrypt */ 1222 if (noise_remote_encrypt(&ar, &index, &nonce, 1223 data, MESSAGE_LEN) != 0) 1224 T_FAILED("encrypt_akp"); 1225 if (noise_remote_decrypt(&br, index, nonce, 1226 data, MESSAGE_LEN + NOISE_AUTHTAG_LEN) != ECONNRESET) 1227 T_FAILED("decrypt_bkp"); 1228 1229 for (i = 0; i < MESSAGE_LEN; i++) 1230 if (data[i] != i) 1231 T_FAILED("decrypt_message_akp_bkp"); 1232 1233 /* Now bob has received confirmation, he can encrypt */ 1234 if (noise_remote_encrypt(&br, &index, &nonce, 1235 data, MESSAGE_LEN) != 0) 1236 T_FAILED("encrypt_kci_ready"); 1237 if (noise_remote_decrypt(&ar, index, nonce, 1238 data, MESSAGE_LEN + NOISE_AUTHTAG_LEN) != 0) 1239 T_FAILED("decrypt_akp"); 1240 1241 for (i = 0; i < MESSAGE_LEN; i++) 1242 if (data[i] != i) 1243 T_FAILED("decrypt_message_bkp_akp"); 1244 1245 T_PASSED; 1246 } 1247 1248 static void 1249 noise_speed_test() 1250 { 1251 #define SPEED_ITER (1<<16) 1252 struct timespec start, end; 1253 struct noise_remote *r; 1254 int nsec, i; 1255 1256 #define NSEC 1000000000 1257 #define T_TIME_START(iter, size) do { \ 1258 printf("%s %d %d byte encryptions\n", __func__, iter, size); \ 1259 nanouptime(&start); \ 1260 } while (0) 1261 #define T_TIME_END(iter, size) do { \ 1262 nanouptime(&end); \ 1263 timespecsub(&end, &start, &end); \ 1264 nsec = (end.tv_sec * NSEC + end.tv_nsec) / iter; \ 1265 printf("%s %d nsec/iter, %d iter/sec, %d byte/sec\n", \ 1266 __func__, nsec, NSEC / nsec, NSEC / nsec * size); \ 1267 } while (0) 1268 #define T_TIME_START_SINGLE(name) do { \ 1269 printf("%s %s\n", __func__, name); \ 1270 nanouptime(&start); \ 1271 } while (0) 1272 #define T_TIME_END_SINGLE() do { \ 1273 nanouptime(&end); \ 1274 timespecsub(&end, &start, &end); \ 1275 nsec = (end.tv_sec * NSEC + end.tv_nsec); \ 1276 printf("%s %d nsec/iter, %d iter/sec\n", \ 1277 __func__, nsec, NSEC / nsec); \ 1278 } while (0) 1279 1280 noise_handshake_init(&al, &ar, &bl, &br); 1281 1282 T_TIME_START_SINGLE("create_initiation"); 1283 if (noise_create_initiation(&ar, &init.s_idx, 1284 init.ue, init.es, init.ets) != 0) 1285 T_FAILED("create_initiation"); 1286 T_TIME_END_SINGLE(); 1287 1288 T_TIME_START_SINGLE("consume_initiation"); 1289 if (noise_consume_initiation(&bl, &r, init.s_idx, 1290 init.ue, init.es, init.ets) != 0) 1291 T_FAILED("consume_initiation"); 1292 T_TIME_END_SINGLE(); 1293 1294 T_TIME_START_SINGLE("create_response"); 1295 if (noise_create_response(&br, &resp.s_idx, 1296 &resp.r_idx, resp.ue, resp.en) != 0) 1297 T_FAILED("create_response"); 1298 T_TIME_END_SINGLE(); 1299 1300 T_TIME_START_SINGLE("consume_response"); 1301 if (noise_consume_response(&ar, resp.s_idx, 1302 resp.r_idx, resp.ue, resp.en) != 0) 1303 T_FAILED("consume_response"); 1304 T_TIME_END_SINGLE(); 1305 1306 /* Derive keys on both sides */ 1307 T_TIME_START_SINGLE("derive_keys"); 1308 if (noise_remote_begin_session(&ar) != 0) 1309 T_FAILED("begin_ar"); 1310 T_TIME_END_SINGLE(); 1311 if (noise_remote_begin_session(&br) != 0) 1312 T_FAILED("begin_br"); 1313 1314 /* Small data encryptions */ 1315 T_TIME_START(SPEED_ITER, MESSAGE_LEN); 1316 for (i = 0; i < SPEED_ITER; i++) { 1317 if (noise_remote_encrypt(&ar, &index, &nonce, 1318 data, MESSAGE_LEN) != 0) 1319 T_FAILED("encrypt_akp"); 1320 } 1321 T_TIME_END(SPEED_ITER, MESSAGE_LEN); 1322 1323 1324 /* Large data encryptions */ 1325 T_TIME_START(SPEED_ITER, LARGE_MESSAGE_LEN); 1326 for (i = 0; i < SPEED_ITER; i++) { 1327 if (noise_remote_encrypt(&ar, &index, &nonce, 1328 largedata, LARGE_MESSAGE_LEN) != 0) 1329 T_FAILED("encrypt_akp"); 1330 } 1331 T_TIME_END(SPEED_ITER, LARGE_MESSAGE_LEN); 1332 } 1333 1334 void 1335 noise_test() 1336 { 1337 noise_counter_test(); 1338 noise_handshake_test(); 1339 noise_speed_test(); 1340 } 1341 1342 #endif /* WGTEST */ 1343