xref: /openbsd-src/sbin/iked/crypto.c (revision fa353a8f9b716432e67aba95e7a4beea67b6c3b5)

/*	$OpenBSD: crypto.c,v 1.47 2024/11/21 13:26:49 claudio Exp $	*/

/*
 * Copyright (c) 2010-2013 Reyk Floeter <reyk@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/types.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/uio.h>

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <event.h>

#include <openssl/ecdsa.h>
#include <openssl/hmac.h>
#include <openssl/evp.h>
#include <openssl/sha.h>
#include <openssl/md5.h>
#include <openssl/x509.h>
#include <openssl/rsa.h>

#include "iked.h"
#include "ikev2.h"

/* RFC 7427, A.1 RSA */
static const uint8_t sha256WithRSA[] = {
	0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00
};
static const uint8_t sha384WithRSA[] = {
	0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0c, 0x05, 0x00
};
static const uint8_t sha512WithRSA[] = {
	0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0d, 0x05, 0x00
};
/* RFC 7427, A.3 ECDSA */
static const uint8_t ecdsa_sha256[] = {
	0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
	0x3d, 0x04, 0x03, 0x02
};
static const uint8_t ecdsa_sha384[] = {
	0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
	0x3d, 0x04, 0x03, 0x03
};
static const uint8_t ecdsa_sha512[] = {
	0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
	0x3d, 0x04, 0x03, 0x04
};
/* RFC 7427, A.4.3 RSASSA-PSS with SHA-256 */
static const uint8_t rsapss_sha256[] = {
	0x30, 0x46, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x39, 0xa0,
	0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00,
	0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
	0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
	0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0xa2, 0x03,
	0x02, 0x01, 0x20, 0xa3, 0x03, 0x02, 0x01, 0x01
};
/* RSASSA-PSS SHA-384 */
static const uint8_t rsapss_sha384[] = {
	0x30, 0x46, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0,
	0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00,
	0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
	0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
	0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0xa2, 0x03,
	0x02, 0x01, 0x30, 0xa3, 0x03, 0x02, 0x01, 0x01
};
/* RSASSA-PSS SHA-512 */
static const uint8_t rsapss_sha512[] = {
	0x30, 0x46, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0,
	0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00,
	0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
	0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
	0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0xa2, 0x03,
	0x02, 0x01, 0x40, 0xa3, 0x03, 0x02, 0x01, 0x01
};
/* RSASSA-PSS SHA-256, no trailer */
static const uint8_t rsapss_sha256nt[] = {
	0x30, 0x41, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0,
	0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00,
	0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
	0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
	0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0xa2, 0x03,
	0x02, 0x01, 0x20
};
/* RSASSA-PSS SHA-384, no trailer */
static const uint8_t rsapss_sha384nt[] = {
	0x30, 0x41, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0,
	0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x02, 0x05, 0x00,
	0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
	0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
	0x03, 0x04, 0x02, 0x02, 0x05, 0x00, 0xa2, 0x03,
	0x02, 0x01, 0x30
};
/* RSASSA-PSS SHA-512, no trailer */
static const uint8_t rsapss_sha512nt[] = {
	0x30, 0x41, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
	0xf7, 0x0d, 0x01, 0x01, 0x0a, 0x30, 0x34, 0xa0,
	0x0f, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48,
	0x01, 0x65, 0x03, 0x04, 0x02, 0x03, 0x05, 0x00,
	0xa1, 0x1c, 0x30, 0x1a, 0x06, 0x09, 0x2a, 0x86,
	0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x08, 0x30,
	0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65,
	0x03, 0x04, 0x02, 0x03, 0x05, 0x00, 0xa2, 0x03,
	0x02, 0x01, 0x40
};

#define FLAG_RSA_PSS	0x00001
int force_rsa_pss = 0;	/* XXX move to API */

static const struct {
	int		 sc_keytype;
	const EVP_MD	*(*sc_md)(void);
	uint8_t		 sc_len;
	const uint8_t	*sc_oid;
	uint32_t	 sc_flags;
} schemes[] = {
	{ EVP_PKEY_RSA, EVP_sha256, sizeof(sha256WithRSA), sha256WithRSA, 0 },
	{ EVP_PKEY_RSA, EVP_sha384, sizeof(sha384WithRSA), sha384WithRSA, 0 },
	{ EVP_PKEY_RSA, EVP_sha512, sizeof(sha512WithRSA), sha512WithRSA, 0 },
	{ EVP_PKEY_EC,  EVP_sha256, sizeof(ecdsa_sha256),  ecdsa_sha256, 0 },
	{ EVP_PKEY_EC,  EVP_sha384, sizeof(ecdsa_sha384),  ecdsa_sha384, 0 },
	{ EVP_PKEY_EC,  EVP_sha512, sizeof(ecdsa_sha512),  ecdsa_sha512, 0 },
	{ EVP_PKEY_RSA, EVP_sha256, sizeof(rsapss_sha256), rsapss_sha256,
	    FLAG_RSA_PSS },
	{ EVP_PKEY_RSA, EVP_sha384, sizeof(rsapss_sha384), rsapss_sha384,
	    FLAG_RSA_PSS },
	{ EVP_PKEY_RSA, EVP_sha512, sizeof(rsapss_sha512), rsapss_sha512,
	    FLAG_RSA_PSS },
	{ EVP_PKEY_RSA, EVP_sha256, sizeof(rsapss_sha256nt), rsapss_sha256nt,
	    FLAG_RSA_PSS },
	{ EVP_PKEY_RSA, EVP_sha384, sizeof(rsapss_sha384nt), rsapss_sha384nt,
	    FLAG_RSA_PSS },
	{ EVP_PKEY_RSA, EVP_sha512, sizeof(rsapss_sha512nt), rsapss_sha512nt,
	    FLAG_RSA_PSS },
};

int	_dsa_verify_init(struct iked_dsa *, const uint8_t *, size_t);
int	_dsa_verify_prepare(struct iked_dsa *, uint8_t **, size_t *,
	    uint8_t **);
int	_dsa_sign_encode(struct iked_dsa *, uint8_t *, size_t, size_t *);
int	_dsa_sign_ecdsa(struct iked_dsa *, uint8_t *, size_t);

struct iked_hash *
hash_new(uint8_t type, uint16_t id)
{
	struct iked_hash	*hash;
	const EVP_MD		*md = NULL;
	int			 length = 0, fixedkey = 0, trunc = 0, isaead = 0;

	switch (type) {
	case IKEV2_XFORMTYPE_PRF:
		switch (id) {
		case IKEV2_XFORMPRF_HMAC_MD5:
			md = EVP_md5();
			length = MD5_DIGEST_LENGTH;
			break;
		case IKEV2_XFORMPRF_HMAC_SHA1:
			md = EVP_sha1();
			length = SHA_DIGEST_LENGTH;
			break;
		case IKEV2_XFORMPRF_HMAC_SHA2_256:
			md = EVP_sha256();
			length = SHA256_DIGEST_LENGTH;
			break;
		case IKEV2_XFORMPRF_HMAC_SHA2_384:
			md = EVP_sha384();
			length = SHA384_DIGEST_LENGTH;
			break;
		case IKEV2_XFORMPRF_HMAC_SHA2_512:
			md = EVP_sha512();
			length = SHA512_DIGEST_LENGTH;
			break;
		case IKEV2_XFORMPRF_AES128_XCBC:
			fixedkey = 128 / 8;
			length = fixedkey;
			/* FALLTHROUGH */
		case IKEV2_XFORMPRF_HMAC_TIGER:
		case IKEV2_XFORMPRF_AES128_CMAC:
		default:
			log_debug("%s: prf %s not supported", __func__,
			    print_map(id, ikev2_xformprf_map));
			break;
		}
		break;
	case IKEV2_XFORMTYPE_INTEGR:
		switch (id) {
		case IKEV2_XFORMAUTH_HMAC_MD5_96:
			md = EVP_md5();
			length = MD5_DIGEST_LENGTH;
			trunc = 12;
			break;
		case IKEV2_XFORMAUTH_HMAC_SHA1_96:
			md = EVP_sha1();
			length = SHA_DIGEST_LENGTH;
			trunc = 12;
			break;
		case IKEV2_XFORMAUTH_HMAC_SHA2_256_128:
			md = EVP_sha256();
			length = SHA256_DIGEST_LENGTH;
			trunc = 16;
			break;
		case IKEV2_XFORMAUTH_HMAC_SHA2_384_192:
			md = EVP_sha384();
			length = SHA384_DIGEST_LENGTH;
			trunc = 24;
			break;
		case IKEV2_XFORMAUTH_HMAC_SHA2_512_256:
			md = EVP_sha512();
			length = SHA512_DIGEST_LENGTH;
			trunc = 32;
			break;
		case IKEV2_XFORMAUTH_AES_GCM_12:
			length = 12;
			isaead = 1;
			break;
		case IKEV2_XFORMAUTH_AES_GCM_16:
			length = 16;
			isaead = 1;
			break;
		case IKEV2_XFORMAUTH_NONE:
		case IKEV2_XFORMAUTH_DES_MAC:
		case IKEV2_XFORMAUTH_KPDK_MD5:
		case IKEV2_XFORMAUTH_AES_XCBC_96:
		case IKEV2_XFORMAUTH_HMAC_MD5_128:
		case IKEV2_XFORMAUTH_HMAC_SHA1_160:
		case IKEV2_XFORMAUTH_AES_CMAC_96:
		case IKEV2_XFORMAUTH_AES_128_GMAC:
		case IKEV2_XFORMAUTH_AES_192_GMAC:
		case IKEV2_XFORMAUTH_AES_256_GMAC:
		default:
			log_debug("%s: auth %s not supported", __func__,
			    print_map(id, ikev2_xformauth_map));
			break;
		}
		break;
	default:
		log_debug("%s: hash type %s not supported", __func__,
		    print_map(id, ikev2_xformtype_map));
		break;
	}
	if (!isaead && md == NULL)
		return (NULL);

	if ((hash = calloc(1, sizeof(*hash))) == NULL) {
		log_debug("%s: alloc hash", __func__);
		return (NULL);
	}

	hash->hash_type = type;
	hash->hash_id = id;
	hash->hash_priv = md;
	hash->hash_ctx = NULL;
	hash->hash_trunc = trunc;
	hash->hash_length = length;
	hash->hash_fixedkey = fixedkey;
	hash->hash_isaead = isaead;

	if (isaead)
		return (hash);

	hash->hash_ctx = HMAC_CTX_new();
	if (hash->hash_ctx == NULL) {
		log_debug("%s: alloc hash ctx", __func__);
		hash_free(hash);
		return (NULL);
	}

	return (hash);
}

struct ibuf *
hash_setkey(struct iked_hash *hash, void *key, size_t keylen)
{
	ibuf_free(hash->hash_key);
	if ((hash->hash_key = ibuf_new(key, keylen)) == NULL) {
		log_debug("%s: alloc hash key", __func__);
		return (NULL);
	}
	return (hash->hash_key);
}

void
hash_free(struct iked_hash *hash)
{
	if (hash == NULL)
		return;
	HMAC_CTX_free(hash->hash_ctx);
	ibuf_free(hash->hash_key);
	free(hash);
}

void
hash_init(struct iked_hash *hash)
{
	HMAC_Init_ex(hash->hash_ctx, ibuf_data(hash->hash_key),
	    ibuf_size(hash->hash_key), hash->hash_priv, NULL);
}

void
hash_update(struct iked_hash *hash, void *buf, size_t len)
{
	HMAC_Update(hash->hash_ctx, buf, len);
}

void
hash_final(struct iked_hash *hash, void *buf, size_t *len)
{
	unsigned int	 length = 0;

	HMAC_Final(hash->hash_ctx, buf, &length);
	*len = (size_t)length;

	/* Truncate the result if required by the alg */
	if (hash->hash_trunc && *len > hash->hash_trunc)
		*len = hash->hash_trunc;
}

size_t
hash_length(struct iked_hash *hash)
{
	if (hash->hash_trunc)
		return (hash->hash_trunc);
	return (hash->hash_length);
}

size_t
hash_keylength(struct iked_hash *hash)
{
	return (hash->hash_length);
}

struct iked_cipher *
cipher_new(uint8_t type, uint16_t id, uint16_t id_length)
{
	struct iked_cipher	*encr;
	const EVP_CIPHER	*cipher = NULL;
	int			 length = 0, fixedkey = 0, ivlength = 0;
	int			 saltlength = 0, authid = 0;

	switch (type) {
	case IKEV2_XFORMTYPE_ENCR:
		switch (id) {
		case IKEV2_XFORMENCR_3DES:
			cipher = EVP_des_ede3_cbc();
			length = EVP_CIPHER_block_size(cipher);
			fixedkey = EVP_CIPHER_key_length(cipher);
			ivlength = EVP_CIPHER_iv_length(cipher);
			break;
		case IKEV2_XFORMENCR_AES_CBC:
			switch (id_length) {
			case 128:
				cipher = EVP_aes_128_cbc();
				break;
			case 192:
				cipher = EVP_aes_192_cbc();
				break;
			case 256:
				cipher = EVP_aes_256_cbc();
				break;
			default:
				log_debug("%s: invalid key length %d"
				    " for cipher %s", __func__, id_length,
				    print_map(id, ikev2_xformencr_map));
				break;
			}
			if (cipher == NULL)
				break;
			length = EVP_CIPHER_block_size(cipher);
			ivlength = EVP_CIPHER_iv_length(cipher);
			fixedkey = EVP_CIPHER_key_length(cipher);
			break;
		case IKEV2_XFORMENCR_AES_GCM_16:
		case IKEV2_XFORMENCR_AES_GCM_12:
			switch (id_length) {
			case 128:
				cipher = EVP_aes_128_gcm();
				break;
			case 256:
				cipher = EVP_aes_256_gcm();
				break;
			default:
				log_debug("%s: invalid key length %d"
				    " for cipher %s", __func__, id_length,
				    print_map(id, ikev2_xformencr_map));
				break;
			}
			if (cipher == NULL)
				break;
			switch(id) {
			case IKEV2_XFORMENCR_AES_GCM_16:
				authid = IKEV2_XFORMAUTH_AES_GCM_16;
				break;
			case IKEV2_XFORMENCR_AES_GCM_12:
				authid = IKEV2_XFORMAUTH_AES_GCM_12;
				break;
			}
			length = EVP_CIPHER_block_size(cipher);
			ivlength = 8;
			saltlength = 4;
			fixedkey = EVP_CIPHER_key_length(cipher) + saltlength;
			break;
		case IKEV2_XFORMENCR_DES_IV64:
		case IKEV2_XFORMENCR_DES:
		case IKEV2_XFORMENCR_RC5:
		case IKEV2_XFORMENCR_IDEA:
		case IKEV2_XFORMENCR_CAST:
		case IKEV2_XFORMENCR_BLOWFISH:
		case IKEV2_XFORMENCR_3IDEA:
		case IKEV2_XFORMENCR_DES_IV32:
		case IKEV2_XFORMENCR_NULL:
		case IKEV2_XFORMENCR_AES_CTR:
			/* FALLTHROUGH */
		default:
			log_debug("%s: cipher %s not supported", __func__,
			    print_map(id, ikev2_xformencr_map));
			cipher = NULL;
			break;
		}
		break;
	default:
		log_debug("%s: cipher type %s not supported", __func__,
		    print_map(id, ikev2_xformtype_map));
		break;
	}
	if (cipher == NULL)
		return (NULL);

	if ((encr = calloc(1, sizeof(*encr))) == NULL) {
		log_debug("%s: alloc cipher", __func__);
		return (NULL);
	}

	encr->encr_id = id;
	encr->encr_priv = cipher;
	encr->encr_ctx = NULL;
	encr->encr_length = length;
	encr->encr_fixedkey = fixedkey;
	encr->encr_ivlength = ivlength ? ivlength : length;
	encr->encr_saltlength = saltlength;
	encr->encr_authid = authid;

	encr->encr_ctx = EVP_CIPHER_CTX_new();
	if (encr->encr_ctx == NULL) {
		log_debug("%s: alloc cipher ctx", __func__);
		cipher_free(encr);
		return (NULL);
	}

	return (encr);
}

struct ibuf *
cipher_setkey(struct iked_cipher *encr, const void *key, size_t keylen)
{
	ibuf_free(encr->encr_key);
	if ((encr->encr_key = ibuf_new(key, keylen)) == NULL) {
		log_debug("%s: alloc cipher key", __func__);
		return (NULL);
	}
	return (encr->encr_key);
}

struct ibuf *
cipher_setiv(struct iked_cipher *encr, const void *iv, size_t len)
{
	ibuf_free(encr->encr_iv);
	encr->encr_iv = NULL;
	if (iv != NULL) {
		if (len < encr->encr_ivlength) {
			log_debug("%s: invalid IV length %zu", __func__, len);
			return (NULL);
		}
		encr->encr_iv = ibuf_new(iv, encr->encr_ivlength);
	} else {
		switch (encr->encr_id) {
		case IKEV2_XFORMENCR_AES_GCM_16:
		case IKEV2_XFORMENCR_AES_GCM_12:
			if (encr->encr_ivlength != sizeof(encr->encr_civ)) {
				log_info("%s: ivlen does not match %zu != %zu",
				    __func__, encr->encr_ivlength,
				    sizeof(encr->encr_civ));
				return (NULL);
			}
			encr->encr_iv = ibuf_new(&encr->encr_civ, sizeof(encr->encr_civ));
			encr->encr_civ++;
			break;
		default:
			/* Get new random IV */
			encr->encr_iv = ibuf_random(encr->encr_ivlength);
		}
	}
	if (encr->encr_iv == NULL) {
		log_debug("%s: failed to set IV", __func__);
		return (NULL);
	}
	return (encr->encr_iv);
}

int
cipher_settag(struct iked_cipher *encr, uint8_t *data, size_t len)
{
	return (EVP_CIPHER_CTX_ctrl(encr->encr_ctx,
	    EVP_CTRL_GCM_SET_TAG, len, data) != 1);
}

int
cipher_gettag(struct iked_cipher *encr, uint8_t *data, size_t len)
{
	return (EVP_CIPHER_CTX_ctrl(encr->encr_ctx,
	    EVP_CTRL_GCM_GET_TAG, len, data) != 1);
}

void
cipher_free(struct iked_cipher *encr)
{
	if (encr == NULL)
		return;
	EVP_CIPHER_CTX_free(encr->encr_ctx);
	ibuf_free(encr->encr_iv);
	ibuf_free(encr->encr_key);
	free(encr);
}

int
cipher_init(struct iked_cipher *encr, int enc)
{
	struct ibuf	*nonce = NULL;
	int		 ret = -1;

	if (EVP_CipherInit_ex(encr->encr_ctx, encr->encr_priv, NULL,
	    NULL, NULL, enc) != 1)
		return (-1);
	if (encr->encr_saltlength > 0) {
		/* For AEADs the nonce is salt + IV  (see RFC5282) */
		nonce = ibuf_new(ibuf_seek(encr->encr_key,
		    ibuf_size(encr->encr_key) - encr->encr_saltlength,
		    encr->encr_saltlength), encr->encr_saltlength);
		if (nonce == NULL)
			return (-1);
		if (ibuf_add_ibuf(nonce, encr->encr_iv) != 0)
			goto done;
		if (EVP_CipherInit_ex(encr->encr_ctx, NULL, NULL,
		    ibuf_data(encr->encr_key), ibuf_data(nonce), enc) != 1)
			goto done;
	} else
		if (EVP_CipherInit_ex(encr->encr_ctx, NULL, NULL,
		    ibuf_data(encr->encr_key), ibuf_data(encr->encr_iv), enc) != 1)
			return (-1);
	EVP_CIPHER_CTX_set_padding(encr->encr_ctx, 0);
	ret = 0;
 done:
	ibuf_free(nonce);
	return (ret);
}

int
cipher_init_encrypt(struct iked_cipher *encr)
{
	return (cipher_init(encr, 1));
}

int
cipher_init_decrypt(struct iked_cipher *encr)
{
	return (cipher_init(encr, 0));
}

void
cipher_aad(struct iked_cipher *encr, const void *in, size_t inlen,
    size_t *outlen)
{
	int	 olen = 0;

	if (EVP_CipherUpdate(encr->encr_ctx, NULL, &olen, in, inlen) != 1) {
		ca_sslerror(__func__);
		*outlen = 0;
		return;
	}
	*outlen = (size_t)olen;
}

int
cipher_update(struct iked_cipher *encr, const void *in, size_t inlen,
    void *out, size_t *outlen)
{
	int	 olen;

	olen = 0;
	if (EVP_CipherUpdate(encr->encr_ctx, out, &olen, in, inlen) != 1) {
		ca_sslerror(__func__);
		*outlen = 0;
		return (-1);
	}
	*outlen = (size_t)olen;
	return (0);
}

int
cipher_final(struct iked_cipher *encr)
{
	int	 olen;

	/*
	 * We always have EVP_CIPH_NO_PADDING set.  This means arg
	 * out is not used and olen should always be 0.
	 */
	if (EVP_CipherFinal_ex(encr->encr_ctx, NULL, &olen) != 1) {
		ca_sslerror(__func__);
		return (-1);
	}
	return (0);
}

size_t
cipher_length(struct iked_cipher *encr)
{
	return (encr->encr_length);
}

size_t
cipher_keylength(struct iked_cipher *encr)
{
	if (encr->encr_fixedkey)
		return (encr->encr_fixedkey);

	/* Might return zero */
	return (ibuf_length(encr->encr_key));
}

size_t
cipher_ivlength(struct iked_cipher *encr)
{
	return (encr->encr_ivlength);
}

size_t
cipher_outlength(struct iked_cipher *encr, size_t inlen)
{
	return (roundup(inlen, encr->encr_length));
}

struct iked_dsa *
dsa_new(uint8_t id, struct iked_hash *prf, int sign)
{
	struct iked_dsa		*dsap = NULL, dsa;

	bzero(&dsa, sizeof(dsa));

	switch (id) {
	case IKEV2_AUTH_SIG:
		if (sign)
			dsa.dsa_priv = EVP_sha256(); /* XXX should be passed */
		else
			dsa.dsa_priv = NULL; /* set later by dsa_init() */
		break;
	case IKEV2_AUTH_RSA_SIG:
		/* RFC5996 says we SHOULD use SHA1 here */
		dsa.dsa_priv = EVP_sha1();
		break;
	case IKEV2_AUTH_SHARED_KEY_MIC:
		if (prf == NULL || prf->hash_priv == NULL)
			fatalx("dsa_new: invalid PRF");
		dsa.dsa_priv = prf->hash_priv;
		dsa.dsa_hmac = 1;
		break;
	case IKEV2_AUTH_DSS_SIG:
		dsa.dsa_priv = EVP_sha1();
		break;
	case IKEV2_AUTH_ECDSA_256:
		dsa.dsa_priv = EVP_sha256();
		break;
	case IKEV2_AUTH_ECDSA_384:
		dsa.dsa_priv = EVP_sha384();
		break;
	case IKEV2_AUTH_ECDSA_521:
		dsa.dsa_priv = EVP_sha512();
		break;
	default:
		log_debug("%s: auth method %s not supported", __func__,
		    print_map(id, ikev2_auth_map));
		break;
	}

	if ((dsap = calloc(1, sizeof(*dsap))) == NULL) {
		log_debug("%s: alloc dsa ctx", __func__);

		return (NULL);
	}
	memcpy(dsap, &dsa, sizeof(*dsap));

	dsap->dsa_method = id;
	dsap->dsa_sign = sign;

	if (dsap->dsa_hmac) {
		if ((dsap->dsa_ctx = HMAC_CTX_new()) == NULL) {
			log_debug("%s: alloc hash ctx", __func__);
			dsa_free(dsap);
			return (NULL);
		}
	} else {
		if ((dsap->dsa_ctx = EVP_MD_CTX_create()) == NULL) {
			log_debug("%s: alloc digest ctx", __func__);
			dsa_free(dsap);
			return (NULL);
		}
	}

	return (dsap);
}

struct iked_dsa *
dsa_sign_new(uint8_t id, struct iked_hash *prf)
{
	return (dsa_new(id, prf, 1));
}

struct iked_dsa *
dsa_verify_new(uint8_t id, struct iked_hash *prf)
{
	return (dsa_new(id, prf, 0));
}

void
dsa_free(struct iked_dsa *dsa)
{
	if (dsa == NULL)
		return;
	if (dsa->dsa_hmac) {
		HMAC_CTX_free((HMAC_CTX *)dsa->dsa_ctx);
	} else {
		EVP_MD_CTX_free((EVP_MD_CTX *)dsa->dsa_ctx);
		EVP_PKEY_free(dsa->dsa_key);
	}

	ibuf_free(dsa->dsa_keydata);
	free(dsa);
}

struct ibuf *
dsa_setkey(struct iked_dsa *dsa, void *key, size_t keylen, uint8_t type)
{
	BIO		*rawcert = NULL;
	X509		*cert = NULL;
	RSA		*rsa = NULL;
	EC_KEY		*ec = NULL;
	EVP_PKEY	*pkey = NULL;

	ibuf_free(dsa->dsa_keydata);
	if ((dsa->dsa_keydata = ibuf_new(key, keylen)) == NULL) {
		log_debug("%s: alloc signature key", __func__);
		return (NULL);
	}

	if ((rawcert = BIO_new_mem_buf(key, keylen)) == NULL)
		goto err;

	switch (type) {
	case IKEV2_CERT_X509_CERT:
		if ((cert = d2i_X509_bio(rawcert, NULL)) == NULL)
			goto sslerr;
		if ((pkey = X509_get_pubkey(cert)) == NULL)
			goto sslerr;
		dsa->dsa_key = pkey;
		break;
	case IKEV2_CERT_RSA_KEY:
		if (dsa->dsa_sign) {
			if ((rsa = d2i_RSAPrivateKey_bio(rawcert,
			    NULL)) == NULL)
				goto sslerr;
		} else {
			if ((rsa = d2i_RSAPublicKey_bio(rawcert,
			    NULL)) == NULL)
				goto sslerr;
		}

		if ((pkey = EVP_PKEY_new()) == NULL)
			goto sslerr;
		if (!EVP_PKEY_set1_RSA(pkey, rsa))
			goto sslerr;

		RSA_free(rsa);		/* pkey now has the reference */
		dsa->dsa_key = pkey;
		break;
	case IKEV2_CERT_ECDSA:
		if (dsa->dsa_sign) {
			if ((ec = d2i_ECPrivateKey_bio(rawcert, NULL)) == NULL)
				goto sslerr;
		} else {
			if ((ec = d2i_EC_PUBKEY_bio(rawcert, NULL)) == NULL)
				goto sslerr;
		}

		if ((pkey = EVP_PKEY_new()) == NULL)
			goto sslerr;
		if (!EVP_PKEY_set1_EC_KEY(pkey, ec))
			goto sslerr;

		EC_KEY_free(ec);	/* pkey now has the reference */
		dsa->dsa_key = pkey;
		break;
	default:
		if (dsa->dsa_hmac)
			break;
		log_debug("%s: unsupported key type", __func__);
		goto err;
	}

	X509_free(cert);
	BIO_free(rawcert);	/* temporary for parsing */

	return (dsa->dsa_keydata);

 sslerr:
	ca_sslerror(__func__);
 err:
	log_debug("%s: error", __func__);

	RSA_free(rsa);
	EC_KEY_free(ec);
	EVP_PKEY_free(pkey);
	X509_free(cert);
	BIO_free(rawcert);
	ibuf_free(dsa->dsa_keydata);
	dsa->dsa_keydata = NULL;
	return (NULL);
}

int
_dsa_verify_init(struct iked_dsa *dsa, const uint8_t *sig, size_t len)
{
	uint8_t			 oidlen;
	size_t			 i;
	int			 keytype;

	if (dsa->dsa_priv != NULL)
		return (0);
	/*
	 * For IKEV2_AUTH_SIG the oid of the authentication signature
	 * is encoded in the first bytes of the auth message.
	 */
	if (dsa->dsa_method != IKEV2_AUTH_SIG)  {
		log_debug("%s: dsa_priv not set for %s", __func__,
		    print_map(dsa->dsa_method, ikev2_auth_map));
		return (-1);
	}
	if (dsa->dsa_key == NULL) {
		log_debug("%s: dsa_key not set for %s", __func__,
		    print_map(dsa->dsa_method, ikev2_auth_map));
		return (-1);
	}
	keytype = EVP_PKEY_type(EVP_PKEY_id(((EVP_PKEY *)dsa->dsa_key)));
	if (sig == NULL) {
		log_debug("%s: signature missing", __func__);
		return (-1);
	}
	if (len < sizeof(oidlen)) {
		log_debug("%s: signature (%zu) too small for oid length",
		    __func__, len);
		return (-1);
	}
	memcpy(&oidlen, sig, sizeof(oidlen));
	if (len < (size_t)oidlen + sizeof(oidlen)) {
		log_debug("%s: signature (%zu) too small for oid (%u)",
		    __func__, len, oidlen);
		return (-1);
	}
	for (i = 0; i < nitems(schemes); i++) {
		if (keytype == schemes[i].sc_keytype &&
		    oidlen == schemes[i].sc_len &&
		    memcmp(sig + 1, schemes[i].sc_oid,
		    schemes[i].sc_len) == 0) {
			dsa->dsa_priv = (*schemes[i].sc_md)();
			dsa->dsa_flags = schemes[i].sc_flags;
			log_debug("%s: signature scheme %zd selected",
			    __func__, i);
			return (0);
		}
	}
	log_debug("%s: unsupported signature (%d)", __func__, oidlen);
	return (-1);
}

int
dsa_init(struct iked_dsa *dsa, const void *buf, size_t len)
{
	int		 ret;
	EVP_PKEY_CTX	*pctx = NULL;

	if (dsa->dsa_hmac) {
		if (!HMAC_Init_ex(dsa->dsa_ctx, ibuf_data(dsa->dsa_keydata),
		    ibuf_size(dsa->dsa_keydata), dsa->dsa_priv, NULL))
			return (-1);
		return (0);
	}

	if (dsa->dsa_sign) {
		if (force_rsa_pss &&
		    EVP_PKEY_base_id(dsa->dsa_key) == EVP_PKEY_RSA)
			dsa->dsa_flags = FLAG_RSA_PSS;
		ret = EVP_DigestSignInit(dsa->dsa_ctx, &pctx, dsa->dsa_priv,
		    NULL, dsa->dsa_key);
	} else {
		/* sets dsa_priv, dsa_flags */
		if ((ret = _dsa_verify_init(dsa, buf, len)) != 0)
			return (ret);
		ret = EVP_DigestVerifyInit(dsa->dsa_ctx, &pctx, dsa->dsa_priv,
		    NULL, dsa->dsa_key);
	}
	if (ret == 1 && dsa->dsa_flags == FLAG_RSA_PSS) {
		if (EVP_PKEY_CTX_set_rsa_padding(pctx,
		    RSA_PKCS1_PSS_PADDING) <= 0 ||
		    EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1) <= 0)
			return (-1);
	}
	if (_dsa_sign_encode(dsa, NULL, 0, NULL) < 0)
		return (-1);

	return (ret == 1 ? 0 : -1);
}

int
dsa_update(struct iked_dsa *dsa, const void *buf, size_t len)
{
	int	ret;

	if (dsa->dsa_hmac)
		ret = HMAC_Update(dsa->dsa_ctx, buf, len);
	else if (dsa->dsa_sign)
		ret = EVP_DigestSignUpdate(dsa->dsa_ctx, buf, len);
	else
		ret = EVP_DigestVerifyUpdate(dsa->dsa_ctx, buf, len);

	return (ret == 1 ? 0 : -1);
}

/* Prefix signature hash with encoded type */
int
_dsa_sign_encode(struct iked_dsa *dsa, uint8_t *ptr, size_t len, size_t *offp)
{
	int		 keytype;
	size_t		 i, need;

	if (offp)
		*offp = 0;
	if (dsa->dsa_method != IKEV2_AUTH_SIG)
		return (0);
	if (dsa->dsa_key == NULL)
		return (-1);
	keytype = EVP_PKEY_type(EVP_PKEY_id(((EVP_PKEY *)dsa->dsa_key)));
	for (i = 0; i < nitems(schemes); i++) {
		/* XXX should avoid calling sc_md() each time... */
		if (keytype == schemes[i].sc_keytype &&
		    dsa->dsa_flags == schemes[i].sc_flags &&
		    (dsa->dsa_priv == (*schemes[i].sc_md)()))
			break;
	}
	if (i >= nitems(schemes))
		return (-1);
	log_debug("%s: signature scheme %zd selected", __func__, i);
	need = sizeof(ptr[0]) + schemes[i].sc_len;
	if (ptr) {
		if (len < need)
			return (-1);
		ptr[0] = schemes[i].sc_len;
		memcpy(ptr + sizeof(ptr[0]), schemes[i].sc_oid,
		    schemes[i].sc_len);
	}
	if (offp)
		*offp = need;
	return (0);
}

/* Export size of encoded signature hash type */
size_t
dsa_prefix(struct iked_dsa *dsa)
{
	size_t		off = 0;

	if (_dsa_sign_encode(dsa, NULL, 0, &off) < 0)
		fatal("dsa_prefix: internal error");
	return off;
}

size_t
dsa_length(struct iked_dsa *dsa)
{
	if (dsa->dsa_hmac)
		return (EVP_MD_size(dsa->dsa_priv));
	switch (dsa->dsa_method) {
	case IKEV2_AUTH_ECDSA_256:
	case IKEV2_AUTH_ECDSA_384:
	case IKEV2_AUTH_ECDSA_521:
		/* size of concat(r|s) */
		return (2 * ((EVP_PKEY_bits(dsa->dsa_key) + 7) / 8));
	}
	return (dsa_prefix(dsa) + EVP_PKEY_size(dsa->dsa_key));
}

int
_dsa_sign_ecdsa(struct iked_dsa *dsa, uint8_t *ptr, size_t len)
{
	ECDSA_SIG	*obj = NULL;
	uint8_t		*tmp = NULL;
	const uint8_t	*p;
	size_t		 tmplen;
	int		 ret = -1;
	int		 bnlen, off;
	const BIGNUM	*r, *s;

	if (len % 2)
		goto done;	/* must be even */
	bnlen = len/2;
	/*
	 * (a) create DER signature into 'tmp' buffer
	 * (b) convert buffer to ECDSA_SIG object
	 * (c) concatenate the padded r|s BIGNUMS into 'ptr'
	 */
	if (EVP_DigestSignFinal(dsa->dsa_ctx, NULL, &tmplen) != 1)
		goto done;
	if ((tmp = calloc(1, tmplen)) == NULL)
		goto done;
	if (EVP_DigestSignFinal(dsa->dsa_ctx, tmp, &tmplen) != 1)
		goto done;
	p = tmp;
	if ((obj = d2i_ECDSA_SIG(NULL, &p, tmplen)) == NULL)
		goto done;
	ECDSA_SIG_get0(obj, &r, &s);
	if (BN_num_bytes(r) > bnlen || BN_num_bytes(s) > bnlen)
		goto done;
	memset(ptr, 0, len);
	off = bnlen - BN_num_bytes(r);
	BN_bn2bin(r, ptr + off);
	off = 2 * bnlen - BN_num_bytes(s);
	BN_bn2bin(s, ptr + off);
	ret = 0;
 done:
	free(tmp);
	ECDSA_SIG_free(obj);

	return (ret);
}

ssize_t
dsa_sign_final(struct iked_dsa *dsa, void *buf, size_t len)
{
	unsigned int	 hmaclen;
	size_t		 off = 0;
	uint8_t		*ptr = buf;

	if (len < dsa_length(dsa))
		return (-1);

	if (dsa->dsa_hmac) {
		if (!HMAC_Final(dsa->dsa_ctx, buf, &hmaclen))
			return (-1);
		if (hmaclen > INT_MAX)
			return (-1);
		return (ssize_t)hmaclen;
	} else {
		switch (dsa->dsa_method) {
		case IKEV2_AUTH_ECDSA_256:
		case IKEV2_AUTH_ECDSA_384:
		case IKEV2_AUTH_ECDSA_521:
			if (_dsa_sign_ecdsa(dsa, buf, len) < 0)
				return (-1);
			return (len);
		default:
			if (_dsa_sign_encode(dsa, ptr, len, &off) < 0)
				return (-1);
			if (off > len)
				return (-1);
			len -= off;
			ptr += off;
			if (EVP_DigestSignFinal(dsa->dsa_ctx, ptr, &len) != 1)
				return (-1);
			return (len + off);
		}
	}
	return (-1);
}

int
_dsa_verify_prepare(struct iked_dsa *dsa, uint8_t **sigp, size_t *lenp,
    uint8_t **freemep)
{
	ECDSA_SIG	*obj = NULL;
	uint8_t		*ptr = NULL;
	size_t		 bnlen, off;
	ssize_t		 len;
	int		 ret = -1;
	BIGNUM		*r = NULL, *s = NULL;

	*freemep = NULL;	/* don't return garbage in case of an error */

	switch (dsa->dsa_method) {
	case IKEV2_AUTH_SIG:
		/*
		 * The first byte of the signature encodes the OID
		 * prefix length which we need to skip.
		 */
		off = (*sigp)[0] + 1;
		*sigp = *sigp + off;
		*lenp = *lenp - off;
		*freemep = NULL;
		ret = 0;
		break;
	case IKEV2_AUTH_ECDSA_256:
	case IKEV2_AUTH_ECDSA_384:
	case IKEV2_AUTH_ECDSA_521:
		/*
		 * sigp points to concatenation r|s, while EVP_VerifyFinal()
		 * expects the signature as a DER-encoded blob (of the two
		 * values), so we need to convert the signature in a new
		 * buffer (we cannot override the given buffer) and the caller
		 * has to free this buffer ('freeme').
		 */
		if (*lenp < 64 || *lenp > 132 || *lenp % 2)
			goto done;
		bnlen = (*lenp)/2;
		/* sigp points to concatenation: r|s */
		if ((obj = ECDSA_SIG_new()) == NULL ||
		    (r = BN_bin2bn(*sigp, bnlen, NULL)) == NULL ||
		    (s = BN_bin2bn(*sigp+bnlen, bnlen, NULL)) == NULL ||
		    ECDSA_SIG_set0(obj, r, s) == 0 ||
		    (len = i2d_ECDSA_SIG(obj, &ptr)) <= 0)
			goto done;
		r = s = NULL;
		*lenp = len;
		*sigp = ptr;
		*freemep = ptr;
		ptr = NULL;
		ret = 0;
		break;
	default:
		return (0);
	}
 done:
	BN_clear_free(r);
	BN_clear_free(s);
	free(ptr);
	ECDSA_SIG_free(obj);

	return (ret);
}

ssize_t
dsa_verify_final(struct iked_dsa *dsa, void *buf, size_t len)
{
	uint8_t		 sig[EVP_MAX_MD_SIZE];
	uint8_t		*ptr = buf, *freeme = NULL;
	unsigned int	 siglen = sizeof(sig);

	if (dsa->dsa_hmac) {
		if (!HMAC_Final(dsa->dsa_ctx, sig, &siglen))
			return (-1);
		if (siglen != len || memcmp(buf, sig, siglen) != 0)
			return (-1);
	} else {
		if (_dsa_verify_prepare(dsa, &ptr, &len, &freeme) < 0)
			return (-1);
		if (EVP_DigestVerifyFinal(dsa->dsa_ctx, ptr, len) != 1) {
			OPENSSL_free(freeme);
			ca_sslerror(__func__);
			return (-1);
		}
		OPENSSL_free(freeme);
	}

	return (0);
}