IBR-DTNSuite  0.10
SecurityBlock.h
Go to the documentation of this file.
1 /*
2  * SecurityBlock.h
3  *
4  * Copyright (C) 2011 IBR, TU Braunschweig
5  *
6  * Written-by: Johannes Morgenroth <morgenroth@ibr.cs.tu-bs.de>
7  *
8  * Licensed under the Apache License, Version 2.0 (the "License");
9  * you may not use this file except in compliance with the License.
10  * You may obtain a copy of the License at
11  *
12  * http://www.apache.org/licenses/LICENSE-2.0
13  *
14  * Unless required by applicable law or agreed to in writing, software
15  * distributed under the License is distributed on an "AS IS" BASIS,
16  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17  * See the License for the specific language governing permissions and
18  * limitations under the License.
19  *
20  */
21 
22 #ifndef SECURITYBLOCK_H_
23 #define SECURITYBLOCK_H_
24 
25 #include "ibrdtn/data/Block.h"
26 #include "ibrdtn/data/EID.h"
27 #include "ibrdtn/data/BundleString.h"
28 #include "ibrdtn/data/Bundle.h"
29 #include <ibrcommon/ssl/AES128Stream.h> // TODO <-- this include sucks
30 #include <list>
31 #include <sys/types.h>
32 
33 // forward deklaration needed for struct RSA
34 struct rsa_st;
35 // forward deklaration of RSA object
36 typedef rsa_st RSA;
37 
38 namespace dtn
39 {
40  namespace security
41  {
42  class MutualSerializer;
43  class StrictSerializer;
44 
58  class SecurityBlock : public dtn::data::Block
59  {
60  friend class StrictSerializer;
61  friend class MutualSerializer;
62  public:
64  enum BLOCK_TYPES
65  {
66  BUNDLE_AUTHENTICATION_BLOCK = 0x02,
67  PAYLOAD_INTEGRITY_BLOCK = 0x03,
68  PAYLOAD_CONFIDENTIAL_BLOCK = 0x04,
69  EXTENSION_SECURITY_BLOCK = 0x09
70  };
73  enum TLV_TYPES
74  {
75  not_set = 0,
76  initialization_vector = 1,
77  key_information = 3,
78  fragment_range = 4,
79  integrity_signature = 5,
80  salt = 7,
81  PCB_integrity_check_value = 8,
82  encapsulated_block = 10,
83  block_type_of_encapsulated_block = 11
84  };
86  enum CIPHERSUITE_FLAGS
87  {
88  CONTAINS_SECURITY_RESULT = 1 << 0,
89  CONTAINS_CORRELATOR = 1 << 1,
90  CONTAINS_CIPHERSUITE_PARAMS = 1 << 2,
91  CONTAINS_SECURITY_DESTINATION = 1 << 3,
92  CONTAINS_SECURITY_SOURCE = 1 << 4,
93  BIT5_RESERVED = 1 << 5,
94  BIT6_RESERVED = 1 << 6
95  };
97  enum CIPHERSUITE_IDS
98  {
99  BAB_HMAC = 0x001,
100  PIB_RSA_SHA256 = 0x002,
101  PCB_RSA_AES128_PAYLOAD_PIB_PCB = 0x003,
102  ESB_RSA_AES128_EXT = 0x004
103  };
104 
105  class TLV
106  {
107  public:
108  TLV() : _type(not_set) {};
109  TLV(TLV_TYPES type, std::string value)
110  : _type(type), _value(value)
111  { }
112 
113  bool operator<(const TLV &tlv) const;
114  bool operator==(const TLV &tlv) const;
115 
116  const std::string getValue() const;
117  TLV_TYPES getType() const;
118  dtn::data::Length getLength() const;
119 
120  friend std::ostream& operator<<(std::ostream &stream, const TLV &tlv);
121  friend std::istream& operator>>(std::istream &stream, TLV &tlv);
122 
123  private:
124  TLV_TYPES _type;
125  dtn::data::BundleString _value;
126  };
127 
128  class TLVList : public std::set<TLV>
129  {
130  public:
131  TLVList() {};
132  virtual ~TLVList() {};
133 
134  friend std::ostream& operator<<(std::ostream &stream, const TLVList &tlvlist);
135  friend std::istream& operator>>(std::istream &stream, TLVList &tlvlist);
136 
137  const std::string get(TLV_TYPES type) const;
138  void get(TLV_TYPES type, unsigned char *value, dtn::data::Length length) const;
139  void set(TLV_TYPES type, std::string value);
140  void set(TLV_TYPES type, const unsigned char *value, dtn::data::Length length);
141  void remove(TLV_TYPES type);
142 
143  const std::string toString() const;
144  dtn::data::Length getLength() const;
145 
146  private:
147  dtn::data::Length getPayloadLength() const;
148  };
149 
151  virtual ~SecurityBlock() = 0;
152 
157  virtual dtn::data::Length getLength() const;
158 
164  virtual dtn::data::Length getLength_mutable() const;
165 
171  virtual std::ostream &serialize(std::ostream &stream, dtn::data::Length &length) const;
172 
179  virtual std::ostream &serialize_strict(std::ostream &stream, dtn::data::Length &length) const;
180 
185  virtual std::istream &deserialize(std::istream &stream, const dtn::data::Length &length);
186 
190  const dtn::data::EID getSecuritySource() const;
191 
196  const dtn::data::EID getSecurityDestination() const;
197 
202  void setSecuritySource(const dtn::data::EID &source);
203 
208  void setSecurityDestination(const dtn::data::EID &destination);
209 
216  bool isSecuritySource(const dtn::data::Bundle&, const dtn::data::EID&) const;
217 
224  bool isSecurityDestination(const dtn::data::Bundle&, const dtn::data::EID&) const;
225 
231  const dtn::data::EID getSecuritySource(const dtn::data::Bundle&) const;
232 
238  const dtn::data::EID getSecurityDestination(const dtn::data::Bundle&) const;
239 
240  protected:
243  dtn::data::Number _ciphersuite_id;
247  dtn::data::Bitset<CIPHERSUITE_FLAGS> _ciphersuite_flags;
249  dtn::data::Number _correlator;
250 
253  TLVList _ciphersuite_params;
254 
256  TLVList _security_result;
257 
259  dtn::data::EID _security_destination;
260 
262  dtn::data::EID _security_source;
263 
265  void store_security_references();
266 
273  SecurityBlock(const SecurityBlock::BLOCK_TYPES type, const CIPHERSUITE_IDS id);
274 
280  SecurityBlock(const SecurityBlock::BLOCK_TYPES type);
281 
286  void setCiphersuiteId(const CIPHERSUITE_IDS id);
287 
292  void setCorrelator(const dtn::data::Number &corr);
293 
300  static bool isCorrelatorPresent(const dtn::data::Bundle &bundle, const dtn::data::Number &correlator);
301 
308  static dtn::data::Number createCorrelatorValue(const dtn::data::Bundle &bundle);
309 
315  virtual MutualSerializer &serialize_mutable(MutualSerializer &serializer) const;
316  virtual MutualSerializer &serialize_mutable_without_security_result(MutualSerializer &serializer) const;
317 
327  virtual dtn::data::Length getSecurityResultSize() const;
328 
335  static void createSaltAndKey(uint32_t& salt, unsigned char * key, dtn::data::Length key_size);
336 
347  static void addKey(TLVList& security_parameter, unsigned char const * const key, dtn::data::Length key_size, RSA * rsa);
348 
358  static bool getKey(const TLVList& security_parameter, unsigned char * key, dtn::data::Length key_size, RSA * rsa);
359 
365  static void addSalt(TLVList& security_parameters, const uint32_t &salt);
366 
371  static uint32_t getSalt(const TLVList& security_parameters);
372 
379  static void copyEID(const dtn::data::Block& from, dtn::data::Block& to, dtn::data::Length skip = 0);
380 
394  template <class T>
395  static T& encryptBlock(dtn::data::Bundle& bundle, dtn::data::Bundle::iterator &it, uint32_t salt, const unsigned char ephemeral_key[ibrcommon::AES128Stream::key_size_in_bytes]);
396 
408  static void decryptBlock(dtn::data::Bundle& bundle, dtn::data::Bundle::iterator &it, uint32_t salt, const unsigned char key[ibrcommon::AES128Stream::key_size_in_bytes]);
409 
415  static void addFragmentRange(TLVList& ciphersuite_params, const dtn::data::Number &fragmentoffset, const dtn::data::Number &payload_length);
416 
417  private:
419  SecurityBlock(const SecurityBlock&);
421  SecurityBlock& operator=(const SecurityBlock&);
422  };
423 
424  template <class T>
425  T& SecurityBlock::encryptBlock(dtn::data::Bundle& bundle, dtn::data::Bundle::iterator &it, uint32_t salt, const unsigned char ephemeral_key[ibrcommon::AES128Stream::key_size_in_bytes])
426  {
427  const dtn::data::Block &block = (**it);
428 
429  // insert ESB, block can be removed after encryption, because bundle will destroy it
430  T& esb = bundle.insert<T>(it);
431 
432  // take eid list
433  copyEID(block, esb);
434 
435  std::stringstream ss;
436  ibrcommon::AES128Stream encrypt(ibrcommon::CipherStream::CIPHER_ENCRYPT, ss, ephemeral_key, salt);
437  dtn::data::Dictionary dict(bundle);
438  dtn::data::DefaultSerializer dser(encrypt, dict);
439  dser << block;
440  encrypt << std::flush;
441 
442  // append tag at the end of the ciphertext
443  unsigned char tag[ibrcommon::AES128Stream::tag_len]; encrypt.getTag(tag);
444  ss.write((const char*)&tag, ibrcommon::AES128Stream::tag_len);
445 
446  esb._security_result.set(SecurityBlock::encapsulated_block, ss.str());
447  esb._ciphersuite_flags |= SecurityBlock::CONTAINS_SECURITY_RESULT;
448 
449  unsigned char iv[ibrcommon::AES128Stream::iv_len]; encrypt.getIV(iv);
450  esb._ciphersuite_params.set(SecurityBlock::initialization_vector, iv, ibrcommon::AES128Stream::iv_len);
451 
452  esb._ciphersuite_flags |= SecurityBlock::CONTAINS_CIPHERSUITE_PARAMS;
453 
454  bundle.erase(it++);
455 
456  return esb;
457  }
458  }
459 }
460 
461 #endif /* SECURITYBLOCK_H_ */