enoch/n2n
1
0
Fork 0
mirror of https://github.com/ntop/n2n.git synced 2024-09-20 00:51:10 +02:00
Code Issues Actions Packages Projects Releases 1 Wiki Activity

CentOS 6 compilation fixes

Browse Source
This commit is contained in:
lucaderi 2020-06-17 15:40:07 +02:00
parent d610308156
commit 75fd32b48a
2 changed files with 83 additions and 87 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

165
header_encryption.c
View File

@ -31,116 +31,115 @@
uint32_t packet_header_decrypt (uint8_t packet[], uint8_t packet_len, uint32_t packet_header_decrypt (uint8_t packet[], uint8_t packet_len,
char * community_name, he_context_t * ctx) { char * community_name, he_context_t * ctx) {
// assemble IV // assemble IV
// the last four are ASCII "n2n!" and do not get overwritten // the last four are ASCII "n2n!" and do not get overwritten
uint8_t iv[16] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, uint8_t iv[16] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x6E, 0x32, 0x6E, 0x21 }; 0x00, 0x00, 0x00, 0x00, 0x6E, 0x32, 0x6E, 0x21 };
// the first 96 bits of the packet get padded with ASCII "n2n!" // the first 96 bits of the packet get padded with ASCII "n2n!"
// to full 128 bit IV // to full 128 bit IV
memcpy (iv, packet, 12); memcpy (iv, packet, 12);
// alternatively, consider: pearson_hash_128 (iv, packet, 12); // alternatively, consider: pearson_hash_128 (iv, packet, 12);
// try community name as possible key and check for magic bytes // try community name as possible key and check for magic bytes
uint32_t magic = 0x6E326E00; // ="n2n_" uint32_t magic = 0x6E326E00; // ="n2n_"
uint32_t test_magic; uint32_t test_magic;
// check for magic bytes and resonable value in header len field // check for magic bytes and resonable value in header len field
speck_he ((uint8_t*)&test_magic, &packet[12], 4, iv, (speck_context_t*)ctx); speck_he ((uint8_t*)&test_magic, &packet[12], 4, iv, (speck_context_t*)ctx);
test_magic = be32toh (test_magic); test_magic = be32toh (test_magic);
if ( ((test_magic << 8) == magic) if ( ((test_magic << 8) == magic)
&& ((test_magic >> 24) <= packet_len) // (test_masgic >> 24) is header_len && ((test_magic >> 24) <= packet_len) // (test_masgic >> 24) is header_len
) { ) {
speck_he (&packet[12], &packet[12], (test_magic >> 24) - 12, iv, (speck_context_t*)ctx); speck_he (&packet[12], &packet[12], (test_magic >> 24) - 12, iv, (speck_context_t*)ctx);
// restore original packet order // restore original packet order
memcpy (&packet[0], &packet[16], 4); memcpy (&packet[0], &packet[16], 4);
memcpy (&packet[4], community_name, N2N_COMMUNITY_SIZE); memcpy (&packet[4], community_name, N2N_COMMUNITY_SIZE);
return (1); // successful return (1); // successful
} else } else
return (0); // unsuccessful return (0); // unsuccessful
} }
int8_t packet_header_decrypt_if_required (uint8_t packet[], uint16_t packet_len, int8_t packet_header_decrypt_if_required (uint8_t packet[], uint16_t packet_len,
struct sn_community *communities) { struct sn_community *communities) {
struct sn_community *c, *tmp; struct sn_community *c, *tmp;
if (packet_len < 20) if (packet_len < 20)
return (-1); return (-1);
// first, check if header is unenrypted to put it into the fast-lane then // first, check if header is unenrypted to put it into the fast-lane then
// the following check is around 99.99962 percent reliable // the following check is around 99.99962 percent reliable
// it heavily relies on the structure of packet's common part // it heavily relies on the structure of packet's common part
// changes to wire.c:encode/decode_common need to go together with this code // changes to wire.c:encode/decode_common need to go together with this code
if ( (packet[19] == (uint8_t)0x00) // null terminated community name if ( (packet[19] == (uint8_t)0x00) // null terminated community name
&& (packet[00] == N2N_PKT_VERSION) // correct packet version && (packet[00] == N2N_PKT_VERSION) // correct packet version
// && (packet[01] <= N2N_DEFAULT_TTL) // reasonable TTL -- might interfere with hole-punching-related or cli passed higher values ?! // && (packet[01] <= N2N_DEFAULT_TTL) // reasonable TTL -- might interfere with hole-punching-related or cli passed higher values ?!
&& ((be16toh (*(uint16_t*)&(packet[02])) & N2N_FLAGS_TYPE_MASK ) <= MSG_TYPE_MAX_TYPE ) // message type && ((be16toh (*(uint16_t*)&(packet[02])) & N2N_FLAGS_TYPE_MASK ) <= MSG_TYPE_MAX_TYPE ) // message type
&& ( be16toh (*(uint16_t*)&(packet[02])) < N2N_FLAGS_OPTIONS) // flags && ( be16toh (*(uint16_t*)&(packet[02])) < N2N_FLAGS_OPTIONS) // flags
) { ) {
// most probably unencrypted // most probably unencrypted
// make sure, no downgrading happens here and no unencrypted packets can be // make sure, no downgrading happens here and no unencrypted packets can be
// injected in a community which definitely deals with encrypted headers // injected in a community which definitely deals with encrypted headers
HASH_FIND_COMMUNITY(communities, (char *)&packet[04], c); HASH_FIND_COMMUNITY(communities, (char *)&packet[04], c);
if (!c) if (!c)
if (c->header_encryption == HEADER_ENCRYPTION_ENABLED) if (c->header_encryption == HEADER_ENCRYPTION_ENABLED)
return (-2); return (-2);
// set 'no encryption' in case it is not set yet // set 'no encryption' in case it is not set yet
c->header_encryption = HEADER_ENCRYPTION_NONE; c->header_encryption = HEADER_ENCRYPTION_NONE;
c->header_encryption_ctx = NULL; c->header_encryption_ctx = NULL;
return (HEADER_ENCRYPTION_NONE); return (HEADER_ENCRYPTION_NONE);
} else { } else {
// most probably encrypted // most probably encrypted
// cycle through the known communities (as keys) to eventually decrypt // cycle through the known communities (as keys) to eventually decrypt
int32_t ret; int32_t ret;
HASH_ITER (hh, communities, c, tmp) { HASH_ITER (hh, communities, c, tmp) {
// skip the definitely unencrypted communities // skip the definitely unencrypted communities
if (c->header_encryption == HEADER_ENCRYPTION_NONE) if (c->header_encryption == HEADER_ENCRYPTION_NONE)
continue; continue;
if ( (ret = packet_header_decrypt (packet, packet_len, c->community, c->header_encryption_ctx)) ) { if ( (ret = packet_header_decrypt (packet, packet_len, c->community, c->header_encryption_ctx)) ) {
// set 'encrypted' in case it is not set yet // set 'encrypted' in case it is not set yet
c->header_encryption = HEADER_ENCRYPTION_ENABLED; c->header_encryption = HEADER_ENCRYPTION_ENABLED;
// no need to test further communities // no need to test further communities
return (HEADER_ENCRYPTION_ENABLED); return (HEADER_ENCRYPTION_ENABLED);
} }
} }
// no matching key/community // no matching key/community
return (-3); return (-3);
} }
} }
int32_t packet_header_encrypt (uint8_t packet[], uint8_t header_len, he_context_t * ctx) { int32_t packet_header_encrypt (uint8_t packet[], uint8_t header_len, he_context_t * ctx) {
uint8_t iv[16];
uint64_t *iv64 = (uint64_t*)&iv;
const uint32_t magic = 0x006E326E;
if (header_len < 20) if (header_len < 20)
return (-1); return (-1);
memcpy (&packet[16], &packet[00], 4); memcpy (&packet[16], &packet[00], 4);
uint8_t iv[16]; iv64[0] = n2n_rand();
((uint64_t*)iv)[0] = n2n_rand (); iv64[1] = n2n_rand();
((uint64_t*)iv)[1] = n2n_rand (); iv64[3] = htobe32(magic);
iv[12] = header_len;
const uint32_t magic = 0x006E326E; speck_he (&packet[12], &packet[12], header_len - 12, iv, (speck_context_t*)ctx);
((uint32_t*)iv)[3] = htobe32 (magic);
iv[12] = header_len; return (0);
speck_he (&packet[12], &packet[12], header_len - 12, iv, (speck_context_t*)ctx);
return (0);
} }
void packet_header_setup_key (char * community_name, he_context_t * ctx) { void packet_header_setup_key (char * community_name, he_context_t * ctx) {
uint8_t key[16]; uint8_t key[16];
pearson_hash_128 (key, (uint8_t*)community_name, N2N_COMMUNITY_SIZE); pearson_hash_128 (key, (uint8_t*)community_name, N2N_COMMUNITY_SIZE);
ctx = calloc(1, sizeof(speck_context_t)); ctx = calloc(1, sizeof(speck_context_t));
speck_expand_key_he (key, (speck_context_t*)ctx); speck_expand_key_he (key, (speck_context_t*)ctx);
} }

3
header_encryption.h
View File

@ -23,9 +23,6 @@
#include "speck.h" #include "speck.h"
typedef struct speck_context_t he_context_t;
/* Header encryption indicators */ /* Header encryption indicators */
#define HEADER_ENCRYPTION_UNKNOWN 0 #define HEADER_ENCRYPTION_UNKNOWN 0
#define HEADER_ENCRYPTION_NONE 1 #define HEADER_ENCRYPTION_NONE 1