mirror of
https://github.com/PurpleI2P/i2pd.git
synced 2025-04-27 11:17:49 +02:00
cumulative update from bitbucket
This commit is contained in:
orignal
parent
73d4025256
commit
62cf83921b
76 changed files with 2408 additions and 2272 deletions
774
Reseed.cpp
774
Reseed.cpp
|
|
@ -3,19 +3,17 @@
|
|||
#include <sstream>
|
||||
#include <boost/regex.hpp>
|
||||
#include <boost/filesystem.hpp>
|
||||
#include <boost/lexical_cast.hpp>
|
||||
#include <cryptopp/asn.h>
|
||||
#include <cryptopp/base64.h>
|
||||
#include <cryptopp/crc.h>
|
||||
#include <cryptopp/hmac.h>
|
||||
#include <cryptopp/zinflate.h>
|
||||
#define CRYPTOPP_ENABLE_NAMESPACE_WEAK 1
|
||||
#include <cryptopp/arc4.h>
|
||||
#include <boost/asio.hpp>
|
||||
#include <boost/asio/ssl.hpp>
|
||||
#include <openssl/bn.h>
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/err.h>
|
||||
#include <zlib.h>
|
||||
#include "I2PEndian.h"
|
||||
#include "Reseed.h"
|
||||
#include "Log.h"
|
||||
#include "Identity.h"
|
||||
#include "CryptoConst.h"
|
||||
#include "Crypto.h"
|
||||
#include "NetDb.h"
|
||||
#include "util.h"
|
||||
|
||||
|
|
@ -24,27 +22,18 @@ namespace i2p
|
|||
{
|
||||
namespace data
|
||||
{
|
||||
|
||||
static std::vector<std::string> httpReseedHostList = {
|
||||
"http://netdb.i2p2.no/", // only SU3 (v2) support
|
||||
"http://i2p-netdb.innovatio.no/",
|
||||
"http://193.150.121.66/netDb/"
|
||||
};
|
||||
|
||||
static std::vector<std::string> httpsReseedHostList = {
|
||||
// "https://193.150.121.66/netDb/", // unstable
|
||||
// "https://i2p-netdb.innovatio.no/",// Vuln to POODLE
|
||||
"https://netdb.i2p2.no/", // Only SU3 (v2) support
|
||||
"https://reseed.i2p-projekt.de/", // Only HTTPS
|
||||
//"https://cowpuncher.drollette.com/netdb/", // returns error
|
||||
"https://netdb.rows.io:444/",
|
||||
"https://uk.reseed.i2p2.no:444/"
|
||||
// following hosts are fine but don't support AES256
|
||||
/*"https://i2p.mooo.com/netDb/",
|
||||
"https://link.mx24.eu/", // Only HTTPS and SU3 (v2) support
|
||||
"https://i2pseed.zarrenspry.info/", // Only HTTPS and SU3 (v2) support
|
||||
"https://ieb9oopo.mooo.com/" // Only HTTPS and SU3 (v2) support*/
|
||||
};
|
||||
static std::vector<std::string> httpsReseedHostList =
|
||||
{
|
||||
"https://reseed.i2p-projekt.de/", // Only HTTPS
|
||||
"https://i2pseed.zarrenspry.info/", // Only HTTPS and SU3 (v3) support
|
||||
"https://i2p.mooo.com/netDb/",
|
||||
"https://netdb.i2p2.no/", // Only SU3 (v3) support, SNI required
|
||||
"https://us.reseed.i2p2.no:444/",
|
||||
"https://uk.reseed.i2p2.no:444/",
|
||||
"https://reseed.i2p.vzaws.com:8443/", // Only SU3 (v3) support
|
||||
"https://user.mx24.eu/", // Only HTTPS and SU3 (v3) support
|
||||
"https://ieb9oopo.mooo.com/" // Only HTTPS and SU3 (v3) support
|
||||
};
|
||||
|
||||
Reseeder::Reseeder()
|
||||
{
|
||||
|
|
@ -54,75 +43,11 @@ namespace data
|
|||
{
|
||||
}
|
||||
|
||||
bool Reseeder::reseedNow()
|
||||
{
|
||||
// This method is deprecated
|
||||
try
|
||||
{
|
||||
std::string reseedHost = httpReseedHostList[(rand() % httpReseedHostList.size())];
|
||||
LogPrint("Reseeding from ", reseedHost);
|
||||
std::string content = i2p::util::http::httpRequest(reseedHost);
|
||||
if (content == "")
|
||||
{
|
||||
LogPrint("Reseed failed");
|
||||
return false;
|
||||
}
|
||||
boost::regex e("<\\s*A\\s+[^>]*href\\s*=\\s*\"([^\"]*)\"", boost::regex::normal | boost::regbase::icase);
|
||||
boost::sregex_token_iterator i(content.begin(), content.end(), e, 1);
|
||||
boost::sregex_token_iterator j;
|
||||
//TODO: Ugly code, try to clean up.
|
||||
//TODO: Try to reduce N number of variables
|
||||
std::string name;
|
||||
std::string routerInfo;
|
||||
std::string tmpUrl;
|
||||
std::string filename;
|
||||
std::string ignoreFileSuffix = ".su3";
|
||||
boost::filesystem::path root = i2p::util::filesystem::GetDataDir();
|
||||
while (i != j)
|
||||
{
|
||||
name = *i++;
|
||||
if (name.find(ignoreFileSuffix)!=std::string::npos)
|
||||
continue;
|
||||
LogPrint("Downloading ", name);
|
||||
tmpUrl = reseedHost;
|
||||
tmpUrl.append(name);
|
||||
routerInfo = i2p::util::http::httpRequest(tmpUrl);
|
||||
if (routerInfo.size()==0)
|
||||
continue;
|
||||
filename = root.string();
|
||||
#ifndef _WIN32
|
||||
filename += "/netDb/r";
|
||||
#else
|
||||
filename += "\\netDb\\r";
|
||||
#endif
|
||||
filename += name.at(11); // first char in id
|
||||
#ifndef _WIN32
|
||||
filename.append("/");
|
||||
#else
|
||||
filename.append("\\");
|
||||
#endif
|
||||
filename.append(name.c_str());
|
||||
std::ofstream outfile (filename, std::ios::binary);
|
||||
outfile << routerInfo;
|
||||
outfile.close();
|
||||
}
|
||||
return true;
|
||||
}
|
||||
catch (std::exception& ex)
|
||||
{
|
||||
//TODO: error reporting
|
||||
return false;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
int Reseeder::ReseedNowSU3 ()
|
||||
{
|
||||
CryptoPP::AutoSeededRandomPool rnd;
|
||||
auto ind = rnd.GenerateWord32 (0, httpReseedHostList.size() - 1 + httpsReseedHostList.size () - 1);
|
||||
std::string reseedHost = (ind < httpReseedHostList.size()) ? httpReseedHostList[ind] :
|
||||
httpsReseedHostList[ind - httpReseedHostList.size()];
|
||||
return ReseedFromSU3 (reseedHost, ind >= httpReseedHostList.size());
|
||||
auto ind = rand () % httpsReseedHostList.size ();
|
||||
std::string& reseedHost = httpsReseedHostList[ind];
|
||||
return ReseedFromSU3 (reseedHost, true);
|
||||
}
|
||||
|
||||
int Reseeder::ReseedFromSU3 (const std::string& host, bool https)
|
||||
|
|
@ -221,10 +146,27 @@ namespace data
|
|||
uint8_t * signature = new uint8_t[signatureLength];
|
||||
s.read ((char *)signature, signatureLength);
|
||||
// RSA-raw
|
||||
i2p::crypto::RSASHA5124096RawVerifier verifier(it->second);
|
||||
verifier.Update (tbs, tbsLen);
|
||||
if (!verifier.Verify (signature))
|
||||
LogPrint (eLogWarning, "SU3 signature verification failed");
|
||||
{
|
||||
// calculate digest
|
||||
uint8_t digest[64];
|
||||
SHA512 (tbs, tbsLen, digest);
|
||||
// encrypt signature
|
||||
BN_CTX * bnctx = BN_CTX_new ();
|
||||
BIGNUM * s = BN_new (), * n = BN_new ();
|
||||
BN_bin2bn (signature, signatureLength, s);
|
||||
BN_bin2bn (it->second, i2p::crypto::RSASHA5124096_KEY_LENGTH, n);
|
||||
BN_mod_exp (s, s, i2p::crypto::rsae, n, bnctx); // s = s^e mod n
|
||||
uint8_t * enSigBuf = new uint8_t[signatureLength];
|
||||
i2p::crypto::bn2buf (s, enSigBuf, signatureLength);
|
||||
// digest is right aligned
|
||||
// we can't use RSA_verify due wrong padding in SU3
|
||||
if (memcmp (enSigBuf + (signatureLength - 64), digest, 64))
|
||||
LogPrint (eLogWarning, "SU3 signature verification failed");
|
||||
delete[] enSigBuf;
|
||||
BN_free (s); BN_free (n);
|
||||
BN_CTX_free (bnctx);
|
||||
}
|
||||
|
||||
delete[] signature;
|
||||
delete[] tbs;
|
||||
s.seekg (pos, std::ios::beg);
|
||||
|
|
@ -255,8 +197,9 @@ namespace data
|
|||
compressionMethod = le16toh (compressionMethod);
|
||||
s.seekg (4, std::ios::cur); // skip fields we don't care about
|
||||
uint32_t compressedSize, uncompressedSize;
|
||||
uint8_t crc32[4];
|
||||
s.read ((char *)crc32, 4);
|
||||
uint32_t crc_32;
|
||||
s.read ((char *)&crc_32, 4);
|
||||
crc_32 = le32toh (crc_32);
|
||||
s.read ((char *)&compressedSize, 4);
|
||||
compressedSize = le32toh (compressedSize);
|
||||
s.read ((char *)&uncompressedSize, 4);
|
||||
|
|
@ -278,9 +221,9 @@ namespace data
|
|||
{
|
||||
LogPrint (eLogError, "SU3 archive data descriptor not found");
|
||||
return numFiles;
|
||||
}
|
||||
|
||||
s.read ((char *)crc32, 4);
|
||||
}
|
||||
s.read ((char *)&crc_32, 4);
|
||||
crc_32 = le32toh (crc_32);
|
||||
s.read ((char *)&compressedSize, 4);
|
||||
compressedSize = le32toh (compressedSize) + 4; // ??? we must consider signature as part of compressed data
|
||||
s.read ((char *)&uncompressedSize, 4);
|
||||
|
|
@ -301,25 +244,31 @@ namespace data
|
|||
s.read ((char *)compressed, compressedSize);
|
||||
if (compressionMethod) // we assume Deflate
|
||||
{
|
||||
CryptoPP::Inflator decompressor;
|
||||
decompressor.Put (compressed, compressedSize);
|
||||
decompressor.MessageEnd();
|
||||
if (decompressor.MaxRetrievable () <= uncompressedSize)
|
||||
{
|
||||
uint8_t * uncompressed = new uint8_t[uncompressedSize];
|
||||
decompressor.Get (uncompressed, uncompressedSize);
|
||||
if (CryptoPP::CRC32().VerifyDigest (crc32, uncompressed, uncompressedSize))
|
||||
z_stream inflator;
|
||||
memset (&inflator, 0, sizeof (inflator));
|
||||
inflateInit2 (&inflator, -MAX_WBITS); // no zlib header
|
||||
uint8_t * uncompressed = new uint8_t[uncompressedSize];
|
||||
inflator.next_in = compressed;
|
||||
inflator.avail_in = compressedSize;
|
||||
inflator.next_out = uncompressed;
|
||||
inflator.avail_out = uncompressedSize;
|
||||
int err;
|
||||
if ((err = inflate (&inflator, Z_SYNC_FLUSH)) >= 0)
|
||||
{
|
||||
uncompressedSize -= inflator.avail_out;
|
||||
if (crc32 (0, uncompressed, uncompressedSize) == crc_32)
|
||||
{
|
||||
i2p::data::netdb.AddRouterInfo (uncompressed, uncompressedSize);
|
||||
numFiles++;
|
||||
}
|
||||
}
|
||||
else
|
||||
LogPrint (eLogError, "CRC32 verification failed");
|
||||
delete[] uncompressed;
|
||||
}
|
||||
}
|
||||
else
|
||||
LogPrint (eLogError, "Actual uncompressed size ", decompressor.MaxRetrievable (), " exceed ", uncompressedSize, " from header");
|
||||
}
|
||||
LogPrint (eLogError, "decompression error ", err);
|
||||
delete[] uncompressed;
|
||||
inflateEnd (&inflator);
|
||||
}
|
||||
else // no compression
|
||||
{
|
||||
i2p::data::netdb.AddRouterInfo (compressed, compressedSize);
|
||||
|
|
@ -362,111 +311,33 @@ namespace data
|
|||
return false;
|
||||
}
|
||||
|
||||
const char CERTIFICATE_HEADER[] = "-----BEGIN CERTIFICATE-----";
|
||||
const char CERTIFICATE_FOOTER[] = "-----END CERTIFICATE-----";
|
||||
void Reseeder::LoadCertificate (const std::string& filename)
|
||||
{
|
||||
std::ifstream s(filename, std::ifstream::binary);
|
||||
if (s.is_open ())
|
||||
{
|
||||
s.seekg (0, std::ios::end);
|
||||
size_t len = s.tellg ();
|
||||
s.seekg (0, std::ios::beg);
|
||||
char buf[2048];
|
||||
s.read (buf, len);
|
||||
std::string cert (buf, len);
|
||||
// assume file in pem format
|
||||
auto pos1 = cert.find (CERTIFICATE_HEADER);
|
||||
auto pos2 = cert.find (CERTIFICATE_FOOTER);
|
||||
if (pos1 == std::string::npos || pos2 == std::string::npos)
|
||||
{
|
||||
LogPrint (eLogError, "Malformed certificate file");
|
||||
return;
|
||||
SSL_CTX * ctx = SSL_CTX_new (TLSv1_method ());
|
||||
int ret = SSL_CTX_use_certificate_file (ctx, filename.c_str (), SSL_FILETYPE_PEM);
|
||||
if (ret)
|
||||
{
|
||||
SSL * ssl = SSL_new (ctx);
|
||||
X509 * cert = SSL_get_certificate (ssl);
|
||||
// verify
|
||||
if (cert)
|
||||
{
|
||||
// extract issuer name
|
||||
char name[100];
|
||||
X509_NAME_oneline (X509_get_issuer_name(cert), name, 100);
|
||||
// extract RSA key (we need n only, e = 65537)
|
||||
RSA * key = X509_get_pubkey (cert)->pkey.rsa;
|
||||
PublicKey value;
|
||||
i2p::crypto::bn2buf (key->n, value, 512);
|
||||
m_SigningKeys[name] = value;
|
||||
}
|
||||
pos1 += strlen (CERTIFICATE_HEADER);
|
||||
pos2 -= pos1;
|
||||
std::string base64 = cert.substr (pos1, pos2);
|
||||
|
||||
CryptoPP::ByteQueue queue;
|
||||
CryptoPP::Base64Decoder decoder; // regular base64 rather than I2P
|
||||
decoder.Attach (new CryptoPP::Redirector (queue));
|
||||
decoder.Put ((const uint8_t *)base64.data(), base64.length());
|
||||
decoder.MessageEnd ();
|
||||
|
||||
LoadCertificate (queue);
|
||||
}
|
||||
SSL_free (ssl);
|
||||
}
|
||||
else
|
||||
LogPrint (eLogError, "Can't open certificate file ", filename);
|
||||
SSL_CTX_free (ctx);
|
||||
}
|
||||
|
||||
std::string Reseeder::LoadCertificate (CryptoPP::ByteQueue& queue)
|
||||
{
|
||||
// extract X.509
|
||||
CryptoPP::BERSequenceDecoder x509Cert (queue);
|
||||
CryptoPP::BERSequenceDecoder tbsCert (x509Cert);
|
||||
// version
|
||||
uint32_t ver;
|
||||
CryptoPP::BERGeneralDecoder context (tbsCert, CryptoPP::CONTEXT_SPECIFIC | CryptoPP::CONSTRUCTED);
|
||||
CryptoPP::BERDecodeUnsigned<uint32_t>(context, ver, CryptoPP::INTEGER);
|
||||
// serial
|
||||
CryptoPP::Integer serial;
|
||||
serial.BERDecode(tbsCert);
|
||||
// signature
|
||||
CryptoPP::BERSequenceDecoder signature (tbsCert);
|
||||
signature.SkipAll();
|
||||
|
||||
// issuer
|
||||
std::string name;
|
||||
CryptoPP::BERSequenceDecoder issuer (tbsCert);
|
||||
{
|
||||
CryptoPP::BERSetDecoder c (issuer); c.SkipAll();
|
||||
CryptoPP::BERSetDecoder st (issuer); st.SkipAll();
|
||||
CryptoPP::BERSetDecoder l (issuer); l.SkipAll();
|
||||
CryptoPP::BERSetDecoder o (issuer); o.SkipAll();
|
||||
CryptoPP::BERSetDecoder ou (issuer); ou.SkipAll();
|
||||
CryptoPP::BERSetDecoder cn (issuer);
|
||||
{
|
||||
CryptoPP::BERSequenceDecoder attributes (cn);
|
||||
{
|
||||
CryptoPP::BERGeneralDecoder ident(attributes, CryptoPP::OBJECT_IDENTIFIER);
|
||||
ident.SkipAll ();
|
||||
CryptoPP::BERDecodeTextString (attributes, name, CryptoPP::UTF8_STRING);
|
||||
}
|
||||
}
|
||||
}
|
||||
issuer.SkipAll();
|
||||
// validity
|
||||
CryptoPP::BERSequenceDecoder validity (tbsCert);
|
||||
validity.SkipAll();
|
||||
// subject
|
||||
CryptoPP::BERSequenceDecoder subject (tbsCert);
|
||||
subject.SkipAll();
|
||||
// public key
|
||||
CryptoPP::BERSequenceDecoder publicKey (tbsCert);
|
||||
{
|
||||
CryptoPP::BERSequenceDecoder ident (publicKey);
|
||||
ident.SkipAll ();
|
||||
CryptoPP::BERGeneralDecoder key (publicKey, CryptoPP::BIT_STRING);
|
||||
key.Skip (1); // FIXME: probably bug in crypto++
|
||||
CryptoPP::BERSequenceDecoder keyPair (key);
|
||||
CryptoPP::Integer n;
|
||||
n.BERDecode (keyPair);
|
||||
if (name.length () > 0)
|
||||
{
|
||||
PublicKey value;
|
||||
n.Encode (value, 512);
|
||||
m_SigningKeys[name] = value;
|
||||
}
|
||||
else
|
||||
LogPrint (eLogWarning, "Unknown issuer. Skipped");
|
||||
}
|
||||
publicKey.SkipAll();
|
||||
|
||||
tbsCert.SkipAll();
|
||||
x509Cert.SkipAll();
|
||||
return name;
|
||||
}
|
||||
|
||||
void Reseeder::LoadCertificates ()
|
||||
{
|
||||
boost::filesystem::path reseedDir = i2p::util::filesystem::GetCertificatesDir() / "reseed";
|
||||
|
|
@ -494,439 +365,50 @@ namespace data
|
|||
{
|
||||
i2p::util::http::url u(address);
|
||||
if (u.port_ == 80) u.port_ = 443;
|
||||
TlsSession session (u.host_, u.port_);
|
||||
|
||||
if (session.IsEstablished ())
|
||||
{
|
||||
// send request
|
||||
std::stringstream ss;
|
||||
ss << "GET " << u.path_ << " HTTP/1.1\r\nHost: " << u.host_
|
||||
<< "\r\nAccept: */*\r\n" << "User-Agent: Wget/1.11.4\r\n" << "Connection: close\r\n\r\n";
|
||||
session.Send ((uint8_t *)ss.str ().c_str (), ss.str ().length ());
|
||||
|
||||
// read response
|
||||
std::stringstream rs;
|
||||
while (session.Receive (rs))
|
||||
;
|
||||
return i2p::util::http::GetHttpContent (rs);
|
||||
boost::asio::io_service service;
|
||||
boost::system::error_code ecode;
|
||||
auto it = boost::asio::ip::tcp::resolver(service).resolve (
|
||||
boost::asio::ip::tcp::resolver::query (u.host_, std::to_string (u.port_)), ecode);
|
||||
if (!ecode)
|
||||
{
|
||||
boost::asio::ssl::context ctx(service, boost::asio::ssl::context::tlsv12);
|
||||
ctx.set_verify_mode(boost::asio::ssl::context::verify_none);
|
||||
boost::asio::ssl::stream<boost::asio::ip::tcp::socket> s(service, ctx);
|
||||
s.lowest_layer().connect (*it, ecode);
|
||||
if (!ecode)
|
||||
{
|
||||
s.handshake (boost::asio::ssl::stream_base::client, ecode);
|
||||
if (!ecode)
|
||||
{
|
||||
LogPrint (eLogInfo, "Connected to ", u.host_, ":", u.port_);
|
||||
// send request
|
||||
std::stringstream ss;
|
||||
ss << "GET " << u.path_ << " HTTP/1.1\r\nHost: " << u.host_
|
||||
<< "\r\nAccept: */*\r\n" << "User-Agent: Wget/1.11.4\r\n" << "Connection: close\r\n\r\n";
|
||||
s.write_some (boost::asio::buffer (ss.str ()));
|
||||
// read response
|
||||
std::stringstream rs;
|
||||
char response[1024]; size_t l = 0;
|
||||
do
|
||||
{
|
||||
l = s.read_some (boost::asio::buffer (response, 1024), ecode);
|
||||
if (l) rs.write (response, l);
|
||||
}
|
||||
while (!ecode && l);
|
||||
// process response
|
||||
return i2p::util::http::GetHttpContent (rs);
|
||||
}
|
||||
else
|
||||
LogPrint (eLogError, "SSL handshake failed: ", ecode.message ());
|
||||
}
|
||||
else
|
||||
LogPrint (eLogError, "Couldn't connect to ", u.host_, ": ", ecode.message ());
|
||||
}
|
||||
else
|
||||
return "";
|
||||
LogPrint (eLogError, "Couldn't resolve address ", u.host_, ": ", ecode.message ());
|
||||
return "";
|
||||
}
|
||||
|
||||
//-------------------------------------------------------------
|
||||
|
||||
template<class Hash>
|
||||
class TlsCipherMAC: public TlsCipher
|
||||
{
|
||||
public:
|
||||
|
||||
TlsCipherMAC (const uint8_t * keys): m_Seqn (0)
|
||||
{
|
||||
memcpy (m_MacKey, keys, Hash::DIGESTSIZE);
|
||||
}
|
||||
|
||||
void CalculateMAC (uint8_t type, const uint8_t * buf, size_t len, uint8_t * mac)
|
||||
{
|
||||
uint8_t header[13]; // seqn (8) + type (1) + version (2) + length (2)
|
||||
htobe64buf (header, m_Seqn);
|
||||
header[8] = type; header[9] = 3; header[10] = 3; // 3,3 means TLS 1.2
|
||||
htobe16buf (header + 11, len);
|
||||
CryptoPP::HMAC<Hash> hmac (m_MacKey, Hash::DIGESTSIZE);
|
||||
hmac.Update (header, 13);
|
||||
hmac.Update (buf, len);
|
||||
hmac.Final (mac);
|
||||
m_Seqn++;
|
||||
}
|
||||
|
||||
private:
|
||||
|
||||
uint64_t m_Seqn;
|
||||
uint8_t m_MacKey[Hash::DIGESTSIZE]; // client
|
||||
};
|
||||
|
||||
template<class Hash>
|
||||
class TlsCipher_AES_256_CBC: public TlsCipherMAC<Hash>
|
||||
{
|
||||
public:
|
||||
|
||||
TlsCipher_AES_256_CBC (const uint8_t * keys): TlsCipherMAC<Hash> (keys)
|
||||
{
|
||||
m_Encryption.SetKey (keys + 2*Hash::DIGESTSIZE);
|
||||
m_Decryption.SetKey (keys + 2*Hash::DIGESTSIZE + 32);
|
||||
}
|
||||
|
||||
size_t Encrypt (const uint8_t * in, size_t len, const uint8_t * mac, uint8_t * out)
|
||||
{
|
||||
size_t size = 0;
|
||||
m_Rnd.GenerateBlock (out, 16); // iv
|
||||
size += 16;
|
||||
m_Encryption.SetIV (out);
|
||||
memcpy (out + size, in, len);
|
||||
size += len;
|
||||
memcpy (out + size, mac, Hash::DIGESTSIZE);
|
||||
size += Hash::DIGESTSIZE;
|
||||
uint8_t paddingSize = size + 1;
|
||||
paddingSize &= 0x0F; // %16
|
||||
if (paddingSize > 0) paddingSize = 16 - paddingSize;
|
||||
memset (out + size, paddingSize, paddingSize + 1); // paddind and last byte are equal to padding size
|
||||
size += paddingSize + 1;
|
||||
m_Encryption.Encrypt (out + 16, size - 16, out + 16);
|
||||
return size;
|
||||
}
|
||||
|
||||
size_t Decrypt (uint8_t * buf, size_t len) // payload is buf + 16
|
||||
{
|
||||
m_Decryption.SetIV (buf);
|
||||
m_Decryption.Decrypt (buf + 16, len - 16, buf + 16);
|
||||
return len - 16 - Hash::DIGESTSIZE - buf[len -1] - 1; // IV(16), mac(32 or 20) and padding
|
||||
}
|
||||
|
||||
size_t GetIVSize () const { return 16; };
|
||||
|
||||
private:
|
||||
|
||||
CryptoPP::AutoSeededRandomPool m_Rnd;
|
||||
i2p::crypto::CBCEncryption m_Encryption;
|
||||
i2p::crypto::CBCDecryption m_Decryption;
|
||||
};
|
||||
|
||||
|
||||
class TlsCipher_RC4_SHA: public TlsCipherMAC<CryptoPP::SHA1>
|
||||
{
|
||||
public:
|
||||
|
||||
TlsCipher_RC4_SHA (const uint8_t * keys): TlsCipherMAC (keys)
|
||||
{
|
||||
m_Encryption.SetKey (keys + 40, 16); // 20 + 20
|
||||
m_Decryption.SetKey (keys + 56, 16); // 20 + 20 + 16
|
||||
}
|
||||
|
||||
size_t Encrypt (const uint8_t * in, size_t len, const uint8_t * mac, uint8_t * out)
|
||||
{
|
||||
memcpy (out, in, len);
|
||||
memcpy (out + len, mac, 20);
|
||||
m_Encryption.ProcessData (out, out, len + 20);
|
||||
return len + 20;
|
||||
}
|
||||
|
||||
size_t Decrypt (uint8_t * buf, size_t len)
|
||||
{
|
||||
m_Decryption.ProcessData (buf, buf, len);
|
||||
return len - 20;
|
||||
}
|
||||
|
||||
private:
|
||||
|
||||
CryptoPP::Weak1::ARC4 m_Encryption, m_Decryption;
|
||||
};
|
||||
|
||||
|
||||
TlsSession::TlsSession (const std::string& host, int port):
|
||||
m_IsEstablished (false), m_Cipher (nullptr)
|
||||
{
|
||||
m_Site.connect(host, boost::lexical_cast<std::string>(port));
|
||||
if (m_Site.good ())
|
||||
Handshake ();
|
||||
else
|
||||
LogPrint (eLogError, "Can't connect to ", host, ":", port);
|
||||
}
|
||||
|
||||
TlsSession::~TlsSession ()
|
||||
{
|
||||
delete m_Cipher;
|
||||
}
|
||||
|
||||
void TlsSession::Handshake ()
|
||||
{
|
||||
static uint8_t clientHello[] =
|
||||
{
|
||||
0x16, // handshake
|
||||
0x03, 0x03, // version (TLS 1.2)
|
||||
0x00, 0x33, // length of handshake
|
||||
// handshake
|
||||
0x01, // handshake type (client hello)
|
||||
0x00, 0x00, 0x2F, // length of handshake payload
|
||||
// client hello
|
||||
0x03, 0x03, // highest version supported (TLS 1.2)
|
||||
0x45, 0xFA, 0x01, 0x19, 0x74, 0x55, 0x18, 0x36,
|
||||
0x42, 0x05, 0xC1, 0xDD, 0x4A, 0x21, 0x80, 0x80,
|
||||
0xEC, 0x37, 0x11, 0x93, 0x16, 0xF4, 0x66, 0x00,
|
||||
0x12, 0x67, 0xAB, 0xBA, 0xFF, 0x29, 0x13, 0x9E, // 32 random bytes
|
||||
0x00, // session id length
|
||||
0x00, 0x06, // chiper suites length
|
||||
0x00, 0x3D, // RSA_WITH_AES_256_CBC_SHA256
|
||||
0x00, 0x35, // RSA_WITH_AES_256_CBC_SHA
|
||||
0x00, 0x05, // RSA_WITH_RC4_128_SHA
|
||||
0x01, // compression methods length
|
||||
0x00, // no compression
|
||||
0x00, 0x00 // extensions length
|
||||
};
|
||||
|
||||
static uint8_t changeCipherSpecs[] =
|
||||
{
|
||||
0x14, // change cipher specs
|
||||
0x03, 0x03, // version (TLS 1.2)
|
||||
0x00, 0x01, // length
|
||||
0x01 // type
|
||||
};
|
||||
|
||||
// send ClientHello
|
||||
m_Site.write ((char *)clientHello, sizeof (clientHello));
|
||||
m_FinishedHash.Update (clientHello + 5, sizeof (clientHello) - 5);
|
||||
// read ServerHello
|
||||
uint8_t type;
|
||||
m_Site.read ((char *)&type, 1);
|
||||
uint16_t version;
|
||||
m_Site.read ((char *)&version, 2);
|
||||
uint16_t length;
|
||||
m_Site.read ((char *)&length, 2);
|
||||
length = be16toh (length);
|
||||
char * serverHello = new char[length];
|
||||
m_Site.read (serverHello, length);
|
||||
m_FinishedHash.Update ((uint8_t *)serverHello, length);
|
||||
uint8_t serverRandom[32];
|
||||
if (serverHello[0] == 0x02) // handshake type server hello
|
||||
memcpy (serverRandom, serverHello + 6, 32);
|
||||
else
|
||||
LogPrint (eLogError, "Unexpected handshake type ", (int)serverHello[0]);
|
||||
uint8_t sessionIDLen = serverHello[38]; // 6 + 32
|
||||
char * cipherSuite = serverHello + 39 + sessionIDLen;
|
||||
if (cipherSuite[1] == 0x3D || cipherSuite[1] == 0x35 || cipherSuite[1] == 0x05)
|
||||
m_IsEstablished = true;
|
||||
else
|
||||
LogPrint (eLogError, "Unsupported cipher ", (int)cipherSuite[0], ",", (int)cipherSuite[1]);
|
||||
// read Certificate
|
||||
m_Site.read ((char *)&type, 1);
|
||||
m_Site.read ((char *)&version, 2);
|
||||
m_Site.read ((char *)&length, 2);
|
||||
length = be16toh (length);
|
||||
char * certificate = new char[length];
|
||||
m_Site.read (certificate, length);
|
||||
m_FinishedHash.Update ((uint8_t *)certificate, length);
|
||||
CryptoPP::RSA::PublicKey publicKey;
|
||||
// 0 - handshake type
|
||||
// 1 - 3 - handshake payload length
|
||||
// 4 - 6 - length of array of certificates
|
||||
// 7 - 9 - length of certificate
|
||||
if (certificate[0] == 0x0B) // handshake type certificate
|
||||
publicKey = ExtractPublicKey ((uint8_t *)certificate + 10, length - 10);
|
||||
else
|
||||
LogPrint (eLogError, "Unexpected handshake type ", (int)certificate[0]);
|
||||
// read ServerHelloDone
|
||||
m_Site.read ((char *)&type, 1);
|
||||
m_Site.read ((char *)&version, 2);
|
||||
m_Site.read ((char *)&length, 2);
|
||||
length = be16toh (length);
|
||||
char * serverHelloDone = new char[length];
|
||||
m_Site.read (serverHelloDone, length);
|
||||
m_FinishedHash.Update ((uint8_t *)serverHelloDone, length);
|
||||
if (serverHelloDone[0] != 0x0E) // handshake type hello done
|
||||
LogPrint (eLogError, "Unexpected handshake type ", (int)serverHelloDone[0]);
|
||||
// our turn now
|
||||
// generate secret key
|
||||
uint8_t secret[48];
|
||||
secret[0] = 3; secret[1] = 3; // version
|
||||
CryptoPP::AutoSeededRandomPool rnd;
|
||||
rnd.GenerateBlock (secret + 2, 46); // 46 random bytes
|
||||
// encrypt RSA
|
||||
CryptoPP::RSAES_PKCS1v15_Encryptor encryptor(publicKey);
|
||||
size_t encryptedLen = encryptor.CiphertextLength (48); // number of bytes for encrypted 48 bytes, usually 256 (2048 bits key)
|
||||
uint8_t * encrypted = new uint8_t[encryptedLen + 2]; // + 2 bytes for length
|
||||
htobe16buf (encrypted, encryptedLen); // first two bytes means length
|
||||
encryptor.Encrypt (rnd, secret, 48, encrypted + 2);
|
||||
// send ClientKeyExchange
|
||||
// 0x10 - handshake type "client key exchange"
|
||||
SendHandshakeMsg (0x10, encrypted, encryptedLen + 2);
|
||||
delete[] encrypted;
|
||||
// send ChangeCipherSpecs
|
||||
m_Site.write ((char *)changeCipherSpecs, sizeof (changeCipherSpecs));
|
||||
// calculate master secret
|
||||
uint8_t random[64];
|
||||
memcpy (random, clientHello + 11, 32);
|
||||
memcpy (random + 32, serverRandom, 32);
|
||||
PRF (secret, "master secret", random, 64, 48, m_MasterSecret);
|
||||
// create keys
|
||||
memcpy (random, serverRandom, 32);
|
||||
memcpy (random + 32, clientHello + 11, 32);
|
||||
uint8_t keys[128]; // clientMACKey(32 or 20), serverMACKey(32 or 20), clientKey(32), serverKey(32)
|
||||
PRF (m_MasterSecret, "key expansion", random, 64, 128, keys);
|
||||
// create cipher
|
||||
if (cipherSuite[1] == 0x3D)
|
||||
{
|
||||
LogPrint (eLogInfo, "Chiper suite is RSA_WITH_AES_256_CBC_SHA256");
|
||||
m_Cipher = new TlsCipher_AES_256_CBC<CryptoPP::SHA256> (keys);
|
||||
}
|
||||
else if (cipherSuite[1] == 0x35)
|
||||
{
|
||||
LogPrint (eLogInfo, "Chiper suite is RSA_WITH_AES_256_CBC_SHA");
|
||||
m_Cipher = new TlsCipher_AES_256_CBC<CryptoPP::SHA1> (keys);
|
||||
}
|
||||
else
|
||||
{
|
||||
// TODO:
|
||||
if (cipherSuite[1] == 0x05)
|
||||
LogPrint (eLogInfo, "Chiper suite is RSA_WITH_RC4_128_SHA");
|
||||
m_Cipher = new TlsCipher_RC4_SHA (keys);
|
||||
}
|
||||
// send finished
|
||||
SendFinishedMsg ();
|
||||
// read ChangeCipherSpecs
|
||||
uint8_t changeCipherSpecs1[6];
|
||||
m_Site.read ((char *)changeCipherSpecs1, 6);
|
||||
// read finished
|
||||
m_Site.read ((char *)&type, 1);
|
||||
m_Site.read ((char *)&version, 2);
|
||||
m_Site.read ((char *)&length, 2);
|
||||
length = be16toh (length);
|
||||
char * finished1 = new char[length];
|
||||
m_Site.read (finished1, length);
|
||||
m_Cipher->Decrypt ((uint8_t *)finished1, length); // for streaming ciphers
|
||||
delete[] finished1;
|
||||
|
||||
delete[] serverHello;
|
||||
delete[] certificate;
|
||||
delete[] serverHelloDone;
|
||||
}
|
||||
|
||||
void TlsSession::SendHandshakeMsg (uint8_t handshakeType, uint8_t * data, size_t len)
|
||||
{
|
||||
uint8_t handshakeHeader[9];
|
||||
handshakeHeader[0] = 0x16; // handshake
|
||||
handshakeHeader[1] = 0x03; handshakeHeader[2] = 0x03; // version is always TLS 1.2 (3,3)
|
||||
htobe16buf (handshakeHeader + 3, len + 4); // length of payload
|
||||
//payload starts
|
||||
handshakeHeader[5] = handshakeType; // handshake type
|
||||
handshakeHeader[6] = 0; // highest byte of payload length is always zero
|
||||
htobe16buf (handshakeHeader + 7, len); // length of data
|
||||
m_Site.write ((char *)handshakeHeader, 9);
|
||||
m_FinishedHash.Update (handshakeHeader + 5, 4); // only payload counts
|
||||
m_Site.write ((char *)data, len);
|
||||
m_FinishedHash.Update (data, len);
|
||||
}
|
||||
|
||||
void TlsSession::SendFinishedMsg ()
|
||||
{
|
||||
// 0x16 handshake
|
||||
// 0x03, 0x03 version (TLS 1.2)
|
||||
// 2 bytes length of handshake (80 or 64 bytes)
|
||||
// handshake (encrypted)
|
||||
// unencrypted context
|
||||
// 0x14 handshake type (finished)
|
||||
// 0x00, 0x00, 0x0C length of handshake payload
|
||||
// 12 bytes of verified data
|
||||
|
||||
uint8_t finishedHashDigest[32], finishedPayload[40], encryptedPayload[80];
|
||||
finishedPayload[0] = 0x14; // handshake type (finished)
|
||||
finishedPayload[1] = 0; finishedPayload[2] = 0; finishedPayload[3] = 0x0C; // 12 bytes
|
||||
m_FinishedHash.Final (finishedHashDigest);
|
||||
PRF (m_MasterSecret, "client finished", finishedHashDigest, 32, 12, finishedPayload + 4);
|
||||
uint8_t mac[32];
|
||||
m_Cipher->CalculateMAC (0x16, finishedPayload, 16, mac);
|
||||
size_t encryptedPayloadSize = m_Cipher->Encrypt (finishedPayload, 16, mac, encryptedPayload);
|
||||
uint8_t finished[5];
|
||||
finished[0] = 0x16; // handshake
|
||||
finished[1] = 0x03; finished[2] = 0x03; // version is always TLS 1.2 (3,3)
|
||||
htobe16buf (finished + 3, encryptedPayloadSize); // length of payload
|
||||
m_Site.write ((char *)finished, sizeof (finished));
|
||||
m_Site.write ((char *)encryptedPayload, encryptedPayloadSize);
|
||||
}
|
||||
|
||||
void TlsSession::PRF (const uint8_t * secret, const char * label, const uint8_t * random, size_t randomLen,
|
||||
size_t len, uint8_t * buf)
|
||||
{
|
||||
// secret is assumed 48 bytes
|
||||
// random is not more than 64 bytes
|
||||
CryptoPP::HMAC<CryptoPP::SHA256> hmac (secret, 48);
|
||||
uint8_t seed[96]; size_t seedLen;
|
||||
seedLen = strlen (label);
|
||||
memcpy (seed, label, seedLen);
|
||||
memcpy (seed + seedLen, random, randomLen);
|
||||
seedLen += randomLen;
|
||||
|
||||
size_t offset = 0;
|
||||
uint8_t a[128];
|
||||
hmac.CalculateDigest (a, seed, seedLen);
|
||||
while (offset < len)
|
||||
{
|
||||
memcpy (a + 32, seed, seedLen);
|
||||
hmac.CalculateDigest (buf + offset, a, seedLen + 32);
|
||||
offset += 32;
|
||||
hmac.CalculateDigest (a, a, 32);
|
||||
}
|
||||
}
|
||||
|
||||
CryptoPP::RSA::PublicKey TlsSession::ExtractPublicKey (const uint8_t * certificate, size_t len)
|
||||
{
|
||||
CryptoPP::ByteQueue queue;
|
||||
queue.Put (certificate, len);
|
||||
queue.MessageEnd ();
|
||||
// extract X.509
|
||||
CryptoPP::BERSequenceDecoder x509Cert (queue);
|
||||
CryptoPP::BERSequenceDecoder tbsCert (x509Cert);
|
||||
// version
|
||||
uint32_t ver;
|
||||
CryptoPP::BERGeneralDecoder context (tbsCert, CryptoPP::CONTEXT_SPECIFIC | CryptoPP::CONSTRUCTED);
|
||||
CryptoPP::BERDecodeUnsigned<uint32_t>(context, ver, CryptoPP::INTEGER);
|
||||
// serial
|
||||
CryptoPP::Integer serial;
|
||||
serial.BERDecode(tbsCert);
|
||||
// signature
|
||||
CryptoPP::BERSequenceDecoder signature (tbsCert);
|
||||
signature.SkipAll();
|
||||
// issuer
|
||||
CryptoPP::BERSequenceDecoder issuer (tbsCert);
|
||||
issuer.SkipAll();
|
||||
// validity
|
||||
CryptoPP::BERSequenceDecoder validity (tbsCert);
|
||||
validity.SkipAll();
|
||||
// subject
|
||||
CryptoPP::BERSequenceDecoder subject (tbsCert);
|
||||
subject.SkipAll();
|
||||
// public key
|
||||
CryptoPP::BERSequenceDecoder publicKey (tbsCert);
|
||||
CryptoPP::BERSequenceDecoder ident (publicKey);
|
||||
ident.SkipAll ();
|
||||
CryptoPP::BERGeneralDecoder key (publicKey, CryptoPP::BIT_STRING);
|
||||
key.Skip (1); // FIXME: probably bug in crypto++
|
||||
CryptoPP::BERSequenceDecoder keyPair (key);
|
||||
CryptoPP::Integer n, e;
|
||||
n.BERDecode (keyPair);
|
||||
e.BERDecode (keyPair);
|
||||
|
||||
CryptoPP::RSA::PublicKey ret;
|
||||
ret.Initialize (n, e);
|
||||
return ret;
|
||||
}
|
||||
|
||||
void TlsSession::Send (const uint8_t * buf, size_t len)
|
||||
{
|
||||
uint8_t * out = new uint8_t[len + 64 + 5]; // 64 = 32 mac + 16 iv + upto 16 padding, 5 = header
|
||||
out[0] = 0x17; // application data
|
||||
out[1] = 0x03; out[2] = 0x03; // version
|
||||
uint8_t mac[32];
|
||||
m_Cipher->CalculateMAC (0x17, buf, len, mac);
|
||||
size_t encryptedLen = m_Cipher->Encrypt (buf, len, mac, out + 5);
|
||||
htobe16buf (out + 3, encryptedLen);
|
||||
m_Site.write ((char *)out, encryptedLen + 5);
|
||||
delete[] out;
|
||||
}
|
||||
|
||||
bool TlsSession::Receive (std::ostream& rs)
|
||||
{
|
||||
if (m_Site.eof ()) return false;
|
||||
uint8_t type; uint16_t version, length;
|
||||
m_Site.read ((char *)&type, 1);
|
||||
m_Site.read ((char *)&version, 2);
|
||||
m_Site.read ((char *)&length, 2);
|
||||
length = be16toh (length);
|
||||
uint8_t * buf = new uint8_t[length];
|
||||
m_Site.read ((char *)buf, length);
|
||||
size_t decryptedLen = m_Cipher->Decrypt (buf, length);
|
||||
rs.write ((char *)buf + m_Cipher->GetIVSize (), decryptedLen);
|
||||
delete[] buf;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue