mirror of
https://github.com/PurpleI2P/i2pd.git
synced 2025-04-27 11:17:49 +02:00
Merge remote-tracking branch 'purple/openssl'
This commit is contained in:
commit
fa154cc4d6
29 changed files with 267 additions and 211 deletions
|
@ -210,6 +210,21 @@ namespace data
|
|||
return 4*d.quot;
|
||||
}
|
||||
|
||||
std::string ToBase64Standard (const std::string& in)
|
||||
{
|
||||
auto len = Base64EncodingBufferSize (in.length ());
|
||||
char * str = new char[len+1];
|
||||
auto l = ByteStreamToBase64 ((const uint8_t *)in.c_str (), in.length (), str, len);
|
||||
str[l] = 0;
|
||||
// replace '-' by '+' and '~' by '/'
|
||||
for (size_t i = 0; i < l; i++)
|
||||
if (str[i] == '-') str[i] = '+';
|
||||
else if (str[i] == '~') str[i] = '/';
|
||||
std::string s(str);
|
||||
delete[] str;
|
||||
return s;
|
||||
}
|
||||
|
||||
/*
|
||||
*
|
||||
* iT64
|
||||
|
|
|
@ -15,10 +15,13 @@ namespace data {
|
|||
size_t Base32ToByteStream (const char * inBuf, size_t len, uint8_t * outBuf, size_t outLen);
|
||||
size_t ByteStreamToBase32 (const uint8_t * InBuf, size_t len, char * outBuf, size_t outLen);
|
||||
|
||||
/**
|
||||
/**
|
||||
Compute the size for a buffer to contain encoded base64 given that the size of the input is input_size bytes
|
||||
*/
|
||||
size_t Base64EncodingBufferSize(const size_t input_size);
|
||||
*/
|
||||
size_t Base64EncodingBufferSize(const size_t input_size);
|
||||
|
||||
std::string ToBase64Standard (const std::string& in); // using standard table, for Proxy-Authorization
|
||||
|
||||
} // data
|
||||
} // i2p
|
||||
|
||||
|
|
|
@ -191,7 +191,7 @@ namespace config {
|
|||
// "https://uk.reseed.i2p2.no:444/," // mamoth's shit
|
||||
"https://i2p-0.manas.ca:8443/,"
|
||||
"https://download.xxlspeed.com/,"
|
||||
"https://reseed-ru.lngserv.ru/,"
|
||||
"https://reseed-fr.i2pd.xyz/,"
|
||||
"https://reseed.atomike.ninja/,"
|
||||
"https://reseed.memcpy.io/,"
|
||||
"https://reseed.onion.im/,"
|
||||
|
|
|
@ -12,9 +12,9 @@ namespace crypto
|
|||
memcpy (m_PublicKey, pub, 256);
|
||||
}
|
||||
|
||||
void ElGamalEncryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx)
|
||||
void ElGamalEncryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding)
|
||||
{
|
||||
ElGamalEncrypt (m_PublicKey, data, encrypted, ctx, true);
|
||||
ElGamalEncrypt (m_PublicKey, data, encrypted, ctx, zeroPadding);
|
||||
}
|
||||
|
||||
ElGamalDecryptor::ElGamalDecryptor (const uint8_t * priv)
|
||||
|
@ -22,9 +22,9 @@ namespace crypto
|
|||
memcpy (m_PrivateKey, priv, 256);
|
||||
}
|
||||
|
||||
bool ElGamalDecryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx)
|
||||
bool ElGamalDecryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding)
|
||||
{
|
||||
return ElGamalDecrypt (m_PrivateKey, encrypted, data, ctx, true);
|
||||
return ElGamalDecrypt (m_PrivateKey, encrypted, data, ctx, zeroPadding);
|
||||
}
|
||||
|
||||
ECIESP256Encryptor::ECIESP256Encryptor (const uint8_t * pub)
|
||||
|
@ -44,10 +44,10 @@ namespace crypto
|
|||
if (m_PublicKey) EC_POINT_free (m_PublicKey);
|
||||
}
|
||||
|
||||
void ECIESP256Encryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx)
|
||||
void ECIESP256Encryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding)
|
||||
{
|
||||
if (m_Curve && m_PublicKey)
|
||||
ECIESEncrypt (m_Curve, m_PublicKey, data, encrypted, ctx, true);
|
||||
ECIESEncrypt (m_Curve, m_PublicKey, data, encrypted, ctx, zeroPadding);
|
||||
}
|
||||
|
||||
ECIESP256Decryptor::ECIESP256Decryptor (const uint8_t * priv)
|
||||
|
@ -62,10 +62,10 @@ namespace crypto
|
|||
if (m_PrivateKey) BN_free (m_PrivateKey);
|
||||
}
|
||||
|
||||
bool ECIESP256Decryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx)
|
||||
bool ECIESP256Decryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding)
|
||||
{
|
||||
if (m_Curve && m_PrivateKey)
|
||||
return ECIESDecrypt (m_Curve, m_PrivateKey, encrypted, data, ctx, true);
|
||||
return ECIESDecrypt (m_Curve, m_PrivateKey, encrypted, data, ctx, zeroPadding);
|
||||
return false;
|
||||
}
|
||||
|
||||
|
@ -104,10 +104,10 @@ namespace crypto
|
|||
if (m_PublicKey) EC_POINT_free (m_PublicKey);
|
||||
}
|
||||
|
||||
void ECIESGOSTR3410Encryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx)
|
||||
void ECIESGOSTR3410Encryptor::Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding)
|
||||
{
|
||||
if (m_PublicKey)
|
||||
ECIESEncrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PublicKey, data, encrypted, ctx, true);
|
||||
ECIESEncrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PublicKey, data, encrypted, ctx, zeroPadding);
|
||||
}
|
||||
|
||||
ECIESGOSTR3410Decryptor::ECIESGOSTR3410Decryptor (const uint8_t * priv)
|
||||
|
@ -120,10 +120,10 @@ namespace crypto
|
|||
if (m_PrivateKey) BN_free (m_PrivateKey);
|
||||
}
|
||||
|
||||
bool ECIESGOSTR3410Decryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx)
|
||||
bool ECIESGOSTR3410Decryptor::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding)
|
||||
{
|
||||
if (m_PrivateKey)
|
||||
return ECIESDecrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PrivateKey, encrypted, data, ctx, true);
|
||||
return ECIESDecrypt (GetGOSTR3410Curve (eGOSTR3410CryptoProA)->GetGroup (), m_PrivateKey, encrypted, data, ctx, zeroPadding);
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
|
@ -13,7 +13,7 @@ namespace crypto
|
|||
public:
|
||||
|
||||
virtual ~CryptoKeyEncryptor () {};
|
||||
virtual void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx) = 0; // 222 bytes data, 512 bytes encrypted
|
||||
virtual void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding) = 0; // 222 bytes data, 512/514 bytes encrypted
|
||||
};
|
||||
|
||||
class CryptoKeyDecryptor
|
||||
|
@ -21,7 +21,7 @@ namespace crypto
|
|||
public:
|
||||
|
||||
virtual ~CryptoKeyDecryptor () {};
|
||||
virtual bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx) = 0; // 512 bytes encrypted, 222 bytes data
|
||||
virtual bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding) = 0; // 512/514 bytes encrypted, 222 bytes data
|
||||
};
|
||||
|
||||
// ElGamal
|
||||
|
@ -30,7 +30,7 @@ namespace crypto
|
|||
public:
|
||||
|
||||
ElGamalEncryptor (const uint8_t * pub);
|
||||
void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx);
|
||||
void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding);
|
||||
|
||||
private:
|
||||
|
||||
|
@ -42,7 +42,7 @@ namespace crypto
|
|||
public:
|
||||
|
||||
ElGamalDecryptor (const uint8_t * priv);
|
||||
bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx);
|
||||
bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding);
|
||||
|
||||
private:
|
||||
|
||||
|
@ -57,7 +57,7 @@ namespace crypto
|
|||
|
||||
ECIESP256Encryptor (const uint8_t * pub);
|
||||
~ECIESP256Encryptor ();
|
||||
void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx);
|
||||
void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding);
|
||||
|
||||
private:
|
||||
|
||||
|
@ -72,7 +72,7 @@ namespace crypto
|
|||
|
||||
ECIESP256Decryptor (const uint8_t * priv);
|
||||
~ECIESP256Decryptor ();
|
||||
bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx);
|
||||
bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding);
|
||||
|
||||
private:
|
||||
|
||||
|
@ -90,7 +90,7 @@ namespace crypto
|
|||
|
||||
ECIESGOSTR3410Encryptor (const uint8_t * pub);
|
||||
~ECIESGOSTR3410Encryptor ();
|
||||
void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx);
|
||||
void Encrypt (const uint8_t * data, uint8_t * encrypted, BN_CTX * ctx, bool zeroPadding);
|
||||
|
||||
private:
|
||||
|
||||
|
@ -104,7 +104,7 @@ namespace crypto
|
|||
|
||||
ECIESGOSTR3410Decryptor (const uint8_t * priv);
|
||||
~ECIESGOSTR3410Decryptor ();
|
||||
bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx);
|
||||
bool Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx, bool zeroPadding);
|
||||
|
||||
private:
|
||||
|
||||
|
|
|
@ -281,8 +281,12 @@ namespace client
|
|||
i2p::garlic::GarlicDestination::SetLeaseSetUpdated ();
|
||||
if (m_IsPublic)
|
||||
{
|
||||
m_PublishVerificationTimer.cancel ();
|
||||
Publish ();
|
||||
auto s = shared_from_this ();
|
||||
m_Service.post ([s](void)
|
||||
{
|
||||
s->m_PublishVerificationTimer.cancel ();
|
||||
s->Publish ();
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -1024,7 +1028,7 @@ namespace client
|
|||
bool ClientDestination::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx) const
|
||||
{
|
||||
if (m_Decryptor)
|
||||
return m_Decryptor->Decrypt (encrypted, data, ctx);
|
||||
return m_Decryptor->Decrypt (encrypted, data, ctx, true);
|
||||
else
|
||||
LogPrint (eLogError, "Destinations: decryptor is not set");
|
||||
return false;
|
||||
|
|
|
@ -327,7 +327,7 @@ namespace i2p
|
|||
{
|
||||
LogPrint (eLogDebug, "I2NP: Build request record ", i, " is ours");
|
||||
BN_CTX * ctx = BN_CTX_new ();
|
||||
i2p::crypto::ElGamalDecrypt (i2p::context.GetPrivateKeys ().GetPrivateKey () , record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText, ctx);
|
||||
i2p::context.DecryptTunnelBuildRecord (record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, clearText, ctx);
|
||||
BN_CTX_free (ctx);
|
||||
// replace record to reply
|
||||
if (i2p::context.AcceptsTunnels () &&
|
||||
|
|
|
@ -212,7 +212,7 @@ namespace data
|
|||
{
|
||||
auto encryptor = m_Identity->CreateEncryptor (m_EncryptionKey);
|
||||
if (encryptor)
|
||||
encryptor->Encrypt (data, encrypted, ctx);
|
||||
encryptor->Encrypt (data, encrypted, ctx, true);
|
||||
}
|
||||
|
||||
LocalLeaseSet::LocalLeaseSet (std::shared_ptr<const IdentityEx> identity, const uint8_t * encryptionPublicKey, std::vector<std::shared_ptr<i2p::tunnel::InboundTunnel> > tunnels):
|
||||
|
|
|
@ -24,6 +24,12 @@ namespace i2p
|
|||
{
|
||||
namespace transport
|
||||
{
|
||||
|
||||
struct NTCPWork
|
||||
{
|
||||
std::shared_ptr<NTCPSession> session;
|
||||
};
|
||||
|
||||
NTCPSession::NTCPSession (NTCPServer& server, std::shared_ptr<const i2p::data::RouterInfo> in_RemoteRouter):
|
||||
TransportSession (in_RemoteRouter, NTCP_ESTABLISH_TIMEOUT),
|
||||
m_Server (server), m_Socket (m_Server.GetService ()),
|
||||
|
@ -177,18 +183,20 @@ namespace transport
|
|||
}
|
||||
}
|
||||
// TODO: check for number of pending keys
|
||||
auto s = shared_from_this ();
|
||||
m_Server.Work(s, [s]() -> std::function<void(void)> {
|
||||
if (!s->m_DHKeysPair)
|
||||
s->m_DHKeysPair = transports.GetNextDHKeysPair ();
|
||||
s->CreateAESKey (s->m_Establisher->phase1.pubKey);
|
||||
return std::bind(&NTCPSession::SendPhase2, s);
|
||||
auto work = new NTCPWork{shared_from_this()};
|
||||
m_Server.Work(work->session, [work, this]() -> std::function<void(void)> {
|
||||
if (!work->session->m_DHKeysPair)
|
||||
work->session->m_DHKeysPair = transports.GetNextDHKeysPair ();
|
||||
work->session->CreateAESKey (work->session->m_Establisher->phase1.pubKey);
|
||||
return std::bind(&NTCPSession::SendPhase2, work->session, work);
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
void NTCPSession::SendPhase2 ()
|
||||
void NTCPSession::SendPhase2 (NTCPWork * work)
|
||||
{
|
||||
if(work)
|
||||
delete work;
|
||||
const uint8_t * y = m_DHKeysPair->GetPublicKey ();
|
||||
memcpy (m_Establisher->phase2.pubKey, y, 256);
|
||||
uint8_t xy[512];
|
||||
|
@ -241,16 +249,17 @@ namespace transport
|
|||
}
|
||||
else
|
||||
{
|
||||
auto s = shared_from_this ();
|
||||
m_Server.Work(s, [s]() -> std::function<void(void)> {
|
||||
s->CreateAESKey (s->m_Establisher->phase2.pubKey);
|
||||
return std::bind(&NTCPSession::HandlePhase2, s);
|
||||
auto work = new NTCPWork{shared_from_this()};
|
||||
m_Server.Work(work->session, [work, this]() -> std::function<void(void)> {
|
||||
work->session->CreateAESKey (work->session->m_Establisher->phase2.pubKey);
|
||||
return std::bind(&NTCPSession::HandlePhase2, work->session, work);
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
void NTCPSession::HandlePhase2 ()
|
||||
void NTCPSession::HandlePhase2 (NTCPWork * work)
|
||||
{
|
||||
if(work) delete work;
|
||||
m_Decryption.SetIV (m_Establisher->phase2.pubKey + 240);
|
||||
m_Encryption.SetIV (m_Establisher->phase1.HXxorHI + 16);
|
||||
|
||||
|
|
|
@ -35,6 +35,8 @@ namespace transport
|
|||
} encrypted;
|
||||
};
|
||||
|
||||
struct NTCPWork;
|
||||
|
||||
const size_t NTCP_MAX_MESSAGE_SIZE = 16384;
|
||||
const size_t NTCP_BUFFER_SIZE = 1028; // fits 1 tunnel data message
|
||||
const int NTCP_CONNECT_TIMEOUT = 5; // 5 seconds
|
||||
|
@ -77,12 +79,12 @@ namespace transport
|
|||
void SendPhase3 ();
|
||||
void HandlePhase1Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred);
|
||||
void HandlePhase2Received (const boost::system::error_code& ecode, std::size_t bytes_transferred);
|
||||
void HandlePhase2 ();
|
||||
void HandlePhase2 (NTCPWork * work=nullptr);
|
||||
void HandlePhase3Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsA);
|
||||
void HandlePhase4Received (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsA);
|
||||
|
||||
//server
|
||||
void SendPhase2 ();
|
||||
void SendPhase2 (NTCPWork * work=nullptr);
|
||||
void SendPhase4 (uint32_t tsA, uint32_t tsB);
|
||||
void HandlePhase1Received (const boost::system::error_code& ecode, std::size_t bytes_transferred);
|
||||
void HandlePhase2Sent (const boost::system::error_code& ecode, std::size_t bytes_transferred, uint32_t tsB);
|
||||
|
|
|
@ -34,11 +34,7 @@ namespace i2p
|
|||
|
||||
void RouterContext::CreateNewRouter ()
|
||||
{
|
||||
#if defined(__x86_64__) || defined(__i386__) || defined(_MSC_VER)
|
||||
m_Keys = i2p::data::PrivateKeys::CreateRandomKeys (i2p::data::SIGNING_KEY_TYPE_EDDSA_SHA512_ED25519);
|
||||
#else
|
||||
m_Keys = i2p::data::PrivateKeys::CreateRandomKeys (i2p::data::SIGNING_KEY_TYPE_DSA_SHA1);
|
||||
#endif
|
||||
SaveKeys ();
|
||||
NewRouterInfo ();
|
||||
}
|
||||
|
@ -482,6 +478,11 @@ namespace i2p
|
|||
|
||||
bool RouterContext::Decrypt (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx) const
|
||||
{
|
||||
return m_Decryptor ? m_Decryptor->Decrypt (encrypted, data, ctx) : false;
|
||||
return m_Decryptor ? m_Decryptor->Decrypt (encrypted, data, ctx, true) : false;
|
||||
}
|
||||
|
||||
bool RouterContext::DecryptTunnelBuildRecord (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx) const
|
||||
{
|
||||
return m_Decryptor ? m_Decryptor->Decrypt (encrypted, data, ctx, false) : false;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -61,6 +61,7 @@ namespace i2p
|
|||
void SetError (RouterError error) { m_Status = eRouterStatusError; m_Error = error; };
|
||||
int GetNetID () const { return m_NetID; };
|
||||
void SetNetID (int netID) { m_NetID = netID; };
|
||||
bool DecryptTunnelBuildRecord (const uint8_t * encrypted, uint8_t * data, BN_CTX * ctx) const;
|
||||
|
||||
void UpdatePort (int port); // called from Daemon
|
||||
void UpdateAddress (const boost::asio::ip::address& host); // called from SSU or Daemon
|
||||
|
|
|
@ -840,7 +840,7 @@ namespace data
|
|||
{
|
||||
auto encryptor = m_RouterIdentity->CreateEncryptor (nullptr);
|
||||
if (encryptor)
|
||||
encryptor->Encrypt (data, encrypted, ctx);
|
||||
encryptor->Encrypt (data, encrypted, ctx, true);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -903,11 +903,7 @@ namespace stream
|
|||
StreamingDestination::StreamingDestination (std::shared_ptr<i2p::client::ClientDestination> owner, uint16_t localPort, bool gzip):
|
||||
m_Owner (owner), m_LocalPort (localPort), m_Gzip (gzip),
|
||||
m_LastIncomingReceiveStreamID (0),
|
||||
m_PendingIncomingTimer (m_Owner->GetService ()),
|
||||
m_ConnTrackTimer(m_Owner->GetService()),
|
||||
m_ConnsPerMinute(DEFAULT_MAX_CONNS_PER_MIN),
|
||||
m_LastBanClear(i2p::util::GetMillisecondsSinceEpoch()),
|
||||
m_EnableDrop(false)
|
||||
m_PendingIncomingTimer (m_Owner->GetService ())
|
||||
{
|
||||
}
|
||||
|
||||
|
@ -923,7 +919,6 @@ namespace stream
|
|||
|
||||
void StreamingDestination::Start ()
|
||||
{
|
||||
ScheduleConnTrack();
|
||||
}
|
||||
|
||||
void StreamingDestination::Stop ()
|
||||
|
@ -931,15 +926,10 @@ namespace stream
|
|||
ResetAcceptor ();
|
||||
m_PendingIncomingTimer.cancel ();
|
||||
m_PendingIncomingStreams.clear ();
|
||||
m_ConnTrackTimer.cancel();
|
||||
{
|
||||
std::unique_lock<std::mutex> l(m_StreamsMutex);
|
||||
m_Streams.clear ();
|
||||
}
|
||||
{
|
||||
std::unique_lock<std::mutex> l(m_ConnsMutex);
|
||||
m_Conns.clear ();
|
||||
}
|
||||
}
|
||||
|
||||
void StreamingDestination::HandleNextPacket (Packet * packet)
|
||||
|
@ -971,17 +961,7 @@ namespace stream
|
|||
auto incomingStream = CreateNewIncomingStream ();
|
||||
incomingStream->HandleNextPacket (packet); // SYN
|
||||
auto ident = incomingStream->GetRemoteIdentity();
|
||||
if(ident && m_EnableDrop)
|
||||
{
|
||||
auto ih = ident->GetIdentHash();
|
||||
if(DropNewStream(ih))
|
||||
{
|
||||
// drop
|
||||
LogPrint(eLogWarning, "Streaming: Dropping connection, too many inbound streams from ", ih.ToBase32());
|
||||
incomingStream->Terminate();
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
m_LastIncomingReceiveStreamID = receiveStreamID;
|
||||
|
||||
// handle saved packets if any
|
||||
|
@ -1176,63 +1156,5 @@ namespace stream
|
|||
return msg;
|
||||
}
|
||||
|
||||
void StreamingDestination::SetMaxConnsPerMinute(const uint32_t conns)
|
||||
{
|
||||
m_EnableDrop = conns > 0;
|
||||
m_ConnsPerMinute = conns;
|
||||
LogPrint(eLogDebug, "Streaming: Set max conns per minute per destination to ", conns);
|
||||
}
|
||||
|
||||
bool StreamingDestination::DropNewStream(const i2p::data::IdentHash & ih)
|
||||
{
|
||||
std::lock_guard<std::mutex> lock(m_ConnsMutex);
|
||||
if (m_Banned.size() > MAX_BANNED_CONNS) return true; // overload
|
||||
auto end = std::end(m_Banned);
|
||||
if ( std::find(std::begin(m_Banned), end, ih) != end) return true; // already banned
|
||||
auto itr = m_Conns.find(ih);
|
||||
if (itr == m_Conns.end())
|
||||
m_Conns[ih] = 0;
|
||||
|
||||
m_Conns[ih] += 1;
|
||||
|
||||
bool ban = m_Conns[ih] >= m_ConnsPerMinute;
|
||||
if (ban)
|
||||
{
|
||||
m_Banned.push_back(ih);
|
||||
m_Conns.erase(ih);
|
||||
LogPrint(eLogWarning, "Streaming: ban ", ih.ToBase32());
|
||||
}
|
||||
return ban;
|
||||
}
|
||||
|
||||
void StreamingDestination::HandleConnTrack(const boost::system::error_code& ecode)
|
||||
{
|
||||
if (ecode != boost::asio::error::operation_aborted)
|
||||
{
|
||||
{ // acquire lock
|
||||
std::lock_guard<std::mutex> lock(m_ConnsMutex);
|
||||
// clear conn tracking
|
||||
m_Conns.clear();
|
||||
// check for ban clear
|
||||
auto ts = i2p::util::GetMillisecondsSinceEpoch();
|
||||
if (ts - m_LastBanClear >= DEFAULT_BAN_INTERVAL)
|
||||
{
|
||||
// clear bans
|
||||
m_Banned.clear();
|
||||
m_LastBanClear = ts;
|
||||
}
|
||||
}
|
||||
// reschedule timer
|
||||
ScheduleConnTrack();
|
||||
}
|
||||
}
|
||||
|
||||
void StreamingDestination::ScheduleConnTrack()
|
||||
{
|
||||
m_ConnTrackTimer.expires_from_now (boost::posix_time::seconds(60));
|
||||
m_ConnTrackTimer.async_wait (
|
||||
std::bind (&StreamingDestination::HandleConnTrack,
|
||||
shared_from_this (), std::placeholders::_1));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -53,22 +53,6 @@ namespace stream
|
|||
const int PENDING_INCOMING_TIMEOUT = 10; // in seconds
|
||||
const int MAX_RECEIVE_TIMEOUT = 30; // in seconds
|
||||
|
||||
/** i2cp option for limiting inbound stremaing connections */
|
||||
const char I2CP_PARAM_STREAMING_MAX_CONNS_PER_MIN[] = "maxconns";
|
||||
/** default maximum connections attempts per minute per destination */
|
||||
const uint32_t DEFAULT_MAX_CONNS_PER_MIN = 600;
|
||||
|
||||
/**
|
||||
* max banned destinations per local destination
|
||||
* TODO: make configurable
|
||||
*/
|
||||
const uint16_t MAX_BANNED_CONNS = 9999;
|
||||
/**
|
||||
* length of a ban in ms
|
||||
* TODO: make configurable
|
||||
*/
|
||||
const uint64_t DEFAULT_BAN_INTERVAL = 60 * 60 * 1000;
|
||||
|
||||
struct Packet
|
||||
{
|
||||
size_t len, offset;
|
||||
|
@ -273,9 +257,6 @@ namespace stream
|
|||
void HandleDataMessagePayload (const uint8_t * buf, size_t len);
|
||||
std::shared_ptr<I2NPMessage> CreateDataMessage (const uint8_t * payload, size_t len, uint16_t toPort);
|
||||
|
||||
/** set max connections per minute per destination */
|
||||
void SetMaxConnsPerMinute(const uint32_t conns);
|
||||
|
||||
Packet * NewPacket () { return m_PacketsPool.Acquire(); }
|
||||
void DeletePacket (Packet * p) { return m_PacketsPool.Release(p); }
|
||||
|
||||
|
@ -286,13 +267,6 @@ namespace stream
|
|||
std::shared_ptr<Stream> CreateNewIncomingStream ();
|
||||
void HandlePendingIncomingTimer (const boost::system::error_code& ecode);
|
||||
|
||||
/** handle cleaning up connection tracking for ratelimits */
|
||||
void HandleConnTrack(const boost::system::error_code& ecode);
|
||||
|
||||
bool DropNewStream(const i2p::data::IdentHash & ident);
|
||||
|
||||
void ScheduleConnTrack();
|
||||
|
||||
private:
|
||||
|
||||
std::shared_ptr<i2p::client::ClientDestination> m_Owner;
|
||||
|
@ -306,17 +280,7 @@ namespace stream
|
|||
boost::asio::deadline_timer m_PendingIncomingTimer;
|
||||
std::map<uint32_t, std::list<Packet *> > m_SavedPackets; // receiveStreamID->packets, arrived before SYN
|
||||
|
||||
std::mutex m_ConnsMutex;
|
||||
/** how many connections per minute did each identity have */
|
||||
std::map<i2p::data::IdentHash, uint32_t> m_Conns;
|
||||
boost::asio::deadline_timer m_ConnTrackTimer;
|
||||
uint32_t m_ConnsPerMinute;
|
||||
/** banned identities */
|
||||
std::vector<i2p::data::IdentHash> m_Banned;
|
||||
uint64_t m_LastBanClear;
|
||||
|
||||
i2p::util::MemoryPool<Packet> m_PacketsPool;
|
||||
bool m_EnableDrop;
|
||||
|
||||
public:
|
||||
|
||||
|
|
|
@ -5,7 +5,6 @@
|
|||
#include <sstream>
|
||||
#include <vector>
|
||||
#include <memory>
|
||||
#include "Crypto.h"
|
||||
#include "Identity.h"
|
||||
#include "RouterContext.h"
|
||||
#include "Timestamp.h"
|
||||
|
@ -103,7 +102,9 @@ namespace tunnel
|
|||
htobe32buf (clearText + BUILD_REQUEST_RECORD_REQUEST_TIME_OFFSET, i2p::util::GetHoursSinceEpoch ());
|
||||
htobe32buf (clearText + BUILD_REQUEST_RECORD_SEND_MSG_ID_OFFSET, replyMsgID);
|
||||
RAND_bytes (clearText + BUILD_REQUEST_RECORD_PADDING_OFFSET, BUILD_REQUEST_RECORD_CLEAR_TEXT_SIZE - BUILD_REQUEST_RECORD_PADDING_OFFSET);
|
||||
i2p::crypto::ElGamalEncrypt (ident->GetEncryptionPublicKey (), clearText, record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, ctx);
|
||||
auto encryptor = ident->CreateEncryptor (nullptr);
|
||||
if (encryptor)
|
||||
encryptor->Encrypt (clearText, record + BUILD_REQUEST_RECORD_ENCRYPTED_OFFSET, ctx, false);
|
||||
memcpy (record + BUILD_REQUEST_RECORD_TO_PEER_OFFSET, (const uint8_t *)ident->GetIdentHash (), 16);
|
||||
}
|
||||
};
|
||||
|
|
|
@ -21,7 +21,7 @@
|
|||
|
||||
#define I2P_VERSION_MAJOR 0
|
||||
#define I2P_VERSION_MINOR 9
|
||||
#define I2P_VERSION_MICRO 33
|
||||
#define I2P_VERSION_MICRO 34
|
||||
#define I2P_VERSION_PATCH 0
|
||||
#define I2P_VERSION MAKE_VERSION(I2P_VERSION_MAJOR, I2P_VERSION_MINOR, I2P_VERSION_MICRO)
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue