diff options
| -rw-r--r-- | framing/framing.go | 13 | ||||
| -rw-r--r-- | ntor/ntor.go | 5 | ||||
| -rw-r--r-- | obfs4.go | 41 | ||||
| -rw-r--r-- | packet.go | 111 | ||||
| -rw-r--r-- | utils.go | 4 |
5 files changed, 147 insertions, 27 deletions
diff --git a/framing/framing.go b/framing/framing.go index 5554a6e..75b9a73 100644 --- a/framing/framing.go +++ b/framing/framing.go @@ -61,6 +61,7 @@ import ( "errors" "fmt" "hash" + "log" "code.google.com/p/go.crypto/nacl/secretbox" @@ -126,7 +127,7 @@ type boxNonce struct { func (nonce *boxNonce) init(prefix []byte) { if noncePrefixLength != len(prefix) { - panic(fmt.Sprintf("BUG: Nonce prefix length invalid: %d", len(prefix))) + log.Panicf("BUG: Nonce prefix length invalid: %d", len(prefix)) } copy(nonce.prefix[:], prefix) @@ -160,7 +161,7 @@ type Encoder struct { // containing exactly KeyLength bytes of keying material. func NewEncoder(key []byte) *Encoder { if len(key) != KeyLength { - panic(fmt.Sprintf("BUG: Invalid encoder key length: %d", len(key))) + log.Panicf("BUG: Invalid encoder key length: %d", len(key)) } encoder := new(Encoder) @@ -222,7 +223,7 @@ type Decoder struct { // containing exactly KeyLength bytes of keying material. func NewDecoder(key []byte) *Decoder { if len(key) != KeyLength { - panic(fmt.Sprintf("BUG: Invalid decoder key length: %d", len(key))) + log.Panicf("BUG: Invalid decoder key length: %d", len(key)) } decoder := new(Decoder) @@ -252,7 +253,7 @@ func (decoder *Decoder) Decode(data *bytes.Buffer) (int, []byte, error) { return 0, nil, err } else if n != lengthLength { // Should *NEVER* happen, since at least 2 bytes exist. - panic(fmt.Sprintf("BUG: Failed to read obfuscated length: %d", n)) + log.Panicf("BUG: Failed to read obfuscated length: %d", n) } // Derive the nonce the peer used. @@ -284,8 +285,8 @@ func (decoder *Decoder) Decode(data *bytes.Buffer) (int, []byte, error) { return 0, nil, err } else if n != int(decoder.nextLength) { // Should *NEVER* happen, since at least 2 bytes exist. - panic(fmt.Sprintf("BUG: Failed to read secretbox, got %d, should have %d", n, - decoder.nextLength)) + log.Panicf("BUG: Failed to read secretbox, got %d, should have %d", n, + decoder.nextLength) } out, ok := secretbox.Open(nil, box, &decoder.nextNonce, &decoder.key) if !ok { diff --git a/ntor/ntor.go b/ntor/ntor.go index 9dbed7f..b19c4a1 100644 --- a/ntor/ntor.go +++ b/ntor/ntor.go @@ -45,6 +45,7 @@ import ( "encoding/base64" "fmt" "io" + "log" "code.google.com/p/go.crypto/curve25519" "code.google.com/p/go.crypto/hkdf" @@ -421,9 +422,9 @@ func Kdf(keySeed []byte, okmLen int) []byte { okm := make([]byte, okmLen) n, err := io.ReadFull(kdf, okm) if err != nil { - panic(fmt.Sprintf("BUG: Failed HKDF: %s", err.Error())) + log.Panicf("BUG: Failed HKDF: %s", err.Error()) } else if n != len(okm) { - panic(fmt.Sprintf("BUG: Got truncated HKDF output: %d", n)) + log.Panicf("BUG: Got truncated HKDF output: %d", n) } return okm @@ -30,6 +30,7 @@ package obfs4 import ( "bytes" + "log" "net" "syscall" "time" @@ -97,7 +98,7 @@ func (c *Obfs4Conn) closeAfterDelay() { func (c *Obfs4Conn) clientHandshake(nodeID *ntor.NodeID, publicKey *ntor.PublicKey) error { if c.isServer { - panic("clientHandshake() called for server connection") + log.Panicf("BUG: clientHandshake() called for server connection") } // Generate/send the client handshake. @@ -155,7 +156,7 @@ func (c *Obfs4Conn) clientHandshake(nodeID *ntor.NodeID, publicKey *ntor.PublicK func (c *Obfs4Conn) serverHandshake(nodeID *ntor.NodeID, keypair *ntor.Keypair) error { if !c.isServer { - panic("serverHandshake() called for client connection") + log.Panicf("BUG: serverHandshake() called for client connection") } hs := newServerHandshake(nodeID, keypair) @@ -219,7 +220,7 @@ func (c *Obfs4Conn) ServerHandshake() error { // Clients handshake as part of Dial. if !c.isServer { - panic("ServerHandshake() called for client connection") + log.Panicf("BUG: ServerHandshake() called for client connection") } // Regardless of what happens, don't need the listener past returning from @@ -263,12 +264,18 @@ func (c *Obfs4Conn) Read(b []byte) (int, error) { break } else if err != nil { // Any other frame decoder errors are fatal. + c.isOk = false return 0, err } - // TODO: Support more than raw payload directly in NaCl boxes. - - c.receiveDecodedBuffer.Write(frame) + // Decode the packet, if there is payload, it will be placed in + // receiveDecodedBuffer automatically. + err = c.decodePacket(frame) + if err != nil { + // All packet decoder errors are fatal. + c.isOk = false + return 0, err + } } } @@ -278,7 +285,8 @@ func (c *Obfs4Conn) Read(b []byte) (int, error) { func (c *Obfs4Conn) Write(b []byte) (int, error) { chopBuf := bytes.NewBuffer(b) - buf := make([]byte, framing.MaximumFramePayloadLength) + buf := make([]byte, maxPacketPayloadLength) + pkt := make([]byte, framing.MaximumFramePayloadLength) nSent := 0 var frameBuf bytes.Buffer @@ -286,25 +294,24 @@ func (c *Obfs4Conn) Write(b []byte) (int, error) { // Send maximum sized frames. n, err := chopBuf.Read(buf) if err != nil { + c.isOk = false return nSent, err } else if n == 0 { - panic("Write(), chopping lenght was 0") + log.Panicf("BUG: Write(), chopping length was 0") } + nSent += n - // Encode the frame. - _, frame, err := c.encoder.Encode(buf[:n]) - if err != nil { - c.isOk = false - return nSent, err - } + // Wrap the payload in a packet. + n = makePacket(pkt[:], packetTypePayload, buf[:n], 0) - _, err = frameBuf.Write(frame) + // Encode the packet in an AEAD frame. + _, frame, err := c.encoder.Encode(pkt[:n]) if err != nil { c.isOk = false return nSent, err } - nSent += n + frameBuf.Write(frame) } // TODO: Insert random padding. @@ -316,7 +323,7 @@ func (c *Obfs4Conn) Write(b []byte) (int, error) { // at this point. It's possible to keep frameBuf around, but fuck it. // Someone that wants write timeouts can change this. c.isOk = false - return nSent, err + return nSent, err // XXX: nSent is a dirty lie here. } return nSent, nil diff --git a/packet.go b/packet.go new file mode 100644 index 0000000..7a6b3fb --- /dev/null +++ b/packet.go @@ -0,0 +1,111 @@ +/* + * Copyright (c) 2014, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package obfs4 + +import ( + "encoding/binary" + "fmt" + "log" + + "github.com/yawning/obfs4/framing" +) + +const ( + packetOverhead = 2 + 1 + maxPacketPayloadLength = framing.MaximumFramePayloadLength - packetOverhead + maxPacketPaddingLength = maxPacketPayloadLength +) + +const ( + packetTypePayload = iota + packetTypePrngSeed +) + +// InvalidPacketLengthError is the error returned when decodePacket detects a +// invalid packet length/ +type InvalidPacketLengthError int + +func (e InvalidPacketLengthError) Error() string { + return fmt.Sprintf("packet: Invalid packet length: %d", int(e)) +} + +// InvalidPacketLengthError is the error returned when decodePacket rejects the +// payload length. +type InvalidPayloadLengthError int + +func (e InvalidPayloadLengthError) Error() string { + return fmt.Sprintf("packet: Invalid payload length: %d", int(e)) +} + +var zeroPadBytes [maxPacketPaddingLength]byte + +func makePacket(pkt []byte, pktType uint8, data []byte, padLen uint16) int { + pktLen := packetOverhead + len(data) + int(padLen) + + if len(data)+int(padLen) > maxPacketPayloadLength { + log.Panicf("BUG: makePacket() len(data) + padLen > maxPacketPayloadLength: %d + %d > %d", + len(data), padLen, maxPacketPayloadLength) + } + + // Packets are: + // uint8_t type packetTypePayload (0x00) + // uint16_t length Length of the payload (Big Endian). + // uint8_t[] payload Data payload. + // uint8_t[] padding Padding. + + pkt[0] = pktType + binary.BigEndian.PutUint16(pkt[1:], uint16(len(data))) + copy(pkt[3:], data[:]) + copy(pkt[3+len(data):], zeroPadBytes[:padLen]) + + return pktLen +} + +func (c *Obfs4Conn) decodePacket(pkt []byte) error { + if len(pkt) < packetOverhead { + return InvalidPacketLengthError(len(pkt)) + } + + pktType := pkt[0] + payloadLen := binary.BigEndian.Uint16(pkt[1:]) + if int(payloadLen) > len(pkt)-packetOverhead { + return InvalidPayloadLengthError(int(payloadLen)) + } + + payload := pkt[3 : 3+payloadLen] + switch pktType { + case packetTypePayload: + // packetTypePayload + c.receiveDecodedBuffer.Write(payload) + default: + // Ignore unrecognised packet types. + log.Printf("[INFO] - Ignoring packet type: %d", pktType) + } + + return nil +} @@ -29,13 +29,13 @@ package obfs4 import ( "crypto/rand" - "fmt" + "log" "math/big" ) func randRange(min, max int64) (int64, error) { if max < min { - panic(fmt.Sprintf("randRange: min > max (%d, %d)", min, max)) + log.Panicf("randRange: min > max (%d, %d)", min, max) } r := (max + 1) - min |