From 34cb9132ef2dae08f91a66015ea5437539a4b557 Mon Sep 17 00:00:00 2001 From: Alon Bar-Lev Date: Wed, 29 Feb 2012 22:11:59 +0200 Subject: build: standard directory layout Suitable for mature project. root - administrative stuff doc - documents src - sources tests - tests distro - distro specific files sample - samples SIDE EFFECT: many changes to rpm spec. Signed-off-by: Alon Bar-Lev Acked-by: Adriaan de Jong Signed-off-by: David Sommerseth --- src/openvpn/packet_id.c | 596 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 596 insertions(+) create mode 100644 src/openvpn/packet_id.c (limited to 'src/openvpn/packet_id.c') diff --git a/src/openvpn/packet_id.c b/src/openvpn/packet_id.c new file mode 100644 index 0000000..ba8973a --- /dev/null +++ b/src/openvpn/packet_id.c @@ -0,0 +1,596 @@ +/* + * OpenVPN -- An application to securely tunnel IP networks + * over a single TCP/UDP port, with support for SSL/TLS-based + * session authentication and key exchange, + * packet encryption, packet authentication, and + * packet compression. + * + * Copyright (C) 2002-2010 OpenVPN Technologies, Inc. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program (see the file COPYING included with this + * distribution); if not, write to the Free Software Foundation, Inc., + * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ + +/* + * These routines are designed to catch replay attacks, + * where a man-in-the-middle captures packets and then + * attempts to replay them back later. + * + * We use the "sliding-window" algorithm, similar + * to IPSec. + */ + +#include "syshead.h" + +#ifdef USE_CRYPTO + +#include "packet_id.h" +#include "misc.h" +#include "integer.h" + +#include "memdbg.h" + +/* #define PID_SIMULATE_BACKTRACK */ + +/* + * Special time_t value that indicates that + * sequence number has expired. + */ +#define SEQ_UNSEEN ((time_t)0) +#define SEQ_EXPIRED ((time_t)1) + +static void packet_id_debug_print (int msglevel, + const struct packet_id_rec *p, + const struct packet_id_net *pin, + const char *message, + int value); + +static inline void +packet_id_debug (int msglevel, + const struct packet_id_rec *p, + const struct packet_id_net *pin, + const char *message, + int value) +{ +#ifdef ENABLE_DEBUG + if (unlikely(check_debug_level(msglevel))) + packet_id_debug_print (msglevel, p, pin, message, value); +#endif +} + +void +packet_id_init (struct packet_id *p, bool tcp_mode, int seq_backtrack, int time_backtrack, const char *name, int unit) +{ + dmsg (D_PID_DEBUG, "PID packet_id_init tcp_mode=%d seq_backtrack=%d time_backtrack=%d", + tcp_mode, + seq_backtrack, + time_backtrack); + + ASSERT (p); + CLEAR (*p); + + p->rec.name = name; + p->rec.unit = unit; + if (seq_backtrack && !tcp_mode) + { + ASSERT (MIN_SEQ_BACKTRACK <= seq_backtrack && seq_backtrack <= MAX_SEQ_BACKTRACK); + ASSERT (MIN_TIME_BACKTRACK <= time_backtrack && time_backtrack <= MAX_TIME_BACKTRACK); + CIRC_LIST_ALLOC (p->rec.seq_list, struct seq_list, seq_backtrack); + p->rec.seq_backtrack = seq_backtrack; + p->rec.time_backtrack = time_backtrack; + } + p->rec.initialized = true; +} + +void +packet_id_free (struct packet_id *p) +{ + if (p) + { + dmsg (D_PID_DEBUG, "PID packet_id_free"); + if (p->rec.seq_list) + free (p->rec.seq_list); + CLEAR (*p); + } +} + +void +packet_id_add (struct packet_id_rec *p, const struct packet_id_net *pin) +{ + const time_t local_now = now; + if (p->seq_list) + { + packet_id_type diff; + + /* + * If time value increases, start a new + * sequence number sequence. + */ + if (!CIRC_LIST_SIZE (p->seq_list) + || pin->time > p->time + || (pin->id >= (packet_id_type)p->seq_backtrack + && pin->id - (packet_id_type)p->seq_backtrack > p->id)) + { + p->time = pin->time; + p->id = 0; + if (pin->id > (packet_id_type)p->seq_backtrack) + p->id = pin->id - (packet_id_type)p->seq_backtrack; + CIRC_LIST_RESET (p->seq_list); + } + + while (p->id < pin->id +#ifdef PID_SIMULATE_BACKTRACK + || (get_random() % 64) < 31 +#endif + ) + { + CIRC_LIST_PUSH (p->seq_list, SEQ_UNSEEN); + ++p->id; + } + + diff = p->id - pin->id; + if (diff < (packet_id_type) CIRC_LIST_SIZE (p->seq_list) + && local_now > SEQ_EXPIRED) + CIRC_LIST_ITEM (p->seq_list, diff) = local_now; + } + else + { + p->time = pin->time; + p->id = pin->id; + } +} + +/* + * Expire sequence numbers which can no longer + * be accepted because they would violate + * time_backtrack. + */ +void +packet_id_reap (struct packet_id_rec *p) +{ + const time_t local_now = now; + if (p->time_backtrack) + { + int i; + bool expire = false; + for (i = 0; i < CIRC_LIST_SIZE (p->seq_list); ++i) + { + const time_t t = CIRC_LIST_ITEM (p->seq_list, i); + if (t == SEQ_EXPIRED) + break; + if (!expire && t && t + p->time_backtrack < local_now) + expire = true; + if (expire) + CIRC_LIST_ITEM (p->seq_list, i) = SEQ_EXPIRED; + } + } + p->last_reap = local_now; +} + +/* + * Return true if packet id is ok, or false if + * it is a replay. + */ +bool +packet_id_test (struct packet_id_rec *p, + const struct packet_id_net *pin) +{ + packet_id_type diff; + + packet_id_debug (D_PID_DEBUG, p, pin, "PID_TEST", 0); + + ASSERT (p->initialized); + + if (!pin->id) + return false; + + if (p->seq_backtrack) + { + /* + * In backtrack mode, we allow packet reordering subject + * to the seq_backtrack and time_backtrack constraints. + * + * This mode is used with UDP. + */ + if (pin->time == p->time) + { + /* is packet-id greater than any one we've seen yet? */ + if (pin->id > p->id) + return true; + + /* check packet-id sliding window for original/replay status */ + diff = p->id - pin->id; + + /* keep track of maximum backtrack seen for debugging purposes */ + if ((int)diff > p->max_backtrack_stat) + { + p->max_backtrack_stat = (int)diff; + packet_id_debug (D_PID_DEBUG_LOW, p, pin, "PID_ERR replay-window backtrack occurred", p->max_backtrack_stat); + } + + if (diff >= (packet_id_type) CIRC_LIST_SIZE (p->seq_list)) + { + packet_id_debug (D_PID_DEBUG_LOW, p, pin, "PID_ERR large diff", diff); + return false; + } + + { + const time_t v = CIRC_LIST_ITEM (p->seq_list, diff); + if (v == 0) + return true; + else + { + /* raised from D_PID_DEBUG_LOW to reduce verbosity */ + packet_id_debug (D_PID_DEBUG_MEDIUM, p, pin, "PID_ERR replay", diff); + return false; + } + } + } + else if (pin->time < p->time) /* if time goes back, reject */ + { + packet_id_debug (D_PID_DEBUG_LOW, p, pin, "PID_ERR time backtrack", 0); + return false; + } + else /* time moved forward */ + return true; + } + else + { + /* + * In non-backtrack mode, all sequence number series must + * begin at some number n > 0 and must increment linearly without gaps. + * + * This mode is used with TCP. + */ + if (pin->time == p->time) + return !p->id || pin->id == p->id + 1; + else if (pin->time < p->time) /* if time goes back, reject */ + return false; + else /* time moved forward */ + return pin->id == 1; + } +} + +/* + * Read/write a packet ID to/from the buffer. Short form is sequence number + * only. Long form is sequence number and timestamp. + */ + +bool +packet_id_read (struct packet_id_net *pin, struct buffer *buf, bool long_form) +{ + packet_id_type net_id; + net_time_t net_time; + + pin->id = 0; + pin->time = 0; + + if (!buf_read (buf, &net_id, sizeof (net_id))) + return false; + pin->id = ntohpid (net_id); + if (long_form) + { + if (!buf_read (buf, &net_time, sizeof (net_time))) + return false; + pin->time = ntohtime (net_time); + } + return true; +} + +bool +packet_id_write (const struct packet_id_net *pin, struct buffer *buf, bool long_form, bool prepend) +{ + packet_id_type net_id = htonpid (pin->id); + net_time_t net_time = htontime (pin->time); + + if (prepend) + { + if (long_form) + { + if (!buf_write_prepend (buf, &net_time, sizeof (net_time))) + return false; + } + if (!buf_write_prepend (buf, &net_id, sizeof (net_id))) + return false; + } + else + { + if (!buf_write (buf, &net_id, sizeof (net_id))) + return false; + if (long_form) + { + if (!buf_write (buf, &net_time, sizeof (net_time))) + return false; + } + } + return true; +} + +const char * +packet_id_net_print (const struct packet_id_net *pin, bool print_timestamp, struct gc_arena *gc) +{ + struct buffer out = alloc_buf_gc (256, gc); + + buf_printf (&out, "[ #" packet_id_format, (packet_id_print_type)pin->id); + if (print_timestamp && pin->time) + buf_printf (&out, " / time = (" packet_id_format ") %s", + (packet_id_print_type)pin->time, + time_string (pin->time, 0, false, gc)); + + buf_printf (&out, " ]"); + return BSTR (&out); +} + +/* initialize the packet_id_persist structure in a disabled state */ +void +packet_id_persist_init (struct packet_id_persist *p) +{ + p->filename = NULL; + p->fd = -1; + p->time = p->time_last_written = 0; + p->id = p->id_last_written = 0; +} + +/* close the file descriptor if it is open, and switch to disabled state */ +void +packet_id_persist_close (struct packet_id_persist *p) +{ + if (packet_id_persist_enabled (p)) + { + if (close (p->fd)) + msg (D_PID_PERSIST | M_ERRNO, "Close error on --replay-persist file %s", p->filename); + packet_id_persist_init (p); + } +} + +/* load persisted rec packet_id (time and id) only once from file, and set state to enabled */ +void +packet_id_persist_load (struct packet_id_persist *p, const char *filename) +{ + struct gc_arena gc = gc_new (); + if (!packet_id_persist_enabled (p)) + { + /* open packet-id persist file for both read and write */ + p->fd = openvpn_open (filename, + O_CREAT | O_RDWR | O_BINARY, + S_IRUSR | S_IWUSR); + if (p->fd == -1) + { + msg (D_PID_PERSIST | M_ERRNO, + "Cannot open --replay-persist file %s for read/write", + filename); + } + else + { + struct packet_id_persist_file_image image; + ssize_t n; + +#if defined(HAVE_FLOCK) && defined(LOCK_EX) && defined(LOCK_NB) + if (flock (p->fd, LOCK_EX | LOCK_NB)) + msg (M_ERR, "Cannot obtain exclusive lock on --replay-persist file %s", filename); +#endif + + p->filename = filename; + n = read (p->fd, &image, sizeof(image)); + if (n == sizeof(image)) + { + p->time = p->time_last_written = image.time; + p->id = p->id_last_written = image.id; + dmsg (D_PID_PERSIST_DEBUG, "PID Persist Read from %s: %s", + p->filename, packet_id_persist_print (p, &gc)); + } + else if (n == -1) + { + msg (D_PID_PERSIST | M_ERRNO, + "Read error on --replay-persist file %s", + p->filename); + } + } + } + gc_free (&gc); +} + +/* save persisted rec packet_id (time and id) to file (only if enabled state) */ +void +packet_id_persist_save (struct packet_id_persist *p) +{ + if (packet_id_persist_enabled (p) && p->time && (p->time != p->time_last_written || + p->id != p->id_last_written)) + { + struct packet_id_persist_file_image image; + ssize_t n; + off_t seek_ret; + struct gc_arena gc = gc_new (); + + image.time = p->time; + image.id = p->id; + seek_ret = lseek(p->fd, (off_t)0, SEEK_SET); + if (seek_ret == (off_t)0) + { + n = write(p->fd, &image, sizeof(image)); + if (n == sizeof(image)) + { + p->time_last_written = p->time; + p->id_last_written = p->id; + dmsg (D_PID_PERSIST_DEBUG, "PID Persist Write to %s: %s", + p->filename, packet_id_persist_print (p, &gc)); + } + else + { + msg (D_PID_PERSIST | M_ERRNO, + "Cannot write to --replay-persist file %s", + p->filename); + } + } + else + { + msg (D_PID_PERSIST | M_ERRNO, + "Cannot seek to beginning of --replay-persist file %s", + p->filename); + } + gc_free (&gc); + } +} + +/* transfer packet_id_persist -> packet_id */ +void +packet_id_persist_load_obj (const struct packet_id_persist *p, struct packet_id *pid) +{ + if (p && pid && packet_id_persist_enabled (p) && p->time) + { + pid->rec.time = p->time; + pid->rec.id = p->id; + } +} + +const char * +packet_id_persist_print (const struct packet_id_persist *p, struct gc_arena *gc) +{ + struct buffer out = alloc_buf_gc (256, gc); + + buf_printf (&out, "["); + + if (packet_id_persist_enabled (p)) + { + buf_printf (&out, " #" packet_id_format, (packet_id_print_type)p->id); + if (p->time) + buf_printf (&out, " / time = (" packet_id_format ") %s", + (packet_id_print_type)p->time, + time_string (p->time, 0, false, gc)); + } + + buf_printf (&out, " ]"); + return (char *)out.data; +} + +#ifdef ENABLE_DEBUG + +static void +packet_id_debug_print (int msglevel, + const struct packet_id_rec *p, + const struct packet_id_net *pin, + const char *message, + int value) +{ + struct gc_arena gc = gc_new (); + struct buffer out = alloc_buf_gc (256, &gc); + struct timeval tv; + const time_t prev_now = now; + const struct seq_list *sl = p->seq_list; + int i; + + CLEAR (tv); + gettimeofday (&tv, NULL); + + buf_printf (&out, "%s [%d]", message, value); + buf_printf (&out, " [%s-%d] [", p->name, p->unit); + for (i = 0; i < sl->x_size; ++i) + { + char c; + time_t v; + int diff; + + v = CIRC_LIST_ITEM(sl, i); + if (v == SEQ_UNSEEN) + c = '_'; + else if (v == SEQ_EXPIRED) + c = 'E'; + else + { + diff = (int) prev_now - v; + if (diff < 0) + c = 'N'; + else if (diff < 10) + c = '0' + diff; + else + c = '>'; + } + buf_printf(&out, "%c", c); + } + buf_printf (&out, "] " time_format ":" packet_id_format, (time_type)p->time, (packet_id_print_type)p->id); + if (pin) + buf_printf (&out, " " time_format ":" packet_id_format, (time_type)pin->time, (packet_id_print_type)pin->id); + + buf_printf (&out, " t=" time_format "[%d]", + (time_type)prev_now, + (int)(prev_now - tv.tv_sec)); + + buf_printf (&out, " r=[%d,%d,%d,%d,%d]", + (int)(p->last_reap - tv.tv_sec), + p->seq_backtrack, + p->time_backtrack, + p->max_backtrack_stat, + (int)p->initialized); + buf_printf (&out, " sl=[%d,%d,%d,%d]", + sl->x_head, + sl->x_size, + sl->x_cap, + sl->x_sizeof); + + msg (msglevel, "%s", BSTR(&out)); + gc_free (&gc); +} + +#endif + +#ifdef PID_TEST + +void +packet_id_interactive_test () +{ + struct packet_id pid; + struct packet_id_net pin; + bool long_form; + bool count = 0; + bool test; + + const int seq_backtrack = 10; + const int time_backtrack = 10; + + packet_id_init (&pid, seq_backtrack, time_backtrack); + + while (true) { + char buf[80]; + if (!fgets(buf, sizeof(buf), stdin)) + break; + update_time (); + if (sscanf (buf, "%lu,%u", &pin.time, &pin.id) == 2) + { + packet_id_reap_test (&pid.rec); + test = packet_id_test (&pid.rec, &pin); + printf ("packet_id_test (" time_format ", " packet_id_format ") returned %d\n", + (time_type)pin.time, + (packet_id_print_type)pin.id, + test); + if (test) + packet_id_add (&pid.rec, &pin); + } + else + { + long_form = (count < 20); + packet_id_alloc_outgoing (&pid.send, &pin, long_form); + printf ("(" time_format "(" packet_id_format "), %d)\n", + (time_type)pin.time, + (packet_id_print_type)pin.id, + long_form); + if (pid.send.id == 10) + pid.send.id = 0xFFFFFFF8; + ++count; + } + } + packet_id_free (&pid); +} +#endif + +#endif /* USE_CRYPTO */ -- cgit