slitheen/server/relay.c

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <regex.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>
#include "relay.h"
#include "slitheen.h"
#include "flow.h"
#include "crypto.h"


int replace_packet(flow *f, uint8_t *packet){
	const struct ip_header *ip_hdr;
	const struct tcp_header *tcp_hdr;

	uint8_t *p = packet;

	p += ETHER_HEADER_LEN; //skip ethernet header
	ip_hdr = (struct ip_header*) p;
	int size_ip = IP_HEADER_LEN(ip_hdr);

	if (ip_hdr->proto != IPPROTO_TCP){
		return 0;
	}

	p += size_ip;	//skip IP header

	tcp_hdr = (struct tcp_header*) p;
	int size_tcp = TCP_HEADER_LEN(tcp_hdr);

	/*fprintf(stderr,"Flow: %d > %d (%s)\n", ip_hdr->src.s_addr, ip_hdr->dst.s_addr, (ip_hdr->src.s_addr != f->src_ip.s_addr)? "incoming":"outgoing");
	fprintf(stderr,"ID number: %u\n", htonl(ip_hdr->id));
	fprintf(stderr,"Sequence number: %u\n", htonl(tcp_hdr->sequence_num));
	fprintf(stderr,"Acknowledgement number: %u\n", htonl(tcp_hdr->ack_num));*/
	int32_t app_data_len = htons(ip_hdr->len) - (size_ip + size_tcp);
	printf("app_data length: %u\n", app_data_len);
	if(app_data_len <= 0){
		return 0;
	}

	/* if outgoing, decrypt and look at header */
	if(ip_hdr->src.s_addr == f->src_ip.s_addr){
		read_header(f, packet);
		return 0;
	} else {
		printf("Current sequence number: %d\n", f->seq_num);
		printf("Received sequence number: %d\n", htonl(tcp_hdr->sequence_num));
		uint32_t offset = htonl(tcp_hdr->sequence_num) - f->seq_num;
		if(offset == 0)
			f->seq_num += app_data_len;
		/* if incoming, replace with data from queue */
		//if(htonl(tcp_hdr->sequence_num) >= f->seq_num){
			replace_contents(f, p, app_data_len, offset, ip_hdr->src, ip_hdr->dst);
		//}//TODO: need to do something about replaying packets (maybe store previously sent data??

		p = packet + ETHER_HEADER_LEN;
#ifdef DEBUG
		fprintf(stdout, "ip hdr length: %d\n", htons(ip_hdr->len));
		fprintf(stdout, "Injecting the following packet:\n");
		for(int i=0; i< htons(ip_hdr->len); i++){
			fprintf(stdout, "%02x ", p[i]);
		}
		fprintf(stdout, "\n");
		fflush(stdout);
#endif
	}
	return 0;

}

int read_header(flow *f, uint8_t *packet){
	const struct ip_header *ip_hdr;
	const struct tcp_header *tcp_hdr;

	uint8_t *p = packet;

	p += ETHER_HEADER_LEN; //skip ethernet header
	ip_hdr = (struct ip_header*) p;
	int size_ip = IP_HEADER_LEN(ip_hdr);

	if (ip_hdr->proto != IPPROTO_TCP){
		return 0;
	}

	p += size_ip;	//skip IP header

	tcp_hdr = (struct tcp_header*) p;
	int size_tcp = TCP_HEADER_LEN(tcp_hdr);
	p += size_tcp;
	int app_data_len = htons(ip_hdr->len) - (size_ip + size_tcp);

	struct record_header *record_hdr = (struct record_header*) p;
	uint32_t record_length = RECORD_LEN(record_hdr);
	uint8_t *decrypted_data = calloc(1, app_data_len);

	/*fprintf(stderr,"record:\n");
	for(int i=0; i< RECORD_HEADER_LEN; i++){
		fprintf(stderr,"%02x ", p[i]);
	}
	fprintf(stderr,"\n");*/
	p+= RECORD_HEADER_LEN;

	memcpy(decrypted_data, p, record_length);

	if(!encrypt(f, decrypted_data, decrypted_data, record_length, 0, record_hdr->type, 0)){
		fprintf(stdout,"decryption failed\n");
		return 0;
	} else {
		fprintf(stdout, "decryption succeeded!\n");
		if(record_hdr->type == 0x17){
			decrypted_data+= EVP_GCM_TLS_EXPLICIT_IV_LEN;
			fprintf(stdout, "request:");
			fprintf(stdout,"%s\n ", decrypted_data);
		}
		
	}
	if(record_hdr->type == 0x15){
		printf("received alert\n");
		for(int i=0; i<record_length; i++){
			printf("%02x ", decrypted_data[i]);
		}
		fflush(stdout);
	}

	/* search through decrypted data for x-ignore */
	regex_t r;
	const uint8_t *regex_text = "x-ignore";
	const uint8_t *match = decrypted_data;
	if(regcomp(&r, regex_text, REG_EXTENDED|REG_NEWLINE)){
		printf("could not compile regex\n");
		return 0;
	}

	regmatch_t m;
	if(regexec(&r, match, 1, &m, 0)){
		printf("no x-ignore found\n");
		return 0;
	} 
	uint8_t *message = decrypted_data;
	//remove escape characters
	for(int i=m.rm_eo+2; i< strlen(match); i++){
		if(match[i] != '\\'){
			*(message++) = match[i];
		} else if (match[i+1] == 'r') {
			*(message++) = '\r';
			i++;
		} else if (match[i+1] == 'n') {
			*(message++) = '\n';
			i++;
		}
	}
	*message = '\0';
	message = decrypted_data;

	regex_t r2;
	const uint8_t *regex_text2 = "host";
	const uint8_t *match2 = decrypted_data;
	regmatch_t m2;
	if(regcomp(&r2, regex_text2, REG_EXTENDED|REG_NEWLINE)){
		printf("could not compile regex\n");
		return 0;
	}
	if(regexec(&r2, match2, 1, &m2, 0)){
		printf("no host found\n");
		return 0;
	}
	uint8_t server[50];
	for(int i=m2.rm_eo+2; i< strlen(match2); i++){
		if(match2[i] != '\n'){
			server[i-m2.rm_eo-2] = match2[i];
		} else {
			server[i-m2.rm_eo-2] = '\0';
			break;
		}
	}

	/* Send GET request to site */
	printf("sending request to site: %s\n", server);

	struct hostent *host;
	host = gethostbyname((const char *) server);

	if(host == NULL){
		printf("gethostbyname failed\n");
		return 0;
	}

	int32_t handle = socket(AF_INET, SOCK_STREAM, 0);
	if(handle < 0){
		printf("error: constructing socket failed\n");
		return 0;
	}
	printf("constructed socket\n");
	struct sockaddr_in dest;
	dest.sin_family = AF_INET;
	dest.sin_port = htons(80);
	dest.sin_addr = *((struct in_addr *) host->h_addr);
	bzero (&(dest.sin_zero), 8);
	printf("connecting...");
	int32_t error = connect (handle, (struct sockaddr *) &dest, sizeof (struct sockaddr));
	printf(" done\n");
	if(error <0){
		printf("error connecting\n");
		return 0;
	}
	int32_t bytes_sent = send(handle, message, strlen(message), 0);
	if( bytes_sent < 0){
		printf("error sending request\n");
		close(handle);
		return 0;
	} else if (bytes_sent < strlen(message)){
		printf("send partial request\n");
		close(handle);
		return 0;
	}

	printf("sent request!\n");
	//change this to realloc and loop later
	uint8_t *buf = calloc(1, 2048);
	memset(buf, 0, 2048);
	int32_t bytes_read = recv(handle, buf, 2048, 0);
	printf("Received message:\n %s\n", buf);
	for(int i=0; i< bytes_read; i++){
		f->censored_queue[i] = buf[i];
	}
	f->censored_length = bytes_read;

	//for now, just close socket
	close(handle);

	return 0;

}

int replace_contents(flow *f, uint8_t *data, int32_t data_len, int32_t offset, struct in_addr src, struct in_addr dst){

	printf("Replacing contents...\n");
	uint8_t *p = data;

	struct tcp_header *tcp_hdr = (struct tcp_header*) p;
	int size_tcp = TCP_HEADER_LEN(tcp_hdr);
	p += size_tcp;

	int32_t tmp_len = data_len;

	//step 1: replace record contents
	//note: encrypted message will be original message size + EVP_GCM_TLS_EXPLICIT_IV_LEN + 16 byte pad
	//first check to see if there's anything in the outbox
	if(f->outbox_len > 0){
		printf("Printing from outbox\n");
		if(f->outbox_len < data_len){
			printf("Next record:\n");
			for(int i=0; i< RECORD_HEADER_LEN; i++){
				printf("%02x ", p[f->outbox_len+i]);
			}
			printf("\n");
		} else {
			printf("Outbox takes up entire packet\n");
		}

		if(tmp_len >= f->outbox_len){
			memcpy(p, f->outbox, f->outbox_len);

			p += f->outbox_len;
			tmp_len -= f->outbox_len;
			f->outbox_len = 0;
			free(f->outbox);
			printf("outbox now empty\n");
		} else {
			printf("Outbox has %d - %d bytes\n", f->outbox_len, tmp_len);
			memcpy(p, f->outbox, tmp_len);
			uint8_t *tmp = calloc(1, f->outbox_len - tmp_len);
			f->outbox_len -= tmp_len;
			memcpy(tmp, f->outbox + tmp_len, f->outbox_len);
			free(f->outbox);
			f->outbox = tmp;
			printf(" = %d bytes left in outbox\n", f->outbox_len);
			tmp_len -= tmp_len;
		}
	}

	while(tmp_len > 0){

		struct record_header *record_hdr = (struct record_header*) p;
		uint32_t record_length = RECORD_LEN(record_hdr);
		fprintf(stdout, "Record:\n");
		for(int i=0; i< RECORD_HEADER_LEN; i++){
			printf("%02x ", p[i]);
		}
		printf("\n");

		p += RECORD_HEADER_LEN;
		if(record_hdr->type != 0x17){
			//TODO: might need to decrypt and re-encrypt
			printf("received non-application data\n");
			tmp_len -= (record_length+ RECORD_HEADER_LEN);
			p += record_length;
			continue;
		}

		uint8_t *new_record = calloc(1, record_length);
		memcpy(new_record, p, record_length);
		uint8_t *tmp_p = new_record;


		/*// BEGIN TEST CODE //

		//Print original record
		printf("Original record (%d bytes):\n", record_length);
		for(int i=0; i< record_length; i++){
			printf("%02x ", p[i]);
		}
		printf("\n");

		//print few bytes of next record (if present)
		if(data_len > record_length + RECORD_HEADER_LEN){
			printf("Next record:\n");
			for(int i=0; i< RECORD_HEADER_LEN; i++){
				printf("%02x ", p[record_length+i]);
			}
			printf("\n");
		} else {
			printf("No extra record: %d = %d + %d\n", data_len, record_length, RECORD_HEADER_LEN);
		}


		//Decrypt record
		printf("Decrypting record... ");
		int n;
		if(!(n = encrypt(f, p, p, record_length, 1, 0x17, 0))){
			fprintf(stderr,"failed\n");
			return 0;
		} else {
			fprintf(stderr, "succeeded!\n");
			printf("Decrypted record:\n");
			for(int i=0; i< record_length; i++){
				printf("%02x ", p[i]);
			}
			printf("\n");
			printf("%s\n", p+ EVP_GCM_TLS_EXPLICIT_IV_LEN);
		}

		//return seq to what it was
		for(int i=7; i>=0; i--){
			--f->read_seq[i];
			if(f->read_seq[i] >= 0)
				break;
			else
				f->read_seq[i] = 0;
		}
		printf("seq reverted (%s): ", "read");
		for(int i=0; i<8; i++){
			printf("%02x ", f->read_seq[i]);
		}
		printf("\n");

		//Now reposition it to be fed into encrypt function
		//memcpy(p, p+ EVP_GCM_TLS_EXPLICIT_IV_LEN, n);

		// END TEST CODE */

		//step 2: figure out what happens if we don't have data
		tmp_p += EVP_GCM_TLS_EXPLICIT_IV_LEN;
		
		struct slitheen_header *sl_hdr = (struct slitheen_header *) tmp_p;
		sl_hdr->marker = 0x01;
		sl_hdr->version = 0x01;
		int32_t remaining = record_length - (SLITHEEN_HEADER_LEN
				+ EVP_GCM_TLS_EXPLICIT_IV_LEN + 16);
		fprintf(stdout, "filling with censored queue data (%d out of %d) at offset %d\n", remaining, f->censored_length-offset, offset);
		if(remaining > 0){
			if(remaining+offset <= f->censored_length){
				fprintf(stdout, "We have enough data to fill the record\n");
				for(int i = 0; i< remaining; i++){
					tmp_p[SLITHEEN_HEADER_LEN+i] = f->censored_queue[i + offset];
				}
				//TODO: when I restructure this for more data, figure out freeing these pointers
				f->censored_queue += remaining;
				f->censored_length -= remaining;
				sl_hdr->len = htons(remaining);
				fprintf(stdout, "copied %d data\n", ntohs(sl_hdr->len));

			} else {
				int32_t dummy_offset = f->censored_length - offset;
				if(dummy_offset < 0) dummy_offset = 0;
				fprintf(stdout, "Not enough data (%d bytes)\n", dummy_offset);
				for(int i = 0; i< dummy_offset; i++){
					tmp_p[SLITHEEN_HEADER_LEN+i] = f->censored_queue[i + offset];
				}
				//TODO: note, we may also be receiving misordered packets. Take Ian's suggestion into account here
				f->censored_queue += dummy_offset;
				f->censored_length -= dummy_offset;
				sl_hdr->len = htons(dummy_offset);
				//TODO: should i < record_length or remaining??
				for(int i = dummy_offset; i< remaining; i++){
					tmp_p[SLITHEEN_HEADER_LEN+i] = 'A';
				}
				fprintf(stdout, "copied %d data and %d garbage bytes\n", ntohs(sl_hdr->len), remaining - dummy_offset);
			}
			printf("Slitheen header\n");
			for(int i=0; i<4; i++)
				printf("%02x ", tmp_p[i]);
			printf("\n");
		}
		tmp_p -= EVP_GCM_TLS_EXPLICIT_IV_LEN;
		//step 3: encrypt new record
		//fprintf(stderr, "computing mac\n");
		//int32_t mac_size = mac(f, p, p+(record_length - (EVP_GCM_TLS_EXPLICIT_IV_LEN + 16)), record_length - (EVP_GCM_TLS_EXPLICIT_IV_LEN + 16), 1, 0x17, 1); 
		//printf(stderr, "mac size: %d\n", mac_size);
		//fprintf(stderr, "encrypting\n");
		int32_t success;
		if((success = encrypt(f, tmp_p, tmp_p, record_length-16, 1, 0x17, 1))< 0){
			fprintf(stdout,"encryption failed\n");
			return 0;
		} else {
			fprintf(stdout, "encryption succeeded!\n");
			//printf("Encrypted data:\n");
			//for(int i=0; i< success; i++){
			//	printf("%02x ", tmp_p[i]);
			//}
			//printf("\n");
		}
		//copy new record into packet
		if(record_length +RECORD_HEADER_LEN > tmp_len){
			//We have a partial record
			printf("Warning: partial record\n");
			memcpy(p, new_record, tmp_len - RECORD_HEADER_LEN);
			f->outbox_len = record_length - (tmp_len - RECORD_HEADER_LEN);
			//save left-overs in outbox
			f->outbox = calloc(1, f->outbox_len);
			memcpy(f->outbox, new_record + (tmp_len - RECORD_HEADER_LEN),
					f->outbox_len);
			free(new_record);
			printf("Outbox has %d = %d - %d bytes\n", f->outbox_len, record_length+RECORD_HEADER_LEN, tmp_len);
		} else {
			memcpy(p, new_record, record_length);
			free(new_record);
		}


		//check to see if next record still exists
		if(data_len > record_length + RECORD_HEADER_LEN){
			printf("Next record:\n");
			for(int i=0; i< RECORD_HEADER_LEN; i++){
				printf("%02x ", p[record_length+i]);
			}
			printf("\n");
		} else {
			printf("No extra record: %d <= %d + %d\n", data_len, record_length, RECORD_HEADER_LEN);
		}
		tmp_len -= record_length+ RECORD_HEADER_LEN;
		p += record_length;

	}
	//step 4: recompute TCP checksum
	p = data;
	p[16] = 0; p[17] = 0;//zero out checksum
	uint16_t chksm = tcp_checksum(p, data_len, src, dst);
	p[17] = chksm & 0xFF;
	p[16] = chksm >> 8;
	fprintf(stdout, "Checksum: 0x%0x%0x\n", p[16], p[17]);
	fflush(stdout);

	return 0;
}

/** Computes the TCP checksum of the data according to RFC 793
 *  sum all 16-bit words in the segment, padd the last word if
 *  needed
 *
 *  there is a pseudo-header prefixed to the segment and
 *  included in the checksum:
 *
 *         +--------+--------+--------+--------+
 *         |           Source Address          |
 *         +--------+--------+--------+--------+
 *         |         Destination Address       |
 *         +--------+--------+--------+--------+
 *         |  zero  |  PTCL  |    TCP Length   |
 *         +--------+--------+--------+--------+
 */
uint16_t tcp_checksum(uint8_t *data, int32_t data_len, struct in_addr src, struct in_addr dst){

	uint8_t *p = data;

	struct tcp_header *tcp_hdr = (struct tcp_header*) p;
	int size_tcp = TCP_HEADER_LEN(tcp_hdr);
	//Construct pseudo-header
	uint16_t tcp_length = data_len + size_tcp;
	uint8_t proto = IPPROTO_TCP;
	fprintf(stdout, "summing pseudoheader\n");
	uint32_t sum = (ntohl(src.s_addr)) >> 16;
	sum += (ntohl(src.s_addr)) &0xFFFF;
	sum += (ntohl(dst.s_addr)) >> 16;
	sum += (ntohl(dst.s_addr)) & 0xFFFF;
	sum += proto;
	sum += tcp_length;

	//now sum the text
	for(int i=0; i< tcp_length-1; i+=2){
		sum += (uint16_t) ((p[i] << 8) + p[i+1]);

	}
	if(tcp_length %2 != 0){
		sum += (uint16_t) (p[tcp_length - 1]) << 8;
	}
	//now add most significant to last significant bits
	sum = (sum >> 16) + (sum & 0xFFFF);
	//now subtract from 0xFF
	sum = 0xFFFF - sum;
	return (uint16_t) sum;
}