slitheen.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596
  1. /* Name: slitheen.c
  2. *
  3. * Slitheen - a decoy routing system for censorship resistance
  4. * Copyright (C) 2017 Cecylia Bocovich (cbocovic@uwaterloo.ca)
  5. *
  6. * This program is free software: you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation, version 3.
  9. *
  10. * This program is distributed in the hope that it will be useful,
  11. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. * GNU General Public License for more details.
  14. *
  15. * You should have received a copy of the GNU General Public License
  16. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17. *
  18. * Additional permission under GNU GPL version 3 section 7
  19. *
  20. * If you modify this Program, or any covered work, by linking or combining
  21. * it with the OpenSSL library (or a modified version of that library),
  22. * containing parts covered by the terms of the OpenSSL Licence and the
  23. * SSLeay license, the licensors of this Program grant you additional
  24. * permission to convey the resulting work. Corresponding Source for a
  25. * non-source form of such a combination shall include the source code
  26. * for the parts of the OpenSSL library used as well as that of the covered
  27. * work.
  28. */
  29. #include <pcap.h>
  30. #include <stdio.h>
  31. #include <stdlib.h>
  32. #include <unistd.h>
  33. #include <string.h>
  34. #include <pthread.h>
  35. #include <sys/ioctl.h>
  36. #include <net/if.h>
  37. #include <openssl/ssl.h>
  38. #include "util.h"
  39. #include "flow.h"
  40. #include "slitheen.h"
  41. #include "relay.h"
  42. #include "crypto.h"
  43. #include "cryptothread.h"
  44. #include "packet.h"
  45. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet);
  46. void *sniff_packets(void *);
  47. void process_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet);
  48. struct packet_info *copy_packet_info(struct packet_info *src_info);
  49. void save_packet(flow *f, struct packet_info *info);
  50. void update_window_expiration(flow *f, struct packet_info *info);
  51. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill);
  52. void usage(void){
  53. printf("Usage: slitheen [internal network interface] [NAT interface]\n");
  54. }
  55. int main(int argc, char *argv[]){
  56. pthread_t t1, t2;
  57. char *dev1 = NULL; /* Device that leads to the internal network */
  58. char *dev2 = NULL; /* Device that leads out to the world */
  59. struct sniff_args outbound;
  60. struct sniff_args inbound;
  61. if (argc != 3) {
  62. usage();
  63. return(2);
  64. }
  65. dev1 = argv[1];
  66. dev2 = argv[2];
  67. if(init_tables()){
  68. exit(1);
  69. }
  70. if(init_session_cache()){
  71. exit(1);
  72. }
  73. init_crypto_locks();
  74. /* Create threads */
  75. outbound.readdev = dev1;
  76. outbound.writedev = dev2;
  77. inbound.readdev = dev2;
  78. inbound.writedev = dev1;
  79. pthread_create(&t1, NULL, sniff_packets, (void *) &outbound);
  80. pthread_create(&t2, NULL, sniff_packets, (void *) &inbound);
  81. pthread_join(t1, NULL);
  82. pthread_join(t2, NULL);
  83. pthread_exit(NULL);
  84. crypto_locks_cleanup();
  85. return(0);
  86. }
  87. void *sniff_packets(void *args){
  88. pcap_t *rd_handle;
  89. pcap_t *wr_handle;
  90. char rd_errbuf[BUFSIZ];
  91. char wr_errbuf[BUFSIZ];
  92. uint8_t MAC[ETHER_ADDR_LEN];
  93. bpf_u_int32 mask;
  94. bpf_u_int32 net;
  95. char *readdev, *writedev;
  96. struct sniff_args *arg_st = (struct sniff_args *) args;
  97. readdev = arg_st->readdev;
  98. writedev = arg_st->writedev;
  99. //Find MAC address of each interface
  100. struct ifreq ifr;
  101. int s = socket(AF_INET, SOCK_DGRAM, 0);
  102. strcpy(ifr.ifr_name, writedev);
  103. ioctl(s, SIOCGIFHWADDR, &ifr);
  104. memcpy(MAC, ifr.ifr_hwaddr.sa_data, ETHER_ADDR_LEN);
  105. close(s);
  106. if (pcap_lookupnet(readdev, &net, &mask, rd_errbuf) == -1){
  107. fprintf(stderr, "Can't get netmask for device %s\n", readdev);
  108. exit(2);
  109. }
  110. rd_handle = pcap_open_live(readdev, BUFSIZ, 0, 0, rd_errbuf);
  111. if (rd_handle == NULL){
  112. fprintf(stderr, "Couldn't open device %s: %s\n", readdev, rd_errbuf);
  113. }
  114. if(pcap_datalink(rd_handle) != DLT_EN10MB) {
  115. fprintf(stderr, "Device %s does not provide Ethernet headers - not supported\n", readdev);
  116. exit(2);
  117. }
  118. if(pcap_setdirection(rd_handle, PCAP_D_IN)){
  119. fprintf(stderr, "Platform does not support write direction. Update filters with MAC address\n");
  120. exit(2);
  121. }
  122. wr_handle = pcap_open_live(writedev, BUFSIZ, 0, 0, wr_errbuf);
  123. if (wr_handle == NULL){
  124. fprintf(stderr, "Couldn't open device %s: %s\n", writedev, wr_errbuf);
  125. }
  126. struct inject_args iargs;
  127. iargs.mac_addr = MAC;
  128. iargs.write_dev = wr_handle;
  129. /*callback function*/
  130. pcap_loop(rd_handle, -1, got_packet, (unsigned char *) &iargs);
  131. /*Sniff a packet*/
  132. pcap_close(rd_handle);
  133. return NULL;
  134. }
  135. /**
  136. * Runs when pcap_loop receives a packet from the specified interface
  137. * If the received packet is a tcp packet, processes it and then writes it back out
  138. * to the interface
  139. *
  140. */
  141. void got_packet(uint8_t *args, const struct pcap_pkthdr *header, const uint8_t *packet){
  142. struct inject_args *iargs = (struct inject_args *) args;
  143. uint8_t *tmp_packet = smalloc(header->len);
  144. memcpy(tmp_packet, packet, header->len);
  145. process_packet(iargs, header, tmp_packet);
  146. }
  147. /* This function receives a full ip packet and then:
  148. * 1) identifies the flow
  149. * 2) adds the packet to the flow's data chain
  150. * 3) updates the flow's state
  151. */
  152. void process_packet(struct inject_args *iargs, const struct pcap_pkthdr *header, uint8_t *packet){
  153. struct packet_info *info = smalloc(sizeof(struct packet_info));
  154. extract_packet_headers(packet, info);
  155. //Ignore non-TCP packets (shouldn't actually get any)
  156. if((info->ip_hdr == NULL) || (info->tcp_hdr == NULL)){
  157. //free(info);
  158. //free(packet);
  159. //return;
  160. goto err;
  161. }
  162. /* Checks to see if this is a possibly tagged hello msg */
  163. if ((info->record_hdr != NULL) && (info->record_hdr->type == HS)){ /* This is a TLS handshake */
  164. check_handshake(info);
  165. }
  166. /* Now if flow is in table, update state */
  167. flow *observed;
  168. if((observed = check_flow(info)) != NULL){
  169. #ifdef DEBUG
  170. /*Check sequence number and replay application data if necessary*/
  171. fprintf(stdout,"Flow: %x:%d > %x:%d (%s)\n", info->ip_hdr->src.s_addr, ntohs(info->tcp_hdr->src_port), info->ip_hdr->dst.s_addr, ntohs(info->tcp_hdr->dst_port), (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? "incoming":"outgoing");
  172. fprintf(stdout,"ID number: %u\n", htonl(info->ip_hdr->id));
  173. fprintf(stdout,"Sequence number: %u\n", htonl(info->tcp_hdr->sequence_num));
  174. fprintf(stdout,"Acknowledgement number: %u\n", htonl(info->tcp_hdr->ack_num));
  175. #endif
  176. uint8_t incoming = (info->ip_hdr->src.s_addr != observed->src_ip.s_addr)? 1 : 0;
  177. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  178. uint32_t expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  179. #ifdef DEBUG
  180. fprintf(stdout,"Expected sequence number: %u\n", expected_seq);
  181. #endif
  182. /* Remove acknowledged data from queue after TCP window is exceeded */
  183. update_window_expiration(observed, info);
  184. /* fill with retransmit data, process new data */
  185. uint32_t data_to_fill;
  186. uint32_t data_to_process;
  187. if(seq_num > expected_seq){
  188. data_to_process = info->app_data_len;
  189. data_to_fill = 0;
  190. } else if (seq_num + info->app_data_len > expected_seq){
  191. data_to_fill = expected_seq - seq_num;
  192. data_to_process = seq_num + info->app_data_len - expected_seq;
  193. } else {
  194. data_to_fill = info->app_data_len;
  195. data_to_process = 0;
  196. }
  197. uint8_t *p = info->app_data;
  198. if(data_to_fill){ //retransmit
  199. printf("Retransmiting data (%u:%u)\n", seq_num, seq_num + info->app_data_len);
  200. retransmit(observed, info, data_to_fill);
  201. }
  202. p += data_to_fill;
  203. if(data_to_process){
  204. if(p != info->app_data){
  205. printf("UH OH something weird might happen\n");
  206. }
  207. if(observed->application){
  208. if(seq_num > expected_seq){
  209. //For now, enters into FORFEIT state
  210. //TODO: change upstream behaviour to try to mask slitheen hdr
  211. //printf("ERROR: future packet in app data, forfeiting flow\n");
  212. remove_flow(observed);
  213. goto err;
  214. }
  215. replace_packet(observed, info);
  216. } else {
  217. //We're still in the TLS handshake; hold packets misordered packets
  218. if(seq_num > expected_seq){
  219. //Delay and process later
  220. frame *new_frame = scalloc(1, sizeof(frame));
  221. new_frame->iargs = iargs;
  222. new_frame->packet = packet;
  223. new_frame->header = header;
  224. new_frame->seq_num = seq_num;
  225. new_frame->next = NULL;
  226. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  227. printf("Delay processing of frame (seq = %u )\n", seq_num);
  228. //add to end of list
  229. if(queue->first_frame == NULL){
  230. queue->first_frame = new_frame;
  231. } else {
  232. frame *last = queue->first_frame;
  233. while(last->next != NULL){
  234. last = last->next;
  235. }
  236. last->next = new_frame;
  237. }
  238. free(info);
  239. observed->ref_ctr--;
  240. printf("Misordered packet. %p ref_ctr %d\n", observed, observed->ref_ctr);
  241. return; //TODO: fix terrible spaghetti returns
  242. }
  243. /* Pass data to packet chain */
  244. if(observed->stall){
  245. }
  246. if(add_packet(observed, info)){//removed_flow
  247. goto err;
  248. }
  249. }
  250. /* Update TCP state */
  251. if(info->tcp_hdr->flags & (FIN | RST) ){
  252. /* Remove flow from table, connection ended */
  253. remove_flow(observed);
  254. goto err;
  255. }
  256. /* add packet to application data queue */
  257. save_packet(observed, info);
  258. }
  259. /*process and release held frames with current sequence numbers*/
  260. frame_queue *queue = (incoming) ? observed->ds_frame_queue : observed->us_frame_queue;
  261. frame *first = queue->first_frame;
  262. frame *prev = queue->first_frame;
  263. expected_seq = (incoming)? observed->downstream_seq_num : observed->upstream_seq_num;
  264. while (first != NULL){
  265. if(first->seq_num <= expected_seq){
  266. //remove from queue and process
  267. if(first == queue->first_frame) {
  268. queue->first_frame = first->next;
  269. } else {
  270. prev->next = first->next;
  271. }
  272. printf("Now processing frame (seq = %u )\n", first->seq_num);
  273. process_packet(iargs, first->header, first->packet);
  274. free(first);
  275. first = queue->first_frame;
  276. prev = queue->first_frame;
  277. } else {
  278. prev = first;
  279. first = first->next;
  280. }
  281. }
  282. observed->ref_ctr--;
  283. }
  284. //TODO: figure out how to not need this
  285. tcp_checksum(info);//update checksum
  286. err:
  287. free(info);//Note: don't free this while a thread is using it
  288. inject_packet(iargs, header, packet);
  289. return;
  290. }
  291. //TODO: rewrite this function to remove bloat
  292. void save_packet(flow *f, struct packet_info *info){
  293. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  294. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  295. //add new app block
  296. packet *new_block = scalloc(1, sizeof(packet));
  297. new_block->seq_num = htonl(info->tcp_hdr->sequence_num);
  298. new_block->data = scalloc(1, info->app_data_len);
  299. memcpy(new_block->data, info->app_data, info->app_data_len);
  300. new_block->len = info->app_data_len;
  301. new_block->next = NULL;
  302. new_block->expiration = 0;
  303. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  304. f->upstream_app_data->first_packet;
  305. //put app data block in queue
  306. if(saved_data == NULL){
  307. if(incoming){
  308. f->downstream_app_data->first_packet = new_block;
  309. if(new_block->seq_num ==
  310. f->downstream_seq_num){
  311. f->downstream_seq_num += new_block->len;
  312. #ifdef DEBUG
  313. printf("Updated downstream expected seqnum to %u\n",
  314. f->downstream_seq_num );
  315. #endif
  316. }
  317. } else {
  318. f->upstream_app_data->first_packet = new_block;
  319. if(new_block->seq_num ==
  320. f->upstream_seq_num){
  321. f->upstream_seq_num += new_block->len;
  322. #ifdef DEBUG
  323. printf("Updated upstream expected seqnum to %u\n",
  324. f->upstream_seq_num );
  325. #endif
  326. }
  327. }
  328. } else {
  329. uint8_t saved = 0;
  330. while(saved_data->next != NULL){
  331. if(!saved && (saved_data->next->seq_num > seq_num)){
  332. new_block->next = saved_data->next;
  333. saved_data->next = new_block;
  334. saved = 1;
  335. }
  336. //update expected sequence number
  337. if(incoming){
  338. if(saved_data->next->seq_num ==
  339. f->downstream_seq_num){
  340. f->downstream_seq_num += saved_data->next->len;
  341. #ifdef DEBUG
  342. printf("Updated downstream expected seqnum to %u\n",
  343. f->downstream_seq_num );
  344. #endif
  345. }
  346. } else {//outgoing
  347. if(saved_data->next->seq_num ==
  348. f->upstream_seq_num){
  349. f->upstream_seq_num += saved_data->next->len;
  350. #ifdef DEBUG
  351. printf("Updated upstream expected seqnum to %u\n",
  352. f->upstream_seq_num );
  353. #endif
  354. }
  355. }
  356. saved_data = saved_data->next;
  357. }
  358. if(!saved){
  359. saved_data->next = new_block;
  360. //update expected sequence number
  361. if(incoming){
  362. if(saved_data->next->seq_num ==
  363. f->downstream_seq_num){
  364. f->downstream_seq_num += saved_data->next->len;
  365. #ifdef DEBUG
  366. printf("Updated downstream expected seqnum to %u\n",
  367. f->downstream_seq_num );
  368. #endif
  369. }
  370. } else {//outgoing
  371. if(saved_data->next->seq_num ==
  372. f->upstream_seq_num){
  373. f->upstream_seq_num += saved_data->next->len;
  374. #ifdef DEBUG
  375. printf("Updated upstream expected seqnum to %u\n",
  376. f->upstream_seq_num );
  377. #endif
  378. }
  379. }
  380. }
  381. }
  382. }
  383. /**
  384. * This function cleans up data that has been acked, after the TCP window of the recipient has been
  385. * exceeded. This ensures that a retransmisson of the data will no longer occur.
  386. *
  387. * Sets the expiration for recent data base on the TCP window
  388. */
  389. void update_window_expiration(flow *f, struct packet_info *info){
  390. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  391. uint32_t ack_num = htonl(info->tcp_hdr->ack_num);
  392. uint32_t end_seq = htonl(info->tcp_hdr->sequence_num) + info->app_data_len - 1;
  393. uint32_t window = ack_num + htons(info->tcp_hdr->win_size);
  394. #ifdef DEBUG
  395. printf("Received sequence number %u\n", htonl(info->tcp_hdr->sequence_num));
  396. printf("Acknowledged up to %u with window expiring at %u\n", ack_num, window);
  397. printf("Removing all packets up to %u\n", end_seq);
  398. #endif
  399. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  400. f->upstream_app_data->first_packet;
  401. while((saved_data != NULL) && (saved_data->expiration != 0) && (end_seq > saved_data->expiration)){
  402. //remove entire block
  403. if(incoming){
  404. f->downstream_app_data->first_packet = saved_data->next;
  405. } else {
  406. f->upstream_app_data->first_packet = saved_data->next;
  407. }
  408. free(saved_data->data);
  409. free(saved_data);
  410. saved_data = (incoming)? f->downstream_app_data->first_packet :
  411. f->upstream_app_data->first_packet;
  412. #ifdef DEBUG
  413. if(saved_data != NULL){
  414. printf("Currently saved seq_num is now %u\n", saved_data->seq_num);
  415. } else {
  416. printf("Acked all data, queue is empty\n");
  417. }
  418. #endif
  419. }
  420. /* Update expiration for packets based on TCP window size */
  421. saved_data = (incoming)? f->upstream_app_data->first_packet :
  422. f->downstream_app_data->first_packet;
  423. while((saved_data != NULL) && (ack_num > saved_data->seq_num)){
  424. //update window
  425. if(ack_num >= saved_data->seq_num + saved_data->len){
  426. //remove entire block
  427. saved_data->expiration = window;
  428. }
  429. saved_data = saved_data->next;
  430. }
  431. }
  432. /**
  433. * This function retransmits previously sent (and possibly modified) data
  434. *
  435. */
  436. void retransmit(flow *f, struct packet_info *info, uint32_t data_to_fill){
  437. uint8_t *p = info->app_data;
  438. uint32_t seq_num = htonl(info->tcp_hdr->sequence_num);
  439. uint8_t incoming = (info->ip_hdr->src.s_addr != f->src_ip.s_addr)? 1 : 0;
  440. packet *saved_data = (incoming)? f->downstream_app_data->first_packet :
  441. f->upstream_app_data->first_packet;
  442. while(data_to_fill > 0){
  443. if(saved_data == NULL){
  444. //have already acked all data
  445. p += data_to_fill;
  446. seq_num += data_to_fill;
  447. data_to_fill -= data_to_fill;
  448. continue;
  449. }
  450. if(seq_num < saved_data->seq_num){
  451. //we are missing a block. Use what was given
  452. if(saved_data->seq_num - seq_num > data_to_fill){
  453. //skip the rest
  454. p += data_to_fill;
  455. seq_num += data_to_fill;
  456. data_to_fill -= data_to_fill;
  457. } else {
  458. p += saved_data->seq_num - seq_num;
  459. data_to_fill -= saved_data->seq_num - seq_num;
  460. seq_num += saved_data->seq_num - seq_num;
  461. }
  462. } else if ( seq_num == saved_data->seq_num) {
  463. if(data_to_fill >= saved_data->len){
  464. //exhaust this block and move onto next one
  465. memcpy(p, saved_data->data, saved_data->len);
  466. p += saved_data->len;
  467. seq_num += saved_data->len;
  468. data_to_fill -= saved_data->len;
  469. saved_data = saved_data->next;
  470. } else {
  471. //fill with partial block
  472. memcpy(p, saved_data->data, data_to_fill);
  473. p += data_to_fill;
  474. seq_num += data_to_fill;
  475. data_to_fill -= data_to_fill;
  476. }
  477. } else { //seq_num > saved_data->seq_num
  478. uint32_t offset = seq_num - saved_data->seq_num;
  479. if(offset > saved_data->len){
  480. saved_data = saved_data->next;
  481. offset -= saved_data->len;
  482. } else {
  483. if(data_to_fill > saved_data->len - offset){
  484. memcpy(p, saved_data->data + offset, saved_data->len - offset);
  485. p += saved_data->len - offset;
  486. seq_num += saved_data->len - offset;
  487. data_to_fill -= saved_data->len - offset;
  488. saved_data = saved_data->next;
  489. } else {
  490. memcpy(p, saved_data->data + offset, data_to_fill);
  491. p += data_to_fill;
  492. seq_num += data_to_fill;
  493. data_to_fill -= data_to_fill;
  494. }
  495. }
  496. }
  497. }
  498. tcp_checksum(info);//update checksum
  499. }