diff --git a/SSU.cpp b/SSU.cpp index e77ccb66..5cb7cfe5 100644 --- a/SSU.cpp +++ b/SSU.cpp @@ -1,5 +1,7 @@ +#include #include #include "Log.h" +#include "RouterContext.h" #include "hmac.h" #include "SSU.h" @@ -8,22 +10,94 @@ namespace i2p namespace ssu { - SSUSession::SSUSession (): m_State (eSessionStateUnknown) + SSUSession::SSUSession (SSUServer * server, const boost::asio::ip::udp::endpoint& remoteEndpoint, + i2p::data::RouterInfo * router): m_Server (server), m_RemoteEndpoint (remoteEndpoint), + m_State (eSessionStateUnknown) { } - void SSUSession::ProcessNextMessage (uint8_t * buf, std::size_t len) + void SSUSession::ProcessNextMessage (uint8_t * buf, size_t len) { switch (m_State) { + case eSessionStateUnknown: + // we assume session request + ProcessSessionRequest (buf, len); + break; default: LogPrint ("SSU state not implemented yet"); } } - void SSUSession::Authenticate (uint8_t * buf, size_t len, uint8_t * aesKey, uint8_t * iv, uint8_t * macKey) + void SSUSession::ProcessSessionRequest (uint8_t * buf, size_t len) + { + auto address = i2p::context.GetRouterInfo ().GetSSUAddress (); + if (address) + { + // use intro key for verification and decryption + if (Validate (buf, len, address->key)) + { + m_State = eSessionStateRequestReceived; + LogPrint ("Session request received"); + Decrypt (buf, len, address->key); + // TODO: + } + else + LogPrint ("MAC verifcation failed"); + } + else + LogPrint ("SSU is not supported"); + } + + void SSUSession::Encrypt (uint8_t * buf, size_t len, uint8_t * aesKey, uint8_t * iv, uint8_t * macKey) { + if (len < sizeof (SSUHeader)) + { + LogPrint ("Unexpected SSU packet length ", len); + return; + } + SSUHeader * header = (SSUHeader *)buf; + memcpy (header->iv, iv, 16); + uint8_t * encrypted = &header->flag; + uint16_t encryptedLen = len - (encrypted - buf); m_Encryption.SetKeyWithIV (aesKey, 32, iv); + m_Encryption.ProcessData (encrypted, encrypted, encryptedLen); + // assume actual buffer size is 18 (16 + 2) bytes more + memcpy (buf + len, iv, 16); + *(uint16_t *)(buf + len + 16) = htobe16 (encryptedLen); + i2p::crypto::HMACMD5Digest (encrypted, encryptedLen + 18, macKey, header->mac); + } + + void SSUSession::Decrypt (uint8_t * buf, size_t len, uint8_t * aesKey) + { + if (len < sizeof (SSUHeader)) + { + LogPrint ("Unexpected SSU packet length ", len); + return; + } + SSUHeader * header = (SSUHeader *)buf; + uint8_t * encrypted = &header->flag; + uint16_t encryptedLen = len - (encrypted - buf); + m_Decryption.SetKeyWithIV (aesKey, 32, header->iv); + m_Decryption.ProcessData (encrypted, encrypted, encryptedLen); + } + + bool SSUSession::Validate (uint8_t * buf, size_t len, uint8_t * macKey) + { + if (len < sizeof (SSUHeader)) + { + LogPrint ("Unexpected SSU packet length ", len); + return false; + } + SSUHeader * header = (SSUHeader *)buf; + uint8_t * encrypted = &header->flag; + uint16_t encryptedLen = len - (encrypted - buf); + // assume actual buffer size is 18 (16 + 2) bytes more + memcpy (buf + len, header->iv, 16); + *(uint16_t *)(buf + len + 16) = htobe16 (encryptedLen); + uint8_t digest[16]; + i2p::crypto::HMACMD5Digest (encrypted, encryptedLen + 18, macKey, digest); + return !memcmp (header->mac, digest, 16); } SSUServer::SSUServer (boost::asio::io_service& service, int port): @@ -47,6 +121,11 @@ namespace ssu m_Socket.close (); } + void SSUServer::Send (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& to) + { + m_Socket.send_to (boost::asio::buffer (buf, len), to); + } + void SSUServer::Receive () { m_Socket.async_receive_from (boost::asio::buffer (m_ReceiveBuffer, SSU_MTU), m_SenderEndpoint, @@ -62,9 +141,9 @@ namespace ssu auto it = m_Sessions.find (m_SenderEndpoint); if (it != m_Sessions.end ()) session = it->second; - if (session) + if (!session) { - session = new SSUSession (); + session = new SSUSession (this, m_SenderEndpoint); m_Sessions[m_SenderEndpoint] = session; LogPrint ("New SSU session from ", m_SenderEndpoint.address ().to_string (), ":", m_SenderEndpoint.port (), " created"); } @@ -74,6 +153,33 @@ namespace ssu else LogPrint ("SSU receive error: ", ecode.message ()); } + + SSUSession * SSUServer::GetSession (i2p::data::RouterInfo * router) + { + SSUSession * session = nullptr; + if (router) + { + auto address = router->GetSSUAddress (); + if (address) + { + boost::asio::ip::udp::endpoint remoteEndpoint (address->host, address->port); + auto it = m_Sessions.find (remoteEndpoint); + if (it != m_Sessions.end ()) + session = it->second; + else + { + // otherwise create new session + session = new SSUSession (this, remoteEndpoint, router); + m_Sessions[remoteEndpoint] = session; + LogPrint ("New SSU session to [", router->GetIdentHashAbbreviation (), "] ", + remoteEndpoint.address ().to_string (), ":", remoteEndpoint.port (), " created"); + } + } + else + LogPrint ("Router ", router->GetIdentHashAbbreviation (), " doesn't have SSU address"); + } + return session; + } } } diff --git a/SSU.h b/SSU.h index 073184f3..0b4843bf 100644 --- a/SSU.h +++ b/SSU.h @@ -7,6 +7,7 @@ #include #include #include "I2PEndian.h" +#include "RouterInfo.h" namespace i2p { @@ -46,21 +47,30 @@ namespace ssu eSessionStateEstablised }; + class SSUServer; class SSUSession { public: - SSUSession (); - void ProcessNextMessage (uint8_t * buf, size_t len); - + SSUSession (SSUServer * server, const boost::asio::ip::udp::endpoint& remoteEndpoint, + i2p::data::RouterInfo * router = nullptr); + void ProcessNextMessage (uint8_t * buf, size_t len); + private: - void Authenticate (uint8_t * buf, size_t len, uint8_t * aesKey, uint8_t * iv, uint8_t * macKey); + void ProcessSessionRequest (uint8_t * buf, size_t len); + + void Encrypt (uint8_t * buf, size_t len, uint8_t * aesKey, uint8_t * iv, uint8_t * macKey); + void Decrypt (uint8_t * buf, size_t len, uint8_t * aesKey); + bool Validate (uint8_t * buf, size_t len, uint8_t * macKey); private: + SSUServer * m_Server; + boost::asio::ip::udp::endpoint m_RemoteEndpoint; SessionState m_State; - CryptoPP::CBC_Mode::Encryption m_Encryption; + CryptoPP::CBC_Mode::Encryption m_Encryption; + CryptoPP::CBC_Mode::Decryption m_Decryption; }; class SSUServer @@ -71,6 +81,9 @@ namespace ssu ~SSUServer (); void Start (); void Stop (); + SSUSession * GetSession (i2p::data::RouterInfo * router); + + void Send (uint8_t * buf, size_t len, const boost::asio::ip::udp::endpoint& to); private: @@ -81,7 +94,7 @@ namespace ssu boost::asio::ip::udp::socket m_Socket; boost::asio::ip::udp::endpoint m_SenderEndpoint; - uint8_t m_ReceiveBuffer[SSU_MTU]; + uint8_t m_ReceiveBuffer[2*SSU_MTU]; std::map m_Sessions; }; }