From 50c74957dd3384f817e6018f0a40647a9153d904 Mon Sep 17 00:00:00 2001 Message-Id: <50c74957dd3384f817e6018f0a40647a9153d904.1715013784.git.mdw@distorted.org.uk> From: Mark Wooding Date: Tue, 19 Jun 2001 22:11:14 +0000 Subject: [PATCH] The beginnings of a malicious proxy for TrIPE. Organization: Straylight/Edgeware From: mdw --- mallory.c | 682 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 682 insertions(+) create mode 100644 mallory.c diff --git a/mallory.c b/mallory.c new file mode 100644 index 00000000..267e9d47 --- /dev/null +++ b/mallory.c @@ -0,0 +1,682 @@ +/* -*-c-*- + * + * $Id: mallory.c,v 1.1 2001/06/19 22:11:14 mdw Exp $ + * + * An evil proxy for TrIPE + * + * (c) 2001 Straylight/Edgeware + */ + +/*----- Licensing notice --------------------------------------------------* + * + * This file is part of Trivial IP Encryption (TrIPE). + * + * TrIPE is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * TrIPE is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with TrIPE; if not, write to the Free Software Foundation, + * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + +/*----- Revision history --------------------------------------------------* + * + * $Log: mallory.c,v $ + * Revision 1.1 2001/06/19 22:11:14 mdw + * The beginnings of a malicious proxy for TrIPE. + * + */ + +/*----- Header files ------------------------------------------------------*/ + +#include "config.h" + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +#include +#include +#include +#include + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include + +#include +#include +#include +#include + +#include +#include +#include + +#include "buf.h" + +/*----- Data structures ---------------------------------------------------*/ + +typedef struct peer { + sel_file sf; + dh_pub kpub; + const char *name; + struct filter *f; +} peer; + +typedef struct filter { + struct filter *next; + peer *p_from, *p_to; + void (*func)(struct filter */*f*/, const octet */*buf*/, size_t /*sz*/); + void *state; +} filter; + +typedef struct qnode { + octet *buf; + size_t sz; +} qnode; + +/*----- Static variables --------------------------------------------------*/ + +#define PKBUFSZ 65536 + +static sel_state sel; +static peer peers[2]; +static unsigned npeer = 0; +static key_file keys; +static grand *rng; + +#define PASS(f, buf, sz) ((f) ? (f)->func((f), (buf), (sz)) : (void)0) +#define RND(i) (rng->ops->range(rng, (i))) + +/*----- Peer management ---------------------------------------------------*/ + +static void dopacket(int fd, unsigned mode, void *vv) +{ + octet buf[PKBUFSZ]; + peer *p = vv; + int r = read(fd, buf, sizeof(buf)); + if (r >= 0) { + printf("recv from `%s'\n", p->name); + PASS(p->f, buf, r); + } +} + +static void addpeer(unsigned ac, char **av) +{ + key_packstruct kps[DH_PUBFETCHSZ]; + key_packdef *kp; + struct hostent *h; + struct sockaddr_in sin; + int len = PKBUFSZ; + peer *p; + int fd; + int e; + + if (ac != 4) + die(1, "syntax: peer:NAME:PORT:ADDR:PORT"); + if (npeer >= 2) + die(1, "enough peers already"); + p = &peers[npeer++]; + p->name = xstrdup(av[0]); + kp = key_fetchinit(dh_pubfetch, kps, &p->kpub); + e = key_fetchbyname(kp, &keys, av[0]); + key_fetchdone(kp); + if (e) + die(1, "key_fetch `%s': %s", av[0], key_strerror(e)); + if ((fd = socket(PF_INET, SOCK_DGRAM, 0)) < 0) + die(1, "socket: %s", strerror(errno)); + fdflags(fd, O_NONBLOCK, O_NONBLOCK, FD_CLOEXEC, FD_CLOEXEC); + memset(&sin, 0, sizeof(sin)); + sin.sin_family = AF_INET; + sin.sin_addr.s_addr = INADDR_ANY; + sin.sin_port = htons(atoi(av[1])); + if (bind(fd, (struct sockaddr *)&sin, sizeof(sin))) + die(1, "bind: %s", strerror(errno)); + memset(&sin, 0, sizeof(sin)); + sin.sin_family = AF_INET; + if ((h = gethostbyname(av[2])) == 0) + die(1, "gethostbyname `%s'", av[2]); + if (setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &len, sizeof(len)) || + setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &len, sizeof(len))) + die(1, "setsockopt: %s", strerror(errno)); + memcpy(&sin.sin_addr, h->h_addr, sizeof(sin.sin_addr)); + sin.sin_port = htons(atoi(av[3])); + if (connect(fd, (struct sockaddr *)&sin, sizeof(sin))) + die(1, "connect: %s", strerror(errno)); + sel_initfile(&sel, &p->sf, fd, SEL_READ, dopacket, p); + sel_addfile(&p->sf); +} + +/*----- Fork filter -------------------------------------------------------*/ + +typedef struct forknode { + struct forknode *next; + filter *f; +} forknode; + +typedef struct forkfilt { + const char *name; + forknode *fn; +} forkfilt; + +static void dofork(filter *f, const octet *buf, size_t sz) +{ + forkfilt *ff = f->state; + forknode *fn; + unsigned i = 0; + + ff = f->state; + for (fn = ff->fn; fn; fn = fn->next) { + printf("fork branch %u of fork `%s'\n", i++, ff->name); + PASS(fn->f, buf, sz); + } + printf("fork branch %u of fork `%s'\n", i++, ff->name); + PASS(f->next, buf, sz); +} + +static void addfork(filter *f, unsigned ac, char **av) +{ + forkfilt *ff; + if (ac != 1) + die(1, "syntax: filt:fork:NAME"); + ff = CREATE(forkfilt); + ff->name = xstrdup(av[0]); + ff->fn = 0; + f->func = dofork; + f->state = ff; +} + +static void nextfork(unsigned ac, char **av) +{ + unsigned i; + filter *f; + forkfilt *ff; + forknode *fn, **ffn; + peer *p; + + for (i = 0; i < 2; i++) { + p = &peers[i]; + for (f = p->f; f; f = f->next) { + if (f->func != dofork) + continue; + ff = f->state; + fn = CREATE(forknode); + for (ffn = &ff->fn; *ffn; ffn = &(*ffn)->next) + ; + fn->f = f->next; + f->next = 0; + fn->next = 0; + *ffn = fn; + } + } +} + +/*----- Corrupt filter ----------------------------------------------------*/ + +typedef struct corrupt { + unsigned p_corrupt; +} corrupt; + +static void docorrupt(filter *f, const octet *buf, size_t sz) +{ + corrupt *c = f->state; + octet b[PKBUFSZ]; + memcpy(b, buf, sz); + + while (!RND(c->p_corrupt)) { + puts("corrupt packet"); + b[RND(sz)] ^= RND(256); + } + PASS(f->next, b, sz); +} + +static void addcorrupt(filter *f, unsigned ac, char **av) +{ + corrupt *c; + if (ac > 1) + die(1, "syntax: filt:corrupt[:PCORRUPT]"); + c = CREATE(corrupt); + if (ac > 0) + c->p_corrupt = atoi(av[0]); + else + c->p_corrupt = 5; + f->state = c; + f->func = docorrupt; +} + +/*----- Delay filter ------------------------------------------------------*/ + +typedef struct delaynode { + unsigned flag; + sel_timer tm; + unsigned i; + struct delay *d; + octet *buf; + size_t sz; + unsigned seq; +} delaynode; + +typedef struct delay { + unsigned max, n; + unsigned long t; + unsigned p_replay; + filter *f; + delaynode *q; +} delay; + +static void dtimer(struct timeval *tv, void *vv); + +static void dinsert(delaynode *dn) +{ + struct timeval tv; + sel_timer *ta, *tb; + unsigned long tdelta = RND(dn->d->t); + gettimeofday(&tv, 0); + TV_ADDL(&tv, &tv, 0, tdelta); + assert(!dn->flag); + sel_addtimer(&sel, &dn->tm, &tv, dtimer, dn); + dn->flag = 1; + for (ta = tb = sel.timers; ta; ta = ta->next) { + ta = ta->next; if (!ta) break; assert(ta != tb); + ta = ta->next; if (!ta) break; assert(ta != tb); + tb = tb->next; + } + printf(" delay %lu usecs", tdelta); +} + +static void dsend(delaynode *dn, unsigned force) +{ + delay *d = dn->d; + delaynode *ddn; + fputs(" send...\n", stdout); + assert(dn->buf); + PASS(d->f->next, dn->buf, dn->sz); + fputs("delay ...", stdout); + if (!force) + dinsert(dn); + else { + xfree(dn->buf); + dn->buf = 0; + d->n--; + if (dn->i < d->n) { + ddn = &d->q[d->n]; + sel_rmtimer(&ddn->tm); + sel_addtimer(&sel, &dn->tm, &ddn->tm.tv, dtimer, dn); + dn->flag = 1; + dn->buf = ddn->buf; + dn->sz = ddn->sz; + dn->seq = ddn->seq; + ddn->buf = 0; + ddn->flag = 0; + printf(" move id %u from slot %u to slot %u", ddn->seq, ddn->i, dn->i); + } + { unsigned i; for (i = 0; i < d->n; i++) assert(d->q[i].buf); } + fputs(" remove", stdout); + } +} + +static void dtimer(struct timeval *tv, void *vv) +{ + delaynode *dn = vv; + printf("delay timer peer `%s' id %u slot %u", + dn->d->f->p_from->name, dn->seq, dn->i); + dn->flag = 0; + dsend(dn, RND(dn->d->p_replay)); + fputc('\n', stdout); +} + +static void dodelay(filter *f, const octet *buf, size_t sz) +{ + delay *d = f->state; + delaynode *dn; + static unsigned seq = 0; + + fputs("delay", stdout); + if (d->n == d->max) { + dn = &d->q[RND(d->n)]; + printf(" force uid %u", dn->seq); + sel_rmtimer(&dn->tm); + dn->flag = 0; + dsend(dn, 1); + fputc(';', stdout); + } + dn = &d->q[d->n++]; + dn->seq = seq++; + printf(" new id %u in slot %u", dn->seq, dn->i); + dn->buf = xmalloc(sz); + dn->sz = sz; + memcpy(dn->buf, buf, sz); + dinsert(dn); + fputc('\n', stdout); +} + +static void adddelay(filter *f, unsigned ac, char **av) +{ + delay *d; + unsigned i; + + if (ac < 1 || ac > 3) + die(1, "syntax: filt:delay:QLEN[:MILLIS:PREPLAY]"); + d = CREATE(delay); + d->max = atoi(av[0]); + if (ac > 1) + d->t = strtoul(av[1], 0, 10); + else + d->t = 100; + d->t *= 1000; + if (ac > 2) + d->p_replay = atoi(av[2]); + else + d->p_replay = 20; + d->n = 0; + d->q = xmalloc(d->max * sizeof(delaynode)); + d->f = f; + f->state = d; + f->func = dodelay; + for (i = 0; i < d->max; i++) { + d->q[i].d = d; + d->q[i].i = i; + d->q[i].buf = 0; + d->q[i].flag = 0; + } +} + +/*----- Filters -----------------------------------------------------------*/ + +static void dosend(filter *f, const octet *buf, size_t sz) +{ + printf("send to `%s'\n", f->p_to->name); + write(f->p_to->sf.fd, buf, sz); +} + +static void addsend(filter *f, unsigned ac, char **av) +{ + if (ac) + die(1, "syntax: filt:send"); + f->func = dosend; +} + +const struct filtab { + const char *name; + void (*func)(filter */*f*/, unsigned /*ac*/, char **/*av*/); +} filtab[] = { + { "send", addsend }, + { "fork", addfork }, + { "delay", adddelay }, + { "corrupt", addcorrupt }, + { 0, 0 } +}; + +static void dofilter(peer *from, peer *to, unsigned ac, char **av) +{ + filter **ff, *f = CREATE(filter); + const struct filtab *ft; + if (ac < 1) + die(1, "syntax: {l,r,}filt:NAME:..."); + f->next = 0; + f->p_from = from; + f->p_to = to; + f->state = 0; + for (ff = &from->f; *ff; ff = &(*ff)->next) + ; + *ff = f; + for (ft = filtab; ft->name; ft++) { + if (strcmp(av[0], ft->name) == 0) { + ft->func(f, ac - 1, av + 1); + return; + } + } + die(1, "unknown filter `%s'", av[0]); +} + +/*----- Flooding ----------------------------------------------------------*/ + +typedef struct flood { + peer *p; + unsigned type; + size_t sz; + unsigned long t; + sel_timer tm; +} flood; + +static void setflood(flood *f); + +static void floodtimer(struct timeval *tv, void *vv) +{ + flood *f = vv; + octet buf[PKBUFSZ]; + size_t sz; + + sz = RND(f->sz); + sz += RND(f->sz); + sz += RND(f->sz); + sz += RND(f->sz); + sz /= 2; + + rng->ops->fill(rng, buf, sz); + if (f->type < 0x100) + buf[0] = f->type; + puts("flood packet"); + PASS(f->p->f, buf, sz); + setflood(f); +} + +static void setflood(flood *f) +{ + struct timeval tv; + gettimeofday(&tv, 0); + TV_ADDL(&tv, &tv, 0, RND(f->t)); + sel_addtimer(&sel, &f->tm, &tv, floodtimer, f); +} + +static void doflood(peer *p, unsigned ac, char **av) +{ + flood *f; + if (ac > 3) + die(1, "syntax: flood[:TYPE:MILLIS:SIZE]"); + f = CREATE(flood); + f->p = p; + if (ac > 0) + f->type = strtoul(av[0], 0, 16); + else + f->type = 0x100; + if (ac > 1) + f->t = atoi(av[1]); + else + f->t = 10; + if (ac > 2) + f->sz = atoi(av[2]); + else + f->sz = 128; + f->t *= 1000; + setflood(f); +} + +/*----- Configuration commands --------------------------------------------*/ + +static void parse(char *p); + +static void addflood(unsigned ac, char **av) { + doflood(&peers[0], ac, av); + doflood(&peers[1], ac, av); +} +static void addlflood(unsigned ac, char **av) { + doflood(&peers[0], ac, av); +} +static void addrflood(unsigned ac, char **av) { + doflood(&peers[1], ac, av); +} + +static void addfilter(unsigned ac, char **av) { + dofilter(&peers[0], &peers[1], ac, av); + dofilter(&peers[1], &peers[0], ac, av); +} +static void addlfilter(unsigned ac, char **av) { + dofilter(&peers[0], &peers[1], ac, av); +} +static void addrfilter(unsigned ac, char **av) { + dofilter(&peers[1], &peers[0], ac, av); +} + +static void include(unsigned ac, char **av) +{ + FILE *fp; + dstr d = DSTR_INIT; + if (!ac) + die(1, "syntax: include:FILE:..."); + while (*av) { + if ((fp = fopen(*av, "r")) == 0) + die(1, "fopen `%s': %s", *av, strerror(errno)); + while (dstr_putline(&d, fp) != EOF) { + parse(d.buf); + DRESET(&d); + } + fclose(fp); + av++; + } +} + +const struct cmdtab { + const char *name; + void (*func)(unsigned /*ac*/, char **/*av*/); +} cmdtab[] = { + { "peer", addpeer }, + { "include", include }, + { "filt", addfilter }, + { "lfilt", addlfilter }, + { "rfilt", addrfilter }, + { "next", nextfork }, + { "flood", addflood }, + { "lflood", addlflood }, + { "rflood", addrflood }, + { 0, 0 } +}; + +#define AVMAX 16 + +static void parse(char *p) +{ + char *v[AVMAX]; + unsigned c = 0; + const struct cmdtab *ct; + + p = strtok(p, ":"); + if (!p || *p == '#') + return; + do { + v[c++] = p; + p = strtok(0, ":"); + } while (p && c < AVMAX - 1); + v[c] = 0; + for (ct = cmdtab; ct->name; ct++) { + if (strcmp(ct->name, v[0]) == 0) { + ct->func(c - 1, v + 1); + return; + } + } + die(1, "unknown command `%s'", v[0]); +} + +/*----- Main driver -------------------------------------------------------*/ + +static void version(FILE *fp) +{ + pquis(fp, "$, TrIPE version " VERSION "\n"); +} + +static void usage(FILE *fp) +{ + pquis(fp, "Usage: $ [-k keyring] directive...\n"); +} + +static void help(FILE *fp) +{ + version(fp); + putc('\n', fp); + usage(fp); +} + +int main(int argc, char *argv[]) +{ + const char *kfname = "keyring.pub"; + int i; + unsigned f = 0; + char buf[16]; + +#define f_bogus 1u + + ego(argv[0]); + for (;;) { + static const struct option opt[] = { + { "help", 0, 0, 'h' }, + { "version", 0, 0, 'v' }, + { "usage", 0, 0, 'u' }, + { "keyring", OPTF_ARGREQ, 0, 'k' }, + { 0, 0, 0, 0 } + }; + if ((i = mdwopt(argc, argv, "hvuk:", opt, 0, 0, 0)) < 0) + break; + switch (i) { + case 'h': + help(stdout); + exit(0); + case 'v': + version(stdout); + exit(0); + case 'u': + usage(stdout); + exit(0); + case 'k': + kfname = optarg; + break; + default: + f |= f_bogus; + break; + } + } + if (f & f_bogus) { + usage(stderr); + exit(1); + } + rand_noisesrc(RAND_GLOBAL, &noise_source); + rand_seed(RAND_GLOBAL, 160); + rand_get(RAND_GLOBAL, buf, sizeof(buf)); + rng = rc4_rand(buf, sizeof(buf)); + sel_init(&sel); + if (key_open(&keys, kfname, KOPEN_READ, key_moan, 0)) + die(1, "couldn't open `%s': %s", kfname, strerror(errno)); + for (i = optind; i < argc; i++) + parse(argv[i]); + if (npeer != 2) + die(1, "need two peers"); + for (;;) + sel_select(&sel); + +#undef f_bogus +} + +/*----- That's all, folks -------------------------------------------------*/ -- [mdw]