New encrypting tunnel seems to work !

diff --git a/ipif/Makefile b/ipif/Makefile
index 122a72e4b7d296ed6320ef1c815d25cc4a899066..c2e3a7f0d727ff7eb46ac31d1484477c9530cc85 100644 (file)
--- a/ipif/Makefile
+++ b/ipif/Makefile
@@ -30,12 +30,13 @@ libuserv=   $(libdir)/userv
 etcuserv=      $(etcdir)/userv
 services=      $(etcuserv)/services.d
 
-TARGETS=       service udptunnel-forwarder
+TARGETS=       service udptunnel-forwarder blowfishtest
 
 MECHFILES=     null pkcs5 timestamp sequence blowfish
 MECHOBJS=      $(foreach m, $(MECHFILES), mech-$m.o)
 
 OBJS_FORWARD=  forwarder.o $(MECHOBJS) blowfish.o automech.c utils.c
+OBJS_BFTEST=   blowfishtest.o blowfish.o hex.o
 
 all:           $(TARGETS)
 
@@ -49,8 +50,12 @@ install:     all
 udptunnel-forwarder:   $(OBJS_FORWARD)
                $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS_FORWARD)
 
+blowfishtest:          $(OBJS_BFTEST)
+               $(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(OBJS_BFTEST)
+
 automech.c automech.h:         automechgen.sh Makefile
                ./$< $(MECHFILES)
 
 forwarder.o $(MECHOBJS) automech.o utils.o:    forwarder.h automech.h
-blowfish.o mech-blowfish.o:                    blowfish.h
+blowfish.o mech-blowfish.o blowfishtest.o:     blowfish.h
+blowfishtest.o hex.o:                          hex.h

diff --git a/ipif/blowfishtest.c b/ipif/blowfishtest.c
index ad14194977f5ce90d79c8a1c90ad1a0d54cb400a..5b2fe57a20a93d75d791795981219fcb26627d2f 100644 (file)
--- a/ipif/blowfishtest.c
+++ b/ipif/blowfishtest.c
@@ -11,8 +11,8 @@
 int main(void) {
   char buf[200], keybuf[200], plainbuf[200], cipherbuf[200], comparebuf[200], ivbuf[200];
   char keytxt[sizeof(buf)+1], plaintxt[sizeof(buf)+1], ciphertxt[sizeof(buf)+1];
-  uint8 key[BLOWFISH_MAXKEYBYTES*2], plain[100], cipher[100], compare[100];
-  uint8 iv[BLOWFISH_BLOCKBYTES];
+  uint8_t key[BLOWFISH_MAXKEYBYTES*2], plain[100], cipher[100], compare[100];
+  uint8_t iv[BLOWFISH_BLOCKBYTES];
   int keysz, plainsz, ciphersz, cskey, csiv, csplain, i;
   struct blowfish_expandedkey ek;
   struct blowfish_cbc_state cs;

diff --git a/ipif/forwarder.c b/ipif/forwarder.c
index 58678329378e2bb04ac5c8b08e77c101bea138fb..d3a0f0fc24804bd882b00789dedd0e9ac700f26a 100644 (file)
--- a/ipif/forwarder.c
+++ b/ipif/forwarder.c
@@ -7,8 +7,8 @@
  *                      <encdec-keys-fd>
  *                      <mtu> <keepalive> <timeout>
  *                      <public-remote-addr> [<public-remote-port>]
- *                      !<mech1> [<mech1-params> ...]
- *                      !<mech2> [<mech2-params> ...]
+ *                      |<mech1> [<mech1-params> ...]
+ *                      |<mech2> [<mech2-params> ...]
  *                      ''
  *
  * Remote addr may '' to mean wait to receive a packet and reply to
@@ -19,6 +19,10 @@
  *    w   means generate and write encdec keys, rather than reading them
  *    K   means do crypto debug (use with care!)
  *
+ * encdec keys datastream has keys for packets from key datastream
+ * writer to reader first, then keys for packets from reader to
+ * writer.
+ *
  * Every must be numeric.  There is very little argument checking.
  *
  * Exit status:
@@ -71,8 +75,8 @@ static time_t nextsendka;
 
 static void cdebug(int mechno /*or -1*/, const char *msg) {
   if (!crypto_debug) return;
-  printf("%s: CRYPTO: %-20s %s\n",
-        programid,
+  printf("%-8.8s: CRYPTO: %-20s %s\n",
+        uname_result.nodename,
         mechno >= 0 ? mechs[mechno]->name : "",
         msg);
 }
@@ -127,6 +131,7 @@ void random_key(void *ptr, size_t sz) {
     write_must(encdec_keys_fd,ptr,sz,"write keys datastream");
   } else {
     read_must(encdec_keys_fd,ptr,sz,"read keys datastream");
+    cdebughex(-1, "random_key", ptr, sz, 0,0,0);
   }
 }
 
@@ -335,18 +340,26 @@ int main(int argc, const char *const *const argv_in) {
   maxprefix= 0;
   i= 0;
   while ((arg= *++argv)) {
-    arg_assert(*arg++ == '!');
+    arg_assert(*arg++ == '|');
     arg_assert(i <= MAXMECHS);
     mechs[i]= find_mech(arg);
-    cdebug(i,"encsetup");
 
+    cdebug(i,"writer->reader setup");
     argv_save= argv;
-    mechs[i]->encsetup(&md_out[i], &maxprefix, &maxsuffix);
+
+    if (encdec_keys_write)
+      mechs[i]->encsetup(&md_out[i], &maxprefix, &maxsuffix);
+    else
+      mechs[i]->decsetup(&md_in[i]);
 
     argv_done= argv;
     argv= argv_save;
-    cdebug(i,"decsetup");
-    mechs[i]->decsetup(&md_in[i]);
+    cdebug(i,"reader->writer setup");
+
+    if (encdec_keys_write)
+      mechs[i]->decsetup(&md_in[i]);
+    else
+      mechs[i]->encsetup(&md_out[i], &maxprefix, &maxsuffix);
 
     assert(argv == argv_done);
     

diff --git a/ipif/hex.c b/ipif/hex.c
index fd889a2d7ebe6584b0f2be785775805e9d9818ba..dc0c749124c3fc761f4f68f217a6dcd4b3cc615b 100644 (file)
--- a/ipif/hex.c
+++ b/ipif/hex.c
@@ -7,7 +7,7 @@
 
 #include "hex.h"
 
-const char *tohex(uint8 *data, int len, char *buf) {
+const char *tohex(uint8_t *data, int len, char *buf) {
   char *p;
   
   for (p= buf;
@@ -17,7 +17,7 @@ const char *tohex(uint8 *data, int len, char *buf) {
   return buf;
 }
 
-void unhex(const char *what, const char *txt, uint8 *datar, int *lenr,
+void unhex(const char *what, const char *txt, uint8_t *datar, int *lenr,
           int minlen, int maxlen) {
   int l, v;
   char buf[3], *ep;

diff --git a/ipif/hex.h b/ipif/hex.h
index e637f9aff428b3e8b198502987b46c1dd73ba4d4..5bce442483ff0f587f4a095d581cc56df5ee81f9 100644 (file)
--- a/ipif/hex.h
+++ b/ipif/hex.h
@@ -3,8 +3,10 @@
 #ifndef HEX__H_INCLUDED
 #define HEX__H_INCLUDED
 
-const char *tohex(uint8 *data, int len, char *buf);
-void unhex(const char *what, const char *txt, uint8 *datar, int *lenr,
+#include <stdint.h>
+
+const char *tohex(uint8_t *data, int len, char *buf);
+void unhex(const char *what, const char *txt, uint8_t *datar, int *lenr,
           int minlen, int maxlen);
 
 #endif

diff --git a/ipif/mech-blowfish.c b/ipif/mech-blowfish.c
index 7447cadb1d888a3ccd729f897c720ba9e5ca0018..65e3311cec21bea7f0b05baf0bf3f3114d6d4faa 100644 (file)
--- a/ipif/mech-blowfish.c
+++ b/ipif/mech-blowfish.c
@@ -13,13 +13,13 @@
 #include "blowfish.h"
 
 struct mechdata {
+  unsigned char iv[BLOWFISH_BLOCKBYTES];
   struct blowfish_cbc_state cbc;
 };
 
 static void mds_blowfish(struct mechdata **md_r) {
   struct mechdata *md;
   unsigned long keysize;
-  unsigned char iv[BLOWFISH_BLOCKBYTES];
   unsigned char key[BLOWFISH_MAXKEYBYTES];
 
   XMALLOC(md);
@@ -29,12 +29,10 @@ static void mds_blowfish(struct mechdata **md_r) {
   keysize >>= 3;
   arg_assert(keysize > 0 && keysize <= BLOWFISH_MAXKEYBYTES);
 
-  random_key(iv,sizeof(iv));
+  random_key(md->iv,sizeof(md->iv));
   random_key(key,keysize);
 
   blowfish_loadkey(&md->cbc.ek, key,keysize);
-  blowfish_cbc_setiv(&md->cbc, iv);
-
   *md_r= md;
 }
 
@@ -62,6 +60,7 @@ static void mes_bfmac(struct mechdata **md_r, int *maxprefix_io, int *maxsuffix_
 #define FOREACH_BLOCK(func,inptr,outptr)                             \
  {                                                                    \
    unsigned char *ptr;                                               \
+   blowfish_cbc_setiv(&md->cbc, md->iv);                              \
    for (ptr= buf->start;                                             \
         ptr < buf->start + msgsize;                                  \
        ptr += BLOWFISH_BLOCKBYTES) {                                 \

diff --git a/ipif/mech-pkcs5.c b/ipif/mech-pkcs5.c
index 6ff35cd2287ddab8026c84c6bb6403c1af4358b0..df4d91843b38e18cf57b7d4e5f91ab6022ea71fb 100644 (file)
--- a/ipif/mech-pkcs5.c
+++ b/ipif/mech-pkcs5.c
@@ -58,11 +58,11 @@ static const char *mdec_pkcs5(struct mechdata *md, struct buffer *buf) {
   unsigned padlen;
   int i;
 
-  BUF_UNPREPEND(padp,buf,1);
+  BUF_UNAPPEND(padp,buf,1);
   padlen= *padp;
-  if (!padlen || (padlen & ~md->mask)) return "invalid length";
+  if (!padlen || (padlen > md->mask+1)) return "invalid length";
 
-  BUF_UNPREPEND(padp,buf,padlen-1);
+  BUF_UNAPPEND(padp,buf,padlen-1);
   for (i=0; i<padlen-1; i++)
     if (*++padp != padlen) return "corrupted padding";
 

diff --git a/ipif/mech-timestamp.c b/ipif/mech-timestamp.c
index e250c084d89f87fe26472618c7eae06afd2feffd..226f23f830d135a204fef14f4c110c4b054e3847 100644 (file)
--- a/ipif/mech-timestamp.c
+++ b/ipif/mech-timestamp.c
@@ -17,7 +17,7 @@
 #include "forwarder.h"
 
 struct mechdata {
-  uint32_t max_skew, max_age;
+  time_t max_skew, max_age;
 };
 
 static void mds_timestamp(struct mechdata **md_r) {
@@ -56,7 +56,7 @@ static const char *mdec_timestamp(struct mechdata *md, struct buffer *buf) {
       return cbuf;
     }
   } else if (age < 0) {
-    if (md->max_skew && age > md->max_skew) {
+    if (md->max_skew && age < -md->max_skew) {
       sprintf(cbuf,"too much skew (%lds)",-age);
       return cbuf;
     }

diff --git a/ipif/udptunnel b/ipif/udptunnel
index e52ee73bad0cdb846a1fda77df601a0012c76393..bb48d1d4547373abe95a5d446c635efb41448d16 100755 (executable)
--- a/ipif/udptunnel
+++ b/ipif/udptunnel
@@ -189,7 +189,7 @@ while ($ARGV[0] =~ m/^-/) {
            $encrarg= arg_value($_,'-e');
            push @remoteopts, "-e$encrarg";
            @thisencryption= split m#/#, $encrarg;
-           $thisencryption[0] =~ s/^/\!/;
+           $thisencryption[0] =~ s/^/\|/;
            push @encryption, @thisencryption;
        } elsif (s/^-m/-/) {
            $masq= 1;