stun

commit a277455f7772361c9a3f4a68c33fe539f7435267
parent fdcdd2572d4476996b65742a8cce502a321bea0c
Author: sin <sin@2f30.org>
Date:   Wed, 30 Mar 2016 09:12:36 +0100

Switch to aes-256-gcm

Diffstat:
M
stun.c
 | 
64
++++++++++++++++++++++++++++++++++++++++++++++++----------------

1 file changed, 48 insertions(+), 16 deletions(-)
diff --git a/stun.c b/stun.c
@@ -22,7 +22,7 @@
  * The sender verifies that the correct response was received.
  *
  * All communication is encrypted using a pre-shared symmetric key, currently
- * using aes-256-cbc hashed with sha512.
+ * using aes-256-gcm hashed with sha512.
  *
  * All tunneled traffic is encapsulated inside the TCP payload.
  * The packet format is shown below:
@@ -80,9 +80,10 @@
 #define RECONNECTTIMEO	60 /* in seconds */
 #define HDRLEN		2
 #define IVLEN		16
+#define TAGLEN		16
 #define PKTLENMASK	0xfff
 #define BADPKT		0x8000
-#define MTU		1424
+#define MTU		1400
 
 enum {
 	TUNDEV,
@@ -167,7 +168,7 @@ prepkey(unsigned char *pw, int pwlen)
 {
 	int ret, nrounds = 5;
 
-	ret = EVP_BytesToKey(EVP_aes_256_cbc(), EVP_sha512(),
+	ret = EVP_BytesToKey(EVP_aes_256_gcm(), EVP_sha512(),
 	                     NULL, pw, pwlen, nrounds, aeskey, NULL);
 	if (ret != 32)
 		logerr("wrong key size %d", ret);
@@ -184,31 +185,56 @@ aesinit(EVP_CIPHER_CTX *ectx, EVP_CIPHER_CTX *dctx)
 
 int
 aesenc(EVP_CIPHER_CTX *ctx, unsigned char *ct, unsigned char *pt, int plen,
-       unsigned char *key, unsigned char *iv)
+       unsigned char *key, unsigned char *iv, unsigned char *tag, int taglen)
 {
 	int clen, flen;
 
-	if (EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv) != 1)
+	if (EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL) != 1)
 		logerr("EVP_EncryptInit_ex failed");
+
+	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, IVLEN, NULL) != 1)
+		logerr("EVP_CTRL_GCM_SET_IVLEN failed");
+
+	if (EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv) != 1)
+		logerr("EVP_EncryptInit_ex failed");
+
 	if (EVP_EncryptUpdate(ctx, ct, &clen, pt, plen) != 1)
 		logerr("EVP_EncryptUpdate failed");
+
 	if (EVP_EncryptFinal_ex(ctx, ct + clen, &flen) != 1)
 		logerr("EVP_EncryptFinal_ex failed");
+
+	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, TAGLEN, tag) != 1)
+		logerr("EVP_CTRL_GCM_GET_TAG failed");
+
 	return clen + flen;
 }
 
 int
 aesdec(EVP_CIPHER_CTX *ctx, unsigned char *pt, unsigned char *ct, int clen,
-       unsigned char *key, unsigned char *iv)
+       unsigned char *key, unsigned char *iv, unsigned char *tag, int taglen)
 {
 	int plen, flen;
 
-	if (EVP_DecryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv) != 1)
+	if (EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), NULL, NULL, NULL) != 1)
+		logerr("EVP_DecryptInit_ex failed");
+
+	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, IVLEN, NULL) != 1)
+		logerr("EVP_CTRL_GCM_SET_IVLEN failed");
+
+	if (EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv) != 1)
 		logerr("EVP_DecryptInit_ex failed");
+
 	if (EVP_DecryptUpdate(ctx, pt, &plen, ct, clen) != 1)
 		logerr("EVP_DecryptUpdate failed");
+
+	if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, TAGLEN, tag) != 1)
+		logerr("EVP_CTRL_GCM_SET_TAG failed");
+
+	/* if this fails, someone has tampered with the packet in transit */
 	if (EVP_DecryptFinal_ex(ctx, pt + plen, &flen) != 1)
-		logerr("EVP_DecryptFinal_ex failed");
+		return -1;
+
 	return plen + flen;
 }
 
@@ -429,17 +455,17 @@ int
 writenet(int fd, unsigned char *pt, int len)
 {
 	unsigned char payload[MTU + AES_BLOCK_SIZE];
-	unsigned char hdr[HDRLEN];
-	unsigned char iv[IVLEN];
-	unsigned char pkt[sizeof(hdr) + sizeof(payload) + sizeof(iv)];
+	unsigned char hdr[HDRLEN], iv[IVLEN], tag[TAGLEN];
+	unsigned char pkt[sizeof(hdr) + sizeof(payload) + sizeof(iv) + sizeof(tag)];
 
 	arc4random_buf(iv, IVLEN);
-	len = aesenc(&ectx, payload, pt, len, aeskey, iv);
+	len = aesenc(&ectx, payload, pt, len, aeskey, iv, tag, TAGLEN);
 	pack16(hdr, len);
 	memcpy(pkt, hdr, HDRLEN);
 	memcpy(&pkt[HDRLEN], iv, IVLEN);
 	memcpy(&pkt[HDRLEN + IVLEN], payload, len);
-	len += IVLEN + HDRLEN;
+	memcpy(&pkt[HDRLEN + IVLEN + len], tag, TAGLEN);
+	len += IVLEN + HDRLEN + TAGLEN;
 	return writeall(fd, pkt, len);
 }
 
@@ -447,8 +473,7 @@ int
 readnet(int fd, unsigned char *pt, int len)
 {
 	unsigned char payload[MTU + AES_BLOCK_SIZE];
-	unsigned char hdr[HDRLEN];
-	unsigned char iv[IVLEN];
+	unsigned char hdr[HDRLEN], iv[IVLEN], tag[TAGLEN];
 	int n, pktlen;
 
 	/* read packet length */
@@ -484,7 +509,14 @@ readnet(int fd, unsigned char *pt, int len)
 	if (n <= 0)
 		return n;
 
-	pktlen = aesdec(&dctx, pt, payload, pktlen, aeskey, iv);
+	/* read tag */
+	n = readall(fd, tag, TAGLEN);
+	if (n <= 0)
+		return n;
+
+	pktlen = aesdec(&dctx, pt, payload, pktlen, aeskey, iv, tag, TAGLEN);
+	if (pktlen < 0)
+		return BADPKT;
 	return pktlen;
 }