Skip to content

Commit c27b9ba

Browse files
jorisvinkjorisvink
committed
Cover offers under tfc and encap.
Before this change offers would stand out size-wise vs normal traffic, this is no longer the case now. This works for all offer types: key offers, cathedral updates and ambry bundle pushes.
1 parent 3e51b34 commit c27b9ba

13 files changed

+149
-17
lines changed

‎include/sanctum.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -654,6 +654,7 @@ int sanctum_key_erase(const char *, struct sanctum_key *,
654654
struct sanctum_sa *);
655655
int sanctum_cipher_kdf(const char *, const char *,
656656
struct nyfe_agelas *cipher, void *, size_t);
657+
void sanctum_offer_tfc(struct sanctum_packet *);
657658
void sanctum_offer_encrypt(struct nyfe_agelas *, struct sanctum_offer *);
658659
void sanctum_offer_install(struct sanctum_key *, struct sanctum_offer *);
659660
int sanctum_offer_decrypt(struct nyfe_agelas *,

‎src/cathedral.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -301,7 +301,7 @@ cathedral_tunnel_update(struct sanctum_packet *pkt, u_int64_t now,
301301

302302
PRECOND(pkt != NULL);
303303

304-
if (pkt->length != sizeof(*op))
304+
if (pkt->length < sizeof(*op))
305305
return;
306306

307307
op = sanctum_packet_head(pkt);
@@ -495,7 +495,7 @@ cathedral_tunnel_federate(struct flock *flock, struct sanctum_packet *update)
495495
PRECOND(flock != NULL);
496496
PRECOND(update != NULL);
497497

498-
if (update->length != sizeof(*op))
498+
if (update->length < sizeof(*op))
499499
fatal("%s: pkt length invalid (%zu)", __func__, update->length);
500500

501501
/*
@@ -537,6 +537,8 @@ cathedral_tunnel_federate(struct flock *flock, struct sanctum_packet *update)
537537
pkt->length = sizeof(*op);
538538
pkt->target = SANCTUM_PROC_PURGATORY_TX;
539539

540+
sanctum_offer_tfc(pkt);
541+
540542
pkt->addr.sin_family = AF_INET;
541543
pkt->addr.sin_port = tunnel->port;
542544
pkt->addr.sin_addr.s_addr = tunnel->ip;
@@ -730,6 +732,8 @@ cathedral_offer_send(const char *secret, struct sanctum_packet *pkt,
730732
pkt->length = sizeof(*op);
731733
pkt->target = SANCTUM_PROC_PURGATORY_TX;
732734

735+
sanctum_offer_tfc(pkt);
736+
733737
pkt->addr.sin_family = AF_INET;
734738
pkt->addr.sin_port = sin->sin_port;
735739
pkt->addr.sin_addr.s_addr = sin->sin_addr.s_addr;

‎src/chapel.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ chapel_packet_handle(struct sanctum_packet *pkt, u_int64_t now)
297297

298298
PRECOND(pkt != NULL);
299299

300-
if (pkt->length != sizeof(struct sanctum_offer))
300+
if (pkt->length < sizeof(struct sanctum_offer))
301301
return;
302302

303303
hdr = sanctum_packet_head(pkt);
@@ -378,6 +378,8 @@ chapel_cathedral_send_info(u_int64_t magic)
378378
pkt->length = sizeof(*op);
379379
pkt->target = SANCTUM_PROC_PURGATORY_TX;
380380

381+
sanctum_offer_tfc(pkt);
382+
381383
pkt->addr.sin_family = AF_INET;
382384
pkt->addr.sin_addr.s_addr = sanctum->cathedral.sin_addr.s_addr;
383385

@@ -403,7 +405,7 @@ chapel_cathedral_packet(struct sanctum_packet *pkt, u_int64_t now)
403405
struct nyfe_agelas cipher;
404406

405407
PRECOND(pkt != NULL);
406-
PRECOND(pkt->length == sizeof(*op));
408+
PRECOND(pkt->length >= sizeof(*op));
407409
PRECOND(sanctum->mode == SANCTUM_MODE_TUNNEL);
408410
PRECOND(sanctum->flags & SANCTUM_FLAG_CATHEDRAL_ACTIVE);
409411

@@ -754,6 +756,8 @@ chapel_offer_encrypt(u_int64_t now)
754756
pkt->length = sizeof(*op);
755757
pkt->target = SANCTUM_PROC_PURGATORY_TX;
756758

759+
sanctum_offer_tfc(pkt);
760+
757761
if (sanctum_ring_queue(io->offer, pkt) == -1)
758762
sanctum_packet_release(pkt);
759763
else
@@ -792,7 +796,7 @@ chapel_offer_decrypt(struct sanctum_packet *pkt, u_int64_t now)
792796

793797
PRECOND(pkt != NULL);
794798
PRECOND(io != NULL);
795-
PRECOND(pkt->length == sizeof(*op));
799+
PRECOND(pkt->length >= sizeof(*op));
796800

797801
op = sanctum_packet_head(pkt);
798802

‎src/config.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,8 @@ sanctum_config_load(const char *file)
211211
break;
212212
}
213213

214-
if (!(sanctum->flags & SANCTUM_FLAG_USE_TAP)) {
214+
if (sanctum->mode != SANCTUM_MODE_CATHEDRAL &&
215+
!(sanctum->flags & SANCTUM_FLAG_USE_TAP)) {
215216
if (sanctum->tun_ip.sin_addr.s_addr == 0)
216217
fatal("no tunnel configuration specified");
217218
}

‎src/utils.c

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -510,6 +510,36 @@ sanctum_offer_encrypt(struct nyfe_agelas *cipher, struct sanctum_offer *op)
510510
nyfe_agelas_authenticate(cipher, op->tag, sizeof(op->tag));
511511
}
512512

513+
/*
514+
* Provide TFC for the offer when both tfc and encap are enabled, this hides
515+
* the fact that this is an offer on the wire.
516+
*
517+
* We have to include the ipsec header, tail and the cipher overhead
518+
* so that the offer is indistinguishable from traffic.
519+
*
520+
* The remaining bytes in the packet are filled with random data.
521+
*/
522+
void
523+
sanctum_offer_tfc(struct sanctum_packet *pkt)
524+
{
525+
u_int8_t *data;
526+
size_t offset;
527+
528+
PRECOND(pkt != NULL);
529+
PRECOND(pkt->length == sizeof(struct sanctum_offer));
530+
531+
if ((sanctum->flags & SANCTUM_FLAG_TFC_ENABLED) &&
532+
(sanctum->flags & SANCTUM_FLAG_ENCAPSULATE)) {
533+
offset = pkt->length;
534+
pkt->length = sanctum->tun_mtu +
535+
sizeof(struct sanctum_ipsec_hdr) +
536+
sizeof(struct sanctum_ipsec_tail) +
537+
sanctum_cipher_overhead();
538+
data = sanctum_packet_head(pkt);
539+
nyfe_random_bytes(&data[offset], pkt->length - offset);
540+
}
541+
}
542+
513543
/*
514544
* Verify and decrypt a sanctum_offer packet.
515545
* Note: does not zeroize the cipher, this is the caller its responsibility.

‎test/cathedral-1-tfc-encap.conf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# sanctum linux-cathedral configuration
2+
3+
mode cathedral
4+
instance cathedral
5+
6+
local 1.1.1.254:31337
7+
tunnel 0.0.0.0/0 1400
8+
9+
secretdir secrets
10+
secret test/sync.key
11+
12+
tfc on
13+
encapsulation 39824fb77ce0768b69a0e2c6ceb0efc1890f803543124b69bdb9ae4eaa1b696f
14+
15+
settings test/cathedral-settings-1.conf
16+
17+
run control as root
18+
run purgatory-rx as root
19+
run purgatory-tx as root
20+
run cathedral as root

‎test/cathedral-2-tfc-encap.conf

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# sanctum linux-cathedral configuration
2+
3+
mode cathedral
4+
instance cathedral
5+
6+
local 1.1.1.254:1337
7+
tunnel 0.0.0.0/0 1400
8+
9+
secretdir secrets
10+
secret test/sync.key
11+
12+
tfc on
13+
encapsulation 39824fb77ce0768b69a0e2c6ceb0efc1890f803543124b69bdb9ae4eaa1b696f
14+
15+
settings test/cathedral-settings-2.conf
16+
17+
run control as root
18+
run purgatory-rx as root
19+
run purgatory-tx as root
20+
run cathedral as root

‎test/cathedral-left-tfc-encap.conf

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# sanctum cathedral-left configuration
2+
3+
spi 0xcafe
4+
instance cafe
5+
6+
tunnel 1.0.0.1/30 1400
7+
8+
route 2.0.0.1/32
9+
accept 3.0.0.1/32
10+
11+
kek ambry/kek-data/kek-0xca
12+
secret test/secret-01.key
13+
14+
tfc on
15+
encapsulation 39824fb77ce0768b69a0e2c6ceb0efc1890f803543124b69bdb9ae4eaa1b696f
16+
17+
cathedral_id 0xbadf00d
18+
cathedral 1.1.1.254:31337
19+
cathedral_flock 0xcafebabe
20+
cathedral_secret secrets/badf00d.key
21+
22+
run bless as root
23+
run heaven-rx as root
24+
run heaven-tx as root
25+
run chapel as root
26+
run confess as root
27+
run control as root
28+
run purgatory-rx as root
29+
run purgatory-tx as root

‎test/cathedral-right-tfc-encap.conf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# sanctum cathedral-right configuration
2+
3+
spi 0xfeca
4+
instance feca
5+
6+
tunnel 1.0.0.2/30 1400
7+
8+
route 3.0.0.1/32
9+
accept 2.0.0.1/32
10+
11+
kek ambry/kek-data/kek-0xfe
12+
secret test/secret-02.key
13+
14+
tfc on
15+
encapsulation 39824fb77ce0768b69a0e2c6ceb0efc1890f803543124b69bdb9ae4eaa1b696f
16+
17+
cathedral_id 0xfe
18+
cathedral 1.1.1.254:1337
19+
cathedral_secret secrets/fe.key
20+
21+
#cathedral_flock 0xfa35e
22+
cathedral_flock 0xcafebabe
23+
24+
run bless as root
25+
run heaven-rx as root
26+
run heaven-tx as root
27+
run chapel as root
28+
run confess as root
29+
run control as root
30+
run purgatory-rx as root
31+
run purgatory-tx as root

‎test/cathedral-settings-1.conf

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,6 @@ flock cafebabe {
99
ambry ambry/ambry.keys
1010
}
1111

12-
flock beefcake {
13-
allow 0xbadf00d spi 0x01
14-
ambry ambry/ambry-beefcake.keys
15-
}
16-
1712
flock fa35e {
1813
allow 0xfe spi 0xfe
1914
allow 0xbadf00d spi 0xca

‎test/linux-cathedral-1.sh

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎test/linux-cathedral-2.sh

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎test/linux-cathedral.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/sh
2+
3+
./sanctum -c $1

0 commit comments

Comments
 (0)