Cloak/internal/server/auth.go

108 lines
2.9 KiB
Go
Raw Normal View History

2018-10-09 15:07:54 +00:00
package server
import (
"bytes"
"encoding/binary"
2019-08-02 14:45:33 +00:00
"errors"
"fmt"
2018-10-14 19:32:54 +00:00
"github.com/cbeuw/Cloak/internal/util"
2019-09-01 00:33:34 +00:00
"net"
"time"
2019-09-01 00:33:34 +00:00
log "github.com/sirupsen/logrus"
2018-10-09 15:07:54 +00:00
)
2019-08-12 13:21:42 +00:00
type ClientInfo struct {
UID []byte
SessionId uint32
ProxyMethod string
EncryptionMethod byte
2019-08-12 21:43:16 +00:00
Unordered bool
2019-09-01 19:23:45 +00:00
Transport Transport
2019-08-12 13:21:42 +00:00
}
2019-08-31 20:40:50 +00:00
type authenticationInfo struct {
sharedSecret []byte
nonce []byte
ciphertextWithTag []byte
}
2019-08-12 21:43:16 +00:00
const (
UNORDERED_FLAG = 0x01 // 0000 0001
)
2019-08-02 14:45:33 +00:00
var ErrTimestampOutOfWindow = errors.New("timestamp is outside of the accepting window")
2019-09-01 00:33:34 +00:00
var ErrUnreconisedProtocol = errors.New("unreconised protocol")
2019-08-02 14:45:33 +00:00
2019-09-01 22:14:28 +00:00
// touchStone checks if a the authenticationInfo are valid. It doesn't check if the UID is authorised
2019-08-31 20:40:50 +00:00
func touchStone(ai authenticationInfo, now func() time.Time) (info ClientInfo, err error) {
2019-08-02 14:45:33 +00:00
var plaintext []byte
2019-08-31 20:40:50 +00:00
plaintext, err = util.AESGCMDecrypt(ai.nonce, ai.sharedSecret, ai.ciphertextWithTag)
2019-08-02 00:01:19 +00:00
if err != nil {
2019-06-09 14:03:28 +00:00
return
}
2019-08-02 00:01:19 +00:00
2019-08-14 10:48:32 +00:00
info = ClientInfo{
2019-08-12 13:21:42 +00:00
UID: plaintext[0:16],
SessionId: 0,
ProxyMethod: string(bytes.Trim(plaintext[16:28], "\x00")),
EncryptionMethod: plaintext[28],
2019-08-12 21:43:16 +00:00
Unordered: plaintext[41]&UNORDERED_FLAG != 0,
2019-08-12 13:21:42 +00:00
}
2019-08-02 00:01:19 +00:00
timestamp := int64(binary.BigEndian.Uint64(plaintext[29:37]))
clientTime := time.Unix(timestamp, 0)
2019-08-16 22:56:46 +00:00
serverTime := now()
if !(clientTime.After(serverTime.Truncate(TIMESTAMP_TOLERANCE)) && clientTime.Before(serverTime.Add(TIMESTAMP_TOLERANCE))) {
2019-08-02 14:45:33 +00:00
err = fmt.Errorf("%v: received timestamp %v", ErrTimestampOutOfWindow, timestamp)
2019-06-09 11:05:41 +00:00
return
2018-10-09 15:07:54 +00:00
}
2019-08-12 13:21:42 +00:00
info.SessionId = binary.BigEndian.Uint32(plaintext[37:41])
2018-11-07 21:16:13 +00:00
return
2018-10-09 15:07:54 +00:00
}
2019-09-01 00:33:34 +00:00
2019-09-01 19:23:45 +00:00
var ErrReplay = errors.New("duplicate random")
var ErrBadProxyMethod = errors.New("invalid proxy method")
2019-09-01 00:33:34 +00:00
// PrepareConnection checks if the first packet of data is ClientHello or HTTP GET, and checks if it was from a Cloak client
// if it is from a Cloak client, it returns the ClientInfo with the decrypted fields. It doesn't check if the user
// is authorised. It also returns a finisher callback function to be called when the caller wishes to proceed with
// the handshake
2019-09-01 19:23:45 +00:00
func PrepareConnection(firstPacket []byte, sta *State, conn net.Conn) (info ClientInfo, finisher func([]byte) (net.Conn, error), err error) {
2020-01-22 22:27:19 +00:00
var transport Transport
2019-09-01 00:33:34 +00:00
switch firstPacket[0] {
case 0x47:
2020-01-22 22:27:19 +00:00
transport = WebSocket{}
2019-09-01 00:33:34 +00:00
case 0x16:
2020-01-22 22:27:19 +00:00
transport = TLS{}
2019-09-01 00:33:34 +00:00
default:
err = ErrUnreconisedProtocol
return
}
2020-01-22 18:37:01 +00:00
var ai authenticationInfo
2020-01-22 22:27:19 +00:00
ai, finisher, err = transport.handshake(firstPacket, sta.staticPv, conn)
2020-01-22 18:37:01 +00:00
if err != nil {
return
}
if sta.registerRandom(ai.nonce) {
err = ErrReplay
return
}
2019-09-01 00:33:34 +00:00
info, err = touchStone(ai, sta.Now)
if err != nil {
log.Debug(err)
2020-01-22 18:37:01 +00:00
err = fmt.Errorf("transport %v in correct format but not Cloak: %v", info.Transport, err)
2019-09-01 00:33:34 +00:00
return
}
if _, ok := sta.ProxyBook[info.ProxyMethod]; !ok {
err = ErrBadProxyMethod
return
}
2020-01-22 22:27:19 +00:00
info.Transport = transport
2019-09-01 00:33:34 +00:00
return
}