yeyinlaoying/vnt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

支持客户端加密

Browse Source
This commit is contained in:
lubeilin
2023-06-26 22:38:15 +08:00
parent e8af503130
commit be3bf82e35
22 changed files with 309 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
switch/src/handle/recv_handler.rs
+118 -45
View File
@@ -1,5 +1,8 @@
use std::net::{Ipv4Addr, SocketAddr, SocketAddrV4};
use std::sync::Arc;
use aes_gcm::{AeadInPlace, Aes256Gcm, Nonce, Tag};
use aes_gcm::aead::consts::{U12, U16};
use aes_gcm::aead::generic_array::GenericArray;
use chrono::Local;
use crossbeam::atomic::AtomicCell;
@@ -45,6 +48,7 @@ pub struct ChannelDataHandler {
out_external_route: ExternalRoute,
cone_sender: Sender<(Ipv4Addr, NatInfo)>,
symmetric_sender: Sender<(Ipv4Addr, NatInfo)>,
cipher: Option<Aes256Gcm>,
}
impl ChannelDataHandler {
@@ -59,7 +63,8 @@ impl ChannelDataHandler {
ip_proxy_map: IpProxyMap,
out_external_route: ExternalRoute,
cone_sender: Sender<(Ipv4Addr, NatInfo)>,
symmetric_sender: Sender<(Ipv4Addr, NatInfo)>, ) -> Self {
symmetric_sender: Sender<(Ipv4Addr, NatInfo)>,
cipher: Option<Aes256Gcm>, ) -> Self {
Self {
current_device,
device_list,
@@ -73,6 +78,7 @@ impl ChannelDataHandler {
out_external_route,
cone_sender,
symmetric_sender,
cipher,
}
}
}
@@ -127,8 +133,51 @@ impl ChannelDataHandler {
match net_packet.protocol() {
Protocol::IpTurn => {
match ip_turn_packet::Protocol::from(net_packet.transport_protocol()) {
ip_turn_packet::Protocol::Icmp => {
let ipv4 = IpV4Packet::new(net_packet.payload())?;
if ipv4.protocol() == ipv4::protocol::Protocol::Icmp {
self.device_writer.write_ipv4(&mut buf[12..])?;
return Ok(());
}
}
ip_turn_packet::Protocol::Igmp => {
let ipv4 = IpV4Packet::new(net_packet.payload())?;
if ipv4.protocol() == ipv4::protocol::Protocol::Igmp {
self.igmp_server.handle(ipv4.payload(), source)?;
}
return Ok(());
}
ip_turn_packet::Protocol::Ipv4 => {
let mut ipv4 = IpV4Packet::new(net_packet.payload_mut())?;
let data = if let Some(cipher) = &self.cipher {
if !net_packet.is_encrypt() {
//未加密的数据之间丢弃
return Ok(());
}
if net_packet.payload().len() < 16 {
log::error!("数据异常,长度小于16");
return Ok(());
}
//需要解密
let mut nonce = [0; 12];
nonce[0..4].copy_from_slice(&source.octets());
nonce[4..8].copy_from_slice(&destination.octets());
nonce[8] = Protocol::IpTurn.into();
nonce[9] = ip_turn_packet::Protocol::Ipv4.into();
let nonce: &GenericArray<u8, U12> = Nonce::from_slice(&nonce);
let data_len = net_packet.payload().len() - 16;
let tag: GenericArray<u8, U16> = Tag::clone_from_slice(&net_packet.payload()[data_len..]);
match cipher.decrypt_in_place_detached(nonce, &[], &mut net_packet.payload_mut()[..data_len], &tag) {
Ok(_) => {}
Err(e) => {
log::error!("数据解密异常:{}",e);
return Ok(());
}
}
&mut net_packet.payload_mut()[..data_len]
} else {
net_packet.payload_mut()
};
let mut ipv4 = IpV4Packet::new(data)?;
match ipv4.protocol() {
ipv4::protocol::Protocol::Igmp => {
self.igmp_server.handle(ipv4.payload(), source)?;
@@ -146,63 +195,87 @@ impl ChannelDataHandler {
ipv4.update_checksum();
net_packet.set_source(destination);
net_packet.set_destination(source);
if let Some(cipher) = &self.cipher {
//需要加密
let mut nonce = [0; 12];
nonce[0..4].copy_from_slice(&destination.octets());
nonce[4..8].copy_from_slice(&source.octets());
nonce[8] = Protocol::IpTurn.into();
nonce[9] = ip_turn_packet::Protocol::Ipv4.into();
let nonce: &GenericArray<u8, U12> = Nonce::from_slice(&nonce);
let data_len = net_packet.payload().len() - 16;
match cipher.encrypt_in_place_detached(nonce, &[], &mut net_packet.payload_mut()[..data_len]) {
Ok(tag) => {
if tag.len() != 16 {
log::error!("加密tag长度错误:{}",tag.len());
return Ok(());
}
net_packet.set_encrypt_flag(true);
net_packet.payload_mut()[data_len..data_len + 16].copy_from_slice(tag.as_slice());
}
Err(e) => {
log::error!("加密失败:{}",e);
return Ok(());
}
}
}
context.send_by_key(net_packet.buffer(), route_key).await?;
return Ok(());
}
}
}
_ => {
if ipv4.destination_ip() != destination {
if let Some(gate_way) = self.out_external_route.route(&ipv4.destination_ip()) {
match ipv4.protocol() {
ipv4::protocol::Protocol::Tcp => {
let dest_ip = ipv4.destination_ip();
//转发到代理目标地址
let mut tcp_packet = packet::tcp::tcp::TcpPacket::new(source, destination, ipv4.payload_mut())?;
let source_port = tcp_packet.source_port();
let dest_port = tcp_packet.destination_port();
tcp_packet.set_destination_port(self.ip_proxy_map.tcp_proxy_port);
tcp_packet.update_checksum();
ipv4.set_destination_ip(destination);
ipv4.update_checksum();
self.ip_proxy_map.tcp_proxy_map.insert(SocketAddrV4::new(source, source_port),
(SocketAddrV4::new(gate_way, 0), SocketAddrV4::new(dest_ip, dest_port)));
}
ipv4::protocol::Protocol::Udp => {
let dest_ip = ipv4.destination_ip();
//转发到代理目标地址
let mut udp_packet = packet::udp::udp::UdpPacket::new(source, destination, ipv4.payload_mut())?;
let source_port = udp_packet.source_port();
let dest_port = udp_packet.destination_port();
udp_packet.set_destination_port(self.ip_proxy_map.udp_proxy_port);
udp_packet.update_checksum();
ipv4.set_destination_ip(destination);
ipv4.update_checksum();
self.ip_proxy_map.udp_proxy_map.insert(SocketAddrV4::new(source, source_port),
(SocketAddrV4::new(gate_way, 0), SocketAddrV4::new(dest_ip, dest_port)));
}
ipv4::protocol::Protocol::Icmp => {
let dest_ip = ipv4.destination_ip();
//转发到代理目标地址
let icmp_packet = icmp::IcmpPacket::new(ipv4.payload())?;
match icmp_packet.header_other() {
HeaderOther::Identifier(id, seq) => {
self.ip_proxy_map.icmp_proxy_map.insert((dest_ip, id, seq), source);
self.ip_proxy_map.send_icmp(ipv4.payload(), &gate_way, &dest_ip)?;
}
_ => {
return Ok(());
}
}
_ => {}
}
if ipv4.destination_ip() != destination {
if let Some(gate_way) = self.out_external_route.route(&ipv4.destination_ip()) {
match ipv4.protocol() {
ipv4::protocol::Protocol::Tcp => {
let dest_ip = ipv4.destination_ip();
//转发到代理目标地址
let mut tcp_packet = packet::tcp::tcp::TcpPacket::new(source, destination, ipv4.payload_mut())?;
let source_port = tcp_packet.source_port();
let dest_port = tcp_packet.destination_port();
tcp_packet.set_destination_port(self.ip_proxy_map.tcp_proxy_port);
tcp_packet.update_checksum();
ipv4.set_destination_ip(destination);
ipv4.update_checksum();
self.ip_proxy_map.tcp_proxy_map.insert(SocketAddrV4::new(source, source_port),
(SocketAddrV4::new(gate_way, 0), SocketAddrV4::new(dest_ip, dest_port)));
}
ipv4::protocol::Protocol::Udp => {
let dest_ip = ipv4.destination_ip();
//转发到代理目标地址
let mut udp_packet = packet::udp::udp::UdpPacket::new(source, destination, ipv4.payload_mut())?;
let source_port = udp_packet.source_port();
let dest_port = udp_packet.destination_port();
udp_packet.set_destination_port(self.ip_proxy_map.udp_proxy_port);
udp_packet.update_checksum();
ipv4.set_destination_ip(destination);
ipv4.update_checksum();
self.ip_proxy_map.udp_proxy_map.insert(SocketAddrV4::new(source, source_port),
(SocketAddrV4::new(gate_way, 0), SocketAddrV4::new(dest_ip, dest_port)));
}
ipv4::protocol::Protocol::Icmp => {
let dest_ip = ipv4.destination_ip();
//转发到代理目标地址
let icmp_packet = icmp::IcmpPacket::new(ipv4.payload())?;
match icmp_packet.header_other() {
HeaderOther::Identifier(id, seq) => {
self.ip_proxy_map.icmp_proxy_map.insert((dest_ip, id, seq), source);
self.ip_proxy_map.send_icmp(ipv4.payload(), &gate_way, &dest_ip)?;
}
_ => {
return Ok(());
}
}
}
_ => {
return Ok(());
}
}
}
}
//传输协议12字节
self.device_writer.write_ipv4(&mut buf[12..])?;
return Ok(());
switch/src/handle/tun_tap/mod.rs
+65 -16
View File
@@ -1,4 +1,8 @@
use std::io;
use std::net::{Ipv4Addr, SocketAddrV4};
use aes_gcm::{AeadInPlace, Aes256Gcm, Nonce};
use aes_gcm::aead::consts::U12;
use aes_gcm::aead::generic_array::GenericArray;
use packet::ip::ipv4::packet::IpV4Packet;
use packet::ip::ipv4::protocol::Protocol;
use packet::tcp::tcp::TcpPacket;
@@ -42,9 +46,9 @@ async fn multicast(igmp_server: &IgmpServer, multicast_addr: Ipv4Addr, sender: &
let mut peer_ips = Vec::with_capacity(8);
let vec = sender.direct_route_table_one();
if let Some(members) = igmp_server.load(&multicast_addr) {
let members_guard = members.read();
for (peer_ip, route) in vec {
if members_guard.is_send(&peer_ip) {
let is_send = {members.read().is_send(&peer_ip)};
if is_send {
if sender.send_by_key(&net_packet.buffer()[..data_len], &route.route_key()).await.is_ok() {
peer_ips.push(peer_ip);
if peer_ips.len() == u8::MAX as usize {
@@ -69,42 +73,59 @@ async fn multicast(igmp_server: &IgmpServer, multicast_addr: Ipv4Addr, sender: &
}
/// 实现一个原地发送，必须保证是如下结构
/// |12字节开头|ip报文|至少1024字节结尾|
/// |12字节开头|ip报文|至少1024字节+12字节结尾|
///
#[inline]
pub async fn base_handle(sender: &ChannelSender, buf: &mut [u8],
data_len: usize,//数据总长度=ip长度+12
igmp_server: &IgmpServer,
current_device: CurrentDeviceInfo,
ip_route: &ExternalRoute, proxy_map: &IpProxyMap) -> Result<()> {
mut data_len: usize,//数据总长度=ip长度+12
igmp_server: &IgmpServer,
current_device: CurrentDeviceInfo,
ip_route: &ExternalRoute, proxy_map: &IpProxyMap, cipher: &Option<Aes256Gcm>) -> Result<()> {
let ipv4_packet = IpV4Packet::new(&buf[12..data_len])?;
let protocol = ipv4_packet.protocol();
let ip_head_len = ipv4_packet.header_len() as usize * 4;
let src_ip = ipv4_packet.source_ip();
let mut dest_ip = ipv4_packet.destination_ip();
let mut net_packet = NetPacket::new(buf)?;
net_packet.set_transport_protocol(ip_turn_packet::Protocol::Ipv4.into());
net_packet.set_version(Version::V1);
net_packet.set_protocol(protocol::Protocol::IpTurn);
net_packet.set_transport_protocol(ip_turn_packet::Protocol::Ipv4.into());
net_packet.first_set_ttl(3);
net_packet.set_source(src_ip);
net_packet.set_destination(dest_ip);
if dest_ip == current_device.virtual_gateway {
if protocol == Protocol::Icmp {
net_packet.set_transport_protocol(ip_turn_packet::Protocol::Icmp.into());
//发送到服务端的不加密
sender.send_main(&net_packet.buffer()[..data_len], current_device.connect_server).await?;
}
return Ok(());
}
if dest_ip.is_multicast() {
if protocol == Protocol::Igmp {
net_packet.set_transport_protocol(ip_turn_packet::Protocol::Igmp.into());
//发送到服务端
sender.send_main(&net_packet.buffer()[..data_len], current_device.connect_server).await?;
return Ok(());
}
}
if dest_ip.is_broadcast() || current_device.broadcast_address == dest_ip {
// 广播 发送到直连目标
if Protocol::Udp == protocol {
if let Some(cipher) = cipher {
//需要加密
encrypt(cipher, &mut data_len, &mut net_packet)?;
}
broadcast(sender, &mut net_packet, data_len, &current_device).await?;
}
return Ok(());
} else if dest_ip.is_multicast() {
match protocol {
Protocol::Igmp => {
//发送到服务端
sender.send_main(&net_packet.buffer()[..data_len], current_device.connect_server).await?;
if protocol == Protocol::Udp {
if let Some(cipher) = cipher {
//需要加密
encrypt(cipher, &mut data_len, &mut net_packet)?;
}
Protocol::Udp => {
multicast(igmp_server, dest_ip, sender, &mut net_packet, data_len, &current_device).await?;
}
_ => {}
multicast(igmp_server, dest_ip, sender, &mut net_packet, data_len, &current_device).await?;
}
return Ok(());
} else {
@@ -158,9 +179,37 @@ pub async fn base_handle(sender: &ChannelSender, buf: &mut [u8],
}
}
}
if let Some(cipher) = cipher {
//需要加密
encrypt(cipher, &mut data_len, &mut net_packet)?;
}
//优先发到直连到地址
if sender.send_by_id(&net_packet.buffer()[..data_len], &dest_ip).await.is_err() {
sender.send_main(&net_packet.buffer()[..data_len], current_device.connect_server).await?;
}
return Ok(());
}
fn encrypt(cipher: &Aes256Gcm, data_len: &mut usize, net_packet: &mut NetPacket<&mut [u8]>) -> io::Result<()> {
let mut nonce = [0; 12];
nonce[0..4].copy_from_slice(&net_packet.source().octets());
nonce[4..8].copy_from_slice(&net_packet.destination().octets());
nonce[8] = protocol::Protocol::IpTurn.into();
nonce[9] = ip_turn_packet::Protocol::Ipv4.into();
let nonce: &GenericArray<u8, U12> = Nonce::from_slice(&nonce);
return match cipher.encrypt_in_place_detached(nonce, &[], &mut net_packet.payload_mut()[..*data_len - 12]) {
Ok(tag) => {
if tag.len() != 16 {
return Err(io::Error::new(io::ErrorKind::Other, format!("加密tag长度错误:{}", tag.len())));
}
net_packet.set_encrypt_flag(true);
net_packet.payload_mut()[*data_len - 12..*data_len - 12 + 16].copy_from_slice(tag.as_slice());
*data_len += 16;
Ok(())
}
Err(e) => {
Err(io::Error::new(io::ErrorKind::Other, format!("加密失败:{}", e)))
}
};
}
switch/src/handle/tun_tap/tap_handler.rs
+18 -15
View File
@@ -1,5 +1,6 @@
use std::sync::Arc;
use std::{io, thread};
use aes_gcm::Aes256Gcm;
use crossbeam::atomic::AtomicCell;
use packet::arp::arp::ArpPacket;
use packet::ethernet;
@@ -21,39 +22,41 @@ pub fn start(sender: ChannelSender,
igmp_server: IgmpServer,
current_device: Arc<AtomicCell<CurrentDeviceInfo>>,
ip_route: ExternalRoute,
ip_proxy_map: IpProxyMap) {
ip_proxy_map: IpProxyMap,
cipher: Option<Aes256Gcm>) {
thread::Builder::new().name("tap-handler".into()).spawn(move || {
tokio::runtime::Builder::new_current_thread()
.enable_all().build().unwrap()
.block_on(async move {
if let Err(e) = start_(sender, device_reader,
device_writer, igmp_server,
current_device, ip_route, ip_proxy_map).await {
current_device, ip_route, ip_proxy_map, cipher).await {
log::warn!("tap:{:?}",e);
}
});
}).unwrap();
}
async fn start_(sender: ChannelSender,
device_reader: DeviceReader,
device_writer: DeviceWriter,
igmp_server: IgmpServer,
current_device: Arc<AtomicCell<CurrentDeviceInfo>>,
ip_route: ExternalRoute,
ip_proxy_map: IpProxyMap) -> io::Result<()> {
let mut buf = [0; 4096];
device_reader: DeviceReader,
device_writer: DeviceWriter,
igmp_server: IgmpServer,
current_device: Arc<AtomicCell<CurrentDeviceInfo>>,
ip_route: ExternalRoute,
ip_proxy_map: IpProxyMap,
cipher: Option<Aes256Gcm>) -> io::Result<()> {
let mut buf = [0; 2048];
loop {
//ip拆包了会直接丢弃？
let len = device_reader.read(&mut buf)?;
if let Err(e) = handle(&mut buf, len, &igmp_server, &current_device, &device_writer, &sender, &ip_route, &ip_proxy_map).await {
if let Err(e) = handle(&mut buf, len, &igmp_server, &current_device, &device_writer, &sender, &ip_route, &ip_proxy_map, &cipher).await {
log::error!("tap handle{:?}",e);
}
}
}
async fn handle(buf: &mut [u8], len: usize, igmp_server: &IgmpServer, current_device: &AtomicCell<CurrentDeviceInfo>,
device_writer: &DeviceWriter, sender: &ChannelSender, ip_route: &ExternalRoute, proxy_map: &IpProxyMap) -> crate::Result<()> {
device_writer: &DeviceWriter, sender: &ChannelSender, ip_route: &ExternalRoute, proxy_map: &IpProxyMap, cipher: &Option<Aes256Gcm>) -> crate::Result<()> {
let mut ethernet_packet = EthernetPacket::new(&mut buf[..len])?;
let current_device = current_device.load();
match ethernet_packet.protocol() {
@@ -68,12 +71,12 @@ async fn handle(buf: &mut [u8], len: usize, igmp_server: &IgmpServer, current_de
return Ok(());
}
//回复一个虚假的MAC地址
out_arp_packet.set_sender_hardware_addr(&[target_p[0], target_p[1], target_p[2], target_p[3], 123, 234]);
out_arp_packet.set_sender_hardware_addr(&[target_p[0], target_p[1], target_p[2], target_p[3], !sender_h[5], 234]);
out_arp_packet.set_sender_protocol_addr(target_p);
out_arp_packet.set_target_hardware_addr(sender_h);
out_arp_packet.set_target_protocol_addr(sender_p);
out_arp_packet.set_op_code(2);
out_ethernet_packet.set_source(&[target_p[0], target_p[1], target_p[2], target_p[3], 123, 234]);
out_ethernet_packet.set_source(&[target_p[0], target_p[1], target_p[2], target_p[3], !sender_h[5], 234]);
out_ethernet_packet.set_destination(sender_h);
device_writer.write_ethernet_tap(&out_ethernet_packet.buffer)?;
}
@@ -105,7 +108,7 @@ async fn handle(buf: &mut [u8], len: usize, igmp_server: &IgmpServer, current_de
}
// 以太网帧头部14字节，预留12字节
return crate::handle::tun_tap::base_handle(sender, &mut buf[2..], len - 2, igmp_server, current_device,
ip_route, proxy_map).await;
ip_route, proxy_map, cipher).await;
}
_ => {
// log::warn!("不支持的二层协议：{:?}",p)
switch/src/handle/tun_tap/tun_handler.rs
+9 -6
View File
@@ -1,5 +1,6 @@
use std::{io, thread};
use std::sync::Arc;
use aes_gcm::Aes256Gcm;
use crossbeam::atomic::AtomicCell;
@@ -35,7 +36,7 @@ fn icmp(device_writer: &DeviceWriter, mut ipv4_packet: IpV4Packet<&mut [u8]>) ->
/// 接收tun数据，并且转发到udp上
#[inline]
async fn handle(sender: &ChannelSender, data: &mut [u8], len: usize, device_writer: &DeviceWriter, igmp_server: &IgmpServer, current_device: CurrentDeviceInfo,
ip_route: &ExternalRoute, proxy_map: &IpProxyMap) -> Result<()> {
ip_route: &ExternalRoute, proxy_map: &IpProxyMap,cipher: &Option<Aes256Gcm>) -> Result<()> {
let ipv4_packet = if let Ok(ipv4_packet) = IpV4Packet::new(&mut data[12..len]) {
ipv4_packet
} else {
@@ -49,7 +50,7 @@ async fn handle(sender: &ChannelSender, data: &mut [u8], len: usize, device_writ
if src_ip == dest_ip {
return icmp(&device_writer, ipv4_packet);
}
return crate::handle::tun_tap::base_handle(sender, data, len, igmp_server, current_device, ip_route, proxy_map).await;
return crate::handle::tun_tap::base_handle(sender, data, len, igmp_server, current_device, ip_route, proxy_map,cipher).await;
}
pub fn start(sender: ChannelSender,
@@ -58,12 +59,13 @@ pub fn start(sender: ChannelSender,
igmp_server: IgmpServer,
current_device: Arc<AtomicCell<CurrentDeviceInfo>>,
ip_route: ExternalRoute,
ip_proxy_map: IpProxyMap) {
ip_proxy_map: IpProxyMap,
cipher: Option<Aes256Gcm>) {
thread::Builder::new().name("tun-handler".into()).spawn(move || {
tokio::runtime::Builder::new_current_thread()
.enable_all().build().unwrap()
.block_on(async move {
if let Err(e) = start_(sender, device_reader, device_writer, igmp_server, current_device, ip_route, ip_proxy_map).await {
if let Err(e) = start_(sender, device_reader, device_writer, igmp_server, current_device, ip_route, ip_proxy_map,cipher).await {
log::warn!("tun:{:?}",e);
}
})
@@ -76,11 +78,12 @@ async fn start_(sender: ChannelSender,
igmp_server: IgmpServer,
current_device: Arc<AtomicCell<CurrentDeviceInfo>>,
ip_route: ExternalRoute,
ip_proxy_map: IpProxyMap) -> io::Result<()> {
ip_proxy_map: IpProxyMap,
cipher: Option<Aes256Gcm>) -> io::Result<()> {
let mut buf = [0; 4096];
loop {
let len = device_reader.read(&mut buf[12..])? + 12;
match handle(&sender, &mut buf, len, &device_writer, &igmp_server, current_device.load(), &ip_route, &ip_proxy_map).await {
match handle(&sender, &mut buf, len, &device_writer, &igmp_server, current_device.load(), &ip_route, &ip_proxy_map,&cipher).await {
Ok(_) => {}
Err(e) => {
log::warn!("{:?}", e)