From 8495cbb8aae99937e2a77efeee253da89694a98c Mon Sep 17 00:00:00 2001 From: meepingsnesroms Date: Sun, 3 Jun 2018 19:45:43 -0700 Subject: [PATCH] Start adding mbed tls to the relay --- .../3dsIrForwarder/include/mbedtls/config.h | 2 +- localTester/3dsIrForwarder/source/relay.c | 126 ++++++++++++++---- localTester/3dsIrForwarder/source/relay.h | 2 +- 3 files changed, 104 insertions(+), 26 deletions(-) diff --git a/localTester/3dsIrForwarder/include/mbedtls/config.h b/localTester/3dsIrForwarder/include/mbedtls/config.h index 677b52e..735099b 100644 --- a/localTester/3dsIrForwarder/include/mbedtls/config.h +++ b/localTester/3dsIrForwarder/include/mbedtls/config.h @@ -2206,7 +2206,7 @@ * * This module provides networking routines. */ -//#define MBEDTLS_NET_C +#define MBEDTLS_NET_C /** * \def MBEDTLS_OID_C diff --git a/localTester/3dsIrForwarder/source/relay.c b/localTester/3dsIrForwarder/source/relay.c index eaf65c9..7ab2657 100644 --- a/localTester/3dsIrForwarder/source/relay.c +++ b/localTester/3dsIrForwarder/source/relay.c @@ -10,22 +10,39 @@ #include "main.h" #include "relay.h" +#include "mbedtls/net.h" +#include "mbedtls/ssl.h" +#include "mbedtls/entropy.h" +#include "mbedtls/ctr_drbg.h" +#include "mbedtls/debug.h" #define SOC_ALIGN 0x1000 #define SOC_BUFFERSIZE 0x100000 +#define WIFI_PORT 1869 bool relayInited = false; +bool clientBound; bool irInited; bool socketInited; static u32* irBuffer; static u32* socketBuffer; -static s32 sock; -static s32 csock; -static struct sockaddr_in client; -static struct sockaddr_in server; -static u32 clientLen = sizeof(client); +//static s32 sock; +//static s32 csock; +//static struct sockaddr_in client; +//static struct sockaddr_in server; +//static u32 clientLen = sizeof(client); + +static bool mbedTlsInited = false; +static mbedtls_net_context bindFd; +static mbedtls_net_context clientFd; +static mbedtls_entropy_context entropy; +static mbedtls_ctr_drbg_context ctrDrbg; +static mbedtls_ssl_context ssl; +static mbedtls_ssl_config conf; +const char* sendCertFile = "sdmc:/3dsIrForwarder/send.pem"; +const char* receiveCertFile = "sdmc:/3dsIrForwarder/receive.pem"; static const char loginQuery[] = "I am a Palm OS command transmitter."; static const char loginAnswer[] = "I want to login to a Palm OS Device!"; @@ -71,10 +88,14 @@ static inline int8_t makeCodeFromBaud(uint32_t baud){ } static void cleanup(){ - if(csock >= 0) - close(csock); - if(sock >= 0) - close(sock); + if(mbedTlsInited){ + mbedtls_net_free(&server_fd); + mbedtls_ssl_free(&ssl); + mbedtls_ssl_config_free(&conf); + mbedtls_ctr_drbg_free(&ctr_drbg); + mbedtls_entropy_free(&entropy); + mbedTlsInited = false; + } if(irInited) iruExit(); if(socketInited) @@ -85,6 +106,13 @@ static void cleanup(){ free(socketBuffer); } +static void mbedTlsCustomDebug(void *ctx, int level, const char *file, int line, const char *str){ + //((void) level); + //fprintf( (FILE *) ctx, "%s:%04d: %s", file, line, str ); + //fflush( (FILE *) ctx ); + printf("%s:%04d: %s", file, line, str); +} + uint32_t relayInit(uint32_t irBaud){ if(!relayInited){ int8_t irBaudCode = makeCodeFromBaud(irBaud); @@ -96,6 +124,35 @@ uint32_t relayInit(uint32_t irBaud){ irInited = false; socketInited = false; + clientBound = false; + + mbedtls_net_init(&bindFd); + mbedtls_net_init(&clientFd); + mbedtls_ssl_init(&ssl); + mbedtls_ssl_config_init(&conf); + mbedtls_x509_crt_init(&cacert); + mbedtls_ctr_drbg_init(&ctrDrbg); + mbedtls_entropy_init(&entropy); + mbedTlsInited = true; + + ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *) pers, strlen(pers)); + if(ret != 0){ + printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d\n", ret ); + return false; + //goto exit; + } + + ret = mbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT); + if(ret != 0){ + return false; + } + + //mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_NONE); + + mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctrDrbg); + //mbedtls_ssl_conf_dbg(&conf, my_debug, stdout); + mbedtls_ssl_conf_dbg(&conf, mbedTlsCustomDebug); + mbedtls_ssl_set_bio(&ssl, &clientFd, mbedtls_net_send, mbedtls_net_recv, NULL); socketBuffer = (u32*)memalign(SOC_ALIGN, SOC_BUFFERSIZE); irBuffer = (u32*)memalign(SOC_ALIGN, SOC_BUFFERSIZE); @@ -124,6 +181,7 @@ uint32_t relayInit(uint32_t irBaud){ } socketInited = true; + /* sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP); if(sock < 0){ cleanup(); @@ -142,13 +200,20 @@ uint32_t relayInit(uint32_t irBaud){ cleanup(); return RELAY_ERROR_CANT_BIND_SOCKET; } + */ - fcntl(sock, F_SETFL, fcntl(sock, F_GETFL, 0) | O_NONBLOCK); - - ret = listen(sock, 5); + //need to convert this devices ip to a string + ret = mbedtls_net_bind(&bindFd, const char *bind_ip, const char *port, MBEDTLS_NET_PROTO_TCP); if(ret != 0){ cleanup(); - return RELAY_ERROR_CANT_LISTEN_SOCKET; + return RELAY_ERROR_CANT_BIND_SOCKET; + } + + ret = mbedtls_net_set_nonblock(&bindFd); + if(ret != 0){ + cleanup(); + mbedtls_net_free(&bindFd); + return RELAY_ERROR_CANT_SET_NONBLOCKING; } relayInited = true; @@ -158,28 +223,41 @@ uint32_t relayInit(uint32_t irBaud){ } void relayExit(){ - if(relayInited) + if(relayInited){ cleanup(); + mbedtls_net_free(&bindFd); + if(clientBound) + mbedtls_net_free(&clientFd); + relayInited = false; + } } uint32_t relayAttemptConnection(){ if(relayInited){ uint8_t commandBuffer[sizeof(loginAnswer)] = {0}; uint32_t bytes; + int ret; - if(csock) - close(csock); - - csock = accept(sock, (struct sockaddr*)&client, &clientLen); - if(csock < 0) + if(clientBound){ + mbedtls_net_free(&clientFd); + clientBound = false; + } + + ret = mbedtls_net_accept( mbedtls_net_context *bind_ctx, mbedtls_net_context *client_ctx, void *client_ip, size_t buf_size, size_t *ip_len ); + if(ret != 0) return RELAY_ERROR_NO_CLIENTS; + clientBound = true; + + ret = mbedtls_net_set_nonblock(&clientFd); + if(ret != 0) + return RELAY_ERROR_CANT_SET_NONBLOCKING; //check if this is an internet scanner bot or a login - send(csock, loginQuery, strlen(loginQuery), 0); + mbedtls_ssl_write(&ssl, loginQuery, strlen(loginQuery), 0); //check if responce matches safeSleep(3); - bytes = recv(csock, commandBuffer, sizeof(loginAnswer), 0); + bytes = mbedtls_ssl_read(&ssl, commandBuffer, sizeof(loginAnswer), 0); if(bytes != sizeof(loginAnswer)){ cleanup(); return RELAY_ERROR_TIMEOUT; @@ -187,7 +265,7 @@ uint32_t relayAttemptConnection(){ if(memcmp(commandBuffer, loginAnswer, sizeof(loginAnswer)) != 0){ //responce is wrong, this is a scanner, DDOS(very unlikely) or clueless web user(most likely, they tried to open the forwarder as a web page) - close(csock); + mbedtls_net_free(&clientFd); return RELAY_ERROR_INVALID_PARAM; } @@ -207,12 +285,12 @@ void relayRun(){ uint32_t bytes; //read from WIFI - bytes = recv(csock, swapBuffer, sizeof(swapBuffer), 0); + bytes = mbedtls_ssl_read(&ssl, swapBuffer, sizeof(swapBuffer), 0); //forward to IR iruSendData(swapBuffer, bytes, false/*wait*/); //read from IR iruRecvData(swapBuffer, sizeof(swapBuffer), 0/*flag*/, &bytes, false/*wait*/); //forward to WIFI - send(csock, swapBuffer, bytes, 0); + mbedtls_ssl_write(&ssl, swapBuffer, bytes, 0); } diff --git a/localTester/3dsIrForwarder/source/relay.h b/localTester/3dsIrForwarder/source/relay.h index 939c36d..568755a 100644 --- a/localTester/3dsIrForwarder/source/relay.h +++ b/localTester/3dsIrForwarder/source/relay.h @@ -13,7 +13,7 @@ enum{ RELAY_ERROR_IR_DRIVER, RELAY_ERROR_CANT_OPEN_SOCKET, RELAY_ERROR_CANT_BIND_SOCKET, - RELAY_ERROR_CANT_LISTEN_SOCKET, + RELAY_ERROR_CANT_SET_NONBLOCKING, RELAY_ERROR_NO_CLIENTS };