July 2012 - tor-commits - lists.torproject.org

[stegotorus/master] fixed a typo...
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit f269b6e1b4ab7abfc1c3478aef3ab45de2c22a55 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Tue Nov 1 19:23:05 2011 +0000 fixed a typo... git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@113 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/zpack.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/steg/zpack.c b/src/steg/zpack.c index 57cd2b2..63aa412 100644 --- a/src/steg/zpack.c +++ b/src/steg/zpack.c @@ -52,7 +52,7 @@ int def(char *source, int slen, char *dest, int dlen, int level) memcpy (in, source, strm.avail_in); slen = slen - strm.avail_in; - source - source + strm.avail_in; + source = source + strm.avail_in; flush = (slen == 0) ? Z_FINISH : Z_NO_FLUSH; strm.next_in = in;

1 0

[stegotorus/master] disabled x_http.c by adding return 0 to x_http_detect.
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 27c3f3c2dc33ca82ba5f558cf808e65c3747b3ba Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Tue Nov 1 06:08:24 2011 +0000 disabled x_http.c by adding return 0 to x_http_detect. svn version should now be working... git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@110 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/x_http.c | 1 + start-client.csh | 4 ++-- start-server.csh | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/steg/x_http.c b/src/steg/x_http.c index df0b94b..c26fe1f 100644 --- a/src/steg/x_http.c +++ b/src/steg/x_http.c @@ -71,6 +71,7 @@ x_http_detect(conn_t *conn) { struct evbuffer *buf = conn_get_inbound(conn); unsigned char *data; + return 0; /* Look for the text of http_response_1. */ if (evbuffer_get_length(buf) >= sizeof http_response_1 - 1) { diff --git a/start-client.csh b/start-client.csh index 65f4465..a09302e 100644 --- a/start-client.csh +++ b/start-client.csh @@ -2,7 +2,7 @@ # ./obfsproxy --log-min-severity=debug x_dsteg socks 127.0.0.1:1080 x_http setenv EVENT_NOKQUEUE yes -#./obfsproxy --log-min-severity=debug chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 +./obfsproxy --log-min-severity=debug chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 # ./obfsproxy --log-min-severity=warn chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 -./obfsproxy --log-min-severity=error chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 +#./obfsproxy --log-min-severity=error chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 diff --git a/start-server.csh b/start-server.csh index 50b781a..935e8bb 100644 --- a/start-server.csh +++ b/start-server.csh @@ -1,6 +1,6 @@ #!/bin/csh setenv EVENT_NOKQUEUE yes -#./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 # ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 -./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +#./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081

1 0

[stegotorus/master] enabled jskeyword skip
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 47fb64a72ab5c8503c2a35d970921c215238cdb5 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Tue Nov 1 06:17:28 2011 +0000 enabled jskeyword skip git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@112 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/payloads.c | 58 ++++++++++++++++++++++++-------------------------- 1 files changed, 28 insertions(+), 30 deletions(-) diff --git a/src/steg/payloads.c b/src/steg/payloads.c index 2782aa6..8d0b8fe 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -454,11 +454,9 @@ unsigned int find_client_payload(char* buf, int len, int type) { pentry_header* p = &payload_hdrs[r]; if (p->ptype == type) { inbuf = payloads[r]; - if (find_uri_type(inbuf) != HTTP_CONTENT_SWF && + if (find_uri_type(inbuf) != HTTP_CONTENT_SWF && find_uri_type(inbuf) != HTTP_CONTENT_JAVASCRIPT) - goto next; - if (p->length > len) { fprintf(stderr, "BUFFER TOO SMALL... \n"); goto next; @@ -497,7 +495,7 @@ unsigned int find_client_payload(char* buf, int len, int type) { int skipJSPattern (char *cp, int len) { // log_debug("Turning off skipJSPattern for debugging"); - return 0; + // return 0; if (len < 1) return 0; @@ -575,6 +573,8 @@ int offset2Alnum_ (char *p, int range) { } } + + /* * offset2Hex returns the offset to the next usable hex char. * usable here refer to char that our steg module can use to encode @@ -608,15 +608,13 @@ int offset2Hex (char *p, int range, int isLastCharHex) { if (isLastCharHex) { if (isxdigit(*cp)) return 0; // base case else { - cp++; - i = offset2Alnum_(cp, p+range-cp); - while (i == 0) { - if (isxdigit(*cp)) return (cp-p); + while (cp < (p+range) && isalnum_(*cp)) { cp++; - i = offset2Alnum_(cp, p+range-cp); + if (isxdigit(*cp)) return (cp-p); } - if (i == -1) return -1; - // if (i > 0), fallthru and handle case 2 + if (cp >= (p+range)) return -1; + // non-alnum_ found + // fallthru and handle case 2 } } @@ -626,29 +624,29 @@ int offset2Hex (char *p, int range, int isLastCharHex) { i = offset2Alnum_(cp, p+range-cp); if (i == -1) return -1; - // isFirstWordChar = 1; while (cp < (p+range) && i != -1) { - - if (i == 0) { - j = skipJSPattern(cp, p+range-cp); - if (j > 0) { - // cp points a word that should not be used (e.g., JS keyword) - cp = cp+j; isFirstWordChar = 1; - } else { // j == 0 - if (isFirstWordChar) { + + if (i == 0) { + if (isFirstWordChar) { + j = skipJSPattern(cp, p+range-cp); + if (j > 0) { + cp = cp+j; + } else { cp++; isFirstWordChar = 0; // skip the 1st char of a word - } - else { // we are in the middle of a word; no need to invoke skipJSPattern - if (isxdigit(*cp)) return (cp-p); - else cp++; } - } - } else { // i > 0 - cp += i; isFirstWordChar = 1; - } - i = offset2Alnum_(cp, p+range-cp); - + } else { // we are in the middle of a word; no need to invoke skipJSPattern + if (isxdigit(*cp)) return (cp-p); + if (! isalnum_(*cp)) { + isFirstWordChar = 1; + } + cp++; + } + } else { + cp += i; isFirstWordChar = 1; + } + i = offset2Alnum_(cp, p+range-cp); + } // while // cannot find next usable hex char

1 0

[stegotorus/master] minor fix to pdfSteg.c
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 0c81b4df3854f45d0426db6754b1a49e14d7d82b Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Tue Nov 1 06:11:32 2011 +0000 minor fix to pdfSteg.c git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@111 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/pdfSteg.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/steg/pdfSteg.c b/src/steg/pdfSteg.c index 58147fa..05216f9 100644 --- a/src/steg/pdfSteg.c +++ b/src/steg/pdfSteg.c @@ -460,6 +460,13 @@ x_http2_handle_client_PDF_receive(steg_t *s, conn_t *conn, struct evbuffer *dest return RECV_INCOMPLETE; httpHdr = (char *) evbuffer_pullup(source, response_len); + + if (httpHdr == NULL) { + log_warn("CLIENT unable to pullup the complete HTTP body"); + return RECV_BAD; + } + + httpBody = httpHdr + hdrLen;

1 0

[stegotorus/master] git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@123 a58ff0ac-194c-e011-a152-003048836090
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit b111b5d76f2692e48bd692853fa3826696aa7bce Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sat Nov 5 00:22:59 2011 +0000 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@123 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/jsSteg.c | 2 +- src/steg/x_http2.c | 2 +- start-server.csh | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/steg/jsSteg.c b/src/steg/jsSteg.c index a323d44..60b2d9a 100644 --- a/src/steg/jsSteg.c +++ b/src/steg/jsSteg.c @@ -1018,7 +1018,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, // decCnt is an odd number or data is not a hex string if (decCnt % 2) { - log_debug("CLIENT ERROR: An odd number of hex characters received"); + fprintf(stderr, "CLIENT ERROR: An odd number of hex characters received\n"); // buf_dump((unsigned char*)data, decCnt, stderr); return RECV_BAD; } diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index 1359238..f22dcea 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -624,7 +624,7 @@ x_http2_client_uri_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { // fprintf(stderr, "outbuf = %s\n", outbuf); if (evbuffer_add(dest, outbuf, datalen) || // add uri field - evbuffer_add(dest, "HTTP 1.1\r\nHost: ", 19) || + evbuffer_add(dest, "HTTP/1.1\r\nHost: ", 19) || evbuffer_add(dest, peername, strlen(peername)) || evbuffer_add(dest, strstr(buf, "\r\n"), len - (unsigned int) (strstr(buf, "\r\n") - buf)) || // add everything but first line evbuffer_add(dest, "\r\n", 2)) { diff --git a/start-server.csh b/start-server.csh index 935e8bb..eb421c4 100644 --- a/start-server.csh +++ b/start-server.csh @@ -1,6 +1,9 @@ #!/bin/csh setenv EVENT_NOKQUEUE yes -./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +# ./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 # ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 #./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +# ./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081 +# ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081 +./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081

1 0

[stegotorus/master] Modified jsSteg and pdfSteg to generate fixed HTTP headers for the responses, and modified x_http2 and jsSteg to respond with html when html is requested, and to respond with js when js is requested.
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 67f7f83208f1e34d2e8b070afcff4b296f0df431 Author: Steven Cheung <cheung(a)csl.sri.com> Date: Wed Nov 2 17:38:25 2011 +0000 Modified jsSteg and pdfSteg to generate fixed HTTP headers for the responses, and modified x_http2 and jsSteg to respond with html when html is requested, and to respond with js when js is requested. git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@114 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/jsSteg.c | 112 +++++++++++++++++++++++++-------------------------- src/steg/jsSteg.h | 2 +- src/steg/payloads.c | 113 +++++++++++++++++++++++++++++++++++++++++++++++---- src/steg/payloads.h | 12 +++-- src/steg/pdfSteg.c | 31 +++++++++----- src/steg/x_http2.c | 29 ++++++++++++- 6 files changed, 216 insertions(+), 83 deletions(-) diff --git a/src/steg/jsSteg.c b/src/steg/jsSteg.c index 5946062..9c67949 100644 --- a/src/steg/jsSteg.c +++ b/src/steg/jsSteg.c @@ -2,6 +2,8 @@ #include "jsSteg.h" #include "cookies.h" +void buf_dump(unsigned char* buf, int len, FILE *out); + /* * jsSteg: A Javascript-based steganography module @@ -610,7 +612,7 @@ int testDecode2(char *inBuf, char *outBuf, int -x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { +x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn, unsigned int content_type) { struct evbuffer_iovec *iv; int nv; @@ -620,6 +622,9 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { char data[(int) sbuflen*2]; unsigned int datalen; + char newHdr[MAX_RESP_HDR_SIZE]; + int newHdrLen = 0; + size_t sofar = 0; unsigned int cnt = 0; int r; @@ -638,12 +643,12 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { int mode; char *hend; unsigned int hLen; - unsigned int mjs; + unsigned int mjs = 0; char *jsTemplate = NULL; int jsTemplateSize = 0; - + /* int hdrLen; @@ -660,6 +665,13 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { log_debug("sbuflen = %d sofar = %d\n", (int) sbuflen, (int) sofar); + + if (content_type != HTTP_CONTENT_JAVASCRIPT && + content_type != HTTP_CONTENT_HTML) { + log_warn("SERVER ERROR: Unknown content type (%d)", content_type); + return -1; + } + // log_debug("SERVER: dumping data with length %d:", (int) sbuflen); // evbuffer_dump(source, stderr); // Convert data in 'source' to hexadecimal and write it to data @@ -675,15 +687,19 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { // jsTemplate should be init already, by x_http2_new or the previous invocation // of this function - mjs = get_max_JS_capacity(); + if (content_type == HTTP_CONTENT_JAVASCRIPT) { + mjs = get_max_JS_capacity(); + } else if (content_type == HTTP_CONTENT_HTML) { + mjs = get_max_HTML_capacity(); + } if (mjs <= 0) { - log_debug("SERVER ERROR: (server_transmit) No JavaScript found in jsTemplate\n"); + log_warn("SERVER ERROR: No JavaScript found in jsTemplate"); return -1; - } + } if (sbuflen > (size_t) mjs) { - log_debug("SERVER ERROR: (server_transmit) jsTemplate cannot accommodate data %d %dn", + log_warn("SERVER ERROR: (server_transmit) jsTemplate cannot accommodate data %d %dn", (int) sbuflen, (int) mjs); return -1; } @@ -712,10 +728,10 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { - if (get_payload(HTTP_CONTENT_JAVASCRIPT, datalen, &jsTemplate, &jsTemplateSize) == 1) { + if (get_payload(content_type, datalen, &jsTemplate, &jsTemplateSize) == 1) { log_debug("SERVER found the next HTTP response template with size %d", jsTemplateSize); } else { - log_debug("SERVER couldn't find the next HTTP response template; reusing the previous one"); + log_warn("SERVER couldn't find the next HTTP response template; reusing the previous one"); } log_debug("MJS %d %d", datalen, mjs); @@ -747,34 +763,10 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { log_debug("SERVER: using HTTP resp template of length = %d\n", jsLen); // log_debug("HTTP resp tempmlate:"); // buf_dump((unsigned char*)jsTemplate, jsLen, stderr); - // fprintf(stderr, "==========================\n"); hLen = hend+4-jsTemplate; r = encodeHTTPBody(data, hend+4, outbuf, datalen, jsLen-hLen, HTTP_MSG_BUF_SIZE, mode); - - - - /// NEW STUFF - - -/* hdrLen = strstr(jsTemplate, "\r\n\r\n") - jsTemplate + 4; - tmp = strstr(jsTemplate, "Content-Length: ") + strlen("Content-Length: "); - - content_len = atoi(tmp); - - - decCnt = decodeHTTPBody(jsTemplate + hdrLen, data2, content_len, HTTP_MSG_BUF_SIZE, &fin2, mode); - - - if (decCnt == (int) datalen) - fprintf(stderr, "cnts match\n"); - else - fprintf(stderr, "cnts don't match %d %d\n", decCnt, datalen); - -*/ - - if (r < 0 || ((unsigned int) r < datalen)) { fprintf(stderr, "incomplete data encoding\n"); exit(-1); @@ -782,20 +774,32 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { return -1; } - // note: the transformation is length-preserving for now - log_debug("SERVER: HTTP body with encoded data:"); - // buf_dump((unsigned char*)outbuf, jsLen-hLen, stderr); - // fprintf(stderr, "==========================\n"); + if (mode == CONTENT_JAVASCRIPT) { // JavaScript in HTTP body + newHdrLen = gen_response_header((char*) "application/x-javascript", 0, jsLen-hLen, newHdr, sizeof(newHdr)); + } else if (mode == CONTENT_HTML_JAVASCRIPT) { // JavaScript(s) embedded in HTML doc + newHdrLen = gen_response_header((char*) "text/html", 0, jsLen-hLen, newHdr, sizeof(newHdr)); + } else { // unknown mode + log_warn("SERVER ERROR: unknown mode for creating the HTTP response header"); + return -1; + } + if (newHdrLen < 0) { + log_warn("SERVER ERROR: gen_response_header fails for jsSteg"); + return -1; + } - if (evbuffer_add(dest, jsTemplate, hLen)) { - log_debug("SERVER ERROR: x_http2_server_transmit: evbuffer_add() fails for jsTemplate"); + if (evbuffer_add(dest, newHdr, newHdrLen)) { + log_warn("SERVER ERROR: evbuffer_add() fails for newHdr"); return -1; } - // fprintf(stderr, "HELLO ==========================\n"); + // if (evbuffer_add(dest, jsTemplate, hLen)) { + // log_warn("SERVER ERROR: evbuffer_add() fails for jsTemplate"); + // return -1; + // } + if (evbuffer_add(dest, outbuf, jsLen-hLen)) { - log_debug("SERVER ERROR: x_http2_server_transmit: evbuffer_add() fails for outbuf"); + log_warn("SERVER ERROR: evbuffer_add() fails for outbuf"); return -1; } @@ -804,7 +808,6 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { // } while (sbuflen > sofar); - // fprintf(stderr, "SERVER TRANSMITTED payload of size %d\n", (int) sbuflen); // obtain a usable HTTP response template for the next data, and @@ -814,10 +817,6 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { log_debug("SERVER finding the next HTTP response template"); - - - - // conn_cease_transmission(conn); conn_close_after_transmit(conn); // downcast_steg(s)->have_transmitted = 1; return 0; @@ -920,9 +919,9 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, } log_debug("CLIENT received HTTP response with length %d\n", response_len); - log_debug("HTTP response:"); - // buf_dump((unsigned char*)respMsg, response_len, stderr); - // fprintf(stderr, "==========================\n"); + // buf_dump((unsigned char*)respMsg, response_len, stderr); + // log_debug("HTTP response header:"); + // buf_dump((unsigned char*)respMsg, hdrLen, stderr); httpBody = respMsg + hdrLen; @@ -936,7 +935,6 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, log_debug("CLIENT Before decodeHTTPBody; mode: %d\n", mode); - // call decodeHTTPBody decCnt = decodeHTTPBody(httpBody, data, response_len-hdrLen, HTTP_MSG_BUF_SIZE, &fin, mode); data[decCnt] = 0; @@ -950,12 +948,12 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, } if (! isxString(data)) { - log_debug("CLIENT ERROR: Data received not hex"); + log_warn("CLIENT ERROR: Data received not hex"); // buf_dump((unsigned char*)data, decCnt, stderr); return RECV_BAD; } - log_debug("Hex data received:"); + // log_debug("Hex data received:"); // buf_dump ((unsigned char*)data, decCnt, stderr); // get a scratch buffer @@ -963,7 +961,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, if (!scratch) return RECV_BAD; if (evbuffer_expand(scratch, decCnt/2)) { - log_debug("CLIENT ERROR: Evbuffer expand failed \n"); + log_warn("CLIENT ERROR: Evbuffer expand failed \n"); evbuffer_free(scratch); return RECV_BAD; } @@ -975,16 +973,16 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, evbuffer_add(scratch, &c, 1); } - log_debug("CLIENT Done converting hex data to binary:\n"); + // log_debug("CLIENT Done converting hex data to binary:\n"); // evbuffer_dump(scratch, stderr); // fprintf(stderr, "CLIENT RECEIVED payload of size %d\n", (int) evbuffer_get_length(scratch)); - // add the scratch buffer (which contains the data) to dest + // add the scratch buffer (which contains the data) to dest if (evbuffer_add_buffer(dest, scratch)) { evbuffer_free(scratch); - log_debug("CLIENT ERROR: Failed to transfer buffer"); + log_warn("CLIENT ERROR: Failed to transfer buffer"); return RECV_BAD; } log_debug("Added scratch (buffer) to dest\n"); @@ -994,7 +992,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, if (response_len <= evbuffer_get_length(source)) { if (evbuffer_drain(source, response_len) == -1) { - log_debug("CLIENT ERROR: Added scratch (buffer) to dest\n"); + log_warn("CLIENT ERROR: Failed to drain source"); return RECV_BAD; } } diff --git a/src/steg/jsSteg.h b/src/steg/jsSteg.h index 3c5f6ae..c076460 100644 --- a/src/steg/jsSteg.h +++ b/src/steg/jsSteg.h @@ -53,7 +53,7 @@ int testDecode2(char *inBuf, char *outBuf, int -x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn); +x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn, unsigned int content_type); int x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct evbuffer* source); diff --git a/src/steg/payloads.c b/src/steg/payloads.c index 8d0b8fe..017c469 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -12,6 +12,7 @@ static int typePayloadCap[MAX_CONTENT_TYPE][MAX_PAYLOADS]; static unsigned int max_JS_capacity = 0; +static unsigned int max_HTML_capacity = 0; static unsigned int max_PDF_capacity = 0; @@ -25,6 +26,10 @@ unsigned int get_max_JS_capacity() { return max_JS_capacity; } +unsigned int get_max_HTML_capacity() { + return max_HTML_capacity; +} + unsigned int get_max_PDF_capacity() { return max_PDF_capacity; } @@ -422,12 +427,15 @@ find_uri_type(char* buf) { if (!strncmp(ext, ".swf", 4) || !strncmp(ext, ".SWF", 4)) return HTTP_CONTENT_SWF; - // if (!strncmp(ext, ".js", 3) || !strncmp(ext, ".JS", 3)) - return HTTP_CONTENT_JAVASCRIPT; + if (!strncmp(ext, ".js", 3) || !strncmp(ext, ".JS", 3)) + return HTTP_CONTENT_JAVASCRIPT; if (!strncmp(ext-1, "html", 4) || !strncmp(ext, "htm", 3) || strchr(ext-1, '.') == NULL) return HTTP_CONTENT_HTML; + // default type + return HTTP_CONTENT_HTML; + // return HTTP_CONTENT_JAVASCRIPT; return -1; } @@ -441,7 +449,6 @@ find_uri_type(char* buf) { - unsigned int find_client_payload(char* buf, int len, int type) { int r = rand() % payload_count; int cnt = 0; @@ -455,8 +462,10 @@ unsigned int find_client_payload(char* buf, int len, int type) { if (p->ptype == type) { inbuf = payloads[r]; if (find_uri_type(inbuf) != HTTP_CONTENT_SWF && - find_uri_type(inbuf) != HTTP_CONTENT_JAVASCRIPT) + find_uri_type(inbuf) != HTTP_CONTENT_HTML && + find_uri_type(inbuf) != HTTP_CONTENT_JAVASCRIPT) { goto next; + } if (p->length > len) { fprintf(stderr, "BUFFER TOO SMALL... \n"); goto next; @@ -490,7 +499,7 @@ unsigned int find_client_payload(char* buf, int len, int type) { * keyword * * todo: - * Use a more efficient algo (e.g., Aho-Corasick) in the next iteration + * Use a more efficient regular expression matching algo */ int skipJSPattern (char *cp, int len) { @@ -864,10 +873,10 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { #endif if (type != HTTP_CONTENT_JAVASCRIPT && + type != HTTP_CONTENT_HTML && type != HTTP_CONTENT_PDF && type != HTTP_CONTENT_SWF) return 0; - // assumption: buf is null-terminated if (!strstr(buf, "\r\n\r\n")) return 0; @@ -918,7 +927,8 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { tjFlag, thFlag, ceFlag, teFlag, http304Flag, clZeroFlag); #endif - if (type == HTTP_CONTENT_JAVASCRIPT) { + // if (type == HTTP_CONTENT_JAVASCRIPT) + if (type == HTTP_CONTENT_JAVASCRIPT || type == HTTP_CONTENT_HTML) { // empty body if it's HTTP not modified (304) or zero Content-Length if (http304Flag || clZeroFlag) return 0; @@ -1072,7 +1082,7 @@ int init_JS_payload_pool(int len, int type, int minCapacity) { msgbuf = payloads[r]; mode = has_eligible_HTTP_content(msgbuf, p->length, HTTP_CONTENT_JAVASCRIPT); - if (mode > 0) { + if (mode == CONTENT_JAVASCRIPT) { cap = capacityJS3(msgbuf, p->length, mode); if (cap < JS_DELIMITER_SIZE) @@ -1124,6 +1134,93 @@ int init_JS_payload_pool(int len, int type, int minCapacity) { } +int init_HTML_payload_pool(int len, int type, int minCapacity) { + + // stat for usable payload + int minPayloadSize = 0, maxPayloadSize = 0; + int sumPayloadSize = 0; + int minPayloadCap = 0, maxPayloadCap = 0; + int sumPayloadCap = 0; + + unsigned int contentType = HTTP_CONTENT_HTML; + + int cnt = 0; + int r; + pentry_header* p; + char* msgbuf; + int cap; + int mode; + + + + if (payload_count == 0) { + log_debug("payload_count == 0; forgot to run load_payloads()?\n"); + return 0; + } + + if (initTypePayload[contentType] != 0) return 1; // init is done already + + + for (r = 0; r < payload_count; r++) { + p = &payload_hdrs[r]; + if (p->ptype != type || p->length > len) { + continue; + } + + msgbuf = payloads[r]; + + mode = has_eligible_HTTP_content(msgbuf, p->length, HTTP_CONTENT_HTML); + if (mode == CONTENT_HTML_JAVASCRIPT) { + + cap = capacityJS3(msgbuf, p->length, mode); + if (cap < JS_DELIMITER_SIZE) + continue; + + cap = (cap - JS_DELIMITER_SIZE)/2; + + if (cap > minCapacity) { + typePayloadCap[contentType][cnt] = cap; // (cap-JS_DELIMITER_SIZE)/2; + // because we use 2 hex char to encode every data byte, the available + // capacity for encoding data is divided by 2 + typePayload[contentType][cnt] = r; + cnt++; + + // update stat + if (cnt == 1) { + minPayloadSize = p->length; maxPayloadSize = p->length; + minPayloadCap = cap; maxPayloadCap = cap; + } + else { + if (minPayloadSize > p->length) minPayloadSize = p->length; + if (maxPayloadSize < p->length) maxPayloadSize = p->length; + if (minPayloadCap > cap) minPayloadCap = cap; + if (maxPayloadCap < cap) { + maxPayloadCap = cap; + } + + } + sumPayloadSize += p->length; sumPayloadCap += cap; + } + } + } + + + max_HTML_capacity = maxPayloadCap; + + + initTypePayload[contentType] = 1; + typePayloadCount[contentType] = cnt; + log_debug("init_payload_pool: typePayloadCount for contentType %d = %d", + contentType, typePayloadCount[contentType]); + log_debug("minPayloadSize = %d", minPayloadSize); + log_debug("maxPayloadSize = %d", maxPayloadSize); + log_debug("avgPayloadSize = %f", (float)sumPayloadSize/(float)cnt); + log_debug("minPayloadCap = %d", minPayloadCap); + log_debug("maxPayloadCap = %d", maxPayloadCap); + log_debug("avgPayloadCap = %f", (float)sumPayloadCap/(float)cnt); + return 1; +} + diff --git a/src/steg/payloads.h b/src/steg/payloads.h index b3fcc9d..56729fe 100644 --- a/src/steg/payloads.h +++ b/src/steg/payloads.h @@ -28,7 +28,8 @@ #define NO_NEXT_STATE -1 #define MAX_PAYLOADS 10000 -// #define HTTP_MSG_BUF_SIZE 100000 +#define MAX_RESP_HDR_SIZE 512 + // jsSteg-specific defines #define JS_DELIMITER '?' @@ -39,13 +40,12 @@ // data encoding will be replaced by JS_DELIMITER_REPLACEMENT #define JS_DELIMITER_SIZE 1 -#define JS_MIN_AVAIL_SIZE 2050 +// #define JS_MIN_AVAIL_SIZE 2050 +#define JS_MIN_AVAIL_SIZE 1026 // JS_MIN_AVAIL_SIZE should reflect the min number of data bytes // a JavaScript may encapsulate -// Using hex-based encoding, it takes 2 hex char in JS -// to encode 1 data byte. Thus the size of data that can be encoded -// is about half this value +#define HTML_MIN_AVAIL_SIZE 1026 #define PDF_DELIMITER_SIZE 2 #define PDF_MIN_AVAIL_SIZE 10240 @@ -128,6 +128,7 @@ unsigned int find_server_payload(char** buf, int len, int type, int contentType) int init_JS_payload_pool(int len, int type, int minCapacity); int init_SWF_payload_pool(int len, int type, int minCapacity); int init_PDF_payload_pool(int len, int type,int minCapacity); +int init_HTML_payload_pool(int len, int type, int minCapacity); int get_next_payload (int contentType, char** buf, int* size, int* cap); @@ -145,6 +146,7 @@ int offset2Hex (char *p, int range, int isLastCharHex); unsigned int capacityJS (char* buf, int len, int mode); unsigned int capacityJS3 (char* buf, int len, int mode); unsigned int get_max_JS_capacity(void); +unsigned int get_max_HTML_capacity(void); char * strInBinary (const char *pattern, unsigned int patternLen, const char *blob, unsigned int blobLen); diff --git a/src/steg/pdfSteg.c b/src/steg/pdfSteg.c index 05216f9..4a91e55 100644 --- a/src/steg/pdfSteg.c +++ b/src/steg/pdfSteg.c @@ -79,8 +79,12 @@ addDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, * * returns the length of data written to outbuf, if succeed; * otherwise, it returns -1 + * * endFlag indicates whether the end-of-encoding byte pattern (i.e., * delimiter1 followed by non-delimiter1) is detected + * + * escape indicates if a dangling delimiter1 has been + * seen in the previous invocation of removeDelimiter */ int removeDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, @@ -113,16 +117,13 @@ removeDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, while ((ibp-inbuf+1)<inbuflen && cnt<outbuflen) { ic1 = *(ibp++); if (ic1 != delimiter1) { - // *escape = 0; outbuf[cnt++] = ic1; } else { - // *escape = 1; // lookahead 1 char ic2 = *ibp; // if the next char is delimiter1 if (ic2 == delimiter1) { outbuf[cnt++] = delimiter1; ibp++; - // *escape = 0; } else { // end-of-data pattern detected *endFlag = 1; break; @@ -130,10 +131,6 @@ removeDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, } } - // if (*escape) { - // *escape = 0; - // return cnt; - // } if (ibp-inbuf == inbuflen) return cnt; // handling the last char in inbuf, if needed @@ -217,7 +214,7 @@ pdfWrap (char *data, unsigned int dlen, memcpy(op, dp, size2); op += size2; tp += size2; dp += size2; cnt += size2; - printf("Encoded %d char in pdf. Done encoding\n", size2); + // printf("Encoded %d char in pdf. Done encoding\n", size2); break; } log_debug("Encoded %d char in pdf", size); @@ -311,6 +308,9 @@ int x_http2_server_PDF_transmit (steg_t* s, struct evbuffer *source, conn_t *con char outbuf[HTTP_MSG_BUF_SIZE]; int cnt, hLen, outbuflen, i; + char newHdr[MAX_RESP_HDR_SIZE]; + int newHdrLen = 0; + struct evbuffer_iovec *iv; int nv; @@ -400,10 +400,21 @@ int x_http2_server_PDF_transmit (steg_t* s, struct evbuffer *source, conn_t *con // } - if (evbuffer_add(dest, pdfTemplate, hLen)) { - log_warn("SERVER ERROR: evbuffer_add() fails for pdfTemplate"); + newHdrLen = gen_response_header((char*) "application/pdf", 0, outbuflen, newHdr, sizeof(newHdr)); + if (newHdrLen < 0) { + log_warn("SERVER ERROR: gen_response_header fails for pdfSteg"); return -1; } + + if (evbuffer_add(dest, newHdr, newHdrLen)) { + log_warn("SERVER ERROR: evbuffer_add() fails for newHdr"); + return -1; + } + // if (evbuffer_add(dest, pdfTemplate, hLen)) { + // log_warn("SERVER ERROR: evbuffer_add() fails for pdfTemplate"); + // return -1; + // } + if (evbuffer_add(dest, outbuf, outbuflen)) { log_warn("SERVER ERROR: evbuffer_add() fails for outbuf"); return -1; diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index 0710fa7..f3789b2 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -49,6 +49,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #define MIN_COOKIE_SIZE 128 #define MAX_COOKIE_SIZE 2048 @@ -154,6 +156,7 @@ x_http2_new(rng_t *rng, unsigned int is_clientside) else { load_payloads("traces/server.out"); init_JS_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, JS_MIN_AVAIL_SIZE); + init_HTML_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, HTML_MIN_AVAIL_SIZE); // init_PDF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, PDF_MIN_AVAIL_SIZE); init_SWF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, 0); } @@ -304,6 +307,17 @@ x_http2_transmit_room(steg_t *s, conn_t *conn) log_warn("js capacity too small\n"); exit(-1); + case HTTP_CONTENT_HTML: + mjc = get_max_HTML_capacity() / 2; + if (mjc > 1024) { + // it should be 1024 + ...., but seems like we need to be a little bit smaller (chopper bug?) + int rval = 512 + rand()%(mjc - 1024); + // fprintf(stderr, "returning rval %d, mjc %d\n", rval, mjc); + return rval; + } + log_warn("js capacity too small\n"); + exit(-1); + case HTTP_CONTENT_PDF: // return 1024 + rand()%(get_max_PDF_capacity() - 1024) return PDF_MIN_AVAIL_SIZE; @@ -462,7 +476,11 @@ x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { log_debug("error ***********************"); return -1; } - + + // debug + // log_warn("CLIENT HTTP request header:"); + // buf_dump((unsigned char*)buf, len, stderr); + // sofar += datalen/2; evbuffer_drain(source, datalen/2); @@ -517,8 +535,13 @@ x_http2_transmit(steg_t *s, struct evbuffer *source, conn_t *conn) case HTTP_CONTENT_SWF: rval = x_http2_server_SWF_transmit(s, source, conn); break; + case HTTP_CONTENT_JAVASCRIPT: - rval = x_http2_server_JS_transmit(s, source, conn); + rval = x_http2_server_JS_transmit(s, source, conn, HTTP_CONTENT_JAVASCRIPT); + break; + + case HTTP_CONTENT_HTML: + rval = x_http2_server_JS_transmit(s, source, conn, HTTP_CONTENT_HTML); break; case HTTP_CONTENT_PDF: @@ -680,7 +703,9 @@ x_http2_receive(steg_t *s, conn_t *conn, struct evbuffer *dest) case HTTP_CONTENT_SWF: rval = x_http2_handle_client_SWF_receive(s, conn, dest, source); break; + case HTTP_CONTENT_JAVASCRIPT: + case HTTP_CONTENT_HTML: rval = x_http2_handle_client_JS_receive(s, conn, dest, source); break;

1 0

[stegotorus/master] cookies.h needs string.h
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit ccff1dbe3b44a83a79b687a7f359770bd6ebf7b0 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Fri Nov 4 21:27:59 2011 +0000 cookies.h needs string.h git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@122 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/cookies.h | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/steg/cookies.h b/src/steg/cookies.h index 4970776..abda927 100644 --- a/src/steg/cookies.h +++ b/src/steg/cookies.h @@ -6,6 +6,7 @@ #include <stdio.h> #include <strings.h> #include <stdlib.h> +#include <string.h> int unwrap_cookie(unsigned char* inbuf, unsigned char* outbuf, int buflen); int gen_cookie_field(unsigned char* outbuf, int total_cookie_len, unsigned char* data, int datalen);

1 0

[stegotorus/master] git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@124 a58ff0ac-194c-e011-a152-003048836090
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 3e5e2ee2cfd54bbd23868b0a1ffd263b8c47d3f8 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sat Nov 5 00:34:55 2011 +0000 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@124 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/x_http2.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index f22dcea..3695c27 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -675,7 +675,7 @@ x_http2_transmit(steg_t *s, struct evbuffer *source, conn_t *conn) the only plausible places to put it are the URL and cookies. This presently uses the URL. And it can't be binary. */ - if (evbuffer_get_length(source) < 256) + if (evbuffer_get_length(source) < 128) return x_http2_client_uri_transmit(s, source, conn); //@@ return x_http2_client_cookie_transmit(s, source, conn); //@@ }

1 0

[stegotorus/master] added uri steg support to x_http2
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 451f65972456021ebc3722e8383e0809fab0374f Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Fri Nov 4 17:38:21 2011 +0000 added uri steg support to x_http2 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@119 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/x_http.c | 2 +- src/steg/x_http2.c | 251 +++++++++++++++++++++++++++++++++++++++------------ start-client.csh | 4 +- 3 files changed, 195 insertions(+), 62 deletions(-) diff --git a/src/steg/x_http.c b/src/steg/x_http.c index c26fe1f..eb08401 100644 --- a/src/steg/x_http.c +++ b/src/steg/x_http.c @@ -71,7 +71,7 @@ x_http_detect(conn_t *conn) { struct evbuffer *buf = conn_get_inbound(conn); unsigned char *data; - return 0; + return 0; /* Look for the text of http_response_1. */ if (evbuffer_get_length(buf) >= sizeof http_response_1 - 1) { diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index f3789b2..1359238 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -87,11 +87,12 @@ STEG_DEFINE_MODULE(x_http2, -int x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn); +int x_http2_client_uri_transmit (steg_t *s, struct evbuffer *source, conn_t *conn); +int x_http2_client_cookie_transmit (steg_t *s, struct evbuffer *source, conn_t *conn); void evbuffer_dump(struct evbuffer *buf, FILE *out); void buf_dump(unsigned char* buf, int len, FILE *out); - +int gen_uri_field(char* uri, unsigned int uri_sz, char* data, int datalen); void @@ -156,6 +157,7 @@ x_http2_new(rng_t *rng, unsigned int is_clientside) else { load_payloads("traces/server.out"); init_JS_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, JS_MIN_AVAIL_SIZE); + // init_JS_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, JS_MIN_AVAIL_SIZE, HTTP_CONTENT_HTML); init_HTML_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, HTML_MIN_AVAIL_SIZE); // init_PDF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, PDF_MIN_AVAIL_SIZE); init_SWF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, 0); @@ -376,7 +378,7 @@ lookup_peer_name_from_ip(char* p_ip, char* p_name) { int -x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { +x_http2_client_cookie_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { /* On the client side, we have to embed the data in a GET query somehow; the only plausible places to put it are the URL and cookies. This @@ -496,6 +498,153 @@ x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { +int gen_uri_field(char* uri, unsigned int uri_sz, char* data, int datalen) { + unsigned int so_far = 0; + uri[0] = 0; + + strcat(uri, "GET /"); + so_far = 5; + + while (datalen > 0) { + unsigned int r = rand() % 4; + + if (r == 1) { + r = rand() % 46; + if (r < 20) + uri[so_far++] = 'g' + r; + else + uri[so_far++] = 'A' + r - 20; + } + else { + uri[so_far++] = data[0]; + data++; + datalen--; + } + + + + r = rand() % 8; + + if (r == 0 && datalen > 0) + uri[so_far++] = '/'; + + if (so_far > uri_sz - 6) { + fprintf(stderr, "too small\n"); + return 0; + } + } + + switch(rand()%4){ + case 1: + memcpy(uri+so_far, ".htm ", 6); + break; + case 2: + memcpy(uri+so_far, ".html ", 7); + break; + case 3: + memcpy(uri+so_far, ".js ", 5); + break; + case 0: + memcpy(uri+so_far, ".swf ", 6); + break; + + } + + return strlen(uri); + +} + + + + + +int +x_http2_client_uri_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { + + + struct evbuffer *dest = conn_get_outbound(conn); + + + struct evbuffer_iovec *iv; + int i, nv; + + /* Convert all the data in 'source' to hexadecimal and write it to + 'scratch'. Data is padded to a multiple of four characters with + equals signs. */ + size_t slen = evbuffer_get_length(source); + size_t datalen = 0; + int cnt = 0; + char data[2*slen]; + + char outbuf[1024]; + int len =0; + char buf[10000]; + + + if (has_peer_name == 0 && lookup_peer_name_from_ip((char*) conn->peername, peername)) + has_peer_name = 1; + + + + nv = evbuffer_peek(source, slen, NULL, NULL, 0); + iv = xzalloc(sizeof(struct evbuffer_iovec) * nv); + if (evbuffer_peek(source, slen, NULL, iv, nv) != nv) { + free(iv); + return -1; + } + + for (i = 0; i < nv; i++) { + const unsigned char *p = iv[i].iov_base; + const unsigned char *limit = p + iv[i].iov_len; + char c; + while (p < limit) { + c = *p++; + data[datalen++] = "0123456789abcdef"[(c & 0xF0) >> 4]; + data[datalen++] = "0123456789abcdef"[(c & 0x0F) >> 0]; + } + } + free(iv); + + + + do { + datalen = gen_uri_field(outbuf, sizeof(outbuf), data, datalen); + } while (datalen == 0); + + + + + // retry up to 10 times + while (!len) { + len = find_client_payload(buf, sizeof(buf), TYPE_HTTP_REQUEST); + if (cnt++ == 10) return -1; + } + + + // fprintf(stderr, "outbuf = %s\n", outbuf); + + if (evbuffer_add(dest, outbuf, datalen) || // add uri field + evbuffer_add(dest, "HTTP 1.1\r\nHost: ", 19) || + evbuffer_add(dest, peername, strlen(peername)) || + evbuffer_add(dest, strstr(buf, "\r\n"), len - (unsigned int) (strstr(buf, "\r\n") - buf)) || // add everything but first line + evbuffer_add(dest, "\r\n", 2)) { + log_debug("error ***********************"); + return -1; + } + + + + evbuffer_drain(source, slen); + conn_cease_transmission(conn); + downcast_steg(s)->type = find_uri_type(outbuf); + downcast_steg(s)->have_transmitted = 1; + return 0; + +} + + + + @@ -526,7 +675,9 @@ x_http2_transmit(steg_t *s, struct evbuffer *source, conn_t *conn) the only plausible places to put it are the URL and cookies. This presently uses the URL. And it can't be binary. */ - return x_http2_client_transmit(s, source, conn); //@@ + if (evbuffer_get_length(source) < 256) + return x_http2_client_uri_transmit(s, source, conn); //@@ + return x_http2_client_cookie_transmit(s, source, conn); //@@ } else { int rval = -1; @@ -570,10 +721,10 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev struct evbuffer_ptr s2 = evbuffer_search(source, "\r\n\r\n", sizeof ("\r\n\r\n") -1 , NULL); unsigned char* limit; unsigned char *p; - int unwrapped_cookie_len; - struct evbuffer *scratch; unsigned char c, h, secondhalf; - unsigned char buf[evbuffer_get_length(source)]; + char outbuf[MAX_COOKIE_SIZE]; + int sofar = 0; + int cookie_mode = 0; if (s2.pos == -1) { @@ -584,7 +735,7 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev log_debug("SERVER received request header of length %d", (int)s2.pos); - data = evbuffer_pullup(source, s2.pos); + data = evbuffer_pullup(source, s2.pos+4); if (data == NULL) { log_debug("SERVER evbuffer_pullup fails"); return RECV_BAD; @@ -593,81 +744,60 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev limit = data + s2.pos; type = find_uri_type((char *)data); - log_warn ("*** Got type %d", type); - /* if (type != 3) { - fprintf(stderr, "type != 3, %d, data = %s \n", find_uri_type2((char *) data), data); - exit(-1); - }*/ + data[s2.pos+4] = 0; + // fprintf(stderr, "data = %s\n", data); - data = (unsigned char*) strstr((char*) data, "Cookie:"); - - if (data == NULL || memcmp(data, "Cookie:", sizeof "Cookie:"-1)) { - log_debug("Unexpected HTTP verb: %.*s", 5, data); - return RECV_BAD; + if (strstr((char*) data, "Cookie") != NULL) { + data = (unsigned char*) strstr((char*) data, "Cookie:"); + p = data + sizeof "Cookie: "-1; + cookie_mode = 1; } - - p = data + sizeof "Cookie: "-1; - unwrapped_cookie_len = unwrap_cookie(p, buf, (int) (limit - p)); - - log_debug("SERVER: received cookie of length = %d %d\n", unwrapped_cookie_len, (int) (limit-p)); - // buf_dump(buf, unwrapped_cookie_len, stderr); - // fprintf(stderr, "==========================\n"); - // buf_dump(p, (int) (limit-p), stderr); - - - // log_debug("hello SERVER received %d cnt = %d\n", (int) (limit - p), cnt); - // buf_dump(p, (int) (limit-p), stderr); - - /* We need a scratch buffer here because the contract is that if - we hit a decode error we *don't* write anything to 'dest'. */ - scratch = evbuffer_new(); - - if (!scratch) return RECV_BAD; - - - if (evbuffer_expand(scratch, unwrapped_cookie_len/2)) { - log_debug("Evbuffer expand failed \n"); - evbuffer_free(scratch); - return RECV_BAD; - } - p = buf; + else + p = data + sizeof "GET /" -1; secondhalf = 0; - while ((int) (p - buf) < unwrapped_cookie_len) { - if (!secondhalf) c = 0; - if ('0' <= *p && *p <= '9') h = *p - '0'; - else if ('a' <= *p && *p <= 'f') h = *p - 'a' + 10; - else if ('A' <= *p && *p <= 'F') h = *p - 'A' + 10; - else if (*p == '=' && !secondhalf) { + c = 0; + + + while (strncmp((char*) p, "\r\n", 4) != 0 && (cookie_mode != 0 || p[0] != '.')) { + if (!secondhalf) + c = 0; + if ('0' <= *p && *p <= '9') + h = *p - '0'; + else if ('a' <= *p && *p <= 'f') + h = *p - 'a' + 10; + else { p++; continue; - } else { - evbuffer_free(scratch); - log_debug("Decode error: unexpected URI characterasdfaf %d", *p); - return RECV_BAD; } c = (c << 4) + h; if (secondhalf) { - evbuffer_add(scratch, &c, 1); - // log_debug("adding to scratch"); + outbuf[sofar++] = c; cnt++; } secondhalf = !secondhalf; p++; } + outbuf[sofar] = 0; + + // fprintf(stderr, "recvd = %d\n", sofar); + + if (secondhalf) { + fprintf(stderr, "incorrect cookie or uri recovery \n"); + exit(-1); + } + - if (evbuffer_add_buffer(dest, scratch)) { - evbuffer_free(scratch); + if (evbuffer_add(dest, outbuf, sofar)) { log_debug("Failed to transfer buffer"); return RECV_BAD; } evbuffer_drain(source, s2.pos + sizeof("\r\n\r\n") - 1); - evbuffer_free(scratch); } while (evbuffer_get_length(source)); @@ -686,6 +816,9 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev + + + static int x_http2_receive(steg_t *s, conn_t *conn, struct evbuffer *dest) { diff --git a/start-client.csh b/start-client.csh index a09302e..65f4465 100644 --- a/start-client.csh +++ b/start-client.csh @@ -2,7 +2,7 @@ # ./obfsproxy --log-min-severity=debug x_dsteg socks 127.0.0.1:1080 x_http setenv EVENT_NOKQUEUE yes -./obfsproxy --log-min-severity=debug chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 +#./obfsproxy --log-min-severity=debug chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 # ./obfsproxy --log-min-severity=warn chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 -#./obfsproxy --log-min-severity=error chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 +./obfsproxy --log-min-severity=error chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2

1 0

[stegotorus/master] minor fix to find_uri_type
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit ba45fb47ae80ed0c08d4d2c46b07c09d3b01b865 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sun Nov 6 05:28:56 2011 +0000 minor fix to find_uri_type git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@127 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/payloads.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 55 insertions(+), 1 deletions(-) diff --git a/src/steg/payloads.c b/src/steg/payloads.c index c683f77..0cae234 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -398,6 +398,60 @@ find_uri_type(char* buf) { buf = strchr(buf, ' ') + 1; uri_len = strchr(buf, ' ') - buf; + + if (uri_len < 0) { + fprintf(stderr, "buf = %sabc\n", buf); + exit (-1); + + } + + uri = malloc(uri_len + 1); + + strncpy(uri, buf, uri_len); + uri[uri_len] = 0; + + ext = strrchr(uri, '/'); + + if (ext == NULL) { + fprintf(stderr, "no / in url: find_uri_type..."); + return -1; + } + + ext = strchr(ext, '.'); + + + if (ext == NULL || !strncmp(ext, ".html", 5) || !strncmp(ext, ".htm", 4) || !strncmp(ext, ".php", 4) + || !strncmp(ext, ".jsp", 4) || !strncmp(ext, ".asp", 4)) + return HTTP_CONTENT_HTML; + + + if (!strncmp(ext, ".js", 3) || !strncmp(ext, ".JS", 3)) + return HTTP_CONTENT_JAVASCRIPT; + + if (!strncmp(ext, ".pdf", 4) || !strncmp(ext, ".PDF", 4)) + return HTTP_CONTENT_PDF; + + + if (!strncmp(ext, ".swf", 4) || !strncmp(ext, ".SWF", 4)) + return HTTP_CONTENT_SWF; + + return -1; + +} + +/* +int +find_uri_type(char* buf) { + + char* uri; + int uri_len; + char* ext; + + if (strncmp(buf, "GET", 3) != 0 && strncmp(buf, "POST", 4) != 0) + return -1; + + buf = strchr(buf, ' ') + 1; + uri_len = strchr(buf, ' ') - buf; uri = malloc(uri_len + 1); strncpy(uri, buf, uri_len); @@ -428,7 +482,7 @@ find_uri_type(char* buf) { } - +*/

1 0