- tor-commits - lists.torproject.org

[stegotorus/master] minor fix to pdfSteg.c
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 0c81b4df3854f45d0426db6754b1a49e14d7d82b Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Tue Nov 1 06:11:32 2011 +0000 minor fix to pdfSteg.c git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@111 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/pdfSteg.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/steg/pdfSteg.c b/src/steg/pdfSteg.c index 58147fa..05216f9 100644 --- a/src/steg/pdfSteg.c +++ b/src/steg/pdfSteg.c @@ -460,6 +460,13 @@ x_http2_handle_client_PDF_receive(steg_t *s, conn_t *conn, struct evbuffer *dest return RECV_INCOMPLETE; httpHdr = (char *) evbuffer_pullup(source, response_len); + + if (httpHdr == NULL) { + log_warn("CLIENT unable to pullup the complete HTTP body"); + return RECV_BAD; + } + + httpBody = httpHdr + hdrLen;

1 0

[stegotorus/master] git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@123 a58ff0ac-194c-e011-a152-003048836090
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit b111b5d76f2692e48bd692853fa3826696aa7bce Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sat Nov 5 00:22:59 2011 +0000 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@123 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/jsSteg.c | 2 +- src/steg/x_http2.c | 2 +- start-server.csh | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/steg/jsSteg.c b/src/steg/jsSteg.c index a323d44..60b2d9a 100644 --- a/src/steg/jsSteg.c +++ b/src/steg/jsSteg.c @@ -1018,7 +1018,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, // decCnt is an odd number or data is not a hex string if (decCnt % 2) { - log_debug("CLIENT ERROR: An odd number of hex characters received"); + fprintf(stderr, "CLIENT ERROR: An odd number of hex characters received\n"); // buf_dump((unsigned char*)data, decCnt, stderr); return RECV_BAD; } diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index 1359238..f22dcea 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -624,7 +624,7 @@ x_http2_client_uri_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { // fprintf(stderr, "outbuf = %s\n", outbuf); if (evbuffer_add(dest, outbuf, datalen) || // add uri field - evbuffer_add(dest, "HTTP 1.1\r\nHost: ", 19) || + evbuffer_add(dest, "HTTP/1.1\r\nHost: ", 19) || evbuffer_add(dest, peername, strlen(peername)) || evbuffer_add(dest, strstr(buf, "\r\n"), len - (unsigned int) (strstr(buf, "\r\n") - buf)) || // add everything but first line evbuffer_add(dest, "\r\n", 2)) { diff --git a/start-server.csh b/start-server.csh index 935e8bb..eb421c4 100644 --- a/start-server.csh +++ b/start-server.csh @@ -1,6 +1,9 @@ #!/bin/csh setenv EVENT_NOKQUEUE yes -./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +# ./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 # ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 #./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +# ./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081 +# ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081 +./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081

1 0

[stegotorus/master] Modified jsSteg and pdfSteg to generate fixed HTTP headers for the responses, and modified x_http2 and jsSteg to respond with html when html is requested, and to respond with js when js is requested.
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 67f7f83208f1e34d2e8b070afcff4b296f0df431 Author: Steven Cheung <cheung(a)csl.sri.com> Date: Wed Nov 2 17:38:25 2011 +0000 Modified jsSteg and pdfSteg to generate fixed HTTP headers for the responses, and modified x_http2 and jsSteg to respond with html when html is requested, and to respond with js when js is requested. git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@114 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/jsSteg.c | 112 +++++++++++++++++++++++++-------------------------- src/steg/jsSteg.h | 2 +- src/steg/payloads.c | 113 +++++++++++++++++++++++++++++++++++++++++++++++---- src/steg/payloads.h | 12 +++-- src/steg/pdfSteg.c | 31 +++++++++----- src/steg/x_http2.c | 29 ++++++++++++- 6 files changed, 216 insertions(+), 83 deletions(-) diff --git a/src/steg/jsSteg.c b/src/steg/jsSteg.c index 5946062..9c67949 100644 --- a/src/steg/jsSteg.c +++ b/src/steg/jsSteg.c @@ -2,6 +2,8 @@ #include "jsSteg.h" #include "cookies.h" +void buf_dump(unsigned char* buf, int len, FILE *out); + /* * jsSteg: A Javascript-based steganography module @@ -610,7 +612,7 @@ int testDecode2(char *inBuf, char *outBuf, int -x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { +x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn, unsigned int content_type) { struct evbuffer_iovec *iv; int nv; @@ -620,6 +622,9 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { char data[(int) sbuflen*2]; unsigned int datalen; + char newHdr[MAX_RESP_HDR_SIZE]; + int newHdrLen = 0; + size_t sofar = 0; unsigned int cnt = 0; int r; @@ -638,12 +643,12 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { int mode; char *hend; unsigned int hLen; - unsigned int mjs; + unsigned int mjs = 0; char *jsTemplate = NULL; int jsTemplateSize = 0; - + /* int hdrLen; @@ -660,6 +665,13 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { log_debug("sbuflen = %d sofar = %d\n", (int) sbuflen, (int) sofar); + + if (content_type != HTTP_CONTENT_JAVASCRIPT && + content_type != HTTP_CONTENT_HTML) { + log_warn("SERVER ERROR: Unknown content type (%d)", content_type); + return -1; + } + // log_debug("SERVER: dumping data with length %d:", (int) sbuflen); // evbuffer_dump(source, stderr); // Convert data in 'source' to hexadecimal and write it to data @@ -675,15 +687,19 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { // jsTemplate should be init already, by x_http2_new or the previous invocation // of this function - mjs = get_max_JS_capacity(); + if (content_type == HTTP_CONTENT_JAVASCRIPT) { + mjs = get_max_JS_capacity(); + } else if (content_type == HTTP_CONTENT_HTML) { + mjs = get_max_HTML_capacity(); + } if (mjs <= 0) { - log_debug("SERVER ERROR: (server_transmit) No JavaScript found in jsTemplate\n"); + log_warn("SERVER ERROR: No JavaScript found in jsTemplate"); return -1; - } + } if (sbuflen > (size_t) mjs) { - log_debug("SERVER ERROR: (server_transmit) jsTemplate cannot accommodate data %d %dn", + log_warn("SERVER ERROR: (server_transmit) jsTemplate cannot accommodate data %d %dn", (int) sbuflen, (int) mjs); return -1; } @@ -712,10 +728,10 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { - if (get_payload(HTTP_CONTENT_JAVASCRIPT, datalen, &jsTemplate, &jsTemplateSize) == 1) { + if (get_payload(content_type, datalen, &jsTemplate, &jsTemplateSize) == 1) { log_debug("SERVER found the next HTTP response template with size %d", jsTemplateSize); } else { - log_debug("SERVER couldn't find the next HTTP response template; reusing the previous one"); + log_warn("SERVER couldn't find the next HTTP response template; reusing the previous one"); } log_debug("MJS %d %d", datalen, mjs); @@ -747,34 +763,10 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { log_debug("SERVER: using HTTP resp template of length = %d\n", jsLen); // log_debug("HTTP resp tempmlate:"); // buf_dump((unsigned char*)jsTemplate, jsLen, stderr); - // fprintf(stderr, "==========================\n"); hLen = hend+4-jsTemplate; r = encodeHTTPBody(data, hend+4, outbuf, datalen, jsLen-hLen, HTTP_MSG_BUF_SIZE, mode); - - - - /// NEW STUFF - - -/* hdrLen = strstr(jsTemplate, "\r\n\r\n") - jsTemplate + 4; - tmp = strstr(jsTemplate, "Content-Length: ") + strlen("Content-Length: "); - - content_len = atoi(tmp); - - - decCnt = decodeHTTPBody(jsTemplate + hdrLen, data2, content_len, HTTP_MSG_BUF_SIZE, &fin2, mode); - - - if (decCnt == (int) datalen) - fprintf(stderr, "cnts match\n"); - else - fprintf(stderr, "cnts don't match %d %d\n", decCnt, datalen); - -*/ - - if (r < 0 || ((unsigned int) r < datalen)) { fprintf(stderr, "incomplete data encoding\n"); exit(-1); @@ -782,20 +774,32 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { return -1; } - // note: the transformation is length-preserving for now - log_debug("SERVER: HTTP body with encoded data:"); - // buf_dump((unsigned char*)outbuf, jsLen-hLen, stderr); - // fprintf(stderr, "==========================\n"); + if (mode == CONTENT_JAVASCRIPT) { // JavaScript in HTTP body + newHdrLen = gen_response_header((char*) "application/x-javascript", 0, jsLen-hLen, newHdr, sizeof(newHdr)); + } else if (mode == CONTENT_HTML_JAVASCRIPT) { // JavaScript(s) embedded in HTML doc + newHdrLen = gen_response_header((char*) "text/html", 0, jsLen-hLen, newHdr, sizeof(newHdr)); + } else { // unknown mode + log_warn("SERVER ERROR: unknown mode for creating the HTTP response header"); + return -1; + } + if (newHdrLen < 0) { + log_warn("SERVER ERROR: gen_response_header fails for jsSteg"); + return -1; + } - if (evbuffer_add(dest, jsTemplate, hLen)) { - log_debug("SERVER ERROR: x_http2_server_transmit: evbuffer_add() fails for jsTemplate"); + if (evbuffer_add(dest, newHdr, newHdrLen)) { + log_warn("SERVER ERROR: evbuffer_add() fails for newHdr"); return -1; } - // fprintf(stderr, "HELLO ==========================\n"); + // if (evbuffer_add(dest, jsTemplate, hLen)) { + // log_warn("SERVER ERROR: evbuffer_add() fails for jsTemplate"); + // return -1; + // } + if (evbuffer_add(dest, outbuf, jsLen-hLen)) { - log_debug("SERVER ERROR: x_http2_server_transmit: evbuffer_add() fails for outbuf"); + log_warn("SERVER ERROR: evbuffer_add() fails for outbuf"); return -1; } @@ -804,7 +808,6 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { // } while (sbuflen > sofar); - // fprintf(stderr, "SERVER TRANSMITTED payload of size %d\n", (int) sbuflen); // obtain a usable HTTP response template for the next data, and @@ -814,10 +817,6 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn) { log_debug("SERVER finding the next HTTP response template"); - - - - // conn_cease_transmission(conn); conn_close_after_transmit(conn); // downcast_steg(s)->have_transmitted = 1; return 0; @@ -920,9 +919,9 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, } log_debug("CLIENT received HTTP response with length %d\n", response_len); - log_debug("HTTP response:"); - // buf_dump((unsigned char*)respMsg, response_len, stderr); - // fprintf(stderr, "==========================\n"); + // buf_dump((unsigned char*)respMsg, response_len, stderr); + // log_debug("HTTP response header:"); + // buf_dump((unsigned char*)respMsg, hdrLen, stderr); httpBody = respMsg + hdrLen; @@ -936,7 +935,6 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, log_debug("CLIENT Before decodeHTTPBody; mode: %d\n", mode); - // call decodeHTTPBody decCnt = decodeHTTPBody(httpBody, data, response_len-hdrLen, HTTP_MSG_BUF_SIZE, &fin, mode); data[decCnt] = 0; @@ -950,12 +948,12 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, } if (! isxString(data)) { - log_debug("CLIENT ERROR: Data received not hex"); + log_warn("CLIENT ERROR: Data received not hex"); // buf_dump((unsigned char*)data, decCnt, stderr); return RECV_BAD; } - log_debug("Hex data received:"); + // log_debug("Hex data received:"); // buf_dump ((unsigned char*)data, decCnt, stderr); // get a scratch buffer @@ -963,7 +961,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, if (!scratch) return RECV_BAD; if (evbuffer_expand(scratch, decCnt/2)) { - log_debug("CLIENT ERROR: Evbuffer expand failed \n"); + log_warn("CLIENT ERROR: Evbuffer expand failed \n"); evbuffer_free(scratch); return RECV_BAD; } @@ -975,16 +973,16 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, evbuffer_add(scratch, &c, 1); } - log_debug("CLIENT Done converting hex data to binary:\n"); + // log_debug("CLIENT Done converting hex data to binary:\n"); // evbuffer_dump(scratch, stderr); // fprintf(stderr, "CLIENT RECEIVED payload of size %d\n", (int) evbuffer_get_length(scratch)); - // add the scratch buffer (which contains the data) to dest + // add the scratch buffer (which contains the data) to dest if (evbuffer_add_buffer(dest, scratch)) { evbuffer_free(scratch); - log_debug("CLIENT ERROR: Failed to transfer buffer"); + log_warn("CLIENT ERROR: Failed to transfer buffer"); return RECV_BAD; } log_debug("Added scratch (buffer) to dest\n"); @@ -994,7 +992,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, if (response_len <= evbuffer_get_length(source)) { if (evbuffer_drain(source, response_len) == -1) { - log_debug("CLIENT ERROR: Added scratch (buffer) to dest\n"); + log_warn("CLIENT ERROR: Failed to drain source"); return RECV_BAD; } } diff --git a/src/steg/jsSteg.h b/src/steg/jsSteg.h index 3c5f6ae..c076460 100644 --- a/src/steg/jsSteg.h +++ b/src/steg/jsSteg.h @@ -53,7 +53,7 @@ int testDecode2(char *inBuf, char *outBuf, int -x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn); +x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn, unsigned int content_type); int x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct evbuffer* source); diff --git a/src/steg/payloads.c b/src/steg/payloads.c index 8d0b8fe..017c469 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -12,6 +12,7 @@ static int typePayloadCap[MAX_CONTENT_TYPE][MAX_PAYLOADS]; static unsigned int max_JS_capacity = 0; +static unsigned int max_HTML_capacity = 0; static unsigned int max_PDF_capacity = 0; @@ -25,6 +26,10 @@ unsigned int get_max_JS_capacity() { return max_JS_capacity; } +unsigned int get_max_HTML_capacity() { + return max_HTML_capacity; +} + unsigned int get_max_PDF_capacity() { return max_PDF_capacity; } @@ -422,12 +427,15 @@ find_uri_type(char* buf) { if (!strncmp(ext, ".swf", 4) || !strncmp(ext, ".SWF", 4)) return HTTP_CONTENT_SWF; - // if (!strncmp(ext, ".js", 3) || !strncmp(ext, ".JS", 3)) - return HTTP_CONTENT_JAVASCRIPT; + if (!strncmp(ext, ".js", 3) || !strncmp(ext, ".JS", 3)) + return HTTP_CONTENT_JAVASCRIPT; if (!strncmp(ext-1, "html", 4) || !strncmp(ext, "htm", 3) || strchr(ext-1, '.') == NULL) return HTTP_CONTENT_HTML; + // default type + return HTTP_CONTENT_HTML; + // return HTTP_CONTENT_JAVASCRIPT; return -1; } @@ -441,7 +449,6 @@ find_uri_type(char* buf) { - unsigned int find_client_payload(char* buf, int len, int type) { int r = rand() % payload_count; int cnt = 0; @@ -455,8 +462,10 @@ unsigned int find_client_payload(char* buf, int len, int type) { if (p->ptype == type) { inbuf = payloads[r]; if (find_uri_type(inbuf) != HTTP_CONTENT_SWF && - find_uri_type(inbuf) != HTTP_CONTENT_JAVASCRIPT) + find_uri_type(inbuf) != HTTP_CONTENT_HTML && + find_uri_type(inbuf) != HTTP_CONTENT_JAVASCRIPT) { goto next; + } if (p->length > len) { fprintf(stderr, "BUFFER TOO SMALL... \n"); goto next; @@ -490,7 +499,7 @@ unsigned int find_client_payload(char* buf, int len, int type) { * keyword * * todo: - * Use a more efficient algo (e.g., Aho-Corasick) in the next iteration + * Use a more efficient regular expression matching algo */ int skipJSPattern (char *cp, int len) { @@ -864,10 +873,10 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { #endif if (type != HTTP_CONTENT_JAVASCRIPT && + type != HTTP_CONTENT_HTML && type != HTTP_CONTENT_PDF && type != HTTP_CONTENT_SWF) return 0; - // assumption: buf is null-terminated if (!strstr(buf, "\r\n\r\n")) return 0; @@ -918,7 +927,8 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { tjFlag, thFlag, ceFlag, teFlag, http304Flag, clZeroFlag); #endif - if (type == HTTP_CONTENT_JAVASCRIPT) { + // if (type == HTTP_CONTENT_JAVASCRIPT) + if (type == HTTP_CONTENT_JAVASCRIPT || type == HTTP_CONTENT_HTML) { // empty body if it's HTTP not modified (304) or zero Content-Length if (http304Flag || clZeroFlag) return 0; @@ -1072,7 +1082,7 @@ int init_JS_payload_pool(int len, int type, int minCapacity) { msgbuf = payloads[r]; mode = has_eligible_HTTP_content(msgbuf, p->length, HTTP_CONTENT_JAVASCRIPT); - if (mode > 0) { + if (mode == CONTENT_JAVASCRIPT) { cap = capacityJS3(msgbuf, p->length, mode); if (cap < JS_DELIMITER_SIZE) @@ -1124,6 +1134,93 @@ int init_JS_payload_pool(int len, int type, int minCapacity) { } +int init_HTML_payload_pool(int len, int type, int minCapacity) { + + // stat for usable payload + int minPayloadSize = 0, maxPayloadSize = 0; + int sumPayloadSize = 0; + int minPayloadCap = 0, maxPayloadCap = 0; + int sumPayloadCap = 0; + + unsigned int contentType = HTTP_CONTENT_HTML; + + int cnt = 0; + int r; + pentry_header* p; + char* msgbuf; + int cap; + int mode; + + + + if (payload_count == 0) { + log_debug("payload_count == 0; forgot to run load_payloads()?\n"); + return 0; + } + + if (initTypePayload[contentType] != 0) return 1; // init is done already + + + for (r = 0; r < payload_count; r++) { + p = &payload_hdrs[r]; + if (p->ptype != type || p->length > len) { + continue; + } + + msgbuf = payloads[r]; + + mode = has_eligible_HTTP_content(msgbuf, p->length, HTTP_CONTENT_HTML); + if (mode == CONTENT_HTML_JAVASCRIPT) { + + cap = capacityJS3(msgbuf, p->length, mode); + if (cap < JS_DELIMITER_SIZE) + continue; + + cap = (cap - JS_DELIMITER_SIZE)/2; + + if (cap > minCapacity) { + typePayloadCap[contentType][cnt] = cap; // (cap-JS_DELIMITER_SIZE)/2; + // because we use 2 hex char to encode every data byte, the available + // capacity for encoding data is divided by 2 + typePayload[contentType][cnt] = r; + cnt++; + + // update stat + if (cnt == 1) { + minPayloadSize = p->length; maxPayloadSize = p->length; + minPayloadCap = cap; maxPayloadCap = cap; + } + else { + if (minPayloadSize > p->length) minPayloadSize = p->length; + if (maxPayloadSize < p->length) maxPayloadSize = p->length; + if (minPayloadCap > cap) minPayloadCap = cap; + if (maxPayloadCap < cap) { + maxPayloadCap = cap; + } + + } + sumPayloadSize += p->length; sumPayloadCap += cap; + } + } + } + + + max_HTML_capacity = maxPayloadCap; + + + initTypePayload[contentType] = 1; + typePayloadCount[contentType] = cnt; + log_debug("init_payload_pool: typePayloadCount for contentType %d = %d", + contentType, typePayloadCount[contentType]); + log_debug("minPayloadSize = %d", minPayloadSize); + log_debug("maxPayloadSize = %d", maxPayloadSize); + log_debug("avgPayloadSize = %f", (float)sumPayloadSize/(float)cnt); + log_debug("minPayloadCap = %d", minPayloadCap); + log_debug("maxPayloadCap = %d", maxPayloadCap); + log_debug("avgPayloadCap = %f", (float)sumPayloadCap/(float)cnt); + return 1; +} + diff --git a/src/steg/payloads.h b/src/steg/payloads.h index b3fcc9d..56729fe 100644 --- a/src/steg/payloads.h +++ b/src/steg/payloads.h @@ -28,7 +28,8 @@ #define NO_NEXT_STATE -1 #define MAX_PAYLOADS 10000 -// #define HTTP_MSG_BUF_SIZE 100000 +#define MAX_RESP_HDR_SIZE 512 + // jsSteg-specific defines #define JS_DELIMITER '?' @@ -39,13 +40,12 @@ // data encoding will be replaced by JS_DELIMITER_REPLACEMENT #define JS_DELIMITER_SIZE 1 -#define JS_MIN_AVAIL_SIZE 2050 +// #define JS_MIN_AVAIL_SIZE 2050 +#define JS_MIN_AVAIL_SIZE 1026 // JS_MIN_AVAIL_SIZE should reflect the min number of data bytes // a JavaScript may encapsulate -// Using hex-based encoding, it takes 2 hex char in JS -// to encode 1 data byte. Thus the size of data that can be encoded -// is about half this value +#define HTML_MIN_AVAIL_SIZE 1026 #define PDF_DELIMITER_SIZE 2 #define PDF_MIN_AVAIL_SIZE 10240 @@ -128,6 +128,7 @@ unsigned int find_server_payload(char** buf, int len, int type, int contentType) int init_JS_payload_pool(int len, int type, int minCapacity); int init_SWF_payload_pool(int len, int type, int minCapacity); int init_PDF_payload_pool(int len, int type,int minCapacity); +int init_HTML_payload_pool(int len, int type, int minCapacity); int get_next_payload (int contentType, char** buf, int* size, int* cap); @@ -145,6 +146,7 @@ int offset2Hex (char *p, int range, int isLastCharHex); unsigned int capacityJS (char* buf, int len, int mode); unsigned int capacityJS3 (char* buf, int len, int mode); unsigned int get_max_JS_capacity(void); +unsigned int get_max_HTML_capacity(void); char * strInBinary (const char *pattern, unsigned int patternLen, const char *blob, unsigned int blobLen); diff --git a/src/steg/pdfSteg.c b/src/steg/pdfSteg.c index 05216f9..4a91e55 100644 --- a/src/steg/pdfSteg.c +++ b/src/steg/pdfSteg.c @@ -79,8 +79,12 @@ addDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, * * returns the length of data written to outbuf, if succeed; * otherwise, it returns -1 + * * endFlag indicates whether the end-of-encoding byte pattern (i.e., * delimiter1 followed by non-delimiter1) is detected + * + * escape indicates if a dangling delimiter1 has been + * seen in the previous invocation of removeDelimiter */ int removeDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, @@ -113,16 +117,13 @@ removeDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, while ((ibp-inbuf+1)<inbuflen && cnt<outbuflen) { ic1 = *(ibp++); if (ic1 != delimiter1) { - // *escape = 0; outbuf[cnt++] = ic1; } else { - // *escape = 1; // lookahead 1 char ic2 = *ibp; // if the next char is delimiter1 if (ic2 == delimiter1) { outbuf[cnt++] = delimiter1; ibp++; - // *escape = 0; } else { // end-of-data pattern detected *endFlag = 1; break; @@ -130,10 +131,6 @@ removeDelimiter(char *inbuf, int inbuflen, char *outbuf, int outbuflen, } } - // if (*escape) { - // *escape = 0; - // return cnt; - // } if (ibp-inbuf == inbuflen) return cnt; // handling the last char in inbuf, if needed @@ -217,7 +214,7 @@ pdfWrap (char *data, unsigned int dlen, memcpy(op, dp, size2); op += size2; tp += size2; dp += size2; cnt += size2; - printf("Encoded %d char in pdf. Done encoding\n", size2); + // printf("Encoded %d char in pdf. Done encoding\n", size2); break; } log_debug("Encoded %d char in pdf", size); @@ -311,6 +308,9 @@ int x_http2_server_PDF_transmit (steg_t* s, struct evbuffer *source, conn_t *con char outbuf[HTTP_MSG_BUF_SIZE]; int cnt, hLen, outbuflen, i; + char newHdr[MAX_RESP_HDR_SIZE]; + int newHdrLen = 0; + struct evbuffer_iovec *iv; int nv; @@ -400,10 +400,21 @@ int x_http2_server_PDF_transmit (steg_t* s, struct evbuffer *source, conn_t *con // } - if (evbuffer_add(dest, pdfTemplate, hLen)) { - log_warn("SERVER ERROR: evbuffer_add() fails for pdfTemplate"); + newHdrLen = gen_response_header((char*) "application/pdf", 0, outbuflen, newHdr, sizeof(newHdr)); + if (newHdrLen < 0) { + log_warn("SERVER ERROR: gen_response_header fails for pdfSteg"); return -1; } + + if (evbuffer_add(dest, newHdr, newHdrLen)) { + log_warn("SERVER ERROR: evbuffer_add() fails for newHdr"); + return -1; + } + // if (evbuffer_add(dest, pdfTemplate, hLen)) { + // log_warn("SERVER ERROR: evbuffer_add() fails for pdfTemplate"); + // return -1; + // } + if (evbuffer_add(dest, outbuf, outbuflen)) { log_warn("SERVER ERROR: evbuffer_add() fails for outbuf"); return -1; diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index 0710fa7..f3789b2 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -49,6 +49,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + #define MIN_COOKIE_SIZE 128 #define MAX_COOKIE_SIZE 2048 @@ -154,6 +156,7 @@ x_http2_new(rng_t *rng, unsigned int is_clientside) else { load_payloads("traces/server.out"); init_JS_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, JS_MIN_AVAIL_SIZE); + init_HTML_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, HTML_MIN_AVAIL_SIZE); // init_PDF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, PDF_MIN_AVAIL_SIZE); init_SWF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, 0); } @@ -304,6 +307,17 @@ x_http2_transmit_room(steg_t *s, conn_t *conn) log_warn("js capacity too small\n"); exit(-1); + case HTTP_CONTENT_HTML: + mjc = get_max_HTML_capacity() / 2; + if (mjc > 1024) { + // it should be 1024 + ...., but seems like we need to be a little bit smaller (chopper bug?) + int rval = 512 + rand()%(mjc - 1024); + // fprintf(stderr, "returning rval %d, mjc %d\n", rval, mjc); + return rval; + } + log_warn("js capacity too small\n"); + exit(-1); + case HTTP_CONTENT_PDF: // return 1024 + rand()%(get_max_PDF_capacity() - 1024) return PDF_MIN_AVAIL_SIZE; @@ -462,7 +476,11 @@ x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { log_debug("error ***********************"); return -1; } - + + // debug + // log_warn("CLIENT HTTP request header:"); + // buf_dump((unsigned char*)buf, len, stderr); + // sofar += datalen/2; evbuffer_drain(source, datalen/2); @@ -517,8 +535,13 @@ x_http2_transmit(steg_t *s, struct evbuffer *source, conn_t *conn) case HTTP_CONTENT_SWF: rval = x_http2_server_SWF_transmit(s, source, conn); break; + case HTTP_CONTENT_JAVASCRIPT: - rval = x_http2_server_JS_transmit(s, source, conn); + rval = x_http2_server_JS_transmit(s, source, conn, HTTP_CONTENT_JAVASCRIPT); + break; + + case HTTP_CONTENT_HTML: + rval = x_http2_server_JS_transmit(s, source, conn, HTTP_CONTENT_HTML); break; case HTTP_CONTENT_PDF: @@ -680,7 +703,9 @@ x_http2_receive(steg_t *s, conn_t *conn, struct evbuffer *dest) case HTTP_CONTENT_SWF: rval = x_http2_handle_client_SWF_receive(s, conn, dest, source); break; + case HTTP_CONTENT_JAVASCRIPT: + case HTTP_CONTENT_HTML: rval = x_http2_handle_client_JS_receive(s, conn, dest, source); break;

1 0

[stegotorus/master] cookies.h needs string.h
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit ccff1dbe3b44a83a79b687a7f359770bd6ebf7b0 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Fri Nov 4 21:27:59 2011 +0000 cookies.h needs string.h git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@122 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/cookies.h | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/steg/cookies.h b/src/steg/cookies.h index 4970776..abda927 100644 --- a/src/steg/cookies.h +++ b/src/steg/cookies.h @@ -6,6 +6,7 @@ #include <stdio.h> #include <strings.h> #include <stdlib.h> +#include <string.h> int unwrap_cookie(unsigned char* inbuf, unsigned char* outbuf, int buflen); int gen_cookie_field(unsigned char* outbuf, int total_cookie_len, unsigned char* data, int datalen);

1 0

[stegotorus/master] git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@124 a58ff0ac-194c-e011-a152-003048836090
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 3e5e2ee2cfd54bbd23868b0a1ffd263b8c47d3f8 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sat Nov 5 00:34:55 2011 +0000 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@124 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/x_http2.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index f22dcea..3695c27 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -675,7 +675,7 @@ x_http2_transmit(steg_t *s, struct evbuffer *source, conn_t *conn) the only plausible places to put it are the URL and cookies. This presently uses the URL. And it can't be binary. */ - if (evbuffer_get_length(source) < 256) + if (evbuffer_get_length(source) < 128) return x_http2_client_uri_transmit(s, source, conn); //@@ return x_http2_client_cookie_transmit(s, source, conn); //@@ }

1 0

[stegotorus/master] added uri steg support to x_http2
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 451f65972456021ebc3722e8383e0809fab0374f Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Fri Nov 4 17:38:21 2011 +0000 added uri steg support to x_http2 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@119 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/x_http.c | 2 +- src/steg/x_http2.c | 251 +++++++++++++++++++++++++++++++++++++++------------ start-client.csh | 4 +- 3 files changed, 195 insertions(+), 62 deletions(-) diff --git a/src/steg/x_http.c b/src/steg/x_http.c index c26fe1f..eb08401 100644 --- a/src/steg/x_http.c +++ b/src/steg/x_http.c @@ -71,7 +71,7 @@ x_http_detect(conn_t *conn) { struct evbuffer *buf = conn_get_inbound(conn); unsigned char *data; - return 0; + return 0; /* Look for the text of http_response_1. */ if (evbuffer_get_length(buf) >= sizeof http_response_1 - 1) { diff --git a/src/steg/x_http2.c b/src/steg/x_http2.c index f3789b2..1359238 100644 --- a/src/steg/x_http2.c +++ b/src/steg/x_http2.c @@ -87,11 +87,12 @@ STEG_DEFINE_MODULE(x_http2, -int x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn); +int x_http2_client_uri_transmit (steg_t *s, struct evbuffer *source, conn_t *conn); +int x_http2_client_cookie_transmit (steg_t *s, struct evbuffer *source, conn_t *conn); void evbuffer_dump(struct evbuffer *buf, FILE *out); void buf_dump(unsigned char* buf, int len, FILE *out); - +int gen_uri_field(char* uri, unsigned int uri_sz, char* data, int datalen); void @@ -156,6 +157,7 @@ x_http2_new(rng_t *rng, unsigned int is_clientside) else { load_payloads("traces/server.out"); init_JS_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, JS_MIN_AVAIL_SIZE); + // init_JS_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, JS_MIN_AVAIL_SIZE, HTTP_CONTENT_HTML); init_HTML_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, HTML_MIN_AVAIL_SIZE); // init_PDF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, PDF_MIN_AVAIL_SIZE); init_SWF_payload_pool(HTTP_MSG_BUF_SIZE, TYPE_HTTP_RESPONSE, 0); @@ -376,7 +378,7 @@ lookup_peer_name_from_ip(char* p_ip, char* p_name) { int -x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { +x_http2_client_cookie_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { /* On the client side, we have to embed the data in a GET query somehow; the only plausible places to put it are the URL and cookies. This @@ -496,6 +498,153 @@ x_http2_client_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { +int gen_uri_field(char* uri, unsigned int uri_sz, char* data, int datalen) { + unsigned int so_far = 0; + uri[0] = 0; + + strcat(uri, "GET /"); + so_far = 5; + + while (datalen > 0) { + unsigned int r = rand() % 4; + + if (r == 1) { + r = rand() % 46; + if (r < 20) + uri[so_far++] = 'g' + r; + else + uri[so_far++] = 'A' + r - 20; + } + else { + uri[so_far++] = data[0]; + data++; + datalen--; + } + + + + r = rand() % 8; + + if (r == 0 && datalen > 0) + uri[so_far++] = '/'; + + if (so_far > uri_sz - 6) { + fprintf(stderr, "too small\n"); + return 0; + } + } + + switch(rand()%4){ + case 1: + memcpy(uri+so_far, ".htm ", 6); + break; + case 2: + memcpy(uri+so_far, ".html ", 7); + break; + case 3: + memcpy(uri+so_far, ".js ", 5); + break; + case 0: + memcpy(uri+so_far, ".swf ", 6); + break; + + } + + return strlen(uri); + +} + + + + + +int +x_http2_client_uri_transmit (steg_t *s, struct evbuffer *source, conn_t *conn) { + + + struct evbuffer *dest = conn_get_outbound(conn); + + + struct evbuffer_iovec *iv; + int i, nv; + + /* Convert all the data in 'source' to hexadecimal and write it to + 'scratch'. Data is padded to a multiple of four characters with + equals signs. */ + size_t slen = evbuffer_get_length(source); + size_t datalen = 0; + int cnt = 0; + char data[2*slen]; + + char outbuf[1024]; + int len =0; + char buf[10000]; + + + if (has_peer_name == 0 && lookup_peer_name_from_ip((char*) conn->peername, peername)) + has_peer_name = 1; + + + + nv = evbuffer_peek(source, slen, NULL, NULL, 0); + iv = xzalloc(sizeof(struct evbuffer_iovec) * nv); + if (evbuffer_peek(source, slen, NULL, iv, nv) != nv) { + free(iv); + return -1; + } + + for (i = 0; i < nv; i++) { + const unsigned char *p = iv[i].iov_base; + const unsigned char *limit = p + iv[i].iov_len; + char c; + while (p < limit) { + c = *p++; + data[datalen++] = "0123456789abcdef"[(c & 0xF0) >> 4]; + data[datalen++] = "0123456789abcdef"[(c & 0x0F) >> 0]; + } + } + free(iv); + + + + do { + datalen = gen_uri_field(outbuf, sizeof(outbuf), data, datalen); + } while (datalen == 0); + + + + + // retry up to 10 times + while (!len) { + len = find_client_payload(buf, sizeof(buf), TYPE_HTTP_REQUEST); + if (cnt++ == 10) return -1; + } + + + // fprintf(stderr, "outbuf = %s\n", outbuf); + + if (evbuffer_add(dest, outbuf, datalen) || // add uri field + evbuffer_add(dest, "HTTP 1.1\r\nHost: ", 19) || + evbuffer_add(dest, peername, strlen(peername)) || + evbuffer_add(dest, strstr(buf, "\r\n"), len - (unsigned int) (strstr(buf, "\r\n") - buf)) || // add everything but first line + evbuffer_add(dest, "\r\n", 2)) { + log_debug("error ***********************"); + return -1; + } + + + + evbuffer_drain(source, slen); + conn_cease_transmission(conn); + downcast_steg(s)->type = find_uri_type(outbuf); + downcast_steg(s)->have_transmitted = 1; + return 0; + +} + + + + @@ -526,7 +675,9 @@ x_http2_transmit(steg_t *s, struct evbuffer *source, conn_t *conn) the only plausible places to put it are the URL and cookies. This presently uses the URL. And it can't be binary. */ - return x_http2_client_transmit(s, source, conn); //@@ + if (evbuffer_get_length(source) < 256) + return x_http2_client_uri_transmit(s, source, conn); //@@ + return x_http2_client_cookie_transmit(s, source, conn); //@@ } else { int rval = -1; @@ -570,10 +721,10 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev struct evbuffer_ptr s2 = evbuffer_search(source, "\r\n\r\n", sizeof ("\r\n\r\n") -1 , NULL); unsigned char* limit; unsigned char *p; - int unwrapped_cookie_len; - struct evbuffer *scratch; unsigned char c, h, secondhalf; - unsigned char buf[evbuffer_get_length(source)]; + char outbuf[MAX_COOKIE_SIZE]; + int sofar = 0; + int cookie_mode = 0; if (s2.pos == -1) { @@ -584,7 +735,7 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev log_debug("SERVER received request header of length %d", (int)s2.pos); - data = evbuffer_pullup(source, s2.pos); + data = evbuffer_pullup(source, s2.pos+4); if (data == NULL) { log_debug("SERVER evbuffer_pullup fails"); return RECV_BAD; @@ -593,81 +744,60 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev limit = data + s2.pos; type = find_uri_type((char *)data); - log_warn ("*** Got type %d", type); - /* if (type != 3) { - fprintf(stderr, "type != 3, %d, data = %s \n", find_uri_type2((char *) data), data); - exit(-1); - }*/ + data[s2.pos+4] = 0; + // fprintf(stderr, "data = %s\n", data); - data = (unsigned char*) strstr((char*) data, "Cookie:"); - - if (data == NULL || memcmp(data, "Cookie:", sizeof "Cookie:"-1)) { - log_debug("Unexpected HTTP verb: %.*s", 5, data); - return RECV_BAD; + if (strstr((char*) data, "Cookie") != NULL) { + data = (unsigned char*) strstr((char*) data, "Cookie:"); + p = data + sizeof "Cookie: "-1; + cookie_mode = 1; } - - p = data + sizeof "Cookie: "-1; - unwrapped_cookie_len = unwrap_cookie(p, buf, (int) (limit - p)); - - log_debug("SERVER: received cookie of length = %d %d\n", unwrapped_cookie_len, (int) (limit-p)); - // buf_dump(buf, unwrapped_cookie_len, stderr); - // fprintf(stderr, "==========================\n"); - // buf_dump(p, (int) (limit-p), stderr); - - - // log_debug("hello SERVER received %d cnt = %d\n", (int) (limit - p), cnt); - // buf_dump(p, (int) (limit-p), stderr); - - /* We need a scratch buffer here because the contract is that if - we hit a decode error we *don't* write anything to 'dest'. */ - scratch = evbuffer_new(); - - if (!scratch) return RECV_BAD; - - - if (evbuffer_expand(scratch, unwrapped_cookie_len/2)) { - log_debug("Evbuffer expand failed \n"); - evbuffer_free(scratch); - return RECV_BAD; - } - p = buf; + else + p = data + sizeof "GET /" -1; secondhalf = 0; - while ((int) (p - buf) < unwrapped_cookie_len) { - if (!secondhalf) c = 0; - if ('0' <= *p && *p <= '9') h = *p - '0'; - else if ('a' <= *p && *p <= 'f') h = *p - 'a' + 10; - else if ('A' <= *p && *p <= 'F') h = *p - 'A' + 10; - else if (*p == '=' && !secondhalf) { + c = 0; + + + while (strncmp((char*) p, "\r\n", 4) != 0 && (cookie_mode != 0 || p[0] != '.')) { + if (!secondhalf) + c = 0; + if ('0' <= *p && *p <= '9') + h = *p - '0'; + else if ('a' <= *p && *p <= 'f') + h = *p - 'a' + 10; + else { p++; continue; - } else { - evbuffer_free(scratch); - log_debug("Decode error: unexpected URI characterasdfaf %d", *p); - return RECV_BAD; } c = (c << 4) + h; if (secondhalf) { - evbuffer_add(scratch, &c, 1); - // log_debug("adding to scratch"); + outbuf[sofar++] = c; cnt++; } secondhalf = !secondhalf; p++; } + outbuf[sofar] = 0; + + // fprintf(stderr, "recvd = %d\n", sofar); + + if (secondhalf) { + fprintf(stderr, "incorrect cookie or uri recovery \n"); + exit(-1); + } + - if (evbuffer_add_buffer(dest, scratch)) { - evbuffer_free(scratch); + if (evbuffer_add(dest, outbuf, sofar)) { log_debug("Failed to transfer buffer"); return RECV_BAD; } evbuffer_drain(source, s2.pos + sizeof("\r\n\r\n") - 1); - evbuffer_free(scratch); } while (evbuffer_get_length(source)); @@ -686,6 +816,9 @@ x_http2_server_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct ev + + + static int x_http2_receive(steg_t *s, conn_t *conn, struct evbuffer *dest) { diff --git a/start-client.csh b/start-client.csh index a09302e..65f4465 100644 --- a/start-client.csh +++ b/start-client.csh @@ -2,7 +2,7 @@ # ./obfsproxy --log-min-severity=debug x_dsteg socks 127.0.0.1:1080 x_http setenv EVENT_NOKQUEUE yes -./obfsproxy --log-min-severity=debug chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 +#./obfsproxy --log-min-severity=debug chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 # ./obfsproxy --log-min-severity=warn chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 -#./obfsproxy --log-min-severity=error chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2 +./obfsproxy --log-min-severity=error chop socks 127.0.0.1:1080 127.0.0.1:8080 x_http2 127.0.0.1:8081 x_http2

1 0

[stegotorus/master] minor fix to find_uri_type
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit ba45fb47ae80ed0c08d4d2c46b07c09d3b01b865 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sun Nov 6 05:28:56 2011 +0000 minor fix to find_uri_type git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@127 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/payloads.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 55 insertions(+), 1 deletions(-) diff --git a/src/steg/payloads.c b/src/steg/payloads.c index c683f77..0cae234 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -398,6 +398,60 @@ find_uri_type(char* buf) { buf = strchr(buf, ' ') + 1; uri_len = strchr(buf, ' ') - buf; + + if (uri_len < 0) { + fprintf(stderr, "buf = %sabc\n", buf); + exit (-1); + + } + + uri = malloc(uri_len + 1); + + strncpy(uri, buf, uri_len); + uri[uri_len] = 0; + + ext = strrchr(uri, '/'); + + if (ext == NULL) { + fprintf(stderr, "no / in url: find_uri_type..."); + return -1; + } + + ext = strchr(ext, '.'); + + + if (ext == NULL || !strncmp(ext, ".html", 5) || !strncmp(ext, ".htm", 4) || !strncmp(ext, ".php", 4) + || !strncmp(ext, ".jsp", 4) || !strncmp(ext, ".asp", 4)) + return HTTP_CONTENT_HTML; + + + if (!strncmp(ext, ".js", 3) || !strncmp(ext, ".JS", 3)) + return HTTP_CONTENT_JAVASCRIPT; + + if (!strncmp(ext, ".pdf", 4) || !strncmp(ext, ".PDF", 4)) + return HTTP_CONTENT_PDF; + + + if (!strncmp(ext, ".swf", 4) || !strncmp(ext, ".SWF", 4)) + return HTTP_CONTENT_SWF; + + return -1; + +} + +/* +int +find_uri_type(char* buf) { + + char* uri; + int uri_len; + char* ext; + + if (strncmp(buf, "GET", 3) != 0 && strncmp(buf, "POST", 4) != 0) + return -1; + + buf = strchr(buf, ' ') + 1; + uri_len = strchr(buf, ' ') - buf; uri = malloc(uri_len + 1); strncpy(uri, buf, uri_len); @@ -428,7 +482,7 @@ find_uri_type(char* buf) { } - +*/

1 0

[stegotorus/master] git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@126 a58ff0ac-194c-e011-a152-003048836090
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 5e617e61d1165df71237147dc60400c2b5f47ec5 Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Sun Nov 6 02:46:06 2011 +0000 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@126 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/payloads.c | 59 ++++++++++++++++++++++++++++++++++++++++---------- start-server.csh | 5 +--- 2 files changed, 48 insertions(+), 16 deletions(-) diff --git a/src/steg/payloads.c b/src/steg/payloads.c index 02be31b..c683f77 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -303,19 +303,7 @@ void gen_rfc_1123_date(char* buf, int buf_size) { -/* sample response header */ -/* - -HTTP/1.1 200 OK -Date: Fri, 21 Oct 2011 19:09:49 GMT -Server: Apache -Content-Length: 1441 -* Content-Encoding: gzip -Content-Type: text/html;charset=UTF-8 -* Keep-Alive: timeout=15, max=93 -Connection: close -*/ int gen_response_header(char* content_type, int gzip, int length, char* buf, int buflen) { @@ -501,6 +489,52 @@ unsigned int find_client_payload(char* buf, int len, int type) { * todo: * Use a more efficient regular expression matching algo */ + + + +int skipJSPattern(char *cp, int len) { + int i,j; + + char keywords [21][10]= {"function", "return", "var", "int", "random", "Math", "while", + "else", "for", "document", "write", "writeln", "true", + "false", "True", "False", "window", "indexOf", "navigator", "case", "if"}; + + if (len < 1) return 0; + + // change the limit to 21 to enable if as a keyword + for (i=0; i < 20; i++) { + char* word = keywords[i]; + + if (len <= (int) strlen(word)) + continue; + + if (word[0] != cp[0]) + continue; + + for (j=1; j < (int) strlen(word); j++) { + if (isxdigit(word[j])) { + if (!isxdigit(cp[j])) + goto next_word; + else + continue; + } + + if (cp[j] != word[j]) + goto next_word; + } + if (!isalnum(cp[j])) + return strlen(word)+1; + + next_word: + continue; + } + + return 0; +} + + +/* + int skipJSPattern (char *cp, int len) { // log_debug("Turning off skipJSPattern for debugging"); @@ -561,6 +595,7 @@ int skipJSPattern (char *cp, int len) { return 0; } +*/ int isalnum_ (char c) { diff --git a/start-server.csh b/start-server.csh index eb421c4..b7d61e6 100644 --- a/start-server.csh +++ b/start-server.csh @@ -2,8 +2,5 @@ setenv EVENT_NOKQUEUE yes # ./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 # ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 -#./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 +./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 127.0.0.1:8080 127.0.0.1:8081 -# ./obfsproxy --log-min-severity=debug chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081 -# ./obfsproxy --log-min-severity=warn chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081 -./obfsproxy --log-min-severity=error chop server 87.73.82.145:8080 128.18.9.71:8080 128.18.9.71:8081

1 0

[stegotorus/master] added gzip encoding to jsSteg
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 2d5331fb2bd8b1197be8c7cb4fc43c7790102902 Author: Steven Cheung <cheung(a)csl.sri.com> Date: Thu Nov 3 00:11:21 2011 +0000 added gzip encoding to jsSteg git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@118 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/jsSteg.c | 551 ++++++++++++++++++++++++--------------------------- src/steg/jsSteg.h | 15 ++- src/steg/payloads.c | 18 +- 3 files changed, 277 insertions(+), 307 deletions(-) diff --git a/src/steg/jsSteg.c b/src/steg/jsSteg.c index 9c67949..a323d44 100644 --- a/src/steg/jsSteg.c +++ b/src/steg/jsSteg.c @@ -32,6 +32,101 @@ int isxString(char *str) { /* + * isGzipContent(char *msg) + * + * If the HTTP header of msg specifies that the content is gzipped, + * this function returns 1; otherwise, it returns 0 + * + * Assumptions: + * msg is null terminated + * + */ +int isGzipContent (char *msg) { + char *ptr = msg, *end; + int gzipFlag = 0; + + if (!strstr(msg, "\r\n\r\n")) + return 0; + + while (1) { + end = strstr(ptr, "\r\n"); + if (end == NULL) { + break; + } + + if (!strncmp(ptr, "Content-Encoding: gzip", 22)) { + gzipFlag = 1; + break; + } + + if (!strncmp(end, "\r\n\r\n", 4)){ + break; + } + ptr = end+2; + } + + return gzipFlag; +} + + +/* + * findContentType(char *msg) + * + * If the HTTP header of msg specifies that the content type: + * case (content type) + * javascript: return HTTP_CONTENT_JAVASCRIPT + * pdf: return HTTP_CONTENT_PDF + * shockwave: return HTTP_CONTENT_SWF + * html: return HTTP_CONTENT_HTML + * otherwise: return 0 + * + * Assumptions: + * msg is null terminated + * + */ +int findContentType (char *msg) { + char *ptr = msg, *end; + + if (!strstr(msg, "\r\n\r\n")) + return 0; + + while (1) { + end = strstr(ptr, "\r\n"); + if (end == NULL) { + break; + } + + if (!strncmp(ptr, "Content-Type:", 13)) { + + if (!strncmp(ptr+14, "text/javascript", 15) || + !strncmp(ptr+14, "application/javascript", 22) || + !strncmp(ptr+14, "application/x-javascript", 24)) { + return HTTP_CONTENT_JAVASCRIPT; + } + if (!strncmp(ptr+14, "text/html", 9)) { + return HTTP_CONTENT_HTML; + } + if (!strncmp(ptr+14, "application/pdf", 15) || + !strncmp(ptr+14, "application/x-pdf", 17)) { + return HTTP_CONTENT_PDF; + } + if (!strncmp(ptr+14, "application/x-shockwave-flash", strlen("application/x-shockwave-flash"))) { + return HTTP_CONTENT_SWF; + } + } + + if (!strncmp(end, "\r\n\r\n", 4)){ + break; + } + ptr = end+2; + } + + return 0; +} + + + +/* * int encode(char *data, char *jTemplate, char *jData, * unsigned int dlen, unsigned int jtlen, unsigned int jdlen) * @@ -618,205 +713,175 @@ x_http2_server_JS_transmit (steg_t* s, struct evbuffer *source, conn_t *conn, un int nv; struct evbuffer *dest = conn_get_outbound(conn); size_t sbuflen = evbuffer_get_length(source); - char outbuf[HTTP_MSG_BUF_SIZE]; + char *hend, *jsTemplate = NULL, *outbuf, *outbuf2; char data[(int) sbuflen*2]; - unsigned int datalen; - char newHdr[MAX_RESP_HDR_SIZE]; - int newHdrLen = 0; - - size_t sofar = 0; - unsigned int cnt = 0; - int r; - - - - // by dynamically configuring the size returned by x_http2_transmit_room(), - // we can ensure that the size of data (source) is less than the max - // data length the JavaScript (jsTemplate) can encode - - - - // do { - int i; - unsigned int jsLen; - int mode; - char *hend; - unsigned int hLen; - unsigned int mjs = 0; - - char *jsTemplate = NULL; - int jsTemplateSize = 0; - - - - - /* int hdrLen; - int content_len; - int fin2; - - char* tmp; - char data2[20000]; - int decCnt; - */ - - datalen = 0; - - - log_debug("sbuflen = %d sofar = %d\n", (int) sbuflen, (int) sofar); - - - if (content_type != HTTP_CONTENT_JAVASCRIPT && - content_type != HTTP_CONTENT_HTML) { - log_warn("SERVER ERROR: Unknown content type (%d)", content_type); - return -1; - } - - // log_debug("SERVER: dumping data with length %d:", (int) sbuflen); - // evbuffer_dump(source, stderr); - // Convert data in 'source' to hexadecimal and write it to data - - nv = evbuffer_peek(source, sbuflen - sofar, NULL, NULL, 0); - iv = xzalloc(sizeof(struct evbuffer_iovec) * nv); - - if (evbuffer_peek(source, sbuflen - sofar, NULL, iv, nv) != nv) { - free(iv); - return -1; - } - - // jsTemplate should be init already, by x_http2_new or the previous invocation - // of this function - - if (content_type == HTTP_CONTENT_JAVASCRIPT) { - mjs = get_max_JS_capacity(); - } else if (content_type == HTTP_CONTENT_HTML) { - mjs = get_max_HTML_capacity(); - } - - if (mjs <= 0) { - log_warn("SERVER ERROR: No JavaScript found in jsTemplate"); - return -1; - } + unsigned int datalen = 0, cnt = 0, mjs = 0; + int r, i, mode, jsLen, hLen, cLen, newHdrLen = 0, outbuf2len; + + int gzipMode = JS_GZIP_RESP; - if (sbuflen > (size_t) mjs) { - log_warn("SERVER ERROR: (server_transmit) jsTemplate cannot accommodate data %d %dn", - (int) sbuflen, (int) mjs); - return -1; - } - - cnt = 0; + log_debug("sbuflen = %d\n", (int) sbuflen); - for (i = 0; i < nv; i++) { - const unsigned char *p = iv[i].iov_base; - const unsigned char *limit = p + iv[i].iov_len; - char c; + if (content_type != HTTP_CONTENT_JAVASCRIPT && + content_type != HTTP_CONTENT_HTML) { + log_warn("SERVER ERROR: Unknown content type (%d)", content_type); + return -1; + } - while (p < limit && cnt < sbuflen-sofar) { - c = *p++; - data[datalen] = "0123456789abcdef"[(c & 0xF0) >> 4]; - data[datalen+1] = "0123456789abcdef"[(c & 0x0F) >> 0]; - datalen += 2; - cnt++; - } - } + // log_debug("SERVER: dumping data with length %d:", (int) sbuflen); + // evbuffer_dump(source, stderr); - log_debug("SERVER encoded data in hex string (len %d):", datalen); - // buf_dump((unsigned char*)data, datalen, stderr); + nv = evbuffer_peek(source, sbuflen, NULL, NULL, 0); + iv = xzalloc(sizeof(struct evbuffer_iovec) * nv); + if (evbuffer_peek(source, sbuflen, NULL, iv, nv) != nv) { free(iv); + return -1; + } + if (content_type == HTTP_CONTENT_JAVASCRIPT) { + mjs = get_max_JS_capacity(); + } else if (content_type == HTTP_CONTENT_HTML) { + mjs = get_max_HTML_capacity(); + } + if (mjs <= 0) { + log_warn("SERVER ERROR: No JavaScript found in jsTemplate"); + return -1; + } - if (get_payload(content_type, datalen, &jsTemplate, &jsTemplateSize) == 1) { - log_debug("SERVER found the next HTTP response template with size %d", jsTemplateSize); - } else { - log_warn("SERVER couldn't find the next HTTP response template; reusing the previous one"); + if (sbuflen > (size_t) mjs) { + log_warn("SERVER ERROR: jsTemplate cannot accommodate data %d %dn", + (int) sbuflen, (int) mjs); + return -1; + } + + // Convert data in 'source' to hexadecimal and write it to data + cnt = 0; + for (i = 0; i < nv; i++) { + const unsigned char *p = iv[i].iov_base; + const unsigned char *limit = p + iv[i].iov_len; + char c; + + while (p < limit && cnt < sbuflen) { + c = *p++; + data[datalen] = "0123456789abcdef"[(c & 0xF0) >> 4]; + data[datalen+1] = "0123456789abcdef"[(c & 0x0F) >> 0]; + datalen += 2; + cnt++; } + } - log_debug("MJS %d %d", datalen, mjs); - + free(iv); + log_debug("SERVER encoded data in hex string (len %d):", datalen); + // buf_dump((unsigned char*)data, datalen, stderr); - if (jsTemplate == NULL) { - fprintf(stderr, "NO suitable payload found %d %d\n", datalen, mjs); - exit(-1); - } - // use encodeHTTPBody to embed data in the JS jsTemplate - // assumption: jsTemplate is null-terminated + if (get_payload(content_type, datalen, &jsTemplate, &jsLen) == 1) { + log_debug("SERVER found the applicable HTTP response template with size %d", jsLen); + } else { + log_warn("SERVER couldn't find the applicable HTTP response template"); + return -1; + } - log_debug("strlen(jsTemplate) = %d", (int)strlen(jsTemplate)); - log_debug("jsTemplateSize = %d", jsTemplateSize); - // unsigned int jsLen = strlen(jsTemplate); - jsLen = jsTemplateSize; + // log_debug("MJS %d %d", datalen, mjs); + if (jsTemplate == NULL) { + log_warn("NO suitable payload found %d %d", datalen, mjs); + return -1; + } + // assumption: jsTemplate is null-terminated + hend = strstr(jsTemplate, "\r\n\r\n"); + if (hend == NULL) { + log_warn("Unable to find end of header in the HTTP template"); + return -1; + } - mode = has_eligible_HTTP_content (jsTemplate, jsLen, HTTP_CONTENT_JAVASCRIPT); - hend = strstr(jsTemplate, "\r\n\r\n"); - if (hend == NULL) { - log_warn("Unable to find end of header in the HTTP template"); - return -1; - } + mode = has_eligible_HTTP_content (jsTemplate, jsLen, HTTP_CONTENT_JAVASCRIPT); - log_debug("SERVER: using HTTP resp template of length = %d\n", jsLen); - // log_debug("HTTP resp tempmlate:"); - // buf_dump((unsigned char*)jsTemplate, jsLen, stderr); + // log_debug("SERVER: using HTTP resp template of length = %d", jsLen); + // log_debug("HTTP resp tempmlate:"); + // buf_dump((unsigned char*)jsTemplate, jsLen, stderr); - hLen = hend+4-jsTemplate; - r = encodeHTTPBody(data, hend+4, outbuf, datalen, jsLen-hLen, HTTP_MSG_BUF_SIZE, mode); + hLen = hend+4-jsTemplate; + cLen = jsLen - hLen; + outbuf = malloc(cLen); + if (outbuf == NULL) { + log_warn("malloc for outbuf fails"); + return -1; + } - if (r < 0 || ((unsigned int) r < datalen)) { - fprintf(stderr, "incomplete data encoding\n"); - exit(-1); - log_debug("SERVER ERROR: Incomplete data encoding"); - return -1; - } + r = encodeHTTPBody(data, hend+4, outbuf, datalen, cLen, cLen, mode); - if (mode == CONTENT_JAVASCRIPT) { // JavaScript in HTTP body - newHdrLen = gen_response_header((char*) "application/x-javascript", 0, jsLen-hLen, newHdr, sizeof(newHdr)); - } else if (mode == CONTENT_HTML_JAVASCRIPT) { // JavaScript(s) embedded in HTML doc - newHdrLen = gen_response_header((char*) "text/html", 0, jsLen-hLen, newHdr, sizeof(newHdr)); - } else { // unknown mode - log_warn("SERVER ERROR: unknown mode for creating the HTTP response header"); - return -1; - } - if (newHdrLen < 0) { - log_warn("SERVER ERROR: gen_response_header fails for jsSteg"); - return -1; - } + if (r < 0 || ((unsigned int) r < datalen)) { + log_warn("SERVER ERROR: Incomplete data encoding"); + return -1; + } - if (evbuffer_add(dest, newHdr, newHdrLen)) { - log_warn("SERVER ERROR: evbuffer_add() fails for newHdr"); + // work in progress + if (gzipMode == 1) { + // conservative estimate: + // sizeof outbuf2 = cLen + 10-byte for gzip header + 8-byte for crc + outbuf2 = malloc(cLen+18); + if (outbuf2 == NULL) { + log_warn("malloc for outbuf2 fails"); return -1; } - // if (evbuffer_add(dest, jsTemplate, hLen)) { - // log_warn("SERVER ERROR: evbuffer_add() fails for jsTemplate"); - // return -1; - // } + outbuf2len = gzDeflate(outbuf, cLen, outbuf2, cLen+18, time(NULL)); - - if (evbuffer_add(dest, outbuf, jsLen-hLen)) { - log_warn("SERVER ERROR: evbuffer_add() fails for outbuf"); + if (outbuf2len <= 0) { + log_warn("gzDeflate for outbuf fails"); + free(outbuf2); return -1; } + free(outbuf); - sofar += datalen/2; - evbuffer_drain(source, datalen/2); - // } while (sbuflen > sofar); - + } else { + outbuf2 = outbuf; + outbuf2len = cLen; + } - // fprintf(stderr, "SERVER TRANSMITTED payload of size %d\n", (int) sbuflen); + // outbuf2 points to the HTTP payload (of length outbuf2len) to be sent + + if (mode == CONTENT_JAVASCRIPT) { // JavaScript in HTTP body + newHdrLen = gen_response_header((char*) "application/x-javascript", gzipMode, + outbuf2len, newHdr, sizeof(newHdr)); + } else if (mode == CONTENT_HTML_JAVASCRIPT) { // JavaScript(s) embedded in HTML doc + newHdrLen = gen_response_header((char*) "text/html", gzipMode, + outbuf2len, newHdr, sizeof(newHdr)); + } else { // unknown mode + log_warn("SERVER ERROR: unknown mode for creating the HTTP response header"); + free(outbuf2); + return -1; + } + if (newHdrLen < 0) { + log_warn("SERVER ERROR: gen_response_header fails for jsSteg"); + free(outbuf2); + return -1; + } - // obtain a usable HTTP response template for the next data, and - // modify jsTemplateCapacity + // newHdr points to the HTTP header (of length newHdrLen) to be sent + if (evbuffer_add(dest, newHdr, newHdrLen)) { + log_warn("SERVER ERROR: evbuffer_add() fails for newHdr"); + free(outbuf2); + return -1; + } - log_debug("SERVER finding the next HTTP response template"); + if (evbuffer_add(dest, outbuf2, outbuf2len)) { + log_warn("SERVER ERROR: evbuffer_add() fails for outbuf2"); + free(outbuf2); + return -1; + } + evbuffer_drain(source, sbuflen); + free(outbuf2); conn_close_after_transmit(conn); // downcast_steg(s)->have_transmitted = 1; return 0; @@ -836,17 +901,14 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, char buf[10]; char respMsg[HTTP_MSG_BUF_SIZE]; char data[HTTP_MSG_BUF_SIZE]; + char buf2[HTTP_MSG_BUF_SIZE]; - unsigned char *field; - unsigned char *fieldStart; - unsigned char* fieldEnd; - unsigned char *fieldValStart; + unsigned char *field, *fieldStart, *fieldEnd, *fieldValStart; char *httpBody; + int decCnt, fin, i, j, k, gzipMode=0, httpBodyLen, buf2len, contentType = 0; ev_ssize_t r; - int mode, decCnt, fin; struct evbuffer * scratch; - int i,j,k; char c; @@ -897,9 +959,7 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, if (response_len > evbuffer_get_length(source)) return RECV_INCOMPLETE; - - - + // read the entire HTTP resp if (response_len < HTTP_MSG_BUF_SIZE) { r = evbuffer_copyout(source, respMsg, response_len); @@ -921,21 +981,37 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, log_debug("CLIENT received HTTP response with length %d\n", response_len); // buf_dump((unsigned char*)respMsg, response_len, stderr); // log_debug("HTTP response header:"); - // buf_dump((unsigned char*)respMsg, hdrLen, stderr); - - httpBody = respMsg + hdrLen; - - log_debug("CLIENT Before has_eligible HTTP content\n"); - // find out if the resp is a JavaScript or JS embedded in HTML doc - mode = has_eligible_HTTP_content (respMsg, response_len, HTTP_CONTENT_JAVASCRIPT); - if (mode != 1 && mode != 2) { - log_debug("CLIENT ERROR: HTTP response not useful for jsSteg (mode %d)", mode); + // buf_dump((unsigned char*)respMsg, hdrLen+80, stderr); + + contentType = findContentType (respMsg); + if (contentType != HTTP_CONTENT_JAVASCRIPT && contentType != HTTP_CONTENT_HTML) { + log_warn("ERROR: Invalid content type (%d)", contentType); return RECV_BAD; } - log_debug("CLIENT Before decodeHTTPBody; mode: %d\n", mode); - - decCnt = decodeHTTPBody(httpBody, data, response_len-hdrLen, HTTP_MSG_BUF_SIZE, &fin, mode); + httpBody = respMsg + hdrLen; + httpBodyLen = response_len - hdrLen; + + gzipMode = isGzipContent(respMsg); + if (gzipMode) { + log_debug("gzip content encoding detected"); + buf2len = gzInflate(httpBody, httpBodyLen, buf2, HTTP_MSG_BUF_SIZE); + if (buf2len <= 0) { + log_warn("gzInflate for httpBody fails"); + return RECV_BAD; + } + buf2[buf2len] = 0; + httpBody = buf2; + httpBodyLen = buf2len; + } + + if (contentType == HTTP_CONTENT_JAVASCRIPT) { + decCnt = decodeHTTPBody(httpBody, data, httpBodyLen, HTTP_MSG_BUF_SIZE, + &fin, CONTENT_JAVASCRIPT); + } else { + decCnt = decodeHTTPBody(httpBody, data, httpBodyLen, HTTP_MSG_BUF_SIZE, + &fin, CONTENT_HTML_JAVASCRIPT); + } data[decCnt] = 0; log_debug("After decodeHTTPBody; decCnt: %d\n", decCnt); @@ -1011,119 +1087,6 @@ x_http2_handle_client_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, } - -//int -//x_http2_handle_server_JS_receive(steg_t *s, conn_t *conn, struct evbuffer *dest, struct evbuffer* source) { -// -// int cnt = 0; -// -// do { -// struct evbuffer_ptr s2 = evbuffer_search(source, "\r\n\r\n", sizeof ("\r\n\r\n") -1 , NULL); -// unsigned char* data; -// unsigned char* limit; -// unsigned char *p; -// int unwrapped_cookie_len; -// struct evbuffer *scratch; -// unsigned char c, h, secondhalf; -// unsigned char buf[evbuffer_get_length(source)]; -// -// -// if (s2.pos == -1) { -// log_debug("Did not find end of request %d", (int) evbuffer_get_length(source)); -// // evbuffer_dump(source, stderr); -// return RECV_INCOMPLETE; -// } -// -// log_debug("SERVER received request header of length %d", (int)s2.pos); -// -// data = evbuffer_pullup(source, s2.pos); -// if (data == NULL) { -// log_debug("SERVER evbuffer_pullup fails"); -// return RECV_BAD; -// } -// -// limit = data + s2.pos; -// -// data = (unsigned char*) strstr((char*) data, "Cookie:"); -// -// if (data == NULL || memcmp(data, "Cookie:", sizeof "Cookie:"-1)) { -// log_debug("Unexpected HTTP verb: %.*s", 5, data); -// return RECV_BAD; -// } -// -// p = data + sizeof "Cookie: "-1; -// unwrapped_cookie_len = unwrap_cookie(p, buf, (int) (limit - p)); -// -// log_debug("SERVER: received cookie of length = %d %d\n", unwrapped_cookie_len, (int) (limit-p)); -// // buf_dump(buf, unwrapped_cookie_len, stderr); -// // fprintf(stderr, "==========================\n"); -// // buf_dump(p, (int) (limit-p), stderr); -// -// -// // log_debug("hello SERVER received %d cnt = %d\n", (int) (limit - p), cnt); -// // buf_dump(p, (int) (limit-p), stderr); -// -// /* We need a scratch buffer here because the contract is that if -// we hit a decode error we *don't* write anything to 'dest'. */ -// scratch = evbuffer_new(); -// -// if (!scratch) return RECV_BAD; -// -// -// if (evbuffer_expand(scratch, unwrapped_cookie_len/2)) { -// log_debug("Evbuffer expand failed \n"); -// evbuffer_free(scratch); -// return RECV_BAD; -// } -// p = buf; -// -// -// secondhalf = 0; -// while ((int) (p - buf) < unwrapped_cookie_len) { -// if (!secondhalf) c = 0; -// if ('0' <= *p && *p <= '9') h = *p - '0'; -// else if ('a' <= *p && *p <= 'f') h = *p - 'a' + 10; -// else if ('A' <= *p && *p <= 'F') h = *p - 'A' + 10; -// else if (*p == '=' && !secondhalf) { -// p++; -// continue; -// } else { -// evbuffer_free(scratch); -// log_debug("Decode error: unexpected URI characterasdfaf %d", *p); -// return RECV_BAD; -// } -// -// c = (c << 4) + h; -// if (secondhalf) { -// evbuffer_add(scratch, &c, 1); -// // log_debug("adding to scratch"); -// cnt++; -// } -// secondhalf = !secondhalf; -// p++; -// } -// -// -// -// if (evbuffer_add_buffer(dest, scratch)) { -// evbuffer_free(scratch); -// log_debug("Failed to transfer buffer"); -// return RECV_BAD; -// } -// evbuffer_drain(source, s2.pos + sizeof("\r\n\r\n") - 1); -// evbuffer_free(scratch); -// } while (evbuffer_get_length(source)); -// -// -// log_debug("SERVER RECEIVED payload %d\n", cnt); -// // downcast_steg(s)->have_received = 1; -// conn_transmit_soon(conn, 100); -// return RECV_GOOD; -//} - - - - /***** int main() { diff --git a/src/steg/jsSteg.h b/src/steg/jsSteg.h index c076460..949aa25 100644 --- a/src/steg/jsSteg.h +++ b/src/steg/jsSteg.h @@ -9,23 +9,32 @@ #include "connections.h" #include "steg.h" #include <event2/buffer.h> +#include "zpack.h" - -/* error codes */ +// error codes #define INVALID_BUF_SIZE -1 #define INVALID_DATA_CHAR -2 +// controlling content gzipping for jsSteg +#define JS_GZIP_RESP 1 + int encodeHTTPBody(char *data, char *jTemplate, char *jData,unsigned int dlen, unsigned int jtlen, unsigned int jdlen, int mode); + int isxString(char *str); + +int isGzipContent (char *msg); + +int findContentType (char *msg); + int decodeHTTPBody (char *jData, char *dataBuf, unsigned int jdlen, unsigned int dataBufSize, int *fin, int mode); int encode(char *data, char *jTemplate, char *jData, unsigned int dlen, unsigned int jtlen, unsigned int jdlen ); -int encode2(char *data, char *jTemplate, char *jData, +int encode2(char *data, char *jTemplate, char *jData, unsigned int dlen, unsigned int jtlen, unsigned int jdlen, int *fin); diff --git a/src/steg/payloads.c b/src/steg/payloads.c index 017c469..02be31b 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -865,7 +865,7 @@ strInBinary (const char *pattern, unsigned int patternLen, int has_eligible_HTTP_content (char* buf, int len, int type) { char* ptr = buf; char* matchptr; - int tjFlag=0, thFlag=0, ceFlag=0, teFlag=0, http304Flag=0, clZeroFlag=0, pdfFlag=0, swfFlag=0; + int tjFlag=0, thFlag=0, ceFlag=0, teFlag=0, http304Flag=0, clZeroFlag=0, pdfFlag=0, swfFlag=0, gzipFlag=0; char* end, *cp; #ifdef DEBUG @@ -906,7 +906,9 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { swfFlag = 1; } - } else if (!strncmp(ptr, "Content-Encoding:", 17)) { + } else if (!strncmp(ptr, "Content-Encoding: gzip", 22)) { + gzipFlag = 1; + } else if (!strncmp(ptr, "Content-Encoding:", 17)) { // Content-Encoding that is not gzip ceFlag = 1; } else if (!strncmp(ptr, "Transfer-Encoding:", 18)) { teFlag = 1; @@ -923,8 +925,8 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { } #ifdef DEBUG - printf("tjFlag=%d; thFlag=%d; ceFlag=%d; teFlag=%d; http304Flag=%d; clZeroFlag=%d\n", - tjFlag, thFlag, ceFlag, teFlag, http304Flag, clZeroFlag); + printf("tjFlag=%d; thFlag=%d; gzipFlag=%d; ceFlag=%d; teFlag=%d; http304Flag=%d; clZeroFlag=%d\n", + tjFlag, thFlag, gzipFlag, ceFlag, teFlag, http304Flag, clZeroFlag); #endif // if (type == HTTP_CONTENT_JAVASCRIPT) @@ -933,12 +935,9 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { if (http304Flag || clZeroFlag) return 0; // for now, we're not dealing with Transfer-Encoding (e.g., chunked) + // or Content-Encoding that is not gzip // if (teFlag) return 0; - // if (ceFlag) return 0; // for now, we remove "Content-Encoding: gzip" in fixContentLen if (teFlag || ceFlag) return 0; -/***** - if (teFlag) return 0; - *****/ if (tjFlag && ceFlag && end != NULL) { log_debug("(JS) gzip flag detected with hdr len %d", (int)(end-buf+4)); @@ -963,9 +962,8 @@ int has_eligible_HTTP_content (char* buf, int len, int type) { if (http304Flag || clZeroFlag) return 0; // for now, we're not dealing with Transfer-Encoding (e.g., chunked) - // or Content-Encoding (e.g., gzip) + // or Content-Encoding that is not gzip // if (teFlag) return 0; - // if (ceFlag) return 0; if (teFlag || ceFlag) return 0; // check if HTTP body contains "endstream";

1 0

[stegotorus/master] git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@129 a58ff0ac-194c-e011-a152-003048836090
by zwol＠torproject.org 20 Jul '12

20 Jul '12

commit 8afedcde7390e7515f35dd07f84af91015aa0b7e Author: Vinod Yegneswaran <vinod(a)csl.sri.com> Date: Mon Nov 7 20:35:29 2011 +0000 git-svn-id: svn+ssh://spartan.csl.sri.com/svn/private/DEFIANCE@129 a58ff0ac-194c-e011-a152-003048836090 --- src/steg/payloads.c | 152 ++++++++++++--------------------------------------- src/steg/payloads.h | 1 - 2 files changed, 36 insertions(+), 117 deletions(-) diff --git a/src/steg/payloads.c b/src/steg/payloads.c index 0cae234..a3e2f65 100644 --- a/src/steg/payloads.c +++ b/src/steg/payloads.c @@ -546,48 +546,51 @@ unsigned int find_client_payload(char* buf, int len, int type) { -int skipJSPattern(char *cp, int len) { - int i,j; +/* int skipJSPattern(char *cp, int len) { */ +/* int i,j; */ - char keywords [21][10]= {"function", "return", "var", "int", "random", "Math", "while", - "else", "for", "document", "write", "writeln", "true", - "false", "True", "False", "window", "indexOf", "navigator", "case", "if"}; - if (len < 1) return 0; +/* char keywords [21][10]= {"function", "return", "var", "int", "random", "Math", "while", */ +/* "else", "for", "document", "write", "writeln", "true", */ +/* "false", "True", "False", "window", "indexOf", "navigator", "case", "if"}; */ - // change the limit to 21 to enable if as a keyword - for (i=0; i < 20; i++) { - char* word = keywords[i]; - - if (len <= (int) strlen(word)) - continue; - if (word[0] != cp[0]) - continue; +/* return 0; */ +/* if (len < 1) return 0; */ - for (j=1; j < (int) strlen(word); j++) { - if (isxdigit(word[j])) { - if (!isxdigit(cp[j])) - goto next_word; - else - continue; - } +/* // change the limit to 21 to enable if as a keyword */ +/* for (i=0; i < 20; i++) { */ +/* char* word = keywords[i]; */ + +/* if (len <= (int) strlen(word)) */ +/* continue; */ + +/* if (word[0] != cp[0]) */ +/* continue; */ + +/* for (j=1; j < (int) strlen(word); j++) { */ +/* if (isxdigit(word[j])) { */ +/* if (!isxdigit(cp[j])) */ +/* goto next_word; */ +/* else */ +/* continue; */ +/* } */ - if (cp[j] != word[j]) - goto next_word; - } - if (!isalnum(cp[j])) - return strlen(word)+1; +/* if (cp[j] != word[j]) */ +/* goto next_word; */ +/* } */ +/* if (!isalnum(cp[j])) */ +/* return strlen(word)+1; */ - next_word: - continue; - } +/* next_word: */ +/* continue; */ +/* } */ + +/* return 0; */ +/* } */ - return 0; -} -/* int skipJSPattern (char *cp, int len) { @@ -649,7 +652,7 @@ int skipJSPattern (char *cp, int len) { return 0; } -*/ + int isalnum_ (char c) { @@ -753,89 +756,6 @@ int offset2Hex (char *p, int range, int isLastCharHex) { } /* - * capacityJS returns the number of usable hex char - * in the input HTTP message for data encoding - * - * Input: - * buf - pointer to HTTP message - * len - sizeof buf - * mode - - * CONTENT_JAVASCRIPT (case 1); HTTP message body is a JavaScript - * (e.g., Content-Type: {text/javascript, application/x-javascript, - * application/javascript}) - * CONTENT_HTML_JAVASCRIPT (case 2) - * Content-Type: text/html and HTTP message body contains - * <script type="text/javascript"> ... </script> - * - * Output: - * capacityJS returns the number of usable hex char that can be embedded - * in the HTTP message - * - * Note: - * This is a prototype for the simple version (all hex char are usable) - * will refine this to skip JavaScript keywords in the next iteration - * - */ - - - -unsigned int capacityJS (char* buf, int len, int mode) { - char *hEnd, *bp, *jsStart, *jsEnd; - int cnt=0; - - // jump to the beginning of the body of the HTTP message - hEnd = strstr(buf, "\r\n\r\n"); - if (hEnd == NULL) { - // cannot find the separator between HTTP header and HTTP body - return 0; - } - bp = hEnd + 4; - - if (mode == CONTENT_JAVASCRIPT) { - while (bp < (buf+len)) { - if (isxdigit(*bp)) { - cnt++; -#ifdef DEBUG - printf("%c", *bp); -#endif - } - bp++; - } -#ifdef DEBUG - printf("\n"); -#endif - return cnt; - } else if (mode == CONTENT_HTML_JAVASCRIPT) { - while (bp < (buf+len)) { - jsStart = strstr(bp, "<script type=\"text/javascript\">"); - if (jsStart == NULL) break; - bp = jsStart+31; - jsEnd = strstr(bp, "</script>"); - if (jsEnd == NULL) break; - // count the number of usable hex char between jsStart+31 and jsEnd - while (bp < jsEnd) { - if (isxdigit(*bp)) { - cnt++; -#ifdef DEBUG - printf("%c", *bp); -#endif - } - bp++; - } - bp += 9; - } -#ifdef DEBUG - printf("\n"); -#endif - return cnt; - } else { - fprintf(stderr, "Unknown mode (%d) for capacityJS() ... \n", mode); - return 0; - } - -} - -/* * capacityJS3 is the next iteration for capacityJS */ unsigned int capacityJS3 (char* buf, int len, int mode) { diff --git a/src/steg/payloads.h b/src/steg/payloads.h index 56729fe..7d66bbf 100644 --- a/src/steg/payloads.h +++ b/src/steg/payloads.h @@ -143,7 +143,6 @@ int skipJSPattern (char *cp, int len); int isalnum_ (char c); int offset2Alnum_ (char *p, int range); int offset2Hex (char *p, int range, int isLastCharHex); -unsigned int capacityJS (char* buf, int len, int mode); unsigned int capacityJS3 (char* buf, int len, int mode); unsigned int get_max_JS_capacity(void); unsigned int get_max_HTML_capacity(void);

1 0