filterblowfish.cpp

#include "filterblowfish.h"

namespace n2nc {

FilterBlowFish::FilterBlowFish() : n2nc::Filter("BF_FILTER","LOADING BlowFish cipher filter module"){
  this->m_bf = NULL ;
  this->m_tmpbuf = malloc(65535);
  this->m_bf_loaded = false ;
  this->m_maxoverhead = sizeof(bfheader_t) + 8 ;  /* 8 due to blowfish internals */
}

FilterBlowFish::~FilterBlowFish(){
  std::cerr << "\t\tBF_FILTER destructor" << std::endl ;
  free(m_tmpbuf);
}

bool n2nc::FilterBlowFish::loadBF(){
  this->m_bf = new n2nc::security::BlowFish(this->m_skey);
  return this->m_bf_loaded = true ;
}

Filter::status_t FilterBlowFish::egress(void *inbuf, void *outbuf,size_t inlen,size_t *outlen){
  bfheader_t hdr ;
  bzero(&hdr,sizeof(bfheader_t));
  int retval ;
  if (!this->m_bf_loaded && !this->loadBF() ){ std::cerr << "bffilter egress. failing load blowfish key" << std::endl; exit(1);}


  /* inject the nseq in the bfheader */
  hdr.n_seq = this->m_pkm->getSendPkHeader()->p_seq +1 ; /* this way i can avoid the re-injecting DOS */

  ::memcpy(this->m_tmpbuf,&hdr,sizeof(bfheader_t));
  ::memcpy((u_char*)this->m_tmpbuf + sizeof(bfheader_t),inbuf,inlen);
  this->m_bf->reinit();
  /* now encrypt all payload */
  retval = this->m_bf->encrypt(this->m_tmpbuf,outbuf,sizeof(bfheader_t) + inlen);
// std::cerr << "\t\tBF_FILTER egress.payload crypted len : " << std::dec << retval << " inlen" << sizeof(bfheader_t) + inlen << std::endl ;
  if(retval < 1){
    std::cerr << "\t\tBF_FILTER egress. drop packet: " << hdr.n_seq << std::endl ;
    *outlen = 0;
    return Filter::FILTER_DROP ;
  }
  *outlen = retval;
  std::cerr << "\t\tBF_FILTER egress. bytes written: " << *outlen << " nseq: " << hdr.n_seq << std::endl ;
  return Filter::FILTER_CONTINUE ;
}

Filter::status_t FilterBlowFish::ingress(void *inbuf, void *outbuf,size_t inlen,size_t *outlen){
  bfheader_t hdr ;
  bzero(&hdr,sizeof(bfheader_t));
  int retval ;
  
  if (!this->m_bf_loaded && !this->loadBF() ){ std::cerr << "bffilter ingress. failing load blowfish key" << std::endl; exit(1);}
  /* check wether the active peer want to change the session key */
  this->m_bf->reinit();

  retval = this->m_bf->decrypt(inbuf,this->m_tmpbuf,inlen);
  if(retval < 1){
    std::cerr << "BF_FILTER ingress. drop packet: " << hdr.n_seq << std::endl ;
    *outlen = -1;
    return Filter::FILTER_DROP ;
  }
  ::memcpy(&hdr,this->m_tmpbuf,sizeof(bfheader_t));
  /* checking the validity of nseq */
  if (hdr.n_seq != this->m_pkm->getRecvPkHeader()->p_seq){
    /* DOS detected, drop packet */
    std::cerr << "\t\tBF_FILTER ingress. DOS detected nseq mismatch. public nseq: " << this->m_pkm->getRecvPkHeader()->p_seq << ". private nseq: " << hdr.n_seq << std::endl ;
    *outlen = -1;
    return Filter::FILTER_DROP ;
  }
  /* packet ok */
  *outlen = retval - sizeof(bfheader_t) ;

  ::memcpy(outbuf,(u_char*)this->m_tmpbuf + sizeof(bfheader_t),*outlen);
  std::cerr << "\t\tBF_FILTER inress. bytes written: " << *outlen << " pri nseq: " << hdr.n_seq << " pub nseq: " << this->m_pkm->getRecvPkHeader()->p_seq  << std::endl ;
  
  return Filter::FILTER_CONTINUE ;
}



extern "C"
Filter* get_istance(){
  return new FilterBlowFish();
}

extern "C"
int free_istance(Filter *filter){
  delete filter ;
}


}

---