add plugin "auth_sha1_v2"
This commit is contained in:
BreakWa11
parent
187e266b26
commit
397990534a
2 changed files with 251 additions and 1 deletions
|
|
@ -80,6 +80,10 @@ class LRUCache(collections.MutableMapping):
|
||||||
def __len__(self):
|
def __len__(self):
|
||||||
return len(self._store)
|
return len(self._store)
|
||||||
|
|
||||||
|
def first(self):
|
||||||
|
if len(self._keys_to_last_time) > 0:
|
||||||
|
return iter(self._keys_to_last_time).next()
|
||||||
|
|
||||||
def sweep(self):
|
def sweep(self):
|
||||||
# O(n - m)
|
# O(n - m)
|
||||||
now = time.time()
|
now = time.time()
|
||||||
|
|
|
||||||
|
|
@ -32,7 +32,7 @@ import hmac
|
||||||
import hashlib
|
import hashlib
|
||||||
|
|
||||||
import shadowsocks
|
import shadowsocks
|
||||||
from shadowsocks import common
|
from shadowsocks import common, lru_cache
|
||||||
from shadowsocks.obfsplugin import plain
|
from shadowsocks.obfsplugin import plain
|
||||||
from shadowsocks.common import to_bytes, to_str, ord, chr
|
from shadowsocks.common import to_bytes, to_str, ord, chr
|
||||||
|
|
||||||
|
|
@ -42,10 +42,15 @@ def create_auth_simple(method):
|
||||||
def create_auth_sha1(method):
|
def create_auth_sha1(method):
|
||||||
return auth_sha1(method)
|
return auth_sha1(method)
|
||||||
|
|
||||||
|
def create_auth_sha1_v2(method):
|
||||||
|
return auth_sha1_v2(method)
|
||||||
|
|
||||||
obfs_map = {
|
obfs_map = {
|
||||||
'auth_simple': (create_auth_simple,),
|
'auth_simple': (create_auth_simple,),
|
||||||
'auth_sha1': (create_auth_sha1,),
|
'auth_sha1': (create_auth_sha1,),
|
||||||
'auth_sha1_compatible': (create_auth_sha1,),
|
'auth_sha1_compatible': (create_auth_sha1,),
|
||||||
|
'auth_sha1_v2': (create_auth_sha1_v2,),
|
||||||
|
'auth_sha1_v2_compatible': (create_auth_sha1_v2,),
|
||||||
}
|
}
|
||||||
|
|
||||||
def match_begin(str1, str2):
|
def match_begin(str1, str2):
|
||||||
|
|
@ -526,3 +531,244 @@ class auth_sha1(verify_base):
|
||||||
self.decrypt_packet_num += 1
|
self.decrypt_packet_num += 1
|
||||||
return out_buf
|
return out_buf
|
||||||
|
|
||||||
|
class obfs_auth_v2_data(object):
|
||||||
|
def __init__(self):
|
||||||
|
self.client_id = lru_cache.LRUCache()
|
||||||
|
self.local_client_id = b''
|
||||||
|
self.connection_id = 0
|
||||||
|
self.set_max_client(64) # max active client count
|
||||||
|
|
||||||
|
def update(self, client_id, connection_id):
|
||||||
|
if client_id in self.client_id:
|
||||||
|
self.client_id[client_id].update()
|
||||||
|
|
||||||
|
def set_max_client(self, max_client):
|
||||||
|
self.max_client = max_client
|
||||||
|
self.max_buffer = max(self.max_client * 2, 1024)
|
||||||
|
|
||||||
|
def insert(self, client_id, connection_id):
|
||||||
|
if self.client_id.get(client_id, None) is None or not self.client_id[client_id].enable:
|
||||||
|
if self.client_id.first() is None or len(self.client_id) < self.max_client:
|
||||||
|
if client_id not in self.client_id:
|
||||||
|
#TODO: check
|
||||||
|
self.client_id[client_id] = client_queue(connection_id)
|
||||||
|
else:
|
||||||
|
self.client_id[client_id].re_enable(connection_id)
|
||||||
|
return self.client_id[client_id].insert(connection_id)
|
||||||
|
|
||||||
|
if not self.client_id[self.client_id.first()].is_active():
|
||||||
|
del self.client_id[self.client_id.first()]
|
||||||
|
if client_id not in self.client_id:
|
||||||
|
#TODO: check
|
||||||
|
self.client_id[client_id] = client_queue(connection_id)
|
||||||
|
else:
|
||||||
|
self.client_id[client_id].re_enable(connection_id)
|
||||||
|
return self.client_id[client_id].insert(connection_id)
|
||||||
|
|
||||||
|
logging.warn('auth_sha1_v2: no inactive client')
|
||||||
|
return False
|
||||||
|
else:
|
||||||
|
return self.client_id[client_id].insert(connection_id)
|
||||||
|
|
||||||
|
class auth_sha1_v2(verify_base):
|
||||||
|
def __init__(self, method):
|
||||||
|
super(auth_sha1_v2, self).__init__(method)
|
||||||
|
self.recv_buf = b''
|
||||||
|
self.unit_len = 8100
|
||||||
|
self.decrypt_packet_num = 0
|
||||||
|
self.raw_trans = False
|
||||||
|
self.has_sent_header = False
|
||||||
|
self.has_recv_header = False
|
||||||
|
self.client_id = 0
|
||||||
|
self.connection_id = 0
|
||||||
|
|
||||||
|
def init_data(self):
|
||||||
|
return obfs_auth_v2_data()
|
||||||
|
|
||||||
|
def set_server_info(self, server_info):
|
||||||
|
self.server_info = server_info
|
||||||
|
try:
|
||||||
|
max_client = int(server_info.protocol_param)
|
||||||
|
except:
|
||||||
|
max_client = 64
|
||||||
|
self.server_info.data.set_max_client(max_client)
|
||||||
|
|
||||||
|
def rnd_data(self, buf_size):
|
||||||
|
if buf_size > 1500:
|
||||||
|
return b'\x01'
|
||||||
|
|
||||||
|
if buf_size > 400:
|
||||||
|
rnd_data = os.urandom(common.ord(os.urandom(1)[0]) % 128)
|
||||||
|
return common.chr(len(rnd_data) + 1) + rnd_data
|
||||||
|
|
||||||
|
rnd_data = os.urandom(struct.unpack('>H', os.urandom(2))[0] % 1024)
|
||||||
|
return common.chr(255) + struct.pack('>H', len(rnd_data) + 3) + rnd_data
|
||||||
|
|
||||||
|
def pack_data(self, buf):
|
||||||
|
if len(buf) == 0:
|
||||||
|
return b''
|
||||||
|
data = self.rnd_data(len(buf)) + buf
|
||||||
|
data = struct.pack('>H', len(data) + 6) + data
|
||||||
|
adler32 = zlib.adler32(data) & 0xFFFFFFFF
|
||||||
|
data += struct.pack('<I', adler32)
|
||||||
|
return data
|
||||||
|
|
||||||
|
def pack_auth_data(self, buf):
|
||||||
|
if len(buf) == 0:
|
||||||
|
return b''
|
||||||
|
data = self.rnd_data(len(buf)) + buf
|
||||||
|
data = struct.pack('>H', len(data) + 16) + data
|
||||||
|
crc = binascii.crc32(self.server_info.key) & 0xFFFFFFFF
|
||||||
|
data = struct.pack('<I', crc) + data
|
||||||
|
data += hmac.new(self.server_info.iv + self.server_info.key, data, hashlib.sha1).digest()[:10]
|
||||||
|
return data
|
||||||
|
|
||||||
|
def auth_data(self):
|
||||||
|
if self.server_info.data.connection_id > 0xFF000000:
|
||||||
|
self.server_info.data.local_client_id = b''
|
||||||
|
if not self.server_info.data.local_client_id:
|
||||||
|
self.server_info.data.local_client_id = os.urandom(8)
|
||||||
|
logging.debug("local_client_id %s" % (binascii.hexlify(self.server_info.data.local_client_id),))
|
||||||
|
self.server_info.data.connection_id = struct.unpack('<Q', self.server_info.data.local_client_id)[0] % 0xFFFFFD
|
||||||
|
self.server_info.data.connection_id += 1
|
||||||
|
return b''.join([self.server_info.data.local_client_id,
|
||||||
|
struct.pack('<I', self.server_info.data.connection_id)])
|
||||||
|
|
||||||
|
def client_pre_encrypt(self, buf):
|
||||||
|
ret = b''
|
||||||
|
if not self.has_sent_header:
|
||||||
|
head_size = self.get_head_size(buf, 30)
|
||||||
|
datalen = min(len(buf), random.randint(0, 31) + head_size)
|
||||||
|
ret += self.pack_auth_data(self.auth_data() + buf[:datalen])
|
||||||
|
buf = buf[datalen:]
|
||||||
|
self.has_sent_header = True
|
||||||
|
while len(buf) > self.unit_len:
|
||||||
|
ret += self.pack_data(buf[:self.unit_len])
|
||||||
|
buf = buf[self.unit_len:]
|
||||||
|
ret += self.pack_data(buf)
|
||||||
|
return ret
|
||||||
|
|
||||||
|
def client_post_decrypt(self, buf):
|
||||||
|
if self.raw_trans:
|
||||||
|
return buf
|
||||||
|
self.recv_buf += buf
|
||||||
|
out_buf = b''
|
||||||
|
while len(self.recv_buf) > 2:
|
||||||
|
length = struct.unpack('>H', self.recv_buf[:2])[0]
|
||||||
|
if length >= 8192 or length < 7:
|
||||||
|
self.raw_trans = True
|
||||||
|
self.recv_buf = b''
|
||||||
|
raise Exception('client_post_decrypt data error')
|
||||||
|
if length > len(self.recv_buf):
|
||||||
|
break
|
||||||
|
|
||||||
|
if struct.pack('<I', zlib.adler32(self.recv_buf[:length - 4]) & 0xFFFFFFFF) != self.recv_buf[length - 4:length]:
|
||||||
|
self.raw_trans = True
|
||||||
|
self.recv_buf = b''
|
||||||
|
raise Exception('client_post_decrypt data uncorrect checksum')
|
||||||
|
|
||||||
|
pos = common.ord(self.recv_buf[2])
|
||||||
|
if pos < 255:
|
||||||
|
pos += 2
|
||||||
|
else:
|
||||||
|
pos = struct.unpack('>H', self.recv_buf[3:5])[0] + 2
|
||||||
|
out_buf += self.recv_buf[pos:length - 4]
|
||||||
|
self.recv_buf = self.recv_buf[length:]
|
||||||
|
|
||||||
|
if out_buf:
|
||||||
|
self.decrypt_packet_num += 1
|
||||||
|
return out_buf
|
||||||
|
|
||||||
|
def server_pre_encrypt(self, buf):
|
||||||
|
if self.raw_trans:
|
||||||
|
return buf
|
||||||
|
ret = b''
|
||||||
|
while len(buf) > self.unit_len:
|
||||||
|
ret += self.pack_data(buf[:self.unit_len])
|
||||||
|
buf = buf[self.unit_len:]
|
||||||
|
ret += self.pack_data(buf)
|
||||||
|
return ret
|
||||||
|
|
||||||
|
def server_post_decrypt(self, buf):
|
||||||
|
if self.raw_trans:
|
||||||
|
return buf
|
||||||
|
self.recv_buf += buf
|
||||||
|
out_buf = b''
|
||||||
|
if not self.has_recv_header:
|
||||||
|
if len(self.recv_buf) < 4:
|
||||||
|
return b''
|
||||||
|
crc = struct.pack('<I', binascii.crc32(self.server_info.key) & 0xFFFFFFFF)
|
||||||
|
if crc != self.recv_buf[:4]:
|
||||||
|
if self.method == 'auth_sha1_v2':
|
||||||
|
return b'E'
|
||||||
|
else:
|
||||||
|
self.raw_trans = True
|
||||||
|
return self.recv_buf
|
||||||
|
length = struct.unpack('>H', self.recv_buf[4:6])[0]
|
||||||
|
if length > len(self.recv_buf):
|
||||||
|
return b''
|
||||||
|
sha1data = hmac.new(self.server_info.recv_iv + self.server_info.key, self.recv_buf[:length - 10], hashlib.sha1).digest()[:10]
|
||||||
|
if sha1data != self.recv_buf[length - 10:length]:
|
||||||
|
logging.error('auth_sha1_v2 data uncorrect auth HMAC-SHA1')
|
||||||
|
return b'E'
|
||||||
|
pos = common.ord(self.recv_buf[6])
|
||||||
|
if pos < 255:
|
||||||
|
pos += 6
|
||||||
|
else:
|
||||||
|
pos = struct.unpack('>H', self.recv_buf[7:9])[0] + 6
|
||||||
|
out_buf = self.recv_buf[pos:length - 10]
|
||||||
|
if len(out_buf) < 8:
|
||||||
|
self.raw_trans = True
|
||||||
|
self.recv_buf = b''
|
||||||
|
logging.info('auth_sha1_v2: too short')
|
||||||
|
return b'E'
|
||||||
|
client_id = struct.unpack('<Q', out_buf[:8])[0]
|
||||||
|
connection_id = struct.unpack('<I', out_buf[8:12])[0]
|
||||||
|
if self.server_info.data.insert(client_id, connection_id):
|
||||||
|
self.has_recv_header = True
|
||||||
|
out_buf = out_buf[12:]
|
||||||
|
self.client_id = client_id
|
||||||
|
self.connection_id = connection_id
|
||||||
|
else:
|
||||||
|
self.raw_trans = True
|
||||||
|
self.recv_buf = b''
|
||||||
|
logging.info('auth_sha1_v2: auth fail, data %s' % (binascii.hexlify(out_buf),))
|
||||||
|
return b'E'
|
||||||
|
self.recv_buf = self.recv_buf[length:]
|
||||||
|
self.has_recv_header = True
|
||||||
|
|
||||||
|
while len(self.recv_buf) > 2:
|
||||||
|
length = struct.unpack('>H', self.recv_buf[:2])[0]
|
||||||
|
if length >= 8192 or length < 7:
|
||||||
|
self.raw_trans = True
|
||||||
|
self.recv_buf = b''
|
||||||
|
if self.decrypt_packet_num == 0:
|
||||||
|
logging.info('auth_sha1_v2: over size')
|
||||||
|
return b'E'
|
||||||
|
else:
|
||||||
|
raise Exception('server_post_decrype data error')
|
||||||
|
if length > len(self.recv_buf):
|
||||||
|
break
|
||||||
|
|
||||||
|
if struct.pack('<I', zlib.adler32(self.recv_buf[:length - 4]) & 0xFFFFFFFF) != self.recv_buf[length - 4:length]:
|
||||||
|
logging.info('auth_sha1: checksum error, data %s' % (binascii.hexlify(self.recv_buf[:length]),))
|
||||||
|
self.raw_trans = True
|
||||||
|
self.recv_buf = b''
|
||||||
|
if self.decrypt_packet_num == 0:
|
||||||
|
return b'E'
|
||||||
|
else:
|
||||||
|
raise Exception('server_post_decrype data uncorrect checksum')
|
||||||
|
|
||||||
|
pos = common.ord(self.recv_buf[2])
|
||||||
|
if pos < 255:
|
||||||
|
pos += 2
|
||||||
|
else:
|
||||||
|
pos = struct.unpack('>H', self.recv_buf[3:5])[0] + 2
|
||||||
|
out_buf += self.recv_buf[pos:length - 4]
|
||||||
|
self.recv_buf = self.recv_buf[length:]
|
||||||
|
|
||||||
|
if out_buf:
|
||||||
|
self.server_info.data.update(self.client_id, self.connection_id)
|
||||||
|
self.decrypt_packet_num += 1
|
||||||
|
return out_buf
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue