From 8c732ebf6736638fe36d83a6d2210c501932f0c6 Mon Sep 17 00:00:00 2001 From: bert hubert Date: Thu, 26 Feb 2015 19:10:33 +0100 Subject: [PATCH] move to symmetric crypto, plus document how it works --- pdns/README-dnsdist.md | 19 ++++++++- pdns/dnsdist.cc | 64 +++++++++++++--------------- pdns/dnsdistconf.lua | 4 +- pdns/sodcrypto.cc | 95 +++++++++--------------------------------- pdns/sodcrypto.hh | 30 ++++++++++++- 5 files changed, 96 insertions(+), 116 deletions(-) diff --git a/pdns/README-dnsdist.md b/pdns/README-dnsdist.md index d8729445cf..7d190c8da5 100644 --- a/pdns/README-dnsdist.md +++ b/pdns/README-dnsdist.md @@ -25,7 +25,7 @@ newServer2 {address="2620:0:ccc::2", qps=10} newServer2 {address="2620:0:ccd::2", qps=10} newServer("192.168.1.2") -$ dnsdist --local=0.0.0.0:5200 +$ dnsdist --local=0.0.0.0:5200 --daemon=no Marking downstream [2001:4860:4860::8888]:53 as 'up' Marking downstream [2001:4860:4860::8844]:53 as 'up' Marking downstream [2620:0:ccc::2]:53 as 'up' @@ -150,3 +150,20 @@ setServerPolicy(luaroundrobin) Incidentally, this is similar to setting: `setServerPolicy(roundrobin)` which uses the C++ based roundrobin policy. +Running it for real +------------------- +First run on the command line, and generate a key: + +``` +# dnsdist --daemon-no +> makeKey() +setKey("sepuCcHcQnSAZgNbNPCCpDWbujZ5esZJmrt/wh6ldkQ=") +``` + +Now add this setKey line to `dnsdistconf.lua`, followed by: + +``` +# dnsdist +# dnsdist --client +> +``` diff --git a/pdns/dnsdist.cc b/pdns/dnsdist.cc index a07a7a3fb3..1937659dfd 100644 --- a/pdns/dnsdist.cc +++ b/pdns/dnsdist.cc @@ -712,22 +712,26 @@ void* maintThread() return 0; } -struct { - string pub; - string sec; -} g_accessKeys, g_serverKeys; +string g_key; void controlClientThread(int fd, ComboAddress client) try { + SodiumNonce theirs; + readn2(fd, (char*)theirs.value, sizeof(theirs.value)); + SodiumNonce ours; + ours.init(); + writen2(fd, (char*)ours.value, sizeof(ours.value)); + for(;;) { uint16_t len; - getMsgLen(fd, &len); + if(!getMsgLen(fd, &len)) + break; char msg[len]; readn2(fd, msg, len); string line(msg, len); - line = sodDecrypt(line, g_accessKeys.pub, g_serverKeys.sec); + line = sodDecryptSym(line, g_key, theirs); // cerr<<"Have decrypted line: "< params) { - if(B64Decode(params[1], g_accessKeys.pub)) - throw std::runtime_error("Unable to decode "+params[1]+" as Base64"); - if(B64Decode(params[2], g_accessKeys.sec)) - throw std::runtime_error("Unable to decode "+params[2]+" as Base64"); - }); - - g_lua.writeFunction("serverKeys", [](std::unordered_map params) { - if(B64Decode(params[1], g_serverKeys.pub)) - throw std::runtime_error("Unable to decode "+params[1]+" as Base64"); - if(B64Decode(params[2], g_serverKeys.sec)) - throw std::runtime_error("Unable to decode "+params[2]+" as Base64"); + g_lua.writeFunction("setKey", [](const std::string& key) { + if(B64Decode(key, g_key)) + throw std::runtime_error("Unable to decode "+key+" as Base64"); }); g_lua.writeFunction("testCrypto", [](string testmsg) { - string encrypted = sodEncrypt(testmsg, g_accessKeys.sec, g_serverKeys.pub); - string decrypted = sodDecrypt(encrypted, g_accessKeys.pub, g_serverKeys.sec); + SodiumNonce sn, sn2; + sn.init(); + sn2=sn; + string encrypted = sodEncryptSym(testmsg, g_key, sn); + string decrypted = sodDecryptSym(encrypted, g_key, sn2); if(testmsg == decrypted) cerr<<"Everything is ok!"< dupper; { ifstream history(".history"); @@ -1009,7 +1011,7 @@ void doClient(ComboAddress server) break; string response; - string msg=sodEncrypt(line, g_accessKeys.sec, g_serverKeys.pub); + string msg=sodEncryptSym(line, g_key, ours); putMsgLen(fd, msg.length()); writen2(fd, msg); uint16_t len; @@ -1017,11 +1019,9 @@ void doClient(ComboAddress server) char resp[len]; readn2(fd, resp, len); msg.assign(resp, len); - msg=sodDecrypt(msg, g_serverKeys.pub, g_accessKeys.sec); + msg=sodDecryptSym(msg, g_key, theirs); cout<>()) { @@ -1150,8 +1148,6 @@ try } } - - for(auto& dss : g_dstates) { if(dss->availability==DownstreamState::Availability::Auto) { bool newState=upCheck(dss->remote); diff --git a/pdns/dnsdistconf.lua b/pdns/dnsdistconf.lua index 5c360494d9..81737c78d6 100644 --- a/pdns/dnsdistconf.lua +++ b/pdns/dnsdistconf.lua @@ -1,7 +1,5 @@ -serverKeys({"oYhvA4N2a+PfWJ1aBVG3OFD/BBO/8sdkzRgGQoDxVz0=","2JjfJbIH/2g+1cIxj7IXhv4j38+rCiXbpdjtn91p/04="}) -accessKeys({"9RM9r+olHDJU+87hBXT9DCCej/DUS1XjIKWTq84AfTs=","ghv/LTqRTOgVvK8A/XEWrFks+F5fng1Wn14Xe9Rblgg="}) - controlSocket("0.0.0.0") +setKey("MXNeLFWHUe4363BBKrY06cAsH8NWNb+Se2eXU5+Bb74=") -- define the good servers newServer("8.8.8.8", 2) -- 2 qps diff --git a/pdns/sodcrypto.cc b/pdns/sodcrypto.cc index f9c63a5184..7c0c4f4131 100644 --- a/pdns/sodcrypto.cc +++ b/pdns/sodcrypto.cc @@ -3,92 +3,35 @@ #include "namespaces.hh" #include "misc.hh" #include "base64.hh" +#include "sodcrypto.hh" -string newKeypair() -{ - unsigned char alice_publickey[crypto_box_PUBLICKEYBYTES]; - unsigned char alice_secretkey[crypto_box_SECRETKEYBYTES]; - crypto_box_keypair(alice_publickey, alice_secretkey); - - string ret("{\""); - ret+=Base64Encode(string((char*)alice_publickey, crypto_box_PUBLICKEYBYTES)); - ret+="\",\""; - ret+=Base64Encode(string((char*)alice_secretkey, crypto_box_SECRETKEYBYTES)); - ret+="\"}"; - return ret; -} -// return: nonce + ciphertext - -std::string sodEncrypt(const std::string& msg, const std::string& secretSource, - const std::string& publicDest) +string newKey() { - unsigned char nonce[crypto_box_NONCEBYTES]; - unsigned char ciphertext[msg.length() + crypto_box_MACBYTES]; - randombytes_buf(nonce, sizeof nonce); - /* - cerr<<"Encrypt plen: "< +#include void sodTest(); std::string newKeypair(); -std::string sodEncrypt(const std::string& msg, const std::string& secretSource, +std::string sodEncryptAsym(const std::string& msg, const std::string& secretSource, const std::string& publicDest); -std::string sodDecrypt(const std::string& msg, const std::string& publicSource, +std::string sodDecryptAsym(const std::string& msg, const std::string& publicSource, const std::string& secretDest); + +struct SodiumNonce +{ + void init() + { + randombytes_buf(value, sizeof value); + } + + void increment() + { + uint64_t* p = (uint64_t*)value; + (*p)++; + } + + string toString() const + { + return string((const char*)value, crypto_secretbox_NONCEBYTES); + } + + unsigned char value[crypto_secretbox_NONCEBYTES]; +}; + +std::string sodEncryptSym(const std::string& msg, const std::string& key, SodiumNonce&); +std::string sodDecryptSym(const std::string& msg, const std::string& key, SodiumNonce&); +std::string newKey(); -- 2.47.3