client.cpp

#include "commonlib/net_wrapper.h"
#include "commonlib/net_exception.h"
#include "commonlib/messages.h"
#include "commonlib/commonlib.h"
#include "commonlib/log.h"

#include <string.h>
#include <stdio.h>
#include <errno.h>

#include <fcntl.h>
#include <unistd.h>

#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/pem.h>
#include <openssl/rand.h>
#include <openssl/err.h>

#include <iostream>
#include <stdexcept>

using namespace std;

// --------- Console Functions ----------
#include <stdlib.h>
#include <termios.h>

struct termios oflags, nflags;

void disable_console_echo()
{
	tcgetattr(fileno(stdin), &oflags);
	nflags = oflags;
	nflags.c_lflag &= ~ECHO;
	nflags.c_lflag |= ECHONL;

	if (tcsetattr(fileno(stdin), TCSANOW, &nflags) != 0) {
		throw std::runtime_error("can't disable echo");
	}
}

void enable_console_echo()
{
	if (tcsetattr(fileno(stdin), TCSANOW, &oflags) != 0) {
		perror("tcsetattr");
		throw std::runtime_error("can't enable echo");
	}
}

// --------------------------------------

my_buffer my_buff;

uint64_t cl_nonce;
uint64_t sr_nonce;

uint64_t cl_seq_num;
uint64_t sr_seq_num;

unsigned char session_key[16];
unsigned char hmac_key[16];

int send_hello_msg(int sock) {
	hello_msg h;
	h.t = CLIENT_HELLO;
	h.nonce = cl_nonce = cl_seq_num = generate_nonce();
	convert_to_network_order(&h);
	LOG_DEBUG("client sends nonce: %ld\n",cl_nonce);
	return send_data(sock,(unsigned char*)&h, sizeof(h));
}

bool recv_hello_msg(int sock)
{
	if( recv_data(sock, &my_buff) < sizeof(simple_msg) )
		return false;

	convert_to_host_order(my_buff.buf);
	simple_msg *p = (simple_msg*)my_buff.buf;
	switch( p->t ) {
  		case SERVER_HELLO:
  			sr_nonce = sr_seq_num = ((hello_msg*)p)->nonce;
			LOG_DEBUG("Server nonce received: %ld\n",sr_nonce);
  			break;
		default:
			return false;
	}

	return true;
}

bool verify_server_identity(int sd)
{
	int signature_len = recv_data(sd, &my_buff);
	if(signature_len <= 0)
	{
		LOG_ERROR("verify_server_identity: cannot recv signature_len\n");
		return false;
	}
	unsigned char *signature = new unsigned char[signature_len];
	memcpy(signature, my_buff.buf, signature_len);

	SignatureVerifier sv("keys/rsa_server_digsign_pubkey.pem");

	unsigned char expected_signed[16];
	memcpy(expected_signed, &cl_nonce, 8);
	memcpy(expected_signed + 8, &sr_nonce, 8);
	sv.verify(expected_signed, 16);

	// compare nonces
	if(!sv.verify_end(signature, signature_len))
	{
		LOG_ERROR("Signature not verified!\n");
		return false;
	}

	LOG_INFO("Server Authentication Success!\n");
	return true;
}

bool send_client_identification(int sd, char auth_username[], char auth_secret[])
{
	// generate session key
	generate_session_key(session_key);
	// generate hmac key
	generate_session_key(hmac_key);

	// setup PublicKey cipher
	EncryptSession asymm_authclient_cipher("keys/rsa_server_pubkey.pem");

	// ## plaintext data
	// send iv and encrypted key generated by EncryptSession
	unsigned char *auth_iv = asymm_authclient_cipher.get_iv();
	unsigned char *auth_pk_encrypted_key;
	unsigned int auth_pk_encrypted_key_len = asymm_authclient_cipher.get_session_key(&auth_pk_encrypted_key);
	send_data(sd, auth_pk_encrypted_key, auth_pk_encrypted_key_len);
	send_data(sd, auth_iv, EVP_CIPHER_iv_length(EVP_aes_128_cbc()));

	// ## ciphered data
	unsigned char *auth_ciphertext;
	unsigned int auth_cipherlen;
	// client nonce encrypt
	asymm_authclient_cipher.encrypt((unsigned char*)&sr_nonce, 8);
	// session key encrypt
	asymm_authclient_cipher.encrypt(session_key, 16);
	// hmac key encrypt
	asymm_authclient_cipher.encrypt(hmac_key, 16);
	// username encrypt
	asymm_authclient_cipher.encrypt((unsigned char*)auth_username, strlen(auth_username) + 1);
	// password encrypt
	asymm_authclient_cipher.encrypt((unsigned char*)auth_secret, strlen(auth_secret) + 1);
	asymm_authclient_cipher.encrypt_end();
	auth_cipherlen = asymm_authclient_cipher.flush_ciphertext(&auth_ciphertext);

	// send client auth header (server needs sizes)
	client_auth auth_header_msg = {CLIENT_AUTHENTICATION, auth_cipherlen, (unsigned int)strlen(auth_username) + 1, (unsigned int)strlen(auth_secret) + 1};
	LOG_DEBUG("client header: ciphertext_len = %u, username_length = %u, password_length = %u\n",
		auth_header_msg.total_ciphertext_size, auth_header_msg.username_length, auth_header_msg.password_length);

	convert_to_network_order(&auth_header_msg);
	send_data(sd, (unsigned char*)&auth_header_msg, sizeof(auth_header_msg));

	// send ciphertext and padded ciphertext
	send_data(sd, auth_ciphertext, auth_cipherlen);

	return true;
}

bool wait_for_authentication_response(int sd)
{
	bool result = false;
	simple_msg auth_response_msg;

	// getting iv
	unsigned char *resp_iv = new unsigned char[EVP_CIPHER_iv_length(EVP_aes_128_cbc())];
	unsigned int resp_iv_len = recv_data(sd, &my_buff);
	memcpy(resp_iv, my_buff.buf, resp_iv_len);

	// getting {auth status,clnonce}_Ksess
	unsigned int resp_cipherlen = recv_data(sd, &my_buff);
	unsigned char *resp_ciphertext = new unsigned char[resp_cipherlen];
	memcpy(resp_ciphertext, my_buff.buf, resp_cipherlen);

	// getting HMAC_Ksess{auth status,clnonce}_Ksess
	unsigned int resp_hmac_len = recv_data(sd, &my_buff);
	unsigned char *resp_hmac = new unsigned char[resp_hmac_len];
	memcpy(resp_hmac, my_buff.buf, resp_hmac_len);

	// verifying HMAC_Ksess{auth status,clnonce}_Ksess
	unsigned char *resp_computed_hmac;
	HMACMaker hm(hmac_key, 16);
	hm.hash(resp_ciphertext, resp_cipherlen);
	hm.hash_end(&resp_computed_hmac);

	if(CRYPTO_memcmp(resp_computed_hmac, resp_hmac, HMAC_LENGTH) != 0)
	{
		LOG_ERROR("Authentication Response HMAC verification failed!\n");
		return false;
	}

	// decipher
	SymmetricCipher sc(EVP_aes_128_cbc(), session_key, resp_iv);
	sc.decrypt(resp_ciphertext, resp_cipherlen);
	sc.decrypt_end();

	unsigned char* resp_plaintext;
	unsigned int resp_plainlen = sc.flush_plaintext(&resp_plaintext);

	// security check
	if(resp_plainlen < sizeof(auth_response_msg) + sizeof(uint64_t))
		return false;

	// extracting things
	unsigned int resp_plaintext_offset = 0;

	// auth status
	memcpy(&auth_response_msg, resp_plaintext, sizeof(auth_response_msg));
	resp_plaintext_offset += sizeof(auth_response_msg);
	// received cl_nonce
	uint64_t verification_cl_nonce;
	memcpy(&verification_cl_nonce, resp_plaintext + resp_plaintext_offset, sizeof(uint64_t));
	resp_plaintext_offset += sizeof(uint64_t);

	if(cl_nonce != verification_cl_nonce)
	{
		LOG_ERROR("Authentication Response Client nonce verification failed! (%lu, %lu)\n", cl_nonce, verification_cl_nonce);
		return false;
	}

	if(auth_response_msg.t == AUTHENTICATION_FAILED )
	{
		LOG_ERROR("Authentication Failed!\n");
		result = false;
	} else
		result = true;

	delete[] resp_computed_hmac;

	return result;
}

bool send_command(int sd, void *msg_str, size_t msg_len)
{
	unsigned char *command_iv = new unsigned char[EVP_CIPHER_iv_length(EVP_aes_128_cbc())];
	generate_iv(command_iv);
	send_data(sd, command_iv, EVP_CIPHER_iv_length(EVP_aes_128_cbc()));

	SymmetricCipher sc(EVP_aes_128_cbc(), session_key, command_iv);

	convert_to_network_order(msg_str);

	// encrypt sr_seq_num|command_str
	sc.encrypt((unsigned char*)&sr_seq_num, sizeof(sr_seq_num));
	sc.encrypt((unsigned char*)msg_str, msg_len);
	sc.encrypt_end();
	unsigned char *command_ciphertext;
	unsigned int command_cipherlen = sc.flush_ciphertext(&command_ciphertext);

	LOG_DEBUG("command_cipherlen:%d\n",command_cipherlen);
	// send {seqnum|command_str}_Ksess
	send_data(sd, command_ciphertext, command_cipherlen);

	// make hmac from {seqnum|command_str}_Ksess
	unsigned char *hash_result;
	unsigned int hash_len;

	HMACMaker hc(hmac_key, 16);
	hc.hash(command_ciphertext, command_cipherlen);
	hash_len = hc.hash_end(&hash_result);

	// send HMAC_Ksess{ eqnum|command_str}_Ksess }
	send_data(sd, hash_result, hash_len);

	// increment server sequence number
	sr_seq_num++;

	delete[] command_iv;

	return true;
}

bool receive_str_response(int sd, unsigned char **received_data, unsigned int* received_data_len)
{
	// getting iv
	unsigned char *command_iv = new unsigned char[EVP_CIPHER_iv_length(EVP_aes_128_cbc())];
	unsigned int command_iv_len = recv_data(sd, &my_buff);
	memcpy(command_iv, my_buff.buf, command_iv_len);

	// getting {seqnum|command_str}_Ksess
	unsigned int command_ciphertext_len = recv_data(sd, &my_buff);
	unsigned char *command_ciphertext = new unsigned char[command_ciphertext_len];
	memcpy(command_ciphertext, my_buff.buf, command_ciphertext_len);

	// getting HMAC_Ksess{seqnum|command_str}_Ksess
	unsigned int command_hmac_len = recv_data(sd, &my_buff);
	unsigned char *command_hmac = new unsigned char[command_hmac_len];
	memcpy(command_hmac, my_buff.buf, command_hmac_len);

	// making HMAC_Ksess{seqnum|command_str}_Ksess
	unsigned char *computed_hmac;
	HMACMaker hm(hmac_key, 16);
	hm.hash(command_ciphertext, command_ciphertext_len);
	hm.hash_end(&computed_hmac);

	if(CRYPTO_memcmp(computed_hmac, command_hmac, HMAC_LENGTH) != 0)
	{
		LOG_INFO("receive_str_response: HMAC authentication failed!\n");
		return false;
	}

	LOG_INFO("receive_str_response: HMAC authentication success!\n");

	// decrypt {seqnum|command_str}_Ksess
	SymmetricCipher sc(EVP_aes_128_cbc(), session_key, command_iv);
	unsigned char *command_plaintext;
	unsigned int command_plainlen;
	sc.decrypt(command_ciphertext, command_ciphertext_len);
	sc.decrypt_end();
	command_plainlen = sc.flush_plaintext(&command_plaintext);

	delete[] command_iv;
	delete[] command_ciphertext;
	delete[] command_hmac;
	delete[] computed_hmac;

	// verify sequence number
	uint64_t received_seqno;
	memcpy((void*)&received_seqno, command_plaintext, sizeof(uint64_t));

	char *data_text = (char*)&command_plaintext[sizeof(uint64_t)];
	unsigned int data_text_len = command_plainlen - sizeof(uint64_t); // Must be checked

	if(received_seqno != cl_seq_num)
	{
		LOG_INFO("receive_str_response: Invalid sequence number! (%lu != %lu)\n", received_seqno, cl_seq_num);
		return false;
	}

	// increment server sequence number
	cl_seq_num++;

	// return receive command
	*received_data = new unsigned char[data_text_len];
	memcpy(*received_data, data_text, data_text_len);
	*received_data_len = data_text_len;
	LOG_DEBUG("receive_str_response: size = %u\n", data_text_len);
	return true;
}

bool receive_file_response(int sd, const char filename[])
{
	// getting iv
	unsigned char *iv = new unsigned char[EVP_CIPHER_iv_length(EVP_aes_128_cbc())];
	unsigned int iv_len = recv_data(sd, &my_buff);
	memcpy(iv, my_buff.buf, iv_len);

	// get file transfer header
	send_file_msg s_msg;
	if(!recv_msg(sd, &s_msg, SEND_FILE)) {
		LOG_ERROR("Errore ricezione messaggio SEND_FILE \n");
		return -1;
	}

	// if file does not exist
	if(s_msg.response_code == 0) {
		printf("File does not exist!\n");
		return false; // we can't go on
	}

	FILE *fp;
	open_file_w(filename, &fp);

	SymmetricCipher sc(EVP_aes_128_cbc(), session_key, iv);
	HMACMaker hm(hmac_key, 16);

	unsigned int total_plainlen = 0;
	// initialize receive buffer
	my_buffer chunk_cipher;
	chunk_cipher.buf = NULL;
	chunk_cipher.size = 0;
	for(unsigned int i=0; i < s_msg.chunk_number; i++)
	{
		// get chunk from tcp socket
		int chunk_cipherlen = recv_data(sd, &chunk_cipher);
		if(chunk_cipherlen < 0)
		{
			LOG_ERROR("receive_file_response: cannot recv chunk_cipher\n");
			return false;
		}
		LOG_DEBUG("decrypting chunk(%d) of %d ciphertext bytes\n", i, chunk_cipherlen);

		// hash partial encrypted text
		hm.hash(chunk_cipher.buf, chunk_cipherlen);

		// do decryption
		unsigned char* chunk_plaintext;
		sc.decrypt(chunk_cipher.buf, chunk_cipherlen);
		unsigned int chunk_plainlen = sc.flush_plaintext(&chunk_plaintext);
		unsigned char* original_chunk_plaintext = chunk_plaintext;

		// if first chunk, nonce must be extracted and verified
		if(i == 0)
		{
			if(chunk_cipherlen < (int)sizeof(uint64_t))
			{
				LOG_ERROR("receive_file_response: cannot recv sequence number\n");
				return false;
			}

			uint64_t received_seqno;
			memcpy((void*)&received_seqno, chunk_plaintext, sizeof(uint64_t));

			// verify sequence number
			if(received_seqno != cl_seq_num) {
				LOG_ERROR("receive_str_response: Invalid sequence number! (%lu != %lu)\n", received_seqno, cl_seq_num);
				return false;
			}

			// chunk_plaintext must be purified from received
			chunk_plaintext += sizeof(uint64_t);
			chunk_plainlen -= sizeof(uint64_t);
		}

		total_plainlen += chunk_plainlen;

		// write to file
		fwrite(chunk_plaintext, 1, chunk_plainlen, fp);

		// if latest chunk, compute padding
		if(i == s_msg.chunk_number-1)
		{
			unsigned char *padding_plaintext;
			sc.decrypt_end();
			unsigned padding_plainlen = sc.flush_plaintext(&padding_plaintext);
			total_plainlen += padding_plainlen;
			LOG_DEBUG("adding last padded block of %d bytes\n", padding_plainlen);

			// write latest block (without padding)
			fwrite(padding_plaintext, 1, padding_plainlen, fp);

			delete[] padding_plaintext;
		}

		delete[] original_chunk_plaintext;
	}

	// getting from client HMAC_Ksess{seqnum|command_str}_Ksess
	unsigned int received_hmac_len = recv_data(sd, &my_buff);
	unsigned char *received_hmac = new unsigned char[received_hmac_len];
	memcpy(received_hmac, my_buff.buf, received_hmac_len);

	// finally compute HMAC_Ksess{seqnum|command_str}_Ksess
	unsigned char *computed_hmac;
	hm.hash_end(&computed_hmac);

	// verify hash
	if(CRYPTO_memcmp(computed_hmac, received_hmac, HMAC_LENGTH) != 0)
	{
		LOG_INFO("receive_str_response: HMAC authentication failed!\n");
		return false;
	}

	LOG_INFO("receive_str_response: HMAC authentication success!\n");

	// increment server sequence number
	cl_seq_num++;
	fclose(fp);
	return true;
}

void quit_command(int sd)
{
	// 6) Send Command
	// send {seqnum|command_str}_Ksess | HMAC{{seqnum|command_str}_Ksess}_Khmac
	simple_msg cmd = {QUIT_SESSION};
	if(!send_command(sd, &cmd, sizeof(cmd)))
		throw runtime_error("cannot send QUIT_SESSION command");
}

void list_command(int sd, string parameters)
{
	// 6) Send Command
	// send {seqnum|command_str}_Ksess | HMAC{{seqnum|command_str}_Ksess}_Khmec
	simple_msg cmd = {LIST_FILE};
	if(!send_command(sd, &cmd, sizeof(cmd)))
		throw runtime_error("cannot send LIST_FILE command");

	// 7) Receive Response
	// receive {seqnum|data}_Ksess | HMAC{{seqnum|data}_Ksess}_Kmac
	unsigned char *received_data;
	unsigned int received_data_len;
	if(!receive_str_response(sd, &received_data, &received_data_len) || received_data_len == 0)
		throw runtime_error("cannot receive response");

	received_data[received_data_len-1] = '\0';
	printf("%s", received_data);
}

void download_command(int sd, string parameters)
{
	if(parameters.length() > 255)
	{
		printf("Error: Too long filename size\n");
		return;
	}

	// 6) Send Command
	// send {seqnum|command_str}_Ksess | HMAC{{seqnum|command_str}_Ksess}_Ksess
	download_file cmd;
	cmd.t = DOWNLOAD_FILE;
	cmd.filename_len = parameters.length();
	memcpy(cmd.filename, parameters.c_str(), cmd.filename_len);
	if(!send_command(sd, &cmd, sizeof(cmd)))
		throw runtime_error("cannot send command");

	receive_file_response(sd, parameters.c_str());
}

int main(int argc, char **argv)
{
	ERR_load_crypto_strings();

	int sd;
	uint16_t server_port;

	my_buff.buf = NULL;
	my_buff.size = 0;

	// Parsing parameters
	if( argc < 3 ){
		perror("use: ./client server_ip port");
		return -1;
	}
	sscanf(argv[2],"%hd",&server_port);

	sd = start_tcp_connection(argv[1], server_port);
	if( sd < 0 )
		return -1;

	// 1) Send Client Nonce
	send_hello_msg(sd);

	// 2) Get Server Nonce
	if(	!recv_hello_msg(sd) )
	{
		printf("Hello message from server not received! \n");
		return -1;
	}

	// 3) Verify Server Identity
	// receive E(Kpriv, client_nonce|server_nonce)
	if(!verify_server_identity(sd)){
		printf("Server verification failed \n");
		return -1;
	}

	// 4) Send client verification infos and KeySession
	// send {client_nonce|session key|username|password}_Kpub

	// ask for credentials
	char *auth_username = NULL;
	char *auth_secret = NULL;
	cout << "Username: ";
	fflush(stdout);
	scanf("%ms", &auth_username);
	if(!auth_username)
		return -1;

	cout << "Password: ";
	fflush(stdout);
	disable_console_echo();
	scanf("%ms", &auth_secret);
	enable_console_echo();
	if(!auth_secret)
		return -1;

	if(!send_client_identification(sd, auth_username, auth_secret))
		return -1;

	// 5) Waiting for AuthOK or AuthFailed
	if(!wait_for_authentication_response(sd))
		return -1;

	cout << "Authentication success!" << endl;

	cin.ignore();
	while(true)
	{
		cout << auth_username << "@" << argv[1] << "$ " << flush;

		string entered_string;
		if(!(std::getline(std::cin, entered_string))) {
			quit_command(sd);
			break;
		}

		// extract command and parameter
		string cmd_str = entered_string.substr(0, entered_string.find(string(" ")));
		entered_string.erase(0, entered_string.find(" ") + 1);
		string params_str(entered_string);
		//cout << "cmd_str:" << cmd_str << " params_str:" << params_str << endl;

		if(cmd_str == "list")
			list_command(sd, params_str);
		else if(cmd_str == "download")
			download_command(sd, params_str);
		else if(cmd_str == "exit" || cmd_str == "quit") {
			quit_command(sd);
			break;
		}
		else if(cmd_str == "help")
			cout << "Commands:" << endl << "\tlist, download <filename>" << endl << "\thelp, exit, quit" << endl;
		else if(cmd_str != "")
			cout << "unrecognized command" << endl;
	}

	printf("\n");

	close(sd);
	delete[]  auth_username;
	secure_zero(auth_secret, strlen(auth_secret));
	delete[] auth_secret;

	return 0;
}