1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
|
// **********************************************************************
//
// Copyright (c) 2002
// MutableRealms, Inc.
// Huntsville, AL, USA
//
// All Rights Reserved
//
// **********************************************************************
#include <Ice/Security.h>
#include <Ice/Stream.h>
#include <Ice/SUdpClientControlChannel.h>
#include <Ice/Instance.h>
#include <Ice/Communicator.h>
#include <Ice/ObjectAdapter.h>
#include <Ice/IdentityUtil.h>
#include <Ice/SUdpTransceiver.h>
#include <Ice/MessageAuthenticator.h>
#include <Ice/Cryptor.h>
#include <Ice/CryptKey.h>
#include <Ice/TraceLevels.h>
#include <Ice/Logger.h>
#include <sstream>
using namespace std;
using namespace Ice;
using namespace IceSecurity::SecureUdp;
using IceInternal::BasicStream;
////////////////////////////////////////////////////////////////////////////////
// Public Incoming Methods (from Ice Client Control Channel)
////////////////////////////////////////////////////////////////////////////////
void
IceSecurity::SecureUdp::ClientControlChannel::serverHello(Long clientID, const ByteSeq& key, const Current&)
{
IceUtil::Mutex::Lock sync(_mutex);
ICE_METHOD_INV("ClientControlChannel::serverHello()");
_clientID = clientID;
// TODO: There is a wierd segmentation fault happening here if I uncomment
// the call to serverKeyChangeMessage(). Dunno why.
// ICE_DEV_DEBUG("About to call serverKeyChangeMessage()");
// serverKeyChangeMessage(key);
ICE_METHOD_RET("ClientControlChannel::serverHello()");
}
void
IceSecurity::SecureUdp::ClientControlChannel::serverKeyChange(const ByteSeq& key, const Current&)
{
IceUtil::Mutex::Lock sync(_mutex);
ICE_METHOD_INV("ClientControlChannel::serverKeyChange()");
serverKeyChangeMessage(key);
ICE_METHOD_RET("ClientControlChannel::serverKeyChange()");
}
void
IceSecurity::SecureUdp::ClientControlChannel::serverGoodbye(const Current&)
{
IceUtil::Mutex::Lock sync(_mutex);
ICE_METHOD_INV("ClientControlChannel::serverGoodbye()");
// TODO: Should find some way to shut down the Transceiver here.
ICE_METHOD_RET("ClientControlChannel::serverGoodbye()");
}
////////////////////////////////////////////////////////////////////////////////
// Protected Methods
////////////////////////////////////////////////////////////////////////////////
// IceSecurity::SecureUdp::ClientControlChannel::ClientControlChannel(const SUdpTransceiverPtr& transceiver,
IceSecurity::SecureUdp::ClientControlChannel::ClientControlChannel(SUdpTransceiver* transceiver,
const InstancePtr& instance,
const std::string& host,
int port) :
ControlChannel(transceiver, instance)
{
ICE_METHOD_INV("ClientControlChannel::ClientControlChannel()");
// Create the Client Channel's name
ostringstream objectName;
objectName << "sudpClient" << hex << (void *) this;
// This MUST be an SSL endpoint - secure handshake takes place over this.
ostringstream endpt;
endpt << "ssl";
// Create the ObjectAdapter's name
ostringstream objectAdapterName;
objectAdapterName << "sudpClientControl" << hex << (void *) this;
Ice::CommunicatorPtr communicator = _instance->communicator();
// Create our ObjectAdapter
_adapter = communicator->createObjectAdapterWithEndpoints(objectAdapterName.str(), endpt.str());
// The client control channel is the implementaion.
ClientChannelPtr clientChannel = this;
_adapter->add(clientChannel, Ice::stringToIdentity(objectName.str()));
// Okay, allow the object to begin accepting requests
_adapter->activate();
const Ice::ObjectPrx& proxy = _adapter->createProxy(stringToIdentity(objectName.str()));
_clientProxy = ClientChannelPrx::uncheckedCast(proxy /* ->ice_oneway() */);
// Create our connection to the Server channel
ostringstream ref;
ref << "sudpServer" << dec << port << ":ssl -p " << dec << port << " -h " << host;
Ice::ObjectPrx base = communicator->stringToProxy(ref.str());
ServerChannelPrx twoway;
try
{
// ice_timeout(10)->
twoway = ServerChannelPrx::checkedCast(base->ice_twoway()->ice_secure(true));
}
catch ( Ice::Exception& expt )
{
ostringstream exptString;
exptString << "Exception: " << expt;
ICE_DEV_DEBUG(exptString.str());
throw;
}
if (!twoway)
{
// TODO: Bad scene, bad object reference
}
_serverChannel = ServerChannelPrx::uncheckedCast(twoway /* ->ice_oneway() */);
_messageAuthenticator = new MessageAuthenticator();
_clientID = 0L;
_msgID = 0L;
clientHello();
ICE_METHOD_RET("ClientControlChannel::ClientControlChannel()");
}
IceSecurity::SecureUdp::ClientControlChannel::~ClientControlChannel()
{
// Make it impossible for the control channel to access the Transceiver
// after transceiver destruction.
unsetTransceiver();
}
void
IceSecurity::SecureUdp::ClientControlChannel::serverKeyChangeMessage(const ByteSeq& key)
{
ICE_METHOD_INV("ClientControlChannel::serverKeyChangeMessage()");
Long msgID = _msgID + 1;
assert(_cryptor);
// From this msgID onwards, use the indicated key
_encryptionKey = _cryptor->getOrCreateKey(key);
assert(_serverChannel);
_serverChannel->clientKeyAcknowledge(_clientID, msgID, _encryptionKey->toByteSeq());
ICE_METHOD_RET("ClientControlChannel::serverKeyChangeMessage()");
}
void
IceSecurity::SecureUdp::ClientControlChannel::clientHello()
{
_serverChannel->clientHello(_clientProxy, _messageAuthenticator->getMACKey());
}
////////////////////////////////////////////////////////////////////////////////
// Incoming Methods (from SUdpTransceiver)
////////////////////////////////////////////////////////////////////////////////
void
IceSecurity::SecureUdp::ClientControlChannel::encryptPacket(Buffer& buffer, Buffer& encryptedPacket)
{
IceUtil::Mutex::Lock sync(_mutex);
// We always, and ONLY, increment here.
++_msgID;
Long messageLength = buffer.b.end() - buffer.b.begin();
// 1. Compute the MAC
ByteSeq macBuffer = _messageAuthenticator->computeMAC(buffer.b);
// 2. Append MAC to Message, produce signed message
BasicStream signedMessageStream(0);
signedMessageStream.write(messageLength);
signedMessageStream.write(buffer.b);
signedMessageStream.write(macBuffer);
// 3. Encrypt signed message
ByteSeq signedMessage;
ByteSeq encryptedMessage;
signedMessageStream.read(signedMessage);
_cryptor->encrypt(_encryptionKey, signedMessage, encryptedMessage);
// 4. Create record header
BasicStream headerStream(0);
Byte version = 1;
Long length = encryptedMessage.end() - encryptedMessage.begin();
headerStream.write(version);
headerStream.write(_clientID);
headerStream.write(_msgID);
headerStream.write(length);
// 5. Prepend header to encrypted message, create SUDP Packet
BasicStream sudpPacket(0);
ByteSeq header;
headerStream.read(header);
sudpPacket.write(header);
sudpPacket.write(encryptedMessage);
// Pass the encrypted packet back.
sudpPacket.read(encryptedPacket.b);
}
void
IceSecurity::SecureUdp::ClientControlChannel::clientKeyRequest()
{
_serverChannel->clientKeyRequest(_clientID);
}
|
