|
Introduction
Reference Scenario
Protocol
Architecture
Download
Hosted on SF!
|
|
The Architecture
The system is composed by some interdependent modules:
The Encrypter: this is a function
that encrypts the current timestamp and other protocol related info
in a packet that is used as a sort of "signature" to open the warp
gate. Any symmetric encryption function is suitable for this purpose.
We use AES as the standard crypto algorithm.
This module is shared between client & server.
[encrypter.c]
The Listener: this uses a specific
mechanism to open and bind the
UDP port used by the server; I have identified three possible mechanisms:
first, a classic bind() + recvfrom(); this assumes that it is possible to
filter all the outgoing ICMP requests, so to not reveal the presence
of the system. Second, we still use a classic system, but we reply with
a fake ICMP message. Third, we use a raw UDP socket, and see how the
system handles this.
[listener.c]
The Actuator: this is the mechanism
used to "open" the warp gate: it
can be a generic command issued to the kernel, for example to add a
firewall rule that allows a specific host to connect the server.
Otherwise, it can add a rule in /etc/hosts.allow.
At the same time, the actuator starts a countdown; when this expires,
the door is "closed" removing the rule that was added.
If we receive another encrypted probe that matches the secret key,
we reset the countdown.
The Listener and the actuator are used by the server only.
[actuator.c]
The Event Manager: this is essentially
a time-driven mechanism
that allow to execute something after a specific delay. We post
a request for a specific time; when the time elapses, the function
associated is executed. It is possible to "clear" the event before
the time is elapsed.
The underlying mechanism is based on Unix signals; I used the Posix
interface, but the actual program should be checked on different
Unix variants.
[event.c]
|
