Truncated history

nfq/BSDmakefile

@@ -0,0 +1,12 @@
+CC ?= cc
+CFLAGS += -std=gnu99 -s -O3 -Wno-address-of-packed-member
+LIBS = -lz
+SRC_FILES = *.c crypto/*.c
+
+all: dvtws
+
+dvtws: $(SRC_FILES)
+	$(CC) $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS)
+
+clean:
+	rm -f dvtws

nfq/Makefile

@@ -0,0 +1,30 @@
+CC ?= gcc
+CFLAGS += -std=gnu99 -O3
+CFLAGS_BSD = -Wno-address-of-packed-member
+CFLAGS_MAC = -mmacosx-version-min=10.8
+CFLAGS_CYGWIN = -Wno-address-of-packed-member -static
+LIBS_LINUX = -lnetfilter_queue -lnfnetlink -lz
+LIBS_BSD = -lz
+LIBS_CYGWIN = -lz -Lwindivert -lwindivert -lwlanapi -lole32 -loleaut32 -luuid
+SRC_FILES = *.c crypto/*.c
+
+all: nfqws
+
+nfqws: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) -o $@ $(SRC_FILES) $(LDFLAGS) $(LIBS_LINUX)
+
+bsd: $(SRC_FILES)
+	$(CC) -s $(CFLAGS) $(CFLAGS_BSD) -o dvtws $(SRC_FILES) $(LDFLAGS) $(LIBS_BSD)
+
+mac: $(SRC_FILES)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsa $(SRC_FILES) $(LDFLAGS) -target arm64-apple-macos10.8 $(LIBS_BSD)
+	$(CC) $(CFLAGS) $(CFLAGS_BSD) -o dvtwsx $(SRC_FILES) $(LDFLAGS) -target x86_64-apple-macos10.8 $(LIBS_BSD)
+	strip dvtwsa dvtwsx
+	lipo -create -output dvtws dvtwsx dvtwsa
+	rm -f dvtwsx dvtwsa
+
+cygwin:
+	$(CC) -s $(CFLAGS) $(CFLAGS_CYGWIN) -o winws $(SRC_FILES) $(LDFLAGS) $(LIBS_CYGWIN) winmanifest.o winicon.o
+
+clean:
+	rm -f nfqws dvtws winws.exe

nfq/checksum.c

@@ -0,0 +1,159 @@
+#define _GNU_SOURCE
+#include "checksum.h"
+#include <netinet/in.h>
+
+//#define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
+//#define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
+
+static uint16_t from64to16(uint64_t x)
+{
+	uint32_t u = (uint32_t)(uint16_t)x + (uint16_t)(x>>16) + (uint16_t)(x>>32) + (uint16_t)(x>>48);
+	return (uint16_t)u + (uint16_t)(u>>16);
+}
+
+// this function preserves data alignment requirements (otherwise it will be damn slow on mips arch)
+// and uses 64-bit arithmetics to improve speed
+// taken from linux source code
+static uint16_t do_csum(const uint8_t * buff, size_t len)
+{
+	uint8_t odd;
+	size_t count;
+	uint64_t result,w,carry=0;
+	uint16_t u16;
+
+	if (!len) return 0;
+	odd = (uint8_t)(1 & (size_t)buff);
+	if (odd)
+	{
+		// any endian compatible
+		u16 = 0;
+		*((uint8_t*)&u16+1) = *buff;
+		result = u16;
+		len--;
+		buff++;
+	}
+	else
+		result = 0;
+	count = len >> 1;		/* nr of 16-bit words.. */
+	if (count)
+	{
+		if (2 & (size_t) buff)
+		{
+			result += *(uint16_t *) buff;
+			count--;
+			len -= 2;
+			buff += 2;
+		}
+		count >>= 1;		/* nr of 32-bit words.. */
+		if (count)
+		{
+			if (4 & (size_t) buff)
+			{
+				result += *(uint32_t *) buff;
+				count--;
+				len -= 4;
+				buff += 4;
+			}
+			count >>= 1;	/* nr of 64-bit words.. */
+			if (count)
+			{
+				do
+				{
+					w = *(uint64_t *) buff;
+					count--;
+					buff += 8;
+					result += carry;
+					result += w;
+					carry = (w > result);
+				} while (count);
+				result += carry;
+				result = (result & 0xffffffff) + (result >> 32);
+			}
+			if (len & 4)
+			{
+				result += *(uint32_t *) buff;
+				buff += 4;
+			}
+		}
+		if (len & 2)
+		{
+			result += *(uint16_t *) buff;
+			buff += 2;
+		}
+	}
+	if (len & 1)
+	{
+		// any endian compatible
+		u16 = 0;
+		*(uint8_t*)&u16 = *buff;
+		result += u16;
+	}
+	u16 = from64to16(result);
+	if (odd) u16 = ((u16 >> 8) & 0xff) | ((u16 & 0xff) << 8);
+	return u16;
+}
+
+uint16_t csum_partial(const void *buff, size_t len)
+{
+	return do_csum(buff,len);
+}
+
+uint16_t csum_tcpudp_magic(uint32_t saddr, uint32_t daddr, size_t len, uint8_t proto, uint16_t sum)
+{
+	return ~from64to16((uint64_t)saddr + daddr + sum + htonl(len+proto));
+}
+
+uint16_t ip4_compute_csum(const void *buff, size_t len)
+{
+	return ~from64to16(do_csum(buff,len));
+}
+void ip4_fix_checksum(struct ip *ip)
+{
+	ip->ip_sum = 0;
+	ip->ip_sum = ip4_compute_csum(ip, ip->ip_hl<<2);
+}
+
+uint16_t csum_ipv6_magic(const void *saddr, const void *daddr, size_t len, uint8_t proto, uint16_t sum)
+{
+	uint64_t a = (uint64_t)sum + htonl(len+proto) +
+			*(uint32_t*)saddr + *((uint32_t*)saddr+1) + *((uint32_t*)saddr+2) + *((uint32_t*)saddr+3) + 
+			*(uint32_t*)daddr + *((uint32_t*)daddr+1) + *((uint32_t*)daddr+2) + *((uint32_t*)daddr+3);
+	return ~from64to16(a);
+}
+
+
+void tcp4_fix_checksum(struct tcphdr *tcp,size_t len, const struct in_addr *src_addr, const struct in_addr *dest_addr)
+{
+	tcp->th_sum = 0;
+	tcp->th_sum = csum_tcpudp_magic(src_addr->s_addr,dest_addr->s_addr,len,IPPROTO_TCP,csum_partial(tcp,len));
+}
+void tcp6_fix_checksum(struct tcphdr *tcp,size_t len, const struct in6_addr *src_addr, const struct in6_addr *dest_addr)
+{
+	tcp->th_sum = 0;
+	tcp->th_sum = csum_ipv6_magic(src_addr,dest_addr,len,IPPROTO_TCP,csum_partial(tcp,len));
+}
+void tcp_fix_checksum(struct tcphdr *tcp,size_t len,const struct ip *ip,const struct ip6_hdr *ip6hdr)
+{
+	if (ip)
+		tcp4_fix_checksum(tcp, len, &ip->ip_src, &ip->ip_dst);
+	else if (ip6hdr)
+		tcp6_fix_checksum(tcp, len, &ip6hdr->ip6_src, &ip6hdr->ip6_dst);
+}
+
+void udp4_fix_checksum(struct udphdr *udp,size_t len, const struct in_addr *src_addr, const struct in_addr *dest_addr)
+{
+	udp->uh_sum = 0;
+	udp->uh_sum = csum_tcpudp_magic(src_addr->s_addr,dest_addr->s_addr,len,IPPROTO_UDP,csum_partial(udp,len));
+}
+void udp6_fix_checksum(struct udphdr *udp,size_t len, const struct in6_addr *src_addr, const struct in6_addr *dest_addr)
+{
+	udp->uh_sum = 0;
+	udp->uh_sum = csum_ipv6_magic(src_addr,dest_addr,len,IPPROTO_UDP,csum_partial(udp,len));
+}
+void udp_fix_checksum(struct udphdr *udp,size_t len,const struct ip *ip,const struct ip6_hdr *ip6hdr)
+{
+	if (ip)
+		udp4_fix_checksum(udp, len, &ip->ip_src, &ip->ip_dst);
+	else if (ip6hdr)
+		udp6_fix_checksum(udp, len, &ip6hdr->ip6_src, &ip6hdr->ip6_dst);
+}

nfq/checksum.h

@@ -0,0 +1,27 @@
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <sys/types.h>
+#include <netinet/in.h>
+
+#define __FAVOR_BSD
+#include <netinet/ip6.h>
+#include <netinet/ip.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+
+uint16_t csum_partial(const void *buff, size_t len);
+uint16_t csum_tcpudp_magic(uint32_t saddr, uint32_t daddr, size_t len, uint8_t proto, uint16_t sum);
+uint16_t csum_ipv6_magic(const void *saddr, const void *daddr, size_t len, uint8_t proto, uint16_t sum);
+
+uint16_t ip4_compute_csum(const void *buff, size_t len);
+void ip4_fix_checksum(struct ip *ip);
+
+void tcp4_fix_checksum(struct tcphdr *tcp,size_t len, const struct in_addr *src_addr, const struct in_addr *dest_addr);
+void tcp6_fix_checksum(struct tcphdr *tcp,size_t len, const struct in6_addr *src_addr, const struct in6_addr *dest_addr);
+void tcp_fix_checksum(struct tcphdr *tcp,size_t len,const struct ip *ip,const struct ip6_hdr *ip6hdr);
+
+void udp4_fix_checksum(struct udphdr *udp,size_t len, const struct in_addr *src_addr, const struct in_addr *dest_addr);
+void udp6_fix_checksum(struct udphdr *udp,size_t len, const struct in6_addr *src_addr, const struct in6_addr *dest_addr);
+void udp_fix_checksum(struct udphdr *udp,size_t len,const struct ip *ip,const struct ip6_hdr *ip6hdr);

nfq/conntrack.c

@@ -0,0 +1,405 @@
+#include "conntrack.h"
+#include "darkmagic.h"
+#include <arpa/inet.h>
+#include <stdio.h>
+
+#undef uthash_nonfatal_oom
+#define uthash_nonfatal_oom(elt) ut_oom_recover(elt)
+
+static bool oom = false;
+static void ut_oom_recover(void *elem)
+{
+	oom = true;
+}
+
+static const char *connstate_s[]={"SYN","ESTABLISHED","FIN"};
+
+static void connswap(const t_conn *c, t_conn *c2)
+{
+	memset(c2,0,sizeof(*c2));
+	c2->l3proto = c->l3proto;
+	c2->l4proto = c->l4proto;
+	c2->src = c->dst;
+	c2->dst = c->src;
+	c2->sport = c->dport;
+	c2->dport = c->sport;
+}
+
+void ConntrackClearHostname(t_ctrack *track)
+{
+	if (track->hostname)
+	{
+		free(track->hostname);
+		track->hostname = NULL;
+	}
+}
+static void ConntrackClearTrack(t_ctrack *track)
+{
+	ConntrackClearHostname(track);
+	ReasmClear(&track->reasm_orig);
+	rawpacket_queue_destroy(&track->delayed);
+}
+
+static void ConntrackFreeElem(t_conntrack_pool *elem)
+{
+	ConntrackClearTrack(&elem->track);
+	free(elem);
+}
+
+static void ConntrackPoolDestroyPool(t_conntrack_pool **pp)
+{
+	t_conntrack_pool *elem, *tmp;
+	HASH_ITER(hh, *pp, elem, tmp) { HASH_DEL(*pp, elem); ConntrackFreeElem(elem); }
+}
+void ConntrackPoolDestroy(t_conntrack *p)
+{
+	ConntrackPoolDestroyPool(&p->pool);
+}
+
+void ConntrackPoolInit(t_conntrack *p, time_t purge_interval, uint32_t timeout_syn, uint32_t timeout_established, uint32_t timeout_fin, uint32_t timeout_udp)
+{
+	p->timeout_syn = timeout_syn;
+	p->timeout_established = timeout_established;
+	p->timeout_fin = timeout_fin;
+	p->timeout_udp= timeout_udp;
+	p->t_purge_interval = purge_interval;
+	time(&p->t_last_purge);
+	p->pool = NULL;
+}
+
+void ConntrackExtractConn(t_conn *c, bool bReverse, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr)
+{
+	memset(c,0,sizeof(*c));
+	if (ip)
+	{
+		c->l3proto = IPPROTO_IP;
+		c->dst.ip = bReverse ? ip->ip_src : ip->ip_dst;
+		c->src.ip = bReverse ? ip->ip_dst : ip->ip_src;
+	}
+	else if (ip6)
+	{
+		c->l3proto = IPPROTO_IPV6;
+		c->dst.ip6 = bReverse ? ip6->ip6_src : ip6->ip6_dst;
+		c->src.ip6 = bReverse ? ip6->ip6_dst : ip6->ip6_src;
+	}
+	else
+		c->l3proto = -1;
+	extract_ports(tcphdr, udphdr, &c->l4proto, bReverse ? &c->dport : &c->sport, bReverse ? &c->sport : &c->dport);
+}
+
+
+static t_conntrack_pool *ConntrackPoolSearch(t_conntrack_pool *p, const t_conn *c)
+{
+	t_conntrack_pool *t;
+	HASH_FIND(hh, p, c, sizeof(*c), t);
+	return t;
+}
+
+static void ConntrackInitTrack(t_ctrack *t)
+{
+	memset(t,0,sizeof(*t));
+	t->scale_orig = t->scale_reply = SCALE_NONE;
+	time(&t->t_start);
+	rawpacket_queue_init(&t->delayed);
+}
+static void ConntrackReInitTrack(t_ctrack *t)
+{
+	ConntrackClearTrack(t);
+	ConntrackInitTrack(t);
+}
+
+static t_conntrack_pool *ConntrackNew(t_conntrack_pool **pp, const t_conn *c)
+{
+	t_conntrack_pool *ctnew;
+	if (!(ctnew = malloc(sizeof(*ctnew)))) return NULL;
+	ctnew->conn = *c;
+	oom = false;
+	HASH_ADD(hh, *pp, conn, sizeof(*c), ctnew);
+	if (oom) { free(ctnew); return NULL; }
+	ConntrackInitTrack(&ctnew->track);
+	return ctnew;
+}
+
+// non-tcp packets are passed with tcphdr=NULL but len_payload filled
+static void ConntrackFeedPacket(t_ctrack *t, bool bReverse, const struct tcphdr *tcphdr, uint32_t len_payload)
+{
+	uint8_t scale;
+
+	if (bReverse)
+	{
+		t->pcounter_reply++;
+		t->pdcounter_reply+=!!len_payload;
+		
+	}
+	else
+	{
+		t->pcounter_orig++;
+		t->pdcounter_orig+=!!len_payload;
+	}
+
+	if (tcphdr)
+	{
+		if (tcp_syn_segment(tcphdr))
+		{
+			if (t->state!=SYN) ConntrackReInitTrack(t); // erase current entry
+			t->seq0 = ntohl(tcphdr->th_seq);
+		}
+		else if (tcp_synack_segment(tcphdr))
+		{
+			if (t->state!=SYN) ConntrackReInitTrack(t); // erase current entry
+			if (!t->seq0) t->seq0 = ntohl(tcphdr->th_ack)-1;
+			t->ack0 = ntohl(tcphdr->th_seq);
+		}
+		else if (tcphdr->th_flags & (TH_FIN|TH_RST))
+		{
+			t->state = FIN;
+		}
+		else
+		{
+			if (t->state==SYN) 
+			{
+				t->state=ESTABLISHED;
+				if (!bReverse && !t->ack0) t->ack0 = ntohl(tcphdr->th_ack)-1;
+			}
+		}
+		scale = tcp_find_scale_factor(tcphdr);
+		if (bReverse)
+		{
+			t->pos_orig = t->seq_last = ntohl(tcphdr->th_ack);
+			t->ack_last = ntohl(tcphdr->th_seq);
+			t->pos_reply = t->ack_last + len_payload;
+			t->winsize_reply = ntohs(tcphdr->th_win);
+			if (scale!=SCALE_NONE) t->scale_reply = scale;
+			
+		}
+		else
+		{
+			t->seq_last = ntohl(tcphdr->th_seq);
+			t->pos_orig = t->seq_last + len_payload;
+			t->pos_reply = t->ack_last = ntohl(tcphdr->th_ack);
+			t->winsize_orig = ntohs(tcphdr->th_win);
+			if (scale!=SCALE_NONE) t->scale_orig = scale;
+		}
+	}
+	else
+	{
+		if (bReverse)
+		{
+			t->ack_last=t->pos_reply;
+			t->pos_reply+=len_payload;
+		}
+		else
+		{
+			t->seq_last=t->pos_orig;
+			t->pos_orig+=len_payload;
+		}
+	}
+
+	time(&t->t_last);
+}
+
+static bool ConntrackPoolDoubleSearchPool(t_conntrack_pool **pp, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr, t_ctrack **ctrack, bool *bReverse)
+{
+	t_conn conn,connswp;
+	t_conntrack_pool *ctr;
+
+	ConntrackExtractConn(&conn,false,ip,ip6,tcphdr,udphdr);
+	if ((ctr=ConntrackPoolSearch(*pp,&conn)))
+	{
+		if (bReverse) *bReverse = false;
+		if (ctrack) *ctrack = &ctr->track;
+		return true;
+	}
+	else
+	{
+		connswap(&conn,&connswp);
+		if ((ctr=ConntrackPoolSearch(*pp,&connswp)))
+		{
+			if (bReverse) *bReverse = true;
+			if (ctrack) *ctrack = &ctr->track;
+			return true;
+		}
+	}
+	return false;
+}
+bool ConntrackPoolDoubleSearch(t_conntrack *p, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr, t_ctrack **ctrack, bool *bReverse)
+{
+	return ConntrackPoolDoubleSearchPool(&p->pool, ip, ip6, tcphdr, udphdr, ctrack, bReverse);
+}
+
+static bool ConntrackPoolFeedPool(t_conntrack_pool **pp, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr, size_t len_payload, t_ctrack **ctrack, bool *bReverse)
+{
+	t_conn conn, connswp;
+	t_conntrack_pool *ctr;
+	bool b_rev;
+
+	ConntrackExtractConn(&conn,false,ip,ip6,tcphdr,udphdr);
+	if ((ctr=ConntrackPoolSearch(*pp,&conn)))
+	{
+		ConntrackFeedPacket(&ctr->track, (b_rev=false), tcphdr, len_payload);
+		goto ok;
+	}
+	else
+	{
+		connswap(&conn,&connswp);
+		if ((ctr=ConntrackPoolSearch(*pp,&connswp)))
+		{
+			ConntrackFeedPacket(&ctr->track, (b_rev=true), tcphdr, len_payload);
+			goto ok;
+		}
+	}
+	b_rev = tcphdr && tcp_synack_segment(tcphdr);
+	if ((tcphdr && tcp_syn_segment(tcphdr)) || b_rev || udphdr)
+	{
+		if ((ctr=ConntrackNew(pp, b_rev ? &connswp : &conn)))
+		{
+			ConntrackFeedPacket(&ctr->track, b_rev, tcphdr, len_payload);
+			goto ok;
+		}
+	}
+	return false;
+ok:
+	if (ctrack) *ctrack = &ctr->track;
+	if (bReverse) *bReverse = b_rev;
+	return true;
+}
+bool ConntrackPoolFeed(t_conntrack *p, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr, size_t len_payload, t_ctrack **ctrack, bool *bReverse)
+{
+	return ConntrackPoolFeedPool(&p->pool,ip,ip6,tcphdr,udphdr,len_payload,ctrack,bReverse);
+}
+
+static bool ConntrackPoolDropPool(t_conntrack_pool **pp, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr)
+{
+	t_conn conn, connswp;
+	t_conntrack_pool *t;
+	ConntrackExtractConn(&conn,false,ip,ip6,tcphdr,udphdr);
+	if (!(t=ConntrackPoolSearch(*pp,&conn)))
+	{
+		connswap(&conn,&connswp);
+		t=ConntrackPoolSearch(*pp,&connswp);
+	}
+	if (!t) return false;
+	HASH_DEL(*pp, t); ConntrackFreeElem(t);
+	return true;
+}
+bool ConntrackPoolDrop(t_conntrack *p, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr)
+{
+	return ConntrackPoolDropPool(&p->pool,ip,ip6,tcphdr,udphdr);
+}
+
+void ConntrackPoolPurge(t_conntrack *p)
+{
+	time_t tidle, tnow = time(NULL);
+	t_conntrack_pool *t, *tmp;
+
+	if ((tnow - p->t_last_purge)>=p->t_purge_interval)
+	{
+		HASH_ITER(hh, p->pool , t, tmp) {
+			tidle = tnow - t->track.t_last;
+			if (	t->track.b_cutoff ||
+				(t->conn.l4proto==IPPROTO_TCP && (
+					(t->track.state==SYN && tidle>=p->timeout_syn) ||
+					(t->track.state==ESTABLISHED && tidle>=p->timeout_established) ||
+					(t->track.state==FIN && tidle>=p->timeout_fin))
+				) || (t->conn.l4proto==IPPROTO_UDP && tidle>=p->timeout_udp)
+			)
+			{
+				HASH_DEL(p->pool, t); ConntrackFreeElem(t); 
+			}
+		}
+		p->t_last_purge = tnow;
+	}
+}
+
+static void taddr2str(uint8_t l3proto, const t_addr *a, char *buf, size_t bufsize)
+{
+	if (!inet_ntop(family_from_proto(l3proto), a, buf, bufsize) && bufsize) *buf=0;
+}
+
+static const char *ConntrackProtoName(t_l7proto proto)
+{
+	switch(proto)
+	{
+		case HTTP: return "HTTP";
+		case TLS: return "TLS";
+		case QUIC: return "QUIC";
+		case WIREGUARD: return "WIREGUARD";
+		case DHT: return "DHT";
+		default: return "UNKNOWN";
+	}
+}
+void ConntrackPoolDump(const t_conntrack *p)
+{
+	t_conntrack_pool *t, *tmp;
+	char sa1[40],sa2[40];
+	time_t tnow = time(NULL);
+	HASH_ITER(hh, p->pool, t, tmp) {
+		taddr2str(t->conn.l3proto, &t->conn.src, sa1, sizeof(sa1));
+		taddr2str(t->conn.l3proto, &t->conn.dst, sa2, sizeof(sa2));
+		printf("%s [%s]:%u => [%s]:%u : %s : t0=%llu last=t0+%llu now=last+%llu packets_orig=d%llu/n%llu packets_reply=d%llu/n%llu ",
+			proto_name(t->conn.l4proto),
+			sa1, t->conn.sport, sa2, t->conn.dport,
+			t->conn.l4proto==IPPROTO_TCP ? connstate_s[t->track.state] : "-",
+			(unsigned long long)t->track.t_start, (unsigned long long)(t->track.t_last - t->track.t_start), (unsigned long long)(tnow - t->track.t_last),
+			(unsigned long long)t->track.pdcounter_orig, (unsigned long long)t->track.pcounter_orig,
+			(unsigned long long)t->track.pdcounter_reply, (unsigned long long)t->track.pcounter_reply);
+		if (t->conn.l4proto==IPPROTO_TCP)
+			printf("seq0=%u rseq=%u pos_orig=%u ack0=%u rack=%u pos_reply=%u wsize_orig=%u:%d wsize_reply=%u:%d",
+				t->track.seq0, t->track.seq_last - t->track.seq0, t->track.pos_orig - t->track.seq0,
+				t->track.ack0, t->track.ack_last - t->track.ack0, t->track.pos_reply - t->track.ack0,
+				t->track.winsize_orig, t->track.scale_orig==SCALE_NONE ? -1 : t->track.scale_orig,
+				t->track.winsize_reply, t->track.scale_reply==SCALE_NONE ? -1 : t->track.scale_reply);
+		else
+			printf("rseq=%u pos_orig=%u rack=%u pos_reply=%u",
+				t->track.seq_last, t->track.pos_orig,
+				t->track.ack_last, t->track.pos_reply);
+		printf(" req_retrans=%u cutoff=%u wss_cutoff=%u d_cutoff=%u hostname=%s l7proto=%s\n",
+			t->track.req_retrans_counter, t->track.b_cutoff, t->track.b_wssize_cutoff, t->track.b_desync_cutoff, t->track.hostname, ConntrackProtoName(t->track.l7proto));
+	};
+}
+
+
+void ReasmClear(t_reassemble *reasm)
+{
+	if (reasm->packet)
+	{
+		free(reasm->packet);
+		reasm->packet = NULL;
+	}
+	reasm->size = reasm->size_present = 0;
+}
+bool ReasmInit(t_reassemble *reasm, size_t size_requested, uint32_t seq_start)
+{
+	reasm->packet = malloc(size_requested);
+	if (!reasm->packet) return false;
+	reasm->size = size_requested;
+	reasm->size_present = 0;
+	reasm->seq = seq_start;
+	return true;
+}
+bool ReasmResize(t_reassemble *reasm, size_t new_size)
+{
+	uint8_t *p = realloc(reasm->packet, new_size);
+	if (!p) return false;
+	reasm->packet = p;
+	reasm->size = new_size;
+	if (reasm->size_present > new_size) reasm->size_present = new_size;
+	return true;
+}
+bool ReasmFeed(t_reassemble *reasm, uint32_t seq, const void *payload, size_t len)
+{
+	if (reasm->seq!=seq) return false; // fail session if out of sequence
+	
+	size_t szcopy;
+	szcopy = reasm->size - reasm->size_present;
+	if (len<szcopy) szcopy = len;
+	memcpy(reasm->packet + reasm->size_present, payload, szcopy);
+	reasm->size_present += szcopy;
+	reasm->seq += (uint32_t)szcopy;
+
+	return true;
+}
+bool ReasmHasSpace(t_reassemble *reasm, size_t len)
+{
+	return (reasm->size_present+len)<=reasm->size;
+}

nfq/conntrack.h

@@ -0,0 +1,125 @@
+#pragma once
+
+
+// this conntrack is not bullet-proof
+// its designed to satisfy dpi desync needs only
+
+#include "packet_queue.h"
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <ctype.h>
+#include <sys/types.h>
+#include <time.h>
+#include <netinet/in.h>
+
+#define __FAVOR_BSD
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+
+
+//#define HASH_BLOOM 20
+#define HASH_NONFATAL_OOM 1
+#undef HASH_FUNCTION
+#define HASH_FUNCTION HASH_BER
+#include "uthash.h"
+
+#define RETRANS_COUNTER_STOP ((uint8_t)-1)
+
+typedef union {
+	struct in_addr ip;
+	struct in6_addr ip6;
+} t_addr;
+typedef struct
+{
+	t_addr src, dst;
+	uint16_t sport,dport;
+	uint8_t	l3proto; // IPPROTO_IP, IPPROTO_IPV6
+	uint8_t l4proto; // IPPROTO_TCP, IPPROTO_UDP
+} t_conn;
+
+// this structure helps to reassemble continuous packets streams. it does not support out-of-orders
+typedef struct {
+	uint8_t *packet;		// allocated for size during reassemble request. requestor must know the message size.
+	uint32_t seq;			// current seq number. if a packet comes with an unexpected seq - it fails reassemble session.
+	size_t size;			// expected message size. success means that we have received exactly 'size' bytes and have them in 'packet'
+	size_t size_present;		// how many bytes already stored in 'packet'
+} t_reassemble;
+
+// SYN - SYN or SYN/ACK received
+// ESTABLISHED - any except SYN or SYN/ACK received
+// FIN - FIN or RST received
+typedef enum {SYN=0, ESTABLISHED, FIN} t_connstate;
+typedef enum {UNKNOWN=0, HTTP, TLS, QUIC, WIREGUARD, DHT} t_l7proto;
+typedef struct
+{
+	struct desync_profile *dp;		// desync profile cache
+	bool dp_search_complete;
+	bool bCheckDone, bCheckResult, bCheckExcluded; // hostlist check result cache
+
+	// common state
+	time_t t_start, t_last;
+	uint64_t pcounter_orig, pcounter_reply;	// packet counter
+	uint64_t pdcounter_orig, pdcounter_reply; // data packet counter (with payload)
+	uint32_t pos_orig, pos_reply;		// TCP: seq_last+payload, ack_last+payload  UDP: sum of all seen payload lenghts including current
+	uint32_t seq_last, ack_last;		// TCP: last seen seq and ack  UDP: sum of all seen payload lenghts NOT including current
+
+	// tcp only state, not used in udp
+	t_connstate state;
+	uint32_t seq0, ack0;			// starting seq and ack
+	uint16_t winsize_orig, winsize_reply;	// last seen window size
+	uint8_t scale_orig, scale_reply;	// last seen window scale factor. SCALE_NONE if none
+	
+	uint8_t req_retrans_counter;		// number of request retransmissions
+	bool req_seq_present,req_seq_finalized,req_seq_abandoned;
+	uint32_t req_seq_start,req_seq_end;	// sequence interval of the request (to track retransmissions)
+
+	uint8_t autottl;
+
+	bool b_cutoff;				// mark for deletion
+	bool b_wssize_cutoff, b_desync_cutoff;
+
+	t_l7proto l7proto;
+	char *hostname;
+	bool hostname_ah_check;			// should perform autohostlist checks
+	
+	t_reassemble reasm_orig;
+	struct rawpacket_tailhead delayed;
+} t_ctrack;
+
+typedef struct
+{
+	t_ctrack track;
+	UT_hash_handle hh;	// makes this structure hashable
+	t_conn conn;		// key
+} t_conntrack_pool;
+typedef struct
+{
+	// inactivity time to purge an entry in each connection state
+	uint32_t timeout_syn,timeout_established,timeout_fin,timeout_udp;
+	time_t t_purge_interval, t_last_purge;
+	t_conntrack_pool *pool;
+} t_conntrack;
+
+void ConntrackPoolInit(t_conntrack *p, time_t purge_interval, uint32_t timeout_syn, uint32_t timeout_established, uint32_t timeout_fin, uint32_t timeout_udp);
+void ConntrackPoolDestroy(t_conntrack *p);
+bool ConntrackPoolFeed(t_conntrack *p, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr, size_t len_payload, t_ctrack **ctrack, bool *bReverse);
+// do not create, do not update. only find existing
+bool ConntrackPoolDoubleSearch(t_conntrack *p, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr, t_ctrack **ctrack, bool *bReverse);
+bool ConntrackPoolDrop(t_conntrack *p, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr);
+void CaonntrackExtractConn(t_conn *c, bool bReverse, const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcphdr, const struct udphdr *udphdr);
+void ConntrackPoolDump(const t_conntrack *p);
+void ConntrackPoolPurge(t_conntrack *p);
+void ConntrackClearHostname(t_ctrack *track);
+
+bool ReasmInit(t_reassemble *reasm, size_t size_requested, uint32_t seq_start);
+bool ReasmResize(t_reassemble *reasm, size_t new_size);
+void ReasmClear(t_reassemble *reasm);
+// false means reassemble session has failed and we should ReasmClear() it
+bool ReasmFeed(t_reassemble *reasm, uint32_t seq, const void *payload, size_t len);
+// check if it has enough space to buffer 'len' bytes
+bool ReasmHasSpace(t_reassemble *reasm, size_t len);
+inline static bool ReasmIsEmpty(t_reassemble *reasm) {return !reasm->size;}
+inline static bool ReasmIsFull(t_reassemble *reasm) {return !ReasmIsEmpty(reasm) && (reasm->size==reasm->size_present);}

nfq/crypto/aes-gcm.c

@@ -0,0 +1,13 @@
+#include "aes-gcm.h"
+
+int aes_gcm_crypt(int mode, uint8_t *output, const uint8_t *input, size_t input_length, const uint8_t *key, const size_t key_len, const uint8_t *iv, const size_t iv_len, const uint8_t *adata, size_t adata_len, uint8_t *atag, size_t atag_len)
+{
+	int ret = 0;
+	gcm_context ctx;
+
+	gcm_setkey(&ctx, key, (const uint)key_len);
+	ret = gcm_crypt_and_tag(&ctx, mode, iv, iv_len, adata, adata_len, input, output, input_length, atag, atag_len);
+	gcm_zero_ctx(&ctx);
+
+	return ret;
+}

nfq/crypto/aes-gcm.h

@@ -0,0 +1,6 @@
+#pragma once
+
+#include "gcm.h"  
+
+// mode : AES_ENCRYPT, AES_DECRYPT
+int aes_gcm_crypt(int mode, uint8_t *output, const uint8_t *input, size_t input_length, const uint8_t *key, const size_t key_len, const uint8_t *iv, const size_t iv_len, const uint8_t *adata, size_t adata_len, uint8_t *atag, size_t atag_len);

nfq/crypto/aes.c

@@ -0,0 +1,483 @@
+/******************************************************************************
+*
+* THIS SOURCE CODE IS HEREBY PLACED INTO THE PUBLIC DOMAIN FOR THE GOOD OF ALL
+*
+* This is a simple and straightforward implementation of the AES Rijndael
+* 128-bit block cipher designed by Vincent Rijmen and Joan Daemen. The focus
+* of this work was correctness & accuracy.  It is written in 'C' without any
+* particular focus upon optimization or speed. It should be endian (memory
+* byte order) neutral since the few places that care are handled explicitly.
+*
+* This implementation of Rijndael was created by Steven M. Gibson of GRC.com.
+*
+* It is intended for general purpose use, but was written in support of GRC's
+* reference implementation of the SQRL (Secure Quick Reliable Login) client.
+*
+* See:    http://csrc.nist.gov/archive/aes/rijndael/wsdindex.html
+*
+* NO COPYRIGHT IS CLAIMED IN THIS WORK, HOWEVER, NEITHER IS ANY WARRANTY MADE
+* REGARDING ITS FITNESS FOR ANY PARTICULAR PURPOSE. USE IT AT YOUR OWN RISK.
+*
+*******************************************************************************/
+
+#include "aes.h"
+
+static int aes_tables_inited = 0;   // run-once flag for performing key
+									// expasion table generation (see below)
+/*
+ *  The following static local tables must be filled-in before the first use of
+ *  the GCM or AES ciphers. They are used for the AES key expansion/scheduling
+ *  and once built are read-only and thread safe. The "gcm_initialize" function
+ *  must be called once during system initialization to populate these arrays
+ *  for subsequent use by the AES key scheduler. If they have not been built
+ *  before attempted use, an error will be returned to the caller.
+ *
+ *  NOTE: GCM Encryption/Decryption does NOT REQUIRE AES decryption. Since
+ *  GCM uses AES in counter-mode, where the AES cipher output is XORed with
+ *  the GCM input, we ONLY NEED AES encryption.  Thus, to save space AES
+ *  decryption is typically disabled by setting AES_DECRYPTION to 0 in aes.h.
+ */
+ // We always need our forward tables
+static uchar FSb[256];      // Forward substitution box (FSb)
+static uint32_t FT0[256];   // Forward key schedule assembly tables
+static uint32_t FT1[256];
+static uint32_t FT2[256];
+static uint32_t FT3[256];
+
+#if AES_DECRYPTION          // We ONLY need reverse for decryption
+static uchar RSb[256];      // Reverse substitution box (RSb)
+static uint32_t RT0[256];   // Reverse key schedule assembly tables
+static uint32_t RT1[256];
+static uint32_t RT2[256];
+static uint32_t RT3[256];
+#endif                      /* AES_DECRYPTION */
+
+static uint32_t RCON[10];   // AES round constants
+
+/*
+ * Platform Endianness Neutralizing Load and Store Macro definitions
+ * AES wants platform-neutral Little Endian (LE) byte ordering
+ */
+#define GET_UINT32_LE(n,b,i) {                  \
+    (n) = ( (uint32_t) (b)[(i)    ]       )     \
+        | ( (uint32_t) (b)[(i) + 1] <<  8 )     \
+        | ( (uint32_t) (b)[(i) + 2] << 16 )     \
+        | ( (uint32_t) (b)[(i) + 3] << 24 ); }
+
+#define PUT_UINT32_LE(n,b,i) {                  \
+    (b)[(i)    ] = (uchar) ( (n)       );       \
+    (b)[(i) + 1] = (uchar) ( (n) >>  8 );       \
+    (b)[(i) + 2] = (uchar) ( (n) >> 16 );       \
+    (b)[(i) + 3] = (uchar) ( (n) >> 24 ); }
+
+ /*
+  *  AES forward and reverse encryption round processing macros
+  */
+#define AES_FROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)     \
+{                                               \
+    X0 = *RK++ ^ FT0[ ( Y0       ) & 0xFF ] ^   \
+                 FT1[ ( Y1 >>  8 ) & 0xFF ] ^   \
+                 FT2[ ( Y2 >> 16 ) & 0xFF ] ^   \
+                 FT3[ ( Y3 >> 24 ) & 0xFF ];    \
+                                                \
+    X1 = *RK++ ^ FT0[ ( Y1       ) & 0xFF ] ^   \
+                 FT1[ ( Y2 >>  8 ) & 0xFF ] ^   \
+                 FT2[ ( Y3 >> 16 ) & 0xFF ] ^   \
+                 FT3[ ( Y0 >> 24 ) & 0xFF ];    \
+                                                \
+    X2 = *RK++ ^ FT0[ ( Y2       ) & 0xFF ] ^   \
+                 FT1[ ( Y3 >>  8 ) & 0xFF ] ^   \
+                 FT2[ ( Y0 >> 16 ) & 0xFF ] ^   \
+                 FT3[ ( Y1 >> 24 ) & 0xFF ];    \
+                                                \
+    X3 = *RK++ ^ FT0[ ( Y3       ) & 0xFF ] ^   \
+                 FT1[ ( Y0 >>  8 ) & 0xFF ] ^   \
+                 FT2[ ( Y1 >> 16 ) & 0xFF ] ^   \
+                 FT3[ ( Y2 >> 24 ) & 0xFF ];    \
+}
+
+#define AES_RROUND(X0,X1,X2,X3,Y0,Y1,Y2,Y3)     \
+{                                               \
+    X0 = *RK++ ^ RT0[ ( Y0       ) & 0xFF ] ^   \
+                 RT1[ ( Y3 >>  8 ) & 0xFF ] ^   \
+                 RT2[ ( Y2 >> 16 ) & 0xFF ] ^   \
+                 RT3[ ( Y1 >> 24 ) & 0xFF ];    \
+                                                \
+    X1 = *RK++ ^ RT0[ ( Y1       ) & 0xFF ] ^   \
+                 RT1[ ( Y0 >>  8 ) & 0xFF ] ^   \
+                 RT2[ ( Y3 >> 16 ) & 0xFF ] ^   \
+                 RT3[ ( Y2 >> 24 ) & 0xFF ];    \
+                                                \
+    X2 = *RK++ ^ RT0[ ( Y2       ) & 0xFF ] ^   \
+                 RT1[ ( Y1 >>  8 ) & 0xFF ] ^   \
+                 RT2[ ( Y0 >> 16 ) & 0xFF ] ^   \
+                 RT3[ ( Y3 >> 24 ) & 0xFF ];    \
+                                                \
+    X3 = *RK++ ^ RT0[ ( Y3       ) & 0xFF ] ^   \
+                 RT1[ ( Y2 >>  8 ) & 0xFF ] ^   \
+                 RT2[ ( Y1 >> 16 ) & 0xFF ] ^   \
+                 RT3[ ( Y0 >> 24 ) & 0xFF ];    \
+}
+
+  /*
+   *  These macros improve the readability of the key
+   *  generation initialization code by collapsing
+   *  repetitive common operations into logical pieces.
+   */
+#define ROTL8(x) ( ( x << 8 ) & 0xFFFFFFFF ) | ( x >> 24 )
+#define XTIME(x) ( ( x << 1 ) ^ ( ( x & 0x80 ) ? 0x1B : 0x00 ) )
+#define MUL(x,y) ( ( x && y ) ? pow[(log[x]+log[y]) % 255] : 0 )
+#define MIX(x,y) { y = ( (y << 1) | (y >> 7) ) & 0xFF; x ^= y; }
+#define CPY128   { *RK++ = *SK++; *RK++ = *SK++; \
+                   *RK++ = *SK++; *RK++ = *SK++; }
+
+   /******************************************************************************
+	*
+	*  AES_INIT_KEYGEN_TABLES
+	*
+	*  Fills the AES key expansion tables allocated above with their static
+	*  data. This is not "per key" data, but static system-wide read-only
+	*  table data. THIS FUNCTION IS NOT THREAD SAFE. It must be called once
+	*  at system initialization to setup the tables for all subsequent use.
+	*
+	******************************************************************************/
+void aes_init_keygen_tables(void)
+{
+	int i, x, y, z;     // general purpose iteration and computation locals
+	int pow[256];
+	int log[256];
+
+	if (aes_tables_inited) return;
+
+	// fill the 'pow' and 'log' tables over GF(2^8)
+	for (i = 0, x = 1; i < 256; i++) {
+		pow[i] = x;
+		log[x] = i;
+		x = (x ^ XTIME(x)) & 0xFF;
+	}
+	// compute the round constants
+	for (i = 0, x = 1; i < 10; i++) {
+		RCON[i] = (uint32_t)x;
+		x = XTIME(x) & 0xFF;
+	}
+	// fill the forward and reverse substitution boxes
+	FSb[0x00] = 0x63;
+#if AES_DECRYPTION  // whether AES decryption is supported
+	RSb[0x63] = 0x00;
+#endif /* AES_DECRYPTION */
+
+	for (i = 1; i < 256; i++) {
+		x = y = pow[255 - log[i]];
+		MIX(x, y);
+		MIX(x, y);
+		MIX(x, y);
+		MIX(x, y);
+		FSb[i] = (uchar)(x ^= 0x63);
+#if AES_DECRYPTION  // whether AES decryption is supported
+		RSb[x] = (uchar)i;
+#endif /* AES_DECRYPTION */
+
+	}
+	// generate the forward and reverse key expansion tables
+	for (i = 0; i < 256; i++) {
+		x = FSb[i];
+		y = XTIME(x) & 0xFF;
+		z = (y ^ x) & 0xFF;
+
+		FT0[i] = ((uint32_t)y) ^ ((uint32_t)x << 8) ^
+			((uint32_t)x << 16) ^ ((uint32_t)z << 24);
+
+		FT1[i] = ROTL8(FT0[i]);
+		FT2[i] = ROTL8(FT1[i]);
+		FT3[i] = ROTL8(FT2[i]);
+
+#if AES_DECRYPTION  // whether AES decryption is supported
+		x = RSb[i];
+
+		RT0[i] = ((uint32_t)MUL(0x0E, x)) ^
+			((uint32_t)MUL(0x09, x) << 8) ^
+			((uint32_t)MUL(0x0D, x) << 16) ^
+			((uint32_t)MUL(0x0B, x) << 24);
+
+		RT1[i] = ROTL8(RT0[i]);
+		RT2[i] = ROTL8(RT1[i]);
+		RT3[i] = ROTL8(RT2[i]);
+#endif /* AES_DECRYPTION */
+	}
+	aes_tables_inited = 1;  // flag that the tables have been generated
+}                           // to permit subsequent use of the AES cipher
+
+/******************************************************************************
+ *
+ *  AES_SET_ENCRYPTION_KEY
+ *
+ *  This is called by 'aes_setkey' when we're establishing a key for
+ *  subsequent encryption.  We give it a pointer to the encryption
+ *  context, a pointer to the key, and the key's length in bytes.
+ *  Valid lengths are: 16, 24 or 32 bytes (128, 192, 256 bits).
+ *
+ ******************************************************************************/
+int aes_set_encryption_key(aes_context *ctx,
+	const uchar *key,
+	uint keysize)
+{
+	uint i;                 // general purpose iteration local
+	uint32_t *RK = ctx->rk; // initialize our RoundKey buffer pointer
+
+	for (i = 0; i < (keysize >> 2); i++) {
+		GET_UINT32_LE(RK[i], key, i << 2);
+	}
+
+	switch (ctx->rounds)
+	{
+	case 10:
+		for (i = 0; i < 10; i++, RK += 4) {
+			RK[4] = RK[0] ^ RCON[i] ^
+				((uint32_t)FSb[(RK[3] >> 8) & 0xFF]) ^
+				((uint32_t)FSb[(RK[3] >> 16) & 0xFF] << 8) ^
+				((uint32_t)FSb[(RK[3] >> 24) & 0xFF] << 16) ^
+				((uint32_t)FSb[(RK[3]) & 0xFF] << 24);
+
+			RK[5] = RK[1] ^ RK[4];
+			RK[6] = RK[2] ^ RK[5];
+			RK[7] = RK[3] ^ RK[6];
+		}
+		break;
+
+	case 12:
+		for (i = 0; i < 8; i++, RK += 6) {
+			RK[6] = RK[0] ^ RCON[i] ^
+				((uint32_t)FSb[(RK[5] >> 8) & 0xFF]) ^
+				((uint32_t)FSb[(RK[5] >> 16) & 0xFF] << 8) ^
+				((uint32_t)FSb[(RK[5] >> 24) & 0xFF] << 16) ^
+				((uint32_t)FSb[(RK[5]) & 0xFF] << 24);
+
+			RK[7] = RK[1] ^ RK[6];
+			RK[8] = RK[2] ^ RK[7];
+			RK[9] = RK[3] ^ RK[8];
+			RK[10] = RK[4] ^ RK[9];
+			RK[11] = RK[5] ^ RK[10];
+		}
+		break;
+
+	case 14:
+		for (i = 0; i < 7; i++, RK += 8) {
+			RK[8] = RK[0] ^ RCON[i] ^
+				((uint32_t)FSb[(RK[7] >> 8) & 0xFF]) ^
+				((uint32_t)FSb[(RK[7] >> 16) & 0xFF] << 8) ^
+				((uint32_t)FSb[(RK[7] >> 24) & 0xFF] << 16) ^
+				((uint32_t)FSb[(RK[7]) & 0xFF] << 24);
+
+			RK[9] = RK[1] ^ RK[8];
+			RK[10] = RK[2] ^ RK[9];
+			RK[11] = RK[3] ^ RK[10];
+
+			RK[12] = RK[4] ^
+				((uint32_t)FSb[(RK[11]) & 0xFF]) ^
+				((uint32_t)FSb[(RK[11] >> 8) & 0xFF] << 8) ^
+				((uint32_t)FSb[(RK[11] >> 16) & 0xFF] << 16) ^
+				((uint32_t)FSb[(RK[11] >> 24) & 0xFF] << 24);
+
+			RK[13] = RK[5] ^ RK[12];
+			RK[14] = RK[6] ^ RK[13];
+			RK[15] = RK[7] ^ RK[14];
+		}
+		break;
+
+	default:
+		return -1;
+	}
+	return(0);
+}
+
+#if AES_DECRYPTION  // whether AES decryption is supported
+
+/******************************************************************************
+ *
+ *  AES_SET_DECRYPTION_KEY
+ *
+ *  This is called by 'aes_setkey' when we're establishing a
+ *  key for subsequent decryption.  We give it a pointer to
+ *  the encryption context, a pointer to the key, and the key's
+ *  length in bits. Valid lengths are: 128, 192, or 256 bits.
+ *
+ ******************************************************************************/
+int aes_set_decryption_key(aes_context *ctx,
+	const uchar *key,
+	uint keysize)
+{
+	int i, j;
+	aes_context cty;            // a calling aes context for set_encryption_key
+	uint32_t *RK = ctx->rk;     // initialize our RoundKey buffer pointer
+	uint32_t *SK;
+	int ret;
+
+	cty.rounds = ctx->rounds;   // initialize our local aes context
+	cty.rk = cty.buf;           // round count and key buf pointer
+
+	if ((ret = aes_set_encryption_key(&cty, key, keysize)) != 0)
+		return(ret);
+
+	SK = cty.rk + cty.rounds * 4;
+
+	CPY128  // copy a 128-bit block from *SK to *RK
+
+		for (i = ctx->rounds - 1, SK -= 8; i > 0; i--, SK -= 8) {
+			for (j = 0; j < 4; j++, SK++) {
+				*RK++ = RT0[FSb[(*SK) & 0xFF]] ^
+					RT1[FSb[(*SK >> 8) & 0xFF]] ^
+					RT2[FSb[(*SK >> 16) & 0xFF]] ^
+					RT3[FSb[(*SK >> 24) & 0xFF]];
+			}
+		}
+	CPY128  // copy a 128-bit block from *SK to *RK
+		memset(&cty, 0, sizeof(aes_context));   // clear local aes context
+	return(0);
+}
+
+#endif /* AES_DECRYPTION */
+
+/******************************************************************************
+ *
+ *  AES_SETKEY
+ *
+ *  Invoked to establish the key schedule for subsequent encryption/decryption
+ *
+ ******************************************************************************/
+int aes_setkey(aes_context *ctx,   // AES context provided by our caller
+	int mode,           // ENCRYPT or DECRYPT flag
+	const uchar *key,   // pointer to the key
+	uint keysize)      // key length in bytes
+{
+	// since table initialization is not thread safe, we could either add
+	// system-specific mutexes and init the AES key generation tables on
+	// demand, or ask the developer to simply call "gcm_initialize" once during
+	// application startup before threading begins. That's what we choose.
+	if (!aes_tables_inited) return (-1);  // fail the call when not inited.
+
+	ctx->mode = mode;       // capture the key type we're creating
+	ctx->rk = ctx->buf;     // initialize our round key pointer
+
+	switch (keysize)       // set the rounds count based upon the keysize
+	{
+	case 16: ctx->rounds = 10; break;   // 16-byte, 128-bit key
+	case 24: ctx->rounds = 12; break;   // 24-byte, 192-bit key
+	case 32: ctx->rounds = 14; break;   // 32-byte, 256-bit key
+	default: return(-1);
+	}
+
+#if AES_DECRYPTION
+	if (mode == DECRYPT)   // expand our key for encryption or decryption
+		return(aes_set_decryption_key(ctx, key, keysize));
+	else     /* ENCRYPT */
+#endif /* AES_DECRYPTION */
+		return(aes_set_encryption_key(ctx, key, keysize));
+}
+
+/******************************************************************************
+ *
+ *  AES_CIPHER
+ *
+ *  Perform AES encryption and decryption.
+ *  The AES context will have been setup with the encryption mode
+ *  and all keying information appropriate for the task.
+ *
+ ******************************************************************************/
+int aes_cipher(aes_context *ctx,
+	const uchar input[16],
+	uchar output[16])
+{
+	int i;
+	uint32_t *RK, X0, X1, X2, X3, Y0, Y1, Y2, Y3;   // general purpose locals
+
+	RK = ctx->rk;
+
+	GET_UINT32_LE(X0, input, 0); X0 ^= *RK++;    // load our 128-bit
+	GET_UINT32_LE(X1, input, 4); X1 ^= *RK++;    // input buffer in a storage
+	GET_UINT32_LE(X2, input, 8); X2 ^= *RK++;    // memory endian-neutral way
+	GET_UINT32_LE(X3, input, 12); X3 ^= *RK++;
+
+#if AES_DECRYPTION  // whether AES decryption is supported
+
+	if (ctx->mode == DECRYPT)
+	{
+		for (i = (ctx->rounds >> 1) - 1; i > 0; i--)
+		{
+			AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);
+			AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);
+		}
+
+		AES_RROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);
+
+		X0 = *RK++ ^ \
+			((uint32_t)RSb[(Y0) & 0xFF]) ^
+			((uint32_t)RSb[(Y3 >> 8) & 0xFF] << 8) ^
+			((uint32_t)RSb[(Y2 >> 16) & 0xFF] << 16) ^
+			((uint32_t)RSb[(Y1 >> 24) & 0xFF] << 24);
+
+		X1 = *RK++ ^ \
+			((uint32_t)RSb[(Y1) & 0xFF]) ^
+			((uint32_t)RSb[(Y0 >> 8) & 0xFF] << 8) ^
+			((uint32_t)RSb[(Y3 >> 16) & 0xFF] << 16) ^
+			((uint32_t)RSb[(Y2 >> 24) & 0xFF] << 24);
+
+		X2 = *RK++ ^ \
+			((uint32_t)RSb[(Y2) & 0xFF]) ^
+			((uint32_t)RSb[(Y1 >> 8) & 0xFF] << 8) ^
+			((uint32_t)RSb[(Y0 >> 16) & 0xFF] << 16) ^
+			((uint32_t)RSb[(Y3 >> 24) & 0xFF] << 24);
+
+		X3 = *RK++ ^ \
+			((uint32_t)RSb[(Y3) & 0xFF]) ^
+			((uint32_t)RSb[(Y2 >> 8) & 0xFF] << 8) ^
+			((uint32_t)RSb[(Y1 >> 16) & 0xFF] << 16) ^
+			((uint32_t)RSb[(Y0 >> 24) & 0xFF] << 24);
+	}
+	else /* ENCRYPT */
+	{
+#endif /* AES_DECRYPTION */
+
+		for (i = (ctx->rounds >> 1) - 1; i > 0; i--)
+		{
+			AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);
+			AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3);
+		}
+
+		AES_FROUND(Y0, Y1, Y2, Y3, X0, X1, X2, X3);
+
+		X0 = *RK++ ^ \
+			((uint32_t)FSb[(Y0) & 0xFF]) ^
+			((uint32_t)FSb[(Y1 >> 8) & 0xFF] << 8) ^
+			((uint32_t)FSb[(Y2 >> 16) & 0xFF] << 16) ^
+			((uint32_t)FSb[(Y3 >> 24) & 0xFF] << 24);
+
+		X1 = *RK++ ^ \
+			((uint32_t)FSb[(Y1) & 0xFF]) ^
+			((uint32_t)FSb[(Y2 >> 8) & 0xFF] << 8) ^
+			((uint32_t)FSb[(Y3 >> 16) & 0xFF] << 16) ^
+			((uint32_t)FSb[(Y0 >> 24) & 0xFF] << 24);
+
+		X2 = *RK++ ^ \
+			((uint32_t)FSb[(Y2) & 0xFF]) ^
+			((uint32_t)FSb[(Y3 >> 8) & 0xFF] << 8) ^
+			((uint32_t)FSb[(Y0 >> 16) & 0xFF] << 16) ^
+			((uint32_t)FSb[(Y1 >> 24) & 0xFF] << 24);
+
+		X3 = *RK++ ^ \
+			((uint32_t)FSb[(Y3) & 0xFF]) ^
+			((uint32_t)FSb[(Y0 >> 8) & 0xFF] << 8) ^
+			((uint32_t)FSb[(Y1 >> 16) & 0xFF] << 16) ^
+			((uint32_t)FSb[(Y2 >> 24) & 0xFF] << 24);
+
+#if AES_DECRYPTION  // whether AES decryption is supported
+	}
+#endif /* AES_DECRYPTION */
+
+	PUT_UINT32_LE(X0, output, 0);
+	PUT_UINT32_LE(X1, output, 4);
+	PUT_UINT32_LE(X2, output, 8);
+	PUT_UINT32_LE(X3, output, 12);
+
+	return(0);
+}
+/* end of aes.c */

nfq/crypto/aes.h

@@ -0,0 +1,78 @@
+/******************************************************************************
+*
+* THIS SOURCE CODE IS HEREBY PLACED INTO THE PUBLIC DOMAIN FOR THE GOOD OF ALL
+*
+* This is a simple and straightforward implementation of the AES Rijndael
+* 128-bit block cipher designed by Vincent Rijmen and Joan Daemen. The focus
+* of this work was correctness & accuracy.  It is written in 'C' without any
+* particular focus upon optimization or speed. It should be endian (memory
+* byte order) neutral since the few places that care are handled explicitly.
+*
+* This implementation of Rijndael was created by Steven M. Gibson of GRC.com.
+*
+* It is intended for general purpose use, but was written in support of GRC's
+* reference implementation of the SQRL (Secure Quick Reliable Login) client.
+*
+* See:    http://csrc.nist.gov/archive/aes/rijndael/wsdindex.html
+*
+* NO COPYRIGHT IS CLAIMED IN THIS WORK, HOWEVER, NEITHER IS ANY WARRANTY MADE
+* REGARDING ITS FITNESS FOR ANY PARTICULAR PURPOSE. USE IT AT YOUR OWN RISK.
+*
+*******************************************************************************/
+
+#pragma once
+
+/******************************************************************************/
+#define AES_DECRYPTION  0       // whether AES decryption is supported
+/******************************************************************************/
+
+#include <string.h>
+
+#define AES_ENCRYPT         1       // specify whether we're encrypting
+#define AES_DECRYPT         0       // or decrypting
+
+#if defined(_MSC_VER)
+#include <basetsd.h>
+typedef UINT32 uint32_t;
+#else
+#include <inttypes.h>
+#endif
+
+typedef unsigned char uchar;    // add some convienent shorter types
+typedef unsigned int uint;
+
+
+/******************************************************************************
+ *  AES_INIT_KEYGEN_TABLES : MUST be called once before any AES use
+ ******************************************************************************/
+void aes_init_keygen_tables(void);
+
+
+/******************************************************************************
+ *  AES_CONTEXT : cipher context / holds inter-call data
+ ******************************************************************************/
+typedef struct {
+	int mode;           // 1 for Encryption, 0 for Decryption
+	int rounds;         // keysize-based rounds count
+	uint32_t *rk;       // pointer to current round key
+	uint32_t buf[68];   // key expansion buffer
+} aes_context;
+
+
+/******************************************************************************
+ *  AES_SETKEY : called to expand the key for encryption or decryption
+ ******************************************************************************/
+int aes_setkey(aes_context *ctx,       // pointer to context
+	int mode,               // 1 or 0 for Encrypt/Decrypt
+	const uchar *key,       // AES input key
+	uint keysize);         // size in bytes (must be 16, 24, 32 for
+					// 128, 192 or 256-bit keys respectively)
+							// returns 0 for success
+
+/******************************************************************************
+ *  AES_CIPHER : called to encrypt or decrypt ONE 128-bit block of data
+ ******************************************************************************/
+int aes_cipher(aes_context *ctx,       // pointer to context
+	const uchar input[16],  // 128-bit block to en/decipher
+	uchar output[16]);     // 128-bit output result block
+							// returns 0 for success

nfq/crypto/gcm.c

@@ -0,0 +1,511 @@
+/******************************************************************************
+*
+* THIS SOURCE CODE IS HEREBY PLACED INTO THE PUBLIC DOMAIN FOR THE GOOD OF ALL
+*
+* This is a simple and straightforward implementation of AES-GCM authenticated
+* encryption. The focus of this work was correctness & accuracy. It is written
+* in straight 'C' without any particular focus upon optimization or speed. It
+* should be endian (memory byte order) neutral since the few places that care
+* are handled explicitly.
+*
+* This implementation of AES-GCM was created by Steven M. Gibson of GRC.com.
+*
+* It is intended for general purpose use, but was written in support of GRC's
+* reference implementation of the SQRL (Secure Quick Reliable Login) client.
+*
+* See:    http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
+*         http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/
+*         gcm/gcm-revised-spec.pdf
+*
+* NO COPYRIGHT IS CLAIMED IN THIS WORK, HOWEVER, NEITHER IS ANY WARRANTY MADE
+* REGARDING ITS FITNESS FOR ANY PARTICULAR PURPOSE. USE IT AT YOUR OWN RISK.
+*
+*******************************************************************************/
+
+#include "gcm.h"
+#include "aes.h"
+
+/******************************************************************************
+ *                      ==== IMPLEMENTATION WARNING ====
+ *
+ *  This code was developed for use within SQRL's fixed environmnent. Thus, it
+ *  is somewhat less "general purpose" than it would be if it were designed as
+ *  a general purpose AES-GCM library. Specifically, it bothers with almost NO
+ *  error checking on parameter limits, buffer bounds, etc. It assumes that it
+ *  is being invoked by its author or by someone who understands the values it
+ *  expects to receive. Its behavior will be undefined otherwise.
+ *
+ *  All functions that might fail are defined to return 'ints' to indicate a
+ *  problem. Most do not do so now. But this allows for error propagation out
+ *  of internal functions if robust error checking should ever be desired.
+ *
+ ******************************************************************************/
+
+ /* Calculating the "GHASH"
+  *
+  * There are many ways of calculating the so-called GHASH in software, each with
+  * a traditional size vs performance tradeoff.  The GHASH (Galois field hash) is
+  * an intriguing construction which takes two 128-bit strings (also the cipher's
+  * block size and the fundamental operation size for the system) and hashes them
+  * into a third 128-bit result.
+  *
+  * Many implementation solutions have been worked out that use large precomputed
+  * table lookups in place of more time consuming bit fiddling, and this approach
+  * can be scaled easily upward or downward as needed to change the time/space
+  * tradeoff. It's been studied extensively and there's a solid body of theory and
+  * practice.  For example, without using any lookup tables an implementation
+  * might obtain 119 cycles per byte throughput, whereas using a simple, though
+  * large, key-specific 64 kbyte 8-bit lookup table the performance jumps to 13
+  * cycles per byte.
+  *
+  * And Intel's processors have, since 2010, included an instruction which does
+  * the entire 128x128->128 bit job in just several 64x64->128 bit pieces.
+  *
+  * Since SQRL is interactive, and only processing a few 128-bit blocks, I've
+  * settled upon a relatively slower but appealing small-table compromise which
+  * folds a bunch of not only time consuming but also bit twiddling into a simple
+  * 16-entry table which is attributed to Victor Shoup's 1996 work while at
+  * Bellcore: "On Fast and Provably Secure MessageAuthentication Based on
+  * Universal Hashing."  See: http://www.shoup.net/papers/macs.pdf
+  * See, also section 4.1 of the "gcm-revised-spec" cited above.
+  */
+
+  /*
+   *  This 16-entry table of pre-computed constants is used by the
+   *  GHASH multiplier to improve over a strictly table-free but
+   *  significantly slower 128x128 bit multiple within GF(2^128).
+   */
+static const uint64_t last4[16] = {
+	0x0000, 0x1c20, 0x3840, 0x2460, 0x7080, 0x6ca0, 0x48c0, 0x54e0,
+	0xe100, 0xfd20, 0xd940, 0xc560, 0x9180, 0x8da0, 0xa9c0, 0xb5e0 };
+
+/*
+ * Platform Endianness Neutralizing Load and Store Macro definitions
+ * GCM wants platform-neutral Big Endian (BE) byte ordering
+ */
+#define GET_UINT32_BE(n,b,i) {                      \
+    (n) = ( (uint32_t) (b)[(i)    ] << 24 )         \
+        | ( (uint32_t) (b)[(i) + 1] << 16 )         \
+        | ( (uint32_t) (b)[(i) + 2] <<  8 )         \
+        | ( (uint32_t) (b)[(i) + 3]       ); }
+
+#define PUT_UINT32_BE(n,b,i) {                      \
+    (b)[(i)    ] = (uchar) ( (n) >> 24 );   \
+    (b)[(i) + 1] = (uchar) ( (n) >> 16 );   \
+    (b)[(i) + 2] = (uchar) ( (n) >>  8 );   \
+    (b)[(i) + 3] = (uchar) ( (n)       ); }
+
+
+ /******************************************************************************
+  *
+  *  GCM_INITIALIZE
+  *
+  *  Must be called once to initialize the GCM library.
+  *
+  *  At present, this only calls the AES keygen table generator, which expands
+  *  the AES keying tables for use. This is NOT A THREAD-SAFE function, so it
+  *  MUST be called during system initialization before a multi-threading
+  *  environment is running.
+  *
+  ******************************************************************************/
+int gcm_initialize(void)
+{
+	aes_init_keygen_tables();
+	return(0);
+}
+
+
+/******************************************************************************
+ *
+ *  GCM_MULT
+ *
+ *  Performs a GHASH operation on the 128-bit input vector 'x', setting
+ *  the 128-bit output vector to 'x' times H using our precomputed tables.
+ *  'x' and 'output' are seen as elements of GCM's GF(2^128) Galois field.
+ *
+ ******************************************************************************/
+static void gcm_mult(gcm_context *ctx,     // pointer to established context
+	const uchar x[16],    // pointer to 128-bit input vector
+	uchar output[16])    // pointer to 128-bit output vector
+{
+	int i;
+	uchar lo, hi, rem;
+	uint64_t zh, zl;
+
+	lo = (uchar)(x[15] & 0x0f);
+	hi = (uchar)(x[15] >> 4);
+	zh = ctx->HH[lo];
+	zl = ctx->HL[lo];
+
+	for (i = 15; i >= 0; i--) {
+		lo = (uchar)(x[i] & 0x0f);
+		hi = (uchar)(x[i] >> 4);
+
+		if (i != 15) {
+			rem = (uchar)(zl & 0x0f);
+			zl = (zh << 60) | (zl >> 4);
+			zh = (zh >> 4);
+			zh ^= (uint64_t)last4[rem] << 48;
+			zh ^= ctx->HH[lo];
+			zl ^= ctx->HL[lo];
+		}
+		rem = (uchar)(zl & 0x0f);
+		zl = (zh << 60) | (zl >> 4);
+		zh = (zh >> 4);
+		zh ^= (uint64_t)last4[rem] << 48;
+		zh ^= ctx->HH[hi];
+		zl ^= ctx->HL[hi];
+	}
+	PUT_UINT32_BE(zh >> 32, output, 0);
+	PUT_UINT32_BE(zh, output, 4);
+	PUT_UINT32_BE(zl >> 32, output, 8);
+	PUT_UINT32_BE(zl, output, 12);
+}
+
+
+/******************************************************************************
+ *
+ *  GCM_SETKEY
+ *
+ *  This is called to set the AES-GCM key. It initializes the AES key
+ *  and populates the gcm context's pre-calculated HTables.
+ *
+ ******************************************************************************/
+int gcm_setkey(gcm_context *ctx,   // pointer to caller-provided gcm context
+	const uchar *key,   // pointer to the AES encryption key
+	const uint keysize) // size in bytes (must be 16, 24, 32 for
+				// 128, 192 or 256-bit keys respectively)
+{
+	int ret, i, j;
+	uint64_t hi, lo;
+	uint64_t vl, vh;
+	unsigned char h[16];
+
+	memset(ctx, 0, sizeof(gcm_context));  // zero caller-provided GCM context
+	memset(h, 0, 16);                     // initialize the block to encrypt
+
+	// encrypt the null 128-bit block to generate a key-based value
+	// which is then used to initialize our GHASH lookup tables
+	if ((ret = aes_setkey(&ctx->aes_ctx, AES_ENCRYPT, key, keysize)) != 0)
+		return(ret);
+	if ((ret = aes_cipher(&ctx->aes_ctx, h, h)) != 0)
+		return(ret);
+
+	GET_UINT32_BE(hi, h, 0);    // pack h as two 64-bit ints, big-endian
+	GET_UINT32_BE(lo, h, 4);
+	vh = (uint64_t)hi << 32 | lo;
+
+	GET_UINT32_BE(hi, h, 8);
+	GET_UINT32_BE(lo, h, 12);
+	vl = (uint64_t)hi << 32 | lo;
+
+	ctx->HL[8] = vl;                // 8 = 1000 corresponds to 1 in GF(2^128)
+	ctx->HH[8] = vh;
+	ctx->HH[0] = 0;                 // 0 corresponds to 0 in GF(2^128)
+	ctx->HL[0] = 0;
+
+	for (i = 4; i > 0; i >>= 1) {
+		uint32_t T = (uint32_t)(vl & 1) * 0xe1000000U;
+		vl = (vh << 63) | (vl >> 1);
+		vh = (vh >> 1) ^ ((uint64_t)T << 32);
+		ctx->HL[i] = vl;
+		ctx->HH[i] = vh;
+	}
+	for (i = 2; i < 16; i <<= 1) {
+		uint64_t *HiL = ctx->HL + i, *HiH = ctx->HH + i;
+		vh = *HiH;
+		vl = *HiL;
+		for (j = 1; j < i; j++) {
+			HiH[j] = vh ^ ctx->HH[j];
+			HiL[j] = vl ^ ctx->HL[j];
+		}
+	}
+	return(0);
+}
+
+
+/******************************************************************************
+ *
+ *    GCM processing occurs four phases: SETKEY, START, UPDATE and FINISH.
+ *
+ *  SETKEY:
+ *
+ *   START: Sets the Encryption/Decryption mode.
+ *          Accepts the initialization vector and additional data.
+ *
+ *  UPDATE: Encrypts or decrypts the plaintext or ciphertext.
+ *
+ *  FINISH: Performs a final GHASH to generate the authentication tag.
+ *
+ ******************************************************************************
+ *
+ *  GCM_START
+ *
+ *  Given a user-provided GCM context, this initializes it, sets the encryption
+ *  mode, and preprocesses the initialization vector and additional AEAD data.
+ *
+ ******************************************************************************/
+int gcm_start(gcm_context *ctx,    // pointer to user-provided GCM context
+	int mode,            // GCM_ENCRYPT or GCM_DECRYPT
+	const uchar *iv,     // pointer to initialization vector
+	size_t iv_len,       // IV length in bytes (should == 12)
+	const uchar *add,    // ptr to additional AEAD data (NULL if none)
+	size_t add_len)     // length of additional AEAD data (bytes)
+{
+	int ret;            // our error return if the AES encrypt fails
+	uchar work_buf[16]; // XOR source built from provided IV if len != 16
+	const uchar *p;     // general purpose array pointer
+	size_t use_len;     // byte count to process, up to 16 bytes
+	size_t i;           // local loop iterator
+
+	// since the context might be reused under the same key
+	// we zero the working buffers for this next new process
+	memset(ctx->y, 0x00, sizeof(ctx->y));
+	memset(ctx->buf, 0x00, sizeof(ctx->buf));
+	ctx->len = 0;
+	ctx->add_len = 0;
+
+	ctx->mode = mode;               // set the GCM encryption/decryption mode
+	ctx->aes_ctx.mode = AES_ENCRYPT;    // GCM *always* runs AES in ENCRYPTION mode
+
+	if (iv_len == 12) {                // GCM natively uses a 12-byte, 96-bit IV
+		memcpy(ctx->y, iv, iv_len);   // copy the IV to the top of the 'y' buff
+		ctx->y[15] = 1;                 // start "counting" from 1 (not 0)
+	}
+	else    // if we don't have a 12-byte IV, we GHASH whatever we've been given
+	{
+		memset(work_buf, 0x00, 16);               // clear the working buffer
+		PUT_UINT32_BE(iv_len * 8, work_buf, 12);  // place the IV into buffer
+
+		p = iv;
+		while (iv_len > 0) {
+			use_len = (iv_len < 16) ? iv_len : 16;
+			for (i = 0; i < use_len; i++) ctx->y[i] ^= p[i];
+			gcm_mult(ctx, ctx->y, ctx->y);
+			iv_len -= use_len;
+			p += use_len;
+		}
+		for (i = 0; i < 16; i++) ctx->y[i] ^= work_buf[i];
+		gcm_mult(ctx, ctx->y, ctx->y);
+	}
+	if ((ret = aes_cipher(&ctx->aes_ctx, ctx->y, ctx->base_ectr)) != 0)
+		return(ret);
+
+	ctx->add_len = add_len;
+	p = add;
+	while (add_len > 0) {
+		use_len = (add_len < 16) ? add_len : 16;
+		for (i = 0; i < use_len; i++) ctx->buf[i] ^= p[i];
+		gcm_mult(ctx, ctx->buf, ctx->buf);
+		add_len -= use_len;
+		p += use_len;
+	}
+	return(0);
+}
+
+/******************************************************************************
+ *
+ *  GCM_UPDATE
+ *
+ *  This is called once or more to process bulk plaintext or ciphertext data.
+ *  We give this some number of bytes of input and it returns the same number
+ *  of output bytes. If called multiple times (which is fine) all but the final
+ *  invocation MUST be called with length mod 16 == 0. (Only the final call can
+ *  have a partial block length of < 128 bits.)
+ *
+ ******************************************************************************/
+int gcm_update(gcm_context *ctx,       // pointer to user-provided GCM context
+	size_t length,          // length, in bytes, of data to process
+	const uchar *input,     // pointer to source data
+	uchar *output)         // pointer to destination data
+{
+	int ret;            // our error return if the AES encrypt fails
+	uchar ectr[16];     // counter-mode cipher output for XORing
+	size_t use_len;     // byte count to process, up to 16 bytes
+	size_t i;           // local loop iterator
+
+	ctx->len += length; // bump the GCM context's running length count
+
+	while (length > 0) {
+		// clamp the length to process at 16 bytes
+		use_len = (length < 16) ? length : 16;
+
+		// increment the context's 128-bit IV||Counter 'y' vector
+		for (i = 16; i > 12; i--) if (++ctx->y[i - 1] != 0) break;
+
+		// encrypt the context's 'y' vector under the established key
+		if ((ret = aes_cipher(&ctx->aes_ctx, ctx->y, ectr)) != 0)
+			return(ret);
+
+		// encrypt or decrypt the input to the output
+		if (ctx->mode == AES_ENCRYPT)
+		{
+			for (i = 0; i < use_len; i++) {
+				// XOR the cipher's ouptut vector (ectr) with our input
+				output[i] = (uchar)(ectr[i] ^ input[i]);
+				// now we mix in our data into the authentication hash.
+				// if we're ENcrypting we XOR in the post-XOR (output) 
+				// results, but if we're DEcrypting we XOR in the input 
+				// data
+				ctx->buf[i] ^= output[i];
+			}
+		}
+		else
+		{
+			for (i = 0; i < use_len; i++) {
+				// but if we're DEcrypting we XOR in the input data first, 
+				// i.e. before saving to ouput data, otherwise if the input 
+				// and output buffer are the same (inplace decryption) we 
+				// would not get the correct auth tag
+
+				ctx->buf[i] ^= input[i];
+
+				// XOR the cipher's ouptut vector (ectr) with our input
+				output[i] = (uchar)(ectr[i] ^ input[i]);
+			}
+		}
+		gcm_mult(ctx, ctx->buf, ctx->buf);    // perform a GHASH operation
+
+		length -= use_len;  // drop the remaining byte count to process
+		input += use_len;  // bump our input pointer forward
+		output += use_len;  // bump our output pointer forward
+	}
+	return(0);
+}
+
+/******************************************************************************
+ *
+ *  GCM_FINISH
+ *
+ *  This is called once after all calls to GCM_UPDATE to finalize the GCM.
+ *  It performs the final GHASH to produce the resulting authentication TAG.
+ *
+ ******************************************************************************/
+int gcm_finish(gcm_context *ctx,   // pointer to user-provided GCM context
+	uchar *tag,         // pointer to buffer which receives the tag
+	size_t tag_len)    // length, in bytes, of the tag-receiving buf
+{
+	uchar work_buf[16];
+	uint64_t orig_len = ctx->len * 8;
+	uint64_t orig_add_len = ctx->add_len * 8;
+	size_t i;
+
+	if (tag_len != 0) memcpy(tag, ctx->base_ectr, tag_len);
+
+	if (orig_len || orig_add_len) {
+		memset(work_buf, 0x00, 16);
+
+		PUT_UINT32_BE((orig_add_len >> 32), work_buf, 0);
+		PUT_UINT32_BE((orig_add_len), work_buf, 4);
+		PUT_UINT32_BE((orig_len >> 32), work_buf, 8);
+		PUT_UINT32_BE((orig_len), work_buf, 12);
+
+		for (i = 0; i < 16; i++) ctx->buf[i] ^= work_buf[i];
+		gcm_mult(ctx, ctx->buf, ctx->buf);
+		for (i = 0; i < tag_len; i++) tag[i] ^= ctx->buf[i];
+	}
+	return(0);
+}
+
+
+/******************************************************************************
+ *
+ *  GCM_CRYPT_AND_TAG
+ *
+ *  This either encrypts or decrypts the user-provided data and, either
+ *  way, generates an authentication tag of the requested length. It must be
+ *  called with a GCM context whose key has already been set with GCM_SETKEY.
+ *
+ *  The user would typically call this explicitly to ENCRYPT a buffer of data
+ *  and optional associated data, and produce its an authentication tag.
+ *
+ *  To reverse the process the user would typically call the companion
+ *  GCM_AUTH_DECRYPT function to decrypt data and verify a user-provided
+ *  authentication tag.  The GCM_AUTH_DECRYPT function calls this function
+ *  to perform its decryption and tag generation, which it then compares.
+ *
+ ******************************************************************************/
+int gcm_crypt_and_tag(
+	gcm_context *ctx,       // gcm context with key already setup
+	int mode,               // cipher direction: GCM_ENCRYPT or GCM_DECRYPT
+	const uchar *iv,        // pointer to the 12-byte initialization vector
+	size_t iv_len,          // byte length if the IV. should always be 12
+	const uchar *add,       // pointer to the non-ciphered additional data
+	size_t add_len,         // byte length of the additional AEAD data
+	const uchar *input,     // pointer to the cipher data source
+	uchar *output,          // pointer to the cipher data destination
+	size_t length,          // byte length of the cipher data
+	uchar *tag,             // pointer to the tag to be generated
+	size_t tag_len)        // byte length of the tag to be generated
+{   /*
+	   assuming that the caller has already invoked gcm_setkey to
+	   prepare the gcm context with the keying material, we simply
+	   invoke each of the three GCM sub-functions in turn...
+	*/
+	gcm_start(ctx, mode, iv, iv_len, add, add_len);
+	gcm_update(ctx, length, input, output);
+	gcm_finish(ctx, tag, tag_len);
+	return(0);
+}
+
+
+/******************************************************************************
+ *
+ *  GCM_AUTH_DECRYPT
+ *
+ *  This DECRYPTS a user-provided data buffer with optional associated data.
+ *  It then verifies a user-supplied authentication tag against the tag just
+ *  re-created during decryption to verify that the data has not been altered.
+ *
+ *  This function calls GCM_CRYPT_AND_TAG (above) to perform the decryption
+ *  and authentication tag generation.
+ *
+ ******************************************************************************/
+int gcm_auth_decrypt(
+	gcm_context *ctx,       // gcm context with key already setup
+	const uchar *iv,        // pointer to the 12-byte initialization vector
+	size_t iv_len,          // byte length if the IV. should always be 12
+	const uchar *add,       // pointer to the non-ciphered additional data
+	size_t add_len,         // byte length of the additional AEAD data
+	const uchar *input,     // pointer to the cipher data source
+	uchar *output,          // pointer to the cipher data destination
+	size_t length,          // byte length of the cipher data
+	const uchar *tag,       // pointer to the tag to be authenticated
+	size_t tag_len)        // byte length of the tag <= 16
+{
+	uchar check_tag[16];        // the tag generated and returned by decryption
+	int diff;                   // an ORed flag to detect authentication errors
+	size_t i;                   // our local iterator
+	/*
+	   we use GCM_DECRYPT_AND_TAG (above) to perform our decryption
+	   (which is an identical XORing to reverse the previous one)
+	   and also to re-generate the matching authentication tag
+	*/
+	gcm_crypt_and_tag(ctx, AES_DECRYPT, iv, iv_len, add, add_len,
+		input, output, length, check_tag, tag_len);
+
+	// now we verify the authentication tag in 'constant time'
+	for (diff = 0, i = 0; i < tag_len; i++)
+		diff |= tag[i] ^ check_tag[i];
+
+	if (diff != 0) {                   // see whether any bits differed?
+		memset(output, 0, length);    // if so... wipe the output data
+		return(GCM_AUTH_FAILURE);     // return GCM_AUTH_FAILURE
+	}
+	return(0);
+}
+
+/******************************************************************************
+ *
+ *  GCM_ZERO_CTX
+ *
+ *  The GCM context contains both the GCM context and the AES context.
+ *  This includes keying and key-related material which is security-
+ *  sensitive, so it MUST be zeroed after use. This function does that.
+ *
+ ******************************************************************************/
+void gcm_zero_ctx(gcm_context *ctx)
+{
+	// zero the context originally provided to us
+	memset(ctx, 0, sizeof(gcm_context));
+}

nfq/crypto/gcm.h

@@ -0,0 +1,183 @@
+/******************************************************************************
+*
+* THIS SOURCE CODE IS HEREBY PLACED INTO THE PUBLIC DOMAIN FOR THE GOOD OF ALL
+*
+* This is a simple and straightforward implementation of AES-GCM authenticated
+* encryption. The focus of this work was correctness & accuracy. It is written
+* in straight 'C' without any particular focus upon optimization or speed. It
+* should be endian (memory byte order) neutral since the few places that care
+* are handled explicitly.
+*
+* This implementation of AES-GCM was created by Steven M. Gibson of GRC.com.
+*
+* It is intended for general purpose use, but was written in support of GRC's
+* reference implementation of the SQRL (Secure Quick Reliable Login) client.
+*
+* See:    http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
+*         http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/ \
+*         gcm/gcm-revised-spec.pdf
+*
+* NO COPYRIGHT IS CLAIMED IN THIS WORK, HOWEVER, NEITHER IS ANY WARRANTY MADE
+* REGARDING ITS FITNESS FOR ANY PARTICULAR PURPOSE. USE IT AT YOUR OWN RISK.
+*
+*******************************************************************************/
+#pragma once
+
+#define GCM_AUTH_FAILURE    0x55555555  // authentication failure
+
+#include "aes.h"                        // gcm_context includes aes_context
+
+#if defined(_MSC_VER)
+#include <basetsd.h>
+typedef unsigned int size_t;// use the right type for length declarations
+typedef UINT32 uint32_t;
+typedef UINT64 uint64_t;
+#else
+#include <stdint.h>
+#endif
+
+
+/******************************************************************************
+ *  GCM_CONTEXT : GCM context / holds keytables, instance data, and AES ctx
+ ******************************************************************************/
+typedef struct {
+	int mode;               // cipher direction: encrypt/decrypt
+	uint64_t len;           // cipher data length processed so far
+	uint64_t add_len;       // total add data length
+	uint64_t HL[16];        // precalculated lo-half HTable
+	uint64_t HH[16];        // precalculated hi-half HTable
+	uchar base_ectr[16];    // first counter-mode cipher output for tag
+	uchar y[16];            // the current cipher-input IV|Counter value
+	uchar buf[16];          // buf working value
+	aes_context aes_ctx;    // cipher context used
+} gcm_context;
+
+
+/******************************************************************************
+ *  GCM_CONTEXT : MUST be called once before ANY use of this library
+ ******************************************************************************/
+int gcm_initialize(void);
+
+
+/******************************************************************************
+ *  GCM_SETKEY : sets the GCM (and AES) keying material for use
+ ******************************************************************************/
+int gcm_setkey(gcm_context *ctx,   // caller-provided context ptr
+	const uchar *key,   // pointer to cipher key
+	const uint keysize  // size in bytes (must be 16, 24, 32 for
+				// 128, 192 or 256-bit keys respectively)
+); // returns 0 for success
+
+
+/******************************************************************************
+ *
+ *  GCM_CRYPT_AND_TAG
+ *
+ *  This either encrypts or decrypts the user-provided data and, either
+ *  way, generates an authentication tag of the requested length. It must be
+ *  called with a GCM context whose key has already been set with GCM_SETKEY.
+ *
+ *  The user would typically call this explicitly to ENCRYPT a buffer of data
+ *  and optional associated data, and produce its an authentication tag.
+ *
+ *  To reverse the process the user would typically call the companion
+ *  GCM_AUTH_DECRYPT function to decrypt data and verify a user-provided
+ *  authentication tag.  The GCM_AUTH_DECRYPT function calls this function
+ *  to perform its decryption and tag generation, which it then compares.
+ *
+ ******************************************************************************/
+int gcm_crypt_and_tag(
+	gcm_context *ctx,       // gcm context with key already setup
+	int mode,               // cipher direction: ENCRYPT (1) or DECRYPT (0)
+	const uchar *iv,        // pointer to the 12-byte initialization vector
+	size_t iv_len,          // byte length if the IV. should always be 12
+	const uchar *add,       // pointer to the non-ciphered additional data
+	size_t add_len,         // byte length of the additional AEAD data
+	const uchar *input,     // pointer to the cipher data source
+	uchar *output,          // pointer to the cipher data destination
+	size_t length,          // byte length of the cipher data
+	uchar *tag,             // pointer to the tag to be generated
+	size_t tag_len);       // byte length of the tag to be generated
+
+
+/******************************************************************************
+ *
+ *  GCM_AUTH_DECRYPT
+ *
+ *  This DECRYPTS a user-provided data buffer with optional associated data.
+ *  It then verifies a user-supplied authentication tag against the tag just
+ *  re-created during decryption to verify that the data has not been altered.
+ *
+ *  This function calls GCM_CRYPT_AND_TAG (above) to perform the decryption
+ *  and authentication tag generation.
+ *
+ ******************************************************************************/
+int gcm_auth_decrypt(
+	gcm_context *ctx,       // gcm context with key already setup
+	const uchar *iv,        // pointer to the 12-byte initialization vector
+	size_t iv_len,          // byte length if the IV. should always be 12
+	const uchar *add,       // pointer to the non-ciphered additional data
+	size_t add_len,         // byte length of the additional AEAD data
+	const uchar *input,     // pointer to the cipher data source
+	uchar *output,          // pointer to the cipher data destination
+	size_t length,          // byte length of the cipher data
+	const uchar *tag,       // pointer to the tag to be authenticated
+	size_t tag_len);       // byte length of the tag <= 16
+
+
+/******************************************************************************
+ *
+ *  GCM_START
+ *
+ *  Given a user-provided GCM context, this initializes it, sets the encryption
+ *  mode, and preprocesses the initialization vector and additional AEAD data.
+ *
+ ******************************************************************************/
+int gcm_start(gcm_context *ctx,    // pointer to user-provided GCM context
+	int mode,            // ENCRYPT (1) or DECRYPT (0)
+	const uchar *iv,     // pointer to initialization vector
+	size_t iv_len,       // IV length in bytes (should == 12)
+	const uchar *add,    // pointer to additional AEAD data (NULL if none)
+	size_t add_len);    // length of additional AEAD data (bytes)
+
+
+/******************************************************************************
+ *
+ *  GCM_UPDATE
+ *
+ *  This is called once or more to process bulk plaintext or ciphertext data.
+ *  We give this some number of bytes of input and it returns the same number
+ *  of output bytes. If called multiple times (which is fine) all but the final
+ *  invocation MUST be called with length mod 16 == 0. (Only the final call can
+ *  have a partial block length of < 128 bits.)
+ *
+ ******************************************************************************/
+int gcm_update(gcm_context *ctx,       // pointer to user-provided GCM context
+	size_t length,          // length, in bytes, of data to process
+	const uchar *input,     // pointer to source data
+	uchar *output);        // pointer to destination data
+
+
+/******************************************************************************
+ *
+ *  GCM_FINISH
+ *
+ *  This is called once after all calls to GCM_UPDATE to finalize the GCM.
+ *  It performs the final GHASH to produce the resulting authentication TAG.
+ *
+ ******************************************************************************/
+int gcm_finish(gcm_context *ctx,   // pointer to user-provided GCM context
+	uchar *tag,         // ptr to tag buffer - NULL if tag_len = 0
+	size_t tag_len);   // length, in bytes, of the tag-receiving buf
+
+
+/******************************************************************************
+ *
+ *  GCM_ZERO_CTX
+ *
+ *  The GCM context contains both the GCM context and the AES context.
+ *  This includes keying and key-related material which is security-
+ *  sensitive, so it MUST be zeroed after use. This function does that.
+ *
+ ******************************************************************************/
+void gcm_zero_ctx(gcm_context *ctx);

nfq/crypto/hkdf.c

@@ -0,0 +1,337 @@
+/**************************** hkdf.c ***************************/
+/***************** See RFC 6234 for details. *******************/
+/* Copyright (c) 2011 IETF Trust and the persons identified as */
+/* authors of the code.  All rights reserved.                  */
+/* See sha.h for terms of use and redistribution.              */
+
+/*
+ *  Description:
+ *      This file implements the HKDF algorithm (HMAC-based
+ *      Extract-and-Expand Key Derivation Function, RFC 5869),
+ *      expressed in terms of the various SHA algorithms.
+ */
+
+#include "sha.h"
+#include <string.h>
+#include <stdlib.h>
+
+ /*
+  *  hkdf
+  *
+  *  Description:
+  *      This function will generate keying material using HKDF.
+  *
+  *  Parameters:
+  *      whichSha: [in]
+  *          One of SHA1, SHA224, SHA256, SHA384, SHA512
+  *      salt[ ]: [in]
+  *          The optional salt value (a non-secret random value);
+  *          if not provided (salt == NULL), it is set internally
+  *          to a string of HashLen(whichSha) zeros.
+  *      salt_len: [in]
+  *          The length of the salt value.  (Ignored if salt == NULL.)
+  *      ikm[ ]: [in]
+  *          Input keying material.
+  *      ikm_len: [in]
+  *          The length of the input keying material.
+  *      info[ ]: [in]
+  *          The optional context and application specific information.
+  *          If info == NULL or a zero-length string, it is ignored.
+  *      info_len: [in]
+  *          The length of the optional context and application specific
+  *          information.  (Ignored if info == NULL.)
+  *      okm[ ]: [out]
+  *          Where the HKDF is to be stored.
+  *      okm_len: [in]
+  *          The length of the buffer to hold okm.
+  *          okm_len must be <= 255 * USHABlockSize(whichSha)
+  *
+  *  Notes:
+  *      Calls hkdfExtract() and hkdfExpand().
+  *
+  *  Returns:
+  *      sha Error Code.
+  *
+  */
+int hkdf(SHAversion whichSha,
+	const unsigned char *salt, size_t salt_len,
+	const unsigned char *ikm, size_t ikm_len,
+	const unsigned char *info, size_t info_len,
+	uint8_t okm[], size_t okm_len)
+{
+	uint8_t prk[USHAMaxHashSize];
+	return hkdfExtract(whichSha, salt, salt_len, ikm, ikm_len, prk) ||
+		hkdfExpand(whichSha, prk, USHAHashSize(whichSha), info,
+			info_len, okm, okm_len);
+}
+
+/*
+ *  hkdfExtract
+ *
+ *  Description:
+ *      This function will perform HKDF extraction.
+ *
+ *  Parameters:
+ *      whichSha: [in]
+ *          One of SHA1, SHA224, SHA256, SHA384, SHA512
+ *      salt[ ]: [in]
+ *          The optional salt value (a non-secret random value);
+ *          if not provided (salt == NULL), it is set internally
+ *          to a string of HashLen(whichSha) zeros.
+ *      salt_len: [in]
+ *          The length of the salt value.  (Ignored if salt == NULL.)
+ *      ikm[ ]: [in]
+ *          Input keying material.
+ *      ikm_len: [in]
+ *          The length of the input keying material.
+ *      prk[ ]: [out]
+ *          Array where the HKDF extraction is to be stored.
+ *          Must be larger than USHAHashSize(whichSha);
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int hkdfExtract(SHAversion whichSha,
+	const unsigned char *salt, size_t salt_len,
+	const unsigned char *ikm, size_t ikm_len,
+	uint8_t prk[USHAMaxHashSize])
+{
+	unsigned char nullSalt[USHAMaxHashSize];
+	if (salt == 0) {
+		salt = nullSalt;
+		salt_len = USHAHashSize(whichSha);
+		memset(nullSalt, '\0', salt_len);
+	}
+	else if (salt_len < 0) {
+		return shaBadParam;
+	}
+	return hmac(whichSha, ikm, ikm_len, salt, salt_len, prk);
+}
+
+/*
+ *  hkdfExpand
+ *
+ *  Description:
+ *      This function will perform HKDF expansion.
+ *
+ *  Parameters:
+ *      whichSha: [in]
+ *          One of SHA1, SHA224, SHA256, SHA384, SHA512
+ *      prk[ ]: [in]
+ *          The pseudo-random key to be expanded; either obtained
+ *          directly from a cryptographically strong, uniformly
+ *          distributed pseudo-random number generator, or as the
+ *          output from hkdfExtract().
+ *      prk_len: [in]
+ *          The length of the pseudo-random key in prk;
+ *          should at least be equal to USHAHashSize(whichSHA).
+ *      info[ ]: [in]
+ *          The optional context and application specific information.
+ *          If info == NULL or a zero-length string, it is ignored.
+ *      info_len: [in]
+ *          The length of the optional context and application specific
+ *          information.  (Ignored if info == NULL.)
+ *      okm[ ]: [out]
+ *          Where the HKDF is to be stored.
+ *      okm_len: [in]
+ *          The length of the buffer to hold okm.
+ *          okm_len must be <= 255 * USHABlockSize(whichSha)
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int hkdfExpand(SHAversion whichSha, const uint8_t prk[], size_t prk_len,
+	const unsigned char *info, size_t info_len,
+	uint8_t okm[], size_t okm_len)
+{
+	size_t hash_len, N;
+	unsigned char T[USHAMaxHashSize];
+	size_t Tlen, where, i;
+
+	if (info == 0) {
+		info = (const unsigned char *)"";
+		info_len = 0;
+	}
+	else if (info_len < 0) {
+		return shaBadParam;
+	}
+	if (okm_len <= 0) return shaBadParam;
+	if (!okm) return shaBadParam;
+
+	hash_len = USHAHashSize(whichSha);
+	if (prk_len < hash_len) return shaBadParam;
+	N = okm_len / hash_len;
+	if ((okm_len % hash_len) != 0) N++;
+	if (N > 255) return shaBadParam;
+
+	Tlen = 0;
+	where = 0;
+	for (i = 1; i <= N; i++) {
+		HMACContext context;
+		unsigned char c = i;
+		int ret = hmacReset(&context, whichSha, prk, prk_len) ||
+			hmacInput(&context, T, Tlen) ||
+			hmacInput(&context, info, info_len) ||
+			hmacInput(&context, &c, 1) ||
+			hmacResult(&context, T);
+		if (ret != shaSuccess) return ret;
+		memcpy(okm + where, T,
+			(i != N) ? hash_len : (okm_len - where));
+		where += hash_len;
+		Tlen = hash_len;
+	}
+	return shaSuccess;
+}
+
+/*
+ *  hkdfReset
+ *
+ *  Description:
+ *      This function will initialize the hkdfContext in preparation
+ *      for key derivation using the modular HKDF interface for
+ *      arbitrary length inputs.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The context to reset.
+ *      whichSha: [in]
+ *          One of SHA1, SHA224, SHA256, SHA384, SHA512
+ *      salt[ ]: [in]
+ *          The optional salt value (a non-secret random value);
+ *          if not provided (salt == NULL), it is set internally
+ *          to a string of HashLen(whichSha) zeros.
+ *      salt_len: [in]
+ *          The length of the salt value.  (Ignored if salt == NULL.)
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int hkdfReset(HKDFContext *context, enum SHAversion whichSha,
+	const unsigned char *salt, size_t salt_len)
+{
+	unsigned char nullSalt[USHAMaxHashSize];
+	if (!context) return shaNull;
+
+	context->whichSha = whichSha;
+	context->hashSize = USHAHashSize(whichSha);
+	if (salt == 0) {
+		salt = nullSalt;
+		salt_len = context->hashSize;
+		memset(nullSalt, '\0', salt_len);
+	}
+
+	return hmacReset(&context->hmacContext, whichSha, salt, salt_len);
+}
+
+/*
+ *  hkdfInput
+ *
+ *  Description:
+ *      This function accepts an array of octets as the next portion
+ *      of the input keying material.  It may be called multiple times.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The HKDF context to update.
+ *      ikm[ ]: [in]
+ *          An array of octets representing the next portion of
+ *          the input keying material.
+ *      ikm_len: [in]
+ *          The length of ikm.
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int hkdfInput(HKDFContext *context, const unsigned char *ikm,
+	size_t ikm_len)
+{
+	if (!context) return shaNull;
+	if (context->Corrupted) return context->Corrupted;
+	if (context->Computed) return context->Corrupted = shaStateError;
+	return hmacInput(&context->hmacContext, ikm, ikm_len);
+}
+
+/*
+ * hkdfFinalBits
+ *
+ * Description:
+ *   This function will add in any final bits of the
+ *   input keying material.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The HKDF context to update
+ *   ikm_bits: [in]
+ *     The final bits of the input keying material, in the upper
+ *     portion of the byte.  (Use 0b###00000 instead of 0b00000###
+ *     to input the three bits ###.)
+ *   ikm_bit_count: [in]
+ *     The number of bits in message_bits, between 1 and 7.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int hkdfFinalBits(HKDFContext *context, uint8_t ikm_bits,
+	unsigned int ikm_bit_count)
+{
+	if (!context) return shaNull;
+	if (context->Corrupted) return context->Corrupted;
+	if (context->Computed) return context->Corrupted = shaStateError;
+	return hmacFinalBits(&context->hmacContext, ikm_bits, ikm_bit_count);
+}
+
+/*
+ * hkdfResult
+ *
+ * Description:
+ *   This function will finish the HKDF extraction and perform the
+ *   final HKDF expansion.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The HKDF context to use to calculate the HKDF hash.
+ *   prk[ ]: [out]
+ *     An optional location to store the HKDF extraction.
+ *     Either NULL, or pointer to a buffer that must be
+ *     larger than USHAHashSize(whichSha);
+ *   info[ ]: [in]
+ *     The optional context and application specific information.
+ *     If info == NULL or a zero-length string, it is ignored.
+ *   info_len: [in]
+ *     The length of the optional context and application specific
+ *     information.  (Ignored if info == NULL.)
+ *   okm[ ]: [out]
+ *     Where the HKDF is to be stored.
+ *   okm_len: [in]
+ *     The length of the buffer to hold okm.
+ *     okm_len must be <= 255 * USHABlockSize(whichSha)
+ *
+ * Returns:
+ *   sha Error Code.
+ *
+ */
+int hkdfResult(HKDFContext *context,
+	uint8_t prk[USHAMaxHashSize],
+	const unsigned char *info, size_t info_len,
+	uint8_t okm[], size_t okm_len)
+{
+	uint8_t prkbuf[USHAMaxHashSize];
+	int ret;
+
+	if (!context) return shaNull;
+	if (context->Corrupted) return context->Corrupted;
+	if (context->Computed) return context->Corrupted = shaStateError;
+	if (!okm) return context->Corrupted = shaBadParam;
+	if (!prk) prk = prkbuf;
+
+	ret = hmacResult(&context->hmacContext, prk) ||
+		hkdfExpand(context->whichSha, prk, context->hashSize, info,
+			info_len, okm, okm_len);
+	context->Computed = 1;
+	return context->Corrupted = ret;
+}
+

nfq/crypto/hmac.c

@@ -0,0 +1,250 @@
+/**************************** hmac.c ***************************/
+/***************** See RFC 6234 for details. *******************/
+/* Copyright (c) 2011 IETF Trust and the persons identified as */
+/* authors of the code.  All rights reserved.                  */
+/* See sha.h for terms of use and redistribution.              */
+
+/*
+ *  Description:
+ *      This file implements the HMAC algorithm (Keyed-Hashing for
+ *      Message Authentication, [RFC 2104]), expressed in terms of
+ *      the various SHA algorithms.
+ */
+
+#include "sha.h"
+#include <stddef.h>
+
+ /*
+  *  hmac
+  *
+  *  Description:
+  *      This function will compute an HMAC message digest.
+  *
+  *  Parameters:
+  *      whichSha: [in]
+  *          One of SHA1, SHA224, SHA256, SHA384, SHA512
+  *      message_array[ ]: [in]
+  *          An array of octets representing the message.
+  *          Note: in RFC 2104, this parameter is known
+  *          as 'text'.
+  *      length: [in]
+  *          The length of the message in message_array.
+  *      key[ ]: [in]
+  *          The secret shared key.
+  *      key_len: [in]
+  *          The length of the secret shared key.
+  *      digest[ ]: [out]
+  *          Where the digest is to be returned.
+  *          NOTE: The length of the digest is determined by
+  *              the value of whichSha.
+  *
+  *  Returns:
+  *      sha Error Code.
+  *
+  */
+
+int hmac(SHAversion whichSha,
+	const unsigned char *message_array, size_t length,
+	const unsigned char *key, size_t key_len,
+	uint8_t digest[USHAMaxHashSize])
+{
+	HMACContext context;
+	return hmacReset(&context, whichSha, key, key_len) ||
+		hmacInput(&context, message_array, length) ||
+		hmacResult(&context, digest);
+}
+
+/*
+ *  hmacReset
+ *
+ *  Description:
+ *      This function will initialize the hmacContext in preparation
+ *      for computing a new HMAC message digest.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The context to reset.
+ *      whichSha: [in]
+ *          One of SHA1, SHA224, SHA256, SHA384, SHA512
+ *      key[ ]: [in]
+ *          The secret shared key.
+ *      key_len: [in]
+ *          The length of the secret shared key.
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int hmacReset(HMACContext *context, enum SHAversion whichSha,
+	const unsigned char *key, size_t key_len)
+{
+	size_t i, blocksize, hashsize;
+	int ret;
+
+	/* inner padding - key XORd with ipad */
+	unsigned char k_ipad[USHA_Max_Message_Block_Size];
+
+	/* temporary buffer when keylen > blocksize */
+	unsigned char tempkey[USHAMaxHashSize];
+
+	if (!context) return shaNull;
+	context->Computed = 0;
+	context->Corrupted = shaSuccess;
+
+	blocksize = context->blockSize = USHABlockSize(whichSha);
+	hashsize = context->hashSize = USHAHashSize(whichSha);
+	context->whichSha = whichSha;
+
+	/*
+	 * If key is longer than the hash blocksize,
+	 * reset it to key = HASH(key).
+	 */
+	if (key_len > blocksize) {
+		USHAContext tcontext;
+		int err = USHAReset(&tcontext, whichSha) ||
+			USHAInput(&tcontext, key, key_len) ||
+			USHAResult(&tcontext, tempkey);
+		if (err != shaSuccess) return err;
+
+		key = tempkey;
+		key_len = hashsize;
+	}
+
+	/*
+	 * The HMAC transform looks like:
+	 *
+	 * SHA(K XOR opad, SHA(K XOR ipad, text))
+	 *
+	 * where K is an n byte key, 0-padded to a total of blocksize bytes,
+	 * ipad is the byte 0x36 repeated blocksize times,
+	 * opad is the byte 0x5c repeated blocksize times,
+	 * and text is the data being protected.
+	 */
+
+	 /* store key into the pads, XOR'd with ipad and opad values */
+	for (i = 0; i < key_len; i++) {
+		k_ipad[i] = key[i] ^ 0x36;
+		context->k_opad[i] = key[i] ^ 0x5c;
+	}
+	/* remaining pad bytes are '\0' XOR'd with ipad and opad values */
+	for (; i < blocksize; i++) {
+		k_ipad[i] = 0x36;
+		context->k_opad[i] = 0x5c;
+	}
+
+	/* perform inner hash */
+	/* init context for 1st pass */
+	ret = USHAReset(&context->shaContext, whichSha) ||
+		/* and start with inner pad */
+		USHAInput(&context->shaContext, k_ipad, blocksize);
+	return context->Corrupted = ret;
+}
+
+/*
+ *  hmacInput
+ *
+ *  Description:
+ *      This function accepts an array of octets as the next portion
+ *      of the message.  It may be called multiple times.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The HMAC context to update.
+ *      text[ ]: [in]
+ *          An array of octets representing the next portion of
+ *          the message.
+ *      text_len: [in]
+ *          The length of the message in text.
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int hmacInput(HMACContext *context, const unsigned char *text,
+	size_t text_len)
+{
+	if (!context) return shaNull;
+	if (context->Corrupted) return context->Corrupted;
+	if (context->Computed) return context->Corrupted = shaStateError;
+	/* then text of datagram */
+	return context->Corrupted =
+		USHAInput(&context->shaContext, text, text_len);
+}
+
+/*
+ * hmacFinalBits
+ *
+ * Description:
+ *   This function will add in any final bits of the message.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The HMAC context to update.
+ *   message_bits: [in]
+ *     The final bits of the message, in the upper portion of the
+ *     byte.  (Use 0b###00000 instead of 0b00000### to input the
+ *     three bits ###.)
+ *   length: [in]
+ *     The number of bits in message_bits, between 1 and 7.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int hmacFinalBits(HMACContext *context,
+	uint8_t bits, unsigned int bit_count)
+{
+	if (!context) return shaNull;
+	if (context->Corrupted) return context->Corrupted;
+	if (context->Computed) return context->Corrupted = shaStateError;
+	/* then final bits of datagram */
+	return context->Corrupted =
+		USHAFinalBits(&context->shaContext, bits, bit_count);
+}
+
+/*
+ * hmacResult
+ *
+ * Description:
+ *   This function will return the N-byte message digest into the
+ *   Message_Digest array provided by the caller.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to use to calculate the HMAC hash.
+ *   digest[ ]: [out]
+ *     Where the digest is returned.
+ *     NOTE 2: The length of the hash is determined by the value of
+ *      whichSha that was passed to hmacReset().
+ *
+ * Returns:
+ *   sha Error Code.
+ *
+ */
+int hmacResult(HMACContext *context, uint8_t *digest)
+{
+	int ret;
+	if (!context) return shaNull;
+	if (context->Corrupted) return context->Corrupted;
+	if (context->Computed) return context->Corrupted = shaStateError;
+
+	/* finish up 1st pass */
+	/* (Use digest here as a temporary buffer.) */
+	ret =
+		USHAResult(&context->shaContext, digest) ||
+
+		/* perform outer SHA */
+		/* init context for 2nd pass */
+		USHAReset(&context->shaContext, context->whichSha) ||
+
+		/* start with outer pad */
+		USHAInput(&context->shaContext, context->k_opad,
+			context->blockSize) ||
+
+		/* then results of 1st hash */
+		USHAInput(&context->shaContext, digest, context->hashSize) ||
+		/* finish up 2nd pass */
+		USHAResult(&context->shaContext, digest);
+
+	context->Computed = 1;
+	return context->Corrupted = ret;
+}

nfq/crypto/sha-private.h

@@ -0,0 +1,25 @@
+/************************ sha-private.h ************************/
+/***************** See RFC 6234 for details. *******************/
+#pragma once
+/*
+ * These definitions are defined in FIPS 180-3, section 4.1.
+ * Ch() and Maj() are defined identically in sections 4.1.1,
+ * 4.1.2, and 4.1.3.
+ *
+ * The definitions used in FIPS 180-3 are as follows:
+ */
+
+#ifndef USE_MODIFIED_MACROS
+#define SHA_Ch(x,y,z)        (((x) & (y)) ^ ((~(x)) & (z)))
+#define SHA_Maj(x,y,z)       (((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+#else /* USE_MODIFIED_MACROS */
+/*
+ * The following definitions are equivalent and potentially faster.
+ */
+
+#define SHA_Ch(x, y, z)      (((x) & ((y) ^ (z))) ^ (z))
+#define SHA_Maj(x, y, z)     (((x) & ((y) | (z))) | ((y) & (z)))
+
+#endif /* USE_MODIFIED_MACROS */
+
+#define SHA_Parity(x, y, z)  ((x) ^ (y) ^ (z))

nfq/crypto/sha.h

@@ -0,0 +1,278 @@
+/**************************** sha.h ****************************/
+/***************** See RFC 6234 for details. *******************/
+/*
+   Copyright (c) 2011 IETF Trust and the persons identified as
+   authors of the code.  All rights reserved.
+   Redistribution and use in source and binary forms, with or
+   without modification, are permitted provided that the following
+   conditions are met:
+   - Redistributions of source code must retain the above
+     copyright notice, this list of conditions and
+     the following disclaimer.
+   - Redistributions in binary form must reproduce the above
+     copyright notice, this list of conditions and the following
+     disclaimer in the documentation and/or other materials provided
+     with the distribution.
+   - Neither the name of Internet Society, IETF or IETF Trust, nor
+     the names of specific contributors, may be used to endorse or
+     promote products derived from this software without specific
+     prior written permission.
+   THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND
+   CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+   INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+   MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+   CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+   SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+   NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+   LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+   HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+   CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+   OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
+   EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#pragma once
+
+/*
+ *  Description:
+ *      This file implements the Secure Hash Algorithms
+ *      as defined in the U.S. National Institute of Standards
+ *      and Technology Federal Information Processing Standards
+ *      Publication (FIPS PUB) 180-3 published in October 2008
+ *      and formerly defined in its predecessors, FIPS PUB 180-1
+ *      and FIP PUB 180-2.
+ *
+ *      A combined document showing all algorithms is available at
+ *              http://csrc.nist.gov/publications/fips/
+ *                     fips180-3/fips180-3_final.pdf
+ *
+ *      The five hashes are defined in these sizes:
+ *              SHA-1           20 byte / 160 bit
+ *              SHA-224         28 byte / 224 bit
+ *              SHA-256         32 byte / 256 bit
+ *              SHA-384         48 byte / 384 bit
+ *              SHA-512         64 byte / 512 bit
+ *
+ *  Compilation Note:
+ *    These files may be compiled with two options:
+ *        USE_32BIT_ONLY - use 32-bit arithmetic only, for systems
+ *                         without 64-bit integers
+ *
+ *        USE_MODIFIED_MACROS - use alternate form of the SHA_Ch()
+ *                         and SHA_Maj() macros that are equivalent
+ *                         and potentially faster on many systems
+ *
+ */
+
+#include <stdint.h>
+#include <stddef.h>
+
+/*
+ * If you do not have the ISO standard stdint.h header file, then you
+ * must typedef the following:
+ *    name              meaning
+ *  uint64_t         unsigned 64-bit integer
+ *  uint32_t         unsigned 32-bit integer
+ *  uint8_t          unsigned 8-bit integer (i.e., unsigned char)
+ *  int_least16_t    integer of >= 16 bits
+ *
+ * See stdint-example.h
+ */
+
+#ifndef _SHA_enum_
+#define _SHA_enum_
+/*
+ *  All SHA functions return one of these values.
+ */
+enum {
+    shaSuccess = 0,
+    shaNull,            /* Null pointer parameter */
+    shaInputTooLong,    /* input data too long */
+    shaStateError,      /* called Input after FinalBits or Result */
+    shaBadParam         /* passed a bad parameter */
+};
+#endif /* _SHA_enum_ */
+
+/*
+ *  These constants hold size information for each of the SHA
+ *  hashing operations
+ */
+enum {
+    SHA1_Message_Block_Size = 64, SHA224_Message_Block_Size = 64,
+    SHA256_Message_Block_Size = 64,
+    USHA_Max_Message_Block_Size = SHA256_Message_Block_Size,
+
+    SHA1HashSize = 20, SHA224HashSize = 28, SHA256HashSize = 32,
+    USHAMaxHashSize = SHA256HashSize,
+
+    SHA1HashSizeBits = 160, SHA224HashSizeBits = 224,
+    SHA256HashSizeBits = 256, USHAMaxHashSizeBits = SHA256HashSizeBits
+};
+
+/*
+ *  These constants are used in the USHA (Unified SHA) functions.
+ */
+typedef enum SHAversion {
+    SHA224, SHA256
+} SHAversion;
+
+/*
+ *  This structure will hold context information for the SHA-256
+ *  hashing operation.
+ */
+typedef struct SHA256Context {
+    uint32_t Intermediate_Hash[SHA256HashSize/4]; /* Message Digest */
+
+    uint32_t Length_High;               /* Message length in bits */
+    uint32_t Length_Low;                /* Message length in bits */
+
+    int_least16_t Message_Block_Index;  /* Message_Block array index */
+                                        /* 512-bit message blocks */
+    uint8_t Message_Block[SHA256_Message_Block_Size];
+
+    int Computed;                   /* Is the hash computed? */
+    int Corrupted;                  /* Cumulative corruption code */
+} SHA256Context;
+
+/*
+ *  This structure will hold context information for the SHA-224
+ *  hashing operation.  It uses the SHA-256 structure for computation.
+ */
+typedef struct SHA256Context SHA224Context;
+
+/*
+ *  This structure holds context information for all SHA
+ *  hashing operations.
+ */
+typedef struct USHAContext {
+    int whichSha;               /* which SHA is being used */
+    union {
+      SHA224Context sha224Context; SHA256Context sha256Context;
+    } ctx;
+
+} USHAContext;
+
+/*
+ *  This structure will hold context information for the HMAC
+ *  keyed-hashing operation.
+ */
+typedef struct HMACContext {
+    int whichSha;               /* which SHA is being used */
+    int hashSize;               /* hash size of SHA being used */
+    int blockSize;              /* block size of SHA being used */
+    USHAContext shaContext;     /* SHA context */
+    unsigned char k_opad[USHA_Max_Message_Block_Size];
+                        /* outer padding - key XORd with opad */
+    int Computed;               /* Is the MAC computed? */
+    int Corrupted;              /* Cumulative corruption code */
+
+} HMACContext;
+
+/*
+ *  This structure will hold context information for the HKDF
+ *  extract-and-expand Key Derivation Functions.
+ */
+typedef struct HKDFContext {
+    int whichSha;               /* which SHA is being used */
+    HMACContext hmacContext;
+    int hashSize;               /* hash size of SHA being used */
+    unsigned char prk[USHAMaxHashSize];
+                        /* pseudo-random key - output of hkdfInput */
+    int Computed;               /* Is the key material computed? */
+    int Corrupted;              /* Cumulative corruption code */
+} HKDFContext;
+
+/*
+ *  Function Prototypes
+ */
+
+
+/* SHA-224 */
+int SHA224Reset(SHA224Context *);
+int SHA224Input(SHA224Context *, const uint8_t *bytes,
+                       unsigned int bytecount);
+int SHA224FinalBits(SHA224Context *, uint8_t bits,
+                           unsigned int bit_count);
+int SHA224Result(SHA224Context *,
+                        uint8_t Message_Digest[SHA224HashSize]);
+
+/* SHA-256 */
+int SHA256Reset(SHA256Context *);
+int SHA256Input(SHA256Context *, const uint8_t *bytes,
+                       unsigned int bytecount);
+int SHA256FinalBits(SHA256Context *, uint8_t bits,
+                           unsigned int bit_count);
+int SHA256Result(SHA256Context *,
+                        uint8_t Message_Digest[SHA256HashSize]);
+
+/* Unified SHA functions, chosen by whichSha */
+int USHAReset(USHAContext *context, SHAversion whichSha);
+int USHAInput(USHAContext *context,
+                     const uint8_t *bytes, unsigned int bytecount);
+int USHAFinalBits(USHAContext *context,
+                         uint8_t bits, unsigned int bit_count);
+int USHAResult(USHAContext *context,
+                      uint8_t Message_Digest[USHAMaxHashSize]);
+int USHABlockSize(enum SHAversion whichSha);
+int USHAHashSize(enum SHAversion whichSha);
+
+/*
+ * HMAC Keyed-Hashing for Message Authentication, RFC 2104,
+ * for all SHAs.
+ * This interface allows a fixed-length text input to be used.
+ */
+int hmac(SHAversion whichSha, /* which SHA algorithm to use */
+    const unsigned char *text,     /* pointer to data stream */
+    size_t text_len,                  /* length of data stream */
+    const unsigned char *key,      /* pointer to authentication key */
+    size_t key_len,                   /* length of authentication key */
+    uint8_t digest[USHAMaxHashSize]); /* caller digest to fill in */
+
+/*
+ * HMAC Keyed-Hashing for Message Authentication, RFC 2104,
+ * for all SHAs.
+ * This interface allows any length of text input to be used.
+ */
+int hmacReset(HMACContext *context, enum SHAversion whichSha,
+                     const unsigned char *key, size_t key_len);
+int hmacInput(HMACContext *context, const unsigned char *text,
+                     size_t text_len);
+int hmacFinalBits(HMACContext *context, uint8_t bits,
+                         unsigned int bit_count);
+int hmacResult(HMACContext *context,
+                      uint8_t digest[USHAMaxHashSize]);
+
+
+/*
+ * HKDF HMAC-based Extract-and-Expand Key Derivation Function,
+ * RFC 5869, for all SHAs.
+ */
+int hkdf(SHAversion whichSha,
+    const unsigned char *salt, size_t salt_len,
+    const unsigned char *ikm, size_t ikm_len,
+    const unsigned char *info, size_t info_len,
+    uint8_t okm[ ], size_t okm_len);
+
+int hkdfExtract(SHAversion whichSha, const unsigned char *salt,
+                       size_t salt_len, const unsigned char *ikm,
+                       size_t ikm_len, uint8_t prk[USHAMaxHashSize]);
+int hkdfExpand(SHAversion whichSha, const uint8_t prk[ ],
+                      size_t prk_len, const unsigned char *info,
+                      size_t info_len, uint8_t okm[ ], size_t okm_len);
+
+/*
+ * HKDF HMAC-based Extract-and-Expand Key Derivation Function,
+ * RFC 5869, for all SHAs.
+ * This interface allows any length of text input to be used.
+ */
+int hkdfReset(HKDFContext *context, enum SHAversion whichSha,
+                     const unsigned char *salt, size_t salt_len);
+int hkdfInput(HKDFContext *context, const unsigned char *ikm,
+                     size_t ikm_len);
+int hkdfFinalBits(HKDFContext *context, uint8_t ikm_bits,
+                         unsigned int ikm_bit_count);
+int hkdfResult(HKDFContext *context,
+                      uint8_t prk[USHAMaxHashSize],
+                      const unsigned char *info, size_t info_len,
+                      uint8_t okm[USHAMaxHashSize], size_t okm_len);

nfq/crypto/sha224-256.c

@@ -0,0 +1,581 @@
+/************************* sha224-256.c ************************/
+/***************** See RFC 6234 for details. *******************/
+/* Copyright (c) 2011 IETF Trust and the persons identified as */
+/* authors of the code.  All rights reserved.                  */
+/* See sha.h for terms of use and redistribution.              */
+
+/*
+ * Description:
+ *   This file implements the Secure Hash Algorithms SHA-224 and
+ *   SHA-256 as defined in the U.S. National Institute of Standards
+ *   and Technology Federal Information Processing Standards
+ *   Publication (FIPS PUB) 180-3 published in October 2008
+ *   and formerly defined in its predecessors, FIPS PUB 180-1
+ *   and FIP PUB 180-2.
+ *
+ *   A combined document showing all algorithms is available at
+ *       http://csrc.nist.gov/publications/fips/
+ *              fips180-3/fips180-3_final.pdf
+ *
+ *   The SHA-224 and SHA-256 algorithms produce 224-bit and 256-bit
+ *   message digests for a given data stream.  It should take about
+ *   2**n steps to find a message with the same digest as a given
+ *   message and 2**(n/2) to find any two messages with the same
+ *   digest, when n is the digest size in bits.  Therefore, this
+ *   algorithm can serve as a means of providing a
+ *   "fingerprint" for a message.
+ *
+ * Portability Issues:
+ *   SHA-224 and SHA-256 are defined in terms of 32-bit "words".
+ *   This code uses <stdint.h> (included via "sha.h") to define 32-
+ *   and 8-bit unsigned integer types.  If your C compiler does not
+ *   support 32-bit unsigned integers, this code is not
+ *   appropriate.
+ *
+ * Caveats:
+ *   SHA-224 and SHA-256 are designed to work with messages less
+ *   than 2^64 bits long.  This implementation uses SHA224/256Input()
+ *   to hash the bits that are a multiple of the size of an 8-bit
+ *   octet, and then optionally uses SHA224/256FinalBits()
+ *   to hash the final few bits of the input.
+ */
+
+#include "sha.h"
+#include "sha-private.h"
+
+/* Define the SHA shift, rotate left, and rotate right macros */
+#define SHA256_SHR(bits,word)      ((word) >> (bits))
+#define SHA256_ROTL(bits,word)                         \
+  (((word) << (bits)) | ((word) >> (32-(bits))))
+#define SHA256_ROTR(bits,word)                         \
+  (((word) >> (bits)) | ((word) << (32-(bits))))
+
+/* Define the SHA SIGMA and sigma macros */
+#define SHA256_SIGMA0(word)   \
+  (SHA256_ROTR( 2,word) ^ SHA256_ROTR(13,word) ^ SHA256_ROTR(22,word))
+#define SHA256_SIGMA1(word)   \
+  (SHA256_ROTR( 6,word) ^ SHA256_ROTR(11,word) ^ SHA256_ROTR(25,word))
+#define SHA256_sigma0(word)   \
+  (SHA256_ROTR( 7,word) ^ SHA256_ROTR(18,word) ^ SHA256_SHR( 3,word))
+#define SHA256_sigma1(word)   \
+  (SHA256_ROTR(17,word) ^ SHA256_ROTR(19,word) ^ SHA256_SHR(10,word))
+
+/*
+ * Add "length" to the length.
+ * Set Corrupted when overflow has occurred.
+ */
+static uint32_t addTemp;
+#define SHA224_256AddLength(context, length)               \
+  (addTemp = (context)->Length_Low, (context)->Corrupted = \
+    (((context)->Length_Low += (length)) < addTemp) &&     \
+    (++(context)->Length_High == 0) ? shaInputTooLong :    \
+                                      (context)->Corrupted )
+
+/* Local Function Prototypes */
+static int SHA224_256Reset(SHA256Context *context, uint32_t *H0);
+static void SHA224_256ProcessMessageBlock(SHA256Context *context);
+static void SHA224_256Finalize(SHA256Context *context,
+  uint8_t Pad_Byte);
+static void SHA224_256PadMessage(SHA256Context *context,
+  uint8_t Pad_Byte);
+static int SHA224_256ResultN(SHA256Context *context,
+  uint8_t Message_Digest[ ], int HashSize);
+
+/* Initial Hash Values: FIPS 180-3 section 5.3.2 */
+static uint32_t SHA224_H0[SHA256HashSize/4] = {
+    0xC1059ED8, 0x367CD507, 0x3070DD17, 0xF70E5939,
+    0xFFC00B31, 0x68581511, 0x64F98FA7, 0xBEFA4FA4
+};
+
+/* Initial Hash Values: FIPS 180-3 section 5.3.3 */
+static uint32_t SHA256_H0[SHA256HashSize/4] = {
+  0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A,
+  0x510E527F, 0x9B05688C, 0x1F83D9AB, 0x5BE0CD19
+};
+
+/*
+ * SHA224Reset
+ *
+ * Description:
+ *   This function will initialize the SHA224Context in preparation
+ *   for computing a new SHA224 message digest.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to reset.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA224Reset(SHA224Context *context)
+{
+  return SHA224_256Reset(context, SHA224_H0);
+}
+
+/*
+ * SHA224Input
+ *
+ * Description:
+ *   This function accepts an array of octets as the next portion
+ *   of the message.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *   message_array[ ]: [in]
+ *     An array of octets representing the next portion of
+ *     the message.
+ *   length: [in]
+ *     The length of the message in message_array.
+ *
+ * Returns:
+ *   sha Error Code.
+ *
+ */
+int SHA224Input(SHA224Context *context, const uint8_t *message_array,
+    unsigned int length)
+{
+  return SHA256Input(context, message_array, length);
+}
+
+/*
+ * SHA224FinalBits
+ *
+ * Description:
+ *   This function will add in any final bits of the message.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *   message_bits: [in]
+ *     The final bits of the message, in the upper portion of the
+ *     byte.  (Use 0b###00000 instead of 0b00000### to input the
+ *     three bits ###.)
+ *   length: [in]
+ *     The number of bits in message_bits, between 1 and 7.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA224FinalBits(SHA224Context *context,
+                    uint8_t message_bits, unsigned int length)
+{
+  return SHA256FinalBits(context, message_bits, length);
+}
+
+/*
+ * SHA224Result
+ *
+ * Description:
+ *   This function will return the 224-bit message digest
+ *   into the Message_Digest array provided by the caller.
+ *   NOTE:
+ *    The first octet of hash is stored in the element with index 0,
+ *    the last octet of hash in the element with index 27.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to use to calculate the SHA hash.
+ *   Message_Digest[ ]: [out]
+ *     Where the digest is returned.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA224Result(SHA224Context *context,
+    uint8_t Message_Digest[SHA224HashSize])
+{
+  return SHA224_256ResultN(context, Message_Digest, SHA224HashSize);
+}
+
+/*
+ * SHA256Reset
+ *
+ * Description:
+ *   This function will initialize the SHA256Context in preparation
+ *   for computing a new SHA256 message digest.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to reset.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA256Reset(SHA256Context *context)
+{
+  return SHA224_256Reset(context, SHA256_H0);
+}
+
+/*
+ * SHA256Input
+ *
+ * Description:
+ *   This function accepts an array of octets as the next portion
+ *   of the message.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *   message_array[ ]: [in]
+ *     An array of octets representing the next portion of
+ *     the message.
+ *   length: [in]
+ *     The length of the message in message_array.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA256Input(SHA256Context *context, const uint8_t *message_array,
+    unsigned int length)
+{
+  if (!context) return shaNull;
+  if (!length) return shaSuccess;
+  if (!message_array) return shaNull;
+  if (context->Computed) return context->Corrupted = shaStateError;
+  if (context->Corrupted) return context->Corrupted;
+
+  while (length--) {
+    context->Message_Block[context->Message_Block_Index++] =
+            *message_array;
+
+    if ((SHA224_256AddLength(context, 8) == shaSuccess) &&
+      (context->Message_Block_Index == SHA256_Message_Block_Size))
+      SHA224_256ProcessMessageBlock(context);
+
+    message_array++;
+  }
+
+  return context->Corrupted;
+
+}
+
+/*
+ * SHA256FinalBits
+ *
+ * Description:
+ *   This function will add in any final bits of the message.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *   message_bits: [in]
+ *     The final bits of the message, in the upper portion of the
+ *     byte.  (Use 0b###00000 instead of 0b00000### to input the
+ *     three bits ###.)
+ *   length: [in]
+ *     The number of bits in message_bits, between 1 and 7.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA256FinalBits(SHA256Context *context,
+                    uint8_t message_bits, unsigned int length)
+{
+  static uint8_t masks[8] = {
+      /* 0 0b00000000 */ 0x00, /* 1 0b10000000 */ 0x80,
+      /* 2 0b11000000 */ 0xC0, /* 3 0b11100000 */ 0xE0,
+      /* 4 0b11110000 */ 0xF0, /* 5 0b11111000 */ 0xF8,
+      /* 6 0b11111100 */ 0xFC, /* 7 0b11111110 */ 0xFE
+  };
+  static uint8_t markbit[8] = {
+      /* 0 0b10000000 */ 0x80, /* 1 0b01000000 */ 0x40,
+      /* 2 0b00100000 */ 0x20, /* 3 0b00010000 */ 0x10,
+      /* 4 0b00001000 */ 0x08, /* 5 0b00000100 */ 0x04,
+      /* 6 0b00000010 */ 0x02, /* 7 0b00000001 */ 0x01
+  };
+
+  if (!context) return shaNull;
+  if (!length) return shaSuccess;
+  if (context->Corrupted) return context->Corrupted;
+  if (context->Computed) return context->Corrupted = shaStateError;
+  if (length >= 8) return context->Corrupted = shaBadParam;
+
+  SHA224_256AddLength(context, length);
+  SHA224_256Finalize(context, (uint8_t)
+    ((message_bits & masks[length]) | markbit[length]));
+
+  return context->Corrupted;
+}
+
+/*
+ * SHA256Result
+ *
+ * Description:
+ *   This function will return the 256-bit message digest
+ *   into the Message_Digest array provided by the caller.
+ *   NOTE:
+ *    The first octet of hash is stored in the element with index 0,
+ *    the last octet of hash in the element with index 31.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to use to calculate the SHA hash.
+ *   Message_Digest[ ]: [out]
+ *     Where the digest is returned.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int SHA256Result(SHA256Context *context,
+                 uint8_t Message_Digest[SHA256HashSize])
+{
+  return SHA224_256ResultN(context, Message_Digest, SHA256HashSize);
+}
+
+/*
+ * SHA224_256Reset
+ *
+ * Description:
+ *   This helper function will initialize the SHA256Context in
+ *   preparation for computing a new SHA-224 or SHA-256 message digest.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to reset.
+ *   H0[ ]: [in]
+ *     The initial hash value array to use.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+static int SHA224_256Reset(SHA256Context *context, uint32_t *H0)
+{
+  if (!context) return shaNull;
+
+  context->Length_High = context->Length_Low = 0;
+  context->Message_Block_Index  = 0;
+
+  context->Intermediate_Hash[0] = H0[0];
+  context->Intermediate_Hash[1] = H0[1];
+  context->Intermediate_Hash[2] = H0[2];
+  context->Intermediate_Hash[3] = H0[3];
+  context->Intermediate_Hash[4] = H0[4];
+  context->Intermediate_Hash[5] = H0[5];
+  context->Intermediate_Hash[6] = H0[6];
+  context->Intermediate_Hash[7] = H0[7];
+
+  context->Computed  = 0;
+  context->Corrupted = shaSuccess;
+
+  return shaSuccess;
+}
+
+/*
+ * SHA224_256ProcessMessageBlock
+ *
+ * Description:
+ *   This helper function will process the next 512 bits of the
+ *   message stored in the Message_Block array.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *
+ * Returns:
+ *   Nothing.
+ *
+ * Comments:
+ *   Many of the variable names in this code, especially the
+ *   single character names, were used because those were the
+ *   names used in the Secure Hash Standard.
+ */
+static void SHA224_256ProcessMessageBlock(SHA256Context *context)
+{
+  /* Constants defined in FIPS 180-3, section 4.2.2 */
+  static const uint32_t K[64] = {
+      0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b,
+      0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01,
+      0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7,
+      0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+      0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152,
+      0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147,
+      0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc,
+      0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+      0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,
+      0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08,
+      0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f,
+      0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+      0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+  };
+  int        t, t4;                   /* Loop counter */
+  uint32_t   temp1, temp2;            /* Temporary word value */
+  uint32_t   W[64];                   /* Word sequence */
+  uint32_t   A, B, C, D, E, F, G, H;  /* Word buffers */
+
+  /*
+   * Initialize the first 16 words in the array W
+   */
+  for (t = t4 = 0; t < 16; t++, t4 += 4)
+    W[t] = (((uint32_t)context->Message_Block[t4]) << 24) |
+           (((uint32_t)context->Message_Block[t4 + 1]) << 16) |
+           (((uint32_t)context->Message_Block[t4 + 2]) << 8) |
+           (((uint32_t)context->Message_Block[t4 + 3]));
+  for (t = 16; t < 64; t++)
+    W[t] = SHA256_sigma1(W[t-2]) + W[t-7] +
+        SHA256_sigma0(W[t-15]) + W[t-16];
+
+  A = context->Intermediate_Hash[0];
+  B = context->Intermediate_Hash[1];
+  C = context->Intermediate_Hash[2];
+  D = context->Intermediate_Hash[3];
+  E = context->Intermediate_Hash[4];
+  F = context->Intermediate_Hash[5];
+  G = context->Intermediate_Hash[6];
+  H = context->Intermediate_Hash[7];
+
+  for (t = 0; t < 64; t++) {
+    temp1 = H + SHA256_SIGMA1(E) + SHA_Ch(E,F,G) + K[t] + W[t];
+    temp2 = SHA256_SIGMA0(A) + SHA_Maj(A,B,C);
+    H = G;
+    G = F;
+    F = E;
+    E = D + temp1;
+    D = C;
+    C = B;
+    B = A;
+    A = temp1 + temp2;
+  }
+
+  context->Intermediate_Hash[0] += A;
+  context->Intermediate_Hash[1] += B;
+  context->Intermediate_Hash[2] += C;
+  context->Intermediate_Hash[3] += D;
+  context->Intermediate_Hash[4] += E;
+  context->Intermediate_Hash[5] += F;
+  context->Intermediate_Hash[6] += G;
+  context->Intermediate_Hash[7] += H;
+
+  context->Message_Block_Index = 0;
+}
+
+/*
+ * SHA224_256Finalize
+ *
+ * Description:
+ *   This helper function finishes off the digest calculations.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *   Pad_Byte: [in]
+ *     The last byte to add to the message block before the 0-padding
+ *     and length.  This will contain the last bits of the message
+ *     followed by another single bit.  If the message was an
+ *     exact multiple of 8-bits long, Pad_Byte will be 0x80.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+static void SHA224_256Finalize(SHA256Context *context,
+    uint8_t Pad_Byte)
+{
+  int i;
+  SHA224_256PadMessage(context, Pad_Byte);
+  /* message may be sensitive, so clear it out */
+  for (i = 0; i < SHA256_Message_Block_Size; ++i)
+    context->Message_Block[i] = 0;
+  context->Length_High = 0;     /* and clear length */
+  context->Length_Low = 0;
+  context->Computed = 1;
+}
+
+/*
+ * SHA224_256PadMessage
+ *
+ * Description:
+ *   According to the standard, the message must be padded to the next
+ *   even multiple of 512 bits.  The first padding bit must be a '1'.
+ *   The last 64 bits represent the length of the original message.
+ *   All bits in between should be 0.  This helper function will pad
+ *   the message according to those rules by filling the
+ *   Message_Block array accordingly.  When it returns, it can be
+ *   assumed that the message digest has been computed.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to pad.
+ *   Pad_Byte: [in]
+ *     The last byte to add to the message block before the 0-padding
+ *     and length.  This will contain the last bits of the message
+ *     followed by another single bit.  If the message was an
+ *     exact multiple of 8-bits long, Pad_Byte will be 0x80.
+ *
+ * Returns:
+ *   Nothing.
+ */
+static void SHA224_256PadMessage(SHA256Context *context,
+    uint8_t Pad_Byte)
+{
+  /*
+   * Check to see if the current message block is too small to hold
+   * the initial padding bits and length.  If so, we will pad the
+   * block, process it, and then continue padding into a second
+   * block.
+   */
+  if (context->Message_Block_Index >= (SHA256_Message_Block_Size-8)) {
+    context->Message_Block[context->Message_Block_Index++] = Pad_Byte;
+    while (context->Message_Block_Index < SHA256_Message_Block_Size)
+      context->Message_Block[context->Message_Block_Index++] = 0;
+    SHA224_256ProcessMessageBlock(context);
+  } else
+    context->Message_Block[context->Message_Block_Index++] = Pad_Byte;
+
+  while (context->Message_Block_Index < (SHA256_Message_Block_Size-8))
+    context->Message_Block[context->Message_Block_Index++] = 0;
+
+  /*
+   * Store the message length as the last 8 octets
+   */
+  context->Message_Block[56] = (uint8_t)(context->Length_High >> 24);
+  context->Message_Block[57] = (uint8_t)(context->Length_High >> 16);
+  context->Message_Block[58] = (uint8_t)(context->Length_High >> 8);
+  context->Message_Block[59] = (uint8_t)(context->Length_High);
+  context->Message_Block[60] = (uint8_t)(context->Length_Low >> 24);
+  context->Message_Block[61] = (uint8_t)(context->Length_Low >> 16);
+  context->Message_Block[62] = (uint8_t)(context->Length_Low >> 8);
+  context->Message_Block[63] = (uint8_t)(context->Length_Low);
+
+  SHA224_256ProcessMessageBlock(context);
+}
+
+/*
+ * SHA224_256ResultN
+ *
+ * Description:
+ *   This helper function will return the 224-bit or 256-bit message
+ *   digest into the Message_Digest array provided by the caller.
+ *   NOTE:
+ *    The first octet of hash is stored in the element with index 0,
+ *    the last octet of hash in the element with index 27/31.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to use to calculate the SHA hash.
+ *   Message_Digest[ ]: [out]
+ *     Where the digest is returned.
+ *   HashSize: [in]
+ *     The size of the hash, either 28 or 32.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+static int SHA224_256ResultN(SHA256Context *context,
+    uint8_t Message_Digest[ ], int HashSize)
+{
+  int i;
+
+  if (!context) return shaNull;
+  if (!Message_Digest) return shaNull;
+  if (context->Corrupted) return context->Corrupted;
+
+  if (!context->Computed)
+    SHA224_256Finalize(context, 0x80);
+
+  for (i = 0; i < HashSize; ++i)
+    Message_Digest[i] = (uint8_t)
+      (context->Intermediate_Hash[i>>2] >> 8 * ( 3 - ( i & 0x03 ) ));
+
+  return shaSuccess;
+}
+

nfq/crypto/usha.c

@@ -0,0 +1,191 @@
+/**************************** usha.c ***************************/
+/***************** See RFC 6234 for details. *******************/
+/* Copyright (c) 2011 IETF Trust and the persons identified as */
+/* authors of the code.  All rights reserved.                  */
+/* See sha.h for terms of use and redistribution.              */
+
+/*
+ *  Description:
+ *     This file implements a unified interface to the SHA algorithms.
+ */
+
+#include "sha.h"
+
+/*
+ *  USHAReset
+ *
+ *  Description:
+ *      This function will initialize the SHA Context in preparation
+ *      for computing a new SHA message digest.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The context to reset.
+ *      whichSha: [in]
+ *          Selects which SHA reset to call
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int USHAReset(USHAContext *context, enum SHAversion whichSha)
+{
+  if (!context) return shaNull;
+  context->whichSha = whichSha;
+  switch (whichSha) {
+    case SHA224: return SHA224Reset((SHA224Context*)&context->ctx);
+    case SHA256: return SHA256Reset((SHA256Context*)&context->ctx);
+    default: return shaBadParam;
+  }
+}
+
+/*
+ *  USHAInput
+ *
+ *  Description:
+ *      This function accepts an array of octets as the next portion
+ *      of the message.
+ *
+ *  Parameters:
+ *      context: [in/out]
+ *          The SHA context to update.
+ *      message_array: [in]
+ *          An array of octets representing the next portion of
+ *          the message.
+ *      length: [in]
+ *          The length of the message in message_array.
+ *
+ *  Returns:
+ *      sha Error Code.
+ *
+ */
+int USHAInput(USHAContext *context,
+              const uint8_t *bytes, unsigned int bytecount)
+{
+  if (!context) return shaNull;
+  switch (context->whichSha) {
+    case SHA224:
+      return SHA224Input((SHA224Context*)&context->ctx, bytes,
+          bytecount);
+    case SHA256:
+      return SHA256Input((SHA256Context*)&context->ctx, bytes,
+          bytecount);
+    default: return shaBadParam;
+  }
+}
+
+/*
+ * USHAFinalBits
+ *
+ * Description:
+ *   This function will add in any final bits of the message.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The SHA context to update.
+ *   message_bits: [in]
+ *     The final bits of the message, in the upper portion of the
+ *     byte.  (Use 0b###00000 instead of 0b00000### to input the
+ *     three bits ###.)
+ *   length: [in]
+ *     The number of bits in message_bits, between 1 and 7.
+ *
+ * Returns:
+ *   sha Error Code.
+ */
+int USHAFinalBits(USHAContext *context,
+                  uint8_t bits, unsigned int bit_count)
+{
+  if (!context) return shaNull;
+  switch (context->whichSha) {
+    case SHA224:
+      return SHA224FinalBits((SHA224Context*)&context->ctx, bits,
+          bit_count);
+    case SHA256:
+      return SHA256FinalBits((SHA256Context*)&context->ctx, bits,
+          bit_count);
+    default: return shaBadParam;
+  }
+}
+
+/*
+ * USHAResult
+ *
+ * Description:
+ *   This function will return the message digest of the appropriate
+ *   bit size, as returned by USHAHashSizeBits(whichSHA) for the
+ *   'whichSHA' value used in the preceeding call to USHAReset,
+ *   into the Message_Digest array provided by the caller.
+ *
+ * Parameters:
+ *   context: [in/out]
+ *     The context to use to calculate the SHA-1 hash.
+ *   Message_Digest: [out]
+ *     Where the digest is returned.
+ *
+ * Returns:
+ *   sha Error Code.
+ *
+ */
+int USHAResult(USHAContext *context,
+               uint8_t Message_Digest[USHAMaxHashSize])
+{
+  if (!context) return shaNull;
+  switch (context->whichSha) {
+    case SHA224:
+      return SHA224Result((SHA224Context*)&context->ctx,
+                          Message_Digest);
+    case SHA256:
+      return SHA256Result((SHA256Context*)&context->ctx,
+                          Message_Digest);
+    default: return shaBadParam;
+  }
+}
+
+/*
+ * USHABlockSize
+ *
+ * Description:
+ *   This function will return the blocksize for the given SHA
+ *   algorithm.
+ *
+ * Parameters:
+ *   whichSha:
+ *     which SHA algorithm to query
+ *
+ * Returns:
+ *   block size
+ *
+ */
+int USHABlockSize(enum SHAversion whichSha)
+{
+  switch (whichSha) {
+    case SHA224: return SHA224_Message_Block_Size;
+    default:
+    case SHA256: return SHA256_Message_Block_Size;
+  }
+}
+
+/*
+ * USHAHashSize
+ *
+ * Description:
+ *   This function will return the hashsize for the given SHA
+ *   algorithm.
+ *
+ * Parameters:
+ *   whichSha:
+ *     which SHA algorithm to query
+ *
+ * Returns:
+ *   hash size
+ *
+ */
+int USHAHashSize(enum SHAversion whichSha)
+{
+  switch (whichSha) {
+    case SHA224: return SHA224HashSize;
+    default:
+    case SHA256: return SHA256HashSize;
+  }
+}

nfq/darkmagic.h

@@ -0,0 +1,243 @@
+#pragma once
+
+#include "checksum.h"
+#include "packet_queue.h"
+#include "pools.h"
+
+#include <stdint.h>
+#include <stdbool.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/param.h>
+#include <netinet/in.h>
+
+#define __FAVOR_BSD
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/tcp.h>
+#include <netinet/udp.h>
+
+#ifndef IPV6_FREEBIND
+#define IPV6_FREEBIND           78
+#endif
+
+#ifdef __CYGWIN__
+#include "windivert/windivert.h"
+#endif
+
+#ifndef IPPROTO_DIVERT
+#define IPPROTO_DIVERT 258
+#endif
+
+#ifndef AF_DIVERT
+#define	AF_DIVERT	44	/* divert(4) */
+#endif
+#ifndef PF_DIVERT
+#define PF_DIVERT AF_DIVERT
+#endif
+
+// returns netorder value
+uint32_t net32_add(uint32_t netorder_value, uint32_t cpuorder_increment);
+uint32_t net16_add(uint16_t netorder_value, uint16_t cpuorder_increment);
+
+#define FOOL_NONE	0x00
+#define FOOL_MD5SIG	0x01
+#define FOOL_BADSUM	0x02
+#define FOOL_TS		0x04
+#define FOOL_BADSEQ	0x08
+#define FOOL_HOPBYHOP	0x10
+#define FOOL_HOPBYHOP2	0x20
+#define FOOL_DESTOPT	0x40
+#define FOOL_IPFRAG1	0x80
+#define FOOL_DATANOACK	0x100
+
+#define SCALE_NONE ((uint8_t)-1)
+
+#define VERDICT_PASS	0
+#define VERDICT_MODIFY	1
+#define VERDICT_DROP	2
+#define VERDICT_MASK	3
+#define VERDICT_NOCSUM	4
+
+#define IP4_TOS(ip_header) (ip_header ? ip_header->ip_tos : 0)
+#define IP6_FLOW(ip6_header) (ip6_header ? ip6_header->ip6_ctlun.ip6_un1.ip6_un1_flow : 0)
+
+// seq and wsize have network byte order
+bool prepare_tcp_segment4(
+	const struct sockaddr_in *src, const struct sockaddr_in *dst,
+	uint8_t tcp_flags,
+	uint32_t nseq, uint32_t nack_seq,
+	uint16_t nwsize,
+	uint8_t scale_factor,
+	uint32_t *timestamps,
+	uint8_t ttl,
+	uint8_t tos,
+	uint32_t fooling,
+	uint32_t badseq_increment,
+	uint32_t badseq_ack_increment,
+	const void *data, uint16_t len,
+	uint8_t *buf, size_t *buflen);
+bool prepare_tcp_segment6(
+	const struct sockaddr_in6 *src, const struct sockaddr_in6 *dst,
+	uint8_t tcp_flags,
+	uint32_t nseq, uint32_t nack_seq,
+	uint16_t nwsize,
+	uint8_t scale_factor,
+	uint32_t *timestamps,
+	uint8_t ttl,
+	uint32_t flow_label,
+	uint32_t fooling,
+	uint32_t badseq_increment,
+	uint32_t badseq_ack_increment,
+	const void *data, uint16_t len,
+	uint8_t *buf, size_t *buflen);
+bool prepare_tcp_segment(
+	const struct sockaddr *src, const struct sockaddr *dst,
+	uint8_t tcp_flags,
+	uint32_t nseq, uint32_t nack_seq,
+	uint16_t nwsize,
+	uint8_t scale_factor,
+	uint32_t *timestamps,
+	uint8_t ttl,
+	uint8_t tos, uint32_t flow_label,
+	uint32_t fooling,
+	uint32_t badseq_increment,
+	uint32_t badseq_ack_increment,
+	const void *data, uint16_t len,
+	uint8_t *buf, size_t *buflen);
+
+
+bool prepare_udp_segment4(
+	const struct sockaddr_in *src, const struct sockaddr_in *dst,
+	uint8_t ttl,
+	uint8_t tos,
+	uint32_t fooling,
+	const uint8_t *padding, size_t padding_size,
+	int padlen,
+	const void *data, uint16_t len,
+	uint8_t *buf, size_t *buflen);
+bool prepare_udp_segment6(
+	const struct sockaddr_in6 *src, const struct sockaddr_in6 *dst,
+	uint8_t ttl,
+	uint32_t flow_label,
+	uint32_t fooling,
+	const uint8_t *padding, size_t padding_size,
+	int padlen,
+	const void *data, uint16_t len,
+	uint8_t *buf, size_t *buflen);
+bool prepare_udp_segment(
+	const struct sockaddr *src, const struct sockaddr *dst,
+	uint8_t ttl,
+	uint8_t tos, uint32_t flow_label,
+	uint32_t fooling,
+	const uint8_t *padding, size_t padding_size,
+	int padlen,
+	const void *data, uint16_t len,
+	uint8_t *buf, size_t *buflen);
+
+bool ip6_insert_simple_hdr(uint8_t type, uint8_t *data_pkt, size_t len_pkt, uint8_t *buf, size_t *buflen);
+
+// ipv4: ident==-1 - copy ip_id from original ipv4 packet
+bool ip_frag4(
+	const uint8_t *pkt, size_t pkt_size,
+	size_t frag_pos, uint32_t ident,
+	uint8_t *pkt1, size_t *pkt1_size,
+	uint8_t *pkt2, size_t *pkt2_size);
+bool ip_frag6(
+	const uint8_t *pkt, size_t pkt_size,
+	size_t frag_pos, uint32_t ident,
+	uint8_t *pkt1, size_t *pkt1_size,
+	uint8_t *pkt2, size_t *pkt2_size);
+bool ip_frag(
+	const uint8_t *pkt, size_t pkt_size,
+	size_t frag_pos, uint32_t ident,
+	uint8_t *pkt1, size_t *pkt1_size,
+	uint8_t *pkt2, size_t *pkt2_size);
+	
+void rewrite_ttl(struct ip *ip, struct ip6_hdr *ip6, uint8_t ttl);
+
+void extract_ports(const struct tcphdr *tcphdr, const struct udphdr *udphdr, uint8_t *proto, uint16_t *sport, uint16_t *dport);
+void extract_endpoints(const struct ip *ip,const struct ip6_hdr *ip6hdr,const struct tcphdr *tcphdr,const struct udphdr *udphdr, struct sockaddr_storage *src, struct sockaddr_storage *dst);
+uint8_t *tcp_find_option(struct tcphdr *tcp, uint8_t kind);
+uint32_t *tcp_find_timestamps(struct tcphdr *tcp);
+uint8_t tcp_find_scale_factor(const struct tcphdr *tcp);
+bool tcp_has_fastopen(const struct tcphdr *tcp);
+
+#ifdef __CYGWIN__
+extern uint32_t w_win32_error;
+
+bool win_dark_init(const struct str_list_head *ssid_filter, const struct str_list_head *nlm_filter);
+bool win_dark_deinit(void);
+bool logical_net_filter_match(void);
+bool nlm_list(bool bAll);
+bool windivert_init(const char *filter);
+bool windivert_recv(uint8_t *packet, size_t *len, WINDIVERT_ADDRESS *wa);
+bool windivert_send(const uint8_t *packet, size_t len, const WINDIVERT_ADDRESS *wa);
+#else
+// should pre-do it if dropping privileges. otherwise its not necessary
+bool rawsend_preinit(bool bind_fix4, bool bind_fix6);
+#endif
+
+// auto creates internal socket and uses it for subsequent calls
+bool rawsend(const struct sockaddr* dst,uint32_t fwmark,const char *ifout,const void *data,size_t len);
+bool rawsend_rp(const struct rawpacket *rp);
+// return trues if all packets were send successfully
+bool rawsend_queue(struct rawpacket_tailhead *q);
+// cleans up socket autocreated by rawsend
+void rawsend_cleanup(void);
+
+#ifdef BSD
+int socket_divert(sa_family_t family);
+#endif
+
+const char *proto_name(uint8_t proto);
+uint16_t family_from_proto(uint8_t l3proto);
+void print_ip(const struct ip *ip);
+void print_ip6hdr(const struct ip6_hdr *ip6hdr, uint8_t proto);
+void print_tcphdr(const struct tcphdr *tcphdr);
+void print_udphdr(const struct udphdr *udphdr);
+void str_ip(char *s, size_t s_len, const struct ip *ip);
+void str_ip6hdr(char *s, size_t s_len, const struct ip6_hdr *ip6hdr, uint8_t proto);
+void str_srcdst_ip6(char *s, size_t s_len, const void *saddr,const void *daddr);
+void str_tcphdr(char *s, size_t s_len, const struct tcphdr *tcphdr);
+void str_udphdr(char *s, size_t s_len, const struct udphdr *udphdr);
+
+bool proto_check_ipv4(const uint8_t *data, size_t len);
+void proto_skip_ipv4(uint8_t **data, size_t *len);
+bool proto_check_ipv6(const uint8_t *data, size_t len);
+void proto_skip_ipv6(uint8_t **data, size_t *len, uint8_t *proto_type, uint8_t **last_header_type);
+bool proto_check_tcp(const uint8_t *data, size_t len);
+void proto_skip_tcp(uint8_t **data, size_t *len);
+bool proto_check_udp(const uint8_t *data, size_t len);
+void proto_skip_udp(uint8_t **data, size_t *len);
+void proto_dissect_l3l4(
+	uint8_t *data, size_t len,
+	struct ip **ip, struct ip6_hdr **ip6,
+	uint8_t *proto,
+	struct tcphdr **tcp,
+	struct udphdr **udp,
+	size_t *transport_len,
+	uint8_t **data_payload, size_t *len_payload);
+
+bool tcp_synack_segment(const struct tcphdr *tcphdr);
+bool tcp_syn_segment(const struct tcphdr *tcphdr);
+bool tcp_ack_segment(const struct tcphdr *tcphdr);
+// scale_factor=SCALE_NONE - do not change
+void tcp_rewrite_wscale(struct tcphdr *tcp, uint8_t scale_factor);
+void tcp_rewrite_winsize(struct tcphdr *tcp, uint16_t winsize, uint8_t scale_factor);
+
+typedef struct
+{
+	uint8_t delta, min, max;
+} autottl;
+#define AUTOTTL_DEFAULT_DELTA 1
+#define AUTOTTL_DEFAULT_MIN 3
+#define AUTOTTL_DEFAULT_MAX 20
+#define AUTOTTL_ENABLED(a) (!!(a).delta)
+#define AUTOTTL_SET_DEFAULT(a) {(a).delta=AUTOTTL_DEFAULT_DELTA; (a).min=AUTOTTL_DEFAULT_MIN; (a).max=AUTOTTL_DEFAULT_MAX;}
+
+uint8_t autottl_guess(uint8_t ttl, const autottl *attl);
+void do_nat(bool bOutbound, struct ip *ip, struct ip6_hdr *ip6, struct tcphdr *tcphdr, struct udphdr *udphdr, const struct sockaddr_in *target4, const struct sockaddr_in6 *target6);
+
+void verdict_tcp_csum_fix(uint8_t verdict, struct tcphdr *tcphdr, size_t transport_len, struct ip *ip, struct ip6_hdr *ip6hdr);
+void verdict_udp_csum_fix(uint8_t verdict, struct udphdr *udphdr, size_t transport_len, struct ip *ip, struct ip6_hdr *ip6hdr);

nfq/desync.h

@@ -0,0 +1,56 @@
+#pragma once
+
+#include "darkmagic.h"
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#define __FAVOR_BSD
+#include <netinet/ip.h>
+#include <netinet/ip6.h>
+#include <netinet/tcp.h>
+#include <netinet/in.h>
+
+#ifdef __linux__
+#define DPI_DESYNC_FWMARK_DEFAULT 0x40000000
+#else
+#define DPI_DESYNC_FWMARK_DEFAULT 512
+#endif
+
+#define DPI_DESYNC_MAX_FAKE_LEN 9216
+
+enum dpi_desync_mode {
+	DESYNC_NONE=0,
+	DESYNC_INVALID,
+	DESYNC_FAKE,
+	DESYNC_FAKE_KNOWN,
+	DESYNC_RST,
+	DESYNC_RSTACK,
+	DESYNC_SYNACK,
+	DESYNC_SYNDATA,
+	DESYNC_DISORDER,
+	DESYNC_DISORDER2,
+	DESYNC_SPLIT,
+	DESYNC_SPLIT2,
+	DESYNC_IPFRAG2,
+	DESYNC_HOPBYHOP,
+	DESYNC_DESTOPT,
+	DESYNC_IPFRAG1,
+	DESYNC_UDPLEN,
+	DESYNC_TAMPER
+};
+
+extern const char *fake_http_request_default;
+extern const uint8_t fake_tls_clienthello_default[648];
+void randomize_default_tls_payload(uint8_t *p);
+
+enum dpi_desync_mode desync_mode_from_string(const char *s);
+bool desync_valid_zero_stage(enum dpi_desync_mode mode);
+bool desync_valid_first_stage(enum dpi_desync_mode mode);
+bool desync_only_first_stage(enum dpi_desync_mode mode);
+bool desync_valid_second_stage(enum dpi_desync_mode mode);
+bool desync_valid_second_stage_tcp(enum dpi_desync_mode mode);
+bool desync_valid_second_stage_udp(enum dpi_desync_mode mode);
+
+void desync_init(void);
+uint8_t dpi_desync_packet(uint32_t fwmark, const char *ifout, uint8_t *data_pkt, size_t *len_pkt);

nfq/gzip.c

@@ -0,0 +1,82 @@
+#include "gzip.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define ZCHUNK 16384
+#define BUFMIN 128
+#define BUFCHUNK (1024*128)
+
+int z_readfile(FILE *F, char **buf, size_t *size)
+{
+	z_stream zs;
+	int r;
+	unsigned char in[ZCHUNK];
+	size_t bufsize;
+	void *newbuf;
+
+	memset(&zs, 0, sizeof(zs));
+
+	*buf = NULL;
+	bufsize = *size = 0;
+
+	r = inflateInit2(&zs, 47);
+	if (r != Z_OK)  return r;
+
+	do
+	{
+		zs.avail_in = fread(in, 1, sizeof(in), F);
+		if (ferror(F))
+		{
+			r = Z_ERRNO;
+			goto zerr;
+		}
+		if (!zs.avail_in) break;
+		zs.next_in = in;
+		do
+		{
+			if ((bufsize - *size) < BUFMIN)
+			{
+				bufsize += BUFCHUNK;
+				newbuf = *buf ? realloc(*buf, bufsize) : malloc(bufsize);
+				if (!newbuf)
+				{
+					r = Z_MEM_ERROR;
+					goto zerr;
+				}
+				*buf = newbuf;
+			}
+			zs.avail_out = bufsize - *size;
+			zs.next_out = (unsigned char*)(*buf + *size);
+			r = inflate(&zs, Z_NO_FLUSH);
+			if (r != Z_OK && r != Z_STREAM_END) goto zerr;
+			*size = bufsize - zs.avail_out;
+		} while (r == Z_OK && zs.avail_in);
+	} while (r == Z_OK);
+
+	if (*size < bufsize)
+	{
+		// free extra space
+		if ((newbuf = realloc(*buf, *size))) *buf = newbuf;
+	}
+
+	inflateEnd(&zs);
+	return Z_OK;
+
+zerr:
+	inflateEnd(&zs);
+	if (*buf)
+	{
+		free(*buf);
+		*buf = NULL;
+	}
+	return r;
+}
+
+bool is_gzip(FILE* F)
+{
+	unsigned char magic[2];
+	bool b = !fseek(F, 0, SEEK_SET) && fread(magic, 1, 2, F) == 2 && magic[0] == 0x1F && magic[1] == 0x8B;
+	fseek(F, 0, SEEK_SET);
+	return b;
+}

nfq/gzip.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include <stdio.h>
+#include <zlib.h>
+#include <stdbool.h>
+
+int z_readfile(FILE *F,char **buf,size_t *size);
+bool is_gzip(FILE* F);

nfq/helpers.c

@@ -0,0 +1,387 @@
+#define _GNU_SOURCE
+
+#include "helpers.h"
+
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
+#include <ctype.h>
+#include <sys/stat.h>
+#include <libgen.h>
+
+#include "params.h"
+
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit)
+{
+	size_t k;
+	bool bcut = false;
+	if (size > limit)
+	{
+		size = limit;
+		bcut = true;
+	}
+	if (!size) return;
+	for (k = 0; k < size; k++) DLOG("%02X ", data[k]);
+	DLOG(bcut ? "... : " : ": ");
+	for (k = 0; k < size; k++) DLOG("%c", data[k] >= 0x20 && data[k] <= 0x7F ? (char)data[k] : '.');
+	if (bcut) DLOG(" ...");
+}
+
+char *strncasestr(const char *s, const char *find, size_t slen)
+{
+	char c, sc;
+	size_t len;
+
+	if ((c = *find++) != '\0')
+	{
+		len = strlen(find);
+		do
+		{
+			do
+			{
+				if (slen-- < 1 || (sc = *s++) == '\0') return NULL;
+			} while (toupper(c) != toupper(sc));
+			if (len > slen)	return NULL;
+		} while (strncasecmp(s, find, len) != 0);
+		s--;
+	}
+	return (char *)s;
+}
+
+bool load_file(const char *filename, void *buffer, size_t *buffer_size)
+{
+	FILE *F;
+
+	F = fopen(filename, "rb");
+	if (!F) return false;
+
+	*buffer_size = fread(buffer, 1, *buffer_size, F);
+	if (ferror(F))
+	{
+		fclose(F);
+		return false;
+	}
+
+	fclose(F);
+	return true;
+}
+bool load_file_nonempty(const char *filename, void *buffer, size_t *buffer_size)
+{
+	bool b = load_file(filename, buffer, buffer_size);
+	return b && *buffer_size;
+}
+bool save_file(const char *filename, const void *buffer, size_t buffer_size)
+{
+	FILE *F;
+
+	F = fopen(filename, "wb");
+	if (!F) return false;
+
+	fwrite(buffer, 1, buffer_size, F);
+	if (ferror(F))
+	{
+		fclose(F);
+		return false;
+	}
+
+	fclose(F);
+	return true;
+}
+bool append_to_list_file(const char *filename, const char *s)
+{
+	FILE *F = fopen(filename,"at");
+	if (!F) return false;
+	bool bOK = fprintf(F,"%s\n",s)>0;
+	fclose(F);
+	return bOK;
+}
+
+
+void ntop46(const struct sockaddr *sa, char *str, size_t len)
+{
+	if (!len) return;
+	*str = 0;
+	switch (sa->sa_family)
+	{
+	case AF_INET:
+		inet_ntop(sa->sa_family, &((struct sockaddr_in*)sa)->sin_addr, str, len);
+		break;
+	case AF_INET6:
+		inet_ntop(sa->sa_family, &((struct sockaddr_in6*)sa)->sin6_addr, str, len);
+		break;
+	default:
+		snprintf(str, len, "UNKNOWN_FAMILY_%d", sa->sa_family);
+	}
+}
+void ntop46_port(const struct sockaddr *sa, char *str, size_t len)
+{
+	char ip[40];
+	ntop46(sa, ip, sizeof(ip));
+	switch (sa->sa_family)
+	{
+	case AF_INET:
+		snprintf(str, len, "%s:%u", ip, ntohs(((struct sockaddr_in*)sa)->sin_port));
+		break;
+	case AF_INET6:
+		snprintf(str, len, "[%s]:%u", ip, ntohs(((struct sockaddr_in6*)sa)->sin6_port));
+		break;
+	default:
+		snprintf(str, len, "%s", ip);
+	}
+}
+void print_sockaddr(const struct sockaddr *sa)
+{
+	char ip_port[48];
+
+	ntop46_port(sa, ip_port, sizeof(ip_port));
+	printf("%s", ip_port);
+}
+
+bool pton4_port(const char *s, struct sockaddr_in *sa)
+{
+	char ip[16],*p;
+	size_t l;
+	unsigned int u;
+
+	p = strchr(s,':');
+	if (!p) return false;
+	l = p-s;
+	if (l<7 || l>15) return false;
+	memcpy(ip,s,l);
+	ip[l]=0;
+	p++;
+
+	sa->sin_family = AF_INET;
+	if (inet_pton(AF_INET,ip,&sa->sin_addr)!=1 || sscanf(p,"%u",&u)!=1 || !u || u>0xFFFF) return false;
+	sa->sin_port = htons((uint16_t)u);
+	
+	return true;
+}
+bool pton6_port(const char *s, struct sockaddr_in6 *sa)
+{
+	char ip[40],*p;
+	size_t l;
+	unsigned int u;
+
+	if (*s++!='[') return false;
+	p = strchr(s,']');
+	if (!p || p[1]!=':') return false;
+	l = p-s;
+	if (l<2 || l>39) return false;
+	p+=2;
+	memcpy(ip,s,l);
+	ip[l]=0;
+
+	sa->sin6_family = AF_INET6;
+	if (inet_pton(AF_INET6,ip,&sa->sin6_addr)!=1 || sscanf(p,"%u",&u)!=1 || !u || u>0xFFFF) return false;
+	sa->sin6_port = htons((uint16_t)u);
+	sa->sin6_flowinfo = 0;
+	sa->sin6_scope_id = 0;
+	
+	return true;
+}
+
+
+void dbgprint_socket_buffers(int fd)
+{
+	if (params.debug)
+	{
+		int v;
+		socklen_t sz;
+		sz = sizeof(int);
+		if (!getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &v, &sz))
+			DLOG("fd=%d SO_RCVBUF=%d\n", fd, v);
+			sz = sizeof(int);
+		if (!getsockopt(fd, SOL_SOCKET, SO_SNDBUF, &v, &sz))
+			DLOG("fd=%d SO_SNDBUF=%d\n", fd, v);
+	}
+}
+bool set_socket_buffers(int fd, int rcvbuf, int sndbuf)
+{
+	DLOG("set_socket_buffers fd=%d rcvbuf=%d sndbuf=%d\n", fd, rcvbuf, sndbuf);
+	if (rcvbuf && setsockopt(fd, SOL_SOCKET, SO_RCVBUF, &rcvbuf, sizeof(int)) < 0)
+	{
+		DLOG_PERROR("setsockopt (SO_RCVBUF)");
+		close(fd);
+		return false;
+	}
+	if (sndbuf && setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sndbuf, sizeof(int)) < 0)
+	{
+		DLOG_PERROR("setsockopt (SO_SNDBUF)");
+		close(fd);
+		return false;
+	}
+	dbgprint_socket_buffers(fd);
+	return true;
+}
+
+uint64_t pntoh64(const void *p)
+{
+	return (uint64_t)*((const uint8_t *)(p)+0) << 56 |
+		(uint64_t)*((const uint8_t *)(p)+1) << 48 |
+		(uint64_t)*((const uint8_t *)(p)+2) << 40 |
+		(uint64_t)*((const uint8_t *)(p)+3) << 32 |
+		(uint64_t)*((const uint8_t *)(p)+4) << 24 |
+		(uint64_t)*((const uint8_t *)(p)+5) << 16 |
+		(uint64_t)*((const uint8_t *)(p)+6) << 8 |
+		(uint64_t)*((const uint8_t *)(p)+7) << 0;
+}
+void phton64(uint8_t *p, uint64_t v)
+{
+	p[0] = (uint8_t)(v >> 56);
+	p[1] = (uint8_t)(v >> 48);
+	p[2] = (uint8_t)(v >> 40);
+	p[3] = (uint8_t)(v >> 32);
+	p[4] = (uint8_t)(v >> 24);
+	p[5] = (uint8_t)(v >> 16);
+	p[6] = (uint8_t)(v >> 8);
+	p[7] = (uint8_t)(v >> 0);
+}
+
+bool seq_within(uint32_t s, uint32_t s1, uint32_t s2)
+{
+	return (s2>=s1 && s>=s1 && s<=s2) || (s2<s1 && (s<=s2 || s>=s1));
+}
+
+bool ipv6_addr_is_zero(const struct in6_addr *a)
+{
+    return !memcmp(a,"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00",16);
+}
+
+
+#define INVALID_HEX_DIGIT ((uint8_t)-1)
+static inline uint8_t parse_hex_digit(char c)
+{
+	return (c>='0' && c<='9') ? c-'0' : (c>='a' && c<='f') ? c-'a'+0xA : (c>='A' && c<='F') ? c-'A'+0xA : INVALID_HEX_DIGIT;
+}
+static inline bool parse_hex_byte(const char *s, uint8_t *pbyte)
+{
+	uint8_t u,l;
+	u = parse_hex_digit(s[0]);
+	l = parse_hex_digit(s[1]);
+	if (u==INVALID_HEX_DIGIT || l==INVALID_HEX_DIGIT)
+	{
+		*pbyte=0;
+		return false;
+	}
+	else
+	{
+		*pbyte=(u<<4) | l;
+		return true;
+	}
+}
+bool parse_hex_str(const char *s, uint8_t *pbuf, size_t *size)
+{
+	uint8_t *pe = pbuf+*size;
+	*size=0;
+	while(pbuf<pe && *s)
+	{
+		if (!parse_hex_byte(s,pbuf))
+			return false;
+		pbuf++; s+=2; (*size)++;
+	}
+	return true;
+}
+
+void fill_pattern(uint8_t *buf,size_t bufsize,const void *pattern,size_t patsize)
+{
+	size_t size;
+
+	while (bufsize)
+	{
+		size = bufsize>patsize ? patsize : bufsize;
+		memcpy(buf,pattern,size);
+		buf += size;
+		bufsize -= size;
+	}
+}
+
+int fprint_localtime(FILE *F)
+{
+	struct tm t;
+	time_t now;
+
+	time(&now);
+	localtime_r(&now,&t);
+	return fprintf(F, "%02d.%02d.%04d %02d:%02d:%02d", t.tm_mday, t.tm_mon + 1, t.tm_year + 1900, t.tm_hour, t.tm_min, t.tm_sec);
+}
+
+time_t file_mod_time(const char *filename)
+{
+	struct stat st;
+	return stat(filename,&st)==-1 ? 0 : st.st_mtime;
+}
+
+bool pf_in_range(uint16_t port, const port_filter *pf)
+{
+	return port && (((!pf->from && !pf->to) || (port>=pf->from && port<=pf->to)) ^ pf->neg);
+}
+bool pf_parse(const char *s, port_filter *pf)
+{
+	unsigned int v1,v2;
+	char c;
+
+	if (!s) return false;
+	if (*s=='~')
+	{
+		pf->neg=true;
+		s++;
+	}
+	else
+		pf->neg=false;
+	if (sscanf(s,"%u-%u%c",&v1,&v2,&c)==2)
+	{
+		if (v1>65535 || v2>65535 || v1>v2) return false;
+		pf->from=(uint16_t)v1;
+		pf->to=(uint16_t)v2;
+	}
+	else if (sscanf(s,"%u%c",&v1,&c)==1)
+	{
+		if (v1>65535) return false;
+		pf->to=pf->from=(uint16_t)v1;
+	}
+	else
+		return false;
+	// deny all case
+	if (!pf->from && !pf->to) pf->neg=true;
+	return true;
+}
+bool pf_is_empty(const port_filter *pf)
+{
+	return !pf->neg && !pf->from && !pf->to;
+}
+
+void fill_random_bytes(uint8_t *p,size_t sz)
+{
+	size_t k,sz16 = sz>>1;
+	for(k=0;k<sz16;k++) ((uint16_t*)p)[k]=(uint16_t)random();
+	if (sz & 1) p[sz-1]=(uint8_t)random();
+}
+void fill_random_az(uint8_t *p,size_t sz)
+{
+	size_t k;
+	for(k=0;k<sz;k++) p[k] = 'a'+(random() % ('z'-'a'));
+}
+void fill_random_az09(uint8_t *p,size_t sz)
+{
+	size_t k;
+	uint8_t rnd;
+	for(k=0;k<sz;k++)
+	{
+		rnd = random() % (10 + 'z'-'a'+1);
+		p[k] = rnd<10 ? rnd+'0' : 'a'+rnd-10;
+	}
+}
+
+bool cd_to_exe_dir(const char *argv0)
+{
+	char *s,*d;
+	bool bOK=false;
+	if ((s = strdup(argv0)))
+	{
+		if ((d = dirname(s)))
+			bOK = !chdir(d);
+		free(s);
+	}
+	return bOK;
+}

nfq/helpers.h

@@ -0,0 +1,66 @@
+#pragma once
+
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <sys/socket.h>
+#include <stddef.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <time.h>
+
+void hexdump_limited_dlog(const uint8_t *data, size_t size, size_t limit);
+char *strncasestr(const char *s,const char *find, size_t slen);
+bool load_file(const char *filename,void *buffer,size_t *buffer_size);
+bool load_file_nonempty(const char *filename,void *buffer,size_t *buffer_size);
+bool save_file(const char *filename, const void *buffer, size_t buffer_size);
+bool append_to_list_file(const char *filename, const char *s);
+
+void print_sockaddr(const struct sockaddr *sa);
+void ntop46(const struct sockaddr *sa, char *str, size_t len);
+void ntop46_port(const struct sockaddr *sa, char *str, size_t len);
+bool pton4_port(const char *s, struct sockaddr_in *sa);
+bool pton6_port(const char *s, struct sockaddr_in6 *sa);
+
+bool seq_within(uint32_t s, uint32_t s1, uint32_t s2);
+
+void dbgprint_socket_buffers(int fd);
+bool set_socket_buffers(int fd, int rcvbuf, int sndbuf);
+
+uint64_t pntoh64(const void *p);
+void phton64(uint8_t *p, uint64_t v);
+
+bool ipv6_addr_is_zero(const struct in6_addr *a);
+
+static inline uint16_t pntoh16(const uint8_t *p) {
+	return ((uint16_t)p[0] << 8) | (uint16_t)p[1];
+}
+static inline void phton16(uint8_t *p, uint16_t v) {
+	p[0] = (uint8_t)(v >> 8);
+	p[1] = v & 0xFF;
+}
+static inline uint32_t pntoh32(const uint8_t *p) {
+	return ((uint32_t)p[0] << 24) | ((uint32_t)p[1] << 16) | ((uint32_t)p[2] << 8) | (uint32_t)p[3];
+}
+
+bool parse_hex_str(const char *s, uint8_t *pbuf, size_t *size);
+void fill_pattern(uint8_t *buf,size_t bufsize,const void *pattern,size_t patsize);
+
+int fprint_localtime(FILE *F);
+
+time_t file_mod_time(const char *filename);
+
+typedef struct
+{
+	uint16_t from,to;
+	bool neg;
+} port_filter;
+bool pf_in_range(uint16_t port, const port_filter *pf);
+bool pf_parse(const char *s, port_filter *pf);
+bool pf_is_empty(const port_filter *pf);
+
+void fill_random_bytes(uint8_t *p,size_t sz);
+void fill_random_az(uint8_t *p,size_t sz);
+void fill_random_az09(uint8_t *p,size_t sz);
+
+bool cd_to_exe_dir(const char *argv0);

nfq/hostlist.c

@@ -0,0 +1,205 @@
+#include <stdio.h>
+#include "hostlist.h"
+#include "gzip.h"
+#include "helpers.h"
+
+// inplace tolower() and add to pool
+static bool addpool(strpool **hostlist, char **s, const char *end)
+{
+	char *p;
+	
+	// advance until eol lowering all chars
+	for (p = *s; p<end && *p && *p!='\r' && *p != '\n'; p++) *p=tolower(*p);
+	if (!StrPoolAddStrLen(hostlist, *s, p-*s))
+	{
+		StrPoolDestroy(hostlist);
+		*hostlist = NULL;
+		return false;
+	}
+	// advance to the next line
+	for (; p<end && (!*p || *p=='\r' || *p=='\n') ; p++);
+	*s = p;
+	return true;
+}
+
+bool AppendHostList(strpool **hostlist, char *filename)
+{
+	char *p, *e, s[256], *zbuf;
+	size_t zsize;
+	int ct = 0;
+	FILE *F;
+	int r;
+
+	DLOG_CONDUP("Loading hostlist %s\n",filename);
+
+	if (!(F = fopen(filename, "rb")))
+	{
+		DLOG_ERR("Could not open %s\n", filename);
+		return false;
+	}
+
+	if (is_gzip(F))
+	{
+		r = z_readfile(F,&zbuf,&zsize);
+		fclose(F);
+		if (r==Z_OK)
+		{
+			DLOG_CONDUP("zlib compression detected. uncompressed size : %zu\n", zsize);
+			
+			p = zbuf;
+			e = zbuf + zsize;
+			while(p<e)
+			{
+				if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue;
+				if (!addpool(hostlist,&p,e))
+				{
+					DLOG_ERR("Not enough memory to store host list : %s\n", filename);
+					free(zbuf);
+					return false;
+				}
+				ct++;
+			}
+			free(zbuf);
+		}
+		else
+		{
+			DLOG_ERR("zlib decompression failed : result %d\n",r);
+			return false;
+		}
+	}
+	else
+	{
+		DLOG_CONDUP("loading plain text list\n");
+		
+		while (fgets(s, 256, F))
+		{
+			p = s;
+			if ( *p == '#' || *p == ';' || *p == '/' || *p == '\n' ) continue;
+			if (!addpool(hostlist,&p,p+strlen(p)))
+			{
+				DLOG_ERR("Not enough memory to store host list : %s\n", filename);
+				fclose(F);
+				return false;
+			}
+			ct++;
+		}
+		fclose(F);
+	}
+
+	DLOG_CONDUP("Loaded %d hosts from %s\n", ct, filename);
+	return true;
+}
+
+bool LoadHostLists(strpool **hostlist, struct str_list_head *file_list)
+{
+	struct str_list *file;
+
+	if (*hostlist)
+	{
+		StrPoolDestroy(hostlist);
+		*hostlist = NULL;
+	}
+
+	LIST_FOREACH(file, file_list, next)
+	{
+		if (!AppendHostList(hostlist, file->str)) return false;
+	}
+	return true;
+}
+
+bool NonEmptyHostlist(strpool **hostlist)
+{
+	// add impossible hostname if the list is empty
+	return *hostlist ? true : StrPoolAddStrLen(hostlist, "@&()", 4);
+}
+
+
+bool SearchHostList(strpool *hostlist, const char *host)
+{
+	if (hostlist)
+	{
+		const char *p = host;
+		bool bInHostList;
+		while (p)
+		{
+			bInHostList = StrPoolCheckStr(hostlist, p);
+			DLOG("Hostlist check for %s : %s\n", p, bInHostList ? "positive" : "negative");
+			if (bInHostList) return true;
+			p = strchr(p, '.');
+			if (p) p++;
+		}
+	}
+	return false;
+}
+
+// return : true = apply fooling, false = do not apply
+static bool HostlistCheck_(strpool *hostlist, strpool *hostlist_exclude, const char *host, bool *excluded)
+{
+	if (excluded) *excluded = false;
+	if (hostlist_exclude)
+	{
+		DLOG("Checking exclude hostlist\n");
+		if (SearchHostList(hostlist_exclude, host))
+		{
+			if (excluded) *excluded = true;
+			return false;
+		}
+	}
+	if (hostlist)
+	{
+		DLOG("Checking include hostlist\n");
+		return SearchHostList(hostlist, host);
+	}
+	return true;
+}
+
+static bool LoadIncludeHostListsForProfile(struct desync_profile *dp)
+{
+	if (!LoadHostLists(&dp->hostlist, &dp->hostlist_files))
+		return false;
+	if (*dp->hostlist_auto_filename)
+	{
+		dp->hostlist_auto_mod_time = file_mod_time(dp->hostlist_auto_filename);
+		NonEmptyHostlist(&dp->hostlist);
+	}
+	return true;
+}
+
+// return : true = apply fooling, false = do not apply
+bool HostlistCheck(struct desync_profile *dp, const char *host, bool *excluded)
+{
+	DLOG("* Hostlist check for profile %d\n",dp->n);
+	if (*dp->hostlist_auto_filename)
+	{
+		time_t t = file_mod_time(dp->hostlist_auto_filename);
+		if (t!=dp->hostlist_auto_mod_time)
+		{
+			DLOG_CONDUP("Autohostlist '%s' from profile %d was modified. Reloading include hostlists for this profile.\n",dp->hostlist_auto_filename, dp->n);
+			if (!LoadIncludeHostListsForProfile(dp))
+			{
+				// what will we do without hostlist ?? sure, gonna die
+				exit(1);
+			}
+			dp->hostlist_auto_mod_time = t;
+			NonEmptyHostlist(&dp->hostlist);
+		}
+	}
+	return HostlistCheck_(dp->hostlist, dp->hostlist_exclude, host, excluded);
+}
+
+bool LoadIncludeHostLists()
+{
+	struct desync_profile_list *dpl;
+	LIST_FOREACH(dpl, &params.desync_profiles, next)
+		if (!LoadIncludeHostListsForProfile(&dpl->dp))
+			return false;
+	return true;
+}
+bool LoadExcludeHostLists()
+{
+	struct desync_profile_list *dpl;
+	LIST_FOREACH(dpl, &params.desync_profiles, next)
+		if (!LoadHostLists(&dpl->dp.hostlist_exclude, &dpl->dp.hostlist_exclude_files))
+			return false;
+	return true;
+}

nfq/hostlist.h

@@ -0,0 +1,14 @@
+#pragma once
+
+#include <stdbool.h>
+#include "pools.h"
+#include "params.h"
+
+bool AppendHostList(strpool **hostlist, char *filename);
+bool LoadHostLists(strpool **hostlist, struct str_list_head *file_list);
+bool LoadIncludeHostLists();
+bool LoadExcludeHostLists();
+bool NonEmptyHostlist(strpool **hostlist);
+bool SearchHostList(strpool *hostlist, const char *host);
+// return : true = apply fooling, false = do not apply
+bool HostlistCheck(struct desync_profile *dp,const char *host, bool *excluded);

nfq/nfqws.h

@@ -0,0 +1,8 @@
+#pragma once
+
+#include <stdbool.h>
+
+#ifdef __CYGWIN__
+extern bool bQuit;
+#endif
+int main(int argc, char *argv[]);

nfq/packet_queue.c

@@ -0,0 +1,68 @@
+#include <stdlib.h>
+#include <string.h>
+
+#include "packet_queue.h"
+
+void rawpacket_queue_init(struct rawpacket_tailhead *q)
+{
+	TAILQ_INIT(q);
+}
+void rawpacket_free(struct rawpacket *rp)
+{
+	if (rp) free(rp->packet);
+	free(rp);
+}
+struct rawpacket *rawpacket_dequeue(struct rawpacket_tailhead *q)
+{
+	struct rawpacket *rp;
+	rp = TAILQ_FIRST(q);
+	if (rp)	TAILQ_REMOVE(q, rp, next);
+	return rp;
+}
+void rawpacket_queue_destroy(struct rawpacket_tailhead *q)
+{
+	struct rawpacket *rp;
+	while((rp = rawpacket_dequeue(q))) rawpacket_free(rp);
+}
+
+struct rawpacket *rawpacket_queue(struct rawpacket_tailhead *q,const struct sockaddr_storage* dst,uint32_t fwmark,const char *ifout,const void *data,size_t len,size_t len_payload)
+{
+	struct rawpacket *rp = malloc(sizeof(struct rawpacket));
+	if (!rp) return NULL;
+
+	rp->packet = malloc(len);
+	if (!rp->packet)
+	{
+		free(rp);
+		return NULL;
+	}
+	
+	rp->dst = *dst;
+	rp->fwmark = fwmark;
+	if (ifout)
+	{
+	    strncpy(rp->ifout,ifout,sizeof(rp->ifout));
+	    rp->ifout[sizeof(rp->ifout)-1]=0;
+	}
+	else
+	    rp->ifout[0]=0;
+	memcpy(rp->packet,data,len);
+	rp->len=len;
+	rp->len_payload=len_payload;
+	
+	TAILQ_INSERT_TAIL(q, rp, next);
+	
+	return rp;
+}
+
+unsigned int rawpacket_queue_count(const struct rawpacket_tailhead *q)
+{
+	const struct rawpacket *rp;
+	unsigned int ct=0;
+	TAILQ_FOREACH(rp, q, next) ct++;
+	return ct;
+}
+bool rawpacket_queue_empty(const struct rawpacket_tailhead *q)
+{
+	return !TAILQ_FIRST(q);
+}

nfq/packet_queue.h

@@ -0,0 +1,26 @@
+#pragma once
+
+#include <inttypes.h>
+#include <stdbool.h>
+#include <sys/queue.h>
+#include <net/if.h>
+#include <sys/socket.h>
+
+struct rawpacket
+{
+	struct sockaddr_storage dst;
+	char ifout[IFNAMSIZ+1];
+	uint32_t fwmark;
+	size_t len, len_payload;
+	uint8_t *packet;
+	TAILQ_ENTRY(rawpacket) next;
+};
+TAILQ_HEAD(rawpacket_tailhead, rawpacket);
+
+void rawpacket_queue_init(struct rawpacket_tailhead *q);
+void rawpacket_queue_destroy(struct rawpacket_tailhead *q);
+bool rawpacket_queue_empty(const struct rawpacket_tailhead *q);
+unsigned int rawpacket_queue_count(const struct rawpacket_tailhead *q);
+struct rawpacket *rawpacket_queue(struct rawpacket_tailhead *q,const struct sockaddr_storage* dst,uint32_t fwmark,const char *ifout,const void *data,size_t len,size_t len_payload);
+struct rawpacket *rawpacket_dequeue(struct rawpacket_tailhead *q);
+void rawpacket_free(struct rawpacket *rp);

nfq/params.c

@@ -0,0 +1,232 @@
+#include "params.h"
+
+#include <stdarg.h>
+#include <syslog.h>
+#include <errno.h>
+
+#include "pools.h"
+#include "desync.h"
+
+#ifdef BSD
+const char *progname = "dvtws";
+#elif defined(__CYGWIN__)
+const char *progname = "winws";
+#elif defined(__linux__)
+const char *progname = "nfqws";
+#else
+#error UNKNOWN_SYSTEM_TIME
+#endif
+
+
+int DLOG_FILE(FILE *F, const char *format, va_list args)
+{
+	return vfprintf(F, format, args);
+}
+int DLOG_CON(const char *format, int syslog_priority, va_list args)
+{
+	return DLOG_FILE(syslog_priority==LOG_ERR ? stderr : stdout, format, args);
+}
+int DLOG_FILENAME(const char *filename, const char *format, va_list args)
+{
+	int r;
+	FILE *F = fopen(filename,"at");
+	if (F)
+	{
+		r = DLOG_FILE(F, format, args);
+		fclose(F);
+	}
+	else
+		r=-1;
+	return r;
+}
+
+static char syslog_buf[1024];
+static size_t syslog_buf_sz=0;
+static void syslog_buffered(int priority, const char *format, va_list args)
+{
+	if (vsnprintf(syslog_buf+syslog_buf_sz,sizeof(syslog_buf)-syslog_buf_sz,format,args)>0)
+	{
+		syslog_buf_sz=strlen(syslog_buf);
+		// log when buffer is full or buffer ends with \n
+		if (syslog_buf_sz>=(sizeof(syslog_buf)-1) || (syslog_buf_sz && syslog_buf[syslog_buf_sz-1]=='\n'))
+		{
+			syslog(priority,"%s",syslog_buf);
+			syslog_buf_sz = 0;
+		}
+	}
+}
+
+static int DLOG_VA(const char *format, int syslog_priority, bool condup, va_list args)
+{
+	int r=0;
+	va_list args2;
+
+	if (condup && !(params.debug && params.debug_target==LOG_TARGET_CONSOLE))
+	{
+		va_copy(args2,args);
+		DLOG_CON(format,syslog_priority,args2);
+	}
+	if (params.debug)
+	{
+		switch(params.debug_target)
+		{
+			case LOG_TARGET_CONSOLE:
+				r = DLOG_CON(format,syslog_priority,args);
+				break;
+			case LOG_TARGET_FILE:
+				r = DLOG_FILENAME(params.debug_logfile,format,args);
+				break;
+			case LOG_TARGET_SYSLOG:
+				// skip newlines
+				syslog_buffered(syslog_priority,format,args);
+				r = 1;
+				break;
+			default:
+				break;
+		}
+	}
+	return r;
+}
+
+int DLOG(const char *format, ...)
+{
+	int r;
+	va_list args;
+	va_start(args, format);
+	r = DLOG_VA(format, LOG_DEBUG, false, args);
+	va_end(args);
+	return r;
+}
+int DLOG_CONDUP(const char *format, ...)
+{
+	int r;
+	va_list args;
+	va_start(args, format);
+	r = DLOG_VA(format, LOG_DEBUG, true, args);
+	va_end(args);
+	return r;
+}
+int DLOG_ERR(const char *format, ...)
+{
+	int r;
+	va_list args;
+	va_start(args, format);
+	r = DLOG_VA(format, LOG_ERR, true, args);
+	va_end(args);
+	return r;
+}
+int DLOG_PERROR(const char *s)
+{
+	return DLOG_ERR("%s: %s\n", s, strerror(errno));
+}
+
+
+int LOG_APPEND(const char *filename, const char *format, va_list args)
+{
+	int r;
+	FILE *F = fopen(filename,"at");
+	if (F)
+	{
+		fprint_localtime(F);
+		fprintf(F, " : ");
+		r = vfprintf(F, format, args);
+		fprintf(F, "\n");
+		fclose(F);
+	}
+	else
+		r=-1;
+	return r;
+}
+
+int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...)
+{
+	if (*params.hostlist_auto_debuglog)
+	{
+		int r;
+		va_list args;
+
+		va_start(args, format);
+		r = LOG_APPEND(params.hostlist_auto_debuglog, format, args);
+		va_end(args);
+		return r;
+	}
+	else
+		return 0;
+}
+
+
+struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head)
+{
+	struct desync_profile_list *entry = calloc(1,sizeof(struct desync_profile_list));
+	if (!entry) return NULL;
+	
+	LIST_INIT(&entry->dp.hostlist_files);
+	LIST_INIT(&entry->dp.hostlist_exclude_files);
+	memcpy(entry->dp.hostspell, "host", 4); // default hostspell
+	entry->dp.desync_skip_nosni = true;
+	entry->dp.desync_split_pos = 2;
+	entry->dp.desync_ipfrag_pos_udp = IPFRAG_UDP_DEFAULT;
+	entry->dp.desync_ipfrag_pos_tcp = IPFRAG_TCP_DEFAULT;
+	entry->dp.desync_repeats = 1;
+	entry->dp.fake_tls_size = sizeof(fake_tls_clienthello_default);
+	memcpy(entry->dp.fake_tls,fake_tls_clienthello_default,entry->dp.fake_tls_size);
+	randomize_default_tls_payload(entry->dp.fake_tls);
+	entry->dp.fake_http_size = strlen(fake_http_request_default);
+	memcpy(entry->dp.fake_http,fake_http_request_default,entry->dp.fake_http_size);
+	entry->dp.fake_quic_size = 620; // must be 601+ for TSPU hack
+	entry->dp.fake_quic[0] = 0x40; // russian TSPU QUIC short header fake
+	entry->dp.fake_wg_size = 64;
+	entry->dp.fake_dht_size = 64;
+	entry->dp.fake_unknown_size = 256;
+	entry->dp.fake_syndata_size = 16;
+	entry->dp.fake_unknown_udp_size = 64;
+	entry->dp.wscale=-1; // default - dont change scale factor (client)
+	entry->dp.desync_ttl6 = 0xFF; // unused
+	entry->dp.desync_badseq_increment = BADSEQ_INCREMENT_DEFAULT;
+	entry->dp.desync_badseq_ack_increment = BADSEQ_ACK_INCREMENT_DEFAULT;
+	entry->dp.wssize_cutoff_mode = entry->dp.desync_start_mode = entry->dp.desync_cutoff_mode = 'n'; // packet number by default
+	entry->dp.udplen_increment = UDPLEN_INCREMENT_DEFAULT;
+	entry->dp.hostlist_auto_fail_threshold = HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT;
+	entry->dp.hostlist_auto_fail_time = HOSTLIST_AUTO_FAIL_TIME_DEFAULT;
+	entry->dp.hostlist_auto_retrans_threshold = HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT;
+	entry->dp.filter_ipv4 = entry->dp.filter_ipv6 = true;
+
+	// add to the tail
+	struct desync_profile_list *dpn,*dpl=LIST_FIRST(&params.desync_profiles);
+	if (dpl)
+	{
+		while ((dpn=LIST_NEXT(dpl,next))) dpl = dpn;
+		LIST_INSERT_AFTER(dpl, entry, next);
+	}
+	else
+		LIST_INSERT_HEAD(&params.desync_profiles, entry, next);
+
+	return entry;
+}
+static void dp_entry_destroy(struct desync_profile_list *entry)
+{
+	strlist_destroy(&entry->dp.hostlist_files);
+	strlist_destroy(&entry->dp.hostlist_exclude_files);
+	StrPoolDestroy(&entry->dp.hostlist_exclude);
+	StrPoolDestroy(&entry->dp.hostlist);
+	HostFailPoolDestroy(&entry->dp.hostlist_auto_fail_counters);
+	free(entry);
+}
+void dp_list_destroy(struct desync_profile_list_head *head)
+{
+	struct desync_profile_list *entry;
+	while ((entry = LIST_FIRST(head)))
+	{
+		LIST_REMOVE(entry, next);
+		dp_entry_destroy(entry);
+	}
+}
+bool dp_list_have_autohostlist(struct desync_profile_list_head *head)
+{
+	struct desync_profile_list *dpl;
+	LIST_FOREACH(dpl, head, next)
+		if (*dpl->dp.hostlist_auto_filename)
+			return true;
+	return false;
+}
+

nfq/params.h

@@ -0,0 +1,123 @@
+#pragma once
+
+#include "pools.h"
+#include "conntrack.h"
+#include "desync.h"
+#include "protocol.h"
+#include "helpers.h"
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <net/if.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <time.h>
+#include <sys/queue.h>
+
+#define TLS_PARTIALS_ENABLE	true
+
+#define Q_RCVBUF	(128*1024)	// in bytes
+#define Q_SNDBUF	(64*1024)	// in bytes
+#define RAW_SNDBUF	(64*1024)	// in bytes
+
+#define Q_MAXLEN	1024		// in packets
+
+#define BADSEQ_INCREMENT_DEFAULT 	-10000
+#define BADSEQ_ACK_INCREMENT_DEFAULT 	-66000
+
+#define IPFRAG_UDP_DEFAULT 8
+#define IPFRAG_TCP_DEFAULT 32
+
+#define UDPLEN_INCREMENT_DEFAULT 	2
+
+#define HOSTLIST_AUTO_FAIL_THRESHOLD_DEFAULT	3
+#define	HOSTLIST_AUTO_FAIL_TIME_DEFAULT 	60
+#define	HOSTLIST_AUTO_RETRANS_THRESHOLD_DEFAULT	3
+
+enum log_target { LOG_TARGET_CONSOLE=0, LOG_TARGET_FILE, LOG_TARGET_SYSLOG };
+
+struct desync_profile
+{
+	int n;	// number of the profile
+
+	uint16_t wsize,wssize;
+	uint8_t wscale,wsscale;
+	char wssize_cutoff_mode; // n - packets, d - data packets, s - relative sequence
+	unsigned int wssize_cutoff;
+
+	bool hostcase, hostnospace, domcase;
+	char hostspell[4];
+	enum dpi_desync_mode desync_mode0,desync_mode,desync_mode2;
+	bool desync_retrans,desync_skip_nosni,desync_any_proto;
+	unsigned int desync_repeats,desync_split_pos,desync_seqovl,desync_ipfrag_pos_tcp,desync_ipfrag_pos_udp;
+	enum httpreqpos desync_split_http_req;
+	enum tlspos desync_split_tls;
+	char desync_start_mode, desync_cutoff_mode; // n - packets, d - data packets, s - relative sequence
+	unsigned int desync_start, desync_cutoff;
+	uint8_t desync_ttl, desync_ttl6;
+	autottl desync_autottl, desync_autottl6;
+	uint32_t desync_fooling_mode;
+	uint32_t desync_badseq_increment, desync_badseq_ack_increment;
+	uint8_t fake_http[1460],fake_tls[1460],fake_unknown[1460],fake_syndata[1460],seqovl_pattern[1460];
+	uint8_t fake_unknown_udp[1472],udplen_pattern[1472],fake_quic[1472],fake_wg[1472],fake_dht[1472];
+	size_t fake_http_size,fake_tls_size,fake_quic_size,fake_wg_size,fake_dht_size,fake_unknown_size,fake_syndata_size,fake_unknown_udp_size;
+	int udplen_increment;
+
+	bool filter_ipv4,filter_ipv6;
+	port_filter pf_tcp,pf_udp;
+	strpool *hostlist, *hostlist_exclude;
+	struct str_list_head hostlist_files, hostlist_exclude_files;
+	char hostlist_auto_filename[PATH_MAX];
+	int hostlist_auto_fail_threshold, hostlist_auto_fail_time, hostlist_auto_retrans_threshold;
+	time_t hostlist_auto_mod_time;
+	hostfail_pool *hostlist_auto_fail_counters;
+};
+
+struct desync_profile_list {
+	struct desync_profile dp;
+	LIST_ENTRY(desync_profile_list) next;
+};
+LIST_HEAD(desync_profile_list_head, desync_profile_list);
+struct desync_profile_list *dp_list_add(struct desync_profile_list_head *head);
+void dp_list_destroy(struct desync_profile_list_head *head);
+bool dp_list_have_autohostlist(struct desync_profile_list_head *head);
+
+struct params_s
+{
+	enum log_target debug_target;
+	char debug_logfile[PATH_MAX];
+	bool debug;
+
+#ifdef __linux__
+	int qnum;
+#elif defined(BSD)
+	uint16_t port; // divert port
+#endif
+	char bind_fix4,bind_fix6;
+	uint32_t desync_fwmark; // unused in BSD
+	
+	struct desync_profile_list_head desync_profiles;
+	
+#ifdef __CYGWIN__
+	struct str_list_head ssid_filter,nlm_filter;
+#else
+	bool droproot;
+	uid_t uid;
+	gid_t gid;
+#endif
+
+	char hostlist_auto_debuglog[PATH_MAX];
+	
+	unsigned int ctrack_t_syn, ctrack_t_est, ctrack_t_fin, ctrack_t_udp;
+	t_conntrack conntrack;
+};
+
+extern struct params_s params;
+extern const char *progname;
+
+int DLOG(const char *format, ...);
+int DLOG_ERR(const char *format, ...);
+int DLOG_PERROR(const char *s);
+int DLOG_CONDUP(const char *format, ...);
+int HOSTLIST_DEBUGLOG_APPEND(const char *format, ...);

nfq/pools.c

@@ -0,0 +1,153 @@
+#define _GNU_SOURCE
+#include "pools.h"
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+#define DESTROY_STR_POOL(etype, ppool) \
+	etype *elem, *tmp; \
+	HASH_ITER(hh, *ppool, elem, tmp) { \
+		free(elem->str); \
+		HASH_DEL(*ppool, elem); \
+		free(elem); \
+	}
+	
+#define ADD_STR_POOL(etype, ppool, keystr, keystr_len) \
+	etype *elem; \
+	if (!(elem = (etype*)malloc(sizeof(etype)))) \
+		return false; \
+	if (!(elem->str = malloc(keystr_len + 1))) \
+	{ \
+		free(elem); \
+		return false; \
+	} \
+	memcpy(elem->str, keystr, keystr_len); \
+	elem->str[keystr_len] = 0; \
+	oom = false; \
+	HASH_ADD_KEYPTR(hh, *ppool, elem->str, strlen(elem->str), elem); \
+	if (oom) \
+	{ \
+		free(elem->str); \
+		free(elem); \
+		return false; \
+	}
+
+
+#undef uthash_nonfatal_oom
+#define uthash_nonfatal_oom(elt) ut_oom_recover(elt)
+static bool oom = false;
+static void ut_oom_recover(void *elem)
+{
+	oom = true;
+}
+
+// for not zero terminated strings
+bool StrPoolAddStrLen(strpool **pp, const char *s, size_t slen)
+{
+	ADD_STR_POOL(strpool, pp, s, slen)
+	return true;
+}
+// for zero terminated strings
+bool StrPoolAddStr(strpool **pp, const char *s)
+{
+	return StrPoolAddStrLen(pp, s, strlen(s));
+}
+
+bool StrPoolCheckStr(strpool *p, const char *s)
+{
+	strpool *elem;
+	HASH_FIND_STR(p, s, elem);
+	return elem != NULL;
+}
+
+void StrPoolDestroy(strpool **pp)
+{
+	DESTROY_STR_POOL(strpool, pp)
+}
+
+
+
+void HostFailPoolDestroy(hostfail_pool **pp)
+{
+	DESTROY_STR_POOL(hostfail_pool, pp)
+}
+hostfail_pool * HostFailPoolAdd(hostfail_pool **pp,const char *s,int fail_time)
+{
+	size_t slen = strlen(s);
+	ADD_STR_POOL(hostfail_pool, pp, s, slen)
+	elem->expire = time(NULL) + fail_time;
+	elem->counter = 0;
+	return elem;
+}
+hostfail_pool *HostFailPoolFind(hostfail_pool *p,const char *s)
+{
+	hostfail_pool *elem;
+	HASH_FIND_STR(p, s, elem);
+	return elem;
+}
+void HostFailPoolDel(hostfail_pool **p, hostfail_pool *elem)
+{
+	HASH_DEL(*p, elem);
+	free(elem);
+}
+void HostFailPoolPurge(hostfail_pool **pp)
+{
+	hostfail_pool *elem, *tmp;
+	time_t now = time(NULL);
+	HASH_ITER(hh, *pp, elem, tmp)
+	{
+		if (now >= elem->expire)
+		{
+			free(elem->str);
+			HASH_DEL(*pp, elem);
+			free(elem);
+		}
+	}
+}
+static time_t host_fail_purge_prev=0;
+void HostFailPoolPurgeRateLimited(hostfail_pool **pp)
+{
+	time_t now = time(NULL);
+	// do not purge too often to save resources
+	if (host_fail_purge_prev != now)
+	{
+		HostFailPoolPurge(pp);
+		host_fail_purge_prev = now;
+	}
+}
+void HostFailPoolDump(hostfail_pool *p)
+{
+	hostfail_pool *elem, *tmp;
+	time_t now = time(NULL);
+	HASH_ITER(hh, p, elem, tmp)
+		printf("host=%s counter=%d time_left=%lld\n",elem->str,elem->counter,(long long int)elem->expire-now);
+}
+
+
+bool strlist_add(struct str_list_head *head, const char *filename)
+{
+	struct str_list *entry = malloc(sizeof(struct str_list));
+	if (!entry) return false;
+	entry->str = strdup(filename);
+	if (!entry->str)
+	{
+		free(entry);
+		return false;
+	}
+	LIST_INSERT_HEAD(head, entry, next);
+	return true;
+}
+static void strlist_entry_destroy(struct str_list *entry)
+{
+	if (entry->str)	free(entry->str);
+	free(entry);
+}
+void strlist_destroy(struct str_list_head *head)
+{
+	struct str_list *entry;
+	while ((entry = LIST_FIRST(head)))
+	{
+		LIST_REMOVE(entry, next);
+		strlist_entry_destroy(entry);
+	}
+}

nfq/pools.h

@@ -0,0 +1,45 @@
+#pragma once
+
+#include <stdbool.h>
+#include <ctype.h>
+#include <sys/queue.h>
+#include <time.h>
+
+//#define HASH_BLOOM 20
+#define HASH_NONFATAL_OOM 1
+#define HASH_FUNCTION HASH_BER
+#include "uthash.h"
+
+typedef struct strpool {
+    char *str;		/* key */
+    UT_hash_handle hh;	/* makes this structure hashable */
+} strpool;
+
+void StrPoolDestroy(strpool **pp);
+bool StrPoolAddStr(strpool **pp,const char *s);
+bool StrPoolAddStrLen(strpool **pp,const char *s,size_t slen);
+bool StrPoolCheckStr(strpool *p,const char *s);
+
+struct str_list {
+	char *str;
+	LIST_ENTRY(str_list) next;
+};
+LIST_HEAD(str_list_head, str_list);
+
+typedef struct hostfail_pool {
+    char *str;		/* key */
+    int counter;	/* value */
+    time_t expire;	/* when to expire record (unixtime) */
+    UT_hash_handle hh;	/* makes this structure hashable */
+} hostfail_pool;
+
+void HostFailPoolDestroy(hostfail_pool **pp);
+hostfail_pool *HostFailPoolAdd(hostfail_pool **pp,const char *s,int fail_time);
+hostfail_pool *HostFailPoolFind(hostfail_pool *p,const char *s);
+void HostFailPoolDel(hostfail_pool **pp, hostfail_pool *elem);
+void HostFailPoolPurge(hostfail_pool **pp);
+void HostFailPoolPurgeRateLimited(hostfail_pool **pp);
+void HostFailPoolDump(hostfail_pool *p);
+
+bool strlist_add(struct str_list_head *head, const char *filename);
+void strlist_destroy(struct str_list_head *head);

nfq/protocol.c

@@ -0,0 +1,771 @@
+#define _GNU_SOURCE
+
+#include "protocol.h"
+#include "helpers.h"
+#include <string.h>
+#include <ctype.h>
+#include <arpa/inet.h>
+#include <string.h>
+
+const char *http_methods[] = { "GET /","POST /","HEAD /","OPTIONS /","PUT /","DELETE /","CONNECT /","TRACE /",NULL };
+const char *HttpMethod(const uint8_t *data, size_t len)
+{
+	const char **method;
+	size_t method_len;
+	for (method = http_methods; *method; method++)
+	{
+		method_len = strlen(*method);
+		if (method_len <= len && !memcmp(data, *method, method_len))
+			return *method;
+	}
+	return NULL;
+}
+bool IsHttp(const uint8_t *data, size_t len)
+{
+	return !!HttpMethod(data,len);
+}
+
+static bool IsHostAt(const uint8_t *p)
+{
+	return \
+		p[0]=='\n' &&
+		(p[1]=='H' || p[1]=='h') &&
+		(p[2]=='o' || p[2]=='O') &&
+		(p[3]=='s' || p[3]=='S') &&
+		(p[4]=='t' || p[4]=='T') &&
+		p[5]==':';
+}
+static uint8_t *FindHostIn(uint8_t *buf, size_t bs)
+{
+	size_t pos;
+	if (bs<6) return NULL;
+	bs-=6;
+	for(pos=0;pos<=bs;pos++)
+		if (IsHostAt(buf+pos))
+			return buf+pos;
+
+	return NULL;
+}
+static const uint8_t *FindHostInConst(const uint8_t *buf, size_t bs)
+{
+	size_t pos;
+	if (bs<6) return NULL;
+	bs-=6;
+	for(pos=0;pos<=bs;pos++)
+		if (IsHostAt(buf+pos))
+			return buf+pos;
+
+	return NULL;
+}
+// pHost points to "Host: ..."
+bool HttpFindHost(uint8_t **pHost,uint8_t *buf,size_t bs)
+{
+	if (!*pHost)
+	{
+		*pHost = FindHostIn(buf, bs);
+		if (*pHost) (*pHost)++;
+	}
+	return !!*pHost;
+}
+bool HttpFindHostConst(const uint8_t **pHost,const uint8_t *buf,size_t bs)
+{
+	if (!*pHost)
+	{
+		*pHost = FindHostInConst(buf, bs);
+		if (*pHost) (*pHost)++;
+	}
+	return !!*pHost;
+}
+
+bool IsHttpReply(const uint8_t *data, size_t len)
+{
+	// HTTP/1.x 200\r\n
+	return len>14 && !memcmp(data,"HTTP/1.",7) && (data[7]=='0' || data[7]=='1') && data[8]==' ' &&
+		data[9]>='0' && data[9]<='9' &&
+		data[10]>='0' && data[10]<='9' &&
+		data[11]>='0' && data[11]<='9';
+}
+int HttpReplyCode(const uint8_t *data, size_t len)
+{
+	return (data[9]-'0')*100 + (data[10]-'0')*10 + (data[11]-'0');
+}
+bool HttpExtractHeader(const uint8_t *data, size_t len, const char *header, char *buf, size_t len_buf)
+{
+	const uint8_t *p, *s, *e = data + len;
+
+	p = (uint8_t*)strncasestr((char*)data, header, len);
+	if (!p) return false;
+	p += strlen(header);
+	while (p < e && (*p == ' ' || *p == '\t')) p++;
+	s = p;
+	while (s < e && (*s != '\r' && *s != '\n' && *s != ' ' && *s != '\t')) s++;
+	if (s > p)
+	{
+		size_t slen = s - p;
+		if (buf && len_buf)
+		{
+			if (slen >= len_buf) slen = len_buf - 1;
+			for (size_t i = 0; i < slen; i++) buf[i] = tolower(p[i]);
+			buf[slen] = 0;
+		}
+		return true;
+	}
+	return false;
+}
+bool HttpExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host)
+{
+	return HttpExtractHeader(data, len, "\nHost:", host, len_host);
+}
+const char *HttpFind2ndLevelDomain(const char *host)
+{
+	const char *p=NULL;
+	if (*host)
+	{
+		for (p = host + strlen(host)-1; p>host && *p!='.'; p--);
+		if (*p=='.') for (p--; p>host && *p!='.'; p--);
+		if (*p=='.') p++;
+	}
+	return p;
+}
+// DPI redirects are global redirects to another domain
+bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host)
+{
+	char loc[256],*redirect_host, *p;
+	int code;
+	
+	if (!host || !*host) return false;
+	
+	code = HttpReplyCode(data,len);
+	
+	if ((code!=302 && code!=307) || !HttpExtractHeader(data,len,"\nLocation:",loc,sizeof(loc))) return false;
+
+	// something like : https://censor.net/badpage.php?reason=denied&source=RKN
+		
+	if (!strncmp(loc,"http://",7))
+		redirect_host=loc+7;
+	else if (!strncmp(loc,"https://",8))
+		redirect_host=loc+8;
+	else
+		return false;
+		
+	// somethinkg like : censor.net/badpage.php?reason=denied&source=RKN
+	
+	for(p=redirect_host; *p && *p!='/' ; p++);
+	*p=0;
+	if (!*redirect_host) return false;
+
+	// somethinkg like : censor.net
+	
+	// extract 2nd level domains
+
+	const char *dhost = HttpFind2ndLevelDomain(host);
+	const char *drhost = HttpFind2ndLevelDomain(redirect_host);
+	
+	return strcasecmp(dhost, drhost)!=0;
+}
+size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz)
+{
+	const uint8_t *method, *host=NULL;
+	int i;
+	
+	switch(tpos_type)
+	{
+		case httpreqpos_method:
+			// recognize some tpws pre-applied hacks
+			method=http;
+			if (sz<10) break;
+			if (*method=='\n' || *method=='\r') method++;
+			if (*method=='\n' || *method=='\r') method++;
+			for (i=0;i<7;i++) if (*method>='A' && *method<='Z') method++;
+			if (i<3 || *method!=' ') break;
+			return method-http-1;
+		case httpreqpos_host:
+			if (HttpFindHostConst(&host,http,sz) && (host-http+7)<sz)
+			{
+				host+=5;
+				if (*host==' ') host++;
+				return host-http;
+			}
+			break;
+		case httpreqpos_pos:
+			break;
+		default:
+			return 0;
+	}
+	return hpos_pos<sz ? hpos_pos : 0;
+}
+
+
+uint16_t TLSRecordDataLen(const uint8_t *data)
+{
+	return pntoh16(data + 3);
+}
+size_t TLSRecordLen(const uint8_t *data)
+{
+	return TLSRecordDataLen(data) + 5;
+}
+bool IsTLSRecordFull(const uint8_t *data, size_t len)
+{
+	return TLSRecordLen(data)<=len;
+}
+bool IsTLSClientHello(const uint8_t *data, size_t len, bool bPartialIsOK)
+{
+	return len >= 6 && data[0] == 0x16 && data[1] == 0x03 && data[2] <= 0x03 && data[5] == 0x01 && (bPartialIsOK || TLSRecordLen(data) <= len);
+}
+
+size_t TLSHandshakeLen(const uint8_t *data)
+{
+	return data[1] << 16 | data[2] << 8 | data[3]; // HandshakeProtocol length
+}
+bool IsTLSHandshakeClientHello(const uint8_t *data, size_t len)
+{
+	return len>=4 && data[0]==0x01 && TLSHandshakeLen(data)>0;
+}
+bool IsTLSHandshakeFull(const uint8_t *data, size_t len)
+{
+	return (4+TLSHandshakeLen(data))<=len;
+}
+
+
+// bPartialIsOK=true - accept partial packets not containing the whole TLS message
+bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK)
+{
+	// +0
+	// u8	HandshakeType: ClientHello
+	// u24	Length
+	// u16	Version
+	// c[32] random
+	// u8	SessionIDLength
+	//	<SessionID>
+	// u16	CipherSuitesLength
+	//	<CipherSuites>
+	// u8	CompressionMethodsLength
+	//	<CompressionMethods>
+	// u16	ExtensionsLength
+
+	size_t l;
+
+	if (!bPartialIsOK && !IsTLSHandshakeFull(data,len)) return false;
+
+	l = 1 + 3 + 2 + 32;
+	// SessionIDLength
+	if (len < (l + 1)) return false;
+	l += data[l] + 1;
+	// CipherSuitesLength
+	if (len < (l + 2)) return false;
+	l += pntoh16(data + l) + 2;
+	// CompressionMethodsLength
+	if (len < (l + 1)) return false;
+	l += data[l] + 1;
+	// ExtensionsLength
+	if (len < (l + 2)) return false;
+
+	data += l; len -= l;
+	l = pntoh16(data);
+	data += 2; len -= 2;
+	
+	if (bPartialIsOK)
+	{
+		if (len < l) l = len;
+	}
+	else
+	{
+		if (len < l) return false;
+	}
+
+	while (l >= 4)
+	{
+		uint16_t etype = pntoh16(data);
+		size_t elen = pntoh16(data + 2);
+		data += 4; l -= 4;
+		if (l < elen) break;
+		if (etype == type)
+		{
+			if (ext && len_ext)
+			{
+				*ext = data;
+				*len_ext = elen;
+			}
+			return true;
+		}
+		data += elen; l -= elen;
+	}
+
+	return false;
+}
+bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK)
+{
+	// +0
+	// u8	ContentType: Handshake
+	// u16	Version: TLS1.0
+	// u16	Length
+	size_t reclen;
+	if (!IsTLSClientHello(data, len, bPartialIsOK)) return false;
+	reclen=TLSRecordLen(data);
+	if (reclen<len) len=reclen; // correct len if it has more data than the first tls record has
+	return TLSFindExtInHandshake(data + 5, len - 5, type, ext, len_ext, bPartialIsOK);
+}
+static bool TLSExtractHostFromExt(const uint8_t *ext, size_t elen, char *host, size_t len_host)
+{
+	// u16	data+0 - name list length
+	// u8	data+2 - server name type. 0=host_name
+	// u16	data+3 - server name length
+	if (elen < 5 || ext[2] != 0) return false;
+	size_t slen = pntoh16(ext + 3);
+	ext += 5; elen -= 5;
+	if (slen < elen) return false;
+	if (host && len_host)
+	{
+		if (slen >= len_host) slen = len_host - 1;
+		for (size_t i = 0; i < slen; i++) host[i] = tolower(ext[i]);
+		host[slen] = 0;
+	}
+	return true;
+}
+bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK)
+{
+	const uint8_t *ext;
+	size_t elen;
+
+	if (!TLSFindExt(data, len, 0, &ext, &elen, bPartialIsOK)) return false;
+	return TLSExtractHostFromExt(ext, elen, host, len_host);
+}
+bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK)
+{
+	const uint8_t *ext;
+	size_t elen;
+
+	if (!TLSFindExtInHandshake(data, len, 0, &ext, &elen, bPartialIsOK)) return false;
+	return TLSExtractHostFromExt(ext, elen, host, len_host);
+}
+size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type)
+{
+	size_t elen;
+	const uint8_t *ext;
+	switch(tpos_type)
+	{
+		case tlspos_sni:
+		case tlspos_sniext:
+			if (TLSFindExt(tls,sz,0,&ext,&elen,false))
+				return (tpos_type==tlspos_sni) ? ext-tls+6 : ext-tls+1;
+			// fall through
+		case tlspos_pos:
+			return tpos_pos<sz ? tpos_pos : 0;
+		default:
+			return 0;
+	}
+}
+
+
+
+static uint8_t tvb_get_varint(const uint8_t *tvb, uint64_t *value)
+{
+	switch (*tvb >> 6)
+	{
+	case 0: /* 0b00 => 1 byte length (6 bits Usable) */
+		if (value) *value = *tvb & 0x3F;
+		return 1;
+	case 1: /* 0b01 => 2 bytes length (14 bits Usable) */
+		if (value) *value = pntoh16(tvb) & 0x3FFF;
+		return 2;
+	case 2: /* 0b10 => 4 bytes length (30 bits Usable) */
+		if (value) *value = pntoh32(tvb) & 0x3FFFFFFF;
+		return 4;
+	case 3: /* 0b11 => 8 bytes length (62 bits Usable) */
+		if (value) *value = pntoh64(tvb) & 0x3FFFFFFFFFFFFFFF;
+		return 8;
+	}
+	// impossible case
+	if (*value) *value = 0;
+	return 0;
+}
+static uint8_t tvb_get_size(uint8_t tvb)
+{
+	return 1 << (tvb >> 6);
+}
+
+bool IsQUICCryptoHello(const uint8_t *data, size_t len, size_t *hello_offset, size_t *hello_len)
+{
+	size_t offset = 1;
+	uint64_t coff, clen;
+	if (len < 3 || *data != 6) return false;
+	if ((offset+tvb_get_size(data[offset])) >= len) return false;
+	offset += tvb_get_varint(data + offset, &coff);
+	// offset must be 0 if it's a full segment, not just a chunk
+	if (coff || (offset+tvb_get_size(data[offset])) >= len) return false;
+	offset += tvb_get_varint(data + offset, &clen);
+	if ((offset + clen) > len || !IsTLSHandshakeClientHello(data+offset,clen)) return false;
+	if (hello_offset) *hello_offset = offset;
+	if (hello_len) *hello_len = (size_t)clen;
+	return true;
+}
+
+/* Returns the QUIC draft version or 0 if not applicable. */
+uint8_t QUICDraftVersion(uint32_t version)
+{
+	/* IETF Draft versions */
+	if ((version >> 8) == 0xff0000) {
+		return (uint8_t)version;
+	}
+	/* Facebook mvfst, based on draft -22. */
+	if (version == 0xfaceb001) {
+		return 22;
+	}
+	/* Facebook mvfst, based on draft -27. */
+	if (version == 0xfaceb002 || version == 0xfaceb00e) {
+		return 27;
+	}
+	/* GQUIC Q050, T050 and T051: they are not really based on any drafts,
+	 * but we must return a sensible value */
+	if (version == 0x51303530 ||
+		version == 0x54303530 ||
+		version == 0x54303531) {
+		return 27;
+	}
+	/* https://tools.ietf.org/html/draft-ietf-quic-transport-32#section-15
+	   "Versions that follow the pattern 0x?a?a?a?a are reserved for use in
+	   forcing version negotiation to be exercised"
+	   It is tricky to return a correct draft version: such number is primarily
+	   used to select a proper salt (which depends on the version itself), but
+	   we don't have a real version here! Let's hope that we need to handle
+	   only latest drafts... */
+	if ((version & 0x0F0F0F0F) == 0x0a0a0a0a) {
+		return 29;
+	}
+	/* QUIC (final?) constants for v1 are defined in draft-33, but draft-34 is the
+	   final draft version */
+	if (version == 0x00000001) {
+		return 34;
+	}
+	/* QUIC Version 2 */
+	/* TODO: for the time being use 100 as a number for V2 and let see how v2 drafts evolve */
+	if (version == 0x709A50C4) {
+		return 100;
+	}
+	return 0;
+}
+
+static bool is_quic_draft_max(uint32_t draft_version, uint8_t max_version)
+{
+	return draft_version && draft_version <= max_version;
+}
+static bool is_quic_v2(uint32_t version)
+{
+    return version == 0x6b3343cf;
+}
+
+static bool quic_hkdf_expand_label(const uint8_t *secret, uint8_t secret_len, const char *label, uint8_t *out, size_t out_len)
+{
+	uint8_t hkdflabel[64];
+
+	size_t label_size = strlen(label);
+	if (label_size > 255) return false;
+	size_t hkdflabel_size = 2 + 1 + label_size + 1;
+	if (hkdflabel_size > sizeof(hkdflabel)) return false;
+
+	phton16(hkdflabel, out_len);
+	hkdflabel[2] = (uint8_t)label_size;
+	memcpy(hkdflabel + 3, label, label_size);
+	hkdflabel[3 + label_size] = 0;
+	return !hkdfExpand(SHA256, secret, secret_len, hkdflabel, hkdflabel_size, out, out_len);
+}
+
+static bool quic_derive_initial_secret(const quic_cid_t *cid, uint8_t *client_initial_secret, uint32_t version)
+{
+	/*
+	 * https://tools.ietf.org/html/draft-ietf-quic-tls-29#section-5.2
+	 *
+	 * initial_salt = 0xafbfec289993d24c9e9786f19c6111e04390a899
+	 * initial_secret = HKDF-Extract(initial_salt, client_dst_connection_id)
+	 *
+	 * client_initial_secret = HKDF-Expand-Label(initial_secret,
+	 *                                           "client in", "", Hash.length)
+	 * server_initial_secret = HKDF-Expand-Label(initial_secret,
+	 *                                           "server in", "", Hash.length)
+	 *
+	 * Hash for handshake packets is SHA-256 (output size 32).
+	 */
+	static const uint8_t handshake_salt_draft_22[20] = {
+		0x7f, 0xbc, 0xdb, 0x0e, 0x7c, 0x66, 0xbb, 0xe9, 0x19, 0x3a,
+		0x96, 0xcd, 0x21, 0x51, 0x9e, 0xbd, 0x7a, 0x02, 0x64, 0x4a
+	};
+	static const uint8_t handshake_salt_draft_23[20] = {
+		0xc3, 0xee, 0xf7, 0x12, 0xc7, 0x2e, 0xbb, 0x5a, 0x11, 0xa7,
+		0xd2, 0x43, 0x2b, 0xb4, 0x63, 0x65, 0xbe, 0xf9, 0xf5, 0x02,
+	};
+	static const uint8_t handshake_salt_draft_29[20] = {
+		0xaf, 0xbf, 0xec, 0x28, 0x99, 0x93, 0xd2, 0x4c, 0x9e, 0x97,
+		0x86, 0xf1, 0x9c, 0x61, 0x11, 0xe0, 0x43, 0x90, 0xa8, 0x99
+	};
+	static const uint8_t handshake_salt_v1[20] = {
+		0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17,
+		0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a
+	};
+	static const uint8_t hanshake_salt_draft_q50[20] = {
+		0x50, 0x45, 0x74, 0xEF, 0xD0, 0x66, 0xFE, 0x2F, 0x9D, 0x94,
+		0x5C, 0xFC, 0xDB, 0xD3, 0xA7, 0xF0, 0xD3, 0xB5, 0x6B, 0x45
+	};
+	static const uint8_t hanshake_salt_draft_t50[20] = {
+		0x7f, 0xf5, 0x79, 0xe5, 0xac, 0xd0, 0x72, 0x91, 0x55, 0x80,
+		0x30, 0x4c, 0x43, 0xa2, 0x36, 0x7c, 0x60, 0x48, 0x83, 0x10
+	};
+	static const uint8_t hanshake_salt_draft_t51[20] = {
+		0x7a, 0x4e, 0xde, 0xf4, 0xe7, 0xcc, 0xee, 0x5f, 0xa4, 0x50,
+		0x6c, 0x19, 0x12, 0x4f, 0xc8, 0xcc, 0xda, 0x6e, 0x03, 0x3d
+	};
+	static const uint8_t handshake_salt_v2[20] = {
+		0x0d, 0xed, 0xe3, 0xde, 0xf7, 0x00, 0xa6, 0xdb, 0x81, 0x93,
+		0x81, 0xbe, 0x6e, 0x26, 0x9d, 0xcb, 0xf9, 0xbd, 0x2e, 0xd9
+	};
+
+	int err;
+	const uint8_t *salt;
+	uint8_t secret[USHAMaxHashSize];
+	uint8_t draft_version = QUICDraftVersion(version);
+
+	if (version == 0x51303530) {
+		salt = hanshake_salt_draft_q50;
+	}
+	else if (version == 0x54303530) {
+		salt = hanshake_salt_draft_t50;
+	}
+	else if (version == 0x54303531) {
+		salt = hanshake_salt_draft_t51;
+	}
+	else if (is_quic_draft_max(draft_version, 22)) {
+		salt = handshake_salt_draft_22;
+	}
+	else if (is_quic_draft_max(draft_version, 28)) {
+		salt = handshake_salt_draft_23;
+	}
+	else if (is_quic_draft_max(draft_version, 32)) {
+		salt = handshake_salt_draft_29;
+	}
+	else if (is_quic_draft_max(draft_version, 34)) {
+		salt = handshake_salt_v1;
+	}
+	else {
+		salt = handshake_salt_v2;
+	}
+
+	err = hkdfExtract(SHA256, salt, 20, cid->cid, cid->len, secret);
+	if (err) return false;
+
+	if (client_initial_secret && !quic_hkdf_expand_label(secret, SHA256HashSize, "tls13 client in", client_initial_secret, SHA256HashSize))
+		return false;
+
+	return true;
+}
+bool QUICIsLongHeader(const uint8_t *data, size_t len)
+{
+	return len>=9 && !!(*data & 0x80);
+}
+uint32_t QUICExtractVersion(const uint8_t *data, size_t len)
+{
+	// long header, fixed bit, type=initial
+	return QUICIsLongHeader(data, len) ? ntohl(*(uint32_t*)(data + 1)) : 0;
+}
+bool QUICExtractDCID(const uint8_t *data, size_t len, quic_cid_t *cid)
+{
+	if (!QUICIsLongHeader(data,len) || !data[5] || data[5] > QUIC_MAX_CID_LENGTH || (6+data[5])>len) return false;
+	cid->len = data[5];
+	memcpy(&cid->cid, data + 6, data[5]);
+	return true;
+}
+bool QUICDecryptInitial(const uint8_t *data, size_t data_len, uint8_t *clean, size_t *clean_len)
+{
+	uint32_t ver = QUICExtractVersion(data, data_len);
+	if (!ver) return false;
+
+	quic_cid_t dcid;
+	if (!QUICExtractDCID(data, data_len, &dcid)) return false;
+
+	uint8_t client_initial_secret[SHA256HashSize];
+	if (!quic_derive_initial_secret(&dcid, client_initial_secret, ver)) return false;
+
+	uint8_t aeskey[16], aesiv[12], aeshp[16];
+	bool v1_label = !is_quic_v2(ver);
+	if (!quic_hkdf_expand_label(client_initial_secret, SHA256HashSize, v1_label ? "tls13 quic key" : "tls13 quicv2 key", aeskey, sizeof(aeskey)) ||
+		!quic_hkdf_expand_label(client_initial_secret, SHA256HashSize, v1_label ? "tls13 quic iv" : "tls13 quicv2 iv", aesiv, sizeof(aesiv)) ||
+		!quic_hkdf_expand_label(client_initial_secret, SHA256HashSize, v1_label ? "tls13 quic hp" : "tls13 quicv2 hp", aeshp, sizeof(aeshp)))
+	{
+		return false;
+	}
+
+	uint64_t payload_len,token_len;
+	size_t pn_offset;
+	pn_offset = 1 + 4 + 1 + data[5];
+	if (pn_offset >= data_len) return false;
+	pn_offset += 1 + data[pn_offset];
+	if ((pn_offset + tvb_get_size(data[pn_offset])) >= data_len) return false;
+	pn_offset += tvb_get_varint(data + pn_offset, &token_len);
+	pn_offset += token_len;
+	if ((pn_offset + tvb_get_size(data[pn_offset])) >= data_len) return false;
+	pn_offset += tvb_get_varint(data + pn_offset, &payload_len);
+	if (payload_len<20 || (pn_offset + payload_len)>data_len) return false;
+
+	aes_init_keygen_tables();
+
+	uint8_t sample_enc[16];
+	aes_context ctx;
+	if (aes_setkey(&ctx, 1, aeshp, sizeof(aeshp)) || aes_cipher(&ctx, data + pn_offset + 4, sample_enc)) return false;
+
+	uint8_t mask[5];
+	memcpy(mask, sample_enc, sizeof(mask));
+
+	uint8_t packet0 = data[0] ^ (mask[0] & 0x0f);
+	uint8_t pkn_len = (packet0 & 0x03) + 1;
+
+	uint8_t pkn_bytes[4];
+	memcpy(pkn_bytes, data + pn_offset, pkn_len);
+	uint32_t pkn = 0;
+	for (uint8_t i = 0; i < pkn_len; i++) pkn |= (uint32_t)(pkn_bytes[i] ^ mask[1 + i]) << (8 * (pkn_len - 1 - i));
+
+ 	phton64(aesiv + sizeof(aesiv) - 8, pntoh64(aesiv + sizeof(aesiv) - 8) ^ pkn);
+
+	size_t cryptlen = payload_len - pkn_len - 16;
+	if (cryptlen > *clean_len) return false;
+	*clean_len = cryptlen;
+	const uint8_t *decrypt_begin = data + pn_offset + pkn_len;
+
+	uint8_t atag[16],header[256];
+	size_t header_len = pn_offset + pkn_len;
+	if (header_len > sizeof(header)) return false; // not likely header will be so large
+	memcpy(header, data, header_len);
+	header[0] = packet0;
+	for(uint8_t i = 0; i < pkn_len; i++) header[header_len - 1 - i] = (uint8_t)(pkn >> (8 * i));
+
+	if (aes_gcm_crypt(AES_DECRYPT, clean, decrypt_begin, cryptlen, aeskey, sizeof(aeskey), aesiv, sizeof(aesiv), header, header_len, atag, sizeof(atag)))
+		return false;
+
+	// check if message was decrypted correctly : good keys , no data corruption
+	return !memcmp(data + pn_offset + pkn_len + cryptlen, atag, 16);
+}
+
+bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len)
+{
+	// Crypto frame can be split into multiple chunks
+	// chromium randomly splits it and pads with zero/one bytes to force support the standard
+	// mozilla does not split
+
+	if (*defrag_len<10) return false;
+	uint8_t *defrag_data = defrag+10;
+	size_t defrag_data_len = *defrag_len-10;
+
+	uint8_t ft;
+	uint64_t offset,sz,szmax=0,zeropos=0,pos=0;
+	bool found=false;
+
+	while(pos<clean_len)
+	{
+		ft = clean[pos];
+		pos++;
+		if (ft>1) // 00 - padding, 01 - ping
+		{
+			if (ft!=6) return false; // dont want to know all possible frame type formats
+
+			if (pos>=clean_len) return false;
+
+			if ((pos+tvb_get_size(clean[pos])>=clean_len)) return false;
+			pos += tvb_get_varint(clean+pos, &offset);
+
+			if ((pos+tvb_get_size(clean[pos])>clean_len)) return false;
+			pos += tvb_get_varint(clean+pos, &sz);
+			if ((pos+sz)>clean_len) return false;
+
+			if ((offset+sz)>defrag_data_len) return false;
+			if (zeropos < offset)
+				// make sure no uninitialized gaps exist in case of not full fragment coverage
+				memset(defrag_data+zeropos,0,offset-zeropos);
+			if ((offset+sz) > zeropos)
+				zeropos=offset+sz;
+			memcpy(defrag_data+offset,clean+pos,sz);
+			if ((offset+sz) > szmax) szmax = offset+sz;
+
+			found=true;
+			pos+=sz;
+		}
+	}
+	if (found)
+	{
+		defrag[0] = 6;
+		defrag[1] = 0; // offset
+		// 2..9 - length 64 bit
+		// +10 - data start
+		phton64(defrag+2,szmax);
+		defrag[2] |= 0xC0; // 64 bit value
+		*defrag_len = (size_t)(szmax+10);
+	}
+	return found;
+}
+
+bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello)
+{
+	if (bIsCryptoHello) *bIsCryptoHello=false;
+	if (bDecryptOK) *bDecryptOK=false;
+
+	uint8_t clean[1500];
+	size_t clean_len = sizeof(clean);
+	if (!QUICDecryptInitial(data,data_len,clean,&clean_len)) return false;
+
+	if (bDecryptOK) *bDecryptOK=true;
+
+	uint8_t defrag[1500];
+	size_t defrag_len = sizeof(defrag);
+	if (!QUICDefragCrypto(clean,clean_len,defrag,&defrag_len)) return false;
+
+	size_t hello_offset, hello_len;
+	if (!IsQUICCryptoHello(defrag, defrag_len, &hello_offset, &hello_len)) return false;
+	if (bIsCryptoHello) *bIsCryptoHello=true;
+
+	return TLSHelloExtractHostFromHandshake(defrag + hello_offset, hello_len, host, len_host, true);
+}
+
+bool IsQUICInitial(const uint8_t *data, size_t len)
+{
+	// too small packets are not likely to be initials with client hello
+	// long header, fixed bit
+	if (len < 256 || (data[0] & 0xC0)!=0xC0) return false;
+
+	uint32_t ver = QUICExtractVersion(data,len);
+	if (QUICDraftVersion(ver) < 11) return false;
+
+	// quic v1 : initial packets are 00b
+	// quic v2 : initial packets are 01b
+	if ((data[0] & 0x30) != (is_quic_v2(ver) ? 0x10 : 0x00)) return false;
+
+	uint64_t offset=5, sz;
+
+	// DCID. must be present
+	if (!data[offset] || data[offset] > QUIC_MAX_CID_LENGTH) return false;
+	offset += 1 + data[offset];
+
+	// SCID
+	if (data[offset] > QUIC_MAX_CID_LENGTH) return false;
+	offset += 1 + data[offset];
+
+	// token length
+	offset += tvb_get_varint(data + offset, &sz);
+	offset += sz;
+	if (offset >= len) return false;
+
+	// payload length
+	if ((offset + tvb_get_size(data[offset])) > len) return false;
+	tvb_get_varint(data + offset, &sz);
+	offset += sz;
+	if (offset > len) return false;
+
+	// client hello cannot be too small. likely ACK
+	return sz>=96;
+}
+
+
+
+bool IsWireguardHandshakeInitiation(const uint8_t *data, size_t len)
+{
+    return len==148 && data[0]==1 && data[1]==0 && data[2]==0 && data[3]==0;
+}
+bool IsDhtD1(const uint8_t *data, size_t len)
+{
+	return len>=7 && data[0]=='d' && data[1]=='1' && data[len-1]=='e';
+}

nfq/protocol.h

@@ -0,0 +1,59 @@
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include "crypto/sha.h"
+#include "crypto/aes-gcm.h"
+#include "helpers.h"
+
+extern const char *http_methods[9];
+const char *HttpMethod(const uint8_t *data, size_t len);
+bool IsHttp(const uint8_t *data, size_t len);
+bool HttpFindHost(uint8_t **pHost,uint8_t *buf,size_t bs);
+bool HttpFindHostConst(const uint8_t **pHost,const uint8_t *buf,size_t bs);
+// header must be passed like this : "\nHost:"
+bool HttpExtractHeader(const uint8_t *data, size_t len, const char *header, char *buf, size_t len_buf);
+bool HttpExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host);
+bool IsHttpReply(const uint8_t *data, size_t len);
+const char *HttpFind2ndLevelDomain(const char *host);
+// must be pre-checked by IsHttpReply
+int HttpReplyCode(const uint8_t *data, size_t len);
+// must be pre-checked by IsHttpReply
+bool HttpReplyLooksLikeDPIRedirect(const uint8_t *data, size_t len, const char *host);
+enum httpreqpos { httpreqpos_none = 0, httpreqpos_method, httpreqpos_host, httpreqpos_pos };
+size_t HttpPos(enum httpreqpos tpos_type, size_t hpos_pos, const uint8_t *http, size_t sz);
+
+uint16_t TLSRecordDataLen(const uint8_t *data);
+size_t TLSRecordLen(const uint8_t *data);
+bool IsTLSRecordFull(const uint8_t *data, size_t len);
+bool IsTLSClientHello(const uint8_t *data, size_t len, bool bPartialIsOK);
+size_t TLSHandshakeLen(const uint8_t *data);
+bool IsTLSHandshakeClientHello(const uint8_t *data, size_t len);
+bool IsTLSHandshakeFull(const uint8_t *data, size_t len);
+bool TLSFindExt(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
+bool TLSFindExtInHandshake(const uint8_t *data, size_t len, uint16_t type, const uint8_t **ext, size_t *len_ext, bool bPartialIsOK);
+bool TLSHelloExtractHost(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
+bool TLSHelloExtractHostFromHandshake(const uint8_t *data, size_t len, char *host, size_t len_host, bool bPartialIsOK);
+enum tlspos { tlspos_none = 0, tlspos_sni, tlspos_sniext, tlspos_pos };
+size_t TLSPos(enum tlspos tpos_type, size_t tpos_pos, const uint8_t *tls, size_t sz, uint8_t type);
+
+bool IsWireguardHandshakeInitiation(const uint8_t *data, size_t len);
+bool IsDhtD1(const uint8_t *data, size_t len);
+
+#define QUIC_MAX_CID_LENGTH  20
+typedef struct quic_cid {
+	uint8_t      len;
+	uint8_t      cid[QUIC_MAX_CID_LENGTH];
+} quic_cid_t;
+
+bool IsQUICInitial(const uint8_t *data, size_t len);
+bool IsQUICCryptoHello(const uint8_t *data, size_t len, size_t *hello_offset, size_t *hello_len);
+bool QUICIsLongHeader(const uint8_t *data, size_t len);
+uint32_t QUICExtractVersion(const uint8_t *data, size_t len);
+uint8_t QUICDraftVersion(uint32_t version);
+bool QUICExtractDCID(const uint8_t *data, size_t len, quic_cid_t *cid);
+
+bool QUICDecryptInitial(const uint8_t *data, size_t data_len, uint8_t *clean, size_t *clean_len);
+bool QUICDefragCrypto(const uint8_t *clean,size_t clean_len, uint8_t *defrag,size_t *defrag_len);
+bool QUICExtractHostFromInitial(const uint8_t *data, size_t data_len, char *host, size_t len_host, bool *bDecryptOK, bool *bIsCryptoHello);

nfq/sec.c

@@ -0,0 +1,391 @@
+#define _GNU_SOURCE
+
+#include <stdio.h>
+#include <stdlib.h>
+#include "sec.h"
+#include <unistd.h>
+#include <fcntl.h>
+#include <grp.h>
+
+#include "params.h"
+
+#ifdef __linux__
+
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <linux/seccomp.h>
+#include <linux/filter.h>
+// __X32_SYSCALL_BIT defined in linux/unistd.h
+#include <linux/unistd.h>
+#include <syscall.h>
+#include <errno.h>
+
+/************ SECCOMP ************/
+
+// block most of the undesired syscalls to harden against code execution
+static long blocked_syscalls[] = {
+#ifdef SYS_execv
+SYS_execv,
+#endif
+SYS_execve,
+#ifdef SYS_execveat
+SYS_execveat,
+#endif
+#ifdef SYS_exec_with_loader
+SYS_exec_with_loader,
+#endif
+#ifdef SYS_clone
+SYS_clone,
+#endif
+#ifdef SYS_clone2
+SYS_clone2,
+#endif
+#ifdef SYS_clone3
+SYS_clone3,
+#endif
+#ifdef SYS_osf_execve
+SYS_osf_execve,
+#endif
+#ifdef SYS_fork
+SYS_fork,
+#endif
+#ifdef SYS_vfork
+SYS_vfork,
+#endif
+#ifdef SYS_uselib
+SYS_uselib,
+#endif
+#ifdef SYS_unlink
+SYS_unlink,
+#endif
+SYS_unlinkat,
+#ifdef SYS_chmod
+SYS_chmod,
+#endif
+SYS_fchmod,SYS_fchmodat,
+#ifdef SYS_chown
+SYS_chown,
+#endif
+#ifdef SYS_chown32
+SYS_chown32,
+#endif
+SYS_fchown,
+#ifdef SYS_fchown32
+SYS_fchown32,
+#endif
+#ifdef SYS_lchown
+SYS_lchown,
+#endif
+#ifdef SYS_lchown32
+SYS_lchown32,
+#endif
+SYS_fchownat,
+#ifdef SYS_symlink
+SYS_symlink,
+#endif
+SYS_symlinkat,
+#ifdef SYS_link
+SYS_link,
+#endif
+SYS_linkat,
+#ifdef SYS_pkey_mprotect
+SYS_pkey_mprotect,
+#endif
+SYS_mprotect,
+SYS_truncate,
+#ifdef SYS_truncate64
+SYS_truncate64,
+#endif
+SYS_ftruncate,
+#ifdef SYS_ftruncate64
+SYS_ftruncate64,
+#endif
+#ifdef SYS_mknod
+SYS_mknod,
+#endif
+SYS_mknodat,
+#ifdef SYS_mkdir
+SYS_mkdir,
+#endif
+SYS_mkdirat,
+#ifdef SYS_rmdir
+SYS_rmdir,
+#endif
+#ifdef SYS_rename
+SYS_rename,
+#endif
+#ifdef SYS_renameat2
+SYS_renameat2,
+#endif
+#ifdef SYS_renameat
+SYS_renameat,
+#endif
+#ifdef SYS_readdir
+SYS_readdir,
+#endif
+#ifdef SYS_getdents
+SYS_getdents,
+#endif
+#ifdef SYS_getdents64
+SYS_getdents64,
+#endif
+#ifdef SYS_process_vm_readv
+SYS_process_vm_readv,
+#endif
+#ifdef SYS_process_vm_writev
+SYS_process_vm_writev,
+#endif
+#ifdef SYS_process_madvise
+SYS_process_madvise,
+#endif
+#ifdef SYS_tkill
+SYS_tkill,
+#endif
+#ifdef SYS_tgkill
+SYS_tgkill,
+#endif
+SYS_kill, SYS_ptrace
+};
+#define BLOCKED_SYSCALL_COUNT (sizeof(blocked_syscalls)/sizeof(*blocked_syscalls))
+
+static void set_filter(struct sock_filter *filter, __u16 code, __u8 jt, __u8 jf, __u32 k)
+{
+	filter->code = code;
+	filter->jt = jt;
+	filter->jf = jf;
+	filter->k = k;
+}
+// deny all blocked syscalls
+static bool set_seccomp(void)
+{
+#ifdef __X32_SYSCALL_BIT
+ #define SECCOMP_PROG_SIZE (6 + BLOCKED_SYSCALL_COUNT)
+#else
+ #define SECCOMP_PROG_SIZE (5 + BLOCKED_SYSCALL_COUNT)
+#endif
+	struct sock_filter sockf[SECCOMP_PROG_SIZE];
+	struct sock_fprog prog = { .len = SECCOMP_PROG_SIZE, .filter = sockf };
+	int i,idx=0;
+
+	set_filter(&prog.filter[idx++], BPF_LD + BPF_W + BPF_ABS, 0, 0, arch_nr);
+#ifdef __X32_SYSCALL_BIT
+	// x86 only
+	set_filter(&prog.filter[idx++], BPF_JMP + BPF_JEQ + BPF_K, 0, 3 + BLOCKED_SYSCALL_COUNT, ARCH_NR); // fail
+	set_filter(&prog.filter[idx++], BPF_LD + BPF_W + BPF_ABS, 0, 0, syscall_nr);
+	set_filter(&prog.filter[idx++], BPF_JMP + BPF_JGT + BPF_K, 1 + BLOCKED_SYSCALL_COUNT, 0, __X32_SYSCALL_BIT - 1); // fail
+#else
+	set_filter(&prog.filter[idx++], BPF_JMP + BPF_JEQ + BPF_K, 0, 2 + BLOCKED_SYSCALL_COUNT, ARCH_NR); // fail
+	set_filter(&prog.filter[idx++], BPF_LD + BPF_W + BPF_ABS, 0, 0, syscall_nr);
+#endif
+
+/*
+	// ! THIS IS NOT WORKING BECAUSE perror() in glibc dups() stderr
+	set_filter(&prog.filter[idx++], BPF_JMP + BPF_JEQ + BPF_K, 0, 3, SYS_write); // special check for write call
+	set_filter(&prog.filter[idx++], BPF_LD + BPF_W + BPF_ABS, 0, 0, syscall_arg(0)); // fd
+	set_filter(&prog.filter[idx++], BPF_JMP + BPF_JGT + BPF_K, 2 + BLOCKED_SYSCALL_COUNT, 0, 2); // 1 - stdout, 2 - stderr. greater are bad
+	set_filter(&prog.filter[idx++], BPF_LD + BPF_W + BPF_ABS, 0, 0, syscall_nr); // reload syscall_nr
+*/
+	for(i=0 ; i<BLOCKED_SYSCALL_COUNT ; i++)
+	{
+		set_filter(&prog.filter[idx++], BPF_JMP + BPF_JEQ + BPF_K, BLOCKED_SYSCALL_COUNT-i, 0, blocked_syscalls[i]);
+	}
+	set_filter(&prog.filter[idx++], BPF_RET + BPF_K, 0, 0, SECCOMP_RET_ALLOW); // success case
+	set_filter(&prog.filter[idx++], BPF_RET + BPF_K, 0, 0, SECCOMP_RET_KILL); // fail case
+	return prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) >= 0;
+}
+
+bool sec_harden(void)
+{
+	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
+	{
+		DLOG_PERROR("PR_SET_NO_NEW_PRIVS(prctl)");
+		return false;
+	}
+#if ARCH_NR!=0
+	if (!set_seccomp())
+	{
+		DLOG_PERROR("seccomp");
+		if (errno==EINVAL) DLOG_ERR("seccomp: this can be safely ignored if kernel does not support seccomp\n");
+		return false;
+	}
+#endif
+	return true;
+}
+
+
+
+
+bool checkpcap(uint64_t caps)
+{
+	if (!caps) return true; // no special caps reqd
+
+	struct __user_cap_header_struct ch = {_LINUX_CAPABILITY_VERSION_3, getpid()};
+	struct __user_cap_data_struct cd[2];
+	uint32_t c0 = (uint32_t)caps;
+	uint32_t c1 = (uint32_t)(caps>>32);
+
+	return !capget(&ch,cd) && (cd[0].effective & c0)==c0 && (cd[1].effective & c1)==c1;
+}
+bool setpcap(uint64_t caps)
+{
+	struct __user_cap_header_struct ch = {_LINUX_CAPABILITY_VERSION_3, getpid()};
+	struct __user_cap_data_struct cd[2];
+	
+	cd[0].effective = cd[0].permitted = (uint32_t)caps;
+	cd[0].inheritable = 0;
+	cd[1].effective = cd[1].permitted = (uint32_t)(caps>>32);
+	cd[1].inheritable = 0;
+
+	return !capset(&ch,cd);
+}
+int getmaxcap(void)
+{
+	int maxcap = CAP_LAST_CAP;
+	FILE *F = fopen("/proc/sys/kernel/cap_last_cap", "r");
+	if (F)
+	{
+		int n = fscanf(F, "%d", &maxcap);
+		fclose(F);
+	}
+	return maxcap;
+
+}
+bool dropcaps(void)
+{
+	uint64_t caps = (1<<CAP_NET_ADMIN)|(1<<CAP_NET_RAW);
+	int maxcap = getmaxcap();
+
+	if (setpcap(caps|(1<<CAP_SETPCAP)))
+	{
+		for (int cap = 0; cap <= maxcap; cap++)
+		{
+			if (prctl(PR_CAPBSET_DROP, cap)<0)
+			{
+				DLOG_ERR("could not drop bound cap %d\n", cap);
+				DLOG_PERROR("cap_drop_bound");
+			}
+		}
+	}
+	// now without CAP_SETPCAP
+	if (!setpcap(caps))
+	{
+		DLOG_PERROR("setpcap");
+		return checkpcap(caps);
+	}
+	return true;
+}
+
+#endif // __linux__
+
+#ifndef __CYGWIN__
+
+#ifndef __linux__
+bool sec_harden(void)
+{
+	// noop
+	return true;
+}
+#endif
+
+bool can_drop_root(void)
+{
+#ifdef __linux__
+	// has some caps
+	return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID)|(1<<CAP_SETPCAP));
+#else
+	// effective root
+	return !geteuid();
+#endif
+}
+
+bool droproot(uid_t uid, gid_t gid)
+{
+#ifdef __linux__
+	if (prctl(PR_SET_KEEPCAPS, 1L))
+	{
+		DLOG_PERROR("prctl(PR_SET_KEEPCAPS)");
+		return false;
+	}
+#endif
+	// drop all SGIDs
+	if (setgroups(0,NULL))
+	{
+		DLOG_PERROR("setgroups");
+		return false;
+	}
+	if (setgid(gid))
+	{
+		DLOG_PERROR("setgid");
+		return false;
+	}
+	if (setuid(uid))
+	{
+		DLOG_PERROR("setuid");
+		return false;
+	}
+#ifdef __linux__
+	return dropcaps();
+#else
+	return true;
+#endif
+}
+
+void print_id(void)
+{
+ int i,N;
+ gid_t g[128];
+
+ DLOG_CONDUP("Running as UID=%u GID=",getuid());
+ N=getgroups(sizeof(g)/sizeof(*g),g);
+ if (N>0)
+ {
+	for(i=0;i<N;i++)
+		DLOG_CONDUP(i==(N-1) ? "%u" : "%u,", g[i]);
+	DLOG_CONDUP("\n");
+ }
+ else
+	DLOG_CONDUP("%u\n",getgid());
+}
+
+#endif
+
+
+void daemonize(void)
+{
+	int pid;
+
+	pid = fork();
+	if (pid == -1)
+	{
+		DLOG_PERROR("fork");
+		exit(2);
+	}
+	else if (pid != 0)
+		exit(0);
+
+	if (setsid() == -1)
+		exit(2);
+	if (chdir("/") == -1)
+		exit(2);
+	close(STDIN_FILENO);
+	close(STDOUT_FILENO);
+	close(STDERR_FILENO);
+	/* redirect fd's 0,1,2 to /dev/null */
+	open("/dev/null", O_RDWR);
+	int fd;
+	/* stdin */
+	fd = dup(0);
+	/* stdout */
+	fd = dup(0);
+	/* stderror */
+}
+
+bool writepid(const char *filename)
+{
+	FILE *F;
+	if (!(F = fopen(filename, "w")))
+		return false;
+	fprintf(F, "%d", getpid());
+	fclose(F);
+	return true;
+}

nfq/sec.h

@@ -0,0 +1,92 @@
+#pragma once
+
+#include <sys/types.h>
+#include <stdbool.h>
+
+#ifdef __linux__
+
+#include <stddef.h>
+#include <sys/capability.h>
+#include <linux/audit.h>
+
+bool checkpcap(uint64_t caps);
+bool setpcap(uint64_t caps);
+int getmaxcap(void);
+bool dropcaps(void);
+
+#define syscall_nr (offsetof(struct seccomp_data, nr))
+#define arch_nr (offsetof(struct seccomp_data, arch))
+#define syscall_arg(x) (offsetof(struct seccomp_data, args[x]))
+
+#if defined(__aarch64__)
+
+# define ARCH_NR	AUDIT_ARCH_AARCH64
+
+#elif defined(__amd64__)
+
+# define ARCH_NR	AUDIT_ARCH_X86_64
+
+#elif defined(__arm__) && (defined(__ARM_EABI__) || defined(__thumb__))
+
+# if __BYTE_ORDER == __LITTLE_ENDIAN
+#  define ARCH_NR	AUDIT_ARCH_ARM
+# else
+#  define ARCH_NR	AUDIT_ARCH_ARMEB
+# endif
+
+#elif defined(__i386__)
+
+# define ARCH_NR	AUDIT_ARCH_I386
+
+#elif defined(__mips__)
+
+#if _MIPS_SIM == _MIPS_SIM_ABI32
+# if __BYTE_ORDER == __LITTLE_ENDIAN
+#  define ARCH_NR	AUDIT_ARCH_MIPSEL
+# else
+#  define ARCH_NR	AUDIT_ARCH_MIPS
+# endif
+#elif _MIPS_SIM == _MIPS_SIM_ABI64
+# if __BYTE_ORDER == __LITTLE_ENDIAN
+#  define ARCH_NR	AUDIT_ARCH_MIPSEL64
+# else
+#  define ARCH_NR	AUDIT_ARCH_MIPS64
+# endif
+#else
+# error "Unsupported mips abi"
+#endif
+
+#elif defined(__PPC64__)
+
+# if __BYTE_ORDER == __LITTLE_ENDIAN
+#  define ARCH_NR	AUDIT_ARCH_PPC64LE
+# else
+#  define ARCH_NR	AUDIT_ARCH_PPC64
+# endif
+
+#elif defined(__PPC__)
+
+# define ARCH_NR	AUDIT_ARCH_PPC
+
+#elif __riscv && __riscv_xlen == 64
+
+# define ARCH_NR	AUDIT_ARCH_RISCV64
+
+#else
+
+# error "Platform does not support seccomp filter yet"
+
+#endif
+
+#endif
+
+
+#ifndef __CYGWIN__
+bool sec_harden(void);
+bool can_drop_root(void);
+bool droproot(uid_t uid, gid_t gid);
+void print_id(void);
+#endif
+
+void daemonize(void);
+bool writepid(const char *filename);

nfq/win.c

@@ -0,0 +1,80 @@
+#ifdef __CYGWIN__
+
+#include <windows.h>
+
+#include "win.h"
+#include "nfqws.h"
+
+#define SERVICE_NAME "winws"
+
+static SERVICE_STATUS ServiceStatus;
+static SERVICE_STATUS_HANDLE hStatus = NULL;
+static int service_argc = 0;
+static char **service_argv = NULL;
+
+void service_main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)));
+
+bool service_run(int argc, char *argv[])
+{
+	SERVICE_TABLE_ENTRY ServiceTable[] = {
+		{SERVICE_NAME, (LPSERVICE_MAIN_FUNCTION)service_main},
+		{NULL, NULL}
+	};
+
+	service_argc = argc;
+	service_argv = argv;
+
+	return StartServiceCtrlDispatcherA(ServiceTable);
+}
+
+static void service_set_status(DWORD state)
+{
+	ServiceStatus.dwCurrentState = state;
+	SetServiceStatus(hStatus, &ServiceStatus);
+}
+
+// Control handler function
+void service_controlhandler(DWORD request)
+{
+	switch (request)
+	{
+	case SERVICE_CONTROL_STOP:
+	case SERVICE_CONTROL_SHUTDOWN:
+		bQuit = true;
+		ServiceStatus.dwCurrentState = SERVICE_STOP_PENDING;
+		break;
+	}
+	SetServiceStatus(hStatus, &ServiceStatus);
+}
+
+void service_main(int argc __attribute__((unused)), char *argv[] __attribute__((unused)))
+{
+	ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
+	ServiceStatus.dwCurrentState = SERVICE_RUNNING;
+	ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN;
+	ServiceStatus.dwWin32ExitCode = 0;
+	ServiceStatus.dwServiceSpecificExitCode = 0;
+	ServiceStatus.dwCheckPoint = 1;
+	ServiceStatus.dwWaitHint = 0;
+
+	hStatus = RegisterServiceCtrlHandlerA(
+		SERVICE_NAME,
+		(LPHANDLER_FUNCTION)service_controlhandler);
+	if (hStatus == (SERVICE_STATUS_HANDLE)0)
+	{
+		// Registering Control Handler failed
+		return;
+	}
+
+	SetServiceStatus(hStatus, &ServiceStatus);
+
+	// Calling main with saved argc & argv
+	ServiceStatus.dwWin32ExitCode = (DWORD)main(service_argc, service_argv);
+
+	ServiceStatus.dwCurrentState = SERVICE_STOPPED;
+	SetServiceStatus(hStatus, &ServiceStatus);
+	return;
+}
+
+
+#endif

nfq/win.h

@@ -0,0 +1,10 @@
+#pragma once
+
+#ifdef __CYGWIN__
+
+#include <stdbool.h>
+
+bool service_run();
+
+#endif
+

nfq/windivert/windivert.h

@@ -0,0 +1,630 @@
+/*
+ * windivert.h
+ * (C) 2019, all rights reserved,
+ *
+ * This file is part of WinDivert.
+ *
+ * WinDivert is free software: you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the
+ * Free Software Foundation, either version 3 of the License, or (at your
+ * option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public
+ * License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * WinDivert is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ * 
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ * 
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc., 51
+ * Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ */
+
+#ifndef __WINDIVERT_H
+#define __WINDIVERT_H
+
+#ifndef WINDIVERT_KERNEL
+#include <windows.h>
+#endif      /* WINDIVERT_KERNEL */
+
+#ifndef WINDIVERTEXPORT
+#define WINDIVERTEXPORT     extern __declspec(dllimport)
+#endif      /* WINDIVERTEXPORT */
+
+#ifdef __MINGW32__
+#define __in
+#define __in_opt
+#define __out
+#define __out_opt
+#define __inout
+#define __inout_opt
+#include <stdint.h>
+#define INT8    int8_t
+#define UINT8   uint8_t
+#define INT16   int16_t
+#define UINT16  uint16_t
+#define INT32   int32_t
+#define UINT32  uint32_t
+#define INT64   int64_t
+#define UINT64  uint64_t
+#endif      /* __MINGW32__ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/****************************************************************************/
+/* WINDIVERT API                                                            */
+/****************************************************************************/
+
+/*
+ * WinDivert layers.
+ */
+typedef enum
+{
+    WINDIVERT_LAYER_NETWORK = 0,        /* Network layer. */
+    WINDIVERT_LAYER_NETWORK_FORWARD = 1,/* Network layer (forwarded packets) */
+    WINDIVERT_LAYER_FLOW = 2,           /* Flow layer. */
+    WINDIVERT_LAYER_SOCKET = 3,         /* Socket layer. */
+    WINDIVERT_LAYER_REFLECT = 4,        /* Reflect layer. */
+} WINDIVERT_LAYER, *PWINDIVERT_LAYER;
+
+/*
+ * WinDivert NETWORK and NETWORK_FORWARD layer data.
+ */
+typedef struct
+{
+    UINT32 IfIdx;                       /* Packet's interface index. */
+    UINT32 SubIfIdx;                    /* Packet's sub-interface index. */
+} WINDIVERT_DATA_NETWORK, *PWINDIVERT_DATA_NETWORK;
+
+/*
+ * WinDivert FLOW layer data.
+ */
+typedef struct
+{
+    UINT64 EndpointId;                  /* Endpoint ID. */
+    UINT64 ParentEndpointId;            /* Parent endpoint ID. */
+    UINT32 ProcessId;                   /* Process ID. */
+    UINT32 LocalAddr[4];                /* Local address. */
+    UINT32 RemoteAddr[4];               /* Remote address. */
+    UINT16 LocalPort;                   /* Local port. */
+    UINT16 RemotePort;                  /* Remote port. */
+    UINT8  Protocol;                    /* Protocol. */
+} WINDIVERT_DATA_FLOW, *PWINDIVERT_DATA_FLOW;
+
+/*
+ * WinDivert SOCKET layer data.
+ */
+typedef struct
+{
+    UINT64 EndpointId;                  /* Endpoint ID. */
+    UINT64 ParentEndpointId;            /* Parent Endpoint ID. */
+    UINT32 ProcessId;                   /* Process ID. */
+    UINT32 LocalAddr[4];                /* Local address. */
+    UINT32 RemoteAddr[4];               /* Remote address. */
+    UINT16 LocalPort;                   /* Local port. */
+    UINT16 RemotePort;                  /* Remote port. */
+    UINT8  Protocol;                    /* Protocol. */
+} WINDIVERT_DATA_SOCKET, *PWINDIVERT_DATA_SOCKET;
+
+/*
+ * WinDivert REFLECTION layer data.
+ */
+typedef struct
+{
+    INT64  Timestamp;                   /* Handle open time. */
+    UINT32 ProcessId;                   /* Handle process ID. */
+    WINDIVERT_LAYER Layer;              /* Handle layer. */
+    UINT64 Flags;                       /* Handle flags. */
+    INT16  Priority;                    /* Handle priority. */
+} WINDIVERT_DATA_REFLECT, *PWINDIVERT_DATA_REFLECT;
+
+/*
+ * WinDivert address.
+ */
+#ifdef _MSC_VER
+#pragma warning(push)
+#pragma warning(disable: 4201)
+#endif
+typedef struct
+{
+    INT64  Timestamp;                   /* Packet's timestamp. */
+    UINT32 Layer:8;                     /* Packet's layer. */
+    UINT32 Event:8;                     /* Packet event. */
+    UINT32 Sniffed:1;                   /* Packet was sniffed? */
+    UINT32 Outbound:1;                  /* Packet is outound? */
+    UINT32 Loopback:1;                  /* Packet is loopback? */
+    UINT32 Impostor:1;                  /* Packet is impostor? */
+    UINT32 IPv6:1;                      /* Packet is IPv6? */
+    UINT32 IPChecksum:1;                /* Packet has valid IPv4 checksum? */
+    UINT32 TCPChecksum:1;               /* Packet has valid TCP checksum? */
+    UINT32 UDPChecksum:1;               /* Packet has valid UDP checksum? */
+    UINT32 Reserved1:8;
+    UINT32 Reserved2;
+    union
+    {
+        WINDIVERT_DATA_NETWORK Network; /* Network layer data. */
+        WINDIVERT_DATA_FLOW Flow;       /* Flow layer data. */
+        WINDIVERT_DATA_SOCKET Socket;   /* Socket layer data. */
+        WINDIVERT_DATA_REFLECT Reflect; /* Reflect layer data. */
+        UINT8 Reserved3[64];
+    };
+} WINDIVERT_ADDRESS, *PWINDIVERT_ADDRESS;
+#ifdef _MSC_VER
+#pragma warning(pop)
+#endif
+
+/*
+ * WinDivert events.
+ */
+typedef enum
+{
+    WINDIVERT_EVENT_NETWORK_PACKET = 0, /* Network packet. */
+    WINDIVERT_EVENT_FLOW_ESTABLISHED = 1,
+                                        /* Flow established. */
+    WINDIVERT_EVENT_FLOW_DELETED = 2,   /* Flow deleted. */
+    WINDIVERT_EVENT_SOCKET_BIND = 3,    /* Socket bind. */
+    WINDIVERT_EVENT_SOCKET_CONNECT = 4, /* Socket connect. */
+    WINDIVERT_EVENT_SOCKET_LISTEN = 5,  /* Socket listen. */
+    WINDIVERT_EVENT_SOCKET_ACCEPT = 6,  /* Socket accept. */
+    WINDIVERT_EVENT_SOCKET_CLOSE = 7,   /* Socket close. */
+    WINDIVERT_EVENT_REFLECT_OPEN = 8,   /* WinDivert handle opened. */
+    WINDIVERT_EVENT_REFLECT_CLOSE = 9,  /* WinDivert handle closed. */
+} WINDIVERT_EVENT, *PWINDIVERT_EVENT;
+
+/*
+ * WinDivert flags.
+ */
+#define WINDIVERT_FLAG_SNIFF            0x0001
+#define WINDIVERT_FLAG_DROP             0x0002
+#define WINDIVERT_FLAG_RECV_ONLY        0x0004
+#define WINDIVERT_FLAG_READ_ONLY        WINDIVERT_FLAG_RECV_ONLY
+#define WINDIVERT_FLAG_SEND_ONLY        0x0008
+#define WINDIVERT_FLAG_WRITE_ONLY       WINDIVERT_FLAG_SEND_ONLY
+#define WINDIVERT_FLAG_NO_INSTALL       0x0010
+#define WINDIVERT_FLAG_FRAGMENTS        0x0020
+
+/*
+ * WinDivert parameters.
+ */
+typedef enum
+{
+    WINDIVERT_PARAM_QUEUE_LENGTH = 0,   /* Packet queue length. */
+    WINDIVERT_PARAM_QUEUE_TIME = 1,     /* Packet queue time. */
+    WINDIVERT_PARAM_QUEUE_SIZE = 2,     /* Packet queue size. */
+    WINDIVERT_PARAM_VERSION_MAJOR = 3,  /* Driver version (major). */
+    WINDIVERT_PARAM_VERSION_MINOR = 4,  /* Driver version (minor). */
+} WINDIVERT_PARAM, *PWINDIVERT_PARAM;
+#define WINDIVERT_PARAM_MAX             WINDIVERT_PARAM_VERSION_MINOR
+
+/*
+ * WinDivert shutdown parameter.
+ */
+typedef enum
+{
+    WINDIVERT_SHUTDOWN_RECV = 0x1,      /* Shutdown recv. */
+    WINDIVERT_SHUTDOWN_SEND = 0x2,      /* Shutdown send. */
+    WINDIVERT_SHUTDOWN_BOTH = 0x3,      /* Shutdown recv and send. */
+} WINDIVERT_SHUTDOWN, *PWINDIVERT_SHUTDOWN;
+#define WINDIVERT_SHUTDOWN_MAX          WINDIVERT_SHUTDOWN_BOTH
+
+#ifndef WINDIVERT_KERNEL
+
+/*
+ * Open a WinDivert handle.
+ */
+WINDIVERTEXPORT HANDLE WinDivertOpen(
+    __in        const char *filter,
+    __in        WINDIVERT_LAYER layer,
+    __in        INT16 priority,
+    __in        UINT64 flags);
+
+/*
+ * Receive (read) a packet from a WinDivert handle.
+ */
+WINDIVERTEXPORT BOOL WinDivertRecv(
+    __in        HANDLE handle,
+    __out_opt   VOID *pPacket,
+    __in        UINT packetLen,
+    __out_opt   UINT *pRecvLen,
+    __out_opt   WINDIVERT_ADDRESS *pAddr);
+
+/*
+ * Receive (read) a packet from a WinDivert handle.
+ */
+WINDIVERTEXPORT BOOL WinDivertRecvEx(
+    __in        HANDLE handle,
+    __out_opt   VOID *pPacket,
+    __in        UINT packetLen,
+    __out_opt   UINT *pRecvLen,
+    __in        UINT64 flags,
+    __out       WINDIVERT_ADDRESS *pAddr,
+    __inout_opt UINT *pAddrLen,
+    __inout_opt LPOVERLAPPED lpOverlapped);
+
+/*
+ * Send (write/inject) a packet to a WinDivert handle.
+ */
+WINDIVERTEXPORT BOOL WinDivertSend(
+    __in        HANDLE handle,
+    __in        const VOID *pPacket,
+    __in        UINT packetLen,
+    __out_opt   UINT *pSendLen,
+    __in        const WINDIVERT_ADDRESS *pAddr);
+
+/*
+ * Send (write/inject) a packet to a WinDivert handle.
+ */
+WINDIVERTEXPORT BOOL WinDivertSendEx(
+    __in        HANDLE handle,
+    __in        const VOID *pPacket,
+    __in        UINT packetLen,
+    __out_opt   UINT *pSendLen,
+    __in        UINT64 flags,
+    __in        const WINDIVERT_ADDRESS *pAddr,
+    __in        UINT addrLen,
+    __inout_opt LPOVERLAPPED lpOverlapped);
+
+/*
+ * Shutdown a WinDivert handle.
+ */
+WINDIVERTEXPORT BOOL WinDivertShutdown(
+    __in        HANDLE handle,
+    __in        WINDIVERT_SHUTDOWN how);
+
+/*
+ * Close a WinDivert handle.
+ */
+WINDIVERTEXPORT BOOL WinDivertClose(
+    __in        HANDLE handle);
+
+/*
+ * Set a WinDivert handle parameter.
+ */
+WINDIVERTEXPORT BOOL WinDivertSetParam(
+    __in        HANDLE handle,
+    __in        WINDIVERT_PARAM param,
+    __in        UINT64 value);
+
+/*
+ * Get a WinDivert handle parameter.
+ */
+WINDIVERTEXPORT BOOL WinDivertGetParam(
+    __in        HANDLE handle,
+    __in        WINDIVERT_PARAM param,
+    __out       UINT64 *pValue);
+
+#endif      /* WINDIVERT_KERNEL */
+
+/*
+ * WinDivert constants.
+ */
+#define WINDIVERT_PRIORITY_HIGHEST              30000
+#define WINDIVERT_PRIORITY_LOWEST               (-WINDIVERT_PRIORITY_HIGHEST)
+#define WINDIVERT_PARAM_QUEUE_LENGTH_DEFAULT    4096
+#define WINDIVERT_PARAM_QUEUE_LENGTH_MIN        32
+#define WINDIVERT_PARAM_QUEUE_LENGTH_MAX        16384
+#define WINDIVERT_PARAM_QUEUE_TIME_DEFAULT      2000        /* 2s */
+#define WINDIVERT_PARAM_QUEUE_TIME_MIN          100         /* 100ms */
+#define WINDIVERT_PARAM_QUEUE_TIME_MAX          16000       /* 16s */
+#define WINDIVERT_PARAM_QUEUE_SIZE_DEFAULT      4194304     /* 4MB */
+#define WINDIVERT_PARAM_QUEUE_SIZE_MIN          65535       /* 64KB */
+#define WINDIVERT_PARAM_QUEUE_SIZE_MAX          33554432    /* 32MB */
+#define WINDIVERT_BATCH_MAX                     0xFF        /* 255 */
+#define WINDIVERT_MTU_MAX                       (40 + 0xFFFF)
+
+/****************************************************************************/
+/* WINDIVERT HELPER API                                                     */
+/****************************************************************************/
+
+#ifdef _MSC_VER
+#pragma warning(push)
+#pragma warning(disable: 4214)
+#endif
+
+/*
+ * IPv4/IPv6/ICMP/ICMPv6/TCP/UDP header definitions.
+ */
+typedef struct
+{
+    UINT8  HdrLength:4;
+    UINT8  Version:4;
+    UINT8  TOS;
+    UINT16 Length;
+    UINT16 Id;
+    UINT16 FragOff0;
+    UINT8  TTL;
+    UINT8  Protocol;
+    UINT16 Checksum;
+    UINT32 SrcAddr;
+    UINT32 DstAddr;
+} WINDIVERT_IPHDR, *PWINDIVERT_IPHDR;
+
+#define WINDIVERT_IPHDR_GET_FRAGOFF(hdr)                    \
+    (((hdr)->FragOff0) & 0xFF1F)
+#define WINDIVERT_IPHDR_GET_MF(hdr)                         \
+    ((((hdr)->FragOff0) & 0x0020) != 0)
+#define WINDIVERT_IPHDR_GET_DF(hdr)                         \
+    ((((hdr)->FragOff0) & 0x0040) != 0)
+#define WINDIVERT_IPHDR_GET_RESERVED(hdr)                   \
+    ((((hdr)->FragOff0) & 0x0080) != 0)
+
+#define WINDIVERT_IPHDR_SET_FRAGOFF(hdr, val)               \
+    do                                                      \
+    {                                                       \
+        (hdr)->FragOff0 = (((hdr)->FragOff0) & 0x00E0) |    \
+            ((val) & 0xFF1F);                               \
+    }                                                       \
+    while (FALSE)
+#define WINDIVERT_IPHDR_SET_MF(hdr, val)                    \
+    do                                                      \
+    {                                                       \
+        (hdr)->FragOff0 = (((hdr)->FragOff0) & 0xFFDF) |    \
+            (((val) & 0x0001) << 5);                        \
+    }                                                       \
+    while (FALSE)
+#define WINDIVERT_IPHDR_SET_DF(hdr, val)                    \
+    do                                                      \
+    {                                                       \
+        (hdr)->FragOff0 = (((hdr)->FragOff0) & 0xFFBF) |    \
+            (((val) & 0x0001) << 6);                        \
+    }                                                       \
+    while (FALSE)
+#define WINDIVERT_IPHDR_SET_RESERVED(hdr, val)              \
+    do                                                      \
+    {                                                       \
+        (hdr)->FragOff0 = (((hdr)->FragOff0) & 0xFF7F) |    \
+            (((val) & 0x0001) << 7);                        \
+    }                                                       \
+    while (FALSE)
+
+typedef struct
+{
+    UINT8  TrafficClass0:4;
+    UINT8  Version:4;
+    UINT8  FlowLabel0:4;
+    UINT8  TrafficClass1:4;
+    UINT16 FlowLabel1;
+    UINT16 Length;
+    UINT8  NextHdr;
+    UINT8  HopLimit;
+    UINT32 SrcAddr[4];
+    UINT32 DstAddr[4];
+} WINDIVERT_IPV6HDR, *PWINDIVERT_IPV6HDR;
+
+#define WINDIVERT_IPV6HDR_GET_TRAFFICCLASS(hdr)             \
+    ((((hdr)->TrafficClass0) << 4) | ((hdr)->TrafficClass1))
+#define WINDIVERT_IPV6HDR_GET_FLOWLABEL(hdr)                \
+    ((((UINT32)(hdr)->FlowLabel0) << 16) | ((UINT32)(hdr)->FlowLabel1))
+
+#define WINDIVERT_IPV6HDR_SET_TRAFFICCLASS(hdr, val)        \
+    do                                                      \
+    {                                                       \
+        (hdr)->TrafficClass0 = ((UINT8)(val) >> 4);         \
+        (hdr)->TrafficClass1 = (UINT8)(val);                \
+    }                                                       \
+    while (FALSE)
+#define WINDIVERT_IPV6HDR_SET_FLOWLABEL(hdr, val)           \
+    do                                                      \
+    {                                                       \
+        (hdr)->FlowLabel0 = (UINT8)((val) >> 16);           \
+        (hdr)->FlowLabel1 = (UINT16)(val);                  \
+    }                                                       \
+    while (FALSE)
+
+typedef struct
+{
+    UINT8  Type;
+    UINT8  Code;
+    UINT16 Checksum;
+    UINT32 Body;
+} WINDIVERT_ICMPHDR, *PWINDIVERT_ICMPHDR;
+
+typedef struct
+{
+    UINT8  Type;
+    UINT8  Code;
+    UINT16 Checksum;
+    UINT32 Body;
+} WINDIVERT_ICMPV6HDR, *PWINDIVERT_ICMPV6HDR;
+
+typedef struct
+{
+    UINT16 SrcPort;
+    UINT16 DstPort;
+    UINT32 SeqNum;
+    UINT32 AckNum;
+    UINT16 Reserved1:4;
+    UINT16 HdrLength:4;
+    UINT16 Fin:1;
+    UINT16 Syn:1;
+    UINT16 Rst:1;
+    UINT16 Psh:1;
+    UINT16 Ack:1;
+    UINT16 Urg:1;
+    UINT16 Reserved2:2;
+    UINT16 Window;
+    UINT16 Checksum;
+    UINT16 UrgPtr;
+} WINDIVERT_TCPHDR, *PWINDIVERT_TCPHDR;
+
+typedef struct
+{
+    UINT16 SrcPort;
+    UINT16 DstPort;
+    UINT16 Length;
+    UINT16 Checksum;
+} WINDIVERT_UDPHDR, *PWINDIVERT_UDPHDR;
+
+#ifdef _MSC_VER
+#pragma warning(pop)
+#endif
+
+/*
+ * Flags for WinDivertHelperCalcChecksums()
+ */
+#define WINDIVERT_HELPER_NO_IP_CHECKSUM                     1
+#define WINDIVERT_HELPER_NO_ICMP_CHECKSUM                   2
+#define WINDIVERT_HELPER_NO_ICMPV6_CHECKSUM                 4
+#define WINDIVERT_HELPER_NO_TCP_CHECKSUM                    8
+#define WINDIVERT_HELPER_NO_UDP_CHECKSUM                    16
+
+#ifndef WINDIVERT_KERNEL
+
+/*
+ * Hash a packet.
+ */
+WINDIVERTEXPORT UINT64 WinDivertHelperHashPacket(
+    __in        const VOID *pPacket,
+    __in        UINT packetLen,
+    __in        UINT64 seed
+#ifdef __cplusplus
+                = 0
+#endif
+);
+
+/*
+ * Parse IPv4/IPv6/ICMP/ICMPv6/TCP/UDP headers from a raw packet.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperParsePacket(
+    __in        const VOID *pPacket,
+    __in        UINT packetLen,
+    __out_opt   PWINDIVERT_IPHDR *ppIpHdr,
+    __out_opt   PWINDIVERT_IPV6HDR *ppIpv6Hdr,
+    __out_opt   UINT8 *pProtocol,
+    __out_opt   PWINDIVERT_ICMPHDR *ppIcmpHdr,
+    __out_opt   PWINDIVERT_ICMPV6HDR *ppIcmpv6Hdr,
+    __out_opt   PWINDIVERT_TCPHDR *ppTcpHdr,
+    __out_opt   PWINDIVERT_UDPHDR *ppUdpHdr,
+    __out_opt   PVOID *ppData,
+    __out_opt   UINT *pDataLen,
+    __out_opt   PVOID *ppNext,
+    __out_opt   UINT *pNextLen);
+
+/*
+ * Parse an IPv4 address.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperParseIPv4Address(
+    __in        const char *addrStr,
+    __out_opt   UINT32 *pAddr);
+
+/*
+ * Parse an IPv6 address.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperParseIPv6Address(
+    __in        const char *addrStr,
+    __out_opt   UINT32 *pAddr);
+
+/*
+ * Format an IPv4 address.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperFormatIPv4Address(
+    __in        UINT32 addr,
+    __out       char *buffer,
+    __in        UINT bufLen);
+
+/*
+ * Format an IPv6 address.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperFormatIPv6Address(
+    __in        const UINT32 *pAddr,
+    __out       char *buffer,
+    __in        UINT bufLen);
+
+/*
+ * Calculate IPv4/IPv6/ICMP/ICMPv6/TCP/UDP checksums.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperCalcChecksums(
+    __inout     VOID *pPacket, 
+    __in        UINT packetLen,
+    __out_opt   WINDIVERT_ADDRESS *pAddr,
+    __in        UINT64 flags);
+
+/*
+ * Decrement the TTL/HopLimit.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperDecrementTTL(
+    __inout     VOID *pPacket,
+    __in        UINT packetLen);
+
+/*
+ * Compile the given filter string.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperCompileFilter(
+    __in        const char *filter,
+    __in        WINDIVERT_LAYER layer,
+    __out_opt   char *object,
+    __in        UINT objLen,
+    __out_opt   const char **errorStr,
+    __out_opt   UINT *errorPos);
+
+/*
+ * Evaluate the given filter string.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperEvalFilter(
+    __in        const char *filter,
+    __in        const VOID *pPacket,
+    __in        UINT packetLen,
+    __in        const WINDIVERT_ADDRESS *pAddr);
+
+/*
+ * Format the given filter string.
+ */
+WINDIVERTEXPORT BOOL WinDivertHelperFormatFilter(
+    __in        const char *filter,
+    __in        WINDIVERT_LAYER layer,
+    __out       char *buffer,
+    __in        UINT bufLen);
+
+/*
+ * Byte ordering.
+ */
+WINDIVERTEXPORT UINT16 WinDivertHelperNtohs(
+    __in        UINT16 x);
+WINDIVERTEXPORT UINT16 WinDivertHelperHtons(
+    __in        UINT16 x);
+WINDIVERTEXPORT UINT32 WinDivertHelperNtohl(
+    __in        UINT32 x);
+WINDIVERTEXPORT UINT32 WinDivertHelperHtonl(
+    __in        UINT32 x);
+WINDIVERTEXPORT UINT64 WinDivertHelperNtohll(
+    __in        UINT64 x);
+WINDIVERTEXPORT UINT64 WinDivertHelperHtonll(
+    __in        UINT64 x);
+WINDIVERTEXPORT void WinDivertHelperNtohIPv6Address(
+    __in        const UINT *inAddr,
+    __out       UINT *outAddr);
+WINDIVERTEXPORT void WinDivertHelperHtonIPv6Address(
+    __in        const UINT *inAddr,
+    __out       UINT *outAddr);
+
+/*
+ * Old names to be removed in the next version.
+ */
+WINDIVERTEXPORT void WinDivertHelperNtohIpv6Address(
+    __in        const UINT *inAddr,
+    __out       UINT *outAddr);
+WINDIVERTEXPORT void WinDivertHelperHtonIpv6Address(
+    __in        const UINT *inAddr,
+    __out       UINT *outAddr);
+
+#endif      /* WINDIVERT_KERNEL */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif      /* __WINDIVERT_H */