security.h File Reference

Go to the source code of this file.

Data Structures
struct	acip_security
	acip security is intentionally a small, concrete record. Fields such as handshake, mode, forbid_encryption, require_encryption give callers the identity and current value they need. It is normally borrowed from, or owned by, the surrounding subsystem—not independently managed. Callers serialize receive/start and keep the transport alive until cleanup. Media must wait for ready, including authentication-only connections. More...

Typedefs
typedef struct acip_security	acip_security_t
	acip security is intentionally a small, concrete record. Fields such as handshake, mode, forbid_encryption, require_encryption give callers the identity and current value they need. It is normally borrowed from, or owned by, the surrounding subsystem—not independently managed. Callers serialize receive/start and keep the transport alive until cleanup. Media must wait for ready, including authentication-only connections.

Functions
asciichat_error_t	acip_security_start (acip_security_t *security, acip_transport_t *transport)
asciichat_error_t	acip_security_receive (acip_security_t *security, acip_transport_t *transport, packet_type_t type, const void *payload, size_t length)
asciichat_error_t	acip_security_init_options (acip_security_t *security, bool server, bool transport_secure, const char *password)
void	acip_security_cleanup (acip_security_t *security)
acip_transport_t *	acip_webrtc_transport_create_secure (struct webrtc_peer_connection *peer, struct webrtc_data_channel *channel, acip_security_t *security, void(*on_ready)(acip_transport_t *, void *), void *user_data)
acip_security_t *	acip_webrtc_transport_security (acip_transport_t *transport)
bool	acip_security_rekey_packet (uint16_t type)
asciichat_error_t	acip_security_rekey_encode (unsigned flow, crypto_rekey_message_t, const void *, size_t, void *, size_t, size_t *)
asciichat_error_t	acip_security_rekey_receive (crypto_rekey_session_t *, acip_traffic_class_t, acip_delivery_t, const void *, size_t, uint64_t now_ns, bool *consumed)
asciichat_error_t	acip_security_rekey_seal (crypto_record_t *, unsigned, crypto_rekey_message_t, const void *, size_t, uint8_t **, size_t *)
asciichat_error_t	acip_security_activate (acip_transport_t *)
asciichat_error_t	acip_security_flush (acip_transport_t *)
asciichat_error_t	acip_security_request_rekey (acip_transport_t *)
asciichat_error_t	acip_security_decrypt (crypto_context_t *, unsigned, unsigned, const void *, size_t, uint8_t **, size_t *, uint64_t *, bool *consumed)
asciichat_error_t	acip_security_seal (crypto_context_t *, acip_traffic_class_t, acip_delivery_t, const void *, size_t, uint8_t **, size_t *)
asciichat_error_t	acip_security_open (crypto_context_t *, acip_traffic_class_t, acip_delivery_t, const void *, size_t, uint8_t **, size_t *, uint64_t *, bool *)
asciichat_error_t	acip_security_next_control (crypto_context_t *, acip_traffic_class_t *, uint8_t **, size_t *)

Typedef Documentation

acip_security_t

typedef struct acip_security acip_security_t

acip security is intentionally a small, concrete record. Fields such as handshake, mode, forbid_encryption, require_encryption give callers the identity and current value they need. It is normally borrowed from, or owned by, the surrounding subsystem—not independently managed. Callers serialize receive/start and keep the transport alive until cleanup. Media must wait for ready, including authentication-only connections.

Per-peer, event-driven negotiation. The caller owns and configures handshake.

Function Documentation

acip_security_activate()

asciichat_error_t acip_security_activate

(

acip_transport_t *

transport

)

Definition at line 178 of file lib/network/acip/security.c.

                                                                      {
  if (!transport)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing secure transport");
  crypto_context_t *crypto = transport->crypto_ctx;
  if (!crypto || !crypto->encrypt_data)
    return ASCIICHAT_OK;
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result == ASCIICHAT_OK) {
    crypto_session_unlock(session);
    atomic_store_bool(&transport->packet_security_active, true);
  }
  return result;
}

References ASCIICHAT_OK, acip_transport::crypto_ctx, crypto_session_lock(), crypto_session_unlock(), crypto_context_t::encrypt_data, ERROR_INVALID_PARAM, acip_transport::packet_security_active, and SET_ERRNO.

Referenced by acip_security_receive(), and quic_transport_begin_security().

acip_security_cleanup()

void acip_security_cleanup

(

acip_security_t *

security

)

Definition at line 11 of file lib/network/acip/security.c.

                                                      {
  if (!security)
    return;
  SAFE_FREE(security->handshake.client_whitelist);
  crypto_handshake_destroy(&security->handshake);
}

References crypto_handshake_context_t::client_whitelist, crypto_handshake_destroy(), acip_security::handshake, and SAFE_FREE.

Referenced by acip_security_init_options(), and peer_crypto_destroy().

acip_security_decrypt()

asciichat_error_t acip_security_decrypt	(	crypto_context_t *	crypto,
		unsigned	flow,
		unsigned	delivery,
		const void *	payload,
		size_t	length,
		uint8_t **	output,
		size_t *	written,
		uint64_t *	sequence,
		bool *	consumed )

Definition at line 193 of file lib/network/acip/security.c.

                                                        {
  if (!output || !written || !consumed)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing security receive output");
  *output = NULL;
  *written = 0;
  *consumed = false;
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result != ASCIICHAT_OK)
    return result;
  result = acip_packet_decrypt_payload(&session->records, flow, delivery, payload, length, output, written, sequence);
  if (result == ASCIICHAT_OK) {
    packet_header_t header;
    memcpy(&header, *output, sizeof(header));
    result = crypto_session_receive(session, session->records.last_receive_channel, delivery,
                                    rekey_message(NET_TO_HOST_U16(header.type)), *output + sizeof(header),
                                    *written - sizeof(header), time_get_ns(), consumed);
  }
  crypto_session_unlock(session);
  if (result != ASCIICHAT_OK) {
    buffer_release(*output);
    *output = NULL;
    *written = 0;
  }
  return result;
}

References acip_packet_decrypt_payload(), ASCIICHAT_OK, buffer_release, crypto_session_lock(), crypto_session_receive(), crypto_session_unlock(), ERROR_INVALID_PARAM, crypto_record::last_receive_channel, NET_TO_HOST_U16, crypto_session::records, and SET_ERRNO.

Referenced by acip_security_open(), client_decrypt_packet(), and packet_decrypt_envelope().

acip_security_flush()

asciichat_error_t acip_security_flush

(

acip_transport_t *

transport

)

Definition at line 248 of file lib/network/acip/security.c.

                                                                   {
  if (!transport || !atomic_load_bool(&transport->packet_security_active))
    return ASCIICHAT_OK;
  for (unsigned i = 0; i < CRYPTO_SESSION_MESSAGES; ++i) {
    uint8_t *wire = NULL;
    size_t length = 0;
    acip_traffic_class_t channel = ACIP_TRAFFIC_CONTROL;
    asciichat_error_t result = acip_security_next_control(transport->crypto_ctx, &channel, &wire, &length);
    if (result != ASCIICHAT_OK || !wire)
      return result;
    defer(buffer_release(wire));
    socket_buffer_t slice = {wire, length};
    acip_send_options_t options = {.traffic_class = channel, .delivery = ACIP_DELIVERY_RELIABLE};
    if (transport->methods->sendv_ex)
      result = transport->methods->sendv_ex(transport, &slice, 1, &options);
    else if (transport->methods->sendv)
      result = transport->methods->sendv(transport, &slice, 1);
    else
      result = transport->methods->send(transport, wire, length);
    if (result != ASCIICHAT_OK)
      return result;
  }
  return ASCIICHAT_OK;
}

References ACIP_DELIVERY_RELIABLE, acip_security_next_control(), ACIP_TRAFFIC_CONTROL, ASCIICHAT_OK, buffer_release, acip_transport::crypto_ctx, CRYPTO_SESSION_MESSAGES, acip_transport::methods, acip_transport::packet_security_active, acip_transport_methods_t::send, acip_transport_methods_t::sendv, and acip_transport_methods_t::sendv_ex.

Referenced by peer_crypto_tick().

acip_security_init_options()

asciichat_error_t acip_security_init_options	(	acip_security_t *	security,
		bool	server,
		bool	transport_secure,
		const char *	password )

Initialize a peer from native CLI options; cleanup releases owned credentials.

Definition at line 6 of file security_options.c.

                                                                            {
  if (!security)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing peer security state");
  memset(security, 0, sizeof(*security));
  const options_t *options = options_get();
  if (!options)
    return SET_ERRNO(ERROR_INVALID_STATE, "Peer security requires initialized options");
  const char *password = password_override ? password_override : options->password;
  crypto_policy_t policy = {
      .transport_secure = transport_secure,
      .encrypt = options->encrypt_enabled,
      .no_encrypt = options->no_encrypt,
      .no_auth = options->no_auth,
      .has_password = password[0] != '\0',
      .has_identity = options->encrypt_key[0] != '\0',
      .has_verification_key = server ? options->client_keys[0] != '\0' : options->server_key[0] != '\0',
  };
  asciichat_error_t result = crypto_policy_resolve(&policy, &security->mode);
  security->forbid_encryption = policy.no_encrypt;
  security->require_encryption = policy.encrypt;
  if (result != ASCIICHAT_OK)
    return result;
  crypto_handshake_context_t *ctx = &security->handshake;
  result = policy.has_password ? crypto_handshake_init_with_password("webrtc_peer", ctx, server, password)
                               : crypto_handshake_init("webrtc_peer", ctx, server);
  if (result != ASCIICHAT_OK)
    return result;
  ctx->require_client_auth = server && options->require_server_verify;
  ctx->crypto_ctx.encrypt_data = ACIP_CRYPTO_HAS_ENCRYPT(security->mode);
  if (policy.has_identity) {
    private_key_t *private_key = server ? &ctx->server_private_key : &ctx->client_private_key;
    public_key_t *public_key = server ? &ctx->server_public_key : &ctx->client_public_key;
    result = parse_private_key(options->encrypt_key, private_key);
    if (result != ASCIICHAT_OK)
      goto failed;
    public_key->type = KEY_TYPE_ED25519;
    memcpy(public_key->key, private_key->public_key, ED25519_PUBLIC_KEY_SIZE);
    if (!server && strncmp(options->encrypt_key, "gpg:", 4) == 0)
      SAFE_STRNCPY(ctx->client_gpg_key_id, options->encrypt_key + 4, sizeof(ctx->client_gpg_key_id));
  }
  if (server && policy.has_verification_key) {
    ctx->client_whitelist = SAFE_CALLOC(MAX_CLIENTS, sizeof(public_key_t), public_key_t *);
    if (!ctx->client_whitelist) {
      result = SET_ERRNO(ERROR_MEMORY, "Cannot allocate WebRTC client key list");
      goto failed;
    }
    result = parse_public_keys(options->client_keys, ctx->client_whitelist, &ctx->num_whitelisted_clients, MAX_CLIENTS);
    if (result != ASCIICHAT_OK)
      goto failed;
    if (!ctx->num_whitelisted_clients) {
      result = SET_ERRNO(ERROR_CRYPTO_AUTH, "WebRTC client key list is empty");
      goto failed;
    }
    ctx->require_client_auth = true;
  } else if (!server && policy.has_verification_key) {
    ctx->verify_server_key = true;
    SAFE_STRNCPY(ctx->expected_server_key, options->server_key, sizeof(ctx->expected_server_key));
    SAFE_STRNCPY(ctx->server_hostname, options->session_string, sizeof(ctx->server_hostname));
  }
  return ASCIICHAT_OK;
failed:
  acip_security_cleanup(security);
  return result;
}

References ACIP_CRYPTO_HAS_ENCRYPT, acip_security_cleanup(), ASCIICHAT_OK, crypto_handshake_context_t::client_gpg_key_id, options_state::client_keys, crypto_handshake_context_t::client_private_key, crypto_handshake_context_t::client_public_key, crypto_handshake_context_t::client_whitelist, crypto_handshake_context_t::crypto_ctx, crypto_handshake_init(), crypto_handshake_init_with_password(), crypto_policy_resolve(), ED25519_PUBLIC_KEY_SIZE, crypto_policy_t::encrypt, crypto_context_t::encrypt_data, options_state::encrypt_enabled, options_state::encrypt_key, ERROR_CRYPTO_AUTH, ERROR_INVALID_PARAM, ERROR_INVALID_STATE, ERROR_MEMORY, crypto_handshake_context_t::expected_server_key, acip_security::forbid_encryption, acip_security::handshake, crypto_policy_t::has_identity, crypto_policy_t::has_password, crypto_policy_t::has_verification_key, public_key_t::key, KEY_TYPE_ED25519, MAX_CLIENTS, acip_security::mode, options_state::no_auth, crypto_policy_t::no_encrypt, options_state::no_encrypt, crypto_handshake_context_t::num_whitelisted_clients, options_get(), parse_private_key(), parse_public_keys(), options_state::password, private_key_t::public_key, crypto_handshake_context_t::require_client_auth, acip_security::require_encryption, options_state::require_server_verify, SAFE_CALLOC, SAFE_STRNCPY, crypto_handshake_context_t::server_hostname, options_state::server_key, crypto_handshake_context_t::server_private_key, crypto_handshake_context_t::server_public_key, options_state::session_string, SET_ERRNO, public_key_t::type, and crypto_handshake_context_t::verify_server_key.

Referenced by network_connection_prepare_security().

acip_security_next_control()

asciichat_error_t acip_security_next_control	(	crypto_context_t *	crypto,
		acip_traffic_class_t *	flow,
		uint8_t **	wire,
		size_t *	length )

Definition at line 222 of file lib/network/acip/security.c.

                                                             {
  if (!flow || !wire || !length)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing security output");
  *wire = NULL;
  *length = 0;
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result != ASCIICHAT_OK)
    return result;
  defer(crypto_session_unlock(session));
  result = crypto_session_tick(session, time_get_ns());
  if (result == ASCIICHAT_OK && session->count) {
    crypto_session_message_t *message = &session->messages[session->head];
    *flow = (acip_traffic_class_t)message->channel;
    result = acip_security_rekey_seal(&session->records, message->channel, message->type, message->payload,
                                      message->length, wire, length);
    if (result == ASCIICHAT_OK) {
      memset(message, 0, sizeof(*message));
      session->head = (session->head + 1) % CRYPTO_SESSION_MESSAGES;
      --session->count;
    }
  }
  return result;
}

References acip_security_rekey_seal(), ASCIICHAT_OK, crypto_session_message_t::channel, crypto_session::count, crypto_session_lock(), CRYPTO_SESSION_MESSAGES, crypto_session_tick(), crypto_session_unlock(), ERROR_INVALID_PARAM, crypto_session::head, crypto_session_message_t::length, crypto_session::messages, crypto_session_message_t::payload, crypto_session::records, SET_ERRNO, and crypto_session_message_t::type.

Referenced by acip_security_flush(), and browser_security_output().

acip_security_open()

asciichat_error_t acip_security_open	(	crypto_context_t *	crypto,
		acip_traffic_class_t	flow,
		acip_delivery_t	delivery,
		const void *	packet,
		size_t	length,
		uint8_t **	output,
		size_t *	written,
		uint64_t *	sequence,
		bool *	consumed )

Definition at line 296 of file lib/network/acip/security.c.

                                                                         {
  packet_header_t header;
  asciichat_error_t result = packet_validate(packet, length, 0, &header);
  if (result != ASCIICHAT_OK)
    return result;
  if (NET_TO_HOST_U16(header.type) != PACKET_TYPE_ENCRYPTED)
    return SET_ERRNO(ERROR_CRYPTO, "Expected authenticated session record");
  return acip_security_decrypt(crypto, flow, delivery, (const uint8_t *)packet + sizeof(header),
                               length - sizeof(header), output, written, sequence, consumed);
}

References acip_security_decrypt(), ASCIICHAT_OK, ERROR_CRYPTO, NET_TO_HOST_U16, PACKET_TYPE_ENCRYPTED, packet_validate(), and SET_ERRNO.

Referenced by browser_security_packet(), and peer_crypto_receive().

acip_security_receive()

asciichat_error_t acip_security_receive	(	acip_security_t *	security,
		acip_transport_t *	transport,
		packet_type_t	type,
		const void *	payload,
		size_t	length )

Definition at line 32 of file lib/network/acip/security.c.

                                                                            {
  if (!security || !transport || (!payload && length) || security->ready)
    return SET_ERRNO(ERROR_INVALID_STATE, "Unexpected peer security packet");
  crypto_handshake_context_t *ctx = &security->handshake;
  asciichat_error_t result = ASCIICHAT_OK;
  if (!security->version_received) {
    if (type != PACKET_TYPE_PROTOCOL_VERSION || length != sizeof(protocol_version_packet_t))
      return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Expected peer security negotiation before media");
    protocol_version_packet_t version;
    memcpy(&version, payload, sizeof(version));
    uint8_t mode = version.supports_encryption;
    if (NET_TO_HOST_U16(version.protocol_version) != PROTOCOL_VERSION_MAJOR ||
        NET_TO_HOST_U16(version.protocol_revision) != PROTOCOL_VERSION_MINOR ||
        NET_TO_HOST_U16(version.protocol_patch) != PROTOCOL_VERSION_PATCH || mode > ACIP_CRYPTO_FULL)
      return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Unsupported peer security protocol");
    if (ctx->is_server) {
      // Match secure WebSocket policy: defaults do not override a client's explicit no-encrypt.
      if ((ctx->has_password || ctx->require_client_auth) && !ACIP_CRYPTO_HAS_AUTH(mode))
        return SET_ERRNO(ERROR_CRYPTO_AUTH, "Peer omitted required authentication");
      if (security->require_encryption && !ACIP_CRYPTO_HAS_ENCRYPT(mode))
        return SET_ERRNO(ERROR_CRYPTO, "Peer omitted required encryption");
      if (security->forbid_encryption && ACIP_CRYPTO_HAS_ENCRYPT(mode))
        return SET_ERRNO(ERROR_CRYPTO, "Peer requires encryption but local policy disables it");
      version.supports_encryption = mode;
      result = packet_send_via_transport(transport, PACKET_TYPE_PROTOCOL_VERSION, &version, sizeof(version), 0);
      if (result != ASCIICHAT_OK)
        return result;
    } else if ((mode & security->mode) != security->mode) {
      return SET_ERRNO(ERROR_CRYPTO, "Peer attempted to downgrade requested security");
    }
    if (security->forbid_encryption && ACIP_CRYPTO_HAS_ENCRYPT(mode))
      return SET_ERRNO(ERROR_CRYPTO, "Peer requires encryption but local policy disables it");
    security->mode = mode;
    security->version_received = true;
    ctx->crypto_ctx.encrypt_data = ACIP_CRYPTO_HAS_ENCRYPT(mode);
    if (mode == ACIP_CRYPTO_NONE) {
      ctx->state = CRYPTO_HANDSHAKE_DISABLED;
      security->ready = true;
      return ASCIICHAT_OK;
    }
    if (!ctx->is_server)
      return ASCIICHAT_OK;
    result = crypto_handshake_server_send_parameters(ctx, transport);
    if (result == ASCIICHAT_OK)
      result = crypto_handshake_server_start(ctx, transport);
    return result;
  }
  if (ctx->is_server) {
    if (ctx->state == CRYPTO_HANDSHAKE_KEY_EXCHANGE)
      result = crypto_handshake_server_auth_challenge(ctx, transport, type, payload, length);
    else if (ctx->state == CRYPTO_HANDSHAKE_AUTHENTICATING)
      result = crypto_handshake_server_complete(ctx, transport, type, payload, length);
    else
      result = SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Unexpected peer authentication state");
  } else {
    switch (type) {
    case PACKET_TYPE_CRYPTO_PARAMETERS:
      if (security->parameters_received || ctx->state != CRYPTO_HANDSHAKE_INIT ||
          length != sizeof(crypto_parameters_packet_t))
        return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Invalid peer crypto parameters");
      result = crypto_handshake_set_parameters(ctx, payload);
      if (result == ASCIICHAT_OK && ctx->crypto_ctx.encrypt_data != !!ACIP_CRYPTO_HAS_ENCRYPT(security->mode))
        return SET_ERRNO(ERROR_CRYPTO, "Peer cipher does not match negotiated policy");
      security->parameters_received = result == ASCIICHAT_OK;
      break;
    case PACKET_TYPE_CRYPTO_KEY_EXCHANGE_INIT:
      if (!security->parameters_received)
        return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Missing peer crypto parameters");
      if (ctx->verify_server_key && length == ctx->crypto_ctx.public_key_size)
        return SET_ERRNO(ERROR_CRYPTO_AUTH, "Peer omitted the required identity key");
      result = crypto_handshake_client_key_exchange(ctx, transport, type, payload, length);
      break;
    case PACKET_TYPE_CRYPTO_AUTH_CHALLENGE:
      result = crypto_handshake_client_auth_response(ctx, transport, type, payload, length);
      break;
    case PACKET_TYPE_CRYPTO_HANDSHAKE_COMPLETE:
      if (ctx->has_password || ctx->client_private_key.type == KEY_TYPE_ED25519)
        return SET_ERRNO(ERROR_CRYPTO_AUTH, "Peer skipped required mutual authentication");
      result = crypto_handshake_client_complete(ctx, transport, type, payload, length);
      break;
    case PACKET_TYPE_CRYPTO_SERVER_AUTH_RESP:
    case PACKET_TYPE_CRYPTO_AUTH_FAILED:
      result = crypto_handshake_client_complete(ctx, transport, type, payload, length);
      break;
    default:
      result = SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Application packet before peer authentication");
    }
  }
  if (result == ASCIICHAT_OK)
    security->ready = ctx->state == CRYPTO_HANDSHAKE_READY;
  else
    ctx->state = CRYPTO_HANDSHAKE_FAILED;
  if (result == ASCIICHAT_OK && security->ready)
    result = acip_security_activate(transport);
  return result;
}

References ACIP_CRYPTO_FULL, ACIP_CRYPTO_HAS_AUTH, ACIP_CRYPTO_HAS_ENCRYPT, ACIP_CRYPTO_NONE, acip_security_activate(), ASCIICHAT_OK, crypto_handshake_context_t::client_private_key, crypto_handshake_context_t::crypto_ctx, CRYPTO_HANDSHAKE_AUTHENTICATING, crypto_handshake_client_auth_response(), crypto_handshake_client_complete(), crypto_handshake_client_key_exchange(), CRYPTO_HANDSHAKE_DISABLED, CRYPTO_HANDSHAKE_FAILED, CRYPTO_HANDSHAKE_INIT, CRYPTO_HANDSHAKE_KEY_EXCHANGE, CRYPTO_HANDSHAKE_READY, crypto_handshake_server_auth_challenge(), crypto_handshake_server_complete(), crypto_handshake_server_send_parameters(), crypto_handshake_server_start(), crypto_handshake_set_parameters(), crypto_context_t::encrypt_data, ERROR_CRYPTO, ERROR_CRYPTO_AUTH, ERROR_INVALID_STATE, ERROR_NETWORK_PROTOCOL, acip_security::forbid_encryption, acip_security::handshake, crypto_handshake_context_t::has_password, crypto_handshake_context_t::is_server, KEY_TYPE_ED25519, acip_security::mode, NET_TO_HOST_U16, packet_send_via_transport(), PACKET_TYPE_CRYPTO_AUTH_CHALLENGE, PACKET_TYPE_CRYPTO_AUTH_FAILED, PACKET_TYPE_CRYPTO_HANDSHAKE_COMPLETE, PACKET_TYPE_CRYPTO_KEY_EXCHANGE_INIT, PACKET_TYPE_CRYPTO_PARAMETERS, PACKET_TYPE_CRYPTO_SERVER_AUTH_RESP, PACKET_TYPE_PROTOCOL_VERSION, acip_security::parameters_received, protocol_version_packet_t::protocol_patch, protocol_version_packet_t::protocol_revision, protocol_version_packet_t::protocol_version, PROTOCOL_VERSION_MAJOR, PROTOCOL_VERSION_MINOR, PROTOCOL_VERSION_PATCH, crypto_context_t::public_key_size, acip_security::ready, crypto_handshake_context_t::require_client_auth, acip_security::require_encryption, SET_ERRNO, crypto_handshake_context_t::state, protocol_version_packet_t::supports_encryption, private_key_t::type, crypto_handshake_context_t::verify_server_key, and acip_security::version_received.

Referenced by peer_crypto_receive().

acip_security_rekey_encode()

asciichat_error_t acip_security_rekey_encode	(	unsigned	flow,
		crypto_rekey_message_t	type,
		const void *	payload,
		size_t	length,
		void *	packet,
		size_t	capacity,
		size_t *	written )

Definition at line 149 of file lib/network/acip/security.c.

                                                                                                            {
  if (type <= CRYPTO_REKEY_NONE || type > CRYPTO_REKEY_NEEDED || flow >= CRYPTO_RECORD_CHANNELS)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid rekey message");
  return packet_encode(rekey_types[type], payload, length, flow, packet, capacity, written);
}

References CRYPTO_RECORD_CHANNELS, CRYPTO_REKEY_NEEDED, ERROR_INVALID_PARAM, packet_encode(), and SET_ERRNO.

Referenced by acip_security_rekey_seal().

acip_security_rekey_packet()

bool acip_security_rekey_packet

(

uint16_t

type

)

Definition at line 145 of file lib/network/acip/security.c.

                                               {
  return rekey_message(type) != CRYPTO_REKEY_NONE;
}

References CRYPTO_REKEY_NONE.

Referenced by quic_connection_submit().

acip_security_rekey_receive()

asciichat_error_t acip_security_rekey_receive	(	crypto_rekey_session_t *	session,
		acip_traffic_class_t	flow,
		acip_delivery_t	delivery,
		const void *	packet,
		size_t	length,
		uint64_t	now_ns,
		bool *	consumed )

Definition at line 156 of file lib/network/acip/security.c.

                                                              {
  packet_header_t header;
  asciichat_error_t result = packet_validate(packet, length, 0, &header);
  if (result != ASCIICHAT_OK)
    return result;
  return crypto_rekey_session_receive(session, flow, delivery, rekey_message(NET_TO_HOST_U16(header.type)),
                                      (const uint8_t *)packet + sizeof(header), length - sizeof(header), now, consumed);
}

References ASCIICHAT_OK, crypto_rekey_session_receive(), NET_TO_HOST_U16, and packet_validate().

acip_security_rekey_seal()

asciichat_error_t acip_security_rekey_seal	(	crypto_record_t *	records,
		unsigned	flow,
		crypto_rekey_message_t	message,
		const void *	payload,
		size_t	length,
		uint8_t **	wire,
		size_t *	written )

Definition at line 167 of file lib/network/acip/security.c.

                                                                                                                {
  uint8_t packet[sizeof(packet_header_t) + CRYPTO_PUBLIC_KEY_SIZE];
  size_t packet_length = 0;
  asciichat_error_t result =
      acip_security_rekey_encode(flow, message, payload, length, packet, sizeof(packet), &packet_length);
  return result == ASCIICHAT_OK ? acip_packet_seal(records, (acip_traffic_class_t)flow, ACIP_DELIVERY_RELIABLE, packet,
                                                   packet_length, wire, written)
                                : result;
}

References ACIP_DELIVERY_RELIABLE, acip_packet_seal(), acip_security_rekey_encode(), ASCIICHAT_OK, and CRYPTO_PUBLIC_KEY_SIZE.

Referenced by acip_security_next_control().

acip_security_request_rekey()

asciichat_error_t acip_security_request_rekey

(

acip_transport_t *

transport

)

Definition at line 273 of file lib/network/acip/security.c.

                                                                           {
  if (!transport || !transport->crypto_ctx || !transport->crypto_ctx->encrypt_data)
    return SET_ERRNO(ERROR_INVALID_STATE, "An encrypted authenticated session is required for rotation");
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(transport->crypto_ctx, &session);
  if (result == ASCIICHAT_OK) {
    result = crypto_rekey_session_request(&session->rotation, time_get_ns());
    crypto_session_unlock(session);
  }
  return result;
}

References ASCIICHAT_OK, acip_transport::crypto_ctx, crypto_rekey_session_request(), crypto_session_lock(), crypto_session_unlock(), crypto_context_t::encrypt_data, ERROR_INVALID_STATE, crypto_session::rotation, and SET_ERRNO.

acip_security_seal()

asciichat_error_t acip_security_seal	(	crypto_context_t *	crypto,
		acip_traffic_class_t	flow,
		acip_delivery_t	delivery,
		const void *	packet,
		size_t	length,
		uint8_t **	output,
		size_t *	written )

Definition at line 285 of file lib/network/acip/security.c.

                                                                                                           {
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result == ASCIICHAT_OK) {
    result = acip_packet_seal(&session->records, flow, delivery, packet, length, output, written);
    crypto_session_unlock(session);
  }
  return result;
}

References acip_packet_seal(), ASCIICHAT_OK, crypto_session_lock(), crypto_session_unlock(), and crypto_session::records.

Referenced by browser_security_packet(), client_encrypt_packet(), quic_connection_submit(), and quic_connection_submit_datagram().

acip_security_start()

asciichat_error_t acip_security_start	(	acip_security_t *	security,
		acip_transport_t *	transport )

Definition at line 18 of file lib/network/acip/security.c.

                                                                                              {
  if (!security || !transport || security->mode > ACIP_CRYPTO_FULL ||
      security->handshake.state != CRYPTO_HANDSHAKE_INIT)
    return SET_ERRNO(ERROR_INVALID_STATE, "Invalid peer security initialization");
  security->handshake.addressless_transport = true;
  transport->crypto_ctx = &security->handshake.crypto_ctx;
  security->handshake.crypto_ctx.encrypt_data = ACIP_CRYPTO_HAS_ENCRYPT(security->mode);
  if (security->handshake.is_server)
    return ASCIICHAT_OK;
  protocol_version_packet_t version;
  protocol_version_packet_init(&version, security->mode);
  return packet_send_via_transport(transport, PACKET_TYPE_PROTOCOL_VERSION, &version, sizeof(version), 0);
}

References ACIP_CRYPTO_FULL, ACIP_CRYPTO_HAS_ENCRYPT, crypto_handshake_context_t::addressless_transport, ASCIICHAT_OK, acip_transport::crypto_ctx, crypto_handshake_context_t::crypto_ctx, CRYPTO_HANDSHAKE_INIT, crypto_context_t::encrypt_data, ERROR_INVALID_STATE, acip_security::handshake, crypto_handshake_context_t::is_server, acip_security::mode, packet_send_via_transport(), PACKET_TYPE_PROTOCOL_VERSION, protocol_version_packet_init(), SET_ERRNO, and crypto_handshake_context_t::state.

Referenced by peer_crypto_create().

acip_webrtc_transport_create_secure()

acip_transport_t * acip_webrtc_transport_create_secure	(	struct webrtc_peer_connection *	peer,
		struct webrtc_data_channel *	channel,
		acip_security_t *	security,
		void(*	on_ready )(acip_transport_t *, void *),
		void *	user_data )

Transfer security ownership on success. Ready fires only after negotiation.

Definition at line 918 of file webrtc/transport.c.

                                                                                                                     {
  if (!security) {
    SET_ERRNO(ERROR_INVALID_PARAM, "Missing WebRTC security state");
    return NULL;
  }
  return webrtc_transport_create(peer_conn, data_channel, &security->handshake.crypto_ctx, security, on_ready,
                                 user_data);
}

References crypto_handshake_context_t::crypto_ctx, ERROR_INVALID_PARAM, acip_security::handshake, and SET_ERRNO.

acip_webrtc_transport_security()

acip_security_t * acip_webrtc_transport_security

(

acip_transport_t *

transport

)

Borrow security already owned by an authenticated peer transport.

Definition at line 774 of file webrtc/transport.c.

                                                                             {
  if (!transport || transport->methods != &webrtc_methods || !transport->impl_data)
    return NULL;
  return ((webrtc_transport_data_t *)transport->impl_data)->security;
}

References acip_transport::impl_data, and acip_transport::methods.