security.c File Reference

Go to the source code of this file.

Functions
void	acip_security_cleanup (acip_security_t *security)
asciichat_error_t	acip_security_start (acip_security_t *security, acip_transport_t *transport)
asciichat_error_t	acip_security_receive (acip_security_t *security, acip_transport_t *transport, packet_type_t type, const void *payload, size_t length)
bool	acip_security_rekey_packet (uint16_t type)
asciichat_error_t	acip_security_rekey_encode (unsigned flow, crypto_rekey_message_t type, const void *payload, size_t length, void *packet, size_t capacity, size_t *written)
asciichat_error_t	acip_security_rekey_receive (crypto_rekey_session_t *session, acip_traffic_class_t flow, acip_delivery_t delivery, const void *packet, size_t length, uint64_t now, bool *consumed)
asciichat_error_t	acip_security_rekey_seal (crypto_record_t *records, unsigned flow, crypto_rekey_message_t message, const void *payload, size_t length, uint8_t **wire, size_t *written)
asciichat_error_t	acip_security_activate (acip_transport_t *transport)
asciichat_error_t	acip_security_decrypt (crypto_context_t *crypto, unsigned flow, unsigned delivery, const void *payload, size_t length, uint8_t **output, size_t *written, uint64_t *sequence, bool *consumed)
asciichat_error_t	acip_security_next_control (crypto_context_t *crypto, acip_traffic_class_t *flow, uint8_t **wire, size_t *length)
asciichat_error_t	acip_security_flush (acip_transport_t *transport)
asciichat_error_t	acip_security_request_rekey (acip_transport_t *transport)
asciichat_error_t	acip_security_seal (crypto_context_t *crypto, acip_traffic_class_t flow, acip_delivery_t delivery, const void *packet, size_t length, uint8_t **output, size_t *written)
asciichat_error_t	acip_security_open (crypto_context_t *crypto, acip_traffic_class_t flow, acip_delivery_t delivery, const void *packet, size_t length, uint8_t **output, size_t *written, uint64_t *sequence, bool *consumed)

Function Documentation

acip_security_activate()

asciichat_error_t acip_security_activate

(

acip_transport_t *

transport

)

Definition at line 178 of file lib/network/acip/security.c.

                                                                      {
  if (!transport)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing secure transport");
  crypto_context_t *crypto = transport->crypto_ctx;
  if (!crypto || !crypto->encrypt_data)
    return ASCIICHAT_OK;
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result == ASCIICHAT_OK) {
    crypto_session_unlock(session);
    atomic_store_bool(&transport->packet_security_active, true);
  }
  return result;
}

References ASCIICHAT_OK, acip_transport::crypto_ctx, crypto_session_lock(), crypto_session_unlock(), crypto_context_t::encrypt_data, ERROR_INVALID_PARAM, acip_transport::packet_security_active, and SET_ERRNO.

Referenced by acip_security_receive(), and quic_transport_begin_security().

acip_security_cleanup()

void acip_security_cleanup

(

acip_security_t *

security

)

Definition at line 11 of file lib/network/acip/security.c.

                                                      {
  if (!security)
    return;
  SAFE_FREE(security->handshake.client_whitelist);
  crypto_handshake_destroy(&security->handshake);
}

References crypto_handshake_context_t::client_whitelist, crypto_handshake_destroy(), acip_security::handshake, and SAFE_FREE.

Referenced by acip_security_init_options(), and peer_crypto_destroy().

acip_security_decrypt()

asciichat_error_t acip_security_decrypt	(	crypto_context_t *	crypto,
		unsigned	flow,
		unsigned	delivery,
		const void *	payload,
		size_t	length,
		uint8_t **	output,
		size_t *	written,
		uint64_t *	sequence,
		bool *	consumed )

Definition at line 193 of file lib/network/acip/security.c.

                                                        {
  if (!output || !written || !consumed)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing security receive output");
  *output = NULL;
  *written = 0;
  *consumed = false;
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result != ASCIICHAT_OK)
    return result;
  result = acip_packet_decrypt_payload(&session->records, flow, delivery, payload, length, output, written, sequence);
  if (result == ASCIICHAT_OK) {
    packet_header_t header;
    memcpy(&header, *output, sizeof(header));
    result = crypto_session_receive(session, session->records.last_receive_channel, delivery,
                                    rekey_message(NET_TO_HOST_U16(header.type)), *output + sizeof(header),
                                    *written - sizeof(header), time_get_ns(), consumed);
  }
  crypto_session_unlock(session);
  if (result != ASCIICHAT_OK) {
    buffer_release(*output);
    *output = NULL;
    *written = 0;
  }
  return result;
}

References acip_packet_decrypt_payload(), ASCIICHAT_OK, buffer_release, crypto_session_lock(), crypto_session_receive(), crypto_session_unlock(), ERROR_INVALID_PARAM, crypto_record::last_receive_channel, NET_TO_HOST_U16, crypto_session::records, and SET_ERRNO.

Referenced by acip_security_open(), client_decrypt_packet(), and packet_decrypt_envelope().

acip_security_flush()

asciichat_error_t acip_security_flush

(

acip_transport_t *

transport

)

Definition at line 248 of file lib/network/acip/security.c.

                                                                   {
  if (!transport || !atomic_load_bool(&transport->packet_security_active))
    return ASCIICHAT_OK;
  for (unsigned i = 0; i < CRYPTO_SESSION_MESSAGES; ++i) {
    uint8_t *wire = NULL;
    size_t length = 0;
    acip_traffic_class_t channel = ACIP_TRAFFIC_CONTROL;
    asciichat_error_t result = acip_security_next_control(transport->crypto_ctx, &channel, &wire, &length);
    if (result != ASCIICHAT_OK || !wire)
      return result;
    defer(buffer_release(wire));
    socket_buffer_t slice = {wire, length};
    acip_send_options_t options = {.traffic_class = channel, .delivery = ACIP_DELIVERY_RELIABLE};
    if (transport->methods->sendv_ex)
      result = transport->methods->sendv_ex(transport, &slice, 1, &options);
    else if (transport->methods->sendv)
      result = transport->methods->sendv(transport, &slice, 1);
    else
      result = transport->methods->send(transport, wire, length);
    if (result != ASCIICHAT_OK)
      return result;
  }
  return ASCIICHAT_OK;
}

References ACIP_DELIVERY_RELIABLE, acip_security_next_control(), ACIP_TRAFFIC_CONTROL, ASCIICHAT_OK, buffer_release, acip_transport::crypto_ctx, CRYPTO_SESSION_MESSAGES, acip_transport::methods, acip_transport::packet_security_active, acip_transport_methods_t::send, acip_transport_methods_t::sendv, and acip_transport_methods_t::sendv_ex.

Referenced by peer_crypto_tick().

acip_security_next_control()

asciichat_error_t acip_security_next_control	(	crypto_context_t *	crypto,
		acip_traffic_class_t *	flow,
		uint8_t **	wire,
		size_t *	length )

Definition at line 222 of file lib/network/acip/security.c.

                                                             {
  if (!flow || !wire || !length)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Missing security output");
  *wire = NULL;
  *length = 0;
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result != ASCIICHAT_OK)
    return result;
  defer(crypto_session_unlock(session));
  result = crypto_session_tick(session, time_get_ns());
  if (result == ASCIICHAT_OK && session->count) {
    crypto_session_message_t *message = &session->messages[session->head];
    *flow = (acip_traffic_class_t)message->channel;
    result = acip_security_rekey_seal(&session->records, message->channel, message->type, message->payload,
                                      message->length, wire, length);
    if (result == ASCIICHAT_OK) {
      memset(message, 0, sizeof(*message));
      session->head = (session->head + 1) % CRYPTO_SESSION_MESSAGES;
      --session->count;
    }
  }
  return result;
}

References acip_security_rekey_seal(), ASCIICHAT_OK, crypto_session_message_t::channel, crypto_session::count, crypto_session_lock(), CRYPTO_SESSION_MESSAGES, crypto_session_tick(), crypto_session_unlock(), ERROR_INVALID_PARAM, crypto_session::head, crypto_session_message_t::length, crypto_session::messages, crypto_session_message_t::payload, crypto_session::records, SET_ERRNO, and crypto_session_message_t::type.

Referenced by acip_security_flush(), and browser_security_output().

acip_security_open()

asciichat_error_t acip_security_open	(	crypto_context_t *	crypto,
		acip_traffic_class_t	flow,
		acip_delivery_t	delivery,
		const void *	packet,
		size_t	length,
		uint8_t **	output,
		size_t *	written,
		uint64_t *	sequence,
		bool *	consumed )

Definition at line 296 of file lib/network/acip/security.c.

                                                                         {
  packet_header_t header;
  asciichat_error_t result = packet_validate(packet, length, 0, &header);
  if (result != ASCIICHAT_OK)
    return result;
  if (NET_TO_HOST_U16(header.type) != PACKET_TYPE_ENCRYPTED)
    return SET_ERRNO(ERROR_CRYPTO, "Expected authenticated session record");
  return acip_security_decrypt(crypto, flow, delivery, (const uint8_t *)packet + sizeof(header),
                               length - sizeof(header), output, written, sequence, consumed);
}

References acip_security_decrypt(), ASCIICHAT_OK, ERROR_CRYPTO, NET_TO_HOST_U16, PACKET_TYPE_ENCRYPTED, packet_validate(), and SET_ERRNO.

Referenced by browser_security_packet(), and peer_crypto_receive().

acip_security_receive()

asciichat_error_t acip_security_receive	(	acip_security_t *	security,
		acip_transport_t *	transport,
		packet_type_t	type,
		const void *	payload,
		size_t	length )

Definition at line 32 of file lib/network/acip/security.c.

                                                                            {
  if (!security || !transport || (!payload && length) || security->ready)
    return SET_ERRNO(ERROR_INVALID_STATE, "Unexpected peer security packet");
  crypto_handshake_context_t *ctx = &security->handshake;
  asciichat_error_t result = ASCIICHAT_OK;
  if (!security->version_received) {
    if (type != PACKET_TYPE_PROTOCOL_VERSION || length != sizeof(protocol_version_packet_t))
      return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Expected peer security negotiation before media");
    protocol_version_packet_t version;
    memcpy(&version, payload, sizeof(version));
    uint8_t mode = version.supports_encryption;
    if (NET_TO_HOST_U16(version.protocol_version) != PROTOCOL_VERSION_MAJOR ||
        NET_TO_HOST_U16(version.protocol_revision) != PROTOCOL_VERSION_MINOR ||
        NET_TO_HOST_U16(version.protocol_patch) != PROTOCOL_VERSION_PATCH || mode > ACIP_CRYPTO_FULL)
      return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Unsupported peer security protocol");
    if (ctx->is_server) {
      // Match secure WebSocket policy: defaults do not override a client's explicit no-encrypt.
      if ((ctx->has_password || ctx->require_client_auth) && !ACIP_CRYPTO_HAS_AUTH(mode))
        return SET_ERRNO(ERROR_CRYPTO_AUTH, "Peer omitted required authentication");
      if (security->require_encryption && !ACIP_CRYPTO_HAS_ENCRYPT(mode))
        return SET_ERRNO(ERROR_CRYPTO, "Peer omitted required encryption");
      if (security->forbid_encryption && ACIP_CRYPTO_HAS_ENCRYPT(mode))
        return SET_ERRNO(ERROR_CRYPTO, "Peer requires encryption but local policy disables it");
      version.supports_encryption = mode;
      result = packet_send_via_transport(transport, PACKET_TYPE_PROTOCOL_VERSION, &version, sizeof(version), 0);
      if (result != ASCIICHAT_OK)
        return result;
    } else if ((mode & security->mode) != security->mode) {
      return SET_ERRNO(ERROR_CRYPTO, "Peer attempted to downgrade requested security");
    }
    if (security->forbid_encryption && ACIP_CRYPTO_HAS_ENCRYPT(mode))
      return SET_ERRNO(ERROR_CRYPTO, "Peer requires encryption but local policy disables it");
    security->mode = mode;
    security->version_received = true;
    ctx->crypto_ctx.encrypt_data = ACIP_CRYPTO_HAS_ENCRYPT(mode);
    if (mode == ACIP_CRYPTO_NONE) {
      ctx->state = CRYPTO_HANDSHAKE_DISABLED;
      security->ready = true;
      return ASCIICHAT_OK;
    }
    if (!ctx->is_server)
      return ASCIICHAT_OK;
    result = crypto_handshake_server_send_parameters(ctx, transport);
    if (result == ASCIICHAT_OK)
      result = crypto_handshake_server_start(ctx, transport);
    return result;
  }
  if (ctx->is_server) {
    if (ctx->state == CRYPTO_HANDSHAKE_KEY_EXCHANGE)
      result = crypto_handshake_server_auth_challenge(ctx, transport, type, payload, length);
    else if (ctx->state == CRYPTO_HANDSHAKE_AUTHENTICATING)
      result = crypto_handshake_server_complete(ctx, transport, type, payload, length);
    else
      result = SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Unexpected peer authentication state");
  } else {
    switch (type) {
    case PACKET_TYPE_CRYPTO_PARAMETERS:
      if (security->parameters_received || ctx->state != CRYPTO_HANDSHAKE_INIT ||
          length != sizeof(crypto_parameters_packet_t))
        return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Invalid peer crypto parameters");
      result = crypto_handshake_set_parameters(ctx, payload);
      if (result == ASCIICHAT_OK && ctx->crypto_ctx.encrypt_data != !!ACIP_CRYPTO_HAS_ENCRYPT(security->mode))
        return SET_ERRNO(ERROR_CRYPTO, "Peer cipher does not match negotiated policy");
      security->parameters_received = result == ASCIICHAT_OK;
      break;
    case PACKET_TYPE_CRYPTO_KEY_EXCHANGE_INIT:
      if (!security->parameters_received)
        return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Missing peer crypto parameters");
      if (ctx->verify_server_key && length == ctx->crypto_ctx.public_key_size)
        return SET_ERRNO(ERROR_CRYPTO_AUTH, "Peer omitted the required identity key");
      result = crypto_handshake_client_key_exchange(ctx, transport, type, payload, length);
      break;
    case PACKET_TYPE_CRYPTO_AUTH_CHALLENGE:
      result = crypto_handshake_client_auth_response(ctx, transport, type, payload, length);
      break;
    case PACKET_TYPE_CRYPTO_HANDSHAKE_COMPLETE:
      if (ctx->has_password || ctx->client_private_key.type == KEY_TYPE_ED25519)
        return SET_ERRNO(ERROR_CRYPTO_AUTH, "Peer skipped required mutual authentication");
      result = crypto_handshake_client_complete(ctx, transport, type, payload, length);
      break;
    case PACKET_TYPE_CRYPTO_SERVER_AUTH_RESP:
    case PACKET_TYPE_CRYPTO_AUTH_FAILED:
      result = crypto_handshake_client_complete(ctx, transport, type, payload, length);
      break;
    default:
      result = SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Application packet before peer authentication");
    }
  }
  if (result == ASCIICHAT_OK)
    security->ready = ctx->state == CRYPTO_HANDSHAKE_READY;
  else
    ctx->state = CRYPTO_HANDSHAKE_FAILED;
  if (result == ASCIICHAT_OK && security->ready)
    result = acip_security_activate(transport);
  return result;
}

References ACIP_CRYPTO_FULL, ACIP_CRYPTO_HAS_AUTH, ACIP_CRYPTO_HAS_ENCRYPT, ACIP_CRYPTO_NONE, acip_security_activate(), ASCIICHAT_OK, crypto_handshake_context_t::client_private_key, crypto_handshake_context_t::crypto_ctx, CRYPTO_HANDSHAKE_AUTHENTICATING, crypto_handshake_client_auth_response(), crypto_handshake_client_complete(), crypto_handshake_client_key_exchange(), CRYPTO_HANDSHAKE_DISABLED, CRYPTO_HANDSHAKE_FAILED, CRYPTO_HANDSHAKE_INIT, CRYPTO_HANDSHAKE_KEY_EXCHANGE, CRYPTO_HANDSHAKE_READY, crypto_handshake_server_auth_challenge(), crypto_handshake_server_complete(), crypto_handshake_server_send_parameters(), crypto_handshake_server_start(), crypto_handshake_set_parameters(), crypto_context_t::encrypt_data, ERROR_CRYPTO, ERROR_CRYPTO_AUTH, ERROR_INVALID_STATE, ERROR_NETWORK_PROTOCOL, acip_security::forbid_encryption, acip_security::handshake, crypto_handshake_context_t::has_password, crypto_handshake_context_t::is_server, KEY_TYPE_ED25519, acip_security::mode, NET_TO_HOST_U16, packet_send_via_transport(), PACKET_TYPE_CRYPTO_AUTH_CHALLENGE, PACKET_TYPE_CRYPTO_AUTH_FAILED, PACKET_TYPE_CRYPTO_HANDSHAKE_COMPLETE, PACKET_TYPE_CRYPTO_KEY_EXCHANGE_INIT, PACKET_TYPE_CRYPTO_PARAMETERS, PACKET_TYPE_CRYPTO_SERVER_AUTH_RESP, PACKET_TYPE_PROTOCOL_VERSION, acip_security::parameters_received, protocol_version_packet_t::protocol_patch, protocol_version_packet_t::protocol_revision, protocol_version_packet_t::protocol_version, PROTOCOL_VERSION_MAJOR, PROTOCOL_VERSION_MINOR, PROTOCOL_VERSION_PATCH, crypto_context_t::public_key_size, acip_security::ready, crypto_handshake_context_t::require_client_auth, acip_security::require_encryption, SET_ERRNO, crypto_handshake_context_t::state, protocol_version_packet_t::supports_encryption, private_key_t::type, crypto_handshake_context_t::verify_server_key, and acip_security::version_received.

Referenced by peer_crypto_receive().

acip_security_rekey_encode()

asciichat_error_t acip_security_rekey_encode	(	unsigned	flow,
		crypto_rekey_message_t	type,
		const void *	payload,
		size_t	length,
		void *	packet,
		size_t	capacity,
		size_t *	written )

Definition at line 149 of file lib/network/acip/security.c.

                                                                                                            {
  if (type <= CRYPTO_REKEY_NONE || type > CRYPTO_REKEY_NEEDED || flow >= CRYPTO_RECORD_CHANNELS)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid rekey message");
  return packet_encode(rekey_types[type], payload, length, flow, packet, capacity, written);
}

References CRYPTO_RECORD_CHANNELS, CRYPTO_REKEY_NEEDED, ERROR_INVALID_PARAM, packet_encode(), and SET_ERRNO.

Referenced by acip_security_rekey_seal().

acip_security_rekey_packet()

bool acip_security_rekey_packet

(

uint16_t

type

)

Definition at line 145 of file lib/network/acip/security.c.

                                               {
  return rekey_message(type) != CRYPTO_REKEY_NONE;
}

References CRYPTO_REKEY_NONE.

Referenced by quic_connection_submit().

acip_security_rekey_receive()

asciichat_error_t acip_security_rekey_receive	(	crypto_rekey_session_t *	session,
		acip_traffic_class_t	flow,
		acip_delivery_t	delivery,
		const void *	packet,
		size_t	length,
		uint64_t	now,
		bool *	consumed )

Definition at line 156 of file lib/network/acip/security.c.

                                                              {
  packet_header_t header;
  asciichat_error_t result = packet_validate(packet, length, 0, &header);
  if (result != ASCIICHAT_OK)
    return result;
  return crypto_rekey_session_receive(session, flow, delivery, rekey_message(NET_TO_HOST_U16(header.type)),
                                      (const uint8_t *)packet + sizeof(header), length - sizeof(header), now, consumed);
}

References ASCIICHAT_OK, crypto_rekey_session_receive(), NET_TO_HOST_U16, and packet_validate().

acip_security_rekey_seal()

asciichat_error_t acip_security_rekey_seal	(	crypto_record_t *	records,
		unsigned	flow,
		crypto_rekey_message_t	message,
		const void *	payload,
		size_t	length,
		uint8_t **	wire,
		size_t *	written )

Definition at line 167 of file lib/network/acip/security.c.

                                                                                                                {
  uint8_t packet[sizeof(packet_header_t) + CRYPTO_PUBLIC_KEY_SIZE];
  size_t packet_length = 0;
  asciichat_error_t result =
      acip_security_rekey_encode(flow, message, payload, length, packet, sizeof(packet), &packet_length);
  return result == ASCIICHAT_OK ? acip_packet_seal(records, (acip_traffic_class_t)flow, ACIP_DELIVERY_RELIABLE, packet,
                                                   packet_length, wire, written)
                                : result;
}

References ACIP_DELIVERY_RELIABLE, acip_packet_seal(), acip_security_rekey_encode(), ASCIICHAT_OK, and CRYPTO_PUBLIC_KEY_SIZE.

Referenced by acip_security_next_control().

acip_security_request_rekey()

asciichat_error_t acip_security_request_rekey

(

acip_transport_t *

transport

)

Definition at line 273 of file lib/network/acip/security.c.

                                                                           {
  if (!transport || !transport->crypto_ctx || !transport->crypto_ctx->encrypt_data)
    return SET_ERRNO(ERROR_INVALID_STATE, "An encrypted authenticated session is required for rotation");
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(transport->crypto_ctx, &session);
  if (result == ASCIICHAT_OK) {
    result = crypto_rekey_session_request(&session->rotation, time_get_ns());
    crypto_session_unlock(session);
  }
  return result;
}

References ASCIICHAT_OK, acip_transport::crypto_ctx, crypto_rekey_session_request(), crypto_session_lock(), crypto_session_unlock(), crypto_context_t::encrypt_data, ERROR_INVALID_STATE, crypto_session::rotation, and SET_ERRNO.

acip_security_seal()

asciichat_error_t acip_security_seal	(	crypto_context_t *	crypto,
		acip_traffic_class_t	flow,
		acip_delivery_t	delivery,
		const void *	packet,
		size_t	length,
		uint8_t **	output,
		size_t *	written )

Definition at line 285 of file lib/network/acip/security.c.

                                                                                                           {
  crypto_session_t *session = NULL;
  asciichat_error_t result = crypto_session_lock(crypto, &session);
  if (result == ASCIICHAT_OK) {
    result = acip_packet_seal(&session->records, flow, delivery, packet, length, output, written);
    crypto_session_unlock(session);
  }
  return result;
}

References acip_packet_seal(), ASCIICHAT_OK, crypto_session_lock(), crypto_session_unlock(), and crypto_session::records.

Referenced by browser_security_packet(), client_encrypt_packet(), quic_connection_submit(), and quic_connection_submit_datagram().

acip_security_start()

asciichat_error_t acip_security_start	(	acip_security_t *	security,
		acip_transport_t *	transport )

Definition at line 18 of file lib/network/acip/security.c.

                                                                                              {
  if (!security || !transport || security->mode > ACIP_CRYPTO_FULL ||
      security->handshake.state != CRYPTO_HANDSHAKE_INIT)
    return SET_ERRNO(ERROR_INVALID_STATE, "Invalid peer security initialization");
  security->handshake.addressless_transport = true;
  transport->crypto_ctx = &security->handshake.crypto_ctx;
  security->handshake.crypto_ctx.encrypt_data = ACIP_CRYPTO_HAS_ENCRYPT(security->mode);
  if (security->handshake.is_server)
    return ASCIICHAT_OK;
  protocol_version_packet_t version;
  protocol_version_packet_init(&version, security->mode);
  return packet_send_via_transport(transport, PACKET_TYPE_PROTOCOL_VERSION, &version, sizeof(version), 0);
}

References ACIP_CRYPTO_FULL, ACIP_CRYPTO_HAS_ENCRYPT, crypto_handshake_context_t::addressless_transport, ASCIICHAT_OK, acip_transport::crypto_ctx, crypto_handshake_context_t::crypto_ctx, CRYPTO_HANDSHAKE_INIT, crypto_context_t::encrypt_data, ERROR_INVALID_STATE, acip_security::handshake, crypto_handshake_context_t::is_server, acip_security::mode, packet_send_via_transport(), PACKET_TYPE_PROTOCOL_VERSION, protocol_version_packet_init(), SET_ERRNO, and crypto_handshake_context_t::state.

Referenced by peer_crypto_create().