peer_crypto.c File Reference

Go to the source code of this file.

Data Structures
struct	peer_output
	peer output is intentionally a small, concrete record. Fields such as next, data, length give callers the identity and current value they need. It is normally borrowed from, or owned by, the surrounding subsystem—not independently managed. More...
struct	browser_peer_crypto

Typedefs
typedef struct peer_output	peer_output_t
	peer output is intentionally a small, concrete record. Fields such as next, data, length give callers the identity and current value they need. It is normally borrowed from, or owned by, the surrounding subsystem—not independently managed.

Functions
const char *	peer_crypto_error (void)
void	peer_crypto_output_pop (browser_peer_crypto_t *peer)
void	peer_crypto_destroy (browser_peer_crypto_t *peer)
browser_peer_crypto_t *	peer_crypto_create (bool server, int encryption, const char *password, const uint8_t *identity, const uint8_t *expected_key)
bool	peer_crypto_ready (browser_peer_crypto_t *peer)
const void *	peer_crypto_output_data (browser_peer_crypto_t *peer)
size_t	peer_crypto_output_size (browser_peer_crypto_t *peer)
const void *	peer_crypto_received_data (browser_peer_crypto_t *peer)
size_t	peer_crypto_received_size (browser_peer_crypto_t *peer)
asciichat_error_t	peer_crypto_send (browser_peer_crypto_t *peer, const void *data, size_t length)
asciichat_error_t	peer_crypto_receive (browser_peer_crypto_t *peer, const void *data, size_t length)
crypto_context_t *	peer_security_context (browser_peer_crypto_t *peer)
asciichat_error_t	peer_crypto_tick (browser_peer_crypto_t *peer)
asciichat_error_t	peer_crypto_quic_begin (browser_peer_crypto_t *peer)

Typedef Documentation

peer_output_t

typedef struct peer_output peer_output_t

peer output is intentionally a small, concrete record. Fields such as next, data, length give callers the identity and current value they need. It is normally borrowed from, or owned by, the surrounding subsystem—not independently managed.

Function Documentation

peer_crypto_create()

browser_peer_crypto_t * peer_crypto_create	(	bool	server,
		int	encryption,
		const char *	password,
		const uint8_t *	identity,
		const uint8_t *	expected_key )

Definition at line 105 of file peer_crypto.c.

                                                                       {
  browser_peer_crypto_t *peer = SAFE_CALLOC(1, sizeof(*peer), browser_peer_crypto_t *);
  if (!peer) {
    SET_ERRNO(ERROR_MEMORY, "Cannot allocate peer security state");
    return NULL;
  }
  crypto_policy_t policy = {.transport_secure = true,
                            .encrypt = encryption == 1,
                            .no_encrypt = encryption == 0,
                            .has_password = password && password[0],
                            .has_identity = identity != NULL,
                            .has_verification_key = expected_key != NULL};
  asciichat_error_t result = crypto_policy_resolve(&policy, &peer->security.mode);
  peer->security.forbid_encryption = policy.no_encrypt;
  peer->security.require_encryption = policy.encrypt;
  crypto_handshake_context_t *ctx = &peer->security.handshake;
  if (result == ASCIICHAT_OK)
    result = policy.has_password ? crypto_handshake_init_with_password("browser_peer", ctx, server, password)
                                 : crypto_handshake_init("browser_peer", ctx, server);
  if (result != ASCIICHAT_OK) {
    peer_crypto_destroy(peer);
    return NULL;
  }
  if (identity) {
    private_key_t *key = server ? &ctx->server_private_key : &ctx->client_private_key;
    public_key_t *public_key = server ? &ctx->server_public_key : &ctx->client_public_key;
    key->type = KEY_TYPE_ED25519;
    memcpy(key->key.ed25519, identity, ED25519_PRIVATE_KEY_SIZE);
    memcpy(key->public_key, identity + ED25519_SEED_SIZE, ED25519_PUBLIC_KEY_SIZE);
    public_key->type = KEY_TYPE_ED25519;
    memcpy(public_key->key, identity + ED25519_SEED_SIZE, ED25519_PUBLIC_KEY_SIZE);
  }
  if (expected_key && server) {
    ctx->client_whitelist = SAFE_CALLOC(1, sizeof(public_key_t), public_key_t *);
    if (!ctx->client_whitelist) {
      peer_crypto_destroy(peer);
      SET_ERRNO(ERROR_MEMORY, "Cannot allocate peer key whitelist");
      return NULL;
    }
    ctx->client_whitelist[0].type = KEY_TYPE_ED25519;
    memcpy(ctx->client_whitelist[0].key, expected_key, ED25519_PUBLIC_KEY_SIZE);
    ctx->num_whitelisted_clients = 1;
    ctx->require_client_auth = true;
  } else if (expected_key) {
    ctx->verify_server_key = true;
    ctx->expected_server_key_bytes_set = true;
    memcpy(ctx->expected_server_key_bytes, expected_key, ED25519_PUBLIC_KEY_SIZE);
  }
  peer->transport.methods = &peer_methods;
  peer->transport.impl_data = peer;
  if (acip_security_start(&peer->security, &peer->transport) != ASCIICHAT_OK) {
    peer_crypto_destroy(peer);
    return NULL;
  }
  return peer;
}

References acip_security_start(), ASCIICHAT_OK, crypto_handshake_context_t::client_private_key, crypto_handshake_context_t::client_public_key, crypto_handshake_context_t::client_whitelist, crypto_handshake_init(), crypto_handshake_init_with_password(), crypto_policy_resolve(), private_key_t::ed25519, ED25519_PRIVATE_KEY_SIZE, ED25519_PUBLIC_KEY_SIZE, ED25519_SEED_SIZE, crypto_policy_t::encrypt, ERROR_MEMORY, crypto_handshake_context_t::expected_server_key_bytes, crypto_handshake_context_t::expected_server_key_bytes_set, acip_security::forbid_encryption, acip_security::handshake, crypto_policy_t::has_password, acip_transport::impl_data, private_key_t::key, public_key_t::key, KEY_TYPE_ED25519, acip_transport::methods, acip_security::mode, crypto_policy_t::no_encrypt, crypto_handshake_context_t::num_whitelisted_clients, peer_crypto_destroy(), private_key_t::public_key, crypto_handshake_context_t::require_client_auth, acip_security::require_encryption, SAFE_CALLOC, browser_peer_crypto::security, crypto_handshake_context_t::server_private_key, crypto_handshake_context_t::server_public_key, SET_ERRNO, browser_peer_crypto::transport, private_key_t::type, public_key_t::type, and crypto_handshake_context_t::verify_server_key.

Referenced by PeerCryptoBinding::PeerCryptoBinding().

peer_crypto_destroy()

void peer_crypto_destroy

(

browser_peer_crypto_t *

peer

)

Definition at line 95 of file peer_crypto.c.

                                                      {
  if (!peer)
    return;
  while (peer->output)
    peer_crypto_output_pop(peer);
  buffer_release(peer->received);
  acip_security_cleanup(&peer->security);
  SAFE_FREE(peer);
}

References acip_security_cleanup(), buffer_release, browser_peer_crypto::output, peer_crypto_output_pop(), browser_peer_crypto::received, SAFE_FREE, and browser_peer_crypto::security.

Referenced by peer_crypto_create().

peer_crypto_error()

const char * peer_crypto_error

(

void

)

Definition at line 32 of file peer_crypto.c.

                                    {
  static asciichat_error_context_t error;
  return HAS_ERRNO(&error) ? error.context_message : "Peer security operation failed";
}

References asciichat_error_context_t::context_message, and HAS_ERRNO.

Referenced by PeerCryptoBinding::error().

peer_crypto_output_data()

const void * peer_crypto_output_data

(

browser_peer_crypto_t *

peer

)

Definition at line 167 of file peer_crypto.c.

                                                                 {
  return peer && peer->output ? peer->output->data : NULL;
}

References peer_output::data, and browser_peer_crypto::output.

Referenced by PeerCryptoBinding::takeOutput().

peer_crypto_output_pop()

void peer_crypto_output_pop

(

browser_peer_crypto_t *

peer

)

Definition at line 84 of file peer_crypto.c.

                                                         {
  if (!peer || !peer->output)
    return;
  peer_output_t *output = peer->output;
  peer->output = output->next;
  if (!peer->output)
    peer->tail = NULL;
  buffer_release(output->data);
  SAFE_FREE(output);
}

References buffer_release, peer_output::data, peer_output::next, browser_peer_crypto::output, SAFE_FREE, and browser_peer_crypto::tail.

Referenced by peer_crypto_destroy(), and PeerCryptoBinding::takeOutput().

peer_crypto_output_size()

size_t peer_crypto_output_size

(

browser_peer_crypto_t *

peer

)

Definition at line 171 of file peer_crypto.c.

                                                            {
  return peer && peer->output ? peer->output->length : 0;
}

References peer_output::length, and browser_peer_crypto::output.

Referenced by PeerCryptoBinding::takeOutput().

peer_crypto_quic_begin()

asciichat_error_t peer_crypto_quic_begin

(

browser_peer_crypto_t *

peer

)

Definition at line 261 of file peer_crypto.c.

                                                                      {
  if (!peer || peer->security.version_received || peer->quic_handshake || !ACIP_CRYPTO_HAS_ENCRYPT(peer->security.mode))
    return SET_ERRNO(ERROR_INVALID_STATE, "Invalid peer QUIC handshake transition");
  peer->quic_handshake = true;
  return ASCIICHAT_OK;
}

References ACIP_CRYPTO_HAS_ENCRYPT, ASCIICHAT_OK, ERROR_INVALID_STATE, acip_security::mode, browser_peer_crypto::quic_handshake, browser_peer_crypto::security, SET_ERRNO, and acip_security::version_received.

Referenced by PeerCryptoBinding::beginQuic().

peer_crypto_ready()

bool peer_crypto_ready

(

browser_peer_crypto_t *

peer

)

Definition at line 163 of file peer_crypto.c.

                                                    {
  return peer && peer->security.ready;
}

References acip_security::ready, and browser_peer_crypto::security.

Referenced by PeerCryptoBinding::ready().

peer_crypto_receive()

asciichat_error_t peer_crypto_receive	(	browser_peer_crypto_t *	peer,
		const void *	data,
		size_t	length )

Definition at line 191 of file peer_crypto.c.

                                                                                                    {
  if (!peer || !data)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid peer packet or security state");
  if (length < sizeof(packet_header_t))
    return SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Invalid peer packet");
  buffer_release(peer->received);
  peer->received = NULL;
  peer->received_length = 0;
  packet_header_t header;
  memcpy(&header, data, sizeof(header));
  size_t payload_length = length - sizeof(header);
  const void *payload = (const uint8_t *)data + sizeof(header);
  packet_type_t type = NET_TO_HOST_U16(header.type);
  asciichat_error_t validation = packet_validate(data, length, 0, NULL);
  if (validation != ASCIICHAT_OK)
    return validation;
  if (!peer->security.ready) {
    asciichat_error_t result = acip_security_receive(&peer->security, &peer->transport, type, payload, payload_length);
    if (result != ASCIICHAT_OK || !peer->quic_handshake || type != PACKET_TYPE_PROTOCOL_VERSION)
      return result;
    crypto_capabilities_packet_t caps = {0};
    caps.supported_kex_algorithms = HOST_TO_NET_U16(KEX_ALGO_X25519);
    caps.supported_auth_algorithms = HOST_TO_NET_U16(AUTH_ALGO_ED25519 | AUTH_ALGO_NONE);
    caps.supported_cipher_algorithms = HOST_TO_NET_U16(CIPHER_ALGO_XSALSA20_POLY1305 | CIPHER_ALGO_NONE);
    caps.preferred_kex = KEX_ALGO_X25519;
    caps.preferred_auth = ACIP_CRYPTO_HAS_AUTH(peer->security.mode) ? AUTH_ALGO_ED25519 : AUTH_ALGO_NONE;
    caps.preferred_cipher = CIPHER_ALGO_XSALSA20_POLY1305;
    caps.requires_verification = peer->security.handshake.verify_server_key;
    result = packet_send_via_transport(&peer->transport, PACKET_TYPE_CRYPTO_CAPABILITIES, &caps, sizeof(caps), 0);
    if (result != ASCIICHAT_OK || !caps.requires_verification)
      return result;
    return packet_send_via_transport(&peer->transport, PACKET_TYPE_CRYPTO_CLIENT_HELLO,
                                     peer->security.handshake.expected_server_key_bytes, ED25519_PUBLIC_KEY_SIZE, 0);
  }
  bool encrypt = ACIP_CRYPTO_HAS_ENCRYPT(peer->security.mode);
  if (packet_is_initial_handshake_type(type) || (encrypt != (type == PACKET_TYPE_ENCRYPTED)))
    return SET_ERRNO(ERROR_CRYPTO, "Peer packet does not match negotiated security");
  if (!encrypt) {
    peer->received = buffer_alloc(NULL, length);
    if (!peer->received)
      return SET_ERRNO(ERROR_MEMORY, "Cannot allocate peer input");
    memcpy(peer->received, data, length);
    peer->received_length = length;
    return ASCIICHAT_OK;
  }
  bool consumed = false;
  uint64_t sequence;
  asciichat_error_t result =
      acip_security_open(&peer->security.handshake.crypto_ctx, CRYPTO_RECORD_ANY_CHANNEL, ACIP_DELIVERY_RELIABLE, data,
                         length, (uint8_t **)&peer->received, &peer->received_length, &sequence, &consumed);
  if (consumed) {
    buffer_release(peer->received);
    peer->received = NULL;
    peer->received_length = 0;
  }
  return result;
}

References ACIP_CRYPTO_HAS_AUTH, ACIP_CRYPTO_HAS_ENCRYPT, ACIP_DELIVERY_RELIABLE, acip_security_open(), acip_security_receive(), ASCIICHAT_OK, AUTH_ALGO_ED25519, AUTH_ALGO_NONE, buffer_alloc(), buffer_release, CIPHER_ALGO_NONE, CIPHER_ALGO_XSALSA20_POLY1305, crypto_handshake_context_t::crypto_ctx, CRYPTO_RECORD_ANY_CHANNEL, ED25519_PUBLIC_KEY_SIZE, ERROR_CRYPTO, ERROR_INVALID_PARAM, ERROR_MEMORY, ERROR_NETWORK_PROTOCOL, crypto_handshake_context_t::expected_server_key_bytes, acip_security::handshake, HOST_TO_NET_U16, KEX_ALGO_X25519, acip_security::mode, NET_TO_HOST_U16, packet_send_via_transport(), PACKET_TYPE_CRYPTO_CAPABILITIES, PACKET_TYPE_CRYPTO_CLIENT_HELLO, PACKET_TYPE_ENCRYPTED, PACKET_TYPE_PROTOCOL_VERSION, packet_validate(), crypto_capabilities_packet_t::preferred_auth, crypto_capabilities_packet_t::preferred_cipher, crypto_capabilities_packet_t::preferred_kex, browser_peer_crypto::quic_handshake, acip_security::ready, browser_peer_crypto::received, browser_peer_crypto::received_length, crypto_capabilities_packet_t::requires_verification, browser_peer_crypto::security, SET_ERRNO, crypto_capabilities_packet_t::supported_auth_algorithms, crypto_capabilities_packet_t::supported_cipher_algorithms, crypto_capabilities_packet_t::supported_kex_algorithms, browser_peer_crypto::transport, and crypto_handshake_context_t::verify_server_key.

peer_crypto_received_data()

const void * peer_crypto_received_data

(

browser_peer_crypto_t *

peer

)

Definition at line 175 of file peer_crypto.c.

                                                                   {
  return peer ? peer->received : NULL;
}

References browser_peer_crypto::received.

Referenced by PeerCryptoBinding::received().

peer_crypto_received_size()

size_t peer_crypto_received_size

(

browser_peer_crypto_t *

peer

)

Definition at line 179 of file peer_crypto.c.

                                                              {
  return peer ? peer->received_length : 0;
}

References browser_peer_crypto::received_length.

Referenced by PeerCryptoBinding::received().

peer_crypto_send()

asciichat_error_t peer_crypto_send	(	browser_peer_crypto_t *	peer,
		const void *	data,
		size_t	length )

Definition at line 183 of file peer_crypto.c.

                                                                                                 {
  if (!peer || !data || !length)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid peer packet or security state");
  if (!peer->security.ready)
    return SET_ERRNO(ERROR_INVALID_STATE, "Peer security is not ready");
  return peer_send(&peer->transport, data, length);
}

References ERROR_INVALID_PARAM, ERROR_INVALID_STATE, acip_security::ready, browser_peer_crypto::security, SET_ERRNO, and browser_peer_crypto::transport.

peer_crypto_tick()

asciichat_error_t peer_crypto_tick

(

browser_peer_crypto_t *

peer

)

Definition at line 253 of file peer_crypto.c.

                                                                {
  if (!peer)
    return SET_ERRNO(ERROR_INVALID_PARAM, "Invalid peer security state");
  if (!peer->security.ready || peer->quic_handshake || !ACIP_CRYPTO_HAS_ENCRYPT(peer->security.mode))
    return ASCIICHAT_OK;
  return acip_security_flush(&peer->transport);
}

References ACIP_CRYPTO_HAS_ENCRYPT, acip_security_flush(), ASCIICHAT_OK, ERROR_INVALID_PARAM, acip_security::mode, browser_peer_crypto::quic_handshake, acip_security::ready, browser_peer_crypto::security, SET_ERRNO, and browser_peer_crypto::transport.

Referenced by PeerCryptoBinding::tick().

peer_security_context()

crypto_context_t * peer_security_context

(

browser_peer_crypto_t *

peer

)

Definition at line 249 of file peer_crypto.c.

                                                                     {
  return peer ? &peer->security.handshake.crypto_ctx : NULL;
}

References crypto_handshake_context_t::crypto_ctx, acip_security::handshake, and browser_peer_crypto::security.

Referenced by PeerCryptoBinding::initQuic(), PeerCryptoBinding::quicEpoch(), PeerCryptoBinding::quicPacket(), PeerCryptoBinding::takeQuicOutput(), and PeerCryptoBinding::tickQuic().