crypto.h File Reference

Server cryptographic operations and per-client handshake management. More...

Go to the source code of this file.

Functions
int	server_crypto_init (void)
int	server_crypto_handshake (client_info_t *client)
bool	crypto_server_is_ready (uint32_t client_id)
const crypto_context_t *	crypto_server_get_context (uint32_t client_id)
int	crypto_server_encrypt_packet (uint32_t client_id, const uint8_t *plaintext, size_t plaintext_len, uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_len)
int	crypto_server_decrypt_packet (uint32_t client_id, const uint8_t *ciphertext, size_t ciphertext_len, uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_len)
void	crypto_server_cleanup_client (uint32_t client_id)

Detailed Description

Server cryptographic operations and per-client handshake management.

Definition in file server/crypto.h.

Function Documentation

crypto_server_cleanup_client()

void crypto_server_cleanup_client

(

uint32_t

client_id

)

Cleanup crypto resources for a specific client

Parameters

client_id

Client ID to cleanup crypto for

Definition at line 749 of file src/server/crypto.c.

                                                      {
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return;
  }
 
  if (client->crypto_initialized) {
    crypto_handshake_destroy(&client->crypto_handshake_ctx);
    client->crypto_initialized = false;
    log_debug("Crypto handshake cleaned up for client %u", client_id);
  }
}

References crypto_handshake_destroy(), and find_client_by_id().

crypto_server_decrypt_packet()

int crypto_server_decrypt_packet	(	uint32_t	client_id,
		const uint8_t *	ciphertext,
		size_t	ciphertext_len,
		uint8_t *	plaintext,
		size_t	plaintext_size,
		size_t *	plaintext_len
	)

Decrypt a received packet from a specific client

Parameters

client_id	Client ID that sent the packet
ciphertext	Encrypted data to decrypt
ciphertext_len	Length of encrypted data
plaintext	Output buffer for decrypted data
plaintext_size	Size of output buffer
plaintext_len	Output length of decrypted data

Returns

0 on success, -1 on failure

Definition at line 733 of file src/server/crypto.c.

                                                                                                   {
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return -1;
  }
 
  return crypto_decrypt_packet_or_passthrough(&client->crypto_handshake_ctx, crypto_server_is_ready(client_id),
                                              ciphertext, ciphertext_len, plaintext, plaintext_size, plaintext_len);
}

References crypto_decrypt_packet_or_passthrough(), crypto_server_is_ready(), and find_client_by_id().

Referenced by process_encrypted_packet().

crypto_server_encrypt_packet()

int crypto_server_encrypt_packet	(	uint32_t	client_id,
		const uint8_t *	plaintext,
		size_t	plaintext_len,
		uint8_t *	ciphertext,
		size_t	ciphertext_size,
		size_t *	ciphertext_len
	)

Encrypt a packet for transmission to a specific client

Parameters

client_id	Client ID to encrypt for
plaintext	Plaintext data to encrypt
plaintext_len	Length of plaintext data
ciphertext	Output buffer for encrypted data
ciphertext_size	Size of output buffer
ciphertext_len	Output length of encrypted data

Returns

0 on success, -1 on failure

Definition at line 711 of file src/server/crypto.c.

                                                                                                      {
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return -1;
  }
 
  return crypto_encrypt_packet_or_passthrough(&client->crypto_handshake_ctx, crypto_server_is_ready(client_id),
                                              plaintext, plaintext_len, ciphertext, ciphertext_size, ciphertext_len);
}

References crypto_encrypt_packet_or_passthrough(), crypto_server_is_ready(), and find_client_by_id().

crypto_server_get_context()

const crypto_context_t * crypto_server_get_context

(

uint32_t

client_id

)

Get crypto context for encryption/decryption for a specific client

Parameters

client_id

Client ID to get context for

Returns

crypto context or NULL if not ready

Definition at line 687 of file src/server/crypto.c.

                                                                      {
  if (!crypto_server_is_ready(client_id)) {
    return NULL;
  }
 
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return NULL;
  }
 
  return crypto_handshake_get_context(&client->crypto_handshake_ctx);
}

References crypto_handshake_get_context(), crypto_server_is_ready(), and find_client_by_id().

Referenced by add_client().

crypto_server_is_ready()

bool crypto_server_is_ready

(

uint32_t

client_id

)

Check if crypto handshake is ready for a specific client

Parameters

client_id

Client ID to check

Returns

true if encryption is ready, false otherwise

Definition at line 663 of file src/server/crypto.c.

                                                {
  if (GET_OPTION(no_encrypt)) {
    return false;
  }
 
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return false;
  }
 
  if (!client->crypto_initialized) {
    return false;
  }
 
  bool ready = crypto_handshake_is_ready(&client->crypto_handshake_ctx);
  return ready;
}

References crypto_handshake_is_ready(), and find_client_by_id().

Referenced by crypto_server_decrypt_packet(), crypto_server_encrypt_packet(), crypto_server_get_context(), and process_encrypted_packet().

server_crypto_handshake()

int server_crypto_handshake

(

client_info_t *

client

)

Perform crypto handshake with client

Parameters

client

Client info structure

Returns

0 on success, -1 on failure

Definition at line 178 of file src/server/crypto.c.

                                                   {
  if (GET_OPTION(no_encrypt)) {
    log_debug("Crypto handshake skipped (disabled)");
    return 0;
  }
 
  if (!client) {
    FATAL(ERROR_CRYPTO_HANDSHAKE, "Client is NULL for crypto handshake");
    return -1;
  }
 
  // Initialize crypto context for this specific client
  const options_t *opts = options_get();
  const char *password = opts && opts->password[0] != '\0' ? opts->password : "";
 
  int init_result;
  if (strlen(password) > 0) {
    // Password provided - use password-based encryption (even if SSH key is also provided)
    log_debug("SERVER_CRYPTO_HANDSHAKE: Using password-based encryption");
    init_result = crypto_handshake_init_with_password(&client->crypto_handshake_ctx, true, password); // true = server
  } else {
    // Server has SSH key - use standard initialization
    log_debug("SERVER_CRYPTO_HANDSHAKE: Using passwordless-based encryption");
    init_result = crypto_handshake_init(&client->crypto_handshake_ctx, true); // true = server
  }
 
  if (init_result != ASCIICHAT_OK) {
    FATAL(init_result, "Failed to initialize crypto handshake for client %u", atomic_load(&client->client_id));
    return -1;
  }
  // Do NOT set crypto_initialized here - it must be set after handshake completes
  client->crypto_initialized = false;
 
  // Set up server keys in the handshake context
  if (g_server_encryption_enabled && g_server_private_key.type == KEY_TYPE_ED25519) {
    // Copy server private key to handshake context for signing
    memcpy(&client->crypto_handshake_ctx.server_private_key, &g_server_private_key, sizeof(private_key_t));
 
    // Extract Ed25519 public key from private key for identity
    client->crypto_handshake_ctx.server_public_key.type = KEY_TYPE_ED25519;
    memcpy(client->crypto_handshake_ctx.server_public_key.key, g_server_private_key.public_key,
           ED25519_PUBLIC_KEY_SIZE);
 
    // SSH key is already configured in the handshake context above
    // No additional setup needed - SSH keys are used only for authentication
 
    log_debug("Server identity keys configured for client %u", atomic_load(&client->client_id));
  }
 
  // Set up client whitelist if specified
  if (g_num_whitelisted_clients > 0) {
    client->crypto_handshake_ctx.require_client_auth = true;
    client->crypto_handshake_ctx.client_whitelist = g_client_whitelist;
    client->crypto_handshake_ctx.num_whitelisted_clients = g_num_whitelisted_clients;
    log_info("Client whitelist enabled: %zu authorized keys", g_num_whitelisted_clients);
  }
 
  // If --require-server-verify is set, require clients to provide identity keys
  // This ensures only clients with Ed25519 identity keys can connect
  if (GET_OPTION(require_server_verify)) {
    client->crypto_handshake_ctx.require_client_auth = true;
    log_info("--require-server-verify enabled: clients must provide identity keys");
  }
 
  log_debug("Starting crypto handshake with client %u...", atomic_load(&client->client_id));
 
  START_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
 
  // Step 0a: Receive client's protocol version
  log_debug("SERVER_CRYPTO_HANDSHAKE: Receiving client protocol version");
  packet_type_t packet_type;
  void *payload = NULL;
  size_t payload_len = 0;
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to receive packet from client %u", atomic_load(&client->client_id));
 
  // Protect socket access during crypto handshake
  mutex_lock(&client->client_state_mutex);
  socket_t socket = client->socket;
  mutex_unlock(&client->client_state_mutex);
 
  if (socket == INVALID_SOCKET_VALUE) {
    log_debug("SERVER_CRYPTO_HANDSHAKE: Socket is invalid for client %u", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  int result = receive_packet(socket, &packet_type, &payload, &payload_len);
  log_debug("SERVER_CRYPTO_HANDSHAKE: Received packet from client %u: result=%d, type=%u",
            atomic_load(&client->client_id), result, packet_type);
 
  // Handle client disconnection gracefully
  if (result != ASCIICHAT_OK) {
    log_info("Client %u disconnected during crypto handshake (connection error)", atomic_load(&client->client_id));
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
    }
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  // If client sent something other than PROTOCOL_VERSION, it means client is using --no-encrypt
  // In this case, we need to store the packet for the caller to process and skip the handshake
  if (packet_type != PACKET_TYPE_PROTOCOL_VERSION) {
    log_info("Client %u sent packet type %u instead of PROTOCOL_VERSION - using unencrypted mode",
             atomic_load(&client->client_id), packet_type);
 
    // Store this packet in the client structure so the caller can process it
    // This is a bit of a hack, but necessary to preserve the packet we already received
    client->pending_packet_type = packet_type;
    client->pending_packet_payload = payload;
    client->pending_packet_length = payload_len;
 
    // Mark crypto as not initialized (no encryption)
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return 0; // Success - just no encryption
  }
 
  if (payload_len != sizeof(protocol_version_packet_t)) {
    log_error("Invalid protocol version packet size: %zu, expected %zu", payload_len,
              sizeof(protocol_version_packet_t));
    buffer_pool_free(NULL, payload, payload_len);
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  protocol_version_packet_t client_version;
  memcpy(&client_version, payload, sizeof(protocol_version_packet_t));
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to free payload for client %u", atomic_load(&client->client_id));
  buffer_pool_free(NULL, payload, payload_len);
  log_debug("SERVER_CRYPTO_HANDSHAKE: Payload freed for client %u", atomic_load(&client->client_id));
 
  // Convert from network byte order
  uint16_t client_proto_version = NET_TO_HOST_U16(client_version.protocol_version);
  uint16_t client_proto_revision = NET_TO_HOST_U16(client_version.protocol_revision);
 
  uint8_t client_mode = client_version.supports_encryption;
  log_info("Client %u protocol version: %u.%u (crypto mode: 0x%02x)", atomic_load(&client->client_id),
           client_proto_version, client_proto_revision, client_mode);
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to check encryption support for client %u",
            atomic_load(&client->client_id));
 
  // Reject ACIP_CRYPTO_NONE (plaintext only) - at minimum, ACIP handshake must run
  if (client_mode == ACIP_CRYPTO_NONE) {
    log_error("Client %u does not support any crypto protocol", atomic_load(&client->client_id));
    log_info("Client %u disconnected - crypto protocol required", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  // Store encryption mode for setting encrypt_data flag later
  client->encrypt_data = ACIP_CRYPTO_HAS_ENCRYPT(client_mode);
 
  // Step 0b: Send our protocol version to client
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to prepare server protocol version for client %u",
            atomic_load(&client->client_id));
  protocol_version_packet_t server_version = {0};
  log_debug("SERVER_CRYPTO_HANDSHAKE: Initialized server_version struct for client %u",
            atomic_load(&client->client_id));
  server_version.protocol_version = HOST_TO_NET_U16(1);  // Protocol version 1
  server_version.protocol_revision = HOST_TO_NET_U16(0); // Revision 0
  server_version.supports_encryption = client_mode;      // Echo client's mode
  server_version.compression_algorithms = 0;             // No compression for now
  server_version.compression_threshold = 0;
  server_version.feature_flags = 0;
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to call send_protocol_version_packet for client %u",
            atomic_load(&client->client_id));
  result = send_protocol_version_packet(socket, &server_version);
  log_debug("SERVER_CRYPTO_HANDSHAKE: send_protocol_version_packet returned %d for client %u", result,
            atomic_load(&client->client_id));
  if (result != 0) {
    log_error("Failed to send protocol version to client %u", atomic_load(&client->client_id));
    log_info("Client %u disconnected - failed to send protocol version", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
  log_debug("SERVER_CRYPTO_HANDSHAKE: Protocol version sent successfully to client %u",
            atomic_load(&client->client_id));
 
  // Step 0c: Receive client's crypto capabilities
  payload = NULL;
  payload_len = 0;
 
  result = receive_packet(socket, &packet_type, &payload, &payload_len);
  if (result != ASCIICHAT_OK) {
    log_info("Client %u disconnected during crypto capabilities exchange", atomic_load(&client->client_id));
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
    }
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  if (packet_type != PACKET_TYPE_CRYPTO_CAPABILITIES) {
    log_error("Server received packet type 0x%x (decimal %u) - Expected 0x%x (decimal %d)", packet_type, packet_type,
              PACKET_TYPE_CRYPTO_CAPABILITIES, PACKET_TYPE_CRYPTO_CAPABILITIES);
    log_error("Raw packet type bytes: %02x %02x %02x %02x", (packet_type >> 0) & 0xFF, (packet_type >> 8) & 0xFF,
              (packet_type >> 16) & 0xFF, (packet_type >> 24) & 0xFF);
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
    }
    log_info("Client %u disconnected due to protocol mismatch in crypto capabilities", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  if (payload_len != sizeof(crypto_capabilities_packet_t)) {
    SET_ERRNO(ERROR_NETWORK_PROTOCOL,
              "Invalid crypto capabilities packet size: %zu (expected %zu) - we should disconnect this client",
              payload_len, sizeof(crypto_capabilities_packet_t));
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
      payload = NULL;
    }
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  if (!payload) {
    SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Crypto capabilities payload is NULL after validation");
    log_error("Client %u crypto capabilities payload is NULL after validation - disconnecting",
              atomic_load(&client->client_id));
    LOG_ERRNO_IF_SET("Crypto handshake: missing capabilities payload");
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  // Copy and validate payload immediately after NULL check to ensure analyzer understands safety
  crypto_capabilities_packet_t client_caps;
  memcpy(&client_caps, payload, sizeof(crypto_capabilities_packet_t));
 
  // Free the buffer after use
  buffer_pool_free(NULL, payload, payload_len);
  payload = NULL; // Clear reference to prevent use-after-free
 
  // Convert from network byte order
  uint16_t supported_kex = NET_TO_HOST_U16(client_caps.supported_kex_algorithms);
  uint16_t supported_auth = NET_TO_HOST_U16(client_caps.supported_auth_algorithms);
  uint16_t supported_cipher = NET_TO_HOST_U16(client_caps.supported_cipher_algorithms);
 
  log_debug("Client %u crypto capabilities: KEX=0x%04x, Auth=0x%04x, Cipher=0x%04x", atomic_load(&client->client_id),
            supported_kex, supported_auth, supported_cipher);
 
  // Step 0d: Select crypto algorithms and send parameters to client
  crypto_parameters_packet_t server_params = {0};
 
  // Select algorithms (for now, we only support X25519 + Ed25519 + XSalsa20-Poly1305)
  server_params.selected_kex = KEX_ALGO_X25519;
  server_params.selected_cipher =
      ACIP_CRYPTO_HAS_ENCRYPT(client_mode) ? CIPHER_ALGO_XSALSA20_POLY1305 : CIPHER_ALGO_NONE;
 
  // Select authentication algorithm based on server configuration
  // Note: Password authentication is not a separate algorithm - it's a mode of operation
  // that affects key derivation. The authentication algorithm refers to signature verification.
  //
  // We require Ed25519 authentication if:
  //   - Server has an identity key (g_server_encryption_enabled AND g_server_private_key is Ed25519)
  //   - This is needed to send authenticated KEY_EXCHANGE_INIT with identity + signature
  //   - Client whitelist verification happens during authentication phase, not key exchange
  if (g_server_encryption_enabled && g_server_private_key.type == KEY_TYPE_ED25519) {
    // SSH key authentication (Ed25519 signatures) - server has identity key
    server_params.selected_auth = AUTH_ALGO_ED25519;
  } else {
    // No signature-based authentication during key exchange
    // Client authentication will be required during auth phase if whitelist is enabled
    server_params.selected_auth = AUTH_ALGO_NONE;
  }
 
  // Set verification flag based on client whitelist
  server_params.verification_enabled = (g_num_whitelisted_clients > 0) ? 1 : 0;
 
  // Set crypto parameters for current algorithms
  server_params.kex_public_key_size = CRYPTO_PUBLIC_KEY_SIZE; // X25519 public key size
 
  // Only set auth/signature sizes if we're using authentication
  if (server_params.selected_auth == AUTH_ALGO_ED25519) {
    server_params.auth_public_key_size = ED25519_PUBLIC_KEY_SIZE; // Ed25519 public key size
    server_params.signature_size = ED25519_SIGNATURE_SIZE;        // Ed25519 signature size
  } else {
    server_params.auth_public_key_size = 0; // No authentication
    server_params.signature_size = 0;       // No signature
  }
 
  server_params.shared_secret_size = CRYPTO_PUBLIC_KEY_SIZE; // X25519 shared secret size
  server_params.nonce_size = CRYPTO_NONCE_SIZE;              // XSalsa20 nonce size
  server_params.mac_size = CRYPTO_MAC_SIZE;                  // Poly1305 MAC size
  server_params.hmac_size = CRYPTO_HMAC_SIZE;                // HMAC-SHA256 size
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: Sending crypto parameters to client %u", atomic_load(&client->client_id));
  result = send_crypto_parameters_packet(socket, &server_params);
  if (result != 0) {
    log_error("Failed to send crypto parameters to client %u", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
  log_debug("Server selected crypto for client %u: KEX=%u, Auth=%u, Cipher=%u", atomic_load(&client->client_id),
            server_params.selected_kex, server_params.selected_auth, server_params.selected_cipher);
 
  // Set the crypto parameters in the handshake context
  result = crypto_handshake_set_parameters(&client->crypto_handshake_ctx, &server_params);
  if (result != ASCIICHAT_OK) {
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    FATAL(result, "Failed to set crypto parameters for client %u", atomic_load(&client->client_id));
    return -1;
  }
 
  // Step 0.5: Receive CRYPTO_CLIENT_HELLO (multi-key support)
  // When server has multiple identity keys, client MUST send CLIENT_HELLO to select the correct key
  // For single-key servers, CLIENT_HELLO is optional (backward compatibility)
  if (g_num_server_identity_keys > 0) {
    log_debug("SERVER_CRYPTO_HANDSHAKE: Waiting for optional CRYPTO_CLIENT_HELLO from client %u",
              atomic_load(&client->client_id));
 
    // Try to receive CLIENT_HELLO packet
    packet_type_t hello_packet_type;
    uint8_t *hello_payload = NULL;
    size_t hello_payload_len = 0;
 
    result = receive_packet(socket, &hello_packet_type, (void **)&hello_payload, &hello_payload_len);
    if (result != ASCIICHAT_OK) {
      log_info("Client %u disconnected during handshake initialization", atomic_load(&client->client_id));
      if (hello_payload) {
        buffer_pool_free(NULL, hello_payload, hello_payload_len);
      }
      client->crypto_initialized = false;
      STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
      return -1;
    }
 
    if (hello_packet_type == PACKET_TYPE_CRYPTO_CLIENT_HELLO) {
      // Client sent expected server key - select matching key
      if (hello_payload_len != ED25519_PUBLIC_KEY_SIZE) {
        log_error("Invalid CRYPTO_CLIENT_HELLO size: %zu (expected %d)", hello_payload_len, ED25519_PUBLIC_KEY_SIZE);
        buffer_pool_free(NULL, hello_payload, hello_payload_len);
        client->crypto_initialized = false;
        STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
        return -1;
      }
 
      const uint8_t *expected_server_key = hello_payload;
 
      // Log the expected key for debugging
      char hex_expected[65];
      pubkey_to_hex(expected_server_key, hex_expected);
      log_debug("Client %u expects server key: %s", atomic_load(&client->client_id), hex_expected);
 
      // Search g_server_identity_keys[] for matching public key
      bool key_found = false;
      for (size_t i = 0; i < g_num_server_identity_keys; i++) {
        if (sodium_memcmp(expected_server_key, g_server_identity_keys[i].public_key, ED25519_PUBLIC_KEY_SIZE) == 0) {
          // Found matching key - use this one for handshake
          memcpy(&client->crypto_handshake_ctx.server_private_key, &g_server_identity_keys[i], sizeof(private_key_t));
 
          char hex_selected[65];
          pubkey_to_hex(g_server_identity_keys[i].public_key, hex_selected);
          log_debug("Client %u selected server identity key #%zu: %s", atomic_load(&client->client_id), i + 1,
                    hex_selected);
 
          key_found = true;
          break;
        }
      }
 
      if (!key_found) {
        // Client requested a key we don't have - reject connection
        log_error("Client %u requested unknown server key %s - rejecting connection", atomic_load(&client->client_id),
                  hex_expected);
        buffer_pool_free(NULL, hello_payload, hello_payload_len);
        client->crypto_initialized = false;
        STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
        return -1;
      }
 
      buffer_pool_free(NULL, hello_payload, hello_payload_len);
    } else {
      // Client didn't send CLIENT_HELLO
      // This is ONLY acceptable for single-key servers (backward compatibility)
      if (g_num_server_identity_keys > 1) {
        log_error("Client %u must send CRYPTO_CLIENT_HELLO when server has multiple keys (got packet type %u)",
                  atomic_load(&client->client_id), hello_packet_type);
        buffer_pool_free(NULL, hello_payload, hello_payload_len);
        client->crypto_initialized = false;
        STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
        return -1;
      }
 
      // Single-key server: Old client didn't send CLIENT_HELLO
      // Store this packet for later processing (it's probably the first handshake packet)
      log_debug("Client %u is using old protocol (no CLIENT_HELLO) - using default key",
                atomic_load(&client->client_id));
 
      // Store pending packet so we can process it after KEY_EXCHANGE_INIT
      client->pending_packet_type = hello_packet_type;
      client->pending_packet_payload = hello_payload;
      client->pending_packet_length = hello_payload_len;
    }
  }
 
  // Step 1: Send our public key to client
  log_debug("About to call crypto_handshake_server_start");
  result = crypto_handshake_server_start_socket(&client->crypto_handshake_ctx, socket);
  if (result != ASCIICHAT_OK) {
    log_error("Crypto handshake start failed for client %u: %s", atomic_load(&client->client_id),
              asciichat_error_string(result));
    LOG_ERRNO_IF_SET("Crypto handshake: failed to send KEY_EXCHANGE_INIT");
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  // Step 2: Receive client's public key and send auth challenge
  result = crypto_handshake_server_auth_challenge_socket(&client->crypto_handshake_ctx, socket);
  if (result != ASCIICHAT_OK) {
    log_error("Crypto authentication challenge failed for client %u: %s", atomic_load(&client->client_id),
              asciichat_error_string(result));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error to disconnect client gracefully
  }
 
  // Check if handshake completed during auth challenge (no authentication needed)
  if (client->crypto_handshake_ctx.state == CRYPTO_HANDSHAKE_READY) {
    uint32_t cid = atomic_load(&client->client_id);
    client->crypto_initialized = true;
    // Propagate encryption flag to crypto context
    client->crypto_handshake_ctx.crypto_ctx.encrypt_data = client->encrypt_data;
    STOP_TIMER_AND_LOG(debug, 100 * NS_PER_MS_INT, "server_crypto_handshake_client_%u",
                       "Crypto handshake completed successfully for client %u (no authentication)", cid);
    return 0;
  }
 
  // Step 3: Receive auth response and complete handshake
  result = crypto_handshake_server_complete_socket(&client->crypto_handshake_ctx, socket);
  if (result != ASCIICHAT_OK) {
    if (result == ERROR_NETWORK || result == ERROR_NETWORK_PROTOCOL || result == ERROR_CRYPTO_AUTH ||
        result == ERROR_CRYPTO_VERIFICATION || result == ERROR_CRYPTO) {
      if (result == ERROR_NETWORK) {
        log_info("Client %u disconnected during authentication", atomic_load(&client->client_id));
      } else {
        log_error("Crypto authentication failed for client %u: %s", atomic_load(&client->client_id),
                  asciichat_error_string(result));
      }
      LOG_ERRNO_IF_SET("Crypto handshake completion failed");
      client->crypto_initialized = false;
      STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
      return -1;
    }
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    FATAL(result, "Crypto authentication response failed for client %u", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    return -1;
  }
 
  uint32_t cid = atomic_load(&client->client_id);
  client->crypto_initialized = true;
  // Propagate encryption flag to crypto context
  client->crypto_handshake_ctx.crypto_ctx.encrypt_data = client->encrypt_data;
  STOP_TIMER_AND_LOG(debug, 100 * NS_PER_MS_INT, "server_crypto_handshake_client_%u",
                     "Crypto handshake completed successfully for client %u", cid);
 
  // Send success notification to client (encrypted channel now established)
  log_info_client(client, "Encryption established - secure channel ready");
  return 0;
}

References buffer_pool_free(), crypto_handshake_init(), crypto_handshake_init_with_password(), crypto_handshake_server_auth_challenge_socket(), crypto_handshake_server_complete_socket(), crypto_handshake_server_start_socket(), crypto_handshake_set_parameters(), g_client_whitelist, g_num_server_identity_keys, g_num_whitelisted_clients, g_server_encryption_enabled, g_server_identity_keys, g_server_private_key, options_get(), pubkey_to_hex(), receive_packet(), send_crypto_parameters_packet(), and send_protocol_version_packet().

Referenced by add_client().

server_crypto_init()

int server_crypto_init

(

void

)

Initialize server crypto system (global initialization)

Returns

0 on success, -1 on failure

Definition at line 161 of file src/server/crypto.c.

                             {
  // Check if encryption is disabled
  if (GET_OPTION(no_encrypt)) {
    log_info("Encryption disabled via --no-encrypt");
    return 0;
  }
 
  log_debug("Server crypto system initialized (per-client contexts will be created on demand)");
  return 0;
}

Referenced by add_client().