src/server/crypto.c

Go to the documentation of this file.

 
#include "client.h"
#include "crypto.h"
 
#include "options/options.h"
#include "options/rcu.h" // For RCU-based options access
#include "common.h"
#include "util/endian.h"
#include "crypto/handshake/common.h"
#include "crypto/handshake/server.h"
#include "crypto/crypto.h"
#include "crypto/keys.h"
#include "util/time.h"
#include "util/endian.h"
 
#include <string.h>
#include <stdio.h>
#include <sodium.h>
 
// External references to global server crypto state
extern bool g_server_encryption_enabled;
extern private_key_t g_server_private_key;
 
// External references to client whitelist (defined in main.c)
extern public_key_t g_client_whitelist[];
extern size_t g_num_whitelisted_clients;
 
// Per-client crypto contexts are now stored in client_info_t structure
// No global crypto context needed
 
int server_crypto_init(void) {
  // Check if encryption is disabled
  if (GET_OPTION(no_encrypt)) {
    log_info("Encryption disabled via --no-encrypt");
    return 0;
  }
 
  log_info("Server crypto system initialized (per-client contexts will be created on demand)");
  return 0;
}
 
int server_crypto_handshake(client_info_t *client) {
  if (GET_OPTION(no_encrypt)) {
    log_debug("Crypto handshake skipped (disabled)");
    return 0;
  }
 
  if (!client) {
    FATAL(ERROR_CRYPTO_HANDSHAKE, "Client is NULL for crypto handshake");
    return -1;
  }
 
  // Initialize crypto context for this specific client
  const options_t *opts = options_get();
  const char *password = opts && opts->password[0] != '\0' ? opts->password : "";
 
  int init_result;
  if (strlen(password) > 0) {
    // Password provided - use password-based encryption (even if SSH key is also provided)
    log_debug("SERVER_CRYPTO_HANDSHAKE: Using password-based encryption");
    init_result = crypto_handshake_init_with_password(&client->crypto_handshake_ctx, true, password); // true = server
  } else {
    // Server has SSH key - use standard initialization
    log_debug("SERVER_CRYPTO_HANDSHAKE: Using passwordless-based encryption");
    init_result = crypto_handshake_init(&client->crypto_handshake_ctx, true); // true = server
  }
 
  if (init_result != ASCIICHAT_OK) {
    FATAL(init_result, "Failed to initialize crypto handshake for client %u", atomic_load(&client->client_id));
    return -1;
  }
  client->crypto_initialized = true;
 
  // Set up server keys in the handshake context
  if (g_server_encryption_enabled && g_server_private_key.type == KEY_TYPE_ED25519) {
    // Copy server private key to handshake context for signing
    memcpy(&client->crypto_handshake_ctx.server_private_key, &g_server_private_key, sizeof(private_key_t));
 
    // Extract Ed25519 public key from private key for identity
    client->crypto_handshake_ctx.server_public_key.type = KEY_TYPE_ED25519;
    memcpy(client->crypto_handshake_ctx.server_public_key.key, g_server_private_key.public_key,
           ED25519_PUBLIC_KEY_SIZE);
 
    // SSH key is already configured in the handshake context above
    // No additional setup needed - SSH keys are used only for authentication
 
    log_debug("Server identity keys configured for client %u", atomic_load(&client->client_id));
  }
 
  // Set up client whitelist if specified
  if (g_num_whitelisted_clients > 0) {
    client->crypto_handshake_ctx.require_client_auth = true;
    client->crypto_handshake_ctx.client_whitelist = g_client_whitelist;
    client->crypto_handshake_ctx.num_whitelisted_clients = g_num_whitelisted_clients;
    log_info("Client whitelist enabled: %zu authorized keys", g_num_whitelisted_clients);
  }
 
  // If --require-server-verify is set, require clients to provide identity keys
  // This ensures only clients with Ed25519 identity keys can connect
  if (GET_OPTION(require_server_verify)) {
    client->crypto_handshake_ctx.require_client_auth = true;
    log_info("--require-server-verify enabled: clients must provide identity keys");
  }
 
  log_info("Starting crypto handshake with client %u...", atomic_load(&client->client_id));
 
  START_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
 
  // Step 0a: Receive client's protocol version
  log_debug("SERVER_CRYPTO_HANDSHAKE: Receiving client protocol version");
  packet_type_t packet_type;
  void *payload = NULL;
  size_t payload_len = 0;
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to receive packet from client %u", atomic_load(&client->client_id));
 
  // Protect socket access during crypto handshake
  mutex_lock(&client->client_state_mutex);
  socket_t socket = client->socket;
  mutex_unlock(&client->client_state_mutex);
 
  if (socket == INVALID_SOCKET_VALUE) {
    log_debug("SERVER_CRYPTO_HANDSHAKE: Socket is invalid for client %u", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  int result = receive_packet(socket, &packet_type, &payload, &payload_len);
  log_debug("SERVER_CRYPTO_HANDSHAKE: Received packet from client %u: result=%d, type=%u",
            atomic_load(&client->client_id), result, packet_type);
 
  // Handle client disconnection gracefully
  if (result != ASCIICHAT_OK) {
    log_info("Client %u disconnected during crypto handshake (connection error)", atomic_load(&client->client_id));
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
    }
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  // If client sent something other than PROTOCOL_VERSION, it means client is using --no-encrypt
  // In this case, we need to store the packet for the caller to process and skip the handshake
  if (packet_type != PACKET_TYPE_PROTOCOL_VERSION) {
    log_info("Client %u sent packet type %u instead of PROTOCOL_VERSION - using unencrypted mode",
             atomic_load(&client->client_id), packet_type);
 
    // Store this packet in the client structure so the caller can process it
    // This is a bit of a hack, but necessary to preserve the packet we already received
    client->pending_packet_type = packet_type;
    client->pending_packet_payload = payload;
    client->pending_packet_length = payload_len;
 
    // Mark crypto as not initialized (no encryption)
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return 0; // Success - just no encryption
  }
 
  if (payload_len != sizeof(protocol_version_packet_t)) {
    log_error("Invalid protocol version packet size: %zu, expected %zu", payload_len,
              sizeof(protocol_version_packet_t));
    buffer_pool_free(NULL, payload, payload_len);
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  protocol_version_packet_t client_version;
  memcpy(&client_version, payload, sizeof(protocol_version_packet_t));
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to free payload for client %u", atomic_load(&client->client_id));
  buffer_pool_free(NULL, payload, payload_len);
  log_debug("SERVER_CRYPTO_HANDSHAKE: Payload freed for client %u", atomic_load(&client->client_id));
 
  // Convert from network byte order
  uint16_t client_proto_version = NET_TO_HOST_U16(client_version.protocol_version);
  uint16_t client_proto_revision = NET_TO_HOST_U16(client_version.protocol_revision);
 
  log_info("Client %u protocol version: %u.%u (encryption: %s)", atomic_load(&client->client_id), client_proto_version,
           client_proto_revision, client_version.supports_encryption ? "yes" : "no");
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to check encryption support for client %u",
            atomic_load(&client->client_id));
 
  if (!client_version.supports_encryption) {
    log_error("Client %u does not support encryption", atomic_load(&client->client_id));
    log_info("Client %u disconnected - encryption not supported", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  // Step 0b: Send our protocol version to client
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to prepare server protocol version for client %u",
            atomic_load(&client->client_id));
  protocol_version_packet_t server_version = {0};
  log_debug("SERVER_CRYPTO_HANDSHAKE: Initialized server_version struct for client %u",
            atomic_load(&client->client_id));
  server_version.protocol_version = HOST_TO_NET_U16(1);  // Protocol version 1
  server_version.protocol_revision = HOST_TO_NET_U16(0); // Revision 0
  server_version.supports_encryption = 1;                // We support encryption
  server_version.compression_algorithms = 0;             // No compression for now
  server_version.compression_threshold = 0;
  server_version.feature_flags = 0;
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: About to call send_protocol_version_packet for client %u",
            atomic_load(&client->client_id));
  result = send_protocol_version_packet(socket, &server_version);
  log_debug("SERVER_CRYPTO_HANDSHAKE: send_protocol_version_packet returned %d for client %u", result,
            atomic_load(&client->client_id));
  if (result != 0) {
    log_error("Failed to send protocol version to client %u", atomic_load(&client->client_id));
    log_info("Client %u disconnected - failed to send protocol version", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
  log_debug("SERVER_CRYPTO_HANDSHAKE: Protocol version sent successfully to client %u",
            atomic_load(&client->client_id));
 
  // Step 0c: Receive client's crypto capabilities
  payload = NULL;
  payload_len = 0;
 
  result = receive_packet(socket, &packet_type, &payload, &payload_len);
  if (result != ASCIICHAT_OK) {
    log_info("Client %u disconnected during crypto capabilities exchange", atomic_load(&client->client_id));
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
    }
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  if (packet_type != PACKET_TYPE_CRYPTO_CAPABILITIES) {
    log_error("Server received packet type 0x%x (decimal %u) - Expected 0x%x (decimal %d)", packet_type, packet_type,
              PACKET_TYPE_CRYPTO_CAPABILITIES, PACKET_TYPE_CRYPTO_CAPABILITIES);
    log_error("Raw packet type bytes: %02x %02x %02x %02x", (packet_type >> 0) & 0xFF, (packet_type >> 8) & 0xFF,
              (packet_type >> 16) & 0xFF, (packet_type >> 24) & 0xFF);
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
    }
    log_info("Client %u disconnected due to protocol mismatch in crypto capabilities", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error but don't crash the server
  }
 
  if (payload_len != sizeof(crypto_capabilities_packet_t)) {
    SET_ERRNO(ERROR_NETWORK_PROTOCOL,
              "Invalid crypto capabilities packet size: %zu (expected %zu) - we should disconnect this client",
              payload_len, sizeof(crypto_capabilities_packet_t));
    if (payload) {
      buffer_pool_free(NULL, payload, payload_len);
      payload = NULL;
    }
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  if (!payload) {
    SET_ERRNO(ERROR_NETWORK_PROTOCOL, "Crypto capabilities payload is NULL after validation");
    log_error("Client %u crypto capabilities payload is NULL after validation - disconnecting",
              atomic_load(&client->client_id));
    LOG_ERRNO_IF_SET("Crypto handshake: missing capabilities payload");
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  crypto_capabilities_packet_t client_caps;
  // NOLINTNEXTLINE(clang-analyzer-unix.cstring.NullArg) - payload checked above, FATAL never returns
  memcpy(&client_caps, payload, sizeof(crypto_capabilities_packet_t));
  buffer_pool_free(NULL, payload, payload_len);
 
  // Convert from network byte order
  uint16_t supported_kex = NET_TO_HOST_U16(client_caps.supported_kex_algorithms);
  uint16_t supported_auth = NET_TO_HOST_U16(client_caps.supported_auth_algorithms);
  uint16_t supported_cipher = NET_TO_HOST_U16(client_caps.supported_cipher_algorithms);
 
  log_info("Client %u crypto capabilities: KEX=0x%04x, Auth=0x%04x, Cipher=0x%04x", atomic_load(&client->client_id),
           supported_kex, supported_auth, supported_cipher);
 
  // Step 0d: Select crypto algorithms and send parameters to client
  crypto_parameters_packet_t server_params = {0};
 
  // Select algorithms (for now, we only support X25519 + Ed25519 + XSalsa20-Poly1305)
  server_params.selected_kex = KEX_ALGO_X25519;
  server_params.selected_cipher = CIPHER_ALGO_XSALSA20_POLY1305;
 
  // Select authentication algorithm based on server configuration
  // Note: Password authentication is not a separate algorithm - it's a mode of operation
  // that affects key derivation. The authentication algorithm refers to signature verification.
  //
  // CRITICAL: We require Ed25519 authentication if:
  //   - Server has an identity key (g_server_encryption_enabled AND g_server_private_key is Ed25519)
  //   - This is needed to send authenticated KEY_EXCHANGE_INIT with identity + signature
  //   - Client whitelist verification happens during authentication phase, not key exchange
  if (g_server_encryption_enabled && g_server_private_key.type == KEY_TYPE_ED25519) {
    // SSH key authentication (Ed25519 signatures) - server has identity key
    server_params.selected_auth = AUTH_ALGO_ED25519;
  } else {
    // No signature-based authentication during key exchange
    // Client authentication will be required during auth phase if whitelist is enabled
    server_params.selected_auth = AUTH_ALGO_NONE;
  }
 
  // Set verification flag based on client whitelist
  server_params.verification_enabled = (g_num_whitelisted_clients > 0) ? 1 : 0;
 
  // Set crypto parameters for current algorithms
  server_params.kex_public_key_size = CRYPTO_PUBLIC_KEY_SIZE; // X25519 public key size
 
  // Only set auth/signature sizes if we're using authentication
  if (server_params.selected_auth == AUTH_ALGO_ED25519) {
    server_params.auth_public_key_size = ED25519_PUBLIC_KEY_SIZE; // Ed25519 public key size
    server_params.signature_size = ED25519_SIGNATURE_SIZE;        // Ed25519 signature size
  } else {
    server_params.auth_public_key_size = 0; // No authentication
    server_params.signature_size = 0;       // No signature
  }
 
  server_params.shared_secret_size = CRYPTO_PUBLIC_KEY_SIZE; // X25519 shared secret size
  server_params.nonce_size = CRYPTO_NONCE_SIZE;              // XSalsa20 nonce size
  server_params.mac_size = CRYPTO_MAC_SIZE;                  // Poly1305 MAC size
  server_params.hmac_size = CRYPTO_HMAC_SIZE;                // HMAC-SHA256 size
 
  log_debug("SERVER_CRYPTO_HANDSHAKE: Sending crypto parameters to client %u", atomic_load(&client->client_id));
  result = send_crypto_parameters_packet(socket, &server_params);
  if (result != 0) {
    log_error("Failed to send crypto parameters to client %u", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
  log_info("Server selected crypto for client %u: KEX=%u, Auth=%u, Cipher=%u", atomic_load(&client->client_id),
           server_params.selected_kex, server_params.selected_auth, server_params.selected_cipher);
 
  // Set the crypto parameters in the handshake context
  result = crypto_handshake_set_parameters(&client->crypto_handshake_ctx, &server_params);
  if (result != ASCIICHAT_OK) {
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    FATAL(result, "Failed to set crypto parameters for client %u", atomic_load(&client->client_id));
    return -1;
  }
 
  // Step 1: Send our public key to client
  log_debug("About to call crypto_handshake_server_start");
  result = crypto_handshake_server_start(&client->crypto_handshake_ctx, socket);
  if (result != ASCIICHAT_OK) {
    log_error("Crypto handshake start failed for client %u: %s", atomic_load(&client->client_id),
              asciichat_error_string(result));
    LOG_ERRNO_IF_SET("Crypto handshake: failed to send KEY_EXCHANGE_INIT");
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1;
  }
 
  // Step 2: Receive client's public key and send auth challenge
  result = crypto_handshake_server_auth_challenge(&client->crypto_handshake_ctx, socket);
  if (result != ASCIICHAT_OK) {
    log_error("Crypto authentication challenge failed for client %u: %s", atomic_load(&client->client_id),
              asciichat_error_string(result));
    client->crypto_initialized = false;
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    return -1; // Return error to disconnect client gracefully
  }
 
  // Check if handshake completed during auth challenge (no authentication needed)
  if (client->crypto_handshake_ctx.state == CRYPTO_HANDSHAKE_READY) {
    uint32_t cid = atomic_load(&client->client_id);
    STOP_TIMER_AND_LOG("server_crypto_handshake_client_%u", log_info,
                       "Crypto handshake completed successfully for client %u (no authentication)", cid);
    return 0;
  }
 
  // Step 3: Receive auth response and complete handshake
  result = crypto_handshake_server_complete(&client->crypto_handshake_ctx, socket);
  if (result != ASCIICHAT_OK) {
    if (result == ERROR_NETWORK || result == ERROR_NETWORK_PROTOCOL || result == ERROR_CRYPTO_AUTH ||
        result == ERROR_CRYPTO_VERIFICATION || result == ERROR_CRYPTO) {
      if (result == ERROR_NETWORK) {
        log_info("Client %u disconnected during authentication", atomic_load(&client->client_id));
      } else {
        log_error("Crypto authentication failed for client %u: %s", atomic_load(&client->client_id),
                  asciichat_error_string(result));
      }
      LOG_ERRNO_IF_SET("Crypto handshake completion failed");
      client->crypto_initialized = false;
      STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
      return -1;
    }
    STOP_TIMER("server_crypto_handshake_client_%u", atomic_load(&client->client_id));
    FATAL(result, "Crypto authentication response failed for client %u", atomic_load(&client->client_id));
    client->crypto_initialized = false;
    return -1;
  }
 
  uint32_t cid = atomic_load(&client->client_id);
  STOP_TIMER_AND_LOG("server_crypto_handshake_client_%u", log_info,
                     "Crypto handshake completed successfully for client %u", cid);
 
  // Send success notification to client (encrypted channel now established)
  log_info_client(client, "Encryption established - secure channel ready");
  return 0;
}
 
bool crypto_server_is_ready(uint32_t client_id) {
  if (GET_OPTION(no_encrypt)) {
    return false;
  }
 
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return false;
  }
 
  if (!client->crypto_initialized) {
    return false;
  }
 
  bool ready = crypto_handshake_is_ready(&client->crypto_handshake_ctx);
  return ready;
}
 
const crypto_context_t *crypto_server_get_context(uint32_t client_id) {
  if (!crypto_server_is_ready(client_id)) {
    return NULL;
  }
 
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return NULL;
  }
 
  return crypto_handshake_get_context(&client->crypto_handshake_ctx);
}
 
int crypto_server_encrypt_packet(uint32_t client_id, const uint8_t *plaintext, size_t plaintext_len,
                                 uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_len) {
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return -1;
  }
 
  return crypto_encrypt_packet_or_passthrough(&client->crypto_handshake_ctx, crypto_server_is_ready(client_id),
                                              plaintext, plaintext_len, ciphertext, ciphertext_size, ciphertext_len);
}
 
int crypto_server_decrypt_packet(uint32_t client_id, const uint8_t *ciphertext, size_t ciphertext_len,
                                 uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_len) {
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return -1;
  }
 
  return crypto_decrypt_packet_or_passthrough(&client->crypto_handshake_ctx, crypto_server_is_ready(client_id),
                                              ciphertext, ciphertext_len, plaintext, plaintext_size, plaintext_len);
}
 
void crypto_server_cleanup_client(uint32_t client_id) {
  client_info_t *client = find_client_by_id(client_id);
  if (!client) {
    return;
  }
 
  if (client->crypto_initialized) {
    crypto_handshake_cleanup(&client->crypto_handshake_ctx);
    client->crypto_initialized = false;
    log_debug("Crypto handshake cleaned up for client %u", client_id);
  }
}