network_crypto_internal.h

Go to the documentation of this file.

/*
 * This file is part of OpenTTD.
 * OpenTTD is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 2.
 * OpenTTD is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with OpenTTD. If not, see <https://www.gnu.org/licenses/old-licenses/gpl-2.0>.
 */

 
#ifndef NETWORK_CRYPTO_INTERNAL_H
#define NETWORK_CRYPTO_INTERNAL_H
 
#include "network_crypto.h"

constexpr size_t X25519_KEY_SIZE = 32;
constexpr size_t X25519_NONCE_SIZE = 24;
constexpr size_t X25519_MAC_SIZE = 16;
constexpr size_t X25519_KEY_EXCHANGE_MESSAGE_SIZE = 8;

struct X25519Key : std::array<uint8_t, X25519_KEY_SIZE> {
  ~X25519Key();
};

struct X25519PublicKey : X25519Key {
};

struct X25519SecretKey : X25519Key {
  static X25519SecretKey CreateRandom();
  X25519PublicKey CreatePublicKey() const;
};

struct X25519Nonce : std::array<uint8_t, X25519_NONCE_SIZE> {
  static X25519Nonce CreateRandom();
  ~X25519Nonce();
};

using X25519Mac = std::array<uint8_t, X25519_MAC_SIZE>;

using X25519KeyExchangeMessage = std::array<uint8_t, X25519_KEY_EXCHANGE_MESSAGE_SIZE>;

enum class X25519KeyExchangeSide : uint8_t {
  CLIENT, 
  SERVER, 
};

class X25519DerivedKeys {
private:
  std::array<uint8_t, X25519_KEY_SIZE + X25519_KEY_SIZE> keys;
public:
  ~X25519DerivedKeys();
  std::span<const uint8_t> ClientToServer() const;
  std::span<const uint8_t> ServerToClient() const;
  bool Exchange(const X25519PublicKey &peer_public_key, X25519KeyExchangeSide side,
      const X25519SecretKey &our_secret_key, const X25519PublicKey &our_public_key, std::string_view extra_payload);
};

class X25519AuthenticationHandler {
private:
  X25519SecretKey our_secret_key; 
  X25519PublicKey our_public_key; 
  X25519Nonce key_exchange_nonce; 
  X25519DerivedKeys derived_keys; 
  X25519PublicKey peer_public_key; 
 
  X25519Nonce encryption_nonce; 
 
protected:
  X25519AuthenticationHandler(const X25519SecretKey &secret_key);
 
  void SendRequest(struct Packet &p);
  bool ReceiveRequest(struct Packet &p);
  bool SendResponse(struct Packet &p, std::string_view derived_key_extra_payload);
  NetworkAuthenticationServerHandler::ResponseResult ReceiveResponse(struct Packet &p, std::string_view derived_key_extra_payload);
 
  std::string GetPeerPublicKey() const;
 
  void SendEnableEncryption(struct Packet &p) const;
  bool ReceiveEnableEncryption(struct Packet &p);
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const;
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const;
};

class X25519KeyExchangeOnlyClientHandler : protected X25519AuthenticationHandler, public NetworkAuthenticationClientHandler {
public:
  X25519KeyExchangeOnlyClientHandler(const X25519SecretKey &secret_key) : X25519AuthenticationHandler(secret_key) {}
 
  RequestResult ReceiveRequest(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveRequest(p) ? RequestResult::ReadyForResponse : RequestResult::Invalid; }
  bool SendResponse(struct Packet &p) override { return this->X25519AuthenticationHandler::SendResponse(p, {}); }
 
  std::string_view GetName() const override { return "X25519-KeyExchangeOnly-client"; }
  NetworkAuthenticationMethod GetAuthenticationMethod() const override { return NetworkAuthenticationMethod::X25519_KeyExchangeOnly; }
 
  bool ReceiveEnableEncryption(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateServerToClientEncryptionHandler(); }
};

class X25519KeyExchangeOnlyServerHandler : protected X25519AuthenticationHandler, public NetworkAuthenticationServerHandler {
public:
  X25519KeyExchangeOnlyServerHandler(const X25519SecretKey &secret_key) : X25519AuthenticationHandler(secret_key) {}
 
  void SendRequest(struct Packet &p) override { this->X25519AuthenticationHandler::SendRequest(p); }
  ResponseResult ReceiveResponse(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveResponse(p, {}); }
 
  std::string_view GetName() const override { return "X25519-KeyExchangeOnly-server"; }
  NetworkAuthenticationMethod GetAuthenticationMethod() const override { return NetworkAuthenticationMethod::X25519_KeyExchangeOnly; }
  bool CanBeUsed() const override { return true; }
 
  std::string GetPeerPublicKey() const override { return this->X25519AuthenticationHandler::GetPeerPublicKey(); }
  void SendEnableEncryption(struct Packet &p) override { this->X25519AuthenticationHandler::SendEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateServerToClientEncryptionHandler(); }
};

class X25519PAKEClientHandler : protected X25519AuthenticationHandler, public NetworkAuthenticationClientHandler {
private:
  std::shared_ptr<NetworkAuthenticationPasswordRequestHandler> handler;
 
public:
  X25519PAKEClientHandler(const X25519SecretKey &secret_key, std::shared_ptr<NetworkAuthenticationPasswordRequestHandler> handler) : X25519AuthenticationHandler(secret_key), handler(std::move(handler)) {}
 
  RequestResult ReceiveRequest(struct Packet &p) override;
  bool SendResponse(struct Packet &p) override { return this->X25519AuthenticationHandler::SendResponse(p, this->handler->password); }
 
  std::string_view GetName() const override { return "X25519-PAKE-client"; }
  NetworkAuthenticationMethod GetAuthenticationMethod() const override { return NetworkAuthenticationMethod::X25519_PAKE; }
 
  bool ReceiveEnableEncryption(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateServerToClientEncryptionHandler(); }
};

class X25519PAKEServerHandler : protected X25519AuthenticationHandler, public NetworkAuthenticationServerHandler {
private:
  const NetworkAuthenticationPasswordProvider *password_provider; 
public:
  X25519PAKEServerHandler(const X25519SecretKey &secret_key, const NetworkAuthenticationPasswordProvider *password_provider) : X25519AuthenticationHandler(secret_key), password_provider(password_provider) {}
 
  void SendRequest(struct Packet &p) override { this->X25519AuthenticationHandler::SendRequest(p); }
  ResponseResult ReceiveResponse(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveResponse(p, this->password_provider->GetPassword()); }
 
  std::string_view GetName() const override { return "X25519-PAKE-server"; }
  NetworkAuthenticationMethod GetAuthenticationMethod() const override { return NetworkAuthenticationMethod::X25519_PAKE; }
  bool CanBeUsed() const override { return !this->password_provider->GetPassword().empty(); }
 
  std::string GetPeerPublicKey() const override { return this->X25519AuthenticationHandler::GetPeerPublicKey(); }
  void SendEnableEncryption(struct Packet &p) override { this->X25519AuthenticationHandler::SendEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateServerToClientEncryptionHandler(); }
};
 

class X25519AuthorizedKeyClientHandler : protected X25519AuthenticationHandler, public NetworkAuthenticationClientHandler {
public:
  X25519AuthorizedKeyClientHandler(const X25519SecretKey &secret_key) : X25519AuthenticationHandler(secret_key) {}
 
  RequestResult ReceiveRequest(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveRequest(p) ? RequestResult::ReadyForResponse : RequestResult::Invalid; }
  bool SendResponse(struct Packet &p) override { return this->X25519AuthenticationHandler::SendResponse(p, {}); }
 
  std::string_view GetName() const override { return "X25519-AuthorizedKey-client"; }
  NetworkAuthenticationMethod GetAuthenticationMethod() const override { return NetworkAuthenticationMethod::X25519_AuthorizedKey; }
 
  bool ReceiveEnableEncryption(struct Packet &p) override { return this->X25519AuthenticationHandler::ReceiveEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateServerToClientEncryptionHandler(); }
 
  static X25519SecretKey GetValidSecretKeyAndUpdatePublicKey(std::string &secret_key, std::string &public_key);
};

class X25519AuthorizedKeyServerHandler : protected X25519AuthenticationHandler, public NetworkAuthenticationServerHandler {
private:
  const NetworkAuthenticationAuthorizedKeyHandler *authorized_key_handler; 
public:
  X25519AuthorizedKeyServerHandler(const X25519SecretKey &secret_key, const NetworkAuthenticationAuthorizedKeyHandler *authorized_key_handler) : X25519AuthenticationHandler(secret_key), authorized_key_handler(authorized_key_handler) {}
 
  void SendRequest(struct Packet &p) override { this->X25519AuthenticationHandler::SendRequest(p); }
  ResponseResult ReceiveResponse(struct Packet &p) override;
 
  std::string_view GetName() const override { return "X25519-AuthorizedKey-server"; }
  NetworkAuthenticationMethod GetAuthenticationMethod() const override { return NetworkAuthenticationMethod::X25519_AuthorizedKey; }
  bool CanBeUsed() const override { return this->authorized_key_handler->CanBeUsed(); }
 
  std::string GetPeerPublicKey() const override { return this->X25519AuthenticationHandler::GetPeerPublicKey(); }
  void SendEnableEncryption(struct Packet &p) override { this->X25519AuthenticationHandler::SendEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->X25519AuthenticationHandler::CreateServerToClientEncryptionHandler(); }
};
 

class CombinedAuthenticationClientHandler : public NetworkAuthenticationClientHandler {
public:
  using Handler = std::unique_ptr<NetworkAuthenticationClientHandler>; 
 
private:
  std::vector<Handler> handlers; 
  NetworkAuthenticationClientHandler *current_handler = nullptr; 
 
public:
  void Add(Handler &&handler) { this->handlers.push_back(std::move(handler)); }
 
  RequestResult ReceiveRequest(struct Packet &p) override;
  bool SendResponse(struct Packet &p) override;
 
  std::string_view GetName() const override;
  NetworkAuthenticationMethod GetAuthenticationMethod() const override;
 
  bool ReceiveEnableEncryption(struct Packet &p) override { return this->current_handler->ReceiveEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->current_handler->CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->current_handler->CreateServerToClientEncryptionHandler(); }
};

class CombinedAuthenticationServerHandler : public NetworkAuthenticationServerHandler {
public:
  using Handler = std::unique_ptr<NetworkAuthenticationServerHandler>; 
 
private:
  std::vector<Handler> handlers; 
 
public:
  void Add(Handler &&handler);
 
  void SendRequest(struct Packet &p) override;
  ResponseResult ReceiveResponse(struct Packet &p) override;
 
  std::string_view GetName() const override;
  NetworkAuthenticationMethod GetAuthenticationMethod() const override;
  bool CanBeUsed() const override;
 
  std::string GetPeerPublicKey() const override { return this->handlers.back()->GetPeerPublicKey(); }
  void SendEnableEncryption(struct Packet &p) override { this->handlers.back()->SendEnableEncryption(p); }
  std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const override { return this->handlers.back()->CreateClientToServerEncryptionHandler(); }
  std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const override { return this->handlers.back()->CreateServerToClientEncryptionHandler(); }
};
 
#endif /* NETWORK_CRYPTO_INTERNAL_H */