OpenTTD Source: src/network/network_crypto.h Source File

OpenTTD Source 15.3

network_crypto.h
Go to the documentation of this file.
1/*
2 * This file is part of OpenTTD.
3 * OpenTTD is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, version 2.
4 * OpenTTD is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
5 * See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with OpenTTD. If not, see <https://www.gnu.org/licenses/old-licenses/gpl-2.0>.
6 */
7
33#ifndef NETWORK_CRYPTO_H
34#define NETWORK_CRYPTO_H
35
36#include "network_type.h"
37
41 class NetworkEncryptionHandler {
42public:
43 virtual ~NetworkEncryptionHandler() = default;
44
49 virtual size_t MACSize() const = 0;
50
57 virtual bool Decrypt(std::span<std::uint8_t> mac, std::span<std::uint8_t> message) = 0;
58
64 virtual void Encrypt(std::span<std::uint8_t> mac, std::span<std::uint8_t> message) = 0;
65};
66
67
71 class NetworkAuthenticationPasswordRequest {
72public:
73 virtual ~NetworkAuthenticationPasswordRequest() = default;
74
78 virtual void Reply(const std::string &password) = 0;
79};
80
84 class NetworkAuthenticationPasswordRequestHandler : public NetworkAuthenticationPasswordRequest {
85protected:
86 friend class X25519PAKEClientHandler;
87
88 std::string password;
89public:
90
91 virtual void Reply(const std::string &password) override;
92
96 virtual void SendResponse() = 0;
97
102 virtual void AskUserForPassword(std::shared_ptr<NetworkAuthenticationPasswordRequest> request) = 0;
103};
104
105
109 class NetworkAuthenticationPasswordProvider {
110public:
111 virtual ~NetworkAuthenticationPasswordProvider() = default;
112
117 virtual std::string_view GetPassword() const = 0;
118};
119
123 class NetworkAuthenticationDefaultPasswordProvider : public NetworkAuthenticationPasswordProvider {
124private:
125 const std::string *password;
126public:
132 NetworkAuthenticationDefaultPasswordProvider(const std::string &password) : password(&password) {}
133
134 std::string_view GetPassword() const override { return *this->password; };
135};
136
140 class NetworkAuthenticationAuthorizedKeyHandler {
141public:
142 virtual ~NetworkAuthenticationAuthorizedKeyHandler() = default;
143
148 virtual bool CanBeUsed() const = 0;
149
155 virtual bool IsAllowed(std::string_view peer_public_key) const = 0;
156};
157
161 class NetworkAuthenticationDefaultAuthorizedKeyHandler : public NetworkAuthenticationAuthorizedKeyHandler {
162private:
163 const NetworkAuthorizedKeys *authorized_keys;
164public:
169 NetworkAuthenticationDefaultAuthorizedKeyHandler(const NetworkAuthorizedKeys &authorized_keys) : authorized_keys(&authorized_keys) {}
170
171 bool CanBeUsed() const override { return !this->authorized_keys->empty(); }
172 bool IsAllowed(std::string_view peer_public_key) const override { return authorized_keys->Contains(peer_public_key); }
173};
174
175
177 enum class NetworkAuthenticationMethod : uint8_t {
178 X25519_KeyExchangeOnly,
179 X25519_PAKE,
180 X25519_AuthorizedKey,
181 End,
182};
183
185 using NetworkAuthenticationMethodMask = EnumBitSet<NetworkAuthenticationMethod, uint16_t>;
186
190 class NetworkAuthenticationHandler {
191public:
192 virtual ~NetworkAuthenticationHandler() = default;
193
198 virtual std::string_view GetName() const = 0;
199
204 virtual NetworkAuthenticationMethod GetAuthenticationMethod() const = 0;
205
210 virtual std::unique_ptr<NetworkEncryptionHandler> CreateClientToServerEncryptionHandler() const = 0;
211
216 virtual std::unique_ptr<NetworkEncryptionHandler> CreateServerToClientEncryptionHandler() const = 0;
217};
218
222 class NetworkAuthenticationClientHandler : public NetworkAuthenticationHandler {
223public:
225 enum class RequestResult : uint8_t {
226 AwaitUserInput,
227 ReadyForResponse,
228 Invalid,
229 };
230
236 virtual RequestResult ReceiveRequest(struct Packet &p) = 0;
237
243 virtual bool SendResponse(struct Packet &p) = 0;
244
249 virtual bool ReceiveEnableEncryption(struct Packet &p) = 0;
250
251 static void EnsureValidSecretKeyAndUpdatePublicKey(std::string &secret_key, std::string &public_key);
252 static std::unique_ptr<NetworkAuthenticationClientHandler> Create(std::shared_ptr<NetworkAuthenticationPasswordRequestHandler> password_handler, std::string &secret_key, std::string &public_key);
253};
254
258 class NetworkAuthenticationServerHandler : public NetworkAuthenticationHandler {
259public:
261 enum class ResponseResult : uint8_t {
262 Authenticated,
263 NotAuthenticated,
264 RetryNextMethod,
265 };
266
271 virtual void SendRequest(struct Packet &p) = 0;
272
278 virtual ResponseResult ReceiveResponse(struct Packet &p) = 0;
279
284 virtual void SendEnableEncryption(struct Packet &p) = 0;
285
291 virtual bool CanBeUsed() const = 0;
292
297 virtual std::string GetPeerPublicKey() const = 0;
298
299 static std::unique_ptr<NetworkAuthenticationServerHandler> Create(const NetworkAuthenticationPasswordProvider *password_provider, const NetworkAuthenticationAuthorizedKeyHandler *authorized_key_handler, NetworkAuthenticationMethodMask client_supported_method_mask = {NetworkAuthenticationMethod::X25519_KeyExchangeOnly, NetworkAuthenticationMethod::X25519_PAKE, NetworkAuthenticationMethod::X25519_AuthorizedKey});
300};
301
302#endif /* NETWORK_CRYPTO_H */
EnumBitSet
Enum-as-bit-set wrapper.
Definition enum_type.hpp:177
NetworkAuthenticationAuthorizedKeyHandler
Callback interface for server implementations to provide the authorized key validation.
Definition network_crypto.h:140
NetworkAuthenticationAuthorizedKeyHandler::IsAllowed
virtual bool IsAllowed(std::string_view peer_public_key) const =0
Check whether the given public key of the peer is allowed in.
NetworkAuthenticationAuthorizedKeyHandler::CanBeUsed
virtual bool CanBeUsed() const =0
Check whether the key handler can be used, i.e.
NetworkAuthenticationClientHandler
Base class for client side cryptographic authentication handlers.
Definition network_crypto.h:222
NetworkAuthenticationClientHandler::RequestResult
RequestResult
The processing result of receiving a request.
Definition network_crypto.h:225
NetworkAuthenticationClientHandler::RequestResult::AwaitUserInput
@ AwaitUserInput
We have requested some user input, but must wait on that.
NetworkAuthenticationClientHandler::RequestResult::Invalid
@ Invalid
We have received an invalid request.
NetworkAuthenticationClientHandler::RequestResult::ReadyForResponse
@ ReadyForResponse
We do not have to wait for user input, and can immediately respond to the server.
NetworkAuthenticationClientHandler::ReceiveEnableEncryption
virtual bool ReceiveEnableEncryption(struct Packet &p)=0
Read the request to enable encryption from the server.
NetworkAuthenticationClientHandler::EnsureValidSecretKeyAndUpdatePublicKey
static void EnsureValidSecretKeyAndUpdatePublicKey(std::string &secret_key, std::string &public_key)
Ensures that the given secret key is valid, and when not overwrite it with a valid secret key.
Definition network_crypto.cpp:451
NetworkAuthenticationClientHandler::ReceiveRequest
virtual RequestResult ReceiveRequest(struct Packet &p)=0
Read a request from the server.
NetworkAuthenticationClientHandler::SendResponse
virtual bool SendResponse(struct Packet &p)=0
Create the response to send to the server.
NetworkAuthenticationClientHandler::Create
static std::unique_ptr< NetworkAuthenticationClientHandler > Create(std::shared_ptr< NetworkAuthenticationPasswordRequestHandler > password_handler, std::string &secret_key, std::string &public_key)
Create a NetworkAuthenticationClientHandler.
Definition network_crypto.cpp:462
NetworkAuthenticationDefaultAuthorizedKeyHandler
Default implementation for the authorized key handler.
Definition network_crypto.h:161
NetworkAuthenticationDefaultAuthorizedKeyHandler::CanBeUsed
bool CanBeUsed() const override
Check whether the key handler can be used, i.e.
Definition network_crypto.h:171
NetworkAuthenticationDefaultAuthorizedKeyHandler::NetworkAuthenticationDefaultAuthorizedKeyHandler
NetworkAuthenticationDefaultAuthorizedKeyHandler(const NetworkAuthorizedKeys &authorized_keys)
Create the handler that uses the given authorized keys to check against.
Definition network_crypto.h:169
NetworkAuthenticationDefaultAuthorizedKeyHandler::authorized_keys
const NetworkAuthorizedKeys * authorized_keys
The authorized keys to check against.
Definition network_crypto.h:163
NetworkAuthenticationDefaultAuthorizedKeyHandler::IsAllowed
bool IsAllowed(std::string_view peer_public_key) const override
Check whether the given public key of the peer is allowed in.
Definition network_crypto.h:172
NetworkAuthenticationDefaultPasswordProvider
Default implementation of the password provider.
Definition network_crypto.h:123
NetworkAuthenticationDefaultPasswordProvider::password
const std::string * password
The password to check against.
Definition network_crypto.h:125
NetworkAuthenticationDefaultPasswordProvider::NetworkAuthenticationDefaultPasswordProvider
NetworkAuthenticationDefaultPasswordProvider(const std::string &password)
Create the provider with the pointer to the password that is to be used.
Definition network_crypto.h:132
NetworkAuthenticationDefaultPasswordProvider::GetPassword
std::string_view GetPassword() const override
Callback to return the password where to validate against.
Definition network_crypto.h:134
NetworkAuthenticationHandler
Base class for cryptographic authentication handlers.
Definition network_crypto.h:190
NetworkAuthenticationHandler::GetName
virtual std::string_view GetName() const =0
Get the name of the handler for debug messages.
NetworkAuthenticationHandler::CreateServerToClientEncryptionHandler
virtual std::unique_ptr< NetworkEncryptionHandler > CreateServerToClientEncryptionHandler() const =0
Create a NetworkEncryptionHandler to encrypt or decrypt messages from the server to the client.
NetworkAuthenticationHandler::GetAuthenticationMethod
virtual NetworkAuthenticationMethod GetAuthenticationMethod() const =0
Get the method this handler is providing functionality for.
NetworkAuthenticationHandler::CreateClientToServerEncryptionHandler
virtual std::unique_ptr< NetworkEncryptionHandler > CreateClientToServerEncryptionHandler() const =0
Create a NetworkEncryptionHandler to encrypt or decrypt messages from the client to the server.
NetworkAuthenticationPasswordProvider
Callback interface for server implementations to provide the current password.
Definition network_crypto.h:109
NetworkAuthenticationPasswordProvider::GetPassword
virtual std::string_view GetPassword() const =0
Callback to return the password where to validate against.
NetworkAuthenticationPasswordRequestHandler
Callback interface for client implementations to provide the handling of the password requests.
Definition network_crypto.h:84
NetworkAuthenticationPasswordRequestHandler::AskUserForPassword
virtual void AskUserForPassword(std::shared_ptr< NetworkAuthenticationPasswordRequest > request)=0
Callback to trigger asking the user for the password.
NetworkAuthenticationPasswordRequestHandler::SendResponse
virtual void SendResponse()=0
Callback to trigger sending the response for the password request.
NetworkAuthenticationPasswordRequestHandler::Reply
virtual void Reply(const std::string &password) override
Reply to the request with the given password.
Definition network_crypto.cpp:440
NetworkAuthenticationPasswordRequestHandler::password
std::string password
The entered password.
Definition network_crypto.h:88
NetworkAuthenticationPasswordRequest
Callback interface for requests for passwords in the context of network authentication.
Definition network_crypto.h:71
NetworkAuthenticationPasswordRequest::Reply
virtual void Reply(const std::string &password)=0
Reply to the request with the given password.
NetworkAuthenticationServerHandler
Base class for server side cryptographic authentication handlers.
Definition network_crypto.h:258
NetworkAuthenticationServerHandler::ReceiveResponse
virtual ResponseResult ReceiveResponse(struct Packet &p)=0
Read the response from the client.
NetworkAuthenticationServerHandler::SendEnableEncryption
virtual void SendEnableEncryption(struct Packet &p)=0
Create the request to enable encryption to the client.
NetworkAuthenticationServerHandler::CanBeUsed
virtual bool CanBeUsed() const =0
Checks whether this handler can be used with the current configuration.
NetworkAuthenticationServerHandler::GetPeerPublicKey
virtual std::string GetPeerPublicKey() const =0
Get the public key the peer provided during the authentication.
NetworkAuthenticationServerHandler::SendRequest
virtual void SendRequest(struct Packet &p)=0
Create the request to send to the client.
NetworkAuthenticationServerHandler::Create
static std::unique_ptr< NetworkAuthenticationServerHandler > Create(const NetworkAuthenticationPasswordProvider *password_provider, const NetworkAuthenticationAuthorizedKeyHandler *authorized_key_handler, NetworkAuthenticationMethodMask client_supported_method_mask={NetworkAuthenticationMethod::X25519_KeyExchangeOnly, NetworkAuthenticationMethod::X25519_PAKE, NetworkAuthenticationMethod::X25519_AuthorizedKey})
Create a NetworkAuthenticationServerHandler.
Definition network_crypto.cpp:478
NetworkAuthenticationServerHandler::ResponseResult
ResponseResult
The processing result of receiving a response.
Definition network_crypto.h:261
NetworkAuthenticationServerHandler::ResponseResult::RetryNextMethod
@ RetryNextMethod
The client failed to authenticate, but there is another method to try.
NetworkAuthenticationServerHandler::ResponseResult::NotAuthenticated
@ NotAuthenticated
All authentications for this handler have been exhausted.
NetworkAuthenticationServerHandler::ResponseResult::Authenticated
@ Authenticated
The client was authenticated successfully.
NetworkAuthorizedKeys
Simple helper to (more easily) manage authorized keys.
Definition network_type.h:137
NetworkAuthorizedKeys::Contains
bool Contains(std::string_view key) const
Check whether the given key is contains in these authorized keys.
Definition network.cpp:180
NetworkEncryptionHandler
Base class for handling the encryption (or decryption) of a network connection.
Definition network_crypto.h:41
NetworkEncryptionHandler::Decrypt
virtual bool Decrypt(std::span< std::uint8_t > mac, std::span< std::uint8_t > message)=0
Decrypt the given message in-place, validating against the given MAC.
NetworkEncryptionHandler::Encrypt
virtual void Encrypt(std::span< std::uint8_t > mac, std::span< std::uint8_t > message)=0
Encrypt the given message in-place, and write the associated MAC.
NetworkEncryptionHandler::MACSize
virtual size_t MACSize() const =0
Get the size of the MAC (Message Authentication Code) used by the underlying encryption protocol.
X25519PAKEClientHandler
Client side handler for using X25519 with a password-authenticated key exchange.
Definition network_crypto_internal.h:185
NetworkAuthenticationMethod
NetworkAuthenticationMethod
The authentication method that can be used.
Definition network_crypto.h:177
NetworkAuthenticationMethod::X25519_KeyExchangeOnly
@ X25519_KeyExchangeOnly
No actual authentication is taking place, just perform a x25519 key exchange. This method is not supp...
NetworkAuthenticationMethod::X25519_PAKE
@ X25519_PAKE
Authentication using x25519 password-authenticated key agreement.
NetworkAuthenticationMethod::End
@ End
Must ALWAYS be on the end of this list!! (period)
NetworkAuthenticationMethod::X25519_AuthorizedKey
@ X25519_AuthorizedKey
Authentication using x22519 key exchange and authorized keys.
network_type.h
Types used for networking.
Packet
Internal entity of a packet.
Definition packet.h:43