toni/baalvpn
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

actually authenticate messages with challenges and HMACs

Browse Source
This commit is contained in:
Antoni Piasecki
2026-07-23 12:39:19 +02:00
parent 4d710fb72b
commit 3f11053834
5 changed files with 165 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
shared/proto.go
View File

@@ -4,38 +4,58 @@ import "encoding/binary"
const PROTO_VERSION uint16 = 1
// pubKey - public key generated by the client
// privKey - private key generated by the client
// sessionKey - key established between two peers
// multicastKey - key shared between everyone for encrypting multicast pkts
// authSecret - secret given during registration for authenticating subsequent requests
const (
_ uint16 = iota
// (client -> server) requests a challenge to prove the ownership of the privKey
// [ pubKey - 1216 bytes ]
REQ_GET_CHALLENGE
// (server -> client) provides a pubKey-encrypted authSecret
// [ ciphertext - 1168 bytes ]
RESP_GET_CHALLENGE
// (client -> server) requests an IP
// [ pubkey - 1216 bytes ]
// [ HMAC(authSecret, pubKey) - 32 bytes ] [ pubKey - 1216 bytes ]
REQ_REGISTER
// (server -> client) returns the assigned IP and encapsulated multicast key
// (server -> client) returns the assigned IP and pubKey-encrypted multicastKey
// [ ip - 16 bytes ] [ ciphertext - 1168 bytes ]
RESP_REGISTER
// (client -> server -> client2) relays an encrypted packet to a specified peer
// [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ encrypted pkt ]
// [ HMAC(authSecret, rest) - 32 bytes ] [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ encryptedPkt ]
ENC_PKT
// (client -> server -> *) broadcasts an encrypted packet
// [ encrypted pkt ]
// [ HMAC(authSecret, rest) - 32 bytes ] [ encryptedPkt ]
BROADCAST_PKT
// (client -> server) requests peer's pubkey from the server for encapsulation
// (client -> server) requests peer's pubKey from the server for encapsulation
// [ ip - 16 bytes ]
REQ_GET_PUBKEY
// (server -> client) provides requested pubkey
// [ ip - 16 bytes ] [ pubkey - 1216 bytes ]
// (server -> client) provides requested pubKey
// [ ip - 16 bytes ] [ pubKey - 1216 bytes ]
RESP_GET_PUBKEY
// (client -> server -> client2) establishes a session key with another peer
// [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ ciphertext - 1120 bytes ]
// (client -> server -> client2) establishes a sessionKey with another peer
// [ HMAC(authSecret, rest) - 32 bytes ] [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ ciphertext - 1120 bytes ]
REQ_ESTABLISH
// (client2 -> server -> client) acknowledges the session key was established
// [ destIP - 16 bytes ] [ srcIP - 16 bytes ]
// (client2 -> server -> client) acknowledges the sessionKey was established
// [ HMAC(authSecret, rest) - 32 bytes ] [ destIP - 16 bytes ] [ srcIP - 16 bytes ]
RESP_ESTABLISH
)
func BuildPkt(pktType uint16, data []byte) []byte {
out := make([]byte, 4+len(data))
func BuildPkt(pktType uint16, parts ...[]byte) []byte {
var total int
for _, p := range parts {
total += len(p)
}
out := make([]byte, 4, 4+total)
binary.LittleEndian.PutUint16(out[0:], PROTO_VERSION)
binary.LittleEndian.PutUint16(out[2:], pktType)
copy(out[4:], data)
for _, p := range parts {
out = append(out, p...)
}
return out
}