actually authenticate messages with challenges and HMACs

.gitignore

@@ -1 +1,2 @@
 Justfile
+/test

README.md

@@ -5,5 +5,9 @@ A hub-and-spoke VPN for IPv6
 ## Features
 * **Post-quantum security:** Uses [XWingMLKEM768X25519](https://datatracker.ietf.org/doc/html/draft-connolly-cfrg-xwing-kem/) + [XChaCha20-Poly1305](https://en.wikipedia.org/wiki/ChaCha20-Poly1305#XChaCha20-Poly1305_%E2%80%93_extended_nonce_variant) + [HKDF-SHA-256](https://en.wikipedia.org/wiki/HKDF) for end-to-end encryption
 
+## Protocol
+
+See [proto.go](https://git.ton1.dev/toni/baalvpn/src/branch/main/shared/proto.go)
+
 ## Third-party dependencies
 * [`github.com/songgao/water`](https://github.com/songgao/water) - cross-platform wrapper around TUN interfaces

client/main.go

@@ -1,7 +1,9 @@
 package main
 
 import (
+	"crypto/hmac"
 	"crypto/hpke"
+	"crypto/sha256"
 	"encoding/binary"
 	"encoding/hex"
 	"log"
@@ -26,9 +28,11 @@ var (
 	iface        *water.Interface
 	conn         *net.UDPConn
 	serverAddr   *net.UDPAddr
-	internalIP   net.IP = nil
+	internalIP   net.IP
 	privKey      hpke.PrivateKey
 	multicastKey []byte
+	challengeCh  = make(chan []byte, 1)
+	authSecret   []byte
 
 	establishMutex    sync.Mutex
 	peerPubKeys       = shared.NewTMap[string, hpke.PublicKey]()
@@ -70,8 +74,23 @@ func register() {
 	}
 	pubKey := privKey.PublicKey()
 
-	// TODO: this probably should be repeated until we get RESP_REGISTER
+	// TODO: all this probably should be retried until we get RESP_REGISTER
-	send(shared.BuildPkt(shared.REQ_REGISTER, pubKey.Bytes()))
+
+	log.Println("requesting register challenge")
+	send(shared.BuildPkt(shared.REQ_GET_CHALLENGE, pubKey.Bytes()))
+
+	challenge := <-challengeCh
+	log.Println("got register challenge")
+
+	authSecret, err = hpke.Open(privKey, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte("baalvpn-challenge"), challenge)
+	if err != nil {
+		panic(err)
+	}
+
+	log.Println("registering")
+	mac := hmac.New(sha256.New, authSecret)
+	mac.Write(pubKey.Bytes())
+	send(shared.BuildPkt(shared.REQ_REGISTER, mac.Sum(nil), pubKey.Bytes()))
 }
 
 func receivePackets() {
@@ -116,11 +135,13 @@ func handleIncomingPkt(pkt []byte) {
 	pktType := binary.LittleEndian.Uint16(pkt[2:])
 
 	switch pktType {
+	case shared.RESP_GET_CHALLENGE:
+		challengeCh <- pkt[4:]
 	case shared.RESP_REGISTER:
 		internalIP = net.IP(pkt[4:20])
 
 		var err error
-		multicastKey, err = hpke.Open(privKey, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte("baalvpn"), pkt[20:])
+		multicastKey, err = hpke.Open(privKey, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte("baalvpn-register"), pkt[20:])
 		if err != nil {
 			panic(err)
 		}
@@ -129,11 +150,11 @@ func handleIncomingPkt(pkt []byte) {
 		setupInterface()
 		go relayPackets()
 	case shared.ENC_PKT:
-		srcIP := net.IP(pkt[20:36]).String()
+		srcIP := net.IP(pkt[52:68]).String()
 
 		sessionKey := getOrEstablishSessionKey(srcIP)
 
-		decryptedPkt, err := DecryptSym(sessionKey, pkt[36:])
+		decryptedPkt, err := DecryptSym(sessionKey, pkt[68:])
 		if err != nil {
 			panic(err)
 		}
@@ -143,7 +164,7 @@ func handleIncomingPkt(pkt []byte) {
 			log.Println(err)
 		}
 	case shared.BROADCAST_PKT:
-		decryptedPkt, err := DecryptSym(multicastKey, pkt[4:])
+		decryptedPkt, err := DecryptSym(multicastKey, pkt[36:])
 		if err != nil {
 			panic(err)
 		}
@@ -159,14 +180,14 @@ func handleIncomingPkt(pkt []byte) {
 		}
 		peerPubKeys.Set(respIP, pubKey)
 	case shared.REQ_ESTABLISH:
-		srcIP := net.IP(pkt[20:36]).String()
+		srcIP := net.IP(pkt[52:68]).String()
-		ciphertext := pkt[36:]
+		ciphertext := pkt[68:]
 
 		r, err := hpke.NewRecipient(ciphertext, privKey, hpke.HKDFSHA256(), hpke.ExportOnly(), nil)
 		if err != nil {
 			panic(err)
 		}
-		sessionKey, err := r.Export("baalvpn", 32)
+		sessionKey, err := r.Export("baalvpn-establish", 32)
 		if err != nil {
 			panic(err)
 		}
@@ -174,10 +195,9 @@ func handleIncomingPkt(pkt []byte) {
 		log.Println("received session key from", srcIP)
 		peerSessionKeys.Set(srcIP, sessionKey)
 
-		reqData := append(net.ParseIP(srcIP), internalIP...)
+		send(buildAuthPkt(shared.RESP_ESTABLISH, net.ParseIP(srcIP), internalIP))
-		send(shared.BuildPkt(shared.RESP_ESTABLISH, reqData))
 	case shared.RESP_ESTABLISH:
-		srcIP := net.IP(pkt[20:36]).String()
+		srcIP := net.IP(pkt[52:68]).String()
 		log.Println("established session key with", srcIP)
 		peerEstablishAcks.Set(srcIP, true)
 	default:
@@ -215,13 +235,12 @@ func getOrEstablishSessionKey(ip string) []byte {
 		if err != nil {
 			panic(err)
 		}
-		sessionKey, err := sender.Export("baalvpn", 32)
+		sessionKey, err := sender.Export("baalvpn-establish", 32)
 		if err != nil {
 			panic(err)
 		}
 
-		reqData := append(net.ParseIP(ip), append(internalIP, ciphertext...)...)
+		send(buildAuthPkt(shared.REQ_ESTABLISH, net.ParseIP(ip), internalIP, ciphertext))
-		send(shared.BuildPkt(shared.REQ_ESTABLISH, reqData))
 
 		for {
 			// TODO: eww
@@ -279,7 +298,7 @@ func relayPackets() {
 				panic(err)
 			}
 
-			send(shared.BuildPkt(shared.BROADCAST_PKT, encryptedPkt))
+			send(buildAuthPkt(shared.BROADCAST_PKT, encryptedPkt))
 		} else {
 			destSessionKey := getOrEstablishSessionKey(destIP)
 
@@ -288,12 +307,18 @@ func relayPackets() {
 				panic(err)
 			}
 
-			reqBody := append(net.ParseIP(destIP), append(internalIP, encryptedPkt...)...)
+			send(buildAuthPkt(shared.ENC_PKT, net.ParseIP(destIP), internalIP, encryptedPkt))
-			send(shared.BuildPkt(shared.ENC_PKT, reqBody))
 		}
 	}
 }
 
+func buildAuthPkt(pktType uint16, parts ...[]byte) []byte {
+	pkt := shared.BuildPkt(pktType, parts...)
+	mac := hmac.New(sha256.New, authSecret)
+	mac.Write(pkt[4:])
+	return append(pkt[:4], append(mac.Sum(nil), pkt[4:]...)...)
+}
+
 func send(req []byte) {
 	if _, err := conn.WriteToUDP(req, serverAddr); err != nil {
 		panic(err)

server/main.go

@@ -3,11 +3,14 @@
 // TODO: somehow persist IPs
 // TODO: key rotation
 // TODO: dont trust claimed IP at all
+// TODO: replay attacks are still a thing
 package main
 
 import (
+	"crypto/hmac"
 	"crypto/hpke"
 	"crypto/rand"
+	"crypto/sha256"
 	"encoding/binary"
 	"encoding/hex"
 	"log"
@@ -21,6 +24,7 @@ type Peer struct {
 	RealAddr     *net.UDPAddr
 	InternalIP   string
 	HexPublicKey string
+	AuthSecret   []byte
 }
 
 var (
@@ -29,6 +33,7 @@ var (
 	peersByPubKey       = shared.NewTMap[string, *Peer]()
 	conn                *net.UDPConn
 	multicastKey        = make([]byte, 32)
+	authSecretsByPubKey = shared.NewTMap[string, []byte]()
 )
 
 func main() {
@@ -93,7 +98,7 @@ func handleReq(req []byte, addr *net.UDPAddr) {
 	pktType := binary.LittleEndian.Uint16(req[2:])
 
 	switch pktType {
-	case shared.REQ_REGISTER:
+	case shared.REQ_GET_CHALLENGE:
 		pubKey, err := hpke.MLKEM768X25519().NewPublicKey(req[4:])
 		if err != nil {
 			log.Println("invalid pubkey")
@@ -102,10 +107,48 @@ func handleReq(req []byte, addr *net.UDPAddr) {
 
 		hexPubKey := hex.EncodeToString(pubKey.Bytes())
 
+		authSecret := make([]byte, 32)
+		if _, err = rand.Read(authSecret); err != nil {
+			panic(err)
+		}
+
+		authSecretsByPubKey.Set(hexPubKey, authSecret)
+
+		ciphertext, err := hpke.Seal(pubKey, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte("baalvpn-challenge"), authSecret)
+		if err != nil {
+			panic(err)
+		}
+
+		sendTo(addr, shared.BuildPkt(shared.RESP_GET_CHALLENGE, ciphertext))
+	case shared.REQ_REGISTER:
+		auth := req[4:36]
+
+		pubKey, err := hpke.MLKEM768X25519().NewPublicKey(req[36:])
+		if err != nil {
+			log.Println("invalid pubkey")
+			return
+		}
+
+		hexPubKey := hex.EncodeToString(pubKey.Bytes())
+
+		authSecret, ok := authSecretsByPubKey.GetOK(hexPubKey)
+		if !ok {
+			log.Println("unknown pubkey tried to REGISTER")
+			return
+		}
+		defer authSecretsByPubKey.Delete(hexPubKey)
+
+		mac := hmac.New(sha256.New, authSecret)
+		mac.Write(pubKey.Bytes())
+		if !hmac.Equal(mac.Sum(nil), auth) {
+			log.Println("failed to authenticate REGISTER")
+			return
+		}
+
 		var internalIP string
-		// TODO: authenticating only by PUBLIC key is obviously a bad idea
 		if peer, ok := peersByPubKey.GetOK(hexPubKey); ok {
 			internalIP = peer.InternalIP
+			peer.AuthSecret = authSecret
 			peers.Delete(peer.RealAddr.String())
 			peer.RealAddr = addr
 			peers.Set(addr.String(), peer)
@@ -115,28 +158,35 @@ func handleReq(req []byte, addr *net.UDPAddr) {
 				RealAddr:     addr,
 				InternalIP:   internalIP,
 				HexPublicKey: hexPubKey,
+				AuthSecret:   authSecret,
 			}
 			peers.Set(addr.String(), peer)
 			peersByInternal.Set(internalIP, peer)
 			peersByPubKey.Set(hexPubKey, peer)
 		}
 
-		ciphertext, err := hpke.Seal(pubKey, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte("baalvpn"), multicastKey)
+		ciphertext, err := hpke.Seal(pubKey, hpke.HKDFSHA256(), hpke.ChaCha20Poly1305(), []byte("baalvpn-register"), multicastKey)
 		if err != nil {
 			panic(err)
 		}
 
-		resp := shared.BuildPkt(shared.RESP_REGISTER, append(net.ParseIP(internalIP), ciphertext...))
+		sendTo(addr, shared.BuildPkt(shared.RESP_REGISTER, net.ParseIP(internalIP), ciphertext))
-		sendTo(addr, resp)
 	case shared.ENC_PKT:
 		peer := peers.Get(addr.String())
 		if peer == nil {
-			log.Println("data from unregistered peer:", addr.String())
+			log.Println("ENC_PKT from unregistered peer:", addr.String())
 			return
 		}
 
-		destIP := net.IP(req[4:20]).String()
+		mac := hmac.New(sha256.New, peer.AuthSecret)
-		srcIP := net.IP(req[20:36]).String()
+		mac.Write(req[36:])
+		if !hmac.Equal(mac.Sum(nil), req[4:36]) {
+			log.Println("failed to authenticate ENC_PKT")
+			return
+		}
+
+		destIP := net.IP(req[36:52]).String()
+		srcIP := net.IP(req[52:68]).String()
 		if srcIP != peer.InternalIP {
 			log.Println("rejected spoofed srcIP in ENC_PKT")
 			return
@@ -151,7 +201,14 @@ func handleReq(req []byte, addr *net.UDPAddr) {
 	case shared.BROADCAST_PKT:
 		peer := peers.Get(addr.String())
 		if peer == nil {
-			log.Println("data from unregistered peer:", addr.String())
+			log.Println("BROADCAST_PKT from unregistered peer:", addr.String())
+			return
+		}
+
+		mac := hmac.New(sha256.New, peer.AuthSecret)
+		mac.Write(req[36:])
+		if !hmac.Equal(mac.Sum(nil), req[4:36]) {
+			log.Println("failed to authenticate BROADCAST_PKT")
 			return
 		}
 
@@ -165,23 +222,29 @@ func handleReq(req []byte, addr *net.UDPAddr) {
 			if err != nil {
 				panic(err)
 			}
-			resp := shared.BuildPkt(shared.RESP_GET_PUBKEY, append(net.ParseIP(peerIP), pubKey...))
+			sendTo(addr, shared.BuildPkt(shared.RESP_GET_PUBKEY, net.ParseIP(peerIP), pubKey))
-			sendTo(addr, resp)
 		}
 	case shared.REQ_ESTABLISH, shared.RESP_ESTABLISH:
 		peer := peers.Get(addr.String())
 		if peer == nil {
-			log.Println("unregistered peer tried to ESTABLISH")
+			log.Println("ESTABLISH from unregistered peer:", addr.String())
 			return
 		}
 
-		srcIP := net.IP(req[20:36]).String()
+		mac := hmac.New(sha256.New, peer.AuthSecret)
+		mac.Write(req[36:])
+		if !hmac.Equal(mac.Sum(nil), req[4:36]) {
+			log.Println("failed to authenticate ESTABLISH")
+			return
+		}
+
+		srcIP := net.IP(req[52:68]).String()
 		if srcIP != peer.InternalIP {
 			log.Println("rejected spoofed srcIP in ESTABLISH")
 			return
 		}
 
-		dstIP := net.IP(req[4:20]).String()
+		dstIP := net.IP(req[36:52]).String()
 		dstPeer := peersByInternal.Get(dstIP)
 		if dstPeer == nil {
 			log.Println("tried to ESTABLISH with an unknown peer")

shared/proto.go

@@ -4,38 +4,58 @@ import "encoding/binary"
 
 const PROTO_VERSION uint16 = 1
 
+// pubKey - public key generated by the client
+// privKey - private key generated by the client
+// sessionKey - key established between two peers
+// multicastKey - key shared between everyone for encrypting multicast pkts
+// authSecret - secret given during registration for authenticating subsequent requests
+
 const (
 	_ uint16 = iota
+	// (client -> server) requests a challenge to prove the ownership of the privKey
+	// [ pubKey - 1216 bytes ]
+	REQ_GET_CHALLENGE
+	// (server -> client) provides a pubKey-encrypted authSecret
+	// [ ciphertext - 1168 bytes ]
+	RESP_GET_CHALLENGE
 	// (client -> server) requests an IP
-	// [ pubkey - 1216 bytes ]
+	// [ HMAC(authSecret, pubKey) - 32 bytes ] [ pubKey - 1216 bytes ]
 	REQ_REGISTER
-	// (server -> client) returns the assigned IP and encapsulated multicast key
+	// (server -> client) returns the assigned IP and pubKey-encrypted multicastKey
 	// [ ip - 16 bytes ] [ ciphertext - 1168 bytes ]
 	RESP_REGISTER
 	// (client -> server -> client2) relays an encrypted packet to a specified peer
-	// [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ encrypted pkt ]
+	// [ HMAC(authSecret, rest) - 32 bytes ] [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ encryptedPkt ]
 	ENC_PKT
 	// (client -> server -> *) broadcasts an encrypted packet
-	// [ encrypted pkt ]
+	// [ HMAC(authSecret, rest) - 32 bytes ] [ encryptedPkt ]
 	BROADCAST_PKT
-	// (client -> server) requests peer's pubkey from the server for encapsulation
+	// (client -> server) requests peer's pubKey from the server for encapsulation
 	// [ ip - 16 bytes ]
 	REQ_GET_PUBKEY
-	// (server -> client) provides requested pubkey
+	// (server -> client) provides requested pubKey
-	// [ ip - 16 bytes ] [ pubkey - 1216 bytes ]
+	// [ ip - 16 bytes ] [ pubKey - 1216 bytes ]
 	RESP_GET_PUBKEY
-	// (client -> server -> client2) establishes a session key with another peer
+	// (client -> server -> client2) establishes a sessionKey with another peer
-	// [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ ciphertext - 1120 bytes ]
+	// [ HMAC(authSecret, rest) - 32 bytes ] [ destIP - 16 bytes ] [ srcIP - 16 bytes ] [ ciphertext - 1120 bytes ]
 	REQ_ESTABLISH
-	// (client2 -> server -> client) acknowledges the session key was established
+	// (client2 -> server -> client) acknowledges the sessionKey was established
-	// [ destIP - 16 bytes ] [ srcIP - 16 bytes ]
+	// [ HMAC(authSecret, rest) - 32 bytes ] [ destIP - 16 bytes ] [ srcIP - 16 bytes ]
 	RESP_ESTABLISH
 )
 
-func BuildPkt(pktType uint16, data []byte) []byte {
+func BuildPkt(pktType uint16, parts ...[]byte) []byte {
-	out := make([]byte, 4+len(data))
+	var total int
+	for _, p := range parts {
+		total += len(p)
+	}
+
+	out := make([]byte, 4, 4+total)
 	binary.LittleEndian.PutUint16(out[0:], PROTO_VERSION)
 	binary.LittleEndian.PutUint16(out[2:], pktType)
-	copy(out[4:], data)
+
+	for _, p := range parts {
+		out = append(out, p...)
+	}
 	return out
 }