Connections and transport

1001    std::copy(std::begin(m_cipher.GetOurPubKey()), std::end(m_cipher.GetOurPubKey()), MakeWritableByteSpan(m_send_buffer).begin());
1002    std::copy(m_send_garbage.begin(), m_send_garbage.end(), m_send_buffer.begin() + EllSwiftPubKey::size());
1003    // We cannot wipe m_send_garbage as it will still be used as AAD later in the handshake.
1004}
1005
1006V2Transport::V2Transport(NodeId nodeid, bool initiating, const CKey& key, std::span<const std::byte> ent32, std::vector<uint8_t> garbage) noexcept
1007    : m_cipher{key, ent32},
1008      m_initiating{initiating},
1009      m_nodeid{nodeid},
1010      m_v1_fallback{nodeid},
1011      m_recv_state{initiating ? RecvState::KEY : RecvState::KEY_MAYBE_V1},
1012      m_send_garbage{std::move(garbage)},
1013      m_send_state{initiating ? SendState::AWAITING_KEY : SendState::MAYBE_V1}
1014{
1015    Assume(m_send_garbage.size() <= MAX_GARBAGE_LEN);
1016    // Start sending immediately if we're the initiator of the connection.
1017    if (initiating) {
1018        LOCK(m_send_mutex);
1019        StartSendingHandshake();
1020    }
1021}
1022
1023V2Transport::V2Transport(NodeId nodeid, bool initiating) noexcept
1024    : V2Transport{nodeid, initiating, GenerateRandomKey(),
1025                  MakeByteSpan(GetRandHash()), GenerateRandomGarbage()} {}
1026
1027void V2Transport::SetReceiveState(RecvState recv_state) noexcept
1028{
1029    AssertLockHeld(m_recv_mutex);
1030    // Enforce allowed state transitions.
1031    switch (m_recv_state) {
1032    case RecvState::KEY_MAYBE_V1:
1033        Assume(recv_state == RecvState::KEY || recv_state == RecvState::V1);
1034        break;
1035    case RecvState::KEY:
1036        Assume(recv_state == RecvState::GARB_GARBTERM);
1037        break;
1038    case RecvState::GARB_GARBTERM:
1039        Assume(recv_state == RecvState::VERSION);
1040        break;
1041    case RecvState::VERSION:
1042        Assume(recv_state == RecvState::APP);
1043        break;
1044    case RecvState::APP:
1045        Assume(recv_state == RecvState::APP_READY);
1046        break;
1047    case RecvState::APP_READY:
1048        Assume(recv_state == RecvState::APP);
1049        break;
1050    case RecvState::V1:
1051        Assume(false); // V1 state cannot be left
1052        break;
1053    }
1054    // Change state.
1055    m_recv_state = recv_state;
1056}
1057
1058void V2Transport::SetSendState(SendState send_state) noexcept
1059{
1060    AssertLockHeld(m_send_mutex);
1061    // Enforce allowed state transitions.
1062    switch (m_send_state) {
1063    case SendState::MAYBE_V1:
1064        Assume(send_state == SendState::V1 || send_state == SendState::AWAITING_KEY);
1065        break;
1066    case SendState::AWAITING_KEY:
1067        Assume(send_state == SendState::READY);
1068        break;
1069    case SendState::READY:
1070    case SendState::V1:
1071        Assume(false); // Final states
1072        break;
1073    }
1074    // Change state.
1075    m_send_state = send_state;
1076}
1077
1078bool V2Transport::ReceivedMessageComplete() const noexcept
1079{
1080    AssertLockNotHeld(m_recv_mutex);
1081    LOCK(m_recv_mutex);
1082    if (m_recv_state == RecvState::V1) return m_v1_fallback.ReceivedMessageComplete();
1083
1084    return m_recv_state == RecvState::APP_READY;
1085}
1086
1087void V2Transport::ProcessReceivedMaybeV1Bytes() noexcept
1088{
1089    AssertLockHeld(m_recv_mutex);
1090    AssertLockNotHeld(m_send_mutex);
1091    Assume(m_recv_state == RecvState::KEY_MAYBE_V1);
1092    // We still have to determine if this is a v1 or v2 connection. The bytes being received could
1093    // be the beginning of either a v1 packet (network magic + "version\x00\x00\x00\x00\x00"), or
1094    // of a v2 public key. BIP324 specifies that a mismatch with this 16-byte string should trigger
1095    // sending of the key.
1096    std::array<uint8_t, V1_PREFIX_LEN> v1_prefix = {0, 0, 0, 0, 'v', 'e', 'r', 's', 'i', 'o', 'n', 0, 0, 0, 0, 0};
1097    std::copy(std::begin(Params().MessageStart()), std::end(Params().MessageStart()), v1_prefix.begin());
1098    Assume(m_recv_buffer.size() <= v1_prefix.size());
1099    if (!std::equal(m_recv_buffer.begin(), m_recv_buffer.end(), v1_prefix.begin())) {
1100        // Mismatch with v1 prefix, so we can assume a v2 connection.
1101        SetReceiveState(RecvState::KEY); // Convert to KEY state, leaving received bytes around.
1102        // Transition the sender to AWAITING_KEY state and start sending.
1103        LOCK(m_send_mutex);
1104        SetSendState(SendState::AWAITING_KEY);
1105        StartSendingHandshake();
1106    } else if (m_recv_buffer.size() == v1_prefix.size()) {
1107        // Full match with the v1 prefix, so fall back to v1 behavior.
1108        LOCK(m_send_mutex);
1109        std::span<const uint8_t> feedback{m_recv_buffer};
1110        // Feed already received bytes to v1 transport. It should always accept these, because it's
1111        // less than the size of a v1 header, and these are the first bytes fed to m_v1_fallback.
1112        bool ret = m_v1_fallback.ReceivedBytes(feedback);
1113        Assume(feedback.empty());
1114        Assume(ret);
1115        SetReceiveState(RecvState::V1);
1116        SetSendState(SendState::V1);
1117        // Reset v2 transport buffers to save memory.
1118        ClearShrink(m_recv_buffer);
1119        ClearShrink(m_send_buffer);
1120    } else {
1121        // We have not received enough to distinguish v1 from v2 yet. Wait until more bytes come.
1122    }
1123}
1124
1125bool V2Transport::ProcessReceivedKeyBytes() noexcept
1126{
1127    AssertLockHeld(m_recv_mutex);
1128    AssertLockNotHeld(m_send_mutex);
1129    Assume(m_recv_state == RecvState::KEY);
1130    Assume(m_recv_buffer.size() <= EllSwiftPubKey::size());
1131
1132    // As a special exception, if bytes 4-16 of the key on a responder connection match the
1133    // corresponding bytes of a V1 version message, but bytes 0-4 don't match the network magic
1134    // (if they did, we'd have switched to V1 state already), assume this is a peer from
1135    // another network, and disconnect them. They will almost certainly disconnect us too when
1136    // they receive our uniformly random key and garbage, but detecting this case specially
1137    // means we can log it.
1138    static constexpr std::array<uint8_t, 12> MATCH = {'v', 'e', 'r', 's', 'i', 'o', 'n', 0, 0, 0, 0, 0};
1139    static constexpr size_t OFFSET = std::tuple_size_v<MessageStartChars>;
1140    if (!m_initiating && m_recv_buffer.size() >= OFFSET + MATCH.size()) {
1141        if (std::equal(MATCH.begin(), MATCH.end(), m_recv_buffer.begin() + OFFSET)) {
1142            LogDebug(BCLog::NET, "V2 transport error: V1 peer with wrong MessageStart %s\n",
1143                     HexStr(std::span(m_recv_buffer).first(OFFSET)));
1144            return false;
1145        }
1146    }
1147
1148    if (m_recv_buffer.size() == EllSwiftPubKey::size()) {
1149        // Other side's key has been fully received, and can now be Diffie-Hellman combined with
1150        // our key to initialize the encryption ciphers.
1151
1152        // Initialize the ciphers.
1153        EllSwiftPubKey ellswift(MakeByteSpan(m_recv_buffer));
1154        LOCK(m_send_mutex);
1155        m_cipher.Initialize(ellswift, m_initiating);
1156
1157        // Switch receiver state to GARB_GARBTERM.
1158        SetReceiveState(RecvState::GARB_GARBTERM);
1159        m_recv_buffer.clear();
1160
1161        // Switch sender state to READY.
1162        SetSendState(SendState::READY);
1163
1164        // Append the garbage terminator to the send buffer.
1165        m_send_buffer.resize(m_send_buffer.size() + BIP324Cipher::GARBAGE_TERMINATOR_LEN);
1166        std::copy(m_cipher.GetSendGarbageTerminator().begin(),
1167                  m_cipher.GetSendGarbageTerminator().end(),
1168                  MakeWritableByteSpan(m_send_buffer).last(BIP324Cipher::GARBAGE_TERMINATOR_LEN).begin());
1169
1170        // Construct version packet in the send buffer, with the sent garbage data as AAD.
1171        m_send_buffer.resize(m_send_buffer.size() + BIP324Cipher::EXPANSION + VERSION_CONTENTS.size());
1172        m_cipher.Encrypt(
1173            /*contents=*/VERSION_CONTENTS,
1174            /*aad=*/MakeByteSpan(m_send_garbage),
1175            /*ignore=*/false,
1176            /*output=*/MakeWritableByteSpan(m_send_buffer).last(BIP324Cipher::EXPANSION + VERSION_CONTENTS.size()));
1177        // We no longer need the garbage.
1178        ClearShrink(m_send_garbage);
1179    } else {
1180        // We still have to receive more key bytes.
1181    }
1182    return true;
1183}
1184
1185bool V2Transport::ProcessReceivedGarbageBytes() noexcept
1186{
1187    AssertLockHeld(m_recv_mutex);
1188    Assume(m_recv_state == RecvState::GARB_GARBTERM);
1189    Assume(m_recv_buffer.size() <= MAX_GARBAGE_LEN + BIP324Cipher::GARBAGE_TERMINATOR_LEN);
1190    if (m_recv_buffer.size() >= BIP324Cipher::GARBAGE_TERMINATOR_LEN) {
1191        if (std::ranges::equal(MakeByteSpan(m_recv_buffer).last(BIP324Cipher::GARBAGE_TERMINATOR_LEN), m_cipher.GetReceiveGarbageTerminator())) {
1192            // Garbage terminator received. Store garbage to authenticate it as AAD later.
1193            m_recv_aad = std::move(m_recv_buffer);
1194            m_recv_aad.resize(m_recv_aad.size() - BIP324Cipher::GARBAGE_TERMINATOR_LEN);
1195            m_recv_buffer.clear();
1196            SetReceiveState(RecvState::VERSION);
1197        } else if (m_recv_buffer.size() == MAX_GARBAGE_LEN + BIP324Cipher::GARBAGE_TERMINATOR_LEN) {
1198            // We've reached the maximum length for garbage + garbage terminator, and the
1199            // terminator still does not match. Abort.
1200            LogDebug(BCLog::NET, "V2 transport error: missing garbage terminator, peer=%d\n", m_nodeid);
1201            return false;
1202        } else {
1203            // We still need to receive more garbage and/or garbage terminator bytes.
1204        }
1205    } else {
1206        // We have less than GARBAGE_TERMINATOR_LEN (16) bytes, so we certainly need to receive
1207        // more first.
1208    }
1209    return true;
1210}
1211
1212bool V2Transport::ProcessReceivedPacketBytes() noexcept
1213{
1214    AssertLockHeld(m_recv_mutex);
1215    Assume(m_recv_state == RecvState::VERSION || m_recv_state == RecvState::APP);
1216
1217    // The maximum permitted contents length for a packet, consisting of:
1218    // - 0x00 byte: indicating long message type encoding
1219    // - 12 bytes of message type
1220    // - payload
1221    static constexpr size_t MAX_CONTENTS_LEN =
1222        1 + CMessageHeader::MESSAGE_TYPE_SIZE +
1223        std::min<size_t>(MAX_SIZE, MAX_PROTOCOL_MESSAGE_LENGTH);
1224
1225    if (m_recv_buffer.size() == BIP324Cipher::LENGTH_LEN) {
1226        // Length descriptor received.
1227        m_recv_len = m_cipher.DecryptLength(MakeByteSpan(m_recv_buffer));
1228        if (m_recv_len > MAX_CONTENTS_LEN) {
1229            LogDebug(BCLog::NET, "V2 transport error: packet too large (%u bytes), peer=%d\n", m_recv_len, m_nodeid);
1230            return false;
1231        }
1232    } else if (m_recv_buffer.size() > BIP324Cipher::LENGTH_LEN && m_recv_buffer.size() == m_recv_len + BIP324Cipher::EXPANSION) {
1233        // Ciphertext received, decrypt it into m_recv_decode_buffer.
1234        // Note that it is impossible to reach this branch without hitting the branch above first,
1235        // as GetMaxBytesToProcess only allows up to LENGTH_LEN into the buffer before that point.
1236        m_recv_decode_buffer.resize(m_recv_len);
1237        bool ignore{false};
1238        bool ret = m_cipher.Decrypt(
1239            /*input=*/MakeByteSpan(m_recv_buffer).subspan(BIP324Cipher::LENGTH_LEN),
1240            /*aad=*/MakeByteSpan(m_recv_aad),
1241            /*ignore=*/ignore,
1242            /*contents=*/MakeWritableByteSpan(m_recv_decode_buffer));
1243        if (!ret) {
1244            LogDebug(BCLog::NET, "V2 transport error: packet decryption failure (%u bytes), peer=%d\n", m_recv_len, m_nodeid);
1245            return false;
1246        }
1247        // We have decrypted a valid packet with the AAD we expected, so clear the expected AAD.
1248        ClearShrink(m_recv_aad);
1249        // Feed the last 4 bytes of the Poly1305 authentication tag (and its timing) into our RNG.
1250        RandAddEvent(ReadLE32(m_recv_buffer.data() + m_recv_buffer.size() - 4));