Connections and transport

1251
1252        // At this point we have a valid packet decrypted into m_recv_decode_buffer. If it's not a
1253        // decoy, which we simply ignore, use the current state to decide what to do with it.
1254        if (!ignore) {
1255            switch (m_recv_state) {
1256            case RecvState::VERSION:
1257                // Version message received; transition to application phase. The contents is
1258                // ignored, but can be used for future extensions.
1259                SetReceiveState(RecvState::APP);
1260                break;
1261            case RecvState::APP:
1262                // Application message decrypted correctly. It can be extracted using GetMessage().
1263                SetReceiveState(RecvState::APP_READY);
1264                break;
1265            default:
1266                // Any other state is invalid (this function should not have been called).
1267                Assume(false);
1268            }
1269        }
1270        // Wipe the receive buffer where the next packet will be received into.
1271        ClearShrink(m_recv_buffer);
1272        // In all but APP_READY state, we can wipe the decoded contents.
1273        if (m_recv_state != RecvState::APP_READY) ClearShrink(m_recv_decode_buffer);
1274    } else {
1275        // We either have less than 3 bytes, so we don't know the packet's length yet, or more
1276        // than 3 bytes but less than the packet's full ciphertext. Wait until those arrive.
1277    }
1278    return true;
1279}
1280
1281size_t V2Transport::GetMaxBytesToProcess() noexcept
1282{
1283    AssertLockHeld(m_recv_mutex);
1284    switch (m_recv_state) {
1285    case RecvState::KEY_MAYBE_V1:
1286        // During the KEY_MAYBE_V1 state we do not allow more than the length of v1 prefix into the
1287        // receive buffer.
1288        Assume(m_recv_buffer.size() <= V1_PREFIX_LEN);
1289        // As long as we're not sure if this is a v1 or v2 connection, don't receive more than what
1290        // is strictly necessary to distinguish the two (16 bytes). If we permitted more than
1291        // the v1 header size (24 bytes), we may not be able to feed the already-received bytes
1292        // back into the m_v1_fallback V1 transport.
1293        return V1_PREFIX_LEN - m_recv_buffer.size();
1294    case RecvState::KEY:
1295        // During the KEY state, we only allow the 64-byte key into the receive buffer.
1296        Assume(m_recv_buffer.size() <= EllSwiftPubKey::size());
1297        // As long as we have not received the other side's public key, don't receive more than
1298        // that (64 bytes), as garbage follows, and locating the garbage terminator requires the
1299        // key exchange first.
1300        return EllSwiftPubKey::size() - m_recv_buffer.size();
1301    case RecvState::GARB_GARBTERM:
1302        // Process garbage bytes one by one (because terminator may appear anywhere).
1303        return 1;
1304    case RecvState::VERSION:
1305    case RecvState::APP:
1306        // These three states all involve decoding a packet. Process the length descriptor first,
1307        // so that we know where the current packet ends (and we don't process bytes from the next
1308        // packet or decoy yet). Then, process the ciphertext bytes of the current packet.
1309        if (m_recv_buffer.size() < BIP324Cipher::LENGTH_LEN) {
1310            return BIP324Cipher::LENGTH_LEN - m_recv_buffer.size();
1311        } else {
1312            // Note that BIP324Cipher::EXPANSION is the total difference between contents size
1313            // and encoded packet size, which includes the 3 bytes due to the packet length.
1314            // When transitioning from receiving the packet length to receiving its ciphertext,
1315            // the encrypted packet length is left in the receive buffer.
1316            return BIP324Cipher::EXPANSION + m_recv_len - m_recv_buffer.size();
1317        }
1318    case RecvState::APP_READY:
1319        // No bytes can be processed until GetMessage() is called.
1320        return 0;
1321    case RecvState::V1:
1322        // Not allowed (must be dealt with by the caller).
1323        Assume(false);
1324        return 0;
1325    }
1326    Assume(false); // unreachable
1327    return 0;
1328}
1329
1330bool V2Transport::ReceivedBytes(std::span<const uint8_t>& msg_bytes) noexcept
1331{
1332    AssertLockNotHeld(m_recv_mutex);
1333    /** How many bytes to allocate in the receive buffer at most above what is received so far. */
1334    static constexpr size_t MAX_RESERVE_AHEAD = 256 * 1024;
1335
1336    LOCK(m_recv_mutex);
1337    if (m_recv_state == RecvState::V1) return m_v1_fallback.ReceivedBytes(msg_bytes);
1338
1339    // Process the provided bytes in msg_bytes in a loop. In each iteration a nonzero number of
1340    // bytes (decided by GetMaxBytesToProcess) are taken from the beginning om msg_bytes, and
1341    // appended to m_recv_buffer. Then, depending on the receiver state, one of the
1342    // ProcessReceived*Bytes functions is called to process the bytes in that buffer.
1343    while (!msg_bytes.empty()) {
1344        // Decide how many bytes to copy from msg_bytes to m_recv_buffer.
1345        size_t max_read = GetMaxBytesToProcess();
1346
1347        // Reserve space in the buffer if there is not enough.
1348        if (m_recv_buffer.size() + std::min(msg_bytes.size(), max_read) > m_recv_buffer.capacity()) {
1349            switch (m_recv_state) {
1350            case RecvState::KEY_MAYBE_V1:
1351            case RecvState::KEY:
1352            case RecvState::GARB_GARBTERM:
1353                // During the initial states (key/garbage), allocate once to fit the maximum (4111
1354                // bytes).
1355                m_recv_buffer.reserve(MAX_GARBAGE_LEN + BIP324Cipher::GARBAGE_TERMINATOR_LEN);
1356                break;
1357            case RecvState::VERSION:
1358            case RecvState::APP: {
1359                // During states where a packet is being received, as much as is expected but never
1360                // more than MAX_RESERVE_AHEAD bytes in addition to what is received so far.
1361                // This means attackers that want to cause us to waste allocated memory are limited
1362                // to MAX_RESERVE_AHEAD above the largest allowed message contents size, and to
1363                // MAX_RESERVE_AHEAD more than they've actually sent us.
1364                size_t alloc_add = std::min(max_read, msg_bytes.size() + MAX_RESERVE_AHEAD);
1365                m_recv_buffer.reserve(m_recv_buffer.size() + alloc_add);
1366                break;
1367            }
1368            case RecvState::APP_READY:
1369                // The buffer is empty in this state.
1370                Assume(m_recv_buffer.empty());
1371                break;
1372            case RecvState::V1:
1373                // Should have bailed out above.
1374                Assume(false);
1375                break;
1376            }
1377        }
1378
1379        // Can't read more than provided input.
1380        max_read = std::min(msg_bytes.size(), max_read);
1381        // Copy data to buffer.
1382        m_recv_buffer.insert(m_recv_buffer.end(), UCharCast(msg_bytes.data()), UCharCast(msg_bytes.data() + max_read));
1383        msg_bytes = msg_bytes.subspan(max_read);
1384
1385        // Process data in the buffer.
1386        switch (m_recv_state) {
1387        case RecvState::KEY_MAYBE_V1:
1388            ProcessReceivedMaybeV1Bytes();
1389            if (m_recv_state == RecvState::V1) return true;
1390            break;
1391
1392        case RecvState::KEY:
1393            if (!ProcessReceivedKeyBytes()) return false;
1394            break;
1395
1396        case RecvState::GARB_GARBTERM:
1397            if (!ProcessReceivedGarbageBytes()) return false;
1398            break;
1399
1400        case RecvState::VERSION:
1401        case RecvState::APP:
1402            if (!ProcessReceivedPacketBytes()) return false;
1403            break;
1404
1405        case RecvState::APP_READY:
1406            return true;
1407
1408        case RecvState::V1:
1409            // We should have bailed out before.
1410            Assume(false);
1411            break;
1412        }
1413        // Make sure we have made progress before continuing.
1414        Assume(max_read > 0);
1415    }
1416
1417    return true;
1418}
1419
1420std::optional<std::string> V2Transport::GetMessageType(std::span<const uint8_t>& contents) noexcept
1421{
1422    if (contents.size() == 0) return std::nullopt; // Empty contents
1423    uint8_t first_byte = contents[0];
1424    contents = contents.subspan(1); // Strip first byte.
1425
1426    if (first_byte != 0) {
1427        // Short (1 byte) encoding.
1428        if (first_byte < std::size(V2_MESSAGE_IDS)) {
1429            // Valid short message id.
1430            return V2_MESSAGE_IDS[first_byte];
1431        } else {
1432            // Unknown short message id.
1433            return std::nullopt;
1434        }
1435    }
1436
1437    if (contents.size() < CMessageHeader::MESSAGE_TYPE_SIZE) {
1438        return std::nullopt; // Long encoding needs 12 message type bytes.
1439    }
1440
1441    size_t msg_type_len{0};
1442    while (msg_type_len < CMessageHeader::MESSAGE_TYPE_SIZE && contents[msg_type_len] != 0) {
1443        // Verify that message type bytes before the first 0x00 are in range. BIP324 specifies the
1444        // long message type encoding as "an ASCII message type (as in the v1 P2P protocol)".
1445        if (contents[msg_type_len] < ' ' || contents[msg_type_len] > 0x7E) {
1446            return {};
1447        }
1448        ++msg_type_len;
1449    }
1450    std::string ret{reinterpret_cast<const char*>(contents.data()), msg_type_len};
1451    while (msg_type_len < CMessageHeader::MESSAGE_TYPE_SIZE) {
1452        // Verify that message type bytes after the first 0x00 are also 0x00.
1453        if (contents[msg_type_len] != 0) return {};
1454        ++msg_type_len;
1455    }
1456    // Strip message type bytes of contents.
1457    contents = contents.subspan(CMessageHeader::MESSAGE_TYPE_SIZE);
1458    return ret;
1459}
1460
1461CNetMessage V2Transport::GetReceivedMessage(NodeClock::time_point time, bool& reject_message) noexcept
1462{
1463    AssertLockNotHeld(m_recv_mutex);
1464    LOCK(m_recv_mutex);
1465    if (m_recv_state == RecvState::V1) return m_v1_fallback.GetReceivedMessage(time, reject_message);
1466
1467    Assume(m_recv_state == RecvState::APP_READY);
1468    std::span<const uint8_t> contents{m_recv_decode_buffer};
1469    auto msg_type = GetMessageType(contents);
1470    CNetMessage msg{DataStream{}};
1471    // Note that BIP324Cipher::EXPANSION also includes the length descriptor size.
1472    msg.m_raw_message_size = m_recv_decode_buffer.size() + BIP324Cipher::EXPANSION;
1473    if (msg_type) {
1474        reject_message = false;
1475        msg.m_type = std::move(*msg_type);
1476        msg.m_time = time;
1477        msg.m_message_size = contents.size();
1478        msg.m_recv.resize(contents.size());
1479        std::copy(contents.begin(), contents.end(), UCharCast(msg.m_recv.data()));
1480    } else {
1481        LogDebug(BCLog::NET, "V2 transport error: invalid message type (%u bytes contents), peer=%d\n", m_recv_decode_buffer.size(), m_nodeid);
1482        reject_message = true;
1483    }
1484    ClearShrink(m_recv_decode_buffer);
1485    SetReceiveState(RecvState::APP);
1486
1487    return msg;
1488}
1489
1490bool V2Transport::SetMessageToSend(CSerializedNetMsg& msg) noexcept
1491{
1492    AssertLockNotHeld(m_send_mutex);
1493    LOCK(m_send_mutex);
1494    if (m_send_state == SendState::V1) return m_v1_fallback.SetMessageToSend(msg);
1495    // We only allow adding a new message to be sent when in the READY state (so the packet cipher
1496    // is available) and the send buffer is empty. This limits the number of messages in the send
1497    // buffer to just one, and leaves the responsibility for queueing them up to the caller.
1498    if (!(m_send_state == SendState::READY && m_send_buffer.empty())) return false;
1499    // Construct contents (encoding message type + payload).
1500    std::vector<uint8_t> contents;