[PD1] Added verification that server returns the correct client cert

Projs/PD1/internal/client/client.go

@@ -39,7 +39,7 @@ func Run() {
 		cl := networking.NewClient[protocol.Packet](&clientKeyStore)
 		defer cl.Connection.Conn.Close()
 
-		receiverCert := getUserCert(cl, uid)
+		receiverCert := getUserCert(cl, clientKeyStore, uid)
 		if receiverCert == nil {
 			return
 		}
@@ -102,7 +102,7 @@ func Run() {
 			return
 		}
 		answerGetMsg := protocol.UnmarshalAnswerGetMsg(receivedMsgPacket.Body)
-		senderCert := getUserCert(cl, answerGetMsg.FromUID)
+		senderCert := getUserCert(cl, clientKeyStore, answerGetMsg.FromUID)
 		decSubjectBytes := clientKeyStore.DecryptMessageContent(senderCert, answerGetMsg.Subject)
 		decBodyBytes := clientKeyStore.DecryptMessageContent(senderCert, answerGetMsg.Body)
 		subject := Unmarshal(decSubjectBytes)
@@ -119,7 +119,7 @@ func Run() {
 
 }
 
-func getUserCert(cl networking.Client[protocol.Packet], uid string) *x509.Certificate {
+func getUserCert(cl networking.Client[protocol.Packet], keyStore cryptoUtils.KeyStore, uid string) *x509.Certificate {
 	getUserCertPacket := protocol.NewGetUserCertPacket(uid)
 	if !cl.Connection.Send(getUserCertPacket) {
 		return nil
@@ -139,10 +139,13 @@ func getUserCert(cl networking.Client[protocol.Packet], uid string) *x509.Certif
 	if err != nil {
 		return nil
 	}
+    if !keyStore.CheckCert(userCert, uid){
+        return nil
+    }
 	return userCert
 }
 
-func getManyMessagesInfo(cl networking.Client[protocol.Packet]) (protocol.AnswerGetUnreadMsgsInfo, map[string]*x509.Certificate) {
+func getManyMessagesInfo(cl networking.Client[protocol.Packet], keyStore cryptoUtils.KeyStore) (protocol.AnswerGetUnreadMsgsInfo, map[string]*x509.Certificate) {
 	answerGetUnreadMsgsInfoPacket, active := cl.Connection.Receive()
 	if !active {
 		return protocol.NewAnswerGetUnreadMsgsInfo(0, 0, nil), nil
@@ -162,7 +165,7 @@ func getManyMessagesInfo(cl networking.Client[protocol.Packet]) (protocol.Answer
 	certificatesMap := map[string]*x509.Certificate{}
 	//Get senders' certificates
 	for senderUID := range senderSet {
-		senderCert := getUserCert(cl, senderUID)
+		senderCert := getUserCert(cl, keyStore, senderUID)
 		certificatesMap[senderUID] = senderCert
 	}
 	return answerGetUnreadMsgsInfo, certificatesMap
@@ -173,7 +176,7 @@ func askQueue(cl networking.Client[protocol.Packet], clientKeyStore cryptoUtils.
 	if !cl.Connection.Send(requestUnreadMsgsQueuePacket) {
 		return
 	}
-	unreadMsgsInfo, certificates := getManyMessagesInfo(cl)
+	unreadMsgsInfo, certificates := getManyMessagesInfo(cl, clientKeyStore)
 	var clientMessages []ClientMessageInfo
 	for _, message := range unreadMsgsInfo.MessagesInfo {
 		senderCert, ok := certificates[message.FromUID]

Projs/PD1/internal/utils/cryptoUtils/cryptoUtils.go

@@ -69,6 +69,31 @@ func LoadKeyStore(keyStorePath string, password string) KeyStore {
 	return KeyStore{cert: cert, caCertChain: caCerts, privKey: privKey}
 }
 
+// Check if the cert is signed by the CA and is for the correct user
+func (k KeyStore) CheckCert(cert *x509.Certificate, uid string) bool {
+	caCertPool := x509.NewCertPool()
+	for _, caCert := range k.caCertChain {
+		caCertPool.AddCert(caCert)
+	}
+	opts := x509.VerifyOptions{
+		Roots: caCertPool,
+	}
+	// Check if the certificate is signed by the specified CA
+	_, err := cert.Verify(opts)
+	if err != nil {
+		log.Println("Certificate not signed by a trusted CA")
+		return false
+	}
+
+	//Check if the pseudonym field is set to UID
+	oidMap := ExtractAllOIDValues(cert)
+	if oidMap["2.5.4.65"] != uid {
+		log.Println("Certificate does not belong to the message's receiver")
+		return false
+	}
+	return true
+}
+
 func (k *KeyStore) GetTLSConfig() *tls.Config {
 
 	certificate := tls.Certificate{Certificate: [][]byte{k.cert.Raw}, PrivateKey: k.privKey, Leaf: k.cert}

Projs/PD1/tokefile.toml

@@ -12,8 +12,12 @@ cmd="go build"
 [targets.server]
 cmd="go run ./cmd/server/server.go"
 
-[targets.queue]
-cmd="go run ./cmd/client/client.go -user certs/client${NUM}/client${NUM}.p12 askqueue"
-
 [targets.send]
-cmd="go run ./cmd/client/client.go -user certs/client${NUM}/client${NUM}.p12 send ${DEST} ${SUBJECT}"
+cmd="echo client1 | go run ./cmd/client/client.go -user certs/client1/client1.p12 send CL2 testsubject"
+
+[targets.askQueue]
+cmd="go run ./cmd/client/client.go -user certs/client2/client2.p12 askqueue"
+
+[targets.fakeAskQueue]
+cmd="go run ./cmd/client/client.go -user certs/FakeClient1/client1.p12 askqueue"
+