[PD1] FIXED TLS Handshake

Projs/PD1/internal/server/server.go

@@ -9,12 +9,11 @@ import (
 
 func clientHandler(connection networking.Connection[protocol.Packet], dataStore DataStore) {
 	defer connection.Conn.Close()
-    
+	_ = dataStore
 	clientCert := connection.GetPeerCertificate()
 	oidValueMap := cryptoUtils.ExtractAllOIDValues(clientCert)
 	fmt.Println(oidValueMap)
 
-
 	for {
 		pac := connection.Receive()
 		switch pac.Flag {
@@ -41,10 +40,10 @@ func Run(port int) {
 
 	//Read server keystore
 	password := AskServerPassword()
-    serverKeyStore := cryptoUtils.LoadKeyStore("certs/server/server.p12",password)
+	serverKeyStore := cryptoUtils.LoadKeyStore("certs/server/server.p12", password)
 
 	//Create server listener
-	server := networking.NewServer[protocol.Packet](&serverKeyStore,port)
+	server := networking.NewServer[protocol.Packet](&serverKeyStore, port)
 	go server.ListenLoop()
 
 	for {

Projs/PD1/internal/utils/cryptoUtils/cryptoUtils.go

@@ -8,7 +8,9 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/binary"
-	"fmt"
+	"errors"
+
+	//"errors"
 	"log"
 	"os"
 
@@ -65,7 +67,6 @@ func LoadKeyStore(keyStorePath string, password string) KeyStore {
 	if err := privKey.Validate(); err != nil {
 		log.Panicln("Private key is not valid")
 	}
-    fmt.Println(cert.SignatureAlgorithm)
 	return KeyStore{cert: cert, caCertChain: caCerts, privKey: privKey}
 }
 
@@ -80,13 +81,64 @@ func (k *KeyStore) GetTLSConfig() *tls.Config {
 	}
 	config := &tls.Config{
 		Certificates: []tls.Certificate{certificate},
-		ClientCAs:    caCertPool,
-		RootCAs:      caCertPool,
-		ClientAuth:   tls.RequireAndVerifyClientCert,
 	}
 	return config
 }
 
+func (k *KeyStore) GetServerTLSConfig() *tls.Config {
+	tlsConfig := k.GetTLSConfig()
+
+	//Add the CA certificate chain to a CertPool
+	caCertPool := x509.NewCertPool()
+	for _, caCert := range k.caCertChain {
+		caCertPool.AddCert(caCert)
+	}
+	tlsConfig.ClientCAs = caCertPool
+	//Request one valid or invalid certificate
+    //FIX: SERVER ACCEPTS CONNECTIONS WITH UNMATCHING OR 
+    // NO CERTIFICATE, NEEDS TO BE CHANGED SOMEHOW
+	tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
+	return tlsConfig
+}
+
+func (k *KeyStore) GetClientTLSConfig() *tls.Config {
+	tlsConfig := k.GetTLSConfig()
+
+	//Add the CA certificate chain to a CertPool
+	caCertPool := x509.NewCertPool()
+	for _, caCert := range k.caCertChain {
+		caCertPool.AddCert(caCert)
+	}
+	tlsConfig.RootCAs = caCertPool
+	tlsConfig.InsecureSkipVerify = true
+	tlsConfig.VerifyPeerCertificate = func(rawCerts [][]byte, _ [][]*x509.Certificate) error {
+		// Verify the peer's certificate
+		opts := x509.VerifyOptions{
+			Roots: caCertPool,
+		}
+		for _, certBytes := range rawCerts {
+			cert, err := x509.ParseCertificate(certBytes)
+			if err != nil {
+				return err
+			}
+	        oidMap := ExtractAllOIDValues(cert)
+
+			// Check if the certificate is signed by the specified CA
+			_, err = cert.Verify(opts)
+			if err != nil {
+	            return errors.New("certificate not signed by trusted CA")
+			}
+
+			 //Check if the pseudonym field is set to "SERVER"
+	        if oidMap["2.5.4.65"] != "SERVER"{
+	            return errors.New("peer isn't the server")
+	        }
+		}
+		return nil
+	}
+	return tlsConfig
+}
+
 func (k KeyStore) EncryptMessageContent(receiverCert *x509.Certificate, content []byte) []byte {
 	// Digital envolope
 

Projs/PD1/internal/utils/networking/client.go

@@ -7,7 +7,7 @@ import (
 
 
 type ClientTLSConfigProvider interface {
-    GetTLSConfig() *tls.Config
+    GetClientTLSConfig() *tls.Config
 }
 
 type Client[T any] struct {
@@ -15,9 +15,9 @@ type Client[T any] struct {
 }
 
 func NewClient[T any](clientTLSConfigProvider ClientTLSConfigProvider) Client[T] {
-    dialConn, err := tls.Dial("tcp", "localhost:8080", clientTLSConfigProvider.GetTLSConfig())
+    dialConn, err := tls.Dial("tcp", "localhost:8080", clientTLSConfigProvider.GetClientTLSConfig())
 	if err != nil {
-		log.Panicln("Could not open connection to server",err)
+        log.Panicln("Server connection error:\n",err)
 	}
 	conn := NewConnection[T](dialConn)
 	return Client[T]{Connection: conn}

Projs/PD1/internal/utils/networking/server.go

@@ -8,7 +8,7 @@ import (
 )
 
 type ServerTLSConfigProvider interface {
-	GetTLSConfig() *tls.Config
+	GetServerTLSConfig() *tls.Config
 }
 
 type Server[T any] struct {
@@ -18,7 +18,7 @@ type Server[T any] struct {
 
 func NewServer[T any](serverTLSConfigProvider ServerTLSConfigProvider, port int) Server[T] {
 
-	listener, err := tls.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", port), serverTLSConfigProvider.GetTLSConfig())
+	listener, err := tls.Listen("tcp", fmt.Sprintf("0.0.0.0:%d", port), serverTLSConfigProvider.GetServerTLSConfig())
 	if err != nil {
 		panic("Server could not bind to address")
 	}
@@ -39,7 +39,7 @@ func (s *Server[T]) ListenLoop() {
 		if !ok {
 			panic("Connection is not a TLS connection")
 		}
-        fmt.Println(tlsConn)
+        tlsConn.Handshake()
 
 		state := tlsConn.ConnectionState()
 		if len(state.PeerCertificates) == 0 {

Projs/PD1/tokefile.toml

@@ -17,6 +17,10 @@ cmd="go run ./cmd/server/server.go"
 deps=["check"]
 cmd="go run ./cmd/client/client.go -user certs/client1/client1.p12 send CLI1 testsubject"
 
+[targets.FakeClient1]
+deps=["check"]
+cmd="go run ./cmd/client/client.go -user certs/FakeClient1/client1.p12 send CLI1 testsubject"
+
 [targets.client2]
 deps=["check"]
 cmd="go run ./cmd/client/client.go -user certs/client2/client2.p12 send CLI1 testsubject"