-
Notifications
You must be signed in to change notification settings - Fork 358
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Apply PQ key exchanging for multihop
- Loading branch information
1 parent
0c728b7
commit 8061e0c
Showing
27 changed files
with
1,228 additions
and
102 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| // | ||
| // LocalNetworkIPs.swift | ||
| // MullvadTypes | ||
| // | ||
| // Created by Mojgan on 2024-07-26. | ||
| // Copyright © 2024 Mullvad VPN AB. All rights reserved. | ||
| // | ||
|
|
||
| import Foundation | ||
|
|
||
| public enum LocalNetworkIPs: String { | ||
| case gatewayAddress = "10.64.0.1" | ||
| case defaultRouteIpV4 = "0.0.0.0" | ||
| case defaultRouteIpV6 = "::" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
132 changes: 132 additions & 0 deletions
132
ios/PacketTunnel/PostQuantum/MultiHopPostQuantumKeyExchanging.swift
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,132 @@ | ||
| // | ||
| // MultiHopPostQuantumKeyExchanging.swift | ||
| // PacketTunnel | ||
| // | ||
| // Created by Mojgan on 2024-07-15. | ||
| // Copyright © 2024 Mullvad VPN AB. All rights reserved. | ||
| // | ||
|
|
||
| import MullvadREST | ||
| import MullvadRustRuntime | ||
| import MullvadSettings | ||
| import MullvadTypes | ||
| import PacketTunnelCore | ||
| import WireGuardKitTypes | ||
|
|
||
| final class MultiHopPostQuantumKeyExchanging: PostQuantumKeyExchangingProtocol { | ||
| let entry: SelectedRelay | ||
| let exit: SelectedRelay | ||
| let keyExchanger: PostQuantumKeyExchangeActorProtocol | ||
| let devicePrivateKey: PrivateKey | ||
| let onFinish: () -> Void | ||
| let onUpdateConfiguration: (PostQuantumNegotiationState) -> Void | ||
|
|
||
| private var entryPostQuantumKey: PostQuantumKey! | ||
| private var exitPostQuantumKey: PostQuantumKey! | ||
|
|
||
| private let defaultGatewayAddressRange = [IPAddressRange(from: "\(LocalNetworkIPs.gatewayAddress.rawValue)/32")!] | ||
| private let allTrafficRange = [ | ||
| IPAddressRange(from: "\(LocalNetworkIPs.defaultRouteIpV4.rawValue)/0")!, | ||
| IPAddressRange(from: "\(LocalNetworkIPs.defaultRouteIpV6.rawValue)/0")!, | ||
| ] | ||
|
|
||
| private var state: StateMachine = .initial | ||
|
|
||
| enum StateMachine { | ||
| case initial | ||
| case negotiatingWithEntry | ||
| case negotiatingBetweenEntryAndExit | ||
| case makeConnection | ||
| } | ||
|
|
||
| init( | ||
| entry: SelectedRelay, | ||
| exit: SelectedRelay, | ||
| devicePrivateKey: PrivateKey, | ||
| keyExchanger: PostQuantumKeyExchangeActorProtocol, | ||
| onUpdateConfiguration: @escaping (PostQuantumNegotiationState) -> Void, | ||
| onFinish: @escaping () -> Void | ||
| ) { | ||
| self.entry = entry | ||
| self.exit = exit | ||
| self.devicePrivateKey = devicePrivateKey | ||
| self.keyExchanger = keyExchanger | ||
| self.onUpdateConfiguration = onUpdateConfiguration | ||
| self.onFinish = onFinish | ||
| } | ||
|
|
||
| func start() { | ||
| guard state == .initial else { return } | ||
| negotiateWithEntry() | ||
| } | ||
|
|
||
| func receivePostQuantumKey( | ||
| _ preSharedKey: PreSharedKey, | ||
| ephemeralKey: PrivateKey | ||
| ) { | ||
| if state == .negotiatingWithEntry { | ||
| entryPostQuantumKey = PostQuantumKey(preSharedKey: preSharedKey, ephemeralKey: ephemeralKey) | ||
| negotiateBetweenEntryAndExit() | ||
| } else if state == .negotiatingBetweenEntryAndExit { | ||
| exitPostQuantumKey = PostQuantumKey(preSharedKey: preSharedKey, ephemeralKey: ephemeralKey) | ||
| makeConnection() | ||
| } | ||
| } | ||
|
|
||
| private func negotiateWithEntry() { | ||
| state = .negotiatingWithEntry | ||
| onUpdateConfiguration(.single(PostQuantumConfigurationRelay( | ||
| relay: entry, | ||
| configuration: PostQuantumConfiguration( | ||
| privateKey: devicePrivateKey, | ||
| allowedIPs: defaultGatewayAddressRange | ||
| ) | ||
| ))) | ||
| keyExchanger.startNegotiation(with: devicePrivateKey) | ||
| } | ||
|
|
||
| private func negotiateBetweenEntryAndExit() { | ||
| state = .negotiatingBetweenEntryAndExit | ||
| onUpdateConfiguration(.multi( | ||
| entry: PostQuantumConfigurationRelay( | ||
| relay: entry, | ||
| configuration: PostQuantumConfiguration( | ||
| privateKey: entryPostQuantumKey.ephemeralKey, | ||
| preSharedKey: entryPostQuantumKey.preSharedKey, | ||
| allowedIPs: [IPAddressRange(from: "\(exit.endpoint.ipv4Relay.ip)/32")!] | ||
| ) | ||
| ), | ||
| exit: PostQuantumConfigurationRelay( | ||
| relay: exit, | ||
| configuration: PostQuantumConfiguration( | ||
| privateKey: devicePrivateKey, | ||
| allowedIPs: defaultGatewayAddressRange | ||
| ) | ||
| ) | ||
| )) | ||
| keyExchanger.startNegotiation(with: devicePrivateKey) | ||
| } | ||
|
|
||
| private func makeConnection() { | ||
| state = .makeConnection | ||
| onUpdateConfiguration(.multi( | ||
| entry: PostQuantumConfigurationRelay( | ||
| relay: entry, | ||
| configuration: PostQuantumConfiguration( | ||
| privateKey: entryPostQuantumKey.ephemeralKey, | ||
| preSharedKey: entryPostQuantumKey.preSharedKey, | ||
| allowedIPs: [IPAddressRange(from: "\(exit.endpoint.ipv4Relay.ip)/32")!] | ||
| ) | ||
| ), | ||
| exit: PostQuantumConfigurationRelay( | ||
| relay: exit, | ||
| configuration: PostQuantumConfiguration( | ||
| privateKey: exitPostQuantumKey.ephemeralKey, | ||
| preSharedKey: exitPostQuantumKey.preSharedKey, | ||
| allowedIPs: allTrafficRange | ||
| ) | ||
| ) | ||
| )) | ||
| self.onFinish() | ||
| } | ||
| } |
Oops, something went wrong.