WireGuardKit: Add wrappers for PrivateKey, PublicKey, PreSharedKey

Signed-off-by: Andrej Mihajlov <and@mullvad.net>

WireGuardKit/Sources/WireGuardKit/Data+KeyEncoding.swift

@@ -1,80 +0,0 @@
-// SPDX-License-Identifier: MIT
-// Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
-
-import Foundation
-
-extension Data {
-    func isKey() -> Bool {
-        return self.count == WG_KEY_LEN
-    }
-
-    func hexKey() -> String? {
-        if self.count != WG_KEY_LEN {
-            return nil
-        }
-        var out = Data(repeating: 0, count: Int(WG_KEY_LEN_HEX))
-        out.withUnsafeMutableInt8Bytes { outBytes in
-            self.withUnsafeUInt8Bytes { inBytes in
-                key_to_hex(outBytes, inBytes)
-            }
-        }
-        out.removeLast()
-        return String(data: out, encoding: .ascii)
-    }
-
-    init?(hexKey hexString: String) {
-        self.init(repeating: 0, count: Int(WG_KEY_LEN))
-
-        if !self.withUnsafeMutableUInt8Bytes { key_from_hex($0, hexString) } {
-            return nil
-        }
-    }
-
-    func base64Key() -> String? {
-        if self.count != WG_KEY_LEN {
-            return nil
-        }
-        var out = Data(repeating: 0, count: Int(WG_KEY_LEN_BASE64))
-        out.withUnsafeMutableInt8Bytes { outBytes in
-            self.withUnsafeUInt8Bytes { inBytes in
-                key_to_base64(outBytes, inBytes)
-            }
-        }
-        out.removeLast()
-        return String(data: out, encoding: .ascii)
-    }
-
-    init?(base64Key base64String: String) {
-        self.init(repeating: 0, count: Int(WG_KEY_LEN))
-
-        if !self.withUnsafeMutableUInt8Bytes { key_from_base64($0, base64String) } {
-            return nil
-        }
-    }
-}
-
-extension Data {
-    func withUnsafeUInt8Bytes<R>(_ body: (UnsafePointer<UInt8>) -> R) -> R {
-        assert(!isEmpty)
-        return self.withUnsafeBytes { (ptr: UnsafeRawBufferPointer) -> R in
-            let bytes = ptr.bindMemory(to: UInt8.self)
-            return body(bytes.baseAddress!) // might crash if self.count == 0
-        }
-    }
-
-    mutating func withUnsafeMutableUInt8Bytes<R>(_ body: (UnsafeMutablePointer<UInt8>) -> R) -> R {
-        assert(!isEmpty)
-        return self.withUnsafeMutableBytes { (ptr: UnsafeMutableRawBufferPointer) -> R in
-            let bytes = ptr.bindMemory(to: UInt8.self)
-            return body(bytes.baseAddress!) // might crash if self.count == 0
-        }
-    }
-
-    mutating func withUnsafeMutableInt8Bytes<R>(_ body: (UnsafeMutablePointer<Int8>) -> R) -> R {
-        assert(!isEmpty)
-        return self.withUnsafeMutableBytes { (ptr: UnsafeMutableRawBufferPointer) -> R in
-            let bytes = ptr.bindMemory(to: Int8.self)
-            return body(bytes.baseAddress!) // might crash if self.count == 0
-        }
-    }
-}

WireGuardKit/Sources/WireGuardKit/InterfaceConfiguration.swift

@@ -5,16 +5,13 @@ import Foundation
 import Network
 
 public struct InterfaceConfiguration {
-    public var privateKey: Data
+    public var privateKey: PrivateKey
     public var addresses = [IPAddressRange]()
     public var listenPort: UInt16?
     public var mtu: UInt16?
     public var dns = [DNSServer]()
 
-    public init(privateKey: Data) {
-        if privateKey.count != TunnelConfiguration.keyLength {
-            fatalError("Invalid private key")
-        }
+    public init(privateKey: PrivateKey) {
         self.privateKey = privateKey
     }
 }

WireGuardKit/Sources/WireGuardKit/PacketTunnelSettingsGenerator.swift

@@ -18,9 +18,7 @@ class PacketTunnelSettingsGenerator {
     func endpointUapiConfiguration() -> String {
         var wgSettings = ""
         for (index, peer) in tunnelConfiguration.peers.enumerated() {
-            if let publicKey = peer.publicKey.hexKey() {
-                wgSettings.append("public_key=\(publicKey)\n")
-            }
+            wgSettings.append("public_key=\(peer.publicKey.hexKey)\n")
             if let endpoint = resolvedEndpoints[index]?.withReresolvedIP() {
                 if case .name(_, _) = endpoint.host { assert(false, "Endpoint is not resolved") }
                 wgSettings.append("endpoint=\(endpoint.stringRepresentation)\n")
@@ -31,9 +29,7 @@ class PacketTunnelSettingsGenerator {
 
     func uapiConfiguration() -> String {
         var wgSettings = ""
-        if let privateKey = tunnelConfiguration.interface.privateKey.hexKey() {
-            wgSettings.append("private_key=\(privateKey)\n")
-        }
+        wgSettings.append("private_key=\(tunnelConfiguration.interface.privateKey.hexKey)\n")
         if let listenPort = tunnelConfiguration.interface.listenPort {
             wgSettings.append("listen_port=\(listenPort)\n")
         }
@@ -42,10 +38,8 @@ class PacketTunnelSettingsGenerator {
         }
         assert(tunnelConfiguration.peers.count == resolvedEndpoints.count)
         for (index, peer) in tunnelConfiguration.peers.enumerated() {
-            if let publicKey = peer.publicKey.hexKey() {
-                wgSettings.append("public_key=\(publicKey)\n")
-            }
-            if let preSharedKey = peer.preSharedKey?.hexKey() {
+            wgSettings.append("public_key=\(peer.publicKey.hexKey)\n")
+            if let preSharedKey = peer.preSharedKey?.hexKey {
                 wgSettings.append("preshared_key=\(preSharedKey)\n")
             }
             if let endpoint = resolvedEndpoints[index]?.withReresolvedIP() {

WireGuardKit/Sources/WireGuardKit/PeerConfiguration.swift

@@ -4,16 +4,8 @@
 import Foundation
 
 public struct PeerConfiguration {
-    public var publicKey: Data
-    public var preSharedKey: Data? {
-        didSet(value) {
-            if let value = value {
-                if value.count != TunnelConfiguration.keyLength {
-                    fatalError("Invalid preshared key")
-                }
-            }
-        }
-    }
+    public var publicKey: PublicKey
+    public var preSharedKey: PreSharedKey?
     public var allowedIPs = [IPAddressRange]()
     public var endpoint: Endpoint?
     public var persistentKeepAlive: UInt16?
@@ -21,11 +13,8 @@ public struct PeerConfiguration {
     public var txBytes: UInt64?
     public var lastHandshakeTime: Date?
 
-    public init(publicKey: Data) {
+    public init(publicKey: PublicKey) {
         self.publicKey = publicKey
-        if publicKey.count != TunnelConfiguration.keyLength {
-            fatalError("Invalid public key")
-        }
     }
 }
 

WireGuardKit/Sources/WireGuardKit/PrivateKey.swift

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: MIT
+// Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
+
+import Foundation
+import WireGuardKitCTarget
+
+/// The class describing a private key used by WireGuard.
+public class PrivateKey: _BaseKey {
+    /// Derived public key
+    public var publicKey: PublicKey {
+        return rawValue.withUnsafeBytes { (privateKeyBufferPointer: UnsafeRawBufferPointer) -> PublicKey in
+            var publicKeyData = Data(repeating: 0, count: Int(WG_KEY_LEN))
+            let privateKeyBytes = privateKeyBufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self)
+
+            publicKeyData.withUnsafeMutableBytes { (publicKeyBufferPointer: UnsafeMutableRawBufferPointer) in
+                let publicKeyBytes = publicKeyBufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self)
+                curve25519_derive_public_key(publicKeyBytes, privateKeyBytes)
+            }
+
+            return PublicKey(rawValue: publicKeyData)!
+        }
+    }
+
+    /// Initialize new private key
+    convenience public init() {
+        var privateKeyData = Data(repeating: 0, count: Int(WG_KEY_LEN))
+        privateKeyData.withUnsafeMutableBytes { (rawBufferPointer: UnsafeMutableRawBufferPointer) in
+            let privateKeyBytes = rawBufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self)
+            curve25519_generate_private_key(privateKeyBytes)
+        }
+        self.init(rawValue: privateKeyData)!
+    }
+}
+
+/// The class describing a public key used by WireGuard.
+public class PublicKey: _BaseKey {}
+
+/// The class describing a pre-shared key used by WireGuard.
+public class PreSharedKey: _BaseKey {}
+
+/// The base key implementation. Should not be used directly.
+public class _BaseKey: RawRepresentable, Equatable, Hashable {
+    /// Raw key representation
+    public let rawValue: Data
+
+    /// Hex encoded representation
+    public var hexKey: String {
+        return rawValue.withUnsafeBytes { (rawBufferPointer: UnsafeRawBufferPointer) -> String in
+            let inBytes = rawBufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self)
+            var outBytes = [CChar](repeating: 0, count: Int(WG_KEY_LEN_HEX))
+            key_to_hex(&outBytes, inBytes)
+            return String(cString: outBytes, encoding: .ascii)!
+        }
+    }
+
+    /// Base64 encoded representation
+    public var base64Key: String {
+        return rawValue.withUnsafeBytes { (rawBufferPointer: UnsafeRawBufferPointer) -> String in
+            let inBytes = rawBufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self)
+            var outBytes = [CChar](repeating: 0, count: Int(WG_KEY_LEN_BASE64))
+            key_to_base64(&outBytes, inBytes)
+            return String(cString: outBytes, encoding: .ascii)!
+        }
+    }
+
+    /// Initialize the key with existing raw representation
+    required public init?(rawValue: Data) {
+        if rawValue.count == WG_KEY_LEN {
+            self.rawValue = rawValue
+        } else {
+            return nil
+        }
+    }
+
+    /// Initialize the key with hex representation
+    public convenience init?(hexKey: String) {
+        var bytes = Data(repeating: 0, count: Int(WG_KEY_LEN))
+        let success = bytes.withUnsafeMutableBytes { (bufferPointer: UnsafeMutableRawBufferPointer) -> Bool in
+            return key_from_hex(bufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self), hexKey)
+        }
+        if success {
+            self.init(rawValue: bytes)
+        } else {
+            return nil
+        }
+    }
+
+    /// Initialize the key with base64 representation
+    public convenience init?(base64Key: String) {
+        var bytes = Data(repeating: 0, count: Int(WG_KEY_LEN))
+        let success = bytes.withUnsafeMutableBytes { (bufferPointer: UnsafeMutableRawBufferPointer) -> Bool in
+            return key_from_base64(bufferPointer.baseAddress!.assumingMemoryBound(to: UInt8.self), base64Key)
+        }
+        if success {
+            self.init(rawValue: bytes)
+        } else {
+            return nil
+        }
+    }
+
+    public static func == (lhs: _BaseKey, rhs: _BaseKey) -> Bool {
+        return lhs.rawValue.withUnsafeBytes { (lhsBytes: UnsafeRawBufferPointer) -> Bool in
+            return rhs.rawValue.withUnsafeBytes { (rhsBytes: UnsafeRawBufferPointer) -> Bool in
+                return key_eq(
+                    lhsBytes.baseAddress!.assumingMemoryBound(to: UInt8.self),
+                    rhsBytes.baseAddress!.assumingMemoryBound(to: UInt8.self)
+                )
+            }
+        }
+    }
+}

WireGuardKit/Sources/WireGuardKit/TunnelConfiguration.swift

@@ -8,15 +8,13 @@ public final class TunnelConfiguration {
     public var interface: InterfaceConfiguration
     public let peers: [PeerConfiguration]
 
-    public static let keyLength = 32
-
     public init(name: String?, interface: InterfaceConfiguration, peers: [PeerConfiguration]) {
         self.interface = interface
         self.peers = peers
         self.name = name
 
         let peerPublicKeysArray = peers.map { $0.publicKey }
-        let peerPublicKeysSet = Set<Data>(peerPublicKeysArray)
+        let peerPublicKeysSet = Set<PublicKey>(peerPublicKeysArray)
         if peerPublicKeysArray.count != peerPublicKeysSet.count {
             fatalError("Two or more peers cannot have the same public key")
         }

WireGuardKit/Sources/WireGuardKitCTarget/include/WireGuardKitCTarget.h

@@ -2,3 +2,4 @@
 // Copyright © 2018-2019 WireGuard LLC. All Rights Reserved.
 
 #include "../key.h"
+#include "../x25519.h"

WireGuardKit/Sources/WireGuardKitCTarget/key.c

@@ -112,3 +112,13 @@ bool key_from_hex(uint8_t key[static WG_KEY_LEN], const char *hex)
 
 	return 1 & ((ret - 1) >> 8);
 }
+
+bool key_eq(const uint8_t key1[static WG_KEY_LEN], const uint8_t key2[static WG_KEY_LEN])
+{
+	volatile uint8_t acc = 0;
+	for (unsigned int i = 0; i < WG_KEY_LEN; ++i) {
+		acc |= key1[i] ^ key2[i];
+		asm volatile("" : "=r"(acc) : "0"(acc));
+	}
+	return 1 & ((acc - 1) >> 8);
+}

WireGuardKit/Sources/WireGuardKitCTarget/key.h

@@ -19,4 +19,6 @@ bool key_from_base64(uint8_t key[static WG_KEY_LEN], const char *base64);
 void key_to_hex(char hex[static WG_KEY_LEN_HEX], const uint8_t key[static WG_KEY_LEN]);
 bool key_from_hex(uint8_t key[static WG_KEY_LEN], const char *hex);
 
+bool key_eq(const uint8_t key1[static WG_KEY_LEN], const uint8_t key2[static WG_KEY_LEN]);
+
 #endif

WireGuardKit/Sources/WireGuardKitCTarget/x25519.c

@@ -0,0 +1,178 @@
+/* SPDX-License-Identifier: GPL-2.0+
+ *
+ * Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
+ *
+ * Curve25519 ECDH functions, based on TweetNaCl but cleaned up.
+ */
+
+#include <stdint.h>
+#include <string.h>
+#include <assert.h>
+#include <CommonCrypto/CommonRandom.h>
+
+#include "x25519.h"
+
+typedef int64_t fe[16];
+
+static inline void carry(fe o)
+{
+    int i;
+
+    for (i = 0; i < 16; ++i) {
+        o[(i + 1) % 16] += (i == 15 ? 38 : 1) * (o[i] >> 16);
+        o[i] &= 0xffff;
+    }
+}
+
+static inline void cswap(fe p, fe q, int b)
+{
+    int i;
+    int64_t t, c = ~(b - 1);
+
+    for (i = 0; i < 16; ++i) {
+        t = c & (p[i] ^ q[i]);
+        p[i] ^= t;
+        q[i] ^= t;
+    }
+}
+
+static inline void pack(uint8_t *o, const fe n)
+{
+    int i, j, b;
+    fe m, t;
+
+    memcpy(t, n, sizeof(t));
+    carry(t);
+    carry(t);
+    carry(t);
+    for (j = 0; j < 2; ++j) {
+        m[0] = t[0] - 0xffed;
+        for (i = 1; i < 15; ++i) {
+            m[i] = t[i] - 0xffff - ((m[i - 1] >> 16) & 1);
+            m[i - 1] &= 0xffff;
+        }
+        m[15] = t[15] - 0x7fff - ((m[14] >> 16) & 1);
+        b = (m[15] >> 16) & 1;
+        m[14] &= 0xffff;
+        cswap(t, m, 1 - b);
+    }
+    for (i = 0; i < 16; ++i) {
+        o[2 * i] = t[i] & 0xff;
+        o[2 * i + 1] = t[i] >> 8;
+    }
+}
+
+static inline void unpack(fe o, const uint8_t *n)
+{
+    int i;
+
+    for (i = 0; i < 16; ++i)
+        o[i] = n[2 * i] + ((int64_t)n[2 * i + 1] << 8);
+    o[15] &= 0x7fff;
+}
+
+static inline void add(fe o, const fe a, const fe b)
+{
+    int i;
+
+    for (i = 0; i < 16; ++i)
+        o[i] = a[i] + b[i];
+}
+
+static inline void subtract(fe o, const fe a, const fe b)
+{
+    int i;
+
+    for (i = 0; i < 16; ++i)
+        o[i] = a[i] - b[i];
+}
+
+static inline void multmod(fe o, const fe a, const fe b)
+{
+    int i, j;
+    int64_t t[31] = { 0 };
+
+    for (i = 0; i < 16; ++i) {
+        for (j = 0; j < 16; ++j)
+            t[i + j] += a[i] * b[j];
+    }
+    for (i = 0; i < 15; ++i)
+        t[i] += 38 * t[i + 16];
+    memcpy(o, t, sizeof(fe));
+    carry(o);
+    carry(o);
+}
+
+static inline void invert(fe o, const fe i)
+{
+    fe c;
+    int a;
+
+    memcpy(c, i, sizeof(c));
+    for (a = 253; a >= 0; --a) {
+        multmod(c, c, c);
+        if (a != 2 && a != 4)
+            multmod(c, c, i);
+    }
+    memcpy(o, c, sizeof(fe));
+}
+
+static void curve25519_shared_secret(uint8_t shared_secret[32], const uint8_t private_key[32], const uint8_t public_key[32])
+{
+    static const fe a24 = { 0xdb41, 1 };
+    uint8_t z[32];
+    int64_t r;
+    int i;
+    fe a = { 1 }, b, c = { 0 }, d = { 1 }, e, f, x;
+
+    memcpy(z, private_key, sizeof(z));
+
+    z[31] = (z[31] & 127) | 64;
+    z[0] &= 248;
+
+    unpack(x, public_key);
+    memcpy(b, x, sizeof(b));
+
+    for (i = 254; i >= 0; --i) {
+        r = (z[i >> 3] >> (i & 7)) & 1;
+        cswap(a, b, (int)r);
+        cswap(c, d, (int)r);
+        add(e, a, c);
+        subtract(a, a, c);
+        add(c, b, d);
+        subtract(b, b, d);
+        multmod(d, e, e);
+        multmod(f, a, a);
+        multmod(a, c, a);
+        multmod(c, b, e);
+        add(e, a, c);
+        subtract(a, a, c);
+        multmod(b, a, a);
+        subtract(c, d, f);
+        multmod(a, c, a24);
+        add(a, a, d);
+        multmod(c, c, a);
+        multmod(a, d, f);
+        multmod(d, b, x);
+        multmod(b, e, e);
+        cswap(a, b, (int)r);
+        cswap(c, d, (int)r);
+    }
+    invert(c, c);
+    multmod(a, a, c);
+    pack(shared_secret, a);
+}
+
+void curve25519_derive_public_key(uint8_t public_key[32], const uint8_t private_key[32])
+{
+    static const uint8_t basepoint[32] = { 9 };
+
+    curve25519_shared_secret(public_key, private_key, basepoint);
+}
+
+void curve25519_generate_private_key(uint8_t private_key[32])
+{
+    assert(CCRandomGenerateBytes(private_key, 32) == kCCSuccess);
+    private_key[31] = (private_key[31] & 127) | 64;
+    private_key[0] &= 248;
+}

WireGuardKit/Sources/WireGuardKitCTarget/x25519.h

@@ -0,0 +1,7 @@
+#ifndef X25519_H
+#define X25519_H
+
+void curve25519_derive_public_key(unsigned char public_key[32], const unsigned char private_key[32]);
+void curve25519_generate_private_key(unsigned char private_key[32]);
+
+#endif