dcrubro/columnlynx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Key loading from files

Browse Source
This commit is contained in:
DcruBro
2026-05-29 10:45:20 +02:00
parent afe10bbb6e
commit 05febee79e
9 changed files with 225 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CMakeLists.txt
View File

@@ -6,7 +6,7 @@ cmake_minimum_required(VERSION 3.16)
# If MAJOR is 0, and MINOR > 0, Version is BETA
project(ColumnLynx
VERSION 1.1.1
VERSION 1.2.0
LANGUAGES CXX
)

36
README.md
View File

@@ -55,7 +55,22 @@ openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | xxd -p -c 32
# Output example: 1c9d4f7a3b2e8a6d0f5c9b1e4d8a7f3c6e2b1a9d5f4c8e0a7b3d6c9f2e
```
You can then set these keys accordingly in the **server_config** and **client_config** files.
Write the hex output into two separate files in the matching config directory:
- `public.key` for the public key
- `private.key` for the private key seed
The files should contain only the hex ASCII characters, optionally followed by a trailing newline. Hex parsing is case-insensitive.
For example:
```bash
printf '%s' '1c9d4f7a3b2e8a6d0f5c9b1e4d8a7f3c6e2b1a9d5f4c8e0a7b3d6c9f2e' > /etc/columnlynx/public.key
printf '%s' '9f3a2b6c0f8e4d1a7c3e9a4b5d2f8c6e1a9d0b7e3f4c2a8e6d5b1f0a3c4e' > /etc/columnlynx/private.key
chmod 600 /etc/columnlynx/private.key
```
On Unix-like systems, the software will warn if the private key file is too permissive and recommend tightening it with `chmod 600`.
### Server Setup (Linux Server ONLY)
@@ -157,20 +172,19 @@ sudo nft add rule nat postroute ip saddr 10.10.0.0/24 oifname "eth0" masquerade
"**server_config**" is a file that contains the server configuration, **one variable per line**. These are the current configuration available variables:
- **SERVER_PUBLIC_KEY** (Hex String): The public key to be used - Used for verification
- **SERVER_PRIVATE_KEY** (Hex String): The private key seed to be used
- **NETWORK** (IPv4 Format): The network IPv4 to be used (Server Interface still needs to be configured manually)
- **SUBNET_MASK** (Integer): The subnet mask to be used (ensure proper length, it will not be checked)
**Example:**
```
SERVER_PUBLIC_KEY=1c9d4f7a3b2e8a6d0f5c9b1e4d8a7f3c6e2b1a9d5f4c8e0a7b3d6c9f2e
SERVER_PRIVATE_KEY=9f3a2b6c0f8e4d1a7c3e9a4b5d2f8c6e1a9d0b7e3f4c2a8e6d5b1f0a3c4e
NETWORK=10.10.0.0
SUBNET_MASK=24
```
The server keypair must now live in the same directory as `server_config`, stored in `public.key` and `private.key`.
`server_config` no longer stores key material.
<hr></hr>
"**whitelisted_keys**" is a file that **public keys of clients that are allowed to connect to the server, one key per line**.
@@ -184,17 +198,9 @@ SUBNET_MASK=24
### Client
"**client_config**" is a file that contains the client configuration, **one variable per line**. These are the current configuration available variables:
"**client_config**" is a file that contains the client configuration, **one variable per line**. Key material is no longer stored here; if you do not have any client-only settings yet, this file can stay empty.
- **CLIENT_PUBLIC_KEY** (Hex String): The public key to be used - Used for verification
- **CLIENT_PRIVATE_KEY** (Hex String): The private key seed to be used
**Example:**
```
CLIENT_PUBLIC_KEY=1c9d4f7a3b2e8a6d0f5c9b1e4d8a7f3c6e2b1a9d5f4c8e0a7b3d6c9f2e
CLIENT_PRIVATE_KEY=9f3a2b6c0f8e4d1a7c3e9a4b5d2f8c6e1a9d0b7e3f4c2a8e6d5b1f0a3c4e
```
The client keypair must now live in the same directory as `client_config`, stored in `public.key` and `private.key`.
<hr></hr>

45
include/columnlynx/client/net/tcp/tcp_client.hpp
View File

@@ -14,7 +14,6 @@
#include <atomic>
#include <algorithm>
#include <vector>
#include <unordered_map>
#include <string>
#include <columnlynx/common/net/protocol_structs.hpp>
#include <columnlynx/common/net/virtual_interface.hpp>
@@ -27,48 +26,7 @@ namespace ColumnLynx::Net::TCP {
public:
TCPClient(asio::io_context& ioContext,
const std::string& host,
const std::string& port)
:
mResolver(ioContext),
mSocket(ioContext),
mHost(host),
mPort(port),
mHeartbeatTimer(mSocket.get_executor()),
mLastHeartbeatReceived(std::chrono::steady_clock::now()),
mLastHeartbeatSent(std::chrono::steady_clock::now())
{
// Get initial client config
std::string configPath = ClientSession::getInstance().getConfigPath();
std::shared_ptr<Utils::LibSodiumWrapper> mLibSodiumWrapper = ClientSession::getInstance().getSodiumWrapper();
// Preload the config map
mRawClientConfig = Utils::getConfigMap(configPath + "client_config");
auto itPubkey = mRawClientConfig.find("CLIENT_PUBLIC_KEY");
auto itPrivkey = mRawClientConfig.find("CLIENT_PRIVATE_KEY");
if (itPubkey != mRawClientConfig.end() && itPrivkey != mRawClientConfig.end()) {
Utils::log("Loading keypair from config file.");
PublicKey pk;
PrivateSeed seed;
std::copy_n(Utils::hexStringToBytes(itPrivkey->second).begin(), seed.size(), seed.begin()); // This is extremely stupid, but the C++ compiler has forced my hand (I would've just used to_array, but fucking asio decls)
std::copy_n(Utils::hexStringToBytes(itPubkey->second).begin(), pk.size(), pk.begin());
if (!mLibSodiumWrapper->recomputeKeys(seed, pk)) {
throw std::runtime_error("Failed to recompute keypair from config file values!");
}
Utils::debug("Newly-Loaded Public Key: " + Utils::bytesToHexString(mLibSodiumWrapper->getPublicKey(), 32));
} else {
#if defined(DEBUG)
Utils::warn("No keypair found in config file! Using random key.");
#else
throw std::runtime_error("No keypair found in config file! Cannot start client without keys.");
#endif
}
}
const std::string& port);
// Starts the TCP Client and initiaties the handshake
void start();
@@ -106,6 +64,5 @@ namespace ColumnLynx::Net::TCP {
int mMissedHeartbeats = 0;
bool mIsHostDomain;
Protocol::TunConfig mTunConfig;
std::unordered_map<std::string, std::string> mRawClientConfig;
};
}

11
include/columnlynx/common/utils.hpp
View File

@@ -79,4 +79,15 @@ namespace ColumnLynx::Utils {
// Returns the config file in an unordered_map format. This purely reads the config file, you still need to parse it manually.
std::unordered_map<std::string, std::string> getConfigMap(std::string path, std::vector<std::string> requiredKeys = {});
// Load a hex-encoded file, validate its byte length, and return the decoded bytes.
std::vector<uint8_t> loadHexBytesFromFile(const std::string& path, size_t expectedBytes, const std::string& description = "key", bool warnOnInsecurePermissions = false);
template <size_t N>
inline std::array<uint8_t, N> loadHexArrayFromFile(const std::string& path, const std::string& description = "key", bool warnOnInsecurePermissions = false) {
auto bytes = loadHexBytesFromFile(path, N, description, warnOnInsecurePermissions);
std::array<uint8_t, N> out{};
std::copy_n(bytes.begin(), N, out.begin());
return out;
}
};

22
src/client/main.cpp
View File

@@ -127,6 +127,28 @@ int main(int argc, char** argv) {
initialState.virtualInterface = tun;
std::shared_ptr<LibSodiumWrapper> sodiumWrapper = std::make_shared<LibSodiumWrapper>();
const std::string clientPublicKeyPath = configPath + "public.key";
const std::string clientPrivateKeyPath = configPath + "private.key";
namespace fs = std::filesystem;
bool clientKeyFilesPresent = fs::exists(clientPublicKeyPath) && fs::exists(clientPrivateKeyPath);
if (clientKeyFilesPresent) {
Utils::log("Loading client keypair from key files.");
PublicKey pk = Utils::loadHexArrayFromFile<crypto_sign_PUBLICKEYBYTES>(clientPublicKeyPath, "client public key");
PrivateSeed seed = Utils::loadHexArrayFromFile<crypto_sign_SEEDBYTES>(clientPrivateKeyPath, "client private key", true);
if (!sodiumWrapper->recomputeKeys(seed, pk)) {
throw std::runtime_error("Failed to recompute client keypair from key files!");
}
} else {
#if defined(DEBUG)
Utils::warn("No client keypair files found! Using random key.");
#else
throw std::runtime_error("No client keypair files found! Cannot start client without keys.");
#endif
}
debug("Public Key: " + Utils::bytesToHexString(sodiumWrapper->getPublicKey(), 32));
debug("Private Key: " + Utils::bytesToHexString(sodiumWrapper->getPrivateKey(), 64));
initialState.sodiumWrapper = sodiumWrapper;

14
src/client/net/tcp/tcp_client.cpp
View File

@@ -6,6 +6,20 @@
//#include <arpa/inet.h>
namespace ColumnLynx::Net::TCP {
TCPClient::TCPClient(asio::io_context& ioContext, const std::string& host, const std::string& port)
: mResolver(ioContext),
mSocket(ioContext),
mHost(host),
mPort(port),
mHeartbeatTimer(mSocket.get_executor()),
mLastHeartbeatReceived(std::chrono::steady_clock::now()),
mLastHeartbeatSent(std::chrono::steady_clock::now())
{
if (!ClientSession::getInstance().getSodiumWrapper()) {
throw std::runtime_error("ClientSession sodium wrapper is not initialized");
}
}
void TCPClient::start() {
auto self = shared_from_this();
mResolver.async_resolve(mHost, mPort,

77
src/common/utils.cpp
View File

@@ -4,6 +4,7 @@
#include <columnlynx/common/utils.hpp>
#include <filesystem>
#include <cctype>
namespace ColumnLynx::Utils {
std::string unixMillisToISO8601(uint64_t unixMillis, bool local) {
@@ -86,7 +87,7 @@ namespace ColumnLynx::Utils {
}
std::string getVersion() {
return "1.1.1";
return "1.2.0";
}
unsigned short serverPort() {
@@ -251,4 +252,78 @@ namespace ColumnLynx::Utils {
return config;
}
std::vector<uint8_t> loadHexBytesFromFile(const std::string& path, size_t expectedBytes, const std::string& description, bool warnOnInsecurePermissions) {
namespace fs = std::filesystem;
std::error_code ec;
fs::path p(path);
fs::path abs = fs::absolute(p, ec);
if (ec) {
throw std::runtime_error("loadHexBytesFromFile(): failed to resolve path: " + path + " - " + ec.message());
}
if (!fs::exists(abs, ec) || ec) {
throw std::runtime_error("loadHexBytesFromFile(): file does not exist: " + abs.string());
}
fs::path canon = fs::canonical(abs, ec);
if (ec) {
throw std::runtime_error("loadHexBytesFromFile(): failed to canonicalize path: " + abs.string());
}
#ifndef _WIN32
if (warnOnInsecurePermissions) {
ec.clear();
fs::file_status status = fs::status(canon, ec);
if (ec) {
warn("loadHexBytesFromFile(): failed to inspect permissions for " + canon.string() + " - " + ec.message());
} else {
auto perms = status.permissions();
if ((perms & (fs::perms::group_all | fs::perms::others_all)) != fs::perms::none) {
warn(description + " file permissions are too permissive: " + canon.string() + " (recommend chmod 600)");
}
if (!fs::is_regular_file(status)) {
warn(description + " path is not a regular file: " + canon.string());
}
}
}
#endif
std::ifstream file(canon);
if (!file.is_open()) {
throw std::runtime_error("Failed to open " + description + " file at path: " + canon.string());
}
std::string hex((std::istreambuf_iterator<char>(file)), std::istreambuf_iterator<char>());
auto trim = [](std::string& s) {
while (!s.empty() && std::isspace(static_cast<unsigned char>(s.back()))) {
s.pop_back();
}
size_t start = 0;
while (start < s.size() && std::isspace(static_cast<unsigned char>(s[start]))) {
++start;
}
if (start > 0) {
s.erase(0, start);
}
};
trim(hex);
if (hex.empty()) {
throw std::runtime_error(description + " file is empty: " + canon.string());
}
std::vector<uint8_t> bytes = hexStringToBytes(hex);
if (bytes.size() != expectedBytes) {
throw std::runtime_error(description + " file must contain exactly " + std::to_string(expectedBytes * 2) + " hex characters (" + std::to_string(expectedBytes) + " bytes), got " + std::to_string(bytes.size()) + " bytes");
}
return bytes;
}
}

36
src/server/main.cpp
View File

@@ -6,6 +6,7 @@
#include <iostream>
#include <thread>
#include <chrono>
#include <filesystem>
#include <cstring>
#include <columnlynx/common/utils.hpp>
#include <columnlynx/common/panic_handler.hpp>
@@ -91,10 +92,9 @@ int main(int argc, char** argv) {
serverState.configPath = configPath;
#if defined(DEBUG)
std::unordered_map<std::string, std::string> config = Utils::getConfigMap(configPath + "server_config", { "NETWORK", "SUBNET_MASK" });
std::unordered_map<std::string, std::string> config = Utils::getConfigMap(configPath + "server_config", { "NETWORK", "SUBNET_MASK" });
#else
// A production server should never use random keys. If the config file cannot be read or does not contain keys, the server will fail to start.
std::unordered_map<std::string, std::string> config = Utils::getConfigMap(configPath + "server_config", { "NETWORK", "SUBNET_MASK", "SERVER_PUBLIC_KEY", "SERVER_PRIVATE_KEY" });
std::unordered_map<std::string, std::string> config = Utils::getConfigMap(configPath + "server_config", { "NETWORK", "SUBNET_MASK" });
#endif
serverState.serverConfig = config;
@@ -105,30 +105,28 @@ int main(int argc, char** argv) {
// Store a reference to the tun in the serverState, it will increment and keep a safe reference (we love shared_ptrs)
serverState.virtualInterface = tun;
// Generate a temporary keypair, replace with actual CA signed keys later (Note, these are stored in memory)
std::shared_ptr<LibSodiumWrapper> sodiumWrapper = std::make_shared<LibSodiumWrapper>();
auto itPubkey = config.find("SERVER_PUBLIC_KEY");
auto itPrivkey = config.find("SERVER_PRIVATE_KEY");
const std::string serverPublicKeyPath = configPath + "public.key";
const std::string serverPrivateKeyPath = configPath + "private.key";
if (itPubkey != config.end() && itPrivkey != config.end()) {
log("Loading keypair from config file.");
namespace fs = std::filesystem;
bool serverKeyFilesPresent = fs::exists(serverPublicKeyPath) && fs::exists(serverPrivateKeyPath);
if (serverKeyFilesPresent) {
log("Loading server keypair from key files.");
PublicKey pk;
PrivateSeed seed;
std::copy_n(Utils::hexStringToBytes(itPrivkey->second).begin(), seed.size(), seed.begin());
std::copy_n(Utils::hexStringToBytes(itPubkey->second).begin(), pk.size(), pk.begin());
PublicKey pk = Utils::loadHexArrayFromFile<crypto_sign_PUBLICKEYBYTES>(serverPublicKeyPath, "server public key");
PrivateSeed seed = Utils::loadHexArrayFromFile<crypto_sign_SEEDBYTES>(serverPrivateKeyPath, "server private key", true);
if (!sodiumWrapper->recomputeKeys(seed, pk)) {
throw std::runtime_error("Failed to recompute keypair from config file values!");
throw std::runtime_error("Failed to recompute keypair from key files!");
}
} else {
#if defined(DEBUG)
warn("No keypair found in config file! Using random key.");
#else
throw std::runtime_error("No keypair found in config file! Cannot start server without keys.");
#endif
#if defined(DEBUG)
warn("No server keypair files found! Using random key.");
#else
throw std::runtime_error("No server keypair files found! Cannot start server without keys.");
#endif
}
log("Server public key: " + bytesToHexString(sodiumWrapper->getPublicKey(), crypto_sign_PUBLICKEYBYTES));

62
tests/test_key_file_loading.cpp Normal file
View File

@@ -0,0 +1,62 @@
// Tests for hex key file loading helpers
#include <cassert>
#include <filesystem>
#include <fstream>
#include <iostream>
#include <columnlynx/common/utils.hpp>
#include <sodium.h>
int main() {
namespace fs = std::filesystem;
using namespace ColumnLynx::Utils;
fs::path tempDir = fs::temp_directory_path() / "columnlynx_key_loader_test";
fs::remove_all(tempDir);
fs::create_directories(tempDir);
auto publicKeyPath = tempDir / "public.key";
auto privateKeyPath = tempDir / "private.key";
{
std::ofstream pub(publicKeyPath);
pub << "00112233445566778899aabbccddeeff00112233445566778899AABBCCDDEEFF";
}
{
std::ofstream priv(privateKeyPath);
priv << "ffeeddccbbaa99887766554433221100ffeeddccbbaa99887766554433221100\n";
}
auto pk = loadHexArrayFromFile<crypto_sign_PUBLICKEYBYTES>(publicKeyPath.string(), "public key");
auto sk = loadHexArrayFromFile<crypto_sign_SEEDBYTES>(privateKeyPath.string(), "private key", true);
assert(pk[0] == 0x00 && pk[1] == 0x11 && pk.back() == 0xFF);
assert(sk[0] == 0xFF && sk[1] == 0xEE && sk.back() == 0x00);
bool threwMissing = false;
try {
(void)loadHexArrayFromFile<crypto_sign_PUBLICKEYBYTES>((tempDir / "missing.key").string(), "missing key");
} catch (const std::exception&) {
threwMissing = true;
}
assert(threwMissing && "Missing key file should throw");
auto badLengthPath = tempDir / "bad-length.key";
{
std::ofstream bad(badLengthPath);
bad << "abcd";
}
bool threwBadLength = false;
try {
(void)loadHexArrayFromFile<crypto_sign_PUBLICKEYBYTES>(badLengthPath.string(), "bad length key");
} catch (const std::exception&) {
threwBadLength = true;
}
assert(threwBadLength && "Wrong-length key file should throw");
std::cout << "Key file loader tests passed\n";
fs::remove_all(tempDir);
return 0;
}