curve.hpp

Go to the documentation of this file.

/*
    ____ _   _ ______     _______               _   _
  / ___| | | |  _ \ \   / / ____|   __ _ _   _| |_| |__
 | |   | | | | |_) \ \ / /|  _|    / _` | | | | __| '_ \
 | |___| |_| |  _ < \ V / | |___  | (_| | |_| | |_| | | |
  \____|\___/|_| \_\ \_/  |_____|  \__,_|\__,_|\__|_| |_|
 
ZMQ sockets: ZAP and CURVE helper functions
Copyright (C) 2025 Paolo Bosetti
*/
 
#pragma once
#ifdef _WIN32
#ifndef NOMINMAX
#define NOMINMAX
#endif
#ifndef WIN32_LEAN_AND_MEAN
#define WIN32_LEAN_AND_MEAN
#endif
#include <winsock2.h>
#endif
#include <string>
#include <vector>
#include <filesystem>
#include <fstream>
#include <zmq.hpp>
 
#include "zap_auth.hpp"
 
using namespace std;
namespace fs = std::filesystem;
 
namespace Mads {
 
enum class auth_verbose { off, on };
 
class CurveAuth {
public:
  CurveAuth(zmq::context_t & context) : _authenticator(context) {}
  ~CurveAuth() = default;
 
  void setup_auth(auth_verbose verbose = auth_verbose::off) {
    // Get some indication of what the authenticator is deciding
    _authenticator.set_verbose(verbose == auth_verbose::on);
    _authenticator.configure_domain("*");
 
    // Whitelist our address; any other address will be rejected
    for (const auto &ip : allowed_ips) {
      _authenticator.allow(ip);
    }
    // Binds inproc://zeromq.zap.01 before returning, so no socket configured
    // after this point can complete a handshake unauthenticated.
    _authenticator.start();
  }
 
  void fetch_public_keys(fs::path const &key_dir) {
    _key_dir = key_dir;
    _client_keys.clear();
    if (!fs::exists(key_dir) || !fs::is_directory(key_dir)) {
      throw runtime_error("Key directory does not exist: " + key_dir.string());
    }
    for (const auto &entry : fs::directory_iterator(key_dir)) {
      if (entry.path().extension() == ".pub") {
        _client_keys.push_back(entry.path().stem().string());
      }
    }
    if (_client_keys.empty()) {
      throw runtime_error("No client public keys found in " + key_dir.string());
    }
  }
 
  void setup_curve_server(zmq::socket_t &socket, string const &key_name) {
    if (_key_dir.empty()) {
      throw runtime_error("Key directory not set. Call fetch_public_keys() first.");
    }
    // We read the server certificates from files generated previously
    CurveKeypair server_keypair;
    string name = "";
    try {
      name = (_key_dir / (key_name + ".pub")).string();
      ifstream server_pub_file(name);
      if (!server_pub_file.is_open()) {
        throw runtime_error(string("cannot open server public key file ") + name + " from " + _key_dir.string());
      }
      getline(server_pub_file, server_keypair.public_key);
      server_pub_file.close();
 
      name = (_key_dir / (key_name + ".key")).string();
      ifstream server_key_file(name);
      if (!server_key_file.is_open()) {
        throw runtime_error(string("cannot open server secret key file ") + name + " from " + _key_dir.string());
      }
      getline(server_key_file, server_keypair.secret_key);
      server_key_file.close();
    } catch (const std::exception &e) {
      throw runtime_error(e.what());
    }
    for (const auto &client_key_name : _client_keys) {
      name = (_key_dir / (client_key_name + ".pub")).string();
      ifstream client_pub_file(name);
      if (!client_pub_file.is_open()) {
        throw runtime_error("cannot open client public key file " + name + " from " + _key_dir.string());
      }
      string client_key;
      getline(client_pub_file, client_key);
      client_pub_file.close();
      _authenticator.configure_curve(client_key);
    }
    socket.set(zmq::sockopt::routing_id, "IDENT");
    socket.set(zmq::sockopt::curve_server, 1);
    socket.set(zmq::sockopt::curve_secretkey, server_keypair.secret_key);
  }
 
  void setup_curve_client(zmq::socket_t &socket, string const &client_name, string const &server_name) {
    // We load the certificates from files generated previously
    try {
      string name = (_key_dir / (client_name + ".pub")).string();
      ifstream client_pub_file(name);
      if (!client_pub_file.is_open()) {
        throw runtime_error(string("cannot open client public key file ") + name + " from " + _key_dir.string());
      }
      getline(client_pub_file, _client_keypair.public_key);
      client_pub_file.close();
 
      name = (_key_dir / (server_name + ".pub")).string();
      ifstream server_pub_file(name);
      if (!server_pub_file.is_open()) {
        throw runtime_error(string("cannot open server public key file ") + name + " from " + _key_dir.string());
      }
      getline(server_pub_file, _server_public_key);
      server_pub_file.close();
 
      name = (_key_dir / (client_name + ".key")).string();
      ifstream client_key_file(name);
      if (!client_key_file.is_open()) {
        throw runtime_error(string("cannot open client private key file ") + name + " from " + _key_dir.string());
      }
      getline(client_key_file, _client_keypair.secret_key);
      client_key_file.close();
    } catch (const std::exception &e) {
      throw runtime_error(e.what());
    }
 
    setup_curve_client(socket);
  }
 
  void setup_curve_client(zmq::socket_t &socket) {
    if (_client_keypair.public_key.empty() || _client_keypair.secret_key.empty() || _server_public_key.empty()) {
      throw runtime_error("Client or server keys not set. Call setup_curve_client() or set them individually first.");
    }
    socket.set(zmq::sockopt::curve_publickey, _client_keypair.public_key);
    socket.set(zmq::sockopt::curve_secretkey, _client_keypair.secret_key);
    socket.set(zmq::sockopt::curve_serverkey, _server_public_key);
  }
 
  void set_key_dir(fs::path const &key_dir) {
    _key_dir = key_dir;
    if (!fs::exists(_key_dir) || !fs::is_directory(_key_dir)) {
      throw runtime_error("Key directory does not exist: " + _key_dir.string());
    }
  }
 
  void set_client_public_key(string const &key) {
    _client_keypair.public_key = key;
  }
 
  string client_public_key() const {
    return _client_keypair.public_key;
  }
 
  void set_client_secret_key(string const &key) {
    _client_keypair.secret_key = key;
  }
 
  string client_secret_key() const {
    return _client_keypair.secret_key;
  }
 
  void set_server_public_key(string const &key) {
    _server_public_key = key;
  }
 
  string server_public_key() const {
    return _server_public_key;
  }
 
  // ZapAuth &get_authenticator() { return _authenticator; }
 
  vector<string> allowed_ips{};
private:
  ZapAuth _authenticator;
  vector<string> _client_keys{};
  fs::path _key_dir;
  CurveKeypair _client_keypair = {"", ""};
  string _server_public_key = "";
};
 
 
 
} // namespace mads