PdMessageSecureChannel.cs

using System;
using System.Collections.ObjectModel;
using System.Diagnostics;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Extensions.Logging;
using OSDP.Net.Connections;
using OSDP.Net.Model;
using OSDP.Net.Model.CommandData;
using OSDP.Net.Model.ReplyData;
using OSDP.Net.Utilities;
 
namespace OSDP.Net.Messages.SecureChannel
{
    internal class PdMessageSecureChannelBase : MessageSecureChannel
    {
        public PdMessageSecureChannelBase(SecurityContext context = null, ILoggerFactory loggerFactory = null)
            : base(context, loggerFactory) { }

        public override void EncodePayload(byte[] payload, Span<byte> destination) =>
            EncodePayload(payload, Context.CMac, destination);

        public override byte[] DecodePayload(byte[] payload) => DecodePayload(payload, Context.RMac);

        public override ReadOnlySpan<byte> GenerateMac(ReadOnlySpan<byte> message, bool isIncoming) =>
            isIncoming ? GenerateCommandMac(message) : GenerateReplyMac(message);
    }
 
    internal class PdMessageSecureChannel(
        IOsdpConnection connection,
        SecurityContext context = null,
        ILoggerFactory loggerFactory = null)
        : PdMessageSecureChannelBase(context, loggerFactory)
    {
        private byte[] _expectedServerCryptogram;
        private byte[] _securityKey;
        private readonly byte[] _clientUID;
 
        // When the last byte of the current command finished arriving, used to time the idle line
        // delay owed before the reply may drive the channel.
        private long _commandReceivedTimestamp;
 
        public PdMessageSecureChannel(IOsdpConnection connection, byte[] securityKey, byte[] clientUID, ILoggerFactory loggerFactory = null)
            : this(connection, context: null, loggerFactory)
        {
            _securityKey = securityKey;
 
            if (clientUID == null)
            {
                throw new ArgumentNullException(nameof(clientUID));
            }
            if (clientUID.Length != 8)
            {
                throw new ArgumentException("Client UID must be exactly 8 bytes", nameof(clientUID));
            }
            _clientUID = clientUID;
        }
 
        public byte Address { get; set; }
 
        public SecurityMode SecurityMode { get; set; } = SecurityMode.Unsecured;
 
        public CommandType[] AllowUnsecured { get; set; } = [];

        private TimeSpan ReplyIdleLineDelay => LineTiming.IdleLine(connection.BaudRate);
 
        public async Task<IncomingMessage> ReadNextCommand(CancellationToken cancellationToken = default)
        {
            var commandBuffer = new Collection<byte>();
 
            if (!await Bus.WaitForStartOfMessage(connection, commandBuffer, TimeSpan.FromSeconds(8), cancellationToken)
                    .ConfigureAwait(false))
            {
                return null;
            }
 
            if (!await Bus.WaitForMessageLength(connection, commandBuffer, cancellationToken).ConfigureAwait(false))
            {
                throw new TimeoutException("Timeout waiting for command message length");
            }
 
            if (!await Bus.WaitForRestOfMessage(connection, commandBuffer, Bus.ExtractMessageLength(commandBuffer),
                    cancellationToken).ConfigureAwait(false))
            {
                throw new TimeoutException("Timeout waiting for command of reply message");
            }
 
            // Stamped before any parsing so the idle line delay is measured from the wire, not from
            // however long this PD's handlers take.
            _commandReceivedTimestamp = Stopwatch.GetTimestamp();
 
            var command = new IncomingMessage(commandBuffer.ToArray().AsSpan(), this);
 
            if (command.Type != (byte)CommandType.Poll)
            {
                Logger?.LogInformation("Received Command: {CommandType}", Enum.GetName(typeof(CommandType), command.Type));
                Logger?.LogDebug("Incoming: {Data}", BitConverter.ToString(commandBuffer.ToArray()));
            }
 
            var commandHandled = await HandleCommand(command);
            return commandHandled ? await ReadNextCommand(cancellationToken) : command;
        }
 
        internal async Task SendReply(OutgoingReply reply, bool sendUnsecured = false)
        {
            if (reply.Command.Type == (byte)CommandType.KeySet && reply.Code == (byte)ReplyType.Ack)
            {
                HandleKeySetUpdate(reply);
            }
 
            var replyBuffer = reply.BuildMessage(sendUnsecured ? null : this);
 
            // The line must be seen idle for two character times before this PD may drive it, or the
            // ACU's transceiver may still be turning around when the reply's first bytes land.
            await LineTiming.WaitAsync(ReplyIdleLineDelay, _commandReceivedTimestamp)
                .ConfigureAwait(false);
 
            if (reply.Command.Type != (byte)CommandType.Poll)
            {
                Logger?.LogInformation("Sending Reply: {Reply}", Enum.GetName(typeof(ReplyType), reply.PayloadData.Code));
                Logger?.LogDebug("Outgoing: {Data}", BitConverter.ToString(replyBuffer));
            }
 
            await connection.WriteAsync(replyBuffer);
        }
 
        private async Task<bool> HandleCommand(IncomingMessage command)
        {
            if (command.Address != Address && command.Address != ControlPanel.ConfigurationAddress) return true;
 
            DropStaleSecureSessionOnConnectionRestart(command);
 
            var reply = (command.IsValidMac, (CommandType)command.Type) switch
            {
                (false, _) => HandleInvalidMac(),
                (true, CommandType.SessionChallenge) => HandleSessionChallenge(command),
                (true, CommandType.ServerCryptogram) => HandleSCrypt(command),
                _ => ValidateCommandSecurity(command)
            };
 
            if (reply == null) return false;
 
            // If we return NAK from here, it is generally because command didn't pass secure channel validation
            // in this case we can only send the reply unsecured
            await SendReply(new OutgoingReply(command, reply), reply.Code == (byte)ReplyType.Nak);
 
            if (command.Type == (byte)CommandType.ServerCryptogram)
            {
                Context.IsSecurityEstablished = true;
            }
 
            return true;
        }
        internal void DropStaleSecureSessionOnConnectionRestart(IncomingMessage command)
        {
            if (command.Sequence == 0 && !command.IsSecureMessage && IsSecurityEstablished)
            {
                ResetSecureChannelSession();
            }
        }
 
        private PayloadData HandleInvalidMac()
        {
            return new Nak(ErrorCode.CommunicationSecurityNotMet);
        }

        protected PayloadData HandleSessionChallenge(IncomingMessage command)
        {
            // Per Section D.1.3
            bool useDefaultKey = command.SecureBlockData[0] == 0;
            bool pdHasDefaultKey = _securityKey.SequenceEqual(SecurityContext.DefaultKey);
 
            if (useDefaultKey && !pdHasDefaultKey)
            {
                // ACU requests SCBK-D, but PD has a non-default key configured
                return new Nak(ErrorCode.DoesNotSupportSecurityBlock);
            }
 
            if (!useDefaultKey && pdHasDefaultKey)
            {
                // ACU requests a SCBK, but PD only has a default key configured
                return new Nak(ErrorCode.DoesNotSupportSecurityBlock);
            }
 
            Context.Reset(_securityKey);
 
            // generate a set of session keys: S-ENC, S-MAC1, S-MAC2 using command.Payload (which is RND.A)
            using var crypto = Context.CreateCypher(true);
            byte[] rndA = command.Payload;
 
            // TODO: we should validate payload and SCB type
 
            Context.Enc = SecurityContext.GenerateKey(crypto, [0x01, 0x82, rndA[0], rndA[1], rndA[2], rndA[3], rndA[4], rndA[5]
            ]);
            Context.SMac1 = SecurityContext.GenerateKey(crypto, [0x01, 0x01, rndA[0], rndA[1], rndA[2], rndA[3], rndA[4], rndA[5]
            ]);
            Context.SMac2 = SecurityContext.GenerateKey(crypto, [0x01, 0x02, rndA[0], rndA[1], rndA[2], rndA[3], rndA[4], rndA[5]
            ]);
 
            // Client UID is vendor code (3 bytes) + serial number (4 bytes) + padding (1 byte).
            // See OSDP specification and GitHub issue #191.
            byte[] cUID = _clientUID;
            byte[] rndB = new byte[8];
 
            new Random().NextBytes(rndB);
            crypto.Key = Context.Enc;
            var clientCryptogram = SecurityContext.GenerateKey(crypto, rndA, rndB);
            _expectedServerCryptogram = SecurityContext.GenerateKey(crypto, rndB, rndA);
 
            // reply with osdp_CCRYPT, returning PD's ID (cUID), its random number and the client cryptogram
            return new ChallengeResponse(cUID, rndB, clientCryptogram, useDefaultKey);
        }
        
        protected PayloadData HandleSCrypt(IncomingMessage command)
        {
            var serverCryptogram = command.Payload;
 
            if (command.SecurityBlockType != (byte)SecurityBlockType.SecureConnectionSequenceStep3)
            {
                Logger?.LogWarning("Received unexpected security block type: {SecurityBlockType}",
                    command.SecurityBlockType);
            }
            else if (!serverCryptogram.SequenceEqual(_expectedServerCryptogram))
            {
                Logger?.LogWarning("Received unexpected server cryptogram!");
            }
            else if (IsSecurityEstablished)
            {
                Logger?.LogWarning("Secure channel already established. Why did we get another SCrypt??");
            }
            else
            {
                var crypto = Context.CreateCypher(true, Context.SMac1);
                Context.RMac = SecurityContext.GenerateKey(crypto, serverCryptogram);
                crypto.Key = Context.SMac2;
                Context.RMac = SecurityContext.GenerateKey(crypto, Context.RMac);
 
                return new InitialRMac(Context.RMac, true);
            }
 
            return new Nak(ErrorCode.DoesNotSupportSecurityBlock);
        }
 
        private PayloadData ValidateCommandSecurity(IncomingMessage command)
        {
            if (IsSecurityEstablished)
            {
                return command.IsSecureMessage ? null : new Nak(ErrorCode.CommunicationSecurityNotMet);
            }
            else if (SecurityMode != SecurityMode.FullSecurity)
            {
                return null;
            }
            else 
            {
                return AllowUnsecured.Contains((CommandType)command.Type) ?
                    null : new Nak(ErrorCode.CommunicationSecurityNotMet);
            }
        }
 
        private void HandleKeySetUpdate(OutgoingReply reply)
        {
            var keySetPayload = EncryptionKeyConfiguration.ParseData(reply.Command.Payload);
 
            _securityKey = keySetPayload.KeyData;
        }
    }
 
    internal enum SecurityMode
    {
        Unsecured,
        InstallMode,
        FullSecurity
    }
}