geändert: README.md

neue Datei: client/client.py neue Datei: client/sec/client.crt.pem neue Datei: client/sec/client.csr.pem neue Datei: client/sec/client.key.pem neue Datei: container/Dockerfile neue Datei: container/requirements.txt neue Datei: lib/__pycache__/crypto_utils.cpython-313.pyc neue Datei: lib/__pycache__/jebp_utils.cpython-313.pyc neue Datei: lib/__pycache__/terminal_table.cpython-313.pyc neue Datei: lib/crypto_utils.py neue Datei: lib/jebp_utils.py neue Datei: lib/terminal_table.py neue Datei: server/clients_management/chclient.py neue Datei: server/clients_management/lsclients.py neue Datei: server/clients_management/mkclient.py neue Datei: server/clients_management/rmclient.py neue Datei: server/config/clients/fingerprints neue Datei: server/main.py neue Datei: server/sec/ca/certs/ca.cert.pem neue Datei: server/sec/ca/private/ca.key.pem neue Datei: server/sec/server.crt.pem neue Datei: server/sec/server.csr.pem neue Datei: server/sec/server.key.pem gelöscht: main.py gelöscht: sec/cert.pem gelöscht: sec/key.pem
2025-12-30 01:43:23 +01:00
parent f9e7d51015
commit 1ac4aefdc8
24 changed files with 676 additions and 1 deletions
@@ -1,3 +1,28 @@
 # jeb

-jCloud Event Bus
+jCloud Event Bus
+
+## jebp (jCloud Event Bus Protocol)
+
+### Messages
+All messages begin with `0x01`, followed by the content length length. The content length length is the length of the content length and representated by one byte. Then follows the content length and after that the message content.
+
+### Handshake
+1. Server: Server protocol, version
+2. Encryption
+    1. Client: Serialized client public key
+    2. Server: Serialized server public key
+    3. Client: Client nonce
+    4. Server: Server nonce
+    5. Client: Random bytes (encrypted)
+    6. Server: received bytes from client (not encrypted)
+
+    The client closes the connection if the received bytes from server (7.) do not match the generated bytes (6.) to prevent malfunction and test the encryption.
+3. Server authentication
+    1. Server: Server certificate
+
+    The client closes the connection if it does not trust the server certificate.
+4. Client authentication
+    1. Client: Client certificate
+
+    The server closes the connection if the client is unauthorized.
@@ -0,0 +1,93 @@
+import sys
+import os
+sys.path.append(os.getcwd())
+import asyncio
+from lib.crypto_utils import (
+    generate_keypair,
+    serialize_public_key,
+    deserialize_public_key,
+    derive_aes_key,
+)
+from lib.jebp_utils import sendmsg, readmsg, MessageFormatError, InvalidCertificateError, validate_cert
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.backends import default_backend
+from cryptography import x509
+import base64
+import dbm
+
+HOST = "127.0.0.1"
+PORT = 8888
+KNOWN_PROTOCOLS = (b'jebp 1.0',)
+SERVER_CERT_FILE = 'server/sec/server.crt.pem'
+CLIENT_CERT_FILE = 'client/sec/client.crt.pem'
+REQUIRED_CERT_COMMON_NAME = 'jeb'
+REQUIRED_ISSUER_CERT_COMMON_NAME = 'jCloudCA-Root-CA'
+
+async def main():
+    reader, writer = await asyncio.open_connection(HOST, PORT)
+
+    try:
+        try:
+            assert await readmsg(reader) in KNOWN_PROTOCOLS
+        except AssertionError:
+            print('Unknown protocol')
+            writer.close()
+            await writer.wait_closed()
+            return
+        
+        # BEGIN ENCRYPTION HANDSHAKE
+
+        # 1. Client ECC keys
+        client_priv, client_pub = generate_keypair()
+
+        # 2. Send client public key
+        await sendmsg(serialize_public_key(client_pub), writer)
+
+        # 3. Receive server public key
+        server_pub_bytes = await readmsg(reader)
+        server_pub = deserialize_public_key(server_pub_bytes)
+
+        # 4. Derive shared AES key
+        aes_key = derive_aes_key(client_priv, server_pub)
+        aesgcm = AESGCM(aes_key)
+
+        client_nonce = os.urandom(12)
+        await sendmsg(client_nonce, writer)
+    
+        server_nonce = await readmsg(reader)
+
+        test_bytes = os.urandom(32)
+        await sendmsg(test_bytes, writer, aesgcm, client_nonce)
+        rec = await readmsg(reader)
+        if rec != test_bytes:
+            raise Exception('encryption handshake failed')
+        await sendmsg(b'', writer)
+
+
+        # BEGIN SERVER AUTHENTICATION HANDSHAKE
+
+        cert_data = await readmsg(reader, aesgcm, server_nonce)
+        cert = x509.load_der_x509_certificate(cert_data, default_backend())
+        if not validate_cert(cert, REQUIRED_CERT_COMMON_NAME, REQUIRED_ISSUER_CERT_COMMON_NAME):
+            raise InvalidCertificateError('certificate not trusted')
+        
+
+        # BEGIN CLIENT AUTHENTICATION HANDSHAKE
+
+        with open(CLIENT_CERT_FILE, 'rb') as certfile:
+            cert_data = certfile.read()
+            certfile.close()
+        await sendmsg(base64.b64decode(cert_data.replace(b'-----BEGIN CERTIFICATE-----', b'').replace(b'-----END CERTIFICATE-----', b'').strip()), writer, aesgcm, client_nonce)
+        
+
+    except MessageFormatError:
+        print('invalid message format')
+    except Exception as e:
+        print(f'{str(type(e))[8:-2]}: {e}')
+    finally:
+        writer.close()
+        await writer.wait_closed()
+        return
+
+
+asyncio.run(main())
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEXjCCAkYCFDyqhr6D93HlZQSik8KgrPVXMHyiMA0GCSqGSIb3DQEBCwUAMHkx
+CzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNOb3JkcmhlaW4tV2VzdGZhbGVuMREwDwYD
+VQQHDAhCb3JuaGVpbTERMA8GA1UECgwIakNsb3VkQ0ExCzAJBgNVBAsMAklUMRkw
+FwYDVQQDDBBqQ2xvdWRDQS1Sb290LUNBMB4XDTI1MTIyOTIzMzcxNFoXDTI2MTIy
+OTIzMzcxNFowXjELMAkGA1UEBhMCREUxHDAaBgNVBAgME05vcmRyaGVpbi1XZXN0
+ZmFsZW4xETAPBgNVBAcMCEJvcm5oZWltMQ8wDQYDVQQKDAZqQ2xvdWQxDTALBgNV
+BAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCbAEzcpkoL
+DCIFUoa9JvOiIQJoe9j4cDsI65M1kczRzxGP5xJEtAJ6fz5gLIo+S4T35kXa/XzY
+KeAQ2nYfaaF6BRDlRYtkwQUgpyMyN6h7nxlFbtF2iuogdLie1CXIAanWNFul1QF2
+Z2o74xh2KA0AiVuMk1Weg91TbKsT8loXkC9Xn6mqCwT43gf9JxAXFPLzvWARi9kQ
+Srp+nkYr7sCRFbyGaA1KqZMJD0+rwWin4UxMkJtmM5FIPEgHI6iRhcXPtHiGQuFl
+bKectfTBiEKb1g9DiY6bitcvseNse6v2XWp05pBp75ZOkygDyaF4Y2eKd/ixgcRv
+NRJztk5cu0CDAgMBAAEwDQYJKoZIhvcNAQELBQADggIBAExB5wKUbxvKSmqrwyT7
+ZmPDDXYAARIu4hGF1nDMlUdcbnUNncD1CMP0piF2B/VDoyFRAdwTTzROzmtBoyUl
+tEy+d3YOJns5k+qgsMPFmbrEADipvDDOvXJ3/tgpN0tcXoaWBiDENdreH88olKwy
+kDbC5fzve74DoQ/sC8ldTgNa/aZp8vILkt5j3UdK7IYSRLFhxyjjGoVxSb/y+Ja8
+98ImQknkv7laSrUNZFesC7DwT98S0G9OZZTt6Ksp4aZSTsr63ugC2Yo91Z9CC4z/
+qPP6v71YDHLtMzMbHahnlmV1AeMOVuIwioVBHg+ewjP0z71ixp/aTeJa7KyOZFii
+fXSPy6WshdQFipr7v2g8eHTtwkyqehEhiSreeVfE1LZaCbyDfVXHaZeZUfrk4tRb
+Eg50U0AMkdk5+JKRSetmMPpNjU56v8piKSHfoT5K2UGzOn9ymChkkNW8W4c0Q7CR
+nJKp6Zzkd8RTJ45HUSbaTR5VVhV5VUHNuatNjsngezZtCqy95WxCJNzVy5m6Hx/c
+Lm5ku/6hVNpugLi5xuPwqjAKZzVgGAuV9le4TjVL+wn75Kx3KsfQvnoLySgsTtR
+4Z4vdIbK4pxoKVdUvuyaUAopGr0ZHRX9LzMkWX/iswGB90KlTbUDzvw56mtoVPTI
+v4Yoc/RsZTUA4j52LnO4vnW7
+-----END CERTIFICATE-----
@@ -0,0 +1,17 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICozCCAYsCAQAwXjELMAkGA1UEBhMCREUxHDAaBgNVBAgME05vcmRyaGVpbi1X
+ZXN0ZmFsZW4xETAPBgNVBAcMCEJvcm5oZWltMQ8wDQYDVQQKDAZqQ2xvdWQxDTAL
+BgNVBAMMBHRlc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCbAEzc
+pkoLDCIFUoa9JvOiIQJoe9j4cDsI65M1kczRzxGP5xJEtAJ6fz5gLIo+S4T35kXa
+/XzYKeAQ2nYfaaF6BRDlRYtkwQUgpyMyN6h7nxlFbtF2iuogdLie1CXIAanWNFul
+1QF2Z2o74xh2KA0AiVuMk1Weg91TbKsT8loXkC9Xn6mqCwT43gf9JxAXFPLzvWAR
+i9kQSrp+nkYr7sCRFbyGaA1KqZMJD0+rwWin4UxMkJtmM5FIPEgHI6iRhcXPtHiG
+QuFlbKectfTBiEKb1g9DiY6bitcvseNse6v2XWp05pBp75ZOkygDyaF4Y2eKd/ix
+gcRvNRJztk5cu0CDAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAmqHeGJsjdPXt
+Bk2xQ8VNfgMKebULLmgB9WxP2agycRWS54guDUTD0dgl+ROZ2WKAKCI5fC0EAbd9
+7dzZX5RFRA0h0ZcbVsYhKtKVgL6rq1ujsVfL0YKrsQw/Uduz5Sqdo8IRvMbI748Z
+tkiJO4rsvdXay7NMKAByMoKINXIYVj/gMpwyBsbuzxytLGODxCSP3bpCYwpL8DB9
+fGn1s/Dq8gVCIMJ2CBLjVhgBGNAb2eNhYBRysXCn8gP0S4DVW/9emi+Tu3Ckgk3C
+siPSls2jmo+qM9kxaTZv684lsUIZlOjzYpRn/nsLpxB6O1VIBSM/fQ1bokKeLIVw
+Pjd+o76eAw==
+-----END CERTIFICATE REQUEST-----
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCbAEzcpkoLDCIF
+Uoa9JvOiIQJoe9j4cDsI65M1kczRzxGP5xJEtAJ6fz5gLIo+S4T35kXa/XzYKeAQ
+2nYfaaF6BRDlRYtkwQUgpyMyN6h7nxlFbtF2iuogdLie1CXIAanWNFul1QF2Z2o7
+4xh2KA0AiVuMk1Weg91TbKsT8loXkC9Xn6mqCwT43gf9JxAXFPLzvWARi9kQSrp+
+nkYr7sCRFbyGaA1KqZMJD0+rwWin4UxMkJtmM5FIPEgHI6iRhcXPtHiGQuFlbKec
+tfTBiEKb1g9DiY6bitcvseNse6v2XWp05pBp75ZOkygDyaF4Y2eKd/ixgcRvNRJz
+tk5cu0CDAgMBAAECggEAGHmlKWhWo8TwME/2N7MJYI3+z9nSinRKVh/AuIJDydN9
+LfBqWY/lHkuuYUhXMfwBzJU/bZN+XbHLEE42vcITve1D3DgtiSTTdvL9Y0YXpCGc
+v3J+v82yp5pWtrnAF4NvuoO8/wQR/YzZ4Qf8ilfLqcyGuL1hFS00SyKLJxSrNjIO
+zzGf8jXPIF7KzzWEWCqDJHCN4VctB0chX0FfhXOLGTDQse/ZdzBOdjWKKJaRLBjG
+0g+sSmahZT5zJjAmj/6PjfYhic6ErVfDAwuzLJ9nMr8CoVPGTUaiNR9c93h/VBlC
+M6+sp6FDdU6YCIu0rzoHbqtybNhAXIGd5CJrZM2f0QKBgQDSTtlyRT67UChw38s/
+lyNrkl5G3sIX969cW0O/eoH9iy5LNJolngXpOH3/KwSmOShizZmx+r7Qmp+idfPj
+DTfe+Gnr6p89ekbpJ1i+l8DcjfUcIFMygrwD7fW3xeAQ/nJTkzozClSocn9wAsob
+j55AP2Ocz1ziOmM692QQttoKEwKBgQC8rVUS/vugseBxuSys0r6l0k6zoJLNZFmy
+gm138PZm9IpLg4nqUgSIfg3sJoZqkmVGfVtQbS1jjjYDDFY1QRai1gM63Ph3h6QL
+/eMjFRJFtKsyiEsvlG/k3SL9x0zCIEnT+rLf7rdDovS55JSsqa7pAr+6b80bxwI+
+c2uYsLO90QKBgQDGaLdC1EszopMUsj3pN2imQweIqv3IaNdbNYr76dMbZaR+NRk8
+ZhJDjhVol6giPgh49mmK/PnqigYS2l8GFWFhjVE4zjf/Yw3lR0a1QSwlqBPXvjNf
+kvFYb7aC8z7KKZOof1zH7HYkGSlbfnY4fE0bZfJPbV6+28DkT6NrFWctWwKBgQCa
+QyGuoVl8flKiyKLVPo1vqG5+gQfl9Gk+AVOdYB8l+ERmD0sgkSRxsJaTgMAfvEgf
+hPi23jzhC/HvNhP6AJiQVGhZpTdlCzq+LzuZgG3rHhdm/nZylWuS9JbaZSvGAH48
+WdoMKvId08tBfbltHmMK0huORECvuFuGUfoj4j1jMQKBgQDGxYkgzgNF1uzrr/lv
+OuMZ06GO5PENAsh8WckiNFN7RAt5YS0alXbDazGInT/Qm5sKCZz8GHK7coes8diC
+7U+9jlyXC6dMMuCRr8vOxJ4VmOz9suF0ZXQmVJTkjbTvM2UWiJE6Zo7C2UgNo+Cb
+JEBKPquHhcULvqN9fYlMVbvguQ==
+-----END PRIVATE KEY-----
@@ -0,0 +1,14 @@
+FROM python:3.13-slim
+
+ENV PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 8888
+
+CMD ["python3", "main.py"]
@@ -0,0 +1 @@
+cryptography
@@ -0,0 +1,32 @@
+from cryptography.hazmat.primitives.asymmetric import ec
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+
+def generate_keypair():
+    private_key = ec.generate_private_key(ec.SECP256R1())
+    return private_key, private_key.public_key()
+
+
+def serialize_public_key(public_key: ec.EllipticCurvePublicKey) -> bytes:
+    return public_key.public_bytes(
+        encoding=serialization.Encoding.X962,
+        format=serialization.PublicFormat.UncompressedPoint,
+    )
+
+
+def deserialize_public_key(data: bytes) -> ec.EllipticCurvePublicKey:
+    return ec.EllipticCurvePublicKey.from_encoded_point(
+        ec.SECP256R1(), data
+    )
+
+
+def derive_aes_key(private_key, peer_public_key) -> bytes:
+    shared_secret = private_key.exchange(ec.ECDH(), peer_public_key)
+
+    return HKDF(
+        algorithm=hashes.SHA256(),
+        length=32,
+        salt=None,
+        info=b'handshake',
+    ).derive(shared_secret)
@@ -0,0 +1,47 @@
+import asyncio
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography import x509
+from datetime import datetime, timezone
+
+MSG_START_BYTE = b'\x01'
+
+class MessageFormatError(Exception): ...
+class InvalidCertificateError(Exception): ...
+
+def int_to_bytes(n: int, signed = False):
+    n = int(n)
+    return n.to_bytes((n.bit_length() + 7) // 8, signed = signed)
+
+async def sendmsg(m, writer: asyncio.StreamWriter, aesgcm: AESGCM = None, aesnonce = None, start_byte = MSG_START_BYTE):
+    if type(m) == str:
+        m = m.encode()
+    if aesgcm:
+        m = aesgcm.encrypt(aesnonce, m, None)
+    content_length = int_to_bytes(len(m))
+    writer.write(start_byte + bytes([len(content_length)]) + content_length + m)
+    await writer.drain()
+
+async def readmsg(reader: asyncio.StreamReader, aesgcm: AESGCM = None, aesnonce = None, start_byte = MSG_START_BYTE):
+    if await reader.readexactly(1) != start_byte:
+        raise MessageFormatError('invalid message format')
+    content_length_length = await reader.readexactly(1)
+    content_length = await reader.readexactly(int.from_bytes(content_length_length))
+    m = await reader.readexactly(int.from_bytes(content_length))
+    if aesgcm:
+        return aesgcm.decrypt(aesnonce, m, None)
+    return m
+
+def validate_cert(cert: x509.Certificate, common_name, issuer_common_name, now = datetime.now(timezone.utc)):
+    if not cert.not_valid_before_utc <= now <= cert.not_valid_after_utc:
+        return False
+    cn = [a.value for a in cert.subject.get_attributes_for_oid(x509.NameOID.COMMON_NAME)]
+    if len(cn) < 1:
+        return False
+    if common_name not in cn:
+        return False
+    cn = [a.value for a in cert.issuer.get_attributes_for_oid(x509.NameOID.COMMON_NAME)]
+    if len(cn) < 1:
+        return False
+    if issuer_common_name not in cn:
+        return False
+    return True
@@ -0,0 +1,106 @@
+#!/usr/bin/env python3
+
+class TableBorderCharset:
+    def __init__(self,
+            corner_top_left, corner_top_right, corner_bottom_left, corner_bottom_right,
+            line_horizontal, line_vertical,
+            t_junction_horizontal_top, t_junction_horizontal_bottom, t_junction_vertical_left, t_junction_vertical_right,
+            intersection
+        ):
+        self.corner_top_left              = corner_top_left
+        self.corner_top_right             = corner_top_right
+        self.corner_bottom_left           = corner_bottom_left
+        self.corner_bottom_right          = corner_bottom_right
+        self.line_horizontal              = line_horizontal
+        self.line_vertical                = line_vertical
+        self.t_junction_horizontal_top    = t_junction_horizontal_top
+        self.t_junction_horizontal_bottom = t_junction_horizontal_bottom
+        self.t_junction_vertical_left     = t_junction_vertical_left
+        self.t_junction_vertical_right    = t_junction_vertical_right
+        self.intersection = intersection
+
+
+
+BORDER_THIN = TableBorderCharset(
+    '┌', '┐', '└', '┘',
+    '─', '│',
+    '┴', '┬', '┤', '├',
+    '┼'
+)
+
+BORDER_THICK = TableBorderCharset(
+    '┏', '┓', '┗', '┛',
+    '━', '┃',
+    '┻', '┳', '┫', '┣',
+    '╋'
+)
+
+BORDER_DOUBLE = TableBorderCharset(
+    '╔', '╗', '╚', '╝',
+    '═', '║',
+    '╩', '╦', '╣', '╠',
+    '╬'
+)
+
+BORDER_ROUND = TableBorderCharset(
+    '╭', '╮', '╰', '╯',
+    '─', '│',
+    '┴', '┬', '┤', '├',
+    '┼'
+)
+
+def get_max_widths(data):
+    max_widths = {}
+    for row in data:
+        for col in row:
+            max_widths[col] = max(len(str(row[col])), max_widths.get(col, 0))
+    return max_widths
+
+
+def ascii_table(data, *, borders = False, border_charset = BORDER_THIN, column_space = 1, uppercase_column_headers = True):
+    column_widths = get_max_widths(data)
+    columns = list(column_widths.keys())
+    table = f'''{(column_space * ' ').join([(c.upper() if uppercase_column_headers else c) + ' ' * (column_widths[c] - len(c)) for c in columns])}'''
+    table = ''
+    for col in columns:
+        column_widths[col] = max(column_widths[col], len(col))
+    for col in columns:
+        table += col.upper() if uppercase_column_headers else col
+        table += ' ' * (column_widths[col] - len(col))
+        table += ' ' * column_space
+        if borders:
+            table += border_charset.line_vertical + ' '
+    for row in data:
+        table += '\n'
+        for column in columns:
+            value = str(row.get(column, ''))
+            table += value
+            table += ' ' * (column_widths[column] - len(str(value)))
+            table += column_space * ' '
+            if borders:
+                table += border_charset.line_vertical + ' '
+    if borders:
+        table_without_borders = table
+        table_width = max([len(r) for r in table_without_borders.split('\n')])
+        table = border_charset.corner_top_left
+        for col in columns:
+            table += border_charset.line_horizontal * (column_widths[col] + 2)
+            table += border_charset.t_junction_horizontal_bottom
+        table = table[:-1] + border_charset.corner_top_right
+        table += '\n'
+        for row in table_without_borders.split('\n'):
+            table += border_charset.line_vertical + ' '
+            table += row
+            table += '\n'
+            table += border_charset.t_junction_vertical_right
+            for i in range(len(columns)):
+                table += border_charset.line_horizontal * (column_widths[columns[i]] + 2)
+                table += border_charset.intersection if i != (len(columns) - 1) else border_charset.t_junction_vertical_left
+            table += '\n'
+        table = '\n'.join(table.split('\n')[:-2]) + '\n'
+        table += border_charset.corner_bottom_left
+        for col in columns:
+            table += border_charset.line_horizontal * (column_widths[col] + 2)
+            table += border_charset.t_junction_horizontal_top
+        table = table[:-1] + border_charset.corner_bottom_right
+    return table
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+
+import dbm
+import sys
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import serialization
+import hashlib
+
+if len(sys.argv) < 2:
+    print(f'{sys.argv[0]}: missing key hash')
+    sys.exit(1)
+
+with dbm.open('server/config/clients/fingerprints', 'c') as db:
+    if bytes.fromhex(sys.argv[1]) not in db.keys():
+        print(f'{sys.argv[0]}: hash not registered')
+        sys.exit(1) 
+    db[bytes.fromhex(sys.argv[1])] = input('New common name: ')
+    db.close()
@@ -0,0 +1,14 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+sys.path.append(os.getcwd())
+import dbm
+from lib.terminal_table import ascii_table
+
+with dbm.open('server/config/clients/fingerprints', 'c') as db:
+    print(ascii_table([{
+        'Key Hash': k.hex(),
+        'Common name': v.decode()
+    } for k, v in db.items()], ))
+    db.close()
@@ -0,0 +1,22 @@
+#!/usr/bin/env python3
+
+import dbm
+import sys
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives import serialization
+import hashlib
+
+if len(sys.argv) < 2:
+    print(f'{sys.argv[0]}: missing common name')
+    sys.exit(1)
+
+try:
+    cert = x509.load_pem_x509_certificate(sys.stdin.buffer.read(), default_backend())
+except:
+    print(f'{sys.argv[0]}: invalid certificate')
+    sys.exit(1)
+
+with dbm.open('server/config/clients/fingerprints', 'c') as db:
+    db[hashlib.sha256(cert.public_key().public_bytes(encoding=serialization.Encoding.DER, format=serialization.PublicFormat.SubjectPublicKeyInfo)).digest()] = sys.argv[1]
+    db.close()
@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+
+import sys
+import os
+sys.path.append(os.getcwd())
+import dbm
+from lib.terminal_table import ascii_table
+
+if len(sys.argv) < 2:
+    print(f'{sys.argv[0]}: missing key hash')
+    sys.exit(1)
+
+with dbm.open('server/config/clients/fingerprints', 'c') as db:
+    try:
+        del db[bytes.fromhex(sys.argv[1])]
+    except:
+        print(f'{sys.argv[0]}: hash not registered')
+        sys.exit(1)
+    db.close()
@@ -0,0 +1,91 @@
+import sys
+import os
+sys.path.append(os.getcwd())
+import asyncio
+from lib.crypto_utils import (
+    generate_keypair,
+    serialize_public_key,
+    deserialize_public_key,
+    derive_aes_key,
+)
+from lib.jebp_utils import sendmsg, readmsg, validate_cert, InvalidCertificateError
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.backends import default_backend
+from cryptography import x509
+import base64
+import dbm
+import hashlib
+
+
+HOST = "0.0.0.0"
+PORT = 8888
+VERSION = 'jebp 1.0'
+CERT_FILE = 'server/sec/server.crt.pem'
+CLIENT_CERT_ISSUER_NAME = 'jCloudCA-Root-CA'
+
+async def handle_client(reader: asyncio.StreamReader, writer: asyncio.StreamWriter):
+    addr = writer.get_extra_info('peername')
+    print(f'Connected to {addr}')
+
+
+    await sendmsg(VERSION, writer)
+    
+    # BEGIN ENCRYPTION HANDSHAKE
+
+    server_priv, server_pub = generate_keypair()
+
+    client_pub_bytes = await readmsg(reader)
+    client_pub = deserialize_public_key(client_pub_bytes)
+
+    await sendmsg(serialize_public_key(server_pub), writer)
+
+    aes_key = derive_aes_key(server_priv, client_pub)
+    aesgcm = AESGCM(aes_key)
+
+    client_nonce = await readmsg(reader)
+
+    server_nonce = os.urandom(12)
+    await sendmsg(server_nonce, writer)
+
+    await sendmsg(await readmsg(reader, aesgcm, client_nonce), writer)
+
+
+    # BEGIN SERVER AUTHENTICATION HANDSHAKE
+
+
+    await readmsg(reader)
+    with open(CERT_FILE, 'rb') as certfile:
+        cert_data = certfile.read()
+        certfile.close()
+
+    await sendmsg(base64.b64decode(cert_data.replace(b'-----BEGIN CERTIFICATE-----', b'').replace(b'-----END CERTIFICATE-----', b'').strip()), writer, aesgcm, server_nonce)
+
+
+    # BEGIN CLIENT AUTHENTICATION HANDSHAKE
+
+    cert = x509.load_der_x509_certificate(await readmsg(reader, aesgcm, client_nonce))
+    key_hash = hashlib.sha256(cert.public_key().public_bytes(encoding=serialization.Encoding.DER, format=serialization.PublicFormat.SubjectPublicKeyInfo)).digest()
+    with dbm.open('server/config/clients/fingerprints', 'c') as db:
+        if key_hash not in db.keys():
+            raise InvalidCertificateError('client not known')
+        if not validate_cert(cert, db[key_hash].decode(), CLIENT_CERT_ISSUER_NAME):
+            raise InvalidCertificateError('client certificate not trusted')
+
+    print('Client authenticated')
+
+    writer.close()
+    await writer.wait_closed()
+
+
+async def main():
+    server = await asyncio.start_server(handle_client, HOST, PORT)
+    addr = ', '.join(str(sock.getsockname()) for sock in server.sockets)
+    print(f'Listening on {addr}')
+
+    async with server:
+        await server.serve_forever()
+
+
+if __name__ == '__main__':
+    asyncio.run(main())
@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDzTCCArWgAwIBAgIUOKOEzdpgmyw7M7cqcJvOqcSBiMEwDQYJKoZIhvcNAQEL
+BQAwdjELMAkGA1UEBhMCREUxHDAaBgNVBAgME05vcmRyaGVpbi1XZXN0ZmFsZW4x
+ETAPBgNVBAcMCEJvcm5oZWltMQ8wDQYDVQQKDAZqQ2xvdWQxETAPBgNVBAsMCFNl
+Y3VyaXR5MRIwEAYDVQQDDAlqQ2xvdWQgQ0EwHhcNMjUxMjI5MTMxOTU1WhcNMzUx
+MjI3MTMxOTU1WjB2MQswCQYDVQQGEwJERTEcMBoGA1UECAwTTm9yZHJoZWluLVdl
+c3RmYWxlbjERMA8GA1UEBwwIQm9ybmhlaW0xDzANBgNVBAoMBmpDbG91ZDERMA8G
+A1UECwwIU2VjdXJpdHkxEjAQBgNVBAMMCWpDbG91ZCBDQTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBANm+Vys2wsAhkFkOCa85/92GEG9x3Y3CWIpBgbB6
+SvLYk0B3Ed78NvSXpigwYgeATtsctM/pMbEGlh4vhCuRSeNaSkYozet6ZR3/qRhI
+hWkULrJE5uLjwFoQkUA94IfF1hfQW5y4vrUnrfDEBoiDUP1oLN5xeNs9MpV4NJR9
+og57k6jrMIKA7Ep1pnszSo5AKfo/xfaI0EmYk8M4xUI2vZUsnh4uZtTfrkoCVsZW
+tk6rg82fWW/y7dEHP2oF8y61STY8jO3QCnyPFoDJNaGJagJx9pSCWypCN0+vwTU/
+arfsjnjQQfvKZaCGS9+J27Yn7iIv4gPjZt8L9pMwMSrgC4kCAwEAAaNTMFEwHQYD
+VR0OBBYEFIjS2hku4PJxxOyeaOgiVyN3rEwoMB8GA1UdIwQYMBaAFIjS2hku4PJx
+xOyeaOgiVyN3rEwoMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+ACG9lGtheCu4k/J4QjpxcgeVtK7UDy6CM4JVIdNzQP5Q+7uzuNjjo6IpJIjRwjNq
+VRsWMtDR2Hlt0cffj0J9V8LVpDz5nah2jvxjRFo1RiBMuEhC2IYMWKdOoIeivwim
+XZeUD6SEiR3x2xsJ/ZBHnZeKF33zwecIMwtrTqwMpnH+gmVDgslkR0gu1Y+SEX7n
+zbysPRq3yNLW7Tdc9SvfK+2k2JOfur4XjPlXl0LwkAd1yE/MxS4qpLZUAmU/YqQH
+zSfuHpTTbe0DqjotyECRs1PaPJMZ3pRFJ6PL6VZE+Xan/0p05gmwv2nimVvtRooS
+NgSIHDq1B1qxB3r+VqBEA3g=
+-----END CERTIFICATE-----
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDZvlcrNsLAIZBZ
+DgmvOf/dhhBvcd2NwliKQYGwekry2JNAdxHe/Db0l6YoMGIHgE7bHLTP6TGxBpYe
+L4QrkUnjWkpGKM3remUd/6kYSIVpFC6yRObi48BaEJFAPeCHxdYX0FucuL61J63w
+xAaIg1D9aCzecXjbPTKVeDSUfaIOe5Oo6zCCgOxKdaZ7M0qOQCn6P8X2iNBJmJPD
+OMVCNr2VLJ4eLmbU365KAlbGVrZOq4PNn1lv8u3RBz9qBfMutUk2PIzt0Ap8jxaA
+yTWhiWoCcfaUglsqQjdPr8E1P2q37I540EH7ymWghkvfidu2J+4iL+ID42bfC/aT
+MDEq4AuJAgMBAAECggEAZdF1Jm5xa/Fl89a2HZuT80zs44gNr2upBmFyWQkegedX
+GAZ1s10h/4boOhPByzsq5JfMTwp+44YubUgP2GWUdP00DRGolMvDe98gfYvv4n5/
+BXplssQIHrVvjmhA1Yxju/gA1sym1MQMuLCZU32AQjbUAGJ0PqSjwjQW9ja3MGio
+/if+UMeVhg+Wf1ZYq3Le8GjkYVToZxw9RTCtF4ERBm3pCa3Jpul81kVwIijpBGCk
+p72P6nwgHYKWdiwnJksk7TTsodVZNePwX1cPpX0ZpU7sPJeq9i9M+f5d6Lrd1ddb
+vS2XFDPb5n5URWdANTtRznEqnscos9jCv2nwC1EyrwKBgQDw9jQ0I3qnP7p6m8++
+8DByLJ1B6LamuCvNaSVKOIhCW2QZF66HJtLXFX65A8W+gEnPtuoBP6rAYLGFYI+z
+usiuxEUwkU4ERbMV5BSqjHJIfm3C6T+6SM2ucX+A5WzIxOxnPsER7L/aSXjM114v
+38XWTYuh1tmLZ4pwVF8gwcQ3fwKBgQDnVS8U24Kzx7SFfIRcxsBcG5NDkQp69x7O
+vDszGF2o/JokCQcmKE/p6j6FMxwUMYZhMEoYeJ+rAkU6hXlk/GgtF/7BS7AoGC8K
+AN+sSZlWVQB3p5GbZdUXq4zhflmYzOCa768+nMkTitwaeCzk5IJFU4dZ1Z64/uSW
+vxa0RLGA9wKBgHHuR1Kbr+Oiaz6Lq1eBY7aoR5ahPLNpgzR1Ua9dOXf+lD6VBu1a
+Ovh9blR2ZyoiqEOxHcWHX+nkDiudM3TsjPStUnWbToMQnZNtKyRUkbibJrSw6nPe
+9nlTqtC8KYpoKcrLTih2g2Pnt1lLP3ptWLJyKeJUnrmeNEPWcMAhPfBrAoGATTF6
+tX4OXkl8rrJ/RKo51EKLYJeMpL3DtP7QzlsKHfK0yOOOVChNimPVGwOUEhT4n4PK
+peHSffETAtU5Tf6AENQZ+Yx1KtvvDmp+OPKSTWGt9z+ecfmIIw7mwvQzl65+IJVs
+p/sPigrjKZ4CdRrfcZzO5KZJAbhktPzs6Zimlr8CgYEAuhcaEE3LeInshaPY4T/p
+gcek6bRaScpi7aY0OBH6YPmO55kU+8G+eGv0ykQpu1wHJHaJIUG+s5JqfboUYVsZ
+nbfuEeQ0rdcbvvaygbL0+bnDecam0Sa5x9G4UmdW/DeXb4HufCamnrxh2e59CYjZ
+tVtU2HF/tg2GyPcQ9sEBIwY=
+-----END PRIVATE KEY-----
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIETTCCAjUCFDyqhr6D93HlZQSik8KgrPVXMHygMA0GCSqGSIb3DQEBCwUAMHkx
+CzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNOb3JkcmhlaW4tV2VzdGZhbGVuMREwDwYD
+VQQHDAhCb3JuaGVpbTERMA8GA1UECgwIakNsb3VkQ0ExCzAJBgNVBAsMAklUMRkw
+FwYDVQQDDBBqQ2xvdWRDQS1Sb290LUNBMB4XDTI1MTIyOTE3MDkxMVoXDTI3MTIy
+OTE3MDkxMVowTTELMAkGA1UEBhMCREUxDDAKBgNVBAgMA05SVzERMA8GA1UEBwwI
+Qm9ybmhlaW0xDzANBgNVBAoMBmpDbG91ZDEMMAoGA1UEAwwDamViMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7zhAY0ytYvzhwuCI0nC7A485Jo74H5tO
+x7sZ8XLkNWr/efjZNkEb0zfzN0BDXgWa74qmjv6JcAU7Fdzc3DMfFiCLbmgrQ0ev
+FoD5PHRoC2x65LMclJQG9mNk3gWhnyB9mQRlJysi7RNDKTUruUpGg/p2wiEmXRJ3
+xfWZ3Jdp0nvxEYbXrVemHBTcXqEW1Klhy7Ycr4cX7IoqLTk4MIOJrD90KFCyKXMt
+6EoHQhhX2IQnX0R1ok/Suxwx+NG7yeDTe5CasqgxTvzuZeT5x8Y3vbv5uIrE6FaA
+0XzvvHTtshqCcQeg1guSdzoRlgyMvh8G9l93VDXYFN922Mec9HfJGwIDAQABMA0G
+CSqGSIb3DQEBCwUAA4ICAQBOVnuexCELMTymgGtx0GG4ZV/xuyGNOI9fxX0n31C9
+6gQ4Uwe5gqy0O9g1Qw/UrA3Yf4o6R1gzxGZdJGUEKm7R1M3GE2/tChTrlRFbmiA5
+LXC0FOhdhU+S6XBpOoj87i2FLts+4si0+EqxOUvR03EkwZeKJaKttNnHkmuxSMkm
+7EJdgqTu7ohcBHlW3Gyc0TGnVX1vMBSkXrLwrRON3Zopd6nlbN/bzEY53aTGlHiN
+IWfk+dE4l8ZLnJcihvm6hf2wwVWNGxiJojk5LsNDyqwvY+1dA4xU0QuJYx1rzJHW
+cNfiC/qA6u9ml4N7UXZZRL/BTr8RF9zXmtr5hzV4xHWY/GmJBybLLPVlB/3fAkCC
+OpNlTlOzqdd0o4y5gjup2ekEi6DFX0Ef0TVLdyJ0+OPm7HrlC76f+kE67ouKQjLT
+bbnQ9j6u3GzNfuywWKPSizV/0X8X/zD/ix/jKOpE+JqRApRHLkRf7QGGOVudFYZW
+L+C0/7EQNaSPjA5iDFlWOy9j20ZF44uYsL8FYJ5tjs49E9QQ2SwKf55Bdr8Kpxnw
+W4zV4S9l+ZXRVK20GuXnpBvMxRDj6ZMeByj0YPyej4gCxnz1PlzT52SwwnwIj3lk
+csnIxvJv15ks0ws9IQqXAEmcgu4jU08yQBh0S4LMj4l8IoDJL2bt/OO5KT7LjyLj
+aQ==
+-----END CERTIFICATE-----
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICkjCCAXoCAQAwTTELMAkGA1UEBhMCREUxDDAKBgNVBAgMA05SVzERMA8GA1UE
+BwwIQm9ybmhlaW0xDzANBgNVBAoMBmpDbG91ZDEMMAoGA1UEAwwDamViMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA7zhAY0ytYvzhwuCI0nC7A485Jo74
+H5tOx7sZ8XLkNWr/efjZNkEb0zfzN0BDXgWa74qmjv6JcAU7Fdzc3DMfFiCLbmgr
+Q0evFoD5PHRoC2x65LMclJQG9mNk3gWhnyB9mQRlJysi7RNDKTUruUpGg/p2wiEm
+XRJ3xfWZ3Jdp0nvxEYbXrVemHBTcXqEW1Klhy7Ycr4cX7IoqLTk4MIOJrD90KFCy
+KXMt6EoHQhhX2IQnX0R1ok/Suxwx+NG7yeDTe5CasqgxTvzuZeT5x8Y3vbv5uIrE
+6FaA0XzvvHTtshqCcQeg1guSdzoRlgyMvh8G9l93VDXYFN922Mec9HfJGwIDAQAB
+oAAwDQYJKoZIhvcNAQELBQADggEBAHeuAv3bYqIf2GGHvm0ztgar+npTd4/vPZDm
+pZBdo3EAEe+Z9wZJCzSfUfpssfrRk94RPdbO10mdwBGDzcQ+V7Urb8jdFoGt1LRD
+P17SvWqfYmGAyML3aA+v1efBkgOIRYPROsoTncP3LrSjRMKKC0MkO2u/QbZMiNce
+ZqnzMvb3RtQAnOxNsS12FGEBiBownQrZqQyq/uIsnAjnA6QhoZJOFiXvupz9MyJq
+MxeRMw9pBz7p31vhnSaWbrb1hmvhmontdmuQ2aNBEZSSMp+rxKLn3lvAlxyy22Uq
+bgahiF6qi5XItOexSkVCBhSC7UACXGZr/9wQacH9FgZEUDCNIYY=
+-----END CERTIFICATE REQUEST-----
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDvOEBjTK1i/OHC
+4IjScLsDjzkmjvgfm07HuxnxcuQ1av95+Nk2QRvTN/M3QENeBZrviqaO/olwBTsV
+3NzcMx8WIItuaCtDR68WgPk8dGgLbHrksxyUlAb2Y2TeBaGfIH2ZBGUnKyLtE0Mp
+NSu5SkaD+nbCISZdEnfF9Zncl2nSe/ERhtetV6YcFNxeoRbUqWHLthyvhxfsiiot
+OTgwg4msP3QoULIpcy3oSgdCGFfYhCdfRHWiT9K7HDH40bvJ4NN7kJqyqDFO/O5l
+5PnHxje9u/m4isToVoDRfO+8dO2yGoJxB6DWC5J3OhGWDIy+Hwb2X3dUNdgU33bY
+x5z0d8kbAgMBAAECggEAcPQtqvWMtT3U1/CvijZCh8a75JIDZOEvjK2y7Ugjq3lv
+UkeHQM/zdINpq0ADz0R0SQE97i0P9j3yDTuxaaQV3JvXWnWDYAxcBxM1HC+W5TX+
+vTg5mYpf0z1RZmhgTUPJKlRh8uGyZyD+SFnb4GzK6Qx9wOJoO/A5b9atJPS1ufV0
+RByegK6eQefif6oAThazxb68vMy1By5cFiAEscql0Y45tyzGB/NWYbq9AlIVkHSd
+XW3z0Ro1cP76t5SrEDQNZ3udGkwZViAVZS++sOu6aXmKda9c3QzzAzu+//nucFYl
+H7xvOZhoi2jyWZWwEwD5JncEtUv+MthqUYMRY3/gmQKBgQD5o3SLasvjHlxD1Vkl
+W8fR2pUjaPCjQIuis9IZ8JSGKPzvA0WTnS6Qc0SnGvqrSZxsnNONPS3lnqlDg7MQ
+VbiFPbH97MZe3/wuy/9oo+ZxMUi8v1X0WzA4w1iBWUh9egAOT9y4V6VXYfqeZEOE
+dIGebeVixSD0aPqfthfDy5un7wKBgQD1UNQKWTh0pvSUAauMHSLmyzGuQQqSyRpS
+yhYDgWr3qhu3/FRIIQaCQ5lAxhepJTgs1xysNdyjM2Tg4rSkFXM8L6YJ3cnmd+SE
+fXyrasjbehwgcnpXruVGE5iWOzEmf5/n26FunHcsFgV8H+hW2Rrt609Xhi6+7v0x
+qAxwCH6llQKBgQDQ344dNO+Bih6i9zkOxBuOH/kXVq+5uMDdEt5hq+Vp15PCnJcz
+qpmSbY/szesdNIs4aYOssprbfISdo+1IZqDsgzGRh/J24ayMr012DWU8IoN8wg82
+VLIlXHWKTN0Vd+XiE7pXV6ZVVfqvWq8PfbgSilsa6FvphIjm5yI9RfhoawKBgQCV
+cSv7MecGiT6te2b58DX2ywn00YKTcRcsIBfRAuIbBfHk3z6owhWo/W063HJFhHr4
+NgMtlZJXiVOG/BR3cOnGXHCVyhrY32jCnX95HZBGw9imm5aUG+NoET//JQgIH+9V
+26I4M/EVVkT5HKb5YUDad2LaOs/3WLe9rFYHWeVtEQKBgG5xsN8GhCGDuWKqHkLe
+hUNAGFgutDQzOM9Huk1YRk6DNog7GXRzJYUWM/XP/TqRSlGZu0I3/1VedkKwiKH3
+VDY/IikRvsGC0pfjM/hnh7EVDEjlTClYh+6uZbY2tpcq+FuR1mr/2uRWiLUZIoWs
+Cjt9QMUxvxXAnjvXacDAkgCj
+-----END PRIVATE KEY-----