Add BIP324 encrypted p2p transport de-/serializer (only used in tests) #18242

198@@ -199,3 +199,116 @@ const std::vector<std::string> &getAllNetMessageTypes()
199 {
200     return allNetMessageTypesVec;
201 }
202+
203+

320@@ -319,4 +321,73 @@ BOOST_AUTO_TEST_CASE(PoissonNextSend)
321     g_mock_deterministic_tests = false;
322 }
323 
324+void message_serialize_deserialize_test(bool v2, const std::vector<CSerializedNetMsg>& test_msgs) {
325+    // use 32 bytey keys with all zeros

332+
333+    if (v2) {
334+        serializer = MakeUnique<V2TransportSerializer>(V2TransportSerializer(k1, k2));
335+        deserializer = MakeUnique<V2TransportDeserializer>(V2TransportDeserializer(Params().MessageStart(), k1, k2));
336+    }
337+    else {

337+    else {
338+        serializer = MakeUnique<V1TransportSerializer>(V1TransportSerializer());
339+        deserializer = MakeUnique<V1TransportDeserializer>(V1TransportDeserializer(Params().MessageStart(), SER_NETWORK, INIT_PROTO_VERSION));
340+    }
341+    // run a couple of times through all messages with the same AEAD instance
342+    for (unsigned int i=0; i<100;i++) {

349+
350+            std::vector<unsigned char> serialized_header;
351+            serializer->prepareForTransport(msg, serialized_header);
352+
353+            // read two times
354+            //  first: read header

352+
353+            // read two times
354+            //  first: read header
355+            size_t read_bytes = 0;
356+            if (serialized_header.size() > 0) read_bytes += deserializer->Read((const char *)serialized_header.data(), serialized_header.size());
357+            //  second: read the encrypted payload (if required)

375+    test_msgs.push_back(CNetMsgMaker(INIT_PROTO_VERSION).Make(NetMsgType::VERSION, PROTOCOL_VERSION, (int)NODE_NETWORK, 123, CAddress(CService(), NODE_NONE), CAddress(CService(), NODE_NONE), 123, "foobar", 500000, true));
376+    test_msgs.push_back(CNetMsgMaker(INIT_PROTO_VERSION).Make(NetMsgType::PING, 123456));
377+    CDataStream stream(ParseHex("020000000001013107ca31e1950a9b44b75ce3e8f30127e4d823ed8add1263a1cc8adcc8e49164000000001716001487835ecf51ea0351ef266d216a7e7a3e74b84b4efeffffff02082268590000000017a9144a94391b99e672b03f56d3f60800ef28bc304c4f8700ca9a3b0000000017a9146d5df9e79f752e3c53fc468db89cafda4f7d00cb87024730440220677de5b11a5617d541ba06a1fa5921ab6b4509f8028b23f18ab8c01c5eb1fcfb02202fe382e6e87653f60ff157aeb3a18fc888736720f27ced546b0b77431edabdb0012102608c772598e9645933a86bcd662a3b939e02fb3e77966c9713db5648d5ba8a0006010000"), SER_NETWORK, PROTOCOL_VERSION);
378+    test_msgs.push_back(CNetMsgMaker(INIT_PROTO_VERSION).Make(NetMsgType::TX, CTransaction(deserialize, stream)));
379+    std::vector<CInv> vInv;
380+    for (unsigned int i=0;i<1000;i++) { vInv.push_back(CInv(MSG_BLOCK, Params().GenesisBlock().GetHash())); }

380+    for (unsigned int i=0;i<1000;i++) { vInv.push_back(CInv(MSG_BLOCK, Params().GenesisBlock().GetHash())); }
381+    test_msgs.push_back(CNetMsgMaker(INIT_PROTO_VERSION).Make(NetMsgType::INV, vInv));
382+
383+    // add a dummy message
384+    std::string dummy;
385+    for (unsigned int i=0;i<100;i++) { dummy += "020000000001013107ca31e1950a9b44b75ce3e8f30127e4d823ed8add1263a1cc8adcc8e49164000000001716001487835ecf51ea0351ef266d216a7e7a3e74b84b4efeffffff02082268590000000017a9144a94391b99e672b03f56d3f60800ef28bc304c4f8700ca9a3b0000000017a9146d5df9e79f752e3c53fc468db89cafda4f7d00cb87024730440220677de5b11a5617d541ba06a1fa5921ab6b4509f8028b23f18ab8c01c5eb1fcfb02202fe382e6e87653f60ff157aeb3a18fc888736720f27ced546b0b77431edabdb0012102608c772598e9645933a86bcd662a3b939e02fb3e77966c9713db5648d5ba8a0006010000"; }

860+        m_aad_seqnr = 0;
861+        m_aad_pos = 0;
862+        m_bytes_decrypted = 0;
863+        m_time_last_rekey = GetTime();
864+    }
865+    else if (m_bytes_decrypted > REKEY_ABORT_LIMIT_BYTES || GetTime() - m_time_last_rekey > REKEY_ABORT_LIMIT_TIME ||

410+    std::unique_ptr<TransportSerializer> serializer = MakeUnique<V2TransportSerializer>(V2TransportSerializer(k1, k2, session_id));;
411+    std::unique_ptr<TransportDeserializer> deserializer = MakeUnique<V2TransportDeserializer>(V2TransportDeserializer(Params().MessageStart(), k1, k2, session_id));
412+
413+    ChaCha20Poly1305AEAD test_decryption_aead(k1.data(), k1.size(), k2.data(), k2.size());
414+
415+    for (unsigned int i=0; i<=76;i++) {

431+    // now make sure we are rekeying by checking against a manual aead instance
432+    serializer.reset(new V2TransportSerializer(mutable_k1, mutable_k2, mutable_session_id));
433+    deserializer.reset(new V2TransportDeserializer(Params().MessageStart(), mutable_k1, mutable_k2, mutable_session_id));
434+    uint32_t aad_seqnr = 0;
435+    uint32_t aad_pos = 0;
436+    for (unsigned int i=0; i<=100;i++) {

17@@ -17,24 +18,22 @@ void initialize()
18     SelectParams(CBaseChainParams::REGTEST);
19 }
20 
21-void test_one_input(const std::vector<uint8_t>& buffer)
22-{
23-    V1TransportDeserializer deserializer{Params().MessageStart(), SER_NETWORK, INIT_PROTO_VERSION};
24+void test_deserializer(std::unique_ptr<TransportDeserializer>& deserializer, const std::vector<uint8_t>& buffer, const int header_size) {

718@@ -718,6 +719,163 @@ CNetMessage V1TransportDeserializer::GetMessage(const CMessageHeader::MessageSta
719     return msg;
720 }
721 
722+int V2TransportDeserializer::Read(const char* pch, unsigned int bytes)
723+{
724+    if (!m_in_data) {
725+        // copy data to temporary parsing buffer
726+        unsigned int remaining = CHACHA20_POLY1305_AEAD_AAD_LEN - m_hdr_pos;

718@@ -718,6 +719,163 @@ CNetMessage V1TransportDeserializer::GetMessage(const CMessageHeader::MessageSta
719     return msg;
720 }
721 
722+int V2TransportDeserializer::Read(const char* pch, unsigned int bytes)
723+{
724+    if (!m_in_data) {
725+        // copy data to temporary parsing buffer
726+        unsigned int remaining = CHACHA20_POLY1305_AEAD_AAD_LEN - m_hdr_pos;
727+        unsigned int copy_bytes = std::min(remaining, bytes);

741+        }
742+
743+        // check and unset rekey bit
744+        // the counterparty can signal a post-this-message rekey by setting the
745+        // most significant bit in the (unencrypted) length
746+        m_rekey_flag = (m_message_size & (1U << 23));

743+        // check and unset rekey bit
744+        // the counterparty can signal a post-this-message rekey by setting the
745+        // most significant bit in the (unencrypted) length
746+        m_rekey_flag = (m_message_size & (1U << 23));
747+        if (m_rekey_flag) {
748+            LogPrint(BCLog::NET, "Rekey flag detected %ld\n", m_message_size);

759+
760+        return copy_bytes;
761+    } else {
762+        const unsigned int AAD_LEN = CHACHA20_POLY1305_AEAD_AAD_LEN;
763+        unsigned int remaining = m_message_size + CHACHA20_POLY1305_AEAD_TAG_LEN - m_data_pos;
764+        unsigned int copy_bytes = std::min(remaining, bytes);

767+        if (vRecv.size() < CHACHA20_POLY1305_AEAD_AAD_LEN + m_data_pos + copy_bytes) {
768+            // Allocate up to 256 KiB ahead, but never more than the total message size (incl. AAD & TAG).
769+            vRecv.resize(std::min(CHACHA20_POLY1305_AEAD_AAD_LEN + m_message_size + CHACHA20_POLY1305_AEAD_TAG_LEN, CHACHA20_POLY1305_AEAD_AAD_LEN + m_data_pos + copy_bytes + 256 * 1024 + CHACHA20_POLY1305_AEAD_TAG_LEN));
770+        }
771+
772+        memcpy(&vRecv[AAD_LEN + m_data_pos], pch, copy_bytes);

820+            if (!GetCommandFromShortCommandID(size_or_shortid, command_name)) {
821+                // unknown-short-id
822+                //  results in a valid but unknown message (will be skipped)
823+                command_name = "unknown-" + ToString(size_or_shortid);
824+            }
825+        }

888@@ -731,6 +889,97 @@ void V1TransportSerializer::prepareForTransport(CSerializedNetMsg& msg, std::vec
889     CVectorWriter{SER_NETWORK, INIT_PROTO_VERSION, header, 0, hdr};
890 }
891 
892+void V2TransportSerializer::prepareForTransport(CSerializedNetMsg& msg, std::vector<unsigned char>& header)
893+{
894+    size_t serialized_command_size = 1; // short-IDs are 1 byte
895+    uint8_t cmd_short_id = GetShortCommandIDFromCommand(msg.command);

904+    uint32_t packet_length = serialized_command_size + msg.data.size();
905+
906+    // prepare the packet length & message command
907+    std::vector<unsigned char> serialized_header;
908+    // reserve 4 bytes (3bytes AD + 1byte short-ID)
909+    serialized_header.resize(CHACHA20_POLY1305_AEAD_AAD_LEN + 1);

910+    // LE serialize the 24bits length
911+    // we do "manually" encode this since there is no helper for 24bit serialization
912+    packet_length = htole32(packet_length);
913+    memcpy(serialized_header.data(), &packet_length, 3);
914+
915+    // append the short-ID (or eventually) the varstr of the command

921+        // or the ASCII command string
922+        vector_writer << msg.command;
923+    }
924+
925+    // insert header directly into the CSerializedNetMsg data buffer (insert at begin)
926+    // TODO: if we refactor the ChaCha20Poly1350 crypt function to allow sepearte buffers for

933+    // length is only allowed up to 2^23 (bit24 is used for indicating rekey)
934+    bool bit24 = msg.data[2] & (1u << 7);
935+    assert(!bit24);
936+
937+    // check if we should rekey after this message
938+    int64_t now = GetTime(); //TODO: check how expansive the GetTime call is and if it is avoidable

934+    bool bit24 = msg.data[2] & (1u << 7);
935+    assert(!bit24);
936+
937+    // check if we should rekey after this message
938+    int64_t now = GetTime(); //TODO: check how expansive the GetTime call is and if it is avoidable
939+    bool rekey = false;

926+    // TODO: if we refactor the ChaCha20Poly1350 crypt function to allow sepearte buffers for
927+    //       the AD, payload and MAC, we could avoid a insert and thus a potential reallocation
928+    msg.data.insert(msg.data.begin(), serialized_header.begin(), serialized_header.end());
929+
930+    // resize the message buffer to make space for the MAC tag
931+    msg.data.resize(msg.data.size() + 16, 0);

942+        msg.data[2] |= (1u << 7);
943+        rekey = true;
944+    }
945+
946+    // encrypt the payload, ignore return code since it can't fail in this case (controlled buffers, don't check the MAC during encrypting)
947+    m_aead->Crypt(m_payload_seqnr, m_aad_seqnr, m_aad_pos, msg.data.data(), msg.data.size(), msg.data.data(), msg.data.size() - 16, true);

732+    unsigned int m_hdr_pos;   // read pos in header
733+    unsigned int m_data_pos;  // read pos in data
734+    bool m_rekey_flag;        // rekey in message detected
735+
736+public:
737+    V2TransportDeserializer(const CMessageHeader::MessageStartChars& pchMessageStartIn, const CPrivKey& k1, const CPrivKey& k2, const uint256& session_id) : m_aead(new ChaCha20Poly1305AEAD(k1.data(), k1.size(), k2.data(), k2.size())), m_aead_k1(k1), m_aead_k2(k2), m_bytes_decrypted(0), m_time_last_rekey(GetTime()), m_session_id(session_id), m_payload_seqnr(0), m_aad_seqnr(0), m_aad_pos(0), vRecv(SER_NETWORK, INIT_PROTO_VERSION)

750+        m_rekey_flag = false;
751+    }
752+    bool Complete() const
753+    {
754+        if (!m_in_data)
755+            return false;

793+    uint64_t m_payload_seqnr = 0;
794+    uint64_t m_aad_seqnr = 0;
795+    int m_aad_pos = 0;
796+
797+public:
798+    V2TransportSerializer(const CPrivKey& k1, const CPrivKey& k2, const uint256& session_id) : m_aead(new ChaCha20Poly1305AEAD(k1.data(), k1.size(), k2.data(), k2.size())), m_aead_k1(k1), m_aead_k2(k2), m_session_id(session_id)

198@@ -199,3 +199,127 @@ const std::vector<std::string> &getAllNetMessageTypes()
199 {
200     return allNetMessageTypesVec;
201 }
202+
203+
204+uint8_t GetShortCommandIDFromCommand(const std::string cmd)
205+{
206+    if (cmd == NetMsgType::ADDR) {

266+    return 0; //no short command
267+}
268+
269+bool GetCommandFromShortCommandID(uint8_t shortID, std::string& cmd)
270+{
271+    if (shortID == NetMsgType::ADDR_SHORT_ID) {

70@@ -71,99 +71,115 @@ namespace NetMsgType {
71  * @see https://bitcoin.org/en/developer-reference#version
72  */
73 extern const char *VERSION;
74+const uint8_t VERSION_SHORT_ID = 38;

710+// Re-key after 1GB (RFC4253 / SSH recommendation) or after 1h
711+static constexpr unsigned int REKEY_LIMIT_BYTES = (1024 * 1024 * 1024);
712+static constexpr unsigned int REKEY_LIMIT_TIME = 3600;
713+static constexpr unsigned int REKEY_ABORT_LIMIT_BYTES = REKEY_LIMIT_BYTES * 1.1; // abort after ~10% tolerance buffer
714+static constexpr unsigned int REKEY_ABORT_LIMIT_TIME = REKEY_LIMIT_BYTES * 1.1;  // abort after ~10% tolerance buffer
715+static constexpr unsigned int MIN_REKEY_TIME = 10;                               // minimal rekey time to avoid DOS

429+        read_message(deserializer, serialized_header, test_msg);
430+        CNetMessage msg_deser = deserializer->GetMessage(Params().MessageStart(), GetTimeMicros());
431+
432+        // make sure we detect the failed rekey
433+        // the 76. message (32kb) must have violated the fast rekey limits
434+        BOOST_CHECK(msg_deser.m_valid_header == (i != 76));

720+
721+    int readHeader(const char* pch, unsigned int nBytes);
722+    int readData(const char* pch, unsigned int nBytes);
723+
724+public:
725+    V2TransportDeserializer(const CMessageHeader::MessageStartChars& pchMessageStartIn, const CPrivKey& k1, const CPrivKey& k2) : m_aead(new ChaCha20Poly1305AEAD(k1.data(), k1.size(), k2.data(), k2.size())), m_payload_seqnr(0), m_aad_seqnr(0), m_aad_pos(0), vRecv(SER_NETWORK, INIT_PROTO_VERSION)

714+    int m_aad_pos;            // position in the aad keystream
715+    bool m_in_data;           // parsing header (false) or data (true)
716+    uint32_t m_message_size;  // expected message size
717+    CDataStream vRecv;        // received message data
718+    unsigned int m_hdr_pos;   // read pos in header
719+    unsigned int m_data_pos;  // read pos in data

264+        ;
265+    }
266+    return 0; //no short command
267+}
268+
269+bool GetCommandFromShortCommandID(uint8_t shortID, std::string& cmd)

52+    const CPrivKey k1(32, 0);
53+    const CPrivKey k2(32, 0);
54+    const uint256 session_id;
55+    std::unique_ptr<TransportDeserializer> v2_deserializer = MakeUnique<V2TransportDeserializer>(V2TransportDeserializer(k1, k2, session_id));
56+    test_deserializer(v1_deserializer, buffer, CMessageHeader::HEADER_SIZE);
57+    test_deserializer(v2_deserializer, buffer, CHACHA20_POLY1305_AEAD_AAD_LEN + CHACHA20_POLY1305_AEAD_TAG_LEN);

263 
264 /* Get a vector of all valid message types (see above) */
265 const std::vector<std::string> &getAllNetMessageTypes();
266 
267+// Short Command IDs are a low bandwidth representations of a message type
268+// The mapping is a peer to peer agreement

702@@ -701,6 +703,53 @@ class V1TransportDeserializer final : public TransportDeserializer
703     CNetMessage GetMessage(const CMessageHeader::MessageStartChars& message_start, int64_t time) override;
704 };
705 
706+class V2TransportDeserializer : public TransportDeserializer

763@@ -715,6 +764,24 @@ class V1TransportSerializer  : public TransportSerializer {
764     void prepareForTransport(CSerializedNetMsg& msg, std::vector<unsigned char>& header) override;
765 };
766 
767+class V2TransportSerializer : public TransportSerializer
768+{
769+private:
770+    std::unique_ptr<ChaCha20Poly1305AEAD> m_aead;
771+    CPrivKey m_aead_k1; //keep the keys for a later rekeying

729+
730+        memcpy(&vRecv[m_hdr_pos], pch, copy_bytes);
731+        m_hdr_pos += copy_bytes;
732+
733+        // if AAD incomplete, exit
734+        if (m_hdr_pos < CHACHA20_POLY1305_AEAD_AAD_LEN) {

734+        if (m_hdr_pos < CHACHA20_POLY1305_AEAD_AAD_LEN) {
735+            return copy_bytes;
736+        }
737+
738+        // we got the AAD bytes at this point (3 bytes encrypted packet length)
739+        // we keep the sequence numbers unchanged at this point. Once the message is authenticated and decrypted, we increase the sequence numbers (or the aad_pos)

767+    }
768+}
769+
770+CNetMessage V2TransportDeserializer::GetMessage(const CMessageHeader::MessageStartChars& message_start, int64_t time)
771+{
772+    // In v2, vRecv contains the encrypted payload plus the MAC tag (1+bytes serialized message command + ? bytes message payload + 16 byte mac tag)

771+{
772+    // In v2, vRecv contains the encrypted payload plus the MAC tag (1+bytes serialized message command + ? bytes message payload + 16 byte mac tag)
773+    assert(Complete());
774+
775+    // defensive decoding (MAC check, decryption, command deserialization)
776+    // we'll always return a CNetMessage (even if encryption fails), we always increase the AEAD sequence numbers

781+    if (m_aead->Crypt(m_payload_seqnr, m_aad_seqnr, m_aad_pos, (unsigned char*)vRecv.data(), vRecv.size(), (const uint8_t*)vRecv.data(), vRecv.size(), false)) {
782+        // MAC check was successful
783+        valid_checksum = true;
784+
785+        // okay, we could decrypt it, now remove packet length and MAC tag
786+        assert(vRecv.size() > CHACHA20_POLY1305_AEAD_AAD_LEN + CHACHA20_POLY1305_AEAD_TAG_LEN);

825+    CNetMessage msg(std::move(vRecv)); // result in a message with CDataStream with readpos pointing to the message payload
826+    msg.m_command = command_name;
827+
828+    // store state about valid header, netmagic and checksum
829+    msg.m_valid_header = valid_header; // not relevant for v2, always pass
830+    msg.m_valid_checksum = valid_checksum;

805+        // try for short ID
806+        if (!valid_header && size_or_shortid >= 0) {
807+            valid_header = true;
808+            if (!GetCommandFromShortCommandID(size_or_shortid, command_name)) {
809+                // unknown-short-id
810+                //  results in a valid but unknown message (will be skipped)

792+        try {
793+            vRecv >> size_or_shortid;
794+        } catch (const std::ios_base::failure&) {
795+            LogPrint(BCLog::NET, "Invalid command name\n");
796+        }
797+        if (size_or_shortid > 0 && size_or_shortid <= 12 && vRecv.size() >= size_or_shortid) {

758+        // switch state to reading message data
759+        m_in_data = true;
760+
761+        return copy_bytes;
762+    } else {
763+        const unsigned int remaining = m_message_size + CHACHA20_POLY1305_AEAD_TAG_LEN - m_data_pos;

719@@ -718,6 +720,170 @@ CNetMessage V1TransportDeserializer::GetMessage(const CMessageHeader::MessageSta
720     return msg;
721 }
722 
723+int V2TransportDeserializer::Read(const char* pch, unsigned int bytes)
724+{
725+    if (!m_in_data) {

750+            m_message_size &= ~(1U << 23);
751+        }
752+
753+        // reject messages larger than MAX_SIZE
754+        if (m_message_size > MAX_SIZE) {
755+            return -1;

271+// returns 0 if no short command ID has been found
272+uint8_t GetShortCommandIDFromCommand(const std::string cmd);
273+
274+// returns the command (string) from a short command ID
275+// returns an empty string if short command ID has not been found
276+bool GetCommandFromShortCommandID(uint8_t shortID, std::string& cmd);

267+// Short Command IDs are a low bandwidth representations of a message type
268+// The mapping is a peer to peer agreement
269+
270+// returns the short command ID for a command
271+// returns 0 if no short command ID has been found
272+uint8_t GetShortCommandIDFromCommand(const std::string cmd);

203@@ -204,3 +204,127 @@ const std::vector<std::string> &getAllNetMessageTypes()
204 {
205     return allNetMessageTypesVec;
206 }
207+
208+
209+uint8_t GetShortCommandIDFromCommand(const std::string cmd)

902+    size_t serialized_command_size = 1; // short-IDs are 1 byte
903+    const uint8_t cmd_short_id = GetShortCommandIDFromCommand(msg.command);
904+    if (cmd_short_id == 0) {
905+        // message command without an assigned short-ID
906+        assert(msg.command.size() <= 12);
907+        // encode as varstr, max 12 chars

941+    assert(!bit24);
942+
943+    // check if we should rekey after this message
944+    const int64_t now = GetTime(); //TODO: check how expansive the GetTime call is and if it is avoidable
945+    bool rekey = false;
946+    if (m_bytes_encrypted >= (gArgs.GetBoolArg("-netencryptionfastrekey", false) ? 32 * 1024 : REKEY_LIMIT_BYTES) || now - m_time_last_rekey >= (gArgs.GetBoolArg("-netencryptionfastrekey", false) ? 10 : REKEY_LIMIT_TIME)) {

864+
865+            // reset sequence numbers
866+            m_payload_seqnr = 0;
867+            m_aad_seqnr = 0;
868+            m_aad_pos = 0;
869+            m_bytes_decrypted = 0;

708+// Re-key after 1GB (RFC4253 / SSH recommendation) or after 1h
709+static constexpr unsigned int REKEY_LIMIT_BYTES = (1024 * 1024 * 1024);
710+static constexpr unsigned int REKEY_LIMIT_TIME = 3600;
711+static constexpr unsigned int REKEY_ABORT_LIMIT_BYTES = REKEY_LIMIT_BYTES * 1.1; // abort after ~10% tolerance buffer
712+static constexpr unsigned int REKEY_ABORT_LIMIT_TIME = REKEY_LIMIT_BYTES * 1.1;  // abort after ~10% tolerance buffer
713+static constexpr unsigned int MIN_REKEY_TIME = 10;                               // minimal rekey time to avoid DOS

939+    // length is only allowed up to 2^23 (bit24 is used for indicating rekey)
940+    bool bit24 = msg.data[2] & (1u << 7);
941+    assert(!bit24);
942+
943+    // check if we should rekey after this message
944+    const int64_t now = GetTime(); //TODO: check how expansive the GetTime call is and if it is avoidable

326+{
327+    size_t read_bytes = 0;
328+    if (serialized_header.size() > 0) read_bytes += deserializer->Read((const char*)serialized_header.data(), serialized_header.size());
329+    //  second: read the encrypted payload (if required)
330+    if (msg.data.size() > 0) read_bytes += deserializer->Read((const char*)msg.data.data(), msg.data.size());
331+    if (msg.data.size() > read_bytes && msg.data.size() - read_bytes > 0) read_bytes += deserializer->Read((const char*)msg.data.data() + read_bytes, msg.data.size() - read_bytes);

911+    // the packet length excludes the 16 byte MAC tag
912+    uint32_t packet_length = serialized_command_size + msg.data.size();
913+
914+    // prepare the packet length & message command and reserve 4 bytes (3bytes AD + 1byte short-ID)
915+    std::vector<unsigned char> serialized_header(CHACHA20_POLY1305_AEAD_AAD_LEN + 1);
916+    // LE serialize the 24bits length

932+    // TODO: if we refactor the ChaCha20Poly1350 crypt function to allow separate buffers for
933+    //       the AD, payload and MAC, we could avoid a insert and thus a potential reallocation
934+    msg.data.insert(msg.data.begin(), serialized_header.begin(), serialized_header.end());
935+
936+    // resize the message buffer to make space for the MAC tag
937+    msg.data.resize(msg.data.size() + CHACHA20_POLY1305_AEAD_TAG_LEN, 0);

321@@ -320,4 +322,77 @@ BOOST_AUTO_TEST_CASE(PoissonNextSend)
322     g_mock_deterministic_tests = false;
323 }
324 
325+void message_serialize_deserialize_test(bool v2, const std::vector<CSerializedNetMsg>& test_msgs)

740@@ -741,6 +741,15 @@ int V2TransportDeserializer::Read(const char* pch, unsigned int bytes)
741             return -1;
742         }
743 
744+        // check and unset rekey bit
745+        // the counterparty can signal a post-this-message rekey by setting the

740@@ -741,6 +741,15 @@ int V2TransportDeserializer::Read(const char* pch, unsigned int bytes)
741             return -1;
742         }
743 
744+        // check and unset rekey bit
745+        // the counterparty can signal a post-this-message rekey by setting the
746+        // most significant bit in the (unencrypted) length
747+        m_rekey_flag = static_cast<bool>(m_message_size & (1U << 23));
748+        if (m_rekey_flag) {
749+            LogPrint(BCLog::NET, "Rekey flag detected\n");

790@@ -782,6 +791,9 @@ CNetMessage V2TransportDeserializer::GetMessage(const CMessageHeader::MessageSta
791         // MAC check was successful
792         valid_checksum = true;
793 
794+        // count bytes we decrypted including MAC tag + AD

707+// used to encrypt more than 2^70 bytes under the same {key, nonce}
708+// Re-key after 1GB (RFC4253 / SSH recommendation) or after 1h
709+static constexpr unsigned int REKEY_LIMIT_BYTES = (1024 * 1024 * 1024);
710+static constexpr unsigned int REKEY_LIMIT_TIME = 3600;
711+static constexpr unsigned int REKEY_ABORT_LIMIT_BYTES = REKEY_LIMIT_BYTES * 1.1; // abort after ~10% tolerance buffer
712+static constexpr unsigned int REKEY_ABORT_LIMIT_TIME = REKEY_LIMIT_BYTES * 1.1;  // abort after ~10% tolerance buffer

702@@ -703,21 +703,36 @@ class V1TransportDeserializer final : public TransportDeserializer
703     CNetMessage GetMessage(const CMessageHeader::MessageStartChars& message_start, int64_t time) override;
704 };
705 
706+// ChaCha20 must never reuse a {key, nonce} for encryption nor may it be
707+// used to encrypt more than 2^70 bytes under the same {key, nonce}
708+// Re-key after 1GB (RFC4253 / SSH recommendation) or after 1h

869+            m_bytes_decrypted = 0;
870+            m_time_last_rekey = now;
871+        }
872+    } else if (m_bytes_decrypted > REKEY_ABORT_LIMIT_BYTES || now - m_time_last_rekey > REKEY_ABORT_LIMIT_TIME ||
873+               (gArgs.GetBoolArg("-netencryptionfastrekey", false) && m_bytes_decrypted > 64 * 1024)) {
874+        // don't further decrypt and therefore abort connection when counterparty failed to respect rekey limits

730+    unsigned int m_hdr_pos = 0;     // read pos in header
731+    unsigned int m_data_pos = 0;    // read pos in data
732+    bool m_rekey_flag = false;      // rekey in message detected
733+
734+public:
735+    V2TransportDeserializer(const CPrivKey& k1, const CPrivKey& k2, const uint256& session_id) : m_aead(new ChaCha20Poly1305AEAD(k1.data(), k1.size(), k2.data(), k2.size())), m_aead_k1(k1), m_aead_k2(k2), m_time_last_rekey(GetTime()), m_session_id(session_id), vRecv(SER_NETWORK, INIT_PROTO_VERSION)

815+
816+            // use direct read since we already read the varlens size uint8_t
817+            command_name.resize(size_or_shortid);
818+            vRecv.read(&command_name[0], size_or_shortid);
819+        }
820+        // try for short ID in case the first byte is a number larger than 12