feat: header MAC

Cargo.toml

@@ -22,7 +22,7 @@ tabled = "0.15"
 thiserror = "1"
 tokio = "1"
 tokio-util = "0.7"
-tokio_chacha20 = { git = "https://github.com/Banyc/tokio_chacha20.git", rev = "3e8835dc6143c1c5ecd664d5af3d6fa8229cf4e3" }
+tokio_chacha20 = { git = "https://github.com/Banyc/tokio_chacha20.git", rev = "246bc1df7c449d608c3a74d8d4ee79cd1d0b983f" }
 tokio_kcp = "0.9"
 tracing = "0.1"
 tracing-subscriber = "0.3"

common/src/header/codec.rs

@@ -39,17 +39,29 @@ where
     };
     trace!(len, "Read header length");
 
+    // Read header
+    if len > MAX_HEADER_LEN {
+        return Err(CodecError::Io(io::Error::new(
+            io::ErrorKind::InvalidData,
+            "Header too long",
+        )));
+    }
+    let hdr = &mut buf[..len];
+    let res = reader.read_exact(hdr);
+    add_await([res])?;
+
+    // Check MAC
+    let mut tag = [0; 16];
+    let res = reader.read_exact(&mut tag);
+    add_await([res])?;
+    let key = cursor.poly1305_key().unwrap();
+    let expected_tag = tokio_chacha20::mac::poly1305_mac(key, hdr);
+    if tag != expected_tag {
+        return Err(CodecError::Integrity);
+    }
+
     // Decode header
     let header = {
-        if len > MAX_HEADER_LEN {
-            return Err(CodecError::Io(io::Error::new(
-                io::ErrorKind::InvalidData,
-                "Header too long",
-            )));
-        }
-        let hdr = &mut buf[..len];
-        let res = reader.read_exact(hdr);
-        add_await([res])?;
         let i = cursor.decrypt(hdr).unwrap();
         assert_eq!(i, 0);
         bincode::deserialize(hdr)?
@@ -99,8 +111,15 @@ where
     // Write header
     let (f, t) = cursor.encrypt(hdr, &mut buf[n..]);
     assert_eq!(hdr.len(), f);
+    let encrypted_hdr = &buf[n..n + t];
     n += t;
 
+    // Write tag
+    let key = cursor.poly1305_key();
+    let tag = tokio_chacha20::mac::poly1305_mac(key, encrypted_hdr);
+    buf[n..n + tag.len()].copy_from_slice(&tag);
+    n += tag.len();
+
     add_await([writer.write_all(&buf[..n])])?;
 
     Ok(())
@@ -151,4 +170,6 @@ pub enum CodecError {
     Io(#[from] io::Error),
     #[error("Serialization error: {0}")]
     Serialization(#[from] bincode::Error),
+    #[error("Data tempered")]
+    Integrity,
 }

common/src/udp/steer.rs

@@ -81,6 +81,6 @@ async fn handle_steer_error(
 fn error_kind_from_header_error(e: &CodecError) -> RouteErrorKind {
     match e {
         CodecError::Io(_) => RouteErrorKind::Io,
-        CodecError::Serialization(_) => RouteErrorKind::Codec,
+        CodecError::Serialization(_) | CodecError::Integrity => RouteErrorKind::Codec,
     }
 }