aead reader and writer

common/crypto/auth.go

@@ -0,0 +1,111 @@
+package crypto
+
+import (
+	"crypto/cipher"
+	"errors"
+	"io"
+	"v2ray.com/core/common/alloc"
+	"v2ray.com/core/common/serial"
+)
+
+var (
+	ErrAuthenticationFailed = errors.New("Authentication failed.")
+	errInsufficientBuffer   = errors.New("Insufficient buffer.")
+)
+
+type BytesGenerator func() []byte
+
+type AuthenticationReader struct {
+	aead     cipher.AEAD
+	buffer   *alloc.Buffer
+	reader   io.Reader
+	ivGen    BytesGenerator
+	extraGen BytesGenerator
+
+	chunk []byte
+}
+
+func NewAuthenticationReader(aead cipher.AEAD, reader io.Reader, ivGen BytesGenerator, extraGen BytesGenerator) *AuthenticationReader {
+	return &AuthenticationReader{
+		aead:     aead,
+		buffer:   alloc.NewLocalBuffer(32 * 1024),
+		reader:   reader,
+		ivGen:    ivGen,
+		extraGen: extraGen,
+	}
+}
+
+func (v *AuthenticationReader) NextChunk() error {
+	size := int(serial.BytesToUint16(v.buffer.BytesTo(2)))
+	if size > v.buffer.Len()-2 {
+		return errInsufficientBuffer
+	}
+	cipherChunk := v.buffer.BytesRange(2, size+2)
+	plainChunk, err := v.aead.Open(cipherChunk, v.ivGen(), cipherChunk, v.extraGen())
+	if err != nil {
+		return err
+	}
+	v.chunk = plainChunk
+	return nil
+}
+
+func (v *AuthenticationReader) CopyChunk(b []byte) int {
+	nBytes := copy(b, v.chunk)
+	if nBytes == len(v.chunk) {
+		v.chunk = nil
+	} else {
+		v.chunk = v.chunk[nBytes:]
+	}
+	return nBytes
+}
+
+func (v *AuthenticationReader) Read(b []byte) (int, error) {
+	if len(v.chunk) > 0 {
+		nBytes := v.CopyChunk(b)
+		return nBytes, nil
+	}
+
+	err := v.NextChunk()
+	if err == errInsufficientBuffer {
+		v.buffer.FillFrom(v.reader)
+	} else if err != nil {
+		return 0, io.ErrUnexpectedEOF
+	}
+
+	totalBytes := 0
+	for {
+		totalBytes += v.CopyChunk(b)
+		if len(b) == 0 {
+			break
+		}
+		if err := v.NextChunk(); err != nil {
+			break
+		}
+	}
+	return totalBytes, nil
+}
+
+type AuthenticationWriter struct {
+	aead     cipher.AEAD
+	buffer   []byte
+	writer   io.Writer
+	ivGen    BytesGenerator
+	extraGen BytesGenerator
+}
+
+func NewAuthenticationWriter(aead cipher.AEAD, writer io.Writer, ivGen BytesGenerator, extraGen BytesGenerator) *AuthenticationWriter {
+	return &AuthenticationWriter{
+		aead:     aead,
+		buffer:   make([]byte, 32*1024),
+		writer:   writer,
+		ivGen:    ivGen,
+		extraGen: extraGen,
+	}
+}
+
+func (v *AuthenticationWriter) Write(b []byte) (int, error) {
+	cipherChunk := v.aead.Seal(v.buffer[2:], v.ivGen(), b, v.extraGen())
+	serial.Uint16ToBytes(uint16(len(cipherChunk)), b[:0])
+	_, err := v.writer.Write(v.buffer[:2+len(cipherChunk)])
+	return len(b), err
+}

proxy/vmess/encoding/auth.go

@@ -2,6 +2,8 @@ package encoding
 
 import (
 	"hash/fnv"
+	"v2ray.com/core/common/crypto"
+	"v2ray.com/core/common/serial"
 )
 
 func Authenticate(b []byte) uint32 {
@@ -9,3 +11,26 @@ func Authenticate(b []byte) uint32 {
 	fnv1hash.Write(b)
 	return fnv1hash.Sum32()
 }
+
+type FnvAuthenticator struct {
+}
+
+func (v *FnvAuthenticator) NonceSize() int {
+	return 0
+}
+
+func (v *FnvAuthenticator) Overhead() int {
+	return 4
+}
+
+func (v *FnvAuthenticator) Seal(dst, nonce, plaintext, additionalData []byte) []byte {
+	dst = serial.Uint32ToBytes(Authenticate(plaintext), dst[:0])
+	return append(dst, plaintext...)
+}
+
+func (v *FnvAuthenticator) Open(dst, nonce, ciphertext, additionalData []byte) ([]byte, error) {
+	if serial.BytesToUint32(ciphertext[:4]) != Authenticate(ciphertext[4:]) {
+		return dst, crypto.ErrAuthenticationFailed
+	}
+	return append(dst[:0], ciphertext[4:]...), nil
+}

proxy/vmess/inbound/inbound.go

@@ -9,6 +9,7 @@ import (
 	"v2ray.com/core/app/proxyman"
 	"v2ray.com/core/common"
 	"v2ray.com/core/common/alloc"
+	"v2ray.com/core/common/crypto"
 	"v2ray.com/core/common/errors"
 	v2io "v2ray.com/core/common/io"
 	"v2ray.com/core/common/loader"
@@ -189,7 +190,8 @@ func (v *VMessInboundHandler) HandleConnection(connection internet.Connection) {
 		bodyReader := session.DecodeRequestBody(reader)
 		var requestReader v2io.Reader
 		if request.Option.Has(protocol.RequestOptionChunkStream) {
-			requestReader = vmessio.NewAuthChunkReader(bodyReader)
+			authReader := crypto.NewAuthenticationReader(new(encoding.FnvAuthenticator), bodyReader, func() []byte { return nil }, func() []byte { return nil })
+			requestReader = v2io.NewAdaptiveReader(authReader)
 		} else {
 			requestReader = v2io.NewAdaptiveReader(bodyReader)
 		}