passepartoutvpn/tunnelkit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #6 from keeshux/block-based-payload-assembly

Browse Source 
Block based payload assembly
This commit is contained in:
Davide De Rosa 2018-08-30 18:01:30 +02:00 committed by GitHub
commit 2f7d41a921
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 226 additions and 201 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
TunnelKit/Sources/Core/CryptoAEAD.h
View File

@ -51,9 +51,6 @@ NS_ASSUME_NONNULL_BEGIN
@interface DataPathCryptoAEAD : NSObject <DataPathEncrypter, DataPathDecrypter>
@property (nonatomic, assign) uint32_t peerId;
@property (nonatomic, assign) CompressionFraming compressionFraming;
- (instancetype)initWithCrypto:(nonnull CryptoAEAD *)crypto;
@end

96
TunnelKit/Sources/Core/CryptoAEAD.m
View File

@ -264,15 +264,16 @@ const NSInteger CryptoAEADTagLength = 16;
- (void)setPeerId:(uint32_t)peerId
{
_peerId = peerId & 0xffffff;
peerId &= 0xffffff;
if (_peerId == PacketPeerIdDisabled) {
if (peerId == PacketPeerIdDisabled) {
self.headerLength = 1;
self.crypto.extraLength = PacketIdLength;
self.crypto.extraPacketIdOffset = 0;
self.setDataHeader = ^(uint8_t *to, uint8_t key) {
PacketHeaderSet(to, PacketCodeDataV1, key);
};
self.checkPeerId = NULL;
}
else {
self.headerLength = 4;
@ -282,87 +283,72 @@ const NSInteger CryptoAEADTagLength = 16;
PacketHeaderSetDataV2(to, key, peerId);
};
self.checkPeerId = ^BOOL(const uint8_t *ptr) {
return (PacketHeaderGetDataV2PeerId(ptr) == self.peerId);
return (PacketHeaderGetDataV2PeerId(ptr) == peerId);
};
}
}
#pragma mark DataPathEncrypter
- (void)assembleDataPacketWithPacketId:(uint32_t)packetId payload:(NSData *)payload into:(uint8_t *)dest length:(NSInteger *)length
- (void)assembleDataPacketWithBlock:(DataPathAssembleBlock)block packetId:(uint32_t)packetId payload:(NSData *)payload into:(uint8_t *)packetBytes length:(NSInteger *)packetLength
{
uint8_t *ptr = dest;
*length = (int)(ptr - dest + payload.length);
switch (self.compressionFraming) {
case CompressionFramingDisabled:
memcpy(ptr, payload.bytes, payload.length);
break;
case CompressionFramingCompress:
memcpy(ptr, payload.bytes, payload.length);
ptr[payload.length] = *ptr;
*ptr = CompressionFramingNoCompressSwap;
*length += sizeof(uint8_t);
break;
case CompressionFramingCompLZO:
memcpy(ptr + sizeof(uint8_t), payload.bytes, payload.length);
*ptr = CompressionFramingNoCompress;
*length += sizeof(uint8_t);
break;
default:
break;
*packetLength = payload.length;
if (!block) {
memcpy(packetBytes, payload.bytes, payload.length);
return;
}
NSInteger packetLengthOffset;
block(packetBytes, &packetLengthOffset, payload);
*packetLength += packetLengthOffset;
}
- (NSData *)encryptedDataPacketWithKey:(uint8_t)key packetId:(uint32_t)packetId payload:(const uint8_t *)payload payloadLength:(NSInteger)payloadLength error:(NSError *__autoreleasing *)error
- (NSData *)encryptedDataPacketWithKey:(uint8_t)key packetId:(uint32_t)packetId packetBytes:(const uint8_t *)packetBytes packetLength:(NSInteger)packetLength error:(NSError *__autoreleasing *)error
{
const int capacity = self.headerLength + PacketIdLength + (int)safe_crypto_capacity(payloadLength, self.crypto.overheadLength);
const int capacity = self.headerLength + PacketIdLength + (int)safe_crypto_capacity(packetLength, self.crypto.overheadLength);
NSMutableData *encryptedPacket = [[NSMutableData alloc] initWithLength:capacity];
uint8_t *ptr = encryptedPacket.mutableBytes;
NSInteger encryptedPayloadLength = INT_MAX;
NSInteger encryptedPacketLength = INT_MAX;
self.setDataHeader(ptr, key);
*(uint32_t *)(ptr + self.headerLength) = htonl(packetId);
const uint8_t *extra = ptr; // AD = header + peer id + packet id
if (self.peerId == PacketPeerIdDisabled) {
if (!self.checkPeerId) {
extra += self.headerLength; // AD = packet id only
}
const BOOL success = [self.crypto encryptBytes:payload
length:payloadLength
const BOOL success = [self.crypto encryptBytes:packetBytes
length:packetLength
dest:(ptr + self.headerLength + PacketIdLength) // skip header and packet id
destLength:&encryptedPayloadLength
destLength:&encryptedPacketLength
extra:extra
error:error];
NSAssert(encryptedPayloadLength <= capacity, @"Did not allocate enough bytes for payload");
NSAssert(encryptedPacketLength <= capacity, @"Did not allocate enough bytes for payload");
if (!success) {
return nil;
}
encryptedPacket.length = self.headerLength + PacketIdLength + encryptedPayloadLength;
encryptedPacket.length = self.headerLength + PacketIdLength + encryptedPacketLength;
return encryptedPacket;
}
#pragma mark DataPathDecrypter
- (BOOL)decryptDataPacket:(NSData *)packet into:(uint8_t *)dest length:(NSInteger *)length packetId:(uint32_t *)packetId error:(NSError *__autoreleasing *)error
- (BOOL)decryptDataPacket:(NSData *)packet into:(uint8_t *)packetBytes length:(NSInteger *)packetLength packetId:(uint32_t *)packetId error:(NSError *__autoreleasing *)error
{
const uint8_t *extra = packet.bytes; // AD = header + peer id + packet id
if (self.peerId == PacketPeerIdDisabled) {
if (!self.checkPeerId) {
extra += self.headerLength; // AD = packet id only
}
// skip header + packet id
const BOOL success = [self.crypto decryptBytes:(packet.bytes + self.headerLength + PacketIdLength)
length:(int)(packet.length - (self.headerLength + PacketIdLength))
dest:dest
destLength:length
dest:packetBytes
destLength:packetLength
extra:extra
error:error];
if (!success) {
@ -378,27 +364,19 @@ const NSInteger CryptoAEADTagLength = 16;
return YES;
}
- (const uint8_t *)parsePayloadWithDataPacket:(uint8_t *)packet packetLength:(NSInteger)packetLength length:(NSInteger *)length
- (const uint8_t *)parsePayloadWithBlock:(DataPathParseBlock)block length:(NSInteger *)length packetBytes:(uint8_t *)packetBytes packetLength:(NSInteger)packetLength
{
uint8_t *ptr = packet;
*length = packetLength - (int)(ptr - packet);
if (self.compressionFraming != CompressionFramingDisabled) {
switch (*ptr) {
case CompressionFramingNoCompress:
ptr += sizeof(uint8_t);
break;
case CompressionFramingNoCompressSwap:
*ptr = packet[packetLength - 1];
break;
default:
NSAssert(NO, @"Compression not supported (found %X)", *ptr);
break;
}
*length -= sizeof(uint8_t);
uint8_t *payload = packetBytes;
*length = packetLength - (int)(payload - packetBytes);
if (!block) {
return payload;
}
return ptr;
NSInteger payloadOffset;
NSInteger payloadHeaderLength;
block(payload, &payloadOffset, &payloadHeaderLength, packetBytes, packetLength);
*length -= payloadHeaderLength;
return payload + payloadOffset;
}
@end

3
TunnelKit/Sources/Core/CryptoCBC.h
View File

@ -50,9 +50,6 @@ NS_ASSUME_NONNULL_BEGIN
@interface DataPathCryptoCBC : NSObject <DataPathEncrypter, DataPathDecrypter>
@property (nonatomic, assign) uint32_t peerId;
@property (nonatomic, assign) CompressionFraming compressionFraming;
- (instancetype)initWithCrypto:(nonnull CryptoCBC *)crypto;
@end

97
TunnelKit/Sources/Core/CryptoCBC.m
View File

@ -266,13 +266,14 @@ const NSInteger CryptoCBCMaxHMACLength = 100;
- (void)setPeerId:(uint32_t)peerId
{
_peerId = peerId & 0xffffff;
peerId &= 0xffffff;
if (_peerId == PacketPeerIdDisabled) {
if (peerId == PacketPeerIdDisabled) {
self.headerLength = 1;
self.setDataHeader = ^(uint8_t *to, uint8_t key) {
PacketHeaderSet(to, PacketCodeDataV1, key);
};
self.checkPeerId = NULL;
}
else {
self.headerLength = 4;
@ -280,76 +281,62 @@ const NSInteger CryptoCBCMaxHMACLength = 100;
PacketHeaderSetDataV2(to, key, peerId);
};
self.checkPeerId = ^BOOL(const uint8_t *ptr) {
return (PacketHeaderGetDataV2PeerId(ptr) == self.peerId);
return (PacketHeaderGetDataV2PeerId(ptr) == peerId);
};
}
}
#pragma mark DataPathEncrypter
- (void)assembleDataPacketWithPacketId:(uint32_t)packetId payload:(NSData *)payload into:(uint8_t *)dest length:(NSInteger *)length
- (void)assembleDataPacketWithBlock:(DataPathAssembleBlock)block packetId:(uint32_t)packetId payload:(NSData *)payload into:(uint8_t *)packetBytes length:(NSInteger *)packetLength
{
uint8_t *ptr = dest;
uint8_t *ptr = packetBytes;
*(uint32_t *)ptr = htonl(packetId);
ptr += sizeof(uint32_t);
*length = (int)(ptr - dest + payload.length);
switch (self.compressionFraming) {
case CompressionFramingDisabled:
memcpy(ptr, payload.bytes, payload.length);
break;
case CompressionFramingCompress:
memcpy(ptr, payload.bytes, payload.length);
ptr[payload.length] = *ptr;
*ptr = CompressionFramingNoCompressSwap;
*length += sizeof(uint8_t);
break;
case CompressionFramingCompLZO:
memcpy(ptr + sizeof(uint8_t), payload.bytes, payload.length);
*ptr = CompressionFramingNoCompress;
*length += sizeof(uint8_t);
break;
default:
break;
*packetLength = (int)(ptr - packetBytes + payload.length);
if (!block) {
memcpy(ptr, payload.bytes, payload.length);
return;
}
NSInteger packetLengthOffset;
block(ptr, &packetLengthOffset, payload);
*packetLength += packetLengthOffset;
}
- (NSData *)encryptedDataPacketWithKey:(uint8_t)key packetId:(uint32_t)packetId payload:(const uint8_t *)payload payloadLength:(NSInteger)payloadLength error:(NSError *__autoreleasing *)error
- (NSData *)encryptedDataPacketWithKey:(uint8_t)key packetId:(uint32_t)packetId packetBytes:(const uint8_t *)packetBytes packetLength:(NSInteger)packetLength error:(NSError *__autoreleasing *)error
{
const int capacity = self.headerLength + (int)safe_crypto_capacity(payloadLength, self.crypto.overheadLength);
const int capacity = self.headerLength + (int)safe_crypto_capacity(packetLength, self.crypto.overheadLength);
NSMutableData *encryptedPacket = [[NSMutableData alloc] initWithLength:capacity];
uint8_t *ptr = encryptedPacket.mutableBytes;
NSInteger encryptedPayloadLength = INT_MAX;
const BOOL success = [self.crypto encryptBytes:payload
length:payloadLength
NSInteger encryptedPacketLength = INT_MAX;
const BOOL success = [self.crypto encryptBytes:packetBytes
length:packetLength
dest:(ptr + self.headerLength) // skip header byte
destLength:&encryptedPayloadLength
destLength:&encryptedPacketLength
extra:NULL
error:error];
NSAssert(encryptedPayloadLength <= capacity, @"Did not allocate enough bytes for payload");
NSAssert(encryptedPacketLength <= capacity, @"Did not allocate enough bytes for payload");
if (!success) {
return nil;
}
self.setDataHeader(ptr, key);
encryptedPacket.length = self.headerLength + encryptedPayloadLength;
encryptedPacket.length = self.headerLength + encryptedPacketLength;
return encryptedPacket;
}
#pragma mark DataPathDecrypter
- (BOOL)decryptDataPacket:(NSData *)packet into:(uint8_t *)dest length:(NSInteger *)length packetId:(nonnull uint32_t *)packetId error:(NSError *__autoreleasing *)error
- (BOOL)decryptDataPacket:(NSData *)packet into:(uint8_t *)packetBytes length:(NSInteger *)packetLength packetId:(uint32_t *)packetId error:(NSError *__autoreleasing *)error
{
// skip header = (code, key)
const BOOL success = [self.crypto decryptBytes:(packet.bytes + self.headerLength)
length:(int)(packet.length - self.headerLength)
dest:dest
destLength:length
dest:packetBytes
destLength:packetLength
extra:NULL
error:error];
if (!success) {
@ -361,32 +348,24 @@ const NSInteger CryptoCBCMaxHMACLength = 100;
}
return NO;
}
*packetId = ntohl(*(uint32_t *)dest);
*packetId = ntohl(*(uint32_t *)packetBytes);
return YES;
}
- (const uint8_t *)parsePayloadWithDataPacket:(uint8_t *)packet packetLength:(NSInteger)packetLength length:(NSInteger *)length
- (const uint8_t *)parsePayloadWithBlock:(DataPathParseBlock)block length:(NSInteger *)length packetBytes:(uint8_t *)packetBytes packetLength:(NSInteger)packetLength
{
uint8_t *ptr = packet;
ptr += sizeof(uint32_t); // packet id
*length = packetLength - (int)(ptr - packet);
if (self.compressionFraming != CompressionFramingDisabled) {
switch (*ptr) {
case CompressionFramingNoCompress:
ptr += sizeof(uint8_t);
break;
case CompressionFramingNoCompressSwap:
*ptr = packet[packetLength - 1];
break;
default:
NSAssert(NO, @"Compression not supported (found %X)", *ptr);
break;
}
*length -= sizeof(uint8_t);
uint8_t *payload = packetBytes;
payload += sizeof(uint32_t); // packet id
*length = packetLength - (int)(payload - packetBytes);
if (!block) {
return payload;
}
return ptr;
NSInteger payloadOffset;
NSInteger payloadHeaderLength;
block(payload, &payloadOffset, &payloadHeaderLength, packetBytes, packetLength);
*length -= payloadHeaderLength;
return payload + payloadOffset;
}
@end

122
TunnelKit/Sources/Core/DataPath.m
View File

@ -64,6 +64,9 @@
@property (nonatomic, assign) int decBufferCapacity;
@property (nonatomic, strong) ReplayProtector *inReplay;
@property (nonatomic, copy) DataPathAssembleBlock assemblePayloadBlock;
@property (nonatomic, copy) DataPathParseBlock parsePayloadBlock;
@end
@implementation DataPath
@ -105,6 +108,8 @@
if (usesReplayProtection) {
self.inReplay = [[ReplayProtector alloc] init];
}
self.compressionFraming = CompressionFramingDisabled;
}
return self;
}
@ -156,24 +161,60 @@
NSAssert(self.encrypter, @"Setting peer-id to nil encrypter");
NSAssert(self.decrypter, @"Setting peer-id to nil decrypter");
self.encrypter.peerId = peerId;
self.decrypter.peerId = peerId;
[self.encrypter setPeerId:peerId];
[self.decrypter setPeerId:peerId];
}
- (void)setCompressionFraming:(CompressionFraming)compressionFraming
{
NSAssert(self.encrypter, @"Setting compressionFraming to nil encrypter");
NSAssert(self.decrypter, @"Setting compressionFraming to nil decrypter");
self.encrypter.compressionFraming = compressionFraming;
self.decrypter.compressionFraming = compressionFraming;
switch (compressionFraming) {
case CompressionFramingDisabled: {
self.assemblePayloadBlock = ^(uint8_t * _Nonnull packetDest, NSInteger * _Nonnull packetLengthOffset, NSData * _Nonnull payload) {
memcpy(packetDest, payload.bytes, payload.length);
*packetLengthOffset = 0;
};
self.parsePayloadBlock = ^(uint8_t * _Nonnull payload, NSInteger *payloadOffset, NSInteger * _Nonnull headerLength, const uint8_t * _Nonnull packet, NSInteger packetLength) {
*payloadOffset = 0;
*headerLength = 0;
};
break;
}
case CompressionFramingCompress: {
self.assemblePayloadBlock = ^(uint8_t * _Nonnull packetDest, NSInteger * _Nonnull packetLengthOffset, NSData * _Nonnull payload) {
memcpy(packetDest, payload.bytes, payload.length);
packetDest[payload.length] = packetDest[0];
packetDest[0] = CompressionFramingNoCompressSwap;
*packetLengthOffset = 1;
};
self.parsePayloadBlock = ^(uint8_t * _Nonnull payload, NSInteger *payloadOffset, NSInteger * _Nonnull headerLength, const uint8_t * _Nonnull packet, NSInteger packetLength) {
NSCAssert(payload[0] == CompressionFramingNoCompressSwap, @"Expected NO_COMPRESS_SWAP (found %X != %X)", payload[0], CompressionFramingNoCompressSwap);
payload[0] = packet[packetLength - 1];
*payloadOffset = 0;
*headerLength = 1;
};
break;
}
case CompressionFramingCompLZO: {
self.assemblePayloadBlock = ^(uint8_t * _Nonnull packetDest, NSInteger * _Nonnull packetLengthOffset, NSData * _Nonnull payload) {
memcpy(packetDest + 1, payload.bytes, payload.length);
packetDest[0] = CompressionFramingNoCompress;
*packetLengthOffset = 1;
};
self.parsePayloadBlock = ^(uint8_t * _Nonnull payload, NSInteger *payloadOffset, NSInteger * _Nonnull headerLength, const uint8_t * _Nonnull packet, NSInteger packetLength) {
NSCAssert(payload[0] == CompressionFramingNoCompress, @"Expected NO_COMPRESS (found %X != %X)", payload[0], CompressionFramingNoCompress);
*payloadOffset = 1;
*headerLength = 1;
};
break;
}
}
}
#pragma mark DataPath
- (NSArray<NSData *> *)encryptPackets:(NSArray<NSData *> *)packets key:(uint8_t)key error:(NSError *__autoreleasing *)error
{
NSAssert(self.encrypter.peerId == self.decrypter.peerId, @"Peer-id mismatch in DataPath encrypter/decrypter");
// NSAssert(self.encrypter.peerId == self.decrypter.peerId, @"Peer-id mismatch in DataPath encrypter/decrypter");
if (self.outPacketId > self.maxPacketId) {
if (error) {
@ -184,53 +225,53 @@
[self.outPackets removeAllObjects];
for (NSData *raw in packets) {
for (NSData *payload in packets) {
self.outPacketId += 1;
// may resize encBuffer to hold encrypted payload
[self adjustEncBufferToPacketSize:(int)raw.length];
[self adjustEncBufferToPacketSize:(int)payload.length];
uint8_t *payload = self.encBufferAligned;
NSInteger payloadLength;
[self.encrypter assembleDataPacketWithPacketId:self.outPacketId
payload:raw
into:payload
length:&payloadLength];
MSSFix(payload, payloadLength);
uint8_t *dataPacketBytes = self.encBufferAligned;
NSInteger dataPacketLength;
[self.encrypter assembleDataPacketWithBlock:self.assemblePayloadBlock
packetId:self.outPacketId
payload:payload
into:dataPacketBytes
length:&dataPacketLength];
MSSFix(dataPacketBytes, dataPacketLength);
NSData *encryptedPacket = [self.encrypter encryptedDataPacketWithKey:key
packetId:self.outPacketId
payload:payload
payloadLength:payloadLength
error:error];
if (!encryptedPacket) {
NSData *encryptedDataPacket = [self.encrypter encryptedDataPacketWithKey:key
packetId:self.outPacketId
packetBytes:dataPacketBytes
packetLength:dataPacketLength
error:error];
if (!encryptedDataPacket) {
return nil;
}
[self.outPackets addObject:encryptedPacket];
[self.outPackets addObject:encryptedDataPacket];
}
return self.outPackets;
}
//- (NSArray<NSData *> *)decryptPackets:(NSArray<NSData *> *)packets error:(NSError *__autoreleasing *)error
- (NSArray<NSData *> *)decryptPackets:(NSArray<NSData *> *)packets keepAlive:(bool *)keepAlive error:(NSError *__autoreleasing *)error
{
NSAssert(self.encrypter.peerId == self.decrypter.peerId, @"Peer-id mismatch in DataPath encrypter/decrypter");
// NSAssert(self.encrypter.peerId == self.decrypter.peerId, @"Peer-id mismatch in DataPath encrypter/decrypter");
[self.inPackets removeAllObjects];
for (NSData *encryptedPacket in packets) {
for (NSData *encryptedDataPacket in packets) {
// may resize decBuffer to encryptedPacket.length
[self adjustDecBufferToPacketSize:(int)encryptedPacket.length];
[self adjustDecBufferToPacketSize:(int)encryptedDataPacket.length];
uint8_t *packet = self.decBufferAligned;
NSInteger packetLength = INT_MAX;
uint8_t *dataPacketBytes = self.decBufferAligned;
NSInteger dataPacketLength = INT_MAX;
uint32_t packetId;
const BOOL success = [self.decrypter decryptDataPacket:encryptedPacket
into:packet
length:&packetLength
const BOOL success = [self.decrypter decryptDataPacket:encryptedDataPacket
into:dataPacketBytes
length:&dataPacketLength
packetId:&packetId
error:error];
if (!success) {
@ -247,21 +288,22 @@
}
NSInteger payloadLength;
const uint8_t *payload = [self.decrypter parsePayloadWithDataPacket:packet
packetLength:packetLength
length:&payloadLength];
const uint8_t *payloadBytes = [self.decrypter parsePayloadWithBlock:self.parsePayloadBlock
length:&payloadLength
packetBytes:dataPacketBytes
packetLength:dataPacketLength];
if ((payloadLength == sizeof(DataPacketPingData)) && !memcmp(payload, DataPacketPingData, payloadLength)) {
if ((payloadLength == sizeof(DataPacketPingData)) && !memcmp(payloadBytes, DataPacketPingData, payloadLength)) {
if (keepAlive) {
*keepAlive = true;
}
continue;
}
// MSSFix(payload, payloadLength);
// MSSFix(payloadBytes, payloadLength);
NSData *raw = [[NSData alloc] initWithBytes:payload length:payloadLength];
[self.inPackets addObject:raw];
NSData *payload = [[NSData alloc] initWithBytes:payloadBytes length:payloadLength];
[self.inPackets addObject:payload];
}
return self.inPackets;

14
TunnelKit/Sources/Core/DataPathEncryption.h
View File

@ -36,26 +36,26 @@
#import <Foundation/Foundation.h>
typedef void (^DataPathAssembleBlock)(uint8_t *_Nonnull packetDest, NSInteger *_Nonnull packetLengthOffset, NSData *_Nonnull payload);
typedef void (^DataPathParseBlock)(uint8_t *_Nonnull payload, NSInteger *_Nonnull payloadOffset, NSInteger *_Nonnull headerLength, const uint8_t *_Nonnull packet, NSInteger packetLength);
@protocol DataPathChannel
- (int)overheadLength;
- (uint32_t)peerId;
- (void)setPeerId:(uint32_t)peerId;
- (CompressionFraming)compressionFraming;
- (void)setCompressionFraming:(CompressionFraming)compressionFraming;
@end
@protocol DataPathEncrypter <DataPathChannel>
- (void)assembleDataPacketWithPacketId:(uint32_t)packetId payload:(NSData *)payload into:(nonnull uint8_t *)dest length:(nonnull NSInteger *)length;
- (NSData *)encryptedDataPacketWithKey:(uint8_t)key packetId:(uint32_t)packetId payload:(const uint8_t *)payload payloadLength:(NSInteger)payloadLength error:(NSError **)error;
- (void)assembleDataPacketWithBlock:(DataPathAssembleBlock)block packetId:(uint32_t)packetId payload:(NSData *)payload into:(nonnull uint8_t *)packetBytes length:(nonnull NSInteger *)packetLength;
- (NSData *)encryptedDataPacketWithKey:(uint8_t)key packetId:(uint32_t)packetId packetBytes:(const uint8_t *)packetBytes packetLength:(NSInteger)packetLength error:(NSError **)error;
@end
@protocol DataPathDecrypter <DataPathChannel>
- (BOOL)decryptDataPacket:(nonnull NSData *)packet into:(nonnull uint8_t *)dest length:(nonnull NSInteger *)length packetId:(nonnull uint32_t *)packetId error:(NSError **)error;
- (nonnull const uint8_t *)parsePayloadWithDataPacket:(nonnull uint8_t *)packet packetLength:(NSInteger)packetLength length:(nonnull NSInteger *)length;
- (BOOL)decryptDataPacket:(nonnull NSData *)packet into:(nonnull uint8_t *)packetBytes length:(nonnull NSInteger *)packetLength packetId:(nonnull uint32_t *)packetId error:(NSError **)error;
- (nonnull const uint8_t *)parsePayloadWithBlock:(DataPathParseBlock)block length:(nonnull NSInteger *)length packetBytes:(nonnull uint8_t *)packetBytes packetLength:(NSInteger)packetLength;
@end

92
TunnelKitTests/DataPathEncryptionTests.swift
View File

@ -40,13 +40,15 @@ import XCTest
@testable import __TunnelKitNative
class DataPathEncryptionTests: XCTestCase {
private var cipherKey: ZeroingData!
private let cipherKey = try! SecureRandom.safeData(length: 32)
private let hmacKey = try! SecureRandom.safeData(length: 32)
private var enc: DataPathEncrypter!
private var hmacKey: ZeroingData!
private var dec: DataPathDecrypter!
override func setUp() {
cipherKey = try! SecureRandom.safeData(length: 32)
hmacKey = try! SecureRandom.safeData(length: 32)
}
override func tearDown() {
@ -54,53 +56,83 @@ class DataPathEncryptionTests: XCTestCase {
}
func testCBC() {
privateTestDataPath(cipher: "aes-128-cbc", digest: "sha256", peerId: nil)
prepareBox(cipher: "aes-128-cbc", digest: "sha256")
privateTestDataPathHigh(peerId: nil)
privateTestDataPathLow(peerId: nil)
}
func testFloatingCBC() {
privateTestDataPath(cipher: "aes-128-cbc", digest: "sha256", peerId: 0x64385837)
prepareBox(cipher: "aes-128-cbc", digest: "sha256")
privateTestDataPathHigh(peerId: 0x64385837)
privateTestDataPathLow(peerId: 0x64385837)
}
func testGCM() {
privateTestDataPath(cipher: "aes-256-gcm", digest: nil, peerId: nil)
prepareBox(cipher: "aes-256-gcm", digest: nil)
privateTestDataPathHigh(peerId: nil)
privateTestDataPathLow(peerId: nil)
}
func testFloatingGCM() {
privateTestDataPath(cipher: "aes-256-gcm", digest: nil, peerId: 0x64385837)
prepareBox(cipher: "aes-256-gcm", digest: nil)
privateTestDataPathHigh(peerId: 0x64385837)
privateTestDataPathLow(peerId: 0x64385837)
}
func privateTestDataPath(cipher: String, digest: String?, peerId: UInt32?) {
func prepareBox(cipher: String, digest: String?) {
let box = CryptoBox(cipherAlgorithm: cipher, digestAlgorithm: digest)
try! box.configure(withCipherEncKey: cipherKey, cipherDecKey: cipherKey, hmacEncKey: hmacKey, hmacDecKey: hmacKey)
let enc = box.encrypter().dataPathEncrypter()
let dec = box.decrypter().dataPathDecrypter()
enc = box.encrypter().dataPathEncrypter()
dec = box.decrypter().dataPathDecrypter()
}
func privateTestDataPathHigh(peerId: UInt32?) {
let path = DataPath(encrypter: enc, decrypter: dec, maxPackets: 1000, usesReplayProtection: false)
path.setCompressionFraming(.disabled)
if let peerId = peerId {
enc.setPeerId(peerId)
dec.setPeerId(peerId)
XCTAssertEqual(enc.peerId(), peerId & 0xffffff)
XCTAssertEqual(dec.peerId(), peerId & 0xffffff)
// XCTAssertEqual(enc.peerId(), peerId & 0xffffff)
// XCTAssertEqual(dec.peerId(), peerId & 0xffffff)
}
// enc.setLZOFraming(true)
// dec.setLZOFraming(true)
let payload = Data(hex: "00112233445566778899")
let packetId: UInt32 = 0x56341200
let expectedPayload = Data(hex: "00112233445566778899")
let key: UInt8 = 4
var encryptedPayload: [UInt8] = [UInt8](repeating: 0, count: 1000)
var encryptedPayloadLength: Int = 0
enc.assembleDataPacket(withPacketId: packetId, payload: payload, into: &encryptedPayload, length: &encryptedPayloadLength)
let encrypted = try! enc.encryptedDataPacket(withKey: key, packetId: packetId, payload: encryptedPayload, payloadLength: encryptedPayloadLength)
var decrypted: [UInt8] = [UInt8](repeating: 0, count: 1000)
let encrypted = try! path.encryptPackets([expectedPayload], key: key)
let decrypted = try! path.decryptPackets(encrypted, keepAlive: nil)
let payload = decrypted.first!
XCTAssertEqual(payload, expectedPayload)
}
func privateTestDataPathLow(peerId: UInt32?) {
if let peerId = peerId {
enc.setPeerId(peerId)
dec.setPeerId(peerId)
// XCTAssertEqual(enc.peerId(), peerId & 0xffffff)
// XCTAssertEqual(dec.peerId(), peerId & 0xffffff)
}
let expectedPayload = Data(hex: "00112233445566778899")
let expectedPacketId: UInt32 = 0x56341200
let key: UInt8 = 4
var encryptedPacketBytes: [UInt8] = [UInt8](repeating: 0, count: 1000)
var encryptedPacketLength: Int = 0
enc.assembleDataPacket(nil, packetId: expectedPacketId, payload: expectedPayload, into: &encryptedPacketBytes, length: &encryptedPacketLength)
let encrypted = try! enc.encryptedDataPacket(withKey: key, packetId: expectedPacketId, packetBytes: encryptedPacketBytes, packetLength: encryptedPacketLength)
var decryptedBytes: [UInt8] = [UInt8](repeating: 0, count: 1000)
var decryptedLength: Int = 0
var decryptedPacketId: UInt32 = 0
var decryptedPayloadLength: Int = 0
try! dec.decryptDataPacket(encrypted, into: &decrypted, length: &decryptedLength, packetId: &decryptedPacketId)
let decryptedPtr = dec.parsePayload(withDataPacket: &decrypted, packetLength: decryptedLength, length: &decryptedPayloadLength)
let decryptedPayload = Data(bytes: decryptedPtr, count: decryptedPayloadLength)
var packetId: UInt32 = 0
var payloadLength: Int = 0
try! dec.decryptDataPacket(encrypted, into: &decryptedBytes, length: &decryptedLength, packetId: &packetId)
let payloadBytes = dec.parsePayload(nil, length: &payloadLength, packetBytes: &decryptedBytes, packetLength: decryptedLength)
let payload = Data(bytes: payloadBytes, count: payloadLength)
XCTAssertEqual(payload, decryptedPayload)
XCTAssertEqual(packetId, decryptedPacketId)
XCTAssertEqual(payload, expectedPayload)
XCTAssertEqual(packetId, expectedPacketId)
}
}