xah30
a070da0be9
Lays the foundation for sing-box mobile clients (Option B from
docs/sing-box.md): an independent Go module that speaks the AuraVPN wire
protocol byte-for-byte. Proof of equivalence is in KAT tests cross-loaded
from a Rust-side deterministic vector exporter.
- tools/export-kat (new Rust bin in workspace): captures a handshake +
derived keys + a sealed datagram record + a knock token using seeded
RNGs (rand::rngs::StdRng + ml-kem's *_deterministic public API), emits
JSON. Reproducible byte-for-byte.
- singbox-aura/ (new Go module, ~3000 LOC, 22 files):
- aura/frame: 5-byte protocol header + Frame{Data,Ping,Pong,Close,
Control} + magic envelope (0xAA,0xAA,0xC0,0x01) — encode/decode
matching aura-proto::frame.
- aura/crypto: hybrid X25519 + ML-KEM-768 (stdlib crypto/ecdh +
crypto/mlkem on Go 1.24+; falls back to circl on older Go via a
documented swap), HKDF-SHA256 derive_session_keys, ChaCha20-Poly1305
with the **LE(u64 counter) || [0;4]** nonce scheme that matches
aura-crypto::AeadKey/AeadSession.
- aura/handshake: client_handshake state machine reproducing protocol.md
§6.2 exactly (CH→SH→ServerAuth→ClientAuth→Finished×2; transcript hash;
ECDSA-P256 transcript signature; HMAC-SHA256 Finished).
- aura/session: DatagramSender/Receiver + 64-wide sliding replay window.
- aura/transport: reliable HS-adapter (DTLS-flight retransmit) + UDP
datagram data path + 16-byte HMAC port-knock with ±1-minute window.
- aura/outbound: sing-box-shaped shim (interface signatures only — sing-
box upstream registration is one more step, documented in README).
- cmd/aura-client: standalone Go binary; reads client.toml via
pelletier/go-toml/v2 and connects to a real aura server. Validates
end-to-end interop with the Rust side.
- KAT: 6 comparisons against Rust vectors — session_keys (HKDF), hybrid
KEM ek/encaps roundtrip, c2s + s2c Finished HMAC, sealed datagram
record at seq=2 (incl. 16-byte Poly1305 tag), knock token. All byte-
for-byte.
Go: 29 tests across 5 packages, all green. Only deps: golang.org/x/crypto
and pelletier/go-toml/v2. Rust: 293 tests still green; tools/export-kat
added to workspace members.
v1 limits documented in singbox-aura/README.md: UDP-only (no TCP/QUIC
fallback yet), no cell padding / cover traffic, no relay/exit role, no
multi-hop, sing-box upstream-registration sketch (vendor sagernet/sing-box +
init() RegisterOutbound) for follow-up.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
104 lines
3.0 KiB
Go
104 lines
3.0 KiB
Go
package handshake
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/ecdsa"
|
|
"crypto/elliptic"
|
|
"crypto/rand"
|
|
"crypto/x509"
|
|
"crypto/x509/pkix"
|
|
"encoding/pem"
|
|
"math/big"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/aura/singbox-aura/aura/frame"
|
|
)
|
|
|
|
// TestSplitAndBuildCertAndSigRoundtrip: tiny but load-bearing — Auth payload layout must match
|
|
// the Rust wire format byte-for-byte.
|
|
func TestSplitAndBuildCertAndSigRoundtrip(t *testing.T) {
|
|
cert := bytes.Repeat([]byte{0xAB}, 250)
|
|
sig := []byte{0xCD, 0xEF, 0x01, 0x02}
|
|
enc := buildCertAndSig(cert, sig)
|
|
gotCert, gotSig, err := splitCertAndSig(enc)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !bytes.Equal(gotCert, cert) || !bytes.Equal(gotSig, sig) {
|
|
t.Fatalf("roundtrip mismatch")
|
|
}
|
|
// Empty signature must be rejected.
|
|
if _, _, err := splitCertAndSig(enc[:2+len(cert)]); err == nil {
|
|
t.Fatal("empty sig must error")
|
|
}
|
|
// Truncated cert must be rejected.
|
|
if _, _, err := splitCertAndSig(enc[:3]); err == nil {
|
|
t.Fatal("truncated cert must error")
|
|
}
|
|
}
|
|
|
|
// TestSignVerifyTranscriptRoundtrip: generate an ECDSA P-256 key + self-signed cert, sign a
|
|
// 32-byte transcript with our helper, verify with our helper, asserting we match the Rust side
|
|
// (ECDSA P-256 / SHA-256 / ASN.1 DER).
|
|
func TestSignVerifyTranscriptRoundtrip(t *testing.T) {
|
|
priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Self-signed cert wrapping this key.
|
|
tmpl := &x509.Certificate{
|
|
SerialNumber: big.NewInt(1),
|
|
Subject: pkix.Name{CommonName: "test-leaf"},
|
|
NotBefore: time.Now().Add(-time.Hour),
|
|
NotAfter: time.Now().Add(24 * time.Hour),
|
|
BasicConstraintsValid: true,
|
|
KeyUsage: x509.KeyUsageDigitalSignature,
|
|
SignatureAlgorithm: x509.ECDSAWithSHA256,
|
|
}
|
|
certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &priv.PublicKey, priv)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Wrap our key in PKCS#8 PEM, as the production cert issuance does.
|
|
keyDER, err := x509.MarshalPKCS8PrivateKey(priv)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
keyPEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})
|
|
|
|
var transcript [32]byte
|
|
for i := range transcript {
|
|
transcript[i] = byte(i ^ 0x55)
|
|
}
|
|
sig, err := signTranscript(keyPEM, transcript[:])
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := verifySignature(certDER, transcript[:], sig); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Tampered transcript: verification must fail.
|
|
bad := transcript
|
|
bad[0] ^= 1
|
|
if err := verifySignature(certDER, bad[:], sig); err == nil {
|
|
t.Fatal("tampered transcript must fail")
|
|
}
|
|
}
|
|
|
|
// TestClientHelloLayoutSize: sanity that we compute the expected hello payload size.
|
|
func TestClientHelloLayoutSize(t *testing.T) {
|
|
const expected = 32 + 1184 + 32 // X25519 + ML-KEM ek + nonce
|
|
if expected != 1248 {
|
|
t.Fatalf("ClientHello expected size 1248, got %d", expected)
|
|
}
|
|
// And the on-wire frame adds the 5-byte header.
|
|
hdr, err := frame.EncodeHeader(frame.MsgClientHello, expected)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if hdr[0] != 0x01 || hdr[4] != 0x01 {
|
|
t.Fatalf("header byte 0/4 mismatch: %x", hdr)
|
|
}
|
|
}
|