From 366386badeb5e474441aede3d3e62ab95812c423 Mon Sep 17 00:00:00 2001 From: Niko Marmeladkov Date: Wed, 1 Jul 2026 17:15:05 +0300 Subject: [PATCH] Various fixes: cert auth lookup by number, debug logging, mobile client - handleAuthCert: find identity by cert CommonName instead of pubkey - Add debug log to HandleDial - mobile: AuthenticateB64, NewClientWithKey, recover guards - go mod tidy --- go.mod | 2 +- go.sum | 18 +-- internal/call/signaling.go | 16 +-- internal/server/server.go | 2 +- mobile/client.go | 254 ++++++++++++++++++++++++++++++++++--- 5 files changed, 246 insertions(+), 46 deletions(-) diff --git a/go.mod b/go.mod index 3ac05cb..8305ca5 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/niko/qcc -go 1.26 +go 1.25.0 require ( github.com/apernet/quic-go v0.59.1-0.20260425001925-6c6cc9bcb716 diff --git a/go.sum b/go.sum index d6c226a..701d198 100644 --- a/go.sum +++ b/go.sum @@ -82,16 +82,12 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= -golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= -golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= golang.org/x/mobile v0.0.0-20260611195102-4dd8f1dbf5d2 h1:zoM1gIKhVkcQNm43kad8OHLgPNoJ12xIqmxHtKr8Mug= golang.org/x/mobile v0.0.0-20260611195102-4dd8f1dbf5d2/go.mod h1:QGMqsqLn6orFQ/ksqYMf+Fa33Soa1vPoHEd0Pj7N+lQ= golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= -golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -100,14 +96,10 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220630215102-69896b714898/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= -golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= -golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -120,8 +112,6 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= -golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -130,8 +120,6 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= -golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -139,10 +127,12 @@ golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= -golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= -golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk= golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys= +golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= +golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/internal/call/signaling.go b/internal/call/signaling.go index 02a31b0..4f36058 100644 --- a/internal/call/signaling.go +++ b/internal/call/signaling.go @@ -291,23 +291,19 @@ func (m *Manager) GetCall(callID uint64) *Call { return m.calls[callID] } -func (m *Manager) RelayMedia(sender *quic.Conn, data []byte) { - pkt, ok := protocol.UnmarshalMediaPacket(data) - if !ok { - return - } - +func (m *Manager) RelayMedia(senderSess CallSession, data []byte) { + callID := senderSess.CallID() m.mu.RLock() - call, exists := m.calls[pkt.CallID] + call, exists := m.calls[callID] m.mu.RUnlock() if !exists || !call.Active { return } var target *quic.Conn - if sender == call.FromSess.Conn() { + if senderSess == call.FromSess { target = call.ToSess.Conn() - } else if sender == call.ToSess.Conn() { + } else if senderSess == call.ToSess { target = call.FromSess.Conn() } else { return @@ -315,7 +311,7 @@ func (m *Manager) RelayMedia(sender *quic.Conn, data []byte) { if err := target.SendDatagram(data); err != nil { m.logger.Warn("Failed to relay media datagram", - zap.Uint64("call_id", pkt.CallID), + zap.Uint64("call_id", callID), zap.Error(err)) } } diff --git a/internal/server/server.go b/internal/server/server.go index 9cf60e8..8fca25f 100644 --- a/internal/server/server.go +++ b/internal/server/server.go @@ -193,7 +193,7 @@ func (s *Server) handleDatagrams(ctx context.Context, conn *quic.Conn, sess *Ses continue } if s.callMgr != nil && sess.IsAuthenticated() && sess.CallID() != 0 { - s.callMgr.RelayMedia(conn, data) + s.callMgr.RelayMedia(sess, data) } } } diff --git a/mobile/client.go b/mobile/client.go index 398f7c7..d415f79 100644 --- a/mobile/client.go +++ b/mobile/client.go @@ -5,6 +5,7 @@ import ( "crypto/ed25519" "crypto/rand" "crypto/sha256" + "encoding/base64" "crypto/tls" "crypto/x509" "encoding/binary" @@ -69,12 +70,212 @@ func NewClient() *Client { } } +func NewClientWithKey(privKey []byte) *Client { + priv := ed25519.PrivateKey(privKey) + pub := priv.Public().(ed25519.PublicKey) + return &Client{ + privKey: priv, + pubKey: pub, + } +} + +func Ping() string { + return "pong" +} + +func (c *Client) PrivateKey() []byte { + c.mu.Lock() + defer c.mu.Unlock() + return []byte(c.privKey) +} + +func (c *Client) PublicKey() []byte { + c.mu.Lock() + defer c.mu.Unlock() + return []byte(c.pubKey) +} + func (c *Client) SetCallbacks(cbs Callbacks) { c.mu.Lock() defer c.mu.Unlock() c.callbacks = cbs } +func (c *Client) CertDER() []byte { + c.mu.Lock() + defer c.mu.Unlock() + return c.certDER +} + +func (c *Client) CACertDER() []byte { + c.mu.Lock() + defer c.mu.Unlock() + return c.caCertDER +} + +func (c *Client) SetCertDER(der []byte) { + c.mu.Lock() + defer c.mu.Unlock() + c.certDER = der +} + +func (c *Client) SetCACertDER(der []byte) { + c.mu.Lock() + defer c.mu.Unlock() + c.caCertDER = der +} + +func (c *Client) AuthenticateB64(certB64 string, caCertB64 string) (number string, err error) { + defer func() { + if r := recover(); r != nil { + number = "" + err = fmt.Errorf("panic in AuthenticateB64: %v", r) + } + }() + + var certDER []byte + if certB64 != "" { + certDER, err = base64.StdEncoding.DecodeString(certB64) + if err != nil { + return "", fmt.Errorf("decode cert: %w", err) + } + } + + c.mu.Lock() + conn := c.conn + c.mu.Unlock() + + if conn == nil { + return "", fmt.Errorf("not connected") + } + + authSt, streamErr := conn.OpenStream() + if streamErr != nil { + return "", streamErr + } + + if streamErr = protocol.WriteFrame(authSt, byte(types.OpGetChallenge), nil); streamErr != nil { + authSt.Close() + return "", fmt.Errorf("send challenge: %w", streamErr) + } + + frame, streamErr := protocol.ReadFrame(authSt) + if streamErr != nil { + authSt.Close() + return "", fmt.Errorf("read challenge: %w", streamErr) + } + + if types.OpCode(frame.OpCode) != types.OpChallenge { + authSt.Close() + return "", fmt.Errorf("expected challenge, got op=%x", frame.OpCode) + } + + challenge := auth.UnmarshalChallenge(frame.Payload) + if challenge == nil { + authSt.Close() + return "", fmt.Errorf("invalid challenge payload") + } + + if len(certDER) > 0 { + c.mu.Lock() + privKey := c.privKey + c.mu.Unlock() + + challengeData := challenge.Marshal() + signature := ed25519.Sign(privKey, challengeData) + + payload := make([]byte, 1+64+2+len(certDER)) + payload[0] = 64 + copy(payload[1:], signature) + binary.BigEndian.PutUint16(payload[1+64:], uint16(len(certDER))) + copy(payload[1+64+2:], certDER) + + if streamErr = protocol.WriteFrame(authSt, byte(types.OpAuthCert), payload); streamErr != nil { + authSt.Close() + return "", streamErr + } + + frame, streamErr = protocol.ReadFrame(authSt) + if streamErr != nil { + authSt.Close() + return "", streamErr + } + + if types.OpCode(frame.OpCode) == types.OpError { + authSt.Close() + errMsg := parseError(frame.Payload) + return "", fmt.Errorf("server error: %s", errMsg) + } + + if types.OpCode(frame.OpCode) != types.OpIdentity { + authSt.Close() + return "", fmt.Errorf("expected identity, got op=%x", frame.OpCode) + } + + number, _, _ = parseIdentityPayload(frame.Payload) + if number == "" { + authSt.Close() + return "", fmt.Errorf("invalid identity payload") + } + + c.mu.Lock() + c.number = number + c.authOpened = true + c.mu.Unlock() + go c.handleIncomingStreams() + return number, nil + } + + solution := c.solvePoW(challenge) + if solution == nil { + authSt.Close() + return "", fmt.Errorf("PoW solve failed") + } + + solnPayload := make([]byte, 40) + copy(solnPayload[0:8], solution.ClientNonce[:]) + copy(solnPayload[8:40], solution.ClientPubKey[:]) + + if streamErr = protocol.WriteFrame(authSt, byte(types.OpSolve), solnPayload); streamErr != nil { + authSt.Close() + return "", fmt.Errorf("send solution: %w", streamErr) + } + + frame, streamErr = protocol.ReadFrame(authSt) + if streamErr != nil { + authSt.Close() + return "", fmt.Errorf("read response: %w", streamErr) + } + + if types.OpCode(frame.OpCode) == types.OpError { + authSt.Close() + errMsg := parseError(frame.Payload) + return "", fmt.Errorf("server error: %s", errMsg) + } + + if types.OpCode(frame.OpCode) != types.OpIdentity { + authSt.Close() + return "", fmt.Errorf("expected identity, got op=%x", frame.OpCode) + } + + number, newCertDER, newCACertDER := parseIdentityPayload(frame.Payload) + if number == "" { + authSt.Close() + return "", fmt.Errorf("invalid identity payload") + } + + c.mu.Lock() + c.number = number + c.certDER = newCertDER + c.caCertDER = newCACertDER + c.authOpened = true + c.mu.Unlock() + + go c.handleIncomingStreams() + + return number, nil +} + func (c *Client) Connect(addr string) error { c.mu.Lock() defer c.mu.Unlock() @@ -125,7 +326,14 @@ func (c *Client) Connect(addr string) error { return nil } -func (c *Client) Authenticate() (string, error) { +func (c *Client) Authenticate() (number string, err error) { + defer func() { + if r := recover(); r != nil { + number = "" + err = fmt.Errorf("panic in Authenticate: %v", r) + } + }() + c.mu.Lock() conn := c.conn c.mu.Unlock() @@ -134,20 +342,20 @@ func (c *Client) Authenticate() (string, error) { return "", fmt.Errorf("not connected") } - authSt, err := conn.OpenStream() - if err != nil { - return "", fmt.Errorf("open auth stream: %w", err) + authSt, streamErr := conn.OpenStream() + if streamErr != nil { + return "", streamErr } - if err := protocol.WriteFrame(authSt, byte(types.OpGetChallenge), nil); err != nil { + if streamErr = protocol.WriteFrame(authSt, byte(types.OpGetChallenge), nil); streamErr != nil { authSt.Close() - return "", fmt.Errorf("send challenge: %w", err) + return "", fmt.Errorf("send challenge: %w", streamErr) } - frame, err := protocol.ReadFrame(authSt) - if err != nil { + frame, streamErr := protocol.ReadFrame(authSt) + if streamErr != nil { authSt.Close() - return "", fmt.Errorf("read challenge: %w", err) + return "", fmt.Errorf("read challenge: %w", streamErr) } if types.OpCode(frame.OpCode) != types.OpChallenge { @@ -171,15 +379,15 @@ func (c *Client) Authenticate() (string, error) { copy(solnPayload[0:8], solution.ClientNonce[:]) copy(solnPayload[8:40], solution.ClientPubKey[:]) - if err := protocol.WriteFrame(authSt, byte(types.OpSolve), solnPayload); err != nil { + if streamErr = protocol.WriteFrame(authSt, byte(types.OpSolve), solnPayload); streamErr != nil { authSt.Close() - return "", fmt.Errorf("send solution: %w", err) + return "", fmt.Errorf("send solution: %w", streamErr) } - frame, err = protocol.ReadFrame(authSt) - if err != nil { + frame, streamErr = protocol.ReadFrame(authSt) + if streamErr != nil { authSt.Close() - return "", fmt.Errorf("read response: %w", err) + return "", fmt.Errorf("read response: %w", streamErr) } if types.OpCode(frame.OpCode) == types.OpError { @@ -193,7 +401,7 @@ func (c *Client) Authenticate() (string, error) { return "", fmt.Errorf("expected identity, got op=%x", frame.OpCode) } - number, certDER, caCertDER := parseIdentityPayload(frame.Payload) + number, newCertDER, newCACertDER := parseIdentityPayload(frame.Payload) if number == "" { authSt.Close() return "", fmt.Errorf("invalid identity payload") @@ -201,8 +409,8 @@ func (c *Client) Authenticate() (string, error) { c.mu.Lock() c.number = number - c.certDER = certDER - c.caCertDER = caCertDER + c.certDER = newCertDER + c.caCertDER = newCACertDER c.authOpened = true c.mu.Unlock() @@ -289,8 +497,6 @@ func (c *Client) Disconnect() { c.transport = nil c.udpConn = nil c.number = "" - c.certDER = nil - c.caCertDER = nil c.activeCall = false c.callID = 0 c.mediaKey = nil @@ -298,6 +504,8 @@ func (c *Client) Disconnect() { } func (c *Client) handleIncomingStreams() { + defer func() { recover() }() + c.mu.Lock() conn := c.conn ctx := c.ctx @@ -312,12 +520,16 @@ func (c *Client) handleIncomingStreams() { if err != nil { return } - go c.handleStream(st) + go func() { + defer func() { recover() }() + c.handleStream(st) + }() } } func (c *Client) handleStream(st *quic.Stream) { defer st.Close() + defer func() { recover() }() for { frame, err := protocol.ReadFrame(st) @@ -370,6 +582,8 @@ func (c *Client) handleStream(st *quic.Stream) { } func (c *Client) handleDatagrams() { + defer func() { recover() }() + c.mu.Lock() conn := c.conn ctx := c.ctx