Niko Marmeladkov
78fdd36db8
Relay media over QUIC uni streams instead of datagrams
2026-07-02 10:31:05 +03:00
Niko Marmeladkov
366386bade
Various fixes: cert auth lookup by number, debug logging, mobile client
...
- handleAuthCert: find identity by cert CommonName instead of pubkey
- Add debug log to HandleDial
- mobile: AuthenticateB64, NewClientWithKey, recover guards
- go mod tidy
2026-07-01 17:15:09 +03:00
Niko Marmeladkov
50344a350a
handleAuthCert: look up identity by cert CommonName, not pubkey
...
Use cert's Subject.CommonName (the phone number) to find identity instead of extracting pubkey and iterating DB. Each cert is bound to a number; the cert tells us which number directly. Also verify cert pubkey matches stored identity pubkey.
2026-07-01 15:41:54 +03:00
Niko Marmeladkov
8726dcc01e
Add debug log to HandleDial, remove OpRegister
...
Log original and normalized target number to debug 'target offline'. Remove unused OpRegister opcode and handler.
2026-07-01 15:08:23 +03:00
Niko Marmeladkov
07814e5014
Add OpRegister: cert-only registration without PoW
...
New flow: register -> OpRegister(pubKey) -> OpIdentity(number+cert). Reconnect: OpGetChallenge -> OpAuthCert(cert+sig). PoW eliminated from client flow.
2026-07-01 15:02:58 +03:00
Niko Marmeladkov
12f38ecb68
handleAuthCert: reject cert-auth when number differs from session
...
If session already has a number (from PoW), cert auth must match that number. Prevents identity theft via cert-sharing.
2026-07-01 14:59:39 +03:00
Niko Marmeladkov
b7597e1335
handleAuthCert: unregister old number before changing identity
...
If session already has a different number (e.g. from PoW), unregister it before re-auth to prevent stale entries in sessions map.
2026-07-01 14:51:52 +03:00
Niko Marmeladkov
ba79f81721
Register: kick out old session when number is taken
...
When a new session registers with an already-taken number, close the old connection. Prevents two devices from sharing the same number simultaneously.
2026-07-01 14:51:04 +03:00
Niko Marmeladkov
73f09c29ab
Add cert-based re-authentication (OpAuthCert)
...
New flow: connect -> OpGetChallenge -> OpAuthCert (signature + certDER) -> server verifies cert chain + Ed25519 signature over challenge data -> reuses existing identity. No re-registration on reconnect.
2026-06-30 14:56:29 +03:00
Niko Marmeladkov
0ed9d18b27
Fix nil interface trap in GetByNumber
...
Map lookup returns typed nil *Session for missing keys, which wraps into CallSession interface as non-nil typed nil. Nil check silently passes, causing nil dereference.
2026-06-30 14:33:41 +03:00
Niko Marmeladkov
4f6310c2bb
Fix PoW auth bypass: verify against issued challenge, not new one
...
Store challenge from handleGetChallenge in session, then verify
against it in handleSolve. Previously a fresh challenge was
generated for verification, making auth trivially bypassable.
2026-06-30 13:47:17 +03:00
Niko Marmeladkov
dbb2782dd7
Fix missing ALPN NextProtos for QUIC handshake
...
Add 'qcc' ALPN protocol to both ACME and insecure TLS configs.
Bump golang.org/x/crypto and transitive x/ deps.
Add golang.org/x/mobile for mobile client bindings.
2026-06-30 13:43:54 +03:00
Niko Marmeladkov
4f88a7eab1
Initial commit: QuiC Call server
2026-06-30 12:52:09 +03:00
