path: root/ioaead.go

package rabaead

import (
	"crypto/cipher"
	"errors"
	"io"

	"snix.ir/poly1305"
	"snix.ir/rabbitio"
)

type streamReader struct {
	ie        *ioaead
	cip       cipher.Stream
	firstRead bool
	nwr       int
	read      io.Reader
	buff      []byte
	temp      []byte
	tagc      []byte
}

type ioaead struct {
	key            []byte // rabbit cipher key
	nonce          []byte
	poly           *poly1305.MAC
	adlen          int
	additionalData AdditionalFunc
}

type streamWriter struct {
	ie          *ioaead
	writer      io.Writer
	plainWriter io.Writer
	nwr         int
	firstWrite  bool
}

var errunderio = errors.New("underlying io reader returns wrong read value, which is not supposed to happen")

func makeioaead(key, iv []byte, adfunc AdditionalFunc) *ioaead {
	if adfunc == nil {
		adfunc = func() []byte { return nil }
	}
	str := &ioaead{
		key:   make([]byte, rabbitio.KeyLen),
		nonce: make([]byte, len(iv)),
	}

	str.additionalData = adfunc
	copy(str.key, key)
	copy(str.nonce, iv)
	var poly [polykeylen]byte
	cph, _ := rabbitio.NewCipher(str.key, str.nonce)
	cph.XORKeyStream(poly[:], poly[:])
	str.poly = poly1305.New(&poly)
	return str
}

func (s *ioaead) execAdFunc() {
	additionalData := s.additionalData()
	s.adlen = len(additionalData)
	writePadding(s.poly, additionalData)
}

func newCipherReader(r io.Reader, key, nonce []byte, f AdditionalFunc) (*streamReader, error) {
	if len(key) != rabbitio.KeyLen {
		return nil, rabbitio.ErrInvalidKey
	}

	if len(nonce) != rabbitio.IVXLen && len(nonce) != 0 {
		return nil, rabbitio.ErrInvalidIVX
	}

	v := &streamReader{
		ie:   makeioaead(key, nonce, f),
		read: r,
		buff: []byte{},
		tagc: make([]byte, 16),
		temp: make([]byte, 16),
	}

	v.cip, _ = rabbitio.NewCipher(v.ie.key, v.ie.nonce)
	return v, nil
}

// NewStreamReader returns streamReader data type, this reader open() and read aead
// ciphertext which have 16-byte poly1305 tag overhead.
// read data cannot be authenticated until underlying reader returns EOF
// so you should use this reader only if you can undo your read.
// AdFunc will be triggered at first call to read method
func NewStreamReader(r io.Reader, key, nonce []byte, f AdditionalFunc) (*streamReader, error) {
	return newCipherReader(r, key, nonce, f)
}

// NewStreamWriter returns streamWriter data type, this writer sale() and write aead
// plaintext which have 16-byte poly1305 tag overhead, running Close() is necessary
// in order to calculate and write tag at the end of the write.
// AdFunc will be triggered at first call to write method
func NewStreamWriter(w io.Writer, key, nonce []byte, f AdditionalFunc) (*streamWriter, error) {
	return newChipherWriter(w, key, nonce, f)
}

func newChipherWriter(w io.Writer, key, nonce []byte, f AdditionalFunc) (*streamWriter, error) {
	if len(key) != rabbitio.KeyLen {
		return nil, rabbitio.ErrInvalidKey
	}
	if len(nonce) != rabbitio.IVXLen && len(nonce) != 0 {
		return nil, rabbitio.ErrInvalidIVX
	}
	v := &streamWriter{
		ie:          makeioaead(key, nonce, f),
		plainWriter: w,
	}

	v.writer, _ = rabbitio.NewWriterCipher(
		v.ie.key, v.ie.nonce,
		io.MultiWriter(w, v.ie.poly),
	)

	return v, nil
}

func (r *streamReader) readTo(b []byte) (int, error) {
	var n int
	if len(r.buff) > 0 {
		return r.copyBuff(b), nil
	}

	sr, err := r.readBuff()
	if err != nil {
		if err == io.EOF {
			n = r.copyUntil(b, sr)
			return n, r.verify()
		}
		return n, err
	}
	return r.copyUntil(b, sr), err
}

// Read reads and open ciphertext.
// read data is unreliable until underlying reader returns EOF
// after that Read return EOF or ErrAuthMsg if integrity of data has been compromised.
// in such a case, you need to unread data. a simple demonstration would be to delete
// or truncate the file if ErrAuthMsg is returned
func (r *streamReader) Read(b []byte) (int, error) {
	if len(b) <= 16 {
		return r.readTo(b)
	}
	n := 0
	for {
		if n+16 > len(b) {
			sr, err := r.readTo(b[n:])
			n += sr
			if err != nil {
				return n, err
			}
			break
		}

		sr, err := r.readTo(b[n : n+16])
		n += sr
		if err != nil {
			return n, err
		}
	}
	return n, nil
}

func (r *streamReader) verify() error {
	r.ie.ioPaddingTo(r.nwr)
	if r.ie.poly.Verify(r.tagc) {
		return io.EOF
	}
	return ErrAuthMsg
}

func (r *streamReader) copyUntil(b []byte, sr int) int {
	n := copy(b, r.buff[:sr])
	r.buff = r.buff[n:]
	r.nwr += n
	return n
}

func (r *streamReader) copyBuff(b []byte) int {
	n := copy(b, r.buff)
	r.buff = r.buff[n:]
	r.nwr += n
	return n
}

func (r *streamReader) readBuff() (int, error) {
	if !r.firstRead {
		r.ie.execAdFunc()
		_, err := io.ReadFull(r.read, r.temp)
		if err != nil {
			return 0, err
		}
		r.firstRead = true
	}

	var buff = make([]byte, 16)
	n, err := r.read.Read(buff)
	if err != nil {
		return 0, err
	}
	if n > len(buff) {
		return 0, errunderio
	}

	copy(r.tagc, append(r.temp[n:], buff[:n]...))
	r.buff = append(r.buff, r.temp[:n]...)
	r.buffAndXor()

	if n < 16 {
		return n, err
	}

	copy(r.temp, buff)
	return n, err
}

func (r *streamReader) buffAndXor() {
	r.ie.poly.Write(r.buff)
	r.cip.XORKeyStream(r.buff, r.buff)
}

// Write writes plaintext data, in order to calculate and write tag
// at the end of the write, running Close() is necessary
func (w *streamWriter) Write(b []byte) (int, error) {
	if !w.firstWrite {
		w.ie.execAdFunc()
		w.firstWrite = true
	}
	n, err := w.writer.Write(b)
	if err != nil {
		return n, err
	}

	w.nwr += n
	return n, err
}

func (p *ioaead) ioPaddingTo(nb int) {
	if rem := nb % 16; rem != 0 {
		var buf [16]byte
		padLen := 16 - rem
		p.poly.Write(buf[:padLen])
	}

	writeUint64(p.poly, p.adlen)
	writeUint64(p.poly, nb)
}

// Close calculate and write poly1305 tag before closing the writer
// if underlying writer does not have a Close() method, Close only
// calculate and write poly1305 tag
func (w *streamWriter) Close() error {
	w.ie.ioPaddingTo(w.nwr)
	if _, err := w.plainWriter.Write(w.ie.poly.Sum(nil)); err != nil {
		return err
	}

	if c, ok := w.plainWriter.(io.Closer); ok {
		return c.Close()
	}
	return nil
}