optimize: improve vless xudp

ciphers/aead_2022_cipher.go

@@ -0,0 +1,153 @@
+package ciphers
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/base64"
+	"fmt"
+	"sync"
+	"time"
+)
+
+type CipherConf2022 struct {
+	KeyLen         int
+	SaltLen        int
+	NonceLen       int
+	TagLen         int
+	NewCipher      func(key []byte) (cipher.AEAD, error)
+	NewBlockCipher func(key []byte) (cipher.Block, error)
+}
+
+const (
+	// Timestamp tolerance
+	TimestampTolerance = 30 * time.Second
+
+	// Salt storage duration
+	SaltStorageDuration = 60 * time.Second
+)
+
+var (
+	Aead2022CiphersConf = map[string]*CipherConf2022{
+		"2022-blake3-aes-256-gcm": {KeyLen: 32, SaltLen: 32, NonceLen: 12, TagLen: 16, NewCipher: NewGcm, NewBlockCipher: aes.NewCipher},
+		"2022-blake3-aes-128-gcm": {KeyLen: 16, SaltLen: 16, NonceLen: 12, TagLen: 16, NewCipher: NewGcm, NewBlockCipher: aes.NewCipher},
+	}
+)
+
+// ValidateBase64PSK validates that the PSK is a valid base64 string with correct length
+func ValidateBase64PSK(pskBase64 string, expectedKeyLen int) ([]byte, error) {
+	if pskBase64 == "" {
+		return nil, fmt.Errorf("PSK cannot be empty for SIP022 methods")
+	}
+
+	psk, err := base64.StdEncoding.DecodeString(pskBase64)
+	if err != nil {
+		return nil, fmt.Errorf("PSK must be valid base64 for SIP022 methods: %w", err)
+	}
+
+	if len(psk) != expectedKeyLen {
+		return nil, fmt.Errorf("PSK length must be %d bytes for this method, got %d", expectedKeyLen, len(psk))
+	}
+
+	return psk, nil
+}
+
+// SlidingWindowFilter implements a sliding window filter for packet ID replay protection
+type SlidingWindowFilter struct {
+	window      []uint64
+	windowSize  uint64
+	latest      uint64
+	initialized bool
+	mutex       sync.Mutex
+}
+
+// NewSlidingWindowFilter creates a new sliding window filter
+func NewSlidingWindowFilter(windowSize int) *SlidingWindowFilter {
+	if windowSize <= 0 {
+		windowSize = 1024
+	}
+	wordCount := (windowSize + 63) / 64
+	return &SlidingWindowFilter{
+		window:     make([]uint64, wordCount),
+		windowSize: uint64(windowSize),
+	}
+}
+
+// CheckAndUpdate checks if the packet ID is valid and updates the window
+func (f *SlidingWindowFilter) CheckAndUpdate(packetID uint64) bool {
+	f.mutex.Lock()
+	defer f.mutex.Unlock()
+	if !f.initialized {
+		f.initialized = true
+		f.latest = packetID
+		f.setBit(0)
+		return true
+	}
+
+	if packetID > f.latest {
+		shift := packetID - f.latest
+		f.shiftWindow(shift)
+		f.latest = packetID
+		f.setBit(0)
+		return true
+	}
+
+	distance := f.latest - packetID
+	if distance >= f.windowSize {
+		return false
+	}
+	if f.getBit(distance) {
+		return false
+	}
+	f.setBit(distance)
+	return true
+}
+
+func (f *SlidingWindowFilter) getBit(index uint64) bool {
+	wordIndex := index / 64
+	bitIndex := index % 64
+	return f.window[wordIndex]&(uint64(1)<<bitIndex) != 0
+}
+
+func (f *SlidingWindowFilter) setBit(index uint64) {
+	wordIndex := index / 64
+	bitIndex := index % 64
+	f.window[wordIndex] |= uint64(1) << bitIndex
+}
+
+func (f *SlidingWindowFilter) setBitInWindow(window []uint64, index uint64) {
+	wordIndex := index / 64
+	bitIndex := index % 64
+	window[wordIndex] |= uint64(1) << bitIndex
+}
+
+func (f *SlidingWindowFilter) shiftWindow(shift uint64) {
+	if shift >= f.windowSize {
+		// Clear all bits in-place
+		for i := range f.window {
+			f.window[i] = 0
+		}
+		return
+	}
+
+	// Optimized in-place shift to avoid allocation
+	wordShift := int(shift / 64)
+	bitShift := shift % 64
+
+	// Shift right by wordShift positions
+	if wordShift > 0 {
+		for i := len(f.window) - 1; i >= wordShift; i-- {
+			f.window[i] = f.window[i-wordShift]
+		}
+		for i := 0; i < wordShift; i++ {
+			f.window[i] = 0
+		}
+	}
+
+	// Handle remaining bit shift
+	if bitShift > 0 {
+		for i := len(f.window) - 1; i > 0; i-- {
+			f.window[i] = (f.window[i] >> bitShift) | (f.window[i-1] << (64 - bitShift))
+		}
+		f.window[0] = f.window[0] >> bitShift
+	}
+}

ciphers/aead_2022_cipher_test.go

@@ -0,0 +1,46 @@
+package ciphers
+
+import "testing"
+
+func TestSlidingWindowFilter_BasicAndDuplicate(t *testing.T) {
+	f := NewSlidingWindowFilter(64)
+
+	if !f.CheckAndUpdate(100) {
+		t.Fatalf("first packet should pass")
+	}
+	if f.CheckAndUpdate(100) {
+		t.Fatalf("duplicate packet should be rejected")
+	}
+	if !f.CheckAndUpdate(101) {
+		t.Fatalf("next packet should pass")
+	}
+	if !f.CheckAndUpdate(99) {
+		t.Fatalf("out-of-order but in-window packet should pass")
+	}
+	if f.CheckAndUpdate(99) {
+		t.Fatalf("duplicate out-of-order packet should be rejected")
+	}
+}
+
+func TestSlidingWindowFilter_ShiftAndTooOld(t *testing.T) {
+	f := NewSlidingWindowFilter(8)
+
+	if !f.CheckAndUpdate(1) {
+		t.Fatalf("packet 1 should pass")
+	}
+	if !f.CheckAndUpdate(2) {
+		t.Fatalf("packet 2 should pass")
+	}
+	if !f.CheckAndUpdate(20) {
+		t.Fatalf("packet 20 should pass")
+	}
+	if f.CheckAndUpdate(2) {
+		t.Fatalf("packet 2 should be too old after large shift")
+	}
+	if !f.CheckAndUpdate(19) {
+		t.Fatalf("packet 19 should pass within current window")
+	}
+	if f.CheckAndUpdate(19) {
+		t.Fatalf("duplicate packet 19 should be rejected")
+	}
+}

ciphers/aead_cipher.go

@@ -33,9 +33,8 @@ var (
 		"aes-256-gcm":            {KeyLen: 32, SaltLen: 32, NonceLen: 12, TagLen: 16, NewCipher: NewGcm},
 		"aes-128-gcm":            {KeyLen: 16, SaltLen: 16, NonceLen: 12, TagLen: 16, NewCipher: NewGcm},
 	}
-	ZeroNonce             [MaxNonceSize]byte
-	ShadowsocksReusedInfo = []byte("ss-subkey")
-	JuicityReusedInfo     = []byte("juicity-reused-info")
+	ZeroNonce         [MaxNonceSize]byte
+	JuicityReusedInfo = []byte("juicity-reused-info")
 )
 
 func NewGcm(key []byte) (cipher.AEAD, error) {
@@ -46,7 +45,9 @@ func NewGcm(key []byte) (cipher.AEAD, error) {
 	return cipher.NewGCM(block)
 }
 
+// Verify is used for legacy compatibility
 func (conf *CipherConf) Verify(buf []byte, masterKey []byte, salt []byte, cipherText []byte, subKey *[]byte) ([]byte, bool) {
+	var shadowsocksReusedInfo = []byte("ss-subkey")
 	var sk []byte
 	if subKey != nil && len(*subKey) == conf.KeyLen {
 		sk = *subKey
@@ -57,7 +58,7 @@ func (conf *CipherConf) Verify(buf []byte, masterKey []byte, salt []byte, cipher
 			sha1.New,
 			masterKey,
 			salt,
-			ShadowsocksReusedInfo,
+			shadowsocksReusedInfo,
 		)
 		io.ReadFull(kdf, sk)
 		if subKey != nil && cap(*subKey) >= conf.KeyLen {