add support for session encryption

tap_core/Cargo.toml

@@ -13,3 +13,5 @@ tap-interface = {version = "0.1.0", registry = "ahines"}
 thiserror = "2.0.21"
 opus= { version="0.4.0" }
 opusic-sys = { version = "0.7.5", features = ["bundled", "no-stack-protector", "no-hardening", "no-fortify-source"] }
+aws-lc-rs = "1.18.2"
+hex = "0.4.3"

tap_core/src/audio_source_thread.rs

@@ -105,10 +105,14 @@ impl AudioSourceThread {
         Ok(stream)
     }
 
-    pub fn worker<T: Read + Write + Send + 'static>(mut self, connection: T) -> Result<(), Error> {
+    pub fn worker<T: Read + Write + Send + 'static>(
+        mut self,
+        connection: T,
+        key: &[u8],
+    ) -> Result<(), Error> {
         let encoder = Self::setup_encoder()?;
         let (sender, receiver) = channel();
-        let tx_thread = TxThread::new(receiver, encoder, connection);
+        let tx_thread = TxThread::new(receiver, encoder, connection, key);
         let thread = thread::spawn(move || tx_thread.thread());
 
         let mut stream = self.setup_stream(&sender)?;

tap_core/src/tx_thread.rs

@@ -1,5 +1,7 @@
 use crate::util::STEREO_FRAME_SIZE;
 use crate::util::{CIRC_BUFFER_SIZE, TAP_PACKET_MAX_DATA_LEN, ThreadMessage};
+use aws_lc_rs::aead::{AES_256_GCM, Aad, RandomizedNonceKey};
+use aws_lc_rs::error::Unspecified;
 use chrono::Utc;
 use circular_buffer::FixedCircularBuffer;
 use log::{error, info, warn};
@@ -18,6 +20,8 @@ pub enum Error {
     IoFailure(#[from] std::io::Error),
     #[error("Encode error: {0}")]
     EncodeFailure(#[from] opus::Error),
+    #[error("Failed to encrypt data")]
+    EncryptionFailed(#[from] Unspecified),
 }
 
 pub struct TxThread<T: Read + Write> {
@@ -27,10 +31,16 @@ pub struct TxThread<T: Read + Write> {
     circular_buffer: FixedCircularBuffer<f32, CIRC_BUFFER_SIZE>,
     seq_count: u32,
     exit: bool,
+    key: RandomizedNonceKey,
 }
 
 impl<T: Read + Write> TxThread<T> {
-    pub fn new(receiver: Receiver<ThreadMessage>, encoder: Encoder, opus_connection: T) -> Self {
+    pub fn new(
+        receiver: Receiver<ThreadMessage>,
+        encoder: Encoder,
+        opus_connection: T,
+        key: &[u8],
+    ) -> Self {
         Self {
             receiver,
             encoder,
@@ -38,6 +48,7 @@ impl<T: Read + Write> TxThread<T> {
             circular_buffer: Default::default(),
             seq_count: 0,
             exit: false,
+            key: RandomizedNonceKey::new(&AES_256_GCM, key).unwrap(),
         }
     }
 
@@ -46,6 +57,18 @@ impl<T: Read + Write> TxThread<T> {
         Ok(self.encoder.encode_float(&encode_buffer, output_buffer)?)
     }
 
+    fn encrypt_data(&self, frame: &[u8]) -> Result<Vec<u8>, Error> {
+        let mut enc_data = frame.to_vec();
+        let nonce = self
+            .key
+            .seal_in_place_append_tag(Aad::empty(), &mut enc_data)?;
+
+        let mut msg = nonce.as_ref().to_vec();
+        msg.append(&mut enc_data);
+
+        Ok(msg)
+    }
+
     fn send_opus_frame(&mut self) -> Result<(), Error> {
         let mut output_buffer = vec![0; TAP_PACKET_MAX_DATA_LEN];
         let size = self.encode(&mut output_buffer)?;
@@ -58,8 +81,11 @@ impl<T: Read + Write> TxThread<T> {
             audio_data: output_buffer,
         };
 
-        self.opus_connection
-            .write_all(tap_message.encode_to_vec().as_slice())?;
+        let tap_message = tap_message.encode_to_vec();
+
+        let enc_message = self.encrypt_data(&tap_message)?;
+
+        self.opus_connection.write_all(enc_message.as_slice())?;
 
         (self.seq_count, _) = self.seq_count.overflowing_add(1);
         Ok(())