Talon/voice-cat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(media): rewrite relay re-seal seq so multi-user audio decrypts

Browse Source 
The media AEAD nonce is an implicit per-direction monotonic counter;
open() reconstructs it from the 14-byte header seq field (the AAD), so
the contract is header.seq == the counter seal() used. The SFU relay
decrypted inbound frames with the sender key, re-sealed with the
recipient send_crypto (its own counter), but forwarded the sender
header verbatim -- so seq carried the wrong counter and the recipient
rebuilt the wrong nonce, silently dropping every relayed frame. It only
worked for a single first-ever sender into a fresh recipient, which is
why reverse/3rd-party audio failed.

Rewrite the outgoing header seq to the recipient peek_send_counter()
before re-sealing so each server->client direction is one contiguous
monotonic counter and the nonce always matches. Safe: the jitter buffer
orders by timestamp, not seq. No wire-format/proto/ABI change.

Adds test_relay_interleaved_reseal regression coverage.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Talon
2026-06-17 21:38:27 +02:00
parent 118ca5129f
commit 2185d9d15c
3 changed files with 140 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
PROGRESS.md
View File

@@ -24,6 +24,32 @@ up instantly. Newest status at the top.
channel CRUD with full per-channel Opus audio config, user moderation (kick/ban/move/server
mute/server deafen/set permissions), and server account management. `dotnet test` of the
Windows solution passes. Still to do: DRED/audio-quality polish.
- **Done:** **Fixed multi-user voice — relayed frames failed AEAD decryption (nonce desync)**
(2026-06-17, reported live: with 2+ people in a channel, audio was one-directional — "I can
hear them but they can't hear me" — and a 3rd joiner heard nobody). Root cause was in the SFU
relay (`server/src/media_relay.cpp`). The media AEAD nonce is an *implicit per-direction
monotonic counter*; `open()` reconstructs it from the 14-byte header's `seq` field (the AAD),
so the wire contract is `header.seq == the counter seal() used` (the client honors this at
`client.cpp:907`). The relay decrypted each inbound frame with the sender's key, then re-sealed
with the **recipient's** `send_crypto` (its own counter) but **forwarded the sender's header
verbatim** — so `header.seq` carried the sender's counter, not the recipient's. The recipient's
`open()` rebuilt the wrong nonce → every relayed frame failed auth and was silently dropped. It
only "worked" while the sender's counter coincidentally equalled the server→recipient counter
(a single first-ever sender into a fresh recipient), which is exactly why the first/sole talker
was heard but reverse/3rd-party audio was not. **Fix:** before re-sealing, the relay rewrites the
outgoing header's `seq` (bytes [8..9]) to the recipient's `peek_send_counter()`, so each
server→client direction is one contiguous monotonic counter and the nonce always matches (the
anti-replay window also stops seeing false replays from interleaved senders). Safe because the
jitter buffer orders by `timestamp`, not `seq` (`audio_engine.h`); `seq` exists only to carry the
AEAD counter. No wire-format/proto/ABI change. Regression test added in `tests/test_media_aead.cpp`
(`test_relay_interleaved_reseal`): two senders interleaved into one recipient all decrypt with the
fix, and the verbatim-seq path is asserted to fail. `ctest --preset m1-dev` — **18/18 green** (run
via PowerShell; Git Bash can't resolve the runtime DLLs. `vad_ptt_devices` is timing-flaky over
loopback — passes on re-run — unrelated to this fix). **Latent, separate:** the secondary
"3rd joiner sometimes can't see other users" report is a control-plane (TCP snapshot/UserEvent)
issue, not this AEAD bug — re-verify after live testing before investigating. Also still latent:
the 16-bit `seq` wraps after 65536 frames per direction (faster on a busy relay) with no ROC, so
the implicit counter desyncs on long continuous sessions (`crypto.cpp` open() TODO).
- **Done:** **Fixed "randomly bumped to Lobby" in the Windows client — actors were excluded
from their own state-change broadcasts** (2026-06-17, reported live: a connected client would
intermittently snap from its joined channel back to Lobby in the UI). Root cause was a design

11
server/src/media_relay.cpp
View File

@@ -102,8 +102,17 @@ void MediaRelay::on_udp_frame(const uint8_t* data, size_t len,
crypto_aead_chacha20poly1305_ietf_ABYTES);
}
// Copy header (re-use sender's header verbatim — ssrc, seq, ts pass through).
// Copy header (ssrc, ts, flags pass through for demux/playout), then rewrite the
// seq field to THIS recipient's next send counter. The media AEAD nonce is an
// implicit per-direction monotonic counter; open() reconstructs it from the seq in
// the header (the AAD). Since we re-seal with the recipient's send_crypto (its own
// counter), the verbatim sender seq would no longer match the nonce seal() uses and
// every relayed frame would fail auth. Set seq = peek_send_counter() BEFORE sealing
// so the header (which is the authenticated AAD) carries the matching counter.
std::memcpy(seal_buf_.data(), data, voicecat::net::kVoiceHeaderSize);
const uint64_t send_ctr = send_crypto->peek_send_counter();
seal_buf_[8] = static_cast<uint8_t>((send_ctr >> 8) & 0xFF);
seal_buf_[9] = static_cast<uint8_t>(send_ctr & 0xFF);
uint8_t* out_payload = seal_buf_.data() + voicecat::net::kVoiceHeaderSize;
long sealed_out = send_crypto->seal(

104
tests/test_media_aead.cpp
View File

@@ -3,6 +3,7 @@
*
* Uses a synthetic 32-byte key directly (no TLS context needed for unit tests).
*/
#include <array>
#include <cstdio>
#include <cstring>
#include <vector>
@@ -148,6 +149,108 @@ static void test_multiple_packets() {
}
}
// Build a 14-byte AAD (voice frame header) with a given ssrc + seq.
static std::vector<uint8_t> make_aad_ssrc(uint32_t ssrc, uint16_t seq) {
VoiceFrame f;
f.ssrc = ssrc;
f.seq = seq;
std::vector<uint8_t> aad(kVoiceHeaderSize);
serialize_header(f, aad.data());
return aad;
}
// Simulate one server relay hop for a single frame, sender → recipient R.
// - sender seals with its send key, setting header seq = its own send counter (client contract).
// - server opens with the sender's key, then re-seals with R's send key.
// - if rewrite_seq, the re-sealed header's seq is set to R's send counter (the fix); otherwise
// the sender's seq is forwarded verbatim (the bug).
// Returns true iff R successfully decrypts the relayed frame.
static bool relay_one(SodiumMediaCrypto& sender_send, SodiumMediaCrypto& server_recv,
SodiumMediaCrypto& r_send, SodiumMediaCrypto& r_recv,
uint32_t ssrc, const std::vector<uint8_t>& plain, bool rewrite_seq) {
// Client A→server: seq carries the sender's send counter.
auto in_aad = make_aad_ssrc(ssrc, static_cast<uint16_t>(sender_send.peek_send_counter()));
std::vector<uint8_t> cipher(plain.size() + crypto_aead_chacha20poly1305_ietf_ABYTES);
long sealed = sender_send.seal(plain.data(), plain.size(), in_aad.data(), in_aad.size(),
cipher.data(), cipher.size());
if (sealed < 0) return false;
// Server decrypts the inbound frame.
std::vector<uint8_t> recovered(plain.size());
long opened = server_recv.open(cipher.data(), static_cast<size_t>(sealed),
in_aad.data(), in_aad.size(),
recovered.data(), recovered.size());
if (opened < 0) return false;
// Server re-seals to R. Header passes through except seq, which (when fixed) is set to R's
// own send counter so R's open() reconstructs the matching nonce.
std::vector<uint8_t> out_aad = in_aad; // copy header verbatim
if (rewrite_seq) {
uint64_t ctr = r_send.peek_send_counter();
out_aad[8] = static_cast<uint8_t>((ctr >> 8) & 0xFF);
out_aad[9] = static_cast<uint8_t>(ctr & 0xFF);
}
std::vector<uint8_t> relay_cipher(recovered.size() + crypto_aead_chacha20poly1305_ietf_ABYTES);
long resealed = r_send.seal(recovered.data(), static_cast<size_t>(opened),
out_aad.data(), out_aad.size(),
relay_cipher.data(), relay_cipher.size());
if (resealed < 0) return false;
// R decrypts the relayed frame.
std::vector<uint8_t> r_recovered(recovered.size());
long r_opened = r_recv.open(relay_cipher.data(), static_cast<size_t>(resealed),
out_aad.data(), out_aad.size(),
r_recovered.data(), r_recovered.size());
return r_opened == static_cast<long>(plain.size());
}
// Regression test for the relay nonce-desync bug: two senders (A, B) relayed into one recipient
// (R) interleaved. The media AEAD nonce is an implicit per-direction counter reconstructed from
// the header seq; if the relay forwards the sender's seq verbatim, it no longer matches R's send
// counter and frames fail to decrypt. The relay must rewrite seq = R's send counter.
static void test_relay_interleaved_reseal() {
auto make_key = [](const char* label) {
std::array<uint8_t, crypto_aead_chacha20poly1305_ietf_KEYBYTES> k{};
crypto_generichash(k.data(), k.size(),
reinterpret_cast<const uint8_t*>(label),
std::strlen(label), nullptr, 0);
return k;
};
auto kA = make_key("relay-A"); // A↔server direction
auto kB = make_key("relay-B"); // B↔server direction
auto kR = make_key("relay-R"); // server↔R direction
std::vector<uint8_t> plain(80, 0x3C);
// Fixed path: interleaved A/B frames all decrypt at R.
{
SodiumMediaCrypto a_send(kA.data()), srv_recv_a(kA.data());
SodiumMediaCrypto b_send(kB.data()), srv_recv_b(kB.data());
SodiumMediaCrypto r_send(kR.data()), r_recv(kR.data());
bool all_ok = true;
for (int i = 0; i < 8; ++i) {
all_ok &= relay_one(a_send, srv_recv_a, r_send, r_recv, 0x1111, plain, /*rewrite=*/true);
all_ok &= relay_one(b_send, srv_recv_b, r_send, r_recv, 0x2222, plain, /*rewrite=*/true);
}
CHECK(all_ok); // with the fix, every interleaved relayed frame decrypts at R
}
// Control: forwarding seq verbatim (the bug) must drop frames once the counters diverge.
{
SodiumMediaCrypto a_send(kA.data()), srv_recv_a(kA.data());
SodiumMediaCrypto b_send(kB.data()), srv_recv_b(kB.data());
SodiumMediaCrypto r_send(kR.data()), r_recv(kR.data());
int failures = 0;
for (int i = 0; i < 8; ++i) {
if (!relay_one(a_send, srv_recv_a, r_send, r_recv, 0x1111, plain, /*rewrite=*/false)) ++failures;
if (!relay_one(b_send, srv_recv_b, r_send, r_recv, 0x2222, plain, /*rewrite=*/false)) ++failures;
}
CHECK(failures > 0); // proves the verbatim-seq path is broken (locks in the regression)
}
}
int main() {
if (sodium_init() < 0) {
std::printf("FAIL: sodium_init failed\n");
@@ -158,6 +261,7 @@ int main() {
test_anti_replay();
test_tamper_detection();
test_multiple_packets();
test_relay_interleaved_reseal();
if (g_failures == 0) {
std::printf("media_aead: all tests passed\n");