大手出版社・港湾・部品工場を止めた「VPN境界ゼロデイ」と「認証情報窃取」：
なぜ一度の侵入で社内全体が止まってしまうのか？

#![forbid(unsafe_code)]

pub const WG_INITIATION_LEN: usize = 148;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum BoundaryFilterDrop {
    InvalidPacketLength(usize),
    InvalidMessageType(u8),
    NonZeroReservedBytes,
    Mac1MismatchSilentDrop,
    ReplayTimestampRejected,
}

/// Constant-time 16-byte MAC1 tag comparison.
#[inline]
pub const fn ct_eq_16(a: &[u8; 16], b: &[u8; 16]) -> bool {
    let mut d: u8 = 0;
    let mut i: usize = 0;
    while i < 16 {
        d |= a[i] ^ b[i];
        i += 1;
    }
    d == 0
}

/// Compares two 12-byte big-endian TAI64N timestamps to enforce strict monotonicity per peer.
#[inline]
pub const fn is_tai64n_strictly_newer(candidate: &[u8; 12], last_seen: &[u8; 12]) -> bool {
    let mut i: usize = 0;
    while i < 12 {
        if candidate[i] > last_seen[i] {
            return true;
        }
        if candidate[i] < last_seen[i] {
            return false;
        }
        i += 1;
    }
    false
}

/// Validates the outer 148-byte frame invariants before any Curve25519 scalar multiplication.
#[inline]
pub fn verify_initiation_frame(
    packet: &[u8],
    expected_mac1: &[u8; 16],
) -> Result<(), BoundaryFilterDrop> {
    if packet.len() != WG_INITIATION_LEN {
        return Err(BoundaryFilterDrop::InvalidPacketLength(packet.len()));
    }
    if packet[0] != 0x01 {
        return Err(BoundaryFilterDrop::InvalidMessageType(packet[0]));
    }
    if packet[1] != 0 || packet[2] != 0 || packet[3] != 0 {
        return Err(BoundaryFilterDrop::NonZeroReservedBytes);
    }

    let mut packet_mac1 = [0u8; 16];
    packet_mac1.copy_from_slice(&packet[116..132]);

    if !ct_eq_16(&packet_mac1, expected_mac1) {
        return Err(BoundaryFilterDrop::Mac1MismatchSilentDrop);
    }

    Ok(())
}