出張先やカフェのフリーWi-Fiはなぜ危険なのか？
偽アクセスポイント（Evil Twin）の仕組みと安全なリモート接続（WireGuard / mTLS）

#![forbid(unsafe_code)]

/// RFC 6479 64-packet sliding anti-replay window + WireGuard Cryptokey Routing validator.
#[derive(Debug, Clone)]
pub struct PeerTunnelState {
    pub peer_public_key: [u8; 32],
    pub allowed_inner_ipv4: u32,
    pub allowed_prefix_mask: u32,
    pub highest_counter: u64,
    pub replay_bitmap: u64,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum PacketVerdict {
    AcceptAndAdvanceWindow,
    SilentDropInvalidMac,
    DropReplayedOrTooOldCounter,
    DropCryptokeyRouteViolation,
}

impl PeerTunnelState {
    #[must_use]
    pub const fn new(peer_public_key: [u8; 32], allowed_inner_ipv4: u32, prefix_len: u8) -> Self {
        let mask = if prefix_len == 0 {
            0
        } else if prefix_len >= 32 {
            u32::MAX
        } else {
            !0u32 << (32 - prefix_len)
        };
        Self {
            peer_public_key,
            allowed_inner_ipv4: allowed_inner_ipv4 & mask,
            allowed_prefix_mask: mask,
            highest_counter: 0,
            replay_bitmap: 0,
        }
    }

    /// Verifies AEAD tag validity, Cryptokey Routing binding (inner source IP vs peer public key),
    /// and updates the 64-bit sliding anti-replay window in O(1) time.
    pub fn verify_inbound_tunnel_packet(
        &mut self,
        aead_tag_valid: bool,
        packet_counter: u64,
        inner_source_ipv4: u32,
    ) -> PacketVerdict {
        // 1. Stealth drop if Poly1305 AEAD authentication tag or MAC1 failed
        if !aead_tag_valid {
            return PacketVerdict::SilentDropInvalidMac;
        }

        // 2. Cryptokey Routing check: decrypted inner source IP must match peer's AllowedIPs
        if (inner_source_ipv4 & self.allowed_prefix_mask) != self.allowed_inner_ipv4 {
            return PacketVerdict::DropCryptokeyRouteViolation;
        }

        // 3. RFC 6479 Anti-Replay Window check (64-bit bitmap)
        if packet_counter > self.highest_counter {
            let shift = packet_counter - self.highest_counter;
            if shift >= 64 {
                self.replay_bitmap = 1;
            } else {
                self.replay_bitmap = (self.replay_bitmap << shift) | 1;
            }
            self.highest_counter = packet_counter;
            PacketVerdict::AcceptAndAdvanceWindow
        } else {
            let diff = self.highest_counter - packet_counter;
            if diff >= 64 {
                return PacketVerdict::DropReplayedOrTooOldCounter;
            }
            let bit = 1u64 << diff;
            if (self.replay_bitmap & bit) != 0 {
                return PacketVerdict::DropReplayedOrTooOldCounter;
            }
            self.replay_bitmap |= bit;
            PacketVerdict::AcceptAndAdvanceWindow
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn enforces_cryptokey_routing_and_blocks_replay() {
        let mut peer = PeerTunnelState::new([0x42; 32], 0x0A64_0002, 32); — 10.100.0.2/32
        assert_eq!(
            peer.verify_inbound_tunnel_packet(true, 1, 0x0A64_0002),
            PacketVerdict::AcceptAndAdvanceWindow
        );
        // Replay of counter 1 must be rejected
        assert_eq!(
            peer.verify_inbound_tunnel_packet(true, 1, 0x0A64_0002),
            PacketVerdict::DropReplayedOrTooOldCounter
        );
        // Spoofed inner IP (10.100.0.99) from peer 10.100.0.2 must be rejected
        assert_eq!(
            peer.verify_inbound_tunnel_packet(true, 2, 0x0A64_0063),
            PacketVerdict::DropCryptokeyRouteViolation
        );
    }
}