function hmac (key, message)
    if (length(key) > blocksize) then
        key = hash(key) // keys longer than blocksize are shortened
    end if
    if (length(key) < blocksize) then
        key = key + [0x00 * (blocksize - length(key))] // keys shorter than blocksize are zero-padded (where ∥ is concatenation)
    end if

    o_key_pad = [0x5c * blocksize] ⊕ key // Where blocksize is that of the underlying hash function
    i_key_pad = [0x36 * blocksize] ⊕ key // Where ⊕ is exclusive or (XOR)

    return hash(o_key_pad + hash(i_key_pad + message)) 
end function

package encoding_test

import (
    "bytes"
    "context"
    "fmt"
    "github.com/google/gopacket"
    "github.com/google/gopacket/layers"
    "github.com/google/gopacket/pcap"
    "io"
    "os"
    "testing"
    "v2ray.com/core/common"
    "v2ray.com/core/common/buf"
    "v2ray.com/core/common/protocol"
    "v2ray.com/core/proxy/vmess"
    . "v2ray.com/core/proxy/vmess/encoding"
)

func toAccount(a *vmess.Account) protocol.Account {
    account, err := a.AsAccount()
    common.Must(err)
    return account
}

func TestEncryption(t *testing.T) {
    user := &protocol.MemoryUser{}

    account := &vmess.Account{
        Id: "b831381d-6324-4d53-ad4f-8cda48b30811"}
    user.Account = toAccount(account)

    sessionHistory := NewSessionHistory()

    defer common.Close(sessionHistory)

    userValidator := vmess.NewTimedUserValidator(protocol.DefaultIDHash)
    userValidator.Add(user)
    defer common.Close(userValidator)

    server := NewServerSession(userValidator, sessionHistory)
    var data []byte
    data = []byte{
        0x4d, 0xd1, 0x1f, 0x9b, 0x04, 0xf2, 0xb5, 0x62,
        0xb9, 0xdb, 0x53, 0x9d, 0x93, 0x9f, 0x1d, 0x52,
        0xb4, 0x8b, 0x35, 0xbf, 0x59, 0x2c, 0x09, 0xb2,
        0x15, 0x45, 0x39, 0x2f, 0x73, 0xf6, 0xce, 0xf9,
        0x11, 0x43, 0x78, 0x64, 0x64, 0x57, 0x8c, 0x1c,
        0x36, 0x1a, 0xa7, 0x2f, 0x63, 0x8c, 0xd0, 0x13,
        0x5f, 0x25, 0x34, 0x35, 0x55, 0xf5, 0x09, 0xae,
        0xf6, 0xc7, 0x4c, 0xd2, 0xa2, 0xb8, 0x6e, 0xe0,
        0xa9, 0xeb, 0x3b, 0x93, 0xa8, 0x1a, 0x54, 0x1d,
        0xef, 0x47, 0x63, 0xcc, 0x54, 0xf9, 0x1b, 0xa0,
        0x26, 0x81, 0xad, 0xd1, 0xb8, 0x15, 0xe8, 0xc5,
        0x0e, 0x02, 0x8c, 0x76, 0xbd, 0xe0, 0xee, 0x8a,
        0x95, 0x93, 0xdb, 0x88, 0xd9, 0x01, 0x06, 0x63,
        0x05, 0xa5, 0x1a, 0x95, 0x86, 0xa9, 0xe3, 0x77,
        0xee, 0x10, 0x0e, 0x7d, 0x4d, 0x33, 0xfc, 0xfc,
        0x04, 0x53, 0xc8, 0x6b, 0x19, 0x98, 0xa9, 0x52,
        0x75, 0xcd, 0x93, 0x68, 0xa6, 0x88, 0x20, 0xc2,
        0xa6, 0xa5, 0x40, 0xb6, 0x38, 0x6c, 0x14, 0x6e,
        0xa7, 0x57, 0x9c, 0xfe, 0x87, 0xb2, 0xe4, 0x59,
        0x85, 0x67, 0x72, 0xef, 0xdc, 0xf0, 0xe4, 0xc6,
        0xab, 0x0f, 0x11, 0xd0, 0x18, 0xa1, 0x55, 0x61,
        0xcf, 0x40, 0x9c, 0xbc, 0x00, 0x49, 0x1d, 0x7f,
        0x4d, 0x22, 0xb7, 0xc4, 0x86, 0xa7, 0x6a, 0x5f,
        0x2f, 0x25, 0xfb, 0xef, 0x50, 0x35, 0x51, 0xa0,
        0xae, 0xb9, 0x0a, 0xd9, 0xdd, 0x24, 0x6a, 0x9c,
        0xc5, 0xe0, 0xd0, 0xc0, 0xb7, 0x51, 0xeb, 0x7b,
        0x54, 0xb0, 0xab, 0xbf, 0xef, 0x19, 0x8b, 0x1c,
        0x4e, 0x5e, 0x75, 0x50, 0x77, 0x46, 0x9c, 0x31,
        0x8f, 0x20, 0xf3, 0xe4, 0x18, 0xaf, 0x03, 0x54,
        0x08, 0x11, 0xab, 0x5c, 0x1e, 0xa7, 0x80, 0xc8,
        0x86, 0xea, 0x2c, 0x90, 0x3b, 0x45, 0x8a, 0x26} //client header
    var data1 []byte
    data1 = []byte{ /* Packet 92 */
        0x04, 0xf0, 0x65, 0xe0, 0xbb, 0xc3, 0x52, 0x6b,
        0xcf, 0x41, 0x14, 0xad, 0x95, 0xf8, 0x36, 0x71,
        0x9b, 0x5c, 0xf3, 0x42, 0x11, 0x12, 0xc8, 0x03,
        0x36, 0xc6, 0xc3, 0x52, 0xad, 0x5d, 0x26, 0xa5,
        0xda, 0xa9, 0xa2, 0xf5, 0x86, 0x90, 0x26, 0xe6,
        0xa1, 0x20, 0x7c, 0xd2, 0x10, 0x85, 0x1c, 0x29,
        0x34, 0x2f, 0xd5, 0x27, 0xd9, 0x4f, 0x85, 0x70,
        0x35, 0x8e, 0xc1, 0x5a, 0x79, 0xc9, 0x5d, 0xb3,
        0x1a, 0x68, 0x8b, 0xc6, 0x09, 0xa6, 0x46, 0xab,
        0x74, 0xa9, 0xd9, 0xcd, 0xce, 0xa1, 0xe8, 0x28} //client body

    var data2 []byte
    if handle, err := pcap.OpenOffline("./Route.pcapng"); err != nil {
        panic(err)
    } else {
        packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
        for packet := range packetSource.Packets() {
            if packet != nil {
                if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil && len(tcpLayer.LayerPayload()) > 0 {
                    if bytes.Compare(tcpLayer.LayerPayload(), data) != 0 && bytes.Compare(tcpLayer.LayerPayload(), data1) != 0 {
                        data2 = append(data2, tcpLayer.LayerPayload()...)
                    } else {
                        fmt.Println("Found client package")
                    }
                }

            }
        }
    }

    OutboundResponseConn := data2                    //from server
    InboudRequestConn := append((data)[:], data1...) //from client
    reader := &buf.BufferedReader{Reader: buf.NewReader(bytes.NewReader(InboudRequestConn))}
    reader1 := &buf.BufferedReader{Reader: buf.NewReader(bytes.NewReader(OutboundResponseConn))}
    request, err := server.DecodeRequestHeader(reader)
    if err != nil {
        panic(err)
    }
    fmt.Println("Received request for ", request.Destination())

    bodyReader := server.DecodeRequestBody(request, reader)
    fmt.Println(bodyReader.ReadMultiBuffer())

    client := NewClientSession(false, protocol.DefaultIDHash, context.TODO(), server)
    _, err = client.DecodeResponseHeader(reader1)

    bodyReader1 := client.DecodeResponseBody(request, reader1)

    stringData, err := bodyReader1.ReadMultiBuffer()

    f, err := os.Create("./evil.html")
    for err == nil {
        f.Write([]byte(stringData.String()))
        stringData, err = bodyReader1.ReadMultiBuffer()

    }
    if err != io.EOF {
        t.Error("nil error")
    }
}

package encoding

import (
    "bytes"
    "context"
    "crypto/aes"
    "crypto/cipher"
    "crypto/md5"
    "crypto/rand"
    "encoding/binary"
    "hash"
    "hash/fnv"
    "io"

    "golang.org/x/crypto/chacha20poly1305"

    "v2ray.com/core/common"
    "v2ray.com/core/common/bitmask"
    "v2ray.com/core/common/buf"
    "v2ray.com/core/common/crypto"
    "v2ray.com/core/common/dice"
    "v2ray.com/core/common/protocol"
    "v2ray.com/core/common/serial"
    "v2ray.com/core/proxy/vmess"
    vmessaead "v2ray.com/core/proxy/vmess/aead"
)

func hashTimestamp(h hash.Hash, t protocol.Timestamp) []byte {
    common.Must2(serial.WriteUint64(h, uint64(t)))
    common.Must2(serial.WriteUint64(h, uint64(t)))
    common.Must2(serial.WriteUint64(h, uint64(t)))
    common.Must2(serial.WriteUint64(h, uint64(t)))
    return h.Sum(nil)
}

// ClientSession stores connection session info for VMess client.
type ClientSession struct {
    isAEAD          bool
    idHash          protocol.IDHash
    requestBodyKey  [16]byte
    requestBodyIV   [16]byte
    responseBodyKey [16]byte
    responseBodyIV  [16]byte
    responseReader  io.Reader
    responseHeader  byte
}

// NewClientSession creates a new ClientSession.
func NewClientSession(isAEAD bool, idHash protocol.IDHash, ctx context.Context, sessionServer *ServerSession) *ClientSession {

    session := &ClientSession{
        isAEAD: sessionServer.isAEADRequest,
        idHash: idHash,
    }

    //randomBytes := make([]byte, 33) // 16 + 16 + 1
    //common.Must2(rand.Read(randomBytes))
    //copy(session.requestBodyKey[:], randomBytes[:16])
    //session.requestBodyIV = []uint8{}
    //copy(session.requestBodyIV[:], randomBytes[16:32])
    //session.responseHeader = randomBytes[32]
    session.requestBodyIV = sessionServer.getRequestBodyIV()
    session.responseBodyIV = sessionServer.getResponseBodyIV()
    session.requestBodyKey = sessionServer.getRequestBodyKey()
    session.responseBodyKey = sessionServer.getResponseBodyKey()
    //if !session.isAEAD {
    //  session.responseBodyKey = md5.Sum(session.requestBodyKey[:])
    //  session.responseBodyIV = md5.Sum(session.requestBodyIV[:])
    //} else {
    //  BodyKey := sha256.Sum256(session.requestBodyKey[:])
    //  copy(session.responseBodyKey[:], BodyKey[:16])
    //  BodyIV := sha256.Sum256(session.requestBodyIV[:])
    //  copy(session.responseBodyIV[:], BodyIV[:16])
    //}

    return session
}

func (c *ClientSession) EncodeRequestHeader(header *protocol.RequestHeader, writer io.Writer) error {
    timestamp := protocol.NewTimestampGenerator(protocol.NowTime(), 30)()
    account := header.User.Account.(*vmess.MemoryAccount)
    if !c.isAEAD {
        idHash := c.idHash(account.AnyValidID().Bytes())
        common.Must2(serial.WriteUint64(idHash, uint64(timestamp)))
        common.Must2(writer.Write(idHash.Sum(nil)))
    }

    buffer := buf.New()
    defer buffer.Release()

    common.Must(buffer.WriteByte(Version))
    common.Must2(buffer.Write(c.requestBodyIV[:]))
    common.Must2(buffer.Write(c.requestBodyKey[:]))
    common.Must(buffer.WriteByte(c.responseHeader))
    common.Must(buffer.WriteByte(byte(header.Option)))

    padingLen := dice.Roll(16)
    security := byte(padingLen<<4) | byte(header.Security)
    common.Must2(buffer.Write([]byte{security, byte(0), byte(header.Command)}))

    if header.Command != protocol.RequestCommandMux {
        if err := addrParser.WriteAddressPort(buffer, header.Address, header.Port); err != nil {
            return newError("failed to writer address and port").Base(err)
        }
    }

    if padingLen > 0 {
        common.Must2(buffer.ReadFullFrom(rand.Reader, int32(padingLen)))
    }

    {
        fnv1a := fnv.New32a()
        common.Must2(fnv1a.Write(buffer.Bytes()))
        hashBytes := buffer.Extend(int32(fnv1a.Size()))
        fnv1a.Sum(hashBytes[:0])
    }

    if !c.isAEAD {
        iv := hashTimestamp(md5.New(), timestamp)
        aesStream := crypto.NewAesEncryptionStream(account.ID.CmdKey(), iv[:])
        aesStream.XORKeyStream(buffer.Bytes(), buffer.Bytes())
        common.Must2(writer.Write(buffer.Bytes()))
    } else {
        var fixedLengthCmdKey [16]byte
        copy(fixedLengthCmdKey[:], account.ID.CmdKey())
        vmessout := vmessaead.SealVMessAEADHeader(fixedLengthCmdKey, buffer.Bytes())
        common.Must2(io.Copy(writer, bytes.NewReader(vmessout)))
    }

    return nil
}

func (c *ClientSession) EncodeRequestBody(request *protocol.RequestHeader, writer io.Writer) buf.Writer {
    var sizeParser crypto.ChunkSizeEncoder = crypto.PlainChunkSizeParser{}
    if request.Option.Has(protocol.RequestOptionChunkMasking) {
        sizeParser = NewShakeSizeParser(c.requestBodyIV[:])
    }
    var padding crypto.PaddingLengthGenerator
    if request.Option.Has(protocol.RequestOptionGlobalPadding) {
        padding = sizeParser.(crypto.PaddingLengthGenerator)
    }

    switch request.Security {
    case protocol.SecurityType_NONE:
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            if request.Command.TransferType() == protocol.TransferTypeStream {
                return crypto.NewChunkStreamWriter(sizeParser, writer)
            }
            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(NoOpAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationWriter(auth, sizeParser, writer, protocol.TransferTypePacket, padding)
        }

        return buf.NewWriter(writer)
    case protocol.SecurityType_LEGACY:
        aesStream := crypto.NewAesEncryptionStream(c.requestBodyKey[:], c.requestBodyIV[:])
        cryptionWriter := crypto.NewCryptionWriter(aesStream, writer)
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(FnvAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationWriter(auth, sizeParser, cryptionWriter, request.Command.TransferType(), padding)
        }

        return &buf.SequentialWriter{Writer: cryptionWriter}
    case protocol.SecurityType_AES128_GCM:
        aead := crypto.NewAesGcm(c.requestBodyKey[:])
        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(c.requestBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationWriter(auth, sizeParser, writer, request.Command.TransferType(), padding)
    case protocol.SecurityType_CHACHA20_POLY1305:
        aead, err := chacha20poly1305.New(GenerateChacha20Poly1305Key(c.requestBodyKey[:]))
        common.Must(err)

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(c.requestBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationWriter(auth, sizeParser, writer, request.Command.TransferType(), padding)
    default:
        panic("Unknown security type.")
    }
}

func (c *ClientSession) DecodeResponseHeader(reader io.Reader) (*protocol.ResponseHeader, error) {
    if !c.isAEAD {
        aesStream := crypto.NewAesDecryptionStream(c.responseBodyKey[:], c.responseBodyIV[:])
        c.responseReader = crypto.NewCryptionReader(aesStream, reader)
    } else {
        aeadResponseHeaderLengthEncryptionKey := vmessaead.KDF16(c.responseBodyKey[:], vmessaead.KDFSaltConst_AEADRespHeaderLenKey)
        aeadResponseHeaderLengthEncryptionIV := vmessaead.KDF(c.responseBodyIV[:], vmessaead.KDFSaltConst_AEADRespHeaderLenIV)[:12]

        aeadResponseHeaderLengthEncryptionKeyAESBlock := common.Must2(aes.NewCipher(aeadResponseHeaderLengthEncryptionKey)).(cipher.Block)
        aeadResponseHeaderLengthEncryptionAEAD := common.Must2(cipher.NewGCM(aeadResponseHeaderLengthEncryptionKeyAESBlock)).(cipher.AEAD)

        var aeadEncryptedResponseHeaderLength [18]byte
        var decryptedResponseHeaderLength int
        var decryptedResponseHeaderLengthBinaryDeserializeBuffer uint16

        if _, err := io.ReadFull(reader, aeadEncryptedResponseHeaderLength[:]); err != nil {
            return nil, newError("Unable to Read Header Len").Base(err)
        }
        if decryptedResponseHeaderLengthBinaryBuffer, err := aeadResponseHeaderLengthEncryptionAEAD.Open(nil, aeadResponseHeaderLengthEncryptionIV, aeadEncryptedResponseHeaderLength[:], nil); err != nil {
            return nil, newError("Failed To Decrypt Length").Base(err)
        } else {
            common.Must(binary.Read(bytes.NewReader(decryptedResponseHeaderLengthBinaryBuffer), binary.BigEndian, &decryptedResponseHeaderLengthBinaryDeserializeBuffer))
            decryptedResponseHeaderLength = int(decryptedResponseHeaderLengthBinaryDeserializeBuffer)
        }

        aeadResponseHeaderPayloadEncryptionKey := vmessaead.KDF16(c.responseBodyKey[:], vmessaead.KDFSaltConst_AEADRespHeaderPayloadKey)
        aeadResponseHeaderPayloadEncryptionIV := vmessaead.KDF(c.responseBodyIV[:], vmessaead.KDFSaltConst_AEADRespHeaderPayloadIV)[:12]

        aeadResponseHeaderPayloadEncryptionKeyAESBlock := common.Must2(aes.NewCipher(aeadResponseHeaderPayloadEncryptionKey)).(cipher.Block)
        aeadResponseHeaderPayloadEncryptionAEAD := common.Must2(cipher.NewGCM(aeadResponseHeaderPayloadEncryptionKeyAESBlock)).(cipher.AEAD)

        encryptedResponseHeaderBuffer := make([]byte, decryptedResponseHeaderLength+16)

        if _, err := io.ReadFull(reader, encryptedResponseHeaderBuffer); err != nil {
            return nil, newError("Unable to Read Header Data").Base(err)
        }

        if decryptedResponseHeaderBuffer, err := aeadResponseHeaderPayloadEncryptionAEAD.Open(nil, aeadResponseHeaderPayloadEncryptionIV, encryptedResponseHeaderBuffer, nil); err != nil {
            return nil, newError("Failed To Decrypt Payload").Base(err)
        } else {
            c.responseReader = bytes.NewReader(decryptedResponseHeaderBuffer)
        }
    }

    buffer := buf.StackNew()
    defer buffer.Release()

    if _, err := buffer.ReadFullFrom(c.responseReader, 4); err != nil {
        return nil, newError("failed to read response header").Base(err).AtWarning()
    }

    if buffer.Byte(0) != c.responseHeader {
        return nil, newError("unexpected response header. Expecting ", int(c.responseHeader), " but actually ", int(buffer.Byte(0)))
    }

    header := &protocol.ResponseHeader{
        Option: bitmask.Byte(buffer.Byte(1)),
    }

    if buffer.Byte(2) != 0 {
        cmdID := buffer.Byte(2)
        dataLen := int32(buffer.Byte(3))

        buffer.Clear()
        if _, err := buffer.ReadFullFrom(c.responseReader, dataLen); err != nil {
            return nil, newError("failed to read response command").Base(err)
        }
        command, err := UnmarshalCommand(cmdID, buffer.Bytes())
        if err == nil {
            header.Command = command
        }
    }
    if c.isAEAD {
        aesStream := crypto.NewAesDecryptionStream(c.responseBodyKey[:], c.responseBodyIV[:])
        c.responseReader = crypto.NewCryptionReader(aesStream, reader)
    }
    return header, nil
}

func (c *ClientSession) DecodeResponseBody(request *protocol.RequestHeader, reader io.Reader) buf.Reader {
    var sizeParser crypto.ChunkSizeDecoder = crypto.PlainChunkSizeParser{}
    if request.Option.Has(protocol.RequestOptionChunkMasking) {
        sizeParser = NewShakeSizeParser(c.responseBodyIV[:])
    }
    var padding crypto.PaddingLengthGenerator
    if request.Option.Has(protocol.RequestOptionGlobalPadding) {
        padding = sizeParser.(crypto.PaddingLengthGenerator)
    }

    switch request.Security {
    case protocol.SecurityType_NONE:
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            if request.Command.TransferType() == protocol.TransferTypeStream {
                return crypto.NewChunkStreamReader(sizeParser, reader)
            }

            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(NoOpAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }

            return crypto.NewAuthenticationReader(auth, sizeParser, reader, protocol.TransferTypePacket, padding)
        }

        return buf.NewReader(reader)
    case protocol.SecurityType_LEGACY:
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(FnvAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationReader(auth, sizeParser, c.responseReader, request.Command.TransferType(), padding)
        }

        return buf.NewReader(c.responseReader)
    case protocol.SecurityType_AES128_GCM:
        aead := crypto.NewAesGcm(c.responseBodyKey[:])

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(c.responseBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationReader(auth, sizeParser, reader, request.Command.TransferType(), padding)
    case protocol.SecurityType_CHACHA20_POLY1305:
        aead, _ := chacha20poly1305.New(GenerateChacha20Poly1305Key(c.responseBodyKey[:]))

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(c.responseBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationReader(auth, sizeParser, reader, request.Command.TransferType(), padding)
    default:
        panic("Unknown security type.")
    }
}

func GenerateChunkNonce(nonce []byte, size uint32) crypto.BytesGenerator {
    c := append([]byte(nil), nonce...)
    count := uint16(0)
    return func() []byte {
        binary.BigEndian.PutUint16(c, count)
        count++
        return c[:size]
    }
}

package encoding

import (
    "bytes"
    "crypto/aes"
    "crypto/cipher"
    "crypto/md5"
    "crypto/sha256"
    "encoding/binary"
    "hash/fnv"
    "io"
    "io/ioutil"
    "sync"
    "time"

    "golang.org/x/crypto/chacha20poly1305"
    "v2ray.com/core/common"
    "v2ray.com/core/common/bitmask"
    "v2ray.com/core/common/buf"
    "v2ray.com/core/common/crypto"
    "v2ray.com/core/common/dice"
    "v2ray.com/core/common/net"
    "v2ray.com/core/common/protocol"
    "v2ray.com/core/common/task"
    "v2ray.com/core/proxy/vmess"
    vmessaead "v2ray.com/core/proxy/vmess/aead"
)

type sessionId struct {
    user  [16]byte
    key   [16]byte
    nonce [16]byte
}

// SessionHistory keeps track of historical session ids, to prevent replay attacks.
type SessionHistory struct {
    sync.RWMutex
    cache map[sessionId]time.Time
    task  *task.Periodic
}

// NewSessionHistory creates a new SessionHistory object.
func NewSessionHistory() *SessionHistory {
    h := &SessionHistory{
        cache: make(map[sessionId]time.Time, 128),
    }
    h.task = &task.Periodic{
        Interval: time.Second * 30,
        Execute:  h.removeExpiredEntries,
    }
    return h
}

// Close implements common.Closable.
func (h *SessionHistory) Close() error {
    return h.task.Close()
}

func (h *SessionHistory) addIfNotExits(session sessionId) bool {
    h.Lock()

    if expire, found := h.cache[session]; found && expire.After(time.Now()) {
        h.Unlock()
        return false
    }

    h.cache[session] = time.Now().Add(time.Minute * 3)
    h.Unlock()
    common.Must(h.task.Start())
    return true
}

func (h *SessionHistory) removeExpiredEntries() error {
    now := time.Now()

    h.Lock()
    defer h.Unlock()

    if len(h.cache) == 0 {
        return newError("nothing to do")
    }

    for session, expire := range h.cache {
        if expire.Before(now) {
            delete(h.cache, session)
        }
    }

    if len(h.cache) == 0 {
        h.cache = make(map[sessionId]time.Time, 128)
    }

    return nil
}

// ServerSession keeps information for a session in VMess server.
type ServerSession struct {
    userValidator   *vmess.TimedUserValidator
    sessionHistory  *SessionHistory
    requestBodyKey  [16]byte
    requestBodyIV   [16]byte
    responseBodyKey [16]byte
    responseBodyIV  [16]byte
    responseWriter  io.Writer
    responseHeader  byte

    isAEADRequest bool

    isAEADForced bool
}

func (s *ServerSession) getResponseBodyKey() [16]byte {
    s.responseBodyKey = md5.Sum(s.requestBodyKey[:])
    return s.responseBodyKey

}
func (s *ServerSession) getResponseBodyIV() [16]byte {
    s.responseBodyIV = md5.Sum(s.requestBodyIV[:])
    return s.responseBodyIV

}
func (s *ServerSession) getRequestBodyKey() [16]byte {

    return s.requestBodyKey

}
func (s *ServerSession) getRequestBodyIV() [16]byte {

    return s.requestBodyIV

}
func (s *ServerSession) IsAEADRequest() bool {
    return s.IsAEADRequest()
}

// NewServerSession creates a new ServerSession, using the given UserValidator.
// The ServerSession instance doesn't take ownership of the validator.
func NewServerSession(validator *vmess.TimedUserValidator, sessionHistory *SessionHistory) *ServerSession {
    return &ServerSession{
        userValidator:  validator,
        sessionHistory: sessionHistory,
    }
}

func parseSecurityType(b byte) protocol.SecurityType {
    if _, f := protocol.SecurityType_name[int32(b)]; f {
        st := protocol.SecurityType(b)
        // For backward compatibility.
        if st == protocol.SecurityType_UNKNOWN {
            st = protocol.SecurityType_LEGACY
        }
        return st
    }
    return protocol.SecurityType_UNKNOWN
}

// DecodeRequestHeader decodes and returns (if successful) a RequestHeader from an input stream.
func (s *ServerSession) DecodeRequestHeader(reader io.Reader) (*protocol.RequestHeader, error) {
    buffer := buf.New()
    behaviorRand := dice.NewDeterministicDice(int64(s.userValidator.GetBehaviorSeed()))
    BaseDrainSize := behaviorRand.Roll(3266)
    RandDrainMax := behaviorRand.Roll(64) + 1
    RandDrainRolled := dice.Roll(RandDrainMax)
    DrainSize := BaseDrainSize + 16 + 38 + RandDrainRolled
    readSizeRemain := DrainSize

    drainConnection := func(e error) error {
        //We read a deterministic generated length of data before closing the connection to offset padding read pattern
        readSizeRemain -= int(buffer.Len())
        if readSizeRemain > 0 {
            err := s.DrainConnN(reader, readSizeRemain)
            if err != nil {
                return newError("failed to drain connection DrainSize = ", BaseDrainSize, " ", RandDrainMax, " ", RandDrainRolled).Base(err).Base(e)
            }
            return newError("connection drained DrainSize = ", BaseDrainSize, " ", RandDrainMax, " ", RandDrainRolled).Base(e)
        }
        return e
    }

    defer func() {
        buffer.Release()
    }()

    if _, err := buffer.ReadFullFrom(reader, protocol.IDBytesLen); err != nil {
        return nil, newError("failed to read request header").Base(err)
    }

    var decryptor io.Reader
    var vmessAccount *vmess.MemoryAccount

    user, foundAEAD, errorAEAD := s.userValidator.GetAEAD(buffer.Bytes())

    var fixedSizeAuthID [16]byte
    copy(fixedSizeAuthID[:], buffer.Bytes())

    if foundAEAD {
        vmessAccount = user.Account.(*vmess.MemoryAccount)
        var fixedSizeCmdKey [16]byte
        copy(fixedSizeCmdKey[:], vmessAccount.ID.CmdKey())
        aeadData, shouldDrain, errorReason, bytesRead := vmessaead.OpenVMessAEADHeader(fixedSizeCmdKey, fixedSizeAuthID, reader)
        if errorReason != nil {
            if shouldDrain {
                readSizeRemain -= bytesRead
                return nil, drainConnection(newError("AEAD read failed").Base(errorReason))
            } else {
                return nil, drainConnection(newError("AEAD read failed, drain skiped").Base(errorReason))
            }
        }
        decryptor = bytes.NewReader(aeadData)
        s.isAEADRequest = true
    } else if !s.isAEADForced && errorAEAD == vmessaead.ErrNotFound {
        userLegacy, timestamp, valid, userValidationError := s.userValidator.Get(buffer.Bytes())
        if !valid || userValidationError != nil {
            return nil, drainConnection(newError("invalid user").Base(userValidationError))
        }
        user = userLegacy
        iv := hashTimestamp(md5.New(), timestamp)

        vmessAccount = userLegacy.Account.(*vmess.MemoryAccount)

        aesStream := crypto.NewAesDecryptionStream(vmessAccount.ID.CmdKey(), iv[:])
        decryptor = crypto.NewCryptionReader(aesStream, reader)
    } else {
        return nil, drainConnection(newError("invalid user").Base(errorAEAD))
    }

    readSizeRemain -= int(buffer.Len())
    buffer.Clear()
    if _, err := buffer.ReadFullFrom(decryptor, 38); err != nil {
        return nil, newError("failed to read request header").Base(err)
    }

    request := &protocol.RequestHeader{
        User:    user,
        Version: buffer.Byte(0),
    }

    copy(s.requestBodyIV[:], buffer.BytesRange(1, 17))   // 16 bytes
    copy(s.requestBodyKey[:], buffer.BytesRange(17, 33)) // 16 bytes
    var sid sessionId
    copy(sid.user[:], vmessAccount.ID.Bytes())
    sid.key = s.requestBodyKey
    sid.nonce = s.requestBodyIV
    if !s.sessionHistory.addIfNotExits(sid) {
        if !s.isAEADRequest {
            drainErr := s.userValidator.BurnTaintFuse(fixedSizeAuthID[:])
            if drainErr != nil {
                return nil, drainConnection(newError("duplicated session id, possibly under replay attack, and failed to taint userHash").Base(drainErr))
            }
            return nil, drainConnection(newError("duplicated session id, possibly under replay attack, userHash tainted"))
        } else {
            return nil, newError("duplicated session id, possibly under replay attack, but this is a AEAD request")
        }

    }

    s.responseHeader = buffer.Byte(33)             // 1 byte
    request.Option = bitmask.Byte(buffer.Byte(34)) // 1 byte
    padingLen := int(buffer.Byte(35) >> 4)
    request.Security = parseSecurityType(buffer.Byte(35) & 0x0F)
    // 1 bytes reserved
    request.Command = protocol.RequestCommand(buffer.Byte(37))

    switch request.Command {
    case protocol.RequestCommandMux:
        request.Address = net.DomainAddress("v1.mux.cool")
        request.Port = 0
    case protocol.RequestCommandTCP, protocol.RequestCommandUDP:
        if addr, port, err := addrParser.ReadAddressPort(buffer, decryptor); err == nil {
            request.Address = addr
            request.Port = port
        }
    }

    if padingLen > 0 {
        if _, err := buffer.ReadFullFrom(decryptor, int32(padingLen)); err != nil {
            if !s.isAEADRequest {
                burnErr := s.userValidator.BurnTaintFuse(fixedSizeAuthID[:])
                if burnErr != nil {
                    return nil, newError("failed to read padding, failed to taint userHash").Base(burnErr).Base(err)
                }
                return nil, newError("failed to read padding, userHash tainted").Base(err)
            }
            return nil, newError("failed to read padding").Base(err)
        }
    }

    if _, err := buffer.ReadFullFrom(decryptor, 4); err != nil {
        if !s.isAEADRequest {
            burnErr := s.userValidator.BurnTaintFuse(fixedSizeAuthID[:])
            if burnErr != nil {
                return nil, newError("failed to read checksum, failed to taint userHash").Base(burnErr).Base(err)
            }
            return nil, newError("failed to read checksum, userHash tainted").Base(err)
        }
        return nil, newError("failed to read checksum").Base(err)
    }

    fnv1a := fnv.New32a()
    common.Must2(fnv1a.Write(buffer.BytesTo(-4)))
    actualHash := fnv1a.Sum32()
    expectedHash := binary.BigEndian.Uint32(buffer.BytesFrom(-4))

    if actualHash != expectedHash {
        if !s.isAEADRequest {
            Autherr := newError("invalid auth, legacy userHash tainted")
            burnErr := s.userValidator.BurnTaintFuse(fixedSizeAuthID[:])
            if burnErr != nil {
                Autherr = newError("invalid auth, can't taint legacy userHash").Base(burnErr)
            }
            //It is possible that we are under attack described in https://github.com/v2ray/v2ray-core/issues/2523
            return nil, drainConnection(Autherr)
        } else {
            return nil, newError("invalid auth, but this is a AEAD request")
        }

    }

    if request.Address == nil {
        return nil, newError("invalid remote address")
    }

    if request.Security == protocol.SecurityType_UNKNOWN || request.Security == protocol.SecurityType_AUTO {
        return nil, newError("unknown security type: ", request.Security)
    }

    return request, nil
}

// DecodeRequestBody returns Reader from which caller can fetch decrypted body.
func (s *ServerSession) DecodeRequestBody(request *protocol.RequestHeader, reader io.Reader) buf.Reader {
    var sizeParser crypto.ChunkSizeDecoder = crypto.PlainChunkSizeParser{}
    if request.Option.Has(protocol.RequestOptionChunkMasking) {
        sizeParser = NewShakeSizeParser(s.requestBodyIV[:])
    }
    var padding crypto.PaddingLengthGenerator
    if request.Option.Has(protocol.RequestOptionGlobalPadding) {
        padding = sizeParser.(crypto.PaddingLengthGenerator)
    }

    switch request.Security {
    case protocol.SecurityType_NONE:
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            if request.Command.TransferType() == protocol.TransferTypeStream {
                return crypto.NewChunkStreamReader(sizeParser, reader)
            }

            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(NoOpAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationReader(auth, sizeParser, reader, protocol.TransferTypePacket, padding)
        }

        return buf.NewReader(reader)
    case protocol.SecurityType_LEGACY:
        aesStream := crypto.NewAesDecryptionStream(s.requestBodyKey[:], s.requestBodyIV[:])
        cryptionReader := crypto.NewCryptionReader(aesStream, reader)
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(FnvAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationReader(auth, sizeParser, cryptionReader, request.Command.TransferType(), padding)
        }

        return buf.NewReader(cryptionReader)
    case protocol.SecurityType_AES128_GCM:
        aead := crypto.NewAesGcm(s.requestBodyKey[:])

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(s.requestBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationReader(auth, sizeParser, reader, request.Command.TransferType(), padding)
    case protocol.SecurityType_CHACHA20_POLY1305:
        aead, _ := chacha20poly1305.New(GenerateChacha20Poly1305Key(s.requestBodyKey[:]))

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(s.requestBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationReader(auth, sizeParser, reader, request.Command.TransferType(), padding)
    default:
        panic("Unknown security type.")
    }
}

// EncodeResponseHeader writes encoded response header into the given writer.
func (s *ServerSession) EncodeResponseHeader(header *protocol.ResponseHeader, writer io.Writer) {
    var encryptionWriter io.Writer
    if !s.isAEADRequest {
        s.responseBodyKey = md5.Sum(s.requestBodyKey[:])
        s.responseBodyIV = md5.Sum(s.requestBodyIV[:])
    } else {
        BodyKey := sha256.Sum256(s.requestBodyKey[:])
        copy(s.responseBodyKey[:], BodyKey[:16])
        BodyIV := sha256.Sum256(s.requestBodyIV[:])
        copy(s.responseBodyIV[:], BodyIV[:16])
    }

    aesStream := crypto.NewAesEncryptionStream(s.responseBodyKey[:], s.responseBodyIV[:])
    encryptionWriter = crypto.NewCryptionWriter(aesStream, writer)
    s.responseWriter = encryptionWriter

    aeadEncryptedHeaderBuffer := bytes.NewBuffer(nil)

    if s.isAEADRequest {
        encryptionWriter = aeadEncryptedHeaderBuffer
    }

    common.Must2(encryptionWriter.Write([]byte{s.responseHeader, byte(header.Option)}))
    err := MarshalCommand(header.Command, encryptionWriter)
    if err != nil {
        common.Must2(encryptionWriter.Write([]byte{0x00, 0x00}))
    }

    if s.isAEADRequest {

        aeadResponseHeaderLengthEncryptionKey := vmessaead.KDF16(s.responseBodyKey[:], vmessaead.KDFSaltConst_AEADRespHeaderLenKey)
        aeadResponseHeaderLengthEncryptionIV := vmessaead.KDF(s.responseBodyIV[:], vmessaead.KDFSaltConst_AEADRespHeaderLenIV)[:12]

        aeadResponseHeaderLengthEncryptionKeyAESBlock := common.Must2(aes.NewCipher(aeadResponseHeaderLengthEncryptionKey)).(cipher.Block)
        aeadResponseHeaderLengthEncryptionAEAD := common.Must2(cipher.NewGCM(aeadResponseHeaderLengthEncryptionKeyAESBlock)).(cipher.AEAD)

        aeadResponseHeaderLengthEncryptionBuffer := bytes.NewBuffer(nil)

        decryptedResponseHeaderLengthBinaryDeserializeBuffer := uint16(aeadEncryptedHeaderBuffer.Len())

        common.Must(binary.Write(aeadResponseHeaderLengthEncryptionBuffer, binary.BigEndian, decryptedResponseHeaderLengthBinaryDeserializeBuffer))

        AEADEncryptedLength := aeadResponseHeaderLengthEncryptionAEAD.Seal(nil, aeadResponseHeaderLengthEncryptionIV, aeadResponseHeaderLengthEncryptionBuffer.Bytes(), nil)
        common.Must2(io.Copy(writer, bytes.NewReader(AEADEncryptedLength)))

        aeadResponseHeaderPayloadEncryptionKey := vmessaead.KDF16(s.responseBodyKey[:], vmessaead.KDFSaltConst_AEADRespHeaderPayloadKey)
        aeadResponseHeaderPayloadEncryptionIV := vmessaead.KDF(s.responseBodyIV[:], vmessaead.KDFSaltConst_AEADRespHeaderPayloadIV)[:12]

        aeadResponseHeaderPayloadEncryptionKeyAESBlock := common.Must2(aes.NewCipher(aeadResponseHeaderPayloadEncryptionKey)).(cipher.Block)
        aeadResponseHeaderPayloadEncryptionAEAD := common.Must2(cipher.NewGCM(aeadResponseHeaderPayloadEncryptionKeyAESBlock)).(cipher.AEAD)

        aeadEncryptedHeaderPayload := aeadResponseHeaderPayloadEncryptionAEAD.Seal(nil, aeadResponseHeaderPayloadEncryptionIV, aeadEncryptedHeaderBuffer.Bytes(), nil)
        common.Must2(io.Copy(writer, bytes.NewReader(aeadEncryptedHeaderPayload)))
    }
}

// EncodeResponseBody returns a Writer that auto-encrypt content written by caller.
func (s *ServerSession) EncodeResponseBody(request *protocol.RequestHeader, writer io.Writer) buf.Writer {
    var sizeParser crypto.ChunkSizeEncoder = crypto.PlainChunkSizeParser{}
    if request.Option.Has(protocol.RequestOptionChunkMasking) {
        sizeParser = NewShakeSizeParser(s.responseBodyIV[:])
    }
    var padding crypto.PaddingLengthGenerator
    if request.Option.Has(protocol.RequestOptionGlobalPadding) {
        padding = sizeParser.(crypto.PaddingLengthGenerator)
    }

    switch request.Security {
    case protocol.SecurityType_NONE:
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            if request.Command.TransferType() == protocol.TransferTypeStream {
                return crypto.NewChunkStreamWriter(sizeParser, writer)
            }

            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(NoOpAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationWriter(auth, sizeParser, writer, protocol.TransferTypePacket, padding)
        }

        return buf.NewWriter(writer)
    case protocol.SecurityType_LEGACY:
        if request.Option.Has(protocol.RequestOptionChunkStream) {
            auth := &crypto.AEADAuthenticator{
                AEAD:                    new(FnvAuthenticator),
                NonceGenerator:          crypto.GenerateEmptyBytes(),
                AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
            }
            return crypto.NewAuthenticationWriter(auth, sizeParser, s.responseWriter, request.Command.TransferType(), padding)
        }

        return &buf.SequentialWriter{Writer: s.responseWriter}
    case protocol.SecurityType_AES128_GCM:
        aead := crypto.NewAesGcm(s.responseBodyKey[:])

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(s.responseBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationWriter(auth, sizeParser, writer, request.Command.TransferType(), padding)
    case protocol.SecurityType_CHACHA20_POLY1305:
        aead, _ := chacha20poly1305.New(GenerateChacha20Poly1305Key(s.responseBodyKey[:]))

        auth := &crypto.AEADAuthenticator{
            AEAD:                    aead,
            NonceGenerator:          GenerateChunkNonce(s.responseBodyIV[:], uint32(aead.NonceSize())),
            AdditionalDataGenerator: crypto.GenerateEmptyBytes(),
        }
        return crypto.NewAuthenticationWriter(auth, sizeParser, writer, request.Command.TransferType(), padding)
    default:
        panic("Unknown security type.")
    }
}

func (s *ServerSession) DrainConnN(reader io.Reader, n int) error {
    _, err := io.CopyN(ioutil.Discard, reader, int64(n))
    return err
}

// +build !confonly

package vmess

import (
    "crypto/hmac"
    "crypto/sha256"
    "fmt"
    "hash"
    "hash/crc64"
    "strings"
    "sync"
    "sync/atomic"
    "time"

    "v2ray.com/core/common"
    "v2ray.com/core/common/dice"
    "v2ray.com/core/common/protocol"
    "v2ray.com/core/common/serial"
    "v2ray.com/core/common/task"
    "v2ray.com/core/proxy/vmess/aead"
)

const (
    updateInterval   = 10 * time.Second
    cacheDurationSec = 120
)

type user struct {
    user    protocol.MemoryUser
    lastSec protocol.Timestamp
}

// TimedUserValidator is a user Validator based on time.
type TimedUserValidator struct {
    sync.RWMutex
    users    []*user
    userHash map[[16]byte]indexTimePair
    hasher   protocol.IDHash
    baseTime protocol.Timestamp
    task     *task.Periodic

    behaviorSeed  uint64
    behaviorFused bool

    aeadDecoderHolder *aead.AuthIDDecoderHolder
}

type indexTimePair struct {
    user    *user
    timeInc uint32

    taintedFuse *uint32
}

// NewTimedUserValidator creates a new TimedUserValidator.
func NewTimedUserValidator(hasher protocol.IDHash) *TimedUserValidator {
    location, err := time.LoadLocation("Asia/Shanghai")
    if err != nil {
        fmt.Println(err)
    }
    stamp := time.Date(2021, 3, 12, 14, 2, 42, 673325408, location)
    tuv := &TimedUserValidator{
        users:    make([]*user, 0, 16),
        userHash: make(map[[16]byte]indexTimePair, 1024),
        hasher:   hasher,
        //baseTime:          protocol.Timestamp(time.Now().Unix() - cacheDurationSec*2),
        baseTime:          protocol.Timestamp(stamp.UTC().Unix() - cacheDurationSec*2),
        aeadDecoderHolder: aead.NewAuthIDDecoderHolder(),
    }
    tuv.task = &task.Periodic{
        Interval: updateInterval,
        Execute: func() error {
            tuv.updateUserHash()
            return nil
        },
    }
    common.Must(tuv.task.Start())
    return tuv
}

func (v *TimedUserValidator) generateNewHashes(nowSec protocol.Timestamp, user *user) {
    var hashValue [16]byte
    genEndSec := nowSec + cacheDurationSec
    genHashForID := func(id *protocol.ID) {
        idHash := v.hasher(id.Bytes())
        genBeginSec := user.lastSec
        if genBeginSec < nowSec-cacheDurationSec {
            genBeginSec = nowSec - cacheDurationSec
        }
        for ts := genBeginSec; ts <= genEndSec; ts++ {
            common.Must2(serial.WriteUint64(idHash, uint64(ts)))
            idHash.Sum(hashValue[:0])
            idHash.Reset()

            v.userHash[hashValue] = indexTimePair{
                user:        user,
                timeInc:     uint32(ts - v.baseTime),
                taintedFuse: new(uint32),
            }
        }
    }

    account := user.user.Account.(*MemoryAccount)

    genHashForID(account.ID)
    for _, id := range account.AlterIDs {
        genHashForID(id)
    }
    user.lastSec = genEndSec
}

func (v *TimedUserValidator) removeExpiredHashes(expire uint32) {
    for key, pair := range v.userHash {
        if pair.timeInc < expire {
            delete(v.userHash, key)
        }
    }
}

func (v *TimedUserValidator) updateUserHash() {
    now := time.Now()
    nowSec := protocol.Timestamp(now.Unix())
    v.Lock()
    defer v.Unlock()

    for _, user := range v.users {
        v.generateNewHashes(nowSec, user)
    }

    expire := protocol.Timestamp(now.Unix() - cacheDurationSec)
    if expire > v.baseTime {
        v.removeExpiredHashes(uint32(expire - v.baseTime))
    }
}

func (v *TimedUserValidator) Add(u *protocol.MemoryUser) error {
    v.Lock()
    defer v.Unlock()
    location, err := time.LoadLocation("Asia/Shanghai")
    if err != nil {
        fmt.Println(err)
    }
    stamp := time.Date(2021, 3, 12, 14, 2, 42, 673325408, location)
    //nowSec := time.Now().Unix()
    nowSec := stamp.UTC().Unix()

    uu := &user{
        user:    *u,
        lastSec: protocol.Timestamp(nowSec - cacheDurationSec),
    }
    v.users = append(v.users, uu)
    v.generateNewHashes(protocol.Timestamp(nowSec), uu)

    account := uu.user.Account.(*MemoryAccount)
    if !v.behaviorFused {
        hashkdf := hmac.New(func() hash.Hash { return sha256.New() }, []byte("VMESSBSKDF"))
        hashkdf.Write(account.ID.Bytes())
        v.behaviorSeed = crc64.Update(v.behaviorSeed, crc64.MakeTable(crc64.ECMA), hashkdf.Sum(nil))
    }

    var cmdkeyfl [16]byte
    copy(cmdkeyfl[:], account.ID.CmdKey())
    v.aeadDecoderHolder.AddUser(cmdkeyfl, u)

    return nil
}

func (v *TimedUserValidator) Get(userHash []byte) (*protocol.MemoryUser, protocol.Timestamp, bool, error) {
    defer v.RUnlock()
    v.RLock()

    v.behaviorFused = true

    var fixedSizeHash [16]byte
    copy(fixedSizeHash[:], userHash)
    pair, found := v.userHash[fixedSizeHash]
    if found {
        user := pair.user.user
        if atomic.LoadUint32(pair.taintedFuse) == 0 {
            return &user, protocol.Timestamp(pair.timeInc) + v.baseTime, true, nil
        }
        return nil, 0, false, ErrTainted
    }
    return nil, 0, false, ErrNotFound
}

func (v *TimedUserValidator) GetAEAD(userHash []byte) (*protocol.MemoryUser, bool, error) {
    defer v.RUnlock()
    v.RLock()
    var userHashFL [16]byte
    copy(userHashFL[:], userHash)

    userd, err := v.aeadDecoderHolder.Match(userHashFL)
    if err != nil {
        return nil, false, err
    }
    return userd.(*protocol.MemoryUser), true, err
}

func (v *TimedUserValidator) Remove(email string) bool {
    v.Lock()
    defer v.Unlock()

    idx := -1
    for i := range v.users {
        if strings.EqualFold(v.users[i].user.Email, email) {
            idx = i
            var cmdkeyfl [16]byte
            copy(cmdkeyfl[:], v.users[i].user.Account.(*MemoryAccount).ID.CmdKey())
            v.aeadDecoderHolder.RemoveUser(cmdkeyfl)
            break
        }
    }
    if idx == -1 {
        return false
    }
    ulen := len(v.users)

    v.users[idx] = v.users[ulen-1]
    v.users[ulen-1] = nil
    v.users = v.users[:ulen-1]

    return true
}

// Close implements common.Closable.
func (v *TimedUserValidator) Close() error {
    return v.task.Close()
}

func (v *TimedUserValidator) GetBehaviorSeed() uint64 {
    v.Lock()
    defer v.Unlock()
    v.behaviorFused = true
    if v.behaviorSeed == 0 {
        v.behaviorSeed = dice.RollUint64()
    }
    return v.behaviorSeed
}

func (v *TimedUserValidator) BurnTaintFuse(userHash []byte) error {
    v.RLock()
    defer v.RUnlock()
    var userHashFL [16]byte
    copy(userHashFL[:], userHash)

    pair, found := v.userHash[userHashFL]
    if found {
        if atomic.CompareAndSwapUint32(pair.taintedFuse, 0, 1) {
            return nil
        }
        return ErrTainted
    }
    return ErrNotFound
}

var ErrNotFound = newError("Not Found")

var ErrTainted = newError("ErrTainted")