I just did a joint and I need to commit before things go wrong

cmd/ck-client/ck-client.go

@@ -187,7 +187,7 @@ start:
 	case 0x00:
 		crypto = &mux.Plain{}
 	case 0x01:
-		crypto, err = mux.MakeAESCipher(sta.UID)
+		crypto, err = mux.MakeAESGCMCipher(sta.UID)
 		if err != nil {
 			log.Println(err)
 			return

cmd/ck-server/ck-server.go

@@ -154,7 +154,7 @@ func dispatchConnection(conn net.Conn, sta *server.State) {
 	case 0x00:
 		crypto = &mux.Plain{}
 	case 0x01:
-		crypto, err = mux.MakeAESCipher(UID)
+		crypto, err = mux.MakeAESGCMCipher(UID)
 		if err != nil {
 			log.Println(err)
 			goWeb(data)

internal/client/state.go

@@ -110,7 +110,7 @@ func (sta *State) ParseConfig(conf string) (err error) {
 	switch preParse.EncryptionMethod {
 	case "plain":
 		sta.EncryptionMethod = 0x00
-	case "aes":
+	case "aes-gcm":
 		sta.EncryptionMethod = 0x01
 	case "chacha20-poly1305":
 		sta.EncryptionMethod = 0x02

internal/multiplex/crypto.go

@@ -21,41 +21,37 @@ func (p *Plain) encrypt(plaintext []byte, nonce []byte) ([]byte, error) {
 }
 
 func (p *Plain) decrypt(buf []byte, nonce []byte) ([]byte, error) {
-	return buf, nil
+	return buf[:len(buf)-16], nil
 }
 
-type AES struct {
+type AESGCM struct {
-	cipher cipher.Block
+	cipher cipher.AEAD
 }
 
-func MakeAESCipher(key []byte) (*AES, error) {
+func MakeAESGCMCipher(key []byte) (*AESGCM, error) {
 	c, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, err
 	}
-	ret := AES{
+	g, err := cipher.NewGCM(c)
-		c,
+	if err != nil {
+		return nil, err
+	}
+	ret := AESGCM{
+		g,
 	}
 	return &ret, nil
 }
 
-func (a *AES) encrypt(plaintext []byte, nonce []byte) ([]byte, error) {
+func (a *AESGCM) encrypt(plaintext []byte, nonce []byte) ([]byte, error) {
-	aesgcm, err := cipher.NewGCM(a.cipher)
+	ciphertext := a.cipher.Seal(nil, nonce, plaintext, nil)
-	if err != nil {
-		return nil, err
-	}
-	ciphertext := aesgcm.Seal(nil, nonce, plaintext, nil)
 	ret := make([]byte, len(plaintext)+16)
 	copy(ret, ciphertext)
 	return ret, nil
 }
 
-func (a *AES) decrypt(ciphertext []byte, nonce []byte) ([]byte, error) {
+func (a *AESGCM) decrypt(ciphertext []byte, nonce []byte) ([]byte, error) {
-	aesgcm, err := cipher.NewGCM(a.cipher)
+	plain, err := a.cipher.Open(nil, nonce, ciphertext, nil)
-	if err != nil {
-		return nil, err
-	}
-	plain, err := aesgcm.Open(nil, nonce, ciphertext, nil)
 	if err != nil {
 		return nil, err
 	}

internal/multiplex/obfs.go

@@ -84,11 +84,14 @@ func MakeDeobfs(key []byte, algo Crypto) Deobfser {
 			return nil, err
 		}
 
+		outputPayload := make([]byte, len(decryptedPayload))
+		copy(outputPayload, decryptedPayload)
+
 		ret := &Frame{
 			StreamID: streamID,
 			Seq:      seq,
 			Closing:  closing,
-			Payload:  decryptedPayload,
+			Payload:  outputPayload,
 		}
 		return ret, nil
 	}