Revert "Refactor obfuscate and deobfuscate functions to reduce a layer of indirection"

This reverts commit 415523f1

See issue #149

internal/multiplex/obfs.go

@@ -11,6 +11,9 @@ import (
 	"golang.org/x/crypto/salsa20"
 )
 
+type Obfser func(*Frame, []byte, int) (int, error)
+type Deobfser func(*Frame, []byte) error
+
 const frameHeaderLength = 14
 const salsa20NonceSize = 8
 
@@ -23,15 +26,21 @@ const (
 
 // Obfuscator is responsible for serialisation, obfuscation, and optional encryption of data frames.
 type Obfuscator struct {
-	payloadCipher cipher.AEAD
+	// Used in Stream.Write. Add multiplexing headers, encrypt and add TLS header
-
+	Obfs Obfser
+	// Remove TLS header, decrypt and unmarshall frames
+	Deobfs     Deobfser
 	SessionKey [32]byte
 
 	maxOverhead int
 }
 
-// obfuscate adds multiplexing headers, encrypt and add TLS header
+// MakeObfs returns a function of type Obfser. An Obfser takes three arguments:
-func (o *Obfuscator) obfuscate(f *Frame, buf []byte, payloadOffsetInBuf int) (int, error) {
+// a *Frame with all the field set correctly, a []byte as buffer to put encrypted
+// message in, and an int called payloadOffsetInBuf to be used when *Frame.payload
+// is in the byte slice used as buffer (2nd argument). payloadOffsetInBuf specifies
+// the index at which data belonging to *Frame.Payload starts in the buffer.
+func MakeObfs(salsaKey [32]byte, payloadCipher cipher.AEAD) Obfser {
 	// The method here is to use the first payloadCipher.NonceSize() bytes of the serialised frame header
 	// as iv/nonce for the AEAD cipher to encrypt the frame payload. Then we use
 	// the authentication tag produced appended to the end of the ciphertext (of size payloadCipher.Overhead())
@@ -63,19 +72,20 @@ func (o *Obfuscator) obfuscate(f *Frame, buf []byte, payloadOffsetInBuf int) (in
 	// We can't ensure its uniqueness ourselves, which is why plaintext mode must only be used when the user input
 	// is already random-like. For Cloak it would normally mean that the user is using a proxy protocol that sends
 	// encrypted data.
+	obfs := func(f *Frame, buf []byte, payloadOffsetInBuf int) (int, error) {
 		payloadLen := len(f.Payload)
 		if payloadLen == 0 {
 			return 0, errors.New("payload cannot be empty")
 		}
 		var extraLen int
-	if o.payloadCipher == nil {
+		if payloadCipher == nil {
 			extraLen = salsa20NonceSize - payloadLen
 			if extraLen < 0 {
 				// if our payload is already greater than 8 bytes
 				extraLen = 0
 			}
 		} else {
-		extraLen = o.payloadCipher.Overhead()
+			extraLen = payloadCipher.Overhead()
 			if extraLen < salsa20NonceSize {
 				return 0, errors.New("AEAD's Overhead cannot be fewer than 8 bytes")
 			}
@@ -98,32 +108,39 @@ func (o *Obfuscator) obfuscate(f *Frame, buf []byte, payloadOffsetInBuf int) (in
 		header[12] = f.Closing
 		header[13] = byte(extraLen)
 
-	if o.payloadCipher == nil {
+		if payloadCipher == nil {
 			if extraLen != 0 { // read nonce
 				extra := buf[usefulLen-extraLen : usefulLen]
 				common.CryptoRandRead(extra)
 			}
 		} else {
-		o.payloadCipher.Seal(payload[:0], header[:o.payloadCipher.NonceSize()], payload, nil)
+			payloadCipher.Seal(payload[:0], header[:payloadCipher.NonceSize()], payload, nil)
 		}
 
 		nonce := buf[usefulLen-salsa20NonceSize : usefulLen]
-	salsa20.XORKeyStream(header, header, nonce, &o.SessionKey)
+		salsa20.XORKeyStream(header, header, nonce, &salsaKey)
 
 		return usefulLen, nil
+	}
+	return obfs
 }
 
-// deobfuscate removes TLS header, decrypt and unmarshall frames
+// MakeDeobfs returns a function Deobfser. A Deobfser takes in a single byte slice,
-func (o *Obfuscator) deobfuscate(f *Frame, in []byte) error {
+// containing the message to be decrypted, and returns a *Frame containing the frame
-	if len(in) < frameHeaderLength+salsa20NonceSize {
+// information and plaintext
-		return fmt.Errorf("input size %v, but it cannot be shorter than %v bytes", len(in), frameHeaderLength+salsa20NonceSize)
+func MakeDeobfs(salsaKey [32]byte, payloadCipher cipher.AEAD) Deobfser {
+	// frame header length + minimum data size (i.e. nonce size of salsa20)
+	const minInputLen = frameHeaderLength + salsa20NonceSize
+	deobfs := func(f *Frame, in []byte) error {
+		if len(in) < minInputLen {
+			return fmt.Errorf("input size %v, but it cannot be shorter than %v bytes", len(in), minInputLen)
 		}
 
 		header := in[:frameHeaderLength]
 		pldWithOverHead := in[frameHeaderLength:] // payload + potential overhead
 
 		nonce := in[len(in)-salsa20NonceSize:]
-	salsa20.XORKeyStream(header, header, nonce, &o.SessionKey)
+		salsa20.XORKeyStream(header, header, nonce, &salsaKey)
 
 		streamID := binary.BigEndian.Uint32(header[0:4])
 		seq := binary.BigEndian.Uint64(header[4:12])
@@ -137,14 +154,14 @@ func (o *Obfuscator) deobfuscate(f *Frame, in []byte) error {
 
 		var outputPayload []byte
 
-	if o.payloadCipher == nil {
+		if payloadCipher == nil {
 			if extraLen == 0 {
 				outputPayload = pldWithOverHead
 			} else {
 				outputPayload = pldWithOverHead[:usefulPayloadLen]
 			}
 		} else {
-		_, err := o.payloadCipher.Open(pldWithOverHead[:0], header[:o.payloadCipher.NonceSize()], pldWithOverHead, nil)
+			_, err := payloadCipher.Open(pldWithOverHead[:0], header[:payloadCipher.NonceSize()], pldWithOverHead, nil)
 			if err != nil {
 				return err
 			}
@@ -156,6 +173,8 @@ func (o *Obfuscator) deobfuscate(f *Frame, in []byte) error {
 		f.Closing = closing
 		f.Payload = outputPayload
 		return nil
+	}
+	return deobfs
 }
 
 func MakeObfuscator(encryptionMethod byte, sessionKey [32]byte) (obfuscator Obfuscator, err error) {
@@ -196,7 +215,7 @@ func MakeObfuscator(encryptionMethod byte, sessionKey [32]byte) (obfuscator Obfu
 		}
 		obfuscator.maxOverhead = payloadCipher.Overhead()
 	default:
-		return obfuscator, fmt.Errorf("unknown encryption method valued %v", encryptionMethod)
+		return obfuscator, errors.New("Unknown encryption method")
 	}
 
 	if payloadCipher != nil {
@@ -205,5 +224,7 @@ func MakeObfuscator(encryptionMethod byte, sessionKey [32]byte) (obfuscator Obfu
 		}
 	}
 
+	obfuscator.Obfs = MakeObfs(sessionKey, payloadCipher)
+	obfuscator.Deobfs = MakeDeobfs(sessionKey, payloadCipher)
 	return
 }

internal/multiplex/obfs_test.go

@@ -19,14 +19,14 @@ func TestGenerateObfs(t *testing.T) {
 		obfsBuf := make([]byte, 512)
 		_testFrame, _ := quick.Value(reflect.TypeOf(&Frame{}), rand.New(rand.NewSource(42)))
 		testFrame := _testFrame.Interface().(*Frame)
-		i, err := obfuscator.obfuscate(testFrame, obfsBuf, 0)
+		i, err := obfuscator.Obfs(testFrame, obfsBuf, 0)
 		if err != nil {
 			ct.Error("failed to obfs ", err)
 			return
 		}
 
 		var resultFrame Frame
-		err = obfuscator.deobfuscate(&resultFrame, obfsBuf[:i])
+		err = obfuscator.Deobfs(&resultFrame, obfsBuf[:i])
 		if err != nil {
 			ct.Error("failed to deobfs ", err)
 			return
@@ -96,57 +96,40 @@ func BenchmarkObfs(b *testing.B) {
 		c, _ := aes.NewCipher(key[:])
 		payloadCipher, _ := cipher.NewGCM(c)
 
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, payloadCipher)
-			payloadCipher: payloadCipher,
-			SessionKey:    key,
-			maxOverhead:   payloadCipher.Overhead(),
-		}
-
 		b.SetBytes(int64(len(testFrame.Payload)))
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			obfuscator.obfuscate(testFrame, obfsBuf, 0)
+			obfs(testFrame, obfsBuf, 0)
 		}
 	})
 	b.Run("AES128GCM", func(b *testing.B) {
 		c, _ := aes.NewCipher(key[:16])
 		payloadCipher, _ := cipher.NewGCM(c)
 
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, payloadCipher)
-			payloadCipher: payloadCipher,
-			SessionKey:    key,
-			maxOverhead:   payloadCipher.Overhead(),
-		}
 		b.SetBytes(int64(len(testFrame.Payload)))
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			obfuscator.obfuscate(testFrame, obfsBuf, 0)
+			obfs(testFrame, obfsBuf, 0)
 		}
 	})
 	b.Run("plain", func(b *testing.B) {
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, nil)
-			payloadCipher: nil,
-			SessionKey:    key,
-			maxOverhead:   salsa20NonceSize,
-		}
 		b.SetBytes(int64(len(testFrame.Payload)))
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			obfuscator.obfuscate(testFrame, obfsBuf, 0)
+			obfs(testFrame, obfsBuf, 0)
 		}
 	})
 	b.Run("chacha20Poly1305", func(b *testing.B) {
-		payloadCipher, _ := chacha20poly1305.New(key[:])
+		payloadCipher, _ := chacha20poly1305.New(key[:16])
 
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, payloadCipher)
-			payloadCipher: payloadCipher,
-			SessionKey:    key,
-			maxOverhead:   payloadCipher.Overhead(),
-		}
 		b.SetBytes(int64(len(testFrame.Payload)))
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			obfuscator.obfuscate(testFrame, obfsBuf, 0)
+			obfs(testFrame, obfsBuf, 0)
 		}
 	})
 }
@@ -168,70 +151,57 @@ func BenchmarkDeobfs(b *testing.B) {
 	b.Run("AES256GCM", func(b *testing.B) {
 		c, _ := aes.NewCipher(key[:])
 		payloadCipher, _ := cipher.NewGCM(c)
-		obfuscator := Obfuscator{
-			payloadCipher: payloadCipher,
-			SessionKey:    key,
-			maxOverhead:   payloadCipher.Overhead(),
-		}
 
-		n, _ := obfuscator.obfuscate(testFrame, obfsBuf, 0)
+		obfs := MakeObfs(key, payloadCipher)
+		n, _ := obfs(testFrame, obfsBuf, 0)
+		deobfs := MakeDeobfs(key, payloadCipher)
 
 		frame := new(Frame)
 		b.SetBytes(int64(n))
 		b.ResetTimer()
 		for i := 0; i < b.N; i++ {
-			obfuscator.deobfuscate(frame, obfsBuf[:n])
+			deobfs(frame, obfsBuf[:n])
 		}
 	})
 	b.Run("AES128GCM", func(b *testing.B) {
 		c, _ := aes.NewCipher(key[:16])
 		payloadCipher, _ := cipher.NewGCM(c)
 
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, payloadCipher)
-			payloadCipher: payloadCipher,
+		n, _ := obfs(testFrame, obfsBuf, 0)
-			SessionKey:    key,
+		deobfs := MakeDeobfs(key, payloadCipher)
-			maxOverhead:   payloadCipher.Overhead(),
-		}
-		n, _ := obfuscator.obfuscate(testFrame, obfsBuf, 0)
 
 		frame := new(Frame)
 		b.ResetTimer()
 		b.SetBytes(int64(n))
 		for i := 0; i < b.N; i++ {
-			obfuscator.deobfuscate(frame, obfsBuf[:n])
+			deobfs(frame, obfsBuf[:n])
 		}
 	})
 	b.Run("plain", func(b *testing.B) {
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, nil)
-			payloadCipher: nil,
+		n, _ := obfs(testFrame, obfsBuf, 0)
-			SessionKey:    key,
+		deobfs := MakeDeobfs(key, nil)
-			maxOverhead:   salsa20NonceSize,
-		}
-		n, _ := obfuscator.obfuscate(testFrame, obfsBuf, 0)
 
 		frame := new(Frame)
 		b.ResetTimer()
 		b.SetBytes(int64(n))
 		for i := 0; i < b.N; i++ {
-			obfuscator.deobfuscate(frame, obfsBuf[:n])
+			deobfs(frame, obfsBuf[:n])
 		}
 	})
 	b.Run("chacha20Poly1305", func(b *testing.B) {
-		payloadCipher, _ := chacha20poly1305.New(key[:])
+		payloadCipher, _ := chacha20poly1305.New(key[:16])
 
-		obfuscator := Obfuscator{
+		obfs := MakeObfs(key, payloadCipher)
-			payloadCipher: nil,
+		n, _ := obfs(testFrame, obfsBuf, 0)
-			SessionKey:    key,
+		deobfs := MakeDeobfs(key, payloadCipher)
-			maxOverhead:   payloadCipher.Overhead(),
-		}
-
-		n, _ := obfuscator.obfuscate(testFrame, obfsBuf, 0)
 
 		frame := new(Frame)
 		b.ResetTimer()
 		b.SetBytes(int64(n))
 		for i := 0; i < b.N; i++ {
-			obfuscator.deobfuscate(frame, obfsBuf[:n])
+			deobfs(frame, obfsBuf[:n])
 		}
 	})
 }

internal/multiplex/session.go

@@ -232,7 +232,7 @@ func (sesh *Session) recvDataFromRemote(data []byte) error {
 	frame := sesh.recvFramePool.Get().(*Frame)
 	defer sesh.recvFramePool.Put(frame)
 
-	err := sesh.deobfuscate(frame, data)
+	err := sesh.Deobfs(frame, data)
 	if err != nil {
 		return fmt.Errorf("Failed to decrypt a frame for session %v: %v", sesh.id, err)
 	}
@@ -331,7 +331,7 @@ func (sesh *Session) Close() error {
 		Closing:  closingSession,
 		Payload:  payload,
 	}
-	i, err := sesh.obfuscate(f, *buf, frameHeaderLength)
+	i, err := sesh.Obfs(f, *buf, frameHeaderLength)
 	if err != nil {
 		return err
 	}

internal/multiplex/session_test.go

@@ -4,10 +4,7 @@ import (
 	"bytes"
 	"github.com/cbeuw/connutil"
 	"github.com/stretchr/testify/assert"
-	"io"
-	"io/ioutil"
 	"math/rand"
-	"net"
 	"strconv"
 	"sync"
 	"sync/atomic"
@@ -19,188 +16,73 @@ var seshConfigs = map[string]SessionConfig{
 	"ordered":   {},
 	"unordered": {Unordered: true},
 }
-var encryptionMethods = map[string]byte{
-	"plain":            EncryptionMethodPlain,
-	"aes-256-gcm":      EncryptionMethodAES256GCM,
-	"aes-128-gcm":      EncryptionMethodAES128GCM,
-	"chacha20poly1305": EncryptionMethodChaha20Poly1305,
-}
 
 const testPayloadLen = 1024
 const obfsBufLen = testPayloadLen * 2
 
 func TestRecvDataFromRemote(t *testing.T) {
+	testPayload := make([]byte, testPayloadLen)
+	rand.Read(testPayload)
+	f := &Frame{
+		1,
+		0,
+		0,
+		testPayload,
+	}
+	obfsBuf := make([]byte, obfsBufLen)
+
 	var sessionKey [32]byte
 	rand.Read(sessionKey[:])
 
+	MakeObfuscatorUnwrap := func(method byte, sessionKey [32]byte) Obfuscator {
+		ret, err := MakeObfuscator(method, sessionKey)
+		if err != nil {
+			t.Fatalf("failed to make an obfuscator: %v", err)
+		}
+		return ret
+	}
+
+	encryptionMethods := map[string]Obfuscator{
+		"plain":             MakeObfuscatorUnwrap(EncryptionMethodPlain, sessionKey),
+		"aes-gcm":           MakeObfuscatorUnwrap(EncryptionMethodAES256GCM, sessionKey),
+		"chacha20-poly1305": MakeObfuscatorUnwrap(EncryptionMethodChaha20Poly1305, sessionKey),
+	}
+
 	for seshType, seshConfig := range seshConfigs {
 		seshConfig := seshConfig
 		t.Run(seshType, func(t *testing.T) {
-			var err error
+			for method, obfuscator := range encryptionMethods {
-			seshConfig.Obfuscator, err = MakeObfuscator(EncryptionMethodPlain, sessionKey)
+				obfuscator := obfuscator
-			if err != nil {
+				t.Run(method, func(t *testing.T) {
-				t.Fatalf("failed to make obfuscator: %v", err)
+					seshConfig.Obfuscator = obfuscator
-			}
-			t.Run("initial frame", func(t *testing.T) {
 					sesh := MakeSession(0, seshConfig)
-				obfsBuf := make([]byte, obfsBufLen)
+					n, err := sesh.Obfs(f, obfsBuf, 0)
-				f := Frame{
+					if err != nil {
-					1,
+						t.Error(err)
-					0,
+						return
-					0,
-					make([]byte, testPayloadLen),
 					}
-				rand.Read(f.Payload)
-				n, err := sesh.obfuscate(&f, obfsBuf, 0)
-				assert.NoError(t, err)
 					err = sesh.recvDataFromRemote(obfsBuf[:n])
-				assert.NoError(t, err)
+					if err != nil {
+						t.Error(err)
+						return
+					}
 					stream, err := sesh.Accept()
-				assert.NoError(t, err)
+					if err != nil {
+						t.Error(err)
+						return
+					}
 
 					resultPayload := make([]byte, testPayloadLen)
 					_, err = stream.Read(resultPayload)
-				assert.NoError(t, err)
+					if err != nil {
-
+						t.Error(err)
-				assert.EqualValues(t, f.Payload, resultPayload)
+						return
-			})
-
-			t.Run("two frames in order", func(t *testing.T) {
-				sesh := MakeSession(0, seshConfig)
-				obfsBuf := make([]byte, obfsBufLen)
-				f := Frame{
-					1,
-					0,
-					0,
-					make([]byte, testPayloadLen),
 					}
-				rand.Read(f.Payload)
+					if !bytes.Equal(testPayload, resultPayload) {
-				n, err := sesh.obfuscate(&f, obfsBuf, 0)
+						t.Errorf("Expecting %x, got %x", testPayload, resultPayload)
-				assert.NoError(t, err)
-				err = sesh.recvDataFromRemote(obfsBuf[:n])
-				assert.NoError(t, err)
-				stream, err := sesh.Accept()
-				assert.NoError(t, err)
-
-				resultPayload := make([]byte, testPayloadLen)
-				_, err = io.ReadFull(stream, resultPayload)
-				assert.NoError(t, err)
-
-				assert.EqualValues(t, f.Payload, resultPayload)
-
-				f.Seq += 1
-				rand.Read(f.Payload)
-				n, err = sesh.obfuscate(&f, obfsBuf, 0)
-				assert.NoError(t, err)
-				err = sesh.recvDataFromRemote(obfsBuf[:n])
-				assert.NoError(t, err)
-
-				_, err = io.ReadFull(stream, resultPayload)
-				assert.NoError(t, err)
-
-				assert.EqualValues(t, f.Payload, resultPayload)
-			})
-
-			t.Run("two frames in order", func(t *testing.T) {
-				sesh := MakeSession(0, seshConfig)
-				obfsBuf := make([]byte, obfsBufLen)
-				f := Frame{
-					1,
-					0,
-					0,
-					make([]byte, testPayloadLen),
 					}
-				rand.Read(f.Payload)
-				n, err := sesh.obfuscate(&f, obfsBuf, 0)
-				assert.NoError(t, err)
-				err = sesh.recvDataFromRemote(obfsBuf[:n])
-				assert.NoError(t, err)
-				stream, err := sesh.Accept()
-				assert.NoError(t, err)
-
-				resultPayload := make([]byte, testPayloadLen)
-				_, err = io.ReadFull(stream, resultPayload)
-				assert.NoError(t, err)
-
-				assert.EqualValues(t, f.Payload, resultPayload)
-
-				f.Seq += 1
-				rand.Read(f.Payload)
-				n, err = sesh.obfuscate(&f, obfsBuf, 0)
-				assert.NoError(t, err)
-				err = sesh.recvDataFromRemote(obfsBuf[:n])
-				assert.NoError(t, err)
-
-				_, err = io.ReadFull(stream, resultPayload)
-				assert.NoError(t, err)
-
-				assert.EqualValues(t, f.Payload, resultPayload)
-			})
-
-			if seshType == "ordered" {
-				t.Run("frames out of order", func(t *testing.T) {
-					sesh := MakeSession(0, seshConfig)
-					obfsBuf := make([]byte, obfsBufLen)
-					f := Frame{
-						1,
-						0,
-						0,
-						nil,
-					}
-
-					// First frame
-					seq0 := make([]byte, testPayloadLen)
-					rand.Read(seq0)
-					f.Seq = 0
-					f.Payload = seq0
-					n, err := sesh.obfuscate(&f, obfsBuf, 0)
-					assert.NoError(t, err)
-					err = sesh.recvDataFromRemote(obfsBuf[:n])
-					assert.NoError(t, err)
-
-					// Third frame
-					seq2 := make([]byte, testPayloadLen)
-					rand.Read(seq2)
-					f.Seq = 2
-					f.Payload = seq2
-					n, err = sesh.obfuscate(&f, obfsBuf, 0)
-					assert.NoError(t, err)
-					err = sesh.recvDataFromRemote(obfsBuf[:n])
-					assert.NoError(t, err)
-
-					// Second frame
-					seq1 := make([]byte, testPayloadLen)
-					rand.Read(seq1)
-					f.Seq = 1
-					f.Payload = seq1
-					n, err = sesh.obfuscate(&f, obfsBuf, 0)
-					assert.NoError(t, err)
-					err = sesh.recvDataFromRemote(obfsBuf[:n])
-					assert.NoError(t, err)
-
-					// Expect things to receive in order
-					stream, err := sesh.Accept()
-					assert.NoError(t, err)
-
-					resultPayload := make([]byte, testPayloadLen)
-
-					// First
-					_, err = io.ReadFull(stream, resultPayload)
-					assert.NoError(t, err)
-					assert.EqualValues(t, seq0, resultPayload)
-
-					// Second
-					_, err = io.ReadFull(stream, resultPayload)
-					assert.NoError(t, err)
-					assert.EqualValues(t, seq1, resultPayload)
-
-					// Third
-					_, err = io.ReadFull(stream, resultPayload)
-					assert.NoError(t, err)
-					assert.EqualValues(t, seq2, resultPayload)
 				})
 			}
-
 		})
 	}
 }
@@ -212,9 +94,10 @@ func TestRecvDataFromRemote_Closing_InOrder(t *testing.T) {
 
 	var sessionKey [32]byte
 	rand.Read(sessionKey[:])
+	obfuscator, _ := MakeObfuscator(EncryptionMethodPlain, sessionKey)
 
 	seshConfig := seshConfigs["ordered"]
-	seshConfig.Obfuscator, _ = MakeObfuscator(EncryptionMethodPlain, sessionKey)
+	seshConfig.Obfuscator = obfuscator
 	sesh := MakeSession(0, seshConfig)
 
 	f1 := &Frame{
@@ -224,7 +107,7 @@ func TestRecvDataFromRemote_Closing_InOrder(t *testing.T) {
 		testPayload,
 	}
 	// create stream 1
-	n, _ := sesh.obfuscate(f1, obfsBuf, 0)
+	n, _ := sesh.Obfs(f1, obfsBuf, 0)
 	err := sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving normal frame for stream 1: %v", err)
@@ -246,7 +129,7 @@ func TestRecvDataFromRemote_Closing_InOrder(t *testing.T) {
 		closingNothing,
 		testPayload,
 	}
-	n, _ = sesh.obfuscate(f2, obfsBuf, 0)
+	n, _ = sesh.Obfs(f2, obfsBuf, 0)
 	err = sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving normal frame for stream 2: %v", err)
@@ -268,7 +151,7 @@ func TestRecvDataFromRemote_Closing_InOrder(t *testing.T) {
 		closingStream,
 		testPayload,
 	}
-	n, _ = sesh.obfuscate(f1CloseStream, obfsBuf, 0)
+	n, _ = sesh.Obfs(f1CloseStream, obfsBuf, 0)
 	err = sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving stream closing frame for stream 1: %v", err)
@@ -297,7 +180,7 @@ func TestRecvDataFromRemote_Closing_InOrder(t *testing.T) {
 	}
 
 	// close stream 1 again
-	n, _ = sesh.obfuscate(f1CloseStream, obfsBuf, 0)
+	n, _ = sesh.Obfs(f1CloseStream, obfsBuf, 0)
 	err = sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving stream closing frame for stream 1 %v", err)
@@ -320,7 +203,7 @@ func TestRecvDataFromRemote_Closing_InOrder(t *testing.T) {
 		Closing:  closingSession,
 		Payload:  testPayload,
 	}
-	n, _ = sesh.obfuscate(fCloseSession, obfsBuf, 0)
+	n, _ = sesh.Obfs(fCloseSession, obfsBuf, 0)
 	err = sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving session closing frame: %v", err)
@@ -350,9 +233,10 @@ func TestRecvDataFromRemote_Closing_OutOfOrder(t *testing.T) {
 
 	var sessionKey [32]byte
 	rand.Read(sessionKey[:])
+	obfuscator, _ := MakeObfuscator(EncryptionMethodPlain, sessionKey)
 
 	seshConfig := seshConfigs["ordered"]
-	seshConfig.Obfuscator, _ = MakeObfuscator(EncryptionMethodPlain, sessionKey)
+	seshConfig.Obfuscator = obfuscator
 	sesh := MakeSession(0, seshConfig)
 
 	// receive stream 1 closing first
@@ -362,7 +246,7 @@ func TestRecvDataFromRemote_Closing_OutOfOrder(t *testing.T) {
 		closingStream,
 		testPayload,
 	}
-	n, _ := sesh.obfuscate(f1CloseStream, obfsBuf, 0)
+	n, _ := sesh.Obfs(f1CloseStream, obfsBuf, 0)
 	err := sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving out of order stream closing frame for stream 1: %v", err)
@@ -384,7 +268,7 @@ func TestRecvDataFromRemote_Closing_OutOfOrder(t *testing.T) {
 		closingNothing,
 		testPayload,
 	}
-	n, _ = sesh.obfuscate(f1, obfsBuf, 0)
+	n, _ = sesh.Obfs(f1, obfsBuf, 0)
 	err = sesh.recvDataFromRemote(obfsBuf[:n])
 	if err != nil {
 		t.Fatalf("receiving normal frame for stream 1: %v", err)
@@ -446,7 +330,7 @@ func TestParallelStreams(t *testing.T) {
 				wg.Add(1)
 				go func(frame *Frame) {
 					obfsBuf := make([]byte, obfsBufLen)
-					n, _ := sesh.obfuscate(frame, obfsBuf, 0)
+					n, _ := sesh.Obfs(frame, obfsBuf, 0)
 					obfsBuf = obfsBuf[0:n]
 
 					err := sesh.recvDataFromRemote(obfsBuf)
@@ -531,7 +415,7 @@ func TestSession_timeoutAfter(t *testing.T) {
 	}
 }
 
-func BenchmarkRecvDataFromRemote(b *testing.B) {
+func BenchmarkRecvDataFromRemote_Ordered(b *testing.B) {
 	testPayload := make([]byte, testPayloadLen)
 	rand.Read(testPayload)
 	f := &Frame{
@@ -544,24 +428,25 @@ func BenchmarkRecvDataFromRemote(b *testing.B) {
 	var sessionKey [32]byte
 	rand.Read(sessionKey[:])
 
+	table := map[string]byte{
+		"plain":            EncryptionMethodPlain,
+		"aes-gcm":          EncryptionMethodAES256GCM,
+		"chacha20poly1305": EncryptionMethodChaha20Poly1305,
+	}
+
 	const maxIter = 100_000 // run with -benchtime 100000x to avoid index out of bounds panic
-	for name, ep := range encryptionMethods {
+	for name, ep := range table {
 		ep := ep
 		b.Run(name, func(b *testing.B) {
-			for seshType, seshConfig := range seshConfigs {
+			seshConfig := seshConfigs["ordered"]
-				b.Run(seshType, func(b *testing.B) {
+			obfuscator, _ := MakeObfuscator(ep, sessionKey)
-					seshConfig.Obfuscator, _ = MakeObfuscator(ep, sessionKey)
+			seshConfig.Obfuscator = obfuscator
 			sesh := MakeSession(0, seshConfig)
 
-					go func() {
-						stream, _ := sesh.Accept()
-						stream.(*Stream).WriteTo(ioutil.Discard)
-					}()
-
 			binaryFrames := [maxIter][]byte{}
 			for i := 0; i < maxIter; i++ {
 				obfsBuf := make([]byte, obfsBufLen)
-						n, _ := sesh.obfuscate(f, obfsBuf, 0)
+				n, _ := sesh.Obfs(f, obfsBuf, 0)
 				binaryFrames[i] = obfsBuf[:n]
 				f.Seq++
 			}
@@ -573,21 +458,27 @@ func BenchmarkRecvDataFromRemote(b *testing.B) {
 			}
 		})
 	}
-		})
-	}
 }
 
 func BenchmarkMultiStreamWrite(b *testing.B) {
 	var sessionKey [32]byte
 	rand.Read(sessionKey[:])
 
+	table := map[string]byte{
+		"plain":            EncryptionMethodPlain,
+		"aes-gcm":          EncryptionMethodAES256GCM,
+		"chacha20poly1305": EncryptionMethodChaha20Poly1305,
+	}
+
 	testPayload := make([]byte, testPayloadLen)
 
-	for name, ep := range encryptionMethods {
+	for name, ep := range table {
 		b.Run(name, func(b *testing.B) {
 			for seshType, seshConfig := range seshConfigs {
+				seshConfig := seshConfig
 				b.Run(seshType, func(b *testing.B) {
-					seshConfig.Obfuscator, _ = MakeObfuscator(ep, sessionKey)
+					obfuscator, _ := MakeObfuscator(ep, sessionKey)
+					seshConfig.Obfuscator = obfuscator
 					sesh := MakeSession(0, seshConfig)
 					sesh.AddConnection(connutil.Discard())
 					b.ResetTimer()
@@ -603,36 +494,3 @@ func BenchmarkMultiStreamWrite(b *testing.B) {
 		})
 	}
 }
-
-func BenchmarkLatency(b *testing.B) {
-	var sessionKey [32]byte
-	rand.Read(sessionKey[:])
-
-	for name, ep := range encryptionMethods {
-		b.Run(name, func(b *testing.B) {
-			for seshType, seshConfig := range seshConfigs {
-				b.Run(seshType, func(b *testing.B) {
-					seshConfig.Obfuscator, _ = MakeObfuscator(ep, sessionKey)
-					clientSesh := MakeSession(0, seshConfig)
-					serverSesh := MakeSession(0, seshConfig)
-
-					c, s := net.Pipe()
-					clientSesh.AddConnection(c)
-					serverSesh.AddConnection(s)
-
-					buf := make([]byte, 64)
-					clientStream, _ := clientSesh.OpenStream()
-					clientStream.Write(buf)
-					serverStream, _ := serverSesh.Accept()
-					io.ReadFull(serverStream, buf)
-
-					b.ResetTimer()
-					for i := 0; i < b.N; i++ {
-						clientStream.Write(buf)
-						io.ReadFull(serverStream, buf)
-					}
-				})
-			}
-		})
-	}
-}

internal/multiplex/stream.go

@@ -113,7 +113,7 @@ func (s *Stream) WriteTo(w io.Writer) (int64, error) {
 }
 
 func (s *Stream) obfuscateAndSend(buf []byte, payloadOffsetInBuf int) error {
-	cipherTextLen, err := s.session.obfuscate(&s.writingFrame, buf, payloadOffsetInBuf)
+	cipherTextLen, err := s.session.Obfs(&s.writingFrame, buf, payloadOffsetInBuf)
 	s.writingFrame.Seq++
 	if err != nil {
 		return err

internal/multiplex/stream_test.go

@@ -142,7 +142,7 @@ func TestStream_Close(t *testing.T) {
 		writingEnd := common.NewTLSConn(rawWritingEnd)
 
 		obfsBuf := make([]byte, 512)
-		i, _ := sesh.obfuscate(dataFrame, obfsBuf, 0)
+		i, _ := sesh.Obfs(dataFrame, obfsBuf, 0)
 		_, err := writingEnd.Write(obfsBuf[:i])
 		if err != nil {
 			t.Error("failed to write from remote end")
@@ -185,7 +185,7 @@ func TestStream_Close(t *testing.T) {
 		writingEnd := common.NewTLSConn(rawWritingEnd)
 
 		obfsBuf := make([]byte, 512)
-		i, err := sesh.obfuscate(dataFrame, obfsBuf, 0)
+		i, err := sesh.Obfs(dataFrame, obfsBuf, 0)
 		if err != nil {
 			t.Errorf("failed to obfuscate frame %v", err)
 		}
@@ -207,7 +207,7 @@ func TestStream_Close(t *testing.T) {
 			testPayload,
 		}
 
-		i, err = sesh.obfuscate(closingFrame, obfsBuf, 0)
+		i, err = sesh.Obfs(closingFrame, obfsBuf, 0)
 		if err != nil {
 			t.Errorf("failed to obfuscate frame %v", err)
 		}
@@ -223,7 +223,7 @@ func TestStream_Close(t *testing.T) {
 			testPayload,
 		}
 
-		i, err = sesh.obfuscate(closingFrameDup, obfsBuf, 0)
+		i, err = sesh.Obfs(closingFrameDup, obfsBuf, 0)
 		if err != nil {
 			t.Errorf("failed to obfuscate frame %v", err)
 		}
@@ -275,7 +275,7 @@ func TestStream_Read(t *testing.T) {
 			obfsBuf := make([]byte, 512)
 			t.Run("Plain read", func(t *testing.T) {
 				f.StreamID = streamID
-				i, _ := sesh.obfuscate(f, obfsBuf, 0)
+				i, _ := sesh.Obfs(f, obfsBuf, 0)
 				streamID++
 				writingEnd.Write(obfsBuf[:i])
 				stream, err := sesh.Accept()
@@ -300,7 +300,7 @@ func TestStream_Read(t *testing.T) {
 			})
 			t.Run("Nil buf", func(t *testing.T) {
 				f.StreamID = streamID
-				i, _ := sesh.obfuscate(f, obfsBuf, 0)
+				i, _ := sesh.Obfs(f, obfsBuf, 0)
 				streamID++
 				writingEnd.Write(obfsBuf[:i])
 				stream, _ := sesh.Accept()
@@ -312,7 +312,7 @@ func TestStream_Read(t *testing.T) {
 			})
 			t.Run("Read after stream close", func(t *testing.T) {
 				f.StreamID = streamID
-				i, _ := sesh.obfuscate(f, obfsBuf, 0)
+				i, _ := sesh.Obfs(f, obfsBuf, 0)
 				streamID++
 				writingEnd.Write(obfsBuf[:i])
 				stream, _ := sesh.Accept()
@@ -337,7 +337,7 @@ func TestStream_Read(t *testing.T) {
 			})
 			t.Run("Read after session close", func(t *testing.T) {
 				f.StreamID = streamID
-				i, _ := sesh.obfuscate(f, obfsBuf, 0)
+				i, _ := sesh.Obfs(f, obfsBuf, 0)
 				streamID++
 				writingEnd.Write(obfsBuf[:i])
 				stream, _ := sesh.Accept()