Function decrypt

src/dnscrypt.rs:61–137

(
    wrapped_packet: &[u8],
    dnscrypt_encryption_params_set: &[Arc<DNSCryptEncryptionParams>],
    pq_ticket_key: &pq::TicketKey,
    pq_enabled: bool,
)

}

pub fn decrypt(
    wrapped_packet: &[u8],
    dnscrypt_encryption_params_set: &[Arc<DNSCryptEncryptionParams>],
    pq_ticket_key: &pq::TicketKey,
    pq_enabled: bool,
) -> Result<(EncryptionParams, Vec<u8>), Error> {
    ensure!(wrapped_packet.len() >= DNSCRYPT_QUERY_MAGIC_SIZE, "Short packet");

    if pq_enabled && wrapped_packet[..pq::PQ_RESUME_MAGIC.len()] == pq::PQ_RESUME_MAGIC {
        return decrypt_pq_resumed(wrapped_packet, dnscrypt_encryption_params_set, pq_ticket_key);
    }

    let client_magic = &wrapped_packet[..DNSCRYPT_QUERY_MAGIC_SIZE];

    if pq_enabled {
        if let Some(params) = dnscrypt_encryption_params_set
            .iter()
            .find(|p| p.pq().is_some_and(|pq| pq.client_magic() == client_magic))
        {
            return decrypt_pq_ciphertext(wrapped_packet, params, pq_ticket_key);
        }
    }

    ensure!(
        wrapped_packet.len()
            >= DNSCRYPT_QUERY_MAGIC_SIZE
                + DNSCRYPT_QUERY_PK_SIZE
                + DNSCRYPT_QUERY_NONCE_SIZE
                + DNS_HEADER_SIZE,
        "Short packet"
    );
    let client_pk = &wrapped_packet
        [DNSCRYPT_QUERY_MAGIC_SIZE..DNSCRYPT_QUERY_MAGIC_SIZE + DNSCRYPT_QUERY_PK_SIZE];
    let client_nonce = &wrapped_packet[DNSCRYPT_QUERY_MAGIC_SIZE + DNSCRYPT_QUERY_PK_SIZE
        ..DNSCRYPT_QUERY_MAGIC_SIZE + DNSCRYPT_QUERY_PK_SIZE + DNSCRYPT_QUERY_NONCE_SIZE];
    let encrypted_packet = &wrapped_packet[DNSCRYPT_QUERY_HEADER_SIZE..];

    let dnscrypt_encryption_params = dnscrypt_encryption_params_set
        .iter()
        .find(|p| p.client_magic() == client_magic)
        .ok_or_else(|| anyhow!("Client magic not found"))?;

    let mut nonce = [0u8; DNSCRYPT_FULL_NONCE_SIZE];
    nonce[..DNSCRYPT_QUERY_NONCE_SIZE].copy_from_slice(client_nonce);

    let cached_shared_key = {
        let mut key_cache = dnscrypt_encryption_params
            .key_cache
            .as_ref()
            .unwrap()
            .lock();
        key_cache
            .get(client_pk)
            .map(|cached_shared_key| (*cached_shared_key).clone())
    };
    let shared_key = match cached_shared_key {
        Some(cached_shared_key) => cached_shared_key,
        None => {