Function encrypt

src/dnscrypt.rs:241–290

(
    packet: Vec<u8>,
    params: &EncryptionParams,
    max_packet_size: usize,
)

}

pub fn encrypt(
    packet: Vec<u8>,
    params: &EncryptionParams,
    max_packet_size: usize,
) -> Result<Vec<u8>, Error> {
    // Every response is framed the same way: the response magic followed by the
    // full nonce. Only the encryption of the payload differs between schemes.
    let nonce = match params {
        EncryptionParams::Classical { nonce, .. } | EncryptionParams::Pq { nonce, .. } => nonce,
    };
    let mut wrapped_packet = Vec::with_capacity(DNS_MAX_PACKET_SIZE);
    wrapped_packet.extend_from_slice(&DNSCRYPT_RESPONSE_MAGIC);
    wrapped_packet.extend_from_slice(nonce);
    match params {
        EncryptionParams::Classical { shared_key, nonce } => {
            ensure!(
                max_packet_size >= wrapped_packet.len(),
                "Max packet size too short"
            );
            let max_encrypted_size = max_packet_size - wrapped_packet.len();
            shared_key.encrypt_into(
                &mut wrapped_packet,
                nonce,
                &nonce[..DNSCRYPT_QUERY_NONCE_SIZE],
                packet,
                max_encrypted_size,
            )?;
        }
        EncryptionParams::Pq {
            shared_key,
            nonce,
            control,
        } => {
            ensure!(
                max_packet_size >= wrapped_packet.len() + DNSCRYPT_MAC_SIZE,
                "Max packet size too short"
            );
            let max_plaintext = max_packet_size - wrapped_packet.len() - DNSCRYPT_MAC_SIZE;
            let mut plaintext = Vec::with_capacity(2 + control.len() + packet.len() + 64);
            plaintext.extend_from_slice(&(control.len() as u16).to_be_bytes());
            plaintext.extend_from_slice(control);
            plaintext.extend_from_slice(&packet);
            pq::pad7816(&mut plaintext, 64);
            ensure!(plaintext.len() <= max_plaintext, "PQ response too large to pad");
            let encrypted = shared_key.seal_raw(nonce, &plaintext);
            wrapped_packet.extend_from_slice(&encrypted);
        }
    }
    Ok(wrapped_packet)
}

pub fn may_be_quic(packet: &[u8]) -> bool {
    !packet.is_empty() && ((80..=127).contains(&packet[0]) || (192..=255).contains(&packet[0]))