Add encrypted UDP voice (OCB2-AES128) with TCP fallback

- Port of Mumble's CryptStateOCB2 (XEX* counter-measures, late/lost/replay
  handling, nonce resync), verified against Mumble's OCB2 test vectors
- UDP channel per connection in the main process, to the address the TLS
  connection reached; used only while the server answers UDP pings, falls back
  to the TCP tunnel automatically; "voice over TCP only" setting
- Voice statistics show the live transport
- Information dialog no longer infers the transport from ping counters
- Message box: no padding, input fills the bar; Edit HTML only in descriptions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/app.e2e.ts

@@ -180,6 +180,13 @@ try {
   const statsText = await page.locator('.stats').textContent();
   const decoded = Number(/decoded (\d+)/.exec(statsText ?? '')?.[1]);
   assert.ok(decoded >= 20, `decoded frames reported: ${statsText}`);
+  // Voice runs over encrypted UDP once the server answers UDP pings
+  await page.locator('.stats', { hasText: /Transport: UDP, \d+ ms ping/ }).waitFor({ timeout: 10000 });
+  await page.getByLabel(/Send voice over TCP only/).check();
+  await page.locator('.stats', { hasText: 'Transport: TCP tunnel' }).waitFor();
+  await page.getByLabel(/Send voice over TCP only/).uncheck();
+  await page.locator('.stats', { hasText: /Transport: UDP/ }).waitFor();
+  console.log('ok: voice transport UDP, with a TCP-only switch');
   await page.getByRole('button', { name: 'Done', exact: true }).click();
   console.log(`ok: ${decoded} frames decoded`);
   await setMode('Push to talk');

test/ocb2.test.ts

@@ -0,0 +1,68 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { randomBytes } from 'node:crypto';
+import { ocbEncrypt, ocbDecrypt, CryptState } from '../electron/ocb2.ts';
+
+const key = Buffer.from([...Array(16).keys()]);
+
+test('OCB2 matches the test vectors used by Mumble (draft-krovetz-ocb-00)', () => {
+  const [, blankTag] = ocbEncrypt(key, Buffer.alloc(0), key);
+  assert.equal(blankTag.toString('hex'), 'bf3108130773ad5ec70ec69e7875a7b0');
+  const source = Buffer.from([...Array(40).keys()]);
+  const [crypt, tag] = ocbEncrypt(key, source, key);
+  assert.equal(tag.toString('hex'), '9db0cdf880f73e3e10d4eb3217766688');
+  assert.equal(crypt.toString('hex'), 'f75d6bc8b4dc8d66b836a2b08b32a6369f1cd3c5228d79fd6c267f5f6aa7b231c7dfb9d59951ae9c');
+});
+
+test('encrypt and decrypt round trip for every length up to 127 bytes', () => {
+  const nonce = Buffer.from('ffeeddccbbaa99887766554433221100', 'hex');
+  for (let len = 0; len < 128; len++) {
+    const plain = randomBytes(len);
+    const [ct, tag] = ocbEncrypt(key, plain, nonce);
+    const [back, tag2, ok] = ocbDecrypt(key, ct, nonce);
+    assert.ok(ok);
+    assert.ok(back.equals(plain), `len ${len}`);
+    assert.ok(tag.equals(tag2));
+  }
+});
+
+function pair() {
+  const k = randomBytes(16), cn = randomBytes(16), sn = randomBytes(16);
+  const client = new CryptState(), server = new CryptState();
+  client.setKey(k, cn, sn);
+  server.setKey(k, sn, cn); // the server encrypts with the client's decrypt nonce and vice versa
+  return { client, server };
+}
+
+test('crypt state: in order, lost, late, replay and tampering', () => {
+  const { client, server } = pair();
+  const packets = Array.from({ length: 300 }, (_, i) => client.encrypt(Buffer.from(`voice ${i}`)));
+  // In order (crosses the 256 wrap of the IV byte)
+  for (let i = 0; i < 280; i++) assert.equal(server.decrypt(packets[i])?.toString(), `voice ${i}`);
+  // 280-282 missing, then 281 arrives late (lost goes back down, like Mumble)
+  assert.equal(server.decrypt(packets[283])?.toString(), 'voice 283');
+  assert.equal(server.lost, 3);
+  assert.equal(server.decrypt(packets[281])?.toString(), 'voice 281');
+  assert.equal(server.late, 1);
+  assert.equal(server.lost, 2);
+  // Replays are rejected
+  assert.equal(server.decrypt(packets[281]), null);
+  assert.equal(server.decrypt(packets[283]), null);
+  // Tampered packets are rejected and do not disturb the state
+  const bad = Buffer.from(packets[284]); bad[6] ^= 1;
+  assert.equal(server.decrypt(bad), null);
+  assert.equal(server.decrypt(packets[284])?.toString(), 'voice 284');
+  assert.equal(server.good, 283);
+});
+
+test('XEX* attack counter-measure: the pattern is changed on encrypt and refused on decrypt', () => {
+  const nonce = randomBytes(16);
+  const attack = Buffer.alloc(32);
+  attack[15] = 16 * 8; // second to last block all zero except the last byte
+  const [, , okStrict] = ocbEncrypt(key, attack, nonce, false);
+  assert.equal(okStrict, false, 'pattern detected');
+  const [ct] = ocbEncrypt(key, attack, nonce);
+  const [plain, , ok] = ocbDecrypt(key, ct, nonce);
+  assert.ok(ok);
+  assert.notDeepEqual([...plain], [...attack], 'one bit was flipped to defuse the pattern');
+});

test/server.test.ts

@@ -8,10 +8,34 @@ import type { Transport } from '../src/core/transport.ts';
 import { openTls } from '../electron/tls-transport.ts';
 import { generateIdentity } from '../electron/identity.ts';
 import { encodeVoice, decodeVoice } from '../src/core/voice-packet.ts';
+import { udpChannel } from '../electron/udp-voice.ts';
 
 const target = process.env.MUMBLE_TEST_HOST;
 const codec = createCodec();
 
+function connectUdp(name: string): Promise<MumbleClient> {
+  const [host, port] = target!.split(':');
+  const id = generateIdentity(name);
+  const client = new MumbleClient(codec);
+  let udp: ReturnType<typeof udpChannel> | undefined;
+  let conn: ReturnType<typeof openTls> | undefined;
+  const transport: Transport = { onData: null, onClose: null, send: b => conn?.send(b), close: () => { udp?.close(); conn?.close(); } };
+  return new Promise((resolve, reject) => {
+    conn = openTls(host, Number(port || 64738), id.certPem, id.keyPem, {
+      // UDP goes to the address the TLS connection actually reached
+      onSecure: info => {
+        udp = udpChannel(info.address, info.port);
+        transport.udp = udp;
+        client.connect(transport, { username: name, os: 'test' });
+      },
+      onData: c => transport.onData?.(c),
+      onClose: r => { udp?.close(); transport.onClose?.(r); }
+    });
+    client.on('synced', () => resolve(client));
+    client.on('close', reject);
+  });
+}
+
 function connect(name: string, password = ''): Promise<MumbleClient> {
   const [host, port] = target!.split(':');
   const id = generateIdentity(name);
@@ -232,3 +256,30 @@ test('channel management and ACLs as SuperUser', { skip: !target || !superPw },
   }
 });
 
+test('voice over encrypted UDP (OCB2) between two clients', { skip: !target }, async () => {
+  const alice = await connectUdp('udpA' + Date.now() % 1000);
+  const bob = await connectUdp('udpB' + Date.now() % 1000);
+  try {
+    // Both sides confirm UDP with encrypted pings
+    await until<void>(res => { if (alice.udpOk) res(); else alice.on('udp', ok => { if (ok) res(); }); }, 8000);
+    await until<void>(res => { if (bob.udpOk) res(); else bob.on('udp', ok => { if (ok) res(); }); }, 8000);
+    assert.ok(alice.udpRtt >= 0);
+
+    // Alice's voice goes out over UDP and reaches bob over UDP, not the TCP tunnel
+    let tunneled = 0;
+    const origSend = (alice as any).sendVoiceTunnel.bind(alice);
+    (alice as any).sendVoiceTunnel = (p: Uint8Array) => { tunneled++; origSend(p); };
+    const got = until<number>(res => {
+      let n = 0;
+      bob.on('voice', raw => { const p = decodeVoice(raw); if (p?.session === alice.session && ++n === 10) res(n); });
+    });
+    const opus = new Uint8Array([0x78, ...new Array(40).fill(9)]);
+    for (let i = 0; i < 10; i++) alice.sendVoice(encodeVoice({ target: 0, frame: i * 2, opus, last: i === 9 }, alice.protobufVoice));
+    assert.equal(await got, 10);
+    assert.equal(tunneled, 0, 'nothing went through the TCP tunnel');
+  } finally {
+    alice.disconnect();
+    bob.disconnect();
+  }
+});
+