mirrors/uquic
1
0
Fork 0
mirror of https://github.com/refraction-networking/uquic.git synced 2025-04-03 20:27:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #3132 from lucas-clemente/amplification-limit-fixes

Browse source 
various amplification limit fixes
This commit is contained in:
Marten Seemann 2021-04-02 18:32:38 +07:00 • committed by GitHub
commit 4b10e67bf1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 87 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

80
internal/ackhandler/sent_packet_handler_test.go
View file

@ -540,29 +540,6 @@ var _ = Describe("SentPacketHandler", func() {
handler.SendMode()
})
It("limits the window to 3x the bytes received, to avoid amplification attacks", func() {
handler.ReceivedPacket(protocol.EncryptionInitial) // receiving an Initial packet doesn't validate the client's address
handler.ReceivedBytes(200)
cong.EXPECT().OnPacketSent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), true).Times(2)
handler.SentPacket(&Packet{
PacketNumber: 1,
Length: 599,
EncryptionLevel: protocol.EncryptionInitial,
Frames: []Frame{{Frame: &wire.PingFrame{}}},
SendTime: time.Now(),
})
cong.EXPECT().CanSend(protocol.ByteCount(599)).Return(true)
Expect(handler.SendMode()).To(Equal(SendAny))
handler.SentPacket(&Packet{
PacketNumber: 2,
Length: 1,
EncryptionLevel: protocol.EncryptionInitial,
Frames: []Frame{{Frame: &wire.PingFrame{}}},
SendTime: time.Now(),
})
Expect(handler.SendMode()).To(Equal(SendNone))
})
It("allows sending of ACKs when congestion limited", func() {
handler.ReceivedPacket(protocol.EncryptionHandshake)
cong.EXPECT().CanSend(gomock.Any()).Return(true)
@ -635,6 +612,7 @@ var _ = Describe("SentPacketHandler", func() {
})
It("implements exponential backoff", func() {
handler.peerAddressValidated = true
handler.SetHandshakeConfirmed()
sendTime := time.Now().Add(-time.Hour)
handler.SentPacket(ackElicitingPacket(&Packet{PacketNumber: 1, SendTime: sendTime}))
@ -828,7 +806,61 @@ var _ = Describe("SentPacketHandler", func() {
})
})
Context("amplification limit", func() {
Context("amplification limit, for the server", func() {
It("limits the window to 3x the bytes received, to avoid amplification attacks", func() {
handler.ReceivedPacket(protocol.EncryptionInitial) // receiving an Initial packet doesn't validate the client's address
handler.ReceivedBytes(200)
handler.SentPacket(&Packet{
PacketNumber: 1,
Length: 599,
EncryptionLevel: protocol.EncryptionInitial,
Frames: []Frame{{Frame: &wire.PingFrame{}}},
SendTime: time.Now(),
})
Expect(handler.SendMode()).To(Equal(SendAny))
handler.SentPacket(&Packet{
PacketNumber: 2,
Length: 1,
EncryptionLevel: protocol.EncryptionInitial,
Frames: []Frame{{Frame: &wire.PingFrame{}}},
SendTime: time.Now(),
})
Expect(handler.SendMode()).To(Equal(SendNone))
})
It("cancels the loss detection timer when it is amplification limited, and resets it when becoming unblocked", func() {
handler.ReceivedBytes(300)
handler.SentPacket(&Packet{
PacketNumber: 1,
Length: 900,
EncryptionLevel: protocol.EncryptionInitial,
Frames: []Frame{{Frame: &wire.PingFrame{}}},
SendTime: time.Now(),
})
// Amplification limited. We don't need to set a timer now.
Expect(handler.GetLossDetectionTimeout()).To(BeZero())
// Unblock the server. Now we should fire up the timer.
handler.ReceivedBytes(1)
Expect(handler.GetLossDetectionTimeout()).ToNot(BeZero())
})
It("resets the loss detection timer when the client's address is validated", func() {
handler.ReceivedBytes(300)
handler.SentPacket(&Packet{
PacketNumber: 1,
Length: 900,
EncryptionLevel: protocol.EncryptionHandshake,
Frames: []Frame{{Frame: &wire.PingFrame{}}},
SendTime: time.Now(),
})
// Amplification limited. We don't need to set a timer now.
Expect(handler.GetLossDetectionTimeout()).To(BeZero())
handler.ReceivedPacket(protocol.EncryptionHandshake)
Expect(handler.GetLossDetectionTimeout()).ToNot(BeZero())
})
})
Context("amplification limit, for the client", func() {
BeforeEach(func() {
perspective = protocol.PerspectiveClient
})