mirror of
https://github.com/refraction-networking/uquic.git
synced 2025-04-03 20:27:35 +03:00
implement a more intuitive address validation API
This commit is contained in:
Marten Seemann
parent
556a6e2f99
commit
f2fa98c0dd
14 changed files with 352 additions and 437 deletions
434
server_test.go
434
server_test.go
|
|
@ -126,22 +126,22 @@ var _ = Describe("Server", func() {
|
|||
Expect(server.config.Versions).To(Equal(protocol.SupportedVersions))
|
||||
Expect(server.config.HandshakeIdleTimeout).To(Equal(protocol.DefaultHandshakeIdleTimeout))
|
||||
Expect(server.config.MaxIdleTimeout).To(Equal(protocol.DefaultIdleTimeout))
|
||||
Expect(reflect.ValueOf(server.config.AcceptToken)).To(Equal(reflect.ValueOf(defaultAcceptToken)))
|
||||
Expect(server.config.KeepAlivePeriod).To(Equal(0 * time.Second))
|
||||
Expect(server.config.RequireAddressValidation).ToNot(BeNil())
|
||||
Expect(server.config.KeepAlivePeriod).To(BeZero())
|
||||
// stop the listener
|
||||
Expect(ln.Close()).To(Succeed())
|
||||
})
|
||||
|
||||
It("setups with the right values", func() {
|
||||
supportedVersions := []protocol.VersionNumber{protocol.VersionTLS}
|
||||
acceptToken := func(_ net.Addr, _ *Token) bool { return true }
|
||||
requireAddrVal := func(net.Addr) bool { return true }
|
||||
config := Config{
|
||||
Versions: supportedVersions,
|
||||
AcceptToken: acceptToken,
|
||||
HandshakeIdleTimeout: 1337 * time.Hour,
|
||||
MaxIdleTimeout: 42 * time.Minute,
|
||||
KeepAlivePeriod: 5 * time.Second,
|
||||
StatelessResetKey: []byte("foobar"),
|
||||
Versions: supportedVersions,
|
||||
HandshakeIdleTimeout: 1337 * time.Hour,
|
||||
MaxIdleTimeout: 42 * time.Minute,
|
||||
KeepAlivePeriod: 5 * time.Second,
|
||||
StatelessResetKey: []byte("foobar"),
|
||||
RequireAddressValidation: requireAddrVal,
|
||||
}
|
||||
ln, err := Listen(conn, tlsConf, &config)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
|
|
@ -150,7 +150,7 @@ var _ = Describe("Server", func() {
|
|||
Expect(server.config.Versions).To(Equal(supportedVersions))
|
||||
Expect(server.config.HandshakeIdleTimeout).To(Equal(1337 * time.Hour))
|
||||
Expect(server.config.MaxIdleTimeout).To(Equal(42 * time.Minute))
|
||||
Expect(reflect.ValueOf(server.config.AcceptToken)).To(Equal(reflect.ValueOf(acceptToken)))
|
||||
Expect(reflect.ValueOf(server.config.RequireAddressValidation)).To(Equal(reflect.ValueOf(requireAddrVal)))
|
||||
Expect(server.config.KeepAlivePeriod).To(Equal(5 * time.Second))
|
||||
Expect(server.config.StatelessResetKey).To(Equal([]byte("foobar")))
|
||||
// stop the listener
|
||||
|
|
@ -239,60 +239,8 @@ var _ = Describe("Server", func() {
|
|||
time.Sleep(50 * time.Millisecond)
|
||||
})
|
||||
|
||||
It("decodes the token from the Token field", func() {
|
||||
raddr := &net.UDPAddr{
|
||||
IP: net.IPv4(192, 168, 13, 37),
|
||||
Port: 1337,
|
||||
}
|
||||
done := make(chan struct{})
|
||||
serv.config.AcceptToken = func(addr net.Addr, token *Token) bool {
|
||||
Expect(addr).To(Equal(raddr))
|
||||
Expect(token).ToNot(BeNil())
|
||||
close(done)
|
||||
return false
|
||||
}
|
||||
token, err := serv.tokenGenerator.NewRetryToken(raddr, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
packet := getPacket(&wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
Token: token,
|
||||
Version: serv.config.Versions[0],
|
||||
}, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.remoteAddr = raddr
|
||||
conn.EXPECT().WriteTo(gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
tracer.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("passes an empty token to the callback, if decoding fails", func() {
|
||||
raddr := &net.UDPAddr{
|
||||
IP: net.IPv4(192, 168, 13, 37),
|
||||
Port: 1337,
|
||||
}
|
||||
done := make(chan struct{})
|
||||
serv.config.AcceptToken = func(addr net.Addr, token *Token) bool {
|
||||
Expect(addr).To(Equal(raddr))
|
||||
Expect(token).To(BeNil())
|
||||
close(done)
|
||||
return false
|
||||
}
|
||||
packet := getPacket(&wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
Token: []byte("foobar"),
|
||||
Version: serv.config.Versions[0],
|
||||
}, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.remoteAddr = raddr
|
||||
conn.EXPECT().WriteTo(gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
tracer.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("creates a connection when the token is accepted", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, token *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
retryToken, err := serv.tokenGenerator.NewRetryToken(
|
||||
&net.UDPAddr{},
|
||||
protocol.ConnectionID{0xde, 0xad, 0xc0, 0xde},
|
||||
|
|
@ -469,8 +417,8 @@ var _ = Describe("Server", func() {
|
|||
time.Sleep(scaleDuration(20 * time.Millisecond))
|
||||
})
|
||||
|
||||
It("replies with a Retry packet, if a Token is required", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return false }
|
||||
It("replies with a Retry packet, if a token is required", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
|
|
@ -502,81 +450,8 @@ var _ = Describe("Server", func() {
|
|||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("sends an INVALID_TOKEN error, if an invalid retry token is received", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return false }
|
||||
token, err := serv.tokenGenerator.NewRetryToken(&net.UDPAddr{}, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.data = append(packet.data, []byte("coalesced packet")...) // add some garbage to simulate a coalesced packet
|
||||
raddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
packet.remoteAddr = raddr
|
||||
tracer.EXPECT().SentPacket(packet.remoteAddr, gomock.Any(), gomock.Any(), gomock.Any()).Do(func(_ net.Addr, replyHdr *logging.Header, _ logging.ByteCount, frames []logging.Frame) {
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeInitial))
|
||||
Expect(replyHdr.SrcConnectionID).To(Equal(hdr.DestConnectionID))
|
||||
Expect(replyHdr.DestConnectionID).To(Equal(hdr.SrcConnectionID))
|
||||
Expect(frames).To(HaveLen(1))
|
||||
Expect(frames[0]).To(BeAssignableToTypeOf(&wire.ConnectionCloseFrame{}))
|
||||
ccf := frames[0].(*logging.ConnectionCloseFrame)
|
||||
Expect(ccf.IsApplicationError).To(BeFalse())
|
||||
Expect(ccf.ErrorCode).To(BeEquivalentTo(qerr.InvalidToken))
|
||||
})
|
||||
done := make(chan struct{})
|
||||
conn.EXPECT().WriteTo(gomock.Any(), raddr).DoAndReturn(func(b []byte, _ net.Addr) (int, error) {
|
||||
defer close(done)
|
||||
replyHdr := parseHeader(b)
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeInitial))
|
||||
Expect(replyHdr.SrcConnectionID).To(Equal(hdr.DestConnectionID))
|
||||
Expect(replyHdr.DestConnectionID).To(Equal(hdr.SrcConnectionID))
|
||||
_, opener := handshake.NewInitialAEAD(hdr.DestConnectionID, protocol.PerspectiveClient, replyHdr.Version)
|
||||
extHdr, err := unpackHeader(opener, replyHdr, b, hdr.Version)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
data, err := opener.Open(nil, b[extHdr.ParsedLen():], extHdr.PacketNumber, b[:extHdr.ParsedLen()])
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
f, err := wire.NewFrameParser(false, hdr.Version).ParseNext(bytes.NewReader(data), protocol.EncryptionInitial)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
Expect(f).To(BeAssignableToTypeOf(&wire.ConnectionCloseFrame{}))
|
||||
ccf := f.(*wire.ConnectionCloseFrame)
|
||||
Expect(ccf.ErrorCode).To(BeEquivalentTo(qerr.InvalidToken))
|
||||
Expect(ccf.ReasonPhrase).To(BeEmpty())
|
||||
return len(b), nil
|
||||
})
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("doesn't send an INVALID_TOKEN error, if the packet is corrupted", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return false }
|
||||
token, err := serv.tokenGenerator.NewRetryToken(&net.UDPAddr{}, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.data[len(packet.data)-10] ^= 0xff // corrupt the packet
|
||||
packet.remoteAddr = &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
done := make(chan struct{})
|
||||
tracer.EXPECT().DroppedPacket(packet.remoteAddr, logging.PacketTypeInitial, packet.Size(), logging.PacketDropPayloadDecryptError).Do(func(net.Addr, logging.PacketType, protocol.ByteCount, logging.PacketDropReason) { close(done) })
|
||||
serv.handlePacket(packet)
|
||||
// make sure there are no Write calls on the packet conn
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("creates a connection, if no Token is required", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
It("creates a connection, if no token is required", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
|
|
@ -659,7 +534,7 @@ var _ = Describe("Server", func() {
|
|||
}).AnyTimes()
|
||||
tracer.EXPECT().TracerForConnection(gomock.Any(), protocol.PerspectiveServer, gomock.Any()).AnyTimes()
|
||||
|
||||
serv.config.AcceptToken = func(net.Addr, *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
acceptConn := make(chan struct{})
|
||||
var counter uint32 // to be used as an atomic, so we query it in Eventually
|
||||
serv.newConn = func(
|
||||
|
|
@ -713,7 +588,7 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
|
||||
It("only creates a single connection for a duplicate Initial", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
var createdConn bool
|
||||
conn := NewMockQuicConn(mockCtrl)
|
||||
serv.newConn = func(
|
||||
|
|
@ -745,7 +620,7 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
|
||||
It("rejects new connection attempts if the accept queue is full", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
|
||||
serv.newConn = func(
|
||||
_ sendConn,
|
||||
|
|
@ -813,7 +688,7 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
|
||||
It("doesn't accept new connections if they were closed in the mean time", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
|
||||
p := getInitial(protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10})
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
|
|
@ -877,6 +752,200 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
})
|
||||
|
||||
Context("token validation", func() {
|
||||
checkInvalidToken := func(b []byte, origHdr *wire.Header) {
|
||||
replyHdr := parseHeader(b)
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeInitial))
|
||||
Expect(replyHdr.SrcConnectionID).To(Equal(origHdr.DestConnectionID))
|
||||
Expect(replyHdr.DestConnectionID).To(Equal(origHdr.SrcConnectionID))
|
||||
_, opener := handshake.NewInitialAEAD(origHdr.DestConnectionID, protocol.PerspectiveClient, replyHdr.Version)
|
||||
extHdr, err := unpackHeader(opener, replyHdr, b, origHdr.Version)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
data, err := opener.Open(nil, b[extHdr.ParsedLen():], extHdr.PacketNumber, b[:extHdr.ParsedLen()])
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
f, err := wire.NewFrameParser(false, origHdr.Version).ParseNext(bytes.NewReader(data), protocol.EncryptionInitial)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
Expect(f).To(BeAssignableToTypeOf(&wire.ConnectionCloseFrame{}))
|
||||
ccf := f.(*wire.ConnectionCloseFrame)
|
||||
Expect(ccf.ErrorCode).To(BeEquivalentTo(qerr.InvalidToken))
|
||||
Expect(ccf.ReasonPhrase).To(BeEmpty())
|
||||
}
|
||||
|
||||
It("decodes the token from the token field", func() {
|
||||
raddr := &net.UDPAddr{IP: net.IPv4(192, 168, 13, 37), Port: 1337}
|
||||
token, err := serv.tokenGenerator.NewRetryToken(raddr, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
packet := getPacket(&wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
Token: token,
|
||||
Version: serv.config.Versions[0],
|
||||
}, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.remoteAddr = raddr
|
||||
conn.EXPECT().WriteTo(gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
tracer.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
|
||||
done := make(chan struct{})
|
||||
phm.EXPECT().AddWithConnID(gomock.Any(), gomock.Any(), gomock.Any()).Do(func(_, _ protocol.ConnectionID, _ func() packetHandler) { close(done) })
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("sends an INVALID_TOKEN error, if an invalid retry token is received", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
token, err := serv.tokenGenerator.NewRetryToken(&net.UDPAddr{}, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.data = append(packet.data, []byte("coalesced packet")...) // add some garbage to simulate a coalesced packet
|
||||
raddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
packet.remoteAddr = raddr
|
||||
tracer.EXPECT().SentPacket(packet.remoteAddr, gomock.Any(), gomock.Any(), gomock.Any()).Do(func(_ net.Addr, replyHdr *logging.Header, _ logging.ByteCount, frames []logging.Frame) {
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeInitial))
|
||||
Expect(replyHdr.SrcConnectionID).To(Equal(hdr.DestConnectionID))
|
||||
Expect(replyHdr.DestConnectionID).To(Equal(hdr.SrcConnectionID))
|
||||
Expect(frames).To(HaveLen(1))
|
||||
Expect(frames[0]).To(BeAssignableToTypeOf(&wire.ConnectionCloseFrame{}))
|
||||
ccf := frames[0].(*logging.ConnectionCloseFrame)
|
||||
Expect(ccf.IsApplicationError).To(BeFalse())
|
||||
Expect(ccf.ErrorCode).To(BeEquivalentTo(qerr.InvalidToken))
|
||||
})
|
||||
done := make(chan struct{})
|
||||
conn.EXPECT().WriteTo(gomock.Any(), raddr).DoAndReturn(func(b []byte, _ net.Addr) (int, error) {
|
||||
defer close(done)
|
||||
checkInvalidToken(b, hdr)
|
||||
return len(b), nil
|
||||
})
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("sends an INVALID_TOKEN error, if an expired retry token is received", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
serv.config.MaxRetryTokenAge = time.Millisecond
|
||||
raddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
token, err := serv.tokenGenerator.NewRetryToken(raddr, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
time.Sleep(2 * time.Millisecond) // make sure the token is expired
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.remoteAddr = raddr
|
||||
tracer.EXPECT().SentPacket(packet.remoteAddr, gomock.Any(), gomock.Any(), gomock.Any()).Do(func(_ net.Addr, replyHdr *logging.Header, _ logging.ByteCount, frames []logging.Frame) {
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeInitial))
|
||||
Expect(replyHdr.SrcConnectionID).To(Equal(hdr.DestConnectionID))
|
||||
Expect(replyHdr.DestConnectionID).To(Equal(hdr.SrcConnectionID))
|
||||
Expect(frames).To(HaveLen(1))
|
||||
Expect(frames[0]).To(BeAssignableToTypeOf(&wire.ConnectionCloseFrame{}))
|
||||
ccf := frames[0].(*logging.ConnectionCloseFrame)
|
||||
Expect(ccf.IsApplicationError).To(BeFalse())
|
||||
Expect(ccf.ErrorCode).To(BeEquivalentTo(qerr.InvalidToken))
|
||||
})
|
||||
done := make(chan struct{})
|
||||
conn.EXPECT().WriteTo(gomock.Any(), raddr).DoAndReturn(func(b []byte, _ net.Addr) (int, error) {
|
||||
defer close(done)
|
||||
checkInvalidToken(b, hdr)
|
||||
return len(b), nil
|
||||
})
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("doesn't send an INVALID_TOKEN error, if an invalid non-retry token is received", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
token, err := serv.tokenGenerator.NewToken(&net.UDPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337})
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.data[len(packet.data)-10] ^= 0xff // corrupt the packet
|
||||
raddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
packet.remoteAddr = raddr
|
||||
tracer.EXPECT().SentPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).MaxTimes(1)
|
||||
done := make(chan struct{})
|
||||
conn.EXPECT().WriteTo(gomock.Any(), raddr).DoAndReturn(func(b []byte, _ net.Addr) (int, error) {
|
||||
defer close(done)
|
||||
replyHdr := parseHeader(b)
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeRetry))
|
||||
return len(b), nil
|
||||
})
|
||||
serv.handlePacket(packet)
|
||||
// make sure there are no Write calls on the packet conn
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("sends an INVALID_TOKEN error, if an expired non-retry token is received", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
serv.config.MaxTokenAge = time.Millisecond
|
||||
raddr := &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
token, err := serv.tokenGenerator.NewToken(raddr)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
time.Sleep(2 * time.Millisecond) // make sure the token is expired
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.remoteAddr = raddr
|
||||
tracer.EXPECT().SentPacket(packet.remoteAddr, gomock.Any(), gomock.Any(), gomock.Any()).Do(func(_ net.Addr, replyHdr *logging.Header, _ logging.ByteCount, frames []logging.Frame) {
|
||||
Expect(replyHdr.Type).To(Equal(protocol.PacketTypeRetry))
|
||||
})
|
||||
done := make(chan struct{})
|
||||
conn.EXPECT().WriteTo(gomock.Any(), raddr).DoAndReturn(func(b []byte, _ net.Addr) (int, error) {
|
||||
defer close(done)
|
||||
return len(b), nil
|
||||
})
|
||||
serv.handlePacket(packet)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
|
||||
It("doesn't send an INVALID_TOKEN error, if the packet is corrupted", func() {
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return true }
|
||||
token, err := serv.tokenGenerator.NewRetryToken(&net.UDPAddr{}, nil, nil)
|
||||
Expect(err).ToNot(HaveOccurred())
|
||||
hdr := &wire.Header{
|
||||
IsLongHeader: true,
|
||||
Type: protocol.PacketTypeInitial,
|
||||
SrcConnectionID: protocol.ConnectionID{5, 4, 3, 2, 1},
|
||||
DestConnectionID: protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10},
|
||||
Token: token,
|
||||
Version: protocol.VersionTLS,
|
||||
}
|
||||
packet := getPacket(hdr, make([]byte, protocol.MinInitialPacketSize))
|
||||
packet.data[len(packet.data)-10] ^= 0xff // corrupt the packet
|
||||
packet.remoteAddr = &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1), Port: 1337}
|
||||
done := make(chan struct{})
|
||||
tracer.EXPECT().DroppedPacket(packet.remoteAddr, logging.PacketTypeInitial, packet.Size(), logging.PacketDropPayloadDecryptError).Do(func(net.Addr, logging.PacketType, protocol.ByteCount, logging.PacketDropReason) { close(done) })
|
||||
serv.handlePacket(packet)
|
||||
// make sure there are no Write calls on the packet conn
|
||||
time.Sleep(50 * time.Millisecond)
|
||||
Eventually(done).Should(BeClosed())
|
||||
})
|
||||
})
|
||||
|
||||
Context("accepting connections", func() {
|
||||
It("returns Accept when an error occurs", func() {
|
||||
testErr := errors.New("test err")
|
||||
|
|
@ -930,7 +999,7 @@ var _ = Describe("Server", func() {
|
|||
}()
|
||||
|
||||
ctx, cancel := context.WithCancel(context.Background()) // handshake context
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
serv.newConn = func(
|
||||
_ sendConn,
|
||||
runner connRunner,
|
||||
|
|
@ -1004,7 +1073,7 @@ var _ = Describe("Server", func() {
|
|||
}()
|
||||
|
||||
ready := make(chan struct{})
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
serv.newConn = func(
|
||||
_ sendConn,
|
||||
runner connRunner,
|
||||
|
|
@ -1045,7 +1114,7 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
|
||||
It("rejects new connection attempts if the accept queue is full", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
senderAddr := &net.UDPAddr{IP: net.IPv4(1, 2, 3, 4), Port: 42}
|
||||
|
||||
serv.newConn = func(
|
||||
|
|
@ -1106,7 +1175,7 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
|
||||
It("doesn't accept new connections if they were closed in the mean time", func() {
|
||||
serv.config.AcceptToken = func(_ net.Addr, _ *Token) bool { return true }
|
||||
serv.config.RequireAddressValidation = func(net.Addr) bool { return false }
|
||||
|
||||
p := getInitial(protocol.ConnectionID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10})
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
|
|
@ -1166,72 +1235,3 @@ var _ = Describe("Server", func() {
|
|||
})
|
||||
})
|
||||
})
|
||||
|
||||
var _ = Describe("default source address verification", func() {
|
||||
It("accepts a token", func() {
|
||||
remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1)}
|
||||
token := &Token{
|
||||
IsRetryToken: true,
|
||||
RemoteAddr: "192.168.0.1",
|
||||
SentTime: time.Now().Add(-protocol.RetryTokenValidity).Add(time.Second), // will expire in 1 second
|
||||
}
|
||||
Expect(defaultAcceptToken(remoteAddr, token)).To(BeTrue())
|
||||
})
|
||||
|
||||
It("requests verification if no token is provided", func() {
|
||||
remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1)}
|
||||
Expect(defaultAcceptToken(remoteAddr, nil)).To(BeFalse())
|
||||
})
|
||||
|
||||
It("rejects a token if the address doesn't match", func() {
|
||||
remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1)}
|
||||
token := &Token{
|
||||
IsRetryToken: true,
|
||||
RemoteAddr: "127.0.0.1",
|
||||
SentTime: time.Now(),
|
||||
}
|
||||
Expect(defaultAcceptToken(remoteAddr, token)).To(BeFalse())
|
||||
})
|
||||
|
||||
It("accepts a token for a remote address is not a UDP address", func() {
|
||||
remoteAddr := &net.TCPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
|
||||
token := &Token{
|
||||
IsRetryToken: true,
|
||||
RemoteAddr: "192.168.0.1:1337",
|
||||
SentTime: time.Now(),
|
||||
}
|
||||
Expect(defaultAcceptToken(remoteAddr, token)).To(BeTrue())
|
||||
})
|
||||
|
||||
It("rejects an invalid token for a remote address is not a UDP address", func() {
|
||||
remoteAddr := &net.TCPAddr{IP: net.IPv4(192, 168, 0, 1), Port: 1337}
|
||||
token := &Token{
|
||||
IsRetryToken: true,
|
||||
RemoteAddr: "192.168.0.1:7331", // mismatching port
|
||||
SentTime: time.Now(),
|
||||
}
|
||||
Expect(defaultAcceptToken(remoteAddr, token)).To(BeFalse())
|
||||
})
|
||||
|
||||
It("rejects an expired token", func() {
|
||||
remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1)}
|
||||
token := &Token{
|
||||
IsRetryToken: true,
|
||||
RemoteAddr: "192.168.0.1",
|
||||
SentTime: time.Now().Add(-protocol.RetryTokenValidity).Add(-time.Second), // expired 1 second ago
|
||||
}
|
||||
Expect(defaultAcceptToken(remoteAddr, token)).To(BeFalse())
|
||||
})
|
||||
|
||||
It("accepts a non-retry token", func() {
|
||||
Expect(protocol.RetryTokenValidity).To(BeNumerically("<", protocol.TokenValidity))
|
||||
remoteAddr := &net.UDPAddr{IP: net.IPv4(192, 168, 0, 1)}
|
||||
token := &Token{
|
||||
IsRetryToken: false,
|
||||
RemoteAddr: "192.168.0.1",
|
||||
// if this was a retry token, it would have expired one second ago
|
||||
SentTime: time.Now().Add(-protocol.RetryTokenValidity).Add(-time.Second),
|
||||
}
|
||||
Expect(defaultAcceptToken(remoteAddr, token)).To(BeTrue())
|
||||
})
|
||||
})
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue