feat(server): add open session core
Add `irtt-server` with the deterministic protocol and session engine the upcoming Tokio runtime will call. `ServerCore::handle_datagram` takes a source endpoint and the bytes of one datagram and returns the bytes to send back, or nothing. It performs no I/O and keeps no clock, so every decision is a pure function of its state and that input apart from drawing session tokens. Rejection is silence. The protocol defines no error reply, no reset and no NACK, so malformed, unauthenticated and policy-refused datagrams are discarded without a response and without disturbing any live session; a client tells "rejected" from "lost" only by timing out. `ServerError` is reserved for internal failures on the server's own side, so an inbound `ProtoError` never surfaces as a server failure. Open handling authenticates before decoding parameters, so a packet that fails authentication is discarded without parsing untrusted data and no reply behavior reveals which stage rejected it. Duration and Interval are accepted when absent and rejected when explicitly present and not positive, which is what the presence-aware parameter decode is for. Negotiation currently rewrites only the protocol version; the restriction knobs the specification describes are deliberately left for their own slices, with one obvious place to add them. Sessions are bounded to a finite default. A single unauthenticated datagram creates one and opens are never deduplicated, so an unbounded table is a liability rather than a compatibility feature; upstream's absence of session bounds is explicitly not a target. A full table drops new opens silently and evicts nothing. No-test opens keep working at capacity because they create no state. Session tokens come from the operating system's random source, since a token is the only thing standing between an off-path attacker and a usable session on an unauthenticated server. A drawn value that is zero or collides with a live session is redrawn within a finite budget; there is no predictable fallback, and a colliding token never overwrites the session that holds it. The reply is encoded before the session is inserted, so an internal failure cannot leave a half-created session behind. Echo and close requests pass admission and are then deliberately ignored: this slice creates sessions, and lifecycle and receive semantics belong to the slices that implement them. Tests pin that so a half-implemented lifecycle cannot appear by accident.
This commit is contained in:
21 files changed
+1744
-4
No files matched your search
@@ -0,0 +1,179 @@
|
||||
use std::{
|
||||
collections::VecDeque,
|
||||
net::SocketAddr,
|
||||
sync::{Arc, Mutex},
|
||||
};
|
||||
|
||||
use irtt_proto::{
|
||||
decode_open_reply, encode_request, varint, OpenReply, PacketLayout, Params, RequestToEncode,
|
||||
FLAG_CLOSE, FLAG_HMAC, FLAG_OPEN, FLAG_REPLY,
|
||||
};
|
||||
|
||||
use crate::{core::ServerCore, error::ServerError, token::TokenSource, ServerConfig};
|
||||
|
||||
pub(crate) const KEY: &[u8] = b"correctkey";
|
||||
pub(crate) const OTHER_KEY: &[u8] = b"wrongkey";
|
||||
|
||||
pub(crate) fn peer() -> SocketAddr {
|
||||
"198.51.100.7:41234".parse().unwrap()
|
||||
}
|
||||
|
||||
pub(crate) fn other_peer() -> SocketAddr {
|
||||
"198.51.100.7:41235".parse().unwrap()
|
||||
}
|
||||
|
||||
/// A token source handing out a fixed script of values, then failing.
|
||||
///
|
||||
/// Draining the script is itself a failure rather than a wrap-around, so a test
|
||||
/// that draws more tokens than it scripted is a loud test bug instead of a
|
||||
/// silent repeat.
|
||||
#[derive(Debug, Clone)]
|
||||
pub(crate) struct ScriptedTokens {
|
||||
values: Arc<Mutex<VecDeque<Result<u64, ServerError>>>>,
|
||||
}
|
||||
|
||||
impl ScriptedTokens {
|
||||
pub(crate) fn new<I>(values: I) -> Self
|
||||
where
|
||||
I: IntoIterator<Item = u64>,
|
||||
{
|
||||
Self {
|
||||
values: Arc::new(Mutex::new(values.into_iter().map(Ok).collect())),
|
||||
}
|
||||
}
|
||||
|
||||
/// A source whose every draw reports a random-source failure.
|
||||
pub(crate) fn failing() -> Self {
|
||||
Self {
|
||||
values: Arc::new(Mutex::new(VecDeque::new())),
|
||||
}
|
||||
}
|
||||
|
||||
/// How many scripted values are still unused.
|
||||
pub(crate) fn remaining(&self) -> usize {
|
||||
self.values.lock().unwrap().len()
|
||||
}
|
||||
}
|
||||
|
||||
impl TokenSource for ScriptedTokens {
|
||||
fn next_token(&mut self) -> Result<u64, ServerError> {
|
||||
self.values
|
||||
.lock()
|
||||
.unwrap()
|
||||
.pop_front()
|
||||
.unwrap_or(Err(ServerError::RandomSource {
|
||||
reason: "scripted failure".to_owned(),
|
||||
}))
|
||||
}
|
||||
}
|
||||
|
||||
/// A core with deterministic tokens, so session identity is assertable.
|
||||
pub(crate) fn core_with_tokens(config: ServerConfig, tokens: ScriptedTokens) -> ServerCore {
|
||||
ServerCore::with_token_source(config, Box::new(tokens))
|
||||
}
|
||||
|
||||
/// Encodes a normal open request carrying `params`.
|
||||
pub(crate) fn open_request(params: &Params, hmac_key: Option<&[u8]>) -> Vec<u8> {
|
||||
encode_request(
|
||||
RequestToEncode::Open {
|
||||
params,
|
||||
no_test: false,
|
||||
},
|
||||
hmac_key,
|
||||
)
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
/// Encodes a no-test open request carrying `params`.
|
||||
pub(crate) fn no_test_request(params: &Params, hmac_key: Option<&[u8]>) -> Vec<u8> {
|
||||
encode_request(
|
||||
RequestToEncode::Open {
|
||||
params,
|
||||
no_test: true,
|
||||
},
|
||||
hmac_key,
|
||||
)
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
/// Builds an open request around a raw parameter payload.
|
||||
///
|
||||
/// Used for payloads a compliant encoder cannot produce, such as a truncated
|
||||
/// varint or an out-of-range enum value.
|
||||
pub(crate) fn open_request_with_raw_params(payload: &[u8], hmac_key: Option<&[u8]>) -> Vec<u8> {
|
||||
let mut packet = irtt_proto::MAGIC.to_vec();
|
||||
packet.push(if hmac_key.is_some() {
|
||||
FLAG_OPEN | FLAG_HMAC
|
||||
} else {
|
||||
FLAG_OPEN
|
||||
});
|
||||
if hmac_key.is_some() {
|
||||
packet.extend_from_slice(&[0; irtt_proto::HMAC_SIZE]);
|
||||
}
|
||||
packet.extend_from_slice(payload);
|
||||
if let Some(key) = hmac_key {
|
||||
irtt_proto::compute_hmac_in_place(key, &mut packet, hmac_field_offset()).unwrap();
|
||||
}
|
||||
packet
|
||||
}
|
||||
|
||||
/// The authentication field sits immediately after the fixed header.
|
||||
fn hmac_field_offset() -> usize {
|
||||
PacketLayout::open_request(false).header_len()
|
||||
}
|
||||
|
||||
/// Encodes one integer parameter as `tag` + zigzag value.
|
||||
pub(crate) fn param_int(tag: u64, value: i64) -> Vec<u8> {
|
||||
let mut encoded = Vec::new();
|
||||
varint::encode_uvarint(tag, &mut encoded);
|
||||
varint::encode_varint(value, &mut encoded);
|
||||
encoded
|
||||
}
|
||||
|
||||
/// Encodes a `server_fill` parameter with an explicit declared length, so tests
|
||||
/// can declare a length the payload does not actually carry.
|
||||
pub(crate) fn param_server_fill(declared_len: u64, value: &[u8]) -> Vec<u8> {
|
||||
let mut encoded = Vec::new();
|
||||
varint::encode_uvarint(9, &mut encoded);
|
||||
varint::encode_uvarint(declared_len, &mut encoded);
|
||||
encoded.extend_from_slice(value);
|
||||
encoded
|
||||
}
|
||||
|
||||
/// Params a well-behaved client would request.
|
||||
pub(crate) fn client_params() -> Params {
|
||||
Params {
|
||||
protocol_version: 1,
|
||||
duration_ns: 3_000_000_000,
|
||||
interval_ns: 1_000_000_000,
|
||||
length: 1472,
|
||||
received_stats: irtt_proto::ReceivedStats::Both,
|
||||
stamp_at: irtt_proto::StampAt::Both,
|
||||
clock: irtt_proto::Clock::Both,
|
||||
dscp: 184,
|
||||
server_fill: None,
|
||||
}
|
||||
}
|
||||
|
||||
/// Decodes a reply the server produced, checking it against the server's key.
|
||||
pub(crate) fn decode_reply(packet: &[u8], hmac_key: Option<&[u8]>) -> OpenReply {
|
||||
decode_open_reply(packet, hmac_key).expect("server reply must decode")
|
||||
}
|
||||
|
||||
pub(crate) fn expect_normal_open_reply(packet: &[u8], hmac_key: Option<&[u8]>) -> OpenReply {
|
||||
let reply = decode_reply(packet, hmac_key);
|
||||
let expected = FLAG_OPEN | FLAG_REPLY | if hmac_key.is_some() { FLAG_HMAC } else { 0 };
|
||||
assert_eq!(reply.flags, expected, "normal open reply flags");
|
||||
assert_ne!(reply.token, 0, "a session-creating reply needs a token");
|
||||
assert_eq!(reply.params.protocol_version, 1);
|
||||
reply
|
||||
}
|
||||
|
||||
pub(crate) fn expect_no_test_reply(packet: &[u8], hmac_key: Option<&[u8]>) -> OpenReply {
|
||||
let reply = decode_reply(packet, hmac_key);
|
||||
let expected =
|
||||
FLAG_OPEN | FLAG_REPLY | FLAG_CLOSE | if hmac_key.is_some() { FLAG_HMAC } else { 0 };
|
||||
assert_eq!(reply.flags, expected, "no-test reply flags");
|
||||
assert_eq!(reply.token, 0, "a no-test reply carries a zero token");
|
||||
reply
|
||||
}
|
||||
Reference in new issue
Block a user