sechmachine/VerseVDI-Data-Plane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(core): add QUIC TLS admission transport

Browse Source
This commit is contained in:
sechmachine
2026-08-12 19:08:32 +07:00
parent 7947ebcc75
commit 111092becb
11 changed files with 2304 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/tests/protocol_fixtures.rs
+77
View File
@@ -134,6 +134,19 @@ fn strict_rc5_dtos_reject_duplicate_trailing_unknown_and_provider_fields() {
assert!(TunnelAdmissionRequest::decode(admission_provider.as_bytes()).is_err());
}
#[test]
fn manifest_public_identity_requires_dns_sni_not_ip_or_uuid() {
for invalid_identity in ["127.0.0.1", "::1", "550e8400-e29b-41d4-a716-446655440000"] {
let manifest = String::from_utf8(valid_manifest().to_vec())
.expect("fixture is UTF-8")
.replace("gateway.test\"}", &format!("{invalid_identity}\"}}"));
assert!(
ConnectionManifest::decode(manifest.as_bytes()).is_err(),
"non-DNS SNI accepted: {invalid_identity}"
);
}
}
#[test]
fn rc5_manifest_credential_and_authority_enforce_bounds_and_bindings() {
let manifest = ConnectionManifest::decode(valid_manifest()).expect("valid manifest");
@@ -164,6 +177,70 @@ fn rc5_manifest_credential_and_authority_enforce_bounds_and_bindings() {
let provider_authority = br#"{"version":"1","session_id":"session","gateway_id":"gateway","audience":"audience","reconnect_sequence":0,"expires_at":"2098-01-01T00:00:00Z","capabilities":{"transport":"quic-tls13","framing":"datagram-v2","media":"encoded","audio":"encoded","source_rate_control":"server","client_decode":["h264-opus"]},"provider_profile":"apollo"}"#;
assert!(ClientSessionAuthority::decode(provider_authority).is_err());
let provider_route = br#"{"version":"1","session_id":"session","gateway_id":"gateway","audience":"audience","reconnect_sequence":0,"expires_at":"2098-01-01T00:00:00Z","capabilities":{"transport":"quic-tls13","framing":"datagram-v2","media":"encoded","audio":"encoded","source_rate_control":"server","client_decode":["h264-opus"]},"stream_host":"provider.invalid"}"#;
assert!(ClientSessionAuthority::decode(provider_route).is_err());
}
#[test]
fn client_authority_directly_rejects_every_manifest_binding_mismatch() {
let manifest = ConnectionManifest::decode(valid_manifest()).expect("valid manifest");
let offered = CapabilityProfile::new(
"quic-tls13",
"datagram-v2",
"encoded",
"encoded",
"server",
vec!["h264-opus".to_owned()],
)
.expect("offered capabilities");
let valid = serde_json::json!({
"version": "1",
"session_id": "session",
"gateway_id": "gateway",
"audience": "audience",
"reconnect_sequence": 0,
"expires_at": "2098-01-01T00:00:00Z",
"capabilities": {
"transport": "quic-tls13",
"framing": "datagram-v2",
"media": "encoded",
"audio": "encoded",
"source_rate_control": "server",
"client_decode": ["h264-opus"],
},
});
for case in [
"session",
"gateway",
"audience",
"reconnect",
"expired",
"beyond-grant",
"capability",
] {
let mut value = valid.clone();
match case {
"session" => value["session_id"] = "other".into(),
"gateway" => value["gateway_id"] = "other".into(),
"audience" => value["audience"] = "other".into(),
"reconnect" => value["reconnect_sequence"] = 1.into(),
"expired" => value["expires_at"] = "2026-08-12T00:00:00Z".into(),
"beyond-grant" => value["expires_at"] = "2100-01-01T00:00:00Z".into(),
"capability" => {
value["capabilities"]["client_decode"] =
serde_json::json!(["h264-opus", "hevc-opus"]);
}
_ => unreachable!(),
}
let authority =
ClientSessionAuthority::decode(&serde_json::to_vec(&value).expect("encode authority"))
.expect("structurally valid authority");
assert_eq!(
authority.validate_binding(&manifest, &offered, "2026-08-12T00:00:00Z"),
Err(versevdi_core::error::CoreError::AuthorityRejected),
"binding mismatch accepted: {case}"
);
}
}
#[test]