sechmachine/VerseVDI-Data-Plane
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(gateway): use registered control flows

Browse Source
This commit is contained in:
sechmachine
2026-07-29 21:16:58 +07:00
parent 236c7c2973
commit 45be5ccea9
4 changed files with 211 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gateway/clipboard.go
+1 -4
View File
@@ -46,10 +46,7 @@ func ValidateGatewayClipboard(policy protocol.ClipboardPolicy, value protocol.Ga
if err := policy.Validate(); err != nil || value.Validate() != nil || !utf8.ValidString(value.Text) {
return ErrProviderMalformed
}
if len(value.Text) > int(policy.MaxTextBytes) || len(value.LoopToken) < 16 || len(value.LoopToken) > 128 {
return ErrProviderMalformed
}
if _, err := base64.RawURLEncoding.DecodeString(value.LoopToken); err != nil {
if len(value.Text) > int(policy.MaxTextBytes) {
return ErrProviderMalformed
}
switch value.Direction {
gateway/clipboard_test.go
+1 -1
View File
@@ -15,7 +15,7 @@ func TestValidateGatewayClipboardEnforcesServerOwnedPolicy(t *testing.T) {
if err := ValidateGatewayClipboard(policy, valid); err != nil {
t.Fatalf("ValidateGatewayClipboard() valid text = %v", err)
}
if err := ValidateGatewayClipboard(policy, protocol.GatewayClipboardText{Direction: "client_to_provider", Text: "hello", Encoding: "utf-8", LoopToken: "not base64url!"}); err == nil {
if err := ValidateGatewayClipboard(policy, protocol.GatewayClipboardText{Direction: "client_to_provider", Text: "hello", Encoding: "utf-8", LoopToken: "!!!!!!!!!!!!!!!!"}); err == nil {
t.Fatal("ValidateGatewayClipboard() accepted malformed loop token")
}
if err := ValidateGatewayClipboard(policy, protocol.GatewayClipboardText{Direction: "client_to_provider", Text: strings.Repeat("x", 6), Encoding: "utf-8", LoopToken: "abcdefghijklmnop"}); err == nil {
gateway/gateway_test.go
+192
View File
@@ -8,6 +8,7 @@ import (
"crypto/tls"
"crypto/x509"
"crypto/x509/pkix"
"encoding/base64"
"encoding/hex"
"errors"
"math/big"
@@ -320,6 +321,197 @@ func TestAdmissionQUICMTLSRelayAndCleanup(t *testing.T) {
}
}
func TestRegisteredChannelFramesTraversePublicTransport(t *testing.T) {
h := newGatewayTransportHarness(t)
input, err := EncodeInputEvent(InputEvent{Sequence: 7, Device: "keyboard", Code: 7, Pressed: true})
if err != nil {
t.Fatal(err)
}
feedback, err := EncodeClientFeedback(Feedback{Sequence: 8, Kind: FeedbackIDR})
if err != nil {
t.Fatal(err)
}
clipboard, err := protocol.EncodeGatewayClipboardText(protocol.GatewayClipboardText{Direction: "client_to_provider", Text: "registered clipboard", Encoding: "utf-8", LoopToken: "abcdefghijklmnop"})
if err != nil {
t.Fatal(err)
}
for _, frame := range []protocol.ChannelFrame{
testChannelFrame("input.sequenced.v1", 7, input),
testChannelFrame("control.ack.v1", 8, feedback),
testChannelFrame("clipboard.text.v1", 9, clipboard),
} {
encoded, encodeErr := protocol.EncodeChannelFrame(frame)
if encodeErr != nil {
t.Fatal(encodeErr)
}
if writeErr := h.client.writeControl(encoded); writeErr != nil {
t.Fatal(writeErr)
}
}
select {
case value := <-h.session.clipboardWrites:
if value != "registered clipboard" {
t.Fatalf("provider clipboard = %q", value)
}
case <-time.After(time.Second):
t.Fatal("registered clipboard flow was not forwarded")
}
deadline := time.Now().Add(time.Second)
for {
h.session.mu.Lock()
inputs := append([]InputEvent(nil), h.session.inputs...)
feedbacks := append([]Feedback(nil), h.session.feedback...)
h.session.mu.Unlock()
if len(inputs) == 1 && inputs[0].Sequence == 7 && len(feedbacks) == 1 && feedbacks[0].Sequence == 8 && feedbacks[0].Kind == FeedbackIDR {
break
}
if time.Now().After(deadline) {
t.Fatalf("registered flows inputs=%#v feedback=%#v", inputs, feedbacks)
}
time.Sleep(time.Millisecond)
}
h.session.EmitEvent(ProviderEvent{Kind: ProviderEventRumble, Payload: []byte{1, 2, 3, 4, 5}})
eventCtx, cancelEvent := context.WithTimeout(context.Background(), time.Second)
event, err := h.client.ReceiveProviderEvent(eventCtx)
cancelEvent()
if err != nil || event.Kind != ProviderEventRumble || string(event.Payload) != string([]byte{1, 2, 3, 4, 5}) {
t.Fatalf("registered provider feedback = %#v, %v", event, err)
}
h.session.mu.Lock()
h.session.clipboard = "registered provider clipboard"
h.session.mu.Unlock()
clipboardCtx, cancelClipboard := context.WithTimeout(context.Background(), time.Second)
value, err := h.client.ReceiveClipboard(clipboardCtx)
cancelClipboard()
if err != nil || value.Text != "registered provider clipboard" {
t.Fatalf("registered provider clipboard = %#v, %v", value, err)
}
}
func TestPrivateChannelAliasesAreRejectedOnPublicTransport(t *testing.T) {
for _, test := range []struct {
alias string
payload func(t *testing.T) []byte
}{
{"control", func(t *testing.T) []byte {
t.Helper()
value, err := EncodeClientFeedback(Feedback{Kind: FeedbackIDR})
if err != nil {
t.Fatal(err)
}
return value
}},
{"input", func(t *testing.T) []byte {
t.Helper()
value, err := EncodeInputEvent(InputEvent{Device: "keyboard", Code: 7, Pressed: true})
if err != nil {
t.Fatal(err)
}
return value
}},
{"clipboard", func(t *testing.T) []byte {
t.Helper()
value, err := protocol.EncodeGatewayClipboardText(protocol.GatewayClipboardText{Direction: "client_to_provider", Text: "alias", Encoding: "utf-8", LoopToken: "abcdefghijklmnop"})
if err != nil {
t.Fatal(err)
}
return value
}},
} {
t.Run(test.alias, func(t *testing.T) {
h := newGatewayTransportHarness(t)
encoded, err := protocol.EncodeChannelFrame(testChannelFrame(test.alias, 1, test.payload(t)))
if err != nil {
t.Fatal(err)
}
if err := h.client.writeControl(encoded); err != nil {
t.Fatal(err)
}
h.waitReleased(t)
h.session.mu.Lock()
defer h.session.mu.Unlock()
if len(h.session.inputs) != 0 || len(h.session.feedback) != 0 {
t.Fatalf("alias reached provider: inputs=%#v feedback=%#v", h.session.inputs, h.session.feedback)
}
})
}
}
func TestProviderClipboardAuditWaitsForPublicTransportDelivery(t *testing.T) {
h := newGatewayTransportHarness(t)
h.client.control.CancelRead(0)
h.session.mu.Lock()
h.session.clipboard = "undeliverable clipboard"
h.session.mu.Unlock()
h.waitReleased(t)
for _, audit := range h.reporter.Audits() {
if audit.Direction == "provider_to_client" && audit.Outcome == "forwarded" {
t.Fatalf("failed delivery was audited as forwarded: %#v", audit)
}
}
}
func testChannelFrame(flowID string, sequence int64, payload []byte) protocol.ChannelFrame {
return protocol.ChannelFrame{Version: "1", FlowID: flowID, Sequence: sequence, Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
}
type gatewayTransportHarness struct {
client *Client
session *fakeSession
admission *oneTimeAdmission
reporter *recordingProviderStateReporter
}
func newGatewayTransportHarness(t *testing.T) gatewayTransportHarness {
t.Helper()
serverTLS, clientTLS := testTLS(t)
fake := NewFakeApollo(FakeApolloConfig{Now: time.Date(2026, time.January, 1, 0, 0, 0, 0, time.UTC)})
authority := protocol.SessionAuthority{Version: "1", SessionID: "session-transport", GatewayID: "gateway-1", Audience: "versevdi-gateway", ReconnectSequence: 0, ExpiresAt: time.Now().Add(5 * time.Second).UTC().Format(time.RFC3339Nano), Capabilities: DefaultCapabilities(), ProviderProfile: ProviderProfileApollo, ProviderIdentity: fake.config.Identity.Key()}
admission := &oneTimeAdmission{authority: authority, released: make(chan struct{})}
reporter := &recordingProviderStateReporter{}
server, err := NewServer(ServerConfig{ListenAddress: "127.0.0.1:0", TLSConfig: serverTLS, GatewayID: "gateway-1", Capabilities: DefaultCapabilities(), ProviderCapabilities: DefaultCapabilities(), Admission: admission, ProviderStateReporter: reporter, ClipboardAuditReporter: reporter, Provider: fake})
if err != nil {
t.Fatal(err)
}
ctx, cancel := context.WithCancel(context.Background())
serveDone := make(chan error, 1)
go func() { serveDone <- server.Serve(ctx) }()
request := protocol.TunnelAdmissionRequest{Version: "1", SessionID: authority.SessionID, GatewayID: authority.GatewayID, Audience: authority.Audience, Grant: strings.Repeat("g", 64), ReconnectSequence: 0, ClientNonce: "nonce-0000000001", DeviceSignature: strings.Repeat("s", 86), Capabilities: DefaultCapabilities()}
client, err := Dial(context.Background(), server.Addr().String(), clientTLS, request)
if err != nil {
cancel()
_ = server.Close()
t.Fatal(err)
}
session, ok := fake.LastSession().(*fakeSession)
if !ok {
t.Fatal("fake provider session type")
}
t.Cleanup(func() {
_ = client.Close()
cancel()
_ = server.Close()
if err := <-serveDone; err != nil {
t.Errorf("serve: %v", err)
}
})
return gatewayTransportHarness{client: client, session: session, admission: admission, reporter: reporter}
}
func (h gatewayTransportHarness) waitReleased(t *testing.T) {
t.Helper()
select {
case <-h.admission.released:
case <-time.After(2 * time.Second):
t.Fatal("gateway did not reject the channel")
}
}
func testTLS(t *testing.T) (*tls.Config, *tls.Config) {
t.Helper()
caKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
gateway/transport.go
+17 -14
View File
@@ -23,6 +23,9 @@ const (
defaultControlLimit = 128 * 1024
clientControlBacklog = 64
applicationError = quic.ApplicationErrorCode(0x100)
controlFlowID = "control.ack.v1"
inputFlowID = "input.sequenced.v1"
clipboardFlowID = "clipboard.text.v1"
)
var (
@@ -446,11 +449,11 @@ func (s *gatewaySession) clipboardLoop() {
}
continue
}
if err := s.reportClipboardAudit(value.Direction, "forwarded", clipboardAuditTextBytes(value.Text), "forwarded"); err != nil {
if err := s.sendClipboard(value); err != nil {
s.result <- err
return
}
if err := s.sendClipboard(value); err != nil {
if err := s.reportClipboardAudit(value.Direction, "forwarded", clipboardAuditTextBytes(value.Text), "forwarded"); err != nil {
s.result <- err
return
}
@@ -499,7 +502,7 @@ func (s *gatewaySession) controlLoop() {
return
}
switch frame.FlowID {
case "control":
case controlFlowID:
sequence, sequenceErr := channelSequence(frame.Sequence)
if sequenceErr != nil {
s.result <- sequenceErr
@@ -509,7 +512,7 @@ func (s *gatewaySession) controlLoop() {
s.result <- err
return
}
case "input":
case inputFlowID:
sequence, sequenceErr := channelSequence(frame.Sequence)
if sequenceErr != nil {
s.result <- sequenceErr
@@ -519,7 +522,7 @@ func (s *gatewaySession) controlLoop() {
s.result <- err
return
}
case "clipboard":
case clipboardFlowID:
value, decodeErr := protocol.DecodeGatewayClipboardText(payload)
if decodeErr != nil {
s.result <- ErrProviderMalformed
@@ -625,7 +628,7 @@ func (s *gatewaySession) sendControl(sequence uint32, payload []byte) error {
if len(payload) > 1024 {
return ErrFramePayloadLimit
}
frame := protocol.ChannelFrame{Version: "1", FlowID: "control", Sequence: int64(sequence), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
frame := protocol.ChannelFrame{Version: "1", FlowID: controlFlowID, Sequence: int64(sequence), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
encoded, err := protocol.EncodeChannelFrame(frame)
if err != nil {
return err
@@ -640,7 +643,7 @@ func (s *gatewaySession) sendClipboard(value protocol.GatewayClipboardText) erro
if err != nil {
return err
}
frame := protocol.ChannelFrame{Version: "1", FlowID: "clipboard", Sequence: int64(s.sequence.Add(1)), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
frame := protocol.ChannelFrame{Version: "1", FlowID: clipboardFlowID, Sequence: int64(s.sequence.Add(1)), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
encoded, err := protocol.EncodeChannelFrame(frame)
if err != nil {
return err
@@ -899,7 +902,7 @@ func (c *Client) SendInput(event InputEvent) error {
if err != nil {
return err
}
frame := protocol.ChannelFrame{Version: "1", FlowID: "input", Sequence: int64(event.Sequence), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
frame := protocol.ChannelFrame{Version: "1", FlowID: inputFlowID, Sequence: int64(event.Sequence), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
encoded, err := protocol.EncodeChannelFrame(frame)
if err != nil {
return err
@@ -924,7 +927,7 @@ func (c *Client) SendClipboard(value protocol.GatewayClipboardText) error {
if err != nil {
return err
}
frame := protocol.ChannelFrame{Version: "1", FlowID: "clipboard", Sequence: 0, Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
frame := protocol.ChannelFrame{Version: "1", FlowID: clipboardFlowID, Sequence: 0, Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
encoded, err := protocol.EncodeChannelFrame(frame)
if err != nil {
return err
@@ -933,7 +936,7 @@ func (c *Client) SendClipboard(value protocol.GatewayClipboardText) error {
}
func (c *Client) sendControl(sequence uint32, payload []byte) error {
frame := protocol.ChannelFrame{Version: "1", FlowID: "control", Sequence: int64(sequence), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
frame := protocol.ChannelFrame{Version: "1", FlowID: controlFlowID, Sequence: int64(sequence), Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
encoded, err := protocol.EncodeChannelFrame(frame)
if err != nil {
return err
@@ -956,7 +959,7 @@ func (c *Client) ReceiveFrame(ctx context.Context) (Frame, error) {
}
func (c *Client) ReceiveProviderEvent(ctx context.Context) (ProviderEvent, error) {
payload, err := c.receiveControlPayload(ctx, "control")
payload, err := c.receiveControlPayload(ctx, controlFlowID)
if err != nil {
return ProviderEvent{}, err
}
@@ -967,7 +970,7 @@ func (c *Client) ReceiveProviderEvent(ctx context.Context) (ProviderEvent, error
}
func (c *Client) ReceiveClipboard(ctx context.Context) (protocol.GatewayClipboardText, error) {
payload, err := c.receiveControlPayload(ctx, "clipboard")
payload, err := c.receiveControlPayload(ctx, clipboardFlowID)
if err != nil {
return protocol.GatewayClipboardText{}, err
}
@@ -975,7 +978,7 @@ func (c *Client) ReceiveClipboard(ctx context.Context) (protocol.GatewayClipboar
}
func (c *Client) receiveControlPayload(ctx context.Context, flowID string) ([]byte, error) {
if c == nil || c.control == nil || (flowID != "control" && flowID != "clipboard") {
if c == nil || c.control == nil || (flowID != controlFlowID && flowID != clipboardFlowID) {
return nil, ErrProviderMalformed
}
c.controlReadMu.Lock()
@@ -1000,7 +1003,7 @@ func (c *Client) receiveControlPayload(ctx context.Context, flowID string) ([]by
return nil, err
}
frame, err := protocol.DecodeChannelFrame(data)
if err != nil || (frame.FlowID != "control" && frame.FlowID != "clipboard") {
if err != nil || (frame.FlowID != controlFlowID && frame.FlowID != clipboardFlowID) {
return nil, ErrProviderMalformed
}
payload, err := base64.StdEncoding.DecodeString(frame.Payload)