fix(gateway): use registered control flows
This commit is contained in:
sechmachine
@@ -8,6 +8,7 @@ import (
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/base64"
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"math/big"
|
||||
@@ -320,6 +321,197 @@ func TestAdmissionQUICMTLSRelayAndCleanup(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestRegisteredChannelFramesTraversePublicTransport(t *testing.T) {
|
||||
h := newGatewayTransportHarness(t)
|
||||
|
||||
input, err := EncodeInputEvent(InputEvent{Sequence: 7, Device: "keyboard", Code: 7, Pressed: true})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
feedback, err := EncodeClientFeedback(Feedback{Sequence: 8, Kind: FeedbackIDR})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
clipboard, err := protocol.EncodeGatewayClipboardText(protocol.GatewayClipboardText{Direction: "client_to_provider", Text: "registered clipboard", Encoding: "utf-8", LoopToken: "abcdefghijklmnop"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, frame := range []protocol.ChannelFrame{
|
||||
testChannelFrame("input.sequenced.v1", 7, input),
|
||||
testChannelFrame("control.ack.v1", 8, feedback),
|
||||
testChannelFrame("clipboard.text.v1", 9, clipboard),
|
||||
} {
|
||||
encoded, encodeErr := protocol.EncodeChannelFrame(frame)
|
||||
if encodeErr != nil {
|
||||
t.Fatal(encodeErr)
|
||||
}
|
||||
if writeErr := h.client.writeControl(encoded); writeErr != nil {
|
||||
t.Fatal(writeErr)
|
||||
}
|
||||
}
|
||||
|
||||
select {
|
||||
case value := <-h.session.clipboardWrites:
|
||||
if value != "registered clipboard" {
|
||||
t.Fatalf("provider clipboard = %q", value)
|
||||
}
|
||||
case <-time.After(time.Second):
|
||||
t.Fatal("registered clipboard flow was not forwarded")
|
||||
}
|
||||
deadline := time.Now().Add(time.Second)
|
||||
for {
|
||||
h.session.mu.Lock()
|
||||
inputs := append([]InputEvent(nil), h.session.inputs...)
|
||||
feedbacks := append([]Feedback(nil), h.session.feedback...)
|
||||
h.session.mu.Unlock()
|
||||
if len(inputs) == 1 && inputs[0].Sequence == 7 && len(feedbacks) == 1 && feedbacks[0].Sequence == 8 && feedbacks[0].Kind == FeedbackIDR {
|
||||
break
|
||||
}
|
||||
if time.Now().After(deadline) {
|
||||
t.Fatalf("registered flows inputs=%#v feedback=%#v", inputs, feedbacks)
|
||||
}
|
||||
time.Sleep(time.Millisecond)
|
||||
}
|
||||
|
||||
h.session.EmitEvent(ProviderEvent{Kind: ProviderEventRumble, Payload: []byte{1, 2, 3, 4, 5}})
|
||||
eventCtx, cancelEvent := context.WithTimeout(context.Background(), time.Second)
|
||||
event, err := h.client.ReceiveProviderEvent(eventCtx)
|
||||
cancelEvent()
|
||||
if err != nil || event.Kind != ProviderEventRumble || string(event.Payload) != string([]byte{1, 2, 3, 4, 5}) {
|
||||
t.Fatalf("registered provider feedback = %#v, %v", event, err)
|
||||
}
|
||||
|
||||
h.session.mu.Lock()
|
||||
h.session.clipboard = "registered provider clipboard"
|
||||
h.session.mu.Unlock()
|
||||
clipboardCtx, cancelClipboard := context.WithTimeout(context.Background(), time.Second)
|
||||
value, err := h.client.ReceiveClipboard(clipboardCtx)
|
||||
cancelClipboard()
|
||||
if err != nil || value.Text != "registered provider clipboard" {
|
||||
t.Fatalf("registered provider clipboard = %#v, %v", value, err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestPrivateChannelAliasesAreRejectedOnPublicTransport(t *testing.T) {
|
||||
for _, test := range []struct {
|
||||
alias string
|
||||
payload func(t *testing.T) []byte
|
||||
}{
|
||||
{"control", func(t *testing.T) []byte {
|
||||
t.Helper()
|
||||
value, err := EncodeClientFeedback(Feedback{Kind: FeedbackIDR})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return value
|
||||
}},
|
||||
{"input", func(t *testing.T) []byte {
|
||||
t.Helper()
|
||||
value, err := EncodeInputEvent(InputEvent{Device: "keyboard", Code: 7, Pressed: true})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return value
|
||||
}},
|
||||
{"clipboard", func(t *testing.T) []byte {
|
||||
t.Helper()
|
||||
value, err := protocol.EncodeGatewayClipboardText(protocol.GatewayClipboardText{Direction: "client_to_provider", Text: "alias", Encoding: "utf-8", LoopToken: "abcdefghijklmnop"})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return value
|
||||
}},
|
||||
} {
|
||||
t.Run(test.alias, func(t *testing.T) {
|
||||
h := newGatewayTransportHarness(t)
|
||||
encoded, err := protocol.EncodeChannelFrame(testChannelFrame(test.alias, 1, test.payload(t)))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := h.client.writeControl(encoded); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
h.waitReleased(t)
|
||||
h.session.mu.Lock()
|
||||
defer h.session.mu.Unlock()
|
||||
if len(h.session.inputs) != 0 || len(h.session.feedback) != 0 {
|
||||
t.Fatalf("alias reached provider: inputs=%#v feedback=%#v", h.session.inputs, h.session.feedback)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestProviderClipboardAuditWaitsForPublicTransportDelivery(t *testing.T) {
|
||||
h := newGatewayTransportHarness(t)
|
||||
h.client.control.CancelRead(0)
|
||||
h.session.mu.Lock()
|
||||
h.session.clipboard = "undeliverable clipboard"
|
||||
h.session.mu.Unlock()
|
||||
|
||||
h.waitReleased(t)
|
||||
for _, audit := range h.reporter.Audits() {
|
||||
if audit.Direction == "provider_to_client" && audit.Outcome == "forwarded" {
|
||||
t.Fatalf("failed delivery was audited as forwarded: %#v", audit)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func testChannelFrame(flowID string, sequence int64, payload []byte) protocol.ChannelFrame {
|
||||
return protocol.ChannelFrame{Version: "1", FlowID: flowID, Sequence: sequence, Flags: 0, FragmentIndex: 0, FragmentCount: 1, TimestampMs: time.Now().UnixMilli(), Payload: base64.StdEncoding.EncodeToString(payload)}
|
||||
}
|
||||
|
||||
type gatewayTransportHarness struct {
|
||||
client *Client
|
||||
session *fakeSession
|
||||
admission *oneTimeAdmission
|
||||
reporter *recordingProviderStateReporter
|
||||
}
|
||||
|
||||
func newGatewayTransportHarness(t *testing.T) gatewayTransportHarness {
|
||||
t.Helper()
|
||||
serverTLS, clientTLS := testTLS(t)
|
||||
fake := NewFakeApollo(FakeApolloConfig{Now: time.Date(2026, time.January, 1, 0, 0, 0, 0, time.UTC)})
|
||||
authority := protocol.SessionAuthority{Version: "1", SessionID: "session-transport", GatewayID: "gateway-1", Audience: "versevdi-gateway", ReconnectSequence: 0, ExpiresAt: time.Now().Add(5 * time.Second).UTC().Format(time.RFC3339Nano), Capabilities: DefaultCapabilities(), ProviderProfile: ProviderProfileApollo, ProviderIdentity: fake.config.Identity.Key()}
|
||||
admission := &oneTimeAdmission{authority: authority, released: make(chan struct{})}
|
||||
reporter := &recordingProviderStateReporter{}
|
||||
server, err := NewServer(ServerConfig{ListenAddress: "127.0.0.1:0", TLSConfig: serverTLS, GatewayID: "gateway-1", Capabilities: DefaultCapabilities(), ProviderCapabilities: DefaultCapabilities(), Admission: admission, ProviderStateReporter: reporter, ClipboardAuditReporter: reporter, Provider: fake})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
serveDone := make(chan error, 1)
|
||||
go func() { serveDone <- server.Serve(ctx) }()
|
||||
request := protocol.TunnelAdmissionRequest{Version: "1", SessionID: authority.SessionID, GatewayID: authority.GatewayID, Audience: authority.Audience, Grant: strings.Repeat("g", 64), ReconnectSequence: 0, ClientNonce: "nonce-0000000001", DeviceSignature: strings.Repeat("s", 86), Capabilities: DefaultCapabilities()}
|
||||
client, err := Dial(context.Background(), server.Addr().String(), clientTLS, request)
|
||||
if err != nil {
|
||||
cancel()
|
||||
_ = server.Close()
|
||||
t.Fatal(err)
|
||||
}
|
||||
session, ok := fake.LastSession().(*fakeSession)
|
||||
if !ok {
|
||||
t.Fatal("fake provider session type")
|
||||
}
|
||||
t.Cleanup(func() {
|
||||
_ = client.Close()
|
||||
cancel()
|
||||
_ = server.Close()
|
||||
if err := <-serveDone; err != nil {
|
||||
t.Errorf("serve: %v", err)
|
||||
}
|
||||
})
|
||||
return gatewayTransportHarness{client: client, session: session, admission: admission, reporter: reporter}
|
||||
}
|
||||
|
||||
func (h gatewayTransportHarness) waitReleased(t *testing.T) {
|
||||
t.Helper()
|
||||
select {
|
||||
case <-h.admission.released:
|
||||
case <-time.After(2 * time.Second):
|
||||
t.Fatal("gateway did not reject the channel")
|
||||
}
|
||||
}
|
||||
|
||||
func testTLS(t *testing.T) (*tls.Config, *tls.Config) {
|
||||
t.Helper()
|
||||
caKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
|
||||
|
||||
Reference in New Issue
Block a user