feat(core): add safe Rust wire session core
This commit is contained in:
sechmachine
@@ -0,0 +1,507 @@
|
||||
use serde::de::DeserializeOwned;
|
||||
use serde::Deserialize;
|
||||
|
||||
use crate::error::{CoreError, Result};
|
||||
|
||||
const MAX_MANIFEST_JSON_BYTES: usize = 128 * 1024;
|
||||
const MAX_CREDENTIAL_JSON_BYTES: usize = 196 * 1024;
|
||||
const MAX_ADMISSION_JSON_BYTES: usize = 16 * 1024;
|
||||
|
||||
fn decode_strict<T: DeserializeOwned>(bytes: &[u8], maximum: usize) -> Result<T> {
|
||||
if bytes.is_empty() || bytes.len() > maximum {
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
serde_json::from_slice(bytes).map_err(|_| CoreError::InvalidArgument)
|
||||
}
|
||||
|
||||
fn bounded(value: &str, minimum: usize, maximum: usize) -> bool {
|
||||
(minimum..=maximum).contains(&value.len())
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
|
||||
struct Timestamp {
|
||||
year: u16,
|
||||
month: u8,
|
||||
day: u8,
|
||||
hour: u8,
|
||||
minute: u8,
|
||||
second: u8,
|
||||
nanosecond: u32,
|
||||
}
|
||||
|
||||
fn timestamp(value: &str, exact_seconds: bool) -> Option<Timestamp> {
|
||||
let bytes = value.as_bytes();
|
||||
if bytes.len() < 20
|
||||
|| bytes.len() > 30
|
||||
|| bytes[4] != b'-'
|
||||
|| bytes[7] != b'-'
|
||||
|| bytes[10] != b'T'
|
||||
|| bytes[13] != b':'
|
||||
|| bytes[16] != b':'
|
||||
|| *bytes.last()? != b'Z'
|
||||
{
|
||||
return None;
|
||||
}
|
||||
let digits = |start: usize, end: usize| {
|
||||
bytes
|
||||
.get(start..end)?
|
||||
.iter()
|
||||
.try_fold(0_u32, |number, byte| {
|
||||
byte.is_ascii_digit()
|
||||
.then_some(number * 10 + u32::from(*byte - b'0'))
|
||||
})
|
||||
};
|
||||
let year = u16::try_from(digits(0, 4)?).ok()?;
|
||||
let month = u8::try_from(digits(5, 7)?).ok()?;
|
||||
let day = u8::try_from(digits(8, 10)?).ok()?;
|
||||
let hour = u8::try_from(digits(11, 13)?).ok()?;
|
||||
let minute = u8::try_from(digits(14, 16)?).ok()?;
|
||||
let second = u8::try_from(digits(17, 19)?).ok()?;
|
||||
if hour > 23 || minute > 59 || second > 59 {
|
||||
return None;
|
||||
}
|
||||
let leap = year % 4 == 0 && (year % 100 != 0 || year % 400 == 0);
|
||||
let maximum_day = match month {
|
||||
1 | 3 | 5 | 7 | 8 | 10 | 12 => 31,
|
||||
4 | 6 | 9 | 11 => 30,
|
||||
2 if leap => 29,
|
||||
2 => 28,
|
||||
_ => return None,
|
||||
};
|
||||
if day == 0 || day > maximum_day {
|
||||
return None;
|
||||
}
|
||||
let nanosecond = if bytes.len() == 20 {
|
||||
0
|
||||
} else {
|
||||
if exact_seconds || bytes[19] != b'.' {
|
||||
return None;
|
||||
}
|
||||
let fraction = bytes.get(20..bytes.len() - 1)?;
|
||||
if fraction.is_empty()
|
||||
|| fraction.len() > 9
|
||||
|| !fraction.iter().all(u8::is_ascii_digit)
|
||||
|| *fraction.last()? == b'0'
|
||||
{
|
||||
return None;
|
||||
}
|
||||
let mut value = fraction
|
||||
.iter()
|
||||
.fold(0_u32, |number, byte| number * 10 + u32::from(*byte - b'0'));
|
||||
for _ in fraction.len()..9 {
|
||||
value *= 10;
|
||||
}
|
||||
value
|
||||
};
|
||||
Some(Timestamp {
|
||||
year,
|
||||
month,
|
||||
day,
|
||||
hour,
|
||||
minute,
|
||||
second,
|
||||
nanosecond,
|
||||
})
|
||||
}
|
||||
|
||||
fn valid_dns_name(value: &str) -> bool {
|
||||
bounded(value, 1, 253)
|
||||
&& value.split('.').all(|label| {
|
||||
bounded(label, 1, 63)
|
||||
&& !label.starts_with('-')
|
||||
&& !label.ends_with('-')
|
||||
&& label
|
||||
.bytes()
|
||||
.all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
|
||||
})
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
pub struct CapabilityProfile {
|
||||
transport: String,
|
||||
framing: String,
|
||||
media: String,
|
||||
audio: String,
|
||||
source_rate_control: String,
|
||||
client_decode: Vec<String>,
|
||||
}
|
||||
|
||||
impl CapabilityProfile {
|
||||
/// Creates and validates an RC5 capability profile.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` when a field violates RC5 bounds or registry values.
|
||||
pub fn new(
|
||||
transport: &str,
|
||||
framing: &str,
|
||||
media: &str,
|
||||
audio: &str,
|
||||
source_rate_control: &str,
|
||||
client_decode: Vec<String>,
|
||||
) -> Result<Self> {
|
||||
let profile = Self {
|
||||
transport: transport.to_owned(),
|
||||
framing: framing.to_owned(),
|
||||
media: media.to_owned(),
|
||||
audio: audio.to_owned(),
|
||||
source_rate_control: source_rate_control.to_owned(),
|
||||
client_decode,
|
||||
};
|
||||
profile.validate()?;
|
||||
Ok(profile)
|
||||
}
|
||||
|
||||
fn validate(&self) -> Result<()> {
|
||||
if !bounded(&self.transport, 1, 64)
|
||||
|| !matches!(self.framing.as_str(), "datagram-v1" | "datagram-v2")
|
||||
|| !bounded(&self.media, 1, 64)
|
||||
|| !bounded(&self.audio, 1, 64)
|
||||
|| !bounded(&self.source_rate_control, 1, 64)
|
||||
|| !(1..=2).contains(&self.client_decode.len())
|
||||
|| self
|
||||
.client_decode
|
||||
.iter()
|
||||
.any(|value| !matches!(value.as_str(), "h264-opus" | "hevc-opus"))
|
||||
|| self.client_decode.len()
|
||||
!= self
|
||||
.client_decode
|
||||
.iter()
|
||||
.collect::<std::collections::BTreeSet<_>>()
|
||||
.len()
|
||||
{
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn is_subset_of(&self, offered: &Self) -> bool {
|
||||
self.transport == offered.transport
|
||||
&& self.framing == offered.framing
|
||||
&& self.media == offered.media
|
||||
&& self.audio == offered.audio
|
||||
&& self.source_rate_control == offered.source_rate_control
|
||||
&& self
|
||||
.client_decode
|
||||
.iter()
|
||||
.all(|codec| offered.client_decode.contains(codec))
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
struct ManifestGateway {
|
||||
id: String,
|
||||
addresses: Vec<String>,
|
||||
public_identity: String,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
struct ManifestTunnel {
|
||||
versions: Vec<String>,
|
||||
features: Vec<String>,
|
||||
}
|
||||
|
||||
#[allow(clippy::struct_field_names)]
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
struct ManifestBounds {
|
||||
minimum_kbps: u64,
|
||||
target_kbps: u64,
|
||||
maximum_kbps: u64,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
struct DisplayMode {
|
||||
resolution_width: u16,
|
||||
resolution_height: u16,
|
||||
fps: u16,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
struct ManifestProfile {
|
||||
id: String,
|
||||
bounds: ManifestBounds,
|
||||
display_mode: Option<DisplayMode>,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
struct GrantReference {
|
||||
opaque_value: String,
|
||||
expires_at: String,
|
||||
audience: String,
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
pub struct ConnectionManifest {
|
||||
version: String,
|
||||
purpose: String,
|
||||
session_id: String,
|
||||
reconnect_sequence: u64,
|
||||
gateway: ManifestGateway,
|
||||
tunnel: ManifestTunnel,
|
||||
profile: ManifestProfile,
|
||||
grant: GrantReference,
|
||||
correlation_id: String,
|
||||
}
|
||||
|
||||
impl ConnectionManifest {
|
||||
/// Strictly decodes and validates an RC5 connection manifest.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for malformed, duplicate, trailing, unknown, or invalid data.
|
||||
pub fn decode(bytes: &[u8]) -> Result<Self> {
|
||||
let manifest: Self = decode_strict(bytes, MAX_MANIFEST_JSON_BYTES)?;
|
||||
manifest.validate()?;
|
||||
Ok(manifest)
|
||||
}
|
||||
|
||||
fn validate(&self) -> Result<()> {
|
||||
let bounds = &self.profile.bounds;
|
||||
let valid_display = self.profile.display_mode.as_ref().is_none_or(|mode| {
|
||||
(320..=16_384).contains(&mode.resolution_width)
|
||||
&& (200..=8_640).contains(&mode.resolution_height)
|
||||
&& (1..=240).contains(&mode.fps)
|
||||
});
|
||||
if self.version != "1"
|
||||
|| !matches!(self.purpose.as_str(), "launch" | "reconnect")
|
||||
|| !bounded(&self.session_id, 1, 128)
|
||||
|| !bounded(&self.gateway.id, 1, 128)
|
||||
|| !(1..=4).contains(&self.gateway.addresses.len())
|
||||
|| self
|
||||
.gateway
|
||||
.addresses
|
||||
.iter()
|
||||
.any(|address| !bounded(address, 1, 256))
|
||||
|| !valid_dns_name(&self.gateway.public_identity)
|
||||
|| !(1..=4).contains(&self.tunnel.versions.len())
|
||||
|| self
|
||||
.tunnel
|
||||
.versions
|
||||
.iter()
|
||||
.any(|version| !bounded(version, 1, 64))
|
||||
|| self.tunnel.features.len() > 32
|
||||
|| self
|
||||
.tunnel
|
||||
.features
|
||||
.iter()
|
||||
.any(|feature| !bounded(feature, 1, 64))
|
||||
|| !bounded(&self.profile.id, 1, 128)
|
||||
|| !(1..=100_000_000).contains(&bounds.minimum_kbps)
|
||||
|| !(1..=100_000_000).contains(&bounds.target_kbps)
|
||||
|| !(1..=100_000_000).contains(&bounds.maximum_kbps)
|
||||
|| bounds.minimum_kbps > bounds.target_kbps
|
||||
|| bounds.target_kbps > bounds.maximum_kbps
|
||||
|| !valid_display
|
||||
|| !bounded(&self.grant.opaque_value, 43, 256)
|
||||
|| timestamp(&self.grant.expires_at, false).is_none()
|
||||
|| !bounded(&self.grant.audience, 1, 128)
|
||||
|| !bounded(&self.correlation_id, 1, 128)
|
||||
{
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Checks expiry and the supported tunnel binding at a supplied UTC instant.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for unsupported input or `expired` for an expired grant.
|
||||
pub fn validate_at(&self, now_utc: &str) -> Result<()> {
|
||||
let now = timestamp(now_utc, false).ok_or(CoreError::InvalidArgument)?;
|
||||
if timestamp(&self.grant.expires_at, false).ok_or(CoreError::InvalidArgument)? <= now {
|
||||
return Err(CoreError::Expired);
|
||||
}
|
||||
if !self
|
||||
.tunnel
|
||||
.versions
|
||||
.iter()
|
||||
.any(|value| value == "verse-gateway-v1/1")
|
||||
|| !self
|
||||
.tunnel
|
||||
.features
|
||||
.iter()
|
||||
.any(|value| value == "control.v1")
|
||||
{
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
pub struct NativeTunnelCredential {
|
||||
client_device_id: String,
|
||||
device_key_id: String,
|
||||
certificate_chain_pem: String,
|
||||
trust_bundle_pem: String,
|
||||
expires_at: String,
|
||||
}
|
||||
|
||||
impl NativeTunnelCredential {
|
||||
/// Strictly decodes and validates an RC5 native tunnel credential.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for malformed, unknown, or out-of-bound data.
|
||||
pub fn decode(bytes: &[u8]) -> Result<Self> {
|
||||
let credential: Self = decode_strict(bytes, MAX_CREDENTIAL_JSON_BYTES)?;
|
||||
if !bounded(&credential.client_device_id, 1, 128)
|
||||
|| !bounded(&credential.device_key_id, 1, 128)
|
||||
|| !bounded(&credential.certificate_chain_pem, 1, 65_536)
|
||||
|| !bounded(&credential.trust_bundle_pem, 1, 65_536)
|
||||
|| timestamp(&credential.expires_at, false).is_none()
|
||||
{
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
Ok(credential)
|
||||
}
|
||||
|
||||
/// Checks credential expiry at a supplied UTC instant.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for an invalid instant or `expired` after expiry.
|
||||
pub fn validate_at(&self, now_utc: &str) -> Result<()> {
|
||||
let now = timestamp(now_utc, false).ok_or(CoreError::InvalidArgument)?;
|
||||
if timestamp(&self.expires_at, false).ok_or(CoreError::InvalidArgument)? <= now {
|
||||
return Err(CoreError::Expired);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
pub struct TunnelAdmissionRequest {
|
||||
version: String,
|
||||
session_id: String,
|
||||
gateway_id: String,
|
||||
audience: String,
|
||||
grant: String,
|
||||
reconnect_sequence: u64,
|
||||
client_nonce: String,
|
||||
device_signature: String,
|
||||
capabilities: CapabilityProfile,
|
||||
}
|
||||
|
||||
impl TunnelAdmissionRequest {
|
||||
/// Strictly decodes and validates an RC5 tunnel admission request.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for malformed, unknown, or out-of-bound data.
|
||||
pub fn decode(bytes: &[u8]) -> Result<Self> {
|
||||
let request: Self = decode_strict(bytes, MAX_ADMISSION_JSON_BYTES)?;
|
||||
if request.version != "1"
|
||||
|| !bounded(&request.session_id, 1, 128)
|
||||
|| !bounded(&request.gateway_id, 1, 128)
|
||||
|| !bounded(&request.audience, 1, 256)
|
||||
|| !bounded(&request.grant, 43, 256)
|
||||
|| !bounded(&request.client_nonce, 16, 128)
|
||||
|| request.device_signature.len() != 86
|
||||
{
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
request.capabilities.validate()?;
|
||||
Ok(request)
|
||||
}
|
||||
|
||||
#[must_use]
|
||||
pub fn admission_transcript(&self) -> Vec<u8> {
|
||||
let reconnect_sequence = self.reconnect_sequence.to_string();
|
||||
let decode_count = self.capabilities.client_decode.len().to_string();
|
||||
let mut fields = vec![
|
||||
self.session_id.as_str(),
|
||||
self.gateway_id.as_str(),
|
||||
self.audience.as_str(),
|
||||
self.grant.as_str(),
|
||||
reconnect_sequence.as_str(),
|
||||
self.client_nonce.as_str(),
|
||||
self.capabilities.transport.as_str(),
|
||||
self.capabilities.framing.as_str(),
|
||||
self.capabilities.media.as_str(),
|
||||
self.capabilities.audio.as_str(),
|
||||
self.capabilities.source_rate_control.as_str(),
|
||||
decode_count.as_str(),
|
||||
];
|
||||
fields.extend(self.capabilities.client_decode.iter().map(String::as_str));
|
||||
let mut transcript = String::from("versevdi/tunnel-admission/v1");
|
||||
for field in fields {
|
||||
transcript.push_str(&field.len().to_string());
|
||||
transcript.push(':');
|
||||
transcript.push_str(field);
|
||||
}
|
||||
transcript.into_bytes()
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Debug, Deserialize)]
|
||||
#[serde(deny_unknown_fields)]
|
||||
pub struct ClientSessionAuthority {
|
||||
version: String,
|
||||
session_id: String,
|
||||
gateway_id: String,
|
||||
audience: String,
|
||||
reconnect_sequence: u64,
|
||||
expires_at: String,
|
||||
capabilities: CapabilityProfile,
|
||||
}
|
||||
|
||||
impl ClientSessionAuthority {
|
||||
/// Strictly decodes and validates a provider-free RC5 client authority.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for malformed, unknown, provider-shaped, or invalid data.
|
||||
pub fn decode(bytes: &[u8]) -> Result<Self> {
|
||||
let authority: Self = decode_strict(bytes, MAX_ADMISSION_JSON_BYTES)?;
|
||||
if authority.version != "1"
|
||||
|| !bounded(&authority.session_id, 1, 128)
|
||||
|| !bounded(&authority.gateway_id, 1, 128)
|
||||
|| !bounded(&authority.audience, 1, 256)
|
||||
|| timestamp(&authority.expires_at, true).is_none()
|
||||
{
|
||||
return Err(CoreError::InvalidArgument);
|
||||
}
|
||||
authority.capabilities.validate()?;
|
||||
Ok(authority)
|
||||
}
|
||||
|
||||
/// Checks session, gateway, audience, reconnect, expiry, and capability bindings.
|
||||
///
|
||||
/// # Errors
|
||||
///
|
||||
/// Returns `invalid_argument` for an invalid clock value or `authority_rejected` on mismatch.
|
||||
pub fn validate_binding(
|
||||
&self,
|
||||
manifest: &ConnectionManifest,
|
||||
offered: &CapabilityProfile,
|
||||
now_utc: &str,
|
||||
) -> Result<()> {
|
||||
let now = timestamp(now_utc, false).ok_or(CoreError::InvalidArgument)?;
|
||||
let expires = timestamp(&self.expires_at, true).ok_or(CoreError::AuthorityRejected)?;
|
||||
let grant_expires =
|
||||
timestamp(&manifest.grant.expires_at, false).ok_or(CoreError::AuthorityRejected)?;
|
||||
if self.session_id != manifest.session_id
|
||||
|| self.gateway_id != manifest.gateway.id
|
||||
|| self.audience != manifest.grant.audience
|
||||
|| self.reconnect_sequence != manifest.reconnect_sequence
|
||||
|| expires <= now
|
||||
|| expires > grant_expires
|
||||
|| !self.capabilities.is_subset_of(offered)
|
||||
{
|
||||
return Err(CoreError::AuthorityRejected);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user