410 lines
11 KiB
Go
410 lines
11 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"strconv"
|
|
"strings"
|
|
"unicode/utf8"
|
|
|
|
protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
|
|
)
|
|
|
|
func main() {
|
|
entries, err := os.ReadDir("fixtures/conformance")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
var results []string
|
|
for _, entry := range entries {
|
|
if entry.IsDir() || filepath.Ext(entry.Name()) != ".tsv" {
|
|
continue
|
|
}
|
|
path := filepath.Join("fixtures/conformance", entry.Name())
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
lines := strings.Split(strings.TrimSuffix(string(data), "\n"), "\n")
|
|
if len(lines) == 0 || lines[0] != "id\tversion\tkind\tinput\texpected" {
|
|
panic("invalid fixture header")
|
|
}
|
|
for _, line := range lines[1:] {
|
|
fields := strings.Split(line, "\t")
|
|
if len(fields) != 5 {
|
|
panic("invalid fixture row")
|
|
}
|
|
actual := evaluate(fields[2], fields[3])
|
|
if actual != fields[4] {
|
|
panic(fmt.Sprintf("%s: got %s want %s", fields[0], actual, fields[4]))
|
|
}
|
|
results = append(results, fields[0]+"\t"+actual)
|
|
}
|
|
}
|
|
fixtureHash := readFixtureHash()
|
|
fmt.Printf("Go conformance passed normalized=%s fixtures=%s\n", normalizedDigest(results), fixtureHash)
|
|
}
|
|
|
|
func evaluate(kind, input string) string {
|
|
parts := map[string]string{}
|
|
for _, item := range strings.Split(input, ";") {
|
|
pair := strings.SplitN(item, "=", 2)
|
|
if len(pair) == 2 {
|
|
parts[pair[0]] = pair[1]
|
|
}
|
|
}
|
|
switch kind {
|
|
case "version":
|
|
if input == "1" || input == "0" || input == "-1" {
|
|
return "valid"
|
|
}
|
|
return "invalid:unsupported_version"
|
|
case "page":
|
|
limit, err := strconv.Atoi(parts["limit"])
|
|
value := protocol.PageInfo{Limit: int64(limit), NextCursor: parts["cursor"]}
|
|
if err == nil && value.Validate() == nil {
|
|
return "valid"
|
|
}
|
|
return "invalid:invalid_limit"
|
|
case "manifest":
|
|
forbidden := []string{"provider_url", "vm_address", "password", "private_key"}
|
|
for _, key := range forbidden {
|
|
if _, ok := parts[key]; ok {
|
|
return "invalid:forbidden_field"
|
|
}
|
|
}
|
|
value := protocol.ConnectionManifest{
|
|
Version: parts["version"], Purpose: parts["purpose"], SessionID: "session-1",
|
|
ReconnectSequence: 0,
|
|
Gateway: protocol.ManifestGateway{
|
|
ID: parts["gateway_id"], Addresses: []string{"gateway.control.test:443"}, PublicIdentity: parts["gateway_id"],
|
|
},
|
|
Tunnel: protocol.ManifestTunnel{Versions: []string{parts["protocol"] + "/1"}, Features: []string{"control.v1"}},
|
|
Profile: protocol.ManifestProfile{ID: "standard", Bounds: protocol.ManifestBounds{MinimumKbps: 1, TargetKbps: 2, MaximumKbps: 3}},
|
|
Grant: protocol.GrantReference{OpaqueValue: parts["grant"], ExpiresAt: parts["expires_at"], Audience: parts["audience"]},
|
|
CorrelationID: "correlation-1",
|
|
}
|
|
if value.Validate() == nil {
|
|
return "valid"
|
|
}
|
|
return "invalid:invalid_manifest"
|
|
case "clipboard":
|
|
_, hasFile := parts["file"]
|
|
value := protocol.ClipboardText{Text: parts["text"], Encoding: parts["encoding"]}
|
|
if !hasFile && value.Validate() == nil {
|
|
return "valid"
|
|
}
|
|
return "invalid:unsupported_clipboard"
|
|
case "event":
|
|
sequence, sequenceErr := strconv.ParseInt(parts["sequence"], 10, 64)
|
|
payloadBytes, payloadErr := strconv.Atoi(parts["payload_bytes"])
|
|
if parts["version"] != "1" {
|
|
return "invalid:unsupported_version"
|
|
}
|
|
if parts["after"] != "" && parts["earliest"] != "" {
|
|
after, afterErr := strconv.ParseInt(parts["after"], 10, 64)
|
|
earliest, earliestErr := strconv.ParseInt(parts["earliest"], 10, 64)
|
|
if afterErr == nil && earliestErr == nil && after > 0 && earliest > 0 && after < earliest-1 {
|
|
return "invalid:gap"
|
|
}
|
|
}
|
|
value := protocol.EventEnvelope{
|
|
EventID: "event-1", Sequence: sequence, Type: "broker.session.changed", Version: 1,
|
|
Resource: protocol.ResourceLink{Type: "broker_session", ID: "session-1", Version: 1},
|
|
OccurredAt: "2099-01-01T00:00:00Z", CorrelationID: parts["correlation_id"], Payload: map[string]any{},
|
|
}
|
|
if payloadErr != nil || payloadBytes > 16384 {
|
|
return "invalid:payload_limit"
|
|
}
|
|
if sequenceErr != nil || value.Validate() != nil {
|
|
return "invalid:required"
|
|
}
|
|
return "valid"
|
|
case "tunnel":
|
|
feature := parts["feature"]
|
|
registered := feature == "control.v1" || feature == "display.request.v1" || feature == "input.absolute.v1" || feature == "input.scroll.v1"
|
|
if (parts["offered"] == "1" || parts["offered"] == "0" || parts["offered"] == "-1") && registered {
|
|
return "valid"
|
|
}
|
|
if !registered {
|
|
return "invalid:unsupported_feature"
|
|
}
|
|
return "invalid:unsupported_version"
|
|
case "datagram":
|
|
return classifyDatagram(parts["hex"])
|
|
case "gateway_input":
|
|
return classifyGatewayInput(parts["hex"])
|
|
case "gateway_feedback":
|
|
return classifyGatewayFeedback(parts["hex"])
|
|
case "gateway_clipboard":
|
|
if _, hasFile := parts["file"]; hasFile {
|
|
return "invalid:forbidden"
|
|
}
|
|
value := protocol.GatewayClipboardText{Direction: parts["direction"], Text: parts["text"], Encoding: parts["encoding"], LoopToken: parts["loop_token"]}
|
|
if value.Validate() != nil {
|
|
return "invalid:clipboard"
|
|
}
|
|
return "valid"
|
|
case "gateway_clipboard_audit":
|
|
if _, hasText := parts["text"]; hasText {
|
|
return "invalid:forbidden"
|
|
}
|
|
textBytes, err := strconv.ParseInt(parts["text_bytes"], 10, 64)
|
|
if err != nil {
|
|
return "invalid:clipboard_audit"
|
|
}
|
|
value := protocol.GatewayClipboardAudit{Version: "1", SessionID: "fixture-session", Direction: parts["direction"], Outcome: parts["outcome"], TextBytes: textBytes, Reason: parts["reason"]}
|
|
if value.Validate() != nil {
|
|
return "invalid:clipboard_audit"
|
|
}
|
|
return "valid"
|
|
default:
|
|
return "invalid:unknown_kind"
|
|
}
|
|
}
|
|
|
|
func decodeGatewayHex(encoded string) ([]byte, string) {
|
|
raw, err := hex.DecodeString(encoded)
|
|
if err != nil {
|
|
return nil, "invalid:hex"
|
|
}
|
|
return raw, ""
|
|
}
|
|
|
|
func classifyGatewayInput(encoded string) string {
|
|
raw, invalid := decodeGatewayHex(encoded)
|
|
if invalid != "" {
|
|
return invalid
|
|
}
|
|
if len(raw) < 6 {
|
|
return "invalid:truncated"
|
|
}
|
|
if string(raw[:4]) != "VGI1" {
|
|
return "invalid:magic"
|
|
}
|
|
kind, length := raw[4], int(raw[5])
|
|
if len(raw) != 6+length {
|
|
return "invalid:length"
|
|
}
|
|
body := raw[6:]
|
|
switch kind {
|
|
case 1:
|
|
if len(body) != 4 || body[0] > 1 || (body[2] == 0 && body[3] == 0) {
|
|
return "invalid:field"
|
|
}
|
|
case 2:
|
|
if len(body) != 3 {
|
|
return "invalid:length"
|
|
}
|
|
if body[0] > 1 || body[1] < 1 || body[1] > 5 {
|
|
return "invalid:field"
|
|
}
|
|
if body[2] != 0 {
|
|
return "invalid:reserved"
|
|
}
|
|
case 3:
|
|
if len(body) != 4 {
|
|
return "invalid:length"
|
|
}
|
|
case 4:
|
|
if len(body) < 1 || len(body) > 4 || !utf8.Valid(body) || utf8.RuneCount(body) != 1 {
|
|
return "invalid:utf8"
|
|
}
|
|
case 5:
|
|
if len(body) != 17 {
|
|
return "invalid:length"
|
|
}
|
|
if body[0] > 15 {
|
|
return "invalid:field"
|
|
}
|
|
if body[1] == 0 && body[2] == 0 {
|
|
for _, value := range body[3:] {
|
|
if value != 0 {
|
|
return "invalid:field"
|
|
}
|
|
}
|
|
}
|
|
case 6:
|
|
if len(body) != 8 {
|
|
return "invalid:length"
|
|
}
|
|
x, y := uint16(body[0])<<8|uint16(body[1]), uint16(body[2])<<8|uint16(body[3])
|
|
width, height := uint16(body[4])<<8|uint16(body[5]), uint16(body[6])<<8|uint16(body[7])
|
|
if width == 0 || height == 0 || x >= width || y >= height {
|
|
return "invalid:field"
|
|
}
|
|
case 7:
|
|
if len(body) != 4 {
|
|
return "invalid:length"
|
|
}
|
|
default:
|
|
return "invalid:kind"
|
|
}
|
|
return "valid"
|
|
}
|
|
|
|
func classifyGatewayFeedback(encoded string) string {
|
|
raw, invalid := decodeGatewayHex(encoded)
|
|
if invalid != "" {
|
|
return invalid
|
|
}
|
|
if len(raw) < 8 {
|
|
return "invalid:truncated"
|
|
}
|
|
if string(raw[:4]) != "VGF1" {
|
|
return "invalid:magic"
|
|
}
|
|
direction, kind := raw[4], raw[5]
|
|
if len(raw) != 8+(int(raw[6])<<8)+int(raw[7]) {
|
|
return "invalid:length"
|
|
}
|
|
if direction != 0 && direction != 1 {
|
|
return "invalid:direction"
|
|
}
|
|
body := raw[8:]
|
|
if direction == 0 {
|
|
if kind >= 0x10 && kind <= 0x12 {
|
|
return "invalid:direction"
|
|
}
|
|
switch kind {
|
|
case 1:
|
|
if len(body) == 0 {
|
|
return "valid"
|
|
}
|
|
case 2:
|
|
if validFECStatus(body) {
|
|
return "valid"
|
|
}
|
|
return "invalid:field"
|
|
case 3:
|
|
if len(body) == 0 {
|
|
return "valid"
|
|
}
|
|
default:
|
|
return "invalid:type"
|
|
}
|
|
return "invalid:length"
|
|
}
|
|
if kind == 1 || kind == 2 || kind == 3 {
|
|
return "invalid:direction"
|
|
}
|
|
switch kind {
|
|
case 0x10:
|
|
if len(body) == 4 {
|
|
return "valid"
|
|
}
|
|
return "invalid:length"
|
|
case 0x11:
|
|
if len(body) != 5 {
|
|
return "invalid:length"
|
|
}
|
|
if body[0] <= 15 {
|
|
return "valid"
|
|
}
|
|
case 0x12:
|
|
if len(body) != 1 {
|
|
return "invalid:length"
|
|
}
|
|
if body[0] <= 1 {
|
|
return "valid"
|
|
}
|
|
default:
|
|
return "invalid:type"
|
|
}
|
|
return "invalid:field"
|
|
}
|
|
|
|
func validFECStatus(body []byte) bool {
|
|
if len(body) != 21 || int(body[10])<<8|int(body[11]) == 0 || int(body[14])<<8|int(body[15]) > int(body[10])<<8|int(body[11]) || int(body[16])<<8|int(body[17]) > int(body[12])<<8|int(body[13]) || body[18] > 100 || body[20] == 0 || body[19] >= body[20] {
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
func classifyDatagram(encoded string) string {
|
|
raw, err := hex.DecodeString(encoded)
|
|
if err != nil {
|
|
return "invalid:hex"
|
|
}
|
|
if len(raw) < 3 {
|
|
return "invalid:truncated"
|
|
}
|
|
if string(raw[:2]) != "VD" {
|
|
return "invalid:magic"
|
|
}
|
|
if raw[2] != 1 && raw[2] != 2 {
|
|
return "invalid:unsupported_version"
|
|
}
|
|
headerBytes := 21
|
|
limits := map[byte]int{1: 1024, 2: 2048, 3: 65515, 10: 1179, 11: 1179, 12: 1179}
|
|
if raw[2] == 2 {
|
|
headerBytes = 23
|
|
limits = map[byte]int{10: 1177, 11: 1177}
|
|
}
|
|
if len(raw) < headerBytes {
|
|
return "invalid:truncated"
|
|
}
|
|
limit, ok := limits[raw[3]]
|
|
if !ok {
|
|
return "invalid:unknown_channel"
|
|
}
|
|
if raw[4] != 0 {
|
|
return "invalid:flags"
|
|
}
|
|
fragmentIndex, fragmentCount := int(raw[17]), int(raw[18])
|
|
payloadOffset := 19
|
|
if raw[2] == 2 {
|
|
fragmentIndex = int(raw[17])<<8 | int(raw[18])
|
|
fragmentCount = int(raw[19])<<8 | int(raw[20])
|
|
payloadOffset = 21
|
|
if fragmentCount > 891 {
|
|
return "invalid:fragment_limit"
|
|
}
|
|
}
|
|
if fragmentCount == 0 || fragmentIndex >= fragmentCount {
|
|
return "invalid:fragment"
|
|
}
|
|
payloadLength := int(raw[payloadOffset])<<8 | int(raw[payloadOffset+1])
|
|
if payloadLength > limit {
|
|
return "invalid:payload_limit"
|
|
}
|
|
if len(raw) != headerBytes+payloadLength {
|
|
return "invalid:length_mismatch"
|
|
}
|
|
if raw[2] == 1 && len(raw) > 65536 || raw[2] == 2 && len(raw) > 1200 {
|
|
return "invalid:frame_limit"
|
|
}
|
|
return "valid"
|
|
}
|
|
|
|
func normalizedDigest(results []string) string {
|
|
const offset = uint64(14695981039346656037)
|
|
const prime = uint64(1099511628211)
|
|
value := offset
|
|
for _, result := range results {
|
|
for _, byteValue := range []byte(result + "\n") {
|
|
value ^= uint64(byteValue)
|
|
value *= prime
|
|
}
|
|
}
|
|
return fmt.Sprintf("%016x", value)
|
|
}
|
|
|
|
func readFixtureHash() string {
|
|
data, err := os.ReadFile("fixtures/manifest.json")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
var manifest struct {
|
|
CorpusSHA256 string `json:"corpus_sha256"`
|
|
}
|
|
if err := json.Unmarshal(data, &manifest); err != nil || len(manifest.CorpusSHA256) != sha256.Size*2 {
|
|
panic("invalid fixture manifest")
|
|
}
|
|
return manifest.CorpusSHA256
|
|
}
|