Test link-local rejection and unrestricted sockets on shared connections

This commit is contained in:
evgeny committed 2026-10-30 22:50:23 +01:00
1 parent 16b1003710
commit eda5d99530
2 files changed
+15 -15

No files matched your search

+7 -7
View File
@@ -82,7 +82,7 @@ static void receive(struct ETCP_CONN* conn, struct ll_entry* packet) {
for (int i = 1; i < 1500; i++) assert(packet->dgram[i] == (uint8_t)(i + ep->received));
ep->received++; queue_dgram_free(packet); queue_entry_free(packet);
}
static void setup(int require_known_node) {
static void setup(void) {
memset(endpoints, 0, sizeof(endpoints));
ua = uasync_create(); assert(ua);
for (int i = 0; i < 2; i++) {
@@ -128,13 +128,13 @@ static void close_initial(struct ETCP_CONN* conn, struct ETCP_LINK* link, int ol
if (old_state == -1) { ++*(int*)arg; etcp_link_close(link); }
}
/* Незнакомый, но криптографически корректный ключ: оба варианта политики должны отказать до UP. */
static void reject_unknown_peer(int connection_policy) {
size_t baseline = u_get_allocated_count(); setup(connection_policy);
static void reject_unknown_peer(void) {
size_t baseline = u_get_allocated_count(); setup();
struct pipe_driver pipes[2] = {{.ua = ua}, {.ua = ua}};
pipes[0].peer = &pipes[1]; pipes[1].peer = &pipes[0];
for (int i = 0; i < 2; ++i) {
struct packet_link_driver driver = api(&pipes[i]);
assert(etcp_link_add(endpoints[i].conn, &driver, i == 1 && !connection_policy));
assert(etcp_link_add(endpoints[i].conn, &driver, i == 1));
}
uint64_t end = get_time_us() + 2000000;
while (!pipes[1].stopped && get_time_us() < end) uasync_poll(ua, 10);
@@ -147,7 +147,7 @@ static void reject_unknown_peer(int connection_policy) {
memory_pool_destroy(endpoints[i].inst.data_pool); memory_pool_destroy(endpoints[i].inst.ack_pool);
}
uasync_destroy(ua, 0); assert(u_get_allocated_count() == baseline);
puts(connection_policy ? "PASS unknown authenticated key denied by connection policy" : "PASS unknown authenticated key denied by link policy");
puts("PASS unknown authenticated key denied by BLE-like link policy");
}
int main(void) {
@@ -169,7 +169,7 @@ int main(void) {
assert(snapshot.direction == PACKET_LINK_OUTGOING);
native.reality_set = 1;
assert(!etcp_link_get_snapshot(&native, &snapshot) && !strcmp(snapshot.protocol, "TCP+REALITY"));
size_t baseline = u_get_allocated_count(); setup(0);
size_t baseline = u_get_allocated_count(); setup();
struct pipe_driver pipes[2] = {{.ua = ua}, {.ua = ua, .connecting = 1}};
pipes[0].peer = &pipes[1]; pipes[1].peer = &pipes[0];
struct packet_link_driver drivers[2] = {api(&pipes[0]), api(&pipes[1])};
@@ -256,6 +256,6 @@ int main(void) {
}
uasync_destroy(ua, 0); assert(u_get_allocated_count() == baseline);
puts("PASS dynamic driver: empty connection, bind rollback, encrypted handshake, 1500-byte messages, backpressure, independent close");
reject_unknown_peer(1); reject_unknown_peer(0);
reject_unknown_peer();
return 0;
}
+8 -8
View File
@@ -24,7 +24,7 @@ struct endpoint {
static struct endpoint ep[2];
static struct UASYNC* ua;
static unsigned close_action, close_fired, late_handshakes;
static int known_default;
static int reuse_connection;
static const char* pubkeys[] = {
"b3193173def895bd0fcea6f86af077c7d77216f10395275f627ac18242ec0f01",
"ce8871f07fa056c636d297115f231b08c29cdf94e0d440fce83a07c34416d36a"
@@ -121,8 +121,8 @@ static void setup(unsigned swapped, unsigned count) {
CHECK(etcp_bind(ep[side].inst, 253, receive) == 0);
}
if (!count) return; /* Отдельная проверка входящего INIT до создания транспорта. */
if (known_default) {
/* Общий объект ранее мог быть создан BLE: входящий UDP обязан переиспользовать его без CHAT-проверки. */
if (reuse_connection) {
/* Входящий UDP переиспользует общий объект, который уже создал другой транспорт. */
ep[1].conn = etcp_connection_create(ep[1].inst, "shared native"); CHECK(ep[1].conn);
CHECK(!etcp_connection_set_peer(ep[1].conn, ep[0].inst->my_keys.public_key));
CHECK(!etcp_conn_index_peer(ep[1].conn));
@@ -539,11 +539,11 @@ static void transition_callbacks(unsigned swapped, unsigned stage, unsigned acti
teardown();
}
/* Оба ETCP_CONN имитируют BLE-происхождение; настоящие UDP/AES-CCM работают без CHAT-мемберства. */
/* Общий ETCP_CONN не несёт политики BLE; настоящие UDP/AES-CCM работают без CHAT-мемберства. */
static void native_socket_admission(void) {
known_default = 1; setup(0, 1);
reuse_connection = 1; setup(0, 1);
for (unsigned side = 0; side < 2; ++side) {
CHECK(ep[side].conn->require_known_node && ep[side].conn->initialized && ep[side].conn->links_up);
CHECK(ep[side].conn->initialized && ep[side].conn->links_up);
CHECK(!first_link(side)->require_known_node);
CHECK(!topo_groups_peer_key_known(ep[side].inst, ep[1-side].inst->my_keys.public_key));
struct ll_entry* entry = ll_alloc_lldgram(2); CHECK(entry);
@@ -551,8 +551,8 @@ static void native_socket_admission(void) {
CHECK(!etcp_send(ep[side].conn, entry));
}
run_for(1000); CHECK(ep[0].received == 1 && ep[1].received == 1);
teardown(); known_default = 0;
DEBUG_INFO(DEBUG_CATEGORY_DEBUG, "PASS native socket policy: unknown CHAT peers, BLE-origin shared conn, encrypted duplex UDP");
teardown(); reuse_connection = 0;
DEBUG_INFO(DEBUG_CATEGORY_DEBUG, "PASS native socket policy: unknown CHAT peers, shared conn, encrypted duplex UDP");
}
/* При отказе показать конкретные живые блоки вместо одного несовпавшего счётчика. */