checkpoint: integrate authenticated transports
This commit is contained in:
h3cx committed
1 parent
313ab00765
commit
586ff8f223
42 files changed
+6277
-771
No files matched your search
@@ -0,0 +1,272 @@
|
||||
use std::{collections::HashMap, fs, process::Command, sync::Arc, time::Duration};
|
||||
|
||||
use base64::Engine;
|
||||
use bytes::Bytes;
|
||||
use quinn::{ClientConfig, Endpoint, ServerConfig};
|
||||
use rustls::pki_types::{pem::PemObject, CertificateDer, PrivateKeyDer};
|
||||
use tokio::time::timeout;
|
||||
use wgcloak::config;
|
||||
use wgcloak::transport::{
|
||||
http3::{Http3ClientConnection, Http3Error, Http3Server, Http3ServerConnection},
|
||||
AdmissionController, TransportSession,
|
||||
};
|
||||
|
||||
const SECRET: &str = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
|
||||
const WRONG_SECRET: &str = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
|
||||
|
||||
fn test_endpoints() -> (
|
||||
tempfile::TempDir,
|
||||
Endpoint,
|
||||
ClientConfig,
|
||||
std::net::SocketAddr,
|
||||
) {
|
||||
let directory = tempfile::tempdir().unwrap();
|
||||
let certificate = directory.path().join("localhost-cert.pem");
|
||||
let private_key = directory.path().join("localhost-key.pem");
|
||||
let result = Command::new("openssl")
|
||||
.args([
|
||||
"req",
|
||||
"-x509",
|
||||
"-newkey",
|
||||
"rsa:2048",
|
||||
"-nodes",
|
||||
"-keyout",
|
||||
private_key.to_str().unwrap(),
|
||||
"-out",
|
||||
certificate.to_str().unwrap(),
|
||||
"-subj",
|
||||
"/CN=localhost",
|
||||
"-addext",
|
||||
"subjectAltName=DNS:localhost",
|
||||
"-addext",
|
||||
"basicConstraints=critical,CA:FALSE",
|
||||
"-addext",
|
||||
"keyUsage=critical,digitalSignature,keyEncipherment",
|
||||
"-addext",
|
||||
"extendedKeyUsage=serverAuth",
|
||||
"-days",
|
||||
"1",
|
||||
])
|
||||
.output()
|
||||
.unwrap();
|
||||
assert!(
|
||||
result.status.success(),
|
||||
"openssl failed: {}",
|
||||
String::from_utf8_lossy(&result.stderr)
|
||||
);
|
||||
|
||||
let cert_pem = fs::read(&certificate).unwrap();
|
||||
let certs: Vec<CertificateDer<'static>> = CertificateDer::pem_slice_iter(&cert_pem)
|
||||
.collect::<Result<_, _>>()
|
||||
.unwrap();
|
||||
let key_pem = fs::read(&private_key).unwrap();
|
||||
let key = PrivateKeyDer::from_pem_slice(&key_pem).unwrap();
|
||||
let mut server_config = ServerConfig::with_single_cert(certs.clone(), key).unwrap();
|
||||
let mut server_transport = quinn::TransportConfig::default();
|
||||
server_transport.datagram_send_buffer_size(1024 * 1024);
|
||||
server_config.transport_config(Arc::new(server_transport));
|
||||
let server = Endpoint::server(server_config, "127.0.0.1:0".parse().unwrap()).unwrap();
|
||||
let server_address = server.local_addr().unwrap();
|
||||
|
||||
let mut roots = rustls::RootCertStore::empty();
|
||||
roots.add(certs[0].clone()).unwrap();
|
||||
let mut client_config = ClientConfig::with_root_certificates(Arc::new(roots)).unwrap();
|
||||
let mut client_transport = quinn::TransportConfig::default();
|
||||
client_transport.datagram_send_buffer_size(1024 * 1024);
|
||||
client_config.transport_config(Arc::new(client_transport));
|
||||
(directory, server, client_config, server_address)
|
||||
}
|
||||
|
||||
async fn connect_client(address: std::net::SocketAddr, config: ClientConfig) -> quinn::Connection {
|
||||
let mut endpoint = Endpoint::client("[::]:0".parse().unwrap()).unwrap();
|
||||
endpoint.set_default_client_config(config);
|
||||
endpoint
|
||||
.connect(address, "localhost")
|
||||
.unwrap()
|
||||
.await
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn connect_udp_authenticates_then_exchanges_contextual_http_datagrams() {
|
||||
let (_certificate_dir, server_endpoint, client_tls, address) = test_endpoints();
|
||||
let mut clients = HashMap::new();
|
||||
clients.insert(
|
||||
"laptop".to_owned(),
|
||||
base64::engine::general_purpose::STANDARD
|
||||
.decode(SECRET)
|
||||
.unwrap(),
|
||||
);
|
||||
let server_task = tokio::spawn(async move {
|
||||
let incoming = server_endpoint.accept().await.unwrap();
|
||||
let quic_connection = incoming.await.unwrap();
|
||||
Http3ServerConnection::new(quic_connection)
|
||||
.await
|
||||
.unwrap()
|
||||
.accept_connect_udp("/tunnel", &clients, 1200, Duration::from_secs(3))
|
||||
.await
|
||||
.unwrap()
|
||||
});
|
||||
|
||||
let quic_connection = connect_client(address, client_tls).await;
|
||||
let client = Http3ClientConnection::new(quic_connection).await.unwrap();
|
||||
let client_session = client
|
||||
.connect_udp(
|
||||
&format!("localhost:{}", address.port()),
|
||||
"/tunnel",
|
||||
"laptop",
|
||||
&base64::engine::general_purpose::STANDARD
|
||||
.decode(SECRET)
|
||||
.unwrap(),
|
||||
1200,
|
||||
Duration::from_secs(3),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
let server_session = timeout(Duration::from_secs(3), server_task)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
|
||||
assert_eq!(
|
||||
client_session.max_datagram_size(),
|
||||
server_session.max_datagram_size()
|
||||
);
|
||||
assert!(client_session.max_datagram_size() < 1200);
|
||||
client_session
|
||||
.send_datagram(b"opaque-upstream")
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
timeout(Duration::from_secs(2), server_session.recv_datagram())
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap(),
|
||||
Bytes::from_static(b"opaque-upstream")
|
||||
);
|
||||
server_session
|
||||
.send_datagram(b"opaque-downstream")
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(
|
||||
timeout(Duration::from_secs(2), client_session.recv_datagram())
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap(),
|
||||
Bytes::from_static(b"opaque-downstream")
|
||||
);
|
||||
let too_large = vec![0; client_session.max_datagram_size() + 1];
|
||||
assert!(matches!(
|
||||
client_session.send_datagram(&too_large).await,
|
||||
Err(Http3Error::Oversized { .. })
|
||||
));
|
||||
client_session.close(Duration::from_secs(2)).await.unwrap();
|
||||
assert!(matches!(
|
||||
client_session.send_datagram(b"after-close").await,
|
||||
Err(Http3Error::Closed)
|
||||
));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn connect_udp_rejects_bad_secret_before_returning_session() {
|
||||
let (_certificate_dir, server_endpoint, client_tls, address) = test_endpoints();
|
||||
let mut clients = HashMap::new();
|
||||
clients.insert(
|
||||
"laptop".to_owned(),
|
||||
base64::engine::general_purpose::STANDARD
|
||||
.decode(SECRET)
|
||||
.unwrap(),
|
||||
);
|
||||
let server_task = tokio::spawn(async move {
|
||||
let incoming = server_endpoint.accept().await.unwrap();
|
||||
let quic_connection = incoming.await.unwrap();
|
||||
Http3ServerConnection::new(quic_connection)
|
||||
.await
|
||||
.unwrap()
|
||||
.accept_connect_udp("/tunnel", &clients, 1200, Duration::from_secs(3))
|
||||
.await
|
||||
});
|
||||
|
||||
let quic_connection = connect_client(address, client_tls).await;
|
||||
let client = Http3ClientConnection::new(quic_connection).await.unwrap();
|
||||
let client_result = client
|
||||
.connect_udp(
|
||||
&format!("localhost:{}", address.port()),
|
||||
"/tunnel",
|
||||
"laptop",
|
||||
&base64::engine::general_purpose::STANDARD
|
||||
.decode(WRONG_SECRET)
|
||||
.unwrap(),
|
||||
1200,
|
||||
Duration::from_secs(3),
|
||||
)
|
||||
.await;
|
||||
assert!(
|
||||
matches!(client_result, Err(Http3Error::AuthenticationRejected)),
|
||||
"unexpected client error: {:?}",
|
||||
client_result.as_ref().err()
|
||||
);
|
||||
let server_result = timeout(Duration::from_secs(3), server_task)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(
|
||||
matches!(server_result, Err(Http3Error::AuthenticationRejected)),
|
||||
"unexpected server error: {:?}",
|
||||
server_result.as_ref().err()
|
||||
);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn http3_server_admission_permit_tracks_authenticated_session_lifetime() {
|
||||
let (_certificate_dir, endpoint, client_tls, address) = test_endpoints();
|
||||
let mut clients = HashMap::new();
|
||||
clients.insert(
|
||||
"laptop".to_owned(),
|
||||
base64::engine::general_purpose::STANDARD
|
||||
.decode(SECRET)
|
||||
.unwrap(),
|
||||
);
|
||||
let limits = config::LimitsConfig {
|
||||
max_sessions: 1,
|
||||
max_sessions_per_ip: 1,
|
||||
..config::LimitsConfig::default()
|
||||
};
|
||||
let admission = AdmissionController::new(&limits);
|
||||
let server = Arc::new(Http3Server::from_endpoint_with_admission(
|
||||
endpoint,
|
||||
"/tunnel",
|
||||
clients,
|
||||
1200,
|
||||
Duration::from_secs(3),
|
||||
admission.clone(),
|
||||
));
|
||||
let accept_server = server.clone();
|
||||
let server_task = tokio::spawn(async move { accept_server.accept_session().await.unwrap() });
|
||||
|
||||
let quic_connection = connect_client(address, client_tls).await;
|
||||
let client = Http3ClientConnection::new(quic_connection).await.unwrap();
|
||||
let client_session = client
|
||||
.connect_udp(
|
||||
&format!("localhost:{}", address.port()),
|
||||
"/tunnel",
|
||||
"laptop",
|
||||
&base64::engine::general_purpose::STANDARD
|
||||
.decode(SECRET)
|
||||
.unwrap(),
|
||||
1200,
|
||||
Duration::from_secs(3),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
let server_session = timeout(Duration::from_secs(3), server_task)
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
|
||||
assert_eq!(admission.active_sessions(), 1);
|
||||
assert_eq!(admission.pending_handshakes(), 0);
|
||||
server_session.close().await.unwrap();
|
||||
assert_eq!(admission.active_sessions(), 0);
|
||||
client_session.close(Duration::from_secs(2)).await.unwrap();
|
||||
}
|
||||
Reference in new issue
Block a user