bastion 0.63.1

client-go/hostdoor_slots_linux_test.go

@@ -0,0 +1,402 @@
+//go:build linux
+
+package main
+
+// The door's handshake slots under a flood: the global and per-source caps,
+// the share kept for addresses a Host proved itself from, and the random
+// early drop for strangers (hostdoor.go, admitHandshake).
+
+import (
+	"crypto/tls"
+	"fmt"
+	"io"
+	"math"
+	"net"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// freshDoorMemory forgets every Host address, before and after the test.
+func freshDoorMemory(t *testing.T) {
+	t.Helper()
+	reset := func() {
+		doorKnown.Lock()
+		doorKnown.until = nil
+		doorKnown.Unlock()
+	}
+	reset()
+	t.Cleanup(reset)
+}
+
+// neverDrops is a draw the early drop never refuses on (it refuses when the
+// draw is below the drop chance, which is under 1 short of the limit).
+func neverDrops() float64 { return math.Nextafter(1, 0) }
+
+// alwaysDrops is a draw the early drop refuses on wherever it applies.
+func alwaysDrops() float64 { return 0 }
+
+func strangersShare() int { return doorMaxHandshakes - doorReservedHandshakes }
+
+// The global and per-source caps hold for everyone, a known Host's address
+// included, and strangers never take the reserved share, however lucky.
+func TestTheHandshakeCapsStillHold(t *testing.T) {
+	freshDoorMemory(t)
+	now := time.Now()
+	d := newHostDoor(":0", true)
+	d.draw = neverDrops
+	// Strangers: admitted up to their share, from enough addresses, and not
+	// one more.
+	for i := 0; i < strangersShare(); i++ {
+		if !d.admitHandshake(fmt.Sprintf("203.0.113.%d", i/doorMaxHandshakesPerSource)) {
+			t.Fatalf("stranger handshake %d refused below the strangers' share", i)
+		}
+	}
+	if d.admitHandshake("198.51.100.200") {
+		t.Fatalf("a stranger took a slot of the reserve (%d in progress)", d.inflight)
+	}
+	// Known addresses: the rest, 8 from each, and then nothing for anyone.
+	for i := 0; d.inflight < doorMaxHandshakes; i++ {
+		src := fmt.Sprintf("198.51.100.%d", i)
+		doorRememberHost(src, now)
+		for j := 0; j < doorMaxHandshakesPerSource; j++ {
+			if !d.admitHandshake(src) {
+				t.Fatalf("handshake %d of known %s refused with %d in progress", j, src, d.inflight)
+			}
+		}
+		if d.inflight < doorMaxHandshakes && d.admitHandshake(src) {
+			t.Fatalf("known %s got a ninth handshake", src)
+		}
+	}
+	doorRememberHost("192.0.2.1", now)
+	if d.inflight != doorMaxHandshakes || d.admitHandshake("192.0.2.1") {
+		t.Fatalf("a handshake past the global cap of %d (%d in progress)", doorMaxHandshakes, d.inflight)
+	}
+	// A known address is held to 8 at once on an empty door too.
+	e := newHostDoor(":0", true)
+	for j := 0; j < doorMaxHandshakesPerSource; j++ {
+		if !e.admitHandshake("192.0.2.1") {
+			t.Fatal("a known address was refused on an empty door")
+		}
+	}
+	if e.admitHandshake("192.0.2.1") {
+		t.Fatal("a known address got a ninth handshake at once")
+	}
+}
+
+// Strangers are dropped early as the door fills: never below the start,
+// with the chance rising from the rate to certain at the strangers' share.
+// A known Host's address is never early-dropped.
+func TestStrangersAreDroppedEarlyAsTheDoorFills(t *testing.T) {
+	freshDoorMemory(t)
+	d := newHostDoor(":0", true)
+	full := strangersShare()
+	for _, c := range []struct {
+		n      int
+		draw   float64
+		admits bool
+	}{
+		{0, 0, true},
+		{doorEarlyDropStart - 1, 0, true},
+		{doorEarlyDropStart, doorEarlyDropRate - 0.01, false},
+		{doorEarlyDropStart, doorEarlyDropRate + 0.01, true},
+		{(doorEarlyDropStart + full) / 2, (1+doorEarlyDropRate)/2 - 0.01, false},
+		{(doorEarlyDropStart + full) / 2, (1+doorEarlyDropRate)/2 + 0.01, true},
+		{full - 1, 0.99, false},
+		{full - 1, neverDrops(), true},
+		{full, neverDrops(), false},
+	} {
+		draw := c.draw
+		d.draw = func() float64 { return draw }
+		if got := d.admitStranger(c.n); got != c.admits {
+			t.Fatalf("with %d in progress and a draw of %v: admitted %v, want %v", c.n, c.draw, got, c.admits)
+		}
+	}
+	// Through admitHandshake: an unlucky stranger is refused at the start,
+	// a known address with the same draw is not, up to the global cap.
+	d = newHostDoor(":0", true)
+	d.draw = alwaysDrops
+	for i := 0; i < doorEarlyDropStart; i++ {
+		if !d.admitHandshake(fmt.Sprintf("203.0.113.%d", i)) {
+			t.Fatalf("stranger %d refused below the start", i)
+		}
+	}
+	if d.admitHandshake("203.0.113.250") {
+		t.Fatal("an unlucky stranger was admitted past the start")
+	}
+	doorRememberHost("198.51.100.7", time.Now())
+	d.inflight = doorMaxHandshakes - 1
+	if !d.admitHandshake("198.51.100.7") {
+		t.Fatal("a known Host's address was early-dropped")
+	}
+}
+
+// An address is remembered for doorKnownHostFor after its last verified
+// handshake, in a bounded memory that forgets the oldest first.
+func TestAHostAddressIsRememberedForAWhileAndBounded(t *testing.T) {
+	freshDoorMemory(t)
+	now := time.Now()
+	doorRememberHost("198.51.100.7", now)
+	if !doorKnownHost("198.51.100.7", now.Add(doorKnownHostFor-time.Second)) {
+		t.Fatal("forgotten before its time")
+	}
+	if doorKnownHost("198.51.100.7", now.Add(doorKnownHostFor)) {
+		t.Fatal("remembered past its time")
+	}
+	if doorKnownHost("198.51.100.8", now) {
+		t.Fatal("an address no Host proved itself from is known")
+	}
+	// A fresh handshake renews it.
+	doorRememberHost("198.51.100.7", now)
+	doorRememberHost("198.51.100.7", now.Add(doorKnownHostFor-time.Second))
+	if !doorKnownHost("198.51.100.7", now.Add(doorKnownHostFor+time.Hour)) {
+		t.Fatal("a renewed address was forgotten")
+	}
+	// Bounded: the oldest goes first, the newest stays.
+	for i := 0; i < 2*doorKnownHostsMax; i++ {
+		doorRememberHost(fmt.Sprintf("2001:db8:%x::/64", i), now.Add(time.Duration(i)*time.Second))
+	}
+	doorKnown.Lock()
+	n := len(doorKnown.until)
+	doorKnown.Unlock()
+	if n > doorKnownHostsMax {
+		t.Fatalf("the memory holds %d addresses, at most %d", n, doorKnownHostsMax)
+	}
+	last := now.Add(time.Duration(2*doorKnownHostsMax) * time.Second)
+	if !doorKnownHost(fmt.Sprintf("2001:db8:%x::/64", 2*doorKnownHostsMax-1), last) {
+		t.Fatal("the newest address was forgotten")
+	}
+	if doorKnownHost("2001:db8:0::/64", last) {
+		t.Fatal("the oldest address outlived a full memory")
+	}
+}
+
+// pipeDoor is a door served over in-memory connections from any address the
+// test names, with one pairing for ca's Host.
+type pipeDoor struct {
+	d       *hostDoor
+	p       *doorPairing
+	ca      *testCA
+	conns   chan net.Conn
+	quit    chan struct{}
+	accepts atomic.Int64
+	pushed  int64
+	mu      sync.Mutex
+	ends    []net.Conn
+}
+
+func (l *pipeDoor) Accept() (net.Conn, error) {
+	l.accepts.Add(1)
+	select {
+	case c := <-l.conns:
+		return c, nil
+	case <-l.quit:
+		return nil, net.ErrClosed
+	}
+}
+func (l *pipeDoor) Close() error   { return nil }
+func (l *pipeDoor) Addr() net.Addr { return &net.TCPAddr{Port: 8812} }
+
+type fromConn struct {
+	net.Conn
+	from net.Addr
+}
+
+func (c fromConn) RemoteAddr() net.Addr { return c.from }
+
+func newPipeDoor(t *testing.T) *pipeDoor {
+	t.Helper()
+	ca := newTestCA(t, "home host CA")
+	cfg := hostDialsPairingFor(t, ca, "home.cseries.localhost", ":8812")
+	p, err := newDoorPairing(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	l := &pipeDoor{d: newHostDoor(":8812", true), p: p, ca: ca, conns: make(chan net.Conn), quit: make(chan struct{})}
+	l.d.pairings[cfg.HostName] = p
+	go l.d.serve(l)
+	t.Cleanup(func() {
+		close(l.quit)
+		l.mu.Lock()
+		for _, c := range l.ends {
+			_ = c.Close()
+		}
+		l.mu.Unlock()
+		p.drain()
+		doorWaitFor(t, 15*time.Second, "every handshake to end", func() bool { return l.inflight() == 0 })
+	})
+	return l
+}
+
+// connect hands the door a connection from ip and waits until the door has
+// admitted or closed it. It returns the far end.
+func (l *pipeDoor) connect(t *testing.T, ip string) net.Conn {
+	t.Helper()
+	near, far := net.Pipe()
+	l.mu.Lock()
+	l.ends = append(l.ends, far)
+	l.mu.Unlock()
+	l.conns <- fromConn{Conn: near, from: &net.TCPAddr{IP: net.ParseIP(ip), Port: 40000}}
+	l.pushed++
+	for l.accepts.Load() <= l.pushed {
+		time.Sleep(50 * time.Microsecond)
+	}
+	return far
+}
+
+// stranger connects from ip and never answers the handshake: a slot held
+// until the handshake's time runs out.
+func (l *pipeDoor) stranger(t *testing.T, ip string) {
+	far := l.connect(t, ip)
+	go func() { _, _ = io.Copy(io.Discard, far) }()
+}
+
+// host connects from ip as the pairing's Host and returns how long its
+// handshake took, or the error that ended it.
+func (l *pipeDoor) host(t *testing.T, ip string, within time.Duration) (time.Duration, error) {
+	t.Helper()
+	start := time.Now()
+	far := l.connect(t, ip)
+	s := tls.Server(far, &tls.Config{Certificates: []tls.Certificate{l.ca.serverCert(t, tcpServerName)},
+		NextProtos: []string{laneALPN}, MinVersion: tls.VersionTLS13, ClientAuth: tls.RequireAnyClientCert})
+	_ = s.SetDeadline(start.Add(within))
+	err := s.Handshake()
+	_ = s.SetDeadline(time.Time{})
+	return time.Since(start), err
+}
+
+func (l *pipeDoor) inflight() int {
+	l.d.mu.Lock()
+	defer l.d.mu.Unlock()
+	return l.d.inflight
+}
+
+// hostReconnectBound is how long the person's own Host may take to get a
+// connection through a flooded door: its first try is admitted, so this is
+// one handshake over an in-memory connection, with room for -race and a
+// loaded machine. A refused try instead costs the Host's backoff (1 s, then
+// doubling to 30 s, docs/host-connects.md).
+const hostReconnectBound = 2 * time.Second
+
+// SECURITY: 64 addresses flooding the door hold every slot strangers may
+// take, and the person's own Host, connecting from the address it proved
+// itself from, gets in at its first try, every time, within
+// hostReconnectBound. The same Host from an address it never proved itself
+// from waits like any stranger; what the reserve keeps is the address.
+func TestTheOwnHostGetsInWhileStrangersFloodTheDoor(t *testing.T) {
+	pairingBox(t)
+	freshDoorMemory(t)
+	l := newPipeDoor(t)
+	const home = "198.51.100.7"
+	// Before the flood: a Host that connected once is known by its address.
+	if _, err := l.host(t, home, hostReconnectBound); err != nil {
+		t.Fatalf("the Host's first connection: %v", err)
+	}
+	doorWaitFor(t, 5*time.Second, "the connection in the pool", func() bool { return l.p.live.Load() == 1 })
+	if !doorKnownHost(home, time.Now()) {
+		t.Fatal("a Host's verified connection did not make its address known")
+	}
+	// The flood: 64 addresses, round and round, until every slot strangers
+	// may hold is held, with the real random early drop.
+	attempts := 0
+	for l.inflight() < strangersShare() {
+		if attempts++; attempts > 50000 {
+			t.Fatalf("the flood holds %d slots after %d connections", l.inflight(), attempts)
+		}
+		l.stranger(t, fmt.Sprintf("203.0.113.%d", attempts%64))
+	}
+	// Full for strangers: from any address, new or flooding, none gets in.
+	for i := 0; i < 64; i++ {
+		l.stranger(t, fmt.Sprintf("192.0.2.%d", i))
+	}
+	if n := l.inflight(); n != strangersShare() {
+		t.Fatalf("strangers hold %d slots, at most %d", n, strangersShare())
+	}
+	// The Host reconnects: each of its spare connections at the first try.
+	for i := 0; i < hostSpareConns; i++ {
+		took, err := l.host(t, home, hostReconnectBound)
+		if err != nil {
+			t.Fatalf("the Host's connection %d during the flood (after %d flood connections): %v", i, attempts, err)
+		}
+		if took > hostReconnectBound {
+			t.Fatalf("the Host's connection %d took %s, bound %s", i, took, hostReconnectBound)
+		}
+		t.Logf("the Host's connection %d through the flood (%d flood connections): %s", i, attempts, took)
+	}
+	doorWaitFor(t, 5*time.Second, "the Host's connections in the pool", func() bool {
+		return l.p.live.Load() == 1+hostSpareConns
+	})
+	// The same Host from an address it never proved itself from: refused.
+	if _, err := l.host(t, "198.51.100.99", hostReconnectBound); err == nil {
+		t.Fatal("an unknown address got past a door full for strangers")
+	}
+}
+
+// A Host never seen before pairs through the window when nobody floods the
+// door, even with a draw the early drop would refuse on, and its address is
+// known from then on, so its lane connections count as its own.
+func TestANewHostPairsWhenNobodyFloods(t *testing.T) {
+	pairingBox(t)
+	freshDoorMemory(t)
+	prev := doorDraw
+	doorDraw = alwaysDrops
+	t.Cleanup(func() { doorDraw = prev })
+	addr := freeDoorAddr(t)
+	code, out, res := openWindowFor(t, addr)
+	ca := newTestCA(t, "home host CA")
+	h := newStandinHost(t, ca, "home", "home.cseries.localhost", addr)
+	done, err := h.pair(formatWindowCode(code))
+	if err != nil {
+		t.Fatalf("%v\n%s", err, pairingAuditText(t))
+	}
+	if done.State != pairingActive {
+		t.Fatalf("done: %+v", done)
+	}
+	select {
+	case err := <-res:
+		if err != nil {
+			t.Fatalf("pair --open: %v\n%s", err, out.String())
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("pair --open never saw the pairing end its window")
+	}
+	host, _, _ := net.SplitHostPort(addr)
+	if !doorKnownHost(sourceKey(host), time.Now()) {
+		t.Fatal("a Host that paired through the window is not known by its address")
+	}
+}
+
+// SECURITY: only a verified handshake for a pairing the door still serves
+// makes an address known: a certificate under another CA does not, nor the
+// Host's own certificate once the door has stopped serving its pairing.
+func TestOnlyAServedHostsVerifiedHandshakeMakesItsAddressKnown(t *testing.T) {
+	pairingBox(t)
+	freshDoorMemory(t)
+	l := newPipeDoor(t)
+	// handshake connects from ip with cert and waits for the door's verdict,
+	// the connection closing, so whatever the door does for it is done.
+	handshake := func(ip string, cert tls.Certificate) {
+		far := l.connect(t, ip)
+		s := tls.Server(far, &tls.Config{Certificates: []tls.Certificate{cert}, NextProtos: []string{laneALPN},
+			MinVersion: tls.VersionTLS13, ClientAuth: tls.RequireAnyClientCert})
+		_ = s.SetDeadline(time.Now().Add(5 * time.Second))
+		if err := s.Handshake(); err == nil {
+			_, _ = s.Read(make([]byte, 1))
+		}
+		_ = s.Close()
+	}
+	const impostorIP, stoppedIP = "198.51.100.60", "198.51.100.61"
+	impostor := newTestCA(t, "impostor")
+	handshake(impostorIP, impostor.serverCert(t, tcpServerName))
+	if doorKnownHost(impostorIP, time.Now()) {
+		t.Fatal("a certificate under another CA made its address known")
+	}
+	l.d.mu.Lock()
+	l.d.closed = true
+	l.d.mu.Unlock()
+	handshake(stoppedIP, l.ca.serverCert(t, tcpServerName))
+	if doorKnownHost(stoppedIP, time.Now()) {
+		t.Fatal("a handshake for a pairing the door no longer serves made its address known")
+	}
+}