1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
|
//! Type and code for handling a "half-closed" stream.
//!
//! A half-closed stream is one that we've sent an END on, but where
//! we might still receive some cells.
use crate::Result;
use crate::stream::cmdcheck::{AnyCmdChecker, StreamStatus};
use crate::stream::flow_ctrl::state::{HalfStreamFlowCtrl, HalfStreamFlowCtrlHooks};
use tor_cell::relaycell::UnparsedRelayMsg;
/// Type to track state of half-closed streams.
///
/// A half-closed stream is one where we've sent an END cell, but where
/// the other side might still send us data.
///
/// We need to track these streams instead of forgetting about them entirely,
/// since otherwise we'd be vulnerable to a class of "DropMark" attacks;
/// see <https://gitlab.torproject.org/tpo/core/tor/-/issues/25573>.
#[derive(Debug)]
pub(crate) struct HalfStream {
/// Flow control for this stream.
///
/// Used to process incoming flow control messages (SENDME, XON, etc).
flow_control: HalfStreamFlowCtrl,
/// Object to tell us which cells to accept on this stream.
cmd_checker: AnyCmdChecker,
}
impl HalfStream {
/// Create a new half-closed stream.
pub(crate) fn new(flow_control: HalfStreamFlowCtrl, cmd_checker: AnyCmdChecker) -> Self {
HalfStream {
flow_control,
cmd_checker,
}
}
/// Process an incoming message and adjust this HalfStream accordingly.
/// Give an error if the protocol has been violated.
///
/// The caller must handle END cells; it is an internal error to pass
/// END cells to this method.
/// no ends here.
pub(crate) fn handle_msg(&mut self, msg: UnparsedRelayMsg) -> Result<StreamStatus> {
use StreamStatus::*;
let Some(msg) = self.flow_control.handle_incoming_msg(msg)? else {
// The flow control code consumed the message,
// which means that it was a flow control message.
// We don't give flow control messages to the checker below.
return Ok(Open);
};
let status = self.cmd_checker.check_msg(&msg)?;
self.cmd_checker.consume_checked_msg(msg)?;
Ok(status)
}
}
#[cfg(test)]
mod test {
// @@ begin test lint list maintained by maint/add_warning @@
#![allow(clippy::bool_assert_comparison)]
#![allow(clippy::clone_on_copy)]
#![allow(clippy::dbg_macro)]
#![allow(clippy::mixed_attributes_style)]
#![allow(clippy::print_stderr)]
#![allow(clippy::print_stdout)]
#![allow(clippy::single_char_pattern)]
#![allow(clippy::unwrap_used)]
#![allow(clippy::unchecked_time_subtraction)]
#![allow(clippy::useless_vec)]
#![allow(clippy::needless_pass_by_value)]
#![allow(clippy::string_slice)] // See arti#2571
//! <!-- @@ end test lint list maintained by maint/add_warning @@ -->
use super::*;
use crate::stream::RECV_WINDOW_INIT;
use crate::stream::flow_ctrl::state::StreamFlowCtrl;
use crate::{client::stream::OutboundDataCmdChecker, congestion::sendme::StreamSendWindow};
use rand::{CryptoRng, Rng};
use tor_basic_utils::test_rng::testing_rng;
use tor_cell::relaycell::{
AnyRelayMsgOuter, RelayCellFormat, StreamId,
msg::{self, AnyRelayMsg},
};
fn to_unparsed<R: Rng + CryptoRng>(rng: &mut R, val: AnyRelayMsg) -> UnparsedRelayMsg {
UnparsedRelayMsg::from_singleton_body(
RelayCellFormat::V0,
AnyRelayMsgOuter::new(StreamId::new(77), val)
.encode(RelayCellFormat::V0, rng)
.expect("encoding failed"),
)
.unwrap()
}
#[test]
fn halfstream_sendme() {
let mut rng = testing_rng();
// Stream level SENDMEs are not authenticated and so the only way to make sure we were not
// expecting one is if the window busts its maximum.
//
// Starting the window at 450, the first SENDME will increment it to 500 (the maximum)
// meaning that the second SENDME will bust that and we'll noticed that it was unexpected.
let sendw = StreamSendWindow::new(450);
let mut hs = HalfStream::new(
StreamFlowCtrl::new_window(sendw).half_stream(),
OutboundDataCmdChecker::new_any(),
);
// one sendme is fine
let m = msg::Sendme::new_empty();
assert!(
hs.handle_msg(to_unparsed(&mut rng, m.clone().into()))
.is_ok()
);
// but no more were expected!
let e = hs
.handle_msg(to_unparsed(&mut rng, m.into()))
.err()
.unwrap();
assert_eq!(
format!("{}", e),
"Circuit protocol violation: Unexpected stream SENDME"
);
}
fn hs_new() -> HalfStream {
HalfStream::new(
StreamFlowCtrl::new_window(StreamSendWindow::new(20)).half_stream(),
OutboundDataCmdChecker::new_any(),
)
}
#[test]
fn halfstream_data() {
let mut hs = hs_new();
let mut rng = testing_rng();
// we didn't give a connected cell during setup, so do it now.
hs.handle_msg(to_unparsed(&mut rng, msg::Connected::new_empty().into()))
.unwrap();
// `RECV_WINDOW_INIT` (500) data cells are okay.
let m = msg::Data::new(&b"this offer is unrepeatable"[..]).unwrap();
for _ in 0_u16..RECV_WINDOW_INIT {
assert!(
hs.handle_msg(to_unparsed(&mut rng, m.clone().into()))
.is_ok()
);
}
// But one more is a protocol violation.
let e = hs
.handle_msg(to_unparsed(&mut rng, m.into()))
.err()
.unwrap();
assert_eq!(
format!("{}", e),
"Circuit protocol violation: Received a data cell in violation of a window"
);
}
#[test]
fn halfstream_connected() {
let mut hs = hs_new();
let mut rng = testing_rng();
// We were told to accept a connected, so we'll accept one
// and no more.
let m = msg::Connected::new_empty();
assert!(
hs.handle_msg(to_unparsed(&mut rng, m.clone().into()))
.is_ok()
);
assert!(
hs.handle_msg(to_unparsed(&mut rng, m.clone().into()))
.is_err()
);
// If we try that again _after getting a connected_,
// accept any.
let mut cmd_checker = OutboundDataCmdChecker::new_any();
{
cmd_checker
.check_msg(&to_unparsed(&mut rng, msg::Connected::new_empty().into()))
.unwrap();
}
let mut hs = HalfStream::new(
StreamFlowCtrl::new_window(StreamSendWindow::new(20)).half_stream(),
cmd_checker,
);
let e = hs
.handle_msg(to_unparsed(&mut rng, m.into()))
.err()
.unwrap();
assert_eq!(
format!("{}", e),
"Stream protocol violation: Received CONNECTED twice on a stream."
);
}
#[test]
fn halfstream_other() {
let mut hs = hs_new();
let mut rng = testing_rng();
let m = msg::Extended2::new(Vec::new());
let e = hs
.handle_msg(to_unparsed(&mut rng, m.into()))
.err()
.unwrap();
assert_eq!(
format!("{}", e),
"Stream protocol violation: Unexpected EXTENDED2 on a data stream!"
);
}
}
|
