Skip to content

Commit d48ff8d

Browse files
utkarshg6utkarshg6
authored
GH-716: Our StreamKeys are insecure (#336)
* GH-716: add UUID * Revert "GH-716: add UUID" This reverts commit f0a6040. * GH-716: use the version of uuid that's been used for actix * GH-716: add dbnavigator to gitignore * GH-716: use UUIDs to make stream keys * GH-716: remove parameters from the constructor of StreamKey * GH-716: remove warnings * GH-716: tests in stream_key.rs are passing * GH-716: fix test handles_http_with_a_port * GH-716: fix some more tests * GH-716: make hash public for StreamKey for make_meaningless_stream_key() * GH-716: small test fixes * GH-716: fix test inbound_server_data_is_translated_to_cores_packages * GH-716: make the test inbound_server_data_is_translated_to_cores_packages not pass easily * GH-716: introduce fn make_meaningful_stream_key * GH-716: improve test inbound_server_data_is_translated_to_cores_packages * GH-716: remove todo * GH-716: improve tests inside stream_key.rs * GH-716: remove clippy warnings * GH-716: use default() instead of new() in tests * GH-716: fix test proxy_server_receives_tls_packet_other_than_handshake_from_dispatcher_then_sends_cores_package_to_hopper * GH-716: trigger actions * GH-716: an attempt to fix multinode tests * GH-716: review changes * GH-716: make the field name of StreamKey named 'hash' private * GH-716: improve tests in file client_request_payload_factory.rs * GH-716: share the helper functions in other crates
1 parent b2d0b07 commit d48ff8d

File tree

17 files changed

+244
-301
lines changed

17 files changed

+244
-301
lines changed

‎multinode_integration_tests/tests/connection_termination_test.rs‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ use node_lib::sub_lib::route::{Route, RouteSegment};
2727
use node_lib::sub_lib::sequence_buffer::SequencedPacket;
2828
use node_lib::sub_lib::stream_key::StreamKey;
2929
use node_lib::sub_lib::versioned_data::VersionedData;
30-
use node_lib::test_utils::make_meaningless_stream_key;
3130
use node_lib::test_utils::neighborhood_test_utils::{db_from_node, make_node_record};
3231
use std::io;
3332
use std::net::SocketAddr;
@@ -298,7 +297,10 @@ fn context_from_request_lcp(
298297
}
299298

300299
fn arbitrary_context() -> (StreamKey, u32) {
301-
(make_meaningless_stream_key(), 12345678)
300+
(
301+
StreamKey::make_meaningful_stream_key("arbitrary_context"),
302+
12345678,
303+
)
302304
}
303305

304306
fn create_request_icp(
@@ -353,7 +355,8 @@ fn create_meaningless_icp(
353355
exit_node: &MASQRealNode,
354356
) -> IncipientCoresPackage {
355357
let socket_addr = SocketAddr::from_str("3.2.1.0:7654").unwrap();
356-
let stream_key = StreamKey::new(PublicKey::new(&[9, 8, 7, 6]), socket_addr);
358+
let stream_key =
359+
StreamKey::make_meaningful_stream_key("Chancellor on brink of second bailout for banks");
357360
IncipientCoresPackage::new(
358361
originating_node.main_cryptde_null().unwrap(),
359362
Route::round_trip(

‎node/Cargo.lock‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎node/Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ variant_count = "1.1.0"
6464
web3 = {version = "0.11.0", default-features = false, features = ["http", "tls"]}
6565
websocket = {version = "0.26.2", default-features = false, features = ["async", "sync"]}
6666
secp256k1secrets = {package = "secp256k1", version = "0.17.2"}
67+
uuid = "0.7.4"
6768

6869
[target.'cfg(target_os = "macos")'.dependencies]
6970
system-configuration = "0.4.0"

‎node/src/hopper/routing_service.rs‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -521,9 +521,9 @@ mod tests {
521521
use crate::test_utils::recorder::{make_recorder, peer_actors_builder};
522522
use crate::test_utils::{
523523
alias_cryptde, main_cryptde, make_cryptde_pair, make_meaningless_message_type,
524-
make_meaningless_stream_key, make_paying_wallet, make_request_payload,
525-
make_response_payload, rate_pack_routing, rate_pack_routing_byte, route_from_proxy_client,
526-
route_to_proxy_client, route_to_proxy_server,
524+
make_paying_wallet, make_request_payload, make_response_payload, rate_pack_routing,
525+
rate_pack_routing_byte, route_from_proxy_client, route_to_proxy_client,
526+
route_to_proxy_server,
527527
};
528528
use actix::System;
529529
use masq_lib::test_utils::environment_guard::EnvironmentGuard;
@@ -537,7 +537,7 @@ mod tests {
537537
fn dns_resolution_failures_are_reported_to_the_proxy_server() {
538538
let cryptdes = make_cryptde_pair();
539539
let route = route_to_proxy_server(&cryptdes.main.public_key(), cryptdes.main);
540-
let stream_key = make_meaningless_stream_key();
540+
let stream_key = StreamKey::make_meaningless_stream_key();
541541
let dns_resolve_failure = DnsResolveFailure_0v1::new(stream_key);
542542
let lcp = LiveCoresPackage::new(
543543
route,
@@ -873,7 +873,7 @@ mod tests {
873873
let alias_cryptde = alias_cryptde();
874874
let (proxy_server, _, proxy_server_recording_arc) = make_recorder();
875875
let route = route_to_proxy_server(&main_cryptde.public_key(), main_cryptde);
876-
let payload = make_response_payload(0, alias_cryptde);
876+
let payload = make_response_payload(0);
877877
let lcp = LiveCoresPackage::new(
878878
route,
879879
encodex::<MessageType>(
@@ -1903,10 +1903,7 @@ mod tests {
19031903
&MessageType::ClientRequest(VersionedData::new(
19041904
&crate::sub_lib::migrations::client_request_payload::MIGRATIONS,
19051905
&ClientRequestPayload_0v1 {
1906-
stream_key: StreamKey::new(
1907-
PublicKey::new(b"1234"),
1908-
SocketAddr::from_str("1.2.3.4:1234").unwrap(),
1909-
),
1906+
stream_key: StreamKey::make_meaningless_stream_key(),
19101907
sequenced_packet: SequencedPacket::new(vec![1, 2, 3, 4], 1234, false),
19111908
target_hostname: Some("hostname".to_string()),
19121909
target_port: 1234,
@@ -1932,10 +1929,7 @@ mod tests {
19321929
&MessageType::DnsResolveFailed(VersionedData::new(
19331930
&crate::sub_lib::migrations::dns_resolve_failure::MIGRATIONS,
19341931
&DnsResolveFailure_0v1 {
1935-
stream_key: StreamKey::new(
1936-
PublicKey::new(b"1234"),
1937-
SocketAddr::from_str("1.2.3.4:1234").unwrap(),
1938-
),
1932+
stream_key: StreamKey::make_meaningless_stream_key(),
19391933
},
19401934
)),
19411935
)
@@ -1975,10 +1969,7 @@ mod tests {
19751969
&MessageType::ClientResponse(VersionedData::new(
19761970
&crate::sub_lib::migrations::client_request_payload::MIGRATIONS,
19771971
&ClientResponsePayload_0v1 {
1978-
stream_key: StreamKey::new(
1979-
PublicKey::new(b"1234"),
1980-
SocketAddr::from_str("1.2.3.4:1234").unwrap(),
1981-
),
1972+
stream_key: StreamKey::make_meaningless_stream_key(),
19821973
sequenced_packet: SequencedPacket::new(vec![1, 2, 3, 4], 1234, false),
19831974
},
19841975
)),

‎node/src/proxy_client/mod.rs‎

Lines changed: 18 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -601,7 +601,7 @@ mod tests {
601601
#[should_panic(expected = "StreamHandlerPool unbound")]
602602
fn panics_if_unbound() {
603603
let request = ClientRequestPayload_0v1 {
604-
stream_key: make_meaningless_stream_key(),
604+
stream_key: StreamKey::make_meaningless_stream_key(),
605605
sequenced_packet: SequencedPacket {
606606
data: b"HEAD http://www.nyan.cat/ HTTP/1.1\r\n\r\n".to_vec(),
607607
sequence_number: 0,
@@ -641,7 +641,7 @@ mod tests {
641641
fn logs_nonexistent_stream_key_during_dns_resolution_failure() {
642642
init_test_logging();
643643
let cryptde = main_cryptde();
644-
let stream_key = make_meaningless_stream_key();
644+
let stream_key = StreamKey::make_meaningless_stream_key();
645645
let stream_key_inner = stream_key.clone();
646646
thread::spawn(move || {
647647
let system = System::new("logs_nonexistent_stream_key_during_dns_resolution_failure");
@@ -677,7 +677,7 @@ mod tests {
677677
init_test_logging();
678678
let cryptde = main_cryptde();
679679
let (hopper, hopper_awaiter, hopper_recording_arc) = make_recorder();
680-
let stream_key = make_meaningless_stream_key();
680+
let stream_key = StreamKey::make_meaningless_stream_key();
681681
let return_route = make_meaningless_route();
682682
let originator_key = make_meaningless_public_key();
683683
let stream_key_inner = stream_key.clone();
@@ -744,7 +744,7 @@ mod tests {
744744
fn data_from_hopper_is_relayed_to_stream_handler_pool() {
745745
let cryptde = main_cryptde();
746746
let request = ClientRequestPayload_0v1 {
747-
stream_key: make_meaningless_stream_key(),
747+
stream_key: StreamKey::make_meaningless_stream_key(),
748748
sequenced_packet: SequencedPacket {
749749
data: b"inbound data".to_vec(),
750750
sequence_number: 0,
@@ -804,7 +804,7 @@ mod tests {
804804
init_test_logging();
805805
let cryptde = main_cryptde();
806806
let request = ClientRequestPayload_0v1 {
807-
stream_key: make_meaningless_stream_key(),
807+
stream_key: StreamKey::make_meaningless_stream_key(),
808808
sequenced_packet: SequencedPacket {
809809
data: b"inbound data".to_vec(),
810810
sequence_number: 0,
@@ -861,7 +861,7 @@ mod tests {
861861
let main_cryptde = main_cryptde();
862862
let alias_cryptde = alias_cryptde();
863863
let request = ClientRequestPayload_0v1 {
864-
stream_key: make_meaningless_stream_key(),
864+
stream_key: StreamKey::make_meaningless_stream_key(),
865865
sequenced_packet: SequencedPacket {
866866
data: b"inbound data".to_vec(),
867867
sequence_number: 0,
@@ -926,11 +926,12 @@ mod tests {
926926
#[test]
927927
fn inbound_server_data_is_translated_to_cores_packages() {
928928
init_test_logging();
929+
let test_name = "inbound_server_data_is_translated_to_cores_packages";
929930
let (hopper, _, hopper_recording_arc) = make_recorder();
930931
let (accountant, _, accountant_recording_arc) = make_recorder();
931-
let stream_key = make_meaningless_stream_key();
932+
let stream_key = StreamKey::make_meaningful_stream_key(test_name);
932933
let data: &[u8] = b"An honest politician is one who, when he is bought, will stay bought.";
933-
let system = System::new("inbound_server_data_is_translated_to_cores_packages");
934+
let system = System::new(test_name);
934935
let route = make_meaningless_route();
935936
let mut subject = ProxyClient::new(ProxyClientConfig {
936937
cryptde: main_cryptde(),
@@ -948,6 +949,7 @@ mod tests {
948949
paying_wallet: Some(make_wallet("paying")),
949950
},
950951
);
952+
subject.logger = Logger::new(test_name);
951953
let subject_addr: Addr<ProxyClient> = subject.start();
952954
let peer_actors = peer_actors_builder()
953955
.hopper(hopper)
@@ -1068,17 +1070,18 @@ mod tests {
10681070
);
10691071
assert_eq!(accountant_recording.len(), 2);
10701072
let tlh = TestLogHandler::new();
1071-
tlh.exists_log_containing(format!("ERROR: ProxyClient: Received InboundServerData from 1.2.3.4:5678: stream +dKB2Lsh3ET2TS/J/cexaanFQz4, sequence 1236, length {}; but no such known stream - ignoring", data.len()).as_str());
1072-
tlh.exists_log_containing(format!("ERROR: ProxyClient: Received InboundServerData (last_data) from 1.2.3.4:5678: stream +dKB2Lsh3ET2TS/J/cexaanFQz4, sequence 1237, length {}; but no such known stream - ignoring", data.len()).as_str());
1073+
tlh.exists_log_containing(format!("ERROR: {test_name}: Received InboundServerData from 1.2.3.4:5678: stream MBqy2yoLFeyqzyArXNTwzbNG16c, sequence 1236, length {}; but no such known stream - ignoring", data.len()).as_str());
1074+
tlh.exists_log_containing(format!("ERROR: {test_name}: Received InboundServerData (last_data) from 1.2.3.4:5678: stream MBqy2yoLFeyqzyArXNTwzbNG16c, sequence 1237, length {}; but no such known stream - ignoring", data.len()).as_str());
10731075
}
10741076

10751077
#[test]
10761078
fn inbound_server_data_without_paying_wallet_does_not_report_exit_service() {
10771079
init_test_logging();
10781080
let (accountant, _, accountant_recording_arc) = make_recorder();
1079-
let stream_key = make_meaningless_stream_key();
1081+
let stream_key = StreamKey::make_meaningless_stream_key();
10801082
let data: &[u8] = b"An honest politician is one who, when he is bought, will stay bought.";
1081-
let system = System::new("inbound_server_data_is_translated_to_cores_packages");
1083+
let system =
1084+
System::new("inbound_server_data_without_paying_wallet_does_not_report_exit_service");
10821085
let mut subject = ProxyClient::new(ProxyClientConfig {
10831086
cryptde: main_cryptde(),
10841087
dns_servers: vec![SocketAddr::from_str("8.7.6.5:4321").unwrap()],
@@ -1128,9 +1131,9 @@ mod tests {
11281131
init_test_logging();
11291132
let (hopper, _, hopper_recording_arc) = make_recorder();
11301133
let (accountant, _, accountant_recording_arc) = make_recorder();
1131-
let stream_key = make_meaningless_stream_key();
1134+
let stream_key = StreamKey::make_meaningless_stream_key();
11321135
let data: &[u8] = b"An honest politician is one who, when he is bought, will stay bought.";
1133-
let system = System::new("inbound_server_data_is_translated_to_cores_packages");
1136+
let system = System::new("error_creating_incipient_cores_package_is_logged_and_dropped");
11341137
let mut subject = ProxyClient::new(ProxyClientConfig {
11351138
cryptde: main_cryptde(),
11361139
dns_servers: vec![SocketAddr::from_str("8.7.6.5:4321").unwrap()],
@@ -1178,7 +1181,7 @@ mod tests {
11781181
let cryptde = main_cryptde();
11791182
let (hopper, _, hopper_recording_arc) = make_recorder();
11801183
let (accountant, _, accountant_recording_arc) = make_recorder();
1181-
let stream_key = make_meaningless_stream_key();
1184+
let stream_key = StreamKey::make_meaningless_stream_key();
11821185
let data: &[u8] = b"An honest politician is one who, when he is bought, will stay bought.";
11831186
let system = System::new("new_return_route_overwrites_existing_return_route");
11841187
let mut subject = ProxyClient::new(ProxyClientConfig {

‎node/src/proxy_client/stream_establisher.rs‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,6 @@ mod tests {
128128
use super::*;
129129
use crate::sub_lib::proxy_server::ProxyProtocol;
130130
use crate::test_utils::main_cryptde;
131-
use crate::test_utils::make_meaningless_stream_key;
132131
use crate::test_utils::recorder::make_recorder;
133132
use crate::test_utils::recorder::peer_actors_builder;
134133
use crate::test_utils::stream_connector_mock::StreamConnectorMock;
@@ -179,7 +178,7 @@ mod tests {
179178
};
180179
subject.spawn_stream_reader(
181180
&ClientRequestPayload_0v1 {
182-
stream_key: make_meaningless_stream_key(),
181+
stream_key: StreamKey::make_meaningless_stream_key(),
183182
sequenced_packet: SequencedPacket {
184183
data: vec![],
185184
sequence_number: 0,
@@ -212,7 +211,7 @@ mod tests {
212211
assert_eq!(
213212
ibsd,
214213
InboundServerData {
215-
stream_key: make_meaningless_stream_key(),
214+
stream_key: StreamKey::make_meaningless_stream_key(),
216215
last_data: false,
217216
sequence_number: 0,
218217
source: SocketAddr::from_str("1.2.3.4:5678").unwrap(),

0 commit comments

Comments
 (0)