drkey: prevent Level2/3 requests for generic protocol, id 0 (scionproto#4880)

This PR tackles scionproto#4329

Author: JordiSubira

control/drkey/grpc/drkey_service.go

@@ -285,6 +285,10 @@ func (d *Server) validateAllowedHost(protoId drkey.Protocol, peerAddr net.Addr)
 // requested dst host. The source AS infrastructure nodes are not supposed to contact
 // the local CS but to derive this key from the SV instead.
 func validateASHostReq(meta drkey.ASHostMeta, localIA addr.IA, peerAddr net.Addr) error {
+	if meta.ProtoId == drkey.Generic {
+		return serrors.New("invalid request, " +
+			"ASHost requests cannot be made for the generic protocol (ProtoID 0)")
+	}
 	hostAddr, err := hostAddrFromPeer(peerAddr)
 	if err != nil {
 		return err
@@ -306,6 +310,10 @@ func validateASHostReq(meta drkey.ASHostMeta, localIA addr.IA, peerAddr net.Addr
 // requested src host. The dst AS infrastructure nodes are not supposed to contact
 // the local CS but to derive this key from the SV instead.
 func validateHostASReq(meta drkey.HostASMeta, localIA addr.IA, peerAddr net.Addr) error {
+	if meta.ProtoId == drkey.Generic {
+		return serrors.New("invalid request, " +
+			"HostAS requests cannot be made for the generic protocol (ProtoID 0)")
+	}
 	hostAddr, err := hostAddrFromPeer(peerAddr)
 	if err != nil {
 		return err
@@ -326,6 +334,10 @@ func validateHostASReq(meta drkey.HostASMeta, localIA addr.IA, peerAddr net.Addr
 // validateHostHostReq returns and error if the requesting host is different from the
 // requested src host or the dst host.
 func validateHostHostReq(meta drkey.HostHostMeta, localIA addr.IA, peerAddr net.Addr) error {
+	if meta.ProtoId == drkey.Generic {
+		return serrors.New("invalid request, " +
+			"HostHost requests cannot be made for the generic protocol (ProtoID 0)")
+	}
 	hostAddr, err := hostAddrFromPeer(peerAddr)
 	if err != nil {
 		return err

control/drkey/grpc/drkey_service_test.go

@@ -148,12 +148,24 @@ func TestValidateASHost(t *testing.T) {
 			LocalIA:   ia112,
 			assertErr: assert.Error,
 		},
+		"invalid proto": {
+			peerAddr: net.TCPAddrFromAddrPort(tcpHost1),
+			req: drkey.ASHostMeta{
+				SrcIA:   ia111,
+				DstIA:   ia112,
+				DstHost: tcpHost1.Addr().String(),
+				ProtoId: drkey.Generic,
+			},
+			LocalIA:   ia112,
+			assertErr: assert.Error,
+		},
 		"valid host": {
 			peerAddr: net.TCPAddrFromAddrPort(tcpHost2),
 			req: drkey.ASHostMeta{
 				SrcIA:   ia111,
 				DstIA:   ia112,
 				DstHost: tcpHost2.Addr().String(),
+				ProtoId: drkey.SCMP,
 			},
 			LocalIA:   ia112,
 			assertErr: assert.NoError,
@@ -202,12 +214,24 @@ func TestValidateHostASReq(t *testing.T) {
 			LocalIA:   ia111,
 			assertErr: assert.Error,
 		},
+		"invalid proto": {
+			peerAddr: net.TCPAddrFromAddrPort(tcpHost1),
+			req: drkey.HostASMeta{
+				SrcIA:   ia111,
+				DstIA:   ia112,
+				SrcHost: tcpHost1.Addr().String(),
+				ProtoId: drkey.Generic,
+			},
+			LocalIA:   ia111,
+			assertErr: assert.Error,
+		},
 		"valid src": {
 			peerAddr: net.TCPAddrFromAddrPort(tcpHost1),
 			req: drkey.HostASMeta{
 				SrcIA:   ia111,
 				DstIA:   ia112,
 				SrcHost: tcpHost1.Addr().String(),
+				ProtoId: drkey.SCMP,
 			},
 			LocalIA:   ia111,
 			assertErr: assert.NoError,
@@ -258,13 +282,26 @@ func TestValidateHostHostReq(t *testing.T) {
 			LocalIA:   ia111,
 			assertErr: assert.Error,
 		},
+		"invalid proto": {
+			peerAddr: net.TCPAddrFromAddrPort(tcpHost1),
+			req: drkey.HostHostMeta{
+				SrcIA:   ia111,
+				DstIA:   ia112,
+				SrcHost: tcpHost1.Addr().String(),
+				DstHost: tcpHost2.Addr().String(),
+				ProtoId: drkey.Generic,
+			},
+			LocalIA:   ia111,
+			assertErr: assert.Error,
+		},
 		"valid src": {
 			peerAddr: net.TCPAddrFromAddrPort(tcpHost1),
 			req: drkey.HostHostMeta{
 				SrcIA:   ia111,
 				DstIA:   ia112,
 				SrcHost: tcpHost1.Addr().String(),
 				DstHost: tcpHost2.Addr().String(),
+				ProtoId: drkey.SCMP,
 			},
 			LocalIA:   ia111,
 			assertErr: assert.NoError,
@@ -276,6 +313,7 @@ func TestValidateHostHostReq(t *testing.T) {
 				DstIA:   ia112,
 				SrcHost: tcpHost1.Addr().String(),
 				DstHost: tcpHost2.Addr().String(),
+				ProtoId: drkey.SCMP,
 			},
 			LocalIA:   ia112,
 			assertErr: assert.NoError,