chore(quic): audit cleanup — drop redundant copy, rename queue, extract test fixture
Three small follow-ups from the audit pass: 1. Drop redundant `challengeData.copyOf()` in `queuePathResponseLocked` — the parser produces a fresh ByteArray per PATH_CHALLENGE via `QuicReader.readBytes`'s `copyOfRange`, so the defensive copy was a wasted allocation. One-line fix. 2. Rename `pendingPathResponses` → `pendingPathChallengePayloads`. The queue holds inbound CHALLENGE payloads we owe RESPONSES for — old name conflated the two. Pure rename across QuicConnection / Parser / Writer / PathValidationTest. 3. Extract shared `newConnectedClient(...)` test fixture (`ConnectedClientFixture.kt`). The 6 test files each repeated ~40 lines of identical handshake-pipe boilerplate; folded into one parameterized helper accepting transport-cap overrides. Net −164 lines across the test tree; per-test helper is now a one-liner that documents the cap shape. No behavior change. Full quic suite + amethyst hook test green. https://claude.ai/code/session_018KPKWRg5baX5Anf7zfEyec
This commit is contained in:
@@ -503,7 +503,7 @@ class QuicConnection(
|
|||||||
*
|
*
|
||||||
* Caller must hold [streamsLock] for any read/write.
|
* Caller must hold [streamsLock] for any read/write.
|
||||||
*/
|
*/
|
||||||
internal val pendingPathResponses: ArrayDeque<ByteArray> = ArrayDeque()
|
internal val pendingPathChallengePayloads: ArrayDeque<ByteArray> = ArrayDeque()
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* RFC 9002 RTT estimator + loss-detection algorithm. Single
|
* RFC 9002 RTT estimator + loss-detection algorithm. Single
|
||||||
@@ -1896,12 +1896,13 @@ class QuicConnection(
|
|||||||
* Caller must hold [streamsLock].
|
* Caller must hold [streamsLock].
|
||||||
*/
|
*/
|
||||||
internal fun queuePathResponseLocked(challengeData: ByteArray) {
|
internal fun queuePathResponseLocked(challengeData: ByteArray) {
|
||||||
if (pendingPathResponses.size >= MAX_PENDING_PATH_RESPONSES) return
|
if (pendingPathChallengePayloads.size >= MAX_PENDING_PATH_RESPONSES) return
|
||||||
// Defensive copy: the parser hands us a slice of the inbound
|
// The parser produces a fresh ByteArray per PATH_CHALLENGE
|
||||||
// packet's plaintext payload, which the parser may free /
|
// (see [com.vitorpamplona.quic.Buffer.QuicReader.readBytes],
|
||||||
// reuse after we return. Copying preserves the bytes for the
|
// which `copyOfRange`s a slice off the inbound payload), so
|
||||||
// writer to encode later.
|
// we can keep the reference directly without a defensive
|
||||||
pendingPathResponses.addLast(challengeData.copyOf())
|
// copy.
|
||||||
|
pendingPathChallengePayloads.addLast(challengeData)
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -2122,7 +2123,7 @@ class QuicConnection(
|
|||||||
const val RETIRED_STREAM_ID_RING_SIZE: Int = 4_096
|
const val RETIRED_STREAM_ID_RING_SIZE: Int = 4_096
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Bound on the [pendingPathResponses] queue. RFC 9000 §8.2
|
* Bound on the [pendingPathChallengePayloads] queue. RFC 9000 §8.2
|
||||||
* doesn't cap PATH_CHALLENGE rate, so a malicious peer could
|
* doesn't cap PATH_CHALLENGE rate, so a malicious peer could
|
||||||
* spam them to exhaust our memory. 64 entries × 8 bytes = 512 B
|
* spam them to exhaust our memory. 64 entries × 8 bytes = 512 B
|
||||||
* worst case — trivial to absorb but tight enough that an
|
* worst case — trivial to absorb but tight enough that an
|
||||||
|
|||||||
+1
-1
@@ -716,7 +716,7 @@ private fun dispatchFrames(
|
|||||||
// RFC 9000 §8.2.2 — peer is validating that a path is
|
// RFC 9000 §8.2.2 — peer is validating that a path is
|
||||||
// alive. We MUST echo the SAME 8-byte payload in a
|
// alive. We MUST echo the SAME 8-byte payload in a
|
||||||
// PATH_RESPONSE on the path the challenge arrived on.
|
// PATH_RESPONSE on the path the challenge arrived on.
|
||||||
// The writer drains [pendingPathResponses] on the next
|
// The writer drains [pendingPathChallengePayloads] on the next
|
||||||
// application-level packet build.
|
// application-level packet build.
|
||||||
//
|
//
|
||||||
// Common practical trigger: server-side path
|
// Common practical trigger: server-side path
|
||||||
|
|||||||
+2
-2
@@ -957,8 +957,8 @@ private fun appendFlowControlUpdates(
|
|||||||
// packet is lost, the peer's next PATH_CHALLENGE retry queues a
|
// packet is lost, the peer's next PATH_CHALLENGE retry queues a
|
||||||
// fresh entry here and we respond again. The peer is responsible
|
// fresh entry here and we respond again. The peer is responsible
|
||||||
// for retrying its challenge until it sees a matching response.
|
// for retrying its challenge until it sees a matching response.
|
||||||
while (conn.pendingPathResponses.isNotEmpty()) {
|
while (conn.pendingPathChallengePayloads.isNotEmpty()) {
|
||||||
val data = conn.pendingPathResponses.removeFirst()
|
val data = conn.pendingPathChallengePayloads.removeFirst()
|
||||||
frames += PathResponseFrame(data)
|
frames += PathResponseFrame(data)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -23,8 +23,6 @@ package com.vitorpamplona.quic.connection
|
|||||||
import com.vitorpamplona.quic.frame.AckFrame
|
import com.vitorpamplona.quic.frame.AckFrame
|
||||||
import com.vitorpamplona.quic.frame.StreamFrame
|
import com.vitorpamplona.quic.frame.StreamFrame
|
||||||
import com.vitorpamplona.quic.stream.StreamId
|
import com.vitorpamplona.quic.stream.StreamId
|
||||||
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
|
||||||
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
|
||||||
import kotlinx.coroutines.async
|
import kotlinx.coroutines.async
|
||||||
import kotlinx.coroutines.awaitAll
|
import kotlinx.coroutines.awaitAll
|
||||||
import kotlinx.coroutines.coroutineScope
|
import kotlinx.coroutines.coroutineScope
|
||||||
@@ -298,49 +296,15 @@ class CloseUnderLoadTest {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 1024-stream caps so the 100-bidi-stream open burst doesn't
|
||||||
|
// brush the cap mid-test, and 16 MiB data window so multi-payload
|
||||||
|
// traffic doesn't trip flow-control mid-close.
|
||||||
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
runBlocking {
|
com.vitorpamplona.quic.connection.newConnectedClient(
|
||||||
val client =
|
maxStreamsBidi = 1024,
|
||||||
QuicConnection(
|
maxStreamsUni = 1024,
|
||||||
serverName = "closeunderload.test",
|
maxData = 16L * 1024 * 1024,
|
||||||
config =
|
)
|
||||||
QuicConnectionConfig(
|
|
||||||
initialMaxStreamsBidi = 1024,
|
|
||||||
initialMaxStreamsUni = 1024,
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
),
|
|
||||||
tlsCertificateValidator = PermissiveCertificateValidator(),
|
|
||||||
)
|
|
||||||
val serverScid = ConnectionId.random(8)
|
|
||||||
val tlsServer =
|
|
||||||
InProcessTlsServer(
|
|
||||||
transportParameters =
|
|
||||||
TransportParameters(
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
initialMaxStreamsBidi = 1024,
|
|
||||||
initialMaxStreamsUni = 1024,
|
|
||||||
initialSourceConnectionId = serverScid.bytes,
|
|
||||||
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
|
||||||
).encode(),
|
|
||||||
)
|
|
||||||
val pipe =
|
|
||||||
InMemoryQuicPipe(
|
|
||||||
client = client,
|
|
||||||
initialDcid = client.destinationConnectionId.bytes,
|
|
||||||
serverScid = serverScid,
|
|
||||||
tlsServer = tlsServer,
|
|
||||||
)
|
|
||||||
client.start()
|
|
||||||
pipe.drive(maxRounds = 16)
|
|
||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
|
||||||
client to pipe
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
|||||||
+94
@@ -0,0 +1,94 @@
|
|||||||
|
/*
|
||||||
|
* Copyright (c) 2025 Vitor Pamplona
|
||||||
|
*
|
||||||
|
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||||
|
* this software and associated documentation files (the "Software"), to deal in
|
||||||
|
* the Software without restriction, including without limitation the rights to use,
|
||||||
|
* copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the
|
||||||
|
* Software, and to permit persons to whom the Software is furnished to do so,
|
||||||
|
* subject to the following conditions:
|
||||||
|
*
|
||||||
|
* The above copyright notice and this permission notice shall be included in all
|
||||||
|
* copies or substantial portions of the Software.
|
||||||
|
*
|
||||||
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||||
|
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||||
|
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
|
||||||
|
* AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||||
|
* WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||||
|
*/
|
||||||
|
package com.vitorpamplona.quic.connection
|
||||||
|
|
||||||
|
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
||||||
|
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
||||||
|
import kotlinx.coroutines.runBlocking
|
||||||
|
import kotlin.test.assertEquals
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Stand up a fresh [QuicConnection] wired through an
|
||||||
|
* [InMemoryQuicPipe] and drive the handshake to CONNECTED. Most of
|
||||||
|
* the audio-rooms tests start from this exact shape — extracted
|
||||||
|
* here to keep each test file focused on its own assertions
|
||||||
|
* rather than ~40 lines of identical fixture boilerplate.
|
||||||
|
*
|
||||||
|
* The transport-parameter knobs cover the only variation real tests
|
||||||
|
* need:
|
||||||
|
* - moq-lite-shaped tests (many peer-uni streams, large data
|
||||||
|
* window): pass `maxStreamsUni = 65_536`, `maxData = 16 MiB`.
|
||||||
|
* - single-stream / control-frame tests (defaults are plenty).
|
||||||
|
*
|
||||||
|
* Both client and server advertise the same caps so flow-control
|
||||||
|
* regressions surface as caps-mismatch failures rather than tests
|
||||||
|
* passing accidentally because ONE side was generous.
|
||||||
|
*/
|
||||||
|
fun newConnectedClient(
|
||||||
|
serverName: String = "example.test",
|
||||||
|
maxStreamsBidi: Long = 16,
|
||||||
|
maxStreamsUni: Long = 16,
|
||||||
|
maxData: Long = 1L * 1024 * 1024,
|
||||||
|
maxStreamData: Long = 64L * 1024,
|
||||||
|
handshakeRounds: Int = 16,
|
||||||
|
): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
|
runBlocking {
|
||||||
|
val client =
|
||||||
|
QuicConnection(
|
||||||
|
serverName = serverName,
|
||||||
|
config =
|
||||||
|
QuicConnectionConfig(
|
||||||
|
initialMaxStreamsBidi = maxStreamsBidi,
|
||||||
|
initialMaxStreamsUni = maxStreamsUni,
|
||||||
|
initialMaxData = maxData,
|
||||||
|
initialMaxStreamDataBidiLocal = maxStreamData,
|
||||||
|
initialMaxStreamDataBidiRemote = maxStreamData,
|
||||||
|
initialMaxStreamDataUni = maxStreamData,
|
||||||
|
),
|
||||||
|
tlsCertificateValidator = PermissiveCertificateValidator(),
|
||||||
|
)
|
||||||
|
val serverScid = ConnectionId.random(8)
|
||||||
|
val tlsServer =
|
||||||
|
InProcessTlsServer(
|
||||||
|
transportParameters =
|
||||||
|
TransportParameters(
|
||||||
|
initialMaxData = maxData,
|
||||||
|
initialMaxStreamDataBidiLocal = maxStreamData,
|
||||||
|
initialMaxStreamDataBidiRemote = maxStreamData,
|
||||||
|
initialMaxStreamDataUni = maxStreamData,
|
||||||
|
initialMaxStreamsBidi = maxStreamsBidi,
|
||||||
|
initialMaxStreamsUni = maxStreamsUni,
|
||||||
|
initialSourceConnectionId = serverScid.bytes,
|
||||||
|
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
||||||
|
).encode(),
|
||||||
|
)
|
||||||
|
val pipe =
|
||||||
|
InMemoryQuicPipe(
|
||||||
|
client = client,
|
||||||
|
initialDcid = client.destinationConnectionId.bytes,
|
||||||
|
serverScid = serverScid,
|
||||||
|
tlsServer = tlsServer,
|
||||||
|
)
|
||||||
|
client.start()
|
||||||
|
pipe.drive(maxRounds = handshakeRounds)
|
||||||
|
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
||||||
|
client to pipe
|
||||||
|
}
|
||||||
+4
-44
@@ -24,8 +24,6 @@ import com.vitorpamplona.quic.frame.PingFrame
|
|||||||
import com.vitorpamplona.quic.frame.StreamFrame
|
import com.vitorpamplona.quic.frame.StreamFrame
|
||||||
import com.vitorpamplona.quic.packet.ShortHeaderPacket
|
import com.vitorpamplona.quic.packet.ShortHeaderPacket
|
||||||
import com.vitorpamplona.quic.stream.StreamId
|
import com.vitorpamplona.quic.stream.StreamId
|
||||||
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
|
||||||
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
|
||||||
import kotlinx.coroutines.flow.toList
|
import kotlinx.coroutines.flow.toList
|
||||||
import kotlinx.coroutines.runBlocking
|
import kotlinx.coroutines.runBlocking
|
||||||
import kotlinx.coroutines.withTimeoutOrNull
|
import kotlinx.coroutines.withTimeoutOrNull
|
||||||
@@ -356,47 +354,9 @@ class KeyUpdatePeerInitiatedTest {
|
|||||||
return null
|
return null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Default caps (16/16 streams, 1 MiB data) — the rotation tests
|
||||||
|
// don't push much traffic; small caps keep the pipe handshake fast.
|
||||||
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
runBlocking {
|
com.vitorpamplona.quic.connection
|
||||||
val client =
|
.newConnectedClient()
|
||||||
QuicConnection(
|
|
||||||
serverName = "keyupdate.test",
|
|
||||||
config =
|
|
||||||
QuicConnectionConfig(
|
|
||||||
initialMaxStreamsBidi = 16,
|
|
||||||
initialMaxStreamsUni = 16,
|
|
||||||
initialMaxData = 1L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
),
|
|
||||||
tlsCertificateValidator = PermissiveCertificateValidator(),
|
|
||||||
)
|
|
||||||
val serverScid = ConnectionId.random(8)
|
|
||||||
val tlsServer =
|
|
||||||
InProcessTlsServer(
|
|
||||||
transportParameters =
|
|
||||||
TransportParameters(
|
|
||||||
initialMaxData = 1L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
initialMaxStreamsBidi = 16,
|
|
||||||
initialMaxStreamsUni = 16,
|
|
||||||
initialSourceConnectionId = serverScid.bytes,
|
|
||||||
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
|
||||||
).encode(),
|
|
||||||
)
|
|
||||||
val pipe =
|
|
||||||
InMemoryQuicPipe(
|
|
||||||
client = client,
|
|
||||||
initialDcid = client.destinationConnectionId.bytes,
|
|
||||||
serverScid = serverScid,
|
|
||||||
tlsServer = tlsServer,
|
|
||||||
)
|
|
||||||
client.start()
|
|
||||||
pipe.drive(maxRounds = 16)
|
|
||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
|
||||||
client to pipe
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
+7
-44
@@ -22,8 +22,6 @@ package com.vitorpamplona.quic.connection
|
|||||||
|
|
||||||
import com.vitorpamplona.quic.frame.StreamFrame
|
import com.vitorpamplona.quic.frame.StreamFrame
|
||||||
import com.vitorpamplona.quic.stream.StreamId
|
import com.vitorpamplona.quic.stream.StreamId
|
||||||
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
|
||||||
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
|
||||||
import kotlinx.coroutines.flow.toList
|
import kotlinx.coroutines.flow.toList
|
||||||
import kotlinx.coroutines.runBlocking
|
import kotlinx.coroutines.runBlocking
|
||||||
import kotlinx.coroutines.withTimeoutOrNull
|
import kotlinx.coroutines.withTimeoutOrNull
|
||||||
@@ -392,47 +390,12 @@ class MoqLiteLossHarnessTest {
|
|||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// 1024 streams per direction + 16 MiB connection-level data —
|
||||||
|
// headroom for 200-stream loss tests without bumping caps.
|
||||||
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
runBlocking {
|
com.vitorpamplona.quic.connection.newConnectedClient(
|
||||||
val client =
|
maxStreamsBidi = 1024,
|
||||||
QuicConnection(
|
maxStreamsUni = 1024,
|
||||||
serverName = "loss.test",
|
maxData = 16L * 1024 * 1024,
|
||||||
config =
|
)
|
||||||
QuicConnectionConfig(
|
|
||||||
initialMaxStreamsBidi = 1024,
|
|
||||||
initialMaxStreamsUni = 1024,
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
),
|
|
||||||
tlsCertificateValidator = PermissiveCertificateValidator(),
|
|
||||||
)
|
|
||||||
val serverScid = ConnectionId.random(8)
|
|
||||||
val tlsServer =
|
|
||||||
InProcessTlsServer(
|
|
||||||
transportParameters =
|
|
||||||
TransportParameters(
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
initialMaxStreamsBidi = 1024,
|
|
||||||
initialMaxStreamsUni = 1024,
|
|
||||||
initialSourceConnectionId = serverScid.bytes,
|
|
||||||
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
|
||||||
).encode(),
|
|
||||||
)
|
|
||||||
val pipe =
|
|
||||||
InMemoryQuicPipe(
|
|
||||||
client = client,
|
|
||||||
initialDcid = client.destinationConnectionId.bytes,
|
|
||||||
serverScid = serverScid,
|
|
||||||
tlsServer = tlsServer,
|
|
||||||
)
|
|
||||||
client.start()
|
|
||||||
pipe.drive(maxRounds = 16)
|
|
||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
|
||||||
client to pipe
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -24,8 +24,6 @@ import com.vitorpamplona.quic.frame.PathChallengeFrame
|
|||||||
import com.vitorpamplona.quic.frame.PathResponseFrame
|
import com.vitorpamplona.quic.frame.PathResponseFrame
|
||||||
import com.vitorpamplona.quic.frame.decodeFrames
|
import com.vitorpamplona.quic.frame.decodeFrames
|
||||||
import com.vitorpamplona.quic.frame.encodeFrames
|
import com.vitorpamplona.quic.frame.encodeFrames
|
||||||
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
|
||||||
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
|
||||||
import kotlinx.coroutines.runBlocking
|
import kotlinx.coroutines.runBlocking
|
||||||
import kotlin.test.Test
|
import kotlin.test.Test
|
||||||
import kotlin.test.assertContentEquals
|
import kotlin.test.assertContentEquals
|
||||||
@@ -181,7 +179,7 @@ class PathValidationTest {
|
|||||||
fun pathResponseQueueIsBoundedAgainstChallengeFlood() =
|
fun pathResponseQueueIsBoundedAgainstChallengeFlood() =
|
||||||
runBlocking {
|
runBlocking {
|
||||||
// Defence-in-depth: an attacker spamming PATH_CHALLENGE
|
// Defence-in-depth: an attacker spamming PATH_CHALLENGE
|
||||||
// shouldn't pin arbitrary memory in our pendingPathResponses
|
// shouldn't pin arbitrary memory in our pendingPathChallengePayloads
|
||||||
// queue. Cap is MAX_PENDING_PATH_RESPONSES (64); excess
|
// queue. Cap is MAX_PENDING_PATH_RESPONSES (64); excess
|
||||||
// challenges are silently dropped — the protocol allows
|
// challenges are silently dropped — the protocol allows
|
||||||
// it (peer would retransmit on PTO if a response actually
|
// it (peer would retransmit on PTO if a response actually
|
||||||
@@ -212,39 +210,8 @@ class PathValidationTest {
|
|||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// Default caps — path validation tests don't open streams.
|
||||||
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
runBlocking {
|
com.vitorpamplona.quic.connection
|
||||||
val client =
|
.newConnectedClient()
|
||||||
QuicConnection(
|
|
||||||
serverName = "path.test",
|
|
||||||
config = QuicConnectionConfig(),
|
|
||||||
tlsCertificateValidator = PermissiveCertificateValidator(),
|
|
||||||
)
|
|
||||||
val serverScid = ConnectionId.random(8)
|
|
||||||
val tlsServer =
|
|
||||||
InProcessTlsServer(
|
|
||||||
transportParameters =
|
|
||||||
TransportParameters(
|
|
||||||
initialMaxData = 1L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
initialMaxStreamsBidi = 16,
|
|
||||||
initialMaxStreamsUni = 16,
|
|
||||||
initialSourceConnectionId = serverScid.bytes,
|
|
||||||
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
|
||||||
).encode(),
|
|
||||||
)
|
|
||||||
val pipe =
|
|
||||||
InMemoryQuicPipe(
|
|
||||||
client = client,
|
|
||||||
initialDcid = client.destinationConnectionId.bytes,
|
|
||||||
serverScid = serverScid,
|
|
||||||
tlsServer = tlsServer,
|
|
||||||
)
|
|
||||||
client.start()
|
|
||||||
pipe.drive(maxRounds = 16)
|
|
||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
|
||||||
client to pipe
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
+9
-44
@@ -23,8 +23,6 @@ package com.vitorpamplona.quic.connection
|
|||||||
import com.vitorpamplona.quic.frame.AckFrame
|
import com.vitorpamplona.quic.frame.AckFrame
|
||||||
import com.vitorpamplona.quic.frame.StreamFrame
|
import com.vitorpamplona.quic.frame.StreamFrame
|
||||||
import com.vitorpamplona.quic.stream.StreamId
|
import com.vitorpamplona.quic.stream.StreamId
|
||||||
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
|
||||||
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
|
||||||
import kotlinx.coroutines.flow.toList
|
import kotlinx.coroutines.flow.toList
|
||||||
import kotlinx.coroutines.runBlocking
|
import kotlinx.coroutines.runBlocking
|
||||||
import kotlinx.coroutines.withTimeoutOrNull
|
import kotlinx.coroutines.withTimeoutOrNull
|
||||||
@@ -429,47 +427,14 @@ class StreamRetirementSoakTest {
|
|||||||
return any
|
return any
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// moq-lite-shaped fixture: 4 K bidi caps + 64 K peer-uni caps so
|
||||||
|
// the soak harness can churn 10 K + streams without hitting
|
||||||
|
// either the peer cap or our advertised cap before the writer's
|
||||||
|
// periodic MAX_STREAMS_UNI extension fires.
|
||||||
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
runBlocking {
|
com.vitorpamplona.quic.connection.newConnectedClient(
|
||||||
val client =
|
maxStreamsBidi = 4096,
|
||||||
QuicConnection(
|
maxStreamsUni = 65_536,
|
||||||
serverName = "example.test",
|
maxData = 16L * 1024 * 1024,
|
||||||
config =
|
)
|
||||||
QuicConnectionConfig(
|
|
||||||
initialMaxStreamsBidi = 4096,
|
|
||||||
initialMaxStreamsUni = 65_536,
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
),
|
|
||||||
tlsCertificateValidator = PermissiveCertificateValidator(),
|
|
||||||
)
|
|
||||||
val serverScid = ConnectionId.random(8)
|
|
||||||
val tlsServer =
|
|
||||||
InProcessTlsServer(
|
|
||||||
transportParameters =
|
|
||||||
TransportParameters(
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
initialMaxStreamsBidi = 4096,
|
|
||||||
initialMaxStreamsUni = 65_536,
|
|
||||||
initialSourceConnectionId = serverScid.bytes,
|
|
||||||
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
|
||||||
).encode(),
|
|
||||||
)
|
|
||||||
val pipe =
|
|
||||||
InMemoryQuicPipe(
|
|
||||||
client = client,
|
|
||||||
initialDcid = client.destinationConnectionId.bytes,
|
|
||||||
serverScid = serverScid,
|
|
||||||
tlsServer = tlsServer,
|
|
||||||
)
|
|
||||||
client.start()
|
|
||||||
pipe.drive(maxRounds = 16)
|
|
||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
|
||||||
client to pipe
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -22,8 +22,6 @@ package com.vitorpamplona.quic.connection
|
|||||||
|
|
||||||
import com.vitorpamplona.quic.frame.StreamFrame
|
import com.vitorpamplona.quic.frame.StreamFrame
|
||||||
import com.vitorpamplona.quic.stream.StreamId
|
import com.vitorpamplona.quic.stream.StreamId
|
||||||
import com.vitorpamplona.quic.tls.InProcessTlsServer
|
|
||||||
import com.vitorpamplona.quic.tls.PermissiveCertificateValidator
|
|
||||||
import kotlinx.coroutines.flow.toList
|
import kotlinx.coroutines.flow.toList
|
||||||
import kotlinx.coroutines.runBlocking
|
import kotlinx.coroutines.runBlocking
|
||||||
import kotlin.test.Test
|
import kotlin.test.Test
|
||||||
@@ -215,47 +213,13 @@ class QuicHeapSoakTest {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// moq-lite-shaped fixture (matches StreamRetirementSoakTest's
|
||||||
|
// shape) — large peer-uni cap so the heap canary can churn 90 K
|
||||||
|
// streams in a 30-min run without bumping the cap.
|
||||||
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
private fun newConnectedClient(): Pair<QuicConnection, InMemoryQuicPipe> =
|
||||||
runBlocking {
|
com.vitorpamplona.quic.connection.newConnectedClient(
|
||||||
val client =
|
maxStreamsBidi = 4096,
|
||||||
QuicConnection(
|
maxStreamsUni = 65_536,
|
||||||
serverName = "soak.test",
|
maxData = 16L * 1024 * 1024,
|
||||||
config =
|
)
|
||||||
QuicConnectionConfig(
|
|
||||||
initialMaxStreamsBidi = 4096,
|
|
||||||
initialMaxStreamsUni = 65_536,
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
),
|
|
||||||
tlsCertificateValidator = PermissiveCertificateValidator(),
|
|
||||||
)
|
|
||||||
val serverScid = ConnectionId.random(8)
|
|
||||||
val tlsServer =
|
|
||||||
InProcessTlsServer(
|
|
||||||
transportParameters =
|
|
||||||
TransportParameters(
|
|
||||||
initialMaxData = 16L * 1024 * 1024,
|
|
||||||
initialMaxStreamDataBidiLocal = 64L * 1024,
|
|
||||||
initialMaxStreamDataBidiRemote = 64L * 1024,
|
|
||||||
initialMaxStreamDataUni = 64L * 1024,
|
|
||||||
initialMaxStreamsBidi = 4096,
|
|
||||||
initialMaxStreamsUni = 65_536,
|
|
||||||
initialSourceConnectionId = serverScid.bytes,
|
|
||||||
originalDestinationConnectionId = client.destinationConnectionId.bytes,
|
|
||||||
).encode(),
|
|
||||||
)
|
|
||||||
val pipe =
|
|
||||||
InMemoryQuicPipe(
|
|
||||||
client = client,
|
|
||||||
initialDcid = client.destinationConnectionId.bytes,
|
|
||||||
serverScid = serverScid,
|
|
||||||
tlsServer = tlsServer,
|
|
||||||
)
|
|
||||||
client.start()
|
|
||||||
pipe.drive(maxRounds = 16)
|
|
||||||
assertEquals(QuicConnection.Status.CONNECTED, client.status)
|
|
||||||
client to pipe
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user