Plan M4a: gatewayd in 15 tasks, with skeletons and given tests
Each task's tests were run against a reference at its end state; the end states were replayed from master in order with the gate at each step (650 to 762 tests); each skeleton compiles against its tests and fails them. The reference is kept off this machine. Lessons T27 (every wait in a test has a limit) and T28 (mutate the reference before hand-over) come from this work. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -0,0 +1,469 @@
|
||||
//! WebSocket frames, adversarially (M4a spec, section 6). Everything a server sends is untrusted:
|
||||
//! each hostile frame must end the connection with an error, never a panic, and a length must be
|
||||
//! refused before anything waits for or allocates its payload. A seeded property test compares the
|
||||
//! decoder with a deliberately naive one written here, on valid streams and on random mutations of
|
||||
//! them, fed in random pieces. The seed is printed on failure. Do not edit.
|
||||
|
||||
use gatewayd::ws::WsError;
|
||||
use gatewayd::ws::frame::{
|
||||
CLOSE, CONTINUATION, Decoder, Incoming, MAX_MESSAGE, PING, PONG, TEXT, encode,
|
||||
};
|
||||
|
||||
/// How a server frame's length is written: the shortest form, or a longer one on purpose.
|
||||
#[derive(Clone, Copy)]
|
||||
enum Len {
|
||||
Short,
|
||||
Force16,
|
||||
Force64,
|
||||
}
|
||||
|
||||
/// A frame as a server sends it (unmasked unless `masked`).
|
||||
fn frame(fin: bool, rsv: u8, opcode: u8, masked: bool, payload: &[u8], form: Len) -> Vec<u8> {
|
||||
let mut out = vec![(if fin { 0x80 } else { 0 }) | (rsv << 4) | opcode];
|
||||
let m = if masked { 0x80 } else { 0 };
|
||||
let len = payload.len();
|
||||
match form {
|
||||
Len::Short if len < 126 => out.push(m | len as u8),
|
||||
Len::Short if len <= 0xFFFF => {
|
||||
out.push(m | 126);
|
||||
out.extend_from_slice(&(len as u16).to_be_bytes());
|
||||
}
|
||||
Len::Force16 => {
|
||||
out.push(m | 126);
|
||||
out.extend_from_slice(&(len as u16).to_be_bytes());
|
||||
}
|
||||
_ => {
|
||||
out.push(m | 127);
|
||||
out.extend_from_slice(&(len as u64).to_be_bytes());
|
||||
}
|
||||
}
|
||||
if masked {
|
||||
out.extend_from_slice(&[1, 2, 3, 4]);
|
||||
}
|
||||
out.extend_from_slice(payload);
|
||||
out
|
||||
}
|
||||
|
||||
fn text(s: &str) -> Vec<u8> {
|
||||
frame(true, 0, TEXT, false, s.as_bytes(), Len::Short)
|
||||
}
|
||||
|
||||
/// Feed `bytes` in pieces of `step` and collect every message, stopping at the first error.
|
||||
fn decode(bytes: &[u8], step: usize) -> (Vec<Incoming>, Option<String>) {
|
||||
let mut d = Decoder::new();
|
||||
let mut got = Vec::new();
|
||||
for piece in bytes.chunks(step.max(1)) {
|
||||
d.feed(piece);
|
||||
loop {
|
||||
match d.next_message() {
|
||||
Ok(Some(m)) => got.push(m),
|
||||
Ok(None) => break,
|
||||
Err(e) => return (got, Some(e.to_string())),
|
||||
}
|
||||
}
|
||||
}
|
||||
(got, None)
|
||||
}
|
||||
|
||||
fn fails(bytes: &[u8], why: &str) {
|
||||
for step in [1, 2, 3, 7, bytes.len().max(1)] {
|
||||
let (_, err) = decode(bytes, step);
|
||||
assert!(err.is_some(), "{why} (fed {step} at a time) was accepted");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plain_messages() {
|
||||
let mut bytes = text("hello");
|
||||
bytes.extend(frame(true, 0, PING, false, b"p1", Len::Short));
|
||||
bytes.extend(frame(true, 0, PONG, false, b"", Len::Short));
|
||||
bytes.extend(frame(
|
||||
true,
|
||||
0,
|
||||
CLOSE,
|
||||
false,
|
||||
&[0x03, 0xE8, b'b', b'y', b'e'],
|
||||
Len::Short,
|
||||
));
|
||||
let (got, err) = decode(&bytes, bytes.len());
|
||||
assert_eq!(err, None);
|
||||
assert_eq!(
|
||||
got,
|
||||
[
|
||||
Incoming::Text("hello".into()),
|
||||
Incoming::Ping(b"p1".to_vec()),
|
||||
Incoming::Pong(Vec::new()),
|
||||
Incoming::Close(Some(1000), "bye".into()),
|
||||
]
|
||||
);
|
||||
assert_eq!(
|
||||
decode(&frame(true, 0, CLOSE, false, b"", Len::Short), 1).0,
|
||||
[Incoming::Close(None, String::new())]
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fragments_reassemble_with_control_frames_between_and_utf8_split_across_them() {
|
||||
let snow = "snow ☃ man";
|
||||
let bytes_of = snow.as_bytes();
|
||||
let cut = snow.find('☃').unwrap() + 1; // inside the three-byte character
|
||||
let mut bytes = frame(false, 0, TEXT, false, &bytes_of[..cut], Len::Short);
|
||||
bytes.extend(frame(true, 0, PING, false, b"mid", Len::Short));
|
||||
bytes.extend(frame(
|
||||
false,
|
||||
0,
|
||||
CONTINUATION,
|
||||
false,
|
||||
&bytes_of[cut..cut + 1],
|
||||
Len::Short,
|
||||
));
|
||||
bytes.extend(frame(
|
||||
true,
|
||||
0,
|
||||
CONTINUATION,
|
||||
false,
|
||||
&bytes_of[cut + 1..],
|
||||
Len::Short,
|
||||
));
|
||||
for step in 1..=bytes.len() {
|
||||
let (got, err) = decode(&bytes, step);
|
||||
assert_eq!(err, None, "step {step}");
|
||||
assert_eq!(
|
||||
got,
|
||||
[Incoming::Ping(b"mid".to_vec()), Incoming::Text(snow.into())],
|
||||
"step {step}"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn lengths_in_every_form() {
|
||||
for len in [0usize, 1, 125, 126, 127, 65_535, 65_536, 100_000] {
|
||||
let body = "x".repeat(len);
|
||||
let (got, err) = decode(&text(&body), 4096);
|
||||
assert_eq!(err, None, "{len}");
|
||||
assert_eq!(got, [Incoming::Text(body)], "{len}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn hostile_frames_end_the_connection() {
|
||||
for rsv in [1, 2, 4] {
|
||||
fails(
|
||||
&frame(true, rsv, TEXT, false, b"x", Len::Short),
|
||||
"a reserved bit",
|
||||
);
|
||||
}
|
||||
fails(
|
||||
&frame(true, 0, TEXT, true, b"x", Len::Short),
|
||||
"a masked frame from the server",
|
||||
);
|
||||
for op in [2u8, 3, 7, 11, 15] {
|
||||
fails(
|
||||
&frame(true, 0, op, false, b"x", Len::Short),
|
||||
"an unknown or binary opcode",
|
||||
);
|
||||
}
|
||||
fails(
|
||||
&frame(true, 0, PING, false, &[0u8; 126], Len::Short),
|
||||
"a control frame over 125 bytes",
|
||||
);
|
||||
fails(
|
||||
&frame(false, 0, PING, false, b"x", Len::Short),
|
||||
"a fragmented control frame",
|
||||
);
|
||||
fails(
|
||||
&frame(true, 0, CONTINUATION, false, b"x", Len::Short),
|
||||
"a continuation with nothing to continue",
|
||||
);
|
||||
let mut inside = frame(false, 0, TEXT, false, b"a", Len::Short);
|
||||
inside.extend(text("b"));
|
||||
fails(&inside, "a new message inside an unfinished one");
|
||||
fails(
|
||||
&frame(true, 0, TEXT, false, b"x", Len::Force16),
|
||||
"a 16-bit length for 1 byte",
|
||||
);
|
||||
fails(
|
||||
&frame(true, 0, TEXT, false, &[b'y'; 200], Len::Force64),
|
||||
"a 64-bit length for 200 bytes",
|
||||
);
|
||||
fails(
|
||||
&frame(true, 0, TEXT, false, &[0xff, 0xfe], Len::Short),
|
||||
"text that is not UTF-8",
|
||||
);
|
||||
fails(
|
||||
&frame(true, 0, CLOSE, false, &[3], Len::Short),
|
||||
"a close frame of one byte",
|
||||
);
|
||||
fails(
|
||||
&frame(true, 0, CLOSE, false, &[3, 232, 0xff], Len::Short),
|
||||
"a close reason that is not UTF-8",
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn huge_lengths_are_refused_from_the_header_alone() {
|
||||
// Only the header is fed: the decoder must refuse without waiting for a payload.
|
||||
let top_bit = [0x81u8, 127, 0x80, 0, 0, 0, 0, 0, 0, 1];
|
||||
let mut d = Decoder::new();
|
||||
d.feed(&top_bit);
|
||||
assert!(
|
||||
d.next_message().is_err(),
|
||||
"a 64-bit length with its top bit set"
|
||||
);
|
||||
|
||||
let too_big = (MAX_MESSAGE as u64) + 1;
|
||||
let mut head = vec![0x81u8, 127];
|
||||
head.extend_from_slice(&too_big.to_be_bytes());
|
||||
let mut d = Decoder::new();
|
||||
d.feed(&head);
|
||||
assert!(matches!(d.next_message(), Err(WsError::TooLarge)));
|
||||
|
||||
let mut head = vec![0x81u8, 127];
|
||||
head.extend_from_slice(&0x7FFF_FFFF_FFFF_FFFFu64.to_be_bytes());
|
||||
let mut d = Decoder::new();
|
||||
d.feed(&head);
|
||||
assert!(matches!(d.next_message(), Err(WsError::TooLarge)));
|
||||
|
||||
// Across fragments: the sum counts.
|
||||
let half = MAX_MESSAGE / 2 + 1;
|
||||
let mut d = Decoder::new();
|
||||
d.feed(&frame(false, 0, TEXT, false, &vec![b'a'; half], Len::Short));
|
||||
assert!(matches!(d.next_message(), Ok(None)));
|
||||
let mut second = vec![0x00u8, 127];
|
||||
second.extend_from_slice(&(half as u64).to_be_bytes());
|
||||
d.feed(&second);
|
||||
assert!(matches!(d.next_message(), Err(WsError::TooLarge)));
|
||||
|
||||
// Exactly the limit is fine.
|
||||
let (got, err) = decode(&text(&"z".repeat(MAX_MESSAGE)), 65_536);
|
||||
assert_eq!(err, None);
|
||||
assert_eq!(got.len(), 1);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn our_frames_are_masked_and_decode_back() {
|
||||
let mask = [0x11, 0x22, 0x33, 0x44];
|
||||
for len in [0usize, 5, 125, 126, 65_535, 65_536] {
|
||||
let payload: Vec<u8> = (0..len).map(|i| (i % 251) as u8).collect();
|
||||
let bytes = encode(TEXT, &payload, mask);
|
||||
assert_eq!(bytes[0], 0x80 | TEXT, "FIN and the opcode");
|
||||
assert_ne!(bytes[1] & 0x80, 0, "the mask bit");
|
||||
let (len_field, header) = match bytes[1] & 0x7F {
|
||||
126 => (u16::from_be_bytes([bytes[2], bytes[3]]) as usize, 4),
|
||||
127 => (
|
||||
u64::from_be_bytes(bytes[2..10].try_into().unwrap()) as usize,
|
||||
10,
|
||||
),
|
||||
n => (n as usize, 2),
|
||||
};
|
||||
assert_eq!(len_field, len);
|
||||
let shortest = if len < 126 {
|
||||
2
|
||||
} else if len <= 0xFFFF {
|
||||
4
|
||||
} else {
|
||||
10
|
||||
};
|
||||
assert_eq!(header, shortest, "the shortest length form");
|
||||
assert_eq!(&bytes[header..header + 4], &mask);
|
||||
let unmasked: Vec<u8> = bytes[header + 4..]
|
||||
.iter()
|
||||
.zip(mask.iter().cycle())
|
||||
.map(|(b, m)| b ^ m)
|
||||
.collect();
|
||||
assert_eq!(unmasked, payload);
|
||||
}
|
||||
assert_eq!(encode(PONG, b"p", mask)[0], 0x80 | PONG);
|
||||
}
|
||||
|
||||
// ---------- the property test ----------
|
||||
|
||||
struct Rng(u64);
|
||||
|
||||
impl Rng {
|
||||
fn next(&mut self) -> u64 {
|
||||
let mut x = self.0;
|
||||
x ^= x << 13;
|
||||
x ^= x >> 7;
|
||||
x ^= x << 17;
|
||||
self.0 = x;
|
||||
x
|
||||
}
|
||||
fn below(&mut self, n: usize) -> usize {
|
||||
(self.next() % n.max(1) as u64) as usize
|
||||
}
|
||||
}
|
||||
|
||||
/// The naive decoder: the whole buffer at once, the rules written out plainly.
|
||||
fn naive(bytes: &[u8]) -> (Vec<Incoming>, bool) {
|
||||
let mut out = Vec::new();
|
||||
let mut i = 0usize;
|
||||
let mut partial: Option<Vec<u8>> = None;
|
||||
while i < bytes.len() {
|
||||
if bytes.len() - i < 2 {
|
||||
return (out, false);
|
||||
}
|
||||
let (b0, b1) = (bytes[i], bytes[i + 1]);
|
||||
let (fin, rsv, op, masked, short) = (
|
||||
b0 >> 7 == 1,
|
||||
(b0 >> 4) & 7,
|
||||
b0 & 15,
|
||||
b1 >> 7 == 1,
|
||||
(b1 & 127) as usize,
|
||||
);
|
||||
if rsv != 0 || masked || ![0, 1, 8, 9, 10].contains(&op) {
|
||||
return (out, true);
|
||||
}
|
||||
let (hl, len) = if short == 126 {
|
||||
if bytes.len() - i < 4 {
|
||||
return (out, false);
|
||||
}
|
||||
let l = u16::from_be_bytes([bytes[i + 2], bytes[i + 3]]) as usize;
|
||||
if l < 126 {
|
||||
return (out, true);
|
||||
}
|
||||
(4, l)
|
||||
} else if short == 127 {
|
||||
if bytes.len() - i < 10 {
|
||||
return (out, false);
|
||||
}
|
||||
let l = u64::from_be_bytes(bytes[i + 2..i + 10].try_into().unwrap());
|
||||
if l >> 63 == 1 || l <= 0xFFFF {
|
||||
return (out, true);
|
||||
}
|
||||
(10, l as usize)
|
||||
} else {
|
||||
(2, short)
|
||||
};
|
||||
let control = op >= 8;
|
||||
if control && (!fin || len > 125) {
|
||||
return (out, true);
|
||||
}
|
||||
if !control {
|
||||
if (op == 1 && partial.is_some()) || (op == 0 && partial.is_none()) {
|
||||
return (out, true);
|
||||
}
|
||||
if partial.as_ref().map_or(0, |p| p.len()) + len > MAX_MESSAGE {
|
||||
return (out, true);
|
||||
}
|
||||
}
|
||||
if bytes.len() - i - hl < len {
|
||||
return (out, false);
|
||||
}
|
||||
let payload = bytes[i + hl..i + hl + len].to_vec();
|
||||
i += hl + len;
|
||||
match op {
|
||||
9 => out.push(Incoming::Ping(payload)),
|
||||
10 => out.push(Incoming::Pong(payload)),
|
||||
8 => {
|
||||
if payload.len() == 1 {
|
||||
return (out, true);
|
||||
}
|
||||
if payload.is_empty() {
|
||||
out.push(Incoming::Close(None, String::new()));
|
||||
} else {
|
||||
match String::from_utf8(payload[2..].to_vec()) {
|
||||
Ok(r) => out.push(Incoming::Close(
|
||||
Some(u16::from_be_bytes([payload[0], payload[1]])),
|
||||
r,
|
||||
)),
|
||||
Err(_) => return (out, true),
|
||||
}
|
||||
}
|
||||
}
|
||||
_ => {
|
||||
let mut m = if op == 1 {
|
||||
Vec::new()
|
||||
} else {
|
||||
partial.take().unwrap()
|
||||
};
|
||||
m.extend_from_slice(&payload);
|
||||
if fin {
|
||||
match String::from_utf8(m) {
|
||||
Ok(t) => out.push(Incoming::Text(t)),
|
||||
Err(_) => return (out, true),
|
||||
}
|
||||
} else {
|
||||
partial = Some(m);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
(out, false)
|
||||
}
|
||||
|
||||
/// A random valid stream: text messages split into random fragments, with control frames between.
|
||||
fn valid_stream(rng: &mut Rng) -> Vec<u8> {
|
||||
let mut bytes = Vec::new();
|
||||
for _ in 0..1 + rng.below(6) {
|
||||
let len = [0, 1, 50, 125, 126, 300, 70_000][rng.below(7)];
|
||||
let body: String = (0..len)
|
||||
.map(|k| {
|
||||
if (k + rng.below(3)).is_multiple_of(29) {
|
||||
'é'
|
||||
} else {
|
||||
'a'
|
||||
}
|
||||
})
|
||||
.collect();
|
||||
let raw = body.as_bytes();
|
||||
let parts = 1 + rng.below(3);
|
||||
let mut cuts: Vec<usize> = (0..parts - 1).map(|_| rng.below(raw.len() + 1)).collect();
|
||||
cuts.sort();
|
||||
let mut start = 0;
|
||||
for (k, cut) in cuts
|
||||
.iter()
|
||||
.copied()
|
||||
.chain(std::iter::once(raw.len()))
|
||||
.enumerate()
|
||||
{
|
||||
let op = if k == 0 { TEXT } else { CONTINUATION };
|
||||
bytes.extend(frame(
|
||||
k == parts - 1,
|
||||
0,
|
||||
op,
|
||||
false,
|
||||
&raw[start..cut],
|
||||
Len::Short,
|
||||
));
|
||||
start = cut;
|
||||
if rng.below(3) == 0 {
|
||||
bytes.extend(frame(
|
||||
true,
|
||||
0,
|
||||
PING,
|
||||
false,
|
||||
&[rng.below(256) as u8; 3],
|
||||
Len::Short,
|
||||
));
|
||||
}
|
||||
}
|
||||
}
|
||||
bytes
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn random_streams_agree_with_the_naive_decoder() {
|
||||
for case in 0..300u64 {
|
||||
let seed = 0x9E37_79B9_7F4A_7C15 ^ (case * 7919 + 1);
|
||||
let mut rng = Rng(seed);
|
||||
let mut bytes = valid_stream(&mut rng);
|
||||
if case % 2 == 1 {
|
||||
// Mutate: flip a few random bits, so most streams break somewhere different.
|
||||
for _ in 0..1 + rng.below(4) {
|
||||
let at = rng.below(bytes.len());
|
||||
bytes[at] ^= 1 << rng.below(8);
|
||||
}
|
||||
}
|
||||
let (want, want_err) = naive(&bytes);
|
||||
let step = 1 + rng.below(4096);
|
||||
let (got, got_err) = decode(&bytes, step);
|
||||
assert_eq!(got, want, "seed {seed:#x}, step {step}: messages differ");
|
||||
assert_eq!(
|
||||
got_err.is_some(),
|
||||
want_err,
|
||||
"seed {seed:#x}, step {step}: {got_err:?} vs naive error {want_err}"
|
||||
);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user