mirror of
https://github.com/telemt/telemt.git
synced 2026-09-07 19:16:14 +03:00
Decoy Contract sanitized
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
This commit is contained in:
Alexey
@@ -29,7 +29,7 @@ pub(super) fn render(
|
||||
|
||||
let _ = writeln!(
|
||||
out,
|
||||
"# HELP telemt_web_session_lifecycle_observations_total Authenticated activity after bounded lifecycle gaps"
|
||||
"# HELP telemt_web_session_lifecycle_observations_total Authenticated WEB session lifecycle observations"
|
||||
);
|
||||
let _ = writeln!(
|
||||
out,
|
||||
|
||||
+11
-3
@@ -151,7 +151,7 @@ pub(crate) async fn serve_connection(
|
||||
}
|
||||
|
||||
async fn handle_request(
|
||||
request: Request<RequestBody>,
|
||||
mut request: Request<RequestBody>,
|
||||
peer: SocketAddr,
|
||||
client_ip_source: WebClientIpSource,
|
||||
trusted_proxy_cidrs: &[IpNetwork],
|
||||
@@ -209,7 +209,11 @@ async fn handle_request(
|
||||
)
|
||||
.await;
|
||||
}
|
||||
serve_decoy(request, vhost, false, &runtime).await
|
||||
let sanitize_recovery = recovery::has_media_type(&request);
|
||||
if sanitize_recovery {
|
||||
strip_query(&mut request);
|
||||
}
|
||||
serve_decoy(request, vhost, sanitize_recovery, &runtime).await
|
||||
}
|
||||
|
||||
async fn handle_root(
|
||||
@@ -228,8 +232,12 @@ async fn handle_root(
|
||||
}
|
||||
let (candidate, canonical) = bridge_candidate(request.uri().query());
|
||||
let profile = match_profile(&vhost, &candidate);
|
||||
let recovery_requested = matches!(representation, recovery::RootRepresentation::Recovery(_));
|
||||
let Some(profile) = profile.filter(|_| canonical && request.method() == Method::GET) else {
|
||||
return serve_decoy(request, vhost, false, &runtime).await;
|
||||
if recovery_requested {
|
||||
strip_query(&mut request);
|
||||
}
|
||||
return serve_decoy(request, vhost, recovery_requested, &runtime).await;
|
||||
};
|
||||
let Some(client_ip) = client_ip(&request, peer, client_ip_source, trusted_proxy_cidrs) else {
|
||||
strip_query(&mut request);
|
||||
|
||||
@@ -30,9 +30,7 @@ pub(super) fn classify(request: &Request<RequestBody>) -> RootRepresentation {
|
||||
let first = values.next();
|
||||
let exact = first.is_some_and(|value| value.as_bytes() == MEDIA_TYPE.as_bytes())
|
||||
&& values.next().is_none();
|
||||
let recovery_present = accepts
|
||||
.iter()
|
||||
.any(|value| value.as_bytes() == MEDIA_TYPE.as_bytes());
|
||||
let recovery_present = has_media_type(request);
|
||||
let authorization_present = request.headers().contains_key(header::AUTHORIZATION);
|
||||
if !exact {
|
||||
return if authorization_present || recovery_present {
|
||||
@@ -52,6 +50,20 @@ pub(super) fn classify(request: &Request<RequestBody>) -> RootRepresentation {
|
||||
.unwrap_or(RootRepresentation::Invalid)
|
||||
}
|
||||
|
||||
/// Detects a recovery media token even when its Accept syntax is noncanonical.
|
||||
pub(super) fn has_media_type(request: &Request<RequestBody>) -> bool {
|
||||
request.headers().get_all(header::ACCEPT).iter().any(|value| {
|
||||
value.to_str().ok().is_some_and(|value| {
|
||||
value.split(',').any(|entry| {
|
||||
entry
|
||||
.split(';')
|
||||
.next()
|
||||
.is_some_and(|media| media.trim().eq_ignore_ascii_case(MEDIA_TYPE))
|
||||
})
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/// Builds the bounded no-store recovery representation.
|
||||
pub(super) fn response(
|
||||
bootstrap: &BootstrapResult,
|
||||
|
||||
@@ -170,6 +170,26 @@ async fn malformed_or_over_capacity_recovery_is_indistinguishable_from_decoy() {
|
||||
assert_eq!(response_header(malformed_headers, "cache-control"), "no-store");
|
||||
assert_eq!(malformed_body, b"<!doctype html><title>decoy</title>");
|
||||
|
||||
let invalid_capability = recover(
|
||||
&listener,
|
||||
&runtime,
|
||||
&base64::engine::general_purpose::URL_SAFE_NO_PAD.encode([99u8; 32]),
|
||||
&format!("Bearer {}", "U".repeat(43)),
|
||||
)
|
||||
.await;
|
||||
assert_eq!(invalid_capability, malformed);
|
||||
|
||||
let malformed_accept = request(
|
||||
&listener,
|
||||
&runtime,
|
||||
format!(
|
||||
"GET /?bridge={encoded} HTTP/1.1\r\nHost: proxy.example.com\r\nX-Forwarded-For: 192.0.2.40\r\nAccept: {RECOVERY_TYPE}, */*\r\nConnection: close\r\n\r\n"
|
||||
)
|
||||
.into_bytes(),
|
||||
)
|
||||
.await;
|
||||
assert_eq!(malformed_accept, malformed);
|
||||
|
||||
let _held = bridge_bootstrap(&listener, &runtime, &encoded).await;
|
||||
let over_capacity = recover(
|
||||
&listener,
|
||||
|
||||
@@ -52,7 +52,7 @@ pub(crate) struct WebSessionStatus {
|
||||
pub(crate) control_items: usize,
|
||||
/// Monotonic age since session creation.
|
||||
pub(crate) age_ms: u64,
|
||||
/// Monotonic age since the latest carrier activity.
|
||||
/// Monotonic age since the latest peer or carrier progress.
|
||||
pub(crate) idle_ms: u64,
|
||||
/// Monotonic age since the latest validated peer operation.
|
||||
pub(crate) peer_idle_ms: u64,
|
||||
|
||||
@@ -12,7 +12,7 @@ pub(super) const SESSION_CLOSE_SLOTS: usize =
|
||||
pub(super) const SESSION_OBSERVATION_SLOTS: usize =
|
||||
WebCarrier::ALL.len() * WebSessionLifecycleObservation::ALL.len();
|
||||
|
||||
/// Stable observation emitted after an authenticated session lifecycle gap.
|
||||
/// Stable authenticated session lifecycle observation.
|
||||
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
|
||||
#[repr(usize)]
|
||||
pub(crate) enum WebSessionLifecycleObservation {
|
||||
|
||||
Reference in New Issue
Block a user