TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-11 05:07:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

control/controlbase: make the protocol version number selectable.

Browse Source 
This is so that we can plumb our client capability version through
the protocol as the Noise version. The capability version increments
more frequently than strictly required (the Noise version only needs
to change when cryptographically-significant changes are made to
the protocol, whereas the capability version also indicates changes
in non-cryptographically-significant parts of the protocol), but this
gives us a safe pre-auth way to determine if the client supports
future protocol features, while still relying on Noise's strong
assurance that the client and server have agreed on the same version.

Currently, the server executes the same protocol regardless of the
version number, and just presents the version to the caller so they
can do capability-based things in the upper RPC protocol. In future,
we may add a ratchet to disallow obsolete protocols, or vary the
Noise handshake behavior based on requested version.

Updates #3488

Signed-off-by: David Anderson <danderson@tailscale.com>
This commit is contained in:
David Anderson
2022-04-07 12:03:32 -07:00
committed by Dave Anderson
parent be861797b4
commit 02ad987e24
10 changed files with 98 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
control/controlbase/handshake_test.go
View File

@@ -26,11 +26,11 @@ func TestHandshake(t *testing.T) {
)
go func() {
var err error
server, err = Server(context.Background(), serverConn, serverKey, nil)
server, err = Server(context.Background(), serverConn, serverKey, testProtocolVersion, nil)
serverErr <- err
}()
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public())
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public(), testProtocolVersion)
if err != nil {
t.Fatalf("client connection failed: %v", err)
}
@@ -42,8 +42,8 @@ func TestHandshake(t *testing.T) {
t.Fatal("client and server disagree on handshake hash")
}
if client.ProtocolVersion() != int(protocolVersion) {
t.Fatalf("client reporting wrong protocol version %d, want %d", client.ProtocolVersion(), protocolVersion)
if client.ProtocolVersion() != int(testProtocolVersion) {
t.Fatalf("client reporting wrong protocol version %d, want %d", client.ProtocolVersion(), testProtocolVersion)
}
if client.ProtocolVersion() != server.ProtocolVersion() {
t.Fatalf("peers disagree on protocol version, client=%d server=%d", client.ProtocolVersion(), server.ProtocolVersion())
@@ -78,11 +78,11 @@ func TestNoReuse(t *testing.T) {
)
go func() {
var err error
server, err = Server(context.Background(), serverConn, serverKey, nil)
server, err = Server(context.Background(), serverConn, serverKey, testProtocolVersion, nil)
serverErr <- err
}()
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public())
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public(), testProtocolVersion)
if err != nil {
t.Fatalf("client connection failed: %v", err)
}
@@ -172,7 +172,7 @@ func TestTampering(t *testing.T) {
serverErr = make(chan error, 1)
)
go func() {
_, err := Server(context.Background(), serverConn, serverKey, nil)
_, err := Server(context.Background(), serverConn, serverKey, testProtocolVersion, nil)
// If the server failed, we have to close the Conn to
// unblock the client.
if err != nil {
@@ -181,7 +181,7 @@ func TestTampering(t *testing.T) {
serverErr <- err
}()
_, err := Client(context.Background(), clientConn, clientKey, serverKey.Public())
_, err := Client(context.Background(), clientConn, clientKey, serverKey.Public(), testProtocolVersion)
if err == nil {
t.Fatal("client connection succeeded despite tampering")
}
@@ -200,11 +200,11 @@ func TestTampering(t *testing.T) {
serverErr = make(chan error, 1)
)
go func() {
_, err := Server(context.Background(), serverConn, serverKey, nil)
_, err := Server(context.Background(), serverConn, serverKey, testProtocolVersion, nil)
serverErr <- err
}()
_, err := Client(context.Background(), clientConn, clientKey, serverKey.Public())
_, err := Client(context.Background(), clientConn, clientKey, serverKey.Public(), testProtocolVersion)
if err == nil {
t.Fatal("client connection succeeded despite tampering")
}
@@ -225,13 +225,13 @@ func TestTampering(t *testing.T) {
serverErr = make(chan error, 1)
)
go func() {
server, err := Server(context.Background(), serverConn, serverKey, nil)
server, err := Server(context.Background(), serverConn, serverKey, testProtocolVersion, nil)
serverErr <- err
_, err = io.WriteString(server, strings.Repeat("a", 14))
serverErr <- err
}()
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public())
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public(), testProtocolVersion)
if err != nil {
t.Fatalf("client handshake failed: %v", err)
}
@@ -266,7 +266,7 @@ func TestTampering(t *testing.T) {
serverErr = make(chan error, 1)
)
go func() {
server, err := Server(context.Background(), serverConn, serverKey, nil)
server, err := Server(context.Background(), serverConn, serverKey, testProtocolVersion, nil)
serverErr <- err
var bs [100]byte
// The server needs a timeout if the tampering is hitting the length header.
@@ -281,7 +281,7 @@ func TestTampering(t *testing.T) {
}
}()
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public())
client, err := Client(context.Background(), clientConn, clientKey, serverKey.Public(), testProtocolVersion)
if err != nil {
t.Fatalf("client handshake failed: %v", err)
}