diff options
Diffstat (limited to 'src/net/ip_test.zig')
| -rw-r--r-- | src/net/ip_test.zig | 3029 |
1 files changed, 3029 insertions, 0 deletions
diff --git a/src/net/ip_test.zig b/src/net/ip_test.zig new file mode 100644 index 0000000..3e4c1f7 --- /dev/null +++ b/src/net/ip_test.zig @@ -0,0 +1,3029 @@ +//! Host tests for the IPv4 stack. +//! +//! This is the one slice of the P4 bring-up that can be *proven* without the board, and this file is +//! the proof. The stack takes frames through `onFrame` and time through `tick`, so a network here is +//! a function that writes bytes by hand and reads back whatever the stack handed to its `send` +//! callback. Nothing is mocked, nothing is stubbed: the code under test is the code that will run on +//! the die, byte for byte. +//! +//! Two rules keep this honest: +//! +//! * **The headers are re-derived here.** These tests do not import `ip.zig`'s offset tables; they +//! write literal offsets taken from the RFCs and from lwIP's packed structs. A test that shared +//! the constant it was checking would pass on a consistent misreading of the RFC, which is +//! exactly the failure mode this stack has to avoid. Where the two transcriptions disagree, one +//! of them is wrong and the test says so. +//! * **Every checksum is verified, never merely computed.** A checksum built by the same helper +//! the stack uses would prove nothing. `verify` below sums the received bytes independently and +//! asserts the fold is zero, which is the property a peer's kernel will check. +//! +//! Run with: zig build test + +const std = @import("std"); +const testing = std.testing; +const ip = @import("ip.zig"); + +// ============================================================================ capture rig +// +// `Stack.init` takes `*const fn ([]const u8) void` - no context pointer - so the captured frames +// have to live somewhere a plain function can reach. That is a wart in the interface, not in the +// stack, and the cost is this file-scope buffer. + +const cap_max = 32; +var cap_bytes: [cap_max][ip.frame_max]u8 = undefined; +var cap_lens: [cap_max]usize = undefined; +var cap_n: usize = 0; +var cap_over: usize = 0; + +fn capture(frame: []const u8) void { + if (cap_n == cap_max) { + cap_over += 1; + return; + } + @memcpy(cap_bytes[cap_n][0..frame.len], frame); + cap_lens[cap_n] = frame.len; + cap_n += 1; +} + +fn clearCapture() void { + cap_n = 0; + cap_over = 0; +} + +fn sent(i: usize) []const u8 { + return cap_bytes[i][0..cap_lens[i]]; +} + +fn lastSent() []const u8 { + return sent(cap_n - 1); +} + +/// A stack with a MAC and an empty capture log. Every test starts here. +fn newStack() ip.Stack { + clearCapture(); + return .init(our_mac, capture); +} + +const our_mac: ip.Mac = .{ 0x40, 0x4c, 0xca, 0xfe, 0x00, 0x01 }; +const gw_mac: ip.Mac = .{ 0x02, 0x00, 0x00, 0x11, 0x22, 0x33 }; +const peer_mac: ip.Mac = .{ 0x02, 0x00, 0x00, 0xaa, 0xbb, 0xcc }; +const our_ip: ip.Ip4 = .{ 192, 168, 1, 42 }; +const gw_ip: ip.Ip4 = .{ 192, 168, 1, 1 }; +const mask24: ip.Ip4 = .{ 255, 255, 255, 0 }; +const peer_ip: ip.Ip4 = .{ 192, 168, 1, 90 }; +const off_net_ip: ip.Ip4 = .{ 93, 184, 216, 34 }; +const bcast_mac: ip.Mac = .{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; +/// RFC 826: the target hardware address of a request is "don't care". +const zero_mac: ip.Mac = .{ 0, 0, 0, 0, 0, 0 }; + +// ================================================================== independent primitives +// +// Header offsets written out again, from the RFCs. See the note at the top of the file. + +/// RFC 1071. Written differently from `ip.Checksum` on purpose: a `u32` accumulator over +/// `readInt`-free manual pairing, so a mistake in one is not a mistake in both. +fn sum16(bytes: []const u8) u32 { + var s: u32 = 0; + var i: usize = 0; + while (i + 1 < bytes.len) : (i += 2) { + s += (@as(u32, bytes[i]) << 8) | bytes[i + 1]; + } + if (i < bytes.len) s += @as(u32, bytes[i]) << 8; + while (s >> 16 != 0) s = (s & 0xffff) + (s >> 16); + return s; +} + +/// The property every receiver relies on: a buffer that already contains its own checksum sums to +/// 0xffff, so the complement is zero. +fn verify(bytes: []const u8) !void { + try testing.expectEqual(@as(u32, 0xffff), sum16(bytes)); +} + +fn verifyTransport(src: ip.Ip4, dst: ip.Ip4, proto: u8, seg: []const u8) !void { + var ph: [12]u8 = undefined; + @memcpy(ph[0..4], &src); + @memcpy(ph[4..8], &dst); + ph[8] = 0; + ph[9] = proto; + std.mem.writeInt(u16, ph[10..12], @intCast(seg.len), .big); + var s = sum16(&ph) + sum16(seg); + while (s >> 16 != 0) s = (s & 0xffff) + (s >> 16); + try testing.expectEqual(@as(u32, 0xffff), s); +} + +fn be16(b: []const u8, off: usize) u16 { + return std.mem.readInt(u16, b[off..][0..2], .big); +} +fn be32(b: []const u8, off: usize) u32 { + return std.mem.readInt(u32, b[off..][0..4], .big); +} +fn put16(b: []u8, off: usize, v: u16) void { + std.mem.writeInt(u16, b[off..][0..2], v, .big); +} +fn put32(b: []u8, off: usize, v: u32) void { + std.mem.writeInt(u32, b[off..][0..4], v, .big); +} + +/// A scratch frame under construction. `len` is the total frame length. +const Frame = struct { + buf: [ip.frame_max]u8 = undefined, + len: usize = 0, + + /// Ethernet II: 6 destination, 6 source, 2 ethertype. RFC 894 / lwIP `prot/ethernet.h:76-83`. + fn eth(self: *Frame, dst: ip.Mac, src: ip.Mac, ethertype: u16) void { + @memcpy(self.buf[0..6], &dst); + @memcpy(self.buf[6..12], &src); + put16(&self.buf, 12, ethertype); + self.len = 14; + } + + /// RFC 791 3.1. Fills the header and returns the payload slice to be written; the caller then + /// calls `sealIp`. + fn ip4(self: *Frame, src: ip.Ip4, dst: ip.Ip4, proto: u8, payload_len: usize) []u8 { + const h = self.buf[14..][0..20]; + h[0] = 0x45; + h[1] = 0; + put16(h, 2, @intCast(20 + payload_len)); + put16(h, 4, 0x1234); + put16(h, 6, 0); + h[8] = 64; + h[9] = proto; + put16(h, 10, 0); + @memcpy(h[12..16], &src); + @memcpy(h[16..20], &dst); + self.len = 14 + 20 + payload_len; + return self.buf[34 .. 34 + payload_len]; + } + + fn sealIp(self: *Frame) void { + const h = self.buf[14..][0..20]; + put16(h, 10, 0); + put16(h, 10, ~@as(u16, @truncate(sum16(h)))); + } + + /// Fill in a UDP or TCP checksum over the pseudo-header plus the segment. + fn sealTransport(self: *Frame, chksum_off: usize) void { + const h = self.buf[14..][0..20]; + const proto = h[9]; + const seg = self.buf[34..self.len]; + var ph: [12]u8 = undefined; + @memcpy(ph[0..4], h[12..16]); + @memcpy(ph[4..8], h[16..20]); + ph[8] = 0; + ph[9] = proto; + std.mem.writeInt(u16, ph[10..12], @intCast(seg.len), .big); + put16(seg, chksum_off, 0); + var s = sum16(&ph) + sum16(seg); + while (s >> 16 != 0) s = (s & 0xffff) + (s >> 16); + put16(seg, chksum_off, ~@as(u16, @truncate(s))); + self.sealIp(); + } + + fn bytes(self: *const Frame) []const u8 { + return self.buf[0..self.len]; + } +}; + +/// RFC 826 packet format, 28 bytes. lwIP `prot/etharp.h:86-96`. +fn arpFrame(opcode: u16, sha: ip.Mac, spa: ip.Ip4, tha: ip.Mac, tpa: ip.Ip4, eth_dst: ip.Mac) Frame { + var f: Frame = .{}; + f.eth(eth_dst, sha, 0x0806); + const a = f.buf[14..][0..28]; + put16(a, 0, 1); // hwtype: Ethernet + put16(a, 2, 0x0800); // proto: IPv4 + a[4] = 6; + a[5] = 4; + put16(a, 6, opcode); + @memcpy(a[8..14], &sha); + @memcpy(a[14..18], &spa); + @memcpy(a[18..24], &tha); + @memcpy(a[24..28], &tpa); + f.len = 14 + 28; + return f; +} + +/// RFC 792 echo. `payload` is the data after the 8-byte header. +fn icmpEchoFrame(src: ip.Ip4, dst: ip.Ip4, id: u16, seq: u16, payload: []const u8) Frame { + var f: Frame = .{}; + f.eth(our_mac, peer_mac, 0x0800); + const p = f.ip4(src, dst, 1, 8 + payload.len); + p[0] = 8; // echo request + p[1] = 0; + put16(p, 2, 0); + put16(p, 4, id); + put16(p, 6, seq); + @memcpy(p[8..], payload); + // ICMP has no pseudo-header (RFC 792): the checksum covers the message alone. + put16(p, 2, ~@as(u16, @truncate(sum16(p)))); + f.sealIp(); + return f; +} + +// ================================================================================= checksum + +test "RFC 1071 worked example" { + // RFC 1071 section 3, the byte sequence spelled out in the document's own figure: + // 00 01 f2 03 f4 f5 f6 f7 -> sum ddf2, checksum 220d + const data = [_]u8{ 0x00, 0x01, 0xf2, 0x03, 0xf4, 0xf5, 0xf6, 0xf7 }; + try testing.expectEqual(@as(u32, 0xddf2), sum16(&data)); + try testing.expectEqual(@as(u16, 0x220d), ip.checksum(&data)); +} + +test "checksum: incremental feeding matches contiguous, including at odd boundaries" { + // The bug this catches is a chunk of odd length leaving the high byte of a word unaccounted + // for. Splitting at every possible offset is cheap and total. + const data = [_]u8{ 0x45, 0x00, 0x00, 0x54, 0xab, 0xcd, 0x40, 0x00, 0x40, 0x01, 0x00, 0x00, 0xc0, 0xa8, 0x01, 0x2a, 0xc0, 0xa8, 0x01, 0x01, 0x7f }; + const want = ip.checksum(&data); + var split: usize = 0; + while (split <= data.len) : (split += 1) { + var c: ip.Checksum = .{}; + c.update(data[0..split]); + c.update(data[split..]); + try testing.expectEqual(want, c.final()); + } + // Three-way split too, so two consecutive odd chunks are exercised. + var i: usize = 0; + while (i < data.len) : (i += 1) { + var j: usize = i; + while (j < data.len) : (j += 1) { + var c: ip.Checksum = .{}; + c.update(data[0..i]); + c.update(data[i..j]); + c.update(data[j..]); + try testing.expectEqual(want, c.final()); + } + } +} + +test "checksum: an odd-length buffer is padded with a zero byte, not with the previous byte" { + // RFC 1071 section 1. A three-byte buffer must checksum as if it were four with a trailing 0. + const odd = [_]u8{ 0xde, 0xad, 0xbe }; + const padded = [_]u8{ 0xde, 0xad, 0xbe, 0x00 }; + try testing.expectEqual(ip.checksum(&padded), ip.checksum(&odd)); +} + +test "checksum: an all-zero buffer checksums to 0xffff, never to 0x0000" { + // A transmitted zero means "no checksum" in UDP, so the distinction is load-bearing. + const zeros: [20]u8 = @splat(0); + try testing.expectEqual(@as(u16, 0xffff), ip.checksum(&zeros)); +} + +test "checksum: RFC 768's transmitted zero is sent as 0xffff" { + // A UDP checksum field of zero means "not computed", so a datagram whose checksum genuinely + // works out to zero must transmit the arithmetically equivalent 0xffff instead. Tested on the + // helper because the case cannot be provoked by choosing DHCP option bytes: it depends on the + // whole datagram, headers included, summing to exactly 0xffff. + try testing.expectEqual(@as(u16, 0xffff), ip.udpChecksumOnWire(0)); + try testing.expectEqual(@as(u16, 0xffff), ip.udpChecksumOnWire(0xffff)); + try testing.expectEqual(@as(u16, 0x1234), ip.udpChecksumOnWire(0x1234)); +} + +test "checksum: a real IPv4 header verifies to zero once its own checksum is in place" { + var h = [_]u8{ 0x45, 0x00, 0x00, 0x3c, 0x1c, 0x46, 0x40, 0x00, 0x40, 0x06, 0x00, 0x00, 0xac, 0x10, 0x0a, 0x63, 0xac, 0x10, 0x0a, 0x0c }; + const c = ip.checksum(&h); + put16(&h, 10, c); + try verify(&h); + // And the classic published value for this header, from the Wikipedia/Comer worked example. + try testing.expectEqual(@as(u16, 0xb1e6), c); +} + +// ====================================================================================== ARP + +test "ARP: a request for our address is answered, and the reply is well formed" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + // setStatic announces; drop that so the reply is the only frame under test. + clearCapture(); + + var req = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(req.bytes()); + + try testing.expectEqual(@as(usize, 1), cap_n); + const r = lastSent(); + try testing.expectEqual(@as(usize, 42), r.len); + // Unicast back to the requester, not broadcast: a broadcast reply is legal but wasteful, and + // every stack on the segment would have to parse it. + try testing.expectEqualSlices(u8, &peer_mac, r[0..6]); + try testing.expectEqualSlices(u8, &our_mac, r[6..12]); + try testing.expectEqual(@as(u16, 0x0806), be16(r, 12)); + + const a = r[14..42]; + try testing.expectEqual(@as(u16, 1), be16(a, 0)); // hwtype Ethernet + try testing.expectEqual(@as(u16, 0x0800), be16(a, 2)); // proto IPv4 + try testing.expectEqual(@as(u8, 6), a[4]); + try testing.expectEqual(@as(u8, 4), a[5]); + try testing.expectEqual(@as(u16, 2), be16(a, 6)); // reply + try testing.expectEqualSlices(u8, &our_mac, a[8..14]); // sender hw = us + try testing.expectEqualSlices(u8, &our_ip, a[14..18]); // sender proto = us + try testing.expectEqualSlices(u8, &peer_mac, a[18..24]); // target hw = requester + try testing.expectEqualSlices(u8, &peer_ip, a[24..28]); +} + +test "ARP: a request for somebody else's address is ignored" { + var s = newStack(); + s.setStatic(our_ip, mask24, gw_ip); + clearCapture(); + var req = arpFrame(1, peer_mac, peer_ip, zero_mac, .{ 192, 168, 1, 77 }, bcast_mac); + s.onFrame(req.bytes()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "ARP: a malformed header is rejected on all four RFC 826 reception checks" { + const bad_fields = [_]struct { off: usize, val: u8 }{ + .{ .off = 1, .val = 2 }, // hwtype 2, not Ethernet + .{ .off = 3, .val = 0x06 }, // proto 0x0806, not IPv4 + .{ .off = 4, .val = 8 }, // hwlen 8 + .{ .off = 5, .val = 16 }, // protolen 16 + }; + for (bad_fields) |bad| { + var s = newStack(); + s.setStatic(our_ip, mask24, gw_ip); + clearCapture(); + var req = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + req.buf[14 + bad.off] = bad.val; + s.onFrame(req.bytes()); + try testing.expectEqual(@as(usize, 0), cap_n); + } +} + +test "ARP: setStatic announces the address gratuitously" { + var s = newStack(); + s.tick(500); + s.setStatic(our_ip, mask24, gw_ip); + try testing.expectEqual(@as(usize, 1), cap_n); + const g = lastSent(); + try testing.expectEqualSlices(u8, &bcast_mac, g[0..6]); + try testing.expectEqual(@as(u16, 0x0806), be16(g, 12)); + const a = g[14..42]; + try testing.expectEqual(@as(u16, 1), be16(a, 6)); // a request... + try testing.expectEqualSlices(u8, &our_ip, a[14..18]); // ...whose sender... + try testing.expectEqualSlices(u8, &our_ip, a[24..28]); // ...and target are both us +} + +test "ARP: a four-entry cache is not thrashed by unrelated broadcast traffic" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + + // Learn the gateway the legitimate way: it ARPs for us, we reply, and it goes in the cache. + var probe = arpFrame(1, gw_mac, gw_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + + // Now flood the segment with ARP between other hosts. None of it is addressed to us, so none + // of it may evict the gateway. + var k: u8 = 0; + while (k < 20) : (k += 1) { + var noise = arpFrame( + 1, + .{ 0x02, 0, 0, 0, 0, k }, + .{ 192, 168, 1, 100 + k }, + zero_mac, + .{ 192, 168, 1, 200 }, + bcast_mac, + ); + s.onFrame(noise.bytes()); + } + clearCapture(); + + // If the gateway survived, a datagram to an off-net address goes straight out to `gw_mac` + // instead of provoking an ARP request. + var echo = icmpEchoFrame(gw_ip, our_ip, 1, 1, "x"); + s.onFrame(echo.bytes()); + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqual(@as(u16, 0x0800), be16(lastSent(), 12)); // IPv4, not an ARP request + try testing.expectEqualSlices(u8, &gw_mac, lastSent()[0..6]); +} + +test "ARP: a cache entry ages out even while it is being used" { + // The bug this pins: refreshing an entry's timestamp on every lookup. It looks harmless and it + // means an entry kept alive by our own traffic is never re-resolved, so a gateway whose MAC + // changes is never noticed. + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + + // Keep using the entry, all the way past the 300 s age limit. + var now: u64 = 1000; + while (now < 400_000) : (now += 10_000) { + s.tick(now); + clearCapture(); + var echo = icmpEchoFrame(peer_ip, our_ip, 1, 1, "x"); + s.onFrame(echo.bytes()); + try testing.expectEqual(@as(usize, 1), cap_n); + } + // Past the limit the entry is gone: the reply is dropped and an ARP request goes in its place. + try testing.expectEqual(@as(u16, 0x0806), be16(lastSent(), 12)); + try testing.expectEqualSlices(u8, &peer_ip, lastSent()[14 + 24 ..][0..4]); +} + +test "ARP: a host that changes its MAC is followed" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + + // Same address, new hardware: a replaced router, or a VRRP failover. + const new_mac: ip.Mac = .{ 0x02, 0x00, 0x00, 0xde, 0xad, 0x01 }; + var again = arpFrame(1, new_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(again.bytes()); + clearCapture(); + + var echo = icmpEchoFrame(peer_ip, our_ip, 1, 1, "x"); + s.onFrame(echo.bytes()); + try testing.expectEqualSlices(u8, &new_mac, lastSent()[0..6]); +} + +test "IPv4: a received header carrying options is parsed by its own length field" { + // `ping -R` and any router-alert path produce these. A parser that assumes 20 bytes reads the + // options as the ICMP header and answers nonsense - or, worse, answers with the checksum + // covering the wrong bytes. + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + // 24-byte header: 20 plus a 4-byte NOP,NOP,NOP,END option block. + var f: Frame = .{}; + f.eth(our_mac, peer_mac, 0x0800); + const total = 24 + 8 + 4; + const h = f.buf[14..][0..24]; + h[0] = 0x46; // IPv4, 6 words of header + h[1] = 0; + put16(h, 2, total); + put16(h, 4, 0x1234); + put16(h, 6, 0); + h[8] = 64; + h[9] = 1; // ICMP + put16(h, 10, 0); + @memcpy(h[12..16], &peer_ip); + @memcpy(h[16..20], &our_ip); + h[20] = 1; // NOP + h[21] = 1; + h[22] = 1; + h[23] = 0; // END + put16(h, 10, ~@as(u16, @truncate(sum16(h)))); + const m = f.buf[14 + 24 ..][0 .. 8 + 4]; + m[0] = 8; + m[1] = 0; + put16(m, 2, 0); + put16(m, 4, 0x0102); + put16(m, 6, 0x0304); + @memcpy(m[8..], "wxyz"); + put16(m, 2, ~@as(u16, @truncate(sum16(m)))); + f.len = 14 + total; + s.onFrame(f.bytes()); + + try testing.expectEqual(@as(usize, 1), cap_n); + const r = lastSent(); + // The reply is emitted with a plain 20-byte header - nothing here generates options - and the + // echoed id, sequence and data prove the request's payload was found at the right offset. + try testing.expectEqual(@as(u8, 0x45), r[14]); + try verify(r[14..34]); + const e = r[34..]; + try testing.expectEqual(@as(u8, 0), e[0]); + try testing.expectEqual(@as(u16, 0x0102), be16(e, 4)); + try testing.expectEqual(@as(u16, 0x0304), be16(e, 6)); + try testing.expectEqualStrings("wxyz", e[8..12]); + try verify(e); +} + +// ===================================================================================== ICMP + +test "ICMP: an echo request is answered with a correct echo reply" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + clearCapture(); + // Teach the stack the peer's MAC by having it ARP for us first. + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + // The payload `ping` sends: 56 bytes, a timestamp then a counting pattern. + var payload: [56]u8 = undefined; + for (&payload, 0..) |*b, i| b.* = @intCast(i); + var req = icmpEchoFrame(peer_ip, our_ip, 0xbeef, 7, &payload); + s.onFrame(req.bytes()); + + try testing.expectEqual(@as(usize, 1), cap_n); + const r = lastSent(); + try testing.expectEqual(@as(usize, 14 + 20 + 8 + 56), r.len); + try testing.expectEqualSlices(u8, &peer_mac, r[0..6]); + try testing.expectEqual(@as(u16, 0x0800), be16(r, 12)); + + const h = r[14..34]; + try testing.expectEqual(@as(u8, 0x45), h[0]); + try testing.expectEqual(@as(u16, 20 + 8 + 56), be16(h, 2)); + try testing.expectEqual(@as(u8, 1), h[9]); // ICMP + // RFC 1122 3.2.1.7 recommends 64. A TTL of 1 is the failure that works on the bench and dies + // at the first router, which is the worst possible time to find out. + try testing.expectEqual(@as(u8, 64), h[8]); + // Don't Fragment: this stack neither fragments nor reassembles, so a router must not fragment + // what it cannot rebuild. + try testing.expectEqual(@as(u16, 0x4000), be16(h, 6)); + try testing.expectEqualSlices(u8, &our_ip, h[12..16]); // src and dst swapped + try testing.expectEqualSlices(u8, &peer_ip, h[16..20]); + try verify(h); // the IP header checksum, checked independently + + const m = r[34..]; + try testing.expectEqual(@as(u8, 0), m[0]); // echo reply + try testing.expectEqual(@as(u8, 0), m[1]); + try testing.expectEqual(@as(u16, 0xbeef), be16(m, 4)); // id echoed + try testing.expectEqual(@as(u16, 7), be16(m, 6)); // sequence echoed + try testing.expectEqualSlices(u8, &payload, m[8..]); + try verify(m); // and the ICMP checksum +} + +test "ICMP: a request with a bad IP header checksum is dropped and counted" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + var req = icmpEchoFrame(peer_ip, our_ip, 1, 1, "abcd"); + req.buf[14 + 10] ^= 0xff; // corrupt the IP header checksum + s.onFrame(req.bytes()); + try testing.expectEqual(@as(usize, 0), cap_n); + try testing.expectEqual(@as(u32, 1), s.counters.checksum_bad); +} + +test "ICMP: a request with a bad ICMP checksum is dropped and counted" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + var req = icmpEchoFrame(peer_ip, our_ip, 1, 1, "abcd"); + req.buf[34 + 2] ^= 0xff; // corrupt the ICMP checksum + s.onFrame(req.bytes()); + try testing.expectEqual(@as(usize, 0), cap_n); + try testing.expectEqual(@as(u32, 1), s.counters.checksum_bad); +} + +test "ICMP: a fragment is dropped rather than answered as a whole datagram" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_mac, peer_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + var req = icmpEchoFrame(peer_ip, our_ip, 1, 1, "abcd"); + put16(&req.buf, 14 + 6, 0x2000); // MF set + req.sealIp(); + s.onFrame(req.bytes()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "a frame addressed to another station is dropped" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + clearCapture(); + var req = icmpEchoFrame(peer_ip, our_ip, 1, 1, "abcd"); + req.buf[0] = 0x02; // not our MAC, not broadcast + s.onFrame(req.bytes()); + try testing.expectEqual(@as(usize, 0), cap_n); + try testing.expect(s.counters.rx_dropped >= 1); +} + +// ===================================================================================== DHCP +// +// RFC 2131. The synthetic server below is what a real one does with the fields that matter, and +// nothing else: no relay agent, no overload, no vendor options. + +/// Offsets into the BOOTP message, from RFC 2131 figure 1 / lwIP `prot/dhcp.h:50-91`. +const d = struct { + const op = 0; + const htype = 1; + const hlen = 2; + const xid = 4; + const secs = 8; + const flags = 10; + const ciaddr = 12; + const yiaddr = 16; + const siaddr = 20; + const chaddr = 28; + const cookie = 236; + const options = 240; +}; + +fn dhcpReply(kind: u8, xid: u32, yiaddr: ip.Ip4, server: ip.Ip4, opts: []const u8, dst_ip: ip.Ip4, dst_mac: ip.Mac) Frame { + var f: Frame = .{}; + f.eth(dst_mac, gw_mac, 0x0800); + const payload_len = 8 + d.options + 3 + opts.len + 1; + const p = f.ip4(server, dst_ip, 17, payload_len); + put16(p, 0, 67); // source port: DHCP server + put16(p, 2, 68); // destination port: DHCP client + put16(p, 4, @intCast(payload_len)); + put16(p, 6, 0); + const m = p[8..]; + @memset(m, 0); + m[d.op] = 2; // BOOTREPLY + m[d.htype] = 1; + m[d.hlen] = 6; + put32(m, d.xid, xid); + @memcpy(m[d.yiaddr..][0..4], &yiaddr); + @memcpy(m[d.siaddr..][0..4], &server); + @memcpy(m[d.chaddr..][0..6], &our_mac); + put32(m, d.cookie, 0x63825363); + m[d.options] = 53; // message type + m[d.options + 1] = 1; + m[d.options + 2] = kind; + @memcpy(m[d.options + 3 ..][0..opts.len], opts); + m[d.options + 3 + opts.len] = 255; // END + f.sealTransport(6); + return f; +} + +/// Option 1 (mask), 3 (router), 6 (DNS), 51 (lease), 54 (server id) for the network in the brief. +const standard_opts = [_]u8{ + 1, 4, 255, 255, 255, 0, // subnet mask /24 + 3, 4, 192, 168, 1, 1, // router + 6, 4, 192, 168, 1, 1, // DNS + 51, 4, 0, 0, 0x1c, 0x20, // lease 7200 s + 54, 4, 192, 168, 1, 1, // server identifier +}; + +fn findOption(msg: []const u8, want: u8) ?[]const u8 { + var i: usize = d.options; + while (i < msg.len) { + if (msg[i] == 255) return null; + if (msg[i] == 0) { + i += 1; + continue; + } + if (i + 2 > msg.len) return null; + const len = msg[i + 1]; + if (i + 2 + len > msg.len) return null; + if (msg[i] == want) return msg[i + 2 ..][0..len]; + i += 2 + len; + } + return null; +} + +/// The DHCP message inside a captured frame, and a few sanity checks that apply to all of them. +fn dhcpOut(frame: []const u8) ![]const u8 { + try testing.expectEqual(@as(u16, 0x0800), be16(frame, 12)); + const h = frame[14..34]; + try testing.expectEqual(@as(u8, 17), h[9]); // UDP + try verify(h); + const seg = frame[34..]; + try testing.expectEqual(@as(u16, 68), be16(seg, 0)); // from the client port + try testing.expectEqual(@as(u16, 67), be16(seg, 2)); // to the server port + try testing.expectEqual(@as(u16, @intCast(seg.len)), be16(seg, 4)); + try verifyTransport(h[12..16].*, h[16..20].*, 17, seg); + const msg = seg[8..]; + try testing.expectEqual(@as(u8, 1), msg[d.op]); // BOOTREQUEST + try testing.expectEqual(@as(u8, 1), msg[d.htype]); // Ethernet + try testing.expectEqual(@as(u8, 6), msg[d.hlen]); + try testing.expectEqual(@as(u32, 0x63825363), be32(msg, d.cookie)); + try testing.expectEqualSlices(u8, &our_mac, msg[d.chaddr..][0..6]); + // RFC 951: a BOOTP message is at least 300 bytes. + try testing.expect(msg.len >= 300); + return msg; +} + +test "DHCP: a full DISCOVER / OFFER / REQUEST / ACK exchange binds the address" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); + + // ---- DISCOVER + try testing.expectEqual(@as(usize, 1), cap_n); + const disc_frame = sent(0); + // Broadcast at both layers: no address yet, so nothing else could work. + try testing.expectEqualSlices(u8, &bcast_mac, disc_frame[0..6]); + try testing.expectEqualSlices(u8, &.{ 0, 0, 0, 0 }, disc_frame[14 + 12 ..][0..4]); + try testing.expectEqualSlices(u8, &.{ 255, 255, 255, 255 }, disc_frame[14 + 16 ..][0..4]); + const disc = try dhcpOut(disc_frame); + try testing.expectEqual(@as(u16, 0x8000), be16(disc, d.flags)); // ask for a broadcast reply + try testing.expectEqualSlices(u8, &.{ 0, 0, 0, 0 }, disc[d.ciaddr..][0..4]); + try testing.expectEqualSlices(u8, &.{1}, findOption(disc, 53).?); // DHCPDISCOVER + try testing.expect(findOption(disc, 55) != null); // parameter request list + try testing.expect(findOption(disc, 57) != null); // maximum message size + // A DISCOVER must not claim an address or name a server. + try testing.expect(findOption(disc, 50) == null); + try testing.expect(findOption(disc, 54) == null); + const xid = be32(disc, d.xid); + + // ---- OFFER, unicast to the address about to be granted (RFC 2131 4.1 permits this, and it is + // the case that only works because `ip4Input` lets UDP through while unbound). + clearCapture(); + var offer = dhcpReply(2, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(offer.bytes()); + try testing.expectEqual(ip.DhcpState.requesting, s.dhcpState()); + + // ---- REQUEST + try testing.expectEqual(@as(usize, 1), cap_n); + const req = try dhcpOut(sent(0)); + try testing.expectEqual(xid, be32(req, d.xid)); // same transaction + try testing.expectEqualSlices(u8, &.{3}, findOption(req, 53).?); // DHCPREQUEST + // RFC 2131 4.3.2: SELECTING carries the offered address in option 50 and the server it is + // accepting in option 54, and `ciaddr` stays zero. + try testing.expectEqualSlices(u8, &our_ip, findOption(req, 50).?); + try testing.expectEqualSlices(u8, &gw_ip, findOption(req, 54).?); + try testing.expectEqualSlices(u8, &.{ 0, 0, 0, 0 }, req[d.ciaddr..][0..4]); + + // ---- ACK + clearCapture(); + var ack = dhcpReply(5, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(ack.bytes()); + + try testing.expectEqual(ip.DhcpState.bound, s.dhcpState()); + try testing.expectEqual(our_ip, s.ip().?); + try testing.expectEqual(mask24, s.netmask()); + try testing.expectEqual(gw_ip, s.gateway()); + try testing.expectEqual(gw_ip, s.dnsServer().?); + // Binding announces the new address. + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqual(@as(u16, 0x0806), be16(lastSent(), 12)); + try testing.expectEqualSlices(u8, &our_ip, lastSent()[14 + 14 ..][0..4]); +} + +test "DHCP: a reply with the wrong transaction id is ignored" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + var offer = dhcpReply(2, xid ^ 0xffff_ffff, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(offer.bytes()); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "DHCP: a reply for another station's hardware address is ignored" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + var offer = dhcpReply(2, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + offer.buf[34 + 8 + d.chaddr + 5] ^= 0xff; // a different chaddr + offer.sealTransport(6); + s.onFrame(offer.bytes()); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "DHCP: DISCOVER is retransmitted with a growing backoff and the same transaction id" { + var s = newStack(); + s.tick(0); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + + // Nothing before the first backoff expires. + s.tick(1_999); + try testing.expectEqual(@as(usize, 0), cap_n); + s.tick(2_000); + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqual(xid, be32(sent(0)[42..], d.xid)); + + // The next interval is longer: nothing at +2 s, a frame at +4 s. + s.tick(5_999); + try testing.expectEqual(@as(usize, 1), cap_n); + s.tick(6_000); + try testing.expectEqual(@as(usize, 2), cap_n); + + // And the `secs` field tracks how long acquisition has been going. + try testing.expectEqual(@as(u16, 6), be16(sent(1)[42..], d.secs)); +} + +test "DHCP: a NAK surrenders the address and restarts from DISCOVER" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + var offer = dhcpReply(2, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(offer.bytes()); + clearCapture(); + + var nak = dhcpReply(6, xid, .{ 0, 0, 0, 0 }, gw_ip, &.{}, ip.ip_broadcast, bcast_mac); + s.onFrame(nak.bytes()); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); + try testing.expect(s.ip() == null); + // And a fresh DISCOVER went out immediately. + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqualSlices(u8, &.{1}, findOption(try dhcpOut(sent(0)), 53).?); +} + +test "DHCP: at T1 the lease is renewed by unicast REQUEST with ciaddr set" { + var s = newStack(); + s.tick(0); + s.dhcpStart(); + const xid0 = be32(sent(0)[42..], d.xid); + var offer = dhcpReply(2, xid0, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(offer.bytes()); + var ack = dhcpReply(5, xid0, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(ack.bytes()); + try testing.expectEqual(ip.DhcpState.bound, s.dhcpState()); + + // Lease 7200 s, so T1 = 3600 s (lwIP `core/ipv4/dhcp.c:757`: half the lease). + clearCapture(); + s.tick(3_599_000); + try testing.expectEqual(@as(usize, 0), cap_n); + try testing.expectEqual(ip.DhcpState.bound, s.dhcpState()); + + // T1. The REQUEST is unicast to the server, so it needs the server's MAC first: with the cache + // empty, the datagram is dropped and an ARP request goes out in its place. + s.tick(3_600_000); + try testing.expectEqual(ip.DhcpState.renewing, s.dhcpState()); + try testing.expectEqual(@as(u16, 0x0806), be16(sent(0), 12)); + try testing.expectEqualSlices(u8, &gw_ip, sent(0)[14 + 24 ..][0..4]); // ARP for the server + + // The server answers by ARPing for us, which is enough to populate the cache. + var probe = arpFrame(1, gw_mac, gw_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + // The next retransmission now has a route. + s.tick(3_602_000); + try testing.expectEqual(@as(usize, 1), cap_n); + const r = lastSent(); + try testing.expectEqualSlices(u8, &gw_mac, r[0..6]); // unicast to the server + try testing.expectEqualSlices(u8, &gw_ip, r[14 + 16 ..][0..4]); + const msg = try dhcpOut(r); + try testing.expectEqualSlices(u8, &.{3}, findOption(msg, 53).?); // DHCPREQUEST + // RFC 2131 4.3.6, the RENEWING column: ciaddr carries the bound address, and there is no + // requested-IP option and no server identifier. + try testing.expectEqualSlices(u8, &our_ip, msg[d.ciaddr..][0..4]); + try testing.expect(findOption(msg, 50) == null); + try testing.expect(findOption(msg, 54) == null); + // A fresh transaction id for the new exchange (RFC 2131 4.4.5). + try testing.expect(be32(msg, d.xid) != xid0); + + // The server ACKs and the lease is extended from now. + const xid1 = be32(msg, d.xid); + clearCapture(); + var ack2 = dhcpReply(5, xid1, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(ack2.bytes()); + try testing.expectEqual(ip.DhcpState.bound, s.dhcpState()); + try testing.expectEqual(our_ip, s.ip().?); +} + +test "DHCP: at T2 renewal becomes a broadcast rebind, and an expired lease is surrendered" { + var s = newStack(); + s.tick(0); + s.dhcpStart(); + const xid0 = be32(sent(0)[42..], d.xid); + var offer = dhcpReply(2, xid0, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(offer.bytes()); + var ack = dhcpReply(5, xid0, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(ack.bytes()); + + // Give the stack the server's MAC so the renewal is not blocked on ARP. + var probe = arpFrame(1, gw_mac, gw_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + + s.tick(3_600_000); // T1 + try testing.expectEqual(ip.DhcpState.renewing, s.dhcpState()); + + // T2 = 7/8 of 7200 s = 6300 s (lwIP `core/ipv4/dhcp.c:766`). + clearCapture(); + s.tick(6_300_000); + try testing.expectEqual(ip.DhcpState.rebinding, s.dhcpState()); + try testing.expectEqual(@as(usize, 1), cap_n); + // Rebinding is broadcast: the granting server is not answering, so ask anybody. + try testing.expectEqualSlices(u8, &bcast_mac, lastSent()[0..6]); + const msg = try dhcpOut(lastSent()); + try testing.expectEqualSlices(u8, &our_ip, msg[d.ciaddr..][0..4]); + try testing.expect(findOption(msg, 54) == null); + + // Lease expiry: the address must go, because the server may already have handed it out. + clearCapture(); + s.tick(7_200_000); + try testing.expect(s.ip() == null); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); +} + +test "DHCP: an option whose length runs past the datagram does not read off the end" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + // Option 54 - the server identifier, which the OFFER handler actually looks for - claiming 200 + // bytes of a message with three left. Unchecked, that is a 200-byte read past the end of the + // frame, which is the classic DHCP parser bug and is reachable by any host on the segment. + var offer = dhcpReply(2, xid, our_ip, gw_ip, &[_]u8{ 54, 200, 192, 168 }, our_ip, our_mac); + offer.sealTransport(6); + s.onFrame(offer.bytes()); + // The option did not resolve, so the handler fell back to `siaddr` - and the exchange carried + // on rather than crashing. + try testing.expectEqual(ip.DhcpState.requesting, s.dhcpState()); + try testing.expectEqual(@as(usize, 1), cap_n); + const req = try dhcpOut(sent(0)); + try testing.expectEqualSlices(u8, &gw_ip, findOption(req, 54).?); // from siaddr +} + +test "DHCP: an option truncated by one byte does not read off the end" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + // Length 4 with only three bytes of message left after it, counting the END marker. + var offer = dhcpReply(2, xid, our_ip, gw_ip, &[_]u8{ 54, 4, 192, 168 }, our_ip, our_mac); + offer.sealTransport(6); + s.onFrame(offer.bytes()); + try testing.expectEqual(ip.DhcpState.requesting, s.dhcpState()); +} + +test "DHCP: a bogus option before a good one does not hide it" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + // A zero-length option, then a pad, then the real server identifier. + var offer = dhcpReply(2, xid, our_ip, gw_ip, &[_]u8{ 12, 0, 0, 54, 4, 192, 168, 1, 1 }, our_ip, our_mac); + offer.sealTransport(6); + s.onFrame(offer.bytes()); + const req = try dhcpOut(sent(0)); + try testing.expectEqualSlices(u8, &gw_ip, findOption(req, 54).?); +} + +/// Cut `drop` bytes off the end of a UDP datagram and re-seal, so the last byte of the options is +/// wherever the caller wants it. `dhcpReply` always writes an END marker, and END is what stops a +/// well-behaved option walk - so the only way to test what happens when the walk reaches the end of +/// the buffer instead is to take the marker away. +fn truncateUdp(f: *Frame, drop: usize) void { + f.len -= drop; + const h = f.buf[14..][0..20]; + put16(h, 2, @intCast(f.len - 14)); + const seg = f.buf[34..f.len]; + put16(seg, 4, @intCast(seg.len)); + f.sealTransport(6); +} + +test "DHCP: an option code in the last byte, with no length byte after it, is not read past" { + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + // A hostname option, then a bare code 3 where a length byte should be. The END marker that + // `dhcpReply` appends is cut off, so the walk runs into the end of the datagram - and no + // option 54 is present, so the handler's search for the server identifier walks the whole + // list and reaches that last byte. Unchecked, reading its length byte is one past the frame. + var offer = dhcpReply(2, xid, our_ip, gw_ip, &[_]u8{ 12, 1, 'x', 3 }, our_ip, our_mac); + truncateUdp(&offer, 1); + s.onFrame(offer.bytes()); + // It read what it could and stopped, and fell back to `siaddr` for the server identifier. + try testing.expectEqual(ip.DhcpState.requesting, s.dhcpState()); + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqualSlices(u8, &gw_ip, findOption(try dhcpOut(sent(0)), 54).?); +} + +test "DHCP: a reply without the magic cookie is not a DHCP message" { + // RFC 2131 3: the four-byte cookie is what distinguishes a DHCP message from plain BOOTP. + // Without the check, any BOOTP reply - or any UDP datagram to port 68 that happens to have the + // right xid in the right place - is parsed as options. + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + var offer = dhcpReply(2, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + put32(&offer.buf, 34 + 8 + d.cookie, 0x63825364); // one off + offer.sealTransport(6); + s.onFrame(offer.bytes()); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "DHCP: a BOOTREQUEST is not mistaken for a reply" { + // Every DISCOVER on the segment is a broadcast, including our own. A client that does not check + // the `op` field parses its own request - or another client's - as an offer, and RFC 2131 gives + // it a `yiaddr` of zero to work with. + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const xid = be32(sent(0)[42..], d.xid); + clearCapture(); + var offer = dhcpReply(2, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + offer.buf[34 + 8 + d.op] = 1; // BOOTREQUEST + offer.sealTransport(6); + s.onFrame(offer.bytes()); + try testing.expectEqual(ip.DhcpState.selecting, s.dhcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +// ====================================================================================== TCP +// +// The synthetic peer. Sequence numbers here are the *peer's*; the stack's are read out of what it +// sends, because its ISN is not something a test may assume. + +/// Offsets into the TCP header, RFC 793 3.1 / lwIP `prot/tcp.h:56-65`. +const t = struct { + const src = 0; + const dst = 2; + const seq = 4; + const ack = 8; + const hdrlen_flags = 12; + const window = 14; + const chksum = 16; + + const fin: u8 = 0x01; + const syn: u8 = 0x02; + const rst: u8 = 0x04; + const psh: u8 = 0x08; + const ack_f: u8 = 0x10; +}; + +const Peer = struct { + ip: ip.Ip4, + port: u16, + mac: ip.Mac, + /// Our own sequence space, as the peer. + seq: u32 = 0x1000_0000, + /// The stack's ports and sequence numbers, learnt from its SYN. + stack_port: u16 = 0, + window: u16 = 8192, + /// With an MSS option in our SYN-ACK, or without. + mss: ?u16 = 1460, + + fn segment(self: *Peer, flags: u8, ackno: u32, data: []const u8, with_mss: bool) Frame { + var f: Frame = .{}; + f.eth(our_mac, self.mac, 0x0800); + const opt_len: usize = if (with_mss) 4 else 0; + const p = f.ip4(self.ip, our_ip, 6, 20 + opt_len + data.len); + put16(p, t.src, self.port); + put16(p, t.dst, self.stack_port); + put32(p, t.seq, self.seq); + put32(p, t.ack, ackno); + put16(p, t.hdrlen_flags, (@as(u16, @intCast((20 + opt_len) / 4)) << 12) | flags); + put16(p, t.window, self.window); + put16(p, t.chksum, 0); + put16(p, 18, 0); + if (with_mss) { + p[20] = 2; + p[21] = 4; + put16(p, 22, self.mss.?); + } + if (data.len != 0) @memcpy(p[20 + opt_len ..], data); + f.sealTransport(t.chksum); + return f; + } +}; + +/// A captured TCP segment, decoded, with its checksums verified independently. +const Seg = struct { + src_port: u16, + dst_port: u16, + seq: u32, + ack: u32, + flags: u8, + window: u16, + data: []const u8, + mss: ?u16, +}; + +fn decode(frame: []const u8) !Seg { + try testing.expectEqual(@as(u16, 0x0800), be16(frame, 12)); + const h = frame[14..34]; + try testing.expectEqual(@as(u8, 6), h[9]); + try verify(h); + const total = be16(h, 2); + const seg = frame[34 .. 14 + total]; + try verifyTransport(h[12..16].*, h[16..20].*, 6, seg); + const hf = be16(seg, t.hdrlen_flags); + const hlen = @as(usize, hf >> 12) * 4; + var mss: ?u16 = null; + var i: usize = 20; + while (i + 1 < hlen) { + if (seg[i] == 0) break; + if (seg[i] == 1) { + i += 1; + continue; + } + const olen = seg[i + 1]; + if (olen < 2 or i + olen > hlen) break; + if (seg[i] == 2 and olen == 4) mss = be16(seg, i + 2); + i += olen; + } + return .{ + .src_port = be16(seg, t.src), + .dst_port = be16(seg, t.dst), + .seq = be32(seg, t.seq), + .ack = be32(seg, t.ack), + .flags = @truncate(hf & 0x3f), + .window = be16(seg, t.window), + .data = seg[hlen..], + .mss = mss, + }; +} + +/// Bring a stack up statically with the peer's MAC already in the ARP cache, then start a GET. +/// Returns the peer and the SYN the stack sent. +fn startGet(s: *ip.Stack, peer: *Peer, path: []const u8, out: []u8) !Seg { + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer.mac, peer.ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, path, out)); + try testing.expectEqual(@as(usize, 1), cap_n); + const syn = try decode(sent(0)); + peer.stack_port = syn.src_port; + return syn; +} + +/// Complete the handshake: deliver the SYN-ACK and return the sequence number that acknowledges the +/// whole request. Afterwards `sent(0)` is the request segment - the capture log is cleared first, so +/// tests never have to remember whether the SYN is still in it. That off-by-one is exactly the kind +/// of thing a test helper exists to remove. +fn handshake(s: *ip.Stack, peer: *Peer, iss: u32) !u32 { + clearCapture(); + var synack = peer.segment(t.syn | t.ack_f, iss +% 1, &.{}, true); + s.onFrame(synack.bytes()); + peer.seq +%= 1; + const req = try decode(sent(0)); + try testing.expect(req.data.len > 0); + return iss +% 1 +% @as(u32, @intCast(req.data.len)); +} + +test "TCP: the SYN offers an MSS, uses an ephemeral port and advertises a window" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + + try testing.expectEqual(t.syn, syn.flags); + try testing.expectEqual(@as(u16, 80), syn.dst_port); + try testing.expect(syn.src_port >= 49152); // RFC 6335 dynamic range + try testing.expectEqual(@as(?u16, 1460), syn.mss); + try testing.expect(syn.window > 0); + try testing.expectEqual(@as(usize, 0), syn.data.len); + try testing.expectEqual(ip.TcpState.syn_sent, s.tcpState()); +} + +test "TCP: a handshake, the request, a response and a clean teardown" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/index.html", &out); + const iss = syn.seq; + + // ---- SYN-ACK + _ = try handshake(&s, &peer, iss); + try testing.expectEqual(ip.TcpState.established, s.tcpState()); + + // The handshake's ACK carries the request: one frame, not two. + try testing.expectEqual(@as(usize, 1), cap_n); + const req = try decode(sent(0)); + try testing.expectEqual(t.ack_f | t.psh, req.flags); + try testing.expectEqual(iss +% 1, req.seq); + try testing.expectEqual(peer.seq, req.ack); + try testing.expect(std.mem.startsWith(u8, req.data, "GET /index.html HTTP/1.1\r\n")); + // The Host header is the address literal - there is no DNS here - and port 80 is elided. + try testing.expect(std.mem.indexOf(u8, req.data, "\r\nHost: 192.168.1.90\r\n") != null); + // Connection: close is the framing for a body with no Content-Length. + try testing.expect(std.mem.indexOf(u8, req.data, "\r\nConnection: close\r\n") != null); + try testing.expect(std.mem.endsWith(u8, req.data, "\r\n\r\n")); + const req_len = req.data.len; + + // ---- the peer acknowledges the request and sends the whole response in one segment + clearCapture(); + const body = "hello, world"; + const response = "HTTP/1.1 200 OK\r\nServer: test\r\nContent-Length: 12\r\n\r\n" ++ body; + var resp = peer.segment(t.ack_f | t.psh, iss +% 1 +% @as(u32, @intCast(req_len)), response, false); + s.onFrame(resp.bytes()); + peer.seq +%= @intCast(response.len); + + // The body is complete, so the stack half-closes: the FIN is the acknowledgement too. + try testing.expectEqual(@as(usize, 1), cap_n); + const fin = try decode(sent(0)); + try testing.expectEqual(t.fin | t.ack_f, fin.flags); + try testing.expectEqual(peer.seq, fin.ack); + try testing.expectEqual(ip.TcpState.fin_wait_1, s.tcpState()); + + // ---- the peer acknowledges our FIN and sends its own + clearCapture(); + var peer_fin = peer.segment(t.fin | t.ack_f, fin.seq +% 1, &.{}, false); + s.onFrame(peer_fin.bytes()); + peer.seq +%= 1; + const last = try decode(lastSent()); + try testing.expectEqual(t.ack_f, last.flags); + try testing.expectEqual(peer.seq, last.ack); + try testing.expectEqual(ip.TcpState.time_wait, s.tcpState()); + + // ---- and the body comes out + const n = try s.httpGet(peer.ip, peer.port, "/index.html", &out); + try testing.expectEqual(@as(usize, 12), n); + try testing.expectEqualStrings(body, out[0..n]); + try testing.expectEqual(@as(u16, 200), s.httpStatus()); + + // TIME_WAIT is short by design; it ends on the clock, not on a frame. + s.tick(1_000_000); + try testing.expectEqual(ip.TcpState.closed, s.tcpState()); +} + +test "TCP: the SYN is retransmitted with its MSS option, on a doubling timer" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + clearCapture(); + + // Nothing before the RTO. + s.tick(1_999); + try testing.expectEqual(@as(usize, 0), cap_n); + s.tick(2_000); + try testing.expectEqual(@as(usize, 1), cap_n); + const again = try decode(sent(0)); + try testing.expectEqual(t.syn, again.flags); + try testing.expectEqual(syn.seq, again.seq); + // The MSS option must be repeated: a peer that only ever sees the retransmission would + // otherwise fall back to 536. + try testing.expectEqual(@as(?u16, 1460), again.mss); + + // The next timeout is twice as long: 2 s, not 1 s. + s.tick(3_999); + try testing.expectEqual(@as(usize, 1), cap_n); + s.tick(4_000); + try testing.expectEqual(@as(usize, 2), cap_n); + try testing.expectEqual(@as(u32, 2), s.counters.tcp_retx); +} + +test "TCP: retransmission after a dropped data segment resends the identical bytes" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/drop", &out); + const iss = syn.seq; + + _ = try handshake(&s, &peer, iss); + const first = try decode(sent(0)); + try testing.expect(first.data.len > 0); + + // Pretend the segment was lost: never acknowledge it, just let time pass. + clearCapture(); + s.tick(1_500); + try testing.expectEqual(@as(usize, 0), cap_n); // handshake completed at t=1000, RTO at t=2000 + s.tick(2_000); + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqual(@as(u32, 1), s.counters.tcp_retx); + + const again = try decode(sent(0)); + try testing.expectEqual(first.seq, again.seq); + try testing.expectEqualSlices(u8, first.data, again.data); + try testing.expectEqual(first.flags, again.flags); + + // Now it gets through, and the connection carries on from the same place. + clearCapture(); + const response = "HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n"; + var resp = peer.segment(t.ack_f, iss +% 1 +% @as(u32, @intCast(first.data.len)), response, false); + s.onFrame(resp.bytes()); + try testing.expectEqual(@as(usize, 0), try s.httpGet(peer.ip, peer.port, "/drop", &out)); + try testing.expectEqual(@as(u16, 204), s.httpStatus()); +} + +test "TCP: retransmission eventually gives up with TimedOut" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + _ = try startGet(&s, &peer, "/", &out); + + // Six retransmissions with a doubling, capped backoff, then failure. Ticking well past every + // deadline in one step is enough: the deadline is absolute. + var now: u64 = 1000; + var k: usize = 0; + while (k < 8) : (k += 1) { + now += 60_000; + s.tick(now); + } + try testing.expectEqual(ip.TcpState.closed, s.tcpState()); + try testing.expectError(error.TimedOut, s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqual(@as(u32, 6), s.counters.tcp_retx); +} + +test "TCP: an out-of-order segment is not accepted, and provokes a duplicate ACK" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + const iss = syn.seq; + const our_next = try handshake(&s, &peer, iss); + const in_order_seq = peer.seq; + + // The second half of the response arrives first. + const head = "HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\n"; + clearCapture(); + peer.seq = in_order_seq +% @as(u32, @intCast(head.len)); + var late = peer.segment(t.ack_f, our_next, "abcd", false); + s.onFrame(late.bytes()); + + // A duplicate ACK for what we are still waiting for, and nothing consumed. + try testing.expectEqual(@as(usize, 1), cap_n); + const dup = try decode(sent(0)); + try testing.expectEqual(t.ack_f, dup.flags); + try testing.expectEqual(in_order_seq, dup.ack); + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, "/", &out)); + + // The missing piece arrives. + clearCapture(); + peer.seq = in_order_seq; + var missing = peer.segment(t.ack_f, our_next, head, false); + s.onFrame(missing.bytes()); + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqual(@as(u16, 200), s.httpStatus()); + + // And the retransmission of the tail completes it. + peer.seq = in_order_seq +% @as(u32, @intCast(head.len)); + var tail = peer.segment(t.ack_f, our_next, "abcd", false); + s.onFrame(tail.bytes()); + try testing.expectEqual(@as(usize, 4), try s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqualStrings("abcd", out[0..4]); +} + +test "TCP: a retransmission overlapping data already received is trimmed, not rejected" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + const iss = syn.seq; + const our_next = try handshake(&s, &peer, iss); + + // Headers first, so the overlap lands squarely in the body where duplicated bytes cannot hide + // in a header line the parser would have skipped anyway. + const head = "HTTP/1.1 200 OK\r\nContent-Length: 16\r\n\r\n"; + var h = peer.segment(t.ack_f, our_next, head, false); + s.onFrame(h.bytes()); + peer.seq +%= @intCast(head.len); + const base = peer.seq; + + // Ten body bytes. + var a = peer.segment(t.ack_f, our_next, "0123456789", false); + s.onFrame(a.bytes()); + + // Then a retransmission that starts four bytes before what we now expect and carries six new + // bytes past it. Without trimming, `6789` is written twice, `rcv_nxt` runs four ahead of the + // truth, and the final six bytes are then rejected as old - so the request never completes. + peer.seq = base +% 6; + var b = peer.segment(t.ack_f, our_next, "6789abcdef", false); + s.onFrame(b.bytes()); + + try testing.expectEqual(@as(usize, 16), try s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqualStrings("0123456789abcdef", out[0..16]); +} + +test "TCP: a SYN-ACK that does not acknowledge our SYN is reset, not accepted" { + // RFC 793 3.4: an old duplicate SYN-ACK, or one aimed at a previous incarnation of this + // 4-tuple, is answered with a reset. Accepting it would establish a connection whose sequence + // space the peer does not agree with, and every subsequent segment would be discarded. + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + clearCapture(); + + var wrong = peer.segment(t.syn | t.ack_f, syn.seq +% 999, &.{}, true); + s.onFrame(wrong.bytes()); + try testing.expectEqual(ip.TcpState.syn_sent, s.tcpState()); + try testing.expectEqual(@as(usize, 1), cap_n); + const rst = try decode(sent(0)); + try testing.expectEqual(t.rst, rst.flags); + try testing.expectEqual(syn.seq +% 999, rst.seq); // RST carries the offending ACK number + + // The right one still works. + clearCapture(); + var right = peer.segment(t.syn | t.ack_f, syn.seq +% 1, &.{}, true); + s.onFrame(right.bytes()); + try testing.expectEqual(ip.TcpState.established, s.tcpState()); +} + +test "TCP: a FIN ahead of the data we have is not honoured" { + // A FIN whose sequence number is past `rcv_nxt` closes the connection over a hole. Honouring it + // would report a complete body that is missing its middle. + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + const iss = syn.seq; + const our_next = try handshake(&s, &peer, iss); + const base = peer.seq; + + const head = "HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\n"; + var h = peer.segment(t.ack_f, our_next, head, false); + s.onFrame(h.bytes()); + peer.seq +%= @intCast(head.len); + + // A FIN 100 bytes into the future, as though a segment we never saw preceded it. + clearCapture(); + peer.seq = base +% @as(u32, @intCast(head.len)) +% 100; + var early = peer.segment(t.fin | t.ack_f, our_next, &.{}, false); + s.onFrame(early.bytes()); + // Not closed, not completed: the body is still outstanding. + try testing.expectEqual(ip.TcpState.established, s.tcpState()); + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, "/", &out)); + + // The real body arrives and completes it. + peer.seq = base +% @as(u32, @intCast(head.len)); + var body = peer.segment(t.ack_f, our_next, "wxyz", false); + s.onFrame(body.bytes()); + try testing.expectEqual(@as(usize, 4), try s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqualStrings("wxyz", out[0..4]); +} + +test "TCP: an in-window RST tears the connection down; an out-of-window one does not" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + const iss = syn.seq; + _ = try handshake(&s, &peer, iss); + + // RFC 5961 3: a RST whose sequence number is not the next one expected gets a challenge ACK + // and is otherwise ignored. This is what stops a blind off-path reset. + clearCapture(); + const good_seq = peer.seq; + peer.seq = good_seq +% 5000; + var bogus = peer.segment(t.rst, 0, &.{}, false); + s.onFrame(bogus.bytes()); + try testing.expectEqual(ip.TcpState.established, s.tcpState()); + try testing.expectEqual(@as(usize, 1), cap_n); + try testing.expectEqual(t.ack_f, (try decode(sent(0))).flags); + + // The real thing. + peer.seq = good_seq; + var reset = peer.segment(t.rst, 0, &.{}, false); + s.onFrame(reset.bytes()); + try testing.expectEqual(ip.TcpState.closed, s.tcpState()); + try testing.expectError(error.ConnectionReset, s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqual(@as(u32, 2), s.counters.tcp_rst_rx); +} + +test "TCP: a segment for a different port is not mistaken for this connection" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + clearCapture(); + const real_port = peer.stack_port; + peer.stack_port = real_port ^ 1; + var stray = peer.segment(t.syn | t.ack_f, syn.seq +% 1, &.{}, true); + s.onFrame(stray.bytes()); + try testing.expectEqual(ip.TcpState.syn_sent, s.tcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "TCP: a segment from a different host is not mistaken for this connection" { + // The whole 4-tuple has to match, not just the ports. A stack that checks only the ports can + // have its connection completed - or reset - by any host on the segment that guesses a + // 16-bit number. + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + clearCapture(); + + // Same ports, different source address. + var impostor: Peer = .{ .ip = gw_ip, .port = 80, .mac = gw_mac, .seq = 0x7000_0000 }; + impostor.stack_port = peer.stack_port; + var stray = impostor.segment(t.syn | t.ack_f, syn.seq +% 1, &.{}, true); + s.onFrame(stray.bytes()); + try testing.expectEqual(ip.TcpState.syn_sent, s.tcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); + + // And a reset from the same impostor is ignored too. + var reset = impostor.segment(t.rst, 0, &.{}, false); + s.onFrame(reset.bytes()); + try testing.expectEqual(ip.TcpState.syn_sent, s.tcpState()); + try testing.expectEqual(@as(u32, 0), s.counters.tcp_rst_rx); +} + +test "TCP: the peer's MSS is honoured, and the request is split across segments" { + // The MSS option only matters when the request is bigger than it, which for a GET means a long + // path. A stack that ignores the option sends one oversized segment that a peer with a small + // MSS - a tunnel, a PPPoE link, anything with encapsulation overhead - drops silently. + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac, .mss = 100 }; + var out: [64]u8 = undefined; + const path: [300]u8 = @splat('q'); + var full_path: [301]u8 = undefined; + full_path[0] = '/'; + @memcpy(full_path[1..], &path); + + const syn = try startGet(&s, &peer, &full_path, &out); + const iss = syn.seq; + clearCapture(); + var synack = peer.segment(t.syn | t.ack_f, iss +% 1, &.{}, true); + s.onFrame(synack.bytes()); + peer.seq +%= 1; + + // Reassemble the request from however many segments it takes, acknowledging each one: with a + // window of one segment, nothing more is sent until the previous is acknowledged. + var assembled: [512]u8 = undefined; + var got: usize = 0; + var rounds: usize = 0; + while (true) : (rounds += 1) { + try testing.expect(rounds < 16); // termination, so a stall fails rather than hangs + try testing.expectEqual(@as(usize, 1), cap_n); + const seg = try decode(sent(0)); + try testing.expect(seg.data.len <= 100); // the peer's MSS, honoured + try testing.expectEqual(iss +% 1 +% @as(u32, @intCast(got)), seg.seq); + @memcpy(assembled[got..][0..seg.data.len], seg.data); + got += seg.data.len; + if (seg.flags & t.fin != 0) break; + clearCapture(); + var ack = peer.segment(t.ack_f, seg.seq +% @as(u32, @intCast(seg.data.len)), &.{}, false); + s.onFrame(ack.bytes()); + if (cap_n == 0) break; // request fully sent and acknowledged + } + try testing.expect(rounds >= 3); // 400-odd bytes at 100 per segment + try testing.expect(std.mem.startsWith(u8, assembled[0..got], "GET /qqq")); + try testing.expect(std.mem.endsWith(u8, assembled[0..got], "\r\n\r\n")); + try testing.expect(std.mem.indexOf(u8, assembled[0..got], &path) != null); +} + +test "TCP: sequence numbers wrap across 2^32 without stalling" { + var s = newStack(); + // A peer whose ISN is chosen so its data crosses the wrap. This is the case a `<` comparison + // instead of RFC 1982 serial arithmetic breaks, and it breaks by hanging forever. + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac, .seq = 0xffff_ffe0 }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + const iss = syn.seq; + const our_next = try handshake(&s, &peer, iss); + + const head = "HTTP/1.1 200 OK\r\nContent-Length: 8\r\n\r\n"; + clearCapture(); + var a = peer.segment(t.ack_f, our_next, head, false); // 38 bytes: crosses the wrap + s.onFrame(a.bytes()); + peer.seq +%= @intCast(head.len); + try testing.expect(peer.seq < 0x1000); // we really did wrap + + var b = peer.segment(t.ack_f, our_next, "12345678", false); + s.onFrame(b.bytes()); + try testing.expectEqual(@as(usize, 8), try s.httpGet(peer.ip, peer.port, "/", &out)); + try testing.expectEqualStrings("12345678", out[0..8]); +} + +test "TCP: an unresolvable peer fails with HostUnreachable after ARP gives up" { + var s = newStack(); + s.tick(0); + s.setStatic(our_ip, mask24, gw_ip); + var out: [64]u8 = undefined; + // Nothing in the cache, and nothing ever answers. + try testing.expectError(error.WouldBlock, s.httpGet(peer_ip, 80, "/", &out)); + try testing.expectEqual(ip.TcpState.arp_wait, s.tcpState()); + var now: u64 = 0; + var k: usize = 0; + while (k < 8) : (k += 1) { + now += 1000; + s.tick(now); + } + try testing.expectError(error.HostUnreachable, s.httpGet(peer_ip, 80, "/", &out)); + // Every attempt was a broadcast ARP request for the peer. + try testing.expect(s.counters.arp_tx >= 5); +} + +test "TCP: an off-net destination is sent to the gateway's MAC" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, gw_mac, gw_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + var out: [64]u8 = undefined; + try testing.expectError(error.WouldBlock, s.httpGet(off_net_ip, 80, "/", &out)); + try testing.expectEqual(@as(usize, 1), cap_n); + const syn = lastSent(); + try testing.expectEqualSlices(u8, &gw_mac, syn[0..6]); // to the gateway... + try testing.expectEqualSlices(u8, &off_net_ip, syn[14 + 16 ..][0..4]); // ...for the peer +} + +// ===================================================================================== HTTP + +/// Handshake, then feed the response in the given pieces, one segment each. +fn runResponse(s: *ip.Stack, peer: *Peer, path: []const u8, out: []u8, pieces: []const []const u8) !void { + const syn = try startGet(s, peer, path, out); + const iss = syn.seq; + const our_next = try handshake(s, peer, iss); + for (pieces) |piece| { + clearCapture(); + var seg = peer.segment(t.ack_f, our_next, piece, false); + s.onFrame(seg.bytes()); + peer.seq +%= @intCast(piece.len); + } +} + +test "HTTP: headers split across two segments" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + // The split falls inside the `Content-Length` field name, and the second piece carries the + // blank line and the start of the body. This is the ordinary case on a real server, and it is + // the one a parser that assumes headers arrive whole gets wrong. + try runResponse(&s, &peer, "/split", &out, &.{ + "HTTP/1.1 200 OK\r\nServer: nginx\r\nContent-Len", + "gth: 11\r\nETag: \"x\"\r\n\r\nhello wor", + "ld", + }); + const n = try s.httpGet(peer.ip, peer.port, "/split", &out); + try testing.expectEqual(@as(usize, 11), n); + try testing.expectEqualStrings("hello world", out[0..n]); + try testing.expectEqual(@as(u16, 200), s.httpStatus()); +} + +test "HTTP: the status line and blank line split one byte at a time" { + // The pathological segmentation: every byte its own segment. If any offset in the parser is + // off by one, one of these iterations lands on it. + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + const response = "HTTP/1.1 201 Created\r\nContent-Length: 3\r\nX: y\r\n\r\nabc"; + var pieces: [response.len][]const u8 = undefined; + for (&pieces, 0..) |*p, i| p.* = response[i .. i + 1]; + try runResponse(&s, &peer, "/bytes", &out, &pieces); + try testing.expectEqual(@as(usize, 3), try s.httpGet(peer.ip, peer.port, "/bytes", &out)); + try testing.expectEqualStrings("abc", out[0..3]); + try testing.expectEqual(@as(u16, 201), s.httpStatus()); +} + +test "HTTP: a header name's case is not significant" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + try runResponse(&s, &peer, "/case", &out, &.{ + "HTTP/1.0 200 OK\r\ncOnTeNt-LeNgTh: 7 \r\n\r\n1234567", + }); + try testing.expectEqual(@as(usize, 7), try s.httpGet(peer.ip, peer.port, "/case", &out)); + try testing.expectEqualStrings("1234567", out[0..7]); +} + +test "HTTP: a body with no Content-Length is terminated by the peer's FIN" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4096]u8 = undefined; + const syn = try startGet(&s, &peer, "/stream", &out); + const iss = syn.seq; + const our_next = try handshake(&s, &peer, iss); + + var a = peer.segment(t.ack_f, our_next, "HTTP/1.1 200 OK\r\nServer: x\r\n\r\npart one ", false); + s.onFrame(a.bytes()); + peer.seq +%= 39; + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, "/stream", &out)); + + var b = peer.segment(t.ack_f, our_next, "part two", false); + s.onFrame(b.bytes()); + peer.seq +%= 8; + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, "/stream", &out)); + + // RFC 7230 3.3.3 case 7: with no Content-Length and no chunking, the connection close is the + // framing. That is why the request said `Connection: close`. + clearCapture(); + var fin = peer.segment(t.fin | t.ack_f, our_next, &.{}, false); + s.onFrame(fin.bytes()); + const n = try s.httpGet(peer.ip, peer.port, "/stream", &out); + try testing.expectEqualStrings("part one part two", out[0..n]); + + // The peer closed first, so this is RFC 793's CLOSE-WAIT -> LAST-ACK: our FIN goes out + // acknowledging theirs, and the connection is not finished until that FIN is acknowledged. + try testing.expectEqual(@as(usize, 1), cap_n); + const ours = try decode(sent(0)); + try testing.expectEqual(t.fin | t.ack_f, ours.flags); + try testing.expectEqual(peer.seq +% 1, ours.ack); // their FIN consumed one sequence number + try testing.expectEqual(ip.TcpState.last_ack, s.tcpState()); + + // Their ACK of our FIN finishes it. + clearCapture(); + peer.seq +%= 1; + var final = peer.segment(t.ack_f, ours.seq +% 1, &.{}, false); + s.onFrame(final.bytes()); + try testing.expectEqual(ip.TcpState.time_wait, s.tcpState()); + try testing.expectEqual(@as(usize, 0), cap_n); // a bare ACK needs no answer + + // The peer's FIN again, because our ACK of it was lost. It has already been consumed, so it is + // "old" by one sequence number - and a stack that only accepts an exactly-in-order FIN answers + // nothing, leaving the peer retransmitting until it gives up and resets. + clearCapture(); + var again: Peer = peer; + again.seq = peer.seq -% 1; // the sequence number their FIN actually carried + var dup = again.segment(t.fin | t.ack_f, ours.seq +% 1, &.{}, false); + s.onFrame(dup.bytes()); + try testing.expectEqual(@as(usize, 1), cap_n); + const reack = try decode(sent(0)); + try testing.expectEqual(t.ack_f, reack.flags); + try testing.expectEqual(peer.seq, reack.ack); // still the sequence number past their FIN + try testing.expectEqual(ip.TcpState.time_wait, s.tcpState()); +} + +// ============================================================================= HTTP chunked +// +// RFC 7230 4.1. The framing is a size in hex, CRLF, that many bytes, CRLF, repeated, ended by a +// zero size, an optional trailer section and one more CRLF. Two things make it worth this many +// cases: the caller must see the decoded bytes and none of the framing, and a segment boundary +// may fall anywhere - including inside a size, inside a CRLF, and inside a chunk whose *data* +// contains CRLFs of its own. + +/// The example from RFC 7230's own appendix, by way of the one everybody quotes. Its third chunk +/// carries `\r\n\r\n` as data, which is the trap: a decoder that scans for a delimiter instead of +/// counting the size it was given loses the rest of the body here, and reports success. +const chunked_head = "HTTP/1.1 200 OK\r\nServer: cloudflare\r\nTransfer-Encoding: chunked\r\n\r\n"; +const chunked_wire = "4\r\nWiki\r\n5\r\npedia\r\nE\r\n in\r\n\r\nchunks.\r\n0\r\n\r\n"; +const chunked_want = "Wikipedia in\r\n\r\nchunks."; + +/// Drive a response through a fresh connection, cut into `pieces`, and return the decoded body. +fn decodeChunked(out: []u8, pieces: []const []const u8) ![]const u8 { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + try runResponse(&s, &peer, "/c", out, pieces); + const n = try s.httpGet(peer.ip, peer.port, "/c", out); + return out[0..n]; +} + +/// The same, expecting a named failure rather than a body. +fn expectChunkedError(want: anyerror, out: []u8, pieces: []const []const u8) !void { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + try runResponse(&s, &peer, "/c", out, pieces); + try testing.expectError(want, s.httpGet(peer.ip, peer.port, "/c", out)); +} + +test "HTTP chunked: a whole response in one segment decodes, framing bytes and all removed" { + var out: [256]u8 = undefined; + const got = try decodeChunked(&out, &.{chunked_head ++ chunked_wire}); + try testing.expectEqualStrings(chunked_want, got); + // Said the other way round, because it is the property that matters: no size, no CRLF and no + // terminator reached the caller. + try testing.expect(std.mem.indexOf(u8, got, "\r\nE\r\n") == null); + try testing.expect(std.mem.indexOf(u8, got, "0\r\n") == null); +} + +test "HTTP chunked: the response split at every single offset, two segments" { + // The decoder has to resume from wherever the cut landed: mid-size, between the CR and the LF + // of a chunk header, mid-data, mid-terminator. This walks every one of those positions. + const response = chunked_head ++ chunked_wire; + var split: usize = 1; + while (split < response.len) : (split += 1) { + var out: [256]u8 = undefined; + const got = try decodeChunked(&out, &.{ response[0..split], response[split..] }); + try testing.expectEqualStrings(chunked_want, got); + } +} + +test "HTTP chunked: the response split one byte at a time" { + // The pathological segmentation. Every state in the machine is entered with an empty input + // and re-entered with one byte, which is where a decoder that peeks at `b[1]` dies. + const response = chunked_head ++ chunked_wire; + var pieces: [response.len][]const u8 = undefined; + for (&pieces, 0..) |*p, i| p.* = response[i .. i + 1]; + var out: [256]u8 = undefined; + const got = try decodeChunked(&out, &pieces); + try testing.expectEqualStrings(chunked_want, got); +} + +test "HTTP chunked: the body arrives across three segments cut inside one chunk's data" { + var out: [256]u8 = undefined; + const got = try decodeChunked(&out, &.{ + chunked_head ++ "4\r\nWi", + "ki\r\n5\r\npe", + "dia\r\nE\r\n in\r\n\r\nchunks.\r\n0\r\n\r\n", + }); + try testing.expectEqualStrings(chunked_want, got); +} + +test "HTTP chunked: chunk extensions are skipped, not delivered" { + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" ++ + "5;name=value;flag\r\nhello\r\n0;last\r\n\r\n", + }); + try testing.expectEqualStrings("hello", got); +} + +test "HTTP chunked: an extension split across segments is still skipped" { + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5;na", + "me=val", + "ue\r\nhello\r\n0\r\n\r\n", + }); + try testing.expectEqualStrings("hello", got); +} + +test "HTTP chunked: a trailer section is skipped and only its final CRLF completes the body" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + const syn = try startGet(&s, &peer, "/c", &out); + const our_next = try handshake(&s, &peer, syn.seq); + + // Everything up to but not including the CRLF that ends the trailer section. + const piece = + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nExpires: now\r\n"; + var a = peer.segment(t.ack_f, our_next, piece, false); + s.onFrame(a.bytes()); + peer.seq +%= @intCast(piece.len); + + // The zero chunk is in and every body byte is here, and it is still not complete: the trailer + // section is part of the message, and a decoder that finished at the zero chunk would hand + // the caller a body while leaving the connection mid-message. + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, peer.port, "/c", &out)); + + var b = peer.segment(t.ack_f, our_next, "\r\n", false); + s.onFrame(b.bytes()); + peer.seq +%= 2; + try testing.expectEqual(@as(usize, 5), try s.httpGet(peer.ip, peer.port, "/c", &out)); + try testing.expectEqualStrings("hello", out[0..5]); +} + +test "HTTP chunked: sizes in upper case hex, and with leading zeros" { + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n" ++ + "00000A\r\n0123456789\r\nB\r\nabcdefghijk\r\n000\r\n\r\n", + }); + try testing.expectEqualStrings("0123456789abcdefghijk", got); +} + +test "HTTP chunked: an empty body is the terminator alone" { + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 204 No Content\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", + }); + try testing.expectEqual(@as(usize, 0), got.len); +} + +test "HTTP chunked: Content-Length beside chunked is ignored, not obeyed" { + // RFC 7230 3.3.3 case 3. A response carrying both is the request-smuggling disagreement, and + // the framing that wins is the chunked one. Obeying the length here would stop after 2 bytes + // and report success on a fifth of the body. + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nTransfer-Encoding: chunked\r\n\r\n" ++ + "5\r\nhello\r\n0\r\n\r\n", + }); + try testing.expectEqualStrings("hello", got); +} + +test "HTTP chunked: the header order does not decide which framing wins" { + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nContent-Length: 2\r\n\r\n" ++ + "5\r\nhello\r\n0\r\n\r\n", + }); + try testing.expectEqualStrings("hello", got); +} + +test "HTTP chunked: a size with no hex digits is refused, never read as the terminator" { + // The dangerous misparse: a stray CRLF where a size belongs is a zero-length chunk to a + // decoder with no `1*HEXDIG` check, and a zero-length chunk ends the body. That is a + // truncated response reported as a complete one. + var out: [64]u8 = undefined; + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n\r\nhello\r\n0\r\n\r\n", + }); + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\nxyz\r\nhello\r\n0\r\n\r\n", + }); +} + +test "HTTP chunked: a chunk not followed by CRLF is refused" { + var out: [64]u8 = undefined; + // Data, then a bare LF where the CRLF belongs. + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n0\r\n\r\n", + }); + // A chunk header whose CR is not followed by LF. + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\rhello\r\n0\r\n\r\n", + }); + // The final CRLF of the message, mangled. + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\n\rx", + }); +} + +test "HTTP chunked: each half of each CRLF is required in its own position" { + // The three cases above are all refused by a decoder that merely skips *two* bytes wherever a + // CRLF belongs; these are not. Each one is a well-framed message to such a decoder - it + // returns `hello` and reports success - and a malformed one to this stack. That is the + // difference between checking the delimiter and counting past it. + var out: [64]u8 = undefined; + // LF where the chunk's closing CR belongs, and the real LF behind it. + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\n\n0\r\n\r\n", + }); + // CR in place, then a byte that is not the LF. + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\rZ0\r\n\r\n", + }); + // And in the chunk header: CR in place, junk where the LF belongs. + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\rZhello\r\n0\r\n\r\n", + }); +} + +test "HTTP chunked: a second chunk with an empty size is refused, not read as the terminator" { + // The first chunk's size sets the "a digit was seen" flag, and it has to be cleared for the + // next one. Left set, the CRLF below reads as a zero-length chunk - the terminator - and the + // response ends silently five bytes in. + var out: [64]u8 = undefined; + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n\r\nmore\r\n0\r\n\r\n", + }); +} + +test "HTTP chunked: an impossible Content-Length beside chunked does not fail the request" { + // The other half of "chunked wins": the length is not merely unused for framing, it is not + // consulted at all - including by the check that refuses a body too big for `out`. A server + // that sends both is already not to be believed about the length. + var out: [64]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nContent-Length: 100000\r\nTransfer-Encoding: chunked\r\n\r\n" ++ + "5\r\nhello\r\n0\r\n\r\n", + }); + try testing.expectEqualStrings("hello", got); +} + +test "HTTP chunked: a body that exactly fills out still leaves window for its terminator" { + // The deadlock this pins: the advertised window is the room left in `out`, and chunked + // framing is consumed without going there. A body that fills `out` to the last byte closes + // the window, the terminator can never be accepted, and the request stalls against a peer + // that is behaving perfectly - until the RTO calls it a timeout. + var out: [5]u8 = undefined; + const got = try decodeChunked(&out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n", + "0\r\n\r\n", + }); + try testing.expectEqualStrings("hello", got); +} + +test "HTTP chunked: a size that overflows usize is refused, not wrapped" { + // Seventeen f's. Wrapped, this is a small number and the response looks well framed. + var out: [64]u8 = undefined; + try expectChunkedError(error.HttpChunkMalformed, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\nfffffffffffffffff\r\n", + }); +} + +test "HTTP chunked: a chunk larger than the caller's buffer fails on the header, before any copy" { + var out: [8]u8 = undefined; + try expectChunkedError(error.StreamTooLong, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n64\r\n", + }); +} + +test "HTTP chunked: chunks that together outgrow the buffer fail, and do not truncate" { + var out: [8]u8 = undefined; + try expectChunkedError(error.StreamTooLong, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n5\r\nworld\r\n0\r\n\r\n", + }); +} + +test "HTTP chunked: an endless chunk extension is bounded" { + const pad: [http_framing_over]u8 = @splat('x'); + var out: [4096]u8 = undefined; + try expectChunkedError(error.HttpHeadersTooLong, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5;", + &pad, + }); +} + +test "HTTP chunked: an endless trailer section is bounded" { + const pad: [http_framing_over]u8 = @splat('x'); + var out: [4096]u8 = undefined; + try expectChunkedError(error.HttpHeadersTooLong, &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n0\r\nX: ", + &pad, + }); +} + +/// One byte past the framing budget, so the bound is tested at the bound and not far above it. +const http_framing_over = ip.http_framing_max + 1; + +test "HTTP chunked: a close before the terminator is an error, not the body that did arrive" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + const syn = try startGet(&s, &peer, "/c", &out); + const our_next = try handshake(&s, &peer, syn.seq); + + const piece = "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\n\r\n5\r\nhello\r\n"; + var a = peer.segment(t.ack_f, our_next, piece, false); + s.onFrame(a.bytes()); + peer.seq +%= @intCast(piece.len); + + var fin = peer.segment(t.fin | t.ack_f, our_next, &.{}, false); + s.onFrame(fin.bytes()); + // Five bytes of body are sitting in `out`, and they are not the answer: chunked framing says + // the message ends at the zero chunk, so a close before it truncated the response. + try testing.expectError(error.ConnectionClosed, s.httpGet(peer.ip, peer.port, "/c", &out)); +} + +test "HTTP: a transfer coding that is neither identity nor chunked is still refused" { + for ([_][]const u8{ "gzip", "deflate", "chunked, gzip", "gzip, chunked" }) |coding| { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + var head: [128]u8 = undefined; + const resp = try std.fmt.bufPrint( + &head, + "HTTP/1.1 200 OK\r\nTransfer-Encoding: {s}\r\n\r\n5\r\nhello\r\n0\r\n\r\n", + .{coding}, + ); + try runResponse(&s, &peer, "/tc", &out, &.{resp}); + try testing.expectError( + error.UnsupportedTransferEncoding, + s.httpGet(peer.ip, peer.port, "/tc", &out), + ); + try testing.expectEqual(ip.TcpState.closed, s.tcpState()); + } +} + +test "HTTP: Transfer-Encoding: identity is accepted" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + try runResponse(&s, &peer, "/id", &out, &.{ + "HTTP/1.1 200 OK\r\nTransfer-Encoding: identity\r\nContent-Length: 2\r\n\r\nok", + }); + try testing.expectEqual(@as(usize, 2), try s.httpGet(peer.ip, peer.port, "/id", &out)); +} + +test "HTTP: a malformed status line is refused" { + for ([_][]const u8{ + "ICY 200 OK\r\nContent-Length: 0\r\n\r\n", + "HTTP/1.1 200 OK\r\n\r\n", + "HTTP/1.1 2xx OK\r\n\r\n", + // The right shape, the wrong protocol. HTTP/2 has no textual status line at all, so a + // server answering this over a cleartext HTTP/1.1 request is not something to guess at. + "HTTP/2.0 200 OK\r\nContent-Length: 0\r\n\r\n", + "ICE/1.0 200 OK\r\nContent-Length: 0\r\n\r\n", + "HTTP/1.1\r\n\r\n", + }) |bad| { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + try runResponse(&s, &peer, "/bad", &out, &.{bad}); + try testing.expectError(error.HttpMalformed, s.httpGet(peer.ip, peer.port, "/bad", &out)); + } +} + +test "HTTP: a Content-Length larger than the caller's buffer fails before any body is copied" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [8]u8 = undefined; + try runResponse(&s, &peer, "/big", &out, &.{ + "HTTP/1.1 200 OK\r\nContent-Length: 100\r\n\r\n0123456789", + }); + try testing.expectError(error.StreamTooLong, s.httpGet(peer.ip, peer.port, "/big", &out)); +} + +test "HTTP: an impossible Content-Length fails at once, not after a partial body" { + // 100 promised bytes into an 8-byte buffer, and only five of them ever arrive. The request is + // already impossible when the headers are parsed, and saying so then is the difference between + // an immediate error and a request that hangs until the peer closes. + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [8]u8 = undefined; + try runResponse(&s, &peer, "/early", &out, &.{ + "HTTP/1.1 200 OK\r\nContent-Length: 100\r\n\r\n01234", + }); + try testing.expectError(error.StreamTooLong, s.httpGet(peer.ip, peer.port, "/early", &out)); + try testing.expectEqual(ip.TcpState.closed, s.tcpState()); +} + +test "HTTP: a body longer than the caller's buffer with no Content-Length fails" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [4]u8 = undefined; + try runResponse(&s, &peer, "/big2", &out, &.{ + "HTTP/1.1 200 OK\r\n\r\n0123456789", + }); + try testing.expectError(error.StreamTooLong, s.httpGet(peer.ip, peer.port, "/big2", &out)); +} + +test "HTTP: an oversized header block fails rather than truncating" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + // One header line per segment until the head buffer is full. No blank line ever arrives. + var pieces: [40][]const u8 = undefined; + for (&pieces) |*p| p.* = "X-Padding: 0123456789012345678901234567890123456789\r\n"; + var first: [2][]const u8 = .{ "HTTP/1.1 200 OK\r\n", pieces[0] }; + _ = &first; + try runResponse(&s, &peer, "/hdr", &out, &pieces); + try testing.expectError(error.HttpHeadersTooLong, s.httpGet(peer.ip, peer.port, "/hdr", &out)); +} + +test "HTTP: a Content-Length: 0 response completes on the headers alone" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + try runResponse(&s, &peer, "/empty", &out, &.{ + "HTTP/1.1 304 Not Modified\r\nContent-Length: 0\r\n\r\n", + }); + try testing.expectEqual(@as(usize, 0), try s.httpGet(peer.ip, peer.port, "/empty", &out)); + try testing.expectEqual(@as(u16, 304), s.httpStatus()); + // Completing the body half-closes, whatever the length was. + try testing.expect(s.tcpState() != .established); +} + +test "HTTP: a truncated body - FIN before Content-Length is met - is an error, not a short read" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + const syn = try startGet(&s, &peer, "/trunc", &out); + const iss = syn.seq; + const our_next = try handshake(&s, &peer, iss); + + const piece = "HTTP/1.1 200 OK\r\nContent-Length: 20\r\n\r\nshort"; + var a = peer.segment(t.ack_f, our_next, piece, false); + s.onFrame(a.bytes()); + peer.seq +%= @intCast(piece.len); + var fin = peer.segment(t.fin | t.ack_f, our_next, &.{}, false); + s.onFrame(fin.bytes()); + try testing.expectError(error.ConnectionClosed, s.httpGet(peer.ip, peer.port, "/trunc", &out)); +} + +test "HTTP: a non-default port appears in the Host header" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 8080, .mac = peer_mac }; + var out: [64]u8 = undefined; + const syn = try startGet(&s, &peer, "/", &out); + var synack = peer.segment(t.syn | t.ack_f, syn.seq +% 1, &.{}, true); + clearCapture(); + s.onFrame(synack.bytes()); + const req = try decode(sent(0)); + try testing.expect(std.mem.indexOf(u8, req.data, "\r\nHost: 192.168.1.90:8080\r\n") != null); +} + +// ========================================================================= the Host: header +// +// A name-based virtual host - which is what everything behind a CDN is - chooses the site from +// this header alone. `Host: 104.21.46.8` reaches Cloudflare and gets Cloudflare's error page; the +// site is only reachable by name. But a bare address in a lab is only reachable by address, so +// both spellings have to be exactly right. + +/// Start a request, complete the handshake, and return the request segment the stack sent. +fn requestFor(s: *ip.Stack, peer: *Peer, name: ?[]const u8, path: []const u8, out: []u8) !Seg { + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer.mac, peer.ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + try testing.expectError(error.WouldBlock, s.httpGetHost(peer.ip, name, peer.port, path, out)); + const syn = try decode(sent(0)); + peer.stack_port = syn.src_port; + clearCapture(); + var synack = peer.segment(t.syn | t.ack_f, syn.seq +% 1, &.{}, true); + s.onFrame(synack.bytes()); + return try decode(sent(0)); +} + +test "HTTP Host: a supplied name is sent instead of the address" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + const req = try requestFor(&s, &peer, "0x4200.cafe", "/", &out); + try testing.expect(std.mem.indexOf(u8, req.data, "\r\nHost: 0x4200.cafe\r\n") != null); + // The address is still where the connection went; the name is only ever a header. + try testing.expect(std.mem.indexOf(u8, req.data, "192.168.1.90") == null); +} + +test "HTTP Host: a name keeps the rule that only a non-default port is appended" { + var s80 = newStack(); + var peer80: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out80: [64]u8 = undefined; + const req80 = try requestFor(&s80, &peer80, "0x4200.cafe", "/", &out80); + try testing.expect(std.mem.indexOf(u8, req80.data, "\r\nHost: 0x4200.cafe\r\n") != null); + + var s8080 = newStack(); + var peer8080: Peer = .{ .ip = peer_ip, .port = 8080, .mac = peer_mac }; + var out8080: [64]u8 = undefined; + const req8080 = try requestFor(&s8080, &peer8080, "0x4200.cafe", "/", &out8080); + try testing.expect(std.mem.indexOf(u8, req8080.data, "\r\nHost: 0x4200.cafe:8080\r\n") != null); +} + +test "HTTP Host: no name is byte for byte what httpGet has always sent" { + // The working test against a bare address depends on this, so it is asserted on the bytes and + // not on a substring: two stacks with the same MAC and the same tick draw the same ephemeral + // port and the same ISN, so the two requests must be identical octet for octet. + var a = newStack(); + var peer_a: Peer = .{ .ip = peer_ip, .port = 8080, .mac = peer_mac }; + var out_a: [64]u8 = undefined; + const req_a = try requestFor(&a, &peer_a, null, "/index.html", &out_a); + var kept: [512]u8 = undefined; + @memcpy(kept[0..req_a.data.len], req_a.data); + const first = kept[0..req_a.data.len]; + + var b = newStack(); + var peer_b: Peer = .{ .ip = peer_ip, .port = 8080, .mac = peer_mac }; + var out_b: [64]u8 = undefined; + b.tick(1000); + b.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer_b.mac, peer_b.ip, zero_mac, our_ip, bcast_mac); + b.onFrame(probe.bytes()); + clearCapture(); + try testing.expectError(error.WouldBlock, b.httpGet(peer_b.ip, peer_b.port, "/index.html", &out_b)); + const syn = try decode(sent(0)); + peer_b.stack_port = syn.src_port; + clearCapture(); + var synack = peer_b.segment(t.syn | t.ack_f, syn.seq +% 1, &.{}, true); + b.onFrame(synack.bytes()); + const req_b = try decode(sent(0)); + + try testing.expectEqualSlices(u8, first, req_b.data); + try testing.expect(std.mem.indexOf(u8, req_b.data, "\r\nHost: 192.168.1.90:8080\r\n") != null); +} + +test "HTTP Host: the name is part of the request's identity, so changing it is Busy" { + var s = newStack(); + const peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var probe = arpFrame(1, peer.mac, peer.ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + + try testing.expectError(error.WouldBlock, s.httpGetHost(peer.ip, "0x4200.cafe", 80, "/", &out)); + // The same call again is the protocol. + try testing.expectError(error.WouldBlock, s.httpGetHost(peer.ip, "0x4200.cafe", 80, "/", &out)); + // A different virtual host on the same address for the same path is a different request, and + // riding on this connection would fetch the wrong site under the right name. + try testing.expectError(error.Busy, s.httpGetHost(peer.ip, "example.com", 80, "/", &out)); + // And "no name" is not the same request as any name. + try testing.expectError(error.Busy, s.httpGetHost(peer.ip, null, 80, "/", &out)); + try testing.expectError(error.Busy, s.httpGet(peer.ip, 80, "/", &out)); +} + +test "HTTP: httpGet before an address exists is refused" { + var s = newStack(); + var out: [64]u8 = undefined; + try testing.expectError(error.NoAddress, s.httpGet(peer_ip, 80, "/", &out)); +} + +test "HTTP: re-entering with different arguments is refused rather than silently switching" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + var other: [64]u8 = undefined; + _ = try startGet(&s, &peer, "/one", &out); + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, 80, "/one", &out)); + try testing.expectError(error.Busy, s.httpGet(peer.ip, 80, "/two", &out)); + try testing.expectError(error.Busy, s.httpGet(peer.ip, 81, "/one", &out)); + try testing.expectError(error.Busy, s.httpGet(gw_ip, 80, "/one", &out)); + // A different output buffer is the dangerous one: the body is written as it arrives, so the + // stack is holding a pointer into the first. + try testing.expectError(error.Busy, s.httpGet(peer.ip, 80, "/one", &other)); + // Same buffer, shorter: `Content-Length` was already checked against the original length, and + // the body is written through the original slice, so a shrunk view is just as wrong. + try testing.expectError(error.Busy, s.httpGet(peer.ip, 80, "/one", out[0..32])); + try testing.expectError(error.Busy, s.httpGet(peer.ip, 80, "/one", out[1..])); + // The original arguments still work. + try testing.expectError(error.WouldBlock, s.httpGet(peer.ip, 80, "/one", &out)); +} + +test "HTTP: a path longer than the request buffer is refused" { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + var out: [64]u8 = undefined; + const long: [600]u8 = @splat('a'); + try testing.expectError(error.RequestTooLong, s.httpGet(peer_ip, 80, &long, &out)); +} + +test "HTTP: two requests in sequence use different ephemeral ports" { + var s = newStack(); + var peer: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + var out: [64]u8 = undefined; + try runResponse(&s, &peer, "/a", &out, &.{"HTTP/1.1 200 OK\r\nContent-Length: 1\r\na\r\n\r\na"}); + _ = try s.httpGet(peer.ip, peer.port, "/a", &out); + const first_port = peer.stack_port; + + const peer2: Peer = .{ .ip = peer_ip, .port = 80, .mac = peer_mac }; + clearCapture(); + try testing.expectError(error.WouldBlock, s.httpGet(peer2.ip, peer2.port, "/b", &out)); + const syn = try decode(sent(0)); + try testing.expect(syn.src_port != first_port); +} + +// ====================================================================================== DNS +// +// RFC 1035. The header offsets and the name encoding below are written out again from the RFC, +// like every other wire format in this file. The parts that need testing are not the header - +// six 16-bit fields - but the two that are easy to get wrong and impossible to see when they are: +// matching the *question* as well as the id, and following compression pointers under a bound. + +/// RFC 1035 4.1.1, re-derived. +const q = struct { + const id = 0; + const flags = 2; + const qdcount = 4; + const ancount = 6; + const nscount = 8; + const arcount = 10; + const hlen = 12; +}; + +/// The resolver this network's DHCP server hands out: the gateway itself. +const dns_ip: ip.Ip4 = .{ 192, 168, 1, 1 }; + +/// RFC 1035 4.1.2 name encoding. No validation, deliberately: a test that shared the encoder's +/// checks could not write a malformed name to see the stack reject it. +fn wireName(buf: []u8, name: []const u8) usize { + var o: usize = 0; + var labels = std.mem.splitScalar(u8, name, '.'); + while (labels.next()) |label| { + buf[o] = @intCast(label.len); + @memcpy(buf[o + 1 ..][0..label.len], label); + o += 1 + label.len; + } + buf[o] = 0; + return o + 1; +} + +/// A DNS message under construction. +const Msg = struct { + buf: [512]u8 = @splat(0), + len: usize = 0, + + fn header(self: *Msg, id: u16, flags: u16, qd: u16, an: u16) void { + put16(&self.buf, q.id, id); + put16(&self.buf, q.flags, flags); + put16(&self.buf, q.qdcount, qd); + put16(&self.buf, q.ancount, an); + put16(&self.buf, q.nscount, 0); + put16(&self.buf, q.arcount, 0); + self.len = q.hlen; + } + + fn question(self: *Msg, name: []const u8, qtype: u16, qclass: u16) void { + self.len += wireName(self.buf[self.len..], name); + self.be(qtype); + self.be(qclass); + } + + /// Append one big-endian 16-bit field. + fn be(self: *Msg, v: u16) void { + put16(&self.buf, self.len, v); + self.len += 2; + } + + fn bytes(self: *Msg, b: []const u8) void { + @memcpy(self.buf[self.len..][0..b.len], b); + self.len += b.len; + } + + /// A resource record whose owner name is a compression pointer to `name_off`, which is what a + /// real server emits for every record after the first: the question's name is at offset 12, + /// and every answer points at it. + fn rr(self: *Msg, name_off: u16, rtype: u16, rclass: u16, rdata: []const u8) void { + self.be(0xc000 | name_off); + self.be(rtype); + self.be(rclass); + put32(&self.buf, self.len, 300); // TTL + self.len += 4; + self.be(@intCast(rdata.len)); + self.bytes(rdata); + } + + fn slice(self: *const Msg) []const u8 { + return self.buf[0..self.len]; + } +}; + +/// A UDP datagram from `src`:`sport` to our address at `dport`. +fn udpFrame(src: ip.Ip4, sport: u16, dport: u16, payload: []const u8) Frame { + var f: Frame = .{}; + f.eth(our_mac, gw_mac, 0x0800); + const seg_len = 8 + payload.len; + const p = f.ip4(src, our_ip, 17, seg_len); + put16(p, 0, sport); + put16(p, 2, dport); + put16(p, 4, @intCast(seg_len)); + put16(p, 6, 0); + @memcpy(p[8..], payload); + f.sealTransport(6); + return f; +} + +/// A stack with an address, a resolver, and the resolver's MAC already learnt. +fn newResolverStack() ip.Stack { + var s = newStack(); + s.tick(1000); + s.setStatic(our_ip, mask24, gw_ip); + s.setDnsServer(dns_ip); + var probe = arpFrame(1, gw_mac, dns_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + return s; +} + +/// The DNS payload of a captured query, with both checksums verified independently. Also returns +/// the source port, which is the other half of what an off-path spoofer has to guess. +fn queryOut(frame: []const u8) !struct { msg: []const u8, sport: u16 } { + try testing.expectEqual(@as(u16, 0x0800), be16(frame, 12)); + const h = frame[14..34]; + try testing.expectEqual(@as(u8, 17), h[9]); // UDP + try verify(h); + try testing.expectEqualSlices(u8, &dns_ip, h[16..20]); + const total = be16(h, 2); + const seg = frame[34 .. 14 + total]; + try testing.expectEqual(@as(u16, 53), be16(seg, 2)); + try testing.expectEqual(@as(u16, @intCast(seg.len)), be16(seg, 4)); + try verifyTransport(h[12..16].*, h[16..20].*, 17, seg); + return .{ .msg = seg[8..], .sport = be16(seg, 0) }; +} + +/// Answer the outstanding query with `an` answer records built by `fill`, and return the address +/// `resolve` then produces - or the error it produces. +fn answerWith(s: *ip.Stack, name: []const u8, m: *Msg) !ip.Ip4 { + var f = udpFrame(dns_ip, 53, dns_query_port, m.slice()); + s.onFrame(f.bytes()); + return s.resolve(name); +} + +/// The source port of the query most recently captured, filled in by `startResolve`. +var dns_query_port: u16 = 0; + +/// Start a query and record its id and source port. +fn startResolve(s: *ip.Stack, name: []const u8) !u16 { + try testing.expectError(error.WouldBlock, s.resolve(name)); + try testing.expectEqual(@as(usize, 1), cap_n); + const out = try queryOut(sent(0)); + dns_query_port = out.sport; + clearCapture(); + return be16(out.msg, q.id); +} + +test "DNS: the query is one A/IN question, recursion desired, from an ephemeral port" { + var s = newResolverStack(); + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); + try testing.expectEqual(@as(usize, 1), cap_n); + const out = try queryOut(sent(0)); + const msg = out.msg; + + try testing.expect(out.sport >= 49152); // RFC 6335 dynamic range + // QR=0, OPCODE=0, RD=1, and nothing else. RFC 1035 4.1.1. + try testing.expectEqual(@as(u16, 0x0100), be16(msg, q.flags)); + try testing.expectEqual(@as(u16, 1), be16(msg, q.qdcount)); + try testing.expectEqual(@as(u16, 0), be16(msg, q.ancount)); + try testing.expectEqual(@as(u16, 0), be16(msg, q.nscount)); + try testing.expectEqual(@as(u16, 0), be16(msg, q.arcount)); + + // The question: `6 0x4200 4 cafe 0`, then QTYPE=A, QCLASS=IN. Written out literally, because + // the length-prefixed encoding is the thing being checked. + const want = [_]u8{ 6, '0', 'x', '4', '2', '0', '0', 4, 'c', 'a', 'f', 'e', 0 }; + try testing.expectEqualSlices(u8, &want, msg[q.hlen..][0..want.len]); + try testing.expectEqual(@as(u16, 1), be16(msg, q.hlen + want.len)); // QTYPE=A + try testing.expectEqual(@as(u16, 1), be16(msg, q.hlen + want.len + 2)); // QCLASS=IN + try testing.expectEqual(@as(usize, q.hlen + want.len + 4), msg.len); + try testing.expectEqual(@as(u32, 1), s.counters.dns_tx); +} + +test "DNS: an answer resolves the name, and the query slot is released" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); // QR, RD, RA, RCODE 0 + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); + try testing.expectEqual(@as(u32, 1), s.counters.dns_rx); + // The slot is free again: a second name resolves without an intervening reset. + try testing.expectError(error.WouldBlock, s.resolve("example.com")); +} + +test "DNS: a CNAME ahead of the A record is stepped over, not read as an address" { + // This is the shape a CDN answers with, and a resolver that reads answer[0] gets a name where + // it wanted four octets. RDLENGTH would even be 4 for a short enough label. + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var cname: [32]u8 = undefined; + const cname_len = wireName(&cname, "edge.example"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 3); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 5, 1, cname[0..cname_len]); // CNAME + m.rr(q.hlen, 28, 1, &[_]u8{0} ** 16); // AAAA - also not an address this stack can use + m.rr(q.hlen, 1, 1, &[_]u8{ 172, 67, 221, 247 }); // and finally the A + + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 172, 67, 221, 247 }, &got); +} + +test "DNS: an owner name written out in full, not compressed, is skipped correctly" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + var full: [32]u8 = undefined; + m.bytes(full[0..wireName(&full, "0x4200.cafe")]); + m.be(1); // A + m.be(1); // IN + m.bytes(&[_]u8{ 0, 0, 1, 44 }); // TTL + m.be(4); + m.bytes(&[_]u8{ 104, 21, 46, 8 }); + + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); +} + +test "DNS: a compression pointer that loops is bounded, not followed forever" { + // The gadget: at the start of the answer section, a one-byte label followed by a pointer back + // to that label. Every jump goes strictly backwards - so the "pointers must point backwards" + // check that most parsers stop at passes it - and the walk still never ends, because stepping + // over the label moves forward again. Only counting the jumps terminates this. + // + // If this test hangs, it has failed. That is the whole point of it. + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + const gadget: u16 = @intCast(m.len); + m.bytes(&[_]u8{ 1, 'x' }); // a label... + m.be(0xc000 | gadget); // ...and a pointer back to it + + try testing.expectError(error.DnsMalformed, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: a compression pointer that points forward is rejected" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + // A forward pointer that a parser without the backwards rule would happily follow: it lands + // on a root label placed at the very end of this message, so the name resolves, the record + // behind it parses, and an address comes out. RFC 1035 4.1.4 only ever compresses against a + // *prior* occurrence, and the rule is what keeps `dnsSkipName`'s jumps monotone. + m.be(0xc000 | 0x002d); // -> offset 45, the root label appended below + m.be(1); // A + m.be(1); // IN + m.bytes(&[_]u8{ 0, 0, 1, 44 }); // TTL + m.be(4); + m.bytes(&[_]u8{ 6, 6, 6, 6 }); + try testing.expectEqual(@as(usize, 45), m.len); + m.bytes(&[_]u8{0}); // the root label the pointer aims at + try testing.expectError(error.DnsMalformed, answerWith(&s, "0x4200.cafe", &m)); + + // And one aimed past the end of the message entirely. + var s2 = newResolverStack(); + const id2 = try startResolve(&s2, "0x4200.cafe"); + var far: Msg = .{}; + far.header(id2, 0x8180, 1, 1); + far.question("0x4200.cafe", 1, 1); + far.be(0xc000 | 0x00fa); + try testing.expectError(error.DnsMalformed, answerWith(&s2, "0x4200.cafe", &far)); +} + +test "DNS: a reserved label type is refused rather than guessed past" { + // RFC 1035 4.1.4 defines the two top bits of a length byte: 00 is a label, 11 is a pointer, + // 01 and 10 are reserved. A parser that treats 0x40 as "a label of 64 bytes" walks somewhere + // arbitrary and then keeps going - here, straight onto a well-formed A record. + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.bytes(&[_]u8{0x40}); // reserved type, low bits zero + m.bytes(&([_]u8{'z'} ** 64)); // what a 0x40-as-length parser would skip + m.bytes(&[_]u8{0}); // ...landing on a root label, so the name "parses" + m.be(1); + m.be(1); + m.bytes(&[_]u8{ 0, 0, 1, 44 }); + m.be(4); + m.bytes(&[_]u8{ 6, 6, 6, 6 }); + try testing.expectError(error.DnsMalformed, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: a pointer to a self-referential offset in the question is bounded too" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + const here: u16 = @intCast(m.len); + // A pointer to itself: rejected by the backwards check alone, since the target is not less + // than the pointer's own offset. + m.be(0xc000 | here); + try testing.expectError(error.DnsMalformed, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: a response with the wrong transaction id is ignored, and the query stays live" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id +% 1, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 1, 2, 3, 4 }); + try testing.expectError(error.WouldBlock, answerWith(&s, "0x4200.cafe", &m)); + try testing.expectEqual(@as(u32, 0), s.counters.dns_rx); +} + +test "DNS: a response echoing a different question is ignored" { + // The id alone is 16 bits. A resolver that checks only the id accepts an answer for any name + // an attacker likes, which is the entire cache-poisoning family. + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("evil.example", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + try testing.expectError(error.WouldBlock, answerWith(&s, "0x4200.cafe", &m)); + + // The one that matters, and the one a length-blind check misses: a different name of exactly + // the same encoded length, so QTYPE and QCLASS still land where they are expected and every + // check but the name's own passes. `kafe` for `cafe`. + var lookalike: Msg = .{}; + lookalike.header(id, 0x8180, 1, 1); + lookalike.question("0x4200.kafe", 1, 1); + lookalike.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + // The same encoded length as the question we actually asked, so nothing after the name moves. + var ours: Msg = .{}; + ours.header(id, 0x8180, 1, 1); + ours.question("0x4200.cafe", 1, 1); + ours.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + try testing.expectEqual(ours.len, lookalike.len); + try testing.expectError(error.WouldBlock, answerWith(&s, "0x4200.cafe", &lookalike)); + + // Nor a right name asked as the wrong type or class. + var wrong_type: Msg = .{}; + wrong_type.header(id, 0x8180, 1, 1); + wrong_type.question("0x4200.cafe", 28, 1); // AAAA + wrong_type.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + try testing.expectError(error.WouldBlock, answerWith(&s, "0x4200.cafe", &wrong_type)); + + var wrong_class: Msg = .{}; + wrong_class.header(id, 0x8180, 1, 1); + wrong_class.question("0x4200.cafe", 1, 3); // CH + wrong_class.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + try testing.expectError(error.WouldBlock, answerWith(&s, "0x4200.cafe", &wrong_class)); +} + +test "DNS: the echoed question is matched case-insensitively, as RFC 4343 requires" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0X4200.CAFE", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); +} + +test "DNS: a response from the wrong source, or the wrong port, is ignored" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + + var wrong_src = udpFrame(.{ 192, 168, 1, 250 }, 53, dns_query_port, m.slice()); + s.onFrame(wrong_src.bytes()); + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); + + var wrong_port = udpFrame(dns_ip, 5353, dns_query_port, m.slice()); + s.onFrame(wrong_port.bytes()); + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); + + // And to a port that is not the one this query was sent from. + var wrong_dport = udpFrame(dns_ip, 53, dns_query_port +% 1, m.slice()); + s.onFrame(wrong_dport.bytes()); + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); + + // The right one still works, so the three rejections above are not rejecting everything. + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 6, 6, 6, 6 }, &got); +} + +test "DNS: a query, not a response, on the right port is ignored" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x0100, 1, 1); // QR clear + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 6, 6, 6, 6 }); + try testing.expectError(error.WouldBlock, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: NXDOMAIN and a refusal are distinct named errors" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var nx: Msg = .{}; + nx.header(id, 0x8183, 1, 0); // RCODE 3 + nx.question("0x4200.cafe", 1, 1); + try testing.expectError(error.NameNotFound, answerWith(&s, "0x4200.cafe", &nx)); + + var s2 = newResolverStack(); + const id2 = try startResolve(&s2, "0x4200.cafe"); + var refused: Msg = .{}; + refused.header(id2, 0x8185, 1, 0); // RCODE 5, REFUSED + refused.question("0x4200.cafe", 1, 1); + try testing.expectError(error.DnsRefused, answerWith(&s2, "0x4200.cafe", &refused)); +} + +test "DNS: an answer with no A record in it is NameNotFound, not a hang" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 28, 1, &[_]u8{0} ** 16); // AAAA only + try testing.expectError(error.NameNotFound, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: an A record with the wrong RDLENGTH is not read as an address" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 2); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 1, 2, 3 }); // an A record three bytes long + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); // the real one, behind it + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); +} + +test "DNS: an RDLENGTH that runs past the end of the message is refused, not read" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.be(0xc000 | q.hlen); + m.be(1); + m.be(1); + m.bytes(&[_]u8{ 0, 0, 1, 44 }); + m.be(400); // RDLENGTH far past what follows + m.bytes(&[_]u8{ 104, 21, 46, 8 }); + try testing.expectError(error.DnsMalformed, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: every truncation of a good response is refused, and none is read off the end" { + // Every prefix of a well-formed answer, each against a *fresh* query - which is the part that + // matters. Feeding them all to one query would stop testing after the first prefix that + // decided it, because a decided query stops listening, and the prefixes that cut inside the + // resource record - exactly the ones whose bounds are worth checking - come last. + var cut: usize = 0; + while (cut < 45) : (cut += 1) { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + try testing.expectEqual(@as(usize, 45), m.len); + + var f = udpFrame(dns_ip, 53, dns_query_port, m.buf[0..cut]); + s.onFrame(f.bytes()); + // Ignored or refused, but never resolved: a prefix of the truth is not the truth. + if (s.resolve("0x4200.cafe")) |_| return error.TestUnexpectedResult else |_| {} + } + // ...and the whole thing does resolve, so the loop above is rejecting truncation and not + // simply rejecting everything. + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); +} + +test "DNS: two queries in sequence use different source ports" { + // The id is 16 bits and the port is the other 16. Reusing one port halves what an off-path + // spoofer has to guess, and makes a late answer to the previous query land on the live one. + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + const first_port = dns_query_port; + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + _ = try answerWith(&s, "0x4200.cafe", &m); + + _ = try startResolve(&s, "example.com"); + try testing.expect(dns_query_port != first_port); +} + +test "DNS: an answer count larger than the answers present does not walk off the end" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 0xffff); // 65,535 answers promised, none delivered + m.question("0x4200.cafe", 1, 1); + try testing.expectError(error.DnsMalformed, answerWith(&s, "0x4200.cafe", &m)); +} + +test "DNS: the query is retransmitted on a doubling timer and then times out" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + + // Nothing before the first deadline. The query went out at t=1000 with a 1 s timer. + s.tick(1_999); + try testing.expectEqual(@as(usize, 0), cap_n); + + s.tick(2_000); + try testing.expectEqual(@as(usize, 1), cap_n); + const re = try queryOut(sent(0)); + // The same id, so an answer to the first attempt still counts. Redrawing it is how a slow + // resolver turns into a timeout on a network that was working. + try testing.expectEqual(id, be16(re.msg, q.id)); + clearCapture(); + + s.tick(3_999); + try testing.expectEqual(@as(usize, 0), cap_n); + s.tick(4_000); + try testing.expectEqual(@as(usize, 1), cap_n); + clearCapture(); + + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); + s.tick(8_000); + try testing.expectError(error.TimedOut, s.resolve("0x4200.cafe")); + try testing.expectEqual(@as(u32, 3), s.counters.dns_tx); + try testing.expectEqual(@as(u32, 2), s.counters.dns_retx); + + // And the slot is free: the next call starts a new query rather than returning the old error. + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); +} + +test "DNS: a late answer to an abandoned query does not resolve a new one" { + var s = newResolverStack(); + const first_id = try startResolve(&s, "0x4200.cafe"); + const first_port = dns_query_port; + // The whole schedule: 1 s, 2 s, 4 s, then out of tries. + s.tick(2_000); + s.tick(4_000); + s.tick(8_000); + clearCapture(); + try testing.expectError(error.TimedOut, s.resolve("0x4200.cafe")); + _ = try startResolve(&s, "0x4200.cafe"); + + var m: Msg = .{}; + m.header(first_id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 9, 9, 9, 9 }); + var f = udpFrame(dns_ip, 53, first_port, m.slice()); + s.onFrame(f.bytes()); + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); +} + +test "DNS: a second name while a query is in flight is Busy, and the first is untouched" { + var s = newResolverStack(); + const id = try startResolve(&s, "0x4200.cafe"); + try testing.expectError(error.Busy, s.resolve("example.com")); + // The same name, spelled with a trailing root dot and in a different case, is the same query. + try testing.expectError(error.WouldBlock, s.resolve("0X4200.CAFE.")); + try testing.expectError(error.WouldBlock, s.resolve("0x4200.cafe")); + + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + const got = try answerWith(&s, "0x4200.cafe.", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); +} + +test "DNS: with no resolver and no address, resolve says which one is missing" { + var no_server = newStack(); + no_server.tick(1000); + no_server.setStatic(our_ip, mask24, gw_ip); + clearCapture(); + try testing.expectError(error.NoDnsServer, no_server.resolve("0x4200.cafe")); + try testing.expectEqual(@as(usize, 0), cap_n); + + var no_addr = newStack(); + no_addr.tick(1000); + no_addr.setDnsServer(dns_ip); + clearCapture(); + try testing.expectError(error.NoAddress, no_addr.resolve("0x4200.cafe")); + try testing.expectEqual(@as(usize, 0), cap_n); +} + +test "DNS: an unusable name is refused before a byte leaves, and says which way it was unusable" { + var s = newResolverStack(); + const long: [ip.dns_name_max + 1]u8 = @splat('a'); + try testing.expectError(error.NameTooLong, s.resolve(&long)); + // A label over 63 bytes, inside a name that is itself short enough - so this is the label + // rule and not the name rule that rejects it. + const long_label = "b" ** 64; + for ([_][]const u8{ "", ".", "..", ".a", "a..b", long_label }) |bad| { + try testing.expectError(error.NameInvalid, s.resolve(bad)); + } + try testing.expectEqual(@as(usize, 0), cap_n); + // A name of exactly the maximum is fine, and is what proves the limit is off by nothing: + // 31 + 1 + 32 = 64 text bytes, encoding to 66 - which is `dns_qname_max` exactly. + const ok = "a" ** 31 ++ "." ++ "b" ** 32; + try testing.expectEqual(@as(usize, ip.dns_name_max), ok.len); + try testing.expectError(error.WouldBlock, s.resolve(ok)); +} + +test "DNS: the resolver DHCP supplied is the one resolve asks, with nothing configured" { + // The default path on this network: the lease carries option 6 and the caller does nothing. + var s = newStack(); + s.tick(10_000); + s.dhcpStart(); + const discover = try dhcpOut(sent(0)); + const xid = be32(discover, d.xid); + + var offer = dhcpReply(2, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(offer.bytes()); + var ack = dhcpReply(5, xid, our_ip, gw_ip, &standard_opts, our_ip, our_mac); + s.onFrame(ack.bytes()); + try testing.expectEqual(ip.DhcpState.bound, s.dhcpState()); + try testing.expectEqualSlices(u8, &dns_ip, &(s.dnsServer().?)); + + // The resolver's MAC, so the query can actually be addressed. + var probe = arpFrame(1, gw_mac, dns_ip, zero_mac, our_ip, bcast_mac); + s.onFrame(probe.bytes()); + clearCapture(); + + const id = try startResolve(&s, "0x4200.cafe"); + var m: Msg = .{}; + m.header(id, 0x8180, 1, 1); + m.question("0x4200.cafe", 1, 1); + m.rr(q.hlen, 1, 1, &[_]u8{ 104, 21, 46, 8 }); + const got = try answerWith(&s, "0x4200.cafe", &m); + try testing.expectEqualSlices(u8, &[_]u8{ 104, 21, 46, 8 }, &got); +} + +test "DNS: a new lease abandons a query in flight rather than leaving it to time out" { + var s = newResolverStack(); + _ = try startResolve(&s, "0x4200.cafe"); + s.dhcpStart(); + // No address and no resolver now, and the query is gone with them - so this is the error that + // names what is missing, not `Busy` from a query nobody can answer. + try testing.expectError(error.NoAddress, s.resolve("0x4200.cafe")); +} + +test "identity: the clock stirs the transaction ids, so two boots do not collide" { + // Same MAC, same firmware, different moment of first tick. If `tick` did not mix `now_ms` into + // the entropy, both would draw identical DHCP transaction ids and identical initial sequence + // numbers, and a reboot would happily accept a reply meant for its previous incarnation. + var a = newStack(); + a.tick(1234); + a.dhcpStart(); + const xid_a = be32(sent(0)[42..], d.xid); + + var b = newStack(); + b.tick(9_876_543); + b.dhcpStart(); + const xid_b = be32(sent(0)[42..], d.xid); + + try testing.expect(xid_a != xid_b); +} + +// ================================================================================ footprint + +test "footprint: the static cost of one Stack" { + // No printing. The test runner speaks a binary protocol over its own stdio under + // `zig build test`, and a diagnostic in the middle of it costs the whole suite's results for + // the sake of a number that an assertion states better anyway. + // + // 6 KiB is the ceiling, and it is not arbitrary: the image has ~128 KB of L2MEM, nothing + // initialises the 32 MB of PSRAM, and ESP-Hosted's queues and its task stacks compete for the + // same space. The stack is ~4,600 bytes today: 3,472 before chunked decoding and the resolver + // (104 bytes between them, mostly the encoded question), then 1,024 more when `http_head_max` + // went 1024 -> 2048 to fit a real CDN response head - measured at 1,043 bytes from the site this + // was pointed at, which failed the request by 19 bytes at the old size. + // + // A regression to 30 KiB would not announce itself any other way; it would show up as a stack + // overflow on the die. The heap in examples/http.zig was reduced by the same 2 KB this raise + // cost, so the image's total is unchanged. + const n = ip.Stack.footprint; + try testing.expect(n <= 6 * 1024); + // And a floor, so the ceiling cannot be met by quietly shrinking a buffer that the protocol + // needs: one full frame to build in, the request held for retransmission, the response head + // held while waiting for the blank line, and the DNS question held for the retransmissions + // and for the comparison against what the server echoes back. + try testing.expect(n >= ip.frame_max + ip.tcp_tx_max + ip.http_head_max + ip.dns_qname_max); +} |