You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

470 lines
13 KiB

  1. package conn
  2. import (
  3. "bufio"
  4. "encoding/hex"
  5. "flag"
  6. "fmt"
  7. "io"
  8. "log"
  9. mrand "math/rand"
  10. "os"
  11. "path/filepath"
  12. "strconv"
  13. "strings"
  14. "sync"
  15. "testing"
  16. "github.com/stretchr/testify/assert"
  17. "github.com/stretchr/testify/require"
  18. "github.com/tendermint/tendermint/crypto"
  19. "github.com/tendermint/tendermint/crypto/ed25519"
  20. "github.com/tendermint/tendermint/crypto/sr25519"
  21. "github.com/tendermint/tendermint/libs/async"
  22. tmrand "github.com/tendermint/tendermint/libs/rand"
  23. )
  24. // Run go test -update from within this module
  25. // to update the golden test vector file
  26. var update = flag.Bool("update", false, "update .golden files")
  27. type kvstoreConn struct {
  28. *io.PipeReader
  29. *io.PipeWriter
  30. }
  31. func (drw kvstoreConn) Close() (err error) {
  32. err2 := drw.PipeWriter.CloseWithError(io.EOF)
  33. err1 := drw.PipeReader.Close()
  34. if err2 != nil {
  35. return err
  36. }
  37. return err1
  38. }
  39. type privKeyWithNilPubKey struct {
  40. orig crypto.PrivKey
  41. }
  42. func (pk privKeyWithNilPubKey) Bytes() []byte { return pk.orig.Bytes() }
  43. func (pk privKeyWithNilPubKey) Sign(msg []byte) ([]byte, error) { return pk.orig.Sign(msg) }
  44. func (pk privKeyWithNilPubKey) PubKey() crypto.PubKey { return nil }
  45. func (pk privKeyWithNilPubKey) Equals(pk2 crypto.PrivKey) bool { return pk.orig.Equals(pk2) }
  46. func (pk privKeyWithNilPubKey) Type() string { return "privKeyWithNilPubKey" }
  47. func TestSecretConnectionHandshake(t *testing.T) {
  48. fooSecConn, barSecConn := makeSecretConnPair(t)
  49. if err := fooSecConn.Close(); err != nil {
  50. t.Error(err)
  51. }
  52. if err := barSecConn.Close(); err != nil {
  53. t.Error(err)
  54. }
  55. }
  56. func TestConcurrentWrite(t *testing.T) {
  57. fooSecConn, barSecConn := makeSecretConnPair(t)
  58. fooWriteText := tmrand.Str(dataMaxSize)
  59. // write from two routines.
  60. // should be safe from race according to net.Conn:
  61. // https://golang.org/pkg/net/#Conn
  62. n := 100
  63. wg := new(sync.WaitGroup)
  64. wg.Add(3)
  65. go writeLots(t, wg, fooSecConn, fooWriteText, n)
  66. go writeLots(t, wg, fooSecConn, fooWriteText, n)
  67. // Consume reads from bar's reader
  68. readLots(t, wg, barSecConn, n*2)
  69. wg.Wait()
  70. if err := fooSecConn.Close(); err != nil {
  71. t.Error(err)
  72. }
  73. }
  74. func TestConcurrentRead(t *testing.T) {
  75. fooSecConn, barSecConn := makeSecretConnPair(t)
  76. fooWriteText := tmrand.Str(dataMaxSize)
  77. n := 100
  78. // read from two routines.
  79. // should be safe from race according to net.Conn:
  80. // https://golang.org/pkg/net/#Conn
  81. wg := new(sync.WaitGroup)
  82. wg.Add(3)
  83. go readLots(t, wg, fooSecConn, n/2)
  84. go readLots(t, wg, fooSecConn, n/2)
  85. // write to bar
  86. writeLots(t, wg, barSecConn, fooWriteText, n)
  87. wg.Wait()
  88. if err := fooSecConn.Close(); err != nil {
  89. t.Error(err)
  90. }
  91. }
  92. func TestSecretConnectionReadWrite(t *testing.T) {
  93. fooConn, barConn := makeKVStoreConnPair()
  94. fooWrites, barWrites := []string{}, []string{}
  95. fooReads, barReads := []string{}, []string{}
  96. // Pre-generate the things to write (for foo & bar)
  97. for i := 0; i < 100; i++ {
  98. fooWrites = append(fooWrites, tmrand.Str((mrand.Int()%(dataMaxSize*5))+1))
  99. barWrites = append(barWrites, tmrand.Str((mrand.Int()%(dataMaxSize*5))+1))
  100. }
  101. // A helper that will run with (fooConn, fooWrites, fooReads) and vice versa
  102. genNodeRunner := func(id string, nodeConn kvstoreConn, nodeWrites []string, nodeReads *[]string) async.Task {
  103. return func(_ int) (interface{}, bool, error) {
  104. // Initiate cryptographic private key and secret connection trhough nodeConn.
  105. nodePrvKey := ed25519.GenPrivKey()
  106. nodeSecretConn, err := MakeSecretConnection(nodeConn, nodePrvKey)
  107. if err != nil {
  108. t.Errorf("failed to establish SecretConnection for node: %v", err)
  109. return nil, true, err
  110. }
  111. // In parallel, handle some reads and writes.
  112. var trs, ok = async.Parallel(
  113. func(_ int) (interface{}, bool, error) {
  114. // Node writes:
  115. for _, nodeWrite := range nodeWrites {
  116. n, err := nodeSecretConn.Write([]byte(nodeWrite))
  117. if err != nil {
  118. t.Errorf("failed to write to nodeSecretConn: %v", err)
  119. return nil, true, err
  120. }
  121. if n != len(nodeWrite) {
  122. err = fmt.Errorf("failed to write all bytes. Expected %v, wrote %v", len(nodeWrite), n)
  123. t.Error(err)
  124. return nil, true, err
  125. }
  126. }
  127. if err := nodeConn.PipeWriter.Close(); err != nil {
  128. t.Error(err)
  129. return nil, true, err
  130. }
  131. return nil, false, nil
  132. },
  133. func(_ int) (interface{}, bool, error) {
  134. // Node reads:
  135. readBuffer := make([]byte, dataMaxSize)
  136. for {
  137. n, err := nodeSecretConn.Read(readBuffer)
  138. if err == io.EOF {
  139. if err := nodeConn.PipeReader.Close(); err != nil {
  140. t.Error(err)
  141. return nil, true, err
  142. }
  143. return nil, false, nil
  144. } else if err != nil {
  145. t.Errorf("failed to read from nodeSecretConn: %v", err)
  146. return nil, true, err
  147. }
  148. *nodeReads = append(*nodeReads, string(readBuffer[:n]))
  149. }
  150. },
  151. )
  152. assert.True(t, ok, "Unexpected task abortion")
  153. // If error:
  154. if trs.FirstError() != nil {
  155. return nil, true, trs.FirstError()
  156. }
  157. // Otherwise:
  158. return nil, false, nil
  159. }
  160. }
  161. // Run foo & bar in parallel
  162. var trs, ok = async.Parallel(
  163. genNodeRunner("foo", fooConn, fooWrites, &fooReads),
  164. genNodeRunner("bar", barConn, barWrites, &barReads),
  165. )
  166. require.Nil(t, trs.FirstError())
  167. require.True(t, ok, "unexpected task abortion")
  168. // A helper to ensure that the writes and reads match.
  169. // Additionally, small writes (<= dataMaxSize) must be atomically read.
  170. compareWritesReads := func(writes []string, reads []string) {
  171. for {
  172. // Pop next write & corresponding reads
  173. var read, write = "", writes[0]
  174. var readCount = 0
  175. for _, readChunk := range reads {
  176. read += readChunk
  177. readCount++
  178. if len(write) <= len(read) {
  179. break
  180. }
  181. if len(write) <= dataMaxSize {
  182. break // atomicity of small writes
  183. }
  184. }
  185. // Compare
  186. if write != read {
  187. t.Errorf("expected to read %X, got %X", write, read)
  188. }
  189. // Iterate
  190. writes = writes[1:]
  191. reads = reads[readCount:]
  192. if len(writes) == 0 {
  193. break
  194. }
  195. }
  196. }
  197. compareWritesReads(fooWrites, barReads)
  198. compareWritesReads(barWrites, fooReads)
  199. }
  200. func TestDeriveSecretsAndChallengeGolden(t *testing.T) {
  201. goldenFilepath := filepath.Join("testdata", t.Name()+".golden")
  202. if *update {
  203. t.Logf("Updating golden test vector file %s", goldenFilepath)
  204. data := createGoldenTestVectors(t)
  205. require.NoError(t, os.WriteFile(goldenFilepath, []byte(data), 0644))
  206. }
  207. f, err := os.Open(goldenFilepath)
  208. if err != nil {
  209. log.Fatal(err)
  210. }
  211. t.Cleanup(closeAll(t, f))
  212. scanner := bufio.NewScanner(f)
  213. for scanner.Scan() {
  214. line := scanner.Text()
  215. params := strings.Split(line, ",")
  216. randSecretVector, err := hex.DecodeString(params[0])
  217. require.Nil(t, err)
  218. randSecret := new([32]byte)
  219. copy((*randSecret)[:], randSecretVector)
  220. locIsLeast, err := strconv.ParseBool(params[1])
  221. require.Nil(t, err)
  222. expectedRecvSecret, err := hex.DecodeString(params[2])
  223. require.Nil(t, err)
  224. expectedSendSecret, err := hex.DecodeString(params[3])
  225. require.Nil(t, err)
  226. recvSecret, sendSecret := deriveSecrets(randSecret, locIsLeast)
  227. require.Equal(t, expectedRecvSecret, (*recvSecret)[:], "Recv Secrets aren't equal")
  228. require.Equal(t, expectedSendSecret, (*sendSecret)[:], "Send Secrets aren't equal")
  229. }
  230. }
  231. func TestNilPubkey(t *testing.T) {
  232. var fooConn, barConn = makeKVStoreConnPair()
  233. t.Cleanup(closeAll(t, fooConn, barConn))
  234. var fooPrvKey = ed25519.GenPrivKey()
  235. var barPrvKey = privKeyWithNilPubKey{ed25519.GenPrivKey()}
  236. go MakeSecretConnection(fooConn, fooPrvKey) //nolint:errcheck // ignore for tests
  237. _, err := MakeSecretConnection(barConn, barPrvKey)
  238. require.Error(t, err)
  239. assert.Equal(t, "toproto: key type <nil> is not supported", err.Error())
  240. }
  241. func TestNonEd25519Pubkey(t *testing.T) {
  242. var fooConn, barConn = makeKVStoreConnPair()
  243. t.Cleanup(closeAll(t, fooConn, barConn))
  244. var fooPrvKey = ed25519.GenPrivKey()
  245. var barPrvKey = sr25519.GenPrivKey()
  246. go MakeSecretConnection(barConn, barPrvKey) //nolint:errcheck // ignore for tests
  247. _, err := MakeSecretConnection(fooConn, fooPrvKey)
  248. require.Error(t, err)
  249. }
  250. func writeLots(t *testing.T, wg *sync.WaitGroup, conn io.Writer, txt string, n int) {
  251. defer wg.Done()
  252. for i := 0; i < n; i++ {
  253. _, err := conn.Write([]byte(txt))
  254. if err != nil {
  255. t.Errorf("failed to write to fooSecConn: %v", err)
  256. return
  257. }
  258. }
  259. }
  260. func readLots(t *testing.T, wg *sync.WaitGroup, conn io.Reader, n int) {
  261. readBuffer := make([]byte, dataMaxSize)
  262. for i := 0; i < n; i++ {
  263. _, err := conn.Read(readBuffer)
  264. assert.NoError(t, err)
  265. }
  266. wg.Done()
  267. }
  268. // Creates the data for a test vector file.
  269. // The file format is:
  270. // Hex(diffie_hellman_secret), loc_is_least, Hex(recvSecret), Hex(sendSecret), Hex(challenge)
  271. func createGoldenTestVectors(t *testing.T) string {
  272. data := ""
  273. for i := 0; i < 32; i++ {
  274. randSecretVector := tmrand.Bytes(32)
  275. randSecret := new([32]byte)
  276. copy((*randSecret)[:], randSecretVector)
  277. data += hex.EncodeToString((*randSecret)[:]) + ","
  278. locIsLeast := mrand.Int63()%2 == 0
  279. data += strconv.FormatBool(locIsLeast) + ","
  280. recvSecret, sendSecret := deriveSecrets(randSecret, locIsLeast)
  281. data += hex.EncodeToString((*recvSecret)[:]) + ","
  282. data += hex.EncodeToString((*sendSecret)[:]) + ","
  283. }
  284. return data
  285. }
  286. // Each returned ReadWriteCloser is akin to a net.Connection
  287. func makeKVStoreConnPair() (fooConn, barConn kvstoreConn) {
  288. barReader, fooWriter := io.Pipe()
  289. fooReader, barWriter := io.Pipe()
  290. return kvstoreConn{fooReader, fooWriter}, kvstoreConn{barReader, barWriter}
  291. }
  292. func makeSecretConnPair(tb testing.TB) (fooSecConn, barSecConn *SecretConnection) {
  293. var (
  294. fooConn, barConn = makeKVStoreConnPair()
  295. fooPrvKey = ed25519.GenPrivKey()
  296. fooPubKey = fooPrvKey.PubKey()
  297. barPrvKey = ed25519.GenPrivKey()
  298. barPubKey = barPrvKey.PubKey()
  299. )
  300. // Make connections from both sides in parallel.
  301. var trs, ok = async.Parallel(
  302. func(_ int) (val interface{}, abort bool, err error) {
  303. fooSecConn, err = MakeSecretConnection(fooConn, fooPrvKey)
  304. if err != nil {
  305. tb.Errorf("failed to establish SecretConnection for foo: %v", err)
  306. return nil, true, err
  307. }
  308. remotePubBytes := fooSecConn.RemotePubKey()
  309. if !remotePubBytes.Equals(barPubKey) {
  310. err = fmt.Errorf("unexpected fooSecConn.RemotePubKey. Expected %v, got %v",
  311. barPubKey, fooSecConn.RemotePubKey())
  312. tb.Error(err)
  313. return nil, true, err
  314. }
  315. return nil, false, nil
  316. },
  317. func(_ int) (val interface{}, abort bool, err error) {
  318. barSecConn, err = MakeSecretConnection(barConn, barPrvKey)
  319. if barSecConn == nil {
  320. tb.Errorf("failed to establish SecretConnection for bar: %v", err)
  321. return nil, true, err
  322. }
  323. remotePubBytes := barSecConn.RemotePubKey()
  324. if !remotePubBytes.Equals(fooPubKey) {
  325. err = fmt.Errorf("unexpected barSecConn.RemotePubKey. Expected %v, got %v",
  326. fooPubKey, barSecConn.RemotePubKey())
  327. tb.Error(err)
  328. return nil, true, err
  329. }
  330. return nil, false, nil
  331. },
  332. )
  333. require.Nil(tb, trs.FirstError())
  334. require.True(tb, ok, "Unexpected task abortion")
  335. return fooSecConn, barSecConn
  336. }
  337. // Benchmarks
  338. func BenchmarkWriteSecretConnection(b *testing.B) {
  339. b.StopTimer()
  340. b.ReportAllocs()
  341. fooSecConn, barSecConn := makeSecretConnPair(b)
  342. randomMsgSizes := []int{
  343. dataMaxSize / 10,
  344. dataMaxSize / 3,
  345. dataMaxSize / 2,
  346. dataMaxSize,
  347. dataMaxSize * 3 / 2,
  348. dataMaxSize * 2,
  349. dataMaxSize * 7 / 2,
  350. }
  351. fooWriteBytes := make([][]byte, 0, len(randomMsgSizes))
  352. for _, size := range randomMsgSizes {
  353. fooWriteBytes = append(fooWriteBytes, tmrand.Bytes(size))
  354. }
  355. // Consume reads from bar's reader
  356. go func() {
  357. readBuffer := make([]byte, dataMaxSize)
  358. for {
  359. _, err := barSecConn.Read(readBuffer)
  360. if err == io.EOF {
  361. return
  362. } else if err != nil {
  363. b.Errorf("failed to read from barSecConn: %v", err)
  364. return
  365. }
  366. }
  367. }()
  368. b.StartTimer()
  369. for i := 0; i < b.N; i++ {
  370. idx := mrand.Intn(len(fooWriteBytes))
  371. _, err := fooSecConn.Write(fooWriteBytes[idx])
  372. if err != nil {
  373. b.Errorf("failed to write to fooSecConn: %v", err)
  374. return
  375. }
  376. }
  377. b.StopTimer()
  378. if err := fooSecConn.Close(); err != nil {
  379. b.Error(err)
  380. }
  381. // barSecConn.Close() race condition
  382. }
  383. func BenchmarkReadSecretConnection(b *testing.B) {
  384. b.StopTimer()
  385. b.ReportAllocs()
  386. fooSecConn, barSecConn := makeSecretConnPair(b)
  387. randomMsgSizes := []int{
  388. dataMaxSize / 10,
  389. dataMaxSize / 3,
  390. dataMaxSize / 2,
  391. dataMaxSize,
  392. dataMaxSize * 3 / 2,
  393. dataMaxSize * 2,
  394. dataMaxSize * 7 / 2,
  395. }
  396. fooWriteBytes := make([][]byte, 0, len(randomMsgSizes))
  397. for _, size := range randomMsgSizes {
  398. fooWriteBytes = append(fooWriteBytes, tmrand.Bytes(size))
  399. }
  400. go func() {
  401. for i := 0; i < b.N; i++ {
  402. idx := mrand.Intn(len(fooWriteBytes))
  403. _, err := fooSecConn.Write(fooWriteBytes[idx])
  404. if err != nil {
  405. b.Errorf("failed to write to fooSecConn: %v, %v,%v", err, i, b.N)
  406. return
  407. }
  408. }
  409. }()
  410. b.StartTimer()
  411. for i := 0; i < b.N; i++ {
  412. readBuffer := make([]byte, dataMaxSize)
  413. _, err := barSecConn.Read(readBuffer)
  414. if err == io.EOF {
  415. return
  416. } else if err != nil {
  417. b.Fatalf("Failed to read from barSecConn: %v", err)
  418. }
  419. }
  420. b.StopTimer()
  421. }