mrambossekandClaude Fable 5
ce1aaa332a
fmr binds two IPv4 addresses. connFor picked whichever socket of the right family came first in the bind list, so a downtrain for a session established on .150 went out from .151 — and every packet was dropped by the client's NAT, which has no mapping for that pair. tcpdump on the server showed all 50 leaving; the client saw none. Read as "100% downstream loss", which is the worst kind of wrong: a confident measurement of something that never happened. Sessions now record which of our own bound addresses received their traffic, and granted sends (and delayed echo) go back out through that socket. The fallback to a family match is kept for the case where nothing has been received yet, and the test pins both paths — a single-homed lab can never reproduce this. Also: the client-side halves of the same work — anonymizer (core-privacy), local run archive with retention (core-archive), upload client, and the app's settings and history screens. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
63 lines
1.9 KiB
Go
63 lines
1.9 KiB
Go
// SPDX-FileCopyrightText: 2026 Echolot contributors
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package control
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestHTTPEchoReflectsRequest(t *testing.T) {
|
|
s := &Server{}
|
|
req := httptest.NewRequest("POST", "/v1/echo", strings.NewReader("payload-bytes"))
|
|
req.Header.Set("X-Injected", "canary")
|
|
rr := httptest.NewRecorder()
|
|
s.httpEcho(rr, req)
|
|
|
|
var resp struct {
|
|
RequestHeadB64 string `json:"request_head_b64"`
|
|
BodyB64 string `json:"body_b64"`
|
|
BodyLen int `json:"body_len"`
|
|
Scheme string `json:"scheme"`
|
|
}
|
|
if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
head, _ := base64.StdEncoding.DecodeString(resp.RequestHeadB64)
|
|
if !strings.Contains(string(head), "X-Injected: canary") {
|
|
t.Fatalf("echo did not reflect the injected header:\n%s", head)
|
|
}
|
|
body, _ := base64.StdEncoding.DecodeString(resp.BodyB64)
|
|
if string(body) != "payload-bytes" || resp.BodyLen != 13 {
|
|
t.Fatalf("body mismatch: %q len=%d", body, resp.BodyLen)
|
|
}
|
|
if resp.Scheme != "http" { // httptest requests carry no TLS
|
|
t.Fatalf("scheme = %s, want http", resp.Scheme)
|
|
}
|
|
}
|
|
|
|
func TestTLSReferenceReturnsChain(t *testing.T) {
|
|
s := &Server{PinB64: "TESTPIN", CertChain: [][]byte{{0x30, 0x82, 0x01}, {0xAA, 0xBB}}}
|
|
rr := httptest.NewRecorder()
|
|
s.tlsReference(rr, httptest.NewRequest("GET", "/v1/tls-reference", nil))
|
|
|
|
var resp struct {
|
|
PinSHA256 string `json:"pin_sha256"`
|
|
ChainDER []string `json:"chain_der"`
|
|
}
|
|
if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if resp.PinSHA256 != "TESTPIN" || len(resp.ChainDER) != 2 {
|
|
t.Fatalf("bad tls-reference: %+v", resp)
|
|
}
|
|
first, _ := base64.StdEncoding.DecodeString(resp.ChainDER[0])
|
|
if len(first) != 3 || first[0] != 0x30 {
|
|
t.Fatalf("leaf DER not round-tripped: %x", first)
|
|
}
|
|
}
|