lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

network_hardening.rs (2796B)

      1 use radroots_transport::{Target, TargetSet, source::FetchBounds};
      2 use radroots_transport_nostr::{
      3     RelayAccess, RelayEndpoint, RelayProfile, RelayProfileKind, RelayUrl, RelayUrlPolicy,
      4 };
      5 
      6 const WORKSPACE_MANIFEST: &str = include_str!("../../../Cargo.toml");
      7 const RELAY_SOURCE: &str = include_str!("../src/relay.rs");
      8 const CLIENT_SOURCE: &str = include_str!("../src/client.rs");
      9 
     10 #[test]
     11 fn tls_verification_and_pinned_dns_are_non_configurable_live_defaults() {
     12     assert!(WORKSPACE_MANIFEST.contains("rustls-tls-webpki-roots"));
     13     for required in [
     14         "client_async_with_config(",
     15         "tokio_rustls::TlsConnector::from(Arc::new(tls_config))",
     16         "roots.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned())",
     17         ".with_no_client_auth()",
     18         "rustls::pki_types::ServerName::try_from(",
     19         "host.trim_matches(['[', ']']).to_owned()",
     20         "crate::source_wire::MeteredIo::new(plaintext, ingress)",
     21         ".max_message_size(Some(MAX_WIRE_MESSAGE_BYTES))",
     22         ".max_frame_size(Some(MAX_WIRE_MESSAGE_BYTES))",
     23         "validate_resolved_addresses(",
     24         "connect_pinned(addresses.as_slice())",
     25         "ConnectionMode::Direct",
     26     ] {
     27         assert!(
     28             RELAY_SOURCE.contains(required),
     29             "missing hardening witness `{required}`"
     30         );
     31     }
     32     for forbidden in [
     33         "danger_accept_invalid_certs",
     34         "danger_accept_invalid_hostnames",
     35         "NoCertificateVerification",
     36     ] {
     37         assert!(!RELAY_SOURCE.contains(forbidden));
     38         assert!(!CLIENT_SOURCE.contains(forbidden));
     39     }
     40 
     41     assert!(RelayUrl::parse("ws://relay.example.com", RelayUrlPolicy::Public).is_err());
     42     assert!(RelayUrl::parse("wss://relay.example.com", RelayUrlPolicy::Public).is_ok());
     43     assert!(RelayUrl::parse("ws://127.0.0.1", RelayUrlPolicy::Local).is_ok());
     44 }
     45 
     46 #[test]
     47 fn page_and_target_limits_reject_oversized_requests() {
     48     assert!(FetchBounds::new(1_001, u64::MAX).is_err());
     49 
     50     let targets = (0..=64)
     51         .map(|index| Target::nostr_relay(format!("wss://r{index}.example.com")).expect("target"))
     52         .collect::<Vec<_>>();
     53     assert!(TargetSet::new(targets).is_err());
     54 
     55     let relays = (0..=64)
     56         .map(|index| {
     57             RelayEndpoint::new(
     58                 format!("wss://r{index}.example.com"),
     59                 RelayUrlPolicy::Public,
     60                 RelayAccess::ReadWrite,
     61             )
     62             .expect("relay endpoint")
     63         })
     64         .collect::<Vec<_>>();
     65     assert!(RelayProfile::explicit(RelayProfileKind::Public, relays).is_err());
     66 }
     67 
     68 #[test]
     69 fn oversized_wire_payload_is_rejected_before_delivery() {
     70     let oversized = "x".repeat(radroots_event_codec::decode::MAX_EVENT_JSON_BYTES + 1);
     71     assert!(radroots_event_codec::decode::signed_event(oversized.as_str()).is_err());
     72 }