roster-host: transport host for the FUT roster update, lifecycle-matched
Second consumer of openfut-tls, and the reason it was extracted first.
This host contains no roster content and no cipher choice: the adapter
owns the 67 bytes and the observed TLS profile, openfut-tls owns the
acceptor, and this crate owns accept/read/drain/write/close.
Lifecycle was MEASURED, not inherited. The obvious mistake here would
have been copying the redirector's 300ms dwell because the other host has
one. A probe against the oracle says otherwise:
dwell after responding 0 ms (redirector: 300 ms)
request body drained POST answered only once it arrives
close clean FIN, never RST
keep-alive none one request per connection
The probe ran against a REPLICA of roster_server.py loaded from its own
source, not against :8081 -- http.server.HTTPServer is single-threaded
and FIFA was mid-session, so holding a connection open to measure the
close would have stalled the game's poll and could have surfaced as the
squad-update error. The replica was then confirmed byte-identical to the
live oracle under masking, the 1-byte delta being the container's Python
version in the Server header.
Differential against the live oracle, every field identical, with the
Server header compared UNMASKED:
GET 230B HEAD 163B POST 163B
drained=True reset=False answered_before_body=False
keepalive: second request accepted by the socket, never answered
Testing follows the redirector's hard-won rule: where a property is
visible both to the client and inside the host, it is asserted inside the
host via ConnOutcome. A client-side check cannot tell "drained" from "not
drained" -- it reads the buffered response either way -- and that exact
mistake let a mutation survive once already.
9 parity tests, 6 unit tests, 5/5 mutations killed, including "answer
before draining", "hold the connection open like the redirector" and
"inherit the redirector's 300ms default".
drain_body is duplicated from the redirector deliberately. Unifying it
means editing the redirector, and the roster A/B must change exactly one
thing. Extraction is scheduled for after the roster gate closes.
Not deployed and not switched: Python still serves :8081.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
funman300
Generated
+9
@@ -3230,6 +3230,15 @@ dependencies = [
|
||||
"openssl",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "openfut-roster-host"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"openfut-adapter-fifa17",
|
||||
"openfut-host-config",
|
||||
"openfut-tls",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "openfut-tls"
|
||||
version = "0.1.0"
|
||||
|
||||
@@ -8,6 +8,7 @@ members = [
|
||||
"openfut-host-config",
|
||||
"openfut-tls",
|
||||
"openfut-redirector-host",
|
||||
"openfut-roster-host",
|
||||
"openfut-bridge",
|
||||
"openfut-launcher",
|
||||
"openfut-launcher/openfut-hook",
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
[package]
|
||||
name = "openfut-roster-host"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
license = "MIT"
|
||||
description = "FIFA 17 FUT roster-update transport host"
|
||||
publish = false
|
||||
|
||||
[dependencies]
|
||||
openfut-adapter-fifa17 = { path = "../openfut-adapter-fifa17" }
|
||||
openfut-host-config = { path = "../openfut-host-config" }
|
||||
# Same listener as the redirector, by construction rather than by convention.
|
||||
# Two hosts configuring TLS separately is how the 2026-08-11 certificate
|
||||
# mismatch happened, and roster is the service where that mismatch first
|
||||
# became visible to the player.
|
||||
openfut-tls = { path = "../openfut-tls" }
|
||||
@@ -0,0 +1,39 @@
|
||||
//! Stamp the commit this binary was built from.
|
||||
//!
|
||||
//! Deliberately records ONLY the commit — no dirty-tree flag. Cargo will not
|
||||
//! re-run a build script because another crate's source changed, so a
|
||||
//! compiled-in "clean" claim can be stale and is therefore not a safeguard.
|
||||
//! (Verified on the Blaze host: editing the adapter and rebuilding left its
|
||||
//! flag reading clean.)
|
||||
//!
|
||||
//! The authoritative checks run at launch, in `scripts/verify-build-identity.sh`,
|
||||
//! which compares this stamp against the checkout's real HEAD and inspects the
|
||||
//! working tree as it is at that moment.
|
||||
|
||||
use std::process::Command;
|
||||
|
||||
fn git(args: &[&str]) -> Option<String> {
|
||||
let out = Command::new("git").args(args).output().ok()?;
|
||||
out.status
|
||||
.success()
|
||||
.then(|| String::from_utf8_lossy(&out.stdout).trim().to_string())
|
||||
}
|
||||
|
||||
fn main() {
|
||||
let commit = git(&["rev-parse", "--short=7", "HEAD"]).unwrap_or_else(|| "unknown".into());
|
||||
println!("cargo:rustc-env=OPENFUT_BUILD_COMMIT={commit}");
|
||||
|
||||
// Committing updates refs/heads/<branch>, not the HEAD file, so watching
|
||||
// HEAD alone leaves the stamp a commit behind.
|
||||
for p in ["../.git/HEAD", "../.git/index"] {
|
||||
if std::path::Path::new(p).exists() {
|
||||
println!("cargo:rerun-if-changed={p}");
|
||||
}
|
||||
}
|
||||
if let Some(rf) = git(&["symbolic-ref", "-q", "HEAD"]) {
|
||||
let path = format!("../.git/{rf}");
|
||||
if std::path::Path::new(&path).exists() {
|
||||
println!("cargo:rerun-if-changed={path}");
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,125 @@
|
||||
//! Roster host configuration.
|
||||
//!
|
||||
//! Endpoints resolve through `openfut-host-config`, the single environment
|
||||
//! reader, so every host builds client-visible addresses the same way. Only
|
||||
//! transport settings are parsed here, and none of them are client-visible.
|
||||
|
||||
use std::time::Duration;
|
||||
|
||||
use openfut_adapter_fifa17::roster;
|
||||
use openfut_host_config::{self as hostcfg, ConfigError};
|
||||
use openfut_tls::{ProtocolVersion, TlsConfig};
|
||||
|
||||
/// How long the oracle holds a roster connection open after responding.
|
||||
///
|
||||
/// **Measured, and deliberately different from the redirector's.** The Blaze
|
||||
/// redirector sleeps 300ms before closing (`time.sleep(0.3)` in
|
||||
/// `redir_handle`); `roster_server.py` has no such sleep, and a lifecycle probe
|
||||
/// against the oracle records `close_ms=0.0` for GET, HEAD and POST alike.
|
||||
///
|
||||
/// Copying the redirector's 300ms because "the other host does it" would have
|
||||
/// been the obvious mistake: FIFA polls this endpoint roughly every 7-15s, so a
|
||||
/// needless dwell per poll is a behaviour change, not a safety margin.
|
||||
pub const ORACLE_CLOSE_DWELL: Duration = Duration::from_millis(0);
|
||||
|
||||
/// Compose the shared listener from the FIFA 17 adapter's observed TLS profile.
|
||||
///
|
||||
/// Identical construction to the redirector host. That is the point: the client
|
||||
/// caches the certificate presented by the first service it reaches, so every
|
||||
/// FIFA-facing listener must be built the same way from the same inputs.
|
||||
fn fifa17_tls(cert: impl Into<String>, key: impl Into<String>) -> Result<TlsConfig, ConfigError> {
|
||||
use openfut_adapter_fifa17::tls as profile;
|
||||
let ver = |s: &str| {
|
||||
ProtocolVersion::parse(s).map_err(|e| ConfigError(format!("FIFA 17 TLS profile: {e}")))
|
||||
};
|
||||
Ok(TlsConfig::new(
|
||||
cert,
|
||||
key,
|
||||
profile::CIPHER_LIST,
|
||||
ver(profile::MIN_VERSION)?,
|
||||
ver(profile::MAX_VERSION)?,
|
||||
))
|
||||
}
|
||||
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct RosterConfig {
|
||||
/// BIND: where this listener binds. Never client-visible.
|
||||
pub listen_addr: String,
|
||||
/// Required, with no default, so this host can never collide with the
|
||||
/// Python roster server it runs beside.
|
||||
pub listen_port: u16,
|
||||
pub tls: TlsConfig,
|
||||
/// The `Server:` header to emit.
|
||||
///
|
||||
/// Environment-derived, not protocol-derived: it carries the *oracle's*
|
||||
/// Python version, so it changes when the container's Python does. Default
|
||||
/// is what the container was last observed to send; overridable so matching
|
||||
/// a redeployed oracle is a configuration change, not a release.
|
||||
pub server_header: String,
|
||||
/// Dwell before closing an answered connection. Overridable ONLY so the
|
||||
/// causal experiment can be run without rebuilding.
|
||||
pub close_dwell: Duration,
|
||||
}
|
||||
|
||||
impl RosterConfig {
|
||||
pub fn from_env() -> Result<RosterConfig, ConfigError> {
|
||||
let adapter = hostcfg::adapter_from_env()?;
|
||||
|
||||
let listen_port = hostcfg::required_port(
|
||||
"OPENFUT_ROSTER_HOST_PORT",
|
||||
"this host runs beside the working Python roster server and must \
|
||||
not collide with it, so the port is explicit and has no default",
|
||||
)?;
|
||||
let listen_addr = hostcfg::optional("OPENFUT_ROSTER_HOST_BIND", &adapter.endpoints.bind);
|
||||
|
||||
let cert = hostcfg::required(
|
||||
"OPENFUT_ROSTER_CERT",
|
||||
"path to the RSA certificate; it MUST be the same certificate every \
|
||||
other FIFA-facing service presents, or the client's cached copy \
|
||||
will not match and the handshake fails with nothing logged",
|
||||
)?;
|
||||
let key = hostcfg::required("OPENFUT_ROSTER_KEY", "path to the matching private key")?;
|
||||
|
||||
let tls = fifa17_tls(cert, key)?;
|
||||
|
||||
let server_header =
|
||||
hostcfg::optional("OPENFUT_ROSTER_SERVER_HEADER", roster::ORACLE_SERVER);
|
||||
|
||||
let close_dwell = match hostcfg::optional_opt("OPENFUT_ROSTER_CLOSE_DWELL_MS") {
|
||||
None => ORACLE_CLOSE_DWELL,
|
||||
// Invalid input is an error, never a silent fallback: a typo that
|
||||
// quietly restored the default would make the causal experiment
|
||||
// report the wrong answer.
|
||||
Some(v) => Duration::from_millis(v.trim().parse().map_err(|_| {
|
||||
ConfigError(format!(
|
||||
"OPENFUT_ROSTER_CLOSE_DWELL_MS is not a number of milliseconds: {v:?}"
|
||||
))
|
||||
})?),
|
||||
};
|
||||
|
||||
Ok(RosterConfig {
|
||||
listen_addr,
|
||||
listen_port,
|
||||
tls,
|
||||
server_header,
|
||||
close_dwell,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn listen_on(&self) -> String {
|
||||
format!("{}:{}", self.listen_addr, self.listen_port)
|
||||
}
|
||||
|
||||
/// Test fixture: an ephemeral port and a certificate pair supplied by the
|
||||
/// caller, so tests never depend on a deployed path.
|
||||
#[doc(hidden)]
|
||||
pub fn for_test(cert: &str, key: &str) -> RosterConfig {
|
||||
RosterConfig {
|
||||
listen_addr: "127.0.0.1".into(),
|
||||
listen_port: 0,
|
||||
tls: fifa17_tls(cert, key).expect("the adapter's TLS profile must be valid"),
|
||||
server_header: roster::ORACLE_SERVER.to_string(),
|
||||
close_dwell: ORACLE_CLOSE_DWELL,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,430 @@
|
||||
//! FUT roster-update transport host.
|
||||
//!
|
||||
//! ```text
|
||||
//! FIFA 17 ──HTTPS GET /fifa17/fut/rosterupdate.xml──> <rosterupdate version="0"/>
|
||||
//! ```
|
||||
//!
|
||||
//! # Division of labour
|
||||
//!
|
||||
//! ```text
|
||||
//! openfut-tls how to build the TLS acceptor
|
||||
//! adapter-fifa17::tls what FIFA 17's TLS was observed to be
|
||||
//! adapter-fifa17::roster what bytes the answer is
|
||||
//! this crate accept, read, drain, write, close
|
||||
//! ```
|
||||
//!
|
||||
//! This host contains no roster content and no cipher choice. It owns the
|
||||
//! socket and the connection lifecycle, nothing else.
|
||||
//!
|
||||
//! # Lifecycle is part of the contract
|
||||
//!
|
||||
//! The redirector proved that byte-identical responses are not behavioural
|
||||
//! parity: answering while the client is still sending leaves unread data in
|
||||
//! the receive queue and Linux turns the close into an RST rather than a FIN.
|
||||
//! So the oracle's lifecycle was *measured* rather than inferred, with a probe
|
||||
//! run against a replica of `roster_server.py` (the live one is single-threaded
|
||||
//! and was serving a live game at the time):
|
||||
//!
|
||||
//! ```text
|
||||
//! dwell after responding 0 ms (the redirector's is 300 ms -- NOT shared)
|
||||
//! request body drained POST is answered only after the body arrives
|
||||
//! close clean FIN, never RST
|
||||
//! keep-alive none one request per connection
|
||||
//! ```
|
||||
//!
|
||||
//! Every one of those is reproduced here, and asserted by `tests/`.
|
||||
//!
|
||||
//! # Why the roster matters more than its 67 bytes suggest
|
||||
//!
|
||||
//! `checkFUTRostersFlow` downloads this before entering FUT; failure aborts
|
||||
//! with *"An error occurred downloading the FUT Squad Update"*. Because it is a
|
||||
//! separate TLS connection from the redirector, it is also where a certificate
|
||||
//! mismatch anywhere in the stack first becomes visible to the player.
|
||||
|
||||
use std::io::{Read, Write};
|
||||
use std::net::{TcpListener, TcpStream};
|
||||
use std::sync::atomic::{AtomicU64, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
use openfut_adapter_fifa17::roster::{self, Method};
|
||||
// The acceptor comes from the shared crate, so this host never names OpenSSL.
|
||||
use openfut_tls::SslAcceptor;
|
||||
|
||||
pub mod config;
|
||||
pub use config::RosterConfig;
|
||||
|
||||
/// Commit this binary was built from, stamped by `build.rs`.
|
||||
pub const BUILD_COMMIT: &str = env!("OPENFUT_BUILD_COMMIT");
|
||||
|
||||
const MAX_HEAD: usize = 16 * 1024;
|
||||
|
||||
pub fn identity() -> String {
|
||||
format!(
|
||||
"openfut-roster-host v{} commit={} profile={} openssl={}",
|
||||
env!("CARGO_PKG_VERSION"),
|
||||
BUILD_COMMIT,
|
||||
if cfg!(debug_assertions) {
|
||||
"debug"
|
||||
} else {
|
||||
"release"
|
||||
},
|
||||
openfut_tls::openssl_version(),
|
||||
)
|
||||
}
|
||||
|
||||
/// Machine-readable `key=value`, matching the redirector's banner so the two
|
||||
/// hosts can be compared at a glance.
|
||||
///
|
||||
/// `cert_sha256` is printed unprompted: serving a different certificate from
|
||||
/// the rest of the stack raises no error at startup and breaks the client much
|
||||
/// later with nothing logged anywhere.
|
||||
pub fn banner(cfg: &RosterConfig) -> String {
|
||||
format!(
|
||||
"{} listen={} server_header={:?} close_dwell_ms={} cert_sha256={} ciphers={}",
|
||||
identity(),
|
||||
cfg.listen_on(),
|
||||
cfg.server_header,
|
||||
cfg.close_dwell.as_millis(),
|
||||
openfut_tls::certificate_fingerprint(&cfg.tls.cert_path)
|
||||
.unwrap_or_else(|e| format!("unreadable ({e})")),
|
||||
cfg.tls.cipher_list,
|
||||
)
|
||||
}
|
||||
|
||||
/// What happened when the request body was drained.
|
||||
///
|
||||
/// Duplicated from the redirector host on purpose, for now. Unifying the two
|
||||
/// would mean editing the redirector, and the roster A/B must change exactly
|
||||
/// one thing. This is scheduled for extraction once the roster gate closes.
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
pub enum BodyRead {
|
||||
/// No `Content-Length` header — nothing to drain.
|
||||
None,
|
||||
Complete(usize),
|
||||
Short {
|
||||
got: usize,
|
||||
want: usize,
|
||||
},
|
||||
}
|
||||
|
||||
/// What the host did on a connection, beyond the bytes it sent.
|
||||
///
|
||||
/// Recorded because the divergence that cost two gate attempts on the
|
||||
/// redirector — a request body left unread — is invisible to any comparison of
|
||||
/// the response.
|
||||
#[derive(Debug, Clone)]
|
||||
pub struct ConnOutcome {
|
||||
pub id: u64,
|
||||
pub method: Option<Method>,
|
||||
pub path: String,
|
||||
pub request_bytes: usize,
|
||||
pub body: BodyRead,
|
||||
pub response_bytes: usize,
|
||||
}
|
||||
|
||||
pub type Outcomes = Arc<std::sync::Mutex<Vec<ConnOutcome>>>;
|
||||
|
||||
/// Bounded: a host polled every few seconds must not accumulate forever.
|
||||
const OUTCOME_HISTORY: usize = 64;
|
||||
|
||||
fn record(outcomes: &Outcomes, o: ConnOutcome) {
|
||||
if let Ok(mut v) = outcomes.lock() {
|
||||
if v.len() >= OUTCOME_HISTORY {
|
||||
v.remove(0);
|
||||
}
|
||||
v.push(o);
|
||||
}
|
||||
}
|
||||
|
||||
pub struct Server {
|
||||
pub local_addr: std::net::SocketAddr,
|
||||
listener: TcpListener,
|
||||
acceptor: Arc<SslAcceptor>,
|
||||
cfg: Arc<RosterConfig>,
|
||||
outcomes: Outcomes,
|
||||
}
|
||||
|
||||
impl Server {
|
||||
pub fn outcomes(&self) -> Outcomes {
|
||||
self.outcomes.clone()
|
||||
}
|
||||
|
||||
pub fn run(self) -> std::io::Result<()> {
|
||||
let counter = AtomicU64::new(0);
|
||||
for incoming in self.listener.incoming() {
|
||||
let Ok(stream) = incoming else { continue };
|
||||
let id = counter.fetch_add(1, Ordering::Relaxed) + 1;
|
||||
let (acceptor, cfg) = (self.acceptor.clone(), self.cfg.clone());
|
||||
let outcomes = self.outcomes.clone();
|
||||
std::thread::spawn(move || handle(stream, id, &acceptor, &cfg, &outcomes));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
/// Build TLS, rehearse the retail handshake, and bind.
|
||||
///
|
||||
/// The rehearsal runs before the listener accepts anything, so a TLS
|
||||
/// misconfiguration is a startup failure rather than a client-visible one.
|
||||
pub fn bind(cfg: RosterConfig) -> std::io::Result<Server> {
|
||||
use openfut_adapter_fifa17::tls as profile;
|
||||
|
||||
let acceptor = openfut_tls::build_acceptor(&cfg.tls)
|
||||
.map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidInput, e.to_string()))?;
|
||||
|
||||
let neg = openfut_tls::self_test(
|
||||
&cfg.tls,
|
||||
profile::OBSERVED_CLIENT_SUITES,
|
||||
profile::CLIENT_SNI,
|
||||
)
|
||||
.map_err(|e| {
|
||||
std::io::Error::new(
|
||||
std::io::ErrorKind::InvalidInput,
|
||||
format!("TLS self-test failed: {e}"),
|
||||
)
|
||||
})?;
|
||||
log(&format!(
|
||||
"SELF-TEST OK: a FIFA-like client negotiates {} / {}",
|
||||
neg.version, neg.cipher
|
||||
));
|
||||
|
||||
let listener = TcpListener::bind(cfg.listen_on())?;
|
||||
let local_addr = listener.local_addr()?;
|
||||
Ok(Server {
|
||||
local_addr,
|
||||
listener,
|
||||
acceptor: Arc::new(acceptor),
|
||||
cfg: Arc::new(cfg),
|
||||
outcomes: Arc::new(std::sync::Mutex::new(Vec::new())),
|
||||
})
|
||||
}
|
||||
|
||||
pub fn serve(cfg: RosterConfig) -> std::io::Result<()> {
|
||||
let server = bind(cfg)?;
|
||||
log(&banner(&server.cfg));
|
||||
server.run()
|
||||
}
|
||||
|
||||
fn log(msg: &str) {
|
||||
let t = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs_f64())
|
||||
.unwrap_or_default();
|
||||
println!("[{t:.3}] {msg}");
|
||||
}
|
||||
|
||||
fn handle(
|
||||
stream: TcpStream,
|
||||
id: u64,
|
||||
acceptor: &SslAcceptor,
|
||||
cfg: &RosterConfig,
|
||||
outcomes: &Outcomes,
|
||||
) {
|
||||
let peer = stream
|
||||
.peer_addr()
|
||||
.map(|a| a.to_string())
|
||||
.unwrap_or_else(|_| "?".into());
|
||||
|
||||
let mut tls = match acceptor.accept(stream) {
|
||||
Ok(s) => s,
|
||||
Err(e) => {
|
||||
log(&format!("conn-{id:04} {peer} TLS HANDSHAKE FAILED: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
|
||||
let mut buf = Vec::with_capacity(1024);
|
||||
if !read_head(&mut tls, &mut buf) {
|
||||
log(&format!("conn-{id:04} {peer} no request read"));
|
||||
return;
|
||||
}
|
||||
|
||||
let head = String::from_utf8_lossy(&buf).to_string();
|
||||
let line0 = head.lines().next().unwrap_or_default().to_string();
|
||||
let method = Method::parse(&line0);
|
||||
let path = line0.split_whitespace().nth(1).unwrap_or("").to_string();
|
||||
|
||||
// Drain BEFORE answering, exactly as the oracle does. `do_POST` reads
|
||||
// Content-Length bytes first; a lifecycle probe confirms the oracle does
|
||||
// not answer until the body arrives. Answering early would leave unread
|
||||
// data in the receive queue and turn our close into an RST.
|
||||
let body = drain_body(&mut tls, &mut buf);
|
||||
|
||||
let response = match method {
|
||||
Some(m) => roster::roster_response(m, &cfg.server_header, &now_http_date()),
|
||||
// The oracle only defines GET/HEAD/POST; anything else is answered by
|
||||
// BaseHTTPRequestHandler's own 501, which this host does not claim to
|
||||
// reproduce. Closing without a response is honest about that rather
|
||||
// than inventing a reply the oracle never sends.
|
||||
None => {
|
||||
log(&format!(
|
||||
"conn-{id:04} {peer} unsupported method in {line0:?}; closing without a response"
|
||||
));
|
||||
record(
|
||||
outcomes,
|
||||
ConnOutcome {
|
||||
id,
|
||||
method: None,
|
||||
path,
|
||||
request_bytes: buf.len(),
|
||||
body,
|
||||
response_bytes: 0,
|
||||
},
|
||||
);
|
||||
let _ = tls.shutdown();
|
||||
return;
|
||||
}
|
||||
};
|
||||
|
||||
let _ = tls.write_all(&response);
|
||||
let _ = tls.flush();
|
||||
|
||||
log(&format!(
|
||||
"conn-{id:04} {peer} {line0} req_bytes={} body={} -> {}B",
|
||||
buf.len(),
|
||||
describe(body),
|
||||
response.len()
|
||||
));
|
||||
record(
|
||||
outcomes,
|
||||
ConnOutcome {
|
||||
id,
|
||||
method,
|
||||
path,
|
||||
request_bytes: buf.len(),
|
||||
body,
|
||||
response_bytes: response.len(),
|
||||
},
|
||||
);
|
||||
|
||||
// Zero by default: the oracle has no post-response sleep. Kept
|
||||
// configurable so the causal experiment is a config change.
|
||||
if !cfg.close_dwell.is_zero() {
|
||||
std::thread::sleep(cfg.close_dwell);
|
||||
}
|
||||
// One request per connection: the response says `Connection: close` and the
|
||||
// oracle closes. No keep-alive loop, measured and matched.
|
||||
let _ = tls.shutdown();
|
||||
}
|
||||
|
||||
fn describe(b: BodyRead) -> String {
|
||||
match b {
|
||||
BodyRead::None => "none".into(),
|
||||
BodyRead::Complete(n) => format!("{n}B complete"),
|
||||
BodyRead::Short { got, want } => format!("{got}/{want}B SHORT"),
|
||||
}
|
||||
}
|
||||
|
||||
/// `Date:` for right now, in the oracle's format.
|
||||
fn now_http_date() -> String {
|
||||
let secs = SystemTime::now()
|
||||
.duration_since(UNIX_EPOCH)
|
||||
.map(|d| d.as_secs() as i64)
|
||||
.unwrap_or(0);
|
||||
roster::http_date(secs)
|
||||
}
|
||||
|
||||
/// Read until the end of the request head, or give up.
|
||||
fn read_head<S: Read>(stream: &mut S, buf: &mut Vec<u8>) -> bool {
|
||||
let mut chunk = [0u8; 1024];
|
||||
loop {
|
||||
match stream.read(&mut chunk) {
|
||||
Ok(0) | Err(_) => return !buf.is_empty(),
|
||||
Ok(n) => {
|
||||
buf.extend_from_slice(&chunk[..n]);
|
||||
if buf.windows(4).any(|w| w == b"\r\n\r\n") {
|
||||
return true;
|
||||
}
|
||||
// A client that never terminates its head must not be able to
|
||||
// grow this buffer without bound.
|
||||
if buf.len() > MAX_HEAD {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse `Content-Length` and read the remainder of the body into `buf`.
|
||||
///
|
||||
/// Header lookup is case-insensitive, and a client that stops early ends the
|
||||
/// read rather than hanging.
|
||||
fn drain_body<S: Read>(stream: &mut S, buf: &mut Vec<u8>) -> BodyRead {
|
||||
let Some(sep) = buf.windows(4).position(|w| w == b"\r\n\r\n") else {
|
||||
return BodyRead::None;
|
||||
};
|
||||
let head = String::from_utf8_lossy(&buf[..sep]).to_string();
|
||||
let Some(want) = head
|
||||
.lines()
|
||||
.find(|l| l.to_ascii_lowercase().starts_with("content-length"))
|
||||
.and_then(|l| l.split(':').nth(1))
|
||||
.and_then(|v| v.trim().parse::<usize>().ok())
|
||||
else {
|
||||
return BodyRead::None;
|
||||
};
|
||||
|
||||
let mut got = buf.len() - (sep + 4);
|
||||
let mut chunk = [0u8; 4096];
|
||||
while got < want {
|
||||
match stream.read(&mut chunk) {
|
||||
Ok(0) | Err(_) => return BodyRead::Short { got, want },
|
||||
Ok(n) => {
|
||||
buf.extend_from_slice(&chunk[..n]);
|
||||
got += n;
|
||||
}
|
||||
}
|
||||
}
|
||||
BodyRead::Complete(got)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn the_default_dwell_is_zero_unlike_the_redirectors() {
|
||||
// The redirector sleeps 300ms; the roster oracle does not. Inheriting
|
||||
// the wrong one would add a needless delay to a poll that runs every
|
||||
// few seconds, and would be a behaviour change rather than caution.
|
||||
assert_eq!(config::ORACLE_CLOSE_DWELL.as_millis(), 0);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn identity_names_the_commit_and_linked_openssl() {
|
||||
let i = identity();
|
||||
assert!(i.contains("commit="), "{i}");
|
||||
assert!(i.contains("openssl="), "{i}");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_body_is_reported_short_when_the_client_stops_early() {
|
||||
let mut buf = b"POST / HTTP/1.1\r\nContent-Length: 10\r\n\r\nabc".to_vec();
|
||||
let mut rest: &[u8] = b"";
|
||||
assert_eq!(
|
||||
drain_body(&mut rest, &mut buf),
|
||||
BodyRead::Short { got: 3, want: 10 }
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn a_body_split_across_reads_is_completed() {
|
||||
let mut buf = b"POST / HTTP/1.1\r\nContent-Length: 8\r\n\r\nab".to_vec();
|
||||
let mut rest: &[u8] = b"cdefgh";
|
||||
assert_eq!(drain_body(&mut rest, &mut buf), BodyRead::Complete(8));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn content_length_is_matched_case_insensitively() {
|
||||
let mut buf = b"POST / HTTP/1.1\r\ncOnTeNt-LeNgTh: 4\r\n\r\n".to_vec();
|
||||
let mut rest: &[u8] = b"abcd";
|
||||
assert_eq!(drain_body(&mut rest, &mut buf), BodyRead::Complete(4));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn no_content_length_means_nothing_to_drain() {
|
||||
let mut buf = b"GET / HTTP/1.1\r\nHost: x\r\n\r\n".to_vec();
|
||||
let mut rest: &[u8] = b"";
|
||||
assert_eq!(drain_body(&mut rest, &mut buf), BodyRead::None);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
//! Entry point for the FUT roster-update host.
|
||||
|
||||
fn main() -> std::io::Result<()> {
|
||||
// `--identity` so a lifecycle script can ask the binary which commit it was
|
||||
// built from, rather than inferring it from a file's mtime. Checking the
|
||||
// artifact on disk instead of the running process has already produced one
|
||||
// confidently wrong refusal on this project.
|
||||
if std::env::args().any(|a| a == "--identity") {
|
||||
println!("{}", openfut_roster_host::identity());
|
||||
return Ok(());
|
||||
}
|
||||
let cfg = openfut_roster_host::RosterConfig::from_env()
|
||||
.map_err(|e| std::io::Error::new(std::io::ErrorKind::InvalidInput, e.to_string()))?;
|
||||
openfut_roster_host::serve(cfg)
|
||||
}
|
||||
@@ -0,0 +1,295 @@
|
||||
//! The roster host held against the Python oracle's measured behaviour.
|
||||
//!
|
||||
//! Response bytes are only half of it. The redirector cost two live gate
|
||||
//! attempts to a divergence no response comparison could see — a request body
|
||||
//! left unread, which turns the close into an RST — so the oracle's lifecycle
|
||||
//! was measured with a probe and every property is asserted here:
|
||||
//!
|
||||
//! ```text
|
||||
//! dwell after responding 0 ms
|
||||
//! request body drained before the response is written
|
||||
//! close immediately after, cleanly
|
||||
//! keep-alive none: one request per connection
|
||||
//! ```
|
||||
//!
|
||||
//! Where a property is observable both from the client and from inside the
|
||||
//! host, it is asserted **inside the host** via `ConnOutcome`. That distinction
|
||||
//! is not pedantry: the first attempt to test body-draining asserted that the
|
||||
//! client still received its response, and that test passed against a host that
|
||||
//! did not drain at all — the client reads the buffered response and sees
|
||||
//! `close_notify` before any reset.
|
||||
|
||||
use std::io::{Read, Write};
|
||||
use std::net::TcpStream;
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use openfut_adapter_fifa17::roster;
|
||||
use openfut_roster_host::{bind, BodyRead, RosterConfig};
|
||||
|
||||
const PATH: &str = "/fifa17/fut/rosterupdate.xml";
|
||||
const BODY: &[u8] = b"probe=1&pad=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
|
||||
|
||||
fn cert_pair() -> (String, String) {
|
||||
let base = concat!(env!("CARGO_MANIFEST_DIR"), "/../fifa17-recon/tools");
|
||||
(
|
||||
format!("{base}/redir_cert.pem"),
|
||||
format!("{base}/redir_key.pem"),
|
||||
)
|
||||
}
|
||||
|
||||
struct Harness {
|
||||
addr: std::net::SocketAddr,
|
||||
outcomes: openfut_roster_host::Outcomes,
|
||||
}
|
||||
|
||||
fn start() -> Harness {
|
||||
start_with(|_| {})
|
||||
}
|
||||
|
||||
fn start_with(tweak: impl FnOnce(&mut RosterConfig)) -> Harness {
|
||||
let (c, k) = cert_pair();
|
||||
let mut cfg = RosterConfig::for_test(&c, &k);
|
||||
tweak(&mut cfg);
|
||||
let server = bind(cfg).expect("bind");
|
||||
let addr = server.local_addr;
|
||||
let outcomes = server.outcomes();
|
||||
std::thread::spawn(move || {
|
||||
let _ = server.run();
|
||||
});
|
||||
Harness { addr, outcomes }
|
||||
}
|
||||
|
||||
/// A client that behaves like FIFA: legacy suites, no certificate checking.
|
||||
fn connect(addr: std::net::SocketAddr) -> openfut_tls::SslStream<TcpStream> {
|
||||
use openfut_tls::{SslConnector, SslMethod, SslVerifyMode};
|
||||
let mut b = SslConnector::builder(SslMethod::tls()).expect("connector");
|
||||
b.set_cipher_list(openfut_adapter_fifa17::tls::OBSERVED_CLIENT_SUITES)
|
||||
.expect("ciphers");
|
||||
b.set_verify(SslVerifyMode::NONE);
|
||||
let sock = TcpStream::connect(addr).expect("connect");
|
||||
sock.set_read_timeout(Some(Duration::from_secs(5))).unwrap();
|
||||
let ssl = b
|
||||
.build()
|
||||
.configure()
|
||||
.and_then(|c| c.verify_hostname(false).into_ssl("roster-test"))
|
||||
.expect("ssl");
|
||||
let mut s = openfut_tls::SslStream::new(ssl, sock).expect("stream");
|
||||
s.connect().expect("handshake");
|
||||
s
|
||||
}
|
||||
|
||||
fn request(method: &str, body: Option<&[u8]>) -> Vec<u8> {
|
||||
let mut r = format!("{method} {PATH} HTTP/1.1\r\nHost: roster-test\r\nAccept: */*\r\n");
|
||||
if let Some(b) = body {
|
||||
r.push_str(&format!("Content-Length: {}\r\n", b.len()));
|
||||
}
|
||||
r.push_str("\r\n");
|
||||
let mut out = r.into_bytes();
|
||||
if let Some(b) = body {
|
||||
out.extend_from_slice(b);
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
fn read_to_eof(s: &mut openfut_tls::SslStream<TcpStream>) -> Vec<u8> {
|
||||
let mut out = Vec::new();
|
||||
let mut chunk = [0u8; 4096];
|
||||
loop {
|
||||
match s.read(&mut chunk) {
|
||||
Ok(0) | Err(_) => break,
|
||||
Ok(n) => out.extend_from_slice(&chunk[..n]),
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
fn exchange(addr: std::net::SocketAddr, method: &str, body: Option<&[u8]>) -> Vec<u8> {
|
||||
let mut s = connect(addr);
|
||||
s.write_all(&request(method, body)).expect("write");
|
||||
s.flush().ok();
|
||||
read_to_eof(&mut s)
|
||||
}
|
||||
|
||||
fn mask(raw: &[u8]) -> String {
|
||||
String::from_utf8_lossy(raw)
|
||||
.split("\r\n")
|
||||
.map(|l| {
|
||||
if l.starts_with("Date: ") {
|
||||
"Date: <MASKED>".to_string()
|
||||
} else if l.starts_with("Server: ") {
|
||||
"Server: <MASKED>".to_string()
|
||||
} else {
|
||||
l.to_string()
|
||||
}
|
||||
})
|
||||
.collect::<Vec<_>>()
|
||||
.join("\r\n")
|
||||
}
|
||||
|
||||
/// The bytes the adapter says the oracle sends, masked the same way.
|
||||
fn expected(method: roster::Method) -> String {
|
||||
mask(&roster::roster_response(
|
||||
method,
|
||||
roster::ORACLE_SERVER,
|
||||
"IRRELEVANT",
|
||||
))
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn get_returns_the_oracles_bytes() {
|
||||
let h = start();
|
||||
let got = exchange(h.addr, "GET", None);
|
||||
assert_eq!(mask(&got), expected(roster::Method::Get));
|
||||
assert!(String::from_utf8_lossy(&got).starts_with("HTTP/1.0 200 OK\r\n"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn head_and_post_are_headers_only_but_still_advertise_the_body() {
|
||||
let h = start();
|
||||
for (m, adapter_m) in [
|
||||
("HEAD", roster::Method::Head),
|
||||
("POST", roster::Method::Post),
|
||||
] {
|
||||
let body = if m == "POST" { Some(BODY) } else { None };
|
||||
let got = exchange(h.addr, m, body);
|
||||
assert_eq!(mask(&got), expected(adapter_m), "{m} differs");
|
||||
let text = String::from_utf8_lossy(&got);
|
||||
assert!(text.contains("Content-Length: 67"), "{m}: {text}");
|
||||
assert!(text.ends_with("\r\n\r\n"), "{m} must send no body");
|
||||
}
|
||||
}
|
||||
|
||||
/// Asserted on the HOST's record, not on what the client received.
|
||||
///
|
||||
/// A client-side assertion cannot distinguish "drained" from "not drained":
|
||||
/// it reads the buffered response either way. This is the exact mistake that
|
||||
/// let a mutation survive on the redirector.
|
||||
#[test]
|
||||
fn the_request_body_is_drained_before_the_response_is_written() {
|
||||
let h = start();
|
||||
let _ = exchange(h.addr, "POST", Some(BODY));
|
||||
let rec = h.outcomes.lock().unwrap();
|
||||
let last = rec.last().expect("a connection was recorded");
|
||||
assert_eq!(
|
||||
last.body,
|
||||
BodyRead::Complete(BODY.len()),
|
||||
"the whole body must be read before answering, or the close becomes an RST"
|
||||
);
|
||||
assert!(last.response_bytes > 0);
|
||||
}
|
||||
|
||||
/// The oracle answers a POST only after the body arrives. Sending the head,
|
||||
/// pausing, then sending the body proves the host waits rather than replying
|
||||
/// early and leaving the socket dirty.
|
||||
#[test]
|
||||
fn a_late_body_is_waited_for_rather_than_answered_early() {
|
||||
let h = start();
|
||||
let mut s = connect(h.addr);
|
||||
let head = format!(
|
||||
"POST {PATH} HTTP/1.1\r\nHost: roster-test\r\nContent-Length: {}\r\n\r\n",
|
||||
BODY.len()
|
||||
);
|
||||
s.write_all(head.as_bytes()).unwrap();
|
||||
s.flush().ok();
|
||||
|
||||
s.get_ref()
|
||||
.set_read_timeout(Some(Duration::from_millis(600)))
|
||||
.unwrap();
|
||||
let mut early = [0u8; 64];
|
||||
let early_n = s.read(&mut early).unwrap_or(0);
|
||||
assert_eq!(
|
||||
early_n,
|
||||
0,
|
||||
"answered before the body arrived: {:?}",
|
||||
String::from_utf8_lossy(&early[..early_n])
|
||||
);
|
||||
|
||||
s.get_ref()
|
||||
.set_read_timeout(Some(Duration::from_secs(5)))
|
||||
.unwrap();
|
||||
s.write_all(BODY).unwrap();
|
||||
s.flush().ok();
|
||||
let late = read_to_eof(&mut s);
|
||||
assert!(!late.is_empty(), "no response after the body arrived");
|
||||
assert_eq!(mask(&late), expected(roster::Method::Post));
|
||||
}
|
||||
|
||||
/// One request per connection: the response says `Connection: close` and the
|
||||
/// oracle closes. Measured, not assumed — a keep-alive loop would be a
|
||||
/// behaviour change invisible in any single response.
|
||||
#[test]
|
||||
fn the_connection_closes_after_one_request() {
|
||||
let h = start();
|
||||
let mut s = connect(h.addr);
|
||||
s.write_all(&request("GET", None)).unwrap();
|
||||
s.flush().ok();
|
||||
let first = read_to_eof(&mut s);
|
||||
assert!(!first.is_empty());
|
||||
// read_to_eof already ran to EOF; a second request must not be answered.
|
||||
let _ = s.write_all(&request("GET", None));
|
||||
let mut buf = [0u8; 32];
|
||||
let n = s.read(&mut buf).unwrap_or(0);
|
||||
assert_eq!(n, 0, "a second request was answered on the same connection");
|
||||
}
|
||||
|
||||
/// The oracle has no post-response sleep — unlike the redirector's 300ms.
|
||||
/// Inheriting the wrong dwell would add delay to a poll that runs every few
|
||||
/// seconds.
|
||||
#[test]
|
||||
fn the_connection_is_not_held_open_after_responding() {
|
||||
let h = start();
|
||||
let mut s = connect(h.addr);
|
||||
s.write_all(&request("GET", None)).unwrap();
|
||||
s.flush().ok();
|
||||
let start = Instant::now();
|
||||
let got = read_to_eof(&mut s);
|
||||
let elapsed = start.elapsed();
|
||||
assert!(!got.is_empty());
|
||||
assert!(
|
||||
elapsed < Duration::from_millis(150),
|
||||
"closed after {elapsed:?}; the roster oracle closes immediately"
|
||||
);
|
||||
}
|
||||
|
||||
/// The dwell stays configurable so the causal experiment — set it and confirm
|
||||
/// the delay appears — can run without a rebuild. Guards against the knob
|
||||
/// being quietly ignored.
|
||||
#[test]
|
||||
fn the_dwell_is_overridable() {
|
||||
let h = start_with(|c| c.close_dwell = Duration::from_millis(400));
|
||||
let mut s = connect(h.addr);
|
||||
s.write_all(&request("GET", None)).unwrap();
|
||||
s.flush().ok();
|
||||
let start = Instant::now();
|
||||
let _ = read_to_eof(&mut s);
|
||||
assert!(
|
||||
start.elapsed() >= Duration::from_millis(350),
|
||||
"dwell override had no effect"
|
||||
);
|
||||
}
|
||||
|
||||
/// The oracle never routes on the path — it logs it and answers the same way.
|
||||
/// A host that started 404ing unknown paths would be a behaviour change.
|
||||
#[test]
|
||||
fn any_path_gets_the_same_answer() {
|
||||
let h = start();
|
||||
let mut s = connect(h.addr);
|
||||
s.write_all(b"GET /something/else HTTP/1.1\r\nHost: x\r\n\r\n")
|
||||
.unwrap();
|
||||
s.flush().ok();
|
||||
let got = read_to_eof(&mut s);
|
||||
assert_eq!(mask(&got), expected(roster::Method::Get));
|
||||
}
|
||||
|
||||
/// Masking must not be able to hide a real difference.
|
||||
#[test]
|
||||
fn masking_does_not_hide_a_missing_header() {
|
||||
let good = roster::roster_response(roster::Method::Get, roster::ORACLE_SERVER, "X");
|
||||
let without: Vec<u8> = String::from_utf8_lossy(&good)
|
||||
.split("\r\n")
|
||||
.filter(|l| !l.starts_with("Date: "))
|
||||
.collect::<Vec<_>>()
|
||||
.join("\r\n")
|
||||
.into_bytes();
|
||||
assert_ne!(mask(&good), mask(&without));
|
||||
}
|
||||
@@ -33,7 +33,15 @@
|
||||
use std::fmt;
|
||||
use std::path::Path;
|
||||
|
||||
use openssl::ssl::{SslAcceptor, SslFiletype, SslMethod, SslOptions, SslVersion};
|
||||
use openssl::ssl::{SslFiletype, SslOptions, SslVersion};
|
||||
|
||||
/// Re-exported so a transport host never has to name OpenSSL itself.
|
||||
///
|
||||
/// Hosts depend on this crate, not on `openssl`. That keeps the linked TLS
|
||||
/// implementation a property of one manifest rather than of every host — the
|
||||
/// version is gate evidence, and a host that could pull its own would be able
|
||||
/// to drift from the rest of the stack silently.
|
||||
pub use openssl::ssl::{SslAcceptor, SslConnector, SslMethod, SslStream, SslVerifyMode};
|
||||
|
||||
#[derive(Debug)]
|
||||
pub struct TlsError(pub String);
|
||||
|
||||
Reference in New Issue
Block a user