mirror of https://github.com/ospab/ostp.git
ospab
d915efc715
The relay authenticated clients itself, with an HMAC handshake and a background job pulling the access-key list from the target server's management API. That never worked with a real client and would not have been worth having if it had. It could not work: no OSTP client produces those credentials. The TCP path required an HTTP request (`GET /stream` with `Authorization: Bearer`) and the UDP path a `timestamp || HMAC` preamble, while the client sends junk frames followed by length-prefixed frames, and an obfuscated Noise handshake. There is no HMAC code in ostp-client at all, so every connection was rejected: TCP answered 404, UDP dropped the datagram. It was also weak where it applied. The HMAC covered only an 8-byte timestamp, so a captured signature was a bearer token replayable from any address for the clock-skew window, with no anti-replay set. And the HTTP handshake put a literal `GET /stream` on the wire — a greppable signature in a protocol whose premise is that nothing is recognisable. Authentication now stays where it is cryptographically meaningful. The target server already authenticates every session end-to-end via Noise with a PSK derived from the access key and silently drops what fails; the relay adds nothing by re-checking, and holding a copy of the key list on a forwarding box is a liability. The relay makes no security decisions and says so. What it does need is protection from being a resource sink, so this adds a session cap, a connection cap, and a token-bucket admission limit on NEW sessions only. It forwards to one fixed upstream and replies only to the sender, so it is not a reflector: amplification is one. Fixes a bug the new end-to-end test caught: upstream sockets were bound as "[::]:0" and connected to a possibly-IPv4 upstream, which fails wherever IPV6_V6ONLY defaults on — that is every deployment with an IPv4 target server. The bind family now follows the resolved upstream. upstream_api_url/token/sync_interval_secs are accepted and ignored so existing relay configs keep parsing; the wizard and template no longer emit them, and `ostp check` flags them as removable. |
||
|---|---|---|
| .. | ||
| src | ||
| .gitignore | ||
| Cargo.toml | ||