mirror of
https://github.com/freemkv/freemkv-keysources.git
synced 2026-10-07 18:13:11 +00:00
Matthew Jackson
599422ef22
CI/lint hardening since v1.6.14: clippy on stable with the MSRV single-sourced from Cargo.toml, cargo-deny dependency-audit gate with first-party git sources allowed (#15), and audience-based comment-guard (#17). No library code changes.
40 lines
1.9 KiB
Markdown
40 lines
1.9 KiB
Markdown
# `src/online.rs` — `OnlineSource::agent` caching
|
|
|
|
## Why cache at all
|
|
|
|
`query` used to build a FRESH `ureq::Agent` every call, and an FMTS disc
|
|
makes two calls per rip (`get_unit_keys` + `get_fmts_indexes`), so it paid
|
|
two TLS handshakes to the same host for no reason — an agent owns the
|
|
connection pool, and a discarded agent discards the pooled, already
|
|
negotiated TLS connection with it.
|
|
|
|
## Security invariant
|
|
|
|
The agent is reused ONLY when the freshly resolved + guarded address SET is
|
|
identical to the one the cached agent is pinned to. Every query still
|
|
re-resolves and re-runs the SSRF guard — that is the whole anti-rebinding
|
|
defence and is deliberately not cached; what is reused is the connection,
|
|
and only to addresses just re-validated this call.
|
|
|
|
## Why the cache key is a sorted, deduped SET, not an ordered sequence
|
|
|
|
`to_socket_addrs` hands back whatever order the resolver felt like, and a
|
|
round-robin keyserver reorders its A/AAAA records on essentially every
|
|
lookup — an ordered `==` therefore missed the cache every single time
|
|
against exactly the deployment that most needs it, silently degrading to
|
|
the per-query TLS handshake this field exists to avoid.
|
|
|
|
Set equality is also the honest predicate: the security property being
|
|
asserted is "these are the same validated addresses", which says nothing
|
|
about their order. The agent itself stays pinned to the order it was BUILT
|
|
with; that is safe because an equal set means every address it holds was
|
|
re-resolved and re-guarded this call.
|
|
|
|
## `a_reordered_but_identical_address_set_reuses_the_agent`
|
|
|
|
Catches the mutation that drops the sort/dedup from `agent_for`'s key (the
|
|
reversed order would then build a second agent) and, via the second half of
|
|
the test, the mutation that "fixes" order-sensitivity by comparing only
|
|
lengths or the first element — which would wrongly reuse an agent pinned to
|
|
a DIFFERENT address.
|