feat(server): harden hostile input and overload behavior (#15)

2026-07-16 12:37:38 +02:00
parent 2ff7cd6d9d
commit 88ef946af5
22 changed files with 2159 additions and 93 deletions
@@ -1,15 +1,56 @@
 using System.Collections.Concurrent;
 using System.Net;
 using FinalFactory.Rendezvous.Contracts;
+using FinalFactory.Rendezvous.Server.Abuse;
 using FinalFactory.Rendezvous.Server.JoinAttempts;
 using FinalFactory.Rendezvous.Server.State;
 using FinalFactory.Rendezvous.Server.Transport;
 using FinalFactory.Rendezvous.Tests.JoinAttempts;
+using Microsoft.Extensions.Options;

 namespace FinalFactory.Rendezvous.Tests.Server;

 public sealed class NatMediationProcessorTests
 {
+    [Fact]
+    public void LimitedAuthenticatedUdpTrafficIsSilentlyDroppedWithoutAnIntroduction()
+    {
+        using JoinAttemptFixture fixture = new();
+        (RegisterSessionResponse registration, _) = fixture.CreateHost(bindPresence: false);
+        AbuseProtectionOptions options = new()
+        {
+            UdpCapabilityDatagramsPerWindow = 1,
+            UdpResourceDatagramsPerWindow = 10,
+        };
+        AbuseProtectionService protection = new(Options.Create(options));
+        NatMediationProcessor processor = new(
+            fixture.Sessions.Store,
+            fixture.Sessions.Capabilities,
+            fixture.Service,
+            protection);
+        CaptureIntroductionSink sink = new();
+        string token = NatPunchRequestTokenCodec.Encode(
+            NatPunchPeerRole.HostPresence,
+            registration.HostPresenceHandle,
+            registration.HostPresenceCapability);
+
+        Assert.Equal(
+            NatMediationResult.HostPresenceAccepted,
+            processor.ProcessRequest(
+                Endpoint("192.168.1.50", 40_000),
+                Endpoint("203.0.113.77", 51_234),
+                token,
+                sink));
+        Assert.Equal(
+            NatMediationResult.Dropped,
+            processor.ProcessRequest(
+                Endpoint("192.168.1.50", 40_000),
+                Endpoint("203.0.113.77", 51_234),
+                token,
+                sink));
+        Assert.Empty(sink.Plans);
+    }
+
    [Fact]
    public void AuthenticatedHostPresenceUsesTheObservedGameplaySocket()
    {