fsm: reject unknown IK initiators by default

Author: nicoburniske

fsm/src/handshake/ik.rs

@@ -62,7 +62,7 @@ pub fn handle_1<M: StreamMeta>(
     }
 
     let peer = fsm.state.peer.clone();
-    if pattern == IkPattern::Kk && peer.is_none() {
+    if peer.is_none() && (pattern == IkPattern::Kk || !fsm.config.accept_unknown_ik) {
         return Err(ReceiveError::NoPeer);
     }
     if peer.as_ref().is_some_and(|peer| route.sender != peer.qid) {

fsm/src/lib.rs

@@ -165,6 +165,8 @@ impl StreamMeta for () {
 /// timing and buffering knobs for `QlFsm`
 #[derive(Debug, Clone, Copy)]
 pub struct QlFsmConfig {
+    /// accept IK initiators without a bound peer
+    pub accept_unknown_ik: bool,
     /// overall time limit for one handshake attempt
     pub handshake_timeout: Duration,
     pub session: SessionConfig,
@@ -173,6 +175,7 @@ pub struct QlFsmConfig {
 impl Default for QlFsmConfig {
     fn default() -> Self {
         Self {
+            accept_unknown_ik: false,
             handshake_timeout: Duration::from_secs(5),
             session: SessionConfig::default(),
         }

fsm/src/tests/handshake.rs

@@ -301,8 +301,32 @@ fn connect_kk_replaces_in_flight_attempt_and_ignores_stale_reply() {
 }
 
 #[test]
-fn inbound_ik1_auto_binds_unbound_responder() {
-    let mut harness = Harness::paired(QlFsmConfig::default(), true, false);
+fn inbound_ik1_rejects_unknown_peer_by_default() {
+    for armed in [false, true] {
+        let mut harness = Harness::paired(QlFsmConfig::default(), true, false);
+        if armed {
+            harness.b.fsm.arm_pairing(pairing_token(9));
+        }
+
+        harness.connect_ik(Side::A).unwrap();
+        let ik1 = harness.next_outbound(Side::A).unwrap();
+        let time = harness.time();
+        let Node { fsm, crypto } = &mut harness.b;
+        assert_eq!(fsm.receive(time, ik1, crypto), Err(ReceiveError::NoPeer));
+        assert!(harness.b.fsm.peer().is_none());
+        assert!(matches!(harness.b.fsm.state.link, LinkState::Idle));
+        assert!(harness.drain_events(Side::B).is_empty());
+        assert!(harness.next_outbound(Side::B).is_none());
+    }
+}
+
+#[test]
+fn inbound_ik1_auto_binds_unbound_responder_when_enabled() {
+    let config = QlFsmConfig {
+        accept_unknown_ik: true,
+        ..QlFsmConfig::default()
+    };
+    let mut harness = Harness::paired(config, true, false);
 
     harness.connect_ik(Side::A).unwrap();
     harness.pump();

fsm/src/tests/proptest.rs

@@ -154,6 +154,7 @@ impl Runner {
                 ..SessionConfig::default()
             },
             handshake_timeout: Duration::from_millis(60),
+            ..QlFsmConfig::default()
         };
 
         Self {

runtime/src/tests/mod.rs

@@ -623,6 +623,7 @@ fn default_runtime_config() -> RuntimeConfig {
                 ..SessionConfig::default()
             },
             handshake_timeout: Duration::from_millis(300),
+            ..QlFsmConfig::default()
         },
         ..Default::default()
     }