snap-control 0.7.0

Control plane implementation of the SNAP transport underlay for SCION
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

// Copyright 2026 Anapaya Systems
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//   http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//! Session manager for the PathGuard WAP API, responsible for managing client authentication and
//! TCP sessions.

use std::{
    collections::HashMap,
    net::IpAddr,
    sync::{Arc, Mutex},
    time::Instant,
};

use crate::pg_wap::auth::AuthInfo;

/// Manages client authentication and TCP sessions.
#[derive(Clone)]
pub struct WapSessionManager {
    inner: Arc<Mutex<WapSessionManagerInner>>,
}

impl WapSessionManager {
    /// Authenticate an IP address to be able to open sessions.
    ///
    /// The authenticated session is appended to the set of authenticated sessions for the given IP
    /// address.
    pub fn add_session_authentication(&self, auth_info: AuthInfo) {
        let mut inner = self.inner.lock().unwrap();
        inner.add_session_authentication(auth_info);
    }

    /// Find the set of authenticated sessions for the given client IP address.
    pub fn authenticated_sessions_for_ip(&self, client_addr: IpAddr) -> Vec<AuthInfo> {
        let mut inner = self.inner.lock().unwrap();
        inner.authenticated_sessions_for_ip(Instant::now(), client_addr)
    }
}

/// Internal session manager state.
pub struct WapSessionManagerInner {
    sessions: HashMap<IpAddr, Vec<AuthInfo>>,
}

impl WapSessionManager {
    /// Create a new [WapSessionManager].
    pub fn new() -> Self {
        let inner = Arc::new(Mutex::new(WapSessionManagerInner {
            sessions: HashMap::new(),
        }));

        Self { inner }
    }
}

impl Default for WapSessionManager {
    fn default() -> Self {
        Self::new()
    }
}

impl WapSessionManagerInner {
    /// Authenticate a IP to be able to open sessions.
    ///
    /// The authenticated session is appended to the set of authenticated sessions for the given IP
    /// address.
    pub fn add_session_authentication(&mut self, auth_info: AuthInfo) {
        // XXX(uniquefine): Currently the sessions map can grow unlimited e.g. due to a malicious
        // client. We should add a limit on the maximum number of entries in the
        // map/sessions in an auth_info.
        self.sessions
            .entry(auth_info.ip)
            .or_default()
            .push(auth_info);
    }

    /// Find the set of authenticated sessions for the given client IP address.
    pub fn authenticated_sessions_for_ip(
        &mut self,
        now: Instant,
        client_addr: IpAddr,
    ) -> Vec<AuthInfo> {
        let Some(auth_infos) = self.sessions.get_mut(&client_addr) else {
            return Vec::new();
        };

        // Remove expired auths and return the remaining ones.
        // XXX(uniquefine): We should consider adding an active cleanup of expired auths.
        auth_infos.retain(|auth| auth.valid_until > now);
        if auth_infos.is_empty() {
            self.sessions.remove(&client_addr);
            Vec::new()
        } else {
            auth_infos.clone()
        }
    }
}