Harden terminal reconnect packet handling

2026-07-07 11:48:59 -04:00
parent b90c34dc17
commit 6b12b3dfe0
4 changed files with 100 additions and 6 deletions
@@ -58,6 +58,19 @@ fn encrypted_packet_round_trips() {
    assert_eq!(plain, b"hello");
 }

+#[test]
+fn plaintext_packet_never_decrypts_as_authenticated_body() {
+    let key = crypto::random_32();
+    let mut decoded = protocol::decode(
+        &protocol::encode_plain(PacketKind::Input, crypto::random_16(), 1, 0, b"hello").unwrap(),
+    )
+    .unwrap();
+    decoded.header.session_key_id = protocol::session_key_id(&key);
+
+    let err = protocol::decrypt_body(&decoded, &key, CLIENT_TO_SERVER).unwrap_err();
+    assert!(err.to_string().contains("not encrypted"));
+}
+
 #[test]
 fn encrypted_packet_rejects_wrong_session_key_id_before_decrypt() {
    let key = crypto::random_32();