Add broker and server side rejection based on proxy version

broker/broker.go

@@ -47,6 +47,7 @@ type BrokerContext struct {
 	bridgeList                     BridgeListHolderFileBased
 	allowedRelayPattern            string
 	presumedPatternForLegacyClient string
+	minProxyVersion                string
 }
 
 func (ctx *BrokerContext) GetBridgeInfo(fingerprint bridgefingerprint.Fingerprint) (BridgeInfo, error) {
@@ -57,6 +58,20 @@ func NewBrokerContext(
 	metricsLogger *log.Logger,
 	allowedRelayPattern,
 	presumedPatternForLegacyClient string,
+) *BrokerContext {
+	return NewBrokerContextWithMinProxyVersion(
+		metricsLogger,
+		allowedRelayPattern,
+		presumedPatternForLegacyClient,
+		"1.3",
+	)
+}
+
+func NewBrokerContextWithMinProxyVersion(
+	metricsLogger *log.Logger,
+	allowedRelayPattern,
+	presumedPatternForLegacyClient string,
+	minProxyVersion string,
 ) *BrokerContext {
 	snowflakes := new(SnowflakeHeap)
 	heap.Init(snowflakes)
@@ -87,6 +102,7 @@ func NewBrokerContext(
 		bridgeList:                     bridgeListHolder,
 		allowedRelayPattern:            allowedRelayPattern,
 		presumedPatternForLegacyClient: presumedPatternForLegacyClient,
+		minProxyVersion:                minProxyVersion,
 	}
 }
 
@@ -204,6 +220,7 @@ func main() {
 	var disableGeoip bool
 	var metricsFilename string
 	var unsafeLogging bool
+	var minProxyVersion string
 
 	flag.StringVar(&acmeEmail, "acme-email", "", "optional contact email for Let's Encrypt notifications")
 	flag.StringVar(&acmeHostnamesCommas, "acme-hostnames", "", "comma-separated hostnames for TLS certificate")
@@ -222,6 +239,7 @@ func main() {
 	flag.BoolVar(&disableGeoip, "disable-geoip", false, "don't use geoip for stats collection")
 	flag.StringVar(&metricsFilename, "metrics-log", "", "path to metrics logging output")
 	flag.BoolVar(&unsafeLogging, "unsafe-logging", false, "prevent logs from being scrubbed")
+	flag.StringVar(&minProxyVersion, "min-proxy-version", "1.3", "the minimum version of the Snowflake proxy that the broker will accept")
 	flag.Parse()
 
 	var err error

broker/ipc.go

@@ -5,11 +5,13 @@ import (
 	"encoding/hex"
 	"fmt"
 	"log"
+	"strconv"
+	"strings"
 	"time"
 
-	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/bridgefingerprint"
-
 	"github.com/prometheus/client_golang/prometheus"
+
+	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/bridgefingerprint"
 	"gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/v2/common/messages"
 )
 
@@ -66,12 +68,49 @@ func (i *IPC) Debug(_ interface{}, response *string) error {
 	return nil
 }
 
+func versionCompare(versionL, versionR string) int {
+	versionSpliter := func(version string) (int64, int64) {
+		s := strings.Split(version, ".")
+		if len(s) != 2 {
+			return -1, -1
+		}
+		major, err := strconv.ParseInt(s[0], 10, 64)
+		if err != nil {
+			return -1, -1
+		}
+		minor, err := strconv.ParseInt(s[1], 10, 64)
+		if err != nil {
+			return -1, -1
+		}
+		return major, minor
+	}
+	versionLMajor, versionLMinor := versionSpliter(versionL)
+	versionRMajor, versionRMinor := versionSpliter(versionR)
+	if versionLMajor > versionRMajor {
+		return -1
+	} else if versionLMajor == versionRMajor {
+		if versionLMinor > versionRMinor {
+			return -1
+		} else if versionLMinor == versionRMinor {
+			return 0
+		} else {
+			return 1
+		}
+	} else {
+		return 1
+	}
+}
+
 func (i *IPC) ProxyPolls(arg messages.Arg, response *[]byte) error {
-	sid, proxyType, natType, clients, relayPattern, relayPatternSupported, err := messages.DecodeProxyPollRequestWithRelayPrefix(arg.Body)
+	sid, proxyType, natType, clients, relayPattern, relayPatternSupported, version, err := messages.DecodeProxyPollRequestWithRelayPrefixAndReturnVersion(arg.Body)
 	if err != nil {
 		return messages.ErrBadRequest
 	}
 
+	if versionCompare(i.ctx.minProxyVersion, version) < 0 {
+		return messages.ErrBadRequest
+	}
+
 	if !relayPatternSupported {
 		i.ctx.metrics.lock.Lock()
 		i.ctx.metrics.proxyPollWithoutRelayURLExtension++