@opensoha/contracts 0.1.29 → 0.2.0

package/proxytransport/socks_upstream_test.go

@@ -0,0 +1,368 @@
+package proxytransport
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+)
+
+type upstreamTestPeer struct {
+	address string
+	closed  <-chan struct{}
+	targets <-chan string
+}
+
+// The fake proxy is separate from the production SOCKS gate. It authenticates,
+// reports the chosen BND address and forwards UDP via a real echo socket.
+func startUpstreamPeer(t *testing.T, command byte, noAuth bool, bound func(int) []byte, target *net.UDPAddr) upstreamTestPeer {
+	t.Helper()
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = listener.Close() })
+	closed := make(chan struct{})
+	targets := make(chan string, 1)
+	go func() {
+		defer close(closed)
+		control, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		defer closePacketFixture(t, control)
+		_ = control.SetDeadline(time.Now().Add(3 * time.Second))
+		var greeting [3]byte
+		if _, err := io.ReadFull(control, greeting[:]); err != nil {
+			return
+		}
+		method := byte(2)
+		if noAuth {
+			method = 0
+		}
+		if greeting != [3]byte{5, 1, method} {
+			return
+		}
+		if writePacketAll(control, []byte{5, method}) != nil {
+			return
+		}
+		if !noAuth {
+			var h [2]byte
+			if _, err := io.ReadFull(control, h[:]); err != nil || h[0] != 1 {
+				return
+			}
+			user := make([]byte, int(h[1]))
+			if _, err := io.ReadFull(control, user); err != nil {
+				return
+			}
+			var size [1]byte
+			if _, err := io.ReadFull(control, size[:]); err != nil {
+				return
+			}
+			secret := make([]byte, int(size[0]))
+			if _, err := io.ReadFull(control, secret); err != nil {
+				return
+			}
+			if string(user) != "upstream-user" || string(secret) != "short-secret" {
+				_, _ = control.Write([]byte{1, 1})
+				return
+			}
+			if writePacketAll(control, []byte{1, 0}) != nil {
+				return
+			}
+		}
+		var h [3]byte
+		if _, err := io.ReadFull(control, h[:]); err != nil || h != [3]byte{5, command, 0} {
+			return
+		}
+		destination, err := readSOCKSAddress(control)
+		if err != nil {
+			return
+		}
+		targets <- destination
+		if command == 1 {
+			if writePacketAll(control, []byte{5, 0, 0, 1, 0, 0, 0, 0, 0, 0}) != nil {
+				return
+			}
+			_, _ = io.Copy(control, control)
+			return
+		}
+		relay, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+		if err != nil {
+			return
+		}
+		defer closePacketFixture(t, relay)
+		port := packetFixtureAs[*net.UDPAddr](t, relay.LocalAddr()).Port
+		if writePacketAll(control, append([]byte{5, 0, 0}, bound(port)...)) != nil {
+			return
+		}
+		go func() { _, _ = io.Copy(io.Discard, control); _ = relay.Close() }()
+		if target == nil {
+			buffer := make([]byte, 65536)
+			_, _, _ = relay.ReadFromUDP(buffer)
+			return
+		}
+		upstream, err := net.DialUDP("udp", nil, target)
+		if err != nil {
+			return
+		}
+		defer closePacketFixture(t, upstream)
+		buffer := make([]byte, 65536)
+		for {
+			n, from, err := relay.ReadFromUDP(buffer)
+			if err != nil {
+				return
+			}
+			if n < 10 || buffer[0] != 0 || buffer[1] != 0 || buffer[2] != 0 || buffer[3] != 1 || !net.IP(buffer[4:8]).Equal(target.IP) || int(binary.BigEndian.Uint16(buffer[8:10])) != target.Port {
+				return
+			}
+			header := append([]byte(nil), buffer[:10]...)
+			_, _ = upstream.Write(buffer[10:n])
+			_ = upstream.SetReadDeadline(time.Now().Add(time.Second))
+			n, err = upstream.Read(buffer[10:])
+			if err != nil {
+				return
+			}
+			copy(buffer[:10], header)
+			_, _ = relay.WriteToUDP(buffer[:10+n], from)
+		}
+	}()
+	return upstreamTestPeer{address: listener.Addr().String(), closed: closed, targets: targets}
+}
+func upstreamTestConnect(address string) UpstreamConnect {
+	return func(ctx context.Context) (net.Conn, error) { return (&net.Dialer{}).DialContext(ctx, "tcp", address) }
+}
+func awaitUpstreamClose(t *testing.T, ch <-chan struct{}) {
+	t.Helper()
+	select {
+	case <-ch:
+	case <-time.After(time.Second):
+		t.Fatal("upstream control/relay not closed")
+	}
+}
+func TestSOCKS5UpstreamUDPSamePinnedSourceAndUnspecified(t *testing.T) {
+	target := realPacketEcho(t)
+	for _, tc := range []struct {
+		name   string
+		prefix []byte
+		noAuth bool
+	}{{"same IP", []byte{1, 127, 0, 0, 1}, false}, {"unspecified IPv4", []byte{1, 0, 0, 0, 0}, true}, {"unspecified IPv6", append([]byte{4}, make([]byte, 16)...), false}} {
+		t.Run(tc.name, func(t *testing.T) {
+			peer := startUpstreamPeer(t, 3, tc.noAuth, func(port int) []byte { return append(append([]byte(nil), tc.prefix...), packetFixturePort(t, port)...) }, target)
+			user, secret := "upstream-user", "short-secret"
+			if tc.noAuth {
+				user, secret = "", ""
+			}
+			conn, err := DialSOCKS5UpstreamUDP(context.Background(), upstreamTestConnect(peer.address), netip.MustParseAddr("127.0.0.1"), user, secret, target.String(), packetTestLease())
+			if err != nil {
+				t.Fatal(err)
+			}
+			packetRoundTrip(t, conn, []byte("source-pinned UDP"))
+			packetRoundTrip(t, conn, nil)
+			if packetFixtureAs[*net.UDPAddr](t, conn.RemoteAddr()).IP.String() != "127.0.0.1" {
+				t.Fatal("socket not pinned to approved source")
+			}
+			if request := <-peer.targets; request != "0.0.0.0:0" {
+				t.Fatalf("associate request %s", request)
+			}
+			_ = conn.Close()
+			awaitUpstreamClose(t, peer.closed)
+			if packetFixtureAs[interface{ Refresh(time.Time) error }](t, conn).Refresh(packetTestLease()) == nil {
+				t.Fatal("closed upstream UDP revived")
+			}
+		})
+	}
+}
+func TestSOCKS5UpstreamUDPRejectsRelayRedirectionWithoutPackets(t *testing.T) {
+	capture, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer closePacketFixture(t, capture)
+	port := packetFixtureAs[*net.UDPAddr](t, capture.LocalAddr()).Port
+	for _, tc := range []struct {
+		name  string
+		reply []byte
+	}{{"other source IP", []byte{1, 192, 0, 2, 99}}, {"other loopback IP", []byte{1, 127, 0, 0, 2}}, {"IPv6 protected loopback", append([]byte{4}, net.IPv6loopback...)}, {"hostname", append([]byte{3, 9}, []byte("localhost")...)}, {"numeric hostname", append([]byte{3, 9}, []byte("127.0.0.1")...)}, {"zero port", []byte{1, 127, 0, 0, 1}}} {
+		t.Run(tc.name, func(t *testing.T) {
+			peer := startUpstreamPeer(t, 3, true, func(_ int) []byte {
+				p := port
+				if tc.name == "zero port" {
+					p = 0
+				}
+				return append(append([]byte(nil), tc.reply...), byte(p>>8), byte(p))
+			}, nil)
+			conn, err := DialSOCKS5UpstreamUDP(context.Background(), upstreamTestConnect(peer.address), netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", packetTestLease())
+			if conn != nil {
+				_ = conn.Close()
+				t.Fatal("unapproved relay returned a connection")
+			}
+			if err == nil {
+				t.Fatal("unapproved relay accepted")
+			}
+			awaitUpstreamClose(t, peer.closed)
+		})
+	}
+	_ = capture.SetReadDeadline(time.Now().Add(40 * time.Millisecond))
+	if n, _, err := capture.ReadFromUDP(make([]byte, 65536)); err == nil || n != 0 {
+		t.Fatalf("refused relay captured %d packets: %v", n, err)
+	}
+}
+func TestSOCKS5UpstreamRejectsWrongFactoryPeerBeforeAuthentication(t *testing.T) {
+	for _, udp := range []bool{false, true} {
+		listener, err := net.Listen("tcp4", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		bytesSeen := make(chan int, 1)
+		go func() {
+			c, err := listener.Accept()
+			if err != nil {
+				bytesSeen <- 0
+				return
+			}
+			defer closePacketFixture(t, c)
+			_ = c.SetReadDeadline(time.Now().Add(time.Second))
+			n, _ := c.Read(make([]byte, 512))
+			bytesSeen <- n
+		}()
+		connect := upstreamTestConnect(listener.Addr().String())
+		var conn net.Conn
+		if udp {
+			conn, err = DialSOCKS5UpstreamUDP(context.Background(), connect, netip.MustParseAddr("127.0.0.2"), "upstream-user", "short-secret", "198.51.100.2:443", packetTestLease())
+		} else {
+			conn, err = DialSOCKS5UpstreamTCP(context.Background(), connect, netip.MustParseAddr("127.0.0.2"), "upstream-user", "short-secret", "198.51.100.2:443", packetTestLease())
+		}
+		if err == nil || conn != nil {
+			t.Fatal("wrong actual peer accepted")
+		}
+		if n := <-bytesSeen; n != 0 {
+			t.Fatalf("credentials/request sent before peer verification: %d bytes", n)
+		}
+		_ = listener.Close()
+	}
+}
+func TestSOCKS5UpstreamTCPKeepsPinnedTargetAndLease(t *testing.T) {
+	for _, noAuth := range []bool{false, true} {
+		peer := startUpstreamPeer(t, 1, noAuth, nil, nil)
+		user, secret := "upstream-user", "short-secret"
+		if noAuth {
+			user, secret = "", ""
+		}
+		conn, err := DialSOCKS5UpstreamTCP(context.Background(), upstreamTestConnect(peer.address), netip.MustParseAddr("127.0.0.1"), user, secret, "198.51.100.2:443", packetTestLease())
+		if err != nil {
+			t.Fatal(err)
+		}
+		if target := <-peer.targets; target != "198.51.100.2:443" {
+			t.Fatalf("CONNECT retargeted: %s", target)
+		}
+		payload := bytes.Repeat([]byte("t"), MaxDatagramBytes+100)
+		done := make(chan error, 1)
+		go func() { _, err := conn.Write(payload); done <- err }()
+		result := make([]byte, len(payload))
+		if _, err := io.ReadFull(conn, result); err != nil || !bytes.Equal(result, payload) {
+			t.Fatalf("TCP stream changed: %v", err)
+		}
+		if err := <-done; err != nil {
+			t.Fatal(err)
+		}
+		_ = conn.Close()
+		awaitUpstreamClose(t, peer.closed)
+		if packetFixtureAs[interface{ Refresh(time.Time) error }](t, conn).Refresh(packetTestLease()) == nil {
+			t.Fatal("closed TCP revived")
+		}
+	}
+	peer := startUpstreamPeer(t, 1, true, nil, nil)
+	conn, err := DialSOCKS5UpstreamTCP(context.Background(), upstreamTestConnect(peer.address), netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", time.Now().Add(35*time.Millisecond))
+	if err != nil {
+		t.Fatal(err)
+	}
+	time.Sleep(45 * time.Millisecond)
+	if packetFixtureAs[interface{ Refresh(time.Time) error }](t, conn).Refresh(packetTestLease()) == nil {
+		t.Fatal("expired TCP revived")
+	}
+	_ = conn.Close()
+	awaitUpstreamClose(t, peer.closed)
+}
+func TestSOCKS5UpstreamInputBounds(t *testing.T) {
+	calls := 0
+	connect := func(context.Context) (net.Conn, error) { calls++; return nil, errors.New("should not dial") }
+	for _, target := range []string{"example.invalid:443", "0.0.0.0:443", "127.0.0.1:0", "[::1]:65536"} {
+		if _, err := DialSOCKS5UpstreamUDP(context.Background(), connect, netip.MustParseAddr("127.0.0.1"), "", "", target, packetTestLease()); err == nil {
+			t.Fatal("invalid pinned target accepted")
+		}
+	}
+	if calls != 0 {
+		t.Fatal("invalid target invoked factory")
+	}
+	if _, err := DialSOCKS5UpstreamTCP(context.Background(), connect, netip.Addr{}, "", "", "198.51.100.2:443", packetTestLease()); err == nil {
+		t.Fatal("missing source accepted")
+	}
+	if _, err := DialSOCKS5UpstreamUDP(context.Background(), connect, netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", time.Now().Add(-time.Second)); err == nil {
+		t.Fatal("expired lease accepted")
+	}
+	if err := upstreamSOCKSAuth(nil, "", "secret"); err == nil {
+		t.Fatal("password silently dropped for NoAuth")
+	}
+	if err := upstreamSOCKSAuth(nil, strings.Repeat("u", 256), "p"); err == nil {
+		t.Fatal("oversized upstream user accepted")
+	}
+}
+
+func TestSOCKS5UpstreamErrorsDoNotDiscloseSource(t *testing.T) {
+	sensitive := "upstream-secret@192.0.2.99"
+	if got := upstreamIOError(errors.New(sensitive)); got == nil || strings.Contains(got.Error(), sensitive) {
+		t.Fatal("transport error disclosed upstream")
+	}
+	connect := func(context.Context) (net.Conn, error) { return nil, errors.New(sensitive) }
+	_, err := DialSOCKS5UpstreamTCP(context.Background(), connect, netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", packetTestLease())
+	if err == nil || strings.Contains(err.Error(), sensitive) {
+		t.Fatal("factory error disclosed upstream")
+	}
+	if !errors.Is(upstreamIOError(net.ErrClosed), net.ErrClosed) {
+		t.Fatal("closed sentinel lost")
+	}
+}
+
+func TestSOCKS5UpstreamResponseSourceIsLiteralAndPinned(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		packet []byte
+		valid  bool
+	}{
+		{"literal", []byte{0, 0, 0, 1, 127, 0, 0, 1, 0, 53, 'x'}, true},
+		{"numeric hostname", append(append([]byte{0, 0, 0, 3, 9}, []byte("127.0.0.1")...), 0, 53, 'x'), false},
+		{"different source", []byte{0, 0, 0, 1, 127, 0, 0, 2, 0, 53, 'x'}, false},
+		{"fragment", []byte{0, 0, 1, 1, 127, 0, 0, 1, 0, 53, 'x'}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			relay, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer closePacketFixture(t, relay)
+			udp, err := net.DialUDP("udp4", nil, packetFixtureAs[*net.UDPAddr](t, relay.LocalAddr()))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer closePacketFixture(t, udp)
+			_ = udp.SetReadDeadline(time.Now().Add(time.Second))
+			_, err = relay.WriteToUDP(tc.packet, packetFixtureAs[*net.UDPAddr](t, udp.LocalAddr()))
+			if err != nil {
+				t.Fatal(err)
+			}
+			transport := &upstreamPacketTransport{socksUDPTransport: &socksUDPTransport{udp: udp, target: "127.0.0.1:53"}}
+			result := make([]byte, 100)
+			n, err := transport.Read(result)
+			if (err == nil) != tc.valid || tc.valid && (n != 1 || result[0] != 'x') {
+				t.Fatalf("pinned reply n=%d err=%v", n, err)
+			}
+		})
+	}
+}

package/proxytransport/udp_conn.go

@@ -0,0 +1,234 @@
+package proxytransport
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"sync"
+	"time"
+)
+
+const MaxDatagramBytes = 65507
+const MaxPacketAssociations = 4096
+const MaxPacketTargets = 128
+const PacketIdleTimeout = 30 * time.Second
+const PacketTransportHeader = "Soha-Transport"
+const PacketTransportVersion = "udp/1"
+
+// ErrPacketUnsupported denotes a verified transport/backend that explicitly
+// cannot carry UDP. It never authorizes an OS-direct or TCP fallback.
+var ErrPacketUnsupported = errors.New("guarded UDP transport unsupported")
+
+// DialPacket returns a message-oriented connection to one authorized, pinned
+// destination. It must not directly dial an unguarded destination as a fallback.
+type DialPacket func(ctx context.Context, user, target string) (net.Conn, error)
+
+// PacketAuthorize is mandatory before each datagram in either direction. The
+// caller checks current node/scope/epoch/protection/rules and its hard lease.
+type PacketAuthorize func(ctx context.Context, user, target string) error
+
+// PacketConn preserves one Read/Write per datagram. Refresh is permitted only
+// before the current lease and idle window expire; callers cap renewal by the
+// current configuration, certificate and credential hard limits.
+type PacketConn struct {
+	conn                                             net.Conn
+	read                                             func([]byte) (int, error)
+	write                                            func([]byte) (int, error)
+	mu                                               sync.Mutex
+	readMu, writeMu                                  sync.Mutex
+	until, lastActivity, readDeadline, writeDeadline time.Time
+	closed                                           bool
+	closeOnce                                        sync.Once
+	closeErr                                         error
+}
+
+func validPacketLease(until time.Time) bool {
+	now := time.Now()
+	return until.After(now) && !until.After(now.Add(5*time.Minute))
+}
+func earlier(a, b time.Time) time.Time {
+	if b.IsZero() || !a.IsZero() && a.Before(b) {
+		return a
+	}
+	return b
+}
+
+// NewPacketConn frames a stream as uint16 big-endian length followed by payload.
+// Zero-length datagrams are valid. Malformed/truncated frames or short Read
+// buffers close the association rather than truncating or joining messages.
+func NewPacketConn(conn net.Conn, deadline time.Time) (*PacketConn, error) {
+	if conn == nil {
+		return nil, errors.New("packet stream missing")
+	}
+	read := func(p []byte) (int, error) {
+		var header [2]byte
+		if _, err := io.ReadFull(conn, header[:]); err != nil {
+			return 0, err
+		}
+		n := int(binary.BigEndian.Uint16(header[:]))
+		if n > MaxDatagramBytes {
+			return 0, errors.New("oversized datagram")
+		}
+		if n > len(p) {
+			return 0, io.ErrShortBuffer
+		}
+		_, err := io.ReadFull(conn, p[:n])
+		return n, err
+	}
+	write := func(p []byte) (int, error) {
+		var header [2]byte
+		size := len(p)
+		if size > MaxDatagramBytes {
+			return 0, errors.New("oversized datagram")
+		}
+		binary.BigEndian.PutUint16(header[:], uint16(size))
+		if err := writePacketAll(conn, header[:]); err != nil {
+			return 0, err
+		}
+		if err := writePacketAll(conn, p); err != nil {
+			return 0, err
+		}
+		return len(p), nil
+	}
+	return newMessageConn(conn, deadline, read, write)
+}
+func newMessageConn(conn net.Conn, deadline time.Time, read, write func([]byte) (int, error)) (*PacketConn, error) {
+	if !validPacketLease(deadline) {
+		return nil, errors.New("invalid packet lease")
+	}
+	p := &PacketConn{conn: conn, read: read, write: write, until: deadline, lastActivity: time.Now()}
+	p.mu.Lock()
+	err := p.applyDeadlinesLocked()
+	p.mu.Unlock()
+	if err != nil {
+		_ = p.Close()
+		return nil, err
+	}
+	return p, nil
+}
+func writePacketAll(w io.Writer, b []byte) error {
+	for len(b) > 0 {
+		n, err := w.Write(b)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		b = b[n:]
+	}
+	return nil
+}
+func (p *PacketConn) checkLocked() error {
+	now := time.Now()
+	if p.closed || !p.until.After(now) || !p.lastActivity.Add(PacketIdleTimeout).After(now) {
+		return net.ErrClosed
+	}
+	return nil
+}
+func (p *PacketConn) applyDeadlinesLocked() error {
+	base := earlier(p.until, p.lastActivity.Add(PacketIdleTimeout))
+	if err := p.conn.SetReadDeadline(earlier(base, p.readDeadline)); err != nil {
+		return err
+	}
+	return p.conn.SetWriteDeadline(earlier(base, p.writeDeadline))
+}
+func (p *PacketConn) before() error { p.mu.Lock(); defer p.mu.Unlock(); return p.checkLocked() }
+func (p *PacketConn) after() error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := p.checkLocked(); err != nil {
+		return err
+	}
+	p.lastActivity = time.Now()
+	return p.applyDeadlinesLocked()
+}
+func (p *PacketConn) Read(b []byte) (int, error) {
+	p.readMu.Lock()
+	defer p.readMu.Unlock()
+	if err := p.before(); err != nil {
+		_ = p.Close()
+		return 0, err
+	}
+	n, err := p.read(b)
+	if err == nil {
+		err = p.after()
+	}
+	if err != nil {
+		_ = p.Close()
+		return 0, err
+	}
+	return n, nil
+}
+func (p *PacketConn) Write(b []byte) (int, error) {
+	p.writeMu.Lock()
+	defer p.writeMu.Unlock()
+	if len(b) > MaxDatagramBytes {
+		_ = p.Close()
+		return 0, errors.New("oversized datagram")
+	}
+	if err := p.before(); err != nil {
+		_ = p.Close()
+		return 0, err
+	}
+	n, err := p.write(b)
+	if err == nil && n != len(b) {
+		err = io.ErrShortWrite
+	}
+	if err == nil {
+		err = p.after()
+	}
+	if err != nil {
+		_ = p.Close()
+		return 0, err
+	}
+	return n, nil
+}
+func (p *PacketConn) Refresh(until time.Time) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := p.checkLocked(); err != nil {
+		return err
+	}
+	if !validPacketLease(until) {
+		return errors.New("invalid packet renewal")
+	}
+	p.until = until
+	return p.applyDeadlinesLocked()
+}
+func (p *PacketConn) Close() error {
+	p.closeOnce.Do(func() { p.mu.Lock(); p.closed = true; p.mu.Unlock(); p.closeErr = p.conn.Close() })
+	return p.closeErr
+}
+func (p *PacketConn) LocalAddr() net.Addr  { return p.conn.LocalAddr() }
+func (p *PacketConn) RemoteAddr() net.Addr { return p.conn.RemoteAddr() }
+func (p *PacketConn) SetDeadline(t time.Time) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := p.checkLocked(); err != nil {
+		return err
+	}
+	p.readDeadline = t
+	p.writeDeadline = t
+	return p.applyDeadlinesLocked()
+}
+func (p *PacketConn) SetReadDeadline(t time.Time) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := p.checkLocked(); err != nil {
+		return err
+	}
+	p.readDeadline = t
+	return p.applyDeadlinesLocked()
+}
+func (p *PacketConn) SetWriteDeadline(t time.Time) error {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if err := p.checkLocked(); err != nil {
+		return err
+	}
+	p.writeDeadline = t
+	return p.applyDeadlinesLocked()
+}