feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化
- 新增 managed/external/nested 三种传输保护模式 - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商 - 明确单连接注入与可重拨连接源的语义边界 - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑 - 优化 shared bulk super-batch 与批量 framed write 路径 - 降低 stream/bulk fast path 的复制和分发损耗 - 补齐 benchmark、回归测试、运行时快照和 README 文档
This commit is contained in:
+35
-16
@@ -268,6 +268,9 @@ func readBulkDedicatedRecordPooled(conn net.Conn) ([]byte, func(), error) {
|
||||
func (c *ClientCommon) dialDedicatedBulkConn(ctx context.Context, timeout time.Duration) (net.Conn, error) {
|
||||
source := c.clientConnectSourceSnapshot()
|
||||
if source != nil {
|
||||
if !source.supportsAdditionalConn() {
|
||||
return nil, errBulkDedicatedSingleConn
|
||||
}
|
||||
if source.network != "" && source.addr != "" {
|
||||
if timeout > 0 {
|
||||
return transport.DialTimeout(source.network, source.addr, timeout)
|
||||
@@ -277,6 +280,7 @@ func (c *ClientCommon) dialDedicatedBulkConn(ctx context.Context, timeout time.D
|
||||
if source.canReconnect() {
|
||||
return source.dial(ctx)
|
||||
}
|
||||
return nil, errClientReconnectSourceUnavailable
|
||||
}
|
||||
conn := c.clientTransportConnSnapshot()
|
||||
if conn == nil || conn.RemoteAddr() == nil {
|
||||
@@ -661,7 +665,8 @@ func (c *ClientCommon) sendDedicatedBulkAttachRequest(ctx context.Context, conn
|
||||
Value: reqPayload,
|
||||
Type: MSG_SYS_WAIT,
|
||||
}
|
||||
frame, err := encodeDirectSignalFrame(stario.NewQueue(), c.sequenceEn, c.msgEn, c.SecretKey, msg)
|
||||
attachProfile := c.clientDedicatedBulkAttachTransportProtectionProfile()
|
||||
frame, err := encodeDirectSignalFrame(stario.NewQueue(), c.sequenceEn, attachProfile.msgEn, attachProfile.secretKey, msg)
|
||||
if err != nil {
|
||||
return bulkAttachResponse{}, err
|
||||
}
|
||||
@@ -675,7 +680,7 @@ func (c *ClientCommon) sendDedicatedBulkAttachRequest(ctx context.Context, conn
|
||||
if err != nil {
|
||||
return bulkAttachResponse{}, err
|
||||
}
|
||||
transfer, err := decodeDirectSignalPayload(c.sequenceDe, c.msgDe, c.SecretKey, replyPayload)
|
||||
transfer, err := decodeDirectSignalPayload(c.sequenceDe, attachProfile.msgDe, attachProfile.secretKey, replyPayload)
|
||||
if err != nil {
|
||||
return bulkAttachResponse{}, err
|
||||
}
|
||||
@@ -685,6 +690,16 @@ func (c *ClientCommon) sendDedicatedBulkAttachRequest(ctx context.Context, conn
|
||||
return decodeBulkAttachResponse(c.sequenceDe, transfer.Value)
|
||||
}
|
||||
|
||||
func (c *ClientCommon) clientDedicatedBulkAttachTransportProtectionProfile() transportProtectionProfile {
|
||||
if c == nil {
|
||||
return transportProtectionProfile{}
|
||||
}
|
||||
if c.securityConfigured && c.securityBootstrap.msgEn != nil && c.securityBootstrap.msgDe != nil {
|
||||
return c.securityBootstrap.clone()
|
||||
}
|
||||
return c.clientTransportProtectionSnapshot()
|
||||
}
|
||||
|
||||
func (c *ClientCommon) readDedicatedSidecarLoop(sidecar *bulkDedicatedSidecar) {
|
||||
if c == nil || sidecar == nil || sidecar.conn == nil {
|
||||
return
|
||||
@@ -695,7 +710,8 @@ func (c *ClientCommon) readDedicatedSidecarLoop(sidecar *bulkDedicatedSidecar) {
|
||||
c.handleClientDedicatedSidecarFailure(sidecar, err)
|
||||
return
|
||||
}
|
||||
plain, plainRelease, err := decryptTransportPayloadCodecPooled(c.modernPSKRuntime, c.msgDe, c.SecretKey, payload, payloadRelease)
|
||||
profile := c.clientTransportProtectionSnapshot()
|
||||
plain, plainRelease, err := decryptTransportPayloadCodecPooled(profile.mode, profile.runtime, profile.msgDe, profile.secretKey, payload, payloadRelease)
|
||||
if err != nil {
|
||||
c.handleClientDedicatedSidecarFailure(sidecar, err)
|
||||
return
|
||||
@@ -1023,7 +1039,7 @@ func (s *ServerCommon) replyDedicatedBulkAttach(client *LogicalConn, message Mes
|
||||
Type: MSG_SYS_REPLY,
|
||||
}
|
||||
if message.inboundConn != nil {
|
||||
return s.sendTransferInbound(client, messageTransportConnSnapshot(&message), message.inboundConn, reply)
|
||||
return s.sendTransferInbound(client, messageTransportConnSnapshot(&message), message.inboundConn, messageInboundTransportProtectionSnapshot(&message), reply)
|
||||
}
|
||||
_, err = s.sendLogical(client, reply)
|
||||
return err
|
||||
@@ -1041,7 +1057,7 @@ func (s *ServerCommon) readDedicatedSidecarLoop(logical *LogicalConn, sidecar *b
|
||||
s.handleServerDedicatedSidecarFailure(logical, sidecar, err)
|
||||
return
|
||||
}
|
||||
plain, plainRelease, err := decryptTransportPayloadCodecPooled(logical.modernPSKRuntimeSnapshot(), logical.msgDeSnapshot(), logical.secretKeySnapshot(), payload, payloadRelease)
|
||||
plain, plainRelease, err := decryptTransportPayloadCodecPooled(logical.protectionModeSnapshot(), logical.modernPSKRuntimeSnapshot(), logical.msgDeSnapshot(), logical.secretKeySnapshot(), payload, payloadRelease)
|
||||
if err != nil {
|
||||
s.handleServerDedicatedSidecarFailure(logical, sidecar, err)
|
||||
return
|
||||
@@ -1171,7 +1187,8 @@ func (c *ClientCommon) dedicatedBulkLaneSender(bulk *bulkHandle) (*bulkDedicated
|
||||
return nil, transportDetachedError("dedicated bulk sidecar not attached", nil)
|
||||
}
|
||||
sender := sidecar.laneSenderWithFactory(func(conn net.Conn) *bulkDedicatedLaneSender {
|
||||
laneRuntime := c.modernPSKRuntime
|
||||
profile := c.clientTransportProtectionSnapshot()
|
||||
laneRuntime := profile.runtime
|
||||
if forked, err := forkDedicatedLaneModernPSKRuntime(laneRuntime); err == nil && forked != nil {
|
||||
laneRuntime = forked
|
||||
}
|
||||
@@ -1198,7 +1215,7 @@ func (c *ClientCommon) sendDedicatedBulkData(ctx context.Context, bulk *bulkHand
|
||||
return sender.submitData(ctx, bulk.dataIDSnapshot(), bulk.nextOutboundDataSeq(), chunk)
|
||||
}
|
||||
|
||||
func (c *ClientCommon) sendDedicatedBulkWrite(ctx context.Context, bulk *bulkHandle, startSeq uint64, payload []byte) (int, error) {
|
||||
func (c *ClientCommon) sendDedicatedBulkWrite(ctx context.Context, bulk *bulkHandle, startSeq uint64, payload []byte, payloadOwned bool) (int, error) {
|
||||
if c == nil || bulk == nil {
|
||||
return 0, errBulkClientNil
|
||||
}
|
||||
@@ -1206,7 +1223,7 @@ func (c *ClientCommon) sendDedicatedBulkWrite(ctx context.Context, bulk *bulkHan
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return sender.submitWrite(ctx, bulk.dataIDSnapshot(), startSeq, payload, bulk.chunkSize)
|
||||
return sender.submitWrite(ctx, bulk.dataIDSnapshot(), startSeq, payload, bulk.chunkSize, payloadOwned)
|
||||
}
|
||||
|
||||
func (c *ClientCommon) sendDedicatedBulkClose(ctx context.Context, bulk *bulkHandle, full bool) error {
|
||||
@@ -1345,7 +1362,7 @@ func (s *ServerCommon) sendDedicatedBulkData(ctx context.Context, logical *Logic
|
||||
return sender.submitData(ctx, bulk.dataIDSnapshot(), bulk.nextOutboundDataSeq(), chunk)
|
||||
}
|
||||
|
||||
func (s *ServerCommon) sendDedicatedBulkWrite(ctx context.Context, logical *LogicalConn, bulk *bulkHandle, startSeq uint64, payload []byte) (int, error) {
|
||||
func (s *ServerCommon) sendDedicatedBulkWrite(ctx context.Context, logical *LogicalConn, bulk *bulkHandle, startSeq uint64, payload []byte, payloadOwned bool) (int, error) {
|
||||
if s == nil || bulk == nil {
|
||||
return 0, errBulkServerNil
|
||||
}
|
||||
@@ -1353,7 +1370,7 @@ func (s *ServerCommon) sendDedicatedBulkWrite(ctx context.Context, logical *Logi
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return sender.submitWrite(ctx, bulk.dataIDSnapshot(), startSeq, payload, bulk.chunkSize)
|
||||
return sender.submitWrite(ctx, bulk.dataIDSnapshot(), startSeq, payload, bulk.chunkSize, payloadOwned)
|
||||
}
|
||||
|
||||
func (s *ServerCommon) sendDedicatedBulkClose(ctx context.Context, logical *LogicalConn, bulk *bulkHandle, full bool) error {
|
||||
@@ -1419,13 +1436,14 @@ func (c *ClientCommon) encodeDedicatedBulkBatchPayload(dataID uint64, items []bu
|
||||
if c == nil {
|
||||
return nil, errBulkClientNil
|
||||
}
|
||||
if runtime := c.modernPSKRuntime; runtime != nil {
|
||||
profile := c.clientTransportProtectionSnapshot()
|
||||
if runtime := profile.runtime; runtime != nil {
|
||||
return runtime.sealFilledPayload(bulkDedicatedBatchPlainLen(items), func(dst []byte) error {
|
||||
return writeBulkDedicatedBatchPlain(dst, dataID, items)
|
||||
})
|
||||
}
|
||||
if c.fastPlainEncode != nil {
|
||||
return encodeBulkDedicatedBatchPayloadFast(c.fastPlainEncode, c.SecretKey, dataID, items)
|
||||
if profile.fastPlainEncode != nil {
|
||||
return encodeBulkDedicatedBatchPayloadFast(profile.fastPlainEncode, profile.secretKey, dataID, items)
|
||||
}
|
||||
plain, err := encodeBulkDedicatedBatchPlain(dataID, items)
|
||||
if err != nil {
|
||||
@@ -1453,8 +1471,9 @@ func (c *ClientCommon) encodeDedicatedBulkBatchesPayloadPooledWithRuntime(runtim
|
||||
return writeBulkDedicatedBatchesPlain(dst, batches)
|
||||
})
|
||||
}
|
||||
if c.fastPlainEncode != nil {
|
||||
payload, err := encodeBulkDedicatedBatchesPayloadFast(c.fastPlainEncode, c.SecretKey, batches)
|
||||
profile := c.clientTransportProtectionSnapshot()
|
||||
if profile.fastPlainEncode != nil {
|
||||
payload, err := encodeBulkDedicatedBatchesPayloadFast(profile.fastPlainEncode, profile.secretKey, batches)
|
||||
return payload, nil, err
|
||||
}
|
||||
plain, err := encodeBulkDedicatedBatchesPlain(batches)
|
||||
@@ -1466,7 +1485,7 @@ func (c *ClientCommon) encodeDedicatedBulkBatchesPayloadPooledWithRuntime(runtim
|
||||
}
|
||||
|
||||
func (c *ClientCommon) encodeDedicatedBulkBatchesPayloadPooled(batches []bulkDedicatedOutboundBatch) ([]byte, func(), error) {
|
||||
return c.encodeDedicatedBulkBatchesPayloadPooledWithRuntime(c.modernPSKRuntime, batches)
|
||||
return c.encodeDedicatedBulkBatchesPayloadPooledWithRuntime(c.clientTransportProtectionSnapshot().runtime, batches)
|
||||
}
|
||||
|
||||
func (c *ClientCommon) encodeDedicatedBulkBatchPayloadPooled(dataID uint64, items []bulkDedicatedSendRequest) ([]byte, func(), error) {
|
||||
|
||||
Reference in New Issue
Block a user