feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式 - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商 - 明确单连接注入与可重拨连接源的语义边界 - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑 - 优化 shared bulk super-batch 与批量 framed write 路径 - 降低 stream/bulk fast path 的复制和分发损耗 - 补齐 benchmark、回归测试、运行时快照和 README 文档
2026-04-20 16:35:44 +08:00
parent f038a89771
commit 98ef9e7fcc
52 changed files with 4069 additions and 445 deletions
@@ -115,6 +115,76 @@ func TestSendDedicatedBulkAttachRequestKeepsCoalescedDedicatedPayloadUnread(t *t
 	}
 }

+func TestSendDedicatedBulkAttachRequestUsesBootstrapProtectionEvenAfterSteadySwitch(t *testing.T) {
+	client := NewClient().(*ClientCommon)
+	if err := UseModernPSKClient(client, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+		t.Fatalf("UseModernPSKClient failed: %v", err)
+	}
+	client.msgID = 100
+
+	alternate, err := deriveModernPSKProtectionProfile([]byte("notify-dedicated-attach-other-secret"), integrationModernPSKOptions(), ProtectionManaged)
+	if err != nil {
+		t.Fatalf("deriveModernPSKProtectionProfile(alternate) failed: %v", err)
+	}
+	client.setClientTransportProtectionProfile(alternate)
+
+	bulk := newBulkHandle(context.Background(), newBulkRuntime("dedicated-attach-bootstrap-test"), clientFileScope(), BulkOpenRequest{
+		BulkID:      "bulk-attach-bootstrap-test",
+		DataID:      1,
+		Dedicated:   true,
+		AttachToken: "attach-token",
+	}, 0, nil, nil, 0, nil, nil, nil, nil, nil)
+
+	bootstrap := client.clientDedicatedBulkAttachTransportProtectionProfile()
+	encodedResp, err := client.sequenceEn(bulkAttachResponse{Accepted: true})
+	if err != nil {
+		t.Fatalf("encode bulkAttachResponse failed: %v", err)
+	}
+	replyFrame, err := encodeDirectSignalFrame(stario.NewQueue(), client.sequenceEn, bootstrap.msgEn, bootstrap.secretKey, TransferMsg{
+		ID:    101,
+		Key:   systemBulkAttachKey,
+		Value: encodedResp,
+		Type:  MSG_SYS_REPLY,
+	})
+	if err != nil {
+		t.Fatalf("encode attach reply frame failed: %v", err)
+	}
+	conn := newBulkAttachScriptConn(replyFrame)
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	resp, err := client.sendDedicatedBulkAttachRequest(ctx, conn, bulk)
+	if err != nil {
+		t.Fatalf("sendDedicatedBulkAttachRequest failed: %v", err)
+	}
+	if !resp.Accepted {
+		t.Fatalf("bulk attach response = %+v, want accepted", resp)
+	}
+
+	parsedReq := stario.NewQueue()
+	var reqMsg TransferMsg
+	if err := parsedReq.ParseMessageOwned(conn.writtenBytes(), "attach-request", func(msgq stario.MsgQueue) error {
+		transfer, err := decodeDirectSignalPayload(client.sequenceDe, bootstrap.msgDe, bootstrap.secretKey, msgq.Msg)
+		if err != nil {
+			return err
+		}
+		reqMsg = transfer
+		return nil
+	}); err != nil {
+		t.Fatalf("parse written attach request with bootstrap profile failed: %v", err)
+	}
+	if reqMsg.Key != systemBulkAttachKey || reqMsg.Type != MSG_SYS_WAIT {
+		t.Fatalf("attach request message mismatch: %+v", reqMsg)
+	}
+
+	if err := parsedReq.ParseMessageOwned(conn.writtenBytes(), "attach-request-current", func(msgq stario.MsgQueue) error {
+		_, err := decodeDirectSignalPayload(client.sequenceDe, alternate.msgDe, alternate.secretKey, msgq.Msg)
+		return err
+	}); !errors.Is(err, errTransportPayloadDecryptFailed) {
+		t.Fatalf("decode written attach request with current steady profile error = %v, want %v", err, errTransportPayloadDecryptFailed)
+	}
+}
+
 func TestHandleBulkAttachSystemMessageAcceptedWritesDirectReplyBeforeDedicatedHandoff(t *testing.T) {
 	server := NewServer().(*ServerCommon)
 	UseLegacySecurityServer(server)