feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式 - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商 - 明确单连接注入与可重拨连接源的语义边界 - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑 - 优化 shared bulk super-batch 与批量 framed write 路径 - 降低 stream/bulk fast path 的复制和分发损耗 - 补齐 benchmark、回归测试、运行时快照和 README 文档
2026-04-20 16:35:44 +08:00
parent f038a89771
commit 98ef9e7fcc
52 changed files with 4069 additions and 445 deletions
@@ -100,6 +100,176 @@ func TestBulkOpenAutoUDPFallsBackToShared(t *testing.T) {
 	_ = accepted.Bulk.Close()
 }

+func TestOpenDedicatedBulkConnectByConnRejectedAsSingleConnMode(t *testing.T) {
+	server := newRunningPeerAttachServerForTest(t, func(server *ServerCommon) {
+		if err := UsePSKOverExternalTransportServer(server, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+			t.Fatalf("UsePSKOverExternalTransportServer failed: %v", err)
+		}
+		server.SetBulkHandler(func(info BulkAcceptInfo) error {
+			return nil
+		})
+	})
+
+	client := NewClient().(*ClientCommon)
+	if err := UsePSKOverExternalTransportClient(client, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+		t.Fatalf("UsePSKOverExternalTransportClient failed: %v", err)
+	}
+
+	left, right := net.Pipe()
+	defer right.Close()
+	bootstrapPeerAttachConnForTest(t, server, right)
+	if err := client.ConnectByConn(left); err != nil {
+		t.Fatalf("ConnectByConn failed: %v", err)
+	}
+	defer func() {
+		client.setByeFromServer(true)
+		_ = client.Stop()
+	}()
+
+	_, err := client.OpenDedicatedBulk(context.Background(), BulkOpenOptions{
+		Range: BulkRange{
+			Offset: 0,
+			Length: 128,
+		},
+	})
+	if !errors.Is(err, errBulkDedicatedSingleConn) {
+		t.Fatalf("client OpenDedicatedBulk over ConnectByConn error = %v, want %v", err, errBulkDedicatedSingleConn)
+	}
+}
+
+func TestOpenBulkAutoConnectByConnFallsBackToShared(t *testing.T) {
+	acceptCh := make(chan BulkAcceptInfo, 2)
+	server := newRunningPeerAttachServerForTest(t, func(server *ServerCommon) {
+		if err := UsePSKOverExternalTransportServer(server, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+			t.Fatalf("UsePSKOverExternalTransportServer failed: %v", err)
+		}
+		server.SetBulkHandler(func(info BulkAcceptInfo) error {
+			acceptCh <- info
+			return nil
+		})
+	})
+
+	client := NewClient().(*ClientCommon)
+	if err := UsePSKOverExternalTransportClient(client, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+		t.Fatalf("UsePSKOverExternalTransportClient failed: %v", err)
+	}
+
+	left, right := net.Pipe()
+	defer right.Close()
+	bootstrapPeerAttachConnForTest(t, server, right)
+	if err := client.ConnectByConn(left); err != nil {
+		t.Fatalf("ConnectByConn failed: %v", err)
+	}
+	defer func() {
+		client.setByeFromServer(true)
+		_ = client.Stop()
+	}()
+
+	bulk, err := client.OpenBulk(context.Background(), BulkOpenOptions{
+		Mode: BulkOpenModeAuto,
+		Range: BulkRange{
+			Offset: 0,
+			Length: 128,
+		},
+	})
+	if err != nil {
+		t.Fatalf("client OpenBulk auto over ConnectByConn failed: %v", err)
+	}
+	if bulk.Snapshot().Dedicated {
+		t.Fatal("client OpenBulk auto over ConnectByConn should fall back to shared")
+	}
+	defer func() {
+		_ = bulk.Close()
+	}()
+
+	accepted := waitAcceptedBulk(t, acceptCh, 2*time.Second)
+	if accepted.Dedicated {
+		t.Fatal("server accepted bulk should be shared after ConnectByConn auto fallback")
+	}
+	if _, err := bulk.Write([]byte("shared-over-single-conn")); err != nil {
+		t.Fatalf("client bulk Write failed: %v", err)
+	}
+	readBulkExactly(t, accepted.Bulk, "shared-over-single-conn", 2*time.Second)
+	select {
+	case extra := <-acceptCh:
+		t.Fatalf("unexpected extra server bulk accept: %+v", extra)
+	case <-time.After(300 * time.Millisecond):
+	}
+	_ = accepted.Bulk.Close()
+}
+
+func TestOpenDedicatedBulkExternalTransportDialableSourceSucceeds(t *testing.T) {
+	server := NewServer().(*ServerCommon)
+	if err := UsePSKOverExternalTransportServer(server, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+		t.Fatalf("UsePSKOverExternalTransportServer failed: %v", err)
+	}
+	acceptCh := make(chan BulkAcceptInfo, 2)
+	server.SetBulkHandler(func(info BulkAcceptInfo) error {
+		acceptCh <- info
+		return nil
+	})
+	if err := server.Listen("tcp", "127.0.0.1:0"); err != nil {
+		t.Fatalf("server Listen failed: %v", err)
+	}
+	defer func() {
+		_ = server.Stop()
+	}()
+
+	client := NewClient().(*ClientCommon)
+	if err := UsePSKOverExternalTransportClient(client, integrationSharedSecret, integrationModernPSKOptions()); err != nil {
+		t.Fatalf("UsePSKOverExternalTransportClient failed: %v", err)
+	}
+	if err := client.Connect("tcp", server.listener.Addr().String()); err != nil {
+		t.Fatalf("client Connect failed: %v", err)
+	}
+	defer func() {
+		client.setByeFromServer(true)
+		_ = client.Stop()
+	}()
+
+	bulk, err := client.OpenDedicatedBulk(context.Background(), BulkOpenOptions{
+		ID: "external-dedicated-dialable",
+		Range: BulkRange{
+			Offset: 0,
+			Length: 64,
+		},
+	})
+	if err != nil {
+		t.Fatalf("client OpenDedicatedBulk failed: %v", err)
+	}
+	if !bulk.Snapshot().Dedicated {
+		t.Fatal("client OpenDedicatedBulk over dialable external transport should stay dedicated")
+	}
+	defer func() {
+		_ = bulk.Close()
+	}()
+
+	accepted := waitAcceptedBulkByID(t, acceptCh, bulk.ID(), 2*time.Second)
+	if !accepted.Dedicated {
+		t.Fatal("server accepted bulk should stay dedicated over dialable external transport")
+	}
+	defer func() {
+		_ = accepted.Bulk.Close()
+	}()
+
+	clientHandle := bulk.(*bulkHandle)
+	if clientHandle.dedicatedConnSnapshot() == nil {
+		t.Fatal("client dedicated sidecar conn should be attached")
+	}
+	if mainConn := client.clientTransportConnSnapshot(); mainConn != nil && clientHandle.dedicatedConnSnapshot() == mainConn {
+		t.Fatal("client dedicated sidecar should use an additional physical connection")
+	}
+	if got := client.clientTransportProtectionSnapshot().mode; got != ProtectionExternal {
+		t.Fatalf("client steady protection mode = %v, want %v", got, ProtectionExternal)
+	}
+
+	payload := "external-dedicated-sidecar"
+	if _, err := bulk.Write([]byte(payload)); err != nil {
+		t.Fatalf("client bulk Write failed: %v", err)
+	}
+	readBulkExactly(t, accepted.Bulk, payload, 2*time.Second)
+}
+
 func TestOpenDedicatedBulkWaitsForActiveSlotUntilContextDeadline(t *testing.T) {
 	server := NewServer().(*ServerCommon)
 	if err := UseModernPSKServer(server, integrationSharedSecret, integrationModernPSKOptions()); err != nil {