feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式 - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商 - 明确单连接注入与可重拨连接源的语义边界 - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑 - 优化 shared bulk super-batch 与批量 framed write 路径 - 降低 stream/bulk fast path 的复制和分发损耗 - 补齐 benchmark、回归测试、运行时快照和 README 文档
2026-04-20 16:35:44 +08:00
parent f038a89771
commit 98ef9e7fcc
52 changed files with 4069 additions and 445 deletions
@@ -6,17 +6,26 @@ import (
 )

 type clientConnAttachmentState struct {
-	maxReadTimeout   time.Duration
-	maxWriteTimeout  time.Duration
-	msgEn            func([]byte, []byte) []byte
-	msgDe            func([]byte, []byte) []byte
-	fastStreamEncode transportFastStreamEncoder
-	fastBulkEncode   transportFastBulkEncoder
-	fastPlainEncode  transportFastPlainEncoder
-	modernPSKRuntime *modernPSKCodecRuntime
-	handshakeRsaKey  []byte
-	secretKey        []byte
-	lastHeartBeat    int64
+	maxReadTimeout         time.Duration
+	maxWriteTimeout        time.Duration
+	authMode               AuthMode
+	protectionMode         ProtectionMode
+	msgEn                  func([]byte, []byte) []byte
+	msgDe                  func([]byte, []byte) []byte
+	fastStreamEncode       transportFastStreamEncoder
+	fastBulkEncode         transportFastBulkEncoder
+	fastPlainEncode        transportFastPlainEncoder
+	modernPSKRuntime       *modernPSKCodecRuntime
+	handshakeRsaKey        []byte
+	secretKey              []byte
+	keyMode                string
+	sessionID              []byte
+	forwardSecrecy         bool
+	forwardSecrecyFallback bool
+	peerAttached           bool
+	peerAttachFallback     bool
+	peerAttachAt           int64
+	lastHeartBeat          int64
 }

 func cloneClientConnAttachmentState(src *clientConnAttachmentState) *clientConnAttachmentState {
@@ -26,6 +35,7 @@ func cloneClientConnAttachmentState(src *clientConnAttachmentState) *clientConnA
 	cloned := *src
 	cloned.handshakeRsaKey = cloneClientConnAttachmentBytes(src.handshakeRsaKey)
 	cloned.secretKey = cloneClientConnAttachmentBytes(src.secretKey)
+	cloned.sessionID = cloneClientConnAttachmentBytes(src.sessionID)
 	return &cloned
 }

@@ -153,6 +163,7 @@ func (c *ClientConn) applyClientConnAttachmentProfile(maxReadTimeout time.Durati
 	c.updateClientConnAttachmentState(func(state *clientConnAttachmentState) {
 		state.maxReadTimeout = maxReadTimeout
 		state.maxWriteTimeout = maxWriteTimeout
+		state.protectionMode = ProtectionManaged
 		state.msgEn = msgEn
 		state.msgDe = msgDe
 		state.modernPSKRuntime = nil
@@ -206,6 +217,7 @@ func (c *ClientConn) clientConnMsgEnSnapshot() func([]byte, []byte) []byte {

 func (c *ClientConn) setClientConnMsgEn(fn func([]byte, []byte) []byte) {
 	c.updateClientConnAttachmentState(func(state *clientConnAttachmentState) {
+		state.protectionMode = ProtectionManaged
 		state.msgEn = fn
 		state.fastStreamEncode = nil
 		state.fastBulkEncode = nil
@@ -223,6 +235,7 @@ func (c *ClientConn) clientConnMsgDeSnapshot() func([]byte, []byte) []byte {

 func (c *ClientConn) setClientConnMsgDe(fn func([]byte, []byte) []byte) {
 	c.updateClientConnAttachmentState(func(state *clientConnAttachmentState) {
+		state.protectionMode = ProtectionManaged
 		state.msgDe = fn
 		state.fastStreamEncode = nil
 		state.fastBulkEncode = nil
@@ -319,6 +332,39 @@ func (c *LogicalConn) modernPSKRuntimeSnapshot() *modernPSKCodecRuntime {
 	return nil
 }

+func (c *LogicalConn) protectionModeSnapshot() ProtectionMode {
+	if state := c.attachmentStateRaw(); state != nil {
+		return state.protectionMode
+	}
+	return ProtectionManaged
+}
+
+func (c *LogicalConn) authModeSnapshot() AuthMode {
+	if state := c.attachmentStateRaw(); state != nil {
+		return state.authMode
+	}
+	return AuthNone
+}
+
+func (c *LogicalConn) peerAttachAuthenticatedSnapshot() (bool, bool, time.Time) {
+	if state := c.attachmentStateRaw(); state != nil {
+		if state.peerAttachAt == 0 {
+			return state.peerAttached, state.peerAttachFallback, time.Time{}
+		}
+		return state.peerAttached, state.peerAttachFallback, time.Unix(0, state.peerAttachAt)
+	}
+	return false, false, time.Time{}
+}
+
+func (c *LogicalConn) markPeerAttachAuthenticated(authMode AuthMode, fallback bool, at time.Time) {
+	c.updateAttachmentState(func(state *clientConnAttachmentState) {
+		state.authMode = authMode
+		state.peerAttached = true
+		state.peerAttachFallback = fallback
+		state.peerAttachAt = at.UnixNano()
+	})
+}
+
 func (c *LogicalConn) setModernPSKRuntime(runtime *modernPSKCodecRuntime) {
 	c.updateAttachmentState(func(state *clientConnAttachmentState) {
 		state.modernPSKRuntime = runtime