b612/notify
1
0
Fork 0
Code Issues Pull Requests Projects Releases 11 Wiki Activity

feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

Browse Source 
- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档
This commit is contained in:
兔子
2026-04-20 16:35:44 +08:00
parent f038a89771
commit 98ef9e7fcc
52 changed files with 4069 additions and 445 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server_send.go
+19 -4
View File
@@ -358,16 +358,20 @@ func (s *ServerCommon) sendEnvelopeTransport(transport *TransportConn, env Envel
}
func (s *ServerCommon) sendEnvelopeInboundTransport(logical *LogicalConn, transport *TransportConn, conn net.Conn, env Envelope) error {
return s.sendEnvelopeInboundTransportWithProfile(logical, transport, conn, nil, env)
}
func (s *ServerCommon) sendEnvelopeInboundTransportWithProfile(logical *LogicalConn, transport *TransportConn, conn net.Conn, profile *transportProtectionProfile, env Envelope) error {
if logical == nil && transport != nil {
logical = transport.logicalConnSnapshot()
}
if logical == nil {
return transportDetachedErrorForPeer(logical, transport)
}
if logical.msgEnSnapshot() == nil {
if profile == nil && logical.msgEnSnapshot() == nil {
return transportDetachedErrorForPeer(logical, transport)
}
payload, err := s.encodeEnvelopePayloadLogical(logical, env)
payload, err := s.encodeEnvelopePayloadInbound(logical, env, profile)
if err != nil {
return err
}
@@ -402,7 +406,18 @@ func (s *ServerCommon) writeControlEnvelopePayload(logical *LogicalConn, transpo
return sender.submit(payload, writeDeadlineFromTimeout(logical.maxWriteTimeoutSnapshot()))
}
func (s *ServerCommon) sendTransferInbound(logical *LogicalConn, transport *TransportConn, conn net.Conn, msg TransferMsg) error {
func (s *ServerCommon) encodeEnvelopePayloadInbound(logical *LogicalConn, env Envelope, profile *transportProtectionProfile) ([]byte, error) {
if profile == nil {
return s.encodeEnvelopePayloadLogical(logical, env)
}
data, err := s.encodeEnvelopePlain(env)
if err != nil {
return nil, err
}
return encryptTransportPayloadCodec(profile.mode, profile.runtime, profile.msgEn, profile.secretKey, data)
}
func (s *ServerCommon) sendTransferInbound(logical *LogicalConn, transport *TransportConn, conn net.Conn, profile *transportProtectionProfile, msg TransferMsg) error {
if logical == nil && transport != nil {
logical = transport.logicalConnSnapshot()
}
@@ -413,7 +428,7 @@ func (s *ServerCommon) sendTransferInbound(logical *LogicalConn, transport *Tran
if err != nil {
return err
}
return s.sendEnvelopeInboundTransport(logical, transport, conn, env)
return s.sendEnvelopeInboundTransportWithProfile(logical, transport, conn, profile, env)
}
func (s *ServerCommon) writeEnvelopePayload(logical *LogicalConn, transport *TransportConn, conn net.Conn, payload []byte) error {