feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化
- 新增 managed/external/nested 三种传输保护模式 - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商 - 明确单连接注入与可重拨连接源的语义边界 - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑 - 优化 shared bulk super-batch 与批量 framed write 路径 - 降低 stream/bulk fast path 的复制和分发损耗 - 补齐 benchmark、回归测试、运行时快照和 README 文档
This commit is contained in:
+97
-16
@@ -1,6 +1,7 @@
|
||||
package notify
|
||||
|
||||
import (
|
||||
"encoding/hex"
|
||||
"errors"
|
||||
"time"
|
||||
)
|
||||
@@ -17,6 +18,19 @@ type ClientRuntimeSnapshot struct {
|
||||
ConnectNetwork string
|
||||
ConnectAddress string
|
||||
CanReconnect bool
|
||||
AuthMode string
|
||||
ProtectionMode string
|
||||
ProtectionKeyMode string
|
||||
ForwardSecrecyEnabled bool
|
||||
ForwardSecrecyFallback bool
|
||||
ForwardSecrecyRequired bool
|
||||
TransportSessionID string
|
||||
PeerAttachAuthenticated bool
|
||||
PeerAttachAuthFallback bool
|
||||
LastPeerAttachAt time.Time
|
||||
PeerAttachRequireExplicitAuth bool
|
||||
PeerAttachRequireChannelBinding bool
|
||||
PeerAttachChannelBindingConfigured bool
|
||||
BulkNetworkProfile string
|
||||
BulkDefaultMode string
|
||||
BulkChunkSize int
|
||||
@@ -37,22 +51,38 @@ type ClientRuntimeSnapshot struct {
|
||||
}
|
||||
|
||||
type ServerRuntimeSnapshot struct {
|
||||
OwnerState string
|
||||
Alive bool
|
||||
ClientCount int
|
||||
DetachedClientCount int
|
||||
DetachedReattachableClientCount int
|
||||
DetachedExpiredClientCount int
|
||||
DetachedClientKeepSec int64
|
||||
TransportAttached bool
|
||||
HasRuntimeListener bool
|
||||
HasRuntimeUDPListener bool
|
||||
HasRuntimeQueue bool
|
||||
HasRuntimeStopCtx bool
|
||||
BulkChunkSize int
|
||||
BulkWindowBytes int
|
||||
BulkMaxInFlight int
|
||||
Retry ConnectionRetrySnapshot
|
||||
OwnerState string
|
||||
Alive bool
|
||||
ClientCount int
|
||||
DetachedClientCount int
|
||||
DetachedReattachableClientCount int
|
||||
DetachedExpiredClientCount int
|
||||
DetachedClientKeepSec int64
|
||||
TransportAttached bool
|
||||
HasRuntimeListener bool
|
||||
HasRuntimeUDPListener bool
|
||||
HasRuntimeQueue bool
|
||||
HasRuntimeStopCtx bool
|
||||
AuthMode string
|
||||
ProtectionMode string
|
||||
ForwardSecrecySupported bool
|
||||
ForwardSecrecyRequired bool
|
||||
PeerAttachRequireExplicitAuth bool
|
||||
PeerAttachRequireChannelBinding bool
|
||||
PeerAttachChannelBindingConfigured bool
|
||||
PeerAttachReplayWindow time.Duration
|
||||
PeerAttachReplayCapacity int
|
||||
PeerAttachExplicitAuth int64
|
||||
PeerAttachAuthFallbacks int64
|
||||
PeerAttachAuthRejects int64
|
||||
PeerAttachDowngradeRejects int64
|
||||
PeerAttachBindingRejects int64
|
||||
PeerAttachReplayRejects int64
|
||||
PeerAttachReplayOverflowRejects int64
|
||||
BulkChunkSize int
|
||||
BulkWindowBytes int
|
||||
BulkMaxInFlight int
|
||||
Retry ConnectionRetrySnapshot
|
||||
}
|
||||
|
||||
type ClientConnRuntimeSnapshot struct {
|
||||
@@ -82,6 +112,15 @@ type ClientConnRuntimeSnapshot struct {
|
||||
TransportDetachRemaining time.Duration
|
||||
TransportDetachExpired bool
|
||||
ReattachEligible bool
|
||||
AuthMode string
|
||||
ProtectionMode string
|
||||
ProtectionKeyMode string
|
||||
ForwardSecrecyEnabled bool
|
||||
ForwardSecrecyFallback bool
|
||||
TransportSessionID string
|
||||
PeerAttachAuthenticated bool
|
||||
PeerAttachAuthFallback bool
|
||||
LastPeerAttachAt time.Time
|
||||
TransportBulkAdaptiveSoftPayloadBytes int
|
||||
TransportStreamAdaptiveSoftPayloadBytes int
|
||||
TransportStreamAdaptiveWaitThresholdBytes int
|
||||
@@ -108,6 +147,19 @@ func (c *ClientCommon) clientRuntimeSnapshot() ClientRuntimeSnapshot {
|
||||
snapshot.ConnectAddress = source.addr
|
||||
snapshot.CanReconnect = source.canReconnect()
|
||||
}
|
||||
snapshot.AuthMode = authModeName(c.securityAuthMode)
|
||||
snapshot.ProtectionMode = protectionModeName(c.securityProtectionMode)
|
||||
protection := c.clientTransportProtectionSnapshot()
|
||||
snapshot.ProtectionKeyMode = protection.keyMode
|
||||
snapshot.ForwardSecrecyEnabled = protection.forwardSecrecy
|
||||
snapshot.ForwardSecrecyFallback = protection.forwardSecrecyFallback
|
||||
snapshot.ForwardSecrecyRequired = c.clientRequiresForwardSecrecy()
|
||||
snapshot.TransportSessionID = hex.EncodeToString(protection.sessionID)
|
||||
snapshot.PeerAttachAuthenticated, snapshot.PeerAttachAuthFallback, snapshot.LastPeerAttachAt = c.clientPeerAttachAuthSnapshot()
|
||||
peerAttachCfg := c.peerAttachSecuritySnapshot()
|
||||
snapshot.PeerAttachRequireExplicitAuth = peerAttachCfg.requireExplicitAuth
|
||||
snapshot.PeerAttachRequireChannelBinding = peerAttachCfg.requireChannelBinding
|
||||
snapshot.PeerAttachChannelBindingConfigured = peerAttachCfg.channelBinding != nil
|
||||
snapshot.BulkNetworkProfile = bulkNetworkProfileName(c.BulkNetworkProfile())
|
||||
snapshot.BulkDefaultMode = bulkOpenModeName(c.BulkDefaultOpenMode())
|
||||
tuning := c.BulkOpenTuning()
|
||||
@@ -161,6 +213,23 @@ func (s *ServerCommon) serverRuntimeSnapshot() ServerRuntimeSnapshot {
|
||||
snapshot.HasRuntimeQueue = rt.queue != nil
|
||||
snapshot.HasRuntimeStopCtx = rt.stopCtx != nil
|
||||
}
|
||||
snapshot.AuthMode = authModeName(s.securityAuthMode)
|
||||
snapshot.ProtectionMode = protectionModeName(s.securityProtectionMode)
|
||||
snapshot.ForwardSecrecySupported = s.serverSupportsForwardSecrecy()
|
||||
snapshot.ForwardSecrecyRequired = s.serverRequiresForwardSecrecy()
|
||||
peerAttachCfg := s.peerAttachSecuritySnapshot()
|
||||
snapshot.PeerAttachRequireExplicitAuth = peerAttachCfg.requireExplicitAuth
|
||||
snapshot.PeerAttachRequireChannelBinding = peerAttachCfg.requireChannelBinding
|
||||
snapshot.PeerAttachChannelBindingConfigured = peerAttachCfg.channelBinding != nil
|
||||
snapshot.PeerAttachReplayWindow = peerAttachCfg.replayWindow
|
||||
snapshot.PeerAttachReplayCapacity = peerAttachCfg.replayCapacity
|
||||
snapshot.PeerAttachExplicitAuth = s.peerAttachExplicitCount.Load()
|
||||
snapshot.PeerAttachAuthFallbacks = s.peerAttachAuthFallbackCount.Load()
|
||||
snapshot.PeerAttachAuthRejects = s.peerAttachAuthRejectCount.Load()
|
||||
snapshot.PeerAttachDowngradeRejects = s.peerAttachDowngradeRejectCount.Load()
|
||||
snapshot.PeerAttachBindingRejects = s.peerAttachBindingRejectCount.Load()
|
||||
snapshot.PeerAttachReplayRejects = s.peerAttachReplayRejectCountSnapshot()
|
||||
snapshot.PeerAttachReplayOverflowRejects = s.peerAttachReplayOverflowRejectCountSnapshot()
|
||||
tuning := s.BulkOpenTuning()
|
||||
snapshot.BulkChunkSize = tuning.ChunkSize
|
||||
snapshot.BulkWindowBytes = tuning.WindowBytes
|
||||
@@ -171,6 +240,7 @@ func (s *ServerCommon) serverRuntimeSnapshot() ServerRuntimeSnapshot {
|
||||
|
||||
func (c *ClientConn) clientConnRuntimeSnapshot() ClientConnRuntimeSnapshot {
|
||||
status := c.clientConnStatusSnapshot()
|
||||
attachment := c.clientConnAttachmentStateSnapshot()
|
||||
now := time.Now()
|
||||
snapshot := ClientConnRuntimeSnapshot{
|
||||
ClientID: c.clientConnIDSnapshot(),
|
||||
@@ -182,6 +252,17 @@ func (c *ClientConn) clientConnRuntimeSnapshot() ClientConnRuntimeSnapshot {
|
||||
TransportAttachCount: c.clientConnTransportAttachCountSnapshot(),
|
||||
TransportDetachCount: c.clientConnTransportDetachCountSnapshot(),
|
||||
LastTransportAttachAt: c.clientConnLastTransportAttachedAtSnapshot(),
|
||||
AuthMode: authModeName(attachment.authMode),
|
||||
ProtectionMode: protectionModeName(attachment.protectionMode),
|
||||
}
|
||||
snapshot.PeerAttachAuthenticated = attachment.peerAttached
|
||||
snapshot.PeerAttachAuthFallback = attachment.peerAttachFallback
|
||||
snapshot.ProtectionKeyMode = attachment.keyMode
|
||||
snapshot.ForwardSecrecyEnabled = attachment.forwardSecrecy
|
||||
snapshot.ForwardSecrecyFallback = attachment.forwardSecrecyFallback
|
||||
snapshot.TransportSessionID = hex.EncodeToString(attachment.sessionID)
|
||||
if attachment.peerAttachAt != 0 {
|
||||
snapshot.LastPeerAttachAt = time.Unix(0, attachment.peerAttachAt)
|
||||
}
|
||||
if status.Err != nil {
|
||||
snapshot.Error = status.Err.Error()
|
||||
|
||||
Reference in New Issue
Block a user