feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式 - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商 - 明确单连接注入与可重拨连接源的语义边界 - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar，auto 模式自动回退 shared - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑 - 优化 shared bulk super-batch 与批量 framed write 路径 - 降低 stream/bulk fast path 的复制和分发损耗 - 补齐 benchmark、回归测试、运行时快照和 README 文档
2026-04-20 16:35:44 +08:00
parent f038a89771
commit 98ef9e7fcc
52 changed files with 4069 additions and 445 deletions
@@ -37,6 +37,21 @@ func TestGetClientRuntimeSnapshotDefaults(t *testing.T) {
 	if snapshot.ConnectSource != "" || snapshot.ConnectNetwork != "" || snapshot.ConnectAddress != "" || snapshot.CanReconnect {
 		t.Fatalf("unexpected default connect source snapshot: %+v", snapshot)
 	}
+	if got, want := snapshot.AuthMode, "none"; got != want {
+		t.Fatalf("AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := snapshot.ProtectionMode, "managed"; got != want {
+		t.Fatalf("ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if snapshot.PeerAttachAuthenticated || snapshot.PeerAttachAuthFallback {
+		t.Fatalf("unexpected default peer attach state: %+v", snapshot)
+	}
+	if !snapshot.LastPeerAttachAt.IsZero() {
+		t.Fatalf("LastPeerAttachAt mismatch: got %v want zero", snapshot.LastPeerAttachAt)
+	}
+	if snapshot.PeerAttachRequireExplicitAuth || snapshot.PeerAttachRequireChannelBinding || snapshot.PeerAttachChannelBindingConfigured {
+		t.Fatalf("unexpected default peer attach policy: %+v", snapshot)
+	}
 	if got, want := snapshot.BulkNetworkProfile, "default"; got != want {
 		t.Fatalf("BulkNetworkProfile mismatch: got %q want %q", got, want)
 	}
@@ -117,6 +132,24 @@ func TestGetServerRuntimeSnapshotDefaults(t *testing.T) {
 	if !snapshot.HasRuntimeStopCtx {
 		t.Fatalf("HasRuntimeStopCtx mismatch: got %v want true", snapshot.HasRuntimeStopCtx)
 	}
+	if got, want := snapshot.AuthMode, "none"; got != want {
+		t.Fatalf("AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := snapshot.ProtectionMode, "managed"; got != want {
+		t.Fatalf("ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if snapshot.PeerAttachRequireExplicitAuth || snapshot.PeerAttachRequireChannelBinding || snapshot.PeerAttachChannelBindingConfigured {
+		t.Fatalf("unexpected default peer attach policy: %+v", snapshot)
+	}
+	if got, want := snapshot.PeerAttachReplayWindow, peerAttachReplayTTL; got != want {
+		t.Fatalf("PeerAttachReplayWindow mismatch: got %s want %s", got, want)
+	}
+	if got, want := snapshot.PeerAttachReplayCapacity, defaultPeerAttachReplayCapacity; got != want {
+		t.Fatalf("PeerAttachReplayCapacity mismatch: got %d want %d", got, want)
+	}
+	if snapshot.PeerAttachExplicitAuth != 0 || snapshot.PeerAttachAuthFallbacks != 0 || snapshot.PeerAttachAuthRejects != 0 || snapshot.PeerAttachDowngradeRejects != 0 || snapshot.PeerAttachBindingRejects != 0 || snapshot.PeerAttachReplayRejects != 0 || snapshot.PeerAttachReplayOverflowRejects != 0 {
+		t.Fatalf("unexpected default peer attach counters: %+v", snapshot)
+	}
 	if got, want := snapshot.BulkChunkSize, defaultBulkChunkSize; got != want {
 		t.Fatalf("BulkChunkSize mismatch: got %d want %d", got, want)
 	}
@@ -476,6 +509,134 @@ func TestGetClientConnRuntimeSnapshotExposesDetachState(t *testing.T) {
 	if snapshot.LastHeartbeatAt.IsZero() {
 		t.Fatal("LastHeartbeatAt should be recorded")
 	}
+	if got, want := snapshot.AuthMode, "none"; got != want {
+		t.Fatalf("AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := snapshot.ProtectionMode, "managed"; got != want {
+		t.Fatalf("ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if snapshot.PeerAttachAuthenticated || snapshot.PeerAttachAuthFallback {
+		t.Fatalf("unexpected peer attach state: %+v", snapshot)
+	}
+	if !snapshot.LastPeerAttachAt.IsZero() {
+		t.Fatalf("LastPeerAttachAt mismatch: got %v want zero", snapshot.LastPeerAttachAt)
+	}
+}
+
+func TestGetRuntimeSnapshotsIncludePeerAttachSecurityState(t *testing.T) {
+	secret := []byte("correct horse battery staple")
+	server := newRunningPeerAttachServerForTest(t, func(server *ServerCommon) {
+		if err := UsePSKOverExternalTransportServer(server, secret, testModernPSKOptions()); err != nil {
+			t.Fatalf("UsePSKOverExternalTransportServer failed: %v", err)
+		}
+	})
+	client := NewClient().(*ClientCommon)
+	if err := UsePSKOverExternalTransportClient(client, secret, testModernPSKOptions()); err != nil {
+		t.Fatalf("UsePSKOverExternalTransportClient failed: %v", err)
+	}
+
+	left, right := net.Pipe()
+	defer right.Close()
+	bootstrapPeerAttachLogicalForTest(t, server, right)
+	if err := client.ConnectByConn(left); err != nil {
+		t.Fatalf("ConnectByConn failed: %v", err)
+	}
+	defer func() {
+		client.setByeFromServer(true)
+		_ = client.Stop()
+	}()
+	deadline := time.Now().Add(time.Second)
+	for {
+		logical := server.GetLogicalConn(client.peerIdentity)
+		if logical != nil {
+			authenticated, fallback, _ := logical.peerAttachAuthenticatedSnapshot()
+			if authenticated && !fallback && logical.protectionModeSnapshot() == ProtectionExternal && server.peerAttachExplicitCount.Load() == 1 {
+				break
+			}
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("peer attach security state did not converge before snapshot")
+		}
+		time.Sleep(time.Millisecond)
+	}
+
+	clientSnapshot, err := GetClientRuntimeSnapshot(client)
+	if err != nil {
+		t.Fatalf("GetClientRuntimeSnapshot failed: %v", err)
+	}
+	if got, want := clientSnapshot.AuthMode, "psk"; got != want {
+		t.Fatalf("client AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := clientSnapshot.ProtectionMode, "external"; got != want {
+		t.Fatalf("client ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if clientSnapshot.PeerAttachRequireExplicitAuth || clientSnapshot.PeerAttachRequireChannelBinding || clientSnapshot.PeerAttachChannelBindingConfigured {
+		t.Fatalf("unexpected client peer attach policy snapshot: %+v", clientSnapshot)
+	}
+	if !clientSnapshot.PeerAttachAuthenticated || clientSnapshot.PeerAttachAuthFallback {
+		t.Fatalf("unexpected client peer attach state: %+v", clientSnapshot)
+	}
+	if clientSnapshot.LastPeerAttachAt.IsZero() {
+		t.Fatal("client LastPeerAttachAt should be recorded")
+	}
+
+	serverSnapshot, err := GetServerRuntimeSnapshot(server)
+	if err != nil {
+		t.Fatalf("GetServerRuntimeSnapshot failed: %v", err)
+	}
+	if got, want := serverSnapshot.AuthMode, "psk"; got != want {
+		t.Fatalf("server AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := serverSnapshot.ProtectionMode, "external"; got != want {
+		t.Fatalf("server ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if serverSnapshot.PeerAttachRequireExplicitAuth || serverSnapshot.PeerAttachRequireChannelBinding || serverSnapshot.PeerAttachChannelBindingConfigured {
+		t.Fatalf("unexpected server peer attach policy snapshot: %+v", serverSnapshot)
+	}
+	if got, want := serverSnapshot.PeerAttachExplicitAuth, int64(1); got != want {
+		t.Fatalf("PeerAttachExplicitAuth mismatch: got %d want %d", got, want)
+	}
+	if serverSnapshot.PeerAttachAuthFallbacks != 0 || serverSnapshot.PeerAttachAuthRejects != 0 || serverSnapshot.PeerAttachDowngradeRejects != 0 || serverSnapshot.PeerAttachBindingRejects != 0 || serverSnapshot.PeerAttachReplayRejects != 0 || serverSnapshot.PeerAttachReplayOverflowRejects != 0 {
+		t.Fatalf("unexpected server peer attach counters: %+v", serverSnapshot)
+	}
+
+	logical := server.GetLogicalConn(client.peerIdentity)
+	if logical == nil {
+		t.Fatal("server logical should exist after peer attach")
+	}
+	logicalSnapshot, err := GetLogicalConnRuntimeSnapshot(logical)
+	if err != nil {
+		t.Fatalf("GetLogicalConnRuntimeSnapshot failed: %v", err)
+	}
+	if got, want := logicalSnapshot.AuthMode, "psk"; got != want {
+		t.Fatalf("logical AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := logicalSnapshot.ProtectionMode, "external"; got != want {
+		t.Fatalf("logical ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if !logicalSnapshot.PeerAttachAuthenticated || logicalSnapshot.PeerAttachAuthFallback {
+		t.Fatalf("unexpected logical peer attach state: %+v", logicalSnapshot)
+	}
+	if logicalSnapshot.LastPeerAttachAt.IsZero() {
+		t.Fatal("logical LastPeerAttachAt should be recorded")
+	}
+
+	clientConnSnapshot, err := GetClientConnRuntimeSnapshot(clientConnFromLogical(logical))
+	if err != nil {
+		t.Fatalf("GetClientConnRuntimeSnapshot failed: %v", err)
+	}
+	if got, want := clientConnSnapshot.AuthMode, "psk"; got != want {
+		t.Fatalf("client conn AuthMode mismatch: got %q want %q", got, want)
+	}
+	if got, want := clientConnSnapshot.ProtectionMode, "external"; got != want {
+		t.Fatalf("client conn ProtectionMode mismatch: got %q want %q", got, want)
+	}
+	if !clientConnSnapshot.PeerAttachAuthenticated || clientConnSnapshot.PeerAttachAuthFallback {
+		t.Fatalf("unexpected client conn peer attach state: %+v", clientConnSnapshot)
+	}
+	if clientConnSnapshot.LastPeerAttachAt.IsZero() {
+		t.Fatal("client conn LastPeerAttachAt should be recorded")
+	}
 }

 func TestGetServerDetachedClientRuntimeSnapshotsFiltersAndSorts(t *testing.T) {