feat(transport): 完成安全架构拆分并收口 stream/bulk 传输优化

- 新增 managed/external/nested 三种传输保护模式
  - 新增 peer attach 显式认证、抗重放、channel binding 和可选前向保密协商
  - 明确单连接注入与可重拨连接源的语义边界
  - 禁止 ConnectByConn 场景下 dedicated bulk 走 sidecar,auto 模式自动回退 shared
  - 修正 dedicated attach 在 bootstrap/steady profile 切换下的处理逻辑
  - 优化 shared bulk super-batch 与批量 framed write 路径
  - 降低 stream/bulk fast path 的复制和分发损耗
  - 补齐 benchmark、回归测试、运行时快照和 README 文档
This commit is contained in:
2026-04-20 16:35:44 +08:00
parent f038a89771
commit 98ef9e7fcc
52 changed files with 4069 additions and 445 deletions
+22 -2
View File
@@ -83,6 +83,10 @@ func (s *ServerCommon) dispatchStreamEnvelope(logical *LogicalConn, transport *T
}
func (c *ClientCommon) dispatchFastStreamData(frame streamFastDataFrame) {
c.dispatchFastStreamDataWithOwner(frame, nil)
}
func (c *ClientCommon) dispatchFastStreamDataWithOwner(frame streamFastDataFrame, owner *streamReadPayloadOwner) {
if frame.DataID == 0 {
return
}
@@ -107,7 +111,13 @@ func (c *ClientCommon) dispatchFastStreamData(frame streamFastDataFrame) {
c.bestEffortRejectInboundStreamData(stream.ID(), frame.DataID, detachErr.Error())
return
}
if err := stream.pushOwnedChunk(frame.Payload); err != nil {
var err error
if owner != nil {
err = stream.pushOwnedChunkWithRelease(frame.Payload, owner.retainChunk())
} else {
err = stream.pushOwnedChunk(frame.Payload)
}
if err != nil {
if c.showError || c.debugMode {
fmt.Println("client stream push chunk error", err)
}
@@ -118,6 +128,10 @@ func (c *ClientCommon) dispatchFastStreamData(frame streamFastDataFrame) {
}
func (s *ServerCommon) dispatchFastStreamData(logical *LogicalConn, transport *TransportConn, conn net.Conn, frame streamFastDataFrame) {
s.dispatchFastStreamDataWithOwner(logical, transport, conn, frame, nil)
}
func (s *ServerCommon) dispatchFastStreamDataWithOwner(logical *LogicalConn, transport *TransportConn, conn net.Conn, frame streamFastDataFrame, owner *streamReadPayloadOwner) {
if logical == nil || frame.DataID == 0 {
return
}
@@ -141,7 +155,13 @@ func (s *ServerCommon) dispatchFastStreamData(logical *LogicalConn, transport *T
s.bestEffortRejectInboundStreamData(logical, transport, conn, stream.ID(), frame.DataID, detachErr.Error())
return
}
if err := stream.pushOwnedChunk(frame.Payload); err != nil {
var err error
if owner != nil {
err = stream.pushOwnedChunkWithRelease(frame.Payload, owner.retainChunk())
} else {
err = stream.pushOwnedChunk(frame.Payload)
}
if err != nil {
if s.showError || s.debugMode {
fmt.Println("server stream push chunk error", err)
}