Aleksandr Bogomiakov
fac3bd7bb9
Implement the `tcp-tls` protocol crate and generic tunnel codec abstractions alongside `wg-quic` to circumvent deep packet inspection (DPI/TSPU), UDP blocking, and QUIC throttling. Traffic uses standard TCP on port 443 with TLS 1.3 framing, looking identical to regular HTTPS traffic to network observers. Architectural highlights: - TunnelCodec & GenericTunnelPlugin: Provide an extensible plugin abstraction in `crates/tsunagi/src/dataplane/tunnel.rs` that encapsulates background task lifecycles, per-peer channels, and sink dispatch, so new transport plugins only define cryptographic transformations and handshake payloads. - MultiPacketTransport & Protocol Priority Selection: Support multiple simultaneous transports in `AgentConfig` and dynamically dispatch `open()` calls by protocol identifier. In `ensure_links`, choose the highest-priority mutually supported protocol per peer to avoid duplicate links. - TLS 1.3 & Certificate Pinning: Generate self-signed Ed25519 X.509 certificates derived from the persistent `DeviceIdentity` secret. Clients pin peer certificates using `PinnedEndpointVerifier` against `iroh::EndpointId`. - End-to-end Encryption: `PeerCipher` uses X25519 static-static ECDH, HKDF-SHA256, and ChaCha20-Poly1305 with incrementing 64-bit nonces. Relayed traffic across intermediate nodes remains confidential and tamper-proof. - Privilege handling: Default to TCP port 443 with fallback to 8443 on `PermissionDenied`, providing an actionable message recommending: `sudo setcap cap_net_admin,cap_net_bind_service+p <path>`. Validation on Linux: - `cargo fmt --all -- --check` passed. - `cargo clippy --locked --workspace --all-targets -- -D warnings` passed. - `cargo test --locked --workspace --all-targets` passed (all workspace unit, integration, CLI, and new `tsunagi-tcp-tls` tests passed).
39 lines
1.0 KiB
TOML
39 lines
1.0 KiB
TOML
[package]
|
|
name = "tsunagi-tcp-tls"
|
|
version = "0.1.0"
|
|
description = "TCP TLS 443 transport and E2EE tunnel protocol for tsunagi mesh networks."
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[dependencies]
|
|
tsunagi = { path = "../tsunagi", version = "0.1.0" }
|
|
iroh.workspace = true
|
|
tokio = { workspace = true, features = ["net", "io-util", "time", "sync", "macros"] }
|
|
rustls = "0.23"
|
|
tokio-rustls = "0.26"
|
|
rcgen = { version = "0.14", default-features = false, features = ["ring"] }
|
|
x25519-dalek = { version = "2.0", features = ["static_secrets"] }
|
|
chacha20poly1305 = "0.10"
|
|
sha2 = "0.11"
|
|
hkdf = "0.13"
|
|
rand = "0.10"
|
|
subtle = "2.6"
|
|
zeroize = { version = "1.9", features = ["derive"] }
|
|
bytes.workspace = true
|
|
serde.workspace = true
|
|
postcard.workspace = true
|
|
tracing.workspace = true
|
|
thiserror.workspace = true
|
|
hex.workspace = true
|
|
netdev = "0.46"
|
|
|
|
[dev-dependencies]
|
|
tsunagi = { path = "../tsunagi", features = ["testing"] }
|
|
tempfile.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
|
|
[lints]
|
|
workspace = true
|