Implement the `tcp-tls` protocol crate and generic tunnel codec abstractions alongside `wg-quic` to circumvent deep packet inspection (DPI/TSPU), UDP blocking, and QUIC throttling. Traffic uses standard TCP on port 443 with TLS 1.3 framing, looking identical to regular HTTPS traffic to network observers. Architectural highlights: - TunnelCodec & GenericTunnelPlugin: Provide an extensible plugin abstraction in `crates/tsunagi/src/dataplane/tunnel.rs` that encapsulates background task lifecycles, per-peer channels, and sink dispatch, so new transport plugins only define cryptographic transformations and handshake payloads. - MultiPacketTransport & Protocol Priority Selection: Support multiple simultaneous transports in `AgentConfig` and dynamically dispatch `open()` calls by protocol identifier. In `ensure_links`, choose the highest-priority mutually supported protocol per peer to avoid duplicate links. - TLS 1.3 & Certificate Pinning: Generate self-signed Ed25519 X.509 certificates derived from the persistent `DeviceIdentity` secret. Clients pin peer certificates using `PinnedEndpointVerifier` against `iroh::EndpointId`. - End-to-end Encryption: `PeerCipher` uses X25519 static-static ECDH, HKDF-SHA256, and ChaCha20-Poly1305 with incrementing 64-bit nonces. Relayed traffic across intermediate nodes remains confidential and tamper-proof. - Privilege handling: Default to TCP port 443 with fallback to 8443 on `PermissionDenied`, providing an actionable message recommending: `sudo setcap cap_net_admin,cap_net_bind_service+p <path>`. Validation on Linux: - `cargo fmt --all -- --check` passed. - `cargo clippy --locked --workspace --all-targets -- -D warnings` passed. - `cargo test --locked --workspace --all-targets` passed (all workspace unit, integration, CLI, and new `tsunagi-tcp-tls` tests passed).
150 lines
4.7 KiB
Rust
150 lines
4.7 KiB
Rust
#![allow(missing_docs)]
|
|
#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
|
|
|
|
use std::sync::Arc;
|
|
use std::time::Duration;
|
|
|
|
use bytes::Bytes;
|
|
use tokio::sync::mpsc;
|
|
use tsunagi::dataplane::transport::{InboundLink, PacketTransport};
|
|
use tsunagi::dataplane::{IpPlugin, PacketSink, PluginContext};
|
|
use tsunagi::identity::{DeviceIdentity, NetworkId};
|
|
use tsunagi_tcp_tls::{TcpTlsCodec, TcpTlsPlugin, TcpTlsTransport};
|
|
|
|
struct TestSink {
|
|
delivered: mpsc::Sender<(NetworkId, iroh::EndpointId, Bytes)>,
|
|
}
|
|
|
|
impl PacketSink for TestSink {
|
|
fn deliver(
|
|
&self,
|
|
network: NetworkId,
|
|
from: iroh::EndpointId,
|
|
packet: Bytes,
|
|
) -> tsunagi::BoxFuture<'_, ()> {
|
|
let delivered = self.delivered.clone();
|
|
Box::pin(async move {
|
|
let _ = delivered.send((network, from, packet)).await;
|
|
})
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_tcp_tls_plugin_end_to_end() {
|
|
let identity_a = DeviceIdentity::generate();
|
|
let peer_a = identity_a.endpoint_id();
|
|
|
|
let identity_b = DeviceIdentity::generate();
|
|
let peer_b = identity_b.endpoint_id();
|
|
|
|
let network = NetworkId::from_bytes([77u8; 32]);
|
|
|
|
// Transports
|
|
let transport_b = Arc::new(
|
|
TcpTlsTransport::bind(&identity_b, Some(0))
|
|
.await
|
|
.expect("bind B"),
|
|
);
|
|
let port_b = transport_b.bound_port();
|
|
|
|
let transport_a = Arc::new(
|
|
TcpTlsTransport::bind(&identity_a, Some(0))
|
|
.await
|
|
.expect("bind A"),
|
|
);
|
|
|
|
// Codecs and plugins
|
|
let codec_a = TcpTlsCodec::new(peer_a, Arc::clone(&transport_a));
|
|
let plugin_a = Arc::new(TcpTlsPlugin::new(codec_a));
|
|
|
|
let codec_b = TcpTlsCodec::new(peer_b, Arc::clone(&transport_b));
|
|
let plugin_b = Arc::new(TcpTlsPlugin::new(codec_b));
|
|
|
|
// Attach sinks
|
|
let (sink_a_tx, mut sink_a_rx) = mpsc::channel(10);
|
|
plugin_a.attach(PluginContext::with_sink(Arc::new(TestSink {
|
|
delivered: sink_a_tx,
|
|
})));
|
|
|
|
let (sink_b_tx, mut sink_b_rx) = mpsc::channel(10);
|
|
plugin_b.attach(PluginContext::with_sink(Arc::new(TestSink {
|
|
delivered: sink_b_tx,
|
|
})));
|
|
|
|
// Capability exchange
|
|
let cap_a = plugin_a
|
|
.local_capability(network)
|
|
.expect("cap A")
|
|
.expect("some cap A");
|
|
let cap_b = plugin_b
|
|
.local_capability(network)
|
|
.expect("cap B")
|
|
.expect("some cap B");
|
|
|
|
plugin_a
|
|
.on_peer_capability(network, peer_b, &cap_b)
|
|
.expect("A on cap B");
|
|
plugin_b
|
|
.on_peer_capability(network, peer_a, &cap_a)
|
|
.expect("B on cap A");
|
|
|
|
// Spawn accept loop on B
|
|
let (inbound_tx, mut inbound_rx) = mpsc::channel::<InboundLink>(1);
|
|
let transport_b_clone = Arc::clone(&transport_b);
|
|
tokio::spawn(async move {
|
|
transport_b_clone
|
|
.accept_loop(move |inbound| {
|
|
let _ = inbound_tx.try_send(inbound);
|
|
})
|
|
.await;
|
|
});
|
|
|
|
// Make sure A knows B's loopback address
|
|
transport_a.set_peer_addr(peer_b, format!("127.0.0.1:{port_b}").parse().unwrap());
|
|
|
|
// Connect link from A to B
|
|
let link_a = transport_a
|
|
.open(network, peer_b, "tcp-tls")
|
|
.await
|
|
.expect("open link from A");
|
|
let inbound_b = tokio::time::timeout(Duration::from_secs(5), inbound_rx.recv())
|
|
.await
|
|
.expect("recv timeout")
|
|
.expect("recv inbound");
|
|
let link_b = inbound_b.link;
|
|
|
|
// Install links into plugins
|
|
plugin_a.on_peer_link(network, peer_b, link_a);
|
|
plugin_b.on_peer_link(network, peer_a, link_b);
|
|
|
|
// Carry packet from A to B
|
|
let ip_packet_a = Bytes::from_static(b"4500003c000100004011e0e8c0a80101c0a8010200000000");
|
|
let carried_a = plugin_a.carry(network, peer_b, ip_packet_a.clone());
|
|
assert!(carried_a, "plugin A should carry packet");
|
|
|
|
let (net_received, from_peer, delivered_pkt) =
|
|
tokio::time::timeout(Duration::from_secs(3), sink_b_rx.recv())
|
|
.await
|
|
.expect("timeout waiting for delivery on B")
|
|
.expect("packet on B");
|
|
|
|
assert_eq!(net_received, network);
|
|
assert_eq!(from_peer, peer_a);
|
|
assert_eq!(delivered_pkt, ip_packet_a);
|
|
|
|
// Carry reply packet from B to A
|
|
let ip_packet_b = Bytes::from_static(b"reply-packet-from-b");
|
|
let carried_b = plugin_b.carry(network, peer_a, ip_packet_b.clone());
|
|
assert!(carried_b, "plugin B should carry packet");
|
|
|
|
let (net_received, from_peer, delivered_pkt) =
|
|
tokio::time::timeout(Duration::from_secs(3), sink_a_rx.recv())
|
|
.await
|
|
.expect("timeout waiting for delivery on A")
|
|
.expect("packet on A");
|
|
|
|
assert_eq!(net_received, network);
|
|
assert_eq!(from_peer, peer_b);
|
|
assert_eq!(delivered_pkt, ip_packet_b);
|
|
}
|