checkpoint: integrate authenticated transports
This commit is contained in:
h3cx committed
1 parent
313ab00765
commit
586ff8f223
42 files changed
+6277
-771
No files matched your search
+95
-91
@@ -1,109 +1,113 @@
|
||||
# Development state
|
||||
|
||||
Checkpoint: 2026-09-14, end of day. Development is paused at a compilable
|
||||
checkpoint; no commit was made.
|
||||
End-of-day checkpoint: 2026-09-15. Branch: `main`. Baseline commit:
|
||||
`313ab00` (`checkpoint: implement wgcloak v1 foundations`). Work after that
|
||||
checkpoint remains uncommitted in the shared worktree. Several agents have
|
||||
edited files in parallel; use the inventory below and review the complete diff
|
||||
before committing.
|
||||
|
||||
## Branch and worktree
|
||||
## Implemented behavior
|
||||
|
||||
- Branch: `main`.
|
||||
- `git status --short` reports the project files as untracked, including
|
||||
`Cargo.toml`, `Cargo.lock`, `src/`, `tests/`, documentation, examples, and
|
||||
packaging files. There is no useful committed baseline to compare against in
|
||||
this checkout.
|
||||
- Multiple agents have been working in the shared directory. Review all diffs
|
||||
and ownership boundaries before committing; in particular, do not assume an
|
||||
untracked file was created by this task or that a concurrent edit is final.
|
||||
- The package now has a reusable Rust library (`src/lib.rs`) and a thin binary
|
||||
(`src/main.rs`). Integration tests import `wgcloak` instead of compiling
|
||||
production modules through `#[path]`; module unit tests run once in the
|
||||
library test target.
|
||||
- Client and server runtime paths support authenticated direct UDP, QUIC
|
||||
DATAGRAM, HTTP/3 CONNECT-UDP with HTTP Datagrams, and TLS/TCP length-framed
|
||||
fallback. TLS client connections use normal certificate-chain and hostname
|
||||
verification. For encrypted transports, shared-secret authentication occurs
|
||||
before server backend-session activation.
|
||||
- Client `auto` uses its configured transport order and bounded connection
|
||||
probes, stops on authentication rejection, and reconnects with jittered
|
||||
exponential backoff from 250 ms through 30 s. Successful connections reset
|
||||
the backoff. The client control `reconnect` command forces another attempt.
|
||||
- The server runs enabled listeners concurrently, rejects incompatible UDP
|
||||
listener port conflicts, and aggregates listener/session statistics. Sessions
|
||||
are isolated and use per-session backend UDP sockets. Admission limits cover
|
||||
active sessions, per-IP sessions, pending handshakes, and authentication
|
||||
attempts.
|
||||
- The Unix control socket uses a private runtime directory and mode `0600`,
|
||||
refuses an active socket, and removes only a verified stale socket. `status`,
|
||||
`stats`, and `shutdown` are supported; `reconnect` is client-only. Config and
|
||||
certificate/key reload are not implemented. The CLI/control reload request
|
||||
returns an explicit unsupported response.
|
||||
- The local client UDP listener currently tracks one most-recent application
|
||||
peer; concurrent local source peers can replace the return target.
|
||||
- Direct UDP keepalives are one-way. Silent peer loss may not be detected
|
||||
immediately; a local transport error or explicit client reconnect is the
|
||||
recovery path covered by tests.
|
||||
|
||||
## Implemented and wired behavior
|
||||
## Verification checkpoint
|
||||
|
||||
The current tree contains the following work, subject to integration review:
|
||||
Before the final config and client-ID edits, the full gates passed:
|
||||
|
||||
- Operational assets: MIT `LICENSE`, Linux-focused `README.md`, `.gitignore`,
|
||||
client/server TOML examples, architecture/protocol/security/operations/
|
||||
troubleshooting documents, an implementation checklist, and systemd client
|
||||
and server templates.
|
||||
- TLS/TCP transport primitives in `src/transport/tls_tcp.rs`: bounded
|
||||
incremental/coalesced u16-big-endian framing, truncated/oversized-frame
|
||||
handling, PEM/DER certificate and private-key loading, challenge-response
|
||||
authentication, authenticated data/heartbeat/close framing, idle timeout,
|
||||
and bounded shutdown.
|
||||
- HTTP/3 support primitives in `src/transport/http3.rs`: CONNECT-UDP request
|
||||
validation, QUIC varints, RFC 9297 HTTP Datagram context encoding, capsule
|
||||
encoding, and project authentication messages. The module does not fake
|
||||
CONNECT-UDP with POST or ordinary streams.
|
||||
- Runtime orchestration in `src/transport/mod.rs`, `src/client/mod.rs`, and
|
||||
`src/server/mod.rs` instantiates direct UDP, QUIC, and TLS/TCP connectors or
|
||||
listeners. TLS backend creation occurs after the authenticated session is
|
||||
established. HTTP/3 currently returns an explicit `Unsupported` result from
|
||||
runtime selection because the actual h3 datagram adapter is not complete.
|
||||
- The client and server start the Unix control server. Client reconnect and
|
||||
reload commands currently cause a reconnect attempt; server shutdown is
|
||||
handled by the encrypted listener paths, while direct-UDP/control lifecycle
|
||||
still needs review.
|
||||
- `h3-quinn` was enabled with its `datagram` feature; `tokio-rustls` and
|
||||
`rustls-native-certs` were added for TLS runtime integration.
|
||||
- `cargo fmt --all -- --check`
|
||||
- `cargo check --all-targets`
|
||||
- `cargo clippy --all-targets -- -D warnings`
|
||||
- `cargo test --all-targets --quiet` — 76 tests passed.
|
||||
|
||||
## Files changed in this work
|
||||
After those edits, the config-focused suite passed 12/12, the client-ID focused
|
||||
transport tests passed, and the current `cargo check` passes. Rerun the full
|
||||
gates after these edits before treating the tree as audited. The broader
|
||||
encrypted daemon-runtime end-to-end proof described below is not yet created or
|
||||
complete; focused transport and HTTP/3 runtime tests do not replace it.
|
||||
|
||||
Primary files touched by the operations/integration work are:
|
||||
## Remaining work, prioritized
|
||||
|
||||
- `Cargo.toml`, `Cargo.lock`
|
||||
- `src/transport/mod.rs`
|
||||
- `src/transport/tls_tcp.rs`
|
||||
- `src/transport/http3.rs`
|
||||
- `src/client/mod.rs`
|
||||
- `src/server/mod.rs`
|
||||
- `tests/tls_tcp.rs`, `tests/http3.rs`, `tests/integration_transports.rs`
|
||||
- `.gitignore`, `LICENSE`, `README.md`
|
||||
- `examples/*`, `packaging/systemd/*`, and the other files under `docs/`
|
||||
1. Add and complete encrypted daemon-runtime end-to-end proof: local UDP
|
||||
application traffic through client runtime, encrypted transport, server
|
||||
runtime, and UDP echo backend, including auth rejection, session isolation,
|
||||
status/stats, and bounded shutdown. Exercise each encrypted mode where
|
||||
practical; do not mistake lower-level transport tests for daemon proof.
|
||||
2. Rerun formatting, all-target check, strict all-target Clippy, and the full
|
||||
suite after the final config/client-ID edits; then review the complete diff
|
||||
and reconcile acceptance evidence with `docs/IMPLEMENTATION_CHECKLIST.md`.
|
||||
3. Add fuzz and benchmark targets for parsers, framing, protocol/auth paths,
|
||||
and transport overhead; record the environment and baseline.
|
||||
4. Decide and document a practical maximum datagram-size cap, with config and
|
||||
boundary tests tied to transport overhead and MTU constraints.
|
||||
5. Confirm whether configuration and certificate/key reload are required by
|
||||
the spec/product scope. Until implemented and tested, they remain explicitly
|
||||
unsupported; do not imply hot reload in CLI or deployment docs.
|
||||
|
||||
`src/transport/quic.rs` was edited by another concurrent agent and is outside
|
||||
the TLS/integration ownership listed above. Preserve that ownership boundary
|
||||
when resolving conflicts.
|
||||
## First recovery tasks
|
||||
|
||||
## Verification and current failures
|
||||
1. Inspect current client/server orchestration and transport test APIs, then
|
||||
create the encrypted daemon-runtime echo test without duplicating transport
|
||||
internals.
|
||||
2. Re-run the four full gates above against the current tree; resolve any
|
||||
compile, lint, or test regressions before adding further features.
|
||||
3. Review spec milestones and the 17 completion criteria, and record evidence
|
||||
for each criterion in the coordinator checklist. Keep fuzzing, benchmarks,
|
||||
datagram-cap decision, and reload scope visible as open items.
|
||||
|
||||
- TOML examples were parsed successfully with Python `tomllib`.
|
||||
- TLS/TCP focused tests passed: `cargo test --test tls_tcp --quiet` (7 tests).
|
||||
- HTTP/3 focused tests passed: `cargo test --test http3 --quiet` (4 tests).
|
||||
- `cargo check` passed after the transport integration edits.
|
||||
- The TLS loopback integration test compiles but currently panics while
|
||||
constructing a rustls configuration because no process-level crypto provider
|
||||
is installed:
|
||||
## Current worktree inventory
|
||||
|
||||
`Could not automatically determine process-level CryptoProvider from Rustls crate features.`
|
||||
Captured with `git status --short` for this checkpoint. These are shared-tree
|
||||
changes; ownership is not implied by this list.
|
||||
|
||||
The runtime/test setup must explicitly install the `ring` provider (or enable
|
||||
exactly one provider feature) before building rustls configurations.
|
||||
- The supervisor's latest failure reprobe reports that the QUIC focused tests
|
||||
now pass. Run the complete suite again after fixing the rustls provider; the
|
||||
earlier complete-suite run had QUIC handshake-timeout failures before the
|
||||
concurrent QUIC-agent fixes landed.
|
||||
- Clippy has not reached a clean result. Existing included test/source modules
|
||||
produce many dead-code and lint diagnostics, and integration code also needs
|
||||
a final lint pass after the provider fix.
|
||||
Modified files:
|
||||
|
||||
## Remaining gaps, prioritized
|
||||
- `Cargo.lock`, `Cargo.toml`
|
||||
- `README.md`
|
||||
- `docs/ARCHITECTURE.md`, `docs/DEVELOPMENT_STATE.md`,
|
||||
`docs/IMPLEMENTATION_CHECKLIST.md`, `docs/OPERATIONS.md`, `docs/PROTOCOL.md`,
|
||||
`docs/TROUBLESHOOTING.md`
|
||||
- `examples/client.advanced.toml`, `examples/server.advanced.toml`,
|
||||
`examples/server.minimal.toml`
|
||||
- `packaging/systemd/wgcloak-client.service`,
|
||||
`packaging/systemd/wgcloak-server.service`
|
||||
- `src/cli.rs`, `src/client/mod.rs`, `src/client/supervisor.rs`, `src/config.rs`,
|
||||
`src/control.rs`, `src/main.rs`, `src/protocol/auth.rs`,
|
||||
`src/protocol/direct.rs`, `src/server/mod.rs`, `src/stats.rs`,
|
||||
`src/transport/direct_udp.rs`, `src/transport/http3.rs`,
|
||||
`src/transport/mod.rs`, `src/transport/quic.rs`
|
||||
- `tests/control.rs`, `tests/direct_udp.rs`, `tests/http3.rs`,
|
||||
`tests/integration_transports.rs`, `tests/quic.rs`, `tests/supervisor.rs`,
|
||||
`tests/tls_tcp.rs`
|
||||
|
||||
1. Fix and verify explicit rustls crypto-provider initialization, then run the
|
||||
TLS loopback test and the complete test suite.
|
||||
2. Finish a real h3 0.0.8/h3-quinn 0.0.10 HTTP/3 CONNECT-UDP datagram adapter,
|
||||
or retain the explicit `Unsupported` path with a precise documented
|
||||
dependency/API blocker. Do not substitute POST, capsules-only streams, or
|
||||
ordinary HTTP request bodies for HTTP Datagrams.
|
||||
3. Review runtime lifecycle semantics: direct-UDP control shutdown wiring,
|
||||
actual file-backed config reload, client TLS heartbeat scheduling, and
|
||||
authentication-error mapping so auto fallback stops on rejected credentials.
|
||||
4. Run repository-wide formatting, tests, and clippy; inspect the shared
|
||||
untracked tree and reconcile concurrent `quic.rs` changes before any commit.
|
||||
|
||||
## First three tasks tomorrow
|
||||
|
||||
1. Install/select the rustls `ring` provider once at runtime and in the
|
||||
integration test setup; rerun TLS loopback plus `cargo test`.
|
||||
2. Inspect the enabled h3-quinn datagram API and implement/test the smallest
|
||||
standards-correct CONNECT-UDP client/server adapter; otherwise record the
|
||||
exact unsupported API/dependency condition in the public docs.
|
||||
3. Perform an end-to-end lifecycle review and repository-wide `fmt`, check,
|
||||
test, and clippy pass, resolving only changes within each agent's ownership.
|
||||
Untracked files:
|
||||
|
||||
- `src/lib.rs`, `src/server/limits.rs`
|
||||
- `tests/http3_integration.rs`, `tests/http3_runtime.rs`, `tests/limits.rs`,
|
||||
`tests/reconnect.rs`, `tests/runtime_lifecycle.rs`
|
||||
Reference in new issue
Block a user