рабочий вариант, но скороть 10 МБит

2026-05-22 21:46:49 +03:00
parent 469fa0e860
commit 20d361a886
280 changed files with 954890 additions and 18524 deletions
@@ -234,6 +234,7 @@ func TestFabricSessionPacketTransportSendsDataFrame(t *testing.T) {
 }

 func TestFabricSessionPacketTransportShardsStreamsByTrafficClass(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel is opaque and no longer classifies TCP control packets")
 	sender := &captureFabricSessionSender{}
 	transport := &FabricSessionPacketTransport{
 		Sender:          sender,
@@ -284,7 +285,245 @@ func TestFabricSessionPacketTransportShardsStreamsByTrafficClass(t *testing.T) {
 	}
 }

+func TestFabricSessionPacketTransportUsesTunnelIDAsServiceIdentity(t *testing.T) {
+	sender := &captureFabricSessionSender{}
+	transport := &FabricSessionPacketTransport{
+		Sender:          sender,
+		StreamID:        700,
+		TunnelID:        "fabric-tunnel-1",
+		VPNConnectionID: "legacy-vpn-1",
+		SendDirection:   FabricDirectionClientToGateway,
+		ServiceTunnel: FabricServiceTunnel{
+			TunnelID:     "fabric-tunnel-1",
+			PoolID:       "ipv4-egress",
+			ServiceID:    "svc-vpn-1",
+			ServiceKind:  "ipv4-tunnel",
+			ServiceClass: "vpn_packets",
+		},
+	}
+
+	if err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{[]byte("packet")}); err != nil {
+		t.Fatalf("send packet: %v", err)
+	}
+	if len(sender.frames) != 1 {
+		t.Fatalf("sent frames = %d, want 1", len(sender.frames))
+	}
+	payload, err := DecodeFabricVPNPacketDataFrame(sender.frames[0])
+	if err != nil {
+		t.Fatalf("decode payload: %v", err)
+	}
+	if payload.VPNConnectionID != "fabric-tunnel-1" {
+		t.Fatalf("payload tunnel identity = %q, want fabric-tunnel-1", payload.VPNConnectionID)
+	}
+	if payload.TunnelID != "fabric-tunnel-1" || payload.PoolID != "" || payload.ServiceID != "" {
+		t.Fatalf("hot data frame should carry only tunnel identity, got %+v", payload)
+	}
+	snapshot := transport.Snapshot()
+	if snapshot["tunnel_id"] != "fabric-tunnel-1" || snapshot["vpn_connection_id_alias"] != "legacy-vpn-1" {
+		t.Fatalf("snapshot should expose tunnel id and legacy alias: %+v", snapshot)
+	}
+	serviceTunnel, ok := snapshot["service_tunnel"].(map[string]any)
+	if !ok || serviceTunnel["transport_owner"] != DefaultFabricTransportOwner || serviceTunnel["route_visibility"] != DefaultFabricRouteVisibility {
+		t.Fatalf("service tunnel snapshot missing fabric ownership: %+v", snapshot["service_tunnel"])
+	}
+}
+
+func TestFabricSessionPacketTransportUsesOpaqueBulkChannelForPacketContents(t *testing.T) {
+	sender := &captureFabricSessionSender{}
+	transport := &FabricSessionPacketTransport{
+		Sender:          sender,
+		TunnelID:        "fabric-tunnel-1",
+		VPNConnectionID: "legacy-vpn-1",
+		SendDirection:   FabricDirectionClientToGateway,
+		StreamIDsByTrafficClass: map[string][]uint64{
+			FabricTrafficClassReliable:    []uint64{701},
+			FabricTrafficClassInteractive: []uint64{801},
+			FabricTrafficClassBulk:        []uint64{901},
+		},
+	}
+	dns := testDNSIPv4PacketForFabricRuntime()
+	tcpControl := testIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51001, 3389)
+	tcpControl[33] = 0x02
+
+	if err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{dns, tcpControl}); err != nil {
+		t.Fatalf("send opaque packets: %v", err)
+	}
+	if len(sender.frames) != 1 {
+		t.Fatalf("frames = %d, want one opaque bulk frame", len(sender.frames))
+	}
+	if sender.frames[0].TrafficClass != fabricproto.TrafficClassBulk || sender.frames[0].StreamID != 901 {
+		t.Fatalf("opaque packets should use bulk stream without protocol analysis: %+v", sender.frames[0])
+	}
+	payload, err := DecodeFabricVPNPacketDataFrame(sender.frames[0])
+	if err != nil {
+		t.Fatalf("decode opaque frame: %v", err)
+	}
+	if len(payload.Packets) != 2 {
+		t.Fatalf("opaque frame packets = %d, want 2", len(payload.Packets))
+	}
+}
+
+func TestFabricSessionPacketPeerRegistryKeepsServiceTunnelFromHello(t *testing.T) {
+	registry := NewFabricSessionPacketPeerRegistry()
+	sender := &recordingFrameSender{}
+	frame, err := NewFabricVPNSessionHelloFrame(FabricVPNPacketFrameInput{
+		StreamID:        711,
+		VPNConnectionID: "fabric-tunnel-1",
+		Direction:       FabricDirectionClientToGateway,
+		TrafficClass:    FabricTrafficClassInteractive,
+		ServiceTunnel: FabricServiceTunnel{
+			TunnelID:        "fabric-tunnel-1",
+			PoolID:          "home-ipv4",
+			ServiceID:       "svc-vpn-1",
+			ServiceKind:     "ipv4-tunnel",
+			ServiceClass:    "vpn_packets",
+			ServiceRole:     "ipv4-egress",
+			RouteLeaseID:    "lease-1",
+			RouteGeneration: "route-gen-1",
+		},
+	})
+	if err != nil {
+		t.Fatalf("hello frame: %v", err)
+	}
+	handled, err := registry.RegisterFrame(context.Background(), sender, frame)
+	if err != nil || !handled {
+		t.Fatalf("register hello handled=%v err=%v", handled, err)
+	}
+	snapshot := registry.Snapshot()
+	peers := snapshot["peers"].([]map[string]any)
+	if len(peers) != 1 {
+		t.Fatalf("peers = %+v", peers)
+	}
+	serviceTunnel := peers[0]["service_tunnel"].(map[string]any)
+	if serviceTunnel["pool_id"] != "home-ipv4" ||
+		serviceTunnel["service_id"] != "svc-vpn-1" ||
+		serviceTunnel["route_visibility"] != DefaultFabricRouteVisibility ||
+		serviceTunnel["route_lease_id"] != "lease-1" ||
+		serviceTunnel["route_generation"] != "route-gen-1" {
+		t.Fatalf("peer service tunnel not preserved: %+v", serviceTunnel)
+	}
+}
+
+func TestFabricSessionPacketTransportRegistersServiceStreams(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel is opaque and no longer derives service stream class from packet contents")
+	sender := &captureFabricSessionSender{}
+	registry := NewFabricServiceStreamRegistry()
+	transport := &FabricSessionPacketTransport{
+		Sender:          sender,
+		TunnelID:        "fabric-tunnel-1",
+		VPNConnectionID: "legacy-vpn-1",
+		ServiceID:       "svc-vpn-1",
+		SendDirection:   FabricDirectionClientToGateway,
+		ServiceStreams:  registry,
+		StreamIDsByTrafficClass: map[string][]uint64{
+			FabricTrafficClassInteractive: []uint64{801},
+			FabricTrafficClassBulk:        []uint64{901},
+		},
+		ServiceTunnel: FabricServiceTunnel{
+			TunnelID:     "fabric-tunnel-1",
+			PoolID:       "ipv4-egress",
+			ServiceID:    "svc-vpn-1",
+			ServiceKind:  "ipv4-tunnel",
+			ServiceClass: "vpn_packets",
+		},
+	}
+	packet := testIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51001, 3389)
+	packet[33] = 0x02
+
+	if err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{packet}); err != nil {
+		t.Fatalf("send packet: %v", err)
+	}
+	streams := registry.StreamsForTunnel("fabric-tunnel-1")
+	if len(streams) != 1 {
+		t.Fatalf("registered streams = %+v, want one", streams)
+	}
+	if streams[0].StreamID != 801 ||
+		streams[0].TrafficClass != FabricTrafficClassInteractive ||
+		streams[0].ServiceID != "svc-vpn-1" ||
+		streams[0].State != FabricServiceStreamStateOpen {
+		t.Fatalf("unexpected service stream: %+v", streams[0])
+	}
+	snapshot := transport.Snapshot()
+	serviceStreams, ok := snapshot["service_streams"].([]map[string]any)
+	if !ok || len(serviceStreams) != 1 || serviceStreams[0]["stream_id"] != uint64(801) {
+		t.Fatalf("transport snapshot missing service streams: %+v", snapshot["service_streams"])
+	}
+
+	if err := transport.Close(); err != nil {
+		t.Fatalf("close transport: %v", err)
+	}
+	streams = registry.StreamsForTunnel("fabric-tunnel-1")
+	if len(streams) != 1 || streams[0].State != FabricServiceStreamStateClosed {
+		t.Fatalf("service stream not closed with transport: %+v", streams)
+	}
+}
+
+func TestFabricSessionPacketTransportUpdatesRouteLeaseWithoutChangingTunnel(t *testing.T) {
+	transport := &FabricSessionPacketTransport{
+		TunnelID: "fabric-tunnel-1",
+		ServiceTunnel: FabricServiceTunnel{
+			TunnelID:        "fabric-tunnel-1",
+			PoolID:          "home-ipv4",
+			ServiceID:       "svc-vpn-1",
+			RouteLeaseID:    "lease-1",
+			RouteGeneration: "route-gen-1",
+		},
+	}
+	changed, err := transport.UpdateServiceTunnel(FabricServiceTunnel{
+		TunnelID:        "fabric-tunnel-1",
+		PoolID:          "home-ipv4",
+		ServiceID:       "svc-vpn-1",
+		RouteLeaseID:    "lease-2",
+		RouteGeneration: "route-gen-2",
+	})
+	if err != nil || !changed {
+		t.Fatalf("update service tunnel changed=%v err=%v", changed, err)
+	}
+	snapshot := transport.Snapshot()
+	if snapshot["tunnel_id"] != "fabric-tunnel-1" ||
+		snapshot["route_lease_id"] != "lease-2" ||
+		snapshot["route_generation"] != "route-gen-2" ||
+		snapshot["route_transition_count"] != uint64(1) {
+		t.Fatalf("route lease update not reflected without tunnel change: %+v", snapshot)
+	}
+	if _, err := transport.UpdateServiceTunnel(FabricServiceTunnel{TunnelID: "other-tunnel"}); err == nil {
+		t.Fatal("expected changing tunnel id to be rejected")
+	}
+}
+
+func TestFabricSessionPacketTransportRoutesDNSOnReliableClass(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel is opaque and no longer detects DNS packets")
+	sender := &captureFabricSessionSender{}
+	registry := NewFabricServiceStreamRegistry()
+	transport := &FabricSessionPacketTransport{
+		Sender:          sender,
+		TunnelID:        "fabric-tunnel-1",
+		VPNConnectionID: "legacy-vpn-1",
+		SendDirection:   FabricDirectionClientToGateway,
+		ServiceStreams:  registry,
+		StreamIDsByTrafficClass: map[string][]uint64{
+			FabricTrafficClassReliable: []uint64{701},
+			FabricTrafficClassBulk:     []uint64{901},
+		},
+	}
+
+	if err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{testDNSIPv4PacketForFabricRuntime()}); err != nil {
+		t.Fatalf("send dns packet: %v", err)
+	}
+	if len(sender.frames) != 1 {
+		t.Fatalf("frames = %d, want 1", len(sender.frames))
+	}
+	if sender.frames[0].StreamID != 701 || sender.frames[0].TrafficClass != fabricproto.TrafficClassReliable {
+		t.Fatalf("dns packet should use reliable stream: %+v", sender.frames[0])
+	}
+	streams := registry.StreamsForTunnel("fabric-tunnel-1")
+	if len(streams) != 1 || streams[0].TrafficClass != FabricTrafficClassDNS {
+		t.Fatalf("dns service stream not tracked separately: %+v", streams)
+	}
+}
+
 func TestFabricSessionPacketTransportSplitsMixedBatchByStream(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel is opaque and no longer splits batches by packet protocol")
 	sender := &captureFabricSessionSender{}
 	transport := &FabricSessionPacketTransport{
 		Sender:          sender,
@@ -470,15 +709,91 @@ func TestFabricSessionPacketPeerTransportSendsReplyToLatestRegisteredPeer(t *tes
 	}
 }

+func TestFabricSessionPacketPeerTransportForgetsClosedPeerAndRebinds(t *testing.T) {
+	inbox := NewFabricPacketInbox(4)
+	registry := NewFabricSessionPacketPeerRegistry()
+	firstSender := &recordingFrameSender{err: errors.New("closed")}
+	registerFabricSessionPeerForTest(t, registry, firstSender, "vpn-1", 7)
+	transport := &FabricSessionPacketPeerTransport{
+		Registry:        registry,
+		Inbox:           inbox,
+		VPNConnectionID: "vpn-1",
+		PeerWaitTimeout: 250 * time.Millisecond,
+	}
+	if err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{[]byte("reply-1")}); err == nil {
+		t.Fatal("send through closed peer succeeded")
+	}
+	if ready := registry.TransportFor("vpn-1", inbox); ready != nil {
+		t.Fatal("closed peer remained registered")
+	}
+	secondSender := &recordingFrameSender{}
+	go func() {
+		time.Sleep(25 * time.Millisecond)
+		registerFabricSessionPeerForTest(t, registry, secondSender, "vpn-1", 11)
+	}()
+	if err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{[]byte("reply-2")}); err != nil {
+		t.Fatalf("send after peer rebind: %v", err)
+	}
+	if len(secondSender.frames) != 1 {
+		t.Fatalf("second sender frames = %d, want 1", len(secondSender.frames))
+	}
+	payload, err := DecodeFabricVPNPacketDataFrame(secondSender.frames[0])
+	if err != nil {
+		t.Fatalf("decode rebound reply: %v", err)
+	}
+	if string(payload.Packets[0]) != "reply-2" {
+		t.Fatalf("rebound payload = %+v", payload)
+	}
+}
+
+func TestFabricSessionPacketPeerTransportFailsFastWithoutPeer(t *testing.T) {
+	inbox := NewFabricPacketInbox(4)
+	registry := NewFabricSessionPacketPeerRegistry()
+	transport := &FabricSessionPacketPeerTransport{
+		Registry:        registry,
+		Inbox:           inbox,
+		VPNConnectionID: "vpn-1",
+		PeerWaitTimeout: 20 * time.Millisecond,
+	}
+	startedAt := time.Now()
+	err := transport.SendGatewayPacketBatch(context.Background(), [][]byte{[]byte("reply")})
+	if err == nil {
+		t.Fatal("send without peer succeeded")
+	}
+	if elapsed := time.Since(startedAt); elapsed > 250*time.Millisecond {
+		t.Fatalf("send without peer took %s, want fast failure", elapsed)
+	}
+}
+
 type recordingFrameSender struct {
+	err    error
 	frames []fabricproto.Frame
 }

 func (s *recordingFrameSender) SendFrame(_ context.Context, frame fabricproto.Frame) error {
+	if s.err != nil {
+		return s.err
+	}
 	s.frames = append(s.frames, frame)
 	return nil
 }

+func registerFabricSessionPeerForTest(t *testing.T, registry *FabricSessionPacketPeerRegistry, sender FabricSessionFrameWriter, vpnConnectionID string, streamID uint64) {
+	t.Helper()
+	frame, err := NewFabricVPNSessionHelloFrame(FabricVPNPacketFrameInput{
+		StreamID:        streamID,
+		VPNConnectionID: vpnConnectionID,
+		Direction:       FabricDirectionClientToGateway,
+	})
+	if err != nil {
+		t.Fatalf("hello frame: %v", err)
+	}
+	handled, err := registry.RegisterFrame(context.Background(), sender, frame)
+	if err != nil || !handled {
+		t.Fatalf("register peer handled=%v err=%v", handled, err)
+	}
+}
+
 func TestFabricSessionPacketTransportReceiveReadsPumpFrames(t *testing.T) {
 	inbox := NewFabricPacketInbox(4)
 	receiver := memoryFabricSessionReceiver{
@@ -684,7 +999,7 @@ func TestFabricPacketInboxReceivesFabricSessionFrame(t *testing.T) {
 	}
 }

-func TestFabricVPNPacketDataFrameInfersInteractiveTCPControl(t *testing.T) {
+func TestFabricVPNPacketDataFrameKeepsExplicitBulkForTCPControlContents(t *testing.T) {
 	packet := testIPv4TCPPacket([4]byte{192, 168, 200, 95}, [4]byte{10, 77, 0, 2}, 3389, 57032)
 	packet[33] = 0x12
 	frame, err := NewFabricVPNPacketDataFrame(FabricVPNPacketFrameInput{
@@ -698,12 +1013,13 @@ func TestFabricVPNPacketDataFrameInfersInteractiveTCPControl(t *testing.T) {
 	if err != nil {
 		t.Fatalf("new fabric vpn frame: %v", err)
 	}
-	if frame.TrafficClass != fabricproto.TrafficClassInteractive {
-		t.Fatalf("traffic class = %v, want interactive", frame.TrafficClass)
+	if frame.TrafficClass != fabricproto.TrafficClassBulk {
+		t.Fatalf("traffic class = %v, want opaque bulk", frame.TrafficClass)
 	}
 }

 func TestFabricPacketInboxPrioritizesGatewayTCPControlPackets(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel preserves arrival order and no longer prioritizes TCP control packets")
 	inbox := NewFabricPacketInbox(4)
 	normal := testIPv4TCPPacket([4]byte{185, 16, 148, 89}, [4]byte{10, 77, 0, 2}, 443, 56000)
 	priority := testIPv4TCPPacket([4]byte{192, 168, 200, 95}, [4]byte{10, 77, 0, 2}, 3389, 57032)
@@ -726,6 +1042,7 @@ func TestFabricPacketInboxPrioritizesGatewayTCPControlPackets(t *testing.T) {
 }

 func TestFabricPacketInboxWaitsBrieflyForGatewayTCPControlPackets(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel preserves arrival order and no longer waits for TCP control packets")
 	inbox := NewFabricPacketInbox(4)
 	normal := testIPv4TCPPacket([4]byte{185, 16, 148, 89}, [4]byte{10, 77, 0, 2}, 443, 56000)
 	priority := testIPv4TCPPacket([4]byte{192, 168, 200, 95}, [4]byte{10, 77, 0, 2}, 3389, 57032)
@@ -774,6 +1091,7 @@ func TestLocalPacketTransportUsesFabricInboxDirections(t *testing.T) {
 }

 func TestFabricFlowSchedulerKeepsReverseFiveTupleTogether(t *testing.T) {
+	t.Skip("retired: base VPN fabric channel uses opaque packet sharding instead of inspecting 5-tuples")
 	scheduler := NewFabricFlowScheduler(8, 8)
 	forward := testIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51000, 3389)
 	reverse := testIPv4TCPPacket([4]byte{192, 168, 200, 95}, [4]byte{10, 77, 0, 2}, 3389, 51000)
@@ -826,6 +1144,18 @@ func TestFabricFlowSchedulerPrioritizesExplicitTrafficClass(t *testing.T) {
 	}
 }

+func TestFabricFlowSchedulerUsesOpaquePacketHashClassifier(t *testing.T) {
+	scheduler := NewFabricFlowScheduler(8, 0)
+	packet := testIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51000, 3389)
+	batches := scheduler.ScheduleClientPacketsForConnection("vpn-1", [][]byte{packet})
+	if len(batches) != 1 {
+		t.Fatalf("batches = %d, want 1", len(batches))
+	}
+	if batches[0].Classifier != "opaque_packet_hash" || !strings.HasPrefix(batches[0].FlowID, "opaque:") {
+		t.Fatalf("scheduler should not expose protocol-derived flow keys: %+v", batches[0])
+	}
+}
+
 func TestFabricFlowSchedulerDropsWhenChannelQueueIsFull(t *testing.T) {
 	scheduler := NewFabricFlowScheduler(1, 1)
 	packetA := testIPv4TCPPacket([4]byte{10, 77, 0, 2}, [4]byte{192, 168, 200, 95}, 51000, 3389)
@@ -1032,7 +1362,7 @@ func TestFabricClientPacketIngressUsesLeasePreferredRouteBeforeConfigOrder(t *te
 	}
 }

-func TestFabricClientPacketIngressTriesAlternateRouteBeforeBackendFallback(t *testing.T) {
+func TestFabricClientPacketIngressTriesAlternateRouteBeforeCompatFallback(t *testing.T) {
 	transport := &failoverProductionTransport{failNextHop: "relay-bad"}
 	ingress := &FabricClientPacketIngress{
 		ForwardTransport: transport,
@@ -2617,10 +2947,10 @@ func TestFabricClientPacketIngressBoundedLoadReportsPerChannelDrops(t *testing.T
 func TestFabricClientPacketIngressUsesLocalGatewayShortcutWithoutRoute(t *testing.T) {
 	inbox := NewFabricPacketInbox(4)
 	ingress := &FabricClientPacketIngress{
-		Inbox:                           inbox,
-		ClusterID:                       "cluster-1",
-		LocalNodeID:                     "entry-1",
-		AllowLegacyLocalGatewayFallback: true,
+		Inbox:                   inbox,
+		ClusterID:               "cluster-1",
+		LocalNodeID:             "entry-1",
+		AllowLocalGatewayBypass: true,
 		LocalGateway: func(vpnConnectionID string) bool {
 			return vpnConnectionID == "vpn-1"
 		},
@@ -2642,10 +2972,10 @@ func TestFabricClientPacketIngressUsesLocalGatewayShortcutWithoutRoute(t *testin
 func TestFabricClientPacketIngressReceivesLocalGatewayReplyWithoutRoute(t *testing.T) {
 	inbox := NewFabricPacketInbox(4)
 	ingress := &FabricClientPacketIngress{
-		Inbox:                           inbox,
-		ClusterID:                       "cluster-1",
-		LocalNodeID:                     "entry-1",
-		AllowLegacyLocalGatewayFallback: true,
+		Inbox:                   inbox,
+		ClusterID:               "cluster-1",
+		LocalNodeID:             "entry-1",
+		AllowLocalGatewayBypass: true,
 		LocalGateway: func(vpnConnectionID string) bool {
 			return vpnConnectionID == "vpn-1"
 		},
@@ -2705,6 +3035,24 @@ func packetSourcePort(packet []byte) uint16 {
 	return uint16(packet[20])<<8 | uint16(packet[21])
 }

+func testDNSIPv4PacketForFabricRuntime() []byte {
+	packet := make([]byte, 28)
+	packet[0] = 0x45
+	packet[2] = 0
+	packet[3] = byte(len(packet))
+	packet[8] = 64
+	packet[9] = 17
+	copy(packet[12:16], []byte{10, 77, 0, 2})
+	copy(packet[16:20], []byte{1, 1, 1, 1})
+	packet[20] = 0xc0
+	packet[21] = 0x00
+	packet[22] = 0x00
+	packet[23] = 0x35
+	packet[24] = 0
+	packet[25] = 8
+	return packet
+}
+
 func testFlowChannelID(vpnConnectionID string, packet []byte, shardCount int) string {
 	return fabricFlowChannelID(vpnConnectionID, packetShard(packet, shardCount))
 }