mirror of
https://github.com/cloudflare/cloudflared.git
synced 2026-06-23 04:10:20 +00:00
lneto
f674b82e2a
Introduce a new crypto/ package as the single source of truth for TLS curve preferences used on every edge-facing connection, and adopt X25519MLKEM768 as the primary post-quantum key exchange for both QUIC and HTTP/2: PQ Prefer (default): X25519MLKEM768, P256Kyber768Draft00, CurveP256 PQ Strict (--post-quantum): X25519MLKEM768, P256Kyber768Draft00 The curve list is identical under FIPS and non-FIPS builds, so crypto.GetCurvePreferences takes only a features.PostQuantumMode and returns a fresh slice on every call. HTTP/2 now applies these curve preferences the same way QUIC does. The previous PostQuantumStrict rejection in serveHTTP2 and the forced QUIC-only selection in NewProtocolSelector are removed since both transports support the same post-quantum curves; the needPQ parameter is dropped from NewProtocolSelector accordingly. Also fix a shared tls.Config race: both the QUIC and HTTP/2 paths now Clone() the per-protocol entry from TunnelConfig.EdgeTLSConfigs before mutating CurvePreferences instead of writing through the shared map entry. Legacy Kyber draft curve X25519Kyber768Draft00 and the unused removeDuplicates helper are removed along with the old supervisor/pqtunnels.go / _test.go files. AGENTS.md is updated with guidance on the new crypto/ package, the cfdcrypto import alias, the tls.Config cloning rule, and the lint workflow implications of .golangci.yaml's whole-files: true setting.
79 lines
2.2 KiB
Go
79 lines
2.2 KiB
Go
package client
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/rs/zerolog"
|
|
|
|
"github.com/cloudflare/cloudflared/features"
|
|
"github.com/cloudflare/cloudflared/tunnelrpc/pogs"
|
|
)
|
|
|
|
// Config captures the local client runtime configuration.
|
|
type Config struct {
|
|
ConnectorID uuid.UUID
|
|
Version string
|
|
Arch string
|
|
|
|
featureSelector features.FeatureSelector
|
|
}
|
|
|
|
func NewConfig(version string, arch string, featureSelector features.FeatureSelector) (*Config, error) {
|
|
connectorID, err := uuid.NewRandom()
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unable to generate a connector UUID: %w", err)
|
|
}
|
|
return &Config{
|
|
ConnectorID: connectorID,
|
|
Version: version,
|
|
Arch: arch,
|
|
featureSelector: featureSelector,
|
|
}, nil
|
|
}
|
|
|
|
// ConnectionOptionsSnapshot is a snapshot of the current client information used to initialize a connection.
|
|
//
|
|
// The FeatureSnapshot is the features that are available for this connection. At the client level they may
|
|
// change, but they will not change within the scope of this struct.
|
|
type ConnectionOptionsSnapshot struct {
|
|
client pogs.ClientInfo
|
|
originLocalIP net.IP
|
|
numPreviousAttempts uint8
|
|
FeatureSnapshot features.FeatureSnapshot
|
|
}
|
|
|
|
func (c *Config) ConnectionOptionsSnapshot(originIP net.IP, previousAttempts uint8) *ConnectionOptionsSnapshot {
|
|
snapshot := c.featureSelector.Snapshot()
|
|
return &ConnectionOptionsSnapshot{
|
|
client: pogs.ClientInfo{
|
|
ClientID: c.ConnectorID[:],
|
|
Version: c.Version,
|
|
Arch: c.Arch,
|
|
Features: snapshot.FeaturesList,
|
|
},
|
|
originLocalIP: originIP,
|
|
numPreviousAttempts: previousAttempts,
|
|
FeatureSnapshot: snapshot,
|
|
}
|
|
}
|
|
|
|
func (c ConnectionOptionsSnapshot) ConnectionOptions() *pogs.ConnectionOptions {
|
|
return &pogs.ConnectionOptions{
|
|
Client: c.client,
|
|
OriginLocalIP: c.originLocalIP,
|
|
ReplaceExisting: false,
|
|
CompressionQuality: 0,
|
|
NumPreviousAttempts: c.numPreviousAttempts,
|
|
}
|
|
}
|
|
|
|
func (c ConnectionOptionsSnapshot) LogFields(event *zerolog.Event) *zerolog.Event {
|
|
return event.Strs("features", c.client.Features)
|
|
}
|
|
|
|
func (c *Config) ConnectionFeaturesSnapshot() features.FeatureSnapshot {
|
|
return c.featureSelector.Snapshot()
|
|
}
|