feat: aether-proxy TLS 双栈支持与自签名证书自动生成

- aether-proxy 新增 TLS 模块：自签名证书生成、TLS acceptor 构建、证书 SHA-256 指纹计算
- 代理服务器支持 HTTP+TLS 双栈模式，通过 peek 首字节区分 TLS ClientHello 与普通 HTTP
- 注册与心跳上报 tls_enabled 和 tls_cert_fingerprint 字段
- Python 侧 httpx 代理适配：TLS 代理使用 httpx.Proxy + CERT_NONE ssl_context
- ProxyNode 模型新增 tls_enabled/tls_cert_fingerprint 字段及对应迁移

aether-proxy/src/proxy/mod.rs

@@ -2,3 +2,4 @@ pub mod connect;
 pub mod plain;
 pub mod server;
 pub mod target_filter;
+pub mod tls;

aether-proxy/src/proxy/server.rs

@@ -6,13 +6,15 @@ use hyper::body::Incoming;
 use hyper::server::conn::http1;
 use hyper::service::service_fn;
 use hyper::{Method, Request};
+use hyper::rt::{Read, Write};
 use hyper_util::rt::TokioIo;
 use tokio::net::TcpListener;
 use tokio::sync::watch;
+use tokio_rustls::TlsAcceptor;
 use tracing::{debug, info, warn};
 
 use crate::config::Config;
-use crate::proxy::{connect, plain};
+use crate::proxy::{connect, plain, tls};
 use crate::runtime::SharedDynamicConfig;
 
 /// Start the proxy server.
@@ -20,15 +22,25 @@ use crate::runtime::SharedDynamicConfig;
 /// Listens for incoming TCP connections and dispatches:
 /// - CONNECT requests -> tunnel handler
 /// - Other HTTP requests -> plain forward proxy handler
+///
+/// When `tls_acceptor` is provided, the server operates in dual-stack mode:
+/// it peeks at the first byte of each connection to distinguish TLS ClientHello
+/// (0x16) from plain HTTP, and handles both on the same port.
 pub async fn run(
     config: Arc<Config>,
     node_id: Arc<RwLock<String>>,
     dynamic: SharedDynamicConfig,
+    tls_acceptor: Option<TlsAcceptor>,
     mut shutdown_rx: watch::Receiver<bool>,
 ) -> anyhow::Result<()> {
     let addr = SocketAddr::from(([0, 0, 0, 0], config.listen_port));
     let listener = TcpListener::bind(addr).await?;
-    info!(addr = %addr, "proxy server listening");
+
+    if tls_acceptor.is_some() {
+        info!(addr = %addr, "proxy server listening (HTTP+TLS dual-stack)");
+    } else {
+        info!(addr = %addr, "proxy server listening (HTTP only)");
+    }
 
     loop {
         tokio::select! {
@@ -46,66 +58,41 @@ pub async fn run(
                 let config = Arc::clone(&config);
                 let node_id = Arc::clone(&node_id);
                 let dynamic = Arc::clone(&dynamic);
+                let tls_acceptor = tls_acceptor.clone();
 
                 tokio::task::spawn(async move {
-                    let io = TokioIo::new(stream);
-
-                    let service = service_fn(move |req: Request<Incoming>| {
-                        let config = Arc::clone(&config);
-                        let node_id = Arc::clone(&node_id);
-                        let dynamic = Arc::clone(&dynamic);
-
-                        async move {
-                            type BoxBody = http_body_util::combinators::BoxBody<bytes::Bytes, Box<dyn std::error::Error + Send + Sync>>;
-
-                            // Snapshot current dynamic values (may be updated by remote config)
-                            let current_node_id = node_id.read().unwrap().clone();
-                            let (allowed_ports, timestamp_tolerance) = {
-                                let d = dynamic.read().unwrap();
-                                (d.allowed_ports.clone(), d.timestamp_tolerance)
-                            };
-
-                            if req.method() == Method::CONNECT {
-                                let resp = connect::handle_connect(
-                                    req,
-                                    config,
-                                    &current_node_id,
-                                    &allowed_ports,
-                                    timestamp_tolerance,
-                                )
-                                .await;
-                                let resp = resp.map(|_| -> BoxBody {
-                                    http_body_util::Empty::new()
-                                        .map_err(|e| -> Box<dyn std::error::Error + Send + Sync> { match e {} })
-                                        .boxed()
-                                });
-                                Ok::<_, hyper::Error>(resp)
-                            } else {
-                                let resp = plain::handle_plain(
-                                    req,
-                                    config,
-                                    &current_node_id,
-                                    &allowed_ports,
-                                    timestamp_tolerance,
-                                )
-                                .await;
-                                // plain::handle_plain already returns BoxBody (streaming)
-                                Ok(resp)
+                    // Dual-stack: peek first byte to decide TLS vs plain HTTP
+                    if let Some(acceptor) = &tls_acceptor {
+                        if tls::is_tls_client_hello(&stream).await {
+                            match acceptor.accept(stream).await {
+                                Ok(tls_stream) => {
+                                    debug!(peer = %peer_addr, "TLS handshake ok");
+                                    serve_connection(
+                                        TokioIo::new(tls_stream),
+                                        peer_addr,
+                                        config,
+                                        node_id,
+                                        dynamic,
+                                    )
+                                    .await;
+                                }
+                                Err(e) => {
+                                    debug!(peer = %peer_addr, error = %e, "TLS handshake failed");
+                                }
                             }
-                        }
-                    });
-
-                    if let Err(e) = http1::Builder::new()
-                        .preserve_header_case(true)
-                        .title_case_headers(false)
-                        .serve_connection(io, service)
-                        .with_upgrades()
-                        .await
-                    {
-                        if !e.to_string().contains("connection closed") {
-                            debug!(peer = %peer_addr, error = %e, "connection error");
+                            return;
                         }
                     }
+
+                    // Plain HTTP
+                    serve_connection(
+                        TokioIo::new(stream),
+                        peer_addr,
+                        config,
+                        node_id,
+                        dynamic,
+                    )
+                    .await;
                 });
             }
             _ = shutdown_rx.changed() => {
@@ -117,3 +104,71 @@ pub async fn run(
 
     Ok(())
 }
+
+/// Serve a single HTTP/1.1 connection (works over both plain TCP and TLS).
+async fn serve_connection<I>(
+    io: I,
+    peer_addr: SocketAddr,
+    config: Arc<Config>,
+    node_id: Arc<RwLock<String>>,
+    dynamic: SharedDynamicConfig,
+) where
+    I: Read + Write + Unpin + Send + 'static,
+{
+    let service = service_fn(move |req: Request<Incoming>| {
+        let config = Arc::clone(&config);
+        let node_id = Arc::clone(&node_id);
+        let dynamic = Arc::clone(&dynamic);
+
+        async move {
+            type BoxBody = http_body_util::combinators::BoxBody<bytes::Bytes, Box<dyn std::error::Error + Send + Sync>>;
+
+            // Snapshot current dynamic values (may be updated by remote config)
+            let current_node_id = node_id.read().unwrap().clone();
+            let (allowed_ports, timestamp_tolerance) = {
+                let d = dynamic.read().unwrap();
+                (d.allowed_ports.clone(), d.timestamp_tolerance)
+            };
+
+            if req.method() == Method::CONNECT {
+                let resp = connect::handle_connect(
+                    req,
+                    config,
+                    &current_node_id,
+                    &allowed_ports,
+                    timestamp_tolerance,
+                )
+                .await;
+                let resp = resp.map(|_| -> BoxBody {
+                    http_body_util::Empty::new()
+                        .map_err(|e| -> Box<dyn std::error::Error + Send + Sync> { match e {} })
+                        .boxed()
+                });
+                Ok::<_, hyper::Error>(resp)
+            } else {
+                let resp = plain::handle_plain(
+                    req,
+                    config,
+                    &current_node_id,
+                    &allowed_ports,
+                    timestamp_tolerance,
+                )
+                .await;
+                // plain::handle_plain already returns BoxBody (streaming)
+                Ok(resp)
+            }
+        }
+    });
+
+    if let Err(e) = http1::Builder::new()
+        .preserve_header_case(true)
+        .title_case_headers(false)
+        .serve_connection(io, service)
+        .with_upgrades()
+        .await
+    {
+        if !e.to_string().contains("connection closed") {
+            debug!(peer = %peer_addr, error = %e, "connection error");
+        }
+    }
+}

aether-proxy/src/proxy/tls.rs

@@ -0,0 +1,116 @@
+use std::fs;
+use std::io::BufReader;
+use std::path::Path;
+use std::sync::Arc;
+
+use rcgen::{CertificateParams, KeyPair};
+use rustls_pki_types::{CertificateDer, PrivateKeyDer};
+use sha2::{Digest, Sha256};
+use tokio_rustls::TlsAcceptor;
+use tracing::{info, warn};
+
+/// Generate a self-signed certificate if the files do not already exist.
+///
+/// The certificate includes SANs: `localhost` and `aether-proxy`.
+/// The private key file is set to mode 0600 on unix.
+pub fn ensure_self_signed_cert(cert_path: &Path, key_path: &Path) -> anyhow::Result<()> {
+    if cert_path.exists() && key_path.exists() {
+        info!(
+            cert = %cert_path.display(),
+            key = %key_path.display(),
+            "using existing TLS certificate"
+        );
+        return Ok(());
+    }
+
+    info!("generating self-signed TLS certificate");
+
+    let mut params = CertificateParams::new(vec![
+        "localhost".into(),
+        "aether-proxy".into(),
+    ])?;
+    params.distinguished_name = rcgen::DistinguishedName::new();
+    params
+        .distinguished_name
+        .push(rcgen::DnType::CommonName, "aether-proxy");
+
+    let key_pair = KeyPair::generate()?;
+    let cert = params.self_signed(&key_pair)?;
+
+    let cert_pem = cert.pem();
+    let key_pem = key_pair.serialize_pem();
+
+    fs::write(cert_path, &cert_pem)?;
+    fs::write(key_path, &key_pem)?;
+
+    // Set key file permissions to 0600 on unix
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let perms = fs::Permissions::from_mode(0o600);
+        fs::set_permissions(key_path, perms)?;
+    }
+
+    info!(
+        cert = %cert_path.display(),
+        key = %key_path.display(),
+        "self-signed TLS certificate generated"
+    );
+
+    Ok(())
+}
+
+/// Build a `TlsAcceptor` from PEM certificate and key files.
+pub fn build_tls_acceptor(cert_path: &Path, key_path: &Path) -> anyhow::Result<TlsAcceptor> {
+    let cert_file = fs::File::open(cert_path)?;
+    let key_file = fs::File::open(key_path)?;
+
+    let certs: Vec<CertificateDer<'static>> = rustls_pemfile::certs(&mut BufReader::new(cert_file))
+        .collect::<Result<Vec<_>, _>>()?;
+
+    if certs.is_empty() {
+        anyhow::bail!("no certificates found in {}", cert_path.display());
+    }
+
+    let key: PrivateKeyDer<'static> =
+        rustls_pemfile::private_key(&mut BufReader::new(key_file))?
+            .ok_or_else(|| anyhow::anyhow!("no private key found in {}", key_path.display()))?;
+
+    let config = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)?;
+
+    Ok(TlsAcceptor::from(Arc::new(config)))
+}
+
+/// Compute the SHA-256 fingerprint of the first certificate in a PEM file.
+///
+/// Returns the hex-encoded fingerprint (lowercase, no separators).
+pub fn cert_sha256_fingerprint(cert_path: &Path) -> anyhow::Result<String> {
+    let cert_file = fs::File::open(cert_path)?;
+    let certs: Vec<CertificateDer<'static>> =
+        rustls_pemfile::certs(&mut BufReader::new(cert_file))
+            .collect::<Result<Vec<_>, _>>()?;
+
+    let cert = certs
+        .first()
+        .ok_or_else(|| anyhow::anyhow!("no certificates found in {}", cert_path.display()))?;
+
+    let digest = Sha256::digest(cert.as_ref());
+    Ok(hex::encode(digest))
+}
+
+/// Peek at the first byte of a TCP stream to determine if it is a TLS ClientHello.
+///
+/// Returns `true` if the first byte is 0x16 (TLS record type: Handshake).
+pub async fn is_tls_client_hello(stream: &tokio::net::TcpStream) -> bool {
+    let mut buf = [0u8; 1];
+    match stream.peek(&mut buf).await {
+        Ok(1) => buf[0] == 0x16,
+        Ok(_) => false,
+        Err(e) => {
+            warn!(error = %e, "failed to peek first byte");
+            false
+        }
+    }
+}