feat(security): harden gateway boundaries and usage policies

Consolidate subscription usage policy enforcement, privacy-safe persistence, and gateway security hardening into one reviewable change. Includes bounded HTTP and execution envelopes, header and protocol guards, DNS and relay validation, authentication and secret projection hardening, secure backup/install paths, and regression coverage.
2026-10-09 18:59:50 +08:00 · 2026-09-04 03:45:52 +08:00
parent ddcbeb3ae9
commit 579f2c7cc1
1019 changed files with 190437 additions and 26080 deletions
@@ -3,14 +3,15 @@
 use bytes::Bytes;

 pub use aether_contracts::tunnel::{
-    decode_payload, encode_connection_close, encode_frame, encode_goaway, encode_goaway_v3,
-    encode_hello, encode_load_report, encode_ping, encode_pong, encode_reset_stream,
-    encode_settings, encode_stream_error, encode_window_update, frame_payload_by_header,
-    ConnectionClosePayload, FrameHeader, GoAwayPayload, HelloPayload, LoadReportPayload,
-    RequestMeta, ResetStreamPayload, ResponseMeta, SettingsPayload, WindowUpdatePayload,
-    CONNECTION_CLOSE, FLAG_END_STREAM, FLAG_GZIP_COMPRESSED, GOAWAY, HEADER_SIZE, HEARTBEAT_ACK,
-    HEARTBEAT_DATA, HELLO, LOAD_REPORT, PING, PONG, REQUEST_BODY, REQUEST_HEADERS, RESET_STREAM,
-    RESPONSE_BODY, RESPONSE_HEADERS, SETTINGS, STREAM_END, STREAM_ERROR, WINDOW_UPDATE,
+    decode_payload, decode_payload_with_limit, encode_connection_close, encode_frame,
+    encode_goaway, encode_goaway_v3, encode_hello, encode_load_report, encode_ping, encode_pong,
+    encode_reset_stream, encode_settings, encode_stream_error, encode_window_update,
+    frame_payload_by_header, ConnectionClosePayload, FrameHeader, GoAwayPayload, HelloPayload,
+    LoadReportPayload, RequestMeta, ResetStreamPayload, ResponseMeta, SettingsPayload,
+    WindowUpdatePayload, CONNECTION_CLOSE, FLAG_END_STREAM, FLAG_GZIP_COMPRESSED, GOAWAY,
+    HEADER_SIZE, HEARTBEAT_ACK, HEARTBEAT_DATA, HELLO, LOAD_REPORT, PING, PONG, REQUEST_BODY,
+    REQUEST_HEADERS, RESET_STREAM, RESPONSE_BODY, RESPONSE_HEADERS, SETTINGS, STREAM_END,
+    STREAM_ERROR, WINDOW_UPDATE,
 };

 pub fn compress_payload(payload: &[u8]) -> Result<(Vec<u8>, u8), std::io::Error> {
@@ -2,6 +2,7 @@ use base64::Engine as _;
 use http::HeaderMap;

 pub const MAX_TUNNEL_STREAMS: usize = 2_048;
+const MAX_TUNNEL_NODE_NAME_UTF8_BYTES: usize = 100 * 4;

 pub fn resolve_proxy_max_streams(headers: &HeaderMap, fallback: usize) -> usize {
    headers
@@ -17,10 +18,20 @@ pub fn resolve_proxy_node_name(headers: &HeaderMap, node_id: &str) -> String {
        .get(aether_contracts::tunnel::TUNNEL_NODE_NAME_B64_HEADER)
        .and_then(|value| value.to_str().ok())
        .and_then(|value| {
+            let value = value.trim();
+            let max_encoded_len = MAX_TUNNEL_NODE_NAME_UTF8_BYTES
+                .saturating_add(2)
+                .checked_div(3)
+                .unwrap_or(usize::MAX)
+                .saturating_mul(4);
+            if value.len() > max_encoded_len {
+                return None;
+            }
            base64::engine::general_purpose::URL_SAFE_NO_PAD
-                .decode(value.trim())
+                .decode(value)
                .ok()
        })
+        .filter(|bytes| bytes.len() <= MAX_TUNNEL_NODE_NAME_UTF8_BYTES)
        .and_then(|bytes| String::from_utf8(bytes).ok())
        .map(|value| value.trim().to_string())
        .filter(|value| !value.is_empty() && value.chars().count() <= 100)
@@ -91,5 +102,17 @@ mod tests {
        headers.remove(aether_contracts::tunnel::TUNNEL_NODE_NAME_B64_HEADER);
        headers.insert("x-node-name", HeaderValue::from_static("edge-1"));
        assert_eq!(resolve_proxy_node_name(&headers, "node-1"), "edge-1");
+
+        let max_encoded_len = super::MAX_TUNNEL_NODE_NAME_UTF8_BYTES
+            .saturating_add(2)
+            .checked_div(3)
+            .unwrap()
+            .saturating_mul(4);
+        headers.insert(
+            aether_contracts::tunnel::TUNNEL_NODE_NAME_B64_HEADER,
+            HeaderValue::from_str(&"A".repeat(max_encoded_len + 1))
+                .expect("oversized encoded header should parse"),
+        );
+        assert_eq!(resolve_proxy_node_name(&headers, "node-1"), "edge-1");
    }
 }
@@ -12,6 +12,8 @@ pub const DEFAULT_TUNNEL_PROBE_BODY_LIMIT_BYTES: usize = 64 * 1024;
 pub struct TunnelAttachmentRecord {
    pub gateway_instance_id: String,
    pub relay_base_url: String,
+    #[serde(default)]
+    pub tunnel_generation: String,
    pub conn_count: usize,
    pub observed_at_unix_secs: u64,
 }
@@ -20,6 +22,7 @@ impl TunnelAttachmentRecord {
    pub fn is_routable(&self, now_unix_secs: u64, ttl_secs: u64) -> bool {
        self.conn_count > 0
            && !self.relay_base_url.trim().is_empty()
+            && !self.tunnel_generation.trim().is_empty()
            && self.observed_at_unix_secs.saturating_add(ttl_secs) >= now_unix_secs
    }

@@ -44,6 +47,7 @@ mod tests {
        TunnelAttachmentRecord {
            gateway_instance_id: "gateway-a".to_string(),
            relay_base_url: "http://gateway-a.internal".to_string(),
+            tunnel_generation: "generation-a".to_string(),
            conn_count: 1,
            observed_at_unix_secs: 100,
        }