mirror of
https://github.com/EasyTier/EasyTier.git
synced 2026-09-12 00:00:40 +00:00
KKRainbow
e0bdb516b6
* fix(quic): bind proxy packet checksum to packet number via ETQ1 version QUIC proxy connections die with quinn PROTOCOL_VIOLATION "unsent packet acked" under bursty traffic with reordering, and the affected peer pair keeps failing for every new connection until the source node restarts. Root cause: the custom crypto checksums the packet bytes but not the packet number, while quinn decodes truncated packet numbers by proximity to the largest received (RFC 9000 Appendix A). A 1-byte encoded packet delayed beyond the +/-128 decode window is decoded as a future packet number, still passes the checksum, gets ACKed, and the peer aborts because it never sent that number. Real QUIC survives this because the AEAD nonce is derived from the packet number, so a misdecode fails authentication. Fix: negotiate a custom QUIC version ETQ1 (0x45545131) for the proxy. Connections on ETQ1 mix the packet number into the SeaHash checksum, so an out-of-window misdecode fails authentication and the packet is handled as ordinary loss. The mode is derived statelessly from the negotiated version in QuicSession and ServerConfig::initial_keys. Compatibility: the proxy endpoint accepts both ETQ1 and version 1. NatDstQuicConnector dials ETQ1 first; on ConnectionError::VersionMismatch from a legacy peer it retries with version 1 and remembers the peer in legacy_version_peers to skip the rejected version afterwards. The quic:// tunnel keeps version 1 only. Verified with 13 docker nodes under netem jitter and bursty iperf load: the previously-poisoned pair survived 16 minutes on ETQ1 with zero violations while all legacy-version pairs kept dying; mixed new-to-old and old-to-new connections work. * fix(quic): extend the ETQ1 checksum fix to the quic:// tunnel The quic:// tunnel shares CryptoKey with the proxy, so after the proxy moved to ETQ1 the tunnel still carried the unsent-packet-acked exposure. Make endpoint_config() dual-version so tunnel listeners accept both ETQ1 and legacy peers, and dial ETQ1 first in upgrade_connected with a transparent fallback to version 1 on VersionMismatch, via a shared connect_with_etq1 helper. The proxy keeps its hedged dialer with the per-peer legacy memory; tunnel connections are established once per session, so the fallback there costs a single extra round trip.