phantom-protocol 0.2.2

Post-quantum-secure L4/L6 universal transport framework — hybrid X25519+ML-KEM-768 / Ed25519+ML-DSA-65, multi-path, UniFFI bindings
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

//! Live end-to-end integration of the TLS-over-TCP active-mimicry transport
//! (queue item #13) over a real TCP loopback: a `PhantomListener::bind_mimic`
//! server and a `connect_pinned_mimic` client complete the full synthetic TLS
//! prelude AND the inner Phantom post-quantum handshake, then exchange encrypted
//! application data bidirectionally.
//!
//! `#[ignore]`-gated like the other loopback suites (`tcp_integration`,
//! `kcp_integration`) so it does not run on the default `cargo test`; the
//! `mimicry`-feature CI job runs it with `-- --ignored`. Requires the `mimicry`
//! feature (and a native, non-wasm target).
#![cfg(all(not(target_arch = "wasm32"), feature = "mimicry"))]

use std::net::SocketAddr;
use std::time::Duration;

use phantom_protocol::api::listener::PhantomListener;
use phantom_protocol::api::session::connect_pinned_mimic;
use tokio::time::timeout;

/// Full session over the mimicry transport: pinned connect, bidirectional
/// encrypted data, and the negative assertion that the application plaintext never
/// appears on the (TLS-record-wrapped) wire is already covered by the inner
/// session's own tests — here we prove the prelude + inner handshake + data path
/// all compose over a real socket through `bind_mimic` / `connect_pinned_mimic`.
#[tokio::test]
#[ignore = "real TCP loopback; run via the mimicry CI job with --ignored"]
async fn mimic_full_session_round_trip() {
    let listener = PhantomListener::bind_mimic("127.0.0.1:0".to_string())
        .await
        .expect("bind_mimic");
    let addr: SocketAddr = listener.local_addr().parse().expect("parse local_addr");
    let pinned = listener.verifying_key_bytes();

    // Server: accept one mimicry connection, echo a reply.
    let server = tokio::spawn(async move {
        let outcome = timeout(Duration::from_secs(15), listener.accept())
            .await
            .expect("accept did not time out")
            .expect("accept");
        let session = outcome.session();
        let got = timeout(Duration::from_secs(15), session.recv())
            .await
            .expect("server recv did not time out")
            .expect("server recv");
        assert_eq!(&got[..], b"hello over mimic-tls");
        session
            .send(b"reply over mimic-tls".to_vec())
            .await
            .expect("server send");
        // Keep the session alive briefly so the reply flushes before drop.
        tokio::time::sleep(Duration::from_millis(200)).await;
    });

    // Client: connect over the mimicry transport with a cover SNI, exchange data.
    let client = timeout(
        Duration::from_secs(15),
        connect_pinned_mimic(
            addr.ip().to_string(),
            addr.port(),
            pinned,
            "www.example-cdn.com".to_string(),
        ),
    )
    .await
    .expect("connect did not time out")
    .expect("connect_pinned_mimic");

    client
        .send(b"hello over mimic-tls".to_vec())
        .await
        .expect("client send");
    let reply = timeout(Duration::from_secs(15), client.recv())
        .await
        .expect("client recv did not time out")
        .expect("client recv");
    assert_eq!(&reply[..], b"reply over mimic-tls");

    server.await.expect("server task");
}