qmux 0.1.0

QMux protocol (draft-ietf-quic-qmux-01) over reliable transports
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92

use std::sync::Arc;
use tokio::net::{TcpStream, ToSocketAddrs};
use tokio_rustls::TlsAcceptor;
use tokio_rustls::TlsConnector;

use crate::transport::StreamTransport;
use crate::{alpn, Config, Error, Session, Version};

/// Extract the application protocol from a TLS ALPN, given the pinned version.
///
/// The QMux version is set by the caller; this function only strips the
/// expected prefix to recover the app protocol. Returns `None` for the bare
/// version ALPN or for unrecognised values.
fn parse_protocol(alpn: Option<&str>, version: Version) -> Option<String> {
    let alpn = alpn.filter(|s| !s.is_empty())?;
    if alpn == version.alpn() {
        return None;
    }
    let Some(proto) = alpn.strip_prefix(version.prefix()) else {
        tracing::warn!(?alpn, ?version, "unrecognized TLS ALPN");
        return None;
    };
    (!proto.is_empty()).then(|| proto.to_string())
}

/// Connect over TLS pinned to a specific QMux version.
///
/// The caller's `alpn_protocols` are treated as bare application-level
/// protocols and wrapped with `{version.prefix()}` before offer. The prefix
/// is stripped from the negotiated result. To advertise multiple QMux
/// versions, drive separate connection attempts.
///
/// The `server_name` is used for SNI and certificate verification.
pub async fn connect(
    addr: impl ToSocketAddrs,
    server_name: &str,
    config: Arc<rustls::ClientConfig>,
    version: Version,
) -> Result<Session, Error> {
    let stream = TcpStream::connect(&addr).await?;

    let server_name = rustls::pki_types::ServerName::try_from(server_name)
        .map_err(|e| Error::Io(e.to_string()))?
        .to_owned();

    let app_protocols: Vec<String> = config
        .alpn_protocols
        .iter()
        .map(|a| String::from_utf8_lossy(a).to_string())
        .collect();
    let prefixed = alpn::build(version, &app_protocols);

    let mut config = (*config).clone();
    config.alpn_protocols = prefixed.iter().map(|s| s.as_bytes().to_vec()).collect();

    tracing::debug!(?prefixed, "TLS connecting");

    let connector = TlsConnector::from(Arc::new(config));
    let tls_stream = connector.connect(server_name, stream).await?;

    let negotiated = tls_stream.get_ref().1.alpn_protocol();
    let negotiated_str = negotiated.and_then(|a| std::str::from_utf8(a).ok());
    tracing::debug!(?negotiated_str, "TLS negotiated ALPN");

    let protocol = parse_protocol(negotiated_str, version);
    tracing::debug!(?version, ?protocol, "parsed ALPN");

    let session_config = Config::new(version, protocol);
    let transport = StreamTransport::new(tls_stream, version, session_config.max_record_size);
    Ok(Session::connect(transport, session_config))
}

/// Accept a TLS connection pinned to a specific QMux version.
pub async fn accept(
    stream: TcpStream,
    config: Arc<rustls::ServerConfig>,
    version: Version,
) -> Result<Session, Error> {
    let acceptor = TlsAcceptor::from(config);
    let tls_stream = acceptor.accept(stream).await?;

    let negotiated = tls_stream.get_ref().1.alpn_protocol();
    let negotiated_str = negotiated.and_then(|a| std::str::from_utf8(a).ok());
    tracing::debug!(?negotiated_str, "TLS accepted, negotiated ALPN");

    let protocol = parse_protocol(negotiated_str, version);
    tracing::debug!(?version, ?protocol, "parsed ALPN");

    let session_config = Config::new(version, protocol);
    let transport = StreamTransport::new(tls_stream, version, session_config.max_record_size);
    Ok(Session::accept(transport, session_config))
}