yuanyuanxianganddeepseek-v4-pro
ca0d7626d2
Add optional one-way TLS on the device port (6543), enabled per client via a pinned trust anchor, so new clients encrypt their transport while legacy plaintext clients keep working unchanged. Server (server/go): sniff each accepted connection and wrap TLS peers (ClientHello 0x16 0x03 + handshake type 0x01) in crypto/tls with MinVersion TLS 1.2; everything else stays on the plaintext path. TLS is enabled only when both YAMA_TLS_CERT and YAMA_TLS_KEY are set, and a cert/key load failure fails startup loudly rather than silently serving plaintext. Client (client/, Windows): Schannel one-way TLS. When the trust anchor is present — registry value Software\<exehash>\settings\tls_cert (REG_SZ holding the PEM), with fallback to settings.ini [settings] tls_cert or yama-ca.pem beside the exe — every outbound connection (main + sub-connections) completes a TLS 1.2 handshake before the app protocol and is strictly pinned to that anchor via a chain engine with hExclusiveRoot; any handshake/cert failure is fail-closed (no plaintext downgrade). Send uses EncryptMessage; Recv uses DecryptMessage and reads plaintext from the stream-mode DATA segment (bufs[1]) rather than the record header. Co-Authored-By: deepseek-v4-pro
56 lines
1.2 KiB
Go
56 lines
1.2 KiB
Go
package server
|
|
|
|
import "testing"
|
|
|
|
func TestIsTLSClientHello(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
b []byte
|
|
want bool
|
|
}{
|
|
{
|
|
name: "TLS 1.2 ClientHello",
|
|
b: []byte{0x16, 0x03, 0x03, 0x00, 0x01, 0x01, 0x00},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "TLS 1.3 ClientHello (legacy record version)",
|
|
b: []byte{0x16, 0x03, 0x01, 0x00, 0x01, 0x01, 0x00},
|
|
want: true,
|
|
},
|
|
{
|
|
name: "plaintext Shine flag",
|
|
b: []byte{'S', 'h', 'i', 'n', 'e', 0x00, 0x00},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "obfuscated HELL header that happens to start 0x16 0x03 but byte5=0x00",
|
|
b: []byte{0x16, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "HTTP-mask POST envelope",
|
|
b: []byte{'P', 'O', 'S', 'T', ' ', '/', 'x'},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "0x16 0x03 but handshake type ServerHello (0x02), not ClientHello",
|
|
b: []byte{0x16, 0x03, 0x03, 0x00, 0x01, 0x02, 0x00},
|
|
want: false,
|
|
},
|
|
{
|
|
name: "too short",
|
|
b: []byte{0x16, 0x03, 0x01},
|
|
want: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
if got := isTLSClientHello(tt.b); got != tt.want {
|
|
t.Errorf("isTLSClientHello(% x) = %v, want %v", tt.b, got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|