mirror of
https://github.com/netbirdio/netbird.git
synced 2026-05-20 15:49:55 +00:00
078c323ef3
The relay now accepts WebTransport sessions on the same UDP socket that
serves raw QUIC. The ALPN-multiplexing QUIC listener owns the socket and
dispatches incoming connections: "nb-quic" continues to the existing
relay handler, "h3" is handed to webtransport-go via http3.Server.
Browsers reach the relay over 443/udp without a second port.
Client side:
- Native builds keep using raw QUIC (no WT dialer registered).
- WASM/browser builds gain a WebTransport dialer that bridges syscall/js
to the browser's WebTransport API and uses datagrams (matching the
native QUIC dialer's semantics — no head-of-line blocking).
- The race dialer learned a transport hint so clients skip dialers a
given relay has not advertised.
Management protocol carries the hint as a new RelayEndpoint{url,
transports[]} list on RelayConfig, mirroring how peers and proxies
announce capabilities. Older management servers that only send urls keep
working unchanged.
devcert build: relay generates an ECDSA P-256 cert with 13-day validity
(within the WebTransport serverCertificateHashes 14-day cap) and exposes
its SHA-256 so the WASM dialer can pin it.
Bumps quic-go v0.55.0 -> v0.59.0 (no API breaks for relay's importers)
and adds github.com/quic-go/webtransport-go v0.10.0.
35 lines
1.0 KiB
Go
35 lines
1.0 KiB
Go
//go:build !devcert
|
|
|
|
package tls
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"fmt"
|
|
)
|
|
|
|
// DevCertHash returns nil in production builds. It exists so callers (notably
|
|
// the WASM WebTransport dialer) can probe for a self-signed dev cert hash
|
|
// without branching on build tags.
|
|
func DevCertHash() []byte { return nil }
|
|
|
|
func ServerQUICTLSConfig(originTLSCfg *tls.Config) (*tls.Config, error) {
|
|
if originTLSCfg == nil {
|
|
return nil, fmt.Errorf("valid TLS config is required for QUIC listener")
|
|
}
|
|
cfg := originTLSCfg.Clone()
|
|
cfg.NextProtos = []string{NBalpn}
|
|
return cfg, nil
|
|
}
|
|
|
|
// ServerMuxTLSConfig returns a TLS config that advertises both the raw QUIC
|
|
// relay ALPN and HTTP/3. The ALPN-multiplexing UDP listener uses it to share a
|
|
// single socket between raw QUIC clients and WebTransport (browser) clients.
|
|
func ServerMuxTLSConfig(originTLSCfg *tls.Config) (*tls.Config, error) {
|
|
if originTLSCfg == nil {
|
|
return nil, fmt.Errorf("valid TLS config is required for QUIC/WT listener")
|
|
}
|
|
cfg := originTLSCfg.Clone()
|
|
cfg.NextProtos = []string{NBalpn, H3alpn}
|
|
return cfg, nil
|
|
}
|