boba/VNOX-Server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

TLS 1.3, channel persistence, membership signaling

Browse source 
- TLS 1.3 on TCP (rustls + tokio-rustls, optional self-signed cert)
- Server-side channel CRUD with SQLite persistence
- Gateway → voice-node membership bridge via broadcast channel
This commit is contained in:
loki5512344 2026-07-09 12:48:18 +02:00
parent 523680e05d
commit 5534cd01f7
Signed by: boba
GPG key ID: 253067914055423B
37 changed files with 771 additions and 160 deletions
Download patch file Download diff file Expand all files Collapse all files

6
gateway/Cargo.toml
View file

@ -38,3 +38,9 @@ axum = { version = "0.8", features = ["ws"] }
tower = "0.5"
sqlx = { version = "0.9", features = ["sqlite", "runtime-tokio", "tls-rustls"] }
bitflags = "2"
# TLS 1.3 support
rustls-pki-types = "1"
rustls = "0.23"
tokio-rustls = "0.26"
rcgen = "0.13"

9
gateway/src/domain/config.rs
View file

@ -90,6 +90,15 @@ pub struct GatewayConfig {
/// Defaults to 10.
#[serde(default)]
pub message_rate_burst: Option<u32>,
/// Enable TLS 1.3 on the TCP listener.
#[serde(default)]
pub tls_enabled: bool,
/// Path to TLS certificate file (PEM).
#[serde(default)]
pub tls_cert_path: Option<String>,
/// Path to TLS private key file (PEM).
#[serde(default)]
pub tls_key_path: Option<String>,
}
#[derive(Debug, Deserialize)]

70
gateway/src/domain/storage/mod.rs
View file

@ -35,7 +35,13 @@ impl Storage {
CREATE TABLE IF NOT EXISTS users (
pubkey TEXT PRIMARY KEY, nickname TEXT NOT NULL, first_seen INTEGER NOT NULL
);
CREATE TABLE IF NOT EXISTS bans (
CREATE TABLE IF NOT EXISTS channels (
id TEXT PRIMARY KEY,
name TEXT NOT NULL,
kind TEXT NOT NULL DEFAULT 'text',
created_at INTEGER NOT NULL
);
CREATE TABLE IF NOT EXISTS bans (
pubkey TEXT PRIMARY KEY, reason TEXT, banned_at INTEGER NOT NULL
);
CREATE TABLE IF NOT EXISTS direct_messages (
@ -215,6 +221,68 @@ pub(crate) fn generate_invite_code() -> String {
format!("{:08x}", hash % 0x100000000u64)
}
use crate::domain::channels::{ChannelKind, ChannelStore};
#[derive(Debug, Clone)]
pub struct ChannelRecord {
pub id: String,
pub name: String,
pub kind: String,
pub created_at: i64,
}
impl Storage {
pub async fn create_channel(&self, id: &str, name: &str, kind: &str) -> Result<bool> {
let result = sqlx::query(
"INSERT OR IGNORE INTO channels (id, name, kind, created_at) VALUES (?, ?, ?, ?)",
)
.bind(id)
.bind(name)
.bind(kind)
.bind(now_ms())
.execute(&self.pool)
.await?;
Ok(result.rows_affected() > 0)
}
pub async fn delete_channel(&self, id: &str) -> Result<bool> {
let result = sqlx::query("DELETE FROM channels WHERE id=?")
.bind(id)
.execute(&self.pool)
.await?;
Ok(result.rows_affected() > 0)
}
pub async fn list_channels(&self) -> Result<Vec<ChannelRecord>> {
let rows = sqlx::query_as::<_, (String, String, String, i64)>(
"SELECT id, name, kind, created_at FROM channels",
)
.fetch_all(&self.pool)
.await?
.into_iter()
.map(|(id, name, kind, created_at)| ChannelRecord {
id,
name,
kind,
created_at,
})
.collect();
Ok(rows)
}
pub async fn load_channels_to_cache(&self, channel_store: &ChannelStore) -> Result<()> {
let channels = self.list_channels().await?;
for ch in channels {
let kind = match ch.kind.as_str() {
"voice" => ChannelKind::Voice,
_ => ChannelKind::Text,
};
crate::domain::channels::create(channel_store, &ch.id, &ch.name, kind).await;
}
Ok(())
}
}
pub(crate) fn now_ms() -> i64 {
std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)

27
gateway/src/handler/channel/create.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::{info, warn};
use crate::{
@ -17,7 +17,7 @@ use crate::{
/// Handle a ChannelCreate request — register a new channel in the store and
/// broadcast the new ChannelState to all sessions so their sidebars update.
pub async fn handle_channel_create(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -97,6 +97,17 @@ pub async fn handle_channel_create(
let created = channels::create(&state.channels, &channel_id, &channel_name, kind.clone()).await;
// Persist to DB (best-effort, log and continue on failure).
if created {
if let Err(e) = state
.storage
.create_channel(&channel_id, &channel_name, kind.as_str())
.await
{
warn!("failed to persist channel to storage: {e}");
}
}
if !created {
io::send_encrypted(
stream,
@ -160,7 +171,7 @@ pub async fn handle_channel_create(
/// Handle a ChannelDelete request — remove the channel from the store and
/// broadcast the deletion to all sessions.
pub async fn handle_channel_delete(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -190,6 +201,14 @@ pub async fn handle_channel_delete(
}
let existed = channels::delete(&state.channels, &req.channel_id).await;
// Remove from DB (best-effort).
if existed {
if let Err(e) = state.storage.delete_channel(&req.channel_id).await {
warn!("failed to remove channel from storage: {e}");
}
}
if !existed {
io::send_encrypted(
stream,
@ -229,7 +248,7 @@ pub async fn handle_channel_delete(
/// Handle a ChannelList request — reply with all known channels.
pub async fn handle_channel_list(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
crypto: &SessionCrypto,

16
gateway/src/handler/channel/join.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::info;
use crate::{
@ -19,7 +19,7 @@ use super::{broadcast_leave, set_channel};
const HISTORY_LIMIT: i64 = 50;
pub async fn join(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
channel_id: &str,
@ -110,6 +110,18 @@ pub async fn join(
});
}
if let Some(tx) = &state.voice_member_tx {
if let Some(sess) = session::get(&state.sessions, session_id).await {
let event = serde_json::json!({
"type": "joined",
"channel_id": channel_id,
"session_id": session_id,
"user_id": sess.user_id,
});
let _ = tx.send(event.to_string());
}
}
info!("session {} joined {channel_id}", &session_id[..8]);
Ok(())
}

23
gateway/src/handler/channel/leave.rs
View file

@ -1,22 +1,39 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::info;
use crate::{domain::channels, net::state::State, proto::SessionCrypto};
use crate::{domain::{channels, session}, net::state::State, proto::SessionCrypto};
use super::{broadcast_leave, set_channel};
pub async fn leave(
_stream: &mut TcpStream,
_stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
_seq: &mut u32,
session_id: &str,
channel_id: &str,
_crypto: &SessionCrypto,
state: &State,
) -> Result<()> {
let user_id = session::get(&state.sessions, session_id)
.await
.map(|s| s.user_id);
channels::leave(&state.channels, channel_id, session_id).await;
set_channel(state, session_id, None).await;
broadcast_leave(state, channel_id, session_id).await;
if let Some(tx) = &state.voice_member_tx {
if let Some(ref uid) = user_id {
let event = serde_json::json!({
"type": "left",
"channel_id": channel_id,
"session_id": session_id,
"user_id": uid,
});
let _ = tx.send(event.to_string());
}
}
info!("session {} left {channel_id}", &session_id[..8]);
Ok(())
}

6
gateway/src/handler/content/presence.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -14,7 +14,7 @@ use crate::{
};
pub async fn handle_presence_update(
_stream: &mut TcpStream,
_stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -60,7 +60,7 @@ pub async fn handle_presence_update(
}
pub async fn handle_presence_sync(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
crypto: &SessionCrypto,

2
gateway/src/handler/content/read_receipt.rs
View file

@ -7,7 +7,7 @@ use crate::{
};
pub async fn handle_read_receipt(
_stream: &mut tokio::net::TcpStream,
_stream: &mut (impl tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

4
gateway/src/handler/deliver.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -8,7 +8,7 @@ use crate::{
};
pub async fn deliver_encrypted(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
msg: &BroadcastMsg,

4
gateway/src/handler/direct_message/history.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -8,7 +8,7 @@ use crate::{
};
pub async fn handle_dm_history(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

4
gateway/src/handler/direct_message/send.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::warn;
use crate::{
@ -14,7 +14,7 @@ use crate::{
};
pub async fn handle_dm_message(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

6
gateway/src/handler/direct_message/start.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -8,7 +8,7 @@ use crate::{
};
pub async fn handle_dm_start(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -88,7 +88,7 @@ pub async fn handle_dm_start(
}
pub async fn handle_dm_read_ack(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

351
gateway/src/handler/dispatch.rs
View file

@ -1,4 +1,5 @@
use anyhow::Result;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::debug;
use crate::{
@ -11,174 +12,402 @@ use crate::{
use super::{Ctx, channel, content, direct_message, friends, guild};
pub async fn dispatch(
ctx: &mut Ctx<'_>,
pub async fn dispatch<S: AsyncRead + AsyncWrite + Unpin>(
ctx: &mut Ctx<'_, S>,
session_id: &str,
pid: PacketId,
payload: &[u8],
addr: std::net::SocketAddr,
) -> Result<()> {
let Ctx {
stream,
seq,
crypto,
state,
} = ctx;
match pid {
PacketId::Ping => {
let ping: PingPayload = serde_json::from_slice(payload)?;
io::send_encrypted(
stream,
ctx.stream,
PacketId::Pong,
seq,
ctx.seq,
&to_payload(&PongPayload {
timestamp: ping.timestamp,
}),
crypto,
ctx.crypto,
)
.await?;
}
PacketId::JoinChannel => {
let m: JoinChannelPayload = serde_json::from_slice(payload)?;
channel::join(stream, seq, session_id, &m.channel_id, crypto, state).await?;
channel::join(ctx.stream, ctx.seq, session_id, &m.channel_id, ctx.crypto, ctx.state)
.await?;
}
PacketId::LeaveChannel => {
let m: LeaveChannelPayload = serde_json::from_slice(payload)?;
channel::leave(stream, seq, session_id, &m.channel_id, crypto, state).await?;
channel::leave(ctx.stream, ctx.seq, session_id, &m.channel_id, ctx.crypto, ctx.state)
.await?;
}
PacketId::ChannelCreate => {
channel::handle_channel_create(stream, seq, session_id, payload, crypto, state).await?;
channel::handle_channel_create(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::ChannelDelete => {
channel::handle_channel_delete(stream, seq, session_id, payload, crypto, state).await?;
channel::handle_channel_delete(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::ChannelList => {
channel::handle_channel_list(stream, seq, session_id, crypto, state).await?;
channel::handle_channel_list(ctx.stream, ctx.seq, session_id, ctx.crypto, ctx.state)
.await?;
}
PacketId::ChatMessage => {
let m: ChatMessagePayload = serde_json::from_slice(payload)?;
content::chat::handle(session_id, m, state).await?;
content::chat::handle(session_id, m, ctx.state).await?;
}
PacketId::DmStart => {
direct_message::handle_dm_start(stream, seq, session_id, payload, crypto, state)
.await?;
direct_message::handle_dm_start(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::DmMessage => {
direct_message::handle_dm_message(stream, seq, session_id, payload, crypto, state)
.await?;
direct_message::handle_dm_message(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::DmHistory => {
direct_message::handle_dm_history(stream, seq, session_id, payload, crypto, state)
.await?;
direct_message::handle_dm_history(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::DmReadAck => {
direct_message::handle_dm_read_ack(stream, seq, session_id, payload, crypto, state)
.await?;
direct_message::handle_dm_read_ack(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildCreate => {
guild::handle_guild_create(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_guild_create(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildDelete => {
guild::handle_guild_delete(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_guild_delete(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildList => {
guild::handle_guild_list(stream, seq, session_id, crypto, state).await?;
guild::handle_guild_list(ctx.stream, ctx.seq, session_id, ctx.crypto, ctx.state)
.await?;
}
PacketId::GuildMemberJoin => {
guild::handle_guild_member_join(stream, seq, session_id, payload, crypto, state)
.await?;
guild::handle_guild_member_join(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildMemberLeave => {
guild::handle_guild_member_leave(stream, seq, session_id, payload, crypto, state)
.await?;
guild::handle_guild_member_leave(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildMemberKick => {
guild::handle_guild_member_kick(stream, seq, session_id, payload, crypto, state)
.await?;
guild::handle_guild_member_kick(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::RoleCreate => {
guild::handle_role_create(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_role_create(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::RoleDelete => {
guild::handle_role_delete(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_role_delete(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::InviteCreate => {
guild::handle_invite_create(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_invite_create(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::InviteAccept => {
guild::handle_invite_accept(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_invite_accept(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::InviteDelete => {
guild::handle_invite_delete(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_invite_delete(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildAuditLogFetch => {
guild::handle_audit_log_fetch(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_audit_log_fetch(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildMemberListFetch => {
guild::handle_member_list_fetch(stream, seq, session_id, payload, crypto, state)
.await?;
guild::handle_member_list_fetch(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildRoleAssign => {
guild::handle_role_assign(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_role_assign(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildRoleUnassign => {
guild::handle_role_unassign(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_role_unassign(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::GuildRoleListFetch => {
guild::handle_role_list_fetch(stream, seq, session_id, payload, crypto, state).await?;
guild::handle_role_list_fetch(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::PresenceUpdate => {
content::presence::handle_presence_update(
stream, seq, session_id, payload, crypto, state,
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::PresenceSync => {
content::presence::handle_presence_sync(stream, seq, session_id, crypto, state).await?;
content::presence::handle_presence_sync(
ctx.stream,
ctx.seq,
session_id,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::FriendRequest => {
friends::handle_friend_request(stream, seq, session_id, payload, crypto, state).await?;
friends::handle_friend_request(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::FriendAccept => {
friends::handle_friend_accept(stream, seq, session_id, payload, crypto, state).await?;
friends::handle_friend_accept(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::FriendDecline => {
friends::handle_friend_decline(stream, seq, session_id, payload, crypto, state).await?;
friends::handle_friend_decline(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::FriendRemove => {
friends::handle_friend_remove(stream, seq, session_id, payload, crypto, state).await?;
friends::handle_friend_remove(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::FriendList => {
friends::handle_friend_list(stream, seq, session_id, crypto, state).await?;
friends::handle_friend_list(ctx.stream, ctx.seq, session_id, ctx.crypto, ctx.state)
.await?;
}
PacketId::BlockUser => {
friends::handle_block_user(stream, seq, session_id, payload, crypto, state).await?;
friends::handle_block_user(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::UnblockUser => {
friends::handle_unblock_user(stream, seq, session_id, payload, crypto, state).await?;
friends::handle_unblock_user(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::BlockList => {
friends::handle_block_list(stream, seq, session_id, crypto, state).await?;
friends::handle_block_list(ctx.stream, ctx.seq, session_id, ctx.crypto, ctx.state)
.await?;
}
PacketId::MessageReactionAdd => {
let m: ReactionPayload = serde_json::from_slice(payload)?;
content::reaction::handle_reaction_add(session_id, m, state).await?;
content::reaction::handle_reaction_add(session_id, m, ctx.state).await?;
}
PacketId::MessageReactionRemove => {
let m: ReactionPayload = serde_json::from_slice(payload)?;
content::reaction::handle_reaction_remove(session_id, m, state).await?;
content::reaction::handle_reaction_remove(session_id, m, ctx.state).await?;
}
PacketId::MessageEdit => {
content::message_edit::handle_message_edit(session_id, payload, state).await?;
content::message_edit::handle_message_edit(session_id, payload, ctx.state).await?;
}
PacketId::MessageDelete => {
content::message_edit::handle_message_delete(session_id, payload, state).await?;
content::message_edit::handle_message_delete(session_id, payload, ctx.state).await?;
}
PacketId::TypingStart => {
content::handle_typing_start(session_id, payload, state).await?;
content::handle_typing_start(session_id, payload, ctx.state).await?;
}
PacketId::ReadReceipt => {
content::handle_read_receipt(stream, seq, session_id, payload, crypto, state).await?;
content::handle_read_receipt(
ctx.stream,
ctx.seq,
session_id,
payload,
ctx.crypto,
ctx.state,
)
.await?;
}
PacketId::Disconnect => debug!("{addr} DISCONNECT"),
other => debug!("{addr} unhandled {:?}", other),

4
gateway/src/handler/friends/decline.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -8,7 +8,7 @@ use crate::{
};
pub async fn handle_friend_decline(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

4
gateway/src/handler/friends/list.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -8,7 +8,7 @@ use crate::{
};
pub async fn handle_friend_list(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
crypto: &SessionCrypto,

10
gateway/src/handler/friends/manage.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -11,7 +11,7 @@ use crate::{
};
pub async fn handle_friend_remove(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -40,7 +40,7 @@ pub async fn handle_friend_remove(
}
pub async fn handle_block_user(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -69,7 +69,7 @@ pub async fn handle_block_user(
}
pub async fn handle_unblock_user(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -98,7 +98,7 @@ pub async fn handle_unblock_user(
}
pub async fn handle_block_list(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
crypto: &SessionCrypto,

4
gateway/src/handler/friends/mod.rs
View file

@ -4,7 +4,7 @@ mod manage;
mod requests;
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
net::io,
@ -12,7 +12,7 @@ use crate::{
};
async fn send_err(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
code: crate::proto::ErrorCode,
msg: &str,

6
gateway/src/handler/friends/requests.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -16,7 +16,7 @@ use crate::{
use super::send_err;
pub async fn handle_friend_request(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -100,7 +100,7 @@ pub async fn handle_friend_request(
}
pub async fn handle_friend_accept(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

4
gateway/src/handler/guild/audit.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::permissions::Permissions,
@ -12,7 +12,7 @@ use crate::{
/// Fetch audit log entries for a guild (admin-only: requires VIEW_AUDIT_LOG or owner).
pub async fn handle_audit_log_fetch(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

6
gateway/src/handler/guild/crud.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::debug;
use crate::{
@ -11,7 +11,7 @@ use crate::{
use super::send_err;
pub async fn handle_guild_create(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -67,7 +67,7 @@ pub async fn handle_guild_create(
}
pub async fn handle_guild_delete(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

8
gateway/src/handler/guild/invites.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::{permissions::Permissions, session},
@ -13,7 +13,7 @@ use crate::{
use super::{now_ms, send_err};
pub async fn handle_invite_create(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -89,7 +89,7 @@ pub async fn handle_invite_create(
}
pub async fn handle_invite_accept(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -164,7 +164,7 @@ pub async fn handle_invite_accept(
}
pub async fn handle_invite_delete(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

4
gateway/src/handler/guild/list.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::session,
@ -8,7 +8,7 @@ use crate::{
};
pub async fn handle_guild_list(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
crypto: &SessionCrypto,

8
gateway/src/handler/guild/members.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::{permissions::Permissions, session},
@ -13,7 +13,7 @@ use crate::{
use super::send_err;
pub async fn handle_guild_member_join(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -63,7 +63,7 @@ pub async fn handle_guild_member_join(
}
pub async fn handle_guild_member_leave(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -96,7 +96,7 @@ pub async fn handle_guild_member_leave(
}
pub async fn handle_guild_member_kick(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

10
gateway/src/handler/guild/members_list.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::{permissions::Permissions, session},
@ -15,7 +15,7 @@ use super::{require_perm, send_err};
/// Fetch the member list for a guild (visible to all members).
pub async fn handle_member_list_fetch(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -65,7 +65,7 @@ pub async fn handle_member_list_fetch(
/// Assign a role to a user (admin only: requires MANAGE_ROLES).
pub async fn handle_role_assign(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -129,7 +129,7 @@ pub async fn handle_role_assign(
/// Remove a role from a user (admin only: requires MANAGE_ROLES).
pub async fn handle_role_unassign(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -192,7 +192,7 @@ pub async fn handle_role_unassign(
/// Fetch all roles defined in a guild (visible to all members).
pub async fn handle_role_list_fetch(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

4
gateway/src/handler/guild/mod.rs
View file

@ -7,7 +7,7 @@ mod members_list;
mod roles;
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::permissions::Permissions,
@ -16,7 +16,7 @@ use crate::{
};
async fn send_err(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
code: crate::proto::ErrorCode,
msg: &str,

6
gateway/src/handler/guild/roles.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{
domain::{permissions::Permissions, session},
@ -10,7 +10,7 @@ use crate::{
use super::send_err;
pub async fn handle_role_create(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],
@ -73,7 +73,7 @@ pub async fn handle_role_create(
}
pub async fn handle_role_delete(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
session_id: &str,
payload: &[u8],

6
gateway/src/handler/mod.rs
View file

@ -10,12 +10,12 @@ pub mod run;
pub use dispatch::dispatch;
pub use run::run_session;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use crate::{net::state::State, proto::SessionCrypto};
pub struct Ctx<'a> {
pub stream: &'a mut TcpStream,
pub struct Ctx<'a, S: AsyncRead + AsyncWrite + Unpin> {
pub stream: &'a mut S,
pub seq: &'a mut u32,
pub crypto: &'a SessionCrypto,
pub state: &'a State,

6
gateway/src/handler/run.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tokio::sync::broadcast;
use tracing::warn;
@ -10,8 +10,8 @@ use crate::{
use super::{Ctx, deliver::deliver_encrypted, dispatch};
pub async fn run_session(
stream: &mut TcpStream,
pub async fn run_session<S: AsyncRead + AsyncWrite + Unpin>(
stream: &mut S,
addr: std::net::SocketAddr,
seq: &mut u32,
session_id: &str,

82
gateway/src/lib.rs
View file

@ -8,14 +8,15 @@ pub mod proto;
use anyhow::Result;
use std::sync::Arc;
use std::sync::atomic::AtomicUsize;
use tokio::io::{AsyncRead, AsyncWrite};
use tokio::net::TcpListener;
use tokio::sync::broadcast;
use tracing::{debug, error, info, warn};
use domain::{channels, config, session, storage};
use net::state::State;
use net::state::{State, VoiceMemberTx};
pub async fn run(cfg: Arc<config::Config>) -> Result<()> {
pub async fn run(cfg: Arc<config::Config>, voice_member_tx: Option<VoiceMemberTx>) -> Result<()> {
let private_mode = cfg.is_private();
if private_mode {
info!("private mode enabled, federation disabled");
@ -74,6 +75,7 @@ pub async fn run(cfg: Arc<config::Config>) -> Result<()> {
metrics.clone(),
sessions_count.clone(),
channels_count.clone(),
voice_member_tx,
);
let admin_bind = cfg
@ -95,11 +97,52 @@ pub async fn run(cfg: Arc<config::Config>) -> Result<()> {
let listener = TcpListener::bind(&cfg.gateway.bind).await?;
info!("listening on {}", cfg.gateway.bind);
if cfg.gateway.tls_enabled {
run_tls(listener, cfg, state).await
} else {
run_plain(listener, state).await
}
}
async fn run_tls(listener: TcpListener, cfg: Arc<config::Config>, state: State) -> Result<()> {
let (certs, key) = load_or_generate_tls_certs(&cfg.gateway)?;
if cfg.gateway.tls_cert_path.is_none() {
warn!("using self-signed TLS certificate — clients must accept it manually");
}
let server_config = rustls::ServerConfig::builder()
.with_no_client_auth()
.with_single_cert(certs, key)?;
let acceptor = tokio_rustls::TlsAcceptor::from(Arc::new(server_config));
loop {
match listener.accept().await {
Ok((stream, addr)) => {
info!("connection from {addr} (TLS)");
state.metrics.inc(&state.metrics.connections_total);
let s = state.clone();
let acceptor = acceptor.clone();
tokio::spawn(async move {
match acceptor.accept(stream).await {
Ok(tls_stream) => {
if let Err(e) = handle(tls_stream, addr, s).await {
debug!("{addr} closed: {e}");
}
}
Err(e) => error!("TLS accept error from {addr}: {e}"),
}
});
}
Err(e) => error!("accept: {e}"),
}
}
}
async fn run_plain(listener: TcpListener, state: State) -> Result<()> {
loop {
match listener.accept().await {
Ok((stream, addr)) => {
info!("connection from {addr}");
metrics.inc(&metrics.connections_total);
state.metrics.inc(&state.metrics.connections_total);
let s = state.clone();
tokio::spawn(async move {
if let Err(e) = handle(stream, addr, s).await {
@ -112,8 +155,8 @@ pub async fn run(cfg: Arc<config::Config>) -> Result<()> {
}
}
async fn handle(
mut stream: tokio::net::TcpStream,
async fn handle<S: AsyncRead + AsyncWrite + Unpin + Send + 'static>(
mut stream: S,
addr: std::net::SocketAddr,
state: State,
) -> Result<()> {
@ -164,3 +207,32 @@ async fn handle(
debug!("{addr} cleaned up");
result
}
fn load_or_generate_tls_certs(
cfg: &config::GatewayConfig,
) -> Result<(
Vec<rustls::pki_types::CertificateDer<'static>>,
rustls::pki_types::PrivateKeyDer<'static>,
)> {
use rustls::pki_types::pem::PemObject;
use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
match (&cfg.tls_cert_path, &cfg.tls_key_path) {
(Some(cert_path), Some(key_path)) => {
let cert_pem = std::fs::read_to_string(cert_path)?;
let key_pem = std::fs::read_to_string(key_path)?;
let cert = CertificateDer::from_pem_reader(&mut cert_pem.as_bytes())?;
let key = PrivateKeyDer::from_pem_reader(&mut key_pem.as_bytes())?;
Ok((vec![cert], key))
}
_ => {
info!("No TLS cert/key configured, generating self-signed certificate");
let certified_key = rcgen::generate_simple_self_signed(vec!["VNOX Server".into()])?;
let cert_der = certified_key.cert.der().clone();
let key_der = PrivateKeyDer::from(PrivatePkcs8KeyDer::from(
certified_key.key_pair.serialize_der(),
));
Ok((vec![cert_der], key_der))
}
}
}

2
gateway/src/main.rs
View file

@ -8,5 +8,5 @@ async fn main() -> Result<()> {
.init();
let cfg = Arc::new(vnox_gateway::domain::config::load()?);
vnox_gateway::run(cfg).await
vnox_gateway::run(cfg, None).await
}

4
gateway/src/net/handshake.rs
View file

@ -1,5 +1,5 @@
use anyhow::Result;
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncWrite};
use tracing::{debug, info, warn};
use crate::{
@ -16,7 +16,7 @@ const LNEX_VERSION: &str = "v1";
/// Returns the session and the derived crypto context (encryption keys).
/// All subsequent packets must be encrypted with `crypto`.
pub async fn run(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
addr: std::net::SocketAddr,
state: &State,
seq: &mut u32,

29
gateway/src/net/io.rs
View file

@ -1,6 +1,5 @@
use anyhow::Result;
use tokio::io::{AsyncReadExt, AsyncWriteExt};
use tokio::net::TcpStream;
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
use crate::proto::{
ErrorCode, ErrorPayload, PacketHeader, PacketId, SessionCrypto, encode_packet, flags,
@ -9,10 +8,8 @@ use crate::proto::{
const MAX_PAYLOAD: u32 = 4 * 1024 * 1024;
// ─── Unencrypted IO (used during handshake) ─────────────────────────────────
pub async fn send_packet(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
id: PacketId,
seq: &mut u32,
payload: &[u8],
@ -24,7 +21,7 @@ pub async fn send_packet(
}
pub async fn send_error(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
seq: &mut u32,
code: ErrorCode,
msg: &str,
@ -37,7 +34,9 @@ pub async fn send_error(
send_packet(stream, PacketId::Error, seq, &to_payload(&p)).await
}
pub async fn read_packet(stream: &mut TcpStream) -> Result<(PacketHeader, Vec<u8>)> {
pub async fn read_packet(
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
) -> Result<(PacketHeader, Vec<u8>)> {
let mut buf = [0u8; PacketHeader::SIZE];
stream.read_exact(&mut buf).await?;
let hdr = PacketHeader::from_bytes(&buf);
@ -54,12 +53,8 @@ pub async fn read_packet(stream: &mut TcpStream) -> Result<(PacketHeader, Vec<u8
Ok((hdr, payload))
}
// ─── Encrypted IO (used after handshake) ─────────────────────────────────────
/// Send an encrypted packet (server → client).
/// Sets the ENCRYPTED flag and encrypts the payload with s2c_key.
pub async fn send_encrypted(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
id: PacketId,
seq: &mut u32,
payload: &[u8],
@ -81,10 +76,8 @@ pub async fn send_encrypted(
Ok(())
}
/// Read and decrypt a packet (client → server).
/// Verifies the ENCRYPTED flag and decrypts with c2s_key.
pub async fn read_encrypted(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
crypto: &SessionCrypto,
) -> Result<(PacketHeader, Vec<u8>)> {
let mut buf = [0u8; PacketHeader::SIZE];
@ -107,12 +100,8 @@ pub async fn read_encrypted(
Ok((hdr, payload))
}
/// Re-encode and deliver a pre-encoded broadcast packet with encryption.
///
/// Extracts the packet ID from the pre-encoded `raw_data`, re-encodes
/// with the correct sequence and encryption for this recipient.
pub async fn deliver_encrypted(
stream: &mut TcpStream,
stream: &mut (impl AsyncRead + AsyncWrite + Unpin),
crypto: &SessionCrypto,
seq: &mut u32,
raw_data: &[u8],

10
gateway/src/net/state.rs
View file

@ -1,7 +1,7 @@
use std::collections::HashMap;
use std::sync::Arc;
use std::sync::atomic::AtomicUsize;
use tokio::sync::{RwLock, broadcast};
use std::sync::Arc;
use tokio::sync::{broadcast, RwLock};
use crate::admin::metrics::Metrics;
use crate::bootstrap::server_identity::ServerIdentity;
@ -11,6 +11,8 @@ use crate::domain::{
};
use crate::proto::PresenceInfo;
pub type VoiceMemberTx = tokio::sync::broadcast::Sender<String>;
#[derive(Clone)]
pub struct State {
pub sessions: SessionStore,
@ -30,6 +32,8 @@ pub struct State {
pub channels_count: Arc<AtomicUsize>,
/// Per-session rate limiter (token bucket).
pub rate_limiter: Arc<RateLimiter>,
/// Gateway → voice-node membership bridge.
pub voice_member_tx: Option<VoiceMemberTx>,
}
impl State {
@ -44,6 +48,7 @@ impl State {
metrics: Arc<Metrics>,
sessions_count: Arc<AtomicUsize>,
channels_count: Arc<AtomicUsize>,
voice_member_tx: Option<VoiceMemberTx>,
) -> Self {
let rate_per_sec = config.gateway.message_rate_per_sec.unwrap_or(5.0);
let burst = config.gateway.message_rate_burst.unwrap_or(10);
@ -60,6 +65,7 @@ impl State {
sessions_count,
channels_count,
rate_limiter,
voice_member_tx,
}
}
}