feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/agent/src/MoShiro.Agent/AgentApp.cs

@@ -1,3 +1,4 @@
+using Fleet.Identity;
 using System.Net;
 using System.Text.Json;
 using Fleet.Core;
@@ -16,6 +17,7 @@ public sealed class AgentApp : IDisposable
 
     private readonly AgentConfig _config;
     private readonly bool _ipv6Supported;
+    private readonly KnockGate _knock;
     private readonly RestartController _restart;
     private readonly RestartController? _ownedRestart;
     private readonly LoadedNodeIdentity _identity;
@@ -60,7 +62,9 @@ public sealed class AgentApp : IDisposable
         _ipv6Supported = bind.AddressFamily == System.Net.Sockets.AddressFamily.InterNetworkV6;
         _admission = new AgentAdmission(_streams);
         _udp = new UdpMux(_sessions, _admission, _clock, _counters.Data, log, bind, config.Listen.UdpPorts);
-        _tcp = new TcpAcceptor(bind, config.Listen.TcpPorts, identity.Certificate, _sessions, _counters.Data);
+        // 预握手敲门：控制端口和数据端口共用一个关卡（限速和去重一起算）；名册就是期望状态里的 peers
+        _knock = new KnockGate(identity.PeerIdentity, RosterKeys, time);
+        _tcp = new TcpAcceptor(bind, config.Listen.TcpPorts, identity.Certificate, _sessions, _counters.Data, _knock);
 
         // 监听方积木的环境：和 Probe 的拨号方共用同一套积木，区别只在这里装配的部分（准入策略、TCP 监听）
         var env = new BlockEnv
@@ -92,6 +96,7 @@ public sealed class AgentApp : IDisposable
                 Listen = new IPEndPoint(bind, config.Listen.ControlPort),
                 Certificate = identity.Certificate,
                 LookupPeerKey = _tasks.LookupPeerKey,
+                Knock = _knock,
             },
             _hub.OnSessionAsync,
             log,
@@ -284,6 +289,9 @@ public sealed class AgentApp : IDisposable
         return link;
     }
 
+    /// <summary>敲门关卡的名册：期望状态里的 peers（任务管理器在构造之后才有）。</summary>
+    private IReadOnlyList<byte[]> RosterKeys() => _tasks.PeerKeys();
+
     private JsonElement? HelloMeta()
     {
         var meta = new AgentHelloMeta
@@ -292,7 +300,7 @@ public sealed class AgentApp : IDisposable
             Ipv6Supported = _ipv6Supported,
             Addresses = [.. LocalAddresses.Sample()],
             Platform = MoShiro.Measurement.PlatformDetector.Detect(),
-            TlsSpki = _identity.File.TlsSpki,
+            TlsPublicKey = Convert.ToBase64String(_identity.Certificate.PublicKey.ExportSubjectPublicKeyInfo()),
             ProbeTcpPort = ControlPort,
             ProbeUdpPorts = [.. UdpPorts],
             LocalLimits = new LocalLimits

backend/agent/src/MoShiro.Agent/Tasks/TaskManager.cs

@@ -52,6 +52,9 @@ public sealed class TaskManager
     /// <summary>点对点握手时查找 Probe 的公钥（SPKI）。</summary>
     public byte[]? LookupPeerKey(string peerId) => _peers.TryGetValue(peerId, out byte[]? key) ? key : null;
 
+    /// <summary>名册里全部 Probe 的公钥：敲门关卡用它们派生配对密钥。</summary>
+    public IReadOnlyList<byte[]> PeerKeys() => [.. _peers.Values];
+
     /// <summary>一个新的 Probe 会话开始：为它登记全部线路任务的流并启动监听方积木，返回要下发给它的线路任务集。</summary>
     public LineTaskSet OpenSession(ProbeSession probe)
     {