feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/shared/MoShiro.Measurement/Net/Tcp.cs

@@ -5,6 +5,7 @@ using System.Net.Sockets;
 using System.Security.Authentication;
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
+using Fleet.Identity;
 using MoShiro.Protocol;
 
 namespace MoShiro.Measurement;
@@ -46,6 +47,12 @@ public sealed class TcpLink : IDisposable
             await client.ConnectAsync(env.PeerAddress!, port, ct);
             long tcpUs = env.Clock.NowUs() - start;
             Stream stream = client.GetStream();
+            if (env.KnockKey is { } knockKey)
+            {
+                // 预握手敲门：监听方不认就不会回任何字节
+                await stream.WriteAsync(Knock.Build(knockKey, env.Time.GetUtcNow().ToUnixTimeMilliseconds()), ct);
+            }
+
             long? tlsUs = null;
             if (tls)
             {
@@ -115,7 +122,7 @@ public sealed class TcpConnection
 public delegate Task TcpResponder(TcpConnection connection, CancellationToken ct);
 
 /// <summary>
-/// 监听方的 TCP 数据面：每个端口一个监听器。连接的第一个字节是 0x16 就先做 TLS（节点自己的证书），否则直接是明文。
+/// 监听方的 TCP 数据面：每个端口一个监听器。连接先过预握手敲门，然后第一个字节是 0x16 就先做 TLS（节点自己的证书），否则直接是明文。
 /// 随后是认证首帧（<c>"MN" | ver | session_id | stream_id | nonce | mac</c>，随机数只能用一次），通过之后交给按 <c>stream_id</c> 登记的处理函数。
 /// 首帧在限定时间内没有到达或者校验失败，直接关闭连接并计数。
 /// </summary>
@@ -128,11 +135,13 @@ public sealed class TcpAcceptor
     private readonly X509Certificate2 _certificate;
     private readonly IDataSessions _sessions;
     private readonly DataPlaneCounters _counters;
+    private readonly KnockGate _knock;
     private readonly ConcurrentDictionary<uint, TcpResponder> _handlers = new();
     private readonly List<TcpListener> _listeners = [];
 
-    public TcpAcceptor(IPAddress bind, IReadOnlyList<int> ports, X509Certificate2 certificate, IDataSessions sessions, DataPlaneCounters counters)
+    public TcpAcceptor(IPAddress bind, IReadOnlyList<int> ports, X509Certificate2 certificate, IDataSessions sessions, DataPlaneCounters counters, KnockGate knock)
     {
+        _knock = knock;
         _bind = bind;
         _ports = ports;
         _certificate = certificate;
@@ -214,6 +223,13 @@ public sealed class TcpAcceptor
                 using var authCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
                 authCts.CancelAfter(s_authTimeout);
 
+                // 预握手敲门：名册里的 Probe 才算得出敲门包；不通过就不写任何字节、直接断开
+                if (!await _knock.AdmitAsync(stream, (client.Client.RemoteEndPoint as IPEndPoint)?.Address, authCts.Token))
+                {
+                    _counters.DropInvalid();
+                    return;
+                }
+
                 byte[] first = new byte[1];
                 if (await stream.ReadAsync(first, authCts.Token) != 1)
                 {