feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/tests/MoShiro.TestSupport/AgentSimulator.cs

@@ -18,6 +18,7 @@ namespace MoShiro.TestSupport;
 public sealed class AgentSimulator : IAsyncDisposable
 {
     private readonly NodeIdentity _identity;
+    private readonly NodeIdentity _tlsKey = NodeIdentity.Generate();
     private readonly ClientWebSocket _socket = new();
     private readonly ConcurrentDictionary<Guid, TaskCompletionSource<bool>> _acks = new();
     private readonly ConcurrentDictionary<long, TaskCompletionSource<RpcMessage>> _responses = new();
@@ -71,6 +72,9 @@ public sealed class AgentSimulator : IAsyncDisposable
 
     public byte[] PublicKey => _identity.PublicKeySpki;
 
+    /// <summary>hello 里上报的 TLS 证书公钥（Probe 用它固定证书、派生敲门密钥）。</summary>
+    public byte[] TlsPublicKey => _tlsKey.PublicKeySpki;
+
     /// <summary>用这个节点的私钥为认证随机数签名（可以冒充别的节点 ID：用来测试服务端的校验）。</summary>
     public byte[] SignAuth(NodeId claimedNode, string nonce) => _identity.Sign(SignaturePurpose.Auth, claimedNode.Value, nonce);
 
@@ -147,7 +151,7 @@ public sealed class AgentSimulator : IAsyncDisposable
         var meta = JsonSerializer.SerializeToElement(
             new AgentHelloMeta
             {
-                TlsSpki = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32)),
+                TlsPublicKey = Convert.ToBase64String(_tlsKey.PublicKeySpki),
                 Addresses = Addresses is null ? null : [.. Addresses],
                 ProbeTcpPort = 7443,
                 ProbeUdpPorts = [7443],

backend/tests/MoShiro.TestSupport/ProbeSimulator.cs

@@ -20,6 +20,7 @@ namespace MoShiro.TestSupport;
 public sealed class ProbeSimulator : IAsyncDisposable
 {
     private readonly NodeIdentity _identity;
+    private byte[]? _agentKey;
     private readonly RpcRouter<ProbeSimulator> _router;
     private readonly ConcurrentDictionary<Guid, TaskCompletionSource> _acks = new();
     private readonly ConcurrentDictionary<uint, EchoCollector> _echoes = new();
@@ -65,11 +66,12 @@ public sealed class ProbeSimulator : IAsyncDisposable
 
     public long NowUs() => (TimeProvider.System.GetTimestamp() - _origin) * 1_000_000 / TimeProvider.System.TimestampFrequency;
 
-    public async Task ConnectAsync(string host, int controlPort, byte[] agentSpkiSha256, int udpPort, NodeId agentId, TimeProvider? time = null, CancellationToken ct = default)
+    public async Task ConnectAsync(string host, int controlPort, byte[] agentPublicKey, int udpPort, NodeId agentId, TimeProvider? time = null, CancellationToken ct = default)
     {
         _agentId = agentId;
-        (PeerSessionInfo info, TlsFrameTransport transport) = await PeerConnector.ConnectAsync(host, controlPort, agentSpkiSha256, _identity, ProbeId, "0.0.0-sim", 8 << 20, time ?? TimeProvider.System, ct);
+        (PeerSessionInfo info, TlsFrameTransport transport) = await PeerConnector.ConnectAsync(host, controlPort, agentPublicKey, _identity, ProbeId, "0.0.0-sim", 8 << 20, time ?? TimeProvider.System, ct);
         _info = info;
+        _agentKey = agentPublicKey;
         _udp = new UdpClient(new IPEndPoint(IPAddress.Loopback, 0));
         _agentUdp = new IPEndPoint(IPAddress.Parse(host), udpPort);
         _rpc = new RpcSession<ProbeSimulator>(transport, _router, this, time ?? TimeProvider.System);
@@ -152,6 +154,7 @@ public sealed class ProbeSimulator : IAsyncDisposable
         using var client = new System.Net.Sockets.TcpClient();
         await client.ConnectAsync(IPAddress.Loopback, tcpPort, ct);
         Stream stream = client.GetStream();
+        await stream.WriteAsync(Knock.Build(Knock.DeriveKey(_identity, _agentKey!), TimeProvider.System.GetUtcNow().ToUnixTimeMilliseconds()), ct); // 预握手敲门
         if (tls)
         {
 #pragma warning disable CA5359 // 测试：Agent 的证书是自签名的，这里只验证数据面