peer sends encrypted relay auth

client.go

@@ -426,6 +426,8 @@ type ClientStatus struct {
 	Status statusc.Status `json:"status"`
 	// Metadata is the metadata field send to the control server and other peers
 	Metadata string `json:"metadata"`
+	// BuildVersion shows the build information of the client
+	BuildVersion string `json:"build-version"`
 	// ServerAddr reports which server this client is connected
 	ServerAddr string `json:"server-address"`
 	// DirectAddr reports local direct connectsions server
@@ -460,6 +462,7 @@ func (c *Client) Status(ctx context.Context) (ClientStatus, error) {
 
 	return ClientStatus{
 		Status:       stat,
+		BuildVersion: model.BuildVersion(),
 		Metadata:     c.metadata,
 		ServerAddr:   c.controlAddr.String(),
 		DirectAddr:   c.directAddr.String(),

cmd/connet/relay.go

@@ -114,6 +114,7 @@ func relayRun(ctx context.Context, cfg RelayConfig, logger *slog.Logger) error {
 	for ix, ingressCfg := range cfg.Ingresses {
 		if ingressCfg.Addr == "" && !usedDefault {
 			ingressCfg.Addr = ":19191"
+			ingressCfg.Hostports = []string{"localhost:19191"}
 			usedDefault = true
 		}
 		if ingress, err := ingressCfg.parse(); err != nil {

endpoint.go

@@ -16,7 +16,6 @@ import (
 	"github.com/connet-dev/connet/pkg/statusc"
 	"github.com/connet-dev/connet/proto"
 	"github.com/connet-dev/connet/proto/pbclient"
-	"github.com/connet-dev/connet/proto/pbclientrelay"
 	"github.com/quic-go/quic-go"
 )
 
@@ -55,7 +54,7 @@ type endpoint struct {
 //   - an error happens in runPeer
 //   - a terminal error happens in runAnnounce
 func newEndpoint(ctx context.Context, cl *Client, cfg endpointConfig, logger *slog.Logger) (*endpoint, error) {
-	p, err := newPeer(cl.directServer, cl.addrs, logger)
+	p, err := newPeer(cl.directServer, cl.addrs, cl.metadata, logger)
 	if err != nil {
 		return nil, err
 	}
@@ -284,27 +283,15 @@ func (ep *endpoint) runRelay(ctx context.Context, conn *quic.Conn) error {
 				return fmt.Errorf("relay unexpected response")
 			}
 
-			var relays []relayPeer
-			relays = append(relays, iterc.MapSlice(resp.Relay.Relays, func(relay *pbclient.Relay) relayPeer {
-				return relayPeer{proto: &pbclient.DirectRelay{
+			var relays []*pbclient.DirectRelay
+			relays = append(relays, iterc.MapSlice(resp.Relay.Relays, func(relay *pbclient.Relay) *pbclient.DirectRelay {
+				return &pbclient.DirectRelay{
 					Id:                relay.Id,
 					Addresses:         relay.Addresses,
 					ServerCertificate: relay.ServerCertificate,
-				}}
-			})...)
-			relays = append(relays, iterc.MapSlice(resp.Relay.Directs, func(relay *pbclient.DirectRelay) relayPeer {
-				return relayPeer{
-					proto: relay,
-					auth: &pbclientrelay.AuthenticateReq{
-						Endpoint:                ep.cfg.endpoint.PB(),
-						Role:                    ep.cfg.role.PB(),
-						AuthenticationSignature: relay.AuthenticationSignature,
-						Metadata:                ep.client.metadata,
-						BuildVersion:            model.BuildVersion(),
-					},
 				}
-
 			})...)
+			relays = append(relays, resp.Relay.Directs...)
 
 			ep.peer.setRelays(relays)
 		}

nix/package.nix

@@ -24,7 +24,7 @@ pkgs.buildGoModule
     fileset = sourceFiles;
   };
 
-  vendorHash = "sha256-2OoJhngBZJ/u7GPDec4Bg0Dq/DMseFbENLGfJAYzj1o=";
+  vendorHash = "sha256-pNuIzSxAxv9KbpOFE0JYJ/ZO9rdVY+AT2erNBVMcyiI=";
   subPackages = [ "cmd/connet" ];
   ldflags = [ "-X 'github.com/connet-dev/connet/model.Version=${lib.strings.fileContents ../VERSION}'" ];
 

peer.go

@@ -21,7 +21,6 @@ import (
 	"github.com/connet-dev/connet/pkg/notify"
 	"github.com/connet-dev/connet/pkg/reliable"
 	"github.com/connet-dev/connet/proto/pbclient"
-	"github.com/connet-dev/connet/proto/pbclientrelay"
 	"github.com/connet-dev/connet/proto/pbconnect"
 	"github.com/connet-dev/connet/proto/pbmodel"
 	"github.com/quic-go/quic-go"
@@ -30,14 +29,15 @@ import (
 type peer struct {
 	self *notify.V[*pbclient.Peer]
 
-	relays     *notify.V[[]relayPeer]
+	relays     *notify.V[[]*pbclient.DirectRelay]
 	relayConns *notify.V[map[relayID]*quic.Conn]
 
 	peers     *notify.V[[]*pbclient.RemotePeer]
 	peerConns *notify.V[map[peerConnKey]*quic.Conn]
 
-	direct *directServer
-	addrs  *notify.V[advertiseAddrs]
+	direct   *directServer
+	addrs    *notify.V[advertiseAddrs]
+	metadata string
 
 	serverCert tls.Certificate
 	clientCert tls.Certificate
@@ -86,12 +86,7 @@ func (s peerStyle) isRelay() bool {
 	return !s.isDirect()
 }
 
-type relayPeer struct {
-	proto *pbclient.DirectRelay
-	auth  *pbclientrelay.AuthenticateReq
-}
-
-func newPeer(direct *directServer, addrs *notify.V[advertiseAddrs], logger *slog.Logger) (*peer, error) {
+func newPeer(direct *directServer, addrs *notify.V[advertiseAddrs], metadata string, logger *slog.Logger) (*peer, error) {
 	root, err := certc.NewRoot()
 	if err != nil {
 		return nil, err
@@ -124,22 +119,23 @@ func newPeer(direct *directServer, addrs *notify.V[advertiseAddrs], logger *slog
 			ClientCertificate: clientTLSCert.Leaf.Raw,
 		}),
 
-		relays:     notify.NewEmpty[[]relayPeer](),
+		relays:     notify.NewEmpty[[]*pbclient.DirectRelay](),
 		relayConns: notify.NewEmpty[map[relayID]*quic.Conn](),
 
 		peers:     notify.NewEmpty[[]*pbclient.RemotePeer](),
 		peerConns: notify.NewEmpty[map[peerConnKey]*quic.Conn](),
 
-		direct: direct,
-		addrs:  addrs,
+		direct:   direct,
+		addrs:    addrs,
+		metadata: metadata,
 
 		serverCert: serverTLSCert,
 		clientCert: clientTLSCert,
 		logger:     logger,
 	}, nil
 }
 
-func (p *peer) setRelays(relays []relayPeer) {
+func (p *peer) setRelays(relays []*pbclient.DirectRelay) {
 	p.relays.Set(relays)
 }
 
@@ -176,22 +172,22 @@ func (p *peer) runDirectAddrs(ctx context.Context) error {
 
 func (p *peer) runRelays(ctx context.Context) error {
 	runningRelays := map[relayID]*relay{}
-	return p.relays.Listen(ctx, func(relays []relayPeer) error {
+	return p.relays.Listen(ctx, func(relays []*pbclient.DirectRelay) error {
 		p.logger.Debug("relays updated", "len", len(relays))
 
 		activeRelays := map[relayID]struct{}{}
 		for _, relay := range relays {
-			id := relayID(relay.proto.Id)
-			hps := model.HostPortFromPBs(relay.proto.Addresses)
+			id := relayID(relay.Id)
+			hps := model.HostPortFromPBs(relay.Addresses)
 
 			activeRelays[id] = struct{}{}
 
-			tlsCfg, err := newServerTLSConfig(relay.proto.ServerCertificate)
+			tlsCfg, err := newServerTLSConfig(relay.ServerCertificate)
 			if err != nil {
 				return err
 			}
 
-			cfg := &relayConfig{tlsCfg, relay.auth}
+			cfg := &relayConfig{tlsCfg, relay.Authentication}
 			if rlg := runningRelays[id]; rlg != nil {
 				p.logger.Debug("updating relay", "id", id)
 				rlg.serverConf.Store(cfg)
@@ -389,14 +385,16 @@ func (p *peer) getECDHPublicKey(cfg *pbconnect.ECDHConfiguration) (*ecdh.PublicK
 
 type StatusPeer struct {
 	// Relays show the status of each relay this peer is connected to
-	Relays map[string]StatusRelayConnection `json:"relays"`
+	Relays map[string]StatusRelay `json:"relays"`
 	// Peers shows the status of each peer this peer is connected to
 	Peers map[string]StatusRemotePeer `json:"peers"`
 }
 
-type StatusRelayConnection struct {
-	ID      string `json:"id"`
-	Address string `json:"address"`
+type StatusRelay struct {
+	ID         string   `json:"id"`
+	Hostports  []string `json:"hostports"`
+	Metadata   string   `json:"metadata"`
+	Connection string   `json:"connection"`
 }
 
 type StatusRemotePeer struct {
@@ -414,15 +412,25 @@ type StatusRemotePeerConnection struct {
 
 func (p *peer) status() (StatusPeer, error) {
 	stat := StatusPeer{
-		Relays: map[string]StatusRelayConnection{},
+		Relays: map[string]StatusRelay{},
 		Peers:  map[string]StatusRemotePeer{},
 	}
 
-	if relays, ok := p.relayConns.Peek(); ok {
-		for id, conn := range relays {
-			stat.Relays[string(id)] = StatusRelayConnection{
-				ID:      string(id),
-				Address: conn.RemoteAddr().String(),
+	if relays, ok := p.relays.Peek(); ok {
+		for _, relay := range relays {
+			stat.Relays[relay.Id] = StatusRelay{
+				ID:        relay.Id,
+				Metadata:  relay.Metadata,
+				Hostports: iterc.MapSliceStrings(model.HostPortFromPBs(relay.Addresses)),
+			}
+		}
+	}
+
+	if relayConns, ok := p.relayConns.Peek(); ok {
+		for id, conn := range relayConns {
+			if v, ok := stat.Relays[string(id)]; ok {
+				v.Connection = conn.RemoteAddr().String()
+				stat.Relays[string(id)] = v
 			}
 		}
 	}

proto/client.proto

@@ -76,5 +76,6 @@ message DirectRelay {
   string id = 1; // relay id as assigned by the control server
   repeated model.HostPort addresses = 2;
   bytes server_certificate = 3; // generic certificate used by this relay
-  bytes authentication_signature = 4; // endpoint/role specific signature to use at the relay
+  bytes authentication = 4; // endpoint/role specific auth to use at the relay
+  string metadata = 5;
 }

proto/client_relay.proto

@@ -2,16 +2,13 @@ syntax = "proto3";
 package client_relay;
 
 import "error.proto";
-import "model.proto";
 
 option go_package = "github.com/connet-dev/connet/proto/pbclientrelay";
 
 message AuthenticateReq {
-  model.Endpoint endpoint = 1;
-  model.Role role = 2;
-  bytes authentication_signature = 3;
-  string metadata = 4;
-  string build_version = 5;
+  bytes authentication = 1;
+  string metadata = 2;
+  string build_version = 3;
 }
 
 message AuthenticateResp {