authentication protocol for udp

Cargo.toml

@@ -84,6 +84,9 @@ monad-types = { path = "./monad-types" }
 monad-updaters = { path = "./monad-updaters" }
 monad-validator = { path = "./monad-validator" }
 monad-wal = { path = "./monad-wal" }
+monad-wireauth-api = { path = "./monad-wireauth-api" }
+monad-wireauth-protocol = { path = "./monad-wireauth-protocol" }
+monad-wireauth-session = { path = "./monad-wireauth-session" }
 
 actix = "0.13"
 actix-http = "3.11.1"
@@ -92,6 +95,7 @@ actix-test = "0.1"
 actix-rt = "2.9.0"
 actix-web = "4.5.1"
 actix-ws = "0.3.0"
+aegis = "0.5"
 aes = "0.8.3"
 agent = { git = "https://github.com/category-labs/manytrace.git", tag = "v0.1.1" }
 alloy-consensus = "0.8"
@@ -138,6 +142,7 @@ criterion = { version = "0.4", features = ["html_reports"] }
 insta = "1.42"
 ctr = "0.9.2"
 dashmap = "6.1.0"
+divan = "0.1"
 enum_dispatch = "0.3.13"
 env_logger = "0.10"
 eyre = "0.6.12"
@@ -199,6 +204,7 @@ sorted_vector_map = "0.2.0"
 sorted-vec = "0.8.3"
 strum = "0.26.3"
 syn = { version = "1.0.0", features = ["full"] }
+tai64 = "4.0"
 tempfile = "3.5"
 test-case = "3.0"
 thiserror = "1.0"
@@ -220,5 +226,5 @@ unicode-normalization = "0.1"
 url = "2.5.0"
 wasm-bindgen = "0.2"
 zerocopy = { version = "0.8", features = ["derive"] }
-zeroize = "1.3"
+zeroize = { version = "1.7", features = ["derive"] }
 zstd = "0.13"

monad-wireauth-api/Cargo.toml

@@ -0,0 +1,50 @@
+[package]
+name = "monad-wireauth-api"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+monad-wireauth-session = { workspace = true, features = ["bench"] }
+monad-wireauth-protocol.workspace = true
+bytes.workspace = true
+rand.workspace = true
+thiserror.workspace = true
+secp256k1 = { workspace = true, features = ["global-context"] }
+zerocopy.workspace = true
+tracing.workspace = true
+hex.workspace = true
+lru.workspace = true
+
+[dependencies.clap]
+workspace = true
+features = ["derive"]
+optional = true
+
+[dependencies.monoio]
+workspace = true
+features = ["sync", "macros"]
+optional = true
+
+[dependencies.tracing-subscriber]
+workspace = true
+features = ["env-filter"]
+optional = true
+
+[dev-dependencies]
+monoio = { workspace = true, features = ["sync", "macros"] }
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
+rstest.workspace = true
+proptest.workspace = true
+divan.workspace = true
+
+[features]
+bench = ["monad-wireauth-session/bench"]
+
+[[bench]]
+name = "manager_bench"
+harness = false
+required-features = ["bench"]
+
+[[example]]
+name = "demo"
+required-features = ["clap", "monoio", "tracing-subscriber"]

monad-wireauth-api/README.md

@@ -0,0 +1,32 @@
+# API
+
+## DoS Protection
+
+the filter operates in three modes based on load:
+
+| condition | action |
+|-----------|--------|
+| sessions >= `high_watermark_sessions` or handshakes >= `handshake_rate_limit` | drop request |
+| sessions >= `low_watermark_sessions` and cookie invalid | send cookie reply |
+| sessions >= `low_watermark_sessions` and cookie valid | apply per-ip rate limiting via lru cache |
+| sessions < `low_watermark_sessions` | no additional measures |
+
+defaults: `high_watermark_sessions`=100,000, `handshake_rate_limit`=2000/sec, `low_watermark_sessions`=10,000, `ip_rate_limit_window`=10s, `max_sessions_per_ip`=10, `ip_history_capacity`=1,000,000
+
+at 2000 handshakes/sec, approximately 400ms of cpu time per second is spent on handshake-related computation during such attack.
+
+## Benchmarks
+
+CPU: 12th Gen Intel(R) Core(TM) i9-12900KF
+
+RUSTFLAGS: `-C target-cpu=haswell -C opt-level=3`
+
+```
+Timer precision: 26 ns
+manager_bench                     fastest       │ slowest       │ median        │ mean          │ samples │ iters
+├─ bench_session_decrypt          162.8 ns      │ 235.5 ns      │ 166.1 ns      │ 167.2 ns      │ 100     │ 1600
+├─ bench_session_encrypt          133.5 ns      │ 136 ns        │ 134.6 ns      │ 134.6 ns      │ 100     │ 3200
+├─ bench_session_handle_init      131.7 µs      │ 206.9 µs      │ 135.7 µs      │ 137.7 µs      │ 100     │ 100
+├─ bench_session_handle_response  61.64 µs      │ 72.83 µs      │ 62.98 µs      │ 63.74 µs      │ 100     │ 100
+╰─ bench_session_send_init        74.48 µs      │ 116.2 µs      │ 76.31 µs      │ 77.72 µs      │ 100     │ 100
+```