Struct QuicMitmRelay 

pub struct QuicMitmRelay<Issuer> { /* private fields */ }

Available on crate features quic and std only.

Terminates a QUIC association whose ClientHello was peeked, using the egress socket the producer prepared for its origin: the QUIC counterpart of the TLS MITM relay.

The client’s attempt is admitted on the ingress socket first, by default only once a Retry validated its address, and only if it carries the ClientHello that was peeked. Then the origin handshake runs over the egress socket, with the client’s QUIC version, server name and the offered protocols the egress TLS configuration allows, in the client’s order. The origin’s certificate is mirrored by the BoringMitmCertIssuer, and the client is accepted with it and the protocol the origin selected; a failure refuses the client. No origin handshake or issuance runs for an unvalidated address. The inner service owns both established connections; this service closes them only when establishment fails. Early data is disabled on both hops, so a client’s 0-RTT is rejected and resent after the handshake. All of it shares one deadline, fixed when serve is called.

The origin sees the client’s own first flight as far as this relay can reproduce it; see Self::with_mirror_client.

An origin requesting a client certificate is answered by the TlsMitmClientAuthPolicy (a flow’s own extension overrides the relay’s): its plan configures the ingress handshake, and its credential is released to the origin only once that handshake completed, with proof of possession of any certificate the client presented. Without a policy, a certificate request fails the association.

Destination selection is the producer’s: this service dials nothing but the egress socket’s peer, and the received server name never changes where traffic goes.

Implementations

impl<Issuer> QuicMitmRelay<Issuer>

pub fn new( issuer: Issuer, exec: Executor, egress_tls: TlsClientConfig, failure_code: VarInt, ) -> QuicMitmRelay<Issuer>

Verify origins with egress_tls, whose ALPN list (when set) bounds what is offered upstream, and close failed associations with application error failure_code. Datagrams are disabled on both hops until both transports enable them.

pub fn with_mirror_client(self, mirror: bool) -> QuicMitmRelay<Issuer>

Whether the origin sees the client’s own first flight instead of the egress configuration’s (default: on). The ClientHello is mirrored without values the native TLS engine cannot negotiate and with GREASE codepoints pinned, the configured egress TLS layered over it (its trust and every setting it names win); the transport parameters keep the client’s order, greased parameter, extra parameters and limits, while connection IDs stay fresh. Receive windows, stream counts and the idle timeout are lowered to Self::with_mirror_ceiling and the egress transport’s idle timeout, and a datagram parameter is dropped unless both transports carry datagrams. A ClientHello or transport profile this relay cannot reproduce (including one whose peek did not retain the Initial structure) falls back to the egress configuration for that layer. Every change is traced.

pub fn set_mirror_client(&mut self, mirror: bool) -> &mut QuicMitmRelay<Issuer>

Whether the origin sees the client’s own first flight instead of the egress configuration’s (default: on). The ClientHello is mirrored without values the native TLS engine cannot negotiate and with GREASE codepoints pinned, the configured egress TLS layered over it (its trust and every setting it names win); the transport parameters keep the client’s order, greased parameter, extra parameters and limits, while connection IDs stay fresh. Receive windows, stream counts and the idle timeout are lowered to Self::with_mirror_ceiling and the egress transport’s idle timeout, and a datagram parameter is dropped unless both transports carry datagrams. A ClientHello or transport profile this relay cannot reproduce (including one whose peek did not retain the Initial structure) falls back to the egress configuration for that layer. Every change is traced.

pub fn with_mirror_ceiling( self, ceiling: QuicMirrorCeiling, ) -> QuicMitmRelay<Issuer>

The most a mirrored client may make the relay hold on its egress connection.

pub fn set_mirror_ceiling( &mut self, ceiling: QuicMirrorCeiling, ) -> &mut QuicMitmRelay<Issuer>

The most a mirrored client may make the relay hold on its egress connection.

pub fn maybe_with_client_auth( self, policy: Option<TlsMitmClientAuthPolicy>, ) -> QuicMitmRelay<Issuer>

The client-authentication policy for origins requesting a certificate. A flow’s own TlsMitmClientAuthPolicy extension overrides it.

pub fn maybe_set_client_auth( &mut self, policy: Option<TlsMitmClientAuthPolicy>, ) -> &mut QuicMitmRelay<Issuer>

The client-authentication policy for origins requesting a certificate. A flow’s own TlsMitmClientAuthPolicy extension overrides it.

pub fn with_client_auth( self, policy: TlsMitmClientAuthPolicy, ) -> QuicMitmRelay<Issuer>

The client-authentication policy for origins requesting a certificate. A flow’s own TlsMitmClientAuthPolicy extension overrides it.

pub fn set_client_auth( &mut self, policy: TlsMitmClientAuthPolicy, ) -> &mut QuicMitmRelay<Issuer>

The client-authentication policy for origins requesting a certificate. A flow’s own TlsMitmClientAuthPolicy extension overrides it.

pub fn without_client_auth(self) -> QuicMitmRelay<Issuer>

The client-authentication policy for origins requesting a certificate. A flow’s own TlsMitmClientAuthPolicy extension overrides it.

pub fn unset_client_auth(&mut self) -> &mut QuicMitmRelay<Issuer>

The client-authentication policy for origins requesting a certificate. A flow’s own TlsMitmClientAuthPolicy extension overrides it.

pub fn with_ingress_transport( self, transport: Arc<TransportConfig>, ) -> QuicMitmRelay<Issuer>

Transport limits advertised to the client.

pub fn set_ingress_transport( &mut self, transport: Arc<TransportConfig>, ) -> &mut QuicMitmRelay<Issuer>

Transport limits advertised to the client.

pub fn with_egress_transport( self, transport: Arc<TransportConfig>, ) -> QuicMitmRelay<Issuer>

Transport limits advertised to the origin.

pub fn set_egress_transport( &mut self, transport: Arc<TransportConfig>, ) -> &mut QuicMitmRelay<Issuer>

Transport limits advertised to the origin.

pub fn with_handshake_timeout(self, timeout: Duration) -> QuicMitmRelay<Issuer>

The budget for both handshakes and certificate issuance, from serve. Defaults to DEFAULT_QUIC_MITM_HANDSHAKE_TIMEOUT.

pub fn set_handshake_timeout( &mut self, timeout: Duration, ) -> &mut QuicMitmRelay<Issuer>

The budget for both handshakes and certificate issuance, from serve. Defaults to DEFAULT_QUIC_MITM_HANDSHAKE_TIMEOUT.

pub fn with_validate_address(self, validate: bool) -> QuicMitmRelay<Issuer>

Whether a Retry validates the client’s address before any origin work runs (the default). Without it, a spoofed first flight costs an origin handshake and issuance.

pub fn set_validate_address( &mut self, validate: bool, ) -> &mut QuicMitmRelay<Issuer>

Whether a Retry validates the client’s address before any origin work runs (the default). Without it, a spoofed first flight costs an origin handshake and issuance.

Trait Implementations

impl<Issuer> Clone for QuicMitmRelay<Issuer>

where Issuer: Clone,

fn clone(&self) -> QuicMitmRelay<Issuer>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<Issuer> Debug for QuicMitmRelay<Issuer>

where Issuer: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl<Issuer, S> Layer<S> for QuicMitmRelay<Issuer>

where Issuer: Clone,

type Service = QuicMitmRelayService<Issuer, S>

The service produced by the layer.

fn layer(&self, inner: S) -> <QuicMitmRelay<Issuer> as Layer<S>>::Service

Wrap the given service with the middleware, returning a new service.

fn into_layer(self, inner: S) -> <QuicMitmRelay<Issuer> as Layer<S>>::Service

Same as layer but consuming self after the service was created.