[AGMETEOR]

context

• part of https://github.com/getlantern/engineering/issues/3702, alongside egress: log every session, with an optional consumer hello #454
• a consumer can verify the egress: lantern-box requires and verifies the egress's client certificate when the track sets egress_ca and egress_server_name. But every egress build calls GenerateSelfSignedTLSConfig(true), a fresh certificate per process, so no CA can vouch for it and production can't turn verification on
• without verification, QUIC between consumer and egress is encrypted but unauthenticated, so a donor can impersonate the egress and read anything inside it: the proxied traffic, and the consumer hello from egress: log every session, with an optional consumer hello #454

summary

• TLSConfigFromEnv (tls.go):
  • with TLS_CERT_FILE and TLS_KEY_FILE set (the names examples/private-swarm/egress-server already uses), the egress presents that certificate
  • with neither set, it keeps the per-process self-signed certificate and the DANGER banner, so current deployments are unchanged
  • with only one set, it fails at startup
• the sing-box, http and socks5 builds use it, replacing three copies of the banner and fallback
• the egress dials the consumer, so this is a TLS client certificate: it needs the clientAuth extended key usage and a SAN equal to the track's egress_server_name
• the egress still doesn't verify the consumer, which is anonymous by design

tests

tls_test.go, using a consumer configured like lantern-box's verifying path (RequireAndVerifyClientCert, ClientCAs, SAN check), with the egress as TLS client as in production:

• a CA-issued egress cert loaded from env passes verification
• the self-signed fallback is rejected ("certificate signed by unknown authority")
• one env var without the other, and missing files, fail
• go test -race ./egress/... ./common/... passes

rollout (not in this PR)

1. issue a CA and an egress cert (clientAuth, SAN = chosen egress_server_name); put the cert and key on egress hosts, e.g. from Vault in lantern-cloud's egress deploy, and set the two env vars
2. only once every egress presents it, set egress_ca and egress_server_name on the unbounded track. Current clients already honour those options, so setting them before the egress presents the cert breaks every unbounded connection
3. lantern-box then sends the device ID in the hello only when verification is on (unbounded: send a consumer hello to the egress lantern-box#355 follow-up)

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}