fix: refresh ACL groups and enable TCP_NODELAY for WebSocket (#2118)

* fix: refresh ACL groups and enable TCP_NODELAY for WebSocket
* add remove_peers to remove list of peer id in ospf route
* fix secure tunnel for unreliable udp tunnel
* fix(web-client): timeout secure tunnel handshake
* fix(web-server): tolerate delayed secure hello
* fix quic endpoint panic
* fix replay check

easytier/src/peers/tests.rs

@@ -8,7 +8,7 @@ use crate::{
         PeerId,
         error::Error,
         global_ctx::{
-            NetworkIdentity,
+            NetworkIdentity, TrustedKeySource,
             tests::{get_mock_global_ctx, get_mock_global_ctx_with_network},
         },
         stats_manager::{LabelSet, LabelType, MetricName},
@@ -1315,6 +1315,107 @@ async fn credential_node_group_assignment() {
     .await;
 }
 
+#[tokio::test]
+async fn credential_node_connected_via_admin_b_trusts_admin_a_groups() {
+    use crate::proto::acl::{Acl, AclV1, GroupIdentity, GroupInfo};
+
+    let admin_a = create_mock_peer_manager_secure("net1".to_string(), "secret".to_string()).await;
+    let admin_b = create_mock_peer_manager_secure("net1".to_string(), "secret".to_string()).await;
+
+    let group_declares = vec![GroupIdentity {
+        group_name: "platform-admin".to_string(),
+        group_secret: "platform-admin-secret".to_string(),
+    }];
+    admin_a.get_global_ctx().config.set_acl(Some(Acl {
+        acl_v1: Some(AclV1 {
+            group: Some(GroupInfo {
+                declares: group_declares.clone(),
+                members: vec!["platform-admin".to_string()],
+            }),
+            ..Default::default()
+        }),
+    }));
+    admin_b.get_global_ctx().config.set_acl(Some(Acl {
+        acl_v1: Some(AclV1 {
+            group: Some(GroupInfo {
+                declares: group_declares,
+                members: vec![],
+            }),
+            ..Default::default()
+        }),
+    }));
+
+    connect_peer_manager(admin_a.clone(), admin_b.clone()).await;
+    wait_route_appear(admin_a.clone(), admin_b.clone())
+        .await
+        .unwrap();
+
+    let (_cred_id, cred_secret) = admin_a
+        .get_global_ctx()
+        .get_credential_manager()
+        .generate_credential(vec![], false, vec![], std::time::Duration::from_secs(3600));
+    admin_a
+        .get_global_ctx()
+        .issue_event(crate::common::global_ctx::GlobalCtxEvent::CredentialChanged);
+
+    let privkey_bytes: [u8; 32] = base64::engine::general_purpose::STANDARD
+        .decode(&cred_secret)
+        .unwrap()
+        .try_into()
+        .unwrap();
+    let private = x25519_dalek::StaticSecret::from(privkey_bytes);
+    let credential_pubkey = x25519_dalek::PublicKey::from(&private).as_bytes().to_vec();
+
+    wait_for_condition(
+        || {
+            let admin_b = admin_b.clone();
+            let credential_pubkey = credential_pubkey.clone();
+            async move {
+                admin_b.get_global_ctx().is_pubkey_trusted_with_source(
+                    &credential_pubkey,
+                    "net1",
+                    TrustedKeySource::OspfCredential,
+                )
+            }
+        },
+        Duration::from_secs(10),
+    )
+    .await;
+
+    let cred_c = create_mock_peer_manager_credential("net1".to_string(), &private).await;
+    connect_peer_manager(cred_c.clone(), admin_b.clone()).await;
+
+    let admin_a_id = admin_a.my_peer_id();
+    wait_for_condition(
+        || {
+            let cred_c = cred_c.clone();
+            async move {
+                cred_c
+                    .list_routes()
+                    .await
+                    .iter()
+                    .any(|r| r.peer_id == admin_a_id)
+            }
+        },
+        Duration::from_secs(10),
+    )
+    .await;
+
+    wait_for_condition(
+        || {
+            let cred_c = cred_c.clone();
+            async move {
+                cred_c
+                    .get_route()
+                    .get_peer_groups(admin_a_id)
+                    .contains(&"platform-admin".to_string())
+            }
+        },
+        Duration::from_secs(10),
+    )
+    .await;
+}
+
 /// Minimal test: two secure peers connect and discover each other's route.
 #[tokio::test]
 async fn two_secure_peers_route_appear() {