Fix io import for named pipe build

Use correct path construction in website.ToProtobuf()

README.md

@@ -42,3 +42,4 @@ See the [wiki](https://sliver.sh/docs?name=Compile+from+Source).
 ### License - GPLv3
 
 Sliver is licensed under [GPLv3](https://www.gnu.org/licenses/gpl-3.0.en.html), some sub-components may have separate licenses. See their respective subdirectories in this project for details.
+

client/command/armory/install.go

@@ -635,20 +635,15 @@ func installAliasPackage(entry *pkgCacheEntry, promptToOverwrite bool, clientCon
 		return errors.New("signature verification failed")
 	}
 
-	tmpFile, err := os.CreateTemp("", "sliver-armory-")
+	tmpFileName, err := writeArmoryTempFile(tarGz)
 	if err != nil {
 		return err
 	}
-	defer os.Remove(tmpFile.Name())
-	_, err = tmpFile.Write(tarGz)
-	if err != nil {
-		return err
-	}
-	tmpFile.Close()
+	defer os.Remove(tmpFileName)
 
 	con.Printf(console.Clearln + "\r") // Clear the line
 
-	installPath := alias.InstallFromFile(tmpFile.Name(), entry.Alias.CommandName, promptToOverwrite, con)
+	installPath := alias.InstallFromFile(tmpFileName, entry.Alias.CommandName, promptToOverwrite, con)
 	if installPath == nil {
 		return errors.New("failed to install alias")
 	}
@@ -729,23 +724,45 @@ func installExtensionPackage(entry *pkgCacheEntry, promptToOverwrite bool, clien
 		return errors.New("signature verification failed")
 	}
 
-	tmpFile, err := os.CreateTemp("", "sliver-armory-")
-	if err != nil {
-		return err
-	}
-	defer os.Remove(tmpFile.Name())
-	_, err = tmpFile.Write(tarGz)
-	if err != nil {
-		return err
-	}
-	err = tmpFile.Sync()
+	tmpFileName, err := writeArmoryTempFile(tarGz)
 	if err != nil {
 		return err
 	}
+	defer os.Remove(tmpFileName)
 
 	con.Printf(console.Clearln + "\r") // Clear download message
 
-	extensions.InstallFromDir(tmpFile.Name(), promptToOverwrite, con, true)
+	extensions.InstallFromDir(tmpFileName, promptToOverwrite, con, true)
 
 	return nil
 }
+
+func writeArmoryTempFile(data []byte) (string, error) {
+	if len(data) == 0 {
+		return "", errors.New("downloaded archive is empty")
+	}
+	tmpFile, err := os.CreateTemp("", "sliver-armory-")
+	if err != nil {
+		return "", err
+	}
+	tmpFileName := tmpFile.Name()
+	for len(data) > 0 {
+		n, err := tmpFile.Write(data)
+		if err != nil {
+			tmpFile.Close()
+			os.Remove(tmpFileName)
+			return "", err
+		}
+		data = data[n:]
+	}
+	if err := tmpFile.Sync(); err != nil {
+		tmpFile.Close()
+		os.Remove(tmpFileName)
+		return "", err
+	}
+	if err := tmpFile.Close(); err != nil {
+		os.Remove(tmpFileName)
+		return "", err
+	}
+	return tmpFileName, nil
+}

client/command/jobs/wg.go

@@ -32,12 +32,13 @@ func WGListenerCmd(cmd *cobra.Command, con *console.SliverClient, args []string)
 	nport, _ := cmd.Flags().GetUint32("nport")
 	keyExchangePort, _ := cmd.Flags().GetUint32("key-port")
 
-	con.PrintInfof("Starting Wireguard listener ...\n")
+	con.PrintInfof("Starting Wireguard listener (udp:%d, tcp-comms:%d, key-exchange:%d) ...\n", lport, nport, keyExchangePort)
 	wg, err := con.Rpc.StartWGListener(context.Background(), &clientpb.WGListenerReq{
 		Port:    lport,
 		NPort:   nport,
 		KeyPort: keyExchangePort,
 	})
+	con.Println()
 	if err != nil {
 		con.PrintErrorf("%s\n", err)
 	} else {

go-tests.sh

@@ -98,6 +98,13 @@ else
     exit 1
 fi
 
+# implant / sliver / transports / wireguard
+if go test ./implant/sliver/transports/wireguard ; then
+    :
+else
+    exit 1
+fi
+
 ## Server
 
 # server / assets / traffic encoders
@@ -178,6 +185,17 @@ else
     exit 1
 fi
 
+# server / c2 / e2e (mtls + wg + yamux)
+SLIVER_ROOT_DIR_E2E="$(mktemp -d)"
+if SLIVER_ROOT_DIR="$SLIVER_ROOT_DIR_E2E" go test -tags=server,$TAGS,sliver_e2e ./server/c2 -run 'Test(MTLS|WG)Yamux_' -count=1 ; then
+    :
+else
+    cat "$SLIVER_ROOT_DIR_E2E/logs/sliver.log" 2>/dev/null || true
+    rm -rf "$SLIVER_ROOT_DIR_E2E"
+    exit 1
+fi
+rm -rf "$SLIVER_ROOT_DIR_E2E"
+
 # server / configs
 if go test -tags=server,$TAGS ./server/configs ; then
     :

go.mod

@@ -30,6 +30,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
+		github.com/hashicorp/yamux v0.1.2
 	github.com/jedib0t/go-pretty/v6 v6.7.8
 	github.com/kbinani/screenshot v0.0.0-20250624051815-089614a94018
 	github.com/klauspost/compress v1.18.1

go.sum

@@ -1096,3 +1096,5 @@ software.sslmate.com/src/go-pkcs12 v0.4.0 h1:H2g08FrTvSFKUj+D309j1DPfk5APnIdAQAB
 software.sslmate.com/src/go-pkcs12 v0.4.0/go.mod h1:Qiz0EyvDRJjjxGyUQa2cCNZn/wMyzrRJ/qcDXOQazLI=
 tailscale.com v1.92.5 h1:h88HqtGk8jd9umF7l6m/8+QK69dY9IVMIlkNK9XYpvQ=
 tailscale.com v1.92.5/go.mod h1:jzTfKDd6XNNSNoX+Q9INIMpMU5rfZ9g8ojcAoMKi5w0=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=

implant/go-mod

@@ -7,6 +7,7 @@ require (
 	github.com/Binject/universal v0.0.0-20220519011857-bea739e758c0
 	github.com/Ne0nd0g/go-clr v1.0.3
 	github.com/gofrs/uuid v4.0.0+incompatible
+	github.com/hashicorp/yamux v0.1.2
 	github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f
 	github.com/lesnuages/go-winio v0.4.19
 	github.com/miekg/dns v1.1.50

implant/go-sum

@@ -27,6 +27,8 @@ github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/jcmturner/gofork v1.0.0 h1:J7uCkflzTEhUZ64xqKnkDxq3kzc96ajM1Gli5ktUem8=
 github.com/jcmturner/gofork v1.0.0/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
 github.com/kbinani/screenshot v0.0.0-20191211154542-3a185f1ce18f h1:5hWo+DzJQSOBl6X+TDac0SPWffRonuRJ2///OYtYRT8=

implant/sliver/cryptography/minisign_raw.go

@@ -0,0 +1,43 @@
+package cryptography
+
+import (
+	"encoding/binary"
+
+	"golang.org/x/crypto/blake2b"
+	"golang.org/x/crypto/ed25519"
+)
+
+// MinisignVerifyRaw - Verify a fixed-length raw minisign signature (binary) using
+// the server's bundled minisign public key.
+func MinisignVerifyRaw(message []byte, rawSig []byte) bool {
+	if len(rawSig) != RawSigSize {
+		return false
+	}
+
+	serverPublicKey, err := DecodeMinisignPublicKey(serverMinisignPublicKey)
+	if err != nil {
+		return false
+	}
+
+	algorithm := binary.LittleEndian.Uint16(rawSig[:2])
+	keyID := binary.LittleEndian.Uint64(rawSig[2:10])
+	if keyID != serverPublicKey.ID() {
+		return false
+	}
+
+	switch algorithm {
+	case EdDSA:
+		// Verify as-is.
+	case HashEdDSA:
+		digest := blake2b.Sum512(message)
+		message = digest[:]
+	default:
+		return false
+	}
+
+	signature := rawSig[10:]
+	if len(signature) != ed25519.SignatureSize {
+		return false
+	}
+	return ed25519.Verify(ed25519.PublicKey(serverPublicKey.PublicKey[:]), message, signature)
+}

implant/sliver/transports/beacon.go

@@ -36,6 +36,11 @@ import (
 
 	// {{end}}
 
+	// {{if or .Config.IncludeMTLS .Config.IncludeWG}}
+	"github.com/hashicorp/yamux"
+
+	// {{end}}
+
 	// {{if .Config.IncludeHTTP}}
 	"github.com/bishopfox/sliver/implant/sliver/transports/httpclient"
 	// {{end}}
@@ -192,6 +197,7 @@ func mtlsBeacon(uri *url.URL) *Beacon {
 	}
 
 	var conn *tls.Conn
+	var muxSession *yamux.Session
 	beacon := &Beacon{
 		ActiveC2: uri.String(),
 		Init: func() error {
@@ -202,15 +208,38 @@ func mtlsBeacon(uri *url.URL) *Beacon {
 			if err != nil {
 				return err
 			}
+			if _, err := conn.Write([]byte(mtls.YamuxPreface)); err != nil {
+				_ = conn.Close()
+				return err
+			}
+			muxSession, err = yamux.Client(conn, nil)
+			if err != nil {
+				_ = conn.Close()
+				return err
+			}
 			return nil
 		},
 		Recv: func() (*pb.Envelope, error) {
-			return mtls.ReadEnvelope(conn)
+			stream, err := muxSession.Accept()
+			if err != nil {
+				return nil, err
+			}
+			defer stream.Close()
+			return mtls.ReadEnvelope(stream)
 		},
 		Send: func(envelope *pb.Envelope) error {
-			return mtls.WriteEnvelope(conn, envelope)
+			stream, err := muxSession.Open()
+			if err != nil {
+				return err
+			}
+			defer stream.Close()
+			return mtls.WriteEnvelope(stream, envelope)
 		},
 		Close: func() error {
+			if muxSession != nil {
+				_ = muxSession.Close()
+				muxSession = nil
+			}
 			if conn != nil {
 				err = conn.Close()
 				if err != nil {
@@ -242,6 +271,7 @@ func wgBeacon(uri *url.URL) *Beacon {
 
 	var conn net.Conn
 	var dev *device.Device
+	var muxSession *yamux.Session
 	beacon := &Beacon{
 		ActiveC2: uri.String(),
 		Init: func() error {
@@ -260,25 +290,48 @@ func wgBeacon(uri *url.URL) *Beacon {
 			if err != nil {
 				return err
 			}
+			if _, err := conn.Write([]byte(wireguard.YamuxPreface)); err != nil {
+				_ = conn.Close()
+				_ = dev.Down()
+				return err
+			}
+			muxSession, err = yamux.Client(conn, nil)
+			if err != nil {
+				_ = conn.Close()
+				_ = dev.Down()
+				return err
+			}
 			return nil
 		},
 		Recv: func() (*pb.Envelope, error) {
-			return wireguard.ReadEnvelope(conn)
+			stream, err := muxSession.Accept()
+			if err != nil {
+				return nil, err
+			}
+			defer stream.Close()
+			return wireguard.ReadEnvelope(stream)
 		},
 		Send: func(envelope *pb.Envelope) error {
-			return wireguard.WriteEnvelope(conn, envelope)
+			stream, err := muxSession.Open()
+			if err != nil {
+				return err
+			}
+			defer stream.Close()
+			return wireguard.WriteEnvelope(stream, envelope)
 		},
 		Close: func() error {
-			err = conn.Close()
-			if err != nil {
-				return err
+			if muxSession != nil {
+				_ = muxSession.Close()
+				muxSession = nil
 			}
-			err = dev.Down()
-			if err != nil {
-				return err
+			if conn != nil {
+				_ = conn.Close()
+				conn = nil
+			}
+			if dev != nil {
+				_ = dev.Down()
+				dev = nil
 			}
-			conn = nil
-			dev = nil
 			return nil
 		},
 		Cleanup: func() error {

implant/sliver/transports/mtls/mtls.go

@@ -22,12 +22,15 @@ package mtls
 
 import (
 	"bytes"
+	"crypto/ed25519"
+	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
+	"sync"
 	"time"
 
 	// {{if .Config.Debug}}
@@ -35,9 +38,11 @@ import (
 	// {{end}}
 
 	"os"
+	"strings"
 
 	"github.com/bishopfox/sliver/implant/sliver/cryptography"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
+	"golang.org/x/crypto/blake2b"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -45,6 +50,9 @@ var (
 	// PingInterval - Amount of time between in-band "pings"
 	PingInterval = 2 * time.Minute
 
+	// YamuxPreface - Magic bytes sent before yamux frames
+	YamuxPreface = "MUX/1"
+
 	// caCertPEM - PEM encoded CA certificate
 	caCertPEM = `{{.Build.MtlsCACert}}`
 
@@ -52,10 +60,40 @@ var (
 	certPEM = `{{.Build.MtlsCert}}`
 )
 
+const mtlsEnvelopeSigningSeedPrefix = "env-signing-v1:"
+
+var (
+	envelopeSigningOnce  sync.Once
+	envelopeSigningErr   error
+	envelopeSigningKeyID uint64
+	envelopeSigningPriv  ed25519.PrivateKey
+)
+
+func mtlsEnvelopeSigningKey() (ed25519.PrivateKey, uint64, error) {
+	envelopeSigningOnce.Do(func() {
+		peerKeyPair := cryptography.GetPeerAgeKeyPair()
+		// NOTE: This file is rendered with Go's text/template; avoid literal template
+		// delimiters in string checks or the template parser will treat it as an action.
+		if peerKeyPair == nil || peerKeyPair.Private == "" || strings.Contains(peerKeyPair.Private, ".Build.PeerPrivateKey") {
+			envelopeSigningErr = errors.New("[mtls] missing peer private key")
+			return
+		}
+
+		seed := sha256.Sum256([]byte(mtlsEnvelopeSigningSeedPrefix + peerKeyPair.Private))
+		envelopeSigningPriv = ed25519.NewKeyFromSeed(seed[:])
+
+		pub := envelopeSigningPriv.Public().(ed25519.PublicKey)
+		digest := blake2b.Sum256(pub)
+		envelopeSigningKeyID = binary.LittleEndian.Uint64(digest[:8])
+	})
+
+	return envelopeSigningPriv, envelopeSigningKeyID, envelopeSigningErr
+}
+
 // WriteEnvelope - Writes a message to the TLS socket using length prefix framing
 // which is a fancy way of saying we write the length of the message then the message
 // e.g. [uint32 length|message] so the receiver can delimit messages properly
-func WriteEnvelope(connection *tls.Conn, envelope *pb.Envelope) error {
+func WriteEnvelope(w io.Writer, envelope *pb.Envelope) error {
 	data, err := proto.Marshal(envelope)
 	if err != nil {
 		// {{if .Config.Debug}}
@@ -63,15 +101,28 @@ func WriteEnvelope(connection *tls.Conn, envelope *pb.Envelope) error {
 		// {{end}}
 		return err
 	}
+
+	signingKey, keyID, err := mtlsEnvelopeSigningKey()
+	if err != nil {
+		return err
+	}
+	rawSigBuf := make([]byte, cryptography.RawSigSize)
+	binary.LittleEndian.PutUint16(rawSigBuf[:2], cryptography.EdDSA)
+	binary.LittleEndian.PutUint64(rawSigBuf[2:10], keyID)
+	copy(rawSigBuf[10:], ed25519.Sign(signingKey, data))
+	if _, werr := w.Write(rawSigBuf); werr != nil {
+		return werr
+	}
+
 	dataLengthBuf := new(bytes.Buffer)
 	binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data)))
-	if _, werr := connection.Write(dataLengthBuf.Bytes()); werr != nil {
+	if _, werr := w.Write(dataLengthBuf.Bytes()); werr != nil {
 		// {{if .Config.Debug}}
 		log.Print("Error writing data length: ", werr)
 		// {{end}}
 		return werr
 	}
-	if _, werr := connection.Write(data); werr != nil {
+	if _, werr := w.Write(data); werr != nil {
 		// {{if .Config.Debug}}
 		log.Print("Error writing data: ", werr)
 		// {{end}}
@@ -81,7 +132,7 @@ func WriteEnvelope(connection *tls.Conn, envelope *pb.Envelope) error {
 }
 
 // WritePing - Send a "ping" message to the server
-func WritePing(connection *tls.Conn) error {
+func WritePing(w io.Writer) error {
 	// {{if .Config.Debug}}
 	log.Print("Socket ping")
 	// {{end}}
@@ -92,16 +143,26 @@ func WritePing(connection *tls.Conn) error {
 		Type: pb.MsgPing,
 		Data: pingBuf,
 	}
-	return WriteEnvelope(connection, &envelope)
+	return WriteEnvelope(w, &envelope)
 }
 
 // ReadEnvelope - Reads a message from the TLS connection using length prefix framing
-func ReadEnvelope(connection *tls.Conn) (*pb.Envelope, error) {
+func ReadEnvelope(r io.Reader) (*pb.Envelope, error) {
+	rawSigBuf := make([]byte, cryptography.RawSigSize)
 	dataLengthBuf := make([]byte, 4) // Size of uint32
-	if len(dataLengthBuf) == 0 || connection == nil {
+	if len(rawSigBuf) == 0 || len(dataLengthBuf) == 0 || r == nil {
 		panic("[[GenerateCanary]]")
 	}
-	n, err := io.ReadFull(connection, dataLengthBuf)
+
+	n, err := io.ReadFull(r, rawSigBuf)
+	if err != nil || n != len(rawSigBuf) {
+		// {{if .Config.Debug}}
+		log.Printf("Socket error (read raw signature): %v\n", err)
+		// {{end}}
+		return nil, err
+	}
+
+	n, err = io.ReadFull(r, dataLengthBuf)
 	if err != nil || n != 4 {
 		// {{if .Config.Debug}}
 		log.Printf("Socket error (read msg-length): %v\n", err)
@@ -119,7 +180,7 @@ func ReadEnvelope(connection *tls.Conn) (*pb.Envelope, error) {
 
 	dataBuf := make([]byte, dataLength)
 
-	n, err = io.ReadFull(connection, dataBuf)
+	n, err = io.ReadFull(r, dataBuf)
 
 	if err != nil || n != dataLength {
 		// {{if .Config.Debug}}
@@ -128,6 +189,13 @@ func ReadEnvelope(connection *tls.Conn) (*pb.Envelope, error) {
 		return nil, err
 	}
 
+	if !cryptography.MinisignVerifyRaw(dataBuf, rawSigBuf) {
+		// {{if .Config.Debug}}
+		log.Printf("Invalid signature on mtls envelope")
+		// {{end}}
+		return nil, errors.New("[mtls] invalid signature")
+	}
+
 	// Unmarshal the protobuf envelope
 	envelope := &pb.Envelope{}
 	err = proto.Unmarshal(dataBuf, envelope)

implant/sliver/transports/session.go

@@ -39,6 +39,11 @@ import (
 
 	// {{end}}
 
+	// {{if or .Config.IncludeMTLS .Config.IncludeWG}}
+	"github.com/hashicorp/yamux"
+
+	// {{end}}
+
 	// {{if .Config.IncludeWG}}
 	"errors"
 
@@ -62,18 +67,19 @@ import (
 	// {{end}}
 
 	// {{if not .Config.IncludeNamePipe}}
-	"io"
 	"net/url"
 	"sync"
 
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 	// {{end}}
 
+	"io"
 	"time"
 )
 
 var (
 	_ time.Duration // Force import
+	_ io.ReadCloser // Force import
 )
 
 type Start func() error
@@ -198,7 +204,9 @@ func mtlsConnect(uri *url.URL) (*Connection, error) {
 	send := make(chan *pb.Envelope)
 	recv := make(chan *pb.Envelope)
 	ctrl := make(chan struct{})
+	done := make(chan struct{})
 	var conn *tls.Conn
+	var muxSession *yamux.Session
 
 	connection := &Connection{
 		Send:    send,
@@ -215,7 +223,13 @@ func mtlsConnect(uri *url.URL) (*Connection, error) {
 			// {{if .Config.Debug}}
 			log.Printf("[mtls] lost connection, cleanup...")
 			// {{end}}
-			conn.Close()
+			close(done)
+			if muxSession != nil {
+				muxSession.Close()
+			}
+			if conn != nil {
+				conn.Close()
+			}
 			close(recv)
 		},
 	}
@@ -243,45 +257,119 @@ func mtlsConnect(uri *url.URL) (*Connection, error) {
 		if err != nil {
 			return err
 		}
+		if _, err := conn.Write([]byte(mtls.YamuxPreface)); err != nil {
+			conn.Close()
+			return err
+		}
+		muxSession, err = yamux.Client(conn, nil)
+		if err != nil {
+			conn.Close()
+			return err
+		}
 		connection.IsOpen = true
 
 		go func() {
 			defer connection.Cleanup()
+			sendSem := make(chan struct{}, 64)
+			ticker := time.NewTicker(mtls.PingInterval)
+			defer ticker.Stop()
+
+			sendEnvelope := func(envelope *pb.Envelope) {
+				if envelope == nil {
+					return
+				}
+				select {
+				case sendSem <- struct{}{}:
+				case <-done:
+					return
+				}
+				go func(envelope *pb.Envelope) {
+					defer func() {
+						<-sendSem
+					}()
+					stream, err := muxSession.Open()
+					if err != nil {
+						connection.Cleanup()
+						return
+					}
+					defer stream.Close()
+					if err := mtls.WriteEnvelope(stream, envelope); err != nil {
+						connection.Cleanup()
+						return
+					}
+				}(envelope)
+			}
+
+			sendPing := func() {
+				select {
+				case sendSem <- struct{}{}:
+				case <-done:
+					return
+				}
+				go func() {
+					defer func() {
+						<-sendSem
+					}()
+					stream, err := muxSession.Open()
+					if err != nil {
+						connection.Cleanup()
+						return
+					}
+					defer stream.Close()
+					if err := mtls.WritePing(stream); err != nil {
+						connection.Cleanup()
+						return
+					}
+				}()
+			}
+
 			for {
 				select {
 				case envelope, ok := <-send:
 					if !ok {
 						return
 					}
-					err := mtls.WriteEnvelope(conn, envelope)
-					if err != nil {
-						return
-					}
-				case <-time.After(mtls.PingInterval):
-					err = mtls.WritePing(conn)
-					if err != nil {
-						return
-					}
+					sendEnvelope(envelope)
+				case <-ticker.C:
+					sendPing()
+				case <-done:
+					return
 				}
 			}
 		}()
 
 		go func() {
 			defer connection.Cleanup()
+			streamSem := make(chan struct{}, 128)
 			for {
-				envelope, err := mtls.ReadEnvelope(conn)
-				if err == io.EOF {
-					// {{if .Config.Debug}}
-					log.Printf("[mtls] eof")
-					// {{end}}
+				stream, err := muxSession.Accept()
+				if err != nil {
 					return
 				}
-				if err != io.EOF && err != nil {
-					break
-				}
-				if envelope != nil {
-					recv <- envelope
+
+				select {
+				case streamSem <- struct{}{}:
+				case <-done:
+					stream.Close()
+					return
 				}
+
+				go func() {
+					defer func() {
+						<-streamSem
+					}()
+					defer stream.Close()
+					envelope, err := mtls.ReadEnvelope(stream)
+					if err != nil {
+						return
+					}
+					if envelope != nil {
+						select {
+						case recv <- envelope:
+						case <-done:
+						}
+					}
+				}()
 			}
 		}()
 
@@ -299,9 +387,11 @@ func wgConnect(uri *url.URL) (*Connection, error) {
 	send := make(chan *pb.Envelope)
 	recv := make(chan *pb.Envelope)
 	ctrl := make(chan struct{})
+	done := make(chan struct{})
 
 	var conn net.Conn
 	var dev *device.Device
+	var muxSession *yamux.Session
 	connection := &Connection{
 		Send:    send,
 		Recv:    recv,
@@ -315,8 +405,16 @@ func wgConnect(uri *url.URL) (*Connection, error) {
 			// {{if .Config.Debug}}
 			log.Printf("[wg] lost connection, cleanup...")
 			// {{end}}
-			conn.Close()
-			dev.Down()
+			close(done)
+			if muxSession != nil {
+				muxSession.Close()
+			}
+			if conn != nil {
+				conn.Close()
+			}
+			if dev != nil {
+				dev.Down()
+			}
 			close(recv)
 		},
 	}
@@ -355,45 +453,121 @@ func wgConnect(uri *url.URL) (*Connection, error) {
 		if err != nil {
 			return err
 		}
+		if _, err := conn.Write([]byte(wireguard.YamuxPreface)); err != nil {
+			conn.Close()
+			dev.Down()
+			return err
+		}
+		muxSession, err = yamux.Client(conn, nil)
+		if err != nil {
+			conn.Close()
+			dev.Down()
+			return err
+		}
 		connection.IsOpen = true
 
 		go func() {
 			defer connection.Cleanup()
+			sendSem := make(chan struct{}, 64)
+			ticker := time.NewTicker(wireguard.PingInterval)
+			defer ticker.Stop()
+
+			sendEnvelope := func(envelope *pb.Envelope) {
+				if envelope == nil {
+					return
+				}
+				select {
+				case sendSem <- struct{}{}:
+				case <-done:
+					return
+				}
+				go func(envelope *pb.Envelope) {
+					defer func() {
+						<-sendSem
+					}()
+					stream, err := muxSession.Open()
+					if err != nil {
+						connection.Cleanup()
+						return
+					}
+					defer stream.Close()
+					if err := wireguard.WriteEnvelope(stream, envelope); err != nil {
+						connection.Cleanup()
+						return
+					}
+				}(envelope)
+			}
+
+			sendPing := func() {
+				select {
+				case sendSem <- struct{}{}:
+				case <-done:
+					return
+				}
+				go func() {
+					defer func() {
+						<-sendSem
+					}()
+					stream, err := muxSession.Open()
+					if err != nil {
+						connection.Cleanup()
+						return
+					}
+					defer stream.Close()
+					if err := wireguard.WritePing(stream); err != nil {
+						connection.Cleanup()
+						return
+					}
+				}()
+			}
+
 			for {
 				select {
 				case envelope, ok := <-send:
 					if !ok {
 						return
 					}
-					err := wireguard.WriteEnvelope(conn, envelope)
-					if err != nil {
-						return
-					}
-				case <-time.After(wireguard.PingInterval):
-					err = wireguard.WritePing(conn)
-					if err != nil {
-						return
-					}
+					sendEnvelope(envelope)
+				case <-ticker.C:
+					sendPing()
+				case <-done:
+					return
 				}
 			}
 		}()
 
 		go func() {
 			defer connection.Cleanup()
+			streamSem := make(chan struct{}, 128)
 			for {
-				envelope, err := wireguard.ReadEnvelope(conn)
-				if err == io.EOF {
-					// {{if .Config.Debug}}
-					log.Printf("[wireguard] eof")
-					// {{end}}
+				stream, err := muxSession.Accept()
+				if err != nil {
 					return
 				}
-				if err != io.EOF && err != nil {
-					break
-				}
-				if envelope != nil {
-					recv <- envelope
+
+				select {
+				case streamSem <- struct{}{}:
+				case <-done:
+					stream.Close()
+					return
 				}
+
+				go func() {
+					defer func() {
+						<-streamSem
+					}()
+					defer stream.Close()
+					envelope, err := wireguard.ReadEnvelope(stream)
+					if err != nil {
+						return
+					}
+					if envelope != nil {
+						select {
+						case recv <- envelope:
+						case <-done:
+						}
+					}
+				}()
 			}
 		}()
 

implant/sliver/transports/wireguard/wireguard.go

@@ -25,6 +25,8 @@ package wireguard
 import (
 	"bufio"
 	"bytes"
+	"crypto/ed25519"
+	"crypto/sha256"
 	"encoding/binary"
 	"errors"
 	"fmt"
@@ -33,15 +35,18 @@ import (
 	"net/netip"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	// {{if .Config.Debug}}
 	"log"
 	// {{end}}
 
+	"github.com/bishopfox/sliver/implant/sliver/cryptography"
 	pb "github.com/bishopfox/sliver/protobuf/sliverpb"
 
 	"github.com/bishopfox/sliver/implant/sliver/netstack"
+	"golang.org/x/crypto/blake2b"
 	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun"
@@ -49,6 +54,9 @@ import (
 )
 
 var (
+	// YamuxPreface - Magic bytes sent before yamux frames
+	YamuxPreface = "MUX/1"
+
 	serverTunIP = "100.64.0.1" // Don't let user configure this for now
 	tunnelNet   *netstack.Net
 	tunAddress  string
@@ -66,6 +74,36 @@ var (
 	failedConn   = 0
 )
 
+const wgEnvelopeSigningSeedPrefix = "env-signing-v1:"
+
+var (
+	envelopeSigningOnce  sync.Once
+	envelopeSigningErr   error
+	envelopeSigningKeyID uint64
+	envelopeSigningPriv  ed25519.PrivateKey
+)
+
+func wgEnvelopeSigningKey() (ed25519.PrivateKey, uint64, error) {
+	envelopeSigningOnce.Do(func() {
+		peerKeyPair := cryptography.GetPeerAgeKeyPair()
+		// NOTE: This file is rendered with Go's text/template; avoid literal template
+		// delimiters in string checks or the template parser will treat it as an action.
+		if peerKeyPair == nil || peerKeyPair.Private == "" || strings.Contains(peerKeyPair.Private, ".Build.PeerPrivateKey") {
+			envelopeSigningErr = errors.New("[wireguard] missing peer private key")
+			return
+		}
+
+		seed := sha256.Sum256([]byte(wgEnvelopeSigningSeedPrefix + peerKeyPair.Private))
+		envelopeSigningPriv = ed25519.NewKeyFromSeed(seed[:])
+
+		pub := envelopeSigningPriv.Public().(ed25519.PublicKey)
+		digest := blake2b.Sum256(pub)
+		envelopeSigningKeyID = binary.LittleEndian.Uint64(digest[:8])
+	})
+
+	return envelopeSigningPriv, envelopeSigningKeyID, envelopeSigningErr
+}
+
 // GetTNet - Get the netstack Net object
 func GetTNet() *netstack.Net {
 	return tunnelNet
@@ -87,6 +125,22 @@ func WriteEnvelope(connection net.Conn, envelope *pb.Envelope) error {
 		// {{end}}
 		return err
 	}
+
+	signingKey, keyID, err := wgEnvelopeSigningKey()
+	if err != nil {
+		return err
+	}
+	rawSigBuf := make([]byte, cryptography.RawSigSize)
+	binary.LittleEndian.PutUint16(rawSigBuf[:2], cryptography.EdDSA)
+	binary.LittleEndian.PutUint64(rawSigBuf[2:10], keyID)
+	copy(rawSigBuf[10:], ed25519.Sign(signingKey, data))
+	if _, werr := connection.Write(rawSigBuf); werr != nil {
+		// {{if .Config.Debug}}
+		log.Print("Socket error (write raw signature): ", werr)
+		// {{end}}
+		return werr
+	}
+
 	dataLengthBuf := new(bytes.Buffer)
 	binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data)))
 	if _, werr := connection.Write(dataLengthBuf.Bytes()); werr != nil {
@@ -121,11 +175,21 @@ func WritePing(connection net.Conn) error {
 
 // ReadEnvelope - Reads a message from the wireguard connection using length prefix framing
 func ReadEnvelope(connection net.Conn) (*pb.Envelope, error) {
+	rawSigBuf := make([]byte, cryptography.RawSigSize)
 	dataLengthBuf := make([]byte, 4) // Size of uint32
-	if len(dataLengthBuf) == 0 || connection == nil {
+	if len(rawSigBuf) == 0 || len(dataLengthBuf) == 0 || connection == nil {
 		panic("[[GenerateCanary]]")
 	}
-	n, err := io.ReadFull(connection, dataLengthBuf)
+
+	n, err := io.ReadFull(connection, rawSigBuf)
+	if err != nil || n != len(rawSigBuf) {
+		// {{if .Config.Debug}}
+		log.Printf("Socket error (read raw signature): %v\n", err)
+		// {{end}}
+		return nil, err
+	}
+
+	n, err = io.ReadFull(connection, dataLengthBuf)
 	if err != nil || n != 4 {
 		// {{if .Config.Debug}}
 		log.Printf("Socket error (read msg-length): %v\n", err)
@@ -152,6 +216,13 @@ func ReadEnvelope(connection net.Conn) (*pb.Envelope, error) {
 		return nil, err
 	}
 
+	if !cryptography.MinisignVerifyRaw(dataBuf, rawSigBuf) {
+		// {{if .Config.Debug}}
+		log.Printf("Invalid signature on wireguard envelope")
+		// {{end}}
+		return nil, errors.New("[wireguard] invalid signature")
+	}
+
 	// Unmarshal the protobuf envelope
 	envelope := &pb.Envelope{}
 	err = proto.Unmarshal(dataBuf, envelope)
@@ -165,6 +236,10 @@ func ReadEnvelope(connection net.Conn) (*pb.Envelope, error) {
 	return envelope, nil
 }
 
+func formatWGEndpoint(address string, port uint16) string {
+	return net.JoinHostPort(address, strconv.Itoa(int(port)))
+}
+
 // getSessKeys - Connect to the wireguard server and retrieve session specific keys and IP
 func getSessKeys(address string, port uint16) error {
 	_, dev, tNet, err := bringUpWGInterface(address, port, wgImplantPrivKey, wgServerPubKey, wgPeerTunIP)
@@ -172,7 +247,9 @@ func getSessKeys(address string, port uint16) error {
 		return err
 	}
 
-	dev.Up()
+	if err := dev.Up(); err != nil {
+		return err
+	}
 
 	// {{if .Config.Debug}}
 	log.Printf("Initial wg connection. Attempting to connect to wg key exchange listener")
@@ -183,6 +260,7 @@ func getSessKeys(address string, port uint16) error {
 		// {{if .Config.Debug}}
 		log.Printf("Unable to connect to wg key exchange listener: %v", err)
 		// {{end}}
+		_ = dev.Down()
 		return err
 	}
 
@@ -207,7 +285,10 @@ func getSessKeys(address string, port uint16) error {
 // WGConnect - Get a wg connection or die trying
 func WGConnect(address string, port uint16) (net.Conn, *device.Device, error) {
 	if wgSessPrivKey == "" || failedConn > 2 {
-		getSessKeys(address, port)
+		if err := getSessKeys(address, port); err != nil {
+			failedConn++
+			return nil, nil, err
+		}
 	}
 
 	// Bring up actual wireguard connection using retrieved keys and IP
@@ -261,7 +342,7 @@ func bringUpWGInterface(address string, port uint16, implantPrivKey string, serv
 	wgConf := bytes.NewBuffer(nil)
 	fmt.Fprintf(wgConf, "private_key=%s\n", implantPrivKey)
 	fmt.Fprintf(wgConf, "public_key=%s\n", serverPubKey)
-	fmt.Fprintf(wgConf, "endpoint=%s:%d\n", address, port)
+	fmt.Fprintf(wgConf, "endpoint=%s\n", formatWGEndpoint(address, port))
 	fmt.Fprintf(wgConf, "allowed_ip=%s/0\n", "0.0.0.0")
 
 	// {{if .Config.Debug}}

implant/sliver/transports/wireguard/wireguard_endpoint_test.go

@@ -0,0 +1,26 @@
+//go:build windows || darwin || linux
+
+package wireguard
+
+import "testing"
+
+func TestFormatWGEndpoint_IPv6(t *testing.T) {
+	got := formatWGEndpoint("::1", 8989)
+	if got != "[::1]:8989" {
+		t.Fatalf("unexpected endpoint: got=%q want=%q", got, "[::1]:8989")
+	}
+}
+
+func TestFormatWGEndpoint_IPv4(t *testing.T) {
+	got := formatWGEndpoint("127.0.0.1", 53)
+	if got != "127.0.0.1:53" {
+		t.Fatalf("unexpected endpoint: got=%q want=%q", got, "127.0.0.1:53")
+	}
+}
+
+func TestFormatWGEndpoint_Hostname(t *testing.T) {
+	got := formatWGEndpoint("example.com", 1337)
+	if got != "example.com:1337" {
+		t.Fatalf("unexpected endpoint: got=%q want=%q", got, "example.com:1337")
+	}
+}

implant/vendor/github.com/hashicorp/yamux/.gitignore

@@ -0,0 +1,23 @@
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+
+# Folders
+_obj
+_test
+
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test

implant/vendor/github.com/hashicorp/yamux/LICENSE

@@ -0,0 +1,364 @@
+Copyright (c) 2014 HashiCorp, Inc.
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.

implant/vendor/github.com/hashicorp/yamux/README.md

@@ -0,0 +1,86 @@
+# Yamux
+
+Yamux (Yet another Multiplexer) is a multiplexing library for Golang.
+It relies on an underlying connection to provide reliability
+and ordering, such as TCP or Unix domain sockets, and provides
+stream-oriented multiplexing. It is inspired by SPDY but is not
+interoperable with it.
+
+Yamux features include:
+
+* Bi-directional streams
+  * Streams can be opened by either client or server
+  * Useful for NAT traversal
+  * Server-side push support
+* Flow control
+  * Avoid starvation
+  * Back-pressure to prevent overwhelming a receiver
+* Keep Alives
+  * Enables persistent connections over a load balancer
+* Efficient
+  * Enables thousands of logical streams with low overhead
+
+## Documentation
+
+For complete documentation, see the associated [Godoc](http://godoc.org/github.com/hashicorp/yamux).
+
+## Specification
+
+The full specification for Yamux is provided in the `spec.md` file.
+It can be used as a guide to implementors of interoperable libraries.
+
+## Usage
+
+Using Yamux is remarkably simple:
+
+```go
+
+func client() {
+    // Get a TCP connection
+    conn, err := net.Dial(...)
+    if err != nil {
+        panic(err)
+    }
+
+    // Setup client side of yamux
+    session, err := yamux.Client(conn, nil)
+    if err != nil {
+        panic(err)
+    }
+
+    // Open a new stream
+    stream, err := session.Open()
+    if err != nil {
+        panic(err)
+    }
+
+    // Stream implements net.Conn
+    stream.Write([]byte("ping"))
+}
+
+func server() {
+    // Accept a TCP connection
+    conn, err := listener.Accept()
+    if err != nil {
+        panic(err)
+    }
+
+    // Setup server side of yamux
+    session, err := yamux.Server(conn, nil)
+    if err != nil {
+        panic(err)
+    }
+
+    // Accept a stream
+    stream, err := session.Accept()
+    if err != nil {
+        panic(err)
+    }
+
+    // Listen for a message
+    buf := make([]byte, 4)
+    stream.Read(buf)
+}
+
+```
+

implant/vendor/github.com/hashicorp/yamux/addr.go

@@ -0,0 +1,60 @@
+package yamux
+
+import (
+	"fmt"
+	"net"
+)
+
+// hasAddr is used to get the address from the underlying connection
+type hasAddr interface {
+	LocalAddr() net.Addr
+	RemoteAddr() net.Addr
+}
+
+// yamuxAddr is used when we cannot get the underlying address
+type yamuxAddr struct {
+	Addr string
+}
+
+func (*yamuxAddr) Network() string {
+	return "yamux"
+}
+
+func (y *yamuxAddr) String() string {
+	return fmt.Sprintf("yamux:%s", y.Addr)
+}
+
+// Addr is used to get the address of the listener.
+func (s *Session) Addr() net.Addr {
+	return s.LocalAddr()
+}
+
+// LocalAddr is used to get the local address of the
+// underlying connection.
+func (s *Session) LocalAddr() net.Addr {
+	addr, ok := s.conn.(hasAddr)
+	if !ok {
+		return &yamuxAddr{"local"}
+	}
+	return addr.LocalAddr()
+}
+
+// RemoteAddr is used to get the address of remote end
+// of the underlying connection
+func (s *Session) RemoteAddr() net.Addr {
+	addr, ok := s.conn.(hasAddr)
+	if !ok {
+		return &yamuxAddr{"remote"}
+	}
+	return addr.RemoteAddr()
+}
+
+// LocalAddr returns the local address
+func (s *Stream) LocalAddr() net.Addr {
+	return s.session.LocalAddr()
+}
+
+// RemoteAddr returns the remote address
+func (s *Stream) RemoteAddr() net.Addr {
+	return s.session.RemoteAddr()
+}

implant/vendor/github.com/hashicorp/yamux/const.go

@@ -0,0 +1,182 @@
+package yamux
+
+import (
+	"encoding/binary"
+	"fmt"
+)
+
+// NetError implements net.Error
+type NetError struct {
+	err       error
+	timeout   bool
+	temporary bool
+}
+
+func (e *NetError) Error() string {
+	return e.err.Error()
+}
+
+func (e *NetError) Timeout() bool {
+	return e.timeout
+}
+
+func (e *NetError) Temporary() bool {
+	return e.temporary
+}
+
+var (
+	// ErrInvalidVersion means we received a frame with an
+	// invalid version
+	ErrInvalidVersion = fmt.Errorf("invalid protocol version")
+
+	// ErrInvalidMsgType means we received a frame with an
+	// invalid message type
+	ErrInvalidMsgType = fmt.Errorf("invalid msg type")
+
+	// ErrSessionShutdown is used if there is a shutdown during
+	// an operation
+	ErrSessionShutdown = fmt.Errorf("session shutdown")
+
+	// ErrStreamsExhausted is returned if we have no more
+	// stream ids to issue
+	ErrStreamsExhausted = fmt.Errorf("streams exhausted")
+
+	// ErrDuplicateStream is used if a duplicate stream is
+	// opened inbound
+	ErrDuplicateStream = fmt.Errorf("duplicate stream initiated")
+
+	// ErrReceiveWindowExceeded indicates the window was exceeded
+	ErrRecvWindowExceeded = fmt.Errorf("recv window exceeded")
+
+	// ErrTimeout is used when we reach an IO deadline
+	ErrTimeout = &NetError{
+		err: fmt.Errorf("i/o deadline reached"),
+
+		// Error should meet net.Error interface for timeouts for compatability
+		// with standard library expectations, such as http servers.
+		timeout: true,
+	}
+
+	// ErrStreamClosed is returned when using a closed stream
+	ErrStreamClosed = fmt.Errorf("stream closed")
+
+	// ErrUnexpectedFlag is set when we get an unexpected flag
+	ErrUnexpectedFlag = fmt.Errorf("unexpected flag")
+
+	// ErrRemoteGoAway is used when we get a go away from the other side
+	ErrRemoteGoAway = fmt.Errorf("remote end is not accepting connections")
+
+	// ErrConnectionReset is sent if a stream is reset. This can happen
+	// if the backlog is exceeded, or if there was a remote GoAway.
+	ErrConnectionReset = fmt.Errorf("connection reset")
+
+	// ErrConnectionWriteTimeout indicates that we hit the "safety valve"
+	// timeout writing to the underlying stream connection.
+	ErrConnectionWriteTimeout = fmt.Errorf("connection write timeout")
+
+	// ErrKeepAliveTimeout is sent if a missed keepalive caused the stream close
+	ErrKeepAliveTimeout = fmt.Errorf("keepalive timeout")
+)
+
+const (
+	// protoVersion is the only version we support
+	protoVersion uint8 = 0
+)
+
+const (
+	// Data is used for data frames. They are followed
+	// by length bytes worth of payload.
+	typeData uint8 = iota
+
+	// WindowUpdate is used to change the window of
+	// a given stream. The length indicates the delta
+	// update to the window.
+	typeWindowUpdate
+
+	// Ping is sent as a keep-alive or to measure
+	// the RTT. The StreamID and Length value are echoed
+	// back in the response.
+	typePing
+
+	// GoAway is sent to terminate a session. The StreamID
+	// should be 0 and the length is an error code.
+	typeGoAway
+)
+
+const (
+	// SYN is sent to signal a new stream. May
+	// be sent with a data payload
+	flagSYN uint16 = 1 << iota
+
+	// ACK is sent to acknowledge a new stream. May
+	// be sent with a data payload
+	flagACK
+
+	// FIN is sent to half-close the given stream.
+	// May be sent with a data payload.
+	flagFIN
+
+	// RST is used to hard close a given stream.
+	flagRST
+)
+
+const (
+	// initialStreamWindow is the initial stream window size
+	initialStreamWindow uint32 = 256 * 1024
+)
+
+const (
+	// goAwayNormal is sent on a normal termination
+	goAwayNormal uint32 = iota
+
+	// goAwayProtoErr sent on a protocol error
+	goAwayProtoErr
+
+	// goAwayInternalErr sent on an internal error
+	goAwayInternalErr
+)
+
+const (
+	sizeOfVersion  = 1
+	sizeOfType     = 1
+	sizeOfFlags    = 2
+	sizeOfStreamID = 4
+	sizeOfLength   = 4
+	headerSize     = sizeOfVersion + sizeOfType + sizeOfFlags +
+		sizeOfStreamID + sizeOfLength
+)
+
+type header []byte
+
+func (h header) Version() uint8 {
+	return h[0]
+}
+
+func (h header) MsgType() uint8 {
+	return h[1]
+}
+
+func (h header) Flags() uint16 {
+	return binary.BigEndian.Uint16(h[2:4])
+}
+
+func (h header) StreamID() uint32 {
+	return binary.BigEndian.Uint32(h[4:8])
+}
+
+func (h header) Length() uint32 {
+	return binary.BigEndian.Uint32(h[8:12])
+}
+
+func (h header) String() string {
+	return fmt.Sprintf("Vsn:%d Type:%d Flags:%d StreamID:%d Length:%d",
+		h.Version(), h.MsgType(), h.Flags(), h.StreamID(), h.Length())
+}
+
+func (h header) encode(msgType uint8, flags uint16, streamID uint32, length uint32) {
+	h[0] = protoVersion
+	h[1] = msgType
+	binary.BigEndian.PutUint16(h[2:4], flags)
+	binary.BigEndian.PutUint32(h[4:8], streamID)
+	binary.BigEndian.PutUint32(h[8:12], length)
+}

implant/vendor/github.com/hashicorp/yamux/mux.go

@@ -0,0 +1,118 @@
+package yamux
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"time"
+)
+
+// Config is used to tune the Yamux session
+type Config struct {
+	// AcceptBacklog is used to limit how many streams may be
+	// waiting an accept.
+	AcceptBacklog int
+
+	// EnableKeepalive is used to do a period keep alive
+	// messages using a ping.
+	EnableKeepAlive bool
+
+	// KeepAliveInterval is how often to perform the keep alive
+	KeepAliveInterval time.Duration
+
+	// ConnectionWriteTimeout is meant to be a "safety valve" timeout after
+	// we which will suspect a problem with the underlying connection and
+	// close it. This is only applied to writes, where's there's generally
+	// an expectation that things will move along quickly.
+	ConnectionWriteTimeout time.Duration
+
+	// MaxStreamWindowSize is used to control the maximum
+	// window size that we allow for a stream.
+	MaxStreamWindowSize uint32
+
+	// StreamOpenTimeout is the maximum amount of time that a stream will
+	// be allowed to remain in pending state while waiting for an ack from the peer.
+	// Once the timeout is reached the session will be gracefully closed.
+	// A zero value disables the StreamOpenTimeout allowing unbounded
+	// blocking on OpenStream calls.
+	StreamOpenTimeout time.Duration
+
+	// StreamCloseTimeout is the maximum time that a stream will allowed to
+	// be in a half-closed state when `Close` is called before forcibly
+	// closing the connection. Forcibly closed connections will empty the
+	// receive buffer, drop any future packets received for that stream,
+	// and send a RST to the remote side.
+	StreamCloseTimeout time.Duration
+
+	// LogOutput is used to control the log destination. Either Logger or
+	// LogOutput can be set, not both.
+	LogOutput io.Writer
+
+	// Logger is used to pass in the logger to be used. Either Logger or
+	// LogOutput can be set, not both.
+	Logger Logger
+}
+
+func (c *Config) Clone() *Config {
+	c2 := *c
+	return &c2
+}
+
+// DefaultConfig is used to return a default configuration
+func DefaultConfig() *Config {
+	return &Config{
+		AcceptBacklog:          256,
+		EnableKeepAlive:        true,
+		KeepAliveInterval:      30 * time.Second,
+		ConnectionWriteTimeout: 10 * time.Second,
+		MaxStreamWindowSize:    initialStreamWindow,
+		StreamCloseTimeout:     5 * time.Minute,
+		StreamOpenTimeout:      75 * time.Second,
+		LogOutput:              os.Stderr,
+	}
+}
+
+// VerifyConfig is used to verify the sanity of configuration
+func VerifyConfig(config *Config) error {
+	if config.AcceptBacklog <= 0 {
+		return fmt.Errorf("backlog must be positive")
+	}
+	if config.KeepAliveInterval == 0 {
+		return fmt.Errorf("keep-alive interval must be positive")
+	}
+	if config.MaxStreamWindowSize < initialStreamWindow {
+		return fmt.Errorf("MaxStreamWindowSize must be larger than %d", initialStreamWindow)
+	}
+	if config.LogOutput != nil && config.Logger != nil {
+		return fmt.Errorf("both Logger and LogOutput may not be set, select one")
+	} else if config.LogOutput == nil && config.Logger == nil {
+		return fmt.Errorf("one of Logger or LogOutput must be set, select one")
+	}
+	return nil
+}
+
+// Server is used to initialize a new server-side connection.
+// There must be at most one server-side connection. If a nil config is
+// provided, the DefaultConfiguration will be used.
+func Server(conn io.ReadWriteCloser, config *Config) (*Session, error) {
+	if config == nil {
+		config = DefaultConfig()
+	}
+	if err := VerifyConfig(config); err != nil {
+		return nil, err
+	}
+	return newSession(config, conn, false), nil
+}
+
+// Client is used to initialize a new client-side connection.
+// There must be at most one client-side connection.
+func Client(conn io.ReadWriteCloser, config *Config) (*Session, error) {
+	if config == nil {
+		config = DefaultConfig()
+	}
+
+	if err := VerifyConfig(config); err != nil {
+		return nil, err
+	}
+	return newSession(config, conn, true), nil
+}

implant/vendor/github.com/hashicorp/yamux/session.go

@@ -0,0 +1,749 @@
+package yamux
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"math"
+	"net"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// Session is used to wrap a reliable ordered connection and to
+// multiplex it into multiple streams.
+type Session struct {
+	// remoteGoAway indicates the remote side does
+	// not want futher connections. Must be first for alignment.
+	remoteGoAway int32
+
+	// localGoAway indicates that we should stop
+	// accepting futher connections. Must be first for alignment.
+	localGoAway int32
+
+	// nextStreamID is the next stream we should
+	// send. This depends if we are a client/server.
+	nextStreamID uint32
+
+	// config holds our configuration
+	config *Config
+
+	// logger is used for our logs
+	logger Logger
+
+	// conn is the underlying connection
+	conn io.ReadWriteCloser
+
+	// bufRead is a buffered reader
+	bufRead *bufio.Reader
+
+	// pings is used to track inflight pings
+	pings    map[uint32]chan struct{}
+	pingID   uint32
+	pingLock sync.Mutex
+
+	// streams maps a stream id to a stream, and inflight has an entry
+	// for any outgoing stream that has not yet been established. Both are
+	// protected by streamLock.
+	streams    map[uint32]*Stream
+	inflight   map[uint32]struct{}
+	streamLock sync.Mutex
+
+	// synCh acts like a semaphore. It is sized to the AcceptBacklog which
+	// is assumed to be symmetric between the client and server. This allows
+	// the client to avoid exceeding the backlog and instead blocks the open.
+	synCh chan struct{}
+
+	// acceptCh is used to pass ready streams to the client
+	acceptCh chan *Stream
+
+	// sendCh is used to mark a stream as ready to send,
+	// or to send a header out directly.
+	sendCh chan *sendReady
+
+	// recvDoneCh is closed when recv() exits to avoid a race
+	// between stream registration and stream shutdown
+	recvDoneCh chan struct{}
+	sendDoneCh chan struct{}
+
+	// shutdown is used to safely close a session
+	shutdown        bool
+	shutdownErr     error
+	shutdownCh      chan struct{}
+	shutdownLock    sync.Mutex
+	shutdownErrLock sync.Mutex
+}
+
+// sendReady is used to either mark a stream as ready
+// or to directly send a header
+type sendReady struct {
+	Hdr  []byte
+	mu   sync.Mutex // Protects Body from unsafe reads.
+	Body []byte
+	Err  chan error
+}
+
+// newSession is used to construct a new session
+func newSession(config *Config, conn io.ReadWriteCloser, client bool) *Session {
+	logger := config.Logger
+	if logger == nil {
+		logger = log.New(config.LogOutput, "", log.LstdFlags)
+	}
+
+	s := &Session{
+		config:     config,
+		logger:     logger,
+		conn:       conn,
+		bufRead:    bufio.NewReader(conn),
+		pings:      make(map[uint32]chan struct{}),
+		streams:    make(map[uint32]*Stream),
+		inflight:   make(map[uint32]struct{}),
+		synCh:      make(chan struct{}, config.AcceptBacklog),
+		acceptCh:   make(chan *Stream, config.AcceptBacklog),
+		sendCh:     make(chan *sendReady, 64),
+		recvDoneCh: make(chan struct{}),
+		sendDoneCh: make(chan struct{}),
+		shutdownCh: make(chan struct{}),
+	}
+	if client {
+		s.nextStreamID = 1
+	} else {
+		s.nextStreamID = 2
+	}
+	go s.recv()
+	go s.send()
+	if config.EnableKeepAlive {
+		go s.keepalive()
+	}
+	return s
+}
+
+// IsClosed does a safe check to see if we have shutdown
+func (s *Session) IsClosed() bool {
+	select {
+	case <-s.shutdownCh:
+		return true
+	default:
+		return false
+	}
+}
+
+// CloseChan returns a read-only channel which is closed as
+// soon as the session is closed.
+func (s *Session) CloseChan() <-chan struct{} {
+	return s.shutdownCh
+}
+
+// NumStreams returns the number of currently open streams
+func (s *Session) NumStreams() int {
+	s.streamLock.Lock()
+	num := len(s.streams)
+	s.streamLock.Unlock()
+	return num
+}
+
+// Open is used to create a new stream as a net.Conn
+func (s *Session) Open() (net.Conn, error) {
+	conn, err := s.OpenStream()
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
+}
+
+// OpenStream is used to create a new stream
+func (s *Session) OpenStream() (*Stream, error) {
+	if s.IsClosed() {
+		return nil, ErrSessionShutdown
+	}
+	if atomic.LoadInt32(&s.remoteGoAway) == 1 {
+		return nil, ErrRemoteGoAway
+	}
+
+	// Block if we have too many inflight SYNs
+	select {
+	case s.synCh <- struct{}{}:
+	case <-s.shutdownCh:
+		return nil, ErrSessionShutdown
+	}
+
+GET_ID:
+	// Get an ID, and check for stream exhaustion
+	id := atomic.LoadUint32(&s.nextStreamID)
+	if id >= math.MaxUint32-1 {
+		return nil, ErrStreamsExhausted
+	}
+	if !atomic.CompareAndSwapUint32(&s.nextStreamID, id, id+2) {
+		goto GET_ID
+	}
+
+	// Register the stream
+	stream := newStream(s, id, streamInit)
+	s.streamLock.Lock()
+	s.streams[id] = stream
+	s.inflight[id] = struct{}{}
+	s.streamLock.Unlock()
+
+	if s.config.StreamOpenTimeout > 0 {
+		go s.setOpenTimeout(stream)
+	}
+
+	// Send the window update to create
+	if err := stream.sendWindowUpdate(); err != nil {
+		select {
+		case <-s.synCh:
+		default:
+			s.logger.Printf("[ERR] yamux: aborted stream open without inflight syn semaphore")
+		}
+		return nil, err
+	}
+	return stream, nil
+}
+
+// setOpenTimeout implements a timeout for streams that are opened but not established.
+// If the StreamOpenTimeout is exceeded we assume the peer is unable to ACK,
+// and close the session.
+// The number of running timers is bounded by the capacity of the synCh.
+func (s *Session) setOpenTimeout(stream *Stream) {
+	timer := time.NewTimer(s.config.StreamOpenTimeout)
+	defer timer.Stop()
+
+	select {
+	case <-stream.establishCh:
+		return
+	case <-s.shutdownCh:
+		return
+	case <-timer.C:
+		// Timeout reached while waiting for ACK.
+		// Close the session to force connection re-establishment.
+		s.logger.Printf("[ERR] yamux: aborted stream open (destination=%s): %v", s.RemoteAddr().String(), ErrTimeout.err)
+		s.Close()
+	}
+}
+
+// Accept is used to block until the next available stream
+// is ready to be accepted.
+func (s *Session) Accept() (net.Conn, error) {
+	conn, err := s.AcceptStream()
+	if err != nil {
+		return nil, err
+	}
+	return conn, err
+}
+
+// AcceptStream is used to block until the next available stream
+// is ready to be accepted.
+func (s *Session) AcceptStream() (*Stream, error) {
+	select {
+	case stream := <-s.acceptCh:
+		if err := stream.sendWindowUpdate(); err != nil {
+			return nil, err
+		}
+		return stream, nil
+	case <-s.shutdownCh:
+		return nil, s.shutdownErr
+	}
+}
+
+// AcceptStream is used to block until the next available stream
+// is ready to be accepted.
+func (s *Session) AcceptStreamWithContext(ctx context.Context) (*Stream, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case stream := <-s.acceptCh:
+		if err := stream.sendWindowUpdate(); err != nil {
+			return nil, err
+		}
+		return stream, nil
+	case <-s.shutdownCh:
+		return nil, s.shutdownErr
+	}
+}
+
+// Close is used to close the session and all streams.
+// Attempts to send a GoAway before closing the connection.
+func (s *Session) Close() error {
+	s.shutdownLock.Lock()
+	defer s.shutdownLock.Unlock()
+
+	if s.shutdown {
+		return nil
+	}
+	s.shutdown = true
+
+	s.shutdownErrLock.Lock()
+	if s.shutdownErr == nil {
+		s.shutdownErr = ErrSessionShutdown
+	}
+	s.shutdownErrLock.Unlock()
+
+	close(s.shutdownCh)
+
+	s.conn.Close()
+	<-s.recvDoneCh
+
+	s.streamLock.Lock()
+	defer s.streamLock.Unlock()
+	for _, stream := range s.streams {
+		stream.forceClose()
+	}
+	<-s.sendDoneCh
+	return nil
+}
+
+// exitErr is used to handle an error that is causing the
+// session to terminate.
+func (s *Session) exitErr(err error) {
+	s.shutdownErrLock.Lock()
+	if s.shutdownErr == nil {
+		s.shutdownErr = err
+	}
+	s.shutdownErrLock.Unlock()
+	s.Close()
+}
+
+// GoAway can be used to prevent accepting further
+// connections. It does not close the underlying conn.
+func (s *Session) GoAway() error {
+	return s.waitForSend(s.goAway(goAwayNormal), nil)
+}
+
+// goAway is used to send a goAway message
+func (s *Session) goAway(reason uint32) header {
+	atomic.SwapInt32(&s.localGoAway, 1)
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typeGoAway, 0, 0, reason)
+	return hdr
+}
+
+// Ping is used to measure the RTT response time
+func (s *Session) Ping() (time.Duration, error) {
+	// Get a channel for the ping
+	ch := make(chan struct{})
+
+	// Get a new ping id, mark as pending
+	s.pingLock.Lock()
+	id := s.pingID
+	s.pingID++
+	s.pings[id] = ch
+	s.pingLock.Unlock()
+
+	// Send the ping request
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typePing, flagSYN, 0, id)
+	if err := s.waitForSend(hdr, nil); err != nil {
+		return 0, err
+	}
+
+	// Wait for a response
+	start := time.Now()
+	select {
+	case <-ch:
+	case <-time.After(s.config.ConnectionWriteTimeout):
+		s.pingLock.Lock()
+		delete(s.pings, id) // Ignore it if a response comes later.
+		s.pingLock.Unlock()
+		return 0, ErrTimeout
+	case <-s.shutdownCh:
+		return 0, ErrSessionShutdown
+	}
+
+	// Compute the RTT
+	return time.Since(start), nil
+}
+
+// keepalive is a long running goroutine that periodically does
+// a ping to keep the connection alive.
+func (s *Session) keepalive() {
+	for {
+		select {
+		case <-time.After(s.config.KeepAliveInterval):
+			_, err := s.Ping()
+			if err != nil {
+				if err != ErrSessionShutdown {
+					s.logger.Printf("[ERR] yamux: keepalive failed: %v", err)
+					s.exitErr(ErrKeepAliveTimeout)
+				}
+				return
+			}
+		case <-s.shutdownCh:
+			return
+		}
+	}
+}
+
+// waitForSendErr waits to send a header, checking for a potential shutdown
+func (s *Session) waitForSend(hdr header, body []byte) error {
+	errCh := make(chan error, 1)
+	return s.waitForSendErr(hdr, body, errCh)
+}
+
+// waitForSendErr waits to send a header with optional data, checking for a
+// potential shutdown. Since there's the expectation that sends can happen
+// in a timely manner, we enforce the connection write timeout here.
+func (s *Session) waitForSendErr(hdr header, body []byte, errCh chan error) error {
+	t := timerPool.Get()
+	timer := t.(*time.Timer)
+	timer.Reset(s.config.ConnectionWriteTimeout)
+	defer func() {
+		timer.Stop()
+		select {
+		case <-timer.C:
+		default:
+		}
+		timerPool.Put(t)
+	}()
+
+	ready := &sendReady{Hdr: hdr, Body: body, Err: errCh}
+	select {
+	case s.sendCh <- ready:
+	case <-s.shutdownCh:
+		return ErrSessionShutdown
+	case <-timer.C:
+		return ErrConnectionWriteTimeout
+	}
+
+	bodyCopy := func() {
+		if body == nil {
+			return // A nil body is ignored.
+		}
+
+		// In the event of session shutdown or connection write timeout,
+		// we need to prevent `send` from reading the body buffer after
+		// returning from this function since the caller may re-use the
+		// underlying array.
+		ready.mu.Lock()
+		defer ready.mu.Unlock()
+
+		if ready.Body == nil {
+			return // Body was already copied in `send`.
+		}
+		newBody := make([]byte, len(body))
+		copy(newBody, body)
+		ready.Body = newBody
+	}
+
+	select {
+	case err := <-errCh:
+		return err
+	case <-s.shutdownCh:
+		bodyCopy()
+		return ErrSessionShutdown
+	case <-timer.C:
+		bodyCopy()
+		return ErrConnectionWriteTimeout
+	}
+}
+
+// sendNoWait does a send without waiting. Since there's the expectation that
+// the send happens right here, we enforce the connection write timeout if we
+// can't queue the header to be sent.
+func (s *Session) sendNoWait(hdr header) error {
+	t := timerPool.Get()
+	timer := t.(*time.Timer)
+	timer.Reset(s.config.ConnectionWriteTimeout)
+	defer func() {
+		timer.Stop()
+		select {
+		case <-timer.C:
+		default:
+		}
+		timerPool.Put(t)
+	}()
+
+	select {
+	case s.sendCh <- &sendReady{Hdr: hdr}:
+		return nil
+	case <-s.shutdownCh:
+		return ErrSessionShutdown
+	case <-timer.C:
+		return ErrConnectionWriteTimeout
+	}
+}
+
+// send is a long running goroutine that sends data
+func (s *Session) send() {
+	if err := s.sendLoop(); err != nil {
+		s.exitErr(err)
+	}
+}
+
+func (s *Session) sendLoop() error {
+	defer close(s.sendDoneCh)
+	var bodyBuf bytes.Buffer
+	for {
+		bodyBuf.Reset()
+
+		select {
+		case ready := <-s.sendCh:
+			// Send a header if ready
+			if ready.Hdr != nil {
+				_, err := s.conn.Write(ready.Hdr)
+				if err != nil {
+					s.logger.Printf("[ERR] yamux: Failed to write header: %v", err)
+					asyncSendErr(ready.Err, err)
+					return err
+				}
+			}
+
+			ready.mu.Lock()
+			if ready.Body != nil {
+				// Copy the body into the buffer to avoid
+				// holding a mutex lock during the write.
+				_, err := bodyBuf.Write(ready.Body)
+				if err != nil {
+					ready.Body = nil
+					ready.mu.Unlock()
+					s.logger.Printf("[ERR] yamux: Failed to copy body into buffer: %v", err)
+					asyncSendErr(ready.Err, err)
+					return err
+				}
+				ready.Body = nil
+			}
+			ready.mu.Unlock()
+
+			if bodyBuf.Len() > 0 {
+				// Send data from a body if given
+				_, err := s.conn.Write(bodyBuf.Bytes())
+				if err != nil {
+					s.logger.Printf("[ERR] yamux: Failed to write body: %v", err)
+					asyncSendErr(ready.Err, err)
+					return err
+				}
+			}
+
+			// No error, successful send
+			asyncSendErr(ready.Err, nil)
+		case <-s.shutdownCh:
+			return nil
+		}
+	}
+}
+
+// recv is a long running goroutine that accepts new data
+func (s *Session) recv() {
+	if err := s.recvLoop(); err != nil {
+		s.exitErr(err)
+	}
+}
+
+// Ensure that the index of the handler (typeData/typeWindowUpdate/etc) matches the message type
+var (
+	handlers = []func(*Session, header) error{
+		typeData:         (*Session).handleStreamMessage,
+		typeWindowUpdate: (*Session).handleStreamMessage,
+		typePing:         (*Session).handlePing,
+		typeGoAway:       (*Session).handleGoAway,
+	}
+)
+
+// recvLoop continues to receive data until a fatal error is encountered
+func (s *Session) recvLoop() error {
+	defer close(s.recvDoneCh)
+	hdr := header(make([]byte, headerSize))
+	for {
+		// Read the header
+		if _, err := io.ReadFull(s.bufRead, hdr); err != nil {
+			if err != io.EOF && !strings.Contains(err.Error(), "closed") && !strings.Contains(err.Error(), "reset by peer") {
+				s.logger.Printf("[ERR] yamux: Failed to read header: %v", err)
+			}
+			return err
+		}
+
+		// Verify the version
+		if hdr.Version() != protoVersion {
+			s.logger.Printf("[ERR] yamux: Invalid protocol version: %d", hdr.Version())
+			return ErrInvalidVersion
+		}
+
+		mt := hdr.MsgType()
+		if mt < typeData || mt > typeGoAway {
+			return ErrInvalidMsgType
+		}
+
+		if err := handlers[mt](s, hdr); err != nil {
+			return err
+		}
+	}
+}
+
+// handleStreamMessage handles either a data or window update frame
+func (s *Session) handleStreamMessage(hdr header) error {
+	// Check for a new stream creation
+	id := hdr.StreamID()
+	flags := hdr.Flags()
+	if flags&flagSYN == flagSYN {
+		if err := s.incomingStream(id); err != nil {
+			return err
+		}
+	}
+
+	// Get the stream
+	s.streamLock.Lock()
+	stream := s.streams[id]
+	s.streamLock.Unlock()
+
+	// If we do not have a stream, likely we sent a RST
+	if stream == nil {
+		// Drain any data on the wire
+		if hdr.MsgType() == typeData && hdr.Length() > 0 {
+			s.logger.Printf("[WARN] yamux: Discarding data for stream: %d", id)
+			if _, err := io.CopyN(ioutil.Discard, s.bufRead, int64(hdr.Length())); err != nil {
+				s.logger.Printf("[ERR] yamux: Failed to discard data: %v", err)
+				return nil
+			}
+		} else {
+			s.logger.Printf("[WARN] yamux: frame for missing stream: %v", hdr)
+		}
+		return nil
+	}
+
+	// Check if this is a window update
+	if hdr.MsgType() == typeWindowUpdate {
+		if err := stream.incrSendWindow(hdr, flags); err != nil {
+			if sendErr := s.sendNoWait(s.goAway(goAwayProtoErr)); sendErr != nil {
+				s.logger.Printf("[WARN] yamux: failed to send go away: %v", sendErr)
+			}
+			return err
+		}
+		return nil
+	}
+
+	// Read the new data
+	if err := stream.readData(hdr, flags, s.bufRead); err != nil {
+		if sendErr := s.sendNoWait(s.goAway(goAwayProtoErr)); sendErr != nil {
+			s.logger.Printf("[WARN] yamux: failed to send go away: %v", sendErr)
+		}
+		return err
+	}
+	return nil
+}
+
+// handlePing is invokde for a typePing frame
+func (s *Session) handlePing(hdr header) error {
+	flags := hdr.Flags()
+	pingID := hdr.Length()
+
+	// Check if this is a query, respond back in a separate context so we
+	// don't interfere with the receiving thread blocking for the write.
+	if flags&flagSYN == flagSYN {
+		go func() {
+			hdr := header(make([]byte, headerSize))
+			hdr.encode(typePing, flagACK, 0, pingID)
+			if err := s.sendNoWait(hdr); err != nil {
+				s.logger.Printf("[WARN] yamux: failed to send ping reply: %v", err)
+			}
+		}()
+		return nil
+	}
+
+	// Handle a response
+	s.pingLock.Lock()
+	ch := s.pings[pingID]
+	if ch != nil {
+		delete(s.pings, pingID)
+		close(ch)
+	}
+	s.pingLock.Unlock()
+	return nil
+}
+
+// handleGoAway is invokde for a typeGoAway frame
+func (s *Session) handleGoAway(hdr header) error {
+	code := hdr.Length()
+	switch code {
+	case goAwayNormal:
+		atomic.SwapInt32(&s.remoteGoAway, 1)
+	case goAwayProtoErr:
+		s.logger.Printf("[ERR] yamux: received protocol error go away")
+		return fmt.Errorf("yamux protocol error")
+	case goAwayInternalErr:
+		s.logger.Printf("[ERR] yamux: received internal error go away")
+		return fmt.Errorf("remote yamux internal error")
+	default:
+		s.logger.Printf("[ERR] yamux: received unexpected go away")
+		return fmt.Errorf("unexpected go away received")
+	}
+	return nil
+}
+
+// incomingStream is used to create a new incoming stream
+func (s *Session) incomingStream(id uint32) error {
+	// Reject immediately if we are doing a go away
+	if atomic.LoadInt32(&s.localGoAway) == 1 {
+		hdr := header(make([]byte, headerSize))
+		hdr.encode(typeWindowUpdate, flagRST, id, 0)
+		return s.sendNoWait(hdr)
+	}
+
+	// Allocate a new stream
+	stream := newStream(s, id, streamSYNReceived)
+
+	s.streamLock.Lock()
+	defer s.streamLock.Unlock()
+
+	// Check if stream already exists
+	if _, ok := s.streams[id]; ok {
+		s.logger.Printf("[ERR] yamux: duplicate stream declared")
+		if sendErr := s.sendNoWait(s.goAway(goAwayProtoErr)); sendErr != nil {
+			s.logger.Printf("[WARN] yamux: failed to send go away: %v", sendErr)
+		}
+		return ErrDuplicateStream
+	}
+
+	// Register the stream
+	s.streams[id] = stream
+
+	// Check if we've exceeded the backlog
+	select {
+	case s.acceptCh <- stream:
+		return nil
+	default:
+		// Backlog exceeded! RST the stream
+		s.logger.Printf("[WARN] yamux: backlog exceeded, forcing connection reset")
+		delete(s.streams, id)
+		hdr := header(make([]byte, headerSize))
+		hdr.encode(typeWindowUpdate, flagRST, id, 0)
+		return s.sendNoWait(hdr)
+	}
+}
+
+// closeStream is used to close a stream once both sides have
+// issued a close. If there was an in-flight SYN and the stream
+// was not yet established, then this will give the credit back.
+func (s *Session) closeStream(id uint32) {
+	s.streamLock.Lock()
+	if _, ok := s.inflight[id]; ok {
+		select {
+		case <-s.synCh:
+		default:
+			s.logger.Printf("[ERR] yamux: SYN tracking out of sync")
+		}
+	}
+	delete(s.streams, id)
+	s.streamLock.Unlock()
+}
+
+// establishStream is used to mark a stream that was in the
+// SYN Sent state as established.
+func (s *Session) establishStream(id uint32) {
+	s.streamLock.Lock()
+	if _, ok := s.inflight[id]; ok {
+		delete(s.inflight, id)
+	} else {
+		s.logger.Printf("[ERR] yamux: established stream without inflight SYN (no tracking entry)")
+	}
+	select {
+	case <-s.synCh:
+	default:
+		s.logger.Printf("[ERR] yamux: established stream without inflight SYN (didn't have semaphore)")
+	}
+	s.streamLock.Unlock()
+}

implant/vendor/github.com/hashicorp/yamux/spec.md

@@ -0,0 +1,140 @@
+# Specification
+
+We use this document to detail the internal specification of Yamux.
+This is used both as a guide for implementing Yamux, but also for
+alternative interoperable libraries to be built.
+
+# Framing
+
+Yamux uses a streaming connection underneath, but imposes a message
+framing so that it can be shared between many logical streams. Each
+frame contains a header like:
+
+* Version (8 bits)
+* Type (8 bits)
+* Flags (16 bits)
+* StreamID (32 bits)
+* Length (32 bits)
+
+This means that each header has a 12 byte overhead.
+All fields are encoded in network order (big endian).
+Each field is described below:
+
+## Version Field
+
+The version field is used for future backward compatibility. At the
+current time, the field is always set to 0, to indicate the initial
+version.
+
+## Type Field
+
+The type field is used to switch the frame message type. The following
+message types are supported:
+
+* 0x0 Data - Used to transmit data. May transmit zero length payloads
+  depending on the flags.
+
+* 0x1 Window Update - Used to updated the senders receive window size.
+  This is used to implement per-session flow control.
+
+* 0x2 Ping - Used to measure RTT. It can also be used to heart-beat
+  and do keep-alives over TCP.
+
+* 0x3 Go Away - Used to close a session.
+
+## Flag Field
+
+The flags field is used to provide additional information related
+to the message type. The following flags are supported:
+
+* 0x1 SYN - Signals the start of a new stream. May be sent with a data or
+  window update message. Also sent with a ping to indicate outbound.
+
+* 0x2 ACK - Acknowledges the start of a new stream. May be sent with a data
+  or window update message. Also sent with a ping to indicate response.
+
+* 0x4 FIN - Performs a half-close of a stream. May be sent with a data
+  message or window update.
+
+* 0x8 RST - Reset a stream immediately. May be sent with a data or
+  window update message.
+
+## StreamID Field
+
+The StreamID field is used to identify the logical stream the frame
+is addressing. The client side should use odd ID's, and the server even.
+This prevents any collisions. Additionally, the 0 ID is reserved to represent
+the session.
+
+Both Ping and Go Away messages should always use the 0 StreamID.
+
+## Length Field
+
+The meaning of the length field depends on the message type:
+
+* Data - provides the length of bytes following the header
+* Window update - provides a delta update to the window size
+* Ping - Contains an opaque value, echoed back
+* Go Away - Contains an error code
+
+# Message Flow
+
+There is no explicit connection setup, as Yamux relies on an underlying
+transport to be provided. However, there is a distinction between client
+and server side of the connection.
+
+## Opening a stream
+
+To open a stream, an initial data or window update frame is sent
+with a new StreamID. The SYN flag should be set to signal a new stream.
+
+The receiver must then reply with either a data or window update frame
+with the StreamID along with the ACK flag to accept the stream or with
+the RST flag to reject the stream.
+
+Because we are relying on the reliable stream underneath, a connection
+can begin sending data once the SYN flag is sent. The corresponding
+ACK does not need to be received. This is particularly well suited
+for an RPC system where a client wants to open a stream and immediately
+fire a request without waiting for the RTT of the ACK.
+
+This does introduce the possibility of a connection being rejected
+after data has been sent already. This is a slight semantic difference
+from TCP, where the connection cannot be refused after it is opened.
+Clients should be prepared to handle this by checking for an error
+that indicates a RST was received.
+
+## Closing a stream
+
+To close a stream, either side sends a data or window update frame
+along with the FIN flag. This does a half-close indicating the sender
+will send no further data.
+
+Once both sides have closed the connection, the stream is closed.
+
+Alternatively, if an error occurs, the RST flag can be used to
+hard close a stream immediately.
+
+## Flow Control
+
+When Yamux is initially starts each stream with a 256KB window size.
+There is no window size for the session.
+
+To prevent the streams from stalling, window update frames should be
+sent regularly. Yamux can be configured to provide a larger limit for
+windows sizes. Both sides assume the initial 256KB window, but can
+immediately send a window update as part of the SYN/ACK indicating a
+larger window.
+
+Both sides should track the number of bytes sent in Data frames
+only, as only they are tracked as part of the window size.
+
+## Session termination
+
+When a session is being terminated, the Go Away message should
+be sent. The Length should be set to one of the following to
+provide an error code:
+
+* 0x0 Normal termination
+* 0x1 Protocol error
+* 0x2 Internal error

implant/vendor/github.com/hashicorp/yamux/stream.go

@@ -0,0 +1,556 @@
+package yamux
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+type streamState int
+
+const (
+	streamInit streamState = iota
+	streamSYNSent
+	streamSYNReceived
+	streamEstablished
+	streamLocalClose
+	streamRemoteClose
+	streamClosed
+	streamReset
+)
+
+// Stream is used to represent a logical stream
+// within a session.
+type Stream struct {
+	recvWindow uint32
+	sendWindow uint32
+
+	id      uint32
+	session *Session
+
+	state     streamState
+	stateLock sync.Mutex
+
+	recvBuf  *bytes.Buffer
+	recvLock sync.Mutex
+
+	controlHdr     header
+	controlErr     chan error
+	controlHdrLock sync.Mutex
+
+	sendHdr  header
+	sendErr  chan error
+	sendLock sync.Mutex
+
+	recvNotifyCh chan struct{}
+	sendNotifyCh chan struct{}
+
+	readDeadline  atomic.Value // time.Time
+	writeDeadline atomic.Value // time.Time
+
+	// establishCh is notified if the stream is established or being closed.
+	establishCh chan struct{}
+
+	// closeTimer is set with stateLock held to honor the StreamCloseTimeout
+	// setting on Session.
+	closeTimer *time.Timer
+}
+
+// newStream is used to construct a new stream within
+// a given session for an ID
+func newStream(session *Session, id uint32, state streamState) *Stream {
+	s := &Stream{
+		id:           id,
+		session:      session,
+		state:        state,
+		controlHdr:   header(make([]byte, headerSize)),
+		controlErr:   make(chan error, 1),
+		sendHdr:      header(make([]byte, headerSize)),
+		sendErr:      make(chan error, 1),
+		recvWindow:   initialStreamWindow,
+		sendWindow:   initialStreamWindow,
+		recvNotifyCh: make(chan struct{}, 1),
+		sendNotifyCh: make(chan struct{}, 1),
+		establishCh:  make(chan struct{}, 1),
+	}
+	s.readDeadline.Store(time.Time{})
+	s.writeDeadline.Store(time.Time{})
+	return s
+}
+
+// Session returns the associated stream session
+func (s *Stream) Session() *Session {
+	return s.session
+}
+
+// StreamID returns the ID of this stream
+func (s *Stream) StreamID() uint32 {
+	return s.id
+}
+
+// Read is used to read from the stream
+func (s *Stream) Read(b []byte) (n int, err error) {
+	defer asyncNotify(s.recvNotifyCh)
+START:
+
+	// If the stream is closed and there's no data buffered, return EOF
+	s.stateLock.Lock()
+	switch s.state {
+	case streamLocalClose:
+		// LocalClose only prohibits further local writes. Handle reads normally.
+	case streamRemoteClose:
+		fallthrough
+	case streamClosed:
+		s.recvLock.Lock()
+		if s.recvBuf == nil || s.recvBuf.Len() == 0 {
+			s.recvLock.Unlock()
+			s.stateLock.Unlock()
+			return 0, io.EOF
+		}
+		s.recvLock.Unlock()
+	case streamReset:
+		s.stateLock.Unlock()
+		return 0, ErrConnectionReset
+	}
+	s.stateLock.Unlock()
+
+	// If there is no data available, block
+	s.recvLock.Lock()
+	if s.recvBuf == nil || s.recvBuf.Len() == 0 {
+		s.recvLock.Unlock()
+		goto WAIT
+	}
+
+	// Read any bytes
+	n, _ = s.recvBuf.Read(b)
+	s.recvLock.Unlock()
+
+	// Send a window update potentially
+	err = s.sendWindowUpdate()
+	if err == ErrSessionShutdown {
+		err = nil
+	}
+	return n, err
+
+WAIT:
+	var timeout <-chan time.Time
+	var timer *time.Timer
+	readDeadline := s.readDeadline.Load().(time.Time)
+	if !readDeadline.IsZero() {
+		delay := time.Until(readDeadline)
+		timer = time.NewTimer(delay)
+		timeout = timer.C
+	}
+	select {
+	case <-s.session.shutdownCh:
+	case <-s.recvNotifyCh:
+	case <-timeout:
+		return 0, ErrTimeout
+	}
+	if timer != nil {
+		if !timer.Stop() {
+			<-timeout
+		}
+	}
+	goto START
+}
+
+// Write is used to write to the stream
+func (s *Stream) Write(b []byte) (n int, err error) {
+	s.sendLock.Lock()
+	defer s.sendLock.Unlock()
+	total := 0
+	for total < len(b) {
+		n, err := s.write(b[total:])
+		total += n
+		if err != nil {
+			return total, err
+		}
+	}
+	return total, nil
+}
+
+// write is used to write to the stream, may return on
+// a short write.
+func (s *Stream) write(b []byte) (n int, err error) {
+	var flags uint16
+	var max uint32
+	var body []byte
+START:
+	s.stateLock.Lock()
+	switch s.state {
+	case streamLocalClose:
+		fallthrough
+	case streamClosed:
+		s.stateLock.Unlock()
+		return 0, ErrStreamClosed
+	case streamReset:
+		s.stateLock.Unlock()
+		return 0, ErrConnectionReset
+	}
+	s.stateLock.Unlock()
+
+	// If there is no data available, block
+	window := atomic.LoadUint32(&s.sendWindow)
+	if window == 0 {
+		goto WAIT
+	}
+
+	// Determine the flags if any
+	flags = s.sendFlags()
+
+	// Send up to our send window
+	max = min(window, uint32(len(b)))
+	body = b[:max]
+
+	// Send the header
+	s.sendHdr.encode(typeData, flags, s.id, max)
+	if err = s.session.waitForSendErr(s.sendHdr, body, s.sendErr); err != nil {
+		if errors.Is(err, ErrSessionShutdown) || errors.Is(err, ErrConnectionWriteTimeout) {
+			// Message left in ready queue, header re-use is unsafe.
+			s.sendHdr = header(make([]byte, headerSize))
+		}
+		return 0, err
+	}
+
+	// Reduce our send window
+	atomic.AddUint32(&s.sendWindow, ^uint32(max-1))
+
+	// Unlock
+	return int(max), err
+
+WAIT:
+	var timeout <-chan time.Time
+	var timer *time.Timer
+	writeDeadline := s.writeDeadline.Load().(time.Time)
+	if !writeDeadline.IsZero() {
+		delay := time.Until(writeDeadline)
+		timer = time.NewTimer(delay)
+		timeout = timer.C
+	}
+	select {
+	case <-s.session.shutdownCh:
+	case <-s.sendNotifyCh:
+	case <-timeout:
+		return 0, ErrTimeout
+	}
+	if timer != nil {
+		if !timer.Stop() {
+			<-timeout
+		}
+	}
+	goto START
+}
+
+// sendFlags determines any flags that are appropriate
+// based on the current stream state
+func (s *Stream) sendFlags() uint16 {
+	s.stateLock.Lock()
+	defer s.stateLock.Unlock()
+	var flags uint16
+	switch s.state {
+	case streamInit:
+		flags |= flagSYN
+		s.state = streamSYNSent
+	case streamSYNReceived:
+		flags |= flagACK
+		s.state = streamEstablished
+	}
+	return flags
+}
+
+// sendWindowUpdate potentially sends a window update enabling
+// further writes to take place. Must be invoked with the lock.
+func (s *Stream) sendWindowUpdate() error {
+	s.controlHdrLock.Lock()
+	defer s.controlHdrLock.Unlock()
+
+	// Determine the delta update
+	max := s.session.config.MaxStreamWindowSize
+	var bufLen uint32
+	s.recvLock.Lock()
+	if s.recvBuf != nil {
+		bufLen = uint32(s.recvBuf.Len())
+	}
+	delta := (max - bufLen) - s.recvWindow
+
+	// Determine the flags if any
+	flags := s.sendFlags()
+
+	// Check if we can omit the update
+	if delta < (max/2) && flags == 0 {
+		s.recvLock.Unlock()
+		return nil
+	}
+
+	// Update our window
+	s.recvWindow += delta
+	s.recvLock.Unlock()
+
+	// Send the header
+	s.controlHdr.encode(typeWindowUpdate, flags, s.id, delta)
+	if err := s.session.waitForSendErr(s.controlHdr, nil, s.controlErr); err != nil {
+		if errors.Is(err, ErrSessionShutdown) || errors.Is(err, ErrConnectionWriteTimeout) {
+			// Message left in ready queue, header re-use is unsafe.
+			s.controlHdr = header(make([]byte, headerSize))
+		}
+		return err
+	}
+	return nil
+}
+
+// sendClose is used to send a FIN
+func (s *Stream) sendClose() error {
+	s.controlHdrLock.Lock()
+	defer s.controlHdrLock.Unlock()
+
+	flags := s.sendFlags()
+	flags |= flagFIN
+	s.controlHdr.encode(typeWindowUpdate, flags, s.id, 0)
+	if err := s.session.waitForSendErr(s.controlHdr, nil, s.controlErr); err != nil {
+		if errors.Is(err, ErrSessionShutdown) || errors.Is(err, ErrConnectionWriteTimeout) {
+			// Message left in ready queue, header re-use is unsafe.
+			s.controlHdr = header(make([]byte, headerSize))
+		}
+		return err
+	}
+	return nil
+}
+
+// Close is used to close the stream
+func (s *Stream) Close() error {
+	closeStream := false
+	s.stateLock.Lock()
+	switch s.state {
+	// Opened means we need to signal a close
+	case streamSYNSent:
+		fallthrough
+	case streamSYNReceived:
+		fallthrough
+	case streamEstablished:
+		s.state = streamLocalClose
+		goto SEND_CLOSE
+
+	case streamLocalClose:
+	case streamRemoteClose:
+		s.state = streamClosed
+		closeStream = true
+		goto SEND_CLOSE
+
+	case streamClosed:
+	case streamReset:
+	default:
+		panic("unhandled state")
+	}
+	s.stateLock.Unlock()
+	return nil
+SEND_CLOSE:
+	// This shouldn't happen (the more realistic scenario to cancel the
+	// timer is via processFlags) but just in case this ever happens, we
+	// cancel the timer to prevent dangling timers.
+	if s.closeTimer != nil {
+		s.closeTimer.Stop()
+		s.closeTimer = nil
+	}
+
+	// If we have a StreamCloseTimeout set we start the timeout timer.
+	// We do this only if we're not already closing the stream since that
+	// means this was a graceful close.
+	//
+	// This prevents memory leaks if one side (this side) closes and the
+	// remote side poorly behaves and never responds with a FIN to complete
+	// the close. After the specified timeout, we clean our resources up no
+	// matter what.
+	if !closeStream && s.session.config.StreamCloseTimeout > 0 {
+		s.closeTimer = time.AfterFunc(
+			s.session.config.StreamCloseTimeout, s.closeTimeout)
+	}
+
+	s.stateLock.Unlock()
+	s.sendClose()
+	s.notifyWaiting()
+	if closeStream {
+		s.session.closeStream(s.id)
+	}
+	return nil
+}
+
+// closeTimeout is called after StreamCloseTimeout during a close to
+// close this stream.
+func (s *Stream) closeTimeout() {
+	// Close our side forcibly
+	s.forceClose()
+
+	// Free the stream from the session map
+	s.session.closeStream(s.id)
+
+	// Send a RST so the remote side closes too.
+	s.sendLock.Lock()
+	defer s.sendLock.Unlock()
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typeWindowUpdate, flagRST, s.id, 0)
+	_ = s.session.sendNoWait(hdr)
+}
+
+// forceClose is used for when the session is exiting
+func (s *Stream) forceClose() {
+	s.stateLock.Lock()
+	s.state = streamClosed
+	s.stateLock.Unlock()
+	s.notifyWaiting()
+}
+
+// processFlags is used to update the state of the stream
+// based on set flags, if any. Lock must be held
+func (s *Stream) processFlags(flags uint16) error {
+	s.stateLock.Lock()
+	defer s.stateLock.Unlock()
+
+	// Close the stream without holding the state lock
+	closeStream := false
+	defer func() {
+		if closeStream {
+			if s.closeTimer != nil {
+				// Stop our close timeout timer since we gracefully closed
+				s.closeTimer.Stop()
+			}
+
+			s.session.closeStream(s.id)
+		}
+	}()
+
+	if flags&flagACK == flagACK {
+		if s.state == streamSYNSent {
+			s.state = streamEstablished
+		}
+		asyncNotify(s.establishCh)
+		s.session.establishStream(s.id)
+	}
+	if flags&flagFIN == flagFIN {
+		switch s.state {
+		case streamSYNSent:
+			fallthrough
+		case streamSYNReceived:
+			fallthrough
+		case streamEstablished:
+			s.state = streamRemoteClose
+			s.notifyWaiting()
+		case streamLocalClose:
+			s.state = streamClosed
+			closeStream = true
+			s.notifyWaiting()
+		default:
+			s.session.logger.Printf("[ERR] yamux: unexpected FIN flag in state %d", s.state)
+			return ErrUnexpectedFlag
+		}
+	}
+	if flags&flagRST == flagRST {
+		s.state = streamReset
+		closeStream = true
+		s.notifyWaiting()
+	}
+	return nil
+}
+
+// notifyWaiting notifies all the waiting channels
+func (s *Stream) notifyWaiting() {
+	asyncNotify(s.recvNotifyCh)
+	asyncNotify(s.sendNotifyCh)
+	asyncNotify(s.establishCh)
+}
+
+// incrSendWindow updates the size of our send window
+func (s *Stream) incrSendWindow(hdr header, flags uint16) error {
+	if err := s.processFlags(flags); err != nil {
+		return err
+	}
+
+	// Increase window, unblock a sender
+	atomic.AddUint32(&s.sendWindow, hdr.Length())
+	asyncNotify(s.sendNotifyCh)
+	return nil
+}
+
+// readData is used to handle a data frame
+func (s *Stream) readData(hdr header, flags uint16, conn io.Reader) error {
+	if err := s.processFlags(flags); err != nil {
+		return err
+	}
+
+	// Check that our recv window is not exceeded
+	length := hdr.Length()
+	if length == 0 {
+		return nil
+	}
+
+	// Wrap in a limited reader
+	conn = &io.LimitedReader{R: conn, N: int64(length)}
+
+	// Copy into buffer
+	s.recvLock.Lock()
+
+	if length > s.recvWindow {
+		s.session.logger.Printf("[ERR] yamux: receive window exceeded (stream: %d, remain: %d, recv: %d)", s.id, s.recvWindow, length)
+		s.recvLock.Unlock()
+		return ErrRecvWindowExceeded
+	}
+
+	if s.recvBuf == nil {
+		// Allocate the receive buffer just-in-time to fit the full data frame.
+		// This way we can read in the whole packet without further allocations.
+		s.recvBuf = bytes.NewBuffer(make([]byte, 0, length))
+	}
+	copiedLength, err := io.Copy(s.recvBuf, conn)
+	if err != nil {
+		s.session.logger.Printf("[ERR] yamux: Failed to read stream data: %v", err)
+		s.recvLock.Unlock()
+		return err
+	}
+
+	// Decrement the receive window
+	s.recvWindow -= uint32(copiedLength)
+	s.recvLock.Unlock()
+
+	// Unblock any readers
+	asyncNotify(s.recvNotifyCh)
+	return nil
+}
+
+// SetDeadline sets the read and write deadlines
+func (s *Stream) SetDeadline(t time.Time) error {
+	if err := s.SetReadDeadline(t); err != nil {
+		return err
+	}
+	if err := s.SetWriteDeadline(t); err != nil {
+		return err
+	}
+	return nil
+}
+
+// SetReadDeadline sets the deadline for blocked and future Read calls.
+func (s *Stream) SetReadDeadline(t time.Time) error {
+	s.readDeadline.Store(t)
+	asyncNotify(s.recvNotifyCh)
+	return nil
+}
+
+// SetWriteDeadline sets the deadline for blocked and future Write calls
+func (s *Stream) SetWriteDeadline(t time.Time) error {
+	s.writeDeadline.Store(t)
+	asyncNotify(s.sendNotifyCh)
+	return nil
+}
+
+// Shrink is used to compact the amount of buffers utilized
+// This is useful when using Yamux in a connection pool to reduce
+// the idle memory utilization.
+func (s *Stream) Shrink() {
+	s.recvLock.Lock()
+	if s.recvBuf != nil && s.recvBuf.Len() == 0 {
+		s.recvBuf = nil
+	}
+	s.recvLock.Unlock()
+}

implant/vendor/github.com/hashicorp/yamux/util.go

@@ -0,0 +1,50 @@
+package yamux
+
+import (
+	"sync"
+	"time"
+)
+
+// Logger is a abstract of *log.Logger
+type Logger interface {
+	Print(v ...interface{})
+	Printf(format string, v ...interface{})
+	Println(v ...interface{})
+}
+
+var (
+	timerPool = &sync.Pool{
+		New: func() interface{} {
+			timer := time.NewTimer(time.Hour * 1e6)
+			timer.Stop()
+			return timer
+		},
+	}
+)
+
+// asyncSendErr is used to try an async send of an error
+func asyncSendErr(ch chan error, err error) {
+	if ch == nil {
+		return
+	}
+	select {
+	case ch <- err:
+	default:
+	}
+}
+
+// asyncNotify is used to signal a waiting goroutine
+func asyncNotify(ch chan struct{}) {
+	select {
+	case ch <- struct{}{}:
+	default:
+	}
+}
+
+// min computes the minimum of two values
+func min(a, b uint32) uint32 {
+	if a < b {
+		return a
+	}
+	return b
+}

implant/vendor/modules.txt

@@ -45,6 +45,9 @@ github.com/google/btree
 # github.com/hashicorp/go-uuid v1.0.2
 ## explicit
 github.com/hashicorp/go-uuid
+# github.com/hashicorp/yamux v0.1.2
+## explicit; go 1.20
+github.com/hashicorp/yamux
 # github.com/jcmturner/gofork v1.0.0
 ## explicit
 github.com/jcmturner/gofork/encoding/asn1

internal/yamuxtest/yamux_test.go

@@ -0,0 +1,83 @@
+package yamuxtest
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"net"
+	"sync"
+	"testing"
+
+	"github.com/hashicorp/yamux"
+)
+
+func TestYamuxConcurrentStreams(t *testing.T) {
+	serverConn, clientConn := net.Pipe()
+	serverSession, err := yamux.Server(serverConn, nil)
+	if err != nil {
+		t.Fatalf("server session: %v", err)
+	}
+	defer serverSession.Close()
+
+	clientSession, err := yamux.Client(clientConn, nil)
+	if err != nil {
+		t.Fatalf("client session: %v", err)
+	}
+	defer clientSession.Close()
+
+	const streams = 16
+	payloads := make([][]byte, streams)
+	for i := 0; i < streams; i++ {
+		payloads[i] = []byte(fmt.Sprintf("stream=%d payload=%s", i, bytes.Repeat([]byte{byte('a' + i)}, 4096)))
+	}
+
+	var openWg sync.WaitGroup
+	openWg.Add(streams)
+	for i := 0; i < streams; i++ {
+		i := i
+		go func() {
+			defer openWg.Done()
+			stream, err := clientSession.Open()
+			if err != nil {
+				t.Errorf("open stream %d: %v", i, err)
+				return
+			}
+			_, err = stream.Write(payloads[i])
+			_ = stream.Close()
+			if err != nil {
+				t.Errorf("write stream %d: %v", i, err)
+				return
+			}
+		}()
+	}
+
+	openWg.Wait()
+
+	wantSet := map[string]struct{}{}
+	for _, p := range payloads {
+		wantSet[string(p)] = struct{}{}
+	}
+
+	gotSet := map[string]struct{}{}
+	for i := 0; i < streams; i++ {
+		stream, err := serverSession.Accept()
+		if err != nil {
+			t.Fatalf("accept stream %d: %v", i, err)
+		}
+		b, err := io.ReadAll(stream)
+		_ = stream.Close()
+		if err != nil {
+			t.Fatalf("read stream %d: %v", i, err)
+		}
+		gotSet[string(b)] = struct{}{}
+	}
+
+	if len(gotSet) != len(wantSet) {
+		t.Fatalf("unexpected payload count: got=%d want=%d", len(gotSet), len(wantSet))
+	}
+	for want := range wantSet {
+		if _, ok := gotSet[want]; !ok {
+			t.Fatalf("missing payload: %q", want)
+		}
+	}
+}

server/c2/c2_test.go

@@ -36,13 +36,13 @@ var (
 )
 
 func TestMain(m *testing.M) {
-	implantConfig := setup()
+	implantBuild := setup()
 	code1 := m.Run()
-	cleanup(implantConfig)
+	cleanup(implantBuild)
 	os.Exit(code1)
 }
 
-func setup() *models.ImplantConfig {
+func setup() *models.ImplantBuild {
 	var err error
 	certs.SetupCAs()
 	serverAgeKeyPair = cryptography.AgeServerKeyPair()
@@ -60,6 +60,7 @@ func setup() *models.ImplantConfig {
 	publicKeyDigest := hex.EncodeToString(digest.Sum(nil))
 
 	implantBuild := &models.ImplantBuild{
+		Name:                "test-" + publicKeyDigest,
 		PeerPublicKey:       peerAgeKeyPair.Public,
 		PeerPublicKeyDigest: publicKeyDigest,
 		PeerPrivateKey:      peerAgeKeyPair.Private,
@@ -70,13 +71,11 @@ func setup() *models.ImplantConfig {
 	if err != nil {
 		panic(err)
 	}
+	return implantBuild
+}
 
-	implantConfig := &models.ImplantConfig{
-		ImplantBuilds: []models.ImplantBuild{*implantBuild},
+func cleanup(implantBuild *models.ImplantBuild) {
+	if implantBuild != nil {
+		db.Session().Delete(implantBuild)
 	}
-	return implantConfig
-}
-
-func cleanup(implantConfig *models.ImplantConfig) {
-	db.Session().Delete(implantConfig)
 }

server/c2/mtls.go

@@ -19,7 +19,10 @@ package c2
 */
 
 import (
+	"bufio"
 	"bytes"
+	"crypto/ed25519"
+	"crypto/sha256"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/binary"
@@ -27,13 +30,20 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"sync"
 
 	consts "github.com/bishopfox/sliver/client/constants"
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/server/certs"
 	"github.com/bishopfox/sliver/server/core"
+	serverCrypto "github.com/bishopfox/sliver/server/cryptography"
+	"github.com/bishopfox/sliver/server/db"
+	"github.com/bishopfox/sliver/server/db/models"
 	serverHandlers "github.com/bishopfox/sliver/server/handlers"
 	"github.com/bishopfox/sliver/server/log"
+	"github.com/bishopfox/sliver/util/minisign"
+	"github.com/hashicorp/yamux"
+	"golang.org/x/crypto/blake2b"
 	"google.golang.org/protobuf/proto"
 )
 
@@ -43,12 +53,57 @@ const (
 
 	// ServerMaxMessageSize - Server-side max GRPC message size
 	ServerMaxMessageSize = (2 * 1024 * 1024 * 1024) - 1
+
+	mtlsYamuxPreface = "MUX/1"
+
+	mtlsYamuxMaxConcurrentStreams = 128
+	mtlsYamuxMaxConcurrentSends   = 64
 )
 
 var (
 	mtlsLog = log.NamedLogger("c2", consts.MtlsStr)
+
+	mtlsYamuxPrefaceBytes = []byte(mtlsYamuxPreface)
+
+	mtlsImplantSigKeyCache sync.Map // map[uint64]ed25519.PublicKey
 )
 
+const mtlsEnvelopeSigningSeedPrefix = "env-signing-v1:"
+
+func deriveImplantSigningKey(peerPrivateKey string) (uint64, ed25519.PublicKey, error) {
+	if peerPrivateKey == "" {
+		return 0, nil, errors.New("[mtls] missing peer private key")
+	}
+	seed := sha256.Sum256([]byte(mtlsEnvelopeSigningSeedPrefix + peerPrivateKey))
+	priv := ed25519.NewKeyFromSeed(seed[:])
+	pub := priv.Public().(ed25519.PublicKey)
+	digest := blake2b.Sum256(pub)
+	keyID := binary.LittleEndian.Uint64(digest[:8])
+	return keyID, pub, nil
+}
+
+func lookupImplantSigKey(keyID uint64) (ed25519.PublicKey, bool, error) {
+	if cached, ok := mtlsImplantSigKeyCache.Load(keyID); ok {
+		return cached.(ed25519.PublicKey), true, nil
+	}
+
+	builds := []*models.ImplantBuild{}
+	if err := db.Session().Where(&models.ImplantBuild{}).Find(&builds).Error; err != nil {
+		return nil, false, err
+	}
+	for _, build := range builds {
+		buildKeyID, pub, err := deriveImplantSigningKey(build.PeerPrivateKey)
+		if err != nil {
+			continue
+		}
+		if buildKeyID == keyID {
+			mtlsImplantSigKeyCache.Store(keyID, pub)
+			return pub, false, nil
+		}
+	}
+	return nil, false, errors.New("[mtls] unknown implant signature key")
+}
+
 // StartMutualTLSListener - Start a mutual TLS listener
 func StartMutualTLSListener(bindIface string, port uint16) (net.Listener, error) {
 	mtlsLog.Infof("Starting raw TCP/mTLS listener on %s:%d", bindIface, port)
@@ -94,51 +149,144 @@ func handleSliverConnection(conn net.Conn) {
 		implantConn.Cleanup()
 	}()
 
-	done := make(chan bool)
+	br := bufio.NewReader(conn)
+	bufferedConn := &mtlsBufferedConn{Conn: conn, r: br}
+
+	preface, err := br.Peek(len(mtlsYamuxPrefaceBytes))
+	if err == nil && bytes.Equal(preface, mtlsYamuxPrefaceBytes) {
+		if _, err := br.Discard(len(mtlsYamuxPrefaceBytes)); err != nil {
+			mtlsLog.Errorf("Failed to discard yamux preface: %v", err)
+			return
+		}
+		handleSliverConnectionYamux(bufferedConn, implantConn)
+		return
+	}
+	mtlsLog.Warnf("Rejecting legacy mtls connection (missing yamux preface) from %s", conn.RemoteAddr())
+}
+
+type mtlsBufferedConn struct {
+	net.Conn
+	r *bufio.Reader
+}
+
+func (c *mtlsBufferedConn) Read(p []byte) (int, error) {
+	return c.r.Read(p)
+}
+
+func handleSliverConnectionYamux(conn net.Conn, implantConn *core.ImplantConnection) {
+	session, err := yamux.Server(conn, nil)
+	if err != nil {
+		mtlsLog.Errorf("Failed to initialize yamux session: %v", err)
+		return
+	}
+	defer session.Close()
+
+	done := make(chan struct{})
+	var doneOnce sync.Once
+	closeDone := func() {
+		doneOnce.Do(func() {
+			close(done)
+			session.Close()
+		})
+	}
+
+	streamSem := make(chan struct{}, mtlsYamuxMaxConcurrentStreams)
+	sendSem := make(chan struct{}, mtlsYamuxMaxConcurrentSends)
+	handlers := serverHandlers.GetHandlers()
+
 	go func() {
-		defer func() {
-			done <- true
-		}()
-		handlers := serverHandlers.GetHandlers()
+		defer closeDone()
 		for {
-			envelope, err := socketReadEnvelope(conn)
+			stream, err := session.Accept()
 			if err != nil {
-				mtlsLog.Errorf("Socket read error %v", err)
+				if !errors.Is(err, io.EOF) {
+					mtlsLog.Errorf("yamux accept error: %v", err)
+				}
 				return
 			}
-			implantConn.UpdateLastMessage()
-			if envelope.ID != 0 {
-				implantConn.RespMutex.RLock()
-				if resp, ok := implantConn.Resp[envelope.ID]; ok {
-					resp <- envelope // Could deadlock, maybe want to investigate better solutions
-				}
-				implantConn.RespMutex.RUnlock()
-			} else if handler, ok := handlers[envelope.Type]; ok {
-				mtlsLog.Debugf("Received new mtls message type %d, data: %s", envelope.Type, envelope.Data)
-				go func() {
-					respEnvelope := handler(implantConn, envelope.Data)
-					if respEnvelope != nil {
-						implantConn.Send <- respEnvelope
-					}
+
+			select {
+			case streamSem <- struct{}{}:
+			case <-done:
+				stream.Close()
+				return
+			}
+
+			go func(stream net.Conn) {
+				defer func() {
+					<-streamSem
 				}()
+				defer stream.Close()
+
+				envelope, err := socketReadEnvelope(stream)
+				if err != nil {
+					mtlsLog.Errorf("Stream read error %v", err)
+					closeDone()
+					return
+				}
+				implantConn.UpdateLastMessage()
+
+				if envelope.ID != 0 {
+					implantConn.RespMutex.RLock()
+					resp, ok := implantConn.Resp[envelope.ID]
+					implantConn.RespMutex.RUnlock()
+					if ok {
+						resp <- envelope
+					}
+					return
+				}
+
+				if handler, ok := handlers[envelope.Type]; ok {
+					mtlsLog.Debugf("Received new mtls message type %d, data: %s", envelope.Type, envelope.Data)
+					go func(envelope *sliverpb.Envelope) {
+						respEnvelope := handler(implantConn, envelope.Data)
+						if respEnvelope != nil {
+							implantConn.Send <- respEnvelope
+						}
+					}(envelope)
+				}
+			}(stream)
+		}
+	}()
+
+	go func() {
+		defer closeDone()
+		for {
+			select {
+			case envelope := <-implantConn.Send:
+				select {
+				case sendSem <- struct{}{}:
+				case <-done:
+					return
+				}
+
+				go func(envelope *sliverpb.Envelope) {
+					defer func() {
+						<-sendSem
+					}()
+
+					stream, err := session.Open()
+					if err != nil {
+						mtlsLog.Errorf("yamux open stream error: %v", err)
+						closeDone()
+						return
+					}
+					defer stream.Close()
+
+					if err := socketWriteEnvelope(stream, envelope); err != nil {
+						mtlsLog.Errorf("Stream write failed %v", err)
+						closeDone()
+						return
+					}
+				}(envelope)
+
+			case <-done:
+				return
 			}
 		}
 	}()
 
-Loop:
-	for {
-		select {
-		case envelope := <-implantConn.Send:
-			err := socketWriteEnvelope(conn, envelope)
-			if err != nil {
-				mtlsLog.Errorf("Socket write failed %v", err)
-				break Loop
-			}
-		case <-done:
-			break Loop
-		}
-	}
-	mtlsLog.Debugf("Closing implant connection %s", implantConn.ID)
+	<-done
 }
 
 // socketWriteEnvelope - Writes a message to the TLS socket using length prefix framing
@@ -150,19 +298,41 @@ func socketWriteEnvelope(connection net.Conn, envelope *sliverpb.Envelope) error
 		mtlsLog.Errorf("Envelope marshaling error: %v", err)
 		return err
 	}
+
+	// Prepend a fixed-length raw minisign signature (binary) so the implant can
+	// verify messages independent of the mTLS layer.
+	rawSig := minisign.SignRawBuf(*serverCrypto.MinisignServerPrivateKey(), data)
+	if _, err := connection.Write(rawSig[:]); err != nil {
+		return err
+	}
+
 	dataLengthBuf := new(bytes.Buffer)
-	binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data)))
-	connection.Write(dataLengthBuf.Bytes())
-	connection.Write(data)
+	if err := binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data))); err != nil {
+		mtlsLog.Errorf("Envelope marshaling error: %v", err)
+		return err
+	}
+	if _, err := connection.Write(dataLengthBuf.Bytes()); err != nil {
+		return err
+	}
+	if _, err := connection.Write(data); err != nil {
+		return err
+	}
 	return nil
 }
 
 // socketReadEnvelope - Reads a message from the TLS connection using length prefix framing
 // returns messageType, message, and error
 func socketReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
+	rawSigBuf := make([]byte, minisign.RawSigSize)
 	// Read the first four bytes to determine data length
 	dataLengthBuf := make([]byte, 4) // Size of uint32
-	n, err := io.ReadFull(connection, dataLengthBuf)
+	n, err := io.ReadFull(connection, rawSigBuf)
+	if err != nil || n != len(rawSigBuf) {
+		mtlsLog.Errorf("Socket error (read raw signature): %v", err)
+		return nil, err
+	}
+
+	n, err = io.ReadFull(connection, dataLengthBuf)
 	if err != nil || n != 4 {
 		mtlsLog.Errorf("Socket error (read msg-length): %v", err)
 		return nil, err
@@ -184,6 +354,21 @@ func socketReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
 		return nil, err
 	}
 
+	algorithm := binary.LittleEndian.Uint16(rawSigBuf[:2])
+	if algorithm != minisign.EdDSA {
+		return nil, errors.New("[mtls] unsupported signature algorithm")
+	}
+	keyID := binary.LittleEndian.Uint64(rawSigBuf[2:10])
+
+	pubKey, _, err := lookupImplantSigKey(keyID)
+	if err != nil {
+		return nil, err
+	}
+	signature := rawSigBuf[10:]
+	if !ed25519.Verify(pubKey, dataBuf, signature) {
+		return nil, errors.New("[mtls] invalid signature")
+	}
+
 	// Unmarshal the protobuf envelope
 	envelope := &sliverpb.Envelope{}
 	err = proto.Unmarshal(dataBuf, envelope)

server/c2/mtls_signing_test.go

@@ -0,0 +1,366 @@
+package c2
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"strings"
+	"testing"
+
+	implantMTLS "github.com/bishopfox/sliver/implant/sliver/transports/mtls"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	serverCrypto "github.com/bishopfox/sliver/server/cryptography"
+	"github.com/bishopfox/sliver/util/minisign"
+	"golang.org/x/crypto/blake2b"
+	"google.golang.org/protobuf/proto"
+)
+
+func clearMTLSImplantSigKeyCache(t *testing.T) {
+	t.Helper()
+	mtlsImplantSigKeyCache.Range(func(key, _ any) bool {
+		mtlsImplantSigKeyCache.Delete(key)
+		return true
+	})
+}
+
+func newImplantSignedEnvelopeFrame(t *testing.T, peerPrivateKey string, envelope *sliverpb.Envelope) ([]byte, uint64, ed25519.PublicKey) {
+	t.Helper()
+
+	data, err := proto.Marshal(envelope)
+	if err != nil {
+		t.Fatalf("marshal envelope: %v", err)
+	}
+
+	seed := sha256.Sum256([]byte(mtlsEnvelopeSigningSeedPrefix + peerPrivateKey))
+	priv := ed25519.NewKeyFromSeed(seed[:])
+	pub := priv.Public().(ed25519.PublicKey)
+
+	digest := blake2b.Sum256(pub)
+	keyID := binary.LittleEndian.Uint64(digest[:8])
+
+	rawSigBuf := make([]byte, minisign.RawSigSize)
+	binary.LittleEndian.PutUint16(rawSigBuf[:2], minisign.EdDSA)
+	binary.LittleEndian.PutUint64(rawSigBuf[2:10], keyID)
+	copy(rawSigBuf[10:], ed25519.Sign(priv, data))
+
+	frame := make([]byte, 0, minisign.RawSigSize+4+len(data))
+	frame = append(frame, rawSigBuf...)
+
+	dataLengthBuf := make([]byte, 4)
+	binary.LittleEndian.PutUint32(dataLengthBuf, uint32(len(data)))
+	frame = append(frame, dataLengthBuf...)
+	frame = append(frame, data...)
+
+	return frame, keyID, pub
+}
+
+func newServerSignedEnvelopeFrame(t *testing.T, envelope *sliverpb.Envelope) []byte {
+	t.Helper()
+
+	data, err := proto.Marshal(envelope)
+	if err != nil {
+		t.Fatalf("marshal envelope: %v", err)
+	}
+
+	rawSig := minisign.SignRawBuf(*serverCrypto.MinisignServerPrivateKey(), data)
+
+	frame := make([]byte, 0, minisign.RawSigSize+4+len(data))
+	frame = append(frame, rawSig[:]...)
+
+	dataLengthBuf := make([]byte, 4)
+	binary.LittleEndian.PutUint32(dataLengthBuf, uint32(len(data)))
+	frame = append(frame, dataLengthBuf...)
+	frame = append(frame, data...)
+
+	return frame
+}
+
+func TestMTLSSocketReadEnvelopeRejectsUnsupportedAlgorithm(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	// Flip to HashEdDSA (or any non-EdDSA value), should be rejected.
+	binary.LittleEndian.PutUint16(frame[:2], minisign.HashEdDSA)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil || !strings.Contains(err.Error(), "unsupported signature algorithm") {
+		t.Fatalf("expected unsupported signature algorithm error, got=%v", err)
+	}
+}
+
+func TestMTLSSocketReadEnvelopeAcceptsValidSignature(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	want := &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	}
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", want)
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	got, err := socketReadEnvelope(srv)
+	if err != nil {
+		t.Fatalf("expected valid signature, got err=%v", err)
+	}
+	if got.Type != want.Type || !bytes.Equal(got.Data, want.Data) {
+		t.Fatalf("unexpected envelope: got=%+v want=%+v", got, want)
+	}
+}
+
+func TestMTLSSocketReadEnvelopeRejectsInvalidSignature(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	// Corrupt a signature byte.
+	frame[10] ^= 0xff
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSSocketReadEnvelopeRejectsTamperedMessage(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	// Flip a byte in the protobuf payload after signing.
+	dataOffset := minisign.RawSigSize + 4
+	frame[dataOffset] ^= 0x01
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSSocketReadEnvelopeRejectsWrongKeyID(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, _ := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	// Swap the key ID to a different cached public key (signature won't match).
+	wrongPub, _, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("generate ed25519 key: %v", err)
+	}
+	wrongKeyID := keyID + 1
+	mtlsImplantSigKeyCache.Store(wrongKeyID, wrongPub)
+	binary.LittleEndian.PutUint64(frame[2:10], wrongKeyID)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err = <-errCh
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSSocketReadEnvelopeRejectsTruncatedSignature(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, _, _ := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame[:minisign.RawSigSize-1])
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil {
+		t.Fatalf("expected error for truncated signature, got nil")
+	}
+	if !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Fatalf("expected EOF for truncated signature, got=%v", err)
+	}
+}
+
+func TestMTLSImplantReadEnvelopeRejectsInvalidServerSignature(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	// Corrupt a signature byte.
+	frame[10] ^= 0xff
+
+	_, err := implantMTLS.ReadEnvelope(bytes.NewReader(frame))
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSImplantReadEnvelopeAcceptsValidServerSignature(t *testing.T) {
+	want := &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	}
+	frame := newServerSignedEnvelopeFrame(t, want)
+
+	got, err := implantMTLS.ReadEnvelope(bytes.NewReader(frame))
+	if err != nil {
+		t.Fatalf("expected valid signature, got err=%v", err)
+	}
+	if got.Type != want.Type || !bytes.Equal(got.Data, want.Data) {
+		t.Fatalf("unexpected envelope: got=%+v want=%+v", got, want)
+	}
+}
+
+func TestMTLSImplantReadEnvelopeRejectsWrongServerKeyID(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	// Flip key ID bytes.
+	frame[2] ^= 0xff
+
+	_, err := implantMTLS.ReadEnvelope(bytes.NewReader(frame))
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSImplantReadEnvelopeRejectsAlgorithmDowngradeTrick(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	// Change algorithm to HashEdDSA without changing the signature; verification must fail.
+	binary.LittleEndian.PutUint16(frame[:2], minisign.HashEdDSA)
+
+	_, err := implantMTLS.ReadEnvelope(bytes.NewReader(frame))
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSImplantReadEnvelopeRejectsTamperedServerMessage(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	// Flip a byte in the protobuf payload after signing.
+	dataOffset := minisign.RawSigSize + 4
+	frame[dataOffset] ^= 0x01
+
+	_, err := implantMTLS.ReadEnvelope(bytes.NewReader(frame))
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestMTLSImplantReadEnvelopeRejectsTruncatedServerSignature(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	_, err := implantMTLS.ReadEnvelope(bytes.NewReader(frame[:minisign.RawSigSize-1]))
+	if err == nil {
+		t.Fatalf("expected error for truncated signature, got nil")
+	}
+	if !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Fatalf("expected EOF for truncated signature, got=%v", err)
+	}
+}

server/c2/mtls_testhooks_sliver_e2e_test.go

@@ -0,0 +1,12 @@
+//go:build server && go_sqlite && sliver_e2e
+
+package c2
+
+import "net"
+
+// HandleSliverConnectionForTest exposes the raw connection handler to external
+// (package `c2_test`) end-to-end tests without shipping test-only symbols in
+// production builds.
+func HandleSliverConnectionForTest(conn net.Conn) {
+	handleSliverConnection(conn)
+}

server/c2/mtls_yamux_beacon_e2e_test.go

@@ -0,0 +1,537 @@
+//go:build server && go_sqlite && sliver_e2e
+
+package c2_test
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	implantHandlers "github.com/bishopfox/sliver/implant/sliver/handlers"
+	implantMTLS "github.com/bishopfox/sliver/implant/sliver/transports/mtls"
+	"github.com/bishopfox/sliver/protobuf/clientpb"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/c2"
+	"github.com/bishopfox/sliver/server/db/models"
+	"github.com/bishopfox/sliver/server/transport"
+	"github.com/google/uuid"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestMTLSYamux_Beacon_EndToEndAsyncPingRPC(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleSliverConnectionForTest(serverConn)
+
+	beaconID := uuid.NewString()
+	beacon := startTestBeacon(t, implantConn, beaconID)
+	t.Cleanup(beacon.Stop)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	waitForBeaconRegistration(t, rpcClient, beaconID, 10*time.Second)
+
+	const tasksCount = 8
+	type taskInfo struct {
+		id    string
+		nonce int32
+	}
+	taskInfos := make([]taskInfo, 0, tasksCount)
+
+	for i := 0; i < tasksCount; i++ {
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+
+		nonce := int32(1000 + i)
+		resp, err := rpcClient.Ping(callCtx, &sliverpb.Ping{
+			Nonce: nonce,
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  int64(5 * time.Second),
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc ping (async): %v", err)
+		}
+		if resp.GetResponse() == nil || resp.GetResponse().TaskID == "" {
+			t.Fatalf("expected ping task id in async response, got=%v", resp.GetResponse())
+		}
+		taskInfos = append(taskInfos, taskInfo{id: resp.GetResponse().TaskID, nonce: nonce})
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pendingTasks, err := beacon.FetchPendingTasks(ctx)
+	if err != nil {
+		t.Fatalf("fetch pending beacon tasks: %v", err)
+	}
+	if len(pendingTasks) < tasksCount {
+		t.Fatalf("unexpected pending tasks count: got=%d want>=%d", len(pendingTasks), tasksCount)
+	}
+
+	results := executeBeaconTasks(t, pendingTasks)
+	if err := beacon.SendResults(results); err != nil {
+		t.Fatalf("send beacon results: %v", err)
+	}
+
+	for _, info := range taskInfos {
+		waitForBeaconTaskCompleted(t, rpcClient, info.id, info.nonce, 10*time.Second)
+	}
+}
+
+func TestMTLSYamux_Beacon_EndToEndAsyncMixedRPCs(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleSliverConnectionForTest(serverConn)
+
+	beaconID := uuid.NewString()
+	beacon := startTestBeacon(t, implantConn, beaconID)
+	t.Cleanup(beacon.Stop)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	waitForBeaconRegistration(t, rpcClient, beaconID, 10*time.Second)
+
+	testDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(testDir, "alpha.txt"), []byte("alpha"), 0600); err != nil {
+		t.Fatalf("write alpha.txt: %v", err)
+	}
+	if err := os.Mkdir(filepath.Join(testDir, "subdir"), 0700); err != nil {
+		t.Fatalf("mkdir subdir: %v", err)
+	}
+
+	reqTimeout := int64(5 * time.Second)
+
+	type taskCheck struct {
+		id    string
+		check func(*testing.T, []byte)
+	}
+	checks := make([]taskCheck, 0, 8)
+
+	addTask := func(callCtx context.Context, taskID string, check func(*testing.T, []byte)) {
+		if taskID == "" {
+			t.Fatalf("expected task id in async response")
+		}
+		checks = append(checks, taskCheck{id: taskID, check: check})
+	}
+
+	for i := 0; i < 4; i++ {
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		nonce := int32(2000 + i)
+		resp, err := rpcClient.Ping(callCtx, &sliverpb.Ping{
+			Nonce: nonce,
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc ping (async): %v", err)
+		}
+
+		taskID := resp.GetResponse().GetTaskID()
+		wantNonce := nonce
+		addTask(callCtx, taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			ping := &sliverpb.Ping{}
+			if err := proto.Unmarshal(data, ping); err != nil {
+				t.Fatalf("unmarshal ping response: %v", err)
+			}
+			if ping.Nonce != wantNonce {
+				t.Fatalf("unexpected ping nonce: got=%d want=%d", ping.Nonce, wantNonce)
+			}
+		})
+	}
+
+	{
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		resp, err := rpcClient.Pwd(callCtx, &sliverpb.PwdReq{
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc pwd (async): %v", err)
+		}
+		taskID := resp.GetResponse().GetTaskID()
+		addTask(callCtx, taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			pwd := &sliverpb.Pwd{}
+			if err := proto.Unmarshal(data, pwd); err != nil {
+				t.Fatalf("unmarshal pwd response: %v", err)
+			}
+			if pwd.Path == "" {
+				t.Fatalf("unexpected empty pwd path")
+			}
+		})
+	}
+
+	{
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		resp, err := rpcClient.GetEnv(callCtx, &sliverpb.EnvReq{
+			Name: "PATH",
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc getenv (async): %v", err)
+		}
+		taskID := resp.GetResponse().GetTaskID()
+		addTask(callCtx, taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			env := &sliverpb.EnvInfo{}
+			if err := proto.Unmarshal(data, env); err != nil {
+				t.Fatalf("unmarshal env response: %v", err)
+			}
+			if len(env.Variables) != 1 || env.Variables[0].Key != "PATH" {
+				t.Fatalf("unexpected env response: %+v", env.Variables)
+			}
+		})
+	}
+
+	{
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		resp, err := rpcClient.Ls(callCtx, &sliverpb.LsReq{
+			Path: testDir,
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc ls (async): %v", err)
+		}
+		taskID := resp.GetResponse().GetTaskID()
+		addTask(callCtx, taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			ls := &sliverpb.Ls{}
+			if err := proto.Unmarshal(data, ls); err != nil {
+				t.Fatalf("unmarshal ls response: %v", err)
+			}
+			if !ls.Exists {
+				t.Fatalf("unexpected ls response (Exists=false): %v", ls.GetResponse())
+			}
+			found := false
+			for _, file := range ls.Files {
+				if file.Name == "alpha.txt" {
+					found = true
+					break
+				}
+			}
+			if !found {
+				t.Fatalf("ls missing expected alpha.txt entry")
+			}
+		})
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pendingTasks, err := beacon.FetchPendingTasks(ctx)
+	if err != nil {
+		t.Fatalf("fetch pending beacon tasks: %v", err)
+	}
+	if len(pendingTasks) < len(checks) {
+		t.Fatalf("unexpected pending tasks count: got=%d want>=%d", len(pendingTasks), len(checks))
+	}
+
+	results := executeBeaconTasks(t, pendingTasks)
+	if err := beacon.SendResults(results); err != nil {
+		t.Fatalf("send beacon results: %v", err)
+	}
+
+	for _, tc := range checks {
+		data := waitForBeaconTaskResponseBytes(t, rpcClient, tc.id, 10*time.Second)
+		tc.check(t, data)
+	}
+}
+
+type testBeacon struct {
+	id       string
+	conn     net.Conn
+	session  *yamux.Session
+	incoming chan *sliverpb.Envelope
+	done     chan struct{}
+}
+
+func startTestBeacon(t *testing.T, conn net.Conn, beaconID string) *testBeacon {
+	t.Helper()
+
+	if _, err := conn.Write([]byte(implantMTLS.YamuxPreface)); err != nil {
+		t.Fatalf("write yamux preface: %v", err)
+	}
+
+	muxSession, err := yamux.Client(conn, nil)
+	if err != nil {
+		t.Fatalf("start yamux client session: %v", err)
+	}
+
+	beacon := &testBeacon{
+		id:       beaconID,
+		conn:     conn,
+		session:  muxSession,
+		incoming: make(chan *sliverpb.Envelope, 64),
+		done:     make(chan struct{}),
+	}
+	go beacon.recvLoop()
+
+	register := &sliverpb.Register{
+		Name:              "e2e-beacon",
+		Hostname:          "localhost",
+		Uuid:              uuid.NewString(),
+		Username:          "unit-test",
+		Os:                runtime.GOOS,
+		Arch:              runtime.GOARCH,
+		Pid:               int32(os.Getpid()),
+		Filename:          "sliver-e2e",
+		ActiveC2:          "mtls://e2e",
+		Version:           "e2e",
+		ReconnectInterval: 0,
+		ProxyURL:          "",
+		Locale:            "en_US",
+	}
+	regData, err := proto.Marshal(&sliverpb.BeaconRegister{
+		ID:          beaconID,
+		Interval:    int64(1),
+		Jitter:      int64(0),
+		Register:    register,
+		NextCheckin: int64(1),
+	})
+	if err != nil {
+		t.Fatalf("marshal beacon register: %v", err)
+	}
+	if err := sendYamuxEnvelope(muxSession, &sliverpb.Envelope{Type: sliverpb.MsgBeaconRegister, Data: regData}); err != nil {
+		t.Fatalf("send beacon register: %v", err)
+	}
+
+	return beacon
+}
+
+func (b *testBeacon) Stop() {
+	select {
+	case <-b.done:
+	default:
+		close(b.done)
+	}
+	_ = b.session.Close()
+	_ = b.conn.Close()
+}
+
+func (b *testBeacon) recvLoop() {
+	defer close(b.incoming)
+	for {
+		stream, err := b.session.Accept()
+		if err != nil {
+			return
+		}
+
+		go func(stream net.Conn) {
+			defer stream.Close()
+			envelope, err := implantMTLS.ReadEnvelope(stream)
+			if err != nil || envelope == nil {
+				return
+			}
+			select {
+			case b.incoming <- envelope:
+			case <-b.done:
+			}
+		}(stream)
+	}
+}
+
+func (b *testBeacon) FetchPendingTasks(ctx context.Context) ([]*sliverpb.Envelope, error) {
+	reqData, err := proto.Marshal(&sliverpb.BeaconTasks{
+		ID:          b.id,
+		NextCheckin: int64(1),
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := sendYamuxEnvelope(b.session, &sliverpb.Envelope{Type: sliverpb.MsgBeaconTasks, Data: reqData}); err != nil {
+		return nil, err
+	}
+
+	for {
+		select {
+		case envelope, ok := <-b.incoming:
+			if !ok {
+				return nil, fmt.Errorf("beacon connection closed")
+			}
+			if envelope.Type != sliverpb.MsgBeaconTasks {
+				continue
+			}
+			resp := &sliverpb.BeaconTasks{}
+			if err := proto.Unmarshal(envelope.Data, resp); err != nil {
+				return nil, err
+			}
+			return resp.Tasks, nil
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
+
+func (b *testBeacon) SendResults(results []*sliverpb.Envelope) error {
+	reqData, err := proto.Marshal(&sliverpb.BeaconTasks{
+		ID:          b.id,
+		NextCheckin: int64(1),
+		Tasks:       results,
+	})
+	if err != nil {
+		return err
+	}
+	return sendYamuxEnvelope(b.session, &sliverpb.Envelope{Type: sliverpb.MsgBeaconTasks, Data: reqData})
+}
+
+func executeBeaconTasks(t *testing.T, tasks []*sliverpb.Envelope) []*sliverpb.Envelope {
+	t.Helper()
+
+	sysHandlers := implantHandlers.GetSystemHandlers()
+	results := make([]*sliverpb.Envelope, 0, len(tasks))
+
+	for _, task := range tasks {
+		if task == nil || task.ID == 0 {
+			continue
+		}
+
+		handler, ok := sysHandlers[task.Type]
+		if !ok {
+			results = append(results, &sliverpb.Envelope{ID: task.ID, UnknownMessageType: true})
+			continue
+		}
+
+		done := make(chan struct{})
+		var (
+			respData []byte
+			respErr  error
+		)
+		var doneOnce sync.Once
+		handler(task.Data, func(data []byte, err error) {
+			respData = data
+			respErr = err
+			doneOnce.Do(func() {
+				close(done)
+			})
+		})
+
+		select {
+		case <-done:
+			_ = respErr
+			results = append(results, &sliverpb.Envelope{ID: task.ID, Data: respData})
+		case <-time.After(2 * time.Second):
+			t.Fatalf("timeout waiting for handler response (task=%d type=%d)", task.ID, task.Type)
+		}
+	}
+	return results
+}
+
+func waitForBeaconRegistration(t *testing.T, rpcClient rpcpb.SliverRPCClient, beaconID string, timeout time.Duration) {
+	t.Helper()
+
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+		_, err := rpcClient.GetBeacon(ctx, &clientpb.Beacon{ID: beaconID})
+		cancel()
+		if err == nil {
+			return
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for beacon registration")
+}
+
+func waitForBeaconTaskResponseBytes(t *testing.T, rpcClient rpcpb.SliverRPCClient, taskID string, timeout time.Duration) []byte {
+	t.Helper()
+
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+		task, err := rpcClient.GetBeaconTaskContent(ctx, &clientpb.BeaconTask{ID: taskID})
+		cancel()
+		if err != nil {
+			time.Sleep(25 * time.Millisecond)
+			continue
+		}
+		if task.State != models.COMPLETED || len(task.Response) == 0 {
+			time.Sleep(25 * time.Millisecond)
+			continue
+		}
+		return task.Response
+	}
+	t.Fatalf("timed out waiting for beacon task completion (task=%s)", taskID)
+	return nil
+}
+
+func waitForBeaconTaskCompleted(t *testing.T, rpcClient rpcpb.SliverRPCClient, taskID string, wantNonce int32, timeout time.Duration) {
+	t.Helper()
+
+	data := waitForBeaconTaskResponseBytes(t, rpcClient, taskID, timeout)
+	ping := &sliverpb.Ping{}
+	if err := proto.Unmarshal(data, ping); err != nil {
+		t.Fatalf("unmarshal ping response: %v", err)
+	}
+	if ping.Nonce != wantNonce {
+		t.Fatalf("unexpected ping nonce: got=%d want=%d", ping.Nonce, wantNonce)
+	}
+}

server/c2/mtls_yamux_grpc_e2e_test.go

@@ -0,0 +1,441 @@
+//go:build server && go_sqlite && sliver_e2e
+
+package c2_test
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	implantHandlers "github.com/bishopfox/sliver/implant/sliver/handlers"
+	implantMTLS "github.com/bishopfox/sliver/implant/sliver/transports/mtls"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/c2"
+	"github.com/bishopfox/sliver/server/core"
+	"github.com/bishopfox/sliver/server/transport"
+	"github.com/google/uuid"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/test/bufconn"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestMTLSYamux_EndToEndPingRPC(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	t.Cleanup(func() {
+		for _, session := range core.Sessions.All() {
+			core.Sessions.Remove(session.ID)
+		}
+	})
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleSliverConnectionForTest(serverConn)
+
+	stopImplant := startTestImplant(t, implantConn)
+	t.Cleanup(stopImplant)
+
+	sessionID := waitForSessionID(t, 10*time.Second)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pingReq := &sliverpb.Ping{
+		Nonce: 31337,
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   int64(5 * time.Second),
+		},
+	}
+	pingResp, err := rpcClient.Ping(ctx, pingReq)
+	if err != nil {
+		t.Fatalf("rpc ping: %v", err)
+	}
+	if pingResp.Nonce != pingReq.Nonce {
+		t.Fatalf("unexpected ping nonce: got=%d want=%d", pingResp.Nonce, pingReq.Nonce)
+	}
+
+	const concurrentPings = 32
+	var wg sync.WaitGroup
+	errCh := make(chan error, concurrentPings)
+
+	for i := 0; i < concurrentPings; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			callCtx, callCancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer callCancel()
+
+			req := &sliverpb.Ping{
+				Nonce: int32(i),
+				Request: &commonpb.Request{
+					SessionID: sessionID,
+					Timeout:   int64(5 * time.Second),
+				},
+			}
+			resp, err := rpcClient.Ping(callCtx, req)
+			if err != nil {
+				errCh <- err
+				return
+			}
+			if resp.Nonce != req.Nonce {
+				errCh <- fmt.Errorf("ping nonce mismatch: got=%d want=%d", resp.Nonce, req.Nonce)
+				return
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(errCh)
+	for err := range errCh {
+		t.Error(err)
+	}
+}
+
+func TestMTLSYamux_EndToEndMixedRPCs(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	t.Cleanup(func() {
+		for _, session := range core.Sessions.All() {
+			core.Sessions.Remove(session.ID)
+		}
+	})
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleSliverConnectionForTest(serverConn)
+
+	stopImplant := startTestImplant(t, implantConn)
+	t.Cleanup(stopImplant)
+
+	sessionID := waitForSessionID(t, 10*time.Second)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	testDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(testDir, "alpha.txt"), []byte("alpha"), 0600); err != nil {
+		t.Fatalf("write alpha.txt: %v", err)
+	}
+	if err := os.Mkdir(filepath.Join(testDir, "subdir"), 0700); err != nil {
+		t.Fatalf("mkdir subdir: %v", err)
+	}
+
+	reqTimeout := int64(5 * time.Second)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	pwdResp, err := rpcClient.Pwd(ctx, &sliverpb.PwdReq{
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   reqTimeout,
+		},
+	})
+	if err != nil {
+		t.Fatalf("rpc pwd: %v", err)
+	}
+	if pwdResp.Path == "" {
+		t.Fatalf("unexpected empty pwd path")
+	}
+
+	envResp, err := rpcClient.GetEnv(ctx, &sliverpb.EnvReq{
+		Name: "PATH",
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   reqTimeout,
+		},
+	})
+	if err != nil {
+		t.Fatalf("rpc getenv: %v", err)
+	}
+	if len(envResp.Variables) != 1 || envResp.Variables[0].Key != "PATH" {
+		t.Fatalf("unexpected getenv response: %+v", envResp.Variables)
+	}
+
+	lsResp, err := rpcClient.Ls(ctx, &sliverpb.LsReq{
+		Path: testDir,
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   reqTimeout,
+		},
+	})
+	if err != nil {
+		t.Fatalf("rpc ls: %v", err)
+	}
+	if !lsResp.Exists {
+		t.Fatalf("unexpected ls response (Exists=false): %v", lsResp.GetResponse())
+	}
+	lsNames := map[string]bool{}
+	for _, file := range lsResp.Files {
+		lsNames[file.Name] = true
+	}
+	for _, want := range []string{"alpha.txt", "subdir"} {
+		if !lsNames[want] {
+			t.Fatalf("ls missing expected entry %q (got %d entries)", want, len(lsResp.Files))
+		}
+	}
+
+	const concurrentCalls = 64
+	var wg sync.WaitGroup
+	errCh := make(chan error, concurrentCalls)
+
+	for i := 0; i < concurrentCalls; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+
+			callCtx, callCancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer callCancel()
+
+			switch i % 4 {
+			case 0:
+				req := &sliverpb.Ping{
+					Nonce: int32(i),
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				}
+				resp, err := rpcClient.Ping(callCtx, req)
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if resp.Nonce != req.Nonce {
+					errCh <- fmt.Errorf("ping nonce mismatch: got=%d want=%d", resp.Nonce, req.Nonce)
+					return
+				}
+
+			case 1:
+				resp, err := rpcClient.Pwd(callCtx, &sliverpb.PwdReq{
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				})
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if resp.Path == "" {
+					errCh <- fmt.Errorf("pwd returned empty path")
+					return
+				}
+
+			case 2:
+				resp, err := rpcClient.GetEnv(callCtx, &sliverpb.EnvReq{
+					Name: "PATH",
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				})
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if len(resp.Variables) != 1 || resp.Variables[0].Key != "PATH" {
+					errCh <- fmt.Errorf("unexpected getenv response: %+v", resp.Variables)
+					return
+				}
+
+			default:
+				resp, err := rpcClient.Ls(callCtx, &sliverpb.LsReq{
+					Path: testDir,
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				})
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if !resp.Exists {
+					errCh <- fmt.Errorf("unexpected ls response (Exists=false): %v", resp.GetResponse())
+					return
+				}
+				found := false
+				for _, file := range resp.Files {
+					if file.Name == "alpha.txt" {
+						found = true
+						break
+					}
+				}
+				if !found {
+					errCh <- fmt.Errorf("ls missing expected alpha.txt entry")
+					return
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(errCh)
+	for err := range errCh {
+		t.Error(err)
+	}
+}
+
+func dialBufConn(ctx context.Context, ln *bufconn.Listener) (*grpc.ClientConn, error) {
+	dialer := func(context.Context, string) (net.Conn, error) { return ln.Dial() }
+	return grpc.DialContext(ctx, "bufnet",
+		grpc.WithContextDialer(dialer),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	)
+}
+
+func waitForSessionID(t *testing.T, timeout time.Duration) string {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		sessions := core.Sessions.All()
+		if 0 < len(sessions) {
+			return sessions[0].ID
+		}
+		time.Sleep(25 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for session registration")
+	return ""
+}
+
+func startTestImplant(t *testing.T, conn net.Conn) func() {
+	t.Helper()
+
+	if _, err := conn.Write([]byte(implantMTLS.YamuxPreface)); err != nil {
+		t.Fatalf("write yamux preface: %v", err)
+	}
+
+	muxSession, err := yamux.Client(conn, nil)
+	if err != nil {
+		t.Fatalf("start yamux client session: %v", err)
+	}
+
+	register := &sliverpb.Register{
+		Name:              "e2e",
+		Hostname:          "localhost",
+		Uuid:              uuid.NewString(),
+		Username:          "unit-test",
+		Os:                runtime.GOOS,
+		Arch:              runtime.GOARCH,
+		Pid:               int32(os.Getpid()),
+		Filename:          "sliver-e2e",
+		ActiveC2:          "mtls://e2e",
+		Version:           "e2e",
+		ReconnectInterval: 0,
+		ProxyURL:          "",
+		Locale:            "en_US",
+	}
+	regData, err := proto.Marshal(register)
+	if err != nil {
+		t.Fatalf("marshal register: %v", err)
+	}
+	if err := sendYamuxEnvelope(muxSession, &sliverpb.Envelope{Type: sliverpb.MsgRegister, Data: regData}); err != nil {
+		t.Fatalf("send register: %v", err)
+	}
+
+	handlers := implantHandlers.GetSystemHandlers()
+	loopDone := make(chan struct{})
+	go func() {
+		defer close(loopDone)
+
+		streamSem := make(chan struct{}, 128)
+		for {
+			stream, err := muxSession.Accept()
+			if err != nil {
+				return
+			}
+			select {
+			case streamSem <- struct{}{}:
+			default:
+				_ = stream.Close()
+				continue
+			}
+
+			go func(stream net.Conn) {
+				defer func() { <-streamSem }()
+				defer stream.Close()
+
+				envelope, err := implantMTLS.ReadEnvelope(stream)
+				if err != nil || envelope == nil || envelope.ID == 0 {
+					return
+				}
+
+				handler, ok := handlers[envelope.Type]
+				if !ok {
+					_ = sendYamuxEnvelope(muxSession, &sliverpb.Envelope{ID: envelope.ID, UnknownMessageType: true})
+					return
+				}
+				handler(envelope.Data, func(data []byte, err error) {
+					_ = err
+					_ = sendYamuxEnvelope(muxSession, &sliverpb.Envelope{ID: envelope.ID, Data: data})
+				})
+			}(stream)
+		}
+	}()
+
+	return func() {
+		_ = muxSession.Close()
+		_ = conn.Close()
+		select {
+		case <-loopDone:
+		case <-time.After(5 * time.Second):
+		}
+	}
+}
+
+func sendYamuxEnvelope(session *yamux.Session, envelope *sliverpb.Envelope) error {
+	stream, err := session.Open()
+	if err != nil {
+		return err
+	}
+	defer stream.Close()
+	return implantMTLS.WriteEnvelope(stream, envelope)
+}

server/c2/wireguard.go

@@ -21,20 +21,25 @@ package c2
 import (
 	"bufio"
 	"bytes"
+	"crypto/ed25519"
 	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
 	"net"
 	"net/netip"
+	"sync"
 
 	"github.com/bishopfox/sliver/protobuf/sliverpb"
 	"github.com/bishopfox/sliver/server/certs"
 	"github.com/bishopfox/sliver/server/core"
+	serverCrypto "github.com/bishopfox/sliver/server/cryptography"
 	"github.com/bishopfox/sliver/server/generate"
 	serverHandlers "github.com/bishopfox/sliver/server/handlers"
 	"github.com/bishopfox/sliver/server/log"
 	"github.com/bishopfox/sliver/server/netstack"
+	"github.com/bishopfox/sliver/util/minisign"
+	"github.com/hashicorp/yamux"
 	"golang.zx2c4.com/wireguard/conn"
 	"golang.zx2c4.com/wireguard/device"
 	"google.golang.org/protobuf/proto"
@@ -45,6 +50,14 @@ var (
 	tunIP = "100.64.0.1" // Don't let user configure this for now
 )
 
+const (
+	wgYamuxPreface = mtlsYamuxPreface
+)
+
+var (
+	wgYamuxPrefaceBytes = []byte(wgYamuxPreface)
+)
+
 // StartWGListener - First creates an inet.af network stack.
 // then creates a Wireguard device/interface and applies configuration.
 // Go routines are spun up to handle key exchange connections, as well
@@ -205,56 +218,150 @@ func handleWGSliverConnection(conn net.Conn) {
 	wgLog.Infof("Accepted incoming connection: %s", conn.RemoteAddr())
 
 	implantConn := core.NewImplantConnection("wg", conn.RemoteAddr().String())
-	implantConn.UpdateLastMessage()
 	defer func() {
+		wgLog.Debugf("wireguard connection closing")
 		implantConn.Cleanup()
 		conn.Close()
 	}()
 
-	done := make(chan bool)
+	br := bufio.NewReader(conn)
+	bufferedConn := &wgBufferedConn{Conn: conn, r: br}
+
+	preface, err := br.Peek(len(wgYamuxPrefaceBytes))
+	if err == nil && bytes.Equal(preface, wgYamuxPrefaceBytes) {
+		if _, err := br.Discard(len(wgYamuxPrefaceBytes)); err != nil {
+			wgLog.Errorf("Failed to discard yamux preface: %v", err)
+			return
+		}
+		handleWGSliverConnectionYamux(bufferedConn, implantConn)
+		return
+	}
+
+	wgLog.Warnf("Rejecting legacy wireguard connection (missing yamux preface) from %s", conn.RemoteAddr())
+}
+
+type wgBufferedConn struct {
+	net.Conn
+	r *bufio.Reader
+}
+
+func (c *wgBufferedConn) Read(p []byte) (int, error) {
+	return c.r.Read(p)
+}
+
+func handleWGSliverConnectionYamux(conn net.Conn, implantConn *core.ImplantConnection) {
+	session, err := yamux.Server(conn, nil)
+	if err != nil {
+		wgLog.Errorf("Failed to initialize yamux session: %v", err)
+		return
+	}
+	defer session.Close()
+
+	done := make(chan struct{})
+	var doneOnce sync.Once
+	closeDone := func() {
+		doneOnce.Do(func() {
+			close(done)
+			session.Close()
+		})
+	}
+
+	streamSem := make(chan struct{}, mtlsYamuxMaxConcurrentStreams)
+	sendSem := make(chan struct{}, mtlsYamuxMaxConcurrentSends)
+	handlers := serverHandlers.GetHandlers()
+
 	go func() {
-		defer func() {
-			done <- true
-		}()
-		handlers := serverHandlers.GetHandlers()
+		defer closeDone()
 		for {
-			envelope, err := socketWGReadEnvelope(conn)
+			stream, err := session.Accept()
 			if err != nil {
-				wgLog.Errorf("Socket read error %s", err)
+				if !errors.Is(err, io.EOF) {
+					wgLog.Errorf("yamux accept error: %v", err)
+				}
 				return
 			}
-			implantConn.UpdateLastMessage()
-			if envelope.ID != 0 {
-				implantConn.RespMutex.RLock()
-				if resp, ok := implantConn.Resp[envelope.ID]; ok {
-					resp <- envelope // Could deadlock, maybe want to investigate better solutions
-				}
-				implantConn.RespMutex.RUnlock()
-			} else if handler, ok := handlers[envelope.Type]; ok {
-				go func() {
-					respEnvelope := handler(implantConn, envelope.Data)
-					if respEnvelope != nil {
-						implantConn.Send <- respEnvelope
-					}
+
+			select {
+			case streamSem <- struct{}{}:
+			case <-done:
+				stream.Close()
+				return
+			}
+
+			go func(stream net.Conn) {
+				defer func() {
+					<-streamSem
 				}()
+				defer stream.Close()
+
+				envelope, err := socketWGReadEnvelope(stream)
+				if err != nil {
+					wgLog.Errorf("Stream read error %v", err)
+					closeDone()
+					return
+				}
+				implantConn.UpdateLastMessage()
+
+				if envelope.ID != 0 {
+					implantConn.RespMutex.RLock()
+					resp, ok := implantConn.Resp[envelope.ID]
+					implantConn.RespMutex.RUnlock()
+					if ok {
+						resp <- envelope
+					}
+					return
+				}
+
+				if handler, ok := handlers[envelope.Type]; ok {
+					go func(envelope *sliverpb.Envelope) {
+						respEnvelope := handler(implantConn, envelope.Data)
+						if respEnvelope != nil {
+							implantConn.Send <- respEnvelope
+						}
+					}(envelope)
+				}
+			}(stream)
+		}
+	}()
+
+	go func() {
+		defer closeDone()
+		for {
+			select {
+			case envelope := <-implantConn.Send:
+				select {
+				case sendSem <- struct{}{}:
+				case <-done:
+					return
+				}
+
+				go func(envelope *sliverpb.Envelope) {
+					defer func() {
+						<-sendSem
+					}()
+
+					stream, err := session.Open()
+					if err != nil {
+						wgLog.Errorf("yamux open stream error: %v", err)
+						closeDone()
+						return
+					}
+					defer stream.Close()
+
+					if err := socketWGWriteEnvelope(stream, envelope); err != nil {
+						wgLog.Errorf("Stream write failed %v", err)
+						closeDone()
+						return
+					}
+				}(envelope)
+
+			case <-done:
+				return
 			}
 		}
 	}()
 
-Loop:
-	for {
-		select {
-		case envelope := <-implantConn.Send:
-			err := socketWGWriteEnvelope(conn, envelope)
-			if err != nil {
-				wgLog.Errorf("Socket write failed %s", err)
-				break Loop
-			}
-		case <-done:
-			break Loop
-		}
-	}
-	wgLog.Debugf("Closing connection to implant %s", implantConn.ID)
+	<-done
 }
 
 // socketWGWriteEnvelope - Writes a message to the wireguard socket using length prefix framing
@@ -266,21 +373,43 @@ func socketWGWriteEnvelope(connection net.Conn, envelope *sliverpb.Envelope) err
 		wgLog.Errorf("Envelope marshaling error: %v", err)
 		return err
 	}
+
+	// Prepend a fixed-length raw minisign signature (binary) so the implant can
+	// verify messages independent of the WireGuard layer.
+	rawSig := minisign.SignRawBuf(*serverCrypto.MinisignServerPrivateKey(), data)
+	if _, err := connection.Write(rawSig[:]); err != nil {
+		return err
+	}
+
 	dataLengthBuf := new(bytes.Buffer)
-	binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data)))
-	connection.Write(dataLengthBuf.Bytes())
-	connection.Write(data)
+	if err := binary.Write(dataLengthBuf, binary.LittleEndian, uint32(len(data))); err != nil {
+		wgLog.Errorf("Envelope marshaling error: %v", err)
+		return err
+	}
+	if _, err := connection.Write(dataLengthBuf.Bytes()); err != nil {
+		return err
+	}
+	if _, err := connection.Write(data); err != nil {
+		return err
+	}
 	return nil
 }
 
 // socketWGReadEnvelope - Reads a message from the wireguard connection using length prefix framing
 // returns messageType, message, and error
 func socketWGReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
+	rawSigBuf := make([]byte, minisign.RawSigSize)
 
 	// Read the first four bytes to determine data length
 	dataLengthBuf := make([]byte, 4) // Size of uint32
 
-	n, err := io.ReadFull(connection, dataLengthBuf)
+	n, err := io.ReadFull(connection, rawSigBuf)
+	if err != nil || n != len(rawSigBuf) {
+		wgLog.Errorf("Socket error (read raw signature): %v", err)
+		return nil, err
+	}
+
+	n, err = io.ReadFull(connection, dataLengthBuf)
 
 	if err != nil || n != 4 {
 		wgLog.Errorf("Socket error (read msg-length): %v", err)
@@ -288,7 +417,7 @@ func socketWGReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
 	}
 	dataLength := int(binary.LittleEndian.Uint32(dataLengthBuf))
 
-	if dataLength <= 0 {
+	if dataLength <= 0 || ServerMaxMessageSize < dataLength {
 		// {{if .Config.Debug}}
 		wgLog.Errorf("[wireguard] read error: %s\n", err)
 		// {{end}}
@@ -303,6 +432,22 @@ func socketWGReadEnvelope(connection net.Conn) (*sliverpb.Envelope, error) {
 		wgLog.Errorf("Socket error (read data): %v", err)
 		return nil, err
 	}
+
+	algorithm := binary.LittleEndian.Uint16(rawSigBuf[:2])
+	if algorithm != minisign.EdDSA {
+		return nil, errors.New("[wireguard] unsupported signature algorithm")
+	}
+	keyID := binary.LittleEndian.Uint64(rawSigBuf[2:10])
+
+	pubKey, _, err := lookupImplantSigKey(keyID)
+	if err != nil {
+		return nil, err
+	}
+	signature := rawSigBuf[10:]
+	if !ed25519.Verify(pubKey, dataBuf, signature) {
+		return nil, errors.New("[wireguard] invalid signature")
+	}
+
 	// Unmarshal the protobuf envelope
 	envelope := &sliverpb.Envelope{}
 	err = proto.Unmarshal(dataBuf, envelope)

server/c2/wireguard_signing_test.go

@@ -0,0 +1,306 @@
+package c2
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"io"
+	"net"
+	"strings"
+	"testing"
+
+	implantWG "github.com/bishopfox/sliver/implant/sliver/transports/wireguard"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/util/minisign"
+)
+
+func TestWGSocketReadEnvelopeAcceptsValidSignature(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	want := &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	}
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", want)
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	got, err := socketWGReadEnvelope(srv)
+	if err != nil {
+		t.Fatalf("expected valid signature, got err=%v", err)
+	}
+	if got.Type != want.Type || !bytes.Equal(got.Data, want.Data) {
+		t.Fatalf("unexpected envelope: got=%+v want=%+v", got, want)
+	}
+}
+
+func TestWGSocketReadEnvelopeRejectsUnsupportedAlgorithm(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	binary.LittleEndian.PutUint16(frame[:2], minisign.HashEdDSA)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketWGReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil || !strings.Contains(err.Error(), "unsupported signature algorithm") {
+		t.Fatalf("expected unsupported signature algorithm error, got=%v", err)
+	}
+}
+
+func TestWGSocketReadEnvelopeRejectsInvalidSignature(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	frame[10] ^= 0xff
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketWGReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestWGSocketReadEnvelopeRejectsTamperedMessage(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, keyID, pub := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	mtlsImplantSigKeyCache.Store(keyID, pub)
+
+	dataOffset := minisign.RawSigSize + 4
+	frame[dataOffset] ^= 0x01
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketWGReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestWGSocketReadEnvelopeRejectsTruncatedSignature(t *testing.T) {
+	clearMTLSImplantSigKeyCache(t)
+
+	frame, _, _ := newImplantSignedEnvelopeFrame(t, "peer-private-key-test", &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := socketWGReadEnvelope(srv)
+		errCh <- err
+	}()
+	go func() {
+		_, _ = cli.Write(frame[:minisign.RawSigSize-1])
+		_ = cli.Close()
+	}()
+
+	err := <-errCh
+	if err == nil {
+		t.Fatalf("expected error for truncated signature, got nil")
+	}
+	if !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Fatalf("expected EOF for truncated signature, got=%v", err)
+	}
+}
+
+func TestWireGuardImplantReadEnvelopeAcceptsValidServerSignature(t *testing.T) {
+	want := &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	}
+	frame := newServerSignedEnvelopeFrame(t, want)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	got, err := implantWG.ReadEnvelope(srv)
+	if err != nil {
+		t.Fatalf("expected valid signature, got err=%v", err)
+	}
+	if got.Type != want.Type || !bytes.Equal(got.Data, want.Data) {
+		t.Fatalf("unexpected envelope: got=%+v want=%+v", got, want)
+	}
+}
+
+func TestWireGuardImplantReadEnvelopeRejectsInvalidServerSignature(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	frame[10] ^= 0xff
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	_, err := implantWG.ReadEnvelope(srv)
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestWireGuardImplantReadEnvelopeRejectsWrongServerKeyID(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	frame[2] ^= 0xff
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	_, err := implantWG.ReadEnvelope(srv)
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestWireGuardImplantReadEnvelopeRejectsAlgorithmDowngradeTrick(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	binary.LittleEndian.PutUint16(frame[:2], minisign.HashEdDSA)
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	_, err := implantWG.ReadEnvelope(srv)
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestWireGuardImplantReadEnvelopeRejectsTamperedServerMessage(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+	dataOffset := minisign.RawSigSize + 4
+	frame[dataOffset] ^= 0x01
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame)
+		_ = cli.Close()
+	}()
+
+	_, err := implantWG.ReadEnvelope(srv)
+	if err == nil || !strings.Contains(err.Error(), "invalid signature") {
+		t.Fatalf("expected invalid signature error, got=%v", err)
+	}
+}
+
+func TestWireGuardImplantReadEnvelopeRejectsTruncatedServerSignature(t *testing.T) {
+	frame := newServerSignedEnvelopeFrame(t, &sliverpb.Envelope{
+		Type: sliverpb.MsgPing,
+		Data: []byte("hello"),
+	})
+
+	srv, cli := net.Pipe()
+	defer srv.Close()
+	defer cli.Close()
+
+	go func() {
+		_, _ = cli.Write(frame[:minisign.RawSigSize-1])
+		_ = cli.Close()
+	}()
+
+	_, err := implantWG.ReadEnvelope(srv)
+	if err == nil {
+		t.Fatalf("expected error for truncated signature, got nil")
+	}
+	if !errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF) {
+		t.Fatalf("expected EOF for truncated signature, got=%v", err)
+	}
+}

server/c2/wireguard_testhooks_sliver_e2e_test.go

@@ -0,0 +1,12 @@
+//go:build server && go_sqlite && sliver_e2e
+
+package c2
+
+import "net"
+
+// HandleWGSliverConnectionForTest exposes the raw connection handler to external
+// (package `c2_test`) end-to-end tests without shipping test-only symbols in
+// production builds.
+func HandleWGSliverConnectionForTest(conn net.Conn) {
+	handleWGSliverConnection(conn)
+}

server/c2/wireguard_yamux_beacon_e2e_test.go

@@ -0,0 +1,439 @@
+//go:build server && go_sqlite && sliver_e2e
+
+package c2_test
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"testing"
+	"time"
+
+	implantWG "github.com/bishopfox/sliver/implant/sliver/transports/wireguard"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/c2"
+	"github.com/bishopfox/sliver/server/transport"
+	"github.com/google/uuid"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestWGYamux_Beacon_EndToEndAsyncPingRPC(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleWGSliverConnectionForTest(serverConn)
+
+	beaconID := uuid.NewString()
+	beacon := startTestWGBeacon(t, implantConn, beaconID)
+	t.Cleanup(beacon.Stop)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	waitForBeaconRegistration(t, rpcClient, beaconID, 10*time.Second)
+
+	const tasksCount = 8
+	type taskInfo struct {
+		id    string
+		nonce int32
+	}
+	taskInfos := make([]taskInfo, 0, tasksCount)
+
+	for i := 0; i < tasksCount; i++ {
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+
+		nonce := int32(1000 + i)
+		resp, err := rpcClient.Ping(callCtx, &sliverpb.Ping{
+			Nonce: nonce,
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  int64(5 * time.Second),
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc ping (async): %v", err)
+		}
+		if resp.GetResponse() == nil || resp.GetResponse().TaskID == "" {
+			t.Fatalf("expected ping task id in async response, got=%v", resp.GetResponse())
+		}
+		taskInfos = append(taskInfos, taskInfo{id: resp.GetResponse().TaskID, nonce: nonce})
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pendingTasks, err := beacon.FetchPendingTasks(ctx)
+	if err != nil {
+		t.Fatalf("fetch pending beacon tasks: %v", err)
+	}
+	if len(pendingTasks) < tasksCount {
+		t.Fatalf("unexpected pending tasks count: got=%d want>=%d", len(pendingTasks), tasksCount)
+	}
+
+	results := executeBeaconTasks(t, pendingTasks)
+	if err := beacon.SendResults(results); err != nil {
+		t.Fatalf("send beacon results: %v", err)
+	}
+
+	for _, info := range taskInfos {
+		waitForBeaconTaskCompleted(t, rpcClient, info.id, info.nonce, 10*time.Second)
+	}
+}
+
+func TestWGYamux_Beacon_EndToEndAsyncMixedRPCs(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleWGSliverConnectionForTest(serverConn)
+
+	beaconID := uuid.NewString()
+	beacon := startTestWGBeacon(t, implantConn, beaconID)
+	t.Cleanup(beacon.Stop)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	waitForBeaconRegistration(t, rpcClient, beaconID, 10*time.Second)
+
+	testDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(testDir, "alpha.txt"), []byte("alpha"), 0600); err != nil {
+		t.Fatalf("write alpha.txt: %v", err)
+	}
+	if err := os.Mkdir(filepath.Join(testDir, "subdir"), 0700); err != nil {
+		t.Fatalf("mkdir subdir: %v", err)
+	}
+
+	reqTimeout := int64(5 * time.Second)
+
+	type taskCheck struct {
+		id    string
+		check func(*testing.T, []byte)
+	}
+	checks := make([]taskCheck, 0, 8)
+
+	addTask := func(taskID string, check func(*testing.T, []byte)) {
+		if taskID == "" {
+			t.Fatalf("expected task id in async response")
+		}
+		checks = append(checks, taskCheck{id: taskID, check: check})
+	}
+
+	for i := 0; i < 4; i++ {
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		nonce := int32(2000 + i)
+		resp, err := rpcClient.Ping(callCtx, &sliverpb.Ping{
+			Nonce: nonce,
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc ping (async): %v", err)
+		}
+
+		taskID := resp.GetResponse().GetTaskID()
+		wantNonce := nonce
+		addTask(taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			ping := &sliverpb.Ping{}
+			if err := proto.Unmarshal(data, ping); err != nil {
+				t.Fatalf("unmarshal ping response: %v", err)
+			}
+			if ping.Nonce != wantNonce {
+				t.Fatalf("unexpected ping nonce: got=%d want=%d", ping.Nonce, wantNonce)
+			}
+		})
+	}
+
+	{
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		resp, err := rpcClient.Pwd(callCtx, &sliverpb.PwdReq{
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc pwd (async): %v", err)
+		}
+		taskID := resp.GetResponse().GetTaskID()
+		addTask(taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			pwd := &sliverpb.Pwd{}
+			if err := proto.Unmarshal(data, pwd); err != nil {
+				t.Fatalf("unmarshal pwd response: %v", err)
+			}
+			if pwd.Path == "" {
+				t.Fatalf("unexpected empty pwd path")
+			}
+		})
+	}
+
+	{
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		resp, err := rpcClient.GetEnv(callCtx, &sliverpb.EnvReq{
+			Name: "PATH",
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc getenv (async): %v", err)
+		}
+		taskID := resp.GetResponse().GetTaskID()
+		addTask(taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			env := &sliverpb.EnvInfo{}
+			if err := proto.Unmarshal(data, env); err != nil {
+				t.Fatalf("unmarshal env response: %v", err)
+			}
+			if len(env.Variables) != 1 || env.Variables[0].Key != "PATH" {
+				t.Fatalf("unexpected env response: %+v", env.Variables)
+			}
+		})
+	}
+
+	{
+		callCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		resp, err := rpcClient.Ls(callCtx, &sliverpb.LsReq{
+			Path: testDir,
+			Request: &commonpb.Request{
+				Async:    true,
+				BeaconID: beaconID,
+				Timeout:  reqTimeout,
+			},
+		})
+		cancel()
+		if err != nil {
+			t.Fatalf("rpc ls (async): %v", err)
+		}
+		taskID := resp.GetResponse().GetTaskID()
+		addTask(taskID, func(t *testing.T, data []byte) {
+			t.Helper()
+			ls := &sliverpb.Ls{}
+			if err := proto.Unmarshal(data, ls); err != nil {
+				t.Fatalf("unmarshal ls response: %v", err)
+			}
+			if !ls.Exists {
+				t.Fatalf("unexpected ls response (Exists=false): %v", ls.GetResponse())
+			}
+			found := false
+			for _, file := range ls.Files {
+				if file.Name == "alpha.txt" {
+					found = true
+					break
+				}
+			}
+			if !found {
+				t.Fatalf("ls missing expected alpha.txt entry")
+			}
+		})
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pendingTasks, err := beacon.FetchPendingTasks(ctx)
+	if err != nil {
+		t.Fatalf("fetch pending beacon tasks: %v", err)
+	}
+	if len(pendingTasks) < len(checks) {
+		t.Fatalf("unexpected pending tasks count: got=%d want>=%d", len(pendingTasks), len(checks))
+	}
+
+	results := executeBeaconTasks(t, pendingTasks)
+	if err := beacon.SendResults(results); err != nil {
+		t.Fatalf("send beacon results: %v", err)
+	}
+
+	for _, tc := range checks {
+		data := waitForBeaconTaskResponseBytes(t, rpcClient, tc.id, 10*time.Second)
+		tc.check(t, data)
+	}
+}
+
+type wgTestBeacon struct {
+	id       string
+	conn     net.Conn
+	session  *yamux.Session
+	incoming chan *sliverpb.Envelope
+	done     chan struct{}
+}
+
+func startTestWGBeacon(t *testing.T, conn net.Conn, beaconID string) *wgTestBeacon {
+	t.Helper()
+
+	if _, err := conn.Write([]byte(implantWG.YamuxPreface)); err != nil {
+		t.Fatalf("write yamux preface: %v", err)
+	}
+
+	muxSession, err := yamux.Client(conn, nil)
+	if err != nil {
+		t.Fatalf("start yamux client session: %v", err)
+	}
+
+	beacon := &wgTestBeacon{
+		id:       beaconID,
+		conn:     conn,
+		session:  muxSession,
+		incoming: make(chan *sliverpb.Envelope, 64),
+		done:     make(chan struct{}),
+	}
+	go beacon.recvLoop()
+
+	register := &sliverpb.Register{
+		Name:              "e2e-beacon",
+		Hostname:          "localhost",
+		Uuid:              uuid.NewString(),
+		Username:          "unit-test",
+		Os:                runtime.GOOS,
+		Arch:              runtime.GOARCH,
+		Pid:               int32(os.Getpid()),
+		Filename:          "sliver-e2e",
+		ActiveC2:          "wg://e2e",
+		Version:           "e2e",
+		ReconnectInterval: 0,
+		ProxyURL:          "",
+		Locale:            "en_US",
+	}
+	regData, err := proto.Marshal(&sliverpb.BeaconRegister{
+		ID:          beaconID,
+		Interval:    int64(1),
+		Jitter:      int64(0),
+		Register:    register,
+		NextCheckin: int64(1),
+	})
+	if err != nil {
+		t.Fatalf("marshal beacon register: %v", err)
+	}
+	if err := sendWGYamuxEnvelope(muxSession, &sliverpb.Envelope{Type: sliverpb.MsgBeaconRegister, Data: regData}); err != nil {
+		t.Fatalf("send beacon register: %v", err)
+	}
+
+	return beacon
+}
+
+func (b *wgTestBeacon) Stop() {
+	select {
+	case <-b.done:
+	default:
+		close(b.done)
+	}
+	_ = b.session.Close()
+	_ = b.conn.Close()
+}
+
+func (b *wgTestBeacon) recvLoop() {
+	defer close(b.incoming)
+	for {
+		stream, err := b.session.Accept()
+		if err != nil {
+			return
+		}
+
+		go func(stream net.Conn) {
+			defer stream.Close()
+			envelope, err := implantWG.ReadEnvelope(stream)
+			if err != nil || envelope == nil {
+				return
+			}
+			select {
+			case b.incoming <- envelope:
+			case <-b.done:
+			}
+		}(stream)
+	}
+}
+
+func (b *wgTestBeacon) FetchPendingTasks(ctx context.Context) ([]*sliverpb.Envelope, error) {
+	reqData, err := proto.Marshal(&sliverpb.BeaconTasks{
+		ID:          b.id,
+		NextCheckin: int64(1),
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := sendWGYamuxEnvelope(b.session, &sliverpb.Envelope{Type: sliverpb.MsgBeaconTasks, Data: reqData}); err != nil {
+		return nil, err
+	}
+
+	for {
+		select {
+		case envelope, ok := <-b.incoming:
+			if !ok {
+				return nil, context.Canceled
+			}
+			if envelope.Type != sliverpb.MsgBeaconTasks {
+				continue
+			}
+			resp := &sliverpb.BeaconTasks{}
+			if err := proto.Unmarshal(envelope.Data, resp); err != nil {
+				return nil, err
+			}
+			return resp.Tasks, nil
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+}
+
+func (b *wgTestBeacon) SendResults(results []*sliverpb.Envelope) error {
+	reqData, err := proto.Marshal(&sliverpb.BeaconTasks{
+		ID:          b.id,
+		NextCheckin: int64(1),
+		Tasks:       results,
+	})
+	if err != nil {
+		return err
+	}
+	return sendWGYamuxEnvelope(b.session, &sliverpb.Envelope{Type: sliverpb.MsgBeaconTasks, Data: reqData})
+}

server/c2/wireguard_yamux_grpc_e2e_test.go

@@ -0,0 +1,416 @@
+//go:build server && go_sqlite && sliver_e2e
+
+package c2_test
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	implantHandlers "github.com/bishopfox/sliver/implant/sliver/handlers"
+	implantWG "github.com/bishopfox/sliver/implant/sliver/transports/wireguard"
+	"github.com/bishopfox/sliver/protobuf/commonpb"
+	"github.com/bishopfox/sliver/protobuf/rpcpb"
+	"github.com/bishopfox/sliver/protobuf/sliverpb"
+	"github.com/bishopfox/sliver/server/c2"
+	"github.com/bishopfox/sliver/server/core"
+	"github.com/bishopfox/sliver/server/transport"
+	"github.com/google/uuid"
+	"github.com/hashicorp/yamux"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestWGYamux_EndToEndPingRPC(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	t.Cleanup(func() {
+		for _, session := range core.Sessions.All() {
+			core.Sessions.Remove(session.ID)
+		}
+	})
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleWGSliverConnectionForTest(serverConn)
+
+	stopImplant := startTestWGImplant(t, implantConn)
+	t.Cleanup(stopImplant)
+
+	sessionID := waitForSessionID(t, 10*time.Second)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	pingReq := &sliverpb.Ping{
+		Nonce: 31337,
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   int64(5 * time.Second),
+		},
+	}
+	pingResp, err := rpcClient.Ping(ctx, pingReq)
+	if err != nil {
+		t.Fatalf("rpc ping: %v", err)
+	}
+	if pingResp.Nonce != pingReq.Nonce {
+		t.Fatalf("unexpected ping nonce: got=%d want=%d", pingResp.Nonce, pingReq.Nonce)
+	}
+
+	const concurrentPings = 32
+	var wg sync.WaitGroup
+	errCh := make(chan error, concurrentPings)
+
+	for i := 0; i < concurrentPings; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+			callCtx, callCancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer callCancel()
+
+			req := &sliverpb.Ping{
+				Nonce: int32(i),
+				Request: &commonpb.Request{
+					SessionID: sessionID,
+					Timeout:   int64(5 * time.Second),
+				},
+			}
+			resp, err := rpcClient.Ping(callCtx, req)
+			if err != nil {
+				errCh <- err
+				return
+			}
+			if resp.Nonce != req.Nonce {
+				errCh <- fmt.Errorf("ping nonce mismatch: got=%d want=%d", resp.Nonce, req.Nonce)
+				return
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(errCh)
+	for err := range errCh {
+		t.Error(err)
+	}
+}
+
+func TestWGYamux_EndToEndMixedRPCs(t *testing.T) {
+	// NOTE: If you run this test in a restricted environment where writes to
+	// `~/.sliver` are blocked, set `SLIVER_ROOT_DIR` to a writable temp dir.
+
+	t.Cleanup(func() {
+		for _, session := range core.Sessions.All() {
+			core.Sessions.Remove(session.ID)
+		}
+	})
+
+	grpcServer, grpcListener, err := transport.LocalListener()
+	if err != nil {
+		t.Fatalf("start local grpc listener: %v", err)
+	}
+	t.Cleanup(func() {
+		grpcServer.Stop()
+		_ = grpcListener.Close()
+	})
+
+	serverConn, implantConn := net.Pipe()
+	t.Cleanup(func() {
+		_ = serverConn.Close()
+		_ = implantConn.Close()
+	})
+	go c2.HandleWGSliverConnectionForTest(serverConn)
+
+	stopImplant := startTestWGImplant(t, implantConn)
+	t.Cleanup(stopImplant)
+
+	sessionID := waitForSessionID(t, 10*time.Second)
+
+	rpcConn, err := dialBufConn(context.Background(), grpcListener)
+	if err != nil {
+		t.Fatalf("dial grpc/bufconn: %v", err)
+	}
+	t.Cleanup(func() { _ = rpcConn.Close() })
+	rpcClient := rpcpb.NewSliverRPCClient(rpcConn)
+
+	testDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(testDir, "alpha.txt"), []byte("alpha"), 0600); err != nil {
+		t.Fatalf("write alpha.txt: %v", err)
+	}
+	if err := os.Mkdir(filepath.Join(testDir, "subdir"), 0700); err != nil {
+		t.Fatalf("mkdir subdir: %v", err)
+	}
+
+	reqTimeout := int64(5 * time.Second)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	pwdResp, err := rpcClient.Pwd(ctx, &sliverpb.PwdReq{
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   reqTimeout,
+		},
+	})
+	if err != nil {
+		t.Fatalf("rpc pwd: %v", err)
+	}
+	if pwdResp.Path == "" {
+		t.Fatalf("unexpected empty pwd path")
+	}
+
+	envResp, err := rpcClient.GetEnv(ctx, &sliverpb.EnvReq{
+		Name: "PATH",
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   reqTimeout,
+		},
+	})
+	if err != nil {
+		t.Fatalf("rpc getenv: %v", err)
+	}
+	if len(envResp.Variables) != 1 || envResp.Variables[0].Key != "PATH" {
+		t.Fatalf("unexpected getenv response: %+v", envResp.Variables)
+	}
+
+	lsResp, err := rpcClient.Ls(ctx, &sliverpb.LsReq{
+		Path: testDir,
+		Request: &commonpb.Request{
+			SessionID: sessionID,
+			Timeout:   reqTimeout,
+		},
+	})
+	if err != nil {
+		t.Fatalf("rpc ls: %v", err)
+	}
+	if !lsResp.Exists {
+		t.Fatalf("unexpected ls response (Exists=false): %v", lsResp.GetResponse())
+	}
+	lsNames := map[string]bool{}
+	for _, file := range lsResp.Files {
+		lsNames[file.Name] = true
+	}
+	for _, want := range []string{"alpha.txt", "subdir"} {
+		if !lsNames[want] {
+			t.Fatalf("ls missing expected entry %q (got %d entries)", want, len(lsResp.Files))
+		}
+	}
+
+	const concurrentCalls = 64
+	var wg sync.WaitGroup
+	errCh := make(chan error, concurrentCalls)
+
+	for i := 0; i < concurrentCalls; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+
+			callCtx, callCancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer callCancel()
+
+			switch i % 4 {
+			case 0:
+				req := &sliverpb.Ping{
+					Nonce: int32(i),
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				}
+				resp, err := rpcClient.Ping(callCtx, req)
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if resp.Nonce != req.Nonce {
+					errCh <- fmt.Errorf("ping nonce mismatch: got=%d want=%d", resp.Nonce, req.Nonce)
+					return
+				}
+
+			case 1:
+				resp, err := rpcClient.Pwd(callCtx, &sliverpb.PwdReq{
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				})
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if resp.Path == "" {
+					errCh <- fmt.Errorf("pwd returned empty path")
+					return
+				}
+
+			case 2:
+				resp, err := rpcClient.GetEnv(callCtx, &sliverpb.EnvReq{
+					Name: "PATH",
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				})
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if len(resp.Variables) != 1 || resp.Variables[0].Key != "PATH" {
+					errCh <- fmt.Errorf("unexpected getenv response: %+v", resp.Variables)
+					return
+				}
+
+			default:
+				resp, err := rpcClient.Ls(callCtx, &sliverpb.LsReq{
+					Path: testDir,
+					Request: &commonpb.Request{
+						SessionID: sessionID,
+						Timeout:   reqTimeout,
+					},
+				})
+				if err != nil {
+					errCh <- err
+					return
+				}
+				if !resp.Exists {
+					errCh <- fmt.Errorf("unexpected ls response (Exists=false): %v", resp.GetResponse())
+					return
+				}
+				found := false
+				for _, file := range resp.Files {
+					if file.Name == "alpha.txt" {
+						found = true
+						break
+					}
+				}
+				if !found {
+					errCh <- fmt.Errorf("ls missing expected alpha.txt entry")
+					return
+				}
+			}
+		}(i)
+	}
+
+	wg.Wait()
+	close(errCh)
+	for err := range errCh {
+		t.Error(err)
+	}
+}
+
+func startTestWGImplant(t *testing.T, conn net.Conn) func() {
+	t.Helper()
+
+	if _, err := conn.Write([]byte(implantWG.YamuxPreface)); err != nil {
+		t.Fatalf("write yamux preface: %v", err)
+	}
+
+	muxSession, err := yamux.Client(conn, nil)
+	if err != nil {
+		t.Fatalf("start yamux client session: %v", err)
+	}
+
+	register := &sliverpb.Register{
+		Name:              "e2e",
+		Hostname:          "localhost",
+		Uuid:              uuid.NewString(),
+		Username:          "unit-test",
+		Os:                runtime.GOOS,
+		Arch:              runtime.GOARCH,
+		Pid:               int32(os.Getpid()),
+		Filename:          "sliver-e2e",
+		ActiveC2:          "wg://e2e",
+		Version:           "e2e",
+		ReconnectInterval: 0,
+		ProxyURL:          "",
+		Locale:            "en_US",
+	}
+	regData, err := proto.Marshal(register)
+	if err != nil {
+		t.Fatalf("marshal register: %v", err)
+	}
+	if err := sendWGYamuxEnvelope(muxSession, &sliverpb.Envelope{Type: sliverpb.MsgRegister, Data: regData}); err != nil {
+		t.Fatalf("send register: %v", err)
+	}
+
+	handlers := implantHandlers.GetSystemHandlers()
+	loopDone := make(chan struct{})
+	go func() {
+		defer close(loopDone)
+
+		streamSem := make(chan struct{}, 128)
+		for {
+			stream, err := muxSession.Accept()
+			if err != nil {
+				return
+			}
+			select {
+			case streamSem <- struct{}{}:
+			default:
+				_ = stream.Close()
+				continue
+			}
+
+			go func(stream net.Conn) {
+				defer func() { <-streamSem }()
+				defer stream.Close()
+
+				envelope, err := implantWG.ReadEnvelope(stream)
+				if err != nil || envelope == nil || envelope.ID == 0 {
+					return
+				}
+
+				handler, ok := handlers[envelope.Type]
+				if !ok {
+					_ = sendWGYamuxEnvelope(muxSession, &sliverpb.Envelope{ID: envelope.ID, UnknownMessageType: true})
+					return
+				}
+				handler(envelope.Data, func(data []byte, err error) {
+					_ = err
+					_ = sendWGYamuxEnvelope(muxSession, &sliverpb.Envelope{ID: envelope.ID, Data: data})
+				})
+			}(stream)
+		}
+	}()
+
+	return func() {
+		_ = muxSession.Close()
+		_ = conn.Close()
+		select {
+		case <-loopDone:
+		case <-time.After(5 * time.Second):
+		}
+	}
+}
+
+func sendWGYamuxEnvelope(session *yamux.Session, envelope *sliverpb.Envelope) error {
+	stream, err := session.Open()
+	if err != nil {
+		return err
+	}
+	defer stream.Close()
+	return implantWG.WriteEnvelope(stream, envelope)
+}

server/cli/operator.go

@@ -24,6 +24,7 @@ import (
 	"path/filepath"
 
 	"github.com/bishopfox/sliver/server/certs"
+	"github.com/bishopfox/sliver/server/configs"
 	"github.com/bishopfox/sliver/server/console"
 	"github.com/spf13/cobra"
 )
@@ -64,6 +65,14 @@ var operatorCmd = &cobra.Command{
 			return
 		}
 
+		if !cmd.Flags().Changed(lportFlagStr) {
+			serverConfig := configs.GetServerConfig()
+
+			if serverConfig.DaemonMode {
+				lport = uint16(serverConfig.DaemonConfig.Port)
+			}
+		}
+
 		save, err := cmd.Flags().GetString(saveFlagStr)
 		if err != nil {
 			fmt.Printf("Failed to parse --%s flag %s", saveFlagStr, err)

server/db/models/website.go

@@ -52,7 +52,10 @@ func (w *Website) BeforeCreate(tx *gorm.DB) (err error) {
 func (w *Website) ToProtobuf(webContentDir string) *clientpb.Website {
 	WebContents := map[string]*clientpb.WebContent{}
 	for _, webcontent := range w.WebContents {
-		contents, _ := os.ReadFile(filepath.Join(webContentDir, webcontent.Path))
+		contents, err := os.ReadFile(filepath.Join(webContentDir, webcontent.ID.String()))
+		if err != nil {
+			continue
+		}
 		WebContents[webcontent.ID.String()] = webcontent.ToProtobuf(&contents)
 	}
 	return &clientpb.Website{

server/rpc/rpc-jobs.go

@@ -156,21 +156,15 @@ func (rpc *Server) StartWGListener(ctx context.Context, req *clientpb.WGListener
 		req.KeyPort = defaultWGKeyExPort
 	}
 
+	if req.NPort == req.KeyPort {
+		return nil, status.Error(codes.InvalidArgument, "wg nport and key-port must be different")
+	}
+
 	err := PortInUse(req.Port)
 	if err != nil {
 		return nil, rpcError(err)
 	}
 
-	err = PortInUse(req.NPort)
-	if err != nil {
-		return nil, rpcError(err)
-	}
-
-	err = PortInUse(req.KeyPort)
-	if err != nil {
-		return nil, rpcError(err)
-	}
-
 	job, err := c2.StartWGListenerJob(req)
 	if err != nil {
 		return nil, rpcError(err)

vendor/github.com/hashicorp/yamux/LICENSE

@@ -0,0 +1,364 @@
+Copyright (c) 2014 HashiCorp, Inc.
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing
+     basis, if such Contributor fails to notify You of the non-compliance by
+     some reasonable means prior to 60 days after You have come back into
+     compliance. Moreover, Your grants from a particular Contributor are
+     reinstated on an ongoing basis if such Contributor notifies You of the
+     non-compliance by some reasonable means, this is the first time You have
+     received notice of non-compliance with this License from such
+     Contributor, and You become compliant prior to 30 days after Your receipt
+     of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions,
+     counter-claims, and cross-claims) alleging that a Contributor Version
+     directly or indirectly infringes any patent, then the rights granted to
+     You by any and all Contributors for the Covered Software under Section
+     2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+      Licenses If You choose to distribute Source Code Form that is
+      Incompatible With Secondary Licenses under the terms of this version of
+      the License, the notice described in Exhibit B of this License must be
+      attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.

vendor/github.com/hashicorp/yamux/README.md

@@ -0,0 +1,86 @@
+# Yamux
+
+Yamux (Yet another Multiplexer) is a multiplexing library for Golang.
+It relies on an underlying connection to provide reliability
+and ordering, such as TCP or Unix domain sockets, and provides
+stream-oriented multiplexing. It is inspired by SPDY but is not
+interoperable with it.
+
+Yamux features include:
+
+* Bi-directional streams
+  * Streams can be opened by either client or server
+  * Useful for NAT traversal
+  * Server-side push support
+* Flow control
+  * Avoid starvation
+  * Back-pressure to prevent overwhelming a receiver
+* Keep Alives
+  * Enables persistent connections over a load balancer
+* Efficient
+  * Enables thousands of logical streams with low overhead
+
+## Documentation
+
+For complete documentation, see the associated [Godoc](http://godoc.org/github.com/hashicorp/yamux).
+
+## Specification
+
+The full specification for Yamux is provided in the `spec.md` file.
+It can be used as a guide to implementors of interoperable libraries.
+
+## Usage
+
+Using Yamux is remarkably simple:
+
+```go
+
+func client() {
+    // Get a TCP connection
+    conn, err := net.Dial(...)
+    if err != nil {
+        panic(err)
+    }
+
+    // Setup client side of yamux
+    session, err := yamux.Client(conn, nil)
+    if err != nil {
+        panic(err)
+    }
+
+    // Open a new stream
+    stream, err := session.Open()
+    if err != nil {
+        panic(err)
+    }
+
+    // Stream implements net.Conn
+    stream.Write([]byte("ping"))
+}
+
+func server() {
+    // Accept a TCP connection
+    conn, err := listener.Accept()
+    if err != nil {
+        panic(err)
+    }
+
+    // Setup server side of yamux
+    session, err := yamux.Server(conn, nil)
+    if err != nil {
+        panic(err)
+    }
+
+    // Accept a stream
+    stream, err := session.Accept()
+    if err != nil {
+        panic(err)
+    }
+
+    // Listen for a message
+    buf := make([]byte, 4)
+    stream.Read(buf)
+}
+
+```
+

vendor/github.com/hashicorp/yamux/addr.go

@@ -0,0 +1,60 @@
+package yamux
+
+import (
+	"fmt"
+	"net"
+)
+
+// hasAddr is used to get the address from the underlying connection
+type hasAddr interface {
+	LocalAddr() net.Addr
+	RemoteAddr() net.Addr
+}
+
+// yamuxAddr is used when we cannot get the underlying address
+type yamuxAddr struct {
+	Addr string
+}
+
+func (*yamuxAddr) Network() string {
+	return "yamux"
+}
+
+func (y *yamuxAddr) String() string {
+	return fmt.Sprintf("yamux:%s", y.Addr)
+}
+
+// Addr is used to get the address of the listener.
+func (s *Session) Addr() net.Addr {
+	return s.LocalAddr()
+}
+
+// LocalAddr is used to get the local address of the
+// underlying connection.
+func (s *Session) LocalAddr() net.Addr {
+	addr, ok := s.conn.(hasAddr)
+	if !ok {
+		return &yamuxAddr{"local"}
+	}
+	return addr.LocalAddr()
+}
+
+// RemoteAddr is used to get the address of remote end
+// of the underlying connection
+func (s *Session) RemoteAddr() net.Addr {
+	addr, ok := s.conn.(hasAddr)
+	if !ok {
+		return &yamuxAddr{"remote"}
+	}
+	return addr.RemoteAddr()
+}
+
+// LocalAddr returns the local address
+func (s *Stream) LocalAddr() net.Addr {
+	return s.session.LocalAddr()
+}
+
+// RemoteAddr returns the remote address
+func (s *Stream) RemoteAddr() net.Addr {
+	return s.session.RemoteAddr()
+}

vendor/github.com/hashicorp/yamux/bench_test.go

@@ -0,0 +1,243 @@
+package yamux
+
+import (
+	"fmt"
+	"io"
+	"testing"
+)
+
+func BenchmarkPing(b *testing.B) {
+	client, _ := testClientServer(b)
+
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	for i := 0; i < b.N; i++ {
+		rtt, err := client.Ping()
+		if err != nil {
+			b.Fatalf("err: %v", err)
+		}
+		if rtt == 0 {
+			b.Fatalf("bad: %v", rtt)
+		}
+	}
+}
+
+func BenchmarkAccept(b *testing.B) {
+	client, server := testClientServer(b)
+
+	doneCh := make(chan struct{})
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	go func() {
+		defer close(doneCh)
+
+		for i := 0; i < b.N; i++ {
+			stream, err := server.AcceptStream()
+			if err != nil {
+				return
+			}
+			stream.Close()
+		}
+	}()
+
+	for i := 0; i < b.N; i++ {
+		stream, err := client.Open()
+		if err != nil {
+			b.Fatalf("err: %v", err)
+		}
+		stream.Close()
+	}
+	<-doneCh
+}
+
+func BenchmarkSendRecv32(b *testing.B) {
+	const payloadSize = 32
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv64(b *testing.B) {
+	const payloadSize = 64
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv128(b *testing.B) {
+	const payloadSize = 128
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv256(b *testing.B) {
+	const payloadSize = 256
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv512(b *testing.B) {
+	const payloadSize = 512
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv1024(b *testing.B) {
+	const payloadSize = 1024
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv2048(b *testing.B) {
+	const payloadSize = 2048
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecv4096(b *testing.B) {
+	const payloadSize = 4096
+	benchmarkSendRecv(b, payloadSize, payloadSize)
+}
+
+func BenchmarkSendRecvLarge(b *testing.B) {
+	const sendSize = 512 * 1024 * 1024 //512 MB
+	const recvSize = 4 * 1024          //4 KB
+	benchmarkSendRecv(b, sendSize, recvSize)
+}
+
+func benchmarkSendRecv(b *testing.B, sendSize, recvSize int) {
+	client, server := testClientServer(b)
+
+	sendBuf := make([]byte, sendSize)
+	recvBuf := make([]byte, recvSize)
+	errCh := make(chan error, 1)
+
+	b.SetBytes(int64(sendSize))
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	go func() {
+		stream, err := server.AcceptStream()
+		if err != nil {
+			errCh <- err
+			return
+		}
+		defer stream.Close()
+
+		switch {
+		case sendSize == recvSize:
+			for i := 0; i < b.N; i++ {
+				if _, err := stream.Read(recvBuf); err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+		case recvSize > sendSize:
+			errCh <- fmt.Errorf("bad test case; recvSize was: %d and sendSize was: %d, but recvSize must be <= sendSize!", recvSize, sendSize)
+			return
+
+		default:
+			chunks := sendSize / recvSize
+			for i := 0; i < b.N; i++ {
+				for j := 0; j < chunks; j++ {
+					if _, err := stream.Read(recvBuf); err != nil {
+						errCh <- err
+						return
+					}
+				}
+			}
+		}
+		errCh <- nil
+	}()
+
+	stream, err := client.Open()
+	if err != nil {
+		b.Fatalf("err: %v", err)
+	}
+	defer stream.Close()
+
+	for i := 0; i < b.N; i++ {
+		if _, err := stream.Write(sendBuf); err != nil {
+			b.Fatalf("err: %v", err)
+		}
+	}
+
+	drainErrorsUntil(b, errCh, 1, 0, "")
+}
+
+func BenchmarkSendRecvParallel32(b *testing.B) {
+	const payloadSize = 32
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel64(b *testing.B) {
+	const payloadSize = 64
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel128(b *testing.B) {
+	const payloadSize = 128
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel256(b *testing.B) {
+	const payloadSize = 256
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel512(b *testing.B) {
+	const payloadSize = 512
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel1024(b *testing.B) {
+	const payloadSize = 1024
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel2048(b *testing.B) {
+	const payloadSize = 2048
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func BenchmarkSendRecvParallel4096(b *testing.B) {
+	const payloadSize = 4096
+	benchmarkSendRecvParallel(b, payloadSize)
+}
+
+func benchmarkSendRecvParallel(b *testing.B, sendSize int) {
+	client, server := testClientServer(b)
+
+	sendBuf := make([]byte, sendSize)
+	discarder := io.Discard.(io.ReaderFrom)
+	b.SetBytes(int64(sendSize))
+	b.ReportAllocs()
+	b.ResetTimer()
+
+	b.RunParallel(func(pb *testing.PB) {
+		errCh := make(chan error, 1)
+		go func() {
+			stream, err := server.AcceptStream()
+			if err != nil {
+				errCh <- err
+				return
+			}
+			defer stream.Close()
+
+			if _, err := discarder.ReadFrom(stream); err != nil {
+				errCh <- err
+				return
+			}
+			errCh <- nil
+		}()
+
+		stream, err := client.Open()
+		if err != nil {
+			b.Fatalf("err: %v", err)
+		}
+
+		for pb.Next() {
+			if _, err := stream.Write(sendBuf); err != nil {
+				b.Fatalf("err: %v", err)
+			}
+		}
+
+		stream.Close()
+
+		drainErrorsUntil(b, errCh, 1, 0, "")
+	})
+}

vendor/github.com/hashicorp/yamux/const.go

@@ -0,0 +1,182 @@
+package yamux
+
+import (
+	"encoding/binary"
+	"fmt"
+)
+
+// NetError implements net.Error
+type NetError struct {
+	err       error
+	timeout   bool
+	temporary bool
+}
+
+func (e *NetError) Error() string {
+	return e.err.Error()
+}
+
+func (e *NetError) Timeout() bool {
+	return e.timeout
+}
+
+func (e *NetError) Temporary() bool {
+	return e.temporary
+}
+
+var (
+	// ErrInvalidVersion means we received a frame with an
+	// invalid version
+	ErrInvalidVersion = fmt.Errorf("invalid protocol version")
+
+	// ErrInvalidMsgType means we received a frame with an
+	// invalid message type
+	ErrInvalidMsgType = fmt.Errorf("invalid msg type")
+
+	// ErrSessionShutdown is used if there is a shutdown during
+	// an operation
+	ErrSessionShutdown = fmt.Errorf("session shutdown")
+
+	// ErrStreamsExhausted is returned if we have no more
+	// stream ids to issue
+	ErrStreamsExhausted = fmt.Errorf("streams exhausted")
+
+	// ErrDuplicateStream is used if a duplicate stream is
+	// opened inbound
+	ErrDuplicateStream = fmt.Errorf("duplicate stream initiated")
+
+	// ErrReceiveWindowExceeded indicates the window was exceeded
+	ErrRecvWindowExceeded = fmt.Errorf("recv window exceeded")
+
+	// ErrTimeout is used when we reach an IO deadline
+	ErrTimeout = &NetError{
+		err: fmt.Errorf("i/o deadline reached"),
+
+		// Error should meet net.Error interface for timeouts for compatability
+		// with standard library expectations, such as http servers.
+		timeout: true,
+	}
+
+	// ErrStreamClosed is returned when using a closed stream
+	ErrStreamClosed = fmt.Errorf("stream closed")
+
+	// ErrUnexpectedFlag is set when we get an unexpected flag
+	ErrUnexpectedFlag = fmt.Errorf("unexpected flag")
+
+	// ErrRemoteGoAway is used when we get a go away from the other side
+	ErrRemoteGoAway = fmt.Errorf("remote end is not accepting connections")
+
+	// ErrConnectionReset is sent if a stream is reset. This can happen
+	// if the backlog is exceeded, or if there was a remote GoAway.
+	ErrConnectionReset = fmt.Errorf("connection reset")
+
+	// ErrConnectionWriteTimeout indicates that we hit the "safety valve"
+	// timeout writing to the underlying stream connection.
+	ErrConnectionWriteTimeout = fmt.Errorf("connection write timeout")
+
+	// ErrKeepAliveTimeout is sent if a missed keepalive caused the stream close
+	ErrKeepAliveTimeout = fmt.Errorf("keepalive timeout")
+)
+
+const (
+	// protoVersion is the only version we support
+	protoVersion uint8 = 0
+)
+
+const (
+	// Data is used for data frames. They are followed
+	// by length bytes worth of payload.
+	typeData uint8 = iota
+
+	// WindowUpdate is used to change the window of
+	// a given stream. The length indicates the delta
+	// update to the window.
+	typeWindowUpdate
+
+	// Ping is sent as a keep-alive or to measure
+	// the RTT. The StreamID and Length value are echoed
+	// back in the response.
+	typePing
+
+	// GoAway is sent to terminate a session. The StreamID
+	// should be 0 and the length is an error code.
+	typeGoAway
+)
+
+const (
+	// SYN is sent to signal a new stream. May
+	// be sent with a data payload
+	flagSYN uint16 = 1 << iota
+
+	// ACK is sent to acknowledge a new stream. May
+	// be sent with a data payload
+	flagACK
+
+	// FIN is sent to half-close the given stream.
+	// May be sent with a data payload.
+	flagFIN
+
+	// RST is used to hard close a given stream.
+	flagRST
+)
+
+const (
+	// initialStreamWindow is the initial stream window size
+	initialStreamWindow uint32 = 256 * 1024
+)
+
+const (
+	// goAwayNormal is sent on a normal termination
+	goAwayNormal uint32 = iota
+
+	// goAwayProtoErr sent on a protocol error
+	goAwayProtoErr
+
+	// goAwayInternalErr sent on an internal error
+	goAwayInternalErr
+)
+
+const (
+	sizeOfVersion  = 1
+	sizeOfType     = 1
+	sizeOfFlags    = 2
+	sizeOfStreamID = 4
+	sizeOfLength   = 4
+	headerSize     = sizeOfVersion + sizeOfType + sizeOfFlags +
+		sizeOfStreamID + sizeOfLength
+)
+
+type header []byte
+
+func (h header) Version() uint8 {
+	return h[0]
+}
+
+func (h header) MsgType() uint8 {
+	return h[1]
+}
+
+func (h header) Flags() uint16 {
+	return binary.BigEndian.Uint16(h[2:4])
+}
+
+func (h header) StreamID() uint32 {
+	return binary.BigEndian.Uint32(h[4:8])
+}
+
+func (h header) Length() uint32 {
+	return binary.BigEndian.Uint32(h[8:12])
+}
+
+func (h header) String() string {
+	return fmt.Sprintf("Vsn:%d Type:%d Flags:%d StreamID:%d Length:%d",
+		h.Version(), h.MsgType(), h.Flags(), h.StreamID(), h.Length())
+}
+
+func (h header) encode(msgType uint8, flags uint16, streamID uint32, length uint32) {
+	h[0] = protoVersion
+	h[1] = msgType
+	binary.BigEndian.PutUint16(h[2:4], flags)
+	binary.BigEndian.PutUint32(h[4:8], streamID)
+	binary.BigEndian.PutUint32(h[8:12], length)
+}

vendor/github.com/hashicorp/yamux/const_test.go

@@ -0,0 +1,72 @@
+package yamux
+
+import (
+	"testing"
+)
+
+func TestConst(t *testing.T) {
+	if protoVersion != 0 {
+		t.Fatalf("bad: %v", protoVersion)
+	}
+
+	if typeData != 0 {
+		t.Fatalf("bad: %v", typeData)
+	}
+	if typeWindowUpdate != 1 {
+		t.Fatalf("bad: %v", typeWindowUpdate)
+	}
+	if typePing != 2 {
+		t.Fatalf("bad: %v", typePing)
+	}
+	if typeGoAway != 3 {
+		t.Fatalf("bad: %v", typeGoAway)
+	}
+
+	if flagSYN != 1 {
+		t.Fatalf("bad: %v", flagSYN)
+	}
+	if flagACK != 2 {
+		t.Fatalf("bad: %v", flagACK)
+	}
+	if flagFIN != 4 {
+		t.Fatalf("bad: %v", flagFIN)
+	}
+	if flagRST != 8 {
+		t.Fatalf("bad: %v", flagRST)
+	}
+
+	if goAwayNormal != 0 {
+		t.Fatalf("bad: %v", goAwayNormal)
+	}
+	if goAwayProtoErr != 1 {
+		t.Fatalf("bad: %v", goAwayProtoErr)
+	}
+	if goAwayInternalErr != 2 {
+		t.Fatalf("bad: %v", goAwayInternalErr)
+	}
+
+	if headerSize != 12 {
+		t.Fatalf("bad header size")
+	}
+}
+
+func TestEncodeDecode(t *testing.T) {
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typeWindowUpdate, flagACK|flagRST, 1234, 4321)
+
+	if hdr.Version() != protoVersion {
+		t.Fatalf("bad: %v", hdr)
+	}
+	if hdr.MsgType() != typeWindowUpdate {
+		t.Fatalf("bad: %v", hdr)
+	}
+	if hdr.Flags() != flagACK|flagRST {
+		t.Fatalf("bad: %v", hdr)
+	}
+	if hdr.StreamID() != 1234 {
+		t.Fatalf("bad: %v", hdr)
+	}
+	if hdr.Length() != 4321 {
+		t.Fatalf("bad: %v", hdr)
+	}
+}

vendor/github.com/hashicorp/yamux/go.mod

@@ -0,0 +1,3 @@
+module github.com/hashicorp/yamux
+
+go 1.20

vendor/github.com/hashicorp/yamux/mux.go

@@ -0,0 +1,118 @@
+package yamux
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"time"
+)
+
+// Config is used to tune the Yamux session
+type Config struct {
+	// AcceptBacklog is used to limit how many streams may be
+	// waiting an accept.
+	AcceptBacklog int
+
+	// EnableKeepalive is used to do a period keep alive
+	// messages using a ping.
+	EnableKeepAlive bool
+
+	// KeepAliveInterval is how often to perform the keep alive
+	KeepAliveInterval time.Duration
+
+	// ConnectionWriteTimeout is meant to be a "safety valve" timeout after
+	// we which will suspect a problem with the underlying connection and
+	// close it. This is only applied to writes, where's there's generally
+	// an expectation that things will move along quickly.
+	ConnectionWriteTimeout time.Duration
+
+	// MaxStreamWindowSize is used to control the maximum
+	// window size that we allow for a stream.
+	MaxStreamWindowSize uint32
+
+	// StreamOpenTimeout is the maximum amount of time that a stream will
+	// be allowed to remain in pending state while waiting for an ack from the peer.
+	// Once the timeout is reached the session will be gracefully closed.
+	// A zero value disables the StreamOpenTimeout allowing unbounded
+	// blocking on OpenStream calls.
+	StreamOpenTimeout time.Duration
+
+	// StreamCloseTimeout is the maximum time that a stream will allowed to
+	// be in a half-closed state when `Close` is called before forcibly
+	// closing the connection. Forcibly closed connections will empty the
+	// receive buffer, drop any future packets received for that stream,
+	// and send a RST to the remote side.
+	StreamCloseTimeout time.Duration
+
+	// LogOutput is used to control the log destination. Either Logger or
+	// LogOutput can be set, not both.
+	LogOutput io.Writer
+
+	// Logger is used to pass in the logger to be used. Either Logger or
+	// LogOutput can be set, not both.
+	Logger Logger
+}
+
+func (c *Config) Clone() *Config {
+	c2 := *c
+	return &c2
+}
+
+// DefaultConfig is used to return a default configuration
+func DefaultConfig() *Config {
+	return &Config{
+		AcceptBacklog:          256,
+		EnableKeepAlive:        true,
+		KeepAliveInterval:      30 * time.Second,
+		ConnectionWriteTimeout: 10 * time.Second,
+		MaxStreamWindowSize:    initialStreamWindow,
+		StreamCloseTimeout:     5 * time.Minute,
+		StreamOpenTimeout:      75 * time.Second,
+		LogOutput:              os.Stderr,
+	}
+}
+
+// VerifyConfig is used to verify the sanity of configuration
+func VerifyConfig(config *Config) error {
+	if config.AcceptBacklog <= 0 {
+		return fmt.Errorf("backlog must be positive")
+	}
+	if config.KeepAliveInterval == 0 {
+		return fmt.Errorf("keep-alive interval must be positive")
+	}
+	if config.MaxStreamWindowSize < initialStreamWindow {
+		return fmt.Errorf("MaxStreamWindowSize must be larger than %d", initialStreamWindow)
+	}
+	if config.LogOutput != nil && config.Logger != nil {
+		return fmt.Errorf("both Logger and LogOutput may not be set, select one")
+	} else if config.LogOutput == nil && config.Logger == nil {
+		return fmt.Errorf("one of Logger or LogOutput must be set, select one")
+	}
+	return nil
+}
+
+// Server is used to initialize a new server-side connection.
+// There must be at most one server-side connection. If a nil config is
+// provided, the DefaultConfiguration will be used.
+func Server(conn io.ReadWriteCloser, config *Config) (*Session, error) {
+	if config == nil {
+		config = DefaultConfig()
+	}
+	if err := VerifyConfig(config); err != nil {
+		return nil, err
+	}
+	return newSession(config, conn, false), nil
+}
+
+// Client is used to initialize a new client-side connection.
+// There must be at most one client-side connection.
+func Client(conn io.ReadWriteCloser, config *Config) (*Session, error) {
+	if config == nil {
+		config = DefaultConfig()
+	}
+
+	if err := VerifyConfig(config); err != nil {
+		return nil, err
+	}
+	return newSession(config, conn, true), nil
+}

vendor/github.com/hashicorp/yamux/session.go

@@ -0,0 +1,749 @@
+package yamux
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"math"
+	"net"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// Session is used to wrap a reliable ordered connection and to
+// multiplex it into multiple streams.
+type Session struct {
+	// remoteGoAway indicates the remote side does
+	// not want futher connections. Must be first for alignment.
+	remoteGoAway int32
+
+	// localGoAway indicates that we should stop
+	// accepting futher connections. Must be first for alignment.
+	localGoAway int32
+
+	// nextStreamID is the next stream we should
+	// send. This depends if we are a client/server.
+	nextStreamID uint32
+
+	// config holds our configuration
+	config *Config
+
+	// logger is used for our logs
+	logger Logger
+
+	// conn is the underlying connection
+	conn io.ReadWriteCloser
+
+	// bufRead is a buffered reader
+	bufRead *bufio.Reader
+
+	// pings is used to track inflight pings
+	pings    map[uint32]chan struct{}
+	pingID   uint32
+	pingLock sync.Mutex
+
+	// streams maps a stream id to a stream, and inflight has an entry
+	// for any outgoing stream that has not yet been established. Both are
+	// protected by streamLock.
+	streams    map[uint32]*Stream
+	inflight   map[uint32]struct{}
+	streamLock sync.Mutex
+
+	// synCh acts like a semaphore. It is sized to the AcceptBacklog which
+	// is assumed to be symmetric between the client and server. This allows
+	// the client to avoid exceeding the backlog and instead blocks the open.
+	synCh chan struct{}
+
+	// acceptCh is used to pass ready streams to the client
+	acceptCh chan *Stream
+
+	// sendCh is used to mark a stream as ready to send,
+	// or to send a header out directly.
+	sendCh chan *sendReady
+
+	// recvDoneCh is closed when recv() exits to avoid a race
+	// between stream registration and stream shutdown
+	recvDoneCh chan struct{}
+	sendDoneCh chan struct{}
+
+	// shutdown is used to safely close a session
+	shutdown        bool
+	shutdownErr     error
+	shutdownCh      chan struct{}
+	shutdownLock    sync.Mutex
+	shutdownErrLock sync.Mutex
+}
+
+// sendReady is used to either mark a stream as ready
+// or to directly send a header
+type sendReady struct {
+	Hdr  []byte
+	mu   sync.Mutex // Protects Body from unsafe reads.
+	Body []byte
+	Err  chan error
+}
+
+// newSession is used to construct a new session
+func newSession(config *Config, conn io.ReadWriteCloser, client bool) *Session {
+	logger := config.Logger
+	if logger == nil {
+		logger = log.New(config.LogOutput, "", log.LstdFlags)
+	}
+
+	s := &Session{
+		config:     config,
+		logger:     logger,
+		conn:       conn,
+		bufRead:    bufio.NewReader(conn),
+		pings:      make(map[uint32]chan struct{}),
+		streams:    make(map[uint32]*Stream),
+		inflight:   make(map[uint32]struct{}),
+		synCh:      make(chan struct{}, config.AcceptBacklog),
+		acceptCh:   make(chan *Stream, config.AcceptBacklog),
+		sendCh:     make(chan *sendReady, 64),
+		recvDoneCh: make(chan struct{}),
+		sendDoneCh: make(chan struct{}),
+		shutdownCh: make(chan struct{}),
+	}
+	if client {
+		s.nextStreamID = 1
+	} else {
+		s.nextStreamID = 2
+	}
+	go s.recv()
+	go s.send()
+	if config.EnableKeepAlive {
+		go s.keepalive()
+	}
+	return s
+}
+
+// IsClosed does a safe check to see if we have shutdown
+func (s *Session) IsClosed() bool {
+	select {
+	case <-s.shutdownCh:
+		return true
+	default:
+		return false
+	}
+}
+
+// CloseChan returns a read-only channel which is closed as
+// soon as the session is closed.
+func (s *Session) CloseChan() <-chan struct{} {
+	return s.shutdownCh
+}
+
+// NumStreams returns the number of currently open streams
+func (s *Session) NumStreams() int {
+	s.streamLock.Lock()
+	num := len(s.streams)
+	s.streamLock.Unlock()
+	return num
+}
+
+// Open is used to create a new stream as a net.Conn
+func (s *Session) Open() (net.Conn, error) {
+	conn, err := s.OpenStream()
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
+}
+
+// OpenStream is used to create a new stream
+func (s *Session) OpenStream() (*Stream, error) {
+	if s.IsClosed() {
+		return nil, ErrSessionShutdown
+	}
+	if atomic.LoadInt32(&s.remoteGoAway) == 1 {
+		return nil, ErrRemoteGoAway
+	}
+
+	// Block if we have too many inflight SYNs
+	select {
+	case s.synCh <- struct{}{}:
+	case <-s.shutdownCh:
+		return nil, ErrSessionShutdown
+	}
+
+GET_ID:
+	// Get an ID, and check for stream exhaustion
+	id := atomic.LoadUint32(&s.nextStreamID)
+	if id >= math.MaxUint32-1 {
+		return nil, ErrStreamsExhausted
+	}
+	if !atomic.CompareAndSwapUint32(&s.nextStreamID, id, id+2) {
+		goto GET_ID
+	}
+
+	// Register the stream
+	stream := newStream(s, id, streamInit)
+	s.streamLock.Lock()
+	s.streams[id] = stream
+	s.inflight[id] = struct{}{}
+	s.streamLock.Unlock()
+
+	if s.config.StreamOpenTimeout > 0 {
+		go s.setOpenTimeout(stream)
+	}
+
+	// Send the window update to create
+	if err := stream.sendWindowUpdate(); err != nil {
+		select {
+		case <-s.synCh:
+		default:
+			s.logger.Printf("[ERR] yamux: aborted stream open without inflight syn semaphore")
+		}
+		return nil, err
+	}
+	return stream, nil
+}
+
+// setOpenTimeout implements a timeout for streams that are opened but not established.
+// If the StreamOpenTimeout is exceeded we assume the peer is unable to ACK,
+// and close the session.
+// The number of running timers is bounded by the capacity of the synCh.
+func (s *Session) setOpenTimeout(stream *Stream) {
+	timer := time.NewTimer(s.config.StreamOpenTimeout)
+	defer timer.Stop()
+
+	select {
+	case <-stream.establishCh:
+		return
+	case <-s.shutdownCh:
+		return
+	case <-timer.C:
+		// Timeout reached while waiting for ACK.
+		// Close the session to force connection re-establishment.
+		s.logger.Printf("[ERR] yamux: aborted stream open (destination=%s): %v", s.RemoteAddr().String(), ErrTimeout.err)
+		s.Close()
+	}
+}
+
+// Accept is used to block until the next available stream
+// is ready to be accepted.
+func (s *Session) Accept() (net.Conn, error) {
+	conn, err := s.AcceptStream()
+	if err != nil {
+		return nil, err
+	}
+	return conn, err
+}
+
+// AcceptStream is used to block until the next available stream
+// is ready to be accepted.
+func (s *Session) AcceptStream() (*Stream, error) {
+	select {
+	case stream := <-s.acceptCh:
+		if err := stream.sendWindowUpdate(); err != nil {
+			return nil, err
+		}
+		return stream, nil
+	case <-s.shutdownCh:
+		return nil, s.shutdownErr
+	}
+}
+
+// AcceptStream is used to block until the next available stream
+// is ready to be accepted.
+func (s *Session) AcceptStreamWithContext(ctx context.Context) (*Stream, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case stream := <-s.acceptCh:
+		if err := stream.sendWindowUpdate(); err != nil {
+			return nil, err
+		}
+		return stream, nil
+	case <-s.shutdownCh:
+		return nil, s.shutdownErr
+	}
+}
+
+// Close is used to close the session and all streams.
+// Attempts to send a GoAway before closing the connection.
+func (s *Session) Close() error {
+	s.shutdownLock.Lock()
+	defer s.shutdownLock.Unlock()
+
+	if s.shutdown {
+		return nil
+	}
+	s.shutdown = true
+
+	s.shutdownErrLock.Lock()
+	if s.shutdownErr == nil {
+		s.shutdownErr = ErrSessionShutdown
+	}
+	s.shutdownErrLock.Unlock()
+
+	close(s.shutdownCh)
+
+	s.conn.Close()
+	<-s.recvDoneCh
+
+	s.streamLock.Lock()
+	defer s.streamLock.Unlock()
+	for _, stream := range s.streams {
+		stream.forceClose()
+	}
+	<-s.sendDoneCh
+	return nil
+}
+
+// exitErr is used to handle an error that is causing the
+// session to terminate.
+func (s *Session) exitErr(err error) {
+	s.shutdownErrLock.Lock()
+	if s.shutdownErr == nil {
+		s.shutdownErr = err
+	}
+	s.shutdownErrLock.Unlock()
+	s.Close()
+}
+
+// GoAway can be used to prevent accepting further
+// connections. It does not close the underlying conn.
+func (s *Session) GoAway() error {
+	return s.waitForSend(s.goAway(goAwayNormal), nil)
+}
+
+// goAway is used to send a goAway message
+func (s *Session) goAway(reason uint32) header {
+	atomic.SwapInt32(&s.localGoAway, 1)
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typeGoAway, 0, 0, reason)
+	return hdr
+}
+
+// Ping is used to measure the RTT response time
+func (s *Session) Ping() (time.Duration, error) {
+	// Get a channel for the ping
+	ch := make(chan struct{})
+
+	// Get a new ping id, mark as pending
+	s.pingLock.Lock()
+	id := s.pingID
+	s.pingID++
+	s.pings[id] = ch
+	s.pingLock.Unlock()
+
+	// Send the ping request
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typePing, flagSYN, 0, id)
+	if err := s.waitForSend(hdr, nil); err != nil {
+		return 0, err
+	}
+
+	// Wait for a response
+	start := time.Now()
+	select {
+	case <-ch:
+	case <-time.After(s.config.ConnectionWriteTimeout):
+		s.pingLock.Lock()
+		delete(s.pings, id) // Ignore it if a response comes later.
+		s.pingLock.Unlock()
+		return 0, ErrTimeout
+	case <-s.shutdownCh:
+		return 0, ErrSessionShutdown
+	}
+
+	// Compute the RTT
+	return time.Since(start), nil
+}
+
+// keepalive is a long running goroutine that periodically does
+// a ping to keep the connection alive.
+func (s *Session) keepalive() {
+	for {
+		select {
+		case <-time.After(s.config.KeepAliveInterval):
+			_, err := s.Ping()
+			if err != nil {
+				if err != ErrSessionShutdown {
+					s.logger.Printf("[ERR] yamux: keepalive failed: %v", err)
+					s.exitErr(ErrKeepAliveTimeout)
+				}
+				return
+			}
+		case <-s.shutdownCh:
+			return
+		}
+	}
+}
+
+// waitForSendErr waits to send a header, checking for a potential shutdown
+func (s *Session) waitForSend(hdr header, body []byte) error {
+	errCh := make(chan error, 1)
+	return s.waitForSendErr(hdr, body, errCh)
+}
+
+// waitForSendErr waits to send a header with optional data, checking for a
+// potential shutdown. Since there's the expectation that sends can happen
+// in a timely manner, we enforce the connection write timeout here.
+func (s *Session) waitForSendErr(hdr header, body []byte, errCh chan error) error {
+	t := timerPool.Get()
+	timer := t.(*time.Timer)
+	timer.Reset(s.config.ConnectionWriteTimeout)
+	defer func() {
+		timer.Stop()
+		select {
+		case <-timer.C:
+		default:
+		}
+		timerPool.Put(t)
+	}()
+
+	ready := &sendReady{Hdr: hdr, Body: body, Err: errCh}
+	select {
+	case s.sendCh <- ready:
+	case <-s.shutdownCh:
+		return ErrSessionShutdown
+	case <-timer.C:
+		return ErrConnectionWriteTimeout
+	}
+
+	bodyCopy := func() {
+		if body == nil {
+			return // A nil body is ignored.
+		}
+
+		// In the event of session shutdown or connection write timeout,
+		// we need to prevent `send` from reading the body buffer after
+		// returning from this function since the caller may re-use the
+		// underlying array.
+		ready.mu.Lock()
+		defer ready.mu.Unlock()
+
+		if ready.Body == nil {
+			return // Body was already copied in `send`.
+		}
+		newBody := make([]byte, len(body))
+		copy(newBody, body)
+		ready.Body = newBody
+	}
+
+	select {
+	case err := <-errCh:
+		return err
+	case <-s.shutdownCh:
+		bodyCopy()
+		return ErrSessionShutdown
+	case <-timer.C:
+		bodyCopy()
+		return ErrConnectionWriteTimeout
+	}
+}
+
+// sendNoWait does a send without waiting. Since there's the expectation that
+// the send happens right here, we enforce the connection write timeout if we
+// can't queue the header to be sent.
+func (s *Session) sendNoWait(hdr header) error {
+	t := timerPool.Get()
+	timer := t.(*time.Timer)
+	timer.Reset(s.config.ConnectionWriteTimeout)
+	defer func() {
+		timer.Stop()
+		select {
+		case <-timer.C:
+		default:
+		}
+		timerPool.Put(t)
+	}()
+
+	select {
+	case s.sendCh <- &sendReady{Hdr: hdr}:
+		return nil
+	case <-s.shutdownCh:
+		return ErrSessionShutdown
+	case <-timer.C:
+		return ErrConnectionWriteTimeout
+	}
+}
+
+// send is a long running goroutine that sends data
+func (s *Session) send() {
+	if err := s.sendLoop(); err != nil {
+		s.exitErr(err)
+	}
+}
+
+func (s *Session) sendLoop() error {
+	defer close(s.sendDoneCh)
+	var bodyBuf bytes.Buffer
+	for {
+		bodyBuf.Reset()
+
+		select {
+		case ready := <-s.sendCh:
+			// Send a header if ready
+			if ready.Hdr != nil {
+				_, err := s.conn.Write(ready.Hdr)
+				if err != nil {
+					s.logger.Printf("[ERR] yamux: Failed to write header: %v", err)
+					asyncSendErr(ready.Err, err)
+					return err
+				}
+			}
+
+			ready.mu.Lock()
+			if ready.Body != nil {
+				// Copy the body into the buffer to avoid
+				// holding a mutex lock during the write.
+				_, err := bodyBuf.Write(ready.Body)
+				if err != nil {
+					ready.Body = nil
+					ready.mu.Unlock()
+					s.logger.Printf("[ERR] yamux: Failed to copy body into buffer: %v", err)
+					asyncSendErr(ready.Err, err)
+					return err
+				}
+				ready.Body = nil
+			}
+			ready.mu.Unlock()
+
+			if bodyBuf.Len() > 0 {
+				// Send data from a body if given
+				_, err := s.conn.Write(bodyBuf.Bytes())
+				if err != nil {
+					s.logger.Printf("[ERR] yamux: Failed to write body: %v", err)
+					asyncSendErr(ready.Err, err)
+					return err
+				}
+			}
+
+			// No error, successful send
+			asyncSendErr(ready.Err, nil)
+		case <-s.shutdownCh:
+			return nil
+		}
+	}
+}
+
+// recv is a long running goroutine that accepts new data
+func (s *Session) recv() {
+	if err := s.recvLoop(); err != nil {
+		s.exitErr(err)
+	}
+}
+
+// Ensure that the index of the handler (typeData/typeWindowUpdate/etc) matches the message type
+var (
+	handlers = []func(*Session, header) error{
+		typeData:         (*Session).handleStreamMessage,
+		typeWindowUpdate: (*Session).handleStreamMessage,
+		typePing:         (*Session).handlePing,
+		typeGoAway:       (*Session).handleGoAway,
+	}
+)
+
+// recvLoop continues to receive data until a fatal error is encountered
+func (s *Session) recvLoop() error {
+	defer close(s.recvDoneCh)
+	hdr := header(make([]byte, headerSize))
+	for {
+		// Read the header
+		if _, err := io.ReadFull(s.bufRead, hdr); err != nil {
+			if err != io.EOF && !strings.Contains(err.Error(), "closed") && !strings.Contains(err.Error(), "reset by peer") {
+				s.logger.Printf("[ERR] yamux: Failed to read header: %v", err)
+			}
+			return err
+		}
+
+		// Verify the version
+		if hdr.Version() != protoVersion {
+			s.logger.Printf("[ERR] yamux: Invalid protocol version: %d", hdr.Version())
+			return ErrInvalidVersion
+		}
+
+		mt := hdr.MsgType()
+		if mt < typeData || mt > typeGoAway {
+			return ErrInvalidMsgType
+		}
+
+		if err := handlers[mt](s, hdr); err != nil {
+			return err
+		}
+	}
+}
+
+// handleStreamMessage handles either a data or window update frame
+func (s *Session) handleStreamMessage(hdr header) error {
+	// Check for a new stream creation
+	id := hdr.StreamID()
+	flags := hdr.Flags()
+	if flags&flagSYN == flagSYN {
+		if err := s.incomingStream(id); err != nil {
+			return err
+		}
+	}
+
+	// Get the stream
+	s.streamLock.Lock()
+	stream := s.streams[id]
+	s.streamLock.Unlock()
+
+	// If we do not have a stream, likely we sent a RST
+	if stream == nil {
+		// Drain any data on the wire
+		if hdr.MsgType() == typeData && hdr.Length() > 0 {
+			s.logger.Printf("[WARN] yamux: Discarding data for stream: %d", id)
+			if _, err := io.CopyN(ioutil.Discard, s.bufRead, int64(hdr.Length())); err != nil {
+				s.logger.Printf("[ERR] yamux: Failed to discard data: %v", err)
+				return nil
+			}
+		} else {
+			s.logger.Printf("[WARN] yamux: frame for missing stream: %v", hdr)
+		}
+		return nil
+	}
+
+	// Check if this is a window update
+	if hdr.MsgType() == typeWindowUpdate {
+		if err := stream.incrSendWindow(hdr, flags); err != nil {
+			if sendErr := s.sendNoWait(s.goAway(goAwayProtoErr)); sendErr != nil {
+				s.logger.Printf("[WARN] yamux: failed to send go away: %v", sendErr)
+			}
+			return err
+		}
+		return nil
+	}
+
+	// Read the new data
+	if err := stream.readData(hdr, flags, s.bufRead); err != nil {
+		if sendErr := s.sendNoWait(s.goAway(goAwayProtoErr)); sendErr != nil {
+			s.logger.Printf("[WARN] yamux: failed to send go away: %v", sendErr)
+		}
+		return err
+	}
+	return nil
+}
+
+// handlePing is invokde for a typePing frame
+func (s *Session) handlePing(hdr header) error {
+	flags := hdr.Flags()
+	pingID := hdr.Length()
+
+	// Check if this is a query, respond back in a separate context so we
+	// don't interfere with the receiving thread blocking for the write.
+	if flags&flagSYN == flagSYN {
+		go func() {
+			hdr := header(make([]byte, headerSize))
+			hdr.encode(typePing, flagACK, 0, pingID)
+			if err := s.sendNoWait(hdr); err != nil {
+				s.logger.Printf("[WARN] yamux: failed to send ping reply: %v", err)
+			}
+		}()
+		return nil
+	}
+
+	// Handle a response
+	s.pingLock.Lock()
+	ch := s.pings[pingID]
+	if ch != nil {
+		delete(s.pings, pingID)
+		close(ch)
+	}
+	s.pingLock.Unlock()
+	return nil
+}
+
+// handleGoAway is invokde for a typeGoAway frame
+func (s *Session) handleGoAway(hdr header) error {
+	code := hdr.Length()
+	switch code {
+	case goAwayNormal:
+		atomic.SwapInt32(&s.remoteGoAway, 1)
+	case goAwayProtoErr:
+		s.logger.Printf("[ERR] yamux: received protocol error go away")
+		return fmt.Errorf("yamux protocol error")
+	case goAwayInternalErr:
+		s.logger.Printf("[ERR] yamux: received internal error go away")
+		return fmt.Errorf("remote yamux internal error")
+	default:
+		s.logger.Printf("[ERR] yamux: received unexpected go away")
+		return fmt.Errorf("unexpected go away received")
+	}
+	return nil
+}
+
+// incomingStream is used to create a new incoming stream
+func (s *Session) incomingStream(id uint32) error {
+	// Reject immediately if we are doing a go away
+	if atomic.LoadInt32(&s.localGoAway) == 1 {
+		hdr := header(make([]byte, headerSize))
+		hdr.encode(typeWindowUpdate, flagRST, id, 0)
+		return s.sendNoWait(hdr)
+	}
+
+	// Allocate a new stream
+	stream := newStream(s, id, streamSYNReceived)
+
+	s.streamLock.Lock()
+	defer s.streamLock.Unlock()
+
+	// Check if stream already exists
+	if _, ok := s.streams[id]; ok {
+		s.logger.Printf("[ERR] yamux: duplicate stream declared")
+		if sendErr := s.sendNoWait(s.goAway(goAwayProtoErr)); sendErr != nil {
+			s.logger.Printf("[WARN] yamux: failed to send go away: %v", sendErr)
+		}
+		return ErrDuplicateStream
+	}
+
+	// Register the stream
+	s.streams[id] = stream
+
+	// Check if we've exceeded the backlog
+	select {
+	case s.acceptCh <- stream:
+		return nil
+	default:
+		// Backlog exceeded! RST the stream
+		s.logger.Printf("[WARN] yamux: backlog exceeded, forcing connection reset")
+		delete(s.streams, id)
+		hdr := header(make([]byte, headerSize))
+		hdr.encode(typeWindowUpdate, flagRST, id, 0)
+		return s.sendNoWait(hdr)
+	}
+}
+
+// closeStream is used to close a stream once both sides have
+// issued a close. If there was an in-flight SYN and the stream
+// was not yet established, then this will give the credit back.
+func (s *Session) closeStream(id uint32) {
+	s.streamLock.Lock()
+	if _, ok := s.inflight[id]; ok {
+		select {
+		case <-s.synCh:
+		default:
+			s.logger.Printf("[ERR] yamux: SYN tracking out of sync")
+		}
+	}
+	delete(s.streams, id)
+	s.streamLock.Unlock()
+}
+
+// establishStream is used to mark a stream that was in the
+// SYN Sent state as established.
+func (s *Session) establishStream(id uint32) {
+	s.streamLock.Lock()
+	if _, ok := s.inflight[id]; ok {
+		delete(s.inflight, id)
+	} else {
+		s.logger.Printf("[ERR] yamux: established stream without inflight SYN (no tracking entry)")
+	}
+	select {
+	case <-s.synCh:
+	default:
+		s.logger.Printf("[ERR] yamux: established stream without inflight SYN (didn't have semaphore)")
+	}
+	s.streamLock.Unlock()
+}

vendor/github.com/hashicorp/yamux/spec.md

@@ -0,0 +1,140 @@
+# Specification
+
+We use this document to detail the internal specification of Yamux.
+This is used both as a guide for implementing Yamux, but also for
+alternative interoperable libraries to be built.
+
+# Framing
+
+Yamux uses a streaming connection underneath, but imposes a message
+framing so that it can be shared between many logical streams. Each
+frame contains a header like:
+
+* Version (8 bits)
+* Type (8 bits)
+* Flags (16 bits)
+* StreamID (32 bits)
+* Length (32 bits)
+
+This means that each header has a 12 byte overhead.
+All fields are encoded in network order (big endian).
+Each field is described below:
+
+## Version Field
+
+The version field is used for future backward compatibility. At the
+current time, the field is always set to 0, to indicate the initial
+version.
+
+## Type Field
+
+The type field is used to switch the frame message type. The following
+message types are supported:
+
+* 0x0 Data - Used to transmit data. May transmit zero length payloads
+  depending on the flags.
+
+* 0x1 Window Update - Used to updated the senders receive window size.
+  This is used to implement per-session flow control.
+
+* 0x2 Ping - Used to measure RTT. It can also be used to heart-beat
+  and do keep-alives over TCP.
+
+* 0x3 Go Away - Used to close a session.
+
+## Flag Field
+
+The flags field is used to provide additional information related
+to the message type. The following flags are supported:
+
+* 0x1 SYN - Signals the start of a new stream. May be sent with a data or
+  window update message. Also sent with a ping to indicate outbound.
+
+* 0x2 ACK - Acknowledges the start of a new stream. May be sent with a data
+  or window update message. Also sent with a ping to indicate response.
+
+* 0x4 FIN - Performs a half-close of a stream. May be sent with a data
+  message or window update.
+
+* 0x8 RST - Reset a stream immediately. May be sent with a data or
+  window update message.
+
+## StreamID Field
+
+The StreamID field is used to identify the logical stream the frame
+is addressing. The client side should use odd ID's, and the server even.
+This prevents any collisions. Additionally, the 0 ID is reserved to represent
+the session.
+
+Both Ping and Go Away messages should always use the 0 StreamID.
+
+## Length Field
+
+The meaning of the length field depends on the message type:
+
+* Data - provides the length of bytes following the header
+* Window update - provides a delta update to the window size
+* Ping - Contains an opaque value, echoed back
+* Go Away - Contains an error code
+
+# Message Flow
+
+There is no explicit connection setup, as Yamux relies on an underlying
+transport to be provided. However, there is a distinction between client
+and server side of the connection.
+
+## Opening a stream
+
+To open a stream, an initial data or window update frame is sent
+with a new StreamID. The SYN flag should be set to signal a new stream.
+
+The receiver must then reply with either a data or window update frame
+with the StreamID along with the ACK flag to accept the stream or with
+the RST flag to reject the stream.
+
+Because we are relying on the reliable stream underneath, a connection
+can begin sending data once the SYN flag is sent. The corresponding
+ACK does not need to be received. This is particularly well suited
+for an RPC system where a client wants to open a stream and immediately
+fire a request without waiting for the RTT of the ACK.
+
+This does introduce the possibility of a connection being rejected
+after data has been sent already. This is a slight semantic difference
+from TCP, where the connection cannot be refused after it is opened.
+Clients should be prepared to handle this by checking for an error
+that indicates a RST was received.
+
+## Closing a stream
+
+To close a stream, either side sends a data or window update frame
+along with the FIN flag. This does a half-close indicating the sender
+will send no further data.
+
+Once both sides have closed the connection, the stream is closed.
+
+Alternatively, if an error occurs, the RST flag can be used to
+hard close a stream immediately.
+
+## Flow Control
+
+When Yamux is initially starts each stream with a 256KB window size.
+There is no window size for the session.
+
+To prevent the streams from stalling, window update frames should be
+sent regularly. Yamux can be configured to provide a larger limit for
+windows sizes. Both sides assume the initial 256KB window, but can
+immediately send a window update as part of the SYN/ACK indicating a
+larger window.
+
+Both sides should track the number of bytes sent in Data frames
+only, as only they are tracked as part of the window size.
+
+## Session termination
+
+When a session is being terminated, the Go Away message should
+be sent. The Length should be set to one of the following to
+provide an error code:
+
+* 0x0 Normal termination
+* 0x1 Protocol error
+* 0x2 Internal error

vendor/github.com/hashicorp/yamux/stream.go

@@ -0,0 +1,556 @@
+package yamux
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+type streamState int
+
+const (
+	streamInit streamState = iota
+	streamSYNSent
+	streamSYNReceived
+	streamEstablished
+	streamLocalClose
+	streamRemoteClose
+	streamClosed
+	streamReset
+)
+
+// Stream is used to represent a logical stream
+// within a session.
+type Stream struct {
+	recvWindow uint32
+	sendWindow uint32
+
+	id      uint32
+	session *Session
+
+	state     streamState
+	stateLock sync.Mutex
+
+	recvBuf  *bytes.Buffer
+	recvLock sync.Mutex
+
+	controlHdr     header
+	controlErr     chan error
+	controlHdrLock sync.Mutex
+
+	sendHdr  header
+	sendErr  chan error
+	sendLock sync.Mutex
+
+	recvNotifyCh chan struct{}
+	sendNotifyCh chan struct{}
+
+	readDeadline  atomic.Value // time.Time
+	writeDeadline atomic.Value // time.Time
+
+	// establishCh is notified if the stream is established or being closed.
+	establishCh chan struct{}
+
+	// closeTimer is set with stateLock held to honor the StreamCloseTimeout
+	// setting on Session.
+	closeTimer *time.Timer
+}
+
+// newStream is used to construct a new stream within
+// a given session for an ID
+func newStream(session *Session, id uint32, state streamState) *Stream {
+	s := &Stream{
+		id:           id,
+		session:      session,
+		state:        state,
+		controlHdr:   header(make([]byte, headerSize)),
+		controlErr:   make(chan error, 1),
+		sendHdr:      header(make([]byte, headerSize)),
+		sendErr:      make(chan error, 1),
+		recvWindow:   initialStreamWindow,
+		sendWindow:   initialStreamWindow,
+		recvNotifyCh: make(chan struct{}, 1),
+		sendNotifyCh: make(chan struct{}, 1),
+		establishCh:  make(chan struct{}, 1),
+	}
+	s.readDeadline.Store(time.Time{})
+	s.writeDeadline.Store(time.Time{})
+	return s
+}
+
+// Session returns the associated stream session
+func (s *Stream) Session() *Session {
+	return s.session
+}
+
+// StreamID returns the ID of this stream
+func (s *Stream) StreamID() uint32 {
+	return s.id
+}
+
+// Read is used to read from the stream
+func (s *Stream) Read(b []byte) (n int, err error) {
+	defer asyncNotify(s.recvNotifyCh)
+START:
+
+	// If the stream is closed and there's no data buffered, return EOF
+	s.stateLock.Lock()
+	switch s.state {
+	case streamLocalClose:
+		// LocalClose only prohibits further local writes. Handle reads normally.
+	case streamRemoteClose:
+		fallthrough
+	case streamClosed:
+		s.recvLock.Lock()
+		if s.recvBuf == nil || s.recvBuf.Len() == 0 {
+			s.recvLock.Unlock()
+			s.stateLock.Unlock()
+			return 0, io.EOF
+		}
+		s.recvLock.Unlock()
+	case streamReset:
+		s.stateLock.Unlock()
+		return 0, ErrConnectionReset
+	}
+	s.stateLock.Unlock()
+
+	// If there is no data available, block
+	s.recvLock.Lock()
+	if s.recvBuf == nil || s.recvBuf.Len() == 0 {
+		s.recvLock.Unlock()
+		goto WAIT
+	}
+
+	// Read any bytes
+	n, _ = s.recvBuf.Read(b)
+	s.recvLock.Unlock()
+
+	// Send a window update potentially
+	err = s.sendWindowUpdate()
+	if err == ErrSessionShutdown {
+		err = nil
+	}
+	return n, err
+
+WAIT:
+	var timeout <-chan time.Time
+	var timer *time.Timer
+	readDeadline := s.readDeadline.Load().(time.Time)
+	if !readDeadline.IsZero() {
+		delay := time.Until(readDeadline)
+		timer = time.NewTimer(delay)
+		timeout = timer.C
+	}
+	select {
+	case <-s.session.shutdownCh:
+	case <-s.recvNotifyCh:
+	case <-timeout:
+		return 0, ErrTimeout
+	}
+	if timer != nil {
+		if !timer.Stop() {
+			<-timeout
+		}
+	}
+	goto START
+}
+
+// Write is used to write to the stream
+func (s *Stream) Write(b []byte) (n int, err error) {
+	s.sendLock.Lock()
+	defer s.sendLock.Unlock()
+	total := 0
+	for total < len(b) {
+		n, err := s.write(b[total:])
+		total += n
+		if err != nil {
+			return total, err
+		}
+	}
+	return total, nil
+}
+
+// write is used to write to the stream, may return on
+// a short write.
+func (s *Stream) write(b []byte) (n int, err error) {
+	var flags uint16
+	var max uint32
+	var body []byte
+START:
+	s.stateLock.Lock()
+	switch s.state {
+	case streamLocalClose:
+		fallthrough
+	case streamClosed:
+		s.stateLock.Unlock()
+		return 0, ErrStreamClosed
+	case streamReset:
+		s.stateLock.Unlock()
+		return 0, ErrConnectionReset
+	}
+	s.stateLock.Unlock()
+
+	// If there is no data available, block
+	window := atomic.LoadUint32(&s.sendWindow)
+	if window == 0 {
+		goto WAIT
+	}
+
+	// Determine the flags if any
+	flags = s.sendFlags()
+
+	// Send up to our send window
+	max = min(window, uint32(len(b)))
+	body = b[:max]
+
+	// Send the header
+	s.sendHdr.encode(typeData, flags, s.id, max)
+	if err = s.session.waitForSendErr(s.sendHdr, body, s.sendErr); err != nil {
+		if errors.Is(err, ErrSessionShutdown) || errors.Is(err, ErrConnectionWriteTimeout) {
+			// Message left in ready queue, header re-use is unsafe.
+			s.sendHdr = header(make([]byte, headerSize))
+		}
+		return 0, err
+	}
+
+	// Reduce our send window
+	atomic.AddUint32(&s.sendWindow, ^uint32(max-1))
+
+	// Unlock
+	return int(max), err
+
+WAIT:
+	var timeout <-chan time.Time
+	var timer *time.Timer
+	writeDeadline := s.writeDeadline.Load().(time.Time)
+	if !writeDeadline.IsZero() {
+		delay := time.Until(writeDeadline)
+		timer = time.NewTimer(delay)
+		timeout = timer.C
+	}
+	select {
+	case <-s.session.shutdownCh:
+	case <-s.sendNotifyCh:
+	case <-timeout:
+		return 0, ErrTimeout
+	}
+	if timer != nil {
+		if !timer.Stop() {
+			<-timeout
+		}
+	}
+	goto START
+}
+
+// sendFlags determines any flags that are appropriate
+// based on the current stream state
+func (s *Stream) sendFlags() uint16 {
+	s.stateLock.Lock()
+	defer s.stateLock.Unlock()
+	var flags uint16
+	switch s.state {
+	case streamInit:
+		flags |= flagSYN
+		s.state = streamSYNSent
+	case streamSYNReceived:
+		flags |= flagACK
+		s.state = streamEstablished
+	}
+	return flags
+}
+
+// sendWindowUpdate potentially sends a window update enabling
+// further writes to take place. Must be invoked with the lock.
+func (s *Stream) sendWindowUpdate() error {
+	s.controlHdrLock.Lock()
+	defer s.controlHdrLock.Unlock()
+
+	// Determine the delta update
+	max := s.session.config.MaxStreamWindowSize
+	var bufLen uint32
+	s.recvLock.Lock()
+	if s.recvBuf != nil {
+		bufLen = uint32(s.recvBuf.Len())
+	}
+	delta := (max - bufLen) - s.recvWindow
+
+	// Determine the flags if any
+	flags := s.sendFlags()
+
+	// Check if we can omit the update
+	if delta < (max/2) && flags == 0 {
+		s.recvLock.Unlock()
+		return nil
+	}
+
+	// Update our window
+	s.recvWindow += delta
+	s.recvLock.Unlock()
+
+	// Send the header
+	s.controlHdr.encode(typeWindowUpdate, flags, s.id, delta)
+	if err := s.session.waitForSendErr(s.controlHdr, nil, s.controlErr); err != nil {
+		if errors.Is(err, ErrSessionShutdown) || errors.Is(err, ErrConnectionWriteTimeout) {
+			// Message left in ready queue, header re-use is unsafe.
+			s.controlHdr = header(make([]byte, headerSize))
+		}
+		return err
+	}
+	return nil
+}
+
+// sendClose is used to send a FIN
+func (s *Stream) sendClose() error {
+	s.controlHdrLock.Lock()
+	defer s.controlHdrLock.Unlock()
+
+	flags := s.sendFlags()
+	flags |= flagFIN
+	s.controlHdr.encode(typeWindowUpdate, flags, s.id, 0)
+	if err := s.session.waitForSendErr(s.controlHdr, nil, s.controlErr); err != nil {
+		if errors.Is(err, ErrSessionShutdown) || errors.Is(err, ErrConnectionWriteTimeout) {
+			// Message left in ready queue, header re-use is unsafe.
+			s.controlHdr = header(make([]byte, headerSize))
+		}
+		return err
+	}
+	return nil
+}
+
+// Close is used to close the stream
+func (s *Stream) Close() error {
+	closeStream := false
+	s.stateLock.Lock()
+	switch s.state {
+	// Opened means we need to signal a close
+	case streamSYNSent:
+		fallthrough
+	case streamSYNReceived:
+		fallthrough
+	case streamEstablished:
+		s.state = streamLocalClose
+		goto SEND_CLOSE
+
+	case streamLocalClose:
+	case streamRemoteClose:
+		s.state = streamClosed
+		closeStream = true
+		goto SEND_CLOSE
+
+	case streamClosed:
+	case streamReset:
+	default:
+		panic("unhandled state")
+	}
+	s.stateLock.Unlock()
+	return nil
+SEND_CLOSE:
+	// This shouldn't happen (the more realistic scenario to cancel the
+	// timer is via processFlags) but just in case this ever happens, we
+	// cancel the timer to prevent dangling timers.
+	if s.closeTimer != nil {
+		s.closeTimer.Stop()
+		s.closeTimer = nil
+	}
+
+	// If we have a StreamCloseTimeout set we start the timeout timer.
+	// We do this only if we're not already closing the stream since that
+	// means this was a graceful close.
+	//
+	// This prevents memory leaks if one side (this side) closes and the
+	// remote side poorly behaves and never responds with a FIN to complete
+	// the close. After the specified timeout, we clean our resources up no
+	// matter what.
+	if !closeStream && s.session.config.StreamCloseTimeout > 0 {
+		s.closeTimer = time.AfterFunc(
+			s.session.config.StreamCloseTimeout, s.closeTimeout)
+	}
+
+	s.stateLock.Unlock()
+	s.sendClose()
+	s.notifyWaiting()
+	if closeStream {
+		s.session.closeStream(s.id)
+	}
+	return nil
+}
+
+// closeTimeout is called after StreamCloseTimeout during a close to
+// close this stream.
+func (s *Stream) closeTimeout() {
+	// Close our side forcibly
+	s.forceClose()
+
+	// Free the stream from the session map
+	s.session.closeStream(s.id)
+
+	// Send a RST so the remote side closes too.
+	s.sendLock.Lock()
+	defer s.sendLock.Unlock()
+	hdr := header(make([]byte, headerSize))
+	hdr.encode(typeWindowUpdate, flagRST, s.id, 0)
+	_ = s.session.sendNoWait(hdr)
+}
+
+// forceClose is used for when the session is exiting
+func (s *Stream) forceClose() {
+	s.stateLock.Lock()
+	s.state = streamClosed
+	s.stateLock.Unlock()
+	s.notifyWaiting()
+}
+
+// processFlags is used to update the state of the stream
+// based on set flags, if any. Lock must be held
+func (s *Stream) processFlags(flags uint16) error {
+	s.stateLock.Lock()
+	defer s.stateLock.Unlock()
+
+	// Close the stream without holding the state lock
+	closeStream := false
+	defer func() {
+		if closeStream {
+			if s.closeTimer != nil {
+				// Stop our close timeout timer since we gracefully closed
+				s.closeTimer.Stop()
+			}
+
+			s.session.closeStream(s.id)
+		}
+	}()
+
+	if flags&flagACK == flagACK {
+		if s.state == streamSYNSent {
+			s.state = streamEstablished
+		}
+		asyncNotify(s.establishCh)
+		s.session.establishStream(s.id)
+	}
+	if flags&flagFIN == flagFIN {
+		switch s.state {
+		case streamSYNSent:
+			fallthrough
+		case streamSYNReceived:
+			fallthrough
+		case streamEstablished:
+			s.state = streamRemoteClose
+			s.notifyWaiting()
+		case streamLocalClose:
+			s.state = streamClosed
+			closeStream = true
+			s.notifyWaiting()
+		default:
+			s.session.logger.Printf("[ERR] yamux: unexpected FIN flag in state %d", s.state)
+			return ErrUnexpectedFlag
+		}
+	}
+	if flags&flagRST == flagRST {
+		s.state = streamReset
+		closeStream = true
+		s.notifyWaiting()
+	}
+	return nil
+}
+
+// notifyWaiting notifies all the waiting channels
+func (s *Stream) notifyWaiting() {
+	asyncNotify(s.recvNotifyCh)
+	asyncNotify(s.sendNotifyCh)
+	asyncNotify(s.establishCh)
+}
+
+// incrSendWindow updates the size of our send window
+func (s *Stream) incrSendWindow(hdr header, flags uint16) error {
+	if err := s.processFlags(flags); err != nil {
+		return err
+	}
+
+	// Increase window, unblock a sender
+	atomic.AddUint32(&s.sendWindow, hdr.Length())
+	asyncNotify(s.sendNotifyCh)
+	return nil
+}
+
+// readData is used to handle a data frame
+func (s *Stream) readData(hdr header, flags uint16, conn io.Reader) error {
+	if err := s.processFlags(flags); err != nil {
+		return err
+	}
+
+	// Check that our recv window is not exceeded
+	length := hdr.Length()
+	if length == 0 {
+		return nil
+	}
+
+	// Wrap in a limited reader
+	conn = &io.LimitedReader{R: conn, N: int64(length)}
+
+	// Copy into buffer
+	s.recvLock.Lock()
+
+	if length > s.recvWindow {
+		s.session.logger.Printf("[ERR] yamux: receive window exceeded (stream: %d, remain: %d, recv: %d)", s.id, s.recvWindow, length)
+		s.recvLock.Unlock()
+		return ErrRecvWindowExceeded
+	}
+
+	if s.recvBuf == nil {
+		// Allocate the receive buffer just-in-time to fit the full data frame.
+		// This way we can read in the whole packet without further allocations.
+		s.recvBuf = bytes.NewBuffer(make([]byte, 0, length))
+	}
+	copiedLength, err := io.Copy(s.recvBuf, conn)
+	if err != nil {
+		s.session.logger.Printf("[ERR] yamux: Failed to read stream data: %v", err)
+		s.recvLock.Unlock()
+		return err
+	}
+
+	// Decrement the receive window
+	s.recvWindow -= uint32(copiedLength)
+	s.recvLock.Unlock()
+
+	// Unblock any readers
+	asyncNotify(s.recvNotifyCh)
+	return nil
+}
+
+// SetDeadline sets the read and write deadlines
+func (s *Stream) SetDeadline(t time.Time) error {
+	if err := s.SetReadDeadline(t); err != nil {
+		return err
+	}
+	if err := s.SetWriteDeadline(t); err != nil {
+		return err
+	}
+	return nil
+}
+
+// SetReadDeadline sets the deadline for blocked and future Read calls.
+func (s *Stream) SetReadDeadline(t time.Time) error {
+	s.readDeadline.Store(t)
+	asyncNotify(s.recvNotifyCh)
+	return nil
+}
+
+// SetWriteDeadline sets the deadline for blocked and future Write calls
+func (s *Stream) SetWriteDeadline(t time.Time) error {
+	s.writeDeadline.Store(t)
+	asyncNotify(s.sendNotifyCh)
+	return nil
+}
+
+// Shrink is used to compact the amount of buffers utilized
+// This is useful when using Yamux in a connection pool to reduce
+// the idle memory utilization.
+func (s *Stream) Shrink() {
+	s.recvLock.Lock()
+	if s.recvBuf != nil && s.recvBuf.Len() == 0 {
+		s.recvBuf = nil
+	}
+	s.recvLock.Unlock()
+}

vendor/github.com/hashicorp/yamux/testdata/README.md

@@ -0,0 +1,7 @@
+Test certificates generated with:
+
+```
+go run $(go env GOROOT)/src/crypto/tls/generate_cert.go --host example.com
+```
+
+Requires a bash-like shell and Go installed.

vendor/github.com/hashicorp/yamux/testdata/cert.pem

@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC/DCCAeSgAwIBAgIRAI8YOah8fp9JcV8YbON8488wDQYJKoZIhvcNAQELBQAw
+EjEQMA4GA1UEChMHQWNtZSBDbzAeFw0yNDA4MTQyMzE0MTJaFw0yNTA4MTQyMzE0
+MTJaMBIxEDAOBgNVBAoTB0FjbWUgQ28wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
+ggEKAoIBAQC5cvLaZRsKScA/JBgIlXTs3uJj7KLOLwGuRxk3sUQ7aREoqlC1bGR8
+wN5mYu9Yso6dEOWJBSXybtSpH60AtGnepAKAra4IDNfLbNmWi+13lyqD/BgIpWoP
+Lww6MDHLxNP1+U4hQ2mcOw/hueaSMUahXhjTTTVHq+cLQ9eBxk7b/mcxzHLS6he+
+0zS2QsQ7p/R5RN5QTALZNoHTgXh7Wou/ynmCHNVzaAOdGIvDTSi6fBdqNgvWrY0w
+WcZePVcTiZ2y/4TKEugXqu6RdO1C3rtAFEWCn9q+RyNl0MCcbxo+n3xljy9y3HTW
+0qdpYg2wZJKuRBRlsr0D72pEg+OTd4gNAgMBAAGjTTBLMA4GA1UdDwEB/wQEAwIF
+oDATBgNVHSUEDDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMBYGA1UdEQQPMA2C
+C2V4YW1wbGUuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBvjm0Y6uS285qhh9Ae/4+f
+/nc9KVECHCt0w4CAVmkoCULncOLPnfDRgfn0S2jveBeD/1916egnRljYdqHaE/1G
+/DHo3b45uC77dCGZzCKl7GC50GOUdirHxNiS99xCPM2rWmoada+v5Oe3kcCBXlJ4
+KeDffE7EGo8ACzO5ziKMbR8oThaFrOXIPtUYUFInURbu9VKfRzkLzXNGBZ1WgVZ6
+i9McZImuKnKLZJ1e3SlX3PcZwoBYbumaIG1XFx0K4FCO+QsZNOtLPIzA+aVdtFii
+f5nn4CxXJ/SGhwnjbJE4lS7vH0JlzVIX5rHEYB4jL8d7TApXVgJ0L/0wgFvQ0bCv
+-----END CERTIFICATE-----

vendor/github.com/hashicorp/yamux/testdata/key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC5cvLaZRsKScA/
+JBgIlXTs3uJj7KLOLwGuRxk3sUQ7aREoqlC1bGR8wN5mYu9Yso6dEOWJBSXybtSp
+H60AtGnepAKAra4IDNfLbNmWi+13lyqD/BgIpWoPLww6MDHLxNP1+U4hQ2mcOw/h
+ueaSMUahXhjTTTVHq+cLQ9eBxk7b/mcxzHLS6he+0zS2QsQ7p/R5RN5QTALZNoHT
+gXh7Wou/ynmCHNVzaAOdGIvDTSi6fBdqNgvWrY0wWcZePVcTiZ2y/4TKEugXqu6R
+dO1C3rtAFEWCn9q+RyNl0MCcbxo+n3xljy9y3HTW0qdpYg2wZJKuRBRlsr0D72pE
+g+OTd4gNAgMBAAECggEAdVXvppM2KqpDQzAZLMUzt/PGFidRU1eWnqhJol08qMJv
+ouUwL7onUm/Nx8ZtXheL+IEKWkmxmtTZJTDvi3SbT81B8Bzz8g/+Ma3rdj+Ovo4c
+zmmg40eV9Yl1GRQJTb55xjY5Yv5+QeV0xQOUiYc4Az3AQ2GkhnaTtyLzph7NIo+d
+n4jiNJIlCP2wO3hyIaIVtQXyoGAwNWHTrJsShGaNi9C32SEqzSzuNF94lnGJ4U9M
+7yLl1GD+uhz6V0q3eY8CHK6g8HOaj1ukMlIz+qZdsY252qpEgmY21kvoUJ9Awjjn
+3dAtR7aX+YFtMdAD8rCPHS00lmSlGOEMcg8m07EHmQKBgQDEyHIKvls9RGRfbMbR
++GQ0HyQu2ACbHu6sc8baZZpr9h0pQJOObvPhVWkTcMpVZqlfJZ3X08WHhBBmTZkQ
+F4K1nAs+Ps7U04cBDph3eGGfe+roQSVcVARmTq4is1SOQMtSpnKyRMS1HLFp9sR0
+03m9a43pmnkT45m/BxFp6kCMxwKBgQDxQV5yH0YBfT5i8T63vDs/f9nvxgRODC5d
+0rdgJBd1R4VPTmI5Cbcfa3IY4H5nMgh90x9T7xu209ywp75TYS/Q119eElTcj5tX
+xhDitw052F2ZA90nuCsyXQq+01zLeRuhMQQx3HbmgoVDNNJJBRfERakhM8z4FDVi
+a5FDrDQoiwKBgBZg6T85iKy+A2Aqwa2NPvACfp3pKKB7cw8fl4Ssu1P9yDExy9YN
+3iRJD0sLr6bopuhQIdQynCseJLNNrdN7qPy4QzsP73ualqbTHxmvEgMOF5fUGMiY
+MWvlFL6TgFExIy5CCZcmZOxn1/FCA/N5PUYCXkArtgtB/fEQf7V402BvAoGBAN3g
+oazRaD/cYLD8cBLo0ZCf0955veHNwCLXtYB9EPnycf8y9pDAh6Mk3QVWCcp8sGSP
+82LtKA7oIDJzw03JtwEZ4oKQ120VwediqIrpkQdfHw2oCRALh+bEvSotF02mryt6
++gGlYdCzvz3E6ZTwUyBWdKqtileptkMy7KFRUZLrAoGAVHMhb1CJWIHLOSNWBHU3
+U0Aq9kY3sK/iECKRa0e7qe8gK/hSm61q3RyyYsrrsp8nyPhuvvoJ61AyD9sf4bWn
+4lQalf69PpfdM3Kr9wgu3B8UG15RYAgu9mEp4f5ys/lB0kdcoNhXHm/omuEI7xho
+0TzPD2rJfUl/Jce1oLGoPL8=
+-----END PRIVATE KEY-----

vendor/github.com/hashicorp/yamux/util.go

@@ -0,0 +1,50 @@
+package yamux
+
+import (
+	"sync"
+	"time"
+)
+
+// Logger is a abstract of *log.Logger
+type Logger interface {
+	Print(v ...interface{})
+	Printf(format string, v ...interface{})
+	Println(v ...interface{})
+}
+
+var (
+	timerPool = &sync.Pool{
+		New: func() interface{} {
+			timer := time.NewTimer(time.Hour * 1e6)
+			timer.Stop()
+			return timer
+		},
+	}
+)
+
+// asyncSendErr is used to try an async send of an error
+func asyncSendErr(ch chan error, err error) {
+	if ch == nil {
+		return
+	}
+	select {
+	case ch <- err:
+	default:
+	}
+}
+
+// asyncNotify is used to signal a waiting goroutine
+func asyncNotify(ch chan struct{}) {
+	select {
+	case ch <- struct{}{}:
+	default:
+	}
+}
+
+// min computes the minimum of two values
+func min(a, b uint32) uint32 {
+	if a < b {
+		return a
+	}
+	return b
+}

vendor/github.com/hashicorp/yamux/util_test.go

@@ -0,0 +1,50 @@
+package yamux
+
+import (
+	"testing"
+)
+
+func TestAsyncSendErr(t *testing.T) {
+	ch := make(chan error)
+	asyncSendErr(ch, ErrTimeout)
+	select {
+	case <-ch:
+		t.Fatalf("should not get")
+	default:
+	}
+
+	ch = make(chan error, 1)
+	asyncSendErr(ch, ErrTimeout)
+	select {
+	case <-ch:
+	default:
+		t.Fatalf("should get")
+	}
+}
+
+func TestAsyncNotify(t *testing.T) {
+	ch := make(chan struct{})
+	asyncNotify(ch)
+	select {
+	case <-ch:
+		t.Fatalf("should not get")
+	default:
+	}
+
+	ch = make(chan struct{}, 1)
+	asyncNotify(ch)
+	select {
+	case <-ch:
+	default:
+		t.Fatalf("should get")
+	}
+}
+
+func TestMin(t *testing.T) {
+	if min(1, 2) != 1 {
+		t.Fatalf("bad")
+	}
+	if min(2, 1) != 1 {
+		t.Fatalf("bad")
+	}
+}

vendor/modules.txt

@@ -803,6 +803,9 @@ github.com/grpc-ecosystem/go-grpc-middleware/util/metautils
 # github.com/hashicorp/go-uuid v1.0.3
 ## explicit
 github.com/hashicorp/go-uuid
+# github.com/hashicorp/yamux v0.1.2
+## explicit
+github.com/hashicorp/yamux
 # github.com/hdevalence/ed25519consensus v0.2.0
 ## explicit; go 1.19
 github.com/hdevalence/ed25519consensus