Fork: 0
yangyangxie / aegis-public
Transfer to URL with SHA Find file
Newer
Older
aegis-public / docs / screenshots / VPS Relay Flow (PROXY Protocol & AI Auto-Blocking).svg
@Jerry Xie Jerry Xie on 19 May 8 KB docs: add and embed rich vector SVG sequence
Raw Blame History 
<svg viewBox="0 0 800 880" width="800" height="880" xmlns="http://www.w3.org/2000/svg" style="background-color: #ffffff; font-family: sans-serif;">
  <!-- Definitions for arrows -->
  <defs>
    <marker id="arrow" viewBox="0 0 10 10" refX="6" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
      <path d="M 0 0 L 10 5 L 0 10 z" fill="#333" />
    </marker>
    <marker id="arrow-dashed" viewBox="0 0 10 10" refX="6" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
      <path d="M 0 0 L 10 5 L 0 10 z" fill="#666" />
    </marker>
    <marker id="arrow-red" viewBox="0 0 10 10" refX="6" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse">
      <path d="M 0 0 L 10 5 L 0 10 z" fill="#d32f2f" />
    </marker>
  </defs>

  <!-- Title -->
  <text x="400" y="30" text-anchor="middle" font-size="18" font-weight="bold" fill="#333">VPS Relay Flow (PROXY Protocol &amp; AI Auto-Blocking)</text>

  <!-- Lifelines -->
  <line x1="80" y1="90" x2="80" y2="790" stroke="#999" stroke-dasharray="5,5" />
  <line x1="240" y1="90" x2="240" y2="790" stroke="#999" stroke-dasharray="5,5" />
  <line x1="400" y1="90" x2="400" y2="790" stroke="#999" stroke-dasharray="5,5" />
  <line x1="560" y1="90" x2="560" y2="790" stroke="#999" stroke-dasharray="5,5" />
  <line x1="720" y1="90" x2="720" y2="790" stroke="#999" stroke-dasharray="5,5" />

  <!-- Participant Boxes (Top) -->
  <rect x="20" y="50" width="120" height="40" rx="5" fill="#e0e0e0" stroke="#999" stroke-width="1.5" />
  <text x="80" y="75" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">Attacker (1.2.3.4)</text>

  <rect x="180" y="50" width="120" height="40" rx="5" fill="#add8e6" stroke="#999" stroke-width="1.5" />
  <text x="240" y="75" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">VPS (Nginx)</text>

  <rect x="340" y="50" width="120" height="40" rx="5" fill="#ffe0b2" stroke="#999" stroke-width="1.5" />
  <text x="400" y="75" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">WG Tunnel</text>

  <rect x="500" y="50" width="120" height="40" rx="5" fill="#fff9c4" stroke="#999" stroke-width="1.5" />
  <text x="560" y="75" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">Envoy (Home)</text>

  <rect x="660" y="50" width="120" height="40" rx="5" fill="#f8bbd0" stroke="#999" stroke-width="1.5" />
  <text x="720" y="75" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">Aegis (Home)</text>

  <!-- Note: Bootstrapping Phase -->
  <rect x="510" y="105" width="230" height="25" rx="3" fill="#c8e6c9" stroke="#999" stroke-width="1" />
  <text x="625" y="122" text-anchor="middle" font-size="11" font-weight="bold" fill="#2e7d32">Bootstrapping Phase</text>

  <!-- Envoy -> Aegis: xDS -->
  <line x1="560" y1="150" x2="720" y2="150" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="640" y="145" text-anchor="middle" font-size="11" fill="#333">Connect gRPC xDS</text>

  <!-- Aegis -> Envoy: Push dynamic config with PROXY filter -->
  <line x1="720" y1="180" x2="560" y2="180" stroke="#666" stroke-dasharray="3,3" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="640" y="175" text-anchor="middle" font-size="11" fill="#555">Push https_listener + PROXY filter</text>

  <!-- Note: Traffic Flow & Auto-Block -->
  <rect x="30" y="215" width="740" height="25" rx="3" fill="#c8e6c9" stroke="#999" stroke-width="1" />
  <text x="400" y="232" text-anchor="middle" font-size="11" font-weight="bold" fill="#2e7d32">Traffic Flow (Exploit Attack &amp; Dynamic Auto-Blocking)</text>

  <!-- Attacker -> VPS: Exploit -->
  <line x1="80" y1="265" x2="240" y2="265" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="160" y="260" text-anchor="middle" font-size="11" fill="#333">Send Exploit to Port 443</text>

  <!-- Note: VPS prepends PROXY header -->
  <rect x="150" y="285" width="180" height="30" rx="3" fill="#e0f7fa" stroke="#999" stroke-width="1" />
  <text x="240" y="303" text-anchor="middle" font-size="10" fill="#006064">Prepend PROXY header (IP 1.2.3.4)</text>

  <!-- VPS -> WG Tunnel -->
  <line x1="240" y1="340" x2="400" y2="340" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="320" y="335" text-anchor="middle" font-size="11" fill="#333">Forward TCP stream</text>

  <!-- WG Tunnel -> Envoy -->
  <line x1="400" y1="370" x2="560" y2="370" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="480" y="365" text-anchor="middle" font-size="11" fill="#333">Deliver to Home (10443)</text>

  <!-- Note: Envoy parses PROXY -->
  <rect x="460" y="390" width="200" height="30" rx="3" fill="#fff9c4" stroke="#999" stroke-width="1" />
  <text x="560" y="408" text-anchor="middle" font-size="10" fill="#6d4c41">PROXY filter restores Client IP: 1.2.3.4</text>

  <!-- Envoy -> Aegis: Stream ALS -->
  <line x1="560" y1="445" x2="720" y2="445" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="640" y="440" text-anchor="middle" font-size="11" fill="#333">Stream ALS (Client IP = 1.2.3.4)</text>

  <!-- Note: AI detects exploit and blocks -->
  <rect x="620" y="465" width="170" height="35" rx="3" fill="#ffcdd2" stroke="#d32f2f" stroke-width="1.5" />
  <text x="705" y="486" text-anchor="middle" font-size="10" font-weight="bold" fill="#c62828">AI Engine Blocks 1.2.3.4</text>

  <!-- Aegis -> Envoy: Push updated blocklist -->
  <line x1="720" y1="525" x2="560" y2="525" stroke="#c62828" stroke-dasharray="3,3" stroke-width="1.5" marker-end="url(#arrow-red)" />
  <text x="640" y="520" text-anchor="middle" font-size="11" fill="#c62828" font-weight="bold">Push updated xDS blocklist</text>

  <!-- Note: Envoy dynamically blocks -->
  <rect x="470" y="545" width="180" height="25" rx="3" fill="#ffcdd2" stroke="#d32f2f" stroke-width="1.5" />
  <text x="560" y="561" text-anchor="middle" font-size="10" font-weight="bold" fill="#c62828">Envoy blocks 1.2.3.4 dynamically</text>

  <!-- Note: Subsequent Request Blocked -->
  <rect x="30" y="595" width="740" height="25" rx="3" fill="#fff9c4" stroke="#999" stroke-width="1" />
  <text x="400" y="612" text-anchor="middle" font-size="11" font-weight="bold" fill="#6d4c41">Subsequent Request from Attacker (Blocked)</text>

  <!-- Attacker -> VPS -->
  <line x1="80" y1="645" x2="240" y2="645" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="160" y="640" text-anchor="middle" font-size="11" fill="#333">Send Request 2</text>

  <!-- VPS -> WG Tunnel -->
  <line x1="240" y1="675" x2="400" y2="675" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="320" y="670" text-anchor="middle" font-size="11" fill="#333">Forward</text>

  <!-- WG Tunnel -> Envoy -->
  <line x1="400" y1="705" x2="560" y2="705" stroke="#333" stroke-width="1.5" marker-end="url(#arrow)" />
  <text x="480" y="700" text-anchor="middle" font-size="11" fill="#333">Deliver</text>

  <!-- Envoy -X Client: Drop connection -->
  <line x1="560" y1="735" x2="80" y2="735" stroke="#d32f2f" stroke-dasharray="5,5" stroke-width="2" marker-end="url(#arrow-red)" />
  <text x="320" y="730" text-anchor="middle" font-size="12" fill="#d32f2f" font-weight="bold">Drop Connection immediately (Client blocked)</text>

  <!-- Note: Legitimate users continue to work -->
  <rect x="150" y="755" width="500" height="25" rx="3" fill="#c8e6c9" stroke="#2e7d32" stroke-width="1.5" />
  <text x="400" y="771" text-anchor="middle" font-size="11" font-weight="bold" fill="#2e7d32">Legitimate traffic passing through VPS continues to work unaffected!</text>

  <!-- Participant Boxes (Bottom) -->
  <rect x="20" y="800" width="120" height="40" rx="5" fill="#e0e0e0" stroke="#999" stroke-width="1.5" />
  <text x="80" y="825" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">Attacker (1.2.3.4)</text>

  <rect x="180" y="800" width="120" height="40" rx="5" fill="#add8e6" stroke="#999" stroke-width="1.5" />
  <text x="240" y="825" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">VPS (Nginx)</text>

  <rect x="340" y="800" width="120" height="40" rx="5" fill="#ffe0b2" stroke="#999" stroke-width="1.5" />
  <text x="400" y="825" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">WG Tunnel</text>

  <rect x="500" y="800" width="120" height="40" rx="5" fill="#fff9c4" stroke="#999" stroke-width="1.5" />
  <text x="560" y="825" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">Envoy (Home)</text>

  <rect x="660" y="800" width="120" height="40" rx="5" fill="#f8bbd0" stroke="#999" stroke-width="1.5" />
  <text x="720" y="825" text-anchor="middle" font-size="13" font-weight="bold" fill="#333">Aegis (Home)</text>
</svg>