astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-09-20 01:28:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

Decoy Fasttrack Drafts

Browse Source 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
This commit is contained in:
Alexey
2026-09-05 21:18:48 +03:00
parent 9f023ff9c7
commit 106b26a5b7
28 changed files with 920 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/http/request.rs
+12 -38
View File
@@ -13,53 +13,27 @@ use crate::web::manager::{
const USER_AGENT_CONTEXT: &[u8] = b"telemt-web-carrier-user-agent-v1\0";
use super::capability::scan_capabilities;
// Canonical host and forwarded-address provenance remain isolated from credentials.
mod identity;
pub(super) use identity::{canonical_request_host, carrier_ip_learning_eligible, client_ip};
/// Decodes an exact canonical bridge query without allocating credential strings.
pub(super) fn bridge_candidate(query: Option<&str>) -> ([u8; 32], bool) {
let mut candidate = [0u8; 32];
let Some(value) = query.and_then(|query| query.strip_prefix("bridge=")) else {
return (candidate, false);
};
if value.len() != 43 {
return (candidate, false);
}
let mut decoded = [0u8; 32];
let Ok(decoded_len) =
base64::engine::general_purpose::URL_SAFE_NO_PAD.decode_slice(value, &mut decoded)
else {
return (candidate, false);
};
let mut canonical = [0u8; 43];
let Ok(encoded_len) =
base64::engine::general_purpose::URL_SAFE_NO_PAD.encode_slice(decoded, &mut canonical)
else {
return (candidate, false);
};
if decoded_len != decoded.len()
|| encoded_len != canonical.len()
|| !bool::from(canonical.ct_eq(value.as_bytes()))
{
return (candidate, false);
}
candidate = decoded;
(candidate, true)
}
/// Matches a capability in constant time across every profile of one virtual host.
/// Matches one capability after a complete branchless scan of the virtual host table.
pub(super) fn match_profile(
vhost: &WebRuntimeVhost,
candidate: &[u8; 32],
) -> Option<Arc<WebRuntimeProfile>> {
let mut matched = None;
for profile in &vhost.profiles {
if bool::from(profile.capability.ct_eq(candidate)) {
matched = Some(Arc::clone(profile));
}
debug_assert_eq!(vhost.capabilities.len(), vhost.profiles.len());
let scan = scan_capabilities(&vhost.capabilities, candidate);
if bool::from(scan.matched) {
usize::try_from(scan.matched_index)
.ok()
.and_then(|index| vhost.profiles.get(index))
.map(Arc::clone)
} else {
None
}
matched
}
/// Validates and hashes one canonical bearer credential for map lookup.