mirror of
https://github.com/telemt/telemt.git
synced 2026-08-01 08:30:44 +03:00
Split config loader helpers into focused modules
This commit is contained in:
Alexey
+37
-3416
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,60 @@
|
|||||||
|
use std::collections::BTreeSet;
|
||||||
|
use std::hash::{DefaultHasher, Hash, Hasher};
|
||||||
|
use std::path::{Path, PathBuf};
|
||||||
|
|
||||||
|
use crate::error::{ProxyError, Result};
|
||||||
|
|
||||||
|
pub(super) fn normalize_config_path(path: &Path) -> PathBuf {
|
||||||
|
path.canonicalize().unwrap_or_else(|_| {
|
||||||
|
if path.is_absolute() {
|
||||||
|
path.to_path_buf()
|
||||||
|
} else {
|
||||||
|
std::env::current_dir()
|
||||||
|
.map(|cwd| cwd.join(path))
|
||||||
|
.unwrap_or_else(|_| path.to_path_buf())
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn hash_rendered_snapshot(rendered: &str) -> u64 {
|
||||||
|
let mut hasher = DefaultHasher::new();
|
||||||
|
rendered.hash(&mut hasher);
|
||||||
|
hasher.finish()
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn preprocess_includes(
|
||||||
|
content: &str,
|
||||||
|
base_dir: &Path,
|
||||||
|
depth: u8,
|
||||||
|
source_files: &mut BTreeSet<PathBuf>,
|
||||||
|
) -> Result<String> {
|
||||||
|
if depth > 10 {
|
||||||
|
return Err(ProxyError::Config("Include depth > 10".into()));
|
||||||
|
}
|
||||||
|
let mut output = String::with_capacity(content.len());
|
||||||
|
for line in content.lines() {
|
||||||
|
let trimmed = line.trim();
|
||||||
|
if let Some(rest) = trimmed.strip_prefix("include") {
|
||||||
|
let rest = rest.trim();
|
||||||
|
if let Some(rest) = rest.strip_prefix('=') {
|
||||||
|
let path_str = rest.trim().trim_matches('"');
|
||||||
|
let resolved = base_dir.join(path_str);
|
||||||
|
source_files.insert(normalize_config_path(&resolved));
|
||||||
|
let included = std::fs::read_to_string(&resolved)
|
||||||
|
.map_err(|e| ProxyError::Config(e.to_string()))?;
|
||||||
|
let included_dir = resolved.parent().unwrap_or(base_dir);
|
||||||
|
output.push_str(&preprocess_includes(
|
||||||
|
&included,
|
||||||
|
included_dir,
|
||||||
|
depth + 1,
|
||||||
|
source_files,
|
||||||
|
)?);
|
||||||
|
output.push('\n');
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
output.push_str(line);
|
||||||
|
output.push('\n');
|
||||||
|
}
|
||||||
|
Ok(output)
|
||||||
|
}
|
||||||
@@ -0,0 +1,115 @@
|
|||||||
|
use crate::error::{ProxyError, Result};
|
||||||
|
use tracing::warn;
|
||||||
|
|
||||||
|
pub(super) fn is_valid_tls_domain_name(domain: &str) -> bool {
|
||||||
|
!domain.is_empty()
|
||||||
|
&& !domain
|
||||||
|
.chars()
|
||||||
|
.any(|ch| ch.is_whitespace() || matches!(ch, '/' | '\\'))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn normalize_domain_to_ascii(domain: &str, field: &str) -> Result<String> {
|
||||||
|
let domain = domain.trim();
|
||||||
|
if !is_valid_tls_domain_name(domain) {
|
||||||
|
return Err(ProxyError::Config(format!(
|
||||||
|
"Invalid {field}: '{}'. Must be a valid domain name",
|
||||||
|
domain
|
||||||
|
)));
|
||||||
|
}
|
||||||
|
|
||||||
|
let parsed = url::Url::parse(&format!("https://{domain}/")).map_err(|error| {
|
||||||
|
ProxyError::Config(format!(
|
||||||
|
"Invalid {field}: '{}'. IDNA conversion failed: {error}",
|
||||||
|
domain
|
||||||
|
))
|
||||||
|
})?;
|
||||||
|
let host = parsed.host_str().ok_or_else(|| {
|
||||||
|
ProxyError::Config(format!("Invalid {field}: '{}'. Host is empty", domain))
|
||||||
|
})?;
|
||||||
|
Ok(host.to_ascii_lowercase())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn normalize_mask_host_to_ascii(host: &str, field: &str) -> Result<String> {
|
||||||
|
let host = host.trim();
|
||||||
|
if host.starts_with('[') && host.ends_with(']') {
|
||||||
|
let inner = &host[1..host.len() - 1];
|
||||||
|
let ip = inner.parse::<std::net::IpAddr>().map_err(|_| {
|
||||||
|
ProxyError::Config(format!(
|
||||||
|
"Invalid {field}: '{}'. IPv6 literal is invalid",
|
||||||
|
host
|
||||||
|
))
|
||||||
|
})?;
|
||||||
|
return match ip {
|
||||||
|
std::net::IpAddr::V6(v6) => Ok(format!("[{v6}]")),
|
||||||
|
std::net::IpAddr::V4(v4) => Ok(v4.to_string()),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
if let Ok(ip) = host.parse::<std::net::IpAddr>() {
|
||||||
|
return match ip {
|
||||||
|
std::net::IpAddr::V4(v4) => Ok(v4.to_string()),
|
||||||
|
std::net::IpAddr::V6(v6) => Ok(format!("[{v6}]")),
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
normalize_domain_to_ascii(host, field)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn parse_exclusive_mask_target(target: &str) -> Option<(&str, u16)> {
|
||||||
|
let target = target.trim();
|
||||||
|
if target.is_empty() {
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
|
||||||
|
if target.starts_with('[') {
|
||||||
|
let end = target.find(']')?;
|
||||||
|
if target.get(end + 1..end + 2)? != ":" {
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
let host = &target[..=end];
|
||||||
|
let port = target[end + 2..].parse::<u16>().ok()?;
|
||||||
|
return (port > 0).then_some((host, port));
|
||||||
|
}
|
||||||
|
|
||||||
|
let (host, port) = target.rsplit_once(':')?;
|
||||||
|
if host.is_empty() || host.contains(':') {
|
||||||
|
return None;
|
||||||
|
}
|
||||||
|
let port = port.parse::<u16>().ok()?;
|
||||||
|
(port > 0).then_some((host, port))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn normalize_exclusive_mask_target(target: &str, field: &str) -> Result<String> {
|
||||||
|
let (host, port) = parse_exclusive_mask_target(target).ok_or_else(|| {
|
||||||
|
ProxyError::Config(format!(
|
||||||
|
"Invalid {field}: '{}'. Expected host:port with port > 0",
|
||||||
|
target
|
||||||
|
))
|
||||||
|
})?;
|
||||||
|
let host = normalize_mask_host_to_ascii(host, field)?;
|
||||||
|
Ok(format!("{host}:{port}"))
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn push_unique_nonempty(target: &mut Vec<String>, value: String) {
|
||||||
|
let trimmed = value.trim();
|
||||||
|
if trimmed.is_empty() {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
if !target.iter().any(|existing| existing == trimmed) {
|
||||||
|
target.push(trimmed.to_string());
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn is_valid_ad_tag(tag: &str) -> bool {
|
||||||
|
tag.len() == 32 && tag.chars().all(|ch| ch.is_ascii_hexdigit())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn sanitize_ad_tag(ad_tag: &mut Option<String>) {
|
||||||
|
let Some(tag) = ad_tag.as_ref() else {
|
||||||
|
return;
|
||||||
|
};
|
||||||
|
|
||||||
|
if !is_valid_ad_tag(tag) {
|
||||||
|
warn!("Invalid general.ad_tag value, expected exactly 32 hex chars; ad_tag is disabled");
|
||||||
|
*ad_tag = None;
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,112 @@
|
|||||||
|
use std::collections::HashMap;
|
||||||
|
use std::collections::hash_map::DefaultHasher;
|
||||||
|
use std::hash::Hasher;
|
||||||
|
|
||||||
|
use crate::error::{ProxyError, Result};
|
||||||
|
|
||||||
|
const ACCESS_SECRET_BYTES: usize = 16;
|
||||||
|
|
||||||
|
/// Precomputed, immutable user authentication data used by handshake hot paths.
|
||||||
|
#[derive(Debug, Clone, Default)]
|
||||||
|
pub(crate) struct UserAuthSnapshot {
|
||||||
|
entries: Vec<UserAuthEntry>,
|
||||||
|
by_name: HashMap<String, u32>,
|
||||||
|
sni_index: HashMap<u64, Vec<u32>>,
|
||||||
|
sni_initial_index: HashMap<u8, Vec<u32>>,
|
||||||
|
}
|
||||||
|
|
||||||
|
#[derive(Debug, Clone)]
|
||||||
|
pub(crate) struct UserAuthEntry {
|
||||||
|
pub(crate) user: String,
|
||||||
|
pub(crate) secret: [u8; ACCESS_SECRET_BYTES],
|
||||||
|
}
|
||||||
|
|
||||||
|
impl UserAuthSnapshot {
|
||||||
|
pub(super) fn from_users(users: &HashMap<String, String>) -> Result<Self> {
|
||||||
|
let mut entries = Vec::with_capacity(users.len());
|
||||||
|
let mut by_name = HashMap::with_capacity(users.len());
|
||||||
|
let mut sni_index = HashMap::with_capacity(users.len());
|
||||||
|
let mut sni_initial_index = HashMap::with_capacity(users.len());
|
||||||
|
|
||||||
|
for (user, secret_hex) in users {
|
||||||
|
let decoded = hex::decode(secret_hex).map_err(|_| ProxyError::InvalidSecret {
|
||||||
|
user: user.clone(),
|
||||||
|
reason: "Must be 32 hex characters".to_string(),
|
||||||
|
})?;
|
||||||
|
if decoded.len() != ACCESS_SECRET_BYTES {
|
||||||
|
return Err(ProxyError::InvalidSecret {
|
||||||
|
user: user.clone(),
|
||||||
|
reason: "Must be 32 hex characters".to_string(),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|
||||||
|
let user_id = u32::try_from(entries.len()).map_err(|_| {
|
||||||
|
ProxyError::Config("Too many users for runtime auth snapshot".to_string())
|
||||||
|
})?;
|
||||||
|
|
||||||
|
let mut secret = [0u8; ACCESS_SECRET_BYTES];
|
||||||
|
secret.copy_from_slice(&decoded);
|
||||||
|
entries.push(UserAuthEntry {
|
||||||
|
user: user.clone(),
|
||||||
|
secret,
|
||||||
|
});
|
||||||
|
by_name.insert(user.clone(), user_id);
|
||||||
|
sni_index
|
||||||
|
.entry(Self::sni_lookup_hash(user))
|
||||||
|
.or_insert_with(Vec::new)
|
||||||
|
.push(user_id);
|
||||||
|
if let Some(initial) = user
|
||||||
|
.as_bytes()
|
||||||
|
.first()
|
||||||
|
.map(|byte| byte.to_ascii_lowercase())
|
||||||
|
{
|
||||||
|
sni_initial_index
|
||||||
|
.entry(initial)
|
||||||
|
.or_insert_with(Vec::new)
|
||||||
|
.push(user_id);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(Self {
|
||||||
|
entries,
|
||||||
|
by_name,
|
||||||
|
sni_index,
|
||||||
|
sni_initial_index,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(crate) fn entries(&self) -> &[UserAuthEntry] {
|
||||||
|
&self.entries
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(crate) fn user_id_by_name(&self, user: &str) -> Option<u32> {
|
||||||
|
self.by_name.get(user).copied()
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(crate) fn entry_by_id(&self, user_id: u32) -> Option<&UserAuthEntry> {
|
||||||
|
let idx = usize::try_from(user_id).ok()?;
|
||||||
|
self.entries.get(idx)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(crate) fn sni_candidates(&self, sni: &str) -> Option<&[u32]> {
|
||||||
|
self.sni_index
|
||||||
|
.get(&Self::sni_lookup_hash(sni))
|
||||||
|
.map(Vec::as_slice)
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(crate) fn sni_initial_candidates(&self, sni: &str) -> Option<&[u32]> {
|
||||||
|
let initial = sni
|
||||||
|
.as_bytes()
|
||||||
|
.first()
|
||||||
|
.map(|byte| byte.to_ascii_lowercase())?;
|
||||||
|
self.sni_initial_index.get(&initial).map(Vec::as_slice)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn sni_lookup_hash(value: &str) -> u64 {
|
||||||
|
let mut hasher = DefaultHasher::new();
|
||||||
|
for byte in value.bytes() {
|
||||||
|
hasher.write_u8(byte.to_ascii_lowercase());
|
||||||
|
}
|
||||||
|
hasher.finish()
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,693 @@
|
|||||||
|
use tracing::warn;
|
||||||
|
|
||||||
|
use crate::error::{ProxyError, Result};
|
||||||
|
|
||||||
|
const TOP_LEVEL_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"general",
|
||||||
|
"logging",
|
||||||
|
"network",
|
||||||
|
"server",
|
||||||
|
"timeouts",
|
||||||
|
"censorship",
|
||||||
|
"access",
|
||||||
|
"upstreams",
|
||||||
|
"show_link",
|
||||||
|
"dc_overrides",
|
||||||
|
"default_dc",
|
||||||
|
"beobachten",
|
||||||
|
"beobachten_minutes",
|
||||||
|
"beobachten_flush_secs",
|
||||||
|
"beobachten_file",
|
||||||
|
"include",
|
||||||
|
];
|
||||||
|
|
||||||
|
const GENERAL_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"data_path",
|
||||||
|
"quota_state_path",
|
||||||
|
"config_strict",
|
||||||
|
"modes",
|
||||||
|
"prefer_ipv6",
|
||||||
|
"fast_mode",
|
||||||
|
"use_middle_proxy",
|
||||||
|
"proxy_secret_path",
|
||||||
|
"proxy_secret_url",
|
||||||
|
"proxy_config_v4_cache_path",
|
||||||
|
"proxy_config_v4_url",
|
||||||
|
"proxy_config_v6_cache_path",
|
||||||
|
"proxy_config_v6_url",
|
||||||
|
"ad_tag",
|
||||||
|
"middle_proxy_nat_ip",
|
||||||
|
"middle_proxy_nat_probe",
|
||||||
|
"middle_proxy_nat_stun",
|
||||||
|
"middle_proxy_nat_stun_servers",
|
||||||
|
"stun_nat_probe_concurrency",
|
||||||
|
"middle_proxy_pool_size",
|
||||||
|
"middle_proxy_warm_standby",
|
||||||
|
"me_init_retry_attempts",
|
||||||
|
"me2dc_fallback",
|
||||||
|
"me2dc_fast",
|
||||||
|
"me_keepalive_enabled",
|
||||||
|
"me_keepalive_interval_secs",
|
||||||
|
"me_keepalive_jitter_secs",
|
||||||
|
"me_keepalive_payload_random",
|
||||||
|
"rpc_proxy_req_every",
|
||||||
|
"me_writer_cmd_channel_capacity",
|
||||||
|
"me_route_channel_capacity",
|
||||||
|
"me_c2me_channel_capacity",
|
||||||
|
"me_c2me_send_timeout_ms",
|
||||||
|
"me_reader_route_data_wait_ms",
|
||||||
|
"me_d2c_flush_batch_max_frames",
|
||||||
|
"me_d2c_flush_batch_max_bytes",
|
||||||
|
"me_d2c_flush_batch_max_delay_us",
|
||||||
|
"me_d2c_ack_flush_immediate",
|
||||||
|
"me_quota_soft_overshoot_bytes",
|
||||||
|
"me_d2c_frame_buf_shrink_threshold_bytes",
|
||||||
|
"direct_relay_copy_buf_c2s_bytes",
|
||||||
|
"direct_relay_copy_buf_s2c_bytes",
|
||||||
|
"crypto_pending_buffer",
|
||||||
|
"max_client_frame",
|
||||||
|
"desync_all_full",
|
||||||
|
"beobachten",
|
||||||
|
"beobachten_minutes",
|
||||||
|
"beobachten_flush_secs",
|
||||||
|
"beobachten_file",
|
||||||
|
"hardswap",
|
||||||
|
"me_warmup_stagger_enabled",
|
||||||
|
"me_warmup_step_delay_ms",
|
||||||
|
"me_warmup_step_jitter_ms",
|
||||||
|
"me_reconnect_max_concurrent_per_dc",
|
||||||
|
"me_reconnect_backoff_base_ms",
|
||||||
|
"me_reconnect_backoff_cap_ms",
|
||||||
|
"me_reconnect_fast_retry_count",
|
||||||
|
"me_single_endpoint_shadow_writers",
|
||||||
|
"me_single_endpoint_outage_mode_enabled",
|
||||||
|
"me_single_endpoint_outage_disable_quarantine",
|
||||||
|
"me_single_endpoint_outage_backoff_min_ms",
|
||||||
|
"me_single_endpoint_outage_backoff_max_ms",
|
||||||
|
"me_single_endpoint_shadow_rotate_every_secs",
|
||||||
|
"me_floor_mode",
|
||||||
|
"me_adaptive_floor_idle_secs",
|
||||||
|
"me_adaptive_floor_min_writers_single_endpoint",
|
||||||
|
"me_adaptive_floor_min_writers_multi_endpoint",
|
||||||
|
"me_adaptive_floor_recover_grace_secs",
|
||||||
|
"me_adaptive_floor_writers_per_core_total",
|
||||||
|
"me_adaptive_floor_cpu_cores_override",
|
||||||
|
"me_adaptive_floor_max_extra_writers_single_per_core",
|
||||||
|
"me_adaptive_floor_max_extra_writers_multi_per_core",
|
||||||
|
"me_adaptive_floor_max_active_writers_per_core",
|
||||||
|
"me_adaptive_floor_max_warm_writers_per_core",
|
||||||
|
"me_adaptive_floor_max_active_writers_global",
|
||||||
|
"me_adaptive_floor_max_warm_writers_global",
|
||||||
|
"upstream_connect_retry_attempts",
|
||||||
|
"upstream_connect_retry_backoff_ms",
|
||||||
|
"upstream_connect_budget_ms",
|
||||||
|
"tg_connect",
|
||||||
|
"upstream_unhealthy_fail_threshold",
|
||||||
|
"upstream_connect_failfast_hard_errors",
|
||||||
|
"stun_iface_mismatch_ignore",
|
||||||
|
"unknown_dc_log_path",
|
||||||
|
"unknown_dc_file_log_enabled",
|
||||||
|
"log_level",
|
||||||
|
"disable_colors",
|
||||||
|
"telemetry",
|
||||||
|
"me_socks_kdf_policy",
|
||||||
|
"me_route_backpressure_enabled",
|
||||||
|
"me_route_fairshare_enabled",
|
||||||
|
"me_route_backpressure_base_timeout_ms",
|
||||||
|
"me_route_backpressure_high_timeout_ms",
|
||||||
|
"me_route_backpressure_high_watermark_pct",
|
||||||
|
"me_health_interval_ms_unhealthy",
|
||||||
|
"me_health_interval_ms_healthy",
|
||||||
|
"me_admission_poll_ms",
|
||||||
|
"me_warn_rate_limit_ms",
|
||||||
|
"me_route_no_writer_mode",
|
||||||
|
"me_route_no_writer_wait_ms",
|
||||||
|
"me_route_hybrid_max_wait_ms",
|
||||||
|
"me_route_blocking_send_timeout_ms",
|
||||||
|
"me_route_inline_recovery_attempts",
|
||||||
|
"me_route_inline_recovery_wait_ms",
|
||||||
|
"links",
|
||||||
|
"fast_mode_min_tls_record",
|
||||||
|
"update_every",
|
||||||
|
"me_reinit_every_secs",
|
||||||
|
"me_hardswap_warmup_delay_min_ms",
|
||||||
|
"me_hardswap_warmup_delay_max_ms",
|
||||||
|
"me_hardswap_warmup_extra_passes",
|
||||||
|
"me_hardswap_warmup_pass_backoff_base_ms",
|
||||||
|
"me_config_stable_snapshots",
|
||||||
|
"me_config_apply_cooldown_secs",
|
||||||
|
"me_snapshot_require_http_2xx",
|
||||||
|
"me_snapshot_reject_empty_map",
|
||||||
|
"me_snapshot_min_proxy_for_lines",
|
||||||
|
"proxy_secret_stable_snapshots",
|
||||||
|
"proxy_secret_rotate_runtime",
|
||||||
|
"me_secret_atomic_snapshot",
|
||||||
|
"proxy_secret_len_max",
|
||||||
|
"me_pool_drain_ttl_secs",
|
||||||
|
"me_instadrain",
|
||||||
|
"me_pool_drain_threshold",
|
||||||
|
"me_pool_drain_soft_evict_enabled",
|
||||||
|
"me_pool_drain_soft_evict_grace_secs",
|
||||||
|
"me_pool_drain_soft_evict_per_writer",
|
||||||
|
"me_pool_drain_soft_evict_budget_per_core",
|
||||||
|
"me_pool_drain_soft_evict_cooldown_ms",
|
||||||
|
"me_bind_stale_mode",
|
||||||
|
"me_bind_stale_ttl_secs",
|
||||||
|
"me_pool_min_fresh_ratio",
|
||||||
|
"me_reinit_drain_timeout_secs",
|
||||||
|
"proxy_secret_auto_reload_secs",
|
||||||
|
"proxy_config_auto_reload_secs",
|
||||||
|
"me_reinit_singleflight",
|
||||||
|
"me_reinit_trigger_channel",
|
||||||
|
"me_reinit_coalesce_window_ms",
|
||||||
|
"me_deterministic_writer_sort",
|
||||||
|
"me_writer_pick_mode",
|
||||||
|
"me_writer_pick_sample_size",
|
||||||
|
"ntp_check",
|
||||||
|
"ntp_servers",
|
||||||
|
"auto_degradation_enabled",
|
||||||
|
"degradation_min_unavailable_dc_groups",
|
||||||
|
"rst_on_close",
|
||||||
|
];
|
||||||
|
|
||||||
|
const NETWORK_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"ipv4",
|
||||||
|
"ipv6",
|
||||||
|
"prefer",
|
||||||
|
"multipath",
|
||||||
|
"stun_use",
|
||||||
|
"stun_servers",
|
||||||
|
"stun_tcp_fallback",
|
||||||
|
"http_ip_detect_urls",
|
||||||
|
"cache_public_ip_path",
|
||||||
|
"dns_overrides",
|
||||||
|
];
|
||||||
|
|
||||||
|
const SERVER_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"port",
|
||||||
|
"listen_addr_ipv4",
|
||||||
|
"listen_addr_ipv6",
|
||||||
|
"listen_unix_sock",
|
||||||
|
"listen_unix_sock_perm",
|
||||||
|
"listen_tcp",
|
||||||
|
"client_mss",
|
||||||
|
"client_mss_bulk",
|
||||||
|
"proxy_protocol",
|
||||||
|
"proxy_protocol_header_timeout_ms",
|
||||||
|
"proxy_protocol_trusted_cidrs",
|
||||||
|
"metrics_port",
|
||||||
|
"metrics_listen",
|
||||||
|
"metrics_whitelist",
|
||||||
|
"api",
|
||||||
|
"admin_api",
|
||||||
|
"listeners",
|
||||||
|
"listen_backlog",
|
||||||
|
"max_connections",
|
||||||
|
"accept_permit_timeout_ms",
|
||||||
|
"conntrack_control",
|
||||||
|
];
|
||||||
|
|
||||||
|
const API_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"enabled",
|
||||||
|
"listen",
|
||||||
|
"whitelist",
|
||||||
|
"gray_action",
|
||||||
|
"auth_header",
|
||||||
|
"request_body_limit_bytes",
|
||||||
|
"minimal_runtime_enabled",
|
||||||
|
"minimal_runtime_cache_ttl_ms",
|
||||||
|
"runtime_edge_enabled",
|
||||||
|
"runtime_edge_cache_ttl_ms",
|
||||||
|
"runtime_edge_top_n",
|
||||||
|
"runtime_edge_events_capacity",
|
||||||
|
"read_only",
|
||||||
|
];
|
||||||
|
|
||||||
|
const CONNTRACK_CONTROL_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"inline_conntrack_control",
|
||||||
|
"mode",
|
||||||
|
"backend",
|
||||||
|
"profile",
|
||||||
|
"hybrid_listener_ips",
|
||||||
|
"pressure_high_watermark_pct",
|
||||||
|
"pressure_low_watermark_pct",
|
||||||
|
"delete_budget_per_sec",
|
||||||
|
];
|
||||||
|
|
||||||
|
const LISTENER_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"ip",
|
||||||
|
"port",
|
||||||
|
"client_mss",
|
||||||
|
"synlimit",
|
||||||
|
"synlimit_seconds",
|
||||||
|
"synlimit_hitcount",
|
||||||
|
"synlimit_burst",
|
||||||
|
"synlimit_ios_seconds",
|
||||||
|
"synlimit_ios_hitcount",
|
||||||
|
"synlimit_ios_burst",
|
||||||
|
"synlimit_hashlimit_expire_ms",
|
||||||
|
"synlimit_hashlimit_size",
|
||||||
|
"announce",
|
||||||
|
"announce_ip",
|
||||||
|
"proxy_protocol",
|
||||||
|
"reuse_allow",
|
||||||
|
];
|
||||||
|
|
||||||
|
const TIMEOUTS_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"client_first_byte_idle_secs",
|
||||||
|
"client_handshake",
|
||||||
|
"relay_idle_policy_v2_enabled",
|
||||||
|
"relay_client_idle_soft_secs",
|
||||||
|
"relay_client_idle_hard_secs",
|
||||||
|
"relay_idle_grace_after_downstream_activity_secs",
|
||||||
|
"client_keepalive",
|
||||||
|
"client_ack",
|
||||||
|
"me_one_retry",
|
||||||
|
"me_one_timeout_ms",
|
||||||
|
];
|
||||||
|
|
||||||
|
const CENSORSHIP_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"tls_domain",
|
||||||
|
"tls_domains",
|
||||||
|
"unknown_sni_action",
|
||||||
|
"tls_fetch_scope",
|
||||||
|
"tls_fetch",
|
||||||
|
"mask",
|
||||||
|
"mask_dynamic",
|
||||||
|
"mask_host",
|
||||||
|
"mask_port",
|
||||||
|
"exclusive_mask",
|
||||||
|
"mask_unix_sock",
|
||||||
|
"fake_cert_len",
|
||||||
|
"tls_emulation",
|
||||||
|
"tls_front_dir",
|
||||||
|
"server_hello_delay_min_ms",
|
||||||
|
"server_hello_delay_max_ms",
|
||||||
|
"tls_new_session_tickets",
|
||||||
|
"serverhello_compact",
|
||||||
|
"tls_full_cert_ttl_secs",
|
||||||
|
"alpn_enforce",
|
||||||
|
"mask_proxy_protocol",
|
||||||
|
"mask_shape_hardening",
|
||||||
|
"mask_shape_hardening_aggressive_mode",
|
||||||
|
"mask_shape_bucket_floor_bytes",
|
||||||
|
"mask_shape_bucket_cap_bytes",
|
||||||
|
"mask_shape_above_cap_blur",
|
||||||
|
"mask_shape_above_cap_blur_max_bytes",
|
||||||
|
"mask_relay_max_bytes",
|
||||||
|
"mask_relay_timeout_ms",
|
||||||
|
"mask_relay_idle_timeout_ms",
|
||||||
|
"mask_classifier_prefetch_timeout_ms",
|
||||||
|
"mask_timing_normalization_enabled",
|
||||||
|
"mask_timing_normalization_floor_ms",
|
||||||
|
"mask_timing_normalization_ceiling_ms",
|
||||||
|
];
|
||||||
|
|
||||||
|
const TLS_FETCH_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"profiles",
|
||||||
|
"strict_route",
|
||||||
|
"attempt_timeout_ms",
|
||||||
|
"total_budget_ms",
|
||||||
|
"grease_enabled",
|
||||||
|
"deterministic",
|
||||||
|
"profile_cache_ttl_secs",
|
||||||
|
];
|
||||||
|
|
||||||
|
const ACCESS_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"users",
|
||||||
|
"user_enabled",
|
||||||
|
"user_ad_tags",
|
||||||
|
"user_max_tcp_conns",
|
||||||
|
"user_max_tcp_conns_global_each",
|
||||||
|
"user_expirations",
|
||||||
|
"user_data_quota",
|
||||||
|
"user_rate_limits",
|
||||||
|
"cidr_rate_limits",
|
||||||
|
"user_max_unique_ips",
|
||||||
|
"user_max_unique_ips_global_each",
|
||||||
|
"user_max_unique_ips_mode",
|
||||||
|
"user_max_unique_ips_window_secs",
|
||||||
|
"replay_check_len",
|
||||||
|
"replay_window_secs",
|
||||||
|
"ignore_time_skew",
|
||||||
|
];
|
||||||
|
|
||||||
|
const RATE_LIMIT_BPS_CONFIG_KEYS: &[&str] = &["up_bps", "down_bps"];
|
||||||
|
|
||||||
|
const UPSTREAM_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"type",
|
||||||
|
"interface",
|
||||||
|
"bind_addresses",
|
||||||
|
"bindtodevice",
|
||||||
|
"force_bind",
|
||||||
|
"address",
|
||||||
|
"user_id",
|
||||||
|
"username",
|
||||||
|
"password",
|
||||||
|
"url",
|
||||||
|
"weight",
|
||||||
|
"enabled",
|
||||||
|
"scopes",
|
||||||
|
"ipv4",
|
||||||
|
"ipv6",
|
||||||
|
];
|
||||||
|
|
||||||
|
const PROXY_MODES_CONFIG_KEYS: &[&str] = &["classic", "secure", "tls"];
|
||||||
|
const TELEMETRY_CONFIG_KEYS: &[&str] = &["core_enabled", "user_enabled", "me_level"];
|
||||||
|
const LINKS_CONFIG_KEYS: &[&str] = &["show", "public_host", "public_port"];
|
||||||
|
const LOGGING_CONFIG_KEYS: &[&str] = &[
|
||||||
|
"destination",
|
||||||
|
"path",
|
||||||
|
"rotation",
|
||||||
|
"max_size_bytes",
|
||||||
|
"max_files",
|
||||||
|
"max_age_secs",
|
||||||
|
];
|
||||||
|
|
||||||
|
#[derive(Debug)]
|
||||||
|
struct UnknownConfigKey {
|
||||||
|
path: String,
|
||||||
|
suggestion: Option<String>,
|
||||||
|
}
|
||||||
|
|
||||||
|
fn table_at<'a>(value: &'a toml::Value, path: &[&str]) -> Option<&'a toml::Table> {
|
||||||
|
let mut current = value;
|
||||||
|
for segment in path {
|
||||||
|
current = current.get(*segment)?;
|
||||||
|
}
|
||||||
|
current.as_table()
|
||||||
|
}
|
||||||
|
|
||||||
|
fn is_strict_config(parsed_toml: &toml::Value) -> bool {
|
||||||
|
table_at(parsed_toml, &["general"])
|
||||||
|
.and_then(|table| table.get("config_strict"))
|
||||||
|
.and_then(toml::Value::as_bool)
|
||||||
|
.unwrap_or(false)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn known_config_keys_for_suggestion() -> Vec<&'static str> {
|
||||||
|
let mut keys = Vec::new();
|
||||||
|
for group in [
|
||||||
|
TOP_LEVEL_CONFIG_KEYS,
|
||||||
|
GENERAL_CONFIG_KEYS,
|
||||||
|
NETWORK_CONFIG_KEYS,
|
||||||
|
SERVER_CONFIG_KEYS,
|
||||||
|
API_CONFIG_KEYS,
|
||||||
|
CONNTRACK_CONTROL_CONFIG_KEYS,
|
||||||
|
LISTENER_CONFIG_KEYS,
|
||||||
|
TIMEOUTS_CONFIG_KEYS,
|
||||||
|
CENSORSHIP_CONFIG_KEYS,
|
||||||
|
TLS_FETCH_CONFIG_KEYS,
|
||||||
|
ACCESS_CONFIG_KEYS,
|
||||||
|
RATE_LIMIT_BPS_CONFIG_KEYS,
|
||||||
|
UPSTREAM_CONFIG_KEYS,
|
||||||
|
PROXY_MODES_CONFIG_KEYS,
|
||||||
|
TELEMETRY_CONFIG_KEYS,
|
||||||
|
LINKS_CONFIG_KEYS,
|
||||||
|
LOGGING_CONFIG_KEYS,
|
||||||
|
] {
|
||||||
|
keys.extend_from_slice(group);
|
||||||
|
}
|
||||||
|
keys
|
||||||
|
}
|
||||||
|
|
||||||
|
fn levenshtein_distance(a: &str, b: &str) -> usize {
|
||||||
|
let b_chars: Vec<char> = b.chars().collect();
|
||||||
|
let mut prev: Vec<usize> = (0..=b_chars.len()).collect();
|
||||||
|
let mut curr = vec![0usize; b_chars.len() + 1];
|
||||||
|
|
||||||
|
for (i, ca) in a.chars().enumerate() {
|
||||||
|
curr[0] = i + 1;
|
||||||
|
for (j, cb) in b_chars.iter().enumerate() {
|
||||||
|
let replace = if ca == *cb { prev[j] } else { prev[j] + 1 };
|
||||||
|
curr[j + 1] = (prev[j + 1] + 1).min(curr[j] + 1).min(replace);
|
||||||
|
}
|
||||||
|
std::mem::swap(&mut prev, &mut curr);
|
||||||
|
}
|
||||||
|
|
||||||
|
prev[b_chars.len()]
|
||||||
|
}
|
||||||
|
|
||||||
|
fn unknown_key_suggestion(key: &str, known_keys: &[&'static str]) -> Option<String> {
|
||||||
|
let normalized = key.to_ascii_lowercase();
|
||||||
|
let mut best: Option<(&str, usize)> = None;
|
||||||
|
for known in known_keys {
|
||||||
|
let distance = levenshtein_distance(&normalized, known);
|
||||||
|
let is_better = match best {
|
||||||
|
Some((_, best_distance)) => distance < best_distance,
|
||||||
|
None => true,
|
||||||
|
};
|
||||||
|
if distance <= 4 && is_better {
|
||||||
|
best = Some((known, distance));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
best.map(|(known, _)| known.to_string())
|
||||||
|
}
|
||||||
|
|
||||||
|
fn push_unknown_keys(
|
||||||
|
unknown: &mut Vec<UnknownConfigKey>,
|
||||||
|
known_for_suggestion: &[&'static str],
|
||||||
|
path: &str,
|
||||||
|
table: &toml::Table,
|
||||||
|
allowed: &[&str],
|
||||||
|
) {
|
||||||
|
for key in table.keys() {
|
||||||
|
if !allowed.contains(&key.as_str()) {
|
||||||
|
let full_path = if path.is_empty() {
|
||||||
|
key.clone()
|
||||||
|
} else {
|
||||||
|
format!("{path}.{key}")
|
||||||
|
};
|
||||||
|
unknown.push(UnknownConfigKey {
|
||||||
|
path: full_path,
|
||||||
|
suggestion: unknown_key_suggestion(key, known_for_suggestion),
|
||||||
|
});
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn check_known_table(
|
||||||
|
parsed_toml: &toml::Value,
|
||||||
|
unknown: &mut Vec<UnknownConfigKey>,
|
||||||
|
known_for_suggestion: &[&'static str],
|
||||||
|
path: &[&str],
|
||||||
|
allowed: &[&str],
|
||||||
|
) {
|
||||||
|
if let Some(table) = table_at(parsed_toml, path) {
|
||||||
|
push_unknown_keys(
|
||||||
|
unknown,
|
||||||
|
known_for_suggestion,
|
||||||
|
&path.join("."),
|
||||||
|
table,
|
||||||
|
allowed,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn check_nested_table_value(
|
||||||
|
unknown: &mut Vec<UnknownConfigKey>,
|
||||||
|
known_for_suggestion: &[&'static str],
|
||||||
|
path: String,
|
||||||
|
value: &toml::Value,
|
||||||
|
allowed: &[&str],
|
||||||
|
) {
|
||||||
|
if let Some(table) = value.as_table() {
|
||||||
|
push_unknown_keys(unknown, known_for_suggestion, &path, table, allowed);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
fn collect_unknown_config_keys(parsed_toml: &toml::Value) -> Vec<UnknownConfigKey> {
|
||||||
|
let known_for_suggestion = known_config_keys_for_suggestion();
|
||||||
|
let mut unknown = Vec::new();
|
||||||
|
|
||||||
|
if let Some(root) = parsed_toml.as_table() {
|
||||||
|
push_unknown_keys(
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
"",
|
||||||
|
root,
|
||||||
|
TOP_LEVEL_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["general"],
|
||||||
|
GENERAL_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["general", "modes"],
|
||||||
|
PROXY_MODES_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["general", "telemetry"],
|
||||||
|
TELEMETRY_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["general", "links"],
|
||||||
|
LINKS_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["logging"],
|
||||||
|
LOGGING_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["network"],
|
||||||
|
NETWORK_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["server"],
|
||||||
|
SERVER_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["server", "api"],
|
||||||
|
API_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["server", "admin_api"],
|
||||||
|
API_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["server", "conntrack_control"],
|
||||||
|
CONNTRACK_CONTROL_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["timeouts"],
|
||||||
|
TIMEOUTS_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["censorship"],
|
||||||
|
CENSORSHIP_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["censorship", "tls_fetch"],
|
||||||
|
TLS_FETCH_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
check_known_table(
|
||||||
|
parsed_toml,
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
&["access"],
|
||||||
|
ACCESS_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
|
||||||
|
if let Some(listeners) = table_at(parsed_toml, &["server"])
|
||||||
|
.and_then(|table| table.get("listeners"))
|
||||||
|
.and_then(toml::Value::as_array)
|
||||||
|
{
|
||||||
|
for (idx, listener) in listeners.iter().enumerate() {
|
||||||
|
check_nested_table_value(
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
format!("server.listeners[{idx}]"),
|
||||||
|
listener,
|
||||||
|
LISTENER_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if let Some(upstreams) = parsed_toml.get("upstreams").and_then(toml::Value::as_array) {
|
||||||
|
for (idx, upstream) in upstreams.iter().enumerate() {
|
||||||
|
check_nested_table_value(
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
format!("upstreams[{idx}]"),
|
||||||
|
upstream,
|
||||||
|
UPSTREAM_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
for access_map in ["user_rate_limits", "cidr_rate_limits"] {
|
||||||
|
if let Some(table) = table_at(parsed_toml, &["access"])
|
||||||
|
.and_then(|access| access.get(access_map))
|
||||||
|
.and_then(toml::Value::as_table)
|
||||||
|
{
|
||||||
|
for (entry_name, value) in table {
|
||||||
|
check_nested_table_value(
|
||||||
|
&mut unknown,
|
||||||
|
&known_for_suggestion,
|
||||||
|
format!("access.{access_map}.{entry_name}"),
|
||||||
|
value,
|
||||||
|
RATE_LIMIT_BPS_CONFIG_KEYS,
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
unknown
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn handle_unknown_config_keys(parsed_toml: &toml::Value) -> Result<()> {
|
||||||
|
let unknown = collect_unknown_config_keys(parsed_toml);
|
||||||
|
if unknown.is_empty() {
|
||||||
|
return Ok(());
|
||||||
|
}
|
||||||
|
|
||||||
|
for item in &unknown {
|
||||||
|
if let Some(suggestion) = item.suggestion.as_deref() {
|
||||||
|
warn!(
|
||||||
|
key = %item.path,
|
||||||
|
suggestion = %suggestion,
|
||||||
|
"Unknown config key ignored; did you mean the suggested key?"
|
||||||
|
);
|
||||||
|
} else {
|
||||||
|
warn!(key = %item.path, "Unknown config key ignored");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if is_strict_config(parsed_toml) {
|
||||||
|
let mut paths = Vec::with_capacity(unknown.len());
|
||||||
|
for item in unknown {
|
||||||
|
if let Some(suggestion) = item.suggestion {
|
||||||
|
paths.push(format!("{} (did you mean `{}`?)", item.path, suggestion));
|
||||||
|
} else {
|
||||||
|
paths.push(item.path);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return Err(ProxyError::Config(format!(
|
||||||
|
"unknown config keys are not allowed when general.config_strict=true: {}",
|
||||||
|
paths.join(", ")
|
||||||
|
)));
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
@@ -0,0 +1,111 @@
|
|||||||
|
use shadowsocks::config::ServerConfig as ShadowsocksServerConfig;
|
||||||
|
use tracing::warn;
|
||||||
|
|
||||||
|
use crate::error::{ProxyError, Result};
|
||||||
|
|
||||||
|
use super::super::types::{LoggingConfig, LoggingDestination, NetworkConfig, UpstreamType};
|
||||||
|
use super::ProxyConfig;
|
||||||
|
|
||||||
|
pub(super) fn validate_network_cfg(net: &mut NetworkConfig) -> Result<()> {
|
||||||
|
if !net.ipv4 && matches!(net.ipv6, Some(false)) {
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"Both ipv4 and ipv6 are disabled in [network]".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
if net.prefer != 4 && net.prefer != 6 {
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"network.prefer must be 4 or 6".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
if !net.ipv4 && net.prefer == 4 {
|
||||||
|
warn!("prefer=4 but ipv4=false; forcing prefer=6");
|
||||||
|
net.prefer = 6;
|
||||||
|
}
|
||||||
|
|
||||||
|
if matches!(net.ipv6, Some(false)) && net.prefer == 6 {
|
||||||
|
warn!("prefer=6 but ipv6=false; forcing prefer=4");
|
||||||
|
net.prefer = 4;
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn validate_logging_config(logging: &LoggingConfig) -> Result<()> {
|
||||||
|
if let Some(path) = logging.path.as_ref()
|
||||||
|
&& path.trim().is_empty()
|
||||||
|
{
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"logging.path cannot be empty when provided".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
if matches!(logging.destination, LoggingDestination::File) && logging.path.is_none() {
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"logging.path must be set when logging.destination=\"file\"".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn validate_upstreams(config: &ProxyConfig) -> Result<()> {
|
||||||
|
let has_enabled_shadowsocks = config.upstreams.iter().any(|upstream| {
|
||||||
|
upstream.enabled && matches!(upstream.upstream_type, UpstreamType::Shadowsocks { .. })
|
||||||
|
});
|
||||||
|
|
||||||
|
if has_enabled_shadowsocks && config.general.use_middle_proxy {
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"shadowsocks upstreams require general.use_middle_proxy = false".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
for upstream in &config.upstreams {
|
||||||
|
if matches!(upstream.ipv4, Some(false)) && matches!(upstream.ipv6, Some(false)) {
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"upstream.ipv4 and upstream.ipv6 cannot both be false".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
if let Some(prefer) = upstream.prefer
|
||||||
|
&& prefer != 4
|
||||||
|
&& prefer != 6
|
||||||
|
{
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"upstream.prefer must be 4 or 6".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
|
||||||
|
if let UpstreamType::Shadowsocks { url, .. } = &upstream.upstream_type {
|
||||||
|
let parsed = ShadowsocksServerConfig::from_url(url)
|
||||||
|
.map_err(|error| ProxyError::Config(format!("invalid shadowsocks url: {error}")))?;
|
||||||
|
if parsed.plugin().is_some() {
|
||||||
|
return Err(ProxyError::Config(
|
||||||
|
"shadowsocks plugins are not supported".to_string(),
|
||||||
|
));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Ok(())
|
||||||
|
}
|
||||||
|
|
||||||
|
pub(super) fn normalize_upstream_family_policy(config: &mut ProxyConfig) {
|
||||||
|
for (idx, upstream) in config.upstreams.iter_mut().enumerate() {
|
||||||
|
if matches!(upstream.ipv4, Some(false)) && upstream.prefer == Some(4) {
|
||||||
|
warn!(
|
||||||
|
upstream = idx,
|
||||||
|
"upstream.prefer=4 but upstream.ipv4=false; forcing prefer=6"
|
||||||
|
);
|
||||||
|
upstream.prefer = Some(6);
|
||||||
|
}
|
||||||
|
|
||||||
|
if matches!(upstream.ipv6, Some(false)) && upstream.prefer == Some(6) {
|
||||||
|
warn!(
|
||||||
|
upstream = idx,
|
||||||
|
"upstream.prefer=6 but upstream.ipv6=false; forcing prefer=4"
|
||||||
|
);
|
||||||
|
upstream.prefer = Some(4);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user