astelm/telemt
1
0
Fork 0
mirror of https://github.com/telemt/telemt.git synced 2026-09-10 12:34:11 +03:00
Code Issues Packages Projects Releases Wiki Activity

Carrier negotiation + WebSocket lifecycle

Browse Source 
Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>
This commit is contained in:
Alexey
2026-08-27 07:38:42 +03:00
parent 80a2737eed
commit c75cf5cc9d
28 changed files with 1411 additions and 1320 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/http/request.rs
+12 -285
View File
@@ -140,6 +140,11 @@ pub(super) fn carrier_request<B>(request: &Request<B>, host: &str) -> Option<Car
}
(Some(capabilities), Some(attempt)) => {
let capabilities = parse_capabilities(capabilities)?;
let capabilities = if native_ios {
capabilities.intersection(CarrierCapabilities::ios())?
} else {
capabilities
};
if (attempt == 1) != failure.is_none() {
return None;
}
@@ -156,15 +161,14 @@ pub(super) fn carrier_request<B>(request: &Request<B>, host: &str) -> Option<Car
))
}
(None, Some(attempt)) if strict_browser_hint(request, host) => {
if native_ios {
return None;
}
if (attempt == 1) != failure.is_none() {
return None;
}
Some(CarrierRequest::automatic(
if native_ios {
CarrierClientClass::Ios
} else {
CarrierClientClass::BrowserHint
},
CarrierClientClass::BrowserHint,
CarrierCapabilities::all(),
attempt,
failure,
@@ -259,284 +263,7 @@ fn single_header<B>(request: &Request<B>, name: impl header::AsHeaderName) -> Op
values.next().is_none().then_some(value)
}
// Canonical request parsing and client-classification tests.
#[cfg(test)]
mod tests {
use super::*;
use ipnetwork::IpNetwork;
use crate::config::{WebCarrier, WebClientIpSource};
#[test]
fn canonical_bridge_query_rejects_aliases() {
let token = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode([7u8; 32]);
assert!(bridge_candidate(Some(&format!("bridge={token}"))).1);
assert!(!bridge_candidate(Some(&format!("x=1&bridge={token}"))).1);
assert!(!bridge_candidate(Some(&format!("bridge={token}="))).1);
}
#[test]
fn host_is_canonical_and_forwarded_identity_is_single_parseable_ip() {
let request = Request::builder()
.header(header::HOST, "proxy.example.com:443")
.header("x-forwarded-for", "192.0.2.10")
.body(())
.unwrap();
assert_eq!(canonical_request_host(&request), Some("proxy.example.com"));
let trusted: [IpNetwork; 1] = ["127.0.0.1/32".parse().unwrap()];
assert_eq!(
client_ip(
&request,
"127.0.0.1:40000".parse().unwrap(),
WebClientIpSource::XForwardedFor,
&trusted,
),
Some("192.0.2.10".parse().unwrap())
);
let expanded_ipv6 = Request::builder()
.header("x-forwarded-for", "2001:0db8:0:0:0:0:0:10")
.body(())
.unwrap();
assert_eq!(
client_ip(
&expanded_ipv6,
"127.0.0.1:40000".parse().unwrap(),
WebClientIpSource::XForwardedFor,
&trusted,
),
Some("2001:db8::10".parse().unwrap())
);
let without_forwarded_address = Request::builder().body(()).unwrap();
assert_eq!(
client_ip(
&without_forwarded_address,
"127.0.0.1:40000".parse().unwrap(),
WebClientIpSource::XForwardedFor,
&trusted,
),
Some("127.0.0.1".parse().unwrap())
);
let empty_forwarded_address = Request::builder()
.header("x-forwarded-for", "")
.body(())
.unwrap();
assert_eq!(
client_ip(
&empty_forwarded_address,
"127.0.0.1:40000".parse().unwrap(),
WebClientIpSource::XForwardedFor,
&trusted,
),
Some("127.0.0.1".parse().unwrap())
);
let uppercase = Request::builder()
.header(header::HOST, "Proxy.Example.com")
.body(())
.unwrap();
assert!(canonical_request_host(&uppercase).is_none());
let appended = Request::builder()
.header("x-forwarded-for", "192.0.2.10, 198.51.100.4")
.body(())
.unwrap();
assert!(
client_ip(
&appended,
"127.0.0.1:40000".parse().unwrap(),
WebClientIpSource::XForwardedFor,
&trusted,
)
.is_none()
);
}
#[test]
fn bearer_and_sequence_headers_reject_noncanonical_aliases() {
let token = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode([1u8; 32]);
let request = Request::builder()
.header(header::AUTHORIZATION, format!("Bearer {token}"))
.header("x-up-seq", "17")
.body(())
.unwrap();
assert_eq!(
bearer_token_hash(&request),
Some(Sha256::digest([1u8; 32]).into())
);
assert_eq!(canonical_u64_header(&request, "x-up-seq"), Some(17));
let leading_zero = Request::builder()
.header("x-up-seq", "017")
.body(())
.unwrap();
assert!(canonical_u64_header(&leading_zero, "x-up-seq").is_none());
}
#[test]
fn cookie_header_accepts_only_absent_or_one_empty_value() {
let absent = Request::new(());
assert!(compatible_cookie_header(&absent));
let empty = Request::builder()
.header(header::COOKIE, "")
.body(())
.unwrap();
assert!(compatible_cookie_header(&empty));
let nonempty = Request::builder()
.header(header::COOKIE, "state=unexpected")
.body(())
.unwrap();
assert!(!compatible_cookie_header(&nonempty));
let whitespace = Request::builder()
.header(header::COOKIE, " ")
.body(())
.unwrap();
assert!(!compatible_cookie_header(&whitespace));
let mut duplicate_empty = Request::new(());
duplicate_empty
.headers_mut()
.append(header::COOKIE, "".parse().unwrap());
duplicate_empty
.headers_mut()
.append(header::COOKIE, "".parse().unwrap());
assert!(!compatible_cookie_header(&duplicate_empty));
let mut duplicate_mixed = Request::new(());
duplicate_mixed
.headers_mut()
.append(header::COOKIE, "".parse().unwrap());
duplicate_mixed
.headers_mut()
.append(header::COOKIE, "state=unexpected".parse().unwrap());
assert!(!compatible_cookie_header(&duplicate_mixed));
}
#[test]
fn carrier_metadata_is_canonical_and_legacy_safe() {
let automatic = Request::builder()
.header(
"x-carrier-capabilities",
"https,https-lanes,websocket,websocket-lanes",
)
.header("x-carrier-attempt", "2")
.header("x-carrier-failure", "timeout")
.header(header::USER_AGENT, "Example Browser")
.body(())
.unwrap();
let parsed = carrier_request(&automatic, "proxy.example.com").unwrap();
assert!(parsed.is_automatic());
assert_eq!(parsed.attempt(), Some(2));
assert_eq!(parsed.failure(), Some(CarrierFailure::Timeout));
let missing_failure = Request::builder()
.header(
"x-carrier-capabilities",
"https,https-lanes,websocket,websocket-lanes",
)
.header("x-carrier-attempt", "2")
.body(())
.unwrap();
assert!(carrier_request(&missing_failure, "proxy.example.com").is_none());
let legacy = Request::builder()
.header(header::USER_AGENT, "Native")
.body(())
.unwrap();
assert!(
!carrier_request(&legacy, "proxy.example.com")
.unwrap()
.is_automatic()
);
let reordered = Request::builder()
.header("x-carrier-capabilities", "websocket,https")
.header("x-carrier-attempt", "1")
.body(())
.unwrap();
assert!(carrier_request(&reordered, "proxy.example.com").is_none());
}
#[test]
fn native_ios_user_agent_classifies_without_overriding_capabilities() {
let metadata_free = Request::builder()
.header(
header::USER_AGENT,
"Telemt/1 CFNetwork/1498.700.2 Darwin/23.6.0",
)
.body(())
.unwrap();
let parsed = carrier_request(&metadata_free, "proxy.example.com").unwrap();
assert_eq!(parsed.class(), CarrierClientClass::Ios);
assert!(!parsed.is_automatic());
assert!(!parsed.uses_capabilities());
let automatic = Request::builder()
.header("x-carrier-capabilities", "https,https-lanes")
.header("x-carrier-attempt", "1")
.header(
header::USER_AGENT,
"Telemt/1 CFNetwork/1498.700.2 Darwin/23.6.0",
)
.body(())
.unwrap();
let parsed = carrier_request(&automatic, "proxy.example.com").unwrap();
assert_eq!(parsed.class(), CarrierClientClass::Ios);
assert!(parsed.is_automatic());
assert!(parsed.supports(WebCarrier::Https));
assert!(parsed.supports(WebCarrier::HttpsLanes));
assert!(!parsed.supports(WebCarrier::Websocket));
assert!(!parsed.supports(WebCarrier::WebsocketLanes));
}
#[test]
fn mapped_private_addresses_are_not_learning_evidence() {
for address in ["::ffff:127.0.0.1", "::ffff:10.0.0.1"] {
let effective_ip = address.parse().unwrap();
let request = Request::builder()
.header("x-forwarded-for", address)
.body(())
.unwrap();
assert!(!carrier_ip_learning_eligible(&request, effective_ip));
}
let effective_ip = "::ffff:8.8.8.8".parse().unwrap();
let request = Request::builder()
.header("x-forwarded-for", "::ffff:8.8.8.8")
.body(())
.unwrap();
assert!(carrier_ip_learning_eligible(&request, effective_ip));
}
#[test]
fn strict_browser_metadata_recovers_a_stripped_capability_marker() {
let request = Request::builder()
.header("x-carrier-attempt", "1")
.header(header::ORIGIN, "https://proxy.example.com")
.header("sec-fetch-site", "same-origin")
.header("sec-fetch-mode", "cors")
.header("sec-fetch-dest", "empty")
.body(())
.unwrap();
let parsed = carrier_request(&request, "proxy.example.com").unwrap();
assert_eq!(parsed.class(), CarrierClientClass::BrowserHint);
}
#[test]
fn user_agent_learning_key_is_case_and_whitespace_normalized() {
let first = Request::builder()
.header(header::USER_AGENT, " Example\t Browser ")
.body(())
.unwrap();
let second = Request::builder()
.header(header::USER_AGENT, "example browser")
.body(())
.unwrap();
assert_eq!(
normalized_user_agent_hash(&first),
normalized_user_agent_hash(&second)
);
}
}
#[path = "request/tests.rs"]
mod tests;