mirror of
https://github.com/telemt/telemt.git
synced 2026-07-25 06:56:15 +03:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Vasiliy Batmaev
|
aee5e24dbd |
@@ -151,14 +151,6 @@ jobs:
|
||||
mkdir -p dist
|
||||
cp "target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}" dist/telemt
|
||||
|
||||
if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
|
||||
STRIP_BIN=aarch64-linux-gnu-strip
|
||||
else
|
||||
STRIP_BIN=strip
|
||||
fi
|
||||
|
||||
"${STRIP_BIN}" dist/telemt
|
||||
|
||||
cd dist
|
||||
tar -czf "${{ matrix.asset }}.tar.gz" \
|
||||
--owner=0 --group=0 --numeric-owner \
|
||||
@@ -287,14 +279,6 @@ jobs:
|
||||
mkdir -p dist
|
||||
cp "target/${{ matrix.target }}/release/${{ env.BINARY_NAME }}" dist/telemt
|
||||
|
||||
if [ "${{ matrix.target }}" = "aarch64-unknown-linux-musl" ]; then
|
||||
STRIP_BIN=aarch64-linux-musl-strip
|
||||
else
|
||||
STRIP_BIN=strip
|
||||
fi
|
||||
|
||||
"${STRIP_BIN}" dist/telemt
|
||||
|
||||
cd dist
|
||||
tar -czf "${{ matrix.asset }}.tar.gz" \
|
||||
--owner=0 --group=0 --numeric-owner \
|
||||
|
||||
Generated
+1
-1
@@ -2780,7 +2780,7 @@ checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
|
||||
|
||||
[[package]]
|
||||
name = "telemt"
|
||||
version = "3.3.38"
|
||||
version = "3.3.36"
|
||||
dependencies = [
|
||||
"aes",
|
||||
"anyhow",
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
[package]
|
||||
name = "telemt"
|
||||
version = "3.3.38"
|
||||
version = "3.3.36"
|
||||
edition = "2024"
|
||||
|
||||
[features]
|
||||
|
||||
@@ -3,9 +3,6 @@
|
||||
***Löst Probleme, bevor andere überhaupt wissen, dass sie existieren*** / ***It solves problems before others even realize they exist***
|
||||
|
||||
### [**Telemt Chat in Telegram**](https://t.me/telemtrs)
|
||||
#### Fixed TLS ClientHello is now available in Telegram Desktop starting from version 6.7.2: to work with EE-MTProxy, please update your client;
|
||||
#### Fixed TLS ClientHello for Telegram Android Client is available in [our chat](https://t.me/telemtrs/30234/36441); official releases for Android and iOS are "work in progress";
|
||||
|
||||
|
||||
**Telemt** is a fast, secure, and feature-rich server written in Rust: it fully implements the official Telegram proxy algo and adds many production-ready improvements such as:
|
||||
- [ME Pool + Reader/Writer + Registry + Refill + Adaptive Floor + Trio-State + Generation Lifecycle](https://github.com/telemt/telemt/blob/main/docs/model/MODEL.en.md)
|
||||
@@ -54,12 +51,8 @@
|
||||
- [FAQ EN](docs/FAQ.en.md)
|
||||
|
||||
### Recognizability for DPI and crawler
|
||||
|
||||
On April 1, 2026, we became aware of a method for detecting MTProxy Fake-TLS,
|
||||
based on the ECH extension and the ordering of cipher suites,
|
||||
as well as an overall unique JA3/JA4 fingerprint
|
||||
that does not occur in modern browsers:
|
||||
we have already submitted initial changes to the Telegram Desktop developers and are working on updates for other clients.
|
||||
Since version 1.1.0.0, we have debugged masking perfectly: for all clients without "presenting" a key,
|
||||
we transparently direct traffic to the target host!
|
||||
|
||||
- We consider this a breakthrough aspect, which has no stable analogues today
|
||||
- Based on this: if `telemt` configured correctly, **TLS mode is completely identical to real-life handshake + communication** with a specified host
|
||||
|
||||
+70
-181
@@ -14,10 +14,10 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`include`](#cfg-top-include) | `String` (special directive) | — |
|
||||
| [`include`](#cfg-top-include) | `String` (special directive) | `null` |
|
||||
| [`show_link`](#cfg-top-show_link) | `"*"` or `String[]` | `[]` (`ShowLink::None`) |
|
||||
| [`dc_overrides`](#cfg-top-dc_overrides) | `Map<String, String or String[]>` | `{}` |
|
||||
| [`default_dc`](#cfg-top-default_dc) | `u8` | — (effective fallback: `2` in ME routing) |
|
||||
| [`default_dc`](#cfg-top-default_dc) | `u8` or `null` | `null` (effective fallback: `2` in ME routing) |
|
||||
|
||||
<a id="cfg-top-include"></a>
|
||||
- `include`
|
||||
@@ -68,17 +68,17 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`data_path`](#cfg-general-data_path) | `String` | — |
|
||||
| [`data_path`](#cfg-general-data_path) | `String` or `null` | `null` |
|
||||
| [`prefer_ipv6`](#cfg-general-prefer_ipv6) | `bool` | `false` |
|
||||
| [`fast_mode`](#cfg-general-fast_mode) | `bool` | `true` |
|
||||
| [`use_middle_proxy`](#cfg-general-use_middle_proxy) | `bool` | `true` |
|
||||
| [`proxy_secret_path`](#cfg-general-proxy_secret_path) | `String` | `"proxy-secret"` |
|
||||
| [`proxy_config_v4_cache_path`](#cfg-general-proxy_config_v4_cache_path) | `String` | `"cache/proxy-config-v4.txt"` |
|
||||
| [`proxy_config_v6_cache_path`](#cfg-general-proxy_config_v6_cache_path) | `String` | `"cache/proxy-config-v6.txt"` |
|
||||
| [`ad_tag`](#cfg-general-ad_tag) | `String` | — |
|
||||
| [`middle_proxy_nat_ip`](#cfg-general-middle_proxy_nat_ip) | `IpAddr` | — |
|
||||
| [`proxy_secret_path`](#cfg-general-proxy_secret_path) | `String` or `null` | `"proxy-secret"` |
|
||||
| [`proxy_config_v4_cache_path`](#cfg-general-proxy_config_v4_cache_path) | `String` or `null` | `"cache/proxy-config-v4.txt"` |
|
||||
| [`proxy_config_v6_cache_path`](#cfg-general-proxy_config_v6_cache_path) | `String` or `null` | `"cache/proxy-config-v6.txt"` |
|
||||
| [`ad_tag`](#cfg-general-ad_tag) | `String` or `null` | `null` |
|
||||
| [`middle_proxy_nat_ip`](#cfg-general-middle_proxy_nat_ip) | `IpAddr` or `null` | `null` |
|
||||
| [`middle_proxy_nat_probe`](#cfg-general-middle_proxy_nat_probe) | `bool` | `true` |
|
||||
| [`middle_proxy_nat_stun`](#cfg-general-middle_proxy_nat_stun) | `String` | — |
|
||||
| [`middle_proxy_nat_stun`](#cfg-general-middle_proxy_nat_stun) | `String` or `null` | `null` |
|
||||
| [`middle_proxy_nat_stun_servers`](#cfg-general-middle_proxy_nat_stun_servers) | `String[]` | `[]` |
|
||||
| [`stun_nat_probe_concurrency`](#cfg-general-stun_nat_probe_concurrency) | `usize` | `8` |
|
||||
| [`middle_proxy_pool_size`](#cfg-general-middle_proxy_pool_size) | `usize` | `8` |
|
||||
@@ -144,7 +144,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
| [`upstream_unhealthy_fail_threshold`](#cfg-general-upstream_unhealthy_fail_threshold) | `u32` | `5` |
|
||||
| [`upstream_connect_failfast_hard_errors`](#cfg-general-upstream_connect_failfast_hard_errors) | `bool` | `false` |
|
||||
| [`stun_iface_mismatch_ignore`](#cfg-general-stun_iface_mismatch_ignore) | `bool` | `false` |
|
||||
| [`unknown_dc_log_path`](#cfg-general-unknown_dc_log_path) | `String` | `"unknown-dc.txt"` |
|
||||
| [`unknown_dc_log_path`](#cfg-general-unknown_dc_log_path) | `String` or `null` | `"unknown-dc.txt"` |
|
||||
| [`unknown_dc_file_log_enabled`](#cfg-general-unknown_dc_file_log_enabled) | `bool` | `false` |
|
||||
| [`log_level`](#cfg-general-log_level) | `"debug"`, `"verbose"`, `"normal"`, or `"silent"` | `"normal"` |
|
||||
| [`disable_colors`](#cfg-general-disable_colors) | `bool` | `false` |
|
||||
@@ -163,7 +163,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
| [`me_route_inline_recovery_attempts`](#cfg-general-me_route_inline_recovery_attempts) | `u32` | `3` |
|
||||
| [`me_route_inline_recovery_wait_ms`](#cfg-general-me_route_inline_recovery_wait_ms) | `u64` | `3000` |
|
||||
| [`fast_mode_min_tls_record`](#cfg-general-fast_mode_min_tls_record) | `usize` | `0` |
|
||||
| [`update_every`](#cfg-general-update_every) | `u64` | `300` |
|
||||
| [`update_every`](#cfg-general-update_every) | `u64` or `null` | `300` |
|
||||
| [`me_reinit_every_secs`](#cfg-general-me_reinit_every_secs) | `u64` | `900` |
|
||||
| [`me_hardswap_warmup_delay_min_ms`](#cfg-general-me_hardswap_warmup_delay_min_ms) | `u64` | `1000` |
|
||||
| [`me_hardswap_warmup_delay_max_ms`](#cfg-general-me_hardswap_warmup_delay_max_ms) | `u64` | `2000` |
|
||||
@@ -205,7 +205,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
|
||||
<a id="cfg-general-data_path"></a>
|
||||
- `data_path`
|
||||
- **Constraints / validation**: `String` (optional).
|
||||
- **Constraints / validation**: `String` or `null`.
|
||||
- **Description**: Optional runtime data directory path.
|
||||
- **Example**:
|
||||
|
||||
@@ -245,7 +245,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-proxy_secret_path"></a>
|
||||
- `proxy_secret_path`
|
||||
- **Constraints / validation**: `String`. When omitted, the default path is `"proxy-secret"`. Empty values are accepted by TOML/serde but will likely fail at runtime (invalid file path).
|
||||
- **Constraints / validation**: `String` or `null`. If `null`, the effective cache path is `"proxy-secret"`. Empty values are accepted but will likely fail at runtime (invalid file path).
|
||||
- **Description**: Path to Telegram infrastructure `proxy-secret` cache file used by ME handshake/RPC auth. Telemt always tries a fresh download from `https://core.telegram.org/getProxySecret` first, caches it to this path on success, and falls back to reading the cached file (any age) on download failure.
|
||||
- **Example**:
|
||||
|
||||
@@ -255,7 +255,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-proxy_config_v4_cache_path"></a>
|
||||
- `proxy_config_v4_cache_path`
|
||||
- **Constraints / validation**: `String`. When set, must not be empty/whitespace-only.
|
||||
- **Constraints / validation**: `String` or `null`. When set, must not be empty/whitespace-only.
|
||||
- **Description**: Optional disk cache path for raw `getProxyConfig` (IPv4) snapshot. At startup Telemt tries to fetch a fresh snapshot first; on fetch failure or empty snapshot it falls back to this cache file when present and non-empty.
|
||||
- **Example**:
|
||||
|
||||
@@ -265,7 +265,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-proxy_config_v6_cache_path"></a>
|
||||
- `proxy_config_v6_cache_path`
|
||||
- **Constraints / validation**: `String`. When set, must not be empty/whitespace-only.
|
||||
- **Constraints / validation**: `String` or `null`. When set, must not be empty/whitespace-only.
|
||||
- **Description**: Optional disk cache path for raw `getProxyConfigV6` (IPv6) snapshot. At startup Telemt tries to fetch a fresh snapshot first; on fetch failure or empty snapshot it falls back to this cache file when present and non-empty.
|
||||
- **Example**:
|
||||
|
||||
@@ -275,7 +275,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-ad_tag"></a>
|
||||
- `ad_tag`
|
||||
- **Constraints / validation**: `String` (optional). When set, must be exactly 32 hex characters; invalid values are disabled during config load.
|
||||
- **Constraints / validation**: `String` or `null`. When set, must be exactly 32 hex characters; invalid values are disabled during config load.
|
||||
- **Description**: Global fallback sponsored-channel `ad_tag` (used when user has no override in `access.user_ad_tags`). An all-zero tag is accepted but has no effect (and is warned about) until replaced with a real tag from `@MTProxybot`.
|
||||
- **Example**:
|
||||
|
||||
@@ -285,7 +285,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-middle_proxy_nat_ip"></a>
|
||||
- `middle_proxy_nat_ip`
|
||||
- **Constraints / validation**: `IpAddr` (optional).
|
||||
- **Constraints / validation**: `IpAddr` or `null`.
|
||||
- **Description**: Manual public NAT IP override used as ME address material when set.
|
||||
- **Example**:
|
||||
|
||||
@@ -967,8 +967,8 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-unknown_dc_log_path"></a>
|
||||
- `unknown_dc_log_path`
|
||||
- **Constraints / validation**: `String` (optional). Must be a safe path (no `..` components, parent directory must exist); unsafe paths are rejected at runtime.
|
||||
- **Description**: Log file path for unknown (non-standard) DC requests when `unknown_dc_file_log_enabled = true`. Omit this key to disable file logging.
|
||||
- **Constraints / validation**: `String` or `null`. Must be a safe path (no `..` components, parent directory must exist); unsafe paths are rejected at runtime.
|
||||
- **Description**: Log file path for unknown (non-standard) DC requests when `unknown_dc_file_log_enabled = true`. Set to `null` to disable file logging.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
@@ -1157,7 +1157,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-update_every"></a>
|
||||
- `update_every`
|
||||
- **Constraints / validation**: `u64` (seconds). If set, must be `> 0`. If this key is not explicitly set, legacy `proxy_secret_auto_reload_secs` and `proxy_config_auto_reload_secs` may be used (their effective minimum must be `> 0`).
|
||||
- **Constraints / validation**: `u64` (seconds) or `null`. If set, must be `> 0`. If `null`, legacy `proxy_secret_auto_reload_secs` and `proxy_config_auto_reload_secs` are used and their effective minimum must be `> 0`.
|
||||
- **Description**: Unified refresh interval for ME updater tasks (`getProxyConfig`, `getProxyConfigV6`, `getProxySecret`). When set, it overrides legacy proxy reload intervals.
|
||||
- **Example**:
|
||||
|
||||
@@ -1450,7 +1450,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-proxy_secret_auto_reload_secs"></a>
|
||||
- `proxy_secret_auto_reload_secs`
|
||||
- **Constraints / validation**: Deprecated. Use `general.update_every`. When `general.update_every` is not explicitly set, the effective legacy refresh interval is `min(proxy_secret_auto_reload_secs, proxy_config_auto_reload_secs)` and must be `> 0`.
|
||||
- **Constraints / validation**: Deprecated. Use `general.update_every`. When `general.update_every` is `null`, the effective legacy refresh interval is `min(proxy_secret_auto_reload_secs, proxy_config_auto_reload_secs)` and must be `> 0`.
|
||||
- **Description**: Deprecated legacy proxy-secret refresh interval. Used only when `general.update_every` is not set.
|
||||
- **Example**:
|
||||
|
||||
@@ -1463,7 +1463,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-proxy_config_auto_reload_secs"></a>
|
||||
- `proxy_config_auto_reload_secs`
|
||||
- **Constraints / validation**: Deprecated. Use `general.update_every`. When `general.update_every` is not explicitly set, the effective legacy refresh interval is `min(proxy_secret_auto_reload_secs, proxy_config_auto_reload_secs)` and must be `> 0`.
|
||||
- **Constraints / validation**: Deprecated. Use `general.update_every`. When `general.update_every` is `null`, the effective legacy refresh interval is `min(proxy_secret_auto_reload_secs, proxy_config_auto_reload_secs)` and must be `> 0`.
|
||||
- **Description**: Deprecated legacy ME config refresh interval. Used only when `general.update_every` is not set.
|
||||
- **Example**:
|
||||
|
||||
@@ -1624,8 +1624,8 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`show`](#cfg-general-links-show) | `"*"` or `String[]` | `"*"` |
|
||||
| [`public_host`](#cfg-general-links-public_host) | `String` | — |
|
||||
| [`public_port`](#cfg-general-links-public_port) | `u16` | — |
|
||||
| [`public_host`](#cfg-general-links-public_host) | `String` or `null` | `null` |
|
||||
| [`public_port`](#cfg-general-links-public_port) | `u16` or `null` | `null` |
|
||||
|
||||
<a id="cfg-general-links-show"></a>
|
||||
- `show`
|
||||
@@ -1641,7 +1641,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-links-public_host"></a>
|
||||
- `public_host`
|
||||
- **Constraints / validation**: `String` (optional).
|
||||
- **Constraints / validation**: `String` or `null`.
|
||||
- **Description**: Public hostname/IP override used for generated `tg://` links (overrides detected IP).
|
||||
- **Example**:
|
||||
|
||||
@@ -1651,7 +1651,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-general-links-public_port"></a>
|
||||
- `public_port`
|
||||
- **Constraints / validation**: `u16` (optional).
|
||||
- **Constraints / validation**: `u16` or `null`.
|
||||
- **Description**: Public port override used for generated `tg://` links (overrides `server.port`).
|
||||
- **Example**:
|
||||
|
||||
@@ -1708,7 +1708,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`ipv4`](#cfg-network-ipv4) | `bool` | `true` |
|
||||
| [`ipv6`](#cfg-network-ipv6) | `bool` | `false` |
|
||||
| [`ipv6`](#cfg-network-ipv6) | `bool` or `null` | `false` |
|
||||
| [`prefer`](#cfg-network-prefer) | `u8` | `4` |
|
||||
| [`multipath`](#cfg-network-multipath) | `bool` | `false` |
|
||||
| [`stun_use`](#cfg-network-stun_use) | `bool` | `true` |
|
||||
@@ -1730,8 +1730,8 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-network-ipv6"></a>
|
||||
- `ipv6`
|
||||
- **Constraints / validation**: `bool`.
|
||||
- **Description**: Enables/disables IPv6 networking. When omitted, defaults to `false`.
|
||||
- **Constraints / validation**: `bool` or `null`. `null` means "auto-detect IPv6 availability".
|
||||
- **Description**: Enables/disables IPv6 when explicitly set; when `null`, Telemt will auto-detect IPv6 availability at runtime.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
@@ -1741,6 +1741,9 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
|
||||
# or: disable IPv6 explicitly
|
||||
# ipv6 = false
|
||||
|
||||
# or: let Telemt auto-detect
|
||||
# ipv6 = null
|
||||
```
|
||||
<a id="cfg-network-prefer"></a>
|
||||
- `prefer`
|
||||
@@ -1839,16 +1842,16 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`port`](#cfg-server-port) | `u16` | `443` |
|
||||
| [`listen_addr_ipv4`](#cfg-server-listen_addr_ipv4) | `String` | `"0.0.0.0"` |
|
||||
| [`listen_addr_ipv6`](#cfg-server-listen_addr_ipv6) | `String` | `"::"` |
|
||||
| [`listen_unix_sock`](#cfg-server-listen_unix_sock) | `String` | — |
|
||||
| [`listen_unix_sock_perm`](#cfg-server-listen_unix_sock_perm) | `String` | — |
|
||||
| [`listen_tcp`](#cfg-server-listen_tcp) | `bool` | — (auto) |
|
||||
| [`listen_addr_ipv4`](#cfg-server-listen_addr_ipv4) | `String` or `null` | `"0.0.0.0"` |
|
||||
| [`listen_addr_ipv6`](#cfg-server-listen_addr_ipv6) | `String` or `null` | `"::"` |
|
||||
| [`listen_unix_sock`](#cfg-server-listen_unix_sock) | `String` or `null` | `null` |
|
||||
| [`listen_unix_sock_perm`](#cfg-server-listen_unix_sock_perm) | `String` or `null` | `null` |
|
||||
| [`listen_tcp`](#cfg-server-listen_tcp) | `bool` or `null` | `null` (auto) |
|
||||
| [`proxy_protocol`](#cfg-server-proxy_protocol) | `bool` | `false` |
|
||||
| [`proxy_protocol_header_timeout_ms`](#cfg-server-proxy_protocol_header_timeout_ms) | `u64` | `500` |
|
||||
| [`proxy_protocol_trusted_cidrs`](#cfg-server-proxy_protocol_trusted_cidrs) | `IpNetwork[]` | `[]` |
|
||||
| [`metrics_port`](#cfg-server-metrics_port) | `u16` | — |
|
||||
| [`metrics_listen`](#cfg-server-metrics_listen) | `String` | — |
|
||||
| [`metrics_port`](#cfg-server-metrics_port) | `u16` or `null` | `null` |
|
||||
| [`metrics_listen`](#cfg-server-metrics_listen) | `String` or `null` | `null` |
|
||||
| [`metrics_whitelist`](#cfg-server-metrics_whitelist) | `IpNetwork[]` | `["127.0.0.1/32", "::1/128"]` |
|
||||
| [`max_connections`](#cfg-server-max_connections) | `u32` | `10000` |
|
||||
| [`accept_permit_timeout_ms`](#cfg-server-accept_permit_timeout_ms) | `u64` | `250` |
|
||||
@@ -1865,8 +1868,8 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-listen_addr_ipv4"></a>
|
||||
- `listen_addr_ipv4`
|
||||
- **Constraints / validation**: `String` (optional). When set, must be a valid IPv4 address string.
|
||||
- **Description**: IPv4 bind address for TCP listener (omit this key to disable IPv4 bind).
|
||||
- **Constraints / validation**: `String` or `null`. When set, must be a valid IPv4 address string.
|
||||
- **Description**: IPv4 bind address for TCP listener (`null` disables IPv4 bind).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
@@ -1875,8 +1878,8 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-listen_addr_ipv6"></a>
|
||||
- `listen_addr_ipv6`
|
||||
- **Constraints / validation**: `String` (optional). When set, must be a valid IPv6 address string.
|
||||
- **Description**: IPv6 bind address for TCP listener (omit this key to disable IPv6 bind).
|
||||
- **Constraints / validation**: `String` or `null`. When set, must be a valid IPv6 address string.
|
||||
- **Description**: IPv6 bind address for TCP listener (`null` disables IPv6 bind).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
@@ -1885,7 +1888,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-listen_unix_sock"></a>
|
||||
- `listen_unix_sock`
|
||||
- **Constraints / validation**: `String` (optional). Must not be empty when set. Unix only.
|
||||
- **Constraints / validation**: `String` or `null`. Must not be empty when set. Unix only.
|
||||
- **Description**: Unix socket path for listener. When set, `server.listen_tcp` defaults to `false` (unless explicitly overridden).
|
||||
- **Example**:
|
||||
|
||||
@@ -1895,8 +1898,8 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-listen_unix_sock_perm"></a>
|
||||
- `listen_unix_sock_perm`
|
||||
- **Constraints / validation**: `String` (optional). When set, should be an octal permission string like `"0666"` or `"0777"`.
|
||||
- **Description**: Optional Unix socket file permissions applied after bind (chmod). When omitted, permissions are not changed (inherits umask).
|
||||
- **Constraints / validation**: `String` or `null`. When set, should be an octal permission string like `"0666"` or `"0777"`.
|
||||
- **Description**: Optional Unix socket file permissions applied after bind (chmod). `null` means "no change" (inherits umask).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
@@ -1906,7 +1909,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-listen_tcp"></a>
|
||||
- `listen_tcp`
|
||||
- **Constraints / validation**: `bool` (optional). When omitted, Telemt auto-detects:
|
||||
- **Constraints / validation**: `bool` or `null`. `null` means auto:
|
||||
- `true` when `listen_unix_sock` is not set
|
||||
- `false` when `listen_unix_sock` is set
|
||||
- **Description**: Explicit TCP listener enable/disable override.
|
||||
@@ -1954,7 +1957,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-metrics_port"></a>
|
||||
- `metrics_port`
|
||||
- **Constraints / validation**: `u16` (optional).
|
||||
- **Constraints / validation**: `u16` or `null`.
|
||||
- **Description**: Prometheus-compatible metrics endpoint port. When set, enables the metrics listener (bind behavior can be overridden by `metrics_listen`).
|
||||
- **Example**:
|
||||
|
||||
@@ -1964,7 +1967,7 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
```
|
||||
<a id="cfg-server-metrics_listen"></a>
|
||||
- `metrics_listen`
|
||||
- **Constraints / validation**: `String` (optional). When set, must be in `IP:PORT` format.
|
||||
- **Constraints / validation**: `String` or `null`. When set, must be in `IP:PORT` format.
|
||||
- **Description**: Full metrics bind address (`IP:PORT`), overrides `metrics_port` and binds on the specified address only.
|
||||
- **Example**:
|
||||
|
||||
@@ -2007,105 +2010,6 @@ This document lists all configuration keys accepted by `config.toml`.
|
||||
|
||||
Note: When `server.proxy_protocol` is enabled, incoming PROXY protocol headers are parsed from the first bytes of the connection and the client source address is replaced with `src_addr` from the header. For security, the peer source IP (the direct connection address) is verified against `server.proxy_protocol_trusted_cidrs`; if this list is empty, PROXY headers are rejected and the connection is considered untrusted.
|
||||
|
||||
## [server.conntrack_control]
|
||||
|
||||
Note: The conntrack-control worker runs **only on Linux**. On other operating systems it is not started; if `inline_conntrack_control` is `true`, a warning is logged. Effective operation also requires **CAP_NET_ADMIN** and a usable backend (`nft` or `iptables` / `ip6tables` on `PATH`). The `conntrack` utility is used for optional table entry deletes under pressure.
|
||||
|
||||
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`inline_conntrack_control`](#cfg-server-conntrack_control-inline_conntrack_control) | `bool` | `true` |
|
||||
| [`mode`](#cfg-server-conntrack_control-mode) | `String` | `"tracked"` |
|
||||
| [`backend`](#cfg-server-conntrack_control-backend) | `String` | `"auto"` |
|
||||
| [`profile`](#cfg-server-conntrack_control-profile) | `String` | `"balanced"` |
|
||||
| [`hybrid_listener_ips`](#cfg-server-conntrack_control-hybrid_listener_ips) | `IpAddr[]` | `[]` |
|
||||
| [`pressure_high_watermark_pct`](#cfg-server-conntrack_control-pressure_high_watermark_pct) | `u8` | `85` |
|
||||
| [`pressure_low_watermark_pct`](#cfg-server-conntrack_control-pressure_low_watermark_pct) | `u8` | `70` |
|
||||
| [`delete_budget_per_sec`](#cfg-server-conntrack_control-delete_budget_per_sec) | `u64` | `4096` |
|
||||
|
||||
<a id="cfg-server-conntrack_control-inline_conntrack_control"></a>
|
||||
- `inline_conntrack_control`
|
||||
- **Constraints / validation**: `bool`.
|
||||
- **Description**: Master switch for the runtime conntrack-control task: reconciles **raw/notrack** netfilter rules for listener ingress (see `mode`), samples load every second, and may run **`conntrack -D`** deletes for qualifying close events while **pressure mode** is active (see `delete_budget_per_sec`). When `false`, notrack rules are cleared and pressure-driven deletes are disabled.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
inline_conntrack_control = true
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-mode"></a>
|
||||
- `mode`
|
||||
- **Constraints / validation**: One of `tracked`, `notrack`, `hybrid` (case-insensitive; serialized lowercase).
|
||||
- **Description**: **`tracked`**: do not install telemt notrack rules (connections stay in conntrack). **`notrack`**: mark matching ingress TCP to `server.port` as notrack — targets are derived from `[[server.listeners]]` if any, otherwise from `server.listen_addr_ipv4` / `server.listen_addr_ipv6` (unspecified addresses mean “any” for that family). **`hybrid`**: notrack only for addresses listed in `hybrid_listener_ips` (must be non-empty; validated at load).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
mode = "notrack"
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-backend"></a>
|
||||
- `backend`
|
||||
- **Constraints / validation**: One of `auto`, `nftables`, `iptables` (case-insensitive; serialized lowercase).
|
||||
- **Description**: Which command set applies notrack rules. **`auto`**: use `nft` if present on `PATH`, else `iptables`/`ip6tables` if present. **`nftables`** / **`iptables`**: force that backend; missing binary means rules cannot be applied. The nft path uses table `inet telemt_conntrack` and a prerouting raw hook; iptables uses chain `TELEMT_NOTRACK` in the `raw` table.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
backend = "auto"
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-profile"></a>
|
||||
- `profile`
|
||||
- **Constraints / validation**: One of `conservative`, `balanced`, `aggressive` (case-insensitive; serialized lowercase).
|
||||
- **Description**: When **conntrack pressure mode** is active (`pressure_*` watermarks), caps idle and activity timeouts to reduce conntrack churn: e.g. **client first-byte idle** (`client.rs`), **direct relay activity timeout** (`direct_relay.rs`), and **middle-relay idle policy** caps (`middle_relay.rs` via `ConntrackPressureProfile::*_cap_secs` / `direct_activity_timeout_secs`). More aggressive profiles use shorter caps.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
profile = "balanced"
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-hybrid_listener_ips"></a>
|
||||
- `hybrid_listener_ips`
|
||||
- **Constraints / validation**: `IpAddr[]`. Required to be **non-empty** when `mode = "hybrid"`. Ignored for `tracked` / `notrack`.
|
||||
- **Description**: Explicit listener addresses that receive notrack rules in hybrid mode (split into IPv4 vs IPv6 rules by the implementation).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
mode = "hybrid"
|
||||
hybrid_listener_ips = ["203.0.113.10", "2001:db8::1"]
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-pressure_high_watermark_pct"></a>
|
||||
- `pressure_high_watermark_pct`
|
||||
- **Constraints / validation**: Must be within `[1, 100]`.
|
||||
- **Description**: Pressure mode **enters** when any of: connection fill vs `server.max_connections` (percentage, if `max_connections > 0`), **file-descriptor** usage vs process soft `RLIMIT_NOFILE`, **non-zero** `accept_permit_timeout` events in the last sample window, or **ME c2me send-full** counter delta. Entry compares relevant percentages against this high watermark (see `update_pressure_state` in `conntrack_control.rs`).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
pressure_high_watermark_pct = 85
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-pressure_low_watermark_pct"></a>
|
||||
- `pressure_low_watermark_pct`
|
||||
- **Constraints / validation**: Must be **strictly less than** `pressure_high_watermark_pct`.
|
||||
- **Description**: Pressure mode **clears** only after **three** consecutive one-second samples where all signals are at or below this low watermark and the accept-timeout / ME-queue deltas are zero (hysteresis).
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
pressure_low_watermark_pct = 70
|
||||
```
|
||||
<a id="cfg-server-conntrack_control-delete_budget_per_sec"></a>
|
||||
- `delete_budget_per_sec`
|
||||
- **Constraints / validation**: Must be `> 0`.
|
||||
- **Description**: Maximum number of **`conntrack -D`** attempts **per second** while pressure mode is active (token bucket refilled each second). Deletes run only for close events with reasons **timeout**, **pressure**, or **reset**; each attempt consumes a token regardless of outcome.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[server.conntrack_control]
|
||||
delete_budget_per_sec = 4096
|
||||
```
|
||||
|
||||
|
||||
## [server.api]
|
||||
|
||||
Note: This section also accepts the legacy alias `[server.admin_api]` (same schema as `[server.api]`).
|
||||
@@ -2254,9 +2158,9 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
| Key | Type | Default |
|
||||
| --- | ---- | ------- |
|
||||
| [`ip`](#cfg-server-listeners-ip) | `IpAddr` | — |
|
||||
| [`announce`](#cfg-server-listeners-announce) | `String` | — |
|
||||
| [`announce_ip`](#cfg-server-listeners-announce_ip) | `IpAddr` | — |
|
||||
| [`proxy_protocol`](#cfg-server-listeners-proxy_protocol) | `bool` | — |
|
||||
| [`announce`](#cfg-server-listeners-announce) | `String` or `null` | — |
|
||||
| [`announce_ip`](#cfg-server-listeners-announce_ip) | `IpAddr` or `null` | — |
|
||||
| [`proxy_protocol`](#cfg-server-listeners-proxy_protocol) | `bool` or `null` | `null` |
|
||||
| [`reuse_allow`](#cfg-server-listeners-reuse_allow) | `bool` | `false` |
|
||||
|
||||
<a id="cfg-server-listeners-ip"></a>
|
||||
@@ -2271,7 +2175,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
```
|
||||
<a id="cfg-server-listeners-announce"></a>
|
||||
- `announce`
|
||||
- **Constraints / validation**: `String` (optional). Must not be empty when set.
|
||||
- **Constraints / validation**: `String` or `null`. Must not be empty when set.
|
||||
- **Description**: Public IP/domain announced in proxy links for this listener. Takes precedence over `announce_ip`.
|
||||
- **Example**:
|
||||
|
||||
@@ -2282,7 +2186,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
```
|
||||
<a id="cfg-server-listeners-announce_ip"></a>
|
||||
- `announce_ip`
|
||||
- **Constraints / validation**: `IpAddr` (optional). Deprecated. Use `announce`.
|
||||
- **Constraints / validation**: `IpAddr` or `null`. Deprecated. Use `announce`.
|
||||
- **Description**: Deprecated legacy announce IP. During config load it is migrated to `announce` when `announce` is not set.
|
||||
- **Example**:
|
||||
|
||||
@@ -2293,7 +2197,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
```
|
||||
<a id="cfg-server-listeners-proxy_protocol"></a>
|
||||
- `proxy_protocol`
|
||||
- **Constraints / validation**: `bool` (optional). When set, overrides `server.proxy_protocol` for this listener.
|
||||
- **Constraints / validation**: `bool` or `null`. When set, overrides `server.proxy_protocol` for this listener.
|
||||
- **Description**: Per-listener PROXY protocol override.
|
||||
- **Example**:
|
||||
|
||||
@@ -2447,9 +2351,9 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
| [`tls_fetch_scope`](#cfg-censorship-tls_fetch_scope) | `String` | `""` |
|
||||
| [`tls_fetch`](#cfg-censorship-tls_fetch) | `Table` | built-in defaults |
|
||||
| [`mask`](#cfg-censorship-mask) | `bool` | `true` |
|
||||
| [`mask_host`](#cfg-censorship-mask_host) | `String` | — |
|
||||
| [`mask_host`](#cfg-censorship-mask_host) | `String` or `null` | `null` |
|
||||
| [`mask_port`](#cfg-censorship-mask_port) | `u16` | `443` |
|
||||
| [`mask_unix_sock`](#cfg-censorship-mask_unix_sock) | `String` | — |
|
||||
| [`mask_unix_sock`](#cfg-censorship-mask_unix_sock) | `String` or `null` | `null` |
|
||||
| [`fake_cert_len`](#cfg-censorship-fake_cert_len) | `usize` | `2048` |
|
||||
| [`tls_emulation`](#cfg-censorship-tls_emulation) | `bool` | `true` |
|
||||
| [`tls_front_dir`](#cfg-censorship-tls_front_dir) | `String` | `"tlsfront"` |
|
||||
@@ -2536,8 +2440,8 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
```
|
||||
<a id="cfg-censorship-mask_host"></a>
|
||||
- `mask_host`
|
||||
- **Constraints / validation**: `String` (optional).
|
||||
- If `mask_unix_sock` is set, `mask_host` must be omitted (mutually exclusive).
|
||||
- **Constraints / validation**: `String` or `null`.
|
||||
- If `mask_unix_sock` is set, `mask_host` must be `null` (mutually exclusive).
|
||||
- If `mask_host` is not set and `mask_unix_sock` is not set, Telemt defaults `mask_host` to `tls_domain`.
|
||||
- **Description**: Upstream mask host for TLS fronting relay.
|
||||
- **Example**:
|
||||
@@ -2558,7 +2462,7 @@ Note: This section also accepts the legacy alias `[server.admin_api]` (same sche
|
||||
```
|
||||
<a id="cfg-censorship-mask_unix_sock"></a>
|
||||
- `mask_unix_sock`
|
||||
- **Constraints / validation**: `String` (optional).
|
||||
- **Constraints / validation**: `String` or `null`.
|
||||
- Must not be empty when set.
|
||||
- Unix only; rejected on non-Unix platforms.
|
||||
- On Unix, must be \(\le 107\) bytes (path length limit).
|
||||
@@ -2978,7 +2882,6 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
| [`users`](#cfg-access-users) | `Map<String, String>` | `{"default": "000…000"}` |
|
||||
| [`user_ad_tags`](#cfg-access-user_ad_tags) | `Map<String, String>` | `{}` |
|
||||
| [`user_max_tcp_conns`](#cfg-access-user_max_tcp_conns) | `Map<String, usize>` | `{}` |
|
||||
| [`user_max_tcp_conns_global_each`](#cfg-access-user_max_tcp_conns_global_each) | `usize` | `0` |
|
||||
| [`user_expirations`](#cfg-access-user_expirations) | `Map<String, DateTime<Utc>>` | `{}` |
|
||||
| [`user_data_quota`](#cfg-access-user_data_quota) | `Map<String, u64>` | `{}` |
|
||||
| [`user_max_unique_ips`](#cfg-access-user_max_unique_ips) | `Map<String, usize>` | `{}` |
|
||||
@@ -3023,20 +2926,6 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
[access.user_max_tcp_conns]
|
||||
alice = 500
|
||||
```
|
||||
<a id="cfg-access-user_max_tcp_conns_global_each"></a>
|
||||
- `user_max_tcp_conns_global_each`
|
||||
- **Constraints / validation**: `usize`. `0` disables the inherited limit.
|
||||
- **Description**: Global per-user maximum concurrent TCP connections, applied when a user has **no positive** entry in `[access.user_max_tcp_conns]` (a missing key, or a value of `0`, both fall through to this setting). Per-user limits greater than `0` in `user_max_tcp_conns` take precedence.
|
||||
- **Example**:
|
||||
|
||||
```toml
|
||||
[access]
|
||||
user_max_tcp_conns_global_each = 200
|
||||
|
||||
[access.user_max_tcp_conns]
|
||||
alice = 500 # uses 500, not the global cap
|
||||
# bob has no entry → uses 200
|
||||
```
|
||||
<a id="cfg-access-user_expirations"></a>
|
||||
- `user_expirations`
|
||||
- **Constraints / validation**: `Map<String, DateTime<Utc>>`. Each value must be a valid RFC3339 / ISO-8601 datetime.
|
||||
@@ -3138,13 +3027,13 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
| [`weight`](#cfg-upstreams-weight) | `u16` | `1` |
|
||||
| [`enabled`](#cfg-upstreams-enabled) | `bool` | `true` |
|
||||
| [`scopes`](#cfg-upstreams-scopes) | `String` | `""` |
|
||||
| [`interface`](#cfg-upstreams-interface) | `String` | — |
|
||||
| [`bind_addresses`](#cfg-upstreams-bind_addresses) | `String[]` | — |
|
||||
| [`interface`](#cfg-upstreams-interface) | `String` or `null` | `null` |
|
||||
| [`bind_addresses`](#cfg-upstreams-bind_addresses) | `String[]` or `null` | `null` |
|
||||
| [`url`](#cfg-upstreams-url) | `String` | — |
|
||||
| [`address`](#cfg-upstreams-address) | `String` | — |
|
||||
| [`user_id`](#cfg-upstreams-user_id) | `String` | — |
|
||||
| [`username`](#cfg-upstreams-username) | `String` | — |
|
||||
| [`password`](#cfg-upstreams-password) | `String` | — |
|
||||
| [`user_id`](#cfg-upstreams-user_id) | `String` or `null` | `null` |
|
||||
| [`username`](#cfg-upstreams-username) | `String` or `null` | `null` |
|
||||
| [`password`](#cfg-upstreams-password) | `String` or `null` | `null` |
|
||||
|
||||
<a id="cfg-upstreams-type"></a>
|
||||
- `type`
|
||||
@@ -3201,7 +3090,7 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
```
|
||||
<a id="cfg-upstreams-interface"></a>
|
||||
- `interface`
|
||||
- **Constraints / validation**: `String` (optional).
|
||||
- **Constraints / validation**: `String` or `null`.
|
||||
- For `"direct"`: may be an IP address (used as explicit local bind) or an OS interface name (resolved to an IP at runtime; Unix only).
|
||||
- For `"socks4"`/`"socks5"`: supported only when `address` is an `IP:port` literal; when `address` is a hostname, interface binding is ignored.
|
||||
- For `"shadowsocks"`: passed to the shadowsocks connector as an optional outbound bind hint.
|
||||
@@ -3220,7 +3109,7 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
```
|
||||
<a id="cfg-upstreams-bind_addresses"></a>
|
||||
- `bind_addresses`
|
||||
- **Constraints / validation**: `String[]` (optional). Applies only to `type = "direct"`.
|
||||
- **Constraints / validation**: `String[]` or `null`. Applies only to `type = "direct"`.
|
||||
- Each entry should be an IP address string.
|
||||
- At runtime, Telemt selects an address that matches the target family (IPv4 vs IPv6). If `bind_addresses` is set and none match the target family, the connect attempt fails.
|
||||
- **Description**: Explicit local source addresses for outgoing direct TCP connects. When multiple addresses are provided, selection is round-robin.
|
||||
@@ -3261,7 +3150,7 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
```
|
||||
<a id="cfg-upstreams-user_id"></a>
|
||||
- `user_id`
|
||||
- **Constraints / validation**: `String` (optional). Only for `type = "socks4"`.
|
||||
- **Constraints / validation**: `String` or `null`. Only for `type = "socks4"`.
|
||||
- **Description**: SOCKS4 CONNECT user ID. Note: when a request scope is selected, Telemt may override this with the selected scope value.
|
||||
- **Example**:
|
||||
|
||||
@@ -3273,7 +3162,7 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
```
|
||||
<a id="cfg-upstreams-username"></a>
|
||||
- `username`
|
||||
- **Constraints / validation**: `String` (optional). Only for `type = "socks5"`.
|
||||
- **Constraints / validation**: `String` or `null`. Only for `type = "socks5"`.
|
||||
- **Description**: SOCKS5 username (for username/password authentication). Note: when a request scope is selected, Telemt may override this with the selected scope value.
|
||||
- **Example**:
|
||||
|
||||
@@ -3285,7 +3174,7 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
|
||||
```
|
||||
<a id="cfg-upstreams-password"></a>
|
||||
- `password`
|
||||
- **Constraints / validation**: `String` (optional). Only for `type = "socks5"`.
|
||||
- **Constraints / validation**: `String` or `null`. Only for `type = "socks5"`.
|
||||
- **Description**: SOCKS5 password (for username/password authentication). Note: when a request scope is selected, Telemt may override this with the selected scope value.
|
||||
- **Example**:
|
||||
|
||||
|
||||
@@ -128,8 +128,8 @@ WorkingDirectory=/opt/telemt
|
||||
ExecStart=/bin/telemt /etc/telemt/telemt.toml
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
|
||||
@@ -128,8 +128,8 @@ WorkingDirectory=/opt/telemt
|
||||
ExecStart=/bin/telemt /etc/telemt/telemt.toml
|
||||
Restart=on-failure
|
||||
LimitNOFILE=65536
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
|
||||
+74
-237
@@ -8,62 +8,18 @@ CONFIG_DIR="${CONFIG_DIR:-/etc/telemt}"
|
||||
CONFIG_FILE="${CONFIG_FILE:-${CONFIG_DIR}/telemt.toml}"
|
||||
WORK_DIR="${WORK_DIR:-/opt/telemt}"
|
||||
TLS_DOMAIN="${TLS_DOMAIN:-petrovich.ru}"
|
||||
SERVER_PORT="${SERVER_PORT:-443}"
|
||||
USER_SECRET=""
|
||||
AD_TAG=""
|
||||
SERVICE_NAME="telemt"
|
||||
TEMP_DIR=""
|
||||
SUDO=""
|
||||
CONFIG_PARENT_DIR=""
|
||||
SERVICE_START_FAILED=0
|
||||
|
||||
PORT_PROVIDED=0
|
||||
SECRET_PROVIDED=0
|
||||
AD_TAG_PROVIDED=0
|
||||
DOMAIN_PROVIDED=0
|
||||
|
||||
ACTION="install"
|
||||
TARGET_VERSION="${VERSION:-latest}"
|
||||
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
-h|--help) ACTION="help"; shift ;;
|
||||
-d|--domain)
|
||||
if [ "$#" -lt 2 ] || [ -z "$2" ]; then
|
||||
printf '[ERROR] %s requires a domain argument.\n' "$1" >&2
|
||||
exit 1
|
||||
fi
|
||||
TLS_DOMAIN="$2"; DOMAIN_PROVIDED=1; shift 2 ;;
|
||||
-p|--port)
|
||||
if [ "$#" -lt 2 ] || [ -z "$2" ]; then
|
||||
printf '[ERROR] %s requires a port argument.\n' "$1" >&2; exit 1
|
||||
fi
|
||||
case "$2" in
|
||||
*[!0-9]*) printf '[ERROR] Port must be a valid number.\n' >&2; exit 1 ;;
|
||||
esac
|
||||
port_num="$(printf '%s\n' "$2" | sed 's/^0*//')"
|
||||
[ -z "$port_num" ] && port_num="0"
|
||||
if [ "${#port_num}" -gt 5 ] || [ "$port_num" -lt 1 ] || [ "$port_num" -gt 65535 ]; then
|
||||
printf '[ERROR] Port must be between 1 and 65535.\n' >&2; exit 1
|
||||
fi
|
||||
SERVER_PORT="$port_num"; PORT_PROVIDED=1; shift 2 ;;
|
||||
-s|--secret)
|
||||
if [ "$#" -lt 2 ] || [ -z "$2" ]; then
|
||||
printf '[ERROR] %s requires a secret argument.\n' "$1" >&2; exit 1
|
||||
fi
|
||||
case "$2" in
|
||||
*[!0-9a-fA-F]*)
|
||||
printf '[ERROR] Secret must contain only hex characters.\n' >&2; exit 1 ;;
|
||||
esac
|
||||
if [ "${#2}" -ne 32 ]; then
|
||||
printf '[ERROR] Secret must be exactly 32 chars.\n' >&2; exit 1
|
||||
fi
|
||||
USER_SECRET="$2"; SECRET_PROVIDED=1; shift 2 ;;
|
||||
-a|--ad-tag|--ad_tag)
|
||||
if [ "$#" -lt 2 ] || [ -z "$2" ]; then
|
||||
printf '[ERROR] %s requires an ad_tag argument.\n' "$1" >&2; exit 1
|
||||
fi
|
||||
AD_TAG="$2"; AD_TAG_PROVIDED=1; shift 2 ;;
|
||||
uninstall|--uninstall)
|
||||
if [ "$ACTION" != "purge" ]; then ACTION="uninstall"; fi
|
||||
shift ;;
|
||||
@@ -96,17 +52,11 @@ cleanup() {
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
show_help() {
|
||||
say "Usage: $0 [ <version> | install | uninstall | purge ] [ options ]"
|
||||
say "Usage: $0 [ <version> | install | uninstall | purge | --help ]"
|
||||
say " <version> Install specific version (e.g. 3.3.15, default: latest)"
|
||||
say " install Install the latest version"
|
||||
say " uninstall Remove the binary and service"
|
||||
say " uninstall Remove the binary and service (keeps config and user)"
|
||||
say " purge Remove everything including configuration, data, and user"
|
||||
say ""
|
||||
say "Options:"
|
||||
say " -d, --domain Set TLS domain (default: petrovich.ru)"
|
||||
say " -p, --port Set server port (default: 443)"
|
||||
say " -s, --secret Set specific user secret (32 hex characters)"
|
||||
say " -a, --ad-tag Set ad_tag"
|
||||
exit 0
|
||||
}
|
||||
|
||||
@@ -123,13 +73,13 @@ get_realpath() {
|
||||
path_in="$1"
|
||||
case "$path_in" in /*) ;; *) path_in="$(pwd)/$path_in" ;; esac
|
||||
|
||||
if command -v realpath >/dev/null 2>&1; then
|
||||
if command -v realpath >/dev/null 2>&1; then
|
||||
if realpath_out="$(realpath -m "$path_in" 2>/dev/null)"; then
|
||||
printf '%s\n' "$realpath_out"
|
||||
return
|
||||
fi
|
||||
fi
|
||||
|
||||
|
||||
if command -v readlink >/dev/null 2>&1; then
|
||||
resolved_path="$(readlink -f "$path_in" 2>/dev/null || true)"
|
||||
if [ -n "$resolved_path" ]; then
|
||||
@@ -162,14 +112,6 @@ get_svc_mgr() {
|
||||
else echo "none"; fi
|
||||
}
|
||||
|
||||
is_config_exists() {
|
||||
if [ -n "$SUDO" ]; then
|
||||
$SUDO sh -c '[ -f "$1" ]' _ "$CONFIG_FILE"
|
||||
else
|
||||
[ -f "$CONFIG_FILE" ]
|
||||
fi
|
||||
}
|
||||
|
||||
verify_common() {
|
||||
[ -n "$BIN_NAME" ] || die "BIN_NAME cannot be empty."
|
||||
[ -n "$INSTALL_DIR" ] || die "INSTALL_DIR cannot be empty."
|
||||
@@ -177,7 +119,7 @@ verify_common() {
|
||||
[ -n "$CONFIG_FILE" ] || die "CONFIG_FILE cannot be empty."
|
||||
|
||||
case "${INSTALL_DIR}${CONFIG_DIR}${WORK_DIR}${CONFIG_FILE}" in
|
||||
*[!a-zA-Z0-9_./-]*) die "Invalid characters in paths." ;;
|
||||
*[!a-zA-Z0-9_./-]*) die "Invalid characters in paths. Only alphanumeric, _, ., -, and / allowed." ;;
|
||||
esac
|
||||
|
||||
case "$TARGET_VERSION" in *[!a-zA-Z0-9_.-]*) die "Invalid characters in version." ;; esac
|
||||
@@ -195,11 +137,11 @@ verify_common() {
|
||||
if [ "$(id -u)" -eq 0 ]; then
|
||||
SUDO=""
|
||||
else
|
||||
command -v sudo >/dev/null 2>&1 || die "This script requires root or sudo."
|
||||
command -v sudo >/dev/null 2>&1 || die "This script requires root or sudo. Neither found."
|
||||
SUDO="sudo"
|
||||
if ! sudo -n true 2>/dev/null; then
|
||||
if ! [ -t 0 ]; then
|
||||
die "sudo requires a password, but no TTY detected."
|
||||
die "sudo requires a password, but no TTY detected. Aborting to prevent hang."
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
@@ -212,7 +154,21 @@ verify_common() {
|
||||
die "Safety check failed: CONFIG_FILE '$CONFIG_FILE' is a directory."
|
||||
fi
|
||||
|
||||
for cmd in id uname awk grep find rm chown chmod mv mktemp mkdir tr dd sed ps head sleep cat tar gzip; do
|
||||
for path in "$CONFIG_DIR" "$CONFIG_PARENT_DIR" "$WORK_DIR"; do
|
||||
check_path="$(get_realpath "$path")"
|
||||
case "$check_path" in
|
||||
/|/bin|/sbin|/usr|/usr/bin|/usr/sbin|/usr/local|/usr/local/bin|/usr/local/sbin|/usr/local/etc|/usr/local/share|/etc|/var|/var/lib|/var/log|/var/run|/home|/root|/tmp|/lib|/lib64|/opt|/run|/boot|/dev|/sys|/proc)
|
||||
die "Safety check failed: '$path' (resolved to '$check_path') is a critical system directory." ;;
|
||||
esac
|
||||
done
|
||||
|
||||
check_install_dir="$(get_realpath "$INSTALL_DIR")"
|
||||
case "$check_install_dir" in
|
||||
/|/etc|/var|/home|/root|/tmp|/usr|/usr/local|/opt|/boot|/dev|/sys|/proc|/run)
|
||||
die "Safety check failed: INSTALL_DIR '$INSTALL_DIR' is a critical system directory." ;;
|
||||
esac
|
||||
|
||||
for cmd in id uname grep find rm chown chmod mv mktemp mkdir tr dd sed ps head sleep cat tar gzip rmdir; do
|
||||
command -v "$cmd" >/dev/null 2>&1 || die "Required command not found: $cmd"
|
||||
done
|
||||
}
|
||||
@@ -221,41 +177,14 @@ verify_install_deps() {
|
||||
command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1 || die "Neither curl nor wget is installed."
|
||||
command -v cp >/dev/null 2>&1 || command -v install >/dev/null 2>&1 || die "Need cp or install"
|
||||
|
||||
if ! command -v setcap >/dev/null 2>&1 || ! command -v conntrack >/dev/null 2>&1; then
|
||||
if ! command -v setcap >/dev/null 2>&1; then
|
||||
if command -v apk >/dev/null 2>&1; then
|
||||
$SUDO apk add --no-cache libcap-utils libcap conntrack-tools >/dev/null 2>&1 || true
|
||||
$SUDO apk add --no-cache libcap-utils >/dev/null 2>&1 || $SUDO apk add --no-cache libcap >/dev/null 2>&1 || true
|
||||
elif command -v apt-get >/dev/null 2>&1; then
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y -q libcap2-bin conntrack >/dev/null 2>&1 || {
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get update -q >/dev/null 2>&1 || true
|
||||
$SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y -q libcap2-bin conntrack >/dev/null 2>&1 || true
|
||||
}
|
||||
elif command -v dnf >/dev/null 2>&1; then $SUDO dnf install -y -q libcap conntrack-tools >/dev/null 2>&1 || true
|
||||
elif command -v yum >/dev/null 2>&1; then $SUDO yum install -y -q libcap conntrack-tools >/dev/null 2>&1 || true
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
check_port_availability() {
|
||||
port_info=""
|
||||
|
||||
if command -v ss >/dev/null 2>&1; then
|
||||
port_info=$($SUDO ss -tulnp 2>/dev/null | grep -E ":${SERVER_PORT}([[:space:]]|$)" || true)
|
||||
elif command -v netstat >/dev/null 2>&1; then
|
||||
port_info=$($SUDO netstat -tulnp 2>/dev/null | grep -E ":${SERVER_PORT}([[:space:]]|$)" || true)
|
||||
elif command -v lsof >/dev/null 2>&1; then
|
||||
port_info=$($SUDO lsof -i :${SERVER_PORT} 2>/dev/null | grep LISTEN || true)
|
||||
else
|
||||
say "[WARNING] Network diagnostic tools (ss, netstat, lsof) not found. Skipping port check."
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [ -n "$port_info" ]; then
|
||||
if printf '%s\n' "$port_info" | grep -q "${BIN_NAME}"; then
|
||||
say " -> Port ${SERVER_PORT} is in use by ${BIN_NAME}. Ignoring as it will be restarted."
|
||||
else
|
||||
say "[ERROR] Port ${SERVER_PORT} is already in use by another process:"
|
||||
printf ' %s\n' "$port_info"
|
||||
die "Please free the port ${SERVER_PORT} or change it and try again."
|
||||
$SUDO apt-get update -q >/dev/null 2>&1 || true
|
||||
$SUDO apt-get install -y -q libcap2-bin >/dev/null 2>&1 || true
|
||||
elif command -v dnf >/dev/null 2>&1; then $SUDO dnf install -y -q libcap >/dev/null 2>&1 || true
|
||||
elif command -v yum >/dev/null 2>&1; then $SUDO yum install -y -q libcap >/dev/null 2>&1 || true
|
||||
fi
|
||||
fi
|
||||
}
|
||||
@@ -263,13 +192,7 @@ check_port_availability() {
|
||||
detect_arch() {
|
||||
sys_arch="$(uname -m)"
|
||||
case "$sys_arch" in
|
||||
x86_64|amd64)
|
||||
if [ -r /proc/cpuinfo ] && grep -q "avx2" /proc/cpuinfo 2>/dev/null && grep -q "bmi2" /proc/cpuinfo 2>/dev/null; then
|
||||
echo "x86_64-v3"
|
||||
else
|
||||
echo "x86_64"
|
||||
fi
|
||||
;;
|
||||
x86_64|amd64) echo "x86_64" ;;
|
||||
aarch64|arm64) echo "aarch64" ;;
|
||||
*) die "Unsupported architecture: $sys_arch" ;;
|
||||
esac
|
||||
@@ -313,10 +236,10 @@ ensure_user_group() {
|
||||
|
||||
setup_dirs() {
|
||||
$SUDO mkdir -p "$WORK_DIR" "$CONFIG_DIR" "$CONFIG_PARENT_DIR" || die "Failed to create directories"
|
||||
|
||||
|
||||
$SUDO chown telemt:telemt "$WORK_DIR" && $SUDO chmod 750 "$WORK_DIR"
|
||||
$SUDO chown root:telemt "$CONFIG_DIR" && $SUDO chmod 750 "$CONFIG_DIR"
|
||||
|
||||
|
||||
if [ "$CONFIG_PARENT_DIR" != "$CONFIG_DIR" ] && [ "$CONFIG_PARENT_DIR" != "." ] && [ "$CONFIG_PARENT_DIR" != "/" ]; then
|
||||
$SUDO chown root:telemt "$CONFIG_PARENT_DIR" && $SUDO chmod 750 "$CONFIG_PARENT_DIR"
|
||||
fi
|
||||
@@ -338,19 +261,17 @@ install_binary() {
|
||||
fi
|
||||
|
||||
$SUDO mkdir -p "$INSTALL_DIR" || die "Failed to create install directory"
|
||||
|
||||
$SUDO rm -f "$bin_dst" 2>/dev/null || true
|
||||
|
||||
if command -v install >/dev/null 2>&1; then
|
||||
$SUDO install -m 0755 "$bin_src" "$bin_dst" || die "Failed to install binary"
|
||||
else
|
||||
$SUDO rm -f "$bin_dst" 2>/dev/null || true
|
||||
$SUDO cp "$bin_src" "$bin_dst" && $SUDO chmod 0755 "$bin_dst" || die "Failed to copy binary"
|
||||
fi
|
||||
|
||||
$SUDO sh -c '[ -x "$1" ]' _ "$bin_dst" || die "Binary not executable: $bin_dst"
|
||||
|
||||
if command -v setcap >/dev/null 2>&1; then
|
||||
$SUDO setcap cap_net_bind_service,cap_net_admin=+ep "$bin_dst" 2>/dev/null || true
|
||||
$SUDO setcap cap_net_bind_service=+ep "$bin_dst" 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -366,20 +287,11 @@ generate_secret() {
|
||||
}
|
||||
|
||||
generate_config_content() {
|
||||
conf_secret="$1"
|
||||
conf_tag="$2"
|
||||
escaped_tls_domain="$(printf '%s\n' "$TLS_DOMAIN" | tr -d '[:cntrl:]' | sed 's/\\/\\\\/g; s/"/\\"/g')"
|
||||
|
||||
cat <<EOF
|
||||
[general]
|
||||
use_middle_proxy = true
|
||||
EOF
|
||||
|
||||
if [ -n "$conf_tag" ]; then
|
||||
echo "ad_tag = \"${conf_tag}\""
|
||||
fi
|
||||
|
||||
cat <<EOF
|
||||
use_middle_proxy = false
|
||||
|
||||
[general.modes]
|
||||
classic = false
|
||||
@@ -387,7 +299,7 @@ secure = false
|
||||
tls = true
|
||||
|
||||
[server]
|
||||
port = ${SERVER_PORT}
|
||||
port = 443
|
||||
|
||||
[server.api]
|
||||
enabled = true
|
||||
@@ -398,73 +310,28 @@ whitelist = ["127.0.0.1/32"]
|
||||
tls_domain = "${escaped_tls_domain}"
|
||||
|
||||
[access.users]
|
||||
hello = "${conf_secret}"
|
||||
hello = "$1"
|
||||
EOF
|
||||
}
|
||||
|
||||
install_config() {
|
||||
if is_config_exists; then
|
||||
say " -> Config already exists at $CONFIG_FILE. Updating parameters..."
|
||||
|
||||
tmp_conf="${TEMP_DIR}/config.tmp"
|
||||
$SUDO cat "$CONFIG_FILE" > "$tmp_conf"
|
||||
|
||||
escaped_domain="$(printf '%s\n' "$TLS_DOMAIN" | tr -d '[:cntrl:]' | sed 's/\\/\\\\/g; s/"/\\"/g')"
|
||||
|
||||
export AWK_PORT="$SERVER_PORT"
|
||||
export AWK_SECRET="$USER_SECRET"
|
||||
export AWK_DOMAIN="$escaped_domain"
|
||||
export AWK_AD_TAG="$AD_TAG"
|
||||
export AWK_FLAG_P="$PORT_PROVIDED"
|
||||
export AWK_FLAG_S="$SECRET_PROVIDED"
|
||||
export AWK_FLAG_D="$DOMAIN_PROVIDED"
|
||||
export AWK_FLAG_A="$AD_TAG_PROVIDED"
|
||||
|
||||
awk '
|
||||
BEGIN { ad_tag_handled = 0 }
|
||||
|
||||
ENVIRON["AWK_FLAG_P"] == "1" && /^[ \t]*port[ \t]*=/ { print "port = " ENVIRON["AWK_PORT"]; next }
|
||||
ENVIRON["AWK_FLAG_S"] == "1" && /^[ \t]*hello[ \t]*=/ { print "hello = \"" ENVIRON["AWK_SECRET"] "\""; next }
|
||||
ENVIRON["AWK_FLAG_D"] == "1" && /^[ \t]*tls_domain[ \t]*=/ { print "tls_domain = \"" ENVIRON["AWK_DOMAIN"] "\""; next }
|
||||
|
||||
ENVIRON["AWK_FLAG_A"] == "1" && /^[ \t]*ad_tag[ \t]*=/ {
|
||||
if (!ad_tag_handled) {
|
||||
print "ad_tag = \"" ENVIRON["AWK_AD_TAG"] "\"";
|
||||
ad_tag_handled = 1;
|
||||
}
|
||||
next
|
||||
}
|
||||
ENVIRON["AWK_FLAG_A"] == "1" && /^\[general\]/ {
|
||||
print;
|
||||
if (!ad_tag_handled) {
|
||||
print "ad_tag = \"" ENVIRON["AWK_AD_TAG"] "\"";
|
||||
ad_tag_handled = 1;
|
||||
}
|
||||
next
|
||||
}
|
||||
|
||||
{ print }
|
||||
' "$tmp_conf" > "${tmp_conf}.new" && mv "${tmp_conf}.new" "$tmp_conf"
|
||||
|
||||
[ "$PORT_PROVIDED" -eq 1 ] && say " -> Updated port: $SERVER_PORT"
|
||||
[ "$SECRET_PROVIDED" -eq 1 ] && say " -> Updated secret for user 'hello'"
|
||||
[ "$DOMAIN_PROVIDED" -eq 1 ] && say " -> Updated tls_domain: $TLS_DOMAIN"
|
||||
[ "$AD_TAG_PROVIDED" -eq 1 ] && say " -> Updated ad_tag"
|
||||
|
||||
write_root "$CONFIG_FILE" < "$tmp_conf"
|
||||
rm -f "$tmp_conf"
|
||||
if [ -n "$SUDO" ]; then
|
||||
if $SUDO sh -c '[ -f "$1" ]' _ "$CONFIG_FILE"; then
|
||||
say " -> Config already exists at $CONFIG_FILE. Skipping creation."
|
||||
return 0
|
||||
fi
|
||||
elif [ -f "$CONFIG_FILE" ]; then
|
||||
say " -> Config already exists at $CONFIG_FILE. Skipping creation."
|
||||
return 0
|
||||
fi
|
||||
|
||||
if [ -z "$USER_SECRET" ]; then
|
||||
USER_SECRET="$(generate_secret)" || die "Failed to generate secret."
|
||||
fi
|
||||
toml_secret="$(generate_secret)" || die "Failed to generate secret."
|
||||
|
||||
generate_config_content "$USER_SECRET" "$AD_TAG" | write_root "$CONFIG_FILE" || die "Failed to install config"
|
||||
generate_config_content "$toml_secret" | write_root "$CONFIG_FILE" || die "Failed to install config"
|
||||
$SUDO chown root:telemt "$CONFIG_FILE" && $SUDO chmod 640 "$CONFIG_FILE"
|
||||
|
||||
say " -> Config created successfully."
|
||||
say " -> Configured secret for user 'hello': $USER_SECRET"
|
||||
say " -> Generated secret for default user 'hello': $toml_secret"
|
||||
}
|
||||
|
||||
generate_systemd_content() {
|
||||
@@ -481,10 +348,9 @@ Group=telemt
|
||||
WorkingDirectory=$WORK_DIR
|
||||
ExecStart="${INSTALL_DIR}/${BIN_NAME}" "${CONFIG_FILE}"
|
||||
Restart=on-failure
|
||||
RestartSec=5
|
||||
LimitNOFILE=65536
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_NET_ADMIN
|
||||
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -515,7 +381,7 @@ install_service() {
|
||||
|
||||
$SUDO systemctl daemon-reload || true
|
||||
$SUDO systemctl enable "$SERVICE_NAME" || true
|
||||
|
||||
|
||||
if ! $SUDO systemctl start "$SERVICE_NAME"; then
|
||||
say "[WARNING] Failed to start service"
|
||||
SERVICE_START_FAILED=1
|
||||
@@ -525,16 +391,16 @@ install_service() {
|
||||
$SUDO chown root:root "/etc/init.d/${SERVICE_NAME}" && $SUDO chmod 0755 "/etc/init.d/${SERVICE_NAME}"
|
||||
|
||||
$SUDO rc-update add "$SERVICE_NAME" default 2>/dev/null || true
|
||||
|
||||
|
||||
if ! $SUDO rc-service "$SERVICE_NAME" start 2>/dev/null; then
|
||||
say "[WARNING] Failed to start service"
|
||||
SERVICE_START_FAILED=1
|
||||
fi
|
||||
else
|
||||
cmd="\"${INSTALL_DIR}/${BIN_NAME}\" \"${CONFIG_FILE}\""
|
||||
if [ -n "$SUDO" ]; then
|
||||
if [ -n "$SUDO" ]; then
|
||||
say " -> Service manager not found. Start manually: sudo -u telemt $cmd"
|
||||
else
|
||||
else
|
||||
say " -> Service manager not found. Start manually: su -s /bin/sh telemt -c '$cmd'"
|
||||
fi
|
||||
fi
|
||||
@@ -549,10 +415,9 @@ kill_user_procs() {
|
||||
if command -v pgrep >/dev/null 2>&1; then
|
||||
pids="$(pgrep -u telemt 2>/dev/null || true)"
|
||||
else
|
||||
pids="$(ps -ef 2>/dev/null | awk '$1=="telemt"{print $2}' || true)"
|
||||
[ -z "$pids" ] && pids="$(ps 2>/dev/null | awk '$2=="telemt"{print $1}' || true)"
|
||||
pids="$(ps -u telemt -o pid= 2>/dev/null || true)"
|
||||
fi
|
||||
|
||||
|
||||
if [ -n "$pids" ]; then
|
||||
for pid in $pids; do
|
||||
case "$pid" in ''|*[!0-9]*) continue ;; *) $SUDO kill "$pid" 2>/dev/null || true ;; esac
|
||||
@@ -592,16 +457,15 @@ uninstall() {
|
||||
say ">>> Stage 5: Purging configuration, data, and user"
|
||||
$SUDO rm -rf "$CONFIG_DIR" "$WORK_DIR"
|
||||
$SUDO rm -f "$CONFIG_FILE"
|
||||
sleep 1
|
||||
$SUDO userdel telemt 2>/dev/null || $SUDO deluser telemt 2>/dev/null || true
|
||||
|
||||
if check_os_entity group telemt; then
|
||||
$SUDO groupdel telemt 2>/dev/null || $SUDO delgroup telemt 2>/dev/null || true
|
||||
if [ "$CONFIG_PARENT_DIR" != "$CONFIG_DIR" ] && [ "$CONFIG_PARENT_DIR" != "." ] && [ "$CONFIG_PARENT_DIR" != "/" ]; then
|
||||
$SUDO rmdir "$CONFIG_PARENT_DIR" 2>/dev/null || true
|
||||
fi
|
||||
$SUDO userdel telemt 2>/dev/null || $SUDO deluser telemt 2>/dev/null || true
|
||||
$SUDO groupdel telemt 2>/dev/null || $SUDO delgroup telemt 2>/dev/null || true
|
||||
else
|
||||
say "Note: Configuration and user kept. Run with 'purge' to remove completely."
|
||||
fi
|
||||
|
||||
|
||||
printf '\n====================================================================\n'
|
||||
printf ' UNINSTALLATION COMPLETE\n'
|
||||
printf '====================================================================\n\n'
|
||||
@@ -615,28 +479,18 @@ case "$ACTION" in
|
||||
say "Starting installation of $BIN_NAME (Version: $TARGET_VERSION)"
|
||||
|
||||
say ">>> Stage 1: Verifying environment and dependencies"
|
||||
verify_common
|
||||
verify_install_deps
|
||||
verify_common; verify_install_deps
|
||||
|
||||
if is_config_exists && [ "$PORT_PROVIDED" -eq 0 ]; then
|
||||
ext_port="$($SUDO awk -F'=' '/^[ \t]*port[ \t]*=/ {gsub(/[^0-9]/, "", $2); print $2; exit}' "$CONFIG_FILE" 2>/dev/null || true)"
|
||||
if [ -n "$ext_port" ]; then
|
||||
SERVER_PORT="$ext_port"
|
||||
fi
|
||||
fi
|
||||
|
||||
check_port_availability
|
||||
|
||||
if [ "$TARGET_VERSION" != "latest" ]; then
|
||||
if [ "$TARGET_VERSION" != "latest" ]; then
|
||||
TARGET_VERSION="${TARGET_VERSION#v}"
|
||||
fi
|
||||
|
||||
|
||||
ARCH="$(detect_arch)"; LIBC="$(detect_libc)"
|
||||
FILE_NAME="${BIN_NAME}-${ARCH}-linux-${LIBC}.tar.gz"
|
||||
|
||||
|
||||
if [ "$TARGET_VERSION" = "latest" ]; then
|
||||
DL_URL="https://github.com/${REPO}/releases/latest/download/${FILE_NAME}"
|
||||
else
|
||||
else
|
||||
DL_URL="https://github.com/${REPO}/releases/download/${TARGET_VERSION}/${FILE_NAME}"
|
||||
fi
|
||||
|
||||
@@ -646,21 +500,7 @@ case "$ACTION" in
|
||||
die "Temp directory is invalid or was not created"
|
||||
fi
|
||||
|
||||
if ! fetch_file "$DL_URL" "${TEMP_DIR}/${FILE_NAME}"; then
|
||||
if [ "$ARCH" = "x86_64-v3" ]; then
|
||||
say " -> x86_64-v3 build not found, falling back to standard x86_64..."
|
||||
ARCH="x86_64"
|
||||
FILE_NAME="${BIN_NAME}-${ARCH}-linux-${LIBC}.tar.gz"
|
||||
if [ "$TARGET_VERSION" = "latest" ]; then
|
||||
DL_URL="https://github.com/${REPO}/releases/latest/download/${FILE_NAME}"
|
||||
else
|
||||
DL_URL="https://github.com/${REPO}/releases/download/${TARGET_VERSION}/${FILE_NAME}"
|
||||
fi
|
||||
fetch_file "$DL_URL" "${TEMP_DIR}/${FILE_NAME}" || die "Download failed"
|
||||
else
|
||||
die "Download failed"
|
||||
fi
|
||||
fi
|
||||
fetch_file "$DL_URL" "${TEMP_DIR}/${FILE_NAME}" || die "Download failed"
|
||||
|
||||
say ">>> Stage 3: Extracting archive"
|
||||
if ! gzip -dc "${TEMP_DIR}/${FILE_NAME}" | tar -xf - -C "$TEMP_DIR" 2>/dev/null; then
|
||||
@@ -672,13 +512,13 @@ case "$ACTION" in
|
||||
|
||||
say ">>> Stage 4: Setting up environment (User, Group, Directories)"
|
||||
ensure_user_group; setup_dirs; stop_service
|
||||
|
||||
|
||||
say ">>> Stage 5: Installing binary"
|
||||
install_binary "$EXTRACTED_BIN" "${INSTALL_DIR}/${BIN_NAME}"
|
||||
|
||||
say ">>> Stage 6: Generating/Updating configuration"
|
||||
|
||||
say ">>> Stage 6: Generating configuration"
|
||||
install_config
|
||||
|
||||
|
||||
say ">>> Stage 7: Installing and starting service"
|
||||
install_service
|
||||
|
||||
@@ -693,7 +533,7 @@ case "$ACTION" in
|
||||
printf ' INSTALLATION SUCCESS\n'
|
||||
printf '====================================================================\n\n'
|
||||
fi
|
||||
|
||||
|
||||
svc="$(get_svc_mgr)"
|
||||
if [ "$svc" = "systemd" ]; then
|
||||
printf 'To check the status of your proxy service, run:\n'
|
||||
@@ -702,18 +542,15 @@ case "$ACTION" in
|
||||
printf 'To check the status of your proxy service, run:\n'
|
||||
printf ' rc-service %s status\n\n' "$SERVICE_NAME"
|
||||
fi
|
||||
|
||||
API_LISTEN="$($SUDO awk -F'"' '/^[ \t]*listen[ \t]*=/ {print $2; exit}' "$CONFIG_FILE" 2>/dev/null || true)"
|
||||
API_LISTEN="${API_LISTEN:-127.0.0.1:9091}"
|
||||
|
||||
|
||||
printf 'To get your user connection links (for Telegram), run:\n'
|
||||
if command -v jq >/dev/null 2>&1; then
|
||||
printf ' curl -s http://%s/v1/users | jq -r '\''.data[]? | "User: \\(.username)\\n\\(.links.tls[0] // empty)\\n"'\''\n' "$API_LISTEN"
|
||||
printf ' curl -s http://127.0.0.1:9091/v1/users | jq -r '\''.data[] | "User: \\(.username)\\n\\(.links.tls[0] // empty)\\n"'\''\n'
|
||||
else
|
||||
printf ' curl -s http://%s/v1/users\n' "$API_LISTEN"
|
||||
printf ' curl -s http://127.0.0.1:9091/v1/users\n'
|
||||
printf ' (Tip: Install '\''jq'\'' for a much cleaner output)\n'
|
||||
fi
|
||||
|
||||
|
||||
printf '\n====================================================================\n'
|
||||
;;
|
||||
esac
|
||||
|
||||
@@ -100,7 +100,7 @@ pub(crate) fn default_fake_cert_len() -> usize {
|
||||
}
|
||||
|
||||
pub(crate) fn default_tls_front_dir() -> String {
|
||||
"/etc/telemt/tlsfront".to_string()
|
||||
"tlsfront".to_string()
|
||||
}
|
||||
|
||||
pub(crate) fn default_replay_check_len() -> usize {
|
||||
@@ -302,7 +302,7 @@ pub(crate) fn default_me2dc_fallback() -> bool {
|
||||
}
|
||||
|
||||
pub(crate) fn default_me2dc_fast() -> bool {
|
||||
true
|
||||
false
|
||||
}
|
||||
|
||||
pub(crate) fn default_keepalive_interval() -> u64 {
|
||||
@@ -558,7 +558,7 @@ pub(crate) fn default_beobachten_flush_secs() -> u64 {
|
||||
}
|
||||
|
||||
pub(crate) fn default_beobachten_file() -> String {
|
||||
"/etc/telemt/beobachten.txt".to_string()
|
||||
"cache/beobachten.txt".to_string()
|
||||
}
|
||||
|
||||
pub(crate) fn default_tls_new_session_tickets() -> u8 {
|
||||
|
||||
+7
-11
@@ -947,11 +947,7 @@ impl ProxyConfig {
|
||||
}
|
||||
|
||||
if matches!(config.server.conntrack_control.mode, ConntrackMode::Hybrid)
|
||||
&& config
|
||||
.server
|
||||
.conntrack_control
|
||||
.hybrid_listener_ips
|
||||
.is_empty()
|
||||
&& config.server.conntrack_control.hybrid_listener_ips.is_empty()
|
||||
{
|
||||
return Err(ProxyError::Config(
|
||||
"server.conntrack_control.hybrid_listener_ips must be non-empty in mode=hybrid"
|
||||
@@ -2507,9 +2503,9 @@ mod tests {
|
||||
let path = dir.join("telemt_conntrack_high_watermark_invalid_test.toml");
|
||||
std::fs::write(&path, toml).unwrap();
|
||||
let err = ProxyConfig::load(&path).unwrap_err().to_string();
|
||||
assert!(err.contains(
|
||||
"server.conntrack_control.pressure_high_watermark_pct must be within [1, 100]"
|
||||
));
|
||||
assert!(
|
||||
err.contains("server.conntrack_control.pressure_high_watermark_pct must be within [1, 100]")
|
||||
);
|
||||
let _ = std::fs::remove_file(path);
|
||||
}
|
||||
|
||||
@@ -2574,9 +2570,9 @@ mod tests {
|
||||
let path = dir.join("telemt_conntrack_hybrid_requires_ips_test.toml");
|
||||
std::fs::write(&path, toml).unwrap();
|
||||
let err = ProxyConfig::load(&path).unwrap_err().to_string();
|
||||
assert!(err.contains(
|
||||
"server.conntrack_control.hybrid_listener_ips must be non-empty in mode=hybrid"
|
||||
));
|
||||
assert!(
|
||||
err.contains("server.conntrack_control.hybrid_listener_ips must be non-empty in mode=hybrid")
|
||||
);
|
||||
let _ = std::fs::remove_file(path);
|
||||
}
|
||||
|
||||
|
||||
+11
-62
@@ -56,11 +56,7 @@ pub(crate) fn spawn_conntrack_controller(
|
||||
shared: Arc<ProxySharedState>,
|
||||
) {
|
||||
if !cfg!(target_os = "linux") {
|
||||
let enabled = config_rx
|
||||
.borrow()
|
||||
.server
|
||||
.conntrack_control
|
||||
.inline_conntrack_control;
|
||||
let enabled = config_rx.borrow().server.conntrack_control.inline_conntrack_control;
|
||||
stats.set_conntrack_control_enabled(enabled);
|
||||
stats.set_conntrack_control_available(false);
|
||||
stats.set_conntrack_pressure_active(false);
|
||||
@@ -69,9 +65,7 @@ pub(crate) fn spawn_conntrack_controller(
|
||||
shared.disable_conntrack_close_sender();
|
||||
shared.set_conntrack_pressure_active(false);
|
||||
if enabled {
|
||||
warn!(
|
||||
"conntrack control is configured but unsupported on this OS; disabling runtime worker"
|
||||
);
|
||||
warn!("conntrack control is configured but unsupported on this OS; disabling runtime worker");
|
||||
}
|
||||
return;
|
||||
}
|
||||
@@ -94,13 +88,7 @@ async fn run_conntrack_controller(
|
||||
let mut delete_budget_tokens = cfg.server.conntrack_control.delete_budget_per_sec;
|
||||
let mut backend = pick_backend(cfg.server.conntrack_control.backend);
|
||||
|
||||
apply_runtime_state(
|
||||
stats.as_ref(),
|
||||
shared.as_ref(),
|
||||
&cfg,
|
||||
backend.is_some(),
|
||||
false,
|
||||
);
|
||||
apply_runtime_state(stats.as_ref(), shared.as_ref(), &cfg, backend.is_some(), false);
|
||||
reconcile_rules(&cfg, backend, stats.as_ref()).await;
|
||||
|
||||
loop {
|
||||
@@ -327,9 +315,7 @@ fn pick_backend(configured: ConntrackBackend) -> Option<NetfilterBackend> {
|
||||
}
|
||||
}
|
||||
ConntrackBackend::Nftables => command_exists("nft").then_some(NetfilterBackend::Nftables),
|
||||
ConntrackBackend::Iptables => {
|
||||
command_exists("iptables").then_some(NetfilterBackend::Iptables)
|
||||
}
|
||||
ConntrackBackend::Iptables => command_exists("iptables").then_some(NetfilterBackend::Iptables),
|
||||
}
|
||||
}
|
||||
|
||||
@@ -410,12 +396,7 @@ fn notrack_targets(cfg: &ProxyConfig) -> (Vec<Option<IpAddr>>, Vec<Option<IpAddr
|
||||
}
|
||||
|
||||
async fn apply_nft_rules(cfg: &ProxyConfig) -> Result<(), String> {
|
||||
let _ = run_command(
|
||||
"nft",
|
||||
&["delete", "table", "inet", "telemt_conntrack"],
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
let _ = run_command("nft", &["delete", "table", "inet", "telemt_conntrack"], None).await;
|
||||
if matches!(cfg.server.conntrack_control.mode, ConntrackMode::Tracked) {
|
||||
return Ok(());
|
||||
}
|
||||
@@ -465,12 +446,7 @@ async fn apply_iptables_rules_for_binary(
|
||||
return Ok(());
|
||||
}
|
||||
let chain = "TELEMT_NOTRACK";
|
||||
let _ = run_command(
|
||||
binary,
|
||||
&["-t", "raw", "-D", "PREROUTING", "-j", chain],
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
let _ = run_command(binary, &["-t", "raw", "-D", "PREROUTING", "-j", chain], None).await;
|
||||
let _ = run_command(binary, &["-t", "raw", "-F", chain], None).await;
|
||||
let _ = run_command(binary, &["-t", "raw", "-X", chain], None).await;
|
||||
|
||||
@@ -480,20 +456,8 @@ async fn apply_iptables_rules_for_binary(
|
||||
|
||||
run_command(binary, &["-t", "raw", "-N", chain], None).await?;
|
||||
run_command(binary, &["-t", "raw", "-F", chain], None).await?;
|
||||
if run_command(
|
||||
binary,
|
||||
&["-t", "raw", "-C", "PREROUTING", "-j", chain],
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.is_err()
|
||||
{
|
||||
run_command(
|
||||
binary,
|
||||
&["-t", "raw", "-I", "PREROUTING", "1", "-j", chain],
|
||||
None,
|
||||
)
|
||||
.await?;
|
||||
if run_command(binary, &["-t", "raw", "-C", "PREROUTING", "-j", chain], None).await.is_err() {
|
||||
run_command(binary, &["-t", "raw", "-I", "PREROUTING", "1", "-j", chain], None).await?;
|
||||
}
|
||||
|
||||
let (v4_targets, v6_targets) = notrack_targets(cfg);
|
||||
@@ -523,26 +487,11 @@ async fn apply_iptables_rules_for_binary(
|
||||
}
|
||||
|
||||
async fn clear_notrack_rules_all_backends() {
|
||||
let _ = run_command(
|
||||
"nft",
|
||||
&["delete", "table", "inet", "telemt_conntrack"],
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
let _ = run_command(
|
||||
"iptables",
|
||||
&["-t", "raw", "-D", "PREROUTING", "-j", "TELEMT_NOTRACK"],
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
let _ = run_command("nft", &["delete", "table", "inet", "telemt_conntrack"], None).await;
|
||||
let _ = run_command("iptables", &["-t", "raw", "-D", "PREROUTING", "-j", "TELEMT_NOTRACK"], None).await;
|
||||
let _ = run_command("iptables", &["-t", "raw", "-F", "TELEMT_NOTRACK"], None).await;
|
||||
let _ = run_command("iptables", &["-t", "raw", "-X", "TELEMT_NOTRACK"], None).await;
|
||||
let _ = run_command(
|
||||
"ip6tables",
|
||||
&["-t", "raw", "-D", "PREROUTING", "-j", "TELEMT_NOTRACK"],
|
||||
None,
|
||||
)
|
||||
.await;
|
||||
let _ = run_command("ip6tables", &["-t", "raw", "-D", "PREROUTING", "-j", "TELEMT_NOTRACK"], None).await;
|
||||
let _ = run_command("ip6tables", &["-t", "raw", "-F", "TELEMT_NOTRACK"], None).await;
|
||||
let _ = run_command("ip6tables", &["-t", "raw", "-X", "TELEMT_NOTRACK"], None).await;
|
||||
}
|
||||
|
||||
+21
-59
@@ -88,10 +88,8 @@ pub fn init_logging(
|
||||
// Use a custom fmt layer that writes to syslog
|
||||
let fmt_layer = fmt::Layer::default()
|
||||
.with_ansi(false)
|
||||
.with_target(false)
|
||||
.with_level(false)
|
||||
.without_time()
|
||||
.with_writer(SyslogMakeWriter::new());
|
||||
.with_target(true)
|
||||
.with_writer(SyslogWriter::new);
|
||||
|
||||
tracing_subscriber::registry()
|
||||
.with(filter_layer)
|
||||
@@ -139,17 +137,12 @@ pub fn init_logging(
|
||||
|
||||
/// Syslog writer for tracing.
|
||||
#[cfg(unix)]
|
||||
#[derive(Clone, Copy)]
|
||||
struct SyslogMakeWriter;
|
||||
|
||||
#[cfg(unix)]
|
||||
#[derive(Clone, Copy)]
|
||||
struct SyslogWriter {
|
||||
priority: libc::c_int,
|
||||
_private: (),
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
impl SyslogMakeWriter {
|
||||
impl SyslogWriter {
|
||||
fn new() -> Self {
|
||||
// Open syslog connection on first use
|
||||
static INIT: std::sync::Once = std::sync::Once::new();
|
||||
@@ -160,18 +153,7 @@ impl SyslogMakeWriter {
|
||||
libc::openlog(ident, libc::LOG_PID | libc::LOG_NDELAY, libc::LOG_DAEMON);
|
||||
}
|
||||
});
|
||||
Self
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
fn syslog_priority_for_level(level: &tracing::Level) -> libc::c_int {
|
||||
match *level {
|
||||
tracing::Level::ERROR => libc::LOG_ERR,
|
||||
tracing::Level::WARN => libc::LOG_WARNING,
|
||||
tracing::Level::INFO => libc::LOG_INFO,
|
||||
tracing::Level::DEBUG => libc::LOG_DEBUG,
|
||||
tracing::Level::TRACE => libc::LOG_DEBUG,
|
||||
Self { _private: () }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -186,13 +168,26 @@ impl std::io::Write for SyslogWriter {
|
||||
return Ok(buf.len());
|
||||
}
|
||||
|
||||
// Determine priority based on log level in the message
|
||||
let priority = if msg.contains(" ERROR ") || msg.contains(" error ") {
|
||||
libc::LOG_ERR
|
||||
} else if msg.contains(" WARN ") || msg.contains(" warn ") {
|
||||
libc::LOG_WARNING
|
||||
} else if msg.contains(" INFO ") || msg.contains(" info ") {
|
||||
libc::LOG_INFO
|
||||
} else if msg.contains(" DEBUG ") || msg.contains(" debug ") {
|
||||
libc::LOG_DEBUG
|
||||
} else {
|
||||
libc::LOG_INFO
|
||||
};
|
||||
|
||||
// Write to syslog
|
||||
let c_msg = std::ffi::CString::new(msg.as_bytes())
|
||||
.unwrap_or_else(|_| std::ffi::CString::new("(invalid utf8)").unwrap());
|
||||
|
||||
unsafe {
|
||||
libc::syslog(
|
||||
self.priority,
|
||||
priority,
|
||||
b"%s\0".as_ptr() as *const libc::c_char,
|
||||
c_msg.as_ptr(),
|
||||
);
|
||||
@@ -207,19 +202,11 @@ impl std::io::Write for SyslogWriter {
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for SyslogMakeWriter {
|
||||
impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for SyslogWriter {
|
||||
type Writer = SyslogWriter;
|
||||
|
||||
fn make_writer(&'a self) -> Self::Writer {
|
||||
SyslogWriter {
|
||||
priority: libc::LOG_INFO,
|
||||
}
|
||||
}
|
||||
|
||||
fn make_writer_for(&'a self, meta: &tracing::Metadata<'_>) -> Self::Writer {
|
||||
SyslogWriter {
|
||||
priority: syslog_priority_for_level(meta.level()),
|
||||
}
|
||||
SyslogWriter::new()
|
||||
}
|
||||
}
|
||||
|
||||
@@ -315,29 +302,4 @@ mod tests {
|
||||
LogDestination::Syslog
|
||||
));
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
#[test]
|
||||
fn test_syslog_priority_for_level_mapping() {
|
||||
assert_eq!(
|
||||
syslog_priority_for_level(&tracing::Level::ERROR),
|
||||
libc::LOG_ERR
|
||||
);
|
||||
assert_eq!(
|
||||
syslog_priority_for_level(&tracing::Level::WARN),
|
||||
libc::LOG_WARNING
|
||||
);
|
||||
assert_eq!(
|
||||
syslog_priority_for_level(&tracing::Level::INFO),
|
||||
libc::LOG_INFO
|
||||
);
|
||||
assert_eq!(
|
||||
syslog_priority_for_level(&tracing::Level::DEBUG),
|
||||
libc::LOG_DEBUG
|
||||
);
|
||||
assert_eq!(
|
||||
syslog_priority_for_level(&tracing::Level::TRACE),
|
||||
libc::LOG_DEBUG
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
+15
-83
@@ -18,38 +18,19 @@ use crate::transport::middle_proxy::{
|
||||
pub(crate) fn resolve_runtime_config_path(
|
||||
config_path_cli: &str,
|
||||
startup_cwd: &std::path::Path,
|
||||
config_path_explicit: bool,
|
||||
) -> PathBuf {
|
||||
if config_path_explicit {
|
||||
let raw = PathBuf::from(config_path_cli);
|
||||
let absolute = if raw.is_absolute() {
|
||||
raw
|
||||
} else {
|
||||
startup_cwd.join(raw)
|
||||
};
|
||||
return absolute.canonicalize().unwrap_or(absolute);
|
||||
}
|
||||
|
||||
let etc_telemt = std::path::Path::new("/etc/telemt");
|
||||
let candidates = [
|
||||
startup_cwd.join("config.toml"),
|
||||
startup_cwd.join("telemt.toml"),
|
||||
etc_telemt.join("telemt.toml"),
|
||||
etc_telemt.join("config.toml"),
|
||||
];
|
||||
for candidate in candidates {
|
||||
if candidate.is_file() {
|
||||
return candidate.canonicalize().unwrap_or(candidate);
|
||||
}
|
||||
}
|
||||
|
||||
startup_cwd.join("config.toml")
|
||||
let raw = PathBuf::from(config_path_cli);
|
||||
let absolute = if raw.is_absolute() {
|
||||
raw
|
||||
} else {
|
||||
startup_cwd.join(raw)
|
||||
};
|
||||
absolute.canonicalize().unwrap_or(absolute)
|
||||
}
|
||||
|
||||
/// Parsed CLI arguments.
|
||||
pub(crate) struct CliArgs {
|
||||
pub config_path: String,
|
||||
pub config_path_explicit: bool,
|
||||
pub data_path: Option<PathBuf>,
|
||||
pub silent: bool,
|
||||
pub log_level: Option<String>,
|
||||
@@ -58,7 +39,6 @@ pub(crate) struct CliArgs {
|
||||
|
||||
pub(crate) fn parse_cli() -> CliArgs {
|
||||
let mut config_path = "config.toml".to_string();
|
||||
let mut config_path_explicit = false;
|
||||
let mut data_path: Option<PathBuf> = None;
|
||||
let mut silent = false;
|
||||
let mut log_level: Option<String> = None;
|
||||
@@ -94,20 +74,6 @@ pub(crate) fn parse_cli() -> CliArgs {
|
||||
s.trim_start_matches("--data-path=").to_string(),
|
||||
));
|
||||
}
|
||||
"--working-dir" => {
|
||||
i += 1;
|
||||
if i < args.len() {
|
||||
data_path = Some(PathBuf::from(args[i].clone()));
|
||||
} else {
|
||||
eprintln!("Missing value for --working-dir");
|
||||
std::process::exit(0);
|
||||
}
|
||||
}
|
||||
s if s.starts_with("--working-dir=") => {
|
||||
data_path = Some(PathBuf::from(
|
||||
s.trim_start_matches("--working-dir=").to_string(),
|
||||
));
|
||||
}
|
||||
"--silent" | "-s" => {
|
||||
silent = true;
|
||||
}
|
||||
@@ -145,12 +111,14 @@ pub(crate) fn parse_cli() -> CliArgs {
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
s if !s.starts_with('-') => {
|
||||
if !matches!(s, "run" | "start" | "stop" | "reload" | "status") {
|
||||
config_path = s.to_string();
|
||||
config_path_explicit = true;
|
||||
s if s.starts_with("--working-dir") => {
|
||||
if !s.contains('=') {
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
s if !s.starts_with('-') => {
|
||||
config_path = s.to_string();
|
||||
}
|
||||
other => {
|
||||
eprintln!("Unknown option: {}", other);
|
||||
}
|
||||
@@ -160,7 +128,6 @@ pub(crate) fn parse_cli() -> CliArgs {
|
||||
|
||||
CliArgs {
|
||||
config_path,
|
||||
config_path_explicit,
|
||||
data_path,
|
||||
silent,
|
||||
log_level,
|
||||
@@ -185,7 +152,6 @@ fn print_help() {
|
||||
eprintln!(
|
||||
" --data-path <DIR> Set data directory (absolute path; overrides config value)"
|
||||
);
|
||||
eprintln!(" --working-dir <DIR> Alias for --data-path");
|
||||
eprintln!(" --silent, -s Suppress info logs");
|
||||
eprintln!(" --log-level <LEVEL> debug|verbose|normal|silent");
|
||||
eprintln!(" --help, -h Show this help");
|
||||
@@ -244,7 +210,7 @@ mod tests {
|
||||
let target = startup_cwd.join("config.toml");
|
||||
std::fs::write(&target, " ").unwrap();
|
||||
|
||||
let resolved = resolve_runtime_config_path("config.toml", &startup_cwd, true);
|
||||
let resolved = resolve_runtime_config_path("config.toml", &startup_cwd);
|
||||
assert_eq!(resolved, target.canonicalize().unwrap());
|
||||
|
||||
let _ = std::fs::remove_file(&target);
|
||||
@@ -260,45 +226,11 @@ mod tests {
|
||||
let startup_cwd = std::env::temp_dir().join(format!("telemt_cfg_path_missing_{nonce}"));
|
||||
std::fs::create_dir_all(&startup_cwd).unwrap();
|
||||
|
||||
let resolved = resolve_runtime_config_path("missing.toml", &startup_cwd, true);
|
||||
let resolved = resolve_runtime_config_path("missing.toml", &startup_cwd);
|
||||
assert_eq!(resolved, startup_cwd.join("missing.toml"));
|
||||
|
||||
let _ = std::fs::remove_dir(&startup_cwd);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_runtime_config_path_uses_startup_candidates_when_not_explicit() {
|
||||
let nonce = std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.unwrap()
|
||||
.as_nanos();
|
||||
let startup_cwd =
|
||||
std::env::temp_dir().join(format!("telemt_cfg_startup_candidates_{nonce}"));
|
||||
std::fs::create_dir_all(&startup_cwd).unwrap();
|
||||
let telemt = startup_cwd.join("telemt.toml");
|
||||
std::fs::write(&telemt, " ").unwrap();
|
||||
|
||||
let resolved = resolve_runtime_config_path("config.toml", &startup_cwd, false);
|
||||
assert_eq!(resolved, telemt.canonicalize().unwrap());
|
||||
|
||||
let _ = std::fs::remove_file(&telemt);
|
||||
let _ = std::fs::remove_dir(&startup_cwd);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_runtime_config_path_defaults_to_startup_config_when_none_found() {
|
||||
let nonce = std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.unwrap()
|
||||
.as_nanos();
|
||||
let startup_cwd = std::env::temp_dir().join(format!("telemt_cfg_startup_default_{nonce}"));
|
||||
std::fs::create_dir_all(&startup_cwd).unwrap();
|
||||
|
||||
let resolved = resolve_runtime_config_path("config.toml", &startup_cwd, false);
|
||||
assert_eq!(resolved, startup_cwd.join("config.toml"));
|
||||
|
||||
let _ = std::fs::remove_dir(&startup_cwd);
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn print_proxy_links(host: &str, port: u16, config: &ProxyConfig) {
|
||||
|
||||
+7
-97
@@ -28,8 +28,8 @@ use tracing::{error, info, warn};
|
||||
use tracing_subscriber::{EnvFilter, fmt, prelude::*, reload};
|
||||
|
||||
use crate::api;
|
||||
use crate::config::{LogLevel, ProxyConfig};
|
||||
use crate::conntrack_control;
|
||||
use crate::config::{LogLevel, ProxyConfig};
|
||||
use crate::crypto::SecureRandom;
|
||||
use crate::ip_tracker::UserIpTracker;
|
||||
use crate::network::probe::{decide_network_capabilities, log_probe_result, run_probe};
|
||||
@@ -112,7 +112,6 @@ async fn run_inner(
|
||||
.await;
|
||||
let cli_args = parse_cli();
|
||||
let config_path_cli = cli_args.config_path;
|
||||
let config_path_explicit = cli_args.config_path_explicit;
|
||||
let data_path = cli_args.data_path;
|
||||
let cli_silent = cli_args.silent;
|
||||
let cli_log_level = cli_args.log_level;
|
||||
@@ -124,8 +123,7 @@ async fn run_inner(
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
let mut config_path =
|
||||
resolve_runtime_config_path(&config_path_cli, &startup_cwd, config_path_explicit);
|
||||
let config_path = resolve_runtime_config_path(&config_path_cli, &startup_cwd);
|
||||
|
||||
let mut config = match ProxyConfig::load(&config_path) {
|
||||
Ok(c) => c,
|
||||
@@ -135,99 +133,11 @@ async fn run_inner(
|
||||
std::process::exit(1);
|
||||
} else {
|
||||
let default = ProxyConfig::default();
|
||||
|
||||
let serialized =
|
||||
match toml::to_string_pretty(&default).or_else(|_| toml::to_string(&default)) {
|
||||
Ok(value) => Some(value),
|
||||
Err(serialize_error) => {
|
||||
eprintln!(
|
||||
"[telemt] Warning: failed to serialize default config: {}",
|
||||
serialize_error
|
||||
);
|
||||
None
|
||||
}
|
||||
};
|
||||
|
||||
if config_path_explicit {
|
||||
if let Some(serialized) = serialized.as_ref() {
|
||||
if let Err(write_error) = std::fs::write(&config_path, serialized) {
|
||||
eprintln!(
|
||||
"[telemt] Error: failed to create explicit config at {}: {}",
|
||||
config_path.display(),
|
||||
write_error
|
||||
);
|
||||
std::process::exit(1);
|
||||
}
|
||||
eprintln!(
|
||||
"[telemt] Created default config at {}",
|
||||
config_path.display()
|
||||
);
|
||||
} else {
|
||||
eprintln!(
|
||||
"[telemt] Warning: running with in-memory default config without writing to disk"
|
||||
);
|
||||
}
|
||||
} else {
|
||||
let system_dir = std::path::Path::new("/etc/telemt");
|
||||
let system_config_path = system_dir.join("telemt.toml");
|
||||
let startup_config_path = startup_cwd.join("config.toml");
|
||||
let mut persisted = false;
|
||||
|
||||
if let Some(serialized) = serialized.as_ref() {
|
||||
match std::fs::create_dir_all(system_dir) {
|
||||
Ok(()) => match std::fs::write(&system_config_path, serialized) {
|
||||
Ok(()) => {
|
||||
config_path = system_config_path;
|
||||
eprintln!(
|
||||
"[telemt] Created default config at {}",
|
||||
config_path.display()
|
||||
);
|
||||
persisted = true;
|
||||
}
|
||||
Err(write_error) => {
|
||||
eprintln!(
|
||||
"[telemt] Warning: failed to write default config at {}: {}",
|
||||
system_config_path.display(),
|
||||
write_error
|
||||
);
|
||||
}
|
||||
},
|
||||
Err(create_error) => {
|
||||
eprintln!(
|
||||
"[telemt] Warning: failed to create {}: {}",
|
||||
system_dir.display(),
|
||||
create_error
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
if !persisted {
|
||||
match std::fs::write(&startup_config_path, serialized) {
|
||||
Ok(()) => {
|
||||
config_path = startup_config_path;
|
||||
eprintln!(
|
||||
"[telemt] Created default config at {}",
|
||||
config_path.display()
|
||||
);
|
||||
persisted = true;
|
||||
}
|
||||
Err(write_error) => {
|
||||
eprintln!(
|
||||
"[telemt] Warning: failed to write default config at {}: {}",
|
||||
startup_config_path.display(),
|
||||
write_error
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if !persisted {
|
||||
eprintln!(
|
||||
"[telemt] Warning: running with in-memory default config without writing to disk"
|
||||
);
|
||||
}
|
||||
}
|
||||
std::fs::write(&config_path, toml::to_string_pretty(&default).unwrap()).unwrap();
|
||||
eprintln!(
|
||||
"[telemt] Created default config at {}",
|
||||
config_path.display()
|
||||
);
|
||||
default
|
||||
}
|
||||
}
|
||||
|
||||
+1
-1
@@ -2,8 +2,8 @@
|
||||
|
||||
mod api;
|
||||
mod cli;
|
||||
mod config;
|
||||
mod conntrack_control;
|
||||
mod config;
|
||||
mod crypto;
|
||||
#[cfg(unix)]
|
||||
mod daemon;
|
||||
|
||||
@@ -246,9 +246,7 @@ pub fn seed_tier_for_user(user: &str) -> AdaptiveTier {
|
||||
if now.saturating_duration_since(value.seen_at) <= PROFILE_TTL {
|
||||
return value.tier;
|
||||
}
|
||||
profiles().remove_if(user, |_, v| {
|
||||
now.saturating_duration_since(v.seen_at) > PROFILE_TTL
|
||||
});
|
||||
profiles().remove_if(user, |_, v| now.saturating_duration_since(v.seen_at) > PROFILE_TTL);
|
||||
}
|
||||
AdaptiveTier::Base
|
||||
}
|
||||
|
||||
+8
-8
@@ -518,15 +518,15 @@ where
|
||||
);
|
||||
return Err(ProxyError::Io(e));
|
||||
}
|
||||
Err(_) => {
|
||||
debug!(
|
||||
peer = %real_peer,
|
||||
idle_secs = first_byte_idle_secs,
|
||||
"Closing idle pooled connection before first client byte"
|
||||
);
|
||||
return Ok(());
|
||||
Err(_) => {
|
||||
debug!(
|
||||
peer = %real_peer,
|
||||
idle_secs = first_byte_idle_secs,
|
||||
"Closing idle pooled connection before first client byte"
|
||||
);
|
||||
return Ok(());
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
let handshake_timeout = handshake_timeout_with_mask_grace(&config);
|
||||
|
||||
@@ -17,13 +17,13 @@ use crate::crypto::SecureRandom;
|
||||
use crate::error::{ProxyError, Result};
|
||||
use crate::protocol::constants::*;
|
||||
use crate::proxy::handshake::{HandshakeSuccess, encrypt_tg_nonce_with_ciphers, generate_tg_nonce};
|
||||
use crate::proxy::shared_state::{
|
||||
ConntrackCloseEvent, ConntrackClosePublishResult, ConntrackCloseReason, ProxySharedState,
|
||||
};
|
||||
use crate::proxy::route_mode::{
|
||||
ROUTE_SWITCH_ERROR_MSG, RelayRouteMode, RouteCutoverState, affected_cutover_state,
|
||||
cutover_stagger_delay,
|
||||
};
|
||||
use crate::proxy::shared_state::{
|
||||
ConntrackCloseEvent, ConntrackClosePublishResult, ConntrackCloseReason, ProxySharedState,
|
||||
};
|
||||
use crate::stats::Stats;
|
||||
use crate::stream::{BufferPool, CryptoReader, CryptoWriter};
|
||||
use crate::transport::UpstreamManager;
|
||||
|
||||
@@ -118,11 +118,7 @@ fn auth_probe_state_expired(state: &AuthProbeState, now: Instant) -> bool {
|
||||
now.duration_since(state.last_seen) > retention
|
||||
}
|
||||
|
||||
fn auth_probe_eviction_offset_in(
|
||||
shared: &ProxySharedState,
|
||||
peer_ip: IpAddr,
|
||||
now: Instant,
|
||||
) -> usize {
|
||||
fn auth_probe_eviction_offset_in(shared: &ProxySharedState, peer_ip: IpAddr, now: Instant) -> usize {
|
||||
let hasher_state = &shared.handshake.auth_probe_eviction_hasher;
|
||||
let mut hasher = hasher_state.build_hasher();
|
||||
peer_ip.hash(&mut hasher);
|
||||
|
||||
@@ -256,11 +256,7 @@ async fn wait_mask_connect_budget(started: Instant) {
|
||||
// sigma is chosen so ~99% of raw samples land inside [floor, ceiling] before clamp.
|
||||
// When floor > ceiling (misconfiguration), returns ceiling (the smaller value).
|
||||
// When floor == ceiling, returns that value. When both are 0, returns 0.
|
||||
pub(crate) fn sample_lognormal_percentile_bounded(
|
||||
floor: u64,
|
||||
ceiling: u64,
|
||||
rng: &mut impl Rng,
|
||||
) -> u64 {
|
||||
pub(crate) fn sample_lognormal_percentile_bounded(floor: u64, ceiling: u64, rng: &mut impl Rng) -> u64 {
|
||||
if ceiling == 0 && floor == 0 {
|
||||
return 0;
|
||||
}
|
||||
@@ -301,9 +297,7 @@ fn mask_outcome_target_budget(config: &ProxyConfig) -> Duration {
|
||||
}
|
||||
if ceiling > floor {
|
||||
let mut rng = rand::rng();
|
||||
return Duration::from_millis(sample_lognormal_percentile_bounded(
|
||||
floor, ceiling, &mut rng,
|
||||
));
|
||||
return Duration::from_millis(sample_lognormal_percentile_bounded(floor, ceiling, &mut rng));
|
||||
}
|
||||
// ceiling <= floor: use the larger value (fail-closed: preserve longer delay)
|
||||
return Duration::from_millis(floor.max(ceiling));
|
||||
|
||||
+21
-27
@@ -3,12 +3,12 @@ use std::collections::hash_map::DefaultHasher;
|
||||
use std::collections::{BTreeSet, HashMap};
|
||||
#[cfg(test)]
|
||||
use std::future::Future;
|
||||
use std::hash::{BuildHasher, Hash};
|
||||
#[cfg(test)]
|
||||
use std::hash::Hasher;
|
||||
use std::hash::{BuildHasher, Hash};
|
||||
use std::net::{IpAddr, SocketAddr};
|
||||
use std::sync::Arc;
|
||||
use std::sync::atomic::{AtomicU64, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
|
||||
@@ -21,13 +21,13 @@ use crate::crypto::SecureRandom;
|
||||
use crate::error::{ProxyError, Result};
|
||||
use crate::protocol::constants::{secure_padding_len, *};
|
||||
use crate::proxy::handshake::HandshakeSuccess;
|
||||
use crate::proxy::shared_state::{
|
||||
ConntrackCloseEvent, ConntrackClosePublishResult, ConntrackCloseReason, ProxySharedState,
|
||||
};
|
||||
use crate::proxy::route_mode::{
|
||||
ROUTE_SWITCH_ERROR_MSG, RelayRouteMode, RouteCutoverState, affected_cutover_state,
|
||||
cutover_stagger_delay,
|
||||
};
|
||||
use crate::proxy::shared_state::{
|
||||
ConntrackCloseEvent, ConntrackClosePublishResult, ConntrackCloseReason, ProxySharedState,
|
||||
};
|
||||
use crate::stats::{
|
||||
MeD2cFlushReason, MeD2cQuotaRejectStage, MeD2cWriteMode, QuotaReserveError, Stats, UserStats,
|
||||
};
|
||||
@@ -257,7 +257,9 @@ impl RelayClientIdlePolicy {
|
||||
if self.soft_idle > self.hard_idle {
|
||||
self.soft_idle = self.hard_idle;
|
||||
}
|
||||
self.legacy_frame_read_timeout = self.legacy_frame_read_timeout.min(pressure_hard_idle_cap);
|
||||
self.legacy_frame_read_timeout = self
|
||||
.legacy_frame_read_timeout
|
||||
.min(pressure_hard_idle_cap);
|
||||
if self.grace_after_downstream_activity > self.hard_idle {
|
||||
self.grace_after_downstream_activity = self.hard_idle;
|
||||
}
|
||||
@@ -459,15 +461,12 @@ fn report_desync_frame_too_large_in(
|
||||
.map(|b| matches!(b[0], b'G' | b'P' | b'H' | b'C' | b'D'))
|
||||
.unwrap_or(false);
|
||||
let now = Instant::now();
|
||||
let dedup_key = hash_value_in(
|
||||
shared,
|
||||
&(
|
||||
state.user.as_str(),
|
||||
state.peer_hash,
|
||||
proto_tag,
|
||||
DESYNC_ERROR_CLASS,
|
||||
),
|
||||
);
|
||||
let dedup_key = hash_value_in(shared, &(
|
||||
state.user.as_str(),
|
||||
state.peer_hash,
|
||||
proto_tag,
|
||||
DESYNC_ERROR_CLASS,
|
||||
));
|
||||
let emit_full = should_emit_full_desync_in(shared, dedup_key, state.desync_all_full, now);
|
||||
let duration_ms = state.started_at.elapsed().as_millis() as u64;
|
||||
let bytes_me2c = state.bytes_me2c.load(Ordering::Relaxed);
|
||||
@@ -632,10 +631,7 @@ fn observe_me_d2c_flush_event(
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn mark_relay_idle_candidate_for_testing(
|
||||
shared: &ProxySharedState,
|
||||
conn_id: u64,
|
||||
) -> bool {
|
||||
pub(crate) fn mark_relay_idle_candidate_for_testing(shared: &ProxySharedState, conn_id: u64) -> bool {
|
||||
let registry = &shared.middle_relay.relay_idle_registry;
|
||||
let mut guard = match registry.lock() {
|
||||
Ok(guard) => guard,
|
||||
@@ -720,10 +716,7 @@ pub(crate) fn relay_pressure_event_seq_for_testing(shared: &ProxySharedState) ->
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn relay_idle_mark_seq_for_testing(shared: &ProxySharedState) -> u64 {
|
||||
shared
|
||||
.middle_relay
|
||||
.relay_idle_mark_seq
|
||||
.load(Ordering::Relaxed)
|
||||
shared.middle_relay.relay_idle_mark_seq.load(Ordering::Relaxed)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
@@ -872,7 +865,10 @@ pub(crate) fn desync_dedup_insert_for_testing(shared: &ProxySharedState, key: u6
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn desync_dedup_get_for_testing(shared: &ProxySharedState, key: u64) -> Option<Instant> {
|
||||
pub(crate) fn desync_dedup_get_for_testing(
|
||||
shared: &ProxySharedState,
|
||||
key: u64,
|
||||
) -> Option<Instant> {
|
||||
shared
|
||||
.middle_relay
|
||||
.desync_dedup
|
||||
@@ -881,9 +877,7 @@ pub(crate) fn desync_dedup_get_for_testing(shared: &ProxySharedState, key: u64)
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
pub(crate) fn desync_dedup_keys_for_testing(
|
||||
shared: &ProxySharedState,
|
||||
) -> std::collections::HashSet<u64> {
|
||||
pub(crate) fn desync_dedup_keys_for_testing(shared: &ProxySharedState) -> std::collections::HashSet<u64> {
|
||||
shared
|
||||
.middle_relay
|
||||
.desync_dedup
|
||||
|
||||
@@ -8,7 +8,7 @@ use std::time::Instant;
|
||||
use dashmap::DashMap;
|
||||
use tokio::sync::mpsc;
|
||||
|
||||
use crate::proxy::handshake::{AuthProbeSaturationState, AuthProbeState};
|
||||
use crate::proxy::handshake::{AuthProbeState, AuthProbeSaturationState};
|
||||
use crate::proxy::middle_relay::{DesyncDedupRotationState, RelayIdleCandidateRegistry};
|
||||
|
||||
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
|
||||
@@ -136,8 +136,7 @@ impl ProxySharedState {
|
||||
}
|
||||
|
||||
pub(crate) fn set_conntrack_pressure_active(&self, active: bool) {
|
||||
self.conntrack_pressure_active
|
||||
.store(active, Ordering::Relaxed);
|
||||
self.conntrack_pressure_active.store(active, Ordering::Relaxed);
|
||||
}
|
||||
|
||||
pub(crate) fn conntrack_pressure_active(&self) -> bool {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
use super::*;
|
||||
use std::sync::Arc;
|
||||
use std::sync::atomic::{AtomicUsize, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
static RACE_TEST_KEY_COUNTER: AtomicUsize = AtomicUsize::new(1_000_000);
|
||||
|
||||
@@ -65,15 +65,9 @@ fn adaptive_base_tier_buffers_unchanged() {
|
||||
fn adaptive_tier1_buffers_within_caps() {
|
||||
let (c2s, s2c) = direct_copy_buffers_for_tier(AdaptiveTier::Tier1, 65536, 262144);
|
||||
assert!(c2s > 65536, "Tier1 c2s should exceed Base");
|
||||
assert!(
|
||||
c2s <= 128 * 1024,
|
||||
"Tier1 c2s should not exceed DIRECT_C2S_CAP_BYTES"
|
||||
);
|
||||
assert!(c2s <= 128 * 1024, "Tier1 c2s should not exceed DIRECT_C2S_CAP_BYTES");
|
||||
assert!(s2c > 262144, "Tier1 s2c should exceed Base");
|
||||
assert!(
|
||||
s2c <= 512 * 1024,
|
||||
"Tier1 s2c should not exceed DIRECT_S2C_CAP_BYTES"
|
||||
);
|
||||
assert!(s2c <= 512 * 1024, "Tier1 s2c should not exceed DIRECT_S2C_CAP_BYTES");
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
@@ -19,8 +19,7 @@ fn adversarial_large_state_offsets_escape_first_scan_window() {
|
||||
((i.wrapping_mul(131)) & 0xff) as u8,
|
||||
));
|
||||
let now = base + Duration::from_nanos(i);
|
||||
let start =
|
||||
auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
let start = auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
if start >= scan_limit {
|
||||
saw_offset_outside_first_window = true;
|
||||
break;
|
||||
@@ -49,8 +48,7 @@ fn stress_large_state_offsets_cover_many_scan_windows() {
|
||||
((i.wrapping_mul(17)) & 0xff) as u8,
|
||||
));
|
||||
let now = base + Duration::from_micros(i);
|
||||
let start =
|
||||
auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
let start = auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
covered_windows.insert(start / scan_limit);
|
||||
}
|
||||
|
||||
@@ -82,8 +80,7 @@ fn light_fuzz_offset_always_stays_inside_state_len() {
|
||||
let state_len = ((seed >> 16) as usize % 200_000).saturating_add(1);
|
||||
let scan_limit = ((seed >> 40) as usize % 2_048).saturating_add(1);
|
||||
let now = base + Duration::from_nanos(seed & 0x0fff);
|
||||
let start =
|
||||
auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
let start = auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
|
||||
assert!(
|
||||
start < state_len,
|
||||
|
||||
@@ -87,11 +87,7 @@ fn adversarial_saturation_grace_requires_extra_failures_before_preauth_throttle(
|
||||
}
|
||||
|
||||
assert!(
|
||||
auth_probe_should_apply_preauth_throttle_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
now + Duration::from_millis(1)
|
||||
),
|
||||
auth_probe_should_apply_preauth_throttle_in(shared.as_ref(), ip, now + Duration::from_millis(1)),
|
||||
"after grace failures are exhausted, preauth throttle must activate"
|
||||
);
|
||||
}
|
||||
@@ -138,11 +134,7 @@ fn light_fuzz_randomized_failures_preserve_cap_and_nonzero_streaks() {
|
||||
(seed >> 8) as u8,
|
||||
seed as u8,
|
||||
));
|
||||
auth_probe_record_failure_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
now + Duration::from_millis((seed & 0x3f) as u64),
|
||||
);
|
||||
auth_probe_record_failure_in(shared.as_ref(), ip, now + Duration::from_millis((seed & 0x3f) as u64));
|
||||
}
|
||||
|
||||
let state = auth_probe_state_for_testing_in_shared(shared.as_ref());
|
||||
@@ -170,11 +162,7 @@ async fn stress_parallel_failure_flood_keeps_state_hard_capped() {
|
||||
((i >> 8) & 0xff) as u8,
|
||||
(i & 0xff) as u8,
|
||||
));
|
||||
auth_probe_record_failure_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
start + Duration::from_millis((i % 4) as u64),
|
||||
);
|
||||
auth_probe_record_failure_in(shared.as_ref(), ip, start + Duration::from_millis((i % 4) as u64));
|
||||
}
|
||||
}));
|
||||
}
|
||||
|
||||
@@ -31,8 +31,7 @@ fn adversarial_large_state_must_allow_start_offset_outside_scan_budget_window()
|
||||
(i & 0xff) as u8,
|
||||
));
|
||||
let now = base + Duration::from_micros(i as u64);
|
||||
let start =
|
||||
auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
let start = auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
assert!(
|
||||
start < state_len,
|
||||
"start offset must stay within state length; start={start}, len={state_len}"
|
||||
@@ -84,8 +83,7 @@ fn light_fuzz_scan_offset_budget_never_exceeds_effective_window() {
|
||||
let state_len = ((seed >> 8) as usize % 131_072).saturating_add(1);
|
||||
let scan_limit = ((seed >> 32) as usize % 512).saturating_add(1);
|
||||
let now = base + Duration::from_nanos(seed & 0xffff);
|
||||
let start =
|
||||
auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
let start = auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
|
||||
assert!(
|
||||
start < state_len,
|
||||
|
||||
@@ -36,13 +36,7 @@ fn adversarial_many_ips_same_time_spreads_offsets_without_bias_collapse() {
|
||||
i as u8,
|
||||
(255 - (i as u8)),
|
||||
));
|
||||
uniq.insert(auth_probe_scan_start_offset_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
now,
|
||||
65_536,
|
||||
16,
|
||||
));
|
||||
uniq.insert(auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, 65_536, 16));
|
||||
}
|
||||
|
||||
assert!(
|
||||
@@ -69,11 +63,7 @@ async fn stress_parallel_failure_churn_under_saturation_remains_capped_and_live(
|
||||
((i >> 8) & 0xff) as u8,
|
||||
(i & 0xff) as u8,
|
||||
));
|
||||
auth_probe_record_failure_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
start + Duration::from_micros((i % 128) as u64),
|
||||
);
|
||||
auth_probe_record_failure_in(shared.as_ref(), ip, start + Duration::from_micros((i % 128) as u64));
|
||||
}
|
||||
}));
|
||||
}
|
||||
@@ -83,17 +73,12 @@ async fn stress_parallel_failure_churn_under_saturation_remains_capped_and_live(
|
||||
}
|
||||
|
||||
assert!(
|
||||
auth_probe_state_for_testing_in_shared(shared.as_ref()).len()
|
||||
<= AUTH_PROBE_TRACK_MAX_ENTRIES,
|
||||
auth_probe_state_for_testing_in_shared(shared.as_ref()).len() <= AUTH_PROBE_TRACK_MAX_ENTRIES,
|
||||
"state must remain hard-capped under parallel saturation churn"
|
||||
);
|
||||
|
||||
let probe = IpAddr::V4(Ipv4Addr::new(10, 4, 1, 1));
|
||||
let _ = auth_probe_should_apply_preauth_throttle_in(
|
||||
shared.as_ref(),
|
||||
probe,
|
||||
start + Duration::from_millis(1),
|
||||
);
|
||||
let _ = auth_probe_should_apply_preauth_throttle_in(shared.as_ref(), probe, start + Duration::from_millis(1));
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -117,8 +102,7 @@ fn light_fuzz_scan_offset_stays_within_window_for_randomized_inputs() {
|
||||
let scan_limit = ((seed >> 40) as usize % 1024).saturating_add(1);
|
||||
let now = base + Duration::from_nanos(seed & 0x1fff);
|
||||
|
||||
let offset =
|
||||
auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
let offset = auth_probe_scan_start_offset_in(shared.as_ref(), ip, now, state_len, scan_limit);
|
||||
assert!(
|
||||
offset < state_len,
|
||||
"scan offset must always remain inside state length"
|
||||
|
||||
@@ -116,14 +116,8 @@ async fn handshake_baseline_auth_probe_streak_increments_per_ip() {
|
||||
)
|
||||
.await;
|
||||
assert!(matches!(res, HandshakeResult::BadClient { .. }));
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), peer.ip()),
|
||||
Some(expected)
|
||||
);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), untouched_ip),
|
||||
None
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), peer.ip()), Some(expected));
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), untouched_ip), None);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -155,8 +149,7 @@ fn handshake_baseline_repeated_probes_streak_monotonic() {
|
||||
|
||||
for _ in 0..100 {
|
||||
auth_probe_record_failure_in(shared.as_ref(), ip, now);
|
||||
let current =
|
||||
auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), ip).unwrap_or(0);
|
||||
let current = auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), ip).unwrap_or(0);
|
||||
assert!(current >= prev, "streak must be monotonic");
|
||||
prev = current;
|
||||
}
|
||||
@@ -180,16 +173,8 @@ fn handshake_baseline_throttled_ip_incurs_backoff_delay() {
|
||||
let before_expiry = now + delay.saturating_sub(Duration::from_millis(1));
|
||||
let after_expiry = now + delay + Duration::from_millis(1);
|
||||
|
||||
assert!(auth_probe_is_throttled_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
before_expiry
|
||||
));
|
||||
assert!(!auth_probe_is_throttled_in(
|
||||
shared.as_ref(),
|
||||
ip,
|
||||
after_expiry
|
||||
));
|
||||
assert!(auth_probe_is_throttled_in(shared.as_ref(), ip, before_expiry));
|
||||
assert!(!auth_probe_is_throttled_in(shared.as_ref(), ip, after_expiry));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -227,10 +212,7 @@ async fn handshake_baseline_malformed_probe_frames_fail_closed_to_masking() {
|
||||
.expect("malformed probe handling must complete in bounded time");
|
||||
|
||||
assert!(
|
||||
matches!(
|
||||
res,
|
||||
HandshakeResult::BadClient { .. } | HandshakeResult::Error(_)
|
||||
),
|
||||
matches!(res, HandshakeResult::BadClient { .. } | HandshakeResult::Error(_)),
|
||||
"malformed probe must fail closed"
|
||||
);
|
||||
}
|
||||
|
||||
@@ -332,13 +332,7 @@ async fn invalid_secret_warning_lock_contention_and_bound() {
|
||||
b.wait().await;
|
||||
for i in 0..iterations_per_task {
|
||||
let user_name = format!("contention_user_{}_{}", t, i);
|
||||
warn_invalid_secret_once_in(
|
||||
shared.as_ref(),
|
||||
&user_name,
|
||||
"invalid_hex",
|
||||
ACCESS_SECRET_BYTES,
|
||||
None,
|
||||
);
|
||||
warn_invalid_secret_once_in(shared.as_ref(), &user_name, "invalid_hex", ACCESS_SECRET_BYTES, None);
|
||||
}
|
||||
}));
|
||||
}
|
||||
@@ -635,8 +629,7 @@ fn auth_probe_saturation_note_resets_retention_window() {
|
||||
|
||||
// This call may return false if backoff has elapsed, but it must not clear
|
||||
// the saturation state because `later` refreshed last_seen.
|
||||
let _ =
|
||||
auth_probe_saturation_is_throttled_at_for_testing_in_shared(shared.as_ref(), check_time);
|
||||
let _ = auth_probe_saturation_is_throttled_at_for_testing_in_shared(shared.as_ref(), check_time);
|
||||
let guard = auth_probe_saturation_state_lock_for_testing_in_shared(shared.as_ref());
|
||||
assert!(
|
||||
guard.is_some(),
|
||||
|
||||
@@ -206,12 +206,7 @@ fn auth_probe_eviction_identical_timestamps_keeps_map_bounded() {
|
||||
}
|
||||
|
||||
let new_ip = IpAddr::V4(Ipv4Addr::new(192, 168, 21, 21));
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
state,
|
||||
new_ip,
|
||||
same + Duration::from_millis(1),
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), state, new_ip, same + Duration::from_millis(1));
|
||||
|
||||
assert_eq!(state.len(), AUTH_PROBE_TRACK_MAX_ENTRIES);
|
||||
assert!(state.contains_key(&new_ip));
|
||||
@@ -330,8 +325,7 @@ async fn saturation_grace_exhaustion_under_concurrency_keeps_peer_throttled() {
|
||||
final_state.fail_streak
|
||||
>= AUTH_PROBE_BACKOFF_START_FAILS + AUTH_PROBE_SATURATION_GRACE_FAILS
|
||||
);
|
||||
assert!(auth_probe_should_apply_preauth_throttle_in(
|
||||
shared.as_ref(),
|
||||
assert!(auth_probe_should_apply_preauth_throttle_in(shared.as_ref(),
|
||||
peer_ip,
|
||||
Instant::now()
|
||||
));
|
||||
|
||||
@@ -54,9 +54,7 @@ fn clear_auth_probe_state_clears_saturation_even_if_poisoned() {
|
||||
poison_saturation_mutex(shared.as_ref());
|
||||
|
||||
auth_probe_note_saturation_in(shared.as_ref(), Instant::now());
|
||||
assert!(auth_probe_saturation_is_throttled_for_testing_in_shared(
|
||||
shared.as_ref()
|
||||
));
|
||||
assert!(auth_probe_saturation_is_throttled_for_testing_in_shared(shared.as_ref()));
|
||||
|
||||
clear_auth_probe_state_for_testing_in_shared(shared.as_ref());
|
||||
assert!(
|
||||
|
||||
@@ -1427,13 +1427,7 @@ fn invalid_secret_warning_cache_is_bounded() {
|
||||
|
||||
for idx in 0..(WARNED_SECRET_MAX_ENTRIES + 32) {
|
||||
let user = format!("warned_user_{idx}");
|
||||
warn_invalid_secret_once_in(
|
||||
shared.as_ref(),
|
||||
&user,
|
||||
"invalid_length",
|
||||
ACCESS_SECRET_BYTES,
|
||||
Some(idx),
|
||||
);
|
||||
warn_invalid_secret_once_in(shared.as_ref(), &user, "invalid_length", ACCESS_SECRET_BYTES, Some(idx));
|
||||
}
|
||||
|
||||
let warned = warned_secrets_for_testing_in_shared(shared.as_ref());
|
||||
@@ -1646,15 +1640,11 @@ fn unknown_sni_warn_cooldown_first_event_is_warn_and_repeated_events_are_info_un
|
||||
"first unknown SNI event must be eligible for WARN emission"
|
||||
);
|
||||
assert!(
|
||||
!should_emit_unknown_sni_warn_for_testing_in_shared(
|
||||
shared.as_ref(),
|
||||
now + Duration::from_secs(1)
|
||||
),
|
||||
!should_emit_unknown_sni_warn_for_testing_in_shared(shared.as_ref(), now + Duration::from_secs(1)),
|
||||
"events inside cooldown window must be demoted from WARN to INFO"
|
||||
);
|
||||
assert!(
|
||||
should_emit_unknown_sni_warn_for_testing_in_shared(
|
||||
shared.as_ref(),
|
||||
should_emit_unknown_sni_warn_for_testing_in_shared(shared.as_ref(),
|
||||
now + Duration::from_secs(UNKNOWN_SNI_WARN_COOLDOWN_SECS)
|
||||
),
|
||||
"once cooldown expires, next unknown SNI event must be WARN-eligible again"
|
||||
@@ -1735,12 +1725,7 @@ fn auth_probe_over_cap_churn_still_tracks_newcomer_after_round_limit() {
|
||||
}
|
||||
|
||||
let newcomer = IpAddr::V4(Ipv4Addr::new(203, 0, 114, 77));
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
&state,
|
||||
newcomer,
|
||||
now + Duration::from_secs(1),
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), &state, newcomer, now + Duration::from_secs(1));
|
||||
|
||||
assert!(
|
||||
state.get(&newcomer).is_some(),
|
||||
@@ -1946,18 +1931,8 @@ fn auth_probe_ipv6_is_bucketed_by_prefix_64() {
|
||||
let ip_a = IpAddr::V6("2001:db8:abcd:1234:1:2:3:4".parse().unwrap());
|
||||
let ip_b = IpAddr::V6("2001:db8:abcd:1234:ffff:eeee:dddd:cccc".parse().unwrap());
|
||||
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
&state,
|
||||
normalize_auth_probe_ip(ip_a),
|
||||
now,
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
&state,
|
||||
normalize_auth_probe_ip(ip_b),
|
||||
now,
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), &state, normalize_auth_probe_ip(ip_a), now);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), &state, normalize_auth_probe_ip(ip_b), now);
|
||||
|
||||
let normalized = normalize_auth_probe_ip(ip_a);
|
||||
assert_eq!(
|
||||
@@ -1981,18 +1956,8 @@ fn auth_probe_ipv6_different_prefixes_use_distinct_buckets() {
|
||||
let ip_a = IpAddr::V6("2001:db8:1111:2222:1:2:3:4".parse().unwrap());
|
||||
let ip_b = IpAddr::V6("2001:db8:1111:3333:1:2:3:4".parse().unwrap());
|
||||
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
&state,
|
||||
normalize_auth_probe_ip(ip_a),
|
||||
now,
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
&state,
|
||||
normalize_auth_probe_ip(ip_b),
|
||||
now,
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), &state, normalize_auth_probe_ip(ip_a), now);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), &state, normalize_auth_probe_ip(ip_b), now);
|
||||
|
||||
assert_eq!(
|
||||
state.len(),
|
||||
@@ -2105,12 +2070,7 @@ fn auth_probe_round_limited_overcap_eviction_marks_saturation_and_keeps_newcomer
|
||||
}
|
||||
|
||||
let newcomer = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 40));
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
&state,
|
||||
newcomer,
|
||||
now + Duration::from_millis(1),
|
||||
);
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(), &state, newcomer, now + Duration::from_millis(1));
|
||||
|
||||
assert!(
|
||||
state.get(&newcomer).is_some(),
|
||||
@@ -2121,10 +2081,7 @@ fn auth_probe_round_limited_overcap_eviction_marks_saturation_and_keeps_newcomer
|
||||
"high fail-streak sentinel must survive round-limited eviction"
|
||||
);
|
||||
assert!(
|
||||
auth_probe_saturation_is_throttled_at_for_testing_in_shared(
|
||||
shared.as_ref(),
|
||||
now + Duration::from_millis(1)
|
||||
),
|
||||
auth_probe_saturation_is_throttled_at_for_testing_in_shared(shared.as_ref(), now + Duration::from_millis(1)),
|
||||
"round-limited over-cap path must activate saturation throttle marker"
|
||||
);
|
||||
}
|
||||
@@ -2206,8 +2163,7 @@ fn stress_auth_probe_overcap_churn_does_not_starve_high_threat_sentinel_bucket()
|
||||
((step >> 8) & 0xff) as u8,
|
||||
(step & 0xff) as u8,
|
||||
));
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(),
|
||||
&state,
|
||||
newcomer,
|
||||
base_now + Duration::from_millis(step as u64 + 1),
|
||||
@@ -2270,8 +2226,7 @@ fn light_fuzz_auth_probe_overcap_eviction_prefers_less_threatening_entries() {
|
||||
((round >> 8) & 0xff) as u8,
|
||||
(round & 0xff) as u8,
|
||||
));
|
||||
auth_probe_record_failure_with_state_in(
|
||||
shared.as_ref(),
|
||||
auth_probe_record_failure_with_state_in(shared.as_ref(),
|
||||
&state,
|
||||
newcomer,
|
||||
now + Duration::from_millis(round as u64 + 1),
|
||||
@@ -3150,10 +3105,7 @@ async fn saturation_grace_boundary_still_admits_valid_tls_before_exhaustion() {
|
||||
matches!(result, HandshakeResult::Success(_)),
|
||||
"valid TLS should still pass while peer remains within saturation grace budget"
|
||||
);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), peer.ip()),
|
||||
None
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), peer.ip()), None);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -3219,10 +3171,7 @@ async fn saturation_grace_exhaustion_blocks_valid_tls_until_backoff_expires() {
|
||||
matches!(allowed, HandshakeResult::Success(_)),
|
||||
"valid TLS should recover after peer-specific pre-auth backoff has elapsed"
|
||||
);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), peer.ip()),
|
||||
None
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(shared.as_ref(), peer.ip()), None);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
use super::*;
|
||||
use rand::SeedableRng;
|
||||
use rand::rngs::StdRng;
|
||||
use rand::SeedableRng;
|
||||
|
||||
fn seeded_rng(seed: u64) -> StdRng {
|
||||
StdRng::seed_from_u64(seed)
|
||||
@@ -57,10 +57,7 @@ fn masking_lognormal_degenerate_floor_eq_ceiling_returns_floor() {
|
||||
let mut rng = seeded_rng(99);
|
||||
for _ in 0..100 {
|
||||
let val = sample_lognormal_percentile_bounded(1000, 1000, &mut rng);
|
||||
assert_eq!(
|
||||
val, 1000,
|
||||
"floor == ceiling must always return exactly that value"
|
||||
);
|
||||
assert_eq!(val, 1000, "floor == ceiling must always return exactly that value");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -7,22 +7,13 @@ fn middle_relay_baseline_public_api_idle_roundtrip_contract() {
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(shared.as_ref());
|
||||
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 7001));
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(7001)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(7001));
|
||||
|
||||
clear_relay_idle_candidate_for_testing(shared.as_ref(), 7001);
|
||||
assert_ne!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(7001)
|
||||
);
|
||||
assert_ne!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(7001));
|
||||
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 7001));
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(7001)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(7001));
|
||||
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(shared.as_ref());
|
||||
}
|
||||
@@ -35,12 +26,7 @@ fn middle_relay_baseline_public_api_desync_window_contract() {
|
||||
let key = 0xDEAD_BEEF_0000_0001u64;
|
||||
let t0 = Instant::now();
|
||||
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
key,
|
||||
false,
|
||||
t0
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(shared.as_ref(), key, false, t0));
|
||||
assert!(!should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
key,
|
||||
@@ -49,12 +35,7 @@ fn middle_relay_baseline_public_api_desync_window_contract() {
|
||||
));
|
||||
|
||||
let t1 = t0 + DESYNC_DEDUP_WINDOW + Duration::from_millis(10);
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
key,
|
||||
false,
|
||||
t1
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(shared.as_ref(), key, false, t1));
|
||||
|
||||
clear_desync_dedup_for_testing_in_shared(shared.as_ref());
|
||||
}
|
||||
|
||||
@@ -13,12 +13,7 @@ fn desync_all_full_bypass_does_not_initialize_or_grow_dedup_cache() {
|
||||
|
||||
for i in 0..20_000u64 {
|
||||
assert!(
|
||||
should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
0xD35E_D000_0000_0000u64 ^ i,
|
||||
true,
|
||||
now
|
||||
),
|
||||
should_emit_full_desync_for_testing(shared.as_ref(), 0xD35E_D000_0000_0000u64 ^ i, true, now),
|
||||
"desync_all_full path must always emit"
|
||||
);
|
||||
}
|
||||
@@ -42,12 +37,7 @@ fn desync_all_full_bypass_keeps_existing_dedup_entries_unchanged() {
|
||||
let now = Instant::now();
|
||||
for i in 0..2048u64 {
|
||||
assert!(
|
||||
should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
0xF011_F000_0000_0000u64 ^ i,
|
||||
true,
|
||||
now
|
||||
),
|
||||
should_emit_full_desync_for_testing(shared.as_ref(), 0xF011_F000_0000_0000u64 ^ i, true, now),
|
||||
"desync_all_full must bypass suppression and dedup refresh"
|
||||
);
|
||||
}
|
||||
@@ -78,8 +68,7 @@ fn edge_all_full_burst_does_not_poison_later_false_path_tracking() {
|
||||
|
||||
let now = Instant::now();
|
||||
for i in 0..8192u64 {
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
assert!(should_emit_full_desync_for_testing(shared.as_ref(),
|
||||
0xABCD_0000_0000_0000 ^ i,
|
||||
true,
|
||||
now
|
||||
@@ -113,12 +102,7 @@ fn adversarial_mixed_sequence_true_steps_never_change_cache_len() {
|
||||
let flag_all_full = (seed & 0x1) == 1;
|
||||
let key = 0x7000_0000_0000_0000u64 ^ i ^ seed;
|
||||
let before = desync_dedup_len_for_testing(shared.as_ref());
|
||||
let _ = should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
key,
|
||||
flag_all_full,
|
||||
Instant::now(),
|
||||
);
|
||||
let _ = should_emit_full_desync_for_testing(shared.as_ref(), key, flag_all_full, Instant::now());
|
||||
let after = desync_dedup_len_for_testing(shared.as_ref());
|
||||
|
||||
if flag_all_full {
|
||||
@@ -140,12 +124,7 @@ fn light_fuzz_all_full_mode_always_emits_and_stays_bounded() {
|
||||
seed ^= seed >> 9;
|
||||
seed ^= seed << 8;
|
||||
let key = seed ^ 0x55AA_55AA_55AA_55AAu64;
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
shared.as_ref(),
|
||||
key,
|
||||
true,
|
||||
Instant::now()
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(shared.as_ref(), key, true, Instant::now()));
|
||||
}
|
||||
|
||||
let after = desync_dedup_len_for_testing(shared.as_ref());
|
||||
|
||||
@@ -366,42 +366,23 @@ fn pressure_evicts_oldest_idle_candidate_with_deterministic_ordering() {
|
||||
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 10));
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 11));
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(10)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(10));
|
||||
|
||||
note_relay_pressure_event_for_testing(shared.as_ref());
|
||||
|
||||
let mut seen_for_newer = 0u64;
|
||||
assert!(
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
11,
|
||||
&mut seen_for_newer,
|
||||
&stats
|
||||
),
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 11, &mut seen_for_newer, &stats),
|
||||
"newer idle candidate must not be evicted while older candidate exists"
|
||||
);
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(10)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(10));
|
||||
|
||||
let mut seen_for_oldest = 0u64;
|
||||
assert!(
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
10,
|
||||
&mut seen_for_oldest,
|
||||
&stats
|
||||
),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 10, &mut seen_for_oldest, &stats),
|
||||
"oldest idle candidate must be evicted first under pressure"
|
||||
);
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(11)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(11));
|
||||
assert_eq!(stats.get_relay_pressure_evict_total(), 1);
|
||||
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(shared.as_ref());
|
||||
@@ -421,10 +402,7 @@ fn pressure_does_not_evict_without_new_pressure_signal() {
|
||||
"without new pressure signal, candidate must stay"
|
||||
);
|
||||
assert_eq!(stats.get_relay_pressure_evict_total(), 0);
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(21)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(21));
|
||||
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(shared.as_ref());
|
||||
}
|
||||
@@ -437,10 +415,7 @@ fn stress_pressure_eviction_preserves_fifo_across_many_candidates() {
|
||||
|
||||
let mut seen_per_conn = std::collections::HashMap::new();
|
||||
for conn_id in 1000u64..1064u64 {
|
||||
assert!(mark_relay_idle_candidate_for_testing(
|
||||
shared.as_ref(),
|
||||
conn_id
|
||||
));
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), conn_id));
|
||||
seen_per_conn.insert(conn_id, 0u64);
|
||||
}
|
||||
|
||||
@@ -451,12 +426,7 @@ fn stress_pressure_eviction_preserves_fifo_across_many_candidates() {
|
||||
.get(&expected)
|
||||
.expect("per-conn pressure cursor must exist");
|
||||
assert!(
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
expected,
|
||||
&mut seen,
|
||||
&stats
|
||||
),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), expected, &mut seen, &stats),
|
||||
"expected conn_id {expected} must be evicted next by deterministic FIFO ordering"
|
||||
);
|
||||
seen_per_conn.insert(expected, seen);
|
||||
@@ -466,10 +436,7 @@ fn stress_pressure_eviction_preserves_fifo_across_many_candidates() {
|
||||
} else {
|
||||
Some(expected + 1)
|
||||
};
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
next
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), next);
|
||||
}
|
||||
|
||||
assert_eq!(stats.get_relay_pressure_evict_total(), 64);
|
||||
@@ -493,24 +460,9 @@ fn blackhat_single_pressure_event_must_not_evict_more_than_one_candidate() {
|
||||
// Single pressure event should authorize at most one eviction globally.
|
||||
note_relay_pressure_event_for_testing(shared.as_ref());
|
||||
|
||||
let evicted_301 = maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
301,
|
||||
&mut seen_301,
|
||||
&stats,
|
||||
);
|
||||
let evicted_302 = maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
302,
|
||||
&mut seen_302,
|
||||
&stats,
|
||||
);
|
||||
let evicted_303 = maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
303,
|
||||
&mut seen_303,
|
||||
&stats,
|
||||
);
|
||||
let evicted_301 = maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 301, &mut seen_301, &stats);
|
||||
let evicted_302 = maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 302, &mut seen_302, &stats);
|
||||
let evicted_303 = maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 303, &mut seen_303, &stats);
|
||||
|
||||
let evicted_total = [evicted_301, evicted_302, evicted_303]
|
||||
.iter()
|
||||
@@ -540,22 +492,12 @@ fn blackhat_pressure_counter_must_track_global_budget_not_per_session_cursor() {
|
||||
note_relay_pressure_event_for_testing(shared.as_ref());
|
||||
|
||||
assert!(
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
401,
|
||||
&mut seen_oldest,
|
||||
&stats
|
||||
),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 401, &mut seen_oldest, &stats),
|
||||
"oldest candidate must consume pressure budget first"
|
||||
);
|
||||
|
||||
assert!(
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
402,
|
||||
&mut seen_next,
|
||||
&stats
|
||||
),
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 402, &mut seen_next, &stats),
|
||||
"next candidate must not consume the same pressure budget"
|
||||
);
|
||||
|
||||
@@ -580,12 +522,7 @@ fn blackhat_stale_pressure_before_idle_mark_must_not_trigger_eviction() {
|
||||
|
||||
let mut seen = 0u64;
|
||||
assert!(
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
501,
|
||||
&mut seen,
|
||||
&stats
|
||||
),
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 501, &mut seen, &stats),
|
||||
"stale pressure (before soft-idle mark) must not evict newly marked candidate"
|
||||
);
|
||||
|
||||
@@ -608,24 +545,9 @@ fn blackhat_stale_pressure_must_not_evict_any_of_newly_marked_batch() {
|
||||
let mut seen_513 = 0u64;
|
||||
|
||||
let evicted = [
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
511,
|
||||
&mut seen_511,
|
||||
&stats,
|
||||
),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
512,
|
||||
&mut seen_512,
|
||||
&stats,
|
||||
),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
513,
|
||||
&mut seen_513,
|
||||
&stats,
|
||||
),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 511, &mut seen_511, &stats),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 512, &mut seen_512, &stats),
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 513, &mut seen_513, &stats),
|
||||
]
|
||||
.iter()
|
||||
.filter(|value| **value)
|
||||
@@ -650,12 +572,7 @@ fn blackhat_stale_pressure_seen_without_candidates_must_be_globally_invalidated(
|
||||
// Session A observed pressure while there were no candidates.
|
||||
let mut seen_a = 0u64;
|
||||
assert!(
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
999_001,
|
||||
&mut seen_a,
|
||||
&stats
|
||||
),
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 999_001, &mut seen_a, &stats),
|
||||
"no candidate existed, so no eviction is possible"
|
||||
);
|
||||
|
||||
@@ -663,12 +580,7 @@ fn blackhat_stale_pressure_seen_without_candidates_must_be_globally_invalidated(
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 521));
|
||||
let mut seen_b = 0u64;
|
||||
assert!(
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
521,
|
||||
&mut seen_b,
|
||||
&stats
|
||||
),
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 521, &mut seen_b, &stats),
|
||||
"once pressure is observed with empty candidate set, it must not be replayed later"
|
||||
);
|
||||
|
||||
@@ -688,12 +600,7 @@ fn blackhat_stale_pressure_must_not_survive_candidate_churn() {
|
||||
|
||||
let mut seen = 0u64;
|
||||
assert!(
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
532,
|
||||
&mut seen,
|
||||
&stats
|
||||
),
|
||||
!maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), 532, &mut seen, &stats),
|
||||
"stale pressure must not survive clear+remark churn cycles"
|
||||
);
|
||||
|
||||
@@ -756,10 +663,7 @@ async fn integration_race_single_pressure_event_allows_at_most_one_eviction_unde
|
||||
let mut seen_per_session = vec![0u64; sessions];
|
||||
|
||||
for conn_id in &conn_ids {
|
||||
assert!(mark_relay_idle_candidate_for_testing(
|
||||
shared.as_ref(),
|
||||
*conn_id
|
||||
));
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), *conn_id));
|
||||
}
|
||||
|
||||
for round in 0..rounds {
|
||||
@@ -772,12 +676,8 @@ async fn integration_race_single_pressure_event_allows_at_most_one_eviction_unde
|
||||
let stats = stats.clone();
|
||||
let shared = shared.clone();
|
||||
joins.push(tokio::spawn(async move {
|
||||
let evicted = maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
conn_id,
|
||||
&mut seen,
|
||||
stats.as_ref(),
|
||||
);
|
||||
let evicted =
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), conn_id, &mut seen, stats.as_ref());
|
||||
(idx, conn_id, seen, evicted)
|
||||
}));
|
||||
}
|
||||
@@ -829,10 +729,7 @@ async fn integration_race_burst_pressure_with_churn_preserves_empty_set_invalida
|
||||
let mut seen_per_session = vec![0u64; sessions];
|
||||
|
||||
for conn_id in &conn_ids {
|
||||
assert!(mark_relay_idle_candidate_for_testing(
|
||||
shared.as_ref(),
|
||||
*conn_id
|
||||
));
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), *conn_id));
|
||||
}
|
||||
|
||||
let mut expected_total_evictions = 0u64;
|
||||
@@ -854,12 +751,8 @@ async fn integration_race_burst_pressure_with_churn_preserves_empty_set_invalida
|
||||
let stats = stats.clone();
|
||||
let shared = shared.clone();
|
||||
joins.push(tokio::spawn(async move {
|
||||
let evicted = maybe_evict_idle_candidate_on_pressure_for_testing(
|
||||
shared.as_ref(),
|
||||
conn_id,
|
||||
&mut seen,
|
||||
stats.as_ref(),
|
||||
);
|
||||
let evicted =
|
||||
maybe_evict_idle_candidate_on_pressure_for_testing(shared.as_ref(), conn_id, &mut seen, stats.as_ref());
|
||||
(idx, conn_id, seen, evicted)
|
||||
}));
|
||||
}
|
||||
@@ -881,10 +774,7 @@ async fn integration_race_burst_pressure_with_churn_preserves_empty_set_invalida
|
||||
"round {round}: empty candidate phase must not allow stale-pressure eviction"
|
||||
);
|
||||
for conn_id in &conn_ids {
|
||||
assert!(mark_relay_idle_candidate_for_testing(
|
||||
shared.as_ref(),
|
||||
*conn_id
|
||||
));
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), *conn_id));
|
||||
}
|
||||
} else {
|
||||
assert!(
|
||||
@@ -893,10 +783,7 @@ async fn integration_race_burst_pressure_with_churn_preserves_empty_set_invalida
|
||||
);
|
||||
if let Some(conn_id) = evicted_conn {
|
||||
expected_total_evictions = expected_total_evictions.saturating_add(1);
|
||||
assert!(mark_relay_idle_candidate_for_testing(
|
||||
shared.as_ref(),
|
||||
conn_id
|
||||
));
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), conn_id));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -25,10 +25,7 @@ fn blackhat_registry_poison_recovers_with_fail_closed_reset_and_pressure_account
|
||||
|
||||
// Helper lock must recover from poison, reset stale state, and continue.
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 42));
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(42)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(42));
|
||||
|
||||
let before = relay_pressure_event_seq_for_testing(shared.as_ref());
|
||||
note_relay_pressure_event_for_testing(shared.as_ref());
|
||||
@@ -57,17 +54,11 @@ fn clear_state_helper_must_reset_poisoned_registry_for_deterministic_fifo_tests(
|
||||
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(shared.as_ref());
|
||||
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
None
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), None);
|
||||
assert_eq!(relay_pressure_event_seq_for_testing(shared.as_ref()), 0);
|
||||
|
||||
assert!(mark_relay_idle_candidate_for_testing(shared.as_ref(), 7));
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(shared.as_ref()),
|
||||
Some(7)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(shared.as_ref()), Some(7));
|
||||
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(shared.as_ref());
|
||||
}
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
use crate::proxy::client::handle_client_stream_with_shared;
|
||||
use crate::proxy::handshake::{
|
||||
auth_probe_fail_streak_for_testing_in_shared, auth_probe_is_throttled_for_testing_in_shared,
|
||||
auth_probe_record_failure_for_testing, clear_auth_probe_state_for_testing_in_shared,
|
||||
clear_unknown_sni_warn_state_for_testing_in_shared, clear_warned_secrets_for_testing_in_shared,
|
||||
should_emit_unknown_sni_warn_for_testing_in_shared, warned_secrets_for_testing_in_shared,
|
||||
};
|
||||
use crate::proxy::client::handle_client_stream_with_shared;
|
||||
use crate::proxy::middle_relay::{
|
||||
clear_desync_dedup_for_testing_in_shared, clear_relay_idle_candidate_for_testing,
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared, mark_relay_idle_candidate_for_testing,
|
||||
@@ -81,10 +81,7 @@ fn new_client_harness() -> ClientHarness {
|
||||
}
|
||||
}
|
||||
|
||||
async fn drive_invalid_mtproto_handshake(
|
||||
shared: Arc<ProxySharedState>,
|
||||
peer: std::net::SocketAddr,
|
||||
) {
|
||||
async fn drive_invalid_mtproto_handshake(shared: Arc<ProxySharedState>, peer: std::net::SocketAddr) {
|
||||
let harness = new_client_harness();
|
||||
let (server_side, mut client_side) = duplex(4096);
|
||||
let invalid = [0u8; 64];
|
||||
@@ -111,10 +108,7 @@ async fn drive_invalid_mtproto_handshake(
|
||||
.write_all(&invalid)
|
||||
.await
|
||||
.expect("failed to write invalid handshake");
|
||||
client_side
|
||||
.shutdown()
|
||||
.await
|
||||
.expect("failed to shutdown client");
|
||||
client_side.shutdown().await.expect("failed to shutdown client");
|
||||
let _ = tokio::time::timeout(Duration::from_secs(3), task)
|
||||
.await
|
||||
.expect("client task timed out")
|
||||
@@ -134,10 +128,7 @@ fn proxy_shared_state_two_instances_do_not_share_auth_probe_state() {
|
||||
auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip),
|
||||
Some(1)
|
||||
);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip),
|
||||
None
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip), None);
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -148,18 +139,8 @@ fn proxy_shared_state_two_instances_do_not_share_desync_dedup() {
|
||||
|
||||
let now = Instant::now();
|
||||
let key = 0xA5A5_u64;
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
a.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
b.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(a.as_ref(), key, false, now));
|
||||
assert!(should_emit_full_desync_for_testing(b.as_ref(), key, false, now));
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -169,10 +150,7 @@ fn proxy_shared_state_two_instances_do_not_share_idle_registry() {
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared(a.as_ref());
|
||||
|
||||
assert!(mark_relay_idle_candidate_for_testing(a.as_ref(), 111));
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(a.as_ref()),
|
||||
Some(111)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(a.as_ref()), Some(111));
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(b.as_ref()), None);
|
||||
}
|
||||
|
||||
@@ -190,10 +168,7 @@ fn proxy_shared_state_reset_in_one_instance_does_not_affect_another() {
|
||||
auth_probe_record_failure_for_testing(b.as_ref(), ip_b, now);
|
||||
clear_auth_probe_state_for_testing_in_shared(a.as_ref());
|
||||
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip_a),
|
||||
None
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip_a), None);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip_b),
|
||||
Some(1)
|
||||
@@ -216,14 +191,8 @@ fn proxy_shared_state_parallel_auth_probe_updates_stay_per_instance() {
|
||||
auth_probe_record_failure_for_testing(b.as_ref(), ip, now + Duration::from_millis(1));
|
||||
}
|
||||
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip),
|
||||
Some(5)
|
||||
);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip),
|
||||
Some(3)
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip), Some(5));
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip), Some(3));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -348,14 +317,8 @@ fn proxy_shared_state_auth_saturation_does_not_bleed_across_instances() {
|
||||
auth_probe_record_failure_for_testing(a.as_ref(), ip, future_now);
|
||||
}
|
||||
|
||||
assert!(auth_probe_is_throttled_for_testing_in_shared(
|
||||
a.as_ref(),
|
||||
ip
|
||||
));
|
||||
assert!(!auth_probe_is_throttled_for_testing_in_shared(
|
||||
b.as_ref(),
|
||||
ip
|
||||
));
|
||||
assert!(auth_probe_is_throttled_for_testing_in_shared(a.as_ref(), ip));
|
||||
assert!(!auth_probe_is_throttled_for_testing_in_shared(b.as_ref(), ip));
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -385,10 +348,7 @@ fn proxy_shared_state_poison_clear_in_one_instance_does_not_affect_other_instanc
|
||||
|
||||
clear_auth_probe_state_for_testing_in_shared(a.as_ref());
|
||||
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip_a),
|
||||
None
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip_a), None);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip_b),
|
||||
Some(1),
|
||||
@@ -503,10 +463,7 @@ fn proxy_shared_state_warned_secret_clear_in_one_instance_does_not_clear_other()
|
||||
clear_warned_secrets_for_testing_in_shared(a.as_ref());
|
||||
clear_warned_secrets_for_testing_in_shared(b.as_ref());
|
||||
|
||||
let key = (
|
||||
"clear-isolation-user".to_string(),
|
||||
"invalid_length".to_string(),
|
||||
);
|
||||
let key = ("clear-isolation-user".to_string(), "invalid_length".to_string());
|
||||
{
|
||||
let warned_a = warned_secrets_for_testing_in_shared(a.as_ref());
|
||||
let mut guard_a = warned_a
|
||||
@@ -551,24 +508,14 @@ fn proxy_shared_state_desync_duplicate_suppression_is_instance_scoped() {
|
||||
|
||||
let now = Instant::now();
|
||||
let key = 0xBEEF_0000_0000_0001u64;
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
a.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(a.as_ref(), key, false, now));
|
||||
assert!(!should_emit_full_desync_for_testing(
|
||||
a.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now + Duration::from_millis(1)
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
b.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(b.as_ref(), key, false, now));
|
||||
}
|
||||
|
||||
#[test]
|
||||
@@ -580,18 +527,8 @@ fn proxy_shared_state_desync_clear_in_one_instance_does_not_clear_other() {
|
||||
|
||||
let now = Instant::now();
|
||||
let key = 0xCAFE_0000_0000_0001u64;
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
a.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(
|
||||
b.as_ref(),
|
||||
key,
|
||||
false,
|
||||
now
|
||||
));
|
||||
assert!(should_emit_full_desync_for_testing(a.as_ref(), key, false, now));
|
||||
assert!(should_emit_full_desync_for_testing(b.as_ref(), key, false, now));
|
||||
|
||||
clear_desync_dedup_for_testing_in_shared(a.as_ref());
|
||||
|
||||
@@ -621,10 +558,7 @@ fn proxy_shared_state_idle_candidate_clear_in_one_instance_does_not_affect_other
|
||||
clear_relay_idle_candidate_for_testing(a.as_ref(), 1001);
|
||||
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(a.as_ref()), None);
|
||||
assert_eq!(
|
||||
oldest_relay_idle_candidate_for_testing(b.as_ref()),
|
||||
Some(2002)
|
||||
);
|
||||
assert_eq!(oldest_relay_idle_candidate_for_testing(b.as_ref()), Some(2002));
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
@@ -1,17 +1,16 @@
|
||||
use crate::proxy::handshake::{
|
||||
auth_probe_fail_streak_for_testing_in_shared, auth_probe_record_failure_for_testing,
|
||||
clear_auth_probe_state_for_testing_in_shared,
|
||||
clear_unknown_sni_warn_state_for_testing_in_shared,
|
||||
clear_auth_probe_state_for_testing_in_shared, clear_unknown_sni_warn_state_for_testing_in_shared,
|
||||
should_emit_unknown_sni_warn_for_testing_in_shared,
|
||||
};
|
||||
use crate::proxy::middle_relay::{
|
||||
clear_desync_dedup_for_testing_in_shared,
|
||||
clear_relay_idle_pressure_state_for_testing_in_shared, mark_relay_idle_candidate_for_testing,
|
||||
oldest_relay_idle_candidate_for_testing, should_emit_full_desync_for_testing,
|
||||
clear_desync_dedup_for_testing_in_shared, clear_relay_idle_pressure_state_for_testing_in_shared,
|
||||
mark_relay_idle_candidate_for_testing, oldest_relay_idle_candidate_for_testing,
|
||||
should_emit_full_desync_for_testing,
|
||||
};
|
||||
use crate::proxy::shared_state::ProxySharedState;
|
||||
use rand::RngExt;
|
||||
use rand::SeedableRng;
|
||||
use rand::RngExt;
|
||||
use rand::rngs::StdRng;
|
||||
use std::net::{IpAddr, Ipv4Addr};
|
||||
use std::sync::Arc;
|
||||
@@ -100,14 +99,8 @@ async fn proxy_shared_state_dual_instance_same_ip_high_contention_no_counter_ble
|
||||
handle.await.expect("task join failed");
|
||||
}
|
||||
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip),
|
||||
Some(64)
|
||||
);
|
||||
assert_eq!(
|
||||
auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip),
|
||||
Some(64)
|
||||
);
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(a.as_ref(), ip), Some(64));
|
||||
assert_eq!(auth_probe_fail_streak_for_testing_in_shared(b.as_ref(), ip), Some(64));
|
||||
}
|
||||
|
||||
#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
|
||||
@@ -190,7 +183,12 @@ async fn proxy_shared_state_seed_matrix_concurrency_isolation_no_counter_bleed()
|
||||
clear_auth_probe_state_for_testing_in_shared(shared_a.as_ref());
|
||||
clear_auth_probe_state_for_testing_in_shared(shared_b.as_ref());
|
||||
|
||||
let ip = IpAddr::V4(Ipv4Addr::new(198, 51, 100, rng.random_range(1_u8..=250_u8)));
|
||||
let ip = IpAddr::V4(Ipv4Addr::new(
|
||||
198,
|
||||
51,
|
||||
100,
|
||||
rng.random_range(1_u8..=250_u8),
|
||||
));
|
||||
let workers = rng.random_range(16_usize..=48_usize);
|
||||
let rounds = rng.random_range(4_usize..=10_usize);
|
||||
|
||||
@@ -212,11 +210,7 @@ async fn proxy_shared_state_seed_matrix_concurrency_isolation_no_counter_bleed()
|
||||
handles.push(tokio::spawn(async move {
|
||||
start_a.wait().await;
|
||||
for _ in 0..a_ops {
|
||||
auth_probe_record_failure_for_testing(
|
||||
shared_a.as_ref(),
|
||||
ip,
|
||||
Instant::now(),
|
||||
);
|
||||
auth_probe_record_failure_for_testing(shared_a.as_ref(), ip, Instant::now());
|
||||
}
|
||||
}));
|
||||
|
||||
@@ -225,11 +219,7 @@ async fn proxy_shared_state_seed_matrix_concurrency_isolation_no_counter_bleed()
|
||||
handles.push(tokio::spawn(async move {
|
||||
start_b.wait().await;
|
||||
for _ in 0..b_ops {
|
||||
auth_probe_record_failure_for_testing(
|
||||
shared_b.as_ref(),
|
||||
ip,
|
||||
Instant::now(),
|
||||
);
|
||||
auth_probe_record_failure_for_testing(shared_b.as_ref(), ip, Instant::now());
|
||||
}
|
||||
}));
|
||||
}
|
||||
|
||||
@@ -69,10 +69,7 @@ async fn relay_baseline_activity_timeout_fires_after_inactivity() {
|
||||
.expect("relay must complete after inactivity timeout")
|
||||
.expect("relay task must not panic");
|
||||
|
||||
assert!(
|
||||
done.is_ok(),
|
||||
"relay must return Ok(()) after inactivity timeout"
|
||||
);
|
||||
assert!(done.is_ok(), "relay must return Ok(()) after inactivity timeout");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -158,10 +155,7 @@ async fn relay_baseline_bidirectional_bytes_counted_symmetrically() {
|
||||
.expect("relay task must not panic");
|
||||
assert!(done.is_ok());
|
||||
|
||||
assert_eq!(
|
||||
stats.get_user_total_octets(user),
|
||||
(c2s.len() + s2c.len()) as u64
|
||||
);
|
||||
assert_eq!(stats.get_user_total_octets(user), (c2s.len() + s2c.len()) as u64);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -228,10 +222,7 @@ async fn relay_baseline_broken_pipe_midtransfer_returns_error() {
|
||||
match done {
|
||||
Err(ProxyError::Io(err)) => {
|
||||
assert!(
|
||||
matches!(
|
||||
err.kind(),
|
||||
io::ErrorKind::BrokenPipe | io::ErrorKind::ConnectionReset
|
||||
),
|
||||
matches!(err.kind(), io::ErrorKind::BrokenPipe | io::ErrorKind::ConnectionReset),
|
||||
"expected BrokenPipe/ConnectionReset, got {:?}",
|
||||
err.kind()
|
||||
);
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
use crate::config::ProxyConfig;
|
||||
use rand::SeedableRng;
|
||||
use rand::rngs::StdRng;
|
||||
use rand::SeedableRng;
|
||||
use std::io;
|
||||
use std::pin::Pin;
|
||||
use std::sync::Arc;
|
||||
@@ -18,10 +18,7 @@ mod tests {
|
||||
let arc = Arc::<AtomicUsize>::from_raw(data.cast::<AtomicUsize>());
|
||||
let cloned = Arc::clone(&arc);
|
||||
let _ = Arc::into_raw(arc);
|
||||
RawWaker::new(
|
||||
Arc::into_raw(cloned).cast::<()>(),
|
||||
&WAKE_COUNTER_WAKER_VTABLE,
|
||||
)
|
||||
RawWaker::new(Arc::into_raw(cloned).cast::<()>(), &WAKE_COUNTER_WAKER_VTABLE)
|
||||
}
|
||||
|
||||
unsafe fn wake_counter_wake(data: *const ()) {
|
||||
|
||||
+2
-4
@@ -1593,15 +1593,13 @@ impl Stats {
|
||||
self.conntrack_delete_success_total.load(Ordering::Relaxed)
|
||||
}
|
||||
pub fn get_conntrack_delete_not_found_total(&self) -> u64 {
|
||||
self.conntrack_delete_not_found_total
|
||||
.load(Ordering::Relaxed)
|
||||
self.conntrack_delete_not_found_total.load(Ordering::Relaxed)
|
||||
}
|
||||
pub fn get_conntrack_delete_error_total(&self) -> u64 {
|
||||
self.conntrack_delete_error_total.load(Ordering::Relaxed)
|
||||
}
|
||||
pub fn get_conntrack_close_event_drop_total(&self) -> u64 {
|
||||
self.conntrack_close_event_drop_total
|
||||
.load(Ordering::Relaxed)
|
||||
self.conntrack_close_event_drop_total.load(Ordering::Relaxed)
|
||||
}
|
||||
pub fn get_me_keepalive_sent(&self) -> u64 {
|
||||
self.me_keepalive_sent.load(Ordering::Relaxed)
|
||||
|
||||
Reference in New Issue
Block a user