.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
 # GNU / glibc
 # ==========================
   build-gnu:
-    name: GNU ${{ matrix.asset }}
+    name: GNU ${{ matrix.target }}
     runs-on: ubuntu-latest
 
     container:
@@ -35,15 +35,8 @@ jobs:
         include:
           - target: x86_64-unknown-linux-gnu
             asset: telemt-x86_64-linux-gnu
-            cpu: baseline
-
-          - target: x86_64-unknown-linux-gnu
-            asset: telemt-x86_64-v3-linux-gnu
-            cpu: v3
-
           - target: aarch64-unknown-linux-gnu
             asset: telemt-aarch64-linux-gnu
-            cpu: generic
 
     steps:
       - uses: actions/checkout@v4
@@ -79,19 +72,11 @@ jobs:
           if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
             export CC=aarch64-linux-gnu-gcc
             export CXX=aarch64-linux-gnu-g++
-            export RUSTFLAGS="-C linker=aarch64-linux-gnu-gcc -C lto=fat -C panic=abort"
+            export RUSTFLAGS="-C linker=aarch64-linux-gnu-gcc"
-
           else
             export CC=clang
             export CXX=clang++
-
+            export RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=lld"
-            if [ "${{ matrix.cpu }}" = "v3" ]; then
-              CPU_FLAGS="-C target-cpu=x86-64-v3"
-            else
-              CPU_FLAGS="-C target-cpu=x86-64"
-            fi
-
-            export RUSTFLAGS="-C linker=clang -C link-arg=-fuse-ld=lld -C lto=fat -C panic=abort $CPU_FLAGS"
           fi
 
           cargo build --release --target ${{ matrix.target }}
@@ -117,75 +102,32 @@ jobs:
 # MUSL
 # ==========================
   build-musl:
-    name: MUSL ${{ matrix.asset }}
+    name: MUSL ${{ matrix.target }}
     runs-on: ubuntu-latest
-  
+
     container:
       image: rust:slim-bookworm
-  
+
     strategy:
       fail-fast: false
       matrix:
         include:
           - target: x86_64-unknown-linux-musl
             asset: telemt-x86_64-linux-musl
-            cpu: baseline
-
-          - target: x86_64-unknown-linux-musl
-            asset: telemt-x86_64-v3-linux-musl
-            cpu: v3
-
           - target: aarch64-unknown-linux-musl
             asset: telemt-aarch64-linux-musl
-            cpu: generic
+
-  
     steps:
       - uses: actions/checkout@v4
-  
+
       - name: Install deps
         run: |
           apt-get update
-          apt-get install -y \
+          apt-get install -y musl-tools pkg-config curl
-            musl-tools \
+
-            pkg-config \
-            curl
-  
-      - uses: actions/cache@v4
-        if: matrix.target == 'aarch64-unknown-linux-musl'
-        with:
-          path: ~/.musl-aarch64
-          key: musl-toolchain-aarch64-v1
-  
-      - name: Install aarch64 musl toolchain
-        if: matrix.target == 'aarch64-unknown-linux-musl'
-        run: |
-          set -e
-  
-          TOOLCHAIN_DIR="$HOME/.musl-aarch64"
-          ARCHIVE="aarch64-linux-musl-cross.tgz"
-          URL="https://github.com/telemt/telemt/releases/download/toolchains/$ARCHIVE"
-  
-          if [ -x "$TOOLCHAIN_DIR/bin/aarch64-linux-musl-gcc" ]; then
-            echo "✅ MUSL toolchain cached"
-          else
-            echo "⬇️ Downloading MUSL toolchain..."
-  
-            curl -fL \
-              --retry 5 \
-              --retry-delay 3 \
-              --connect-timeout 10 \
-              --max-time 120 \
-              -o "$ARCHIVE" "$URL"
-  
-            mkdir -p "$TOOLCHAIN_DIR"
-            tar -xzf "$ARCHIVE" --strip-components=1 -C "$TOOLCHAIN_DIR"
-          fi
-  
-          echo "$TOOLCHAIN_DIR/bin" >> $GITHUB_PATH
-  
       - name: Add rust target
         run: rustup target add ${{ matrix.target }}
-  
+
       - uses: actions/cache@v4
         with:
           path: |
@@ -193,41 +135,31 @@ jobs:
             /usr/local/cargo/git
             target
           key: musl-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
-  
+
       - name: Build
         run: |
           if [ "${{ matrix.target }}" = "aarch64-unknown-linux-musl" ]; then
             export CC=aarch64-linux-musl-gcc
-            export CC_aarch64_unknown_linux_musl=aarch64-linux-musl-gcc
+            export RUSTFLAGS="-C target-feature=+crt-static -C linker=aarch64-linux-musl-gcc"
-            export RUSTFLAGS="-C target-feature=+crt-static -C linker=aarch64-linux-musl-gcc -C lto=fat -C panic=abort"
-
           else
             export CC=musl-gcc
-            export CC_x86_64_unknown_linux_musl=musl-gcc
+            export RUSTFLAGS="-C target-feature=+crt-static"
-
-            if [ "${{ matrix.cpu }}" = "v3" ]; then
-              CPU_FLAGS="-C target-cpu=x86-64-v3"
-            else
-              CPU_FLAGS="-C target-cpu=x86-64"
-            fi
-
-            export RUSTFLAGS="-C target-feature=+crt-static -C lto=fat -C panic=abort $CPU_FLAGS"
           fi
 
           cargo build --release --target ${{ matrix.target }}
-  
+
       - name: Package
         run: |
           mkdir -p dist
           cp target/${{ matrix.target }}/release/${{ env.BINARY_NAME }} dist/telemt
-  
+
           cd dist
           tar -czf ${{ matrix.asset }}.tar.gz \
             --owner=0 --group=0 --numeric-owner \
             telemt
-  
+
           sha256sum ${{ matrix.asset }}.tar.gz > ${{ matrix.asset }}.sha256
-  
+
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.asset }}
@@ -262,48 +194,51 @@ jobs:
           prerelease: ${{ contains(github.ref, '-') }}
 
 # ==========================
-# Docker
+# Docker (FROM RELEASE)
 # ==========================
   docker:
-    name: Docker
+    name: Docker (from release)
     runs-on: ubuntu-latest
-    needs: [build-gnu, build-musl]
+    needs: release
-  
+
     permissions:
       contents: read
       packages: write
-  
+
     steps:
       - uses: actions/checkout@v4
-  
+
-      - uses: actions/download-artifact@v4
+      - name: Install gh
-        with:
+        run: apt-get update && apt-get install -y gh
-          path: dist
+
-  
+      - name: Extract version
-      - name: Extract binaries
+        id: vars
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
+
+      - name: Download binary
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          mkdir bin
+          mkdir dist
-  
+
-          tar -xzf dist/telemt-x86_64-linux-musl/telemt-x86_64-linux-musl.tar.gz -C bin
+          gh release download ${{ steps.vars.outputs.VERSION }} \
-          mv bin/telemt bin/telemt-amd64
+            --repo ${{ github.repository }} \
-  
+            --pattern "telemt-x86_64-linux-musl.tar.gz" \
-          tar -xzf dist/telemt-aarch64-linux-musl/telemt-aarch64-linux-musl.tar.gz -C bin
+            --dir dist
-          mv bin/telemt bin/telemt-arm64
+
-  
+          tar -xzf dist/telemt-x86_64-linux-musl.tar.gz -C dist
+          chmod +x dist/telemt
+
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
-  
+
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-  
+
-      - name: Extract version
+      - name: Build & Push
-        id: vars
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
-  
-      - name: Build & Push (multi-arch)
         uses: docker/build-push-action@v6
         with:
           context: .
@@ -313,5 +248,4 @@ jobs:
             ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.VERSION }}
             ghcr.io/${{ github.repository }}:latest
           build-args: |
-            BINARY_AMD64=bin/telemt-amd64
+            BINARY=dist/telemt
-            BINARY_ARM64=bin/telemt-arm64

.github/workflows/test.yml

@@ -54,20 +54,14 @@ jobs:
         uses: actions/cache@v4
         with:
           path: |
-            ~/.cargo/bin
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-nextest-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-nextest-
             ${{ runner.os }}-cargo-
 
-      - name: Install cargo-nextest
+      - run: cargo test --verbose
-        run: cargo install --locked cargo-nextest || true
-
-      - name: Run tests with nextest
-        run: cargo nextest run -j "$(nproc)"
 
 # ==========================
 # Clippy
@@ -94,13 +88,11 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-clippy-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-clippy-
             ${{ runner.os }}-cargo-
 
-      - name: Run clippy
+      - run: cargo clippy -- --cap-lints warn
-        run: cargo clippy -j "$(nproc)" -- --cap-lints warn
 
 # ==========================
 # Udeps
@@ -116,24 +108,20 @@ jobs:
       - uses: actions/checkout@v4
 
       - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rust-src
 
       - name: Cache cargo
         uses: actions/cache@v4
         with:
           path: |
-            ~/.cargo/bin
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-cargo-udeps-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-cargo-udeps-
             ${{ runner.os }}-cargo-
 
       - name: Install cargo-udeps
-        run: cargo install --locked cargo-udeps || true
+        run: cargo install cargo-udeps || true
 
-      - name: Run udeps
+      # тоже не валит билд
-        run: cargo udeps -j "$(nproc)" || true
+      - run: cargo udeps || true

Cargo.lock

@@ -2793,7 +2793,7 @@ checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
 
 [[package]]
 name = "telemt"
-version = "3.3.31"
+version = "3.3.30"
 dependencies = [
  "aes",
  "anyhow",

Cargo.toml

@@ -1,11 +1,8 @@
 [package]
 name = "telemt"
-version = "3.3.31"
+version = "3.3.30"
 edition = "2024"
 
-[profile.release]
-codegen-units = 1
-
 [features]
 redteam_offline_expected_fail = []
 
@@ -86,6 +83,4 @@ name = "crypto_bench"
 harness = false
 
 [profile.release]
-lto = "fat"
+lto = "thin"
-codegen-units = 1
-

Dockerfile

@@ -1,78 +1,47 @@
 # syntax=docker/dockerfile:1
 
-ARG TARGETARCH
+ARG BINARY
-ARG BINARY_AMD64
-ARG BINARY_ARM64
 
 # ==========================
-# Minimal Image
+# Stage: minimal
 # ==========================
 FROM debian:12-slim AS minimal
 
-ARG TARGETARCH
+RUN apt-get update && apt-get install -y --no-install-recommends \
-ARG BINARY_AMD64
+    binutils \
-ARG BINARY_ARM64
+    curl \
-
+    ca-certificates \
-RUN set -eux; \
+    && rm -rf /var/lib/apt/lists/* \
-    apt-get update; \
-    apt-get install -y --no-install-recommends \
-        binutils \
-        curl \
-        xz-utils \
-        ca-certificates; \
-    rm -rf /var/lib/apt/lists/*
-
-# --- Select correct binary ---
-RUN set -eux; \
-    case "${TARGETARCH}" in \
-        amd64) BIN="${BINARY_AMD64}" ;; \
-        arm64) BIN="${BINARY_ARM64}" ;; \
-        *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
-    esac; \
-    echo "Using binary: $BIN"; \
-    test -f "$BIN"; \
-    cp "$BIN" /telemt
-
-# --- Install UPX (arch-aware) ---
-RUN set -eux; \
-    case "${TARGETARCH}" in \
-        amd64) UPX_ARCH="amd64" ;; \
-        arm64) UPX_ARCH="arm64" ;; \
-        *) echo "Unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
-    esac; \
     \
-    curl -fL \
+    && curl -fL \
         --retry 5 \
         --retry-delay 3 \
         --connect-timeout 10 \
         --max-time 120 \
         -o /tmp/upx.tar.xz \
-        "https://github.com/telemt/telemt/releases/download/toolchains/upx-${UPX_ARCH}_linux.tar.xz"; \
+        https://github.com/telemt/telemt/releases/download/toolchains/upx-amd64_linux.tar.xz \
-    \
+    && tar -xf /tmp/upx.tar.xz -C /tmp \
-    tar -xf /tmp/upx.tar.xz -C /tmp; \
+    && mv /tmp/upx*/upx /usr/local/bin/upx \
-    install -m 0755 /tmp/upx*/upx /usr/local/bin/upx; \
+    && chmod +x /usr/local/bin/upx \
-    rm -rf /tmp/upx*
+    && rm -rf /tmp/upx*
 
-# --- Optimize binary ---
+COPY ${BINARY} /telemt
-RUN set -eux; \
+
-    test -f /telemt; \
+RUN strip /telemt || true
-    strip --strip-unneeded /telemt || true; \
+RUN upx --best --lzma /telemt || true
-    upx --best --lzma /telemt || true
 
 # ==========================
-# Debug Image
+# Debug image
 # ==========================
 FROM debian:12-slim AS debug
 
-RUN set -eux; \
+RUN apt-get update && apt-get install -y --no-install-recommends \
-    apt-get update; \
+    ca-certificates \
-    apt-get install -y --no-install-recommends \
+    tzdata \
-        ca-certificates \
+    curl \
-        tzdata \
+    iproute2 \
-        curl \
+    busybox \
-        iproute2 \
+    && rm -rf /var/lib/apt/lists/*
-        busybox; \
-    rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
 
@@ -85,7 +54,7 @@ ENTRYPOINT ["/app/telemt"]
 CMD ["config.toml"]
 
 # ==========================
-# Production Distroless on MUSL
+# Production (REAL distroless)
 # ==========================
 FROM gcr.io/distroless/static-debian12 AS prod
 
@@ -99,4 +68,4 @@ USER nonroot:nonroot
 EXPOSE 443 9090 9091
 
 ENTRYPOINT ["/app/telemt"]
-CMD ["config.toml"]
+CMD ["config.toml"]

src/proxy/handshake.rs

@@ -13,7 +13,7 @@ use std::sync::Arc;
 use std::sync::{Mutex, OnceLock};
 use std::time::{Duration, Instant};
 use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
-use tracing::{debug, info, trace, warn};
+use tracing::{debug, trace, warn};
 use zeroize::{Zeroize, Zeroizing};
 
 use crate::config::{ProxyConfig, UnknownSniAction};
@@ -28,8 +28,6 @@ use rand::RngExt;
 
 const ACCESS_SECRET_BYTES: usize = 16;
 static INVALID_SECRET_WARNED: OnceLock<Mutex<HashSet<(String, String)>>> = OnceLock::new();
-const UNKNOWN_SNI_WARN_COOLDOWN_SECS: u64 = 5;
-static UNKNOWN_SNI_WARN_NEXT_ALLOWED: OnceLock<Mutex<Option<Instant>>> = OnceLock::new();
 #[cfg(test)]
 const WARNED_SECRET_MAX_ENTRIES: usize = 64;
 #[cfg(not(test))]
@@ -88,24 +86,6 @@ fn auth_probe_saturation_state_lock()
         .unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
-fn unknown_sni_warn_state_lock() -> std::sync::MutexGuard<'static, Option<Instant>> {
-    UNKNOWN_SNI_WARN_NEXT_ALLOWED
-        .get_or_init(|| Mutex::new(None))
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner())
-}
-
-fn should_emit_unknown_sni_warn(now: Instant) -> bool {
-    let mut guard = unknown_sni_warn_state_lock();
-    if let Some(next_allowed) = *guard
-        && now < next_allowed
-    {
-        return false;
-    }
-    *guard = Some(now + Duration::from_secs(UNKNOWN_SNI_WARN_COOLDOWN_SECS));
-    true
-}
-
 fn normalize_auth_probe_ip(peer_ip: IpAddr) -> IpAddr {
     match peer_ip {
         IpAddr::V4(ip) => IpAddr::V4(ip),
@@ -432,25 +412,6 @@ fn auth_probe_test_lock() -> &'static Mutex<()> {
     TEST_LOCK.get_or_init(|| Mutex::new(()))
 }
 
-#[cfg(test)]
-fn unknown_sni_warn_test_lock() -> &'static Mutex<()> {
-    static TEST_LOCK: OnceLock<Mutex<()>> = OnceLock::new();
-    TEST_LOCK.get_or_init(|| Mutex::new(()))
-}
-
-#[cfg(test)]
-fn clear_unknown_sni_warn_state_for_testing() {
-    if UNKNOWN_SNI_WARN_NEXT_ALLOWED.get().is_some() {
-        let mut guard = unknown_sni_warn_state_lock();
-        *guard = None;
-    }
-}
-
-#[cfg(test)]
-fn should_emit_unknown_sni_warn_for_testing(now: Instant) -> bool {
-    should_emit_unknown_sni_warn(now)
-}
-
 #[cfg(test)]
 fn clear_warned_secrets_for_testing() {
     if let Some(warned) = INVALID_SECRET_WARNED.get()
@@ -697,25 +658,12 @@ where
     if client_sni.is_some() && matched_tls_domain.is_none() && preferred_user_hint.is_none() {
         auth_probe_record_failure(peer.ip(), Instant::now());
         maybe_apply_server_hello_delay(config).await;
-        let sni = client_sni.as_deref().unwrap_or_default();
+        debug!(
-        let log_now = Instant::now();
+            peer = %peer,
-        if should_emit_unknown_sni_warn(log_now) {
+            sni = ?client_sni,
-            warn!(
+            action = ?config.censorship.unknown_sni_action,
-                peer = %peer,
+            "TLS handshake rejected by unknown SNI policy"
-                sni = %sni,
+        );
-                unknown_sni = true,
-                unknown_sni_action = ?config.censorship.unknown_sni_action,
-                "TLS handshake rejected by unknown SNI policy"
-            );
-        } else {
-            info!(
-                peer = %peer,
-                sni = %sni,
-                unknown_sni = true,
-                unknown_sni_action = ?config.censorship.unknown_sni_action,
-                "TLS handshake rejected by unknown SNI policy"
-            );
-        }
         return match config.censorship.unknown_sni_action {
             UnknownSniAction::Drop => HandshakeResult::Error(ProxyError::UnknownTlsSni),
             UnknownSniAction::Mask => HandshakeResult::BadClient { reader, writer },

src/proxy/tests/handshake_security_tests.rs

@@ -1643,32 +1643,6 @@ fn auth_probe_capacity_fresh_full_map_still_tracks_newcomer_with_bounded_evictio
     );
 }
 
-#[test]
-fn unknown_sni_warn_cooldown_first_event_is_warn_and_repeated_events_are_info_until_window_expires()
-{
-    let _guard = unknown_sni_warn_test_lock()
-        .lock()
-        .unwrap_or_else(|poisoned| poisoned.into_inner());
-    clear_unknown_sni_warn_state_for_testing();
-
-    let now = Instant::now();
-
-    assert!(
-        should_emit_unknown_sni_warn_for_testing(now),
-        "first unknown SNI event must be eligible for WARN emission"
-    );
-    assert!(
-        !should_emit_unknown_sni_warn_for_testing(now + Duration::from_secs(1)),
-        "events inside cooldown window must be demoted from WARN to INFO"
-    );
-    assert!(
-        should_emit_unknown_sni_warn_for_testing(
-            now + Duration::from_secs(UNKNOWN_SNI_WARN_COOLDOWN_SECS)
-        ),
-        "once cooldown expires, next unknown SNI event must be WARN-eligible again"
-    );
-}
-
 #[test]
 fn stress_auth_probe_full_map_churn_keeps_bound_and_tracks_newcomers() {
     let _guard = auth_probe_test_lock()