mirror of
https://github.com/telemt/telemt.git
synced 2026-06-21 18:31:10 +03:00
David Osipov
91be148b72
This commit introduces a comprehensive set of improvements to enhance the security, reliability, and configurability of the proxy server, specifically targeting adversarial resilience and high-load concurrency. Security & Cryptography: - Zeroize MTProto cryptographic key material (`dec_key`, `enc_key`) immediately after use to prevent memory leakage on early returns. - Move TLS handshake replay tracking after full policy/ALPN validation to prevent cache poisoning by unauthenticated probes. - Add `proxy_protocol_trusted_cidrs` configuration to restrict PROXY protocol headers to trusted networks, rejecting spoofed IPs. Adversarial Resilience & DoS Mitigation: - Implement "Tiny Frame Debt" tracking in the middle-relay to prevent CPU exhaustion from malicious 0-byte or 1-byte frame floods. - Add `mask_relay_max_bytes` to strictly bound unauthenticated fallback connections, preventing the proxy from being abused as an open relay. - Add a 5ms prefetch window (`mask_classifier_prefetch_timeout_ms`) to correctly assemble and classify fragmented HTTP/1.1 and HTTP/2 probes (e.g., `PRI * HTTP/2.0`) before routing them to masking heuristics. - Prevent recursive masking loops (FD exhaustion) by verifying the mask target is not the proxy's own listener via local interface enumeration. Concurrency & Reliability: - Eliminate executor waker storms during quota lock contention by replacing the spin-waker task with inline `Sleep` and exponential backoff. - Roll back user quota reservations (`rollback_me2c_quota_reservation`) if a network write fails, preventing Head-of-Line (HoL) blocking from permanently burning data quotas. - Recover gracefully from idle-registry `Mutex` poisoning instead of panicking, ensuring isolated thread failures do not break the proxy. - Fix `auth_probe_scan_start_offset` modulo logic to ensure bounds safety. Testing: - Add extensive adversarial, timing, fuzzing, and invariant test suites for both the client and handshake modules.
56 lines
1.8 KiB
Rust
56 lines
1.8 KiB
Rust
use super::*;
|
|
use tokio::net::TcpListener;
|
|
use tokio::time::Duration;
|
|
|
|
#[tokio::test]
|
|
async fn http2_preface_is_forwarded_and_recorded_as_http() {
|
|
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
|
|
let backend_addr = listener.local_addr().unwrap();
|
|
let preface = b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n".to_vec();
|
|
|
|
let accept_task = tokio::spawn({
|
|
let preface = preface.clone();
|
|
async move {
|
|
let (mut stream, _) = listener.accept().await.unwrap();
|
|
let mut received = vec![0u8; preface.len()];
|
|
stream.read_exact(&mut received).await.unwrap();
|
|
assert_eq!(received, preface);
|
|
}
|
|
});
|
|
|
|
let mut config = ProxyConfig::default();
|
|
config.general.beobachten = true;
|
|
config.general.beobachten_minutes = 1;
|
|
config.censorship.mask = true;
|
|
config.censorship.mask_host = Some("127.0.0.1".to_string());
|
|
config.censorship.mask_port = backend_addr.port();
|
|
config.censorship.mask_unix_sock = None;
|
|
config.censorship.mask_proxy_protocol = 0;
|
|
|
|
let peer: SocketAddr = "198.51.100.130:54130".parse().unwrap();
|
|
let local_addr: SocketAddr = "127.0.0.1:443".parse().unwrap();
|
|
let (client_reader, _client_writer) = tokio::io::duplex(512);
|
|
let (_client_visible_reader, client_visible_writer) = tokio::io::duplex(512);
|
|
let beobachten = BeobachtenStore::new();
|
|
|
|
handle_bad_client(
|
|
client_reader,
|
|
client_visible_writer,
|
|
&preface,
|
|
peer,
|
|
local_addr,
|
|
&config,
|
|
&beobachten,
|
|
)
|
|
.await;
|
|
|
|
tokio::time::timeout(Duration::from_secs(2), accept_task)
|
|
.await
|
|
.unwrap()
|
|
.unwrap();
|
|
|
|
let snapshot = beobachten.snapshot_text(Duration::from_secs(60));
|
|
assert!(snapshot.contains("[HTTP]"));
|
|
assert!(snapshot.contains("198.51.100.130-1"));
|
|
}
|