TG Unblock v0.2.0: Telegram WebSocket bypass proxy

Made-with: Cursor:

src/bypass.rs

@@ -0,0 +1,201 @@
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+pub fn check_admin() -> bool {
+    let output = Command::new("net")
+        .args(["session"])
+        .output();
+    matches!(output, Ok(o) if o.status.success())
+}
+
+pub fn set_dns(adapter: &str, primary: &str, secondary: &str) -> Result<(), String> {
+    let out1 = Command::new("netsh")
+        .args([
+            "interface", "ipv4", "set", "dnsservers",
+            adapter, "static", primary, "primary", "validate=no",
+        ])
+        .output()
+        .map_err(|e| format!("netsh error: {}", e))?;
+
+    if !out1.status.success() {
+        let stderr = String::from_utf8_lossy(&out1.stderr);
+        return Err(format!("Failed to set primary DNS: {}", stderr));
+    }
+
+    let out2 = Command::new("netsh")
+        .args([
+            "interface", "ipv4", "add", "dnsservers",
+            adapter, secondary, "index=2", "validate=no",
+        ])
+        .output()
+        .map_err(|e| format!("netsh error: {}", e))?;
+
+    if !out2.status.success() {
+        // Non-critical: secondary DNS may already exist
+    }
+
+    Ok(())
+}
+
+pub fn reset_dns(adapter: &str) -> Result<(), String> {
+    let out = Command::new("netsh")
+        .args([
+            "interface", "ipv4", "set", "dnsservers",
+            adapter, "dhcp",
+        ])
+        .output()
+        .map_err(|e| format!("netsh error: {}", e))?;
+
+    if !out.status.success() {
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        return Err(format!("Failed to reset DNS: {}", stderr));
+    }
+    Ok(())
+}
+
+pub fn flush_dns() {
+    let _ = Command::new("ipconfig")
+        .args(["/flushdns"])
+        .output();
+}
+
+pub fn find_goodbyedpi() -> Option<String> {
+    let exe_dir = std::env::current_exe()
+        .ok()
+        .and_then(|p| p.parent().map(|p| p.to_path_buf()))
+        .unwrap_or_else(|| PathBuf::from("."));
+
+    let search_dirs = vec![
+        exe_dir.join("tools"),
+        exe_dir.join("tools").join("goodbyedpi"),
+        exe_dir.clone(),
+        PathBuf::from("tools"),
+        PathBuf::from("tools").join("goodbyedpi"),
+        PathBuf::from("."),
+    ];
+
+    for dir in &search_dirs {
+        // Check common locations
+        for sub in &["x86_64", "x86", ""] {
+            let candidate = if sub.is_empty() {
+                dir.join("goodbyedpi.exe")
+            } else {
+                dir.join(sub).join("goodbyedpi.exe")
+            };
+            if candidate.exists() {
+                return Some(candidate.to_string_lossy().to_string());
+            }
+        }
+    }
+
+    // Recursive search in tools/
+    if let Ok(entries) = find_file_recursive(Path::new("tools"), "goodbyedpi.exe") {
+        if !entries.is_empty() {
+            return Some(entries[0].to_string_lossy().to_string());
+        }
+    }
+
+    None
+}
+
+fn find_file_recursive(dir: &Path, filename: &str) -> Result<Vec<PathBuf>, std::io::Error> {
+    let mut results = Vec::new();
+    if !dir.exists() {
+        return Ok(results);
+    }
+    for entry in std::fs::read_dir(dir)? {
+        let entry = entry?;
+        let path = entry.path();
+        if path.is_file() && path.file_name().map(|n| n == filename).unwrap_or(false) {
+            results.push(path);
+        } else if path.is_dir() {
+            results.extend(find_file_recursive(&path, filename)?);
+        }
+    }
+    Ok(results)
+}
+
+pub fn get_blacklist_path() -> Option<String> {
+    let candidates = vec![
+        PathBuf::from("tg_blacklist.txt"),
+        PathBuf::from("tools").join("tg_blacklist.txt"),
+        std::env::current_exe()
+            .ok()
+            .and_then(|p| p.parent().map(|p| p.join("tg_blacklist.txt")))
+            .unwrap_or_default(),
+    ];
+
+    for path in candidates {
+        if path.exists() {
+            return Some(path.to_string_lossy().to_string());
+        }
+    }
+    None
+}
+
+pub fn start_goodbyedpi(exe_path: &str, args: &[&str], blacklist: Option<&str>) -> Result<(), String> {
+    let mut cmd = Command::new(exe_path);
+    cmd.args(args);
+
+    if let Some(bl) = blacklist {
+        cmd.args(["--blacklist", bl]);
+    }
+
+    cmd.spawn().map_err(|e| format!("Failed to start GoodbyeDPI: {}", e))?;
+    Ok(())
+}
+
+pub fn kill_goodbyedpi() {
+    let _ = Command::new("taskkill")
+        .args(["/f", "/im", "goodbyedpi.exe"])
+        .output();
+}
+
+pub fn download_goodbyedpi() -> Result<String, String> {
+    let tools_dir = PathBuf::from("tools");
+    std::fs::create_dir_all(&tools_dir)
+        .map_err(|e| format!("Cannot create tools dir: {}", e))?;
+
+    let zip_path = tools_dir.join("goodbyedpi.zip");
+    let url = "https://github.com/ValdikSS/GoodbyeDPI/releases/download/0.2.3rc3/goodbyedpi-0.2.3rc3-2.zip";
+
+    // Download using powershell
+    let dl_script = format!(
+        "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri '{}' -OutFile '{}' -UseBasicParsing",
+        url,
+        zip_path.to_string_lossy()
+    );
+
+    let output = Command::new("powershell")
+        .args(["-Command", &dl_script])
+        .output()
+        .map_err(|e| format!("Download failed: {}", e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(format!("Download failed: {}", stderr));
+    }
+
+    // Extract
+    let extract_script = format!(
+        "Expand-Archive -Path '{}' -DestinationPath '{}' -Force",
+        zip_path.to_string_lossy(),
+        tools_dir.to_string_lossy()
+    );
+
+    let output = Command::new("powershell")
+        .args(["-Command", &extract_script])
+        .output()
+        .map_err(|e| format!("Extraction failed: {}", e))?;
+
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        return Err(format!("Extraction failed: {}", stderr));
+    }
+
+    // Clean up zip
+    let _ = std::fs::remove_file(&zip_path);
+
+    // Find the exe
+    find_goodbyedpi().ok_or_else(|| "goodbyedpi.exe not found after extraction".to_string())
+}

src/main.rs

@@ -0,0 +1,358 @@
+#![cfg_attr(not(debug_assertions), windows_subsystem = "windows")]
+
+mod bypass;
+mod network;
+mod ws_proxy;
+
+use std::sync::atomic::Ordering;
+use std::sync::{Arc, Mutex};
+
+use eframe::egui;
+
+const PROXY_PORT: u16 = 1080;
+
+fn main() -> eframe::Result<()> {
+    let options = eframe::NativeOptions {
+        viewport: egui::ViewportBuilder::default()
+            .with_inner_size([680.0, 560.0])
+            .with_min_inner_size([580.0, 460.0])
+            .with_title("TG Unblock"),
+        ..Default::default()
+    };
+
+    eframe::run_native(
+        "TG Unblock",
+        options,
+        Box::new(|cc| {
+            setup_fonts(&cc.egui_ctx);
+            Ok(Box::new(App::new()))
+        }),
+    )
+}
+
+fn setup_fonts(ctx: &egui::Context) {
+    let mut fonts = egui::FontDefinitions::default();
+    fonts.font_data.insert(
+        "system".to_owned(),
+        std::sync::Arc::new(egui::FontData::from_static(include_bytes!(
+            "C:\\Windows\\Fonts\\segoeui.ttf"
+        ))),
+    );
+    fonts
+        .families
+        .entry(egui::FontFamily::Proportional)
+        .or_default()
+        .insert(0, "system".to_owned());
+    fonts
+        .families
+        .entry(egui::FontFamily::Monospace)
+        .or_default()
+        .insert(0, "system".to_owned());
+    ctx.set_fonts(fonts);
+}
+
+#[derive(Clone)]
+struct LogEntry {
+    text: String,
+    is_error: bool,
+    ts: String,
+}
+
+struct App {
+    log: Arc<Mutex<Vec<LogEntry>>>,
+    proxy_stats: Arc<ws_proxy::ProxyStats>,
+    is_admin: bool,
+    adapter_name: Arc<Mutex<Option<String>>>,
+    dns_set: Arc<Mutex<bool>>,
+}
+
+impl App {
+    fn new() -> Self {
+        let is_admin = bypass::check_admin();
+        let app = Self {
+            log: Arc::new(Mutex::new(Vec::new())),
+            proxy_stats: ws_proxy::ProxyStats::new(),
+            is_admin,
+            adapter_name: Arc::new(Mutex::new(None)),
+            dns_set: Arc::new(Mutex::new(false)),
+        };
+        log_msg(&app.log, "Запущено", false);
+        if !is_admin {
+            log_msg(&app.log, "Нет прав администратора — DNS менять не получится", true);
+        }
+        {
+            let adapter = app.adapter_name.clone();
+            let log = app.log.clone();
+            std::thread::spawn(move || {
+                if let Some(name) = network::detect_adapter() {
+                    log_msg(&log, &format!("Адаптер: {}", name), false);
+                    *adapter.lock().unwrap() = Some(name);
+                }
+            });
+        }
+        app
+    }
+
+    fn proxy_running(&self) -> bool {
+        self.proxy_stats.running.load(Ordering::SeqCst)
+    }
+
+    fn start_proxy(&self) {
+        if self.proxy_running() {
+            return;
+        }
+        let stats = self.proxy_stats.clone();
+        let log = self.log.clone();
+        let adapter = self.adapter_name.clone();
+        let dns_set = self.dns_set.clone();
+        let is_admin = self.is_admin;
+
+        std::thread::spawn(move || {
+            // DNS
+            if is_admin {
+                let aname = adapter.lock().unwrap().clone().or_else(network::detect_adapter);
+                if let Some(ref name) = aname {
+                    if bypass::set_dns(name, "1.1.1.1", "1.0.0.1").is_ok() {
+                        bypass::flush_dns();
+                        log_msg(&log, "DNS → Cloudflare 1.1.1.1", false);
+                        *dns_set.lock().unwrap() = true;
+                    }
+                }
+            }
+
+            log_msg(&log, &format!("Запускаю WS-прокси на 127.0.0.1:{}...", PROXY_PORT), false);
+
+            let rt = tokio::runtime::Runtime::new().unwrap();
+            let result = rt.block_on(ws_proxy::run_proxy(PROXY_PORT, stats));
+            if let Err(e) = result {
+                log_msg(&log, &format!("Прокси остановлен: {}", e), true);
+            }
+        });
+
+        std::thread::sleep(std::time::Duration::from_millis(300));
+        if self.proxy_running() {
+            log_msg(&self.log, "Прокси запущен! Настройте Telegram.", false);
+        }
+    }
+
+    fn stop_proxy(&self) {
+        self.proxy_stats.running.store(false, Ordering::SeqCst);
+        log_msg(&self.log, "Прокси остановлен", false);
+
+        if *self.dns_set.lock().unwrap() {
+            let adapter = self.adapter_name.clone();
+            let log = self.log.clone();
+            let dns_set = self.dns_set.clone();
+            std::thread::spawn(move || {
+                let aname = adapter.lock().unwrap().clone().or_else(network::detect_adapter);
+                if let Some(ref name) = aname {
+                    let _ = bypass::reset_dns(name);
+                    bypass::flush_dns();
+                    *dns_set.lock().unwrap() = false;
+                    log_msg(&log, "DNS сброшен", false);
+                }
+            });
+        }
+    }
+
+    fn open_tg_proxy_link(&self) {
+        let url = format!("tg://socks?server=127.0.0.1&port={}", PROXY_PORT);
+        log_msg(&self.log, "Открываю настройку прокси в Telegram...", false);
+        let _ = open::that(&url);
+    }
+}
+
+fn log_msg(log: &Arc<Mutex<Vec<LogEntry>>>, text: &str, err: bool) {
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    let ts = format!("{:02}:{:02}:{:02}", (now % 86400) / 3600, (now % 3600) / 60, now % 60);
+    log.lock().unwrap().push(LogEntry {
+        text: text.to_string(),
+        is_error: err,
+        ts,
+    });
+}
+
+impl eframe::App for App {
+    fn update(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
+        ctx.request_repaint_after(std::time::Duration::from_millis(400));
+
+        let running = self.proxy_running();
+        let active = self.proxy_stats.active_conn.load(Ordering::Relaxed);
+        let total = self.proxy_stats.total_conn.load(Ordering::Relaxed);
+        let ws = self.proxy_stats.ws_active.load(Ordering::Relaxed);
+
+        // --- Top bar ---
+        egui::TopBottomPanel::top("top").show(ctx, |ui| {
+            ui.horizontal(|ui| {
+                ui.heading("TG Unblock");
+                ui.separator();
+                if running {
+                    ui.colored_label(
+                        egui::Color32::from_rgb(80, 220, 120),
+                        egui::RichText::new("ПРОКСИ РАБОТАЕТ").strong(),
+                    );
+                    ui.separator();
+                    ui.label(format!("Соединений: {} (WS: {}) | Всего: {}", active, ws, total));
+                } else {
+                    ui.label("Прокси не запущен");
+                }
+            });
+        });
+
+        // --- Log panel ---
+        egui::TopBottomPanel::bottom("log")
+            .min_height(130.0)
+            .show(ctx, |ui| {
+                ui.label(egui::RichText::new("Лог").strong());
+                ui.separator();
+                egui::ScrollArea::vertical()
+                    .auto_shrink([false, false])
+                    .stick_to_bottom(true)
+                    .show(ui, |ui| {
+                        let logs = self.log.lock().unwrap();
+                        for e in logs.iter() {
+                            let color = if e.is_error {
+                                egui::Color32::from_rgb(255, 100, 100)
+                            } else {
+                                egui::Color32::from_rgb(170, 215, 170)
+                            };
+                            ui.colored_label(color, format!("[{}] {}", e.ts, e.text));
+                        }
+                    });
+            });
+
+        // --- Main panel ---
+        egui::CentralPanel::default().show(ctx, |ui| {
+            ui.add_space(15.0);
+
+            ui.vertical_centered(|ui| {
+                if !running {
+                    ui.label(egui::RichText::new("Обход блокировки Telegram через WebSocket-прокси").size(15.0));
+                    ui.add_space(5.0);
+                    ui.label("Трафик идёт через web.telegram.org — провайдер видит обычный HTTPS");
+                    ui.add_space(15.0);
+
+                    let btn = ui.add_sized(
+                        [340.0, 55.0],
+                        egui::Button::new(egui::RichText::new("Запустить обход").size(20.0).strong()),
+                    );
+                    if btn.clicked() {
+                        self.start_proxy();
+                    }
+                } else {
+                    ui.colored_label(
+                        egui::Color32::from_rgb(80, 220, 120),
+                        egui::RichText::new("Обход работает").size(22.0).strong(),
+                    );
+                    ui.add_space(5.0);
+                    ui.label(format!("SOCKS5 прокси на 127.0.0.1:{}", PROXY_PORT));
+                    ui.label(format!("WebSocket-туннелей: {} | Соединений: {}", ws, active));
+                    ui.add_space(12.0);
+
+                    // Stop button
+                    let stop = ui.add_sized(
+                        [340.0, 42.0],
+                        egui::Button::new(egui::RichText::new("Остановить").size(17.0)),
+                    );
+                    if stop.clicked() {
+                        self.stop_proxy();
+                    }
+                }
+            });
+
+            ui.add_space(20.0);
+            ui.separator();
+            ui.add_space(8.0);
+
+            // --- Telegram setup ---
+            ui.heading("Настройка Telegram Desktop");
+            ui.add_space(6.0);
+
+            if running {
+                ui.horizontal(|ui| {
+                    if ui.button("   Настроить автоматически   ").clicked() {
+                        self.open_tg_proxy_link();
+                    }
+                    ui.label("(откроет Telegram, нажмите \"Подключить\")");
+                });
+                ui.add_space(8.0);
+            }
+
+            ui.label("Или вручную: Настройки → Продвинутые → Тип соединения → SOCKS5");
+            ui.add_space(4.0);
+            egui::Grid::new("manual_setup")
+                .num_columns(2)
+                .spacing([15.0, 4.0])
+                .show(ui, |ui| {
+                    ui.label("Сервер:");
+                    ui.monospace("127.0.0.1");
+                    ui.end_row();
+                    ui.label("Порт:");
+                    ui.monospace(format!("{}", PROXY_PORT));
+                    ui.end_row();
+                    ui.label("Логин/Пароль:");
+                    ui.label("оставить пустыми");
+                    ui.end_row();
+                });
+
+            ui.add_space(15.0);
+            ui.separator();
+            ui.add_space(5.0);
+
+            // --- How it works ---
+            ui.heading("Как это работает");
+            ui.add_space(4.0);
+            ui.label("1. Локальный SOCKS5-прокси принимает соединения от Telegram");
+            ui.label("2. Трафик к серверам Telegram заворачивается в WebSocket (WSS)");
+            ui.label("3. Подключение идёт через web.telegram.org — обычный HTTPS");
+            ui.label("4. Провайдер/DPI не видит MTProto, не может замедлить");
+            ui.add_space(4.0);
+            ui.colored_label(
+                egui::Color32::from_rgb(170, 170, 170),
+                "Не-Telegram трафик проходит напрямую без изменений",
+            );
+
+            ui.add_space(12.0);
+            ui.separator();
+            ui.add_space(6.0);
+
+            // --- VPN ad ---
+            egui::Frame::new()
+                .fill(egui::Color32::from_rgb(30, 35, 50))
+                .corner_radius(10.0)
+                .inner_margin(14.0)
+                .show(ui, |ui| {
+                    ui.horizontal(|ui| {
+                        ui.colored_label(
+                            egui::Color32::from_rgb(100, 180, 255),
+                            egui::RichText::new("by sonic VPN").size(16.0).strong(),
+                        );
+                        ui.label(egui::RichText::new(" — ").size(14.0));
+                        ui.label(
+                            egui::RichText::new("Полный обход блокировок для всех приложений")
+                                .size(13.0),
+                        );
+                    });
+                    ui.add_space(4.0);
+                    ui.horizontal(|ui| {
+                        ui.label("Быстрый VPN без ограничений скорости:");
+                        let link = ui.add(
+                            egui::Hyperlink::from_label_and_url(
+                                egui::RichText::new("@bysonicvpn_bot")
+                                    .size(14.0)
+                                    .strong()
+                                    .color(egui::Color32::from_rgb(100, 200, 255)),
+                                "https://t.me/bysonicvpn_bot",
+                            ),
+                        );
+                        if link.clicked() {
+                            let _ = open::that("https://t.me/bysonicvpn_bot");
+                        }
+                    });
+                });
+        });
+    }
+}

src/network.rs

@@ -0,0 +1,176 @@
+use std::net::{TcpStream, SocketAddr};
+use std::process::Command;
+use std::time::{Duration, Instant};
+
+pub fn detect_adapter() -> Option<String> {
+    let output = Command::new("powershell")
+        .args([
+            "-Command",
+            "(Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | Select-Object -First 1).Name",
+        ])
+        .output()
+        .ok()?;
+
+    let name = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    if name.is_empty() {
+        None
+    } else {
+        Some(name)
+    }
+}
+
+pub fn get_current_dns() -> Option<String> {
+    let output = Command::new("powershell")
+        .args([
+            "-Command",
+            "Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object {$_.ServerAddresses.Count -gt 0} | Select-Object -First 1 -ExpandProperty ServerAddresses | Out-String",
+        ])
+        .output()
+        .ok()?;
+
+    let result = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    if result.is_empty() {
+        Some("Не определено".to_string())
+    } else {
+        Some(result.replace('\n', ", ").replace('\r', ""))
+    }
+}
+
+pub fn ping_host(ip: &str) -> (bool, Option<u64>) {
+    let start = Instant::now();
+    let output = Command::new("ping")
+        .args(["-n", "1", "-w", "3000", ip])
+        .output();
+
+    match output {
+        Ok(out) => {
+            let elapsed = start.elapsed().as_millis() as u64;
+            let stdout = String::from_utf8_lossy(&out.stdout);
+            let ok = out.status.success() && (stdout.contains("TTL=") || stdout.contains("ttl="));
+
+            if ok {
+                // Try to extract actual time from ping output
+                if let Some(time_str) = extract_ping_time(&stdout) {
+                    (true, Some(time_str))
+                } else {
+                    (true, Some(elapsed))
+                }
+            } else {
+                (false, None)
+            }
+        }
+        Err(_) => (false, None),
+    }
+}
+
+fn extract_ping_time(output: &str) -> Option<u64> {
+    // Match patterns like "time=46ms" or "time<1ms" or "время=46мс"
+    for line in output.lines() {
+        let lower = line.to_lowercase();
+        if let Some(pos) = lower.find("time=").or_else(|| lower.find("time<")) {
+            let after = &lower[pos + 5..];
+            let num: String = after.chars().take_while(|c| c.is_ascii_digit()).collect();
+            if let Ok(ms) = num.parse::<u64>() {
+                return Some(ms);
+            }
+        }
+        // Russian locale
+        if let Some(pos) = lower.find("=").filter(|_| lower.contains("ms") || lower.contains("мс")) {
+            let after = &lower[pos + 1..];
+            let num: String = after.chars().take_while(|c| c.is_ascii_digit()).collect();
+            if let Ok(ms) = num.parse::<u64>() {
+                if ms < 10000 {
+                    return Some(ms);
+                }
+            }
+        }
+    }
+    None
+}
+
+pub fn tcp_check(ip: &str, port: u16) -> (bool, Option<u64>) {
+    let addr: SocketAddr = format!("{}:{}", ip, port).parse().unwrap();
+    let start = Instant::now();
+    match TcpStream::connect_timeout(&addr, Duration::from_secs(5)) {
+        Ok(_stream) => {
+            let elapsed = start.elapsed().as_millis() as u64;
+            (true, Some(elapsed))
+        }
+        Err(_) => (false, None),
+    }
+}
+
+pub fn https_check(url: &str) -> (bool, Option<u64>) {
+    let start = Instant::now();
+    let client = reqwest::blocking::Client::builder()
+        .timeout(Duration::from_secs(10))
+        .danger_accept_invalid_certs(true)
+        .build();
+
+    match client {
+        Ok(c) => match c.get(url).send() {
+            Ok(resp) => {
+                let elapsed = start.elapsed().as_millis() as u64;
+                (resp.status().is_success(), Some(elapsed))
+            }
+            Err(_) => (false, None),
+        },
+        Err(_) => (false, None),
+    }
+}
+
+/// Benchmarks Telegram connectivity: runs multiple TCP+HTTPS checks,
+/// returns (works: bool, score: u64) where lower score = faster connection.
+/// Score is average latency across all successful checks. u64::MAX if nothing works.
+pub fn benchmark_telegram() -> (bool, u64) {
+    let tcp_targets = [
+        ("149.154.167.51", 443u16),
+        ("149.154.175.50", 443),
+        ("149.154.167.91", 443),
+        ("91.108.56.100", 443),
+    ];
+
+    let mut total_ms: u64 = 0;
+    let mut ok_count: u64 = 0;
+    let mut fail_count: u64 = 0;
+
+    // TCP checks (x2 rounds for stability)
+    for _ in 0..2 {
+        for (ip, port) in &tcp_targets {
+            let (ok, latency) = tcp_check(ip, *port);
+            if ok {
+                total_ms += latency.unwrap_or(5000);
+                ok_count += 1;
+            } else {
+                fail_count += 1;
+            }
+        }
+    }
+
+    // HTTPS check — the real indicator of usable speed
+    let https_urls = [
+        "https://web.telegram.org",
+        "https://t.me",
+    ];
+    for url in &https_urls {
+        let (ok, latency) = https_check(url);
+        if ok {
+            // Weight HTTPS 3x heavier since it's closer to real usage
+            let ms = latency.unwrap_or(10000);
+            total_ms += ms * 3;
+            ok_count += 3;
+        } else {
+            fail_count += 3;
+        }
+    }
+
+    if ok_count == 0 {
+        return (false, u64::MAX);
+    }
+
+    // Penalize failures: each fail adds 2000ms to the score
+    let penalty = fail_count * 2000;
+    let avg = (total_ms + penalty) / (ok_count + fail_count);
+
+    (true, avg)
+}

src/ws_proxy.rs

@@ -0,0 +1,265 @@
+use std::net::Ipv4Addr;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
+use tokio::net::{TcpListener, TcpStream};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio_tungstenite::tungstenite;
+use tungstenite::client::IntoClientRequest;
+
+pub struct ProxyStats {
+    pub running: AtomicBool,
+    pub active_conn: AtomicU32,
+    pub total_conn: AtomicU32,
+    pub ws_active: AtomicU32,
+}
+
+impl ProxyStats {
+    pub fn new() -> Arc<Self> {
+        Arc::new(Self {
+            running: AtomicBool::new(false),
+            active_conn: AtomicU32::new(0),
+            total_conn: AtomicU32::new(0),
+            ws_active: AtomicU32::new(0),
+        })
+    }
+}
+
+pub async fn run_proxy(port: u16, stats: Arc<ProxyStats>) -> Result<(), String> {
+    let addr = format!("127.0.0.1:{}", port);
+    let listener = TcpListener::bind(&addr)
+        .await
+        .map_err(|e| format!("Не удалось занять порт {}: {}", port, e))?;
+
+    stats.running.store(true, Ordering::SeqCst);
+
+    loop {
+        if !stats.running.load(Ordering::SeqCst) {
+            break;
+        }
+
+        tokio::select! {
+            result = listener.accept() => {
+                if let Ok((stream, _)) = result {
+                    let st = stats.clone();
+                    st.active_conn.fetch_add(1, Ordering::Relaxed);
+                    st.total_conn.fetch_add(1, Ordering::Relaxed);
+                    tokio::spawn(async move {
+                        let _ = handle_socks5(stream, &st).await;
+                        st.active_conn.fetch_sub(1, Ordering::Relaxed);
+                    });
+                }
+            }
+            _ = tokio::time::sleep(std::time::Duration::from_millis(200)) => {}
+        }
+    }
+
+    stats.running.store(false, Ordering::SeqCst);
+    Ok(())
+}
+
+/// DC name mapping from official Telegram MTProto transport docs
+fn dc_ws_url(dc: u8) -> String {
+    let name = match dc {
+        1 => "pluto",
+        2 => "venus",
+        3 => "aurora",
+        4 => "vesta",
+        5 => "flora",
+        _ => "venus",
+    };
+    format!("wss://{}.web.telegram.org/apiws", name)
+}
+
+async fn handle_socks5(
+    mut stream: TcpStream,
+    stats: &ProxyStats,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    stream.set_nodelay(true)?;
+
+    let mut buf = [0u8; 258];
+    let n = stream.read(&mut buf).await?;
+    if n < 2 || buf[0] != 0x05 {
+        return Err("Not SOCKS5".into());
+    }
+    stream.write_all(&[0x05, 0x00]).await?;
+
+    let n = stream.read(&mut buf).await?;
+    if n < 7 || buf[0] != 0x05 || buf[1] != 0x01 {
+        stream.write_all(&[0x05, 0x07, 0x00, 0x01, 0, 0, 0, 0, 0, 0]).await?;
+        return Err("Bad CONNECT".into());
+    }
+
+    let (dest_addr, dest_port) = parse_dest(&buf[3..n])?;
+
+    let dc = dest_addr
+        .parse::<Ipv4Addr>()
+        .ok()
+        .and_then(telegram_dc);
+
+    if let Some(dc_id) = dc {
+        stream
+            .write_all(&[0x05, 0x00, 0x00, 0x01, 127, 0, 0, 1, 0x04, 0x38])
+            .await?;
+
+        stats.ws_active.fetch_add(1, Ordering::Relaxed);
+        let result = relay_via_ws(stream, dc_id).await;
+        stats.ws_active.fetch_sub(1, Ordering::Relaxed);
+
+        if let Err(e) = result {
+            return Err(format!("WS tunnel DC{}: {}", dc_id, e).into());
+        }
+    } else {
+        let target = format!("{}:{}", dest_addr, dest_port);
+        match TcpStream::connect(&target).await {
+            Ok(remote) => {
+                let _ = remote.set_nodelay(true);
+                stream
+                    .write_all(&[0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0])
+                    .await?;
+                relay_tcp(stream, remote).await;
+            }
+            Err(_) => {
+                stream
+                    .write_all(&[0x05, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0])
+                    .await?;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+fn parse_dest(data: &[u8]) -> Result<(String, u16), Box<dyn std::error::Error + Send + Sync>> {
+    match data[0] {
+        0x01 => {
+            if data.len() < 7 { return Err("short".into()); }
+            let ip = format!("{}.{}.{}.{}", data[1], data[2], data[3], data[4]);
+            let port = u16::from_be_bytes([data[5], data[6]]);
+            Ok((ip, port))
+        }
+        0x03 => {
+            let len = data[1] as usize;
+            if data.len() < 2 + len + 2 { return Err("short".into()); }
+            let domain = std::str::from_utf8(&data[2..2 + len])?.to_string();
+            let port = u16::from_be_bytes([data[2 + len], data[3 + len]]);
+            Ok((domain, port))
+        }
+        0x04 => {
+            if data.len() < 19 { return Err("short".into()); }
+            let port = u16::from_be_bytes([data[17], data[18]]);
+            let mut segs = [0u16; 8];
+            for i in 0..8 {
+                segs[i] = u16::from_be_bytes([data[1 + i * 2], data[2 + i * 2]]);
+            }
+            let ip = std::net::Ipv6Addr::new(
+                segs[0], segs[1], segs[2], segs[3], segs[4], segs[5], segs[6], segs[7],
+            );
+            Ok((ip.to_string(), port))
+        }
+        _ => Err("unknown addr type".into()),
+    }
+}
+
+fn telegram_dc(ip: Ipv4Addr) -> Option<u8> {
+    let o = ip.octets();
+    match (o[0], o[1]) {
+        (149, 154) => Some(match o[2] {
+            160..=163 => 1,
+            164..=167 => 2,
+            168..=171 => 3,
+            172..=175 => 1,
+            _ => 2,
+        }),
+        (91, 108) => Some(match o[2] {
+            56..=59 => 5,
+            8..=11 => 3,
+            12..=15 => 4,
+            _ => 2,
+        }),
+        (91, 105) => Some(2),
+        (185, 76) => Some(2),
+        _ => None,
+    }
+}
+
+async fn relay_via_ws(
+    tcp_stream: TcpStream,
+    dc_id: u8,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    use futures_util::{SinkExt, StreamExt};
+
+    let ws_url = dc_ws_url(dc_id);
+    let mut request = ws_url.as_str().into_client_request()?;
+
+    // Required by the Telegram WebSocket transport protocol
+    request.headers_mut().insert(
+        "Sec-WebSocket-Protocol",
+        "binary".parse()?,
+    );
+    request.headers_mut().insert(
+        "Origin",
+        "https://web.telegram.org".parse()?,
+    );
+
+    let connector = tokio_tungstenite::Connector::NativeTls(
+        native_tls::TlsConnector::new().map_err(|e| format!("TLS: {}", e))?,
+    );
+
+    let (ws, _resp) = tokio_tungstenite::connect_async_tls_with_config(
+        request,
+        None,
+        false,
+        Some(connector),
+    )
+    .await?;
+
+    let (mut ws_tx, mut ws_rx) = ws.split();
+    let (mut tcp_rx, mut tcp_tx) = tokio::io::split(tcp_stream);
+
+    let up = async {
+        let mut buf = vec![0u8; 32768];
+        loop {
+            match tcp_rx.read(&mut buf).await {
+                Ok(0) => break,
+                Ok(n) => {
+                    let msg = tungstenite::Message::Binary(buf[..n].to_vec());
+                    if ws_tx.send(msg).await.is_err() {
+                        break;
+                    }
+                }
+                Err(_) => break,
+            }
+        }
+        let _ = ws_tx.close().await;
+    };
+
+    let down = async {
+        while let Some(Ok(msg)) = ws_rx.next().await {
+            match msg {
+                tungstenite::Message::Binary(data) => {
+                    if tcp_tx.write_all(&data).await.is_err() {
+                        break;
+                    }
+                }
+                tungstenite::Message::Close(_) => break,
+                _ => {}
+            }
+        }
+    };
+
+    tokio::select! {
+        _ = up => {}
+        _ = down => {}
+    }
+
+    Ok(())
+}
+
+async fn relay_tcp(client: TcpStream, remote: TcpStream) {
+    let (mut cr, mut cw) = tokio::io::split(client);
+    let (mut rr, mut rw) = tokio::io::split(remote);
+    tokio::select! {
+        _ = tokio::io::copy(&mut cr, &mut rw) => {}
+        _ = tokio::io::copy(&mut rr, &mut cw) => {}
+    }
+}