Update Cargo.lock

Regression coverage + Synlimit netfilter rules per-target + CidrRateLimitKey with IpNetwork + Telemt-Referenz der Konfigurationsparameter

CONTRIBUTING.md

@@ -1,18 +1,20 @@
 # Issues
-## Warnung
+### Warnung
+
 Before opening Issue, if it is more question than problem or bug - ask about that [in our chat](https://t.me/telemtrs)
 
-## What it is not
-- NOT Question and Answer
-- NOT Helpdesk
-
 ***Each of your Issues triggers attempts to reproduce problems and analyze them, which are done manually by people***
 
+Issues is **NOT** about:
+- Question and Answer
+- Helpdesk
+- Configuration or Intergraion Support
+
 ---
 
 # Pull Requests
 
-## General
+### General
 - ONLY signed and verified commits
 - ONLY from your name
 - DO NOT commit with `codex`, `claude`, or other AI tools as author/committer
@@ -20,7 +22,7 @@ Before opening Issue, if it is more question than problem or bug - ask about tha
 
 ---
 
-## Definition of Ready (MANDATORY)
+### Definition of Ready (MANDATORY)
 
 A Pull Request WILL be ignored or closed if:
 
@@ -32,14 +34,14 @@ A Pull Request WILL be ignored or closed if:
 
 ---
 
-## Blessed Principles
+### Blessed Principles
 - PR must build
 - PR must pass tests
 - PR must be understood by author
 
 ---
 
-## AI Usage Policy
+### AI Usage Policy
 
 AI tools (Claude, ChatGPT, Codex, DeepSeek, etc.) are allowed as **assistants**, NOT as decision-makers.
 
@@ -60,7 +62,7 @@ PRs that look like unverified AI dumps WILL be closed
 
 ---
 
-## Maintainer Policy
+### Maintainer Policy
 
 Maintainers reserve the right to:
 
@@ -72,7 +74,7 @@ Respect the reviewers time
 
 ---
 
-## Enforcement
+### Enforcement
 
 Pull Requests that violate project standards may be closed without review.
 

Cargo.lock

@@ -2899,7 +2899,7 @@ checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
 
 [[package]]
 name = "telemt"
-version = "3.4.22"
+version = "3.4.23"
 dependencies = [
  "aes",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "telemt"
-version = "3.4.22"
+version = "3.4.23"
 edition = "2024"
 
 [features]

docker-compose.host-netfilter.yml

@@ -4,7 +4,6 @@ services:
       context: .
       target: prod-netfilter
     network_mode: host
-    ports: []
+    ports: !reset []
     cap_add:
-      - NET_BIND_SERVICE
-      - NET_ADMIN
+      - NET_ADMIN

docs/Config_params/CONFIG_PARAMS.en.md

@@ -3186,7 +3186,7 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
 | [`replay_window_secs`](#replay_window_secs) | `u64` | `120` | `✘` |
 | [`ignore_time_skew`](#ignore_time_skew) | `bool` | `false` | `✘` |
 | [`user_rate_limits`](#user_rate_limits) | `Map<String, RateLimitBps>` | `{}` | `✔` |
-| [`cidr_rate_limits`](#cidr_rate_limits) | `Map<IpNetwork, RateLimitBps>` | `{}` | `✔` |
+| [`cidr_rate_limits`](#cidr_rate_limits) | `Map<CidrRateLimitKey, RateLimitBps>` | `{}` | `✔` |
 
 ## users
   - **Constraints / validation**: Must not be empty (at least one user must exist). Each value must be **exactly 32 hex characters**.
@@ -3349,13 +3349,15 @@ If your backend or network is very bandwidth-constrained, reduce cap first. If p
     alice = { up_bps = 1048576, down_bps = 2097152 }
     ```
 ## cidr_rate_limits
-  - **Constraints / validation**: Table `CIDR -> { up_bps, down_bps }`. CIDR must parse as `IpNetwork`; at least one direction must be non-zero.
-  - **Description**: Source-subnet bandwidth caps applied alongside per-user limits.
+  - **Constraints / validation**: Table `CIDR or auto-template -> { up_bps, down_bps }`. Explicit CIDR keys must parse as `IpNetwork`; auto-template keys must be `*4/N` (`N=0..32`), `*6/N` (`N=0..128`), or `*/N` (`N=0..32`). At least one direction must be non-zero. Duplicate normalized auto-templates are rejected.
+  - **Description**: Source-subnet bandwidth caps applied alongside per-user limits. Explicit CIDR rules use longest-prefix-wins and take priority over auto-templates. Auto-templates create buckets lazily per matched source subnet: `*4/N` for IPv4, `*6/N` for IPv6, and `*/N` as a dual-stack shorthand where IPv4 uses `/N` and IPv6 uses `/(N * 4)`.
   - **Example**:
 
     ```toml
     [access.cidr_rate_limits]
     "203.0.113.0/24" = { up_bps = 0, down_bps = 1048576 }
+    "*4/32" = { up_bps = 262144, down_bps = 1048576 }
+    "*6/64" = { up_bps = 262144, down_bps = 1048576 }
     ```
 # [[upstreams]]
 

docs/Config_params/CONFIG_PARAMS.ru.md

@@ -3112,7 +3112,7 @@
 | [`replay_window_secs`](#replay_window_secs) | `u64` | `120` | `✘` |
 | [`ignore_time_skew`](#ignore_time_skew) | `bool` | `false` | `✘` |
 | [`user_rate_limits`](#user_rate_limits) | `Map<String, RateLimitBps>` | `{}` | `✔` |
-| [`cidr_rate_limits`](#cidr_rate_limits) | `Map<IpNetwork, RateLimitBps>` | `{}` | `✔` |
+| [`cidr_rate_limits`](#cidr_rate_limits) | `Map<CidrRateLimitKey, RateLimitBps>` | `{}` | `✔` |
 
 ## users
   - **Ограничения / валидация**: Не должно быть пустым (должен существовать хотя бы один пользователь). Каждое значение должно состоять **ровно из 32 шестнадцатеричных символов**.
@@ -3265,13 +3265,15 @@
     alice = { up_bps = 1048576, down_bps = 2097152 }
     ```
 ## cidr_rate_limits
-  - **Ограничения / валидация**: Таблица `CIDR -> { up_bps, down_bps }`. CIDR должен корректно разбираться как `IpNetwork`; хотя бы одно направление должно быть ненулевым.
-  - **Описание**: Лимиты скорости для подсетей источников, применяются поверх пользовательских ограничений.
+  - **Ограничения / валидация**: Таблица `CIDR или auto-template -> { up_bps, down_bps }`. Explicit CIDR-ключи должны корректно разбираться как `IpNetwork`; auto-template ключи должны иметь вид `*4/N` (`N=0..32`), `*6/N` (`N=0..128`) или `*/N` (`N=0..32`). Хотя бы одно направление должно быть ненулевым. Дублирующиеся нормализованные auto-template отклоняются.
+  - **Описание**: Лимиты скорости для подсетей источников, применяются поверх пользовательских ограничений. Explicit CIDR-правила используют longest-prefix-wins и имеют приоритет над auto-template. Auto-template создают bucket’ы лениво по matched source subnet: `*4/N` для IPv4, `*6/N` для IPv6, а `*/N` является dual-stack shorthand, где IPv4 использует `/N`, а IPv6 — `/(N * 4)`.
   - **Example**:
 
     ```toml
     [access.cidr_rate_limits]
     "203.0.113.0/24" = { up_bps = 0, down_bps = 1048576 }
+    "*4/32" = { up_bps = 262144, down_bps = 1048576 }
+    "*6/64" = { up_bps = 262144, down_bps = 1048576 }
     ```
 # [[upstreams]]
 

src/config/hot_reload.rs

@@ -36,8 +36,8 @@ use tracing::{error, info, warn};
 
 use super::load::{LoadedConfig, ProxyConfig};
 use crate::config::{
-    ListenerConfig, LogLevel, MeBindStaleMode, MeFloorMode, MeSocksKdfPolicy, MeTelemetryLevel,
-    MeWriterPickMode, SynLimitMode,
+    CidrRateLimitKey, ListenerConfig, LogLevel, MeBindStaleMode, MeFloorMode, MeSocksKdfPolicy,
+    MeTelemetryLevel, MeWriterPickMode, SynLimitMode,
 };
 
 const HOT_RELOAD_DEBOUNCE: Duration = Duration::from_millis(50);
@@ -128,8 +128,7 @@ pub struct HotFields {
     pub user_expirations: std::collections::HashMap<String, chrono::DateTime<chrono::Utc>>,
     pub user_data_quota: std::collections::HashMap<String, u64>,
     pub user_rate_limits: std::collections::HashMap<String, crate::config::RateLimitBps>,
-    pub cidr_rate_limits:
-        std::collections::HashMap<ipnetwork::IpNetwork, crate::config::RateLimitBps>,
+    pub cidr_rate_limits: std::collections::HashMap<CidrRateLimitKey, crate::config::RateLimitBps>,
     pub user_max_unique_ips: std::collections::HashMap<String, usize>,
     pub user_max_unique_ips_global_each: usize,
     pub user_max_unique_ips_mode: crate::config::UserMaxUniqueIpsMode,

src/config/load.rs

@@ -673,6 +673,16 @@ impl ProxyConfig {
                 )));
             }
         }
+        let mut cidr_auto_templates = HashSet::new();
+        for cidr in config.access.cidr_rate_limits.keys() {
+            for template in cidr.auto_templates().into_iter().flatten() {
+                if !cidr_auto_templates.insert(template) {
+                    return Err(ProxyError::Config(format!(
+                        "access.cidr_rate_limits.{cidr} duplicates normalized auto-template {template}"
+                    )));
+                }
+            }
+        }
 
         if config.general.me_reinit_every_secs == 0 {
             return Err(ProxyError::Config(
@@ -958,6 +968,10 @@ impl ProxyConfig {
             .server
             .client_mss_value()
             .map_err(|error| ProxyError::Config(format!("server.client_mss {error}")))?;
+        config
+            .server
+            .client_mss_bulk_value()
+            .map_err(|error| ProxyError::Config(format!("server.client_mss_bulk {error}")))?;
         for (idx, listener) in config.server.listeners.iter().enumerate() {
             if listener.client_mss.is_some() {
                 listener

src/config/tests/load_basic_tests.rs

@@ -1,4 +1,5 @@
 use super::*;
+use crate::config::CidrRateLimitKey;
 
 const TEST_SHADOWSOCKS_URL: &str =
     "ss://2022-blake3-aes-256-gcm:MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDE=@127.0.0.1:8388";
@@ -319,6 +320,80 @@ fn logging_config_is_loaded_from_strict_config() {
     assert_eq!(cfg.logging.max_age_secs, 60);
 }
 
+#[test]
+fn cidr_rate_limits_accept_auto_templates_in_strict_config() {
+    let cfg = load_config_from_temp_toml(
+        r#"
+            [general]
+            config_strict = true
+
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [access.cidr_rate_limits]
+            "*/24" = { up_bps = 1024, down_bps = 0 }
+            "*4/30" = { up_bps = 0, down_bps = 2048 }
+            "*6/64" = { up_bps = 4096, down_bps = 0 }
+        "#,
+    );
+
+    assert!(
+        cfg.access
+            .cidr_rate_limits
+            .contains_key(&CidrRateLimitKey::AutoDual(24))
+    );
+    assert!(
+        cfg.access
+            .cidr_rate_limits
+            .contains_key(&CidrRateLimitKey::AutoV4(30))
+    );
+    assert!(
+        cfg.access
+            .cidr_rate_limits
+            .contains_key(&CidrRateLimitKey::AutoV6(64))
+    );
+}
+
+#[test]
+fn cidr_rate_limits_reject_invalid_auto_template_prefix() {
+    let error = load_config_error_from_temp_toml(
+        r#"
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [access.cidr_rate_limits]
+            "*4/33" = { up_bps = 1024, down_bps = 0 }
+        "#,
+    );
+
+    assert!(error.contains("prefix must be within 0..=32"));
+}
+
+#[test]
+fn cidr_rate_limits_reject_duplicate_normalized_auto_templates() {
+    let error = load_config_error_from_temp_toml(
+        r#"
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+
+            [access.cidr_rate_limits]
+            "*/32" = { up_bps = 1024, down_bps = 0 }
+            "*6/128" = { up_bps = 2048, down_bps = 0 }
+        "#,
+    );
+
+    assert!(error.contains("duplicates normalized auto-template *6/128"));
+}
+
 #[test]
 fn file_logging_requires_path() {
     let error = load_config_error_from_temp_toml(
@@ -1652,6 +1727,7 @@ fn client_mss_custom_value_is_accepted() {
     let toml = r#"
         [server]
         client_mss = "4096"
+        client_mss_bulk = "1400"
 
         [censorship]
         tls_domain = "example.com"
@@ -1665,6 +1741,7 @@ fn client_mss_custom_value_is_accepted() {
     let cfg = ProxyConfig::load(&path).unwrap();
 
     assert_eq!(cfg.server.client_mss_value(), Ok(Some(4096)));
+    assert_eq!(cfg.server.client_mss_bulk_value(), Ok(Some(1400)));
     let _ = std::fs::remove_file(path);
 }
 
@@ -1693,6 +1770,33 @@ fn client_mss_out_of_range_is_rejected() {
     }
 }
 
+#[test]
+fn client_mss_bulk_out_of_range_is_rejected() {
+    for value in ["87", "4097"] {
+        let toml = format!(
+            r#"
+            [server]
+            client_mss_bulk = "{value}"
+
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+        "#
+        );
+        let dir = std::env::temp_dir();
+        let path = dir.join(format!(
+            "telemt_client_mss_bulk_out_of_range_{value}_test.toml"
+        ));
+        std::fs::write(&path, toml).unwrap();
+        let err = ProxyConfig::load(&path).unwrap_err().to_string();
+
+        assert!(err.contains("server.client_mss_bulk custom value must be within [88, 4096]"));
+        let _ = std::fs::remove_file(path);
+    }
+}
+
 #[test]
 fn client_mss_unquoted_number_is_rejected() {
     let toml = r#"

src/config/types.rs

@@ -2,6 +2,7 @@ use chrono::{DateTime, Utc};
 use ipnetwork::IpNetwork;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
+use std::fmt;
 use std::net::IpAddr;
 use std::path::PathBuf;
 
@@ -2098,11 +2099,13 @@ pub struct AccessConfig {
 
     /// Per-CIDR aggregate transport rate limits in bits-per-second.
     ///
-    /// Matching uses longest-prefix-wins semantics. A value of `0` in one
-    /// direction means "unlimited" for that direction. Limits are amortized
-    /// with the same bounded-burst contract as per-user rate limits.
+    /// Explicit CIDR keys use longest-prefix-wins semantics. Auto-template
+    /// keys (`*4/N`, `*6/N`, `*/N`) lazily create per-source-subnet buckets
+    /// after explicit CIDR matching misses. A value of `0` in one direction
+    /// means "unlimited" for that direction. Limits are amortized with the
+    /// same bounded-burst contract as per-user rate limits.
     #[serde(default)]
-    pub cidr_rate_limits: HashMap<IpNetwork, RateLimitBps>,
+    pub cidr_rate_limits: HashMap<CidrRateLimitKey, RateLimitBps>,
 
     /// Per-username client source IP/CIDR deny list. Checked after successful
     /// authentication; matching IPs get the same rejection path as invalid auth
@@ -2171,10 +2174,156 @@ impl AccessConfig {
     }
 }
 
+/// Key used by `access.cidr_rate_limits`.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum CidrRateLimitKey {
+    /// Explicit source CIDR rule.
+    Network(IpNetwork),
+    /// IPv4 auto-template that creates one bucket for each matching `/N`.
+    AutoV4(u8),
+    /// IPv6 auto-template that creates one bucket for each matching `/N`.
+    AutoV6(u8),
+    /// Dual-stack auto-template; IPv4 uses `/N`, IPv6 uses `/(N * 4)`.
+    AutoDual(u8),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) enum CidrAutoTemplateFamily {
+    V4,
+    V6,
+}
+
+impl CidrAutoTemplateFamily {
+    pub(crate) fn marker(self) -> &'static str {
+        match self {
+            Self::V4 => "*4",
+            Self::V6 => "*6",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub(crate) struct CidrAutoTemplate {
+    pub(crate) family: CidrAutoTemplateFamily,
+    pub(crate) prefix_len: u8,
+}
+
+impl fmt::Display for CidrAutoTemplate {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "{}/{}", self.family.marker(), self.prefix_len)
+    }
+}
+
+impl CidrRateLimitKey {
+    pub(crate) fn auto_templates(&self) -> [Option<CidrAutoTemplate>; 2] {
+        match *self {
+            Self::Network(_) => [None, None],
+            Self::AutoV4(prefix_len) => [
+                Some(CidrAutoTemplate {
+                    family: CidrAutoTemplateFamily::V4,
+                    prefix_len,
+                }),
+                None,
+            ],
+            Self::AutoV6(prefix_len) => [
+                Some(CidrAutoTemplate {
+                    family: CidrAutoTemplateFamily::V6,
+                    prefix_len,
+                }),
+                None,
+            ],
+            Self::AutoDual(prefix_len) => [
+                Some(CidrAutoTemplate {
+                    family: CidrAutoTemplateFamily::V4,
+                    prefix_len,
+                }),
+                Some(CidrAutoTemplate {
+                    family: CidrAutoTemplateFamily::V6,
+                    prefix_len: prefix_len.saturating_mul(4),
+                }),
+            ],
+        }
+    }
+}
+
+impl fmt::Display for CidrRateLimitKey {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Network(cidr) => write!(formatter, "{cidr}"),
+            Self::AutoV4(prefix_len) => write!(formatter, "*4/{prefix_len}"),
+            Self::AutoV6(prefix_len) => write!(formatter, "*6/{prefix_len}"),
+            Self::AutoDual(prefix_len) => write!(formatter, "*/{prefix_len}"),
+        }
+    }
+}
+
+impl Serialize for CidrRateLimitKey {
+    fn serialize<S>(&self, serializer: S) -> std::result::Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for CidrRateLimitKey {
+    fn deserialize<D>(deserializer: D) -> std::result::Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let value = String::deserialize(deserializer)?;
+        parse_cidr_rate_limit_key(&value).map_err(serde::de::Error::custom)
+    }
+}
+
+fn parse_cidr_rate_limit_key(value: &str) -> std::result::Result<CidrRateLimitKey, String> {
+    if let Some(prefix) = value.strip_prefix("*4/") {
+        return parse_cidr_auto_prefix(value, prefix, 32).map(CidrRateLimitKey::AutoV4);
+    }
+    if let Some(prefix) = value.strip_prefix("*6/") {
+        return parse_cidr_auto_prefix(value, prefix, 128).map(CidrRateLimitKey::AutoV6);
+    }
+    if let Some(prefix) = value.strip_prefix("*/") {
+        return parse_cidr_auto_prefix(value, prefix, 32).map(CidrRateLimitKey::AutoDual);
+    }
+    if value.starts_with('*') {
+        return Err(format!(
+            "invalid CIDR rate limit key {value:?}; expected CIDR, *4/N, *6/N, or */N"
+        ));
+    }
+    value
+        .parse::<IpNetwork>()
+        .map(CidrRateLimitKey::Network)
+        .map_err(|error| {
+            format!(
+                "invalid CIDR rate limit key {value:?}: {error}; expected CIDR, *4/N, *6/N, or */N"
+            )
+        })
+}
+
+fn parse_cidr_auto_prefix(
+    key: &str,
+    prefix: &str,
+    max_prefix: u8,
+) -> std::result::Result<u8, String> {
+    let prefix = prefix.parse::<u8>().map_err(|_| {
+        format!("invalid CIDR auto-template key {key:?}; prefix must be within 0..={max_prefix}")
+    })?;
+    if prefix > max_prefix {
+        return Err(format!(
+            "invalid CIDR auto-template key {key:?}; prefix must be within 0..={max_prefix}"
+        ));
+    }
+    Ok(prefix)
+}
+
+/// Transport rate limit in bits-per-second.
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct RateLimitBps {
+    /// Upload direction limit in bits-per-second; `0` means unlimited.
     #[serde(default)]
     pub up_bps: u64,
+    /// Download direction limit in bits-per-second; `0` means unlimited.
     #[serde(default)]
     pub down_bps: u64,
 }

src/proxy/middle_relay.rs

@@ -69,7 +69,9 @@ use self::quota::{
 #[cfg(test)]
 use self::c2me::enqueue_c2me_command;
 #[cfg(test)]
-use self::d2c::{compute_intermediate_secure_wire_len, process_me_writer_response};
+use self::d2c::{
+    compute_intermediate_secure_wire_len, process_me_writer_response, write_client_payload,
+};
 #[cfg(test)]
 pub(crate) use self::desync::{
     clear_desync_dedup_for_testing_in_shared, desync_dedup_get_for_testing,
@@ -166,3 +168,7 @@ mod middle_relay_atomic_quota_invariant_tests;
 #[cfg(test)]
 #[path = "tests/middle_relay_baseline_invariant_tests.rs"]
 mod middle_relay_baseline_invariant_tests;
+
+#[cfg(test)]
+#[path = "tests/middle_relay_d2c_flush_padding_security_tests.rs"]
+mod middle_relay_d2c_flush_padding_security_tests;

src/proxy/tests/middle_relay_d2c_flush_padding_security_tests.rs

@@ -0,0 +1,150 @@
+use std::io;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::task::{Context, Poll};
+
+use tokio::io::AsyncWrite;
+
+use super::*;
+use crate::crypto::AesCtr;
+use crate::protocol::framing::INTERMEDIATE_WIRE_LEN_MASK;
+
+#[derive(Clone, Default)]
+struct RecordingWriter {
+    writes: Arc<Mutex<Vec<u8>>>,
+    flushes: Arc<AtomicUsize>,
+}
+
+impl RecordingWriter {
+    fn captured(&self) -> Vec<u8> {
+        self.writes
+            .lock()
+            .expect("test writer capture lock must not be poisoned")
+            .clone()
+    }
+}
+
+impl AsyncWrite for RecordingWriter {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        self.writes
+            .lock()
+            .expect("test writer capture lock must not be poisoned")
+            .extend_from_slice(buf);
+        Poll::Ready(Ok(buf.len()))
+    }
+
+    fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        self.flushes.fetch_add(1, Ordering::Relaxed);
+        Poll::Ready(Ok(()))
+    }
+
+    fn poll_shutdown(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+}
+
+fn crypto_writer(inner: RecordingWriter) -> CryptoWriter<RecordingWriter> {
+    let key = [0u8; 32];
+    CryptoWriter::new(inner, AesCtr::new(&key, 0), 8 * 1024 * 1024)
+}
+
+fn decrypt_capture(mut encrypted: Vec<u8>) -> Vec<u8> {
+    let key = [0u8; 32];
+    let mut cipher = AesCtr::new(&key, 0);
+    cipher.apply(&mut encrypted);
+    encrypted
+}
+
+fn secure_wire_len(cleartext: &[u8]) -> usize {
+    let header = cleartext
+        .get(..4)
+        .expect("secure frame must include an intermediate header");
+    (u32::from_le_bytes(
+        header
+            .try_into()
+            .expect("secure frame header must be four bytes"),
+    ) & INTERMEDIATE_WIRE_LEN_MASK) as usize
+}
+
+async fn write_secure_payload(payload_len: usize) -> (MeD2cWriteMode, Vec<u8>) {
+    let inner = RecordingWriter::default();
+    let capture = inner.clone();
+    let mut writer = crypto_writer(inner);
+    let payload = vec![0xa5; payload_len];
+    let mut frame_buf = Vec::new();
+    let cancel = CancellationToken::new();
+    let rng = SecureRandom::new();
+
+    let mode = write_client_payload(
+        &mut writer,
+        ProtoTag::Secure,
+        0,
+        &payload,
+        &rng,
+        &mut frame_buf,
+        &cancel,
+    )
+    .await
+    .expect("secure payload write must succeed");
+    flush_client_or_cancel(&mut writer, &cancel)
+        .await
+        .expect("secure payload flush must succeed");
+
+    (mode, decrypt_capture(capture.captured()))
+}
+
+fn assert_secure_payload_with_tail_padding(cleartext: &[u8], payload_len: usize) {
+    let wire_len = secure_wire_len(cleartext);
+    assert_eq!(cleartext.len(), 4 + wire_len);
+    assert!(
+        cleartext[4..4 + payload_len]
+            .iter()
+            .all(|byte| *byte == 0xa5)
+    );
+
+    let padding_len = wire_len
+        .checked_sub(payload_len)
+        .expect("secure wire length must include payload bytes");
+    assert!((1..=3).contains(&padding_len));
+    assert_ne!(wire_len % 4, 0);
+}
+
+#[tokio::test]
+async fn queue_drain_flush_reason_performs_physical_client_flush() {
+    let inner = RecordingWriter::default();
+    let flushes = inner.flushes.clone();
+    let mut writer = crypto_writer(inner);
+    let cancel = CancellationToken::new();
+
+    assert!(me_d2c_flush_reason_requires_client_flush(
+        MeD2cFlushReason::QueueDrain
+    ));
+    flush_client_or_cancel(&mut writer, &cancel)
+        .await
+        .expect("client flush must succeed");
+
+    assert_eq!(flushes.load(Ordering::Relaxed), 1);
+}
+
+#[tokio::test]
+async fn secure_payload_coalesced_path_keeps_tail_padding() {
+    let payload_len = 8;
+    let (mode, cleartext) = write_secure_payload(payload_len).await;
+
+    assert!(matches!(mode, MeD2cWriteMode::Coalesced));
+    assert_secure_payload_with_tail_padding(&cleartext, payload_len);
+}
+
+#[tokio::test]
+async fn secure_payload_split_path_keeps_tail_padding() {
+    let payload_len = ME_D2C_SINGLE_WRITE_COALESCE_MAX_BYTES;
+    let (mode, cleartext) = write_secure_payload(payload_len).await;
+
+    assert!(matches!(mode, MeD2cWriteMode::Split));
+    assert_secure_payload_with_tail_padding(&cleartext, payload_len);
+}

src/proxy/traffic_limiter.rs

@@ -10,7 +10,7 @@ use arc_swap::ArcSwap;
 use dashmap::DashMap;
 use ipnetwork::IpNetwork;
 
-use crate::config::RateLimitBps;
+use crate::config::{CidrRateLimitKey, RateLimitBps};
 
 const REGISTRY_SHARDS: usize = 64;
 const FAIR_EPOCH_MS: u64 = 20;
@@ -413,16 +413,29 @@ struct CidrRule {
     prefix_len: u8,
 }
 
+#[derive(Clone, Copy)]
+struct CidrAutoRule {
+    prefix_len: u8,
+    limits: RateLimitBps,
+}
+
+enum CidrPolicyMatch<'a> {
+    Explicit(&'a CidrRule),
+    Auto { key: String, limits: RateLimitBps },
+}
+
 #[derive(Default)]
 struct PolicySnapshot {
     user_limits: HashMap<String, RateLimitBps>,
     cidr_rules_v4: Vec<CidrRule>,
     cidr_rules_v6: Vec<CidrRule>,
+    cidr_auto_rules_v4: Vec<CidrAutoRule>,
+    cidr_auto_rules_v6: Vec<CidrAutoRule>,
     cidr_rule_keys: HashSet<String>,
 }
 
 impl PolicySnapshot {
-    fn match_cidr(&self, ip: IpAddr) -> Option<&CidrRule> {
+    fn match_cidr(&self, ip: IpAddr) -> Option<CidrPolicyMatch<'_>> {
         match ip {
             IpAddr::V4(_) => self
                 .cidr_rules_v4
@@ -433,6 +446,20 @@ impl PolicySnapshot {
                 .iter()
                 .find(|rule| rule.cidr.contains(ip)),
         }
+        .map(CidrPolicyMatch::Explicit)
+        .or_else(|| self.match_auto_cidr(ip))
+    }
+
+    fn match_auto_cidr(&self, ip: IpAddr) -> Option<CidrPolicyMatch<'_>> {
+        let rule = match ip {
+            IpAddr::V4(_) => self.cidr_auto_rules_v4.first()?,
+            IpAddr::V6(_) => self.cidr_auto_rules_v6.first()?,
+        };
+        let key = auto_cidr_bucket_key(ip, rule.prefix_len)?;
+        Some(CidrPolicyMatch::Auto {
+            key,
+            limits: rule.limits,
+        })
     }
 }
 
@@ -633,7 +660,7 @@ impl TrafficLimiter {
     pub fn apply_policy(
         &self,
         user_limits: HashMap<String, RateLimitBps>,
-        cidr_limits: HashMap<IpNetwork, RateLimitBps>,
+        cidr_limits: HashMap<CidrRateLimitKey, RateLimitBps>,
     ) {
         let filtered_users = user_limits
             .into_iter()
@@ -642,39 +669,64 @@ impl TrafficLimiter {
 
         let mut cidr_rules_v4 = Vec::new();
         let mut cidr_rules_v6 = Vec::new();
+        let mut cidr_auto_rules_v4 = Vec::new();
+        let mut cidr_auto_rules_v6 = Vec::new();
         let mut cidr_rule_keys = HashSet::new();
-        for (cidr, limits) in cidr_limits {
+        for (key, limits) in cidr_limits {
             if limits.up_bps == 0 && limits.down_bps == 0 {
                 continue;
             }
-            let key = cidr.to_string();
-            let rule = CidrRule {
-                key: key.clone(),
-                cidr,
-                limits,
-                prefix_len: cidr.prefix(),
-            };
-            cidr_rule_keys.insert(key);
-            match rule.cidr {
-                IpNetwork::V4(_) => cidr_rules_v4.push(rule),
-                IpNetwork::V6(_) => cidr_rules_v6.push(rule),
+            match key {
+                CidrRateLimitKey::Network(cidr) => {
+                    let key = cidr.to_string();
+                    let rule = CidrRule {
+                        key: key.clone(),
+                        cidr,
+                        limits,
+                        prefix_len: cidr.prefix(),
+                    };
+                    cidr_rule_keys.insert(key);
+                    match rule.cidr {
+                        IpNetwork::V4(_) => cidr_rules_v4.push(rule),
+                        IpNetwork::V6(_) => cidr_rules_v6.push(rule),
+                    }
+                }
+                CidrRateLimitKey::AutoV4(prefix_len) => {
+                    cidr_auto_rules_v4.push(CidrAutoRule { prefix_len, limits });
+                }
+                CidrRateLimitKey::AutoV6(prefix_len) => {
+                    cidr_auto_rules_v6.push(CidrAutoRule { prefix_len, limits });
+                }
+                CidrRateLimitKey::AutoDual(prefix_len) => {
+                    cidr_auto_rules_v4.push(CidrAutoRule { prefix_len, limits });
+                    cidr_auto_rules_v6.push(CidrAutoRule {
+                        prefix_len: prefix_len.saturating_mul(4),
+                        limits,
+                    });
+                }
             }
         }
 
         cidr_rules_v4.sort_by(|a, b| b.prefix_len.cmp(&a.prefix_len));
         cidr_rules_v6.sort_by(|a, b| b.prefix_len.cmp(&a.prefix_len));
+        cidr_auto_rules_v4.sort_by(|a, b| b.prefix_len.cmp(&a.prefix_len));
+        cidr_auto_rules_v6.sort_by(|a, b| b.prefix_len.cmp(&a.prefix_len));
+        let cidr_policy_entries =
+            cidr_rule_keys.len() + cidr_auto_rules_v4.len() + cidr_auto_rules_v6.len();
 
         self.user_scope
             .policy_entries
             .store(filtered_users.len() as u64, Ordering::Relaxed);
         self.cidr_scope
             .policy_entries
-            .store(cidr_rule_keys.len() as u64, Ordering::Relaxed);
+            .store(cidr_policy_entries as u64, Ordering::Relaxed);
 
         self.policy.store(Arc::new(PolicySnapshot {
             user_limits: filtered_users,
             cidr_rules_v4,
             cidr_rules_v6,
+            cidr_auto_rules_v4,
+            cidr_auto_rules_v6,
             cidr_rule_keys,
         }));
 
@@ -703,11 +755,15 @@ impl TrafficLimiter {
         let mut cidr_bucket = None;
         let mut cidr_user_key = None;
         let mut cidr_user_share = None;
-        if let Some(rule) = policy.match_cidr(client_ip) {
+        if let Some(rule_match) = policy.match_cidr(client_ip) {
+            let (key, limits) = match &rule_match {
+                CidrPolicyMatch::Explicit(rule) => (rule.key.as_str(), rule.limits),
+                CidrPolicyMatch::Auto { key, limits } => (key.as_str(), *limits),
+            };
             let bucket = self
                 .cidr_buckets
-                .get_or_insert_with(rule.key.as_str(), || CidrBucket::new(rule.limits));
-            bucket.set_rates(rule.limits);
+                .get_or_insert_with(key, || CidrBucket::new(limits));
+            bucket.set_rates(limits);
             bucket.active_leases.fetch_add(1, Ordering::Relaxed);
             self.cidr_scope
                 .active_leases
@@ -841,6 +897,16 @@ fn bytes_per_epoch(bps: u64) -> u64 {
     bytes.max(1)
 }
 
+fn auto_cidr_bucket_key(ip: IpAddr, prefix_len: u8) -> Option<String> {
+    let cidr = IpNetwork::new(ip, prefix_len).ok()?;
+    let network = IpNetwork::new(cidr.network(), prefix_len).ok()?;
+    let family = match network {
+        IpNetwork::V4(_) => "4",
+        IpNetwork::V6(_) => "6",
+    };
+    Some(format!("auto:{family}:{network}"))
+}
+
 fn current_epoch() -> u64 {
     let start = limiter_epoch_start();
     let elapsed_ms = start.elapsed().as_millis() as u64;
@@ -851,3 +917,82 @@ fn limiter_epoch_start() -> &'static Instant {
     static START: OnceLock<Instant> = OnceLock::new();
     START.get_or_init(Instant::now)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn rate(up_bps: u64, down_bps: u64) -> RateLimitBps {
+        RateLimitBps { up_bps, down_bps }
+    }
+
+    #[test]
+    fn explicit_cidr_rule_wins_over_auto_template() {
+        let limiter = TrafficLimiter::new();
+        let mut cidr_limits = HashMap::new();
+        cidr_limits.insert(CidrRateLimitKey::AutoV4(24), rate(1_000, 0));
+        cidr_limits.insert(
+            CidrRateLimitKey::Network("203.0.113.7/32".parse().unwrap()),
+            rate(2_000, 0),
+        );
+
+        limiter.apply_policy(HashMap::new(), cidr_limits);
+        let policy = limiter.policy.load_full();
+        let matched = policy.match_cidr("203.0.113.7".parse().unwrap()).unwrap();
+
+        match matched {
+            CidrPolicyMatch::Explicit(rule) => assert_eq!(rule.key.as_str(), "203.0.113.7/32"),
+            CidrPolicyMatch::Auto { .. } => panic!("explicit CIDR must have priority"),
+        }
+    }
+
+    #[test]
+    fn auto_template_uses_longest_prefix() {
+        let limiter = TrafficLimiter::new();
+        let mut cidr_limits = HashMap::new();
+        cidr_limits.insert(CidrRateLimitKey::AutoV4(24), rate(1_000, 0));
+        cidr_limits.insert(CidrRateLimitKey::AutoV4(32), rate(2_000, 0));
+
+        limiter.apply_policy(HashMap::new(), cidr_limits);
+        let policy = limiter.policy.load_full();
+        let matched = policy.match_cidr("203.0.113.129".parse().unwrap()).unwrap();
+
+        match matched {
+            CidrPolicyMatch::Auto { key, limits } => {
+                assert_eq!(key, "auto:4:203.0.113.129/32");
+                assert_eq!(limits.up_bps, 2_000);
+            }
+            CidrPolicyMatch::Explicit(_) => panic!("auto-template match expected"),
+        }
+    }
+
+    #[test]
+    fn dual_auto_template_maps_v6_prefix_by_four() {
+        let limiter = TrafficLimiter::new();
+        let mut cidr_limits = HashMap::new();
+        cidr_limits.insert(CidrRateLimitKey::AutoDual(32), rate(1_000, 0));
+
+        limiter.apply_policy(HashMap::new(), cidr_limits);
+        let policy = limiter.policy.load_full();
+        let matched = policy.match_cidr("2001:db8::1".parse().unwrap()).unwrap();
+
+        match matched {
+            CidrPolicyMatch::Auto { key, .. } => {
+                assert_eq!(key, "auto:6:2001:db8::1/128");
+            }
+            CidrPolicyMatch::Explicit(_) => panic!("auto-template match expected"),
+        }
+    }
+
+    #[test]
+    fn auto_cidr_bucket_key_canonicalizes_network_address() {
+        assert_eq!(
+            auto_cidr_bucket_key("203.0.113.129".parse().unwrap(), 24).unwrap(),
+            "auto:4:203.0.113.0/24"
+        );
+        assert_eq!(
+            auto_cidr_bucket_key("2001:db8::abcd".parse().unwrap(), 64).unwrap(),
+            "auto:6:2001:db8::/64"
+        );
+    }
+}

src/synlimit_control/iptables.rs

@@ -1,10 +1,8 @@
 use std::net::IpAddr;
 
 use super::command::run_command;
-use super::model::{SynLimitRule, SynLimitTargets, synlimit_rate_arg};
+use super::model::{SynLimitNamespace, SynLimitRule, SynLimitTargets, synlimit_rate_arg};
 
-const IPTABLES_CHAIN: &str = "TELEMT_SYNLIMIT";
-const IPTABLES_HASHLIMIT_PREFIX: &str = "TMT-SYN";
 const IPV4_IOS_PACKET_LENGTH: u16 = 64;
 const IPV6_IOS_PACKET_LENGTH: u16 = 84;
 const IOS_TTL_LIMIT: u8 = 65;
@@ -38,49 +36,57 @@ impl IpTablesFamily {
     }
 }
 
-pub(super) async fn apply_synlimit_rules(targets: &SynLimitTargets) -> Result<(), String> {
-    apply_rules_for_binary("iptables", &targets.iptables_v4, IpTablesFamily::V4).await?;
-    apply_rules_for_binary("ip6tables", &targets.iptables_v6, IpTablesFamily::V6).await
+pub(super) async fn apply_synlimit_rules(
+    targets: &SynLimitTargets,
+    namespace: &SynLimitNamespace,
+) -> Result<(), String> {
+    apply_rules_for_binary(
+        "iptables",
+        &targets.iptables_v4,
+        IpTablesFamily::V4,
+        namespace,
+    )
+    .await?;
+    apply_rules_for_binary(
+        "ip6tables",
+        &targets.iptables_v6,
+        IpTablesFamily::V6,
+        namespace,
+    )
+    .await
 }
 
 async fn apply_rules_for_binary(
     binary: &str,
     targets: &[SynLimitRule],
     family: IpTablesFamily,
+    namespace: &SynLimitNamespace,
 ) -> Result<(), String> {
     if targets.is_empty() {
         return Ok(());
     }
-    let _ = run_command(binary, &["-t", "filter", "-N", IPTABLES_CHAIN], None).await;
-    run_command(binary, &["-t", "filter", "-F", IPTABLES_CHAIN], None).await?;
-    if run_command(
-        binary,
-        &["-t", "filter", "-C", "INPUT", "-j", IPTABLES_CHAIN],
-        None,
-    )
-    .await
-    .is_err()
+    let chain = namespace.iptables_chain.as_str();
+    let _ = run_command(binary, &["-t", "filter", "-N", chain], None).await;
+    run_command(binary, &["-t", "filter", "-F", chain], None).await?;
+    if run_command(binary, &["-t", "filter", "-C", "INPUT", "-j", chain], None)
+        .await
+        .is_err()
     {
         run_command(
             binary,
-            &["-t", "filter", "-I", "INPUT", "1", "-j", IPTABLES_CHAIN],
+            &["-t", "filter", "-I", "INPUT", "1", "-j", chain],
             None,
         )
         .await?;
     }
 
     for (idx, target) in targets.iter().enumerate() {
-        for rule in iptables_synfix_rule_args(target, idx, family) {
+        for rule in iptables_synfix_rule_args(target, idx, family, namespace) {
             let refs: Vec<&str> = rule.iter().map(String::as_str).collect();
             run_command(binary, &refs, None).await?;
         }
     }
-    run_command(
-        binary,
-        &["-t", "filter", "-A", IPTABLES_CHAIN, "-j", "RETURN"],
-        None,
-    )
-    .await?;
+    run_command(binary, &["-t", "filter", "-A", chain, "-j", "RETURN"], None).await?;
 
     Ok(())
 }
@@ -89,12 +95,13 @@ fn iptables_synfix_rule_args(
     target: &SynLimitRule,
     idx: usize,
     family: IpTablesFamily,
+    namespace: &SynLimitNamespace,
 ) -> Vec<Vec<String>> {
     vec![
-        iptables_ios_accept_rule_args(target, idx, family),
-        iptables_ios_reject_rule_args(target, family),
-        iptables_generic_accept_rule_args(target, idx, family),
-        iptables_generic_reject_rule_args(target),
+        iptables_ios_accept_rule_args(target, idx, family, namespace),
+        iptables_ios_reject_rule_args(target, family, namespace),
+        iptables_generic_accept_rule_args(target, idx, family, namespace),
+        iptables_generic_reject_rule_args(target, namespace),
     ]
 }
 
@@ -102,12 +109,15 @@ fn iptables_ios_accept_rule_args(
     target: &SynLimitRule,
     idx: usize,
     family: IpTablesFamily,
+    namespace: &SynLimitNamespace,
 ) -> Vec<String> {
     let hashlimit_name = format!(
-        "{IPTABLES_HASHLIMIT_PREFIX}-I{}-{idx}",
+        "{}-I{}-{idx}",
+        namespace.iptables_hashlimit_prefix,
         family.hashlimit_tag()
     );
-    let mut args = iptables_base_rule_args(target.ip, target.port);
+    let mut args =
+        iptables_base_rule_args(namespace.iptables_chain.as_str(), target.ip, target.port);
     args.extend(iptables_ios_match_args(family));
     args.extend(iptables_hashlimit_args(
         &hashlimit_name,
@@ -121,8 +131,13 @@ fn iptables_ios_accept_rule_args(
     args
 }
 
-fn iptables_ios_reject_rule_args(target: &SynLimitRule, family: IpTablesFamily) -> Vec<String> {
-    let mut args = iptables_base_rule_args(target.ip, target.port);
+fn iptables_ios_reject_rule_args(
+    target: &SynLimitRule,
+    family: IpTablesFamily,
+    namespace: &SynLimitNamespace,
+) -> Vec<String> {
+    let mut args =
+        iptables_base_rule_args(namespace.iptables_chain.as_str(), target.ip, target.port);
     args.extend(iptables_ios_match_args(family));
     args.extend(iptables_reject_args());
     args
@@ -132,12 +147,15 @@ fn iptables_generic_accept_rule_args(
     target: &SynLimitRule,
     idx: usize,
     family: IpTablesFamily,
+    namespace: &SynLimitNamespace,
 ) -> Vec<String> {
     let hashlimit_name = format!(
-        "{IPTABLES_HASHLIMIT_PREFIX}-G{}-{idx}",
+        "{}-G{}-{idx}",
+        namespace.iptables_hashlimit_prefix,
         family.hashlimit_tag()
     );
-    let mut args = iptables_base_rule_args(target.ip, target.port);
+    let mut args =
+        iptables_base_rule_args(namespace.iptables_chain.as_str(), target.ip, target.port);
     args.extend(iptables_hashlimit_args(
         &hashlimit_name,
         target.generic_seconds,
@@ -150,18 +168,22 @@ fn iptables_generic_accept_rule_args(
     args
 }
 
-fn iptables_generic_reject_rule_args(target: &SynLimitRule) -> Vec<String> {
-    let mut args = iptables_base_rule_args(target.ip, target.port);
+fn iptables_generic_reject_rule_args(
+    target: &SynLimitRule,
+    namespace: &SynLimitNamespace,
+) -> Vec<String> {
+    let mut args =
+        iptables_base_rule_args(namespace.iptables_chain.as_str(), target.ip, target.port);
     args.extend(iptables_reject_args());
     args
 }
 
-fn iptables_base_rule_args(ip: Option<IpAddr>, port: u16) -> Vec<String> {
+fn iptables_base_rule_args(chain: &str, ip: Option<IpAddr>, port: u16) -> Vec<String> {
     let mut args = vec![
         "-t".to_string(),
         "filter".to_string(),
         "-A".to_string(),
-        IPTABLES_CHAIN.to_string(),
+        chain.to_string(),
         "-p".to_string(),
         "tcp".to_string(),
         "--syn".to_string(),
@@ -226,17 +248,15 @@ fn iptables_reject_args() -> Vec<String> {
     ]
 }
 
-pub(super) async fn clear_rules_for_binary(binary: &str) -> Result<bool, String> {
+pub(super) async fn clear_rules_for_binary(
+    binary: &str,
+    namespace: &SynLimitNamespace,
+) -> Result<bool, String> {
     let mut errors = Vec::new();
     let mut removed = false;
+    let chain = namespace.iptables_chain.as_str();
     for _ in 0..8 {
-        match run_command(
-            binary,
-            &["-t", "filter", "-D", "INPUT", "-j", IPTABLES_CHAIN],
-            None,
-        )
-        .await
-        {
+        match run_command(binary, &["-t", "filter", "-D", "INPUT", "-j", chain], None).await {
             Ok(()) => {
                 removed = true;
             }
@@ -247,7 +267,7 @@ pub(super) async fn clear_rules_for_binary(binary: &str) -> Result<bool, String>
             }
         }
     }
-    match run_command(binary, &["-t", "filter", "-F", IPTABLES_CHAIN], None).await {
+    match run_command(binary, &["-t", "filter", "-F", chain], None).await {
         Ok(()) => {
             removed = true;
         }
@@ -256,7 +276,7 @@ pub(super) async fn clear_rules_for_binary(binary: &str) -> Result<bool, String>
             errors.push(format!("{binary} flush chain failed: {error}"));
         }
     }
-    match run_command(binary, &["-t", "filter", "-X", IPTABLES_CHAIN], None).await {
+    match run_command(binary, &["-t", "filter", "-X", chain], None).await {
         Ok(()) => {
             removed = true;
         }
@@ -292,12 +312,26 @@ mod tests {
             .any(|pair| pair[0].as_str() == key && pair[1].as_str() == value)
     }
 
+    fn has_key(args: &[String], key: &str) -> bool {
+        args.iter().any(|arg| arg == key)
+    }
+
+    fn test_namespace() -> SynLimitNamespace {
+        SynLimitNamespace {
+            nft_table: "telemt_synlimit_test".to_string(),
+            iptables_chain: "TMT_SYN_TEST".to_string(),
+            iptables_hashlimit_prefix: "TMTTEST".to_string(),
+        }
+    }
+
     #[test]
     fn iptables_rules_use_synfix_order_and_rejects() {
         let target = test_rule(Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 7))), 443);
-        let rules = iptables_synfix_rule_args(&target, 0, IpTablesFamily::V4);
+        let namespace = test_namespace();
+        let rules = iptables_synfix_rule_args(&target, 0, IpTablesFamily::V4, &namespace);
 
         assert_eq!(rules.len(), 4);
+        assert!(has_pair(&rules[0], "-A", "TMT_SYN_TEST"));
         assert!(has_pair(&rules[0], "--length", "64"));
         assert!(has_pair(&rules[0], "--ttl-lt", "65"));
         assert!(has_pair(&rules[0], "--hashlimit-upto", "12/second"));
@@ -314,10 +348,42 @@ mod tests {
     #[test]
     fn ip6tables_rules_use_ipv6_hoplimit_classifier() {
         let target = test_rule(Some(IpAddr::V6(Ipv6Addr::LOCALHOST)), 443);
-        let rules = iptables_synfix_rule_args(&target, 0, IpTablesFamily::V6);
+        let namespace = test_namespace();
+        let rules = iptables_synfix_rule_args(&target, 0, IpTablesFamily::V6, &namespace);
 
         assert!(has_pair(&rules[0], "--length", "84"));
         assert!(has_pair(&rules[0], "--hl-lt", "65"));
         assert!(has_pair(&rules[0], "-d", "::1"));
     }
+
+    #[test]
+    fn iptables_missing_rule_errors_are_cleanup_benign() {
+        assert!(is_missing_command_or_iptables_rule(
+            "iptables is not available"
+        ));
+        assert!(is_missing_command_or_iptables_rule(
+            "iptables: No chain/target/match by that name."
+        ));
+        assert!(is_missing_command_or_iptables_rule(
+            "iptables: Chain TELEMT_SYNLIMIT does not exist."
+        ));
+        assert!(is_missing_command_or_iptables_rule(
+            "Couldn't load target `TELEMT_SYNLIMIT': No such file or directory"
+        ));
+        assert!(!is_missing_command_or_iptables_rule(
+            "iptables: Permission denied"
+        ));
+    }
+
+    #[test]
+    fn iptables_wildcard_rule_omits_destination_match() {
+        let target = test_rule(None, 443);
+        let namespace = test_namespace();
+        let rules = iptables_synfix_rule_args(&target, 0, IpTablesFamily::V4, &namespace);
+
+        for rule in rules {
+            assert!(!has_key(&rule, "-d"));
+            assert!(has_pair(&rule, "--dport", "443"));
+        }
+    }
 }

src/synlimit_control/mod.rs

@@ -1,4 +1,4 @@
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 
 use tokio::sync::watch;
 use tracing::warn;
@@ -11,7 +11,9 @@ mod model;
 mod nftables;
 
 use self::command::has_cap_net_admin;
-use self::model::synlimit_targets;
+use self::model::{SynLimitNamespace, synlimit_namespace, synlimit_targets};
+
+static ACTIVE_SYNLIMIT_NAMESPACE: Mutex<Option<SynLimitNamespace>> = Mutex::new(None);
 
 pub(crate) fn spawn_synlimit_controller(config_rx: watch::Receiver<Arc<ProxyConfig>>) {
     if !cfg!(target_os = "linux") {
@@ -39,7 +41,34 @@ async fn wait_for_config_channel_close_and_reconcile(
 }
 
 pub(crate) async fn reconcile_synlimit_rules(cfg: &ProxyConfig) {
-    match clear_synlimit_rules_all_backends().await {
+    let targets = synlimit_targets(cfg);
+    let namespace = synlimit_namespace(&targets);
+    if let Some(previous_namespace) = set_active_synlimit_namespace(namespace.clone()) {
+        match clear_synlimit_rules_for_namespace(&previous_namespace).await {
+            Ok(true) => {
+                warn!("Removed previous SYN limiter namespace before reconcile");
+            }
+            Ok(false) => {}
+            Err(error) => {
+                warn!(error = %error, "Failed to clear previous SYN limiter namespace before reconcile");
+            }
+        }
+    }
+
+    if targets.is_empty() {
+        return;
+    }
+    let Some(namespace) = namespace else {
+        return;
+    };
+    if !has_cap_net_admin() {
+        warn!(
+            "SYN limiter configured but CAP_NET_ADMIN is not available; netfilter rules not applied"
+        );
+        return;
+    }
+
+    match clear_synlimit_rules_for_namespace(&namespace).await {
         Ok(true) => {
             warn!("Removed stale SYN limiter rules left by a previous run before reconcile");
         }
@@ -49,37 +78,33 @@ pub(crate) async fn reconcile_synlimit_rules(cfg: &ProxyConfig) {
         }
     }
 
-    let targets = synlimit_targets(cfg);
-    if targets.is_empty() {
-        return;
-    }
-    if !has_cap_net_admin() {
-        warn!(
-            "SYN limiter configured but CAP_NET_ADMIN is not available; netfilter rules not applied"
-        );
-        return;
-    }
-
     if targets.has_iptables_targets()
-        && let Err(error) = iptables::apply_synlimit_rules(&targets).await
+        && let Err(error) = iptables::apply_synlimit_rules(&targets, &namespace).await
     {
         warn!(error = %error, "Failed to apply iptables SYN limiter rules");
     }
     if targets.has_nft_targets()
-        && let Err(error) = nftables::apply_synlimit_rules(&targets).await
+        && let Err(error) = nftables::apply_synlimit_rules(&targets, &namespace).await
     {
         warn!(error = %error, "Failed to apply nftables SYN limiter rules");
     }
 }
 
 pub(crate) async fn clear_synlimit_rules_all_backends() -> Result<bool, String> {
+    let Some(namespace) = take_active_synlimit_namespace() else {
+        return Ok(false);
+    };
+    clear_synlimit_rules_for_namespace(&namespace).await
+}
+
+async fn clear_synlimit_rules_for_namespace(namespace: &SynLimitNamespace) -> Result<bool, String> {
     if !has_cap_net_admin() {
         return Ok(false);
     }
 
     let mut errors = Vec::new();
     let mut removed = false;
-    match nftables::clear_rules_all_families().await {
+    match nftables::clear_rules_all_families(namespace).await {
         Ok(value) => {
             removed |= value;
         }
@@ -87,7 +112,7 @@ pub(crate) async fn clear_synlimit_rules_all_backends() -> Result<bool, String>
             errors.push(error);
         }
     }
-    match iptables::clear_rules_for_binary("iptables").await {
+    match iptables::clear_rules_for_binary("iptables", namespace).await {
         Ok(value) => {
             removed |= value;
         }
@@ -95,7 +120,7 @@ pub(crate) async fn clear_synlimit_rules_all_backends() -> Result<bool, String>
             errors.push(error);
         }
     }
-    match iptables::clear_rules_for_binary("ip6tables").await {
+    match iptables::clear_rules_for_binary("ip6tables", namespace).await {
         Ok(value) => {
             removed |= value;
         }
@@ -111,6 +136,32 @@ pub(crate) async fn clear_synlimit_rules_all_backends() -> Result<bool, String>
     }
 }
 
+fn set_active_synlimit_namespace(next: Option<SynLimitNamespace>) -> Option<SynLimitNamespace> {
+    match ACTIVE_SYNLIMIT_NAMESPACE.lock() {
+        Ok(mut active) => {
+            if *active == next {
+                None
+            } else {
+                std::mem::replace(&mut *active, next)
+            }
+        }
+        Err(error) => {
+            warn!(error = %error, "Failed to update active SYN limiter namespace");
+            None
+        }
+    }
+}
+
+fn take_active_synlimit_namespace() -> Option<SynLimitNamespace> {
+    match ACTIVE_SYNLIMIT_NAMESPACE.lock() {
+        Ok(mut active) => active.take(),
+        Err(error) => {
+            warn!(error = %error, "Failed to read active SYN limiter namespace");
+            None
+        }
+    }
+}
+
 fn has_synlimit_config(cfg: &ProxyConfig) -> bool {
     cfg.server
         .listeners

src/synlimit_control/model.rs

@@ -17,6 +17,13 @@ pub(super) struct SynLimitRule {
     pub(super) hashlimit_size: u32,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) struct SynLimitNamespace {
+    pub(super) nft_table: String,
+    pub(super) iptables_chain: String,
+    pub(super) iptables_hashlimit_prefix: String,
+}
+
 #[derive(Default)]
 pub(super) struct SynLimitTargets {
     pub(super) iptables_v4: Vec<SynLimitRule>,
@@ -42,6 +49,44 @@ impl SynLimitTargets {
     }
 }
 
+struct SynLimitNamespaceHasher {
+    value: u64,
+}
+
+impl SynLimitNamespaceHasher {
+    const OFFSET: u64 = 0xcbf2_9ce4_8422_2325;
+    const PRIME: u64 = 0x0000_0100_0000_01b3;
+
+    fn new() -> Self {
+        Self {
+            value: Self::OFFSET,
+        }
+    }
+
+    fn write(&mut self, bytes: &[u8]) {
+        for byte in bytes {
+            self.value ^= u64::from(*byte);
+            self.value = self.value.wrapping_mul(Self::PRIME);
+        }
+    }
+
+    fn write_u8(&mut self, value: u8) {
+        self.write(&[value]);
+    }
+
+    fn write_u16(&mut self, value: u16) {
+        self.write(&value.to_le_bytes());
+    }
+
+    fn write_u32(&mut self, value: u32) {
+        self.write(&value.to_le_bytes());
+    }
+
+    fn finish(self) -> u64 {
+        self.value
+    }
+}
+
 pub(super) fn synlimit_targets(cfg: &ProxyConfig) -> SynLimitTargets {
     let mut iptables_v4 = BTreeSet::new();
     let mut iptables_v6 = BTreeSet::new();
@@ -91,6 +136,64 @@ pub(super) fn synlimit_targets(cfg: &ProxyConfig) -> SynLimitTargets {
     }
 }
 
+pub(super) fn synlimit_namespace(targets: &SynLimitTargets) -> Option<SynLimitNamespace> {
+    if targets.is_empty() {
+        return None;
+    }
+
+    let mut hasher = SynLimitNamespaceHasher::new();
+    write_namespace_rule_group(&mut hasher, b"iptables-v4", &targets.iptables_v4);
+    write_namespace_rule_group(&mut hasher, b"iptables-v6", &targets.iptables_v6);
+    write_namespace_rule_group(&mut hasher, b"nft-v4", &targets.nft_v4);
+    write_namespace_rule_group(&mut hasher, b"nft-v6", &targets.nft_v6);
+
+    let suffix = format!("{:016x}", hasher.finish());
+    let iptables_suffix = &suffix[..12];
+    let hashlimit_suffix = &suffix[..10];
+    Some(SynLimitNamespace {
+        nft_table: format!("telemt_synlimit_{suffix}"),
+        iptables_chain: format!("TMT_SYN_{iptables_suffix}"),
+        iptables_hashlimit_prefix: format!("TMT{hashlimit_suffix}"),
+    })
+}
+
+fn write_namespace_rule_group(
+    hasher: &mut SynLimitNamespaceHasher,
+    group: &[u8],
+    rules: &[SynLimitRule],
+) {
+    hasher.write(group);
+    hasher.write_u32(rules.len() as u32);
+    for rule in rules {
+        write_namespace_rule(hasher, rule);
+    }
+}
+
+fn write_namespace_rule(hasher: &mut SynLimitNamespaceHasher, rule: &SynLimitRule) {
+    match rule.ip {
+        Some(IpAddr::V4(ip)) => {
+            hasher.write_u8(4);
+            hasher.write(&ip.octets());
+        }
+        Some(IpAddr::V6(ip)) => {
+            hasher.write_u8(6);
+            hasher.write(&ip.octets());
+        }
+        None => {
+            hasher.write_u8(0);
+        }
+    }
+    hasher.write_u16(rule.port);
+    hasher.write_u32(rule.generic_seconds);
+    hasher.write_u32(rule.generic_hitcount);
+    hasher.write_u32(rule.generic_burst);
+    hasher.write_u32(rule.ios_seconds);
+    hasher.write_u32(rule.ios_hitcount);
+    hasher.write_u32(rule.ios_burst);
+    hasher.write_u32(rule.hashlimit_expire_ms);
+    hasher.write_u32(rule.hashlimit_size);
+}
+
 pub(super) fn synlimit_rate_arg(seconds: u32, hitcount: u32) -> String {
     let seconds = u64::from(seconds.max(1));
     let hitcount = u64::from(hitcount.max(1));
@@ -124,3 +227,139 @@ pub(super) fn test_rule(ip: Option<IpAddr>, port: u16) -> SynLimitRule {
         hashlimit_size: 32_768,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+    use super::*;
+    use crate::config::ListenerConfig;
+
+    fn listener(ip: IpAddr, port: Option<u16>, synlimit: SynLimitMode) -> ListenerConfig {
+        ListenerConfig {
+            ip,
+            port,
+            client_mss: None,
+            synlimit,
+            synlimit_seconds: 60,
+            synlimit_hitcount: 48,
+            synlimit_burst: 1,
+            synlimit_ios_seconds: 1,
+            synlimit_ios_hitcount: 12,
+            synlimit_ios_burst: 24,
+            synlimit_hashlimit_expire_ms: 60_000,
+            synlimit_hashlimit_size: 32_768,
+            announce: None,
+            announce_ip: None,
+            proxy_protocol: None,
+            reuse_allow: false,
+        }
+    }
+
+    #[test]
+    fn synlimit_targets_deduplicate_and_use_legacy_port_fallback() {
+        let mut cfg = ProxyConfig::default();
+        cfg.server.port = 9443;
+        cfg.server.listeners = vec![
+            listener(
+                IpAddr::V4(Ipv4Addr::UNSPECIFIED),
+                None,
+                SynLimitMode::Iptables,
+            ),
+            listener(
+                IpAddr::V4(Ipv4Addr::UNSPECIFIED),
+                None,
+                SynLimitMode::Iptables,
+            ),
+        ];
+
+        let targets = synlimit_targets(&cfg);
+
+        assert_eq!(targets.iptables_v4.len(), 1);
+        assert_eq!(targets.iptables_v4[0].ip, None);
+        assert_eq!(targets.iptables_v4[0].port, 9443);
+        assert!(targets.iptables_v6.is_empty());
+        assert!(targets.nft_v4.is_empty());
+        assert!(targets.nft_v6.is_empty());
+    }
+
+    #[test]
+    fn synlimit_targets_separate_backends_and_ip_families() {
+        let mut cfg = ProxyConfig::default();
+        cfg.server.listeners = vec![
+            listener(
+                IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1)),
+                Some(443),
+                SynLimitMode::Iptables,
+            ),
+            listener(
+                IpAddr::V6(Ipv6Addr::LOCALHOST),
+                Some(443),
+                SynLimitMode::Iptables,
+            ),
+            listener(
+                IpAddr::V4(Ipv4Addr::new(203, 0, 113, 2)),
+                Some(444),
+                SynLimitMode::Nftables,
+            ),
+            listener(
+                IpAddr::V6(Ipv6Addr::UNSPECIFIED),
+                Some(444),
+                SynLimitMode::Nftables,
+            ),
+        ];
+
+        let targets = synlimit_targets(&cfg);
+
+        assert_eq!(targets.iptables_v4.len(), 1);
+        assert_eq!(targets.iptables_v6.len(), 1);
+        assert_eq!(targets.nft_v4.len(), 1);
+        assert_eq!(targets.nft_v6.len(), 1);
+        assert_eq!(
+            targets.iptables_v4[0].ip,
+            Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1)))
+        );
+        assert_eq!(
+            targets.iptables_v6[0].ip,
+            Some(IpAddr::V6(Ipv6Addr::LOCALHOST))
+        );
+        assert_eq!(
+            targets.nft_v4[0].ip,
+            Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 2)))
+        );
+        assert_eq!(targets.nft_v6[0].ip, None);
+    }
+
+    #[test]
+    fn synlimit_namespace_is_stable_and_changes_by_targets() {
+        let mut cfg = ProxyConfig::default();
+        cfg.server.listeners = vec![listener(
+            IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1)),
+            Some(443),
+            SynLimitMode::Nftables,
+        )];
+        let first = synlimit_namespace(&synlimit_targets(&cfg))
+            .expect("configured targets must have a namespace");
+        let second = synlimit_namespace(&synlimit_targets(&cfg))
+            .expect("configured targets must have a namespace");
+
+        cfg.server.listeners[0].port = Some(444);
+        let changed = synlimit_namespace(&synlimit_targets(&cfg))
+            .expect("configured targets must have a namespace");
+
+        assert_eq!(first, second);
+        assert_ne!(first, changed);
+        assert!(first.nft_table.starts_with("telemt_synlimit_"));
+        assert!(first.iptables_chain.starts_with("TMT_SYN_"));
+        assert!(first.iptables_chain.len() <= 28);
+        assert!(first.iptables_hashlimit_prefix.starts_with("TMT"));
+    }
+
+    #[test]
+    fn synlimit_rate_arg_uses_native_units_without_fractional_rates() {
+        assert_eq!(synlimit_rate_arg(1, 12), "12/second");
+        assert_eq!(synlimit_rate_arg(60, 48), "48/minute");
+        assert_eq!(synlimit_rate_arg(3600, 121), "121/hour");
+        assert_eq!(synlimit_rate_arg(86400, 241), "241/day");
+    }
+}

src/synlimit_control/nftables.rs

@@ -1,7 +1,6 @@
 use super::command::{run_command, run_command_stdout};
-use super::model::{SynLimitRule, SynLimitTargets, synlimit_rate_arg};
+use super::model::{SynLimitNamespace, SynLimitRule, SynLimitTargets, synlimit_rate_arg};
 
-const NFT_TABLE: &str = "telemt_synlimit";
 const NFT_CHAIN: &str = "input";
 const NFT_INPUT_PRIORITY: i16 = -5;
 const IPV4_IOS_PACKET_LENGTH: u16 = 64;
@@ -38,10 +37,13 @@ impl NftFamily {
     }
 }
 
-pub(super) async fn apply_synlimit_rules(targets: &SynLimitTargets) -> Result<(), String> {
+pub(super) async fn apply_synlimit_rules(
+    targets: &SynLimitTargets,
+    namespace: &SynLimitNamespace,
+) -> Result<(), String> {
     let families = detect_nft_table_families().await;
     for plan in nft_apply_plan(families, &targets.nft_v4, &targets.nft_v6) {
-        let script = nft_synlimit_script(plan);
+        let script = nft_synlimit_script(plan, namespace);
         run_command("nft", &["-f", "-"], Some(script)).await?;
     }
 
@@ -114,9 +116,13 @@ fn nft_apply_plan<'a>(
     Vec::new()
 }
 
-fn nft_synlimit_script(plan: NftApplyPlan<'_>) -> String {
+fn nft_synlimit_script(plan: NftApplyPlan<'_>, namespace: &SynLimitNamespace) -> String {
     let mut script = String::new();
-    script.push_str(&format!("table {} {NFT_TABLE} {{\n", plan.family.as_str()));
+    script.push_str(&format!(
+        "table {} {} {{\n",
+        plan.family.as_str(),
+        namespace.nft_table
+    ));
     script.push_str(&format!("  chain {NFT_CHAIN} {{\n"));
     script.push_str(&format!(
         "    type filter hook input priority {NFT_INPUT_PRIORITY}; policy accept;\n"
@@ -186,25 +192,22 @@ fn push_nft_v6_rules(script: &mut String, target: &SynLimitRule, idx: usize) {
     ));
 }
 
-pub(super) async fn clear_rules_all_families() -> Result<bool, String> {
+pub(super) async fn clear_rules_all_families(
+    namespace: &SynLimitNamespace,
+) -> Result<bool, String> {
     let mut errors = Vec::new();
     let mut removed = false;
+    let table = namespace.nft_table.as_str();
     for family in [NftFamily::Inet, NftFamily::Ip, NftFamily::Ip6] {
-        match run_command(
-            "nft",
-            &["delete", "table", family.as_str(), NFT_TABLE],
-            None,
-        )
-        .await
-        {
+        match run_command("nft", &["delete", "table", family.as_str(), table], None).await {
             Ok(()) => {
                 removed = true;
             }
             Err(error) if is_missing_command_or_nft_table(&error) => {}
             Err(error) => {
                 errors.push(format!(
-                    "nft delete table {} {NFT_TABLE} failed: {error}",
-                    family.as_str()
+                    "nft delete table {} {table} failed: {error}",
+                    family.as_str(),
                 ));
             }
         }
@@ -228,15 +231,28 @@ mod tests {
     use super::*;
     use crate::synlimit_control::model::test_rule;
 
+    fn test_namespace(table: &str) -> SynLimitNamespace {
+        SynLimitNamespace {
+            nft_table: table.to_string(),
+            iptables_chain: "TMT_SYN_TEST".to_string(),
+            iptables_hashlimit_prefix: "TMTTEST".to_string(),
+        }
+    }
+
     #[test]
     fn nft_script_uses_synfix_v4_rules_and_early_priority() {
         let rule = test_rule(Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 7))), 443);
-        let script = nft_synlimit_script(NftApplyPlan {
-            family: NftFamily::Inet,
-            v4_targets: &[rule],
-            v6_targets: &[],
-        });
+        let namespace = test_namespace("telemt_synlimit_test_a");
+        let script = nft_synlimit_script(
+            NftApplyPlan {
+                family: NftFamily::Inet,
+                v4_targets: &[rule],
+                v6_targets: &[],
+            },
+            &namespace,
+        );
 
+        assert!(script.contains("table inet telemt_synlimit_test_a"));
         assert!(script.contains("type filter hook input priority -5; policy accept;"));
         assert!(script.contains("ip daddr 203.0.113.7"));
         assert!(script.contains("meta length 64 ip ttl < 65"));
@@ -248,15 +264,53 @@ mod tests {
     #[test]
     fn nft_script_uses_ipv6_hoplimit_classifier() {
         let rule = test_rule(Some(IpAddr::V6(Ipv6Addr::LOCALHOST)), 443);
-        let script = nft_synlimit_script(NftApplyPlan {
-            family: NftFamily::Inet,
-            v4_targets: &[],
-            v6_targets: &[rule],
-        });
+        let namespace = test_namespace("telemt_synlimit_test_b");
+        let script = nft_synlimit_script(
+            NftApplyPlan {
+                family: NftFamily::Inet,
+                v4_targets: &[],
+                v6_targets: &[rule],
+            },
+            &namespace,
+        );
 
+        assert!(script.contains("table inet telemt_synlimit_test_b"));
         assert!(script.contains("ip6 daddr ::1"));
         assert!(script.contains("meta length 84 ip6 hoplimit < 65"));
         assert!(script.contains("ip6 saddr limit rate over 12/second burst 24 packets"));
         assert!(script.contains("ip6 saddr limit rate over 48/minute burst 1 packets"));
     }
+
+    #[test]
+    fn nft_missing_table_errors_are_cleanup_benign() {
+        assert!(is_missing_command_or_nft_table("nft is not available"));
+        assert!(is_missing_command_or_nft_table(
+            "Error: No such file or directory"
+        ));
+        assert!(!is_missing_command_or_nft_table(
+            "Error: Operation not permitted"
+        ));
+    }
+
+    #[test]
+    fn nft_apply_plan_keeps_dual_stack_rules_in_inet_table() {
+        let v4_rule = test_rule(Some(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 7))), 443);
+        let v6_rule = test_rule(Some(IpAddr::V6(Ipv6Addr::LOCALHOST)), 443);
+        let v4_rules = [v4_rule];
+        let v6_rules = [v6_rule];
+        let plans = nft_apply_plan(
+            NftTableFamilies {
+                inet: false,
+                ip: false,
+                ip6: false,
+            },
+            &v4_rules,
+            &v6_rules,
+        );
+
+        assert_eq!(plans.len(), 1);
+        assert_eq!(plans[0].family.as_str(), "inet");
+        assert_eq!(plans[0].v4_targets, v4_rules.as_slice());
+        assert_eq!(plans[0].v6_targets, v6_rules.as_slice());
+    }
 }

src/transport/middle_proxy/handshake.rs

@@ -675,8 +675,122 @@ fn hex_dump(data: &[u8]) -> String {
 mod tests {
     use super::*;
     use std::io::ErrorKind;
+    use std::net::{Ipv4Addr, Ipv6Addr};
     use tokio::net::{TcpListener, TcpStream};
 
+    fn upstream_egress(
+        route_kind: UpstreamRouteKind,
+        socks_bound_addr: Option<SocketAddr>,
+    ) -> UpstreamEgressInfo {
+        UpstreamEgressInfo {
+            upstream_id: 7,
+            route_kind,
+            local_addr: None,
+            direct_bind_ip: None,
+            socks_bound_addr,
+            socks_proxy_addr: None,
+        }
+    }
+
+    #[test]
+    fn socks_bound_addr_is_used_only_for_public_same_family_tuple() {
+        let v4_bound = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(93, 184, 216, 34)), 443);
+        let v6_bound = SocketAddr::new(
+            IpAddr::V6(
+                "2606:4700:4700::1111"
+                    .parse::<Ipv6Addr>()
+                    .expect("test IPv6 address must parse"),
+            ),
+            443,
+        );
+
+        assert_eq!(
+            MePool::select_socks_bound_addr(
+                IpFamily::V4,
+                Some(upstream_egress(UpstreamRouteKind::Socks5, Some(v4_bound)))
+            ),
+            Some(v4_bound)
+        );
+        assert_eq!(
+            MePool::select_socks_bound_addr(
+                IpFamily::V6,
+                Some(upstream_egress(UpstreamRouteKind::Socks5, Some(v6_bound)))
+            ),
+            Some(v6_bound)
+        );
+    }
+
+    #[test]
+    fn socks_bound_addr_rejects_bogon_unspecified_wrong_family_and_non_socks_routes() {
+        let bogon_bound = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(10, 0, 0, 1)), 443);
+        let unspecified_bound = SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 443);
+        let public_v4_bound = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(93, 184, 216, 34)), 443);
+
+        assert_eq!(
+            MePool::select_socks_bound_addr(
+                IpFamily::V4,
+                Some(upstream_egress(
+                    UpstreamRouteKind::Socks5,
+                    Some(bogon_bound)
+                ))
+            ),
+            None
+        );
+        assert_eq!(
+            MePool::select_socks_bound_addr(
+                IpFamily::V4,
+                Some(upstream_egress(
+                    UpstreamRouteKind::Socks5,
+                    Some(unspecified_bound)
+                ))
+            ),
+            None
+        );
+        assert_eq!(
+            MePool::select_socks_bound_addr(
+                IpFamily::V6,
+                Some(upstream_egress(
+                    UpstreamRouteKind::Socks5,
+                    Some(public_v4_bound)
+                ))
+            ),
+            None
+        );
+        assert_eq!(
+            MePool::select_socks_bound_addr(
+                IpFamily::V4,
+                Some(upstream_egress(
+                    UpstreamRouteKind::Direct,
+                    Some(public_v4_bound)
+                ))
+            ),
+            None
+        );
+    }
+
+    #[test]
+    fn kdf_client_port_source_tracks_only_valid_socks_bound_port() {
+        let bound = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(93, 184, 216, 34)), 443);
+        let zero_port_bound = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(93, 184, 216, 34)), 0);
+
+        assert_eq!(
+            KdfClientPortSource::from_socks_bound_port(Some(bound.port())),
+            KdfClientPortSource::SocksBound
+        );
+        assert_eq!(
+            KdfClientPortSource::from_socks_bound_port(
+                Some(zero_port_bound)
+                    .filter(|addr| addr.port() != 0)
+                    .map(|addr| addr.port())
+            ),
+            KdfClientPortSource::LocalSocket
+        );
+        assert_eq!(
+            KdfClientPortSource::from_socks_bound_port(None),
+            KdfClientPortSource::LocalSocket
+        );
+    }
+
     #[tokio::test]
     async fn test_configure_keepalive_loopback() {
         let listener = match TcpListener::bind("127.0.0.1:0").await {

src/transport/middle_proxy/tests/send_adversarial_tests.rs

@@ -368,3 +368,63 @@ async fn send_proxy_req_uses_writer_source_ip_when_advertised_our_addr_differs()
         SocketAddr::new(IpAddr::V4(Ipv4Addr::new(203, 0, 113, 31)), our_addr.port())
     );
 }
+
+#[tokio::test]
+async fn send_proxy_req_blocking_fallback_uses_writer_source_ip() {
+    let (pool, _rng) = make_pool().await;
+    pool.rr.store(0, Ordering::Relaxed);
+
+    let (conn_id, _rx) = pool.registry.register().await;
+    let mut live_rx = insert_writer(
+        &pool,
+        32,
+        2,
+        SocketAddr::new(IpAddr::V4(Ipv4Addr::new(127, 0, 2, 32)), 443),
+        true,
+    )
+    .await;
+    let source_ip = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 32));
+
+    let tx = {
+        let mut writers = pool.writers.write().await;
+        let writer = writers
+            .iter_mut()
+            .find(|writer| writer.id == 32)
+            .expect("test writer must exist");
+        writer.source_ip = source_ip;
+        writer.tx.clone()
+    };
+    for _ in 0..8 {
+        tx.try_send(WriterCommand::Close)
+            .expect("test writer channel must accept preload");
+    }
+
+    let our_addr = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(198, 51, 100, 8)), 9443);
+    let pool_for_send = pool.clone();
+    let send_task = tokio::spawn(async move {
+        pool_for_send
+            .send_proxy_req(
+                conn_id,
+                2,
+                SocketAddr::new(IpAddr::V4(Ipv4Addr::new(10, 0, 0, 8)), 30003),
+                our_addr,
+                b"blocking",
+                0,
+                None,
+            )
+            .await
+    });
+
+    tokio::time::sleep(Duration::from_millis(10)).await;
+    assert!(matches!(live_rx.recv().await, Some(WriterCommand::Close)));
+
+    let result = send_task.await.expect("send task must not panic");
+    assert!(result.is_ok());
+    let payload = recv_first_data_payload(&mut live_rx, Duration::from_millis(50))
+        .await
+        .expect("writer must receive blocking fallback payload");
+    assert_eq!(
+        proxy_req_our_addr_from_payload(&payload),
+        SocketAddr::new(source_ip, our_addr.port())
+    );
+}