mirror of
https://github.com/telemt/telemt.git
synced 2026-05-17 08:26:39 +03:00
91be148b72
This commit introduces a comprehensive set of improvements to enhance the security, reliability, and configurability of the proxy server, specifically targeting adversarial resilience and high-load concurrency. Security & Cryptography: - Zeroize MTProto cryptographic key material (`dec_key`, `enc_key`) immediately after use to prevent memory leakage on early returns. - Move TLS handshake replay tracking after full policy/ALPN validation to prevent cache poisoning by unauthenticated probes. - Add `proxy_protocol_trusted_cidrs` configuration to restrict PROXY protocol headers to trusted networks, rejecting spoofed IPs. Adversarial Resilience & DoS Mitigation: - Implement "Tiny Frame Debt" tracking in the middle-relay to prevent CPU exhaustion from malicious 0-byte or 1-byte frame floods. - Add `mask_relay_max_bytes` to strictly bound unauthenticated fallback connections, preventing the proxy from being abused as an open relay. - Add a 5ms prefetch window (`mask_classifier_prefetch_timeout_ms`) to correctly assemble and classify fragmented HTTP/1.1 and HTTP/2 probes (e.g., `PRI * HTTP/2.0`) before routing them to masking heuristics. - Prevent recursive masking loops (FD exhaustion) by verifying the mask target is not the proxy's own listener via local interface enumeration. Concurrency & Reliability: - Eliminate executor waker storms during quota lock contention by replacing the spin-waker task with inline `Sleep` and exponential backoff. - Roll back user quota reservations (`rollback_me2c_quota_reservation`) if a network write fails, preventing Head-of-Line (HoL) blocking from permanently burning data quotas. - Recover gracefully from idle-registry `Mutex` poisoning instead of panicking, ensuring isolated thread failures do not break the proxy. - Fix `auth_probe_scan_start_offset` modulo logic to ensure bounds safety. Testing: - Add extensive adversarial, timing, fuzzing, and invariant test suites for both the client and handshake modules.
87 lines
1.9 KiB
TOML
87 lines
1.9 KiB
TOML
[package]
|
|
name = "telemt"
|
|
version = "3.3.30"
|
|
edition = "2024"
|
|
|
|
[features]
|
|
redteam_offline_expected_fail = []
|
|
|
|
[dependencies]
|
|
# C
|
|
libc = "0.2"
|
|
|
|
# Async runtime
|
|
tokio = { version = "1.42", features = ["full", "tracing"] }
|
|
tokio-util = { version = "0.7", features = ["full"] }
|
|
|
|
# Crypto
|
|
aes = "0.8"
|
|
ctr = "0.9"
|
|
cbc = "0.1"
|
|
sha2 = "0.10"
|
|
sha1 = "0.10"
|
|
md-5 = "0.10"
|
|
hmac = "0.12"
|
|
crc32fast = "1.4"
|
|
crc32c = "0.6"
|
|
zeroize = { version = "1.8", features = ["derive"] }
|
|
subtle = "2.6"
|
|
static_assertions = "1.1"
|
|
|
|
# Network
|
|
socket2 = { version = "0.6", features = ["all"] }
|
|
nix = { version = "0.31", default-features = false, features = ["net", "fs"] }
|
|
shadowsocks = { version = "1.24", features = ["aead-cipher-2022"] }
|
|
|
|
# Serialization
|
|
serde = { version = "1.0", features = ["derive"] }
|
|
serde_json = "1.0"
|
|
toml = "1.0"
|
|
x509-parser = "0.18"
|
|
|
|
# Utils
|
|
bytes = "1.9"
|
|
thiserror = "2.0"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
parking_lot = "0.12"
|
|
dashmap = "6.1"
|
|
arc-swap = "1.7"
|
|
lru = "0.16"
|
|
rand = "0.10"
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
hex = "0.4"
|
|
base64 = "0.22"
|
|
url = "2.5"
|
|
regex = "1.11"
|
|
crossbeam-queue = "0.3"
|
|
num-bigint = "0.4"
|
|
num-traits = "0.2"
|
|
x25519-dalek = "2"
|
|
anyhow = "1.0"
|
|
|
|
# HTTP
|
|
reqwest = { version = "0.13", features = ["rustls"], default-features = false }
|
|
notify = "8.2"
|
|
ipnetwork = { version = "0.21", features = ["serde"] }
|
|
hyper = { version = "1", features = ["server", "http1"] }
|
|
hyper-util = { version = "0.1", features = ["tokio", "server-auto"] }
|
|
http-body-util = "0.1"
|
|
httpdate = "1.0"
|
|
tokio-rustls = { version = "0.26", default-features = false, features = ["tls12"] }
|
|
rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "ring"] }
|
|
webpki-roots = "1.0"
|
|
|
|
[dev-dependencies]
|
|
tokio-test = "0.4"
|
|
criterion = "0.8"
|
|
proptest = "1.4"
|
|
futures = "0.3"
|
|
|
|
[[bench]]
|
|
name = "crypto_bench"
|
|
harness = false
|
|
|
|
[profile.release]
|
|
lto = "thin"
|