mirror of
https://github.com/ScuroNeko/mtg.git
synced 2026-08-31 21:34:02 +03:00
Update docs
This commit is contained in:
+8
-8
@@ -1,17 +1,17 @@
|
|||||||
// Antireplay package has cache implementations that are effective
|
// Antireplay package has cache implementations that are effective against
|
||||||
// against replay attacks.
|
// replay attacks.
|
||||||
//
|
//
|
||||||
// To understand more about replay attacks, please read documentation
|
// To understand more about replay attacks, please read documentation for
|
||||||
// for mtglib.AntiReplayCache interface. This package has a list of some
|
// [mtglib.AntiReplayCache] interface. This package has a list of some
|
||||||
// implementations of this interface.
|
// implementations of this interface.
|
||||||
package antireplay
|
package antireplay
|
||||||
|
|
||||||
const (
|
const (
|
||||||
// DefaultStableBloomFilterMaxSize is a recommended byte size for a
|
// DefaultStableBloomFilterMaxSize is a recommended byte size for a stable
|
||||||
// stable bloom filter.
|
// bloom filter.
|
||||||
DefaultStableBloomFilterMaxSize = 1024 * 1024 // 1MiB
|
DefaultStableBloomFilterMaxSize = 1024 * 1024 // 1MiB
|
||||||
|
|
||||||
// DefaultStableBloomFilterErrorRate is a recommended default error
|
// DefaultStableBloomFilterErrorRate is a recommended default error rate for a
|
||||||
// rate for a stable bloom filter.
|
// stable bloom filter.
|
||||||
DefaultStableBloomFilterErrorRate = 0.001
|
DefaultStableBloomFilterErrorRate = 0.001
|
||||||
)
|
)
|
||||||
|
|||||||
+2
-3
@@ -6,9 +6,8 @@ type noop struct{}
|
|||||||
|
|
||||||
func (n noop) SeenBefore(_ []byte) bool { return false }
|
func (n noop) SeenBefore(_ []byte) bool { return false }
|
||||||
|
|
||||||
// NewNoop returns an implementation that does nothing. A corresponding
|
// NewNoop returns an implementation that does nothing. A corresponding method
|
||||||
// method always returns false, so this cache accepts everything you
|
// always returns false, so this cache accepts everything you pass to it.
|
||||||
// pass to it.
|
|
||||||
func NewNoop() mtglib.AntiReplayCache {
|
func NewNoop() mtglib.AntiReplayCache {
|
||||||
return noop{}
|
return noop{}
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -20,19 +20,19 @@ func (s *stableBloomFilter) SeenBefore(digest []byte) bool {
|
|||||||
return s.filter.TestAndAdd(digest)
|
return s.filter.TestAndAdd(digest)
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewStableBloomFilter returns an implementation of AntiReplayCache
|
// NewStableBloomFilter returns an implementation of AntiReplayCache based on
|
||||||
// based on stable bloom filter.
|
// stable bloom filter.
|
||||||
//
|
//
|
||||||
// http://webdocs.cs.ualberta.ca/~drafiei/papers/DupDet06Sigmod.pdf
|
// http://webdocs.cs.ualberta.ca/~drafiei/papers/DupDet06Sigmod.pdf
|
||||||
//
|
//
|
||||||
// The basic idea of a stable bloom filter is quite simple: each time
|
// The basic idea of a stable bloom filter is quite simple: each time when you
|
||||||
// when you set a new element, you randomly reset P elements. There is a
|
// set a new element, you randomly reset P elements. There is a hardcore math
|
||||||
// hardcore math which proves that if you choose this P correctly, you
|
// which proves that if you choose this P correctly, you can maintain the same
|
||||||
// can maintain the same error rate for a stream of elements.
|
// error rate for a stream of elements.
|
||||||
//
|
//
|
||||||
// byteSize is the number of bytes you want to give to a bloom filter.
|
// byteSize is the number of bytes you want to give to a bloom filter.
|
||||||
// errorRate is desired false-positive error rate. If you want to use
|
// errorRate is desired false-positive error rate. If you want to use default
|
||||||
// default values, please pass 0 for byteSize and <0 for errorRate.
|
// values, please pass 0 for byteSize and <0 for errorRate.
|
||||||
func NewStableBloomFilter(byteSize uint, errorRate float64) mtglib.AntiReplayCache {
|
func NewStableBloomFilter(byteSize uint, errorRate float64) mtglib.AntiReplayCache {
|
||||||
if byteSize == 0 {
|
if byteSize == 0 {
|
||||||
byteSize = DefaultStableBloomFilterMaxSize
|
byteSize = DefaultStableBloomFilterMaxSize
|
||||||
|
|||||||
+3
-3
@@ -5,19 +5,19 @@ import (
|
|||||||
"net"
|
"net"
|
||||||
)
|
)
|
||||||
|
|
||||||
// CloseableReader is a reader interface that can close its reading end.
|
// CloseableReader is an [io.Reader] interface that can close its reading end.
|
||||||
type CloseableReader interface {
|
type CloseableReader interface {
|
||||||
io.Reader
|
io.Reader
|
||||||
CloseRead() error
|
CloseRead() error
|
||||||
}
|
}
|
||||||
|
|
||||||
// CloseableWriter is a writer that can close its writing end.
|
// CloseableWriter is an [io.Writer] that can close its writing end.
|
||||||
type CloseableWriter interface {
|
type CloseableWriter interface {
|
||||||
io.Writer
|
io.Writer
|
||||||
CloseWrite() error
|
CloseWrite() error
|
||||||
}
|
}
|
||||||
|
|
||||||
// Conn is an extension of net.Conn that can close its ends. This mostly
|
// Conn is an extension of [net.Conn] that can close its ends. This mostly
|
||||||
// implies TCP connections.
|
// implies TCP connections.
|
||||||
type Conn interface {
|
type Conn interface {
|
||||||
net.Conn
|
net.Conn
|
||||||
|
|||||||
@@ -9,7 +9,7 @@ import (
|
|||||||
"github.com/OneOfOne/xxhash"
|
"github.com/OneOfOne/xxhash"
|
||||||
)
|
)
|
||||||
|
|
||||||
// EventStream is a default implementation of the mtglib.EventStream
|
// EventStream is a default implementation of the [mtglib.EventStream]
|
||||||
// interface.
|
// interface.
|
||||||
//
|
//
|
||||||
// EventStream manages a set of goroutines, observers. Main
|
// EventStream manages a set of goroutines, observers. Main
|
||||||
|
|||||||
+20
-20
@@ -1,19 +1,19 @@
|
|||||||
// Events has a default implementations of EventStream for mtglib.
|
// Events has a default implementations of EventStream for mtglib.
|
||||||
//
|
//
|
||||||
// Please see documentation for mtglib.EventStream interface to get an
|
// Please see documentation for [mtglib.EventStream] interface to get an idea
|
||||||
// idea of such an abstraction. This package has implementations for the
|
// of such an abstraction. This package has implementations for the default
|
||||||
// default event stream.
|
// event stream.
|
||||||
//
|
//
|
||||||
// Default event stream has a list of its own concepts. First, all it
|
// Default event stream has a list of its own concepts. First, all it does is a
|
||||||
// does is a routing of messages to known observers. It takes an event,
|
// routing of messages to known observers. It takes an event, defines its type
|
||||||
// defines its type and pass this message to a method of the observer.
|
// and pass this message to a method of the observer.
|
||||||
//
|
//
|
||||||
// There might be many observers, but default event stream has a
|
// There might be many observers, but default event stream has a guarantee
|
||||||
// guarantee though. It uses StreamID as a sharding key and guarantees
|
// though. It uses StreamID as a sharding key and guarantees that a message
|
||||||
// that a message with the same StreamID will be devlivered to the same
|
// with the same StreamID will be devlivered to the same observer instance. So,
|
||||||
// observer instance. So, each producer is guarateed to get all relevant
|
// each producer is guarateed to get all relevant messages related to the same
|
||||||
// messages related to the same session. It is not possible that it will
|
// session. It is not possible that it will get EventFinish if it has not seen
|
||||||
// get EventFinish if it has not seen EventStart for that session yet.
|
// EventStart for that session yet.
|
||||||
package events
|
package events
|
||||||
|
|
||||||
import "github.com/9seconds/mtg/v2/mtglib"
|
import "github.com/9seconds/mtg/v2/mtglib"
|
||||||
@@ -21,10 +21,10 @@ import "github.com/9seconds/mtg/v2/mtglib"
|
|||||||
// Observer is an instance that listens for the incoming events.
|
// Observer is an instance that listens for the incoming events.
|
||||||
//
|
//
|
||||||
// As it is said in the package description, the default event stream
|
// As it is said in the package description, the default event stream
|
||||||
// guarantees that all events with the same StreamID are going to be
|
// guarantees that all events with the same StreamID are going to be routed to
|
||||||
// routed to the same instance of the observer. So, there is no need
|
// the same instance of the observer. So, there is no need to synchronize
|
||||||
// to synchronize information about streams between many observers
|
// information about streams between many observers instances, they can have
|
||||||
// instances, they can have their local storage.
|
// their local storage.
|
||||||
type Observer interface {
|
type Observer interface {
|
||||||
// EventStart reacts on incoming mtglib.EventStart event.
|
// EventStart reacts on incoming mtglib.EventStart event.
|
||||||
EventStart(mtglib.EventStart)
|
EventStart(mtglib.EventStart)
|
||||||
@@ -65,8 +65,8 @@ type Observer interface {
|
|||||||
|
|
||||||
// ObserverFactory creates a new instance of the observer.
|
// ObserverFactory creates a new instance of the observer.
|
||||||
//
|
//
|
||||||
// Default event stream creates a small set of goroutines to manage
|
// Default event stream creates a small set of goroutines to manage incoming
|
||||||
// incoming messages. Each message is routed to an appropriate observer
|
// messages. Each message is routed to an appropriate observer based on a
|
||||||
// based on a sharding key, stream id. So, it is possible that an
|
// sharding key, stream id. So, it is possible that an instance of mtg will
|
||||||
// instance of mtg will have many observer instances, not a single one.
|
// have many observer instances, not a single one.
|
||||||
type ObserverFactory func() Observer
|
type ObserverFactory func() Observer
|
||||||
|
|||||||
@@ -40,6 +40,8 @@ func (h httpFile) String() string {
|
|||||||
return h.url
|
return h.url
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// NewHTTP returns a file abstraction for HTTP/HTTPS endpoint. You also need to
|
||||||
|
// provide a valid instance of [http.Client] to access it.
|
||||||
func NewHTTP(client *http.Client, endpoint string) (File, error) {
|
func NewHTTP(client *http.Client, endpoint string) (File, error) {
|
||||||
if client == nil {
|
if client == nil {
|
||||||
return nil, ErrBadHTTPClient
|
return nil, ErrBadHTTPClient
|
||||||
|
|||||||
@@ -6,9 +6,16 @@ import (
|
|||||||
"io"
|
"io"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
// ErrBadHTTPClient is returned if given HTTP client is initialized
|
||||||
|
// incorrectly.
|
||||||
var ErrBadHTTPClient = errors.New("incorrect http client")
|
var ErrBadHTTPClient = errors.New("incorrect http client")
|
||||||
|
|
||||||
|
// File is an abstraction for a entity that can be opened in some context.
|
||||||
type File interface {
|
type File interface {
|
||||||
|
// Open returns an readable entity for a file. It is important to not forget
|
||||||
|
// to close it after the usage.
|
||||||
Open(context.Context) (io.ReadCloser, error)
|
Open(context.Context) (io.ReadCloser, error)
|
||||||
|
|
||||||
|
// String returns a short text description for the file
|
||||||
String() string
|
String() string
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -19,6 +19,7 @@ func (l localFile) String() string {
|
|||||||
return l.path
|
return l.path
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// NewLocal returns an openable File for a path on a local file system.
|
||||||
func NewLocal(path string) (File, error) {
|
func NewLocal(path string) (File, error) {
|
||||||
if stat, err := os.Stat(path); os.IsNotExist(err) || stat.IsDir() || stat.Mode().Perm()&0o400 == 0 {
|
if stat, err := os.Stat(path); os.IsNotExist(err) || stat.IsDir() || stat.Mode().Perm()&0o400 == 0 {
|
||||||
return nil, fmt.Errorf("%s is not a readable file", path)
|
return nil, fmt.Errorf("%s is not a readable file", path)
|
||||||
|
|||||||
@@ -19,6 +19,7 @@ func (m memFile) String() string {
|
|||||||
return "mem"
|
return "mem"
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// NewMem returns an openable file that is kept in RAM.
|
||||||
func NewMem(networks []*net.IPNet) File {
|
func NewMem(networks []*net.IPNet) File {
|
||||||
builder := strings.Builder{}
|
builder := strings.Builder{}
|
||||||
|
|
||||||
|
|||||||
+14
-12
@@ -27,19 +27,19 @@ var (
|
|||||||
// execute when ip list is updated.
|
// execute when ip list is updated.
|
||||||
type FireholUpdateCallback func(context.Context, int)
|
type FireholUpdateCallback func(context.Context, int)
|
||||||
|
|
||||||
// Firehol is IPBlocklist which uses lists from FireHOL:
|
// Firehol is [mtglib.IPBlocklist] which uses lists from FireHOL:
|
||||||
// https://iplists.firehol.org/
|
// https://iplists.firehol.org/
|
||||||
//
|
//
|
||||||
// It can use both local files and remote URLs. This is not necessary
|
// It can use both local files and remote URLs. This is not necessary that
|
||||||
// that blocklists should be taken from this website, we expect only
|
// blocklists should be taken from this website, we expect only compatible
|
||||||
// compatible formats here.
|
// formats here.
|
||||||
//
|
//
|
||||||
// Example of the format:
|
// Example of the format:
|
||||||
//
|
//
|
||||||
// # this is a comment
|
// # this is a comment
|
||||||
// # to ignore
|
// # to ignore
|
||||||
// 127.0.0.1 # you can specify an IP
|
// 127.0.0.1 # you can specify an IP
|
||||||
// 10.0.0.0/8 # or cidr
|
// 10.0.0.0/8 # or cidr
|
||||||
type Firehol struct {
|
type Firehol struct {
|
||||||
ctx context.Context
|
ctx context.Context
|
||||||
ctxCancel context.CancelFunc
|
ctxCancel context.CancelFunc
|
||||||
@@ -78,8 +78,7 @@ func (f *Firehol) Contains(ip net.IP) bool {
|
|||||||
|
|
||||||
// Run starts a background update process.
|
// Run starts a background update process.
|
||||||
//
|
//
|
||||||
// This is a blocking method so you probably want to run it in a
|
// This is a blocking method so you probably want to run it in a goroutine.
|
||||||
// goroutine.
|
|
||||||
func (f *Firehol) Run(updateEach time.Duration) {
|
func (f *Firehol) Run(updateEach time.Duration) {
|
||||||
if updateEach == 0 {
|
if updateEach == 0 {
|
||||||
updateEach = DefaultFireholUpdateEach
|
updateEach = DefaultFireholUpdateEach
|
||||||
@@ -211,8 +210,8 @@ func (f *Firehol) updateParseLine(text string) (*net.IPNet, error) {
|
|||||||
|
|
||||||
// NewFirehol creates a new instance of FireHOL IP blocklist.
|
// NewFirehol creates a new instance of FireHOL IP blocklist.
|
||||||
//
|
//
|
||||||
// This method does not start an update process so please execute Run
|
// This method does not start an update process so please execute Run when it
|
||||||
// when it is necessary.
|
// is necessary.
|
||||||
func NewFirehol(logger mtglib.Logger, network mtglib.Network,
|
func NewFirehol(logger mtglib.Logger, network mtglib.Network,
|
||||||
downloadConcurrency uint,
|
downloadConcurrency uint,
|
||||||
urls []string,
|
urls []string,
|
||||||
@@ -244,6 +243,9 @@ func NewFirehol(logger mtglib.Logger, network mtglib.Network,
|
|||||||
return NewFireholFromFiles(logger, downloadConcurrency, blocklists, updateCallback)
|
return NewFireholFromFiles(logger, downloadConcurrency, blocklists, updateCallback)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// NewFirehol creates a new instance of FireHOL IP blocklist.
|
||||||
|
//
|
||||||
|
// This method creates this instances from a given list of files.
|
||||||
func NewFireholFromFiles(logger mtglib.Logger,
|
func NewFireholFromFiles(logger mtglib.Logger,
|
||||||
downloadConcurrency uint,
|
downloadConcurrency uint,
|
||||||
blocklists []files.File,
|
blocklists []files.File,
|
||||||
|
|||||||
+5
-5
@@ -1,8 +1,8 @@
|
|||||||
// Package ipblocklist contains default implementation of the
|
// Package ipblocklist contains default implementation of the
|
||||||
// IPBlocklist for mtg.
|
// [mtglib.IPBlocklist] for mtg.
|
||||||
//
|
//
|
||||||
// Please check documentation for mtglib.IPBlocklist interface to get an
|
// Please check documentation for [mtglib.IPBlocklist] interface to get an idea
|
||||||
// idea of this abstraction.
|
// of this abstraction.
|
||||||
package ipblocklist
|
package ipblocklist
|
||||||
|
|
||||||
import "time"
|
import "time"
|
||||||
@@ -12,7 +12,7 @@ const (
|
|||||||
// concurrent downloads of ip blocklists for Firehol.
|
// concurrent downloads of ip blocklists for Firehol.
|
||||||
DefaultFireholDownloadConcurrency = 1
|
DefaultFireholDownloadConcurrency = 1
|
||||||
|
|
||||||
// DefaultFireholUpdateEach defines a default time period when
|
// DefaultFireholUpdateEach defines a default time period when Firehol
|
||||||
// Firehol requests updates of the blocklists.
|
// requests updates of the blocklists.
|
||||||
DefaultFireholUpdateEach = 6 * time.Hour
|
DefaultFireholUpdateEach = 6 * time.Hour
|
||||||
)
|
)
|
||||||
|
|||||||
+1
-2
@@ -13,8 +13,7 @@ func (n noop) Contains(ip net.IP) bool { return false }
|
|||||||
func (n noop) Run(updateEach time.Duration) {}
|
func (n noop) Run(updateEach time.Duration) {}
|
||||||
func (n noop) Shutdown() {}
|
func (n noop) Shutdown() {}
|
||||||
|
|
||||||
// NewNoop returns a dummy ipblocklist which allows all incoming
|
// NewNoop returns a dummy ipblocklist which allows all incoming connections.
|
||||||
// connections.
|
|
||||||
func NewNoop() mtglib.IPBlocklist {
|
func NewNoop() mtglib.IPBlocklist {
|
||||||
return noop{}
|
return noop{}
|
||||||
}
|
}
|
||||||
|
|||||||
+6
-8
@@ -1,14 +1,12 @@
|
|||||||
// Package logger has implementation of loggers for mtglib.Logger
|
// Package logger has implementation of loggers for [mtglib.Logger] interface.
|
||||||
// interface.
|
|
||||||
//
|
//
|
||||||
// Please see a description of that interface to get some agreements
|
// Please see a description of that interface to get some agreements which are
|
||||||
// which are used by mtglib.
|
// used by mtglib.
|
||||||
package logger
|
package logger
|
||||||
|
|
||||||
// StdLikeLogger is an interface which is close to log.Logger. This is
|
// StdLikeLogger is an interface which is close to [log.Logger]. This is
|
||||||
// commonly used by many 3pp tools. While mtglib itself does not need
|
// commonly used by many 3pp tools. While mtglib itself does not need it, it is
|
||||||
// it, it is always a good idea to support it and have a transient end
|
// always a good idea to support it and have a transient end to end logging.
|
||||||
// to end logging.
|
|
||||||
type StdLikeLogger interface {
|
type StdLikeLogger interface {
|
||||||
Printf(format string, args ...interface{})
|
Printf(format string, args ...interface{})
|
||||||
}
|
}
|
||||||
|
|||||||
+17
-17
@@ -29,13 +29,13 @@ type EventStart struct {
|
|||||||
RemoteIP net.IP
|
RemoteIP net.IP
|
||||||
}
|
}
|
||||||
|
|
||||||
// EventConnectedToDC is emitted when mtg proxy has connected to a
|
// EventConnectedToDC is emitted when mtg proxy has connected to a Telegram
|
||||||
// Telegram server.
|
// server.
|
||||||
type EventConnectedToDC struct {
|
type EventConnectedToDC struct {
|
||||||
eventBase
|
eventBase
|
||||||
|
|
||||||
// RemoteIP is an IP address of the Telegram server proxy has been
|
// RemoteIP is an IP address of the Telegram server proxy has been connected
|
||||||
// connected to.
|
// to.
|
||||||
RemoteIP net.IP
|
RemoteIP net.IP
|
||||||
|
|
||||||
// DC is an index of the datacenter proxy has been connected to.
|
// DC is an index of the datacenter proxy has been connected to.
|
||||||
@@ -49,15 +49,15 @@ type EventTraffic struct {
|
|||||||
// Traffic is a count of bytes which were transmitted.
|
// Traffic is a count of bytes which were transmitted.
|
||||||
Traffic uint
|
Traffic uint
|
||||||
|
|
||||||
// IsRead defines if we _read_ or _write_ to connection. A rule of
|
// IsRead defines if we _read_ or _write_ to connection. A rule of thumb is
|
||||||
// thumb is simple: EventTraffic is bound to a remote connection. Not
|
// simple: EventTraffic is bound to a remote connection. Not to a client one,
|
||||||
// to a client one, but either to Telegram or front domain one.
|
// but either to Telegram or front domain one.
|
||||||
//
|
//
|
||||||
// In the case of Telegram, isRead means that we've fetched some bytes
|
// In the case of Telegram, isRead means that we've fetched some bytes from
|
||||||
// from Telegram to send it to a client.
|
// Telegram to send it to a client.
|
||||||
//
|
//
|
||||||
// In the case of the front domain, it means that we've fetched some
|
// In the case of the front domain, it means that we've fetched some bytes
|
||||||
// bytes from this domain to send it to a client.
|
// from this domain to send it to a client.
|
||||||
IsRead bool
|
IsRead bool
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -66,20 +66,20 @@ type EventFinish struct {
|
|||||||
eventBase
|
eventBase
|
||||||
}
|
}
|
||||||
|
|
||||||
// EventDomainFronting is emitted when we connect to a front domain
|
// EventDomainFronting is emitted when we connect to a front domain instead of
|
||||||
// instead of Telegram server.
|
// Telegram server.
|
||||||
type EventDomainFronting struct {
|
type EventDomainFronting struct {
|
||||||
eventBase
|
eventBase
|
||||||
}
|
}
|
||||||
|
|
||||||
// EventConcurrencyLimited is emitted when connection was declined
|
// EventConcurrencyLimited is emitted when connection was declined because of
|
||||||
// because of the concurrency limit of the worker pool.
|
// the concurrency limit of the worker pool.
|
||||||
type EventConcurrencyLimited struct {
|
type EventConcurrencyLimited struct {
|
||||||
eventBase
|
eventBase
|
||||||
}
|
}
|
||||||
|
|
||||||
// EventIPBlocklisted is emitted when connection was declined because
|
// EventIPBlocklisted is emitted when connection was declined because IP
|
||||||
// IP address was found in IP blocklist.
|
// address was found in IP blocklist.
|
||||||
type EventIPBlocklisted struct {
|
type EventIPBlocklisted struct {
|
||||||
eventBase
|
eventBase
|
||||||
|
|
||||||
|
|||||||
+124
-139
@@ -1,20 +1,19 @@
|
|||||||
// mtglib defines a package with MTPROTO proxy.
|
// mtglib defines a package with MTPROTO proxy.
|
||||||
//
|
//
|
||||||
// Since mtg itself is build as an example of how to work with mtglib,
|
// Since mtg itself is build as an example of how to work with mtglib, it worth
|
||||||
// it worth to telling a couple of words about a project organization.
|
// to telling a couple of words about a project organization.
|
||||||
//
|
//
|
||||||
// A core object of the project is mtglib.Proxy. This is a proxy you
|
// A core object of the project is [mtglib.Proxy]. This is a proxy you expect:
|
||||||
// expect: that one which you configure, set to serve on a listener
|
// that one which you configure, set to serve on a listener and/or shutdown on
|
||||||
// and/or shutdown on application termination.
|
// application termination.
|
||||||
//
|
//
|
||||||
// But it also has a core logic unrelated to Telegram per se: anti
|
// But it also has a core logic unrelated to Telegram per se: anti replay
|
||||||
// replay cache, network connectivity (who knows, maybe you want to have
|
// cache, network connectivity (who knows, maybe you want to have a native
|
||||||
// a native VMESS integration) and so on.
|
// VMESS integration) and so on.
|
||||||
//
|
//
|
||||||
// You can supply such parts to a proxy with interfaces. The rest of
|
// You can supply such parts to a proxy with interfaces. The rest of the
|
||||||
// the packages in mtg define some default implementations of these
|
// packages in mtg define some default implementations of these interfaces. But
|
||||||
// interfaces. But if you want to integrate it with, let say, influxdb,
|
// if you want to integrate it with, let say, influxdb, you can do it easily.
|
||||||
// you can do it easily.
|
|
||||||
package mtglib
|
package mtglib
|
||||||
|
|
||||||
import (
|
import (
|
||||||
@@ -28,42 +27,42 @@ import (
|
|||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
// ErrSecretEmpty is returned if you are trying to create a proxy
|
// ErrSecretEmpty is returned if you are trying to create a proxy but do not
|
||||||
// but do not provide a secret.
|
// provide a secret.
|
||||||
ErrSecretEmpty = errors.New("secret is empty")
|
ErrSecretEmpty = errors.New("secret is empty")
|
||||||
|
|
||||||
// ErrSecretInvalid is returned if you are trying to create a proxy
|
// ErrSecretInvalid is returned if you are trying to create a proxy but secret
|
||||||
// but secret value is invalid (no host or payload are zeroes).
|
// value is invalid (no host or payload are zeroes).
|
||||||
ErrSecretInvalid = errors.New("secret is invalid")
|
ErrSecretInvalid = errors.New("secret is invalid")
|
||||||
|
|
||||||
// ErrNetworkIsNotDefined is returned if you are trying to create a
|
// ErrNetworkIsNotDefined is returned if you are trying to create a proxy but
|
||||||
// proxy but network value is undefined.
|
// network value is undefined.
|
||||||
ErrNetworkIsNotDefined = errors.New("network is not defined")
|
ErrNetworkIsNotDefined = errors.New("network is not defined")
|
||||||
|
|
||||||
// ErrAntiReplayCacheIsNotDefined is returned if you are trying to
|
// ErrAntiReplayCacheIsNotDefined is returned if you are trying to create a
|
||||||
// create a proxy but anti replay cache value is undefined.
|
// proxy but anti replay cache value is undefined.
|
||||||
ErrAntiReplayCacheIsNotDefined = errors.New("anti-replay cache is not defined")
|
ErrAntiReplayCacheIsNotDefined = errors.New("anti-replay cache is not defined")
|
||||||
|
|
||||||
// ErrIPBlocklistIsNotDefined is returned if you are trying to
|
// ErrIPBlocklistIsNotDefined is returned if you are trying to create a proxy
|
||||||
// create a proxy but ip blocklist instance is not defined.
|
// but ip blocklist instance is not defined.
|
||||||
ErrIPBlocklistIsNotDefined = errors.New("ip blocklist is not defined")
|
ErrIPBlocklistIsNotDefined = errors.New("ip blocklist is not defined")
|
||||||
|
|
||||||
// ErrIPAllowlistIsNotDefined is returned if you are trying to
|
// ErrIPAllowlistIsNotDefined is returned if you are trying to create a proxy
|
||||||
// create a proxy but ip allowlist instance is not defined.
|
// but ip allowlist instance is not defined.
|
||||||
ErrIPAllowlistIsNotDefined = errors.New("ip allowlist is not defined")
|
ErrIPAllowlistIsNotDefined = errors.New("ip allowlist is not defined")
|
||||||
|
|
||||||
// ErrEventStreamIsNotDefined is returned if you are trying to create a
|
// ErrEventStreamIsNotDefined is returned if you are trying to create a proxy
|
||||||
// proxy but event stream instance is not defined.
|
// but event stream instance is not defined.
|
||||||
ErrEventStreamIsNotDefined = errors.New("event stream is not defined")
|
ErrEventStreamIsNotDefined = errors.New("event stream is not defined")
|
||||||
|
|
||||||
// ErrLoggerIsNotDefined is returned if you are trying to
|
// ErrLoggerIsNotDefined is returned if you are trying to create a proxy but
|
||||||
// create a proxy but logger is not defined.
|
// logger is not defined.
|
||||||
ErrLoggerIsNotDefined = errors.New("logger is not defined")
|
ErrLoggerIsNotDefined = errors.New("logger is not defined")
|
||||||
)
|
)
|
||||||
|
|
||||||
const (
|
const (
|
||||||
// DefaultConcurrency is a default max count of simultaneously
|
// DefaultConcurrency is a default max count of simultaneously connected
|
||||||
// connected clients.
|
// clients.
|
||||||
DefaultConcurrency = 4096
|
DefaultConcurrency = 4096
|
||||||
|
|
||||||
// DefaultBufferSize is a default size of a copy buffer.
|
// DefaultBufferSize is a default size of a copy buffer.
|
||||||
@@ -71,31 +70,29 @@ const (
|
|||||||
// Deprecated: this setting no longer makes any effect.
|
// Deprecated: this setting no longer makes any effect.
|
||||||
DefaultBufferSize = 16 * 1024 // 16 kib
|
DefaultBufferSize = 16 * 1024 // 16 kib
|
||||||
|
|
||||||
// DefaultDomainFrontingPort is a default port (HTTPS) to connect to in
|
// DefaultDomainFrontingPort is a default port (HTTPS) to connect to in case
|
||||||
// case of probe-resistance activity.
|
// of probe-resistance activity.
|
||||||
DefaultDomainFrontingPort = 443
|
DefaultDomainFrontingPort = 443
|
||||||
|
|
||||||
// DefaultIdleTimeout is a default timeout for closing a connection
|
// DefaultIdleTimeout is a default timeout for closing a connection in case of
|
||||||
// in case of idling.
|
// idling.
|
||||||
//
|
//
|
||||||
// Deprecated: no longer in use because of changed TCP relay
|
// Deprecated: no longer in use because of changed TCP relay algorithm.
|
||||||
// algorithm.
|
|
||||||
DefaultIdleTimeout = time.Minute
|
DefaultIdleTimeout = time.Minute
|
||||||
|
|
||||||
// DefaultTolerateTimeSkewness is a default timeout for time
|
// DefaultTolerateTimeSkewness is a default timeout for time skewness on a
|
||||||
// skewness on a faketls timeout verification.
|
// faketls timeout verification.
|
||||||
DefaultTolerateTimeSkewness = 3 * time.Second
|
DefaultTolerateTimeSkewness = 3 * time.Second
|
||||||
|
|
||||||
// DefaultPreferIP is a default value for Telegram IP connectivity
|
// DefaultPreferIP is a default value for Telegram IP connectivity preference.
|
||||||
// preference.
|
|
||||||
DefaultPreferIP = "prefer-ipv6"
|
DefaultPreferIP = "prefer-ipv6"
|
||||||
|
|
||||||
// SecretKeyLength defines a length of the secret bytes used
|
// SecretKeyLength defines a length of the secret bytes used by Telegram and a
|
||||||
// by Telegram and a proxy.
|
// proxy.
|
||||||
SecretKeyLength = 16
|
SecretKeyLength = 16
|
||||||
|
|
||||||
// ConnectionIDBytesLength defines a count of random bytes used to generate
|
// ConnectionIDBytesLength defines a count of random bytes used to generate a
|
||||||
// a stream/connection ids.
|
// stream/connection ids.
|
||||||
ConnectionIDBytesLength = 16
|
ConnectionIDBytesLength = 16
|
||||||
|
|
||||||
// TCPRelayReadTimeout defines a max time period between two consecuitive
|
// TCPRelayReadTimeout defines a max time period between two consecuitive
|
||||||
@@ -104,81 +101,76 @@ const (
|
|||||||
TCPRelayReadTimeout = 20 * time.Second
|
TCPRelayReadTimeout = 20 * time.Second
|
||||||
)
|
)
|
||||||
|
|
||||||
// Network defines a knowledge how to work with a network. It may sound
|
// Network defines a knowledge how to work with a network. It may sound fun but
|
||||||
// fun but it encapsulates all the knowledge how to properly establish
|
// it encapsulates all the knowledge how to properly establish connections to
|
||||||
// connections to remote hosts and configure HTTP clients.
|
// remote hosts and configure HTTP clients.
|
||||||
//
|
//
|
||||||
// For example, if you want to use SOCKS5 proxy, you probably want to
|
// For example, if you want to use SOCKS5 proxy, you probably want to have all
|
||||||
// have all traffic routed to this proxy: telegram connections, http
|
// traffic routed to this proxy: telegram connections, http requests and so on.
|
||||||
// requests and so on. This knowledge is encapsulated into instances of
|
// This knowledge is encapsulated into instances of such interface.
|
||||||
// such interface.
|
|
||||||
//
|
//
|
||||||
// mtglib uses Network for:
|
// mtglib uses Network for:
|
||||||
//
|
// 1. Dialing to Telegram
|
||||||
// 1. Dialing to Telegram
|
// 2. Dialing to front domain
|
||||||
//
|
// 3. Doing HTTP requests (for example, for FireHOL ipblocklist).
|
||||||
// 2. Dialing to front domain
|
|
||||||
//
|
|
||||||
// 3. Doing HTTP requests (for example, for FireHOL ipblocklist).
|
|
||||||
type Network interface {
|
type Network interface {
|
||||||
// Dial establishes context-free TCP connections.
|
// Dial establishes context-free TCP connections.
|
||||||
Dial(network, address string) (essentials.Conn, error)
|
Dial(network, address string) (essentials.Conn, error)
|
||||||
|
|
||||||
// DialContext dials using a context. This is a preferrable
|
// DialContext dials using a context. This is a preferrable way of
|
||||||
// way of establishing TCP connections.
|
// establishing TCP connections.
|
||||||
DialContext(ctx context.Context, network, address string) (essentials.Conn, error)
|
DialContext(ctx context.Context, network, address string) (essentials.Conn, error)
|
||||||
|
|
||||||
// MakeHTTPClient build an HTTP client with given dial function. If
|
// MakeHTTPClient build an HTTP client with given dial function. If nothing is
|
||||||
// nothing is provided, then DialContext of this interface is going
|
// provided, then DialContext of this interface is going to be used.
|
||||||
// to be used.
|
|
||||||
MakeHTTPClient(func(ctx context.Context, network, address string) (essentials.Conn, error)) *http.Client
|
MakeHTTPClient(func(ctx context.Context, network, address string) (essentials.Conn, error)) *http.Client
|
||||||
}
|
}
|
||||||
|
|
||||||
// AntiReplayCache is an interface that is used to detect replay attacks
|
// AntiReplayCache is an interface that is used to detect replay attacks based
|
||||||
// based on some traffic fingerprints.
|
// on some traffic fingerprints.
|
||||||
//
|
//
|
||||||
// Replay attacks are probe attacks whose main goal is to identify if
|
// Replay attacks are probe attacks whose main goal is to identify if server
|
||||||
// server software can be classified in some way. For example, if you
|
// software can be classified in some way. For example, if you send some HTTP
|
||||||
// send some HTTP request to a web server, then you can expect that this
|
// request to a web server, then you can expect that this server will respond
|
||||||
// server will respond with HTTP response back.
|
// with HTTP response back.
|
||||||
//
|
//
|
||||||
// There is a problem though. Let's imagine, that connection is
|
// There is a problem though. Let's imagine, that connection is encrypted.
|
||||||
// encrypted. Let's imagine, that it is encrypted with some static key
|
// Let's imagine, that it is encrypted with some static key like [ShadowSocks].
|
||||||
// like ShadowSocks (https://shadowsocks.org/assets/whitepaper.pdf).
|
// In that case, in theory, if you repeat the same bytes, you can get the same
|
||||||
// In that case, in theory, if you repeat the same bytes, you can get
|
// responses. Let's imagine, that you've cracked the key. then if you send the
|
||||||
// the same responses. Let's imagine, that you've cracked the key. then
|
// same bytes, you can decrypt a response and see its structure. Based on its
|
||||||
// if you send the same bytes, you can decrypt a response and see its
|
// structure you can identify if this server is SOCKS5, MTPROTO proxy etc.
|
||||||
// structure. Based on its structure you can identify if this server is
|
|
||||||
// SOCKS5, MTPROTO proxy etc.
|
|
||||||
//
|
//
|
||||||
// This is just one example, maybe not the best or not the most
|
// This is just one example, maybe not the best or not the most relevant. In
|
||||||
// relevant. In real life, different organizations use such replay
|
// real life, different organizations use such replay attacks to perform some
|
||||||
// attacks to perform some reverse engineering of the proxy, do some
|
// reverse engineering of the proxy, do some statical analysis to identify
|
||||||
// statical analysis to identify server software.
|
// server software.
|
||||||
//
|
//
|
||||||
// There are many ways how to protect your proxy against them. One
|
// There are many ways how to protect your proxy against them. One is domain
|
||||||
// is domain fronting which is a core part of mtg. Another one is to
|
// fronting which is a core part of mtg. Another one is to collect some
|
||||||
// collect some 'handshake fingerprints' and forbid duplication.
|
// 'handshake fingerprints' and forbid duplication.
|
||||||
//
|
//
|
||||||
// So, it one is sending the same byte flow right after you (or a couple
|
// So, it one is sending the same byte flow right after you (or a couple of
|
||||||
// of hours after), mtg should detect that and reject this connection
|
// hours after), mtg should detect that and reject this connection (or redirect
|
||||||
// (or redirect to fronting domain).
|
// to fronting domain).
|
||||||
|
//
|
||||||
|
// [ShadowSocks]: https://shadowsocks.org/assets/whitepaper.pdf
|
||||||
type AntiReplayCache interface {
|
type AntiReplayCache interface {
|
||||||
// Seen before checks if this set of bytes was observed before or
|
// Seen before checks if this set of bytes was observed before or not. If it
|
||||||
// not. If it is required to store this information somewhere else,
|
// is required to store this information somewhere else, then it has to do
|
||||||
// then it has to do that.
|
// that.
|
||||||
SeenBefore(data []byte) bool
|
SeenBefore(data []byte) bool
|
||||||
}
|
}
|
||||||
|
|
||||||
// IPBlocklist filters requests based on IP address.
|
// IPBlocklist filters requests based on IP address.
|
||||||
//
|
//
|
||||||
// If this filter has an IP address, then mtg closes a request without
|
// If this filter has an IP address, then mtg closes a request without reading
|
||||||
// reading anything from a socket. It also does not give such request to
|
// anything from a socket. It also does not give such request to a worker pool,
|
||||||
// a worker pool, so in worst cases you can expect that you invoke this
|
// so in worst cases you can expect that you invoke this object more frequent
|
||||||
// object more frequent than defined proxy concurrency.
|
// than defined proxy concurrency.
|
||||||
type IPBlocklist interface {
|
type IPBlocklist interface {
|
||||||
// Contains checks if given IP address belongs to this blocklist If.
|
// Contains checks if given IP address belongs to this blocklist If. it is, a
|
||||||
// it is, a connection is terminated .
|
// connection is terminated .
|
||||||
Contains(net.IP) bool
|
Contains(net.IP) bool
|
||||||
|
|
||||||
// Run starts a background update procedure for a blocklist
|
// Run starts a background update procedure for a blocklist
|
||||||
@@ -188,40 +180,35 @@ type IPBlocklist interface {
|
|||||||
Shutdown()
|
Shutdown()
|
||||||
}
|
}
|
||||||
|
|
||||||
// Event is a data structure which is populated during mtg request
|
// Event is a data structure which is populated during mtg request processing
|
||||||
// processing lifecycle. Each request popluates many events:
|
// lifecycle. Each request popluates many events:
|
||||||
|
// 1. Client connected
|
||||||
|
// 2. Request is finished
|
||||||
|
// 3. Connection to Telegram server is established
|
||||||
//
|
//
|
||||||
// 1. Client connected
|
// and so on. All these events are data structures but all of them must conform
|
||||||
//
|
// the same interface.
|
||||||
// 2. Request is finished
|
|
||||||
//
|
|
||||||
// 3. Connection to Telegram server is established
|
|
||||||
//
|
|
||||||
// and so on. All these events are data structures but all of them
|
|
||||||
// must conform the same interface.
|
|
||||||
type Event interface {
|
type Event interface {
|
||||||
// StreamID returns an identifier of the stream, connection,
|
// StreamID returns an identifier of the stream, connection, request, you name
|
||||||
// request, you name it. All events within the same stream returns
|
// it. All events within the same stream returns the same stream id.
|
||||||
// the same stream id.
|
|
||||||
StreamID() string
|
StreamID() string
|
||||||
|
|
||||||
// Timestamp returns a timestamp when this event was generated.
|
// Timestamp returns a timestamp when this event was generated.
|
||||||
Timestamp() time.Time
|
Timestamp() time.Time
|
||||||
}
|
}
|
||||||
|
|
||||||
// EventStream is an abstraction that accepts a set of events produced
|
// EventStream is an abstraction that accepts a set of events produced by mtg.
|
||||||
// by mtg. Its main goal is to inject your logging or monitoring system.
|
// Its main goal is to inject your logging or monitoring system.
|
||||||
//
|
//
|
||||||
// The idea is simple. When mtg works, it emits a set of events during
|
// The idea is simple. When mtg works, it emits a set of events during a
|
||||||
// a lifecycle of the requestor: EventStart, EventFinish etc. mtg is a
|
// lifecycle of the requestor: EventStart, EventFinish etc. mtg is a producer
|
||||||
// producer which puts these events into a stream. Responsibility of
|
// which puts these events into a stream. Responsibility of the stream is to
|
||||||
// the stream is to deliver this event to consumers/observers. There
|
// deliver this event to consumers/observers. There might be many different
|
||||||
// might be many different observers (for example, you want to have both
|
// observers (for example, you want to have both statsd and prometheus), mtg
|
||||||
// statsd and prometheus), mtg should know nothing about them.
|
// should know nothing about them.
|
||||||
type EventStream interface {
|
type EventStream interface {
|
||||||
// Send delivers an event to observers. Given context has to be
|
// Send delivers an event to observers. Given context has to be respected. If
|
||||||
// respected. If the context is closed, all blocking operations should
|
// the context is closed, all blocking operations should be released ASAP.
|
||||||
// be released ASAP.
|
|
||||||
//
|
//
|
||||||
// It is possible that context is closed but the message is delivered.
|
// It is possible that context is closed but the message is delivered.
|
||||||
// EventStream implementations should solve this issue somehow.
|
// EventStream implementations should solve this issue somehow.
|
||||||
@@ -230,27 +217,26 @@ type EventStream interface {
|
|||||||
|
|
||||||
// Logger defines an interface of the logger used by mtglib.
|
// Logger defines an interface of the logger used by mtglib.
|
||||||
//
|
//
|
||||||
// Each logger has a name. It is possible to stack names to organize
|
// Each logger has a name. It is possible to stack names to organize poor-man
|
||||||
// poor-man namespaces. Also, each logger must be able to bind
|
// namespaces. Also, each logger must be able to bind parameters to avoid
|
||||||
// parameters to avoid pushing them all the time.
|
// pushing them all the time.
|
||||||
//
|
//
|
||||||
// Example
|
// Example
|
||||||
//
|
//
|
||||||
// logger := SomeLogger{}
|
// logger := SomeLogger{} logger = logger.BindStr("ip", net.IP{127, 0, 0, 1})
|
||||||
// logger = logger.BindStr("ip", net.IP{127, 0, 0, 1})
|
// logger.Info("Hello")
|
||||||
// logger.Info("Hello")
|
|
||||||
//
|
//
|
||||||
// In that case, ip is bound as a parameter. It is a great idea to
|
// In that case, ip is bound as a parameter. It is a great idea to put this
|
||||||
// put this parameter somewhere in a log message.
|
// parameter somewhere in a log message.
|
||||||
//
|
//
|
||||||
// logger1 = logger.BindStr("param1", "11")
|
// logger1 = logger.BindStr("param1", "11") logger2 = logger.BindInt("param2",
|
||||||
// logger2 = logger.BindInt("param2", 11)
|
// 11)
|
||||||
//
|
//
|
||||||
// logger1 should see no param2 and vice versa, logger2 should not see param1
|
// logger1 should see no param2 and vice versa, logger2 should not see param1
|
||||||
// If you attach a parameter to a logger, parents should not know about that.
|
// If you attach a parameter to a logger, parents should not know about that.
|
||||||
type Logger interface {
|
type Logger interface {
|
||||||
// Named returns a new logger with a bound name. Name chaining is
|
// Named returns a new logger with a bound name. Name chaining is allowed and
|
||||||
// allowed and appreciated.
|
// appreciated.
|
||||||
Named(name string) Logger
|
Named(name string) Logger
|
||||||
|
|
||||||
// BindInt binds new integer parameter to a new logger instance.
|
// BindInt binds new integer parameter to a new logger instance.
|
||||||
@@ -268,22 +254,21 @@ type Logger interface {
|
|||||||
// Info puts a message about some normal situation.
|
// Info puts a message about some normal situation.
|
||||||
Info(msg string)
|
Info(msg string)
|
||||||
|
|
||||||
// InfoError puts a message about some normal situation but this
|
// InfoError puts a message about some normal situation but this situation is
|
||||||
// situation is related to a given error.
|
// related to a given error.
|
||||||
InfoError(msg string, err error)
|
InfoError(msg string, err error)
|
||||||
|
|
||||||
// Warning puts a message about some extraordinary situation
|
// Warning puts a message about some extraordinary situation worth to look at.
|
||||||
// worth to look at.
|
|
||||||
Warning(msg string)
|
Warning(msg string)
|
||||||
|
|
||||||
// WarningError puts a message about some extraordinary situation
|
// WarningError puts a message about some extraordinary situation worth to
|
||||||
// worth to look at. This situation is related to a given error.
|
// look at. This situation is related to a given error.
|
||||||
WarningError(msg string, err error)
|
WarningError(msg string, err error)
|
||||||
|
|
||||||
// Debug puts a message useful for debugging only.
|
// Debug puts a message useful for debugging only.
|
||||||
Debug(msg string)
|
Debug(msg string)
|
||||||
|
|
||||||
// Debug puts a message useful for debugging only. This message is
|
// Debug puts a message useful for debugging only. This message is related to
|
||||||
// related to a given error.
|
// a given error.
|
||||||
DebugError(msg string, err error)
|
DebugError(msg string, err error)
|
||||||
}
|
}
|
||||||
|
|||||||
+4
-4
@@ -44,8 +44,8 @@ func (p *Proxy) DomainFrontingAddress() string {
|
|||||||
return net.JoinHostPort(p.secret.Host, strconv.Itoa(p.domainFrontingPort))
|
return net.JoinHostPort(p.secret.Host, strconv.Itoa(p.domainFrontingPort))
|
||||||
}
|
}
|
||||||
|
|
||||||
// ServeConn serves a connection. We do not check IP blocklist and
|
// ServeConn serves a connection. We do not check IP blocklist and concurrency
|
||||||
// concurrency limit here.
|
// limit here.
|
||||||
func (p *Proxy) ServeConn(conn essentials.Conn) {
|
func (p *Proxy) ServeConn(conn essentials.Conn) {
|
||||||
p.streamWaitGroup.Add(1)
|
p.streamWaitGroup.Add(1)
|
||||||
defer p.streamWaitGroup.Done()
|
defer p.streamWaitGroup.Done()
|
||||||
@@ -138,8 +138,8 @@ func (p *Proxy) Serve(listener net.Listener) error {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// Shutdown 'gracefully' shutdowns all connections. Please remember that
|
// Shutdown 'gracefully' shutdowns all connections. Please remember that it
|
||||||
// it does not close an underlying listener.
|
// does not close an underlying listener.
|
||||||
func (p *Proxy) Shutdown() {
|
func (p *Proxy) Shutdown() {
|
||||||
p.ctxCancel()
|
p.ctxCancel()
|
||||||
p.streamWaitGroup.Wait()
|
p.streamWaitGroup.Wait()
|
||||||
|
|||||||
+25
-29
@@ -4,16 +4,16 @@ import "time"
|
|||||||
|
|
||||||
// ProxyOpts is a structure with settings to mtg proxy.
|
// ProxyOpts is a structure with settings to mtg proxy.
|
||||||
//
|
//
|
||||||
// This is not required per se, but this is to shorten function
|
// This is not required per se, but this is to shorten function signature and
|
||||||
// signature and give an ability to conveniently provide default values.
|
// give an ability to conveniently provide default values.
|
||||||
type ProxyOpts struct {
|
type ProxyOpts struct {
|
||||||
// Secret defines a secret which should be used by a proxy.
|
// Secret defines a secret which should be used by a proxy.
|
||||||
//
|
//
|
||||||
// This is a mandatory setting.
|
// This is a mandatory setting.
|
||||||
Secret Secret
|
Secret Secret
|
||||||
|
|
||||||
// Network defines a network instance which should be used for all
|
// Network defines a network instance which should be used for all network
|
||||||
// network communications made by proxies.
|
// communications made by proxies.
|
||||||
//
|
//
|
||||||
// This is a mandatory setting.
|
// This is a mandatory setting.
|
||||||
Network Network
|
Network Network
|
||||||
@@ -45,9 +45,8 @@ type ProxyOpts struct {
|
|||||||
|
|
||||||
// BufferSize is a size of the copy buffer in bytes.
|
// BufferSize is a size of the copy buffer in bytes.
|
||||||
//
|
//
|
||||||
// Please remember that we multiply this number in 2, because when
|
// Please remember that we multiply this number in 2, because when we relay
|
||||||
// we relay between proxies, we have to create 2 intermediate
|
// between proxies, we have to create 2 intermediate buffers: to and from.
|
||||||
// buffers: to and from.
|
|
||||||
//
|
//
|
||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
//
|
//
|
||||||
@@ -62,22 +61,20 @@ type ProxyOpts struct {
|
|||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
Concurrency uint
|
Concurrency uint
|
||||||
|
|
||||||
// IdleTimeout is a timeout for relay when we have to break a
|
// IdleTimeout is a timeout for relay when we have to break a stream.
|
||||||
// stream.
|
|
||||||
//
|
//
|
||||||
// This is a timeout for any activity. So, if we have any message
|
// This is a timeout for any activity. So, if we have any message which will
|
||||||
// which will pass to either direction, a timer is reset. If we have
|
// pass to either direction, a timer is reset. If we have no any reads or
|
||||||
// no any reads or writes for this timeout, a connection will be
|
// writes for this timeout, a connection will be aborted.
|
||||||
// aborted.
|
|
||||||
//
|
//
|
||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
IdleTimeout time.Duration
|
IdleTimeout time.Duration
|
||||||
|
|
||||||
// TolerateTimeSkewness is a time boundary that defines a time
|
// TolerateTimeSkewness is a time boundary that defines a time range where
|
||||||
// range where faketls timestamp is acceptable.
|
// faketls timestamp is acceptable.
|
||||||
//
|
//
|
||||||
// This means that if if you got a timestamp X, now is Y, then
|
// This means that if if you got a timestamp X, now is Y, then if |X-Y| <
|
||||||
// if |X-Y| < TolerateTimeSkewness, then you accept a packet.
|
// TolerateTimeSkewness, then you accept a packet.
|
||||||
//
|
//
|
||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
TolerateTimeSkewness time.Duration
|
TolerateTimeSkewness time.Duration
|
||||||
@@ -88,30 +85,29 @@ type ProxyOpts struct {
|
|||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
PreferIP string
|
PreferIP string
|
||||||
|
|
||||||
// DomainFrontingPort is a port we use to connect to a fronting
|
// DomainFrontingPort is a port we use to connect to a fronting domain.
|
||||||
// domain.
|
|
||||||
//
|
//
|
||||||
// This is required because secret does not specify a port. It
|
// This is required because secret does not specify a port. It specifies a
|
||||||
// specifies a hostname only.
|
// hostname only.
|
||||||
//
|
//
|
||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
DomainFrontingPort uint
|
DomainFrontingPort uint
|
||||||
|
|
||||||
// AllowFallbackOnUnknownDC defines how proxy behaves if unknown DC was
|
// AllowFallbackOnUnknownDC defines how proxy behaves if unknown DC was
|
||||||
// requested. If this setting is set to false, then such connection
|
// requested. If this setting is set to false, then such connection will be
|
||||||
// will be rejected. Otherwise, proxy will chose any DC.
|
// rejected. Otherwise, proxy will chose any DC.
|
||||||
//
|
//
|
||||||
// Telegram is designed in a way that any DC can serve any request,
|
// Telegram is designed in a way that any DC can serve any request, the
|
||||||
// the problem is a latency.
|
// problem is a latency.
|
||||||
//
|
//
|
||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
AllowFallbackOnUnknownDC bool
|
AllowFallbackOnUnknownDC bool
|
||||||
|
|
||||||
// UseTestDCs defines if we have to connect to production or to staging
|
// UseTestDCs defines if we have to connect to production or to staging DCs of
|
||||||
// DCs of Telegram.
|
// Telegram.
|
||||||
//
|
//
|
||||||
// This is required if you use mtglib as an integration library for
|
// This is required if you use mtglib as an integration library for your
|
||||||
// your Telegram-related projects.
|
// Telegram-related projects.
|
||||||
//
|
//
|
||||||
// This is an optional setting.
|
// This is an optional setting.
|
||||||
UseTestDCs bool
|
UseTestDCs bool
|
||||||
|
|||||||
+17
-18
@@ -17,28 +17,27 @@ var secretEmptyKey [SecretKeyLength]byte
|
|||||||
// "ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d".
|
// "ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d".
|
||||||
// Actually, this is a serialized datastructure of 2 parts: key and host.
|
// Actually, this is a serialized datastructure of 2 parts: key and host.
|
||||||
//
|
//
|
||||||
// ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d
|
// ee367a189aee18fa31c190054efd4a8e9573746f726167652e676f6f676c65617069732e636f6d
|
||||||
// |-|-------------------------------|-------------------------------------------
|
// |-|-------------------------------|-------------------------------------------
|
||||||
// p key hostname
|
// p key hostname
|
||||||
//
|
//
|
||||||
// Serialized secret starts with 'ee'. Actually, in the past we also had
|
// Serialized secret starts with 'ee'. Actually, in the past we also had 'dd'
|
||||||
// 'dd' secrets and prefixless ones. But this is history. Currently,
|
// secrets and prefixless ones. But this is history. Currently, we do have only
|
||||||
// we do have only 'ee' secrets which mean faketls + protection from
|
// 'ee' secrets which mean faketls + protection from statistical attacks on a
|
||||||
// statistical attacks on a length. 'ee' is a byte 238 (0xee).
|
// length. 'ee' is a byte 238 (0xee).
|
||||||
//
|
//
|
||||||
// After that, we have 16 bytes of the key. This is a random generated
|
// After that, we have 16 bytes of the key. This is a random generated secret
|
||||||
// secret data of the proxy and this data is used to derive
|
// data of the proxy and this data is used to derive authentication schemas.
|
||||||
// authentication schemas. These secrets are mixed into hmacs and sha256
|
// These secrets are mixed into hmacs and sha256 checksums which are used to
|
||||||
// checksums which are used to build AEAD ciphers for obfuscated2
|
// build AEAD ciphers for obfuscated2 protocol and ensure faketls handshake.
|
||||||
// protocol and ensure faketls handshake.
|
|
||||||
//
|
//
|
||||||
// Host is a domain fronting hostname in latin1 (ASCII) encoding. This
|
// Host is a domain fronting hostname in latin1 (ASCII) encoding. This hostname
|
||||||
// hostname should be used for SNI in faketls and MTG verifies it. Also,
|
// should be used for SNI in faketls and MTG verifies it. Also, this is when
|
||||||
// this is when mtg gets about a domain fronting hostname.
|
// mtg gets about a domain fronting hostname.
|
||||||
//
|
//
|
||||||
// Secrets can be serialized into 2 forms: hex and base64. If
|
// Secrets can be serialized into 2 forms: hex and base64. If you decode both
|
||||||
// you decode both forms into bytes, you'll get the same byte array.
|
// forms into bytes, you'll get the same byte array. Telegram clients nowadays
|
||||||
// Telegram clients nowadays accept all forms.
|
// accept all forms.
|
||||||
type Secret struct {
|
type Secret struct {
|
||||||
// Key is a set of bytes used for traffic authentication.
|
// Key is a set of bytes used for traffic authentication.
|
||||||
Key [SecretKeyLength]byte
|
Key [SecretKeyLength]byte
|
||||||
|
|||||||
+32
-42
@@ -1,20 +1,16 @@
|
|||||||
// Network contains a default implementation of the network.
|
// Network contains a default implementation of the network.
|
||||||
//
|
//
|
||||||
// Please see mtglib.Network interface to get some basic idea behind
|
// Please see [mtglib.Network] interface to get some basic idea behind this
|
||||||
// this abstraction.
|
// abstraction.
|
||||||
//
|
//
|
||||||
// Some notable feature of this implementation:
|
// Some notable feature of this implementation:
|
||||||
//
|
//
|
||||||
// 1. It detaches dialer from a network. Dialer is something which
|
// 1. It detaches dialer from a network. Dialer is something which implements a
|
||||||
// implements a real dialer and network completes it with more higher
|
// real dialer and network completes it with more higher level details.
|
||||||
// level details.
|
// 2. It uses only TCP connections. Even for DNS it uses DNS-Over-HTTPS
|
||||||
//
|
// 3. It has some simple implementation of DNS cache which is good enough for
|
||||||
// 2. It uses only TCP connections. Even for DNS it uses DNS-Over-HTTPS
|
// our purpose.
|
||||||
//
|
// 4. It sets uses SO_REUSEPORT port if applicable.
|
||||||
// 3. It has some simple implementation of DNS cache which is good
|
|
||||||
// enough for our purpose.
|
|
||||||
//
|
|
||||||
// 4. It sets uses SO_REUSEPORT port if applicable.
|
|
||||||
package network
|
package network
|
||||||
|
|
||||||
import (
|
import (
|
||||||
@@ -26,53 +22,47 @@ import (
|
|||||||
)
|
)
|
||||||
|
|
||||||
const (
|
const (
|
||||||
// DefaultTimeout is a default timeout for establishing TCP
|
// DefaultTimeout is a default timeout for establishing TCP connection.
|
||||||
// connection.
|
|
||||||
DefaultTimeout = 10 * time.Second
|
DefaultTimeout = 10 * time.Second
|
||||||
|
|
||||||
// DefaultHTTPTimeout defines a default timeout for making HTTP
|
// DefaultHTTPTimeout defines a default timeout for making HTTP request.
|
||||||
// request.
|
|
||||||
DefaultHTTPTimeout = 10 * time.Second
|
DefaultHTTPTimeout = 10 * time.Second
|
||||||
|
|
||||||
// Deprecated:
|
// Deprecated:
|
||||||
//
|
//
|
||||||
// DefaultBufferSize defines a TCP buffer size. Both read and write, so
|
// DefaultBufferSize defines a TCP buffer size. Both read and write, so for
|
||||||
// for real size, please multiply this number by 2.
|
// real size, please multiply this number by 2.
|
||||||
DefaultBufferSize = 16 * 1024 // 16 kib
|
DefaultBufferSize = 16 * 1024 // 16 kib
|
||||||
|
|
||||||
// DefaultTCPKeepAlivePeriod defines a time period between 2
|
// DefaultTCPKeepAlivePeriod defines a time period between 2 consequitive
|
||||||
// consequitive probes.
|
// probes.
|
||||||
DefaultTCPKeepAlivePeriod = 10 * time.Second
|
DefaultTCPKeepAlivePeriod = 10 * time.Second
|
||||||
|
|
||||||
// ProxyDialerOpenThreshold is used for load balancing SOCKS5 dialer
|
// ProxyDialerOpenThreshold is used for load balancing SOCKS5 dialer only.
|
||||||
// only.
|
|
||||||
//
|
//
|
||||||
// This dialer uses circuit breaker with of 3 stages: OPEN,
|
// This dialer uses circuit breaker with of 3 stages: OPEN, HALF_OPEN and
|
||||||
// HALF_OPEN and CLOSED. If state is CLOSED, all requests go in
|
// CLOSED. If state is CLOSED, all requests go in a normal mode. If you get
|
||||||
// a normal mode. If you get more that ProxyDialerOpenThreshold
|
// more that ProxyDialerOpenThreshold errors, circuit breaker goes into OPEN
|
||||||
// errors, circuit breaker goes into OPEN mode.
|
// mode.
|
||||||
//
|
//
|
||||||
// When circuit breaker is in OPEN mode, it forbids all request to
|
// When circuit breaker is in OPEN mode, it forbids all request to a given
|
||||||
// a given proxy. But after ProxyDialerHalfOpenTimeout it gives a
|
// proxy. But after ProxyDialerHalfOpenTimeout it gives a second chance and
|
||||||
// second chance and opens an access for a SINGLE request. If this
|
// opens an access for a SINGLE request. If this request success, then circuit
|
||||||
// request success, then circuit breaker closes, otherwise opens
|
// breaker closes, otherwise opens again.
|
||||||
// again.
|
|
||||||
//
|
//
|
||||||
// When circuit breaker is closed, it clears an error states each
|
// When circuit breaker is closed, it clears an error states each
|
||||||
// ProxyDialerResetFailuresTimeout.
|
// ProxyDialerResetFailuresTimeout.
|
||||||
ProxyDialerOpenThreshold = 5
|
ProxyDialerOpenThreshold = 5
|
||||||
|
|
||||||
// ProxyDialerHalfOpenTimeout defines a halfopen timeout for circuit
|
// ProxyDialerHalfOpenTimeout defines a halfopen timeout for circuit breaker.
|
||||||
// breaker.
|
|
||||||
ProxyDialerHalfOpenTimeout = time.Minute
|
ProxyDialerHalfOpenTimeout = time.Minute
|
||||||
|
|
||||||
// ProxyDialerResetFailuresTimeout defines a timeout for resetting a
|
// ProxyDialerResetFailuresTimeout defines a timeout for resetting a failure.
|
||||||
// failure.
|
|
||||||
ProxyDialerResetFailuresTimeout = 10 * time.Second
|
ProxyDialerResetFailuresTimeout = 10 * time.Second
|
||||||
|
|
||||||
// DefaultDOHHostname defines a default IP address for DOH host.
|
// DefaultDOHHostname defines a default IP address for DOH host. Since mtg is
|
||||||
// Since mtg is simple, please pass IP address here. We do not
|
// simple, please pass IP address here. We do not have bootstrap servers here
|
||||||
// have bootstrap servers here embedded.
|
// embedded.
|
||||||
DefaultDOHHostname = "9.9.9.9"
|
DefaultDOHHostname = "9.9.9.9"
|
||||||
|
|
||||||
// DNSTimeout defines a timeout for DNS queries.
|
// DNSTimeout defines a timeout for DNS queries.
|
||||||
@@ -84,12 +74,12 @@ const (
|
|||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
// ErrCircuitBreakerOpened is returned when proxy is being accessed
|
// ErrCircuitBreakerOpened is returned when proxy is being accessed but
|
||||||
// but circuit breaker is opened.
|
// circuit breaker is opened.
|
||||||
ErrCircuitBreakerOpened = errors.New("circuit breaker is opened")
|
ErrCircuitBreakerOpened = errors.New("circuit breaker is opened")
|
||||||
|
|
||||||
// ErrCannotDialWithAllProxies is returned when load balancing
|
// ErrCannotDialWithAllProxies is returned when load balancing client is
|
||||||
// client is trying to access proxies but all of them are failed.
|
// trying to access proxies but all of them are failed.
|
||||||
ErrCannotDialWithAllProxies = errors.New("cannot dial with all proxies")
|
ErrCannotDialWithAllProxies = errors.New("cannot dial with all proxies")
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|||||||
@@ -33,16 +33,14 @@ func (l loadBalancedSocks5Dialer) DialContext(ctx context.Context, network, addr
|
|||||||
return nil, ErrCannotDialWithAllProxies
|
return nil, ErrCannotDialWithAllProxies
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewLoadBalancedSocks5Dialer builds a new load balancing SOCKS5
|
// NewLoadBalancedSocks5Dialer builds a new load balancing SOCKS5 dialer.
|
||||||
// dialer.
|
|
||||||
//
|
//
|
||||||
// The main difference from one which is made by NewSocks5Dialer is that
|
// The main difference from one which is made by NewSocks5Dialer is that we
|
||||||
// we actually have a list of these proxies. When dial is requested,
|
// actually have a list of these proxies. When dial is requested, any proxy is
|
||||||
// any proxy is picked and used. If proxy fails for some reason, we try
|
// picked and used. If proxy fails for some reason, we try another one.
|
||||||
// another one.
|
|
||||||
//
|
//
|
||||||
// So, it is mostly useful if you have some routes with proxies which
|
// So, it is mostly useful if you have some routes with proxies which are not
|
||||||
// are not always online or having buggy network.
|
// always online or having buggy network.
|
||||||
func NewLoadBalancedSocks5Dialer(baseDialer Dialer, proxyURLs []*url.URL) (Dialer, error) {
|
func NewLoadBalancedSocks5Dialer(baseDialer Dialer, proxyURLs []*url.URL) (Dialer, error) {
|
||||||
dialers := make([]Dialer, 0, len(proxyURLs))
|
dialers := make([]Dialer, 0, len(proxyURLs))
|
||||||
|
|
||||||
|
|||||||
+2
-2
@@ -118,8 +118,8 @@ func (n *network) dnsResolve(protocol, address string) ([]string, error) {
|
|||||||
return ips, nil
|
return ips, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewNetwork assembles an mtglib.Network compatible structure
|
// NewNetwork assembles an mtglib.Network compatible structure based on a
|
||||||
// based on a dialer and given params.
|
// dialer and given params.
|
||||||
//
|
//
|
||||||
// It brings simple DNS cache and DNS-Over-HTTPS when necessary.
|
// It brings simple DNS cache and DNS-Over-HTTPS when necessary.
|
||||||
func NewNetwork(dialer Dialer,
|
func NewNetwork(dialer Dialer,
|
||||||
|
|||||||
+2
-2
@@ -136,8 +136,8 @@ func (s socks5Dialer) connect(conn io.ReadWriter, address string) error {
|
|||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewSocks5Dialer build a new dialer from a given one (so, in theory
|
// NewSocks5Dialer build a new dialer from a given one (so, in theory you can
|
||||||
// you can chain here). Proxy parameters are passed with URI in a form of:
|
// chain here). Proxy parameters are passed with URI in a form of:
|
||||||
//
|
//
|
||||||
// socks5://[user:[password]]@host:port
|
// socks5://[user:[password]]@host:port
|
||||||
func NewSocks5Dialer(baseDialer Dialer, proxyURL *url.URL) (Dialer, error) {
|
func NewSocks5Dialer(baseDialer Dialer, proxyURL *url.URL) (Dialer, error) {
|
||||||
|
|||||||
+1
-1
@@ -1,4 +1,4 @@
|
|||||||
// Stats package has implementations of events.Observers for different
|
// Stats package has implementations of [events.Observer] for different
|
||||||
// monitoring systems.
|
// monitoring systems.
|
||||||
//
|
//
|
||||||
// Observer is a consumer of events produced by mtg. Consumers, defined
|
// Observer is a consumer of events produced by mtg. Consumers, defined
|
||||||
|
|||||||
+3
-4
@@ -139,12 +139,11 @@ func (p prometheusProcessor) Shutdown() {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// PrometheusFactory is a factory of events.Observers which collect
|
// PrometheusFactory is a factory of [events.Observer] which collect
|
||||||
// information in a format suitable for Prometheus.
|
// information in a format suitable for Prometheus.
|
||||||
//
|
//
|
||||||
// This factory can also serve on a given listener. In that case it
|
// This factory can also serve on a given listener. In that case it starts HTTP
|
||||||
// starts HTTP server with a single endpoint - a Prometheus-compatible
|
// server with a single endpoint - a Prometheus-compatible scrape output.
|
||||||
// scrape output.
|
|
||||||
type PrometheusFactory struct {
|
type PrometheusFactory struct {
|
||||||
httpServer *http.Server
|
httpServer *http.Server
|
||||||
|
|
||||||
|
|||||||
+7
-8
@@ -147,13 +147,13 @@ func (s statsdProcessor) Shutdown() {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// StatsdFactory is a factory of events.Observers which dumps
|
// StatsdFactory is a factory of [events.Observer] which dumps information to
|
||||||
// information to statsd.
|
// statsd.
|
||||||
//
|
//
|
||||||
// Please beware that we support ONLY UDP endpoints there. And this
|
// Please beware that we support ONLY UDP endpoints there. And this factory
|
||||||
// factory won't use mtglib.Network so it won't use a proxy if you
|
// won't use [mtglib.Network] so it won't use a proxy if you provide any. If
|
||||||
// provide any. If you need it, I would recommend starting a local
|
// you need it, I would recommend starting a local statsd and route metrics
|
||||||
// statsd and route metrics further by features of the chosen server.
|
// further by features of the chosen server.
|
||||||
type StatsdFactory struct {
|
type StatsdFactory struct {
|
||||||
client *statsd.Client
|
client *statsd.Client
|
||||||
}
|
}
|
||||||
@@ -171,8 +171,7 @@ func (s StatsdFactory) Make() events.Observer {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewStatsd builds an events.ObserverFactory that sends events
|
// NewStatsd builds an [events.ObserverFactory] that sends events to statsd.
|
||||||
// to statsd.
|
|
||||||
//
|
//
|
||||||
// Valid tagFormats are 'datadog', 'influxdb' and 'graphite'.
|
// Valid tagFormats are 'datadog', 'influxdb' and 'graphite'.
|
||||||
func NewStatsd(address string, log logger.StdLikeLogger,
|
func NewStatsd(address string, log logger.StdLikeLogger,
|
||||||
|
|||||||
Reference in New Issue
Block a user