@opensoha/contracts 0.1.27 → 0.2.0

package/proxytransport/native_egress_test.go

@@ -0,0 +1,236 @@
+package proxytransport
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/netip"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestNativeScopeResolver(t *testing.T) {
+	// A poison default resolver proves success and rejection never use OS DNS.
+	previous := net.DefaultResolver
+	var defaultCalls atomic.Int32
+	net.DefaultResolver = &net.Resolver{PreferGo: true, Dial: func(context.Context, string, string) (net.Conn, error) {
+		defaultCalls.Add(1)
+		return nil, errors.New("default DNS forbidden")
+	}}
+	t.Cleanup(func() {
+		net.DefaultResolver = previous
+		if defaultCalls.Load() != 0 {
+			t.Errorf("default resolver called %d times", defaultCalls.Load())
+		}
+	})
+
+	if _, err := NewScopeWithResolver(nil, nil, nil); err == nil {
+		t.Fatal("nil resolver accepted")
+	}
+	for _, tc := range []struct {
+		name          string
+		answers       []netip.Addr
+		fail, wantErr bool
+	}{
+		{name: "public", answers: []netip.Addr{netip.MustParseAddr("198.51.100.9")}},
+		{name: "private outside protection", answers: []netip.Addr{netip.MustParseAddr("192.168.1.1")}},
+		{name: "resolver error", fail: true, wantErr: true},
+		{name: "empty", wantErr: true},
+		{name: "invalid", answers: []netip.Addr{{}}, wantErr: true},
+		{name: "protected private", answers: []netip.Addr{netip.MustParseAddr("10.1.2.3")}, wantErr: true},
+		{name: "mixed protected", answers: []netip.Addr{netip.MustParseAddr("198.51.100.9"), netip.MustParseAddr("10.1.2.3")}, wantErr: true},
+		{name: "loopback", answers: []netip.Addr{netip.MustParseAddr("127.0.0.1")}, wantErr: true},
+		{name: "mapped", answers: []netip.Addr{netip.MustParseAddr("::ffff:198.51.100.9")}, wantErr: true},
+		{name: "excess answers", answers: make([]netip.Addr, 33), wantErr: true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := 0
+			type contextKey struct{}
+			ctx := context.WithValue(context.Background(), contextKey{}, true)
+			scope, err := NewScopeWithResolver([]string{"10.0.0.0/8"}, []string{"blocked.invalid"}, func(got context.Context, network, host string) ([]netip.Addr, error) {
+				calls++
+				if got != ctx || network != "ip" || host != "resolver-only.invalid" {
+					t.Fatal("resolver arguments changed")
+				}
+				if tc.fail {
+					return tc.answers, errors.New("resolver denied")
+				}
+				return tc.answers, nil
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			got, err := scope.Resolve(ctx, "RESOLVER-ONLY.invalid.")
+			if (err != nil) != tc.wantErr || calls != 1 {
+				t.Fatalf("got %v, %v calls=%d", got, err, calls)
+			}
+			if !tc.wantErr && got != tc.answers[0] {
+				t.Fatal("injected answer not used")
+			}
+			for _, host := range []string{"blocked.invalid", "sub.blocked.invalid", "bad host", "10.2.3.4"} {
+				if _, err := scope.Resolve(ctx, host); err == nil {
+					t.Fatalf("accepted protected/invalid %s", host)
+				}
+			}
+			if calls != 1 {
+				t.Fatal("protected name/literal reached resolver")
+			}
+		})
+	}
+}
+
+func TestNativeScopeResolverCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	scope, err := NewScopeWithResolver(nil, nil, func(context.Context, string, string) ([]netip.Addr, error) {
+		cancel()
+		return []netip.Addr{netip.MustParseAddr("198.51.100.9")}, nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := scope.Resolve(ctx, "resolver-only.invalid"); err == nil {
+		t.Fatal("canceled resolver accepted")
+	}
+}
+
+func nativeRelayBound(t *testing.T) func(int) []byte {
+	return func(port int) []byte { return append([]byte{1, 0, 0, 0, 0}, packetFixturePort(t, port)...) }
+}
+
+func TestNativeUDPInjectedDialRoundTrip(t *testing.T) {
+	target := realPacketEcho(t)
+	peer := startUpstreamPeer(t, 3, true, nativeRelayBound(t), target)
+	calls := 0
+	var injected *net.UDPConn
+	conn, err := DialSOCKS5UpstreamUDPWithDial(context.Background(), upstreamTestConnect(peer.address), func(ctx context.Context, relay netip.AddrPort) (*net.UDPConn, error) {
+		calls++
+		if ctx.Err() != nil || relay.Addr() != netip.MustParseAddr("127.0.0.1") || relay.Port() == 0 {
+			t.Fatal("dial did not receive approved literal relay")
+		}
+		if _, ok := ctx.Deadline(); !ok {
+			t.Fatal("missing setup deadline")
+		}
+		c, err := (&net.Dialer{}).DialContext(ctx, "udp4", relay.String())
+		if err != nil {
+			return nil, err
+		}
+		injected = packetFixtureAs[*net.UDPConn](t, c)
+		return injected, nil
+	}, netip.MustParseAddr("127.0.0.1"), "", "", target.String(), packetTestLease())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if calls != 1 {
+		t.Fatal("unexpected dial count")
+	}
+	// A packet from a different relay socket must never reach the connected read.
+	spoof, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer closePacketFixture(t, spoof)
+	packet, err := encodeSOCKSDatagram(target.String(), []byte("off-path"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := spoof.WriteToUDP(packet, packetFixtureAs[*net.UDPAddr](t, injected.LocalAddr())); err != nil {
+		t.Fatal(err)
+	}
+	packetRoundTrip(t, conn, []byte("injected UDP"))
+	packetRoundTrip(t, conn, nil)
+	_ = conn.Close()
+	awaitUpstreamClose(t, peer.closed)
+}
+
+func TestNativeUDPInjectedDialRejectsInvalidSockets(t *testing.T) {
+	capture, err := net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer closePacketFixture(t, capture)
+	for _, mode := range []string{"error", "nil", "error with socket", "wrong remote", "wrong family", "unconnected", "canceled"} {
+		t.Run(mode, func(t *testing.T) {
+			peer := startUpstreamPeer(t, 3, true, nativeRelayBound(t), nil)
+			ctx, cancel := context.WithCancel(context.Background())
+			defer cancel()
+			calls := 0
+			var returned *net.UDPConn
+			conn, err := DialSOCKS5UpstreamUDPWithDial(ctx, upstreamTestConnect(peer.address), func(ctx context.Context, relay netip.AddrPort) (*net.UDPConn, error) {
+				calls++
+				if mode == "error" {
+					return nil, errors.New("denied")
+				}
+				if mode == "nil" {
+					return nil, nil
+				}
+				var err error
+				switch mode {
+				case "wrong remote":
+					returned, err = net.DialUDP("udp4", nil, packetFixtureAs[*net.UDPAddr](t, capture.LocalAddr()))
+				case "wrong family":
+					returned, err = net.DialUDP("udp6", nil, &net.UDPAddr{IP: net.IPv6loopback, Port: int(relay.Port())})
+				case "unconnected":
+					returned, err = net.ListenUDP("udp4", &net.UDPAddr{IP: net.IPv4(127, 0, 0, 1)})
+				default:
+					returned, err = net.DialUDP("udp4", nil, net.UDPAddrFromAddrPort(relay))
+				}
+				if err != nil {
+					t.Fatal(err)
+				}
+				if mode == "canceled" {
+					cancel()
+				}
+				if mode == "error with socket" {
+					return returned, errors.New("denied")
+				}
+				return returned, nil
+			}, netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", packetTestLease())
+			if conn != nil {
+				closePacketFixture(t, conn)
+				t.Fatal("invalid callback returned usable connection")
+			}
+			if err == nil || calls != 1 {
+				t.Fatalf("err=%v calls=%d", err, calls)
+			}
+			if returned != nil {
+				if _, err := returned.Write([]byte("must remain unsent")); !errors.Is(err, net.ErrClosed) {
+					t.Fatalf("returned socket was not closed: %v", err)
+				}
+			}
+			awaitUpstreamClose(t, peer.closed)
+		})
+	}
+	_ = capture.SetReadDeadline(time.Now().Add(40 * time.Millisecond))
+	if n, _, err := capture.ReadFromUDP(make([]byte, 64)); err == nil || n != 0 {
+		t.Fatalf("rejected callback sent %d bytes: %v", n, err)
+	}
+}
+
+func TestNativeUDPRejectsBeforeInjectedDial(t *testing.T) {
+	calls := 0
+	dial := func(context.Context, netip.AddrPort) (*net.UDPConn, error) {
+		calls++
+		return nil, errors.New("must not dial")
+	}
+	for _, reply := range [][]byte{{1, 127, 0, 0, 2}, {4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}, append([]byte{3, 9}, []byte("localhost")...)} {
+		peer := startUpstreamPeer(t, 3, true, func(port int) []byte { return append(append([]byte(nil), reply...), packetFixturePort(t, port)...) }, nil)
+		conn, err := DialSOCKS5UpstreamUDPWithDial(context.Background(), upstreamTestConnect(peer.address), dial, netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", packetTestLease())
+		if conn != nil || err == nil {
+			t.Fatal("unapproved relay accepted")
+		}
+		awaitUpstreamClose(t, peer.closed)
+	}
+	connect := func(context.Context) (net.Conn, error) { calls++; return nil, errors.New("must not connect") }
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if c, e := DialSOCKS5UpstreamUDPWithDial(ctx, upstreamTestConnect("127.0.0.1:1"), dial, netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", packetTestLease()); c != nil || e == nil {
+		t.Fatal("canceled context accepted")
+	}
+	if c, e := DialSOCKS5UpstreamUDPWithDial(context.Background(), connect, nil, netip.MustParseAddr("127.0.0.1"), "", "", "198.51.100.2:443", packetTestLease()); c != nil || e == nil {
+		t.Fatal("nil callback accepted")
+	}
+	if calls != 0 {
+		t.Fatal("invalid dependencies/relay reached callback")
+	}
+}

package/proxytransport/probe.go

@@ -21,9 +21,13 @@ func ProbeConnection() net.Conn {
 			return
 		}
 		_ = request.Body.Close()
-		if request.Method != http.MethodGet {
+		if request.Method != http.MethodGet && request.Method != http.MethodHead {
 			return
 		}
+		// Native Mihomo URLTest truncates elapsed time to integral milliseconds
+		// and rejects a successful zero. This fixed floor is health-only
+		// compatibility; this private responder must not supply real RTT data.
+		time.Sleep(2 * time.Millisecond)
 		_, _ = io.WriteString(server, "HTTP/1.1 204 No Content\r\nConnection: close\r\n\r\n")
 	}()
 	return client

package/proxytransport/probe_test.go

@@ -0,0 +1,106 @@
+package proxytransport
+
+import (
+	"bufio"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestProbeConnectionGETAndHEADNoBody(t *testing.T) {
+	const expected = "HTTP/1.1 204 No Content\r\nConnection: close\r\n\r\n"
+	for _, method := range []string{http.MethodGet, http.MethodHead} {
+		t.Run(method, func(t *testing.T) {
+			conn := ProbeConnection()
+			defer closePacketFixture(t, conn)
+			if err := conn.SetDeadline(time.Now().Add(3 * time.Second)); err != nil {
+				t.Fatal(err)
+			}
+			started := time.Now()
+			if _, err := io.WriteString(conn, method+" / HTTP/1.1\r\nHost: private-probe.invalid\r\n\r\n"); err != nil {
+				t.Fatal(err)
+			}
+			raw, err := io.ReadAll(conn)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if elapsed := time.Since(started); elapsed < time.Millisecond {
+				t.Fatalf("private health response rounded to zero milliseconds: %v", elapsed)
+			}
+			if string(raw) != expected {
+				t.Fatalf("response changed: %q", raw)
+			}
+			response, err := http.ReadResponse(bufio.NewReader(strings.NewReader(string(raw))), &http.Request{Method: method})
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer func() {
+				if err := response.Body.Close(); err != nil {
+					t.Errorf("probe response body close: %v", err)
+				}
+			}()
+			body, err := io.ReadAll(response.Body)
+			wantLength := int64(0)
+			if method == http.MethodHead {
+				// HEAD has no body. Without Content-Length the parser records
+				// unknown representation length; do not add that header to 204.
+				wantLength = -1
+			}
+			if err != nil || len(body) != 0 || response.ContentLength != wantLength || response.StatusCode != http.StatusNoContent {
+				t.Fatalf("HTTP semantics status=%d length=%d body=%q err=%v", response.StatusCode, response.ContentLength, body, err)
+			}
+		})
+	}
+}
+func TestProbeConnectionRejectsOtherMethods(t *testing.T) {
+	for _, method := range []string{http.MethodPost, http.MethodPut, http.MethodConnect} {
+		t.Run(method, func(t *testing.T) {
+			conn := ProbeConnection()
+			defer closePacketFixture(t, conn)
+			_ = conn.SetDeadline(time.Now().Add(3 * time.Second))
+			_, err := io.WriteString(conn, method+" / HTTP/1.1\r\nHost: private-probe.invalid\r\nContent-Length: 0\r\n\r\n")
+			if err != nil {
+				t.Fatal(err)
+			}
+			response, err := http.ReadResponse(bufio.NewReader(conn), &http.Request{Method: method})
+			if response != nil {
+				defer func() {
+					if err := response.Body.Close(); err != nil {
+						t.Errorf("probe response body close: %v", err)
+					}
+				}()
+			}
+			if err == nil || response != nil {
+				t.Fatal("unsupported method accepted")
+			}
+		})
+	}
+}
+func TestProbeConnectionBoundsRequestHeaders(t *testing.T) {
+	conn := ProbeConnection()
+	defer closePacketFixture(t, conn)
+	_ = conn.SetDeadline(time.Now().Add(3 * time.Second))
+	written := make(chan error, 1)
+	go func() {
+		_, err := io.WriteString(conn, "HEAD / HTTP/1.1\r\nHost: private-probe.invalid\r\nX-Padding: "+strings.Repeat("x", 17<<10)+"\r\n\r\n")
+		written <- err
+	}()
+	response, err := http.ReadResponse(bufio.NewReader(conn), &http.Request{Method: http.MethodHead})
+	if response != nil {
+		defer func() {
+			if err := response.Body.Close(); err != nil {
+				t.Errorf("probe response body close: %v", err)
+			}
+		}()
+	}
+	if err == nil || response != nil {
+		t.Fatal("oversized headers accepted")
+	}
+	select {
+	case <-written:
+	case <-time.After(3 * time.Second):
+		t.Fatal("oversized probe left writer blocked")
+	}
+}

package/proxytransport/refresh_test.go

@@ -0,0 +1,74 @@
+package proxytransport
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"testing"
+	"time"
+)
+
+type refreshTestConn struct {
+	net.Conn
+	deadline    time.Time
+	deadlineErr error
+	closed      bool
+}
+
+func (c *refreshTestConn) SetDeadline(deadline time.Time) error {
+	if c.deadlineErr != nil {
+		return c.deadlineErr
+	}
+	c.deadline = deadline
+	return nil
+}
+func (c *refreshTestConn) Close() error { c.closed = true; return nil }
+
+func TestHandlerRefreshPrunesClosedConnectionWithoutFailingOtherLease(t *testing.T) {
+	h, err := New(map[string]string{"node": strings.Repeat("p", 32)}, func(context.Context, string, string) (net.Conn, error) { return nil, nil }, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = h.Close() }()
+	// Model a connection closed by node revocation, before its unregister path
+	// acquires h.mu. The wrapped sentinel verifies errors.Is, not error equality.
+	revoked := &refreshTestConn{deadlineErr: fmt.Errorf("deadline: %w", net.ErrClosed), closed: true}
+	retained := &refreshTestConn{}
+	h.connections[revoked] = struct{}{}
+	h.connections[retained] = struct{}{}
+	until := time.Now().Add(2 * time.Minute)
+	if err := h.Refresh(until); err != nil {
+		t.Fatalf("revoked A failed B renewal: %v", err)
+	}
+	if _, exists := h.connections[revoked]; exists {
+		t.Fatal("closed connection not pruned")
+	}
+	if len(h.connections) != 1 || !retained.deadline.Equal(until) || !h.Ready() {
+		t.Fatal("retained B not renewed")
+	}
+	if err := h.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if !retained.closed || h.Refresh(time.Now().Add(time.Minute)) == nil || h.Ready() {
+		t.Fatal("closed handler revived")
+	}
+}
+
+func TestHandlerRefreshPreservesOtherDeadlineFailure(t *testing.T) {
+	h, err := New(map[string]string{"node": strings.Repeat("p", 32)}, func(context.Context, string, string) (net.Conn, error) { return nil, nil }, time.Now().Add(time.Minute))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = h.Close() }()
+	failure := errors.New("deadline update failed")
+	retained := &refreshTestConn{deadlineErr: failure}
+	h.connections[retained] = struct{}{}
+	if err := h.Refresh(time.Now().Add(2 * time.Minute)); !errors.Is(err, failure) {
+		t.Fatalf("deadline failure hidden: %v", err)
+	}
+	if _, exists := h.connections[retained]; !exists {
+		t.Fatal("non-closed connection incorrectly pruned")
+	}
+}

package/proxytransport/scope.go

@@ -8,16 +8,32 @@ import (
 	"strings"
 )
 
+// LookupNetIP resolves names through a trusted, process-owned resolver.
+// It has the same call shape as net.Resolver.LookupNetIP.
+type LookupNetIP func(context.Context, string, string) ([]netip.Addr, error)
+
 type Scope struct {
+	lookup   LookupNetIP
 	prefixes []netip.Prefix
 	hosts    []string
 }
 
 func NewScope(cidrs, hosts []string) (*Scope, error) {
+	return NewScopeWithResolver(cidrs, hosts, func(ctx context.Context, network, host string) ([]netip.Addr, error) {
+		return net.DefaultResolver.LookupNetIP(ctx, network, host)
+	})
+}
+
+// NewScopeWithResolver retains all destination protection checks while using
+// only lookup for names. A nil resolver or lookup failure never falls back.
+func NewScopeWithResolver(cidrs, hosts []string, lookup LookupNetIP) (*Scope, error) {
+	if lookup == nil {
+		return nil, errors.New("proxy resolver unavailable")
+	}
 	if len(cidrs) > 4096 || len(hosts) > 2048 {
 		return nil, errors.New("proxy destination scope exceeds its limit")
 	}
-	scope := &Scope{hosts: append([]string(nil), hosts...)}
+	scope := &Scope{hosts: append([]string(nil), hosts...), lookup: lookup}
 	for _, raw := range cidrs {
 		prefix, err := netip.ParsePrefix(raw)
 		if err != nil || !prefix.Addr().IsGlobalUnicast() || prefix.Addr().Is4In6() || prefix.Bits() == 0 || prefix != prefix.Masked() || prefix.String() != raw {
@@ -50,8 +66,12 @@ func (s *Scope) Resolve(ctx context.Context, host string) (netip.Addr, error) {
 			return netip.Addr{}, errors.New("invalid proxy hostname")
 		}
 		var err error
-		addresses, err = net.DefaultResolver.LookupNetIP(ctx, "ip", host)
-		if err != nil {
+		lookup := s.lookup
+		if lookup == nil { // Preserve the historical zero-value Scope behavior.
+			lookup = net.DefaultResolver.LookupNetIP
+		}
+		addresses, err = lookup(ctx, "ip", host)
+		if err != nil || ctx.Err() != nil {
 			return netip.Addr{}, errors.New("proxy DNS unavailable")
 		}
 	}