mitmproxy-linux 0.12.15__tar.gz → 0.12.16__tar.gz

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/.github/workflows/autofix.yml

@@ -17,7 +17,7 @@ jobs:
   protobuf:
     runs-on: macos-latest
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       # FIXME: https://github.com/mitmproxy/mitmproxy/issues/7877 - bump SwiftProtobuf and then re-add this here.
       # - run: brew install swift-protobuf
       - run: brew install protobuf
@@ -39,7 +39,7 @@ jobs:
           - os: macos-latest
           - os: ubuntu-latest
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
         with:
           rust-version: ${{ env.MSRV }}

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
     env:
       RUSTFLAGS: ${{ matrix.rust == 'nightly' && '-Zpanic_abort_tests -C panic=abort' || '' }}
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
         with:
           rust-version: ${{ matrix.rust }}
@@ -84,17 +84,17 @@ jobs:
     runs-on: ${{ matrix.os }}
     name: build mitmproxy-rs (${{ matrix.name }})
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
         with:
           extra-targets: ${{ matrix.target }}
 
       - if: runner.os == 'Linux'
         name: Install maturin[zig] from PyPI
-        uses: install-pinned/maturin-with-zig@7f54e6144d8fd17188d0e99742fefc4bcb178e06
+        uses: install-pinned/maturin-with-zig@b10cdafc5d601c9f081acd683e4d9e2cb3538528
       - if: runner.os != 'Linux'
         name: Install maturin from PyPI
-        uses: install-pinned/maturin@3bfd83cd34bdcbcc8a10e459c2a9e41e6c33e706
+        uses: install-pinned/maturin@499d31ac84c34c8a405f267c9cb60fa7d5592e62
 
       - if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         run: python .github/scripts/pin-versions.py
@@ -115,7 +115,7 @@ jobs:
   build-macos-app:
     runs-on: macos-latest
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - if: ${{ !startsWith(github.ref, 'refs/tags/') }}  # harden against cache poisoning
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
         id: cache-app
@@ -141,9 +141,9 @@ jobs:
     runs-on: windows-latest
     name: build mitmproxy-windows
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
-      - uses: install-pinned/build@80919007c59a8977ba4eedf1f3234e73f674aa2e
+      - uses: install-pinned/build@9ff7470d36ff1790990e7c6f16201bc35bfe9a73
 
       - run: cargo build --release --package windows-redirector
 
@@ -158,11 +158,11 @@ jobs:
     needs: build-macos-app
     runs-on: macos-latest
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
         with:
           extra-targets: aarch64-apple-darwin x86_64-apple-darwin
-      - uses: install-pinned/build@80919007c59a8977ba4eedf1f3234e73f674aa2e
+      - uses: install-pinned/build@9ff7470d36ff1790990e7c6f16201bc35bfe9a73
 
       - run: |
           cargo build --release --package macos-certificate-truster --target x86_64-apple-darwin
@@ -192,10 +192,10 @@ jobs:
             args: --compatibility manylinux2014 --zig
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
       - name: Install maturin[zig] from PyPI
-        uses: install-pinned/maturin-with-zig@7f54e6144d8fd17188d0e99742fefc4bcb178e06
+        uses: install-pinned/maturin-with-zig@b10cdafc5d601c9f081acd683e4d9e2cb3538528
       - run: maturin build --release ${{ matrix.args }}
         working-directory: ./mitmproxy-linux
       - run: test -f target/wheels/*-py3-none-*.whl  # ensure we have a universal wheel
@@ -209,7 +209,7 @@ jobs:
     needs: build-linux-wheel
     runs-on: ubuntu-latest
     steps:
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
@@ -226,12 +226,12 @@ jobs:
       - build-windows-wheel
       - build-linux-wheel
       - build-macos-wheel
-    uses: mhils/workflows/.github/workflows/alls-green.yml@e6b54c0368640a2201137f00272b978b51d26268
+    uses: mhils/workflows/.github/workflows/alls-green.yml@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
     with:
       jobs: ${{ toJSON(needs) }}
 
   deploy:
-    uses: mhils/workflows/.github/workflows/python-deploy.yml@e6b54c0368640a2201137f00272b978b51d26268
+    uses: mhils/workflows/.github/workflows/python-deploy.yml@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
     needs: check
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
     with:

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/.github/workflows/docs.yml

@@ -20,11 +20,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # TODO: This should ideally just reuse the main CI artifacts.
-      - uses: mhils/workflows/checkout@e6b54c0368640a2201137f00272b978b51d26268
+      - uses: mhils/workflows/checkout@589b2878317d2d57c315c5825f9a1cfe9c76a7c3
       - uses: ./.github/actions/setup
-      - uses: install-pinned/maturin-with-zig@7f54e6144d8fd17188d0e99742fefc4bcb178e06
-      - uses: install-pinned/mypy@75779f141592e4909d64e13f8a1861f06aa9cd8d
-      - uses: install-pinned/pdoc@69ba59f9699df21e1026110af4ec6b10a98cf5cd
+      - uses: install-pinned/maturin-with-zig@b10cdafc5d601c9f081acd683e4d9e2cb3538528
+      - uses: install-pinned/mypy@ca797a92cfcf502e7c9f5d37f8d2d276778d2774
+      - uses: install-pinned/pdoc@f06d2d4ffa04927fd830d36f5bafba15f02f3932
 
       - run: maturin build --features docs,pyo3/extension-module
         working-directory: ./mitmproxy-rs
@@ -52,4 +52,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/CHANGELOG.md

@@ -1,6 +1,11 @@
 ## Unreleased: mitmproxy_rs next
 
 
+## 14 November 2026: mitmproxy_rs 0.12.16
+
+- Refactor protobuf-YAML conversion, fix missing unknown fields on nested known messages.
+
+
 ## 22 October 2026: mitmproxy_rs 0.12.15
 
 

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/Cargo.lock

@@ -230,7 +230,7 @@ dependencies = [
  "anyhow",
  "cargo_metadata",
  "rustc_version",
- "which 8.0.5",
+ "which 8.0.6",
 ]
 
 [[package]]
@@ -1093,12 +1093,13 @@ checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
- "miniz_oxide",
+ "miniz_oxide 0.9.1",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -1366,9 +1367,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hickory-net"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
+checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d"
 dependencies = [
  "async-trait",
  "cfg-if",
@@ -1390,9 +1391,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
+checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d"
 dependencies = [
  "data-encoding",
  "idna",
@@ -1411,9 +1412,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c"
+checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1437,9 +1438,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-server"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "130236ba6abba90da6a7acf7a87b27d862b592c3145dc74bc47bf86d8ff198ec"
+checksum = "950c2ad9ba2ad35d6890b725baff91305f65b87d7719a6c6071514dc70f13eeb"
 dependencies = [
  "async-trait",
  "bytes",
@@ -1944,9 +1945,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "lru_time_cache"
@@ -1956,7 +1957,7 @@ checksum = "9106e1d747ffd48e6be5bb2d97fa706ed25b144fbee4d5c02eae110cd8d6badd"
 
 [[package]]
 name = "macos-certificate-truster"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "security-framework",
 ]
@@ -2010,6 +2011,16 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.2.2"
@@ -2023,7 +2034,7 @@ dependencies = [
 
 [[package]]
 name = "mitm-wg-test-client"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "boringtun",
@@ -2034,7 +2045,7 @@ dependencies = [
 
 [[package]]
 name = "mitmproxy"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "boringtun",
@@ -2069,7 +2080,7 @@ dependencies = [
 
 [[package]]
 name = "mitmproxy-contentviews"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "criterion",
@@ -2088,7 +2099,7 @@ dependencies = [
 
 [[package]]
 name = "mitmproxy-highlight"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "criterion",
@@ -2102,7 +2113,7 @@ dependencies = [
 
 [[package]]
 name = "mitmproxy-linux"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "aya",
@@ -2127,24 +2138,24 @@ dependencies = [
 
 [[package]]
 name = "mitmproxy-linux-ebpf"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "aya-ebpf",
  "aya-log-ebpf",
  "mitmproxy-linux-ebpf-common",
- "which 8.0.5",
+ "which 8.0.6",
 ]
 
 [[package]]
 name = "mitmproxy-linux-ebpf-common"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "aya-ebpf",
 ]
 
 [[package]]
 name = "mitmproxy_rs"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "boringtun",
@@ -2655,7 +2666,7 @@ dependencies = [
  "crc32fast",
  "fdeflate",
  "flate2",
- "miniz_oxide",
+ "miniz_oxide 0.8.9",
 ]
 
 [[package]]
@@ -2931,9 +2942,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.10.2"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
  "chacha20 0.10.1",
  "getrandom 0.4.3",
@@ -3757,9 +3768,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter"
-version = "0.26.12"
+version = "0.26.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83c567a8e18ae93f20982c90370b16fd24023aeaf52f6052b96957ab253a0fec"
+checksum = "17ebdd3a5a7e28a1890b876fdbd0c3c0fe0a6336cffaa104f11b9f720c9daa29"
 dependencies = [
  "cc",
  "regex",
@@ -3781,9 +3792,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter-highlight"
-version = "0.26.12"
+version = "0.26.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12bf7c298789885e63e7c1c9c86976875136064d23f541007bae3a02a23a74f9"
+checksum = "662316ecd27166f79e18865429638c05194aee76a7bc374136d844f05d778f74"
 dependencies = [
  "regex",
  "streaming-iterator",
@@ -4037,9 +4048,9 @@ dependencies = [
 
 [[package]]
 name = "which"
-version = "8.0.5"
+version = "8.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f3ef584124b911bcc3875c2f1472e80f24361ceb789bd1c62b3e9a3df9ff43c"
+checksum = "bae2f2b2b816647a1cab1acc91f5bd20812d53cb344382635ec2181940c8034f"
 dependencies = [
  "libc",
 ]
@@ -4198,7 +4209,7 @@ dependencies = [
 
 [[package]]
 name = "windows-redirector"
-version = "0.12.15"
+version = "0.12.16"
 dependencies = [
  "anyhow",
  "env_logger",
@@ -4567,6 +4578,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
 [[package]]
 name = "zmij"
 version = "1.0.23"

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/Cargo.toml

@@ -6,7 +6,7 @@ authors = [
     "Fabio Valentini <decathorpe@gmail.com>",
     "Maximilian Hils <cargo@maximilianhils.com>",
 ]
-version = "0.12.15"
+version = "0.12.16"
 publish = false
 repository = "https://github.com/mitmproxy/mitmproxy-rs"
 edition = "2024"

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mitmproxy_linux
-Version: 0.12.15
+Version: 0.12.16
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/mitmproxy-macos/version-info.toml

@@ -28,7 +28,7 @@ authors = [
     "Fabio Valentini <decathorpe@gmail.com>",
     "Maximilian Hils <cargo@maximilianhils.com>",
 ]
-version = "0.12.15"
+version = "0.12.16"
 publish = false
 repository = "https://github.com/mitmproxy/mitmproxy-rs"
 edition = "2024"

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/src/network/udp.rs

@@ -144,10 +144,13 @@ impl UdpHandler {
             .unwrap_or(ConnectionId::unassigned_udp());
 
         match self.connections.get_mut(&potential_cid) {
-            Some((state, _)) => {
+            Some((state, _)) if !state.closed => {
                 state.add_packet(packet.payload);
             }
-            None => {
+            // Packets for a closed connection start a new one. Dropping them instead would also
+            // refresh the closed entry, so a client that keeps reusing the same four-tuple (e.g. for
+            // DNS) would never get through again.
+            _ => {
                 let mut state = ConnectionState::default();
                 state.add_packet(packet.payload);
                 let connection_id = self.connection_id_generator.next_id();
@@ -311,6 +314,41 @@ mod tests {
         assert!(rx.blocking_recv().is_err());
     }
 
+    #[test]
+    fn test_receive_after_close_opens_new_connection() {
+        let mut handler = UdpHandler::new();
+        let (events_tx, mut events_rx) = tokio::sync::mpsc::channel(1);
+        let mut receive = |handler: &mut UdpHandler| {
+            let packet = UdpPacket {
+                src_addr: SocketAddr::from_str("10.0.0.1:1").unwrap(),
+                dst_addr: SocketAddr::from_str("10.0.0.53:53").unwrap(),
+                payload: vec![1, 2, 3],
+            };
+            handler.receive_data(packet, TunnelInfo::None, events_tx.try_reserve().unwrap());
+            match events_rx.try_recv() {
+                Ok(TransportEvent::ConnectionEstablished { connection_id, .. }) => {
+                    Some(connection_id)
+                }
+                Err(_) => None,
+            }
+        };
+
+        let first = receive(&mut handler).expect("first packet opens a connection");
+        assert_eq!(
+            receive(&mut handler),
+            None,
+            "same four-tuple reuses the connection"
+        );
+
+        handler.close_connection(first);
+        let second = receive(&mut handler).expect("packet after close opens a new connection");
+        assert_ne!(first, second);
+
+        let (tx, rx) = oneshot::channel();
+        handler.read_data(second, tx);
+        assert_eq!(rx.blocking_recv().unwrap(), vec![1, 2, 3]);
+    }
+
     #[tokio::test]
     async fn test_udp_server_echo() -> anyhow::Result<()> {
         let (commands_tx, commands_rx) = tokio::sync::mpsc::unbounded_channel();

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/src/packet_sources/macos.rs

@@ -247,7 +247,12 @@ impl ConnectionTask {
         loop {
             tokio::select! {
                 _ = self.shutdown.recv() => break,
-                Some(packet) = stream.next(), if state.packet_queue_len() < 10 => {
+                packet = stream.next(), if state.packet_queue_len() < 10 => {
+                    let Some(packet) = packet else {
+                        // extension closed the flow
+                        state.close();
+                        break;
+                    };
                     let packet = ipc::UdpPacket::decode(
                         packet.context("IPC read error")?
                     ).context("invalid IPC message")?;
@@ -393,6 +398,96 @@ impl ConnectionTask {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use tokio::sync::mpsc;
+    use tokio::sync::watch;
+
+    fn udp_handshake() -> NewFlow {
+        NewFlow {
+            message: Some(ipc::new_flow::Message::Udp(UdpFlow {
+                local_address: Some(ipc::Address {
+                    host: "127.0.0.1".into(),
+                    port: 12345,
+                }),
+                tunnel_info: Some(ipc::TunnelInfo {
+                    pid: Some(42),
+                    process_name: Some("test".into()),
+                }),
+            })),
+        }
+    }
+
+    async fn write_handshake(client: &mut UnixStream, handshake: &NewFlow) {
+        let bytes = handshake.encode_to_vec();
+        client.write_u32(bytes.len() as u32).await.unwrap();
+        client.write_all(&bytes).await.unwrap();
+        client.flush().await.unwrap();
+    }
+
+    async fn spawn_connection_task(
+        server: UnixStream,
+    ) -> (
+        tokio::task::JoinHandle<Result<()>>,
+        mpsc::Receiver<TransportEvent>,
+        watch::Sender<()>,
+    ) {
+        let (events_tx, events_rx) = mpsc::channel(16);
+        let (shutdown_tx, shutdown_rx) = shutdown::channel();
+        let handle = tokio::spawn(ConnectionTask::new(server, events_tx, shutdown_rx).run());
+        (handle, events_rx, shutdown_tx)
+    }
+
+    #[tokio::test]
+    async fn udp_eof_before_first_datagram_completes() {
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let (handle, mut events_rx, _shutdown_tx) = spawn_connection_task(server).await;
+
+        write_handshake(&mut client, &udp_handshake()).await;
+        drop(client);
+
+        timeout(Duration::from_secs(1), handle)
+            .await
+            .expect("UDP task hung after redirector EOF before the first datagram")
+            .unwrap()
+            .unwrap();
+
+        assert!(
+            events_rx.try_recv().is_err(),
+            "ConnectionEstablished must not be sent when no datagram arrived"
+        );
+    }
+
+    #[tokio::test]
+    async fn udp_eof_after_first_datagram_completes() {
+        let (mut client, server) = UnixStream::pair().unwrap();
+        let (handle, mut events_rx, _shutdown_tx) = spawn_connection_task(server).await;
+
+        write_handshake(&mut client, &udp_handshake()).await;
+
+        let mut framed = Framed::new(client, LengthDelimitedCodec::new());
+        let packet = ipc::UdpPacket {
+            data: Bytes::from_static(b"hello"),
+            remote_address: Some(ipc::Address {
+                host: "8.8.8.8".into(),
+                port: 53,
+            }),
+        };
+        framed
+            .send(Bytes::from(packet.encode_to_vec()))
+            .await
+            .unwrap();
+        drop(framed);
+
+        timeout(Duration::from_secs(1), handle)
+            .await
+            .expect("UDP task hung after redirector EOF following a datagram")
+            .unwrap()
+            .unwrap();
+
+        match events_rx.try_recv() {
+            Ok(TransportEvent::ConnectionEstablished { .. }) => {}
+            other => panic!("expected ConnectionEstablished, got {other:?}"),
+        }
+    }
 
     async fn spawn_tcp_connection() -> (
         UnixStream,

{mitmproxy_linux-0.12.15 → mitmproxy_linux-0.12.16}/src/packet_sources/wireguard.rs

@@ -1,6 +1,7 @@
 use std::collections::HashMap;
 use std::net::{IpAddr, SocketAddr};
 use std::sync::Arc;
+use std::time::Duration;
 
 use crate::messages::{
     NetworkCommand, NetworkEvent, SmolPacket, TransportCommand, TransportEvent, TunnelInfo,
@@ -10,6 +11,7 @@ use crate::packet_sources::{PacketSourceConf, PacketSourceTask};
 use anyhow::{Context, Result, anyhow};
 use boringtun::noise::{
     Packet, Tunn, TunnResult, errors::WireGuardError, handshake::parse_handshake_anon,
+    rate_limiter::RateLimiter,
 };
 use boringtun::x25519::{PublicKey, StaticSecret};
 use pretty_hex::pretty_hex;
@@ -21,6 +23,7 @@ use tokio::{
         Mutex,
         mpsc::{Receiver, Sender},
     },
+    time::{MissedTickBehavior, interval},
 };
 
 use crate::packet_sources::udp::{create_and_bind_udp_socket, remote_host_closed_conn};
@@ -29,6 +32,10 @@ use crate::shutdown;
 // WireGuard headers are 60 bytes for IPv4 and 80 bytes for IPv6
 const WG_HEADER_SIZE: usize = 80;
 
+/// Number of handshakes per second we accept before answering with cookie replies
+/// (same value as boringtun's own device implementation).
+const HANDSHAKE_RATE_LIMIT: u64 = 100;
+
 /// A WireGuard peer. We keep track of the tunnel state and the peer address.
 pub struct WireGuardPeer {
     tunnel: Tunn,
@@ -59,18 +66,26 @@ impl PacketSourceConf for WireGuardConf {
             add_network_layer(transport_events_tx, transport_commands_rx, shutdown);
 
         // initialize WireGuard server
+        let public_key = PublicKey::from(&self.private_key);
+
+        // If no rate limiter is passed to `Tunn::new`, boringtun creates one per tunnel that only
+        // gets reset from `Tunn::update_timers`, which we never call. Its counter would then
+        // never be reset and all handshakes after the first ten would be answered with cookie
+        // replies. Instead, we share a single rate limiter and reset it ourselves (see `run`).
+        let rate_limiter = Arc::new(RateLimiter::new(&public_key, HANDSHAKE_RATE_LIMIT));
+
         let mut peers_by_idx = HashMap::new();
         let mut peers_by_key = HashMap::new();
-        for public_key in self.peer_public_keys {
+        for peer_public_key in self.peer_public_keys {
             let index = peers_by_idx.len() as u32;
 
             let tunnel = Tunn::new(
                 self.private_key.clone(),
-                public_key,
+                peer_public_key,
                 None,
                 Some(25),
                 index,
-                None,
+                Some(rate_limiter.clone()),
             );
 
             let peer = Arc::new(Mutex::new(WireGuardPeer {
@@ -79,7 +94,7 @@ impl PacketSourceConf for WireGuardConf {
             }));
 
             peers_by_idx.insert(index, peer.clone());
-            peers_by_key.insert(public_key, peer);
+            peers_by_key.insert(peer_public_key, peer);
         }
 
         let socket = create_and_bind_udp_socket(self.listen_addr)?;
@@ -87,13 +102,12 @@ impl PacketSourceConf for WireGuardConf {
 
         log::debug!("WireGuard server listening for UDP connections on {local_addr} ...");
 
-        let public_key = PublicKey::from(&self.private_key);
-
         Ok((
             WireGuardTask {
                 socket,
                 private_key: self.private_key,
                 public_key,
+                rate_limiter,
 
                 peers_by_idx,
                 peers_by_key,
@@ -113,6 +127,7 @@ pub struct WireGuardTask {
     socket: UdpSocket,
     private_key: StaticSecret,
     public_key: PublicKey,
+    rate_limiter: Arc<RateLimiter>,
 
     peers_by_idx: HashMap<u32, Arc<Mutex<WireGuardPeer>>>,
     peers_by_key: HashMap<PublicKey, Arc<Mutex<WireGuardPeer>>>,
@@ -133,9 +148,16 @@ impl PacketSourceTask for WireGuardTask {
 
         let mut udp_buf = vec![0; MAX_PACKET_SIZE];
 
+        // boringtun expects the handshake rate limiter to be reset about once per second.
+        let mut reset_rate_limiter = interval(Duration::from_secs(1));
+        reset_rate_limiter.set_missed_tick_behavior(MissedTickBehavior::Delay);
+
         loop {
             tokio::select! {
                 exit = &mut self.network_task_handle => break exit.context("network task panic")?.context("network task error")?,
+                _ = reset_rate_limiter.tick() => {
+                    self.rate_limiter.reset_count();
+                },
                 // wait for WireGuard packets incoming on the UDP socket
                 r = self.socket.recv_from(udp_buf.as_mut_slice()) => {
                     if remote_host_closed_conn(&r) {