feat(mtproto): add MTProto proxy backend via telemt #61
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine AS builder | ||
|
|
||
| ARG TARGETOS | ||
| ARG TARGETARCH | ||
| ARG TELEMT_REPOSITORY=telemt/telemt | ||
| ARG TELEMT_VERSION=3.4.25 | ||
|
|
||
| RUN apk update && apk add --no-cache make curl tar | ||
|
|
||
| WORKDIR /src | ||
|
|
||
| COPY go* . | ||
| RUN go mod download | ||
|
|
||
| COPY . . | ||
| RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} make NAME=main build | ||
| RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} \ | ||
| TELEMT_REPOSITORY=${TELEMT_REPOSITORY} TELEMT_VERSION=${TELEMT_VERSION} \ | ||
| make install_telemt | ||
|
|
||
| FROM alpine:latest | ||
|
|
||
| LABEL org.opencontainers.image.source="https://github.com/PasarGuard/node" | ||
|
|
||
| RUN apk update && apk add --no-cache ca-certificates \ | ||
| && addgroup -S pgnode \ | ||
| && adduser -S -G pgnode pgnode \ | ||
| && mkdir -p /var/lib/pg-node/generated /var/lib/pg-node/certs \ | ||
| && chown -R pgnode:pgnode /var/lib/pg-node | ||
|
|
||
| WORKDIR /app | ||
| COPY --from=builder /src/main /app/main | ||
| COPY --from=builder /usr/local/bin/telemt /usr/local/bin/telemt | ||
| RUN chown pgnode:pgnode /app/main /usr/local/bin/telemt | ||
|
|
||
| USER pgnode | ||
| ENTRYPOINT ["./main"] | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,275 @@ | ||
| package mtproto | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "encoding/json" | ||
| "errors" | ||
| "fmt" | ||
| "io" | ||
| "net/http" | ||
| "net/url" | ||
| "strings" | ||
| "time" | ||
| ) | ||
|
|
||
| type apiClient struct { | ||
| baseURL string | ||
| authHeader string | ||
| httpClient *http.Client | ||
| } | ||
|
|
||
| type apiSuccessResponse[T any] struct { | ||
| OK bool `json:"ok"` | ||
| Data T `json:"data"` | ||
| Revision string `json:"revision"` | ||
| Error *apiErrorBody `json:"error,omitempty"` | ||
| } | ||
|
|
||
| type apiErrorResponse struct { | ||
| OK bool `json:"ok"` | ||
| Error *apiErrorBody `json:"error"` | ||
| Request uint64 `json:"request_id"` | ||
| Revision string `json:"revision"` | ||
| } | ||
|
|
||
| type apiErrorBody struct { | ||
| Code string `json:"code"` | ||
| Message string `json:"message"` | ||
| } | ||
|
|
||
| type telemtUserInfo struct { | ||
| Username string `json:"username"` | ||
| InRuntime bool `json:"in_runtime"` | ||
| CurrentConnections uint64 `json:"current_connections"` | ||
| ActiveUniqueIPsList []string `json:"active_unique_ips_list"` | ||
| RecentUniqueIPsList []string `json:"recent_unique_ips_list"` | ||
| ActiveUniqueIPs int `json:"active_unique_ips"` | ||
| RecentUniqueIPs int `json:"recent_unique_ips"` | ||
| UserAdTag string `json:"user_ad_tag"` | ||
| MaxTCPConns int `json:"max_tcp_conns"` | ||
| MaxUniqueIPs int `json:"max_unique_ips"` | ||
| TotalOctets uint64 `json:"total_octets"` | ||
| } | ||
|
|
||
| type telemtHealth struct { | ||
| Status string `json:"status"` | ||
| ReadOnly bool `json:"read_only"` | ||
| } | ||
|
|
||
| type telemtCreateUserRequest struct { | ||
| Username string `json:"username"` | ||
| Secret string `json:"secret,omitempty"` | ||
| UserAdTag string `json:"user_ad_tag,omitempty"` | ||
| MaxTCPConns *int `json:"max_tcp_conns,omitempty"` | ||
| MaxUniqueIPs *int `json:"max_unique_ips,omitempty"` | ||
| } | ||
|
|
||
| // telemtPatchUserRequest uses JSON Merge Patch: omitted fields are unchanged, | ||
| // JSON null removes the per-user override, and a value sets it. omitempty is | ||
| // therefore not used on the clearable fields. | ||
| type telemtPatchUserRequest struct { | ||
| Secret string `json:"secret,omitempty"` | ||
| UserAdTag *string `json:"user_ad_tag"` | ||
| MaxTCPConns *int `json:"max_tcp_conns"` | ||
| MaxUniqueIPs *int `json:"max_unique_ips"` | ||
| } | ||
|
Comment on lines
+71
to
+76
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== client.go around telemtPatchUserRequest ==\n'
sed -n '60,110p' backend/mtproto/client.go
printf '\n== buildPatchUserRequest ==\n'
sed -n '160,210p' backend/mtproto/client.go
printf '\n== mtproto.go around upsertUser ==\n'
sed -n '1,220p' backend/mtproto/mtproto.go
printf '\n== search for PatchUser / telemtPatchUserRequest usage ==\n'
rg -n "PatchUser|telemtPatchUserRequest|buildPatchUserRequest|UpdateUsers|upsertUser" backend/mtprotoRepository: PasarGuard/node Length of output: 9240 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== runtimeUser definition and transforms ==\n'
rg -n "type runtimeUser|func .*runtimeUser|optionalPositive|ExpirationRFC3339|UserAdTag|MaxTCPConns|MaxUniqueIPs|DataQuotaBytes" backend/mtproto/client.go backend/mtproto/mtproto.go backend/mtproto/*.go
printf '\n== buildNextDesiredLocked / applyFullDesiredLocked / upsertUser ==\n'
sed -n '300,430p' backend/mtproto/mtproto.go
printf '\n== any clear/reset/delete calls in apiClient ==\n'
rg -n "CreateUser|PatchUser|DeleteUser|Reset|Clear|UpdateUser" backend/mtproto/*.goRepository: PasarGuard/node Length of output: 16123 🏁 Script executed: #!/bin/bash
set -euo pipefail
sed -n '209,285p' backend/mtproto/config.goRepository: PasarGuard/node Length of output: 2549 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== search for telemt API docs / handlers ==\n'
rg -n "PatchUser|patch user|user_ad_tag|max_tcp_conns|expiration_rfc3339|data_quota_bytes|max_unique_ips|omitempty" -g '!**/*_test.go' .
printf '\n== list likely doc files ==\n'
git ls-files | rg '(^|/)(README|docs|openapi|swagger|api|telemt|mtproto).*'Repository: PasarGuard/node Length of output: 17128 PATCH drops explicit clears for runtime limits 🤖 Prompt for AI Agents |
||
|
|
||
| type apiStatusError struct { | ||
| StatusCode int | ||
| Code string | ||
| Message string | ||
| } | ||
|
|
||
| func (e *apiStatusError) Error() string { | ||
| message := strings.TrimSpace(e.Message) | ||
| if message != "" { | ||
| return message | ||
| } | ||
| if e.Code != "" { | ||
| return e.Code | ||
| } | ||
| return fmt.Sprintf("telemt API request failed with status %d", e.StatusCode) | ||
| } | ||
|
|
||
| func (e *apiStatusError) NotFound() bool { | ||
| return e.StatusCode == http.StatusNotFound || e.Code == "not_found" | ||
| } | ||
|
|
||
| func newAPIClient(baseURL, authHeader string) *apiClient { | ||
| return &apiClient{ | ||
| baseURL: strings.TrimRight(baseURL, "/"), | ||
| authHeader: authHeader, | ||
| httpClient: &http.Client{ | ||
| Timeout: 10 * time.Second, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func (c *apiClient) Health(ctx context.Context) error { | ||
| _, err := doAPIRequest[telemtHealth](ctx, c, http.MethodGet, "/v1/health", nil) | ||
| return err | ||
| } | ||
|
|
||
| func (c *apiClient) GetUser(ctx context.Context, username string) (*telemtUserInfo, error) { | ||
| escapedUsername := url.PathEscape(username) | ||
| user, err := doAPIRequest[telemtUserInfo](ctx, c, http.MethodGet, "/v1/users/"+escapedUsername, nil) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return user, nil | ||
| } | ||
|
|
||
| func (c *apiClient) CreateUser(ctx context.Context, user *runtimeUser) error { | ||
| request, err := buildCreateUserRequest(user) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| _, err = doAPIRequest[telemtUserInfo](ctx, c, http.MethodPost, "/v1/users", request) | ||
| return err | ||
| } | ||
|
|
||
| func (c *apiClient) PatchUser(ctx context.Context, username string, user *runtimeUser) error { | ||
| request, err := buildPatchUserRequest(user) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| _, err = doAPIRequest[telemtUserInfo](ctx, c, http.MethodPatch, "/v1/users/"+url.PathEscape(username), request) | ||
| return err | ||
| } | ||
|
|
||
| func (c *apiClient) DeleteUser(ctx context.Context, username string) error { | ||
| _, err := doAPIRequest[map[string]any](ctx, c, http.MethodDelete, "/v1/users/"+url.PathEscape(username), nil) | ||
| return err | ||
| } | ||
|
|
||
| func buildCreateUserRequest(user *runtimeUser) (*telemtCreateUserRequest, error) { | ||
| maxTCPConns, err := optionalPositiveInt(user.MaxTCPConns, "max_tcp_conns") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| maxUniqueIPs, err := optionalPositiveInt(user.MaxUniqueIPs, "max_unique_ips") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| request := &telemtCreateUserRequest{ | ||
| Username: user.Username, | ||
| Secret: user.Secret, | ||
| UserAdTag: user.UserAdTag, | ||
| MaxTCPConns: maxTCPConns, | ||
| MaxUniqueIPs: maxUniqueIPs, | ||
| } | ||
| return request, nil | ||
| } | ||
|
|
||
| func buildPatchUserRequest(user *runtimeUser) (*telemtPatchUserRequest, error) { | ||
| if user == nil { | ||
| return nil, errors.New("mtproto user is nil") | ||
| } | ||
|
|
||
| maxTCPConns, err := optionalPositiveInt(user.MaxTCPConns, "max_tcp_conns") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| maxUniqueIPs, err := optionalPositiveInt(user.MaxUniqueIPs, "max_unique_ips") | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| request := &telemtPatchUserRequest{ | ||
| Secret: user.Secret, | ||
| MaxTCPConns: maxTCPConns, | ||
| MaxUniqueIPs: maxUniqueIPs, | ||
| } | ||
| if user.UserAdTag != "" { | ||
| tag := user.UserAdTag | ||
| request.UserAdTag = &tag | ||
| } | ||
| return request, nil | ||
| } | ||
|
|
||
| func optionalPositiveInt(value uint32, field string) (*int, error) { | ||
| if value == 0 { | ||
| return nil, nil | ||
| } | ||
| maxInt := int(^uint(0) >> 1) | ||
| if uint64(value) > uint64(maxInt) { | ||
| return nil, fmt.Errorf("mtproto field %s exceeds native int range", field) | ||
| } | ||
| converted := int(value) | ||
| return &converted, nil | ||
| } | ||
|
|
||
| func doAPIRequest[T any](ctx context.Context, client *apiClient, method, path string, body any) (*T, error) { | ||
| if client == nil { | ||
| return nil, errors.New("mtproto api client is nil") | ||
| } | ||
|
|
||
| var requestBody io.Reader | ||
| if body != nil { | ||
| encoded, err := json.Marshal(body) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to encode mtproto api request: %w", err) | ||
| } | ||
| requestBody = bytes.NewReader(encoded) | ||
| } | ||
|
|
||
| request, err := http.NewRequestWithContext(ctx, method, client.baseURL+path, requestBody) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if body != nil { | ||
| request.Header.Set("Content-Type", "application/json") | ||
| } | ||
| if client.authHeader != "" { | ||
| request.Header.Set("Authorization", client.authHeader) | ||
| } | ||
|
|
||
| response, err := client.httpClient.Do(request) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| defer response.Body.Close() | ||
|
|
||
| payload, err := io.ReadAll(response.Body) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| if response.StatusCode < http.StatusOK || response.StatusCode >= http.StatusMultipleChoices { | ||
| var failure apiErrorResponse | ||
| if json.Unmarshal(payload, &failure) == nil && failure.Error != nil { | ||
| return nil, &apiStatusError{ | ||
| StatusCode: response.StatusCode, | ||
| Code: failure.Error.Code, | ||
| Message: failure.Error.Message, | ||
| } | ||
| } | ||
| return nil, &apiStatusError{ | ||
| StatusCode: response.StatusCode, | ||
| Message: strings.TrimSpace(string(payload)), | ||
| } | ||
| } | ||
|
|
||
| var success apiSuccessResponse[T] | ||
| if err := json.Unmarshal(payload, &success); err != nil { | ||
| return nil, fmt.Errorf("failed to decode mtproto api response: %w", err) | ||
| } | ||
| if !success.OK { | ||
| if success.Error != nil { | ||
| return nil, &apiStatusError{ | ||
| StatusCode: response.StatusCode, | ||
| Code: success.Error.Code, | ||
| Message: success.Error.Message, | ||
| } | ||
| } | ||
| return nil, &apiStatusError{ | ||
| StatusCode: response.StatusCode, | ||
| Message: "telemt api returned ok=false", | ||
| } | ||
| } | ||
|
|
||
| return &success.Data, nil | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Drop root in the runtime stage.
The final image never switches away from root, so a compromise in either
mainortelemtgets full root privileges inside the container. Add a dedicated runtime user here; if you need privileged ports, grant onlyCAP_NET_BIND_SERVICEat deploy time instead of keeping the whole container root.🤖 Prompt for AI Agents
Source: Linters/SAST tools