Repository navigation
Add SOCKS5 and HTTP proxy support with direct-connection fallback - #50
Merged
Merged
Conversation
Termgram could only connect directly, so users behind restrictive networks had no way to reach Telegram. Enable grammers-mtsender's proxy feature and extend the vendored connection setup: ConnectionParams::proxy_fallback tries the configured SOCKS5 proxy first with a ten-second timeout and then the same datacenter address directly, falling back only on I/O errors or that timeout. resolve_proxy prefers TERMGRAM_PROXY over the saved preference. The environment value is strict and never falls back; an invalid value disables proxying with a startup warning. The saved preference prefers the proxy but falls back to direct connections when it is unreachable. Pressing p on the sign-in, connecting or fatal screen opens a proxy editor that validates and saves a socks5://host:port URL to settings.conf and restarts the Telegram worker through the existing account-switch path. Pre-connection screens now use the Input keymap context so the shortcut and editor editing work there. Validation: cargo fmt, clippy (-D warnings) and the full test suite pass, including the vendored mtsender unit test; the fallback and the strict environment behavior were verified against a live connection. Amp-Thread-ID: https://ampcode.com/threads/T-01a0c24b-d4c2-707c-86c1-da9f060dd6b7 Co-authored-by: Amp <amp@ampcode.com>
The proxy setting only accepted SOCKS5, but common corporate and personal proxies speak HTTP CONNECT. The vendored mtsender patch negotiates an HTTP CONNECT tunnel for http:// proxy URLs: it resolves the proxy host, sends CONNECT with the optional Proxy-Authorization: Basic header (small local base64 encoder, no new dependency), validates the response status line and keeps the tunnel as a raw stream. Schemes other than socks5 and http are still rejected. Proxy fallback and timeout behavior are unchanged and apply to both schemes. Termgram's validate_proxy and the proxy editor accept both schemes now. Validation: cargo fmt, clippy (-D warnings) and the full test suite pass, including new vendored tests for the response parser, header framing and base64 encoding. Verified end to end through a local HTTP CONNECT proxy with and without credentials: the tunnel carried the Telegram connection to the sign-in screen. Amp-Thread-ID: https://ampcode.com/threads/T-01a0c24b-d4c2-707c-86c1-da9f060dd6b7 Co-authored-by: Amp <amp@ampcode.com>
The proxy timeout and fallback logic in establish_stream referenced ServerAddr::Proxied and PROXY_CONNECT_TIMEOUT without a feature gate, so building grammers-mtsender without its proxy feature (as the CI update-payload test does) failed to compile. Gate those references and move the proxy-only test import into the test to avoid an unused-import warning without the feature. Amp-Thread-ID: https://ampcode.com/threads/T-01a0c24b-d4c2-707c-86c1-da9f060dd6b7 Co-authored-by: Amp <amp@ampcode.com>
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Termgram could only connect directly, so users behind restrictive networks had no way to reach Telegram. The underlying grammers-mtsender supports SOCKS5 behind its
proxyfeature, but Termgram did not enable it and had no UI or configuration for it.Solution
Enable mtsender's
proxyfeature and extend the vendored patch:ConnectionParams::proxy_fallback(vendored addition): the configured proxy is tried first with a ten-second timeout, then the same datacenter address directly. Only I/O errors or that timeout fall back; a proxy that answers but breaks the protocol does not mask the failure. Without the flag, a configured proxy is used exclusively.http://proxy URLs and negotiates a plain HTTP CONNECT tunnel (optionalProxy-Authorization: Basic, response status validated, no new dependencies). Other schemes stay rejected. Reapply notes are invendor/README.md.Application side:
TERMGRAM_PROXY(socks5://host:portorhttp://host:port) overrides the saved preference and is strict: connections never bypass it with a direct fallback, and an invalid value disables proxying for the run with a startup warning.pon the sign-in, connecting, or fatal screen) validates a URL, saves it tosettings.confand restarts the Telegram worker through the existing account-switch path. An empty value connects directly.Debugoutput.Notes for the maintainer
proxy_fallbackoption and the HTTP CONNECT support live in the vendored grammers-mtsender patch per the existingvendor/convention; both would be welcome upstream and the patch is small enough to rebase away once available.Validation
cargo fmt --all -- --check,cargo clippy --locked --all-targets --all-features -- -D warnings,cargo test --locked --all-targets --all-features(275 tests) and the vendored mtsender--libtests pass.proxy=, credential redaction inDebug, the editor save/clear/invalid-input flows, the vendored fallback attempt list, the CONNECT response parser, header framing and the base64 encoder.TERMGRAM_PROXYagainst a dead address fails without fallback; and a local HTTP CONNECT proxy (with and without credentials) carried the connection to the sign-in screen.