421b8a289e
proxy: keepalive will work on macos and other unix too
...
So remove the linux only gate
2026-05-06 22:38:50 +01:00
c4dbaa743b
proxy-server: add tcp_keepalive option
...
Some upstream peers (e.g. QQ Mail's rate-limiter) silently hold a
proxied TCP connection open indefinitely — sending no data, FIN, or RST
— rather than cleanly refusing. Without some kind of timeout
management, the two file descriptors for such a session remain open for
the lifetime of the process, slowly exhausting the kernel's
file-descriptor table and occupying proxy-server worker slots.
This commit configures kernel level keepalive options with reasonable
defaults to detect and close out this class of connection.
Co-authored-by: Wez Furlong <wez@wezfurlong.org >
Closes: https://github.com/KumoCorp/kumomta/pull/509
2026-05-06 21:09:10 +01:00
1690e6526a
refactor: move start_proxy_listener to proxy module
...
We're keeping a reference to it via kumo.start_proxy_listener briefly,
just in case someone is using that live somewhere.
We don't need to changelog this, as this whole feature hasn't
been in a stable tag yet.
refs: https://github.com/KumoCorp/kumomta/pull/472
2026-02-06 07:31:30 +00:00
37111c8036
add auto-gen docs for proxy-server http api and metrics
...
refs: https://github.com/KumoCorp/kumomta/pull/472
2026-02-06 07:11:56 +00:00
18f6f19f10
refactor: fold connections_accepted_for_listener into ProxySessionMetrics
...
refs: https://github.com/KumoCorp/kumomta/pull/472
2026-02-06 07:11:55 +00:00
f898e2a7e6
Add Prometheus metrics to proxy-server
...
Co-authored-by: Wez Furlong <wez@wezfurlong.org >
closes: https://github.com/KumoCorp/kumomta/pull/472
2026-02-06 07:11:27 +00:00
2369162e75
proxy: flip no_splice to use_splice in proxy policy file
...
This option was named `--no-splice` on the command line because that
was the easiest UX there. The negative logic makes it harder to
understand how to enable/disable, so let's flip it and default
use_splice=true.
refs: #459
2026-01-19 07:45:09 +00:00
e18d2b25c1
proxy: refine TcpStream conversion
2026-01-19 07:45:09 +00:00
d62ec9ed76
proxy: fixup config.put in lua callback error case
...
We must only config.put in the success case, otherwise we might
leave a broken lua context in the cache
refs: #459
2026-01-19 07:45:08 +00:00
baa6326dd6
proxy: restore no-splice functionality
2026-01-19 07:45:08 +00:00
c3ed6279d5
feat: add TLS and RFC 1929 auth to KumoProxy
...
Add TLS encryption and username/password authentication support for
the KumoProxy SOCKS5 server, with full Lua configuration capabilities.
Proxy Server Changes:
- Add kumo.start_proxy_listener() Lua function with TLS support
- Add proxy_server_auth_rfc1929 event for Lua-based auth validation
- Return AuthInfo from auth for ACL system integration
- Support optional and required authentication modes
- Maintain backwards-compatible legacy CLI mode (--listen, --timeout-seconds)
Breaking Changes:
- Cache renamed from rfc5321_rustls_config to rustls_client_config
Refs: #451
Closes: 459
2026-01-19 07:45:02 +00:00
5a1efc0c8c
rustfmt
2025-09-18 20:09:48 +01:00
eb54cc74d9
proxy-server: raise NOFILE soft limit to match hard limit
...
This makes the startup behavior consistent with kumod and tsa-daemon,
which can help with "Too many open files" errors in systems without
any explicit tunings for the proxy server.
It is still a good idea to explicitly tune that value up, and it is
something we should put into a systemd unit when we get around to
shipping one of those for the proxy server (#188 )
2025-09-18 15:54:18 +01:00
e3fdcaa628
cargo clippy --fix
2025-04-09 10:26:07 -07:00
18db31f204
Manage all external dependencies at the workspace level
2024-11-13 13:50:27 -07:00
3975afc446
proxy_handler: rustfmt
...
I'm not in-love with how it renders this all on one line,
but it prevents the "broken" fmt from being noisy and in the way.
2024-09-16 18:20:03 -07:00
cb3fd8a5d4
proxy-server: enable compilation on non-Linux platforms
...
tokio-splice does not compile on macOS due to missing libc calls.
2024-09-16 06:32:33 -07:00
b5596183be
proxy-server: simplify passthru implementation
...
We've been trying to run down an issue where a user has reported that
some sessions that are running via the proxy seem to hang waiting for a
response from the peer. The common theme is that the size of the
payload is approximately 1MB in size, and that the proxy is in use.
I haven't been able to get it to reproduce at all, but in looking
carefully at the code here, my splice(2) implementation used a pipe
buffer that was 1MB in size, and doing non-blocking IO outside of
tokio's internals is a bit of a black art, so I'd buy the theory
that we might be getting stuck somewhere if we did fill up that
pipe buffer.
Since I couldn't catch it in the act, I've opted to go for the simple
and safer route here, as a speculative remediation:
* Added a `--no-splice` command line parameter to opt out of using
`splice(2)` completely on Linux so that we can rule out weirdness
with splice completely. The result will have lower theoretical
max throughput, but a simpler internal implementation.
* There now exists a `tokio-splice` crate that has the same
functionality as my own splice_copy code does, but a different
implementation. Adopt that for the `splice(2)` mode.
* Switch away from splitting the stream into read/write halves: there
are now utility functions available in tokio and tokio_splice that
don't require splitting the streams, which further simplifies
the implementation.
2024-07-30 16:32:39 -07:00
8f87f66ea6
proxy: refine error reporting a little bit more
2024-07-15 16:04:59 -07:00
b13ab592e5
kumoproxy: improve diagnostics around connectivity issues
...
Previously we were very tight-lipped. We now will log some
context to the journal for the proxy service for issues that
we couldn't propagate back to the client.
2024-07-15 11:55:00 -07:00
a8b61ce59e
proxy-server: fix missing bind(2) call
...
Somewhat embarrasing really
2024-03-14 17:51:58 -07:00
10d14ed2c1
build(deps): bump the all group with 9 updates
...
Bumps the all group with 9 updates:
| Package | From | To |
| --- | --- | --- |
| [tempfile](https://github.com/Stebalien/tempfile ) | `3.10.0` | `3.10.1` |
| [strum](https://github.com/Peternator7/strum ) | `0.26.1` | `0.26.2` |
| [chrono](https://github.com/chronotope/chrono ) | `0.4.34` | `0.4.35` |
| [clap](https://github.com/clap-rs/clap ) | `4.5.1` | `4.5.2` |
| [reqwest](https://github.com/seanmonstar/reqwest ) | `0.11.24` | `0.11.25` |
| [env_logger](https://github.com/rust-cli/env_logger ) | `0.11.2` | `0.11.3` |
| [log](https://github.com/rust-lang/log ) | `0.4.20` | `0.4.21` |
| [pest](https://github.com/pest-parser/pest ) | `2.7.7` | `2.7.8` |
| [pest_derive](https://github.com/pest-parser/pest ) | `2.7.7` | `2.7.8` |
Updates `tempfile` from 3.10.0 to 3.10.1
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Stebalien/tempfile/compare/v3.10.0...v3.10.1 )
Updates `strum` from 0.26.1 to 0.26.2
- [Release notes](https://github.com/Peternator7/strum/releases )
- [Changelog](https://github.com/Peternator7/strum/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Peternator7/strum/commits )
Updates `chrono` from 0.4.34 to 0.4.35
- [Release notes](https://github.com/chronotope/chrono/releases )
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md )
- [Commits](https://github.com/chronotope/chrono/compare/v0.4.34...v0.4.35 )
Updates `clap` from 4.5.1 to 4.5.2
- [Release notes](https://github.com/clap-rs/clap/releases )
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md )
- [Commits](https://github.com/clap-rs/clap/compare/clap_complete-v4.5.1...v4.5.2 )
Updates `reqwest` from 0.11.24 to 0.11.25
- [Release notes](https://github.com/seanmonstar/reqwest/releases )
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md )
- [Commits](https://github.com/seanmonstar/reqwest/compare/v0.11.24...v0.11.25 )
Updates `env_logger` from 0.11.2 to 0.11.3
- [Release notes](https://github.com/rust-cli/env_logger/releases )
- [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rust-cli/env_logger/compare/v0.11.2...v0.11.3 )
Updates `log` from 0.4.20 to 0.4.21
- [Release notes](https://github.com/rust-lang/log/releases )
- [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rust-lang/log/compare/0.4.20...0.4.21 )
Updates `pest` from 2.7.7 to 2.7.8
- [Release notes](https://github.com/pest-parser/pest/releases )
- [Commits](https://github.com/pest-parser/pest/compare/v2.7.7...v2.7.8 )
Updates `pest_derive` from 2.7.7 to 2.7.8
- [Release notes](https://github.com/pest-parser/pest/releases )
- [Commits](https://github.com/pest-parser/pest/compare/v2.7.7...v2.7.8 )
---
updated-dependencies:
- dependency-name: tempfile
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: strum
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: chrono
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: clap
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: reqwest
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: env_logger
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: log
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: pest
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
- dependency-name: pest_derive
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2024-03-11 07:01:49 -07:00
113eeb5380
build(deps): bump the all group with 13 updates
...
Bumps the all group with 13 updates:
| Package | From | To |
| --- | --- | --- |
| [strum](https://github.com/Peternator7/strum ) | `0.25.0` | `0.26.1` |
| [k9](https://github.com/aaronabramov/k9 ) | `0.11.6` | `0.12.0` |
| [lipsum](https://github.com/mgeisler/lipsum ) | `0.8.2` | `0.9.0` |
| [zstd](https://github.com/gyscos/zstd-rs ) | `0.12.4` | `0.13.0` |
| [tungstenite](https://github.com/snapview/tungstenite-rs ) | `0.20.1` | `0.21.0` |
| [async-channel](https://github.com/smol-rs/async-channel ) | `1.9.0` | `2.1.1` |
| [flume](https://github.com/zesterer/flume ) | `0.10.14` | `0.11.0` |
| [metrics](https://github.com/metrics-rs/metrics ) | `0.20.1` | `0.22.0` |
| [env_logger](https://github.com/rust-cli/env_logger ) | `0.10.2` | `0.11.1` |
| [notify](https://github.com/notify-rs/notify ) | `5.2.0` | `6.1.1` |
| [zstd-safe](https://github.com/gyscos/zstd-rs ) | `6.0.6` | `7.0.0` |
| [which](https://github.com/harryfei/which-rs ) | `4.4.2` | `6.0.0` |
| [git2](https://github.com/rust-lang/git2-rs ) | `0.16.1` | `0.18.1` |
Updates `strum` from 0.25.0 to 0.26.1
- [Release notes](https://github.com/Peternator7/strum/releases )
- [Changelog](https://github.com/Peternator7/strum/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Peternator7/strum/commits/v0.26.1 )
Updates `k9` from 0.11.6 to 0.12.0
- [Commits](https://github.com/aaronabramov/k9/commits )
Updates `lipsum` from 0.8.2 to 0.9.0
- [Release notes](https://github.com/mgeisler/lipsum/releases )
- [Commits](https://github.com/mgeisler/lipsum/compare/0.8.2...0.9.0 )
Updates `zstd` from 0.12.4 to 0.13.0
- [Release notes](https://github.com/gyscos/zstd-rs/releases )
- [Commits](https://github.com/gyscos/zstd-rs/compare/v0.12.4...v0.13.0 )
Updates `tungstenite` from 0.20.1 to 0.21.0
- [Changelog](https://github.com/snapview/tungstenite-rs/blob/master/CHANGELOG.md )
- [Commits](https://github.com/snapview/tungstenite-rs/compare/v0.20.1...v0.21.0 )
Updates `async-channel` from 1.9.0 to 2.1.1
- [Release notes](https://github.com/smol-rs/async-channel/releases )
- [Changelog](https://github.com/smol-rs/async-channel/blob/master/CHANGELOG.md )
- [Commits](https://github.com/smol-rs/async-channel/compare/v1.9.0...v2.1.1 )
Updates `flume` from 0.10.14 to 0.11.0
- [Changelog](https://github.com/zesterer/flume/blob/master/CHANGELOG.md )
- [Commits](https://github.com/zesterer/flume/commits )
Updates `metrics` from 0.20.1 to 0.22.0
- [Changelog](https://github.com/metrics-rs/metrics/blob/main/release.toml )
- [Commits](https://github.com/metrics-rs/metrics/compare/metrics-v0.20.1...metrics-v0.22.0 )
Updates `env_logger` from 0.10.2 to 0.11.1
- [Release notes](https://github.com/rust-cli/env_logger/releases )
- [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md )
- [Commits](https://github.com/rust-cli/env_logger/compare/v0.10.2...v0.11.1 )
Updates `notify` from 5.2.0 to 6.1.1
- [Release notes](https://github.com/notify-rs/notify/releases )
- [Changelog](https://github.com/notify-rs/notify/blob/main/CHANGELOG.md )
- [Commits](https://github.com/notify-rs/notify/commits/notify-6.1.1 )
Updates `zstd-safe` from 6.0.6 to 7.0.0
- [Release notes](https://github.com/gyscos/zstd-rs/releases )
- [Commits](https://github.com/gyscos/zstd-rs/compare/zstd-safe-6.0.6...zstd-safe-7.0.0 )
Updates `which` from 4.4.2 to 6.0.0
- [Release notes](https://github.com/harryfei/which-rs/releases )
- [Changelog](https://github.com/harryfei/which-rs/blob/master/CHANGELOG.md )
- [Commits](https://github.com/harryfei/which-rs/compare/4.4.2...6.0.0 )
Updates `git2` from 0.16.1 to 0.18.1
- [Changelog](https://github.com/rust-lang/git2-rs/blob/master/CHANGELOG.md )
- [Commits](https://github.com/rust-lang/git2-rs/compare/0.16.1...git2-0.18.1 )
---
updated-dependencies:
- dependency-name: strum
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: k9
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: lipsum
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: zstd
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: tungstenite
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: async-channel
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: flume
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: metrics
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: env_logger
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
- dependency-name: notify
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: zstd-safe
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: which
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: all
- dependency-name: git2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: all
...
Signed-off-by: dependabot[bot] <support@github.com >
2024-02-06 19:23:23 -07:00
37e3401584
proxy: now compiles on macos
2023-10-09 10:04:24 -07:00
d843579d1e
refactor: control some dep versions via workspace Cargo.toml
...
This makes it easier to upgrade the version holistically later.
2023-08-17 10:49:25 -07:00
acef2ecab9
Add timeouts to socks server handshake/connection initiation
...
Let's avoid things hanging forever while setting up a connection.
refs: https://github.com/KumoCorp/kumomta/issues/45
2023-05-15 17:55:28 -07:00
beb120fda5
Add a SOCKS5 proxy server implementation
...
This is a pretty tight, lightweight implementation of SOCKS5
intended to be used to facilitate an MTA asking it to bind and
connect.
It uses the splice(2) syscall to avoid kernel/userspace copies
when passing data through, so it should be quite efficient.
refs: https://github.com/KumoCorp/kumomta/issues/45
2023-05-15 17:38:17 -07:00
Wez Furlong
Jack
Aditya Ganti
Kevin Vu
Dirkjan Ochtman
dependabot[bot]