Skip to content

v1.4.1-LTS

Latest
Latest

Choose a tag to compare

View all tags
@SamNet-dev SamNet-dev released this 15 Sep 21:34
v1.4.1-LTS
bef2425

🛡️ MTProxyMax v1.4.1-LTS Release Notes & Architectural Blueprint

Version: v1.4.1-LTS
Codename: Enterprise Hardening, Multi-Instance Isolation & Telemt 3.5.7
Status: Long Term Support (LTS) — Maintenance & Production Stability Release

🌟 Executive Summary

MTProxyMax v1.4.1-LTS builds upon the enterprise foundation established in v1.4.0-LTS, delivering two months of rigorous stability hardening, multi-instance isolation, security enhancements, and core engine evolutions.

This release resolves critical deployment hurdles across container environments—including eliminating secondary instance port collision crash-loops (AddrInUse), ensuring seamless zero-downtime hot reloads via in-place config generation, enforcing strict Role-Based Access Control (RBAC) across reseller tiers in the Telegram bot, and providing native OpenRC init service support for lightweight environments such as Alpine Linux. Furthermore, the core Rust engine is upgraded to telemt 3.5.7, bringing enhanced TCP probe validation and resilient websocket connection recovery.

🚀 Key Highlights & Enterprise Enhancements of v1.4.1 LTS

1. ⚙️ Telemt Core Engine v3.5.7 (4ca7418)

  • Upstream Integration: Pinned to the latest stable release of the high-performance Rust proxy engine (telemt 3.5.7 Wirtschaftsvertreter).
  • Websocket Lane Recovery: Automatically recovers and cleans stale websocket connection lanes after proxy reloads/restarts (#923).
  • Target Port Validation: Hardened target port probing to evaluate only TCP listeners (#919), avoiding false-negative UDP artifacts.
  • Automated Multi-Arch Pipeline: Pre-built Docker images for amd64 and arm64 published via GitHub Container Registry (ghcr.io/samnet-dev/mtproxymax-telemt:latest).

2. 🔀 Multi-Instance Port Pair Isolation (instance)

  • Technology: Atomic pair reservation for telemetry listeners [p, p + 1].
  • Mechanism: In telemt, each running proxy binds two distinct ports: a Prometheus scraper port (metrics_listen) and an internal stats port (stats_listen / internal_stats_listen = metrics + 1). Previously, candidate allocation checked only metrics ports, causing newly added instances to collide with the primary proxy's stats port (9091) and enter an immediate AddrInUse (code 98) crash loop.
  • Resolution: _next_free_metrics_port() now treats every listener as an atomic pair [p, p + 1]. The first instance on a default installation is assigned 9092 (occupying 9092 & 9093), leaving primary 9090 and 9091 collision-free. Subsequent instances cleanly advance (9094, 9096, etc.), and port range exhaustion (9091-9199) is handled gracefully (#135).
  • CLI Command: mtproxymax instance add <port> [label]

3. 🛡️ Masking Backend Precedence & Routing Loop Defense (mask-backend)

  • Precedence Guarantee: Explicit MASKING_HOST and MASKING_PORT configurations now take strict precedence in generate_telemt_config(), preserving custom backends even when Cover Shield is active (#128).
  • Bidirectional Synchronization: Full synchronization between mtproxymax mask-backend <host:port>, Settings menu [m], and mtproxymax cover-shield target <url>.
  • Routing Loop Guard: Emits prominent warnings if the configured masking backend targets the proxy's own listen port on 127.0.0.1, localhost, or public IP (CUSTOM_IP), preventing TLS probe amplification loops.
  • Domain Secret Preservation: Changed FakeTLS domain rotation prompt to [y/N] (No by default), requiring an explicit --rotate flag in non-interactive CLI workflows to preserve active user secrets.

4. 🔄 In-Place Hot-Reload & Inode Preservation (reload)

  • Technology: In-place configuration writes (> "$CONFIG_DIR/config.toml") and directory bind mounts (-v "${CONFIG_DIR}:/etc/telemt:ro").
  • Mechanism: Resolves container configuration detaching where cp or atomic rename recreated the inode while the running container kept reading the unlinked original file (#134 / #133).
  • Live Engine Verification: Added _engine_config_in_sync() to verify live container configuration matching via /proc/<pid>/root, falling back gracefully to a container restart if stale.

5. 🔐 Telegram Bot Reseller RBAC Hardening (telegram)

  • Technology: Fail-closed Role-Based Access Control (RBAC) in mtproxymax-telegram.sh.
  • Mechanism: Enforces documented privilege boundaries for reseller accounts (#132 / #131). Resellers are strictly isolated to /mp_voucher management and public self-service commands, with all admin control plane commands (/mp_status, /mp_restart, /mp_secrets, /mp_link, /mp_add, /reply, etc.) blocked.
  • Security Auditing: Unauthorized access attempts trigger localized denial notices to the requester and record security violation notices to /opt/mtproxymax/audit.log.

6. 🏔️ Alpine Linux & OpenRC Service Management

  • Technology: Supervised OpenRC init scripts under /etc/init.d/.
  • Mechanism: Automatically generates /etc/init.d/mtproxymax-telegram supervised by supervise-daemon (with auto-respawn and isolated .err logs) and /etc/init.d/mtproxymax for autostart on non-systemd systems (#130 / #129).
  • CLI & Service Commands: Unified lifecycle management across systemd, openrc, and standalone environments.

7. 📊 LXC Virtualized RAM Detection & Resource Controls (resources)

  • Multi-Tier Detection: Resolves low-memory crashes on LXC/Proxmox containers (#127) by prioritizing container memory ceilings (/var/lib/lxcfs/proc/meminfo, cgroups v1 memory.limit_in_bytes, cgroups v2 memory.max) over the physical host's RAM.
  • Resource Controls: Added mtproxymax resources status, mtproxymax resources set <cpus> <mem>, and mtproxymax resources clear with interactive confirmation and non-interactive scripting flags.

8. 🔍 Upload Mechanism Diagnostics (upload-test)

  • Technology: Comprehensive network socket and QoS queue inspection (#126).
  • CLI Command: mtproxymax upload-test
  • Coverage: Audits kernel wmem_max socket buffers, BBR congestion control parameters, Linux tc QoS upload shaping rules, and engine client_mss clamping with actionable performance recommendations.

🛠️ Architecture & Compatibility Summary

Component Status / Version in v1.4.1-LTS Notes
Core Engine Telemt 3.5.7 (4ca7418) Multi-arch Docker (amd64, arm64)
Init Systems systemd, openrc, standalone Auto-detected with supervised daemons
Multi-Instance Pair-wise disjoint allocation Metrics (p) & Stats (p + 1) collision-free
Hot Reload In-place inode preservation Validated via /proc/<pid>/root
Telegram RBAC Strict dual-tier (Admin / Reseller) Fail-closed with audit.log
RAM Auto-Tune Multi-tier container ceiling detection LXCFS, cgroups v1/v2, Proxmox aware

🛡️ Comprehensive Audit & Bug Fix Summary

  • Atomic Settings Changes (#125): Restart-requiring settings (port, IPv4/IPv6 bind addresses, FakeTLS domain) are grouped into atomic transactional prompts, preventing configuration divergence when a restart is declined.
  • Traffic Accounting Synchronization (#121 / #123): Added mtproxymax traffic reset-global and synchronized reset signals with the Telegram background daemon.
  • Guest Access Hardening (#120): Fixed label preservation and access limit enforcement on temporary guest access secrets (mtproxymax guest).
  • Telemt client_mss Tuning (#124 / #118 / #102): Added CLI controls (mtproxymax client-mss status|off|tspu|<bytes>) and normalized settings persistence.
  • Telegram Parser Resilience (#117): Added missing exception guards in Telegram JSON parsing routines to prevent daemon crashes on malformed updates.
  • Container Health & Auto-Healer Hardening: Hardened drop_caches invocation against read-only target filesystems, sanitized socket counter formatting, and safeguarded D-Bus recovery routines.

📋 Verification & Testing Checklist

All changes in v1.4.1-LTS have been verified across 13 automated test suites:

  1. tests/test_instance_metrics_ports.sh (17 assertions — port pair allocation & exhaustion)
  2. tests/test_masking_backend.sh (22 assertions — precedence & loop guards)
  3. tests/test_hot_reload_inode.sh (13 assertions — in-place config & reload sync)
  4. tests/test_telegram_reseller_rbac.sh (62 assertions — strict reseller RBAC)
  5. tests/test_telegram_service_openrc.sh (54 assertions — OpenRC service lifecycle)
  6. tests/test_traffic_reset.sh (24 assertions — global traffic reset & daemon sync)
  7. tests/test_replication.sh (112 assertions — multi-node replication & config integrity)
  8. tests/test_secret_command_status.sh (7 assertions — secret lifecycle error propagation)
  9. tests/test_settings_restart.sh (15 assertions — atomic settings confirmation)
  10. tests/test_upload_diagnostics.sh (8 assertions — upload audit pipeline)
  11. tests/test_guest.sh (13 assertions — guest duration & quota enforcement)
  12. tests/test_client_mss.sh (client_mss parsing & generation)
  13. tests/test_lxc_ram_and_resources.sh (LXC memory auto-tuning & CLI controls)

📥 Quick Upgrade

To update an existing installation to v1.4.1-LTS:

mtproxymax update

Or re-run the universal one-line installer:

bash <(curl -sL https://raw.githubusercontent.com/SamNet-dev/MTProxyMax/main/mtproxymax.sh)
Assets 2
Loading