refactor: check proxy validity via donut-proxy

src-tauri/tests/donut_proxy_integration.rs

@@ -1121,3 +1121,224 @@ async fn test_no_bypass_rules_all_through_upstream(
 
   Ok(())
 }
+
+/// Start a minimal SOCKS5 proxy that tunnels connections to the real destination.
+/// Returns (port, JoinHandle).
+async fn start_mock_socks5_server() -> (u16, tokio::task::JoinHandle<()>) {
+  let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+  let port = listener.local_addr().unwrap().port();
+
+  let handle = tokio::spawn(async move {
+    while let Ok((mut client, _)) = listener.accept().await {
+      tokio::spawn(async move {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+        // SOCKS5 handshake: client sends version + methods
+        let mut buf = [0u8; 256];
+        let n = client.read(&mut buf).await.unwrap_or(0);
+        if n < 2 || buf[0] != 0x05 {
+          return;
+        }
+
+        // Reply: version 5, no auth required
+        client.write_all(&[0x05, 0x00]).await.ok();
+
+        // Read connect request: VER CMD RSV ATYP DST.ADDR DST.PORT
+        let n = client.read(&mut buf).await.unwrap_or(0);
+        if n < 7 || buf[1] != 0x01 {
+          client
+            .write_all(&[0x05, 0x07, 0x00, 0x01, 0, 0, 0, 0, 0, 0])
+            .await
+            .ok();
+          return;
+        }
+
+        let (target_host, target_port) = match buf[3] {
+          0x01 => {
+            // IPv4
+            if n < 10 {
+              return;
+            }
+            let ip = format!("{}.{}.{}.{}", buf[4], buf[5], buf[6], buf[7]);
+            let port = u16::from_be_bytes([buf[8], buf[9]]);
+            (ip, port)
+          }
+          0x03 => {
+            // Domain
+            let domain_len = buf[4] as usize;
+            if n < 5 + domain_len + 2 {
+              return;
+            }
+            let domain = String::from_utf8_lossy(&buf[5..5 + domain_len]).to_string();
+            let port = u16::from_be_bytes([buf[5 + domain_len], buf[6 + domain_len]]);
+            (domain, port)
+          }
+          _ => return,
+        };
+
+        // Connect to target
+        let target =
+          match tokio::net::TcpStream::connect(format!("{}:{}", target_host, target_port)).await {
+            Ok(t) => t,
+            Err(_) => {
+              client
+                .write_all(&[0x05, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0])
+                .await
+                .ok();
+              return;
+            }
+          };
+
+        // Success reply
+        client
+          .write_all(&[0x05, 0x00, 0x00, 0x01, 127, 0, 0, 1, 0, 0])
+          .await
+          .ok();
+
+        // Bidirectional relay
+        let (mut cr, mut cw) = tokio::io::split(client);
+        let (mut tr, mut tw) = tokio::io::split(target);
+        tokio::select! {
+          _ = tokio::io::copy(&mut cr, &mut tw) => {}
+          _ = tokio::io::copy(&mut tr, &mut cw) => {}
+        }
+      });
+    }
+  });
+
+  sleep(Duration::from_millis(100)).await;
+  (port, handle)
+}
+
+/// Test that a SOCKS5 upstream proxy works end-to-end through donut-proxy.
+/// Starts a mock SOCKS5 server, a mock HTTP target server,
+/// then routes requests through donut-proxy -> SOCKS5 -> target.
+#[tokio::test]
+#[serial]
+async fn test_local_proxy_with_socks5_upstream(
+) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+  let binary_path = setup_test().await?;
+  let mut tracker = ProxyTestTracker::new(binary_path.clone());
+
+  // Start a mock HTTP server as the final destination
+  let (target_port, target_handle) = start_mock_http_server("SOCKS5-TARGET-RESPONSE").await;
+  println!("Mock target HTTP server on port {target_port}");
+
+  // Start a mock SOCKS5 proxy
+  let (socks_port, socks_handle) = start_mock_socks5_server().await;
+  println!("Mock SOCKS5 server on port {socks_port}");
+
+  // Start donut-proxy with socks5 upstream
+  let output = TestUtils::execute_command(
+    &binary_path,
+    &[
+      "proxy",
+      "start",
+      "--host",
+      "127.0.0.1",
+      "--proxy-port",
+      &socks_port.to_string(),
+      "--type",
+      "socks5",
+    ],
+  )
+  .await?;
+
+  if !output.status.success() {
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    target_handle.abort();
+    socks_handle.abort();
+    return Err(format!("Proxy start failed - stdout: {stdout}, stderr: {stderr}").into());
+  }
+
+  let stdout = String::from_utf8(output.stdout)?;
+  let config: Value = serde_json::from_str(&stdout)?;
+  let proxy_id = config["id"].as_str().unwrap().to_string();
+  let local_port = config["localPort"].as_u64().unwrap() as u16;
+  tracker.track_proxy(proxy_id.clone());
+  println!("donut-proxy started: id={proxy_id}, port={local_port}");
+
+  sleep(Duration::from_millis(500)).await;
+
+  // Test 1: HTTP request through donut-proxy -> SOCKS5 -> target
+  let mut stream = TcpStream::connect(("127.0.0.1", local_port)).await?;
+  let request = format!(
+    "GET http://127.0.0.1:{target_port}/ HTTP/1.1\r\nHost: 127.0.0.1:{target_port}\r\nConnection: close\r\n\r\n"
+  );
+  stream.write_all(request.as_bytes()).await?;
+
+  let mut response = vec![0u8; 8192];
+  let n = tokio::time::timeout(Duration::from_secs(10), stream.read(&mut response))
+    .await
+    .map_err(|_| "HTTP request through SOCKS5 timed out")?
+    .map_err(|e| format!("Read error: {e}"))?;
+  let response_str = String::from_utf8_lossy(&response[..n]);
+
+  assert!(
+    response_str.contains("SOCKS5-TARGET-RESPONSE"),
+    "HTTP request should be tunneled through SOCKS5 to target, got: {}",
+    &response_str[..response_str.len().min(500)]
+  );
+  println!("SOCKS5 HTTP proxy test passed");
+  drop(stream);
+
+  // Allow proxy to settle between tests
+  sleep(Duration::from_millis(500)).await;
+
+  // Test 2: CONNECT tunnel through donut-proxy -> SOCKS5 -> target
+  // This is the critical path for HTTPS browsing.
+  // The proxy's raw TCP handler can race with prior connection cleanup, so retry.
+  let mut connect_ok = false;
+  for attempt in 1..=5 {
+    sleep(Duration::from_millis(200)).await;
+    let Ok(mut stream) = TcpStream::connect(("127.0.0.1", local_port)).await else {
+      continue;
+    };
+    let _ = stream.set_nodelay(true);
+    let connect_req =
+      format!("CONNECT 127.0.0.1:{target_port} HTTP/1.1\r\nHost: 127.0.0.1:{target_port}\r\n\r\n");
+    if stream.write_all(connect_req.as_bytes()).await.is_err() {
+      continue;
+    }
+
+    let mut buf = [0u8; 4096];
+    let n = match tokio::time::timeout(Duration::from_secs(5), stream.read(&mut buf)).await {
+      Ok(Ok(n)) if n > 0 => n,
+      _ => {
+        println!("CONNECT attempt {attempt}/5: empty response, retrying");
+        continue;
+      }
+    };
+
+    if !String::from_utf8_lossy(&buf[..n]).contains("200") {
+      continue;
+    }
+
+    // Tunnel established — send HTTP through it
+    let inner_req =
+      format!("GET / HTTP/1.1\r\nHost: 127.0.0.1:{target_port}\r\nConnection: close\r\n\r\n");
+    if stream.write_all(inner_req.as_bytes()).await.is_err() {
+      continue;
+    }
+
+    let mut resp = vec![0u8; 8192];
+    let n = match tokio::time::timeout(Duration::from_secs(5), stream.read(&mut resp)).await {
+      Ok(Ok(n)) if n > 0 => n,
+      _ => continue,
+    };
+
+    if String::from_utf8_lossy(&resp[..n]).contains("SOCKS5-TARGET-RESPONSE") {
+      connect_ok = true;
+      println!("SOCKS5 CONNECT tunnel test passed (attempt {attempt})");
+      break;
+    }
+  }
+  assert!(connect_ok, "CONNECT tunnel through SOCKS5 should work");
+
+  tracker.cleanup_all().await;
+  target_handle.abort();
+  socks_handle.abort();
+
+  Ok(())
+}