getlantern
diff --git a/‎crates/flint-dial/src/engine.rs‎
Lines changed: 25 additions & 7 deletions b/‎crates/flint-dial/src/engine.rs‎
Lines changed: 25 additions & 7 deletions
diff --git a/‎crates/flint-dial/src/lib.rs‎
Lines changed: 59 additions & 2 deletions b/‎crates/flint-dial/src/lib.rs‎
Lines changed: 59 additions & 2 deletions
diff --git a/‎crates/flint-fronted/src/lib.rs‎
Lines changed: 44 additions & 0 deletions b/‎crates/flint-fronted/src/lib.rs‎
Lines changed: 44 additions & 0 deletions
@@ -9,35 +9,50 @@ use flint_tls::{CertVerification, Profile};
 use tokio::io::{AsyncRead, AsyncWrite};
 use tokio::net::TcpStream;
 
-use crate::{BootstrapStrategy, BoxedTlsStream, TlsEngine};
+use crate::{AlpnStream, BootstrapStrategy, BoxedTlsStream, TlsEngine};
 
 /// Execute `strategy`: open a TCP connection to its target, then dial TLS over it ([`dial_over`]).
 /// Sets `TCP_NODELAY` when the wire plan asks for it (so each shaped segment leaves as its own packet).
 pub async fn dial(strategy: &BootstrapStrategy) -> io::Result<BoxedTlsStream> {
+    Ok(dial_alpn(strategy).await?.into_inner())
+}
+
+/// Like [`dial`], but returns an [`AlpnStream`] that also carries the ALPN protocol the server
+/// negotiated, so a consumer can pick its HTTP version per connection.
+pub async fn dial_alpn(strategy: &BootstrapStrategy) -> io::Result<AlpnStream> {
     let tcp = TcpStream::connect(strategy.target).await?;
     if strategy.wire.tcp_nodelay {
         let _ = tcp.set_nodelay(true);
     }
-    dial_over(tcp, strategy).await
+    dial_over_alpn(tcp, strategy).await
 }
 
 /// Execute `strategy` over an already-connected byte `stream` (the caller controls how the TCP is
 /// opened — e.g. spark injecting socket protection, or a test injecting an in-memory pipe). Applies
 /// the wire shaping, then runs the strategy's TLS engine.
 pub async fn dial_over<S>(stream: S, strategy: &BootstrapStrategy) -> io::Result<BoxedTlsStream>
+where
+    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+{
+    Ok(dial_over_alpn(stream, strategy).await?.into_inner())
+}
+
+/// Like [`dial_over`], but returns an [`AlpnStream`] carrying the negotiated ALPN protocol.
+pub async fn dial_over_alpn<S>(stream: S, strategy: &BootstrapStrategy) -> io::Result<AlpnStream>
 where
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
 {
     match &strategy.engine {
         TlsEngine::BoringChrome(profile) => {
-            dial_boring(
+            let (stream, alpn) = dial_boring(
                 stream,
                 &strategy.sni,
                 profile,
                 &strategy.wire,
                 &strategy.verification,
             )
-            .await
+            .await?;
+            Ok(AlpnStream::new(stream, alpn))
         }
         TlsEngine::Rustls => {
             drop(stream);
@@ -70,12 +85,15 @@ async fn dial_boring<S>(
     profile: &Profile,
     wire: &WirePlan,
     verification: &CertVerification,
-) -> io::Result<BoxedTlsStream>
+) -> io::Result<(BoxedTlsStream, Option<Vec<u8>>)>
 where
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
 {
     let tls = flint_tls::connect_with(shape(stream, wire), sni, profile, verification).await?;
-    Ok(Box::new(tls))
+    // Capture the ALPN the edge negotiated (the boring profile offers h2,http/1.1)
+    // before boxing erases the concrete SslStream.
+    let alpn = tls.ssl().selected_alpn_protocol().map(|p| p.to_vec());
+    Ok((Box::new(tls), alpn))
 }
 
 #[cfg(not(feature = "boring"))]
@@ -85,7 +103,7 @@ async fn dial_boring<S>(
     _profile: &Profile,
     _wire: &WirePlan,
     _verification: &CertVerification,
-) -> io::Result<BoxedTlsStream>
+) -> io::Result<(BoxedTlsStream, Option<Vec<u8>>)>
 where
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
 {
 
@@ -17,13 +17,17 @@
 //! explicit `Unsupported` error rather than silently degrading.
 #![forbid(unsafe_code)]
 
-use tokio::io::{AsyncRead, AsyncWrite};
+use std::io;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
 
 mod engine;
 mod race;
 mod strategy;
 
-pub use engine::{dial, dial_over};
+pub use engine::{dial, dial_alpn, dial_over, dial_over_alpn};
 pub use flint_tls::CertVerification;
 pub use race::{probe_windowed, race, race_windowed, race_with};
 pub use strategy::{BootstrapStrategy, TlsEngine};
@@ -36,3 +40,56 @@ pub type BoxedTlsStream = Box<dyn TlsStream>;
 pub trait TlsStream: AsyncRead + AsyncWrite + Unpin + Send {}
 
 impl<T: AsyncRead + AsyncWrite + Unpin + Send + ?Sized> TlsStream for T {}
+
+/// A dialed TLS stream that also carries the **ALPN protocol the server
+/// negotiated** (e.g. `b"h2"` or `b"http/1.1"`). The boring Chrome engine offers
+/// `h2,http/1.1`; the edge picks one, and a consumer (e.g. the meek client) reads
+/// it back here to choose its HTTP version per connection rather than guessing.
+/// Wraps a [`BoxedTlsStream`] and forwards all I/O to it.
+pub struct AlpnStream {
+    inner: BoxedTlsStream,
+    alpn: Option<Vec<u8>>,
+}
+
+impl AlpnStream {
+    pub fn new(inner: BoxedTlsStream, alpn: Option<Vec<u8>>) -> Self {
+        Self { inner, alpn }
+    }
+
+    /// The negotiated ALPN protocol (e.g. `b"h2"`, `b"http/1.1"`), or `None` if
+    /// none was negotiated.
+    pub fn alpn(&self) -> Option<&[u8]> {
+        self.alpn.as_deref()
+    }
+
+    /// Drop the ALPN annotation, yielding the underlying stream.
+    pub fn into_inner(self) -> BoxedTlsStream {
+        self.inner
+    }
+}
+
+impl AsyncRead for AlpnStream {
+    fn poll_read(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.inner).poll_read(cx, buf)
+    }
+}
+
+impl AsyncWrite for AlpnStream {
+    fn poll_write(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<io::Result<usize>> {
+        Pin::new(&mut self.inner).poll_write(cx, buf)
+    }
+    fn poll_flush(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.inner).poll_flush(cx)
+    }
+    fn poll_shutdown(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
+        Pin::new(&mut self.inner).poll_shutdown(cx)
+    }
+}
@@ -32,6 +32,20 @@ pub use flint_transport::{
     race_boxed, BoxedConnection, BoxedConnectionTransport, Connection, ConnectionTransport,
     RaceError, RaceOptions, TransportConnection,
 };
+
+pub mod meek_poll;
+pub use meek_poll::{
+    open_meek_poll, open_meek_poll_auto, FrontedMeekPollDialer, MeekHttpVersion, MeekPollConfig,
+    MeekPollConn, DEFAULT_MAX_BODY_BYTES,
+};
+
+pub mod sys_dns;
+pub use sys_dns::SystemResolver;
+
+pub mod scanner;
+pub use scanner::{Candidate, ScanResult, ScanTargets};
+
+pub mod socks5;
 use http::{Method, Request, StatusCode};
 use ring::digest;
 use serde::{Deserialize, Serialize};
@@ -1481,6 +1495,36 @@ where
     }
 }
 
+/// Race already-materialized fronts (e.g. scanner-discovered) to a working
+/// verified-TLS edge, dialing each with the boring Chrome engine. The scanner /
+/// self-bootstrap path uses this instead of [`FrontPool`] (which needs a
+/// [`Config`]). Requires the `boring` feature at runtime; without it each dial
+/// returns an Unsupported error and the race fails.
+pub async fn dial_fronts(
+    host: &str,
+    fronts: &[MaterializedFront],
+    options: DialOptions,
+) -> Result<FrontedConnection, Error> {
+    race_materialized_with(host, fronts, options, |strategy| async move {
+        flint_dial::dial(&strategy).await
+    })
+    .await
+}
+
+/// Like [`dial_fronts`], but each dial returns an [`flint_dial::AlpnStream`] so the
+/// caller can read the ALPN the winning edge negotiated (h2 vs http/1.1) — used by
+/// the meek client to auto-select its HTTP version per connection.
+pub async fn dial_fronts_alpn(
+    host: &str,
+    fronts: &[MaterializedFront],
+    options: DialOptions,
+) -> Result<FrontedConnection<flint_dial::AlpnStream>, Error> {
+    race_materialized_with(host, fronts, options, |strategy| async move {
+        flint_dial::dial_alpn(&strategy).await
+    })
+    .await
+}
+
 struct DialCandidate {
     front: Front,
     addr: SocketAddr,