rusnel 0.10.0

use crate::common::utils::SerdeHelper;
use anyhow::{anyhow, Result};
use serde::{Deserialize, Serialize};
use std::fmt;
use std::net::{IpAddr, Ipv6Addr, SocketAddr};
use std::str::FromStr;

/// Wire-level protocol selector. Kept as a separate enum so the parser and
/// dispatchers can `match` on it directly without stringly-typed checks.
#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
pub enum Protocol {
    Tcp,
    Udp,
}

/// Direction of a tunnel relative to the *initiating* client. Forward is the
/// chisel-default (client opens a local listener; server reaches the
/// upstream); Reverse swaps those roles.
#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq)]
pub enum Direction {
    Forward,
    Reverse,
}

/// A `host:port` pair as the user typed it on the CLI, before any DNS
/// resolution. We keep the host as a `String` (not an `IpAddr`) so DNS names
/// like `google.com` survive intact down to the actual `connect` call.
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, Hash)]
pub struct HostPort {
    pub host: String,
    pub port: u16,
}

impl HostPort {
    pub fn new(host: impl Into<String>, port: u16) -> Self {
        Self {
            host: host.into(),
            port,
        }
    }

    /// Render as `host:port`, bracketing IPv6 literals so the output is safe
    /// to feed to `TcpStream::connect` and friends.
    pub fn to_addr_string(&self) -> String {
        if self.host.parse::<Ipv6Addr>().is_ok() {
            format!("[{}]:{}", self.host, self.port)
        } else {
            format!("{}:{}", self.host, self.port)
        }
    }
}

impl fmt::Display for HostPort {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        f.write_str(&self.to_addr_string())
    }
}

/// What kind of tunnel this remote represents. The `local` socket is always
/// the address the *initiating* client (or, for reverse remotes, the server)
/// listens on; the `remote` host:port is the peer's connect target. SOCKS5
/// has no static remote — the target is supplied per-connection by the SOCKS
/// handshake.
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
pub enum RemoteKind {
    Tcp { local: SocketAddr, remote: HostPort },
    Udp { local: SocketAddr, remote: HostPort },
    Socks5 { local: SocketAddr },
}

impl RemoteKind {
    pub fn local(&self) -> SocketAddr {
        match self {
            RemoteKind::Tcp { local, .. }
            | RemoteKind::Udp { local, .. }
            | RemoteKind::Socks5 { local } => *local,
        }
    }

    pub fn protocol(&self) -> Option<Protocol> {
        match self {
            RemoteKind::Tcp { .. } => Some(Protocol::Tcp),
            RemoteKind::Udp { .. } => Some(Protocol::Udp),
            RemoteKind::Socks5 { .. } => None,
        }
    }
}

/// A single tunnel description (a *tunnel declaration*). One of these per
/// `--remote` flag on the client CLI; sent to the server in bulk inside
/// [`SessionHello`] right after the QUIC connection is established.
///
/// In the post-0.8 protocol the client never re-sends a `RemoteRequest`
/// per data conn — once the server accepts the hello and assigns each
/// declaration a `tunnel_id`, all subsequent bi-streams identify
/// themselves with [`OpenConn`] frames keyed by that id.
#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
pub struct RemoteRequest {
    pub direction: Direction,
    pub kind: RemoteKind,
    /// `true` when the user typed `stdio:host:port` (forward-only). The
    /// client pipes its own stdin/stdout to/from the QUIC stream instead
    /// of binding a local listener; the server side is unaffected (still
    /// a normal TCP/UDP `connect` to `kind.remote`). The dummy
    /// `kind.local` (always `0.0.0.0:0`) is never bound.
    #[serde(default)]
    pub stdio: bool,
}

impl RemoteRequest {
    pub fn new(direction: Direction, kind: RemoteKind) -> Self {
        Self {
            direction,
            kind,
            stdio: false,
        }
    }

    /// `true` if this remote represents SOCKS5 traffic — a standalone
    /// SOCKS5 listener declaration (`R:socks` for reverse, plain `socks`
    /// for forward). Used by the server's hello-time validation to gate
    /// SOCKS5 behind `--allow-socks`. Per-CONNECT / per-UDP-target
    /// dynamic streams the SOCKS handler manufactures at runtime no
    /// longer need their own flag — they are carried as
    /// [`OpenConn::dynamic`] under a parent SOCKS5 tunnel, which was
    /// already gated at hello time.
    pub fn is_socks(&self) -> bool {
        matches!(self.kind, RemoteKind::Socks5 { .. })
    }

    pub fn is_reversed(&self) -> bool {
        matches!(self.direction, Direction::Reverse)
    }

    pub fn is_stdio(&self) -> bool {
        self.stdio
    }

    /// `local_host:local_port` as a `SocketAddr`. Use the resulting value's
    /// `Display` for binding/listening — that path brackets IPv6 literals
    /// correctly (`[::1]:8080`).
    pub fn local_socket_addr(&self) -> SocketAddr {
        self.kind.local()
    }

    /// `remote_host:remote_port` formatted for `TcpStream::connect`,
    /// `UdpSocket::send_to`, and friends. Brackets bare IPv6 literals.
    /// Returns `None` for SOCKS5 remotes, which have no static target.
    pub fn remote_addr_string(&self) -> Option<String> {
        match &self.kind {
            RemoteKind::Tcp { remote, .. } | RemoteKind::Udp { remote, .. } => {
                Some(remote.to_addr_string())
            }
            RemoteKind::Socks5 { .. } => None,
        }
    }
}

impl fmt::Display for Protocol {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Protocol::Tcp => write!(f, "tcp"),
            Protocol::Udp => write!(f, "udp"),
        }
    }
}

impl fmt::Display for RemoteRequest {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        if self.is_reversed() {
            write!(f, "R:")?;
        }
        if self.stdio {
            // stdio is always forward-only (rejected at parse time
            // otherwise) and is forbidden with SOCKS5, so the only
            // shapes here are Tcp/Udp.
            return match &self.kind {
                RemoteKind::Tcp { remote, .. } => {
                    write!(f, "stdio=>{}/tcp", remote.to_addr_string())
                }
                RemoteKind::Udp { remote, .. } => {
                    write!(f, "stdio=>{}/udp", remote.to_addr_string())
                }
                RemoteKind::Socks5 { .. } => write!(f, "stdio=>socks"),
            };
        }
        match &self.kind {
            RemoteKind::Socks5 { local } => write!(f, "{}=>socks", local.port()),
            RemoteKind::Tcp { local, remote } => {
                write!(f, "{}=>{}/tcp", local.port(), remote.to_addr_string())
            }
            RemoteKind::Udp { local, remote } => {
                write!(f, "{}=>{}/udp", local.port(), remote.to_addr_string())
            }
        }
    }
}

impl SerdeHelper for RemoteRequest {}

// ---------------------------------------------------------------------------
// Session-level handshake (post-0.8 wire protocol)
// ---------------------------------------------------------------------------
//
// Right after the QUIC connection is established the client opens its
// first bi-stream and sends a [`SessionHello`] carrying *every* tunnel
// declaration it wants. The server validates them all in one shot
// against `--allow-reverse` / `--allow-socks` and either accepts the
// whole batch — assigning one `tunnel_id` per declaration in the same
// order — or rejects the entire session. Subsequent bi-streams (in
// either direction) start with an [`OpenConn`] frame that names the
// `tunnel_id` they belong to, so neither side ever re-sends a full
// [`RemoteRequest`] on the data plane.

/// First control frame the client sends on a fresh QUIC connection.
#[derive(Serialize, Deserialize, Debug, Clone)]
pub struct SessionHello {
    pub remotes: Vec<RemoteRequest>,
}

impl SerdeHelper for SessionHello {}

/// Server's reply to [`SessionHello`]. On success, `tunnel_ids[i]` is
/// the server-assigned id for `hello.remotes[i]`. On failure, the
/// server closes the connection.
#[derive(Serialize, Deserialize, Debug)]
pub enum SessionHelloResponse {
    Ok { tunnel_ids: Vec<u64> },
    Failed(String),
}

impl SerdeHelper for SessionHelloResponse {}

/// Per-conn opener. Sent on the first 4 + body bytes of every
/// data-plane bi-stream (in either direction) so the receiving side
/// knows which tunnel this conn belongs to without consulting any
/// out-of-band state.
#[derive(Serialize, Deserialize, Debug, Clone)]
pub struct OpenConn {
    pub tunnel_id: u64,
    /// SOCKS5-only: the per-CONNECT (TCP) or per-target (UDP) address
    /// the SOCKS handshake just resolved. `None` for static tunnels
    /// (the receiving side uses the parent tunnel's declared `kind`).
    pub dynamic: Option<DynamicTarget>,
}

impl SerdeHelper for OpenConn {}

#[derive(Serialize, Deserialize, Debug, Clone)]
pub enum DynamicTarget {
    Tcp(HostPort),
    Udp(HostPort),
}

/// Reply to an [`OpenConn`]. `Ok` = "go ahead, start streaming"; `Failed`
/// surfaces a server-side reason (unknown tunnel id, dispatch error,
/// …) so the conn can be torn down cleanly instead of timing out.
#[derive(Serialize, Deserialize, Debug)]
pub enum OpenConnResponse {
    Ok,
    Failed(String),
}

impl SerdeHelper for OpenConnResponse {}

// ---------------------------------------------------------------------------
// Parser
// ---------------------------------------------------------------------------

/// Marker token the user types in place of `<remote-host>:<remote-port>` to
/// request a SOCKS5 dynamic tunnel.
const SOCKS_KEYWORD: &str = "socks";

/// Marker token that replaces the local-side `host:port` to request that
/// the client pipe its own stdin/stdout to/from the tunnel instead of
/// binding a local listener. Forward-only — `R:stdio:...` is rejected.
const STDIO_KEYWORD: &str = "stdio";

/// Default address for things that historically defaulted to `0.0.0.0` (the
/// IPv4 wildcard).
const ANY_V4: &str = "0.0.0.0";
/// Default address for SOCKS5's local listener.
const SOCKS_DEFAULT_LOCAL: &str = "127.0.0.1";
const SOCKS_DEFAULT_PORT: u16 = 1080;
/// Default `remote_host` used when the user omits it in a `stdio:port`
/// short-hand, matching chisel's behavior (`3000` resolves to
/// `127.0.0.1:3000` on the remote side).
const STDIO_DEFAULT_REMOTE_HOST: &str = "127.0.0.1";

/// Decomposed input as a sequence of structured layers. The parser pipes the
/// raw string through these sub-parses in order:
///
///   1. `parse_direction` strips the optional `R:` / `R/` prefix.
///   2. `parse_protocol` strips the optional `/tcp` / `/udp` suffix.
///   3. `split_addr_tokens` tokenizes the residual `host:port:host:port`
///      respecting `[…]` so IPv6 literals stay atomic.
///   4. `tokens_to_kind` dispatches on the token count and the SOCKS keyword
///      to build the final [`RemoteKind`].
impl FromStr for RemoteRequest {
    type Err = anyhow::Error;

    fn from_str(input: &str) -> Result<RemoteRequest> {
        let (direction, after_dir) = parse_direction(input)?;
        let (protocol_hint, body) = parse_protocol(after_dir)?;
        let tokens = split_addr_tokens(body)?;

        // Detect a leading `stdio` token. Stdio replaces the local
        // listener with the client's own stdin/stdout, so it only
        // makes sense in the *first* token slot and only on forward
        // tunnels (the server side of a reverse tunnel can't write to
        // the client's stdout).
        let (stdio, addr_tokens) = if !tokens.is_empty() && tokens[0] == STDIO_KEYWORD {
            if matches!(direction, Direction::Reverse) {
                return Err(anyhow!("Invalid format: stdio cannot be reversed"));
            }
            (true, &tokens[1..])
        } else {
            (false, tokens.as_slice())
        };

        let kind = if stdio {
            tokens_to_stdio_kind(addr_tokens, protocol_hint)?
        } else {
            tokens_to_kind(addr_tokens, protocol_hint)?
        };
        Ok(RemoteRequest {
            direction,
            kind,
            stdio,
        })
    }
}

/// Strip a leading `R:` ("reverse") marker. Matches chisel's syntax exactly:
/// the colon form is the only form accepted.
fn parse_direction(s: &str) -> Result<(Direction, &str)> {
    if let Some(rest) = s.strip_prefix("R:") {
        if rest.is_empty() {
            return Err(anyhow!("Invalid format: Missing details after R:"));
        }
        return Ok((Direction::Reverse, rest));
    }
    if s == "R" {
        return Err(anyhow!("Invalid format: Missing details after R"));
    }
    Ok((Direction::Forward, s))
}

/// Pop a trailing `/tcp` or `/udp` if present. Returns the protocol the
/// caller asked for (or `None` if no suffix), plus the residual address
/// portion. Errors out on any other suffix so silent typos don't slip
/// through as TCP.
fn parse_protocol(s: &str) -> Result<(Option<Protocol>, &str)> {
    match s.rsplit_once('/') {
        Some((head, "tcp")) => Ok((Some(Protocol::Tcp), head)),
        Some((head, "udp")) => Ok((Some(Protocol::Udp), head)),
        Some(_) => Err(anyhow!("Invalid protocol: Must be 'tcp' or 'udp'")),
        None => Ok((None, s)),
    }
}

/// Split `s` on `:` while treating `[...]` segments as a single atomic
/// token so IPv6 literals (which contain `:`) survive intact. Bracketed
/// tokens are returned *with* their brackets so [`unbracket`] can recognize
/// them later.
fn split_addr_tokens(s: &str) -> Result<Vec<&str>> {
    let bytes = s.as_bytes();
    let mut tokens = Vec::new();
    let mut i = 0;
    while i < bytes.len() {
        if bytes[i] == b'[' {
            let close_rel = bytes[i + 1..]
                .iter()
                .position(|&b| b == b']')
                .ok_or_else(|| anyhow!("Invalid format: unterminated '['"))?;
            let close = i + 1 + close_rel;
            tokens.push(&s[i..=close]);
            i = close + 1;
            if i < bytes.len() {
                if bytes[i] != b':' {
                    return Err(anyhow!("Invalid format: expected ':' after ']'"));
                }
                i += 1;
                if i == bytes.len() {
                    return Err(anyhow!("Invalid format: trailing ':' after ']'"));
                }
            }
        } else {
            let next = bytes[i..]
                .iter()
                .position(|&b| b == b':')
                .map(|p| i + p)
                .unwrap_or(bytes.len());
            tokens.push(&s[i..next]);
            i = next;
            if i < bytes.len() {
                i += 1;
                if i == bytes.len() {
                    return Err(anyhow!("Invalid format: trailing ':'"));
                }
            }
        }
    }
    Ok(tokens)
}

fn unbracket(s: &str) -> &str {
    if s.len() >= 2 && s.starts_with('[') && s.ends_with(']') {
        &s[1..s.len() - 1]
    } else {
        s
    }
}

fn parse_ip(s: &str, what: &str) -> Result<IpAddr> {
    unbracket(s)
        .parse::<IpAddr>()
        .map_err(|_| anyhow!("Invalid {what}"))
}

fn parse_port(s: &str, what: &str) -> Result<u16> {
    s.parse::<u16>().map_err(|_| anyhow!("Invalid {what}"))
}

/// `0.0.0.0` as an `IpAddr`. Cheap; called from the per-arity branches
/// below for the v4 wildcard default.
fn any_v4() -> IpAddr {
    // The literal is a constant — `parse` here is total. We unwrap to avoid
    // bubbling an `anyhow!` that can never fire at runtime.
    ANY_V4
        .parse::<IpAddr>()
        .unwrap_or(IpAddr::V4(std::net::Ipv4Addr::UNSPECIFIED))
}

fn socks_default_local() -> IpAddr {
    SOCKS_DEFAULT_LOCAL
        .parse::<IpAddr>()
        .unwrap_or(IpAddr::V4(std::net::Ipv4Addr::LOCALHOST))
}

/// Combine a tokenized address with an optional protocol hint into a
/// [`RemoteKind`]. SOCKS5 ignores the protocol hint (it's TCP-only by
/// definition); the `tcp`/`udp` discriminator only matters for the
/// host:port shapes.
fn tokens_to_kind(tokens: &[&str], protocol: Option<Protocol>) -> Result<RemoteKind> {
    if tokens.is_empty() {
        return Err(anyhow!("Invalid format: Missing parts"));
    }

    // Each shape ends in either a `socks` keyword (build a Socks5) or a
    // host:port quadruple/triple/double/single (build Tcp/Udp). The shape
    // is fully determined by token count.
    match tokens.len() {
        1 => parse_one_token(tokens[0], protocol),
        2 => parse_two_tokens(tokens, protocol),
        3 => parse_three_tokens(tokens, protocol),
        4 => parse_four_tokens(tokens, protocol),
        _ => Err(anyhow!(
            "Invalid format: Unexpected number of address parts"
        )),
    }
}

fn parse_one_token(token: &str, protocol: Option<Protocol>) -> Result<RemoteKind> {
    if token == SOCKS_KEYWORD {
        return Ok(RemoteKind::Socks5 {
            local: SocketAddr::new(socks_default_local(), SOCKS_DEFAULT_PORT),
        });
    }
    let port = parse_port(token, "remote port")?;
    Ok(make_host_port_kind(
        SocketAddr::new(any_v4(), port),
        HostPort::new(ANY_V4, port),
        protocol,
    ))
}

fn parse_two_tokens(tokens: &[&str], protocol: Option<Protocol>) -> Result<RemoteKind> {
    if tokens[1] == SOCKS_KEYWORD {
        let local_port = parse_port(tokens[0], "remote port")?;
        return Ok(RemoteKind::Socks5 {
            local: SocketAddr::new(socks_default_local(), local_port),
        });
    }
    let remote_host = unbracket(tokens[0]).to_string();
    let remote_port = parse_port(tokens[1], "remote port")?;
    Ok(make_host_port_kind(
        SocketAddr::new(any_v4(), remote_port),
        HostPort::new(remote_host, remote_port),
        protocol,
    ))
}

fn parse_three_tokens(tokens: &[&str], protocol: Option<Protocol>) -> Result<RemoteKind> {
    if tokens[2] == SOCKS_KEYWORD {
        let local_host = parse_ip(tokens[0], "local host")?;
        let local_port = parse_port(tokens[1], "local port")?;
        return Ok(RemoteKind::Socks5 {
            local: SocketAddr::new(local_host, local_port),
        });
    }
    let local_port = parse_port(tokens[0], "local port")?;
    let remote_host = unbracket(tokens[1]).to_string();
    let remote_port = parse_port(tokens[2], "remote port")?;
    Ok(make_host_port_kind(
        SocketAddr::new(any_v4(), local_port),
        HostPort::new(remote_host, remote_port),
        protocol,
    ))
}

fn parse_four_tokens(tokens: &[&str], protocol: Option<Protocol>) -> Result<RemoteKind> {
    let local_host = parse_ip(tokens[0], "local host")?;
    let local_port = parse_port(tokens[1], "local port")?;
    let remote_host = unbracket(tokens[2]).to_string();
    let remote_port = parse_port(tokens[3], "remote port")?;
    Ok(make_host_port_kind(
        SocketAddr::new(local_host, local_port),
        HostPort::new(remote_host, remote_port),
        protocol,
    ))
}

/// Build a [`RemoteKind`] for a `stdio:...` declaration. The `local`
/// `SocketAddr` is a dummy `0.0.0.0:0` — the client's stdio dispatcher
/// never binds it. Stdio is incompatible with SOCKS5 (no `socks` keyword
/// allowed in the remainder) since stdio is a single-conn pipe.
fn tokens_to_stdio_kind(tokens: &[&str], protocol: Option<Protocol>) -> Result<RemoteKind> {
    if tokens.contains(&SOCKS_KEYWORD) {
        return Err(anyhow!(
            "Invalid format: stdio cannot be combined with socks"
        ));
    }
    let local = SocketAddr::new(any_v4(), 0);
    match tokens.len() {
        1 => {
            // `stdio:<port>` — chisel defaults the omitted remote host
            // to 127.0.0.1 (vs. 0.0.0.0 for a bare port short-hand).
            let port = parse_port(tokens[0], "remote port")?;
            Ok(make_host_port_kind(
                local,
                HostPort::new(STDIO_DEFAULT_REMOTE_HOST, port),
                protocol,
            ))
        }
        2 => {
            let remote_host = unbracket(tokens[0]).to_string();
            let remote_port = parse_port(tokens[1], "remote port")?;
            Ok(make_host_port_kind(
                local,
                HostPort::new(remote_host, remote_port),
                protocol,
            ))
        }
        0 => Err(anyhow!(
            "Invalid format: stdio requires a remote host:port or port"
        )),
        _ => Err(anyhow!(
            "Invalid format: stdio expects '<host>:<port>' or '<port>'"
        )),
    }
}

fn make_host_port_kind(
    local: SocketAddr,
    remote: HostPort,
    protocol: Option<Protocol>,
) -> RemoteKind {
    match protocol.unwrap_or(Protocol::Tcp) {
        Protocol::Tcp => RemoteKind::Tcp { local, remote },
        Protocol::Udp => RemoteKind::Udp { local, remote },
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn parse(s: &str) -> RemoteRequest {
        RemoteRequest::from_str(s).unwrap_or_else(|e| panic!("expected `{s}` to parse: {e}"))
    }

    fn ip(s: &str) -> IpAddr {
        s.parse().unwrap()
    }

    /// Convenience: pull the `(local, remote, protocol)` triple out of a
    /// host:port-shaped remote. Panics on Socks5 — tests that produce a
    /// SOCKS5 remote use `assert!(matches!(...))` directly.
    fn unwrap_hp(r: &RemoteRequest) -> (SocketAddr, &HostPort, Protocol) {
        match &r.kind {
            RemoteKind::Tcp { local, remote } => (*local, remote, Protocol::Tcp),
            RemoteKind::Udp { local, remote } => (*local, remote, Protocol::Udp),
            RemoteKind::Socks5 { .. } => panic!("expected host:port remote, got socks"),
        }
    }

    #[test]
    fn forward_just_remote_port() {
        let r = parse("1337");
        let (local, remote, proto) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("0.0.0.0"), 1337));
        assert_eq!(remote.host, "0.0.0.0");
        assert_eq!(remote.port, 1337);
        assert!(!r.is_reversed());
        assert_eq!(proto, Protocol::Tcp);
    }

    #[test]
    fn forward_remote_host_and_port() {
        let r = parse("example.com:1337");
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("0.0.0.0"), 1337));
        assert_eq!(remote.host, "example.com");
        assert_eq!(remote.port, 1337);
        assert!(!r.is_reversed());
    }

    #[test]
    fn forward_local_port_remote_host_port() {
        let r = parse("1337:google.com:80");
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("0.0.0.0"), 1337));
        assert_eq!(remote.host, "google.com");
        assert_eq!(remote.port, 80);
    }

    #[test]
    fn forward_full_quadruple() {
        let r = parse("192.168.1.14:5000:google.com:80");
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("192.168.1.14"), 5000));
        assert_eq!(remote.host, "google.com");
        assert_eq!(remote.port, 80);
    }

    #[test]
    fn forward_udp_protocol_suffix() {
        let r = parse("1.1.1.1:53/udp");
        let (_, remote, proto) = unwrap_hp(&r);
        assert_eq!(remote.host, "1.1.1.1");
        assert_eq!(remote.port, 53);
        assert_eq!(proto, Protocol::Udp);
    }

    #[test]
    fn socks_default_local() {
        let r = parse("socks");
        assert!(r.is_socks());
        assert_eq!(
            r.local_socket_addr(),
            SocketAddr::new(ip("127.0.0.1"), 1080)
        );
        assert!(!r.is_reversed());
    }

    #[test]
    fn socks_custom_local_port() {
        let r = parse("5000:socks");
        assert!(r.is_socks());
        assert_eq!(
            r.local_socket_addr(),
            SocketAddr::new(ip("127.0.0.1"), 5000)
        );
    }

    #[test]
    fn reverse_prefix_with_port() {
        let r = parse("R:2222:localhost:22");
        assert!(r.is_reversed());
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local.port(), 2222);
        assert_eq!(remote.host, "localhost");
        assert_eq!(remote.port, 22);
    }

    #[test]
    fn reverse_socks_default_local() {
        let r = parse("R:socks");
        assert!(r.is_reversed());
        assert!(r.is_socks());
        assert_eq!(
            r.local_socket_addr(),
            SocketAddr::new(ip("127.0.0.1"), 1080)
        );
    }

    #[test]
    fn reverse_socks_custom_local_port() {
        let r = parse("R:5000:socks");
        assert!(r.is_reversed());
        assert!(r.is_socks());
        assert_eq!(r.local_socket_addr().port(), 5000);
    }

    #[test]
    fn rejects_unknown_protocol() {
        let err = RemoteRequest::from_str("1.1.1.1:53/sctp").unwrap_err();
        assert!(
            err.to_string().contains("Invalid protocol"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_invalid_local_ip() {
        let err = RemoteRequest::from_str("not-an-ip:1:host:80").unwrap_err();
        assert!(
            err.to_string().contains("Invalid local host"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_invalid_port() {
        let err = RemoteRequest::from_str("99999").unwrap_err();
        assert!(
            err.to_string().contains("Invalid remote port"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_too_many_address_parts() {
        let err = RemoteRequest::from_str("a:b:c:d:e").unwrap_err();
        assert!(
            err.to_string()
                .contains("Unexpected number of address parts"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn ipv6_remote_host_port() {
        let r = parse("[::1]:80");
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("0.0.0.0"), 80));
        assert_eq!(remote.host, "::1");
        assert_eq!(remote.port, 80);
    }

    #[test]
    fn ipv6_local_port_remote_host_port() {
        let r = parse("8080:[2001:db8::1]:443");
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("0.0.0.0"), 8080));
        assert_eq!(remote.host, "2001:db8::1");
        assert_eq!(remote.port, 443);
    }

    #[test]
    fn ipv6_full_quadruple() {
        let r = parse("[::1]:5000:[2001:db8::1]:80/udp");
        let (local, remote, proto) = unwrap_hp(&r);
        assert_eq!(local, SocketAddr::new(ip("::1"), 5000));
        assert_eq!(remote.host, "2001:db8::1");
        assert_eq!(remote.port, 80);
        assert_eq!(proto, Protocol::Udp);
    }

    #[test]
    fn ipv6_local_only_with_socks() {
        let r = parse("[::1]:1080:socks");
        assert_eq!(r.local_socket_addr(), SocketAddr::new(ip("::1"), 1080));
        assert!(r.is_socks());
    }

    #[test]
    fn ipv6_reverse() {
        let r = parse("R:[::1]:5000:[2001:db8::1]:80");
        assert!(r.is_reversed());
        let (local, remote, _) = unwrap_hp(&r);
        assert_eq!(local.ip(), ip("::1"));
        assert_eq!(remote.host, "2001:db8::1");
    }

    #[test]
    fn rejects_unterminated_bracket() {
        let err = RemoteRequest::from_str("[::1:80").unwrap_err();
        assert!(
            err.to_string().contains("unterminated"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_missing_colon_after_bracket() {
        // `[::1]80` (no `:` between `]` and the port) is an obvious user
        // typo; reject it explicitly rather than silently producing a
        // one-token parse that fails later with a misleading error.
        let err = RemoteRequest::from_str("[::1]80").unwrap_err();
        assert!(
            err.to_string().contains("expected ':'"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn unbracketed_ipv6_still_rejected() {
        // Bare colon-rich tokens have always been ambiguous (could be IPv6
        // or `host:port:host:port…`). We require brackets for IPv6 — same
        // rule HTTP, ssh, and curl all use.
        assert!(RemoteRequest::from_str("fe80::1:53").is_err());
    }

    #[test]
    fn remote_addr_string_brackets_ipv6() {
        let r = parse("[2001:db8::1]:443");
        assert_eq!(r.remote_addr_string().as_deref(), Some("[2001:db8::1]:443"));
    }

    #[test]
    fn remote_addr_string_passes_dns_through() {
        let r = parse("example.com:80");
        assert_eq!(r.remote_addr_string().as_deref(), Some("example.com:80"));
    }

    #[test]
    fn remote_addr_string_none_for_socks() {
        let r = parse("socks");
        assert_eq!(r.remote_addr_string(), None);
    }

    #[test]
    fn local_socket_addr_handles_ipv6() {
        let r = parse("[::1]:8080:example.com:80");
        assert_eq!(r.local_socket_addr().to_string(), "[::1]:8080");
    }

    #[test]
    fn protocol_helpers() {
        assert_eq!(parse("80").kind.protocol(), Some(Protocol::Tcp));
        assert_eq!(parse("80/udp").kind.protocol(), Some(Protocol::Udp));
        assert_eq!(parse("socks").kind.protocol(), None);
    }

    #[test]
    fn rejects_r_slash_prefix() {
        // `R/` was a Rusnel-specific shorthand; we now match chisel
        // exactly and require the colon form.
        let err = RemoteRequest::from_str("R/1337:google.com:80").unwrap_err();
        assert!(
            err.to_string().contains("Invalid"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_bare_r() {
        let err = RemoteRequest::from_str("R").unwrap_err();
        assert!(
            err.to_string().contains("after R"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_empty_after_reverse_prefix() {
        let err = RemoteRequest::from_str("R:").unwrap_err();
        assert!(
            err.to_string().contains("after R:"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn stdio_with_remote_host_port() {
        let r = parse("stdio:example.com:22");
        assert!(r.is_stdio());
        assert!(!r.is_reversed());
        let (_, remote, proto) = unwrap_hp(&r);
        assert_eq!(remote.host, "example.com");
        assert_eq!(remote.port, 22);
        assert_eq!(proto, Protocol::Tcp);
    }

    #[test]
    fn stdio_with_just_port_defaults_remote_to_loopback() {
        // Per chisel's `stdio:80` short-hand: omitted remote host
        // resolves to 127.0.0.1 (not 0.0.0.0).
        let r = parse("stdio:80");
        assert!(r.is_stdio());
        let (_, remote, _) = unwrap_hp(&r);
        assert_eq!(remote.host, "127.0.0.1");
        assert_eq!(remote.port, 80);
    }

    #[test]
    fn stdio_with_udp_protocol_suffix() {
        let r = parse("stdio:1.1.1.1:53/udp");
        assert!(r.is_stdio());
        let (_, remote, proto) = unwrap_hp(&r);
        assert_eq!(remote.host, "1.1.1.1");
        assert_eq!(remote.port, 53);
        assert_eq!(proto, Protocol::Udp);
    }

    #[test]
    fn stdio_ipv6_remote() {
        let r = parse("stdio:[2001:db8::1]:443");
        assert!(r.is_stdio());
        let (_, remote, _) = unwrap_hp(&r);
        assert_eq!(remote.host, "2001:db8::1");
        assert_eq!(remote.port, 443);
    }

    #[test]
    fn rejects_reverse_stdio() {
        let err = RemoteRequest::from_str("R:stdio:example.com:22").unwrap_err();
        assert!(
            err.to_string().contains("stdio cannot be reversed"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_stdio_alone() {
        let err = RemoteRequest::from_str("stdio").unwrap_err();
        assert!(
            err.to_string().contains("stdio requires"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn rejects_stdio_socks() {
        let err = RemoteRequest::from_str("stdio:socks").unwrap_err();
        assert!(
            err.to_string()
                .contains("stdio cannot be combined with socks"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn stdio_round_trips_through_display() {
        let r = parse("stdio:example.com:22");
        assert_eq!(r.to_string(), "stdio=>example.com:22/tcp");
        let r = parse("stdio:1.1.1.1:53/udp");
        assert_eq!(r.to_string(), "stdio=>1.1.1.1:53/udp");
    }

    #[test]
    fn rejects_trailing_colon() {
        let err = RemoteRequest::from_str("1.1.1.1:").unwrap_err();
        assert!(
            err.to_string().contains("trailing ':'"),
            "unexpected error: {err}"
        );
    }

    #[test]
    fn idn_remote_host_passes_through() {
        let r = parse("示例網站.com:80");
        let (_, remote, _) = unwrap_hp(&r);
        assert_eq!(remote.host, "示例網站.com");
        assert_eq!(remote.port, 80);
    }
}