push.rocks/smartproxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(PortProxy): Improved code formatting and readability in PortProxy class by adjusting spacing and comments.

Browse Source
This commit is contained in:
Philipp Kunz 2025-03-06 22:56:18 +00:00
parent 1718a3b2f2
commit 0e605d9a9d
3 changed files with 494 additions and 284 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changelog.md
View File

@ -1,5 +1,11 @@
# Changelog # Changelog
## 2025-03-06 - 3.28.1 - fix(PortProxy)
Improved code formatting and readability in PortProxy class by adjusting spacing and comments.
- Adjusted comment and spacing for better code readability.
- No functional changes made in the PortProxy class.
## 2025-03-06 - 3.28.0 - feat(router) ## 2025-03-06 - 3.28.0 - feat(router)
Add detailed routing tests and refactor ProxyRouter for improved path matching Add detailed routing tests and refactor ProxyRouter for improved path matching

2
ts/00_commitinfo_data.ts
View File

@ -3,6 +3,6 @@
*/ */
export const commitinfo = { export const commitinfo = {
name: '@push.rocks/smartproxy', name: '@push.rocks/smartproxy',
version: '3.28.0', version: '3.28.1',
description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.' description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
} }

406
ts/classes.portproxy.ts
View File

@ -90,7 +90,7 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
try { try {
// Check if buffer is too small for TLS // Check if buffer is too small for TLS
if (buffer.length < 5) { if (buffer.length < 5) {
if (enableLogging) console.log("Buffer too small for TLS header"); if (enableLogging) console.log('Buffer too small for TLS header');
return undefined; return undefined;
} }
@ -109,7 +109,10 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
// Check record length // Check record length
const recordLength = buffer.readUInt16BE(3); const recordLength = buffer.readUInt16BE(3);
if (buffer.length < 5 + recordLength) { if (buffer.length < 5 + recordLength) {
if (enableLogging) console.log(`Buffer too small for TLS record. Expected: ${5 + recordLength}, Got: ${buffer.length}`); if (enableLogging)
console.log(
`Buffer too small for TLS record. Expected: ${5 + recordLength}, Got: ${buffer.length}`
);
return undefined; return undefined;
} }
@ -136,7 +139,7 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
// Cipher suites // Cipher suites
if (offset + 2 > buffer.length) { if (offset + 2 > buffer.length) {
if (enableLogging) console.log("Buffer too small for cipher suites length"); if (enableLogging) console.log('Buffer too small for cipher suites length');
return undefined; return undefined;
} }
const cipherSuitesLength = buffer.readUInt16BE(offset); const cipherSuitesLength = buffer.readUInt16BE(offset);
@ -145,7 +148,7 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
// Compression methods // Compression methods
if (offset + 1 > buffer.length) { if (offset + 1 > buffer.length) {
if (enableLogging) console.log("Buffer too small for compression methods length"); if (enableLogging) console.log('Buffer too small for compression methods length');
return undefined; return undefined;
} }
const compressionMethodsLength = buffer.readUInt8(offset); const compressionMethodsLength = buffer.readUInt8(offset);
@ -154,7 +157,7 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
// Extensions // Extensions
if (offset + 2 > buffer.length) { if (offset + 2 > buffer.length) {
if (enableLogging) console.log("Buffer too small for extensions length"); if (enableLogging) console.log('Buffer too small for extensions length');
return undefined; return undefined;
} }
const extensionsLength = buffer.readUInt16BE(offset); const extensionsLength = buffer.readUInt16BE(offset);
@ -163,7 +166,10 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
const extensionsEnd = offset + extensionsLength; const extensionsEnd = offset + extensionsLength;
if (extensionsEnd > buffer.length) { if (extensionsEnd > buffer.length) {
if (enableLogging) console.log(`Buffer too small for extensions. Expected end: ${extensionsEnd}, Buffer length: ${buffer.length}`); if (enableLogging)
console.log(
`Buffer too small for extensions. Expected end: ${extensionsEnd}, Buffer length: ${buffer.length}`
);
return undefined; return undefined;
} }
@ -172,13 +178,15 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
const extensionType = buffer.readUInt16BE(offset); const extensionType = buffer.readUInt16BE(offset);
const extensionLength = buffer.readUInt16BE(offset + 2); const extensionLength = buffer.readUInt16BE(offset + 2);
if (enableLogging) console.log(`Extension Type: 0x${extensionType.toString(16)}, Length: ${extensionLength}`); if (enableLogging)
console.log(`Extension Type: 0x${extensionType.toString(16)}, Length: ${extensionLength}`);
offset += 4; offset += 4;
if (extensionType === 0x0000) { // SNI extension if (extensionType === 0x0000) {
// SNI extension
if (offset + 2 > buffer.length) { if (offset + 2 > buffer.length) {
if (enableLogging) console.log("Buffer too small for SNI list length"); if (enableLogging) console.log('Buffer too small for SNI list length');
return undefined; return undefined;
} }
@ -188,7 +196,10 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
const sniListEnd = offset + sniListLength; const sniListEnd = offset + sniListLength;
if (sniListEnd > buffer.length) { if (sniListEnd > buffer.length) {
if (enableLogging) console.log(`Buffer too small for SNI list. Expected end: ${sniListEnd}, Buffer length: ${buffer.length}`); if (enableLogging)
console.log(
`Buffer too small for SNI list. Expected end: ${sniListEnd}, Buffer length: ${buffer.length}`
);
return undefined; return undefined;
} }
@ -199,9 +210,15 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
if (enableLogging) console.log(`Name Type: ${nameType}, Name Length: ${nameLen}`); if (enableLogging) console.log(`Name Type: ${nameType}, Name Length: ${nameLen}`);
if (nameType === 0) { // host_name if (nameType === 0) {
// host_name
if (offset + nameLen > buffer.length) { if (offset + nameLen > buffer.length) {
if (enableLogging) console.log(`Buffer too small for hostname. Expected: ${offset + nameLen}, Got: ${buffer.length}`); if (enableLogging)
console.log(
`Buffer too small for hostname. Expected: ${offset + nameLen}, Got: ${
buffer.length
}`
);
return undefined; return undefined;
} }
@ -218,7 +235,7 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
} }
} }
if (enableLogging) console.log("No SNI extension found"); if (enableLogging) console.log('No SNI extension found');
return undefined; return undefined;
} catch (err) { } catch (err) {
console.log(`Error extracting SNI: ${err}`); console.log(`Error extracting SNI: ${err}`);
@ -228,7 +245,7 @@ function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | un
// Helper: Check if a port falls within any of the given port ranges // Helper: Check if a port falls within any of the given port ranges
const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => { const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
return ranges.some(range => port >= range.from && port <= range.to); return ranges.some((range) => port >= range.from && port <= range.to);
}; };
// Helper: Check if a given IP matches any of the glob patterns // Helper: Check if a given IP matches any of the glob patterns
@ -251,8 +268,8 @@ const isAllowed = (ip: string, patterns: string[]): boolean => {
if (normalizedIPVariants.length === 0) return false; if (normalizedIPVariants.length === 0) return false;
const expandedPatterns = patterns.flatMap(normalizeIP); const expandedPatterns = patterns.flatMap(normalizeIP);
return normalizedIPVariants.some(ipVariant => return normalizedIPVariants.some((ipVariant) =>
expandedPatterns.some(pattern => plugins.minimatch(ipVariant, pattern)) expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern))
); );
}; };
@ -309,11 +326,11 @@ export class PortProxy {
targetIP: settingsArg.targetIP || 'localhost', targetIP: settingsArg.targetIP || 'localhost',
// Timeout settings with our enhanced defaults // Timeout settings with our enhanced defaults
initialDataTimeout: settingsArg.initialDataTimeout || 60000, // 60 seconds for initial data initialDataTimeout: settingsArg.initialDataTimeout || 60000, // 60 seconds for initial handshake
socketTimeout: settingsArg.socketTimeout || 3600000, // 1 hour socket timeout socketTimeout: settingsArg.socketTimeout || 2592000000, // 30 days socket timeout
inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000, // 60 seconds interval inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000, // 60 seconds interval
maxConnectionLifetime: settingsArg.maxConnectionLifetime || 3600000, // 1 hour default lifetime maxConnectionLifetime: settingsArg.maxConnectionLifetime || 2592000000, // 30 days max lifetime
inactivityTimeout: settingsArg.inactivityTimeout || 3600000, // 1 hour inactivity timeout inactivityTimeout: settingsArg.inactivityTimeout || 14400000, // 4 hours inactivity timeout
gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds
@ -356,7 +373,7 @@ export class PortProxy {
} }
// Get timestamps and filter out entries older than 1 minute // Get timestamps and filter out entries older than 1 minute
const timestamps = this.connectionRateByIP.get(ip)!.filter(time => now - time < minute); const timestamps = this.connectionRateByIP.get(ip)!.filter((time) => now - time < minute);
timestamps.push(now); timestamps.push(now);
this.connectionRateByIP.set(ip, timestamps); this.connectionRateByIP.set(ip, timestamps);
@ -505,11 +522,17 @@ export class PortProxy {
// Log connection details // Log connection details
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${record.id}] Connection from ${record.remoteIP} on port ${record.localPort} terminated (${reason}).` + console.log(
` Duration: ${plugins.prettyMs(duration)}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` + `[${record.id}] Connection from ${record.remoteIP} on port ${record.localPort} terminated (${reason}).` +
`TLS: ${record.isTLS ? 'Yes' : 'No'}`); ` Duration: ${plugins.prettyMs(
duration
)}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
`TLS: ${record.isTLS ? 'Yes' : 'No'}`
);
} else { } else {
console.log(`[${record.id}] Connection from ${record.remoteIP} terminated (${reason}). Active connections: ${this.connectionRecords.size}`); console.log(
`[${record.id}] Connection from ${record.remoteIP} terminated (${reason}). Active connections: ${this.connectionRecords.size}`
);
} }
} }
} }
@ -556,16 +579,22 @@ export class PortProxy {
const localPort = socket.localPort || 0; // The port on which this connection was accepted. const localPort = socket.localPort || 0; // The port on which this connection was accepted.
// Check rate limits // Check rate limits
if (this.settings.maxConnectionsPerIP && if (
this.getConnectionCountByIP(remoteIP) >= this.settings.maxConnectionsPerIP) { this.settings.maxConnectionsPerIP &&
console.log(`Connection rejected from ${remoteIP}: Maximum connections per IP (${this.settings.maxConnectionsPerIP}) exceeded`); this.getConnectionCountByIP(remoteIP) >= this.settings.maxConnectionsPerIP
) {
console.log(
`Connection rejected from ${remoteIP}: Maximum connections per IP (${this.settings.maxConnectionsPerIP}) exceeded`
);
socket.end(); socket.end();
socket.destroy(); socket.destroy();
return; return;
} }
if (this.settings.connectionRateLimitPerMinute && !this.checkConnectionRate(remoteIP)) { if (this.settings.connectionRateLimitPerMinute && !this.checkConnectionRate(remoteIP)) {
console.log(`Connection rejected from ${remoteIP}: Connection rate limit (${this.settings.connectionRateLimitPerMinute}/min) exceeded`); console.log(
`Connection rejected from ${remoteIP}: Connection rate limit (${this.settings.connectionRateLimitPerMinute}/min) exceeded`
);
socket.end(); socket.end();
socket.destroy(); socket.destroy();
return; return;
@ -611,7 +640,7 @@ export class PortProxy {
localPort: localPort, localPort: localPort,
isTLS: false, isTLS: false,
tlsHandshakeComplete: false, tlsHandshakeComplete: false,
hasReceivedInitialData: false hasReceivedInitialData: false,
}; };
// Track connection by IP // Track connection by IP
@ -619,9 +648,13 @@ export class PortProxy {
this.connectionRecords.set(connectionId, connectionRecord); this.connectionRecords.set(connectionId, connectionRecord);
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`); console.log(
`[${connectionId}] New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`
);
} else { } else {
console.log(`New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`); console.log(
`New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`
);
} }
let initialDataReceived = false; let initialDataReceived = false;
@ -661,7 +694,9 @@ export class PortProxy {
if (this.settings.sniEnabled) { if (this.settings.sniEnabled) {
initialTimeout = setTimeout(() => { initialTimeout = setTimeout(() => {
if (!initialDataReceived) { if (!initialDataReceived) {
console.log(`[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`); console.log(
`[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
);
if (incomingTerminationReason === null) { if (incomingTerminationReason === null) {
incomingTerminationReason = 'initial_timeout'; incomingTerminationReason = 'initial_timeout';
this.incrementTerminationStat('incoming', 'initial_timeout'); this.incrementTerminationStat('incoming', 'initial_timeout');
@ -694,7 +729,9 @@ export class PortProxy {
connectionRecord.isTLS = true; connectionRecord.isTLS = true;
if (this.settings.enableTlsDebugLogging) { if (this.settings.enableTlsDebugLogging) {
console.log(`[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`); console.log(
`[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`
);
// Try to extract SNI and log detailed debug info // Try to extract SNI and log detailed debug info
extractSNI(chunk, true); extractSNI(chunk, true);
} }
@ -711,12 +748,30 @@ export class PortProxy {
if (code === 'ECONNRESET') { if (code === 'ECONNRESET') {
reason = 'econnreset'; reason = 'econnreset';
console.log(`[${connectionId}] ECONNRESET on ${side} side from ${remoteIP}: ${err.message}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(lastActivityAge)} ago`); console.log(
`[${connectionId}] ECONNRESET on ${side} side from ${remoteIP}: ${
err.message
}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
lastActivityAge
)} ago`
);
} else if (code === 'ETIMEDOUT') { } else if (code === 'ETIMEDOUT') {
reason = 'etimedout'; reason = 'etimedout';
console.log(`[${connectionId}] ETIMEDOUT on ${side} side from ${remoteIP}: ${err.message}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(lastActivityAge)} ago`); console.log(
`[${connectionId}] ETIMEDOUT on ${side} side from ${remoteIP}: ${
err.message
}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
lastActivityAge
)} ago`
);
} else { } else {
console.log(`[${connectionId}] Error on ${side} side from ${remoteIP}: ${err.message}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(lastActivityAge)} ago`); console.log(
`[${connectionId}] Error on ${side} side from ${remoteIP}: ${
err.message
}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
lastActivityAge
)} ago`
);
} }
if (side === 'incoming' && incomingTerminationReason === null) { if (side === 'incoming' && incomingTerminationReason === null) {
@ -755,7 +810,12 @@ export class PortProxy {
* @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing). * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
* @param overridePort - If provided, use this port for the outgoing connection. * @param overridePort - If provided, use this port for the outgoing connection.
*/ */
const setupConnection = (serverName: string, initialChunk?: Buffer, forcedDomain?: IDomainConfig, overridePort?: number) => { const setupConnection = (
serverName: string,
initialChunk?: Buffer,
forcedDomain?: IDomainConfig,
overridePort?: number
) => {
// Clear the initial timeout since we've received data // Clear the initial timeout since we've received data
if (initialTimeout) { if (initialTimeout) {
clearTimeout(initialTimeout); clearTimeout(initialTimeout);
@ -771,16 +831,20 @@ export class PortProxy {
connectionRecord.isTLS = true; connectionRecord.isTLS = true;
if (this.settings.enableTlsDebugLogging) { if (this.settings.enableTlsDebugLogging) {
console.log(`[${connectionId}] TLS handshake detected in setup, ${initialChunk.length} bytes`); console.log(
`[${connectionId}] TLS handshake detected in setup, ${initialChunk.length} bytes`
);
} }
} }
// If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup. // If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
const domainConfig = forcedDomain const domainConfig = forcedDomain
? forcedDomain ? forcedDomain
: (serverName ? this.settings.domainConfigs.find(config => : serverName
config.domains.some(d => plugins.minimatch(serverName, d)) ? this.settings.domainConfigs.find((config) =>
) : undefined); config.domains.some((d) => plugins.minimatch(serverName, d))
)
: undefined;
// Save domain config in connection record // Save domain config in connection record
connectionRecord.domainConfig = domainConfig; connectionRecord.domainConfig = domainConfig;
@ -789,20 +853,37 @@ export class PortProxy {
if (domainConfig) { if (domainConfig) {
const effectiveAllowedIPs: string[] = [ const effectiveAllowedIPs: string[] = [
...domainConfig.allowedIPs, ...domainConfig.allowedIPs,
...(this.settings.defaultAllowedIPs || []) ...(this.settings.defaultAllowedIPs || []),
]; ];
const effectiveBlockedIPs: string[] = [ const effectiveBlockedIPs: string[] = [
...(domainConfig.blockedIPs || []), ...(domainConfig.blockedIPs || []),
...(this.settings.defaultBlockedIPs || []) ...(this.settings.defaultBlockedIPs || []),
]; ];
// Skip IP validation if allowedIPs is empty // Skip IP validation if allowedIPs is empty
if (domainConfig.allowedIPs.length > 0 && !isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) { if (
return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(', ')}`); domainConfig.allowedIPs.length > 0 &&
!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)
) {
return rejectIncomingConnection(
'rejected',
`Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(
', '
)}`
);
} }
} else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) { } else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
if (!isGlobIPAllowed(remoteIP, this.settings.defaultAllowedIPs, this.settings.defaultBlockedIPs || [])) { if (
return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed by default allowed list`); !isGlobIPAllowed(
remoteIP,
this.settings.defaultAllowedIPs,
this.settings.defaultBlockedIPs || []
)
) {
return rejectIncomingConnection(
'rejected',
`Connection rejected: IP ${remoteIP} not allowed by default allowed list`
);
} }
} }
@ -828,7 +909,9 @@ export class PortProxy {
connectionRecord.isTLS = true; connectionRecord.isTLS = true;
if (this.settings.enableTlsDebugLogging) { if (this.settings.enableTlsDebugLogging) {
console.log(`[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`); console.log(
`[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
);
} }
} }
@ -836,7 +919,9 @@ export class PortProxy {
const newSize = connectionRecord.pendingDataSize + chunk.length; const newSize = connectionRecord.pendingDataSize + chunk.length;
if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) { if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
console.log(`[${connectionId}] Buffer limit exceeded for connection from ${remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`); console.log(
`[${connectionId}] Buffer limit exceeded for connection from ${remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
);
socket.end(); // Gracefully close the socket socket.end(); // Gracefully close the socket
return initiateCleanupOnce('buffer_limit_exceeded'); return initiateCleanupOnce('buffer_limit_exceeded');
} }
@ -886,17 +971,25 @@ export class PortProxy {
targetSocket.once('error', (err) => { targetSocket.once('error', (err) => {
// This handler runs only once during the initial connection phase // This handler runs only once during the initial connection phase
const code = (err as any).code; const code = (err as any).code;
console.log(`[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`); console.log(
`[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
);
// Resume the incoming socket to prevent it from hanging // Resume the incoming socket to prevent it from hanging
socket.resume(); socket.resume();
if (code === 'ECONNREFUSED') { if (code === 'ECONNREFUSED') {
console.log(`[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`); console.log(
`[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
);
} else if (code === 'ETIMEDOUT') { } else if (code === 'ETIMEDOUT') {
console.log(`[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`); console.log(
`[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
);
} else if (code === 'ECONNRESET') { } else if (code === 'ECONNRESET') {
console.log(`[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`); console.log(
`[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
);
} else if (code === 'EHOSTUNREACH') { } else if (code === 'EHOSTUNREACH') {
console.log(`[${connectionId}] Host ${targetHost} is unreachable`); console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
} }
@ -922,7 +1015,11 @@ export class PortProxy {
// Handle timeouts // Handle timeouts
socket.on('timeout', () => { socket.on('timeout', () => {
console.log(`[${connectionId}] Timeout on incoming side from ${remoteIP} after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`); console.log(
`[${connectionId}] Timeout on incoming side from ${remoteIP} after ${plugins.prettyMs(
this.settings.socketTimeout || 3600000
)}`
);
if (incomingTerminationReason === null) { if (incomingTerminationReason === null) {
incomingTerminationReason = 'timeout'; incomingTerminationReason = 'timeout';
this.incrementTerminationStat('incoming', 'timeout'); this.incrementTerminationStat('incoming', 'timeout');
@ -931,7 +1028,11 @@ export class PortProxy {
}); });
targetSocket.on('timeout', () => { targetSocket.on('timeout', () => {
console.log(`[${connectionId}] Timeout on outgoing side from ${remoteIP} after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`); console.log(
`[${connectionId}] Timeout on outgoing side from ${remoteIP} after ${plugins.prettyMs(
this.settings.socketTimeout || 3600000
)}`
);
if (outgoingTerminationReason === null) { if (outgoingTerminationReason === null) {
outgoingTerminationReason = 'timeout'; outgoingTerminationReason = 'timeout';
this.incrementTerminationStat('outgoing', 'timeout'); this.incrementTerminationStat('outgoing', 'timeout');
@ -965,7 +1066,9 @@ export class PortProxy {
const combinedData = Buffer.concat(connectionRecord.pendingData); const combinedData = Buffer.concat(connectionRecord.pendingData);
targetSocket.write(combinedData, (err) => { targetSocket.write(combinedData, (err) => {
if (err) { if (err) {
console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`); console.log(
`[${connectionId}] Error writing pending data to target: ${err.message}`
);
return initiateCleanupOnce('write_error'); return initiateCleanupOnce('write_error');
} }
@ -977,13 +1080,25 @@ export class PortProxy {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log( console.log(
`[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` + `[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
`${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}` + `${
serverName
? ` (SNI: ${serverName})`
: forcedDomain
? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
: ''
}` +
` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}` ` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}`
); );
} else { } else {
console.log( console.log(
`Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` + `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
`${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}` `${
serverName
? ` (SNI: ${serverName})`
: forcedDomain
? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
: ''
}`
); );
} }
}); });
@ -996,13 +1111,25 @@ export class PortProxy {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log( console.log(
`[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` + `[${connectionId}] Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
`${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}` + `${
serverName
? ` (SNI: ${serverName})`
: forcedDomain
? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
: ''
}` +
` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}` ` TLS: ${connectionRecord.isTLS ? 'Yes' : 'No'}`
); );
} else { } else {
console.log( console.log(
`Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` + `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
`${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}` `${
serverName
? ` (SNI: ${serverName})`
: forcedDomain
? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})`
: ''
}`
); );
} }
} }
@ -1019,13 +1146,19 @@ export class PortProxy {
// Try to extract SNI from potential renegotiation // Try to extract SNI from potential renegotiation
const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging); const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
if (newSNI && newSNI !== connectionRecord.lockedDomain) { if (newSNI && newSNI !== connectionRecord.lockedDomain) {
console.log(`[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${connectionRecord.lockedDomain}. Terminating connection.`); console.log(
`[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${connectionRecord.lockedDomain}. Terminating connection.`
);
initiateCleanupOnce('sni_mismatch'); initiateCleanupOnce('sni_mismatch');
} else if (newSNI && this.settings.enableDetailedLogging) { } else if (newSNI && this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`); console.log(
`[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
);
} }
} catch (err) { } catch (err) {
console.log(`[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`); console.log(
`[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
);
} }
} }
}); });
@ -1039,7 +1172,11 @@ export class PortProxy {
// Set timeout based on domain config or default // Set timeout based on domain config or default
const connectionTimeout = this.getConnectionTimeout(connectionRecord); const connectionTimeout = this.getConnectionTimeout(connectionRecord);
connectionRecord.cleanupTimer = setTimeout(() => { connectionRecord.cleanupTimer = setTimeout(() => {
console.log(`[${connectionId}] Connection from ${remoteIP} exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`); console.log(
`[${connectionId}] Connection from ${remoteIP} exceeded max lifetime (${plugins.prettyMs(
connectionTimeout
)}), forcing cleanup.`
);
initiateCleanupOnce('connection_timeout'); initiateCleanupOnce('connection_timeout');
}, connectionTimeout); }, connectionTimeout);
@ -1053,7 +1190,9 @@ export class PortProxy {
connectionRecord.tlsHandshakeComplete = true; connectionRecord.tlsHandshakeComplete = true;
if (this.settings.enableTlsDebugLogging) { if (this.settings.enableTlsDebugLogging) {
console.log(`[${connectionId}] TLS handshake complete for connection from ${remoteIP}`); console.log(
`[${connectionId}] TLS handshake complete for connection from ${remoteIP}`
);
} }
} }
}); });
@ -1061,45 +1200,72 @@ export class PortProxy {
// --- PORT RANGE-BASED HANDLING --- // --- PORT RANGE-BASED HANDLING ---
// Only apply port-based rules if the incoming port is within one of the global port ranges. // Only apply port-based rules if the incoming port is within one of the global port ranges.
if (this.settings.globalPortRanges && isPortInRanges(localPort, this.settings.globalPortRanges)) { if (
this.settings.globalPortRanges &&
isPortInRanges(localPort, this.settings.globalPortRanges)
) {
if (this.settings.forwardAllGlobalRanges) { if (this.settings.forwardAllGlobalRanges) {
if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0 && !isAllowed(remoteIP, this.settings.defaultAllowedIPs)) { if (
console.log(`[${connectionId}] Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`); this.settings.defaultAllowedIPs &&
this.settings.defaultAllowedIPs.length > 0 &&
!isAllowed(remoteIP, this.settings.defaultAllowedIPs)
) {
console.log(
`[${connectionId}] Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`
);
socket.end(); socket.end();
return; return;
} }
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`); console.log(
`[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`
);
} }
setupConnection('', undefined, { setupConnection(
'',
undefined,
{
domains: ['global'], domains: ['global'],
allowedIPs: this.settings.defaultAllowedIPs || [], allowedIPs: this.settings.defaultAllowedIPs || [],
blockedIPs: this.settings.defaultBlockedIPs || [], blockedIPs: this.settings.defaultBlockedIPs || [],
targetIPs: [this.settings.targetIP!], targetIPs: [this.settings.targetIP!],
portRanges: [] portRanges: [],
}, localPort); },
localPort
);
return; return;
} else { } else {
// Attempt to find a matching forced domain config based on the local port. // Attempt to find a matching forced domain config based on the local port.
const forcedDomain = this.settings.domainConfigs.find( const forcedDomain = this.settings.domainConfigs.find(
domain => domain.portRanges && domain.portRanges.length > 0 && isPortInRanges(localPort, domain.portRanges) (domain) =>
domain.portRanges &&
domain.portRanges.length > 0 &&
isPortInRanges(localPort, domain.portRanges)
); );
if (forcedDomain) { if (forcedDomain) {
const effectiveAllowedIPs: string[] = [ const effectiveAllowedIPs: string[] = [
...forcedDomain.allowedIPs, ...forcedDomain.allowedIPs,
...(this.settings.defaultAllowedIPs || []) ...(this.settings.defaultAllowedIPs || []),
]; ];
const effectiveBlockedIPs: string[] = [ const effectiveBlockedIPs: string[] = [
...(forcedDomain.blockedIPs || []), ...(forcedDomain.blockedIPs || []),
...(this.settings.defaultBlockedIPs || []) ...(this.settings.defaultBlockedIPs || []),
]; ];
if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) { if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
console.log(`[${connectionId}] Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(', ')} on port ${localPort}.`); console.log(
`[${connectionId}] Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(
', '
)} on port ${localPort}.`
);
socket.end(); socket.end();
return; return;
} }
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(', ')}.`); console.log(
`[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(
', '
)}.`
);
} }
setupConnection('', undefined, forcedDomain, localPort); setupConnection('', undefined, forcedDomain, localPort);
return; return;
@ -1127,7 +1293,9 @@ export class PortProxy {
connectionRecord.isTLS = true; connectionRecord.isTLS = true;
if (this.settings.enableTlsDebugLogging) { if (this.settings.enableTlsDebugLogging) {
console.log(`[${connectionId}] Extracting SNI from TLS handshake, ${chunk.length} bytes`); console.log(
`[${connectionId}] Extracting SNI from TLS handshake, ${chunk.length} bytes`
);
} }
serverName = extractSNI(chunk, this.settings.enableTlsDebugLogging) || ''; serverName = extractSNI(chunk, this.settings.enableTlsDebugLogging) || '';
@ -1137,7 +1305,11 @@ export class PortProxy {
connectionRecord.lockedDomain = serverName; connectionRecord.lockedDomain = serverName;
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Received connection from ${remoteIP} with SNI: ${serverName || '(empty)'}`); console.log(
`[${connectionId}] Received connection from ${remoteIP} with SNI: ${
serverName || '(empty)'
}`
);
} }
setupConnection(serverName, chunk); setupConnection(serverName, chunk);
@ -1146,8 +1318,15 @@ export class PortProxy {
initialDataReceived = true; initialDataReceived = true;
connectionRecord.hasReceivedInitialData = true; connectionRecord.hasReceivedInitialData = true;
if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0 && !isAllowed(remoteIP, this.settings.defaultAllowedIPs)) { if (
return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`); this.settings.defaultAllowedIPs &&
this.settings.defaultAllowedIPs.length > 0 &&
!isAllowed(remoteIP, this.settings.defaultAllowedIPs)
) {
return rejectIncomingConnection(
'rejected',
`Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`
);
} }
setupConnection(''); setupConnection('');
@ -1172,13 +1351,15 @@ export class PortProxy {
// Create a server for each port. // Create a server for each port.
for (const port of listeningPorts) { for (const port of listeningPorts) {
const server = plugins.net const server = plugins.net.createServer(connectionHandler).on('error', (err: Error) => {
.createServer(connectionHandler)
.on('error', (err: Error) => {
console.log(`Server Error on port ${port}: ${err.message}`); console.log(`Server Error on port ${port}: ${err.message}`);
}); });
server.listen(port, () => { server.listen(port, () => {
console.log(`PortProxy -> OK: Now listening on port ${port}${this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''}`); console.log(
`PortProxy -> OK: Now listening on port ${port}${
this.settings.sniEnabled ? ' (SNI passthrough enabled)' : ''
}`
);
}); });
this.netServers.push(server); this.netServers.push(server);
} }
@ -1221,19 +1402,33 @@ export class PortProxy {
} }
// Parity check: if outgoing socket closed and incoming remains active // Parity check: if outgoing socket closed and incoming remains active
if (record.outgoingClosedTime && if (
record.outgoingClosedTime &&
!record.incoming.destroyed && !record.incoming.destroyed &&
!record.connectionClosed && !record.connectionClosed &&
(now - record.outgoingClosedTime > 120000)) { now - record.outgoingClosedTime > 120000
) {
const remoteIP = record.remoteIP; const remoteIP = record.remoteIP;
console.log(`[${id}] Parity check: Incoming socket for ${remoteIP} still active ${plugins.prettyMs(now - record.outgoingClosedTime)} after outgoing closed.`); console.log(
`[${id}] Parity check: Incoming socket for ${remoteIP} still active ${plugins.prettyMs(
now - record.outgoingClosedTime
)} after outgoing closed.`
);
this.cleanupConnection(record, 'parity_check'); this.cleanupConnection(record, 'parity_check');
} }
// Check for stalled connections waiting for initial data // Check for stalled connections waiting for initial data
if (!record.hasReceivedInitialData && if (
(now - record.incomingStartTime > this.settings.initialDataTimeout! / 2)) { !record.hasReceivedInitialData &&
console.log(`[${id}] Warning: Connection from ${record.remoteIP} has not received initial data after ${plugins.prettyMs(now - record.incomingStartTime)}`); now - record.incomingStartTime > this.settings.initialDataTimeout! / 2
) {
console.log(
`[${id}] Warning: Connection from ${
record.remoteIP
} has not received initial data after ${plugins.prettyMs(
now - record.incomingStartTime
)}`
);
} }
// Skip inactivity check if disabled // Skip inactivity check if disabled
@ -1243,7 +1438,11 @@ export class PortProxy {
const inactivityTime = now - record.lastActivity; const inactivityTime = now - record.lastActivity;
if (inactivityTime > inactivityThreshold && !record.connectionClosed) { if (inactivityTime > inactivityThreshold && !record.connectionClosed) {
console.log(`[${id}] Inactivity check: No activity on connection from ${record.remoteIP} for ${plugins.prettyMs(inactivityTime)}.`); console.log(
`[${id}] Inactivity check: No activity on connection from ${
record.remoteIP
} for ${plugins.prettyMs(inactivityTime)}.`
);
this.cleanupConnection(record, 'inactivity'); this.cleanupConnection(record, 'inactivity');
} }
} }
@ -1253,8 +1452,13 @@ export class PortProxy {
console.log( console.log(
`Active connections: ${this.connectionRecords.size}. ` + `Active connections: ${this.connectionRecords.size}. ` +
`Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), Non-TLS=${nonTlsConnections}. ` + `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), Non-TLS=${nonTlsConnections}. ` +
`Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(maxOutgoing)}. ` + `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(
`Termination stats: ${JSON.stringify({IN: this.terminationStats.incoming, OUT: this.terminationStats.outgoing})}` maxOutgoing
)}. ` +
`Termination stats: ${JSON.stringify({
IN: this.terminationStats.incoming,
OUT: this.terminationStats.outgoing,
})}`
); );
}, this.settings.inactivityCheckInterval || 60000); }, this.settings.inactivityCheckInterval || 60000);
@ -1268,12 +1472,12 @@ export class PortProxy {
* Gracefully shut down the proxy * Gracefully shut down the proxy
*/ */
public async stop() { public async stop() {
console.log("PortProxy shutting down..."); console.log('PortProxy shutting down...');
this.isShuttingDown = true; this.isShuttingDown = true;
// Stop accepting new connections // Stop accepting new connections
const closeServerPromises: Promise<void>[] = this.netServers.map( const closeServerPromises: Promise<void>[] = this.netServers.map(
server => (server) =>
new Promise<void>((resolve) => { new Promise<void>((resolve) => {
if (!server.listening) { if (!server.listening) {
resolve(); resolve();
@ -1296,7 +1500,7 @@ export class PortProxy {
// Wait for servers to close // Wait for servers to close
await Promise.all(closeServerPromises); await Promise.all(closeServerPromises);
console.log("All servers closed. Cleaning up active connections..."); console.log('All servers closed. Cleaning up active connections...');
// Force destroy all active connections immediately // Force destroy all active connections immediately
const connectionIds = [...this.connectionRecords.keys()]; const connectionIds = [...this.connectionRecords.keys()];
@ -1328,7 +1532,7 @@ export class PortProxy {
} }
// Short delay to allow graceful ends to process // Short delay to allow graceful ends to process
await new Promise(resolve => setTimeout(resolve, 100)); await new Promise((resolve) => setTimeout(resolve, 100));
// Second pass: Force destroy everything // Second pass: Force destroy everything
for (const id of connectionIds) { for (const id of connectionIds) {
@ -1365,9 +1569,9 @@ export class PortProxy {
// Reset termination stats // Reset termination stats
this.terminationStats = { this.terminationStats = {
incoming: {}, incoming: {},
outgoing: {} outgoing: {},
}; };
console.log("PortProxy shutdown complete."); console.log('PortProxy shutdown complete.');
} }
} }