push.rocks/smartproxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(PortProxy): Improve TLS keep-alive management and fix whitespace formatting

Browse Source
This commit is contained in:
Philipp Kunz 2025-03-10 14:13:56 +00:00
parent 4465cac807
commit 146fac73cf
3 changed files with 248 additions and 147 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
changelog.md
View File

@ -1,5 +1,11 @@
# Changelog # Changelog
## 2025-03-10 - 3.30.1 - fix(PortProxy)
Improve TLS keep-alive management and fix whitespace formatting
- Implemented better handling for TLS keep-alive connections after sleep or long inactivity.
- Reformatted whitespace for better readability and consistency.
## 2025-03-08 - 3.30.0 - feat(PortProxy) ## 2025-03-08 - 3.30.0 - feat(PortProxy)
Add advanced TLS keep-alive handling and system sleep detection Add advanced TLS keep-alive handling and system sleep detection

2
ts/00_commitinfo_data.ts
View File

@ -3,6 +3,6 @@
*/ */
export const commitinfo = { export const commitinfo = {
name: '@push.rocks/smartproxy', name: '@push.rocks/smartproxy',
version: '3.30.0', version: '3.30.1',
description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.' description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
} }

387
ts/classes.portproxy.ts
View File

@ -10,7 +10,7 @@ export interface IDomainConfig {
portRanges?: Array<{ from: number; to: number }>; // Optional port ranges portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
// Allow domain-specific timeout override // Allow domain-specific timeout override
connectionTimeout?: number; // Connection timeout override (ms) connectionTimeout?: number; // Connection timeout override (ms)
// New properties for NetworkProxy integration // New properties for NetworkProxy integration
useNetworkProxy?: boolean; // When true, forwards TLS connections to NetworkProxy useNetworkProxy?: boolean; // When true, forwards TLS connections to NetworkProxy
networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0) networkProxyIndex?: number; // Optional index to specify which NetworkProxy to use (defaults to 0)
@ -54,12 +54,12 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
// Rate limiting and security // Rate limiting and security
maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
// Enhanced keep-alive settings // Enhanced keep-alive settings
keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms) extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
// New property for NetworkProxy integration // New property for NetworkProxy integration
networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
} }
@ -90,17 +90,17 @@ interface IConnectionRecord {
tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete
hasReceivedInitialData: boolean; // Whether initial data has been received hasReceivedInitialData: boolean; // Whether initial data has been received
domainConfig?: IDomainConfig; // Associated domain config for this connection domainConfig?: IDomainConfig; // Associated domain config for this connection
// Keep-alive tracking // Keep-alive tracking
hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
incomingTerminationReason?: string | null; // Reason for incoming termination incomingTerminationReason?: string | null; // Reason for incoming termination
outgoingTerminationReason?: string | null; // Reason for outgoing termination outgoingTerminationReason?: string | null; // Reason for outgoing termination
// New field for NetworkProxy tracking // New field for NetworkProxy tracking
usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
networkProxyIndex?: number; // Which NetworkProxy instance is being used networkProxyIndex?: number; // Which NetworkProxy instance is being used
// Sleep detection fields // Sleep detection fields
possibleSystemSleep?: boolean; // Flag to indicate a possible system sleep was detected possibleSystemSleep?: boolean; // Flag to indicate a possible system sleep was detected
lastSleepDetection?: number; // Timestamp of the last sleep detection lastSleepDetection?: number; // Timestamp of the last sleep detection
@ -352,7 +352,7 @@ export class PortProxy {
// Connection tracking by IP for rate limiting // Connection tracking by IP for rate limiting
private connectionsByIP: Map<string, Set<string>> = new Map(); private connectionsByIP: Map<string, Set<string>> = new Map();
private connectionRateByIP: Map<string, number[]> = new Map(); private connectionRateByIP: Map<string, number[]> = new Map();
// New property to store NetworkProxy instances // New property to store NetworkProxy instances
private networkProxies: NetworkProxy[] = []; private networkProxies: NetworkProxy[] = [];
@ -379,8 +379,8 @@ export class PortProxy {
// Feature flags // Feature flags
disableInactivityCheck: settingsArg.disableInactivityCheck || false, disableInactivityCheck: settingsArg.disableInactivityCheck || false,
enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined enableKeepAliveProbes:
? settingsArg.enableKeepAliveProbes : true, // Enable by default settingsArg.enableKeepAliveProbes !== undefined ? settingsArg.enableKeepAliveProbes : true, // Enable by default
enableDetailedLogging: settingsArg.enableDetailedLogging || false, enableDetailedLogging: settingsArg.enableDetailedLogging || false,
enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false, enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false, // Disable randomization by default enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false, // Disable randomization by default
@ -388,13 +388,13 @@ export class PortProxy {
// Rate limiting defaults // Rate limiting defaults
maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP
connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute
// Enhanced keep-alive settings // Enhanced keep-alive settings
keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended', // Extended by default keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended', // Extended by default
keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6, // 6x normal inactivity timeout
extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
}; };
// Store NetworkProxy instances if provided // Store NetworkProxy instances if provided
this.networkProxies = settingsArg.networkProxies || []; this.networkProxies = settingsArg.networkProxies || [];
} }
@ -417,58 +417,66 @@ export class PortProxy {
serverName?: string serverName?: string
): void { ): void {
// Determine which NetworkProxy to use // Determine which NetworkProxy to use
const proxyIndex = domainConfig.networkProxyIndex !== undefined const proxyIndex =
? domainConfig.networkProxyIndex domainConfig.networkProxyIndex !== undefined ? domainConfig.networkProxyIndex : 0;
: 0;
// Validate the NetworkProxy index // Validate the NetworkProxy index
if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) { if (proxyIndex < 0 || proxyIndex >= this.networkProxies.length) {
console.log(`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`); console.log(
`[${connectionId}] Invalid NetworkProxy index: ${proxyIndex}. Using fallback direct connection.`
);
// Fall back to direct connection // Fall back to direct connection
return this.setupDirectConnection(connectionId, socket, record, domainConfig, serverName, initialData); return this.setupDirectConnection(
connectionId,
socket,
record,
domainConfig,
serverName,
initialData
);
} }
const networkProxy = this.networkProxies[proxyIndex]; const networkProxy = this.networkProxies[proxyIndex];
const proxyPort = networkProxy.getListeningPort(); const proxyPort = networkProxy.getListeningPort();
const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log( console.log(
`[${connectionId}] Forwarding TLS connection to NetworkProxy[${proxyIndex}] at ${proxyHost}:${proxyPort}` `[${connectionId}] Forwarding TLS connection to NetworkProxy[${proxyIndex}] at ${proxyHost}:${proxyPort}`
); );
} }
// Create a connection to the NetworkProxy // Create a connection to the NetworkProxy
const proxySocket = plugins.net.connect({ const proxySocket = plugins.net.connect({
host: proxyHost, host: proxyHost,
port: proxyPort port: proxyPort,
}); });
// Store the outgoing socket in the record // Store the outgoing socket in the record
record.outgoing = proxySocket; record.outgoing = proxySocket;
record.outgoingStartTime = Date.now(); record.outgoingStartTime = Date.now();
record.usingNetworkProxy = true; record.usingNetworkProxy = true;
record.networkProxyIndex = proxyIndex; record.networkProxyIndex = proxyIndex;
// Set up error handlers // Set up error handlers
proxySocket.on('error', (err) => { proxySocket.on('error', (err) => {
console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`); console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
this.cleanupConnection(record, 'network_proxy_connect_error'); this.cleanupConnection(record, 'network_proxy_connect_error');
}); });
// Handle connection to NetworkProxy // Handle connection to NetworkProxy
proxySocket.on('connect', () => { proxySocket.on('connect', () => {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`); console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
} }
// First send the initial data that contains the TLS ClientHello // First send the initial data that contains the TLS ClientHello
proxySocket.write(initialData); proxySocket.write(initialData);
// Now set up bidirectional piping between client and NetworkProxy // Now set up bidirectional piping between client and NetworkProxy
socket.pipe(proxySocket); socket.pipe(proxySocket);
proxySocket.pipe(socket); proxySocket.pipe(socket);
// Setup cleanup handlers // Setup cleanup handlers
proxySocket.on('close', () => { proxySocket.on('close', () => {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
@ -476,32 +484,37 @@ export class PortProxy {
} }
this.cleanupConnection(record, 'network_proxy_closed'); this.cleanupConnection(record, 'network_proxy_closed');
}); });
socket.on('close', () => { socket.on('close', () => {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Client connection closed after forwarding to NetworkProxy`); console.log(
`[${connectionId}] Client connection closed after forwarding to NetworkProxy`
);
} }
this.cleanupConnection(record, 'client_closed'); this.cleanupConnection(record, 'client_closed');
}); });
// Update activity on data transfer // Update activity on data transfer
socket.on('data', (chunk: Buffer) => { socket.on('data', (chunk: Buffer) => {
this.updateActivity(record); this.updateActivity(record);
// Check for potential TLS renegotiation or reconnection packets // Check for potential TLS renegotiation or reconnection packets
if (chunk.length > 0 && chunk[0] === 22) { // ContentType.handshake if (chunk.length > 0 && chunk[0] === 22) {
// ContentType.handshake
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`); console.log(
`[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`
);
} }
// Let the NetworkProxy handle the TLS renegotiation // Let the NetworkProxy handle the TLS renegotiation
// Just update the activity timestamp to prevent timeouts // Just update the activity timestamp to prevent timeouts
record.lastActivity = Date.now(); record.lastActivity = Date.now();
} }
}); });
proxySocket.on('data', () => this.updateActivity(record)); proxySocket.on('data', () => this.updateActivity(record));
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log( console.log(
`[${connectionId}] TLS connection successfully forwarded to NetworkProxy[${proxyIndex}]` `[${connectionId}] TLS connection successfully forwarded to NetworkProxy[${proxyIndex}]`
@ -509,7 +522,7 @@ export class PortProxy {
} }
}); });
} }
/** /**
* Sets up a direct connection to the target (original behavior) * Sets up a direct connection to the target (original behavior)
* This is used when NetworkProxy isn't configured or as a fallback * This is used when NetworkProxy isn't configured or as a fallback
@ -586,11 +599,11 @@ export class PortProxy {
// Apply socket optimizations // Apply socket optimizations
targetSocket.setNoDelay(this.settings.noDelay); targetSocket.setNoDelay(this.settings.noDelay);
// Apply keep-alive settings to the outgoing connection as well // Apply keep-alive settings to the outgoing connection as well
if (this.settings.keepAlive) { if (this.settings.keepAlive) {
targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay); targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
// Apply enhanced TCP keep-alive options if enabled // Apply enhanced TCP keep-alive options if enabled
if (this.settings.enableKeepAliveProbes) { if (this.settings.enableKeepAliveProbes) {
try { try {
@ -603,7 +616,9 @@ export class PortProxy {
} catch (err) { } catch (err) {
// Ignore errors - these are optional enhancements // Ignore errors - these are optional enhancements
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`); console.log(
`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`
);
} }
} }
} }
@ -660,19 +675,21 @@ export class PortProxy {
// For keep-alive connections, just log a warning instead of closing // For keep-alive connections, just log a warning instead of closing
if (record.hasKeepAlive) { if (record.hasKeepAlive) {
console.log( console.log(
`[${connectionId}] Timeout event on incoming keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs( `[${connectionId}] Timeout event on incoming keep-alive connection from ${
record.remoteIP
} after ${plugins.prettyMs(
this.settings.socketTimeout || 3600000 this.settings.socketTimeout || 3600000
)}. Connection preserved.` )}. Connection preserved.`
); );
// Don't close the connection - just log // Don't close the connection - just log
return; return;
} }
// For non-keep-alive connections, proceed with normal cleanup // For non-keep-alive connections, proceed with normal cleanup
console.log( console.log(
`[${connectionId}] Timeout on incoming side from ${record.remoteIP} after ${plugins.prettyMs( `[${connectionId}] Timeout on incoming side from ${
this.settings.socketTimeout || 3600000 record.remoteIP
)}` } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
); );
if (record.incomingTerminationReason === null) { if (record.incomingTerminationReason === null) {
record.incomingTerminationReason = 'timeout'; record.incomingTerminationReason = 'timeout';
@ -685,19 +702,21 @@ export class PortProxy {
// For keep-alive connections, just log a warning instead of closing // For keep-alive connections, just log a warning instead of closing
if (record.hasKeepAlive) { if (record.hasKeepAlive) {
console.log( console.log(
`[${connectionId}] Timeout event on outgoing keep-alive connection from ${record.remoteIP} after ${plugins.prettyMs( `[${connectionId}] Timeout event on outgoing keep-alive connection from ${
record.remoteIP
} after ${plugins.prettyMs(
this.settings.socketTimeout || 3600000 this.settings.socketTimeout || 3600000
)}. Connection preserved.` )}. Connection preserved.`
); );
// Don't close the connection - just log // Don't close the connection - just log
return; return;
} }
// For non-keep-alive connections, proceed with normal cleanup // For non-keep-alive connections, proceed with normal cleanup
console.log( console.log(
`[${connectionId}] Timeout on outgoing side from ${record.remoteIP} after ${plugins.prettyMs( `[${connectionId}] Timeout on outgoing side from ${
this.settings.socketTimeout || 3600000 record.remoteIP
)}` } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
); );
if (record.outgoingTerminationReason === null) { if (record.outgoingTerminationReason === null) {
record.outgoingTerminationReason = 'timeout'; record.outgoingTerminationReason = 'timeout';
@ -711,9 +730,11 @@ export class PortProxy {
// Disable timeouts completely for immortal connections // Disable timeouts completely for immortal connections
socket.setTimeout(0); socket.setTimeout(0);
targetSocket.setTimeout(0); targetSocket.setTimeout(0);
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`); console.log(
`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`
);
} }
} else { } else {
// Set normal timeouts for other connections // Set normal timeouts for other connections
@ -743,9 +764,7 @@ export class PortProxy {
const combinedData = Buffer.concat(record.pendingData); const combinedData = Buffer.concat(record.pendingData);
targetSocket.write(combinedData, (err) => { targetSocket.write(combinedData, (err) => {
if (err) { if (err) {
console.log( console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`);
`[${connectionId}] Error writing pending data to target: ${err.message}`
);
return this.initiateCleanupOnce(record, 'write_error'); return this.initiateCleanupOnce(record, 'write_error');
} }
@ -764,7 +783,9 @@ export class PortProxy {
? ` (Port-based for domain: ${domainConfig.domains.join(', ')})` ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
: '' : ''
}` + }` +
` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
record.hasKeepAlive ? 'Yes' : 'No'
}`
); );
} else { } else {
console.log( console.log(
@ -795,7 +816,9 @@ export class PortProxy {
? ` (Port-based for domain: ${domainConfig.domains.join(', ')})` ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
: '' : ''
}` + }` +
` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
record.hasKeepAlive ? 'Yes' : 'No'
}`
); );
} else { } else {
console.log( console.log(
@ -845,77 +868,90 @@ export class PortProxy {
if (record.cleanupTimer) { if (record.cleanupTimer) {
clearTimeout(record.cleanupTimer); clearTimeout(record.cleanupTimer);
} }
// For immortal keep-alive connections, skip setting a timeout completely // For immortal keep-alive connections, skip setting a timeout completely
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') { if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`); console.log(
`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`
);
} }
// No cleanup timer for immortal connections // No cleanup timer for immortal connections
} }
// For TLS keep-alive connections, use a very extended timeout // For TLS keep-alive connections, use a very extended timeout
else if (record.hasKeepAlive && record.isTLS) { else if (record.hasKeepAlive && record.isTLS) {
// For TLS keep-alive connections, use a very extended timeout // For TLS keep-alive connections, use a very extended timeout
// This helps prevent certificate errors after sleep/wake cycles // This helps prevent certificate errors after sleep/wake cycles
const tlsKeepAliveTimeout = 14 * 24 * 60 * 60 * 1000; // 14 days for TLS keep-alive const tlsKeepAliveTimeout = 14 * 24 * 60 * 60 * 1000; // 14 days for TLS keep-alive
const safeTimeout = ensureSafeTimeout(tlsKeepAliveTimeout); const safeTimeout = ensureSafeTimeout(tlsKeepAliveTimeout);
record.cleanupTimer = setTimeout(() => { record.cleanupTimer = setTimeout(() => {
console.log( console.log(
`[${connectionId}] TLS keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs( `[${connectionId}] TLS keep-alive connection from ${
record.remoteIP
} exceeded extended lifetime (${plugins.prettyMs(
tlsKeepAliveTimeout tlsKeepAliveTimeout
)}), forcing cleanup.` )}), forcing cleanup.`
); );
this.initiateCleanupOnce(record, 'tls_extended_lifetime'); this.initiateCleanupOnce(record, 'tls_extended_lifetime');
}, safeTimeout); }, safeTimeout);
// Make sure timeout doesn't keep the process alive // Make sure timeout doesn't keep the process alive
if (record.cleanupTimer.unref) { if (record.cleanupTimer.unref) {
record.cleanupTimer.unref(); record.cleanupTimer.unref();
} }
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] TLS keep-alive connection with enhanced protection, lifetime: ${plugins.prettyMs(tlsKeepAliveTimeout)}`); console.log(
`[${connectionId}] TLS keep-alive connection with enhanced protection, lifetime: ${plugins.prettyMs(
tlsKeepAliveTimeout
)}`
);
} }
} }
// For extended keep-alive connections, use extended timeout // For extended keep-alive connections, use extended timeout
else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') { else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
const safeTimeout = ensureSafeTimeout(extendedTimeout); const safeTimeout = ensureSafeTimeout(extendedTimeout);
record.cleanupTimer = setTimeout(() => { record.cleanupTimer = setTimeout(() => {
console.log( console.log(
`[${connectionId}] Keep-alive connection from ${record.remoteIP} exceeded extended lifetime (${plugins.prettyMs( `[${connectionId}] Keep-alive connection from ${
extendedTimeout record.remoteIP
)}), forcing cleanup.` } exceeded extended lifetime (${plugins.prettyMs(extendedTimeout)}), forcing cleanup.`
); );
this.initiateCleanupOnce(record, 'extended_lifetime'); this.initiateCleanupOnce(record, 'extended_lifetime');
}, safeTimeout); }, safeTimeout);
// Make sure timeout doesn't keep the process alive // Make sure timeout doesn't keep the process alive
if (record.cleanupTimer.unref) { if (record.cleanupTimer.unref) {
record.cleanupTimer.unref(); record.cleanupTimer.unref();
} }
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(extendedTimeout)}`); console.log(
`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(
extendedTimeout
)}`
);
} }
} }
// For standard connections, use normal timeout // For standard connections, use normal timeout
else { else {
// Use domain-specific timeout if available, otherwise use default // Use domain-specific timeout if available, otherwise use default
const connectionTimeout = record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!; const connectionTimeout =
record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
const safeTimeout = ensureSafeTimeout(connectionTimeout); const safeTimeout = ensureSafeTimeout(connectionTimeout);
record.cleanupTimer = setTimeout(() => { record.cleanupTimer = setTimeout(() => {
console.log( console.log(
`[${connectionId}] Connection from ${record.remoteIP} exceeded max lifetime (${plugins.prettyMs( `[${connectionId}] Connection from ${
connectionTimeout record.remoteIP
)}), forcing cleanup.` } exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`
); );
this.initiateCleanupOnce(record, 'connection_timeout'); this.initiateCleanupOnce(record, 'connection_timeout');
}, safeTimeout); }, safeTimeout);
// Make sure timeout doesn't keep the process alive // Make sure timeout doesn't keep the process alive
if (record.cleanupTimer.unref) { if (record.cleanupTimer.unref) {
record.cleanupTimer.unref(); record.cleanupTimer.unref();
@ -999,35 +1035,46 @@ export class PortProxy {
private updateActivity(record: IConnectionRecord): void { private updateActivity(record: IConnectionRecord): void {
// Get the current time // Get the current time
const now = Date.now(); const now = Date.now();
// Check if there was a large time gap that suggests system sleep // Check if there was a large time gap that suggests system sleep
if (record.lastActivity > 0) { if (record.lastActivity > 0) {
const timeDiff = now - record.lastActivity; const timeDiff = now - record.lastActivity;
// If time difference is very large (> 30 minutes) and this is a keep-alive connection, // If time difference is very large (> 30 minutes) and this is a keep-alive connection,
// this might indicate system sleep rather than just inactivity // this might indicate system sleep rather than just inactivity
if (timeDiff > 30 * 60 * 1000 && record.hasKeepAlive) { if (timeDiff > 30 * 60 * 1000 && record.hasKeepAlive) {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log( console.log(
`[${record.id}] Detected possible system sleep for ${plugins.prettyMs(timeDiff)}. ` + `[${record.id}] Detected possible system sleep for ${plugins.prettyMs(timeDiff)}. ` +
`Preserving keep-alive connection.` `Handling keep-alive connection after long inactivity.`
); );
} }
// For keep-alive connections after sleep, we should refresh the TLS state if needed // For TLS keep-alive connections after sleep/long inactivity, force close
// to make browser establish a new connection with fresh certificate context
if (record.isTLS && record.tlsHandshakeComplete) { if (record.isTLS && record.tlsHandshakeComplete) {
this.refreshTlsStateAfterSleep(record); if (timeDiff > 4 * 60 * 60 * 1000) {
// If inactive for more than 4 hours
console.log(
`[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
`Closing to force new connection with fresh certificate.`
);
return this.initiateCleanupOnce(record, 'certificate_refresh_needed');
} else {
// For shorter inactivity periods, try to refresh the TLS state
this.refreshTlsStateAfterSleep(record);
}
} }
// Mark that we detected sleep // Mark that we detected sleep
record.possibleSystemSleep = true; record.possibleSystemSleep = true;
record.lastSleepDetection = now; record.lastSleepDetection = now;
} }
} }
// Update the activity timestamp // Update the activity timestamp
record.lastActivity = now; record.lastActivity = now;
// Clear any inactivity warning // Clear any inactivity warning
if (record.inactivityWarningIssued) { if (record.inactivityWarningIssued) {
record.inactivityWarningIssued = false; record.inactivityWarningIssued = false;
@ -1042,22 +1089,37 @@ export class PortProxy {
if (record.usingNetworkProxy) { if (record.usingNetworkProxy) {
return; return;
} }
try { try {
// For outgoing connections that might need to be refreshed // For outgoing connections that might need to be refreshed
if (record.outgoing && !record.outgoing.destroyed) { if (record.outgoing && !record.outgoing.destroyed) {
// Send a zero-byte packet to test the connection // Check how long this connection has been established
const connectionAge = Date.now() - record.incomingStartTime;
const hourInMs = 60 * 60 * 1000;
// For TLS browser connections that are very old, it's better to force a new connection
// rather than trying to refresh the state, to avoid certificate issues
if (record.isTLS && record.hasKeepAlive && connectionAge > 12 * hourInMs) {
console.log(
`[${record.id}] Long-lived TLS connection (${plugins.prettyMs(connectionAge)}). ` +
`Closing to ensure proper certificate handling on browser reconnect.`
);
return this.initiateCleanupOnce(record, 'certificate_context_refresh');
}
// For newer connections, try to send a refresh packet
record.outgoing.write(Buffer.alloc(0)); record.outgoing.write(Buffer.alloc(0));
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${record.id}] Sent refresh packet after sleep detection`); console.log(`[${record.id}] Sent refresh packet after sleep detection`);
} }
} }
} catch (err) { } catch (err) {
console.log(`[${record.id}] Error refreshing TLS state: ${err}`); console.log(`[${record.id}] Error refreshing TLS state: ${err}`);
// If we can't refresh, don't terminate - client will re-establish if needed // If we hit an error, it's likely the connection is already broken
// Just log the issue but preserve the connection // Force cleanup to ensure browser reconnects cleanly
return this.initiateCleanupOnce(record, 'tls_refresh_error');
} }
} }
@ -1158,7 +1220,9 @@ export class PortProxy {
` Duration: ${plugins.prettyMs( ` Duration: ${plugins.prettyMs(
duration duration
)}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` + )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
`TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` + `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
record.hasKeepAlive ? 'Yes' : 'No'
}` +
`${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}` `${record.usingNetworkProxy ? `, NetworkProxy: ${record.networkProxyIndex}` : ''}`
); );
} else { } else {
@ -1181,7 +1245,7 @@ export class PortProxy {
} }
return this.settings.targetIP!; return this.settings.targetIP!;
} }
/** /**
* Initiates cleanup once for a connection * Initiates cleanup once for a connection
*/ */
@ -1189,12 +1253,15 @@ export class PortProxy {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`); console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
} }
if (record.incomingTerminationReason === null || record.incomingTerminationReason === undefined) { if (
record.incomingTerminationReason === null ||
record.incomingTerminationReason === undefined
) {
record.incomingTerminationReason = reason; record.incomingTerminationReason = reason;
this.incrementTerminationStat('incoming', reason); this.incrementTerminationStat('incoming', reason);
} }
this.cleanupConnection(record, reason); this.cleanupConnection(record, reason);
} }
@ -1318,7 +1385,7 @@ export class PortProxy {
// Apply socket optimizations // Apply socket optimizations
socket.setNoDelay(this.settings.noDelay); socket.setNoDelay(this.settings.noDelay);
// Create a unique connection ID and record // Create a unique connection ID and record
const connectionId = generateConnectionId(); const connectionId = generateConnectionId();
const connectionRecord: IConnectionRecord = { const connectionRecord: IConnectionRecord = {
@ -1342,19 +1409,19 @@ export class PortProxy {
hasKeepAlive: false, // Will set to true if keep-alive is applied hasKeepAlive: false, // Will set to true if keep-alive is applied
incomingTerminationReason: null, incomingTerminationReason: null,
outgoingTerminationReason: null, outgoingTerminationReason: null,
// Initialize NetworkProxy tracking fields // Initialize NetworkProxy tracking fields
usingNetworkProxy: false, usingNetworkProxy: false,
// Initialize sleep detection fields // Initialize sleep detection fields
possibleSystemSleep: false possibleSystemSleep: false,
}; };
// Apply keep-alive settings if enabled // Apply keep-alive settings if enabled
if (this.settings.keepAlive) { if (this.settings.keepAlive) {
socket.setKeepAlive(true, this.settings.keepAliveInitialDelay); socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
// Apply enhanced TCP keep-alive options if enabled // Apply enhanced TCP keep-alive options if enabled
if (this.settings.enableKeepAliveProbes) { if (this.settings.enableKeepAliveProbes) {
try { try {
@ -1368,7 +1435,9 @@ export class PortProxy {
} catch (err) { } catch (err) {
// Ignore errors - these are optional enhancements // Ignore errors - these are optional enhancements
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`); console.log(
`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`
);
} }
} }
} }
@ -1381,8 +1450,8 @@ export class PortProxy {
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log( console.log(
`[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` + `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
`Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` + `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
`Active connections: ${this.connectionRecords.size}` `Active connections: ${this.connectionRecords.size}`
); );
} else { } else {
console.log( console.log(
@ -1520,12 +1589,12 @@ export class PortProxy {
)}` )}`
); );
} }
// Check if we should forward this to a NetworkProxy // Check if we should forward this to a NetworkProxy
if ( if (
isTlsHandshakeDetected && isTlsHandshakeDetected &&
domainConfig.useNetworkProxy === true && domainConfig.useNetworkProxy === true &&
initialChunk && initialChunk &&
this.networkProxies.length > 0 this.networkProxies.length > 0
) { ) {
return this.forwardToNetworkProxy( return this.forwardToNetworkProxy(
@ -1763,11 +1832,11 @@ export class PortProxy {
} else { } else {
nonTlsConnections++; nonTlsConnections++;
} }
if (record.hasKeepAlive) { if (record.hasKeepAlive) {
keepAliveConnections++; keepAliveConnections++;
} }
if (record.usingNetworkProxy) { if (record.usingNetworkProxy) {
networkProxyConnections++; networkProxyConnections++;
} }
@ -1808,34 +1877,41 @@ export class PortProxy {
} }
// Skip inactivity check if disabled or for immortal keep-alive connections // Skip inactivity check if disabled or for immortal keep-alive connections
if (!this.settings.disableInactivityCheck && if (
!(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')) { !this.settings.disableInactivityCheck &&
!(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
) {
const inactivityTime = now - record.lastActivity; const inactivityTime = now - record.lastActivity;
// Special handling for TLS keep-alive connections // Special handling for TLS keep-alive connections
if (record.hasKeepAlive && record.isTLS && inactivityTime > this.settings.inactivityTimeout! / 2) { if (
record.hasKeepAlive &&
record.isTLS &&
inactivityTime > this.settings.inactivityTimeout! / 2
) {
// For TLS keep-alive connections that are getting stale, try to refresh before closing // For TLS keep-alive connections that are getting stale, try to refresh before closing
if (!record.inactivityWarningIssued) { if (!record.inactivityWarningIssued) {
console.log( console.log(
`[${id}] TLS keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` + `[${id}] TLS keep-alive connection from ${
`Attempting to preserve connection.` record.remoteIP
} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
`Attempting to preserve connection.`
); );
// Set warning flag but give a much longer grace period for TLS connections // Set warning flag but give a much longer grace period for TLS connections
record.inactivityWarningIssued = true; record.inactivityWarningIssued = true;
// For TLS connections, extend the last activity time considerably // For TLS connections, extend the last activity time considerably
// This gives browsers more time to re-establish the connection properly // This gives browsers more time to re-establish the connection properly
record.lastActivity = now - (this.settings.inactivityTimeout! / 3); record.lastActivity = now - this.settings.inactivityTimeout! / 3;
// Try to stimulate the connection with a probe packet // Try to stimulate the connection with a probe packet
if (record.outgoing && !record.outgoing.destroyed) { if (record.outgoing && !record.outgoing.destroyed) {
try { try {
// For TLS connections, send a proper TLS heartbeat-like packet // For TLS connections, send a proper TLS heartbeat-like packet
// This is just a small empty buffer that won't affect the TLS session // This is just a small empty buffer that won't affect the TLS session
record.outgoing.write(Buffer.alloc(0)); record.outgoing.write(Buffer.alloc(0));
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${id}] Sent TLS keep-alive probe packet`); console.log(`[${id}] Sent TLS keep-alive probe packet`);
} }
@ -1843,36 +1919,38 @@ export class PortProxy {
console.log(`[${id}] Error sending TLS probe packet: ${err}`); console.log(`[${id}] Error sending TLS probe packet: ${err}`);
} }
} }
// Don't proceed to the normal inactivity check logic // Don't proceed to the normal inactivity check logic
continue; continue;
} }
} }
// Use extended timeout for extended-treatment keep-alive connections // Use extended timeout for extended-treatment keep-alive connections
let effectiveTimeout = this.settings.inactivityTimeout!; let effectiveTimeout = this.settings.inactivityTimeout!;
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') { if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
const multiplier = this.settings.keepAliveInactivityMultiplier || 6; const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
effectiveTimeout = effectiveTimeout * multiplier; effectiveTimeout = effectiveTimeout * multiplier;
} }
if (inactivityTime > effectiveTimeout && !record.connectionClosed) { if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
// For keep-alive connections, issue a warning first // For keep-alive connections, issue a warning first
if (record.hasKeepAlive && !record.inactivityWarningIssued) { if (record.hasKeepAlive && !record.inactivityWarningIssued) {
console.log( console.log(
`[${id}] Warning: Keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` + `[${id}] Warning: Keep-alive connection from ${
`Will close in 10 minutes if no activity.` record.remoteIP
} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
`Will close in 10 minutes if no activity.`
); );
// Set warning flag and add grace period // Set warning flag and add grace period
record.inactivityWarningIssued = true; record.inactivityWarningIssued = true;
record.lastActivity = now - (effectiveTimeout - 600000); record.lastActivity = now - (effectiveTimeout - 600000);
// Try to stimulate activity with a probe packet // Try to stimulate activity with a probe packet
if (record.outgoing && !record.outgoing.destroyed) { if (record.outgoing && !record.outgoing.destroyed) {
try { try {
record.outgoing.write(Buffer.alloc(0)); record.outgoing.write(Buffer.alloc(0));
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${id}] Sent probe packet to test keep-alive connection`); console.log(`[${id}] Sent probe packet to test keep-alive connection`);
} }
@ -1882,22 +1960,37 @@ export class PortProxy {
} }
} else { } else {
// MODIFIED: For TLS connections, be more lenient before closing // MODIFIED: For TLS connections, be more lenient before closing
// For TLS browser connections, we need to handle certificate context properly
if (record.isTLS && record.hasKeepAlive) { if (record.isTLS && record.hasKeepAlive) {
// For TLS keep-alive connections, add additional grace period // For very long inactivity, it's better to close the connection
// This helps with browsers reconnecting after sleep // so the browser establishes a new one with a fresh certificate context
console.log( if (inactivityTime > 6 * 60 * 60 * 1000) {
`[${id}] TLS keep-alive connection from ${record.remoteIP} inactive for ${plugins.prettyMs(inactivityTime)}. ` + // 6 hours
`Adding extra grace period.` console.log(
); `[${id}] TLS keep-alive connection from ${
record.remoteIP
// Give additional time for browsers to reconnect properly } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
record.lastActivity = now - (effectiveTimeout / 2); `Closing to ensure proper certificate handling on browser reconnect.`
);
this.cleanupConnection(record, 'tls_certificate_refresh');
} else {
// For shorter inactivity periods, add grace period
console.log(
`[${id}] TLS keep-alive connection from ${
record.remoteIP
} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
`Adding extra grace period.`
);
// Give additional time for browsers to reconnect properly
record.lastActivity = now - effectiveTimeout / 2;
}
} else { } else {
// For non-keep-alive or after warning, close the connection // For non-keep-alive or after warning, close the connection
console.log( console.log(
`[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` + `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
`for ${plugins.prettyMs(inactivityTime)}.` + `for ${plugins.prettyMs(inactivityTime)}.` +
(record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '') (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
); );
this.cleanupConnection(record, 'inactivity'); this.cleanupConnection(record, 'inactivity');
} }
@ -1905,7 +1998,9 @@ export class PortProxy {
} else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) { } else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
// If activity detected after warning, clear the warning // If activity detected after warning, clear the warning
if (this.settings.enableDetailedLogging) { if (this.settings.enableDetailedLogging) {
console.log(`[${id}] Connection activity detected after inactivity warning, resetting warning`); console.log(
`[${id}] Connection activity detected after inactivity warning, resetting warning`
);
} }
record.inactivityWarningIssued = false; record.inactivityWarningIssued = false;
} }
@ -2054,4 +2149,4 @@ export class PortProxy {
console.log('PortProxy shutdown complete.'); console.log('PortProxy shutdown complete.');
} }
} }