push.rocks/smartproxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(SniHandler): Refactor SniHandler: update whitespace, comment formatting, and consistent type definitions

Browse Source
This commit is contained in:
Philipp Kunz 2025-03-12 10:54:24 +00:00
parent b401d126bc
commit ddfbcdb1f3
3 changed files with 339 additions and 259 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
changelog.md
View File

@ -1,5 +1,13 @@
# Changelog
## 2025-03-12 - 3.41.6 - fix(SniHandler)
Refactor SniHandler: update whitespace, comment formatting, and consistent type definitions
- Unified inline comment style and spacing in SniHandler
- Refactored session cache type declaration for clarity
- Adjusted buffer length calculations to include TLS record header consistently
- Minor improvements to logging messages during ClientHello reassembly and SNI extraction
## 2025-03-12 - 3.41.5 - fix(portproxy)
Enforce TLS handshake and SNI validation on port 443 by blocking non-TLS connections and terminating session resumption attempts without SNI when allowSessionTicket is disabled.

2
ts/00_commitinfo_data.ts
View File

@ -3,6 +3,6 @@
*/
export const commitinfo = {
name: '@push.rocks/smartproxy',
version: '3.41.5',
version: '3.41.6',
description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, dynamic routing with authentication options, and automatic ACME certificate management.'
}

204
ts/classes.snihandler.ts
View File

@ -15,19 +15,22 @@ export class SniHandler {
private static readonly TLS_SESSION_TICKET_EXTENSION_TYPE = 0x0023;
private static readonly TLS_SNI_HOST_NAME_TYPE = 0;
private static readonly TLS_PSK_EXTENSION_TYPE = 0x0029; // Pre-Shared Key extension type for TLS 1.3
private static readonly TLS_PSK_KE_MODES_EXTENSION_TYPE = 0x002D; // PSK Key Exchange Modes
private static readonly TLS_EARLY_DATA_EXTENSION_TYPE = 0x002A; // Early Data (0-RTT) extension
private static readonly TLS_PSK_KE_MODES_EXTENSION_TYPE = 0x002d; // PSK Key Exchange Modes
private static readonly TLS_EARLY_DATA_EXTENSION_TYPE = 0x002a; // Early Data (0-RTT) extension
// Buffer for handling fragmented ClientHello messages
private static fragmentedBuffers: Map<string, Buffer> = new Map();
private static fragmentTimeout: number = 1000; // ms to wait for fragments before cleanup
// Session tracking for tab reactivation scenarios
private static sessionCache: Map<string, {
private static sessionCache: Map<
string,
{
sni: string;
timestamp: number;
clientRandom?: Buffer;
}> = new Map();
}
> = new Map();
// Longer timeout for session cache (24 hours by default)
private static sessionCacheTimeout: number = 24 * 60 * 60 * 1000; // 24 hours in milliseconds
@ -60,7 +63,7 @@ export class SniHandler {
}
});
expiredKeys.forEach(key => {
expiredKeys.forEach((key) => {
this.sessionCache.delete(key);
});
}
@ -94,7 +97,7 @@ export class SniHandler {
this.sessionCache.set(key, {
sni,
timestamp: Date.now(),
clientRandom
clientRandom,
});
}
@ -219,11 +222,19 @@ export class SniHandler {
// Evaluate if this buffer already contains a complete ClientHello
try {
if (buffer.length >= 5) {
const recordLength = (buffer[3] << 8) + buffer[4];
if (buffer.length >= recordLength + 5) {
// Get the record length from TLS header
const recordLength = (buffer[3] << 8) + buffer[4] + 5; // +5 for the TLS record header itself
log(`Initial buffer size: ${buffer.length}, expected record length: ${recordLength}`);
// Check if this buffer already contains a complete TLS record
if (buffer.length >= recordLength) {
log(`Initial buffer contains complete ClientHello, length: ${buffer.length}`);
return buffer;
}
} else {
log(
`Initial buffer too small (${buffer.length} bytes), needs at least 5 bytes for TLS header`
);
}
} catch (e) {
log(`Error checking initial buffer completeness: ${e}`);
@ -242,14 +253,59 @@ export class SniHandler {
// Check if we now have a complete ClientHello
try {
if (newBuffer.length >= 5) {
const recordLength = (newBuffer[3] << 8) + newBuffer[4];
if (newBuffer.length >= recordLength + 5) {
log(`Assembled complete ClientHello, length: ${newBuffer.length}`);
// Get the record length from TLS header
const recordLength = (newBuffer[3] << 8) + newBuffer[4] + 5; // +5 for the TLS record header itself
log(
`Reassembled buffer size: ${newBuffer.length}, expected record length: ${recordLength}`
);
// Check if we have a complete TLS record now
if (newBuffer.length >= recordLength) {
log(
`Assembled complete ClientHello, length: ${newBuffer.length}, needed: ${recordLength}`
);
// Extract the complete TLS record (might be followed by more data)
const completeRecord = newBuffer.slice(0, recordLength);
// Check if this record is indeed a ClientHello (type 1) at position 5
if (
completeRecord.length > 5 &&
completeRecord[5] === this.TLS_CLIENT_HELLO_HANDSHAKE_TYPE
) {
log(`Verified record is a ClientHello handshake message`);
// Complete message received, remove from tracking
this.fragmentedBuffers.delete(connectionId);
return completeRecord;
} else {
log(`Record is complete but not a ClientHello handshake, continuing to buffer`);
// This might be another TLS record type preceding the ClientHello
// Try checking for a ClientHello starting at the end of this record
if (newBuffer.length > recordLength + 5) {
const nextRecordType = newBuffer[recordLength];
log(
`Next record type: ${nextRecordType} (looking for ${this.TLS_HANDSHAKE_RECORD_TYPE})`
);
if (nextRecordType === this.TLS_HANDSHAKE_RECORD_TYPE) {
const handshakeType = newBuffer[recordLength + 5];
log(
`Next handshake type: ${handshakeType} (looking for ${this.TLS_CLIENT_HELLO_HANDSHAKE_TYPE})`
);
if (handshakeType === this.TLS_CLIENT_HELLO_HANDSHAKE_TYPE) {
// Found a ClientHello in the next record, return the entire buffer
log(`Found ClientHello in subsequent record, returning full buffer`);
this.fragmentedBuffers.delete(connectionId);
return newBuffer;
}
}
}
}
}
}
} catch (e) {
log(`Error checking reassembled buffer completeness: ${e}`);
}
@ -432,7 +488,9 @@ export class SniHandler {
// Extract the hostname
if (tempPos + 5 + nameLength <= extensionsEnd) {
const hostname = buffer.slice(tempPos + 5, tempPos + 5 + nameLength).toString('utf8');
const hostname = buffer
.slice(tempPos + 5, tempPos + 5 + nameLength)
.toString('utf8');
log(`Found SNI extension with server_name: ${hostname}`);
}
}
@ -459,31 +517,35 @@ export class SniHandler {
}
// Consider it a resumption if any resumption mechanism is present
const isResumption = hasSessionTicket || hasPSK || hasEarlyData ||
(hasNonEmptySessionId && !hasPSK); // Legacy resumption
const isResumption =
hasSessionTicket || hasPSK || hasEarlyData || (hasNonEmptySessionId && !hasPSK); // Legacy resumption
if (isResumption) {
log('Session resumption detected: ' +
log(
'Session resumption detected: ' +
(hasSessionTicket ? 'session ticket, ' : '') +
(hasPSK ? 'PSK, ' : '') +
(hasEarlyData ? 'early data, ' : '') +
(hasNonEmptySessionId ? 'session ID' : '') +
(hasSNI ? ', with SNI' : ', without SNI'));
(hasSNI ? ', with SNI' : ', without SNI')
);
}
// Return an object with both flags
// For clarity: connections should be blocked if they have session resumption without SNI
if (isResumption) {
log(`Resumption summary - hasSNI: ${hasSNI ? 'yes' : 'no'}, resumption type: ${
log(
`Resumption summary - hasSNI: ${hasSNI ? 'yes' : 'no'}, resumption type: ${
hasSessionTicket ? 'session ticket, ' : ''
}${hasPSK ? 'PSK, ' : ''}${hasEarlyData ? 'early data, ' : ''}${
hasNonEmptySessionId ? 'session ID' : ''
}`);
}`
);
}
return {
isResumption,
hasSNI
hasSNI,
};
} catch (error) {
log(`Error checking for session resumption: ${error}`);
@ -974,7 +1036,8 @@ export class SniHandler {
// Try to extract using common patterns
// Pattern 1: Look for domain name pattern
const domainPattern = /([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?/i;
const domainPattern =
/([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?/i;
const domainMatch = identityStr.match(domainPattern);
if (domainMatch && domainMatch[0]) {
log(`Found domain in PSK identity: ${domainMatch[0]}`);
@ -1020,10 +1083,7 @@ export class SniHandler {
* @param enableLogging - Whether to enable logging
* @returns true if early data is detected
*/
public static hasEarlyData(
buffer: Buffer,
enableLogging: boolean = false
): boolean {
public static hasEarlyData(buffer: Buffer, enableLogging: boolean = false): boolean {
const log = (message: string) => {
if (enableLogging) {
console.log(`[Early Data] ${message}`);
@ -1135,6 +1195,23 @@ export class SniHandler {
}
};
// Log buffer details for debugging
if (enableLogging) {
log(`Buffer size: ${buffer.length} bytes`);
log(`Buffer starts with: ${buffer.slice(0, Math.min(10, buffer.length)).toString('hex')}`);
if (buffer.length >= 5) {
const recordType = buffer[0];
const majorVersion = buffer[1];
const minorVersion = buffer[2];
const recordLength = (buffer[3] << 8) + buffer[4];
log(
`TLS Record: type=${recordType}, version=${majorVersion}.${minorVersion}, length=${recordLength}`
);
}
}
// Check if we need to handle fragmented packets
let processBuffer = buffer;
if (connectionInfo) {
@ -1169,65 +1246,64 @@ export class SniHandler {
return standardSni;
}
// Check for tab reactivation pattern
const isTabReactivation = this.isTabReactivationHandshake(processBuffer, enableLogging);
if (isTabReactivation && connectionInfo?.sourceIp) {
// Try to get the SNI from our session cache for tab reactivation
const cachedSni = this.getCachedSession(connectionInfo.sourceIp);
if (cachedSni) {
log(`Retrieved cached SNI for tab reactivation: ${cachedSni}`);
return cachedSni;
}
log('Tab reactivation detected but no cached SNI found');
}
// Check for TLS 1.3 early data (0-RTT)
const hasEarly = this.hasEarlyData(processBuffer, enableLogging);
if (hasEarly) {
log('TLS 1.3 Early Data detected, trying session cache');
// For 0-RTT, check the session cache
if (connectionInfo?.sourceIp) {
const cachedSni = this.getCachedSession(connectionInfo.sourceIp);
if (cachedSni) {
log(`Retrieved cached SNI for 0-RTT: ${cachedSni}`);
return cachedSni;
}
}
}
// If standard extraction failed and we have a valid ClientHello,
// this might be a session resumption with non-standard format
// Check for session resumption when standard SNI extraction fails
// This may help in chained proxy scenarios
if (this.isClientHello(processBuffer)) {
log('Detected ClientHello without standard SNI, possible session resumption');
const resumptionInfo = this.hasSessionResumption(processBuffer, enableLogging);
// Try to extract from PSK extension (TLS 1.3 resumption)
if (resumptionInfo.isResumption) {
log(`Detected session resumption in ClientHello without standard SNI`);
// Try to extract SNI from PSK extension
const pskSni = this.extractSNIFromPSKExtension(processBuffer, enableLogging);
if (pskSni) {
log(`Extracted SNI from PSK extension: ${pskSni}`);
// Cache this SNI for future reference
// Cache this SNI
if (connectionInfo?.sourceIp) {
const clientRandom = this.extractClientRandom(processBuffer);
this.cacheSession(connectionInfo.sourceIp, pskSni, clientRandom);
log(`Cached PSK-derived SNI: ${pskSni}`);
}
return pskSni;
}
// If we have a session ticket but no SNI or PSK identity,
// check our session cache as a last resort
// If session resumption has SNI in a non-standard location,
// we need to apply heuristics
if (connectionInfo?.sourceIp) {
const cachedSni = this.getCachedSession(connectionInfo.sourceIp);
if (cachedSni) {
log(`Using cached SNI as last resort: ${cachedSni}`);
log(`Using cached SNI for session resumption: ${cachedSni}`);
return cachedSni;
}
}
log('Failed to extract SNI from resumption mechanisms');
}
}
// Try tab reactivation and other recovery methods...
// (existing code remains unchanged)
// Log detailed info about the ClientHello when SNI extraction fails
if (this.isClientHello(processBuffer) && enableLogging) {
log(`SNI extraction failed for ClientHello. Buffer details:`);
if (processBuffer.length >= 43) {
// ClientHello with at least client random
const clientRandom = processBuffer.slice(11, 11 + 32).toString('hex');
log(`Client Random: ${clientRandom}`);
// Log session ID length and presence
const sessionIdLength = processBuffer[43];
log(`Session ID length: ${sessionIdLength}`);
if (sessionIdLength > 0 && processBuffer.length >= 44 + sessionIdLength) {
const sessionId = processBuffer.slice(44, 44 + sessionIdLength).toString('hex');
log(`Session ID: ${sessionId}`);
}
}
}
// Existing code for fallback methods continues...
return undefined;
}
@ -1298,11 +1374,7 @@ export class SniHandler {
}
// For handshake messages, try the full extraction process
const sni = this.extractSNIWithResumptionSupport(
buffer,
connectionInfo,
enableLogging
);
const sni = this.extractSNIWithResumptionSupport(buffer, connectionInfo, enableLogging);
if (sni) {
log(`Successfully extracted SNI: ${sni}`);