3.30.8

Fixed TypeScript errors caused by using 'connectionRecord' instead of 'record' in TLS renegotiation handlers.
The variable name mistake occurred when moving and restructuring the TLS handshake detection code.

🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>

changelog.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2025-03-11 - 3.30.8 - fix(core)
+No changes in this commit.
+
+
+## 2025-03-11 - 3.30.7 - fix(PortProxy)
+Improve TLS renegotiation SNI handling by first checking if the new SNI is allowed under the existing domain config. If not, attempt to find an alternative domain config and update the locked domain accordingly; otherwise, terminate the connection on SNI mismatch.
+
+- Added a preliminary check against the original domain config to allow re-handshakes if the new SNI matches allowed patterns.
+- If the original config does not allow, search for an alternative domain config and validate IP rules.
+- Update the locked domain when allowed, ensuring connection reuse with valid certificate context.
+- Terminate the connection if no suitable domain config is found or IP restrictions are violated.
+
+## 2025-03-11 - 3.30.6 - fix(PortProxy)
+Improve TLS renegotiation handling in PortProxy by validating the new SNI against allowed domain configurations. If the new SNI is permitted based on existing IP rules, update the locked domain to allow connection reuse; otherwise, terminate the connection to prevent misrouting.
+
+- Added logic to check if a new SNI during renegotiation is allowed by comparing IP rules from the matching domain configuration.
+- Updated detailed logging to indicate when a valid SNI change is accepted and when it results in a mismatch termination.
+
+## 2025-03-10 - 3.30.5 - fix(internal)
+No uncommitted changes detected; project files and tests remain unchanged.
+
+
+## 2025-03-10 - 3.30.4 - fix(PortProxy)
+Fix TLS renegotiation handling and adjust TLS keep-alive timeouts in PortProxy implementation
+
+- Allow TLS renegotiation data without an explicit SNI extraction to pass through, ensuring valid renegotiations are not dropped (critical for Chrome).
+- Update TLS keep-alive timeout from an aggressive 30 minutes to a more generous 4 hours to reduce unnecessary reconnections.
+- Increase inactivity thresholds for TLS connections from 20 minutes to 2 hours with an additional verification interval extended from 5 to 15 minutes.
+- Adjust long-lived TLS connection timeout from 45 minutes to 8 hours for improved certificate context refresh in chained proxy scenarios.
+
 ## 2025-03-10 - 3.30.3 - fix(classes.portproxy.ts)
 Simplify timeout management in PortProxy and fix chained proxy certificate refresh issues
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "3.30.3",
+  "version": "3.30.8",
   "private": false,
   "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.",
   "main": "dist_ts/index.js",

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '3.30.3',
+  version: '3.30.8',
   description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
 }

ts/classes.portproxy.ts

@@ -502,25 +502,16 @@ export class PortProxy {
         this.cleanupConnection(record, 'client_closed');
       });
       
-      // Update activity on data transfer
+      // Special handler for TLS handshake detection with NetworkProxy
       socket.on('data', (chunk: Buffer) => {
-        this.updateActivity(record);
+        // Check for TLS handshake packets (ContentType.handshake)
-
-        // Check for potential TLS renegotiation or reconnection packets
         if (chunk.length > 0 && chunk[0] === 22) {
-          // ContentType.handshake
+          console.log(`[${connectionId}] Detected potential TLS handshake with NetworkProxy, updating activity`);
-          if (this.settings.enableDetailedLogging) {
+          this.updateActivity(record);
-            console.log(
-              `[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`
-            );
-          }
-
-          // Let the NetworkProxy handle the TLS renegotiation
-          // Just update the activity timestamp to prevent timeouts
-          record.lastActivity = Date.now();
         }
       });
 
+      // Update activity on data transfer from the proxy socket
       proxySocket.on('data', () => this.updateActivity(record));
 
       if (this.settings.enableDetailedLogging) {
@@ -776,6 +767,75 @@ export class PortProxy {
             return this.initiateCleanupOnce(record, 'write_error');
           }
 
+          // Set up the renegotiation listener *before* piping if this is a TLS connection with SNI
+          if (serverName && record.isTLS) {
+            // This listener handles TLS renegotiation detection
+            socket.on('data', (renegChunk) => {
+              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+                // Always update activity timestamp for any handshake packet
+                this.updateActivity(record);
+                
+                try {
+                  // Try to extract SNI from potential renegotiation
+                  const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+                  
+                  // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+                  if (newSNI === undefined) {
+                    console.log(`[${connectionId}] Rehandshake detected without SNI, allowing it through.`);
+                    return;
+                  }
+                  
+                  // Check if the SNI has changed
+                  if (newSNI !== serverName) {
+                    console.log(`[${connectionId}] Rehandshake with different SNI: ${newSNI} vs original ${serverName}`);
+                    
+                    // Allow if the new SNI matches existing domain config or find a new matching config
+                    let allowed = false;
+                    
+                    if (record.domainConfig) {
+                      allowed = record.domainConfig.domains.some(d => plugins.minimatch(newSNI, d));
+                    }
+                    
+                    if (!allowed) {
+                      const newDomainConfig = this.settings.domainConfigs.find((config) =>
+                        config.domains.some((d) => plugins.minimatch(newSNI, d))
+                      );
+                      
+                      if (newDomainConfig) {
+                        const effectiveAllowedIPs = [
+                          ...newDomainConfig.allowedIPs,
+                          ...(this.settings.defaultAllowedIPs || []),
+                        ];
+                        const effectiveBlockedIPs = [
+                          ...(newDomainConfig.blockedIPs || []),
+                          ...(this.settings.defaultBlockedIPs || []),
+                        ];
+                        
+                        allowed = isGlobIPAllowed(record.remoteIP, effectiveAllowedIPs, effectiveBlockedIPs);
+                        
+                        if (allowed) {
+                          record.domainConfig = newDomainConfig;
+                        }
+                      }
+                    }
+                    
+                    if (allowed) {
+                      console.log(`[${connectionId}] Updated domain for connection from ${record.remoteIP} to: ${newSNI}`);
+                      record.lockedDomain = newSNI;
+                    } else {
+                      console.log(`[${connectionId}] Rehandshake SNI ${newSNI} not allowed. Terminating connection.`);
+                      this.initiateCleanupOnce(record, 'sni_mismatch');
+                    }
+                  } else {
+                    console.log(`[${connectionId}] Rehandshake with same SNI: ${newSNI}`);
+                  }
+                } catch (err) {
+                  console.log(`[${connectionId}] Error processing renegotiation: ${err}. Allowing to continue.`);
+                }
+              }
+            });
+          }
+          
           // Now set up piping for future data and resume the socket
           socket.pipe(targetSocket);
           targetSocket.pipe(socket);
@@ -809,7 +869,76 @@ export class PortProxy {
           }
         });
       } else {
-        // No pending data, so just set up piping
+        // Set up the renegotiation listener *before* piping if this is a TLS connection with SNI
+        if (serverName && record.isTLS) {
+          // This listener handles TLS renegotiation detection
+          socket.on('data', (renegChunk) => {
+            if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+              // Always update activity timestamp for any handshake packet
+              this.updateActivity(record);
+              
+              try {
+                // Try to extract SNI from potential renegotiation
+                const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+                
+                // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+                if (newSNI === undefined) {
+                  console.log(`[${connectionId}] Rehandshake detected without SNI, allowing it through.`);
+                  return;
+                }
+                
+                // Check if the SNI has changed
+                if (newSNI !== serverName) {
+                  console.log(`[${connectionId}] Rehandshake with different SNI: ${newSNI} vs original ${serverName}`);
+                  
+                  // Allow if the new SNI matches existing domain config or find a new matching config
+                  let allowed = false;
+                  
+                  if (record.domainConfig) {
+                    allowed = record.domainConfig.domains.some(d => plugins.minimatch(newSNI, d));
+                  }
+                  
+                  if (!allowed) {
+                    const newDomainConfig = this.settings.domainConfigs.find((config) =>
+                      config.domains.some((d) => plugins.minimatch(newSNI, d))
+                    );
+                    
+                    if (newDomainConfig) {
+                      const effectiveAllowedIPs = [
+                        ...newDomainConfig.allowedIPs,
+                        ...(this.settings.defaultAllowedIPs || []),
+                      ];
+                      const effectiveBlockedIPs = [
+                        ...(newDomainConfig.blockedIPs || []),
+                        ...(this.settings.defaultBlockedIPs || []),
+                      ];
+                      
+                      allowed = isGlobIPAllowed(record.remoteIP, effectiveAllowedIPs, effectiveBlockedIPs);
+                      
+                      if (allowed) {
+                        record.domainConfig = newDomainConfig;
+                      }
+                    }
+                  }
+                  
+                  if (allowed) {
+                    console.log(`[${connectionId}] Updated domain for connection from ${record.remoteIP} to: ${newSNI}`);
+                    record.lockedDomain = newSNI;
+                  } else {
+                    console.log(`[${connectionId}] Rehandshake SNI ${newSNI} not allowed. Terminating connection.`);
+                    this.initiateCleanupOnce(record, 'sni_mismatch');
+                  }
+                } else {
+                  console.log(`[${connectionId}] Rehandshake with same SNI: ${newSNI}`);
+                }
+              } catch (err) {
+                console.log(`[${connectionId}] Error processing renegotiation: ${err}. Allowing to continue.`);
+              }
+            }
+          });
+        }
+        
+        // Now set up piping
         socket.pipe(targetSocket);
         targetSocket.pipe(socket);
         socket.resume(); // Resume the socket after piping is established
@@ -846,31 +975,8 @@ export class PortProxy {
       record.pendingData = [];
       record.pendingDataSize = 0;
 
-      // Add the renegotiation listener for SNI validation
+      // Renegotiation detection is now handled before piping is established
-      if (serverName) {
+      // This ensures the data listener receives all packets properly
-        socket.on('data', (renegChunk: Buffer) => {
-          if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
-            try {
-              // Try to extract SNI from potential renegotiation
-              const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
-              if (newSNI && newSNI !== record.lockedDomain) {
-                console.log(
-                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. Terminating connection.`
-                );
-                this.initiateCleanupOnce(record, 'sni_mismatch');
-              } else if (newSNI && this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
-                );
-              }
-            } catch (err) {
-              console.log(
-                `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
-              );
-            }
-          }
-        });
-      }
 
       // Set connection timeout with simpler logic
       if (record.cleanupTimer) {
@@ -886,13 +992,12 @@ export class PortProxy {
         }
         // No cleanup timer for immortal connections
       }
-      // For TLS keep-alive connections, use an aggressive timeout to ensure
+      // For TLS keep-alive connections, use a more generous timeout now that
-      // certificates are regularly refreshed even in chained proxy scenarios
+      // we've fixed the renegotiation handling issue that was causing certificate problems
       else if (record.hasKeepAlive && record.isTLS) {
-        // Use a much shorter timeout for TLS connections to ensure certificate contexts are refreshed frequently
+        // Use a longer timeout for TLS connections now that renegotiation handling is fixed
-        // This prevents issues with stale certificates in browser tabs that have been idle for a while
+        // This reduces unnecessary reconnections while still ensuring certificate freshness
-        // 30 minutes is aggressive enough to handle multi-proxy chains without causing too many reconnects
+        const tlsKeepAliveTimeout = 4 * 60 * 60 * 1000; // 4 hours for TLS keep-alive - increased from 30 minutes
-        const tlsKeepAliveTimeout = 30 * 60 * 1000; // 30 minutes for TLS keep-alive - dramatically reduced from 8 hours
         const safeTimeout = ensureSafeTimeout(tlsKeepAliveTimeout);
 
         record.cleanupTimer = setTimeout(() => {
@@ -1063,34 +1168,34 @@ export class PortProxy {
         // For TLS keep-alive connections after sleep/long inactivity, force close
         // to make browser establish a new connection with fresh certificate context
         if (record.isTLS && record.tlsHandshakeComplete) {
-          // Much more aggressive timeout (20 minutes) to ensure reliable operation in chained proxy scenarios
+          // More generous timeout now that we've fixed the renegotiation handling
-          if (timeDiff > 20 * 60 * 1000) {
+          if (timeDiff > 2 * 60 * 60 * 1000) {
-            // If inactive for more than 20 minutes (reduced from 4 hours)
+            // If inactive for more than 2 hours (increased from 20 minutes)
             console.log(
               `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
                 `Closing to force new connection with fresh certificate.`
             );
             return this.initiateCleanupOnce(record, 'certificate_refresh_needed');
-          } else if (timeDiff > 10 * 60 * 1000) {
+          } else if (timeDiff > 30 * 60 * 1000) {
-            // For shorter but still significant inactivity (10+ minutes), be more aggressive with refresh
+            // For shorter but still significant inactivity (30+ minutes), refresh TLS state
             console.log(
               `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
-                `Aggressively refreshing TLS state to prevent certificate issues in proxy chains.`
+                `Refreshing TLS state.`
             );
             this.refreshTlsStateAfterSleep(record);
             
-            // Add an additional check in 5 minutes if no activity
+            // Add an additional check in 15 minutes if no activity
             const refreshCheckId = record.id;
             const refreshCheck = setTimeout(() => {
               const currentRecord = this.connectionRecords.get(refreshCheckId);
-              if (currentRecord && Date.now() - currentRecord.lastActivity > 5 * 60 * 1000) {
+              if (currentRecord && Date.now() - currentRecord.lastActivity > 15 * 60 * 1000) {
                 console.log(
                   `[${refreshCheckId}] No activity detected after TLS refresh. ` +
                     `Closing connection to ensure certificate freshness.`
                 );
                 this.initiateCleanupOnce(currentRecord, 'tls_refresh_verification_failed');
               }
-            }, 5 * 60 * 1000);
+            }, 15 * 60 * 1000);
             
             // Make sure timeout doesn't keep the process alive
             if (refreshCheck.unref) {
@@ -1133,9 +1238,9 @@ export class PortProxy {
         const connectionAge = Date.now() - record.incomingStartTime;
         const hourInMs = 60 * 60 * 1000;
 
-        // For TLS browser connections, use a much more aggressive timeout
+        // For TLS browser connections, use a more generous timeout now that 
-        // to avoid certificate issues, especially in chained proxy scenarios
+        // we've fixed the renegotiation handling issues
-        if (record.isTLS && record.hasKeepAlive && connectionAge > 45 * 60 * 1000) { // 45 minutes instead of 12 hours
+        if (record.isTLS && record.hasKeepAlive && connectionAge > 8 * hourInMs) { // 8 hours instead of 45 minutes
           console.log(
             `[${record.id}] Long-lived TLS connection (${plugins.prettyMs(connectionAge)}). ` +
               `Closing to ensure proper certificate handling on browser reconnect in proxy chain.`
@@ -1602,6 +1707,12 @@ export class PortProxy {
         // Save domain config in connection record
         connectionRecord.domainConfig = domainConfig;
         
+        // Always set the lockedDomain, even for non-SNI connections
+        if (serverName) {
+          connectionRecord.lockedDomain = serverName;
+          console.log(`[${connectionId}] Locked connection to domain: ${serverName}`);
+        }
+
         // IP validation is skipped if allowedIPs is empty
         if (domainConfig) {
           const effectiveAllowedIPs: string[] = [