3.30.8

fix(core): No changes in this commit.
fix(PortProxy): Fix TypeScript errors by using correct variable names
2025-03-11 02:50:01 +00:00 · 2025-03-11 02:50:01 +00:00 · 2025-03-11 02:47:57 +00:00 · 2025-03-11 02:45:51 +00:00 · 2025-03-11 02:40:08 +00:00 · 2025-03-11 02:25:59 +00:00
4 changed files with 167 additions and 99 deletions
--- a/changelog.md
+++ b/changelog.md
@ -1,5 +1,17 @@
 # Changelog

+## 2025-03-11 - 3.30.8 - fix(core)
+No changes in this commit.
+
+
+## 2025-03-11 - 3.30.7 - fix(PortProxy)
+Improve TLS renegotiation SNI handling by first checking if the new SNI is allowed under the existing domain config. If not, attempt to find an alternative domain config and update the locked domain accordingly; otherwise, terminate the connection on SNI mismatch.
+
+- Added a preliminary check against the original domain config to allow re-handshakes if the new SNI matches allowed patterns.
+- If the original config does not allow, search for an alternative domain config and validate IP rules.
+- Update the locked domain when allowed, ensuring connection reuse with valid certificate context.
+- Terminate the connection if no suitable domain config is found or IP restrictions are violated.
+
 ## 2025-03-11 - 3.30.6 - fix(PortProxy)
 Improve TLS renegotiation handling in PortProxy by validating the new SNI against allowed domain configurations. If the new SNI is permitted based on existing IP rules, update the locked domain to allow connection reuse; otherwise, terminate the connection to prevent misrouting.

--- a/package.json
+++ b/package.json
@ -1,6 +1,6 @@
 {
  "name": "@push.rocks/smartproxy",
-  "version": "3.30.6",
+  "version": "3.30.8",
  "private": false,
  "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.",
  "main": "dist_ts/index.js",
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@ -3,6 +3,6 @@
 */
 export const commitinfo = {
  name: '@push.rocks/smartproxy',
-  version: '3.30.6',
+  version: '3.30.8',
  description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, and dynamic routing with authentication options.'
 }
--- a/ts/classes.portproxy.ts
+++ b/ts/classes.portproxy.ts
@ -501,28 +501,17 @@ export class PortProxy {
        }
        this.cleanupConnection(record, 'client_closed');
      });
-
-      // Update activity on data transfer
+      
+      // Special handler for TLS handshake detection with NetworkProxy
      socket.on('data', (chunk: Buffer) => {
-        this.updateActivity(record);
-
-        // Check for potential TLS renegotiation or reconnection packets
+        // Check for TLS handshake packets (ContentType.handshake)
        if (chunk.length > 0 && chunk[0] === 22) {
-          // ContentType.handshake
-          if (this.settings.enableDetailedLogging) {
-            console.log(
-              `[${connectionId}] Detected potential TLS handshake data while connected to NetworkProxy`
-            );
-          }
-
-          // NOTE: We don't need to explicitly forward the renegotiation packets
-          // because socket.pipe(proxySocket) is already handling that.
-          // The pipe ensures all data (including renegotiation) flows through properly.
-          // Just update the activity timestamp to prevent timeouts
-          record.lastActivity = Date.now();
+          console.log(`[${connectionId}] Detected potential TLS handshake with NetworkProxy, updating activity`);
+          this.updateActivity(record);
        }
      });

+      // Update activity on data transfer from the proxy socket
      proxySocket.on('data', () => this.updateActivity(record));

      if (this.settings.enableDetailedLogging) {
@ -778,6 +767,75 @@ export class PortProxy {
            return this.initiateCleanupOnce(record, 'write_error');
          }

+          // Set up the renegotiation listener *before* piping if this is a TLS connection with SNI
+          if (serverName && record.isTLS) {
+            // This listener handles TLS renegotiation detection
+            socket.on('data', (renegChunk) => {
+              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+                // Always update activity timestamp for any handshake packet
+                this.updateActivity(record);
+                
+                try {
+                  // Try to extract SNI from potential renegotiation
+                  const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+                  
+                  // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+                  if (newSNI === undefined) {
+                    console.log(`[${connectionId}] Rehandshake detected without SNI, allowing it through.`);
+                    return;
+                  }
+                  
+                  // Check if the SNI has changed
+                  if (newSNI !== serverName) {
+                    console.log(`[${connectionId}] Rehandshake with different SNI: ${newSNI} vs original ${serverName}`);
+                    
+                    // Allow if the new SNI matches existing domain config or find a new matching config
+                    let allowed = false;
+                    
+                    if (record.domainConfig) {
+                      allowed = record.domainConfig.domains.some(d => plugins.minimatch(newSNI, d));
+                    }
+                    
+                    if (!allowed) {
+                      const newDomainConfig = this.settings.domainConfigs.find((config) =>
+                        config.domains.some((d) => plugins.minimatch(newSNI, d))
+                      );
+                      
+                      if (newDomainConfig) {
+                        const effectiveAllowedIPs = [
+                          ...newDomainConfig.allowedIPs,
+                          ...(this.settings.defaultAllowedIPs || []),
+                        ];
+                        const effectiveBlockedIPs = [
+                          ...(newDomainConfig.blockedIPs || []),
+                          ...(this.settings.defaultBlockedIPs || []),
+                        ];
+                        
+                        allowed = isGlobIPAllowed(record.remoteIP, effectiveAllowedIPs, effectiveBlockedIPs);
+                        
+                        if (allowed) {
+                          record.domainConfig = newDomainConfig;
+                        }
+                      }
+                    }
+                    
+                    if (allowed) {
+                      console.log(`[${connectionId}] Updated domain for connection from ${record.remoteIP} to: ${newSNI}`);
+                      record.lockedDomain = newSNI;
+                    } else {
+                      console.log(`[${connectionId}] Rehandshake SNI ${newSNI} not allowed. Terminating connection.`);
+                      this.initiateCleanupOnce(record, 'sni_mismatch');
+                    }
+                  } else {
+                    console.log(`[${connectionId}] Rehandshake with same SNI: ${newSNI}`);
+                  }
+                } catch (err) {
+                  console.log(`[${connectionId}] Error processing renegotiation: ${err}. Allowing to continue.`);
+                }
+              }
+            });
+          }
+          
          // Now set up piping for future data and resume the socket
          socket.pipe(targetSocket);
          targetSocket.pipe(socket);
@ -811,7 +869,76 @@ export class PortProxy {
          }
        });
      } else {
-        // No pending data, so just set up piping
+        // Set up the renegotiation listener *before* piping if this is a TLS connection with SNI
+        if (serverName && record.isTLS) {
+          // This listener handles TLS renegotiation detection
+          socket.on('data', (renegChunk) => {
+            if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+              // Always update activity timestamp for any handshake packet
+              this.updateActivity(record);
+              
+              try {
+                // Try to extract SNI from potential renegotiation
+                const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+                
+                // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+                if (newSNI === undefined) {
+                  console.log(`[${connectionId}] Rehandshake detected without SNI, allowing it through.`);
+                  return;
+                }
+                
+                // Check if the SNI has changed
+                if (newSNI !== serverName) {
+                  console.log(`[${connectionId}] Rehandshake with different SNI: ${newSNI} vs original ${serverName}`);
+                  
+                  // Allow if the new SNI matches existing domain config or find a new matching config
+                  let allowed = false;
+                  
+                  if (record.domainConfig) {
+                    allowed = record.domainConfig.domains.some(d => plugins.minimatch(newSNI, d));
+                  }
+                  
+                  if (!allowed) {
+                    const newDomainConfig = this.settings.domainConfigs.find((config) =>
+                      config.domains.some((d) => plugins.minimatch(newSNI, d))
+                    );
+                    
+                    if (newDomainConfig) {
+                      const effectiveAllowedIPs = [
+                        ...newDomainConfig.allowedIPs,
+                        ...(this.settings.defaultAllowedIPs || []),
+                      ];
+                      const effectiveBlockedIPs = [
+                        ...(newDomainConfig.blockedIPs || []),
+                        ...(this.settings.defaultBlockedIPs || []),
+                      ];
+                      
+                      allowed = isGlobIPAllowed(record.remoteIP, effectiveAllowedIPs, effectiveBlockedIPs);
+                      
+                      if (allowed) {
+                        record.domainConfig = newDomainConfig;
+                      }
+                    }
+                  }
+                  
+                  if (allowed) {
+                    console.log(`[${connectionId}] Updated domain for connection from ${record.remoteIP} to: ${newSNI}`);
+                    record.lockedDomain = newSNI;
+                  } else {
+                    console.log(`[${connectionId}] Rehandshake SNI ${newSNI} not allowed. Terminating connection.`);
+                    this.initiateCleanupOnce(record, 'sni_mismatch');
+                  }
+                } else {
+                  console.log(`[${connectionId}] Rehandshake with same SNI: ${newSNI}`);
+                }
+              } catch (err) {
+                console.log(`[${connectionId}] Error processing renegotiation: ${err}. Allowing to continue.`);
+              }
+            }
+          });
+        }
+        
+        // Now set up piping
        socket.pipe(targetSocket);
        targetSocket.pipe(socket);
        socket.resume(); // Resume the socket after piping is established
@ -848,85 +975,8 @@ export class PortProxy {
      record.pendingData = [];
      record.pendingDataSize = 0;

-      // Add the renegotiation listener for SNI validation
-      if (serverName) {
-        // This listener will check for TLS renegotiation attempts
-        // Note: We don't need to explicitly forward the renegotiation packets
-        // since socket.pipe(targetSocket) is already set up earlier and handles that
-        socket.on('data', (renegChunk: Buffer) => {
-          if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
-            try {
-              // Try to extract SNI from potential renegotiation
-              const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
-              
-              // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
-              // Otherwise valid renegotiations that don't explicitly repeat the SNI will break
-              if (newSNI === undefined) {
-                if (this.settings.enableDetailedLogging) {
-                  console.log(
-                    `[${connectionId}] Rehandshake detected without SNI, allowing it through.`
-                  );
-                }
-                // Let it pass through - this is critical for Chrome's TLS handling
-                return;
-              }
-              
-              // Check if the SNI has changed
-              if (newSNI && newSNI !== record.lockedDomain) {
-                // Instead of immediately terminating, check if the new SNI would be allowed
-                // by the same ruleset that allowed the initial connection
-                const newDomainConfig = this.settings.domainConfigs.find((config) =>
-                  config.domains.some((d) => plugins.minimatch(newSNI, d))
-                );
-                
-                // If we found a matching domain config, check IP rules
-                if (newDomainConfig) {
-                  const effectiveAllowedIPs = [
-                    ...newDomainConfig.allowedIPs,
-                    ...(this.settings.defaultAllowedIPs || []),
-                  ];
-                  const effectiveBlockedIPs = [
-                    ...(newDomainConfig.blockedIPs || []),
-                    ...(this.settings.defaultBlockedIPs || []),
-                  ];
-                  
-                  // Check if the IP is allowed for the new domain
-                  if (isGlobIPAllowed(record.remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
-                    // Allow the domain switch - Chrome is reusing the connection for a different domain
-                    if (this.settings.enableDetailedLogging) {
-                      console.log(
-                        `[${connectionId}] Rehandshake with new SNI: ${newSNI} (previously ${record.lockedDomain}). ` +
-                        `New domain is allowed by rules, permitting connection reuse.`
-                      );
-                    }
-                    
-                    // Update the locked domain to the new domain
-                    record.lockedDomain = newSNI;
-                    return;
-                  }
-                }
-                
-                // If we get here, either no matching domain config was found or the IP is not allowed
-                console.log(
-                  `[${connectionId}] Rehandshake detected with different SNI: ${newSNI} vs locked ${record.lockedDomain}. ` +
-                  `New domain not allowed by rules. Terminating connection.`
-                );
-                this.initiateCleanupOnce(record, 'sni_mismatch');
-              } else if (newSNI && this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Rehandshake detected with same SNI: ${newSNI}. Allowing.`
-                );
-              }
-            } catch (err) {
-              // Always allow the renegotiation to continue if we encounter an error
-              // This ensures Chrome can complete its TLS renegotiation
-              console.log(
-                `[${connectionId}] Error processing potential renegotiation: ${err}. Allowing connection to continue.`
-              );
-            }
-          }
-        });
-      }
+      // Renegotiation detection is now handled before piping is established
+      // This ensures the data listener receives all packets properly

      // Set connection timeout with simpler logic
      if (record.cleanupTimer) {
@ -1656,6 +1706,12 @@ export class PortProxy {

        // Save domain config in connection record
        connectionRecord.domainConfig = domainConfig;
+        
+        // Always set the lockedDomain, even for non-SNI connections
+        if (serverName) {
+          connectionRecord.lockedDomain = serverName;
+          console.log(`[${connectionId}] Locked connection to domain: ${serverName}`);
+        }

        // IP validation is skipped if allowedIPs is empty
        if (domainConfig) {
Author	SHA1	Message	Date
Philipp Kunz	98b7f3ed7f	3.30.8 Some checks failed Default (tags) / security (push) Failing after 11m56s Details Default (tags) / test (push) Has been cancelled Details Default (tags) / release (push) Has been cancelled Details Default (tags) / metadata (push) Has been cancelled Details	2025-03-11 02:50:01 +00:00
Philipp Kunz	cb83caeafd	fix(core): No changes in this commit.	2025-03-11 02:50:01 +00:00
Philipp Kunz	7850a80452	fix(PortProxy): Fix TypeScript errors by using correct variable names Fixed TypeScript errors caused by using 'connectionRecord' instead of 'record' in TLS renegotiation handlers. The variable name mistake occurred when moving and restructuring the TLS handshake detection code. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-03-11 02:47:57 +00:00
Philipp Kunz	ef8f583a90	fix(PortProxy): Move TLS renegotiation detection before socket piping Fundamentally restructured TLS renegotiation handling to ensure handshake packets are properly detected. The previous implementation attached event handlers after pipe() was established, which might have caused handshake packets to bypass detection. Key changes: 1. Moved renegotiation detection before pipe() to ensure all TLS handshake packets are detected 2. Added explicit lockedDomain setting for all SNI connections 3. Simplified the NetworkProxy TLS handshake detection 4. Removed redundant data handlers that could interfere with each other These changes should make renegotiation detection more reliable regardless of how Node.js internal pipe() implementation handles data events. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-03-11 02:45:51 +00:00
Philipp Kunz	2bdd6f8c1f	fix(PortProxy): Update activity timestamp during TLS renegotiation to prevent connection timeouts Ensures that TLS renegotiation packets properly update the connection's activity timestamp even when no SNI is present or when there are errors processing the renegotiation. This prevents connections from being closed due to inactivity during legitimate TLS renegotiation. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-03-11 02:40:08 +00:00
Philipp Kunz	99d28eafd1	3.30.7 Some checks failed Default (tags) / security (push) Successful in 29s Details Default (tags) / test (push) Failing after 1m1s Details Default (tags) / release (push) Has been skipped Details Default (tags) / metadata (push) Has been skipped Details	2025-03-11 02:25:59 +00:00
Philipp Kunz	788b444fcc	fix(PortProxy): Improve TLS renegotiation SNI handling by first checking if the new SNI is allowed under the existing domain config. If not, attempt to find an alternative domain config and update the locked domain accordingly; otherwise, terminate the connection on SNI mismatch.	2025-03-11 02:25:58 +00:00