4.1.13

changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2025-03-17 - 4.1.13 - fix(tls-handshake)
+Set certificate_expired TLS alert level to warning instead of fatal to allow graceful termination.
+
+- In the TLS handshake alert for certificate_expired (0x2F), changed the alert level from 0x02 (fatal) to 0x01 (warning).
+- This change avoids abrupt connection termination, enabling a smoother handling of certificate expiration alerts.
+
+## 2025-03-17 - 4.1.12 - fix(classes.pp.connectionhandler)
+Replace unrecognized_name alert data with certificate_expired alert in TLS handshake handling for session resumption without SNI
+
+- Switched the alert payload from serverNameUnknownAlertData to a new certificateExpiredAlert buffer
+- Now sends a fatal certificate_expired alert (code 47) instead of a warning unrecognized_name alert
+- Improves TLS error reporting and encourages immediate disconnection when a ClientHello lacks SNI and session tickets are disallowed
+
+## 2025-03-17 - 4.1.11 - fix(connectionhandler)
+Increase delay before cleaning up connections when session resumption is blocked due to missing SNI, allowing more natural socket termination.
+
+- Changed cleanup delay in ts/classes.pp.connectionhandler.ts from 300ms to 1000ms.
+- This fix ensures that sockets get sufficient time to terminate gracefully.
+
 ## 2025-03-16 - 4.1.10 - fix(connectionhandler)
 Increase delay timings for TLS alert transmission in session ticket blocking to allow graceful socket termination
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "4.1.10",
+  "version": "4.1.13",
   "private": false,
   "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, dynamic routing with authentication options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '4.1.10',
+  version: '4.1.13',
   description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, dynamic routing with authentication options, and automatic ACME certificate management.'
 }

ts/classes.pp.connectionhandler.ts

@@ -605,10 +605,20 @@ export class ConnectionHandler {
               0x00, // close_notify alert (0)
             ]);
 
+            const certificateExpiredAlert = Buffer.from([
+              0x15, // Alert record type
+              0x03,
+              0x03, // TLS 1.2 version
+              0x00,
+              0x02, // Length
+              0x01, // Warning alert level (1)
+              0x2F, // certificate_expired alert (47)
+            ]);
+
             try {
               // Use cork/uncork to ensure the alert is sent as a single packet
               socket.cork();
-              const writeSuccessful = socket.write(serverNameUnknownAlertData);
+              const writeSuccessful = socket.write(certificateExpiredAlert);
               socket.uncork();
               
               // Function to handle the clean socket termination - but more gradually
@@ -620,7 +630,7 @@ export class ConnectionHandler {
                 // Log the cleanup but wait for natural closure
                 setTimeout(() => {
                   this.connectionManager.cleanupConnection(record, 'session_ticket_blocked_no_sni');
-                }, 300); // Longer delay to let socket cleanup happen naturally
+                }, 1000); // Longer delay to let socket cleanup happen naturally
               };
               
               if (writeSuccessful) {