2154 lines
80 KiB
TypeScript
2154 lines
80 KiB
TypeScript
import * as plugins from './plugins.js';
|
|
import { NetworkProxy } from './classes.networkproxy.js';
|
|
import { SniHandler } from './classes.snihandler.js';
|
|
|
|
/** Domain configuration with per-domain allowed port ranges */
|
|
export interface IDomainConfig {
|
|
domains: string[]; // Glob patterns for domain(s)
|
|
allowedIPs: string[]; // Glob patterns for allowed IPs
|
|
blockedIPs?: string[]; // Glob patterns for blocked IPs
|
|
targetIPs?: string[]; // If multiple targetIPs are given, use round robin.
|
|
portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
|
|
// Allow domain-specific timeout override
|
|
connectionTimeout?: number; // Connection timeout override (ms)
|
|
}
|
|
|
|
/** Port proxy settings including global allowed port ranges */
|
|
export interface IPortProxySettings extends plugins.tls.TlsOptions {
|
|
fromPort: number;
|
|
toPort: number;
|
|
targetIP?: string; // Global target host to proxy to, defaults to 'localhost'
|
|
domainConfigs: IDomainConfig[];
|
|
sniEnabled?: boolean;
|
|
defaultAllowedIPs?: string[];
|
|
defaultBlockedIPs?: string[];
|
|
preserveSourceIP?: boolean;
|
|
|
|
// Timeout settings
|
|
initialDataTimeout?: number; // Timeout for initial data/SNI (ms), default: 60000 (60s)
|
|
socketTimeout?: number; // Socket inactivity timeout (ms), default: 3600000 (1h)
|
|
inactivityCheckInterval?: number; // How often to check for inactive connections (ms), default: 60000 (60s)
|
|
maxConnectionLifetime?: number; // Default max connection lifetime (ms), default: 86400000 (24h)
|
|
inactivityTimeout?: number; // Inactivity timeout (ms), default: 14400000 (4h)
|
|
|
|
gracefulShutdownTimeout?: number; // (ms) maximum time to wait for connections to close during shutdown
|
|
globalPortRanges: Array<{ from: number; to: number }>; // Global allowed port ranges
|
|
forwardAllGlobalRanges?: boolean; // When true, forwards all connections on global port ranges to the global targetIP
|
|
|
|
// Socket optimization settings
|
|
noDelay?: boolean; // Disable Nagle's algorithm (default: true)
|
|
keepAlive?: boolean; // Enable TCP keepalive (default: true)
|
|
keepAliveInitialDelay?: number; // Initial delay before sending keepalive probes (ms)
|
|
maxPendingDataSize?: number; // Maximum bytes to buffer during connection setup
|
|
|
|
// Enhanced features
|
|
disableInactivityCheck?: boolean; // Disable inactivity checking entirely
|
|
enableKeepAliveProbes?: boolean; // Enable TCP keep-alive probes
|
|
enableDetailedLogging?: boolean; // Enable detailed connection logging
|
|
enableTlsDebugLogging?: boolean; // Enable TLS handshake debug logging
|
|
enableRandomizedTimeouts?: boolean; // Randomize timeouts slightly to prevent thundering herd
|
|
|
|
// Rate limiting and security
|
|
maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
|
|
connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
|
|
|
|
// Enhanced keep-alive settings
|
|
keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
|
|
keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
|
|
extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
|
|
|
|
// NetworkProxy integration
|
|
useNetworkProxy?: number[]; // Array of ports to forward to NetworkProxy
|
|
networkProxyPort?: number; // Port where NetworkProxy is listening (default: 8443)
|
|
|
|
// ACME certificate management options
|
|
acme?: {
|
|
enabled?: boolean; // Whether to enable automatic certificate management
|
|
port?: number; // Port to listen on for ACME challenges (default: 80)
|
|
contactEmail?: string; // Email for Let's Encrypt account
|
|
useProduction?: boolean; // Whether to use Let's Encrypt production (default: false for staging)
|
|
renewThresholdDays?: number; // Days before expiry to renew certificates (default: 30)
|
|
autoRenew?: boolean; // Whether to automatically renew certificates (default: true)
|
|
certificateStore?: string; // Directory to store certificates (default: ./certs)
|
|
skipConfiguredCerts?: boolean; // Skip domains that already have certificates configured
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Enhanced connection record
|
|
*/
|
|
interface IConnectionRecord {
|
|
id: string; // Unique connection identifier
|
|
incoming: plugins.net.Socket;
|
|
outgoing: plugins.net.Socket | null;
|
|
incomingStartTime: number;
|
|
outgoingStartTime?: number;
|
|
outgoingClosedTime?: number;
|
|
lockedDomain?: string; // Used to lock this connection to the initial SNI
|
|
connectionClosed: boolean; // Flag to prevent multiple cleanup attempts
|
|
cleanupTimer?: NodeJS.Timeout; // Timer for max lifetime/inactivity
|
|
lastActivity: number; // Last activity timestamp for inactivity detection
|
|
pendingData: Buffer[]; // Buffer to hold data during connection setup
|
|
pendingDataSize: number; // Track total size of pending data
|
|
|
|
// Enhanced tracking fields
|
|
bytesReceived: number; // Total bytes received
|
|
bytesSent: number; // Total bytes sent
|
|
remoteIP: string; // Remote IP (cached for logging after socket close)
|
|
localPort: number; // Local port (cached for logging)
|
|
isTLS: boolean; // Whether this connection is a TLS connection
|
|
tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete
|
|
hasReceivedInitialData: boolean; // Whether initial data has been received
|
|
domainConfig?: IDomainConfig; // Associated domain config for this connection
|
|
|
|
// Keep-alive tracking
|
|
hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
|
|
inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
|
|
incomingTerminationReason?: string | null; // Reason for incoming termination
|
|
outgoingTerminationReason?: string | null; // Reason for outgoing termination
|
|
|
|
// NetworkProxy tracking
|
|
usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
|
|
|
|
// Renegotiation handler
|
|
renegotiationHandler?: (chunk: Buffer) => void; // Handler for renegotiation detection
|
|
|
|
// Browser connection tracking
|
|
isBrowserConnection?: boolean; // Whether this connection appears to be from a browser
|
|
domainSwitches?: number; // Number of times the domain has been switched on this connection
|
|
}
|
|
|
|
// SNI functions are now imported from SniHandler class
|
|
// No need for wrapper functions
|
|
|
|
// Helper: Check if a port falls within any of the given port ranges
|
|
const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
|
|
return ranges.some((range) => port >= range.from && port <= range.to);
|
|
};
|
|
|
|
// Helper: Check if a given IP matches any of the glob patterns
|
|
const isAllowed = (ip: string, patterns: string[]): boolean => {
|
|
if (!ip || !patterns || patterns.length === 0) return false;
|
|
|
|
const normalizeIP = (ip: string): string[] => {
|
|
if (!ip) return [];
|
|
if (ip.startsWith('::ffff:')) {
|
|
const ipv4 = ip.slice(7);
|
|
return [ip, ipv4];
|
|
}
|
|
if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
|
|
return [ip, `::ffff:${ip}`];
|
|
}
|
|
return [ip];
|
|
};
|
|
|
|
const normalizedIPVariants = normalizeIP(ip);
|
|
if (normalizedIPVariants.length === 0) return false;
|
|
|
|
const expandedPatterns = patterns.flatMap(normalizeIP);
|
|
return normalizedIPVariants.some((ipVariant) =>
|
|
expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern))
|
|
);
|
|
};
|
|
|
|
// Helper: Check if an IP is allowed considering allowed and blocked glob patterns
|
|
const isGlobIPAllowed = (ip: string, allowed: string[], blocked: string[] = []): boolean => {
|
|
if (!ip) return false;
|
|
if (blocked.length > 0 && isAllowed(ip, blocked)) return false;
|
|
return isAllowed(ip, allowed);
|
|
};
|
|
|
|
// Helper: Generate a unique connection ID
|
|
const generateConnectionId = (): string => {
|
|
return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
|
|
};
|
|
|
|
// SNI functions are now imported from SniHandler class
|
|
|
|
// Helper: Ensure timeout values don't exceed Node.js max safe integer
|
|
const ensureSafeTimeout = (timeout: number): number => {
|
|
const MAX_SAFE_TIMEOUT = 2147483647; // Maximum safe value (2^31 - 1)
|
|
return Math.min(Math.floor(timeout), MAX_SAFE_TIMEOUT);
|
|
};
|
|
|
|
// Helper: Generate a slightly randomized timeout to prevent thundering herd
|
|
const randomizeTimeout = (baseTimeout: number, variationPercent: number = 5): number => {
|
|
const safeBaseTimeout = ensureSafeTimeout(baseTimeout);
|
|
const variation = safeBaseTimeout * (variationPercent / 100);
|
|
return ensureSafeTimeout(safeBaseTimeout + Math.floor(Math.random() * variation * 2) - variation);
|
|
};
|
|
|
|
export class PortProxy {
|
|
private netServers: plugins.net.Server[] = [];
|
|
settings: IPortProxySettings;
|
|
private connectionRecords: Map<string, IConnectionRecord> = new Map();
|
|
private connectionLogger: NodeJS.Timeout | null = null;
|
|
private isShuttingDown: boolean = false;
|
|
|
|
// Map to track round robin indices for each domain config
|
|
private domainTargetIndices: Map<IDomainConfig, number> = new Map();
|
|
|
|
// Enhanced stats tracking
|
|
private terminationStats: {
|
|
incoming: Record<string, number>;
|
|
outgoing: Record<string, number>;
|
|
} = {
|
|
incoming: {},
|
|
outgoing: {},
|
|
};
|
|
|
|
// Connection tracking by IP for rate limiting
|
|
private connectionsByIP: Map<string, Set<string>> = new Map();
|
|
private connectionRateByIP: Map<string, number[]> = new Map();
|
|
|
|
// NetworkProxy instance for TLS termination
|
|
private networkProxy: NetworkProxy | null = null;
|
|
|
|
constructor(settingsArg: IPortProxySettings) {
|
|
// Set reasonable defaults for all settings
|
|
this.settings = {
|
|
...settingsArg,
|
|
targetIP: settingsArg.targetIP || 'localhost',
|
|
|
|
// Timeout settings with reasonable defaults
|
|
initialDataTimeout: settingsArg.initialDataTimeout || 60000, // 60 seconds for initial handshake
|
|
socketTimeout: ensureSafeTimeout(settingsArg.socketTimeout || 3600000), // 1 hour socket timeout
|
|
inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000, // 60 seconds interval
|
|
maxConnectionLifetime: ensureSafeTimeout(settingsArg.maxConnectionLifetime || 86400000), // 24 hours default
|
|
inactivityTimeout: ensureSafeTimeout(settingsArg.inactivityTimeout || 14400000), // 4 hours inactivity timeout
|
|
|
|
gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds
|
|
|
|
// Socket optimization settings
|
|
noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
|
|
keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
|
|
keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds
|
|
maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB
|
|
|
|
// Feature flags
|
|
disableInactivityCheck: settingsArg.disableInactivityCheck || false,
|
|
enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined
|
|
? settingsArg.enableKeepAliveProbes : true,
|
|
enableDetailedLogging: settingsArg.enableDetailedLogging || false,
|
|
enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
|
|
enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
|
|
|
|
// Rate limiting defaults
|
|
maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
|
|
connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
|
|
|
|
// Enhanced keep-alive settings
|
|
keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended',
|
|
keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6,
|
|
extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
|
|
|
|
// NetworkProxy settings
|
|
networkProxyPort: settingsArg.networkProxyPort || 8443, // Default NetworkProxy port
|
|
|
|
// ACME certificate settings with reasonable defaults
|
|
acme: settingsArg.acme || {
|
|
enabled: false,
|
|
port: 80,
|
|
contactEmail: 'admin@example.com',
|
|
useProduction: false,
|
|
renewThresholdDays: 30,
|
|
autoRenew: true,
|
|
certificateStore: './certs',
|
|
skipConfiguredCerts: false
|
|
}
|
|
};
|
|
|
|
// Initialize NetworkProxy if enabled
|
|
if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
|
|
this.initializeNetworkProxy();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Initialize NetworkProxy instance
|
|
*/
|
|
private async initializeNetworkProxy(): Promise<void> {
|
|
if (!this.networkProxy) {
|
|
// Configure NetworkProxy options based on PortProxy settings
|
|
const networkProxyOptions: any = {
|
|
port: this.settings.networkProxyPort!,
|
|
portProxyIntegration: true,
|
|
logLevel: this.settings.enableDetailedLogging ? 'debug' : 'info'
|
|
};
|
|
|
|
// Add ACME settings if configured
|
|
if (this.settings.acme) {
|
|
networkProxyOptions.acme = { ...this.settings.acme };
|
|
}
|
|
|
|
this.networkProxy = new NetworkProxy(networkProxyOptions);
|
|
|
|
console.log(`Initialized NetworkProxy on port ${this.settings.networkProxyPort}`);
|
|
|
|
// Convert and apply domain configurations to NetworkProxy
|
|
await this.syncDomainConfigsToNetworkProxy();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Updates the domain configurations for the proxy
|
|
* @param newDomainConfigs The new domain configurations
|
|
*/
|
|
public async updateDomainConfigs(newDomainConfigs: IDomainConfig[]): Promise<void> {
|
|
console.log(`Updating domain configurations (${newDomainConfigs.length} configs)`);
|
|
this.settings.domainConfigs = newDomainConfigs;
|
|
|
|
// If NetworkProxy is initialized, resync the configurations
|
|
if (this.networkProxy) {
|
|
await this.syncDomainConfigsToNetworkProxy();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Updates the ACME certificate settings
|
|
* @param acmeSettings New ACME settings
|
|
*/
|
|
public async updateAcmeSettings(acmeSettings: IPortProxySettings['acme']): Promise<void> {
|
|
console.log('Updating ACME certificate settings');
|
|
|
|
// Update settings
|
|
this.settings.acme = {
|
|
...this.settings.acme,
|
|
...acmeSettings
|
|
};
|
|
|
|
// If NetworkProxy is initialized, update its ACME settings
|
|
if (this.networkProxy) {
|
|
try {
|
|
// Recreate NetworkProxy with new settings if ACME enabled state has changed
|
|
if (this.settings.acme.enabled !== acmeSettings.enabled) {
|
|
console.log(`ACME enabled state changed to: ${acmeSettings.enabled}`);
|
|
|
|
// Stop the current NetworkProxy
|
|
await this.networkProxy.stop();
|
|
this.networkProxy = null;
|
|
|
|
// Reinitialize with new settings
|
|
await this.initializeNetworkProxy();
|
|
|
|
// Use start() to make sure ACME gets initialized if newly enabled
|
|
await this.networkProxy.start();
|
|
} else {
|
|
// Update existing NetworkProxy with new settings
|
|
// Note: Some settings may require a restart to take effect
|
|
console.log('Updating ACME settings in NetworkProxy');
|
|
|
|
// For certificate renewals, we might want to trigger checks with the new settings
|
|
if (acmeSettings.renewThresholdDays) {
|
|
console.log(`Setting new renewal threshold to ${acmeSettings.renewThresholdDays} days`);
|
|
// This is implementation-dependent but gives an example
|
|
if (this.networkProxy.options.acme) {
|
|
this.networkProxy.options.acme.renewThresholdDays = acmeSettings.renewThresholdDays;
|
|
}
|
|
}
|
|
}
|
|
} catch (err) {
|
|
console.log(`Error updating ACME settings: ${err}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Synchronizes PortProxy domain configurations to NetworkProxy
|
|
* This allows domains configured in PortProxy to be used by NetworkProxy
|
|
*/
|
|
private async syncDomainConfigsToNetworkProxy(): Promise<void> {
|
|
if (!this.networkProxy) {
|
|
console.log('Cannot sync configurations - NetworkProxy not initialized');
|
|
return;
|
|
}
|
|
|
|
try {
|
|
// Get SSL certificates from assets
|
|
// Import fs directly since it's not in plugins
|
|
const fs = await import('fs');
|
|
|
|
let certPair;
|
|
try {
|
|
certPair = {
|
|
key: fs.readFileSync('assets/certs/key.pem', 'utf8'),
|
|
cert: fs.readFileSync('assets/certs/cert.pem', 'utf8')
|
|
};
|
|
} catch (certError) {
|
|
console.log(`Warning: Could not read default certificates: ${certError}`);
|
|
console.log('Using empty certificate placeholders - ACME will generate proper certificates if enabled');
|
|
|
|
// Use empty placeholders - NetworkProxy will use its internal defaults
|
|
// or ACME will generate proper ones if enabled
|
|
certPair = {
|
|
key: '',
|
|
cert: ''
|
|
};
|
|
}
|
|
|
|
// Convert domain configs to NetworkProxy configs
|
|
const proxyConfigs = this.networkProxy.convertPortProxyConfigs(
|
|
this.settings.domainConfigs,
|
|
certPair
|
|
);
|
|
|
|
// Log ACME-eligible domains if ACME is enabled
|
|
if (this.settings.acme?.enabled) {
|
|
const acmeEligibleDomains = proxyConfigs
|
|
.filter(config => !config.hostName.includes('*')) // Exclude wildcards
|
|
.map(config => config.hostName);
|
|
|
|
if (acmeEligibleDomains.length > 0) {
|
|
console.log(`Domains eligible for ACME certificates: ${acmeEligibleDomains.join(', ')}`);
|
|
} else {
|
|
console.log('No domains eligible for ACME certificates found in configuration');
|
|
}
|
|
}
|
|
|
|
// Update NetworkProxy with the converted configs
|
|
this.networkProxy.updateProxyConfigs(proxyConfigs).then(() => {
|
|
console.log(`Successfully synchronized ${proxyConfigs.length} domain configurations to NetworkProxy`);
|
|
}).catch(err => {
|
|
console.log(`Error synchronizing configurations: ${err.message}`);
|
|
});
|
|
} catch (err) {
|
|
console.log(`Failed to sync configurations: ${err}`);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Requests a certificate for a specific domain
|
|
* @param domain The domain to request a certificate for
|
|
* @returns Promise that resolves to true if the request was successful, false otherwise
|
|
*/
|
|
public async requestCertificate(domain: string): Promise<boolean> {
|
|
if (!this.networkProxy) {
|
|
console.log('Cannot request certificate - NetworkProxy not initialized');
|
|
return false;
|
|
}
|
|
|
|
if (!this.settings.acme?.enabled) {
|
|
console.log('Cannot request certificate - ACME is not enabled');
|
|
return false;
|
|
}
|
|
|
|
try {
|
|
const result = await this.networkProxy.requestCertificate(domain);
|
|
if (result) {
|
|
console.log(`Certificate request for ${domain} submitted successfully`);
|
|
} else {
|
|
console.log(`Certificate request for ${domain} failed`);
|
|
}
|
|
return result;
|
|
} catch (err) {
|
|
console.log(`Error requesting certificate: ${err}`);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Forwards a TLS connection to a NetworkProxy for handling
|
|
* @param connectionId - Unique connection identifier
|
|
* @param socket - The incoming client socket
|
|
* @param record - The connection record
|
|
* @param initialData - Initial data chunk (TLS ClientHello)
|
|
*/
|
|
private forwardToNetworkProxy(
|
|
connectionId: string,
|
|
socket: plugins.net.Socket,
|
|
record: IConnectionRecord,
|
|
initialData: Buffer
|
|
): void {
|
|
// Ensure NetworkProxy is initialized
|
|
if (!this.networkProxy) {
|
|
console.log(
|
|
`[${connectionId}] NetworkProxy not initialized. Using fallback direct connection.`
|
|
);
|
|
// Fall back to direct connection
|
|
return this.setupDirectConnection(
|
|
connectionId,
|
|
socket,
|
|
record,
|
|
undefined,
|
|
undefined,
|
|
initialData
|
|
);
|
|
}
|
|
|
|
const proxyPort = this.networkProxy.getListeningPort();
|
|
const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Forwarding TLS connection to NetworkProxy at ${proxyHost}:${proxyPort}`
|
|
);
|
|
}
|
|
|
|
// Create a connection to the NetworkProxy
|
|
const proxySocket = plugins.net.connect({
|
|
host: proxyHost,
|
|
port: proxyPort,
|
|
});
|
|
|
|
// Store the outgoing socket in the record
|
|
record.outgoing = proxySocket;
|
|
record.outgoingStartTime = Date.now();
|
|
record.usingNetworkProxy = true;
|
|
|
|
// Set up error handlers
|
|
proxySocket.on('error', (err) => {
|
|
console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
|
|
this.cleanupConnection(record, 'network_proxy_connect_error');
|
|
});
|
|
|
|
// Handle connection to NetworkProxy
|
|
proxySocket.on('connect', () => {
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
|
|
}
|
|
|
|
// First send the initial data that contains the TLS ClientHello
|
|
proxySocket.write(initialData);
|
|
|
|
// Now set up bidirectional piping between client and NetworkProxy
|
|
socket.pipe(proxySocket);
|
|
proxySocket.pipe(socket);
|
|
|
|
// Setup cleanup handlers
|
|
proxySocket.on('close', () => {
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(`[${connectionId}] NetworkProxy connection closed`);
|
|
}
|
|
this.cleanupConnection(record, 'network_proxy_closed');
|
|
});
|
|
|
|
socket.on('close', () => {
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Client connection closed after forwarding to NetworkProxy`
|
|
);
|
|
}
|
|
this.cleanupConnection(record, 'client_closed');
|
|
});
|
|
|
|
// Update activity on data transfer
|
|
socket.on('data', () => this.updateActivity(record));
|
|
proxySocket.on('data', () => this.updateActivity(record));
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] TLS connection successfully forwarded to NetworkProxy`
|
|
);
|
|
}
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Sets up a direct connection to the target (original behavior)
|
|
* This is used when NetworkProxy isn't configured or as a fallback
|
|
*/
|
|
private setupDirectConnection(
|
|
connectionId: string,
|
|
socket: plugins.net.Socket,
|
|
record: IConnectionRecord,
|
|
domainConfig: IDomainConfig | undefined,
|
|
serverName?: string,
|
|
initialChunk?: Buffer,
|
|
overridePort?: number
|
|
): void {
|
|
// Existing connection setup logic
|
|
const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
|
|
const connectionOptions: plugins.net.NetConnectOpts = {
|
|
host: targetHost,
|
|
port: overridePort !== undefined ? overridePort : this.settings.toPort,
|
|
};
|
|
if (this.settings.preserveSourceIP) {
|
|
connectionOptions.localAddress = record.remoteIP.replace('::ffff:', '');
|
|
}
|
|
|
|
// Create a safe queue for incoming data using a Buffer array
|
|
// We'll use this to ensure we don't lose data during handler transitions
|
|
const dataQueue: Buffer[] = [];
|
|
let queueSize = 0;
|
|
let processingQueue = false;
|
|
let drainPending = false;
|
|
|
|
// Flag to track if we've switched to the final piping mechanism
|
|
// Once this is true, we no longer buffer data in dataQueue
|
|
let pipingEstablished = false;
|
|
|
|
// Pause the incoming socket to prevent buffer overflows
|
|
// This ensures we control the flow of data until piping is set up
|
|
socket.pause();
|
|
|
|
// Function to safely process the data queue without losing events
|
|
const processDataQueue = () => {
|
|
if (processingQueue || dataQueue.length === 0 || pipingEstablished) return;
|
|
|
|
processingQueue = true;
|
|
|
|
try {
|
|
// Process all queued chunks with the current active handler
|
|
while (dataQueue.length > 0) {
|
|
const chunk = dataQueue.shift()!;
|
|
queueSize -= chunk.length;
|
|
|
|
// Once piping is established, we shouldn't get here,
|
|
// but just in case, pass to the outgoing socket directly
|
|
if (pipingEstablished && record.outgoing) {
|
|
record.outgoing.write(chunk);
|
|
continue;
|
|
}
|
|
|
|
// Track bytes received
|
|
record.bytesReceived += chunk.length;
|
|
|
|
// Check for TLS handshake
|
|
if (!record.isTLS && SniHandler.isTlsHandshake(chunk)) {
|
|
record.isTLS = true;
|
|
|
|
if (this.settings.enableTlsDebugLogging) {
|
|
console.log(
|
|
`[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
|
|
);
|
|
}
|
|
}
|
|
|
|
// Check if adding this chunk would exceed the buffer limit
|
|
const newSize = record.pendingDataSize + chunk.length;
|
|
|
|
if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
|
|
console.log(
|
|
`[${connectionId}] Buffer limit exceeded for connection from ${record.remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
|
|
);
|
|
socket.end(); // Gracefully close the socket
|
|
this.initiateCleanupOnce(record, 'buffer_limit_exceeded');
|
|
return;
|
|
}
|
|
|
|
// Buffer the chunk and update the size counter
|
|
record.pendingData.push(Buffer.from(chunk));
|
|
record.pendingDataSize = newSize;
|
|
this.updateActivity(record);
|
|
}
|
|
} finally {
|
|
processingQueue = false;
|
|
|
|
// If there's a pending drain and we've processed everything,
|
|
// signal we're ready for more data if we haven't established piping yet
|
|
if (drainPending && dataQueue.length === 0 && !pipingEstablished) {
|
|
drainPending = false;
|
|
socket.resume();
|
|
}
|
|
}
|
|
};
|
|
|
|
// Unified data handler that safely queues incoming data
|
|
const safeDataHandler = (chunk: Buffer) => {
|
|
// If piping is already established, just let the pipe handle it
|
|
if (pipingEstablished) return;
|
|
|
|
// Add to our queue for orderly processing
|
|
dataQueue.push(Buffer.from(chunk)); // Make a copy to be safe
|
|
queueSize += chunk.length;
|
|
|
|
// If queue is getting large, pause socket until we catch up
|
|
if (this.settings.maxPendingDataSize && queueSize > this.settings.maxPendingDataSize * 0.8) {
|
|
socket.pause();
|
|
drainPending = true;
|
|
}
|
|
|
|
// Process the queue
|
|
processDataQueue();
|
|
};
|
|
|
|
// Add our safe data handler
|
|
socket.on('data', safeDataHandler);
|
|
|
|
// Add initial chunk to pending data if present
|
|
if (initialChunk) {
|
|
record.bytesReceived += initialChunk.length;
|
|
record.pendingData.push(Buffer.from(initialChunk));
|
|
record.pendingDataSize = initialChunk.length;
|
|
}
|
|
|
|
// Create the target socket but don't set up piping immediately
|
|
const targetSocket = plugins.net.connect(connectionOptions);
|
|
record.outgoing = targetSocket;
|
|
record.outgoingStartTime = Date.now();
|
|
|
|
// Apply socket optimizations
|
|
targetSocket.setNoDelay(this.settings.noDelay);
|
|
|
|
// Apply keep-alive settings to the outgoing connection as well
|
|
if (this.settings.keepAlive) {
|
|
targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
|
|
|
|
// Apply enhanced TCP keep-alive options if enabled
|
|
if (this.settings.enableKeepAliveProbes) {
|
|
try {
|
|
if ('setKeepAliveProbes' in targetSocket) {
|
|
(targetSocket as any).setKeepAliveProbes(10);
|
|
}
|
|
if ('setKeepAliveInterval' in targetSocket) {
|
|
(targetSocket as any).setKeepAliveInterval(1000);
|
|
}
|
|
} catch (err) {
|
|
// Ignore errors - these are optional enhancements
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Setup specific error handler for connection phase
|
|
targetSocket.once('error', (err) => {
|
|
// This handler runs only once during the initial connection phase
|
|
const code = (err as any).code;
|
|
console.log(
|
|
`[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
|
|
);
|
|
|
|
// Resume the incoming socket to prevent it from hanging
|
|
socket.resume();
|
|
|
|
if (code === 'ECONNREFUSED') {
|
|
console.log(
|
|
`[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
|
|
);
|
|
} else if (code === 'ETIMEDOUT') {
|
|
console.log(
|
|
`[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
|
|
);
|
|
} else if (code === 'ECONNRESET') {
|
|
console.log(
|
|
`[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
|
|
);
|
|
} else if (code === 'EHOSTUNREACH') {
|
|
console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
|
|
}
|
|
|
|
// Clear any existing error handler after connection phase
|
|
targetSocket.removeAllListeners('error');
|
|
|
|
// Re-add the normal error handler for established connections
|
|
targetSocket.on('error', this.handleError('outgoing', record));
|
|
|
|
if (record.outgoingTerminationReason === null) {
|
|
record.outgoingTerminationReason = 'connection_failed';
|
|
this.incrementTerminationStat('outgoing', 'connection_failed');
|
|
}
|
|
|
|
// Clean up the connection
|
|
this.initiateCleanupOnce(record, `connection_failed_${code}`);
|
|
});
|
|
|
|
// Setup close handler
|
|
targetSocket.on('close', this.handleClose('outgoing', record));
|
|
socket.on('close', this.handleClose('incoming', record));
|
|
|
|
// Handle timeouts with keep-alive awareness
|
|
socket.on('timeout', () => {
|
|
// For keep-alive connections, just log a warning instead of closing
|
|
if (record.hasKeepAlive) {
|
|
console.log(
|
|
`[${connectionId}] Timeout event on incoming keep-alive connection from ${
|
|
record.remoteIP
|
|
} after ${plugins.prettyMs(
|
|
this.settings.socketTimeout || 3600000
|
|
)}. Connection preserved.`
|
|
);
|
|
// Don't close the connection - just log
|
|
return;
|
|
}
|
|
|
|
// For non-keep-alive connections, proceed with normal cleanup
|
|
console.log(
|
|
`[${connectionId}] Timeout on incoming side from ${
|
|
record.remoteIP
|
|
} after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
|
|
);
|
|
if (record.incomingTerminationReason === null) {
|
|
record.incomingTerminationReason = 'timeout';
|
|
this.incrementTerminationStat('incoming', 'timeout');
|
|
}
|
|
this.initiateCleanupOnce(record, 'timeout_incoming');
|
|
});
|
|
|
|
targetSocket.on('timeout', () => {
|
|
// For keep-alive connections, just log a warning instead of closing
|
|
if (record.hasKeepAlive) {
|
|
console.log(
|
|
`[${connectionId}] Timeout event on outgoing keep-alive connection from ${
|
|
record.remoteIP
|
|
} after ${plugins.prettyMs(
|
|
this.settings.socketTimeout || 3600000
|
|
)}. Connection preserved.`
|
|
);
|
|
// Don't close the connection - just log
|
|
return;
|
|
}
|
|
|
|
// For non-keep-alive connections, proceed with normal cleanup
|
|
console.log(
|
|
`[${connectionId}] Timeout on outgoing side from ${
|
|
record.remoteIP
|
|
} after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
|
|
);
|
|
if (record.outgoingTerminationReason === null) {
|
|
record.outgoingTerminationReason = 'timeout';
|
|
this.incrementTerminationStat('outgoing', 'timeout');
|
|
}
|
|
this.initiateCleanupOnce(record, 'timeout_outgoing');
|
|
});
|
|
|
|
// Set appropriate timeouts, or disable for immortal keep-alive connections
|
|
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
|
|
// Disable timeouts completely for immortal connections
|
|
socket.setTimeout(0);
|
|
targetSocket.setTimeout(0);
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`
|
|
);
|
|
}
|
|
} else {
|
|
// Set normal timeouts for other connections
|
|
socket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
|
|
targetSocket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
|
|
}
|
|
|
|
// Track outgoing data for bytes counting
|
|
targetSocket.on('data', (chunk: Buffer) => {
|
|
record.bytesSent += chunk.length;
|
|
this.updateActivity(record);
|
|
});
|
|
|
|
// Wait for the outgoing connection to be ready before setting up piping
|
|
targetSocket.once('connect', () => {
|
|
// Clear the initial connection error handler
|
|
targetSocket.removeAllListeners('error');
|
|
|
|
// Add the normal error handler for established connections
|
|
targetSocket.on('error', this.handleError('outgoing', record));
|
|
|
|
// Process any remaining data in the queue before switching to piping
|
|
processDataQueue();
|
|
|
|
// Setup function to establish piping - we'll use this after flushing data
|
|
const setupPiping = () => {
|
|
// Mark that we're switching to piping mode
|
|
pipingEstablished = true;
|
|
|
|
// Setup piping in both directions
|
|
socket.pipe(targetSocket);
|
|
targetSocket.pipe(socket);
|
|
|
|
// Resume the socket to ensure data flows
|
|
socket.resume();
|
|
|
|
// Process any data that might be queued in the interim
|
|
if (dataQueue.length > 0) {
|
|
// Write any remaining queued data directly to the target socket
|
|
for (const chunk of dataQueue) {
|
|
targetSocket.write(chunk);
|
|
}
|
|
// Clear the queue
|
|
dataQueue.length = 0;
|
|
queueSize = 0;
|
|
}
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
|
|
`${
|
|
serverName
|
|
? ` (SNI: ${serverName})`
|
|
: domainConfig
|
|
? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
|
|
: ''
|
|
}` +
|
|
` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
|
|
record.hasKeepAlive ? 'Yes' : 'No'
|
|
}`
|
|
);
|
|
} else {
|
|
console.log(
|
|
`Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
|
|
`${
|
|
serverName
|
|
? ` (SNI: ${serverName})`
|
|
: domainConfig
|
|
? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
|
|
: ''
|
|
}`
|
|
);
|
|
}
|
|
};
|
|
|
|
// Flush all pending data to target
|
|
if (record.pendingData.length > 0) {
|
|
const combinedData = Buffer.concat(record.pendingData);
|
|
targetSocket.write(combinedData, (err) => {
|
|
if (err) {
|
|
console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`);
|
|
return this.initiateCleanupOnce(record, 'write_error');
|
|
}
|
|
|
|
// Establish piping now that we've flushed the buffered data
|
|
setupPiping();
|
|
});
|
|
} else {
|
|
// No pending data, just establish piping immediately
|
|
setupPiping();
|
|
}
|
|
|
|
// Clear the buffer now that we've processed it
|
|
record.pendingData = [];
|
|
record.pendingDataSize = 0;
|
|
|
|
// Add the renegotiation handler for SNI validation with strict domain enforcement
|
|
// This will be called after we've established piping
|
|
if (serverName) {
|
|
// Define a handler for checking renegotiation with improved detection
|
|
const renegotiationHandler = (renegChunk: Buffer) => {
|
|
// Only process if this looks like a TLS ClientHello
|
|
if (SniHandler.isClientHello(renegChunk)) {
|
|
try {
|
|
// Extract SNI from ClientHello
|
|
const newSNI = SniHandler.extractSNIWithResumptionSupport(renegChunk, this.settings.enableTlsDebugLogging);
|
|
|
|
// Skip if no SNI was found
|
|
if (!newSNI) return;
|
|
|
|
// Handle SNI change during renegotiation - always terminate for domain switches
|
|
if (newSNI !== record.lockedDomain) {
|
|
// Log and terminate the connection for any SNI change
|
|
console.log(
|
|
`[${connectionId}] Renegotiation with different SNI: ${record.lockedDomain} -> ${newSNI}. ` +
|
|
`Terminating connection - SNI domain switching is not allowed.`
|
|
);
|
|
this.initiateCleanupOnce(record, 'sni_mismatch');
|
|
} else if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Renegotiation detected with same SNI: ${newSNI}. Allowing.`
|
|
);
|
|
}
|
|
} catch (err) {
|
|
console.log(
|
|
`[${connectionId}] Error processing ClientHello: ${err}. Allowing connection to continue.`
|
|
);
|
|
}
|
|
}
|
|
};
|
|
|
|
// Store the handler in the connection record so we can remove it during cleanup
|
|
record.renegotiationHandler = renegotiationHandler;
|
|
|
|
// The renegotiation handler is added when piping is established
|
|
// Making it part of setupPiping ensures proper sequencing of event handlers
|
|
socket.on('data', renegotiationHandler);
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(`[${connectionId}] TLS renegotiation handler installed for SNI domain: ${serverName}`);
|
|
}
|
|
}
|
|
|
|
// Set connection timeout with simpler logic
|
|
if (record.cleanupTimer) {
|
|
clearTimeout(record.cleanupTimer);
|
|
}
|
|
|
|
// For immortal keep-alive connections, skip setting a timeout completely
|
|
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`
|
|
);
|
|
}
|
|
// No cleanup timer for immortal connections
|
|
}
|
|
// For extended keep-alive connections, use extended timeout
|
|
else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
|
|
const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
|
|
const safeTimeout = ensureSafeTimeout(extendedTimeout);
|
|
|
|
record.cleanupTimer = setTimeout(() => {
|
|
console.log(
|
|
`[${connectionId}] Keep-alive connection from ${
|
|
record.remoteIP
|
|
} exceeded extended lifetime (${plugins.prettyMs(extendedTimeout)}), forcing cleanup.`
|
|
);
|
|
this.initiateCleanupOnce(record, 'extended_lifetime');
|
|
}, safeTimeout);
|
|
|
|
// Make sure timeout doesn't keep the process alive
|
|
if (record.cleanupTimer.unref) {
|
|
record.cleanupTimer.unref();
|
|
}
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(
|
|
extendedTimeout
|
|
)}`
|
|
);
|
|
}
|
|
}
|
|
// For standard connections, use normal timeout
|
|
else {
|
|
// Use domain-specific timeout if available, otherwise use default
|
|
const connectionTimeout =
|
|
record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
|
|
const safeTimeout = ensureSafeTimeout(connectionTimeout);
|
|
|
|
record.cleanupTimer = setTimeout(() => {
|
|
console.log(
|
|
`[${connectionId}] Connection from ${
|
|
record.remoteIP
|
|
} exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`
|
|
);
|
|
this.initiateCleanupOnce(record, 'connection_timeout');
|
|
}, safeTimeout);
|
|
|
|
// Make sure timeout doesn't keep the process alive
|
|
if (record.cleanupTimer.unref) {
|
|
record.cleanupTimer.unref();
|
|
}
|
|
}
|
|
|
|
// Mark TLS handshake as complete for TLS connections
|
|
if (record.isTLS) {
|
|
record.tlsHandshakeComplete = true;
|
|
|
|
if (this.settings.enableTlsDebugLogging) {
|
|
console.log(
|
|
`[${connectionId}] TLS handshake complete for connection from ${record.remoteIP}`
|
|
);
|
|
}
|
|
}
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Get connections count by IP
|
|
*/
|
|
private getConnectionCountByIP(ip: string): number {
|
|
return this.connectionsByIP.get(ip)?.size || 0;
|
|
}
|
|
|
|
/**
|
|
* Check and update connection rate for an IP
|
|
*/
|
|
private checkConnectionRate(ip: string): boolean {
|
|
const now = Date.now();
|
|
const minute = 60 * 1000;
|
|
|
|
if (!this.connectionRateByIP.has(ip)) {
|
|
this.connectionRateByIP.set(ip, [now]);
|
|
return true;
|
|
}
|
|
|
|
// Get timestamps and filter out entries older than 1 minute
|
|
const timestamps = this.connectionRateByIP.get(ip)!.filter((time) => now - time < minute);
|
|
timestamps.push(now);
|
|
this.connectionRateByIP.set(ip, timestamps);
|
|
|
|
// Check if rate exceeds limit
|
|
return timestamps.length <= this.settings.connectionRateLimitPerMinute!;
|
|
}
|
|
|
|
/**
|
|
* Track connection by IP
|
|
*/
|
|
private trackConnectionByIP(ip: string, connectionId: string): void {
|
|
if (!this.connectionsByIP.has(ip)) {
|
|
this.connectionsByIP.set(ip, new Set());
|
|
}
|
|
this.connectionsByIP.get(ip)!.add(connectionId);
|
|
}
|
|
|
|
/**
|
|
* Remove connection tracking for an IP
|
|
*/
|
|
private removeConnectionByIP(ip: string, connectionId: string): void {
|
|
if (this.connectionsByIP.has(ip)) {
|
|
const connections = this.connectionsByIP.get(ip)!;
|
|
connections.delete(connectionId);
|
|
if (connections.size === 0) {
|
|
this.connectionsByIP.delete(ip);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Track connection termination statistic
|
|
*/
|
|
private incrementTerminationStat(side: 'incoming' | 'outgoing', reason: string): void {
|
|
this.terminationStats[side][reason] = (this.terminationStats[side][reason] || 0) + 1;
|
|
}
|
|
|
|
/**
|
|
* Cleans up a connection record.
|
|
* Destroys both incoming and outgoing sockets, clears timers, and removes the record.
|
|
* @param record - The connection record to clean up
|
|
* @param reason - Optional reason for cleanup (for logging)
|
|
*/
|
|
private cleanupConnection(record: IConnectionRecord, reason: string = 'normal'): void {
|
|
if (!record.connectionClosed) {
|
|
record.connectionClosed = true;
|
|
|
|
// Track connection termination
|
|
this.removeConnectionByIP(record.remoteIP, record.id);
|
|
|
|
if (record.cleanupTimer) {
|
|
clearTimeout(record.cleanupTimer);
|
|
record.cleanupTimer = undefined;
|
|
}
|
|
|
|
// Detailed logging data
|
|
const duration = Date.now() - record.incomingStartTime;
|
|
const bytesReceived = record.bytesReceived;
|
|
const bytesSent = record.bytesSent;
|
|
|
|
// Remove all data handlers (both standard and renegotiation) to make sure we clean up properly
|
|
if (record.incoming) {
|
|
try {
|
|
// Remove our safe data handler
|
|
record.incoming.removeAllListeners('data');
|
|
|
|
// Reset the handler references
|
|
record.renegotiationHandler = undefined;
|
|
} catch (err) {
|
|
console.log(`[${record.id}] Error removing data handlers: ${err}`);
|
|
}
|
|
}
|
|
|
|
try {
|
|
if (!record.incoming.destroyed) {
|
|
// Try graceful shutdown first, then force destroy after a short timeout
|
|
record.incoming.end();
|
|
const incomingTimeout = setTimeout(() => {
|
|
try {
|
|
if (record && !record.incoming.destroyed) {
|
|
record.incoming.destroy();
|
|
}
|
|
} catch (err) {
|
|
console.log(`[${record.id}] Error destroying incoming socket: ${err}`);
|
|
}
|
|
}, 1000);
|
|
|
|
// Ensure the timeout doesn't block Node from exiting
|
|
if (incomingTimeout.unref) {
|
|
incomingTimeout.unref();
|
|
}
|
|
}
|
|
} catch (err) {
|
|
console.log(`[${record.id}] Error closing incoming socket: ${err}`);
|
|
try {
|
|
if (!record.incoming.destroyed) {
|
|
record.incoming.destroy();
|
|
}
|
|
} catch (destroyErr) {
|
|
console.log(`[${record.id}] Error destroying incoming socket: ${destroyErr}`);
|
|
}
|
|
}
|
|
|
|
try {
|
|
if (record.outgoing && !record.outgoing.destroyed) {
|
|
// Try graceful shutdown first, then force destroy after a short timeout
|
|
record.outgoing.end();
|
|
const outgoingTimeout = setTimeout(() => {
|
|
try {
|
|
if (record && record.outgoing && !record.outgoing.destroyed) {
|
|
record.outgoing.destroy();
|
|
}
|
|
} catch (err) {
|
|
console.log(`[${record.id}] Error destroying outgoing socket: ${err}`);
|
|
}
|
|
}, 1000);
|
|
|
|
// Ensure the timeout doesn't block Node from exiting
|
|
if (outgoingTimeout.unref) {
|
|
outgoingTimeout.unref();
|
|
}
|
|
}
|
|
} catch (err) {
|
|
console.log(`[${record.id}] Error closing outgoing socket: ${err}`);
|
|
try {
|
|
if (record.outgoing && !record.outgoing.destroyed) {
|
|
record.outgoing.destroy();
|
|
}
|
|
} catch (destroyErr) {
|
|
console.log(`[${record.id}] Error destroying outgoing socket: ${destroyErr}`);
|
|
}
|
|
}
|
|
|
|
// Clear pendingData to avoid memory leaks
|
|
record.pendingData = [];
|
|
record.pendingDataSize = 0;
|
|
|
|
// Remove the record from the tracking map
|
|
this.connectionRecords.delete(record.id);
|
|
|
|
// Log connection details
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${record.id}] Connection from ${record.remoteIP} on port ${record.localPort} terminated (${reason}).` +
|
|
` Duration: ${plugins.prettyMs(
|
|
duration
|
|
)}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
|
|
`TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
|
|
record.hasKeepAlive ? 'Yes' : 'No'
|
|
}` +
|
|
`${record.usingNetworkProxy ? ', Using NetworkProxy' : ''}` +
|
|
`${record.domainSwitches ? `, Domain switches: ${record.domainSwitches}` : ''}`
|
|
);
|
|
} else {
|
|
console.log(
|
|
`[${record.id}] Connection from ${record.remoteIP} terminated (${reason}). Active connections: ${this.connectionRecords.size}`
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Update connection activity timestamp
|
|
*/
|
|
private updateActivity(record: IConnectionRecord): void {
|
|
record.lastActivity = Date.now();
|
|
|
|
// Clear any inactivity warning
|
|
if (record.inactivityWarningIssued) {
|
|
record.inactivityWarningIssued = false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get target IP with round-robin support
|
|
*/
|
|
private getTargetIP(domainConfig: IDomainConfig): string {
|
|
if (domainConfig.targetIPs && domainConfig.targetIPs.length > 0) {
|
|
const currentIndex = this.domainTargetIndices.get(domainConfig) || 0;
|
|
const ip = domainConfig.targetIPs[currentIndex % domainConfig.targetIPs.length];
|
|
this.domainTargetIndices.set(domainConfig, currentIndex + 1);
|
|
return ip;
|
|
}
|
|
return this.settings.targetIP!;
|
|
}
|
|
|
|
/**
|
|
* Initiates cleanup once for a connection
|
|
*/
|
|
private initiateCleanupOnce(record: IConnectionRecord, reason: string = 'normal'): void {
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
|
|
}
|
|
|
|
if (
|
|
record.incomingTerminationReason === null ||
|
|
record.incomingTerminationReason === undefined
|
|
) {
|
|
record.incomingTerminationReason = reason;
|
|
this.incrementTerminationStat('incoming', reason);
|
|
}
|
|
|
|
this.cleanupConnection(record, reason);
|
|
}
|
|
|
|
/**
|
|
* Creates a generic error handler for incoming or outgoing sockets
|
|
*/
|
|
private handleError(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
|
|
return (err: Error) => {
|
|
const code = (err as any).code;
|
|
let reason = 'error';
|
|
|
|
const now = Date.now();
|
|
const connectionDuration = now - record.incomingStartTime;
|
|
const lastActivityAge = now - record.lastActivity;
|
|
|
|
if (code === 'ECONNRESET') {
|
|
reason = 'econnreset';
|
|
console.log(
|
|
`[${record.id}] ECONNRESET on ${side} side from ${record.remoteIP}: ${
|
|
err.message
|
|
}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
|
|
lastActivityAge
|
|
)} ago`
|
|
);
|
|
} else if (code === 'ETIMEDOUT') {
|
|
reason = 'etimedout';
|
|
console.log(
|
|
`[${record.id}] ETIMEDOUT on ${side} side from ${record.remoteIP}: ${
|
|
err.message
|
|
}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
|
|
lastActivityAge
|
|
)} ago`
|
|
);
|
|
} else {
|
|
console.log(
|
|
`[${record.id}] Error on ${side} side from ${record.remoteIP}: ${
|
|
err.message
|
|
}. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
|
|
lastActivityAge
|
|
)} ago`
|
|
);
|
|
}
|
|
|
|
if (side === 'incoming' && record.incomingTerminationReason === null) {
|
|
record.incomingTerminationReason = reason;
|
|
this.incrementTerminationStat('incoming', reason);
|
|
} else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
|
|
record.outgoingTerminationReason = reason;
|
|
this.incrementTerminationStat('outgoing', reason);
|
|
}
|
|
|
|
this.initiateCleanupOnce(record, reason);
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Creates a generic close handler for incoming or outgoing sockets
|
|
*/
|
|
private handleClose(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
|
|
return () => {
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(`[${record.id}] Connection closed on ${side} side from ${record.remoteIP}`);
|
|
}
|
|
|
|
if (side === 'incoming' && record.incomingTerminationReason === null) {
|
|
record.incomingTerminationReason = 'normal';
|
|
this.incrementTerminationStat('incoming', 'normal');
|
|
} else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
|
|
record.outgoingTerminationReason = 'normal';
|
|
this.incrementTerminationStat('outgoing', 'normal');
|
|
// Record the time when outgoing socket closed.
|
|
record.outgoingClosedTime = Date.now();
|
|
}
|
|
|
|
this.initiateCleanupOnce(record, 'closed_' + side);
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Main method to start the proxy
|
|
*/
|
|
public async start() {
|
|
// Don't start if already shutting down
|
|
if (this.isShuttingDown) {
|
|
console.log("Cannot start PortProxy while it's shutting down");
|
|
return;
|
|
}
|
|
|
|
// Initialize NetworkProxy if needed (useNetworkProxy is set but networkProxy isn't initialized)
|
|
if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0 && !this.networkProxy) {
|
|
await this.initializeNetworkProxy();
|
|
}
|
|
|
|
// Start NetworkProxy if configured
|
|
if (this.networkProxy) {
|
|
await this.networkProxy.start();
|
|
console.log(`NetworkProxy started on port ${this.settings.networkProxyPort}`);
|
|
|
|
// Log ACME status
|
|
if (this.settings.acme?.enabled) {
|
|
console.log(`ACME certificate management is enabled (${this.settings.acme.useProduction ? 'Production' : 'Staging'} mode)`);
|
|
console.log(`ACME HTTP challenge server on port ${this.settings.acme.port}`);
|
|
|
|
// Register domains for ACME certificates if enabled
|
|
if (this.networkProxy.options.acme?.enabled) {
|
|
console.log('Registering domains with ACME certificate manager...');
|
|
// The NetworkProxy will handle this internally via registerDomainsWithAcmeManager()
|
|
}
|
|
}
|
|
}
|
|
|
|
// Define a unified connection handler for all listening ports.
|
|
const connectionHandler = (socket: plugins.net.Socket) => {
|
|
if (this.isShuttingDown) {
|
|
socket.end();
|
|
socket.destroy();
|
|
return;
|
|
}
|
|
|
|
const remoteIP = socket.remoteAddress || '';
|
|
const localPort = socket.localPort || 0; // The port on which this connection was accepted.
|
|
|
|
// Check rate limits
|
|
if (
|
|
this.settings.maxConnectionsPerIP &&
|
|
this.getConnectionCountByIP(remoteIP) >= this.settings.maxConnectionsPerIP
|
|
) {
|
|
console.log(
|
|
`Connection rejected from ${remoteIP}: Maximum connections per IP (${this.settings.maxConnectionsPerIP}) exceeded`
|
|
);
|
|
socket.end();
|
|
socket.destroy();
|
|
return;
|
|
}
|
|
|
|
if (this.settings.connectionRateLimitPerMinute && !this.checkConnectionRate(remoteIP)) {
|
|
console.log(
|
|
`Connection rejected from ${remoteIP}: Connection rate limit (${this.settings.connectionRateLimitPerMinute}/min) exceeded`
|
|
);
|
|
socket.end();
|
|
socket.destroy();
|
|
return;
|
|
}
|
|
|
|
// Apply socket optimizations
|
|
socket.setNoDelay(this.settings.noDelay);
|
|
|
|
// Create a unique connection ID and record
|
|
const connectionId = generateConnectionId();
|
|
const connectionRecord: IConnectionRecord = {
|
|
id: connectionId,
|
|
incoming: socket,
|
|
outgoing: null,
|
|
incomingStartTime: Date.now(),
|
|
lastActivity: Date.now(),
|
|
connectionClosed: false,
|
|
pendingData: [],
|
|
pendingDataSize: 0,
|
|
|
|
// Initialize enhanced tracking fields
|
|
bytesReceived: 0,
|
|
bytesSent: 0,
|
|
remoteIP: remoteIP,
|
|
localPort: localPort,
|
|
isTLS: false,
|
|
tlsHandshakeComplete: false,
|
|
hasReceivedInitialData: false,
|
|
hasKeepAlive: false, // Will set to true if keep-alive is applied
|
|
incomingTerminationReason: null,
|
|
outgoingTerminationReason: null,
|
|
|
|
// Initialize NetworkProxy tracking
|
|
usingNetworkProxy: false,
|
|
|
|
// Initialize browser connection tracking
|
|
isBrowserConnection: false,
|
|
domainSwitches: 0,
|
|
};
|
|
|
|
// Apply keep-alive settings if enabled
|
|
if (this.settings.keepAlive) {
|
|
socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
|
|
connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
|
|
|
|
// Apply enhanced TCP keep-alive options if enabled
|
|
if (this.settings.enableKeepAliveProbes) {
|
|
try {
|
|
// These are platform-specific and may not be available
|
|
if ('setKeepAliveProbes' in socket) {
|
|
(socket as any).setKeepAliveProbes(10); // More aggressive probing
|
|
}
|
|
if ('setKeepAliveInterval' in socket) {
|
|
(socket as any).setKeepAliveInterval(1000); // 1 second interval between probes
|
|
}
|
|
} catch (err) {
|
|
// Ignore errors - these are optional enhancements
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`
|
|
);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Track connection by IP
|
|
this.trackConnectionByIP(remoteIP, connectionId);
|
|
this.connectionRecords.set(connectionId, connectionRecord);
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
|
|
`Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
|
|
`Active connections: ${this.connectionRecords.size}`
|
|
);
|
|
} else {
|
|
console.log(
|
|
`New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`
|
|
);
|
|
}
|
|
|
|
// Check if this connection should be forwarded directly to NetworkProxy based on port
|
|
const shouldUseNetworkProxy = this.settings.useNetworkProxy &&
|
|
this.settings.useNetworkProxy.includes(localPort);
|
|
|
|
if (shouldUseNetworkProxy) {
|
|
// For NetworkProxy ports, we want to capture the TLS handshake and forward directly
|
|
let initialDataReceived = false;
|
|
|
|
// Set an initial timeout for handshake data
|
|
let initialTimeout: NodeJS.Timeout | null = setTimeout(() => {
|
|
if (!initialDataReceived) {
|
|
console.log(
|
|
`[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
|
|
);
|
|
if (connectionRecord.incomingTerminationReason === null) {
|
|
connectionRecord.incomingTerminationReason = 'initial_timeout';
|
|
this.incrementTerminationStat('incoming', 'initial_timeout');
|
|
}
|
|
socket.end();
|
|
this.cleanupConnection(connectionRecord, 'initial_timeout');
|
|
}
|
|
}, this.settings.initialDataTimeout!);
|
|
|
|
// Make sure timeout doesn't keep the process alive
|
|
if (initialTimeout.unref) {
|
|
initialTimeout.unref();
|
|
}
|
|
|
|
socket.on('error', this.handleError('incoming', connectionRecord));
|
|
|
|
// First data handler to capture initial TLS handshake for NetworkProxy
|
|
socket.once('data', (chunk: Buffer) => {
|
|
// Clear the initial timeout since we've received data
|
|
if (initialTimeout) {
|
|
clearTimeout(initialTimeout);
|
|
initialTimeout = null;
|
|
}
|
|
|
|
initialDataReceived = true;
|
|
connectionRecord.hasReceivedInitialData = true;
|
|
|
|
// Check if this looks like a TLS handshake
|
|
if (SniHandler.isTlsHandshake(chunk)) {
|
|
connectionRecord.isTLS = true;
|
|
|
|
// Forward directly to NetworkProxy without SNI processing
|
|
this.forwardToNetworkProxy(connectionId, socket, connectionRecord, chunk);
|
|
} else {
|
|
// If not TLS, use normal direct connection
|
|
console.log(`[${connectionId}] Non-TLS connection on NetworkProxy port ${localPort}`);
|
|
this.setupDirectConnection(connectionId, socket, connectionRecord, undefined, undefined, chunk);
|
|
}
|
|
});
|
|
|
|
} else {
|
|
// For non-NetworkProxy ports, proceed with normal processing
|
|
|
|
// Define helpers for rejecting connections
|
|
const rejectIncomingConnection = (reason: string, logMessage: string) => {
|
|
console.log(`[${connectionId}] ${logMessage}`);
|
|
socket.end();
|
|
if (connectionRecord.incomingTerminationReason === null) {
|
|
connectionRecord.incomingTerminationReason = reason;
|
|
this.incrementTerminationStat('incoming', reason);
|
|
}
|
|
this.cleanupConnection(connectionRecord, reason);
|
|
};
|
|
|
|
let initialDataReceived = false;
|
|
|
|
// Set an initial timeout for SNI data if needed
|
|
let initialTimeout: NodeJS.Timeout | null = null;
|
|
if (this.settings.sniEnabled) {
|
|
initialTimeout = setTimeout(() => {
|
|
if (!initialDataReceived) {
|
|
console.log(
|
|
`[${connectionId}] Initial data timeout (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP} on port ${localPort}`
|
|
);
|
|
if (connectionRecord.incomingTerminationReason === null) {
|
|
connectionRecord.incomingTerminationReason = 'initial_timeout';
|
|
this.incrementTerminationStat('incoming', 'initial_timeout');
|
|
}
|
|
socket.end();
|
|
this.cleanupConnection(connectionRecord, 'initial_timeout');
|
|
}
|
|
}, this.settings.initialDataTimeout!);
|
|
|
|
// Make sure timeout doesn't keep the process alive
|
|
if (initialTimeout.unref) {
|
|
initialTimeout.unref();
|
|
}
|
|
} else {
|
|
initialDataReceived = true;
|
|
connectionRecord.hasReceivedInitialData = true;
|
|
}
|
|
|
|
socket.on('error', this.handleError('incoming', connectionRecord));
|
|
|
|
// Track data for bytes counting
|
|
socket.on('data', (chunk: Buffer) => {
|
|
connectionRecord.bytesReceived += chunk.length;
|
|
this.updateActivity(connectionRecord);
|
|
|
|
// Check for TLS handshake if this is the first chunk
|
|
if (!connectionRecord.isTLS && SniHandler.isTlsHandshake(chunk)) {
|
|
connectionRecord.isTLS = true;
|
|
|
|
if (this.settings.enableTlsDebugLogging) {
|
|
console.log(
|
|
`[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`
|
|
);
|
|
// Try to extract SNI and log detailed debug info
|
|
SniHandler.extractSNIWithResumptionSupport(chunk, true);
|
|
}
|
|
}
|
|
});
|
|
|
|
/**
|
|
* Sets up the connection to the target host.
|
|
* @param serverName - The SNI hostname (unused when forcedDomain is provided).
|
|
* @param initialChunk - Optional initial data chunk.
|
|
* @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
|
|
* @param overridePort - If provided, use this port for the outgoing connection.
|
|
*/
|
|
const setupConnection = (
|
|
serverName: string,
|
|
initialChunk?: Buffer,
|
|
forcedDomain?: IDomainConfig,
|
|
overridePort?: number
|
|
) => {
|
|
// Clear the initial timeout since we've received data
|
|
if (initialTimeout) {
|
|
clearTimeout(initialTimeout);
|
|
initialTimeout = null;
|
|
}
|
|
|
|
// Mark that we've received initial data
|
|
initialDataReceived = true;
|
|
connectionRecord.hasReceivedInitialData = true;
|
|
|
|
// Check if this looks like a TLS handshake
|
|
const isTlsHandshakeDetected = initialChunk && SniHandler.isTlsHandshake(initialChunk);
|
|
if (isTlsHandshakeDetected) {
|
|
connectionRecord.isTLS = true;
|
|
|
|
if (this.settings.enableTlsDebugLogging) {
|
|
console.log(
|
|
`[${connectionId}] TLS handshake detected in setup, ${initialChunk.length} bytes`
|
|
);
|
|
}
|
|
}
|
|
|
|
// If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
|
|
const domainConfig = forcedDomain
|
|
? forcedDomain
|
|
: serverName
|
|
? this.settings.domainConfigs.find((config) =>
|
|
config.domains.some((d) => plugins.minimatch(serverName, d))
|
|
)
|
|
: undefined;
|
|
|
|
// Save domain config in connection record
|
|
connectionRecord.domainConfig = domainConfig;
|
|
|
|
// IP validation is skipped if allowedIPs is empty
|
|
if (domainConfig) {
|
|
const effectiveAllowedIPs: string[] = [
|
|
...domainConfig.allowedIPs,
|
|
...(this.settings.defaultAllowedIPs || []),
|
|
];
|
|
const effectiveBlockedIPs: string[] = [
|
|
...(domainConfig.blockedIPs || []),
|
|
...(this.settings.defaultBlockedIPs || []),
|
|
];
|
|
|
|
// Skip IP validation if allowedIPs is empty
|
|
if (
|
|
domainConfig.allowedIPs.length > 0 &&
|
|
!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)
|
|
) {
|
|
return rejectIncomingConnection(
|
|
'rejected',
|
|
`Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(
|
|
', '
|
|
)}`
|
|
);
|
|
}
|
|
} else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
|
|
if (
|
|
!isGlobIPAllowed(
|
|
remoteIP,
|
|
this.settings.defaultAllowedIPs,
|
|
this.settings.defaultBlockedIPs || []
|
|
)
|
|
) {
|
|
return rejectIncomingConnection(
|
|
'rejected',
|
|
`Connection rejected: IP ${remoteIP} not allowed by default allowed list`
|
|
);
|
|
}
|
|
}
|
|
|
|
// Save the initial SNI
|
|
if (serverName) {
|
|
connectionRecord.lockedDomain = serverName;
|
|
}
|
|
|
|
// Set up the direct connection
|
|
return this.setupDirectConnection(
|
|
connectionId,
|
|
socket,
|
|
connectionRecord,
|
|
domainConfig,
|
|
serverName,
|
|
initialChunk,
|
|
overridePort
|
|
);
|
|
};
|
|
|
|
// --- PORT RANGE-BASED HANDLING ---
|
|
// Only apply port-based rules if the incoming port is within one of the global port ranges.
|
|
if (
|
|
this.settings.globalPortRanges &&
|
|
isPortInRanges(localPort, this.settings.globalPortRanges)
|
|
) {
|
|
if (this.settings.forwardAllGlobalRanges) {
|
|
if (
|
|
this.settings.defaultAllowedIPs &&
|
|
this.settings.defaultAllowedIPs.length > 0 &&
|
|
!isAllowed(remoteIP, this.settings.defaultAllowedIPs)
|
|
) {
|
|
console.log(
|
|
`[${connectionId}] Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`
|
|
);
|
|
socket.end();
|
|
return;
|
|
}
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`
|
|
);
|
|
}
|
|
setupConnection(
|
|
'',
|
|
undefined,
|
|
{
|
|
domains: ['global'],
|
|
allowedIPs: this.settings.defaultAllowedIPs || [],
|
|
blockedIPs: this.settings.defaultBlockedIPs || [],
|
|
targetIPs: [this.settings.targetIP!],
|
|
portRanges: [],
|
|
},
|
|
localPort
|
|
);
|
|
return;
|
|
} else {
|
|
// Attempt to find a matching forced domain config based on the local port.
|
|
const forcedDomain = this.settings.domainConfigs.find(
|
|
(domain) =>
|
|
domain.portRanges &&
|
|
domain.portRanges.length > 0 &&
|
|
isPortInRanges(localPort, domain.portRanges)
|
|
);
|
|
if (forcedDomain) {
|
|
const effectiveAllowedIPs: string[] = [
|
|
...forcedDomain.allowedIPs,
|
|
...(this.settings.defaultAllowedIPs || []),
|
|
];
|
|
const effectiveBlockedIPs: string[] = [
|
|
...(forcedDomain.blockedIPs || []),
|
|
...(this.settings.defaultBlockedIPs || []),
|
|
];
|
|
if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
|
|
console.log(
|
|
`[${connectionId}] Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(
|
|
', '
|
|
)} on port ${localPort}.`
|
|
);
|
|
socket.end();
|
|
return;
|
|
}
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(
|
|
', '
|
|
)}.`
|
|
);
|
|
}
|
|
setupConnection('', undefined, forcedDomain, localPort);
|
|
return;
|
|
}
|
|
// Fall through to SNI/default handling if no forced domain config is found.
|
|
}
|
|
}
|
|
|
|
// --- FALLBACK: SNI-BASED HANDLING (or default when SNI is disabled) ---
|
|
if (this.settings.sniEnabled) {
|
|
initialDataReceived = false;
|
|
|
|
socket.once('data', (chunk: Buffer) => {
|
|
if (initialTimeout) {
|
|
clearTimeout(initialTimeout);
|
|
initialTimeout = null;
|
|
}
|
|
|
|
initialDataReceived = true;
|
|
|
|
// Try to extract SNI
|
|
let serverName = '';
|
|
|
|
if (SniHandler.isTlsHandshake(chunk)) {
|
|
connectionRecord.isTLS = true;
|
|
|
|
if (this.settings.enableTlsDebugLogging) {
|
|
console.log(
|
|
`[${connectionId}] Extracting SNI from TLS handshake, ${chunk.length} bytes`
|
|
);
|
|
}
|
|
|
|
serverName = SniHandler.extractSNIWithResumptionSupport(chunk, this.settings.enableTlsDebugLogging) || '';
|
|
}
|
|
|
|
// Lock the connection to the negotiated SNI.
|
|
connectionRecord.lockedDomain = serverName;
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${connectionId}] Received connection from ${remoteIP} with SNI: ${
|
|
serverName || '(empty)'
|
|
}`
|
|
);
|
|
}
|
|
|
|
setupConnection(serverName, chunk);
|
|
});
|
|
} else {
|
|
initialDataReceived = true;
|
|
connectionRecord.hasReceivedInitialData = true;
|
|
|
|
if (
|
|
this.settings.defaultAllowedIPs &&
|
|
this.settings.defaultAllowedIPs.length > 0 &&
|
|
!isAllowed(remoteIP, this.settings.defaultAllowedIPs)
|
|
) {
|
|
return rejectIncomingConnection(
|
|
'rejected',
|
|
`Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`
|
|
);
|
|
}
|
|
|
|
setupConnection('');
|
|
}
|
|
}
|
|
};
|
|
|
|
// --- SETUP LISTENERS ---
|
|
// Determine which ports to listen on.
|
|
const listeningPorts = new Set<number>();
|
|
if (this.settings.globalPortRanges && this.settings.globalPortRanges.length > 0) {
|
|
// Listen on every port defined by the global ranges.
|
|
for (const range of this.settings.globalPortRanges) {
|
|
for (let port = range.from; port <= range.to; port++) {
|
|
listeningPorts.add(port);
|
|
}
|
|
}
|
|
// Also ensure the default fromPort is listened to if it isn't already in the ranges.
|
|
listeningPorts.add(this.settings.fromPort);
|
|
} else {
|
|
listeningPorts.add(this.settings.fromPort);
|
|
}
|
|
|
|
// Create a server for each port.
|
|
for (const port of listeningPorts) {
|
|
const server = plugins.net.createServer(connectionHandler).on('error', (err: Error) => {
|
|
console.log(`Server Error on port ${port}: ${err.message}`);
|
|
});
|
|
server.listen(port, () => {
|
|
const isNetworkProxyPort = this.settings.useNetworkProxy?.includes(port);
|
|
console.log(
|
|
`PortProxy -> OK: Now listening on port ${port}${
|
|
this.settings.sniEnabled && !isNetworkProxyPort ? ' (SNI passthrough enabled)' : ''
|
|
}${isNetworkProxyPort ? ' (NetworkProxy forwarding enabled)' : ''}`
|
|
);
|
|
});
|
|
this.netServers.push(server);
|
|
}
|
|
|
|
// Log active connection count, longest running durations, and run parity checks periodically
|
|
this.connectionLogger = setInterval(() => {
|
|
// Immediately return if shutting down
|
|
if (this.isShuttingDown) return;
|
|
|
|
const now = Date.now();
|
|
let maxIncoming = 0;
|
|
let maxOutgoing = 0;
|
|
let tlsConnections = 0;
|
|
let nonTlsConnections = 0;
|
|
let completedTlsHandshakes = 0;
|
|
let pendingTlsHandshakes = 0;
|
|
let keepAliveConnections = 0;
|
|
let networkProxyConnections = 0;
|
|
let domainSwitchedConnections = 0;
|
|
|
|
// Create a copy of the keys to avoid modification during iteration
|
|
const connectionIds = [...this.connectionRecords.keys()];
|
|
|
|
for (const id of connectionIds) {
|
|
const record = this.connectionRecords.get(id);
|
|
if (!record) continue;
|
|
|
|
// Track connection stats
|
|
if (record.isTLS) {
|
|
tlsConnections++;
|
|
if (record.tlsHandshakeComplete) {
|
|
completedTlsHandshakes++;
|
|
} else {
|
|
pendingTlsHandshakes++;
|
|
}
|
|
} else {
|
|
nonTlsConnections++;
|
|
}
|
|
|
|
if (record.hasKeepAlive) {
|
|
keepAliveConnections++;
|
|
}
|
|
|
|
if (record.usingNetworkProxy) {
|
|
networkProxyConnections++;
|
|
}
|
|
|
|
if (record.domainSwitches && record.domainSwitches > 0) {
|
|
domainSwitchedConnections++;
|
|
}
|
|
|
|
maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
|
|
if (record.outgoingStartTime) {
|
|
maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
|
|
}
|
|
// Parity check: if outgoing socket closed and incoming remains active
|
|
if (
|
|
record.outgoingClosedTime &&
|
|
!record.incoming.destroyed &&
|
|
!record.connectionClosed &&
|
|
now - record.outgoingClosedTime > 120000
|
|
) {
|
|
const remoteIP = record.remoteIP;
|
|
console.log(
|
|
`[${id}] Parity check: Incoming socket for ${remoteIP} still active ${plugins.prettyMs(
|
|
now - record.outgoingClosedTime
|
|
)} after outgoing closed.`
|
|
);
|
|
this.cleanupConnection(record, 'parity_check');
|
|
}
|
|
|
|
// Check for stalled connections waiting for initial data
|
|
if (
|
|
!record.hasReceivedInitialData &&
|
|
now - record.incomingStartTime > this.settings.initialDataTimeout! / 2
|
|
) {
|
|
console.log(
|
|
`[${id}] Warning: Connection from ${
|
|
record.remoteIP
|
|
} has not received initial data after ${plugins.prettyMs(
|
|
now - record.incomingStartTime
|
|
)}`
|
|
);
|
|
}
|
|
|
|
// Skip inactivity check if disabled or for immortal keep-alive connections
|
|
if (
|
|
!this.settings.disableInactivityCheck &&
|
|
!(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
|
|
) {
|
|
const inactivityTime = now - record.lastActivity;
|
|
|
|
// Use extended timeout for extended-treatment keep-alive connections
|
|
let effectiveTimeout = this.settings.inactivityTimeout!;
|
|
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
|
|
const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
|
|
effectiveTimeout = effectiveTimeout * multiplier;
|
|
}
|
|
|
|
if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
|
|
// For keep-alive connections, issue a warning first
|
|
if (record.hasKeepAlive && !record.inactivityWarningIssued) {
|
|
console.log(
|
|
`[${id}] Warning: Keep-alive connection from ${
|
|
record.remoteIP
|
|
} inactive for ${plugins.prettyMs(inactivityTime)}. ` +
|
|
`Will close in 10 minutes if no activity.`
|
|
);
|
|
|
|
// Set warning flag and add grace period
|
|
record.inactivityWarningIssued = true;
|
|
record.lastActivity = now - (effectiveTimeout - 600000);
|
|
|
|
// Try to stimulate activity with a probe packet
|
|
if (record.outgoing && !record.outgoing.destroyed) {
|
|
try {
|
|
record.outgoing.write(Buffer.alloc(0));
|
|
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(`[${id}] Sent probe packet to test keep-alive connection`);
|
|
}
|
|
} catch (err) {
|
|
console.log(`[${id}] Error sending probe packet: ${err}`);
|
|
}
|
|
}
|
|
} else {
|
|
// For non-keep-alive or after warning, close the connection
|
|
console.log(
|
|
`[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
|
|
`for ${plugins.prettyMs(inactivityTime)}.` +
|
|
(record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
|
|
);
|
|
this.cleanupConnection(record, 'inactivity');
|
|
}
|
|
} else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
|
|
// If activity detected after warning, clear the warning
|
|
if (this.settings.enableDetailedLogging) {
|
|
console.log(
|
|
`[${id}] Connection activity detected after inactivity warning, resetting warning`
|
|
);
|
|
}
|
|
record.inactivityWarningIssued = false;
|
|
}
|
|
}
|
|
}
|
|
|
|
// Log detailed stats periodically
|
|
console.log(
|
|
`Active connections: ${this.connectionRecords.size}. ` +
|
|
`Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
|
|
`Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}, ` +
|
|
`DomainSwitched=${domainSwitchedConnections}. ` +
|
|
`Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(
|
|
maxOutgoing
|
|
)}. ` +
|
|
`Termination stats: ${JSON.stringify({
|
|
IN: this.terminationStats.incoming,
|
|
OUT: this.terminationStats.outgoing,
|
|
})}`
|
|
);
|
|
}, this.settings.inactivityCheckInterval || 60000);
|
|
|
|
// Make sure the interval doesn't keep the process alive
|
|
if (this.connectionLogger.unref) {
|
|
this.connectionLogger.unref();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Gracefully shut down the proxy
|
|
*/
|
|
public async stop() {
|
|
console.log('PortProxy shutting down...');
|
|
this.isShuttingDown = true;
|
|
|
|
// Stop accepting new connections
|
|
const closeServerPromises: Promise<void>[] = this.netServers.map(
|
|
(server) =>
|
|
new Promise<void>((resolve) => {
|
|
if (!server.listening) {
|
|
resolve();
|
|
return;
|
|
}
|
|
server.close((err) => {
|
|
if (err) {
|
|
console.log(`Error closing server: ${err.message}`);
|
|
}
|
|
resolve();
|
|
});
|
|
})
|
|
);
|
|
|
|
// Stop the connection logger
|
|
if (this.connectionLogger) {
|
|
clearInterval(this.connectionLogger);
|
|
this.connectionLogger = null;
|
|
}
|
|
|
|
// Wait for servers to close
|
|
await Promise.all(closeServerPromises);
|
|
console.log('All servers closed. Cleaning up active connections...');
|
|
|
|
// Force destroy all active connections immediately
|
|
const connectionIds = [...this.connectionRecords.keys()];
|
|
console.log(`Cleaning up ${connectionIds.length} active connections...`);
|
|
|
|
// First pass: End all connections gracefully
|
|
for (const id of connectionIds) {
|
|
const record = this.connectionRecords.get(id);
|
|
if (record) {
|
|
try {
|
|
// Clear any timers
|
|
if (record.cleanupTimer) {
|
|
clearTimeout(record.cleanupTimer);
|
|
record.cleanupTimer = undefined;
|
|
}
|
|
|
|
// End sockets gracefully
|
|
if (record.incoming && !record.incoming.destroyed) {
|
|
record.incoming.end();
|
|
}
|
|
|
|
if (record.outgoing && !record.outgoing.destroyed) {
|
|
record.outgoing.end();
|
|
}
|
|
} catch (err) {
|
|
console.log(`Error during graceful connection end for ${id}: ${err}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Short delay to allow graceful ends to process
|
|
await new Promise((resolve) => setTimeout(resolve, 100));
|
|
|
|
// Second pass: Force destroy everything
|
|
for (const id of connectionIds) {
|
|
const record = this.connectionRecords.get(id);
|
|
if (record) {
|
|
try {
|
|
// Remove all listeners to prevent memory leaks
|
|
if (record.incoming) {
|
|
record.incoming.removeAllListeners();
|
|
if (!record.incoming.destroyed) {
|
|
record.incoming.destroy();
|
|
}
|
|
}
|
|
|
|
if (record.outgoing) {
|
|
record.outgoing.removeAllListeners();
|
|
if (!record.outgoing.destroyed) {
|
|
record.outgoing.destroy();
|
|
}
|
|
}
|
|
} catch (err) {
|
|
console.log(`Error during forced connection destruction for ${id}: ${err}`);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Stop NetworkProxy if it was started (which also stops ACME manager)
|
|
if (this.networkProxy) {
|
|
try {
|
|
console.log('Stopping NetworkProxy...');
|
|
await this.networkProxy.stop();
|
|
console.log('NetworkProxy stopped successfully');
|
|
|
|
// Log ACME shutdown if it was enabled
|
|
if (this.settings.acme?.enabled) {
|
|
console.log('ACME certificate manager stopped');
|
|
}
|
|
} catch (err) {
|
|
console.log(`Error stopping NetworkProxy: ${err}`);
|
|
}
|
|
}
|
|
|
|
// Clear all tracking maps
|
|
this.connectionRecords.clear();
|
|
this.domainTargetIndices.clear();
|
|
this.connectionsByIP.clear();
|
|
this.connectionRateByIP.clear();
|
|
this.netServers = [];
|
|
|
|
// Reset termination stats
|
|
this.terminationStats = {
|
|
incoming: {},
|
|
outgoing: {},
|
|
};
|
|
|
|
console.log('PortProxy shutdown complete.');
|
|
}
|
|
} |