anytls 0.1.0

data/lib/anytls/buffered_io.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 握手解析器和转发器共用的小型预读缓冲；不暴露 to_io，
+  # 防止 IO 优化绕过已缓冲的字节。
+  class BufferedIO
+    attr_reader :timeout
+
+    def initialize(io, timeout: nil)
+      @io = io
+      self.timeout = timeout
+      @buffer = +"".b
+      @line_budget = nil
+      @track_trailers = false
+    end
+
+    # 在协议阶段边界重新设定绝对读取预算；握手完成后清除预算，
+    # 允许已建立的隧道持续空闲。
+    def timeout=(value)
+      @timeout = value
+      @deadline = value && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + value)
+    end
+
+    def peek(length)
+      fill(length)
+      @buffer.byteslice(0, length)
+    end
+
+    def read(length = nil, outbuf = nil, timeout: @timeout)
+      raise ArgumentError, "negative length" if length&.negative?
+
+      data = +"".b
+      if length
+        data << readpartial(length - data.bytesize, timeout: timeout) while data.bytesize < length
+      else
+        loop { data << readpartial(16_384, timeout: timeout) }
+      end
+      outbuf ? outbuf.replace(data) : data
+    rescue EOFError
+      if data.empty? && length != 0
+        outbuf&.clear
+        return nil
+      end
+
+      outbuf ? outbuf.replace(data) : data
+    end
+
+    def readpartial(length, outbuf = nil, timeout: @timeout)
+      raise ArgumentError, "negative length" if length.negative?
+      return outbuf ? outbuf.replace("") : +"".b if length.zero?
+
+      data = if @buffer.empty?
+               read_underlying(length, timeout)
+             else
+               @buffer.slice!(0, length)
+             end
+      raise EOFError if data.nil? || data.empty?
+
+      outbuf ? outbuf.replace(data) : data
+    rescue EOFError
+      outbuf&.clear
+      raise
+    end
+
+    def gets(separator = "\n", limit = 8192)
+      raise ArgumentError, "separator must not be empty" if separator.nil? || separator.empty?
+
+      loop do
+        if (index = @buffer.index(separator))
+          size = index + separator.bytesize
+          raise BufferLimitExceeded, "HTTP line exceeds limit" if size > limit
+
+          return account_line(@buffer.slice!(0, size))
+        end
+        raise BufferLimitExceeded, "HTTP line exceeds limit" if @buffer.bytesize >= limit
+
+        @buffer << read_underlying([4096, limit - @buffer.bytesize].min, @timeout)
+      end
+    rescue EOFError
+      return nil if @buffer.empty?
+
+      raise ProtocolError, "truncated line"
+    end
+
+    # 同时限制单行、头部总字节数和头部数量；读取终止 chunk 后，
+    # 为分块传输的尾部字段建立独立预算。
+    def begin_headers!
+      @line_budget = [0, 0]
+      @track_trailers = true
+    end
+
+    def write(bytes, timeout: @timeout)
+      IOHelpers.write_all(@io, bytes, timeout: timeout)
+      bytes.bytesize
+    end
+
+    def flush
+      @io.flush if @io.respond_to?(:flush)
+      self
+    end
+
+    def close
+      IOHelpers.close(@io) unless @io.closed?
+    rescue IOError, SystemCallError
+      nil
+    end
+
+    def closed? = @io.closed?
+
+    # 本地 TCP socket 可停止上传读取，同时继续返回 HTTP 错误。
+    # AnyTLS 逻辑流只支持整体关闭。
+    def close_read
+      if @io.is_a?(BasicSocket)
+        @io.shutdown(Socket::SHUT_RD)
+      else
+        close
+      end
+    rescue IOError, SystemCallError
+      nil
+    end
+
+    def close_write
+      if @io.is_a?(IO) && @io.respond_to?(:close_write)
+        @io.close_write
+      else
+        raise ProtocolError, "AnyTLS streams do not support half-close"
+      end
+    end
+
+    def peeraddr = @io.peeraddr
+
+    def addr = @io.addr
+
+    private
+
+    def fill(length)
+      @buffer << read_underlying([length - @buffer.bytesize, 4096].max, @timeout) while @buffer.bytesize < length
+    end
+
+    def read_underlying(length, timeout)
+      if @deadline
+        remaining = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        raise TimeoutError, "read timed out" unless remaining.positive?
+
+        timeout = timeout ? [timeout, remaining].min : remaining
+      end
+      unless @io.respond_to?(:read_nonblock)
+        return @io.readpartial(length, timeout: timeout)
+      end
+
+      deadline = timeout && (Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout)
+      loop do
+        result = @io.read_nonblock(length, exception: false)
+        case result
+        when :wait_readable, :wait_writable
+          remaining = deadline && (deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC))
+          raise TimeoutError, "read timed out" if remaining && remaining <= 0
+
+          ready = IO.select(result == :wait_readable ? [@io] : nil, result == :wait_writable ? [@io] : nil, nil,
+                            remaining)
+          raise TimeoutError, "read timed out" unless ready
+        when nil
+          raise EOFError
+        else
+          return result
+        end
+      end
+    end
+
+    def account_line(line)
+      if @line_budget
+        @line_budget[0] += line.bytesize
+        @line_budget[1] += 1 unless line == "\r\n"
+        if @line_budget[0] > 65_536 || @line_budget[1] > 101
+          raise BufferLimitExceeded, "HTTP headers exceed limit"
+        end
+
+        @line_budget = nil if line == "\r\n"
+      elsif @track_trailers && line.match?(/\A0+(?:;[^\r\n]*)?\r\n\z/)
+        @line_budget = [0, 1] # 尾部字段没有请求行或状态行。
+      end
+      line
+    end
+  end
+end

data/lib/anytls/byte_buffer.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 有界二进制接收队列；生产者不阻塞，读取者可等待数据。
+  # 远端结束后先读完缓冲再报告 EOF 或异常；本地关闭则丢弃缓冲。
+  class ByteBuffer
+    def initialize(limit: 262_144)
+      @limit = limit
+      @bytes = String.new(encoding: Encoding::BINARY)
+      @mutex = Mutex.new
+      @changed = ConditionVariable.new
+      @finished = false
+    end
+
+    def size
+      @mutex.synchronize { @bytes.bytesize }
+    end
+
+    def inspect
+      "#<#{self.class} bytes=#{size} limit=#{@limit}>"
+    end
+
+    def push(bytes)
+      @mutex.synchronize do
+        return if @finished
+        raise BufferLimitExceeded, "stream receive buffer limit exceeded" if @bytes.bytesize + bytes.bytesize > @limit
+
+        @bytes << bytes
+        @changed.broadcast
+      end
+    end
+
+    def readpartial(length, deadline:)
+      raise ArgumentError, "length must be positive" unless length.is_a?(Integer) && length.positive?
+
+      @mutex.synchronize do
+        deadline.wait(@changed, @mutex) while @bytes.empty? && !@finished
+        if @bytes.empty?
+          raise @error if @error
+
+          raise EOFError, "end of stream"
+        end
+        count = [length, @bytes.bytesize].min
+        result = @bytes.byteslice(0, count)
+        @bytes = @bytes.byteslice(count..) || String.new(encoding: Encoding::BINARY)
+        result
+      end
+    end
+
+    def finish(error = nil, discard: false)
+      @mutex.synchronize do
+        unless @finished
+          @error = error
+          @finished = true
+        end
+        @bytes.clear if discard
+        @changed.broadcast
+      end
+    end
+  end
+end

data/lib/anytls/cli/client_listener.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require "socket"
+
+module AnyTLS
+  module CLI
+    # 有界本地 TCP 接入；回收工作线程，并允许资源耗尽后恢复接入。
+    # 持有监听器和混合代理适配器；停止时也关闭客户端会话池。
+    class ClientListener
+      def initialize(client:, options:, logger:)
+        @client = client
+        @options = options
+        @logger = logger
+        @mixed = Inbound::Mixed.new(client: client, logger: logger,
+                                    handshake_timeout: options.fetch(:handshake_timeout))
+        @listener = TCPServer.new(options.fetch(:listen_host), options.fetch(:listen_port))
+        @workers = {}
+        @completed = Queue.new
+      end
+
+      def run(shutdown)
+        address = @listener.local_address
+        @logger.info("mixed proxy listening on #{address.ip_address}:#{address.ip_port}")
+        loop do
+          reap_workers
+          ready = IO.select([@listener, shutdown.reader], nil, nil, 0.1)&.first
+          next unless ready
+          break if ready.include?(shutdown.reader)
+
+          accept_client(shutdown)
+        end
+      ensure
+        close
+      end
+
+      def close
+        @listener.close unless @listener.closed?
+        @mixed.close
+        @client.close
+        @workers.each_key { |socket| socket.close unless socket.closed? }
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + @options.fetch(:grace)
+        @workers.each_value do |thread|
+          remaining = [deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), 0].max
+          raise IOError, "proxy worker did not stop" unless thread.join(remaining)
+
+          thread.value
+        end
+        @workers.clear
+      end
+
+      private
+
+      def accept_client(shutdown)
+        socket = @listener.accept_nonblock(exception: false)
+        return if socket == :wait_readable
+
+        if @workers.size >= @options.fetch(:max_connections)
+          socket.close
+          return
+        end
+        start_worker(socket)
+        @resource_limited = false
+      rescue Errno::EMFILE, Errno::ENFILE, ThreadError => error
+        socket.close if socket.is_a?(IO) && !socket.closed?
+        @logger.warn("proxy admission paused (#{error.class})") unless @resource_limited
+        @resource_limited = true
+        IO.select([shutdown.reader], nil, nil, 0.05)
+      end
+
+      def start_worker(socket)
+        @workers[socket] = Thread.new do
+          @mixed.handle(socket)
+        rescue StandardError => error
+          @logger.warn("proxy connection failed (#{error.class})")
+        ensure
+          socket.close unless socket.closed?
+          @completed << socket
+        end
+      end
+
+      def reap_workers
+        loop do
+          socket = @completed.pop(true)
+          @workers.delete(socket)&.join
+        rescue ThreadError
+          break
+        end
+      end
+    end
+  end
+end

data/lib/anytls/cli/options.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+require "optparse"
+require "logger"
+
+module AnyTLS
+  # 命令行编排层；核心对象不读取进程参数或 ENV。
+  module CLI
+    # 解析兼容及当前选项，按优先级读取显式参数、URI 和环境变量中的凭据。
+    # 监听前完成校验；帮助和版本查询无需凭据，也不启动网络 I/O。
+    class Options
+      LEGACY_FLAGS = { "-sni" => "--sni", "-dr" => "--disable-reuse",
+                       "-padding-scheme" => "--padding-scheme" }.freeze
+      VALUE_FLAGS = %w[-l --listen -p --password --password-file --connect-timeout --handshake-timeout
+                       --max-sessions --grace --padding-scheme --log-level -s --server --sni --ca-file
+                       -m --min-idle-sessions --open-timeout --max-connections --cert --key --max-streams].freeze
+
+      attr_reader :values, :parser
+
+      def initialize(mode, env: ENV)
+        @mode = mode
+        @env = env
+        @values = { listen: mode == :client ? "127.0.0.1:1080" : "0.0.0.0:8443",
+                    min_idle_sessions: 5, reuse: true, connect_timeout: 5.0,
+                    handshake_timeout: 5.0, open_timeout: 5.0, max_sessions: 128,
+                    max_connections: 256, max_streams: 256, grace: 5.0 }
+        @parser = OptionParser.new
+        configure
+      end
+
+      def parse(argv)
+        args = normalize_legacy(argv)
+        parser.parse!(args)
+        raise ArgumentError, "unexpected positional arguments" unless args.empty?
+        return values if values[:help] || values[:version]
+
+        validate!
+        values
+      end
+
+      private
+
+      def normalize_legacy(argv)
+        value_follows = false
+        argv.map do |argument|
+          if value_follows
+            value_follows = false
+            next argument
+          end
+          flag, value = argument.split("=", 2)
+          flag = LEGACY_FLAGS.fetch(flag, flag)
+          value_follows = value.nil? && VALUE_FLAGS.include?(flag)
+          value.nil? ? flag : "#{flag}=#{value}"
+        end
+      end
+
+      def configure
+        parser.banner = "Usage: anytls-#{@mode} [options]"
+        parser.on("-l", "--listen ADDRESS", "Listen address (bracket IPv6)") { |v| values[:listen] = v }
+        parser.on("-p", "--password PASSWORD", "Password; prefer a file or ANYTLS_PASSWORD") do |v|
+          values[:password_argument] = v
+        end
+        parser.on("--password-file PATH", "Read password from a private file") { |v| values[:password_file] = v }
+        parser.on("--connect-timeout SECONDS", Float) { |v| values[:connect_timeout] = v }
+        parser.on("--handshake-timeout SECONDS", Float) { |v| values[:handshake_timeout] = v }
+        parser.on("--max-sessions COUNT", Integer) { |v| values[:max_sessions] = v }
+        parser.on("--grace SECONDS", Float, "Shutdown grace period") { |v| values[:grace] = v }
+        parser.on("--padding-scheme PATH") { |v| values[:padding_file] = v }
+        parser.on("--log-level LEVEL", %w[debug info warn error fatal]) { |v| values[:log_level] = v }
+        @mode == :client ? configure_client : configure_server
+        parser.on("-h", "--help", "Show this help") { values[:help] = true }
+        parser.on("-v", "--version", "Show version") { values[:version] = true }
+      end
+
+      def configure_client
+        parser.on("-s", "--server ADDRESS", "Server host:port or anytls:// URI") { |v| values[:server] = v }
+        parser.on("--sni HOST") { |v| values[:sni] = v }
+        parser.on("--ca-file PATH") { |v| values[:ca_file] = v }
+        parser.on("--insecure", "Explicitly disable TLS certificate verification") { values[:insecure] = true }
+        parser.on("-m", "--min-idle-sessions COUNT", Integer) { |v| values[:min_idle_sessions] = v }
+        parser.on("--disable-reuse", "Use a fresh session for every connection") { values[:reuse] = false }
+        parser.on("--open-timeout SECONDS", Float) { |v| values[:open_timeout] = v }
+        parser.on("--max-connections COUNT", Integer) { |v| values[:max_connections] = v }
+      end
+
+      def configure_server
+        parser.on("--cert PATH", "PEM certificate chain") { |v| values[:cert] = v }
+        parser.on("--key PATH", "PEM private key") { |v| values[:key] = v }
+        parser.on("--self-signed", "Generate an ephemeral development certificate") { values[:self_signed] = true }
+        parser.on("--max-streams COUNT", Integer) { |v| values[:max_streams] = v }
+      end
+
+      def validate!
+        values[:listen_host], values[:listen_port] = parse_endpoint(values[:listen], allow_zero: true)
+        parse_server if @mode == :client
+        values[:password] = resolve_password
+        raise ArgumentError, "password is required" if values[:password].nil? || values[:password].empty?
+
+        %i[connect_timeout handshake_timeout open_timeout grace].each do |key|
+          value = values.fetch(key)
+          raise ArgumentError, "#{key} must be positive and finite" unless value.finite? && value.positive?
+        end
+        %i[max_sessions max_connections max_streams].each do |key|
+          raise ArgumentError, "#{key} must be positive" unless values.fetch(key).positive?
+        end
+        if @mode == :client && values[:min_idle_sessions].negative?
+          raise ArgumentError, "min_idle_sessions must be nonnegative"
+        end
+
+        validate_certificate! if @mode == :server
+        values[:log_level] ||= %w[debug info warn error fatal].include?(@env["LOG_LEVEL"]) ? @env["LOG_LEVEL"] : "info"
+      end
+
+      def parse_server
+        server = values[:server]
+        raise ArgumentError, "server is required" unless server
+
+        if server.start_with?("anytls://")
+          uri = ConnectionURI.parse(server)
+          values[:host], values[:port] = uri.values_at(:host, :port)
+          values[:uri_password] = uri[:password]
+          values[:sni] ||= uri[:sni]
+          values[:insecure] = uri[:insecure] unless values.key?(:insecure)
+        else
+          values[:host], values[:port] = parse_endpoint(server)
+        end
+      end
+
+      def parse_endpoint(value, allow_zero: false)
+        match = /\A(?:\[([^\]]+)\]|([^:\s]+)):(\d+)\z/.match(value)
+        raise ArgumentError, "expected host:port or [IPv6]:port" unless match
+
+        port = Integer(match[3], 10)
+        raise ArgumentError, "port is out of range" unless port.between?(allow_zero ? 0 : 1, 65_535)
+
+        [match[1] || match[2], port]
+      end
+
+      def resolve_password
+        if values[:password_argument] && values[:password_file]
+          raise ArgumentError, "choose password or password-file"
+        end
+
+        if values[:password_file]
+          File.binread(values[:password_file]).sub(/\r?\n\z/, "")
+        else
+          values[:password_argument] || values[:uri_password] || @env["ANYTLS_PASSWORD"]
+        end
+      end
+
+      def validate_certificate!
+        if values[:self_signed]
+          raise ArgumentError, "self-signed cannot be combined with cert/key" if values[:cert] || values[:key]
+        elsif !values[:cert] || !values[:key]
+          raise ArgumentError, "server requires cert and key, or explicit self-signed"
+        end
+      end
+    end
+  end
+end

data/lib/anytls/cli/runner.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require_relative "options"
+require_relative "shutdown"
+require_relative "client_listener"
+
+module AnyTLS
+  module CLI
+    # 进程入口：创建资源、等待停止，并返回脱敏诊断与退出码。
+    # 退出码为 0（成功）、2（参数错误）、1（运行失败）。
+    class Runner
+      def self.run(mode, argv = ARGV, env: ENV, stdout: $stdout, stderr: $stderr)
+        new(mode, argv, env: env, stdout: stdout, stderr: stderr).run
+      end
+
+      def initialize(mode, argv, env:, stdout:, stderr:)
+        @mode, @argv, @env, @stdout, @stderr = mode, argv, env, stdout, stderr
+      end
+
+      def run
+        options = Options.new(@mode, env: @env)
+        values = options.parse(@argv)
+        if values[:help]
+          @stdout.puts(options.parser)
+          return 0
+        end
+        if values[:version]
+          @stdout.puts(AnyTLS::VERSION)
+          return 0
+        end
+        logger = Logger.new(@stderr, level: values.fetch(:log_level))
+        logger.formatter = ->(severity, _time, _name, message) { "#{severity}: #{message}\n" }
+        shutdown = Shutdown.new.install
+        @mode == :client ? run_client(values, logger, shutdown) : run_server(values, logger, shutdown)
+        0
+      rescue OptionParser::ParseError, ArgumentError
+        @stderr.puts("error: invalid options; use --help")
+        2
+      rescue StandardError => error
+        @stderr.puts("error: #{@mode} failed (#{error.class})")
+        1
+      ensure
+        shutdown&.close
+      end
+
+      private
+
+      def padding(values)
+        return unless values[:padding_file]
+
+        Padding::Scheme.new(File.binread(values[:padding_file]))
+      end
+
+      def run_client(values, logger, shutdown)
+        tls = TLSConfig.new(ca_file: values[:ca_file], sni: values[:sni], insecure: values.fetch(:insecure, false))
+        client = Client.new(host: values.fetch(:host), port: values.fetch(:port), password: values.fetch(:password),
+                            tls: tls, min_idle_sessions: values.fetch(:min_idle_sessions), reuse: values.fetch(:reuse),
+                            connect_timeout: values.fetch(:connect_timeout),
+                            handshake_timeout: values.fetch(:handshake_timeout),
+                            open_timeout: values.fetch(:open_timeout),
+                            max_sessions: values.fetch(:max_sessions), logger: logger, padding: padding(values))
+        listener = ClientListener.new(client: client, options: values, logger: logger)
+        listener.run(shutdown)
+      ensure
+        client&.close
+      end
+
+      def run_server(values, logger, shutdown)
+        tls = TLSConfig.new(server: true, cert: values[:cert], key: values[:key],
+                            self_signed: values.fetch(:self_signed, false))
+        server = Server.new(host: values.fetch(:listen_host), port: values.fetch(:listen_port),
+                            password: values.fetch(:password), tls: tls, padding: padding(values),
+                            connect_timeout: values.fetch(:connect_timeout),
+                            handshake_timeout: values.fetch(:handshake_timeout),
+                            max_sessions: values.fetch(:max_sessions), max_streams: values.fetch(:max_streams),
+                            logger: logger)
+        worker = Thread.new { server.run }
+        loop do
+          break unless worker.alive?
+          break if IO.select([shutdown.reader], nil, nil, 0.1)
+        end
+        server.stop(grace: values.fetch(:grace))
+        worker.value
+      ensure
+        server&.stop(grace: values.fetch(:grace))
+      end
+    end
+  end
+end

data/lib/anytls/cli/shutdown.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "socket"
+
+module AnyTLS
+  module CLI
+    # 信号处理器仅写入唤醒 socket；由正常线程执行停止流程。
+    # 安装者持有 socket 两端，关闭时恢复原信号处理器。
+    class Shutdown
+      attr_reader :reader
+
+      def initialize
+        @reader, @writer = Socket.pair(:UNIX, :STREAM, 0)
+        @previous = {}
+      end
+
+      def install
+        %w[INT TERM].each do |signal|
+          @previous[signal] = Signal.trap(signal) do
+            @writer.write_nonblock("x", exception: false)
+          rescue IOError, SystemCallError
+            nil
+          end
+        end
+        self
+      end
+
+      def close
+        @previous.each { |signal, handler| Signal.trap(signal, handler) }
+        @previous.clear
+        @reader.close unless @reader.closed?
+        @writer.close unless @writer.closed?
+      end
+    end
+  end
+end