anytls 0.1.0

data/lib/anytls/client.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 延迟拨号的出站入口；每条流独占租用一个会话，客户端持有会话池。
+  # 构造时不拨号；块形式在退出时关闭交给块的资源。
+  class Client
+    attr_reader :address
+
+    def initialize(host:, password:, port: 443, tls: nil, min_idle_sessions: 5, idle_timeout: 30,
+                   idle_check_interval: 30, connect_timeout: 5, handshake_timeout: 5, open_timeout: 5,
+                   max_sessions: 128, logger: nil, padding: nil, reuse: true)
+      raise ConfigurationError, "password must be a nonempty String" unless password.is_a?(String) && !password.empty?
+
+      @address = Address.new(host: host, port: port)
+      raise ConfigurationError, "server port must be positive" unless port.positive?
+
+      [connect_timeout, handshake_timeout, open_timeout].each do |value|
+        Deadline.new(value)
+        raise ConfigurationError, "connection timeouts must be positive" unless value&.positive?
+      end
+      @digest = Digest::SHA256.digest(password).freeze
+      @tls = tls || TLSConfig.new
+      @connect_timeout = connect_timeout
+      @handshake_timeout = handshake_timeout
+      @open_timeout = open_timeout
+      @logger = logger
+      @scheme = padding || Padding::Scheme.default
+      @scheme_mutex = Mutex.new
+      @pool = SessionPool.new(max_sessions: max_sessions, min_idle_sessions: min_idle_sessions,
+                              idle_timeout: idle_timeout, idle_check_interval: idle_check_interval,
+                              reuse: reuse) do |sequence, timeout|
+        create_session(sequence, timeout)
+      end
+    end
+
+    def self.open(**)
+      client = new(**)
+      return client unless block_given?
+
+      begin
+        yield client
+      ensure
+        client.close
+      end
+    end
+
+    # 返回的流可能仍未确认目标连接，直到收到 v2 协商结果和 SYNACK。
+    # 获取会话和开流共用预算；失败操作不会自动重放。
+    def connect(host, port, timeout: nil)
+      destination = Address.new(host: host, port: port)
+      raise ArgumentError, "destination port must be positive" unless port.positive?
+
+      deadline = Deadline.new(timeout.nil? ? @open_timeout : timeout)
+      session, stream = open_stream(destination, deadline)
+      stream.wait_connected(timeout: deadline.remaining) if session.peer_version >= 2
+      return stream unless block_given?
+
+      begin
+        yield stream
+      ensure
+        stream.close
+      end
+    rescue StandardError
+      stream&.close
+      raise
+    end
+
+    # 固定目标使用连接模式 UoT；未指定固定目标时，每个包必须提供目标。
+    def open_datagrams(destination: nil, timeout: nil)
+      deadline = Deadline.new(timeout.nil? ? @open_timeout : timeout)
+      session, stream = open_stream(Address.new(host: "sp.v2.udp-over-tcp.arpa", port: 443), deadline)
+      connection = UoT::Connection.new(stream, destination: destination, timeout: deadline.remaining)
+      stream.wait_connected(timeout: deadline.remaining) if session.peer_version >= 2
+      return connection unless block_given?
+
+      begin
+        yield connection
+      ensure
+        connection.close
+      end
+    rescue StandardError
+      stream&.close
+      raise
+    end
+
+    def stats
+      @pool.stats
+    end
+
+    def padding_scheme
+      @scheme_mutex.synchronize { @scheme }
+    end
+
+    def close
+      @pool.close
+    end
+
+    def inspect
+      "#<#{self.class} server=#{address.host}:#{address.port}>"
+    end
+
+    private
+
+    def open_stream(destination, deadline)
+      session = @pool.acquire(timeout: deadline.remaining)
+      begin
+        [session, session.open_stream(destination, timeout: deadline.remaining)]
+      rescue StandardError
+        session.close
+        raise
+      end
+    end
+
+    def create_session(sequence, timeout)
+      deadline = Deadline.new(timeout)
+      socket = Dialer.connect(address, timeout: [deadline.remaining, @connect_timeout].compact.min)
+      session = Session.new(socket, tls: @tls, password_digest: @digest, scheme: padding_scheme,
+                                    host: address.host, sequence: sequence, handshake_timeout: @handshake_timeout,
+                                    open_timeout: @open_timeout, logger: @logger,
+                                    on_idle: ->(item) { @pool.release(item) },
+                                    on_close: ->(item) { @pool.remove(item) },
+                                    on_padding: ->(scheme) { @scheme_mutex.synchronize { @scheme = scheme } })
+      session.wait_ready(timeout: deadline.remaining)
+    rescue StandardError
+      session ? session.close : socket&.close
+      raise
+    end
+  end
+end

data/lib/anytls/connection_uri.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module AnyTLS
+  # 纯连接 URI 编解码：保留字面加号，校验已知选项，
+  # 允许未来扩展查询参数，解析异常不回显凭据。
+  module ConnectionURI
+    module_function
+
+    def parse(value)
+      raise TypeError, "connection URI must be a String" unless value.is_a?(String)
+      raise ConfigurationError, "invalid percent encoding in connection URI" if value.match?(/%(?![0-9a-fA-F]{2})/)
+
+      uri = URI.parse(value)
+      unless uri.scheme == "anytls" && uri.host && ["", "/"].include?(uri.path)
+        raise ConfigurationError, "expected an anytls URI with a host and no path"
+      end
+      raise ConfigurationError, "encode password punctuation in URI user information" if uri.password
+
+      address = Address.new(host: uri.hostname, port: uri.port || 443)
+      raise ConfigurationError, "server port must be positive" if address.port.zero?
+
+      query = parse_query(uri.query)
+      insecure = query.fetch("insecure", "0")
+      raise ConfigurationError, "insecure must be 0 or 1" unless %w[0 1].include?(insecure)
+
+      {
+        host: address.host,
+        port: address.port,
+        password: decode_component(uri.user || "").freeze,
+        sni: query["sni"]&.freeze,
+        insecure: insecure == "1",
+        name: uri.fragment && decode_component(uri.fragment).freeze
+      }.freeze
+    rescue URI::InvalidURIError, ArgumentError => error
+      raise error if error.is_a?(ConfigurationError)
+
+      raise ConfigurationError, "invalid AnyTLS connection URI", cause: nil
+    end
+
+    def build(host:, password:, port: 443, sni: nil, insecure: false, name: nil)
+      address = Address.new(host:, port:)
+      raise ConfigurationError, "server port must be positive" if address.port.zero?
+      raise TypeError, "password must be a String" unless password.is_a?(String)
+      raise ArgumentError, "insecure must be boolean" unless [true, false].include?(insecure)
+
+      host_text = address.ipv6? ? "[#{address.host}]" : address.host
+      result = "anytls://#{encode_component(password)}@#{host_text}:#{port}/"
+      query = []
+      query << "sni=#{encode_component(sni)}" unless sni.nil?
+      query << "insecure=1" if insecure
+      result << "?#{query.join('&')}" unless query.empty?
+      result << "##{encode_component(name)}" unless name.nil?
+      result
+    end
+
+    def redact(value)
+      config = parse(value)
+      build(**config, password: "REDACTED")
+    end
+
+    def parse_query(query)
+      return {} unless query
+
+      query.split("&").each_with_object({}) do |part, result|
+        key, value = part.split("=", 2)
+        raise ConfigurationError, "URI query entry requires a value" unless value
+
+        key = decode_component(key)
+        raise ConfigurationError, "duplicate URI query parameter" if result.key?(key)
+
+        result[key] = decode_component(value)
+      end
+    end
+
+    private_class_method :parse_query
+
+    def decode_component(value)
+      decoded = URI::RFC2396_PARSER.unescape(value).force_encoding(Encoding::UTF_8)
+      raise ConfigurationError, "URI text must be UTF-8" unless decoded.valid_encoding?
+
+      decoded
+    end
+
+    private_class_method :decode_component
+
+    def encode_component(value)
+      raise TypeError, "URI component must be a String" unless value.is_a?(String)
+
+      URI::RFC2396_PARSER.escape(value, /[^a-zA-Z0-9\-._~]/)
+    end
+
+    private_class_method :encode_component
+  end
+end

data/lib/anytls/deadline.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 排队、等待和 socket 操作共用一个基于单调时钟的绝对时间预算。
+  class Deadline
+    def self.now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+
+    def initialize(seconds = nil)
+      unless seconds.nil? || (seconds.is_a?(Numeric) && seconds.finite? && seconds >= 0)
+        raise ArgumentError, "timeout must be a finite nonnegative number"
+      end
+
+      @expires_at = seconds && (self.class.now + seconds)
+    end
+
+    def remaining
+      return nil unless @expires_at
+
+      [@expires_at - self.class.now, 0].max
+    end
+
+    def check!
+      raise TimeoutError, "operation timed out" if @expires_at && self.class.now >= @expires_at
+    end
+
+    def wait(condition, mutex)
+      check!
+      condition.wait(mutex, remaining)
+      check!
+    end
+  end
+end

data/lib/anytls/dialer.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 在同一连接预算内解析地址，并交错尝试不同地址族。
+  # 成功连接的 TCP socket 交给调用者；其余尝试全部关闭。
+  module Dialer
+    module_function
+
+    def connect(address, timeout: 5)
+      raise ArgumentError, "destination port must be positive" unless address.port.positive?
+
+      deadline = Deadline.new(timeout)
+      deadline.check!
+      addresses = Addrinfo.getaddrinfo(address.host, address.port, nil, :STREAM, timeout: deadline.remaining)
+      candidates = interleave_families(addresses.uniq(&:to_sockaddr))
+      pending = []
+      next_attempt = Deadline.now
+      last_error = SocketError.new("no addresses for destination")
+      loop do
+        deadline.check!
+        if !candidates.empty? && (pending.empty? || Deadline.now >= next_attempt)
+          endpoint = candidates.shift
+          socket = nil
+          begin
+            socket = Socket.new(endpoint.afamily, Socket::SOCK_STREAM, 0)
+            pending << socket
+            socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
+            result = socket.connect_nonblock(endpoint, exception: false)
+            if result.is_a?(Integer) && result.zero?
+              pending.delete(socket)
+              return socket
+            end
+          rescue SystemCallError => error
+            last_error = error
+            pending.delete(socket)
+            socket&.close
+          end
+          next_attempt = Deadline.now + 0.25
+        end
+        raise last_error if candidates.empty? && pending.empty?
+        next if pending.empty?
+
+        delay = candidates.empty? ? deadline.remaining : [next_attempt - Deadline.now, 0].max
+        delay = [delay, deadline.remaining].compact.min
+        ready = IO.select(nil, pending, nil, delay)
+        next unless ready
+
+        ready[1].each do |connection|
+          status = connection.getsockopt(Socket::SOL_SOCKET, Socket::SO_ERROR).int
+          pending.delete(connection)
+          return connection if status.zero?
+
+          last_error = SystemCallError.new("TCP connect failed", status)
+          connection.close
+        end
+      end
+    rescue Errno::ETIMEDOUT, IO::TimeoutError => error
+      raise TimeoutError, "TCP connection timed out", cause: error
+    ensure
+      pending&.each(&:close)
+    end
+
+    def interleave_families(addresses)
+      first, other = addresses.partition { |endpoint| endpoint.afamily == addresses.first.afamily }
+      first.zip(other).flatten.compact + other.drop(first.length)
+    end
+
+    private_class_method :interleave_families
+  end
+end

data/lib/anytls/errors.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 协议和传输故障继承 Error；配置错误和本地关闭
+  # 分别保留 Ruby 的 ArgumentError 与 IOError 捕获契约。
+  class Error < StandardError; end
+
+  class ConfigurationError < ArgumentError; end
+
+  class ProtocolError < Error; end
+
+  class AuthenticationError < Error; end
+
+  class TransportError < Error; end
+
+  class RemoteError < Error; end
+
+  class TimeoutError < Error; end
+
+  class BufferLimitExceeded < Error; end
+
+  class ClosedError < IOError; end
+end

data/lib/anytls/inbound/http_proxy.rb

@@ -0,0 +1,224 @@
+# frozen_string_literal: true
+
+require "uri"
+require "protocol/http1/connection"
+
+module AnyTLS
+  module Inbound
+    # 每个客户端连接独立使用处理器；由 protocol-http1 解析 HTTP 消息边界，
+    # 过滤逐跳头，并流式转发普通请求体，避免缓存整条消息。
+    # CONNECT 与成功的 Upgrade 将预读字节交给转发器；HTTPS 使用 CONNECT。
+    class HTTPProxy
+      HOP_HEADERS = %w[connection proxy-connection proxy-authenticate proxy-authorization keep-alive
+                       te trailer transfer-encoding upgrade content-length].freeze
+
+      # 在 protocol-http1 消费消息定界头之前完成校验。
+      class Connection < ::Protocol::HTTP1::Connection
+        attr_reader :declared_content_length
+
+        def read_headers
+          headers = super
+          fields = headers.to_a
+          lengths = fields.select { |name, _| name.downcase == "content-length" }.map(&:last)
+          transfers = fields.select { |name, _| name.downcase == "transfer-encoding" }.map(&:last)
+          hosts = fields.count { |name, _| name.downcase == "host" }
+          raise ProtocolError, "duplicate Host header" if hosts > 1
+          raise ProtocolError, "ambiguous HTTP framing" if lengths.length > 1 || (lengths.any? && transfers.any?)
+          if lengths.any? && !lengths.first.match?(/\A[0-9]+\z/)
+            raise ProtocolError, "invalid Content-Length"
+          end
+
+          @declared_content_length = lengths.first
+          if transfers.any? && transfers.map(&:downcase) != ["chunked"]
+            raise ProtocolError, "unsupported Transfer-Encoding"
+          end
+
+          fields.map(&:last).each do |value|
+            raise ProtocolError, "invalid HTTP header value" if value.match?(/[\x00-\x08\x0a-\x1f\x7f]/)
+          end
+          headers
+        end
+
+        def read_request_body(method, headers)
+          # 依赖将 Upgrade 请求直接解释为隧道；带消息体时先拒绝，防止
+          # Content-Length 或分块定界被丢弃、请求体变成升级后的协议数据。
+          if headers["upgrade"] && (headers["transfer-encoding"] ||
+              (@declared_content_length && Integer(@declared_content_length, 10).positive?))
+            raise ProtocolError, "Upgrade requests with a body are unsupported"
+          end
+
+          super
+        end
+      end
+
+      def initialize(client:, logger: nil, handshake_timeout: 5)
+        @client = client
+        @logger = logger
+        @handshake_timeout = handshake_timeout
+      end
+
+      def handle(io)
+        connection = Connection.new(io, maximum_line_length: 8192)
+        loop do
+          @responded = false
+          io.timeout = @handshake_timeout
+          io.begin_headers!
+          request = connection.read_request
+          break unless request
+
+          host, method, target, version, headers, body = request
+          raise ProtocolError, "unsupported HTTP version" unless %w[HTTP/1.0 HTTP/1.1].include?(version)
+          raise ProtocolError, "HTTP/1.1 requires a Host header" if version == "HTTP/1.1" && host.to_s.empty?
+
+          io.timeout = nil
+          if method == "CONNECT"
+            connect(io, connection, target)
+            break
+          end
+
+          forward(io, connection, method, target, version, headers, body, host)
+          break unless connection.idle?
+        end
+      rescue BufferLimitExceeded
+        error_response(io, 431, "Request Header Fields Too Large")
+      rescue TimeoutError
+        error_response(io, 504, "Gateway Timeout")
+      rescue ProtocolError, ArgumentError, URI::InvalidURIError, ::Protocol::HTTP1::Error
+        error_response(io, 400, "Bad Request")
+      rescue TransportError, RemoteError, SocketError, SystemCallError, IOError, ::Protocol::HTTP::Error
+        error_response(io, 502, "Bad Gateway")
+      end
+
+      private
+
+      def connect(io, connection, authority)
+        parsed = URI.parse("http://#{authority}")
+        unless parsed.host && parsed.userinfo.nil? && parsed.path.empty? && parsed.query.nil? &&
+               parsed.fragment.nil? && authority.match?(/:\d+\z/) && parsed.port.positive?
+          raise ProtocolError, "CONNECT requires host:port"
+        end
+
+        stream = @client.connect(parsed.hostname, parsed.port, timeout: @handshake_timeout)
+        io.write("HTTP/1.1 200 Connection Established\r\n\r\n".b)
+        @responded = true
+        Relay.copy(connection.hijack!, stream)
+      ensure
+        stream&.close
+      end
+
+      def forward(io, downstream, method, target, version, headers, body, _host)
+        uri = URI.parse(target)
+        unless uri.is_a?(URI::HTTP) && uri.host && uri.userinfo.nil? && uri.fragment.nil?
+          raise ProtocolError, "HTTP proxy requires an absolute HTTP URI"
+        end
+        # HTTPS 目标使用 CONNECT；若在此加密目标流量，
+        # 需要可供 TLS 使用的真实 IO 端点，AnyTLS 虚拟流不具备该能力。
+        raise ProtocolError, "use CONNECT for HTTPS destinations" unless uri.scheme == "http"
+
+        stream = @client.connect(uri.hostname, uri.port, timeout: @handshake_timeout)
+        transport = BufferedIO.new(stream)
+        upstream = Connection.new(transport, maximum_line_length: 8192)
+        upgrade = headers["upgrade"]
+        if upgrade && !headers["connection"].to_s.downcase.split(",").map(&:strip).include?("upgrade")
+          raise ProtocolError, "Upgrade requires Connection: upgrade"
+        end
+
+        outgoing = filtered_headers(headers, upgrade: !upgrade.nil?)
+        outgoing.delete("expect")
+        if headers["expect"]
+          raise ProtocolError, "unsupported expectation" unless headers["expect"].downcase == "100-continue"
+
+          downstream.write_interim_response(version, 100, [])
+        end
+        upstream.write_request(uri.host.include?(":") ? "[#{uri.hostname}]:#{uri.port}" : uri.authority,
+                               method, uri.request_uri, "HTTP/1.1", outgoing)
+        if upgrade
+          transport.write("\r\n")
+        elsif body
+          cancel_upload = false
+          upload = Thread.new do
+            upstream.write_body("HTTP/1.1", body)
+            nil
+          rescue StandardError => error
+            stream.close unless cancel_upload || stream.closed?
+            error
+          end
+        else
+          upstream.write_body("HTTP/1.1", body)
+        end
+        loop do
+          transport.timeout = upload&.alive? ? nil : @handshake_timeout
+          transport.begin_headers!
+          _response_version, status, reason, response_headers, response_body = upstream.read_response(method)
+          transport.timeout = nil
+          if status.between?(100, 199) && status != 101
+            downstream.write_interim_response(version, status, filtered_headers(response_headers), reason)
+            next
+          end
+
+          if upload&.alive?
+            # 目标服务可能在读取完整请求体之前拒绝上传。
+            # 仅关闭本地客户端 socket 的读取方向，等待上传线程结束，
+            # 再交付目标响应并关闭该 HTTP 连接。
+            downstream.persistent = false
+            cancel_upload = true
+            io.close_read
+            upload.join
+          end
+
+          if status == 101
+            raise ProtocolError, "unexpected HTTP upgrade" unless upgrade
+
+            downstream.write_response(version, status, filtered_headers(response_headers, upgrade: true), reason)
+            io.write("\r\n")
+            @responded = true
+            Relay.copy(downstream.hijack!, upstream.hijack!)
+          else
+            response_fields = filtered_headers(response_headers)
+            no_body = method == "HEAD" || [204, 304].include?(status)
+            if no_body && status != 204 && upstream.declared_content_length
+              response_fields.add("content-length", upstream.declared_content_length)
+            end
+            downstream.write_response(version, status, response_fields, reason)
+            @responded = true
+            # Upgrade 被拒绝时，请求的隧道体仍未结束。
+            downstream.persistent = false if upgrade
+            if no_body
+              io.write("\r\n")
+              downstream.send_end_stream!
+              response_body&.close
+            else
+              downstream.write_body(version, response_body)
+            end
+          end
+          break
+        end
+      rescue StandardError => error
+        upload_error = upload.value if upload && !upload.alive?
+        raise(upload_error || error)
+      ensure
+        stream&.close
+        if upload&.alive?
+          cancel_upload = true
+          io.close_read
+          upload.join
+        end
+      end
+
+      def filtered_headers(headers, upgrade: false)
+        names = headers["connection"].to_s.split(",").map { |name| name.strip.downcase }
+        forbidden = HOP_HEADERS + names + ["host"]
+        forbidden -= %w[connection upgrade] if upgrade
+        ::Protocol::HTTP::Headers.new(headers.to_a.reject { |name, _| forbidden.include?(name.downcase) })
+      end
+
+      def error_response(io, status, reason)
+        return if @responded || io.closed?
+
+        io.write("HTTP/1.1 #{status} #{reason}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n")
+      rescue IOError, SystemCallError, Error
+        nil
+      end
+    end
+  end
+end

data/lib/anytls/inbound/mixed.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative "../buffered_io"
+require_relative "../relay"
+require_relative "../uot/connection"
+require_relative "socks4"
+require_relative "socks5"
+
+module AnyTLS
+  # 本地代理适配层，将应用协议握手转换为 Client API 调用。
+  module Inbound
+    # 按缓冲区首字节分派协议，保留已预读的后续载荷。
+    # 持有接入 socket；关闭活动连接以唤醒等待中的处理线程。
+    class Mixed
+      def initialize(client:, logger: nil, handshake_timeout: 5)
+        @client = client
+        @logger = logger
+        @handshake_timeout = handshake_timeout
+        @lock = Mutex.new
+        @connections = {}
+        @closed = false
+      end
+
+      def handle(socket)
+        @lock.synchronize do
+          raise ClosedError, "inbound listener closed" if @closed
+
+          @connections[socket] = true
+        end
+        io = BufferedIO.new(socket, timeout: @handshake_timeout)
+        handler = case io.peek(1).getbyte(0)
+                  when 4 then Socks4
+                  when 5 then Socks5
+                  else
+                    require_relative "http_proxy"
+                    HTTPProxy
+                  end
+        handler.new(client: @client, logger: @logger, handshake_timeout: @handshake_timeout).handle(io)
+      rescue IOError, SystemCallError, Error, SocketError => error
+        Log.emit(@logger, :debug, "inbound connection ended: #{error.class}")
+      ensure
+        IOHelpers.close(socket) unless socket.closed?
+        @lock.synchronize { @connections.delete(socket) }
+      end
+
+      def close
+        connections = @lock.synchronize do
+          @closed = true
+          @connections.keys
+        end
+        connections.each do |socket|
+          IOHelpers.close(socket) unless socket.closed?
+        rescue IOError, SystemCallError
+          nil
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/anytls/inbound/socks4.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module AnyTLS
+  module Inbound
+    # 仅支持 SOCKS4/4a CONNECT；以有界 NUL 结尾字符串读取用户标识和域名。
+    # 用户标识不作为本地监听器的授权机制。
+    class Socks4
+      def initialize(client:, logger: nil, handshake_timeout: 5)
+        @client = client
+        @logger = logger
+        @handshake_timeout = handshake_timeout
+      end
+
+      def handle(io)
+        header = IOHelpers.read_exact(io, 8, timeout: @handshake_timeout)
+        version, command, port = header.unpack("CCn")
+        raise ProtocolError, "unsupported SOCKS4 request" unless version == 4 && command == 1 && port.positive?
+
+        null_string(io) # SOCKS4 用户标识仅为元数据，不用于认证。
+        address = header.byteslice(4, 4)
+        host = if address.byteslice(0, 3) == "\0\0\0".b && address.getbyte(3).positive?
+                 null_string(io)
+               else
+                 IPAddr.ntop(address)
+               end
+        raise ProtocolError, "empty SOCKS4a host" if host.empty?
+
+        stream = @client.connect(host, port, timeout: @handshake_timeout)
+        io.write([0, 90, 0, 0].pack("CCnN"))
+        replied = true
+        io.timeout = nil
+        Relay.copy(io, stream)
+      rescue ProtocolError, ArgumentError, TimeoutError, TransportError, RemoteError, SocketError, SystemCallError
+        io.write([0, 91, 0, 0].pack("CCnN")) unless replied || io.closed?
+      ensure
+        stream&.close
+      end
+
+      private
+
+      def null_string(io)
+        value = +"".b
+        256.times do
+          byte = IOHelpers.read_exact(io, 1, timeout: @handshake_timeout)
+          return value if byte == "\0".b
+
+          value << byte
+        end
+        raise ProtocolError, "SOCKS4 string exceeds 255 bytes"
+      end
+    end
+  end
+end