anytls 0.1.0

data/lib/anytls/relay.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 使用有界片段进行双向转发，并负责关闭两个端点。
+  # 任一方向首先结束时启动清理，并等待两个转发线程退出。
+  module Relay
+    BUFFER_SIZE = 16_384
+
+    # FIN 关闭整条 AnyTLS 流；任一方向 EOF 都会关闭两个端点。
+    # 此处不能模拟 TCP 半关闭，否则会丢失协议状态。
+    def self.copy(left, right)
+      completed = Queue.new
+      workers = []
+      terminal_error = nil
+      begin
+        [[left, right], [right, left]].each do |source, destination|
+          workers << Thread.new do
+            copy_error = nil
+            begin
+              loop do
+                data = source.readpartial(BUFFER_SIZE)
+                break if data.nil? || data.empty?
+
+                IOHelpers.write_all(destination, data)
+              end
+            rescue IOError, SystemCallError
+              # EOF 或另一方向触发的关闭都会结束该方向的转发。
+            rescue StandardError => error
+              copy_error = error
+            ensure
+              completed << copy_error
+            end
+          end
+        end
+        terminal_error = completed.pop
+      rescue StandardError => error
+        terminal_error = error
+      ensure
+        [left, right].each do |endpoint|
+          IOHelpers.close(endpoint)
+        rescue StandardError => error
+          terminal_error ||= error
+        end
+        workers.each(&:join)
+      end
+      raise terminal_error if terminal_error
+    end
+  end
+end

data/lib/anytls/server.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 持有监听器、已接入会话、出站工作线程和目标 socket。
+  # 会话所有者线程分派流，由数量受限的工作线程执行目标 I/O。
+  class Server
+    attr_reader :port
+
+    def initialize(password:, tls:, host: "0.0.0.0", port: 8443, padding: nil, connect_timeout: 5,
+                   handshake_timeout: 5, max_sessions: 128, max_streams: 256, logger: nil)
+      raise ConfigurationError, "password must be a nonempty String" unless password.is_a?(String) && !password.empty?
+
+      @address = Address.new(host: host, port: port)
+      [max_sessions, max_streams].each do |number|
+        unless number.is_a?(Integer) && number.positive?
+          raise ConfigurationError,
+                "resource limits must be positive integers"
+        end
+      end
+      [connect_timeout, handshake_timeout].each do |value|
+        Deadline.new(value)
+        raise ConfigurationError, "connection timeouts must be positive" unless value&.positive?
+      end
+      @port = port
+      @tls = tls
+      @scheme = padding || Padding::Scheme.default
+      @digest = Digest::SHA256.digest(password).freeze
+      @connect_timeout = connect_timeout
+      @handshake_timeout = handshake_timeout
+      @max_sessions = max_sessions
+      @max_streams = max_streams
+      @logger = logger
+      @mutex = Mutex.new
+      @changed = ConditionVariable.new
+      @sessions = {}
+      @workers = []
+      @targets = {}
+      @active_streams = 0
+      @sequence = 0
+      @stopping = false
+      @stopped = false
+      @stop_owner = nil
+    end
+
+    def run
+      owns_listener = false
+      @mutex.synchronize do
+        raise ClosedError, "server stopped" if @stopping
+        raise Error, "server already running" if @listener
+
+        @listener = TCPServer.new(@address.host, @address.port)
+        owns_listener = true
+        @port = @listener.local_address.ip_port
+      end
+      loop do
+        socket = nil
+        begin
+          socket = @listener.accept
+          socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
+          accept_connection(socket)
+          socket = nil # 所有权已交给会话，或连接已被拒绝并关闭。
+        rescue Errno::EMFILE, Errno::ENFILE, ThreadError => error
+          socket&.close unless socket&.closed?
+          now = Deadline.now
+          if !@resource_warning_at || now - @resource_warning_at >= 5
+            Log.emit(@logger, :warn, "accept capacity exhausted (#{error.class})")
+            @resource_warning_at = now
+          end
+          @mutex.synchronize { @changed.wait(@mutex, 0.05) unless @stopping }
+          break if @mutex.synchronize { @stopping }
+        ensure
+          socket&.close unless socket&.closed?
+        end
+      end
+    rescue IOError, SystemCallError
+      raise unless owns_listener && @mutex.synchronize { @stopping }
+    ensure
+      stop(grace: 0) if owns_listener && !@mutex.synchronize { @stopping }
+    end
+
+    # 首次调用者负责停止流程；后续调用者等待同一流程完成。
+    # 停止接入后，已有流仍可在宽限期内继续传输。
+    def stop(grace: 5)
+      deadline = Deadline.new(grace)
+      owns_stop = false
+      sessions = @mutex.synchronize do
+        return if @stopped || @stop_owner == Thread.current
+
+        if @stopping
+          @changed.wait(@mutex) until @stopped
+          return
+        end
+
+        owns_stop = true
+        @stop_owner = Thread.current
+        @stopping = true
+        @changed.broadcast
+        @listener&.close unless @listener&.closed?
+        while @active_streams.positive?
+          remaining = deadline.remaining
+          break if remaining&.zero?
+
+          @changed.wait(@mutex, remaining)
+        end
+        @sessions.keys
+      end
+      sessions.each { |session| session.close(wait: false) }
+      sessions.each(&:close)
+      workers, targets = @mutex.synchronize { [@workers.dup, @targets.keys] }
+      targets.each { |socket| IOHelpers.close(socket) unless socket.closed? }
+      workers.each { |thread| thread.join unless thread == Thread.current }
+      nil
+    ensure
+      if owns_stop
+        @mutex.synchronize do
+          @stopped = true
+          @stop_owner = nil
+          @changed.broadcast
+        end
+      end
+    end
+
+    def stats
+      @mutex.synchronize { { sessions: @sessions.size, active_streams: @active_streams }.freeze }
+    end
+
+    def inspect
+      "#<#{self.class} listen=#{@address.host}:#{port}>"
+    end
+
+    private
+
+    def accept_connection(socket)
+      @mutex.synchronize do
+        if @stopping || @sessions.size >= @max_sessions
+          socket.close
+          return
+        end
+        @sequence += 1
+        session = Session.new(socket, tls: @tls, password_digest: @digest, scheme: @scheme, server: true,
+                                      sequence: @sequence, handshake_timeout: @handshake_timeout, logger: @logger,
+                                      on_stream: method(:start_stream), on_close: method(:remove_session))
+        @sessions[session] = true
+      end
+    rescue StandardError
+      socket.close unless socket.closed?
+      raise
+    end
+
+    def remove_session(session)
+      @mutex.synchronize do
+        @sessions.delete(session)
+        @changed.broadcast
+      end
+    end
+
+    def start_stream(stream, session)
+      @mutex.synchronize do
+        # 此回调运行于会话所有者线程；拒绝流时不能同步向该线程
+        # 再次提交任务，否则会等待自身执行。
+        accepted = !@stopping && @active_streams < @max_streams
+        return false unless accepted
+
+        @active_streams += 1
+        @workers.select!(&:alive?)
+        @workers << Thread.new do
+          handle_stream(stream, session)
+        rescue Error, IOError, SystemCallError, SocketError => error
+          Log.emit(@logger, :debug, "AnyTLS outbound ended: #{error.class}")
+        ensure
+          begin
+            stream.close
+          ensure
+            @mutex.synchronize do
+              @active_streams -= 1
+              @changed.broadcast
+            end
+          end
+        end
+        true
+      rescue ThreadError
+        @active_streams -= 1
+        @changed.broadcast
+        false
+      end
+    end
+
+    def handle_stream(stream, session)
+      reported = false
+      destination = Protocol::SocksAddress.read(stream, timeout: @connect_timeout)
+      if destination.host == "sp.v2.udp-over-tcp.arpa"
+        UoT::Server.new(logger: @logger).handle(
+          stream,
+          on_ready: lambda {
+            session.report_connected(stream.id)
+            reported = true
+          },
+          on_failure: lambda { |error|
+            session.report_connected(stream.id, error: error)
+            reported = true
+          }
+        )
+      else
+        target = Dialer.connect(destination, timeout: @connect_timeout)
+        @mutex.synchronize { @targets[target] = true }
+        session.report_connected(stream.id)
+        reported = true
+        Relay.copy(stream, target)
+      end
+    rescue Error, IOError, SystemCallError, SocketError => error
+      session.report_connected(stream.id, error: error) unless reported || stream.closed?
+      raise
+    ensure
+      if target
+        IOHelpers.close(target) unless target.closed?
+        @mutex.synchronize { @targets.delete(target) }
+      end
+    end
+  end
+end