anytls 0.1.0

data/lib/anytls/session_pool.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 独占租用会话，优先复用创建序号最新的空闲会话。
+  # 正在创建的会话计入容量；空闲保留策略不会主动拨号补齐。
+  class SessionPool
+    def initialize(max_sessions: 128, min_idle_sessions: 5, idle_timeout: 30, idle_check_interval: 30, reuse: true,
+                   &factory)
+      raise ArgumentError, "session factory required" unless factory
+      unless max_sessions.is_a?(Integer) && max_sessions.positive?
+        raise ConfigurationError,
+              "max_sessions must be positive"
+      end
+      unless min_idle_sessions.is_a?(Integer) && min_idle_sessions >= 0
+        raise ConfigurationError, "min_idle_sessions must be nonnegative"
+      end
+
+      [idle_timeout, idle_check_interval].each do |seconds|
+        Deadline.new(seconds)
+        raise ConfigurationError, "idle periods must be positive" unless seconds&.positive?
+      end
+      raise ConfigurationError, "reuse must be boolean" unless [true, false].include?(reuse)
+
+      @max_sessions = max_sessions
+      @min_idle_sessions = min_idle_sessions
+      @idle_timeout = idle_timeout
+      @interval = idle_check_interval
+      @reuse = reuse
+      @factory = factory
+      @mutex = Mutex.new
+      @changed = ConditionVariable.new
+      @sessions = {}
+      @idle = {}
+      @creating = 0
+      @sequence = 0
+      @closed = false
+    end
+
+    # 锁内预留容量，锁外拨号。池关闭后，
+    # 迟到的创建结果会被拒绝并关闭，不会交给租用者。
+    def acquire(timeout: 5)
+      deadline = Deadline.new(timeout)
+      sequence = @mutex.synchronize do
+        start_maintenance
+        loop do
+          raise ClosedError, "client closed" if @closed
+
+          if @reuse && !@idle.empty?
+            session = @idle.keys.max_by(&:sequence)
+            @idle.delete(session)
+            if session.closed?
+              @sessions.delete(session)
+              next
+            end
+            @sessions[session] = :leased
+            return session
+          end
+          if @sessions.size + @creating < @max_sessions
+            @creating += 1
+            @sequence += 1
+            break @sequence
+          end
+          deadline.wait(@changed, @mutex)
+        end
+      end
+
+      session = nil
+      begin
+        session = @factory.call(sequence, deadline.remaining)
+        @mutex.synchronize do
+          raise ClosedError, "client closed during dial" if @closed || session.closed?
+
+          @sessions[session] = :leased
+        end
+        session
+      rescue StandardError
+        session&.close
+        raise
+      ensure
+        @mutex.synchronize do
+          @creating -= 1
+          @changed.broadcast
+        end
+      end
+    end
+
+    # 会话已无流时归还；需要丢弃的会话在锁外关闭，
+    # 以便其所有者回调安全地从池中移除会话。
+    def release(session)
+      discard = @mutex.synchronize do
+        if @closed || !@reuse || session.closed?
+          @sessions.delete(session)
+          @idle.delete(session)
+          true
+        elsif @sessions.key?(session)
+          @sessions[session] = :idle
+          @idle[session] = Deadline.now
+          false
+        end
+      ensure
+        @changed.broadcast
+      end
+      session.close(wait: false) if discard
+    end
+
+    def remove(session)
+      @mutex.synchronize do
+        @sessions.delete(session)
+        @idle.delete(session)
+        @changed.broadcast
+      end
+    end
+
+    def stats
+      @mutex.synchronize do
+        { sessions: @sessions.size, idle_sessions: @idle.size, creating_sessions: @creating,
+          created_sessions: @sequence }.freeze
+      end
+    end
+
+    def close
+      sessions = @mutex.synchronize do
+        @closed = true
+        @changed.broadcast
+        result = @sessions.keys
+        @sessions.clear
+        @idle.clear
+        result
+      end
+      sessions.each { |session| session.close(wait: false) }
+      sessions.each(&:close)
+      @maintenance&.join unless @maintenance == Thread.current
+      @mutex.synchronize { @changed.wait(@mutex) while @creating.positive? }
+      nil
+    end
+
+    private
+
+    def start_maintenance
+      return if @maintenance || !@reuse || @closed
+
+      @maintenance = Thread.new do
+        loop do
+          expired = @mutex.synchronize do
+            @changed.wait(@mutex, @interval) unless @closed
+            break if @closed
+
+            retained = @idle.keys.sort_by { |session| -session.sequence }.first(@min_idle_sessions)
+            result = @idle.filter_map do |session, since|
+              session if !retained.include?(session) && Deadline.now - since >= @idle_timeout
+            end
+            result.each do |session|
+              @idle.delete(session)
+              @sessions.delete(session)
+            end
+            result
+          end
+          break unless expired
+
+          expired.each(&:close)
+        end
+      end
+      @maintenance.name = "anytls-pool"
+    end
+  end
+end

data/lib/anytls/stream.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 虚拟字节流，不暴露共享 TLS 文件描述符，也不冒充真实 IO。
+  # 写入串行执行并分帧；成功写入仅确认本地传输完成，
+  # FIN 同时关闭该虚拟流的两个方向。
+  class Stream
+    attr_reader :id
+
+    def initialize(session, id, receive_limit: 262_144)
+      @session = session
+      @id = id
+      @buffer = ByteBuffer.new(limit: receive_limit)
+      @mutex = Mutex.new
+      @changed = ConditionVariable.new
+      @closed = false
+      @writing = false
+      @connection_status = :unconfirmed
+    end
+
+    def connection_status
+      @mutex.synchronize { @connection_status }
+    end
+
+    def closed?
+      @mutex.synchronize { @closed }
+    end
+
+    def inspect
+      "#<#{self.class} id=#{id} closed=#{closed?}>"
+    end
+
+    def readpartial(length, outbuf = nil, timeout: nil)
+      result = @buffer.readpartial(length, deadline: Deadline.new(timeout))
+      outbuf ? outbuf.replace(result) : result
+    rescue EOFError
+      outbuf&.clear
+      raise
+    end
+
+    def read(length, outbuf = nil, timeout: nil)
+      raise ArgumentError, "length must be nonnegative" unless length.is_a?(Integer) && length >= 0
+
+      deadline = Deadline.new(timeout)
+      result = String.new(encoding: Encoding::BINARY)
+      begin
+        result << @buffer.readpartial(length - result.bytesize, deadline: deadline) while result.bytesize < length
+      rescue EOFError
+        if result.empty? && length.positive?
+          outbuf&.clear
+          return nil
+        end
+      end
+      outbuf ? outbuf.replace(result) : result
+    end
+
+    def write(bytes, timeout: nil)
+      raise TypeError, "write expects a String" unless bytes.is_a?(String)
+
+      deadline = Deadline.new(timeout)
+      acquire_writer(deadline)
+      begin
+        offset = 0
+        while offset < bytes.bytesize
+          ensure_open!
+          chunk = bytes.byteslice(offset, 16_384).b.freeze
+          @session.write_stream(id, chunk, deadline: deadline)
+          offset += chunk.bytesize
+        end
+        offset
+      ensure
+        @mutex.synchronize do
+          @writing = false
+          @changed.broadcast
+        end
+      end
+    end
+
+    def flush
+      self
+    end
+
+    def close
+      return nil if closed?
+
+      @session.close_stream(id)
+      nil
+    end
+
+    # 等待目标连接的 SYNACK，并非认证回执；v1 对端无法确认目标，
+    # 因此等待会持续到超时或流关闭。
+    def wait_connected(timeout: 5)
+      deadline = Deadline.new(timeout)
+      @mutex.synchronize do
+        deadline.wait(@changed, @mutex) while @connection_status == :unconfirmed && !@closed
+        raise @terminal_error if @terminal_error
+        raise ClosedError, "stream closed" if @closed
+
+        @connection_status
+      end
+    end
+
+    def buffered_bytes
+      @buffer.size
+    end
+
+    # 由会话驱动的操作；这些方法不得回调应用代码。
+    def receive(bytes)
+      @buffer.push(bytes)
+    end
+
+    def confirm
+      @mutex.synchronize do
+        @connection_status = :confirmed unless @closed
+        @changed.broadcast
+      end
+    end
+
+    def finish(error = nil, local: false)
+      @mutex.synchronize do
+        return if @closed
+
+        @closed = true
+        @terminal_error = error
+        @connection_status = :failed if error
+        @changed.broadcast
+      end
+      @buffer.finish(error, discard: local)
+    end
+
+    private
+
+    def ensure_open!
+      @mutex.synchronize do
+        raise @terminal_error if @terminal_error
+        raise ClosedError, "stream closed" if @closed
+      end
+    end
+
+    def acquire_writer(deadline)
+      @mutex.synchronize do
+        deadline.wait(@changed, @mutex) while @writing && !@closed
+        raise @terminal_error if @terminal_error
+        raise ClosedError, "stream closed" if @closed
+
+        deadline.check!
+        @writing = true
+      end
+    end
+  end
+end

data/lib/anytls/tls_config.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  # 在 socket 使用前构建并冻结 TLS 上下文；客户端验证证书链，
+  # 传输层校验对端名称，自签名证书必须显式启用。
+  class TLSConfig
+    attr_reader :sni, :insecure, :context
+
+    def initialize(server: false, cert: nil, key: nil, ca_file: nil, sni: nil, insecure: false,
+                   self_signed: false, min_version: nil, max_version: nil)
+      [server, insecure, self_signed].each do |value|
+        raise ConfigurationError, "TLS flags must be boolean" unless [true, false].include?(value)
+      end
+      if self_signed && (cert || key)
+        raise ConfigurationError,
+              "self-signed and certificate files are mutually exclusive"
+      end
+      raise ConfigurationError, "certificate and key must be supplied together" if cert.nil? != key.nil?
+      raise ConfigurationError, "server certificate and key are required" if server && !self_signed && !cert
+      raise ConfigurationError, "self-signed is a server option" if self_signed && !server
+
+      Address.new(host: sni, port: 0) unless sni.nil?
+
+      @sni = sni&.dup&.freeze
+      @insecure = insecure
+      @context = OpenSSL::SSL::SSLContext.new
+      if server
+        @context.cert, @context.key, chain = self_signed ? generate_certificate : load_certificate(cert, key)
+        @context.extra_chain_cert = chain if chain&.any?
+        unless @context.cert.check_private_key(@context.key)
+          raise ConfigurationError,
+                "certificate does not match private key"
+        end
+      else
+        # 显式 CA 必须在 set_params 前设置，避免加载到进程共享的默认信任库。
+        @context.ca_file = ca_file if ca_file
+        @context.set_params(verify_mode: insecure ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER)
+        # 显式使用 IP 作为 SNI 配置时，发送的 SNI 与证书验证名称有所区别。
+        @context.verify_hostname = false
+      end
+      @context.min_version = min_version || OpenSSL::SSL::TLS1_2_VERSION
+      @context.max_version = max_version if max_version
+      @context.freeze
+      freeze
+    end
+
+    def inspect
+      "#<#{self.class} insecure=#{insecure}>"
+    end
+
+    private
+
+    def load_certificate(cert, key)
+      certificates = cert.is_a?(OpenSSL::X509::Certificate) ? [cert] : OpenSSL::X509::Certificate.load_file(cert)
+      private_key = key.respond_to?(:private?) ? key : OpenSSL::PKey.read(File.binread(key))
+      [certificates.first, private_key, certificates.drop(1)]
+    end
+
+    def generate_certificate
+      key = OpenSSL::PKey::EC.generate("prime256v1")
+      certificate = OpenSSL::X509::Certificate.new
+      certificate.version = 2
+      certificate.serial = SecureRandom.random_number(2**128)
+      certificate.subject = certificate.issuer = OpenSSL::X509::Name.parse("/CN=localhost")
+      certificate.public_key = key
+      certificate.not_before = Time.now - 60
+      certificate.not_after = Time.now + (86_400 * 30)
+      factory = OpenSSL::X509::ExtensionFactory.new
+      factory.subject_certificate = factory.issuer_certificate = certificate
+      certificate.add_extension(factory.create_extension("basicConstraints", "CA:TRUE", true))
+      certificate.add_extension(factory.create_extension("subjectAltName", "DNS:localhost,IP:127.0.0.1,IP:::1"))
+      certificate.sign(key, OpenSSL::Digest.new("SHA256"))
+      [certificate, key]
+    end
+  end
+end

data/lib/anytls/transport/tls_connection.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+module AnyTLS
+  module Transport
+    # 只有 Session 所有者线程可调用 TLS 方法；待重试的 SSL 写入
+    # 在 WANT_READ/WANT_WRITE 重试期间保持完全相同的字节和长度。
+    class TLSConnection
+      attr_reader :io, :write_wait
+
+      def initialize(socket, config:, server:, host: nil, cancel_io: nil, cancelled: nil)
+        @io = socket
+        @config = config
+        @server = server
+        @cancel_io = cancel_io
+        @cancelled = cancelled
+        @verification_name = config.sni || host
+        @ssl = OpenSSL::SSL::SSLSocket.new(socket, config.context)
+        @ssl.sync_close = true
+        @ssl.hostname = @verification_name if !server && @verification_name && !ip_literal?(@verification_name)
+      end
+
+      def handshake(timeout: 5)
+        deadline = Deadline.new(timeout)
+        loop do
+          raise ClosedError, "TLS setup cancelled" if @cancelled&.call
+
+          deadline.check!
+          result = @server ? @ssl.accept_nonblock(exception: false) : @ssl.connect_nonblock(exception: false)
+          break unless result.is_a?(Symbol)
+
+          wait_for_io(result, deadline)
+        end
+        @ssl.post_connection_check(@verification_name) unless @server || @config.insecure
+      end
+
+      def authenticate(password_digest, scheme:, timeout: 5)
+        if @server
+          Protocol::Authentication.read(self, password_digest: password_digest, timeout: timeout)
+        else
+          IOHelpers.write_all(self, Protocol::Authentication.encode(password_digest, scheme: scheme), timeout: timeout)
+        end
+      end
+
+      def read_nonblock(length, exception: false)
+        @ssl.read_nonblock(length, exception: exception)
+      end
+
+      def write_nonblock(bytes, exception: false)
+        @ssl.write_nonblock(bytes, exception: exception)
+      end
+
+      def wait_for_io(direction, deadline)
+        deadline.check!
+        raise ClosedError, "TLS setup cancelled" if @cancelled&.call
+
+        readers = @cancel_io ? [@cancel_io] : []
+        readers << @io if direction == :wait_readable
+        writers = direction == :wait_writable ? [@io] : []
+        ready = IO.select(readers, writers, nil, deadline.remaining)
+        raise ClosedError, "TLS setup cancelled" if @cancelled&.call
+        raise TimeoutError, "TLS setup timed out" unless ready
+
+        nil
+      end
+
+      def pending
+        @ssl.pending
+      end
+
+      def inspect
+        "#<#{self.class} role=#{@server ? 'server' : 'client'}>"
+      end
+
+      def begin_write(bytes)
+        raise ProtocolError, "overlapping TLS writes" if @write_buffer
+
+        @write_buffer = bytes
+        @write_wait = nil
+      end
+
+      def advance_write
+        result = @ssl.write_nonblock(@write_buffer, exception: false)
+        if result.is_a?(Symbol)
+          @write_wait = result
+          return result
+        end
+        raise TransportError, "TLS write made no progress" unless result.positive?
+
+        @write_wait = nil
+        if result == @write_buffer.bytesize
+          @write_buffer = nil
+          :complete
+        else
+          @write_buffer = @write_buffer.byteslice(result..)
+          :progress
+        end
+      end
+
+      def close
+        # 失败写入仍占有 SSL 重试状态时，不执行阻塞式 TLS 关闭握手。
+        @io.close unless @io.closed?
+        @ssl.sysclose
+      rescue IOError, SystemCallError, OpenSSL::SSL::SSLError
+        nil
+      end
+
+      private
+
+      def ip_literal?(host)
+        IPAddr.new(host)
+        true
+      rescue IPAddr::InvalidAddressError
+        false
+      end
+    end
+  end
+end

data/lib/anytls/uot/connection.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module AnyTLS
+  # UDP-over-TCP v2 消息定界；地址类型标记与 SOCKS 地址格式不同。
+  module UoT
+    MAGIC_HOST = "sp.v2.udp-over-tcp.arpa"
+
+    # 在字节流上提供数据包接口，读取和写入分别串行化。
+    # 数据包部分传输失败时关闭流，防止从错误的消息边界继续解析。
+    class Connection
+      # 线协议长度上限；操作系统可能施加更低的 UDP 大小限制。
+      MAX_PACKET_SIZE = 65_535
+      attr_reader :destination
+
+      def initialize(stream, destination: nil, client: true, timeout: nil)
+        @stream = stream
+        @destination = destination
+        @write_gate = Queue.new
+        @read_gate = Queue.new
+        @write_gate << true
+        @read_gate << true
+        if client
+          target = destination || Address.new(host: "0.0.0.0", port: 0)
+          request = [destination ? 1 : 0].pack("C") + Protocol::SocksAddress.encode(target)
+          IOHelpers.write_all(stream, request, timeout: timeout)
+        end
+      rescue StandardError
+        stream.close unless stream.closed?
+        raise
+      end
+
+      def self.accept(stream, timeout: nil)
+        deadline = Deadline.new(timeout)
+        mode = IOHelpers.read_exact(stream, 1, timeout: deadline.remaining).unpack1("C")
+        raise ProtocolError, "invalid UoT mode" unless [0, 1].include?(mode)
+
+        destination = Protocol::SocksAddress.read(stream, timeout: deadline.remaining)
+        new(stream, destination: mode == 1 ? destination : nil, client: false)
+      end
+
+      def send_packet(payload, destination: nil, timeout: nil)
+        deadline = Deadline.new(timeout)
+        payload = String(payload).b
+        raise BufferLimitExceeded, "UDP payload exceeds #{MAX_PACKET_SIZE} bytes" if payload.bytesize > MAX_PACKET_SIZE
+
+        target = destination || @destination
+        raise ArgumentError, "destination is required" unless target
+        if @destination && (target.host != @destination.host || target.port != @destination.port)
+          raise ArgumentError, "connected UoT destination cannot change"
+        end
+
+        bytes = @destination ? +"".b : encode_address(target)
+        bytes << [payload.bytesize].pack("n") << payload
+        with_gate(@write_gate, deadline) { IOHelpers.write_all(@stream, bytes, timeout: deadline.remaining) }
+        payload.bytesize
+      end
+
+      def receive_packet(timeout: nil)
+        deadline = Deadline.new(timeout)
+        with_gate(@read_gate, deadline) do
+          destination = @destination || read_address(deadline)
+          length = IOHelpers.read_exact(@stream, 2, timeout: deadline.remaining).unpack1("n")
+          raise BufferLimitExceeded, "UDP payload exceeds #{MAX_PACKET_SIZE} bytes" if length > MAX_PACKET_SIZE
+
+          [IOHelpers.read_exact(@stream, length, timeout: deadline.remaining), destination]
+        end
+      end
+
+      def close
+        IOHelpers.close(@stream) unless @stream.closed?
+      end
+
+      def closed? = @stream.closed?
+
+      private
+
+      def with_gate(gate, deadline)
+        deadline.check!
+        acquired = gate.pop(timeout: deadline.remaining)
+        raise TimeoutError, "datagram operation timed out waiting for another operation" unless acquired
+        raise ClosedError, "datagram connection closed" if closed?
+
+        begin
+          yield
+        rescue Error, IOError, SystemCallError
+          # 部分数据包无法从原消息边界恢复传输。
+          close
+          raise
+        end
+      ensure
+        gate << true if acquired
+      end
+
+      def encode_address(address)
+        encoded = Protocol::SocksAddress.encode(address).dup
+        encoded.setbyte(0, { 1 => 0, 4 => 1, 3 => 2 }.fetch(encoded.getbyte(0)))
+        encoded
+      end
+
+      def read_address(deadline)
+        type = IOHelpers.read_exact(@stream, 1, timeout: deadline.remaining).unpack1("C")
+        host = case type
+               when 0 then IPAddr.ntop(IOHelpers.read_exact(@stream, 4, timeout: deadline.remaining))
+               when 1 then IPAddr.ntop(IOHelpers.read_exact(@stream, 16, timeout: deadline.remaining))
+               when 2
+                 size = IOHelpers.read_exact(@stream, 1, timeout: deadline.remaining).unpack1("C")
+                 raise ProtocolError, "empty UoT domain" if size.zero?
+
+                 IOHelpers.read_exact(@stream, size, timeout: deadline.remaining)
+               else
+                 raise ProtocolError, "invalid UoT address type"
+               end
+        port = IOHelpers.read_exact(@stream, 2, timeout: deadline.remaining).unpack1("n")
+        Address.new(host: host, port: port)
+      rescue ArgumentError => error
+        raise ProtocolError, "invalid UoT address", cause: error
+      end
+    end
+  end
+end