girl 0.86.0 → 0.90.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48f438a56f35bb4fd0fbb76e57f08b5ea1a6e8890b8a2b7542881b1f69e89461
-  data.tar.gz: 8ad2943b900e91f8a6e29306fe29249d467374f738261daadaaa429961370206
+  metadata.gz: 2e1916068595360e4ab83189c93759e2c6ed05979d4a4128ff83f95390e91dce
+  data.tar.gz: 9f39d67731002186f66f04e4bb463834980a243fc0d6322b5e35f749fa356f95
 SHA512:
-  metadata.gz: 98512a3678ebde91bff827995447765c57c558f885313d05ecd8c831e85354a9ea81beb5ff038c18787b1bd0c15fe88317b85a3b6e84458a5709bcf59b027fff
-  data.tar.gz: 263aff6f7b79025d5404f6b6e4a68b01dfa899df0af4556b0085f72e9bb3227d6423be77e3c1cd12445fb1c9727c426be9750a9f7cea72d112b72c59702917a7
+  metadata.gz: 18e61543e05ae79c31ee76a8504cfcfef1271aa1419430ae667b46c8291dcc790630aa1123bc662ce817117a26b68ac343f5c7679134a3205548f32ba28cfb31
+  data.tar.gz: 797fa163ab50c3ace753ac833381bdeb040876c12de7d2b5570dbe0f3a799a91b18fa220ca5ea4ecbc8cfad69aabbd1dd245ad1bcd404b92423020890f5d38d1

data/lib/girl/head.rb

@@ -1,18 +1,12 @@
 module Girl
-  PACK_SIZE             = 1328             # 包大小 1400(console MTU) - 8(PPPoE header) - 40(IPv6 header) - 8(UDP header) - 8(pack id) - 8(src id) = 1328
-  CHUNK_SIZE            = PACK_SIZE * 1000 # 块大小
-  WBUFFS_LIMIT          = 1000             # 写前上限，超过上限结一个块
-  WMEMS_LIMIT           = 100_000          # 写后上限，达到上限暂停写
-  RESUME_BELOW          = 50_000           # 降到多少以下恢复写
-  EXPIRE_NEW            = 10               # 创建之后多久没有流量进来，过期
-  EXPIRE_AFTER          = 300              # 多久没有新流量，过期
-  CHECK_EXPIRE_INTERVAL = 30               # 检查过期间隔
-  CHECK_STATUS_INTERVAL = 0.5              # 发送状态间隔
-  SEND_STATUS_UNTIL     = 10               # 持续的告之对面状态，直到没有流量往来，持续多少秒
-  MISS_RANGE_LIMIT      = 500              # miss段上限，达到上限忽略要后面的段
-  RESENDING_LIMIT       = 5000             # 重传队列上限
-  CONFUSE_UNTIL         = 5                # 混淆前几个包
-  RESOLV_CACHE_EXPIRE   = 300              # dns查询结果缓存多久过期
+  READ_SIZE             = 1024 * 1024       # 一次读多少
+  WBUFF_LIMIT           = 100 * 1024 * 1024 # 写前上限，超过上限暂停读src/dst
+  RESUME_BELOW          = WBUFF_LIMIT / 2   # 降到多少以下恢复读
+  SEND_HELLO_COUNT      = 10                # hello最多发几次
+  EXPIRE_AFTER          = 300               # 多久没有新流量，过期
+  CHECK_EXPIRE_INTERVAL = 30                # 检查过期间隔
+  CHECK_RESUME_INTERVAL = 1                 # 检查恢复读间隔
+  RESOLV_CACHE_EXPIRE   = 300               # dns查询结果缓存多久过期
   TUND_PORT             = 1
   HEARTBEAT             = 2
   A_NEW_SOURCE          = 3
@@ -27,6 +21,11 @@ module Girl
   TUND_FIN              = 12
   TUN_FIN               = 13
   IP_CHANGED            = 14
+  SINGLE_MISS           = 15
+  RANGE_MISS            = 16
+  CONTINUE              = 17
+  IS_RESEND_READY       = 18
+  RESEND_READY          = 19
   HTTP_OK               = "HTTP/1.1 200 OK\r\n\r\n"
   # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
   RESERVED_ROUTE = <<EOF
@@ -38,4 +37,14 @@ module Girl
 192.168.0.0/16
 255.255.255.255/32
 EOF
+  CONSTS = %w[
+    READ_SIZE
+    WBUFF_LIMIT
+    RESUME_BELOW
+    SEND_HELLO_COUNT
+    EXPIRE_AFTER
+    CHECK_EXPIRE_INTERVAL
+    CHECK_RESUME_INTERVAL
+    RESOLV_CACHE_EXPIRE
+  ]
 end

data/lib/girl/proxy.rb

@@ -7,66 +7,45 @@ require 'ipaddr'
 require 'json'
 require 'socket'
 
-##
+=begin
 # Girl::Proxy - 代理服务，近端。
-#
-# 包结构
-# ======
-#
-# tun-proxyd:
-#
-# hello
-#
-# proxyd-tun:
-#
-# Q>: 0 ctlmsg -> C: 1 tund port -> n: tund port
-#
-# tun-tund:
-#
-# Q>: 0 ctlmsg -> C: 2 heartbeat     -> C: random char
-#                    3 a new source  -> Q>: src id -> encoded destination address
-#                    4 paired        -> Q>: src id -> n: dst port
-#                    5 dest status   -> n: dst port -> Q>: biggest relayed dst pack id -> Q>: continue src pack id
-#                    6 source status -> Q>: src id -> Q>: biggest relayed src pack id -> Q>: continue dst pack id
-#                    7 miss          -> Q>/n: src id / dst port -> Q>: pack id begin -> Q>:  pack id end
-#                    8 fin1          -> Q>/n: src id / dst port -> Q>: biggest src pack id / biggest dst pack id -> Q>: continue dst pack id / continue src pack id
-#                    9 not use
-#                   10 fin2          -> Q>/n: src id / dst port
-#                   11 not use
-#                   12 tund fin
-#                   13 tun fin
-#                   14 tun ip changed
-#
-# Q>: 1+ pack_id -> Q>/n: src id / dst port -> traffic
-#
-# close logic
-# ===========
-#
-# 1-1. after close src -> dst closed ? no -> send fin1
-# 1-2. tun recv fin2 -> del src ext
-#
-# 2-1. tun recv fin1 -> all traffic received ? -> close src after write
-# 2-2. tun recv traffic -> dst closed and all traffic received ? -> close src after write
-# 2-3. after close src -> dst closed ? yes -> del src ext -> send fin2
-#
-# 3-1. after close dst -> src closed ? no -> send fin1
-# 3-2. tund recv fin2 -> del dst ext
-#
-# 4-1. tund recv fin1 -> all traffic received ? -> close dst after write
-# 4-2. tund recv traffic -> src closed and all traffic received ? -> close dst after write
-# 4-3. after close dst -> src closed ? yes -> del dst ext -> send fin2
-#
+
+## 包结构
+
+tun-proxyd:
+
+hello
+
+proxyd-tun:
+
+Q>: 0 ctlmsg -> C: 1 tund port -> n: tund port -> n: tcpd port
+
+tun-tund:
+
+Q>: 0 ctlmsg -> C: 2 heartbeat       [not use]
+                   3 a new source    -> Q>: src id -> encoded destination address
+                   4 paired          -> Q>: src id -> n: dst id
+                   5 dest status     [not use]
+                   6 source status   [not use]
+                   7 miss            [not use]
+                   8 fin1            [not use]
+                   9 confirm fin1    [not use]
+                  10 fin2            [not use]
+                  11 confirm fin2    [not use]
+                  12 tund fin
+                  13 tun fin
+                  14 tun ip changed
+=end
+
 module Girl
   class Proxy
 
     def initialize( config_path = nil )
-      unless config_path
+      unless config_path then
         config_path = File.expand_path( '../girl.conf.json', __FILE__ )
       end
 
-      unless File.exist?( config_path )
-        raise "missing config file #{ config_path }"
-      end
+      raise "missing config file #{ config_path }" unless File.exist?( config_path )
 
       # {
       #     "proxy_port": 6666,                   // 代理服务，近端（本地）端口
@@ -74,8 +53,6 @@ module Girl
       #     "proxyd_port": 6060,                  // 代理服务，远端端口
       #     "direct_path": "girl.direct.txt",     // 直连ip段
       #     "remote_path": "girl.remote.txt",     // 交给远端解析的域名列表
-      #     "proxy_tmp_dir": "/tmp/girl.proxy",   // 近端缓存根路径
-      #     "proxyd_tmp_dir": "/tmp/girl.proxyd", // 远端缓存根路径
       #     "im": "girl",                         // 标识，用来识别近端
       #     "worker_count": 4                     // 子进程数，默认取cpu个数
       # }
@@ -85,75 +62,40 @@ module Girl
       proxyd_port = conf[ :proxyd_port ]
       direct_path = conf[ :direct_path ]
       remote_path = conf[ :remote_path ]
-      proxy_tmp_dir = conf[ :proxy_tmp_dir ]
       im = conf[ :im ]
       worker_count = conf[ :worker_count ]
 
-      unless proxy_port
+      unless proxy_port then
         proxy_port = 6666
       end
 
-      unless proxyd_host
-        raise "missing proxyd host"
-      end
+      raise "missing proxyd host" unless proxyd_host
 
-      unless proxyd_port
+      unless proxyd_port then
         proxyd_port = 6060
       end
 
       directs = []
 
-      if direct_path
-        unless File.exist?( direct_path )
-          raise "not found direct file #{ direct_path }"
-        end
-
-        directs = ( RESERVED_ROUTE.split( "\n" ) + IO.binread( direct_path ).split( "\n" ) ).map { | line | IPAddr.new( line.strip ) }
+      if direct_path then
+        raise "not found direct file #{ direct_path }" unless File.exist?( direct_path )
+        directs = ( RESERVED_ROUTE.split( "\n" ) + IO.binread( direct_path ).split( "\n" ) ).map{ | line | IPAddr.new( line.strip ) }
       end
 
       remotes = []
 
-      if remote_path
-        unless File.exist?( remote_path )
-          raise "not found remote file #{ remote_path }"
-        end
-
-        remotes = IO.binread( remote_path ).split( "\n" ).map { | line | line.strip }
+      if remote_path then
+        raise "not found remote file #{ remote_path }" unless File.exist?( remote_path )
+        remotes = IO.binread( remote_path ).split( "\n" ).map{ | line | line.strip }
       end
 
-      unless proxy_tmp_dir
-        proxy_tmp_dir = '/tmp/girl.proxy'
-      end
-
-      unless File.exist?( proxy_tmp_dir )
-        Dir.mkdir( proxy_tmp_dir )
-      end
-
-      src_chunk_dir = File.join( proxy_tmp_dir, 'src.chunk' )
-
-      unless Dir.exist?( src_chunk_dir )
-        Dir.mkdir( src_chunk_dir )
-      end
-
-      dst_chunk_dir = File.join( proxy_tmp_dir, 'dst.chunk' )
-
-      unless Dir.exist?( dst_chunk_dir )
-        Dir.mkdir( dst_chunk_dir )
-      end
-
-      tun_chunk_dir = File.join( proxy_tmp_dir, 'tun.chunk' )
-
-      unless Dir.exist?( tun_chunk_dir )
-        Dir.mkdir( tun_chunk_dir )
-      end
-
-      unless im
+      unless im then
         im = 'girl'
       end
 
       nprocessors = Etc.nprocessors
 
-      if worker_count.nil? || worker_count <= 0 || worker_count > nprocessors
+      if worker_count.nil? || worker_count <= 0 || worker_count > nprocessors then
         worker_count = nprocessors
       end
 
@@ -164,43 +106,23 @@ module Girl
       puts "proxyd port #{ proxyd_port }"
       puts "#{ direct_path } #{ directs.size } directs"
       puts "#{ remote_path } #{ remotes.size } remotes"
-      puts "src chunk dir #{ src_chunk_dir }"
-      puts "dst chunk dir #{ dst_chunk_dir }"
-      puts "tun chunk dir #{ tun_chunk_dir }"
       puts "im #{ im }"
       puts "worker count #{ worker_count }"
 
-      names = %w[
-        PACK_SIZE
-        CHUNK_SIZE
-        WBUFFS_LIMIT
-        WMEMS_LIMIT
-        RESUME_BELOW
-        EXPIRE_NEW
-        EXPIRE_AFTER
-        CHECK_EXPIRE_INTERVAL
-        CHECK_STATUS_INTERVAL
-        SEND_STATUS_UNTIL
-        MISS_RANGE_LIMIT
-        RESENDING_LIMIT
-        CONFUSE_UNTIL
-        RESOLV_CACHE_EXPIRE
-      ]
-
-      len = names.map{ | name | name.size }.max
-
-      names.each do | name |
+      len = CONSTS.map{ | name | name.size }.max
+
+      CONSTS.each do | name |
         puts "#{ name.gsub( '_', ' ' ).ljust( len ) } #{ Girl.const_get( name ) }"
       end
 
-      if RUBY_PLATFORM.include?( 'linux' )
+      if RUBY_PLATFORM.include?( 'linux' ) then
         $0 = title
         workers = []
 
         worker_count.times do | i |
           workers << fork do
             $0 = 'girl proxy worker'
-            worker = Girl::ProxyWorker.new( proxy_port, proxyd_host, proxyd_port, directs, remotes, src_chunk_dir, dst_chunk_dir, tun_chunk_dir, im )
+            worker = Girl::ProxyWorker.new( proxy_port, proxyd_host, proxyd_port, directs, remotes, im )
 
             Signal.trap( :TERM ) do
               puts "w#{ i } exit"
@@ -224,7 +146,7 @@ module Girl
 
         Process.waitall
       else
-        Girl::ProxyWorker.new( proxy_port, proxyd_host, proxyd_port, directs, remotes, src_chunk_dir, dst_chunk_dir, tun_chunk_dir, im ).looping
+        Girl::ProxyWorker.new( proxy_port, proxyd_host, proxyd_port, directs, remotes, im ).looping
       end
     end
 

data/lib/girl/proxy_worker.rb

@@ -4,21 +4,19 @@ module Girl
     ##
     # initialize
     #
-    def initialize( proxy_port, proxyd_host, proxyd_port, directs, remotes, src_chunk_dir, dst_chunk_dir, tun_chunk_dir, im )
+    def initialize( proxy_port, proxyd_host, proxyd_port, directs, remotes, im )
       @proxyd_host = proxyd_host
       @proxyd_addr = Socket.sockaddr_in( proxyd_port, proxyd_host )
       @directs = directs
       @remotes = remotes
-      @src_chunk_dir = src_chunk_dir
-      @dst_chunk_dir = dst_chunk_dir
-      @tun_chunk_dir = tun_chunk_dir
       @custom = Girl::ProxyCustom.new( im )
       @mutex = Mutex.new
       @reads = []
       @writes = []
-      @roles = {}         # sock => :dotr / :proxy / :src / :dst / :tun
+      @roles = {}         # sock => :dotr / :proxy / :src / :dst / :tun / :stream
       @src_infos = {}     # src => {}
       @dst_infos = {}     # dst => {}
+      @stream_infos = {}  # stream => {}
       @resolv_caches = {} # domain => [ ip, created_at ]
 
       dotr, dotw = IO.pipe
@@ -33,36 +31,40 @@ module Girl
     def looping
       puts "p#{ Process.pid } #{ Time.new } looping"
       loop_check_expire
-      loop_check_status
+      loop_check_resume
 
       loop do
         rs, ws = IO.select( @reads, @writes )
 
         @mutex.synchronize do
-          # 先写，再读
-          ws.each do | sock |
-            case @roles[ sock ]
-            when :src
-              write_src( sock )
-            when :dst
-              write_dst( sock )
-            when :tun
-              write_tun( sock )
-            end
-          end
-
+          # 先读，再写，避免打上关闭标记后读到
           rs.each do | sock |
             case @roles[ sock ]
-            when :dotr
+            when :dotr then
               read_dotr( sock )
-            when :proxy
+            when :proxy then
               read_proxy( sock )
-            when :src
+            when :tun then
+              read_tun( sock )
+            when :src then
               read_src( sock )
-            when :dst
+            when :dst then
               read_dst( sock )
-            when :tun
-              read_tun( sock )
+            when :stream then
+              read_stream( sock )
+            end
+          end
+
+          ws.each do | sock |
+            case @roles[ sock ]
+            when :tun then
+              write_tun( sock )
+            when :src then
+              write_src( sock )
+            when :dst then
+              write_dst( sock )
+            when :stream then
+              write_stream( sock )
             end
           end
         end
@@ -76,7 +78,7 @@ module Girl
     # quit!
     #
     def quit!
-      if @tun && !@tun.closed? && @tun_info[ :tund_addr ]
+      if @tun && !@tun.closed? && @tun_info[ :tund_addr ] then
         # puts "debug1 send tun fin"
         data = [ 0, TUN_FIN ].pack( 'Q>C' )
         @tun.sendmsg( data, 0, @tun_info[ :tund_addr ] )
@@ -89,175 +91,223 @@ module Girl
     private
 
     ##
-    # loop check expire
+    # add ctlmsg
     #
-    def loop_check_expire
-      Thread.new do
-        loop do
-          sleep CHECK_EXPIRE_INTERVAL
-
-          @mutex.synchronize do
-            need_trigger = false
-            now = Time.new
-
-            if @tun && !@tun.closed?
-              is_expired = @tun_info[ :last_recv_at ] ? ( now - @tun_info[ :last_recv_at ] > EXPIRE_AFTER ) : ( now - @tun_info[ :created_at ] > EXPIRE_NEW )
-
-              if is_expired
-                puts "p#{ Process.pid } #{ Time.new } expire tun"
-                set_is_closing( @tun )
-              else
-                data = [ 0, HEARTBEAT, rand( 128 ) ].pack( 'Q>CC' )
-                # puts "debug1 #{ Time.new } heartbeat"
-                add_tun_ctlmsg( data )
-
-                @tun_info[ :src_exts ].each do | src_id, src_ext |
-                  if src_ext[ :src ].closed? && ( now - src_ext[ :last_continue_at ] > EXPIRE_AFTER )
-                    puts "p#{ Process.pid } #{ Time.new } expire src ext #{ src_ext[ :destination_domain ] }"
-                    del_src_ext( src_id )
-                  end
-                end
-              end
-
-              need_trigger = true
-            end
+    def add_ctlmsg( data, to_addr = nil )
+      unless to_addr then
+        to_addr = @tun_info[ :tund_addr ]
+      end
 
-            @src_infos.each do | src, src_info |
-              if now - src_info[ :last_continue_at ] > EXPIRE_AFTER
-                puts "p#{ Process.pid } #{ Time.new } expire src #{ src_info[ :destination_domain ] }"
-                set_is_closing( src )
-                need_trigger = true
-              end
-            end
+      if to_addr then
+        @tun_info[ :ctlmsgs ] << [ data, to_addr ]
+        add_write( @tun )
+      end
+    end
 
-            @dst_infos.each do | dst, dst_info |
-              if now - dst_info[ :last_continue_at ] > EXPIRE_AFTER
-                puts "p#{ Process.pid } #{ Time.new } expire dst #{ dst_info[ :domain ] }"
-                set_is_closing( dst )
-                need_trigger = true
-              end
-            end
+    ##
+    # add read
+    #
+    def add_read( sock, role = nil )
+      unless @reads.include?( sock ) then
+        @reads << sock
 
-            if need_trigger
-              next_tick
-            end
-          end
+        if role then
+          @roles[ sock ] = role
         end
       end
     end
 
     ##
-    # loop check status
+    # add src wbuff
     #
-    def loop_check_status
-      Thread.new do
-        loop do
-          sleep CHECK_STATUS_INTERVAL
-
-          @mutex.synchronize do
-            if @tun && !@tun.closed? && @tun_info[ :tund_addr ]
-              need_trigger = false
-
-              if @tun_info[ :src_exts ].any?
-                now = Time.new
-
-                @tun_info[ :src_exts ].each do | src_id, src_ext |
-                  if src_ext[ :dst_port ] && ( now - src_ext[ :last_continue_at ] < SEND_STATUS_UNTIL )
-                    data = [ 0, SOURCE_STATUS, src_id, src_ext[ :relay_pack_id ], src_ext[ :continue_dst_pack_id ] ].pack( 'Q>CQ>Q>Q>' )
-                    add_tun_ctlmsg( data )
-                    need_trigger = true
-                  end
-                end
-              end
+    def add_src_wbuff( src, data )
+      return if src.closed?
+      src_info = @src_infos[ src ]
+      src_info[ :wbuff ] << data
+      add_write( src )
+      src_info[ :last_recv_at ] = Time.new
+    end
 
-              if @tun_info[ :paused ] && ( @tun_info[ :src_exts ].map{ | _, src_ext | src_ext[ :wmems ].size }.sum < RESUME_BELOW )
-                puts "p#{ Process.pid } #{ Time.new } resume tun"
-                @tun_info[ :paused ] = false
-                add_write( @tun )
-                need_trigger = true
-              end
+    ##
+    # add src wbuff socks5 conn reply
+    #
+    def add_src_wbuff_socks5_conn_reply( src )
+      # +----+-----+-------+------+----------+----------+
+      # |VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
+      # +----+-----+-------+------+----------+----------+
+      # | 1  |  1  | X'00' |  1   | Variable |    2     |
+      # +----+-----+-------+------+----------+----------+
+      proxy_ip, proxy_port = @proxy_local_address.ip_unpack
+      data = [ [ 5, 0, 0, 1 ].pack( 'C4' ), IPAddr.new( proxy_ip ).hton, [ proxy_port ].pack( 'n' ) ].join
+      # puts "debug1 add src wbuff socks5 conn reply #{ data.inspect }"
+      add_src_wbuff( src, data )
+    end
 
-              if need_trigger
-                next_tick
-              end
-            end
-          end
-        end
+    ##
+    # add write
+    #
+    def add_write( sock )
+      unless @writes.include?( sock ) then
+        @writes << sock
       end
     end
 
     ##
-    # loop send a new source
+    # close sock
     #
-    def loop_send_a_new_source( src_ext, data )
-      Thread.new do
-        EXPIRE_NEW.times do
-          if src_ext[ :src ].closed? || src_ext[ :dst_port ]
-            # puts "debug1 break loop send a new source #{ src_ext[ :dst_port ] }"
-            break
-          end
+    def close_sock( sock )
+      sock.close
+      @reads.delete( sock )
+      @writes.delete( sock )
+      @roles.delete( sock )
+    end
 
-          @mutex.synchronize do
-            # puts "debug1 send a new source #{ data.inspect }"
-            add_tun_ctlmsg( data )
-            next_tick
-          end
+    ##
+    # close dst
+    #
+    def close_dst( dst )
+      # puts "debug1 close dst"
+      close_sock( dst )
+      @dst_infos.delete( dst )
+    end
 
-          sleep 1
-        end
+    ##
+    # close read src
+    #
+    def close_read_src( src )
+      return if src.closed?
+      # puts "debug1 close read src"
+      src.close_read
+      @reads.delete( src )
+
+      if src.closed? then
+        # puts "debug1 delete src info"
+        @roles.delete( src )
+        src_info = del_src_info( src )
+      else
+        src_info = @src_infos[ src ]
       end
+
+      src_info[ :paused ] = false
+      src_info
     end
 
     ##
-    # resolve domain
+    # close read dst
     #
-    def resolve_domain( src, domain )
-      if @remotes.any? { | remote | ( domain.size >= remote.size ) && ( domain[ ( remote.size * -1 )..-1 ] == remote ) }
-        # puts "debug1 #{ domain } hit remotes"
-        new_a_src_ext( src )
-        return
+    def close_read_dst( dst )
+      return if dst.closed?
+      # puts "debug1 close read dst"
+      dst.close_read
+      @reads.delete( dst )
+
+      if dst.closed? then
+        # puts "debug1 delete dst info"
+        @roles.delete( dst )
+        dst_info = @dst_infos.delete( dst )
+      else
+        dst_info = @dst_infos[ dst ]
       end
 
-      resolv_cache = @resolv_caches[ domain ]
+      dst_info
+    end
 
-      if resolv_cache
-        ip_info, created_at = resolv_cache
+    ##
+    # close read stream
+    #
+    def close_read_stream( stream )
+      return if stream.closed?
+      # puts "debug1 close read stream"
+      stream.close_read
+      @reads.delete( stream )
+
+      if stream.closed? then
+        # puts "debug1 delete stream info"
+        @roles.delete( stream )
+        stream_info = @stream_infos.delete( stream )
+      else
+        stream_info = @stream_infos[ stream ]
+      end
 
-        if Time.new - created_at < RESOLV_CACHE_EXPIRE
-          # puts "debug1 #{ domain } hit resolv cache #{ ip_info.inspect }"
-          deal_with_destination_ip( src, ip_info )
-          return
-        end
+      stream_info
+    end
 
-        # puts "debug1 expire #{ domain } resolv cache"
-        @resolv_caches.delete( domain )
-      end
+    ##
+    # close src
+    #
+    def close_src( src )
+      # puts "debug1 close src"
+      close_sock( src )
+      del_src_info( src )
+    end
 
-      src_info = @src_infos[ src ]
-      src_info[ :proxy_type ] = :checking
+    ##
+    # close tun
+    #
+    def close_tun( tun )
+      # puts "debug1 close tun"
+      close_sock( tun )
+      @tun_info[ :srcs ].each{ | _, src | set_src_closing( src ) }
+    end
 
-      Thread.new do
-        begin
-          ip_info = Addrinfo.ip( domain )
-        rescue Exception => e
-          puts "p#{ Process.pid } #{ Time.new } resolv #{ domain } #{ e.class }"
-        end
+    ##
+    # close write src
+    #
+    def close_write_src( src )
+      return if src.closed?
+      # puts "debug1 close write src"
+      src.close_write
+      @writes.delete( src )
+
+      if src.closed? then
+        # puts "debug1 delete src info"
+        @roles.delete( src )
+        src_info = del_src_info( src )
+      else
+        src_info = @src_infos[ src ]
+      end
 
-        @mutex.synchronize do
-          if ip_info
-            @resolv_caches[ domain ] = [ ip_info, Time.new ]
+      src_info
+    end
 
-            unless src.closed?
-              puts "p#{ Process.pid } #{ Time.new } resolved #{ domain } #{ ip_info.ip_address }"
-              deal_with_destination_ip( src, ip_info )
-            end
-          else
-            set_is_closing( src )
-          end
+    ##
+    # close write dst
+    #
+    def close_write_dst( dst )
+      return if dst.closed?
+      # puts "debug1 close write dst"
+      dst.close_write
+      @writes.delete( dst )
+
+      if dst.closed? then
+        # puts "debug1 delete dst info"
+        @roles.delete( dst )
+        dst_info = @dst_infos.delete( dst )
+      else
+        dst_info = @dst_infos[ dst ]
+      end
 
-          next_tick
-        end
+      dst_info
+    end
+
+    ##
+    # close write stream
+    #
+    def close_write_stream( stream )
+      return if stream.closed?
+      # puts "debug1 close write stream"
+      stream.close_write
+      @writes.delete( stream )
+
+      if stream.closed? then
+        # puts "debug1 delete stream info"
+        @roles.delete( stream )
+        stream_info = @stream_infos.delete( stream )
+      else
+        stream_info = @stream_infos[ stream ]
       end
+
+      stream_info
     end
 
     ##
@@ -266,468 +316,313 @@ module Girl
     def deal_with_destination_ip( src, ip_info )
       src_info = @src_infos[ src ]
 
-      if ( @directs.any? { | direct | direct.include?( ip_info.ip_address ) } ) || ( ( src_info[ :destination_domain ] == @proxyd_host ) && ![ 80, 443 ].include?( src_info[ :destination_port ] ) )
+      if ( @directs.any? { | direct | direct.include?( ip_info.ip_address ) } ) || ( ( src_info[ :destination_domain ] == @proxyd_host ) && ![ 80, 443 ].include?( src_info[ :destination_port ] ) ) then
         # ip命中直连列表，或者访问远端非80/443端口，直连
         # puts "debug1 #{ ip_info.inspect } hit directs"
         new_a_dst( src, ip_info )
       else
         # 走远端
-        new_a_src_ext( src )
+        # puts "debug1 #{ ip_info.inspect } go tunnel"
+        set_src_proxy_type_tunnel( src )
       end
     end
 
     ##
-    # new a proxy
+    # del src info
     #
-    def new_a_proxy( proxy_port )
-      proxy = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
-      proxy.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEADDR, 1 )
+    def del_src_info( src )
+      src_info = @src_infos.delete( src )
 
-      if RUBY_PLATFORM.include?( 'linux' )
-        proxy.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEPORT, 1 )
-        proxy.setsockopt( Socket::SOL_TCP, Socket::TCP_NODELAY, 1 )
+      if src_info[ :stream ] && @tun && !@tun.closed? then
+        @tun_info[ :srcs ].delete( src_info[ :id ] )
       end
 
-      proxy.bind( Socket.sockaddr_in( proxy_port, '0.0.0.0' ) )
-      proxy.listen( 511 )
-      puts "p#{ Process.pid } #{ Time.new } proxy listen on #{ proxy_port }"
-      add_read( proxy, :proxy )
-      @proxy_local_address = proxy.local_address
-    end
-
-    ##
-    # new a tun
-    #
-    def new_a_tun
-      tun = Socket.new( Socket::AF_INET, Socket::SOCK_DGRAM, 0 )
-      tun.bind( Socket.sockaddr_in( 0, '0.0.0.0' ) )
-      port = tun.local_address.ip_port
-      tun_info = {
-        port: port,           # 端口
-        ctlmsg_rbuffs: [],    # 还没配上tund，暂存的ctlmsg
-        ctlmsgs: [],          # [ to_addr, data ]
-        wbuffs: [],           # 写前缓存 [ src_id, pack_id, data ]
-        caches: [],           # 块读出缓存 [ src_id, pack_id, data ]
-        chunks: [],           # 块队列 filename
-        spring: 0,            # 块后缀，结块时，如果块队列不为空，则自增，为空，则置为0
-        tund_addr: nil,       # tund地址
-        src_exts: {},         # src额外信息 src_id => {}
-        src_ids: {},          # dst_port => src_id
-        paused: false,        # 是否暂停写
-        resendings: [],       # 重传队列 [ src_id, pack_id ]
-        created_at: Time.new, # 创建时间
-        last_recv_at: nil,    # 上一次收到流量的时间，过期关闭
-        is_closing: false     # 是否准备关闭
-      }
-
-      @tun = tun
-      @tun_info = tun_info
-
-      add_read( tun, :tun )
-      data = @custom.hello
-      puts "p#{ Process.pid } #{ Time.new } hello i'm tun"
-      # puts "debug1 #{ data.inspect }"
-      add_tun_ctlmsg( data, @proxyd_addr )
+      src_info
     end
 
     ##
-    # new a dst
+    # loop check expire
     #
-    def new_a_dst( src, ip_info )
-      src_info = @src_infos[ src ]
-      domain = src_info[ :destination_domain ]
-      destination_addr = Socket.sockaddr_in( src_info[ :destination_port ], ip_info.ip_address )
-      dst = Socket.new( ip_info.ipv4? ? Socket::AF_INET : Socket::AF_INET6, Socket::SOCK_STREAM, 0 )
+    def loop_check_expire
+      Thread.new do
+        loop do
+          sleep CHECK_EXPIRE_INTERVAL
 
-      if RUBY_PLATFORM.include?( 'linux' )
-        dst.setsockopt( Socket::SOL_TCP, Socket::TCP_NODELAY, 1 )
-      end
+          @mutex.synchronize do
+            trigger = false
+            now = Time.new
 
-      begin
-        dst.connect_nonblock( destination_addr )
-      rescue IO::WaitWritable
-        # connect nonblock 必抛 wait writable，这里仅仅接一下，逻辑写外面，整齐
-      rescue Exception => e
-        puts "p#{ Process.pid } #{ Time.new } connect destination #{ e.class }, close src"
-        set_is_closing( src )
-        return
-      end
+            if @tun && !@tun.closed? then
+              last_recv_at = @tun_info[ :last_recv_at ] || @tun_info[ :created_at ]
+              last_sent_at = @tun_info[ :last_sent_at ] || @tun_info[ :created_at ]
 
-      # puts "debug1 a new dst #{ dst.local_address.inspect }"
-      local_port = dst.local_address.ip_port
-      @dst_infos[ dst ] = {
-        local_port: local_port,     # 本地端口
-        src: src,                   # 对应src
-        domain: domain,             # 域名
-        wbuff: '',                  # 写前
-        cache: '',                  # 块读出缓存
-        chunks: [],                 # 块队列，写前达到块大小时结一个块 filename
-        spring: 0,                  # 块后缀，结块时，如果块队列不为空，则自增，为空，则置为0
-        last_continue_at: Time.new, # 上一次发生流量的时间
-        is_closing: false           # 是否准备关闭
-      }
+              if @tun_info[ :srcs ].empty? && ( now - last_recv_at >= EXPIRE_AFTER ) && ( now - last_sent_at >= EXPIRE_AFTER ) then
+                puts "p#{ Process.pid } #{ Time.new } expire tun"
+                set_tun_closing
+                trigger = true
+              end
+            end
 
-      add_read( dst, :dst )
-      src_info[ :proxy_type ] = :direct
-      src_info[ :dst ] = dst
+            @src_infos.each do | src, src_info |
+              last_recv_at = src_info[ :last_recv_at ] || src_info[ :created_at ]
+              last_sent_at = src_info[ :last_sent_at ] || src_info[ :created_at ]
 
-      if src_info[ :proxy_proto ] == :http
-        if src_info[ :is_connect ]
-          # puts "debug1 add src wbuff http ok"
-          add_src_wbuff( src, HTTP_OK )
-        else
-          # puts "debug1 add src rbuffs to dst wbuff"
+              if ( now - last_recv_at >= EXPIRE_AFTER ) && ( now - last_sent_at >= EXPIRE_AFTER ) then
+                puts "p#{ Process.pid } #{ Time.new } expire src #{ src_info[ :destination_domain ] }"
+                set_src_closing( src )
+                trigger = true
+              end
+            end
 
-          src_info[ :rbuffs ].each do | _, data |
-            add_dst_wbuff( dst, data )
+            next_tick if trigger
           end
         end
-      elsif src_info[ :proxy_proto ] == :socks5
-        add_src_wbuff_socks5_conn_reply( src )
       end
     end
 
     ##
-    # new a src ext
+    # loop check resume
     #
-    def new_a_src_ext( src )
-      if @tun.nil? || @tun.closed?
-        new_a_tun
-      end
+    def loop_check_resume
+      Thread.new do
+        loop do
+          sleep CHECK_RESUME_INTERVAL
 
-      src_info = @src_infos[ src ]
-      src_id = src_info[ :id ]
-      destination_port = src_info[ :destination_port ]
-      destination_domain = src_info[ :destination_domain ]
-
-      src_ext = {
-        src: src,                               # src
-        dst_port: nil,                          # 远端dst端口
-        destination_domain: destination_domain, # 目的地域名
-        wmems: {},                              # 写后 pack_id => data
-        send_ats: {},                           # 上一次发出时间 pack_id => send_at
-        relay_pack_id: 0,                       # 转发到几
-        continue_dst_pack_id: 0,                # 收到几
-        pieces: {},                             # 跳号包 dst_pack_id => data
-        is_dst_closed: false,                   # dst是否已关闭
-        biggest_dst_pack_id: 0,                 # dst最大包号码
-        completed_pack_id: 0,                   # 完成到几（对面收到几）
-        last_continue_at: Time.new              # 上一次发生流量的时间
-      }
+          @mutex.synchronize do
+            trigger = false
 
-      @tun_info[ :src_exts ][ src_id ] = src_ext
-      src_info[ :proxy_type ] = :tunnel
-
-      destination_domain_port = [ destination_domain, destination_port ].join( ':' )
-      data = [ [ 0, A_NEW_SOURCE, src_id ].pack( 'Q>CQ>' ), @custom.encode( destination_domain_port ) ].join
-      loop_send_a_new_source( src_ext, data )
-    end
-
-    ##
-    # add src wbuff socks5 conn reply
-    #
-    def add_src_wbuff_socks5_conn_reply( src )
-      # +----+-----+-------+------+----------+----------+
-      # |VER | REP |  RSV  | ATYP | BND.ADDR | BND.PORT |
-      # +----+-----+-------+------+----------+----------+
-      # | 1  |  1  | X'00' |  1   | Variable |    2     |
-      # +----+-----+-------+------+----------+----------+
-      proxy_ip, proxy_port = @proxy_local_address.ip_unpack
-      data = [ [ 5, 0, 0, 1 ].pack( 'C4' ), IPAddr.new( proxy_ip ).hton, [ proxy_port ].pack( 'n' ) ].join
-      # puts "debug1 add src wbuff socks5 conn reply #{ data.inspect }"
-      add_src_wbuff( src, data )
-    end
+            @src_infos.select{ | _, src_info | src_info[ :paused ] }.each do | src, src_info |
+              dst = src_info[ :dst ]
 
-    ##
-    # sub http request
-    #
-    def sub_http_request( data )
-      lines = data.split( "\r\n" )
+              if dst then
+                dst_info = @dst_infos[ dst ]
 
-      if lines.empty?
-        return [ data, nil ]
-      end
+                if dst_info[ :wbuff ].size < RESUME_BELOW then
+                  puts "p#{ Process.pid } #{ Time.new } dst.wbuff below #{ RESUME_BELOW }, resume src #{ src_info[ :destination_domain ] }"
+                  resume_src( src )
+                  trigger = true
+                end
+              else
+                stream = src_info[ :stream ]
+                stream_info = @stream_infos[ stream ]
 
-      method, url, proto = lines.first.split( ' ' )
+                if stream_info[ :wbuff ].size < RESUME_BELOW then
+                  puts "p#{ Process.pid } #{ Time.new } stream.wbuff below #{ RESUME_BELOW }, resume src #{ src_info[ :destination_domain ] }"
+                  resume_src( src )
+                  trigger = true
+                end
+              end
+            end
 
-      if proto && url && proto[ 0, 4 ] == 'HTTP' && url[ 0, 7 ] == 'http://'
-        domain_and_port = url.split( '/' )[ 2 ]
-        data = data.sub( "http://#{ domain_and_port }", '' )
-        # puts "debug1 subed #{ data.inspect } #{ domain_and_port }"
+            next_tick if trigger
+          end
+        end
       end
-
-      [ data, domain_and_port ]
     end
 
     ##
-    # add tun ctlmsg
+    # loop send a new source
     #
-    def add_tun_ctlmsg( data, to_addr = nil )
-      unless to_addr
-        to_addr = @tun_info[ :tund_addr ]
-      end
+    def loop_send_a_new_source( src )
+      src_info = @src_infos[ src ]
 
-      if to_addr
-        @tun_info[ :ctlmsgs ] << [ to_addr, data ]
-        add_write( @tun )
-      else
-        @tun_info[ :ctlmsg_rbuffs ] << data
-      end
-    end
+      if src_info then
+        destination_domain = src_info[ :destination_domain ]
+        destination_port = src_info[ :destination_port ]
+        domain_port = [ destination_domain, destination_port ].join( ':' )
+        data = [ [ 0, A_NEW_SOURCE, src_info[ :id ] ].pack( 'Q>CQ>' ), @custom.encode( domain_port ) ].join
+
+        Thread.new do
+          SEND_HELLO_COUNT.times do | i |
+            if @tun.nil? || @tun.closed? || src.closed? || src_info[ :stream ] then
+              # puts "debug1 break loop send a new source #{ src_info[ :dst_port ] }"
+              break
+            end
 
-    ##
-    # add tun wbuff
-    #
-    def add_tun_wbuff( src_id, pack_id, data )
-      @tun_info[ :wbuffs ] << [ src_id, pack_id, data ]
+            @mutex.synchronize do
+              if i >= 1 then
+                puts "p#{ Process.pid } #{ Time.new } resend a new source #{ domain_port } #{ i }"
+              end
 
-      if @tun_info[ :wbuffs ].size >= WBUFFS_LIMIT
-        spring = @tun_info[ :chunks ].size > 0 ? ( @tun_info[ :spring ] + 1 ) : 0
-        filename = "#{ Process.pid }-#{ @tun_info[ :port ] }.#{ spring }"
-        chunk_path = File.join( @tun_chunk_dir, filename )
-        datas = @tun_info[ :wbuffs ].map{ | _src_id, _pack_id, _data | [ [ _src_id, _pack_id, _data.bytesize ].pack( 'Q>Q>n' ), _data ].join }
+              add_ctlmsg( data )
+              next_tick
+            end
 
-        begin
-          IO.binwrite( chunk_path, datas.join )
-        rescue Errno::ENOSPC => e
-          puts "p#{ Process.pid } #{ Time.new } #{ e.class }, close tun"
-          set_is_closing( @tun )
-          return
+            sleep 1
+          end
         end
-
-        @tun_info[ :chunks ] << filename
-        @tun_info[ :spring ] = spring
-        @tun_info[ :wbuffs ].clear
       end
-
-      add_write( @tun )
     end
 
     ##
-    # add src wbuff
+    # new a dst
     #
-    def add_src_wbuff( src, data )
+    def new_a_dst( src, ip_info )
       src_info = @src_infos[ src ]
-      src_info[ :wbuff ] << data
-
-      if src_info[ :wbuff ].bytesize >= CHUNK_SIZE
-        spring = src_info[ :chunks ].size > 0 ? ( src_info[ :spring ] + 1 ) : 0
-        filename = "#{ Process.pid }-#{ src_info[ :id ] }.#{ spring }"
-        chunk_path = File.join( @src_chunk_dir, filename )
-
-        begin
-          IO.binwrite( chunk_path, src_info[ :wbuff ] )
-        rescue Errno::ENOSPC => e
-          puts "p#{ Process.pid } #{ Time.new } #{ e.class }, close src"
-          set_is_closing( src )
-          return
-        end
+      domain = src_info[ :destination_domain ]
+      destination_addr = Socket.sockaddr_in( src_info[ :destination_port ], ip_info.ip_address )
+      dst = Socket.new( ip_info.ipv4? ? Socket::AF_INET : Socket::AF_INET6, Socket::SOCK_STREAM, 0 )
+      dst.setsockopt( Socket::SOL_TCP, Socket::TCP_NODELAY, 1 ) if RUBY_PLATFORM.include?( 'linux' )
 
-        src_info[ :chunks ] << filename
-        src_info[ :spring ] = spring
-        src_info[ :wbuff ].clear
+      begin
+        dst.connect_nonblock( destination_addr )
+      rescue IO::WaitWritable
+        # connect nonblock 必抛 wait writable
+      rescue Exception => e
+        puts "p#{ Process.pid } #{ Time.new } dst connect destination #{ e.class }, close src"
+        set_src_closing( src )
+        return
       end
 
-      add_write( src )
-    end
-
-    ##
-    # add dst wbuff
-    #
-    def add_dst_wbuff( dst, data )
-      dst_info = @dst_infos[ dst ]
-      dst_info[ :wbuff ] << data
+      # puts "debug1 a new dst #{ dst.local_address.inspect }"
+      local_port = dst.local_address.ip_port
+      dst_info = {
+        local_port: local_port, # 本地端口
+        src: src,               # 对应src
+        domain: domain,         # 域名
+        wbuff: '',              # 写前，从src读到的流量
+        closing: false,         # 准备关闭
+        closing_read: false,    # 准备关闭读
+        closing_write: false    # 准备关闭写
+      }
 
-      if dst_info[ :wbuff ].bytesize >= CHUNK_SIZE
-        spring = dst_info[ :chunks ].size > 0 ? ( dst_info[ :spring ] + 1 ) : 0
-        filename = "#{ Process.pid }-#{ dst_info[ :local_port ] }.#{ spring }"
-        chunk_path = File.join( @dst_chunk_dir, filename )
+      @dst_infos[ dst ] = dst_info
+      add_read( dst, :dst )
+      src_info[ :proxy_type ] = :direct
+      src_info[ :dst ] = dst
 
-        begin
-          IO.binwrite( chunk_path, dst_info[ :wbuff ] )
-        rescue Errno::ENOSPC => e
-          puts "p#{ Process.pid } #{ Time.new } #{ e.class }, close dst"
-          set_is_closing( dst )
-          return
+      if src_info[ :proxy_proto ] == :http then
+        if src_info[ :is_connect ] then
+          # puts "debug1 add src.wbuff http ok"
+          add_src_wbuff( src, HTTP_OK )
+        elsif src_info[ :rbuff ] then
+          # puts "debug1 move src.rbuff to dst.wbuff"
+          dst_info[ :wbuff ] << src_info[ :rbuff ]
+          add_write( dst )
         end
-
-        dst_info[ :chunks ] << filename
-        dst_info[ :spring ] = spring
-        dst_info[ :wbuff ].clear
+      elsif src_info[ :proxy_proto ] == :socks5 then
+        add_src_wbuff_socks5_conn_reply( src )
       end
-
-      add_write( dst )
     end
 
     ##
-    # add read
+    # new a stream
     #
-    def add_read( sock, role )
-      unless @reads.include?( sock )
-        @reads << sock
-      end
+    def new_a_stream( src_id, dst_id )
+      src = @tun_info[ :srcs ][ src_id ]
+      return if src.nil? || src.closed?
 
-      @roles[ sock ] = role
-    end
+      src_info = @src_infos[ src ]
+      return if src_info[ :dst_id ]
 
-    ##
-    # add write
-    #
-    def add_write( sock )
-      if sock && !sock.closed? && !@writes.include?( sock )
-        @writes << sock
+      if dst_id == 0 then
+        puts "p#{ Process.pid } #{ Time.new } remote dst already closed"
+        set_src_closing( src )
+        return
       end
-    end
 
-    ##
-    # set is closing
-    #
-    def set_is_closing( sock )
-      if sock && !sock.closed?
-        role = @roles[ sock ]
-        # puts "debug1 set #{ role.to_s } is closing"
-
-        case role
-        when :src
-          src_info = @src_infos[ sock ]
-          src_info[ :is_closing ] = true
-        when :dst
-          dst_info = @dst_infos[ sock ]
-          dst_info[ :is_closing ] = true
-        when :tun
-          @tun_info[ :is_closing ] = true
-        end
+      stream = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
+      stream.setsockopt( Socket::SOL_TCP, Socket::TCP_NODELAY, 1 ) if RUBY_PLATFORM.include?( 'linux' )
 
-        @reads.delete( sock )
-        add_write( sock )
-      end
-    end
-
-    ##
-    # send data
-    #
-    def send_data( tun, data, to_addr )
       begin
-        tun.sendmsg( data, 0, to_addr )
-      rescue IO::WaitWritable, Errno::EINTR
-        return false
-      rescue Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::ENETDOWN => e
-        puts "#{ Time.new } #{ e.class }, close tun"
-        close_tun( tun )
-        return false
+        stream.connect_nonblock( @tun_info[ :tcpd_addr ] )
+      rescue IO::WaitWritable
+      rescue Exception => e
+        puts "p#{ Process.pid } #{ Time.new } connect tcpd #{ e.class }"
+        return
       end
 
-      true
-    end
-
-    ##
-    # close src
-    #
-    def close_src( src )
-      # puts "debug1 close src"
-      close_sock( src )
-      src_info = @src_infos.delete( src )
+      # puts "debug1 set stream.wbuff #{ dst_id }"
+      data = [ dst_id ].pack( 'n' )
 
-      src_info[ :chunks ].each do | filename |
-        begin
-          File.delete( File.join( @src_chunk_dir, filename ) )
-        rescue Errno::ENOENT
-        end
+      unless src_info[ :rbuff ].empty? then
+        # puts "debug1 encode and move src.rbuff to stream.wbuff"
+        data << @custom.encode( src_info[ :rbuff ] )
       end
 
-      src_id = src_info[ :id ]
-
-      if src_info[ :proxy_type ] == :tunnel
-        return if @tun.closed?
+      @stream_infos[ stream ] = {
+        src: src,   # 对应src
+        wbuff: data # 写前，写往远端streamd
+      }
 
-        src_ext = @tun_info[ :src_exts ][ src_id ]
-        return if src_ext.nil? || src_ext[ :dst_port ].nil?
+      src_info[ :dst_id ] = dst_id
+      src_info[ :stream ] = stream
+      add_read( stream, :stream )
+      add_write( stream )
 
-        if src_ext[ :is_dst_closed ]
-          # puts "debug1 2-3. after close src -> dst closed ? yes -> del src ext -> send fin2"
-          del_src_ext( src_id )
-          data = [ 0, FIN2, src_id ].pack( 'Q>CQ>' )
-          add_tun_ctlmsg( data )
-        else
-          # puts "debug1 1-1. after close src -> dst closed ? no -> send fin1"
-          data = [ 0, FIN1, src_id, src_info[ :biggest_pack_id ], src_ext[ :continue_dst_pack_id ] ].pack( 'Q>CQ>Q>Q>' )
-          add_tun_ctlmsg( data )
+      if src_info[ :proxy_proto ] == :http then
+        if src_info[ :is_connect ] then
+          # puts "debug1 add src.wbuff http ok"
+          add_src_wbuff( src, HTTP_OK )
         end
-      elsif src_info[ :proxy_type ] == :direct
-        set_is_closing( src_info[ :dst ] )
+      elsif src_info[ :proxy_proto ] == :socks5 then
+        add_src_wbuff_socks5_conn_reply( src )
       end
     end
 
     ##
-    # close dst
+    # new a proxy
     #
-    def close_dst( dst )
-      # puts "debug1 close dst"
-      close_sock( dst )
-      dst_info = @dst_infos.delete( dst )
+    def new_a_proxy( proxy_port )
+      proxy = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
+      proxy.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEADDR, 1 )
 
-      dst_info[ :chunks ].each do | filename |
-        begin
-          File.delete( File.join( @dst_chunk_dir, filename ) )
-        rescue Errno::ENOENT
-        end
+      if RUBY_PLATFORM.include?( 'linux' ) then
+        proxy.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEPORT, 1 )
+        proxy.setsockopt( Socket::SOL_TCP, Socket::TCP_NODELAY, 1 )
       end
 
-      set_is_closing( dst_info[ :src ] )
+      proxy.bind( Socket.sockaddr_in( proxy_port, '0.0.0.0' ) )
+      proxy.listen( 127 )
+      puts "p#{ Process.pid } #{ Time.new } proxy listen on #{ proxy_port }"
+      add_read( proxy, :proxy )
+      @proxy_local_address = proxy.local_address
     end
 
     ##
-    # close tun
+    # new a tun
     #
-    def close_tun( tun )
-      # puts "debug1 close tun"
-      close_sock( tun )
+    def new_a_tun
+      tun = Socket.new( Socket::AF_INET, Socket::SOCK_DGRAM, 0 )
+      tun.bind( Socket.sockaddr_in( 0, '0.0.0.0' ) )
+      port = tun.local_address.ip_port
+      tun_info = {
+        port: port,           # 端口
+        pending_sources: [],  # 还没配上tund，暂存的src
+        ctlmsgs: [],          # [ ctlmsg, to_addr ]
+        tund_addr: nil,       # tund地址
+        tcpd_addr: nil,       # tcpd地址
+        srcs: {},             # src_id => src
+        created_at: Time.new, # 创建时间
+        last_recv_at: nil,    # 上一次收到流量的时间
+        last_sent_at: nil,    # 上一次发出流量的时间
+        closing: false        # 是否准备关闭
+      }
 
-      @tun_info[ :chunks ].each do | filename |
-        begin
-          File.delete( File.join( @tun_chunk_dir, filename ) )
-        rescue Errno::ENOENT
-        end
-      end
+      @tun = tun
+      @tun_info = tun_info
 
-      @tun_info[ :src_exts ].each{ | _, src_ext | set_is_closing( src_ext[ :src ] ) }
-    end
+      add_read( tun, :tun )
+      data = @custom.hello
 
-    ##
-    # close sock
-    #
-    def close_sock( sock )
-      sock.close
-      @reads.delete( sock )
-      @writes.delete( sock )
-      @roles.delete( sock )
-    end
+      Thread.new do
+        SEND_HELLO_COUNT.times do | i |
+          if @tun.nil? || @tun.closed? || @tun_info[ :tund_addr ] then
+            # puts "debug1 break loop send hello"
+            break
+          end
 
-    ##
-    # del src ext
-    #
-    def del_src_ext( src_id )
-      src_ext = @tun_info[ :src_exts ].delete( src_id )
+          @mutex.synchronize do
+            msg = i >= 1 ? "resend hello #{ i }" : "hello i'm tun"
+            puts "p#{ Process.pid } #{ Time.new } #{ msg }"
+            # puts "debug1 #{ data.inspect }"
 
-      if src_ext
-        @tun_info[ :src_ids ].delete( src_ext[ :dst_port ] )
-      end
-    end
+            add_ctlmsg( data, @proxyd_addr )
+            next_tick
+          end
 
-    ##
-    # release wmems
-    #
-    def release_wmems( src_ext, completed_pack_id )
-      if completed_pack_id > src_ext[ :completed_pack_id ]
-        # puts "debug2 update completed pack #{ completed_pack_id }"
-        pack_ids = src_ext[ :wmems ].keys.select { | pack_id | pack_id <= completed_pack_id }
-
-        pack_ids.each do | pack_id |
-          src_ext[ :wmems ].delete( pack_id )
-          src_ext[ :send_ats ].delete( pack_id )
+          sleep 1
         end
-
-        src_ext[ :completed_pack_id ] = completed_pack_id
       end
     end
 
@@ -739,213 +634,176 @@ module Girl
     end
 
     ##
-    # write src
+    # resolve domain
     #
-    def write_src( src )
-      src_info = @src_infos[ src ]
-      from, data = :cache, src_info[ :cache ]
-
-      if data.empty?
-        if src_info[ :chunks ].any?
-          path = File.join( @src_chunk_dir, src_info[ :chunks ].shift )
-
-          begin
-            data = src_info[ :cache ] = IO.binread( path )
-            File.delete( path )
-          rescue Errno::ENOENT => e
-            puts "p#{ Process.pid } #{ Time.new } read #{ path } #{ e.class }"
-            close_src( src )
-            return
-          end
-        else
-          from, data = :wbuff, src_info[ :wbuff ]
-        end
-      end
-
-      if data.empty?
-        if src_info[ :is_closing ]
-          close_src( src )
-        else
-          @writes.delete( src )
-        end
-
-        return
-      end
-
-      begin
-        written = src.write_nonblock( data )
-      rescue IO::WaitWritable, Errno::EINTR
-        return
-      rescue Exception => e
-        close_src( src )
+    def resolve_domain( src, domain )
+      if @remotes.any? { | remote | ( domain.size >= remote.size ) && ( domain[ ( remote.size * -1 )..-1 ] == remote ) } then
+        # puts "debug1 #{ domain } hit remotes"
+        set_src_proxy_type_tunnel( src )
         return
       end
 
-      # puts "debug2 write src #{ written }"
-      data = data[ written..-1 ]
-      src_info[ from ] = data
-      src_info[ :last_continue_at ] = Time.new
-    end
+      resolv_cache = @resolv_caches[ domain ]
 
-    ##
-    # write dst
-    #
-    def write_dst( dst )
-      dst_info = @dst_infos[ dst ]
-      from, data = :cache, dst_info[ :cache ]
-
-      if data.empty?
-        if dst_info[ :chunks ].any?
-          path = File.join( @dst_chunk_dir, dst_info[ :chunks ].shift )
-
-          begin
-            data = dst_info[ :cache ] = IO.binread( path )
-            File.delete( path )
-          rescue Errno::ENOENT => e
-            puts "p#{ Process.pid } #{ Time.new } read #{ path } #{ e.class }"
-            close_dst( dst )
-            return
-          end
-        else
-          from, data = :wbuff, dst_info[ :wbuff ]
-        end
-      end
+      if resolv_cache then
+        ip_info, created_at = resolv_cache
 
-      if data.empty?
-        if dst_info[ :is_closing ]
-          close_dst( dst )
-        else
-          @writes.delete( dst )
+        if Time.new - created_at < RESOLV_CACHE_EXPIRE then
+          # puts "debug1 #{ domain } hit resolv cache #{ ip_info.inspect }"
+          deal_with_destination_ip( src, ip_info )
+          return
         end
 
-        return
-      end
-
-      begin
-        written = dst.write_nonblock( data )
-      rescue IO::WaitWritable, Errno::EINTR
-        return
-      rescue Exception => e
-        # puts "debug1 write dst #{ e.class }"
-        close_dst( dst )
-        return
-      end
-
-      # puts "debug2 write dst #{ written }"
-      data = data[ written..-1 ]
-      dst_info[ from ] = data
-      dst_info[ :last_continue_at ] = Time.new
-    end
-
-    ##
-    # write tun
-    #
-    def write_tun( tun )
-      if @tun_info[ :is_closing ]
-        close_tun( tun )
-        return
+        # puts "debug1 expire #{ domain } resolv cache"
+        @resolv_caches.delete( domain )
       end
 
-      now = Time.new
-
-      # 传ctlmsg
-      while @tun_info[ :ctlmsgs ].any?
-        to_addr, data = @tun_info[ :ctlmsgs ].first
+      src_info = @src_infos[ src ]
+      src_info[ :proxy_type ] = :checking
 
-        unless send_data( tun, data, to_addr )
-          return
+      Thread.new do
+        begin
+          ip_info = Addrinfo.ip( domain )
+        rescue Exception => e
+          puts "p#{ Process.pid } #{ Time.new } resolv #{ domain } #{ e.class }"
         end
 
-        @tun_info[ :ctlmsgs ].shift
-      end
-
-      # 重传
-      while @tun_info[ :resendings ].any?
-        src_id, pack_id = @tun_info[ :resendings ].first
-        src_ext = @tun_info[ :src_exts ][ src_id ]
-
-        if src_ext
-          data = src_ext[ :wmems ][ pack_id ]
+        @mutex.synchronize do
+          if ip_info then
+            @resolv_caches[ domain ] = [ ip_info, Time.new ]
 
-          if data
-            unless send_data( tun, data, @tun_info[ :tund_addr ] )
-              return
+            unless src.closed? then
+              puts "p#{ Process.pid } #{ Time.new } resolved #{ domain } #{ ip_info.ip_address }"
+              deal_with_destination_ip( src, ip_info )
             end
-
-            src_ext[ :last_continue_at ] = now
+          else
+            set_src_closing( src )
           end
-        end
 
-        @tun_info[ :resendings ].shift
+          next_tick
+        end
       end
+    end
 
-      # 若写后达到上限，暂停取写前
-      if @tun_info[ :src_exts ].map{ | _, src_ext | src_ext[ :wmems ].size }.sum >= WMEMS_LIMIT
-        unless @tun_info[ :paused ]
-          puts "p#{ Process.pid } #{ Time.new } pause tun"
-          @tun_info[ :paused ] = true
-        end
+    ##
+    # resume src
+    #
+    def resume_src( src )
+      src_info = @src_infos[ src ]
+      src_info[ :paused ] = false
+      add_read( src )
+    end
 
-        @writes.delete( tun )
-        return
-      end
+    ##
+    # set dst closing
+    #
+    def set_dst_closing( dst )
+      return if dst.closed?
+      dst_info = @dst_infos[ dst ]
+      dst_info[ :closing ] = true
+      @reads.delete( dst )
+      add_write( dst )
+    end
+
+    ##
+    # set dst closing write
+    #
+    def set_dst_closing_write( dst )
+      return if dst.closed?
+      dst_info = @dst_infos[ dst ]
+      dst_info[ :closing_write ] = true
+      add_write( dst )
+    end
 
-      # 取写前
-      if @tun_info[ :caches ].any?
-        datas = @tun_info[ :caches ]
-      elsif @tun_info[ :chunks ].any?
-        path = File.join( @tun_chunk_dir, @tun_info[ :chunks ].shift )
+    ##
+    # set src is closing
+    #
+    def set_src_closing( src )
+      return if src.closed?
+      @reads.delete( src )
+      src_info = @src_infos[ src ]
+      src_info[ :closing ] = true
+      add_write( src )
+    end
 
-        begin
-          data = IO.binread( path )
-          File.delete( path )
-        rescue Errno::ENOENT => e
-          puts "p#{ Process.pid } #{ Time.new } read #{ path } #{ e.class }"
-          close_tun( tun )
-          return
-        end
+    ##
+    # set src closing write
+    #
+    def set_src_closing_write( src )
+      return if src.closed?
+      src_info = @src_infos[ src ]
+      src_info[ :closing_write ] = true
+      add_write( src )
+    end
 
-        caches = []
+    ##
+    # set src proxy type tunnel
+    #
+    def set_src_proxy_type_tunnel( src )
+      if @tun.nil? || @tun.closed? then
+        new_a_tun
+      end
 
-        until data.empty?
-          _src_id, _pack_id, pack_size = data[ 0, 18 ].unpack( 'Q>Q>n' )
-          caches << [ _src_id, _pack_id, data[ 18, pack_size ] ]
-          data = data[ ( 18 + pack_size )..-1 ]
-        end
+      src_info = @src_infos[ src ]
+      src_info[ :proxy_type ] = :tunnel
+      src_id = src_info[ :id ]
+      @tun_info[ :srcs ][ src_id ] = src
 
-        datas = @tun_info[ :caches ] = caches
-      elsif @tun_info[ :wbuffs ].any?
-        datas = @tun_info[ :wbuffs ]
+      if @tun_info[ :tund_addr ] then
+        loop_send_a_new_source( src )
       else
-        @writes.delete( tun )
-        return
+        @tun_info[ :pending_sources ] << src
       end
+    end
 
-      while datas.any?
-        src_id, pack_id, data = datas.first
-        src_ext = @tun_info[ :src_exts ][ src_id ]
+    ##
+    # set stream closing
+    #
+    def set_stream_closing( stream )
+      return if stream.closed?
+      stream_info = @stream_infos[ stream ]
+      stream_info[ :closing ] = true
+      @reads.delete( stream )
+      add_write( stream )
+    end
 
-        if src_ext
-          if pack_id <= CONFUSE_UNTIL
-            data = @custom.encode( data )
-            # puts "debug1 encoded pack #{ pack_id }"
-          end
+    ##
+    # set stream closing write
+    #
+    def set_stream_closing_write( stream )
+      return if stream.closed?
+      stream_info = @stream_infos[ stream ]
+      stream_info[ :closing_write ] = true
+      add_write( stream )
+    end
 
-          data = [ [ pack_id, src_id ].pack( 'Q>Q>' ), data ].join
+    ##
+    # set tun is closing
+    #
+    def set_tun_closing
+      return if @tun.closed?
+      @tun_info[ :closing ] = true
+      @reads.delete( @tun )
+      add_write( @tun )
+    end
 
-          unless send_data( tun, data, @tun_info[ :tund_addr ] )
-            return
-          end
+    ##
+    # sub http request
+    #
+    def sub_http_request( data )
+      lines = data.split( "\r\n" )
 
-          # puts "debug2 written pack #{ pack_id }"
-          src_ext[ :relay_pack_id ] = pack_id
-          src_ext[ :wmems ][ pack_id ] = data
-          src_ext[ :send_ats ][ pack_id ] = now
-          src_ext[ :last_continue_at ] = now
-        end
+      return [ data, nil ] if lines.empty?
+
+      method, url, proto = lines.first.split( ' ' )
 
-        datas.shift
+      if proto && url && proto[ 0, 4 ] == 'HTTP' && url[ 0, 7 ] == 'http://' then
+        domain_port = url.split( '/' )[ 2 ]
+        data = data.sub( "http://#{ domain_port }", '' )
+        # puts "debug1 subed #{ data.inspect } #{ domain_port }"
       end
+
+      [ data, domain_port ]
     end
 
     ##
@@ -962,64 +820,133 @@ module Girl
       begin
         src, addrinfo = proxy.accept_nonblock
       rescue IO::WaitReadable, Errno::EINTR
+        print 'r'
         return
       end
 
-      id = rand( ( 2 ** 64 ) - 2 ) + 1
-      # puts "debug1 accept a src #{ addrinfo.inspect } #{ id }"
+      src_id = rand( ( 2 ** 64 ) - 2 ) + 1
+      # puts "debug1 accept a src #{ addrinfo.inspect } #{ src_id }"
 
       @src_infos[ src ] = {
-        id: id,                     # id
-        proxy_proto: :uncheck,      # :uncheck / :http / :socks5
-        proxy_type: :uncheck,       # :uncheck / :checking / :direct / :tunnel / :negotiation
-        dst: nil,                   # :direct的场合，对应的dst
-        destination_domain: nil,    # 目的地域名
-        destination_port: nil,      # 目的地端口
-        biggest_pack_id: 0,         # 最大包号码
-        is_connect: true,           # 代理协议是http的场合，是否是CONNECT
-        rbuffs: [],                 # 非CONNECT，dst或者远端dst未准备好，暂存流量 [ pack_id, data ]
-        wbuff: '',                  # 写前
-        cache: '',                  # 块读出缓存
-        chunks: [],                 # 块队列，写前达到块大小时结一个块 filename
-        spring: 0,                  # 块后缀，结块时，如果块队列不为空，则自增，为空，则置为0
-        last_continue_at: Time.new, # 上一次发生流量的时间
-        is_closing: false           # 是否准备关闭
+        id: src_id,              # id
+        proxy_proto: :uncheck,   # :uncheck / :http / :socks5
+        proxy_type: :uncheck,    # :uncheck / :checking / :direct / :tunnel / :negotiation
+        destination_domain: nil, # 目的地域名
+        destination_port: nil,   # 目的地端口
+        is_connect: true,        # 代理协议是http的场合，是否是CONNECT
+        rbuff: '',               # 读到的流量
+        dst: nil,                # :direct的场合，对应的dst
+        stream: nil,             # :tunnel的场合，对应的stream
+        dst_id: nil,             # 远端dst id
+        wbuff: '',               # 从dst/stream读到的流量
+        created_at: Time.new,    # 创建时间
+        last_recv_at: nil,       # 上一次收到新流量（由dst收到，或者由stream收到）的时间
+        last_sent_at: nil,       # 上一次发出流量（由dst发出，或者由stream发出）的时间
+        paused: false,           # 是否已暂停
+        closing: false,          # 准备关闭
+        closing_read: false,     # 准备关闭读
+        closing_write: false     # 准备关闭写
       }
 
       add_read( src, :src )
     end
 
+    ##
+    # read tun
+    #
+    def read_tun( tun )
+      begin
+        data, addrinfo, rflags, *controls = tun.recvmsg_nonblock
+      rescue IO::WaitReadable, Errno::EINTR
+        print 'r'
+        return
+      end
+
+      from_addr = addrinfo.to_sockaddr
+      @tun_info[ :last_recv_at ] = Time.new
+      pack_id = data[ 0, 8 ].unpack( 'Q>' ).first
+      return if pack_id != 0
+
+      ctl_num = data[ 8 ].unpack( 'C' ).first
+
+      case ctl_num
+      when TUND_PORT then
+        return if ( from_addr != @proxyd_addr ) || @tun_info[ :tund_addr ]
+
+        tund_port, tcpd_port = data[ 9, 4 ].unpack( 'nn' )
+
+        puts "p#{ Process.pid } #{ Time.new } got tund port #{ tund_port }, #{ tcpd_port }"
+        @tun_info[ :tund_addr ] = Socket.sockaddr_in( tund_port, @proxyd_host )
+        @tun_info[ :tcpd_addr ] = Socket.sockaddr_in( tcpd_port, @proxyd_host )
+
+        if @tun_info[ :pending_sources ].any? then
+          puts "p#{ Process.pid } #{ Time.new } send pending sources"
+
+          @tun_info[ :pending_sources ].each do | src |
+            loop_send_a_new_source( src )
+          end
+
+          @tun_info[ :pending_sources ].clear
+        end
+      when PAIRED then
+        return if from_addr != @tun_info[ :tund_addr ]
+
+        src_id, dst_id = data[ 9, 10 ].unpack( 'Q>n' )
+
+        # puts "debug1 got paired #{ src_id } #{ dst_id }"
+        new_a_stream( src_id, dst_id )
+      when TUND_FIN then
+        return if from_addr != @tun_info[ :tund_addr ]
+
+        puts "p#{ Process.pid } #{ Time.new } recv tund fin"
+        set_tun_closing
+      when IP_CHANGED then
+        return if from_addr != @tun_info[ :tund_addr ]
+
+        puts "p#{ Process.pid } #{ Time.new } recv ip changed"
+        set_tun_closing
+      end
+    end
+
     ##
     # read src
     #
     def read_src( src )
       begin
-        data = src.read_nonblock( PACK_SIZE )
+        data = src.read_nonblock( READ_SIZE )
       rescue IO::WaitReadable, Errno::EINTR
+        print 'r'
         return
       rescue Exception => e
         # puts "debug1 read src #{ e.class }"
-        set_is_closing( src )
+        src_info = close_read_src( src )
+        dst = src_info[ :dst ]
+
+        if dst then
+          set_dst_closing_write( dst )
+        else
+          stream = src_info[ :stream ]
+          set_stream_closing_write( stream ) if stream
+        end
+
         return
       end
 
-      # puts "debug2 read src #{ data.inspect }"
       src_info = @src_infos[ src ]
-      src_info[ :last_continue_at ] = Time.new
       proxy_type = src_info[ :proxy_type ]
 
       case proxy_type
-      when :uncheck
-        if data[ 0, 7 ] == 'CONNECT'
+      when :uncheck then
+        if data[ 0, 7 ] == 'CONNECT' then
           # puts "debug1 CONNECT"
-          domain_and_port = data.split( "\r\n" )[ 0 ].split( ' ' )[ 1 ]
+          domain_port = data.split( "\r\n" )[ 0 ].split( ' ' )[ 1 ]
 
-          unless domain_and_port
+          unless domain_port then
             puts "p#{ Process.pid } #{ Time.new } CONNECT miss domain"
-            set_is_closing( src )
+            set_src_closing( src )
             return
           end
-        elsif data[ 0 ].unpack( 'C' ).first == 5
+        elsif data[ 0 ].unpack( 'C' ).first == 5 then
           # puts "debug1 socks5 #{ data.inspect }"
 
           # https://tools.ietf.org/html/rfc1928
@@ -1032,9 +959,9 @@ module Girl
           nmethods = data[ 1 ].unpack( 'C' ).first
           methods = data[ 2, nmethods ].unpack( 'C*' )
 
-          unless methods.include?( 0 )
+          unless methods.include?( 0 ) then
             puts "p#{ Process.pid } #{ Time.new } miss method 00"
-            set_is_closing( src )
+            set_src_closing( src )
             return
           end
 
@@ -1045,41 +972,37 @@ module Girl
           # +----+--------+
           data2 = [ 5, 0 ].pack( 'CC' )
           add_src_wbuff( src, data2 )
-
           src_info[ :proxy_proto ] = :socks5
           src_info[ :proxy_type ] = :negotiation
-
           return
         else
           # puts "debug1 not CONNECT #{ data.inspect }"
           host_line = data.split( "\r\n" ).find { | _line | _line[ 0, 6 ] == 'Host: ' }
 
-          unless host_line
+          unless host_line then
             # puts "debug1 not found host line"
-            set_is_closing( src )
+            set_src_closing( src )
             return
           end
 
-          data, domain_and_port = sub_http_request( data )
+          data, domain_port = sub_http_request( data )
 
-          unless domain_and_port
+          unless domain_port then
             # puts "debug1 not HTTP"
-            domain_and_port = host_line.split( ' ' )[ 1 ]
+            domain_port = host_line.split( ' ' )[ 1 ]
 
-            unless domain_and_port
+            unless domain_port then
               puts "p#{ Process.pid } #{ Time.new } Host line miss domain"
-              set_is_closing( src )
+              set_src_closing( src )
               return
             end
           end
 
           src_info[ :is_connect ] = false
-          pack_id = src_info[ :biggest_pack_id ] + 1
-          src_info[ :biggest_pack_id ] = pack_id
-          src_info[ :rbuffs ] << [ pack_id, data ]
+          src_info[ :rbuff ] << data
         end
 
-        domain, port = domain_and_port.split( ':' )
+        domain, port = domain_port.split( ':' )
         port = port ? port.to_i : 80
 
         src_info[ :proxy_proto ] = :http
@@ -1087,12 +1010,10 @@ module Girl
         src_info[ :destination_port ] = port
 
         resolve_domain( src, domain )
-      when :checking
-        # puts "debug1 add src rbuff while checking #{ data.inspect }"
-        pack_id = src_info[ :biggest_pack_id ] + 1
-        src_info[ :biggest_pack_id ] = pack_id
-        src_info[ :rbuffs ] << [ pack_id, data ]
-      when :negotiation
+      when :checking then
+        # puts "debug1 add src rbuff before resolved #{ data.inspect }"
+        src_info[ :rbuff ] << data
+      when :negotiation then
         # +----+-----+-------+------+----------+----------+
         # |VER | CMD |  RSV  | ATYP | DST.ADDR | DST.PORT |
         # +----+-----+-------+------+----------+----------+
@@ -1101,10 +1022,10 @@ module Girl
         # puts "debug1 negotiation #{ data.inspect }"
         ver, cmd, rsv, atyp = data[ 0, 4 ].unpack( 'C4' )
 
-        if cmd == 1
+        if cmd == 1 then
           # puts "debug1 socks5 CONNECT"
 
-          if atyp == 1
+          if atyp == 1 then
             destination_host, destination_port = data[ 4, 6 ].unpack( 'Nn' )
             destination_addr = Socket.sockaddr_in( destination_port, destination_host )
             destination_addrinfo = Addrinfo.new( destination_addr )
@@ -1113,10 +1034,10 @@ module Girl
             src_info[ :destination_port ] = destination_port
             # puts "debug1 IP V4 address #{ destination_addrinfo.inspect }"
             deal_with_destination_ip( src, destination_addrinfo )
-          elsif atyp == 3
+          elsif atyp == 3 then
             domain_len = data[ 4 ].unpack( 'C' ).first
 
-            if ( domain_len + 7 ) == data.bytesize
+            if ( domain_len + 7 ) == data.bytesize then
               domain = data[ 5, domain_len ]
               port = data[ ( 5 + domain_len ), 2 ].unpack( 'n' ).first
               src_info[ :destination_domain ] = domain
@@ -1128,53 +1049,64 @@ module Girl
         else
           puts "p#{ Process.pid } #{ Time.new } socks5 cmd #{ cmd } not implement"
         end
-      when :tunnel
-        src_id = src_info[ :id ]
-        src_ext = @tun_info[ :src_exts ][ src_id ]
-
-        unless src_ext
-          # puts "debug1 not found src ext"
-          set_is_closing( src )
-          return
-        end
+      when :tunnel then
+        stream = src_info[ :stream ]
 
-        pack_id = src_info[ :biggest_pack_id ] + 1
-        src_info[ :biggest_pack_id ] = pack_id
+        if stream then
+          unless stream.closed? then
+            unless src_info[ :is_connect ] then
+              data, _ = sub_http_request( data )
+            end
 
-        if src_ext[ :dst_port ]
-          if @tun.closed?
-            # puts "debug1 tun closed, close src"
-            set_is_closing( src )
-            return
+            stream_info = @stream_infos[ stream ]
+            data = @custom.encode( data )
+            # puts "debug2 add stream.wbuff encoded #{ data.bytesize }"
+            stream_info[ :wbuff ] << data
+            add_write( stream )
+
+            if stream_info[ :wbuff ].bytesize >= WBUFF_LIMIT then
+              puts "p#{ Process.pid } #{ Time.new } pause tunnel src #{ src_info[ :id ] } #{ src_info[ :destination_domain ] }"
+              src_info[ :paused ] = true
+              @reads.delete( src )
+            end
           end
+        else
+          # puts "debug1 stream not ready, save data to src.rbuff"
+          src_info[ :rbuff ] << data
 
-          unless src_info[ :is_connect ]
-            data, _ = sub_http_request( data )
+          if src_info[ :rbuff ].bytesize >= WBUFF_LIMIT then
+            # puts "debug1 tunnel src.rbuff full"
+            set_src_closing( src )
           end
-
-          add_tun_wbuff( src_id, pack_id, data )
-        else
-          # puts "debug1 remote dst not ready, save data to src rbuff"
-          src_info[ :rbuffs ] << [ pack_id, data ]
         end
-      when :direct
+      when :direct then
         dst = src_info[ :dst ]
 
-        if dst
-          if dst.closed?
-            # puts "debug1 dst closed, close src"
-            set_is_closing( src )
-            return
-          end
+        if dst then
+          unless dst.closed? then
+            unless src_info[ :is_connect ] then
+              data, _ = sub_http_request( data )
+            end
 
-          unless src_info[ :is_connect ]
-            data, _ = sub_http_request( data )
-          end
+            dst_info = @dst_infos[ dst ]
+            # puts "debug2 add dst.wbuff #{ data.bytesize }"
+            dst_info[ :wbuff ] << data
+            add_write( dst )
 
-          add_dst_wbuff( dst, data )
+            if dst_info[ :wbuff ].bytesize >= WBUFF_LIMIT then
+              puts "p#{ Process.pid } #{ Time.new } pause direct src #{ src_info[ :id ] } #{ src_info[ :destination_domain ] }"
+              src_info[ :paused ] = true
+              @reads.delete( src )
+            end
+          end
         else
-          # puts "debug1 dst not ready, save data to src rbuff"
-          src_info[ :rbuffs ] << [ nil, data ]
+          # puts "debug1 dst not ready, save data to src.rbuff"
+          src_info[ :rbuff ] << data
+
+          if src_info[ :rbuff ].bytesize >= WBUFF_LIMIT then
+            # puts "debug1 direct src.rbuff full"
+            set_src_closing( src )
+          end
         end
       end
     end
@@ -1184,243 +1116,252 @@ module Girl
     #
     def read_dst( dst )
       begin
-        data = dst.read_nonblock( PACK_SIZE )
+        data = dst.read_nonblock( READ_SIZE )
       rescue IO::WaitReadable, Errno::EINTR
+        print 'r'
         return
       rescue Exception => e
         # puts "debug1 read dst #{ e.class }"
-        set_is_closing( dst )
+        dst_info = close_read_dst( dst )
+        src = dst_info[ :src ]
+        set_src_closing_write( src )
         return
       end
 
-      # puts "debug2 read dst #{ data.inspect }"
       dst_info = @dst_infos[ dst ]
-      dst_info[ :last_continue_at ] = Time.new
       src = dst_info[ :src ]
+      add_src_wbuff( src, data )
+    end
 
-      if src.closed?
-        puts "p#{ Process.pid } #{ Time.new } src closed, close dst"
-        set_is_closing( dst )
+    ##
+    # read stream
+    #
+    def read_stream( stream )
+      begin
+        data = stream.read_nonblock( READ_SIZE )
+      rescue IO::WaitReadable, Errno::EINTR
+        print 'r'
+        return
+      rescue Exception => e
+        # puts "debug1 read stream #{ e.class }"
+        stream_info = close_read_stream( stream )
+        src = stream_info[ :src ]
+        set_src_closing_write( src )
         return
       end
 
+      stream_info = @stream_infos[ stream ]
+      src = stream_info[ :src ]
+      data = @custom.decode( data )
+      # puts "debug2 add src.wbuff decoded #{ data.bytesize }"
       add_src_wbuff( src, data )
     end
 
     ##
-    # read tun
+    # write tun
     #
-    def read_tun( tun )
-      data, addrinfo, rflags, *controls = tun.recvmsg
-      from_addr = addrinfo.to_sockaddr
-      now = Time.new
-      @tun_info[ :last_recv_at ] = now
-      pack_id = data[ 0, 8 ].unpack( 'Q>' ).first
-
-      if pack_id == 0
-        ctl_num = data[ 8 ].unpack( 'C' ).first
-
-        case ctl_num
-        when TUND_PORT
-          return if ( from_addr != @proxyd_addr ) || @tun_info[ :tund_addr ]
-
-          tund_port = data[ 9, 2 ].unpack( 'n' ).first
-
-          puts "p#{ Process.pid } #{ Time.new } got tund port #{ tund_port }"
-          tund_addr = Socket.sockaddr_in( tund_port, @proxyd_host )
-          @tun_info[ :tund_addr ] = tund_addr
-
-          if @tun_info[ :ctlmsg_rbuffs ].any?
-            # puts "debug1 move #{ @tun_info[ :ctlmsg_rbuffs ].size } ctlmsg rbuffs to ctlmsgs"
-            @tun_info[ :ctlmsgs ] += @tun_info[ :ctlmsg_rbuffs ].map{ | _data | [ tund_addr, _data ] }
-            @tun_info[ :ctlmsg_rbuffs ].clear
-            add_write( tun )
-          end
-        when PAIRED
-          return if from_addr != @tun_info[ :tund_addr ]
+    def write_tun( tun )
+      # 处理关闭
+      if @tun_info[ :closing ] then
+        close_tun( tun )
+        return
+      end
 
-          src_id, dst_port = data[ 9, 10 ].unpack( 'Q>n' )
+      now = Time.new
 
-          src_ext = @tun_info[ :src_exts ][ src_id ]
-          return if src_ext.nil? || src_ext[ :dst_port ]
+      # 发ctlmsg
+      while @tun_info[ :ctlmsgs ].any? do
+        data, to_addr = @tun_info[ :ctlmsgs ].first
 
-          src = src_ext[ :src ]
-          return if src.closed?
+        begin
+          @tun.sendmsg_nonblock( data, 0, to_addr )
+        rescue IO::WaitWritable, Errno::EINTR
+          puts "p#{ Process.pid } #{ Time.new } wait send ctlmsg, left #{ @tun_info[ :ctlmsgs ].size }"
+          @tun_info[ :last_sent_at ] = now
+          return
+        rescue Errno::EHOSTUNREACH, Errno::ENETUNREACH, Errno::ENETDOWN => e
+          puts "p#{ Process.pid } #{ Time.new } sendmsg #{ e.class }, close tun"
+          close_tun( tun )
+          return
+        end
 
-          # puts "debug1 got paired #{ src_id } #{ dst_port }"
+        @tun_info[ :ctlmsgs ].shift
+      end
 
-          if dst_port == 0
-            set_is_closing( src )
-            return
-          end
+      @tun_info[ :last_sent_at ] = now
+      @writes.delete( tun )
+    end
 
-          src_ext[ :dst_port ] = dst_port
-          @tun_info[ :src_ids ][ dst_port ] = src_id
+    ##
+    # write src
+    #
+    def write_src( src )
+      return if src.closed?
+      src_info = @src_infos[ src ]
+      dst = src_info[ :dst ]
 
-          src_info = @src_infos[ src ]
+      # 处理关闭
+      if src_info[ :closing ] then
+        close_src( src )
 
-          if src_info[ :proxy_proto ] == :http
-            if src_info[ :is_connect ]
-              # puts "debug1 add src wbuff http ok"
-              add_src_wbuff( src, HTTP_OK )
-            else
-              # puts "debug1 add src rbuffs to tun wbuffs"
+        if dst then
+          close_read_dst( dst )
+          set_dst_closing_write( dst )
+        else
+          stream = src_info[ :stream ]
 
-              src_info[ :rbuffs ].each do | pack_id, _data |
-                add_tun_wbuff( src_id, pack_id, _data )
-              end
-            end
-          elsif src_info[ :proxy_proto ] == :socks5
-            add_src_wbuff_socks5_conn_reply( src_ext[ :src ] )
+          if stream then
+            close_read_stream( stream )
+            set_stream_closing_write( stream )
           end
-        when DEST_STATUS
-          return if from_addr != @tun_info[ :tund_addr ]
-
-          dst_port, relay_dst_pack_id, continue_src_pack_id = data[ 9, 18 ].unpack( 'nQ>Q>' )
-
-          src_id = @tun_info[ :src_ids ][ dst_port ]
-          return unless src_id
-
-          src_ext = @tun_info[ :src_exts ][ src_id ]
-          return unless src_ext
-
-          # puts "debug2 got dest status"
-
-          release_wmems( src_ext, continue_src_pack_id )
-
-          # 发miss
-          if !src_ext[ :src ].closed? && ( src_ext[ :continue_dst_pack_id ] < relay_dst_pack_id )
-            ranges = []
-            ignored = false
-            curr_pack_id = src_ext[ :continue_dst_pack_id ] + 1
+        end
 
-            src_ext[ :pieces ].keys.sort.each do | pack_id |
-              if pack_id > curr_pack_id
-                ranges << [ curr_pack_id, pack_id - 1 ]
+        return
+      end
 
-                if ranges.size >= MISS_RANGE_LIMIT
-                  puts "p#{ Process.pid } #{ Time.new } break add miss range at #{ pack_id }"
-                  ignored = true
-                  break
-                end
-              end
+      # 处理wbuff
+      data = src_info[ :wbuff ]
 
-              curr_pack_id = pack_id + 1
-            end
+      # 写前为空，处理关闭写
+      if data.empty? then
+        if src_info[ :closing_write ] then
+          close_write_src( src )
+        else
+          @writes.delete( src )
+        end
 
-            if !ignored && ( curr_pack_id <= relay_dst_pack_id )
-              ranges << [ curr_pack_id, relay_dst_pack_id ]
-            end
+        return
+      end
 
-            # puts "debug1 continue/relay #{ src_ext[ :continue_dst_pack_id ] }/#{ relay_dst_pack_id } send MISS #{ ranges.size }"
+      # 写入
+      begin
+        written = src.write_nonblock( data )
+      rescue IO::WaitWritable, Errno::EINTR
+        print 'w'
+        return
+      rescue Exception => e
+        # puts "debug1 write src #{ e.class }"
+        close_write_src( src )
 
-            ranges.each do | pack_id_begin, pack_id_end |
-              data2 = [ 0, MISS, dst_port, pack_id_begin, pack_id_end ].pack( 'Q>CnQ>Q>' )
-              add_tun_ctlmsg( data2 )
-            end
-          end
-        when MISS
-          return if ( from_addr != @tun_info[ :tund_addr ] ) || ( @tun_info[ :resendings ].size >= RESENDING_LIMIT )
+        if dst then
+          close_read_dst( dst )
+        else
+          stream = src_info[ :stream ]
+          close_read_stream( stream ) if stream
+        end
 
-          src_id, pack_id_begin, pack_id_end = data[ 9, 24 ].unpack( 'Q>Q>Q>' )
+        return
+      end
 
-          src_ext = @tun_info[ :src_exts ][ src_id ]
-          return unless src_ext
+      # puts "debug2 written src #{ written }"
+      data = data[ written..-1 ]
+      src_info[ :wbuff ] = data
+    end
 
-          ( pack_id_begin..pack_id_end ).each do | pack_id |
-            send_at = src_ext[ :send_ats ][ pack_id ]
+    ##
+    # write dst
+    #
+    def write_dst( dst )
+      return if dst.closed?
+      dst_info = @dst_infos[ dst ]
+      src = dst_info[ :src ]
 
-            if send_at
-              break if now - send_at < CHECK_STATUS_INTERVAL
-              @tun_info[ :resendings ] << [ src_id, pack_id ]
-            end
-          end
+      # 处理关闭
+      if dst_info[ :closing ] then
+        close_dst( dst )
 
-          add_write( tun )
-        when FIN1
-          return if from_addr != @tun_info[ :tund_addr ]
+        if src then
+          close_read_src( src )
+          set_src_closing_write( src )
+        end
 
-          dst_port, biggest_dst_pack_id, continue_src_pack_id = data[ 9, 18 ].unpack( 'nQ>Q>' )
+        return
+      end
 
-          src_id = @tun_info[ :src_ids ][ dst_port ]
-          return unless src_id
+      data = dst_info[ :wbuff ]
 
-          src_ext = @tun_info[ :src_exts ][ src_id ]
-          return unless src_ext
+      # 写前为空，处理关闭写
+      if data.empty? then
+        if dst_info[ :closing_write ] then
+          close_write_dst( dst )
+        else
+          @writes.delete( dst )
+        end
 
-          # puts "debug1 got fin1 #{ dst_port } biggest dst pack #{ biggest_dst_pack_id } completed src pack #{ continue_src_pack_id }"
-          src_ext[ :is_dst_closed ] = true
-          src_ext[ :biggest_dst_pack_id ] = biggest_dst_pack_id
-          release_wmems( src_ext, continue_src_pack_id )
+        return
+      end
 
-          if ( biggest_dst_pack_id == src_ext[ :continue_dst_pack_id ] )
-            # puts "debug1 2-1. tun recv fin1 -> all traffic received ? -> close src after write"
-            set_is_closing( src_ext[ :src ] )
-          end
-        when FIN2
-          return if from_addr != @tun_info[ :tund_addr ]
+      # 写入
+      begin
+        written = dst.write_nonblock( data )
+      rescue IO::WaitWritable, Errno::EINTR
+        print 'w'
+        return
+      rescue Exception => e
+        # puts "debug1 write dst #{ e.class }"
+        close_write_dst( dst )
+        close_read_src( src )
+        return
+      end
 
-          dst_port = data[ 9, 2 ].unpack( 'n' ).first
+      data = data[ written..-1 ]
+      dst_info[ :wbuff ] = data
 
-          src_id = @tun_info[ :src_ids ][ dst_port ]
-          return unless src_id
+      unless src.closed? then
+        src_info = @src_infos[ src ]
+        src_info[ :last_sent_at ] = Time.new
+      end
+    end
 
-          # puts "debug1 1-2. tun recv fin2 -> del src ext"
-          del_src_ext( src_id )
-        when TUND_FIN
-          return if from_addr != @tun_info[ :tund_addr ]
+    ##
+    # write stream
+    #
+    def write_stream( stream )
+      return if stream.closed?
+      stream_info = @stream_infos[ stream ]
+      src = stream_info[ :src ]
+
+      # 处理关闭
+      if stream_info[ :closing ] then
+        close_stream( stream )
+        close_read_src( src )
+        set_src_closing_write( src )
+        return
+      end
 
-          puts "p#{ Process.pid } #{ Time.new } recv tund fin"
-          set_is_closing( tun )
-        when IP_CHANGED
-          return if from_addr != @tun_info[ :tund_addr ]
+      data = stream_info[ :wbuff ]
 
-          puts "p#{ Process.pid } #{ Time.new } recv ip changed"
-          set_is_closing( tun )
+      # 写前为空，处理关闭写
+      if data.empty? then
+        if stream_info[ :closing_write ] then
+          close_write_stream( stream )
+        else
+          @writes.delete( stream )
         end
 
         return
       end
 
-      return if from_addr != @tun_info[ :tund_addr ]
-
-      dst_port = data[ 8, 2 ].unpack( 'n' ).first
-
-      src_id = @tun_info[ :src_ids ][ dst_port ]
-      return unless src_id
-
-      src_ext = @tun_info[ :src_exts ][ src_id ]
-      return if src_ext.nil? || src_ext[ :src ].closed?
-      return if ( pack_id <= src_ext[ :continue_dst_pack_id ] ) || src_ext[ :pieces ].include?( pack_id )
-
-      data = data[ 10..-1 ]
-      # puts "debug2 got pack #{ pack_id }"
-
-      if pack_id <= CONFUSE_UNTIL
-        # puts "debug2 #{ data.inspect }"
-        data = @custom.decode( data )
-        # puts "debug1 decoded pack #{ pack_id }"
+      # 写入
+      begin
+        written = stream.write_nonblock( data )
+      rescue IO::WaitWritable, Errno::EINTR
+        print 'w'
+        return
+      rescue Exception => e
+        # puts "debug1 write stream #{ e.class }"
+        close_write_stream( stream )
+        close_read_src( src )
+        return
       end
 
-      # 放进写前，跳号放碎片缓存
-      if pack_id - src_ext[ :continue_dst_pack_id ] == 1
-        while src_ext[ :pieces ].include?( pack_id + 1 )
-          data << src_ext[ :pieces ].delete( pack_id + 1 )
-          pack_id += 1
-        end
-
-        src_ext[ :continue_dst_pack_id ] = pack_id
-        src_ext[ :last_continue_at ] = now
-        add_src_wbuff( src_ext[ :src ], data )
-        # puts "debug2 update continue dst pack #{ pack_id }"
+      # puts "debug2 written stream #{ written }"
+      data = data[ written..-1 ]
+      stream_info[ :wbuff ] = data
 
-        # 接到流量，若对面已关闭，且流量正好收全，关闭src
-        if src_ext[ :is_dst_closed ] && ( pack_id == src_ext[ :biggest_dst_pack_id ] )
-          # puts "debug1 2-2. tun recv traffic -> dst closed and all traffic received ? -> close src after write"
-          set_is_closing( src_ext[ :src ] )
-        end
-      else
-        src_ext[ :pieces ][ pack_id ] = data
+      unless src.closed? then
+        src_info = @src_infos[ src ]
+        src_info[ :last_sent_at ] = Time.new
       end
     end