girl 4.4.0 → 4.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7b905d2180abe835d892f44038fdf2f96b6710ad942fa2d762a2484430ea48f
-  data.tar.gz: d0a95baf185ce66219c7ce783c975d5bdd4bd9e00273ae77842f70697301ac40
+  metadata.gz: 011aa472a00bf6cb2d5c73af7f5a9f685897bcafa782cb5080c53f830775738a
+  data.tar.gz: 05a8c74a0a96a65f77432c2b64fe384283ed0a15178f4e09f820ce1b2d82f706
 SHA512:
-  metadata.gz: 6659b516924a9a43be0b7cf9c3d85ae8bda57e22d131089ae295f24ca7247d628e7d8fc795e6625cadac81a785b6390ae1ec3e170a42d5c3403e023879ff11ea
-  data.tar.gz: 6800db65291e870d6a87c3b22328a9415210c73b8535d5077609f0a957901a05f6832e621321ad9b5f2e78c609c640f1fe18ad8321e44ee195a4af7da2b62239
+  metadata.gz: 10e71a4842eb5ab95edb29411607502e073ae0c7f7f371163d42d9ac85dcb5fcda39363c572ddef67565e6eefa17706f836bec0eb48c16f31422d34838691277
+  data.tar.gz: facd9596a3518f80d587e436cbbb8fe76da4f7be6657b75d40cf076b11fa4f92c8ea0cb1fde9d8c0a496c3e8667d231a29e47da0ae463cf2a2d06e53ef8f1c07

data/girl.gemspec

@@ -31,8 +31,6 @@ lib/girl/relay.rb
 lib/girl/resolv_custom.rb
 lib/girl/resolvd_worker.rb
 lib/girl/resolvd.rb
-lib/girl/ssl_worker.rb
-lib/girl/ssl.rb
 lib/girl/version.rb
   ]
 

data/lib/girl/head.rb

@@ -1,13 +1,15 @@
 module Girl
-  READ_SIZE             = 1024 * 1024      # atun, btun一次读多少
+  READ_SIZE             = 1024 * 1024      # 一次读多少
   WBUFF_LIMIT           = 50 * 1024 * 1024 # 写前上限，超过上限暂停读
   RESUME_BELOW          = WBUFF_LIMIT / 2  # 降到多少以下恢复读
+  CHUNK_SIZE            = 65535            # 按块加解密，块尺寸上限，不超过65535
   EXPIRE_NEW            = 5                # 多久没有建立通道，过期
-  EXPIRE_AFTER          = 300              # 多久没有新流量，过期
+  EXPIRE_CONNECTING     = 2                # 连接中，多久没连上过期
+  EXPIRE_AFTER          = 86400            # 多久没有新流量，过期
   EXPIRE_CTL            = 86400            # 多久没有ctlmsg来，过期
   RESET_TRAFF_DAY       = 1                # 流量计数重置日，0为不重置
   CHECK_TRAFF_INTERVAL  = 86400            # 检查今天是否是流量计数重置日间隔
-  CHECK_EXPIRE_INTERVAL = 5                # 检查过期间隔
+  CHECK_EXPIRE_INTERVAL = 1                # 检查过期间隔
   CHECK_RESUME_INTERVAL = 1                # 检查恢复读间隔
   RESOLV_CACHE_EXPIRE   = 300              # dns查询结果缓存多久过期
   RESEND_LIMIT          = 5                # ctlmsg重传次数
@@ -47,12 +49,15 @@ module Girl
 172.16.0.0/12
 192.168.0.0/16
 255.255.255.255/32
+::1
 EOF
   CONSTS = %w[
     READ_SIZE
     WBUFF_LIMIT
     RESUME_BELOW
+    CHUNK_SIZE
     EXPIRE_NEW
+    EXPIRE_CONNECTING
     EXPIRE_AFTER
     EXPIRE_CTL
     RESET_TRAFF_DAY

data/lib/girl/proxy_worker.rb

@@ -7,7 +7,6 @@ module Girl
     def initialize( redir_port, proxyd_host, proxyd_port, directs, remotes, im )
       @proxyd_host = proxyd_host
       @proxyd_port = proxyd_port
-      @proxyd_addr = Socket.sockaddr_in( proxyd_port, proxyd_host )
       @directs = directs
       @remotes = remotes
       @custom = Girl::ProxyCustom.new( im )
@@ -431,8 +430,7 @@ module Girl
       return if src.closed?
       src_info = @src_infos[ src ]
 
-      if ( ( @ip_address_list.any? { | addrinfo | addrinfo.ip_address == ip_info.ip_address } ) && ( src_info[ :destination_port ] == @redir_port ) ) \
-        || ( ( ip_info.ip_address == @proxyd_host ) && ( src_info[ :destination_port ] == @proxyd_port ) ) then
+      if ( @ip_address_list.any? { | addrinfo | addrinfo.ip_address == ip_info.ip_address } ) && ( src_info[ :destination_port ] == @redir_port ) then
         puts "p#{ Process.pid } #{ Time.new } ignore #{ ip_info.ip_address }:#{ src_info[ :destination_port ] }"
         add_closing_src( src )
         return
@@ -507,19 +505,33 @@ module Girl
           if @ctl && !@ctl.closed? then
             last_recv_at = @ctl_info[ :last_recv_at ] || @ctl_info[ :created_at ]
 
-            if now - last_recv_at >= EXPIRE_AFTER then
-               puts "p#{ Process.pid } #{ Time.new } expire ctl"
-               @ctl_info[ :closing ] = true
-               next_tick
+            if now - last_recv_at >= EXPIRE_CTL then
+               puts "p#{ Process.pid } #{ Time.new } expire ctl #{ EXPIRE_CTL }"
+               set_ctl_closing
             end
           end
 
           @src_infos.each do | src, src_info |
             last_recv_at = src_info[ :last_recv_at ] || src_info[ :created_at ]
             last_sent_at = src_info[ :last_sent_at ] || src_info[ :created_at ]
-            expire_after = ( src_info[ :dst ] || src_info[ :atun ] ) ? EXPIRE_AFTER : EXPIRE_NEW
 
-            if ( now - last_recv_at >= expire_after ) && ( now - last_sent_at >= expire_after ) then
+            if src_info[ :dst ] then
+              if src_info[ :dst_connected ] then
+                expire_after = EXPIRE_AFTER
+                is_expire = ( now - last_recv_at >= expire_after ) && ( now - last_sent_at >= expire_after )
+              else
+                expire_after = EXPIRE_CONNECTING
+                is_expire = ( now - src_info[ :dst_created_at ] >= expire_after )
+              end
+            elsif src_info[ :atun ] then
+              expire_after = EXPIRE_AFTER
+              is_expire = ( now - last_recv_at >= expire_after ) && ( now - last_sent_at >= expire_after )
+            else
+              expire_after = EXPIRE_NEW
+              is_expire = ( now - last_recv_at >= expire_after ) && ( now - last_sent_at >= expire_after )
+            end
+
+            if is_expire then
               puts "p#{ Process.pid } #{ Time.new } expire src #{ expire_after } #{ src_info[ :id ] } #{ src_info[ :destination_domain ] }"
               add_closing_src( src )
 
@@ -548,7 +560,7 @@ module Girl
               if !dst.closed? then
                 dst_info = @dst_infos[ dst ]
 
-                if dst_info[ :wbuff ].size < RESUME_BELOW then
+                if dst_info[ :wbuff ].bytesize < RESUME_BELOW then
                   puts "p#{ Process.pid } #{ Time.new } resume direct src #{ src_info[ :destination_domain ] }"
                   add_resume_src( src )
                 end
@@ -559,7 +571,7 @@ module Girl
               if atun && !atun.closed? then
                 atun_info = @atun_infos[ atun ]
 
-                if atun_info[ :wbuff ].size < RESUME_BELOW then
+                if atun_info[ :wbuff ].bytesize < RESUME_BELOW then
                   puts "p#{ Process.pid } #{ Time.new } resume tunnel src #{ src_info[ :destination_domain ] }"
                   add_resume_src( src )
                 end
@@ -574,7 +586,7 @@ module Girl
             if src && !src.closed? then
               src_info = @src_infos[ src ]
 
-              if src_info[ :wbuff ].size < RESUME_BELOW then
+              if src_info[ :wbuff ].bytesize < RESUME_BELOW then
                 puts "p#{ Process.pid } #{ Time.new } resume dst #{ dst_info[ :domain ] }"
                 add_resume_dst( dst )
               end
@@ -588,7 +600,7 @@ module Girl
             if src && !src.closed? then
               src_info = @src_infos[ src ]
 
-              if src_info[ :wbuff ].size < RESUME_BELOW then
+              if src_info[ :wbuff ].bytesize < RESUME_BELOW then
                 puts "p#{ Process.pid } #{ Time.new } resume btun #{ btun_info[ :domain ] }"
                 add_resume_btun( btun )
               end
@@ -615,6 +627,7 @@ module Girl
 
           if resend >= RESEND_LIMIT then
             @ctl_info[ :resends ].delete( key )
+            set_ctl_closing
             break
           end
 
@@ -631,14 +644,22 @@ module Girl
       src_info = @src_infos[ src ]
       domain = src_info[ :destination_domain ]
       destination_addr = Socket.sockaddr_in( src_info[ :destination_port ], ip_info.ip_address )
-      dst = Socket.new( ip_info.ipv4? ? Socket::AF_INET : Socket::AF_INET6, Socket::SOCK_STREAM, 0 )
+
+      begin
+        dst = Socket.new( ip_info.ipv4? ? Socket::AF_INET : Socket::AF_INET6, Socket::SOCK_STREAM, 0 )
+      rescue Exception => e
+        puts "p#{ Process.pid } #{ Time.new } new a dst #{ src_info[ :destination_domain ] } #{ src_info[ :destination_port ] } #{ e.class }"
+        add_closing_src( src )
+        return
+      end
+
+      dst.setsockopt( Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1 )
 
       begin
         dst.connect_nonblock( destination_addr )
       rescue IO::WaitWritable
-        # connect nonblock 必抛 wait writable
       rescue Exception => e
-        puts "p#{ Process.pid } #{ Time.new } dst connect destination #{ domain } #{ src_info[ :destination_port ] } #{ ip_info.ip_address } #{ e.class }, close src"
+        puts "p#{ Process.pid } #{ Time.new } dst connect destination #{ domain } #{ src_info[ :destination_port ] } #{ ip_info.ip_address } #{ e.class }"
         dst.close
         add_closing_src( src )
         return
@@ -653,9 +674,9 @@ module Girl
       }
 
       @dst_infos[ dst ] = dst_info
-      add_read( dst, :dst )
       src_info[ :proxy_type ] = :direct
       src_info[ :dst ] = dst
+      src_info[ :dst_created_at ] = Time.new
 
       if src_info[ :proxy_proto ] == :http then
         if src_info[ :is_connect ] then
@@ -664,11 +685,13 @@ module Girl
         elsif src_info[ :rbuff ] then
           # puts "debug move src.rbuff to dst.wbuff"
           dst_info[ :wbuff ] << src_info[ :rbuff ]
-          add_write( dst )
         end
       elsif src_info[ :proxy_proto ] == :socks5 then
         add_socks5_conn_reply( src )
       end
+
+      add_read( dst, :dst )
+      add_write( dst )
     end
 
     ##
@@ -684,7 +707,10 @@ module Girl
       @ctl = ctl
       add_read( ctl, :ctl )
 
+      ctld_port = @proxyd_port + 10.times.to_a.sample
+      ctld_addr = Socket.sockaddr_in( ctld_port, @proxyd_host )
       @ctl_info = {
+        ctld_addr: ctld_addr,        # ctld地址
         resends: ConcurrentHash.new, # key => count
         atund_addr: nil,             # atund地址，src->dst
         btund_addr: nil,             # btund地址，dst->src
@@ -694,7 +720,7 @@ module Girl
       }
 
       hello = @custom.hello
-      puts "p#{ Process.pid } #{ Time.new } hello i'm #{ hello.inspect }"
+      puts "p#{ Process.pid } #{ Time.new } hello i'm #{ hello.inspect } #{ ctld_port }"
       key = [ HELLO ].pack( 'C' )
       add_ctlmsg( key, hello )
     end
@@ -704,6 +730,7 @@ module Girl
     #
     def new_a_redir( redir_port )
       redir = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
+      redir.setsockopt( Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1 )
       redir.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEADDR, 1 )
 
       if RUBY_PLATFORM.include?( 'linux' ) then
@@ -730,23 +757,25 @@ module Girl
 
       # puts "debug new atun and btun"
       atun = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
+      atun.setsockopt( Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1 )
 
       begin
         atun.connect_nonblock( @ctl_info[ :atund_addr ] )
       rescue IO::WaitWritable
       rescue Exception => e
-        puts "p#{ Process.pid } #{ Time.new } connect atund #{ e.class }, close atun"
+        puts "p#{ Process.pid } #{ Time.new } connect atund #{ e.class }"
         atun.close
         return
       end
 
       btun = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
+      btun.setsockopt( Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1 )
 
       begin
         btun.connect_nonblock( @ctl_info[ :btund_addr ] )
       rescue IO::WaitWritable
       rescue Exception => e
-        puts "p#{ Process.pid } #{ Time.new } connect btund #{ e.class }, close btun"
+        puts "p#{ Process.pid } #{ Time.new } connect btund #{ e.class }"
         btun.close
         return
       end
@@ -755,7 +784,7 @@ module Girl
       atun_wbuff = [ dst_id ].pack( 'n' )
 
       until src_info[ :rbuff ].empty? do
-        data = src_info[ :rbuff ][ 0, 65535 ]
+        data = src_info[ :rbuff ][ 0, CHUNK_SIZE ]
         data_size = data.bytesize
         # puts "debug move src.rbuff #{ data_size } to atun.wbuff"
         atun_wbuff << pack_a_chunk( data )
@@ -866,7 +895,7 @@ module Girl
       data = @custom.encode( data )
 
       begin
-        @ctl.sendmsg( data, 0, @proxyd_addr )
+        @ctl.sendmsg( data, 0, @ctl_info[ :ctld_addr ] )
         @ctl_info[ :last_sent_at ] = Time.new
       rescue Exception => e
         puts "p#{ Process.pid } #{ Time.new } sendmsg #{ e.class }"
@@ -886,6 +915,15 @@ module Girl
       add_write( atun )
     end
 
+    ##
+    # set ctl closing
+    #
+    def set_ctl_closing
+      return if @ctl.closed?
+      @ctl_info[ :closing ] = true
+      next_tick
+    end
+
     ##
     # set dst closing write
     #
@@ -929,7 +967,7 @@ module Girl
     # read dotr
     #
     def read_dotr( dotr )
-      dotr.read_nonblock( 65535 )
+      dotr.read_nonblock( READ_SIZE )
 
       if @ctl_info && @ctl_info[ :closing ] then
         send_ctlmsg( [ CTL_FIN ].pack( 'C' ) )
@@ -993,6 +1031,8 @@ module Girl
         is_connect: true,        # 代理协议是http的场合，是否是CONNECT
         rbuff: '',               # 读到的流量
         dst: nil,                # :direct的场合，对应的dst
+        dst_created_at: nil,     # :direct的场合，对应的dst的创建时间
+        dst_connected: false,    # :direct的场合，对应的dst是否已连接
         ctl: nil,                # :tunnel的场合，对应的ctl
         atun: nil,               # :tunnel的场合，对应的atun
         btun: nil,               # :tunnel的场合，对应的btun
@@ -1028,7 +1068,7 @@ module Girl
 
       case ctl_num
       when TUND_PORT then
-        return if @ctl_info[ :atund_addr ] || data.size != 5
+        return if @ctl_info[ :atund_addr ] || data.bytesize != 5
         atund_port, btund_port = data[ 1, 4 ].unpack( 'nn' )
         puts "p#{ Process.pid } #{ Time.new } got tund port #{ atund_port } #{ btund_port }"
         @ctl_info[ :resends ].delete( [ HELLO ].pack( 'C' ) )
@@ -1042,14 +1082,14 @@ module Girl
           @pending_srcs.clear
         end
       when PAIRED then
-        return if data.size != 11
+        return if data.bytesize != 11
         src_id, dst_id = data[ 1, 10 ].unpack( 'Q>n' )
         # puts "debug got paired #{ src_id } #{ dst_id }"
         @ctl_info[ :resends ].delete( [ A_NEW_SOURCE, src_id ].pack( 'CQ>' ) )
         @ctl_info[ :last_recv_at ] = Time.new
         new_tuns( src_id, dst_id )
       when UNKNOWN_CTL_ADDR then
-        puts "p#{ Process.pid } #{ Time.new } got unknown ctl addr, close ctl"
+        puts "p#{ Process.pid } #{ Time.new } got unknown ctl addr"
         close_ctl( ctl )
       end
     end
@@ -1066,7 +1106,7 @@ module Girl
       src_info = @src_infos[ src ]
 
       begin
-        data = src.read_nonblock( 65535 )
+        data = src.read_nonblock( CHUNK_SIZE )
       rescue IO::WaitReadable
         print 'r'
         return
@@ -1167,9 +1207,18 @@ module Girl
           src_info[ :rbuff ] << data
         end
 
-        domain, port = domain_port.split( ':' )
-        port = port ? port.to_i : 80
+        colon_idx = domain_port.rindex( ':' )
+        close_idx = domain_port.rindex( ']' )
 
+        if colon_idx && ( close_idx.nil? || ( colon_idx > close_idx ) ) then
+          domain = domain_port[ 0...colon_idx ]
+          port = domain_port[ ( colon_idx + 1 )..-1 ].to_i
+        else
+          domain = domain_port
+          port = 80
+        end
+
+        domain = domain.gsub( /\[|\]/, '' )
         src_info[ :proxy_proto ] = :http
         src_info[ :destination_domain ] = domain
         src_info[ :destination_port ] = port
@@ -1210,9 +1259,13 @@ module Girl
               # puts "debug DOMAINNAME #{ domain } #{ port }"
               resolve_domain( src, domain )
             end
+          else
+            puts "p#{ Process.pid } #{ Time.new } socks5 atyp #{ atyp } not implement"
+            add_closing_src( src )
           end
         else
           puts "p#{ Process.pid } #{ Time.new } socks5 cmd #{ cmd } not implement"
+          add_closing_src( src )
         end
       when :tunnel then
         atun = src_info[ :atun ]
@@ -1248,7 +1301,7 @@ module Girl
       src = dst_info[ :src ]
 
       begin
-        data = dst.read_nonblock( 65535 )
+        data = dst.read_nonblock( CHUNK_SIZE )
       rescue IO::WaitReadable
         print 'r'
         return
@@ -1413,6 +1466,12 @@ module Girl
 
       dst_info = @dst_infos[ dst ]
       src = dst_info[ :src ]
+      src_info = @src_infos[ src ]
+
+      unless src.closed? then
+        src_info[ :dst_connected ] = true
+      end
+
       data = dst_info[ :wbuff ]
 
       # 写前为空，处理关闭写
@@ -1443,7 +1502,6 @@ module Girl
       dst_info[ :wbuff ] = data
 
       unless src.closed? then
-        src_info = @src_infos[ src ]
         src_info[ :last_sent_at ] = Time.new
       end
     end

data/lib/girl/proxyd_worker.rb

@@ -28,7 +28,7 @@ module Girl
       dotr, dotw = IO.pipe
       @dotw = dotw
       add_read( dotr, :dotr )
-      new_a_ctld( proxyd_port )
+      new_ctlds( proxyd_port )
       new_a_infod( infod_port )
     end
 
@@ -305,7 +305,14 @@ module Girl
     # deal with destination addr
     #
     def deal_with_destination_addr( ctl_addr, src_id, destination_addr, domain_port )
-      dst = Socket.new( Addrinfo.new( destination_addr ).ipv4? ? Socket::AF_INET : Socket::AF_INET6, Socket::SOCK_STREAM, 0 )
+      begin
+        dst = Socket.new( Addrinfo.new( destination_addr ).ipv4? ? Socket::AF_INET : Socket::AF_INET6, Socket::SOCK_STREAM, 0 )
+      rescue Exception => e
+        puts "p#{ Process.pid } #{ Time.new } new a dst #{ destination_addr.inspect } #{ domain_port } #{ e.class }"
+        return
+      end
+
+      dst.setsockopt( Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1 )
 
       begin
         dst.connect_nonblock( destination_addr )
@@ -324,6 +331,7 @@ module Girl
         ctl_addr: ctl_addr,       # 对应ctl
         im: ctl_info[ :im ],      # 标识
         domain_port: domain_port, # 目的地和端口
+        connected: false,         # 是否已连接
         rbuff: '',                # 对应的tun没准备好，暂存读到的流量
         atun: nil,                # 对应的atun
         btun: nil,                # 对应的btun
@@ -336,13 +344,14 @@ module Girl
       }
 
       add_read( dst, :dst )
+      add_write( dst )
 
       ctl_info[ :dst_ids ][ src_id ] = dst_id
       ctl_info[ :dsts ][ dst_id ] = dst
 
       data = [ PAIRED, src_id, dst_id ].pack( 'CQ>n' )
       # puts "debug add ctlmsg paired #{ src_id } #{ dst_id }"
-      send_ctlmsg( data, ctl_addr )
+      send_ctlmsg( ctl_info[ :ctld ], data, ctl_addr )
     end
 
     ##
@@ -404,11 +413,17 @@ module Girl
           end
 
           @dst_infos.each do | dst, dst_info |
-            last_recv_at = dst_info[ :last_recv_at ] || dst_info[ :created_at ]
-            last_sent_at = dst_info[ :last_sent_at ] || dst_info[ :created_at ]
-            expire_after = dst_info[ :btun ] ? EXPIRE_AFTER : EXPIRE_NEW
+            if dst_info[ :connected ] then
+              last_recv_at = dst_info[ :last_recv_at ] || dst_info[ :created_at ]
+              last_sent_at = dst_info[ :last_sent_at ] || dst_info[ :created_at ]
+              expire_after = EXPIRE_AFTER
+              is_expire = ( now - last_recv_at >= expire_after ) && ( now - last_sent_at >= expire_after )
+            else
+              expire_after = EXPIRE_CONNECTING
+              is_expire = ( now - dst_info[ :created_at ] >= expire_after )
+            end
 
-            if ( now - last_recv_at >= expire_after ) && ( now - last_sent_at >= expire_after ) then
+            if is_expire then
               puts "p#{ Process.pid } #{ Time.new } expire dst #{ expire_after } #{ dst_info[ :domain_port ] }"
 
               unless @closing_dsts.include?( dst ) then
@@ -436,7 +451,7 @@ module Girl
             if btun && !btun.closed? then
               btun_info = @btun_infos[ btun ]
 
-              if btun_info[ :wbuff ].size < RESUME_BELOW then
+              if btun_info[ :wbuff ].bytesize < RESUME_BELOW then
                 puts "p#{ Process.pid } #{ Time.new } resume dst #{ dst_info[ :domain_port ] }"
                 add_resume_dst( dst )
               end
@@ -450,7 +465,7 @@ module Girl
             if dst && !dst.closed? then
               dst_info = @dst_infos[ dst ]
 
-              if dst_info[ :wbuff ].size < RESUME_BELOW then
+              if dst_info[ :wbuff ].bytesize < RESUME_BELOW then
                 puts "p#{ Process.pid } #{ Time.new } resume atun #{ atun_info[ :domain_port ] }"
                 add_resume_atun( atun )
               end
@@ -479,18 +494,6 @@ module Girl
       end
     end
 
-    ##
-    # new a ctld
-    #
-    def new_a_ctld( proxyd_port )
-      ctld = Socket.new( Socket::AF_INET, Socket::SOCK_DGRAM, 0 )
-      ctld.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEPORT, 1 )
-      ctld.bind( Socket.sockaddr_in( proxyd_port, '0.0.0.0' ) )
-      puts "p#{ Process.pid } #{ Time.new } ctld bind on #{ proxyd_port }"
-      add_read( ctld, :ctld )
-      @ctld = ctld
-    end
-
     ##
     # new a infod
     #
@@ -507,11 +510,26 @@ module Girl
     #
     def new_a_tund
       tund = Socket.new( Socket::AF_INET, Socket::SOCK_STREAM, 0 )
+      tund.setsockopt( Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1 )
       tund.bind( Socket.sockaddr_in( 0, '0.0.0.0' ) )
       tund.listen( 127 )
       tund
     end
 
+    ##
+    # new ctlds
+    #
+    def new_ctlds( proxyd_port )
+      10.times do | i |
+        ctld_port = proxyd_port + i
+        ctld = Socket.new( Socket::AF_INET, Socket::SOCK_DGRAM, 0 )
+        ctld.setsockopt( Socket::SOL_SOCKET, Socket::SO_REUSEPORT, 1 )
+        ctld.bind( Socket.sockaddr_in( ctld_port, '0.0.0.0' ) )
+        puts "p#{ Process.pid } #{ Time.new } ctld bind on #{ ctld_port }"
+        add_read( ctld, :ctld )
+      end
+    end
+
     ##
     # next tick
     #
@@ -571,11 +589,11 @@ module Girl
     ##
     # send ctlmsg
     #
-    def send_ctlmsg( data, to_addr )
+    def send_ctlmsg( ctld, data, to_addr )
       data = @custom.encode( data )
 
       begin
-        @ctld.sendmsg( data, 0, to_addr )
+        ctld.sendmsg( data, 0, to_addr )
       rescue Exception => e
         puts "p#{ Process.pid } #{ Time.new } sendmsg #{ e.class }"
       end
@@ -609,7 +627,7 @@ module Girl
     # read dotr
     #
     def read_dotr( dotr )
-      dotr.read_nonblock( 65535 )
+      dotr.read_nonblock( READ_SIZE )
 
       if @deleting_ctl_infos.any? then
         @deleting_ctl_infos.each { | ctl_addr | del_ctl_info( ctl_addr ) }
@@ -655,7 +673,7 @@ module Girl
         if ctl_info then
           atund_port, btund_port = ctl_info[ :atund_port ], ctl_info[ :btund_port ]
         else
-          return if data.size <= 1
+          return if data.bytesize <= 1
           im = data[ 1..-1 ]
           result = @custom.check( im, addrinfo )
 
@@ -687,6 +705,7 @@ module Girl
           }
 
           @ctl_infos[ ctl_addr ] = {
+            ctld: ctld,                  # 对应的ctld
             addrinfo: addrinfo,          # 地址
             im: im,                      # 标识
             atund: atund,                # 对应atund，src->dst
@@ -702,21 +721,21 @@ module Girl
         end
 
         data2 = [ TUND_PORT, atund_port, btund_port ].pack( 'Cnn' )
-        send_ctlmsg( data2, ctl_addr )
+        send_ctlmsg( ctld, data2, ctl_addr )
       when A_NEW_SOURCE then
         unless ctl_info then
-          send_ctlmsg( [ UNKNOWN_CTL_ADDR ].pack( 'C' ), addrinfo )
+          send_ctlmsg( ctld, [ UNKNOWN_CTL_ADDR ].pack( 'C' ), addrinfo )
           return
         end
 
-        return if data.size <= 9
+        return if data.bytesize <= 9
         src_id = data[ 1, 8 ].unpack( 'Q>' ).first
         dst_id = ctl_info[ :dst_ids ][ src_id ]
 
         if dst_id then
           data2 = [ PAIRED, src_id, dst_id ].pack( 'CQ>n' )
           # puts "debug dst id exist, send ctlmsg paired #{ src_id } #{ dst_id }"
-          send_ctlmsg( data2, ctl_addr )
+          send_ctlmsg( ctld, data2, ctl_addr )
           return
         end
 
@@ -772,7 +791,7 @@ module Girl
       btun = dst_info[ :btun ]
 
       begin
-        data = dst.read_nonblock( 65535 )
+        data = dst.read_nonblock( CHUNK_SIZE )
       rescue IO::WaitReadable
         print 'r'
         return
@@ -1044,7 +1063,7 @@ module Girl
         data2 = ''
 
         until dst_info[ :rbuff ].empty? do
-          _data = dst_info[ :rbuff ][ 0, 65535 ]
+          _data = dst_info[ :rbuff ][ 0, CHUNK_SIZE ]
           data_size = _data.bytesize
           # puts "debug move dst.rbuff to btun.wbuff"
           data2 << pack_a_chunk( _data )
@@ -1067,6 +1086,7 @@ module Girl
       end
 
       dst_info = @dst_infos[ dst ]
+      dst_info[ :connected ] = true
       atun = dst_info[ :atun ]
       data = dst_info[ :wbuff ]