@opensecurity/zonzon-core 0.1.4 → 0.1.5

package/dist/http-handler.js

@@ -1,4 +1,5 @@
 import * as http from "http";
+import * as https from "https";
 import * as net from "net";
 import * as dns from "dns/promises";
 import { HttpProxyService } from "./http-proxy.js";
@@ -58,14 +59,22 @@ export class HttpHandler {
     server = null;
     circuitBreakers = new Map();
     activeConnections = new Set();
+    idleTimeoutMs;
     constructor(dnsServer, config, port) {
         this.dnsServer = dnsServer;
         this.proxyService = new HttpProxyService();
         this.config = config;
         this.port = config.httpPort ?? port ?? 80;
+        this.idleTimeoutMs = config.tcpIdleTimeoutMs ?? 30000;
     }
     getCircuitBreaker(upstream) {
         if (!this.circuitBreakers.has(upstream)) {
+            if (this.circuitBreakers.size >= 10000) {
+                const firstKey = this.circuitBreakers.keys().next().value;
+                if (firstKey !== undefined) {
+                    this.circuitBreakers.delete(firstKey);
+                }
+            }
             this.circuitBreakers.set(upstream, new ProxyCircuitBreaker());
         }
         return this.circuitBreakers.get(upstream);
@@ -82,25 +91,21 @@ export class HttpHandler {
         }
         return undefined;
     }
-    injectCustomHeaders(responseHeaders, hostConfig) {
-        if (!hostConfig.http_proxy?.enabled)
-            return;
-        for (const [key, value] of Object.entries(hostConfig.http_proxy.headers)) {
-            const sanitized = this.proxyService.sanitizeHeader(value);
-            if (sanitized) {
-                responseHeaders.set(key, sanitized);
-            }
-        }
-    }
     async handleConnect(req, clientSocket, head) {
         const clientIp = req.socket.remoteAddress || "unknown";
         const targetUrl = req.url || "";
         const [hostname, portStr] = targetUrl.split(':');
         const port = portStr ? parseInt(portStr, 10) : 443;
         try {
-            await this.proxyService.validateTargetFirewall(`https://${hostname}:${port}`, this.config.firewall);
-            audit.http(clientIp, "CONNECT", hostname, `:${port}`, 200, "TCP Tunnel Established");
-            const srvSocket = net.connect(port, hostname, () => {
+            const validatedIps = await this.proxyService.validateTargetFirewall(`https://${hostname}:${port}`, this.config.firewall);
+            const targetIp = validatedIps[0];
+            audit.http(clientIp, "CONNECT", hostname, `:${port}`, 200, `TCP Tunnel Established -> ${targetIp}`);
+            clientSocket.setTimeout(this.idleTimeoutMs);
+            clientSocket.on("timeout", () => {
+                audit.error(`CONNECT Client tunnel idle timeout reached for ${clientIp}`);
+                clientSocket.destroy();
+            });
+            const srvSocket = net.connect(port, targetIp, () => {
                 clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
                 if (head && head.length > 0) {
                     srvSocket.write(head);
@@ -108,6 +113,11 @@ export class HttpHandler {
                 srvSocket.pipe(clientSocket);
                 clientSocket.pipe(srvSocket);
             });
+            srvSocket.setTimeout(this.idleTimeoutMs);
+            srvSocket.on("timeout", () => {
+                audit.error(`CONNECT Upstream tunnel idle timeout reached for ${hostname}:${port}`);
+                srvSocket.destroy();
+            });
             this.activeConnections.add(srvSocket);
             srvSocket.on('close', () => this.activeConnections.delete(srvSocket));
             srvSocket.on('error', (err) => {
@@ -128,14 +138,86 @@ export class HttpHandler {
             }
         }
     }
+    async doHttpProxy(targetUrl, targetIp, hostname, reqMethod, reqHeaders, bodyBuffer, clientIp, res, breaker, auditUrl, customReqHeaders = {}, customResHeaders = {}) {
+        const hopByHop = this.proxyService.getHopByHopHeaders();
+        const outReqHeaders = {};
+        for (const [k, v] of Object.entries(reqHeaders)) {
+            if (!hopByHop.includes(k.toLowerCase()) && v !== undefined) {
+                outReqHeaders[k] = Array.isArray(v) ? v.join(", ") : v;
+            }
+        }
+        outReqHeaders["Host"] = hostname;
+        if (bodyBuffer) {
+            outReqHeaders["content-length"] = String(bodyBuffer.length);
+        }
+        else if (reqMethod !== "GET" && reqMethod !== "HEAD") {
+            outReqHeaders["content-length"] = "0";
+        }
+        for (const [k, v] of Object.entries(customReqHeaders)) {
+            outReqHeaders[k] = v;
+        }
+        const reqOptions = {
+            hostname: targetIp,
+            port: targetUrl.port || (targetUrl.protocol === "https:" ? 443 : 80),
+            path: targetUrl.pathname + targetUrl.search,
+            method: reqMethod,
+            headers: outReqHeaders,
+            timeout: this.idleTimeoutMs,
+            servername: targetUrl.protocol === "https:" ? hostname : undefined
+        };
+        const requestModule = targetUrl.protocol === "https:" ? https : http;
+        const proxyResp = await breaker.execute(() => new Promise((resolve, reject) => {
+            const proxyReq = requestModule.request(reqOptions, resolve);
+            proxyReq.on("error", reject);
+            proxyReq.on("timeout", () => { proxyReq.destroy(); reject(new Error("TimeoutError")); });
+            if (bodyBuffer) {
+                proxyReq.write(bodyBuffer);
+            }
+            proxyReq.end();
+        }));
+        const outResHeaders = {};
+        for (const [k, v] of Object.entries(proxyResp.headers)) {
+            if (!hopByHop.includes(k.toLowerCase()) && v !== undefined) {
+                outResHeaders[k] = Array.isArray(v) ? v.join(", ") : v;
+            }
+        }
+        for (const [k, v] of Object.entries(customResHeaders)) {
+            outResHeaders[k] = v;
+        }
+        audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, proxyResp.statusCode || 502, auditUrl);
+        res.writeHead(proxyResp.statusCode || 502, outResHeaders);
+        proxyResp.pipe(res);
+    }
+    async readRequestBodySafe(req, maxBytes, clientIp) {
+        const chunks = [];
+        let totalSize = 0;
+        const absoluteTimeout = setTimeout(() => {
+            req.destroy(new Error("Read absolute timeout exceeded (Slowloris Mitigation)"));
+        }, 10000);
+        try {
+            for await (const chunk of req) {
+                totalSize += chunk.length;
+                if (totalSize > maxBytes) {
+                    clearTimeout(absoluteTimeout);
+                    throw new Error("Payload size limit exceeded");
+                }
+                chunks.push(chunk);
+            }
+        }
+        finally {
+            clearTimeout(absoluteTimeout);
+        }
+        return chunks.length > 0 ? Buffer.concat(chunks) : undefined;
+    }
     async handleForwardProxy(req, res) {
         const clientIp = req.socket.remoteAddress || "unknown";
         const reqMethod = req.method || "GET";
         const reqUrl = req.url || "/";
         const targetUrl = new URL(reqUrl);
         const hostname = targetUrl.hostname;
+        let validatedIps = [];
         try {
-            await this.proxyService.validateTargetFirewall(targetUrl.toString(), this.config.firewall);
+            validatedIps = await this.proxyService.validateTargetFirewall(targetUrl.toString(), this.config.firewall);
         }
         catch (fwErr) {
             audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, 403, "Blocked by L3/L7 Firewall");
@@ -143,63 +225,34 @@ export class HttpHandler {
             res.end(`<h1>403 Forbidden</h1><p>${fwErr.message}</p>`);
             return;
         }
-        const headers = new Headers();
-        for (const [k, v] of Object.entries(req.headers)) {
-            if (Array.isArray(v)) {
-                headers.set(k, v.join(", "));
-            }
-            else if (typeof v === "string") {
-                headers.set(k, v);
-            }
-        }
-        const hopByHop = this.proxyService.getHopByHopHeaders();
-        for (const h of hopByHop) {
-            headers.delete(h);
-        }
+        const targetIp = validatedIps[0];
         const maxBodyBytes = 5 * 1024 * 1024;
         let bodyBuffer = undefined;
         if (reqMethod !== "GET" && reqMethod !== "HEAD") {
-            const chunks = [];
-            let totalSize = 0;
-            for await (const chunk of req) {
-                totalSize += chunk.length;
-                if (totalSize > maxBodyBytes) {
-                    audit.http(clientIp, reqMethod, hostname, reqUrl, 413, targetUrl.hostname);
-                    res.writeHead(413, { "Content-Type": "text/html" });
-                    res.end("<h1>413 Payload Too Large</h1>");
-                    return;
-                }
-                chunks.push(chunk);
+            try {
+                bodyBuffer = await this.readRequestBodySafe(req, maxBodyBytes, clientIp);
             }
-            if (chunks.length > 0) {
-                bodyBuffer = Buffer.concat(chunks);
+            catch (readErr) {
+                audit.http(clientIp, reqMethod, hostname, reqUrl, 413, targetUrl.hostname);
+                res.writeHead(413, { "Content-Type": "text/html", "Connection": "close" });
+                res.end("<h1>413 Payload Too Large / Read Fault</h1>");
+                if (!req.destroyed)
+                    req.destroy();
+                return;
             }
         }
-        const proxiedReqInit = {
-            method: reqMethod,
-            headers,
-        };
-        if (bodyBuffer) {
-            proxiedReqInit.body = bodyBuffer;
-            proxiedReqInit.duplex = "half";
-        }
-        const proxiedReq = new Request(targetUrl.toString(), proxiedReqInit);
-        const breaker = this.getCircuitBreaker(targetUrl.hostname);
+        const breaker = this.getCircuitBreaker(hostname);
         try {
-            const proxyResp = await breaker.execute(() => fetch(proxiedReq));
-            const outHeaders = {};
-            proxyResp.headers.forEach((value, key) => {
-                if (!hopByHop.includes(key.toLowerCase())) {
-                    outHeaders[key] = value;
-                }
-            });
-            audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, proxyResp.status, targetUrl.toString());
-            res.writeHead(proxyResp.status, outHeaders);
-            const responseBuffer = Buffer.from(await proxyResp.arrayBuffer());
-            res.end(responseBuffer);
+            await this.doHttpProxy(targetUrl, targetIp, hostname, reqMethod, req.headers, bodyBuffer, clientIp, res, breaker, targetUrl.toString());
         }
         catch (err) {
-            audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, 502, "Upstream Timeout or Fault");
+            if (err.name === 'AbortError' || err.name === 'TimeoutError' || err.message === 'TimeoutError') {
+                audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, 504, "Upstream Gateway Timeout");
+                res.writeHead(504, { "Content-Type": "text/html" });
+                res.end(`<h1>504 Gateway Timeout</h1>`);
+                return;
+            }
+            audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, 502, "Upstream Offline or Fault");
             res.writeHead(502, { "Content-Type": "text/html" });
             res.end(`<h1>502 Bad Gateway</h1>`);
         }
@@ -245,8 +298,9 @@ export class HttpHandler {
                 }
                 if (hostConfig.http_proxy?.enabled && hostConfig.http_proxy.upstream) {
                     const upstreamBase = new URL(hostConfig.http_proxy.upstream);
+                    let validatedIps = [];
                     try {
-                        await this.proxyService.validateTargetFirewall(upstreamBase.toString(), this.config.firewall);
+                        validatedIps = await this.proxyService.validateTargetFirewall(upstreamBase.toString(), this.config.firewall);
                     }
                     catch (fwErr) {
                         audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked by L3 Firewall");
@@ -254,6 +308,7 @@ export class HttpHandler {
                         res.end(`<h1>403 Forbidden</h1><p>${fwErr.message}</p>`);
                         return;
                     }
+                    const targetIp = validatedIps[0];
                     let safePath = "/";
                     try {
                         const parsedPath = new URL(reqUrl, "http://safe.local");
@@ -263,56 +318,38 @@ export class HttpHandler {
                         safePath = "/";
                     }
                     const targetUrl = new URL(safePath, upstreamBase);
-                    const headers = new Headers();
-                    for (const [k, v] of Object.entries(req.headers)) {
-                        if (Array.isArray(v)) {
-                            headers.set(k, v.join(", "));
-                        }
-                        else if (typeof v === "string") {
-                            headers.set(k, v);
+                    const originalHostname = targetUrl.hostname;
+                    const customReqHeaders = {};
+                    const customResHeaders = { "X-Proxy": "zonzon" };
+                    for (const [key, value] of Object.entries(hostConfig.http_proxy.headers)) {
+                        const sanitized = this.proxyService.sanitizeHeader(value);
+                        if (sanitized) {
+                            customReqHeaders[key] = sanitized;
+                            customResHeaders[key] = sanitized;
                         }
                     }
                     const shouldForwardBody = hostConfig.http_proxy.forwardRequestBody;
                     const maxBodyBytes = hostConfig.http_proxy.maxRequestBodyBytes ?? 5 * 1024 * 1024;
                     let bodyBuffer = undefined;
                     if (reqMethod !== "GET" && reqMethod !== "HEAD") {
-                        const chunks = [];
-                        let totalSize = 0;
-                        for await (const chunk of req) {
-                            totalSize += chunk.length;
-                            if (totalSize > maxBodyBytes) {
-                                audit.http(clientIp, reqMethod, hostname, reqUrl, 413, upstreamBase.hostname);
-                                res.writeHead(413, { "Content-Type": "text/html" });
-                                res.end("<h1>413 Payload Too Large</h1>");
-                                return;
-                            }
-                            chunks.push(chunk);
+                        try {
+                            bodyBuffer = await this.readRequestBodySafe(req, maxBodyBytes, clientIp);
                         }
-                        if (chunks.length > 0) {
-                            bodyBuffer = Buffer.concat(chunks);
+                        catch (readErr) {
+                            audit.http(clientIp, reqMethod, hostname, reqUrl, 413, upstreamBase.hostname);
+                            res.writeHead(413, { "Content-Type": "text/html", "Connection": "close" });
+                            res.end("<h1>413 Payload Too Large / Read Fault</h1>");
+                            if (!req.destroyed)
+                                req.destroy();
+                            return;
                         }
                     }
-                    const proxiedReqInit = {
-                        method: reqMethod,
-                        headers,
-                    };
                     if (shouldForwardBody && bodyBuffer) {
-                        proxiedReqInit.body = bodyBuffer;
-                        proxiedReqInit.duplex = "half";
+                        customReqHeaders["X-Body-Forwarded"] = "true";
+                        customReqHeaders["X-Body-Size"] = String(bodyBuffer.length);
                     }
-                    const proxiedReq = new Request(targetUrl.toString(), proxiedReqInit);
-                    const breaker = this.getCircuitBreaker(upstreamBase.hostname);
-                    const proxyResp = await breaker.execute(() => fetch(proxiedReq));
-                    const responseHeaders = new Headers(proxyResp.headers);
-                    this.injectCustomHeaders(responseHeaders, hostConfig);
-                    const outHeaders = {};
-                    responseHeaders.forEach((value, key) => {
-                        outHeaders[key] = value;
-                    });
-                    audit.http(clientIp, reqMethod, hostname, safePath, proxyResp.status, targetUrl.toString());
-                    res.writeHead(proxyResp.status, outHeaders);
-                    const responseBuffer = Buffer.from(await proxyResp.arrayBuffer());
-                    res.end(responseBuffer);
+                    const breaker = this.getCircuitBreaker(originalHostname);
+                    await this.doHttpProxy(targetUrl, targetIp, originalHostname, reqMethod, req.headers, shouldForwardBody ? bodyBuffer : undefined, clientIp, res, breaker, targetUrl.toString(), customReqHeaders, customResHeaders);
                     return;
                 }
             }
@@ -333,43 +370,46 @@ export class HttpHandler {
                 res.end("Forbidden");
                 return;
             }
-            const targetUrl = new URL(reqUrl, `http://${hostname}`);
-            const headers = new Headers();
-            for (const [k, v] of Object.entries(req.headers)) {
-                if (Array.isArray(v))
-                    headers.set(k, v.join(", "));
-                else if (typeof v === "string")
-                    headers.set(k, v);
+            if (firewallEngine.evaluateOutbound(targetIp, this.config.firewall) === "DENY") {
+                audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked by SSRF Policy");
+                res.writeHead(403);
+                res.end("Forbidden");
+                return;
             }
-            const proxiedReqInit = { method: reqMethod, headers };
+            const targetUrl = new URL(reqUrl, `http://${hostname}`);
+            let bodyBuffer = undefined;
             if (reqMethod !== "GET" && reqMethod !== "HEAD") {
-                const chunks = [];
-                for await (const chunk of req)
-                    chunks.push(chunk);
-                if (chunks.length > 0) {
-                    proxiedReqInit.body = Buffer.concat(chunks);
-                    proxiedReqInit.duplex = "half";
+                const maxBodyBytes = this.config.hosts[hostname]?.http_proxy?.maxRequestBodyBytes ?? 5242880;
+                try {
+                    bodyBuffer = await this.readRequestBodySafe(req, maxBodyBytes, clientIp);
+                }
+                catch (readErr) {
+                    res.writeHead(413, { "Content-Type": "text/html", "Connection": "close" });
+                    res.end("<h1>413 Payload Too Large / Read Fault</h1>");
+                    if (!req.destroyed)
+                        req.destroy();
+                    return;
                 }
             }
-            const proxiedReq = new Request(targetUrl.toString(), proxiedReqInit);
-            const breaker = this.getCircuitBreaker(targetUrl.hostname);
-            const proxyResp = await breaker.execute(() => fetch(proxiedReq));
-            const outHeaders = {};
-            proxyResp.headers.forEach((value, key) => { outHeaders[key] = value; });
-            audit.http(clientIp, reqMethod, hostname, reqUrl, proxyResp.status, targetIp);
-            res.writeHead(proxyResp.status, outHeaders);
-            res.end(Buffer.from(await proxyResp.arrayBuffer()));
+            const breaker = this.getCircuitBreaker(hostname);
+            await this.doHttpProxy(targetUrl, targetIp, hostname, reqMethod, req.headers, bodyBuffer, clientIp, res, breaker, targetIp);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             audit.error(`HTTP request failed: ${message}`);
-            if (message.includes("Security Block") || message.includes("Firewall") || message.includes("Blocked")) {
+            if (err.name === 'AbortError' || err.name === 'TimeoutError' || message === 'TimeoutError') {
+                audit.http(clientIp, reqMethod, hostname, reqUrl, 504, "Upstream Gateway Timeout");
+                res.writeHead(504, { "Content-Type": "text/html" });
+                res.end(`<h1>504 Gateway Timeout</h1>`);
+                return;
+            }
+            if (message.includes("Security Block") || message.includes("Firewall") || message.includes("Blocked") || message.includes("Restricted IP")) {
                 audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked for Security (SSRF/Firewall)");
                 res.writeHead(403, { "Content-Type": "text/html" });
                 res.end(`<h1>403 Forbidden</h1>`);
                 return;
             }
-            audit.http(clientIp, reqMethod, hostname, reqUrl, 502, "Upstream Offline/Timeout");
+            audit.http(clientIp, reqMethod, hostname, reqUrl, 502, "Upstream Offline/Fault");
             res.writeHead(502, { "Content-Type": "text/html" });
             res.end(`<h1>502 Bad Gateway</h1>`);
             return;
@@ -386,6 +426,9 @@ export class HttpHandler {
                     }
                 });
             });
+            this.server.headersTimeout = 10000;
+            this.server.requestTimeout = this.idleTimeoutMs;
+            this.server.keepAliveTimeout = 5000;
             this.server.on("connect", (req, clientSocket, head) => {
                 this.handleConnect(req, clientSocket, head).catch((err) => {
                     audit.error(`TCP CONNECT critical error: ${err}`);
@@ -410,16 +453,13 @@ export class HttpHandler {
     }
     async stop() {
         if (this.server) {
-            for (const socket of this.activeConnections) {
-                socket.destroy();
-            }
-            this.activeConnections.clear();
-            if ('closeAllConnections' in this.server) {
-                this.server.closeAllConnections();
+            if ('closeIdleConnections' in this.server) {
+                this.server.closeIdleConnections();
             }
             await new Promise((resolve) => {
                 this.server.close(() => resolve());
             });
+            this.activeConnections.clear();
             this.server = null;
         }
     }

package/dist/http-proxy.d.ts

@@ -1,7 +1,6 @@
 import { HostConfig, ProxiedRequest, ModifiedHeaders, FirewallConfig } from "./types.js";
 export declare class HttpProxyService {
-    private isRestrictedCloudMetadata;
-    validateTargetFirewall(targetUrl: string, fw?: FirewallConfig): Promise<void>;
+    validateTargetFirewall(targetUrl: string, fw?: FirewallConfig): Promise<string[]>;
     getUpstreamHeaders(config: HostConfig, originalRequest: ProxiedRequest): ModifiedHeaders;
     checkRedirect(config: HostConfig): {
         code: number;

package/dist/http-proxy.js

@@ -2,12 +2,6 @@ import * as net from "net";
 import * as dns from "dns/promises";
 import { firewallEngine } from "./firewall.js";
 export class HttpProxyService {
-    isRestrictedCloudMetadata(ip) {
-        if (!net.isIPv4(ip))
-            return false;
-        const parts = ip.split('.').map(Number);
-        return (parts[0] === 169 && parts[1] === 254) || parts[0] === 0;
-    }
     async validateTargetFirewall(targetUrl, fw) {
         const parsed = new URL(targetUrl);
         const host = parsed.hostname;
@@ -30,8 +24,11 @@ export class HttpProxyService {
                 throw new Error(`Resolution Fault: '${host}'`);
             }
         }
+        if (targetIps.length === 0) {
+            throw new Error(`NXDOMAIN: '${host}'`);
+        }
         for (const ip of targetIps) {
-            if (this.isRestrictedCloudMetadata(ip)) {
+            if (firewallEngine.evaluateOutbound(ip, fw) === "DENY") {
                 throw new Error(`Restricted IP: (${ip})`);
             }
             if (fw) {
@@ -40,6 +37,7 @@ export class HttpProxyService {
                 }
             }
         }
+        return targetIps;
     }
     getUpstreamHeaders(config, originalRequest) {
         const result = {

package/dist/rate-limiter.d.ts

@@ -1,11 +1,16 @@
 export interface RateLimiterOptions {
     maxRequests: number;
     windowMs: number;
+    maxTrackedIps?: number;
 }
 export declare class RateLimiter {
     private options;
     private buckets;
+    private gcInterval;
+    private maxTrackedIps;
     constructor(options: RateLimiterOptions);
+    private garbageCollect;
+    destroy(): void;
     allow(ip: string): boolean;
     getRequestCount(ip: string): number;
 }

package/dist/rate-limiter.js

@@ -1,33 +1,52 @@
 export class RateLimiter {
     options;
     buckets = new Map();
+    gcInterval;
+    maxTrackedIps;
     constructor(options) {
         this.options = options;
+        this.maxTrackedIps = options.maxTrackedIps ?? 100000;
+        this.gcInterval = setInterval(() => this.garbageCollect(), Math.max(options.windowMs * 2, 60000));
+        this.gcInterval.unref();
+    }
+    garbageCollect() {
+        const now = Date.now();
+        for (const [ip, bucket] of this.buckets.entries()) {
+            if (now >= bucket.resetTime) {
+                this.buckets.delete(ip);
+            }
+        }
+    }
+    destroy() {
+        clearInterval(this.gcInterval);
+        this.buckets.clear();
     }
     allow(ip) {
         const now = Date.now();
         let bucket = this.buckets.get(ip);
-        if (!bucket || now - bucket.timestamps[0] > this.options.windowMs) {
-            bucket = { timestamps: [now] };
+        if (!bucket || now >= bucket.resetTime) {
+            if (this.buckets.size >= this.maxTrackedIps) {
+                const firstKey = this.buckets.keys().next().value;
+                if (firstKey !== undefined) {
+                    this.buckets.delete(firstKey);
+                }
+            }
+            bucket = { count: 1, resetTime: now + this.options.windowMs };
             this.buckets.set(ip, bucket);
             return true;
         }
-        const windowStart = now - this.options.windowMs;
-        while (bucket.timestamps.length > 0 && bucket.timestamps[0] < windowStart) {
-            bucket.timestamps.shift();
-        }
-        if (bucket.timestamps.length >= this.options.maxRequests) {
+        if (bucket.count >= this.options.maxRequests) {
             return false;
         }
-        bucket.timestamps.push(now);
+        bucket.count++;
         return true;
     }
     getRequestCount(ip) {
         const now = Date.now();
-        const windowStart = now - this.options.windowMs;
         const bucket = this.buckets.get(ip);
-        if (!bucket)
+        if (!bucket || now >= bucket.resetTime) {
             return 0;
-        return bucket.timestamps.filter((t) => t >= windowStart).length;
+        }
+        return bucket.count;
     }
 }

package/dist/schema.js

@@ -1,8 +1,8 @@
 import { z } from "zod";
 import * as net from "net";
-const CrlfFreeString = z.string().refine((val) => !/[\r\n]/.test(val), "Contains CR/LF");
-const Ipv4Schema = z.string().refine((ip) => net.isIPv4(ip), "Invalid IPv4");
-const Ipv6Schema = z.string().refine((ip) => net.isIPv6(ip), "Invalid IPv6");
+const CrlfFreeString = z.string().max(8192).refine((val) => !/[\r\n]/.test(val), "Contains CR/LF");
+const Ipv4Schema = z.string().max(45).refine((ip) => net.isIPv4(ip), "Invalid IPv4");
+const Ipv6Schema = z.string().max(45).refine((ip) => net.isIPv6(ip), "Invalid IPv6");
 const HostnameSchema = z.string().max(253).refine((hostname) => {
     const parts = hostname.split(".");
     const hostPattern = /^[a-zA-Z0-9_]([a-zA-Z0-9_-]{0,61}[a-zA-Z0-9])?$/;
@@ -30,7 +30,7 @@ const DnsRecordSchema = z.discriminatedUnion("type", [
 const HttpProxySchema = z.object({
     enabled: z.boolean(),
     upstream: CrlfFreeString.optional(),
-    headers: z.record(z.string().regex(/^[a-zA-Z0-9\-]+$/), CrlfFreeString).default({}),
+    headers: z.record(z.string().max(256).regex(/^[a-zA-Z0-9\-]+$/), CrlfFreeString).default({}),
     forwardRequestBody: z.boolean().default(false),
     maxRequestBodyBytes: z.number().int().min(0).max(10485760).default(5242880),
 }).refine(data => !data.enabled || !!data.upstream, {
@@ -59,12 +59,19 @@ const FirewallSchema = z.object({
 const ControlPlaneSchema = z.object({
     enabled: z.boolean().default(true).optional(),
     port: z.coerce.number().int().min(1).max(65535).default(8080).optional(),
-    apiKey: z.string().optional()
+    apiKey: z.string().max(256).optional()
+});
+const TlsSchema = z.object({
+    cert: z.string().min(1),
+    key: z.string().min(1)
 });
 const ServerConfigSchema = z.object({
     port: z.coerce.number().int().min(1).max(65535).default(53),
     httpPort: z.coerce.number().int().min(1).max(65535).optional(),
     httpsPort: z.coerce.number().int().min(1).max(65535).optional(),
+    tls: TlsSchema.optional(),
+    dotPort: z.coerce.number().int().min(1).max(65535).default(853).optional(),
+    dohPort: z.coerce.number().int().min(1).max(65535).default(8443).optional(),
     fallbackDns: Ipv4Schema.optional(),
     firewall: FirewallSchema.optional(),
     controlPlane: ControlPlaneSchema.optional(),
@@ -74,7 +81,7 @@ const ServerConfigSchema = z.object({
     tcpIdleTimeoutMs: z.coerce.number().int().min(1000).max(600000).default(30000),
     rateLimitMaxRequests: z.coerce.number().int().min(0).max(100000).default(0),
     rateLimitWindowMs: z.coerce.number().int().min(100).max(60000).default(1000),
-    hosts: z.record(z.string(), HostConfigSchema).default({}),
+    hosts: z.record(z.string().max(253), HostConfigSchema).default({}),
 }).refine(data => {
     for (const key of Object.keys(data.hosts)) {
         const normalized = key.toLowerCase();

package/dist/sni-proxy.d.ts

@@ -4,6 +4,7 @@ export declare class SniProxyService {
     private config;
     private server;
     private activeConnections;
+    private idleTimeoutMs;
     constructor(config: ServerConfig, port?: number);
     private extractSNI;
     private handleConnection;