@push.rocks/smartproxy 3.22.0 → 3.22.3

package/ts/classes.portproxy.ts

@@ -23,7 +23,6 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
   globalPortRanges: Array<{ from: number; to: number }>; // Global allowed port ranges
   forwardAllGlobalRanges?: boolean; // When true, forwards all connections on global port ranges to the global targetIP
   gracefulShutdownTimeout?: number; // (ms) maximum time to wait for connections to close during shutdown
-  initialDataTimeout?: number; // (ms) timeout for receiving initial data, useful for chained proxies
 }
 
 /**
@@ -90,25 +89,24 @@ function extractSNI(buffer: Buffer): string | undefined {
 }
 
 interface IConnectionRecord {
+  id: string;                       // Unique connection identifier
   incoming: plugins.net.Socket;
   outgoing: plugins.net.Socket | null;
   incomingStartTime: number;
   outgoingStartTime?: number;
   outgoingClosedTime?: number;
-  lockedDomain?: string; // Field to lock this connection to the initial SNI
-  connectionClosed: boolean;
-  cleanupTimer?: NodeJS.Timeout; // Timer to force cleanup after max lifetime/inactivity
-  cleanupInitiated: boolean; // Flag to track if cleanup has been initiated but not completed
-  id: string; // Unique identifier for the connection
-  lastActivity: number; // Timestamp of last activity on either socket
+  lockedDomain?: string;            // Used to lock this connection to the initial SNI
+  connectionClosed: boolean;        // Flag to prevent multiple cleanup attempts
+  cleanupTimer?: NodeJS.Timeout;    // Timer for max lifetime/inactivity
+  lastActivity: number;             // Last activity timestamp for inactivity detection
 }
 
-// Helper: Check if a port falls within any of the given port ranges.
+// Helper: Check if a port falls within any of the given port ranges
 const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
   return ranges.some(range => port >= range.from && port <= range.to);
 };
 
-// Helper: Check if a given IP matches any of the glob patterns.
+// Helper: Check if a given IP matches any of the glob patterns
 const isAllowed = (ip: string, patterns: string[]): boolean => {
   const normalizeIP = (ip: string): string[] => {
     if (ip.startsWith('::ffff:')) {
@@ -127,13 +125,13 @@ const isAllowed = (ip: string, patterns: string[]): boolean => {
   );
 };
 
-// Helper: Check if an IP is allowed considering allowed and blocked glob patterns.
+// Helper: Check if an IP is allowed considering allowed and blocked glob patterns
 const isGlobIPAllowed = (ip: string, allowed: string[], blocked: string[] = []): boolean => {
   if (blocked.length > 0 && isAllowed(ip, blocked)) return false;
   return isAllowed(ip, allowed);
 };
 
-// Helper: Generate a unique ID for a connection
+// Helper: Generate a unique connection ID
 const generateConnectionId = (): string => {
   return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
 };
@@ -141,12 +139,11 @@ const generateConnectionId = (): string => {
 export class PortProxy {
   private netServers: plugins.net.Server[] = [];
   settings: IPortProxySettings;
-  // Unified record tracking each connection pair.
   private connectionRecords: Map<string, IConnectionRecord> = new Map();
   private connectionLogger: NodeJS.Timeout | null = null;
   private isShuttingDown: boolean = false;
 
-  // Map to track round robin indices for each domain config.
+  // Map to track round robin indices for each domain config
   private domainTargetIndices: Map<IDomainConfig, number> = new Map();
 
   private terminationStats: {
@@ -164,9 +161,6 @@ export class PortProxy {
       maxConnectionLifetime: settingsArg.maxConnectionLifetime || 600000,
       gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000,
     };
-    
-    // Debug logging for constructor settings
-    console.log(`PortProxy initialized with targetIP: ${this.settings.targetIP}, toPort: ${this.settings.toPort}, fromPort: ${this.settings.fromPort}, sniEnabled: ${this.settings.sniEnabled}`);
   }
 
   private incrementTerminationStat(side: 'incoming' | 'outgoing', reason: string): void {
@@ -174,77 +168,64 @@ export class PortProxy {
   }
 
   /**
-   * Initiates the cleanup process for a connection.
-   * Sets the flag to prevent duplicate cleanup attempts and schedules actual cleanup.
-   */
-  private initiateCleanup(record: IConnectionRecord, reason: string = 'normal'): void {
-    if (record.cleanupInitiated) return;
-    
-    record.cleanupInitiated = true;
-    const remoteIP = record.incoming.remoteAddress || 'unknown';
-    console.log(`Initiating cleanup for connection ${record.id} from ${remoteIP} (reason: ${reason})`);
-    
-    // Execute cleanup immediately to prevent lingering connections
-    this.executeCleanup(record);
-  }
-
-  /**
-   * Executes the actual cleanup of a connection.
-   * Destroys sockets, clears timers, and removes the record.
+   * Cleans up a connection record.
+   * Destroys both incoming and outgoing sockets, clears timers, and removes the record.
+   * @param record - The connection record to clean up
+   * @param reason - Optional reason for cleanup (for logging)
    */
-  private executeCleanup(record: IConnectionRecord): void {
-    if (record.connectionClosed) return;
-    
-    record.connectionClosed = true;
-    const remoteIP = record.incoming.remoteAddress || 'unknown';
-    
-    if (record.cleanupTimer) {
-      clearTimeout(record.cleanupTimer);
-      record.cleanupTimer = undefined;
-    }
-    
-    // End the sockets first to allow for graceful closure
-    try {
-      if (!record.incoming.destroyed) {
-        record.incoming.end();
-        // Set a safety timeout to force destroy if end doesn't complete
-        setTimeout(() => {
-          if (!record.incoming.destroyed) {
-            console.log(`Forcing destruction of incoming socket for ${remoteIP}`);
-            record.incoming.destroy();
-          }
-        }, 1000);
-      }
-    } catch (err) {
-      console.error(`Error ending incoming socket for ${remoteIP}:`, err);
-      if (!record.incoming.destroyed) {
-        record.incoming.destroy();
+  private cleanupConnection(record: IConnectionRecord, reason: string = 'normal'): void {
+    if (!record.connectionClosed) {
+      record.connectionClosed = true;
+      
+      if (record.cleanupTimer) {
+        clearTimeout(record.cleanupTimer);
+        record.cleanupTimer = undefined;
       }
-    }
-
-    try {
-      if (record.outgoing && !record.outgoing.destroyed) {
-        record.outgoing.end();
-        // Set a safety timeout to force destroy if end doesn't complete
-        setTimeout(() => {
-          if (record.outgoing && !record.outgoing.destroyed) {
-            console.log(`Forcing destruction of outgoing socket for ${remoteIP}`);
-            record.outgoing.destroy();
-          }
-        }, 1000);
+      
+      try {
+        if (!record.incoming.destroyed) {
+          // Try graceful shutdown first, then force destroy after a short timeout
+          record.incoming.end();
+          setTimeout(() => {
+            if (record && !record.incoming.destroyed) {
+              record.incoming.destroy();
+            }
+          }, 1000);
+        }
+      } catch (err) {
+        console.log(`Error closing incoming socket: ${err}`);
+        if (!record.incoming.destroyed) {
+          record.incoming.destroy();
+        }
       }
-    } catch (err) {
-      console.error(`Error ending outgoing socket for ${remoteIP}:`, err);
-      if (record.outgoing && !record.outgoing.destroyed) {
-        record.outgoing.destroy();
+      
+      try {
+        if (record.outgoing && !record.outgoing.destroyed) {
+          // Try graceful shutdown first, then force destroy after a short timeout
+          record.outgoing.end();
+          setTimeout(() => {
+            if (record && record.outgoing && !record.outgoing.destroyed) {
+              record.outgoing.destroy();
+            }
+          }, 1000);
+        }
+      } catch (err) {
+        console.log(`Error closing outgoing socket: ${err}`);
+        if (record.outgoing && !record.outgoing.destroyed) {
+          record.outgoing.destroy();
+        }
       }
+      
+      // Remove the record from the tracking map
+      this.connectionRecords.delete(record.id);
+      
+      const remoteIP = record.incoming.remoteAddress || 'unknown';
+      console.log(`Connection from ${remoteIP} terminated (${reason}). Active connections: ${this.connectionRecords.size}`);
     }
+  }
 
-    // Remove the record after a delay to ensure all events have propagated
-    setTimeout(() => {
-      this.connectionRecords.delete(record.id);
-      console.log(`Connection ${record.id} from ${remoteIP} fully cleaned up. Active connections: ${this.connectionRecords.size}`);
-    }, 2000);
+  private updateActivity(record: IConnectionRecord): void {
+    record.lastActivity = Date.now();
   }
 
   private getTargetIP(domainConfig: IDomainConfig): string {
@@ -257,27 +238,6 @@ export class PortProxy {
     return this.settings.targetIP!;
   }
 
-  /**
-   * Updates the last activity timestamp for a connection record
-   */
-  private updateActivity(record: IConnectionRecord): void {
-    record.lastActivity = Date.now();
-    
-    // Reset the inactivity timer if one is set
-    if (this.settings.maxConnectionLifetime && record.cleanupTimer) {
-      clearTimeout(record.cleanupTimer);
-      
-      // Set a new cleanup timer
-      record.cleanupTimer = setTimeout(() => {
-        const now = Date.now();
-        const inactivityTime = now - record.lastActivity;
-        const remoteIP = record.incoming.remoteAddress || 'unknown';
-        console.log(`Connection ${record.id} from ${remoteIP} exceeded max lifetime or inactivity period (${inactivityTime}ms), forcing cleanup.`);
-        this.initiateCleanup(record, 'timeout');
-      }, this.settings.maxConnectionLifetime);
-    }
-  }
-
   public async start() {
     // Define a unified connection handler for all listening ports.
     const connectionHandler = (socket: plugins.net.Socket) => {
@@ -297,23 +257,28 @@ export class PortProxy {
         outgoing: null,
         incomingStartTime: Date.now(),
         lastActivity: Date.now(),
-        connectionClosed: false,
-        cleanupInitiated: false
+        connectionClosed: false
       };
-
       this.connectionRecords.set(connectionId, connectionRecord);
-      console.log(`New connection ${connectionId} from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`);
+      
+      console.log(`New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`);
 
       let initialDataReceived = false;
       let incomingTerminationReason: string | null = null;
       let outgoingTerminationReason: string | null = null;
 
-      // Local cleanup function that delegates to the class method.
+      // Local function for cleanupOnce
+      const cleanupOnce = () => {
+        this.cleanupConnection(connectionRecord);
+      };
+      
+      // Define initiateCleanupOnce for compatibility with potential future improvements
       const initiateCleanupOnce = (reason: string = 'normal') => {
-        this.initiateCleanup(connectionRecord, reason);
+        console.log(`Connection cleanup initiated for ${remoteIP} (${reason})`);
+        cleanupOnce();
       };
 
-      // Helper to reject an incoming connection.
+      // Helper to reject an incoming connection
       const rejectIncomingConnection = (reason: string, logMessage: string) => {
         console.log(logMessage);
         socket.end();
@@ -321,55 +286,25 @@ export class PortProxy {
           incomingTerminationReason = reason;
           this.incrementTerminationStat('incoming', reason);
         }
-        initiateCleanupOnce(reason);
+        cleanupOnce();
       };
 
-      // Set an initial timeout only if SNI is enabled or this is not a chained proxy
-      // For chained proxies, we need to allow more time for data to flow through
-      const initialTimeoutMs = this.settings.initialDataTimeout || 
-                             (this.settings.sniEnabled ? 15000 : 0); // Increased timeout for SNI, disabled for non-SNI by default
-      
+      // Set an initial timeout for SNI data if needed
       let initialTimeout: NodeJS.Timeout | null = null;
-      
-      if (initialTimeoutMs > 0) {
-        console.log(`Setting initial data timeout of ${initialTimeoutMs}ms for connection from ${remoteIP}`);
+      if (this.settings.sniEnabled) {
         initialTimeout = setTimeout(() => {
           if (!initialDataReceived) {
-            console.log(`Initial connection timeout for ${remoteIP} (no data received after ${initialTimeoutMs}ms)`);
-            if (incomingTerminationReason === null) {
-              incomingTerminationReason = 'initial_timeout';
-              this.incrementTerminationStat('incoming', 'initial_timeout');
-            }
-            initiateCleanupOnce('initial_timeout');
+            console.log(`Initial data timeout for ${remoteIP}`);
+            socket.end();
+            cleanupOnce();
           }
-        }, initialTimeoutMs);
+        }, 5000);
       } else {
-        console.log(`No initial timeout set for connection from ${remoteIP} (likely chained proxy)`);
-        // Mark as received immediately if we're not waiting for data
         initialDataReceived = true;
       }
 
       socket.on('error', (err: Error) => {
-        const errorMessage = initialDataReceived
-          ? `(Immediate) Incoming socket error from ${remoteIP}: ${err.message}`
-          : `(Premature) Incoming socket error from ${remoteIP} before data received: ${err.message}`;
-        console.log(errorMessage);
-        
-        // Clear the initial timeout if it exists
-        if (initialTimeout) {
-          clearTimeout(initialTimeout);
-          initialTimeout = null;
-        }
-        
-        // For premature errors, we need to handle them explicitly 
-        // since the standard error handlers might not be set up yet
-        if (!initialDataReceived) {
-          if (incomingTerminationReason === null) {
-            incomingTerminationReason = 'premature_error';
-            this.incrementTerminationStat('incoming', 'premature_error');
-          }
-          initiateCleanupOnce('premature_error');
-        }
+        console.log(`Incoming socket error from ${remoteIP}: ${err.message}`);
       });
 
       const handleError = (side: 'incoming' | 'outgoing') => (err: Error) => {
@@ -378,13 +313,9 @@ export class PortProxy {
         if (code === 'ECONNRESET') {
           reason = 'econnreset';
           console.log(`ECONNRESET on ${side} side from ${remoteIP}: ${err.message}`);
-        } else if (code === 'ECONNREFUSED') {
-          reason = 'econnrefused';
-          console.log(`ECONNREFUSED on ${side} side from ${remoteIP}: ${err.message}`);
         } else {
           console.log(`Error on ${side} side from ${remoteIP}: ${err.message}`);
         }
-        
         if (side === 'incoming' && incomingTerminationReason === null) {
           incomingTerminationReason = reason;
           this.incrementTerminationStat('incoming', reason);
@@ -392,13 +323,11 @@ export class PortProxy {
           outgoingTerminationReason = reason;
           this.incrementTerminationStat('outgoing', reason);
         }
-        
         initiateCleanupOnce(reason);
       };
 
       const handleClose = (side: 'incoming' | 'outgoing') => () => {
         console.log(`Connection closed on ${side} side from ${remoteIP}`);
-        
         if (side === 'incoming' && incomingTerminationReason === null) {
           incomingTerminationReason = 'normal';
           this.incrementTerminationStat('incoming', 'normal');
@@ -407,24 +336,8 @@ export class PortProxy {
           this.incrementTerminationStat('outgoing', 'normal');
           // Record the time when outgoing socket closed.
           connectionRecord.outgoingClosedTime = Date.now();
-          
-          // If incoming is still active but outgoing closed, set a shorter timeout
-          if (!connectionRecord.incoming.destroyed) {
-            console.log(`Outgoing socket closed but incoming still active for ${remoteIP}. Setting cleanup timeout.`);
-            setTimeout(() => {
-              if (!connectionRecord.connectionClosed && !connectionRecord.incoming.destroyed) {
-                console.log(`Incoming socket still active ${Date.now() - connectionRecord.outgoingClosedTime!}ms after outgoing closed for ${remoteIP}. Cleaning up.`);
-                initiateCleanupOnce('outgoing_closed_timeout');
-              }
-            }, 10000); // 10 second timeout instead of waiting for the next parity check
-          }
-        }
-        
-        // If both sides are closed/destroyed, clean up
-        if ((side === 'incoming' && connectionRecord.outgoing?.destroyed) || 
-            (side === 'outgoing' && connectionRecord.incoming.destroyed)) {
-          initiateCleanupOnce('both_closed');
         }
+        initiateCleanupOnce('closed_' + side);
       };
 
       /**
@@ -438,6 +351,7 @@ export class PortProxy {
         // Clear the initial timeout since we've received data
         if (initialTimeout) {
           clearTimeout(initialTimeout);
+          initialTimeout = null;
         }
         
         // If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
@@ -447,35 +361,25 @@ export class PortProxy {
               config.domains.some(d => plugins.minimatch(serverName, d))
             ) : undefined);
 
-        // Effective IP check: merge allowed IPs with default allowed, and remove blocked IPs.
-        // In a chained proxy, relax IP validation unless explicitly configured
-        // If this is the first proxy in the chain, normal validation applies
+        // IP validation is skipped if allowedIPs is empty
         if (domainConfig) {
-          // Has specific domain config - check IP restrictions only if allowedIPs is non-empty
-          if (domainConfig.allowedIPs.length > 0) {
-            const effectiveAllowedIPs: string[] = [
-              ...domainConfig.allowedIPs,
-              ...(this.settings.defaultAllowedIPs || [])
-            ];
-            const effectiveBlockedIPs: string[] = [
-              ...(domainConfig.blockedIPs || []),
-              ...(this.settings.defaultBlockedIPs || [])
-            ];
-            if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
-              return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(', ')}`);
-            }
-          } else {
-            console.log(`Domain config for ${domainConfig.domains.join(', ')} has empty allowedIPs, skipping IP validation`);
+          const effectiveAllowedIPs: string[] = [
+            ...domainConfig.allowedIPs,
+            ...(this.settings.defaultAllowedIPs || [])
+          ];
+          const effectiveBlockedIPs: string[] = [
+            ...(domainConfig.blockedIPs || []),
+            ...(this.settings.defaultBlockedIPs || [])
+          ];
+          
+          // Skip IP validation if allowedIPs is empty
+          if (domainConfig.allowedIPs.length > 0 && !isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
+            return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(', ')}`);
           }
         } else if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
-          // No domain config but has default IP restrictions
           if (!isGlobIPAllowed(remoteIP, this.settings.defaultAllowedIPs, this.settings.defaultBlockedIPs || [])) {
             return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed by default allowed list`);
           }
-        } else {
-          // No domain config and no default allowed IPs
-          // In a chained proxy setup, we'll allow this connection 
-          console.log(`No specific IP restrictions found for ${remoteIP}. Allowing connection in potential chained proxy setup.`);
         }
 
         const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
@@ -487,116 +391,57 @@ export class PortProxy {
           connectionOptions.localAddress = remoteIP.replace('::ffff:', '');
         }
 
-        // Add explicit connection timeout and error handling
-        let connectionTimeout: NodeJS.Timeout | null = null;
-        let connectionSucceeded = false;
-        
-        // Set connection timeout - longer for chained proxies
-        connectionTimeout = setTimeout(() => {
-          if (!connectionSucceeded) {
-            console.log(`Connection timeout connecting to ${targetHost}:${connectionOptions.port} for ${remoteIP}`);
-            if (outgoingTerminationReason === null) {
-              outgoingTerminationReason = 'connection_timeout';
-              this.incrementTerminationStat('outgoing', 'connection_timeout');
-            }
-            initiateCleanupOnce('connection_timeout');
-          }
-        }, 10000); // Increased from 5s to 10s to accommodate chained proxies
-
-        console.log(`Attempting to connect to ${targetHost}:${connectionOptions.port} for client ${remoteIP}...`);
-        
-        // Create the target socket
+        // Create the target socket and immediately set up data piping
         const targetSocket = plugins.net.connect(connectionOptions);
         connectionRecord.outgoing = targetSocket;
+        connectionRecord.outgoingStartTime = Date.now();
         
-        // Handle successful connection
-        targetSocket.once('connect', () => {
-          connectionSucceeded = true;
-          if (connectionTimeout) {
-            clearTimeout(connectionTimeout);
-            connectionTimeout = null;
-          }
-          
-          connectionRecord.outgoingStartTime = Date.now();
-          console.log(
-            `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-            `${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}`
-          );
-
-          // Setup data flow after confirmed connection
-          setupDataFlow(targetSocket, initialChunk);
-        });
-
-        // Handle connection errors early
-        targetSocket.once('error', (err) => {
-          if (!connectionSucceeded) {
-            // This is an initial connection error
-            console.log(`Failed to connect to ${targetHost}:${connectionOptions.port} for ${remoteIP}: ${err.message}`);
-            if (connectionTimeout) {
-              clearTimeout(connectionTimeout);
-              connectionTimeout = null;
-            }
-            if (outgoingTerminationReason === null) {
-              outgoingTerminationReason = 'connection_failed';
-              this.incrementTerminationStat('outgoing', 'connection_failed');
-            }
-            initiateCleanupOnce('connection_failed');
-          }
-          // Other errors will be handled by the main error handler
-        });
-      };
-
-      /**
-       * Sets up the data flow between sockets after successful connection
-       */
-      const setupDataFlow = (targetSocket: plugins.net.Socket, initialChunk?: Buffer) => {
+        // Set up the pipe immediately to ensure data flows without delay
         if (initialChunk) {
           socket.unshift(initialChunk);
         }
         
-        // Set appropriate timeouts for both sockets
-        socket.setTimeout(120000);
-        targetSocket.setTimeout(120000);
-        
-        // Set up the pipe in both directions
         socket.pipe(targetSocket);
         targetSocket.pipe(socket);
+        
+        console.log(
+          `Connection established: ${remoteIP} -> ${targetHost}:${connectionOptions.port}` +
+          `${serverName ? ` (SNI: ${serverName})` : forcedDomain ? ` (Port-based for domain: ${forcedDomain.domains.join(', ')})` : ''}`
+        );
 
-        // Attach error and close handlers
+        // Add appropriate handlers for connection management
         socket.on('error', handleError('incoming'));
         targetSocket.on('error', handleError('outgoing'));
         socket.on('close', handleClose('incoming'));
         targetSocket.on('close', handleClose('outgoing'));
-        
-        // Handle timeout events
         socket.on('timeout', () => {
           console.log(`Timeout on incoming side from ${remoteIP}`);
           if (incomingTerminationReason === null) {
             incomingTerminationReason = 'timeout';
             this.incrementTerminationStat('incoming', 'timeout');
           }
-          initiateCleanupOnce('timeout');
+          initiateCleanupOnce('timeout_incoming');
         });
-        
         targetSocket.on('timeout', () => {
           console.log(`Timeout on outgoing side from ${remoteIP}`);
           if (outgoingTerminationReason === null) {
             outgoingTerminationReason = 'timeout';
             this.incrementTerminationStat('outgoing', 'timeout');
           }
-          initiateCleanupOnce('timeout');
+          initiateCleanupOnce('timeout_outgoing');
         });
-        
-        socket.on('end', handleClose('incoming'));
-        targetSocket.on('end', handleClose('outgoing'));
 
-        // Track activity for both sockets to reset inactivity timers
-        socket.on('data', (data) => {
-          this.updateActivity(connectionRecord);
+        // Set appropriate timeouts
+        socket.setTimeout(120000);
+        targetSocket.setTimeout(120000);
+        
+        // Update activity for both sockets
+        socket.on('data', () => {
+          connectionRecord.lastActivity = Date.now();
         });
         
-        targetSocket.on('data', (data) => {
-          this.updateActivity(connectionRecord);
+        targetSocket.on('data', () => {
+          connectionRecord.lastActivity = Date.now();
         });
 
         // Initialize a cleanup timer for max connection lifetime
@@ -615,7 +460,6 @@ export class PortProxy {
           if (this.settings.defaultAllowedIPs && !isAllowed(remoteIP, this.settings.defaultAllowedIPs)) {
             console.log(`Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`);
             socket.end();
-            initiateCleanupOnce('rejected');
             return;
           }
           console.log(`Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`);
@@ -644,7 +488,6 @@ export class PortProxy {
             if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
               console.log(`Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(', ')} on port ${localPort}.`);
               socket.end();
-              initiateCleanupOnce('rejected');
               return;
             }
             console.log(`Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(', ')}.`);
@@ -657,14 +500,8 @@ export class PortProxy {
 
       // --- FALLBACK: SNI-BASED HANDLING (or default when SNI is disabled) ---
       if (this.settings.sniEnabled) {
-        // If using SNI, we need to wait for data to establish the connection
-        if (initialDataReceived) {
-          console.log(`Initial data already marked as received for ${remoteIP}, but SNI is enabled. This is unexpected.`);
-        }
-        
         initialDataReceived = false;
-        
-        console.log(`Waiting for TLS ClientHello from ${remoteIP} to extract SNI...`);
+
         socket.once('data', (chunk: Buffer) => {
           if (initialTimeout) {
             clearTimeout(initialTimeout);
@@ -672,23 +509,10 @@ export class PortProxy {
           }
           
           initialDataReceived = true;
-          console.log(`Received initial data from ${remoteIP}, length: ${chunk.length} bytes`);
-          
-          let serverName = '';
-          try {
-            // Only try to extract SNI if the chunk looks like a TLS ClientHello
-            if (chunk.length > 5 && chunk.readUInt8(0) === 22) {
-              serverName = extractSNI(chunk) || '';
-              console.log(`Extracted SNI: "${serverName}" from connection ${remoteIP}`);
-            } else {
-              console.log(`Data from ${remoteIP} doesn't appear to be a TLS ClientHello. First byte: ${chunk.length > 0 ? chunk.readUInt8(0) : 'N/A'}`);
-            }
-          } catch (err) {
-            console.log(`Error extracting SNI from chunk: ${err}. Proceeding without SNI.`);
-          }
-          
+          const serverName = extractSNI(chunk) || '';
           // Lock the connection to the negotiated SNI.
           connectionRecord.lockedDomain = serverName;
+          console.log(`Received connection from ${remoteIP} with SNI: ${serverName}`);
           
           // Delay adding the renegotiation listener until the next tick,
           // so the initial ClientHello is not reprocessed.
@@ -714,23 +538,10 @@ export class PortProxy {
           setupConnection(serverName, chunk);
         });
       } else {
-        // Non-SNI mode: we can proceed immediately without waiting for data
-        if (initialTimeout) {
-          clearTimeout(initialTimeout);
-          initialTimeout = null;
-        }
-        
         initialDataReceived = true;
-        console.log(`SNI disabled for connection from ${remoteIP}, proceeding directly to connection setup`);
-        
-        // Check IP restrictions only if explicitly configured
-        if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
-          if (!isAllowed(remoteIP, this.settings.defaultAllowedIPs)) {
-            return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`);
-          }
+        if (!this.settings.defaultAllowedIPs || this.settings.defaultAllowedIPs.length === 0 || !isAllowed(remoteIP, this.settings.defaultAllowedIPs)) {
+          return rejectIncomingConnection('rejected', `Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`);
         }
-        
-        // Proceed with connection setup
         setupConnection('');
       }
     };
@@ -764,7 +575,7 @@ export class PortProxy {
       this.netServers.push(server);
     }
 
-    // Log active connection count, run parity checks, and check for connection issues every 10 seconds.
+    // Log active connection count, longest running durations, and run parity checks every 10 seconds.
     this.connectionLogger = setInterval(() => {
       if (this.isShuttingDown) return;
       
@@ -784,25 +595,23 @@ export class PortProxy {
           maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
         }
         
-        // Parity check: if outgoing socket closed and incoming remains active for >30 seconds, trigger cleanup
+        // Parity check: if outgoing socket closed and incoming remains active
         if (record.outgoingClosedTime && 
             !record.incoming.destroyed && 
             !record.connectionClosed && 
-            !record.cleanupInitiated && 
             (now - record.outgoingClosedTime > 30000)) {
           const remoteIP = record.incoming.remoteAddress || 'unknown';
-          console.log(`Parity check triggered: Incoming socket for ${remoteIP} has been active >30s after outgoing closed.`);
-          this.initiateCleanup(record, 'parity_check');
+          console.log(`Parity check: Incoming socket for ${remoteIP} still active ${plugins.prettyMs(now - record.outgoingClosedTime)} after outgoing closed.`);
+          this.cleanupConnection(record, 'parity_check');
         }
         
-        // Inactivity check: if no activity for a long time but sockets still open
+        // Inactivity check
         const inactivityTime = now - record.lastActivity;
         if (inactivityTime > 180000 && // 3 minutes
-            !record.connectionClosed && 
-            !record.cleanupInitiated) {
+            !record.connectionClosed) {
           const remoteIP = record.incoming.remoteAddress || 'unknown';
-          console.log(`Inactivity check triggered: No activity on connection from ${remoteIP} for ${plugins.prettyMs(inactivityTime)}.`);
-          this.initiateCleanup(record, 'inactivity');
+          console.log(`Inactivity check: No activity on connection from ${remoteIP} for ${plugins.prettyMs(inactivityTime)}.`);
+          this.cleanupConnection(record, 'inactivity');
         }
       }
       
@@ -837,14 +646,14 @@ export class PortProxy {
     await Promise.all(closeServerPromises);
     console.log("All servers closed. Cleaning up active connections...");
     
-    // Gracefully close active connections
+    // Clean up active connections
     const connectionIds = [...this.connectionRecords.keys()];
     console.log(`Cleaning up ${connectionIds.length} active connections...`);
     
     for (const id of connectionIds) {
       const record = this.connectionRecords.get(id);
-      if (record && !record.connectionClosed && !record.cleanupInitiated) {
-        this.initiateCleanup(record, 'shutdown');
+      if (record && !record.connectionClosed) {
+        this.cleanupConnection(record, 'shutdown');
       }
     }