@push.rocks/smartproxy 3.31.2 → 3.32.1

package/ts/classes.portproxy.ts

@@ -56,6 +56,19 @@ export interface IPortProxySettings extends plugins.tls.TlsOptions {
 
   // NetworkProxy integration
   networkProxies?: NetworkProxy[]; // Array of NetworkProxy instances to use for TLS termination
+  
+  // New settings for chained proxy configurations and TLS handling
+  isChainedProxy?: boolean;  // Whether this proxy is part of a proxy chain (detected automatically if unspecified)
+  chainPosition?: 'first' | 'middle' | 'last'; // Position in the proxy chain (affects TLS handling)
+  aggressiveTlsRefresh?: boolean; // Use more aggressive TLS refresh timeouts (default: true for chained)
+  
+  // TLS session cache configuration
+  tlsSessionCache?: {
+    enabled?: boolean;     // Whether to use the TLS session cache (default: true)
+    maxEntries?: number;   // Maximum cache entries (default: 10000)
+    expiryTime?: number;   // Session expiry time in ms (default: 24h)
+    cleanupInterval?: number; // Cache cleanup interval in ms (default: 10min)
+  };
 }
 
 /**
@@ -87,6 +100,8 @@ interface IConnectionRecord {
 
   // Keep-alive tracking
   hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
+  incomingKeepAliveEnabled?: boolean; // Whether keep-alive is enabled on incoming socket
+  outgoingKeepAliveEnabled?: boolean; // Whether keep-alive is enabled on outgoing socket
   inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
   incomingTerminationReason?: string | null; // Reason for incoming termination
   outgoingTerminationReason?: string | null; // Reason for outgoing termination
@@ -108,49 +123,254 @@ interface ITlsSessionInfo {
   sessionId?: Buffer;     // The TLS session ID (if available)
   ticketId?: string;      // Session ticket identifier for newer TLS versions
   ticketTimestamp: number; // When this session was recorded
+  lastAccessed?: number;  // When this session was last accessed
+  accessCount?: number;   // How many times this session has been used
 }
 
-// Global cache of TLS session IDs to SNI domains
-// This ensures resumed sessions maintain their SNI binding
-const tlsSessionCache = new Map<string, ITlsSessionInfo>();
+/**
+ * Configuration for TLS session cache
+ */
+interface ITlsSessionCacheConfig {
+  maxEntries: number;        // Maximum number of entries to keep in the cache
+  expiryTime: number;        // Time in ms before sessions expire (default: 24 hours)
+  cleanupInterval: number;   // Interval in ms to run cleanup (default: 10 minutes)
+  enabled: boolean;          // Whether session caching is enabled
+}
 
-// Reference to session cleanup timer so we can clear it
-let tlsSessionCleanupTimer: NodeJS.Timeout | null = null;
+// Default configuration for session cache with relaxed timeouts
+const DEFAULT_SESSION_CACHE_CONFIG: ITlsSessionCacheConfig = {
+  maxEntries: 20000,          // Default max 20,000 entries (doubled)
+  expiryTime: 7 * 24 * 60 * 60 * 1000, // 7 days default (increased from 24 hours)
+  cleanupInterval: 30 * 60 * 1000, // Clean up every 30 minutes (relaxed from 10 minutes)
+  enabled: true               // Enabled by default
+};
 
-// Start the cleanup timer for session cache
-function startSessionCleanupTimer() {
-  // Avoid creating multiple timers
-  if (tlsSessionCleanupTimer) {
-    clearInterval(tlsSessionCleanupTimer);
+// Enhanced TLS session cache with size limits and better performance
+class TlsSessionCache {
+  private cache = new Map<string, ITlsSessionInfo>();
+  private config: ITlsSessionCacheConfig;
+  private cleanupTimer: NodeJS.Timeout | null = null;
+  private lastCleanupTime: number = 0;
+  private cacheStats = {
+    hits: 0,
+    misses: 0,
+    expirations: 0,
+    evictions: 0,
+    total: 0
+  };
+
+  constructor(config?: Partial<ITlsSessionCacheConfig>) {
+    this.config = { ...DEFAULT_SESSION_CACHE_CONFIG, ...config };
+    this.startCleanupTimer();
   }
-  
-  // Create new cleanup timer
-  tlsSessionCleanupTimer = setInterval(() => {
+
+  /**
+   * Get a session from the cache
+   */
+  public get(key: string): ITlsSessionInfo | undefined {
+    // Skip if cache is disabled
+    if (!this.config.enabled) return undefined;
+
+    const entry = this.cache.get(key);
+    
+    if (entry) {
+      // Update access information
+      entry.lastAccessed = Date.now();
+      entry.accessCount = (entry.accessCount || 0) + 1;
+      this.cache.set(key, entry);
+      this.cacheStats.hits++;
+      return entry;
+    }
+    
+    this.cacheStats.misses++;
+    return undefined;
+  }
+
+  /**
+   * Check if the cache has a key
+   */
+  public has(key: string): boolean {
+    // Skip if cache is disabled
+    if (!this.config.enabled) return false;
+    
+    const exists = this.cache.has(key);
+    if (exists) {
+      const entry = this.cache.get(key)!;
+      
+      // Check if entry has expired
+      if (Date.now() - entry.ticketTimestamp > this.config.expiryTime) {
+        this.cache.delete(key);
+        this.cacheStats.expirations++;
+        return false;
+      }
+      
+      // Update last accessed time
+      entry.lastAccessed = Date.now();
+      this.cache.set(key, entry);
+    }
+    
+    return exists;
+  }
+
+  /**
+   * Set a session in the cache
+   */
+  public set(key: string, value: ITlsSessionInfo): void {
+    // Skip if cache is disabled
+    if (!this.config.enabled) return;
+    
+    // Ensure timestamps are set
+    const entry = {
+      ...value,
+      lastAccessed: Date.now(),
+      accessCount: 0
+    };
+
+    // Check if we need to evict entries
+    if (!this.cache.has(key) && this.cache.size >= this.config.maxEntries) {
+      this.evictOldest();
+    }
+
+    this.cache.set(key, entry);
+    this.cacheStats.total = this.cache.size;
+    
+    // Run cleanup if it's been a while
+    const timeSinceCleanup = Date.now() - this.lastCleanupTime;
+    if (timeSinceCleanup > this.config.cleanupInterval * 2) {
+      this.cleanup();
+    }
+  }
+
+  /**
+   * Delete a session from the cache
+   */
+  public delete(key: string): boolean {
+    return this.cache.delete(key);
+  }
+
+  /**
+   * Clear the entire cache
+   */
+  public clear(): void {
+    this.cache.clear();
+    this.cacheStats.total = 0;
+  }
+
+  /**
+   * Get cache statistics
+   */
+  public getStats(): any {
+    return {
+      ...this.cacheStats,
+      size: this.cache.size,
+      enabled: this.config.enabled,
+      maxEntries: this.config.maxEntries,
+      expiryTimeHours: this.config.expiryTime / (60 * 60 * 1000)
+    };
+  }
+
+  /**
+   * Update cache configuration
+   */
+  public updateConfig(config: Partial<ITlsSessionCacheConfig>): void {
+    this.config = { ...this.config, ...config };
+    
+    // Restart the cleanup timer with new interval
+    this.startCleanupTimer();
+    
+    // Run immediate cleanup if max entries was reduced
+    if (config.maxEntries && this.cache.size > config.maxEntries) {
+      while (this.cache.size > config.maxEntries) {
+        this.evictOldest();
+      }
+    }
+  }
+
+  /**
+   * Start the cleanup timer
+   */
+  private startCleanupTimer(): void {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+    
+    if (!this.config.enabled) return;
+    
+    this.cleanupTimer = setInterval(() => {
+      this.cleanup();
+    }, this.config.cleanupInterval);
+    
+    // Make sure the interval doesn't keep the process alive
+    if (this.cleanupTimer.unref) {
+      this.cleanupTimer.unref();
+    }
+  }
+
+  /**
+   * Clean up expired entries
+   */
+  private cleanup(): void {
+    this.lastCleanupTime = Date.now();
+    
     const now = Date.now();
-    const expiryTime = 24 * 60 * 60 * 1000; // 24 hours
+    let expiredCount = 0;
     
-    for (const [sessionId, info] of tlsSessionCache.entries()) {
-      if (now - info.ticketTimestamp > expiryTime) {
-        tlsSessionCache.delete(sessionId);
+    for (const [key, info] of this.cache.entries()) {
+      if (now - info.ticketTimestamp > this.config.expiryTime) {
+        this.cache.delete(key);
+        expiredCount++;
       }
     }
-  }, 60 * 60 * 1000); // Clean up once per hour
-  
-  // Make sure the interval doesn't keep the process alive
-  if (tlsSessionCleanupTimer.unref) {
-    tlsSessionCleanupTimer.unref();
+    
+    if (expiredCount > 0) {
+      this.cacheStats.expirations += expiredCount;
+      this.cacheStats.total = this.cache.size;
+      console.log(`TLS Session Cache: Cleaned up ${expiredCount} expired entries. ${this.cache.size} entries remaining.`);
+    }
+  }
+
+  /**
+   * Evict the oldest entries when cache is full
+   */
+  private evictOldest(): void {
+    if (this.cache.size === 0) return;
+    
+    let oldestKey: string | null = null;
+    let oldestTime = Date.now();
+    
+    // Strategy: Find least recently accessed entry
+    for (const [key, info] of this.cache.entries()) {
+      const lastAccess = info.lastAccessed || info.ticketTimestamp;
+      if (lastAccess < oldestTime) {
+        oldestTime = lastAccess;
+        oldestKey = key;
+      }
+    }
+    
+    if (oldestKey) {
+      this.cache.delete(oldestKey);
+      this.cacheStats.evictions++;
+    }
+  }
+
+  /**
+   * Stop cleanup timer (used during shutdown)
+   */
+  public stop(): void {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
   }
 }
 
-// Start the timer initially
-startSessionCleanupTimer();
+// Create the global session cache
+const tlsSessionCache = new TlsSessionCache();
 
-// Function to stop the cleanup timer (used during shutdown)
+// Legacy function for backward compatibility
 function stopSessionCleanupTimer() {
-  if (tlsSessionCleanupTimer) {
-    clearInterval(tlsSessionCleanupTimer);
-    tlsSessionCleanupTimer = null;
-  }
+  tlsSessionCache.stop();
 }
 
 /**
@@ -165,6 +385,8 @@ interface ISNIExtractResult {
   isResumption: boolean;    // Whether this appears to be a session resumption
   resumedDomain?: string;   // The domain associated with the session if resuming
   partialExtract?: boolean; // Whether this was only a partial extraction (more data needed)
+  recordsExamined?: number; // Number of TLS records examined in the buffer
+  multipleRecords?: boolean; // Whether multiple TLS records were found in the buffer
 }
 
 /**
@@ -172,6 +394,11 @@ interface ISNIExtractResult {
  * Enhanced for robustness and detailed logging.
  * Also extracts and tracks TLS Session IDs for session resumption handling.
  * 
+ * Improved to handle:
+ * - Multiple TLS records in a single buffer
+ * - Fragmented TLS handshakes across multiple records
+ * - Partial TLS records that may continue in future chunks
+ * 
  * @param buffer - Buffer containing the TLS ClientHello.
  * @param enableLogging - Whether to enable detailed logging.
  * @returns An object containing SNI and session information, or undefined if parsing fails.
@@ -181,49 +408,159 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
     // Check if buffer is too small for TLS
     if (buffer.length < 5) {
       if (enableLogging) console.log('Buffer too small for TLS header');
-      return undefined;
+      return { 
+        isResumption: false,
+        partialExtract: true  // Indicating we need more data
+      };
     }
 
-    // Check record type (has to be handshake - 22)
+    // Check first record type (has to be handshake - 22)
     const recordType = buffer.readUInt8(0);
     if (recordType !== 22) {
       if (enableLogging) console.log(`Not a TLS handshake. Record type: ${recordType}`);
       return undefined;
     }
 
-    // Check TLS version (has to be 3.1 or higher)
-    const majorVersion = buffer.readUInt8(1);
-    const minorVersion = buffer.readUInt8(2);
-    if (enableLogging) console.log(`TLS Version: ${majorVersion}.${minorVersion}`);
+    // Track multiple records and total records examined
+    let recordsExamined = 0;
+    let multipleRecords = false;
+    let currentPosition = 0;
+    let result: ISNIExtractResult | undefined;
 
-    // Check record length
-    const recordLength = buffer.readUInt16BE(3);
-    if (buffer.length < 5 + recordLength) {
-      if (enableLogging)
-        console.log(
-          `Buffer too small for TLS record. Expected: ${5 + recordLength}, Got: ${buffer.length}`
-        );
-      return undefined;
+    // Process potentially multiple TLS records in the buffer
+    while (currentPosition + 5 <= buffer.length) {
+      recordsExamined++;
+      
+      // Read record header
+      const currentRecordType = buffer.readUInt8(currentPosition);
+      
+      // Only process handshake records (type 22)
+      if (currentRecordType !== 22) {
+        if (enableLogging) console.log(`Skipping non-handshake record at position ${currentPosition}, type: ${currentRecordType}`);
+        
+        // Move to next potential record
+        if (currentPosition + 5 <= buffer.length) {
+          // Need at least 5 bytes to determine next record length
+          const nextRecordLength = buffer.readUInt16BE(currentPosition + 3);
+          currentPosition += 5 + nextRecordLength;
+          multipleRecords = true;
+          continue;
+        } else {
+          // Not enough data to determine next record
+          break;
+        }
+      }
+      
+      // Check TLS version
+      const majorVersion = buffer.readUInt8(currentPosition + 1);
+      const minorVersion = buffer.readUInt8(currentPosition + 2);
+      if (enableLogging) console.log(`TLS Version: ${majorVersion}.${minorVersion} at position ${currentPosition}`);
+      
+      // Get record length
+      const recordLength = buffer.readUInt16BE(currentPosition + 3);
+      
+      // Check if we have the complete record
+      if (currentPosition + 5 + recordLength > buffer.length) {
+        if (enableLogging) {
+          console.log(`Incomplete TLS record at position ${currentPosition}. Expected: ${currentPosition + 5 + recordLength}, Got: ${buffer.length}`);
+        }
+        
+        // Return partial info and signal that more data is needed
+        return {
+          isResumption: false,
+          partialExtract: true,
+          recordsExamined,
+          multipleRecords
+        };
+      }
+      
+      // Process this record - extract handshake information
+      const recordResult = extractSNIFromRecord(
+        buffer.slice(currentPosition, currentPosition + 5 + recordLength),
+        enableLogging
+      );
+      
+      // If we found SNI or session info in this record, store it
+      if (recordResult && (recordResult.serverName || recordResult.isResumption)) {
+        result = recordResult;
+        result.recordsExamined = recordsExamined;
+        result.multipleRecords = multipleRecords;
+        
+        // Once we've found SNI or session resumption info, we can stop processing
+        // But we'll still set the multipleRecords flag to indicate more records exist
+        if (currentPosition + 5 + recordLength < buffer.length) {
+          result.multipleRecords = true;
+        }
+        
+        break;
+      }
+      
+      // Move to the next record
+      currentPosition += 5 + recordLength;
+      
+      // Set the flag if we've processed multiple records
+      if (currentPosition < buffer.length) {
+        multipleRecords = true;
+      }
+    }
+    
+    // If we processed records but didn't find SNI or session info
+    if (recordsExamined > 0 && !result) {
+      return {
+        isResumption: false,
+        recordsExamined,
+        multipleRecords
+      };
     }
+    
+    return result;
+  } catch (err) {
+    console.log(`Error extracting SNI: ${err}`);
+    return undefined;
+  }
+}
 
+/**
+ * Extracts SNI information from a single TLS record
+ * This helper function processes a single complete TLS record
+ */
+function extractSNIFromRecord(recordBuffer: Buffer, enableLogging: boolean = false): ISNIExtractResult | undefined {
+  try {
+    // Skip the 5-byte TLS record header
     let offset = 5;
-    const handshakeType = buffer.readUInt8(offset);
-    if (handshakeType !== 1) {
+    
+    // Verify this is a handshake message
+    const handshakeType = recordBuffer.readUInt8(offset);
+    if (handshakeType !== 1) {  // 1 = ClientHello
       if (enableLogging) console.log(`Not a ClientHello. Handshake type: ${handshakeType}`);
       return undefined;
     }
-
-    offset += 4; // Skip handshake header (type + length)
-
+    
+    // Skip the 4-byte handshake header (type + 3 bytes length)
+    offset += 4;
+    
+    // Check if we have at least 38 more bytes for protocol version and random
+    if (offset + 38 > recordBuffer.length) {
+      if (enableLogging) console.log('Buffer too small for handshake header');
+      return undefined;
+    }
+    
     // Client version
-    const clientMajorVersion = buffer.readUInt8(offset);
-    const clientMinorVersion = buffer.readUInt8(offset + 1);
+    const clientMajorVersion = recordBuffer.readUInt8(offset);
+    const clientMinorVersion = recordBuffer.readUInt8(offset + 1);
     if (enableLogging) console.log(`Client Version: ${clientMajorVersion}.${clientMinorVersion}`);
-
-    offset += 2 + 32; // Skip client version and random
-
+    
+    // Skip version and random (2 + 32 bytes)
+    offset += 2 + 32;
+    
+    // Session ID
+    if (offset + 1 > recordBuffer.length) {
+      if (enableLogging) console.log('Buffer too small for session ID length');
+      return undefined;
+    }
+    
     // Extract Session ID for session resumption tracking
-    const sessionIDLength = buffer.readUInt8(offset);
+    const sessionIDLength = recordBuffer.readUInt8(offset);
     if (enableLogging) console.log(`Session ID Length: ${sessionIDLength}`);
     
     // If there's a session ID, extract it
@@ -233,7 +570,12 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
     let resumedDomain: string | undefined;
     
     if (sessionIDLength > 0) {
-      sessionId = Buffer.from(buffer.slice(offset + 1, offset + 1 + sessionIDLength));
+      if (offset + 1 + sessionIDLength > recordBuffer.length) {
+        if (enableLogging) console.log('Buffer too small for session ID data');
+        return undefined;
+      }
+      
+      sessionId = Buffer.from(recordBuffer.slice(offset + 1, offset + 1 + sessionIDLength));
       
       // Convert sessionId to a string key for our cache
       sessionIdKey = sessionId.toString('hex');
@@ -254,56 +596,121 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
       }
     }
     
-    offset += 1 + sessionIDLength; // Skip session ID
-
+    offset += 1 + sessionIDLength; // Skip session ID length and data
+    
     // Cipher suites
-    if (offset + 2 > buffer.length) {
+    if (offset + 2 > recordBuffer.length) {
       if (enableLogging) console.log('Buffer too small for cipher suites length');
       return undefined;
     }
-    const cipherSuitesLength = buffer.readUInt16BE(offset);
+    
+    const cipherSuitesLength = recordBuffer.readUInt16BE(offset);
     if (enableLogging) console.log(`Cipher Suites Length: ${cipherSuitesLength}`);
-    offset += 2 + cipherSuitesLength; // Skip cipher suites
-
+    
+    if (offset + 2 + cipherSuitesLength > recordBuffer.length) {
+      if (enableLogging) console.log('Buffer too small for cipher suites data');
+      return undefined;
+    }
+    
+    offset += 2 + cipherSuitesLength; // Skip cipher suites length and data
+    
     // Compression methods
-    if (offset + 1 > buffer.length) {
+    if (offset + 1 > recordBuffer.length) {
       if (enableLogging) console.log('Buffer too small for compression methods length');
       return undefined;
     }
-    const compressionMethodsLength = buffer.readUInt8(offset);
+    
+    const compressionMethodsLength = recordBuffer.readUInt8(offset);
     if (enableLogging) console.log(`Compression Methods Length: ${compressionMethodsLength}`);
-    offset += 1 + compressionMethodsLength; // Skip compression methods
-
-    // Extensions
-    if (offset + 2 > buffer.length) {
-      if (enableLogging) console.log('Buffer too small for extensions length');
+    
+    if (offset + 1 + compressionMethodsLength > recordBuffer.length) {
+      if (enableLogging) console.log('Buffer too small for compression methods data');
       return undefined;
     }
-    const extensionsLength = buffer.readUInt16BE(offset);
+    
+    offset += 1 + compressionMethodsLength; // Skip compression methods length and data
+    
+    // Check if we have extensions data
+    if (offset + 2 > recordBuffer.length) {
+      if (enableLogging) console.log('No extensions data found - end of ClientHello');
+      
+      // Even without SNI, we might be dealing with a session resumption
+      if (isResumption && resumedDomain) {
+        return {
+          serverName: resumedDomain, // Use the domain from previous session
+          sessionId,
+          sessionIdKey,
+          hasSessionTicket: false,
+          isResumption: true,
+          resumedDomain
+        };
+      }
+      
+      return {
+        isResumption,
+        sessionId,
+        sessionIdKey
+      };
+    }
+    
+    // Extensions
+    const extensionsLength = recordBuffer.readUInt16BE(offset);
     if (enableLogging) console.log(`Extensions Length: ${extensionsLength}`);
+    
     offset += 2;
     const extensionsEnd = offset + extensionsLength;
-
-    if (extensionsEnd > buffer.length) {
-      if (enableLogging)
-        console.log(
-          `Buffer too small for extensions. Expected end: ${extensionsEnd}, Buffer length: ${buffer.length}`
-        );
-      return undefined;
+    
+    if (extensionsEnd > recordBuffer.length) {
+      if (enableLogging) {
+        console.log(`Buffer too small for extensions. Expected end: ${extensionsEnd}, Buffer length: ${recordBuffer.length}`);
+      }
+      
+      // Even without complete extensions, we might be dealing with a session resumption
+      if (isResumption && resumedDomain) {
+        return {
+          serverName: resumedDomain, // Use the domain from previous session
+          sessionId,
+          sessionIdKey,
+          hasSessionTicket: false,
+          isResumption: true,
+          resumedDomain
+        };
+      }
+      
+      return {
+        isResumption,
+        sessionId,
+        sessionIdKey,
+        partialExtract: true // Indicating we have incomplete extensions data
+      };
     }
-
+    
     // Variables to track session tickets
     let hasSessionTicket = false;
     let sessionTicketId: string | undefined;
     
     // Parse extensions
     while (offset + 4 <= extensionsEnd) {
-      const extensionType = buffer.readUInt16BE(offset);
-      const extensionLength = buffer.readUInt16BE(offset + 2);
-
-      if (enableLogging)
+      const extensionType = recordBuffer.readUInt16BE(offset);
+      const extensionLength = recordBuffer.readUInt16BE(offset + 2);
+      
+      if (enableLogging) {
         console.log(`Extension Type: 0x${extensionType.toString(16)}, Length: ${extensionLength}`);
-
+      }
+      
+      if (offset + 4 + extensionLength > recordBuffer.length) {
+        if (enableLogging) {
+          console.log(`Extension data incomplete. Expected: ${offset + 4 + extensionLength}, Got: ${recordBuffer.length}`);
+        }
+        return {
+          isResumption,
+          sessionId,
+          sessionIdKey,
+          hasSessionTicket,
+          partialExtract: true
+        };
+      }
+      
       offset += 4;
       
       // Check for Session Ticket extension (type 0x0023)
@@ -312,7 +719,7 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
         
         // Extract a hash of the ticket for tracking
         if (extensionLength > 16) { // Ensure we have enough bytes to create a meaningful ID
-          const ticketBytes = buffer.slice(offset, offset + Math.min(16, extensionLength));
+          const ticketBytes = recordBuffer.slice(offset, offset + Math.min(16, extensionLength));
           sessionTicketId = ticketBytes.toString('hex');
           
           if (enableLogging) {
@@ -332,47 +739,74 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
           }
         }
       }
-
+      
+      // Server Name Indication extension (type 0x0000)
       if (extensionType === 0x0000) {
-        // SNI extension
-        if (offset + 2 > buffer.length) {
+        if (offset + 2 > recordBuffer.length) {
           if (enableLogging) console.log('Buffer too small for SNI list length');
-          return undefined;
+          return {
+            isResumption,
+            sessionId,
+            sessionIdKey,
+            hasSessionTicket,
+            partialExtract: true
+          };
         }
-
-        const sniListLength = buffer.readUInt16BE(offset);
+        
+        const sniListLength = recordBuffer.readUInt16BE(offset);
         if (enableLogging) console.log(`SNI List Length: ${sniListLength}`);
+        
         offset += 2;
         const sniListEnd = offset + sniListLength;
-
-        if (sniListEnd > buffer.length) {
-          if (enableLogging)
-            console.log(
-              `Buffer too small for SNI list. Expected end: ${sniListEnd}, Buffer length: ${buffer.length}`
-            );
-          return undefined;
+        
+        if (sniListEnd > recordBuffer.length) {
+          if (enableLogging) {
+            console.log(`Buffer too small for SNI list. Expected end: ${sniListEnd}, Buffer length: ${recordBuffer.length}`);
+          }
+          return {
+            isResumption,
+            sessionId,
+            sessionIdKey,
+            hasSessionTicket,
+            partialExtract: true
+          };
         }
-
+        
         while (offset + 3 < sniListEnd) {
-          const nameType = buffer.readUInt8(offset++);
-          const nameLen = buffer.readUInt16BE(offset);
+          const nameType = recordBuffer.readUInt8(offset++);
+          
+          if (offset + 2 > recordBuffer.length) {
+            if (enableLogging) console.log('Buffer too small for SNI name length');
+            return {
+              isResumption,
+              sessionId,
+              sessionIdKey,
+              hasSessionTicket,
+              partialExtract: true
+            };
+          }
+          
+          const nameLen = recordBuffer.readUInt16BE(offset);
           offset += 2;
-
+          
           if (enableLogging) console.log(`Name Type: ${nameType}, Name Length: ${nameLen}`);
-
+          
+          // Only process hostname entries (type 0)
           if (nameType === 0) {
-            // host_name
-            if (offset + nameLen > buffer.length) {
-              if (enableLogging)
-                console.log(
-                  `Buffer too small for hostname. Expected: ${offset + nameLen}, Got: ${
-                    buffer.length
-                  }`
-                );
-              return undefined;
+            if (offset + nameLen > recordBuffer.length) {
+              if (enableLogging) {
+                console.log(`Buffer too small for hostname. Expected: ${offset + nameLen}, Got: ${recordBuffer.length}`);
+              }
+              return {
+                isResumption,
+                sessionId,
+                sessionIdKey,
+                hasSessionTicket,
+                partialExtract: true
+              };
             }
-
-            const serverName = buffer.toString('utf8', offset, offset + nameLen);
+            
+            const serverName = recordBuffer.toString('utf8', offset, offset + nameLen);
             if (enableLogging) console.log(`Extracted SNI: ${serverName}`);
             
             // Store the session ID to domain mapping for future resumptions
@@ -412,15 +846,20 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
               hasSessionTicket
             };
           }
-
+          
+          // Skip this name entry
           offset += nameLen;
         }
+        
+        // Finished processing the SNI extension without finding a hostname
         break;
       } else {
+        // Skip other extensions
         offset += extensionLength;
       }
     }
-
+    
+    // We finished processing all extensions without finding SNI
     if (enableLogging) console.log('No SNI extension found');
     
     // Even without SNI, we might be dealing with a session resumption
@@ -446,7 +885,7 @@ function extractSNIInfo(buffer: Buffer, enableLogging: boolean = false): ISNIExt
       resumedDomain
     };
   } catch (err) {
-    console.log(`Error extracting SNI: ${err}`);
+    console.log(`Error in extractSNIFromRecord: ${err}`);
     return undefined;
   }
 }
@@ -564,45 +1003,111 @@ export class PortProxy {
   private networkProxies: NetworkProxy[] = [];
 
   constructor(settingsArg: IPortProxySettings) {
-    // Set hardcoded sensible defaults for all settings
+    // Auto-detect if this is a chained proxy based on targetIP
+    const targetIP = settingsArg.targetIP || 'localhost';
+    const isChainedProxy = settingsArg.isChainedProxy !== undefined
+      ? settingsArg.isChainedProxy
+      : (targetIP === 'localhost' || targetIP === '127.0.0.1');
+    
+    // Use more aggressive timeouts for chained proxies
+    const aggressiveTlsRefresh = settingsArg.aggressiveTlsRefresh !== undefined
+      ? settingsArg.aggressiveTlsRefresh
+      : isChainedProxy;
+    
+    // Configure TLS session cache if specified
+    if (settingsArg.tlsSessionCache) {
+      tlsSessionCache.updateConfig({
+        enabled: settingsArg.tlsSessionCache.enabled,
+        maxEntries: settingsArg.tlsSessionCache.maxEntries,
+        expiryTime: settingsArg.tlsSessionCache.expiryTime,
+        cleanupInterval: settingsArg.tlsSessionCache.cleanupInterval
+      });
+      
+      console.log(`Configured TLS session cache with custom settings. Current stats: ${JSON.stringify(tlsSessionCache.getStats())}`);
+    }
+    
+    // Determine appropriate timeouts based on proxy chain position
+    // Much more relaxed socket timeouts
+    let socketTimeout = 6 * 60 * 60 * 1000; // 6 hours default for standalone
+    
+    if (isChainedProxy) {
+      // Still adjust based on chain position, but with more relaxed values
+      const chainPosition = settingsArg.chainPosition || 'middle';
+      
+      // Adjust timeouts based on position in chain, but significantly relaxed
+      switch (chainPosition) {
+        case 'first':
+          // First proxy handling browser connections
+          socketTimeout = 6 * 60 * 60 * 1000; // 6 hours
+          break;
+        case 'middle':
+          // Middle proxies
+          socketTimeout = 5 * 60 * 60 * 1000; // 5 hours
+          break;
+        case 'last':
+          // Last proxy connects to backend
+          socketTimeout = 6 * 60 * 60 * 1000; // 6 hours
+          break;
+      }
+      
+      console.log(`Configured as ${chainPosition} proxy in chain. Using relaxed timeouts for better stability.`);
+    }
+
+    // Set sensible defaults with significantly relaxed timeouts
     this.settings = {
       ...settingsArg,
-      targetIP: settingsArg.targetIP || 'localhost',
-
-      // Hardcoded timeout settings optimized for TLS safety in all deployment scenarios
-      initialDataTimeout: 60000, // 60 seconds for initial handshake
-      socketTimeout: 1800000, // 30 minutes - short enough for regular certificate refresh
-      inactivityCheckInterval: 60000, // 60 seconds interval for regular cleanup
-      maxConnectionLifetime: 3600000, // 1 hour maximum lifetime for all connections
-      inactivityTimeout: 1800000, // 30 minutes inactivity timeout
+      targetIP: targetIP,
       
-      gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds
+      // Record the chained proxy status for use in other methods
+      isChainedProxy: isChainedProxy,
+      chainPosition: settingsArg.chainPosition || (isChainedProxy ? 'middle' : 'last'),
+      aggressiveTlsRefresh: aggressiveTlsRefresh,
+
+      // Much more relaxed timeout settings
+      initialDataTimeout: 120000, // 2 minutes for initial handshake (doubled)
+      socketTimeout: socketTimeout, // 5-6 hours based on chain position
+      inactivityCheckInterval: 5 * 60 * 1000, // 5 minutes between checks (relaxed)
+      maxConnectionLifetime: 12 * 60 * 60 * 1000, // 12 hours lifetime
+      inactivityTimeout: 4 * 60 * 60 * 1000, // 4 hours inactivity timeout
+      
+      gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 60000, // 60 seconds
 
       // Socket optimization settings
       noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
       keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
-      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds
-      maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB to handle large TLS handshakes
+      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 30000, // 30 seconds (increased)
+      maxPendingDataSize: settingsArg.maxPendingDataSize || 20 * 1024 * 1024, // 20MB to handle large TLS handshakes
 
       // Feature flags - simplified with sensible defaults
-      disableInactivityCheck: false, // Always enable inactivity checks for TLS safety
-      enableKeepAliveProbes: true, // Always enable keep-alive probes for connection health
+      disableInactivityCheck: false, // Still enable inactivity checks
+      enableKeepAliveProbes: true, // Still enable keep-alive probes
       enableDetailedLogging: settingsArg.enableDetailedLogging || false,
       enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
       enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
 
       // Rate limiting defaults
-      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100, // 100 connections per IP
-      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300, // 300 per minute
-
-      // Keep-alive settings with sensible defaults that ensure certificate safety
-      keepAliveTreatment: 'standard', // Always use standard treatment for certificate safety
-      keepAliveInactivityMultiplier: 2, // 2x normal inactivity timeout for minimal extension
-      extendedKeepAliveLifetime: 3 * 60 * 60 * 1000, // 3 hours maximum (previously was 7 days!)
+      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 200, // 200 connections per IP (doubled)
+      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 500, // 500 per minute (increased)
+
+      // Keep-alive settings with much more relaxed defaults
+      keepAliveTreatment: 'extended', // Use extended keep-alive treatment
+      keepAliveInactivityMultiplier: 3, // 3x normal inactivity timeout for longer extension
+      // Much longer keep-alive lifetimes
+      extendedKeepAliveLifetime: isChainedProxy 
+        ? 24 * 60 * 60 * 1000  // 24 hours for chained proxies
+        : 48 * 60 * 60 * 1000, // 48 hours for standalone proxies
     };
 
     // Store NetworkProxy instances if provided
     this.networkProxies = settingsArg.networkProxies || [];
+    
+    // Log proxy configuration details
+    console.log(`PortProxy initialized with ${isChainedProxy ? 'chained proxy' : 'standalone'} configuration.`);
+    if (isChainedProxy) {
+      console.log(`TLS certificate refresh: ${aggressiveTlsRefresh ? 'Aggressive' : 'Standard'}`);
+      console.log(`Connection lifetime: ${plugins.prettyMs(this.settings.maxConnectionLifetime)}`);
+      console.log(`Inactivity timeout: ${plugins.prettyMs(this.settings.inactivityTimeout)}`);
+    }
   }
 
   /**
@@ -652,10 +1157,13 @@ export class PortProxy {
       );
     }
 
-    // Create a connection to the NetworkProxy
+    // Create a connection to the NetworkProxy with optimized settings for reliability
     const proxySocket = plugins.net.connect({
       host: proxyHost,
       port: proxyPort,
+      noDelay: true, // Disable Nagle's algorithm for NetworkProxy connections
+      keepAlive: this.settings.keepAlive, // Use the same keepAlive setting as regular connections
+      keepAliveInitialDelay: Math.max(this.settings.keepAliveInitialDelay - 5000, 5000) // Slightly faster
     });
 
     // Store the outgoing socket in the record
@@ -663,6 +1171,30 @@ export class PortProxy {
     record.outgoingStartTime = Date.now();
     record.usingNetworkProxy = true;
     record.networkProxyIndex = proxyIndex;
+    
+    // Mark keep-alive as enabled on outgoing if requested
+    if (this.settings.keepAlive) {
+      record.outgoingKeepAliveEnabled = true;
+      
+      // Apply enhanced TCP keep-alive options if enabled
+      if (this.settings.enableKeepAliveProbes) {
+        try {
+          if ('setKeepAliveProbes' in proxySocket) {
+            (proxySocket as any).setKeepAliveProbes(10);
+          }
+          if ('setKeepAliveInterval' in proxySocket) {
+            (proxySocket as any).setKeepAliveInterval(800);
+          }
+          
+          console.log(`[${connectionId}] Enhanced TCP keep-alive configured for NetworkProxy connection`);
+        } catch (err) {
+          // Ignore errors - these are optional enhancements
+          if (this.settings.enableDetailedLogging) {
+            console.log(`[${connectionId}] Enhanced keep-alive not supported for NetworkProxy: ${err}`);
+          }
+        }
+      }
+    }
 
     // Set up error handlers
     proxySocket.on('error', (err) => {
@@ -711,6 +1243,41 @@ export class PortProxy {
 
       // Update activity on data transfer from the proxy socket
       proxySocket.on('data', () => this.updateActivity(record));
+      
+      // Special handling for application-level keep-alives on NetworkProxy connections
+      if (this.settings.keepAlive && record.isTLS) {
+        // Set up a timer to periodically send application-level keep-alives
+        const keepAliveTimer = setInterval(() => {
+          if (proxySocket && !proxySocket.destroyed && record && !record.connectionClosed) {
+            try {
+              // Send 0-byte packet as application-level keep-alive
+              proxySocket.write(Buffer.alloc(0));
+              
+              if (this.settings.enableDetailedLogging) {
+                console.log(`[${connectionId}] Sent application-level keep-alive to NetworkProxy connection`);
+              }
+            } catch (err) {
+              // If we can't write, the connection is probably already dead
+              if (this.settings.enableDetailedLogging) {
+                console.log(`[${connectionId}] Error sending application-level keep-alive to NetworkProxy: ${err}`);
+              }
+              
+              // Stop the timer if we hit an error
+              clearInterval(keepAliveTimer);
+            }
+          } else {
+            // Clean up timer if connection is gone
+            clearInterval(keepAliveTimer);
+          }
+        }, 60000); // Send keep-alive every minute
+        
+        // Make sure interval doesn't prevent process exit
+        if (keepAliveTimer.unref) {
+          keepAliveTimer.unref();
+        }
+        
+        console.log(`[${connectionId}] Application-level keep-alive configured for NetworkProxy connection`);
+      }
 
       if (this.settings.enableDetailedLogging) {
         console.log(
@@ -832,17 +1399,25 @@ export class PortProxy {
 
     // Apply keep-alive settings to the outgoing connection as well
     if (this.settings.keepAlive) {
-      targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
+      // Use a slightly shorter initial delay for outgoing to ensure it stays active
+      const outgoingInitialDelay = Math.max(this.settings.keepAliveInitialDelay - 5000, 5000);
+      targetSocket.setKeepAlive(true, outgoingInitialDelay);
+      record.outgoingKeepAliveEnabled = true;
+      
+      console.log(`[${connectionId}] Keep-alive enabled on outgoing connection with initial delay: ${outgoingInitialDelay}ms`);
 
       // Apply enhanced TCP keep-alive options if enabled
       if (this.settings.enableKeepAliveProbes) {
         try {
           if ('setKeepAliveProbes' in targetSocket) {
-            (targetSocket as any).setKeepAliveProbes(10);
+            (targetSocket as any).setKeepAliveProbes(10); // Same probes as incoming
           }
           if ('setKeepAliveInterval' in targetSocket) {
-            (targetSocket as any).setKeepAliveInterval(1000);
+            // Use a shorter interval on outgoing for more reliable detection
+            (targetSocket as any).setKeepAliveInterval(800); // Slightly faster than incoming
           }
+          
+          console.log(`[${connectionId}] Enhanced TCP keep-alive probes configured on outgoing connection`);
         } catch (err) {
           // Ignore errors - these are optional enhancements
           if (this.settings.enableDetailedLogging) {
@@ -852,6 +1427,43 @@ export class PortProxy {
           }
         }
       }
+      
+      // Special handling for TLS keep-alive - we want to be more aggressive 
+      // with keeping the outgoing connection alive in TLS mode
+      if (record.isTLS) {
+        // Set a timer to periodically send empty data to keep connection alive
+        // This is in addition to TCP keep-alive, works at application layer
+        const keepAliveTimer = setInterval(() => {
+          if (targetSocket && !targetSocket.destroyed && record && !record.connectionClosed) {
+            try {
+              // Send 0-byte packet as application-level keep-alive
+              targetSocket.write(Buffer.alloc(0));
+              
+              if (this.settings.enableDetailedLogging) {
+                console.log(`[${connectionId}] Sent application-level keep-alive to outgoing TLS connection`);
+              }
+            } catch (err) {
+              // If we can't write, the connection is probably already dead
+              if (this.settings.enableDetailedLogging) {
+                console.log(`[${connectionId}] Error sending application-level keep-alive: ${err}`);
+              }
+              
+              // Stop the timer if we hit an error
+              clearInterval(keepAliveTimer);
+            }
+          } else {
+            // Clean up timer if connection is gone
+            clearInterval(keepAliveTimer);
+          }
+        }, 60000); // Send keep-alive every minute
+        
+        // Make sure interval doesn't prevent process exit
+        if (keepAliveTimer.unref) {
+          keepAliveTimer.unref();
+        }
+        
+        console.log(`[${connectionId}] Application-level keep-alive configured for TLS outgoing connection`);
+      }
     }
 
     // Setup specific error handler for connection phase with enhanced retries
@@ -1040,15 +1652,37 @@ export class PortProxy {
 
           // Set up the renegotiation listener *before* piping if this is a TLS connection with SNI
           if (serverName && record.isTLS) {
-            // This listener handles TLS renegotiation detection
+            // Create a flag to prevent double-processing of the same handshake packet
+            let processingRenegotiation = false;
+            
+            // This listener handles TLS renegotiation detection on the incoming socket
             socket.on('data', (renegChunk) => {
-              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+              // Only check for content type 22 (handshake) and not already processing 
+              if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22 && !processingRenegotiation) {
+                processingRenegotiation = true;
+                
                 // Always update activity timestamp for any handshake packet
                 this.updateActivity(record);
                 
                 try {
+                  // Enhanced logging for renegotiation
+                  console.log(`[${connectionId}] TLS handshake/renegotiation packet detected (${renegChunk.length} bytes)`);
+                  
                   // Extract all TLS information including session resumption data
                   const sniInfo = extractSNIInfo(renegChunk, this.settings.enableTlsDebugLogging);
+                  
+                  // Log details about the handshake packet
+                  if (this.settings.enableTlsDebugLogging) {
+                    console.log(`[${connectionId}] Handshake SNI extraction results:`, {
+                      isResumption: sniInfo?.isResumption || false,
+                      serverName: sniInfo?.serverName || 'none',
+                      resumedDomain: sniInfo?.resumedDomain || 'none',
+                      recordsExamined: sniInfo?.recordsExamined || 0,
+                      multipleRecords: sniInfo?.multipleRecords || false,
+                      partialExtract: sniInfo?.partialExtract || false
+                    });
+                  }
+                  
                   let newSNI = sniInfo?.serverName;
                   
                   // Handle session resumption - if we recognize the session ID, we know what domain it belongs to
@@ -1057,10 +1691,17 @@ export class PortProxy {
                     newSNI = sniInfo.resumedDomain;
                   }
                   
-                  // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+                  // IMPORTANT: If we can't extract an SNI from renegotiation, but we detected a TLS handshake,
+                  // we still need to make sure it's properly forwarded to maintain the TLS state
                   if (newSNI === undefined) {
-                    console.log(`[${connectionId}] Rehandshake detected without SNI, allowing it through.`);
-                    return;
+                    console.log(`[${connectionId}] Rehandshake detected without SNI, forwarding transparently.`);
+                    
+                    // Set a temporary timeout to reset the processing flag
+                    setTimeout(() => {
+                      processingRenegotiation = false;
+                    }, 500);
+                    
+                    return; // Let the piping handle the forwarding
                   }
                   
                   // Check if the SNI has changed
@@ -1103,15 +1744,34 @@ export class PortProxy {
                     } else {
                       console.log(`[${connectionId}] Rehandshake SNI ${newSNI} not allowed. Terminating connection.`);
                       this.initiateCleanupOnce(record, 'sni_mismatch');
+                      return;
                     }
                   } else {
                     console.log(`[${connectionId}] Rehandshake with same SNI: ${newSNI}`);
                   }
                 } catch (err) {
                   console.log(`[${connectionId}] Error processing renegotiation: ${err}. Allowing to continue.`);
+                } finally {
+                  // Reset the processing flag after a small delay to prevent double-processing
+                  // of packets that may be part of the same handshake
+                  setTimeout(() => {
+                    processingRenegotiation = false;
+                  }, 500);
                 }
               }
             });
+            
+            // Set up a listener on the outgoing socket to detect issues with renegotiation
+            // This helps catch cases where the outgoing connection has closed but the incoming is still active
+            targetSocket.on('error', (err) => {
+              // If we get an error during what might be a renegotiation, log it specially
+              if (processingRenegotiation) {
+                console.log(`[${connectionId}] ERROR: Outgoing socket error during TLS renegotiation: ${err.message}`);
+                // Force immediate cleanup to prevent hanging connections
+                this.initiateCleanupOnce(record, 'renegotiation_error');
+              }
+              // The normal error handler will be called for other errors
+            });
           }
           
           // Now set up piping for future data and resume the socket
@@ -1149,15 +1809,37 @@ export class PortProxy {
       } else {
         // Set up the renegotiation listener *before* piping if this is a TLS connection with SNI
         if (serverName && record.isTLS) {
-          // This listener handles TLS renegotiation detection
+          // Create a flag to prevent double-processing of the same handshake packet
+          let processingRenegotiation = false;
+          
+          // This listener handles TLS renegotiation detection on the incoming socket
           socket.on('data', (renegChunk) => {
-            if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22) {
+            // Only check for content type 22 (handshake) and not already processing 
+            if (renegChunk.length > 0 && renegChunk.readUInt8(0) === 22 && !processingRenegotiation) {
+              processingRenegotiation = true;
+              
               // Always update activity timestamp for any handshake packet
               this.updateActivity(record);
               
               try {
+                // Enhanced logging for renegotiation
+                console.log(`[${connectionId}] TLS handshake/renegotiation packet detected (${renegChunk.length} bytes)`);
+                
                 // Extract all TLS information including session resumption data
                 const sniInfo = extractSNIInfo(renegChunk, this.settings.enableTlsDebugLogging);
+                
+                // Log details about the handshake packet
+                if (this.settings.enableTlsDebugLogging) {
+                  console.log(`[${connectionId}] Handshake SNI extraction results:`, {
+                    isResumption: sniInfo?.isResumption || false,
+                    serverName: sniInfo?.serverName || 'none',
+                    resumedDomain: sniInfo?.resumedDomain || 'none',
+                    recordsExamined: sniInfo?.recordsExamined || 0,
+                    multipleRecords: sniInfo?.multipleRecords || false,
+                    partialExtract: sniInfo?.partialExtract || false
+                  });
+                }
+                
                 let newSNI = sniInfo?.serverName;
                 
                 // Handle session resumption - if we recognize the session ID, we know what domain it belongs to
@@ -1166,10 +1848,17 @@ export class PortProxy {
                   newSNI = sniInfo.resumedDomain;
                 }
                 
-                // IMPORTANT: If we can't extract an SNI from renegotiation, we MUST allow it through
+                // IMPORTANT: If we can't extract an SNI from renegotiation, but we detected a TLS handshake,
+                // we still need to make sure it's properly forwarded to maintain the TLS state
                 if (newSNI === undefined) {
-                  console.log(`[${connectionId}] Rehandshake detected without SNI, allowing it through.`);
-                  return;
+                  console.log(`[${connectionId}] Rehandshake detected without SNI, forwarding transparently.`);
+                  
+                  // Set a temporary timeout to reset the processing flag
+                  setTimeout(() => {
+                    processingRenegotiation = false;
+                  }, 500);
+                  
+                  return; // Let the piping handle the forwarding
                 }
                 
                 // Check if the SNI has changed
@@ -1243,15 +1932,45 @@ export class PortProxy {
                   } else {
                     console.log(`[${connectionId}] Rehandshake SNI ${newSNI} not allowed. Terminating connection.`);
                     this.initiateCleanupOnce(record, 'sni_mismatch');
+                    return;
                   }
                 } else {
                   console.log(`[${connectionId}] Rehandshake with same SNI: ${newSNI}`);
                 }
               } catch (err) {
                 console.log(`[${connectionId}] Error processing renegotiation: ${err}. Allowing to continue.`);
+              } finally {
+                // Reset the processing flag after a small delay to prevent double-processing
+                // of packets that may be part of the same handshake
+                setTimeout(() => {
+                  processingRenegotiation = false;
+                }, 500);
               }
             }
           });
+          
+          // Set up a listener on the outgoing socket to detect issues with renegotiation
+          // This helps catch cases where the outgoing connection has closed but the incoming is still active
+          targetSocket.on('error', (err) => {
+            // If we get an error during what might be a renegotiation, log it specially
+            if (processingRenegotiation) {
+              console.log(`[${connectionId}] ERROR: Outgoing socket error during TLS renegotiation: ${err.message}`);
+              // Force immediate cleanup to prevent hanging connections
+              this.initiateCleanupOnce(record, 'renegotiation_error');
+            }
+            // The normal error handler will be called for other errors
+          });
+          
+          // Also monitor targetSocket for connection issues during client handshakes
+          targetSocket.on('close', () => {
+            // If the outgoing socket closes during renegotiation, it's a critical issue
+            if (processingRenegotiation) {
+              console.log(`[${connectionId}] CRITICAL: Outgoing socket closed during TLS renegotiation!`);
+              console.log(`[${connectionId}] This likely explains cert mismatch errors in the browser.`);
+              // Force immediate cleanup on the client side
+              this.initiateCleanupOnce(record, 'target_closed_during_renegotiation');
+            }
+          });
         }
         
         // Now set up piping
@@ -1461,7 +2180,8 @@ export class PortProxy {
   }
 
   /**
-   * Update connection activity timestamp with sleep detection
+   * Update connection activity timestamp with enhanced sleep detection
+   * Improved for chained proxy scenarios and more aggressive handling of stale connections
    */
   private updateActivity(record: IConnectionRecord): void {
     // Get the current time
@@ -1471,62 +2191,108 @@ export class PortProxy {
     if (record.lastActivity > 0) {
       const timeDiff = now - record.lastActivity;
 
-      // If time difference is very large (> 30 minutes) and this is a keep-alive connection,
-      // this might indicate system sleep rather than just inactivity
-      if (timeDiff > 30 * 60 * 1000 && record.hasKeepAlive) {
-        if (this.settings.enableDetailedLogging) {
-          console.log(
-            `[${record.id}] Detected possible system sleep for ${plugins.prettyMs(timeDiff)}. ` +
-              `Handling keep-alive connection after long inactivity.`
-          );
-        }
-
-        // For TLS keep-alive connections after sleep/long inactivity, force close
-        // to make browser establish a new connection with fresh certificate context
-        if (record.isTLS && record.tlsHandshakeComplete) {
-          // More generous timeout now that we've fixed the renegotiation handling
-          if (timeDiff > 2 * 60 * 60 * 1000) {
-            // If inactive for more than 2 hours (increased from 20 minutes)
+      // Enhanced sleep detection with graduated thresholds - much more relaxed
+      // Using chain detection from settings instead of recalculating
+      const isChainedProxy = this.settings.isChainedProxy || false;
+      const minuteInMs = 60 * 1000;
+      const hourInMs = 60 * minuteInMs;
+      
+      // Significantly relaxed thresholds for better stability
+      const shortInactivityThreshold = 30 * minuteInMs;  // 30 minutes
+      const mediumInactivityThreshold = 2 * hourInMs;    // 2 hours
+      const longInactivityThreshold = 8 * hourInMs;      // 8 hours
+      
+      // Short inactivity (10-15 mins) - Might be temporary network issue or short sleep
+      if (timeDiff > shortInactivityThreshold) {
+        if (record.isTLS && !record.possibleSystemSleep) {
+          // Record first detection of possible sleep/inactivity
+          record.possibleSystemSleep = true;
+          record.lastSleepDetection = now;
+          
+          if (this.settings.enableDetailedLogging) {
             console.log(
-              `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
-                `Closing to force new connection with fresh certificate.`
+              `[${record.id}] Detected possible short inactivity for ${plugins.prettyMs(timeDiff)}. ` +
+              `Monitoring for TLS connection health.`
             );
-            return this.initiateCleanupOnce(record, 'certificate_refresh_needed');
-          } else if (timeDiff > 30 * 60 * 1000) {
-            // For shorter but still significant inactivity (30+ minutes), refresh TLS state
+          }
+          
+          // For TLS connections, send a minimal probe to check connection health
+          if (!record.usingNetworkProxy && record.outgoing && !record.outgoing.destroyed) {
+            try {
+              record.outgoing.write(Buffer.alloc(0));
+            } catch (err) {
+              console.log(`[${record.id}] Error sending TLS probe: ${err}`);
+            }
+          }
+        }
+      }
+      
+      // Medium inactivity (20-30 mins) - Likely a sleep event or network change
+      if (timeDiff > mediumInactivityThreshold && record.hasKeepAlive) {
+        console.log(
+          `[${record.id}] Detected medium inactivity period for ${plugins.prettyMs(timeDiff)}. ` +
+          `Taking proactive steps for connection health.`
+        );
+        
+        // For TLS connections, we need more aggressive handling
+        if (record.isTLS && record.tlsHandshakeComplete) {
+          // If in a chained proxy, we should be even more aggressive about refreshing
+          if (isChainedProxy) {
             console.log(
-              `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
-                `Refreshing TLS state.`
+              `[${record.id}] TLS connection in chained proxy inactive for ${plugins.prettyMs(timeDiff)}. ` +
+              `Closing to prevent certificate inconsistencies across chain.`
             );
-            this.refreshTlsStateAfterSleep(record);
-            
-            // Add an additional check in 15 minutes if no activity
-            const refreshCheckId = record.id;
-            const refreshCheck = setTimeout(() => {
-              const currentRecord = this.connectionRecords.get(refreshCheckId);
-              if (currentRecord && Date.now() - currentRecord.lastActivity > 15 * 60 * 1000) {
+            return this.initiateCleanupOnce(record, 'chained_proxy_inactivity');
+          }
+          
+          // For TLS in single proxy, try refresh first
+          console.log(
+            `[${record.id}] TLS connection inactive for ${plugins.prettyMs(timeDiff)}. ` +
+            `Attempting active refresh of TLS state.`
+          );
+          
+          // Attempt deep TLS state refresh with buffer flush
+          this.performDeepTlsRefresh(record);
+          
+          // Schedule verification check with tighter timing for chained setups
+          const verificationTimeout = isChainedProxy ? 5 * minuteInMs : 10 * minuteInMs;
+          const refreshCheckId = record.id;
+          const refreshCheck = setTimeout(() => {
+            const currentRecord = this.connectionRecords.get(refreshCheckId);
+            if (currentRecord) {
+              const verificationTimeDiff = Date.now() - currentRecord.lastActivity;
+              if (verificationTimeDiff > verificationTimeout / 2) {
                 console.log(
-                  `[${refreshCheckId}] No activity detected after TLS refresh. ` +
-                    `Closing connection to ensure certificate freshness.`
+                  `[${refreshCheckId}] No activity detected after TLS refresh (${plugins.prettyMs(verificationTimeDiff)}). ` +
+                  `Closing connection to ensure proper browser reconnection.`
                 );
                 this.initiateCleanupOnce(currentRecord, 'tls_refresh_verification_failed');
               }
-            }, 15 * 60 * 1000);
-            
-            // Make sure timeout doesn't keep the process alive
-            if (refreshCheck.unref) {
-              refreshCheck.unref();
             }
-          } else {
-            // For shorter inactivity periods, try to refresh the TLS state normally
-            this.refreshTlsStateAfterSleep(record);
+          }, verificationTimeout);
+          
+          // Make sure timeout doesn't keep the process alive
+          if (refreshCheck.unref) {
+            refreshCheck.unref();
           }
         }
 
-        // Mark that we detected sleep
+        // Update sleep detection markers
         record.possibleSystemSleep = true;
         record.lastSleepDetection = now;
       }
+      
+      // Long inactivity (60-120 mins) - Definite sleep/suspend or major network change
+      if (timeDiff > longInactivityThreshold) {
+        console.log(
+          `[${record.id}] Detected long inactivity period of ${plugins.prettyMs(timeDiff)}. ` +
+          `Closing connection to ensure fresh certificate context.`
+        );
+        
+        // For long periods, we always want to force close and let browser reconnect
+        // This ensures fresh certificates and proper TLS context across the chain
+        return this.initiateCleanupOnce(record, 'extended_inactivity_refresh');
+      }
     }
 
     // Update the activity timestamp
@@ -1539,9 +2305,11 @@ export class PortProxy {
   }
 
   /**
-   * Refresh TLS state after sleep detection
+   * Perform deep TLS state refresh after sleep detection
+   * More aggressive than the standard refresh, specifically designed for
+   * recovering connections after system sleep in chained proxy setups
    */
-  private refreshTlsStateAfterSleep(record: IConnectionRecord): void {
+  private performDeepTlsRefresh(record: IConnectionRecord): void {
     // Skip if we're using a NetworkProxy as it handles its own TLS state
     if (record.usingNetworkProxy) {
       return;
@@ -1554,31 +2322,76 @@ export class PortProxy {
         const connectionAge = Date.now() - record.incomingStartTime;
         const hourInMs = 60 * 60 * 1000;
 
-        // For TLS browser connections, use a more generous timeout now that 
-        // we've fixed the renegotiation handling issues
-        if (record.isTLS && record.hasKeepAlive && connectionAge > 8 * hourInMs) { // 8 hours instead of 45 minutes
+        // For very long-lived connections, just close them
+        if (connectionAge > 4 * hourInMs) { // Reduced from 8 hours to 4 hours for chained proxies
           console.log(
             `[${record.id}] Long-lived TLS connection (${plugins.prettyMs(connectionAge)}). ` +
-              `Closing to ensure proper certificate handling on browser reconnect in proxy chain.`
+            `Closing to ensure proper certificate handling across proxy chain.`
           );
-          return this.initiateCleanupOnce(record, 'certificate_context_refresh');
+          return this.initiateCleanupOnce(record, 'certificate_age_refresh');
         }
 
-        // For newer connections, try to send a refresh packet
+        // Perform a series of actions to try to refresh the TLS state
+        
+        // 1. Send a zero-length buffer to trigger any pending errors
         record.outgoing.write(Buffer.alloc(0));
+        
+        // 2. Check socket state
+        if (record.outgoing.writableEnded || !record.outgoing.writable) {
+          console.log(`[${record.id}] Socket no longer writable during refresh`);
+          return this.initiateCleanupOnce(record, 'socket_state_error');
+        }
+        
+        // 3. For TLS connections, try to force background renegotiation
+        // by manipulating socket timeouts
+        const originalTimeout = record.outgoing.timeout;
+        record.outgoing.setTimeout(100); // Set very short timeout
+        
+        // 4. Create a small delay to allow timeout to process
+        setTimeout(() => {
+          try {
+            if (record.outgoing && !record.outgoing.destroyed) {
+              // Reset timeout to original value
+              record.outgoing.setTimeout(originalTimeout || 0);
+              
+              // Send another probe with random data (16 bytes) that will be ignored by TLS layer
+              // but might trigger internal state updates in the TLS implementation
+              const probeBuffer = Buffer.alloc(16);
+              // Fill with random data
+              for (let i = 0; i < 16; i++) {
+                probeBuffer[i] = Math.floor(Math.random() * 256);
+              }
+              record.outgoing.write(Buffer.alloc(0));
+              
+              if (this.settings.enableDetailedLogging) {
+                console.log(`[${record.id}] Completed deep TLS refresh sequence`);
+              }
+            }
+          } catch (innerErr) {
+            console.log(`[${record.id}] Error during deep TLS refresh: ${innerErr}`);
+            this.initiateCleanupOnce(record, 'deep_refresh_error');
+          }
+        }, 150);
 
         if (this.settings.enableDetailedLogging) {
-          console.log(`[${record.id}] Sent refresh packet after sleep detection`);
+          console.log(`[${record.id}] Initiated deep TLS refresh sequence`);
         }
       }
     } catch (err) {
-      console.log(`[${record.id}] Error refreshing TLS state: ${err}`);
+      console.log(`[${record.id}] Error starting TLS state refresh: ${err}`);
 
       // If we hit an error, it's likely the connection is already broken
       // Force cleanup to ensure browser reconnects cleanly
       return this.initiateCleanupOnce(record, 'tls_refresh_error');
     }
   }
+  
+  /**
+   * Legacy refresh method for backward compatibility
+   */
+  private refreshTlsStateAfterSleep(record: IConnectionRecord): void {
+    return this.performDeepTlsRefresh(record);
+  }
 
   /**
    * Cleans up a connection record.
@@ -1872,12 +2685,20 @@ export class PortProxy {
 
         // Initialize sleep detection fields
         possibleSystemSleep: false,
+        
+        // Track keep-alive state for both sides of the connection
+        incomingKeepAliveEnabled: false,
+        outgoingKeepAliveEnabled: false,
       };
 
       // Apply keep-alive settings if enabled
       if (this.settings.keepAlive) {
+        // Configure incoming socket keep-alive
         socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
         connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
+        connectionRecord.incomingKeepAliveEnabled = true;
+        
+        console.log(`[${connectionId}] Keep-alive enabled on incoming connection with initial delay: ${this.settings.keepAliveInitialDelay}ms`);
 
         // Apply enhanced TCP keep-alive options if enabled
         if (this.settings.enableKeepAliveProbes) {
@@ -1889,6 +2710,8 @@ export class PortProxy {
             if ('setKeepAliveInterval' in socket) {
               (socket as any).setKeepAliveInterval(1000); // 1 second interval between probes
             }
+            
+            console.log(`[${connectionId}] Enhanced TCP keep-alive probes configured on incoming connection`);
           } catch (err) {
             // Ignore errors - these are optional enhancements
             if (this.settings.enableDetailedLogging) {