@push.rocks/smartproxy 3.37.0 → 3.37.1

package/dist_ts/classes.snihandler.d.ts

@@ -0,0 +1,45 @@
+import { Buffer } from 'buffer';
+/**
+ * SNI (Server Name Indication) handler for TLS connections.
+ * Provides robust extraction of SNI values from TLS ClientHello messages.
+ */
+export declare class SniHandler {
+    private static readonly TLS_HANDSHAKE_RECORD_TYPE;
+    private static readonly TLS_CLIENT_HELLO_HANDSHAKE_TYPE;
+    private static readonly TLS_SNI_EXTENSION_TYPE;
+    private static readonly TLS_SESSION_TICKET_EXTENSION_TYPE;
+    private static readonly TLS_SNI_HOST_NAME_TYPE;
+    /**
+     * Checks if a buffer contains a TLS handshake message (record type 22)
+     * @param buffer - The buffer to check
+     * @returns true if the buffer starts with a TLS handshake record type
+     */
+    static isTlsHandshake(buffer: Buffer): boolean;
+    /**
+     * Checks if a buffer contains a TLS ClientHello message
+     * @param buffer - The buffer to check
+     * @returns true if the buffer appears to be a ClientHello message
+     */
+    static isClientHello(buffer: Buffer): boolean;
+    /**
+     * Extracts the SNI (Server Name Indication) from a TLS ClientHello message.
+     * Implements robust parsing with support for session resumption edge cases.
+     *
+     * @param buffer - The buffer containing the TLS ClientHello message
+     * @param enableLogging - Whether to enable detailed debug logging
+     * @returns The extracted server name or undefined if not found
+     */
+    static extractSNI(buffer: Buffer, enableLogging?: boolean): string | undefined;
+    /**
+     * Attempts to extract SNI from an initial ClientHello packet and handles
+     * session resumption edge cases more robustly than the standard extraction.
+     *
+     * This method is specifically designed for Chrome and other browsers that
+     * may send different ClientHello formats during session resumption.
+     *
+     * @param buffer - The buffer containing the TLS ClientHello message
+     * @param enableLogging - Whether to enable detailed debug logging
+     * @returns The extracted server name or undefined if not found
+     */
+    static extractSNIWithResumptionSupport(buffer: Buffer, enableLogging?: boolean): string | undefined;
+}

package/dist_ts/classes.snihandler.js

@@ -0,0 +1,274 @@
+import { Buffer } from 'buffer';
+/**
+ * SNI (Server Name Indication) handler for TLS connections.
+ * Provides robust extraction of SNI values from TLS ClientHello messages.
+ */
+export class SniHandler {
+    // TLS record types and constants
+    static { this.TLS_HANDSHAKE_RECORD_TYPE = 22; }
+    static { this.TLS_CLIENT_HELLO_HANDSHAKE_TYPE = 1; }
+    static { this.TLS_SNI_EXTENSION_TYPE = 0x0000; }
+    static { this.TLS_SESSION_TICKET_EXTENSION_TYPE = 0x0023; }
+    static { this.TLS_SNI_HOST_NAME_TYPE = 0; }
+    /**
+     * Checks if a buffer contains a TLS handshake message (record type 22)
+     * @param buffer - The buffer to check
+     * @returns true if the buffer starts with a TLS handshake record type
+     */
+    static isTlsHandshake(buffer) {
+        return buffer.length > 0 && buffer[0] === this.TLS_HANDSHAKE_RECORD_TYPE;
+    }
+    /**
+     * Checks if a buffer contains a TLS ClientHello message
+     * @param buffer - The buffer to check
+     * @returns true if the buffer appears to be a ClientHello message
+     */
+    static isClientHello(buffer) {
+        // Minimum ClientHello size (TLS record header + handshake header)
+        if (buffer.length < 9) {
+            return false;
+        }
+        // Check record type (must be TLS_HANDSHAKE_RECORD_TYPE)
+        if (buffer[0] !== this.TLS_HANDSHAKE_RECORD_TYPE) {
+            return false;
+        }
+        // Skip version and length in TLS record header (5 bytes total)
+        // Check handshake type at byte 5 (must be CLIENT_HELLO)
+        return buffer[5] === this.TLS_CLIENT_HELLO_HANDSHAKE_TYPE;
+    }
+    /**
+     * Extracts the SNI (Server Name Indication) from a TLS ClientHello message.
+     * Implements robust parsing with support for session resumption edge cases.
+     *
+     * @param buffer - The buffer containing the TLS ClientHello message
+     * @param enableLogging - Whether to enable detailed debug logging
+     * @returns The extracted server name or undefined if not found
+     */
+    static extractSNI(buffer, enableLogging = false) {
+        // Logging helper
+        const log = (message) => {
+            if (enableLogging) {
+                console.log(`[SNI Extraction] ${message}`);
+            }
+        };
+        try {
+            // Buffer must be at least 5 bytes (TLS record header)
+            if (buffer.length < 5) {
+                log('Buffer too small for TLS record header');
+                return undefined;
+            }
+            // Check record type (must be TLS_HANDSHAKE_RECORD_TYPE = 22)
+            if (buffer[0] !== this.TLS_HANDSHAKE_RECORD_TYPE) {
+                log(`Not a TLS handshake record: ${buffer[0]}`);
+                return undefined;
+            }
+            // Check TLS version
+            const majorVersion = buffer[1];
+            const minorVersion = buffer[2];
+            log(`TLS version: ${majorVersion}.${minorVersion}`);
+            // Parse record length (bytes 3-4, big-endian)
+            const recordLength = (buffer[3] << 8) + buffer[4];
+            log(`Record length: ${recordLength}`);
+            // Validate record length against buffer size
+            if (buffer.length < recordLength + 5) {
+                log('Buffer smaller than expected record length');
+                return undefined;
+            }
+            // Start of handshake message in the buffer
+            let pos = 5;
+            // Check handshake type (must be CLIENT_HELLO = 1)
+            if (buffer[pos] !== this.TLS_CLIENT_HELLO_HANDSHAKE_TYPE) {
+                log(`Not a ClientHello message: ${buffer[pos]}`);
+                return undefined;
+            }
+            // Skip handshake type (1 byte)
+            pos += 1;
+            // Parse handshake length (3 bytes, big-endian)
+            const handshakeLength = (buffer[pos] << 16) + (buffer[pos + 1] << 8) + buffer[pos + 2];
+            log(`Handshake length: ${handshakeLength}`);
+            // Skip handshake length (3 bytes)
+            pos += 3;
+            // Check client version (2 bytes)
+            const clientMajorVersion = buffer[pos];
+            const clientMinorVersion = buffer[pos + 1];
+            log(`Client version: ${clientMajorVersion}.${clientMinorVersion}`);
+            // Skip client version (2 bytes)
+            pos += 2;
+            // Skip client random (32 bytes)
+            pos += 32;
+            // Parse session ID
+            if (pos + 1 > buffer.length) {
+                log('Buffer too small for session ID length');
+                return undefined;
+            }
+            const sessionIdLength = buffer[pos];
+            log(`Session ID length: ${sessionIdLength}`);
+            // Skip session ID length (1 byte) and session ID
+            pos += 1 + sessionIdLength;
+            // Check if we have enough bytes left
+            if (pos + 2 > buffer.length) {
+                log('Buffer too small for cipher suites length');
+                return undefined;
+            }
+            // Parse cipher suites length (2 bytes, big-endian)
+            const cipherSuitesLength = (buffer[pos] << 8) + buffer[pos + 1];
+            log(`Cipher suites length: ${cipherSuitesLength}`);
+            // Skip cipher suites length (2 bytes) and cipher suites
+            pos += 2 + cipherSuitesLength;
+            // Check if we have enough bytes left
+            if (pos + 1 > buffer.length) {
+                log('Buffer too small for compression methods length');
+                return undefined;
+            }
+            // Parse compression methods length (1 byte)
+            const compressionMethodsLength = buffer[pos];
+            log(`Compression methods length: ${compressionMethodsLength}`);
+            // Skip compression methods length (1 byte) and compression methods
+            pos += 1 + compressionMethodsLength;
+            // Check if we have enough bytes for extensions length
+            if (pos + 2 > buffer.length) {
+                log('No extensions present or buffer too small');
+                return undefined;
+            }
+            // Parse extensions length (2 bytes, big-endian)
+            const extensionsLength = (buffer[pos] << 8) + buffer[pos + 1];
+            log(`Extensions length: ${extensionsLength}`);
+            // Skip extensions length (2 bytes)
+            pos += 2;
+            // Extensions end position
+            const extensionsEnd = pos + extensionsLength;
+            // Check if extensions length is valid
+            if (extensionsEnd > buffer.length) {
+                log('Extensions length exceeds buffer size');
+                return undefined;
+            }
+            // Track if we found session tickets (for improved resumption handling)
+            let hasSessionTicket = false;
+            // Iterate through extensions
+            while (pos + 4 <= extensionsEnd) {
+                // Parse extension type (2 bytes, big-endian)
+                const extensionType = (buffer[pos] << 8) + buffer[pos + 1];
+                log(`Extension type: 0x${extensionType.toString(16).padStart(4, '0')}`);
+                // Skip extension type (2 bytes)
+                pos += 2;
+                // Parse extension length (2 bytes, big-endian)
+                const extensionLength = (buffer[pos] << 8) + buffer[pos + 1];
+                log(`Extension length: ${extensionLength}`);
+                // Skip extension length (2 bytes)
+                pos += 2;
+                // Check if this is the SNI extension
+                if (extensionType === this.TLS_SNI_EXTENSION_TYPE) {
+                    log('Found SNI extension');
+                    // Ensure we have enough bytes for the server name list
+                    if (pos + 2 > extensionsEnd) {
+                        log('Extension too small for server name list length');
+                        pos += extensionLength; // Skip this extension
+                        continue;
+                    }
+                    // Parse server name list length (2 bytes, big-endian)
+                    const serverNameListLength = (buffer[pos] << 8) + buffer[pos + 1];
+                    log(`Server name list length: ${serverNameListLength}`);
+                    // Skip server name list length (2 bytes)
+                    pos += 2;
+                    // Ensure server name list length is valid
+                    if (pos + serverNameListLength > extensionsEnd) {
+                        log('Server name list length exceeds extension size');
+                        break; // Exit the loop, extension parsing is broken
+                    }
+                    // End position of server name list
+                    const serverNameListEnd = pos + serverNameListLength;
+                    // Iterate through server names
+                    while (pos + 3 <= serverNameListEnd) {
+                        // Check name type (must be HOST_NAME_TYPE = 0 for hostname)
+                        const nameType = buffer[pos];
+                        log(`Name type: ${nameType}`);
+                        if (nameType !== this.TLS_SNI_HOST_NAME_TYPE) {
+                            log(`Unsupported name type: ${nameType}`);
+                            pos += 1; // Skip name type (1 byte)
+                            // Skip name length (2 bytes) and name data
+                            if (pos + 2 <= serverNameListEnd) {
+                                const nameLength = (buffer[pos] << 8) + buffer[pos + 1];
+                                pos += 2 + nameLength;
+                            }
+                            else {
+                                log('Invalid server name entry');
+                                break;
+                            }
+                            continue;
+                        }
+                        // Skip name type (1 byte)
+                        pos += 1;
+                        // Ensure we have enough bytes for name length
+                        if (pos + 2 > serverNameListEnd) {
+                            log('Server name entry too small for name length');
+                            break;
+                        }
+                        // Parse name length (2 bytes, big-endian)
+                        const nameLength = (buffer[pos] << 8) + buffer[pos + 1];
+                        log(`Name length: ${nameLength}`);
+                        // Skip name length (2 bytes)
+                        pos += 2;
+                        // Ensure we have enough bytes for the name
+                        if (pos + nameLength > serverNameListEnd) {
+                            log('Name length exceeds server name list size');
+                            break;
+                        }
+                        // Extract server name (hostname)
+                        const serverName = buffer.slice(pos, pos + nameLength).toString('utf8');
+                        log(`Extracted server name: ${serverName}`);
+                        return serverName;
+                    }
+                }
+                else if (extensionType === this.TLS_SESSION_TICKET_EXTENSION_TYPE) {
+                    // If we encounter a session ticket extension, mark it for later
+                    log('Found session ticket extension');
+                    hasSessionTicket = true;
+                    pos += extensionLength; // Skip this extension
+                }
+                else {
+                    // Skip this extension
+                    pos += extensionLength;
+                }
+            }
+            // Log if we found a session ticket but no SNI
+            if (hasSessionTicket) {
+                log('Session ticket present but no SNI found - possible resumption scenario');
+            }
+            log('No SNI extension found in ClientHello');
+            return undefined;
+        }
+        catch (error) {
+            log(`Error parsing SNI: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }
+    }
+    /**
+     * Attempts to extract SNI from an initial ClientHello packet and handles
+     * session resumption edge cases more robustly than the standard extraction.
+     *
+     * This method is specifically designed for Chrome and other browsers that
+     * may send different ClientHello formats during session resumption.
+     *
+     * @param buffer - The buffer containing the TLS ClientHello message
+     * @param enableLogging - Whether to enable detailed debug logging
+     * @returns The extracted server name or undefined if not found
+     */
+    static extractSNIWithResumptionSupport(buffer, enableLogging = false) {
+        // First try the standard SNI extraction
+        const standardSni = this.extractSNI(buffer, enableLogging);
+        if (standardSni) {
+            return standardSni;
+        }
+        // If standard extraction failed and we have a valid ClientHello,
+        // this might be a session resumption with non-standard format
+        if (this.isClientHello(buffer)) {
+            if (enableLogging) {
+                console.log('[SNI Extraction] Detected ClientHello without standard SNI, possible session resumption');
+            }
+            // Additional handling could be implemented here for specific browser behaviors
+            // For now, this is a placeholder for future improvements
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zbmloYW5kbGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5zbmloYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxRQUFRLENBQUM7QUFFaEM7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFVBQVU7SUFDckIsaUNBQWlDO2FBQ1QsOEJBQXlCLEdBQUcsRUFBRSxDQUFDO2FBQy9CLG9DQUErQixHQUFHLENBQUMsQ0FBQzthQUNwQywyQkFBc0IsR0FBRyxNQUFNLENBQUM7YUFDaEMsc0NBQWlDLEdBQUcsTUFBTSxDQUFDO2FBQzNDLDJCQUFzQixHQUFHLENBQUMsQ0FBQztJQUVuRDs7OztPQUlHO0lBQ0ksTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFjO1FBQ3pDLE9BQU8sTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyx5QkFBeUIsQ0FBQztJQUMzRSxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNJLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBYztRQUN4QyxrRUFBa0U7UUFDbEUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RCLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELHdEQUF3RDtRQUN4RCxJQUFJLE1BQU0sQ0FBQyxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMseUJBQXlCLEVBQUUsQ0FBQztZQUNqRCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFFRCwrREFBK0Q7UUFDL0Qsd0RBQXdEO1FBQ3hELE9BQU8sTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQywrQkFBK0IsQ0FBQztJQUM1RCxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNJLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBYyxFQUFFLGdCQUF5QixLQUFLO1FBQ3JFLGlCQUFpQjtRQUNqQixNQUFNLEdBQUcsR0FBRyxDQUFDLE9BQWUsRUFBRSxFQUFFO1lBQzlCLElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ2xCLE9BQU8sQ0FBQyxHQUFHLENBQUMsb0JBQW9CLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDN0MsQ0FBQztRQUNILENBQUMsQ0FBQztRQUVGLElBQUksQ0FBQztZQUNILHNEQUFzRDtZQUN0RCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RCLEdBQUcsQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO2dCQUM5QyxPQUFPLFNBQVMsQ0FBQztZQUNuQixDQUFDO1lBRUQsNkRBQTZEO1lBQzdELElBQUksTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyx5QkFBeUIsRUFBRSxDQUFDO2dCQUNqRCxHQUFHLENBQUMsK0JBQStCLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7Z0JBQ2hELE9BQU8sU0FBUyxDQUFDO1lBQ25CLENBQUM7WUFFRCxvQkFBb0I7WUFDcEIsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQy9CLE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUMvQixHQUFHLENBQUMsZ0JBQWdCLFlBQVksSUFBSSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1lBRXBELDhDQUE4QztZQUM5QyxNQUFNLFlBQVksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDbEQsR0FBRyxDQUFDLGtCQUFrQixZQUFZLEVBQUUsQ0FBQyxDQUFDO1lBRXRDLDZDQUE2QztZQUM3QyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsWUFBWSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUNyQyxHQUFHLENBQUMsNENBQTRDLENBQUMsQ0FBQztnQkFDbEQsT0FBTyxTQUFTLENBQUM7WUFDbkIsQ0FBQztZQUVELDJDQUEyQztZQUMzQyxJQUFJLEdBQUcsR0FBRyxDQUFDLENBQUM7WUFFWixrREFBa0Q7WUFDbEQsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssSUFBSSxDQUFDLCtCQUErQixFQUFFLENBQUM7Z0JBQ3pELEdBQUcsQ0FBQyw4QkFBOEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztnQkFDakQsT0FBTyxTQUFTLENBQUM7WUFDbkIsQ0FBQztZQUVELCtCQUErQjtZQUMvQixHQUFHLElBQUksQ0FBQyxDQUFDO1lBRVQsK0NBQStDO1lBQy9DLE1BQU0sZUFBZSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3ZGLEdBQUcsQ0FBQyxxQkFBcUIsZUFBZSxFQUFFLENBQUMsQ0FBQztZQUU1QyxrQ0FBa0M7WUFDbEMsR0FBRyxJQUFJLENBQUMsQ0FBQztZQUVULGlDQUFpQztZQUNqQyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN2QyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDM0MsR0FBRyxDQUFDLG1CQUFtQixrQkFBa0IsSUFBSSxrQkFBa0IsRUFBRSxDQUFDLENBQUM7WUFFbkUsZ0NBQWdDO1lBQ2hDLEdBQUcsSUFBSSxDQUFDLENBQUM7WUFFVCxnQ0FBZ0M7WUFDaEMsR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUVWLG1CQUFtQjtZQUNuQixJQUFJLEdBQUcsR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUM1QixHQUFHLENBQUMsd0NBQXdDLENBQUMsQ0FBQztnQkFDOUMsT0FBTyxTQUFTLENBQUM7WUFDbkIsQ0FBQztZQUVELE1BQU0sZUFBZSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNwQyxHQUFHLENBQUMsc0JBQXNCLGVBQWUsRUFBRSxDQUFDLENBQUM7WUFFN0MsaURBQWlEO1lBQ2pELEdBQUcsSUFBSSxDQUFDLEdBQUcsZUFBZSxDQUFDO1lBRTNCLHFDQUFxQztZQUNyQyxJQUFJLEdBQUcsR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUM1QixHQUFHLENBQUMsMkNBQTJDLENBQUMsQ0FBQztnQkFDakQsT0FBTyxTQUFTLENBQUM7WUFDbkIsQ0FBQztZQUVELG1EQUFtRDtZQUNuRCxNQUFNLGtCQUFrQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDaEUsR0FBRyxDQUFDLHlCQUF5QixrQkFBa0IsRUFBRSxDQUFDLENBQUM7WUFFbkQsd0RBQXdEO1lBQ3hELEdBQUcsSUFBSSxDQUFDLEdBQUcsa0JBQWtCLENBQUM7WUFFOUIscUNBQXFDO1lBQ3JDLElBQUksR0FBRyxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQzVCLEdBQUcsQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO2dCQUN2RCxPQUFPLFNBQVMsQ0FBQztZQUNuQixDQUFDO1lBRUQsNENBQTRDO1lBQzVDLE1BQU0sd0JBQXdCLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQzdDLEdBQUcsQ0FBQywrQkFBK0Isd0JBQXdCLEVBQUUsQ0FBQyxDQUFDO1lBRS9ELG1FQUFtRTtZQUNuRSxHQUFHLElBQUksQ0FBQyxHQUFHLHdCQUF3QixDQUFDO1lBRXBDLHNEQUFzRDtZQUN0RCxJQUFJLEdBQUcsR0FBRyxDQUFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUM1QixHQUFHLENBQUMsMkNBQTJDLENBQUMsQ0FBQztnQkFDakQsT0FBTyxTQUFTLENBQUM7WUFDbkIsQ0FBQztZQUVELGdEQUFnRDtZQUNoRCxNQUFNLGdCQUFnQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDOUQsR0FBRyxDQUFDLHNCQUFzQixnQkFBZ0IsRUFBRSxDQUFDLENBQUM7WUFFOUMsbUNBQW1DO1lBQ25DLEdBQUcsSUFBSSxDQUFDLENBQUM7WUFFVCwwQkFBMEI7WUFDMUIsTUFBTSxhQUFhLEdBQUcsR0FBRyxHQUFHLGdCQUFnQixDQUFDO1lBRTdDLHNDQUFzQztZQUN0QyxJQUFJLGFBQWEsR0FBRyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ2xDLEdBQUcsQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO2dCQUM3QyxPQUFPLFNBQVMsQ0FBQztZQUNuQixDQUFDO1lBRUQsdUVBQXVFO1lBQ3ZFLElBQUksZ0JBQWdCLEdBQUcsS0FBSyxDQUFDO1lBRTdCLDZCQUE2QjtZQUM3QixPQUFPLEdBQUcsR0FBRyxDQUFDLElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ2hDLDZDQUE2QztnQkFDN0MsTUFBTSxhQUFhLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsTUFBTSxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDM0QsR0FBRyxDQUFDLHFCQUFxQixhQUFhLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUV4RSxnQ0FBZ0M7Z0JBQ2hDLEdBQUcsSUFBSSxDQUFDLENBQUM7Z0JBRVQsK0NBQStDO2dCQUMvQyxNQUFNLGVBQWUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUM3RCxHQUFHLENBQUMscUJBQXFCLGVBQWUsRUFBRSxDQUFDLENBQUM7Z0JBRTVDLGtDQUFrQztnQkFDbEMsR0FBRyxJQUFJLENBQUMsQ0FBQztnQkFFVCxxQ0FBcUM7Z0JBQ3JDLElBQUksYUFBYSxLQUFLLElBQUksQ0FBQyxzQkFBc0IsRUFBRSxDQUFDO29CQUNsRCxHQUFHLENBQUMscUJBQXFCLENBQUMsQ0FBQztvQkFFM0IsdURBQXVEO29CQUN2RCxJQUFJLEdBQUcsR0FBRyxDQUFDLEdBQUcsYUFBYSxFQUFFLENBQUM7d0JBQzVCLEdBQUcsQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO3dCQUN2RCxHQUFHLElBQUksZUFBZSxDQUFDLENBQUMsc0JBQXNCO3dCQUM5QyxTQUFTO29CQUNYLENBQUM7b0JBRUQsc0RBQXNEO29CQUN0RCxNQUFNLG9CQUFvQixHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUM7b0JBQ2xFLEdBQUcsQ0FBQyw0QkFBNEIsb0JBQW9CLEVBQUUsQ0FBQyxDQUFDO29CQUV4RCx5Q0FBeUM7b0JBQ3pDLEdBQUcsSUFBSSxDQUFDLENBQUM7b0JBRVQsMENBQTBDO29CQUMxQyxJQUFJLEdBQUcsR0FBRyxvQkFBb0IsR0FBRyxhQUFhLEVBQUUsQ0FBQzt3QkFDL0MsR0FBRyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7d0JBQ3RELE1BQU0sQ0FBQyw2Q0FBNkM7b0JBQ3RELENBQUM7b0JBRUQsbUNBQW1DO29CQUNuQyxNQUFNLGlCQUFpQixHQUFHLEdBQUcsR0FBRyxvQkFBb0IsQ0FBQztvQkFFckQsK0JBQStCO29CQUMvQixPQUFPLEdBQUcsR0FBRyxDQUFDLElBQUksaUJBQWlCLEVBQUUsQ0FBQzt3QkFDcEMsNERBQTREO3dCQUM1RCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7d0JBQzdCLEdBQUcsQ0FBQyxjQUFjLFFBQVEsRUFBRSxDQUFDLENBQUM7d0JBRTlCLElBQUksUUFBUSxLQUFLLElBQUksQ0FBQyxzQkFBc0IsRUFBRSxDQUFDOzRCQUM3QyxHQUFHLENBQUMsMEJBQTBCLFFBQVEsRUFBRSxDQUFDLENBQUM7NEJBQzFDLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQywwQkFBMEI7NEJBRXBDLDJDQUEyQzs0QkFDM0MsSUFBSSxHQUFHLEdBQUcsQ0FBQyxJQUFJLGlCQUFpQixFQUFFLENBQUM7Z0NBQ2pDLE1BQU0sVUFBVSxHQUFHLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxHQUFHLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0NBQ3hELEdBQUcsSUFBSSxDQUFDLEdBQUcsVUFBVSxDQUFDOzRCQUN4QixDQUFDO2lDQUFNLENBQUM7Z0NBQ04sR0FBRyxDQUFDLDJCQUEyQixDQUFDLENBQUM7Z0NBQ2pDLE1BQU07NEJBQ1IsQ0FBQzs0QkFDRCxTQUFTO3dCQUNYLENBQUM7d0JBRUQsMEJBQTBCO3dCQUMxQixHQUFHLElBQUksQ0FBQyxDQUFDO3dCQUVULDhDQUE4Qzt3QkFDOUMsSUFBSSxHQUFHLEdBQUcsQ0FBQyxHQUFHLGlCQUFpQixFQUFFLENBQUM7NEJBQ2hDLEdBQUcsQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDOzRCQUNuRCxNQUFNO3dCQUNSLENBQUM7d0JBRUQsMENBQTBDO3dCQUMxQyxNQUFNLFVBQVUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsR0FBRyxHQUFHLENBQUMsQ0FBQyxDQUFDO3dCQUN4RCxHQUFHLENBQUMsZ0JBQWdCLFVBQVUsRUFBRSxDQUFDLENBQUM7d0JBRWxDLDZCQUE2Qjt3QkFDN0IsR0FBRyxJQUFJLENBQUMsQ0FBQzt3QkFFVCwyQ0FBMkM7d0JBQzNDLElBQUksR0FBRyxHQUFHLFVBQVUsR0FBRyxpQkFBaUIsRUFBRSxDQUFDOzRCQUN6QyxHQUFHLENBQUMsMkNBQTJDLENBQUMsQ0FBQzs0QkFDakQsTUFBTTt3QkFDUixDQUFDO3dCQUVELGlDQUFpQzt3QkFDakMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRyxHQUFHLFVBQVUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQzt3QkFDeEUsR0FBRyxDQUFDLDBCQUEwQixVQUFVLEVBQUUsQ0FBQyxDQUFDO3dCQUM1QyxPQUFPLFVBQVUsQ0FBQztvQkFDcEIsQ0FBQztnQkFDSCxDQUFDO3FCQUFNLElBQUksYUFBYSxLQUFLLElBQUksQ0FBQyxpQ0FBaUMsRUFBRSxDQUFDO29CQUNwRSxnRUFBZ0U7b0JBQ2hFLEdBQUcsQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO29CQUN0QyxnQkFBZ0IsR0FBRyxJQUFJLENBQUM7b0JBQ3hCLEdBQUcsSUFBSSxlQUFlLENBQUMsQ0FBQyxzQkFBc0I7Z0JBQ2hELENBQUM7cUJBQU0sQ0FBQztvQkFDTixzQkFBc0I7b0JBQ3RCLEdBQUcsSUFBSSxlQUFlLENBQUM7Z0JBQ3pCLENBQUM7WUFDSCxDQUFDO1lBRUQsOENBQThDO1lBQzlDLElBQUksZ0JBQWdCLEVBQUUsQ0FBQztnQkFDckIsR0FBRyxDQUFDLHdFQUF3RSxDQUFDLENBQUM7WUFDaEYsQ0FBQztZQUVELEdBQUcsQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1lBQzdDLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsR0FBRyxDQUFDLHNCQUFzQixLQUFLLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3BGLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7T0FVRztJQUNJLE1BQU0sQ0FBQywrQkFBK0IsQ0FDM0MsTUFBYyxFQUNkLGdCQUF5QixLQUFLO1FBRTlCLHdDQUF3QztRQUN4QyxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxhQUFhLENBQUMsQ0FBQztRQUMzRCxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ2hCLE9BQU8sV0FBVyxDQUFDO1FBQ3JCLENBQUM7UUFFRCxpRUFBaUU7UUFDakUsOERBQThEO1FBQzlELElBQUksSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQy9CLElBQUksYUFBYSxFQUFFLENBQUM7Z0JBQ2xCLE9BQU8sQ0FBQyxHQUFHLENBQUMseUZBQXlGLENBQUMsQ0FBQztZQUN6RyxDQUFDO1lBRUQsK0VBQStFO1lBQy9FLHlEQUF5RDtRQUMzRCxDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQyJ9

package/dist_ts/index.d.ts

@@ -3,3 +3,4 @@ export * from './classes.networkproxy.js';
 export * from './classes.portproxy.js';
 export * from './classes.port80handler.js';
 export * from './classes.sslredirect.js';
+export * from './classes.snihandler.js';

package/dist_ts/index.js

@@ -3,4 +3,5 @@ export * from './classes.networkproxy.js';
 export * from './classes.portproxy.js';
 export * from './classes.port80handler.js';
 export * from './classes.sslredirect.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUMifQ==
+export * from './classes.snihandler.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMkJBQTJCLENBQUM7QUFDMUMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyx5QkFBeUIsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "3.37.0",
+  "version": "3.37.1",
   "private": false,
   "description": "A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, dynamic routing with authentication options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '3.37.0',
+  version: '3.37.1',
   description: 'A powerful proxy package that effectively handles high traffic, with features such as SSL/TLS support, port proxying, WebSocket handling, dynamic routing with authentication options, and automatic ACME certificate management.'
 }

package/ts/classes.portproxy.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import { NetworkProxy } from './classes.networkproxy.js';
+import { SniHandler } from './classes.snihandler.js';
 
 /** Domain configuration with per-domain allowed port ranges */
 export interface IDomainConfig {
@@ -117,192 +118,8 @@ interface IConnectionRecord {
   domainSwitches?: number; // Number of times the domain has been switched on this connection
 }
 
-/**
- * Extracts the SNI (Server Name Indication) from a TLS ClientHello packet.
- * Enhanced for robustness and detailed logging.
- * @param buffer - Buffer containing the TLS ClientHello.
- * @param enableLogging - Whether to enable detailed logging.
- * @returns The server name if found, otherwise undefined.
- */
-function extractSNI(buffer: Buffer, enableLogging: boolean = false): string | undefined {
-  try {
-    // Check if buffer is too small for TLS
-    if (buffer.length < 5) {
-      if (enableLogging) console.log('Buffer too small for TLS header');
-      return undefined;
-    }
-
-    // Check record type (has to be handshake - 22)
-    const recordType = buffer.readUInt8(0);
-    if (recordType !== 22) {
-      if (enableLogging) console.log(`Not a TLS handshake. Record type: ${recordType}`);
-      return undefined;
-    }
-
-    // Check TLS version (has to be 3.1 or higher)
-    const majorVersion = buffer.readUInt8(1);
-    const minorVersion = buffer.readUInt8(2);
-    if (enableLogging) console.log(`TLS Version: ${majorVersion}.${minorVersion}`);
-
-    // Check record length
-    const recordLength = buffer.readUInt16BE(3);
-    if (buffer.length < 5 + recordLength) {
-      if (enableLogging)
-        console.log(
-          `Buffer too small for TLS record. Expected: ${5 + recordLength}, Got: ${buffer.length}`
-        );
-      return undefined;
-    }
-
-    let offset = 5;
-    const handshakeType = buffer.readUInt8(offset);
-    if (handshakeType !== 1) {
-      if (enableLogging) console.log(`Not a ClientHello. Handshake type: ${handshakeType}`);
-      return undefined;
-    }
-
-    offset += 4; // Skip handshake header (type + length)
-
-    // Client version
-    const clientMajorVersion = buffer.readUInt8(offset);
-    const clientMinorVersion = buffer.readUInt8(offset + 1);
-    if (enableLogging) console.log(`Client Version: ${clientMajorVersion}.${clientMinorVersion}`);
-
-    offset += 2 + 32; // Skip client version and random
-
-    // Session ID
-    const sessionIDLength = buffer.readUInt8(offset);
-    if (enableLogging) console.log(`Session ID Length: ${sessionIDLength}`);
-    offset += 1 + sessionIDLength; // Skip session ID
-
-    // Cipher suites
-    if (offset + 2 > buffer.length) {
-      if (enableLogging) console.log('Buffer too small for cipher suites length');
-      return undefined;
-    }
-    const cipherSuitesLength = buffer.readUInt16BE(offset);
-    if (enableLogging) console.log(`Cipher Suites Length: ${cipherSuitesLength}`);
-    offset += 2 + cipherSuitesLength; // Skip cipher suites
-
-    // Compression methods
-    if (offset + 1 > buffer.length) {
-      if (enableLogging) console.log('Buffer too small for compression methods length');
-      return undefined;
-    }
-    const compressionMethodsLength = buffer.readUInt8(offset);
-    if (enableLogging) console.log(`Compression Methods Length: ${compressionMethodsLength}`);
-    offset += 1 + compressionMethodsLength; // Skip compression methods
-
-    // Extensions
-    if (offset + 2 > buffer.length) {
-      if (enableLogging) console.log('Buffer too small for extensions length');
-      return undefined;
-    }
-    const extensionsLength = buffer.readUInt16BE(offset);
-    if (enableLogging) console.log(`Extensions Length: ${extensionsLength}`);
-    offset += 2;
-    const extensionsEnd = offset + extensionsLength;
-
-    if (extensionsEnd > buffer.length) {
-      if (enableLogging)
-        console.log(
-          `Buffer too small for extensions. Expected end: ${extensionsEnd}, Buffer length: ${buffer.length}`
-        );
-      return undefined;
-    }
-
-    // Parse extensions
-    while (offset + 4 <= extensionsEnd) {
-      const extensionType = buffer.readUInt16BE(offset);
-      const extensionLength = buffer.readUInt16BE(offset + 2);
-
-      if (enableLogging)
-        console.log(`Extension Type: 0x${extensionType.toString(16)}, Length: ${extensionLength}`);
-
-      offset += 4;
-
-      if (extensionType === 0x0000) {
-        // SNI extension
-        if (offset + 2 > buffer.length) {
-          if (enableLogging) console.log('Buffer too small for SNI list length');
-          return undefined;
-        }
-
-        const sniListLength = buffer.readUInt16BE(offset);
-        if (enableLogging) console.log(`SNI List Length: ${sniListLength}`);
-        offset += 2;
-        const sniListEnd = offset + sniListLength;
-
-        if (sniListEnd > buffer.length) {
-          if (enableLogging)
-            console.log(
-              `Buffer too small for SNI list. Expected end: ${sniListEnd}, Buffer length: ${buffer.length}`
-            );
-          return undefined;
-        }
-
-        while (offset + 3 < sniListEnd) {
-          const nameType = buffer.readUInt8(offset++);
-          const nameLen = buffer.readUInt16BE(offset);
-          offset += 2;
-
-          if (enableLogging) console.log(`Name Type: ${nameType}, Name Length: ${nameLen}`);
-
-          if (nameType === 0) {
-            // host_name
-            if (offset + nameLen > buffer.length) {
-              if (enableLogging)
-                console.log(
-                  `Buffer too small for hostname. Expected: ${offset + nameLen}, Got: ${
-                    buffer.length
-                  }`
-                );
-              return undefined;
-            }
-
-            const serverName = buffer.toString('utf8', offset, offset + nameLen);
-            if (enableLogging) console.log(`Extracted SNI: ${serverName}`);
-            return serverName;
-          }
-
-          offset += nameLen;
-        }
-        break;
-      } else {
-        offset += extensionLength;
-      }
-    }
-
-    if (enableLogging) console.log('No SNI extension found');
-    return undefined;
-  } catch (err) {
-    console.log(`Error extracting SNI: ${err}`);
-    return undefined;
-  }
-}
-
-/**
- * Checks if a TLS record is a proper ClientHello message (more accurate than just checking record type)
- * @param buffer - Buffer containing the TLS record
- * @returns true if the buffer contains a proper ClientHello message
- */
-function isClientHello(buffer: Buffer): boolean {
-  try {
-    if (buffer.length < 9) return false; // Too small for a proper ClientHello
-
-    // Check record type (has to be handshake - 22)
-    if (buffer.readUInt8(0) !== 22) return false;
-
-    // After the TLS record header (5 bytes), check the handshake type (1 for ClientHello)
-    if (buffer.readUInt8(5) !== 1) return false;
-
-    // Basic checks passed, this appears to be a ClientHello
-    return true;
-  } catch (err) {
-    console.log(`Error checking for ClientHello: ${err}`);
-    return false;
-  }
-}
+// SNI functions are now imported from SniHandler class
+// No need for wrapper functions
 
 // Helper: Check if a port falls within any of the given port ranges
 const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
@@ -346,10 +163,7 @@ const generateConnectionId = (): string => {
   return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
 };
 
-// Helper: Check if a buffer contains a TLS handshake
-const isTlsHandshake = (buffer: Buffer): boolean => {
-  return buffer.length > 0 && buffer[0] === 22; // ContentType.handshake
-};
+// SNI functions are now imported from SniHandler class
 
 // Helper: Ensure timeout values don't exceed Node.js max safe integer
 const ensureSafeTimeout = (timeout: number): number => {
@@ -761,7 +575,7 @@ export class PortProxy {
       record.bytesReceived += chunk.length;
 
       // Check for TLS handshake
-      if (!record.isTLS && isTlsHandshake(chunk)) {
+      if (!record.isTLS && SniHandler.isTlsHandshake(chunk)) {
         record.isTLS = true;
 
         if (this.settings.enableTlsDebugLogging) {
@@ -1049,10 +863,10 @@ export class PortProxy {
         // Define a handler for checking renegotiation with improved detection
         const renegotiationHandler = (renegChunk: Buffer) => {
           // Only process if this looks like a TLS ClientHello
-          if (isClientHello(renegChunk)) {
+          if (SniHandler.isClientHello(renegChunk)) {
             try {
               // Extract SNI from ClientHello
-              const newSNI = extractSNI(renegChunk, this.settings.enableTlsDebugLogging);
+              const newSNI = SniHandler.extractSNIWithResumptionSupport(renegChunk, this.settings.enableTlsDebugLogging);
 
               // Skip if no SNI was found
               if (!newSNI) return;
@@ -1644,7 +1458,7 @@ export class PortProxy {
           connectionRecord.hasReceivedInitialData = true;
 
           // Check if this looks like a TLS handshake
-          if (isTlsHandshake(chunk)) {
+          if (SniHandler.isTlsHandshake(chunk)) {
             connectionRecord.isTLS = true;
             
             // Forward directly to NetworkProxy without SNI processing
@@ -1706,7 +1520,7 @@ export class PortProxy {
           this.updateActivity(connectionRecord);
 
           // Check for TLS handshake if this is the first chunk
-          if (!connectionRecord.isTLS && isTlsHandshake(chunk)) {
+          if (!connectionRecord.isTLS && SniHandler.isTlsHandshake(chunk)) {
             connectionRecord.isTLS = true;
 
             if (this.settings.enableTlsDebugLogging) {
@@ -1714,7 +1528,7 @@ export class PortProxy {
                 `[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`
               );
               // Try to extract SNI and log detailed debug info
-              extractSNI(chunk, true);
+              SniHandler.extractSNIWithResumptionSupport(chunk, true);
             }
           }
         });
@@ -1743,7 +1557,7 @@ export class PortProxy {
           connectionRecord.hasReceivedInitialData = true;
 
           // Check if this looks like a TLS handshake
-          const isTlsHandshakeDetected = initialChunk && isTlsHandshake(initialChunk);
+          const isTlsHandshakeDetected = initialChunk && SniHandler.isTlsHandshake(initialChunk);
           if (isTlsHandshakeDetected) {
             connectionRecord.isTLS = true;
 
@@ -1912,7 +1726,7 @@ export class PortProxy {
             // Try to extract SNI
             let serverName = '';
 
-            if (isTlsHandshake(chunk)) {
+            if (SniHandler.isTlsHandshake(chunk)) {
               connectionRecord.isTLS = true;
 
               if (this.settings.enableTlsDebugLogging) {
@@ -1921,7 +1735,7 @@ export class PortProxy {
                 );
               }
 
-              serverName = extractSNI(chunk, this.settings.enableTlsDebugLogging) || '';
+              serverName = SniHandler.extractSNIWithResumptionSupport(chunk, this.settings.enableTlsDebugLogging) || '';
             }
 
             // Lock the connection to the negotiated SNI.