@push.rocks/smartproxy 3.41.8 → 4.1.0

package/ts/classes.portproxy.ts

@@ -1,2503 +0,0 @@
-import * as plugins from './plugins.js';
-import { NetworkProxy } from './classes.networkproxy.js';
-import { SniHandler } from './classes.snihandler.js';
-
-/** Domain configuration with per-domain allowed port ranges */
-export interface IDomainConfig {
-  domains: string[]; // Glob patterns for domain(s)
-  allowedIPs: string[]; // Glob patterns for allowed IPs
-  blockedIPs?: string[]; // Glob patterns for blocked IPs
-  targetIPs?: string[]; // If multiple targetIPs are given, use round robin.
-  portRanges?: Array<{ from: number; to: number }>; // Optional port ranges
-  // Allow domain-specific timeout override
-  connectionTimeout?: number; // Connection timeout override (ms)
-
-  // NetworkProxy integration options for this specific domain
-  useNetworkProxy?: boolean; // Whether to use NetworkProxy for this domain
-  networkProxyPort?: number; // Override default NetworkProxy port for this domain
-}
-
-/** Port proxy settings including global allowed port ranges */
-export interface IPortProxySettings extends plugins.tls.TlsOptions {
-  fromPort: number;
-  toPort: number;
-  targetIP?: string; // Global target host to proxy to, defaults to 'localhost'
-  domainConfigs: IDomainConfig[];
-  sniEnabled?: boolean;
-  defaultAllowedIPs?: string[];
-  defaultBlockedIPs?: string[];
-  preserveSourceIP?: boolean;
-
-  // Timeout settings
-  initialDataTimeout?: number; // Timeout for initial data/SNI (ms), default: 60000 (60s)
-  socketTimeout?: number; // Socket inactivity timeout (ms), default: 3600000 (1h)
-  inactivityCheckInterval?: number; // How often to check for inactive connections (ms), default: 60000 (60s)
-  maxConnectionLifetime?: number; // Default max connection lifetime (ms), default: 86400000 (24h)
-  inactivityTimeout?: number; // Inactivity timeout (ms), default: 14400000 (4h)
-
-  gracefulShutdownTimeout?: number; // (ms) maximum time to wait for connections to close during shutdown
-  globalPortRanges: Array<{ from: number; to: number }>; // Global allowed port ranges
-  forwardAllGlobalRanges?: boolean; // When true, forwards all connections on global port ranges to the global targetIP
-
-  // Socket optimization settings
-  noDelay?: boolean; // Disable Nagle's algorithm (default: true)
-  keepAlive?: boolean; // Enable TCP keepalive (default: true)
-  keepAliveInitialDelay?: number; // Initial delay before sending keepalive probes (ms)
-  maxPendingDataSize?: number; // Maximum bytes to buffer during connection setup
-
-  // Enhanced features
-  disableInactivityCheck?: boolean; // Disable inactivity checking entirely
-  enableKeepAliveProbes?: boolean; // Enable TCP keep-alive probes
-  enableDetailedLogging?: boolean; // Enable detailed connection logging
-  enableTlsDebugLogging?: boolean; // Enable TLS handshake debug logging
-  enableRandomizedTimeouts?: boolean; // Randomize timeouts slightly to prevent thundering herd
-  allowSessionTicket?: boolean; // Allow TLS session ticket for reconnection (default: true)
-
-  // Rate limiting and security
-  maxConnectionsPerIP?: number; // Maximum simultaneous connections from a single IP
-  connectionRateLimitPerMinute?: number; // Max new connections per minute from a single IP
-
-  // Enhanced keep-alive settings
-  keepAliveTreatment?: 'standard' | 'extended' | 'immortal'; // How to treat keep-alive connections
-  keepAliveInactivityMultiplier?: number; // Multiplier for inactivity timeout for keep-alive connections
-  extendedKeepAliveLifetime?: number; // Extended lifetime for keep-alive connections (ms)
-
-  // NetworkProxy integration
-  useNetworkProxy?: number[]; // Array of ports to forward to NetworkProxy
-  networkProxyPort?: number; // Port where NetworkProxy is listening (default: 8443)
-
-  // ACME certificate management options
-  acme?: {
-    enabled?: boolean; // Whether to enable automatic certificate management
-    port?: number; // Port to listen on for ACME challenges (default: 80)
-    contactEmail?: string; // Email for Let's Encrypt account
-    useProduction?: boolean; // Whether to use Let's Encrypt production (default: false for staging)
-    renewThresholdDays?: number; // Days before expiry to renew certificates (default: 30)
-    autoRenew?: boolean; // Whether to automatically renew certificates (default: true)
-    certificateStore?: string; // Directory to store certificates (default: ./certs)
-    skipConfiguredCerts?: boolean; // Skip domains that already have certificates configured
-  };
-}
-
-/**
- * Enhanced connection record
- */
-interface IConnectionRecord {
-  id: string; // Unique connection identifier
-  incoming: plugins.net.Socket;
-  outgoing: plugins.net.Socket | null;
-  incomingStartTime: number;
-  outgoingStartTime?: number;
-  outgoingClosedTime?: number;
-  lockedDomain?: string; // Used to lock this connection to the initial SNI
-  connectionClosed: boolean; // Flag to prevent multiple cleanup attempts
-  cleanupTimer?: NodeJS.Timeout; // Timer for max lifetime/inactivity
-  lastActivity: number; // Last activity timestamp for inactivity detection
-  pendingData: Buffer[]; // Buffer to hold data during connection setup
-  pendingDataSize: number; // Track total size of pending data
-
-  // Enhanced tracking fields
-  bytesReceived: number; // Total bytes received
-  bytesSent: number; // Total bytes sent
-  remoteIP: string; // Remote IP (cached for logging after socket close)
-  localPort: number; // Local port (cached for logging)
-  isTLS: boolean; // Whether this connection is a TLS connection
-  tlsHandshakeComplete: boolean; // Whether the TLS handshake is complete
-  hasReceivedInitialData: boolean; // Whether initial data has been received
-  domainConfig?: IDomainConfig; // Associated domain config for this connection
-
-  // Keep-alive tracking
-  hasKeepAlive: boolean; // Whether keep-alive is enabled for this connection
-  inactivityWarningIssued?: boolean; // Whether an inactivity warning has been issued
-  incomingTerminationReason?: string | null; // Reason for incoming termination
-  outgoingTerminationReason?: string | null; // Reason for outgoing termination
-
-  // NetworkProxy tracking
-  usingNetworkProxy?: boolean; // Whether this connection is using a NetworkProxy
-
-  // Renegotiation handler
-  renegotiationHandler?: (chunk: Buffer) => void; // Handler for renegotiation detection
-
-  // Browser connection tracking
-  isBrowserConnection?: boolean; // Whether this connection appears to be from a browser
-  domainSwitches?: number; // Number of times the domain has been switched on this connection
-}
-
-// SNI functions are now imported from SniHandler class
-// No need for wrapper functions
-
-// Helper: Check if a port falls within any of the given port ranges
-const isPortInRanges = (port: number, ranges: Array<{ from: number; to: number }>): boolean => {
-  return ranges.some((range) => port >= range.from && port <= range.to);
-};
-
-// Helper: Check if a given IP matches any of the glob patterns
-const isAllowed = (ip: string, patterns: string[]): boolean => {
-  if (!ip || !patterns || patterns.length === 0) return false;
-
-  const normalizeIP = (ip: string): string[] => {
-    if (!ip) return [];
-    if (ip.startsWith('::ffff:')) {
-      const ipv4 = ip.slice(7);
-      return [ip, ipv4];
-    }
-    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
-      return [ip, `::ffff:${ip}`];
-    }
-    return [ip];
-  };
-
-  const normalizedIPVariants = normalizeIP(ip);
-  if (normalizedIPVariants.length === 0) return false;
-
-  const expandedPatterns = patterns.flatMap(normalizeIP);
-  return normalizedIPVariants.some((ipVariant) =>
-    expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern))
-  );
-};
-
-// Helper: Check if an IP is allowed considering allowed and blocked glob patterns
-const isGlobIPAllowed = (ip: string, allowed: string[], blocked: string[] = []): boolean => {
-  if (!ip) return false;
-  if (blocked.length > 0 && isAllowed(ip, blocked)) return false;
-  return isAllowed(ip, allowed);
-};
-
-// Helper: Generate a unique connection ID
-const generateConnectionId = (): string => {
-  return Math.random().toString(36).substring(2, 15) + Math.random().toString(36).substring(2, 15);
-};
-
-// SNI functions are now imported from SniHandler class
-
-// Helper: Ensure timeout values don't exceed Node.js max safe integer
-const ensureSafeTimeout = (timeout: number): number => {
-  const MAX_SAFE_TIMEOUT = 2147483647; // Maximum safe value (2^31 - 1)
-  return Math.min(Math.floor(timeout), MAX_SAFE_TIMEOUT);
-};
-
-// Helper: Generate a slightly randomized timeout to prevent thundering herd
-const randomizeTimeout = (baseTimeout: number, variationPercent: number = 5): number => {
-  const safeBaseTimeout = ensureSafeTimeout(baseTimeout);
-  const variation = safeBaseTimeout * (variationPercent / 100);
-  return ensureSafeTimeout(safeBaseTimeout + Math.floor(Math.random() * variation * 2) - variation);
-};
-
-export class PortProxy {
-  private netServers: plugins.net.Server[] = [];
-  settings: IPortProxySettings;
-  private connectionRecords: Map<string, IConnectionRecord> = new Map();
-  private connectionLogger: NodeJS.Timeout | null = null;
-  private isShuttingDown: boolean = false;
-
-  // Map to track round robin indices for each domain config
-  private domainTargetIndices: Map<IDomainConfig, number> = new Map();
-
-  // Enhanced stats tracking
-  private terminationStats: {
-    incoming: Record<string, number>;
-    outgoing: Record<string, number>;
-  } = {
-    incoming: {},
-    outgoing: {},
-  };
-
-  // Connection tracking by IP for rate limiting
-  private connectionsByIP: Map<string, Set<string>> = new Map();
-  private connectionRateByIP: Map<string, number[]> = new Map();
-
-  // NetworkProxy instance for TLS termination
-  private networkProxy: NetworkProxy | null = null;
-
-  constructor(settingsArg: IPortProxySettings) {
-    // Set reasonable defaults for all settings
-    this.settings = {
-      ...settingsArg,
-      targetIP: settingsArg.targetIP || 'localhost',
-
-      // Timeout settings with reasonable defaults
-      initialDataTimeout: settingsArg.initialDataTimeout || 120000, // 120 seconds for initial handshake
-      socketTimeout: ensureSafeTimeout(settingsArg.socketTimeout || 3600000), // 1 hour socket timeout
-      inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000, // 60 seconds interval
-      maxConnectionLifetime: ensureSafeTimeout(settingsArg.maxConnectionLifetime || 86400000), // 24 hours default
-      inactivityTimeout: ensureSafeTimeout(settingsArg.inactivityTimeout || 14400000), // 4 hours inactivity timeout
-
-      gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000, // 30 seconds
-
-      // Socket optimization settings
-      noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
-      keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
-      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000, // 10 seconds
-      maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024, // 10MB
-
-      // Feature flags
-      disableInactivityCheck: settingsArg.disableInactivityCheck || false,
-      enableKeepAliveProbes:
-        settingsArg.enableKeepAliveProbes !== undefined ? settingsArg.enableKeepAliveProbes : true,
-      enableDetailedLogging: settingsArg.enableDetailedLogging || false,
-      enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
-      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
-      allowSessionTicket:
-        settingsArg.allowSessionTicket !== undefined ? settingsArg.allowSessionTicket : true,
-
-      // Rate limiting defaults
-      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
-      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
-
-      // Enhanced keep-alive settings
-      keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended',
-      keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6,
-      extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000, // 7 days
-
-      // NetworkProxy settings
-      networkProxyPort: settingsArg.networkProxyPort || 8443, // Default NetworkProxy port
-
-      // ACME certificate settings with reasonable defaults
-      acme: settingsArg.acme || {
-        enabled: false,
-        port: 80,
-        contactEmail: 'admin@example.com',
-        useProduction: false,
-        renewThresholdDays: 30,
-        autoRenew: true,
-        certificateStore: './certs',
-        skipConfiguredCerts: false,
-      },
-    };
-
-    // Initialize NetworkProxy if enabled
-    if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
-      this.initializeNetworkProxy();
-    }
-  }
-
-  /**
-   * Initialize NetworkProxy instance
-   */
-  private async initializeNetworkProxy(): Promise<void> {
-    if (!this.networkProxy) {
-      // Configure NetworkProxy options based on PortProxy settings
-      const networkProxyOptions: any = {
-        port: this.settings.networkProxyPort!,
-        portProxyIntegration: true,
-        logLevel: this.settings.enableDetailedLogging ? 'debug' : 'info',
-      };
-
-      // Add ACME settings if configured
-      if (this.settings.acme) {
-        networkProxyOptions.acme = { ...this.settings.acme };
-      }
-
-      this.networkProxy = new NetworkProxy(networkProxyOptions);
-
-      console.log(`Initialized NetworkProxy on port ${this.settings.networkProxyPort}`);
-
-      // Convert and apply domain configurations to NetworkProxy
-      await this.syncDomainConfigsToNetworkProxy();
-    }
-  }
-
-  /**
-   * Updates the domain configurations for the proxy
-   * @param newDomainConfigs The new domain configurations
-   */
-  public async updateDomainConfigs(newDomainConfigs: IDomainConfig[]): Promise<void> {
-    console.log(`Updating domain configurations (${newDomainConfigs.length} configs)`);
-    this.settings.domainConfigs = newDomainConfigs;
-
-    // If NetworkProxy is initialized, resync the configurations
-    if (this.networkProxy) {
-      await this.syncDomainConfigsToNetworkProxy();
-    }
-  }
-
-  /**
-   * Updates the ACME certificate settings
-   * @param acmeSettings New ACME settings
-   */
-  public async updateAcmeSettings(acmeSettings: IPortProxySettings['acme']): Promise<void> {
-    console.log('Updating ACME certificate settings');
-
-    // Update settings
-    this.settings.acme = {
-      ...this.settings.acme,
-      ...acmeSettings,
-    };
-
-    // If NetworkProxy is initialized, update its ACME settings
-    if (this.networkProxy) {
-      try {
-        // Recreate NetworkProxy with new settings if ACME enabled state has changed
-        if (this.settings.acme.enabled !== acmeSettings.enabled) {
-          console.log(`ACME enabled state changed to: ${acmeSettings.enabled}`);
-
-          // Stop the current NetworkProxy
-          await this.networkProxy.stop();
-          this.networkProxy = null;
-
-          // Reinitialize with new settings
-          await this.initializeNetworkProxy();
-
-          // Use start() to make sure ACME gets initialized if newly enabled
-          await this.networkProxy.start();
-        } else {
-          // Update existing NetworkProxy with new settings
-          // Note: Some settings may require a restart to take effect
-          console.log('Updating ACME settings in NetworkProxy');
-
-          // For certificate renewals, we might want to trigger checks with the new settings
-          if (acmeSettings.renewThresholdDays) {
-            console.log(`Setting new renewal threshold to ${acmeSettings.renewThresholdDays} days`);
-            // This is implementation-dependent but gives an example
-            if (this.networkProxy.options.acme) {
-              this.networkProxy.options.acme.renewThresholdDays = acmeSettings.renewThresholdDays;
-            }
-          }
-        }
-      } catch (err) {
-        console.log(`Error updating ACME settings: ${err}`);
-      }
-    }
-  }
-
-  /**
-   * Synchronizes PortProxy domain configurations to NetworkProxy
-   * This allows domains configured in PortProxy to be used by NetworkProxy
-   */
-  private async syncDomainConfigsToNetworkProxy(): Promise<void> {
-    if (!this.networkProxy) {
-      console.log('Cannot sync configurations - NetworkProxy not initialized');
-      return;
-    }
-
-    try {
-      // Get SSL certificates from assets
-      // Import fs directly since it's not in plugins
-      const fs = await import('fs');
-
-      let certPair;
-      try {
-        certPair = {
-          key: fs.readFileSync('assets/certs/key.pem', 'utf8'),
-          cert: fs.readFileSync('assets/certs/cert.pem', 'utf8'),
-        };
-      } catch (certError) {
-        console.log(`Warning: Could not read default certificates: ${certError}`);
-        console.log(
-          'Using empty certificate placeholders - ACME will generate proper certificates if enabled'
-        );
-
-        // Use empty placeholders - NetworkProxy will use its internal defaults
-        // or ACME will generate proper ones if enabled
-        certPair = {
-          key: '',
-          cert: '',
-        };
-      }
-
-      // Convert domain configs to NetworkProxy configs
-      const proxyConfigs = this.networkProxy.convertPortProxyConfigs(
-        this.settings.domainConfigs,
-        certPair
-      );
-
-      // Log ACME-eligible domains if ACME is enabled
-      if (this.settings.acme?.enabled) {
-        const acmeEligibleDomains = proxyConfigs
-          .filter((config) => !config.hostName.includes('*')) // Exclude wildcards
-          .map((config) => config.hostName);
-
-        if (acmeEligibleDomains.length > 0) {
-          console.log(`Domains eligible for ACME certificates: ${acmeEligibleDomains.join(', ')}`);
-        } else {
-          console.log('No domains eligible for ACME certificates found in configuration');
-        }
-      }
-
-      // Update NetworkProxy with the converted configs
-      this.networkProxy
-        .updateProxyConfigs(proxyConfigs)
-        .then(() => {
-          console.log(
-            `Successfully synchronized ${proxyConfigs.length} domain configurations to NetworkProxy`
-          );
-        })
-        .catch((err) => {
-          console.log(`Error synchronizing configurations: ${err.message}`);
-        });
-    } catch (err) {
-      console.log(`Failed to sync configurations: ${err}`);
-    }
-  }
-
-  /**
-   * Requests a certificate for a specific domain
-   * @param domain The domain to request a certificate for
-   * @returns Promise that resolves to true if the request was successful, false otherwise
-   */
-  public async requestCertificate(domain: string): Promise<boolean> {
-    if (!this.networkProxy) {
-      console.log('Cannot request certificate - NetworkProxy not initialized');
-      return false;
-    }
-
-    if (!this.settings.acme?.enabled) {
-      console.log('Cannot request certificate - ACME is not enabled');
-      return false;
-    }
-
-    try {
-      const result = await this.networkProxy.requestCertificate(domain);
-      if (result) {
-        console.log(`Certificate request for ${domain} submitted successfully`);
-      } else {
-        console.log(`Certificate request for ${domain} failed`);
-      }
-      return result;
-    } catch (err) {
-      console.log(`Error requesting certificate: ${err}`);
-      return false;
-    }
-  }
-
-  /**
-   * Forwards a TLS connection to a NetworkProxy for handling
-   * @param connectionId - Unique connection identifier
-   * @param socket - The incoming client socket
-   * @param record - The connection record
-   * @param initialData - Initial data chunk (TLS ClientHello)
-   * @param customProxyPort - Optional custom port for NetworkProxy (for domain-specific settings)
-   */
-  private forwardToNetworkProxy(
-    connectionId: string,
-    socket: plugins.net.Socket,
-    record: IConnectionRecord,
-    initialData: Buffer,
-    customProxyPort?: number
-  ): void {
-    // Ensure NetworkProxy is initialized
-    if (!this.networkProxy) {
-      console.log(
-        `[${connectionId}] NetworkProxy not initialized. Using fallback direct connection.`
-      );
-      // Fall back to direct connection
-      return this.setupDirectConnection(
-        connectionId,
-        socket,
-        record,
-        undefined,
-        undefined,
-        initialData
-      );
-    }
-
-    // Use the custom port if provided, otherwise use the default NetworkProxy port
-    const proxyPort = customProxyPort || this.networkProxy.getListeningPort();
-    const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
-
-    if (this.settings.enableDetailedLogging) {
-      console.log(
-        `[${connectionId}] Forwarding TLS connection to NetworkProxy at ${proxyHost}:${proxyPort}`
-      );
-    }
-
-    // Create a connection to the NetworkProxy
-    const proxySocket = plugins.net.connect({
-      host: proxyHost,
-      port: proxyPort,
-    });
-
-    // Store the outgoing socket in the record
-    record.outgoing = proxySocket;
-    record.outgoingStartTime = Date.now();
-    record.usingNetworkProxy = true;
-
-    // Set up error handlers
-    proxySocket.on('error', (err) => {
-      console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
-      this.cleanupConnection(record, 'network_proxy_connect_error');
-    });
-
-    // Handle connection to NetworkProxy
-    proxySocket.on('connect', () => {
-      if (this.settings.enableDetailedLogging) {
-        console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
-      }
-
-      // First send the initial data that contains the TLS ClientHello
-      proxySocket.write(initialData);
-
-      // Now set up bidirectional piping between client and NetworkProxy
-      socket.pipe(proxySocket);
-      proxySocket.pipe(socket);
-
-      // Setup cleanup handlers
-      proxySocket.on('close', () => {
-        if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] NetworkProxy connection closed`);
-        }
-        this.cleanupConnection(record, 'network_proxy_closed');
-      });
-
-      socket.on('close', () => {
-        if (this.settings.enableDetailedLogging) {
-          console.log(
-            `[${connectionId}] Client connection closed after forwarding to NetworkProxy`
-          );
-        }
-        this.cleanupConnection(record, 'client_closed');
-      });
-
-      // Update activity on data transfer
-      socket.on('data', () => this.updateActivity(record));
-      proxySocket.on('data', () => this.updateActivity(record));
-
-      if (this.settings.enableDetailedLogging) {
-        console.log(`[${connectionId}] TLS connection successfully forwarded to NetworkProxy`);
-      }
-    });
-  }
-
-  /**
-   * Sets up a direct connection to the target (original behavior)
-   * This is used when NetworkProxy isn't configured or as a fallback
-   */
-  private setupDirectConnection(
-    connectionId: string,
-    socket: plugins.net.Socket,
-    record: IConnectionRecord,
-    domainConfig: IDomainConfig | undefined,
-    serverName?: string,
-    initialChunk?: Buffer,
-    overridePort?: number
-  ): void {
-    // Existing connection setup logic
-    const targetHost = domainConfig ? this.getTargetIP(domainConfig) : this.settings.targetIP!;
-    const connectionOptions: plugins.net.NetConnectOpts = {
-      host: targetHost,
-      port: overridePort !== undefined ? overridePort : this.settings.toPort,
-    };
-    if (this.settings.preserveSourceIP) {
-      connectionOptions.localAddress = record.remoteIP.replace('::ffff:', '');
-    }
-
-    // Create a safe queue for incoming data using a Buffer array
-    // We'll use this to ensure we don't lose data during handler transitions
-    const dataQueue: Buffer[] = [];
-    let queueSize = 0;
-    let processingQueue = false;
-    let drainPending = false;
-
-    // Flag to track if we've switched to the final piping mechanism
-    // Once this is true, we no longer buffer data in dataQueue
-    let pipingEstablished = false;
-
-    // Pause the incoming socket to prevent buffer overflows
-    // This ensures we control the flow of data until piping is set up
-    socket.pause();
-
-    // Function to safely process the data queue without losing events
-    const processDataQueue = () => {
-      if (processingQueue || dataQueue.length === 0 || pipingEstablished) return;
-
-      processingQueue = true;
-
-      try {
-        // Process all queued chunks with the current active handler
-        while (dataQueue.length > 0) {
-          const chunk = dataQueue.shift()!;
-          queueSize -= chunk.length;
-
-          // Once piping is established, we shouldn't get here,
-          // but just in case, pass to the outgoing socket directly
-          if (pipingEstablished && record.outgoing) {
-            record.outgoing.write(chunk);
-            continue;
-          }
-
-          // Track bytes received
-          record.bytesReceived += chunk.length;
-
-          // Check for TLS handshake
-          if (!record.isTLS && SniHandler.isTlsHandshake(chunk)) {
-            record.isTLS = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake detected in tempDataHandler, ${chunk.length} bytes`
-              );
-            }
-          }
-
-          // Check if adding this chunk would exceed the buffer limit
-          const newSize = record.pendingDataSize + chunk.length;
-
-          if (this.settings.maxPendingDataSize && newSize > this.settings.maxPendingDataSize) {
-            console.log(
-              `[${connectionId}] Buffer limit exceeded for connection from ${record.remoteIP}: ${newSize} bytes > ${this.settings.maxPendingDataSize} bytes`
-            );
-            socket.end(); // Gracefully close the socket
-            this.initiateCleanupOnce(record, 'buffer_limit_exceeded');
-            return;
-          }
-
-          // Buffer the chunk and update the size counter
-          record.pendingData.push(Buffer.from(chunk));
-          record.pendingDataSize = newSize;
-          this.updateActivity(record);
-        }
-      } finally {
-        processingQueue = false;
-
-        // If there's a pending drain and we've processed everything,
-        // signal we're ready for more data if we haven't established piping yet
-        if (drainPending && dataQueue.length === 0 && !pipingEstablished) {
-          drainPending = false;
-          socket.resume();
-        }
-      }
-    };
-
-    // Unified data handler that safely queues incoming data
-    const safeDataHandler = (chunk: Buffer) => {
-      // If piping is already established, just let the pipe handle it
-      if (pipingEstablished) return;
-
-      // Add to our queue for orderly processing
-      dataQueue.push(Buffer.from(chunk)); // Make a copy to be safe
-      queueSize += chunk.length;
-
-      // If queue is getting large, pause socket until we catch up
-      if (this.settings.maxPendingDataSize && queueSize > this.settings.maxPendingDataSize * 0.8) {
-        socket.pause();
-        drainPending = true;
-      }
-
-      // Process the queue
-      processDataQueue();
-    };
-
-    // Add our safe data handler
-    socket.on('data', safeDataHandler);
-
-    // Add initial chunk to pending data if present
-    if (initialChunk) {
-      record.bytesReceived += initialChunk.length;
-      record.pendingData.push(Buffer.from(initialChunk));
-      record.pendingDataSize = initialChunk.length;
-    }
-
-    // Create the target socket but don't set up piping immediately
-    const targetSocket = plugins.net.connect(connectionOptions);
-    record.outgoing = targetSocket;
-    record.outgoingStartTime = Date.now();
-
-    // Apply socket optimizations
-    targetSocket.setNoDelay(this.settings.noDelay);
-
-    // Apply keep-alive settings to the outgoing connection as well
-    if (this.settings.keepAlive) {
-      targetSocket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-
-      // Apply enhanced TCP keep-alive options if enabled
-      if (this.settings.enableKeepAliveProbes) {
-        try {
-          if ('setKeepAliveProbes' in targetSocket) {
-            (targetSocket as any).setKeepAliveProbes(10);
-          }
-          if ('setKeepAliveInterval' in targetSocket) {
-            (targetSocket as any).setKeepAliveInterval(1000);
-          }
-        } catch (err) {
-          // Ignore errors - these are optional enhancements
-          if (this.settings.enableDetailedLogging) {
-            console.log(
-              `[${connectionId}] Enhanced TCP keep-alive not supported for outgoing socket: ${err}`
-            );
-          }
-        }
-      }
-    }
-
-    // Setup specific error handler for connection phase
-    targetSocket.once('error', (err) => {
-      // This handler runs only once during the initial connection phase
-      const code = (err as any).code;
-      console.log(
-        `[${connectionId}] Connection setup error to ${targetHost}:${connectionOptions.port}: ${err.message} (${code})`
-      );
-
-      // Resume the incoming socket to prevent it from hanging
-      socket.resume();
-
-      if (code === 'ECONNREFUSED') {
-        console.log(
-          `[${connectionId}] Target ${targetHost}:${connectionOptions.port} refused connection`
-        );
-      } else if (code === 'ETIMEDOUT') {
-        console.log(
-          `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} timed out`
-        );
-      } else if (code === 'ECONNRESET') {
-        console.log(
-          `[${connectionId}] Connection to ${targetHost}:${connectionOptions.port} was reset`
-        );
-      } else if (code === 'EHOSTUNREACH') {
-        console.log(`[${connectionId}] Host ${targetHost} is unreachable`);
-      }
-
-      // Clear any existing error handler after connection phase
-      targetSocket.removeAllListeners('error');
-
-      // Re-add the normal error handler for established connections
-      targetSocket.on('error', this.handleError('outgoing', record));
-
-      if (record.outgoingTerminationReason === null) {
-        record.outgoingTerminationReason = 'connection_failed';
-        this.incrementTerminationStat('outgoing', 'connection_failed');
-      }
-
-      // Clean up the connection
-      this.initiateCleanupOnce(record, `connection_failed_${code}`);
-    });
-
-    // Setup close handler
-    targetSocket.on('close', this.handleClose('outgoing', record));
-    socket.on('close', this.handleClose('incoming', record));
-
-    // Handle timeouts with keep-alive awareness
-    socket.on('timeout', () => {
-      // For keep-alive connections, just log a warning instead of closing
-      if (record.hasKeepAlive) {
-        console.log(
-          `[${connectionId}] Timeout event on incoming keep-alive connection from ${
-            record.remoteIP
-          } after ${plugins.prettyMs(
-            this.settings.socketTimeout || 3600000
-          )}. Connection preserved.`
-        );
-        // Don't close the connection - just log
-        return;
-      }
-
-      // For non-keep-alive connections, proceed with normal cleanup
-      console.log(
-        `[${connectionId}] Timeout on incoming side from ${
-          record.remoteIP
-        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
-      );
-      if (record.incomingTerminationReason === null) {
-        record.incomingTerminationReason = 'timeout';
-        this.incrementTerminationStat('incoming', 'timeout');
-      }
-      this.initiateCleanupOnce(record, 'timeout_incoming');
-    });
-
-    targetSocket.on('timeout', () => {
-      // For keep-alive connections, just log a warning instead of closing
-      if (record.hasKeepAlive) {
-        console.log(
-          `[${connectionId}] Timeout event on outgoing keep-alive connection from ${
-            record.remoteIP
-          } after ${plugins.prettyMs(
-            this.settings.socketTimeout || 3600000
-          )}. Connection preserved.`
-        );
-        // Don't close the connection - just log
-        return;
-      }
-
-      // For non-keep-alive connections, proceed with normal cleanup
-      console.log(
-        `[${connectionId}] Timeout on outgoing side from ${
-          record.remoteIP
-        } after ${plugins.prettyMs(this.settings.socketTimeout || 3600000)}`
-      );
-      if (record.outgoingTerminationReason === null) {
-        record.outgoingTerminationReason = 'timeout';
-        this.incrementTerminationStat('outgoing', 'timeout');
-      }
-      this.initiateCleanupOnce(record, 'timeout_outgoing');
-    });
-
-    // Set appropriate timeouts, or disable for immortal keep-alive connections
-    if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
-      // Disable timeouts completely for immortal connections
-      socket.setTimeout(0);
-      targetSocket.setTimeout(0);
-
-      if (this.settings.enableDetailedLogging) {
-        console.log(
-          `[${connectionId}] Disabled socket timeouts for immortal keep-alive connection`
-        );
-      }
-    } else {
-      // Set normal timeouts for other connections
-      socket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
-      targetSocket.setTimeout(ensureSafeTimeout(this.settings.socketTimeout || 3600000));
-    }
-
-    // Track outgoing data for bytes counting
-    targetSocket.on('data', (chunk: Buffer) => {
-      record.bytesSent += chunk.length;
-      this.updateActivity(record);
-    });
-
-    // Wait for the outgoing connection to be ready before setting up piping
-    targetSocket.once('connect', () => {
-      // Clear the initial connection error handler
-      targetSocket.removeAllListeners('error');
-
-      // Add the normal error handler for established connections
-      targetSocket.on('error', this.handleError('outgoing', record));
-
-      // Process any remaining data in the queue before switching to piping
-      processDataQueue();
-      
-      // Set up piping immediately - don't delay this crucial step
-      pipingEstablished = true;
-      
-      // Flush all pending data to target
-      if (record.pendingData.length > 0) {
-        const combinedData = Buffer.concat(record.pendingData);
-        
-        if (this.settings.enableDetailedLogging) {
-          console.log(`[${connectionId}] Forwarding ${combinedData.length} bytes of initial data to target`);
-        }
-        
-        // Write pending data immediately
-        targetSocket.write(combinedData, (err) => {
-          if (err) {
-            console.log(`[${connectionId}] Error writing pending data to target: ${err.message}`);
-            return this.initiateCleanupOnce(record, 'write_error');
-          }
-        });
-        
-        // Clear the buffer now that we've processed it
-        record.pendingData = [];
-        record.pendingDataSize = 0;
-      }
-      
-      // Setup piping in both directions without any delays
-      socket.pipe(targetSocket);
-      targetSocket.pipe(socket);
-      
-      // Resume the socket to ensure data flows - CRITICAL!
-      socket.resume();
-      
-      // Process any data that might be queued in the interim
-      if (dataQueue.length > 0) {
-        // Write any remaining queued data directly to the target socket
-        for (const chunk of dataQueue) {
-          targetSocket.write(chunk);
-        }
-        // Clear the queue
-        dataQueue.length = 0;
-        queueSize = 0;
-      }
-      
-      if (this.settings.enableDetailedLogging) {
-        console.log(
-          `[${connectionId}] Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-            `${
-              serverName
-                ? ` (SNI: ${serverName})`
-                : domainConfig
-                ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
-                : ''
-            }` +
-            ` TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
-              record.hasKeepAlive ? 'Yes' : 'No'
-            }`
-        );
-      } else {
-        console.log(
-          `Connection established: ${record.remoteIP} -> ${targetHost}:${connectionOptions.port}` +
-            `${
-              serverName
-                ? ` (SNI: ${serverName})`
-                : domainConfig
-                ? ` (Port-based for domain: ${domainConfig.domains.join(', ')})`
-                : ''
-            }`
-        );
-      }
-
-
-      // Add the renegotiation handler for SNI validation with strict domain enforcement
-      // This will be called after we've established piping
-      if (serverName) {
-        // Define a handler for checking renegotiation with improved detection
-        const renegotiationHandler = (renegChunk: Buffer) => {
-          // Only process if this looks like a TLS ClientHello
-          if (SniHandler.isClientHello(renegChunk)) {
-            try {
-              // Extract SNI from ClientHello
-              // Create a connection info object for the existing connection
-              const connInfo = {
-                sourceIp: record.remoteIP,
-                sourcePort: record.incoming.remotePort || 0,
-                destIp: record.incoming.localAddress || '',
-                destPort: record.incoming.localPort || 0,
-              };
-
-              // Check for session tickets if allowSessionTicket is disabled
-              if (this.settings.allowSessionTicket === false) {
-                // Analyze for session resumption attempt (session ticket or PSK)
-                const resumptionInfo = SniHandler.hasSessionResumption(
-                  renegChunk,
-                  this.settings.enableTlsDebugLogging
-                );
-
-                if (resumptionInfo.isResumption) {
-                  // Always log resumption attempt for easier debugging
-                  // Try to extract SNI for logging
-                  const extractedSNI = SniHandler.extractSNI(
-                    renegChunk,
-                    this.settings.enableTlsDebugLogging
-                  );
-                  console.log(
-                    `[${connectionId}] Session resumption detected in renegotiation. ` +
-                      `Has SNI: ${resumptionInfo.hasSNI ? 'Yes' : 'No'}, ` +
-                      `SNI value: ${extractedSNI || 'None'}, ` +
-                      `allowSessionTicket: ${this.settings.allowSessionTicket}`
-                  );
-
-                  // Block if there's session resumption without SNI
-                  if (!resumptionInfo.hasSNI) {
-                    console.log(
-                      `[${connectionId}] Session resumption detected in renegotiation without SNI and allowSessionTicket=false. ` +
-                        `Terminating connection to force new TLS handshake.`
-                    );
-                    this.initiateCleanupOnce(record, 'session_ticket_blocked');
-                    return;
-                  } else {
-                    if (this.settings.enableDetailedLogging) {
-                      console.log(
-                        `[${connectionId}] Session resumption with SNI detected in renegotiation. ` +
-                          `Allowing connection since SNI is present.`
-                      );
-                    }
-                  }
-                }
-              }
-
-              const newSNI = SniHandler.extractSNIWithResumptionSupport(
-                renegChunk,
-                connInfo,
-                this.settings.enableTlsDebugLogging
-              );
-
-              // Skip if no SNI was found
-              if (!newSNI) return;
-
-              // Handle SNI change during renegotiation - always terminate for domain switches
-              if (newSNI !== record.lockedDomain) {
-                // Log and terminate the connection for any SNI change
-                console.log(
-                  `[${connectionId}] Renegotiation with different SNI: ${record.lockedDomain} -> ${newSNI}. ` +
-                    `Terminating connection - SNI domain switching is not allowed.`
-                );
-                this.initiateCleanupOnce(record, 'sni_mismatch');
-              } else if (this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Renegotiation detected with same SNI: ${newSNI}. Allowing.`
-                );
-              }
-            } catch (err) {
-              console.log(
-                `[${connectionId}] Error processing ClientHello: ${err}. Allowing connection to continue.`
-              );
-            }
-          }
-        };
-
-        // Store the handler in the connection record so we can remove it during cleanup
-        record.renegotiationHandler = renegotiationHandler;
-
-        // The renegotiation handler is added when piping is established
-        // Making it part of setupPiping ensures proper sequencing of event handlers
-        socket.on('data', renegotiationHandler);
-
-        if (this.settings.enableDetailedLogging) {
-          console.log(
-            `[${connectionId}] TLS renegotiation handler installed for SNI domain: ${serverName}`
-          );
-          if (this.settings.allowSessionTicket === false) {
-            console.log(
-              `[${connectionId}] Session ticket usage is disabled. Connection will be reset on reconnection attempts.`
-            );
-          }
-        }
-      }
-
-      // Set connection timeout with simpler logic
-      if (record.cleanupTimer) {
-        clearTimeout(record.cleanupTimer);
-      }
-
-      // For immortal keep-alive connections, skip setting a timeout completely
-      if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
-        if (this.settings.enableDetailedLogging) {
-          console.log(
-            `[${connectionId}] Keep-alive connection with immortal treatment - no max lifetime`
-          );
-        }
-        // No cleanup timer for immortal connections
-      }
-      // For extended keep-alive connections, use extended timeout
-      else if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
-        const extendedTimeout = this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000; // 7 days
-        const safeTimeout = ensureSafeTimeout(extendedTimeout);
-
-        record.cleanupTimer = setTimeout(() => {
-          console.log(
-            `[${connectionId}] Keep-alive connection from ${
-              record.remoteIP
-            } exceeded extended lifetime (${plugins.prettyMs(extendedTimeout)}), forcing cleanup.`
-          );
-          this.initiateCleanupOnce(record, 'extended_lifetime');
-        }, safeTimeout);
-
-        // Make sure timeout doesn't keep the process alive
-        if (record.cleanupTimer.unref) {
-          record.cleanupTimer.unref();
-        }
-
-        if (this.settings.enableDetailedLogging) {
-          console.log(
-            `[${connectionId}] Keep-alive connection with extended lifetime of ${plugins.prettyMs(
-              extendedTimeout
-            )}`
-          );
-        }
-      }
-      // For standard connections, use normal timeout
-      else {
-        // Use domain-specific timeout if available, otherwise use default
-        const connectionTimeout =
-          record.domainConfig?.connectionTimeout || this.settings.maxConnectionLifetime!;
-        const safeTimeout = ensureSafeTimeout(connectionTimeout);
-
-        record.cleanupTimer = setTimeout(() => {
-          console.log(
-            `[${connectionId}] Connection from ${
-              record.remoteIP
-            } exceeded max lifetime (${plugins.prettyMs(connectionTimeout)}), forcing cleanup.`
-          );
-          this.initiateCleanupOnce(record, 'connection_timeout');
-        }, safeTimeout);
-
-        // Make sure timeout doesn't keep the process alive
-        if (record.cleanupTimer.unref) {
-          record.cleanupTimer.unref();
-        }
-      }
-
-      // Mark TLS handshake as complete for TLS connections
-      if (record.isTLS) {
-        record.tlsHandshakeComplete = true;
-
-        if (this.settings.enableTlsDebugLogging) {
-          console.log(
-            `[${connectionId}] TLS handshake complete for connection from ${record.remoteIP}`
-          );
-        }
-      }
-    });
-  }
-
-  /**
-   * Get connections count by IP
-   */
-  private getConnectionCountByIP(ip: string): number {
-    return this.connectionsByIP.get(ip)?.size || 0;
-  }
-
-  /**
-   * Check and update connection rate for an IP
-   */
-  private checkConnectionRate(ip: string): boolean {
-    const now = Date.now();
-    const minute = 60 * 1000;
-
-    if (!this.connectionRateByIP.has(ip)) {
-      this.connectionRateByIP.set(ip, [now]);
-      return true;
-    }
-
-    // Get timestamps and filter out entries older than 1 minute
-    const timestamps = this.connectionRateByIP.get(ip)!.filter((time) => now - time < minute);
-    timestamps.push(now);
-    this.connectionRateByIP.set(ip, timestamps);
-
-    // Check if rate exceeds limit
-    return timestamps.length <= this.settings.connectionRateLimitPerMinute!;
-  }
-
-  /**
-   * Track connection by IP
-   */
-  private trackConnectionByIP(ip: string, connectionId: string): void {
-    if (!this.connectionsByIP.has(ip)) {
-      this.connectionsByIP.set(ip, new Set());
-    }
-    this.connectionsByIP.get(ip)!.add(connectionId);
-  }
-
-  /**
-   * Remove connection tracking for an IP
-   */
-  private removeConnectionByIP(ip: string, connectionId: string): void {
-    if (this.connectionsByIP.has(ip)) {
-      const connections = this.connectionsByIP.get(ip)!;
-      connections.delete(connectionId);
-      if (connections.size === 0) {
-        this.connectionsByIP.delete(ip);
-      }
-    }
-  }
-
-  /**
-   * Track connection termination statistic
-   */
-  private incrementTerminationStat(side: 'incoming' | 'outgoing', reason: string): void {
-    this.terminationStats[side][reason] = (this.terminationStats[side][reason] || 0) + 1;
-  }
-
-  /**
-   * Cleans up a connection record.
-   * Destroys both incoming and outgoing sockets, clears timers, and removes the record.
-   * @param record - The connection record to clean up
-   * @param reason - Optional reason for cleanup (for logging)
-   */
-  private cleanupConnection(record: IConnectionRecord, reason: string = 'normal'): void {
-    if (!record.connectionClosed) {
-      record.connectionClosed = true;
-
-      // Track connection termination
-      this.removeConnectionByIP(record.remoteIP, record.id);
-
-      if (record.cleanupTimer) {
-        clearTimeout(record.cleanupTimer);
-        record.cleanupTimer = undefined;
-      }
-
-      // Detailed logging data
-      const duration = Date.now() - record.incomingStartTime;
-      const bytesReceived = record.bytesReceived;
-      const bytesSent = record.bytesSent;
-
-      // Remove all data handlers (both standard and renegotiation) to make sure we clean up properly
-      if (record.incoming) {
-        try {
-          // Remove our safe data handler
-          record.incoming.removeAllListeners('data');
-
-          // Reset the handler references
-          record.renegotiationHandler = undefined;
-        } catch (err) {
-          console.log(`[${record.id}] Error removing data handlers: ${err}`);
-        }
-      }
-
-      try {
-        if (!record.incoming.destroyed) {
-          // Try graceful shutdown first, then force destroy after a short timeout
-          record.incoming.end();
-          const incomingTimeout = setTimeout(() => {
-            try {
-              if (record && !record.incoming.destroyed) {
-                record.incoming.destroy();
-              }
-            } catch (err) {
-              console.log(`[${record.id}] Error destroying incoming socket: ${err}`);
-            }
-          }, 1000);
-
-          // Ensure the timeout doesn't block Node from exiting
-          if (incomingTimeout.unref) {
-            incomingTimeout.unref();
-          }
-        }
-      } catch (err) {
-        console.log(`[${record.id}] Error closing incoming socket: ${err}`);
-        try {
-          if (!record.incoming.destroyed) {
-            record.incoming.destroy();
-          }
-        } catch (destroyErr) {
-          console.log(`[${record.id}] Error destroying incoming socket: ${destroyErr}`);
-        }
-      }
-
-      try {
-        if (record.outgoing && !record.outgoing.destroyed) {
-          // Try graceful shutdown first, then force destroy after a short timeout
-          record.outgoing.end();
-          const outgoingTimeout = setTimeout(() => {
-            try {
-              if (record && record.outgoing && !record.outgoing.destroyed) {
-                record.outgoing.destroy();
-              }
-            } catch (err) {
-              console.log(`[${record.id}] Error destroying outgoing socket: ${err}`);
-            }
-          }, 1000);
-
-          // Ensure the timeout doesn't block Node from exiting
-          if (outgoingTimeout.unref) {
-            outgoingTimeout.unref();
-          }
-        }
-      } catch (err) {
-        console.log(`[${record.id}] Error closing outgoing socket: ${err}`);
-        try {
-          if (record.outgoing && !record.outgoing.destroyed) {
-            record.outgoing.destroy();
-          }
-        } catch (destroyErr) {
-          console.log(`[${record.id}] Error destroying outgoing socket: ${destroyErr}`);
-        }
-      }
-
-      // Clear pendingData to avoid memory leaks
-      record.pendingData = [];
-      record.pendingDataSize = 0;
-
-      // Remove the record from the tracking map
-      this.connectionRecords.delete(record.id);
-
-      // Log connection details
-      if (this.settings.enableDetailedLogging) {
-        console.log(
-          `[${record.id}] Connection from ${record.remoteIP} on port ${record.localPort} terminated (${reason}).` +
-            ` Duration: ${plugins.prettyMs(
-              duration
-            )}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
-            `TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${
-              record.hasKeepAlive ? 'Yes' : 'No'
-            }` +
-            `${record.usingNetworkProxy ? ', Using NetworkProxy' : ''}` +
-            `${record.domainSwitches ? `, Domain switches: ${record.domainSwitches}` : ''}`
-        );
-      } else {
-        console.log(
-          `[${record.id}] Connection from ${record.remoteIP} terminated (${reason}). Active connections: ${this.connectionRecords.size}`
-        );
-      }
-    }
-  }
-
-  /**
-   * Update connection activity timestamp
-   */
-  private updateActivity(record: IConnectionRecord): void {
-    record.lastActivity = Date.now();
-
-    // Clear any inactivity warning
-    if (record.inactivityWarningIssued) {
-      record.inactivityWarningIssued = false;
-    }
-  }
-
-  /**
-   * Get target IP with round-robin support
-   */
-  private getTargetIP(domainConfig: IDomainConfig): string {
-    if (domainConfig.targetIPs && domainConfig.targetIPs.length > 0) {
-      const currentIndex = this.domainTargetIndices.get(domainConfig) || 0;
-      const ip = domainConfig.targetIPs[currentIndex % domainConfig.targetIPs.length];
-      this.domainTargetIndices.set(domainConfig, currentIndex + 1);
-      return ip;
-    }
-    return this.settings.targetIP!;
-  }
-
-  /**
-   * Initiates cleanup once for a connection
-   */
-  private initiateCleanupOnce(record: IConnectionRecord, reason: string = 'normal'): void {
-    if (this.settings.enableDetailedLogging) {
-      console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
-    }
-
-    if (
-      record.incomingTerminationReason === null ||
-      record.incomingTerminationReason === undefined
-    ) {
-      record.incomingTerminationReason = reason;
-      this.incrementTerminationStat('incoming', reason);
-    }
-
-    this.cleanupConnection(record, reason);
-  }
-
-  /**
-   * Creates a generic error handler for incoming or outgoing sockets
-   */
-  private handleError(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
-    return (err: Error) => {
-      const code = (err as any).code;
-      let reason = 'error';
-
-      const now = Date.now();
-      const connectionDuration = now - record.incomingStartTime;
-      const lastActivityAge = now - record.lastActivity;
-
-      if (code === 'ECONNRESET') {
-        reason = 'econnreset';
-        console.log(
-          `[${record.id}] ECONNRESET on ${side} side from ${record.remoteIP}: ${
-            err.message
-          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-            lastActivityAge
-          )} ago`
-        );
-      } else if (code === 'ETIMEDOUT') {
-        reason = 'etimedout';
-        console.log(
-          `[${record.id}] ETIMEDOUT on ${side} side from ${record.remoteIP}: ${
-            err.message
-          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-            lastActivityAge
-          )} ago`
-        );
-      } else {
-        console.log(
-          `[${record.id}] Error on ${side} side from ${record.remoteIP}: ${
-            err.message
-          }. Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(
-            lastActivityAge
-          )} ago`
-        );
-      }
-
-      if (side === 'incoming' && record.incomingTerminationReason === null) {
-        record.incomingTerminationReason = reason;
-        this.incrementTerminationStat('incoming', reason);
-      } else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
-        record.outgoingTerminationReason = reason;
-        this.incrementTerminationStat('outgoing', reason);
-      }
-
-      this.initiateCleanupOnce(record, reason);
-    };
-  }
-
-  /**
-   * Creates a generic close handler for incoming or outgoing sockets
-   */
-  private handleClose(side: 'incoming' | 'outgoing', record: IConnectionRecord) {
-    return () => {
-      if (this.settings.enableDetailedLogging) {
-        console.log(`[${record.id}] Connection closed on ${side} side from ${record.remoteIP}`);
-      }
-
-      if (side === 'incoming' && record.incomingTerminationReason === null) {
-        record.incomingTerminationReason = 'normal';
-        this.incrementTerminationStat('incoming', 'normal');
-      } else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
-        record.outgoingTerminationReason = 'normal';
-        this.incrementTerminationStat('outgoing', 'normal');
-        // Record the time when outgoing socket closed.
-        record.outgoingClosedTime = Date.now();
-      }
-
-      this.initiateCleanupOnce(record, 'closed_' + side);
-    };
-  }
-
-  /**
-   * Main method to start the proxy
-   */
-  public async start() {
-    // Don't start if already shutting down
-    if (this.isShuttingDown) {
-      console.log("Cannot start PortProxy while it's shutting down");
-      return;
-    }
-
-    // Initialize NetworkProxy if needed (useNetworkProxy is set but networkProxy isn't initialized)
-    if (
-      this.settings.useNetworkProxy &&
-      this.settings.useNetworkProxy.length > 0 &&
-      !this.networkProxy
-    ) {
-      await this.initializeNetworkProxy();
-    }
-
-    // Start NetworkProxy if configured
-    if (this.networkProxy) {
-      await this.networkProxy.start();
-      console.log(`NetworkProxy started on port ${this.settings.networkProxyPort}`);
-
-      // Log ACME status
-      if (this.settings.acme?.enabled) {
-        console.log(
-          `ACME certificate management is enabled (${
-            this.settings.acme.useProduction ? 'Production' : 'Staging'
-          } mode)`
-        );
-        console.log(`ACME HTTP challenge server on port ${this.settings.acme.port}`);
-
-        // Register domains for ACME certificates if enabled
-        if (this.networkProxy.options.acme?.enabled) {
-          console.log('Registering domains with ACME certificate manager...');
-          // The NetworkProxy will handle this internally via registerDomainsWithAcmeManager()
-        }
-      }
-    }
-
-    // Define a unified connection handler for all listening ports.
-    const connectionHandler = (socket: plugins.net.Socket) => {
-      if (this.isShuttingDown) {
-        socket.end();
-        socket.destroy();
-        return;
-      }
-
-      const remoteIP = socket.remoteAddress || '';
-      const localPort = socket.localPort || 0; // The port on which this connection was accepted.
-
-      // Check rate limits
-      if (
-        this.settings.maxConnectionsPerIP &&
-        this.getConnectionCountByIP(remoteIP) >= this.settings.maxConnectionsPerIP
-      ) {
-        console.log(
-          `Connection rejected from ${remoteIP}: Maximum connections per IP (${this.settings.maxConnectionsPerIP}) exceeded`
-        );
-        socket.end();
-        socket.destroy();
-        return;
-      }
-
-      if (this.settings.connectionRateLimitPerMinute && !this.checkConnectionRate(remoteIP)) {
-        console.log(
-          `Connection rejected from ${remoteIP}: Connection rate limit (${this.settings.connectionRateLimitPerMinute}/min) exceeded`
-        );
-        socket.end();
-        socket.destroy();
-        return;
-      }
-
-      // Apply socket optimizations
-      socket.setNoDelay(this.settings.noDelay);
-
-      // Create a unique connection ID and record
-      const connectionId = generateConnectionId();
-      const connectionRecord: IConnectionRecord = {
-        id: connectionId,
-        incoming: socket,
-        outgoing: null,
-        incomingStartTime: Date.now(),
-        lastActivity: Date.now(),
-        connectionClosed: false,
-        pendingData: [],
-        pendingDataSize: 0,
-
-        // Initialize enhanced tracking fields
-        bytesReceived: 0,
-        bytesSent: 0,
-        remoteIP: remoteIP,
-        localPort: localPort,
-        isTLS: false,
-        tlsHandshakeComplete: false,
-        hasReceivedInitialData: false,
-        hasKeepAlive: false, // Will set to true if keep-alive is applied
-        incomingTerminationReason: null,
-        outgoingTerminationReason: null,
-
-        // Initialize NetworkProxy tracking
-        usingNetworkProxy: false,
-
-        // Initialize browser connection tracking
-        isBrowserConnection: false,
-        domainSwitches: 0,
-      };
-
-      // Apply keep-alive settings if enabled
-      if (this.settings.keepAlive) {
-        socket.setKeepAlive(true, this.settings.keepAliveInitialDelay);
-        connectionRecord.hasKeepAlive = true; // Mark connection as having keep-alive
-
-        // Apply enhanced TCP keep-alive options if enabled
-        if (this.settings.enableKeepAliveProbes) {
-          try {
-            // These are platform-specific and may not be available
-            if ('setKeepAliveProbes' in socket) {
-              (socket as any).setKeepAliveProbes(10); // More aggressive probing
-            }
-            if ('setKeepAliveInterval' in socket) {
-              (socket as any).setKeepAliveInterval(1000); // 1 second interval between probes
-            }
-          } catch (err) {
-            // Ignore errors - these are optional enhancements
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${connectionId}] Enhanced TCP keep-alive settings not supported: ${err}`
-              );
-            }
-          }
-        }
-      }
-
-      // Track connection by IP
-      this.trackConnectionByIP(remoteIP, connectionId);
-      this.connectionRecords.set(connectionId, connectionRecord);
-
-      if (this.settings.enableDetailedLogging) {
-        console.log(
-          `[${connectionId}] New connection from ${remoteIP} on port ${localPort}. ` +
-            `Keep-Alive: ${connectionRecord.hasKeepAlive ? 'Enabled' : 'Disabled'}. ` +
-            `Active connections: ${this.connectionRecords.size}`
-        );
-      } else {
-        console.log(
-          `New connection from ${remoteIP} on port ${localPort}. Active connections: ${this.connectionRecords.size}`
-        );
-      }
-
-      // Check if this connection should be forwarded directly to NetworkProxy
-      // First check port-based forwarding settings
-      let shouldUseNetworkProxy =
-        this.settings.useNetworkProxy && this.settings.useNetworkProxy.includes(localPort);
-
-      // We'll look for domain-specific settings after SNI extraction
-
-      if (shouldUseNetworkProxy) {
-        // For NetworkProxy ports, we want to capture the TLS handshake and forward directly
-        let initialDataReceived = false;
-
-        // Set an initial timeout for handshake data
-        let initialTimeout: NodeJS.Timeout | null = setTimeout(() => {
-          if (!initialDataReceived) {
-            console.log(`[${connectionId}] Initial data warning (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP}`);
-            
-            // Add a grace period instead of immediate termination
-            setTimeout(() => {
-              if (!initialDataReceived) {
-                console.log(`[${connectionId}] Final initial data timeout after grace period`);
-                if (connectionRecord.incomingTerminationReason === null) {
-                  connectionRecord.incomingTerminationReason = 'initial_timeout';
-                  this.incrementTerminationStat('incoming', 'initial_timeout');
-                }
-                socket.end();
-                this.cleanupConnection(connectionRecord, 'initial_timeout');
-              }
-            }, 30000); // 30 second grace period
-          }
-        }, this.settings.initialDataTimeout!);
-
-        // Make sure timeout doesn't keep the process alive
-        if (initialTimeout.unref) {
-          initialTimeout.unref();
-        }
-
-        socket.on('error', this.handleError('incoming', connectionRecord));
-
-        // First data handler to capture initial TLS handshake for NetworkProxy
-        socket.once('data', (chunk: Buffer) => {
-          // Clear the initial timeout since we've received data
-          if (initialTimeout) {
-            clearTimeout(initialTimeout);
-            initialTimeout = null;
-          }
-
-          initialDataReceived = true;
-          connectionRecord.hasReceivedInitialData = true;
-
-          // Block non-TLS connections on port 443
-          // Always enforce TLS on standard HTTPS port
-          if (!SniHandler.isTlsHandshake(chunk) && localPort === 443) {
-            console.log(
-              `[${connectionId}] Non-TLS connection detected on port 443. ` +
-                `Terminating connection - only TLS traffic is allowed on standard HTTPS port.`
-            );
-            if (connectionRecord.incomingTerminationReason === null) {
-              connectionRecord.incomingTerminationReason = 'non_tls_blocked';
-              this.incrementTerminationStat('incoming', 'non_tls_blocked');
-            }
-            socket.end();
-            this.cleanupConnection(connectionRecord, 'non_tls_blocked');
-            return;
-          }
-
-          // Check if this looks like a TLS handshake
-          if (SniHandler.isTlsHandshake(chunk)) {
-            connectionRecord.isTLS = true;
-
-            // Check for TLS ClientHello with either no SNI or session tickets
-            if (this.settings.allowSessionTicket === false && SniHandler.isClientHello(chunk)) {
-              // Extract SNI first
-              const extractedSNI = SniHandler.extractSNI(
-                chunk,
-                this.settings.enableTlsDebugLogging
-              );
-              const hasSNI = !!extractedSNI;
-
-              // Analyze for session resumption attempt
-              const resumptionInfo = SniHandler.hasSessionResumption(
-                chunk,
-                this.settings.enableTlsDebugLogging
-              );
-
-              // Always log for debugging purposes
-              console.log(
-                `[${connectionId}] TLS ClientHello detected with allowSessionTicket=false. ` +
-                  `Has SNI: ${hasSNI ? 'Yes' : 'No'}, ` +
-                  `SNI value: ${extractedSNI || 'None'}, ` +
-                  `Has session resumption: ${resumptionInfo.isResumption ? 'Yes' : 'No'}`
-              );
-
-              // Block if this is a connection with session resumption but no SNI
-              if (resumptionInfo.isResumption && !hasSNI) {
-                console.log(
-                  `[${connectionId}] Session resumption detected in initial ClientHello without SNI and allowSessionTicket=false. ` +
-                    `Terminating connection to force new TLS handshake.`
-                );
-                if (connectionRecord.incomingTerminationReason === null) {
-                  connectionRecord.incomingTerminationReason = 'session_ticket_blocked';
-                  this.incrementTerminationStat('incoming', 'session_ticket_blocked');
-                }
-                socket.end();
-                this.cleanupConnection(connectionRecord, 'session_ticket_blocked');
-                return;
-              }
-
-              // Also block if this is a TLS connection without SNI when allowSessionTicket is false
-              // This forces clients to send SNI which helps with routing
-              if (!hasSNI && localPort === 443) {
-                console.log(
-                  `[${connectionId}] TLS ClientHello detected on port 443 without SNI and allowSessionTicket=false. ` +
-                    `Terminating connection to force proper SNI in handshake.`
-                );
-                if (connectionRecord.incomingTerminationReason === null) {
-                  connectionRecord.incomingTerminationReason = 'no_sni_blocked';
-                  this.incrementTerminationStat('incoming', 'no_sni_blocked');
-                }
-                socket.end();
-                this.cleanupConnection(connectionRecord, 'no_sni_blocked');
-                return;
-              }
-            }
-
-            // Try to extract SNI for domain-specific NetworkProxy handling
-            const connInfo = {
-              sourceIp: remoteIP,
-              sourcePort: socket.remotePort || 0,
-              destIp: socket.localAddress || '',
-              destPort: socket.localPort || 0,
-            };
-
-            // Extract SNI to check for domain-specific NetworkProxy settings
-            const serverName = SniHandler.processTlsPacket(
-              chunk,
-              connInfo,
-              this.settings.enableTlsDebugLogging
-            );
-
-            if (serverName) {
-              // If we got an SNI, check for domain-specific NetworkProxy settings
-              const domainConfig = this.settings.domainConfigs.find((config) =>
-                config.domains.some((d) => plugins.minimatch(serverName, d))
-              );
-
-              // Save domain config and SNI in connection record
-              connectionRecord.domainConfig = domainConfig;
-              connectionRecord.lockedDomain = serverName;
-
-              // Use domain-specific NetworkProxy port if configured
-              if (domainConfig?.useNetworkProxy) {
-                const networkProxyPort =
-                  domainConfig.networkProxyPort || this.settings.networkProxyPort;
-
-                if (this.settings.enableDetailedLogging) {
-                  console.log(
-                    `[${connectionId}] Using domain-specific NetworkProxy for ${serverName} on port ${networkProxyPort}`
-                  );
-                }
-
-                // Forward to NetworkProxy with domain-specific port
-                this.forwardToNetworkProxy(
-                  connectionId,
-                  socket,
-                  connectionRecord,
-                  chunk,
-                  networkProxyPort
-                );
-                return;
-              }
-            }
-
-            // Forward directly to NetworkProxy without domain-specific settings
-            this.forwardToNetworkProxy(connectionId, socket, connectionRecord, chunk);
-          } else {
-            // If not TLS, use normal direct connection
-            console.log(`[${connectionId}] Non-TLS connection on NetworkProxy port ${localPort}`);
-            this.setupDirectConnection(
-              connectionId,
-              socket,
-              connectionRecord,
-              undefined,
-              undefined,
-              chunk
-            );
-          }
-        });
-      } else {
-        // For non-NetworkProxy ports, proceed with normal processing
-
-        // Define helpers for rejecting connections
-        const rejectIncomingConnection = (reason: string, logMessage: string) => {
-          console.log(`[${connectionId}] ${logMessage}`);
-          socket.end();
-          if (connectionRecord.incomingTerminationReason === null) {
-            connectionRecord.incomingTerminationReason = reason;
-            this.incrementTerminationStat('incoming', reason);
-          }
-          this.cleanupConnection(connectionRecord, reason);
-        };
-
-        let initialDataReceived = false;
-
-        // Set an initial timeout for SNI data if needed
-        let initialTimeout: NodeJS.Timeout | null = null;
-        if (this.settings.sniEnabled) {
-          initialTimeout = setTimeout(() => {
-            if (!initialDataReceived) {
-              console.log(`[${connectionId}] Initial data warning (${this.settings.initialDataTimeout}ms) for connection from ${remoteIP}`);
-              
-              // Add a grace period instead of immediate termination
-              setTimeout(() => {
-                if (!initialDataReceived) {
-                  console.log(`[${connectionId}] Final initial data timeout after grace period`);
-                  if (connectionRecord.incomingTerminationReason === null) {
-                    connectionRecord.incomingTerminationReason = 'initial_timeout';
-                    this.incrementTerminationStat('incoming', 'initial_timeout');
-                  }
-                  socket.end();
-                  this.cleanupConnection(connectionRecord, 'initial_timeout');
-                }
-              }, 30000); // 30 second grace period
-            }
-          }, this.settings.initialDataTimeout!);
-
-          // Make sure timeout doesn't keep the process alive
-          if (initialTimeout.unref) {
-            initialTimeout.unref();
-          }
-        } else {
-          initialDataReceived = true;
-          connectionRecord.hasReceivedInitialData = true;
-        }
-
-        socket.on('error', this.handleError('incoming', connectionRecord));
-
-        // Track data for bytes counting
-        socket.on('data', (chunk: Buffer) => {
-          connectionRecord.bytesReceived += chunk.length;
-          this.updateActivity(connectionRecord);
-
-          // Check for TLS handshake if this is the first chunk
-          if (!connectionRecord.isTLS && SniHandler.isTlsHandshake(chunk)) {
-            connectionRecord.isTLS = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake detected from ${remoteIP}, ${chunk.length} bytes`
-              );
-              // Try to extract SNI and log detailed debug info
-              // Create connection info for debug logging
-              const debugConnInfo = {
-                sourceIp: remoteIP,
-                sourcePort: socket.remotePort || 0,
-                destIp: socket.localAddress || '',
-                destPort: socket.localPort || 0,
-              };
-
-              SniHandler.extractSNIWithResumptionSupport(chunk, debugConnInfo, true);
-            }
-          }
-        });
-
-        /**
-         * Sets up the connection to the target host.
-         * @param serverName - The SNI hostname (unused when forcedDomain is provided).
-         * @param initialChunk - Optional initial data chunk.
-         * @param forcedDomain - If provided, overrides SNI/domain lookup (used for port-based routing).
-         * @param overridePort - If provided, use this port for the outgoing connection.
-         */
-        const setupConnection = (
-          serverName: string,
-          initialChunk?: Buffer,
-          forcedDomain?: IDomainConfig,
-          overridePort?: number
-        ) => {
-          // Clear the initial timeout since we've received data
-          if (initialTimeout) {
-            clearTimeout(initialTimeout);
-            initialTimeout = null;
-          }
-
-          // Mark that we've received initial data
-          initialDataReceived = true;
-          connectionRecord.hasReceivedInitialData = true;
-
-          // Check if this looks like a TLS handshake
-          const isTlsHandshakeDetected = initialChunk && SniHandler.isTlsHandshake(initialChunk);
-          if (isTlsHandshakeDetected) {
-            connectionRecord.isTLS = true;
-
-            if (this.settings.enableTlsDebugLogging) {
-              console.log(
-                `[${connectionId}] TLS handshake detected in setup, ${initialChunk.length} bytes`
-              );
-            }
-          }
-
-          // If a forcedDomain is provided (port-based routing), use it; otherwise, use SNI-based lookup.
-          const domainConfig = forcedDomain
-            ? forcedDomain
-            : serverName
-            ? this.settings.domainConfigs.find((config) =>
-                config.domains.some((d) => plugins.minimatch(serverName, d))
-              )
-            : undefined;
-
-          // Save domain config in connection record
-          connectionRecord.domainConfig = domainConfig;
-
-          // Check if this domain should use NetworkProxy (domain-specific setting)
-          if (domainConfig?.useNetworkProxy && this.networkProxy) {
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${connectionId}] Domain ${serverName} is configured to use NetworkProxy`
-              );
-            }
-
-            const networkProxyPort =
-              domainConfig.networkProxyPort || this.settings.networkProxyPort;
-
-            if (initialChunk && connectionRecord.isTLS) {
-              // For TLS connections with initial chunk, forward to NetworkProxy
-              this.forwardToNetworkProxy(
-                connectionId,
-                socket,
-                connectionRecord,
-                initialChunk,
-                networkProxyPort // Pass the domain-specific NetworkProxy port if configured
-              );
-              return; // Skip normal connection setup
-            }
-          }
-
-          // IP validation is skipped if allowedIPs is empty
-          if (domainConfig) {
-            const effectiveAllowedIPs: string[] = [
-              ...domainConfig.allowedIPs,
-              ...(this.settings.defaultAllowedIPs || []),
-            ];
-            const effectiveBlockedIPs: string[] = [
-              ...(domainConfig.blockedIPs || []),
-              ...(this.settings.defaultBlockedIPs || []),
-            ];
-
-            // Skip IP validation if allowedIPs is empty
-            if (
-              domainConfig.allowedIPs.length > 0 &&
-              !isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)
-            ) {
-              return rejectIncomingConnection(
-                'rejected',
-                `Connection rejected: IP ${remoteIP} not allowed for domain ${domainConfig.domains.join(
-                  ', '
-                )}`
-              );
-            }
-          } else if (
-            this.settings.defaultAllowedIPs &&
-            this.settings.defaultAllowedIPs.length > 0
-          ) {
-            if (
-              !isGlobIPAllowed(
-                remoteIP,
-                this.settings.defaultAllowedIPs,
-                this.settings.defaultBlockedIPs || []
-              )
-            ) {
-              return rejectIncomingConnection(
-                'rejected',
-                `Connection rejected: IP ${remoteIP} not allowed by default allowed list`
-              );
-            }
-          }
-
-          // Save the initial SNI
-          if (serverName) {
-            connectionRecord.lockedDomain = serverName;
-          }
-
-          // Set up the direct connection
-          return this.setupDirectConnection(
-            connectionId,
-            socket,
-            connectionRecord,
-            domainConfig,
-            serverName,
-            initialChunk,
-            overridePort
-          );
-        };
-
-        // --- PORT RANGE-BASED HANDLING ---
-        // Only apply port-based rules if the incoming port is within one of the global port ranges.
-        if (
-          this.settings.globalPortRanges &&
-          isPortInRanges(localPort, this.settings.globalPortRanges)
-        ) {
-          if (this.settings.forwardAllGlobalRanges) {
-            if (
-              this.settings.defaultAllowedIPs &&
-              this.settings.defaultAllowedIPs.length > 0 &&
-              !isAllowed(remoteIP, this.settings.defaultAllowedIPs)
-            ) {
-              console.log(
-                `[${connectionId}] Connection from ${remoteIP} rejected: IP ${remoteIP} not allowed in global default allowed list.`
-              );
-              socket.end();
-              return;
-            }
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`
-              );
-            }
-            setupConnection(
-              '',
-              undefined,
-              {
-                domains: ['global'],
-                allowedIPs: this.settings.defaultAllowedIPs || [],
-                blockedIPs: this.settings.defaultBlockedIPs || [],
-                targetIPs: [this.settings.targetIP!],
-                portRanges: [],
-              },
-              localPort
-            );
-            return;
-          } else {
-            // Attempt to find a matching forced domain config based on the local port.
-            const forcedDomain = this.settings.domainConfigs.find(
-              (domain) =>
-                domain.portRanges &&
-                domain.portRanges.length > 0 &&
-                isPortInRanges(localPort, domain.portRanges)
-            );
-            if (forcedDomain) {
-              const effectiveAllowedIPs: string[] = [
-                ...forcedDomain.allowedIPs,
-                ...(this.settings.defaultAllowedIPs || []),
-              ];
-              const effectiveBlockedIPs: string[] = [
-                ...(forcedDomain.blockedIPs || []),
-                ...(this.settings.defaultBlockedIPs || []),
-              ];
-              if (!isGlobIPAllowed(remoteIP, effectiveAllowedIPs, effectiveBlockedIPs)) {
-                console.log(
-                  `[${connectionId}] Connection from ${remoteIP} rejected: IP not allowed for domain ${forcedDomain.domains.join(
-                    ', '
-                  )} on port ${localPort}.`
-                );
-                socket.end();
-                return;
-              }
-              if (this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Port-based connection from ${remoteIP} on port ${localPort} matched domain ${forcedDomain.domains.join(
-                    ', '
-                  )}.`
-                );
-              }
-              setupConnection('', undefined, forcedDomain, localPort);
-              return;
-            }
-            // Fall through to SNI/default handling if no forced domain config is found.
-          }
-        }
-
-        // --- FALLBACK: SNI-BASED HANDLING (or default when SNI is disabled) ---
-        if (this.settings.sniEnabled) {
-          initialDataReceived = false;
-
-          socket.once('data', (chunk: Buffer) => {
-            // Clear timeout immediately
-            if (initialTimeout) {
-              clearTimeout(initialTimeout);
-              initialTimeout = null;
-            }
-            
-            initialDataReceived = true;
-            
-            // Add debugging ONLY if detailed logging is enabled - avoid heavy processing
-            if (this.settings.enableTlsDebugLogging && SniHandler.isClientHello(chunk)) {
-              // Move heavy debug logging to a separate async task to not block the flow
-              setImmediate(() => {
-                try {
-                  const resumptionInfo = SniHandler.hasSessionResumption(chunk, true);
-                  const standardSNI = SniHandler.extractSNI(chunk, true);
-                  const pskSNI = SniHandler.extractSNIFromPSKExtension(chunk, true);
-                  
-                  console.log(`[${connectionId}] ClientHello details: isResumption=${resumptionInfo.isResumption}, hasSNI=${resumptionInfo.hasSNI}`);
-                  console.log(`[${connectionId}] SNI extraction results: standardSNI=${standardSNI || 'none'}, pskSNI=${pskSNI || 'none'}`);
-                } catch (err) {
-                  console.log(`[${connectionId}] Error in debug logging: ${err}`);
-                }
-              });
-            }
-
-            // Block non-TLS connections on port 443
-            // Always enforce TLS on standard HTTPS port
-            if (!SniHandler.isTlsHandshake(chunk) && localPort === 443) {
-              console.log(
-                `[${connectionId}] Non-TLS connection detected on port 443 in SNI handler. ` +
-                  `Terminating connection - only TLS traffic is allowed on standard HTTPS port.`
-              );
-              if (connectionRecord.incomingTerminationReason === null) {
-                connectionRecord.incomingTerminationReason = 'non_tls_blocked';
-                this.incrementTerminationStat('incoming', 'non_tls_blocked');
-              }
-              socket.end();
-              this.cleanupConnection(connectionRecord, 'non_tls_blocked');
-              return;
-            }
-
-            // Try to extract SNI
-            let serverName = '';
-
-            if (SniHandler.isTlsHandshake(chunk)) {
-              connectionRecord.isTLS = true;
-
-              if (this.settings.enableTlsDebugLogging) {
-                console.log(
-                  `[${connectionId}] Extracting SNI from TLS handshake, ${chunk.length} bytes`
-                );
-              }
-
-              // Check for session tickets if allowSessionTicket is disabled
-              if (this.settings.allowSessionTicket === false && SniHandler.isClientHello(chunk)) {
-                // Analyze for session resumption attempt
-                const resumptionInfo = SniHandler.hasSessionResumption(
-                  chunk,
-                  this.settings.enableTlsDebugLogging
-                );
-
-                if (resumptionInfo.isResumption) {
-                  // Always log resumption attempt for easier debugging
-                  // Try to extract SNI for logging
-                  const extractedSNI = SniHandler.extractSNI(
-                    chunk,
-                    this.settings.enableTlsDebugLogging
-                  );
-                  console.log(
-                    `[${connectionId}] Session resumption detected in SNI handler. ` +
-                      `Has SNI: ${resumptionInfo.hasSNI ? 'Yes' : 'No'}, ` +
-                      `SNI value: ${extractedSNI || 'None'}, ` +
-                      `allowSessionTicket: ${this.settings.allowSessionTicket}`
-                  );
-
-                  // Block if there's session resumption without SNI
-                  if (!resumptionInfo.hasSNI) {
-                    console.log(
-                      `[${connectionId}] Session resumption detected in SNI handler without SNI and allowSessionTicket=false. ` +
-                        `Terminating connection to force new TLS handshake.`
-                    );
-                    if (connectionRecord.incomingTerminationReason === null) {
-                      connectionRecord.incomingTerminationReason = 'session_ticket_blocked';
-                      this.incrementTerminationStat('incoming', 'session_ticket_blocked');
-                    }
-                    socket.end();
-                    this.cleanupConnection(connectionRecord, 'session_ticket_blocked');
-                    return;
-                  } else {
-                    if (this.settings.enableDetailedLogging) {
-                      console.log(
-                        `[${connectionId}] Session resumption with SNI detected in SNI handler. ` +
-                          `Allowing connection since SNI is present.`
-                      );
-                    }
-                  }
-                }
-              }
-
-              // Create connection info object for SNI extraction
-              const connInfo = {
-                sourceIp: remoteIP,
-                sourcePort: socket.remotePort || 0,
-                destIp: socket.localAddress || '',
-                destPort: socket.localPort || 0,
-              };
-
-              // Use the new processTlsPacket method for comprehensive handling
-              serverName =
-                SniHandler.processTlsPacket(
-                  chunk,
-                  connInfo,
-                  this.settings.enableTlsDebugLogging,
-                  connectionRecord.lockedDomain // Pass any previously negotiated domain as a hint
-                ) || '';
-            }
-
-            // Lock the connection to the negotiated SNI.
-            connectionRecord.lockedDomain = serverName;
-
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${connectionId}] Received connection from ${remoteIP} with SNI: ${
-                  serverName || '(empty)'
-                }`
-              );
-            }
-
-            setupConnection(serverName, chunk);
-          });
-        } else {
-          initialDataReceived = true;
-          connectionRecord.hasReceivedInitialData = true;
-
-          if (
-            this.settings.defaultAllowedIPs &&
-            this.settings.defaultAllowedIPs.length > 0 &&
-            !isAllowed(remoteIP, this.settings.defaultAllowedIPs)
-          ) {
-            return rejectIncomingConnection(
-              'rejected',
-              `Connection rejected: IP ${remoteIP} not allowed for non-SNI connection`
-            );
-          }
-
-          setupConnection('');
-        }
-      }
-    };
-
-    // --- SETUP LISTENERS ---
-    // Determine which ports to listen on.
-    const listeningPorts = new Set<number>();
-    if (this.settings.globalPortRanges && this.settings.globalPortRanges.length > 0) {
-      // Listen on every port defined by the global ranges.
-      for (const range of this.settings.globalPortRanges) {
-        for (let port = range.from; port <= range.to; port++) {
-          listeningPorts.add(port);
-        }
-      }
-      // Also ensure the default fromPort is listened to if it isn't already in the ranges.
-      listeningPorts.add(this.settings.fromPort);
-    } else {
-      listeningPorts.add(this.settings.fromPort);
-    }
-
-    // Create a server for each port.
-    for (const port of listeningPorts) {
-      const server = plugins.net.createServer(connectionHandler).on('error', (err: Error) => {
-        console.log(`Server Error on port ${port}: ${err.message}`);
-      });
-      server.listen(port, () => {
-        const isNetworkProxyPort = this.settings.useNetworkProxy?.includes(port);
-        console.log(
-          `PortProxy -> OK: Now listening on port ${port}${
-            this.settings.sniEnabled && !isNetworkProxyPort ? ' (SNI passthrough enabled)' : ''
-          }${isNetworkProxyPort ? ' (NetworkProxy forwarding enabled)' : ''}`
-        );
-      });
-      this.netServers.push(server);
-    }
-
-    // Log active connection count, longest running durations, and run parity checks periodically
-    this.connectionLogger = setInterval(() => {
-      // Immediately return if shutting down
-      if (this.isShuttingDown) return;
-
-      const now = Date.now();
-      let maxIncoming = 0;
-      let maxOutgoing = 0;
-      let tlsConnections = 0;
-      let nonTlsConnections = 0;
-      let completedTlsHandshakes = 0;
-      let pendingTlsHandshakes = 0;
-      let keepAliveConnections = 0;
-      let networkProxyConnections = 0;
-      let domainSwitchedConnections = 0;
-
-      // Create a copy of the keys to avoid modification during iteration
-      const connectionIds = [...this.connectionRecords.keys()];
-
-      for (const id of connectionIds) {
-        const record = this.connectionRecords.get(id);
-        if (!record) continue;
-
-        // Track connection stats
-        if (record.isTLS) {
-          tlsConnections++;
-          if (record.tlsHandshakeComplete) {
-            completedTlsHandshakes++;
-          } else {
-            pendingTlsHandshakes++;
-          }
-        } else {
-          nonTlsConnections++;
-        }
-
-        if (record.hasKeepAlive) {
-          keepAliveConnections++;
-        }
-
-        if (record.usingNetworkProxy) {
-          networkProxyConnections++;
-        }
-
-        if (record.domainSwitches && record.domainSwitches > 0) {
-          domainSwitchedConnections++;
-        }
-
-        maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
-        if (record.outgoingStartTime) {
-          maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
-        }
-        // Parity check: if outgoing socket closed and incoming remains active
-        if (
-          record.outgoingClosedTime &&
-          !record.incoming.destroyed &&
-          !record.connectionClosed &&
-          now - record.outgoingClosedTime > 120000
-        ) {
-          const remoteIP = record.remoteIP;
-          console.log(
-            `[${id}] Parity check: Incoming socket for ${remoteIP} still active ${plugins.prettyMs(
-              now - record.outgoingClosedTime
-            )} after outgoing closed.`
-          );
-          this.cleanupConnection(record, 'parity_check');
-        }
-
-        // Check for stalled connections waiting for initial data
-        if (
-          !record.hasReceivedInitialData &&
-          now - record.incomingStartTime > this.settings.initialDataTimeout! / 2
-        ) {
-          console.log(
-            `[${id}] Warning: Connection from ${
-              record.remoteIP
-            } has not received initial data after ${plugins.prettyMs(
-              now - record.incomingStartTime
-            )}`
-          );
-        }
-
-        // Skip inactivity check if disabled or for immortal keep-alive connections
-        if (
-          !this.settings.disableInactivityCheck &&
-          !(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
-        ) {
-          const inactivityTime = now - record.lastActivity;
-
-          // Use extended timeout for extended-treatment keep-alive connections
-          let effectiveTimeout = this.settings.inactivityTimeout!;
-          if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
-            const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
-            effectiveTimeout = effectiveTimeout * multiplier;
-          }
-
-          if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
-            // For keep-alive connections, issue a warning first
-            if (record.hasKeepAlive && !record.inactivityWarningIssued) {
-              console.log(
-                `[${id}] Warning: Keep-alive connection from ${
-                  record.remoteIP
-                } inactive for ${plugins.prettyMs(inactivityTime)}. ` +
-                  `Will close in 10 minutes if no activity.`
-              );
-
-              // Set warning flag and add grace period
-              record.inactivityWarningIssued = true;
-              record.lastActivity = now - (effectiveTimeout - 600000);
-
-              // Try to stimulate activity with a probe packet
-              if (record.outgoing && !record.outgoing.destroyed) {
-                try {
-                  record.outgoing.write(Buffer.alloc(0));
-
-                  if (this.settings.enableDetailedLogging) {
-                    console.log(`[${id}] Sent probe packet to test keep-alive connection`);
-                  }
-                } catch (err) {
-                  console.log(`[${id}] Error sending probe packet: ${err}`);
-                }
-              }
-            } else {
-              // For non-keep-alive or after warning, close the connection
-              console.log(
-                `[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
-                  `for ${plugins.prettyMs(inactivityTime)}.` +
-                  (record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
-              );
-              this.cleanupConnection(record, 'inactivity');
-            }
-          } else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
-            // If activity detected after warning, clear the warning
-            if (this.settings.enableDetailedLogging) {
-              console.log(
-                `[${id}] Connection activity detected after inactivity warning, resetting warning`
-              );
-            }
-            record.inactivityWarningIssued = false;
-          }
-        }
-      }
-
-      // Log detailed stats periodically
-      console.log(
-        `Active connections: ${this.connectionRecords.size}. ` +
-          `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
-          `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}, ` +
-          `DomainSwitched=${domainSwitchedConnections}. ` +
-          `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(
-            maxOutgoing
-          )}. ` +
-          `Termination stats: ${JSON.stringify({
-            IN: this.terminationStats.incoming,
-            OUT: this.terminationStats.outgoing,
-          })}`
-      );
-    }, this.settings.inactivityCheckInterval || 60000);
-
-    // Make sure the interval doesn't keep the process alive
-    if (this.connectionLogger.unref) {
-      this.connectionLogger.unref();
-    }
-  }
-
-  /**
-   * Gracefully shut down the proxy
-   */
-  public async stop() {
-    console.log('PortProxy shutting down...');
-    this.isShuttingDown = true;
-
-    // Stop accepting new connections
-    const closeServerPromises: Promise<void>[] = this.netServers.map(
-      (server) =>
-        new Promise<void>((resolve) => {
-          if (!server.listening) {
-            resolve();
-            return;
-          }
-          server.close((err) => {
-            if (err) {
-              console.log(`Error closing server: ${err.message}`);
-            }
-            resolve();
-          });
-        })
-    );
-
-    // Stop the connection logger
-    if (this.connectionLogger) {
-      clearInterval(this.connectionLogger);
-      this.connectionLogger = null;
-    }
-
-    // Wait for servers to close
-    await Promise.all(closeServerPromises);
-    console.log('All servers closed. Cleaning up active connections...');
-
-    // Force destroy all active connections immediately
-    const connectionIds = [...this.connectionRecords.keys()];
-    console.log(`Cleaning up ${connectionIds.length} active connections...`);
-
-    // First pass: End all connections gracefully
-    for (const id of connectionIds) {
-      const record = this.connectionRecords.get(id);
-      if (record) {
-        try {
-          // Clear any timers
-          if (record.cleanupTimer) {
-            clearTimeout(record.cleanupTimer);
-            record.cleanupTimer = undefined;
-          }
-
-          // End sockets gracefully
-          if (record.incoming && !record.incoming.destroyed) {
-            record.incoming.end();
-          }
-
-          if (record.outgoing && !record.outgoing.destroyed) {
-            record.outgoing.end();
-          }
-        } catch (err) {
-          console.log(`Error during graceful connection end for ${id}: ${err}`);
-        }
-      }
-    }
-
-    // Short delay to allow graceful ends to process
-    await new Promise((resolve) => setTimeout(resolve, 100));
-
-    // Second pass: Force destroy everything
-    for (const id of connectionIds) {
-      const record = this.connectionRecords.get(id);
-      if (record) {
-        try {
-          // Remove all listeners to prevent memory leaks
-          if (record.incoming) {
-            record.incoming.removeAllListeners();
-            if (!record.incoming.destroyed) {
-              record.incoming.destroy();
-            }
-          }
-
-          if (record.outgoing) {
-            record.outgoing.removeAllListeners();
-            if (!record.outgoing.destroyed) {
-              record.outgoing.destroy();
-            }
-          }
-        } catch (err) {
-          console.log(`Error during forced connection destruction for ${id}: ${err}`);
-        }
-      }
-    }
-
-    // Stop NetworkProxy if it was started (which also stops ACME manager)
-    if (this.networkProxy) {
-      try {
-        console.log('Stopping NetworkProxy...');
-        await this.networkProxy.stop();
-        console.log('NetworkProxy stopped successfully');
-
-        // Log ACME shutdown if it was enabled
-        if (this.settings.acme?.enabled) {
-          console.log('ACME certificate manager stopped');
-        }
-      } catch (err) {
-        console.log(`Error stopping NetworkProxy: ${err}`);
-      }
-    }
-
-    // Clear all tracking maps
-    this.connectionRecords.clear();
-    this.domainTargetIndices.clear();
-    this.connectionsByIP.clear();
-    this.connectionRateByIP.clear();
-    this.netServers = [];
-
-    // Reset termination stats
-    this.terminationStats = {
-      incoming: {},
-      outgoing: {},
-    };
-
-    console.log('PortProxy shutdown complete.');
-  }
-}