ja4proxy 0.2.0__tar.gz → 0.3.0__tar.gz

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ja4proxy
-Version: 0.2.0
+Version: 0.3.0
 Summary: High-performance universal proxy server with browser TLS (JA4) and HTTP/2 impersonation
 Author-email: cipherwire <dev@cipherwire.link>
 License-Expression: MIT
@@ -657,7 +657,7 @@ Run the full automated test suite covering CA generation, SOCKS5 state machines,
 python -m unittest discover -s tests -p "test_*.py" -v
 ```
 
-All 18 unit and live tests execute with zero warnings and zero regressions:
+All 19 unit and live tests execute with zero warnings and zero regressions:
 ```text
 test_ca_creation (test_certs.TestCertificateAuthority) ... ok
 test_leaf_cert_generation (test_certs.TestCertificateAuthority) ... ok
@@ -667,6 +667,7 @@ test_live_post_httpbin (test_engine.TestNativeEngine) ... ok
 test_bad_gateway_mapping_status_502 (test_live_proxy.TestLiveProxy) ... ok
 test_chunked_request_upload (test_live_proxy.TestLiveProxy) ... ok
 test_client_proxy_authentication (test_live_proxy.TestLiveProxy) ... ok
+test_connect_tls_handshake_timeout (test_live_proxy.TestLiveProxy) ... ok
 test_gateway_mode_gzip (test_live_proxy.TestLiveProxy) ... ok
 test_safari_ios_headers (test_live_proxy.TestLiveProxy) ... ok
 test_socks5_ingress_tls_peet (test_live_proxy.TestLiveProxy) ... ok
@@ -679,7 +680,7 @@ test_parse_credentials_proxy_with_hyphens (test_parser.TestParser) ... ok
 test_parse_credentials_tags (test_parser.TestParser) ... ok
 
 ----------------------------------------------------------------------
-Ran 18 tests in 6.164s
+Ran 19 tests in 6.421s
 
 OK
 ```

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/README.md

@@ -644,7 +644,7 @@ Run the full automated test suite covering CA generation, SOCKS5 state machines,
 python -m unittest discover -s tests -p "test_*.py" -v
 ```
 
-All 18 unit and live tests execute with zero warnings and zero regressions:
+All 19 unit and live tests execute with zero warnings and zero regressions:
 ```text
 test_ca_creation (test_certs.TestCertificateAuthority) ... ok
 test_leaf_cert_generation (test_certs.TestCertificateAuthority) ... ok
@@ -654,6 +654,7 @@ test_live_post_httpbin (test_engine.TestNativeEngine) ... ok
 test_bad_gateway_mapping_status_502 (test_live_proxy.TestLiveProxy) ... ok
 test_chunked_request_upload (test_live_proxy.TestLiveProxy) ... ok
 test_client_proxy_authentication (test_live_proxy.TestLiveProxy) ... ok
+test_connect_tls_handshake_timeout (test_live_proxy.TestLiveProxy) ... ok
 test_gateway_mode_gzip (test_live_proxy.TestLiveProxy) ... ok
 test_safari_ios_headers (test_live_proxy.TestLiveProxy) ... ok
 test_socks5_ingress_tls_peet (test_live_proxy.TestLiveProxy) ... ok
@@ -666,7 +667,7 @@ test_parse_credentials_proxy_with_hyphens (test_parser.TestParser) ... ok
 test_parse_credentials_tags (test_parser.TestParser) ... ok
 
 ----------------------------------------------------------------------
-Ran 18 tests in 6.164s
+Ran 19 tests in 6.421s
 
 OK
 ```

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/ja4proxy/__init__.py

@@ -1,6 +1,6 @@
 """ja4proxy: High-performance universal proxy server with browser TLS (JA4) and HTTP/2 impersonation."""
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 __author__ = "cipherwire"
 
 from ja4proxy.engine.bridge import NativeEngine

ja4proxy-0.3.0/ja4proxy/__main__.py

@@ -0,0 +1,5 @@
+"""Entry point for python -m ja4proxy."""
+from ja4proxy.cli import main
+
+if __name__ == "__main__":
+    main()

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/ja4proxy/server.py

@@ -22,6 +22,7 @@ from ja4proxy.parser import (
 logger = logging.getLogger("ja4proxy")
 
 DEFAULT_IDLE_TIMEOUT: float = 15.0
+DEFAULT_TLS_HANDSHAKE_TIMEOUT: float = 10.0
 _DNS_CACHE_TTL: float = 120.0
 _DNS_CACHE: dict[str, tuple[bool, float]] = {}
 _DNS_LOCKS: dict[str, asyncio.Lock] = {}
@@ -161,6 +162,7 @@ class ProxyServer:
         upstream_proxy: str | None = None,
         auth: str | None = None,
         idle_timeout: float = DEFAULT_IDLE_TIMEOUT,
+        tls_handshake_timeout: float = DEFAULT_TLS_HANDSHAKE_TIMEOUT,
     ):
         self.host = host
         self.port = port
@@ -177,6 +179,7 @@ class ProxyServer:
             self.auth_user, self.auth_pass = None, None
 
         self.idle_timeout = idle_timeout
+        self.tls_handshake_timeout = tls_handshake_timeout
         self.ca = CertificateAuthority(cert_dir)
         self.engine = NativeEngine.get_instance()
         self._server: asyncio.Server | None = None
@@ -414,16 +417,26 @@ class ProxyServer:
 
         # Prepare SSL context before acknowledging SOCKS5 to ensure server is ready for TLS ClientHello
         if target_port == 443:
-            ssl_ctx = self.ca.get_ssl_context_for_host(target_host)
+            ssl_ctx = await self.ca.get_ssl_context_for_host_async(target_host)
             writer.write(b"\x05\x00\x00\x01\x00\x00\x00\x00\x00\x00")
             await writer.drain()
 
             loop = asyncio.get_running_loop()
             transport = writer.transport
             protocol = transport.get_protocol()
-            new_transport = await loop.start_tls(
-                transport, protocol, ssl_ctx, server_side=True
-            )
+            try:
+                new_transport = await asyncio.wait_for(
+                    loop.start_tls(transport, protocol, ssl_ctx, server_side=True),
+                    timeout=self.tls_handshake_timeout,
+                )
+            except (asyncio.TimeoutError, Exception) as exc:
+                logger.debug(f"SOCKS5 TLS handshake failed or timed out for {target_host}: {exc}")
+                writer.close()
+                try:
+                    await writer.wait_closed()
+                except Exception:
+                    pass
+                return
             writer._transport = new_transport
 
             await self._run_tls_http_loop(reader, writer, target_authority, directive)
@@ -482,16 +495,26 @@ class ProxyServer:
         directive, _ = extract_directives(headers)
 
         if target_port == 443:
-            ssl_ctx = self.ca.get_ssl_context_for_host(clean_host)
+            ssl_ctx = await self.ca.get_ssl_context_for_host_async(clean_host)
             writer.write(b"HTTP/1.1 200 Connection Established\r\n\r\n")
             await writer.drain()
 
             loop = asyncio.get_running_loop()
             transport = writer.transport
             protocol = transport.get_protocol()
-            new_transport = await loop.start_tls(
-                transport, protocol, ssl_ctx, server_side=True
-            )
+            try:
+                new_transport = await asyncio.wait_for(
+                    loop.start_tls(transport, protocol, ssl_ctx, server_side=True),
+                    timeout=self.tls_handshake_timeout,
+                )
+            except (asyncio.TimeoutError, Exception) as exc:
+                logger.debug(f"CONNECT TLS handshake failed or timed out for {clean_host}: {exc}")
+                writer.close()
+                try:
+                    await writer.wait_closed()
+                except Exception:
+                    pass
+                return
             writer._transport = new_transport
 
             await self._run_tls_http_loop(reader, writer, target_authority, directive)

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/ja4proxy.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ja4proxy
-Version: 0.2.0
+Version: 0.3.0
 Summary: High-performance universal proxy server with browser TLS (JA4) and HTTP/2 impersonation
 Author-email: cipherwire <dev@cipherwire.link>
 License-Expression: MIT
@@ -657,7 +657,7 @@ Run the full automated test suite covering CA generation, SOCKS5 state machines,
 python -m unittest discover -s tests -p "test_*.py" -v
 ```
 
-All 18 unit and live tests execute with zero warnings and zero regressions:
+All 19 unit and live tests execute with zero warnings and zero regressions:
 ```text
 test_ca_creation (test_certs.TestCertificateAuthority) ... ok
 test_leaf_cert_generation (test_certs.TestCertificateAuthority) ... ok
@@ -667,6 +667,7 @@ test_live_post_httpbin (test_engine.TestNativeEngine) ... ok
 test_bad_gateway_mapping_status_502 (test_live_proxy.TestLiveProxy) ... ok
 test_chunked_request_upload (test_live_proxy.TestLiveProxy) ... ok
 test_client_proxy_authentication (test_live_proxy.TestLiveProxy) ... ok
+test_connect_tls_handshake_timeout (test_live_proxy.TestLiveProxy) ... ok
 test_gateway_mode_gzip (test_live_proxy.TestLiveProxy) ... ok
 test_safari_ios_headers (test_live_proxy.TestLiveProxy) ... ok
 test_socks5_ingress_tls_peet (test_live_proxy.TestLiveProxy) ... ok
@@ -679,7 +680,7 @@ test_parse_credentials_proxy_with_hyphens (test_parser.TestParser) ... ok
 test_parse_credentials_tags (test_parser.TestParser) ... ok
 
 ----------------------------------------------------------------------
-Ran 18 tests in 6.164s
+Ran 19 tests in 6.421s
 
 OK
 ```

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/ja4proxy.egg-info/SOURCES.txt

@@ -2,6 +2,7 @@ LICENSE
 README.md
 pyproject.toml
 ja4proxy/__init__.py
+ja4proxy/__main__.py
 ja4proxy/certs.py
 ja4proxy/cli.py
 ja4proxy/parser.py

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ja4proxy"
-version = "0.2.0"
+version = "0.3.0"
 description = "High-performance universal proxy server with browser TLS (JA4) and HTTP/2 impersonation"
 readme = "README.md"
 authors = [{ name = "cipherwire", email = "dev@cipherwire.link" }]

{ja4proxy-0.2.0 → ja4proxy-0.3.0}/tests/test_live_proxy.py

@@ -271,7 +271,6 @@ class TestLiveProxy(unittest.IsolatedAsyncioTestCase):
             # 2. Authorized request with valid credentials -> 200 / processed
             reader, writer = await asyncio.open_connection("127.0.0.1", auth_server.port)
             auth_token = "proxyuser:secretpass".encode("utf-8")
-            b64_auth = struct.__dict__.get("b64", None)
             import base64
             auth_header = base64.b64encode(auth_token).decode("utf-8")
 
@@ -291,6 +290,39 @@ class TestLiveProxy(unittest.IsolatedAsyncioTestCase):
         finally:
             await auth_server.close()
 
+    async def test_connect_tls_handshake_timeout(self):
+        """Tests that a client stalling during TLS handshake is cleanly terminated by timeout."""
+        server = ProxyServer(
+            host="127.0.0.1",
+            port=0,
+            tls_handshake_timeout=0.5,
+            cert_dir=self.temp_dir,
+            allow_private_networks=True,
+        )
+        await server.start()
+
+        try:
+            reader, writer = await asyncio.open_connection("127.0.0.1", server.port)
+            connect_req = (
+                f"CONNECT tls.peet.ws:443 HTTP/1.1\r\n"
+                f"Host: tls.peet.ws:443\r\n\r\n"
+            )
+            writer.write(connect_req.encode("utf-8"))
+            await writer.drain()
+
+            status_line = await reader.readline()
+            self.assertIn(b"200 Connection Established", status_line)
+            # Drain empty line after headers
+            await reader.readline()
+
+            # Client stalls without sending ClientHello; proxy should close on handshake timeout
+            data = await asyncio.wait_for(reader.read(100), timeout=2.0)
+            self.assertEqual(data, b"")
+            writer.close()
+            await writer.wait_closed()
+        finally:
+            await server.close()
+
 
 if __name__ == "__main__":
     unittest.main()