procproxy 0.1.0__py3-none-any.whl

proxycore/tunnel/sessions.py

@@ -0,0 +1,315 @@
+"""会话表 + 粘性 + 统计 + 超时回收。
+
+会话键的语义：
+* 路线 A：`sessions[src_port] = (pid, dst)`，sink `accept()` 用 `peer[1]` 反查；
+* 记录必须在改写前写入（先记账再发包）；
+* 记录带时间戳，超过 `pending_ttl`（默认 5 分钟）未被 accept 则回收，防止泄漏。
+
+粘性（`sticky_per_pid`）：键是 `(pid, rule_id)`，避免"规则改了但粘性还指向旧代理"。
+"""
+
+from __future__ import annotations
+
+import threading
+import time
+from collections.abc import Callable
+from dataclasses import dataclass
+from typing import Any
+
+from ..types import Action, ConnRequest, Decision, Endpoint, ProcInfo, Proto, Session
+
+DEFAULT_PENDING_TTL_S = 300.0  # 5 分钟未被 accept 则回收
+DEFAULT_HALF_CLOSE_GRACE_S = 30.0  # ：TCP 半关闭后残留
+
+STATE_CONNECTING = "connecting"
+STATE_RELAYING = "relaying"
+STATE_CLOSED = "closed"
+STATE_FAILED = "failed"
+
+
+@dataclass(slots=True)
+class PendingRedirect:
+    """一条"已改道但尚未被 sink accept"的记录（先记账后发包的那个账）。"""
+
+    backend_id: int  # 路线 A = 客户端源端口
+    proc: ProcInfo
+    dst: Endpoint
+    proto: Proto
+    upstream: str
+    rule_id: str
+    created_at: float
+    is_v6: bool = False
+
+
+class SessionTable:
+    """会话表。线程安全（拦截线程写、sink 线程读、维护线程回收）。"""
+
+    def __init__(
+        self,
+        *,
+        max_sessions: int = 20000,
+        log: Any = None,
+        pending_ttl_s: float = DEFAULT_PENDING_TTL_S,
+        clock: Callable[[], float] = time.time,
+    ) -> None:
+        self.max_sessions = max_sessions
+        self._log = log
+        self._pending_ttl_s = pending_ttl_s
+        self._clock = clock
+        self._lock = threading.RLock()
+        self._pending: dict[int, PendingRedirect] = {}
+        self._sessions: dict[int, Session] = {}
+        self._sticky: dict[tuple[int, str], str] = {}
+        self._by_backend_id: dict[int, int] = {}  # backend_id → session_id
+        self._next_id = 1
+        self._test_target: str = ""
+        self.force_upstream: str = ""
+        self._counters: dict[str, int] = {
+            "created": 0,
+            "closed": 0,
+            "failed": 0,
+            "original_unknown": 0,
+            "redirect_failed": 0,
+        }
+        self._extra_self_pids: set[int] = set()
+
+    # ------------------------------------------------------------- 记账 ------
+    def put_pending(self, conn: ConnRequest, decision: Decision) -> None:
+        """先记账再发包。"""
+        # 注意：`backend_id` 可能是合法的 0（例如被截断的源端口），
+        # 因此这里必须用 `is None` 判断缺省，而不是真值判断。
+        raw_id = conn.backend_id
+        key = int(raw_id) if raw_id is not None else self._auto_key()
+        with self._lock:
+            if len(self._pending) >= self.max_sessions:
+                self._evict_oldest_pending_locked()
+            self._pending[key] = PendingRedirect(
+                backend_id=key,
+                proc=conn.proc,
+                dst=conn.dst,
+                proto=conn.proto,
+                upstream=decision.upstream,
+                rule_id=decision.rule_id,
+                created_at=self._clock(),
+                is_v6=conn.dst.is_v6,
+            )
+
+    def _auto_key(self) -> int:
+        key = self._next_id + 10_000_000
+        self._next_id += 1
+        return key
+
+    def pop_pending(self, backend_id: int) -> PendingRedirect | None:
+        """sink `accept()` 之后调用：取出并删除该记录（原子）。"""
+        with self._lock:
+            return self._pending.pop(int(backend_id), None)
+
+    def pending_count(self) -> int:
+        with self._lock:
+            return len(self._pending)
+
+    # ------------------------------------------------------- 会话生命周期 ---
+    def open(
+        self,
+        pending: PendingRedirect,
+        *,
+        upstream: str = "",
+        state: str = STATE_CONNECTING,
+    ) -> Session:
+        with self._lock:
+            session = Session(
+                id=self._next_id,
+                proc=pending.proc,
+                proto=pending.proto,
+                original=pending.dst,
+                upstream=upstream or pending.upstream,
+                rule_id=pending.rule_id,
+                started_at=self._clock(),
+                state=state,
+            )
+            self._next_id += 1
+            self._sessions[session.id] = session
+            self._by_backend_id[int(pending.backend_id)] = session.id
+            self._counters["created"] += 1
+            return session
+
+    def session_for_backend_id(self, backend_id: int) -> Session | None:
+        with self._lock:
+            sid = self._by_backend_id.get(int(backend_id))
+            return self._sessions.get(sid) if sid else None
+
+    def mark_relaying(self, session: Session) -> None:
+        session.state = STATE_RELAYING
+
+    def close(self, session: Session, *, reason: str = "ok", error: str = "") -> None:
+        with self._lock:
+            session.state = STATE_FAILED if error else STATE_CLOSED
+            session.error = error
+            self._counters["closed" if not error else "failed"] += 1
+            for backend_id, sid in list(self._by_backend_id.items()):
+                if sid == session.id:
+                    del self._by_backend_id[backend_id]
+            self._sessions.pop(session.id, None)
+        if self._log is not None:
+            self._log.session_end(session, reason=reason)
+
+    # ------------------------------------------------------------ 查询 ------
+
+    def active(self) -> list[Session]:
+        with self._lock:
+            return [s for s in self._sessions.values() if s.state in (STATE_CONNECTING, STATE_RELAYING)]
+
+    def all(self) -> list[Session]:
+        with self._lock:
+            return list(self._sessions.values())
+
+    def count(self) -> int:
+        with self._lock:
+            return len(self._sessions)
+
+    # ------------------------------------------------------------ 粘性 ------
+    def sticky_upstream(self, pid: int, rule_id: str, *, default: str = "") -> str:
+        """粘性上游选择（规则引擎热路径调用，必须 O(1) 无锁竞争）。"""
+        if self.force_upstream:
+            return self.force_upstream
+        key = (int(pid), rule_id)
+        with self._lock:
+            existing = self._sticky.get(key)
+            if existing is not None:
+                return existing
+            if default:
+                self._sticky[key] = default
+            return default
+
+    def set_sticky(self, pid: int, rule_id: str, upstream: str) -> None:
+        with self._lock:
+            self._sticky[(int(pid), rule_id)] = upstream
+
+    def sticky_pids(self) -> list[int]:
+        with self._lock:
+            return sorted({pid for pid, _ in self._sticky})
+
+    def forget_pid(self, pid: int) -> None:
+        with self._lock:
+            for key in [k for k in self._sticky if k[0] == int(pid)]:
+                del self._sticky[key]
+            self._extra_self_pids.discard(int(pid))
+
+    def on_profile_reload(self, profile: Any) -> None:
+        """热重载后：按 `rule_id` 迁移粘性。"""
+        with self._lock:
+            valid_upstreams = set(getattr(profile, "upstreams", {}) or {})
+            valid_rules = {r.id for r in getattr(profile, "rules", [])}
+            for key in list(self._sticky):
+                _pid, rule_id = key
+                # 新 profile 是完整集合：即使它一条规则/上游都没有，
+                # 旧粘性也必须全部失效（空集合不是"不检查"）。
+                if rule_id not in valid_rules:
+                    del self._sticky[key]
+                    continue
+                if self._sticky[key] not in valid_upstreams:
+                    del self._sticky[key]
+
+    # ------------------------------------------------------ 自 PID 白名单 ---
+    def add_self_pid(self, pid: int) -> None:
+        with self._lock:
+            self._extra_self_pids.add(int(pid))
+
+    def self_pids(self) -> set[int]:
+        with self._lock:
+            return set(self._extra_self_pids)
+
+    def set_test_target(self, target: str) -> None:
+        with self._lock:
+            self._test_target = target
+
+    def test_mode(self) -> bool:
+        """是否处于"手工投喂"测试模式（`--sink-test-target` / `--upstream`）。"""
+        with self._lock:
+            return bool(self._test_target) or bool(self.force_upstream)
+
+    def test_target_endpoint(self) -> Endpoint | None:
+        """测试模式（`--sink-test-target host:port`）：sink 转发到该固定目标。 验收方式：不做任何抓包，`curl -x http://<sink> http://anything` 即可
+        走完 `accept → 选上游 → dial → relay` 全链路。
+        """
+        with self._lock:
+            return _parse_endpoint(self._test_target) if self._test_target else None
+
+    def make_test_pending(self, backend_id: int) -> PendingRedirect:
+        """测试模式下为一条 accept 到的连接合成 pending 记录（真实目标未知 → 用测试目标占位）。"""
+        target = self.test_target_endpoint() or Endpoint("0.0.0.0", 0)
+        return PendingRedirect(
+            backend_id=int(backend_id),
+            proc=ProcInfo(pid=0, name="sink-client", path=""),
+            dst=target,
+            proto=Proto.TCP,
+            upstream=self.force_upstream,
+            rule_id="sink-test-mode",
+            created_at=self._clock(),
+        )
+
+    # ------------------------------------------------------------ 回收 ------
+    def reap(self, *, now: float | None = None) -> int:
+        """回收：① 未被 accept 的过期 pending；② 超时的活动会话。"""
+        stamp = now if now is not None else self._clock()
+        removed = 0
+        with self._lock:
+            for key in [k for k, p in self._pending.items() if stamp - p.created_at > self._pending_ttl_s]:
+                del self._pending[key]
+                removed += 1
+                self._counters["original_unknown"] += 1
+            # 只回收卡在 connecting 的会话。relaying 的会话由中继线程自己收尾；
+            # 按"建立时刻"回收活跃连接会把长连接从统计里抹掉，而流量还在跑。
+            stale = [
+                s
+                for s in self._sessions.values()
+                if s.state == STATE_CONNECTING and stamp - s.started_at > self._pending_ttl_s * 20
+            ]
+            for session in stale:
+                session.state = STATE_CLOSED
+                session.error = "reaped"
+                self._sessions.pop(session.id, None)
+                for backend_id, sid in list(self._by_backend_id.items()):
+                    if sid == session.id:
+                        del self._by_backend_id[backend_id]
+                removed += 1
+        return removed
+
+    def _evict_oldest_pending_locked(self) -> None:
+        if not self._pending:
+            return
+        oldest = min(self._pending, key=lambda k: self._pending[k].created_at)
+        del self._pending[oldest]
+
+    # ------------------------------------------------------ 统计/记录 ------
+    def record_decision(self, conn: ConnRequest, decision: Decision) -> None:
+        """记录一次决策（供 `cli status`/统计使用，不做任何 IO）。"""
+        with self._lock:
+            if decision.action is Action.PROXY:
+                self.put_pending(conn, decision)
+            elif decision.action is Action.BLOCK:
+                self._counters["blocked"] = self._counters.get("blocked", 0) + 1
+
+    def note_original_unknown(self) -> None:
+        with self._lock:
+            self._counters["original_unknown"] += 1
+
+    def stats(self) -> dict[str, int]:
+        with self._lock:
+            out = dict(self._counters)
+            out["active"] = len(self._sessions)
+            out["pending"] = len(self._pending)
+            out["sticky"] = len(self._sticky)
+            out["bytes_up"] = sum(s.bytes_up for s in self._sessions.values())
+            out["bytes_down"] = sum(s.bytes_down for s in self._sessions.values())
+            return out
+
+
+def _parse_endpoint(text: str) -> Endpoint | None:
+    text = text.strip()
+    if not text:
+        return None
+    host, _, port = text.rpartition(":")
+    if not host or not port.isdigit():
+        return None
+    return Endpoint(addr=host, port=int(port), is_v6=":" in host)

proxycore/tunnel/sink.py

@@ -0,0 +1,325 @@
+"""sink：本地拦截端口：`accept → lookup_original → 选上游 → dial → relay`。
+
+端到端流程：
+
+```
+sink.accept()
+  ├─ pending = sessions.pop_pending(peer_port)          # 路线 A：源端口反查原始目标
+  │  （由 backend.lookup_original(sock, ctx) 反查）
+  ├─ pending is None → E_ORIGINAL_DST_UNKNOWN → 关闭连接（不猜，不直连）
+  ├─ 选上游（粘性已由规则引擎写入 decision）
+  └─ 落 worker 线程池：dial(upstream).connect(original) → relay(client, upstream)
+```
+
+红线：
+* 反查失败必须关闭连接并记 ERROR（禁止"猜目标"或"失败直连"）；
+* accept 循环不做任何阻塞 IO（握手丢给 worker 线程池）。
+
+双栈：同时监听 `host:port`（v4）与 `[::1]:port`（v6，`IPV6_V6ONLY=1`）。
+后端改道 v6 连接时把目的写成 `[::1]:port`，没有这个监听就哪也落不下来。
+v6 监听是必需的而不是可选的：本机 IPv6 一旦可用（默认就有），
+只监听 v4 会让所有 v6 连接落空，而且是在后端已经改道之后落空。
+"""
+
+from __future__ import annotations
+
+import contextlib
+import os
+import select
+import socket
+import threading
+from concurrent.futures import ThreadPoolExecutor
+from typing import TYPE_CHECKING, Any
+
+from ..backend.base import Backend, OriginalDstUnknown
+from ..types import Endpoint
+from ..upstream.base import UpstreamDialer, UpstreamError
+from .relay import relay_bidirectional
+from .sessions import SessionTable
+
+if TYPE_CHECKING:
+    from ..config import Config
+    from ..dns.modes import DnsPolicy
+    from ..log import EventLogger
+
+DEFAULT_BACKLOG = 512
+DEFAULT_ACCEPT_THREADS = 4  # ：N = min(4, CPU)
+
+
+class Sink:
+    """本地拦截端口监听器（每个 accept 线程一个 socket 共享队列）。"""
+
+    def __init__(
+        self,
+        *,
+        backend: Backend,
+        sessions: SessionTable,
+        config: Config,
+        log: EventLogger,
+        dialer_factory: Any = None,
+        dns: DnsPolicy | None = None,
+    ) -> None:
+        self.backend = backend
+        self.sessions = sessions
+        self.config = config
+        self.log = log
+        self._dialer_factory = dialer_factory
+        # `DnsPolicy`（`proxycore.dns.modes`）。None = 不做 DNS 决策，按 IP 直给上游
+        # （单测/嵌入场景）。Runtime 起 sink 时总会传。
+        self.dns = dns
+        self._listener: socket.socket | None = None
+        self._listener6: socket.socket | None = None
+        self._threads: list[threading.Thread] = []
+        self._stop = threading.Event()
+        self._workers = ThreadPoolExecutor(max_workers=64, thread_name_prefix="ppx-dial")
+        self.accepted = 0
+
+    # ------------------------------------------------------------ 生命周期 --
+    def start(self) -> None:
+        sink_cfg = self.config.service.sink
+        listener = self._bind4(str(sink_cfg.host), int(sink_cfg.port))
+        self._listener = listener
+        self._listener6 = self._bind6(int(sink_cfg.port))
+        cpu = os.cpu_count() or 4
+        count = max(1, min(DEFAULT_ACCEPT_THREADS, cpu))
+        for index in range(count):
+            thread = threading.Thread(target=self._accept_loop, name=f"ppx-accept-{index}", daemon=True)
+            thread.start()
+            self._threads.append(thread)
+        self.log.info(
+            "sink_listening",
+            host=sink_cfg.host,
+            port=sink_cfg.port,
+            accept_threads=count,
+            ipv6=self._listener6 is not None,
+        )
+
+    def _bind4(self, host: str, port: int) -> socket.socket:
+        listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        try:
+            # 启动时做占用检测
+            listener.bind((host, port))
+        except OSError as exc:
+            listener.close()
+            raise OriginalDstUnknown(f"sink 端口不可用 {host}:{port}: {exc}") from exc
+        listener.listen(DEFAULT_BACKLOG)
+        listener.settimeout(0.5)
+        return listener
+
+    def _bind6(self, port: int) -> socket.socket | None:
+        """v6 侧的 sink 监听（`[::1]:port`）。失败不抛：但要吵。
+
+        bind 到具体地址 `::1`（不是 `::`），并且显式置 `IPV6_V6ONLY`：
+        否则这个套接字会顺带接管 v4 的 `0.0.0.0:port`，和 v4 监听抢端口。
+        """
+        listener = socket.socket(socket.AF_INET6, socket.SOCK_STREAM)
+        listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        with contextlib.suppress(OSError, AttributeError):
+            listener.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 1)
+        try:
+            listener.bind(("::1", port))
+        except OSError as exc:
+            listener.close()
+            # 不静默降级：v6 一旦解析到就会走这条路径，落不下来就是"改道后连接必挂"
+            self.log.error(
+                "sink_ipv6_unavailable",
+                port=port,
+                code="E_SINK_IPV6_UNAVAILABLE",
+                error=str(exc),
+                hint="v6 连接改道后无处落地，会在 sink 端口上连接失败（不是直连，但应用会连不上）",
+            )
+            return None
+        listener.listen(DEFAULT_BACKLOG)
+        listener.settimeout(0.5)
+        return listener
+
+    def stop(self) -> None:
+        self._stop.set()
+        for attr in ("_listener", "_listener6"):
+            listener = getattr(self, attr)
+            setattr(self, attr, None)
+            if listener is not None:
+                with contextlib.suppress(OSError):
+                    listener.close()
+        for thread in self._threads:
+            thread.join(timeout=1.0)
+        self._threads.clear()
+        self._workers.shutdown(wait=False, cancel_futures=True)
+
+    def _live_listeners(self) -> list[socket.socket]:
+        return [s for s in (self._listener, self._listener6) if s is not None]
+
+    # -------------------------------------------------------------- accept --
+    def _accept_loop(self) -> None:
+        while not self._stop.is_set():
+            listeners = self._live_listeners()
+            if not listeners:
+                return
+            try:
+                # 两个监听一起等：串行 accept 会让 v6 连接平白多等一个超时。
+                # select 在 Windows 上同样可用（这里最多 2 个套接字）。
+                ready, _, _ = select.select(listeners, [], [], 0.5)
+            except (OSError, ValueError):
+                return  # 套接字被 stop() 关掉了
+            for listener in ready:
+                self._accept_one(listener)
+
+    def _accept_one(self, listener: socket.socket) -> None:
+        try:
+            client, peer = listener.accept()
+        except (TimeoutError, BlockingIOError):
+            return
+        except OSError:
+            return
+        self.accepted += 1
+        with contextlib.suppress(OSError):
+            client.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+        self._workers.submit(self._handle_client, client, peer)
+
+    def _handle_client(self, client: socket.socket, peer: tuple[Any, ...]) -> None:
+        peer_port = int(peer[1])
+        backend_ctx = peer_port
+        original: Endpoint | None = None
+
+        if self.sessions.test_mode():
+            # 测试模式（--sink-test-target / --upstream）：不做抓包，连接是直接打到 sink 端口的；
+            # 目标由测试目标决定、上游被强制指定，会话照常记账。
+            original = self.sessions.test_target_endpoint()
+        else:
+            try:
+                original = self.backend.lookup_original(client, backend_ctx)
+            except OriginalDstUnknown as exc:
+                self.log.error(
+                    "original_dst_unknown",
+                    client_port=peer_port,
+                    code="E_ORIGINAL_DST_UNKNOWN",
+                    error=str(exc),
+                )
+                self.sessions.note_original_unknown()
+                _close(client)
+                return
+            if original is None:
+                # 无重定向记录 → 该连接不是我们改道的 → 关闭（不猜、不直连）
+                self.log.warn("original_dst_missing", client_port=peer_port, code="E_ORIGINAL_DST_UNKNOWN")
+                self.sessions.note_original_unknown()
+                _close(client)
+                return
+
+        pending = self.sessions.pop_pending(backend_ctx)
+        if pending is None:
+            # 测试模式 / 后端自建连接：合成一条决策记录（真实目标未知，用测试目标占位）
+            pending = self.sessions.make_test_pending(backend_ctx)
+        upstream_alias = pending.upstream or self.sessions.force_upstream
+        session = self.sessions.open(pending, upstream=upstream_alias)
+        dial_target = self.sessions.test_target_endpoint() or original
+
+        dialer = self._make_dialer(upstream_alias)
+        if dialer is None:
+            self.log.error(
+                "upstream_missing",
+                upstream=upstream_alias or "-",
+                code="E_UPSTREAM_DOWN",
+                hint="规则命中了 proxy 但上游别名未配置/不存在，连接会被关闭（不会直连）",
+            )
+            self.sessions.close(session, reason="upstream-missing", error="E_UPSTREAM_DOWN")
+            _close(client)
+            return
+
+        if dial_target is None:
+            # 既没有恢复出原始目标、也没有测试目标 → 记 E_ORIGINAL_DST_UNKNOWN 并关闭
+            self.log.error(
+                "original_dst_unknown",
+                client_port=peer_port,
+                code="E_ORIGINAL_DST_UNKNOWN",
+                hint="既没有重定向记录也没有测试目标",
+            )
+            self.sessions.note_original_unknown()
+            self.sessions.close(session, reason="original-dst-unknown", error="E_ORIGINAL_DST_UNKNOWN")
+            _close(client)
+            return
+
+        try:
+            upstream_sock = dialer.dial_tcp_sync(*self._dial_args(dial_target))
+        except UpstreamError as exc:
+            self.log.error(
+                "upstream_dial_failed",
+                dst=str(dial_target),
+                upstream=upstream_alias,
+                code=exc.code,
+                error=str(exc),
+            )
+            self.sessions.close(session, reason=exc.code, error=str(exc))
+            _close(client)
+            return
+
+        self.sessions.mark_relaying(session)
+        try:
+            up, down, reason = relay_bidirectional(
+                client, upstream_sock, idle_timeout=self.config.service.idle_timeout_s,
+                half_close_grace=self.config.service.half_close_timeout_s,
+            )
+        finally:
+            _close(upstream_sock)
+            _close(client)
+        session.bytes_up += up
+        session.bytes_down += down
+        self.sessions.close(session, reason=reason)
+
+    # -------------------------------------------------------------- DNS -----
+    def _dial_args(self, target: Endpoint) -> tuple[Endpoint, str | None]:
+        """按 DNS 策略决定"交给上游的是什么"。
+
+        * `remote`（默认）→ 有可信域名就把域名交给上游远端解析
+          （SOCKS5 `ATYP=3` / SOCKS4a / CONNECT 原样传域名），本地不查 DNS；
+        * `local` → 先在本地解析成 IP，再把 IP 交给上游（`hostname=None`）；
+        * `bypass` → 命中 `dns_bypass` 的域名走 local，其余走 remote。
+
+        路线 A 下大多是"只有 IP"：应用自己 `getaddrinfo` 完才 `connect`，
+        我们在 IP 层只看到 IP 。这是应用行为决定的，不是缺陷。
+        `plan_for_connection` 在这种情况下查 DNS 缓存，但只认可信项：
+        嗅探来的映射是近似的（TTL 内有效、CDN 会误判），拿它去 dial 等于猜一个
+        域名让上游连过去，猜错就是连到别人的站点。
+        """
+        if self.dns is None:
+            return target, None
+        plan = self.dns.plan_for_connection(target.addr)
+        dial = (
+            target
+            if plan.addr == target.addr
+            else Endpoint(addr=plan.addr, port=target.port, is_v6=":" in plan.addr)
+        )
+        if plan.hostname or plan.used_local_dns:
+            # 只在"真的发生了名字决策"时记一笔；纯 IP 透传是常态，不必刷屏
+            self.log.debug(
+                "dns_plan",
+                target=str(target),
+                mode=plan.mode,
+                dial=str(dial),
+                hostname=plan.hostname or "-",
+                reason=plan.reason,
+            )
+        return dial, plan.hostname
+
+    # ------------------------------------------------------------- 上游 -----
+    def _make_dialer(self, alias: str) -> UpstreamDialer | None:
+        if not alias:
+            return None
+        upstream = self.config.profile.upstreams.get(alias)
+        if upstream is None:
+            return None
+        if self._dialer_factory is not None:
+            return self._dialer_factory(upstream)
+        from ..upstream import make_dialer
+
+        # 注入别名解析器：跳链（chain）需要按别名取到其它 upstream
+        upstreams = self.config.profile.upstreams
+        return make_dialer(
+            upstream,
+            timeout=self.config.service.upstream_timeout_s,
+            resolver=upstreams.get,
+        )
+
+def _close(sock: socket.socket) -> None:
+    with contextlib.suppress(OSError):
+        sock.close()