proxynt 2.1.0rc1__tar.gz → 2.1.2__tar.gz

{proxynt-2.1.0rc1/proxynt.egg-info → proxynt-2.1.2}/PKG-INFO

@@ -1,10 +1,7 @@
 Metadata-Version: 2.1
 Name: proxynt
-Version: 2.1.0rc1
-Summary: UNKNOWN
+Version: 2.1.2
 Home-page: https://github.com/sazima/proxynt
-License: UNKNOWN
-Platform: UNKNOWN
 Description-Content-Type: text/markdown
 Provides-Extra: snappy
 License-File: LICENSE
@@ -175,5 +172,3 @@ ssh -oPort=12222 test@192.168.9.224
 
 
 
-
-

proxynt-2.1.2/common/captcha.py

@@ -0,0 +1,123 @@
+import random
+import secrets
+import time
+from typing import Dict, Tuple
+
+"""
+登录验证码 (纯标准库生成 SVG) 与按 IP 的登录失败锁定
+只在 tornado 线程中使用, 不加锁
+"""
+
+CAPTCHA_CHARS = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'  # 去掉 0/O、1/I/L 等易混淆字符
+CAPTCHA_LENGTH = 4
+CAPTCHA_WIDTH = 120
+CAPTCHA_HEIGHT = 44
+CAPTCHA_EXPIRE_SECONDS = 120
+CAPTCHA_MAX_STORE = 1000
+
+LOGIN_MAX_FAILURES = 5  # 同一 IP 连续失败次数上限
+LOGIN_LOCK_SECONDS = 300
+LOGIN_MAX_TRACKED_IPS = 10000
+
+
+def _rand_color(low: int, high: int) -> str:
+    return '#%02x%02x%02x' % (random.randint(low, high), random.randint(low, high), random.randint(low, high))
+
+
+def _render_svg(code: str) -> str:
+    parts = [f'<svg xmlns="http://www.w3.org/2000/svg" width="{CAPTCHA_WIDTH}" height="{CAPTCHA_HEIGHT}" '
+             f'viewBox="0 0 {CAPTCHA_WIDTH} {CAPTCHA_HEIGHT}">',
+             f'<rect width="100%" height="100%" fill="{_rand_color(225, 250)}"/>']
+    # 噪点
+    for _ in range(30):
+        parts.append(f'<circle cx="{random.uniform(0, CAPTCHA_WIDTH):.1f}" cy="{random.uniform(0, CAPTCHA_HEIGHT):.1f}" '
+                     f'r="{random.uniform(0.5, 1.5):.1f}" fill="{_rand_color(100, 200)}"/>')
+    # 字符: 随机字号、旋转、偏移
+    step = CAPTCHA_WIDTH / (CAPTCHA_LENGTH + 1)
+    for i, ch in enumerate(code):
+        x = step * (i + 0.6) + random.uniform(-4, 4)
+        y = CAPTCHA_HEIGHT * 0.68 + random.uniform(-3, 3)
+        parts.append(f'<text x="{x:.1f}" y="{y:.1f}" font-size="{random.randint(22, 26)}" font-family="Arial,sans-serif" '
+                     f'font-weight="bold" fill="{_rand_color(20, 120)}" '
+                     f'transform="rotate({random.randint(-25, 25)} {x:.1f} {y:.1f})">{ch}</text>')
+    # 干扰曲线
+    for _ in range(3):
+        parts.append(f'<path d="M{random.uniform(0, 20):.1f} {random.uniform(0, CAPTCHA_HEIGHT):.1f} '
+                     f'Q{random.uniform(30, 90):.1f} {random.uniform(-10, CAPTCHA_HEIGHT + 10):.1f} '
+                     f'{random.uniform(100, CAPTCHA_WIDTH):.1f} {random.uniform(0, CAPTCHA_HEIGHT):.1f}" '
+                     f'stroke="{_rand_color(60, 160)}" stroke-width="{random.uniform(1, 2):.1f}" fill="none"/>')
+    parts.append('</svg>')
+    return ''.join(parts)
+
+
+class CaptchaStore:
+    """captcha_id -> (答案, 生成时间), 校验一次即作废"""
+
+    def __init__(self):
+        self._store: Dict[str, Tuple[str, float]] = dict()
+
+    def create(self) -> Tuple[str, str]:
+        """返回 (captcha_id, svg)"""
+        if len(self._store) >= CAPTCHA_MAX_STORE:
+            self._clean()
+        if len(self._store) >= CAPTCHA_MAX_STORE:
+            self._store.pop(next(iter(self._store)))  # 仍然满则淘汰最早的
+        code = ''.join(secrets.choice(CAPTCHA_CHARS) for _ in range(CAPTCHA_LENGTH))
+        captcha_id = secrets.token_urlsafe(16)
+        self._store[captcha_id] = (code, time.time())
+        return captcha_id, _render_svg(code)
+
+    def verify(self, captcha_id: str, answer: str) -> bool:
+        if not captcha_id or not answer:
+            return False
+        item = self._store.pop(captcha_id, None)
+        if item is None:
+            return False
+        code, create_time = item
+        if time.time() - create_time > CAPTCHA_EXPIRE_SECONDS:
+            return False
+        return secrets.compare_digest(code, answer.strip().upper())
+
+    def _clean(self):
+        now = time.time()
+        for k in [k for k, (_, t) in self._store.items() if now - t > CAPTCHA_EXPIRE_SECONDS]:
+            self._store.pop(k, None)
+
+
+class LoginLimiter:
+    """按 IP 记录连续失败次数, 超过上限锁定一段时间"""
+
+    def __init__(self):
+        self._failures: Dict[str, Tuple[int, float]] = dict()  # ip -> (连续失败次数, 最后失败时间)
+
+    def locked_seconds(self, ip: str) -> int:
+        """剩余锁定秒数, 0 表示未锁定"""
+        item = self._failures.get(ip)
+        if not item:
+            return 0
+        count, last_time = item
+        remain = LOGIN_LOCK_SECONDS - (time.time() - last_time)
+        if remain <= 0:
+            if count >= LOGIN_MAX_FAILURES:
+                self._failures.pop(ip, None)  # 锁定结束, 重新计数
+            return 0
+        return int(remain) + 1 if count >= LOGIN_MAX_FAILURES else 0
+
+    def record_failure(self, ip: str) -> int:
+        """记录一次失败, 返回剩余可尝试次数"""
+        if len(self._failures) >= LOGIN_MAX_TRACKED_IPS:
+            self._clean()
+        count, last_time = self._failures.get(ip, (0, 0))
+        if time.time() - last_time > LOGIN_LOCK_SECONDS:
+            count = 0
+        count += 1
+        self._failures[ip] = (count, time.time())
+        return max(LOGIN_MAX_FAILURES - count, 0)
+
+    def record_success(self, ip: str):
+        self._failures.pop(ip, None)
+
+    def _clean(self):
+        now = time.time()
+        for k in [k for k, (_, t) in self._failures.items() if now - t > LOGIN_LOCK_SECONDS]:
+            self._failures.pop(k, None)

{proxynt-2.1.0rc1 → proxynt-2.1.2}/common/pool.py

@@ -17,6 +17,8 @@ from constant.system_constant import SystemConstant
 
 PAUSE_REASON_SPEED_LIMIT = 'speed_limit'
 PAUSE_REASON_FLOW_CONTROL = 'flow_control'
+PAUSE_REASON_EARLY_DATA = 'early_data'
+PAUSE_REASON_WS_BACKPRESSURE = 'ws_backpressure'
 
 
 class SelectPool:
@@ -32,6 +34,7 @@ class SelectPool:
         self.selector.register(self._wakeup_r, EVENT_READ, None)
         # 每个 socket 的暂停原因 (如 speed_limit / flow_control), 全部解除才恢复读取
         self._pause_reasons: Dict[socket.socket, Set[str]] = dict()
+        self._paused_data: Dict[socket.socket, ResisterAppendData] = dict()  # 暂停期间 socket 不在 selector 中, 保存其 data
         self._pause_lock = threading.Lock()
 
     def _wakeup(self):
@@ -68,6 +71,7 @@ class SelectPool:
             self.fileno_to_client.pop(fileno)
         with self._pause_lock:
             self._pause_reasons.pop(s, None)
+            self._paused_data.pop(s, None)
         try:
             self.selector.unregister(s)
         except (KeyError, ValueError):
@@ -76,20 +80,26 @@ class SelectPool:
             LoggerFactory.get_logger().error(traceback.format_exc())
 
     def pause_reading(self, s: socket.socket, reason: str = PAUSE_REASON_SPEED_LIMIT):
-        """暂停监听可读事件 (modify 掩码为 0)"""
+        """
+        暂停监听可读事件
+        不能用 modify(s, 0): Python 3.6 的 modify 会先 unregister 再以 0 掩码 register 抛 ValueError, socket 被永久移除
+        这里直接 unregister 并保存 data, 恢复时重新 register
+        """
         with self._pause_lock:
+            reasons = self._pause_reasons.get(s)
+            if reasons:
+                reasons.add(reason)
+                return
             try:
                 key = self.selector.get_key(s)
             except (KeyError, ValueError):
                 return
-            reasons = self._pause_reasons.setdefault(s, set())
-            first_pause = not reasons
-            reasons.add(reason)
-            if first_pause:
-                try:
-                    self.selector.modify(s, 0, key.data)
-                except (KeyError, ValueError):
-                    pass
+            self._pause_reasons[s] = {reason}
+            self._paused_data[s] = key.data
+            try:
+                self.selector.unregister(s)
+            except (KeyError, ValueError):
+                pass
 
     def resume_reading(self, s: socket.socket, reason: str = PAUSE_REASON_SPEED_LIMIT):
         """解除一个暂停原因, 没有其他原因时恢复监听可读事件"""
@@ -101,10 +111,10 @@ class SelectPool:
             if reasons:
                 return
             self._pause_reasons.pop(s, None)
+            data = self._paused_data.pop(s, None)
             try:
-                key = self.selector.get_key(s)
-                self.selector.modify(s, EVENT_READ, key.data)
-            except (KeyError, ValueError):
+                self.selector.register(s, EVENT_READ, data)
+            except (KeyError, ValueError, OSError):
                 return
         self._wakeup()
 

{proxynt-2.1.0rc1 → proxynt-2.1.2}/constant/system_constant.py

@@ -15,7 +15,7 @@ class SystemConstant:
 
     COOKIE_EXPIRE_SECONDS = 3600 * 24
 
-    VERSION = '2.1.0.rc1'
+    VERSION = '2.1.2'
 
     GITHUB = 'https://github.com/sazima/proxynt'
 

{proxynt-2.1.0rc1 → proxynt-2.1.2/proxynt.egg-info}/PKG-INFO

@@ -1,10 +1,7 @@
 Metadata-Version: 2.1
 Name: proxynt
-Version: 2.1.0rc1
-Summary: UNKNOWN
+Version: 2.1.2
 Home-page: https://github.com/sazima/proxynt
-License: UNKNOWN
-Platform: UNKNOWN
 Description-Content-Type: text/markdown
 Provides-Extra: snappy
 License-File: LICENSE
@@ -175,5 +172,3 @@ ssh -oPort=12222 test@192.168.9.224
 
 
 
-
-

{proxynt-2.1.0rc1 → proxynt-2.1.2}/proxynt.egg-info/SOURCES.txt

@@ -16,6 +16,7 @@ setup.py
 ./client/tunnel_protocol.py
 ./client/udp_forward_client.py
 ./common/__init__.py
+./common/captcha.py
 ./common/cert_utils.py
 ./common/encrypt_utils.py
 ./common/kcp.py

proxynt-2.1.2/proxynt.egg-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+nt_client = proxynt.run_client:main
+nt_server = proxynt.run_server:main

{proxynt-2.1.0rc1 → proxynt-2.1.2}/run_client.py

@@ -402,6 +402,8 @@ async def connect_loop(url, client, processor):
                 on_message_callback=on_message,
                 connect_timeout=10,
             )
+            # 关闭 Nagle: 否则小包要等上一个包的 ACK, 每个方向多出约一个 RTT 的延迟
+            ws_conn.protocol.set_nodelay(True)
             client.ws_sender.set_connection(ws_conn, io)
             client.on_open()
             await close_future

{proxynt-2.1.0rc1 → proxynt-2.1.2}/server/admin_http_handler.py

@@ -7,6 +7,7 @@ from typing import List, Set, Tuple
 
 from tornado.web import RequestHandler
 
+from common.captcha import CaptchaStore, LoginLimiter
 from common.logger_factory import LoggerFactory
 from constant.system_constant import SystemConstant
 from context.context_utils import ContextUtils
@@ -17,25 +18,69 @@ from server.websocket_handler import MyWebSocketaHandler
 
 # todo: 身份认证
 COOKIE_KEY = 'c'
+CAPTCHA_COOKIE_KEY = 'cid'
 MIN_PORT = 1000
 NOT_LOGIN = 401
 
+captcha_store = CaptchaStore()
+login_limiter = LoginLimiter()
+
+
+def is_login(handler: RequestHandler) -> bool:
+    cookie_dict = ContextUtils.get_cookie_to_time()
+    result = handler.get_cookie(COOKIE_KEY)
+    return result in cookie_dict and time.time() - cookie_dict[result] < SystemConstant.COOKIE_EXPIRE_SECONDS
+
+
+def get_client_ip(handler: RequestHandler) -> str:
+    """只有经本机反向代理 (nginx) 转发时才信任 X-Real-IP, 防止直连时伪造请求头绕过失败锁定"""
+    remote_ip = handler.request.remote_ip
+    if remote_ip in ('127.0.0.1', '::1'):
+        return handler.request.headers.get('X-Real-IP') or remote_ip
+    return remote_ip
+
 
 class AdminHtmlHandler(RequestHandler):
     async def get(self):
-        result = self.get_cookie(COOKIE_KEY)
-        cookie_dict = ContextUtils.get_cookie_to_time()
-        if result in cookie_dict and time.time() - cookie_dict[result] < SystemConstant.COOKIE_EXPIRE_SECONDS:
+        if self.get_argument('captcha', ''):
+            captcha_id, svg = captcha_store.create()
+            self.set_cookie(CAPTCHA_COOKIE_KEY, captcha_id, httponly=True)
+            self.set_header('Content-Type', 'image/svg+xml')
+            self.set_header('Cache-Control', 'no-store')
+            self.write(svg)
+            return
+        if is_login(self):
             self.render('ele_index.html')
         else:
             self.render('login.html')
 
     async def post(self):
         try:
+            ip = get_client_ip(self)
+            locked_seconds = login_limiter.locked_seconds(ip)
+            if locked_seconds:
+                self.write({
+                    'code': 400,
+                    'data': '',
+                    'msg': f'失败次数过多, 请 {locked_seconds} 秒后再试'
+                })
+                return
             body_data = json.loads(self.request.body)
-            password = body_data['password']
+            password = body_data.get('password', '')
+            captcha = body_data.get('captcha', '')
+            # 不管对错, 验证码只能用一次
+            captcha_ok = captcha_store.verify(self.get_cookie(CAPTCHA_COOKIE_KEY), captcha)
+            self.clear_cookie(CAPTCHA_COOKIE_KEY)
+            if not captcha_ok:
+                self.write({
+                    'code': 400,
+                    'data': '',
+                    'msg': '验证码错误或已过期'
+                })
+                return
             admin_config = ContextUtils.get_admin_config()
             if admin_config and admin_config['admin_password'] == password:
+                login_limiter.record_success(ip)
                 cookie_value = base64.b64encode(os.urandom(64)).decode()
                 cookie_dict = ContextUtils.get_cookie_to_time()
                 cookie_dict[cookie_value] = time.time()
@@ -46,10 +91,12 @@ class AdminHtmlHandler(RequestHandler):
                     'msg': ''
                 })
             else:
+                remain = login_limiter.record_failure(ip)
+                LoggerFactory.get_logger().warning(f'admin login failed from {ip}, remain attempts: {remain}')
                 self.write({
                     'code': 400,
                     'data': '',
-                    'msg': '密码错误'
+                    'msg': f'密码错误, 还可尝试 {remain} 次' if remain else '密码错误次数过多, 请稍后再试'
                 })
         except Exception:
             LoggerFactory.get_logger().error(traceback.format_exc())
@@ -57,6 +104,14 @@ class AdminHtmlHandler(RequestHandler):
 
 class ShowVariableHandler(RequestHandler):
     def get(self):
+        if not is_login(self):
+            self.set_status(NOT_LOGIN)
+            self.write({
+                'code': NOT_LOGIN,
+                'data': '',
+                'msg': '未登录'
+            })
+            return
         forward_client = TcpForwardClient.get_instance()
         dict_ = forward_client.__dict__
         self.write({

{proxynt-2.1.0rc1 → proxynt-2.1.2}/server/tcp_forward_client.py

@@ -16,7 +16,7 @@ import tornado
 
 from common.logger_factory import LoggerFactory
 from common.nat_serialization import NatSerialization
-from common.pool import SelectPool, PAUSE_REASON_FLOW_CONTROL
+from common.pool import SelectPool, PAUSE_REASON_FLOW_CONTROL, PAUSE_REASON_EARLY_DATA, PAUSE_REASON_WS_BACKPRESSURE
 from common.register_append_data import ResisterAppendData
 from common.speed_limit import SpeedLimiter
 from constant.message_type_constnat import MessageTypeConstant
@@ -59,7 +59,8 @@ class PublicSocketConnection:
         self.connection_confirmed = False  # Whether connection is confirmed
         self.early_data_buffer = []  # Buffer early data (data received before connection confirmation)
         self.early_data_lock = Lock()  # socket 线程缓冲与 tornado 线程 flush 互斥, 防止数据乱序/丢失
-        self.max_early_data_packets = 65536 * 4  # Maximum buffered packets
+        self.early_data_bytes = 0  # early_data_buffer 中的字节数
+        self.early_data_flushed = False  # early data 是否已全部写入 websocket, 之前 socket 线程读到的数据都进缓冲, 保证顺序
         self.bytes_from_public: int = 0
         self.bytes_to_public: int = 0
         self.create_time: float = time.time()
@@ -72,6 +73,7 @@ class PublicSocketConnection:
         return f'{self.uid}_{self.socket}_{self.socket_server.name}'
 
 
+EARLY_DATA_MAX_BYTES = 1 * 1024 * 1024  # 连接确认前最多缓冲的字节数, 超过后暂停读取该公网连接, 确认并 flush 完成后恢复
 SEND_QUEUE_HIGH_WATER = 4 * 1024 * 1024  # 单个 uid 积压超过该值时对来源 websocket 做背压
 SEND_QUEUE_LOW_WATER = 1 * 1024 * 1024
 # 客户端支持流控时: 超过 FLOW_HIGH_WATER 通知客户端暂停该 uid, 低于 FLOW_LOW_WATER 恢复
@@ -218,12 +220,24 @@ class TcpForwardClient:
             LoggerFactory.get_logger().info(
                 f'public side closed uid: {socket_connection.uid.hex()}, error: {recv_error}, {socket_connection.stats()}')
 
-        # Optimistic send mode: buffer data if connection not confirmed
-        if socket_connection.optimistic_mode and not socket_connection.connection_confirmed:
+        # Optimistic send mode: early data 未全部 flush 前, 数据都进缓冲
+        if socket_connection.optimistic_mode and not socket_connection.early_data_flushed:
             with socket_connection.early_data_lock:
                 # 加锁后再判断一次, 避免与 CONNECT_CONFIRMED 的 flush 竞争
-                if not socket_connection.connection_confirmed:
-                    if not recv:
+                if not socket_connection.early_data_flushed:
+                    if recv:
+                        socket_connection.early_data_buffer.append(recv)
+                        socket_connection.early_data_bytes += len(recv)
+                        if LoggerFactory.get_logger().isEnabledFor(logging.DEBUG):
+                            LoggerFactory.get_logger().debug(f'Buffering early data uid: {socket_connection.uid}, len: {len(recv)}, buffer_bytes: {socket_connection.early_data_bytes}')
+                        if socket_connection.early_data_bytes >= EARLY_DATA_MAX_BYTES:
+                            # 不再读取, 数据留在内核缓冲区, flush 完成后恢复
+                            self.socket_event_loop.pause_reading(each, PAUSE_REASON_EARLY_DATA)
+                        return
+                    # 公网侧已关闭, 剩余 early data 没有接收方了, 直接丢弃
+                    socket_connection.early_data_buffer = []
+                    socket_connection.early_data_bytes = 0
+                    if not socket_connection.connection_confirmed:
                         # Client closed connection before confirmation, close immediately
                         LoggerFactory.get_logger().info(f'recv empty before confirmed, close uid: {socket_connection.uid}')
                         try:
@@ -231,18 +245,7 @@ class TcpForwardClient:
                         except (OSError, ValueError, KeyError):
                             LoggerFactory.get_logger().error(f'Close error: {traceback.format_exc()}')
                         return
-                    if len(socket_connection.early_data_buffer) < socket_connection.max_early_data_packets:
-                        socket_connection.early_data_buffer.append(recv)
-                        if LoggerFactory.get_logger().isEnabledFor(logging.DEBUG):
-                            LoggerFactory.get_logger().debug(f'Buffering early data uid: {socket_connection.uid}, len: {len(recv)}, buffer_size: {len(socket_connection.early_data_buffer)}')
-                    else:
-                        # Too much buffered data, connection may have failed, close connection
-                        LoggerFactory.get_logger().warning(f'Too much early data buffered, closing connection uid: {socket_connection.uid}')
-                        try:
-                            self.close_connection(socket_connection)
-                        except (OSError, ValueError, KeyError):
-                            LoggerFactory.get_logger().error(f'Close error: {traceback.format_exc()}')
-                    return
+                    # 已确认但 flush 未完成: 走下面的正常关闭流程通知客户端
 
         # --- 发送端限速：暂停读取，延迟恢复 ---
         if data.speed_limiter and recv:
@@ -271,11 +274,22 @@ class TcpForwardClient:
             handler = socket_connection.socket_server.websocket_handler
             is_compress = handler.compress_support
             protocol_version = handler.protocol_version
-            self.tornado_loop.add_callback(
-                partial(handler.write_message, NatSerialization.dumps(send_message, ContextUtils.get_password(), is_compress, protocol_version)), True)
+            message = bytes(NatSerialization.dumps(send_message, ContextUtils.get_password(), is_compress, protocol_version))
+            self.tornado_loop.add_callback(self._write_public_data, socket_connection, handler, message)
         except Exception:
             LoggerFactory.get_logger().error(traceback.format_exc())
 
+    def _write_public_data(self, connection: PublicSocketConnection, handler: 'MyWebSocketaHandler', message: bytes):
+        """
+        tornado 线程中把公网数据写入 websocket
+        写缓冲积压超过高水位时暂停读取该公网连接, 本次写入 flush 后恢复, 避免大流量占满到客户端的 websocket, 阻塞同一客户端的其他连接
+        """
+        future = handler.write_bytes(message)
+        if future is None or self.uid_to_connection.get(connection.uid) is not connection:
+            return
+        self.socket_event_loop.pause_reading(connection.socket, PAUSE_REASON_WS_BACKPRESSURE)
+        future.add_done_callback(lambda _: self.socket_event_loop.resume_reading(connection.socket, PAUSE_REASON_WS_BACKPRESSURE))
+
     def start_accept(self, server_socket: socket, register_append_data: ResisterAppendData):
         try:
             client, address = server_socket.accept()
@@ -375,6 +389,39 @@ class TcpForwardClient:
             if self.uid_to_send_queue.get(uid) is send_queue:
                 self.uid_to_send_queue.pop(uid, None)
 
+    async def flush_early_data(self, connection: PublicSocketConnection):
+        """
+        连接确认后分批把 early data 写入 websocket, 每批做背压
+        flush 期间公网连接暂停读取, socket 线程已读到的数据继续进缓冲, 全部写完后才切换为直接转发, 保证顺序
+        """
+        handler = connection.socket_server.websocket_handler
+        self.socket_event_loop.pause_reading(connection.socket, PAUSE_REASON_EARLY_DATA)
+        try:
+            while True:
+                with connection.early_data_lock:
+                    batch = connection.early_data_buffer
+                    connection.early_data_buffer = []
+                    connection.early_data_bytes = 0
+                    if not batch:
+                        connection.early_data_flushed = True
+                        return
+                for buffered_data in batch:
+                    if self.uid_to_connection.get(connection.uid) is not connection:
+                        LoggerFactory.get_logger().info(f'connection {connection.uid.hex()} closed, drop remaining early data')
+                        return
+                    send_message: MessageEntity = {
+                        'type_': MessageTypeConstant.WEBSOCKET_OVER_TCP,
+                        'data': {
+                            'name': connection.socket_server.name,
+                            'data': buffered_data,
+                            'uid': connection.uid,
+                            'ip_port': connection.socket_server.ip_port
+                        }
+                    }
+                    await handler.wait_backpressure(handler.forward_message(send_message), handler.client_name)
+        finally:
+            self.socket_event_loop.resume_reading(connection.socket, PAUSE_REASON_EARLY_DATA)
+
     def set_public_reading_paused(self, connection: PublicSocketConnection, pause: bool):
         """客户端通知暂停/恢复读取公网连接"""
         if pause:

{proxynt-2.1.0rc1 → proxynt-2.1.2}/server/template/login.html

@@ -9,6 +9,13 @@
                 <el-form-item label="密码 " :label-width="formLabelWidth">
                     <el-input v-model="form.password" autocomplete="off" @keyup.enter.native="handleLogin" type="password"></el-input>
                 </el-form-item>
+                <el-form-item label="验证码 " :label-width="formLabelWidth">
+                    <div style="display: flex; align-items: center;">
+                        <el-input v-model="form.captcha" autocomplete="off" @keyup.enter.native="handleLogin" maxlength="4" style="width: 140px;"></el-input>
+                        <img :src="captchaUrl" @click="refreshCaptcha" title="看不清? 点击刷新" alt="验证码"
+                             style="height: 40px; margin-left: 10px; cursor: pointer; border-radius: 4px;">
+                    </div>
+                </el-form-item>
             </el-form>
         </el-col>
         <el-col :span="12">
@@ -25,23 +32,33 @@
             return {
                 formLabelWidth: '120px',
                 form: {
-                    password: ''
-                }
+                    password: '',
+                    captcha: ''
+                },
+                captchaUrl: ''
             }
         },
         mounted() {
+            this.refreshCaptcha()
         },
         methods: {
+            refreshCaptcha() {
+                this.form.captcha = ''
+                this.captchaUrl = window.location.pathname + '?captcha=1&t=' + Date.now()
+            },
             handleLogin() {
                 const url = window.location.href
 
                 axios.post(url, this.form).then(res=> {
                     if (res.data.code !== 200) {
+                        // 验证码只能用一次, 失败后换新的
+                        this.refreshCaptcha()
                         return alert(res.data.msg)
                     }
                     location.reload();
                 }).catch(err => {
                     console.log(err)
+                    this.refreshCaptcha()
                     alert('服务器出现错误')
                 })
 

{proxynt-2.1.0rc1 → proxynt-2.1.2}/server/websocket_handler.py

@@ -30,7 +30,7 @@ from exceptions.replay_error import ReplayError
 from exceptions.signature_error import SignatureError
 from server.tcp_forward_client import TcpForwardClient
 
-WRITE_BUFFER_HIGH_WATER = 4 * 1024 * 1024  # 目标 websocket 写缓冲超过该值时暂停读取来源 websocket
+WRITE_BUFFER_HIGH_WATER = 1 * 1024 * 1024  # 目标 websocket 写缓冲超过该值时暂停读取来源 websocket
 WRITE_DRAIN_TIMEOUT = 30
 
 
@@ -63,6 +63,8 @@ class MyWebSocketaHandler(WebSocketHandler):
         cls.c2c_lock = asyncio.Lock()
 
     def open(self, *args: str, **kwargs: str):
+        # 关闭 Nagle: 否则小包要等上一个包的 ACK, 每个方向多出约一个 RTT 的延迟
+        self.set_nodelay(True)
         self.lock = Lock()
         self._pending_write_bytes = 0
         self.client_name = None
@@ -136,8 +138,12 @@ class MyWebSocketaHandler(WebSocketHandler):
         写缓冲积压超过高水位时返回 future, 调用方 await 它做背压; 否则返回 None
         """
         message = NatSerialization.dumps(message_dict, ContextUtils.get_password(), self.compress_support, self.protocol_version)
+        return self.write_bytes(bytes(message))
+
+    def write_bytes(self, message: bytes) -> Optional[asyncio.Future]:
+        """写入已序列化的消息, 不等待 flush; 写缓冲积压超过高水位时返回 future, 否则返回 None"""
         try:
-            future = self._write_nowait(bytes(message))
+            future = self._write_nowait(message)
         except WebSocketClosedError:
             LoggerFactory.get_logger().info(f'forward to closed websocket {self.client_name}, drop')
             return None
@@ -402,24 +408,11 @@ class MyWebSocketaHandler(WebSocketHandler):
                     connection = tcp_forward_client.uid_to_connection[uid]
                     with connection.early_data_lock:
                         connection.connection_confirmed = True
-                        early_data_buffer = connection.early_data_buffer
-                        connection.early_data_buffer = []
+                        early_data_bytes = connection.early_data_bytes
                     LoggerFactory.get_logger().info(
-                        f'connect confirmed uid: {uid.hex()}, flushing {sum(len(b) for b in early_data_buffer)} bytes, {connection.stats()}')
-
-                    # 同步写入不 await, 保证早期数据排在 socket 线程后续数据之前
-                    for buffered_data in early_data_buffer:
-                        if buffered_data:
-                            send_message: MessageEntity = {
-                                'type_': MessageTypeConstant.WEBSOCKET_OVER_TCP,
-                                'data': {
-                                    'name': connection.socket_server.name,
-                                    'data': buffered_data,
-                                    'uid': uid,
-                                    'ip_port': connection.socket_server.ip_port
-                                }
-                            }
-                            self.forward_message(send_message)
+                        f'connect confirmed uid: {uid.hex()}, flushing {early_data_bytes} bytes, {connection.stats()}')
+                    # 单独的任务 flush: 背压等待不能阻塞本 websocket 后续消息的处理
+                    asyncio.ensure_future(tcp_forward_client.flush_early_data(connection))
 
             elif message_dict['type_'] == MessageTypeConstant.CONNECT_FAILED:
                 data: TcpOverWebsocketMessage = message_dict['data']

proxynt-2.1.0rc1/proxynt.egg-info/entry_points.txt

@@ -1,5 +0,0 @@
-
-    [console_scripts]
-    nt_client = proxynt.run_client:main
-    nt_server = proxynt.run_server:main
-