Skip to content

v2.0.1

Choose a tag to compare

View all tags
@MrMohebi MrMohebi released this 19 Nov 20:05
· 1 commit to master since this release
v2.0.1
527ab5f

📦 CHANGELOG

🚀 v2.0.1 – Loop-Safe Release (2025-11-19)

This release fixes all infinite loop issues, improves Docker compatibility, and introduces automatic port-offset routing.

🔥 New Features

  • Port Offset System (9443→443, 9080→80)
    Prevents infinite NAT loops inside Docker by mapping incoming 9xxx ports back to real service ports.

    • Incoming 9443 → backend 443
    • Incoming 9080 → backend 80
    • Generic: 9xxx → xxx

  • Automatic Backend Port Calculation
    Added calculateBackendPort() to derive correct upstream port from incoming port.

  • Docker-Safe Architecture
    Now the proxy can run safely inside Docker without ever looping back into itself:

    docker run -p 443:9443 -p 80:9080 proxy

  • Local-IP Loop Detection
    Blocks requests targeting:

    • 127.0.0.1
    • container IPs (e.g. 172.17.x.x)
    • any loopback scenario

  • Improved SNI & Host Parsing

    • Robust TLS ClientHello reading
    • Safe fallback for malformed HTTP requests
    • Better error reporting

🛠 Enhancements

  • Cleaner multi-port handling

    • Supports lists (9443,9080)
    • Supports ranges (9000-9999)
    • Mixed formats now work reliably

  • Improved logging with slog

    • Context-aware fields
    • Debug mode shows detailed inbound/outbound flow

  • Removed broken waitgroup logic

    • Listeners now run asynchronously without blocking startup

  • Refined connection lifecycle

    • Safe CloseWrite usage
    • No panics due to non-TCPConn types

  • Better error readability

    • TLS handshake failures explained
    • Invalid ports detected early

🐛 Bug Fixes

  • Fixed infinite self-connection loop

    • Proxy no longer dials its own listening port
    • Works correctly behind Docker NAT

  • Fixed HTTP detection deadlock

    • Prevented long hangs when reading initial bytes

  • Fixed TLS handshake stalling

    • Added read deadlines
    • Improved ClientHello extraction using corrected ReadOnlyConn

  • Fixed crash when port ranges were malformed

    • Handling of cases like 8080- or -9000

  • Fixed missing pointer receiver on ReadOnlyConn

    • Deadlines now work
    • Avoids handshake blockages

📦 Technical Notes

  • Using 9xxx → xxx port-offset model is now required for Docker deployments.

  • All tests confirm zero looping under:

    • Host network mode
    • Bridge network mode
    • Exposed port mode
    • NAT rewrites

Example deployment:

docker run \
  -p 443:9443 \
  -p 80:9080 \
  ghcr.io/mrmohebi/forward-proxy:latest \
  -port 9443,9080 \
  -log-level info
Assets 2
Loading