nessi/NexaVPN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: replace Peek with ReadFull in TLS ClientHello parsing to prevent buffering issues

Browse Source 
Replace bufio.Reader.Peek calls with io.ReadFull for header and record body reading. Allocate header and full buffers explicitly and copy header into full buffer before reading remaining bytes. Remove redundant byte slice copy when returning full ClientHello data.
This commit is contained in:
Sascha Nesterovic
2026-03-19 22:38:12 +01:00
parent e412395ade
commit a8a88140af
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
deploy/access-proxy/main.go
View File

@@ -166,23 +166,24 @@ func proxyCopy(errCh chan<- error, dst io.Writer, src io.Reader) {
} }
func readClientHello(reader *bufio.Reader) ([]byte, string, error) { func readClientHello(reader *bufio.Reader) ([]byte, string, error) {
header, err := reader.Peek(5) header := make([]byte, 5)
if err != nil { if _, err := io.ReadFull(reader, header); err != nil {
return nil, "", err return nil, "", err
} }
if header[0] != 22 { if header[0] != 22 {
return nil, "", errors.New("not a tls client hello") return nil, "", errors.New("not a tls client hello")
} }
recordLen := int(header[3])<<8 | int(header[4]) recordLen := int(header[3])<<8 | int(header[4])
full, err := reader.Peek(5 + recordLen) full := make([]byte, 5+recordLen)
if err != nil { copy(full, header)
if _, err := io.ReadFull(reader, full[5:]); err != nil {
return nil, "", err return nil, "", err
} }
host, err := extractSNI(full) host, err := extractSNI(full)
if err != nil { if err != nil {
return nil, "", err return nil, "", err
} }
return append([]byte(nil), full...), host, nil return full, host, nil
} }
func extractSNI(packet []byte) (string, error) { func extractSNI(packet []byte) (string, error) {