Method handleTunnel

internal/exit/exit.go:314–453

(w http.ResponseWriter, r *http.Request)

}

func (s *Server) handleTunnel(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		w.WriteHeader(http.StatusMethodNotAllowed)
		return
	}
	s.stats.requests.Add(1)
	body, err := readTunnelRequestBody(r.Body, r.ContentLength, maxRequestBodyBytes)
	if err != nil {
		log.Printf("[exit] read body: %v", err)
		if errors.Is(err, errRequestTooLarge) {
			w.WriteHeader(http.StatusRequestEntityTooLarge)
		} else {
			w.WriteHeader(http.StatusBadRequest)
		}
		return
	}

	clientID, rxFrames, err := frame.DecodeBatch(s.aead, body)
	if err != nil {
		s.stats.decodeFailures.Add(1)
		// Decode failure on the very first batch from a client almost always
		// means the AES key on the client does not match this server's key.
		log.Printf("[exit] decode batch failed: %v (likely tunnel_key mismatch — confirm client config matches this server's tunnel_key)", err)
		w.WriteHeader(http.StatusNoContent)
		return
	}

	if len(rxFrames) > 0 {
		var bytesIn uint64
		for _, f := range rxFrames {
			bytesIn += uint64(len(f.Payload))
		}
		s.stats.framesIn.Add(uint64(len(rxFrames)))
		s.stats.bytesIn.Add(bytesIn)
	}

	// Process SYN frames in parallel — each routeIncoming on a SYN may dial
	// upstream synchronously, and a single bad target (typo'd / stale DNS /
	// unroutable IP) used to block every other SYN behind it for the full
	// dial timeout. Non-SYN frames are still routed sequentially after the
	// SYN goroutines finish so a DATA frame that lands in the same batch as
	// its own SYN doesn't race the openSession registration.
	var synWG sync.WaitGroup
	for _, f := range rxFrames {
		if f.HasFlag(frame.FlagSYN) {
			synWG.Add(1)
			go func(f *frame.Frame) {
				defer synWG.Done()
				s.routeIncoming(f, clientID)
			}(f)
		}
	}
	synWG.Wait()
	for _, f := range rxFrames {
		if !f.HasFlag(frame.FlagSYN) {
			s.routeIncoming(f, clientID)
		}
	}