feat: introduce buffered random reader to optimize entropy access and implement asynchronous share URL generation for navigation attributes

Author: lemon-mint

cmd/wasm-kernel/main.go

@@ -4,7 +4,6 @@ package main
 
 import (
 	"context"
-	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -20,6 +19,7 @@ import (
 	"github.com/gosuda/zeroproxy/internal/cookiejar"
 	"github.com/gosuda/zeroproxy/internal/headers"
 	"github.com/gosuda/zeroproxy/internal/htmltx"
+	"github.com/gosuda/zeroproxy/internal/randbuf"
 	"github.com/gosuda/zeroproxy/internal/smuxconn"
 	"github.com/gosuda/zeroproxy/internal/swhttp"
 	"github.com/gosuda/zeroproxy/internal/wsconn"
@@ -527,7 +527,7 @@ func (k *Kernel) tabFromValues(tabID, keyB64 string) *zphttp.TabState {
 	key, _ := base64.RawURLEncoding.DecodeString(keyB64)
 	if len(key) == 0 {
 		key = make([]byte, 32)
-		_, _ = rand.Read(key)
+		_ = randbuf.ReadFull(key)
 	}
 	t := &zphttp.TabState{TabID: tabID, CookieJar: cookiejar.New(), StreamIsolationKey: key}
 	k.tabs[tabID] = t

internal/randbuf/randbuf.go

@@ -0,0 +1,30 @@
+package randbuf
+
+import (
+	"bufio"
+	"crypto/rand"
+	"io"
+	"sync"
+)
+
+const defaultBufferSize = 32 * 1024
+
+// Reader amortizes small crypto/rand reads, such as WebSocket frame masks, while
+// preserving an io.Reader seam for deterministic tests that inject their own RNG.
+var Reader io.Reader = &lockedReader{r: bufio.NewReaderSize(rand.Reader, defaultBufferSize)}
+
+func ReadFull(p []byte) error {
+	_, err := io.ReadFull(Reader, p)
+	return err
+}
+
+type lockedReader struct {
+	mu sync.Mutex
+	r  *bufio.Reader
+}
+
+func (r *lockedReader) Read(p []byte) (int, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return r.r.Read(p)
+}

internal/shareurl/shareurl.go

@@ -4,7 +4,6 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/hmac"
-	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
@@ -15,6 +14,8 @@ import (
 	"strings"
 
 	"golang.org/x/crypto/hkdf"
+
+	"github.com/gosuda/zeroproxy/internal/randbuf"
 )
 
 var (
@@ -34,7 +35,7 @@ const (
 // same AES-256-CBC + HMAC-SHA256 envelope as web/zp-core.js, carrying explicit
 // relay server parameters.
 func NewWithServers(target string, servers []string) (string, error) {
-	return NewWithRandAndServers(rand.Reader, target, servers)
+	return NewWithRandAndServers(randbuf.Reader, target, servers)
 }
 
 func NewWithRand(random io.Reader, target string) (string, error) {

internal/wsproto/client.go

@@ -3,7 +3,6 @@ package wsproto
 import (
 	"bufio"
 	"context"
-	"crypto/rand"
 	"crypto/sha1"
 	"encoding/base64"
 	"encoding/binary"
@@ -15,6 +14,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/gosuda/zeroproxy/internal/randbuf"
 	"github.com/gosuda/zeroproxy/internal/zphttp"
 )
 
@@ -49,7 +49,7 @@ func Dial(ctx context.Context, engine *zphttp.Engine, target *url.URL, protocols
 		return nil, nil, err
 	}
 	keyBytes := make([]byte, 16)
-	if _, err := rand.Read(keyBytes); err != nil {
+	if err := randbuf.ReadFull(keyBytes); err != nil {
 		_ = c.Close()
 		return nil, nil, err
 	}
@@ -155,7 +155,7 @@ func (c *Conn) WriteFrame(op byte, payload []byte) error {
 		n = 10
 	}
 	var mask [4]byte
-	if _, err := rand.Read(mask[:]); err != nil {
+	if err := randbuf.ReadFull(mask[:]); err != nil {
 		return err
 	}
 	copy(hdr[n:], mask[:])

rewriter-rs/src/share_url.rs

@@ -4,7 +4,9 @@ use base64::Engine;
 use cbc::cipher::{block_padding::Pkcs7, BlockEncryptMut, KeyIvInit};
 use hmac::{Hmac, Mac};
 use sha2::Sha256;
+use std::cell::RefCell;
 use std::collections::HashSet;
+use std::io::{self, BufReader, Read};
 use std::net::IpAddr;
 use url::Url;
 
@@ -19,13 +21,37 @@ const MAX_RELAY_SERVERS: usize = 8;
 const MAX_RELAY_SERVER_BYTES: usize = 2048;
 const SEED_LEN: usize = 64;
 const IV_LEN: usize = 16;
+const RANDOM_BUFFER_SIZE: usize = 32 * 1024;
+
+thread_local! {
+    static RANDOM_READER: RefCell<BufReader<GetRandomReader>> =
+        RefCell::new(BufReader::with_capacity(RANDOM_BUFFER_SIZE, GetRandomReader));
+}
+
+struct GetRandomReader;
+
+impl Read for GetRandomReader {
+    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
+        getrandom::getrandom(buf).map_err(|err| io::Error::other(err.to_string()))?;
+        Ok(buf.len())
+    }
+}
 
 pub(crate) fn new_with_servers(target: &str, servers: &[String]) -> Result<String, String> {
     let mut random = [0u8; SEED_LEN + IV_LEN];
-    getrandom::getrandom(&mut random).map_err(|err| err.to_string())?;
+    fill_random(&mut random)?;
     new_with_seed_iv_and_servers(target, servers, &random[..SEED_LEN], &random[SEED_LEN..])
 }
 
+fn fill_random(buf: &mut [u8]) -> Result<(), String> {
+    RANDOM_READER.with(|reader| {
+        reader
+            .borrow_mut()
+            .read_exact(buf)
+            .map_err(|err| err.to_string())
+    })
+}
+
 pub(crate) fn new_with_seed_iv_and_servers(
     target: &str,
     servers: &[String],

test/e2e/proxy.test.js

@@ -105,6 +105,11 @@ function createTargetServer(requests) {
           dynamicImage.id = 'dynamic-image-probe';
           dynamicImage.src = '/image-probe.png?dynamic=1';
           document.body.appendChild(dynamicImage);
+          const dynamicRelativeLink = document.createElement('a');
+          dynamicRelativeLink.id = 'dynamic-relative-next';
+          dynamicRelativeLink.setAttribute('href', '/next');
+          dynamicRelativeLink.textContent = 'Dynamic next page';
+          document.body.appendChild(dynamicRelativeLink);
           const dynamicCSP = document.createElement('meta');
           dynamicCSP.setAttribute('http-equiv', 'Content-Security-Policy');
           dynamicCSP.setAttribute('content', "default-src 'none'");
@@ -1623,6 +1628,16 @@ test('browser traffic uses internal SOCKS5 mode and covers proxied runtime integ
       platform: navigator.platform,
       userAgentData,
       templateLink: window.__templateLinkFixture,
+      dynamicRelativeLink: (() => {
+        const el = document.getElementById('dynamic-relative-next');
+        return (
+          el && {
+            href: el.getAttribute('href'),
+            hrefProp: el.href,
+            outerHTML: el.outerHTML,
+          }
+        );
+      })(),
       phase2Location: window.__phase2Location,
       phase2DynamicFunction: window.__phase2DynamicFunction,
       phase2EvalLocation: window.__phase2EvalLocation,
@@ -1824,6 +1839,45 @@ test('browser traffic uses internal SOCKS5 mode and covers proxied runtime integ
   assert.match(addressBarShare, relayServerParam);
   const staticNextHref = await page.$eval('#next', (el) => el.getAttribute('href') || '');
   assert.equal(staticNextHref, `http://${targetHost}:${targetPort}/next`);
+  assert.deepEqual(home.dynamicRelativeLink, {
+    href: `http://${targetHost}:${targetPort}/next`,
+    hrefProp: `http://${targetHost}:${targetPort}/next`,
+    outerHTML: `<a id="dynamic-relative-next" href="http://${targetHost}:${targetPort}/next">Dynamic next page</a>`,
+  });
+  const rawDynamicRelativeLink = await (async () => {
+    const client = await page.target().createCDPSession();
+    const deadline = Date.now() + 5000;
+    let last = null;
+    while (Date.now() < deadline) {
+      const snap = await client.send('DOMSnapshot.captureSnapshot', {
+        computedStyles: [],
+        includeDOMRects: false,
+        includePaintOrder: false,
+      });
+      const strings = snap.strings;
+      for (const doc of snap.documents) {
+        const attrs = doc.nodes.attributes || [];
+        for (const nodeAttrs of attrs) {
+          const pairs = {};
+          for (let i = 0; i < (nodeAttrs || []).length; i += 2) {
+            pairs[strings[nodeAttrs[i]]] = strings[nodeAttrs[i + 1]];
+          }
+          if (pairs.id === 'dynamic-relative-next') {
+            last = pairs;
+            if (/^\/zp\/p\//.test(pairs.href || '')) return pairs;
+          }
+        }
+      }
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    return last;
+  })();
+  assert.match(rawDynamicRelativeLink && rawDynamicRelativeLink.href || '', /^\/zp\/p\//);
+  assert.match(rawDynamicRelativeLink && rawDynamicRelativeLink.href || '', /#k=/);
+  assert.equal(
+    rawDynamicRelativeLink && rawDynamicRelativeLink['data-zp-target-url'],
+    `http://${targetHost}:${targetPort}/next`,
+  );
   const externalContext = await (browser.createBrowserContext
     ? browser.createBrowserContext()
     : browser.createIncognitoBrowserContext());

web/runtime-prelude.mjs

@@ -63,6 +63,7 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
   const documentCharset = String(boot.documentCharset || '');
   const dynamicCompileAllowed = boot.dynamicCompileAllowed === true;
   const urlMeta = new WeakMap();
+  const navShareVersions = new WeakMap();
   const messageListenerWrappers = new WeakMap();
   const frameWindowOrigins = new WeakMap();
   const frameSandboxMeta = new WeakMap();
@@ -318,6 +319,10 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
   }
   function shareFragmentForKey(key) { return ZP.makeShareFragment(String(key), activeServers); }
   function isHTTPURL(raw) { try { const u = new URL(String(raw), baseURL); return u.protocol === 'http:' || u.protocol === 'https:'; } catch { return false; } }
+  function isControlURL(raw) {
+    const value = String(raw || '').trim();
+    return value.startsWith(ZP.CONTROL_PREFIX) || value.startsWith(proxyOrigin + ZP.CONTROL_PREFIX);
+  }
   function hasExecutableURLScheme(raw) { return /^(?:javascript|data|vbscript):/i.test(String(raw).trim()); }
   function hasDangerousURLScheme(raw) { return /^(?:javascript|vbscript):/i.test(String(raw).trim()); }
   function shouldBlockURLAttribute(el, key, raw) {
@@ -1749,6 +1754,29 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
   function visibleNavigationURL(el, attrName) {
     return Native.getAttribute.call(el, 'data-zp-target-url') || urlMeta.get(el) || Native.getAttribute.call(el, attrName) || '';
   }
+  function isShareNavigationAttribute(el, attrName) {
+    const tag = el && el.localName;
+    return attrLocalName(attrName) === 'href' && (tag === 'a' || tag === 'area');
+  }
+  function bumpNavigationShareVersion(el) {
+    const version = (navShareVersions.get(el) || 0) + 1;
+    navShareVersions.set(el, version);
+    return version;
+  }
+  function scheduleNavigationShareURL(el, attrName, target) {
+    if (!isShareNavigationAttribute(el, attrName)) return;
+    const version = bumpNavigationShareVersion(el);
+    ZP.encryptShareURL(target).then(share => {
+      if (navShareVersions.get(el) !== version) return;
+      if ((Native.getAttribute.call(el, 'data-zp-target-url') || urlMeta.get(el) || '') !== target) return;
+      const href = `${ZP.makeSharePath(share.encrypted)}${shareFragmentForKey(share.key)}`;
+      if (Native.getAttribute.call(el, attrName) !== href) Native.setAttribute.call(el, attrName, href);
+    }).catch(() => {});
+  }
+  function rememberNavigationTarget(el, target) {
+    urlMeta.set(el, target);
+    if (Native.getAttribute.call(el, 'data-zp-target-url') !== target) Native.setAttribute.call(el, 'data-zp-target-url', target);
+  }
   function visibleSrcset(el) {
     const stored = Native.getAttribute.call(el, 'data-zp-target-srcset');
     if (stored) return stored;
@@ -2392,10 +2420,11 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
     if (isResourceURLAttribute(this, key)) return setResourceURLAttribute(this, k, v);
     if (isURLBearing(this, key)) {
       if (shouldBlockURLAttribute(this, localKey, v)) return blockExecutableURL(this, localKey, v);
+      if (isControlURL(v)) return Native.setAttribute.call(this, k, v);
       if (isHTTPURL(v)) {
         const t = targetURL(v);
-        urlMeta.set(this, t);
-        if (!usesRawURLAttribute(this, key)) Native.setAttribute.call(this, 'data-zp-target-url', t);
+        rememberNavigationTarget(this, t);
+        scheduleNavigationShareURL(this, k, t);
         if ((this.localName === 'iframe' || this.localName === 'frame') && localKey === 'src') {
           setFrameSourceAttribute(this, k, t);
           return;
@@ -2425,10 +2454,11 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
     if (isResourceURLAttribute(this, key)) return setResourceURLAttribute(this, k, v, ns);
     if (isURLBearing(this, key)) {
       if (shouldBlockURLAttribute(this, localKey, v)) return blockExecutableURL(this, localKey, v);
+      if (isControlURL(v)) return Native.setAttributeNS.call(this, ns, k, v);
       if (isHTTPURL(v)) {
         const t = targetURL(v);
-        urlMeta.set(this, t);
-        if (!usesRawURLAttribute(this, key)) Native.setAttribute.call(this, 'data-zp-target-url', t);
+        rememberNavigationTarget(this, t);
+        scheduleNavigationShareURL(this, k, t);
         if ((this.localName === 'iframe' || this.localName === 'frame') && localKey === 'src') {
           setFrameSourceAttribute(this, k, t, ns);
           return;
@@ -2532,6 +2562,11 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
       urlMeta.delete(this);
       Native.removeAttribute.call(this, 'data-zp-target-url');
     }
+    if (isURLBearing(this, key) && usesRawURLAttribute(this, key)) {
+      bumpNavigationShareVersion(this);
+      urlMeta.delete(this);
+      Native.removeAttribute.call(this, 'data-zp-target-url');
+    }
     if (isSrcsetAttribute(this, key)) Native.removeAttribute.call(this, 'data-zp-target-srcset');
     return Native.removeAttribute.call(this, k);
   }
@@ -3081,16 +3116,16 @@ import { createWorkerFacades } from './runtime/workers/facades.mjs';
     if (!isURLBearing(el, key)) return;
     const raw = Native.getAttribute.call(el, key);
     if (shouldBlockURLAttribute(el, localKey, raw)) { blockExecutableURL(el, localKey, raw); return; }
-    if (!raw || !isHTTPURL(raw) || String(raw).startsWith(proxyOrigin)) return;
+    if (!raw || !isHTTPURL(raw) || isControlURL(raw) || String(raw).startsWith(proxyOrigin)) return;
     if (isResourceURLAttribute(el, key)) {
       if (!Native.getAttribute.call(el, 'data-zp-target-url')) setResourceURLAttribute(el, key, raw);
       return;
     }
     let target;
     try { target = targetURL(raw); } catch { return; }
-    const alreadyMapped = urlMeta.get(el) === target && (!usesRawURLAttribute(el, key) ? Native.getAttribute.call(el, 'data-zp-target-url') === target : true);
-    urlMeta.set(el, target);
-    if (!usesRawURLAttribute(el, key)) Native.setAttribute.call(el, 'data-zp-target-url', target);
+    const alreadyMapped = urlMeta.get(el) === target && Native.getAttribute.call(el, 'data-zp-target-url') === target;
+    rememberNavigationTarget(el, target);
+    scheduleNavigationShareURL(el, key, target);
     if ((tag === 'iframe' || tag === 'frame') && localKey === 'src') {
       sanitizeFrameSandbox(el);
       setFrameSourceAttribute(el, key, target);