Module tcp 

TCP stream proxy: accept a client, pick a load-balanced upstream (optionally by TLS SNI), and relay bytes in both directions until either side closes.

Constants

MAX_CLIENT_HELLO 🔒

Cap on how much of a ClientHello is buffered while looking for the SNI.

Functions

peek_sni 🔒

Reads (consuming) the start of the connection until the SNI is resolved, EOF, the 8 KiB cap, or the timeout. Returns the hostname (if any) and the bytes consumed so they can be replayed to the upstream. Any short / garbage / timeout path yields (None, buf) so the caller uses the default pool.

spawn

Binds the TCP listener (fail-fast) and spawns its accept loop, returning the bound address (the OS-assigned port when cfg.port == 0). The loop stops accepting when shutdown_rx flips to true. When router has SNI routes, each connection’s TLS ClientHello is peeked to pick a backend by hostname.