BUG??? Reverse Proxy (Portal/Bridge) connection state desynchronization after restarts

[dimzon]

Bug Report: Reverse Proxy (Portal/Bridge) connection state desynchronization after restarts

Description

The Xray-core Reverse Proxy module fails to maintain or recover connection states correctly when either the Bridge or the Portal process is restarted. The system enters a "deadlock" state where the Portal holds stale tunnel mappings, or the Bridge fails to re-register after a Portal reboot, leading to hanging connections or Empty reply from server errors.

Environment

• Xray-core version: 26.3.27 (d2758a0)
• Go version: go1.26.1 linux/amd64
• OS: Ubuntu 20.04.6 LTS (Kernel: 5.4.0-192-generic x86_64)
• Setup: Portal (Server) with dokodemo-door inbounds, Bridge (Client) behind NAT connected via Shadowsocks 2022.

Steps to Reproduce

1. Initial State: Start Portal, then Bridge.
2. Verify: Run curl 127.0.0.1:80 on the Portal side.
   • Result: Success (HTTP response from Bridge).
3. Simulate Bridge Failure: Kill the Bridge process. Run curl 127.0.0.1:80 on Portal.
   • Result: Hangs (Expected).
4. Failed Recovery (Stale Portal State): Start Bridge again.
   • Result: The previous curl from Step 3 continues to hang and does not recover.
5. Ghost Session: Kill the hanging curl and start a new curl 127.0.0.1:80.
   • Result: Still hangs (Unexpected: Portal does not route new requests through the re-established Bridge connection).
6. Portal Desynchronization: Kill the hanging curl. Restart the Portal process while the Bridge is still running. Run curl 127.0.0.1:80 on Portal.
   • Result: curl: (52) Empty reply from server.
7. Full Reset: Restart the Bridge process again. Run curl 127.0.0.1:80 on Portal.
   • Result: Success (Connectivity restored).

Actual Behavior

• Bridge Restart: Portal retains "dead" internal states in its tunnel pool. Existing connections do not resume, and new requests are routed into the stale pool rather than using the fresh Bridge connection.
• Portal Restart: Bridge remains in a stale state, failing to detect the server reboot and re-register its tunnels immediately, resulting in Empty reply (EOF).
• Reliability: The module is not self-healing and requires manual synchronization of both processes to recover from a single-point restart.

Expected Behavior

• Portal should invalidate or prioritize new tunnel registrations from the same Bridge (matching domain), clearing out stale associations.
• Bridge should implement a robust heartbeat or detection mechanism to trigger re-registration if the Portal is restarted or the transport layer is interrupted.

---

Configurations

Bridge Config (bridge.json):

{
    "log": { "loglevel": "warning" },
    "reverse": {
        "bridges": [{ "tag": "bridge", "domain": "reverse.xray.internal" }]
    },
    "outbounds": [
        { "tag": "blackhole", "protocol": "blackhole" },
        {
            "protocol": "shadowsocks",
            "settings": {
                "servers": [{
                    "address": "YOUR_PORTAL_IP",
                    "port": 87,
                    "method": "2022-blake3-aes-128-gcm",
                    "password": "YOUR_PASSWORD"
                }]
            },
            "tag": "to_portal"
        },
        {
            "tag": "to_local",
            "protocol": "freedom",
            "settings": { "redirect": "127.0.0.1:0" }
        }
    ],
    "routing": {
        "rules": [
            {
                "type": "field",
                "inboundTag": ["bridge"],
                "domain": ["full:reverse.xray.internal"],
                "outboundTag": "to_portal"
            },
            {
                "type": "field",
                "inboundTag": ["bridge"],
                "network": "tcp",
                "port": "80,443,451,486,643,5228,7443,59962,59964",
                "outboundTag": "to_local"
            },
            {
                "type": "field",
                "inboundTag": ["bridge"],
                "network": "udp",
                "port": "304,404,451,487,488,489,543,59964",
                "outboundTag": "to_local"
            }
        ]
    }
}

Portal Config (portal.json):

{
    "log": { "loglevel": "warning" },
    "reverse": {
        "portals": [{ "tag": "portal", "domain": "reverse.xray.internal" }]
    },
    "inbounds": [
        {
            "listen": "::",
            "port": 87,
            "protocol": "shadowsocks",
            "settings": {
                "method": "2022-blake3-aes-128-gcm",
                "password": "YOUR_PASSWORD",
                "udp": true
            },
            "streamSettings": {
                "sockopt": {
                    "tcpKeepAliveInterval": 15,
                    "tcpKeepAliveIdle": 15
                }
            },
            "tag": "from_bridge"
        },
        {
            "tag": "public_in_80_tcp",
            "listen": "0.0.0.0",
            "port": "80,88",
            "protocol": "dokodemo-door",
            "settings": { "address": "127.0.0.1", "port": 80, "network": "tcp" }
        },
        {
            "tag": "public_in_443_tcp",
            "listen": "0.0.0.0",
            "port": "443,453",
            "protocol": "dokodemo-door",
            "settings": { "address": "127.0.0.1", "port": 443, "network": "tcp" }
        }
    ],
    "outbounds": [{ "tag": "blackhole", "protocol": "blackhole" }],
    "routing": {
        "rules": [
            { "type": "field", "inboundTag": ["from_bridge"], "outboundTag": "portal" },
            { "type": "field", "inboundTag": ["public_in_80_tcp", "public_in_443_tcp"], "outboundTag": "portal" }
        ]
    }
}

[vemneyy]

same