penguin/tinyproxy

commit 4ee0fbade2dcdc37b8a43b6f8f668ae31a4de360

commit 4ee0fbade2dcdc37b8a43b6f8f668ae31a4de360
Author: 斟酌 鵬兄 <tgckpg@gmail.com>
Date:   2026-06-08T00:03:04Z

    Do not log default option values
---
 docs/tinyproxy.conf.5.scd | 17 ++++++++++++-----
 examples/tinyproxy.conf   |  4 ++++
 src/route.c               | 19 +++++++++++++++----
 3 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/docs/tinyproxy.conf.5.scd b/docs/tinyproxy.conf.5.scd
index c9d9fba..0d26e21 100644
--- a/docs/tinyproxy.conf.5.scd
+++ b/docs/tinyproxy.conf.5.scd
@@ -25,12 +25,19 @@ proxy_v2
 sni_sniff
 	Enable passive SNI sniffing for TLS traffic.
 
-	When enabled, tinyproxy inspects the TLS ClientHello from the client
-	and logs the observed Server Name Indication as client_sni=.
+	When enabled, tinyproxy inspects bytes already read from the client's
+	TLS ClientHello and logs the observed Server Name Indication as
+	client_sni=. TLS traffic is not decrypted or modified.
 
-	This does not decrypt TLS traffic, modify client data, or verify that
-	the SNI value is truthful. If no usable SNI is observed, client_sni=
-	is left empty and sni_status= describes why.
+	If no usable SNI is observed, client_sni= contains a bracketed status
+	such as <missing>, <not_tls>, <not_observed>, or <parse_error>.
+
+	This option is mainly intended for debugging routes with shared TLS
+	upstreams, such as investigating which hostname is associated with
+	upstream timeout or reset errors.
+
+	Do not enable this option on stable routes unless the extra diagnostic
+	logging is needed. It adds a small bounded parsing cost to client reads.
 
 	Default: false
 
diff --git a/examples/tinyproxy.conf b/examples/tinyproxy.conf
index f2e93e9..1ff0038 100644
--- a/examples/tinyproxy.conf
+++ b/examples/tinyproxy.conf
@@ -3,6 +3,10 @@
 listen tcp :80     tcp 10.0.1.1:80
 listen tcp :443    tcp 10.0.1.1:443    proxy_v2,keep_alive
 
+# Diagnostic only: log the TLS SNI seen from clients before forwarding.
+# Useful when debugging upstream timeout/reset errors behind a shared TLS gateway.
+# listen tcp :443 tcp 10.0.1.1:443 proxy_v2,sni_sniff,connect_timeout=5
+
 # TCP # listener to UNIX stream backend.
 listen tcp  :12990                unix /tmp/test.sock
 
diff --git a/src/route.c b/src/route.c
index 57944f1..e7fc502 100644
--- a/src/route.c
+++ b/src/route.c
@@ -46,10 +46,21 @@ void route_options_str(const struct route_options *opts, char *buf, size_t bufle
 #define ADD_INT(name, value) \
 	ADD_FMT("%s=%d", name, value)
 
-	ADD_BOOL("proxy_v2", opts->proxy_v2);
-	ADD_INT("idle_timeout", opts->idle_timeout_sec);
-	ADD_INT("connect_timeout", opts->connect_timeout_sec);
-	ADD_BOOL("keep_alive", opts->keep_alive);
+	if(opts->proxy_v2) {
+		ADD_BOOL("proxy_v2", opts->proxy_v2);
+	}
+	if(opts->idle_timeout_sec != ROUTE_DEFAULT_IDLE_TIMEOUT_SEC) {
+		ADD_INT("idle_timeout", opts->idle_timeout_sec);
+	}
+	if(opts->connect_timeout_sec != ROUTE_DEFAULT_CONNECT_TIMEOUT_SEC) {
+		ADD_INT("connect_timeout", opts->connect_timeout_sec);
+	}
+	if(opts->keep_alive) {
+		ADD_BOOL("keep_alive", opts->keep_alive);
+	}
+	if(opts->sni_sniff) {
+		ADD_BOOL("sni_sniff", opts->sni_sniff);
+	}
 
 	switch (opts->broadcast_reply) {
 		case BROADCAST_REPLY_OFF: