BREAKING_CHANGE(core): refactored the codebase to be more maintainable
This commit is contained in:
398
ts/networkproxy/classes.np.certificatemanager.ts
Normal file
398
ts/networkproxy/classes.np.certificatemanager.ts
Normal file
@ -0,0 +1,398 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import * as fs from 'fs';
|
||||
import * as path from 'path';
|
||||
import { fileURLToPath } from 'url';
|
||||
import { type INetworkProxyOptions, type ICertificateEntry, type ILogger, createLogger } from './classes.np.types.js';
|
||||
import { Port80Handler, Port80HandlerEvents, type IDomainOptions } from '../port80handler/classes.port80handler.js';
|
||||
|
||||
/**
|
||||
* Manages SSL certificates for NetworkProxy including ACME integration
|
||||
*/
|
||||
export class CertificateManager {
|
||||
private defaultCertificates: { key: string; cert: string };
|
||||
private certificateCache: Map<string, ICertificateEntry> = new Map();
|
||||
private port80Handler: Port80Handler | null = null;
|
||||
private externalPort80Handler: boolean = false;
|
||||
private certificateStoreDir: string;
|
||||
private logger: ILogger;
|
||||
private httpsServer: plugins.https.Server | null = null;
|
||||
|
||||
constructor(private options: INetworkProxyOptions) {
|
||||
this.certificateStoreDir = path.resolve(options.acme?.certificateStore || './certs');
|
||||
this.logger = createLogger(options.logLevel || 'info');
|
||||
|
||||
// Ensure certificate store directory exists
|
||||
try {
|
||||
if (!fs.existsSync(this.certificateStoreDir)) {
|
||||
fs.mkdirSync(this.certificateStoreDir, { recursive: true });
|
||||
this.logger.info(`Created certificate store directory: ${this.certificateStoreDir}`);
|
||||
}
|
||||
} catch (error) {
|
||||
this.logger.warn(`Failed to create certificate store directory: ${error}`);
|
||||
}
|
||||
|
||||
this.loadDefaultCertificates();
|
||||
}
|
||||
|
||||
/**
|
||||
* Loads default certificates from the filesystem
|
||||
*/
|
||||
public loadDefaultCertificates(): void {
|
||||
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
||||
const certPath = path.join(__dirname, '..', '..', 'assets', 'certs');
|
||||
|
||||
try {
|
||||
this.defaultCertificates = {
|
||||
key: fs.readFileSync(path.join(certPath, 'key.pem'), 'utf8'),
|
||||
cert: fs.readFileSync(path.join(certPath, 'cert.pem'), 'utf8')
|
||||
};
|
||||
this.logger.info('Default certificates loaded successfully');
|
||||
} catch (error) {
|
||||
this.logger.error('Error loading default certificates', error);
|
||||
|
||||
// Generate self-signed fallback certificates
|
||||
try {
|
||||
// This is a placeholder for actual certificate generation code
|
||||
// In a real implementation, you would use a library like selfsigned to generate certs
|
||||
this.defaultCertificates = {
|
||||
key: "FALLBACK_KEY_CONTENT",
|
||||
cert: "FALLBACK_CERT_CONTENT"
|
||||
};
|
||||
this.logger.warn('Using fallback self-signed certificates');
|
||||
} catch (fallbackError) {
|
||||
this.logger.error('Failed to generate fallback certificates', fallbackError);
|
||||
throw new Error('Could not load or generate SSL certificates');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the HTTPS server reference for context updates
|
||||
*/
|
||||
public setHttpsServer(server: plugins.https.Server): void {
|
||||
this.httpsServer = server;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get default certificates
|
||||
*/
|
||||
public getDefaultCertificates(): { key: string; cert: string } {
|
||||
return { ...this.defaultCertificates };
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets an external Port80Handler for certificate management
|
||||
*/
|
||||
public setExternalPort80Handler(handler: Port80Handler): void {
|
||||
if (this.port80Handler && !this.externalPort80Handler) {
|
||||
this.logger.warn('Replacing existing internal Port80Handler with external handler');
|
||||
|
||||
// Clean up existing handler if needed
|
||||
if (this.port80Handler !== handler) {
|
||||
// Unregister event handlers to avoid memory leaks
|
||||
this.port80Handler.removeAllListeners(Port80HandlerEvents.CERTIFICATE_ISSUED);
|
||||
this.port80Handler.removeAllListeners(Port80HandlerEvents.CERTIFICATE_RENEWED);
|
||||
this.port80Handler.removeAllListeners(Port80HandlerEvents.CERTIFICATE_FAILED);
|
||||
this.port80Handler.removeAllListeners(Port80HandlerEvents.CERTIFICATE_EXPIRING);
|
||||
}
|
||||
}
|
||||
|
||||
// Set the external handler
|
||||
this.port80Handler = handler;
|
||||
this.externalPort80Handler = true;
|
||||
|
||||
// Register event handlers
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_ISSUED, this.handleCertificateIssued.bind(this));
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_RENEWED, this.handleCertificateIssued.bind(this));
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_FAILED, this.handleCertificateFailed.bind(this));
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_EXPIRING, (data) => {
|
||||
this.logger.info(`Certificate for ${data.domain} expires in ${data.daysRemaining} days`);
|
||||
});
|
||||
|
||||
this.logger.info('External Port80Handler connected to CertificateManager');
|
||||
|
||||
// Register domains with Port80Handler if we have any certificates cached
|
||||
if (this.certificateCache.size > 0) {
|
||||
const domains = Array.from(this.certificateCache.keys())
|
||||
.filter(domain => !domain.includes('*')); // Skip wildcard domains
|
||||
|
||||
this.registerDomainsWithPort80Handler(domains);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle newly issued or renewed certificates from Port80Handler
|
||||
*/
|
||||
private handleCertificateIssued(data: { domain: string; certificate: string; privateKey: string; expiryDate: Date }): void {
|
||||
const { domain, certificate, privateKey, expiryDate } = data;
|
||||
|
||||
this.logger.info(`Certificate ${this.certificateCache.has(domain) ? 'renewed' : 'issued'} for ${domain}, valid until ${expiryDate.toISOString()}`);
|
||||
|
||||
// Update certificate in HTTPS server
|
||||
this.updateCertificateCache(domain, certificate, privateKey, expiryDate);
|
||||
|
||||
// Save the certificate to the filesystem if not using external handler
|
||||
if (!this.externalPort80Handler && this.options.acme?.certificateStore) {
|
||||
this.saveCertificateToStore(domain, certificate, privateKey);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle certificate issuance failures
|
||||
*/
|
||||
private handleCertificateFailed(data: { domain: string; error: string }): void {
|
||||
this.logger.error(`Certificate issuance failed for ${data.domain}: ${data.error}`);
|
||||
}
|
||||
|
||||
/**
|
||||
* Saves certificate and private key to the filesystem
|
||||
*/
|
||||
private saveCertificateToStore(domain: string, certificate: string, privateKey: string): void {
|
||||
try {
|
||||
const certPath = path.join(this.certificateStoreDir, `${domain}.cert.pem`);
|
||||
const keyPath = path.join(this.certificateStoreDir, `${domain}.key.pem`);
|
||||
|
||||
fs.writeFileSync(certPath, certificate);
|
||||
fs.writeFileSync(keyPath, privateKey);
|
||||
|
||||
// Ensure private key has restricted permissions
|
||||
try {
|
||||
fs.chmodSync(keyPath, 0o600);
|
||||
} catch (error) {
|
||||
this.logger.warn(`Failed to set permissions on private key for ${domain}: ${error}`);
|
||||
}
|
||||
|
||||
this.logger.info(`Saved certificate for ${domain} to ${certPath}`);
|
||||
} catch (error) {
|
||||
this.logger.error(`Failed to save certificate for ${domain}: ${error}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handles SNI (Server Name Indication) for TLS connections
|
||||
* Used by the HTTPS server to select the correct certificate for each domain
|
||||
*/
|
||||
public handleSNI(domain: string, cb: (err: Error | null, ctx: plugins.tls.SecureContext) => void): void {
|
||||
this.logger.debug(`SNI request for domain: ${domain}`);
|
||||
|
||||
// Check if we have a certificate for this domain
|
||||
const certs = this.certificateCache.get(domain);
|
||||
|
||||
if (certs) {
|
||||
try {
|
||||
// Create TLS context with the cached certificate
|
||||
const context = plugins.tls.createSecureContext({
|
||||
key: certs.key,
|
||||
cert: certs.cert
|
||||
});
|
||||
|
||||
this.logger.debug(`Using cached certificate for ${domain}`);
|
||||
cb(null, context);
|
||||
return;
|
||||
} catch (err) {
|
||||
this.logger.error(`Error creating secure context for ${domain}:`, err);
|
||||
}
|
||||
}
|
||||
|
||||
// Check if we should trigger certificate issuance
|
||||
if (this.options.acme?.enabled && this.port80Handler && !domain.includes('*')) {
|
||||
// Check if this domain is already registered
|
||||
const certData = this.port80Handler.getCertificate(domain);
|
||||
|
||||
if (!certData) {
|
||||
this.logger.info(`No certificate found for ${domain}, registering for issuance`);
|
||||
|
||||
// Register with new domain options format
|
||||
const domainOptions: IDomainOptions = {
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true
|
||||
};
|
||||
|
||||
this.port80Handler.addDomain(domainOptions);
|
||||
}
|
||||
}
|
||||
|
||||
// Fall back to default certificate
|
||||
try {
|
||||
const context = plugins.tls.createSecureContext({
|
||||
key: this.defaultCertificates.key,
|
||||
cert: this.defaultCertificates.cert
|
||||
});
|
||||
|
||||
this.logger.debug(`Using default certificate for ${domain}`);
|
||||
cb(null, context);
|
||||
} catch (err) {
|
||||
this.logger.error(`Error creating default secure context:`, err);
|
||||
cb(new Error('Cannot create secure context'), null);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates certificate in cache
|
||||
*/
|
||||
public updateCertificateCache(domain: string, certificate: string, privateKey: string, expiryDate?: Date): void {
|
||||
// Update certificate context in HTTPS server if it's running
|
||||
if (this.httpsServer) {
|
||||
try {
|
||||
this.httpsServer.addContext(domain, {
|
||||
key: privateKey,
|
||||
cert: certificate
|
||||
});
|
||||
this.logger.debug(`Updated SSL context for domain: ${domain}`);
|
||||
} catch (error) {
|
||||
this.logger.error(`Error updating SSL context for domain ${domain}:`, error);
|
||||
}
|
||||
}
|
||||
|
||||
// Update certificate in cache
|
||||
this.certificateCache.set(domain, {
|
||||
key: privateKey,
|
||||
cert: certificate,
|
||||
expires: expiryDate
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a certificate for a domain
|
||||
*/
|
||||
public getCertificate(domain: string): ICertificateEntry | undefined {
|
||||
return this.certificateCache.get(domain);
|
||||
}
|
||||
|
||||
/**
|
||||
* Requests a new certificate for a domain
|
||||
*/
|
||||
public async requestCertificate(domain: string): Promise<boolean> {
|
||||
if (!this.options.acme?.enabled && !this.externalPort80Handler) {
|
||||
this.logger.warn('ACME certificate management is not enabled');
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!this.port80Handler) {
|
||||
this.logger.error('Port80Handler is not initialized');
|
||||
return false;
|
||||
}
|
||||
|
||||
// Skip wildcard domains - can't get certs for these with HTTP-01 validation
|
||||
if (domain.includes('*')) {
|
||||
this.logger.error(`Cannot request certificate for wildcard domain: ${domain}`);
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
// Use the new domain options format
|
||||
const domainOptions: IDomainOptions = {
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true
|
||||
};
|
||||
|
||||
this.port80Handler.addDomain(domainOptions);
|
||||
this.logger.info(`Certificate request submitted for domain: ${domain}`);
|
||||
return true;
|
||||
} catch (error) {
|
||||
this.logger.error(`Error requesting certificate for domain ${domain}:`, error);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Registers domains with Port80Handler for ACME certificate management
|
||||
*/
|
||||
public registerDomainsWithPort80Handler(domains: string[]): void {
|
||||
if (!this.port80Handler) {
|
||||
this.logger.warn('Port80Handler is not initialized');
|
||||
return;
|
||||
}
|
||||
|
||||
for (const domain of domains) {
|
||||
// Skip wildcard domains - can't get certs for these with HTTP-01 validation
|
||||
if (domain.includes('*')) {
|
||||
this.logger.info(`Skipping wildcard domain for ACME: ${domain}`);
|
||||
continue;
|
||||
}
|
||||
|
||||
// Skip domains already with certificates if configured to do so
|
||||
if (this.options.acme?.skipConfiguredCerts) {
|
||||
const cachedCert = this.certificateCache.get(domain);
|
||||
if (cachedCert) {
|
||||
this.logger.info(`Skipping domain with existing certificate: ${domain}`);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
// Register the domain for certificate issuance with new domain options format
|
||||
const domainOptions: IDomainOptions = {
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true
|
||||
};
|
||||
|
||||
this.port80Handler.addDomain(domainOptions);
|
||||
this.logger.info(`Registered domain for ACME certificate issuance: ${domain}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize internal Port80Handler
|
||||
*/
|
||||
public async initializePort80Handler(): Promise<Port80Handler | null> {
|
||||
// Skip if using external handler
|
||||
if (this.externalPort80Handler) {
|
||||
this.logger.info('Using external Port80Handler, skipping initialization');
|
||||
return this.port80Handler;
|
||||
}
|
||||
|
||||
if (!this.options.acme?.enabled) {
|
||||
return null;
|
||||
}
|
||||
|
||||
// Create certificate manager
|
||||
this.port80Handler = new Port80Handler({
|
||||
port: this.options.acme.port,
|
||||
contactEmail: this.options.acme.contactEmail,
|
||||
useProduction: this.options.acme.useProduction,
|
||||
renewThresholdDays: this.options.acme.renewThresholdDays,
|
||||
httpsRedirectPort: this.options.port, // Redirect to our HTTPS port
|
||||
renewCheckIntervalHours: 24, // Check daily for renewals
|
||||
enabled: this.options.acme.enabled,
|
||||
autoRenew: this.options.acme.autoRenew,
|
||||
certificateStore: this.options.acme.certificateStore,
|
||||
skipConfiguredCerts: this.options.acme.skipConfiguredCerts
|
||||
});
|
||||
|
||||
// Register event handlers
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_ISSUED, this.handleCertificateIssued.bind(this));
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_RENEWED, this.handleCertificateIssued.bind(this));
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_FAILED, this.handleCertificateFailed.bind(this));
|
||||
this.port80Handler.on(Port80HandlerEvents.CERTIFICATE_EXPIRING, (data) => {
|
||||
this.logger.info(`Certificate for ${data.domain} expires in ${data.daysRemaining} days`);
|
||||
});
|
||||
|
||||
// Start the handler
|
||||
try {
|
||||
await this.port80Handler.start();
|
||||
this.logger.info(`Port80Handler started on port ${this.options.acme.port}`);
|
||||
return this.port80Handler;
|
||||
} catch (error) {
|
||||
this.logger.error(`Failed to start Port80Handler: ${error}`);
|
||||
this.port80Handler = null;
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop the Port80Handler if it was internally created
|
||||
*/
|
||||
public async stopPort80Handler(): Promise<void> {
|
||||
if (this.port80Handler && !this.externalPort80Handler) {
|
||||
try {
|
||||
await this.port80Handler.stop();
|
||||
this.logger.info('Port80Handler stopped');
|
||||
} catch (error) {
|
||||
this.logger.error('Error stopping Port80Handler', error);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
241
ts/networkproxy/classes.np.connectionpool.ts
Normal file
241
ts/networkproxy/classes.np.connectionpool.ts
Normal file
@ -0,0 +1,241 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type INetworkProxyOptions, type IConnectionEntry, type ILogger, createLogger } from './classes.np.types.js';
|
||||
|
||||
/**
|
||||
* Manages a pool of backend connections for efficient reuse
|
||||
*/
|
||||
export class ConnectionPool {
|
||||
private connectionPool: Map<string, Array<IConnectionEntry>> = new Map();
|
||||
private roundRobinPositions: Map<string, number> = new Map();
|
||||
private logger: ILogger;
|
||||
|
||||
constructor(private options: INetworkProxyOptions) {
|
||||
this.logger = createLogger(options.logLevel || 'info');
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a connection from the pool or create a new one
|
||||
*/
|
||||
public getConnection(host: string, port: number): Promise<plugins.net.Socket> {
|
||||
return new Promise((resolve, reject) => {
|
||||
const poolKey = `${host}:${port}`;
|
||||
const connectionList = this.connectionPool.get(poolKey) || [];
|
||||
|
||||
// Look for an idle connection
|
||||
const idleConnectionIndex = connectionList.findIndex(c => c.isIdle);
|
||||
|
||||
if (idleConnectionIndex >= 0) {
|
||||
// Get existing connection from pool
|
||||
const connection = connectionList[idleConnectionIndex];
|
||||
connection.isIdle = false;
|
||||
connection.lastUsed = Date.now();
|
||||
this.logger.debug(`Reusing connection from pool for ${poolKey}`);
|
||||
|
||||
// Update the pool
|
||||
this.connectionPool.set(poolKey, connectionList);
|
||||
|
||||
resolve(connection.socket);
|
||||
return;
|
||||
}
|
||||
|
||||
// No idle connection available, create a new one if pool isn't full
|
||||
const poolSize = this.options.connectionPoolSize || 50;
|
||||
if (connectionList.length < poolSize) {
|
||||
this.logger.debug(`Creating new connection to ${host}:${port}`);
|
||||
|
||||
try {
|
||||
const socket = plugins.net.connect({
|
||||
host,
|
||||
port,
|
||||
keepAlive: true,
|
||||
keepAliveInitialDelay: 30000 // 30 seconds
|
||||
});
|
||||
|
||||
socket.once('connect', () => {
|
||||
// Add to connection pool
|
||||
const connection = {
|
||||
socket,
|
||||
lastUsed: Date.now(),
|
||||
isIdle: false
|
||||
};
|
||||
|
||||
connectionList.push(connection);
|
||||
this.connectionPool.set(poolKey, connectionList);
|
||||
|
||||
// Setup cleanup when the connection is closed
|
||||
socket.once('close', () => {
|
||||
const idx = connectionList.findIndex(c => c.socket === socket);
|
||||
if (idx >= 0) {
|
||||
connectionList.splice(idx, 1);
|
||||
this.connectionPool.set(poolKey, connectionList);
|
||||
this.logger.debug(`Removed closed connection from pool for ${poolKey}`);
|
||||
}
|
||||
});
|
||||
|
||||
resolve(socket);
|
||||
});
|
||||
|
||||
socket.once('error', (err) => {
|
||||
this.logger.error(`Error creating connection to ${host}:${port}`, err);
|
||||
reject(err);
|
||||
});
|
||||
} catch (err) {
|
||||
this.logger.error(`Failed to create connection to ${host}:${port}`, err);
|
||||
reject(err);
|
||||
}
|
||||
} else {
|
||||
// Pool is full, wait for an idle connection or reject
|
||||
this.logger.warn(`Connection pool for ${poolKey} is full (${connectionList.length})`);
|
||||
reject(new Error(`Connection pool for ${poolKey} is full`));
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Return a connection to the pool for reuse
|
||||
*/
|
||||
public returnConnection(socket: plugins.net.Socket, host: string, port: number): void {
|
||||
const poolKey = `${host}:${port}`;
|
||||
const connectionList = this.connectionPool.get(poolKey) || [];
|
||||
|
||||
// Find this connection in the pool
|
||||
const connectionIndex = connectionList.findIndex(c => c.socket === socket);
|
||||
|
||||
if (connectionIndex >= 0) {
|
||||
// Mark as idle and update last used time
|
||||
connectionList[connectionIndex].isIdle = true;
|
||||
connectionList[connectionIndex].lastUsed = Date.now();
|
||||
|
||||
this.logger.debug(`Returned connection to pool for ${poolKey}`);
|
||||
} else {
|
||||
this.logger.warn(`Attempted to return unknown connection to pool for ${poolKey}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Cleanup the connection pool by removing idle connections
|
||||
* or reducing pool size if it exceeds the configured maximum
|
||||
*/
|
||||
public cleanupConnectionPool(): void {
|
||||
const now = Date.now();
|
||||
const idleTimeout = this.options.keepAliveTimeout || 120000; // 2 minutes default
|
||||
|
||||
for (const [host, connections] of this.connectionPool.entries()) {
|
||||
// Sort by last used time (oldest first)
|
||||
connections.sort((a, b) => a.lastUsed - b.lastUsed);
|
||||
|
||||
// Remove idle connections older than the idle timeout
|
||||
let removed = 0;
|
||||
while (connections.length > 0) {
|
||||
const connection = connections[0];
|
||||
|
||||
// Remove if idle and exceeds timeout, or if pool is too large
|
||||
if ((connection.isIdle && now - connection.lastUsed > idleTimeout) ||
|
||||
connections.length > (this.options.connectionPoolSize || 50)) {
|
||||
|
||||
try {
|
||||
if (!connection.socket.destroyed) {
|
||||
connection.socket.end();
|
||||
connection.socket.destroy();
|
||||
}
|
||||
} catch (err) {
|
||||
this.logger.error(`Error destroying pooled connection to ${host}`, err);
|
||||
}
|
||||
|
||||
connections.shift(); // Remove from pool
|
||||
removed++;
|
||||
} else {
|
||||
break; // Stop removing if we've reached active or recent connections
|
||||
}
|
||||
}
|
||||
|
||||
if (removed > 0) {
|
||||
this.logger.debug(`Removed ${removed} idle connections from pool for ${host}, ${connections.length} remaining`);
|
||||
}
|
||||
|
||||
// Update the pool with the remaining connections
|
||||
if (connections.length === 0) {
|
||||
this.connectionPool.delete(host);
|
||||
} else {
|
||||
this.connectionPool.set(host, connections);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Close all connections in the pool
|
||||
*/
|
||||
public closeAllConnections(): void {
|
||||
for (const [host, connections] of this.connectionPool.entries()) {
|
||||
this.logger.debug(`Closing ${connections.length} connections to ${host}`);
|
||||
|
||||
for (const connection of connections) {
|
||||
try {
|
||||
if (!connection.socket.destroyed) {
|
||||
connection.socket.end();
|
||||
connection.socket.destroy();
|
||||
}
|
||||
} catch (error) {
|
||||
this.logger.error(`Error closing connection to ${host}:`, error);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
this.connectionPool.clear();
|
||||
this.roundRobinPositions.clear();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get load balancing target using round-robin
|
||||
*/
|
||||
public getNextTarget(targets: string[], port: number): { host: string, port: number } {
|
||||
const targetKey = targets.join(',');
|
||||
|
||||
// Initialize position if not exists
|
||||
if (!this.roundRobinPositions.has(targetKey)) {
|
||||
this.roundRobinPositions.set(targetKey, 0);
|
||||
}
|
||||
|
||||
// Get current position and increment for next time
|
||||
const currentPosition = this.roundRobinPositions.get(targetKey)!;
|
||||
const nextPosition = (currentPosition + 1) % targets.length;
|
||||
this.roundRobinPositions.set(targetKey, nextPosition);
|
||||
|
||||
// Return the selected target
|
||||
return {
|
||||
host: targets[currentPosition],
|
||||
port
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the connection pool status
|
||||
*/
|
||||
public getPoolStatus(): Record<string, { total: number, idle: number }> {
|
||||
return Object.fromEntries(
|
||||
Array.from(this.connectionPool.entries()).map(([host, connections]) => [
|
||||
host,
|
||||
{
|
||||
total: connections.length,
|
||||
idle: connections.filter(c => c.isIdle).length
|
||||
}
|
||||
])
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Setup a periodic cleanup task
|
||||
*/
|
||||
public setupPeriodicCleanup(interval: number = 60000): NodeJS.Timeout {
|
||||
const timer = setInterval(() => {
|
||||
this.cleanupConnectionPool();
|
||||
}, interval);
|
||||
|
||||
// Don't prevent process exit
|
||||
if (timer.unref) {
|
||||
timer.unref();
|
||||
}
|
||||
|
||||
return timer;
|
||||
}
|
||||
}
|
||||
469
ts/networkproxy/classes.np.networkproxy.ts
Normal file
469
ts/networkproxy/classes.np.networkproxy.ts
Normal file
@ -0,0 +1,469 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type INetworkProxyOptions, type ILogger, createLogger, type IReverseProxyConfig } from './classes.np.types.js';
|
||||
import { CertificateManager } from './classes.np.certificatemanager.js';
|
||||
import { ConnectionPool } from './classes.np.connectionpool.js';
|
||||
import { RequestHandler, type IMetricsTracker } from './classes.np.requesthandler.js';
|
||||
import { WebSocketHandler } from './classes.np.websockethandler.js';
|
||||
import { ProxyRouter } from '../classes.router.js';
|
||||
import { Port80Handler } from '../port80handler/classes.port80handler.js';
|
||||
|
||||
/**
|
||||
* NetworkProxy provides a reverse proxy with TLS termination, WebSocket support,
|
||||
* automatic certificate management, and high-performance connection pooling.
|
||||
*/
|
||||
export class NetworkProxy implements IMetricsTracker {
|
||||
// Configuration
|
||||
public options: INetworkProxyOptions;
|
||||
public proxyConfigs: IReverseProxyConfig[] = [];
|
||||
|
||||
// Server instances
|
||||
public httpsServer: plugins.https.Server;
|
||||
|
||||
// Core components
|
||||
private certificateManager: CertificateManager;
|
||||
private connectionPool: ConnectionPool;
|
||||
private requestHandler: RequestHandler;
|
||||
private webSocketHandler: WebSocketHandler;
|
||||
private router = new ProxyRouter();
|
||||
|
||||
// State tracking
|
||||
public socketMap = new plugins.lik.ObjectMap<plugins.net.Socket>();
|
||||
public activeContexts: Set<string> = new Set();
|
||||
public connectedClients: number = 0;
|
||||
public startTime: number = 0;
|
||||
public requestsServed: number = 0;
|
||||
public failedRequests: number = 0;
|
||||
|
||||
// Tracking for PortProxy integration
|
||||
private portProxyConnections: number = 0;
|
||||
private tlsTerminatedConnections: number = 0;
|
||||
|
||||
// Timers
|
||||
private metricsInterval: NodeJS.Timeout;
|
||||
private connectionPoolCleanupInterval: NodeJS.Timeout;
|
||||
|
||||
// Logger
|
||||
private logger: ILogger;
|
||||
|
||||
/**
|
||||
* Creates a new NetworkProxy instance
|
||||
*/
|
||||
constructor(optionsArg: INetworkProxyOptions) {
|
||||
// Set default options
|
||||
this.options = {
|
||||
port: optionsArg.port,
|
||||
maxConnections: optionsArg.maxConnections || 10000,
|
||||
keepAliveTimeout: optionsArg.keepAliveTimeout || 120000, // 2 minutes
|
||||
headersTimeout: optionsArg.headersTimeout || 60000, // 1 minute
|
||||
logLevel: optionsArg.logLevel || 'info',
|
||||
cors: optionsArg.cors || {
|
||||
allowOrigin: '*',
|
||||
allowMethods: 'GET, POST, PUT, DELETE, OPTIONS',
|
||||
allowHeaders: 'Content-Type, Authorization',
|
||||
maxAge: 86400
|
||||
},
|
||||
// Defaults for PortProxy integration
|
||||
connectionPoolSize: optionsArg.connectionPoolSize || 50,
|
||||
portProxyIntegration: optionsArg.portProxyIntegration || false,
|
||||
useExternalPort80Handler: optionsArg.useExternalPort80Handler || false,
|
||||
// Default ACME options
|
||||
acme: {
|
||||
enabled: optionsArg.acme?.enabled || false,
|
||||
port: optionsArg.acme?.port || 80,
|
||||
contactEmail: optionsArg.acme?.contactEmail || 'admin@example.com',
|
||||
useProduction: optionsArg.acme?.useProduction || false, // Default to staging for safety
|
||||
renewThresholdDays: optionsArg.acme?.renewThresholdDays || 30,
|
||||
autoRenew: optionsArg.acme?.autoRenew !== false, // Default to true
|
||||
certificateStore: optionsArg.acme?.certificateStore || './certs',
|
||||
skipConfiguredCerts: optionsArg.acme?.skipConfiguredCerts || false
|
||||
}
|
||||
};
|
||||
|
||||
// Initialize logger
|
||||
this.logger = createLogger(this.options.logLevel);
|
||||
|
||||
// Initialize components
|
||||
this.certificateManager = new CertificateManager(this.options);
|
||||
this.connectionPool = new ConnectionPool(this.options);
|
||||
this.requestHandler = new RequestHandler(this.options, this.connectionPool, this.router);
|
||||
this.webSocketHandler = new WebSocketHandler(this.options, this.connectionPool, this.router);
|
||||
|
||||
// Connect request handler to this metrics tracker
|
||||
this.requestHandler.setMetricsTracker(this);
|
||||
}
|
||||
|
||||
/**
|
||||
* Implements IMetricsTracker interface to increment request counters
|
||||
*/
|
||||
public incrementRequestsServed(): void {
|
||||
this.requestsServed++;
|
||||
}
|
||||
|
||||
/**
|
||||
* Implements IMetricsTracker interface to increment failed request counters
|
||||
*/
|
||||
public incrementFailedRequests(): void {
|
||||
this.failedRequests++;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the port number this NetworkProxy is listening on
|
||||
* Useful for PortProxy to determine where to forward connections
|
||||
*/
|
||||
public getListeningPort(): number {
|
||||
return this.options.port;
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates the server capacity settings
|
||||
* @param maxConnections Maximum number of simultaneous connections
|
||||
* @param keepAliveTimeout Keep-alive timeout in milliseconds
|
||||
* @param connectionPoolSize Size of the connection pool per backend
|
||||
*/
|
||||
public updateCapacity(maxConnections?: number, keepAliveTimeout?: number, connectionPoolSize?: number): void {
|
||||
if (maxConnections !== undefined) {
|
||||
this.options.maxConnections = maxConnections;
|
||||
this.logger.info(`Updated max connections to ${maxConnections}`);
|
||||
}
|
||||
|
||||
if (keepAliveTimeout !== undefined) {
|
||||
this.options.keepAliveTimeout = keepAliveTimeout;
|
||||
|
||||
if (this.httpsServer) {
|
||||
this.httpsServer.keepAliveTimeout = keepAliveTimeout;
|
||||
this.logger.info(`Updated keep-alive timeout to ${keepAliveTimeout}ms`);
|
||||
}
|
||||
}
|
||||
|
||||
if (connectionPoolSize !== undefined) {
|
||||
this.options.connectionPoolSize = connectionPoolSize;
|
||||
this.logger.info(`Updated connection pool size to ${connectionPoolSize}`);
|
||||
|
||||
// Clean up excess connections in the pool
|
||||
this.connectionPool.cleanupConnectionPool();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns current server metrics
|
||||
* Useful for PortProxy to determine which NetworkProxy to use for load balancing
|
||||
*/
|
||||
public getMetrics(): any {
|
||||
return {
|
||||
activeConnections: this.connectedClients,
|
||||
totalRequests: this.requestsServed,
|
||||
failedRequests: this.failedRequests,
|
||||
portProxyConnections: this.portProxyConnections,
|
||||
tlsTerminatedConnections: this.tlsTerminatedConnections,
|
||||
connectionPoolSize: this.connectionPool.getPoolStatus(),
|
||||
uptime: Math.floor((Date.now() - this.startTime) / 1000),
|
||||
memoryUsage: process.memoryUsage(),
|
||||
activeWebSockets: this.webSocketHandler.getConnectionInfo().activeConnections
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets an external Port80Handler for certificate management
|
||||
* This allows the NetworkProxy to use a centrally managed Port80Handler
|
||||
* instead of creating its own
|
||||
*
|
||||
* @param handler The Port80Handler instance to use
|
||||
*/
|
||||
public setExternalPort80Handler(handler: Port80Handler): void {
|
||||
// Connect it to the certificate manager
|
||||
this.certificateManager.setExternalPort80Handler(handler);
|
||||
}
|
||||
|
||||
/**
|
||||
* Starts the proxy server
|
||||
*/
|
||||
public async start(): Promise<void> {
|
||||
this.startTime = Date.now();
|
||||
|
||||
// Initialize Port80Handler if enabled and not using external handler
|
||||
if (this.options.acme?.enabled && !this.options.useExternalPort80Handler) {
|
||||
await this.certificateManager.initializePort80Handler();
|
||||
}
|
||||
|
||||
// Create the HTTPS server
|
||||
this.httpsServer = plugins.https.createServer(
|
||||
{
|
||||
key: this.certificateManager.getDefaultCertificates().key,
|
||||
cert: this.certificateManager.getDefaultCertificates().cert,
|
||||
SNICallback: (domain, cb) => this.certificateManager.handleSNI(domain, cb)
|
||||
},
|
||||
(req, res) => this.requestHandler.handleRequest(req, res)
|
||||
);
|
||||
|
||||
// Configure server timeouts
|
||||
this.httpsServer.keepAliveTimeout = this.options.keepAliveTimeout;
|
||||
this.httpsServer.headersTimeout = this.options.headersTimeout;
|
||||
|
||||
// Setup connection tracking
|
||||
this.setupConnectionTracking();
|
||||
|
||||
// Share HTTPS server with certificate manager
|
||||
this.certificateManager.setHttpsServer(this.httpsServer);
|
||||
|
||||
// Setup WebSocket support
|
||||
this.webSocketHandler.initialize(this.httpsServer);
|
||||
|
||||
// Start metrics collection
|
||||
this.setupMetricsCollection();
|
||||
|
||||
// Setup connection pool cleanup interval
|
||||
this.connectionPoolCleanupInterval = this.connectionPool.setupPeriodicCleanup();
|
||||
|
||||
// Start the server
|
||||
return new Promise((resolve) => {
|
||||
this.httpsServer.listen(this.options.port, () => {
|
||||
this.logger.info(`NetworkProxy started on port ${this.options.port}`);
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets up tracking of TCP connections
|
||||
*/
|
||||
private setupConnectionTracking(): void {
|
||||
this.httpsServer.on('connection', (connection: plugins.net.Socket) => {
|
||||
// Check if max connections reached
|
||||
if (this.socketMap.getArray().length >= this.options.maxConnections) {
|
||||
this.logger.warn(`Max connections (${this.options.maxConnections}) reached, rejecting new connection`);
|
||||
connection.destroy();
|
||||
return;
|
||||
}
|
||||
|
||||
// Add connection to tracking
|
||||
this.socketMap.add(connection);
|
||||
this.connectedClients = this.socketMap.getArray().length;
|
||||
|
||||
// Check for connection from PortProxy by inspecting the source port
|
||||
const localPort = connection.localPort || 0;
|
||||
const remotePort = connection.remotePort || 0;
|
||||
|
||||
// If this connection is from a PortProxy (usually indicated by it coming from localhost)
|
||||
if (this.options.portProxyIntegration && connection.remoteAddress?.includes('127.0.0.1')) {
|
||||
this.portProxyConnections++;
|
||||
this.logger.debug(`New connection from PortProxy (local: ${localPort}, remote: ${remotePort})`);
|
||||
} else {
|
||||
this.logger.debug(`New direct connection (local: ${localPort}, remote: ${remotePort})`);
|
||||
}
|
||||
|
||||
// Setup connection cleanup handlers
|
||||
const cleanupConnection = () => {
|
||||
if (this.socketMap.checkForObject(connection)) {
|
||||
this.socketMap.remove(connection);
|
||||
this.connectedClients = this.socketMap.getArray().length;
|
||||
|
||||
// If this was a PortProxy connection, decrement the counter
|
||||
if (this.options.portProxyIntegration && connection.remoteAddress?.includes('127.0.0.1')) {
|
||||
this.portProxyConnections--;
|
||||
}
|
||||
|
||||
this.logger.debug(`Connection closed. ${this.connectedClients} connections remaining`);
|
||||
}
|
||||
};
|
||||
|
||||
connection.on('close', cleanupConnection);
|
||||
connection.on('error', (err) => {
|
||||
this.logger.debug('Connection error', err);
|
||||
cleanupConnection();
|
||||
});
|
||||
connection.on('end', cleanupConnection);
|
||||
});
|
||||
|
||||
// Track TLS handshake completions
|
||||
this.httpsServer.on('secureConnection', (tlsSocket) => {
|
||||
this.tlsTerminatedConnections++;
|
||||
this.logger.debug('TLS handshake completed, connection secured');
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets up metrics collection
|
||||
*/
|
||||
private setupMetricsCollection(): void {
|
||||
this.metricsInterval = setInterval(() => {
|
||||
const uptime = Math.floor((Date.now() - this.startTime) / 1000);
|
||||
const metrics = {
|
||||
uptime,
|
||||
activeConnections: this.connectedClients,
|
||||
totalRequests: this.requestsServed,
|
||||
failedRequests: this.failedRequests,
|
||||
portProxyConnections: this.portProxyConnections,
|
||||
tlsTerminatedConnections: this.tlsTerminatedConnections,
|
||||
activeWebSockets: this.webSocketHandler.getConnectionInfo().activeConnections,
|
||||
memoryUsage: process.memoryUsage(),
|
||||
activeContexts: Array.from(this.activeContexts),
|
||||
connectionPool: this.connectionPool.getPoolStatus()
|
||||
};
|
||||
|
||||
this.logger.debug('Proxy metrics', metrics);
|
||||
}, 60000); // Log metrics every minute
|
||||
|
||||
// Don't keep process alive just for metrics
|
||||
if (this.metricsInterval.unref) {
|
||||
this.metricsInterval.unref();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates proxy configurations
|
||||
*/
|
||||
public async updateProxyConfigs(
|
||||
proxyConfigsArg: plugins.tsclass.network.IReverseProxyConfig[]
|
||||
): Promise<void> {
|
||||
this.logger.info(`Updating proxy configurations (${proxyConfigsArg.length} configs)`);
|
||||
|
||||
// Update internal configs
|
||||
this.proxyConfigs = proxyConfigsArg;
|
||||
this.router.setNewProxyConfigs(proxyConfigsArg);
|
||||
|
||||
// Collect all hostnames for cleanup later
|
||||
const currentHostNames = new Set<string>();
|
||||
|
||||
// Add/update SSL contexts for each host
|
||||
for (const config of proxyConfigsArg) {
|
||||
currentHostNames.add(config.hostName);
|
||||
|
||||
try {
|
||||
// Update certificate in cache
|
||||
this.certificateManager.updateCertificateCache(
|
||||
config.hostName,
|
||||
config.publicKey,
|
||||
config.privateKey
|
||||
);
|
||||
|
||||
this.activeContexts.add(config.hostName);
|
||||
} catch (error) {
|
||||
this.logger.error(`Failed to add SSL context for ${config.hostName}`, error);
|
||||
}
|
||||
}
|
||||
|
||||
// Clean up removed contexts
|
||||
for (const hostname of this.activeContexts) {
|
||||
if (!currentHostNames.has(hostname)) {
|
||||
this.logger.info(`Hostname ${hostname} removed from configuration`);
|
||||
this.activeContexts.delete(hostname);
|
||||
}
|
||||
}
|
||||
|
||||
// Register domains with Port80Handler if available
|
||||
const domainsForACME = Array.from(currentHostNames)
|
||||
.filter(domain => !domain.includes('*')); // Skip wildcard domains
|
||||
|
||||
this.certificateManager.registerDomainsWithPort80Handler(domainsForACME);
|
||||
}
|
||||
|
||||
/**
|
||||
* Converts PortProxy domain configurations to NetworkProxy configs
|
||||
* @param domainConfigs PortProxy domain configs
|
||||
* @param sslKeyPair Default SSL key pair to use if not specified
|
||||
* @returns Array of NetworkProxy configs
|
||||
*/
|
||||
public convertPortProxyConfigs(
|
||||
domainConfigs: Array<{
|
||||
domains: string[];
|
||||
targetIPs?: string[];
|
||||
allowedIPs?: string[];
|
||||
}>,
|
||||
sslKeyPair?: { key: string; cert: string }
|
||||
): plugins.tsclass.network.IReverseProxyConfig[] {
|
||||
const proxyConfigs: plugins.tsclass.network.IReverseProxyConfig[] = [];
|
||||
|
||||
// Use default certificates if not provided
|
||||
const defaultCerts = this.certificateManager.getDefaultCertificates();
|
||||
const sslKey = sslKeyPair?.key || defaultCerts.key;
|
||||
const sslCert = sslKeyPair?.cert || defaultCerts.cert;
|
||||
|
||||
for (const domainConfig of domainConfigs) {
|
||||
// Each domain in the domains array gets its own config
|
||||
for (const domain of domainConfig.domains) {
|
||||
// Skip non-hostname patterns (like IP addresses)
|
||||
if (domain.match(/^\d+\.\d+\.\d+\.\d+$/) || domain === '*' || domain === 'localhost') {
|
||||
continue;
|
||||
}
|
||||
|
||||
proxyConfigs.push({
|
||||
hostName: domain,
|
||||
destinationIps: domainConfig.targetIPs || ['localhost'],
|
||||
destinationPorts: [this.options.port], // Use the NetworkProxy port
|
||||
privateKey: sslKey,
|
||||
publicKey: sslCert
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
this.logger.info(`Converted ${domainConfigs.length} PortProxy configs to ${proxyConfigs.length} NetworkProxy configs`);
|
||||
return proxyConfigs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds default headers to be included in all responses
|
||||
*/
|
||||
public async addDefaultHeaders(headersArg: { [key: string]: string }): Promise<void> {
|
||||
this.logger.info('Adding default headers', headersArg);
|
||||
this.requestHandler.setDefaultHeaders(headersArg);
|
||||
}
|
||||
|
||||
/**
|
||||
* Stops the proxy server
|
||||
*/
|
||||
public async stop(): Promise<void> {
|
||||
this.logger.info('Stopping NetworkProxy server');
|
||||
|
||||
// Clear intervals
|
||||
if (this.metricsInterval) {
|
||||
clearInterval(this.metricsInterval);
|
||||
}
|
||||
|
||||
if (this.connectionPoolCleanupInterval) {
|
||||
clearInterval(this.connectionPoolCleanupInterval);
|
||||
}
|
||||
|
||||
// Stop WebSocket handler
|
||||
this.webSocketHandler.shutdown();
|
||||
|
||||
// Close all tracked sockets
|
||||
for (const socket of this.socketMap.getArray()) {
|
||||
try {
|
||||
socket.destroy();
|
||||
} catch (error) {
|
||||
this.logger.error('Error destroying socket', error);
|
||||
}
|
||||
}
|
||||
|
||||
// Close all connection pool connections
|
||||
this.connectionPool.closeAllConnections();
|
||||
|
||||
// Stop Port80Handler if internally managed
|
||||
await this.certificateManager.stopPort80Handler();
|
||||
|
||||
// Close the HTTPS server
|
||||
return new Promise((resolve) => {
|
||||
this.httpsServer.close(() => {
|
||||
this.logger.info('NetworkProxy server stopped successfully');
|
||||
resolve();
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Requests a new certificate for a domain
|
||||
* This can be used to manually trigger certificate issuance
|
||||
* @param domain The domain to request a certificate for
|
||||
* @returns A promise that resolves when the request is submitted (not when the certificate is issued)
|
||||
*/
|
||||
public async requestCertificate(domain: string): Promise<boolean> {
|
||||
return this.certificateManager.requestCertificate(domain);
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets all proxy configurations currently in use
|
||||
*/
|
||||
public getProxyConfigs(): plugins.tsclass.network.IReverseProxyConfig[] {
|
||||
return [...this.proxyConfigs];
|
||||
}
|
||||
}
|
||||
278
ts/networkproxy/classes.np.requesthandler.ts
Normal file
278
ts/networkproxy/classes.np.requesthandler.ts
Normal file
@ -0,0 +1,278 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type INetworkProxyOptions, type ILogger, createLogger, type IReverseProxyConfig } from './classes.np.types.js';
|
||||
import { ConnectionPool } from './classes.np.connectionpool.js';
|
||||
import { ProxyRouter } from '../classes.router.js';
|
||||
|
||||
/**
|
||||
* Interface for tracking metrics
|
||||
*/
|
||||
export interface IMetricsTracker {
|
||||
incrementRequestsServed(): void;
|
||||
incrementFailedRequests(): void;
|
||||
}
|
||||
|
||||
/**
|
||||
* Handles HTTP request processing and proxying
|
||||
*/
|
||||
export class RequestHandler {
|
||||
private defaultHeaders: { [key: string]: string } = {};
|
||||
private logger: ILogger;
|
||||
private metricsTracker: IMetricsTracker | null = null;
|
||||
|
||||
constructor(
|
||||
private options: INetworkProxyOptions,
|
||||
private connectionPool: ConnectionPool,
|
||||
private router: ProxyRouter
|
||||
) {
|
||||
this.logger = createLogger(options.logLevel || 'info');
|
||||
}
|
||||
|
||||
/**
|
||||
* Set the metrics tracker instance
|
||||
*/
|
||||
public setMetricsTracker(tracker: IMetricsTracker): void {
|
||||
this.metricsTracker = tracker;
|
||||
}
|
||||
|
||||
/**
|
||||
* Set default headers to be included in all responses
|
||||
*/
|
||||
public setDefaultHeaders(headers: { [key: string]: string }): void {
|
||||
this.defaultHeaders = {
|
||||
...this.defaultHeaders,
|
||||
...headers
|
||||
};
|
||||
this.logger.info('Updated default response headers');
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all default headers
|
||||
*/
|
||||
public getDefaultHeaders(): { [key: string]: string } {
|
||||
return { ...this.defaultHeaders };
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply CORS headers to response if configured
|
||||
*/
|
||||
private applyCorsHeaders(
|
||||
res: plugins.http.ServerResponse,
|
||||
req: plugins.http.IncomingMessage
|
||||
): void {
|
||||
if (!this.options.cors) {
|
||||
return;
|
||||
}
|
||||
|
||||
// Apply CORS headers
|
||||
if (this.options.cors.allowOrigin) {
|
||||
res.setHeader('Access-Control-Allow-Origin', this.options.cors.allowOrigin);
|
||||
}
|
||||
|
||||
if (this.options.cors.allowMethods) {
|
||||
res.setHeader('Access-Control-Allow-Methods', this.options.cors.allowMethods);
|
||||
}
|
||||
|
||||
if (this.options.cors.allowHeaders) {
|
||||
res.setHeader('Access-Control-Allow-Headers', this.options.cors.allowHeaders);
|
||||
}
|
||||
|
||||
if (this.options.cors.maxAge) {
|
||||
res.setHeader('Access-Control-Max-Age', this.options.cors.maxAge.toString());
|
||||
}
|
||||
|
||||
// Handle CORS preflight requests
|
||||
if (req.method === 'OPTIONS') {
|
||||
res.statusCode = 204; // No content
|
||||
res.end();
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply default headers to response
|
||||
*/
|
||||
private applyDefaultHeaders(res: plugins.http.ServerResponse): void {
|
||||
// Apply default headers
|
||||
for (const [key, value] of Object.entries(this.defaultHeaders)) {
|
||||
if (!res.hasHeader(key)) {
|
||||
res.setHeader(key, value);
|
||||
}
|
||||
}
|
||||
|
||||
// Add server identifier if not already set
|
||||
if (!res.hasHeader('Server')) {
|
||||
res.setHeader('Server', 'NetworkProxy');
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle an HTTP request
|
||||
*/
|
||||
public async handleRequest(
|
||||
req: plugins.http.IncomingMessage,
|
||||
res: plugins.http.ServerResponse
|
||||
): Promise<void> {
|
||||
// Record start time for logging
|
||||
const startTime = Date.now();
|
||||
|
||||
// Apply CORS headers if configured
|
||||
this.applyCorsHeaders(res, req);
|
||||
|
||||
// If this is an OPTIONS request, the response has already been ended in applyCorsHeaders
|
||||
// so we should return early to avoid trying to set more headers
|
||||
if (req.method === 'OPTIONS') {
|
||||
// Increment metrics for OPTIONS requests too
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementRequestsServed();
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Apply default headers
|
||||
this.applyDefaultHeaders(res);
|
||||
|
||||
try {
|
||||
// Find target based on hostname
|
||||
const proxyConfig = this.router.routeReq(req);
|
||||
|
||||
if (!proxyConfig) {
|
||||
// No matching proxy configuration
|
||||
this.logger.warn(`No proxy configuration for host: ${req.headers.host}`);
|
||||
res.statusCode = 404;
|
||||
res.end('Not Found: No proxy configuration for this host');
|
||||
|
||||
// Increment failed requests counter
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementFailedRequests();
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
// Get destination IP using round-robin if multiple IPs configured
|
||||
const destination = this.connectionPool.getNextTarget(
|
||||
proxyConfig.destinationIps,
|
||||
proxyConfig.destinationPorts[0]
|
||||
);
|
||||
|
||||
// Create options for the proxy request
|
||||
const options: plugins.http.RequestOptions = {
|
||||
hostname: destination.host,
|
||||
port: destination.port,
|
||||
path: req.url,
|
||||
method: req.method,
|
||||
headers: { ...req.headers }
|
||||
};
|
||||
|
||||
// Remove host header to avoid issues with virtual hosts on target server
|
||||
// The host header should match the target server's expected hostname
|
||||
if (options.headers && options.headers.host) {
|
||||
if ((proxyConfig as IReverseProxyConfig).rewriteHostHeader) {
|
||||
options.headers.host = `${destination.host}:${destination.port}`;
|
||||
}
|
||||
}
|
||||
|
||||
this.logger.debug(
|
||||
`Proxying request to ${destination.host}:${destination.port}${req.url}`,
|
||||
{ method: req.method }
|
||||
);
|
||||
|
||||
// Create proxy request
|
||||
const proxyReq = plugins.http.request(options, (proxyRes) => {
|
||||
// Copy status code
|
||||
res.statusCode = proxyRes.statusCode || 500;
|
||||
|
||||
// Copy headers from proxy response to client response
|
||||
for (const [key, value] of Object.entries(proxyRes.headers)) {
|
||||
if (value !== undefined) {
|
||||
res.setHeader(key, value);
|
||||
}
|
||||
}
|
||||
|
||||
// Pipe proxy response to client response
|
||||
proxyRes.pipe(res);
|
||||
|
||||
// Increment served requests counter when the response finishes
|
||||
res.on('finish', () => {
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementRequestsServed();
|
||||
}
|
||||
|
||||
// Log the completed request
|
||||
const duration = Date.now() - startTime;
|
||||
this.logger.debug(
|
||||
`Request completed in ${duration}ms: ${req.method} ${req.url} ${res.statusCode}`,
|
||||
{ duration, statusCode: res.statusCode }
|
||||
);
|
||||
});
|
||||
});
|
||||
|
||||
// Handle proxy request errors
|
||||
proxyReq.on('error', (error) => {
|
||||
const duration = Date.now() - startTime;
|
||||
this.logger.error(
|
||||
`Proxy error for ${req.method} ${req.url}: ${error.message}`,
|
||||
{ duration, error: error.message }
|
||||
);
|
||||
|
||||
// Increment failed requests counter
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementFailedRequests();
|
||||
}
|
||||
|
||||
// Check if headers have already been sent
|
||||
if (!res.headersSent) {
|
||||
res.statusCode = 502;
|
||||
res.end(`Bad Gateway: ${error.message}`);
|
||||
} else {
|
||||
// If headers already sent, just close the connection
|
||||
res.end();
|
||||
}
|
||||
});
|
||||
|
||||
// Pipe request body to proxy request and handle client-side errors
|
||||
req.pipe(proxyReq);
|
||||
|
||||
// Handle client disconnection
|
||||
req.on('error', (error) => {
|
||||
this.logger.debug(`Client connection error: ${error.message}`);
|
||||
proxyReq.destroy();
|
||||
|
||||
// Increment failed requests counter on client errors
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementFailedRequests();
|
||||
}
|
||||
});
|
||||
|
||||
// Handle response errors
|
||||
res.on('error', (error) => {
|
||||
this.logger.debug(`Response error: ${error.message}`);
|
||||
proxyReq.destroy();
|
||||
|
||||
// Increment failed requests counter on response errors
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementFailedRequests();
|
||||
}
|
||||
});
|
||||
|
||||
} catch (error) {
|
||||
// Handle any unexpected errors
|
||||
this.logger.error(
|
||||
`Unexpected error handling request: ${error.message}`,
|
||||
{ error: error.stack }
|
||||
);
|
||||
|
||||
// Increment failed requests counter
|
||||
if (this.metricsTracker) {
|
||||
this.metricsTracker.incrementFailedRequests();
|
||||
}
|
||||
|
||||
if (!res.headersSent) {
|
||||
res.statusCode = 500;
|
||||
res.end('Internal Server Error');
|
||||
} else {
|
||||
res.end();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
123
ts/networkproxy/classes.np.types.ts
Normal file
123
ts/networkproxy/classes.np.types.ts
Normal file
@ -0,0 +1,123 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
|
||||
/**
|
||||
* Configuration options for NetworkProxy
|
||||
*/
|
||||
export interface INetworkProxyOptions {
|
||||
port: number;
|
||||
maxConnections?: number;
|
||||
keepAliveTimeout?: number;
|
||||
headersTimeout?: number;
|
||||
logLevel?: 'error' | 'warn' | 'info' | 'debug';
|
||||
cors?: {
|
||||
allowOrigin?: string;
|
||||
allowMethods?: string;
|
||||
allowHeaders?: string;
|
||||
maxAge?: number;
|
||||
};
|
||||
|
||||
// Settings for PortProxy integration
|
||||
connectionPoolSize?: number; // Maximum connections to maintain in the pool to each backend
|
||||
portProxyIntegration?: boolean; // Flag to indicate this proxy is used by PortProxy
|
||||
useExternalPort80Handler?: boolean; // Flag to indicate using external Port80Handler
|
||||
|
||||
// ACME certificate management options
|
||||
acme?: {
|
||||
enabled?: boolean; // Whether to enable automatic certificate management
|
||||
port?: number; // Port to listen on for ACME challenges (default: 80)
|
||||
contactEmail?: string; // Email for Let's Encrypt account
|
||||
useProduction?: boolean; // Whether to use Let's Encrypt production (default: false for staging)
|
||||
renewThresholdDays?: number; // Days before expiry to renew certificates (default: 30)
|
||||
autoRenew?: boolean; // Whether to automatically renew certificates (default: true)
|
||||
certificateStore?: string; // Directory to store certificates (default: ./certs)
|
||||
skipConfiguredCerts?: boolean; // Skip domains that already have certificates configured
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Interface for a certificate entry in the cache
|
||||
*/
|
||||
export interface ICertificateEntry {
|
||||
key: string;
|
||||
cert: string;
|
||||
expires?: Date;
|
||||
}
|
||||
|
||||
/**
|
||||
* Interface for reverse proxy configuration
|
||||
*/
|
||||
export interface IReverseProxyConfig {
|
||||
destinationIps: string[];
|
||||
destinationPorts: number[];
|
||||
hostName: string;
|
||||
privateKey: string;
|
||||
publicKey: string;
|
||||
authentication?: {
|
||||
type: 'Basic';
|
||||
user: string;
|
||||
pass: string;
|
||||
};
|
||||
rewriteHostHeader?: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Interface for connection tracking in the pool
|
||||
*/
|
||||
export interface IConnectionEntry {
|
||||
socket: plugins.net.Socket;
|
||||
lastUsed: number;
|
||||
isIdle: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* WebSocket with heartbeat interface
|
||||
*/
|
||||
export interface IWebSocketWithHeartbeat extends plugins.wsDefault {
|
||||
lastPong: number;
|
||||
isAlive: boolean;
|
||||
}
|
||||
|
||||
/**
|
||||
* Logger interface for consistent logging across components
|
||||
*/
|
||||
export interface ILogger {
|
||||
debug(message: string, data?: any): void;
|
||||
info(message: string, data?: any): void;
|
||||
warn(message: string, data?: any): void;
|
||||
error(message: string, data?: any): void;
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a logger based on the specified log level
|
||||
*/
|
||||
export function createLogger(logLevel: string = 'info'): ILogger {
|
||||
const logLevels = {
|
||||
error: 0,
|
||||
warn: 1,
|
||||
info: 2,
|
||||
debug: 3
|
||||
};
|
||||
|
||||
return {
|
||||
debug: (message: string, data?: any) => {
|
||||
if (logLevels[logLevel] >= logLevels.debug) {
|
||||
console.log(`[DEBUG] ${message}`, data || '');
|
||||
}
|
||||
},
|
||||
info: (message: string, data?: any) => {
|
||||
if (logLevels[logLevel] >= logLevels.info) {
|
||||
console.log(`[INFO] ${message}`, data || '');
|
||||
}
|
||||
},
|
||||
warn: (message: string, data?: any) => {
|
||||
if (logLevels[logLevel] >= logLevels.warn) {
|
||||
console.warn(`[WARN] ${message}`, data || '');
|
||||
}
|
||||
},
|
||||
error: (message: string, data?: any) => {
|
||||
if (logLevels[logLevel] >= logLevels.error) {
|
||||
console.error(`[ERROR] ${message}`, data || '');
|
||||
}
|
||||
}
|
||||
};
|
||||
}
|
||||
226
ts/networkproxy/classes.np.websockethandler.ts
Normal file
226
ts/networkproxy/classes.np.websockethandler.ts
Normal file
@ -0,0 +1,226 @@
|
||||
import * as plugins from '../plugins.js';
|
||||
import { type INetworkProxyOptions, type IWebSocketWithHeartbeat, type ILogger, createLogger, type IReverseProxyConfig } from './classes.np.types.js';
|
||||
import { ConnectionPool } from './classes.np.connectionpool.js';
|
||||
import { ProxyRouter } from '../classes.router.js';
|
||||
|
||||
/**
|
||||
* Handles WebSocket connections and proxying
|
||||
*/
|
||||
export class WebSocketHandler {
|
||||
private heartbeatInterval: NodeJS.Timeout | null = null;
|
||||
private wsServer: plugins.ws.WebSocketServer | null = null;
|
||||
private logger: ILogger;
|
||||
|
||||
constructor(
|
||||
private options: INetworkProxyOptions,
|
||||
private connectionPool: ConnectionPool,
|
||||
private router: ProxyRouter
|
||||
) {
|
||||
this.logger = createLogger(options.logLevel || 'info');
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize WebSocket server on an existing HTTPS server
|
||||
*/
|
||||
public initialize(server: plugins.https.Server): void {
|
||||
// Create WebSocket server
|
||||
this.wsServer = new plugins.ws.WebSocketServer({
|
||||
server: server,
|
||||
clientTracking: true
|
||||
});
|
||||
|
||||
// Handle WebSocket connections
|
||||
this.wsServer.on('connection', (wsIncoming: IWebSocketWithHeartbeat, req: plugins.http.IncomingMessage) => {
|
||||
this.handleWebSocketConnection(wsIncoming, req);
|
||||
});
|
||||
|
||||
// Start the heartbeat interval
|
||||
this.startHeartbeat();
|
||||
|
||||
this.logger.info('WebSocket handler initialized');
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the heartbeat interval to check for inactive WebSocket connections
|
||||
*/
|
||||
private startHeartbeat(): void {
|
||||
// Clean up existing interval if any
|
||||
if (this.heartbeatInterval) {
|
||||
clearInterval(this.heartbeatInterval);
|
||||
}
|
||||
|
||||
// Set up the heartbeat interval (check every 30 seconds)
|
||||
this.heartbeatInterval = setInterval(() => {
|
||||
if (!this.wsServer || this.wsServer.clients.size === 0) {
|
||||
return; // Skip if no active connections
|
||||
}
|
||||
|
||||
this.logger.debug(`WebSocket heartbeat check for ${this.wsServer.clients.size} clients`);
|
||||
|
||||
this.wsServer.clients.forEach((ws: plugins.wsDefault) => {
|
||||
const wsWithHeartbeat = ws as IWebSocketWithHeartbeat;
|
||||
|
||||
if (wsWithHeartbeat.isAlive === false) {
|
||||
this.logger.debug('Terminating inactive WebSocket connection');
|
||||
return wsWithHeartbeat.terminate();
|
||||
}
|
||||
|
||||
wsWithHeartbeat.isAlive = false;
|
||||
wsWithHeartbeat.ping();
|
||||
});
|
||||
}, 30000);
|
||||
|
||||
// Make sure the interval doesn't keep the process alive
|
||||
if (this.heartbeatInterval.unref) {
|
||||
this.heartbeatInterval.unref();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle a new WebSocket connection
|
||||
*/
|
||||
private handleWebSocketConnection(wsIncoming: IWebSocketWithHeartbeat, req: plugins.http.IncomingMessage): void {
|
||||
try {
|
||||
// Initialize heartbeat tracking
|
||||
wsIncoming.isAlive = true;
|
||||
wsIncoming.lastPong = Date.now();
|
||||
|
||||
// Handle pong messages to track liveness
|
||||
wsIncoming.on('pong', () => {
|
||||
wsIncoming.isAlive = true;
|
||||
wsIncoming.lastPong = Date.now();
|
||||
});
|
||||
|
||||
// Find target configuration based on request
|
||||
const proxyConfig = this.router.routeReq(req);
|
||||
|
||||
if (!proxyConfig) {
|
||||
this.logger.warn(`No proxy configuration for WebSocket host: ${req.headers.host}`);
|
||||
wsIncoming.close(1008, 'No proxy configuration for this host');
|
||||
return;
|
||||
}
|
||||
|
||||
// Get destination target using round-robin if multiple targets
|
||||
const destination = this.connectionPool.getNextTarget(
|
||||
proxyConfig.destinationIps,
|
||||
proxyConfig.destinationPorts[0]
|
||||
);
|
||||
|
||||
// Build target URL
|
||||
const protocol = (req.socket as any).encrypted ? 'wss' : 'ws';
|
||||
const targetUrl = `${protocol}://${destination.host}:${destination.port}${req.url}`;
|
||||
|
||||
this.logger.debug(`WebSocket connection from ${req.socket.remoteAddress} to ${targetUrl}`);
|
||||
|
||||
// Create headers for outgoing WebSocket connection
|
||||
const headers: { [key: string]: string } = {};
|
||||
|
||||
// Copy relevant headers from incoming request
|
||||
for (const [key, value] of Object.entries(req.headers)) {
|
||||
if (value && typeof value === 'string' &&
|
||||
key.toLowerCase() !== 'connection' &&
|
||||
key.toLowerCase() !== 'upgrade' &&
|
||||
key.toLowerCase() !== 'sec-websocket-key' &&
|
||||
key.toLowerCase() !== 'sec-websocket-version') {
|
||||
headers[key] = value;
|
||||
}
|
||||
}
|
||||
|
||||
// Override host header if needed
|
||||
if ((proxyConfig as IReverseProxyConfig).rewriteHostHeader) {
|
||||
headers['host'] = `${destination.host}:${destination.port}`;
|
||||
}
|
||||
|
||||
// Create outgoing WebSocket connection
|
||||
const wsOutgoing = new plugins.wsDefault(targetUrl, {
|
||||
headers: headers,
|
||||
followRedirects: true
|
||||
});
|
||||
|
||||
// Handle connection errors
|
||||
wsOutgoing.on('error', (err) => {
|
||||
this.logger.error(`WebSocket target connection error: ${err.message}`);
|
||||
if (wsIncoming.readyState === wsIncoming.OPEN) {
|
||||
wsIncoming.close(1011, 'Internal server error');
|
||||
}
|
||||
});
|
||||
|
||||
// Handle outgoing connection open
|
||||
wsOutgoing.on('open', () => {
|
||||
// Forward incoming messages to outgoing connection
|
||||
wsIncoming.on('message', (data, isBinary) => {
|
||||
if (wsOutgoing.readyState === wsOutgoing.OPEN) {
|
||||
wsOutgoing.send(data, { binary: isBinary });
|
||||
}
|
||||
});
|
||||
|
||||
// Forward outgoing messages to incoming connection
|
||||
wsOutgoing.on('message', (data, isBinary) => {
|
||||
if (wsIncoming.readyState === wsIncoming.OPEN) {
|
||||
wsIncoming.send(data, { binary: isBinary });
|
||||
}
|
||||
});
|
||||
|
||||
// Handle closing of connections
|
||||
wsIncoming.on('close', (code, reason) => {
|
||||
this.logger.debug(`WebSocket client connection closed: ${code} ${reason}`);
|
||||
if (wsOutgoing.readyState === wsOutgoing.OPEN) {
|
||||
wsOutgoing.close(code, reason);
|
||||
}
|
||||
});
|
||||
|
||||
wsOutgoing.on('close', (code, reason) => {
|
||||
this.logger.debug(`WebSocket target connection closed: ${code} ${reason}`);
|
||||
if (wsIncoming.readyState === wsIncoming.OPEN) {
|
||||
wsIncoming.close(code, reason);
|
||||
}
|
||||
});
|
||||
|
||||
this.logger.debug(`WebSocket connection established: ${req.headers.host} -> ${destination.host}:${destination.port}`);
|
||||
});
|
||||
|
||||
} catch (error) {
|
||||
this.logger.error(`Error handling WebSocket connection: ${error.message}`);
|
||||
if (wsIncoming.readyState === wsIncoming.OPEN) {
|
||||
wsIncoming.close(1011, 'Internal server error');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get information about active WebSocket connections
|
||||
*/
|
||||
public getConnectionInfo(): { activeConnections: number } {
|
||||
return {
|
||||
activeConnections: this.wsServer ? this.wsServer.clients.size : 0
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Shutdown the WebSocket handler
|
||||
*/
|
||||
public shutdown(): void {
|
||||
// Stop heartbeat interval
|
||||
if (this.heartbeatInterval) {
|
||||
clearInterval(this.heartbeatInterval);
|
||||
this.heartbeatInterval = null;
|
||||
}
|
||||
|
||||
// Close all WebSocket connections
|
||||
if (this.wsServer) {
|
||||
this.logger.info(`Closing ${this.wsServer.clients.size} WebSocket connections`);
|
||||
|
||||
for (const client of this.wsServer.clients) {
|
||||
try {
|
||||
client.terminate();
|
||||
} catch (error) {
|
||||
this.logger.error('Error terminating WebSocket client', error);
|
||||
}
|
||||
}
|
||||
|
||||
// Close the server
|
||||
this.wsServer.close();
|
||||
this.wsServer = null;
|
||||
}
|
||||
}
|
||||
}
|
||||
7
ts/networkproxy/index.ts
Normal file
7
ts/networkproxy/index.ts
Normal file
@ -0,0 +1,7 @@
|
||||
// Re-export all components for easier imports
|
||||
export * from './classes.np.types.js';
|
||||
export * from './classes.np.certificatemanager.js';
|
||||
export * from './classes.np.connectionpool.js';
|
||||
export * from './classes.np.requesthandler.js';
|
||||
export * from './classes.np.websockethandler.js';
|
||||
export * from './classes.np.networkproxy.js';
|
||||
Reference in New Issue
Block a user