update
This commit is contained in:
1240
ts/proxies/smart-proxy/connection-handler.ts
Normal file
1240
ts/proxies/smart-proxy/connection-handler.ts
Normal file
File diff suppressed because it is too large
Load Diff
446
ts/proxies/smart-proxy/connection-manager.ts
Normal file
446
ts/proxies/smart-proxy/connection-manager.ts
Normal file
@ -0,0 +1,446 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { ConnectionRecord, SmartProxyOptions } from './models/interfaces.js';
|
||||
import { SecurityManager } from './security-manager.js';
|
||||
import { TimeoutManager } from './timeout-manager.js';
|
||||
|
||||
/**
|
||||
* Manages connection lifecycle, tracking, and cleanup
|
||||
*/
|
||||
export class ConnectionManager {
|
||||
private connectionRecords: Map<string, ConnectionRecord> = new Map();
|
||||
private terminationStats: {
|
||||
incoming: Record<string, number>;
|
||||
outgoing: Record<string, number>;
|
||||
} = { incoming: {}, outgoing: {} };
|
||||
|
||||
constructor(
|
||||
private settings: SmartProxyOptions,
|
||||
private securityManager: SecurityManager,
|
||||
private timeoutManager: TimeoutManager
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Generate a unique connection ID
|
||||
*/
|
||||
public generateConnectionId(): string {
|
||||
return Math.random().toString(36).substring(2, 15) +
|
||||
Math.random().toString(36).substring(2, 15);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create and track a new connection
|
||||
*/
|
||||
public createConnection(socket: plugins.net.Socket): ConnectionRecord {
|
||||
const connectionId = this.generateConnectionId();
|
||||
const remoteIP = socket.remoteAddress || '';
|
||||
const localPort = socket.localPort || 0;
|
||||
|
||||
const record: ConnectionRecord = {
|
||||
id: connectionId,
|
||||
incoming: socket,
|
||||
outgoing: null,
|
||||
incomingStartTime: Date.now(),
|
||||
lastActivity: Date.now(),
|
||||
connectionClosed: false,
|
||||
pendingData: [],
|
||||
pendingDataSize: 0,
|
||||
bytesReceived: 0,
|
||||
bytesSent: 0,
|
||||
remoteIP,
|
||||
localPort,
|
||||
isTLS: false,
|
||||
tlsHandshakeComplete: false,
|
||||
hasReceivedInitialData: false,
|
||||
hasKeepAlive: false,
|
||||
incomingTerminationReason: null,
|
||||
outgoingTerminationReason: null,
|
||||
usingNetworkProxy: false,
|
||||
isBrowserConnection: false,
|
||||
domainSwitches: 0
|
||||
};
|
||||
|
||||
this.trackConnection(connectionId, record);
|
||||
return record;
|
||||
}
|
||||
|
||||
/**
|
||||
* Track an existing connection
|
||||
*/
|
||||
public trackConnection(connectionId: string, record: ConnectionRecord): void {
|
||||
this.connectionRecords.set(connectionId, record);
|
||||
this.securityManager.trackConnectionByIP(record.remoteIP, connectionId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a connection by ID
|
||||
*/
|
||||
public getConnection(connectionId: string): ConnectionRecord | undefined {
|
||||
return this.connectionRecords.get(connectionId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all active connections
|
||||
*/
|
||||
public getConnections(): Map<string, ConnectionRecord> {
|
||||
return this.connectionRecords;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get count of active connections
|
||||
*/
|
||||
public getConnectionCount(): number {
|
||||
return this.connectionRecords.size;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initiates cleanup once for a connection
|
||||
*/
|
||||
public initiateCleanupOnce(record: ConnectionRecord, reason: string = 'normal'): void {
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${record.id}] Connection cleanup initiated for ${record.remoteIP} (${reason})`);
|
||||
}
|
||||
|
||||
if (
|
||||
record.incomingTerminationReason === null ||
|
||||
record.incomingTerminationReason === undefined
|
||||
) {
|
||||
record.incomingTerminationReason = reason;
|
||||
this.incrementTerminationStat('incoming', reason);
|
||||
}
|
||||
|
||||
this.cleanupConnection(record, reason);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean up a connection record
|
||||
*/
|
||||
public cleanupConnection(record: ConnectionRecord, reason: string = 'normal'): void {
|
||||
if (!record.connectionClosed) {
|
||||
record.connectionClosed = true;
|
||||
|
||||
// Track connection termination
|
||||
this.securityManager.removeConnectionByIP(record.remoteIP, record.id);
|
||||
|
||||
if (record.cleanupTimer) {
|
||||
clearTimeout(record.cleanupTimer);
|
||||
record.cleanupTimer = undefined;
|
||||
}
|
||||
|
||||
// Detailed logging data
|
||||
const duration = Date.now() - record.incomingStartTime;
|
||||
const bytesReceived = record.bytesReceived;
|
||||
const bytesSent = record.bytesSent;
|
||||
|
||||
// Remove all data handlers to make sure we clean up properly
|
||||
if (record.incoming) {
|
||||
try {
|
||||
// Remove our safe data handler
|
||||
record.incoming.removeAllListeners('data');
|
||||
// Reset the handler references
|
||||
record.renegotiationHandler = undefined;
|
||||
} catch (err) {
|
||||
console.log(`[${record.id}] Error removing data handlers: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Handle incoming socket
|
||||
this.cleanupSocket(record, 'incoming', record.incoming);
|
||||
|
||||
// Handle outgoing socket
|
||||
if (record.outgoing) {
|
||||
this.cleanupSocket(record, 'outgoing', record.outgoing);
|
||||
}
|
||||
|
||||
// Clear pendingData to avoid memory leaks
|
||||
record.pendingData = [];
|
||||
record.pendingDataSize = 0;
|
||||
|
||||
// Remove the record from the tracking map
|
||||
this.connectionRecords.delete(record.id);
|
||||
|
||||
// Log connection details
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(
|
||||
`[${record.id}] Connection from ${record.remoteIP} on port ${record.localPort} terminated (${reason}).` +
|
||||
` Duration: ${plugins.prettyMs(duration)}, Bytes IN: ${bytesReceived}, OUT: ${bytesSent}, ` +
|
||||
`TLS: ${record.isTLS ? 'Yes' : 'No'}, Keep-Alive: ${record.hasKeepAlive ? 'Yes' : 'No'}` +
|
||||
`${record.usingNetworkProxy ? ', Using NetworkProxy' : ''}` +
|
||||
`${record.domainSwitches ? `, Domain switches: ${record.domainSwitches}` : ''}`
|
||||
);
|
||||
} else {
|
||||
console.log(
|
||||
`[${record.id}] Connection from ${record.remoteIP} terminated (${reason}). Active connections: ${this.connectionRecords.size}`
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Helper method to clean up a socket
|
||||
*/
|
||||
private cleanupSocket(record: ConnectionRecord, side: 'incoming' | 'outgoing', socket: plugins.net.Socket): void {
|
||||
try {
|
||||
if (!socket.destroyed) {
|
||||
// Try graceful shutdown first, then force destroy after a short timeout
|
||||
socket.end();
|
||||
const socketTimeout = setTimeout(() => {
|
||||
try {
|
||||
if (!socket.destroyed) {
|
||||
socket.destroy();
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`[${record.id}] Error destroying ${side} socket: ${err}`);
|
||||
}
|
||||
}, 1000);
|
||||
|
||||
// Ensure the timeout doesn't block Node from exiting
|
||||
if (socketTimeout.unref) {
|
||||
socketTimeout.unref();
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`[${record.id}] Error closing ${side} socket: ${err}`);
|
||||
try {
|
||||
if (!socket.destroyed) {
|
||||
socket.destroy();
|
||||
}
|
||||
} catch (destroyErr) {
|
||||
console.log(`[${record.id}] Error destroying ${side} socket: ${destroyErr}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a generic error handler for incoming or outgoing sockets
|
||||
*/
|
||||
public handleError(side: 'incoming' | 'outgoing', record: ConnectionRecord) {
|
||||
return (err: Error) => {
|
||||
const code = (err as any).code;
|
||||
let reason = 'error';
|
||||
|
||||
const now = Date.now();
|
||||
const connectionDuration = now - record.incomingStartTime;
|
||||
const lastActivityAge = now - record.lastActivity;
|
||||
|
||||
if (code === 'ECONNRESET') {
|
||||
reason = 'econnreset';
|
||||
console.log(
|
||||
`[${record.id}] ECONNRESET on ${side} side from ${record.remoteIP}: ${err.message}. ` +
|
||||
`Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(lastActivityAge)} ago`
|
||||
);
|
||||
} else if (code === 'ETIMEDOUT') {
|
||||
reason = 'etimedout';
|
||||
console.log(
|
||||
`[${record.id}] ETIMEDOUT on ${side} side from ${record.remoteIP}: ${err.message}. ` +
|
||||
`Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(lastActivityAge)} ago`
|
||||
);
|
||||
} else {
|
||||
console.log(
|
||||
`[${record.id}] Error on ${side} side from ${record.remoteIP}: ${err.message}. ` +
|
||||
`Duration: ${plugins.prettyMs(connectionDuration)}, Last activity: ${plugins.prettyMs(lastActivityAge)} ago`
|
||||
);
|
||||
}
|
||||
|
||||
if (side === 'incoming' && record.incomingTerminationReason === null) {
|
||||
record.incomingTerminationReason = reason;
|
||||
this.incrementTerminationStat('incoming', reason);
|
||||
} else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
|
||||
record.outgoingTerminationReason = reason;
|
||||
this.incrementTerminationStat('outgoing', reason);
|
||||
}
|
||||
|
||||
this.initiateCleanupOnce(record, reason);
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a generic close handler for incoming or outgoing sockets
|
||||
*/
|
||||
public handleClose(side: 'incoming' | 'outgoing', record: ConnectionRecord) {
|
||||
return () => {
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${record.id}] Connection closed on ${side} side from ${record.remoteIP}`);
|
||||
}
|
||||
|
||||
if (side === 'incoming' && record.incomingTerminationReason === null) {
|
||||
record.incomingTerminationReason = 'normal';
|
||||
this.incrementTerminationStat('incoming', 'normal');
|
||||
} else if (side === 'outgoing' && record.outgoingTerminationReason === null) {
|
||||
record.outgoingTerminationReason = 'normal';
|
||||
this.incrementTerminationStat('outgoing', 'normal');
|
||||
// Record the time when outgoing socket closed.
|
||||
record.outgoingClosedTime = Date.now();
|
||||
}
|
||||
|
||||
this.initiateCleanupOnce(record, 'closed_' + side);
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Increment termination statistics
|
||||
*/
|
||||
public incrementTerminationStat(side: 'incoming' | 'outgoing', reason: string): void {
|
||||
this.terminationStats[side][reason] = (this.terminationStats[side][reason] || 0) + 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get termination statistics
|
||||
*/
|
||||
public getTerminationStats(): { incoming: Record<string, number>; outgoing: Record<string, number> } {
|
||||
return this.terminationStats;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check for stalled/inactive connections
|
||||
*/
|
||||
public performInactivityCheck(): void {
|
||||
const now = Date.now();
|
||||
const connectionIds = [...this.connectionRecords.keys()];
|
||||
|
||||
for (const id of connectionIds) {
|
||||
const record = this.connectionRecords.get(id);
|
||||
if (!record) continue;
|
||||
|
||||
// Skip inactivity check if disabled or for immortal keep-alive connections
|
||||
if (
|
||||
this.settings.disableInactivityCheck ||
|
||||
(record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal')
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
|
||||
const inactivityTime = now - record.lastActivity;
|
||||
|
||||
// Use extended timeout for extended-treatment keep-alive connections
|
||||
let effectiveTimeout = this.settings.inactivityTimeout!;
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
|
||||
const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
|
||||
effectiveTimeout = effectiveTimeout * multiplier;
|
||||
}
|
||||
|
||||
if (inactivityTime > effectiveTimeout && !record.connectionClosed) {
|
||||
// For keep-alive connections, issue a warning first
|
||||
if (record.hasKeepAlive && !record.inactivityWarningIssued) {
|
||||
console.log(
|
||||
`[${id}] Warning: Keep-alive connection from ${record.remoteIP} inactive for ${
|
||||
plugins.prettyMs(inactivityTime)
|
||||
}. Will close in 10 minutes if no activity.`
|
||||
);
|
||||
|
||||
// Set warning flag and add grace period
|
||||
record.inactivityWarningIssued = true;
|
||||
record.lastActivity = now - (effectiveTimeout - 600000);
|
||||
|
||||
// Try to stimulate activity with a probe packet
|
||||
if (record.outgoing && !record.outgoing.destroyed) {
|
||||
try {
|
||||
record.outgoing.write(Buffer.alloc(0));
|
||||
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${id}] Sent probe packet to test keep-alive connection`);
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`[${id}] Error sending probe packet: ${err}`);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// For non-keep-alive or after warning, close the connection
|
||||
console.log(
|
||||
`[${id}] Inactivity check: No activity on connection from ${record.remoteIP} ` +
|
||||
`for ${plugins.prettyMs(inactivityTime)}.` +
|
||||
(record.hasKeepAlive ? ' Despite keep-alive being enabled.' : '')
|
||||
);
|
||||
this.cleanupConnection(record, 'inactivity');
|
||||
}
|
||||
} else if (inactivityTime <= effectiveTimeout && record.inactivityWarningIssued) {
|
||||
// If activity detected after warning, clear the warning
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(
|
||||
`[${id}] Connection activity detected after inactivity warning, resetting warning`
|
||||
);
|
||||
}
|
||||
record.inactivityWarningIssued = false;
|
||||
}
|
||||
|
||||
// Parity check: if outgoing socket closed and incoming remains active
|
||||
if (
|
||||
record.outgoingClosedTime &&
|
||||
!record.incoming.destroyed &&
|
||||
!record.connectionClosed &&
|
||||
now - record.outgoingClosedTime > 120000
|
||||
) {
|
||||
console.log(
|
||||
`[${id}] Parity check: Incoming socket for ${record.remoteIP} still active ${
|
||||
plugins.prettyMs(now - record.outgoingClosedTime)
|
||||
} after outgoing closed.`
|
||||
);
|
||||
this.cleanupConnection(record, 'parity_check');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Clear all connections (for shutdown)
|
||||
*/
|
||||
public clearConnections(): void {
|
||||
// Create a copy of the keys to avoid modification during iteration
|
||||
const connectionIds = [...this.connectionRecords.keys()];
|
||||
|
||||
// First pass: End all connections gracefully
|
||||
for (const id of connectionIds) {
|
||||
const record = this.connectionRecords.get(id);
|
||||
if (record) {
|
||||
try {
|
||||
// Clear any timers
|
||||
if (record.cleanupTimer) {
|
||||
clearTimeout(record.cleanupTimer);
|
||||
record.cleanupTimer = undefined;
|
||||
}
|
||||
|
||||
// End sockets gracefully
|
||||
if (record.incoming && !record.incoming.destroyed) {
|
||||
record.incoming.end();
|
||||
}
|
||||
|
||||
if (record.outgoing && !record.outgoing.destroyed) {
|
||||
record.outgoing.end();
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`Error during graceful connection end for ${id}: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Short delay to allow graceful ends to process
|
||||
setTimeout(() => {
|
||||
// Second pass: Force destroy everything
|
||||
for (const id of connectionIds) {
|
||||
const record = this.connectionRecords.get(id);
|
||||
if (record) {
|
||||
try {
|
||||
// Remove all listeners to prevent memory leaks
|
||||
if (record.incoming) {
|
||||
record.incoming.removeAllListeners();
|
||||
if (!record.incoming.destroyed) {
|
||||
record.incoming.destroy();
|
||||
}
|
||||
}
|
||||
|
||||
if (record.outgoing) {
|
||||
record.outgoing.removeAllListeners();
|
||||
if (!record.outgoing.destroyed) {
|
||||
record.outgoing.destroy();
|
||||
}
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`Error during forced connection destruction for ${id}: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Clear all maps
|
||||
this.connectionRecords.clear();
|
||||
this.terminationStats = { incoming: {}, outgoing: {} };
|
||||
}, 100);
|
||||
}
|
||||
}
|
||||
298
ts/proxies/smart-proxy/domain-config-manager.ts
Normal file
298
ts/proxies/smart-proxy/domain-config-manager.ts
Normal file
@ -0,0 +1,298 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { DomainConfig, SmartProxyOptions } from './models/interfaces.js';
|
||||
import type { ForwardingType, ForwardConfig } from '../../forwarding/config/forwarding-types.js';
|
||||
import type { ForwardingHandler } from '../../forwarding/handlers/base-handler.js';
|
||||
import { ForwardingHandlerFactory } from '../../forwarding/factory/forwarding-factory.js';
|
||||
|
||||
/**
|
||||
* Manages domain configurations and target selection
|
||||
*/
|
||||
export class DomainConfigManager {
|
||||
// Track round-robin indices for domain configs
|
||||
private domainTargetIndices: Map<DomainConfig, number> = new Map();
|
||||
|
||||
// Cache forwarding handlers for each domain config
|
||||
private forwardingHandlers: Map<DomainConfig, ForwardingHandler> = new Map();
|
||||
|
||||
constructor(private settings: SmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Updates the domain configurations
|
||||
*/
|
||||
public updateDomainConfigs(newDomainConfigs: DomainConfig[]): void {
|
||||
this.settings.domainConfigs = newDomainConfigs;
|
||||
|
||||
// Reset target indices for removed configs
|
||||
const currentConfigSet = new Set(newDomainConfigs);
|
||||
for (const [config] of this.domainTargetIndices) {
|
||||
if (!currentConfigSet.has(config)) {
|
||||
this.domainTargetIndices.delete(config);
|
||||
}
|
||||
}
|
||||
|
||||
// Clear handlers for removed configs and create handlers for new configs
|
||||
const handlersToRemove: DomainConfig[] = [];
|
||||
for (const [config] of this.forwardingHandlers) {
|
||||
if (!currentConfigSet.has(config)) {
|
||||
handlersToRemove.push(config);
|
||||
}
|
||||
}
|
||||
|
||||
// Remove handlers that are no longer needed
|
||||
for (const config of handlersToRemove) {
|
||||
this.forwardingHandlers.delete(config);
|
||||
}
|
||||
|
||||
// Create handlers for new configs
|
||||
for (const config of newDomainConfigs) {
|
||||
if (!this.forwardingHandlers.has(config)) {
|
||||
try {
|
||||
const handler = this.createForwardingHandler(config);
|
||||
this.forwardingHandlers.set(config, handler);
|
||||
} catch (err) {
|
||||
console.log(`Error creating forwarding handler for domain ${config.domains.join(', ')}: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get all domain configurations
|
||||
*/
|
||||
public getDomainConfigs(): DomainConfig[] {
|
||||
return this.settings.domainConfigs;
|
||||
}
|
||||
|
||||
/**
|
||||
* Find domain config matching a server name
|
||||
*/
|
||||
public findDomainConfig(serverName: string): DomainConfig | undefined {
|
||||
if (!serverName) return undefined;
|
||||
|
||||
return this.settings.domainConfigs.find((config) =>
|
||||
config.domains.some((d) => plugins.minimatch(serverName, d))
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Find domain config for a specific port
|
||||
*/
|
||||
public findDomainConfigForPort(port: number): DomainConfig | undefined {
|
||||
return this.settings.domainConfigs.find(
|
||||
(domain) => {
|
||||
const portRanges = domain.forwarding?.advanced?.portRanges;
|
||||
return portRanges &&
|
||||
portRanges.length > 0 &&
|
||||
this.isPortInRanges(port, portRanges);
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a port is within any of the given ranges
|
||||
*/
|
||||
public isPortInRanges(port: number, ranges: Array<{ from: number; to: number }>): boolean {
|
||||
return ranges.some((range) => port >= range.from && port <= range.to);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get target IP with round-robin support
|
||||
*/
|
||||
public getTargetIP(domainConfig: DomainConfig): string {
|
||||
const targetHosts = Array.isArray(domainConfig.forwarding.target.host)
|
||||
? domainConfig.forwarding.target.host
|
||||
: [domainConfig.forwarding.target.host];
|
||||
|
||||
if (targetHosts.length > 0) {
|
||||
const currentIndex = this.domainTargetIndices.get(domainConfig) || 0;
|
||||
const ip = targetHosts[currentIndex % targetHosts.length];
|
||||
this.domainTargetIndices.set(domainConfig, currentIndex + 1);
|
||||
return ip;
|
||||
}
|
||||
|
||||
return this.settings.targetIP || 'localhost';
|
||||
}
|
||||
|
||||
/**
|
||||
* Get target host with round-robin support (for tests)
|
||||
* This is just an alias for getTargetIP for easier test compatibility
|
||||
*/
|
||||
public getTargetHost(domainConfig: DomainConfig): string {
|
||||
return this.getTargetIP(domainConfig);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get target port from domain config
|
||||
*/
|
||||
public getTargetPort(domainConfig: DomainConfig, defaultPort: number): number {
|
||||
return domainConfig.forwarding.target.port || defaultPort;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if a domain should use NetworkProxy
|
||||
*/
|
||||
public shouldUseNetworkProxy(domainConfig: DomainConfig): boolean {
|
||||
const forwardingType = this.getForwardingType(domainConfig);
|
||||
return forwardingType === 'https-terminate-to-http' ||
|
||||
forwardingType === 'https-terminate-to-https';
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the NetworkProxy port for a domain
|
||||
*/
|
||||
public getNetworkProxyPort(domainConfig: DomainConfig): number | undefined {
|
||||
// First check if we should use NetworkProxy at all
|
||||
if (!this.shouldUseNetworkProxy(domainConfig)) {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
return domainConfig.forwarding.advanced?.networkProxyPort || this.settings.networkProxyPort;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get effective allowed and blocked IPs for a domain
|
||||
*
|
||||
* This method combines domain-specific security rules from the forwarding configuration
|
||||
* with global security defaults when necessary.
|
||||
*/
|
||||
public getEffectiveIPRules(domainConfig: DomainConfig): {
|
||||
allowedIPs: string[],
|
||||
blockedIPs: string[]
|
||||
} {
|
||||
// Start with empty arrays
|
||||
const allowedIPs: string[] = [];
|
||||
const blockedIPs: string[] = [];
|
||||
|
||||
// Add IPs from forwarding security settings if available
|
||||
if (domainConfig.forwarding?.security?.allowedIps) {
|
||||
allowedIPs.push(...domainConfig.forwarding.security.allowedIps);
|
||||
} else {
|
||||
// If no allowed IPs are specified in forwarding config and global defaults exist, use them
|
||||
if (this.settings.defaultAllowedIPs && this.settings.defaultAllowedIPs.length > 0) {
|
||||
allowedIPs.push(...this.settings.defaultAllowedIPs);
|
||||
} else {
|
||||
// Default to allow all if no specific rules
|
||||
allowedIPs.push('*');
|
||||
}
|
||||
}
|
||||
|
||||
// Add blocked IPs from forwarding security settings if available
|
||||
if (domainConfig.forwarding?.security?.blockedIps) {
|
||||
blockedIPs.push(...domainConfig.forwarding.security.blockedIps);
|
||||
}
|
||||
|
||||
// Always add global blocked IPs, even if domain has its own rules
|
||||
// This ensures that global blocks take precedence
|
||||
if (this.settings.defaultBlockedIPs && this.settings.defaultBlockedIPs.length > 0) {
|
||||
// Add only unique IPs that aren't already in the list
|
||||
for (const ip of this.settings.defaultBlockedIPs) {
|
||||
if (!blockedIPs.includes(ip)) {
|
||||
blockedIPs.push(ip);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
allowedIPs,
|
||||
blockedIPs
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Get connection timeout for a domain
|
||||
*/
|
||||
public getConnectionTimeout(domainConfig?: DomainConfig): number {
|
||||
if (domainConfig?.forwarding.advanced?.timeout) {
|
||||
return domainConfig.forwarding.advanced.timeout;
|
||||
}
|
||||
|
||||
return this.settings.maxConnectionLifetime || 86400000; // 24 hours default
|
||||
}
|
||||
|
||||
/**
|
||||
* Creates a forwarding handler for a domain configuration
|
||||
*/
|
||||
private createForwardingHandler(domainConfig: DomainConfig): ForwardingHandler {
|
||||
// Create a new handler using the factory
|
||||
const handler = ForwardingHandlerFactory.createHandler(domainConfig.forwarding);
|
||||
|
||||
// Initialize the handler
|
||||
handler.initialize().catch(err => {
|
||||
console.log(`Error initializing forwarding handler for ${domainConfig.domains.join(', ')}: ${err}`);
|
||||
});
|
||||
|
||||
return handler;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets a forwarding handler for a domain config
|
||||
* If no handler exists, creates one
|
||||
*/
|
||||
public getForwardingHandler(domainConfig: DomainConfig): ForwardingHandler {
|
||||
// If we already have a handler, return it
|
||||
if (this.forwardingHandlers.has(domainConfig)) {
|
||||
return this.forwardingHandlers.get(domainConfig)!;
|
||||
}
|
||||
|
||||
// Otherwise create a new handler
|
||||
const handler = this.createForwardingHandler(domainConfig);
|
||||
this.forwardingHandlers.set(domainConfig, handler);
|
||||
|
||||
return handler;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the forwarding type for a domain config
|
||||
*/
|
||||
public getForwardingType(domainConfig?: DomainConfig): ForwardingType | undefined {
|
||||
if (!domainConfig?.forwarding) return undefined;
|
||||
return domainConfig.forwarding.type;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if the forwarding type requires TLS termination
|
||||
*/
|
||||
public requiresTlsTermination(domainConfig?: DomainConfig): boolean {
|
||||
if (!domainConfig) return false;
|
||||
|
||||
const forwardingType = this.getForwardingType(domainConfig);
|
||||
return forwardingType === 'https-terminate-to-http' ||
|
||||
forwardingType === 'https-terminate-to-https';
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if the forwarding type supports HTTP
|
||||
*/
|
||||
public supportsHttp(domainConfig?: DomainConfig): boolean {
|
||||
if (!domainConfig) return false;
|
||||
|
||||
const forwardingType = this.getForwardingType(domainConfig);
|
||||
|
||||
// HTTP-only always supports HTTP
|
||||
if (forwardingType === 'http-only') return true;
|
||||
|
||||
// For termination types, check the HTTP settings
|
||||
if (forwardingType === 'https-terminate-to-http' ||
|
||||
forwardingType === 'https-terminate-to-https') {
|
||||
// HTTP is supported by default for termination types
|
||||
return domainConfig.forwarding?.http?.enabled !== false;
|
||||
}
|
||||
|
||||
// HTTPS-passthrough doesn't support HTTP
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Checks if HTTP requests should be redirected to HTTPS
|
||||
*/
|
||||
public shouldRedirectToHttps(domainConfig?: DomainConfig): boolean {
|
||||
if (!domainConfig?.forwarding) return false;
|
||||
|
||||
// Only check for redirect if HTTP is enabled
|
||||
if (this.supportsHttp(domainConfig)) {
|
||||
return !!domainConfig.forwarding.http?.redirectToHttps;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
@ -4,5 +4,15 @@
|
||||
// Re-export models
|
||||
export * from './models/index.js';
|
||||
|
||||
// Core SmartProxy will be added later:
|
||||
// export { SmartProxy } from './smart-proxy.js';
|
||||
// Export the main SmartProxy class
|
||||
export { SmartProxy } from './smart-proxy.js';
|
||||
|
||||
// Export supporting classes
|
||||
export { ConnectionManager } from './connection-manager.js';
|
||||
export { SecurityManager } from './security-manager.js';
|
||||
export { DomainConfigManager } from './domain-config-manager.js';
|
||||
export { TimeoutManager } from './timeout-manager.js';
|
||||
export { TlsManager } from './tls-manager.js';
|
||||
export { NetworkProxyBridge } from './network-proxy-bridge.js';
|
||||
export { PortRangeManager } from './port-range-manager.js';
|
||||
export { ConnectionHandler } from './connection-handler.js';
|
||||
|
||||
371
ts/proxies/smart-proxy/network-proxy-bridge.ts
Normal file
371
ts/proxies/smart-proxy/network-proxy-bridge.ts
Normal file
@ -0,0 +1,371 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import { NetworkProxy } from '../network-proxy/index.js';
|
||||
import { Port80Handler } from '../../http/port80/port80-handler.js';
|
||||
import { Port80HandlerEvents } from '../../core/models/common-types.js';
|
||||
import { subscribeToPort80Handler } from '../../core/utils/event-utils.js';
|
||||
import type { CertificateData } from '../../certificate/models/certificate-types.js';
|
||||
import type { ConnectionRecord, SmartProxyOptions, DomainConfig } from './models/interfaces.js';
|
||||
|
||||
/**
|
||||
* Manages NetworkProxy integration for TLS termination
|
||||
*/
|
||||
export class NetworkProxyBridge {
|
||||
private networkProxy: NetworkProxy | null = null;
|
||||
private port80Handler: Port80Handler | null = null;
|
||||
|
||||
constructor(private settings: SmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Set the Port80Handler to use for certificate management
|
||||
*/
|
||||
public setPort80Handler(handler: Port80Handler): void {
|
||||
this.port80Handler = handler;
|
||||
|
||||
// Subscribe to certificate events
|
||||
subscribeToPort80Handler(handler, {
|
||||
onCertificateIssued: this.handleCertificateEvent.bind(this),
|
||||
onCertificateRenewed: this.handleCertificateEvent.bind(this)
|
||||
});
|
||||
|
||||
// If NetworkProxy is already initialized, connect it with Port80Handler
|
||||
if (this.networkProxy) {
|
||||
this.networkProxy.setExternalPort80Handler(handler);
|
||||
}
|
||||
|
||||
console.log('Port80Handler connected to NetworkProxyBridge');
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize NetworkProxy instance
|
||||
*/
|
||||
public async initialize(): Promise<void> {
|
||||
if (!this.networkProxy && this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
|
||||
// Configure NetworkProxy options based on PortProxy settings
|
||||
const networkProxyOptions: any = {
|
||||
port: this.settings.networkProxyPort!,
|
||||
portProxyIntegration: true,
|
||||
logLevel: this.settings.enableDetailedLogging ? 'debug' : 'info',
|
||||
useExternalPort80Handler: !!this.port80Handler // Use Port80Handler if available
|
||||
};
|
||||
|
||||
|
||||
this.networkProxy = new NetworkProxy(networkProxyOptions);
|
||||
|
||||
console.log(`Initialized NetworkProxy on port ${this.settings.networkProxyPort}`);
|
||||
|
||||
// Connect Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
this.networkProxy.setExternalPort80Handler(this.port80Handler);
|
||||
}
|
||||
|
||||
// Convert and apply domain configurations to NetworkProxy
|
||||
await this.syncDomainConfigsToNetworkProxy();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle certificate issuance or renewal events
|
||||
*/
|
||||
private handleCertificateEvent(data: CertificateData): void {
|
||||
if (!this.networkProxy) return;
|
||||
|
||||
console.log(`Received certificate for ${data.domain} from Port80Handler, updating NetworkProxy`);
|
||||
|
||||
try {
|
||||
// Find existing config for this domain
|
||||
const existingConfigs = this.networkProxy.getProxyConfigs()
|
||||
.filter(config => config.hostName === data.domain);
|
||||
|
||||
if (existingConfigs.length > 0) {
|
||||
// Update existing configs with new certificate
|
||||
for (const config of existingConfigs) {
|
||||
config.privateKey = data.privateKey;
|
||||
config.publicKey = data.certificate;
|
||||
}
|
||||
|
||||
// Apply updated configs
|
||||
this.networkProxy.updateProxyConfigs(existingConfigs)
|
||||
.then(() => console.log(`Updated certificate for ${data.domain} in NetworkProxy`))
|
||||
.catch(err => console.log(`Error updating certificate in NetworkProxy: ${err}`));
|
||||
} else {
|
||||
// Create a new config for this domain
|
||||
console.log(`No existing config found for ${data.domain}, creating new config in NetworkProxy`);
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(`Error handling certificate event: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply an external (static) certificate into NetworkProxy
|
||||
*/
|
||||
public applyExternalCertificate(data: CertificateData): void {
|
||||
if (!this.networkProxy) {
|
||||
console.log(`NetworkProxy not initialized: cannot apply external certificate for ${data.domain}`);
|
||||
return;
|
||||
}
|
||||
this.handleCertificateEvent(data);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the NetworkProxy instance
|
||||
*/
|
||||
public getNetworkProxy(): NetworkProxy | null {
|
||||
return this.networkProxy;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the NetworkProxy port
|
||||
*/
|
||||
public getNetworkProxyPort(): number {
|
||||
return this.networkProxy ? this.networkProxy.getListeningPort() : this.settings.networkProxyPort || 8443;
|
||||
}
|
||||
|
||||
/**
|
||||
* Start NetworkProxy
|
||||
*/
|
||||
public async start(): Promise<void> {
|
||||
if (this.networkProxy) {
|
||||
await this.networkProxy.start();
|
||||
console.log(`NetworkProxy started on port ${this.settings.networkProxyPort}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop NetworkProxy
|
||||
*/
|
||||
public async stop(): Promise<void> {
|
||||
if (this.networkProxy) {
|
||||
try {
|
||||
console.log('Stopping NetworkProxy...');
|
||||
await this.networkProxy.stop();
|
||||
console.log('NetworkProxy stopped successfully');
|
||||
} catch (err) {
|
||||
console.log(`Error stopping NetworkProxy: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Register domains with Port80Handler
|
||||
*/
|
||||
public registerDomainsWithPort80Handler(domains: string[]): void {
|
||||
if (!this.port80Handler) {
|
||||
console.log('Cannot register domains - Port80Handler not initialized');
|
||||
return;
|
||||
}
|
||||
|
||||
for (const domain of domains) {
|
||||
// Skip wildcards
|
||||
if (domain.includes('*')) {
|
||||
console.log(`Skipping wildcard domain for ACME: ${domain}`);
|
||||
continue;
|
||||
}
|
||||
|
||||
// Register the domain
|
||||
try {
|
||||
this.port80Handler.addDomain({
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true
|
||||
});
|
||||
|
||||
console.log(`Registered domain with Port80Handler: ${domain}`);
|
||||
} catch (err) {
|
||||
console.log(`Error registering domain ${domain} with Port80Handler: ${err}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Forwards a TLS connection to a NetworkProxy for handling
|
||||
*/
|
||||
public forwardToNetworkProxy(
|
||||
connectionId: string,
|
||||
socket: plugins.net.Socket,
|
||||
record: ConnectionRecord,
|
||||
initialData: Buffer,
|
||||
customProxyPort?: number,
|
||||
onError?: (reason: string) => void
|
||||
): void {
|
||||
// Ensure NetworkProxy is initialized
|
||||
if (!this.networkProxy) {
|
||||
console.log(
|
||||
`[${connectionId}] NetworkProxy not initialized. Cannot forward connection.`
|
||||
);
|
||||
if (onError) {
|
||||
onError('network_proxy_not_initialized');
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Use the custom port if provided, otherwise use the default NetworkProxy port
|
||||
const proxyPort = customProxyPort || this.networkProxy.getListeningPort();
|
||||
const proxyHost = 'localhost'; // Assuming NetworkProxy runs locally
|
||||
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(
|
||||
`[${connectionId}] Forwarding TLS connection to NetworkProxy at ${proxyHost}:${proxyPort}`
|
||||
);
|
||||
}
|
||||
|
||||
// Create a connection to the NetworkProxy
|
||||
const proxySocket = plugins.net.connect({
|
||||
host: proxyHost,
|
||||
port: proxyPort,
|
||||
});
|
||||
|
||||
// Store the outgoing socket in the record
|
||||
record.outgoing = proxySocket;
|
||||
record.outgoingStartTime = Date.now();
|
||||
record.usingNetworkProxy = true;
|
||||
|
||||
// Set up error handlers
|
||||
proxySocket.on('error', (err) => {
|
||||
console.log(`[${connectionId}] Error connecting to NetworkProxy: ${err.message}`);
|
||||
if (onError) {
|
||||
onError('network_proxy_connect_error');
|
||||
}
|
||||
});
|
||||
|
||||
// Handle connection to NetworkProxy
|
||||
proxySocket.on('connect', () => {
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${connectionId}] Connected to NetworkProxy at ${proxyHost}:${proxyPort}`);
|
||||
}
|
||||
|
||||
// First send the initial data that contains the TLS ClientHello
|
||||
proxySocket.write(initialData);
|
||||
|
||||
// Now set up bidirectional piping between client and NetworkProxy
|
||||
socket.pipe(proxySocket);
|
||||
proxySocket.pipe(socket);
|
||||
|
||||
// Update activity on data transfer (caller should handle this)
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`[${connectionId}] TLS connection successfully forwarded to NetworkProxy`);
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Synchronizes domain configurations to NetworkProxy
|
||||
*/
|
||||
public async syncDomainConfigsToNetworkProxy(): Promise<void> {
|
||||
if (!this.networkProxy) {
|
||||
console.log('Cannot sync configurations - NetworkProxy not initialized');
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
// Get SSL certificates from assets
|
||||
// Import fs directly since it's not in plugins
|
||||
const fs = await import('fs');
|
||||
|
||||
let certPair;
|
||||
try {
|
||||
certPair = {
|
||||
key: fs.readFileSync('assets/certs/key.pem', 'utf8'),
|
||||
cert: fs.readFileSync('assets/certs/cert.pem', 'utf8'),
|
||||
};
|
||||
} catch (certError) {
|
||||
console.log(`Warning: Could not read default certificates: ${certError}`);
|
||||
console.log(
|
||||
'Using empty certificate placeholders - ACME will generate proper certificates if enabled'
|
||||
);
|
||||
|
||||
// Use empty placeholders - NetworkProxy will use its internal defaults
|
||||
// or ACME will generate proper ones if enabled
|
||||
certPair = {
|
||||
key: '',
|
||||
cert: '',
|
||||
};
|
||||
}
|
||||
|
||||
// Convert domain configs to NetworkProxy configs
|
||||
const proxyConfigs = this.networkProxy.convertSmartProxyConfigs(
|
||||
this.settings.domainConfigs,
|
||||
certPair
|
||||
);
|
||||
|
||||
// Log ACME-eligible domains
|
||||
const acmeEnabled = !!this.settings.acme?.enabled;
|
||||
if (acmeEnabled) {
|
||||
const acmeEligibleDomains = proxyConfigs
|
||||
.filter((config) => !config.hostName.includes('*')) // Exclude wildcards
|
||||
.map((config) => config.hostName);
|
||||
|
||||
if (acmeEligibleDomains.length > 0) {
|
||||
console.log(`Domains eligible for ACME certificates: ${acmeEligibleDomains.join(', ')}`);
|
||||
|
||||
// Register these domains with Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
this.registerDomainsWithPort80Handler(acmeEligibleDomains);
|
||||
}
|
||||
} else {
|
||||
console.log('No domains eligible for ACME certificates found in configuration');
|
||||
}
|
||||
}
|
||||
|
||||
// Update NetworkProxy with the converted configs
|
||||
await this.networkProxy.updateProxyConfigs(proxyConfigs);
|
||||
console.log(`Successfully synchronized ${proxyConfigs.length} domain configurations to NetworkProxy`);
|
||||
} catch (err) {
|
||||
console.log(`Failed to sync configurations: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Request a certificate for a specific domain
|
||||
*/
|
||||
public async requestCertificate(domain: string): Promise<boolean> {
|
||||
// Delegate to Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
try {
|
||||
// Check if the domain is already registered
|
||||
const cert = this.port80Handler.getCertificate(domain);
|
||||
if (cert) {
|
||||
console.log(`Certificate already exists for ${domain}`);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Register the domain for certificate issuance
|
||||
this.port80Handler.addDomain({
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true
|
||||
});
|
||||
|
||||
console.log(`Domain ${domain} registered for certificate issuance`);
|
||||
return true;
|
||||
} catch (err) {
|
||||
console.log(`Error requesting certificate: ${err}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Fall back to NetworkProxy if Port80Handler is not available
|
||||
if (!this.networkProxy) {
|
||||
console.log('Cannot request certificate - NetworkProxy not initialized');
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!this.settings.acme?.enabled) {
|
||||
console.log('Cannot request certificate - ACME is not enabled');
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
const result = await this.networkProxy.requestCertificate(domain);
|
||||
if (result) {
|
||||
console.log(`Certificate request for ${domain} submitted successfully`);
|
||||
} else {
|
||||
console.log(`Certificate request for ${domain} failed`);
|
||||
}
|
||||
return result;
|
||||
} catch (err) {
|
||||
console.log(`Error requesting certificate: ${err}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
211
ts/proxies/smart-proxy/port-range-manager.ts
Normal file
211
ts/proxies/smart-proxy/port-range-manager.ts
Normal file
@ -0,0 +1,211 @@
|
||||
import type { SmartProxyOptions } from './models/interfaces.js';
|
||||
|
||||
/**
|
||||
* Manages port ranges and port-based configuration
|
||||
*/
|
||||
export class PortRangeManager {
|
||||
constructor(private settings: SmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Get all ports that should be listened on
|
||||
*/
|
||||
public getListeningPorts(): Set<number> {
|
||||
const listeningPorts = new Set<number>();
|
||||
|
||||
// Always include the main fromPort
|
||||
listeningPorts.add(this.settings.fromPort);
|
||||
|
||||
// Add ports from global port ranges if defined
|
||||
if (this.settings.globalPortRanges && this.settings.globalPortRanges.length > 0) {
|
||||
for (const range of this.settings.globalPortRanges) {
|
||||
for (let port = range.from; port <= range.to; port++) {
|
||||
listeningPorts.add(port);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return listeningPorts;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a port should use NetworkProxy for forwarding
|
||||
*/
|
||||
public shouldUseNetworkProxy(port: number): boolean {
|
||||
return !!this.settings.useNetworkProxy && this.settings.useNetworkProxy.includes(port);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if port should use global forwarding
|
||||
*/
|
||||
public shouldUseGlobalForwarding(port: number): boolean {
|
||||
return (
|
||||
!!this.settings.forwardAllGlobalRanges &&
|
||||
this.isPortInGlobalRanges(port)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a port is in global ranges
|
||||
*/
|
||||
public isPortInGlobalRanges(port: number): boolean {
|
||||
return (
|
||||
this.settings.globalPortRanges &&
|
||||
this.isPortInRanges(port, this.settings.globalPortRanges)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a port falls within the specified ranges
|
||||
*/
|
||||
public isPortInRanges(port: number, ranges: Array<{ from: number; to: number }>): boolean {
|
||||
return ranges.some((range) => port >= range.from && port <= range.to);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get forwarding port for a specific listening port
|
||||
* This determines what port to connect to on the target
|
||||
*/
|
||||
public getForwardingPort(listeningPort: number): number {
|
||||
// If using global forwarding, forward to the original port
|
||||
if (this.settings.forwardAllGlobalRanges && this.isPortInGlobalRanges(listeningPort)) {
|
||||
return listeningPort;
|
||||
}
|
||||
|
||||
// Otherwise use the configured toPort
|
||||
return this.settings.toPort;
|
||||
}
|
||||
|
||||
/**
|
||||
* Find domain-specific port ranges that include a given port
|
||||
*/
|
||||
public findDomainPortRange(port: number): {
|
||||
domainIndex: number,
|
||||
range: { from: number, to: number }
|
||||
} | undefined {
|
||||
for (let i = 0; i < this.settings.domainConfigs.length; i++) {
|
||||
const domain = this.settings.domainConfigs[i];
|
||||
// Get port ranges from forwarding.advanced if available
|
||||
const portRanges = domain.forwarding?.advanced?.portRanges;
|
||||
if (portRanges && portRanges.length > 0) {
|
||||
for (const range of portRanges) {
|
||||
if (port >= range.from && port <= range.to) {
|
||||
return { domainIndex: i, range };
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a list of all configured ports
|
||||
* This includes the fromPort, NetworkProxy ports, and ports from all ranges
|
||||
*/
|
||||
public getAllConfiguredPorts(): number[] {
|
||||
const ports = new Set<number>();
|
||||
|
||||
// Add main listening port
|
||||
ports.add(this.settings.fromPort);
|
||||
|
||||
// Add NetworkProxy port if configured
|
||||
if (this.settings.networkProxyPort) {
|
||||
ports.add(this.settings.networkProxyPort);
|
||||
}
|
||||
|
||||
// Add NetworkProxy ports
|
||||
if (this.settings.useNetworkProxy) {
|
||||
for (const port of this.settings.useNetworkProxy) {
|
||||
ports.add(port);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// Add global port ranges
|
||||
if (this.settings.globalPortRanges) {
|
||||
for (const range of this.settings.globalPortRanges) {
|
||||
for (let port = range.from; port <= range.to; port++) {
|
||||
ports.add(port);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Add domain-specific port ranges
|
||||
for (const domain of this.settings.domainConfigs) {
|
||||
// Get port ranges from forwarding.advanced
|
||||
const portRanges = domain.forwarding?.advanced?.portRanges;
|
||||
if (portRanges && portRanges.length > 0) {
|
||||
for (const range of portRanges) {
|
||||
for (let port = range.from; port <= range.to; port++) {
|
||||
ports.add(port);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Add domain-specific NetworkProxy port if configured in forwarding.advanced
|
||||
const networkProxyPort = domain.forwarding?.advanced?.networkProxyPort;
|
||||
if (networkProxyPort) {
|
||||
ports.add(networkProxyPort);
|
||||
}
|
||||
}
|
||||
|
||||
return Array.from(ports);
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate port configuration
|
||||
* Returns array of warning messages
|
||||
*/
|
||||
public validateConfiguration(): string[] {
|
||||
const warnings: string[] = [];
|
||||
|
||||
// Check for overlapping port ranges
|
||||
const portMappings = new Map<number, string[]>();
|
||||
|
||||
// Track global port ranges
|
||||
if (this.settings.globalPortRanges) {
|
||||
for (const range of this.settings.globalPortRanges) {
|
||||
for (let port = range.from; port <= range.to; port++) {
|
||||
if (!portMappings.has(port)) {
|
||||
portMappings.set(port, []);
|
||||
}
|
||||
portMappings.get(port)!.push('Global Port Range');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Track domain-specific port ranges
|
||||
for (const domain of this.settings.domainConfigs) {
|
||||
// Get port ranges from forwarding.advanced
|
||||
const portRanges = domain.forwarding?.advanced?.portRanges;
|
||||
if (portRanges && portRanges.length > 0) {
|
||||
for (const range of portRanges) {
|
||||
for (let port = range.from; port <= range.to; port++) {
|
||||
if (!portMappings.has(port)) {
|
||||
portMappings.set(port, []);
|
||||
}
|
||||
portMappings.get(port)!.push(`Domain: ${domain.domains.join(', ')}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Check for ports with multiple mappings
|
||||
for (const [port, mappings] of portMappings.entries()) {
|
||||
if (mappings.length > 1) {
|
||||
warnings.push(`Port ${port} has multiple mappings: ${mappings.join(', ')}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Check if main ports are used elsewhere
|
||||
if (portMappings.has(this.settings.fromPort) && portMappings.get(this.settings.fromPort)!.length > 0) {
|
||||
warnings.push(`Main listening port ${this.settings.fromPort} is also used in port ranges`);
|
||||
}
|
||||
|
||||
if (this.settings.networkProxyPort && portMappings.has(this.settings.networkProxyPort)) {
|
||||
warnings.push(`NetworkProxy port ${this.settings.networkProxyPort} is also used in port ranges`);
|
||||
}
|
||||
|
||||
|
||||
return warnings;
|
||||
}
|
||||
}
|
||||
171
ts/proxies/smart-proxy/security-manager.ts
Normal file
171
ts/proxies/smart-proxy/security-manager.ts
Normal file
@ -0,0 +1,171 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { SmartProxyOptions } from './models/interfaces.js';
|
||||
|
||||
/**
|
||||
* Handles security aspects like IP tracking, rate limiting, and authorization
|
||||
*/
|
||||
export class SecurityManager {
|
||||
private connectionsByIP: Map<string, Set<string>> = new Map();
|
||||
private connectionRateByIP: Map<string, number[]> = new Map();
|
||||
|
||||
constructor(private settings: SmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Get connections count by IP
|
||||
*/
|
||||
public getConnectionCountByIP(ip: string): number {
|
||||
return this.connectionsByIP.get(ip)?.size || 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check and update connection rate for an IP
|
||||
* @returns true if within rate limit, false if exceeding limit
|
||||
*/
|
||||
public checkConnectionRate(ip: string): boolean {
|
||||
const now = Date.now();
|
||||
const minute = 60 * 1000;
|
||||
|
||||
if (!this.connectionRateByIP.has(ip)) {
|
||||
this.connectionRateByIP.set(ip, [now]);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Get timestamps and filter out entries older than 1 minute
|
||||
const timestamps = this.connectionRateByIP.get(ip)!.filter((time) => now - time < minute);
|
||||
timestamps.push(now);
|
||||
this.connectionRateByIP.set(ip, timestamps);
|
||||
|
||||
// Check if rate exceeds limit
|
||||
return timestamps.length <= this.settings.connectionRateLimitPerMinute!;
|
||||
}
|
||||
|
||||
/**
|
||||
* Track connection by IP
|
||||
*/
|
||||
public trackConnectionByIP(ip: string, connectionId: string): void {
|
||||
if (!this.connectionsByIP.has(ip)) {
|
||||
this.connectionsByIP.set(ip, new Set());
|
||||
}
|
||||
this.connectionsByIP.get(ip)!.add(connectionId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove connection tracking for an IP
|
||||
*/
|
||||
public removeConnectionByIP(ip: string, connectionId: string): void {
|
||||
if (this.connectionsByIP.has(ip)) {
|
||||
const connections = this.connectionsByIP.get(ip)!;
|
||||
connections.delete(connectionId);
|
||||
if (connections.size === 0) {
|
||||
this.connectionsByIP.delete(ip);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if an IP is authorized using forwarding security rules
|
||||
*
|
||||
* This method is used to determine if an IP is allowed to connect, based on security
|
||||
* rules configured in the forwarding configuration. The allowed and blocked IPs are
|
||||
* typically derived from domain.forwarding.security.allowedIps and blockedIps through
|
||||
* DomainConfigManager.getEffectiveIPRules().
|
||||
*
|
||||
* @param ip - The IP address to check
|
||||
* @param allowedIPs - Array of allowed IP patterns from forwarding.security.allowedIps
|
||||
* @param blockedIPs - Array of blocked IP patterns from forwarding.security.blockedIps
|
||||
* @returns true if IP is authorized, false if blocked
|
||||
*/
|
||||
public isIPAuthorized(ip: string, allowedIPs: string[], blockedIPs: string[] = []): boolean {
|
||||
// Skip IP validation if allowedIPs is empty
|
||||
if (!ip || (allowedIPs.length === 0 && blockedIPs.length === 0)) {
|
||||
return true;
|
||||
}
|
||||
|
||||
// First check if IP is blocked - blocked IPs take precedence
|
||||
if (blockedIPs.length > 0 && this.isGlobIPMatch(ip, blockedIPs)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Then check if IP is allowed
|
||||
return this.isGlobIPMatch(ip, allowedIPs);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the IP matches any of the glob patterns from security configuration
|
||||
*
|
||||
* This method checks IP addresses against glob patterns and handles IPv4/IPv6 normalization.
|
||||
* It's used to implement IP filtering based on the forwarding.security configuration.
|
||||
*
|
||||
* @param ip - The IP address to check
|
||||
* @param patterns - Array of glob patterns from forwarding.security.allowedIps or blockedIps
|
||||
* @returns true if IP matches any pattern, false otherwise
|
||||
*/
|
||||
private isGlobIPMatch(ip: string, patterns: string[]): boolean {
|
||||
if (!ip || !patterns || patterns.length === 0) return false;
|
||||
|
||||
// Handle IPv4/IPv6 normalization for proper matching
|
||||
const normalizeIP = (ip: string): string[] => {
|
||||
if (!ip) return [];
|
||||
// Handle IPv4-mapped IPv6 addresses (::ffff:127.0.0.1)
|
||||
if (ip.startsWith('::ffff:')) {
|
||||
const ipv4 = ip.slice(7);
|
||||
return [ip, ipv4];
|
||||
}
|
||||
// Handle IPv4 addresses by also checking IPv4-mapped form
|
||||
if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
|
||||
return [ip, `::ffff:${ip}`];
|
||||
}
|
||||
return [ip];
|
||||
};
|
||||
|
||||
// Normalize the IP being checked
|
||||
const normalizedIPVariants = normalizeIP(ip);
|
||||
if (normalizedIPVariants.length === 0) return false;
|
||||
|
||||
// Normalize the pattern IPs for consistent comparison
|
||||
const expandedPatterns = patterns.flatMap(normalizeIP);
|
||||
|
||||
// Check for any match between normalized IP variants and patterns
|
||||
return normalizedIPVariants.some((ipVariant) =>
|
||||
expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern))
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if IP should be allowed considering connection rate and max connections
|
||||
* @returns Object with result and reason
|
||||
*/
|
||||
public validateIP(ip: string): { allowed: boolean; reason?: string } {
|
||||
// Check connection count limit
|
||||
if (
|
||||
this.settings.maxConnectionsPerIP &&
|
||||
this.getConnectionCountByIP(ip) >= this.settings.maxConnectionsPerIP
|
||||
) {
|
||||
return {
|
||||
allowed: false,
|
||||
reason: `Maximum connections per IP (${this.settings.maxConnectionsPerIP}) exceeded`
|
||||
};
|
||||
}
|
||||
|
||||
// Check connection rate limit
|
||||
if (
|
||||
this.settings.connectionRateLimitPerMinute &&
|
||||
!this.checkConnectionRate(ip)
|
||||
) {
|
||||
return {
|
||||
allowed: false,
|
||||
reason: `Connection rate limit (${this.settings.connectionRateLimitPerMinute}/min) exceeded`
|
||||
};
|
||||
}
|
||||
|
||||
return { allowed: true };
|
||||
}
|
||||
|
||||
/**
|
||||
* Clears all IP tracking data (for shutdown)
|
||||
*/
|
||||
public clearIPTracking(): void {
|
||||
this.connectionsByIP.clear();
|
||||
this.connectionRateByIP.clear();
|
||||
}
|
||||
}
|
||||
656
ts/proxies/smart-proxy/smart-proxy.ts
Normal file
656
ts/proxies/smart-proxy/smart-proxy.ts
Normal file
@ -0,0 +1,656 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
|
||||
// Importing from the new structure
|
||||
import { ConnectionManager } from './connection-manager.js';
|
||||
import { SecurityManager } from './security-manager.js';
|
||||
import { DomainConfigManager } from './domain-config-manager.js';
|
||||
import { TlsManager } from './tls-manager.js';
|
||||
import { NetworkProxyBridge } from './network-proxy-bridge.js';
|
||||
import { TimeoutManager } from './timeout-manager.js';
|
||||
import { PortRangeManager } from './port-range-manager.js';
|
||||
import { ConnectionHandler } from './connection-handler.js';
|
||||
|
||||
// External dependencies from migrated modules
|
||||
import { Port80Handler } from '../../http/port80/port80-handler.js';
|
||||
import { CertProvisioner } from '../../certificate/providers/cert-provisioner.js';
|
||||
import type { CertificateData } from '../../certificate/models/certificate-types.js';
|
||||
import { buildPort80Handler } from '../../certificate/acme/acme-factory.js';
|
||||
import type { ForwardingType } from '../../forwarding/config/forwarding-types.js';
|
||||
import { createPort80HandlerOptions } from '../../common/port80-adapter.js';
|
||||
|
||||
// Import types from models
|
||||
import type { SmartProxyOptions, DomainConfig } from './models/interfaces.js';
|
||||
// Provide backward compatibility types
|
||||
export type { SmartProxyOptions as IPortProxySettings, DomainConfig as IDomainConfig };
|
||||
|
||||
/**
|
||||
* SmartProxy - Main class that coordinates all components
|
||||
*/
|
||||
export class SmartProxy extends plugins.EventEmitter {
|
||||
private netServers: plugins.net.Server[] = [];
|
||||
private connectionLogger: NodeJS.Timeout | null = null;
|
||||
private isShuttingDown: boolean = false;
|
||||
|
||||
// Component managers
|
||||
private connectionManager: ConnectionManager;
|
||||
private securityManager: SecurityManager;
|
||||
public domainConfigManager: DomainConfigManager;
|
||||
private tlsManager: TlsManager;
|
||||
private networkProxyBridge: NetworkProxyBridge;
|
||||
private timeoutManager: TimeoutManager;
|
||||
private portRangeManager: PortRangeManager;
|
||||
private connectionHandler: ConnectionHandler;
|
||||
|
||||
// Port80Handler for ACME certificate management
|
||||
private port80Handler: Port80Handler | null = null;
|
||||
// CertProvisioner for unified certificate workflows
|
||||
private certProvisioner?: CertProvisioner;
|
||||
|
||||
constructor(settingsArg: SmartProxyOptions) {
|
||||
super();
|
||||
// Set reasonable defaults for all settings
|
||||
this.settings = {
|
||||
...settingsArg,
|
||||
targetIP: settingsArg.targetIP || 'localhost',
|
||||
initialDataTimeout: settingsArg.initialDataTimeout || 120000,
|
||||
socketTimeout: settingsArg.socketTimeout || 3600000,
|
||||
inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000,
|
||||
maxConnectionLifetime: settingsArg.maxConnectionLifetime || 86400000,
|
||||
inactivityTimeout: settingsArg.inactivityTimeout || 14400000,
|
||||
gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000,
|
||||
noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
|
||||
keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
|
||||
keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000,
|
||||
maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024,
|
||||
disableInactivityCheck: settingsArg.disableInactivityCheck || false,
|
||||
enableKeepAliveProbes:
|
||||
settingsArg.enableKeepAliveProbes !== undefined ? settingsArg.enableKeepAliveProbes : true,
|
||||
enableDetailedLogging: settingsArg.enableDetailedLogging || false,
|
||||
enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
|
||||
enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
|
||||
allowSessionTicket:
|
||||
settingsArg.allowSessionTicket !== undefined ? settingsArg.allowSessionTicket : true,
|
||||
maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
|
||||
connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
|
||||
keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended',
|
||||
keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6,
|
||||
extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000,
|
||||
networkProxyPort: settingsArg.networkProxyPort || 8443,
|
||||
acme: settingsArg.acme || {},
|
||||
globalPortRanges: settingsArg.globalPortRanges || [],
|
||||
};
|
||||
|
||||
// Set default ACME options if not provided
|
||||
if (!this.settings.acme || Object.keys(this.settings.acme).length === 0) {
|
||||
this.settings.acme = {
|
||||
enabled: false,
|
||||
port: 80,
|
||||
accountEmail: 'admin@example.com',
|
||||
useProduction: false,
|
||||
renewThresholdDays: 30,
|
||||
autoRenew: true,
|
||||
certificateStore: './certs',
|
||||
skipConfiguredCerts: false,
|
||||
httpsRedirectPort: this.settings.fromPort,
|
||||
renewCheckIntervalHours: 24,
|
||||
domainForwards: []
|
||||
};
|
||||
}
|
||||
|
||||
// Initialize component managers
|
||||
this.timeoutManager = new TimeoutManager(this.settings);
|
||||
this.securityManager = new SecurityManager(this.settings);
|
||||
this.connectionManager = new ConnectionManager(
|
||||
this.settings,
|
||||
this.securityManager,
|
||||
this.timeoutManager
|
||||
);
|
||||
this.domainConfigManager = new DomainConfigManager(this.settings);
|
||||
this.tlsManager = new TlsManager(this.settings);
|
||||
this.networkProxyBridge = new NetworkProxyBridge(this.settings);
|
||||
this.portRangeManager = new PortRangeManager(this.settings);
|
||||
|
||||
// Initialize connection handler
|
||||
this.connectionHandler = new ConnectionHandler(
|
||||
this.settings,
|
||||
this.connectionManager,
|
||||
this.securityManager,
|
||||
this.domainConfigManager,
|
||||
this.tlsManager,
|
||||
this.networkProxyBridge,
|
||||
this.timeoutManager,
|
||||
this.portRangeManager
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* The settings for the port proxy
|
||||
*/
|
||||
public settings: SmartProxyOptions;
|
||||
|
||||
/**
|
||||
* Initialize the Port80Handler for ACME certificate management
|
||||
*/
|
||||
private async initializePort80Handler(): Promise<void> {
|
||||
const config = this.settings.acme!;
|
||||
if (!config.enabled) {
|
||||
console.log('ACME is disabled in configuration');
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
// Build and start the Port80Handler
|
||||
this.port80Handler = buildPort80Handler({
|
||||
...config,
|
||||
httpsRedirectPort: config.httpsRedirectPort || this.settings.fromPort
|
||||
});
|
||||
// Share Port80Handler with NetworkProxyBridge before start
|
||||
this.networkProxyBridge.setPort80Handler(this.port80Handler);
|
||||
await this.port80Handler.start();
|
||||
console.log(`Port80Handler started on port ${config.port}`);
|
||||
} catch (err) {
|
||||
console.log(`Error initializing Port80Handler: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Start the proxy server
|
||||
*/
|
||||
public async start() {
|
||||
// Don't start if already shutting down
|
||||
if (this.isShuttingDown) {
|
||||
console.log("Cannot start SmartProxy while it's shutting down");
|
||||
return;
|
||||
}
|
||||
|
||||
// Process domain configs
|
||||
// Note: ensureForwardingConfig is no longer needed since forwarding is now required
|
||||
|
||||
// Initialize domain config manager with the processed configs
|
||||
this.domainConfigManager.updateDomainConfigs(this.settings.domainConfigs);
|
||||
|
||||
// Initialize Port80Handler if enabled
|
||||
await this.initializePort80Handler();
|
||||
|
||||
// Initialize CertProvisioner for unified certificate workflows
|
||||
if (this.port80Handler) {
|
||||
const acme = this.settings.acme!;
|
||||
|
||||
// Convert domain forwards to use the new forwarding system if possible
|
||||
const domainForwards = acme.domainForwards?.map(f => {
|
||||
// If the domain has a forwarding config in domainConfigs, use that
|
||||
const domainConfig = this.settings.domainConfigs.find(
|
||||
dc => dc.domains.some(d => d === f.domain)
|
||||
);
|
||||
|
||||
if (domainConfig?.forwarding) {
|
||||
return {
|
||||
domain: f.domain,
|
||||
forwardConfig: f.forwardConfig,
|
||||
acmeForwardConfig: f.acmeForwardConfig,
|
||||
sslRedirect: f.sslRedirect || domainConfig.forwarding.http?.redirectToHttps || false
|
||||
};
|
||||
}
|
||||
|
||||
// Otherwise use the existing configuration
|
||||
return {
|
||||
domain: f.domain,
|
||||
forwardConfig: f.forwardConfig,
|
||||
acmeForwardConfig: f.acmeForwardConfig,
|
||||
sslRedirect: f.sslRedirect || false
|
||||
};
|
||||
}) || [];
|
||||
|
||||
this.certProvisioner = new CertProvisioner(
|
||||
this.settings.domainConfigs,
|
||||
this.port80Handler,
|
||||
this.networkProxyBridge,
|
||||
this.settings.certProvisionFunction,
|
||||
acme.renewThresholdDays!,
|
||||
acme.renewCheckIntervalHours!,
|
||||
acme.autoRenew!,
|
||||
domainForwards
|
||||
);
|
||||
|
||||
this.certProvisioner.on('certificate', (certData) => {
|
||||
this.emit('certificate', {
|
||||
domain: certData.domain,
|
||||
publicKey: certData.certificate,
|
||||
privateKey: certData.privateKey,
|
||||
expiryDate: certData.expiryDate,
|
||||
source: certData.source,
|
||||
isRenewal: certData.isRenewal
|
||||
});
|
||||
});
|
||||
|
||||
await this.certProvisioner.start();
|
||||
console.log('CertProvisioner started');
|
||||
}
|
||||
|
||||
// Initialize and start NetworkProxy if needed
|
||||
if (
|
||||
this.settings.useNetworkProxy &&
|
||||
this.settings.useNetworkProxy.length > 0
|
||||
) {
|
||||
await this.networkProxyBridge.initialize();
|
||||
await this.networkProxyBridge.start();
|
||||
}
|
||||
|
||||
// Validate port configuration
|
||||
const configWarnings = this.portRangeManager.validateConfiguration();
|
||||
if (configWarnings.length > 0) {
|
||||
console.log("Port configuration warnings:");
|
||||
for (const warning of configWarnings) {
|
||||
console.log(` - ${warning}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Get listening ports from PortRangeManager
|
||||
const listeningPorts = this.portRangeManager.getListeningPorts();
|
||||
|
||||
// Create servers for each port
|
||||
for (const port of listeningPorts) {
|
||||
const server = plugins.net.createServer((socket) => {
|
||||
// Check if shutting down
|
||||
if (this.isShuttingDown) {
|
||||
socket.end();
|
||||
socket.destroy();
|
||||
return;
|
||||
}
|
||||
|
||||
// Delegate to connection handler
|
||||
this.connectionHandler.handleConnection(socket);
|
||||
}).on('error', (err: Error) => {
|
||||
console.log(`Server Error on port ${port}: ${err.message}`);
|
||||
});
|
||||
|
||||
server.listen(port, () => {
|
||||
const isNetworkProxyPort = this.settings.useNetworkProxy?.includes(port);
|
||||
console.log(
|
||||
`SmartProxy -> OK: Now listening on port ${port}${
|
||||
this.settings.sniEnabled && !isNetworkProxyPort ? ' (SNI passthrough enabled)' : ''
|
||||
}${isNetworkProxyPort ? ' (NetworkProxy forwarding enabled)' : ''}`
|
||||
);
|
||||
});
|
||||
|
||||
this.netServers.push(server);
|
||||
}
|
||||
|
||||
// Set up periodic connection logging and inactivity checks
|
||||
this.connectionLogger = setInterval(() => {
|
||||
// Immediately return if shutting down
|
||||
if (this.isShuttingDown) return;
|
||||
|
||||
// Perform inactivity check
|
||||
this.connectionManager.performInactivityCheck();
|
||||
|
||||
// Log connection statistics
|
||||
const now = Date.now();
|
||||
let maxIncoming = 0;
|
||||
let maxOutgoing = 0;
|
||||
let tlsConnections = 0;
|
||||
let nonTlsConnections = 0;
|
||||
let completedTlsHandshakes = 0;
|
||||
let pendingTlsHandshakes = 0;
|
||||
let keepAliveConnections = 0;
|
||||
let networkProxyConnections = 0;
|
||||
|
||||
// Get connection records for analysis
|
||||
const connectionRecords = this.connectionManager.getConnections();
|
||||
|
||||
// Analyze active connections
|
||||
for (const record of connectionRecords.values()) {
|
||||
// Track connection stats
|
||||
if (record.isTLS) {
|
||||
tlsConnections++;
|
||||
if (record.tlsHandshakeComplete) {
|
||||
completedTlsHandshakes++;
|
||||
} else {
|
||||
pendingTlsHandshakes++;
|
||||
}
|
||||
} else {
|
||||
nonTlsConnections++;
|
||||
}
|
||||
|
||||
if (record.hasKeepAlive) {
|
||||
keepAliveConnections++;
|
||||
}
|
||||
|
||||
if (record.usingNetworkProxy) {
|
||||
networkProxyConnections++;
|
||||
}
|
||||
|
||||
maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
|
||||
if (record.outgoingStartTime) {
|
||||
maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
|
||||
}
|
||||
}
|
||||
|
||||
// Get termination stats
|
||||
const terminationStats = this.connectionManager.getTerminationStats();
|
||||
|
||||
// Log detailed stats
|
||||
console.log(
|
||||
`Active connections: ${connectionRecords.size}. ` +
|
||||
`Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
|
||||
`Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}. ` +
|
||||
`Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(maxOutgoing)}. ` +
|
||||
`Termination stats: ${JSON.stringify({
|
||||
IN: terminationStats.incoming,
|
||||
OUT: terminationStats.outgoing,
|
||||
})}`
|
||||
);
|
||||
}, this.settings.inactivityCheckInterval || 60000);
|
||||
|
||||
// Make sure the interval doesn't keep the process alive
|
||||
if (this.connectionLogger.unref) {
|
||||
this.connectionLogger.unref();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Stop the proxy server
|
||||
*/
|
||||
public async stop() {
|
||||
console.log('SmartProxy shutting down...');
|
||||
this.isShuttingDown = true;
|
||||
// Stop CertProvisioner if active
|
||||
if (this.certProvisioner) {
|
||||
await this.certProvisioner.stop();
|
||||
console.log('CertProvisioner stopped');
|
||||
}
|
||||
|
||||
// Stop the Port80Handler if running
|
||||
if (this.port80Handler) {
|
||||
try {
|
||||
await this.port80Handler.stop();
|
||||
console.log('Port80Handler stopped');
|
||||
this.port80Handler = null;
|
||||
} catch (err) {
|
||||
console.log(`Error stopping Port80Handler: ${err}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Stop accepting new connections
|
||||
const closeServerPromises: Promise<void>[] = this.netServers.map(
|
||||
(server) =>
|
||||
new Promise<void>((resolve) => {
|
||||
if (!server.listening) {
|
||||
resolve();
|
||||
return;
|
||||
}
|
||||
server.close((err) => {
|
||||
if (err) {
|
||||
console.log(`Error closing server: ${err.message}`);
|
||||
}
|
||||
resolve();
|
||||
});
|
||||
})
|
||||
);
|
||||
|
||||
// Stop the connection logger
|
||||
if (this.connectionLogger) {
|
||||
clearInterval(this.connectionLogger);
|
||||
this.connectionLogger = null;
|
||||
}
|
||||
|
||||
// Wait for servers to close
|
||||
await Promise.all(closeServerPromises);
|
||||
console.log('All servers closed. Cleaning up active connections...');
|
||||
|
||||
// Clean up all active connections
|
||||
this.connectionManager.clearConnections();
|
||||
|
||||
// Stop NetworkProxy
|
||||
await this.networkProxyBridge.stop();
|
||||
|
||||
// Clear all servers
|
||||
this.netServers = [];
|
||||
|
||||
console.log('SmartProxy shutdown complete.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Updates the domain configurations for the proxy
|
||||
*/
|
||||
public async updateDomainConfigs(newDomainConfigs: DomainConfig[]): Promise<void> {
|
||||
console.log(`Updating domain configurations (${newDomainConfigs.length} configs)`);
|
||||
|
||||
// Update domain configs in DomainConfigManager
|
||||
this.domainConfigManager.updateDomainConfigs(newDomainConfigs);
|
||||
|
||||
// If NetworkProxy is initialized, resync the configurations
|
||||
if (this.networkProxyBridge.getNetworkProxy()) {
|
||||
await this.networkProxyBridge.syncDomainConfigsToNetworkProxy();
|
||||
}
|
||||
|
||||
// If Port80Handler is running, provision certificates based on forwarding type
|
||||
if (this.port80Handler && this.settings.acme?.enabled) {
|
||||
for (const domainConfig of newDomainConfigs) {
|
||||
// Skip certificate provisioning for http-only or passthrough configs that don't need certs
|
||||
const forwardingType = domainConfig.forwarding.type;
|
||||
const needsCertificate =
|
||||
forwardingType === 'https-terminate-to-http' ||
|
||||
forwardingType === 'https-terminate-to-https';
|
||||
|
||||
// Skip certificate provisioning if ACME is explicitly disabled for this domain
|
||||
const acmeDisabled = domainConfig.forwarding.acme?.enabled === false;
|
||||
|
||||
if (!needsCertificate || acmeDisabled) {
|
||||
if (this.settings.enableDetailedLogging) {
|
||||
console.log(`Skipping certificate provisioning for ${domainConfig.domains.join(', ')} (${forwardingType})`);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
|
||||
for (const domain of domainConfig.domains) {
|
||||
const isWildcard = domain.includes('*');
|
||||
let provision: string | plugins.tsclass.network.ICert = 'http01';
|
||||
|
||||
// Check for ACME forwarding configuration in the domain
|
||||
const forwardAcmeChallenges = domainConfig.forwarding.acme?.forwardChallenges;
|
||||
|
||||
if (this.settings.certProvisionFunction) {
|
||||
try {
|
||||
provision = await this.settings.certProvisionFunction(domain);
|
||||
} catch (err) {
|
||||
console.log(`certProvider error for ${domain}: ${err}`);
|
||||
}
|
||||
} else if (isWildcard) {
|
||||
console.warn(`Skipping wildcard domain without certProvisionFunction: ${domain}`);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (provision === 'http01') {
|
||||
if (isWildcard) {
|
||||
console.warn(`Skipping HTTP-01 for wildcard domain: ${domain}`);
|
||||
continue;
|
||||
}
|
||||
|
||||
// Create Port80Handler options from the forwarding configuration
|
||||
const port80Config = createPort80HandlerOptions(domain, domainConfig.forwarding);
|
||||
|
||||
this.port80Handler.addDomain(port80Config);
|
||||
console.log(`Registered domain ${domain} with Port80Handler for HTTP-01`);
|
||||
} else {
|
||||
// Static certificate (e.g., DNS-01 provisioned) supports wildcards
|
||||
const certObj = provision as plugins.tsclass.network.ICert;
|
||||
const certData: CertificateData = {
|
||||
domain: certObj.domainName,
|
||||
certificate: certObj.publicKey,
|
||||
privateKey: certObj.privateKey,
|
||||
expiryDate: new Date(certObj.validUntil)
|
||||
};
|
||||
this.networkProxyBridge.applyExternalCertificate(certData);
|
||||
console.log(`Applied static certificate for ${domain} from certProvider`);
|
||||
}
|
||||
}
|
||||
}
|
||||
console.log('Provisioned certificates for new domains');
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Request a certificate for a specific domain
|
||||
*/
|
||||
public async requestCertificate(domain: string): Promise<boolean> {
|
||||
// Validate domain format
|
||||
if (!this.isValidDomain(domain)) {
|
||||
console.log(`Invalid domain format: ${domain}`);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Use Port80Handler if available
|
||||
if (this.port80Handler) {
|
||||
try {
|
||||
// Check if we already have a certificate
|
||||
const cert = this.port80Handler.getCertificate(domain);
|
||||
if (cert) {
|
||||
console.log(`Certificate already exists for ${domain}, valid until ${cert.expiryDate.toISOString()}`);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Register domain for certificate issuance
|
||||
this.port80Handler.addDomain({
|
||||
domainName: domain,
|
||||
sslRedirect: true,
|
||||
acmeMaintenance: true
|
||||
});
|
||||
|
||||
console.log(`Domain ${domain} registered for certificate issuance`);
|
||||
return true;
|
||||
} catch (err) {
|
||||
console.log(`Error registering domain with Port80Handler: ${err}`);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
// Fall back to NetworkProxyBridge
|
||||
return this.networkProxyBridge.requestCertificate(domain);
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates if a domain name is valid for certificate issuance
|
||||
*/
|
||||
private isValidDomain(domain: string): boolean {
|
||||
// Very basic domain validation
|
||||
if (!domain || domain.length === 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Check for wildcard domains (they can't get ACME certs)
|
||||
if (domain.includes('*')) {
|
||||
console.log(`Wildcard domains like "${domain}" are not supported for ACME certificates`);
|
||||
return false;
|
||||
}
|
||||
|
||||
// Check if domain has at least one dot and no invalid characters
|
||||
const validDomainRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
|
||||
if (!validDomainRegex.test(domain)) {
|
||||
console.log(`Domain "${domain}" has invalid format`);
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get statistics about current connections
|
||||
*/
|
||||
public getStatistics(): any {
|
||||
const connectionRecords = this.connectionManager.getConnections();
|
||||
const terminationStats = this.connectionManager.getTerminationStats();
|
||||
|
||||
let tlsConnections = 0;
|
||||
let nonTlsConnections = 0;
|
||||
let keepAliveConnections = 0;
|
||||
let networkProxyConnections = 0;
|
||||
|
||||
// Analyze active connections
|
||||
for (const record of connectionRecords.values()) {
|
||||
if (record.isTLS) tlsConnections++;
|
||||
else nonTlsConnections++;
|
||||
if (record.hasKeepAlive) keepAliveConnections++;
|
||||
if (record.usingNetworkProxy) networkProxyConnections++;
|
||||
}
|
||||
|
||||
return {
|
||||
activeConnections: connectionRecords.size,
|
||||
tlsConnections,
|
||||
nonTlsConnections,
|
||||
keepAliveConnections,
|
||||
networkProxyConnections,
|
||||
terminationStats,
|
||||
acmeEnabled: !!this.port80Handler,
|
||||
port80HandlerPort: this.port80Handler ? this.settings.acme?.port : null
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a list of eligible domains for ACME certificates
|
||||
*/
|
||||
public getEligibleDomainsForCertificates(): string[] {
|
||||
// Collect all non-wildcard domains from domain configs
|
||||
const domains: string[] = [];
|
||||
|
||||
for (const config of this.settings.domainConfigs) {
|
||||
// Skip domains that can't be used with ACME
|
||||
const eligibleDomains = config.domains.filter(domain =>
|
||||
!domain.includes('*') && this.isValidDomain(domain)
|
||||
);
|
||||
|
||||
domains.push(...eligibleDomains);
|
||||
}
|
||||
|
||||
return domains;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get status of certificates managed by Port80Handler
|
||||
*/
|
||||
public getCertificateStatus(): any {
|
||||
if (!this.port80Handler) {
|
||||
return {
|
||||
enabled: false,
|
||||
message: 'Port80Handler is not enabled'
|
||||
};
|
||||
}
|
||||
|
||||
// Get eligible domains
|
||||
const eligibleDomains = this.getEligibleDomainsForCertificates();
|
||||
const certificateStatus: Record<string, any> = {};
|
||||
|
||||
// Check each domain
|
||||
for (const domain of eligibleDomains) {
|
||||
const cert = this.port80Handler.getCertificate(domain);
|
||||
|
||||
if (cert) {
|
||||
const now = new Date();
|
||||
const expiryDate = cert.expiryDate;
|
||||
const daysRemaining = Math.floor((expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000));
|
||||
|
||||
certificateStatus[domain] = {
|
||||
status: 'valid',
|
||||
expiryDate: expiryDate.toISOString(),
|
||||
daysRemaining,
|
||||
renewalNeeded: daysRemaining <= (this.settings.acme?.renewThresholdDays ?? 0)
|
||||
};
|
||||
} else {
|
||||
certificateStatus[domain] = {
|
||||
status: 'missing',
|
||||
message: 'No certificate found'
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
const acme = this.settings.acme!;
|
||||
return {
|
||||
enabled: true,
|
||||
port: acme.port!,
|
||||
useProduction: acme.useProduction!,
|
||||
autoRenew: acme.autoRenew!,
|
||||
certificates: certificateStatus
|
||||
};
|
||||
}
|
||||
}
|
||||
190
ts/proxies/smart-proxy/timeout-manager.ts
Normal file
190
ts/proxies/smart-proxy/timeout-manager.ts
Normal file
@ -0,0 +1,190 @@
|
||||
import type { ConnectionRecord, SmartProxyOptions } from './models/interfaces.js';
|
||||
|
||||
/**
|
||||
* Manages timeouts and inactivity tracking for connections
|
||||
*/
|
||||
export class TimeoutManager {
|
||||
constructor(private settings: SmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Ensure timeout values don't exceed Node.js max safe integer
|
||||
*/
|
||||
public ensureSafeTimeout(timeout: number): number {
|
||||
const MAX_SAFE_TIMEOUT = 2147483647; // Maximum safe value (2^31 - 1)
|
||||
return Math.min(Math.floor(timeout), MAX_SAFE_TIMEOUT);
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a slightly randomized timeout to prevent thundering herd
|
||||
*/
|
||||
public randomizeTimeout(baseTimeout: number, variationPercent: number = 5): number {
|
||||
const safeBaseTimeout = this.ensureSafeTimeout(baseTimeout);
|
||||
const variation = safeBaseTimeout * (variationPercent / 100);
|
||||
return this.ensureSafeTimeout(
|
||||
safeBaseTimeout + Math.floor(Math.random() * variation * 2) - variation
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update connection activity timestamp
|
||||
*/
|
||||
public updateActivity(record: ConnectionRecord): void {
|
||||
record.lastActivity = Date.now();
|
||||
|
||||
// Clear any inactivity warning
|
||||
if (record.inactivityWarningIssued) {
|
||||
record.inactivityWarningIssued = false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculate effective inactivity timeout based on connection type
|
||||
*/
|
||||
public getEffectiveInactivityTimeout(record: ConnectionRecord): number {
|
||||
let effectiveTimeout = this.settings.inactivityTimeout || 14400000; // 4 hours default
|
||||
|
||||
// For immortal keep-alive connections, use an extremely long timeout
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
|
||||
return Number.MAX_SAFE_INTEGER;
|
||||
}
|
||||
|
||||
// For extended keep-alive connections, apply multiplier
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
|
||||
const multiplier = this.settings.keepAliveInactivityMultiplier || 6;
|
||||
effectiveTimeout = effectiveTimeout * multiplier;
|
||||
}
|
||||
|
||||
return this.ensureSafeTimeout(effectiveTimeout);
|
||||
}
|
||||
|
||||
/**
|
||||
* Calculate effective max lifetime based on connection type
|
||||
*/
|
||||
public getEffectiveMaxLifetime(record: ConnectionRecord): number {
|
||||
// Use domain-specific timeout from forwarding.advanced if available
|
||||
const baseTimeout = record.domainConfig?.forwarding?.advanced?.timeout ||
|
||||
this.settings.maxConnectionLifetime ||
|
||||
86400000; // 24 hours default
|
||||
|
||||
// For immortal keep-alive connections, use an extremely long lifetime
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
|
||||
return Number.MAX_SAFE_INTEGER;
|
||||
}
|
||||
|
||||
// For extended keep-alive connections, use the extended lifetime setting
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'extended') {
|
||||
return this.ensureSafeTimeout(
|
||||
this.settings.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000 // 7 days default
|
||||
);
|
||||
}
|
||||
|
||||
// Apply randomization if enabled
|
||||
if (this.settings.enableRandomizedTimeouts) {
|
||||
return this.randomizeTimeout(baseTimeout);
|
||||
}
|
||||
|
||||
return this.ensureSafeTimeout(baseTimeout);
|
||||
}
|
||||
|
||||
/**
|
||||
* Setup connection timeout
|
||||
* @returns The cleanup timer
|
||||
*/
|
||||
public setupConnectionTimeout(
|
||||
record: ConnectionRecord,
|
||||
onTimeout: (record: ConnectionRecord, reason: string) => void
|
||||
): NodeJS.Timeout {
|
||||
// Clear any existing timer
|
||||
if (record.cleanupTimer) {
|
||||
clearTimeout(record.cleanupTimer);
|
||||
}
|
||||
|
||||
// Calculate effective timeout
|
||||
const effectiveLifetime = this.getEffectiveMaxLifetime(record);
|
||||
|
||||
// Set up the timeout
|
||||
const timer = setTimeout(() => {
|
||||
// Call the provided callback
|
||||
onTimeout(record, 'connection_timeout');
|
||||
}, effectiveLifetime);
|
||||
|
||||
// Make sure timeout doesn't keep the process alive
|
||||
if (timer.unref) {
|
||||
timer.unref();
|
||||
}
|
||||
|
||||
return timer;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check for inactivity on a connection
|
||||
* @returns Object with check results
|
||||
*/
|
||||
public checkInactivity(record: ConnectionRecord): {
|
||||
isInactive: boolean;
|
||||
shouldWarn: boolean;
|
||||
inactivityTime: number;
|
||||
effectiveTimeout: number;
|
||||
} {
|
||||
// Skip for connections with inactivity check disabled
|
||||
if (this.settings.disableInactivityCheck) {
|
||||
return {
|
||||
isInactive: false,
|
||||
shouldWarn: false,
|
||||
inactivityTime: 0,
|
||||
effectiveTimeout: 0
|
||||
};
|
||||
}
|
||||
|
||||
// Skip for immortal keep-alive connections
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
|
||||
return {
|
||||
isInactive: false,
|
||||
shouldWarn: false,
|
||||
inactivityTime: 0,
|
||||
effectiveTimeout: 0
|
||||
};
|
||||
}
|
||||
|
||||
const now = Date.now();
|
||||
const inactivityTime = now - record.lastActivity;
|
||||
const effectiveTimeout = this.getEffectiveInactivityTimeout(record);
|
||||
|
||||
// Check if inactive
|
||||
const isInactive = inactivityTime > effectiveTimeout;
|
||||
|
||||
// For keep-alive connections, we should warn first
|
||||
const shouldWarn = record.hasKeepAlive &&
|
||||
isInactive &&
|
||||
!record.inactivityWarningIssued;
|
||||
|
||||
return {
|
||||
isInactive,
|
||||
shouldWarn,
|
||||
inactivityTime,
|
||||
effectiveTimeout
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Apply socket timeout settings
|
||||
*/
|
||||
public applySocketTimeouts(record: ConnectionRecord): void {
|
||||
// Skip for immortal keep-alive connections
|
||||
if (record.hasKeepAlive && this.settings.keepAliveTreatment === 'immortal') {
|
||||
// Disable timeouts completely for immortal connections
|
||||
record.incoming.setTimeout(0);
|
||||
if (record.outgoing) {
|
||||
record.outgoing.setTimeout(0);
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
// Apply normal timeouts
|
||||
const timeout = this.ensureSafeTimeout(this.settings.socketTimeout || 3600000); // 1 hour default
|
||||
record.incoming.setTimeout(timeout);
|
||||
if (record.outgoing) {
|
||||
record.outgoing.setTimeout(timeout);
|
||||
}
|
||||
}
|
||||
}
|
||||
206
ts/proxies/smart-proxy/tls-manager.ts
Normal file
206
ts/proxies/smart-proxy/tls-manager.ts
Normal file
@ -0,0 +1,206 @@
|
||||
import * as plugins from '../../plugins.js';
|
||||
import type { SmartProxyOptions } from './models/interfaces.js';
|
||||
import { SniHandler } from '../../tls/sni/sni-handler.js';
|
||||
|
||||
/**
|
||||
* Interface for connection information used for SNI extraction
|
||||
*/
|
||||
interface IConnectionInfo {
|
||||
sourceIp: string;
|
||||
sourcePort: number;
|
||||
destIp: string;
|
||||
destPort: number;
|
||||
}
|
||||
|
||||
/**
|
||||
* Manages TLS-related operations including SNI extraction and validation
|
||||
*/
|
||||
export class TlsManager {
|
||||
constructor(private settings: SmartProxyOptions) {}
|
||||
|
||||
/**
|
||||
* Check if a data chunk appears to be a TLS handshake
|
||||
*/
|
||||
public isTlsHandshake(chunk: Buffer): boolean {
|
||||
return SniHandler.isTlsHandshake(chunk);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a data chunk appears to be a TLS ClientHello
|
||||
*/
|
||||
public isClientHello(chunk: Buffer): boolean {
|
||||
return SniHandler.isClientHello(chunk);
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract Server Name Indication (SNI) from TLS handshake
|
||||
*/
|
||||
public extractSNI(
|
||||
chunk: Buffer,
|
||||
connInfo: IConnectionInfo,
|
||||
previousDomain?: string
|
||||
): string | undefined {
|
||||
// Use the SniHandler to process the TLS packet
|
||||
return SniHandler.processTlsPacket(
|
||||
chunk,
|
||||
connInfo,
|
||||
this.settings.enableTlsDebugLogging || false,
|
||||
previousDomain
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle session resumption attempts
|
||||
*/
|
||||
public handleSessionResumption(
|
||||
chunk: Buffer,
|
||||
connectionId: string,
|
||||
hasSNI: boolean
|
||||
): { shouldBlock: boolean; reason?: string } {
|
||||
// Skip if session tickets are allowed
|
||||
if (this.settings.allowSessionTicket !== false) {
|
||||
return { shouldBlock: false };
|
||||
}
|
||||
|
||||
// Check for session resumption attempt
|
||||
const resumptionInfo = SniHandler.hasSessionResumption(
|
||||
chunk,
|
||||
this.settings.enableTlsDebugLogging || false
|
||||
);
|
||||
|
||||
// If this is a resumption attempt without SNI, block it
|
||||
if (resumptionInfo.isResumption && !hasSNI && !resumptionInfo.hasSNI) {
|
||||
if (this.settings.enableTlsDebugLogging) {
|
||||
console.log(
|
||||
`[${connectionId}] Session resumption detected without SNI and allowSessionTicket=false. ` +
|
||||
`Terminating connection to force new TLS handshake.`
|
||||
);
|
||||
}
|
||||
return {
|
||||
shouldBlock: true,
|
||||
reason: 'session_ticket_blocked'
|
||||
};
|
||||
}
|
||||
|
||||
return { shouldBlock: false };
|
||||
}
|
||||
|
||||
/**
|
||||
* Check for SNI mismatch during renegotiation
|
||||
*/
|
||||
public checkRenegotiationSNI(
|
||||
chunk: Buffer,
|
||||
connInfo: IConnectionInfo,
|
||||
expectedDomain: string,
|
||||
connectionId: string
|
||||
): { hasMismatch: boolean; extractedSNI?: string } {
|
||||
// Only process if this looks like a TLS ClientHello
|
||||
if (!this.isClientHello(chunk)) {
|
||||
return { hasMismatch: false };
|
||||
}
|
||||
|
||||
try {
|
||||
// Extract SNI with renegotiation support
|
||||
const newSNI = SniHandler.extractSNIWithResumptionSupport(
|
||||
chunk,
|
||||
connInfo,
|
||||
this.settings.enableTlsDebugLogging || false
|
||||
);
|
||||
|
||||
// Skip if no SNI was found
|
||||
if (!newSNI) return { hasMismatch: false };
|
||||
|
||||
// Check for SNI mismatch
|
||||
if (newSNI !== expectedDomain) {
|
||||
if (this.settings.enableTlsDebugLogging) {
|
||||
console.log(
|
||||
`[${connectionId}] Renegotiation with different SNI: ${expectedDomain} -> ${newSNI}. ` +
|
||||
`Terminating connection - SNI domain switching is not allowed.`
|
||||
);
|
||||
}
|
||||
return { hasMismatch: true, extractedSNI: newSNI };
|
||||
} else if (this.settings.enableTlsDebugLogging) {
|
||||
console.log(
|
||||
`[${connectionId}] Renegotiation detected with same SNI: ${newSNI}. Allowing.`
|
||||
);
|
||||
}
|
||||
} catch (err) {
|
||||
console.log(
|
||||
`[${connectionId}] Error processing ClientHello: ${err}. Allowing connection to continue.`
|
||||
);
|
||||
}
|
||||
|
||||
return { hasMismatch: false };
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a renegotiation handler function for a connection
|
||||
*/
|
||||
public createRenegotiationHandler(
|
||||
connectionId: string,
|
||||
lockedDomain: string,
|
||||
connInfo: IConnectionInfo,
|
||||
onMismatch: (connectionId: string, reason: string) => void
|
||||
): (chunk: Buffer) => void {
|
||||
return (chunk: Buffer) => {
|
||||
const result = this.checkRenegotiationSNI(chunk, connInfo, lockedDomain, connectionId);
|
||||
if (result.hasMismatch) {
|
||||
onMismatch(connectionId, 'sni_mismatch');
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
/**
|
||||
* Analyze TLS connection for browser fingerprinting
|
||||
* This helps identify browser vs non-browser connections
|
||||
*/
|
||||
public analyzeClientHello(chunk: Buffer): {
|
||||
isBrowserConnection: boolean;
|
||||
isRenewal: boolean;
|
||||
hasSNI: boolean;
|
||||
} {
|
||||
// Default result
|
||||
const result = {
|
||||
isBrowserConnection: false,
|
||||
isRenewal: false,
|
||||
hasSNI: false
|
||||
};
|
||||
|
||||
try {
|
||||
// Check if it's a ClientHello
|
||||
if (!this.isClientHello(chunk)) {
|
||||
return result;
|
||||
}
|
||||
|
||||
// Check for session resumption
|
||||
const resumptionInfo = SniHandler.hasSessionResumption(
|
||||
chunk,
|
||||
this.settings.enableTlsDebugLogging || false
|
||||
);
|
||||
|
||||
// Extract SNI
|
||||
const sni = SniHandler.extractSNI(
|
||||
chunk,
|
||||
this.settings.enableTlsDebugLogging || false
|
||||
);
|
||||
|
||||
// Update result
|
||||
result.isRenewal = resumptionInfo.isResumption;
|
||||
result.hasSNI = !!sni;
|
||||
|
||||
// Browsers typically:
|
||||
// 1. Send SNI extension
|
||||
// 2. Have a variety of extensions (ALPN, etc.)
|
||||
// 3. Use standard cipher suites
|
||||
// ...more complex heuristics could be implemented here
|
||||
|
||||
// Simple heuristic: presence of SNI suggests browser
|
||||
result.isBrowserConnection = !!sni;
|
||||
|
||||
return result;
|
||||
} catch (err) {
|
||||
console.log(`Error analyzing ClientHello: ${err}`);
|
||||
return result;
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user