587 lines
17 KiB
TypeScript
587 lines
17 KiB
TypeScript
import * as plugins from '../../plugins.js';
|
|
import type {
|
|
IRouteConfig,
|
|
IRouteMatch,
|
|
IRouteAction,
|
|
TPortRange
|
|
} from './models/route-types.js';
|
|
import type {
|
|
ISmartProxyOptions,
|
|
IRoutedSmartProxyOptions,
|
|
IDomainConfig
|
|
} from './models/interfaces.js';
|
|
import {
|
|
isRoutedOptions,
|
|
isLegacyOptions
|
|
} from './models/interfaces.js';
|
|
|
|
/**
|
|
* Result of route matching
|
|
*/
|
|
export interface IRouteMatchResult {
|
|
route: IRouteConfig;
|
|
// Additional match parameters (path, query, etc.)
|
|
params?: Record<string, string>;
|
|
}
|
|
|
|
/**
|
|
* The RouteManager handles all routing decisions based on connections and attributes
|
|
*/
|
|
export class RouteManager extends plugins.EventEmitter {
|
|
private routes: IRouteConfig[] = [];
|
|
private portMap: Map<number, IRouteConfig[]> = new Map();
|
|
private options: IRoutedSmartProxyOptions;
|
|
|
|
constructor(options: ISmartProxyOptions) {
|
|
super();
|
|
|
|
// We no longer support legacy options, always use provided options
|
|
this.options = options;
|
|
|
|
// Initialize routes from either source
|
|
this.updateRoutes(this.options.routes);
|
|
}
|
|
|
|
/**
|
|
* Update routes with new configuration
|
|
*/
|
|
public updateRoutes(routes: IRouteConfig[] = []): void {
|
|
// Sort routes by priority (higher first)
|
|
this.routes = [...(routes || [])].sort((a, b) => {
|
|
const priorityA = a.priority ?? 0;
|
|
const priorityB = b.priority ?? 0;
|
|
return priorityB - priorityA;
|
|
});
|
|
|
|
// Rebuild port mapping for fast lookups
|
|
this.rebuildPortMap();
|
|
}
|
|
|
|
/**
|
|
* Rebuild the port mapping for fast lookups
|
|
*/
|
|
private rebuildPortMap(): void {
|
|
this.portMap.clear();
|
|
|
|
for (const route of this.routes) {
|
|
const ports = this.expandPortRange(route.match.ports);
|
|
|
|
for (const port of ports) {
|
|
if (!this.portMap.has(port)) {
|
|
this.portMap.set(port, []);
|
|
}
|
|
this.portMap.get(port)!.push(route);
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Expand a port range specification into an array of individual ports
|
|
*/
|
|
private expandPortRange(portRange: TPortRange): number[] {
|
|
if (typeof portRange === 'number') {
|
|
return [portRange];
|
|
}
|
|
|
|
if (Array.isArray(portRange)) {
|
|
// Handle array of port objects or numbers
|
|
return portRange.flatMap(item => {
|
|
if (typeof item === 'number') {
|
|
return [item];
|
|
} else if (typeof item === 'object' && 'from' in item && 'to' in item) {
|
|
// Handle port range object
|
|
const ports: number[] = [];
|
|
for (let p = item.from; p <= item.to; p++) {
|
|
ports.push(p);
|
|
}
|
|
return ports;
|
|
}
|
|
return [];
|
|
});
|
|
}
|
|
|
|
return [];
|
|
}
|
|
|
|
/**
|
|
* Get all ports that should be listened on
|
|
*/
|
|
public getListeningPorts(): number[] {
|
|
return Array.from(this.portMap.keys());
|
|
}
|
|
|
|
/**
|
|
* Get all routes for a given port
|
|
*/
|
|
public getRoutesForPort(port: number): IRouteConfig[] {
|
|
return this.portMap.get(port) || [];
|
|
}
|
|
|
|
/**
|
|
* Test if a pattern matches a domain using glob matching
|
|
*/
|
|
private matchDomain(pattern: string, domain: string): boolean {
|
|
// Convert glob pattern to regex
|
|
const regexPattern = pattern
|
|
.replace(/\./g, '\\.') // Escape dots
|
|
.replace(/\*/g, '.*'); // Convert * to .*
|
|
|
|
const regex = new RegExp(`^${regexPattern}$`, 'i');
|
|
return regex.test(domain);
|
|
}
|
|
|
|
/**
|
|
* Match a domain against all patterns in a route
|
|
*/
|
|
private matchRouteDomain(route: IRouteConfig, domain: string): boolean {
|
|
if (!route.match.domains) {
|
|
// If no domains specified, match all domains
|
|
return true;
|
|
}
|
|
|
|
const patterns = Array.isArray(route.match.domains)
|
|
? route.match.domains
|
|
: [route.match.domains];
|
|
|
|
return patterns.some(pattern => this.matchDomain(pattern, domain));
|
|
}
|
|
|
|
/**
|
|
* Check if a client IP is allowed by a route's security settings
|
|
*/
|
|
private isClientIpAllowed(route: IRouteConfig, clientIp: string): boolean {
|
|
const security = route.action.security;
|
|
|
|
if (!security) {
|
|
return true; // No security settings means allowed
|
|
}
|
|
|
|
// Check blocked IPs first
|
|
if (security.blockedIps && security.blockedIps.length > 0) {
|
|
for (const pattern of security.blockedIps) {
|
|
if (this.matchIpPattern(pattern, clientIp)) {
|
|
return false; // IP is blocked
|
|
}
|
|
}
|
|
}
|
|
|
|
// If there are allowed IPs, check them
|
|
if (security.allowedIps && security.allowedIps.length > 0) {
|
|
for (const pattern of security.allowedIps) {
|
|
if (this.matchIpPattern(pattern, clientIp)) {
|
|
return true; // IP is allowed
|
|
}
|
|
}
|
|
return false; // IP not in allowed list
|
|
}
|
|
|
|
// No allowed IPs specified, so IP is allowed
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Match an IP against a pattern
|
|
*/
|
|
private matchIpPattern(pattern: string, ip: string): boolean {
|
|
// Handle exact match
|
|
if (pattern === ip) {
|
|
return true;
|
|
}
|
|
|
|
// Handle CIDR notation (e.g., 192.168.1.0/24)
|
|
if (pattern.includes('/')) {
|
|
return this.matchIpCidr(pattern, ip);
|
|
}
|
|
|
|
// Handle glob pattern (e.g., 192.168.1.*)
|
|
if (pattern.includes('*')) {
|
|
const regexPattern = pattern.replace(/\./g, '\\.').replace(/\*/g, '.*');
|
|
const regex = new RegExp(`^${regexPattern}$`);
|
|
return regex.test(ip);
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Match an IP against a CIDR pattern
|
|
*/
|
|
private matchIpCidr(cidr: string, ip: string): boolean {
|
|
try {
|
|
// In a real implementation, you'd use a proper IP library
|
|
// This is a simplified implementation
|
|
const [subnet, bits] = cidr.split('/');
|
|
const mask = parseInt(bits, 10);
|
|
|
|
// Convert IP addresses to numeric values
|
|
const ipNum = this.ipToNumber(ip);
|
|
const subnetNum = this.ipToNumber(subnet);
|
|
|
|
// Calculate subnet mask
|
|
const maskNum = ~(2 ** (32 - mask) - 1);
|
|
|
|
// Check if IP is in subnet
|
|
return (ipNum & maskNum) === (subnetNum & maskNum);
|
|
} catch (e) {
|
|
console.error(`Error matching IP ${ip} against CIDR ${cidr}:`, e);
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Convert an IP address to a numeric value
|
|
*/
|
|
private ipToNumber(ip: string): number {
|
|
const parts = ip.split('.').map(part => parseInt(part, 10));
|
|
return (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3];
|
|
}
|
|
|
|
/**
|
|
* Find the matching route for a connection
|
|
*/
|
|
public findMatchingRoute(options: {
|
|
port: number;
|
|
domain?: string;
|
|
clientIp: string;
|
|
path?: string;
|
|
tlsVersion?: string;
|
|
}): IRouteMatchResult | null {
|
|
const { port, domain, clientIp, path, tlsVersion } = options;
|
|
|
|
// Get all routes for this port
|
|
const routesForPort = this.getRoutesForPort(port);
|
|
|
|
// Find the first matching route based on priority order
|
|
for (const route of routesForPort) {
|
|
// Check domain match if specified
|
|
if (domain && !this.matchRouteDomain(route, domain)) {
|
|
continue;
|
|
}
|
|
|
|
// Check path match if specified in both route and request
|
|
if (path && route.match.path) {
|
|
if (!this.matchPath(route.match.path, path)) {
|
|
continue;
|
|
}
|
|
}
|
|
|
|
// Check client IP match
|
|
if (route.match.clientIp && !route.match.clientIp.some(pattern =>
|
|
this.matchIpPattern(pattern, clientIp))) {
|
|
continue;
|
|
}
|
|
|
|
// Check TLS version match
|
|
if (tlsVersion && route.match.tlsVersion &&
|
|
!route.match.tlsVersion.includes(tlsVersion)) {
|
|
continue;
|
|
}
|
|
|
|
// Check security settings
|
|
if (!this.isClientIpAllowed(route, clientIp)) {
|
|
continue;
|
|
}
|
|
|
|
// All checks passed, this route matches
|
|
return { route };
|
|
}
|
|
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Match a path against a pattern
|
|
*/
|
|
private matchPath(pattern: string, path: string): boolean {
|
|
// Convert the glob pattern to a regex
|
|
const regexPattern = pattern
|
|
.replace(/\./g, '\\.') // Escape dots
|
|
.replace(/\*/g, '.*') // Convert * to .*
|
|
.replace(/\//g, '\\/'); // Escape slashes
|
|
|
|
const regex = new RegExp(`^${regexPattern}$`);
|
|
return regex.test(path);
|
|
}
|
|
|
|
/**
|
|
* Convert a domain config to routes
|
|
* (For backward compatibility with code that still uses domainConfigs)
|
|
*/
|
|
public domainConfigToRoutes(domainConfig: IDomainConfig): IRouteConfig[] {
|
|
const routes: IRouteConfig[] = [];
|
|
const { domains, forwarding } = domainConfig;
|
|
|
|
// Determine the action based on forwarding type
|
|
let action: IRouteAction = {
|
|
type: 'forward',
|
|
target: {
|
|
host: forwarding.target.host,
|
|
port: forwarding.target.port
|
|
}
|
|
};
|
|
|
|
// Set TLS mode based on forwarding type
|
|
switch (forwarding.type) {
|
|
case 'http-only':
|
|
// No TLS settings needed
|
|
break;
|
|
case 'https-passthrough':
|
|
action.tls = { mode: 'passthrough' };
|
|
break;
|
|
case 'https-terminate-to-http':
|
|
action.tls = {
|
|
mode: 'terminate',
|
|
certificate: forwarding.https?.customCert ? {
|
|
key: forwarding.https.customCert.key,
|
|
cert: forwarding.https.customCert.cert
|
|
} : 'auto'
|
|
};
|
|
break;
|
|
case 'https-terminate-to-https':
|
|
action.tls = {
|
|
mode: 'terminate-and-reencrypt',
|
|
certificate: forwarding.https?.customCert ? {
|
|
key: forwarding.https.customCert.key,
|
|
cert: forwarding.https.customCert.cert
|
|
} : 'auto'
|
|
};
|
|
break;
|
|
}
|
|
|
|
// Add security settings if present
|
|
if (forwarding.security) {
|
|
action.security = {
|
|
allowedIps: forwarding.security.allowedIps,
|
|
blockedIps: forwarding.security.blockedIps,
|
|
maxConnections: forwarding.security.maxConnections
|
|
};
|
|
}
|
|
|
|
// Add advanced settings if present
|
|
if (forwarding.advanced) {
|
|
action.advanced = {
|
|
timeout: forwarding.advanced.timeout,
|
|
headers: forwarding.advanced.headers,
|
|
keepAlive: forwarding.advanced.keepAlive
|
|
};
|
|
}
|
|
|
|
// Determine which port to use based on forwarding type
|
|
const defaultPort = forwarding.type.startsWith('https') ? 443 : 80;
|
|
|
|
// Add the main route
|
|
routes.push({
|
|
match: {
|
|
ports: defaultPort,
|
|
domains
|
|
},
|
|
action,
|
|
name: `Route for ${domains.join(', ')}`
|
|
});
|
|
|
|
// Add HTTP redirect if needed
|
|
if (forwarding.http?.redirectToHttps) {
|
|
routes.push({
|
|
match: {
|
|
ports: 80,
|
|
domains
|
|
},
|
|
action: {
|
|
type: 'redirect',
|
|
redirect: {
|
|
to: 'https://{domain}{path}',
|
|
status: 301
|
|
}
|
|
},
|
|
name: `HTTP Redirect for ${domains.join(', ')}`,
|
|
priority: 100 // Higher priority for redirects
|
|
});
|
|
}
|
|
|
|
// Add port ranges if specified
|
|
if (forwarding.advanced?.portRanges) {
|
|
for (const range of forwarding.advanced.portRanges) {
|
|
routes.push({
|
|
match: {
|
|
ports: [{ from: range.from, to: range.to }],
|
|
domains
|
|
},
|
|
action,
|
|
name: `Port Range ${range.from}-${range.to} for ${domains.join(', ')}`
|
|
});
|
|
}
|
|
}
|
|
|
|
return routes;
|
|
}
|
|
|
|
/**
|
|
* Update routes based on domain configs
|
|
* (For backward compatibility with code that still uses domainConfigs)
|
|
*/
|
|
public updateFromDomainConfigs(domainConfigs: IDomainConfig[]): void {
|
|
const routes: IRouteConfig[] = [];
|
|
|
|
// Convert each domain config to routes
|
|
for (const config of domainConfigs) {
|
|
routes.push(...this.domainConfigToRoutes(config));
|
|
}
|
|
|
|
// Merge with existing routes that aren't derived from domain configs
|
|
const nonDomainRoutes = this.routes.filter(r =>
|
|
!r.name || !r.name.includes('for '));
|
|
|
|
this.updateRoutes([...nonDomainRoutes, ...routes]);
|
|
}
|
|
|
|
/**
|
|
* Validate the route configuration and return any warnings
|
|
*/
|
|
public validateConfiguration(): string[] {
|
|
const warnings: string[] = [];
|
|
const duplicatePorts = new Map<number, number>();
|
|
|
|
// Check for routes with the same exact match criteria
|
|
for (let i = 0; i < this.routes.length; i++) {
|
|
for (let j = i + 1; j < this.routes.length; j++) {
|
|
const route1 = this.routes[i];
|
|
const route2 = this.routes[j];
|
|
|
|
// Check if route match criteria are the same
|
|
if (this.areMatchesSimilar(route1.match, route2.match)) {
|
|
warnings.push(
|
|
`Routes "${route1.name || i}" and "${route2.name || j}" have similar match criteria. ` +
|
|
`The route with higher priority (${Math.max(route1.priority || 0, route2.priority || 0)}) will be used.`
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
// Check for routes that may never be matched due to priority
|
|
for (let i = 0; i < this.routes.length; i++) {
|
|
const route = this.routes[i];
|
|
const higherPriorityRoutes = this.routes.filter(r =>
|
|
(r.priority || 0) > (route.priority || 0));
|
|
|
|
for (const higherRoute of higherPriorityRoutes) {
|
|
if (this.isRouteShadowed(route, higherRoute)) {
|
|
warnings.push(
|
|
`Route "${route.name || i}" may never be matched because it is shadowed by ` +
|
|
`higher priority route "${higherRoute.name || 'unnamed'}"`
|
|
);
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
return warnings;
|
|
}
|
|
|
|
/**
|
|
* Check if two route matches are similar (potential conflict)
|
|
*/
|
|
private areMatchesSimilar(match1: IRouteMatch, match2: IRouteMatch): boolean {
|
|
// Check port overlap
|
|
const ports1 = new Set(this.expandPortRange(match1.ports));
|
|
const ports2 = new Set(this.expandPortRange(match2.ports));
|
|
|
|
let havePortOverlap = false;
|
|
for (const port of ports1) {
|
|
if (ports2.has(port)) {
|
|
havePortOverlap = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!havePortOverlap) {
|
|
return false;
|
|
}
|
|
|
|
// Check domain overlap
|
|
if (match1.domains && match2.domains) {
|
|
const domains1 = Array.isArray(match1.domains) ? match1.domains : [match1.domains];
|
|
const domains2 = Array.isArray(match2.domains) ? match2.domains : [match2.domains];
|
|
|
|
// Check if any domain pattern from match1 could match any from match2
|
|
let haveDomainOverlap = false;
|
|
for (const domain1 of domains1) {
|
|
for (const domain2 of domains2) {
|
|
if (domain1 === domain2 ||
|
|
(domain1.includes('*') || domain2.includes('*'))) {
|
|
haveDomainOverlap = true;
|
|
break;
|
|
}
|
|
}
|
|
if (haveDomainOverlap) break;
|
|
}
|
|
|
|
if (!haveDomainOverlap) {
|
|
return false;
|
|
}
|
|
} else if (match1.domains || match2.domains) {
|
|
// One has domains, the other doesn't - they could overlap
|
|
// The one with domains is more specific, so it's not exactly a conflict
|
|
return false;
|
|
}
|
|
|
|
// Check path overlap
|
|
if (match1.path && match2.path) {
|
|
// This is a simplified check - in a real implementation,
|
|
// you'd need to check if the path patterns could match the same paths
|
|
return match1.path === match2.path ||
|
|
match1.path.includes('*') ||
|
|
match2.path.includes('*');
|
|
} else if (match1.path || match2.path) {
|
|
// One has a path, the other doesn't
|
|
return false;
|
|
}
|
|
|
|
// If we get here, the matches have significant overlap
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Check if a route is completely shadowed by a higher priority route
|
|
*/
|
|
private isRouteShadowed(route: IRouteConfig, higherPriorityRoute: IRouteConfig): boolean {
|
|
// If they don't have similar match criteria, no shadowing occurs
|
|
if (!this.areMatchesSimilar(route.match, higherPriorityRoute.match)) {
|
|
return false;
|
|
}
|
|
|
|
// If higher priority route has more specific criteria, no shadowing
|
|
if (this.isRouteMoreSpecific(higherPriorityRoute.match, route.match)) {
|
|
return false;
|
|
}
|
|
|
|
// If higher priority route is equally or less specific but has higher priority,
|
|
// it shadows the lower priority route
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Check if route1 is more specific than route2
|
|
*/
|
|
private isRouteMoreSpecific(match1: IRouteMatch, match2: IRouteMatch): boolean {
|
|
// Check if match1 has more specific criteria
|
|
let match1Points = 0;
|
|
let match2Points = 0;
|
|
|
|
// Path is the most specific
|
|
if (match1.path) match1Points += 3;
|
|
if (match2.path) match2Points += 3;
|
|
|
|
// Domain is next most specific
|
|
if (match1.domains) match1Points += 2;
|
|
if (match2.domains) match2Points += 2;
|
|
|
|
// Client IP and TLS version are least specific
|
|
if (match1.clientIp) match1Points += 1;
|
|
if (match2.clientIp) match2Points += 1;
|
|
|
|
if (match1.tlsVersion) match1Points += 1;
|
|
if (match2.tlsVersion) match2Points += 1;
|
|
|
|
return match1Points > match2Points;
|
|
}
|
|
} |