@having5548/dsh-downloader 0.0.0-stage → 0.5.2

package/lib/core/proxy-server.js

@@ -0,0 +1,341 @@
+// ---------------------------------------------------------------------------
+// Vendored from dsh-clash-proxy 0.2.0 (MIT).
+// Source: H:\mycode\example\dsh-clash\lib\core\proxy-server.js
+// UNMODIFIED except where a line is marked [dsh-downloader].
+// ---------------------------------------------------------------------------
+import net from "node:net";
+import { connectThrough } from "./transports.js";
+
+/**
+ * The loopback rule-splitting proxy server.
+ *
+ * One port speaks both:
+ * - HTTP proxy: CONNECT for tunnels, absolute-form GET/POST for plain http
+ * - SOCKS5: greeting/negotiation then TCP connect
+ *
+ * Every target is decided by the {@link RuleEngine}: `direct` connects
+ * straight to the destination, `proxy` goes through the current upstream
+ * node, `reject` drops the connection. Byte counters feed the GUI traffic
+ * panel. No system proxy, no TUN, loopback only.
+ * @module dsh-clash-proxy/proxy-server
+ */
+
+/** Pipe an async iterable of chunks into a writable socket. */
+async function pumpInto(iterable, socket, counter) {
+	try {
+		for await (const chunk of iterable) {
+			if (socket.destroyed) return;
+			counter?.(chunk.length);
+			if (!socket.write(chunk)) await new Promise((resolve) => socket.once("drain", resolve));
+		}
+		if (!socket.destroyed) socket.end();
+	} catch (error) {
+		// [dsh-downloader] surface the relay failure instead of failing silently.
+		if (process.env.DSH_PROXY_DEBUG === "1") console.error("[proxy] relay failed:", error instanceof Error ? error.message : String(error));
+		socket.destroy();
+	}
+}
+
+/** Pipe one socket into another (plain duplex). */
+function pipeSockets(source, target, counter) {
+	source.on("data", (chunk) => {
+		counter?.(chunk.length);
+		if (!target.write(chunk)) source.pause();
+	});
+	target.on("drain", () => source.resume());
+	source.on("end", () => target.end());
+	source.on("close", () => target.destroy());
+	source.on("error", () => target.destroy());
+}
+
+export class ProxyServer {
+	#engine;
+	#resolveNode;
+	#token = null;
+	#server = null;
+	#port = 0;
+	/** @type {{up: number, down: number}} */
+	counters = { up: 0, down: 0 };
+
+	/**
+	 * @param engine - rule engine deciding direct/proxy/reject.
+	 * @param resolveNode - thunk returning the current upstream node
+	 * (null → direct-only fallback when no node is selected).
+	 * @param token - [dsh-downloader] per-process secret. When set, only callers
+	 * that present it are served; every other connection is refused, so nothing
+	 * outside the owning plugin can borrow this listener as a proxy.
+	 */
+	constructor({ engine, resolveNode, token = null }) {
+		this.#engine = engine;
+		this.#resolveNode = resolveNode;
+		this.#token = typeof token === "string" && token.length > 0 ? token : null;
+	}
+
+	/** Whether this listener is token-gated. */
+	get gated() {
+		return this.#token !== null;
+	}
+
+	/** Bound loopback port (0 until started). */
+	get port() {
+		return this.#port;
+	}
+
+	/**
+	 * [dsh-downloader] Accept an HTTP request only from a caller holding the token.
+	 * Both the `Bearer` form (what this plugin's own client sends) and the
+	 * `Basic dsh:<token>` form (what `curl -x dsh:<token>@…` would send) count.
+	 */
+	#authorized(headers) {
+		if (this.#token === null) return true;
+		const raw = headers["proxy-authorization"];
+		if (typeof raw !== "string" || raw.length === 0) return false;
+		if (raw === `Bearer ${this.#token}`) return true;
+		const expectedBasic = `Basic ${Buffer.from(`dsh:${this.#token}`).toString("base64")}`;
+		return raw === expectedBasic;
+	}
+
+	/** Start listening on 127.0.0.1. @returns the bound port. */
+	start(port = 0) {
+		return new Promise((resolve, reject) => {
+			this.#server = net.createServer((client) => this.#handle(client));
+			this.#server.once("error", reject);
+			// Loopback only: nothing outside this machine can reach the core at all.
+			this.#server.listen(port, "127.0.0.1", () => {
+				this.#port = this.#server.address().port;
+				resolve(this.#port);
+			});
+		});
+	}
+
+	/** Stop listening and destroy every in-flight connection. */
+	stop() {
+		const server = this.#server;
+		this.#server = null;
+		if (server !== null) server.close();
+	}
+
+	/** Route one inbound connection by first byte: 0x05 → SOCKS5, else HTTP. */
+	#handle(client) {
+		client.once("data", (first) => {
+			if (first[0] === 0x05) {
+				// [dsh-downloader] A SOCKS5 greeting cannot carry the token, so a
+				// gated listener refuses the protocol outright instead of serving
+				// an unauthenticated caller. This plugin's own client uses CONNECT.
+				if (this.#token !== null) {
+					client.end(Buffer.from([0x05, 0xff]));
+					return;
+				}
+				this.#handleSocks5(client, first).catch(() => client.destroy());
+			} else {
+				this.#handleHttp(client, first).catch(() => client.destroy());
+			}
+		});
+		client.on("error", () => {});
+	}
+
+	/** Connect to the target per rules; returns the duplex face or throws. */
+	async #connect(host, port) {
+		const action = this.#engine.decide(host);
+		if (action === "reject") throw new Error(`rejected by rule: ${host}`);
+		const node = action === "proxy" ? this.#resolveNode() : null;
+		if (action === "proxy" && (node === null || node === undefined)) throw new Error(`no upstream node available for ${host} (select a node or check the subscription)`);
+		// eslint-disable-next-line no-console
+		if (process.env.DSH_PROXY_DEBUG === "1") console.error(`[proxy] ${host}:${port} → ${action}${action === "proxy" ? ` via ${typeof node === "string" ? node : node?.name}(${node?.type})` : ""}`);
+		return connectThrough(node, host, port);
+	}
+
+	#relay(face, client) {
+		pumpInto(face.read, client, (bytes) => {
+			this.counters.down += bytes;
+		}).catch(() => client.destroy());
+		client.on("data", (chunk) => {
+			this.counters.up += chunk.length;
+			face.write(chunk);
+		});
+		client.on("end", () => face.close());
+		client.on("close", () => face.close());
+		client.on("error", () => face.close());
+	}
+
+	// ---- SOCKS5 inbound ------------------------------------------------------
+
+	async #handleSocks5(client, greeting) {
+		const methods = [...greeting.subarray(2, 2 + greeting[1])];
+		const method = methods.includes(0x00) ? 0x00 : 0xff;
+		client.write(Buffer.from([0x05, method]));
+		if (method === 0xff) return client.end();
+
+		const { host, port, rest } = await this.#readSocks5Request(client);
+		const action = this.#engine.decide(host);
+		if (action === "reject") {
+			client.end(Buffer.from([0x05, 0x02, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+			return;
+		}
+		try {
+			const face = await this.#connect(host, port);
+			client.write(Buffer.from([0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+			if (rest.length > 0) client.unshift(rest);
+			this.#relay(face, client);
+		} catch (error) {
+			client.end(Buffer.from([0x05, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0]));
+		}
+	}
+
+	async #readSocks5Request(client) {
+		const header = await new Promise((resolve, reject) => {
+			const onData = (chunk) => {
+				cleanup();
+				resolve(chunk);
+			};
+			const onError = (error) => {
+				cleanup();
+				reject(error);
+			};
+			const cleanup = () => {
+				client.off("data", onData);
+				client.off("error", onError);
+			};
+			client.once("data", onData);
+			client.once("error", onError);
+		});
+		const atyp = header[3];
+		let host;
+		let port;
+		let rest;
+		if (atyp === 0x01) {
+			host = [...header.subarray(4, 8)].join(".");
+			port = header.readUInt16BE(8);
+			rest = header.subarray(10);
+		} else if (atyp === 0x04) {
+			const groups = [];
+			for (let i = 0; i < 8; i++) groups.push(header.subarray(4 + i * 2, 6 + i * 2).toString("hex"));
+			host = groups.join(":").replace(/(^|:)0(:0)+(:|$)/, "::");
+			port = header.readUInt16BE(20);
+			rest = header.subarray(22);
+		} else if (atyp === 0x03) {
+			const length = header[4];
+			host = header.subarray(5, 5 + length).toString("utf8");
+			port = header.readUInt16BE(5 + length);
+			rest = header.subarray(7 + length);
+		} else {
+			throw new Error("socks5: unsupported address type");
+		}
+		return { host, port, rest };
+	}
+
+	// ---- HTTP inbound --------------------------------------------------------
+
+	async #handleHttp(client, first) {
+		const head = await this.#readHttpHead(client, first);
+		const lines = head.split("\r\n");
+		const requestLine = lines[0] ?? "";
+		const [method, target] = requestLine.split(" ");
+		const headers = {};
+		for (const line of lines.slice(1)) {
+			const colon = line.indexOf(":");
+			if (colon === -1) continue;
+			headers[line.slice(0, colon).trim().toLowerCase()] = line.slice(colon + 1).trim();
+		}
+		// [dsh-downloader] Refuse any caller that does not hold this process's token.
+		if (!this.#authorized(headers)) {
+			if (process.env.DSH_PROXY_DEBUG === "1") console.error("[proxy] refused an unauthenticated caller (scope: this plugin only)");
+			// [dsh-downloader] 挑战必须写 `Basic`：我们两种都接受
+			// （`Bearer <令牌>` 与 `Basic dsh:<令牌>`），但**只有 Basic 是客户端
+			// 普遍能应答的方案**。原先写 `Bearer`，curl/git 拿到不认识的方案就
+			// 直接放弃重试 —— git 连预发都不会做，于是必然吃 407。
+			client.end(
+				"HTTP/1.1 407 Proxy Authentication Required\r\n" +
+					'Proxy-Authenticate: Basic realm="dsh-downloader"\r\n' +
+					"Content-Length: 0\r\n" +
+					"Connection: close\r\n\r\n"
+			);
+			return;
+		}
+		if (method === "CONNECT") {
+			await this.#handleConnect(client, target, headers);
+			return;
+		}
+		if (target !== undefined && (target.startsWith("http://") || target.startsWith("https://"))) {
+			await this.#handleAbsolute(client, method, target, requestLine, lines);
+			return;
+		}
+		client.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+	}
+
+	async #readHttpHead(client, first) {
+		let buffer = first;
+		for (;;) {
+			const end = buffer.indexOf("\r\n\r\n");
+			if (end !== -1) {
+				const head = buffer.subarray(0, end).toString("latin1");
+				if (buffer.length > end + 4) client.unshift(buffer.subarray(end + 4));
+				return head;
+			}
+			const chunk = await new Promise((resolve, reject) => {
+				const onData = (data) => {
+					cleanup();
+					resolve(data);
+				};
+				const onError = (error) => {
+					cleanup();
+					reject(error);
+				};
+				const cleanup = () => {
+					client.off("data", onData);
+					client.off("error", onError);
+				};
+				client.once("data", onData);
+				client.once("error", onError);
+			});
+			buffer = Buffer.concat([buffer, chunk]);
+		}
+	}
+
+	async #handleConnect(client, target, headers) {
+		const colon = target.lastIndexOf(":");
+		if (colon <= 0) {
+			client.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+			return;
+		}
+		const host = target.slice(0, colon);
+		const port = Number(target.slice(colon + 1));
+		try {
+			const face = await this.#connect(host, port);
+			// eslint-disable-next-line no-console
+			if (process.env.DSH_PROXY_DEBUG === "1") console.error(`[proxy] tunnel established for ${host}:${port}`);
+			client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+			this.#relay(face, client);
+		} catch (error) {
+			// eslint-disable-next-line no-console
+			if (process.env.DSH_PROXY_DEBUG === "1") console.error(`[proxy] connect failed for ${host}:${port}:`, error.message);
+			client.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+		}
+	}
+
+	async #handleAbsolute(client, method, target, requestLine, lines) {
+		let url;
+		try {
+			url = new URL(target);
+		} catch {
+			client.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+			return;
+		}
+		const host = url.hostname;
+		const port = url.port.length > 0 ? Number(url.port) : 80;
+		try {
+			const face = await this.#connect(host, port);
+			// Rebuild the request with an origin-form target and forced close.
+			const path = `${url.pathname}${url.search}`;
+			const rewritten = lines.slice(1).filter((line) => !/^(proxy-connection|connection):/i.test(line.trim()));
+			const outbound = `${method} ${path} HTTP/1.1\r\n${rewritten.join("\r\n")}\r\nConnection: close\r\n\r\n`;
+			this.counters.up += Buffer.byteLength(outbound);
+			face.write(Buffer.from(outbound));
+			pumpInto(face.read, client, (bytes) => {
+				this.counters.down += bytes;
+			}).catch(() => client.destroy());
+		} catch (error) {
+			client.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+		}
+	}
+}

package/lib/core/rules.js

@@ -0,0 +1,242 @@
+// ---------------------------------------------------------------------------
+// Vendored from dsh-clash-proxy 0.2.0 (MIT).
+// Source: H:\mycode\example\dsh-clash\lib\core\rules.js
+// UNMODIFIED except where a line is marked [dsh-downloader].
+// ---------------------------------------------------------------------------
+import { readFileSync } from "node:fs";
+import { gunzipSync } from "node:zlib";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+/**
+ * Rule engine: decides `direct` | `proxy` | `reject` per target host.
+ *
+ * Matching order for a hostname:
+ * 1. user extraRules, in order (DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR)
+ * 2. subscription passthrough rules (same types, DIRECT/REJECT only)
+ * 3. the embedded CN domain suffix table → direct
+ * 4. default → proxy
+ *
+ * IP literals skip domain rules and use the embedded CN CIDR tables plus any
+ * custom IP-CIDR rules, defaulting to proxy.
+ * @module dsh-clash-proxy/rules
+ */
+
+const dataDir = join(dirname(fileURLToPath(import.meta.url)), "data");
+
+function loadJson(name) {
+	return JSON.parse(gunzipSync(readFileSync(join(dataDir, name))).toString("utf8"));
+}
+
+/** Embedded domestic domain suffixes (DOMAIN-SUFFIX semantics). */
+const CN_SUFFIXES = new Set(loadJson("cn-domains.json.gz"));
+/** Embedded domestic IPv4 CIDRs [[baseInt, prefixLen], ...] sorted by base. */
+const CN_CIDRS4 = loadJson("cn-cidrs.json.gz");
+/** Embedded domestic IPv6 CIDRs [network(6×u16), prefixLen] parsed at load. */
+const CN_CIDRS6 = loadJson("cn-cidrs6.json.gz").map((cidr) => {
+	const slash = cidr.indexOf("/");
+	const network = cidr.slice(0, slash);
+	const prefix = Number(cidr.slice(slash + 1));
+	const parts = network.split(":");
+	const groups = new Array(8).fill(0);
+	if (parts.includes("")) {
+		// "::" compression: place the right-hand groups at the tail.
+		const empty = parts.indexOf("");
+		const left = parts.slice(0, empty);
+		const right = parts.slice(empty + 1);
+		left.forEach((part, index) => {
+			if (part.length > 0) groups[index] = parseInt(part, 16);
+		});
+		right.forEach((part, index) => {
+			if (part.length > 0) groups[8 - right.length + index] = parseInt(part, 16);
+		});
+	} else {
+		parts.forEach((part, index) => {
+			groups[index] = parseInt(part, 16);
+		});
+	}
+	return { groups, prefix };
+}).sort((a, b) => {
+	for (let i = 0; i < 8; i++) if (a.groups[i] !== b.groups[i]) return a.groups[i] - b.groups[i];
+	return a.prefix - b.prefix;
+});
+
+/** IPv4 dotted string → uint32. */
+export function ipv4ToInt(ip) {
+	const parts = ip.split(".").map(Number);
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return ((parts[0] * 256 + parts[1]) * 256 + parts[2]) * 256 + parts[3];
+}
+
+/** IPv6 string → 8×uint16 groups (uncompressed). */
+export function ipv6ToGroups(ip) {
+	if (ip.includes("::")) {
+		const [left, right] = ip.split("::");
+		const leftGroups = left.length > 0 ? left.split(":").map((part) => parseInt(part, 16)) : [];
+		const rightGroups = right.length > 0 ? right.split(":").map((part) => parseInt(part, 16)) : [];
+		if (leftGroups.length + rightGroups.length > 7 || leftGroups.some(Number.isNaN) || rightGroups.some(Number.isNaN)) return null;
+		const middle = new Array(8 - leftGroups.length - rightGroups.length).fill(0);
+		return [...leftGroups, ...middle, ...rightGroups];
+	}
+	const groups = ip.split(":").map((part) => parseInt(part, 16));
+	if (groups.length !== 8 || groups.some(Number.isNaN)) return null;
+	return groups;
+}
+
+/** True when the IPv4 int falls inside any embedded CN CIDR. */
+export function inCnCidr4(ipInt) {
+	for (const [base, prefix] of CN_CIDRS4) {
+		if (base > ipInt) return false; // sorted: no later row can match
+		const mask = prefix === 0 ? 0 : (-1 << (32 - prefix)) >>> 0;
+		if ((ipInt & mask) === (base & mask)) return true;
+	}
+	return false;
+}
+
+/** True when the IPv6 groups fall inside any embedded CN CIDR. */
+export function inCnCidr6(groups) {
+	for (const { groups: network, prefix } of CN_CIDRS6) {
+		let before = false;
+		let equal = true;
+		for (let i = 0; i < 8 && equal; i++) {
+			if (groups[i] !== network[i]) {
+				equal = false;
+				before = groups[i] < network[i];
+			}
+		}
+		if (before) return false; // sorted
+		if (!equal) continue;
+		// network equals the prefix bits so far — compare remaining bits below.
+		let matched = true;
+		for (let bit = 0; bit < prefix; bit++) {
+			const groupIndex = bit >> 4;
+			const bitIndex = 15 - (bit & 15);
+			if (((groups[groupIndex] >> bitIndex) & 1) !== ((network[groupIndex] >> bitIndex) & 1)) {
+				matched = false;
+				break;
+			}
+		}
+		if (matched) return true;
+	}
+	return false;
+}
+
+/**
+ * Compile a rule line ("TYPE,param[,param],TARGET") into a matcher.
+ * Supported types: DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR, IP-CIDR6,
+ * MATCH, GEOIP (CN only). Unknown types yield null.
+ */
+function compileRule(line) {
+	if (typeof line !== "string") return null;
+	const trimmed = line.trim();
+	if (trimmed.length === 0 || trimmed.startsWith("#") || trimmed.startsWith("//")) return null;
+	const parts = trimmed.split(",").map((part) => part.trim());
+	const target = (parts.pop() ?? "").toUpperCase();
+	if (target !== "DIRECT" && target !== "PROXY" && target !== "REJECT" && target !== "REJECT-DROP") return null;
+	const action = target === "REJECT-DROP" ? "reject" : target.toLowerCase();
+	const type = (parts.shift() ?? "").toUpperCase();
+	const param = parts.join(",");
+	switch (type) {
+		case "DOMAIN":
+			return { match: (host) => host === param.toLowerCase(), action };
+		case "DOMAIN-SUFFIX":
+			return { match: (host) => host === param.toLowerCase() || host.endsWith(`.${param.toLowerCase()}`), action };
+		case "DOMAIN-KEYWORD":
+			return { match: (host) => host.includes(param.toLowerCase()), action };
+		case "IP-CIDR": {
+			const slash = param.indexOf("/");
+			const base = ipv4ToInt(param.slice(0, slash));
+			const prefix = Number(param.slice(slash + 1));
+			if (base === null || !Number.isInteger(prefix)) return null;
+			const mask = prefix === 0 ? 0 : (-1 << (32 - prefix)) >>> 0;
+			return { matchIp: (ipInt) => (ipInt & mask) === (base & mask), action };
+		}
+		case "IP-CIDR6": {
+			const slash = param.indexOf("/");
+			const groups = ipv6ToGroups(param.slice(0, slash));
+			const prefix = Number(param.slice(slash + 1));
+			if (groups === null || !Number.isInteger(prefix)) return null;
+			return {
+				matchIp6: (candidate) => {
+					for (let bit = 0; bit < prefix; bit++) {
+						const groupIndex = bit >> 4;
+						const bitIndex = 15 - (bit & 15);
+						if (((candidate[groupIndex] >> bitIndex) & 1) !== ((groups[groupIndex] >> bitIndex) & 1)) return false;
+					}
+					return true;
+				},
+				action
+			};
+		}
+		case "MATCH":
+			return { match: () => true, action };
+		default:
+			return null;
+	}
+}
+
+/** @typedef {{ruleLines: string[], excludeRules: string[]}} RuleEngineOptions */
+
+export class RuleEngine {
+	#hostRules;
+	#ipRules;
+	#ip6Rules;
+
+	/**
+	 * @param extraRules - user rule lines, highest priority.
+	 * @param excludeRules - subscription rule lines to drop (substring).
+	 * @param subscriptionRules - subscription DIRECT/REJECT passthrough lines.
+	 */
+	constructor({ extraRules = [], excludeRules = [], subscriptionRules = [] } = {}) {
+		this.#hostRules = [];
+		this.#ipRules = [];
+		this.#ip6Rules = [];
+		const lines = [
+			...extraRules.filter((line) => typeof line === "string"),
+			...subscriptionRules.filter((line) => typeof line === "string" && !excludeRules.some((excluded) => line.includes(excluded)))
+		];
+		for (const line of lines) {
+			const rule = compileRule(line);
+			if (rule === null) continue;
+			if (rule.matchIp !== undefined) this.#ipRules.push(rule);
+			else if (rule.matchIp6 !== undefined) this.#ip6Rules.push(rule);
+			else this.#hostRules.push(rule);
+		}
+	}
+
+	/** Decision for a hostname (lowercased). */
+	matchHost(host) {
+		for (const rule of this.#hostRules) if (rule.match(host)) return rule.action;
+		return null;
+	}
+
+	/** Decision for an IPv4 int. */
+	matchIp(ipInt) {
+		for (const rule of this.#ipRules) if (rule.matchIp(ipInt)) return rule.action;
+		if (inCnCidr4(ipInt)) return "direct";
+		return null;
+	}
+
+	/** Decision for IPv6 groups. */
+	matchIp6(groups) {
+		for (const rule of this.#ip6Rules) if (rule.matchIp6(groups)) return rule.action;
+		if (inCnCidr6(groups)) return "direct";
+		return null;
+	}
+
+	/** Final decision for a raw host string (hostname or IP literal). */
+	decide(rawHost) {
+		const host = rawHost.toLowerCase().trim();
+		const ip4 = ipv4ToInt(host);
+		if (ip4 !== null) return this.matchIp(ip4) ?? "proxy";
+		const ip6 = ipv6ToGroups(host);
+		if (ip6 !== null) return this.matchIp6(ip6) ?? "proxy";
+		const ruleAction = this.matchHost(host);
+		if (ruleAction !== null) return ruleAction;
+		if (CN_SUFFIXES.has(host) || host.endsWith(".cn")) return "direct";
+		for (let dot = host.indexOf("."); dot !== -1; dot = host.indexOf(".", dot + 1)) {
+			if (CN_SUFFIXES.has(host.slice(dot + 1))) return "direct";
+		}
+		return "proxy";
+	}
+}