@kitman-sh/cli 0.0.0-stage → 0.7.0

package/dist/egress-proxy.ts

@@ -0,0 +1,107 @@
+// Runs alone inside the egress proxy container, so it imports nothing outside Node.
+import { once } from 'node:events'
+import { connect, createServer, type Server, type Socket } from 'node:net'
+
+/** Whether the allowlist takes `host:port`: an entry `host` takes any port, `host:port` one, `*.domain` subdomains. */
+export const egressAllowed = (hosts: readonly string[], host: string, port: number) => {
+  const target = host.toLowerCase()
+
+  return hosts.some(entry => {
+    const [name = '', entryPort] = entry.toLowerCase().split(':')
+
+    if (entryPort !== undefined && Number(entryPort) !== port) return false
+
+    return name.startsWith('*.') ? target.endsWith(name.slice(1)) : target === name
+  })
+}
+
+const connectTarget = (authority: string) => {
+  const separator = authority.lastIndexOf(':')
+  const port = Number(authority.slice(separator + 1))
+
+  return separator === -1 || !Number.isInteger(port)
+    ? undefined
+    : { host: authority.slice(0, separator).replace(/^\[|\]$/g, ''), port }
+}
+
+const httpTarget = (absolute: string) => {
+  if (!URL.canParse(absolute)) return undefined
+  const url = new URL(absolute)
+
+  return url.protocol !== 'http:'
+    ? undefined
+    : {
+        host: url.hostname.replace(/^\[|\]$/g, ''),
+        port: url.port === '' ? 80 : Number(url.port),
+        path: `${url.pathname}${url.search}`
+      }
+}
+
+const answer = (socket: Socket, status: string) => socket.end(`HTTP/1.1 ${status}\r\nContent-Length: 0\r\n\r\n`)
+
+const handle = (hosts: readonly string[]) => (client: Socket) => {
+  let head = Buffer.alloc(0)
+
+  const onData = (chunk: Buffer) => {
+    head = Buffer.concat([head, chunk])
+    const end = head.indexOf('\r\n\r\n')
+
+    if (end === -1) return head.length > 16_384 ? answer(client, '431 Request Header Fields Too Large') : undefined
+    client.off('data', onData)
+
+    const [requestLine = '', ...headers] = head.subarray(0, end).toString().split('\r\n')
+    const [method = '', target = '', version = 'HTTP/1.1'] = requestLine.split(' ')
+    const destination = method === 'CONNECT' ? connectTarget(target) : httpTarget(target)
+
+    if (destination === undefined) return answer(client, '405 Method Not Allowed')
+
+    if (!egressAllowed(hosts, destination.host, destination.port)) return answer(client, '403 Forbidden')
+
+    const upstream = connect(destination.port, destination.host, () => {
+      if (!('path' in destination)) {
+        client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+        upstream.write(head.subarray(end + 4))
+      } else {
+        // One request per connection: a reused one could carry a request for another host to this one.
+        const kept = headers.filter(line => !/^(proxy-)?connection:/i.test(line))
+
+        upstream.write(
+          Buffer.concat([
+            Buffer.from(
+              [[method, destination.path, version].join(' '), ...kept, 'Connection: close', '', ''].join('\r\n')
+            ),
+            head.subarray(end + 4)
+          ])
+        )
+      }
+
+      client.pipe(upstream)
+      upstream.pipe(client)
+    })
+
+    upstream.on('error', () => (client.writable ? answer(client, '502 Bad Gateway') : client.destroy()))
+    client.on('error', () => upstream.destroy())
+  }
+
+  client.on('data', onData)
+  client.on('error', () => client.destroy())
+}
+
+/** An HTTP proxy that tunnels CONNECT and forwards plain HTTP only to the allowlist. */
+export const startEgressProxy = (input: {
+  readonly hosts: readonly string[]
+  readonly port: number
+  readonly hostname: string
+}): Promise<Server> => {
+  const server = createServer(handle(input.hosts)).listen(input.port, input.hostname)
+
+  return once(server, 'listening').then(() => server)
+}
+
+// `bun egress-proxy.ts <comma-separated allowlist>`
+if (import.meta.main)
+  void startEgressProxy({
+    hosts: (Bun.argv[2] ?? '').split(',').filter(host => host.length > 0),
+    port: 3128,
+    hostname: '0.0.0.0'
+  })