@opensecurity/zonzon-core 0.1.2 → 0.1.4

package/dist/http-handler.js

@@ -0,0 +1,429 @@
+import * as http from "http";
+import * as net from "net";
+import * as dns from "dns/promises";
+import { HttpProxyService } from "./http-proxy.js";
+import { audit } from "./audit.js";
+import { firewallEngine } from "./firewall.js";
+var CircuitState;
+(function (CircuitState) {
+    CircuitState[CircuitState["CLOSED"] = 0] = "CLOSED";
+    CircuitState[CircuitState["OPEN"] = 1] = "OPEN";
+    CircuitState[CircuitState["HALF_OPEN"] = 2] = "HALF_OPEN";
+})(CircuitState || (CircuitState = {}));
+class ProxyCircuitBreaker {
+    state = CircuitState.CLOSED;
+    failures = 0;
+    lastFailureTime = 0;
+    threshold = 5;
+    resetTimeoutMs = 10000;
+    async execute(action) {
+        const now = Date.now();
+        if (this.state === CircuitState.OPEN) {
+            if (now - this.lastFailureTime > this.resetTimeoutMs) {
+                this.state = CircuitState.HALF_OPEN;
+            }
+            else {
+                throw new Error("Target Offline");
+            }
+        }
+        try {
+            const result = await action();
+            if (this.state === CircuitState.HALF_OPEN) {
+                this.reset();
+            }
+            return result;
+        }
+        catch (error) {
+            this.recordFailure(now);
+            throw error;
+        }
+    }
+    recordFailure(time) {
+        this.failures++;
+        this.lastFailureTime = time;
+        if (this.failures >= this.threshold) {
+            this.state = CircuitState.OPEN;
+        }
+    }
+    reset() {
+        this.state = CircuitState.CLOSED;
+        this.failures = 0;
+    }
+}
+export class HttpHandler {
+    dnsServer;
+    proxyService;
+    port;
+    config;
+    server = null;
+    circuitBreakers = new Map();
+    activeConnections = new Set();
+    constructor(dnsServer, config, port) {
+        this.dnsServer = dnsServer;
+        this.proxyService = new HttpProxyService();
+        this.config = config;
+        this.port = config.httpPort ?? port ?? 80;
+    }
+    getCircuitBreaker(upstream) {
+        if (!this.circuitBreakers.has(upstream)) {
+            this.circuitBreakers.set(upstream, new ProxyCircuitBreaker());
+        }
+        return this.circuitBreakers.get(upstream);
+    }
+    findWildcardHost(config, hostname) {
+        const normalizedName = hostname.toLowerCase().replace(/\.$/, "");
+        const labels = normalizedName.split(".");
+        for (let i = 0; i < labels.length - 1; i++) {
+            const suffix = labels.slice(i).join(".");
+            const wildcardKey = "*." + suffix;
+            if (config.hosts[wildcardKey]) {
+                return config.hosts[wildcardKey];
+            }
+        }
+        return undefined;
+    }
+    injectCustomHeaders(responseHeaders, hostConfig) {
+        if (!hostConfig.http_proxy?.enabled)
+            return;
+        for (const [key, value] of Object.entries(hostConfig.http_proxy.headers)) {
+            const sanitized = this.proxyService.sanitizeHeader(value);
+            if (sanitized) {
+                responseHeaders.set(key, sanitized);
+            }
+        }
+    }
+    async handleConnect(req, clientSocket, head) {
+        const clientIp = req.socket.remoteAddress || "unknown";
+        const targetUrl = req.url || "";
+        const [hostname, portStr] = targetUrl.split(':');
+        const port = portStr ? parseInt(portStr, 10) : 443;
+        try {
+            await this.proxyService.validateTargetFirewall(`https://${hostname}:${port}`, this.config.firewall);
+            audit.http(clientIp, "CONNECT", hostname, `:${port}`, 200, "TCP Tunnel Established");
+            const srvSocket = net.connect(port, hostname, () => {
+                clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+                if (head && head.length > 0) {
+                    srvSocket.write(head);
+                }
+                srvSocket.pipe(clientSocket);
+                clientSocket.pipe(srvSocket);
+            });
+            this.activeConnections.add(srvSocket);
+            srvSocket.on('close', () => this.activeConnections.delete(srvSocket));
+            srvSocket.on('error', (err) => {
+                audit.error(`Upstream tunnel fault on ${hostname}:${port} - ${err.message}`);
+                if (!clientSocket.destroyed)
+                    clientSocket.destroy();
+            });
+            clientSocket.on('error', (err) => {
+                if (!srvSocket.destroyed)
+                    srvSocket.destroy();
+            });
+        }
+        catch (err) {
+            audit.http(clientIp, "CONNECT", hostname, `:${port}`, 403, "Blocked by Firewall");
+            if (!clientSocket.destroyed) {
+                clientSocket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
+                clientSocket.destroy();
+            }
+        }
+    }
+    async handleForwardProxy(req, res) {
+        const clientIp = req.socket.remoteAddress || "unknown";
+        const reqMethod = req.method || "GET";
+        const reqUrl = req.url || "/";
+        const targetUrl = new URL(reqUrl);
+        const hostname = targetUrl.hostname;
+        try {
+            await this.proxyService.validateTargetFirewall(targetUrl.toString(), this.config.firewall);
+        }
+        catch (fwErr) {
+            audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, 403, "Blocked by L3/L7 Firewall");
+            res.writeHead(403, { "Content-Type": "text/html" });
+            res.end(`<h1>403 Forbidden</h1><p>${fwErr.message}</p>`);
+            return;
+        }
+        const headers = new Headers();
+        for (const [k, v] of Object.entries(req.headers)) {
+            if (Array.isArray(v)) {
+                headers.set(k, v.join(", "));
+            }
+            else if (typeof v === "string") {
+                headers.set(k, v);
+            }
+        }
+        const hopByHop = this.proxyService.getHopByHopHeaders();
+        for (const h of hopByHop) {
+            headers.delete(h);
+        }
+        const maxBodyBytes = 5 * 1024 * 1024;
+        let bodyBuffer = undefined;
+        if (reqMethod !== "GET" && reqMethod !== "HEAD") {
+            const chunks = [];
+            let totalSize = 0;
+            for await (const chunk of req) {
+                totalSize += chunk.length;
+                if (totalSize > maxBodyBytes) {
+                    audit.http(clientIp, reqMethod, hostname, reqUrl, 413, targetUrl.hostname);
+                    res.writeHead(413, { "Content-Type": "text/html" });
+                    res.end("<h1>413 Payload Too Large</h1>");
+                    return;
+                }
+                chunks.push(chunk);
+            }
+            if (chunks.length > 0) {
+                bodyBuffer = Buffer.concat(chunks);
+            }
+        }
+        const proxiedReqInit = {
+            method: reqMethod,
+            headers,
+        };
+        if (bodyBuffer) {
+            proxiedReqInit.body = bodyBuffer;
+            proxiedReqInit.duplex = "half";
+        }
+        const proxiedReq = new Request(targetUrl.toString(), proxiedReqInit);
+        const breaker = this.getCircuitBreaker(targetUrl.hostname);
+        try {
+            const proxyResp = await breaker.execute(() => fetch(proxiedReq));
+            const outHeaders = {};
+            proxyResp.headers.forEach((value, key) => {
+                if (!hopByHop.includes(key.toLowerCase())) {
+                    outHeaders[key] = value;
+                }
+            });
+            audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, proxyResp.status, targetUrl.toString());
+            res.writeHead(proxyResp.status, outHeaders);
+            const responseBuffer = Buffer.from(await proxyResp.arrayBuffer());
+            res.end(responseBuffer);
+        }
+        catch (err) {
+            audit.http(clientIp, reqMethod, hostname, targetUrl.pathname, 502, "Upstream Timeout or Fault");
+            res.writeHead(502, { "Content-Type": "text/html" });
+            res.end(`<h1>502 Bad Gateway</h1>`);
+        }
+    }
+    async handleRequest(req, res) {
+        const clientIp = req.socket.remoteAddress || "unknown";
+        const reqMethod = req.method || "GET";
+        const reqUrl = req.url || "/";
+        if (reqUrl.startsWith("http://")) {
+            return this.handleForwardProxy(req, res);
+        }
+        const rawHost = req.headers.host || "";
+        const hostname = rawHost.split(":")[0];
+        try {
+            if (!hostname) {
+                audit.http(clientIp, reqMethod, "UNKNOWN", reqUrl, 400, "Missing Host Header");
+                res.writeHead(400);
+                res.end("Bad Request");
+                return;
+            }
+            let hostConfig = this.config.hosts[hostname];
+            if (!hostConfig) {
+                const wildConfig = this.findWildcardHost(this.config, hostname);
+                if (wildConfig)
+                    hostConfig = wildConfig;
+            }
+            if (hostConfig) {
+                const redirect = this.proxyService.checkRedirect(hostConfig);
+                if (redirect) {
+                    try {
+                        await this.proxyService.validateTargetFirewall(redirect.target, this.config.firewall);
+                        audit.http(clientIp, reqMethod, hostname, reqUrl, redirect.code, redirect.target);
+                        res.writeHead(redirect.code, { Location: redirect.target });
+                        res.end();
+                        return;
+                    }
+                    catch (err) {
+                        audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked by L3 Firewall");
+                        res.writeHead(403, { "Content-Type": "text/html" });
+                        res.end("<h1>403 Forbidden</h1>");
+                        return;
+                    }
+                }
+                if (hostConfig.http_proxy?.enabled && hostConfig.http_proxy.upstream) {
+                    const upstreamBase = new URL(hostConfig.http_proxy.upstream);
+                    try {
+                        await this.proxyService.validateTargetFirewall(upstreamBase.toString(), this.config.firewall);
+                    }
+                    catch (fwErr) {
+                        audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked by L3 Firewall");
+                        res.writeHead(403, { "Content-Type": "text/html" });
+                        res.end(`<h1>403 Forbidden</h1><p>${fwErr.message}</p>`);
+                        return;
+                    }
+                    let safePath = "/";
+                    try {
+                        const parsedPath = new URL(reqUrl, "http://safe.local");
+                        safePath = parsedPath.pathname + parsedPath.search;
+                    }
+                    catch {
+                        safePath = "/";
+                    }
+                    const targetUrl = new URL(safePath, upstreamBase);
+                    const headers = new Headers();
+                    for (const [k, v] of Object.entries(req.headers)) {
+                        if (Array.isArray(v)) {
+                            headers.set(k, v.join(", "));
+                        }
+                        else if (typeof v === "string") {
+                            headers.set(k, v);
+                        }
+                    }
+                    const shouldForwardBody = hostConfig.http_proxy.forwardRequestBody;
+                    const maxBodyBytes = hostConfig.http_proxy.maxRequestBodyBytes ?? 5 * 1024 * 1024;
+                    let bodyBuffer = undefined;
+                    if (reqMethod !== "GET" && reqMethod !== "HEAD") {
+                        const chunks = [];
+                        let totalSize = 0;
+                        for await (const chunk of req) {
+                            totalSize += chunk.length;
+                            if (totalSize > maxBodyBytes) {
+                                audit.http(clientIp, reqMethod, hostname, reqUrl, 413, upstreamBase.hostname);
+                                res.writeHead(413, { "Content-Type": "text/html" });
+                                res.end("<h1>413 Payload Too Large</h1>");
+                                return;
+                            }
+                            chunks.push(chunk);
+                        }
+                        if (chunks.length > 0) {
+                            bodyBuffer = Buffer.concat(chunks);
+                        }
+                    }
+                    const proxiedReqInit = {
+                        method: reqMethod,
+                        headers,
+                    };
+                    if (shouldForwardBody && bodyBuffer) {
+                        proxiedReqInit.body = bodyBuffer;
+                        proxiedReqInit.duplex = "half";
+                    }
+                    const proxiedReq = new Request(targetUrl.toString(), proxiedReqInit);
+                    const breaker = this.getCircuitBreaker(upstreamBase.hostname);
+                    const proxyResp = await breaker.execute(() => fetch(proxiedReq));
+                    const responseHeaders = new Headers(proxyResp.headers);
+                    this.injectCustomHeaders(responseHeaders, hostConfig);
+                    const outHeaders = {};
+                    responseHeaders.forEach((value, key) => {
+                        outHeaders[key] = value;
+                    });
+                    audit.http(clientIp, reqMethod, hostname, safePath, proxyResp.status, targetUrl.toString());
+                    res.writeHead(proxyResp.status, outHeaders);
+                    const responseBuffer = Buffer.from(await proxyResp.arrayBuffer());
+                    res.end(responseBuffer);
+                    return;
+                }
+            }
+            if (firewallEngine.evaluateDomain(hostname, this.config.firewall) === "DENY") {
+                audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked by Domain Firewall");
+                res.writeHead(403);
+                res.end("Forbidden");
+                return;
+            }
+            const records = await dns.resolve(hostname);
+            const targetIps = records.filter(ip => typeof ip === "string");
+            if (targetIps.length === 0)
+                throw new Error("NXDOMAIN");
+            const targetIp = targetIps[0];
+            if (firewallEngine.evaluateIp(targetIp, this.config.firewall) === "DENY") {
+                audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked by IP Firewall");
+                res.writeHead(403);
+                res.end("Forbidden");
+                return;
+            }
+            const targetUrl = new URL(reqUrl, `http://${hostname}`);
+            const headers = new Headers();
+            for (const [k, v] of Object.entries(req.headers)) {
+                if (Array.isArray(v))
+                    headers.set(k, v.join(", "));
+                else if (typeof v === "string")
+                    headers.set(k, v);
+            }
+            const proxiedReqInit = { method: reqMethod, headers };
+            if (reqMethod !== "GET" && reqMethod !== "HEAD") {
+                const chunks = [];
+                for await (const chunk of req)
+                    chunks.push(chunk);
+                if (chunks.length > 0) {
+                    proxiedReqInit.body = Buffer.concat(chunks);
+                    proxiedReqInit.duplex = "half";
+                }
+            }
+            const proxiedReq = new Request(targetUrl.toString(), proxiedReqInit);
+            const breaker = this.getCircuitBreaker(targetUrl.hostname);
+            const proxyResp = await breaker.execute(() => fetch(proxiedReq));
+            const outHeaders = {};
+            proxyResp.headers.forEach((value, key) => { outHeaders[key] = value; });
+            audit.http(clientIp, reqMethod, hostname, reqUrl, proxyResp.status, targetIp);
+            res.writeHead(proxyResp.status, outHeaders);
+            res.end(Buffer.from(await proxyResp.arrayBuffer()));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            audit.error(`HTTP request failed: ${message}`);
+            if (message.includes("Security Block") || message.includes("Firewall") || message.includes("Blocked")) {
+                audit.http(clientIp, reqMethod, hostname, reqUrl, 403, "Blocked for Security (SSRF/Firewall)");
+                res.writeHead(403, { "Content-Type": "text/html" });
+                res.end(`<h1>403 Forbidden</h1>`);
+                return;
+            }
+            audit.http(clientIp, reqMethod, hostname, reqUrl, 502, "Upstream Offline/Timeout");
+            res.writeHead(502, { "Content-Type": "text/html" });
+            res.end(`<h1>502 Bad Gateway</h1>`);
+            return;
+        }
+    }
+    start() {
+        return new Promise((resolve, reject) => {
+            this.server = http.createServer((req, res) => {
+                this.handleRequest(req, res).catch((err) => {
+                    audit.error(`HTTP interface critical error: ${err}`);
+                    if (!res.headersSent) {
+                        res.writeHead(500, { "Content-Type": "text/html" });
+                        res.end("<h1>500 Internal Server Error</h1>");
+                    }
+                });
+            });
+            this.server.on("connect", (req, clientSocket, head) => {
+                this.handleConnect(req, clientSocket, head).catch((err) => {
+                    audit.error(`TCP CONNECT critical error: ${err}`);
+                    if (!clientSocket.destroyed) {
+                        clientSocket.write('HTTP/1.1 500 Internal Server Error\r\n\r\n');
+                        clientSocket.destroy();
+                    }
+                });
+            });
+            this.server.on("connection", (socket) => {
+                this.activeConnections.add(socket);
+                socket.on("close", () => {
+                    this.activeConnections.delete(socket);
+                });
+            });
+            this.server.on('error', (err) => reject(err));
+            this.server.listen(this.port, "0.0.0.0", () => {
+                audit.system(`L7 Sandbox Firewall routing internally on boundary :${this.port}`);
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        if (this.server) {
+            for (const socket of this.activeConnections) {
+                socket.destroy();
+            }
+            this.activeConnections.clear();
+            if ('closeAllConnections' in this.server) {
+                this.server.closeAllConnections();
+            }
+            await new Promise((resolve) => {
+                this.server.close(() => resolve());
+            });
+            this.server = null;
+        }
+    }
+    getPort() {
+        return this.port;
+    }
+}

package/dist/http-proxy.d.ts

@@ -0,0 +1,14 @@
+import { HostConfig, ProxiedRequest, ModifiedHeaders, FirewallConfig } from "./types.js";
+export declare class HttpProxyService {
+    private isRestrictedCloudMetadata;
+    validateTargetFirewall(targetUrl: string, fw?: FirewallConfig): Promise<void>;
+    getUpstreamHeaders(config: HostConfig, originalRequest: ProxiedRequest): ModifiedHeaders;
+    checkRedirect(config: HostConfig): {
+        code: number;
+        target: string;
+    } | null;
+    sanitizeHeader(value: string): string | null;
+    isValidHeaderName(name: string): boolean;
+    getHopByHopHeaders(): string[];
+    calculateTimeout(config: HostConfig): number;
+}

package/dist/http-proxy.js

@@ -0,0 +1,135 @@
+import * as net from "net";
+import * as dns from "dns/promises";
+import { firewallEngine } from "./firewall.js";
+export class HttpProxyService {
+    isRestrictedCloudMetadata(ip) {
+        if (!net.isIPv4(ip))
+            return false;
+        const parts = ip.split('.').map(Number);
+        return (parts[0] === 169 && parts[1] === 254) || parts[0] === 0;
+    }
+    async validateTargetFirewall(targetUrl, fw) {
+        const parsed = new URL(targetUrl);
+        const host = parsed.hostname;
+        const isLiteralIp = net.isIP(host) !== 0;
+        if (fw && !isLiteralIp) {
+            if (firewallEngine.evaluateDomain(host, fw) === "DENY") {
+                throw new Error(`Domain Blocked: '${host}'`);
+            }
+        }
+        let targetIps = [];
+        if (isLiteralIp) {
+            targetIps = [host];
+        }
+        else {
+            try {
+                const records = await dns.resolve(host);
+                targetIps = records.filter(ip => typeof ip === 'string');
+            }
+            catch {
+                throw new Error(`Resolution Fault: '${host}'`);
+            }
+        }
+        for (const ip of targetIps) {
+            if (this.isRestrictedCloudMetadata(ip)) {
+                throw new Error(`Restricted IP: (${ip})`);
+            }
+            if (fw) {
+                if (firewallEngine.evaluateIp(ip, fw) === "DENY") {
+                    throw new Error(`IP Blocked: ${ip}`);
+                }
+            }
+        }
+    }
+    getUpstreamHeaders(config, originalRequest) {
+        const result = {
+            upstreamHeaders: {},
+            clientResponseHeaders: {},
+        };
+        if (!config.http_proxy || !config.http_proxy.enabled) {
+            return result;
+        }
+        for (const [key, value] of Object.entries(originalRequest.headers)) {
+            const lowerKey = key.toLowerCase();
+            if (!["connection", "keep-alive", "te", "transfer-encoding", "upgrade", "proxy-authorization"].includes(lowerKey)) {
+                result.clientResponseHeaders[key] = value;
+            }
+        }
+        for (const [key, value] of Object.entries(config.http_proxy.headers)) {
+            const sanitized = this.sanitizeHeader(value);
+            if (sanitized) {
+                result.upstreamHeaders[key] = sanitized;
+                result.clientResponseHeaders[key] = sanitized;
+            }
+        }
+        result.clientResponseHeaders["X-Proxy"] = "zonzon";
+        if (config.http_proxy.forwardRequestBody && originalRequest.body) {
+            const maxBodyBytes = config.http_proxy.maxRequestBodyBytes ?? 5 * 1024 * 1024;
+            if (originalRequest.body.length <= maxBodyBytes) {
+                result.upstreamHeaders["X-Body-Forwarded"] = "true";
+                result.upstreamHeaders["X-Body-Size"] = String(originalRequest.body.length);
+            }
+            else {
+                throw new Error(`Payload Limit Exceeded`);
+            }
+        }
+        return result;
+    }
+    checkRedirect(config) {
+        if (!config.redirect || !config.redirect.enabled) {
+            return null;
+        }
+        const { code, target } = config.redirect;
+        if (![301, 302, 303, 307, 308].includes(code)) {
+            return null;
+        }
+        try {
+            const parsed = new URL(target);
+            if (!parsed.protocol || !parsed.hostname) {
+                return null;
+            }
+        }
+        catch {
+            return null;
+        }
+        return { code, target };
+    }
+    sanitizeHeader(value) {
+        if (typeof value !== "string")
+            return null;
+        if (/[\r\n\t]/.test(value))
+            return null;
+        if (/[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(value))
+            return null;
+        if (/%0[dD]/i.test(value) || /%0[aA]/.test(value))
+            return null;
+        if (value.length > 8192)
+            return null;
+        return value;
+    }
+    isValidHeaderName(name) {
+        if (typeof name !== "string" || name.length === 0)
+            return false;
+        if (name.length > 256)
+            return false;
+        return /^[a-zA-Z0-9!#$%&'*+\-.^_`|~]+$/.test(name);
+    }
+    getHopByHopHeaders() {
+        return [
+            "connection",
+            "keep-alive",
+            "proxy-authenticate",
+            "proxy-authorization",
+            "te",
+            "trailer",
+            "transfer-encoding",
+            "upgrade",
+        ];
+    }
+    calculateTimeout(config) {
+        if (config.http_proxy?.enabled) {
+            return Math.max(1000, Math.min(30000, 5000));
+        }
+        return 0;
+    }
+}

package/dist/http-proxy.test.d.ts

@@ -0,0 +1 @@
+export {};