@push.rocks/smartproxy 10.2.0 → 11.0.0

package/ts/examples/forwarding-example.ts

@@ -0,0 +1,128 @@
+import * as plugins from '../plugins.js';
+import { createServer } from 'http';
+import { Socket } from 'net';
+import {
+  DomainManager,
+  DomainManagerEvents,
+  createDomainConfig,
+  helpers
+} from '../smartproxy/forwarding/index.js';
+
+/**
+ * Example showing how to use the unified forwarding system
+ */
+async function main() {
+  console.log('Initializing forwarding example...');
+  
+  // Create the domain manager
+  const domainManager = new DomainManager();
+  
+  // Set up event listeners
+  domainManager.on(DomainManagerEvents.DOMAIN_ADDED, (data) => {
+    console.log(`Domain added: ${data.domains.join(', ')} (${data.forwardingType})`);
+  });
+  
+  domainManager.on(DomainManagerEvents.DOMAIN_MATCHED, (data) => {
+    console.log(`Domain matched: ${data.domain} (${data.handlerType})`);
+  });
+  
+  domainManager.on(DomainManagerEvents.DOMAIN_MATCH_FAILED, (data) => {
+    console.log(`Domain match failed: ${data.domain}`);
+  });
+  
+  domainManager.on(DomainManagerEvents.ERROR, (data) => {
+    console.error(`Error:`, data);
+  });
+  
+  // Add example domains with different forwarding types
+  
+  // Example 1: HTTP-only forwarding
+  await domainManager.addDomainConfig(
+    createDomainConfig('example.com', helpers.httpOnly({
+      target: { host: 'localhost', port: 3000 }
+    }))
+  );
+
+  // Example 2: HTTPS termination with HTTP backend
+  await domainManager.addDomainConfig(
+    createDomainConfig('secure.example.com', helpers.tlsTerminateToHttp({
+      target: { host: 'localhost', port: 3000 }
+    }))
+  );
+
+  // Example 3: HTTPS termination with HTTPS backend
+  await domainManager.addDomainConfig(
+    createDomainConfig('api.example.com', helpers.tlsTerminateToHttps({
+      target: { host: 'localhost', port: 8443 }
+    }))
+  );
+
+  // Example 4: SNI passthrough
+  await domainManager.addDomainConfig(
+    createDomainConfig('passthrough.example.com', helpers.sniPassthrough({
+      target: { host: '10.0.0.5', port: 443 }
+    }))
+  );
+  
+  // Example 5: Custom configuration for a more complex setup
+  await domainManager.addDomainConfig(
+    createDomainConfig(['*.example.com', '*.example.org'], {
+      type: 'https-terminate-to-http',
+      target: {
+        host: ['10.0.0.10', '10.0.0.11'], // Round-robin load balancing
+        port: 8080
+      },
+      http: {
+        enabled: true,
+        redirectToHttps: false // Allow both HTTP and HTTPS
+      },
+      acme: {
+        enabled: true,
+        maintenance: true,
+        production: false,  // Use staging for testing
+        forwardChallenges: {
+          host: '192.168.1.100',
+          port: 8080
+        }
+      },
+      security: {
+        allowedIps: ['10.0.0.*', '192.168.1.*'],
+        maxConnections: 100
+      },
+      advanced: {
+        headers: {
+          'X-Forwarded-For': '{clientIp}',
+          'X-Forwarded-Host': '{sni}'
+        }
+      }
+    })
+  );
+  
+  // Create a simple HTTP server to demonstrate HTTP handler
+  const httpServer = createServer((req, res) => {
+    // Extract the domain from the Host header
+    const domain = req.headers.host?.split(':')[0] || 'unknown';
+    
+    // Forward the request to the appropriate handler
+    if (!domainManager.handleHttpRequest(domain, req, res)) {
+      // No handler found, send a default response
+      res.statusCode = 404;
+      res.end(`No handler found for domain: ${domain}`);
+    }
+  });
+  
+  // Listen on HTTP port
+  httpServer.listen(80, () => {
+    console.log('HTTP server listening on port 80');
+  });
+  
+  // For HTTPS and SNI, we would need to set up a TLS server
+  // This is a simplified example that just shows how the domain manager works
+  
+  console.log('Forwarding example initialized successfully');
+}
+
+// Run the example
+main().catch(error => {
+  console.error('Error running example:', error);
+});

package/ts/index.ts

@@ -7,3 +7,6 @@ export * from './smartproxy/classes.pp.snihandler.js';
 export * from './smartproxy/classes.pp.interfaces.js';
 
 export * from './common/types.js';
+
+// Export forwarding system
+export * as forwarding from './smartproxy/forwarding/index.js';

package/ts/smartproxy/classes.pp.connectionhandler.ts

@@ -11,6 +11,8 @@ import { TlsManager } from './classes.pp.tlsmanager.js';
 import { NetworkProxyBridge } from './classes.pp.networkproxybridge.js';
 import { TimeoutManager } from './classes.pp.timeoutmanager.js';
 import { PortRangeManager } from './classes.pp.portrangemanager.js';
+import type { IForwardingHandler } from './types/forwarding.types.js';
+import type { ForwardingType } from './types/forwarding.types.js';
 
 /**
  * Handles new connection processing and setup logic
@@ -176,37 +178,73 @@ export class ConnectionHandler {
             destPort: socket.localPort || 0,
           };
 
-          // Extract SNI for domain-specific NetworkProxy handling if available
+          // Extract SNI for domain-specific forwarding if available
           const serverName = this.tlsManager.extractSNI(chunk, connInfo);
 
           // For NetworkProxy connections, we'll allow session tickets even without SNI
-          // We'll only use the serverName if available to determine the specific NetworkProxy port
+          // We'll only use the serverName if available to determine the specific forwarding
           if (serverName) {
             // Save domain config and SNI in connection record
             const domainConfig = this.domainConfigManager.findDomainConfig(serverName);
             record.domainConfig = domainConfig;
             record.lockedDomain = serverName;
 
-            // Use domain-specific NetworkProxy port if configured
-            if (domainConfig && this.domainConfigManager.shouldUseNetworkProxy(domainConfig)) {
-              const networkProxyPort = this.domainConfigManager.getNetworkProxyPort(domainConfig);
+            // If we have a domain config and it has a forwarding config
+            if (domainConfig) {
+              try {
+                // Get the forwarding type for this domain
+                const forwardingType = this.domainConfigManager.getForwardingType(domainConfig);
+
+                // For TLS termination types, use NetworkProxy
+                if (forwardingType === 'https-terminate-to-http' ||
+                    forwardingType === 'https-terminate-to-https') {
+                  const networkProxyPort = this.domainConfigManager.getNetworkProxyPort(domainConfig);
+
+                  if (this.settings.enableDetailedLogging) {
+                    console.log(
+                      `[${connectionId}] Using TLS termination (${forwardingType}) for ${serverName} on port ${networkProxyPort}`
+                    );
+                  }
+
+                  // Forward to NetworkProxy with domain-specific port
+                  this.networkProxyBridge.forwardToNetworkProxy(
+                    connectionId,
+                    socket,
+                    record,
+                    chunk,
+                    networkProxyPort,
+                    (reason) => this.connectionManager.initiateCleanupOnce(record, reason)
+                  );
+                  return;
+                }
 
-              if (this.settings.enableDetailedLogging) {
-                console.log(
-                  `[${connectionId}] Using domain-specific NetworkProxy for ${serverName} on port ${networkProxyPort}`
-                );
-              }
+                // For HTTPS passthrough, use the forwarding handler directly
+                if (forwardingType === 'https-passthrough') {
+                  const handler = this.domainConfigManager.getForwardingHandler(domainConfig);
 
-              // Forward to NetworkProxy with domain-specific port
-              this.networkProxyBridge.forwardToNetworkProxy(
-                connectionId,
-                socket,
-                record,
-                chunk,
-                networkProxyPort,
-                (reason) => this.connectionManager.initiateCleanupOnce(record, reason)
-              );
-              return;
+                  if (this.settings.enableDetailedLogging) {
+                    console.log(
+                      `[${connectionId}] Using forwarding handler for SNI passthrough to ${serverName}`
+                    );
+                  }
+
+                  // Handle the connection using the handler
+                  handler.handleConnection(socket);
+
+                  return;
+                }
+
+                // For HTTP-only, we shouldn't get TLS connections
+                if (forwardingType === 'http-only') {
+                  console.log(`[${connectionId}] Received TLS connection for HTTP-only domain ${serverName}`);
+                  socket.end();
+                  this.connectionManager.cleanupConnection(record, 'wrong_protocol');
+                  return;
+                }
+              } catch (err) {
+                console.log(`[${connectionId}] Error using forwarding handler: ${err}`);
+                // Fall through to default NetworkProxy handling
+              }
             }
           } else if (
             this.settings.allowSessionTicket === false &&
@@ -229,10 +267,38 @@ export class ConnectionHandler {
           (reason) => this.connectionManager.initiateCleanupOnce(record, reason)
         );
       } else {
-        // If not TLS, use normal direct connection
+        // If not TLS, handle as plain HTTP
         console.log(
           `[${connectionId}] Non-TLS connection on NetworkProxy port ${record.localPort}`
         );
+
+        // Check if we have a domain config based on port
+        const portBasedDomainConfig = this.domainConfigManager.findDomainConfigForPort(record.localPort);
+
+        if (portBasedDomainConfig) {
+          try {
+            // If this domain supports HTTP via a forwarding handler, use it
+            if (this.domainConfigManager.supportsHttp(portBasedDomainConfig)) {
+              const handler = this.domainConfigManager.getForwardingHandler(portBasedDomainConfig);
+
+              if (this.settings.enableDetailedLogging) {
+                console.log(
+                  `[${connectionId}] Using forwarding handler for non-TLS connection to port ${record.localPort}`
+                );
+              }
+
+              // Handle the connection using the handler
+              handler.handleConnection(socket);
+
+              return;
+            }
+          } catch (err) {
+            console.log(`[${connectionId}] Error using forwarding handler for HTTP: ${err}`);
+            // Fall through to direct connection
+          }
+        }
+
+        // Use legacy direct connection as fallback
         this.setupDirectConnection(socket, record, undefined, undefined, chunk);
       }
     });
@@ -380,9 +446,8 @@ export class ConnectionHandler {
       if (domainConfig) {
         const ipRules = this.domainConfigManager.getEffectiveIPRules(domainConfig);
 
-        // Skip IP validation if allowedIPs is empty
+        // Perform IP validation using security rules
         if (
-          domainConfig.allowedIPs.length > 0 &&
           !this.securityManager.isIPAuthorized(
             record.remoteIP,
             ipRules.allowedIPs,
@@ -431,10 +496,31 @@ export class ConnectionHandler {
     // Only apply port-based rules if the incoming port is within one of the global port ranges.
     if (this.portRangeManager.isPortInGlobalRanges(localPort)) {
       if (this.portRangeManager.shouldUseGlobalForwarding(localPort)) {
+        // Create a virtual domain config for global forwarding with security settings
+        const globalDomainConfig = {
+          domains: ['global'],
+          forwarding: {
+            type: 'http-only' as ForwardingType,
+            target: {
+              host: this.settings.targetIP!,
+              port: this.settings.toPort
+            },
+            security: {
+              allowedIps: this.settings.defaultAllowedIPs || [],
+              blockedIps: this.settings.defaultBlockedIPs || []
+            }
+          },
+        };
+
+        // Use the same IP filtering mechanism as domain-specific configs
+        const ipRules = this.domainConfigManager.getEffectiveIPRules(globalDomainConfig);
+
         if (
-          this.settings.defaultAllowedIPs &&
-          this.settings.defaultAllowedIPs.length > 0 &&
-          !this.securityManager.isIPAuthorized(record.remoteIP, this.settings.defaultAllowedIPs)
+          !this.securityManager.isIPAuthorized(
+            record.remoteIP,
+            ipRules.allowedIPs,
+            ipRules.blockedIPs
+          )
         ) {
           console.log(
             `[${connectionId}] Connection from ${record.remoteIP} rejected: IP ${record.remoteIP} not allowed in global default allowed list.`
@@ -442,29 +528,21 @@ export class ConnectionHandler {
           socket.end();
           return;
         }
+
         if (this.settings.enableDetailedLogging) {
           console.log(
             `[${connectionId}] Port-based connection from ${record.remoteIP} on port ${localPort} forwarded to global target IP ${this.settings.targetIP}.`
           );
         }
-        setupConnection(
-          '',
-          undefined,
-          {
-            domains: ['global'],
-            allowedIPs: this.settings.defaultAllowedIPs || [],
-            blockedIPs: this.settings.defaultBlockedIPs || [],
-            targetIPs: [this.settings.targetIP!],
-            portRanges: [],
-          },
-          localPort
-        );
+
+        setupConnection('', undefined, globalDomainConfig, localPort);
         return;
       } else {
         // Attempt to find a matching forced domain config based on the local port.
         const forcedDomain = this.domainConfigManager.findDomainConfigForPort(localPort);
 
         if (forcedDomain) {
+          // Get effective IP rules from the domain config's forwarding security settings
           const ipRules = this.domainConfigManager.getEffectiveIPRules(forcedDomain);
 
           if (
@@ -624,10 +702,18 @@ export class ConnectionHandler {
       initialDataReceived = true;
       record.hasReceivedInitialData = true;
 
-      if (
-        this.settings.defaultAllowedIPs &&
-        this.settings.defaultAllowedIPs.length > 0 &&
-        !this.securityManager.isIPAuthorized(record.remoteIP, this.settings.defaultAllowedIPs)
+      // Create default security settings for non-SNI connections
+      const defaultSecurity = {
+        allowedIPs: this.settings.defaultAllowedIPs || [],
+        blockedIPs: this.settings.defaultBlockedIPs || []
+      };
+
+      if (defaultSecurity.allowedIPs.length > 0 &&
+          !this.securityManager.isIPAuthorized(
+            record.remoteIP,
+            defaultSecurity.allowedIPs,
+            defaultSecurity.blockedIPs
+          )
       ) {
         return rejectIncomingConnection(
           'rejected',
@@ -652,13 +738,99 @@ export class ConnectionHandler {
   ): void {
     const connectionId = record.id;
 
+    // If we have a domain config, try to use a forwarding handler
+    if (domainConfig) {
+      try {
+        // Get the forwarding handler for this domain
+        const forwardingHandler = this.domainConfigManager.getForwardingHandler(domainConfig);
+
+        // Check the forwarding type to determine how to handle the connection
+        const forwardingType = this.domainConfigManager.getForwardingType(domainConfig);
+
+        // For TLS connections, handle differently based on forwarding type
+        if (record.isTLS) {
+          // For HTTP-only, we shouldn't get TLS connections
+          if (forwardingType === 'http-only') {
+            console.log(`[${connectionId}] Received TLS connection for HTTP-only domain ${serverName || 'unknown'}`);
+            socket.end();
+            this.connectionManager.initiateCleanupOnce(record, 'wrong_protocol');
+            return;
+          }
+
+          // For HTTPS passthrough, use the handler's connection handling
+          if (forwardingType === 'https-passthrough') {
+            // If there's initial data, process it first
+            if (initialChunk) {
+              record.bytesReceived += initialChunk.length;
+            }
+
+            // Let the handler take over
+            if (this.settings.enableDetailedLogging) {
+              console.log(`[${connectionId}] Using forwarding handler for ${forwardingType} connection to ${serverName || 'unknown'}`);
+            }
+
+            // Pass the connection to the handler
+            forwardingHandler.handleConnection(socket);
+
+            // Set metadata fields
+            record.usingNetworkProxy = false;
+
+            // Add connection information to record
+            if (serverName) {
+              record.lockedDomain = serverName;
+            }
+
+            return;
+          }
+
+          // For TLS termination types, we'll fall through to the legacy connection setup
+          // because NetworkProxy is used for termination
+        }
+        // For non-TLS connections, check if we support HTTP
+        else if (!record.isTLS && this.domainConfigManager.supportsHttp(domainConfig)) {
+          // For HTTP handling that the handler supports natively
+          if (forwardingType === 'http-only' ||
+              (forwardingType === 'https-terminate-to-http' || forwardingType === 'https-terminate-to-https')) {
+
+            // If there's redirect to HTTPS configured and this is a normal HTTP connection
+            if (this.domainConfigManager.shouldRedirectToHttps(domainConfig)) {
+              // We'll let the handler deal with the HTTP request and potential redirect
+              // Once an HTTP request arrives, it can redirect as needed
+            }
+
+            // Let the handler take over for HTTP handling
+            if (this.settings.enableDetailedLogging) {
+              console.log(`[${connectionId}] Using forwarding handler for HTTP connection to ${serverName || 'unknown'}`);
+            }
+
+            // Pass the connection to the handler
+            forwardingHandler.handleConnection(socket);
+
+            // Add connection information to record
+            if (serverName) {
+              record.lockedDomain = serverName;
+            }
+
+            return;
+          }
+        }
+      } catch (err) {
+        console.log(`[${connectionId}] Error using forwarding handler: ${err}`);
+        // Fall through to legacy connection handling
+      }
+    }
+
+    // If we get here, we'll use legacy connection handling
+
     // Determine target host
     const targetHost = domainConfig
       ? this.domainConfigManager.getTargetIP(domainConfig)
       : this.settings.targetIP!;
 
-    // Determine target port
-    const targetPort = overridePort !== undefined ? overridePort : this.settings.toPort;
+    // Determine target port - first try forwarding config, then fallback
+    const targetPort = domainConfig
+      ? this.domainConfigManager.getTargetPort(domainConfig, overridePort !== undefined ? overridePort : this.settings.toPort)
+      : (overridePort !== undefined ? overridePort : this.settings.toPort);
 
     // Setup connection options
     const connectionOptions: plugins.net.NetConnectOpts = {
@@ -842,6 +1014,21 @@ export class ConnectionHandler {
         this.connectionManager.incrementTerminationStat('outgoing', 'connection_failed');
       }
 
+      // If we have a forwarding handler for this domain, let it handle the error
+      if (domainConfig) {
+        try {
+          const forwardingHandler = this.domainConfigManager.getForwardingHandler(domainConfig);
+          forwardingHandler.emit('connection_error', {
+            socket,
+            error: err,
+            connectionId
+          });
+        } catch (handlerErr) {
+          // If getting the handler fails, just log and continue with normal cleanup
+          console.log(`Error getting forwarding handler for error handling: ${handlerErr}`);
+        }
+      }
+
       // Clean up the connection
       this.connectionManager.initiateCleanupOnce(record, `connection_failed_${code}`);
     });