@push.rocks/smartproxy 10.2.0 → 12.0.0

package/ts/smartproxy/classes.pp.portrangemanager.ts

@@ -84,8 +84,10 @@ export class PortRangeManager {
   } | undefined {
     for (let i = 0; i < this.settings.domainConfigs.length; i++) {
       const domain = this.settings.domainConfigs[i];
-      if (domain.portRanges) {
-        for (const range of domain.portRanges) {
+      // Get port ranges from forwarding.advanced if available
+      const portRanges = domain.forwarding?.advanced?.portRanges;
+      if (portRanges && portRanges.length > 0) {
+        for (const range of portRanges) {
           if (port >= range.from && port <= range.to) {
             return { domainIndex: i, range };
           }
@@ -129,17 +131,20 @@ export class PortRangeManager {
     
     // Add domain-specific port ranges
     for (const domain of this.settings.domainConfigs) {
-      if (domain.portRanges) {
-        for (const range of domain.portRanges) {
+      // Get port ranges from forwarding.advanced
+      const portRanges = domain.forwarding?.advanced?.portRanges;
+      if (portRanges && portRanges.length > 0) {
+        for (const range of portRanges) {
           for (let port = range.from; port <= range.to; port++) {
             ports.add(port);
           }
         }
       }
-      
-      // Add domain-specific NetworkProxy port if configured
-      if (domain.useNetworkProxy && domain.networkProxyPort) {
-        ports.add(domain.networkProxyPort);
+
+      // Add domain-specific NetworkProxy port if configured in forwarding.advanced
+      const networkProxyPort = domain.forwarding?.advanced?.networkProxyPort;
+      if (networkProxyPort) {
+        ports.add(networkProxyPort);
       }
     }
     
@@ -170,8 +175,10 @@ export class PortRangeManager {
     
     // Track domain-specific port ranges
     for (const domain of this.settings.domainConfigs) {
-      if (domain.portRanges) {
-        for (const range of domain.portRanges) {
+      // Get port ranges from forwarding.advanced
+      const portRanges = domain.forwarding?.advanced?.portRanges;
+      if (portRanges && portRanges.length > 0) {
+        for (const range of portRanges) {
           for (let port = range.from; port <= range.to; port++) {
             if (!portMappings.has(port)) {
               portMappings.set(port, []);

package/ts/smartproxy/classes.pp.securitymanager.ts

@@ -63,45 +63,69 @@ export class SecurityManager {
   }
   
   /**
-   * Check if an IP is allowed using glob patterns
+   * Check if an IP is authorized using forwarding security rules
+   *
+   * This method is used to determine if an IP is allowed to connect, based on security
+   * rules configured in the forwarding configuration. The allowed and blocked IPs are
+   * typically derived from domain.forwarding.security.allowedIps and blockedIps through
+   * DomainConfigManager.getEffectiveIPRules().
+   *
+   * @param ip - The IP address to check
+   * @param allowedIPs - Array of allowed IP patterns from forwarding.security.allowedIps
+   * @param blockedIPs - Array of blocked IP patterns from forwarding.security.blockedIps
+   * @returns true if IP is authorized, false if blocked
    */
   public isIPAuthorized(ip: string, allowedIPs: string[], blockedIPs: string[] = []): boolean {
     // Skip IP validation if allowedIPs is empty
     if (!ip || (allowedIPs.length === 0 && blockedIPs.length === 0)) {
       return true;
     }
-    
-    // First check if IP is blocked
+
+    // First check if IP is blocked - blocked IPs take precedence
     if (blockedIPs.length > 0 && this.isGlobIPMatch(ip, blockedIPs)) {
       return false;
     }
-    
+
     // Then check if IP is allowed
     return this.isGlobIPMatch(ip, allowedIPs);
   }
   
   /**
-   * Check if the IP matches any of the glob patterns
+   * Check if the IP matches any of the glob patterns from security configuration
+   *
+   * This method checks IP addresses against glob patterns and handles IPv4/IPv6 normalization.
+   * It's used to implement IP filtering based on the forwarding.security configuration.
+   *
+   * @param ip - The IP address to check
+   * @param patterns - Array of glob patterns from forwarding.security.allowedIps or blockedIps
+   * @returns true if IP matches any pattern, false otherwise
    */
   private isGlobIPMatch(ip: string, patterns: string[]): boolean {
     if (!ip || !patterns || patterns.length === 0) return false;
 
+    // Handle IPv4/IPv6 normalization for proper matching
     const normalizeIP = (ip: string): string[] => {
       if (!ip) return [];
+      // Handle IPv4-mapped IPv6 addresses (::ffff:127.0.0.1)
       if (ip.startsWith('::ffff:')) {
         const ipv4 = ip.slice(7);
         return [ip, ipv4];
       }
+      // Handle IPv4 addresses by also checking IPv4-mapped form
       if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
         return [ip, `::ffff:${ip}`];
       }
       return [ip];
     };
 
+    // Normalize the IP being checked
     const normalizedIPVariants = normalizeIP(ip);
     if (normalizedIPVariants.length === 0) return false;
 
+    // Normalize the pattern IPs for consistent comparison
     const expandedPatterns = patterns.flatMap(normalizeIP);
+
+    // Check for any match between normalized IP variants and patterns
     return normalizedIPVariants.some((ipVariant) =>
       expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern))
     );

package/ts/smartproxy/classes.pp.timeoutmanager.ts

@@ -61,9 +61,9 @@ export class TimeoutManager {
    * Calculate effective max lifetime based on connection type
    */
   public getEffectiveMaxLifetime(record: IConnectionRecord): number {
-    // Use domain-specific timeout if available
-    const baseTimeout = record.domainConfig?.connectionTimeout || 
-                        this.settings.maxConnectionLifetime || 
+    // Use domain-specific timeout from forwarding.advanced if available
+    const baseTimeout = record.domainConfig?.forwarding?.advanced?.timeout ||
+                        this.settings.maxConnectionLifetime ||
                         86400000; // 24 hours default
     
     // For immortal keep-alive connections, use an extremely long lifetime

package/ts/smartproxy/classes.smartproxy.ts

@@ -12,6 +12,8 @@ import { Port80Handler } from '../port80handler/classes.port80handler.js';
 import { CertProvisioner } from './classes.pp.certprovisioner.js';
 import type { ICertificateData } from '../common/types.js';
 import { buildPort80Handler } from '../common/acmeFactory.js';
+import type { ForwardingType } from './types/forwarding.types.js';
+import { createPort80HandlerOptions } from '../common/port80-adapter.js';
 
 import type { ISmartProxyOptions, IDomainConfig } from './classes.pp.interfaces.js';
 export type { ISmartProxyOptions as IPortProxySettings, IDomainConfig };
@@ -156,11 +158,44 @@ export class SmartProxy extends plugins.EventEmitter {
       return;
     }
 
+    // Process domain configs
+    // Note: ensureForwardingConfig is no longer needed since forwarding is now required
+
+    // Initialize domain config manager with the processed configs
+    this.domainConfigManager.updateDomainConfigs(this.settings.domainConfigs);
+
     // Initialize Port80Handler if enabled
     await this.initializePort80Handler();
+
     // Initialize CertProvisioner for unified certificate workflows
     if (this.port80Handler) {
       const acme = this.settings.acme!;
+
+      // Convert domain forwards to use the new forwarding system if possible
+      const domainForwards = acme.domainForwards?.map(f => {
+        // If the domain has a forwarding config in domainConfigs, use that
+        const domainConfig = this.settings.domainConfigs.find(
+          dc => dc.domains.some(d => d === f.domain)
+        );
+
+        if (domainConfig?.forwarding) {
+          return {
+            domain: f.domain,
+            forwardConfig: f.forwardConfig,
+            acmeForwardConfig: f.acmeForwardConfig,
+            sslRedirect: f.sslRedirect || domainConfig.forwarding.http?.redirectToHttps || false
+          };
+        }
+
+        // Otherwise use the existing configuration
+        return {
+          domain: f.domain,
+          forwardConfig: f.forwardConfig,
+          acmeForwardConfig: f.acmeForwardConfig,
+          sslRedirect: f.sslRedirect || false
+        };
+      }) || [];
+
       this.certProvisioner = new CertProvisioner(
         this.settings.domainConfigs,
         this.port80Handler,
@@ -169,13 +204,9 @@ export class SmartProxy extends plugins.EventEmitter {
         acme.renewThresholdDays!,
         acme.renewCheckIntervalHours!,
         acme.autoRenew!,
-        acme.domainForwards?.map(f => ({
-          domain: f.domain,
-          forwardConfig: f.forwardConfig,
-          acmeForwardConfig: f.acmeForwardConfig,
-          sslRedirect: f.sslRedirect || false
-        })) || []
+        domainForwards
       );
+
       this.certProvisioner.on('certificate', (certData) => {
         this.emit('certificate', {
           domain: certData.domain,
@@ -186,6 +217,7 @@ export class SmartProxy extends plugins.EventEmitter {
           isRenewal: certData.isRenewal
         });
       });
+
       await this.certProvisioner.start();
       console.log('CertProvisioner started');
     }
@@ -378,21 +410,41 @@ export class SmartProxy extends plugins.EventEmitter {
    */
   public async updateDomainConfigs(newDomainConfigs: IDomainConfig[]): Promise<void> {
     console.log(`Updating domain configurations (${newDomainConfigs.length} configs)`);
-    
+
     // Update domain configs in DomainConfigManager
     this.domainConfigManager.updateDomainConfigs(newDomainConfigs);
-    
+
     // If NetworkProxy is initialized, resync the configurations
     if (this.networkProxyBridge.getNetworkProxy()) {
       await this.networkProxyBridge.syncDomainConfigsToNetworkProxy();
     }
-    
-    // If Port80Handler is running, provision certificates per new domain
+
+    // If Port80Handler is running, provision certificates based on forwarding type
     if (this.port80Handler && this.settings.acme?.enabled) {
       for (const domainConfig of newDomainConfigs) {
+        // Skip certificate provisioning for http-only or passthrough configs that don't need certs
+        const forwardingType = domainConfig.forwarding.type;
+        const needsCertificate =
+          forwardingType === 'https-terminate-to-http' ||
+          forwardingType === 'https-terminate-to-https';
+
+        // Skip certificate provisioning if ACME is explicitly disabled for this domain
+        const acmeDisabled = domainConfig.forwarding.acme?.enabled === false;
+
+        if (!needsCertificate || acmeDisabled) {
+          if (this.settings.enableDetailedLogging) {
+            console.log(`Skipping certificate provisioning for ${domainConfig.domains.join(', ')} (${forwardingType})`);
+          }
+          continue;
+        }
+
         for (const domain of domainConfig.domains) {
           const isWildcard = domain.includes('*');
           let provision: string | plugins.tsclass.network.ICert = 'http01';
+
+          // Check for ACME forwarding configuration in the domain
+          const forwardAcmeChallenges = domainConfig.forwarding.acme?.forwardChallenges;
+
           if (this.settings.certProvisionFunction) {
             try {
               provision = await this.settings.certProvisionFunction(domain);
@@ -403,16 +455,17 @@ export class SmartProxy extends plugins.EventEmitter {
             console.warn(`Skipping wildcard domain without certProvisionFunction: ${domain}`);
             continue;
           }
+
           if (provision === 'http01') {
             if (isWildcard) {
               console.warn(`Skipping HTTP-01 for wildcard domain: ${domain}`);
               continue;
             }
-            this.port80Handler.addDomain({
-              domainName: domain,
-              sslRedirect: true,
-              acmeMaintenance: true
-            });
+
+            // Create Port80Handler options from the forwarding configuration
+            const port80Config = createPort80HandlerOptions(domain, domainConfig.forwarding);
+
+            this.port80Handler.addDomain(port80Config);
             console.log(`Registered domain ${domain} with Port80Handler for HTTP-01`);
           } else {
             // Static certificate (e.g., DNS-01 provisioned) supports wildcards

package/ts/smartproxy/forwarding/domain-config.ts

@@ -0,0 +1,28 @@
+import type { IForwardConfig } from '../types/forwarding.types.js';
+
+/**
+ * Domain configuration with unified forwarding configuration
+ */
+export interface IDomainConfig {
+  // Core properties - domain patterns
+  domains: string[];
+
+  // Unified forwarding configuration
+  forwarding: IForwardConfig;
+}
+
+/**
+ * Helper function to create a domain configuration
+ */
+export function createDomainConfig(
+  domains: string | string[],
+  forwarding: IForwardConfig
+): IDomainConfig {
+  // Normalize domains to an array
+  const domainArray = Array.isArray(domains) ? domains : [domains];
+
+  return {
+    domains: domainArray,
+    forwarding
+  };
+}

package/ts/smartproxy/forwarding/domain-manager.ts

@@ -0,0 +1,283 @@
+import * as plugins from '../../plugins.js';
+import type { IDomainConfig } from './domain-config.js';
+import type { IForwardingHandler } from '../types/forwarding.types.js';
+import { ForwardingHandlerEvents } from '../types/forwarding.types.js';
+import { ForwardingHandlerFactory } from './forwarding.factory.js';
+
+/**
+ * Events emitted by the DomainManager
+ */
+export enum DomainManagerEvents {
+  DOMAIN_ADDED = 'domain-added',
+  DOMAIN_REMOVED = 'domain-removed',
+  DOMAIN_MATCHED = 'domain-matched',
+  DOMAIN_MATCH_FAILED = 'domain-match-failed',
+  CERTIFICATE_NEEDED = 'certificate-needed',
+  CERTIFICATE_LOADED = 'certificate-loaded',
+  ERROR = 'error'
+}
+
+/**
+ * Manages domains and their forwarding handlers
+ */
+export class DomainManager extends plugins.EventEmitter {
+  private domainConfigs: IDomainConfig[] = [];
+  private domainHandlers: Map<string, IForwardingHandler> = new Map();
+  
+  /**
+   * Create a new DomainManager
+   * @param initialDomains Optional initial domain configurations
+   */
+  constructor(initialDomains?: IDomainConfig[]) {
+    super();
+    
+    if (initialDomains) {
+      this.setDomainConfigs(initialDomains);
+    }
+  }
+  
+  /**
+   * Set or replace all domain configurations
+   * @param configs Array of domain configurations
+   */
+  public async setDomainConfigs(configs: IDomainConfig[]): Promise<void> {
+    // Clear existing handlers
+    this.domainHandlers.clear();
+    
+    // Store new configurations
+    this.domainConfigs = [...configs];
+    
+    // Initialize handlers for each domain
+    for (const config of this.domainConfigs) {
+      await this.createHandlersForDomain(config);
+    }
+  }
+  
+  /**
+   * Add a new domain configuration
+   * @param config The domain configuration to add
+   */
+  public async addDomainConfig(config: IDomainConfig): Promise<void> {
+    // Check if any of these domains already exist
+    for (const domain of config.domains) {
+      if (this.domainHandlers.has(domain)) {
+        // Remove existing handler for this domain
+        this.domainHandlers.delete(domain);
+      }
+    }
+    
+    // Add the new configuration
+    this.domainConfigs.push(config);
+    
+    // Create handlers for the new domain
+    await this.createHandlersForDomain(config);
+    
+    this.emit(DomainManagerEvents.DOMAIN_ADDED, {
+      domains: config.domains,
+      forwardingType: config.forwarding.type
+    });
+  }
+  
+  /**
+   * Remove a domain configuration
+   * @param domain The domain to remove
+   * @returns True if the domain was found and removed
+   */
+  public removeDomainConfig(domain: string): boolean {
+    // Find the config that includes this domain
+    const index = this.domainConfigs.findIndex(config => 
+      config.domains.includes(domain)
+    );
+    
+    if (index === -1) {
+      return false;
+    }
+    
+    // Get the config
+    const config = this.domainConfigs[index];
+    
+    // Remove all handlers for this config
+    for (const domainName of config.domains) {
+      this.domainHandlers.delete(domainName);
+    }
+    
+    // Remove the config
+    this.domainConfigs.splice(index, 1);
+    
+    this.emit(DomainManagerEvents.DOMAIN_REMOVED, {
+      domains: config.domains
+    });
+    
+    return true;
+  }
+  
+  /**
+   * Find the handler for a domain
+   * @param domain The domain to find a handler for
+   * @returns The handler or undefined if no match
+   */
+  public findHandlerForDomain(domain: string): IForwardingHandler | undefined {
+    // Try exact match
+    if (this.domainHandlers.has(domain)) {
+      return this.domainHandlers.get(domain);
+    }
+    
+    // Try wildcard matches
+    const wildcardHandler = this.findWildcardHandler(domain);
+    if (wildcardHandler) {
+      return wildcardHandler;
+    }
+    
+    // No match found
+    return undefined;
+  }
+  
+  /**
+   * Handle a connection for a domain
+   * @param domain The domain
+   * @param socket The client socket
+   * @returns True if the connection was handled
+   */
+  public handleConnection(domain: string, socket: plugins.net.Socket): boolean {
+    const handler = this.findHandlerForDomain(domain);
+    
+    if (!handler) {
+      this.emit(DomainManagerEvents.DOMAIN_MATCH_FAILED, {
+        domain,
+        remoteAddress: socket.remoteAddress
+      });
+      return false;
+    }
+    
+    this.emit(DomainManagerEvents.DOMAIN_MATCHED, {
+      domain,
+      handlerType: handler.constructor.name,
+      remoteAddress: socket.remoteAddress
+    });
+    
+    // Handle the connection
+    handler.handleConnection(socket);
+    return true;
+  }
+  
+  /**
+   * Handle an HTTP request for a domain
+   * @param domain The domain
+   * @param req The HTTP request
+   * @param res The HTTP response
+   * @returns True if the request was handled
+   */
+  public handleHttpRequest(domain: string, req: plugins.http.IncomingMessage, res: plugins.http.ServerResponse): boolean {
+    const handler = this.findHandlerForDomain(domain);
+    
+    if (!handler) {
+      this.emit(DomainManagerEvents.DOMAIN_MATCH_FAILED, {
+        domain,
+        remoteAddress: req.socket.remoteAddress
+      });
+      return false;
+    }
+    
+    this.emit(DomainManagerEvents.DOMAIN_MATCHED, {
+      domain,
+      handlerType: handler.constructor.name,
+      remoteAddress: req.socket.remoteAddress
+    });
+    
+    // Handle the request
+    handler.handleHttpRequest(req, res);
+    return true;
+  }
+  
+  /**
+   * Create handlers for a domain configuration
+   * @param config The domain configuration
+   */
+  private async createHandlersForDomain(config: IDomainConfig): Promise<void> {
+    try {
+      // Create a handler for this forwarding configuration
+      const handler = ForwardingHandlerFactory.createHandler(config.forwarding);
+      
+      // Initialize the handler
+      await handler.initialize();
+      
+      // Set up event forwarding
+      this.setupHandlerEvents(handler, config);
+      
+      // Store the handler for each domain in the config
+      for (const domain of config.domains) {
+        this.domainHandlers.set(domain, handler);
+      }
+    } catch (error) {
+      this.emit(DomainManagerEvents.ERROR, {
+        domains: config.domains,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  
+  /**
+   * Set up event forwarding from a handler
+   * @param handler The handler
+   * @param config The domain configuration for this handler
+   */
+  private setupHandlerEvents(handler: IForwardingHandler, config: IDomainConfig): void {
+    // Forward relevant events
+    handler.on(ForwardingHandlerEvents.CERTIFICATE_NEEDED, (data) => {
+      this.emit(DomainManagerEvents.CERTIFICATE_NEEDED, {
+        ...data,
+        domains: config.domains
+      });
+    });
+    
+    handler.on(ForwardingHandlerEvents.CERTIFICATE_LOADED, (data) => {
+      this.emit(DomainManagerEvents.CERTIFICATE_LOADED, {
+        ...data,
+        domains: config.domains
+      });
+    });
+    
+    handler.on(ForwardingHandlerEvents.ERROR, (data) => {
+      this.emit(DomainManagerEvents.ERROR, {
+        ...data,
+        domains: config.domains
+      });
+    });
+  }
+  
+  /**
+   * Find a handler for a domain using wildcard matching
+   * @param domain The domain to find a handler for
+   * @returns The handler or undefined if no match
+   */
+  private findWildcardHandler(domain: string): IForwardingHandler | undefined {
+    // Exact match already checked in findHandlerForDomain
+    
+    // Try subdomain wildcard (*.example.com)
+    if (domain.includes('.')) {
+      const parts = domain.split('.');
+      if (parts.length > 2) {
+        const wildcardDomain = `*.${parts.slice(1).join('.')}`;
+        if (this.domainHandlers.has(wildcardDomain)) {
+          return this.domainHandlers.get(wildcardDomain);
+        }
+      }
+    }
+    
+    // Try full wildcard
+    if (this.domainHandlers.has('*')) {
+      return this.domainHandlers.get('*');
+    }
+    
+    // No match found
+    return undefined;
+  }
+  
+  /**
+   * Get all domain configurations
+   * @returns Array of domain configurations
+   */
+  public getDomainConfigs(): IDomainConfig[] {
+    return [...this.domainConfigs];
+  }
+}