@push.rocks/smartproxy 12.0.0 → 13.1.2

package/ts/tls/utils/tls-utils.ts

@@ -0,0 +1,201 @@
+import * as plugins from '../../plugins.js';
+
+/**
+ * TLS record types as defined in various RFCs
+ */
+export enum TlsRecordType {
+  CHANGE_CIPHER_SPEC = 20,
+  ALERT = 21,
+  HANDSHAKE = 22,
+  APPLICATION_DATA = 23,
+  HEARTBEAT = 24, // RFC 6520
+}
+
+/**
+ * TLS handshake message types
+ */
+export enum TlsHandshakeType {
+  HELLO_REQUEST = 0,
+  CLIENT_HELLO = 1,
+  SERVER_HELLO = 2,
+  NEW_SESSION_TICKET = 4,
+  ENCRYPTED_EXTENSIONS = 8, // TLS 1.3
+  CERTIFICATE = 11,
+  SERVER_KEY_EXCHANGE = 12,
+  CERTIFICATE_REQUEST = 13,
+  SERVER_HELLO_DONE = 14,
+  CERTIFICATE_VERIFY = 15,
+  CLIENT_KEY_EXCHANGE = 16,
+  FINISHED = 20,
+}
+
+/**
+ * TLS extension types
+ */
+export enum TlsExtensionType {
+  SERVER_NAME = 0, // SNI
+  MAX_FRAGMENT_LENGTH = 1,
+  CLIENT_CERTIFICATE_URL = 2,
+  TRUSTED_CA_KEYS = 3,
+  TRUNCATED_HMAC = 4,
+  STATUS_REQUEST = 5, // OCSP
+  SUPPORTED_GROUPS = 10, // Previously named "elliptic_curves"
+  EC_POINT_FORMATS = 11,
+  SIGNATURE_ALGORITHMS = 13,
+  APPLICATION_LAYER_PROTOCOL_NEGOTIATION = 16, // ALPN
+  SIGNED_CERTIFICATE_TIMESTAMP = 18, // Certificate Transparency
+  PADDING = 21,
+  SESSION_TICKET = 35,
+  PRE_SHARED_KEY = 41, // TLS 1.3
+  EARLY_DATA = 42, // TLS 1.3 0-RTT
+  SUPPORTED_VERSIONS = 43, // TLS 1.3
+  COOKIE = 44, // TLS 1.3
+  PSK_KEY_EXCHANGE_MODES = 45, // TLS 1.3
+  CERTIFICATE_AUTHORITIES = 47, // TLS 1.3
+  POST_HANDSHAKE_AUTH = 49, // TLS 1.3
+  SIGNATURE_ALGORITHMS_CERT = 50, // TLS 1.3
+  KEY_SHARE = 51, // TLS 1.3
+}
+
+/**
+ * TLS alert levels
+ */
+export enum TlsAlertLevel {
+  WARNING = 1,
+  FATAL = 2,
+}
+
+/**
+ * TLS alert description codes
+ */
+export enum TlsAlertDescription {
+  CLOSE_NOTIFY = 0,
+  UNEXPECTED_MESSAGE = 10,
+  BAD_RECORD_MAC = 20,
+  DECRYPTION_FAILED = 21, // TLS 1.0 only
+  RECORD_OVERFLOW = 22,
+  DECOMPRESSION_FAILURE = 30, // TLS 1.2 and below
+  HANDSHAKE_FAILURE = 40,
+  NO_CERTIFICATE = 41, // SSLv3 only
+  BAD_CERTIFICATE = 42,
+  UNSUPPORTED_CERTIFICATE = 43,
+  CERTIFICATE_REVOKED = 44,
+  CERTIFICATE_EXPIRED = 45,
+  CERTIFICATE_UNKNOWN = 46,
+  ILLEGAL_PARAMETER = 47,
+  UNKNOWN_CA = 48,
+  ACCESS_DENIED = 49,
+  DECODE_ERROR = 50,
+  DECRYPT_ERROR = 51,
+  EXPORT_RESTRICTION = 60, // TLS 1.0 only
+  PROTOCOL_VERSION = 70,
+  INSUFFICIENT_SECURITY = 71,
+  INTERNAL_ERROR = 80,
+  INAPPROPRIATE_FALLBACK = 86,
+  USER_CANCELED = 90,
+  NO_RENEGOTIATION = 100, // TLS 1.2 and below
+  MISSING_EXTENSION = 109, // TLS 1.3
+  UNSUPPORTED_EXTENSION = 110, // TLS 1.3
+  CERTIFICATE_REQUIRED = 111, // TLS 1.3
+  UNRECOGNIZED_NAME = 112,
+  BAD_CERTIFICATE_STATUS_RESPONSE = 113,
+  BAD_CERTIFICATE_HASH_VALUE = 114, // TLS 1.2 and below
+  UNKNOWN_PSK_IDENTITY = 115,
+  CERTIFICATE_REQUIRED_1_3 = 116, // TLS 1.3
+  NO_APPLICATION_PROTOCOL = 120,
+}
+
+/**
+ * TLS version codes (major.minor)
+ */
+export const TlsVersion = {
+  SSL3: [0x03, 0x00],
+  TLS1_0: [0x03, 0x01],
+  TLS1_1: [0x03, 0x02],
+  TLS1_2: [0x03, 0x03],
+  TLS1_3: [0x03, 0x04],
+};
+
+/**
+ * Utility functions for TLS protocol operations
+ */
+export class TlsUtils {
+  /**
+   * Checks if a buffer contains a TLS handshake record
+   * @param buffer The buffer to check
+   * @returns true if the buffer starts with a TLS handshake record
+   */
+  public static isTlsHandshake(buffer: Buffer): boolean {
+    return buffer.length > 0 && buffer[0] === TlsRecordType.HANDSHAKE;
+  }
+  
+  /**
+   * Checks if a buffer contains TLS application data
+   * @param buffer The buffer to check
+   * @returns true if the buffer starts with a TLS application data record
+   */
+  public static isTlsApplicationData(buffer: Buffer): boolean {
+    return buffer.length > 0 && buffer[0] === TlsRecordType.APPLICATION_DATA;
+  }
+  
+  /**
+   * Checks if a buffer contains a TLS alert record
+   * @param buffer The buffer to check
+   * @returns true if the buffer starts with a TLS alert record
+   */
+  public static isTlsAlert(buffer: Buffer): boolean {
+    return buffer.length > 0 && buffer[0] === TlsRecordType.ALERT;
+  }
+  
+  /**
+   * Checks if a buffer contains a TLS ClientHello message
+   * @param buffer The buffer to check
+   * @returns true if the buffer appears to be a ClientHello message
+   */
+  public static isClientHello(buffer: Buffer): boolean {
+    // Minimum ClientHello size (TLS record header + handshake header)
+    if (buffer.length < 9) {
+      return false;
+    }
+    
+    // Check record type (must be TLS_HANDSHAKE_RECORD_TYPE)
+    if (buffer[0] !== TlsRecordType.HANDSHAKE) {
+      return false;
+    }
+    
+    // Skip version and length in TLS record header (5 bytes total)
+    // Check handshake type at byte 5 (must be CLIENT_HELLO)
+    return buffer[5] === TlsHandshakeType.CLIENT_HELLO;
+  }
+  
+  /**
+   * Gets the record length from a TLS record header
+   * @param buffer Buffer containing a TLS record
+   * @returns The record length if the buffer is valid, -1 otherwise
+   */
+  public static getTlsRecordLength(buffer: Buffer): number {
+    if (buffer.length < 5) {
+      return -1;
+    }
+    
+    // Bytes 3-4 contain the record length (big-endian)
+    return (buffer[3] << 8) + buffer[4];
+  }
+  
+  /**
+   * Creates a connection ID based on source/destination information
+   * Used to track fragmented ClientHello messages across multiple packets
+   *
+   * @param connectionInfo Object containing connection identifiers
+   * @returns A string ID for the connection
+   */
+  public static createConnectionId(connectionInfo: {
+    sourceIp?: string;
+    sourcePort?: number;
+    destIp?: string;
+    destPort?: number;
+  }): string {
+    const { sourceIp, sourcePort, destIp, destPort } = connectionInfo;
+    return `${sourceIp}:${sourcePort}-${destIp}:${destPort}`;
+  }
+}

package/ts/common/acmeFactory.ts

@@ -1,23 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import type { IAcmeOptions } from './types.js';
-import { Port80Handler } from '../port80handler/classes.port80handler.js';
-
-/**
- * Factory to create a Port80Handler with common setup.
- * Ensures the certificate store directory exists and instantiates the handler.
- * @param options Port80Handler configuration options
- * @returns A new Port80Handler instance
- */
-export function buildPort80Handler(
-  options: IAcmeOptions
-): Port80Handler {
-  if (options.certificateStore) {
-    const certStorePath = path.resolve(options.certificateStore);
-    if (!fs.existsSync(certStorePath)) {
-      fs.mkdirSync(certStorePath, { recursive: true });
-      console.log(`Created certificate store directory: ${certStorePath}`);
-    }
-  }
-  return new Port80Handler(options);
-}

package/ts/helpers.certificates.ts

@@ -1,30 +0,0 @@
-import * as fs from 'fs';
-import * as path from 'path';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
-export interface ICertificates {
-  privateKey: string;
-  publicKey: string;
-}
-
-export function loadDefaultCertificates(): ICertificates {
-  try {
-    const certPath = path.join(__dirname, '..', 'assets', 'certs');
-    const privateKey = fs.readFileSync(path.join(certPath, 'key.pem'), 'utf8');
-    const publicKey = fs.readFileSync(path.join(certPath, 'cert.pem'), 'utf8');
-
-    if (!privateKey || !publicKey) {
-      throw new Error('Failed to load default certificates');
-    }
-
-    return {
-      privateKey,
-      publicKey
-    };
-  } catch (error) {
-    console.error('Error loading default certificates:', error);
-    throw error;
-  }
-}

package/ts/networkproxy/index.ts

@@ -1,7 +0,0 @@
-// Re-export all components for easier imports
-export * from './classes.np.types.js';
-export * from './classes.np.certificatemanager.js';
-export * from './classes.np.connectionpool.js';
-export * from './classes.np.requesthandler.js';
-export * from './classes.np.websockethandler.js';
-export * from './classes.np.networkproxy.js';

package/ts/smartproxy/classes.pp.certprovisioner.ts

@@ -1,200 +0,0 @@
-import * as plugins from '../plugins.js';
-import type { IDomainConfig, ISmartProxyCertProvisionObject } from './classes.pp.interfaces.js';
-import { Port80Handler } from '../port80handler/classes.port80handler.js';
-import { Port80HandlerEvents } from '../common/types.js';
-import { subscribeToPort80Handler } from '../common/eventUtils.js';
-import type { ICertificateData } from '../common/types.js';
-import type { NetworkProxyBridge } from './classes.pp.networkproxybridge.js';
-
-/**
- * CertProvisioner manages certificate provisioning and renewal workflows,
- * unifying static certificates and HTTP-01 challenges via Port80Handler.
- */
-export class CertProvisioner extends plugins.EventEmitter {
-  private domainConfigs: IDomainConfig[];
-  private port80Handler: Port80Handler;
-  private networkProxyBridge: NetworkProxyBridge;
-  private certProvisionFunction?: (domain: string) => Promise<ISmartProxyCertProvisionObject>;
-  private forwardConfigs: Array<{ domain: string; forwardConfig?: { ip: string; port: number }; acmeForwardConfig?: { ip: string; port: number }; sslRedirect: boolean }>;
-  private renewThresholdDays: number;
-  private renewCheckIntervalHours: number;
-  private autoRenew: boolean;
-  private renewManager?: plugins.taskbuffer.TaskManager;
-  // Track provisioning type per domain: 'http01' or 'static'
-  private provisionMap: Map<string, 'http01' | 'static'>;
-
-  /**
-   * @param domainConfigs Array of domain configuration objects
-   * @param port80Handler HTTP-01 challenge handler instance
-   * @param networkProxyBridge Bridge for applying external certificates
-   * @param certProvider Optional callback returning a static cert or 'http01'
-   * @param renewThresholdDays Days before expiry to trigger renewals
-   * @param renewCheckIntervalHours Interval in hours to check for renewals
-   * @param autoRenew Whether to automatically schedule renewals
-   */
-  constructor(
-    domainConfigs: IDomainConfig[],
-    port80Handler: Port80Handler,
-    networkProxyBridge: NetworkProxyBridge,
-    certProvider?: (domain: string) => Promise<ISmartProxyCertProvisionObject>,
-    renewThresholdDays: number = 30,
-    renewCheckIntervalHours: number = 24,
-    autoRenew: boolean = true,
-    forwardConfigs: Array<{ domain: string; forwardConfig?: { ip: string; port: number }; acmeForwardConfig?: { ip: string; port: number }; sslRedirect: boolean }> = []
-  ) {
-    super();
-    this.domainConfigs = domainConfigs;
-    this.port80Handler = port80Handler;
-    this.networkProxyBridge = networkProxyBridge;
-    this.certProvisionFunction = certProvider;
-    this.renewThresholdDays = renewThresholdDays;
-    this.renewCheckIntervalHours = renewCheckIntervalHours;
-    this.autoRenew = autoRenew;
-    this.provisionMap = new Map();
-    this.forwardConfigs = forwardConfigs;
-  }
-
-  /**
-   * Start initial provisioning and schedule renewals.
-   */
-  public async start(): Promise<void> {
-    // Subscribe to Port80Handler certificate events
-    subscribeToPort80Handler(this.port80Handler, {
-      onCertificateIssued: (data: ICertificateData) => {
-        this.emit('certificate', { ...data, source: 'http01', isRenewal: false });
-      },
-      onCertificateRenewed: (data: ICertificateData) => {
-        this.emit('certificate', { ...data, source: 'http01', isRenewal: true });
-      }
-    });
-
-    // Apply external forwarding for ACME challenges (e.g. Synology)
-    for (const f of this.forwardConfigs) {
-      this.port80Handler.addDomain({
-        domainName: f.domain,
-        sslRedirect: f.sslRedirect,
-        acmeMaintenance: false,
-        forward: f.forwardConfig,
-        acmeForward: f.acmeForwardConfig
-      });
-    }
-    // Initial provisioning for all domains
-    const domains = this.domainConfigs.flatMap(cfg => cfg.domains);
-    for (const domain of domains) {
-      const isWildcard = domain.includes('*');
-      let provision: ISmartProxyCertProvisionObject | 'http01' = 'http01';
-      if (this.certProvisionFunction) {
-        try {
-          provision = await this.certProvisionFunction(domain);
-        } catch (err) {
-          console.error(`certProvider error for ${domain}:`, err);
-        }
-      } else if (isWildcard) {
-        // No certProvider: cannot handle wildcard without DNS-01 support
-        console.warn(`Skipping wildcard domain without certProvisionFunction: ${domain}`);
-        continue;
-      }
-      if (provision === 'http01') {
-        if (isWildcard) {
-          console.warn(`Skipping HTTP-01 for wildcard domain: ${domain}`);
-          continue;
-        }
-        this.provisionMap.set(domain, 'http01');
-        this.port80Handler.addDomain({ domainName: domain, sslRedirect: true, acmeMaintenance: true });
-      } else {
-        // Static certificate (e.g., DNS-01 provisioned or user-provided) supports wildcard domains
-        this.provisionMap.set(domain, 'static');
-        const certObj = provision as plugins.tsclass.network.ICert;
-        const certData: ICertificateData = {
-          domain: certObj.domainName,
-          certificate: certObj.publicKey,
-          privateKey: certObj.privateKey,
-          expiryDate: new Date(certObj.validUntil)
-        };
-        this.networkProxyBridge.applyExternalCertificate(certData);
-        this.emit('certificate', { ...certData, source: 'static', isRenewal: false });
-      }
-    }
-
-    // Schedule renewals if enabled
-    if (this.autoRenew) {
-      this.renewManager = new plugins.taskbuffer.TaskManager();
-      const renewTask = new plugins.taskbuffer.Task({
-        name: 'CertificateRenewals',
-        taskFunction: async () => {
-          for (const [domain, type] of this.provisionMap.entries()) {
-            // Skip wildcard domains
-            if (domain.includes('*')) continue;
-            try {
-              if (type === 'http01') {
-                await this.port80Handler.renewCertificate(domain);
-              } else if (type === 'static' && this.certProvisionFunction) {
-                const provision2 = await this.certProvisionFunction(domain);
-                if (provision2 !== 'http01') {
-                  const certObj = provision2 as plugins.tsclass.network.ICert;
-                  const certData: ICertificateData = {
-                    domain: certObj.domainName,
-                    certificate: certObj.publicKey,
-                    privateKey: certObj.privateKey,
-                    expiryDate: new Date(certObj.validUntil)
-                  };
-                  this.networkProxyBridge.applyExternalCertificate(certData);
-                  this.emit('certificate', { ...certData, source: 'static', isRenewal: true });
-                }
-              }
-            } catch (err) {
-              console.error(`Renewal error for ${domain}:`, err);
-            }
-          }
-        }
-      });
-      const hours = this.renewCheckIntervalHours;
-      const cronExpr = `0 0 */${hours} * * *`;
-      this.renewManager.addAndScheduleTask(renewTask, cronExpr);
-      this.renewManager.start();
-    }
-  }
-
-  /**
-   * Stop all scheduled renewal tasks.
-   */
-  public async stop(): Promise<void> {
-    // Stop scheduled renewals
-    if (this.renewManager) {
-      this.renewManager.stop();
-    }
-  }
-
-  /**
-   * Request a certificate on-demand for the given domain.
-   * @param domain Domain name to provision
-   */
-  public async requestCertificate(domain: string): Promise<void> {
-    const isWildcard = domain.includes('*');
-    // Determine provisioning method
-    let provision: ISmartProxyCertProvisionObject | 'http01' = 'http01';
-    if (this.certProvisionFunction) {
-      provision = await this.certProvisionFunction(domain);
-    } else if (isWildcard) {
-      // Cannot perform HTTP-01 on wildcard without certProvider
-      throw new Error(`Cannot request certificate for wildcard domain without certProvisionFunction: ${domain}`);
-    }
-    if (provision === 'http01') {
-      if (isWildcard) {
-        throw new Error(`Cannot request HTTP-01 certificate for wildcard domain: ${domain}`);
-      }
-      await this.port80Handler.renewCertificate(domain);
-    } else {
-      // Static certificate (e.g., DNS-01 provisioned) supports wildcards
-      const certObj = provision as plugins.tsclass.network.ICert;
-      const certData: ICertificateData = {
-        domain: certObj.domainName,
-        certificate: certObj.publicKey,
-        privateKey: certObj.privateKey,
-        expiryDate: new Date(certObj.validUntil)
-      };
-      this.networkProxyBridge.applyExternalCertificate(certData);
-      this.emit('certificate', { ...certData, source: 'static', isRenewal: false });
-    }
-  }
-}