@push.rocks/smartproxy 19.3.2 → 19.3.3

package/dist_ts/smartproxy/classes.pp.securitymanager.js

@@ -1,149 +0,0 @@
-import * as plugins from '../plugins.js';
-/**
- * Handles security aspects like IP tracking, rate limiting, and authorization
- */
-export class SecurityManager {
-    constructor(settings) {
-        this.settings = settings;
-        this.connectionsByIP = new Map();
-        this.connectionRateByIP = new Map();
-    }
-    /**
-     * Get connections count by IP
-     */
-    getConnectionCountByIP(ip) {
-        return this.connectionsByIP.get(ip)?.size || 0;
-    }
-    /**
-     * Check and update connection rate for an IP
-     * @returns true if within rate limit, false if exceeding limit
-     */
-    checkConnectionRate(ip) {
-        const now = Date.now();
-        const minute = 60 * 1000;
-        if (!this.connectionRateByIP.has(ip)) {
-            this.connectionRateByIP.set(ip, [now]);
-            return true;
-        }
-        // Get timestamps and filter out entries older than 1 minute
-        const timestamps = this.connectionRateByIP.get(ip).filter((time) => now - time < minute);
-        timestamps.push(now);
-        this.connectionRateByIP.set(ip, timestamps);
-        // Check if rate exceeds limit
-        return timestamps.length <= this.settings.connectionRateLimitPerMinute;
-    }
-    /**
-     * Track connection by IP
-     */
-    trackConnectionByIP(ip, connectionId) {
-        if (!this.connectionsByIP.has(ip)) {
-            this.connectionsByIP.set(ip, new Set());
-        }
-        this.connectionsByIP.get(ip).add(connectionId);
-    }
-    /**
-     * Remove connection tracking for an IP
-     */
-    removeConnectionByIP(ip, connectionId) {
-        if (this.connectionsByIP.has(ip)) {
-            const connections = this.connectionsByIP.get(ip);
-            connections.delete(connectionId);
-            if (connections.size === 0) {
-                this.connectionsByIP.delete(ip);
-            }
-        }
-    }
-    /**
-     * Check if an IP is authorized using forwarding security rules
-     *
-     * This method is used to determine if an IP is allowed to connect, based on security
-     * rules configured in the forwarding configuration. The allowed and blocked IPs are
-     * typically derived from domain.forwarding.security.allowedIps and blockedIps through
-     * DomainConfigManager.getEffectiveIPRules().
-     *
-     * @param ip - The IP address to check
-     * @param allowedIPs - Array of allowed IP patterns from forwarding.security.allowedIps
-     * @param blockedIPs - Array of blocked IP patterns from forwarding.security.blockedIps
-     * @returns true if IP is authorized, false if blocked
-     */
-    isIPAuthorized(ip, allowedIPs, blockedIPs = []) {
-        // Skip IP validation if allowedIPs is empty
-        if (!ip || (allowedIPs.length === 0 && blockedIPs.length === 0)) {
-            return true;
-        }
-        // First check if IP is blocked - blocked IPs take precedence
-        if (blockedIPs.length > 0 && this.isGlobIPMatch(ip, blockedIPs)) {
-            return false;
-        }
-        // Then check if IP is allowed
-        return this.isGlobIPMatch(ip, allowedIPs);
-    }
-    /**
-     * Check if the IP matches any of the glob patterns from security configuration
-     *
-     * This method checks IP addresses against glob patterns and handles IPv4/IPv6 normalization.
-     * It's used to implement IP filtering based on the forwarding.security configuration.
-     *
-     * @param ip - The IP address to check
-     * @param patterns - Array of glob patterns from forwarding.security.allowedIps or blockedIps
-     * @returns true if IP matches any pattern, false otherwise
-     */
-    isGlobIPMatch(ip, patterns) {
-        if (!ip || !patterns || patterns.length === 0)
-            return false;
-        // Handle IPv4/IPv6 normalization for proper matching
-        const normalizeIP = (ip) => {
-            if (!ip)
-                return [];
-            // Handle IPv4-mapped IPv6 addresses (::ffff:127.0.0.1)
-            if (ip.startsWith('::ffff:')) {
-                const ipv4 = ip.slice(7);
-                return [ip, ipv4];
-            }
-            // Handle IPv4 addresses by also checking IPv4-mapped form
-            if (/^\d{1,3}(\.\d{1,3}){3}$/.test(ip)) {
-                return [ip, `::ffff:${ip}`];
-            }
-            return [ip];
-        };
-        // Normalize the IP being checked
-        const normalizedIPVariants = normalizeIP(ip);
-        if (normalizedIPVariants.length === 0)
-            return false;
-        // Normalize the pattern IPs for consistent comparison
-        const expandedPatterns = patterns.flatMap(normalizeIP);
-        // Check for any match between normalized IP variants and patterns
-        return normalizedIPVariants.some((ipVariant) => expandedPatterns.some((pattern) => plugins.minimatch(ipVariant, pattern)));
-    }
-    /**
-     * Check if IP should be allowed considering connection rate and max connections
-     * @returns Object with result and reason
-     */
-    validateIP(ip) {
-        // Check connection count limit
-        if (this.settings.maxConnectionsPerIP &&
-            this.getConnectionCountByIP(ip) >= this.settings.maxConnectionsPerIP) {
-            return {
-                allowed: false,
-                reason: `Maximum connections per IP (${this.settings.maxConnectionsPerIP}) exceeded`
-            };
-        }
-        // Check connection rate limit
-        if (this.settings.connectionRateLimitPerMinute &&
-            !this.checkConnectionRate(ip)) {
-            return {
-                allowed: false,
-                reason: `Connection rate limit (${this.settings.connectionRateLimitPerMinute}/min) exceeded`
-            };
-        }
-        return { allowed: true };
-    }
-    /**
-     * Clears all IP tracking data (for shutdown)
-     */
-    clearIPTracking() {
-        this.connectionsByIP.clear();
-        this.connectionRateByIP.clear();
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5wcC5zZWN1cml0eW1hbmFnZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zbWFydHByb3h5L2NsYXNzZXMucHAuc2VjdXJpdHltYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBR3pDOztHQUVHO0FBQ0gsTUFBTSxPQUFPLGVBQWU7SUFJMUIsWUFBb0IsUUFBNEI7UUFBNUIsYUFBUSxHQUFSLFFBQVEsQ0FBb0I7UUFIeEMsb0JBQWUsR0FBNkIsSUFBSSxHQUFHLEVBQUUsQ0FBQztRQUN0RCx1QkFBa0IsR0FBMEIsSUFBSSxHQUFHLEVBQUUsQ0FBQztJQUVYLENBQUM7SUFFcEQ7O09BRUc7SUFDSSxzQkFBc0IsQ0FBQyxFQUFVO1FBQ3RDLE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEVBQUUsSUFBSSxJQUFJLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksbUJBQW1CLENBQUMsRUFBVTtRQUNuQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdkIsTUFBTSxNQUFNLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztRQUV6QixJQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3JDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN2QyxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCw0REFBNEQ7UUFDNUQsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLEdBQUcsR0FBRyxJQUFJLEdBQUcsTUFBTSxDQUFDLENBQUM7UUFDMUYsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNyQixJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUU1Qyw4QkFBOEI7UUFDOUIsT0FBTyxVQUFVLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsNEJBQTZCLENBQUM7SUFDMUUsQ0FBQztJQUVEOztPQUVHO0lBQ0ksbUJBQW1CLENBQUMsRUFBVSxFQUFFLFlBQW9CO1FBQ3pELElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ2xDLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxJQUFJLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDMUMsQ0FBQztRQUNELElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBRSxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxvQkFBb0IsQ0FBQyxFQUFVLEVBQUUsWUFBb0I7UUFDMUQsSUFBSSxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ2pDLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBRSxDQUFDO1lBQ2xELFdBQVcsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDakMsSUFBSSxXQUFXLENBQUMsSUFBSSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUMzQixJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNsQyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRDs7Ozs7Ozs7Ozs7O09BWUc7SUFDSSxjQUFjLENBQUMsRUFBVSxFQUFFLFVBQW9CLEVBQUUsYUFBdUIsRUFBRTtRQUMvRSw0Q0FBNEM7UUFDNUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFFRCw2REFBNkQ7UUFDN0QsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsYUFBYSxDQUFDLEVBQUUsRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELDhCQUE4QjtRQUM5QixPQUFPLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRDs7Ozs7Ozs7O09BU0c7SUFDSyxhQUFhLENBQUMsRUFBVSxFQUFFLFFBQWtCO1FBQ2xELElBQUksQ0FBQyxFQUFFLElBQUksQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFFNUQscURBQXFEO1FBQ3JELE1BQU0sV0FBVyxHQUFHLENBQUMsRUFBVSxFQUFZLEVBQUU7WUFDM0MsSUFBSSxDQUFDLEVBQUU7Z0JBQUUsT0FBTyxFQUFFLENBQUM7WUFDbkIsdURBQXVEO1lBQ3ZELElBQUksRUFBRSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO2dCQUM3QixNQUFNLElBQUksR0FBRyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUN6QixPQUFPLENBQUMsRUFBRSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ3BCLENBQUM7WUFDRCwwREFBMEQ7WUFDMUQsSUFBSSx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQztnQkFDdkMsT0FBTyxDQUFDLEVBQUUsRUFBRSxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDOUIsQ0FBQztZQUNELE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNkLENBQUMsQ0FBQztRQUVGLGlDQUFpQztRQUNqQyxNQUFNLG9CQUFvQixHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3QyxJQUFJLG9CQUFvQixDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFFcEQsc0RBQXNEO1FBQ3RELE1BQU0sZ0JBQWdCLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUV2RCxrRUFBa0U7UUFDbEUsT0FBTyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUM3QyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQzFFLENBQUM7SUFDSixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksVUFBVSxDQUFDLEVBQVU7UUFDMUIsK0JBQStCO1FBQy9CLElBQ0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxtQkFBbUI7WUFDakMsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsbUJBQW1CLEVBQ3BFLENBQUM7WUFDRCxPQUFPO2dCQUNMLE9BQU8sRUFBRSxLQUFLO2dCQUNkLE1BQU0sRUFBRSwrQkFBK0IsSUFBSSxDQUFDLFFBQVEsQ0FBQyxtQkFBbUIsWUFBWTthQUNyRixDQUFDO1FBQ0osQ0FBQztRQUVELDhCQUE4QjtRQUM5QixJQUNFLElBQUksQ0FBQyxRQUFRLENBQUMsNEJBQTRCO1lBQzFDLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQyxFQUM3QixDQUFDO1lBQ0QsT0FBTztnQkFDTCxPQUFPLEVBQUUsS0FBSztnQkFDZCxNQUFNLEVBQUUsMEJBQTBCLElBQUksQ0FBQyxRQUFRLENBQUMsNEJBQTRCLGdCQUFnQjthQUM3RixDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDM0IsQ0FBQztJQUVEOztPQUVHO0lBQ0ksZUFBZTtRQUNwQixJQUFJLENBQUMsZUFBZSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQzdCLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUNsQyxDQUFDO0NBQ0YifQ==

package/dist_ts/smartproxy/classes.pp.snihandler.d.ts

@@ -1,153 +0,0 @@
-import { Buffer } from 'buffer';
-/**
- * SNI (Server Name Indication) handler for TLS connections.
- * Provides robust extraction of SNI values from TLS ClientHello messages
- * with support for fragmented packets, TLS 1.3 resumption, Chrome-specific
- * connection behaviors, and tab hibernation/reactivation scenarios.
- */
-export declare class SniHandler {
-    private static readonly TLS_HANDSHAKE_RECORD_TYPE;
-    private static readonly TLS_APPLICATION_DATA_TYPE;
-    private static readonly TLS_CLIENT_HELLO_HANDSHAKE_TYPE;
-    private static readonly TLS_SNI_EXTENSION_TYPE;
-    private static readonly TLS_SESSION_TICKET_EXTENSION_TYPE;
-    private static readonly TLS_SNI_HOST_NAME_TYPE;
-    private static readonly TLS_PSK_EXTENSION_TYPE;
-    private static readonly TLS_PSK_KE_MODES_EXTENSION_TYPE;
-    private static readonly TLS_EARLY_DATA_EXTENSION_TYPE;
-    private static fragmentedBuffers;
-    private static fragmentTimeout;
-    /**
-     * Checks if a buffer contains a TLS handshake message (record type 22)
-     * @param buffer - The buffer to check
-     * @returns true if the buffer starts with a TLS handshake record type
-     */
-    static isTlsHandshake(buffer: Buffer): boolean;
-    /**
-     * Checks if a buffer contains TLS application data (record type 23)
-     * @param buffer - The buffer to check
-     * @returns true if the buffer starts with a TLS application data record type
-     */
-    static isTlsApplicationData(buffer: Buffer): boolean;
-    /**
-     * Creates a connection ID based on source/destination information
-     * Used to track fragmented ClientHello messages across multiple packets
-     *
-     * @param connectionInfo - Object containing connection identifiers (IP/port)
-     * @returns A string ID for the connection
-     */
-    static createConnectionId(connectionInfo: {
-        sourceIp?: string;
-        sourcePort?: number;
-        destIp?: string;
-        destPort?: number;
-    }): string;
-    /**
-     * Handles potential fragmented ClientHello messages by buffering and reassembling
-     * TLS record fragments that might span multiple TCP packets.
-     *
-     * @param buffer - The current buffer fragment
-     * @param connectionId - Unique identifier for the connection
-     * @param enableLogging - Whether to enable logging
-     * @returns A complete buffer if reassembly is successful, or undefined if more fragments are needed
-     */
-    static handleFragmentedClientHello(buffer: Buffer, connectionId: string, enableLogging?: boolean): Buffer | undefined;
-    /**
-     * Checks if a buffer contains a TLS ClientHello message
-     * @param buffer - The buffer to check
-     * @returns true if the buffer appears to be a ClientHello message
-     */
-    static isClientHello(buffer: Buffer): boolean;
-    /**
-     * Checks if a ClientHello message contains session resumption indicators
-     * such as session tickets or PSK (Pre-Shared Key) extensions.
-     *
-     * @param buffer - The buffer containing a ClientHello message
-     * @param enableLogging - Whether to enable logging
-     * @returns Object containing details about session resumption and SNI presence
-     */
-    static hasSessionResumption(buffer: Buffer, enableLogging?: boolean): {
-        isResumption: boolean;
-        hasSNI: boolean;
-    };
-    /**
-     * Detects characteristics of a tab reactivation TLS handshake
-     * These often have specific patterns in Chrome and other browsers
-     *
-     * @param buffer - The buffer containing a ClientHello message
-     * @param enableLogging - Whether to enable logging
-     * @returns true if this appears to be a tab reactivation handshake
-     */
-    static isTabReactivationHandshake(buffer: Buffer, enableLogging?: boolean): boolean;
-    /**
-     * Extracts the SNI (Server Name Indication) from a TLS ClientHello message.
-     * Implements robust parsing with support for session resumption edge cases.
-     *
-     * @param buffer - The buffer containing the TLS ClientHello message
-     * @param enableLogging - Whether to enable detailed debug logging
-     * @returns The extracted server name or undefined if not found
-     */
-    static extractSNI(buffer: Buffer, enableLogging?: boolean): string | undefined;
-    /**
-     * Attempts to extract SNI from the PSK extension in a TLS 1.3 ClientHello.
-     *
-     * In TLS 1.3, when a client attempts to resume a session, it may include
-     * the server name in the PSK identity hint rather than in the SNI extension.
-     *
-     * @param buffer - The buffer containing the TLS ClientHello message
-     * @param enableLogging - Whether to enable detailed debug logging
-     * @returns The extracted server name or undefined if not found
-     */
-    static extractSNIFromPSKExtension(buffer: Buffer, enableLogging?: boolean): string | undefined;
-    /**
-     * Checks if the buffer contains TLS 1.3 early data (0-RTT)
-     * @param buffer - The buffer to check
-     * @param enableLogging - Whether to enable logging
-     * @returns true if early data is detected
-     */
-    static hasEarlyData(buffer: Buffer, enableLogging?: boolean): boolean;
-    /**
-     * Attempts to extract SNI from an initial ClientHello packet and handles
-     * session resumption edge cases more robustly than the standard extraction.
-     *
-     * This method handles:
-     * 1. Standard SNI extraction
-     * 2. TLS 1.3 PSK-based resumption (Chrome, Firefox, etc.)
-     * 3. Session ticket-based resumption
-     * 4. Fragmented ClientHello messages
-     * 5. TLS 1.3 Early Data (0-RTT)
-     * 6. Chrome's connection racing behaviors
-     *
-     * @param buffer - The buffer containing the TLS ClientHello message
-     * @param connectionInfo - Optional connection information for fragment handling
-     * @param enableLogging - Whether to enable detailed debug logging
-     * @returns The extracted server name or undefined if not found
-     */
-    static extractSNIWithResumptionSupport(buffer: Buffer, connectionInfo?: {
-        sourceIp?: string;
-        sourcePort?: number;
-        destIp?: string;
-        destPort?: number;
-    }, enableLogging?: boolean): string | undefined;
-    /**
-     * Main entry point for SNI extraction that handles all edge cases.
-     * This should be called for each TLS packet received from a client.
-     *
-     * The method uses connection tracking to handle fragmented ClientHello
-     * messages and various TLS 1.3 behaviors, including Chrome's connection
-     * racing patterns and tab reactivation behaviors.
-     *
-     * @param buffer - The buffer containing TLS data
-     * @param connectionInfo - Connection metadata (IPs and ports)
-     * @param enableLogging - Whether to enable detailed debug logging
-     * @param cachedSni - Optional cached SNI from previous connections (for racing detection)
-     * @returns The extracted server name or undefined if not found or more data needed
-     */
-    static processTlsPacket(buffer: Buffer, connectionInfo: {
-        sourceIp: string;
-        sourcePort: number;
-        destIp: string;
-        destPort: number;
-        timestamp?: number;
-    }, enableLogging?: boolean, cachedSni?: string): string | undefined;
-}