@push.rocks/smartproxy 19.4.2 → 19.5.3

package/ts/proxies/smart-proxy/route-manager.ts

@@ -211,9 +211,10 @@ export class RouteManager extends plugins.EventEmitter {
   
   /**
    * Check if a client IP is allowed by a route's security settings
+   * @deprecated Security is now checked in route-connection-handler.ts after route matching
    */
   private isClientIpAllowed(route: IRouteConfig, clientIp: string): boolean {
-    const security = route.action.security;
+    const security = route.security;
     
     if (!security) {
       return true; // No security settings means allowed
@@ -330,8 +331,9 @@ export class RouteManager extends plugins.EventEmitter {
     clientIp: string;
     path?: string;
     tlsVersion?: string;
+    skipDomainCheck?: boolean;
   }): IRouteMatchResult | null {
-    const { port, domain, clientIp, path, tlsVersion } = options;
+    const { port, domain, clientIp, path, tlsVersion, skipDomainCheck } = options;
     
     // Get all routes for this port
     const routesForPort = this.getRoutesForPort(port);
@@ -340,7 +342,7 @@ export class RouteManager extends plugins.EventEmitter {
     for (const route of routesForPort) {
       // Check domain match
       // If the route has domain restrictions and we have a domain to check
-      if (route.match.domains) {
+      if (route.match.domains && !skipDomainCheck) {
         // If no domain was provided (non-TLS or no SNI), this route doesn't match
         if (!domain) {
           continue;
@@ -351,6 +353,7 @@ export class RouteManager extends plugins.EventEmitter {
         }
       }
       // If route has no domain restrictions, it matches all domains
+      // If skipDomainCheck is true, we skip domain validation for HTTP connections
       
       // Check path match if specified in both route and request
       if (path && route.match.path) {
@@ -371,12 +374,8 @@ export class RouteManager extends plugins.EventEmitter {
         continue;
       }
       
-      // Check security settings
-      if (!this.isClientIpAllowed(route, clientIp)) {
-        continue;
-      }
-      
       // All checks passed, this route matches
+      // NOTE: Security is checked AFTER route matching in route-connection-handler.ts
       return { route };
     }
     

package/ts/proxies/smart-proxy/utils/index.ts

@@ -19,7 +19,6 @@ import {
   createWebSocketRoute as createWebSocketPatternRoute,
   createLoadBalancerRoute as createLoadBalancerPatternRoute,
   createApiGatewayRoute,
-  createStaticFileServerRoute,
   addRateLimiting,
   addBasicAuth,
   addJwtAuth
@@ -29,7 +28,6 @@ export {
   createWebSocketPatternRoute,
   createLoadBalancerPatternRoute,
   createApiGatewayRoute,
-  createStaticFileServerRoute,
   addRateLimiting,
   addBasicAuth,
   addJwtAuth

package/ts/proxies/smart-proxy/utils/route-helpers.ts

@@ -11,7 +11,6 @@
  * - HTTPS passthrough routes (createHttpsPassthroughRoute)
  * - Complete HTTPS servers with redirects (createCompleteHttpsServer)
  * - Load balancer routes (createLoadBalancerRoute)
- * - Static file server routes (createStaticFileRoute)
  * - API routes (createApiRoute)
  * - WebSocket routes (createWebSocketRoute)
  * - Port mapping routes (createPortMappingRoute, createOffsetPortMappingRoute)
@@ -19,6 +18,7 @@
  * - NFTables routes (createNfTablesRoute, createNfTablesTerminateRoute)
  */
 
+import * as plugins from '../../../plugins.js';
 import type { IRouteConfig, IRouteMatch, IRouteAction, IRouteTarget, TPortRange, IRouteContext } from '../models/route-types.js';
 
 /**
@@ -118,11 +118,8 @@ export function createHttpToHttpsRedirect(
 
   // Create route action
   const action: IRouteAction = {
-    type: 'redirect',
-    redirect: {
-      to: `https://{domain}:${httpsPort}{path}`,
-      status: 301
-    }
+    type: 'socket-handler',
+    socketHandler: SocketHandlers.httpRedirect(`https://{domain}:${httpsPort}{path}`, 301)
   };
 
   // Create the route config
@@ -266,60 +263,6 @@ export function createLoadBalancerRoute(
   };
 }
 
-/**
- * Create a static file server route
- * @param domains Domain(s) to match
- * @param rootDir Root directory path for static files
- * @param options Additional route options
- * @returns Route configuration object
- */
-export function createStaticFileRoute(
-  domains: string | string[],
-  rootDir: string,
-  options: {
-    indexFiles?: string[];
-    serveOnHttps?: boolean;
-    certificate?: 'auto' | { key: string; cert: string };
-    httpPort?: number | number[];
-    httpsPort?: number | number[];
-    name?: string;
-    [key: string]: any;
-  } = {}
-): IRouteConfig {
-  // Create route match
-  const match: IRouteMatch = {
-    ports: options.serveOnHttps
-      ? (options.httpsPort || 443)
-      : (options.httpPort || 80),
-    domains
-  };
-
-  // Create route action
-  const action: IRouteAction = {
-    type: 'static',
-    static: {
-      root: rootDir,
-      index: options.indexFiles || ['index.html', 'index.htm']
-    }
-  };
-
-  // Add TLS configuration if serving on HTTPS
-  if (options.serveOnHttps) {
-    action.tls = {
-      mode: 'terminate',
-      certificate: options.certificate || 'auto'
-    };
-  }
-
-  // Create the route config
-  return {
-    match,
-    action,
-    name: options.name || `Static Files for ${Array.isArray(domains) ? domains.join(', ') : domains}`,
-    ...options
-  };
-}
-
 /**
  * Create an API route configuration
  * @param domains Domain(s) to match
@@ -682,14 +625,6 @@ export function createNfTablesRoute(
     }
   };
   
-  // Add security if allowed or blocked IPs are specified
-  if (options.ipAllowList?.length || options.ipBlockList?.length) {
-    action.security = {
-      ipAllowList: options.ipAllowList,
-      ipBlockList: options.ipBlockList
-    };
-  }
-  
   // Add TLS options if needed
   if (options.useTls) {
     action.tls = {
@@ -698,11 +633,21 @@ export function createNfTablesRoute(
   }
   
   // Create the route config
-  return {
+  const routeConfig: IRouteConfig = {
     name,
     match,
     action
   };
+  
+  // Add security if allowed or blocked IPs are specified
+  if (options.ipAllowList?.length || options.ipBlockList?.length) {
+    routeConfig.security = {
+      ipAllowList: options.ipAllowList,
+      ipBlockList: options.ipBlockList
+    };
+  }
+  
+  return routeConfig;
 }
 
 /**
@@ -810,4 +755,278 @@ export function createCompleteNfTablesHttpsServer(
   );
   
   return [httpsRoute, httpRedirectRoute];
-}
+}
+
+/**
+ * Create a socket handler route configuration
+ * @param domains Domain(s) to match
+ * @param ports Port(s) to listen on
+ * @param handler Socket handler function
+ * @param options Additional route options
+ * @returns Route configuration object
+ */
+export function createSocketHandlerRoute(
+  domains: string | string[],
+  ports: TPortRange,
+  handler: (socket: plugins.net.Socket) => void | Promise<void>,
+  options: {
+    name?: string;
+    priority?: number;
+    path?: string;
+  } = {}
+): IRouteConfig {
+  return {
+    name: options.name || 'socket-handler-route',
+    priority: options.priority !== undefined ? options.priority : 50,
+    match: {
+      domains,
+      ports,
+      ...(options.path && { path: options.path })
+    },
+    action: {
+      type: 'socket-handler',
+      socketHandler: handler
+    }
+  };
+}
+
+/**
+ * Pre-built socket handlers for common use cases
+ */
+export const SocketHandlers = {
+  /**
+   * Simple echo server handler
+   */
+  echo: (socket: plugins.net.Socket, context: IRouteContext) => {
+    socket.write('ECHO SERVER READY\n');
+    socket.on('data', data => socket.write(data));
+  },
+  
+  /**
+   * TCP proxy handler
+   */
+  proxy: (targetHost: string, targetPort: number) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    const target = plugins.net.connect(targetPort, targetHost);
+    socket.pipe(target);
+    target.pipe(socket);
+    socket.on('close', () => target.destroy());
+    target.on('close', () => socket.destroy());
+    target.on('error', (err) => {
+      console.error('Proxy target error:', err);
+      socket.destroy();
+    });
+  },
+  
+  /**
+   * Line-based protocol handler
+   */
+  lineProtocol: (handler: (line: string, socket: plugins.net.Socket) => void) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    let buffer = '';
+    socket.on('data', (data) => {
+      buffer += data.toString();
+      const lines = buffer.split('\n');
+      buffer = lines.pop() || '';
+      lines.forEach(line => {
+        if (line.trim()) {
+          handler(line.trim(), socket);
+        }
+      });
+    });
+  },
+  
+  /**
+   * Simple HTTP response handler (for testing)
+   */
+  httpResponse: (statusCode: number, body: string) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    const response = [
+      `HTTP/1.1 ${statusCode} ${statusCode === 200 ? 'OK' : 'Error'}`,
+      'Content-Type: text/plain',
+      `Content-Length: ${body.length}`,
+      'Connection: close',
+      '',
+      body
+    ].join('\r\n');
+    
+    socket.write(response);
+    socket.end();
+  },
+  
+  /**
+   * Block connection immediately
+   */
+  block: (message?: string) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    const finalMessage = message || `Connection blocked from ${context.clientIp}`;
+    if (finalMessage) {
+      socket.write(finalMessage);
+    }
+    socket.end();
+  },
+  
+  /**
+   * HTTP block response
+   */
+  httpBlock: (statusCode: number = 403, message?: string) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    const defaultMessage = `Access forbidden for ${context.domain || context.clientIp}`;
+    const finalMessage = message || defaultMessage;
+    
+    const response = [
+      `HTTP/1.1 ${statusCode} ${finalMessage}`,
+      'Content-Type: text/plain',
+      `Content-Length: ${finalMessage.length}`,
+      'Connection: close',
+      '',
+      finalMessage
+    ].join('\r\n');
+    
+    socket.write(response);
+    socket.end();
+  },
+  
+  /**
+   * HTTP redirect handler
+   */
+  httpRedirect: (locationTemplate: string, statusCode: number = 301) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    let buffer = '';
+    
+    socket.once('data', (data) => {
+      buffer += data.toString();
+      
+      const lines = buffer.split('\r\n');
+      const requestLine = lines[0];
+      const [method, path] = requestLine.split(' ');
+      
+      const domain = context.domain || 'localhost';
+      const port = context.port;
+      
+      let finalLocation = locationTemplate
+        .replace('{domain}', domain)
+        .replace('{port}', String(port))
+        .replace('{path}', path)
+        .replace('{clientIp}', context.clientIp);
+      
+      const message = `Redirecting to ${finalLocation}`;
+      const response = [
+        `HTTP/1.1 ${statusCode} ${statusCode === 301 ? 'Moved Permanently' : 'Found'}`,
+        `Location: ${finalLocation}`,
+        'Content-Type: text/plain',
+        `Content-Length: ${message.length}`,
+        'Connection: close',
+        '',
+        message
+      ].join('\r\n');
+      
+      socket.write(response);
+      socket.end();
+    });
+  },
+  
+  /**
+   * HTTP server handler for ACME challenges and other HTTP needs
+   */
+  httpServer: (handler: (req: { method: string; url: string; headers: Record<string, string>; body?: string }, res: { status: (code: number) => void; header: (name: string, value: string) => void; send: (data: string) => void; end: () => void }) => void) => (socket: plugins.net.Socket, context: IRouteContext) => {
+    let buffer = '';
+    let requestParsed = false;
+    
+    socket.on('data', (data) => {
+      if (requestParsed) return; // Only handle the first request
+      
+      buffer += data.toString();
+      
+      // Check if we have a complete HTTP request
+      const headerEndIndex = buffer.indexOf('\r\n\r\n');
+      if (headerEndIndex === -1) return; // Need more data
+      
+      requestParsed = true;
+      
+      // Parse the HTTP request
+      const headerPart = buffer.substring(0, headerEndIndex);
+      const bodyPart = buffer.substring(headerEndIndex + 4);
+      
+      const lines = headerPart.split('\r\n');
+      const [method, url] = lines[0].split(' ');
+      
+      const headers: Record<string, string> = {};
+      for (let i = 1; i < lines.length; i++) {
+        const colonIndex = lines[i].indexOf(':');
+        if (colonIndex > 0) {
+          const name = lines[i].substring(0, colonIndex).trim().toLowerCase();
+          const value = lines[i].substring(colonIndex + 1).trim();
+          headers[name] = value;
+        }
+      }
+      
+      // Create request object
+      const req = {
+        method: method || 'GET',
+        url: url || '/',
+        headers,
+        body: bodyPart
+      };
+      
+      // Create response object
+      let statusCode = 200;
+      const responseHeaders: Record<string, string> = {};
+      let ended = false;
+      
+      const res = {
+        status: (code: number) => {
+          statusCode = code;
+        },
+        header: (name: string, value: string) => {
+          responseHeaders[name] = value;
+        },
+        send: (data: string) => {
+          if (ended) return;
+          ended = true;
+          
+          if (!responseHeaders['content-type']) {
+            responseHeaders['content-type'] = 'text/plain';
+          }
+          responseHeaders['content-length'] = String(data.length);
+          responseHeaders['connection'] = 'close';
+          
+          const statusText = statusCode === 200 ? 'OK' : 
+                           statusCode === 404 ? 'Not Found' :
+                           statusCode === 500 ? 'Internal Server Error' : 'Response';
+          
+          let response = `HTTP/1.1 ${statusCode} ${statusText}\r\n`;
+          for (const [name, value] of Object.entries(responseHeaders)) {
+            response += `${name}: ${value}\r\n`;
+          }
+          response += '\r\n';
+          response += data;
+          
+          socket.write(response);
+          socket.end();
+        },
+        end: () => {
+          if (ended) return;
+          ended = true;
+          socket.write('HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n');
+          socket.end();
+        }
+      };
+      
+      try {
+        handler(req, res);
+        // Ensure response is sent even if handler doesn't call send()
+        setTimeout(() => {
+          if (!ended) {
+            res.send('');
+          }
+        }, 1000);
+      } catch (error) {
+        if (!ended) {
+          res.status(500);
+          res.send('Internal Server Error');
+        }
+      }
+    });
+    
+    socket.on('error', () => {
+      if (!requestParsed) {
+        socket.end();
+      }
+    });
+  }
+};

package/ts/proxies/smart-proxy/utils/route-patterns.ts

@@ -7,6 +7,7 @@
 
 import type { IRouteConfig, IRouteMatch, IRouteAction, IRouteTarget } from '../models/route-types.js';
 import { mergeRouteConfigs } from './route-utils.js';
+import { SocketHandlers } from './route-helpers.js';
 
 /**
  * Create a basic HTTP route configuration
@@ -112,11 +113,11 @@ export function createHttpToHttpsRedirect(
       ports: 80
     },
     action: {
-      type: 'redirect',
-      redirect: {
-        to: options.preservePath ? 'https://{domain}{path}' : 'https://{domain}',
-        status: options.redirectCode || 301
-      }
+      type: 'socket-handler',
+      socketHandler: SocketHandlers.httpRedirect(
+        options.preservePath ? 'https://{domain}{path}' : 'https://{domain}',
+        options.redirectCode || 301
+      )
     },
     name: options.name || `HTTP to HTTPS redirect: ${Array.isArray(domains) ? domains.join(', ') : domains}`
   };
@@ -214,57 +215,6 @@ export function createApiGatewayRoute(
   return mergeRouteConfigs(baseRoute, apiRoute);
 }
 
-/**
- * Create a static file server route pattern
- * @param domains Domain(s) to match
- * @param rootDirectory Root directory for static files
- * @param options Additional route options
- * @returns Static file server route configuration
- */
-export function createStaticFileServerRoute(
-  domains: string | string[],
-  rootDirectory: string,
-  options: {
-    useTls?: boolean;
-    certificate?: 'auto' | { key: string; cert: string };
-    indexFiles?: string[];
-    cacheControl?: string;
-    path?: string;
-    [key: string]: any;
-  } = {}
-): IRouteConfig {
-  // Create base route with static action
-  const baseRoute: IRouteConfig = {
-    match: {
-      domains,
-      ports: options.useTls ? 443 : 80,
-      path: options.path || '/'
-    },
-    action: {
-      type: 'static',
-      static: {
-        root: rootDirectory,
-        index: options.indexFiles || ['index.html', 'index.htm'],
-        headers: {
-          'Cache-Control': options.cacheControl || 'public, max-age=3600'
-        }
-      }
-    },
-    name: options.name || `Static Server: ${Array.isArray(domains) ? domains.join(', ') : domains}`,
-    priority: options.priority || 50
-  };
-  
-  // Add TLS configuration if requested
-  if (options.useTls) {
-    baseRoute.action.tls = {
-      mode: 'terminate',
-      certificate: options.certificate || 'auto'
-    };
-  }
-  
-  return baseRoute;
-}
-
 /**
  * Create a WebSocket route pattern
  * @param domains Domain(s) to match

package/ts/proxies/smart-proxy/utils/route-utils.ts

@@ -53,7 +53,15 @@ export function mergeRouteConfigs(
   if (overrideRoute.action) {
     // If action types are different, replace the entire action
     if (overrideRoute.action.type && overrideRoute.action.type !== mergedRoute.action.type) {
-      mergedRoute.action = JSON.parse(JSON.stringify(overrideRoute.action));
+      // Handle socket handler specially since it's a function
+      if (overrideRoute.action.type === 'socket-handler' && overrideRoute.action.socketHandler) {
+        mergedRoute.action = {
+          type: 'socket-handler',
+          socketHandler: overrideRoute.action.socketHandler
+        };
+      } else {
+        mergedRoute.action = JSON.parse(JSON.stringify(overrideRoute.action));
+      }
     } else {
       // Otherwise merge the action properties
       mergedRoute.action = { ...mergedRoute.action };
@@ -74,20 +82,9 @@ export function mergeRouteConfigs(
         };
       }
       
-      // Merge redirect options
-      if (overrideRoute.action.redirect) {
-        mergedRoute.action.redirect = {
-          ...mergedRoute.action.redirect,
-          ...overrideRoute.action.redirect
-        };
-      }
-      
-      // Merge static options
-      if (overrideRoute.action.static) {
-        mergedRoute.action.static = {
-          ...mergedRoute.action.static,
-          ...overrideRoute.action.static
-        };
+      // Handle socket handler update
+      if (overrideRoute.action.socketHandler) {
+        mergedRoute.action.socketHandler = overrideRoute.action.socketHandler;
       }
     }
   }

package/ts/proxies/smart-proxy/utils/route-validators.ts

@@ -98,7 +98,7 @@ export function validateRouteAction(action: IRouteAction): { valid: boolean; err
   // Validate action type
   if (!action.type) {
     errors.push('Action type is required');
-  } else if (!['forward', 'redirect', 'static', 'block'].includes(action.type)) {
+  } else if (!['forward', 'socket-handler'].includes(action.type)) {
     errors.push(`Invalid action type: ${action.type}`);
   }
 
@@ -143,30 +143,12 @@ export function validateRouteAction(action: IRouteAction): { valid: boolean; err
     }
   }
 
-  // Validate redirect for 'redirect' action
-  if (action.type === 'redirect') {
-    if (!action.redirect) {
-      errors.push('Redirect configuration is required for redirect action');
-    } else {
-      if (!action.redirect.to) {
-        errors.push('Redirect target (to) is required');
-      }
-
-      if (action.redirect.status && 
-          ![301, 302, 303, 307, 308].includes(action.redirect.status)) {
-        errors.push('Invalid redirect status code');
-      }
-    }
-  }
-
-  // Validate static file config for 'static' action
-  if (action.type === 'static') {
-    if (!action.static) {
-      errors.push('Static file configuration is required for static action');
-    } else {
-      if (!action.static.root) {
-        errors.push('Static file root directory is required');
-      }
+  // Validate socket handler for 'socket-handler' action
+  if (action.type === 'socket-handler') {
+    if (!action.socketHandler) {
+      errors.push('Socket handler function is required for socket-handler action');
+    } else if (typeof action.socketHandler !== 'function') {
+      errors.push('Socket handler must be a function');
     }
   }
 
@@ -261,12 +243,8 @@ export function hasRequiredPropertiesForAction(route: IRouteConfig, actionType:
   switch (actionType) {
     case 'forward':
       return !!route.action.target && !!route.action.target.host && !!route.action.target.port;
-    case 'redirect':
-      return !!route.action.redirect && !!route.action.redirect.to;
-    case 'static':
-      return !!route.action.static && !!route.action.static.root;
-    case 'block':
-      return true; // Block action doesn't require additional properties
+    case 'socket-handler':
+      return !!route.action.socketHandler && typeof route.action.socketHandler === 'function';
     default:
       return false;
   }