@push.rocks/smartproxy 19.5.2 → 19.5.3

package/ts/proxies/smart-proxy/route-connection-handler.ts

@@ -146,18 +146,42 @@ export class RouteConnectionHandler {
       );
     }
 
-    // Start TLS SNI handling
-    this.handleTlsConnection(socket, record);
+    // Handle the connection - wait for initial data to determine if it's TLS
+    this.handleInitialData(socket, record);
   }
 
   /**
-   * Handle a connection and wait for TLS handshake for SNI extraction if needed
+   * Handle initial data from a connection to determine routing
    */
-  private handleTlsConnection(socket: plugins.net.Socket, record: IConnectionRecord): void {
+  private handleInitialData(socket: plugins.net.Socket, record: IConnectionRecord): void {
     const connectionId = record.id;
     const localPort = record.localPort;
     let initialDataReceived = false;
 
+    // Check if any routes on this port require TLS handling
+    const allRoutes = this.routeManager.getAllRoutes();
+    const needsTlsHandling = allRoutes.some(route => {
+      // Check if route matches this port
+      const matchesPort = this.routeManager.getRoutesForPort(localPort).includes(route);
+      
+      return matchesPort && 
+             route.action.type === 'forward' && 
+             route.action.tls && 
+             (route.action.tls.mode === 'terminate' || 
+              route.action.tls.mode === 'passthrough');
+    });
+
+    // If no routes require TLS handling and it's not port 443, route immediately
+    if (!needsTlsHandling && localPort !== 443) {
+      // Set up error handler
+      socket.on('error', this.connectionManager.handleError('incoming', record));
+      
+      // Route immediately for non-TLS connections
+      this.routeConnection(socket, record, '', undefined);
+      return;
+    }
+
+    // Otherwise, wait for initial data to check if it's TLS
     // Set an initial timeout for handshake data
     let initialTimeout: NodeJS.Timeout | null = setTimeout(() => {
       if (!initialDataReceived) {
@@ -296,6 +320,12 @@ export class RouteConnectionHandler {
     const localPort = record.localPort;
     const remoteIP = record.remoteIP;
 
+    // Check if this is an HTTP proxy port
+    const isHttpProxyPort = this.settings.useHttpProxy?.includes(localPort);
+    
+    // For HTTP proxy ports without TLS, skip domain check since domain info comes from HTTP headers
+    const skipDomainCheck = isHttpProxyPort && !record.isTLS;
+
     // Find matching route
     const routeMatch = this.routeManager.findMatchingRoute({
       port: localPort,
@@ -303,6 +333,7 @@ export class RouteConnectionHandler {
       clientIp: remoteIP,
       path: undefined, // We don't have path info at this point
       tlsVersion: undefined, // We don't extract TLS version yet
+      skipDomainCheck: skipDomainCheck,
     });
 
     if (!routeMatch) {
@@ -382,6 +413,56 @@ export class RouteConnectionHandler {
       });
     }
 
+    // Apply route-specific security checks
+    if (route.security) {
+      // Check IP allow/block lists
+      if (route.security.ipAllowList || route.security.ipBlockList) {
+        const isIPAllowed = this.securityManager.isIPAuthorized(
+          remoteIP,
+          route.security.ipAllowList || [],
+          route.security.ipBlockList || []
+        );
+
+        if (!isIPAllowed) {
+          logger.log('warn', `IP ${remoteIP} blocked by route security for route ${route.name || 'unnamed'} (connection: ${connectionId})`, {
+            connectionId,
+            remoteIP,
+            routeName: route.name || 'unnamed',
+            component: 'route-handler'
+          });
+          socket.end();
+          this.connectionManager.cleanupConnection(record, 'route_ip_blocked');
+          return;
+        }
+      }
+
+      // Check max connections per route
+      if (route.security.maxConnections !== undefined) {
+        // TODO: Implement per-route connection tracking
+        // For now, log that this feature is not yet implemented
+        if (this.settings.enableDetailedLogging) {
+          logger.log('warn', `Route ${route.name} has maxConnections=${route.security.maxConnections} configured but per-route connection limits are not yet implemented`, {
+            connectionId,
+            routeName: route.name,
+            component: 'route-handler'
+          });
+        }
+      }
+
+      // Check authentication requirements
+      if (route.security.authentication || route.security.basicAuth || route.security.jwtAuth) {
+        // Authentication checks would typically happen at the HTTP layer
+        // For non-HTTP connections or passthrough, we can't enforce authentication
+        if (route.action.type === 'forward' && route.action.tls?.mode !== 'terminate') {
+          logger.log('warn', `Route ${route.name} has authentication configured but it cannot be enforced for non-terminated connections`, {
+            connectionId,
+            routeName: route.name,
+            tlsMode: route.action.tls?.mode || 'none',
+            component: 'route-handler'
+          });
+        }
+      }
+    }
 
     // Handle the route based on its action type
     switch (route.action.type) {
@@ -634,6 +715,18 @@ export class RouteConnectionHandler {
       // No TLS settings - check if this port should use HttpProxy
       const isHttpProxyPort = this.settings.useHttpProxy?.includes(record.localPort);
       
+      // Debug logging
+      if (this.settings.enableDetailedLogging) {
+        logger.log('debug', `Checking HttpProxy forwarding: port=${record.localPort}, useHttpProxy=${JSON.stringify(this.settings.useHttpProxy)}, isHttpProxyPort=${isHttpProxyPort}, hasHttpProxy=${!!this.httpProxyBridge.getHttpProxy()}`, {
+          connectionId,
+          localPort: record.localPort,
+          useHttpProxy: this.settings.useHttpProxy,
+          isHttpProxyPort,
+          hasHttpProxy: !!this.httpProxyBridge.getHttpProxy(),
+          component: 'route-handler'
+        });
+      }
+      
       if (isHttpProxyPort && this.httpProxyBridge.getHttpProxy()) {
         // Forward non-TLS connections to HttpProxy if configured
         if (this.settings.enableDetailedLogging) {

package/ts/proxies/smart-proxy/route-manager.ts

@@ -211,9 +211,10 @@ export class RouteManager extends plugins.EventEmitter {
   
   /**
    * Check if a client IP is allowed by a route's security settings
+   * @deprecated Security is now checked in route-connection-handler.ts after route matching
    */
   private isClientIpAllowed(route: IRouteConfig, clientIp: string): boolean {
-    const security = route.action.security;
+    const security = route.security;
     
     if (!security) {
       return true; // No security settings means allowed
@@ -330,8 +331,9 @@ export class RouteManager extends plugins.EventEmitter {
     clientIp: string;
     path?: string;
     tlsVersion?: string;
+    skipDomainCheck?: boolean;
   }): IRouteMatchResult | null {
-    const { port, domain, clientIp, path, tlsVersion } = options;
+    const { port, domain, clientIp, path, tlsVersion, skipDomainCheck } = options;
     
     // Get all routes for this port
     const routesForPort = this.getRoutesForPort(port);
@@ -340,7 +342,7 @@ export class RouteManager extends plugins.EventEmitter {
     for (const route of routesForPort) {
       // Check domain match
       // If the route has domain restrictions and we have a domain to check
-      if (route.match.domains) {
+      if (route.match.domains && !skipDomainCheck) {
         // If no domain was provided (non-TLS or no SNI), this route doesn't match
         if (!domain) {
           continue;
@@ -351,6 +353,7 @@ export class RouteManager extends plugins.EventEmitter {
         }
       }
       // If route has no domain restrictions, it matches all domains
+      // If skipDomainCheck is true, we skip domain validation for HTTP connections
       
       // Check path match if specified in both route and request
       if (path && route.match.path) {
@@ -371,12 +374,8 @@ export class RouteManager extends plugins.EventEmitter {
         continue;
       }
       
-      // Check security settings
-      if (!this.isClientIpAllowed(route, clientIp)) {
-        continue;
-      }
-      
       // All checks passed, this route matches
+      // NOTE: Security is checked AFTER route matching in route-connection-handler.ts
       return { route };
     }
     

package/ts/proxies/smart-proxy/utils/route-helpers.ts

@@ -625,14 +625,6 @@ export function createNfTablesRoute(
     }
   };
   
-  // Add security if allowed or blocked IPs are specified
-  if (options.ipAllowList?.length || options.ipBlockList?.length) {
-    action.security = {
-      ipAllowList: options.ipAllowList,
-      ipBlockList: options.ipBlockList
-    };
-  }
-  
   // Add TLS options if needed
   if (options.useTls) {
     action.tls = {
@@ -641,11 +633,21 @@ export function createNfTablesRoute(
   }
   
   // Create the route config
-  return {
+  const routeConfig: IRouteConfig = {
     name,
     match,
     action
   };
+  
+  // Add security if allowed or blocked IPs are specified
+  if (options.ipAllowList?.length || options.ipBlockList?.length) {
+    routeConfig.security = {
+      ipAllowList: options.ipAllowList,
+      ipBlockList: options.ipBlockList
+    };
+  }
+  
+  return routeConfig;
 }
 
 /**