@push.rocks/smartproxy 21.0.0 → 21.1.1

package/ts/proxies/http-proxy/models/http-types.ts

@@ -1,4 +1,6 @@
 import * as plugins from '../../../plugins.js';
+// Import from protocols for consistent status codes
+import { HttpStatus as ProtocolHttpStatus, getStatusText as getProtocolStatusText } from '../../../protocols/http/index.js';
 
 /**
  * HTTP-specific event types
@@ -10,34 +12,33 @@ export enum HttpEvents {
   REQUEST_ERROR = 'request-error',
 }
 
-/**
- * HTTP status codes as an enum for better type safety
- */
-export enum HttpStatus {
-  OK = 200,
-  MOVED_PERMANENTLY = 301,
-  FOUND = 302,
-  TEMPORARY_REDIRECT = 307,
-  PERMANENT_REDIRECT = 308,
-  BAD_REQUEST = 400,
-  UNAUTHORIZED = 401,
-  FORBIDDEN = 403,
-  NOT_FOUND = 404,
-  METHOD_NOT_ALLOWED = 405,
-  REQUEST_TIMEOUT = 408,
-  TOO_MANY_REQUESTS = 429,
-  INTERNAL_SERVER_ERROR = 500,
-  NOT_IMPLEMENTED = 501,
-  BAD_GATEWAY = 502,
-  SERVICE_UNAVAILABLE = 503,
-  GATEWAY_TIMEOUT = 504,
-}
+
+// Re-export for backward compatibility with subset of commonly used codes
+export const HttpStatus = {
+  OK: ProtocolHttpStatus.OK,
+  MOVED_PERMANENTLY: ProtocolHttpStatus.MOVED_PERMANENTLY,
+  FOUND: ProtocolHttpStatus.FOUND,
+  TEMPORARY_REDIRECT: ProtocolHttpStatus.TEMPORARY_REDIRECT,
+  PERMANENT_REDIRECT: ProtocolHttpStatus.PERMANENT_REDIRECT,
+  BAD_REQUEST: ProtocolHttpStatus.BAD_REQUEST,
+  UNAUTHORIZED: ProtocolHttpStatus.UNAUTHORIZED,
+  FORBIDDEN: ProtocolHttpStatus.FORBIDDEN,
+  NOT_FOUND: ProtocolHttpStatus.NOT_FOUND,
+  METHOD_NOT_ALLOWED: ProtocolHttpStatus.METHOD_NOT_ALLOWED,
+  REQUEST_TIMEOUT: ProtocolHttpStatus.REQUEST_TIMEOUT,
+  TOO_MANY_REQUESTS: ProtocolHttpStatus.TOO_MANY_REQUESTS,
+  INTERNAL_SERVER_ERROR: ProtocolHttpStatus.INTERNAL_SERVER_ERROR,
+  NOT_IMPLEMENTED: ProtocolHttpStatus.NOT_IMPLEMENTED,
+  BAD_GATEWAY: ProtocolHttpStatus.BAD_GATEWAY,
+  SERVICE_UNAVAILABLE: ProtocolHttpStatus.SERVICE_UNAVAILABLE,
+  GATEWAY_TIMEOUT: ProtocolHttpStatus.GATEWAY_TIMEOUT,
+} as const;
 
 /**
  * Base error class for HTTP-related errors
  */
 export class HttpError extends Error {
-  constructor(message: string, public readonly statusCode: HttpStatus = HttpStatus.INTERNAL_SERVER_ERROR) {
+  constructor(message: string, public readonly statusCode: number = HttpStatus.INTERNAL_SERVER_ERROR) {
     super(message);
     this.name = 'HttpError';
   }
@@ -61,7 +62,7 @@ export class CertificateError extends HttpError {
  * Error related to server operations
  */
 export class ServerError extends HttpError {
-  constructor(message: string, public readonly code?: string, statusCode: HttpStatus = HttpStatus.INTERNAL_SERVER_ERROR) {
+  constructor(message: string, public readonly code?: string, statusCode: number = HttpStatus.INTERNAL_SERVER_ERROR) {
     super(message, statusCode);
     this.name = 'ServerError';
   }
@@ -93,7 +94,7 @@ export class NotFoundError extends HttpError {
 export interface IRedirectConfig {
   source: string;           // Source path or pattern
   destination: string;      // Destination URL  
-  type: HttpStatus;         // Redirect status code
+  type: number;             // Redirect status code
   preserveQuery?: boolean;  // Whether to preserve query parameters
 }
 
@@ -115,30 +116,12 @@ export interface IRouterConfig {
  */
 export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'HEAD' | 'OPTIONS' | 'CONNECT' | 'TRACE';
 
+
 /**
  * Helper function to get HTTP status text
  */
-export function getStatusText(status: HttpStatus): string {
-  const statusTexts: Record<HttpStatus, string> = {
-    [HttpStatus.OK]: 'OK',
-    [HttpStatus.MOVED_PERMANENTLY]: 'Moved Permanently',
-    [HttpStatus.FOUND]: 'Found',
-    [HttpStatus.TEMPORARY_REDIRECT]: 'Temporary Redirect',
-    [HttpStatus.PERMANENT_REDIRECT]: 'Permanent Redirect',
-    [HttpStatus.BAD_REQUEST]: 'Bad Request',
-    [HttpStatus.UNAUTHORIZED]: 'Unauthorized',
-    [HttpStatus.FORBIDDEN]: 'Forbidden',
-    [HttpStatus.NOT_FOUND]: 'Not Found',
-    [HttpStatus.METHOD_NOT_ALLOWED]: 'Method Not Allowed',
-    [HttpStatus.REQUEST_TIMEOUT]: 'Request Timeout',
-    [HttpStatus.TOO_MANY_REQUESTS]: 'Too Many Requests',
-    [HttpStatus.INTERNAL_SERVER_ERROR]: 'Internal Server Error',
-    [HttpStatus.NOT_IMPLEMENTED]: 'Not Implemented',
-    [HttpStatus.BAD_GATEWAY]: 'Bad Gateway',
-    [HttpStatus.SERVICE_UNAVAILABLE]: 'Service Unavailable',
-    [HttpStatus.GATEWAY_TIMEOUT]: 'Gateway Timeout',
-  };
-  return statusTexts[status] || 'Unknown';
+export function getStatusText(status: number): string {
+  return getProtocolStatusText(status as ProtocolHttpStatus);
 }
 
 // Legacy interfaces for backward compatibility

package/ts/proxies/smart-proxy/models/interfaces.ts

@@ -195,4 +195,11 @@ export interface IConnectionRecord {
   
   // NFTables tracking
   nftablesHandled?: boolean; // Whether this connection is being handled by NFTables at kernel level
+  
+  // HTTP-specific information (extracted from protocol detection)
+  httpInfo?: {
+    method?: string;
+    path?: string;
+    headers?: Record<string, string>;
+  };
 }

package/ts/proxies/smart-proxy/route-connection-handler.ts

@@ -10,6 +10,7 @@ import { WrappedSocket } from '../../core/models/wrapped-socket.js';
 import { getUnderlyingSocket } from '../../core/models/socket-types.js';
 import { ProxyProtocolParser } from '../../core/utils/proxy-protocol.js';
 import type { SmartProxy } from './smart-proxy.js';
+import { ProtocolDetector } from '../../detection/index.js';
 
 /**
  * Handles new connection processing and setup logic with support for route-based configuration
@@ -301,11 +302,27 @@ export class RouteConnectionHandler {
     });
 
     // Handler for processing initial data (after potential PROXY protocol)
-    const processInitialData = (chunk: Buffer) => {
+    const processInitialData = async (chunk: Buffer) => {
+      // Use ProtocolDetector to identify protocol
+      const connectionId = ProtocolDetector.createConnectionId({
+        sourceIp: record.remoteIP,
+        sourcePort: socket.remotePort,
+        destIp: socket.localAddress,
+        destPort: socket.localPort,
+        socketId: record.id
+      });
+      
+      const detectionResult = await ProtocolDetector.detectWithConnectionTracking(
+        chunk,
+        connectionId,
+        { extractFullHeaders: false } // Only extract essential info for routing
+      );
+      
       // Block non-TLS connections on port 443
-      if (!this.smartProxy.tlsManager.isTlsHandshake(chunk) && localPort === 443) {
-        logger.log('warn', `Non-TLS connection ${connectionId} detected on port 443. Terminating connection - only TLS traffic is allowed on standard HTTPS port.`, {
-          connectionId,
+      if (localPort === 443 && detectionResult.protocol !== 'tls') {
+        logger.log('warn', `Non-TLS connection ${record.id} detected on port 443. Terminating connection - only TLS traffic is allowed on standard HTTPS port.`, {
+          connectionId: record.id,
+          detectedProtocol: detectionResult.protocol,
           message: 'Terminating connection - only TLS traffic is allowed on standard HTTPS port.',
           component: 'route-handler'
         });
@@ -318,71 +335,78 @@ export class RouteConnectionHandler {
         return;
       }
 
-      // Check if this looks like a TLS handshake
+      // Extract domain and protocol info
       let serverName = '';
-      if (this.smartProxy.tlsManager.isTlsHandshake(chunk)) {
+      if (detectionResult.protocol === 'tls') {
         record.isTLS = true;
+        serverName = detectionResult.connectionInfo.domain || '';
+        
+        // Lock the connection to the negotiated SNI
+        record.lockedDomain = serverName;
 
-        // Check for ClientHello to extract SNI
-        if (this.smartProxy.tlsManager.isClientHello(chunk)) {
-          // Create connection info for SNI extraction
-          const connInfo = {
-            sourceIp: record.remoteIP,
-            sourcePort: socket.remotePort || 0,
-            destIp: socket.localAddress || '',
-            destPort: socket.localPort || 0,
-          };
-
-          // Extract SNI
-          serverName = this.smartProxy.tlsManager.extractSNI(chunk, connInfo) || '';
-
-          // Lock the connection to the negotiated SNI
-          record.lockedDomain = serverName;
-
-          // Check if we should reject connections without SNI
-          if (!serverName && this.smartProxy.settings.allowSessionTicket === false) {
-            logger.log('warn', `No SNI detected in TLS ClientHello for connection ${connectionId}; sending TLS alert`, {
-              connectionId,
-              component: 'route-handler'
-            });
-            if (record.incomingTerminationReason === null) {
-              record.incomingTerminationReason = 'session_ticket_blocked_no_sni';
-              this.smartProxy.connectionManager.incrementTerminationStat(
-                'incoming',
-                'session_ticket_blocked_no_sni'
-              );
-            }
-            const alert = Buffer.from([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x70]);
-            try {
-              // Count the alert bytes being sent
-              record.bytesSent += alert.length;
-              if (this.smartProxy.metricsCollector) {
-                this.smartProxy.metricsCollector.recordBytes(record.id, 0, alert.length);
-              }
-              
-              socket.cork();
-              socket.write(alert);
-              socket.uncork();
-              socket.end();
-            } catch {
-              socket.end();
+        // Check if we should reject connections without SNI
+        if (!serverName && this.smartProxy.settings.allowSessionTicket === false) {
+          logger.log('warn', `No SNI detected in TLS ClientHello for connection ${record.id}; sending TLS alert`, {
+            connectionId: record.id,
+            component: 'route-handler'
+          });
+          if (record.incomingTerminationReason === null) {
+            record.incomingTerminationReason = 'session_ticket_blocked_no_sni';
+            this.smartProxy.connectionManager.incrementTerminationStat(
+              'incoming',
+              'session_ticket_blocked_no_sni'
+            );
+          }
+          const alert = Buffer.from([0x15, 0x03, 0x03, 0x00, 0x02, 0x01, 0x70]);
+          try {
+            // Count the alert bytes being sent
+            record.bytesSent += alert.length;
+            if (this.smartProxy.metricsCollector) {
+              this.smartProxy.metricsCollector.recordBytes(record.id, 0, alert.length);
             }
-            this.smartProxy.connectionManager.cleanupConnection(record, 'session_ticket_blocked_no_sni');
-            return;
+            
+            socket.cork();
+            socket.write(alert);
+            socket.uncork();
+            socket.end();
+          } catch {
+            socket.end();
           }
+          this.smartProxy.connectionManager.cleanupConnection(record, 'session_ticket_blocked_no_sni');
+          return;
+        }
 
-          if (this.smartProxy.settings.enableDetailedLogging) {
-            logger.log('info', `TLS connection with SNI`, {
-              connectionId,
-              serverName: serverName || '(empty)',
-              component: 'route-handler'
-            });
-          }
+        if (this.smartProxy.settings.enableDetailedLogging) {
+          logger.log('info', `TLS connection with SNI`, {
+            connectionId: record.id,
+            serverName: serverName || '(empty)',
+            component: 'route-handler'
+          });
+        }
+      } else if (detectionResult.protocol === 'http') {
+        // For HTTP, extract domain from Host header
+        serverName = detectionResult.connectionInfo.domain || '';
+        
+        // Store HTTP-specific info for later use
+        record.httpInfo = {
+          method: detectionResult.connectionInfo.method,
+          path: detectionResult.connectionInfo.path,
+          headers: detectionResult.connectionInfo.headers
+        };
+        
+        if (this.smartProxy.settings.enableDetailedLogging) {
+          logger.log('info', `HTTP connection detected`, {
+            connectionId: record.id,
+            domain: serverName || '(no host header)',
+            method: detectionResult.connectionInfo.method,
+            path: detectionResult.connectionInfo.path,
+            component: 'route-handler'
+          });
         }
       }
 
       // Find the appropriate route for this connection
-      this.routeConnection(socket, record, serverName, chunk);
+      this.routeConnection(socket, record, serverName, chunk, detectionResult);
     };
 
     // First data handler to capture initial TLS handshake or PROXY protocol
@@ -454,7 +478,8 @@ export class RouteConnectionHandler {
     socket: plugins.net.Socket | WrappedSocket,
     record: IConnectionRecord,
     serverName: string,
-    initialChunk?: Buffer
+    initialChunk?: Buffer,
+    detectionResult?: any // Using any temporarily to avoid circular dependency issues
   ): void {
     const connectionId = record.id;
     const localPort = record.localPort;
@@ -635,7 +660,7 @@ export class RouteConnectionHandler {
     // Handle the route based on its action type
     switch (route.action.type) {
       case 'forward':
-        return this.handleForwardAction(socket, record, route, initialChunk);
+        return this.handleForwardAction(socket, record, route, initialChunk, detectionResult);
 
       case 'socket-handler':
         logger.log('info', `Handling socket-handler action for route ${route.name}`, {
@@ -738,7 +763,8 @@ export class RouteConnectionHandler {
     socket: plugins.net.Socket | WrappedSocket,
     record: IConnectionRecord,
     route: IRouteConfig,
-    initialChunk?: Buffer
+    initialChunk?: Buffer,
+    detectionResult?: any // Using any temporarily to avoid circular dependency issues
   ): void {
     const connectionId = record.id;
     const action = route.action as IRouteAction;
@@ -819,14 +845,11 @@ export class RouteConnectionHandler {
     // Create context for target selection
     const targetSelectionContext = {
       port: record.localPort,
-      path: undefined, // Will be populated from HTTP headers if available
-      headers: undefined, // Will be populated from HTTP headers if available
-      method: undefined // Will be populated from HTTP headers if available
+      path: record.httpInfo?.path,
+      headers: record.httpInfo?.headers,
+      method: record.httpInfo?.method
     };
     
-    // TODO: Extract path, headers, and method from initialChunk if it's HTTP
-    // For now, we'll select based on port only
-    
     const selectedTarget = this.selectTarget(action.targets, targetSelectionContext);
     if (!selectedTarget) {
       logger.log('error', `No matching target found for connection ${connectionId}`, {

package/ts/proxies/smart-proxy/tls-manager.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../../plugins.js';
 import { SniHandler } from '../../tls/sni/sni-handler.js';
+import { ProtocolDetector, TlsDetector } from '../../detection/index.js';
 import type { SmartProxy } from './smart-proxy.js';
 
 /**

package/ts/proxies/smart-proxy/utils/route-helpers.ts

@@ -21,6 +21,7 @@
 import * as plugins from '../../../plugins.js';
 import type { IRouteConfig, IRouteMatch, IRouteAction, IRouteTarget, TPortRange, IRouteContext } from '../models/route-types.js';
 import { mergeRouteConfigs } from './route-utils.js';
+import { ProtocolDetector, HttpDetector } from '../../../detection/index.js';
 
 /**
  * Create an HTTP-only route configuration
@@ -956,83 +957,91 @@ export const SocketHandlers = {
   
   /**
    * HTTP redirect handler
+   * Now uses the centralized detection module for HTTP parsing
    */
   httpRedirect: (locationTemplate: string, statusCode: number = 301) => (socket: plugins.net.Socket, context: IRouteContext) => {
-    let buffer = '';
+    const connectionId = ProtocolDetector.createConnectionId({
+      socketId: context.connectionId || `${Date.now()}-${Math.random()}`
+    });
     
-    socket.once('data', (data) => {
-      buffer += data.toString();
-      
-      const lines = buffer.split('\r\n');
-      const requestLine = lines[0];
-      const [method, path] = requestLine.split(' ');
-      
-      const domain = context.domain || 'localhost';
-      const port = context.port;
-      
-      let finalLocation = locationTemplate
-        .replace('{domain}', domain)
-        .replace('{port}', String(port))
-        .replace('{path}', path)
-        .replace('{clientIp}', context.clientIp);
+    socket.once('data', async (data) => {
+      // Use detection module for parsing
+      const detectionResult = await ProtocolDetector.detectWithConnectionTracking(
+        data,
+        connectionId,
+        { extractFullHeaders: false } // We only need method and path
+      );
       
-      const message = `Redirecting to ${finalLocation}`;
-      const response = [
-        `HTTP/1.1 ${statusCode} ${statusCode === 301 ? 'Moved Permanently' : 'Found'}`,
-        `Location: ${finalLocation}`,
-        'Content-Type: text/plain',
-        `Content-Length: ${message.length}`,
-        'Connection: close',
-        '',
-        message
-      ].join('\r\n');
+      if (detectionResult.protocol === 'http' && detectionResult.connectionInfo.path) {
+        const method = detectionResult.connectionInfo.method || 'GET';
+        const path = detectionResult.connectionInfo.path || '/';
+        
+        const domain = context.domain || 'localhost';
+        const port = context.port;
+        
+        let finalLocation = locationTemplate
+          .replace('{domain}', domain)
+          .replace('{port}', String(port))
+          .replace('{path}', path)
+          .replace('{clientIp}', context.clientIp);
+        
+        const message = `Redirecting to ${finalLocation}`;
+        const response = [
+          `HTTP/1.1 ${statusCode} ${statusCode === 301 ? 'Moved Permanently' : 'Found'}`,
+          `Location: ${finalLocation}`,
+          'Content-Type: text/plain',
+          `Content-Length: ${message.length}`,
+          'Connection: close',
+          '',
+          message
+        ].join('\r\n');
+        
+        socket.write(response);
+      } else {
+        // Not a valid HTTP request, close connection
+        socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+      }
       
-      socket.write(response);
       socket.end();
+      // Clean up detection state
+      ProtocolDetector.cleanupConnections();
     });
   },
   
   /**
    * HTTP server handler for ACME challenges and other HTTP needs
+   * Now uses the centralized detection module for HTTP parsing
    */
   httpServer: (handler: (req: { method: string; url: string; headers: Record<string, string>; body?: string }, res: { status: (code: number) => void; header: (name: string, value: string) => void; send: (data: string) => void; end: () => void }) => void) => (socket: plugins.net.Socket, context: IRouteContext) => {
-    let buffer = '';
     let requestParsed = false;
+    const connectionId = ProtocolDetector.createConnectionId({
+      socketId: context.connectionId || `${Date.now()}-${Math.random()}`
+    });
     
-    socket.on('data', (data) => {
+    const processData = async (data: Buffer) => {
       if (requestParsed) return; // Only handle the first request
       
-      buffer += data.toString();
+      // Use HttpDetector for parsing
+      const detectionResult = await ProtocolDetector.detectWithConnectionTracking(
+        data,
+        connectionId,
+        { extractFullHeaders: true }
+      );
       
-      // Check if we have a complete HTTP request
-      const headerEndIndex = buffer.indexOf('\r\n\r\n');
-      if (headerEndIndex === -1) return; // Need more data
+      if (detectionResult.protocol !== 'http' || !detectionResult.isComplete) {
+        // Not a complete HTTP request yet
+        return;
+      }
       
       requestParsed = true;
+      const connInfo = detectionResult.connectionInfo;
       
-      // Parse the HTTP request
-      const headerPart = buffer.substring(0, headerEndIndex);
-      const bodyPart = buffer.substring(headerEndIndex + 4);
-      
-      const lines = headerPart.split('\r\n');
-      const [method, url] = lines[0].split(' ');
-      
-      const headers: Record<string, string> = {};
-      for (let i = 1; i < lines.length; i++) {
-        const colonIndex = lines[i].indexOf(':');
-        if (colonIndex > 0) {
-          const name = lines[i].substring(0, colonIndex).trim().toLowerCase();
-          const value = lines[i].substring(colonIndex + 1).trim();
-          headers[name] = value;
-        }
-      }
-      
-      // Create request object
+      // Create request object from detection result
       const req = {
-        method: method || 'GET',
-        url: url || '/',
-        headers,
-        body: bodyPart
+        method: connInfo.method || 'GET',
+        url: connInfo.path || '/',
+        headers: connInfo.headers || {},
+        body: detectionResult.remainingBuffer?.toString() || ''
       };
       
       // Create response object
@@ -1093,13 +1102,20 @@ export const SocketHandlers = {
           res.send('Internal Server Error');
         }
       }
-    });
+    };
+    
+    socket.on('data', processData);
     
     socket.on('error', () => {
       if (!requestParsed) {
         socket.end();
       }
     });
+    
+    socket.on('close', () => {
+      // Clean up detection state
+      ProtocolDetector.cleanupConnections();
+    });
   }
 };
 

package/ts/tls/index.ts

@@ -1,22 +1,18 @@
 /**
- * TLS module providing SNI extraction, TLS alerts, and other TLS-related utilities
+ * TLS module for smartproxy
+ * Re-exports protocol components and provides smartproxy-specific functionality
  */
 
-// Export TLS alert functionality
-export * from './alerts/tls-alert.js';
+// Re-export all protocol components from protocols/tls
+export * from '../protocols/tls/index.js';
 
-// Export SNI handling
+// Export smartproxy-specific SNI handler
 export * from './sni/sni-handler.js';
-export * from './sni/sni-extraction.js';
-export * from './sni/client-hello-parser.js';
-
-// Export TLS utilities
-export * from './utils/tls-utils.js';
 
 // Create a namespace for SNI utilities
 import { SniHandler } from './sni/sni-handler.js';
-import { SniExtraction } from './sni/sni-extraction.js';
-import { ClientHelloParser } from './sni/client-hello-parser.js';
+import { SniExtraction } from '../protocols/tls/sni/sni-extraction.js';
+import { ClientHelloParser } from '../protocols/tls/sni/client-hello-parser.js';
 
 // Export utility objects for convenience
 export const SNI = {
@@ -30,4 +26,4 @@ export const SNI = {
   // Convenience functions
   extractSNI: SniHandler.extractSNI,
   processTlsPacket: SniHandler.processTlsPacket,
-};
+};

package/ts/tls/sni/sni-handler.ts

@@ -4,15 +4,15 @@ import {
   TlsHandshakeType,
   TlsExtensionType,
   TlsUtils
-} from '../utils/tls-utils.js';
+} from '../../protocols/tls/utils/tls-utils.js';
 import {
   ClientHelloParser,
   type LoggerFunction
-} from './client-hello-parser.js';
+} from '../../protocols/tls/sni/client-hello-parser.js';
 import {
   SniExtraction,
   type ConnectionInfo
-} from './sni-extraction.js';
+} from '../../protocols/tls/sni/sni-extraction.js';
 
 /**
  * SNI (Server Name Indication) handler for TLS connections.