@push.rocks/smartproxy 21.1.7 → 22.6.0

package/ts/proxies/smart-proxy/utils/route-helpers/https-helpers.ts

@@ -0,0 +1,163 @@
+/**
+ * HTTPS Route Helper Functions
+ *
+ * This module provides utility functions for creating HTTPS route configurations
+ * including TLS termination and passthrough routes.
+ */
+
+import type { IRouteConfig, IRouteMatch, IRouteAction } from '../../models/route-types.js';
+import { SocketHandlers } from './socket-handlers.js';
+
+/**
+ * Create an HTTPS route with TLS termination
+ * @param domains Domain(s) to match
+ * @param target Target host and port
+ * @param options Additional route options
+ * @returns Route configuration object
+ */
+export function createHttpsTerminateRoute(
+  domains: string | string[],
+  target: { host: string | string[]; port: number },
+  options: {
+    certificate?: 'auto' | { key: string; cert: string };
+    httpPort?: number | number[];
+    httpsPort?: number | number[];
+    reencrypt?: boolean;
+    name?: string;
+    [key: string]: any;
+  } = {}
+): IRouteConfig {
+  // Create route match
+  const match: IRouteMatch = {
+    ports: options.httpsPort || 443,
+    domains
+  };
+
+  // Create route action
+  const action: IRouteAction = {
+    type: 'forward',
+    targets: [target],
+    tls: {
+      mode: options.reencrypt ? 'terminate-and-reencrypt' : 'terminate',
+      certificate: options.certificate || 'auto'
+    }
+  };
+
+  // Create the route config
+  return {
+    match,
+    action,
+    name: options.name || `HTTPS Route for ${Array.isArray(domains) ? domains.join(', ') : domains}`,
+    ...options
+  };
+}
+
+/**
+ * Create an HTTP to HTTPS redirect route
+ * @param domains Domain(s) to match
+ * @param httpsPort HTTPS port to redirect to (default: 443)
+ * @param options Additional route options
+ * @returns Route configuration object
+ */
+export function createHttpToHttpsRedirect(
+  domains: string | string[],
+  httpsPort: number = 443,
+  options: Partial<IRouteConfig> = {}
+): IRouteConfig {
+  // Create route match
+  const match: IRouteMatch = {
+    ports: options.match?.ports || 80,
+    domains
+  };
+
+  // Create route action
+  const action: IRouteAction = {
+    type: 'socket-handler',
+    socketHandler: SocketHandlers.httpRedirect(`https://{domain}:${httpsPort}{path}`, 301)
+  };
+
+  // Create the route config
+  return {
+    match,
+    action,
+    name: options.name || `HTTP to HTTPS Redirect for ${Array.isArray(domains) ? domains.join(', ') : domains}`,
+    ...options
+  };
+}
+
+/**
+ * Create an HTTPS passthrough route (SNI-based forwarding without TLS termination)
+ * @param domains Domain(s) to match
+ * @param target Target host and port
+ * @param options Additional route options
+ * @returns Route configuration object
+ */
+export function createHttpsPassthroughRoute(
+  domains: string | string[],
+  target: { host: string | string[]; port: number },
+  options: Partial<IRouteConfig> = {}
+): IRouteConfig {
+  // Create route match
+  const match: IRouteMatch = {
+    ports: options.match?.ports || 443,
+    domains
+  };
+
+  // Create route action
+  const action: IRouteAction = {
+    type: 'forward',
+    targets: [target],
+    tls: {
+      mode: 'passthrough'
+    }
+  };
+
+  // Create the route config
+  return {
+    match,
+    action,
+    name: options.name || `HTTPS Passthrough for ${Array.isArray(domains) ? domains.join(', ') : domains}`,
+    ...options
+  };
+}
+
+/**
+ * Create a complete HTTPS server with HTTP to HTTPS redirects
+ * @param domains Domain(s) to match
+ * @param target Target host and port
+ * @param options Additional configuration options
+ * @returns Array of two route configurations (HTTPS and HTTP redirect)
+ */
+export function createCompleteHttpsServer(
+  domains: string | string[],
+  target: { host: string | string[]; port: number },
+  options: {
+    certificate?: 'auto' | { key: string; cert: string };
+    httpPort?: number | number[];
+    httpsPort?: number | number[];
+    reencrypt?: boolean;
+    name?: string;
+    [key: string]: any;
+  } = {}
+): IRouteConfig[] {
+  // Create the HTTPS route
+  const httpsRoute = createHttpsTerminateRoute(domains, target, options);
+
+  // Create the HTTP redirect route
+  const httpRedirectRoute = createHttpToHttpsRedirect(
+    domains,
+    // Extract the HTTPS port from the HTTPS route - ensure it's a number
+    typeof options.httpsPort === 'number' ? options.httpsPort :
+      Array.isArray(options.httpsPort) ? options.httpsPort[0] : 443,
+    {
+      // Set the HTTP port
+      match: {
+        ports: options.httpPort || 80,
+        domains
+      },
+      name: `HTTP to HTTPS Redirect for ${Array.isArray(domains) ? domains.join(', ') : domains}`
+    }
+  );
+
+  return [httpsRoute, httpRedirectRoute];
+}

package/ts/proxies/smart-proxy/utils/route-helpers/index.ts

@@ -0,0 +1,62 @@
+/**
+ * Route Helper Functions
+ *
+ * This module provides utility functions for creating route configurations for common scenarios.
+ * These functions aim to simplify the creation of route configurations for typical use cases.
+ *
+ * This barrel file re-exports all helper functions for backwards compatibility.
+ */
+
+// HTTP helpers
+export { createHttpRoute } from './http-helpers.js';
+
+// HTTPS helpers
+export {
+  createHttpsTerminateRoute,
+  createHttpToHttpsRedirect,
+  createHttpsPassthroughRoute,
+  createCompleteHttpsServer
+} from './https-helpers.js';
+
+// WebSocket helpers
+export { createWebSocketRoute } from './websocket-helpers.js';
+
+// Load balancer helpers
+export {
+  createLoadBalancerRoute,
+  createSmartLoadBalancer
+} from './load-balancer-helpers.js';
+
+// NFTables helpers
+export {
+  createNfTablesRoute,
+  createNfTablesTerminateRoute,
+  createCompleteNfTablesHttpsServer
+} from './nftables-helpers.js';
+
+// Dynamic routing helpers
+export {
+  createPortOffset,
+  createPortMappingRoute,
+  createOffsetPortMappingRoute,
+  createDynamicRoute
+} from './dynamic-helpers.js';
+
+// API helpers
+export {
+  createApiRoute,
+  createApiGatewayRoute
+} from './api-helpers.js';
+
+// Security helpers
+export {
+  addRateLimiting,
+  addBasicAuth,
+  addJwtAuth
+} from './security-helpers.js';
+
+// Socket handlers
+export {
+  SocketHandlers,
+  createSocketHandlerRoute
+} from './socket-handlers.js';

package/ts/proxies/smart-proxy/utils/route-helpers/load-balancer-helpers.ts

@@ -0,0 +1,154 @@
+/**
+ * Load Balancer Route Helper Functions
+ *
+ * This module provides utility functions for creating load balancer route configurations.
+ */
+
+import type { IRouteConfig, IRouteMatch, IRouteAction, IRouteTarget, TPortRange, IRouteContext } from '../../models/route-types.js';
+
+/**
+ * Create a load balancer route (round-robin between multiple backend hosts)
+ * @param domains Domain(s) to match
+ * @param backendsOrHosts Array of backend servers OR array of host strings (legacy)
+ * @param portOrOptions Port number (legacy) OR options object
+ * @param options Additional route options (legacy)
+ * @returns Route configuration object
+ */
+export function createLoadBalancerRoute(
+  domains: string | string[],
+  backendsOrHosts: Array<{ host: string; port: number }> | string[],
+  portOrOptions?: number | {
+    tls?: {
+      mode: 'passthrough' | 'terminate' | 'terminate-and-reencrypt';
+      certificate?: 'auto' | { key: string; cert: string };
+    };
+    useTls?: boolean;
+    certificate?: 'auto' | { key: string; cert: string };
+    algorithm?: 'round-robin' | 'least-connections' | 'ip-hash';
+    healthCheck?: {
+      path: string;
+      interval: number;
+      timeout: number;
+      unhealthyThreshold: number;
+      healthyThreshold: number;
+    };
+    [key: string]: any;
+  },
+  options?: {
+    tls?: {
+      mode: 'passthrough' | 'terminate' | 'terminate-and-reencrypt';
+      certificate?: 'auto' | { key: string; cert: string };
+    };
+    [key: string]: any;
+  }
+): IRouteConfig {
+  // Handle legacy signature: (domains, hosts[], port, options)
+  let backends: Array<{ host: string; port: number }>;
+  let finalOptions: any;
+
+  if (Array.isArray(backendsOrHosts) && backendsOrHosts.length > 0 && typeof backendsOrHosts[0] === 'string') {
+    // Legacy signature
+    const hosts = backendsOrHosts as string[];
+    const port = portOrOptions as number;
+    backends = hosts.map(host => ({ host, port }));
+    finalOptions = options || {};
+  } else {
+    // New signature
+    backends = backendsOrHosts as Array<{ host: string; port: number }>;
+    finalOptions = (portOrOptions as any) || {};
+  }
+
+  // Extract hosts and ensure all backends use the same port
+  const port = backends[0].port;
+  const hosts = backends.map(backend => backend.host);
+
+  // Create route match
+  const match: IRouteMatch = {
+    ports: finalOptions.match?.ports || (finalOptions.tls || finalOptions.useTls ? 443 : 80),
+    domains
+  };
+
+  // Create route target
+  const target: IRouteTarget = {
+    host: hosts,
+    port
+  };
+
+  // Create route action
+  const action: IRouteAction = {
+    type: 'forward',
+    targets: [target]
+  };
+
+  // Add TLS configuration if provided
+  if (finalOptions.tls || finalOptions.useTls) {
+    action.tls = {
+      mode: finalOptions.tls?.mode || 'terminate',
+      certificate: finalOptions.tls?.certificate || finalOptions.certificate || 'auto'
+    };
+  }
+
+  // Add load balancing options
+  if (finalOptions.algorithm || finalOptions.healthCheck) {
+    action.loadBalancing = {
+      algorithm: finalOptions.algorithm || 'round-robin',
+      healthCheck: finalOptions.healthCheck
+    };
+  }
+
+  // Create the route config
+  return {
+    match,
+    action,
+    name: finalOptions.name || `Load Balancer for ${Array.isArray(domains) ? domains.join(', ') : domains}`,
+    ...finalOptions
+  };
+}
+
+/**
+ * Create a smart load balancer with dynamic domain-based backend selection
+ * @param options Smart load balancer options
+ * @returns Route configuration object
+ */
+export function createSmartLoadBalancer(options: {
+  ports: TPortRange;
+  domainTargets: Record<string, string | string[]>;
+  portMapper: (context: IRouteContext) => number;
+  name?: string;
+  defaultTarget?: string | string[];
+  priority?: number;
+  [key: string]: any;
+}): IRouteConfig {
+  // Extract all domain keys to create the match criteria
+  const domains = Object.keys(options.domainTargets);
+
+  // Create the smart host selector function
+  const hostSelector = (context: IRouteContext) => {
+    const domain = context.domain || '';
+    return options.domainTargets[domain] || options.defaultTarget || 'localhost';
+  };
+
+  // Create route match
+  const match: IRouteMatch = {
+    ports: options.ports,
+    domains
+  };
+
+  // Create route action
+  const action: IRouteAction = {
+    type: 'forward',
+    targets: [{
+      host: hostSelector,
+      port: options.portMapper
+    }]
+  };
+
+  // Create the route config
+  return {
+    match,
+    action,
+    name: options.name || `Smart Load Balancer for ${domains.join(', ')}`,
+    priority: options.priority,
+    ...options
+  };
+}

package/ts/proxies/smart-proxy/utils/route-helpers/nftables-helpers.ts

@@ -0,0 +1,202 @@
+/**
+ * NFTables Route Helper Functions
+ *
+ * This module provides utility functions for creating NFTables-based route configurations
+ * for high-performance packet forwarding at the kernel level.
+ */
+
+import type { IRouteConfig, IRouteMatch, IRouteAction, TPortRange } from '../../models/route-types.js';
+import { createHttpToHttpsRedirect } from './https-helpers.js';
+
+/**
+ * Create an NFTables-based route for high-performance packet forwarding
+ * @param nameOrDomains Name or domain(s) to match
+ * @param target Target host and port
+ * @param options Additional route options
+ * @returns Route configuration object
+ */
+export function createNfTablesRoute(
+  nameOrDomains: string | string[],
+  target: { host: string; port: number | 'preserve' },
+  options: {
+    ports?: TPortRange;
+    protocol?: 'tcp' | 'udp' | 'all';
+    preserveSourceIP?: boolean;
+    ipAllowList?: string[];
+    ipBlockList?: string[];
+    maxRate?: string;
+    priority?: number;
+    useTls?: boolean;
+    tableName?: string;
+    useIPSets?: boolean;
+    useAdvancedNAT?: boolean;
+  } = {}
+): IRouteConfig {
+  // Determine if this is a name or domain
+  let name: string;
+  let domains: string | string[] | undefined;
+
+  if (Array.isArray(nameOrDomains) || (typeof nameOrDomains === 'string' && nameOrDomains.includes('.'))) {
+    domains = nameOrDomains;
+    name = Array.isArray(nameOrDomains) ? nameOrDomains[0] : nameOrDomains;
+  } else {
+    name = nameOrDomains;
+    domains = undefined; // No domains
+  }
+
+  // Create route match
+  const match: IRouteMatch = {
+    domains,
+    ports: options.ports || 80
+  };
+
+  // Create route action
+  const action: IRouteAction = {
+    type: 'forward',
+    targets: [{
+      host: target.host,
+      port: target.port
+    }],
+    forwardingEngine: 'nftables',
+    nftables: {
+      protocol: options.protocol || 'tcp',
+      preserveSourceIP: options.preserveSourceIP,
+      maxRate: options.maxRate,
+      priority: options.priority,
+      tableName: options.tableName,
+      useIPSets: options.useIPSets,
+      useAdvancedNAT: options.useAdvancedNAT
+    }
+  };
+
+  // Add TLS options if needed
+  if (options.useTls) {
+    action.tls = {
+      mode: 'passthrough'
+    };
+  }
+
+  // Create the route config
+  const routeConfig: IRouteConfig = {
+    name,
+    match,
+    action
+  };
+
+  // Add security if allowed or blocked IPs are specified
+  if (options.ipAllowList?.length || options.ipBlockList?.length) {
+    routeConfig.security = {
+      ipAllowList: options.ipAllowList,
+      ipBlockList: options.ipBlockList
+    };
+  }
+
+  return routeConfig;
+}
+
+/**
+ * Create an NFTables-based TLS termination route
+ * @param nameOrDomains Name or domain(s) to match
+ * @param target Target host and port
+ * @param options Additional route options
+ * @returns Route configuration object
+ */
+export function createNfTablesTerminateRoute(
+  nameOrDomains: string | string[],
+  target: { host: string; port: number | 'preserve' },
+  options: {
+    ports?: TPortRange;
+    protocol?: 'tcp' | 'udp' | 'all';
+    preserveSourceIP?: boolean;
+    ipAllowList?: string[];
+    ipBlockList?: string[];
+    maxRate?: string;
+    priority?: number;
+    tableName?: string;
+    useIPSets?: boolean;
+    useAdvancedNAT?: boolean;
+    certificate?: 'auto' | { key: string; cert: string };
+  } = {}
+): IRouteConfig {
+  // Create basic NFTables route
+  const route = createNfTablesRoute(
+    nameOrDomains,
+    target,
+    {
+      ...options,
+      ports: options.ports || 443,
+      useTls: false
+    }
+  );
+
+  // Set TLS termination
+  route.action.tls = {
+    mode: 'terminate',
+    certificate: options.certificate || 'auto'
+  };
+
+  return route;
+}
+
+/**
+ * Create a complete NFTables-based HTTPS setup with HTTP redirect
+ * @param nameOrDomains Name or domain(s) to match
+ * @param target Target host and port
+ * @param options Additional route options
+ * @returns Array of two route configurations (HTTPS and HTTP redirect)
+ */
+export function createCompleteNfTablesHttpsServer(
+  nameOrDomains: string | string[],
+  target: { host: string; port: number | 'preserve' },
+  options: {
+    httpPort?: TPortRange;
+    httpsPort?: TPortRange;
+    protocol?: 'tcp' | 'udp' | 'all';
+    preserveSourceIP?: boolean;
+    ipAllowList?: string[];
+    ipBlockList?: string[];
+    maxRate?: string;
+    priority?: number;
+    tableName?: string;
+    useIPSets?: boolean;
+    useAdvancedNAT?: boolean;
+    certificate?: 'auto' | { key: string; cert: string };
+  } = {}
+): IRouteConfig[] {
+  // Create the HTTPS route using NFTables
+  const httpsRoute = createNfTablesTerminateRoute(
+    nameOrDomains,
+    target,
+    {
+      ...options,
+      ports: options.httpsPort || 443
+    }
+  );
+
+  // Determine the domain(s) for HTTP redirect
+  const domains = typeof nameOrDomains === 'string' && !nameOrDomains.includes('.')
+    ? undefined
+    : nameOrDomains;
+
+  // Extract the HTTPS port for the redirect destination
+  const httpsPort = typeof options.httpsPort === 'number'
+    ? options.httpsPort
+    : Array.isArray(options.httpsPort) && typeof options.httpsPort[0] === 'number'
+      ? options.httpsPort[0]
+      : 443;
+
+  // Create the HTTP redirect route (this uses standard forwarding, not NFTables)
+  const httpRedirectRoute = createHttpToHttpsRedirect(
+    domains as any, // Type cast needed since domains can be undefined now
+    httpsPort,
+    {
+      match: {
+        ports: options.httpPort || 80,
+        domains: domains as any // Type cast needed since domains can be undefined now
+      },
+      name: `HTTP to HTTPS Redirect for ${Array.isArray(domains) ? domains.join(', ') : domains || 'all domains'}`
+    }
+  );
+
+  return [httpsRoute, httpRedirectRoute];
+}

package/ts/proxies/smart-proxy/utils/route-helpers/security-helpers.ts

@@ -0,0 +1,96 @@
+/**
+ * Security Route Helper Functions
+ *
+ * This module provides utility functions for adding security features to routes.
+ */
+
+import type { IRouteConfig } from '../../models/route-types.js';
+import { mergeRouteConfigs } from '../route-utils.js';
+
+/**
+ * Create a rate limiting route pattern
+ * @param baseRoute Base route to add rate limiting to
+ * @param rateLimit Rate limiting configuration
+ * @returns Route with rate limiting
+ */
+export function addRateLimiting(
+  baseRoute: IRouteConfig,
+  rateLimit: {
+    maxRequests: number;
+    window: number; // Time window in seconds
+    keyBy?: 'ip' | 'path' | 'header';
+    headerName?: string; // Required if keyBy is 'header'
+    errorMessage?: string;
+  }
+): IRouteConfig {
+  return mergeRouteConfigs(baseRoute, {
+    security: {
+      rateLimit: {
+        enabled: true,
+        maxRequests: rateLimit.maxRequests,
+        window: rateLimit.window,
+        keyBy: rateLimit.keyBy || 'ip',
+        headerName: rateLimit.headerName,
+        errorMessage: rateLimit.errorMessage || 'Rate limit exceeded. Please try again later.'
+      }
+    }
+  });
+}
+
+/**
+ * Create a basic authentication route pattern
+ * @param baseRoute Base route to add authentication to
+ * @param auth Authentication configuration
+ * @returns Route with basic authentication
+ */
+export function addBasicAuth(
+  baseRoute: IRouteConfig,
+  auth: {
+    users: Array<{ username: string; password: string }>;
+    realm?: string;
+    excludePaths?: string[];
+  }
+): IRouteConfig {
+  return mergeRouteConfigs(baseRoute, {
+    security: {
+      basicAuth: {
+        enabled: true,
+        users: auth.users,
+        realm: auth.realm || 'Restricted Area',
+        excludePaths: auth.excludePaths || []
+      }
+    }
+  });
+}
+
+/**
+ * Create a JWT authentication route pattern
+ * @param baseRoute Base route to add JWT authentication to
+ * @param jwt JWT authentication configuration
+ * @returns Route with JWT authentication
+ */
+export function addJwtAuth(
+  baseRoute: IRouteConfig,
+  jwt: {
+    secret: string;
+    algorithm?: string;
+    issuer?: string;
+    audience?: string;
+    expiresIn?: number; // Time in seconds
+    excludePaths?: string[];
+  }
+): IRouteConfig {
+  return mergeRouteConfigs(baseRoute, {
+    security: {
+      jwtAuth: {
+        enabled: true,
+        secret: jwt.secret,
+        algorithm: jwt.algorithm || 'HS256',
+        issuer: jwt.issuer,
+        audience: jwt.audience,
+        expiresIn: jwt.expiresIn,
+        excludePaths: jwt.excludePaths || []
+      }
+    }
+  });
+}