@push.rocks/smartproxy 27.12.7 → 27.13.0

package/ts/proxies/smart-proxy/utils/route-validator.ts

@@ -1,5 +1,5 @@
 import { logger } from '../../../core/utils/logger.js';
-import type { IRouteConfig, IRouteMatch, IRouteAction, TPortRange } from '../models/route-types.js';
+import type { IInboundProxyProtocolPolicy, IRouteConfig, IRouteMatch, IRouteAction, TPortRange, TTransportProtocol } from '../models/route-types.js';
 
 /**
  * Validates route configurations for correctness and safety
@@ -93,6 +93,25 @@ export class RouteValidator {
         }
       }
 
+      // Validate inbound PROXY protocol policy
+      if (route.match.inboundProxyProtocol) {
+        const policy = route.match.inboundProxyProtocol;
+        if (!['reject', 'optional', 'required'].includes(policy.mode)) {
+          errors.push(`Invalid inbound PROXY protocol mode: ${policy.mode}`);
+        }
+        if (policy.trustedProxyIPs !== undefined) {
+          if (!Array.isArray(policy.trustedProxyIPs) || policy.trustedProxyIPs.length === 0) {
+            errors.push('inboundProxyProtocol.trustedProxyIPs must be a non-empty array when specified');
+          } else {
+            for (const ip of policy.trustedProxyIPs) {
+              if (!this.isValidIPPattern(ip)) {
+                errors.push(`Invalid trusted proxy IP pattern: ${ip}`);
+              }
+            }
+          }
+        }
+      }
+
       // Validate headers
       if (route.match.headers) {
         for (const [key, value] of Object.entries(route.match.headers)) {
@@ -344,9 +363,73 @@ export class RouteValidator {
       }
     }
 
+    // Inbound PROXY protocol is listener-scoped. A route-level declaration is
+    // a shorthand for the full port/transport listener policy, so every route
+    // sharing that listener must either all omit it or all use an identical one.
+    const listenerPolicies = new Map<string, { route: string; fingerprint: string }>();
+    for (const route of routes) {
+      if (!route.match?.ports) {
+        continue;
+      }
+
+      for (const port of this.expandPorts(route.match.ports)) {
+        for (const transport of this.transportsForMatch(route.match.transport)) {
+          const key = `${transport}:${port}`;
+          const fingerprint = this.inboundProxyPolicyFingerprint(route.match.inboundProxyProtocol);
+          const existing = listenerPolicies.get(key);
+          if (!existing) {
+            listenerPolicies.set(key, {
+              route: route.name || 'unnamed',
+              fingerprint,
+            });
+          } else if (existing.fingerprint !== fingerprint) {
+            conflicts.push({
+              route: route.name || 'unnamed',
+              message: `Conflicting inbound PROXY protocol policy on ${transport} port ${port} (differs from ${existing.route})`,
+            });
+          }
+        }
+      }
+    }
+
     return conflicts;
   }
 
+  private static expandPorts(ports: TPortRange): number[] {
+    const entries = Array.isArray(ports) ? ports : [ports];
+    const expandedPorts: number[] = [];
+    for (const port of entries) {
+      if (typeof port === 'number') {
+        expandedPorts.push(port);
+      } else if (typeof port === 'object' && 'from' in port && 'to' in port) {
+        for (let current = port.from; current <= port.to; current++) {
+          expandedPorts.push(current);
+        }
+      }
+    }
+    return expandedPorts;
+  }
+
+  private static transportsForMatch(transport?: TTransportProtocol): Array<'tcp' | 'udp'> {
+    if (transport === 'udp') {
+      return ['udp'];
+    }
+    if (transport === 'all') {
+      return ['tcp', 'udp'];
+    }
+    return ['tcp'];
+  }
+
+  private static inboundProxyPolicyFingerprint(policy?: IInboundProxyProtocolPolicy): string {
+    if (!policy) {
+      return 'default';
+    }
+    return JSON.stringify({
+      mode: policy.mode,
+      trustedProxyIPs: [...(policy.trustedProxyIPs ?? [])].sort(),
+    });
+  }
+
   private static isCatchAllDomainMatch(match: IRouteMatch): boolean {
     return !match.domains
       || (Array.isArray(match.domains) && match.domains.includes('*'))

package/ts/proxies/smart-proxy/utils/rust-config.ts

@@ -4,6 +4,7 @@ import type {
   IRustAcmeOptions,
   IRustDefaultConfig,
   IRustProxyOptions,
+  IRustChallengeOptions,
   IRustRouteAction,
   IRustRouteConfig,
   IRustRouteMatch,
@@ -146,18 +147,36 @@ function serializeDefaultsForRust(defaults?: ISmartProxyOptions['defaults']): IR
   };
 }
 
+export function buildChallengeOptionsForRust(settings: ISmartProxyOptions): IRustChallengeOptions | undefined {
+  const hasChallengeRoutes = settings.routes.some((route) => Boolean(route.security?.challenge));
+  if (!hasChallengeRoutes) {
+    return undefined;
+  }
+
+  const runtimeOptions = settings.challenge || {};
+  return {
+    cookieSigningKey: runtimeOptions.cookieSigningKey || '',
+    pendingCookieName: runtimeOptions.pendingCookieName || '__smartproxy_challenge_pending',
+    clearanceCookieName: runtimeOptions.clearanceCookieName || '__smartproxy_clearance',
+    reservedPathPrefix: runtimeOptions.reservedPathPrefix || '/.well-known/smartproxy-challenge',
+    relaySocketPath: runtimeOptions.relaySocketPath || '',
+    relayTimeoutMs: runtimeOptions.relayTimeoutMs ?? 5_000,
+    pendingTtlSeconds: runtimeOptions.pendingTtlSeconds ?? 300,
+  };
+}
+
 export function buildRustProxyOptions(
   settings: ISmartProxyOptions,
   routes: IRustRouteConfig[],
   acmeOverride?: IAcmeOptions,
+  challengeOverride?: IRustChallengeOptions,
 ): IRustProxyOptions {
   const acme = acmeOverride !== undefined ? acmeOverride : settings.acme;
 
   return {
     routes,
     preserveSourceIp: settings.preserveSourceIP,
-    proxyIps: settings.proxyIPs,
-    acceptProxyProtocol: settings.acceptProxyProtocol,
+    trustedProxyIPs: settings.trustedProxyIPs,
     sendProxyProtocol: settings.sendProxyProtocol,
     defaults: serializeDefaultsForRust(settings.defaults),
     connectionTimeout: settings.connectionTimeout,
@@ -183,6 +202,7 @@ export function buildRustProxyOptions(
     extendedKeepAliveLifetime: settings.extendedKeepAliveLifetime,
     metrics: settings.metrics,
     securityPolicy: settings.securityPolicy,
+    challenge: challengeOverride || buildChallengeOptionsForRust(settings),
     acme: serializeAcmeForRust(acme),
   };
 }