@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.61-sysid.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +43 -2
- package/dist/index.d.ts +3 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/sandbox/credential-mask-files.d.ts +72 -0
- package/dist/sandbox/credential-mask-files.d.ts.map +1 -0
- package/dist/sandbox/credential-mask-files.js +146 -0
- package/dist/sandbox/credential-mask-files.js.map +1 -0
- package/dist/sandbox/credential-sentinel.d.ts +72 -0
- package/dist/sandbox/credential-sentinel.d.ts.map +1 -0
- package/dist/sandbox/credential-sentinel.js +130 -0
- package/dist/sandbox/credential-sentinel.js.map +1 -0
- package/dist/sandbox/domain-pattern.d.ts +36 -0
- package/dist/sandbox/domain-pattern.d.ts.map +1 -0
- package/dist/sandbox/domain-pattern.js +60 -0
- package/dist/sandbox/domain-pattern.js.map +1 -0
- package/dist/sandbox/http-proxy.d.ts +32 -1
- package/dist/sandbox/http-proxy.d.ts.map +1 -1
- package/dist/sandbox/http-proxy.js +10 -2
- package/dist/sandbox/http-proxy.js.map +1 -1
- package/dist/sandbox/linux-sandbox-utils.d.ts +15 -0
- package/dist/sandbox/linux-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/linux-sandbox-utils.js +106 -47
- package/dist/sandbox/linux-sandbox-utils.js.map +1 -1
- package/dist/sandbox/listen-in-range.d.ts +12 -0
- package/dist/sandbox/listen-in-range.d.ts.map +1 -0
- package/dist/sandbox/listen-in-range.js +43 -0
- package/dist/sandbox/listen-in-range.js.map +1 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts +11 -0
- package/dist/sandbox/macos-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/macos-sandbox-utils.js +69 -14
- package/dist/sandbox/macos-sandbox-utils.js.map +1 -1
- package/dist/sandbox/mitm-ca.d.ts +18 -2
- package/dist/sandbox/mitm-ca.d.ts.map +1 -1
- package/dist/sandbox/mitm-ca.js +49 -9
- package/dist/sandbox/mitm-ca.js.map +1 -1
- package/dist/sandbox/mitm-leaf.d.ts.map +1 -1
- package/dist/sandbox/mitm-leaf.js +24 -6
- package/dist/sandbox/mitm-leaf.js.map +1 -1
- package/dist/sandbox/mux-proxy.d.ts +59 -0
- package/dist/sandbox/mux-proxy.d.ts.map +1 -0
- package/dist/sandbox/mux-proxy.js +159 -0
- package/dist/sandbox/mux-proxy.js.map +1 -0
- package/dist/sandbox/request-filter.d.ts +11 -1
- package/dist/sandbox/request-filter.d.ts.map +1 -1
- package/dist/sandbox/request-filter.js.map +1 -1
- package/dist/sandbox/sandbox-config.d.ts +254 -25
- package/dist/sandbox/sandbox-config.d.ts.map +1 -1
- package/dist/sandbox/sandbox-config.js +200 -13
- package/dist/sandbox/sandbox-config.js.map +1 -1
- package/dist/sandbox/sandbox-manager.d.ts +4 -0
- package/dist/sandbox/sandbox-manager.d.ts.map +1 -1
- package/dist/sandbox/sandbox-manager.js +601 -194
- package/dist/sandbox/sandbox-manager.js.map +1 -1
- package/dist/sandbox/sandbox-schemas.d.ts +15 -0
- package/dist/sandbox/sandbox-schemas.d.ts.map +1 -1
- package/dist/sandbox/sandbox-utils.d.ts +42 -6
- package/dist/sandbox/sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/sandbox-utils.js +115 -27
- package/dist/sandbox/sandbox-utils.js.map +1 -1
- package/dist/sandbox/socks-proxy.d.ts +11 -5
- package/dist/sandbox/socks-proxy.d.ts.map +1 -1
- package/dist/sandbox/socks-proxy.js +13 -81
- package/dist/sandbox/socks-proxy.js.map +1 -1
- package/dist/sandbox/tls-terminate-proxy.d.ts +2 -2
- package/dist/sandbox/tls-terminate-proxy.d.ts.map +1 -1
- package/dist/sandbox/tls-terminate-proxy.js +31 -5
- package/dist/sandbox/tls-terminate-proxy.js.map +1 -1
- package/dist/sandbox/windows-sandbox-utils.d.ts +347 -11
- package/dist/sandbox/windows-sandbox-utils.d.ts.map +1 -1
- package/dist/sandbox/windows-sandbox-utils.js +437 -45
- package/dist/sandbox/windows-sandbox-utils.js.map +1 -1
- package/package.json +7 -4
- package/vendor/seccomp/build.ts +8 -30
- package/vendor/srt-win/build.ts +21 -0
- package/dist/vendor/seccomp/Dockerfile.build +0 -6
- package/dist/vendor/seccomp/arm64/apply-seccomp +0 -0
- package/dist/vendor/seccomp/build.ts +0 -91
- package/dist/vendor/seccomp/x64/apply-seccomp +0 -0
- package/dist/vendor/seccomp-src/apply-seccomp.c +0 -280
- package/dist/vendor/seccomp-src/seccomp-unix-block.c +0 -148
- package/dist/vendor/srt-win/Cargo.lock +0 -361
- package/dist/vendor/srt-win/Cargo.toml +0 -46
- package/dist/vendor/srt-win/ci/cleanup.ps1 +0 -49
- package/dist/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
- package/dist/vendor/srt-win/ci/smoke.ps1 +0 -307
- package/dist/vendor/srt-win/src/job.rs +0 -102
- package/dist/vendor/srt-win/src/launch.rs +0 -732
- package/dist/vendor/srt-win/src/lib.rs +0 -20
- package/dist/vendor/srt-win/src/main.rs +0 -669
- package/dist/vendor/srt-win/src/self_protect.rs +0 -169
- package/dist/vendor/srt-win/src/sid.rs +0 -296
- package/dist/vendor/srt-win/src/token.rs +0 -341
- package/dist/vendor/srt-win/src/util.rs +0 -42
- package/dist/vendor/srt-win/src/wfp.rs +0 -992
- package/dist/vendor/srt-win/src/winsta.rs +0 -209
- package/dist/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
- package/vendor/seccomp-src/apply-seccomp.c +0 -280
- package/vendor/seccomp-src/seccomp-unix-block.c +0 -148
- package/vendor/srt-win/Cargo.lock +0 -361
- package/vendor/srt-win/Cargo.toml +0 -46
- package/vendor/srt-win/ci/cleanup.ps1 +0 -49
- package/vendor/srt-win/ci/smoke-exec.ps1 +0 -446
- package/vendor/srt-win/ci/smoke.ps1 +0 -307
- package/vendor/srt-win/src/job.rs +0 -102
- package/vendor/srt-win/src/launch.rs +0 -732
- package/vendor/srt-win/src/lib.rs +0 -20
- package/vendor/srt-win/src/main.rs +0 -669
- package/vendor/srt-win/src/self_protect.rs +0 -169
- package/vendor/srt-win/src/sid.rs +0 -296
- package/vendor/srt-win/src/token.rs +0 -341
- package/vendor/srt-win/src/util.rs +0 -42
- package/vendor/srt-win/src/wfp.rs +0 -992
- package/vendor/srt-win/src/winsta.rs +0 -209
- package/vendor/srt-win/tests/sd_access_check_matrix.rs +0 -259
|
@@ -91,91 +91,23 @@ export function createSocksProxyServer(options) {
|
|
|
91
91
|
}
|
|
92
92
|
});
|
|
93
93
|
});
|
|
94
|
-
// Track every
|
|
95
|
-
// immediately.
|
|
96
|
-
//
|
|
97
|
-
//
|
|
98
|
-
//
|
|
99
|
-
// 5s test/hook timeout, so we destroy connections rather than drain them.
|
|
100
|
-
const internalServer = socksServer
|
|
101
|
-
?.server;
|
|
94
|
+
// Track every injected client socket so close() can tear them down
|
|
95
|
+
// immediately. A SOCKS connection mid-`dialDirect()` (30s timeout) or
|
|
96
|
+
// mid-relay would otherwise hold reset() open past bun's test timeout.
|
|
97
|
+
// The library's internal net.Server is never .listen()ed — the mux owns
|
|
98
|
+
// accept — so there's no listener to close; we only destroy sockets.
|
|
102
99
|
const openSockets = new Set();
|
|
103
|
-
internalServer?.on('connection', (socket) => {
|
|
104
|
-
openSockets.add(socket);
|
|
105
|
-
socket.once('close', () => openSockets.delete(socket));
|
|
106
|
-
});
|
|
107
100
|
return {
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
if (internalServer && typeof internalServer?.address === 'function') {
|
|
114
|
-
const address = internalServer.address();
|
|
115
|
-
if (address && typeof address === 'object' && 'port' in address) {
|
|
116
|
-
return address.port;
|
|
117
|
-
}
|
|
118
|
-
}
|
|
119
|
-
}
|
|
120
|
-
catch (error) {
|
|
121
|
-
// Server might not be listening yet or property access failed
|
|
122
|
-
logForDebugging(`Error getting port: ${error}`, { level: 'error' });
|
|
123
|
-
}
|
|
124
|
-
return undefined;
|
|
125
|
-
},
|
|
126
|
-
listen(port, hostname) {
|
|
127
|
-
return new Promise((resolve, reject) => {
|
|
128
|
-
internalServer?.once('error', reject);
|
|
129
|
-
const listeningCallback = () => {
|
|
130
|
-
internalServer?.removeListener('error', reject);
|
|
131
|
-
const actualPort = this.getPort();
|
|
132
|
-
if (actualPort) {
|
|
133
|
-
logForDebugging(`SOCKS proxy listening on ${hostname}:${actualPort}`);
|
|
134
|
-
resolve(actualPort);
|
|
135
|
-
}
|
|
136
|
-
else {
|
|
137
|
-
reject(new Error('Failed to get SOCKS proxy server port'));
|
|
138
|
-
}
|
|
139
|
-
};
|
|
140
|
-
socksServer.listen(port, hostname, listeningCallback);
|
|
141
|
-
});
|
|
101
|
+
handleConnection(socket) {
|
|
102
|
+
socket.setNoDelay();
|
|
103
|
+
openSockets.add(socket);
|
|
104
|
+
socket.once('close', () => openSockets.delete(socket));
|
|
105
|
+
socksServer._handleConnection(socket);
|
|
142
106
|
},
|
|
143
107
|
async close() {
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
// Only reject for actual errors, not for "already closed" states
|
|
148
|
-
// Check for common "already closed" error patterns
|
|
149
|
-
const errorMessage = error.message?.toLowerCase() || '';
|
|
150
|
-
const isAlreadyClosed = errorMessage.includes('not running') ||
|
|
151
|
-
errorMessage.includes('already closed') ||
|
|
152
|
-
errorMessage.includes('not listening');
|
|
153
|
-
if (!isAlreadyClosed) {
|
|
154
|
-
reject(error);
|
|
155
|
-
return;
|
|
156
|
-
}
|
|
157
|
-
}
|
|
158
|
-
resolve();
|
|
159
|
-
});
|
|
160
|
-
// Forcibly drop any sockets still open. close() above stopped the
|
|
161
|
-
// listener; the callback won't fire until these drain on their own,
|
|
162
|
-
// and a stuck upstream dial means they may never drain.
|
|
163
|
-
for (const socket of openSockets) {
|
|
164
|
-
socket.destroy();
|
|
165
|
-
}
|
|
166
|
-
openSockets.clear();
|
|
167
|
-
});
|
|
168
|
-
},
|
|
169
|
-
unref() {
|
|
170
|
-
// Access the internal server to call unref
|
|
171
|
-
try {
|
|
172
|
-
if (internalServer && typeof internalServer?.unref === 'function') {
|
|
173
|
-
internalServer.unref();
|
|
174
|
-
}
|
|
175
|
-
}
|
|
176
|
-
catch (error) {
|
|
177
|
-
logForDebugging(`Error calling unref: ${error}`, { level: 'error' });
|
|
178
|
-
}
|
|
108
|
+
for (const socket of openSockets)
|
|
109
|
+
socket.destroy();
|
|
110
|
+
openSockets.clear();
|
|
179
111
|
},
|
|
180
112
|
};
|
|
181
113
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"socks-proxy.js","sourceRoot":"","sources":["../../src/sandbox/socks-proxy.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"socks-proxy.js","sourceRoot":"","sources":["../../src/sandbox/socks-proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,qBAAqB,EACrB,UAAU,EACV,WAAW,EACX,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAA;AAkC1B,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,WAAW,GAAG,YAAY,EAAE,CAAA;IAElC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,WAAW,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAChD,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;gBACxE,MAAM,EAAE,CAAA;YACV,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;gBAC1D,IAAI,EAAE,CAAA;YACR,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,WAAW,CAAC,mBAAmB,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAA;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;YAE1B,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,0DAA0D;YAC1D,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,eAAe,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAC7D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;gBACD,OAAO,KAAK,CAAA;YACd,CAAC;YAED,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YAE5D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,EAAE;oBAC3D,KAAK,EAAE,OAAO;iBACf,CAAC,CAAA;gBACF,OAAO,KAAK,CAAA;YACd,CAAC;YAED,eAAe,CAAC,yBAAyB,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YAC5D,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAe,CAAC,gCAAgC,KAAK,EAAE,EAAE;gBACvD,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,yEAAyE;IACzE,2DAA2D;IAC3D,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAA;QAE1B,wEAAwE;QACxE,IAAI,UAAU,GAAG,KAAK,CAAA;QACtB,IAAI,WAA+B,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAC7B,UAAU,GAAG,IAAI,CAAA;YACjB,WAAW,EAAE,OAAO,EAAE,CAAA;QACxB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;QAErD,iEAAiE;QACjE,0EAA0E;QAC1E,MAAM,SAAS,GACb,OAAO,CAAC,WAAW,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC;YACxE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAA;QAEf,MAAM,IAAI,GAAG,SAAS;YACpB,CAAC,CAAC,qBAAqB,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;YAC9C,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAE1B,IAAI;aACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YACf,WAAW,GAAG,QAAQ,CAAA;YACtB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;YACjD,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,CAAC,OAAO,EAAE,CAAA;gBAClB,OAAM;YACR,CAAC;YACD,UAAU,CAAC,iBAAiB,CAAC,CAAA;YAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC1B,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QACnD,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE;YACX,eAAe,CACb,oBAAoB,IAAI,IAAI,IAAI,YAAa,GAAa,CAAC,OAAO,EAAE,EACpE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,UAAU,CAAC,kBAAkB,CAAC,CAAA;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,yDAAyD;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,CAAA;IAEF,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,OAAO;QACL,gBAAgB,CAAC,MAAc;YAC7B,MAAM,CAAC,UAAU,EAAE,CAAA;YACnB,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YACtD,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;QACvC,CAAC;QACD,KAAK,CAAC,KAAK;YACT,KAAK,MAAM,MAAM,IAAI,WAAW;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;YAClD,WAAW,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;KACF,CAAA;AACH,CAAC"}
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
*/
|
|
11
11
|
import type { Duplex } from 'node:stream';
|
|
12
12
|
import type { MitmCA } from './mitm-ca.js';
|
|
13
|
-
import { type FilterRequestCallback } from './request-filter.js';
|
|
13
|
+
import { type FilterRequestCallback, type MutateForwardedHeaders } from './request-filter.js';
|
|
14
14
|
/**
|
|
15
15
|
* True if `buf` starts with a TLS Handshake record header.
|
|
16
16
|
*
|
|
@@ -66,5 +66,5 @@ export type TerminateTarget = {
|
|
|
66
66
|
* request handler close over `target` (which carries the originally-
|
|
67
67
|
* requested host:port) without socket-keyed lookups.
|
|
68
68
|
*/
|
|
69
|
-
export declare function terminateAndForward(ca: MitmCA, filterRequest: FilterRequestCallback | undefined, socket: Duplex, head: Buffer, target: TerminateTarget): void;
|
|
69
|
+
export declare function terminateAndForward(ca: MitmCA, filterRequest: FilterRequestCallback | undefined, mutateHeaders: MutateForwardedHeaders | undefined, socket: Duplex, head: Buffer, target: TerminateTarget): void;
|
|
70
70
|
//# sourceMappingURL=tls-terminate-proxy.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tls-terminate-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,
|
|
1
|
+
{"version":3,"file":"tls-terminate-proxy.d.ts","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAY,MAAM,aAAa,CAAA;AAEnD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC5B,MAAM,qBAAqB,CAAA;AAI5B;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB3C;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,qBAAqB,GAAG,SAAS,EAChD,aAAa,EAAE,sBAAsB,GAAG,SAAS,EACjD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,GACtB,IAAI,CAyEN"}
|
|
@@ -84,7 +84,7 @@ export function peekForClientHello(socket, head) {
|
|
|
84
84
|
* request handler close over `target` (which carries the originally-
|
|
85
85
|
* requested host:port) without socket-keyed lookups.
|
|
86
86
|
*/
|
|
87
|
-
export function terminateAndForward(ca, filterRequest, socket, head, target) {
|
|
87
|
+
export function terminateAndForward(ca, filterRequest, mutateHeaders, socket, head, target) {
|
|
88
88
|
// ALPN advertises HTTP/1.1 only — terminating HTTP/2 would require a frame
|
|
89
89
|
// parser; clients negotiate down. The base secureContext covers clients
|
|
90
90
|
// that don't send SNI; SNICallback covers everyone else.
|
|
@@ -103,7 +103,7 @@ export function terminateAndForward(ca, filterRequest, socket, head, target) {
|
|
|
103
103
|
},
|
|
104
104
|
});
|
|
105
105
|
inner.on('request', (req, res) => {
|
|
106
|
-
void forwardUpstream(filterRequest, req, res, target);
|
|
106
|
+
void forwardUpstream(filterRequest, mutateHeaders, req, res, target);
|
|
107
107
|
});
|
|
108
108
|
inner.on('tlsClientError', (err, sock) => {
|
|
109
109
|
logForDebugging(`[tls-terminate] client TLS error for ${target.hostname}: ${err.message}`, { level: 'error' });
|
|
@@ -152,7 +152,15 @@ export function terminateAndForward(ca, filterRequest, socket, head, target) {
|
|
|
152
152
|
});
|
|
153
153
|
inner.unref();
|
|
154
154
|
}
|
|
155
|
-
async function forwardUpstream(filterRequest, req, res, target) {
|
|
155
|
+
async function forwardUpstream(filterRequest, mutateHeaders, req, res, target) {
|
|
156
|
+
// req.url is the request-target verbatim. Inside a CONNECT tunnel almost
|
|
157
|
+
// every client sends origin-form (`/path?q`), but RFC 7230 §5.3.2 also
|
|
158
|
+
// permits absolute-form (`https://host/path`) and servers MUST accept it.
|
|
159
|
+
// Normalize to origin-form so concatenating onto `https://${host}` below
|
|
160
|
+
// yields a well-formed URL, and discard any client-supplied authority so
|
|
161
|
+
// the CONNECT-verified target stays authoritative (same rationale as the
|
|
162
|
+
// Host-header note below).
|
|
163
|
+
const path = originFormPath(req.url);
|
|
156
164
|
let body = req;
|
|
157
165
|
if (filterRequest) {
|
|
158
166
|
const ac = new AbortController();
|
|
@@ -175,7 +183,7 @@ async function forwardUpstream(filterRequest, req, res, target) {
|
|
|
175
183
|
const host = target.port === 443
|
|
176
184
|
? target.hostname
|
|
177
185
|
: `${target.hostname}:${target.port}`;
|
|
178
|
-
const out = await decideAndRespond(filterRequest, req, res, `https://${host}${
|
|
186
|
+
const out = await decideAndRespond(filterRequest, req, res, `https://${host}${path}`, ac.signal);
|
|
179
187
|
if (out === null)
|
|
180
188
|
return;
|
|
181
189
|
body = out;
|
|
@@ -186,11 +194,16 @@ async function forwardUpstream(filterRequest, req, res, target) {
|
|
|
186
194
|
// correct verification under both Node and Bun.
|
|
187
195
|
const fwdHeaders = stripHopByHop(req.headers);
|
|
188
196
|
delete fwdHeaders.host;
|
|
197
|
+
// Header mutation runs after the allow decision and before httpsRequest.
|
|
198
|
+
// The upstream TLS handshake (rejectUnauthorized defaults to true)
|
|
199
|
+
// completes before any HTTP bytes are written, so mutated headers never
|
|
200
|
+
// reach an unverified server.
|
|
201
|
+
mutateHeaders?.(fwdHeaders, target.hostname);
|
|
189
202
|
// TODO(terminating-tls): honour parentProxy for the upstream leg.
|
|
190
203
|
const upstream = httpsRequest({
|
|
191
204
|
host: target.hostname,
|
|
192
205
|
port: target.port,
|
|
193
|
-
path
|
|
206
|
+
path,
|
|
194
207
|
method: req.method,
|
|
195
208
|
headers: fwdHeaders,
|
|
196
209
|
// We're a TLS-terminating proxy, not a trust boundary for the upstream
|
|
@@ -223,6 +236,19 @@ async function forwardUpstream(filterRequest, req, res, target) {
|
|
|
223
236
|
res.on('close', () => upstream.destroy());
|
|
224
237
|
body.pipe(upstream);
|
|
225
238
|
}
|
|
239
|
+
function originFormPath(reqUrl) {
|
|
240
|
+
const raw = reqUrl ?? '/';
|
|
241
|
+
if (raw.startsWith('/'))
|
|
242
|
+
return raw;
|
|
243
|
+
try {
|
|
244
|
+
const u = new URL(raw);
|
|
245
|
+
return `${u.pathname}${u.search}` || '/';
|
|
246
|
+
}
|
|
247
|
+
catch {
|
|
248
|
+
// asterisk-form (`OPTIONS *`) or anything else non-absolute — pass through.
|
|
249
|
+
return raw;
|
|
250
|
+
}
|
|
251
|
+
}
|
|
226
252
|
let sockSeq = 0;
|
|
227
253
|
function innerSocketPath() {
|
|
228
254
|
// Keep it short — macOS sun_path is 104 bytes.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,
|
|
1
|
+
{"version":3,"file":"tls-terminate-proxy.js","sourceRoot":"","sources":["../../src/sandbox/tls-terminate-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACxB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EACL,gBAAgB,GAGjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,CACL,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAE,IAAI,IAAI,CACzE,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,IAAY;IAEZ,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,GAAG,GAAG,IAAI,CAAA;QACd,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACpC,OAAO,CAAC,EAAE,KAAK,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;YAC/B,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAA;YAClC,MAAM,CAAC,MAAM,EAAE,CAAA;QACjB,CAAC,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;AACJ,CAAC;AAaD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CACjC,EAAU,EACV,aAAgD,EAChD,aAAiD,EACjD,MAAc,EACd,IAAY,EACZ,MAAuB;IAEvB,2EAA2E;IAC3E,wEAAwE;IACxE,yDAAyD;IACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,aAAa,EAAE,CAAC,UAAU,CAAC;QAC3B,IAAI,EAAE,QAAQ,CAAC,OAAO;QACtB,GAAG,EAAE,QAAQ,CAAC,MAAM;QACpB,WAAW,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE;YAC9B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC/D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,EAAE,CAAC,GAAY,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;KACF,CAAC,CAAA;IAEF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,eAAe,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;QACvC,eAAe,CACb,wCAAwC,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,EACzE,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACjC,wDAAwD;QACxD,eAAe,CAAC,yCAAyC,EAAE;YACzD,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;QACF,IAAI,CAAC,OAAO,EAAE,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAA;IACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACtB,eAAe,CACb,+CAA+C,GAAG,CAAC,OAAO,EAAE,EAC5D,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,MAAM,CAAC,OAAO,EAAE,CAAA;QAChB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;YACrB,eAAe,CAAC,0CAA0C,GAAG,CAAC,OAAO,EAAE,EAAE;gBACvE,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,wEAAwE;YACxE,yDAAyD;YACzD,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACjB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAA;YACd,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IACF,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAgD,EAChD,aAAiD,EACjD,GAAoB,EACpB,GAAmB,EACnB,MAAuB;IAEvB,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,2BAA2B;IAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,IAAI,GAAa,GAAG,CAAA;IACxB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAA;QACnC,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,gEAAgE;QAChE,2CAA2C;QAC3C,EAAE;QACF,4DAA4D;QAC5D,sDAAsD;QACtD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,KAAK,GAAG;YACjB,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAA;QACzC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAChC,aAAa,EACb,GAAG,EACH,GAAG,EACH,WAAW,IAAI,GAAG,IAAI,EAAE,EACxB,EAAE,CAAC,MAAM,CACV,CAAA;QACD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAM;QACxB,IAAI,GAAG,GAAG,CAAA;IACZ,CAAC;IAED,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,UAAU,CAAC,IAAI,CAAA;IACtB,yEAAyE;IACzE,mEAAmE;IACnE,wEAAwE;IACxE,8BAA8B;IAC9B,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE5C,kEAAkE;IAClE,MAAM,QAAQ,GAAG,YAAY,CAC3B;QACE,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI;QACJ,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,UAAU;QACnB,uEAAuE;QACvE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,6CAA6C;QAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,gEAAgE;QAChE,KAAK,EAAE,KAAK;KACb,EACD,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;QACpE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjB,CAAC,CACF,CAAA;IAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QACzB,eAAe,CACb,4BAA4B,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,OAAO,EAAE,EACnF,EAAE,KAAK,EAAE,OAAO,EAAE,CACnB,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,OAAO,EAAE,CAAA;QACf,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B;IAChD,MAAM,GAAG,GAAG,MAAM,IAAI,GAAG,CAAA;IACzB,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACtB,OAAO,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,GAAG,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,IAAI,OAAO,GAAG,CAAC,CAAA;AACf,SAAS,eAAe;IACtB,+CAA+C;IAC/C,OAAO,IAAI,CACT,MAAM,EAAE,EACR,UAAU,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,CACzD,CAAA;AACH,CAAC"}
|