@torrent-tv/proxy 2.5.5 → 2.5.8

package/CHANGELOG.md

@@ -0,0 +1,21 @@
+## 2.5.7
+
+- **Fix**: WebRTC connection failure behind symmetric NAT — all ICE candidates (private and public) are now sent to the browser immediately. The browser attempts all paths in parallel; the local LAN path succeeds when browser and proxy are on the same network. Chrome's Private Network Access dialog appears once on first connect.
+
+## 2.5.6
+
+- **Fix**: ICE candidate filtering — private host candidates (RFC 1918, Docker bridge IPs, IPv6 ULA/loopback) are now buffered and suppressed when a public srflx candidate is available. This eliminates the Chrome/Brave Private Network Access permission dialog when connecting from a page served over HTTPS. Falls back to private candidates if no public srflx candidate is gathered (e.g. STUN unreachable), so connectivity is preserved at the cost of the PNA dialog.
+
+## 2.5.5
+
+- **Fix**: Tunnel keepalive — proxy now sends a WebSocket ping to the server every 30 s to prevent Cloudflare's ~100 s idle-connection timeout from dropping the tunnel.
+
+## 2.5.3
+
+- Internal: improved tunnel reconnect logic and error logging.
+
+## 2.0.0
+
+- **New**: WebRTC P2P tunnel architecture — replaced direct HTTP streaming with a persistent WebSocket tunnel to the server. Video is delivered from the proxy to the browser over a WebRTC data channel; the server acts only as a signalling relay.
+- **New**: `node-datachannel` dependency for server-side WebRTC.
+- **Removed**: `public_base_url` config — no longer needed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.5.5",
+  "version": "2.5.8",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/webrtc-manager.js

@@ -15,6 +15,49 @@ import nodeDataChannel from "node-datachannel";
 
 const ICE_SERVERS = ["stun:stun.l.google.com:19302"];
 
+/**
+ * Return true when the ICE candidate string describes a `typ host` candidate
+ * with a private (RFC 1918 / ULA / loopback) IP address.
+ *
+ * Browsers enforce Private Network Access (PNA) and show a permission dialog
+ * when a page served from a public origin (e.g. webauth.courses) attempts a
+ * WebRTC connection to a private-network address.  Filtering these candidates
+ * out before forwarding them to the browser lets the connection proceed via the
+ * server-reflexive (srflx) candidate — the proxy's public IP as seen by STUN —
+ * which does not trigger PNA.
+ *
+ * Edge case: if no srflx candidate is available (STUN unreachable, symmetric
+ * NAT that maps differently per destination, etc.) all host candidates are
+ * suppressed and the connection will fail.  We accept this trade-off; STUN is
+ * a hard dependency of the WebRTC path in any case.
+ *
+ * @param {string} candidate - Raw candidate attribute string from node-datachannel.
+ * @returns {boolean}
+ */
+function isPrivateHostCandidate(candidate) {
+  // Only care about "typ host" — srflx and relay are already public/relay.
+  if (!candidate.includes("typ host")) {
+    return false;
+  }
+  // RFC 1918 IPv4 private ranges.
+  if (/\b(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.)/.test(candidate)) {
+    return true;
+  }
+  // Docker / typical private subnets not covered above (100.64–127 are special).
+  if (/\b127\./.test(candidate)) {
+    return true;
+  }
+  // IPv6 loopback.
+  if (/\s::1\s/.test(candidate)) {
+    return true;
+  }
+  // IPv6 Unique Local Addresses (ULA): fc00::/7 — starts with fc or fd.
+  if (/\s(?:fc|fd)[0-9a-f]{2}:/i.test(candidate)) {
+    return true;
+  }
+  return false;
+}
+
 /**
  * Configuration for the WebRTC manager.
  *
@@ -79,11 +122,23 @@ export function createWebRtcManager({ sendSignal, onDataChannel, onLog }) {
       iceServers: ICE_SERVERS
     });
 
-    // Forward our ICE candidates to the browser through the tunnel.
+    // Forward all ICE candidates to the browser through the tunnel.
+    //
+    // All candidates — both private (RFC 1918) and public (srflx) — are sent
+    // immediately. The browser will attempt all paths in parallel and use
+    // whichever connects first. Private candidates trigger Chrome's Private
+    // Network Access (PNA) permission dialog once; after the user allows it
+    // the connection proceeds via the local LAN path.
     pc.onLocalCandidate((candidate, mid) => {
+      const isPrivate = isPrivateHostCandidate(candidate);
+      log(`[webrtc] Session ${sessionId.slice(0, 8)}: sending ${isPrivate ? "private" : "public"} candidate`);
       sendSignal(sessionId, { type: "candidate", candidate, mid });
     });
 
+    pc.onGatheringStateChange((state) => {
+      log(`[webrtc] Session ${sessionId.slice(0, 8)}: gathering → ${state}`);
+    });
+
     // Forward our SDP answer to the browser through the tunnel.
     pc.onLocalDescription((sdp, type) => {
       log(`[webrtc] Session ${sessionId.slice(0, 8)}: sending ${type}`);