@warren-bank/hls-proxy 3.6.7 → 3.6.8

package/README.md

@@ -160,6 +160,7 @@ options:
 --acl-ip <ip_address_list>
 --acl-pass <password_list>
 --block-req-hostname <hostname_list>
+--allow-private-req-hostnames
 --http-proxy <http[s]://[user:pass@]hostname:port>
 --tls-cert <filepath>
 --tls-key <filepath>
@@ -400,7 +401,30 @@ options:
 * _--acl-pass_ restricts proxy server access to requests that include a `password` querystring parameter having a value in whitelist
   * ex: `"1111,2222,3333,4444,5555"`
 * _--block-req-hostname_ blocks proxy server requests to hostnames in blacklist
-  * ex: `"localhost,127.0.0.1"`
+  * the value is a comma-separated list that is normalized to lowercase
+  * the value of each item in the list can use any of the following formats:
+    - includes substring
+      * value begins and ends with `*` character
+      * ex: `"*foo*"`<br>blacklists all hostnames that include the substring: `foo`
+    - starts with substring
+      * value ends with `*` character
+      * ex: `"www.*"`<br>blacklists all hostnames that start with the substring: `www.`
+    - ends with substring
+      * value starts with `*` character
+      * ex: `"*.foo.com"`<br>blacklists all hostnames that end with the substring: `.foo.com`
+    - matches regex pattern
+      * value begins and ends with `/` character
+      * ex: `"/^www\..+\.com$/"`<br>blacklists all hostnames that both start with the substring: `www.`, and end with the substring: `.com`
+    - equals exact string
+      * all other values
+      * ex: `"localhost,127.0.0.1"`
+* _--allow-private-req-hostnames_ is a flag to prevent the automatic addition of the following values to the _--block-req-hostname_ blacklist:
+  ```text
+    localhost,
+    ::1,
+    /^(0\.|10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/,
+    /^(fe80:|fc|fd|::ffff:(0\.|10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.))/
+  ```
 * --http-proxy enables all outbound HTTP and HTTPS requests from HLS-Proxy to be tunnelled through an additional external web proxy server
   * SOCKS proxies are not supported
   * ex: `http://myusername:mypassword@myproxy.example.com:1234`

package/hls-proxy/bin/lib/help.js

@@ -31,6 +31,7 @@ options:
 --acl-ip <ip_address_list>
 --acl-pass <password_list>
 --block-req-hostname <hostname_list>
+--allow-private-req-hostnames
 --http-proxy <http[s]://[user:pass@]hostname:port>
 --tls-cert <filepath>
 --tls-key <filepath>

package/hls-proxy/bin/lib/process_argv.js

@@ -39,6 +39,7 @@ const argv_flags = {
   "--acl-ip":                               {},
   "--acl-pass":                             {},
   "--block-req-hostname":                   {},
+  "--allow-private-req-hostnames":          {bool: true},
   "--http-proxy":                           {},
 
   "--tls-cert":                             {file: "path-exists"},
@@ -179,7 +180,99 @@ if (argv_vals["--acl-pass"]) {
 }
 
 if (argv_vals["--block-req-hostname"]) {
-  argv_vals["--block-req-hostname"] = argv_vals["--block-req-hostname"].trim().toLowerCase().split(/\s*,\s*/g)
+  const blacklist = argv_vals["--block-req-hostname"].trim().toLowerCase().split(/\s*,\s*/g)
+
+  argv_vals["--block-req-hostname"] = {
+    includes:   [],
+    startsWith: [],
+    endsWith:   [],
+    match:      [],
+    equals:     []
+  }
+
+  for (const item of blacklist) {
+    if (!item) continue
+
+    const globStart  = item.startsWith('*')
+    const globEnd    = item.endsWith('*')
+    const regexStart = item.startsWith('/')
+    const regexEnd   = item.endsWith('/')
+
+    if (globStart && globEnd) {
+      if (item.length > 2) {
+        argv_vals["--block-req-hostname"].includes.push(
+          item.substring(1, item.length - 1)
+        )
+      }
+      continue
+    }
+    if (globEnd) {
+      if (item.length > 1) {
+        argv_vals["--block-req-hostname"].startsWith.push(
+          item.substring(0, item.length - 1)
+        )
+      }
+      continue
+    }
+    if (globStart) {
+      if (item.length > 1) {
+        argv_vals["--block-req-hostname"].endsWith.push(
+          item.substring(1, item.length)
+        )
+      }
+      continue
+    }
+    if (regexStart && regexEnd) {
+      if (item.length > 2) {
+        try {
+          const regex = new RegExp(item.substring(1, item.length - 1))
+
+          argv_vals["--block-req-hostname"].match.push(
+            regex
+          )
+        }
+        catch(ignored) {}
+      }
+      continue
+    }
+    else {
+      argv_vals["--block-req-hostname"].equals.push(
+        item
+      )
+    }
+  }
+}
+
+if (!argv_vals["--allow-private-req-hostnames"]) {
+  if (!argv_vals["--block-req-hostname"]) {
+    argv_vals["--block-req-hostname"] = {
+      includes:   [],
+      startsWith: [],
+      endsWith:   [],
+      match:      [],
+      equals:     []
+    }
+  }
+  argv_vals["--block-req-hostname"].match.push(
+    /^(0\.|10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/,
+    /^(fe80:|fc|fd|::ffff:(0\.|10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.))/
+  )
+  argv_vals["--block-req-hostname"].equals.push(
+    'localhost',
+    '::1'
+  )
+}
+
+if (argv_vals["--block-req-hostname"]) {
+  if (
+    !argv_vals["--block-req-hostname"].includes.length   &&
+    !argv_vals["--block-req-hostname"].startsWith.length &&
+    !argv_vals["--block-req-hostname"].endsWith.length   &&
+    !argv_vals["--block-req-hostname"].match.length      &&
+    !argv_vals["--block-req-hostname"].equals.length
+  ) {
+    argv_vals["--block-req-hostname"] = null
+  }
 }
 
 if (argv_vals["--http-proxy"]) {

package/hls-proxy/utils.js

@@ -201,7 +201,7 @@ const block_request_options = function(params, request_options) {
   const {block_req_hostname} = params
 
   // short circuit
-  if (!block_req_hostname || !Array.isArray(block_req_hostname) || !block_req_hostname.length || !request_options)
+  if (!block_req_hostname || !request_options)
     return false
 
   // special case: url
@@ -212,7 +212,20 @@ const block_request_options = function(params, request_options) {
   if (!request_options.hostname || (typeof request_options.hostname !== 'string'))
     return false
 
-  return (block_req_hostname.indexOf(request_options.hostname.toLowerCase()) >= 0)
+  const hostname = request_options.hostname.toLowerCase()
+  for (const blacklist_item of block_req_hostname.includes) {
+    if (hostname.includes(blacklist_item)) return true
+  }
+  for (const blacklist_item of block_req_hostname.startsWith) {
+    if (hostname.startsWith(blacklist_item)) return true
+  }
+  for (const blacklist_item of block_req_hostname.endsWith) {
+    if (hostname.endsWith(blacklist_item)) return true
+  }
+  for (const blacklist_item of block_req_hostname.match) {
+    if (blacklist_item.test(hostname)) return true
+  }
+  return (block_req_hostname.equals.indexOf(hostname) >= 0)
 }
 
 const should_prefetch_url = function(params, url, url_type) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@warren-bank/hls-proxy",
   "description": "Node.js server to proxy HLS video streams",
-  "version":     "3.6.7",
+  "version":     "3.6.8",
   "scripts": {
     "start":     "node hls-proxy/bin/hlsd.js",
     "sudo": "sudo node hls-proxy/bin/hlsd.js"