dshost-plugin 0.1.15 → 0.1.16

package/lib/core.js

@@ -19,8 +19,93 @@ const WS_SEND_HIGH_WATER = parseInt(process.env.WS_SEND_HIGH_WATER || String(8 *
 const RECONNECT_BASE_MS = 1000;
 const RECONNECT_MAX_MS = 60000;
 
+const IGNORE_IFACE_RE = /^(lo|docker\d*|br-[0-9a-f]+|veth[0-9a-f]+|virbr\d*|cni\d*|flannel\d*)$/i;
+const TRANSPARENT_GIF = Buffer.from('R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7', 'base64');
+
+/**
+ * Enumerate and classify all candidate IPv4 addresses for intranet direct probing.
+ * Excludes loopback, internal interfaces, Docker bridges, container veths,
+ * sing-box/clash virtual tun interfaces (e.g. 172.18.0.1), and public WAN IPs.
+ * Categorizes EasyTier (10.144.x.x), Tailscale (100.64-127.x.x), and LAN (192.168.x.x, 10.x.x.x).
+ * @returns {Array<{ip: string, name: string, type: 'lan'|'vpn', desc: string, prio: number}>}
+ */
+export function collectCandidateIpv4s() {
+  const list = [];
+  const seenIps = new Set();
+  try {
+    const ifaces = os.networkInterfaces();
+    for (const [name, addrs] of Object.entries(ifaces)) {
+      if (IGNORE_IFACE_RE.test(name)) continue;
+      for (const a of addrs || []) {
+        if (a.family !== 'IPv4' || a.internal) continue;
+        const ip = a.address;
+        if (!ip || ip.startsWith('127.') || ip.startsWith('169.254.') || ip === '0.0.0.0') continue;
+        if (seenIps.has(ip)) continue;
+
+        // 1. Identify virtual tun/tap interfaces
+        const isTunTap = /^(tun|tap|utun)/i.test(name);
+        const isEasyTier = ip.startsWith('10.144.') || /easytier/i.test(name);
+        const isTailscale = /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(ip) || /tailscale/i.test(name);
+
+        // If it's a tun/tap interface but NOT a recognized mesh VPN, it is a local proxy
+        // (e.g. sing-box/clash fake-ip or 172.18.0.1 tun) -> STRICTLY EXCLUDE.
+        if (isTunTap && !isEasyTier && !isTailscale) {
+          continue;
+        }
+
+        // 2. Filter out 172.16.0.0/12 (Docker networks, sing-box tun endpoints)
+        if (/^172\.(1[6-9]|2\d|3[01])\./.test(ip)) {
+          continue;
+        }
+
+        let type = null;
+        let desc = name;
+        let prio = 99;
+
+        if (isEasyTier) {
+          type = 'vpn';
+          desc = 'EasyTier 专网';
+          prio = 1; // Prioritize mesh VPN across heterogeneous networks
+        } else if (isTailscale) {
+          type = 'vpn';
+          desc = 'Tailscale 专网';
+          prio = 1;
+        } else if (ip.startsWith('192.168.')) {
+          type = 'lan';
+          desc = '物理局域网 (192.168.x)';
+          prio = 2;
+        } else if (ip.startsWith('10.')) {
+          type = 'lan';
+          desc = '私有内网 (10.x)';
+          prio = 3;
+        } else {
+          // Public WAN IPs MUST NEVER be reported as intranet direct probe candidates!
+          continue;
+        }
+
+        seenIps.add(ip);
+        list.push({ ip, name, type, desc, prio });
+      }
+    }
+  } catch {}
+
+  // Explicit override or additional candidate IPs via env var
+  const envCandidates = (process.env.DSH_CANDIDATE_IPS || '').split(',').map((s) => s.trim()).filter(Boolean);
+  for (const raw of envCandidates) {
+    if (!seenIps.has(raw) && /^(\d{1,3}\.){3}\d{1,3}$/.test(raw)) {
+      seenIps.add(raw);
+      list.unshift({ ip: raw, name: 'env', type: 'lan', desc: '指定内网地址', prio: 0 });
+    }
+  }
+
+  list.sort((a, b) => a.prio - b.prio);
+  return list;
+}
+
 /** First non-internal IPv4 of this host (for the dashboard), or null. */
 function localIPv4() {
+  const c = collectCandidateIpv4s();
+  if (c.length > 0) return c[0].ip;
   try {
     for (const addrs of Object.values(os.networkInterfaces())) {
       for (const a of addrs || []) {
@@ -242,20 +327,28 @@ function detectDshMetadata() {
 }
 
 /** Collect local system info for the relay dashboard. */
-export function collectSystemInfo(defaultVersion) {
+export function collectSystemInfo(defaultVersion, lanBridgeInfo = null) {
   const disks = collectDisks();
   const diskTotal = disks.reduce((a, d) => a + d.total, 0);
   const diskUsed = disks.reduce((a, d) => a + d.used, 0);
   const diskFree = disks.reduce((a, d) => a + d.free, 0);
   const cpus = os.cpus();
   const meta = detectDshMetadata();
+  const candidates = collectCandidateIpv4s();
+  const bridgePort = lanBridgeInfo?.port || parseInt(process.env.LAN_BRIDGE_PORT || '3088', 10);
+  const bridgeEnabled = lanBridgeInfo ? lanBridgeInfo.enabled : process.env.LAN_BRIDGE_ENABLED !== '0';
   return {
     instanceId: getEffectiveInstanceId(),
     hostname: os.hostname(),
     platform: os.platform(),
     release: os.release(),
     arch: os.arch(),
-    ip: localIPv4(),
+    ip: candidates[0]?.ip || localIPv4(),
+    network: {
+      bridgePort,
+      bridgeEnabled,
+      candidates,
+    },
     cpuModel: cpus[0]?.model || '',
     cpuCores: cpus.length,
     loadAvg: os.loadavg(),
@@ -347,6 +440,244 @@ export function normalizeServices(raw, log) {
   return out;
 }
 
+/**
+ * Start lightweight LAN bridge listener for browser probing and direct LAN offloading.
+ * - Handles /__dsh_probe.gif and /__dsh_probe with CORS + Private Network Access headers.
+ * - Reverse proxies all other requests to local DSH (127.0.0.1:3080) rewriting Host/Origin.
+ * - Forwards WebSocket upgrades cleanly.
+ */
+export function startLanBridge({
+  port = 3088,
+  dshHost = '127.0.0.1',
+  dshPort = 3080,
+  getInstanceId: getInstId = getInstanceId,
+  getWebToken = null,
+  getAuthCookie = null,
+  mintAuthCookie = null,
+  log = console,
+}) {
+  let isListening = false;
+  // Track authenticated client IPs with expiration (7 days)
+  const authenticatedClients = new Map();
+
+  function isClientAuthed(ip, cookieHeader = '') {
+    if (cookieHeader.includes('dsh-auth-') || cookieHeader.includes('dsh_lan_auth=1')) {
+      return true;
+    }
+    const exp = authenticatedClients.get(ip);
+    if (exp && exp > Date.now()) {
+      return true;
+    }
+    return false;
+  }
+
+  function markClientAuthed(ip) {
+    if (ip) {
+      authenticatedClients.set(ip, Date.now() + 7 * 86400000);
+      if (authenticatedClients.size > 1000) {
+        const now = Date.now();
+        for (const [k, v] of authenticatedClients) {
+          if (v <= now) authenticatedClients.delete(k);
+        }
+      }
+    }
+  }
+
+  const server = http.createServer((req, res) => {
+    // CORS + PNA headers for modern browser cross-network access
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Private-Network', 'true');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS, HEAD');
+    res.setHeader('Access-Control-Allow-Headers', '*');
+
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+
+    const rawUrl = req.url || '/';
+    const pathOnly = rawUrl.split('?')[0];
+
+    // 1. Lightweight probe image for PNA / Mixed Content bypass
+    if (pathOnly === '/__dsh_probe.gif') {
+      res.setHeader('Content-Type', 'image/gif');
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
+      res.writeHead(200);
+      res.end(TRANSPARENT_GIF);
+      return;
+    }
+
+    // 2. JSON probe endpoint
+    if (pathOnly === '/__dsh_probe') {
+      res.setHeader('Content-Type', 'application/json');
+      res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
+      res.writeHead(200);
+      res.end(JSON.stringify({
+        ok: true,
+        instanceId: getInstId ? getInstId() : null,
+        hostname: os.hostname(),
+        ts: Date.now(),
+      }));
+      return;
+    }
+
+    const clientIp = req.socket?.remoteAddress;
+    const incomingCookie = req.headers.cookie || '';
+
+    // Check if request query contains a launch/direct token
+    let hasValidTokenInQuery = false;
+    let queryToken = null;
+    try {
+      const u = new URL(rawUrl, 'http://127.0.0.1');
+      queryToken = u.searchParams.get('token');
+      const activeToken = getWebToken ? getWebToken() : null;
+      if (queryToken && activeToken && queryToken === activeToken) {
+        hasValidTokenInQuery = true;
+        markClientAuthed(clientIp);
+      }
+    } catch {}
+
+    const clientAuthed = hasValidTokenInQuery || isClientAuthed(clientIp, incomingCookie);
+
+    // 3. Reverse proxy to local dsh on 127.0.0.1:3080
+    const dshHeaders = { ...req.headers };
+    dshHeaders.host = `${dshHost}:${dshPort}`;
+    if (dshHeaders.origin) {
+      dshHeaders.origin = `http://${dshHost}:${dshPort}`;
+    }
+    if (clientIp) {
+      dshHeaders['x-forwarded-for'] = clientIp;
+    }
+
+    // Auth injection: If request lacks dsh-auth- cookie, but client is authenticated
+    // (via token exchange, dsh_lan_auth cookie, or client IP match),
+    // inject active authCookie so local DSH never 401s on browser cross-origin redirects
+    const currentAuthCookie = getAuthCookie ? getAuthCookie() : null;
+    if (!incomingCookie.includes('dsh-auth-') && clientAuthed && currentAuthCookie) {
+      dshHeaders.cookie = incomingCookie ? `${incomingCookie}; ${currentAuthCookie}` : currentAuthCookie;
+    }
+
+    const dshReq = http.request(
+      `http://${dshHost}:${dshPort}${rawUrl}`,
+      {
+        method: req.method,
+        headers: dshHeaders,
+      },
+      (dshRes) => {
+        const resHeaders = { ...dshRes.headers };
+
+        // Rewrite Set-Cookie: SameSite=Strict -> SameSite=Lax
+        // Also attach dsh_lan_auth cookie if client is authenticated
+        const sc = resHeaders['set-cookie'];
+        if (sc) {
+          const list = Array.isArray(sc) ? sc : [sc];
+          const rewritten = list.map((c) => c.replace(/;\s*SameSite=Strict/i, '; SameSite=Lax'));
+          if (clientAuthed) {
+            rewritten.push('dsh_lan_auth=1; Path=/; SameSite=Lax; Max-Age=2592000');
+          }
+          resHeaders['set-cookie'] = rewritten;
+        } else if (hasValidTokenInQuery || clientAuthed) {
+          resHeaders['set-cookie'] = ['dsh_lan_auth=1; Path=/; SameSite=Lax; Max-Age=2592000'];
+        }
+
+        if (dshRes.statusCode === 401 && mintAuthCookie) {
+          mintAuthCookie().catch(() => {});
+        }
+
+        res.writeHead(dshRes.statusCode, resHeaders);
+        dshRes.pipe(res);
+      }
+    );
+
+    dshReq.on('error', (err) => {
+      if (!res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8' });
+        res.end(`LAN Bridge Error: unable to connect to local DSH at ${dshHost}:${dshPort} (${err.message})`);
+      }
+    });
+
+    req.pipe(dshReq);
+  });
+
+  // Handle WebSocket Upgrade (e.g. terminals, RPC streams)
+  server.on('upgrade', (req, socket, head) => {
+    const clientIp = req.socket?.remoteAddress;
+    const incomingCookie = req.headers.cookie || '';
+    const dshHeaders = { ...req.headers };
+    dshHeaders.host = `${dshHost}:${dshPort}`;
+    if (dshHeaders.origin) {
+      dshHeaders.origin = `http://${dshHost}:${dshPort}`;
+    }
+
+    const currentAuthCookie = getAuthCookie ? getAuthCookie() : null;
+    const clientAuthed = isClientAuthed(clientIp, incomingCookie);
+    if (!incomingCookie.includes('dsh-auth-') && (clientAuthed || currentAuthCookie) && currentAuthCookie) {
+      dshHeaders.cookie = incomingCookie ? `${incomingCookie}; ${currentAuthCookie}` : currentAuthCookie;
+    }
+
+    const proxyReq = http.request({
+      hostname: dshHost,
+      port: dshPort,
+      path: req.url,
+      method: req.method,
+      headers: dshHeaders,
+    });
+
+    proxyReq.on('upgrade', (proxyRes, proxySocket, proxyHead) => {
+      let rawHeaders = `HTTP/1.1 101 Switching Protocols\r\n`;
+      for (const [k, v] of Object.entries(proxyRes.headers)) {
+        if (Array.isArray(v)) {
+          for (const item of v) rawHeaders += `${k}: ${item}\r\n`;
+        } else {
+          rawHeaders += `${k}: ${v}\r\n`;
+        }
+      }
+      rawHeaders += '\r\n';
+      socket.write(rawHeaders);
+
+      if (proxyHead && proxyHead.length) socket.write(proxyHead);
+      if (head && head.length) proxySocket.write(head);
+
+      proxySocket.pipe(socket);
+      socket.pipe(proxySocket);
+
+      proxySocket.on('error', () => socket.destroy());
+      socket.on('error', () => proxySocket.destroy());
+    });
+
+    proxyReq.on('error', (err) => {
+      log.warn?.(`[lan-bridge] WS upgrade to ${dshHost}:${dshPort} error: ${err.message}`);
+      socket.destroy();
+    });
+
+    proxyReq.end();
+  });
+
+  server.on('error', (err) => {
+    isListening = false;
+    log.warn?.(`[lan-bridge] Failed to bind 0.0.0.0:${port}: ${err.message}`);
+  });
+
+  try {
+    server.listen(port, '0.0.0.0', () => {
+      isListening = true;
+      log.log?.(`[lan-bridge] Listening on 0.0.0.0:${port} -> proxying to ${dshHost}:${dshPort}`);
+    });
+  } catch (err) {
+    log.warn?.(`[lan-bridge] Failed to start listener: ${err.message}`);
+  }
+
+  return {
+    server,
+    port,
+    get enabled() { return isListening && server.listening; },
+    close() {
+      try { server.close(); } catch {}
+    },
+  };
+}
+
 /**
  * Start the agent connection loop.
  * @param {object} opts
@@ -498,8 +829,43 @@ export function startAgent(opts) {
     mintAuthCookie();
   }
 
+  function getActiveWebToken() {
+    if (webToken) return webToken;
+    try {
+      if (fs.existsSync('/var/log/dsh-web.log')) {
+        const content = fs.readFileSync('/var/log/dsh-web.log', 'utf8');
+        const matches = [...content.matchAll(/\?token=([A-Za-z0-9_-]+)/g)];
+        if (matches.length > 0) {
+          return matches[matches.length - 1][1];
+        }
+      }
+    } catch {}
+    return null;
+  }
+
   if (webToken) mintAuthCookie();
 
+  // ── LAN Bridge for local/intranet direct offload & timing-gap probing ──
+  const lanBridgePort = parseInt(process.env.LAN_BRIDGE_PORT || '3088', 10);
+  const lanBridgeEnabled = process.env.LAN_BRIDGE_ENABLED !== '0' && process.env.DSH_SERVICES_ONLY !== '1';
+  let lanBridge = null;
+  if (lanBridgeEnabled) {
+    try {
+      lanBridge = startLanBridge({
+        port: lanBridgePort,
+        dshHost,
+        dshPort,
+        getInstanceId: getEffectiveInstanceId,
+        getWebToken: getActiveWebToken,
+        getAuthCookie: () => authCookie,
+        mintAuthCookie,
+        log,
+      });
+    } catch (e) {
+      log.warn?.(`[agent] Failed to initialize LAN bridge: ${e.message}`);
+    }
+  }
+
   const streams = new Map();
   let registered = false;
   let reconnectTimer = null;
@@ -541,7 +907,13 @@ export function startAgent(opts) {
         reconnectAttempt = 0;
         relayUsername = msg.username || null;
         log.log?.(`[agent] Registered as ${msg.username} (session ${msg.sessionId || ''})`);
-        send(ws, { type: 'system-info', info: collectSystemInfo(dshVersion) });
+        send(ws, {
+          type: 'system-info',
+          info: collectSystemInfo(dshVersion, {
+            port: lanBridgePort,
+            enabled: lanBridge ? lanBridge.enabled : false,
+          }),
+        });
         // 插件工作区：上报本实例声明的服务清单（relay 存实例维度，供 /p 路由校验）
         // DSH_SERVICES_ONLY=1：独立 services agent，relay 不注册主实例（服务旁挂到同机 dsh 实例）
         send(ws, servicesFrame());
@@ -551,6 +923,23 @@ export function startAgent(opts) {
 
       if (msg.type === 'heartbeat') return;
 
+      // 直连免密换票请求响应
+      if (msg.type === 'lan-ticket:request') {
+        const activeToken = getActiveWebToken();
+        if (!authCookie && activeToken) {
+          mintAuthCookie().catch(() => {});
+        }
+        send(ws, {
+          type: 'lan-ticket:response',
+          reqId: msg.reqId,
+          ok: true,
+          token: activeToken || '',
+          bridgePort: lanBridgePort,
+          bridgeEnabled: lanBridge ? lanBridge.enabled : false,
+        });
+        return;
+      }
+
       // 门户托管业务下发（仅宿主开启 remoteServices 时接受）
       if (msg.type === 'services:config') {
         if (!remoteServices) { log.warn?.('[agent] services:config ignored (remoteServices disabled)'); return; }
@@ -1005,6 +1394,7 @@ export function startAgent(opts) {
     stop() {
       if (heartbeatInterval) clearInterval(heartbeatInterval);
       if (reconnectTimer) clearTimeout(reconnectTimer);
+      if (lanBridge) lanBridge.close();
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dshost-plugin",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Official remote cloud relay plugin for DSHost (dshost.me): securely access your dsh Web UI from anywhere",
   "type": "module",
   "main": "lib/index.js",