rezo 1.0.138 → 1.0.140

package/dist/adapters/curl-exit-code.cjs

@@ -0,0 +1,66 @@
+const EXIT_CODE_TO_ERROR_CODE = {
+  1: "ERR_INVALID_PROTOCOL",
+  3: "ERR_INVALID_URL",
+  5: "REZ_PROXY_CONNECTION_FAILED",
+  6: "ENOTFOUND",
+  8: "HPE_INVALID_CONSTANT",
+  16: "ERR_HTTP2_ERROR",
+  18: "ERR_STREAM_PREMATURE_CLOSE",
+  22: "REZ_HTTP_ERROR",
+  23: "REZ_DOWNLOAD_FAILED",
+  26: "REZ_UPLOAD_FAILED",
+  35: "EPROTO",
+  47: "REZ_MAX_REDIRECTS_EXCEEDED",
+  52: "ECONNRESET",
+  53: "EPROTO",
+  55: "EPIPE",
+  56: "ECONNRESET",
+  58: "ERR_TLS_INVALID_CLIENT_CERTIFICATE",
+  59: "EPROTO",
+  61: "REZ_DECOMPRESSION_ERROR",
+  63: "REZ_RESPONSE_TOO_LARGE",
+  77: "ERR_TLS_CA_BUNDLE_UNREADABLE",
+  91: "REZ_SOCKS_PROTOCOL_ERROR",
+  92: "ECONNRESET",
+  97: "REZ_PROXY_TARGET_UNREACHABLE",
+  99: "ERR_TLS_INVALID_CLIENT_CERTIFICATE"
+};
+const CONNECT_FAILURE_PATTERNS = [
+  [/connection refused/i, "ECONNREFUSED"],
+  [/no route to host/i, "EHOSTUNREACH"],
+  [/network (is )?unreachable/i, "ENETUNREACH"],
+  [/timed? ?out/i, "ETIMEDOUT"]
+];
+const VERIFICATION_FAILURE_PATTERNS = [
+  [/no alternative certificate subject name matches|does not match target host name/i, "ERR_TLS_CERT_ALTNAME_INVALID"],
+  [/certificate has expired/i, "CERT_HAS_EXPIRED"],
+  [/certificate is not yet valid/i, "CERT_NOT_YET_VALID"],
+  [/self[- ]signed certificate in certificate chain/i, "SELF_SIGNED_CERT_IN_CHAIN"],
+  [/self[- ]signed certificate/i, "DEPTH_ZERO_SELF_SIGNED_CERT"],
+  [/unable to get (local )?issuer certificate/i, "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"]
+];
+const CURL_EXIT_COULD_NOT_CONNECT = 7;
+const CURL_EXIT_PEER_VERIFICATION_FAILED = 60;
+const CURL_EXIT_PEER_VERIFICATION_FAILED_LEGACY = 51;
+function firstMatchingCode(stderr, patterns, fallback) {
+  for (const [pattern, code] of patterns) {
+    if (pattern.test(stderr))
+      return code;
+  }
+  return fallback;
+}
+function classifyCurlExitCode(exitCode, stderr) {
+  if (exitCode === CURL_EXIT_COULD_NOT_CONNECT) {
+    return firstMatchingCode(stderr, CONNECT_FAILURE_PATTERNS, "ECONNREFUSED");
+  }
+  if (exitCode === CURL_EXIT_PEER_VERIFICATION_FAILED || exitCode === CURL_EXIT_PEER_VERIFICATION_FAILED_LEGACY) {
+    return firstMatchingCode(stderr, VERIFICATION_FAILURE_PATTERNS, "UNABLE_TO_VERIFY_LEAF_SIGNATURE");
+  }
+  return EXIT_CODE_TO_ERROR_CODE[exitCode] ?? "REZ_UNKNOWN_ERROR";
+}
+function isCurlTransferInterruption(exitCode) {
+  return exitCode === 18 || exitCode === 55 || exitCode === 56 || exitCode === 92;
+}
+
+exports.classifyCurlExitCode = classifyCurlExitCode;
+exports.isCurlTransferInterruption = isCurlTransferInterruption;

package/dist/adapters/curl-exit-code.js

@@ -0,0 +1,63 @@
+const EXIT_CODE_TO_ERROR_CODE = {
+  1: "ERR_INVALID_PROTOCOL",
+  3: "ERR_INVALID_URL",
+  5: "REZ_PROXY_CONNECTION_FAILED",
+  6: "ENOTFOUND",
+  8: "HPE_INVALID_CONSTANT",
+  16: "ERR_HTTP2_ERROR",
+  18: "ERR_STREAM_PREMATURE_CLOSE",
+  22: "REZ_HTTP_ERROR",
+  23: "REZ_DOWNLOAD_FAILED",
+  26: "REZ_UPLOAD_FAILED",
+  35: "EPROTO",
+  47: "REZ_MAX_REDIRECTS_EXCEEDED",
+  52: "ECONNRESET",
+  53: "EPROTO",
+  55: "EPIPE",
+  56: "ECONNRESET",
+  58: "ERR_TLS_INVALID_CLIENT_CERTIFICATE",
+  59: "EPROTO",
+  61: "REZ_DECOMPRESSION_ERROR",
+  63: "REZ_RESPONSE_TOO_LARGE",
+  77: "ERR_TLS_CA_BUNDLE_UNREADABLE",
+  91: "REZ_SOCKS_PROTOCOL_ERROR",
+  92: "ECONNRESET",
+  97: "REZ_PROXY_TARGET_UNREACHABLE",
+  99: "ERR_TLS_INVALID_CLIENT_CERTIFICATE"
+};
+const CONNECT_FAILURE_PATTERNS = [
+  [/connection refused/i, "ECONNREFUSED"],
+  [/no route to host/i, "EHOSTUNREACH"],
+  [/network (is )?unreachable/i, "ENETUNREACH"],
+  [/timed? ?out/i, "ETIMEDOUT"]
+];
+const VERIFICATION_FAILURE_PATTERNS = [
+  [/no alternative certificate subject name matches|does not match target host name/i, "ERR_TLS_CERT_ALTNAME_INVALID"],
+  [/certificate has expired/i, "CERT_HAS_EXPIRED"],
+  [/certificate is not yet valid/i, "CERT_NOT_YET_VALID"],
+  [/self[- ]signed certificate in certificate chain/i, "SELF_SIGNED_CERT_IN_CHAIN"],
+  [/self[- ]signed certificate/i, "DEPTH_ZERO_SELF_SIGNED_CERT"],
+  [/unable to get (local )?issuer certificate/i, "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"]
+];
+const CURL_EXIT_COULD_NOT_CONNECT = 7;
+const CURL_EXIT_PEER_VERIFICATION_FAILED = 60;
+const CURL_EXIT_PEER_VERIFICATION_FAILED_LEGACY = 51;
+function firstMatchingCode(stderr, patterns, fallback) {
+  for (const [pattern, code] of patterns) {
+    if (pattern.test(stderr))
+      return code;
+  }
+  return fallback;
+}
+export function classifyCurlExitCode(exitCode, stderr) {
+  if (exitCode === CURL_EXIT_COULD_NOT_CONNECT) {
+    return firstMatchingCode(stderr, CONNECT_FAILURE_PATTERNS, "ECONNREFUSED");
+  }
+  if (exitCode === CURL_EXIT_PEER_VERIFICATION_FAILED || exitCode === CURL_EXIT_PEER_VERIFICATION_FAILED_LEGACY) {
+    return firstMatchingCode(stderr, VERIFICATION_FAILURE_PATTERNS, "UNABLE_TO_VERIFY_LEAF_SIGNATURE");
+  }
+  return EXIT_CODE_TO_ERROR_CODE[exitCode] ?? "REZ_UNKNOWN_ERROR";
+}
+export function isCurlTransferInterruption(exitCode) {
+  return exitCode === 18 || exitCode === 55 || exitCode === 56 || exitCode === 92;
+}

package/dist/adapters/curl-redirect-hop.cjs

@@ -0,0 +1,14 @@
+function isFollowableRedirectStatus(status) {
+  return status >= 300 && status < 400 && status !== 304;
+}
+function planCurlRedirectHop(status, method, location, currentUrl) {
+  if (!isFollowableRedirectStatus(status) || !location)
+    return null;
+  const url = new URL(location, currentUrl).toString();
+  if (status === 301 || status === 302 || status === 303)
+    return { dropBody: true, method: "GET", url };
+  return { dropBody: false, method: method.toUpperCase(), url };
+}
+
+exports.isFollowableRedirectStatus = isFollowableRedirectStatus;
+exports.planCurlRedirectHop = planCurlRedirectHop;

package/dist/adapters/curl-redirect-hop.js

@@ -0,0 +1,11 @@
+export function isFollowableRedirectStatus(status) {
+  return status >= 300 && status < 400 && status !== 304;
+}
+export function planCurlRedirectHop(status, method, location, currentUrl) {
+  if (!isFollowableRedirectStatus(status) || !location)
+    return null;
+  const url = new URL(location, currentUrl).toString();
+  if (status === 301 || status === 302 || status === 303)
+    return { dropBody: true, method: "GET", url };
+  return { dropBody: false, method: method.toUpperCase(), url };
+}

package/dist/adapters/curl-stealth.cjs

@@ -0,0 +1,120 @@
+const { spawn } = require("node:child_process");
+const { createServer } = require("node:net");
+const OPENSSL_FAMILY = new Set(["OpenSSL", "quictls"]);
+const BACKEND_TOKEN = /^\(?(OpenSSL|quictls|LibreSSL|BoringSSL|AWS-LC|wolfSSL|GnuTLS|mbedTLS|Schannel|SecureTransport|rustls|bearssl)(?:\/([\w.+-]+))?\)?$/u;
+const CURL_ROUTE_BOUNDARIES = Object.freeze([
+  "sigalgs",
+  "renegotiationScsv",
+  "extensionOrder",
+  "grease",
+  "h2Settings",
+  "h2ConnectionWindow",
+  "h2PseudoHeaderOrder"
+]);
+function parseCurlTlsBackends(versionLine) {
+  const backends = [];
+  for (const token of versionLine.trim().split(/\s+/u)) {
+    const match = token.match(BACKEND_TOKEN);
+    if (match)
+      backends.push({ name: match[1], version: match[2] ?? null });
+  }
+  return backends;
+}
+function splitCipherSuites(ciphers) {
+  const tls12 = [];
+  const tls13 = [];
+  for (const suite of ciphers.split(":")) {
+    if (!suite || suite.startsWith("@"))
+      continue;
+    (suite.startsWith("TLS_") ? tls13 : tls12).push(suite);
+  }
+  return { tls12, tls13 };
+}
+function supportsKeyShareMarkers(backend) {
+  if (!backend || !OPENSSL_FAMILY.has(backend.name) || !backend.version)
+    return false;
+  const [major = 0, minor = 0] = backend.version.split(".").map((part) => Number.parseInt(part, 10));
+  return major > 3 || major === 3 && minor >= 5;
+}
+function stealthTlsArguments(profile, keyShareMarkers = false) {
+  const { tls12, tls13 } = splitCipherSuites(profile.tls.ciphers);
+  const args = [];
+  args.push(profile.tls.minVersion === "TLSv1.3" ? "--tlsv1.3" : "--tlsv1.2");
+  args.push("--tls-max", profile.tls.maxVersion === "TLSv1.2" ? "1.2" : "1.3");
+  if (tls13.length > 0)
+    args.push("--tls13-ciphers", tls13.join(":"));
+  if (tls12.length > 0)
+    args.push("--ciphers", tls12.join(":"));
+  const groups = profile.tls.ecdhCurve.split(":").filter((group) => group.length > 0).map((group) => keyShareMarkers ? group : group.replace(/^\*/u, ""));
+  if (groups.length > 0)
+    args.push("--curves", groups.join(":"));
+  return args;
+}
+const acceptanceByMaterial = new Map;
+function probeCurlTlsAcceptance(tlsArgs, curlCommand = "curl") {
+  const key = `${curlCommand} ${tlsArgs.join(" ")}`;
+  let pending = acceptanceByMaterial.get(key);
+  if (!pending) {
+    pending = runAcceptanceProbe(tlsArgs, curlCommand);
+    acceptanceByMaterial.set(key, pending);
+    pending.catch(() => acceptanceByMaterial.delete(key));
+  }
+  return pending;
+}
+async function runAcceptanceProbe(tlsArgs, curlCommand) {
+  const listener = createServer((socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    listener.once("error", reject);
+    listener.listen(0, "127.0.0.1", () => resolve());
+  });
+  const address = listener.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  try {
+    return await new Promise((resolve, reject) => {
+      const child = spawn(curlCommand, ["-sS", "--max-time", "10", "-o", "/dev/null", ...tlsArgs, `https://127.0.0.1:${port}/`], { stdio: ["ignore", "ignore", "pipe"] });
+      let stderr = "";
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      child.once("error", reject);
+      child.once("close", (code) => {
+        if (code === 59)
+          resolve({ accepted: false, detail: stderr.trim().split(`
+`).pop() ?? `curl exit ${code}` });
+        else
+          resolve({ accepted: true });
+      });
+    });
+  } finally {
+    await new Promise((resolve) => listener.close(() => resolve()));
+  }
+}
+async function mapStealthProfileToCurl(profile, capabilities, curlCommand = "curl") {
+  const reasons = [];
+  if (capabilities.tlsBackends.length !== 1) {
+    reasons.push(capabilities.tlsBackends.length === 0 ? `curl ${capabilities.curlVersion} names no TLS backend, so its cipher and group syntax is unknown` : `curl ${capabilities.curlVersion} is a MultiSSL build (${capabilities.tlsBackends.map((backend) => backend.name).join(", ")}); the active backend cannot be known from here`);
+  } else if (!OPENSSL_FAMILY.has(capabilities.tlsBackends[0].name)) {
+    reasons.push(`curl ${capabilities.curlVersion} uses ${capabilities.tlsBackends[0].name}, which does not take the profile's OpenSSL cipher and group lists`);
+  }
+  const wantsHttp2 = profile.tls.alpnProtocols.includes("h2");
+  if (wantsHttp2 && !capabilities.http2)
+    reasons.push(`profile offers h2 in ALPN but curl ${capabilities.curlVersion} was built without HTTP/2`);
+  if (reasons.length > 0)
+    return { ok: false, reasons };
+  const tlsArgs = stealthTlsArguments(profile, supportsKeyShareMarkers(capabilities.tlsBackends[0]));
+  const acceptance = await probeCurlTlsAcceptance(tlsArgs, curlCommand);
+  if (!acceptance.accepted) {
+    return { ok: false, reasons: [`curl ${capabilities.curlVersion} (${capabilities.tlsBackends[0].name}/${capabilities.tlsBackends[0].version ?? "?"}) rejects the profile's TLS material: ${acceptance.detail}`] };
+  }
+  return {
+    ok: true,
+    mapping: { tlsArgs, httpVersionArg: wantsHttp2 ? "--http2" : "--http1.1", useHttp2Headers: wantsHttp2, notExpressible: CURL_ROUTE_BOUNDARIES }
+  };
+}
+
+exports.parseCurlTlsBackends = parseCurlTlsBackends;
+exports.splitCipherSuites = splitCipherSuites;
+exports.supportsKeyShareMarkers = supportsKeyShareMarkers;
+exports.stealthTlsArguments = stealthTlsArguments;
+exports.probeCurlTlsAcceptance = probeCurlTlsAcceptance;
+exports.mapStealthProfileToCurl = mapStealthProfileToCurl;

package/dist/adapters/curl-stealth.js

@@ -0,0 +1,113 @@
+import { spawn } from "node:child_process";
+import { createServer } from "node:net";
+const OPENSSL_FAMILY = new Set(["OpenSSL", "quictls"]);
+const BACKEND_TOKEN = /^\(?(OpenSSL|quictls|LibreSSL|BoringSSL|AWS-LC|wolfSSL|GnuTLS|mbedTLS|Schannel|SecureTransport|rustls|bearssl)(?:\/([\w.+-]+))?\)?$/u;
+const CURL_ROUTE_BOUNDARIES = Object.freeze([
+  "sigalgs",
+  "renegotiationScsv",
+  "extensionOrder",
+  "grease",
+  "h2Settings",
+  "h2ConnectionWindow",
+  "h2PseudoHeaderOrder"
+]);
+export function parseCurlTlsBackends(versionLine) {
+  const backends = [];
+  for (const token of versionLine.trim().split(/\s+/u)) {
+    const match = token.match(BACKEND_TOKEN);
+    if (match)
+      backends.push({ name: match[1], version: match[2] ?? null });
+  }
+  return backends;
+}
+export function splitCipherSuites(ciphers) {
+  const tls12 = [];
+  const tls13 = [];
+  for (const suite of ciphers.split(":")) {
+    if (!suite || suite.startsWith("@"))
+      continue;
+    (suite.startsWith("TLS_") ? tls13 : tls12).push(suite);
+  }
+  return { tls12, tls13 };
+}
+export function supportsKeyShareMarkers(backend) {
+  if (!backend || !OPENSSL_FAMILY.has(backend.name) || !backend.version)
+    return false;
+  const [major = 0, minor = 0] = backend.version.split(".").map((part) => Number.parseInt(part, 10));
+  return major > 3 || major === 3 && minor >= 5;
+}
+export function stealthTlsArguments(profile, keyShareMarkers = false) {
+  const { tls12, tls13 } = splitCipherSuites(profile.tls.ciphers);
+  const args = [];
+  args.push(profile.tls.minVersion === "TLSv1.3" ? "--tlsv1.3" : "--tlsv1.2");
+  args.push("--tls-max", profile.tls.maxVersion === "TLSv1.2" ? "1.2" : "1.3");
+  if (tls13.length > 0)
+    args.push("--tls13-ciphers", tls13.join(":"));
+  if (tls12.length > 0)
+    args.push("--ciphers", tls12.join(":"));
+  const groups = profile.tls.ecdhCurve.split(":").filter((group) => group.length > 0).map((group) => keyShareMarkers ? group : group.replace(/^\*/u, ""));
+  if (groups.length > 0)
+    args.push("--curves", groups.join(":"));
+  return args;
+}
+const acceptanceByMaterial = new Map;
+export function probeCurlTlsAcceptance(tlsArgs, curlCommand = "curl") {
+  const key = `${curlCommand} ${tlsArgs.join(" ")}`;
+  let pending = acceptanceByMaterial.get(key);
+  if (!pending) {
+    pending = runAcceptanceProbe(tlsArgs, curlCommand);
+    acceptanceByMaterial.set(key, pending);
+    pending.catch(() => acceptanceByMaterial.delete(key));
+  }
+  return pending;
+}
+async function runAcceptanceProbe(tlsArgs, curlCommand) {
+  const listener = createServer((socket) => socket.destroy());
+  await new Promise((resolve, reject) => {
+    listener.once("error", reject);
+    listener.listen(0, "127.0.0.1", () => resolve());
+  });
+  const address = listener.address();
+  const port = typeof address === "object" && address ? address.port : 0;
+  try {
+    return await new Promise((resolve, reject) => {
+      const child = spawn(curlCommand, ["-sS", "--max-time", "10", "-o", "/dev/null", ...tlsArgs, `https://127.0.0.1:${port}/`], { stdio: ["ignore", "ignore", "pipe"] });
+      let stderr = "";
+      child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+      });
+      child.once("error", reject);
+      child.once("close", (code) => {
+        if (code === 59)
+          resolve({ accepted: false, detail: stderr.trim().split(`
+`).pop() ?? `curl exit ${code}` });
+        else
+          resolve({ accepted: true });
+      });
+    });
+  } finally {
+    await new Promise((resolve) => listener.close(() => resolve()));
+  }
+}
+export async function mapStealthProfileToCurl(profile, capabilities, curlCommand = "curl") {
+  const reasons = [];
+  if (capabilities.tlsBackends.length !== 1) {
+    reasons.push(capabilities.tlsBackends.length === 0 ? `curl ${capabilities.curlVersion} names no TLS backend, so its cipher and group syntax is unknown` : `curl ${capabilities.curlVersion} is a MultiSSL build (${capabilities.tlsBackends.map((backend) => backend.name).join(", ")}); the active backend cannot be known from here`);
+  } else if (!OPENSSL_FAMILY.has(capabilities.tlsBackends[0].name)) {
+    reasons.push(`curl ${capabilities.curlVersion} uses ${capabilities.tlsBackends[0].name}, which does not take the profile's OpenSSL cipher and group lists`);
+  }
+  const wantsHttp2 = profile.tls.alpnProtocols.includes("h2");
+  if (wantsHttp2 && !capabilities.http2)
+    reasons.push(`profile offers h2 in ALPN but curl ${capabilities.curlVersion} was built without HTTP/2`);
+  if (reasons.length > 0)
+    return { ok: false, reasons };
+  const tlsArgs = stealthTlsArguments(profile, supportsKeyShareMarkers(capabilities.tlsBackends[0]));
+  const acceptance = await probeCurlTlsAcceptance(tlsArgs, curlCommand);
+  if (!acceptance.accepted) {
+    return { ok: false, reasons: [`curl ${capabilities.curlVersion} (${capabilities.tlsBackends[0].name}/${capabilities.tlsBackends[0].version ?? "?"}) rejects the profile's TLS material: ${acceptance.detail}`] };
+  }
+  return {
+    ok: true,
+    mapping: { tlsArgs, httpVersionArg: wantsHttp2 ? "--http2" : "--http1.1", useHttp2Headers: wantsHttp2, notExpressible: CURL_ROUTE_BOUNDARIES }
+  };
+}