'use strict'; module.exports.create = function (deps, config) { console.log('config', config); var listeners = require('../servers').listeners.tcp; var domainUtils = require('../domain-utils'); var modules; var addrProperties = [ 'remoteAddress' , 'remotePort' , 'remoteFamily' , 'localAddress' , 'localPort' , 'localFamily' ]; function nameMatchesDomains(name, domainList) { return domainList.some(function (pattern) { return domainUtils.match(pattern, name); }); } function proxy(mod, conn, opts) { // First thing we need to add to the connection options is where to proxy the connection to var newConnOpts = domainUtils.separatePort(mod.address || ''); newConnOpts.port = newConnOpts.port || mod.port; newConnOpts.host = newConnOpts.host || mod.host || 'localhost'; // Then we add all of the connection address information. We need to prefix all of the // properties with '_' so we can provide the information to any connection `createConnection` // implementation but not have the default implementation try to bind the same local port. addrProperties.forEach(function (name) { newConnOpts['_' + name] = opts[name] || opts['_'+name] || conn[name] || conn['_'+name]; }); modules.proxy(conn, newConnOpts); return true; } function checkTcpProxy(conn, opts) { var proxied = false; // TCP Proxying (ie routing based on domain name [vs local port]) only works for // TLS wrapped connections, so if the opts don't give us a servername or don't tell us // this is the decrypted side of a TLS connection we can't handle it here. if (!opts.servername || !opts.encrypted) { return proxied; } proxied = config.domains.some(function (dom) { if (!dom.modules || !Array.isArray(dom.modules.tcp)) { return false; } if (!nameMatchesDomains(opts.servername, dom.names)) { return false; } return dom.modules.tcp.some(function (mod) { if (mod.type !== 'proxy') { return false; } return proxy(mod, conn, opts); }); }); proxied = proxied || config.tcp.modules.some(function (mod) { if (mod.type !== 'proxy') { return false; } if (!nameMatchesDomains(opts.servername, mod.domains)) { return false; } return proxy(mod, conn, opts); }); return proxied; } function checkTcpForward(conn, opts) { // TCP forwarding (ie routing connections based on local port) requires the local port if (!conn.localPort) { return false; } return config.tcp.modules.some(function (mod) { if (mod.type !== 'forward') { return false; } if (mod.ports.indexOf(conn.localPort) < 0) { return false; } return proxy(mod, conn, opts); }); } // opts = { servername, encrypted, peek, data, remoteAddress, remotePort } function peek(conn, firstChunk, opts) { opts.firstChunk = firstChunk; conn.__opts = opts; // TODO port/service-based routing can do here // TLS byte 1 is handshake and byte 6 is client hello if (0x16 === firstChunk[0]/* && 0x01 === firstChunk[5]*/) { modules.tls.emit('connection', conn); return; } // This doesn't work with TLS, but now that we know this isn't a TLS connection we can // unshift the first chunk back onto the connection for future use. The unshift should // happen after any listeners are attached to it but before any new data comes in. if (!opts.hyperPeek) { process.nextTick(function () { conn.unshift(firstChunk); }); } // Connection is not TLS, check for HTTP next. if (firstChunk[0] > 32 && firstChunk[0] < 127) { var firstStr = firstChunk.toString(); if (/HTTP\//i.test(firstStr)) { modules.http.emit('connection', conn); return; } } console.warn('failed to identify protocol from first chunk', firstChunk); conn.destroy(); } function tcpHandler(conn, opts) { function getProp(name) { return opts[name] || opts['_'+name] || conn[name] || conn['_'+name]; } opts = opts || {}; var logName = getProp('remoteAddress') + ':' + getProp('remotePort') + ' -> ' + getProp('localAddress') + ':' + getProp('localPort'); console.log('[tcpHandler]', logName, 'connection started - encrypted: ' + (opts.encrypted || false)); var start = Date.now(); conn.on('timeout', function () { console.log('[tcpHandler]', logName, 'connection timed out', (Date.now()-start)/1000); }); conn.on('end', function () { console.log('[tcpHandler]', logName, 'connection ended', (Date.now()-start)/1000); }); conn.on('close', function () { console.log('[tcpHandler]', logName, 'connection closed', (Date.now()-start)/1000); }); if (checkTcpForward(conn, opts)) { return; } if (checkTcpProxy(conn, opts)) { return; } // XXX PEEK COMMENT XXX // TODO we can have our cake and eat it too // we can skip the need to wrap the TLS connection twice // because we've already peeked at the data, // but this needs to be handled better before we enable that // (because it creates new edge cases) if (opts.hyperPeek) { console.log('hyperpeek'); peek(conn, opts.firstChunk, opts); return; } function onError(err) { console.error('[error] socket errored peeking -', err); conn.destroy(); } conn.once('error', onError); conn.once('data', function (chunk) { conn.removeListener('error', onError); peek(conn, chunk, opts); }); } modules = {}; modules.tcpHandler = tcpHandler; modules.proxy = require('./proxy-conn').create(deps, config); modules.tls = require('./tls').create(deps, config, modules); modules.http = require('./http').create(deps, config, modules); deps.tunnel = deps.tunnel || {}; deps.tunnel.net = { createConnection: function (opts, cb) { console.log('[gl.tunnel] creating connection'); // here "reader" means the socket that looks like the connection being accepted // here "writer" means the remote-looking part of the socket that driving the connection var writer; var wrapOpts = {}; function usePair(err, reader) { if (err) { process.nextTick(function () { writer.emit('error', err); }); return; } // this has the normal net/tcp stuff plus our custom stuff // opts = { address, port, // hostname, servername, tls, encrypted, data, localAddress, localPort, remoteAddress, remotePort, remoteFamily } Object.keys(opts).forEach(function (key) { wrapOpts[key] = opts[key]; try { reader[key] = opts[key]; } catch(e) { // can't set real socket getters, like remoteAddr } }); // A few more extra specialty options wrapOpts.localAddress = wrapOpts.localAddress || '127.0.0.2'; // TODO use the tunnel's external address wrapOpts.localPort = wrapOpts.localPort || 'tunnel-0'; try { reader._remoteAddress = wrapOpts.remoteAddress; reader._remotePort = wrapOpts.remotePort; reader._remoteFamily = wrapOpts.remoteFamily; reader._localAddress = wrapOpts.localAddress; reader._localPort = wrapOpts.localPort; reader._localFamily = wrapOpts.localFamily; } catch(e) { } tcpHandler(reader, wrapOpts); process.nextTick(function () { // this cb will cause the stream to emit its (actually) first data event // (even though it already gave a peek into that first data chunk) console.log('[tunnel] callback, data should begin to flow'); cb(); }); } wrapOpts.firstChunk = opts.data; wrapOpts.hyperPeek = !!opts.data; // We used to use `stream-pair` for non-tls connections, but there are places // that require properties/functions to be present on the socket that aren't // present on a JSStream so it caused problems. writer = require('socket-pair').create(usePair); return writer; } }; deps.tunnelClients = require('../tunnel-client-manager').create(deps, config); deps.tunnelServer = require('../tunnel-server-manager').create(deps, config); function updateListeners() { var current = listeners.list(); var wanted = config.tcp.bind; if (!Array.isArray(wanted)) { wanted = []; } wanted = wanted.map(Number).filter((port) => port > 0 && port < 65356); var closeProms = current.filter(function (port) { return wanted.indexOf(port) < 0; }).map(function (port) { return listeners.close(port, 1000); }); // We don't really need to filter here since listening on the same port with the // same handler function twice is basically a no-op. var openProms = wanted.map(function (port) { return listeners.add(port, tcpHandler); }); return Promise.all(closeProms.concat(openProms)); } var mainPort; function updateConf() { updateListeners().catch(function (err) { console.error('Error updating TCP listeners to match bind configuration'); console.error(err); }); var unforwarded = {}; config.tcp.bind.forEach(function (port) { unforwarded[port] = true; }); config.tcp.modules.forEach(function (mod) { if (['forward', 'proxy'].indexOf(mod.type) < 0) { console.warn('unknown TCP module type specified', JSON.stringify(mod)); } if (mod.type !== 'forward') { return; } mod.ports.forEach(function (port) { if (!unforwarded[port]) { console.warn('trying to forward TCP port ' + port + ' multiple times or it is unbound'); } else { delete unforwarded[port]; } }); }); // Not really sure what we can reasonably do to prevent this. At least not without making // our configuration validation more complicated. if (!Object.keys(unforwarded).length) { console.warn('no bound TCP ports are not being forwarded, admin interface will be inaccessible'); } // If we are listening on port 443 make that the main port we respond to mDNS queries with // otherwise choose the lowest number port we are bound to but not forwarding. if (unforwarded['443']) { mainPort = 443; } else { mainPort = Object.keys(unforwarded).map(Number).sort((a, b) => a - b)[0]; } } updateConf(); var result = { updateConf }; Object.defineProperty(result, 'mainPort', {enumerable: true, get: () => mainPort}); return result; };