[Init] Initial commit - NetMesh terminal manager

electron/bridges/proxyUtils.cjs

@@ -0,0 +1,347 @@
+/**
+ * Proxy Utilities - Shared proxy socket creation for SSH connections
+ * Extracted from sshBridge.cjs and sftpBridge.cjs to eliminate code duplication
+ */
+
+const net = require("node:net");
+const { spawn } = require("node:child_process");
+const { Duplex } = require("node:stream");
+const { enableTcpNoDelay } = require("./tcpNoDelay.cjs");
+
+function quotePosixShellArg(value) {
+    return "'" + String(value).replace(/'/g, "'\\''") + "'";
+}
+
+function quoteWindowsCmdArg(value) {
+    const text = String(value);
+    if (/[\0\r\n"%!]/.test(text)) {
+        throw new Error("ProxyCommand target contains characters that cannot be safely substituted on Windows");
+    }
+    return `"${text}"`;
+}
+
+function quoteShellArg(value, platform = process.platform) {
+    return platform === "win32" ? quoteWindowsCmdArg(value) : quotePosixShellArg(value);
+}
+
+function substituteProxyCommand(command, targetHost, targetPort, options = {}) {
+    const platform = options.platform || process.platform;
+    return String(command || "").replace(/%%|%h|%p/g, (token) => {
+        if (token === "%%") return "%";
+        if (token === "%h") return quoteShellArg(targetHost, platform);
+        if (token === "%p") return quoteShellArg(targetPort, platform);
+        return token;
+    });
+}
+
+function createProcessSocket(child) {
+    let proxyReady = false;
+    const proxyReadyCallbacks = new Set();
+    const markProxyReady = () => {
+        if (proxyReady) return;
+        proxyReady = true;
+        for (const callback of proxyReadyCallbacks) callback();
+        proxyReadyCallbacks.clear();
+    };
+    const socket = new Duplex({
+        read() {
+            child.stdout.resume();
+        },
+        write(chunk, encoding, callback) {
+            if (!child.stdin.writable) {
+                callback(new Error("ProxyCommand stdin is not writable"));
+                return;
+            }
+            if (child.stdin.write(chunk, encoding)) {
+                callback();
+            } else {
+                child.stdin.once("drain", callback);
+            }
+        },
+        final(callback) {
+            child.stdin.end(callback);
+        },
+        destroy(error, callback) {
+            proxyReadyCallbacks.clear();
+            try { child.stdin.destroy(); } catch { /* ignore */ }
+            try { child.stdout.destroy(); } catch { /* ignore */ }
+            if (!child.killed) {
+                try { child.kill(); } catch { /* ignore */ }
+            }
+            callback(error);
+        },
+    });
+    socket.setNoDelay = () => socket;
+    socket.setKeepAlive = () => socket;
+    socket.setTimeout = () => socket;
+    socket.__netcattyOnProxyReady = (callback) => {
+        if (proxyReady) queueMicrotask(callback);
+        else proxyReadyCallbacks.add(callback);
+    };
+
+    child.stdout.on("data", (chunk) => {
+        markProxyReady();
+        if (!socket.push(chunk)) child.stdout.pause();
+    });
+    child.stdout.on("end", () => socket.push(null));
+    child.stdout.on("error", (err) => socket.destroy(err));
+    child.stdin.on("error", (err) => socket.destroy(err));
+
+    return socket;
+}
+
+function runWhenProxyConnectionReady(socket, callback) {
+    if (typeof socket?.__netcattyOnProxyReady === "function") {
+        socket.__netcattyOnProxyReady(callback);
+        return;
+    }
+    callback();
+}
+
+function createProxyCommandSocket(proxy, targetHost, targetPort, options = {}) {
+    const command = substituteProxyCommand(proxy.command, targetHost, targetPort, { platform: process.platform }).trim();
+    if (!command) return Promise.reject(new Error("ProxyCommand is required"));
+
+    // Keep SSH ProxyCommand on the launch-time proxy env. App-level Direct/Custom
+    // rewrites process.env for Node HTTP clients only and must not change SSH.
+    const { buildTerminalProcessEnv } = require("./httpNetworkProxyBridge.cjs");
+    const child = spawn(command, {
+        shell: true,
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true,
+        env: buildTerminalProcessEnv(process.env),
+    });
+    const socket = createProcessSocket(child);
+    const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
+        ? Number(options.timeoutMs)
+        : 0;
+    let settled = false;
+    let stderr = "";
+    let timeoutId = null;
+
+    const clearConnectTimeout = () => {
+        if (!timeoutId) return;
+        clearTimeout(timeoutId);
+        timeoutId = null;
+    };
+
+    child.stderr?.on("data", (chunk) => {
+        stderr = (stderr + chunk.toString()).slice(-4096);
+    });
+    child.stdout.once("data", clearConnectTimeout);
+    child.once("close", clearConnectTimeout);
+
+    if (timeoutMs) {
+        timeoutId = setTimeout(() => {
+            const err = new Error(`ProxyCommand connection timeout to ${targetHost}:${targetPort}`);
+            socket.destroy(err);
+        }, timeoutMs);
+        timeoutId.unref?.();
+    }
+
+    return new Promise((resolve, reject) => {
+        child.once("error", (err) => {
+            clearConnectTimeout();
+            if (settled) {
+                socket.destroy(err);
+                return;
+            }
+            settled = true;
+            reject(err);
+        });
+        child.once("spawn", () => {
+            settled = true;
+            try { options.onSocket?.(socket); } catch { /* ignore */ }
+            resolve(socket);
+        });
+        child.once("close", (code, signal) => {
+            if (code === 0 || socket.destroyed) return;
+            const detail = stderr.trim() ? `: ${stderr.trim()}` : "";
+            const err = new Error(`ProxyCommand exited ${signal ? `with signal ${signal}` : `with code ${code}`}${detail}`);
+            if (!settled) {
+                settled = true;
+                reject(err);
+            } else {
+                socket.destroy(err);
+            }
+        });
+    }).catch((err) => {
+        clearConnectTimeout();
+        try { child.kill(); } catch { /* ignore */ }
+        throw err;
+    });
+}
+
+/**
+ * Create a socket through a proxy (HTTP CONNECT or SOCKS5)
+ * @param {Object} proxy - Proxy configuration
+ * @param {string} proxy.type - 'http' or 'socks5'
+ * @param {string} proxy.host - Proxy host
+ * @param {number} proxy.port - Proxy port
+ * @param {string} [proxy.username] - Optional username for auth
+ * @param {string} [proxy.password] - Optional password for auth
+ * @param {string} targetHost - Target host to connect through proxy
+ * @param {number} targetPort - Target port to connect through proxy
+ * @param {Object} [options]
+ * @param {(socket: net.Socket) => void} [options.onSocket] - Called immediately with the underlying socket
+ * @returns {Promise<net.Socket>} Connected socket through proxy
+ */
+function createProxySocket(proxy, targetHost, targetPort, options = {}) {
+    const { onSocket } = options;
+    if (proxy.type === 'command') {
+        return createProxyCommandSocket(proxy, targetHost, targetPort, options);
+    }
+    return new Promise((resolve, reject) => {
+        const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0
+            ? Number(options.timeoutMs)
+            : 0;
+        let settled = false;
+        let timeoutId = null;
+        let socket = null;
+
+        const clearHandshakeTimeout = () => {
+            if (timeoutId) {
+                clearTimeout(timeoutId);
+                timeoutId = null;
+            }
+        };
+        const settleResolve = () => {
+            if (settled) return;
+            settled = true;
+            clearHandshakeTimeout();
+            resolve(socket);
+        };
+        const settleReject = (err) => {
+            if (settled) return;
+            settled = true;
+            clearHandshakeTimeout();
+            try { socket?.destroy?.(); } catch { /* ignore */ }
+            reject(err);
+        };
+        const armHandshakeTimeout = () => {
+            if (!timeoutMs) return;
+            timeoutId = setTimeout(() => {
+                settleReject(new Error(`Proxy connection timeout to ${targetHost}:${targetPort}`));
+            }, timeoutMs);
+            timeoutId.unref?.();
+        };
+
+        if (proxy.type === 'http') {
+            // HTTP CONNECT proxy
+            socket = net.connect(proxy.port, proxy.host, () => {
+                enableTcpNoDelay(socket);
+                let authHeader = '';
+                if (proxy.username && proxy.password) {
+                    const auth = Buffer.from(`${proxy.username}:${proxy.password}`).toString('base64');
+                    authHeader = `Proxy-Authorization: Basic ${auth}\r\n`;
+                }
+                const connectRequest = `CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\nHost: ${targetHost}:${targetPort}\r\n${authHeader}\r\n`;
+                socket.write(connectRequest);
+
+                let response = '';
+                const onData = (data) => {
+                    response += data.toString();
+                    if (response.includes('\r\n\r\n')) {
+                        socket.removeListener('data', onData);
+                        if (response.startsWith('HTTP/1.1 200') || response.startsWith('HTTP/1.0 200')) {
+                            settleResolve();
+                        } else {
+                            settleReject(new Error(`HTTP proxy error: ${response.split('\r\n')[0]}`));
+                        }
+                    }
+                };
+                socket.on('data', onData);
+            });
+            enableTcpNoDelay(socket);
+            try { onSocket?.(socket); } catch { /* ignore */ }
+            armHandshakeTimeout();
+            socket.on('error', settleReject);
+        } else if (proxy.type === 'socks5') {
+            // SOCKS5 proxy
+            socket = net.connect(proxy.port, proxy.host, () => {
+                enableTcpNoDelay(socket);
+                // SOCKS5 greeting
+                const authMethods = proxy.username && proxy.password ? [0x00, 0x02] : [0x00];
+                socket.write(Buffer.from([0x05, authMethods.length, ...authMethods]));
+
+                let step = 'greeting';
+                const onData = (data) => {
+                    if (step === 'greeting') {
+                        if (data[0] !== 0x05) {
+                            settleReject(new Error('Invalid SOCKS5 response'));
+                            return;
+                        }
+                        const method = data[1];
+                        if (method === 0x02 && proxy.username && proxy.password) {
+                            // Username/password auth
+                            step = 'auth';
+                            const userBuf = Buffer.from(proxy.username);
+                            const passBuf = Buffer.from(proxy.password);
+                            socket.write(Buffer.concat([
+                                Buffer.from([0x01, userBuf.length]),
+                                userBuf,
+                                Buffer.from([passBuf.length]),
+                                passBuf
+                            ]));
+                        } else if (method === 0x00) {
+                            // No auth, proceed to connect
+                            step = 'connect';
+                            sendConnectRequest();
+                        } else {
+                            settleReject(new Error('SOCKS5 authentication method not supported'));
+                        }
+                    } else if (step === 'auth') {
+                        if (data[1] !== 0x00) {
+                            settleReject(new Error('SOCKS5 authentication failed'));
+                            return;
+                        }
+                        step = 'connect';
+                        sendConnectRequest();
+                    } else if (step === 'connect') {
+                        socket.removeListener('data', onData);
+                        if (data[1] === 0x00) {
+                            settleResolve();
+                        } else {
+                            const errors = {
+                                0x01: 'General failure',
+                                0x02: 'Connection not allowed',
+                                0x03: 'Network unreachable',
+                                0x04: 'Host unreachable',
+                                0x05: 'Connection refused',
+                                0x06: 'TTL expired',
+                                0x07: 'Command not supported',
+                                0x08: 'Address type not supported',
+                            };
+                            settleReject(new Error(`SOCKS5 error: ${errors[data[1]] || 'Unknown'}`));
+                        }
+                    }
+                };
+
+                const sendConnectRequest = () => {
+                    // SOCKS5 connect request
+                    const hostBuf = Buffer.from(targetHost);
+                    const request = Buffer.concat([
+                        Buffer.from([0x05, 0x01, 0x00, 0x03, hostBuf.length]),
+                        hostBuf,
+                        Buffer.from([(targetPort >> 8) & 0xff, targetPort & 0xff])
+                    ]);
+                    socket.write(request);
+                };
+
+                socket.on('data', onData);
+            });
+            enableTcpNoDelay(socket);
+            try { onSocket?.(socket); } catch { /* ignore */ }
+            armHandshakeTimeout();
+            socket.on('error', settleReject);
+        } else {
+            reject(new Error(`Unknown proxy type: ${proxy.type}`));
+        }
+    });
+}
+
+module.exports = {
+    createProxySocket,
+    runWhenProxyConnectionReady,
+    substituteProxyCommand,
+};