feat: listener scope filter

charts/fsm/components/scripts/gateways/filters/http/HTTPForward.js

@@ -0,0 +1,28 @@
+export default function () {
+  var $ctx
+  var $sni
+  var $session
+
+  var balancers = new algo.Cache(
+    target => new algo.LoadBalancer([target])
+  )
+
+  return pipeline($=>$
+    .onStart(c => {
+      $ctx = c.parent
+      $sni = $ctx.originalServerName
+      $session = balancers.get($ctx.originalTarget).allocate()
+    })
+    .muxHTTP(() => $session).to($=>$
+      .pipe(() => $sni ? 'tls' : 'tcp', {
+        'tcp': ($=>$.connect(() => $session.target)),
+        'tls': ($=>$
+          .connectTLS({ sni: () => $sni }).to($=>$
+            .connect(() => $session.target)
+          )
+        ),
+      })
+    )
+    .onEnd(() => $session.free())
+  )
+}

charts/fsm/components/scripts/gateways/filters/tcp/ProxyAccept.js

@@ -0,0 +1,55 @@
+export default function () {
+  var $ctx
+  var $proto
+
+  return pipeline($=>$
+    .onStart(c => { $ctx = c })
+    .detectProtocol(p => { $proto = p })
+    .pipe(
+      () => {
+        if ($proto !== undefined) {
+          return $proto === 'HTTP' ? 'http' : 'socks'
+        }
+      }, {
+        'http': ($=>$
+          .demuxHTTP().to($=>$
+            .pipe(
+              function (evt) {
+                if (evt instanceof MessageStart) {
+                  return evt.head.method === 'CONNECT' ? 'tunnel' : 'forward'
+                }
+              }, {
+                'tunnel': ($=>$
+                  .acceptHTTPTunnel(
+                    function (req) {
+                      $ctx.originalTarget = req.head.path
+                      return new Message({ status: 200 })
+                    }
+                  ).to($=>$.pipeNext())
+                ),
+                'forward': ($=>$
+                  .handleMessageStart(
+                    function (req) {
+                      var url = new URL(req.head.path)
+                      $ctx.originalTarget = `${url.hostname}:${url.port}`
+                      req.head.path = url.path
+                    }
+                  )
+                  .pipeNext()
+                ),
+              }
+            )
+          )
+        ),
+        'socks': ($=>$
+          .acceptSOCKS(
+            function (req) {
+              $ctx.originalTarget = `${req.domain || req.ip}:${req.port}`
+              return true
+            }
+          ).to($=>$.pipeNext())
+        )
+      }
+    )
+  )
+}

charts/fsm/components/scripts/gateways/filters/tcp/TLSDelegate.js

@@ -0,0 +1,50 @@
+export default function ({ tlsDelegate }, resources) {
+  var ca = new crypto.Certificate(resources.secrets[tlsDelegate.certificate['ca.crt']])
+  var caKey = new crypto.PrivateKey(resources.secrets[tlsDelegate.certificate['ca.key']])
+  var key = new crypto.PrivateKey({ type: 'rsa', bits: 2048 })
+  var pkey = new crypto.PublicKey(key)
+
+  var cache = new algo.Cache(
+    domain => new crypto.Certificate({
+      subject: { CN: domain },
+      extensions: { subjectAltName: `DNS:${domain}` },
+      days: 365,
+      timeOffset: -3600,
+      issuer: ca,
+      privateKey: caKey,
+      publicKey: pkey,
+    }),
+    null, { ttl: 60*60 }
+  )
+
+  var $ctx
+  var $proto
+
+  return pipeline($=>$
+    .onStart(c => { $ctx = c })
+    .pipe(evt => evt instanceof MessageStart ? 'L7' : 'L4', {
+      'L7': ($=>$.pipeNext()),
+      'L4': ($=>$
+        .detectProtocol(p => { $proto = p })
+        .pipe(
+          () => {
+            if ($proto !== undefined) {
+              return ($proto === 'TLS' ? 'tls' : 'tcp')
+            }
+          }, {
+            'tcp': ($=>$.pipeNext()),
+            'tls': ($=>$
+              .acceptTLS({
+                certificate: s => {
+                  if (!s) return
+                  $ctx.originalServerName = s
+                  return { key, cert: cache.get(s) }
+                }
+              }).to($=>$.pipeNext())
+            )
+          }
+        )
+      )
+    })
+  )
+}