/** * DomainFront Relay + Full Tunnel — Google Apps Script * * FOUR modes: * 1. Single relay: POST { k, m, u, h, b, ct, r } → { s, h, b } * 2. Batch relay: POST { k, q: [{m,u,h,b,ct,r}, ...] } → { q: [{s,h,b}, ...] } * 3. Tunnel: POST { k, t, h, p, sid, d } → { sid, d, eof } * 4. Tunnel batch: POST { k, t:"batch", ops:[...] } → { r: [...] } * Batch ops include TCP (`connect`, `data`) and UDP (`udp_open`, * `udp_data`) tunnel-node operations. * * CHANGE THESE TO YOUR OWN VALUES! */ const AUTH_KEY = "CHANGE_ME_TO_A_STRONG_SECRET"; const TUNNEL_SERVER_URL = "https://YOUR_TUNNEL_NODE_URL"; const TUNNEL_AUTH_KEY = "YOUR_TUNNEL_AUTH_KEY"; // Active-probing defense. When false (production default), bad AUTH_KEY // requests get a decoy HTML page that looks like a placeholder Apps // Script web app instead of the JSON `{"e":"unauthorized"}` body. This // makes the deployment indistinguishable from a forgotten-but-public // Apps Script project to active scanners that POST malformed payloads // looking for proxy endpoints. // // Set to `true` during initial setup if a misconfigured client is // hitting "unauthorized" and you want the explicit JSON error to debug // — then flip back to false before the deployment is widely shared. // (Inspired by #365 Section 3, mhrv-rs v1.8.0+.) const DIAGNOSTIC_MODE = false; const SKIP_HEADERS = { host: 1, connection: 1, "content-length": 1, "transfer-encoding": 1, "proxy-connection": 1, "proxy-authorization": 1, "priority": 1, te: 1, }; // HTML body for the bad-auth decoy. Mimics a minimal Apps Script-style // placeholder page — no proxy-shaped JSON, nothing distinctive enough // for a probe to fingerprint as a tunnel endpoint. const DECOY_HTML = 'Web App' + '

The script completed but did not return anything.

' + ''; function _decoyOrError(jsonBody) { if (DIAGNOSTIC_MODE) return _json(jsonBody); return ContentService .createTextOutput(DECOY_HTML) .setMimeType(ContentService.MimeType.HTML); } // ========================== Entry point ========================== function doPost(e) { try { var req = JSON.parse(e.postData.contents); if (req.k !== AUTH_KEY) return _decoyOrError({ e: "unauthorized" }); // Tunnel mode if (req.t) return _doTunnel(req); // Batch relay mode if (Array.isArray(req.q)) return _doBatch(req.q); // Single relay mode return _doSingle(req); } catch (err) { // Parse failures of the request body are also probe-shaped — a real // mhrv-rs client never sends invalid JSON. Decoy for the same reason. return _decoyOrError({ e: String(err) }); } } // ========================== Tunnel mode ========================== function _doTunnel(req) { // Batch tunnel: { k, t:"batch", ops:[...] } if (req.t === "batch") { return _doTunnelBatch(req); } // Single tunnel op var payload = { k: TUNNEL_AUTH_KEY }; switch (req.t) { case "connect": payload.op = "connect"; payload.host = req.h; payload.port = req.p; break; case "connect_data": payload.op = "connect_data"; payload.host = req.h; payload.port = req.p; if (req.d) payload.data = req.d; break; case "data": payload.op = "data"; payload.sid = req.sid; if (req.d) payload.data = req.d; break; case "close": payload.op = "close"; payload.sid = req.sid; break; default: // Structured `code` lets the Rust client detect version skew // without substring-matching the error text. Must match // CODE_UNSUPPORTED_OP in tunnel_client.rs and tunnel-node/src/main.rs. return _json({ e: "unknown tunnel op: " + req.t, code: "UNSUPPORTED_OP" }); } var resp = UrlFetchApp.fetch(TUNNEL_SERVER_URL + "/tunnel", { method: "post", contentType: "application/json", payload: JSON.stringify(payload), muteHttpExceptions: true, followRedirects: true, }); if (resp.getResponseCode() !== 200) { return _json({ e: "tunnel node HTTP " + resp.getResponseCode() }); } return ContentService.createTextOutput(resp.getContentText()) .setMimeType(ContentService.MimeType.JSON); } // Batch tunnel: forward all ops in one request to /tunnel/batch function _doTunnelBatch(req) { var payload = { k: TUNNEL_AUTH_KEY, ops: req.ops || [], }; var resp = UrlFetchApp.fetch(TUNNEL_SERVER_URL + "/tunnel/batch", { method: "post", contentType: "application/json", payload: JSON.stringify(payload), muteHttpExceptions: true, followRedirects: true, }); if (resp.getResponseCode() !== 200) { return _json({ e: "tunnel batch HTTP " + resp.getResponseCode() }); } return ContentService.createTextOutput(resp.getContentText()) .setMimeType(ContentService.MimeType.JSON); } // ========================== HTTP relay mode ========================== function _doSingle(req) { if (!req.u || typeof req.u !== "string" || !req.u.match(/^https?:\/\//i)) { return _json({ e: "bad url" }); } var opts = _buildOpts(req); var resp = UrlFetchApp.fetch(req.u, opts); return _json({ s: resp.getResponseCode(), h: _respHeaders(resp), b: Utilities.base64Encode(resp.getContent()), }); } function _doBatch(items) { var fetchArgs = []; var errorMap = {}; for (var i = 0; i < items.length; i++) { var item = items[i]; if (!item.u || typeof item.u !== "string" || !item.u.match(/^https?:\/\//i)) { errorMap[i] = "bad url"; continue; } var opts = _buildOpts(item); opts.url = item.u; fetchArgs.push({ _i: i, _o: opts }); } var responses = []; if (fetchArgs.length > 0) { responses = UrlFetchApp.fetchAll(fetchArgs.map(function(x) { return x._o; })); } var results = []; var rIdx = 0; for (var i = 0; i < items.length; i++) { if (errorMap.hasOwnProperty(i)) { results.push({ e: errorMap[i] }); } else { var resp = responses[rIdx++]; results.push({ s: resp.getResponseCode(), h: _respHeaders(resp), b: Utilities.base64Encode(resp.getContent()), }); } } return _json({ q: results }); } // ========================== Helpers ========================== function _buildOpts(req) { var opts = { method: (req.m || "GET").toLowerCase(), muteHttpExceptions: true, followRedirects: req.r !== false, validateHttpsCertificates: true, escaping: false, }; if (req.h && typeof req.h === "object") { var headers = {}; for (var k in req.h) { if (req.h.hasOwnProperty(k) && !SKIP_HEADERS[k.toLowerCase()]) { headers[k] = req.h[k]; } } opts.headers = headers; } if (req.b) { opts.payload = Utilities.base64Decode(req.b); if (req.ct) opts.contentType = req.ct; } return opts; } function _respHeaders(resp) { try { if (typeof resp.getAllHeaders === "function") { return resp.getAllHeaders(); } } catch (err) {} return resp.getHeaders(); } function doGet(e) { return HtmlService.createHtmlOutput( "My App" + '' + "

Welcome

This application is running normally.

" + "" ); } function _json(obj) { return ContentService.createTextOutput(JSON.stringify(obj)).setMimeType( ContentService.MimeType.JSON ); }