cf_tunnel.js

'use strict';

const net = require('node:net');
const tls = require('node:tls');
const fs = require('node:fs');
const http2 = require('node:http2');
const dns = require('node:dns/promises');
const socketpair = require('unix-socketpair');
const capnp = require('../node-capnp');

const tunnelrpc = require('./tunnelrpc.capnp');

const CLIENT_ID = crypto.randomUUID();

(async () => {
  const [{ port, name }] = await dns.resolveSrv('_v2-origintunneld._tcp.argotunnel.com');
  const { address } = await dns.lookup(name);

  const quickTun = await fetch('https://api.trycloudflare.com/tunnel', {
    method: 'POST',
  }).then((r) => r.json());

  console.log(`https://${quickTun.result.hostname}`);

  const socket = tls.connect(port, address, {
    servername: 'h2.cftunnel.com',
    ca: fs.readFileSync('./cf_root.pem'),
    minVersion: 'TLSv1.3',
  }, () => {
    const session = http2.performServerHandshake(socket, { enableConnectProtocol: true });
    session.on('stream', async (stream, headers) => {
      if (headers['cf-cloudflared-proxy-connection-upgrade'] === 'control-stream') {
        handleControlStream(quickTun, stream, session);
      } else {
        stream.respond({
          'content-type': 'text/html; charset=utf-8',
          ':status': 200,
        });
        stream.end('<h1>Hello World</h1>');
      }
    });
  });
})();

async function handleControlStream(quickTun, stream, session) {
  const [fdA, fdB] = socketpair(1);

  const a = new net.Socket({ fd: fdA });
  a.pipe(stream);
  stream.pipe(a);

  const conn = capnp.connect({ capabilityStreamFd: fdB });
  const cap = conn.restore("registrationServer", tunnelrpc.RegistrationServer);

  await cap.registerConnection(
    {
      accountTag: quickTun.result.account_tag,
      tunnelSecret: Buffer.from(quickTun.result.secret, 'base64'),
    },
    Buffer.from(quickTun.result.id.replaceAll('-', ''), 'hex'),
    0,
    {
      client: {
        clientId: Buffer.from(CLIENT_ID.replaceAll('-', ''), 'hex'),
      },
    }
  );
}