├── README.md
├── index.js
└── LICENSE


/README.md:
--------------------------------------------------------------------------------
  1 | # Shadowfetch
  2 | 
  3 | [![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
  4 | 
  5 | > A privacy-focused alternative to Cloudflare Workers' built-in fetch, licensed under the GNU Affero General Public License (AGPL).
  6 | 
  7 | ## 📑 Table of Contents
  8 | - [Introduction](#introduction)
  9 | - [Why Shadowfetch?](#why-shadowfetch)
 10 |   - [About Cloudflare's Built-in fetch](#about-cloudflares-built-in-fetch)
 11 |   - [How Shadowfetch Protects Privacy](#how-shadowfetch-protects-privacy)
 12 | - [Installation & Usage](#installation--usage)
 13 | - [Architecture Overview](#architecture-overview)
 14 | - [Contributing](#contributing)
 15 | - [License](#license)
 16 | 
 17 | ---
 18 | 
 19 | <a id="introduction"></a>
 20 | ## 🌟 Introduction
 21 | 
 22 | Shadowfetch is an alternative to Cloudflare Workers' built-in `fetch`. It aims to maintain maximum control over request and response handling without leaking unnecessary user information. Since Cloudflare's built-in `fetch` may disclose details such as:
 23 | - User IP addresses
 24 | - Geolocation metadata (via CF-IPCountry)
 25 | - Other Worker-specific headers
 26 | 
 27 | …Shadowfetch acts as a privacy shield by stripping or selectively forwarding only the essential headers.
 28 | 
 29 | ---
 30 | 
 31 | <a id="why-shadowfetch"></a>
 32 | ## 🤔 Why Shadowfetch?
 33 | 
 34 | <a id="about-cloudflares-built-in-fetch"></a>
 35 | ### About Cloudflare's Built-in fetch
 36 | 
 37 | When you use Cloudflare Workers, any outbound request through the default `fetch` can carry additional headers like:
 38 | - `cf-ipcountry`: Provides the user's country information.
 39 | - Various `cf-*` metadata: Used internally by Cloudflare for routing and analytics.
 40 | 
 41 | For many privacy-conscious scenarios—especially in user-centric applications—this can be problematic since end-users may not be aware that their location or IP-based data could be revealed.
 42 | 
 43 | <a id="how-shadowfetch-protects-privacy"></a>
 44 | ### How Shadowfetch Protects Privacy
 45 | 
 46 | Shadowfetch works by:
 47 | 1. Removing or masking all sensitive headers that Cloudflare automatically appends (e.g., `cf-ipcountry`, `cf-connecting-ip`).
 48 | 2. Directly handling the request via raw TCP sockets (Cloudflare Workers allow experimental support for raw socket connections), bypassing most default Worker-level request enhancements.
 49 | 3. Guaranteeing a minimal footprint—relaying only the essential information explicitly allowed to be shared with the target server.
 50 | 
 51 | By doing so, it reduces potential data leaks and offers a more transparent, privacy-oriented approach to proxying or forwarding requests.
 52 | 
 53 | ---
 54 | 
 55 | <a id="installation--usage"></a>
 56 | ## 📦 Installation & Usage
 57 | 
 58 | 1. **Clone or download** this repository.
 59 | 2. **Add or replace** your existing Worker's code with Shadowfetch's main script.
 60 | 3. **Configure** your personal settings (like `AUTH_TOKEN`, `DEFAULT_DST_URL`, etc.) in the code:
 61 |    ```js
 62 |    const CONFIG = {
 63 |      AUTH_TOKEN: "image",             // Example usage
 64 |      DEFAULT_DST_URL: "https://...",  
 65 |      DEBUG_MODE: false,
 66 |    };
 67 |    ```
 68 | 4. **Deploy** your Worker to Cloudflare via Wrangler or the Cloudflare dashboard.
 69 | 
 70 | When your Worker receives HTTP or WebSocket requests under the specific path pattern (e.g., `/image/https/...`), Shadowfetch will route them through a raw socket-based approach—thus mitigating metadata exposure.
 71 | 
 72 | ---
 73 | 
 74 | <a id="architecture-overview"></a>
 75 | ## 🏗️ Architecture Overview
 76 | 
 77 | ```mermaid
 78 | graph TD
 79 |     A[Client Request] --> B[Cloudflare Worker]
 80 |     subgraph Worker Environment
 81 |         B --> C[Shadowfetch Handler]
 82 |         C --> D[Header Sanitization]
 83 |         D --> E[Raw Socket Connection]
 84 |     end
 85 |     E --> F[Destination Server]
 86 |     
 87 |     style A fill:#f9f,stroke:#333,stroke-width:2px
 88 |     style B fill:#bbf,stroke:#333,stroke-width:2px
 89 |     style C fill:#dfd,stroke:#333,stroke-width:2px
 90 |     style D fill:#dfd,stroke:#333,stroke-width:2px
 91 |     style E fill:#dfd,stroke:#333,stroke-width:2px
 92 |     style F fill:#f9f,stroke:#333,stroke-width:2px
 93 | ```
 94 | 
 95 | **Key Components:**
 96 | 1. 🔄 **Request Interception:** The client's request is intercepted by your Cloudflare Worker.
 97 | 2. 🧹 **Header Processing:** Shadowfetch strips sensitive headers and metadata.
 98 | 3. 🔌 **Raw Socket Connection:** Direct TCP connection bypasses Cloudflare's built-in header injections.
 99 | 4. 📨 **Clean Delivery:** The target server receives only essential, privacy-respecting data.
100 | 
101 | ---
102 | 
103 | <a id="contributing"></a>
104 | ## 👥 Contributing
105 | 
106 | Contributions are welcome! Please fork the repository, create a new branch, and open a pull request with your changes or improvements.
107 | 
108 | Some ways to contribute:
109 | - 💡 Suggesting new features.
110 | - 🐛 Reporting bugs.
111 | - 📝 Writing documentation and examples.
112 | 
113 | ---
114 | 
115 | <a id="license"></a>
116 | ## ⚖️ License
117 | 
118 | Shadowfetch is licensed under the [GNU Affero General Public License](https://www.gnu.org/licenses/agpl-3.0.html) (AGPL).  
119 | You are free to use, distribute, and modify the project under the terms of the AGPL.
120 | 


--------------------------------------------------------------------------------
/index.js:
--------------------------------------------------------------------------------
  1 | import { connect } from "cloudflare:sockets";
  2 | 
  3 | // Global configuration including the authentication token, default destination URL, and debug mode flag
  4 | const CONFIG = {
  5 |   AUTH_TOKEN: "image",
  6 |   DEFAULT_DST_URL: "https://example.com/",
  7 |   DEBUG_MODE: false,
  8 | };
  9 | 
 10 | // Update global configuration from environment variables (prioritizing environment values)
 11 | function updateConfigFromEnv(env) {
 12 |   if (!env) return;
 13 |   for (const key of Object.keys(CONFIG)) {
 14 |     if (key in env) {
 15 |       if (typeof CONFIG[key] === 'boolean') {
 16 |         CONFIG[key] = env[key] === 'true';
 17 |       } else {
 18 |         CONFIG[key] = env[key];
 19 |       }
 20 |     }
 21 |   }
 22 | }
 23 | 
 24 | // Define text encoder and decoder for converting between strings and byte arrays
 25 | const encoder = new TextEncoder();
 26 | const decoder = new TextDecoder();
 27 | 
 28 | // Filter out HTTP headers that should not be forwarded (ignore headers: host, accept-encoding, cf-*)
 29 | const HEADER_FILTER_RE = /^(host|accept-encoding|cf-)/i;
 30 | 
 31 | // Define the debug log output function based on the debug mode setting
 32 | const log = CONFIG.DEBUG_MODE
 33 |   ? (message, data = "") => console.log(`[DEBUG] ${message}`, data)
 34 |   : () => {};
 35 | 
 36 | // Concatenate multiple Uint8Arrays into a single new Uint8Array
 37 | function concatUint8Arrays(...arrays) {
 38 |   const total = arrays.reduce((sum, arr) => sum + arr.length, 0);
 39 |   const result = new Uint8Array(total);
 40 |   let offset = 0;
 41 |   for (const arr of arrays) {
 42 |     result.set(arr, offset);
 43 |     offset += arr.length;
 44 |   }
 45 |   return result;
 46 | }
 47 | 
 48 | // Parse HTTP response headers, returning the status code, status text, headers, and the header section's end position
 49 | function parseHttpHeaders(buff) {
 50 |   const text = decoder.decode(buff);
 51 |   // Look for the end of HTTP headers indicated by "\r\n\r\n"
 52 |   const headerEnd = text.indexOf("\r\n\r\n");
 53 |   if (headerEnd === -1) return null;
 54 |   const headerSection = text.slice(0, headerEnd).split("\r\n");
 55 |   const statusLine = headerSection[0];
 56 |   // Match the HTTP status line, e.g., "HTTP/1.1 200 OK"
 57 |   const statusMatch = statusLine.match(/HTTP\/1\.[01] (\d+) (.*)/);
 58 |   if (!statusMatch) throw new Error(`Invalid status line: ${statusLine}`);
 59 |   const headers = new Headers();
 60 |   // Parse the response headers
 61 |   for (let i = 1; i < headerSection.length; i++) {
 62 |     const line = headerSection[i];
 63 |     const idx = line.indexOf(": ");
 64 |     if (idx !== -1) {
 65 |       headers.append(line.slice(0, idx), line.slice(idx + 2));
 66 |     }
 67 |   }
 68 |   return { status: Number(statusMatch[1]), statusText: statusMatch[2], headers, headerEnd };
 69 | }
 70 | 
 71 | // Read data from the reader until a double CRLF (indicating the end of HTTP headers) is encountered
 72 | async function readUntilDoubleCRLF(reader) {
 73 |   let respText = "";
 74 |   while (true) {
 75 |     const { value, done } = await reader.read();
 76 |     if (value) {
 77 |       respText += decoder.decode(value, { stream: true });
 78 |       if (respText.includes("\r\n\r\n")) break;
 79 |     }
 80 |     if (done) break;
 81 |   }
 82 |   return respText;
 83 | }
 84 | 
 85 | // Async generator: read chunked HTTP response data chunks and yield each chunk sequentially
 86 | async function* readChunks(reader, buff = new Uint8Array()) {
 87 |   while (true) {
 88 |     // Look for the position of the CRLF separator in the existing buffer
 89 |     let pos = -1;
 90 |     for (let i = 0; i < buff.length - 1; i++) {
 91 |       if (buff[i] === 13 && buff[i + 1] === 10) {
 92 |         pos = i;
 93 |         break;
 94 |       }
 95 |     }
 96 |     // If not found, continue reading more data to fill the buffer
 97 |     if (pos === -1) {
 98 |       const { value, done } = await reader.read();
 99 |       if (done) break;
100 |       buff = concatUint8Arrays(buff, value);
101 |       continue;
102 |     }
103 |     // Parse the chunk size (in hexadecimal format)
104 |     const size = parseInt(decoder.decode(buff.slice(0, pos)), 16);
105 |     log("Read chunk size", size);
106 |     // A size of 0 indicates the end of chunks
107 |     if (!size) break;
108 |     // Remove the parsed size part and the following CRLF from the buffer
109 |     buff = buff.slice(pos + 2);
110 |     // Ensure the buffer contains the complete chunk (including the trailing CRLF)
111 |     while (buff.length < size + 2) {
112 |       const { value, done } = await reader.read();
113 |       if (done) throw new Error("Unexpected EOF in chunked encoding");
114 |       buff = concatUint8Arrays(buff, value);
115 |     }
116 |     // Yield the chunk data (excluding the trailing CRLF)
117 |     yield buff.slice(0, size);
118 |     buff = buff.slice(size + 2);
119 |   }
120 | }
121 | 
122 | // Parse the complete HTTP response, handling the response body data based on transfer mode (chunked or fixed-length)
123 | async function parseResponse(reader) {
124 |   let buff = new Uint8Array();
125 |   while (true) {
126 |     const { value, done } = await reader.read();
127 |     if (value) {
128 |       buff = concatUint8Arrays(buff, value);
129 |       const parsed = parseHttpHeaders(buff);
130 |       if (parsed) {
131 |         const { status, statusText, headers, headerEnd } = parsed;
132 |         const isChunked = headers.get("transfer-encoding")?.includes("chunked");
133 |         const contentLength = parseInt(headers.get("content-length") || "0", 10);
134 |         const data = buff.slice(headerEnd + 4);
135 |         // Distribute the response body data via a ReadableStream
136 |         return new Response(
137 |           new ReadableStream({
138 |             async start(ctrl) {
139 |               try {
140 |                 if (isChunked) {
141 |                   log("Using chunked transfer mode");
142 |                   // Chunked transfer mode: read and enqueue each chunk sequentially
143 |                   for await (const chunk of readChunks(reader, data)) {
144 |                     ctrl.enqueue(chunk);
145 |                   }
146 |                 } else {
147 |                   log("Using fixed-length transfer mode", { contentLength });
148 |                   let received = data.length;
149 |                   if (data.length) ctrl.enqueue(data);
150 |                   // Fixed-length mode: read the specified number of bytes based on content-length
151 |                   while (received < contentLength) {
152 |                     const { value, done } = await reader.read();
153 |                     if (done) break;
154 |                     received += value.length;
155 |                     ctrl.enqueue(value);
156 |                   }
157 |                 }
158 |                 ctrl.close();
159 |               } catch (err) {
160 |                 log("Error parsing response", err);
161 |                 ctrl.error(err);
162 |               }
163 |             },
164 |           }),
165 |           { status, statusText, headers }
166 |         );
167 |       }
168 |     }
169 |     if (done) break;
170 |   }
171 |   throw new Error("Unable to parse response headers");
172 | }
173 | 
174 | // Generate a random Sec-WebSocket-Key required for the WebSocket handshake
175 | function generateWebSocketKey() {
176 |   const bytes = new Uint8Array(16);
177 |   crypto.getRandomValues(bytes);
178 |   return btoa(String.fromCharCode(...bytes));
179 | }
180 | 
181 | // Pack a text message into a WebSocket frame (currently supports only text frames with payloads not too large)
182 | function packTextFrame(payload) {
183 |   const FIN_AND_OP = 0x81; // FIN flag and text frame opcode
184 |   const maskBit = 0x80; // Mask bit (must be set to 1 for client-sent messages)
185 |   const len = payload.length;
186 |   let header;
187 |   if (len < 126) {
188 |     header = new Uint8Array(2);
189 |     header[0] = FIN_AND_OP;
190 |     header[1] = maskBit | len;
191 |   } else if (len < 65536) {
192 |     header = new Uint8Array(4);
193 |     header[0] = FIN_AND_OP;
194 |     header[1] = maskBit | 126;
195 |     header[2] = (len >> 8) & 0xff;
196 |     header[3] = len & 0xff;
197 |   } else {
198 |     throw new Error("Payload too large");
199 |   }
200 |   // Generate a 4-byte random mask
201 |   const mask = new Uint8Array(4);
202 |   crypto.getRandomValues(mask);
203 |   const maskedPayload = new Uint8Array(len);
204 |   // Apply the mask to the payload
205 |   for (let i = 0; i < len; i++) {
206 |     maskedPayload[i] = payload[i] ^ mask[i % 4];
207 |   }
208 |   // Concatenate the frame header, mask, and masked payload
209 |   return concatUint8Arrays(header, mask, maskedPayload);
210 | }
211 | 
212 | // Class for parsing and reassembling WebSocket frames, supporting fragmented messages
213 | class SocketFramesReader {
214 |   constructor(reader) {
215 |     this.reader = reader;
216 |     this.buffer = new Uint8Array();
217 |     this.fragmentedPayload = null;
218 |     this.fragmentedOpcode = null;
219 |   }
220 |   // Ensure that the buffer has enough bytes for parsing
221 |   async ensureBuffer(length) {
222 |     while (this.buffer.length < length) {
223 |       const { value, done } = await this.reader.read();
224 |       if (done) return false;
225 |       this.buffer = concatUint8Arrays(this.buffer, value);
226 |     }
227 |     return true;
228 |   }
229 |   // Parse the next WebSocket frame and handle fragmentation (opcode 0 indicates continuation)
230 |   async nextFrame() {
231 |     while (true) {
232 |       if (!(await this.ensureBuffer(2))) return null;
233 |       const first = this.buffer[0],
234 |         second = this.buffer[1],
235 |         fin = (first >> 7) & 1,
236 |         opcode = first & 0x0f,
237 |         isMasked = (second >> 7) & 1;
238 |       let payloadLen = second & 0x7f,
239 |         offset = 2;
240 |       // If payload length is 126, parse the next two bytes for the actual length
241 |       if (payloadLen === 126) {
242 |         if (!(await this.ensureBuffer(offset + 2))) return null;
243 |         payloadLen = (this.buffer[offset] << 8) | this.buffer[offset + 1];
244 |         offset += 2;
245 |       } else if (payloadLen === 127) {
246 |         throw new Error("127 length mode is not supported");
247 |       }
248 |       let mask;
249 |       if (isMasked) {
250 |         if (!(await this.ensureBuffer(offset + 4))) return null;
251 |         mask = this.buffer.slice(offset, offset + 4);
252 |         offset += 4;
253 |       }
254 |       if (!(await this.ensureBuffer(offset + payloadLen))) return null;
255 |       let payload = this.buffer.slice(offset, offset + payloadLen);
256 |       if (isMasked && mask) {
257 |         for (let i = 0; i < payload.length; i++) {
258 |           payload[i] ^= mask[i % 4];
259 |         }
260 |       }
261 |       // Remove the processed bytes from the buffer
262 |       this.buffer = this.buffer.slice(offset + payloadLen);
263 |       // Opcode 0 indicates a continuation frame: concatenate the fragmented data
264 |       if (opcode === 0) {
265 |         if (this.fragmentedPayload === null)
266 |           throw new Error("Received continuation frame without initiation");
267 |         this.fragmentedPayload = concatUint8Arrays(this.fragmentedPayload, payload);
268 |         if (fin) {
269 |           const completePayload = this.fragmentedPayload;
270 |           const completeOpcode = this.fragmentedOpcode;
271 |           this.fragmentedPayload = this.fragmentedOpcode = null;
272 |           return { fin: true, opcode: completeOpcode, payload: completePayload };
273 |         }
274 |       } else {
275 |         // If there is fragmented data but the current frame is not a continuation, reset the fragmentation state
276 |         if (!fin) {
277 |           this.fragmentedPayload = payload;
278 |           this.fragmentedOpcode = opcode;
279 |           continue;
280 |         } else {
281 |           if (this.fragmentedPayload) {
282 |             this.fragmentedPayload = this.fragmentedOpcode = null;
283 |           }
284 |           return { fin, opcode, payload };
285 |         }
286 |       }
287 |     }
288 |   }
289 | }
290 | 
291 | // Forward HTTP requests or WebSocket handshake and data based on the request type
292 | async function nativeFetch(req, dstUrl) {
293 |   // Clean up the headers by removing those that match the filter criteria
294 |   const cleanedHeaders = new Headers();
295 |   for (const [k, v] of req.headers) {
296 |     if (!HEADER_FILTER_RE.test(k)) {
297 |       cleanedHeaders.set(k, v);
298 |     }
299 |   }
300 |   
301 |   // Check if the request is a WebSocket request
302 |   const upgradeHeader = req.headers.get("Upgrade")?.toLowerCase();
303 |   const isWebSocket = upgradeHeader === "websocket";
304 |   const targetUrl = new URL(dstUrl);
305 |   
306 |   if (isWebSocket) {
307 |     // If the target URL does not support the WebSocket protocol, return an error response
308 |     if (!/^wss?:\/\//i.test(dstUrl)) {
309 |       return new Response("Target does not support WebSocket", { status: 400 });
310 |     }
311 |     const isSecure = targetUrl.protocol === "wss:";
312 |     const port = targetUrl.port || (isSecure ? 443 : 80);
313 |     // Establish a raw socket connection to the target server
314 |     const socket = await connect(
315 |       { hostname: targetUrl.hostname, port: Number(port) },
316 |       { secureTransport: isSecure ? "on" : "off" }
317 |     );
318 |   
319 |     // Generate the key required for the WebSocket handshake
320 |     const key = generateWebSocketKey();
321 | 
322 |     // Construct the HTTP headers required for the handshake
323 |     cleanedHeaders.set('Host', targetUrl.hostname);
324 |     cleanedHeaders.set('Connection', 'Upgrade');
325 |     cleanedHeaders.set('Upgrade', 'websocket');
326 |     cleanedHeaders.set('Sec-WebSocket-Version', '13');
327 |     cleanedHeaders.set('Sec-WebSocket-Key', key);
328 |   
329 |     // Assemble the HTTP request data for the WebSocket handshake
330 |     const handshakeReq =
331 |       `GET ${targetUrl.pathname}${targetUrl.search} HTTP/1.1\r\n` +
332 |       Array.from(cleanedHeaders.entries())
333 |         .map(([k, v]) => `${k}: ${v}`)
334 |         .join('\r\n') +
335 |       '\r\n\r\n';
336 | 
337 |     log("Sending WebSocket handshake request", handshakeReq);
338 |     const writer = socket.writable.getWriter();
339 |     await writer.write(encoder.encode(handshakeReq));
340 |   
341 |     const reader = socket.readable.getReader();
342 |     const handshakeResp = await readUntilDoubleCRLF(reader);
343 |     log("Received handshake response", handshakeResp);
344 |     // Verify that the handshake response indicates a 101 Switching Protocols status
345 |     if (
346 |       !handshakeResp.includes("101") ||
347 |       !handshakeResp.includes("Switching Protocols")
348 |     ) {
349 |       throw new Error("WebSocket handshake failed: " + handshakeResp);
350 |     }
351 |   
352 |     // Create an internal WebSocketPair
353 |     const [client, server] = new WebSocketPair();
354 |     client.accept();
355 |     // Establish bidirectional frame relaying between the client and the remote socket
356 |     relayWebSocketFrames(client, socket, writer, reader);
357 |     return new Response(null, { status: 101, webSocket: server });
358 |   } else {
359 |     // For standard HTTP requests: set required headers (such as Host and disable compression)
360 |     cleanedHeaders.set("Host", targetUrl.hostname);
361 |     cleanedHeaders.set("accept-encoding", "identity");
362 |   
363 |     const port = targetUrl.protocol === "https:" ? 443 : 80;
364 |     const socket = await connect(
365 |       { hostname: targetUrl.hostname, port },
366 |       { secureTransport: targetUrl.protocol === "https:" ? "on" : "off" }
367 |     );
368 |     const writer = socket.writable.getWriter();
369 |     // Construct the request line and headers
370 |     const requestLine =
371 |       `${req.method} ${targetUrl.pathname}${targetUrl.search} HTTP/1.1\r\n` +
372 |       Array.from(cleanedHeaders.entries())
373 |         .map(([k, v]) => `${k}: ${v}`)
374 |         .join("\r\n") +
375 |       "\r\n\r\n";
376 |     log("Sending request", requestLine);
377 |     await writer.write(encoder.encode(requestLine));
378 |   
379 |     // If there is a request body, forward it to the target server
380 |     if (req.body) {
381 |       log("Forwarding request body");
382 |       for await (const chunk of req.body) {
383 |         await writer.write(chunk);
384 |       }
385 |     }
386 |     // Parse and return the target server's response
387 |     return await parseResponse(socket.readable.getReader());
388 |   }
389 | }
390 | 
391 | // Relay WebSocket frames bidirectionally between the client and the remote socket
392 | function relayWebSocketFrames(ws, socket, writer, reader) {
393 |   // Listen for messages from the client, package them into frames, and send them to the remote socket
394 |   ws.addEventListener("message", async (event) => {
395 |     let payload;
396 |     if (typeof event.data === "string") {
397 |       payload = encoder.encode(event.data);
398 |     } else if (event.data instanceof ArrayBuffer) {
399 |       payload = new Uint8Array(event.data);
400 |     } else {
401 |       payload = event.data;
402 |     }
403 |     const frame = packTextFrame(payload);
404 |     try {
405 |       await writer.write(frame);
406 |     } catch (e) {
407 |       log("Remote write error", e);
408 |     }
409 |   });
410 |   
411 |   // Asynchronously relay WebSocket frames received from the remote to the client
412 |   (async function relayFrames() {
413 |     const frameReader = new SocketFramesReader(reader);
414 |     try {
415 |       while (true) {
416 |         const frame = await frameReader.nextFrame();
417 |         if (!frame) break;
418 |         // Process the data frame based on its opcode
419 |         switch (frame.opcode) {
420 |           case 1: // Text frame
421 |           case 2: // Binary frame
422 |             ws.send(frame.payload);
423 |             break;
424 |           case 8: // Close frame
425 |             log("Received Close frame, closing WebSocket");
426 |             ws.close(1000);
427 |             return;
428 |           default:
429 |             log(`Received unknown frame type, Opcode: ${frame.opcode}`);
430 |         }
431 |       }
432 |     } catch (e) {
433 |       log("Error reading remote frame", e);
434 |     } finally {
435 |       ws.close();
436 |       writer.releaseLock();
437 |       socket.close();
438 |     }
439 |   })();
440 |   
441 |   // When the client WebSocket closes, also close the remote socket connection
442 |   ws.addEventListener("close", () => socket.close());
443 | }
444 | 
445 | // Entry point for handling requests: update configuration, parse target URL, and forward the request
446 | async function handleRequest(req, env) {
447 |   updateConfigFromEnv(env);
448 |   CONFIG.DEBUG_MODE = CONFIG.DEBUG_MODE;
449 |   const url = new URL(req.url);
450 |   const parts = url.pathname.split("/").filter(Boolean);
451 |   const [auth, protocol, ...path] = parts;
452 |   // Check whether the auth parameter matches the configured auth token
453 |   const isValid = auth === CONFIG.AUTH_TOKEN;
454 |   // If it matches, construct the target URL; otherwise, use the default target
455 |   const dstUrl =
456 |     isValid && protocol
457 |       ? `${protocol}//${path.join("/")}${url.search}`
458 |       : CONFIG.DEFAULT_DST_URL;
459 |   log("Target URL", dstUrl);
460 |   
461 |   return await nativeFetch(req, dstUrl);
462 | }
463 | 
464 | // Export the fetch event handler for Cloudflare Workers and related environments
465 | export default { fetch: handleRequest };
466 | export const onRequest = (ctx) => handleRequest(ctx.request, ctx.env);
467 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU AFFERO GENERAL PUBLIC LICENSE
  2 |                        Version 3, 19 November 2007
  3 | 
  4 |  Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  5 |  Everyone is permitted to copy and distribute verbatim copies
  6 |  of this license document, but changing it is not allowed.
  7 | 
  8 |                             Preamble
  9 | 
 10 |   The GNU Affero General Public License is a free, copyleft license for
 11 | software and other kinds of works, specifically designed to ensure
 12 | cooperation with the community in the case of network server software.
 13 | 
 14 |   The licenses for most software and other practical works are designed
 15 | to take away your freedom to share and change the works.  By contrast,
 16 | our General Public Licenses are intended to guarantee your freedom to
 17 | share and change all versions of a program--to make sure it remains free
 18 | software for all its users.
 19 | 
 20 |   When we speak of free software, we are referring to freedom, not
 21 | price.  Our General Public Licenses are designed to make sure that you
 22 | have the freedom to distribute copies of free software (and charge for
 23 | them if you wish), that you receive source code or can get it if you
 24 | want it, that you can change the software or use pieces of it in new
 25 | free programs, and that you know you can do these things.
 26 | 
 27 |   Developers that use our General Public Licenses protect your rights
 28 | with two steps: (1) assert copyright on the software, and (2) offer
 29 | you this License which gives you legal permission to copy, distribute
 30 | and/or modify the software.
 31 | 
 32 |   A secondary benefit of defending all users' freedom is that
 33 | improvements made in alternate versions of the program, if they
 34 | receive widespread use, become available for other developers to
 35 | incorporate.  Many developers of free software are heartened and
 36 | encouraged by the resulting cooperation.  However, in the case of
 37 | software used on network servers, this result may fail to come about.
 38 | The GNU General Public License permits making a modified version and
 39 | letting the public access it on a server without ever releasing its
 40 | source code to the public.
 41 | 
 42 |   The GNU Affero General Public License is designed specifically to
 43 | ensure that, in such cases, the modified source code becomes available
 44 | to the community.  It requires the operator of a network server to
 45 | provide the source code of the modified version running there to the
 46 | users of that server.  Therefore, public use of a modified version, on
 47 | a publicly accessible server, gives the public access to the source
 48 | code of the modified version.
 49 | 
 50 |   An older license, called the Affero General Public License and
 51 | published by Affero, was designed to accomplish similar goals.  This is
 52 | a different license, not a version of the Affero GPL, but Affero has
 53 | released a new version of the Affero GPL which permits relicensing under
 54 | this license.
 55 | 
 56 |   The precise terms and conditions for copying, distribution and
 57 | modification follow.
 58 | 
 59 |                        TERMS AND CONDITIONS
 60 | 
 61 |   0. Definitions.
 62 | 
 63 |   "This License" refers to version 3 of the GNU Affero General Public License.
 64 | 
 65 |   "Copyright" also means copyright-like laws that apply to other kinds of
 66 | works, such as semiconductor masks.
 67 | 
 68 |   "The Program" refers to any copyrightable work licensed under this
 69 | License.  Each licensee is addressed as "you".  "Licensees" and
 70 | "recipients" may be individuals or organizations.
 71 | 
 72 |   To "modify" a work means to copy from or adapt all or part of the work
 73 | in a fashion requiring copyright permission, other than the making of an
 74 | exact copy.  The resulting work is called a "modified version" of the
 75 | earlier work or a work "based on" the earlier work.
 76 | 
 77 |   A "covered work" means either the unmodified Program or a work based
 78 | on the Program.
 79 | 
 80 |   To "propagate" a work means to do anything with it that, without
 81 | permission, would make you directly or secondarily liable for
 82 | infringement under applicable copyright law, except executing it on a
 83 | computer or modifying a private copy.  Propagation includes copying,
 84 | distribution (with or without modification), making available to the
 85 | public, and in some countries other activities as well.
 86 | 
 87 |   To "convey" a work means any kind of propagation that enables other
 88 | parties to make or receive copies.  Mere interaction with a user through
 89 | a computer network, with no transfer of a copy, is not conveying.
 90 | 
 91 |   An interactive user interface displays "Appropriate Legal Notices"
 92 | to the extent that it includes a convenient and prominently visible
 93 | feature that (1) displays an appropriate copyright notice, and (2)
 94 | tells the user that there is no warranty for the work (except to the
 95 | extent that warranties are provided), that licensees may convey the
 96 | work under this License, and how to view a copy of this License.  If
 97 | the interface presents a list of user commands or options, such as a
 98 | menu, a prominent item in the list meets this criterion.
 99 | 
100 |   1. Source Code.
101 | 
102 |   The "source code" for a work means the preferred form of the work
103 | for making modifications to it.  "Object code" means any non-source
104 | form of a work.
105 | 
106 |   A "Standard Interface" means an interface that either is an official
107 | standard defined by a recognized standards body, or, in the case of
108 | interfaces specified for a particular programming language, one that
109 | is widely used among developers working in that language.
110 | 
111 |   The "System Libraries" of an executable work include anything, other
112 | than the work as a whole, that (a) is included in the normal form of
113 | packaging a Major Component, but which is not part of that Major
114 | Component, and (b) serves only to enable use of the work with that
115 | Major Component, or to implement a Standard Interface for which an
116 | implementation is available to the public in source code form.  A
117 | "Major Component", in this context, means a major essential component
118 | (kernel, window system, and so on) of the specific operating system
119 | (if any) on which the executable work runs, or a compiler used to
120 | produce the work, or an object code interpreter used to run it.
121 | 
122 |   The "Corresponding Source" for a work in object code form means all
123 | the source code needed to generate, install, and (for an executable
124 | work) run the object code and to modify the work, including scripts to
125 | control those activities.  However, it does not include the work's
126 | System Libraries, or general-purpose tools or generally available free
127 | programs which are used unmodified in performing those activities but
128 | which are not part of the work.  For example, Corresponding Source
129 | includes interface definition files associated with source files for
130 | the work, and the source code for shared libraries and dynamically
131 | linked subprograms that the work is specifically designed to require,
132 | such as by intimate data communication or control flow between those
133 | subprograms and other parts of the work.
134 | 
135 |   The Corresponding Source need not include anything that users
136 | can regenerate automatically from other parts of the Corresponding
137 | Source.
138 | 
139 |   The Corresponding Source for a work in source code form is that
140 | same work.
141 | 
142 |   2. Basic Permissions.
143 | 
144 |   All rights granted under this License are granted for the term of
145 | copyright on the Program, and are irrevocable provided the stated
146 | conditions are met.  This License explicitly affirms your unlimited
147 | permission to run the unmodified Program.  The output from running a
148 | covered work is covered by this License only if the output, given its
149 | content, constitutes a covered work.  This License acknowledges your
150 | rights of fair use or other equivalent, as provided by copyright law.
151 | 
152 |   You may make, run and propagate covered works that you do not
153 | convey, without conditions so long as your license otherwise remains
154 | in force.  You may convey covered works to others for the sole purpose
155 | of having them make modifications exclusively for you, or provide you
156 | with facilities for running those works, provided that you comply with
157 | the terms of this License in conveying all material for which you do
158 | not control copyright.  Those thus making or running the covered works
159 | for you must do so exclusively on your behalf, under your direction
160 | and control, on terms that prohibit them from making any copies of
161 | your copyrighted material outside their relationship with you.
162 | 
163 |   Conveying under any other circumstances is permitted solely under
164 | the conditions stated below.  Sublicensing is not allowed; section 10
165 | makes it unnecessary.
166 | 
167 |   3. Protecting Users' Legal Rights From Anti-Circumvention Law.
168 | 
169 |   No covered work shall be deemed part of an effective technological
170 | measure under any applicable law fulfilling obligations under article
171 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or
172 | similar laws prohibiting or restricting circumvention of such
173 | measures.
174 | 
175 |   When you convey a covered work, you waive any legal power to forbid
176 | circumvention of technological measures to the extent such circumvention
177 | is effected by exercising rights under this License with respect to
178 | the covered work, and you disclaim any intention to limit operation or
179 | modification of the work as a means of enforcing, against the work's
180 | users, your or third parties' legal rights to forbid circumvention of
181 | technological measures.
182 | 
183 |   4. Conveying Verbatim Copies.
184 | 
185 |   You may convey verbatim copies of the Program's source code as you
186 | receive it, in any medium, provided that you conspicuously and
187 | appropriately publish on each copy an appropriate copyright notice;
188 | keep intact all notices stating that this License and any
189 | non-permissive terms added in accord with section 7 apply to the code;
190 | keep intact all notices of the absence of any warranty; and give all
191 | recipients a copy of this License along with the Program.
192 | 
193 |   You may charge any price or no price for each copy that you convey,
194 | and you may offer support or warranty protection for a fee.
195 | 
196 |   5. Conveying Modified Source Versions.
197 | 
198 |   You may convey a work based on the Program, or the modifications to
199 | produce it from the Program, in the form of source code under the
200 | terms of section 4, provided that you also meet all of these conditions:
201 | 
202 |     a) The work must carry prominent notices stating that you modified
203 |     it, and giving a relevant date.
204 | 
205 |     b) The work must carry prominent notices stating that it is
206 |     released under this License and any conditions added under section
207 |     7.  This requirement modifies the requirement in section 4 to
208 |     "keep intact all notices".
209 | 
210 |     c) You must license the entire work, as a whole, under this
211 |     License to anyone who comes into possession of a copy.  This
212 |     License will therefore apply, along with any applicable section 7
213 |     additional terms, to the whole of the work, and all its parts,
214 |     regardless of how they are packaged.  This License gives no
215 |     permission to license the work in any other way, but it does not
216 |     invalidate such permission if you have separately received it.
217 | 
218 |     d) If the work has interactive user interfaces, each must display
219 |     Appropriate Legal Notices; however, if the Program has interactive
220 |     interfaces that do not display Appropriate Legal Notices, your
221 |     work need not make them do so.
222 | 
223 |   A compilation of a covered work with other separate and independent
224 | works, which are not by their nature extensions of the covered work,
225 | and which are not combined with it such as to form a larger program,
226 | in or on a volume of a storage or distribution medium, is called an
227 | "aggregate" if the compilation and its resulting copyright are not
228 | used to limit the access or legal rights of the compilation's users
229 | beyond what the individual works permit.  Inclusion of a covered work
230 | in an aggregate does not cause this License to apply to the other
231 | parts of the aggregate.
232 | 
233 |   6. Conveying Non-Source Forms.
234 | 
235 |   You may convey a covered work in object code form under the terms
236 | of sections 4 and 5, provided that you also convey the
237 | machine-readable Corresponding Source under the terms of this License,
238 | in one of these ways:
239 | 
240 |     a) Convey the object code in, or embodied in, a physical product
241 |     (including a physical distribution medium), accompanied by the
242 |     Corresponding Source fixed on a durable physical medium
243 |     customarily used for software interchange.
244 | 
245 |     b) Convey the object code in, or embodied in, a physical product
246 |     (including a physical distribution medium), accompanied by a
247 |     written offer, valid for at least three years and valid for as
248 |     long as you offer spare parts or customer support for that product
249 |     model, to give anyone who possesses the object code either (1) a
250 |     copy of the Corresponding Source for all the software in the
251 |     product that is covered by this License, on a durable physical
252 |     medium customarily used for software interchange, for a price no
253 |     more than your reasonable cost of physically performing this
254 |     conveying of source, or (2) access to copy the
255 |     Corresponding Source from a network server at no charge.
256 | 
257 |     c) Convey individual copies of the object code with a copy of the
258 |     written offer to provide the Corresponding Source.  This
259 |     alternative is allowed only occasionally and noncommercially, and
260 |     only if you received the object code with such an offer, in accord
261 |     with subsection 6b.
262 | 
263 |     d) Convey the object code by offering access from a designated
264 |     place (gratis or for a charge), and offer equivalent access to the
265 |     Corresponding Source in the same way through the same place at no
266 |     further charge.  You need not require recipients to copy the
267 |     Corresponding Source along with the object code.  If the place to
268 |     copy the object code is a network server, the Corresponding Source
269 |     may be on a different server (operated by you or a third party)
270 |     that supports equivalent copying facilities, provided you maintain
271 |     clear directions next to the object code saying where to find the
272 |     Corresponding Source.  Regardless of what server hosts the
273 |     Corresponding Source, you remain obligated to ensure that it is
274 |     available for as long as needed to satisfy these requirements.
275 | 
276 |     e) Convey the object code using peer-to-peer transmission, provided
277 |     you inform other peers where the object code and Corresponding
278 |     Source of the work are being offered to the general public at no
279 |     charge under subsection 6d.
280 | 
281 |   A separable portion of the object code, whose source code is excluded
282 | from the Corresponding Source as a System Library, need not be
283 | included in conveying the object code work.
284 | 
285 |   A "User Product" is either (1) a "consumer product", which means any
286 | tangible personal property which is normally used for personal, family,
287 | or household purposes, or (2) anything designed or sold for incorporation
288 | into a dwelling.  In determining whether a product is a consumer product,
289 | doubtful cases shall be resolved in favor of coverage.  For a particular
290 | product received by a particular user, "normally used" refers to a
291 | typical or common use of that class of product, regardless of the status
292 | of the particular user or of the way in which the particular user
293 | actually uses, or expects or is expected to use, the product.  A product
294 | is a consumer product regardless of whether the product has substantial
295 | commercial, industrial or non-consumer uses, unless such uses represent
296 | the only significant mode of use of the product.
297 | 
298 |   "Installation Information" for a User Product means any methods,
299 | procedures, authorization keys, or other information required to install
300 | and execute modified versions of a covered work in that User Product from
301 | a modified version of its Corresponding Source.  The information must
302 | suffice to ensure that the continued functioning of the modified object
303 | code is in no case prevented or interfered with solely because
304 | modification has been made.
305 | 
306 |   If you convey an object code work under this section in, or with, or
307 | specifically for use in, a User Product, and the conveying occurs as
308 | part of a transaction in which the right of possession and use of the
309 | User Product is transferred to the recipient in perpetuity or for a
310 | fixed term (regardless of how the transaction is characterized), the
311 | Corresponding Source conveyed under this section must be accompanied
312 | by the Installation Information.  But this requirement does not apply
313 | if neither you nor any third party retains the ability to install
314 | modified object code on the User Product (for example, the work has
315 | been installed in ROM).
316 | 
317 |   The requirement to provide Installation Information does not include a
318 | requirement to continue to provide support service, warranty, or updates
319 | for a work that has been modified or installed by the recipient, or for
320 | the User Product in which it has been modified or installed.  Access to a
321 | network may be denied when the modification itself materially and
322 | adversely affects the operation of the network or violates the rules and
323 | protocols for communication across the network.
324 | 
325 |   Corresponding Source conveyed, and Installation Information provided,
326 | in accord with this section must be in a format that is publicly
327 | documented (and with an implementation available to the public in
328 | source code form), and must require no special password or key for
329 | unpacking, reading or copying.
330 | 
331 |   7. Additional Terms.
332 | 
333 |   "Additional permissions" are terms that supplement the terms of this
334 | License by making exceptions from one or more of its conditions.
335 | Additional permissions that are applicable to the entire Program shall
336 | be treated as though they were included in this License, to the extent
337 | that they are valid under applicable law.  If additional permissions
338 | apply only to part of the Program, that part may be used separately
339 | under those permissions, but the entire Program remains governed by
340 | this License without regard to the additional permissions.
341 | 
342 |   When you convey a copy of a covered work, you may at your option
343 | remove any additional permissions from that copy, or from any part of
344 | it.  (Additional permissions may be written to require their own
345 | removal in certain cases when you modify the work.)  You may place
346 | additional permissions on material, added by you to a covered work,
347 | for which you have or can give appropriate copyright permission.
348 | 
349 |   Notwithstanding any other provision of this License, for material you
350 | add to a covered work, you may (if authorized by the copyright holders of
351 | that material) supplement the terms of this License with terms:
352 | 
353 |     a) Disclaiming warranty or limiting liability differently from the
354 |     terms of sections 15 and 16 of this License; or
355 | 
356 |     b) Requiring preservation of specified reasonable legal notices or
357 |     author attributions in that material or in the Appropriate Legal
358 |     Notices displayed by works containing it; or
359 | 
360 |     c) Prohibiting misrepresentation of the origin of that material, or
361 |     requiring that modified versions of such material be marked in
362 |     reasonable ways as different from the original version; or
363 | 
364 |     d) Limiting the use for publicity purposes of names of licensors or
365 |     authors of the material; or
366 | 
367 |     e) Declining to grant rights under trademark law for use of some
368 |     trade names, trademarks, or service marks; or
369 | 
370 |     f) Requiring indemnification of licensors and authors of that
371 |     material by anyone who conveys the material (or modified versions of
372 |     it) with contractual assumptions of liability to the recipient, for
373 |     any liability that these contractual assumptions directly impose on
374 |     those licensors and authors.
375 | 
376 |   All other non-permissive additional terms are considered "further
377 | restrictions" within the meaning of section 10.  If the Program as you
378 | received it, or any part of it, contains a notice stating that it is
379 | governed by this License along with a term that is a further
380 | restriction, you may remove that term.  If a license document contains
381 | a further restriction but permits relicensing or conveying under this
382 | License, you may add to a covered work material governed by the terms
383 | of that license document, provided that the further restriction does
384 | not survive such relicensing or conveying.
385 | 
386 |   If you add terms to a covered work in accord with this section, you
387 | must place, in the relevant source files, a statement of the
388 | additional terms that apply to those files, or a notice indicating
389 | where to find the applicable terms.
390 | 
391 |   Additional terms, permissive or non-permissive, may be stated in the
392 | form of a separately written license, or stated as exceptions;
393 | the above requirements apply either way.
394 | 
395 |   8. Termination.
396 | 
397 |   You may not propagate or modify a covered work except as expressly
398 | provided under this License.  Any attempt otherwise to propagate or
399 | modify it is void, and will automatically terminate your rights under
400 | this License (including any patent licenses granted under the third
401 | paragraph of section 11).
402 | 
403 |   However, if you cease all violation of this License, then your
404 | license from a particular copyright holder is reinstated (a)
405 | provisionally, unless and until the copyright holder explicitly and
406 | finally terminates your license, and (b) permanently, if the copyright
407 | holder fails to notify you of the violation by some reasonable means
408 | prior to 60 days after the cessation.
409 | 
410 |   Moreover, your license from a particular copyright holder is
411 | reinstated permanently if the copyright holder notifies you of the
412 | violation by some reasonable means, this is the first time you have
413 | received notice of violation of this License (for any work) from that
414 | copyright holder, and you cure the violation prior to 30 days after
415 | your receipt of the notice.
416 | 
417 |   Termination of your rights under this section does not terminate the
418 | licenses of parties who have received copies or rights from you under
419 | this License.  If your rights have been terminated and not permanently
420 | reinstated, you do not qualify to receive new licenses for the same
421 | material under section 10.
422 | 
423 |   9. Acceptance Not Required for Having Copies.
424 | 
425 |   You are not required to accept this License in order to receive or
426 | run a copy of the Program.  Ancillary propagation of a covered work
427 | occurring solely as a consequence of using peer-to-peer transmission
428 | to receive a copy likewise does not require acceptance.  However,
429 | nothing other than this License grants you permission to propagate or
430 | modify any covered work.  These actions infringe copyright if you do
431 | not accept this License.  Therefore, by modifying or propagating a
432 | covered work, you indicate your acceptance of this License to do so.
433 | 
434 |   10. Automatic Licensing of Downstream Recipients.
435 | 
436 |   Each time you convey a covered work, the recipient automatically
437 | receives a license from the original licensors, to run, modify and
438 | propagate that work, subject to this License.  You are not responsible
439 | for enforcing compliance by third parties with this License.
440 | 
441 |   An "entity transaction" is a transaction transferring control of an
442 | organization, or substantially all assets of one, or subdividing an
443 | organization, or merging organizations.  If propagation of a covered
444 | work results from an entity transaction, each party to that
445 | transaction who receives a copy of the work also receives whatever
446 | licenses to the work the party's predecessor in interest had or could
447 | give under the previous paragraph, plus a right to possession of the
448 | Corresponding Source of the work from the predecessor in interest, if
449 | the predecessor has it or can get it with reasonable efforts.
450 | 
451 |   You may not impose any further restrictions on the exercise of the
452 | rights granted or affirmed under this License.  For example, you may
453 | not impose a license fee, royalty, or other charge for exercise of
454 | rights granted under this License, and you may not initiate litigation
455 | (including a cross-claim or counterclaim in a lawsuit) alleging that
456 | any patent claim is infringed by making, using, selling, offering for
457 | sale, or importing the Program or any portion of it.
458 | 
459 |   11. Patents.
460 | 
461 |   A "contributor" is a copyright holder who authorizes use under this
462 | License of the Program or a work on which the Program is based.  The
463 | work thus licensed is called the contributor's "contributor version".
464 | 
465 |   A contributor's "essential patent claims" are all patent claims
466 | owned or controlled by the contributor, whether already acquired or
467 | hereafter acquired, that would be infringed by some manner, permitted
468 | by this License, of making, using, or selling its contributor version,
469 | but do not include claims that would be infringed only as a
470 | consequence of further modification of the contributor version.  For
471 | purposes of this definition, "control" includes the right to grant
472 | patent sublicenses in a manner consistent with the requirements of
473 | this License.
474 | 
475 |   Each contributor grants you a non-exclusive, worldwide, royalty-free
476 | patent license under the contributor's essential patent claims, to
477 | make, use, sell, offer for sale, import and otherwise run, modify and
478 | propagate the contents of its contributor version.
479 | 
480 |   In the following three paragraphs, a "patent license" is any express
481 | agreement or commitment, however denominated, not to enforce a patent
482 | (such as an express permission to practice a patent or covenant not to
483 | sue for patent infringement).  To "grant" such a patent license to a
484 | party means to make such an agreement or commitment not to enforce a
485 | patent against the party.
486 | 
487 |   If you convey a covered work, knowingly relying on a patent license,
488 | and the Corresponding Source of the work is not available for anyone
489 | to copy, free of charge and under the terms of this License, through a
490 | publicly available network server or other readily accessible means,
491 | then you must either (1) cause the Corresponding Source to be so
492 | available, or (2) arrange to deprive yourself of the benefit of the
493 | patent license for this particular work, or (3) arrange, in a manner
494 | consistent with the requirements of this License, to extend the patent
495 | license to downstream recipients.  "Knowingly relying" means you have
496 | actual knowledge that, but for the patent license, your conveying the
497 | covered work in a country, or your recipient's use of the covered work
498 | in a country, would infringe one or more identifiable patents in that
499 | country that you have reason to believe are valid.
500 | 
501 |   If, pursuant to or in connection with a single transaction or
502 | arrangement, you convey, or propagate by procuring conveyance of, a
503 | covered work, and grant a patent license to some of the parties
504 | receiving the covered work authorizing them to use, propagate, modify
505 | or convey a specific copy of the covered work, then the patent license
506 | you grant is automatically extended to all recipients of the covered
507 | work and works based on it.
508 | 
509 |   A patent license is "discriminatory" if it does not include within
510 | the scope of its coverage, prohibits the exercise of, or is
511 | conditioned on the non-exercise of one or more of the rights that are
512 | specifically granted under this License.  You may not convey a covered
513 | work if you are a party to an arrangement with a third party that is
514 | in the business of distributing software, under which you make payment
515 | to the third party based on the extent of your activity of conveying
516 | the work, and under which the third party grants, to any of the
517 | parties who would receive the covered work from you, a discriminatory
518 | patent license (a) in connection with copies of the covered work
519 | conveyed by you (or copies made from those copies), or (b) primarily
520 | for and in connection with specific products or compilations that
521 | contain the covered work, unless you entered into that arrangement,
522 | or that patent license was granted, prior to 28 March 2007.
523 | 
524 |   Nothing in this License shall be construed as excluding or limiting
525 | any implied license or other defenses to infringement that may
526 | otherwise be available to you under applicable patent law.
527 | 
528 |   12. No Surrender of Others' Freedom.
529 | 
530 |   If conditions are imposed on you (whether by court order, agreement or
531 | otherwise) that contradict the conditions of this License, they do not
532 | excuse you from the conditions of this License.  If you cannot convey a
533 | covered work so as to satisfy simultaneously your obligations under this
534 | License and any other pertinent obligations, then as a consequence you may
535 | not convey it at all.  For example, if you agree to terms that obligate you
536 | to collect a royalty for further conveying from those to whom you convey
537 | the Program, the only way you could satisfy both those terms and this
538 | License would be to refrain entirely from conveying the Program.
539 | 
540 |   13. Remote Network Interaction; Use with the GNU General Public License.
541 | 
542 |   Notwithstanding any other provision of this License, if you modify the
543 | Program, your modified version must prominently offer all users
544 | interacting with it remotely through a computer network (if your version
545 | supports such interaction) an opportunity to receive the Corresponding
546 | Source of your version by providing access to the Corresponding Source
547 | from a network server at no charge, through some standard or customary
548 | means of facilitating copying of software.  This Corresponding Source
549 | shall include the Corresponding Source for any work covered by version 3
550 | of the GNU General Public License that is incorporated pursuant to the
551 | following paragraph.
552 | 
553 |   Notwithstanding any other provision of this License, you have
554 | permission to link or combine any covered work with a work licensed
555 | under version 3 of the GNU General Public License into a single
556 | combined work, and to convey the resulting work.  The terms of this
557 | License will continue to apply to the part which is the covered work,
558 | but the work with which it is combined will remain governed by version
559 | 3 of the GNU General Public License.
560 | 
561 |   14. Revised Versions of this License.
562 | 
563 |   The Free Software Foundation may publish revised and/or new versions of
564 | the GNU Affero General Public License from time to time.  Such new versions
565 | will be similar in spirit to the present version, but may differ in detail to
566 | address new problems or concerns.
567 | 
568 |   Each version is given a distinguishing version number.  If the
569 | Program specifies that a certain numbered version of the GNU Affero General
570 | Public License "or any later version" applies to it, you have the
571 | option of following the terms and conditions either of that numbered
572 | version or of any later version published by the Free Software
573 | Foundation.  If the Program does not specify a version number of the
574 | GNU Affero General Public License, you may choose any version ever published
575 | by the Free Software Foundation.
576 | 
577 |   If the Program specifies that a proxy can decide which future
578 | versions of the GNU Affero General Public License can be used, that proxy's
579 | public statement of acceptance of a version permanently authorizes you
580 | to choose that version for the Program.
581 | 
582 |   Later license versions may give you additional or different
583 | permissions.  However, no additional obligations are imposed on any
584 | author or copyright holder as a result of your choosing to follow a
585 | later version.
586 | 
587 |   15. Disclaimer of Warranty.
588 | 
589 |   THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
590 | APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
591 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
592 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
593 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
594 | PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
595 | IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
596 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
597 | 
598 |   16. Limitation of Liability.
599 | 
600 |   IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
601 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
602 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
603 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
604 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
605 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
606 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
607 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
608 | SUCH DAMAGES.
609 | 
610 |   17. Interpretation of Sections 15 and 16.
611 | 
612 |   If the disclaimer of warranty and limitation of liability provided
613 | above cannot be given local legal effect according to their terms,
614 | reviewing courts shall apply local law that most closely approximates
615 | an absolute waiver of all civil liability in connection with the
616 | Program, unless a warranty or assumption of liability accompanies a
617 | copy of the Program in return for a fee.
618 | 
619 |                      END OF TERMS AND CONDITIONS
620 | 
621 |             How to Apply These Terms to Your New Programs
622 | 
623 |   If you develop a new program, and you want it to be of the greatest
624 | possible use to the public, the best way to achieve this is to make it
625 | free software which everyone can redistribute and change under these terms.
626 | 
627 |   To do so, attach the following notices to the program.  It is safest
628 | to attach them to the start of each source file to most effectively
629 | state the exclusion of warranty; and each file should have at least
630 | the "copyright" line and a pointer to where the full notice is found.
631 | 
632 |     <one line to give the program's name and a brief idea of what it does.>
633 |     Copyright (C) <year>  <name of author>
634 | 
635 |     This program is free software: you can redistribute it and/or modify
636 |     it under the terms of the GNU Affero General Public License as published
637 |     by the Free Software Foundation, either version 3 of the License, or
638 |     (at your option) any later version.
639 | 
640 |     This program is distributed in the hope that it will be useful,
641 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
642 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
643 |     GNU Affero General Public License for more details.
644 | 
645 |     You should have received a copy of the GNU Affero General Public License
646 |     along with this program.  If not, see <https://www.gnu.org/licenses/>.
647 | 
648 | Also add information on how to contact you by electronic and paper mail.
649 | 
650 |   If your software can interact with users remotely through a computer
651 | network, you should also make sure that it provides a way for users to
652 | get its source.  For example, if your program is a web application, its
653 | interface could display a "Source" link that leads users to an archive
654 | of the code.  There are many ways you could offer source, and different
655 | solutions will be better for different programs; see section 13 for the
656 | specific requirements.
657 | 
658 |   You should also get your employer (if you work as a programmer) or school,
659 | if any, to sign a "copyright disclaimer" for the program, if necessary.
660 | For more information on this, and how to apply and follow the GNU AGPL, see
661 | <https://www.gnu.org/licenses/>.
662 | 


--------------------------------------------------------------------------------