@encharm/cws 4.5.2 → 4.6.0

package/src/headers/26/quic/session_manager.h

@@ -0,0 +1,107 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <env.h>
+#include <node_sockaddr.h>
+#include <unordered_map>
+#include <unordered_set>
+#include "cid.h"
+#include "tokens.h"
+
+namespace node::quic {
+
+class Endpoint;
+class Session;
+
+// SessionManager is a per-Realm singleton that centralizes QUIC session
+// routing. It holds the authoritative CID -> Session mapping, enabling
+// any Endpoint to route packets to any session. This decouples session
+// lifetime from individual endpoints, which is required for preferred
+// address, connection migration, and multi-path QUIC.
+//
+// SessionManager is held by BindingData and lazily created on first access.
+// It is not exposed to JavaScript.
+class SessionManager final {
+ public:
+  explicit SessionManager() = default;
+  ~SessionManager() = default;
+
+  // Session routing. The sessions_ map holds BaseObjectPtr<Session> (owning
+  // references). SessionManager is the single authority for session ownership.
+  BaseObjectPtr<Session> FindSession(const CID& dcid);
+  void AddSession(const CID& scid, BaseObjectPtr<Session> session);
+  void RemoveSession(const CID& scid);
+
+  // Cross-endpoint CID association. This map holds locally-generated CIDs
+  // that need to be routable from any endpoint (e.g., preferred address CID,
+  // multipath NEW_CONNECTION_ID CIDs). Peer-chosen CIDs from connection
+  // establishment (config.dcid, config.ocid) go in Endpoint::dcid_to_scid_
+  // instead, because those values can collide across endpoints.
+  void AssociateCID(const CID& cid, const CID& scid);
+  void DisassociateCID(const CID& cid);
+
+  // Stateless reset token association. The token_map_ holds raw (non-owning)
+  // pointers. Entries are valid only while the corresponding session exists
+  // in sessions_. Sessions clean up their tokens during teardown.
+  void AssociateStatelessResetToken(const StatelessResetToken& token,
+                                    Session* session);
+  void DisassociateStatelessResetToken(const StatelessResetToken& token);
+  Session* FindSessionByStatelessResetToken(
+      const StatelessResetToken& token) const;
+
+  // Endpoint registry. Endpoints register themselves when they start
+  // receiving and unregister when they close.
+  void RegisterEndpoint(Endpoint* endpoint, const SocketAddress& local_address);
+  void UnregisterEndpoint(Endpoint* endpoint);
+  bool HasEndpoints() const;
+  size_t endpoint_count() const;
+
+  // Find the endpoint bound to a given local address. Used by the session
+  // send path to route packets through the correct endpoint based on the
+  // ngtcp2 packet path. Tries exact match first, then wildcard fallback
+  // (0.0.0.0 or [::] on the same port).
+  Endpoint* FindEndpointForAddress(const SocketAddress& local_addr) const;
+
+  // Primary endpoint tracking. Each session has one primary endpoint
+  // responsible for its lifecycle.
+  void SetPrimaryEndpoint(Session* session, Endpoint* endpoint);
+  Endpoint* GetPrimaryEndpoint(Session* session) const;
+
+  // Close all sessions whose primary endpoint is the given endpoint.
+  // Used by Endpoint::Destroy().
+  void CloseAllSessionsFor(Endpoint* endpoint);
+
+  // Destroy all sessions. Used when the last endpoint is removed.
+  void DestroyAllSessions();
+
+  bool is_empty() const;
+
+ private:
+  // The sessions_ map holds strong owning references keyed by locally-
+  // generated SCIDs. This is the single source of truth for session
+  // ownership.
+  CID::Map<BaseObjectPtr<Session>> sessions_;
+
+  // Cross-endpoint CID -> primary SCID mapping. Contains locally-generated
+  // CIDs that need to be routable from any endpoint. Peer-chosen CIDs
+  // from connection establishment are in Endpoint::dcid_to_scid_ instead.
+  CID::Map<CID> dcid_to_scid_;
+
+  // Stateless reset token -> Session (non-owning).
+  StatelessResetToken::Map<Session*> token_map_;
+
+  // All registered endpoints.
+  std::unordered_set<Endpoint*> endpoints_;
+
+  // Endpoint -> bound local address, for FindEndpointForAddress lookups.
+  std::unordered_map<Endpoint*, SocketAddress> endpoint_addrs_;
+
+  // Session -> primary Endpoint mapping (non-owning both directions;
+  // sessions are owned by sessions_, endpoints are externally owned).
+  std::unordered_map<Session*, Endpoint*> primary_map_;
+};
+
+}  // namespace node::quic
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS

package/src/headers/26/quic/sessionticket.h

@@ -0,0 +1,110 @@
+#pragma once
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <crypto/crypto_common.h>
+#include <env.h>
+#include <memory_tracker.h>
+#include <uv.h>
+#include <v8.h>
+#include "data.h"
+#include "defs.h"
+
+namespace node::quic {
+
+// A TLS 1.3 Session resumption ticket. Encapsulates both the TLS
+// ticket and the encoded QUIC transport parameters. The encoded
+// structure should be considered to be opaque for end users.
+// In JavaScript, the ticket will be represented as a Buffer
+// instance with opaque data. To resume a session, the user code
+// would pass that Buffer back into to client connection API.
+class SessionTicket final : public MemoryRetainer {
+ public:
+  static v8::Maybe<SessionTicket> FromV8Value(Environment* env,
+                                              v8::Local<v8::Value> value);
+
+  SessionTicket() = default;
+  SessionTicket(Store&& ticket, Store&& transport_params);
+
+  const uv_buf_t ticket() const;
+
+  const ngtcp2_vec transport_params() const;
+
+  v8::MaybeLocal<v8::Object> encode(Environment* env) const;
+
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(SessionTicket)
+  SET_SELF_SIZE(SessionTicket)
+
+  class AppData;
+
+  // The callback that OpenSSL will call when generating the session ticket
+  // and it needs to collect additional application specific data.
+  static int GenerateCallback(SSL* ssl, void* arg);
+
+  // The callback that OpenSSL will call when consuming the session ticket
+  // and it needs to pass embedded application data back into the app.
+  static SSL_TICKET_RETURN DecryptedCallback(SSL* ssl,
+                                             SSL_SESSION* session,
+                                             const unsigned char* keyname,
+                                             size_t keyname_len,
+                                             SSL_TICKET_STATUS status,
+                                             void* arg);
+
+ private:
+  Store ticket_;
+  Store transport_params_;
+};
+
+// SessionTicket::AppData is a utility class that is used only during the
+// generation or access of TLS stateless session tickets. It exists solely to
+// provide a easier way for Session::Application instances to set relevant
+// metadata in the session ticket when it is created, and the extract and
+// subsequently verify that data when a ticket is received and is being
+// validated. The app data is completely opaque to anything other than the
+// server-side of the Session::Application that sets it.
+class SessionTicket::AppData final {
+ public:
+  enum class Status : uint8_t {
+    TICKET_IGNORE = SSL_TICKET_RETURN_IGNORE,
+    TICKET_IGNORE_RENEW = SSL_TICKET_RETURN_IGNORE_RENEW,
+    TICKET_USE = SSL_TICKET_RETURN_USE,
+    TICKET_USE_RENEW = SSL_TICKET_RETURN_USE_RENEW,
+  };
+
+  explicit AppData(SSL* ssl, SSL_SESSION* session = nullptr);
+  DISALLOW_COPY_AND_MOVE(AppData)
+
+  bool Set(const uv_buf_t& data);
+  std::optional<const uv_buf_t> Get() const;
+
+  // A source of application data collected during the creation of the
+  // session ticket. This interface will be implemented by the QUIC
+  // Session.
+  class Source {
+   public:
+    enum class Flag : uint8_t { STATUS_NONE, STATUS_RENEW };
+
+    // Collect application data into the given AppData instance.
+    virtual void CollectSessionTicketAppData(AppData* app_data) const = 0;
+
+    // Extract application data from the given AppData instance.
+    virtual Status ExtractSessionTicketAppData(
+        const AppData& app_data, Flag flag = Flag::STATUS_NONE) = 0;
+  };
+
+  static void Collect(SSL* ssl);
+  static Status Extract(SSL* ssl,
+                        SSL_SESSION* session,
+                        Source::Flag flag = Source::Flag::STATUS_NONE);
+
+ private:
+  SSL_SESSION* GetSession() const;
+  bool set_ = false;
+  SSL* ssl_;
+  SSL_SESSION* session_;
+};
+
+}  // namespace node::quic
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS