@factoidal/core 0.31.1 → 0.33.0

package/xmpp/server.mjs

@@ -37,10 +37,13 @@
 // server-to-server federation, and any limit on how many bytes
 // a client may send without completing a unit beyond `maxBuffered`,
 // which is a transport limit this host applies by closing the socket.
+// The other transport limits are `maxConnections`, `loginTimeoutMs` and
+// `maxQueuedBytes`. There is no connection limit per address: behind a
+// proxy, every client has the same one.
 
-import { randomBytes } from 'node:crypto'
+import { createHash, randomBytes } from 'node:crypto'
 import { StringDecoder } from 'node:string_decoder'
-import { mkdir, readFile, writeFile, readdir, unlink, rename } from 'node:fs/promises'
+import { mkdir, readFile, writeFile, readdir, unlink, rename, stat } from 'node:fs/promises'
 import { join } from 'node:path'
 import { loadEngine } from '../bin/engine.mjs'
 import { createXmppRouter } from './router.mjs'
@@ -49,7 +52,7 @@ import { createXmppRouter } from './router.mjs'
 export const XMPP_SERVER_OPS = [
   'xmppOpen', 'xmppClose',
   'xmppSessionOpen', 'xmppSessionFeed', 'xmppSessionDeliver', 'xmppSessionClose',
-  'xmppSessionTlsUp', 'xmppRosterGet', 'xmppRosterSet', 'xmppWsOpen', 'xmppStateLoad'
+  'xmppSessionTlsUp', 'xmppRosterGet', 'xmppRosterSet', 'xmppWsOpen', 'xmppStateLoad', 'xmppClock'
 ]
 
 /** An error raised by this host, as opposed to one the engine reported.
@@ -116,10 +119,19 @@ function randomToken (bytes = 18) {
  * @param {object} options
  * @param {string} [options.domain] the domain the server is authoritative for (default `localhost`)
  * @param {Array<{username: string, password: string}>} [options.accounts]
- * @param {string} [options.accountsText] `user:password` lines, the harness's accounts-file format
- * @param {string} [options.saltB64] the SCRAM salt, base64
+ * @param {string} [options.accountsText] the accounts file's text, one account per line:
+ *   `name:password`, or the keys `factoidal xmpp-serve --verifier NAME` writes. A line that is
+ *   neither stops the start (`Server.accountsOfText`)
+ * @param {string} [options.saltB64] one SCRAM salt for every name, base64; absent, each name has its own
+ * @param {string} [options.saltSeed] the seed of the salts; absent, a random one for this process
+ * @param {string} [options.occupantSeed] the key of the rooms' occupant ids; absent, a random one
  * @param {number} [options.iterationCount] the SCRAM iteration count
  * @param {boolean} [options.tlsCarrier] whether the carrier terminates TLS
+ * @param {boolean} [options.disableRateLimits] no failed SASL login limit and no sender rate on
+ *   held stanzas (`--dangerously-disable-ratelimits`)
+ * @param {object} [options.heldLimits] caps of the stanzas held for offline accounts, each a
+ *   number: `perAccount`, `perAccountBytes`, `total`, `totalBytes`, `senderPerWindow`,
+ *   `senderWindow` (seconds); what is absent keeps the engine's default
  * @param {object} [options.engine] an engine handle to reuse
  * @returns {Promise<{engine: object, handle: string, domain: string,
  *   openSession: Function, roster: Function, setRoster: Function, close: Function}>}
@@ -130,11 +142,20 @@ export async function openXmppServer (options = {}) {
   if (typeof options.domain === 'string') config.domain = options.domain
   if (Array.isArray(options.accounts)) config.accounts = options.accounts
   if (typeof options.accountsText === 'string') config.accountsText = options.accountsText
+  // One salt per name, from a seed the engine cannot make; a fixed `saltB64`
+  // (a transcript that must replay) is one salt for all.
   if (typeof options.saltB64 === 'string') config.saltB64 = options.saltB64
+  else config.saltSeed = typeof options.saltSeed === 'string' ? options.saltSeed : randomToken(32)
+  // The key of the XEP-0421 occupant ids of the rooms.
+  config.occupantSeed = typeof options.occupantSeed === 'string' ? options.occupantSeed : randomToken(32)
   if (typeof options.iterationCount === 'number') config.iterationCount = options.iterationCount
   if (typeof options.tlsCarrier === 'boolean') config.tlsCarrier = options.tlsCarrier
   // XEP-0045 room service (L4Factoidal/XMPP/Muc.lean); off unless named.
   if (typeof options.mucDomain === 'string') config.mucDomain = options.mucDomain
+  // Members-only rooms: [{room, members: [bare JID]}]; no list, an open room.
+  if (Array.isArray(options.mucMembers)) config.mucMembers = options.mucMembers
+  // Nicks reserved for a JID: [{nick, jid}]. Each account's name is reserved for it anyway.
+  if (Array.isArray(options.mucReservedNicks)) config.mucReservedNicks = options.mucReservedNicks
   // XEP-0369 channels (L4Factoidal/XMPP/Mix.lean), joined through MIX-PAM; off unless named.
   if (typeof options.mixDomain === 'string') config.mixDomain = options.mixDomain
   // GC3 prototype groups (L4Factoidal/XMPP/Gc3.lean; no published spec); off unless named.
@@ -142,6 +163,10 @@ export async function openXmppServer (options = {}) {
   // The host keeps the state across restarts (a state key and a DIR): only
   // then does the engine produce `store`/`unstore`.
   if (options.persist === true) config.persist = true
+  // The failed SASL login limit is on unless the operator turns it off
+  // (https://github.com/danbri/factoidal/issues/1128); the engine decides.
+  if (options.disableRateLimits === true) config.disableRateLimits = true
+  if (options.heldLimits && typeof options.heldLimits === 'object') config.heldLimits = options.heldLimits
   let opened
   try {
     opened = engine.call('xmppOpen', [JSON.stringify(config)])
@@ -157,20 +182,45 @@ export async function openXmppServer (options = {}) {
     throw new XmppHostError('xmppOpen answered with no handle')
   }
   const handle = opened.handle
+  // The rate limits read the host's clock: tell the engine when the second changes.
+  let lastSecond = 0
+  const tick = () => {
+    const now = Math.floor(Date.now() / 1000)
+    if (now === lastSecond) return
+    lastSecond = now
+    try {
+      engine.call('xmppClock', [handle, String(now)])
+    } catch (error) {
+      // An older engine has no such op, and no limit that reads it.
+      if (!isUnknownOp(error)) throw error
+    }
+  }
+  // An older engine ignores the list, and the rooms would be open: do not start.
+  if (Array.isArray(options.mucMembers) && opened.mucMembers !== options.mucMembers.length) {
+    engine.call('xmppClose', [handle])
+    throw new XmppHostError('this engine does not carry members-only rooms; rebuild the engine')
+  }
   return {
     engine,
     handle,
     domain: typeof opened.domain === 'string' ? opened.domain : (config.domain || 'localhost'),
     accounts: typeof opened.accounts === 'number' ? opened.accounts : undefined,
+    /** The engine's start warnings (--dangerously-disable-ratelimits). */
+    warnings: Array.isArray(opened.warnings) ? opened.warnings : [],
+    tick,
     /**
      * One client connection.
-     * @param {{streamId?: string, nonce?: string, tlsCarrier?: boolean, startTls?: boolean, maxUnits?: number}} [sessionOptions]
+     * `remoteAddress` (the socket's) and the clock go to the engine for the
+     * failed SASL login limit (https://github.com/danbri/factoidal/issues/1128).
+     * @param {{streamId?: string, nonce?: string, tlsCarrier?: boolean, startTls?: boolean, maxUnits?: number, remoteAddress?: string}} [sessionOptions]
      */
     openSession (sessionOptions = {}) {
       const record = {
         streamId: typeof sessionOptions.streamId === 'string' ? sessionOptions.streamId : randomToken(),
-        nonce: typeof sessionOptions.nonce === 'string' ? sessionOptions.nonce : randomToken()
+        nonce: typeof sessionOptions.nonce === 'string' ? sessionOptions.nonce : randomToken(),
+        now: Math.floor(Date.now() / 1000)
       }
+      if (typeof sessionOptions.remoteAddress === 'string') record.remoteAddress = sessionOptions.remoteAddress
       if (typeof sessionOptions.tlsCarrier === 'boolean') record.tlsCarrier = sessionOptions.tlsCarrier
       if (typeof sessionOptions.startTls === 'boolean') record.startTls = sessionOptions.startTls
       if (typeof sessionOptions.maxUnits === 'number') record.maxUnits = sessionOptions.maxUnits
@@ -182,6 +232,7 @@ export async function openXmppServer (options = {}) {
         handle: session,
         /** Feed received text; returns the engine's answer document. */
         feed (text) {
+          tick()
           return engine.call('xmppSessionFeed', [session, text])
         },
         /** The TLS handshake a feed asked for (`startTls: true`) finished. */
@@ -228,6 +279,14 @@ async function readAccountsFile (path) {
   }
 }
 
+/** A warning when the accounts file can be read by anyone but its owner. */
+async function accountsFileWarnings (path) {
+  if (process.platform === 'win32') return []
+  const { mode } = await stat(path)
+  if ((mode & 0o077) === 0) return []
+  return [`${path} can be read by other users of this machine: chmod 600 it`]
+}
+
 /**
  * A `net.Server` (or `tls.Server`, when `cert` and `key` are given —
  * XEP-0368 direct TLS) that runs one engine session per connection.
@@ -235,6 +294,7 @@ async function readAccountsFile (path) {
  * The server is returned unlistened: the caller chooses the port.
  *
  * @param {object} options as `openXmppServer`, plus:
+ * @param {string} [options.accountsFile] the path `accountsText` came from, to check its mode
  * @param {string} [options.dir] state directory: `accounts` is read from it when
  *   no accounts are given; rosters are persisted under `roster/`; `spool/` is
  *   polled for stanzas written by other processes
@@ -243,10 +303,20 @@ async function readAccountsFile (path) {
  * @param {boolean} [options.startTls] listen in clear and use `cert` and
  *   `key` for STARTTLS (RFC 6120 section 5), which the engine then requires
  *   before anything else; without it, `cert` and `key` mean direct TLS
+ * @param {number} [options.directTlsPort] with `startTls`, `listen` also serves
+ *   XEP-0368 direct TLS on this port, in the same server: one set of rooms
  * @param {number} [options.pollMs] spool poll interval (default 250; 0 disables)
  * @param {number} [options.maxBuffered] residual UTF-8 bytes held by the engine
  *   after a feed before the socket is closed (default 1 MiB); the decoder
  *   may separately hold up to three bytes of an incomplete UTF-8 sequence
+ * @param {number} [options.maxConnections] open connections, of all kinds, before
+ *   a new one is closed at once (default 1024)
+ * @param {number} [options.loginTimeoutMs] how long a connection may stay
+ *   without a bound resource before it is closed (default 30000; 0 disables)
+ * @param {number} [options.maxQueuedBytes] bytes waiting to be written to a
+ *   client that is not reading, before the socket is closed (default 8 MiB)
+ * @param {boolean} [options.addressLimit] false: count failed logins per account name only, for a
+ *   listener behind a proxy, where every client has one address (default true)
  * @param {Function} [options.onError]
  * @param {Function} [options.onLog]
  * @returns {Promise<{server: object, xmpp: object, close: Function, sessions: Function}>}
@@ -259,6 +329,14 @@ export async function createXmppServer (options = {}) {
   const dir = typeof options.dir === 'string' ? options.dir : null
   const pollMs = typeof options.pollMs === 'number' ? options.pollMs : 250
   const maxBuffered = typeof options.maxBuffered === 'number' ? options.maxBuffered : 1024 * 1024
+  const limit = (name, fallback) => {
+    const value = typeof options[name] === 'number' ? options[name] : fallback
+    if (!Number.isSafeInteger(value) || value < 0) throw new XmppHostError(`${name} must be a nonnegative safe integer`)
+    return value
+  }
+  const maxConnections = limit('maxConnections', 1024)
+  const loginTimeoutMs = limit('loginTimeoutMs', 30000)
+  const maxQueuedBytes = limit('maxQueuedBytes', 8 * 1024 * 1024)
   if (!Number.isSafeInteger(maxBuffered) || maxBuffered < 0) {
     throw new XmppHostError('maxBuffered must be a nonnegative safe integer')
   }
@@ -267,9 +345,19 @@ export async function createXmppServer (options = {}) {
   }
 
   const serverOptions = { ...options }
+  let accountsFile = typeof options.accountsFile === 'string' ? options.accountsFile : null
   if (dir !== null && !Array.isArray(options.accounts) && typeof options.accountsText !== 'string') {
     const text = await readAccountsFile(join(dir, 'accounts'))
-    if (text !== null) serverOptions.accountsText = text
+    if (text !== null) { serverOptions.accountsText = text; accountsFile = join(dir, 'accounts') }
+  }
+  // Salts that survive a restart when the state does: a client that keeps a
+  // salted password goes on working, and a name's salt does not change.
+  if (typeof options.saltSeed !== 'string' && typeof options.stateKey === 'string') {
+    serverOptions.saltSeed = createHash('sha256').update('xmpp salt seed\0' + options.stateKey).digest('base64url')
+  }
+  // Occupant ids that survive a restart, for the same reason.
+  if (typeof options.occupantSeed !== 'string' && typeof options.stateKey === 'string') {
+    serverOptions.occupantSeed = createHash('sha256').update('xmpp occupant seed\0' + options.stateKey).digest('base64url')
   }
   const haveKey = options.cert !== undefined && options.key !== undefined
   if (options.startTls === true && !haveKey) {
@@ -280,6 +368,7 @@ export async function createXmppServer (options = {}) {
   if (typeof serverOptions.tlsCarrier !== 'boolean') serverOptions.tlsCarrier = useTls
   if (dir !== null && options.stateKey !== undefined) serverOptions.persist = true
   const xmpp = await openXmppServer(serverOptions)
+  if (accountsFile !== null) xmpp.warnings.push(...await accountsFileWarnings(accountsFile))
 
   // Rosters the previous run persisted.
   try {
@@ -337,6 +426,10 @@ export async function createXmppServer (options = {}) {
           if (got.status !== 200) throw new XmppHostError(`state: ${path} answered ${got.status}`)
           const loaded = xmpp.engine.call('xmppStateLoad', [xmpp.handle, path, new TextDecoder().decode(got.body)])
           if (loaded === null || typeof loaded !== 'object') throw new XmppHostError(`state: ${path} was refused`)
+          if (loaded.stale === true) {
+            const gone = await state.step({ method: 'DELETE', target: path, headers: [], body: new Uint8Array(0) })
+            if (gone.status >= 300 && gone.status !== 404) throw new XmppHostError(`state: DELETE ${path} answered ${gone.status}`)
+          }
         }
       }
     } catch (error) {
@@ -385,8 +478,44 @@ export async function createXmppServer (options = {}) {
   // connection callback and therefore have no engine session yet.
   const transports = new Set()
 
+  // The client's address for the login limit. Behind a proxy every client has
+  // the proxy's address, and a limit on it would stop them all: `addressLimit: false`.
+  const addressOf = (socket) =>
+    options.addressLimit !== false && typeof socket.remoteAddress === 'string' ? socket.remoteAddress : ''
+
+  // Transport limits, like `maxBuffered`: bytes and time, not protocol.
+  function closeIfBacklogged (c) {
+    if (c.socket.destroyed || !(c.socket.writableLength > maxQueuedBytes)) return
+    onError(new XmppHostError(`connection exceeded ${maxQueuedBytes} queued bytes`))
+    c.socket.destroy()
+  }
+
   function writeAll (c, lines) {
     for (const line of lines) if (!c.socket.destroyed) c.socket.write(line)
+    closeIfBacklogged(c)
+  }
+
+  /** A connection gets `loginTimeoutMs` to bind a resource. */
+  function startLoginTimer (c) {
+    if (loginTimeoutMs === 0) return
+    c.loginTimer = setTimeout(() => {
+      if (c.full === null && connections.has(c)) {
+        onLog('closing a connection that did not log in in time')
+        c.socket.destroy()
+      }
+    }, loginTimeoutMs)
+    c.loginTimer.unref()
+  }
+
+  /** Count a new socket, or close it at once if the server is full. */
+  function admit (socket) {
+    if (transports.size >= maxConnections) {
+      onError(new XmppHostError(`refused a connection: ${maxConnections} are open`))
+      socket.destroy()
+      return
+    }
+    transports.add(socket)
+    socket.once('close', () => transports.delete(socket))
   }
 
   let rosterWrites = Promise.resolve()
@@ -471,6 +600,7 @@ export async function createXmppServer (options = {}) {
   function endSession (c) {
     if (!connections.has(c)) return
     connections.delete(c)
+    clearTimeout(c.loginTimer)
     let answer
     try { answer = c.session.close() } catch (error) { onError(error); answer = { send: [] } }
     // The session left its MUC rooms (Muc.leaveAll): tell the other occupants.
@@ -482,10 +612,10 @@ export async function createXmppServer (options = {}) {
     }
   }
 
-  function onConnection (socket) {
+  function onConnection (socket, direct = false) {
     let session
     try {
-      session = xmpp.openSession({ tlsCarrier: useTls, startTls })
+      session = xmpp.openSession({ tlsCarrier: useTls || direct, startTls: startTls && !direct, remoteAddress: addressOf(socket) })
     } catch (error) {
       onError(error)
       socket.destroy()
@@ -505,6 +635,7 @@ export async function createXmppServer (options = {}) {
       }
     }
     connections.add(c)
+    startLoginTimer(c)
     onLog(`connection from ${socket.remoteAddress}:${socket.remotePort}`)
     c.onData = (chunk) => {
       if (!connections.has(c) || c.closing || c.upgrading) return
@@ -552,7 +683,7 @@ export async function createXmppServer (options = {}) {
     let handle
     try {
       const opened = xmpp.engine.call('xmppWsOpen', [xmpp.handle, JSON.stringify({
-        streamId: randomToken(), nonce: randomToken(),
+        streamId: randomToken(), nonce: randomToken(), remoteAddress: addressOf(socket),
         path: typeof ws.path === 'string' ? ws.path : '/xmpp-websocket',
         allowedOrigins: Array.isArray(ws.allowedOrigins) ? ws.allowedOrigins : [],
         allowNoOrigin: ws.allowNoOrigin === true,
@@ -579,15 +710,17 @@ export async function createXmppServer (options = {}) {
       },
       deliver (text) {
         const got = wsCall('xmppWsDeliver', [handle, text], new Uint8Array(0))
-        if (got.envelope.delivered === true) { if (!socket.destroyed) socket.write(got.bytes); return true }
+        if (got.envelope.delivered === true) { if (!socket.destroyed) socket.write(got.bytes); closeIfBacklogged(c); return true }
         return false
       }
     }
     connections.add(c)
+    startLoginTimer(c)
     socket.on('data', (chunk) => {
       if (!connections.has(c) || c.closing) return
       let got
       try {
+        xmpp.tick()
         got = wsCall('xmppWsFeed', [handle], new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength))
       } catch (error) {
         onError(error)
@@ -623,29 +756,32 @@ export async function createXmppServer (options = {}) {
       const net = await import('node:net')
       wsServer = net.createServer(onWsConnection)
     }
-    wsServer.on('connection', socket => {
-      transports.add(socket)
-      socket.once('close', () => transports.delete(socket))
-    })
+    wsServer.on('connection', admit)
   }
 
   let server
   try {
     if (useTls) {
       const tls = await import('node:tls')
-      server = tls.createServer({ cert: options.cert, key: options.key }, onConnection)
+      server = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket))
     } else {
       const net = await import('node:net')
-      server = net.createServer(onConnection)
+      server = net.createServer((socket) => onConnection(socket))
     }
   } catch (error) {
     xmpp.close()
     throw error
   }
-  server.on('connection', socket => {
-    transports.add(socket)
-    socket.once('close', () => transports.delete(socket))
-  })
+  server.on('connection', admit)
+
+  // XEP-0368 direct TLS beside a STARTTLS listener: the engine takes its
+  // answer per session, so this differs only in what `onConnection` passes.
+  let directServer = null
+  if (startTls && options.directTlsPort !== undefined) {
+    const tls = await import('node:tls')
+    directServer = tls.createServer({ cert: options.cert, key: options.key }, (socket) => onConnection(socket, true))
+    directServer.on('connection', admit)
+  }
 
   // The harness's mailbox: `<dir>/spool/<bare jid>/<name>` holds one
   // stanza's bytes for that account. Polled for every bound session,
@@ -693,6 +829,7 @@ export async function createXmppServer (options = {}) {
   return {
     server,
     wsServer,
+    directServer,
     xmpp,
     /** The live connections' `{bare, full}` pairs, for a host's own view. */
     sessions () {
@@ -714,6 +851,7 @@ export async function createXmppServer (options = {}) {
         try {
           await new Promise(resolve => server.close(resolve))
           if (wsServer !== null) await new Promise(resolve => wsServer.close(resolve))
+          if (directServer !== null) await new Promise(resolve => directServer.close(resolve))
           await pollTask
           await rosterWrites
           await stateWrites
@@ -765,7 +903,20 @@ export async function listen (options = {}) {
     const path = typeof options.websocket.path === 'string' ? options.websocket.path : '/xmpp-websocket'
     wsOrigin = `${wsScheme}://${host}:${created.wsServer.address().port}${path}`
   }
+  let directOrigin = null
+  if (created.directServer !== null) {
+    try {
+      await new Promise((resolve, reject) => {
+        created.directServer.once('error', reject)
+        created.directServer.listen(options.directTlsPort, host, resolve)
+      })
+    } catch (error) {
+      await created.close()
+      throw error
+    }
+    directOrigin = `xmpps://${host}:${created.directServer.address().port}`
+  }
   const bound = created.server.address()
   const scheme = options.cert !== undefined && options.key !== undefined ? 'xmpps' : 'xmpp'
-  return { ...created, port: bound.port, host, origin: `${scheme}://${host}:${bound.port}`, wsOrigin }
+  return { ...created, port: bound.port, host, origin: `${scheme}://${host}:${bound.port}`, wsOrigin, directOrigin }
 }