@lakutata/webrtc 0.0.0-stage → 3.1.1

package/dist/esm/lib/ice/stun/tcpProtocol.js

@@ -0,0 +1,318 @@
+import { connect, createServer } from 'node:net';
+import { Event, debug } from '../imports/common.js';
+import { classes } from './const.js';
+import { parseMessage } from './message.js';
+import { encodeTcpFrame, splitTcpFrames } from './tcpFrame.js';
+import { Transaction, buildTransactionOptions, resolveRequestAddress } from './transaction.js';
+const log = debug('webrtc/ice/stun/tcpProtocol');
+function socketKey(addr) {
+    return `${addr[0]}:${addr[1]}`;
+}
+function isSocketClosed(socket) {
+    return socket.destroyed || socket.writableEnded;
+}
+function addressFromSocket(socket) {
+    if (!socket.remoteAddress || !socket.remotePort) {
+        return;
+    }
+    return [socket.remoteAddress, socket.remotePort];
+}
+async function waitForListening(server, host, port) {
+    return await new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off('listening', onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off('error', onError);
+            resolve();
+        };
+        server.once('error', onError);
+        server.once('listening', onListening);
+        server.listen({
+            host,
+            port: port ?? 0,
+            exclusive: true
+        });
+    });
+}
+class BaseTcpProtocol {
+    constructor() {
+        this.type = BaseTcpProtocol.type;
+        this.transactions = {};
+        this.onRequestReceived = new Event();
+        this.onDataReceived = new Event();
+        /** The connection to this remote address was closed (by either side). */
+        this.onConnectionClosed = new Event();
+        this.sockets = new Map();
+    }
+    static { this.type = 'tcp'; }
+    rememberSocket(entry) {
+        const remoteAddr = entry.remoteAddr;
+        if (!remoteAddr) {
+            return;
+        }
+        this.sockets.set(socketKey(remoteAddr), entry);
+    }
+    /** Drop `entry` only if it is still the socket registered for its address. */
+    forgetSocket(entry) {
+        const remoteAddr = entry.remoteAddr;
+        if (!remoteAddr) {
+            return false;
+        }
+        const key = socketKey(remoteAddr);
+        if (this.sockets.get(key) !== entry) {
+            return false;
+        }
+        this.sockets.delete(key);
+        return true;
+    }
+    /** Registered socket for `addr`, discarding it if it is already closed. */
+    getOpenSocket(addr) {
+        const entry = this.sockets.get(socketKey(addr));
+        if (!entry) {
+            return;
+        }
+        if (isSocketClosed(entry.socket)) {
+            this.dropSocket(entry);
+            return;
+        }
+        return entry;
+    }
+    dropSocket(entry) {
+        entry.socket.destroy();
+        if (this.forgetSocket(entry) && entry.remoteAddr) {
+            this.onConnectionClosed.execute(entry.remoteAddr);
+        }
+    }
+    registerSocket(socket, remoteAddr) {
+        const entry = {
+            socket,
+            buffer: Buffer.alloc(0),
+            remoteAddr
+        };
+        if (remoteAddr) {
+            this.rememberSocket(entry);
+        }
+        socket.on('data', (data) => {
+            entry.buffer = Buffer.concat([entry.buffer, data]);
+            const { frames, rest } = splitTcpFrames(entry.buffer);
+            entry.buffer = rest;
+            const socketAddr = entry.remoteAddr ?? addressFromSocket(socket);
+            if (!entry.remoteAddr && socketAddr) {
+                entry.remoteAddr = socketAddr;
+                this.rememberSocket(entry);
+            }
+            if (!socketAddr) {
+                return;
+            }
+            for (const frame of frames) {
+                if (frame.length === 0) {
+                    continue;
+                }
+                this.handleFrame(frame, socketAddr);
+            }
+        });
+        socket.on('close', () => {
+            if (this.forgetSocket(entry) && entry.remoteAddr) {
+                this.onConnectionClosed.execute(entry.remoteAddr);
+            }
+        });
+        socket.on('error', (error) => {
+            log('tcp socket error', error);
+        });
+        return entry;
+    }
+    handleFrame(data, addr) {
+        try {
+            const message = parseMessage(data);
+            if (!message) {
+                this.onDataReceived.execute(data);
+                return;
+            }
+            if ((message.messageClass === classes.RESPONSE ||
+                message.messageClass === classes.ERROR) &&
+                this.transactions[message.transactionIdHex]) {
+                const transaction = this.transactions[message.transactionIdHex];
+                const verified = transaction.integrityKey
+                    ? parseMessage(data, transaction.integrityKey)
+                    : message;
+                if (!verified) {
+                    log('STUN response failed MESSAGE-INTEGRITY check');
+                    return;
+                }
+                transaction.responseReceived(verified, addr);
+            }
+            else if (message.messageClass === classes.REQUEST) {
+                this.onRequestReceived.execute(message, addr, data);
+            }
+        }
+        catch (error) {
+            log('tcp frame parse error', error);
+        }
+    }
+    async sendFrame(data, addr) {
+        const entry = await this.getSocket(addr);
+        try {
+            await new Promise((resolve, reject) => {
+                entry.socket.write(encodeTcpFrame(data), (error) => {
+                    if (error) {
+                        reject(error);
+                        return;
+                    }
+                    resolve();
+                });
+            });
+        }
+        catch (error) {
+            // EPIPE / ECONNRESET / ERR_STREAM_DESTROYED: this connection is gone.
+            // Forget it so the next send does not reuse it, and report the failure.
+            log('tcp write failed', addr, error);
+            this.dropSocket(entry);
+            throw error;
+        }
+    }
+    async sendStun(message, addr) {
+        await this.sendFrame(message.bytes, addr);
+    }
+    async sendData(data, addr) {
+        await this.sendFrame(data, addr);
+    }
+    async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
+        if (this.transactions[request.transactionIdHex]) {
+            throw new Error('already requested');
+        }
+        if (integrityKey) {
+            request.addMessageIntegrity(integrityKey);
+            request.addFingerprint();
+        }
+        const resolvedAddr = await resolveRequestAddress(addr);
+        const options = {
+            // A failed connect/write will not be fixed by waiting for a response.
+            failOnSendError: true,
+            ...buildTransactionOptions(integrityKey, retransmissionsOrOptions, onRequestSent)
+        };
+        const transaction = new Transaction(request, resolvedAddr, this, options);
+        this.transactions[request.transactionIdHex] = transaction;
+        try {
+            return await transaction.run();
+        }
+        finally {
+            delete this.transactions[request.transactionIdHex];
+        }
+    }
+    async pruneForSelection(remoteAddr) {
+        for (const [key, entry] of this.sockets.entries()) {
+            if (remoteAddr && key === socketKey(remoteAddr)) {
+                continue;
+            }
+            entry.socket.destroy();
+            this.sockets.delete(key);
+        }
+    }
+    get activeSocketCount() {
+        return this.sockets.size;
+    }
+    get address() {
+        return {};
+    }
+    async close() {
+        Object.values(this.transactions).forEach((transaction) => {
+            transaction.cancel();
+        });
+        await this.pruneForSelection();
+        this.onRequestReceived.complete();
+        this.onDataReceived.complete();
+        this.onConnectionClosed.complete();
+    }
+}
+export class TcpActiveProtocol extends BaseTcpProtocol {
+    constructor() {
+        super(...arguments);
+        this.pendingSockets = new Map();
+    }
+    async connectionMade(localIp) {
+        this.localIp = localIp;
+    }
+    async getSocket(addr) {
+        const key = socketKey(addr);
+        const existing = this.getOpenSocket(addr);
+        if (existing) {
+            return existing;
+        }
+        const pending = this.pendingSockets.get(key);
+        if (pending) {
+            return await pending;
+        }
+        const connecting = new Promise((resolve, reject) => {
+            const socket = connect({
+                host: addr[0],
+                port: addr[1],
+                localAddress: this.localIp
+            });
+            const entry = this.registerSocket(socket, addr);
+            const onError = (error) => {
+                socket.off('connect', onConnect);
+                reject(error);
+            };
+            const onConnect = () => {
+                socket.off('error', onError);
+                resolve(entry);
+            };
+            socket.once('error', onError);
+            socket.once('connect', onConnect);
+        });
+        this.pendingSockets.set(key, connecting);
+        try {
+            return await connecting;
+        }
+        finally {
+            this.pendingSockets.delete(key);
+        }
+    }
+}
+export class TcpPassiveProtocol extends BaseTcpProtocol {
+    constructor() {
+        super(...arguments);
+        this.server = createServer((socket) => {
+            this.registerSocket(socket, addressFromSocket(socket));
+        });
+    }
+    async connectionMade(localIp, portRange) {
+        this.localIp = localIp;
+        if (portRange) {
+            let lastError;
+            for (let port = portRange[0]; port <= portRange[1]; port++) {
+                try {
+                    await waitForListening(this.server, localIp, port);
+                    return;
+                }
+                catch (error) {
+                    lastError = error;
+                }
+            }
+            throw lastError ?? new Error('tcp port not found');
+        }
+        await waitForListening(this.server, localIp);
+    }
+    async getSocket(addr) {
+        const entry = this.getOpenSocket(addr);
+        if (!entry) {
+            throw new Error('tcp passive connection not established');
+        }
+        return entry;
+    }
+    get listeningPort() {
+        const address = this.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('tcp passive protocol is not listening');
+        }
+        return address.port;
+    }
+    async close() {
+        await super.close();
+        await new Promise((resolve) => {
+            this.server.close(() => resolve());
+        });
+    }
+}

package/dist/esm/lib/ice/stun/transaction.js

@@ -0,0 +1,230 @@
+import { promises as dns } from 'node:dns';
+import { isIP } from 'node:net';
+import { Event, debug } from '../imports/common.js';
+import { AddressFamilyMismatch, TransactionFailed, TransactionTimeout } from '../exceptions.js';
+import { RETRY_MAX, RETRY_RTO, classes } from './const.js';
+const log = debug('webrtc/ice/stun/transaction');
+/**
+ * Resolve a request target to a concrete IP before creating a Transaction so
+ * response source-address checks match the UDP peer address (hostname ≠ IP).
+ *
+ * `family` is the family of the socket that will carry the request: a
+ * hostname resolves only in that family, and an IP literal of the other
+ * family throws AddressFamilyMismatch instead of retransmitting into a send
+ * that cannot succeed. Family 0 means unknown: no preference, no check.
+ */
+export async function resolveRequestAddress(addr, family = 0) {
+    const literalFamily = isIP(addr[0]);
+    if (literalFamily) {
+        if (family !== 0 && literalFamily !== family) {
+            throw new AddressFamilyMismatch(addr, family);
+        }
+        return addr;
+    }
+    const looked = await dns.lookup(addr[0], { family });
+    return [looked.address, addr[1]];
+}
+/**
+ * Normalize legacy positional args and the options-object form into one shape.
+ * Existing callers pass `(retransmissions?, onRequestSent?)`.
+ */
+export function normalizeTransactionOptions(retransmissionsOrOptions, onRequestSent) {
+    if (retransmissionsOrOptions !== null &&
+        typeof retransmissionsOrOptions === 'object') {
+        return retransmissionsOrOptions;
+    }
+    // After the object branch, only number | undefined remains (legacy positional API).
+    const retransmissions = typeof retransmissionsOrOptions === 'number'
+        ? retransmissionsOrOptions
+        : undefined;
+    return {
+        retransmissions,
+        onRequestSent
+    };
+}
+/**
+ * Compare ICE transport addresses (host, port).
+ * IPv6 literals are compared in canonical form because the socket reports
+ * `::1` even when the peer was configured as `0:0:0:0:0:0:0:1`.
+ */
+export function addressEquals(a, b) {
+    return a[1] === b[1] && canonicalHost(a[0]) === canonicalHost(b[0]);
+}
+// Only used for comparison; never for the address a packet is sent to,
+// since the zone id is dropped (`fe80::1%eth0`). The serialization of the URLs
+// is the same in Node.js and Bun (the SocketAddress of Bun keeps the text given).
+function canonicalHost(host) {
+    if (isIP(host) !== 6)
+        return host;
+    return new URL(`http://[${host.split('%')[0]}]/`).hostname.slice(1, -1);
+}
+export class Transaction {
+    constructor(request, addr, protocol, retransmissionsOrOptions, onRequestSent) {
+        this.request = request;
+        this.addr = addr;
+        this.protocol = protocol;
+        this.ended = false;
+        this.tries = 0;
+        this.onResponse = new Event();
+        /**
+       * Accept a matching authenticated non-error response from the expected
+       * remote address. Wrong address, missing MESSAGE-INTEGRITY (when required),
+       * or non-success class is rejected without completing the transaction
+       * (wrong address / unauthenticated responses are ignored so we keep waiting).
+       */
+        this.responseReceived = (message, addr) => {
+            if (this.ended || this.onResponse.length === 0) {
+                return;
+            }
+            // RFC 7675 / ICE: only responses from the request's transport address.
+            if (!addressEquals(this.expectedAddr, addr)) {
+                log('ignore STUN response from unexpected address', addr, 'expected', this.expectedAddr);
+                return;
+            }
+            // RFC 7675 authenticated consent: integrityKey requires MESSAGE-INTEGRITY.
+            // Wire HMAC is verified by protocol layers via parseMessage(data, key);
+            // this presence check is defense-in-depth if responseReceived is called
+            // with a constructed Message that skipped the wire re-parse path.
+            if (this.integrityKey) {
+                const hasIntegrity = message.attributesKeys.includes('MESSAGE-INTEGRITY') ||
+                    message.attributesKeys.includes('MESSAGE-INTEGRITY-SHA256');
+                if (!hasIntegrity && !isChallenge(message)) {
+                    log('ignore unauthenticated STUN response (MESSAGE-INTEGRITY required)');
+                    return;
+                }
+            }
+            if (message.messageClass === classes.RESPONSE) {
+                this.onResponse.execute(message, addr);
+                this.onResponse.complete();
+            }
+            else {
+                // ERROR class or other non-success
+                this.onResponse.error(new TransactionFailed(message, addr));
+            }
+        };
+        this.run = async () => {
+            try {
+                if (this.signal?.aborted) {
+                    throw new TransactionTimeout();
+                }
+                this.attachAbortListener();
+                this.retry().catch((e) => {
+                    log('retry failed', e);
+                });
+                const res = await this.onResponse.asPromise();
+                return res;
+            }
+            finally {
+                this.cancel();
+            }
+        };
+        this.retry = async () => {
+            while (this.tries < this.triesMax && !this.ended) {
+                this.onRequestSent?.(this.tries);
+                this.protocol.sendStun(this.request, this.addr).catch((e) => {
+                    log('send stun failed', e);
+                    if (this.failOnSendError) {
+                        this.fail(e);
+                    }
+                });
+                await this.wait(this.timeoutDelay);
+                if (this.ended) {
+                    break;
+                }
+                this.timeoutDelay *= 2;
+                this.tries++;
+            }
+            if (this.tries >= this.triesMax && !this.ended) {
+                log(`retry failed times:${this.tries} maxLimit:${this.triesMax}`);
+                this.failWithTimeout();
+            }
+        };
+        const options = normalizeTransactionOptions(retransmissionsOrOptions, onRequestSent);
+        // triesMax = initial send + retransmissions
+        this.triesMax = 1 + (options.retransmissions ?? RETRY_MAX);
+        // responseTimeout is independent of retransmission count (RFC 7675 / 8445)
+        this.timeoutDelay = options.responseTimeout ?? RETRY_RTO;
+        this.onRequestSent = options.onRequestSent;
+        this.signal = options.signal;
+        this.failOnSendError = options.failOnSendError ?? false;
+        this.expectedAddr = addr;
+        this.integrityKey = options.integrityKey;
+    }
+    attachAbortListener() {
+        if (!this.signal) {
+            return;
+        }
+        this.onAbort = () => {
+            this.failWithTimeout();
+        };
+        this.signal.addEventListener('abort', this.onAbort, { once: true });
+    }
+    failWithTimeout() {
+        this.fail(new TransactionTimeout());
+    }
+    fail(error) {
+        if (this.ended) {
+            return;
+        }
+        this.ended = true;
+        this.clearWait();
+        if (this.onResponse.length > 0) {
+            this.onResponse.error(error);
+        }
+    }
+    clearWait() {
+        if (this.waitTimer !== undefined) {
+            clearTimeout(this.waitTimer);
+            this.waitTimer = undefined;
+        }
+        const resolve = this.waitResolve;
+        this.waitResolve = undefined;
+        resolve?.();
+    }
+    wait(ms) {
+        return new Promise((resolve) => {
+            if (this.ended || this.signal?.aborted) {
+                resolve();
+                return;
+            }
+            this.waitResolve = resolve;
+            this.waitTimer = setTimeout(() => {
+                this.waitTimer = undefined;
+                this.waitResolve = undefined;
+                resolve();
+            }, ms);
+        });
+    }
+    cancel() {
+        this.ended = true;
+        this.clearWait();
+        if (this.signal && this.onAbort) {
+            this.signal.removeEventListener('abort', this.onAbort);
+            this.onAbort = undefined;
+        }
+    }
+}
+/**
+ * Whether an error response is a challenge of long-term credentials: a 401
+ * or 438 (Stale Nonce) with a new NONCE. A server cannot protect it with the
+ * key of the nonce it rejects, so it comes without MESSAGE-INTEGRITY and the
+ * client retries with the new nonce (RFC 8489, section 9.2.5).
+ */
+export function isChallenge(message) {
+    if (message.messageClass !== classes.ERROR || !message.getAttributeValue('NONCE')) {
+        return false;
+    }
+    const [code] = message.getAttributeValue('ERROR-CODE') ?? [];
+    return code === 401 || code === 438;
+}
+/**
+ * Build Transaction options for Protocol.request, folding integrityKey into
+ * options so response path can re-verify MESSAGE-INTEGRITY.
+ */
+export function buildTransactionOptions(integrityKey, retransmissionsOrOptions, onRequestSent) {
+    const options = normalizeTransactionOptions(retransmissionsOrOptions, onRequestSent);
+    if (integrityKey && !options.integrityKey) {
+        options.integrityKey = integrityKey;
+    }
+    return options;
+}

package/dist/esm/lib/ice/turn/frame.js

@@ -0,0 +1 @@
+export * from '../../turn/turn/frame.js';