@livedesk/hub 0.1.34 → 0.1.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/src/transport/secure-direct-acceptor.js

@@ -17,10 +17,18 @@ const HANDSHAKE_TIMEOUT_MS = 5_000;
 const REPLAY_TTL_MS = 2 * 60 * 1000;
 const MAX_REPLAY_ENTRIES = 8192;
 const DEFAULT_MAX_PENDING_HANDSHAKES = 128;
-const DEFAULT_MAX_CONNECTIONS_PER_IP_PER_MINUTE = 60;
+// One Client can open control, frame, input, file, and audio channels.
+// A 200-computer site behind one NAT can therefore legitimately create
+// more than 1,000 authenticated handshakes during a coordinated restart.
+// Keep a generous raw-IP burst ceiling; actual abuse blocking below is
+// failure-scoped by device whenever a stable device id is available.
+const DEFAULT_MAX_CONNECTIONS_PER_IP_PER_MINUTE = 2400;
 const DEFAULT_MAX_CONSECUTIVE_FAILURES = 8;
 const DEFAULT_IP_BLOCK_MS = 60_000;
 const MAX_TRACKED_IPS = 4096;
+const MAX_TRACKED_DEVICE_FAILURES = 16384;
+const BLOCKED_IP_RECOVERY_PROBE_MS = 2_000;
+const IP_SCOPED_FAILURES = new Set(['secure-handshake-json-invalid', 'secure-handshake-too-large']);
 
 function directError(code) {
   const error = new Error(code);
@@ -60,6 +68,26 @@ function safeHandshakeError(error) {
   const code = clean(error?.code || error?.message, 100).toLowerCase();
   return /^[-a-z0-9]+$/.test(code) ? code : 'secure-handshake-rejected';
 }
+function normalizeIpAddress(value) {
+  return clean(value, 100).replace(/^::ffff:/, '').toLowerCase() || 'unknown';
+}
+
+function isPrivateNetworkAddress(value) {
+  const address = normalizeIpAddress(value);
+  if (address === '127.0.0.1' || address === '::1' || address === 'localhost') return true;
+  if (address.startsWith('fe80:') || address.startsWith('fc') || address.startsWith('fd')) return true;
+  const parts = address.split('.').map(part => Number(part));
+  return parts.length === 4
+    && parts.every(part => Number.isInteger(part) && part >= 0 && part <= 255)
+    && (parts[0] === 10
+      || (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+      || (parts[0] === 192 && parts[1] === 168));
+}
+
+function failureOwnerKey(ip, deviceId) {
+  const normalizedDeviceId = clean(deviceId, 128);
+  return normalizedDeviceId ? `${normalizeIpAddress(ip)}|${normalizedDeviceId}` : '';
+}
 
 export function createSecureDirectAcceptor({
   authority,
@@ -77,6 +105,7 @@ export function createSecureDirectAcceptor({
   }
   const replayCache = new Map();
   const ipStates = new Map();
+  const deviceFailureStates = new Map();
   const maxPendingHandshakes = Math.max(1, Number(abuseLimits.maxPendingHandshakes)
     || DEFAULT_MAX_PENDING_HANDSHAKES);
   const maxConnectionsPerIpPerMinute = Math.max(1, Number(abuseLimits.maxConnectionsPerIpPerMinute)
@@ -93,10 +122,13 @@ export function createSecureDirectAcceptor({
   let capacityRejections = 0;
   let rateLimitRejections = 0;
   let blockedIpRejections = 0;
+  let blockedDeviceRejections = 0;
+  let compatibilityRejections = 0;
+  let recoveryProbeAdmissions = 0;
   let probeClosures = 0;
 
   function remoteAddress(rawSocket) {
-    return clean(rawSocket?.remoteAddress, 100).replace(/^::ffff:/, '') || 'unknown';
+    return normalizeIpAddress(rawSocket?.remoteAddress);
   }
 
   function pruneIpStates(current) {
@@ -121,6 +153,7 @@ export function createSecureDirectAcceptor({
         connectionCount: 0,
         consecutiveFailures: 0,
         blockedUntil: 0,
+        nextRecoveryProbeAt: 0,
         lastSeenAt: current
       };
       ipStates.set(ip, state);
@@ -133,11 +166,51 @@ export function createSecureDirectAcceptor({
     return state;
   }
 
+  function pruneDeviceFailureStates(current) {
+    for (const [key, state] of deviceFailureStates) {
+      if (current - state.lastSeenAt >= Math.max(ipBlockMs * 2, 5 * 60_000)) {
+        deviceFailureStates.delete(key);
+      }
+    }
+    while (deviceFailureStates.size > MAX_TRACKED_DEVICE_FAILURES) {
+      const oldest = deviceFailureStates.keys().next().value;
+      if (!oldest) break;
+      deviceFailureStates.delete(oldest);
+    }
+  }
+
+  function getDeviceFailureState(ip, deviceId, current) {
+    const key = failureOwnerKey(ip, deviceId);
+    if (!key) return null;
+    pruneDeviceFailureStates(current);
+    let state = deviceFailureStates.get(key);
+    if (!state) {
+      state = { consecutiveFailures: 0, blockedUntil: 0, lastSeenAt: current };
+      deviceFailureStates.set(key, state);
+    }
+    state.lastSeenAt = current;
+    return state;
+  }
+
+  function deviceAdmissionError(ip, deviceId, current) {
+    const state = getDeviceFailureState(ip, deviceId, current);
+    if (state?.blockedUntil > current) {
+      blockedDeviceRejections += 1;
+      return 'secure-device-temporarily-blocked';
+    }
+    return '';
+  }
+
   function admissionError(ip, current) {
     const state = getIpState(ip, current);
     if (state.blockedUntil > current) {
-      blockedIpRejections += 1;
-      return 'secure-ip-temporarily-blocked';
+      if (state.nextRecoveryProbeAt <= current) {
+        state.nextRecoveryProbeAt = current + BLOCKED_IP_RECOVERY_PROBE_MS;
+        recoveryProbeAdmissions += 1;
+      } else {
+        blockedIpRejections += 1;
+        return 'secure-ip-temporarily-blocked';
+      }
     }
     if (pendingHandshakes >= maxPendingHandshakes) {
       capacityRejections += 1;
@@ -151,18 +224,39 @@ export function createSecureDirectAcceptor({
     return '';
   }
 
-  function recordFailure(ip, current) {
+  function recordFailure(ip, deviceId, code, current) {
+    if (code === 'secure-client-hello-required' && isPrivateNetworkAddress(ip)) {
+      compatibilityRejections += 1;
+      return;
+    }
+    const deviceState = !IP_SCOPED_FAILURES.has(code)
+      ? getDeviceFailureState(ip, deviceId, current)
+      : null;
+    if (deviceState) {
+      deviceState.consecutiveFailures += 1;
+      if (deviceState.consecutiveFailures >= maxConsecutiveFailures) {
+        deviceState.blockedUntil = Math.max(deviceState.blockedUntil, current + ipBlockMs);
+      }
+      return;
+    }
     const state = getIpState(ip, current);
     state.consecutiveFailures += 1;
     if (state.consecutiveFailures >= maxConsecutiveFailures) {
       state.blockedUntil = Math.max(state.blockedUntil, current + ipBlockMs);
+      state.nextRecoveryProbeAt = current + BLOCKED_IP_RECOVERY_PROBE_MS;
     }
   }
 
-  function recordSuccess(ip, current) {
+  function recordSuccess(ip, deviceId, current) {
     const state = getIpState(ip, current);
     state.consecutiveFailures = 0;
     state.blockedUntil = 0;
+    state.nextRecoveryProbeAt = 0;
+    const deviceState = getDeviceFailureState(ip, deviceId, current);
+    if (deviceState) {
+      deviceState.consecutiveFailures = 0;
+      deviceState.blockedUntil = 0;
+    }
   }
 
   function rejectSocket(rawSocket, code, ip, observedDeviceId = '') {
@@ -360,12 +454,12 @@ export function createSecureDirectAcceptor({
       settled = true;
       cleanup();
       const code = safeHandshakeError(error);
-      if (code === 'secure-handshake-closed' && bytes === 0) {
+      if ((code === 'secure-handshake-closed' || code === 'secure-handshake-timeout') && bytes === 0) {
         probeClosures += 1;
         try { rawSocket.destroy(); } catch {}
         return;
       }
-      recordFailure(ip, Math.floor(now()));
+      recordFailure(ip, observedDeviceId, code, Math.floor(now()));
       rejectSocket(rawSocket, code, ip, observedDeviceId);
     };
 
@@ -390,7 +484,12 @@ export function createSecureDirectAcceptor({
       let hello;
       try {
         hello = JSON.parse(combined.subarray(0, newline).toString('utf8'));
-        observedDeviceId = clean(hello?.deviceId, 128);
+        observedDeviceId = clean(hello?.deviceId, 128);        const deviceDenied = deviceAdmissionError(ip, observedDeviceId, Math.floor(now()));
+        if (deviceDenied) {
+          settled = false;
+          fail(directError(deviceDenied));
+          return;
+        }
       } catch {
         settled = false;
         fail(directError('secure-handshake-json-invalid'));
@@ -398,7 +497,7 @@ export function createSecureDirectAcceptor({
       }
       try {
         handleHello(rawSocket, hello, combined.subarray(newline + 1));
-        recordSuccess(ip, Math.floor(now()));
+        recordSuccess(ip, observedDeviceId, Math.floor(now()));
       } catch (error) {
         // settled is reset only for the common failure path so it can emit the
         // bounded rejection response and release the raw socket.
@@ -424,9 +523,13 @@ export function createSecureDirectAcceptor({
       replayRejections,
       pendingHandshakes,
       trackedIpCount: ipStates.size,
+      trackedDeviceFailureCount: deviceFailureStates.size,
       capacityRejections,
       rateLimitRejections,
       blockedIpRejections,
+      blockedDeviceRejections,
+      compatibilityRejections,
+      recoveryProbeAdmissions,
       probeClosures,
       limits: {
         maxPendingHandshakes,