@onekeyfe/react-native-sni-connect 3.0.71 → 3.0.72

package/ios/SniConnectCore.swift

@@ -0,0 +1,228 @@
+import Foundation
+
+enum SniConnectCoreDiagnostics {
+  static var warnSink: ((String) -> Void)?
+
+  static func warn(_ message: String) {
+    warnSink?(message)
+  }
+
+  static func event(_ name: String, _ fields: [(String, Any?)]) -> String {
+    let normalizedFields: [(String, Any?)] = [("event", name)] + fields
+    return normalizedFields
+      .map { key, value in "\(key)=\(sanitize(value))" }
+      .joined(separator: " ")
+  }
+
+  static func shortHash(_ value: String?) -> String {
+    guard let value, !value.isEmpty else {
+      return "none"
+    }
+
+    var hash: UInt64 = 1_469_598_103_934_665_603
+    for byte in value.utf8 {
+      hash ^= UInt64(byte)
+      hash &*= 1_099_511_628_211
+    }
+    return String(String(format: "%016llx", hash).prefix(12))
+  }
+
+  private static func sanitize(_ value: Any?) -> String {
+    guard let value else {
+      return "none"
+    }
+    return String(describing: value)
+      .replacingOccurrences(of: "\n", with: "_")
+      .replacingOccurrences(of: "\r", with: "_")
+      .replacingOccurrences(of: " ", with: "_")
+  }
+}
+
+struct SniConnectResolverConfig: Equatable {
+  let hostname: String
+  let ip: String
+}
+
+enum SniConnectCoreError: Error {
+  case resourceLimit(String)
+}
+
+final class SniConnectPinnedResolverRegistry {
+  static let defaultMaxEntries = 32
+
+  private let maxEntries: Int
+  private var classesByKey: [String: AnyClass] = [:]
+  private var configsByClassName: [String: SniConnectResolverConfig] = [:]
+  private var referenceCountsByKey: [String: Int] = [:]
+  private var reusableClasses: [AnyClass] = []
+  private var allocatedClassNames: Set<String> = []
+
+  init(maxEntries: Int = SniConnectPinnedResolverRegistry.defaultMaxEntries) {
+    self.maxEntries = maxEntries
+  }
+
+  var entryCount: Int {
+    classesByKey.count
+  }
+
+  var allocatedClassCount: Int {
+    allocatedClassNames.count
+  }
+
+  func resolverClass(
+    hostname: String,
+    ip: String,
+    allocateClass: () -> AnyClass
+  ) throws -> AnyClass {
+    let normalizedHost = hostname.lowercased()
+    let key = Self.key(hostname: normalizedHost, ip: ip)
+    if let resolverClass = classesByKey[key] {
+      referenceCountsByKey[key, default: 0] += 1
+      return resolverClass
+    }
+
+    guard classesByKey.count < maxEntries else {
+      throw SniConnectCoreError.resourceLimit("Too many cached SNI resolver entries")
+    }
+
+    let resolverClass: AnyClass = reusableClasses.popLast() ?? allocateClass()
+    let className = NSStringFromClass(resolverClass)
+    allocatedClassNames.insert(className)
+    classesByKey[key] = resolverClass
+    configsByClassName[className] = SniConnectResolverConfig(hostname: normalizedHost, ip: ip)
+    referenceCountsByKey[key] = 1
+    return resolverClass
+  }
+
+  func resolve(domain: String, resolverClass: AnyClass) -> String? {
+    guard let config = configsByClassName[NSStringFromClass(resolverClass)] else {
+      return nil
+    }
+    guard domain.caseInsensitiveCompare(config.hostname) == .orderedSame else {
+      SniConnectCoreDiagnostics.warn(SniConnectCoreDiagnostics.event("sni_pinned_dns_unexpected_host", [
+        ("expectedHost", config.hostname),
+        ("requestedHostHash", SniConnectCoreDiagnostics.shortHash(domain.lowercased())),
+        ("result", "fail_closed"),
+      ]))
+      return nil
+    }
+    return config.ip
+  }
+
+  func release(hostname: String, ip: String) {
+    let key = Self.key(hostname: hostname.lowercased(), ip: ip)
+    guard let referenceCount = referenceCountsByKey[key] else {
+      return
+    }
+    if referenceCount > 1 {
+      referenceCountsByKey[key] = referenceCount - 1
+      return
+    }
+
+    referenceCountsByKey.removeValue(forKey: key)
+    guard let resolverClass = classesByKey.removeValue(forKey: key) else {
+      return
+    }
+    configsByClassName.removeValue(forKey: NSStringFromClass(resolverClass))
+    reusableClasses.append(resolverClass)
+  }
+
+  func clear() {
+    reusableClasses.append(contentsOf: classesByKey.values)
+    classesByKey.removeAll()
+    configsByClassName.removeAll()
+    referenceCountsByKey.removeAll()
+  }
+
+  private static func key(hostname: String, ip: String) -> String {
+    return "\(hostname)|\(ip)"
+  }
+}
+
+enum SniConnectResponseText {
+  static func decode(_ data: Data) -> String {
+    guard !data.isEmpty else {
+      return ""
+    }
+    if let text = String(data: data, encoding: .utf8) {
+      return text
+    }
+    return String(decoding: data, as: UTF8.self)
+  }
+}
+
+enum SniConnectTimeout: Error, Equatable {
+  case deadlineExceeded
+}
+
+enum SniConnectWallClockDeadline {
+  static func run<T>(
+    timeoutMilliseconds: TimeInterval,
+    operation: @escaping @Sendable () async throws -> T
+  ) async throws -> T {
+    let timeoutNanoseconds = UInt64(max(1.0, timeoutMilliseconds) * 1_000_000.0)
+    return try await withThrowingTaskGroup(of: T.self) { group in
+      group.addTask {
+        try await operation()
+      }
+      group.addTask {
+        try await Task.sleep(nanoseconds: timeoutNanoseconds)
+        throw SniConnectTimeout.deadlineExceeded
+      }
+
+      do {
+        guard let result = try await group.next() else {
+          throw SniConnectTimeout.deadlineExceeded
+        }
+        group.cancelAll()
+        return result
+      } catch {
+        group.cancelAll()
+        throw error
+      }
+    }
+  }
+}
+
+struct SniConnectHeaderMaps: Equatable {
+  let singleValueHeaders: [String: String]
+  let multiValueHeaders: [String: [String]]
+}
+
+enum SniConnectResponseHeaders {
+  static func make(rawHeaderFields: [(name: String, value: String)]) -> SniConnectHeaderMaps {
+    var singleValueHeaders: [String: String] = [:]
+    var multiValueHeaders: [String: [String]] = [:]
+
+    for header in rawHeaderFields {
+      let name = header.name.lowercased()
+      guard !name.isEmpty else { continue }
+
+      singleValueHeaders[name] = header.value
+      multiValueHeaders[name, default: []].append(header.value)
+    }
+
+    return SniConnectHeaderMaps(
+      singleValueHeaders: singleValueHeaders,
+      multiValueHeaders: multiValueHeaders
+    )
+  }
+
+  static func make(from headerFields: [AnyHashable: Any]) -> SniConnectHeaderMaps {
+    let rawHeaderFields = headerFields.flatMap { key, value -> [(name: String, value: String)] in
+      let name = String(describing: key)
+      return values(from: value).map { (name: name, value: $0) }
+    }
+    return make(rawHeaderFields: rawHeaderFields)
+  }
+
+  private static func values(from value: Any) -> [String] {
+    if let values = value as? [String] {
+      return values
+    }
+    if let values = value as? NSArray {
+      return values.map { String(describing: $0) }
+    }
+    return [String(describing: value)]
+  }
+}

package/ios/SniConnectLog.swift

@@ -20,10 +20,49 @@ enum SniConnectLog {
   static func warn(_ message: String) { dispatch("warn::", message) }
   static func error(_ message: String) { dispatch("error::", message) }
 
+  static func event(_ name: String, _ fields: [(String, Any?)]) -> String {
+    let normalizedFields: [(String, Any?)] = [("event", name)] + fields
+    let pairs = normalizedFields.map { key, value in
+      "\(key)=\(sanitize(value))"
+    }
+    return pairs.joined(separator: " ")
+  }
+
+  static func shortHash(_ value: String?) -> String {
+    guard let value, !value.isEmpty else {
+      return "none"
+    }
+
+    var hash: UInt64 = 1_469_598_103_934_665_603
+    for byte in value.utf8 {
+      hash ^= UInt64(byte)
+      hash &*= 1_099_511_628_211
+    }
+    return String(String(format: "%016llx", hash).prefix(12))
+  }
+
+  static func elapsedMs(since startedAt: Date) -> Int {
+    max(0, Int(Date().timeIntervalSince(startedAt) * 1000))
+  }
+
+  static func ipFamily(_ ip: String) -> String {
+    ip.contains(":") ? "ipv6" : "ipv4"
+  }
+
   private static func dispatch(_ selectorName: String, _ message: String) {
     guard let cls = logClass else { return }
     let sel = NSSelectorFromString(selectorName)
     guard cls.responds(to: sel) else { return }
     _ = cls.perform(sel, with: tag, with: message)
   }
+
+  private static func sanitize(_ value: Any?) -> String {
+    guard let value else {
+      return "none"
+    }
+    return String(describing: value)
+      .replacingOccurrences(of: "\n", with: "_")
+      .replacingOccurrences(of: "\r", with: "_")
+      .replacingOccurrences(of: " ", with: "_")
+  }
 }

package/ios/SniConnectValidation.swift

@@ -15,15 +15,83 @@ enum SniConnectValidation {
     case invalidMethod(String)
     case invalidPath(String)
     case invalidHeader(String)
+    case invalidRequestId(String)
+    case invalidTimeout(Double)
+    case invalidBody
+    case resourceLimit(String)
   }
 
+  static let maxRequestIdBytes = 128
+  static let maxTimeoutMillis = 120_000.0
+  static let maxPathBytes = 8 * 1024
+  static let maxRequestBodyBytes = 1024 * 1024
+  static let maxResponseBodyBytes = 10 * 1024 * 1024
+  static let maxHeaderCount = 64
+  static let maxHeaderNameBytes = 128
+  static let maxHeaderValueBytes = 8 * 1024
+  static let maxTotalHeaderBytes = 32 * 1024
+  static let maxActiveRequests = 64
+  static let maxActiveRequestsPerPair = 16
+
   /// HTTP methods the module is allowed to issue.
   private static let allowedMethods: Set<String> = [
     "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS",
   ]
 
+  private static let moduleOwnedHeaders: Set<String> = [
+    "host",
+    "content-length",
+    "accept-encoding",
+    "x-emascurl-config-id",
+  ]
+
+  private static let unsafeHeaders: Set<String> = [
+    "connection",
+    "keep-alive",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "expect",
+  ]
+
+  private static let headerTokenPattern = "^[!#$%&'*+.^_`|~0-9A-Za-z-]+$"
+
+  static func validateRequestId(_ requestId: String?) throws {
+    guard let requestId = requestId else { return }
+    if requestId.isEmpty ||
+       containsControlCharacters(requestId) ||
+       byteCount(requestId) > maxRequestIdBytes {
+      throw ValidationError.invalidRequestId(requestId)
+    }
+  }
+
+  static func validateTimeout(_ timeout: Double) throws {
+    if !timeout.isFinite || timeout < 1 || timeout > maxTimeoutMillis {
+      throw ValidationError.invalidTimeout(timeout)
+    }
+  }
+
+  static func validateBody(_ body: String?) throws {
+    if let body = body, byteCount(body) > maxRequestBodyBytes {
+      throw ValidationError.invalidBody
+    }
+  }
+
+  static func validateMethodBody(method: String, body: String?) throws {
+    if (method == "GET" || method == "HEAD") && body != nil {
+      throw ValidationError.invalidBody
+    }
+    if (method == "POST" || method == "PUT" || method == "PATCH") && body == nil {
+      throw ValidationError.invalidBody
+    }
+  }
+
   /// Validate and uppercase the HTTP method.
   static func normalizeMethod(_ method: String) throws -> String {
+    if containsControlCharacters(method) {
+      throw ValidationError.invalidMethod(method)
+    }
     let upper = method.trimmingCharacters(in: .whitespacesAndNewlines).uppercased()
     guard allowedMethods.contains(upper) else {
       throw ValidationError.invalidMethod(method)
@@ -41,6 +109,9 @@ enum SniConnectValidation {
     guard hostname.range(of: pattern, options: .regularExpression) != nil else {
       throw ValidationError.invalidHostname(hostname)
     }
+    if parseIPv4(hostname) != nil || parseIPv6(hostname) != nil {
+      throw ValidationError.invalidHostname(hostname)
+    }
   }
 
   /// Validate `path`: must be a relative path/query only. Reject absolute URLs
@@ -51,6 +122,9 @@ enum SniConnectValidation {
     if containsControlCharacters(trimmed) {
       throw ValidationError.invalidPath(path)
     }
+    if byteCount(trimmed) > maxPathBytes {
+      throw ValidationError.invalidPath(path)
+    }
     // Reject anything that looks like it carries a scheme or authority.
     if trimmed.contains("://") || trimmed.hasPrefix("//") {
       throw ValidationError.invalidPath(path)
@@ -67,23 +141,66 @@ enum SniConnectValidation {
   /// Validate header names/values: reject CR/LF/control characters (header
   /// injection) and the Host header (the module sets Host itself).
   static func validateHeaders(_ headers: [String: String]) throws {
+    _ = try normalizeHeaders(headers)
+  }
+
+  static func normalizeHeaders(_ headers: [String: String]) throws -> [String: String] {
+    if headers.count > maxHeaderCount {
+      throw ValidationError.invalidHeader("too many headers")
+    }
+
+    var totalBytes = 0
+    var normalizedHeaders: [String: String] = [:]
     for (key, value) in headers {
-      if key.isEmpty || containsControlCharacters(key) || containsControlCharacters(value) {
+      let keyBytes = byteCount(key)
+      let valueBytes = byteCount(value)
+      totalBytes += keyBytes + valueBytes
+
+      if key.isEmpty ||
+         containsControlCharacters(key) ||
+         containsControlCharacters(value) ||
+         keyBytes > maxHeaderNameBytes ||
+         valueBytes > maxHeaderValueBytes ||
+         key.range(of: headerTokenPattern, options: .regularExpression) == nil {
         throw ValidationError.invalidHeader(key)
       }
+
+      let lowerKey = key.lowercased()
+      if lowerKey.hasPrefix(":") || lowerKey.hasPrefix("proxy-") || unsafeHeaders.contains(lowerKey) {
+        throw ValidationError.invalidHeader(key)
+      }
+      if moduleOwnedHeaders.contains(lowerKey) {
+        continue
+      }
+      normalizedHeaders[key] = value
     }
+    if totalBytes > maxTotalHeaderBytes {
+      throw ValidationError.invalidHeader("headers too large")
+    }
+    return normalizedHeaders
   }
 
   static func containsControlCharacters(_ s: String) -> Bool {
     return s.unicodeScalars.contains { $0.value < 0x20 || $0.value == 0x7F }
   }
 
+  private static func byteCount(_ s: String) -> Int {
+    return s.lengthOfBytes(using: .utf8)
+  }
+
   // MARK: - IP validation
 
   /// Validate `ip` is a literal IPv4/IPv6 address (never a hostname) and routes
   /// to a public/global-unicast destination. Rejects loopback, private,
   /// link-local (incl. 169.254.169.254 metadata), CGNAT, multicast and reserved.
   static func validatePublicIP(_ ip: String) throws {
+    if ip.isEmpty ||
+       ip.trimmingCharacters(in: .whitespacesAndNewlines) != ip ||
+       ip.contains("[") ||
+       ip.contains("]") ||
+       ip.contains("%") {
+      throw ValidationError.invalidIP(ip)
+    }
     if let v4 = parseIPv4(ip) {
       if isForbiddenIPv4(v4) { throw ValidationError.forbiddenIP(ip) }
       return
@@ -142,10 +259,135 @@ enum SniConnectValidation {
     if b[0] == 0xFE && (b[1] & 0xC0) == 0x80 { return true }
     // Unique local fc00::/7
     if (b[0] & 0xFE) == 0xFC { return true }
+    // Discard-only 100::/64
+    if b[0] == 0x01 && b[1] == 0x00 && b[2...7].allSatisfy({ $0 == 0 }) { return true }
+    // IETF protocol assignments that should not be accepted as public endpoints.
+    if b[0] == 0x20 && b[1] == 0x01 {
+      if b[2] == 0x00 && b[3] == 0x00 { return true } // 2001::/32 Teredo
+      if b[2] == 0x00 && (b[3] & 0xF0) == 0x10 { return true } // 2001:10::/28 ORCHID
+      if b[2] == 0x00 && b[3] == 0x02 { return true } // 2001:2::/48 benchmarking
+      if b[2] == 0x0D && b[3] == 0xB8 { return true } // 2001:db8::/32 docs
+    }
+    // 6to4 embeds an IPv4 route target and is deprecated.
+    if b[0] == 0x20 && b[1] == 0x02 { return true }
+    // NAT64 well-known prefix. Allow only when the embedded IPv4 is public.
+    if isNat64WellKnown(b) { return isForbiddenIPv4([b[12], b[13], b[14], b[15]]) }
+    // NAT64 local-use prefix can route through operator-specific private policy.
+    if isNat64LocalUse(b) { return true }
+    // Deprecated IPv4-compatible IPv6 addresses.
+    if b[0...11].allSatisfy({ $0 == 0 }) { return true }
     // IPv4-mapped ::ffff:0:0/96 — validate the embedded IPv4
     if b[0...9].allSatisfy({ $0 == 0 }) && b[10] == 0xFF && b[11] == 0xFF {
       return isForbiddenIPv4([b[12], b[13], b[14], b[15]])
     }
     return false
   }
+
+  private static func isNat64WellKnown(_ b: [UInt8]) -> Bool {
+    return b[0] == 0x00 &&
+      b[1] == 0x64 &&
+      b[2] == 0xFF &&
+      b[3] == 0x9B &&
+      b[4...11].allSatisfy({ $0 == 0 })
+  }
+
+  private static func isNat64LocalUse(_ b: [UInt8]) -> Bool {
+    return b[0] == 0x00 &&
+      b[1] == 0x64 &&
+      b[2] == 0xFF &&
+      b[3] == 0x9B &&
+      b[4] == 0x00 &&
+      b[5] == 0x01
+  }
+}
+
+final class SniConnectRequestLimiter {
+  final class Token {
+    private weak var limiter: SniConnectRequestLimiter?
+    private let key: String
+    private let lock = NSLock()
+    private var released = false
+
+    fileprivate init(limiter: SniConnectRequestLimiter, key: String) {
+      self.limiter = limiter
+      self.key = key
+    }
+
+    func release() {
+      lock.lock()
+      if released {
+        lock.unlock()
+        return
+      }
+      released = true
+      lock.unlock()
+      limiter?.release(key: key)
+    }
+
+    deinit {
+      release()
+    }
+  }
+
+  private let maxActiveRequests: Int
+  private let maxActiveRequestsPerPair: Int
+  private let queue = DispatchQueue(label: "com.onekey.sni.connect.request-limiter")
+  private var activeRequests = 0
+  private var activeRequestsByPair: [String: Int] = [:]
+
+  init(
+    maxActiveRequests: Int = SniConnectValidation.maxActiveRequests,
+    maxActiveRequestsPerPair: Int = SniConnectValidation.maxActiveRequestsPerPair
+  ) {
+    self.maxActiveRequests = maxActiveRequests
+    self.maxActiveRequestsPerPair = maxActiveRequestsPerPair
+  }
+
+  func acquire(hostname: String, ip: String) throws -> Token {
+    let key = pairKey(hostname: hostname, ip: ip)
+    return try queue.sync {
+      if activeRequests >= maxActiveRequests {
+        SniConnectCoreDiagnostics.warn(SniConnectCoreDiagnostics.event("sni_resource_limit", [
+          ("activeCount", activeRequests),
+          ("pairCount", activeRequestsByPair[key] ?? 0),
+          ("limit", maxActiveRequests),
+          ("reason", "max_active_requests"),
+          ("hostname", hostname.lowercased()),
+          ("ipHash", SniConnectCoreDiagnostics.shortHash(ip)),
+        ]))
+        throw SniConnectValidation.ValidationError.resourceLimit("Too many active SNI requests")
+      }
+      let pairCount = activeRequestsByPair[key] ?? 0
+      if pairCount >= maxActiveRequestsPerPair {
+        SniConnectCoreDiagnostics.warn(SniConnectCoreDiagnostics.event("sni_resource_limit", [
+          ("activeCount", activeRequests),
+          ("pairCount", pairCount),
+          ("limit", maxActiveRequestsPerPair),
+          ("reason", "max_active_requests_per_pair"),
+          ("hostname", hostname.lowercased()),
+          ("ipHash", SniConnectCoreDiagnostics.shortHash(ip)),
+        ]))
+        throw SniConnectValidation.ValidationError.resourceLimit("Too many active SNI requests for destination")
+      }
+      activeRequests += 1
+      activeRequestsByPair[key] = pairCount + 1
+      return Token(limiter: self, key: key)
+    }
+  }
+
+  private func release(key: String) {
+    queue.sync {
+      activeRequests = max(0, activeRequests - 1)
+      guard let pairCount = activeRequestsByPair[key] else { return }
+      if pairCount <= 1 {
+        activeRequestsByPair.removeValue(forKey: key)
+      } else {
+        activeRequestsByPair[key] = pairCount - 1
+      }
+    }
+  }
+
+  private func pairKey(hostname: String, ip: String) -> String {
+    return "\(hostname.lowercased())|\(ip)"
+  }
 }