@otto-code/relay 0.8.19 → 0.9.0

package/dist/cloudflare-adapter.d.ts

@@ -46,6 +46,13 @@ export declare class RelayDurableObject {
     private hasServerDataSocket;
     private hasClientSocket;
     private closeExistingServerSockets;
+    private hasClientCapacity;
+    private validateV2Admission;
+    /**
+     * Count opaque frames without inspecting them. The counter is part of the
+     * hibernatable socket attachment so a wake/sleep cycle cannot reset a flood.
+     */
+    private consumeMessageAllowance;
     private handleControlKeepalive;
     private nudgeOrResetControlForConnection;
     private frameByteSize;

package/dist/cloudflare-adapter.js

@@ -29,6 +29,12 @@ const CURRENT_RELAY_VERSION = "2";
 const MAX_PENDING_FRAMES_PER_CONNECTION = 200;
 const MAX_PENDING_BYTES_PER_CONNECTION = 1024 * 1024; // fits one max-size (1 MiB) frame
 const MAX_PENDING_BYTES_TOTAL = 16 * 1024 * 1024; // across all connectionIds in this DO
+const MAX_ROUTE_KEY_BYTES = 256;
+const MAX_CLIENT_SOCKETS_PER_SESSION = 4;
+const DATA_MESSAGE_WINDOW_MS = 10000;
+const MAX_DATA_MESSAGES_PER_WINDOW = 200;
+const CONTROL_MESSAGE_WINDOW_MS = 60000;
+const MAX_CONTROL_MESSAGES_PER_WINDOW = 6;
 function resolveRelayVersion(rawValue) {
     if (rawValue == null)
         return LEGACY_RELAY_VERSION;
@@ -71,6 +77,13 @@ function getString(record, key) {
     const value = record[key];
     return typeof value === "string" ? value : undefined;
 }
+function getFiniteNumber(record, key) {
+    const value = record[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function utf8ByteLength(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
 function getGlobalWebSocketPair() {
     // Access WebSocketPair from global scope (Cloudflare Workers runtime)
     // Use Reflect to access global property without type assertions
@@ -136,6 +149,53 @@ export class RelayDurableObject {
             }
         }
     }
+    hasClientCapacity() {
+        return this.state.getWebSockets("client").length < MAX_CLIENT_SOCKETS_PER_SESSION;
+    }
+    validateV2Admission(role, resolvedConnectionId) {
+        // A real daemon only opens a v2 data socket after the client socket has
+        // connected and its control notification has been delivered. Refusing an
+        // orphan data socket eliminates an otherwise unbounded fake-socket shape.
+        if (role === "server" && resolvedConnectionId && !this.hasClientSocket(resolvedConnectionId)) {
+            return new Response("No matching client connection", { status: 409 });
+        }
+        if (role === "client" && !this.hasClientCapacity()) {
+            return new Response("Relay session client capacity reached", { status: 429 });
+        }
+        return undefined;
+    }
+    /**
+     * Count opaque frames without inspecting them. The counter is part of the
+     * hibernatable socket attachment so a wake/sleep cycle cannot reset a flood.
+     */
+    consumeMessageAllowance(ws, attachment) {
+        const connectionId = getString(attachment, "connectionId");
+        const version = getString(attachment, "version") ?? LEGACY_RELAY_VERSION;
+        // v1 has no separate control channel: both roles carry opaque relay data.
+        const isControl = version === CURRENT_RELAY_VERSION && attachment.role === "server" && !connectionId;
+        const windowMs = isControl ? CONTROL_MESSAGE_WINDOW_MS : DATA_MESSAGE_WINDOW_MS;
+        const maxMessages = isControl ? MAX_CONTROL_MESSAGES_PER_WINDOW : MAX_DATA_MESSAGES_PER_WINDOW;
+        const now = Date.now();
+        const windowStartedAt = Math.floor(now / windowMs) * windowMs;
+        const previousWindowStartedAt = getFiniteNumber(attachment, "rateWindowStartedAt");
+        const previousCount = getFiniteNumber(attachment, "rateWindowMessageCount") ?? 0;
+        const count = previousWindowStartedAt === windowStartedAt ? previousCount : 0;
+        if (count >= maxMessages) {
+            try {
+                ws.close(1013, "Relay message rate exceeded");
+            }
+            catch {
+                // ignore
+            }
+            return false;
+        }
+        serializeAttachment(ws, {
+            ...attachment,
+            rateWindowStartedAt: windowStartedAt,
+            rateWindowMessageCount: count + 1,
+        });
+        return true;
+    }
     // COMPAT(relay-json-ping): Old daemons (< v0.1.76) send JSON {type:"ping"} on the control
     // socket and rely on a JSON {type:"pong"} reply to keep controlLastSeenAt fresh. New daemons
     // use WebSocket protocol pings (auto-answered at the edge, DO stays hibernated). Remove this
@@ -309,6 +369,9 @@ export class RelayDurableObject {
             : connectionId;
         const isServerControl = role === "server" && !resolvedConnectionId;
         const isServerData = role === "server" && !!resolvedConnectionId;
+        const admissionError = this.validateV2Admission(role, resolvedConnectionId);
+        if (admissionError)
+            return admissionError;
         // Close any existing server-side connection with the same identity.
         // - server-control: single per serverId
         // - server-data: single per connectionId
@@ -395,6 +458,9 @@ export class RelayDurableObject {
             return;
         }
         const attachment = attachmentRaw;
+        if (!this.consumeMessageAllowance(ws, attachment)) {
+            return;
+        }
         const version = getString(attachment, "version") ?? LEGACY_RELAY_VERSION;
         if (version === LEGACY_RELAY_VERSION) {
             const targetRole = attachment.role === "server" ? "client" : "server";
@@ -533,6 +599,21 @@ export default {
             if (!serverId) {
                 return new Response("Missing serverId parameter", { status: 400 });
             }
+            if (utf8ByteLength(serverId) > MAX_ROUTE_KEY_BYTES) {
+                return new Response("serverId is too long", { status: 400 });
+            }
+            const connectionId = url.searchParams.get("connectionId");
+            if (connectionId !== null && utf8ByteLength(connectionId) > MAX_ROUTE_KEY_BYTES) {
+                return new Response("connectionId is too long", { status: 400 });
+            }
+            const role = url.searchParams.get("role");
+            if (role !== "server" && role !== "client") {
+                return new Response("Missing or invalid role parameter", { status: 400 });
+            }
+            const upgradeHeader = request.headers.get("Upgrade");
+            if (!upgradeHeader || upgradeHeader.toLowerCase() !== "websocket") {
+                return new Response("Expected WebSocket upgrade", { status: 426 });
+            }
             const version = resolveRelayVersion(url.searchParams.get("v"));
             if (!version) {
                 return new Response("Invalid v parameter (expected 1 or 2)", { status: 400 });

package/dist/crypto.js

@@ -14,6 +14,7 @@
 import nacl from "tweetnacl";
 import { fromByteArray, toByteArray } from "base64-js";
 const NONCE_LENGTH = nacl.box.nonceLength; // 24
+const ZERO_X25519_SHARED_RESULT = new Uint8Array(nacl.box.sharedKeyLength);
 let prngReady = false;
 function getGlobalCrypto() {
     const g = globalThis;
@@ -48,6 +49,18 @@ function encodeBase64(bytes) {
 function decodeBase64(base64) {
     return toByteArray(base64);
 }
+function decodePublicKeyBase64(base64) {
+    if (typeof base64 !== "string" ||
+        base64.length % 4 !== 0 ||
+        !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(base64)) {
+        throw new Error("Invalid public key encoding");
+    }
+    const bytes = decodeBase64(base64);
+    if (encodeBase64(bytes) !== base64) {
+        throw new Error("Invalid public key encoding");
+    }
+    return bytes;
+}
 function toUint8(data) {
     return typeof data === "string" ? new TextEncoder().encode(data) : new Uint8Array(data);
 }
@@ -68,7 +81,7 @@ export function exportPublicKey(publicKey) {
     return encodeBase64(publicKey);
 }
 export function importPublicKey(base64) {
-    const bytes = decodeBase64(base64);
+    const bytes = decodePublicKeyBase64(base64);
     if (bytes.byteLength !== nacl.box.publicKeyLength) {
         throw new Error(`Invalid public key length (expected ${nacl.box.publicKeyLength})`);
     }
@@ -94,6 +107,12 @@ export function deriveSharedKey(ourSecretKey, peerPublicKey) {
     if (peerPublicKey.byteLength !== nacl.box.publicKeyLength) {
         throw new Error(`Invalid peer public key length (expected ${nacl.box.publicKeyLength})`);
     }
+    const rawSharedResult = nacl.scalarMult(ourSecretKey, peerPublicKey);
+    const isAllZero = nacl.verify(rawSharedResult, ZERO_X25519_SHARED_RESULT);
+    rawSharedResult.fill(0);
+    if (isAllZero) {
+        throw new Error("Invalid peer public key");
+    }
     return nacl.box.before(peerPublicKey, ourSecretKey);
 }
 /**

package/dist/types.d.ts

@@ -23,5 +23,12 @@ export interface RelaySessionAttachment {
      */
     connectionId?: string | null;
     createdAt: number;
+    /**
+     * Ephemeral per-socket message allowance. This travels with Cloudflare's
+     * hibernatable WebSocket attachment only; it is neither user identity nor
+     * relay history and disappears when the socket closes.
+     */
+    rateWindowStartedAt?: number;
+    rateWindowMessageCount?: number;
 }
 //# sourceMappingURL=types.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-code/relay",
-  "version": "0.8.19",
+  "version": "0.9.0",
   "description": "Otto relay for bridging daemon and client connections",
   "license": "AGPL-3.0-or-later",
   "files": [