@robota-sdk/agent-transport-webrtc 3.0.0-beta.99 → 3.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robota-sdk/agent-transport-webrtc",
-  "version": "3.0.0-beta.99",
+  "version": "3.0.2",
   "description": "Peer-to-peer WebRTC transport for the Robota SDK (data-channel session bridge for remote control and the device mesh)",
   "type": "module",
   "main": "dist/node/index.js",
@@ -44,11 +44,11 @@
     "multicast-dns": "^7.2.5",
     "nostr-tools": "^2.25.2",
     "ws": "^8.21.1",
-    "@robota-sdk/agent-interface-session": "3.0.0-beta.99",
-    "@robota-sdk/agent-interface-session-mobility": "3.0.0-beta.99",
-    "@robota-sdk/agent-remote-pairing": "3.0.0-beta.99",
-    "@robota-sdk/agent-transport": "3.0.0-beta.99",
-    "@robota-sdk/agent-interface-transport": "3.0.0-beta.99"
+    "@robota-sdk/agent-interface-session-mobility": "3.0.2",
+    "@robota-sdk/agent-interface-session": "3.0.2",
+    "@robota-sdk/agent-remote-pairing": "3.0.2",
+    "@robota-sdk/agent-transport": "3.0.2",
+    "@robota-sdk/agent-interface-transport": "3.0.2"
   },
   "peerDependencies": {
     "node-datachannel": "^0.33.4"

package/src/__tests__/turn-server.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
 
 import { randomBytes } from 'node:crypto';
 import { createSocket } from 'node:dgram';
@@ -211,6 +211,7 @@ describe('TURN server — requests nobody authenticated', () => {
       fingerprint: false,
     });
     expect((await probe(server, [bareBinding])).answers).toEqual([]);
+    expect(server.unauthenticatedSourceCount).toBe(0);
 
     // One the size a WebRTC client sends gets its challenge, no larger than itself.
     const sized = allocateRequest(20);
@@ -218,6 +219,49 @@ describe('TURN server — requests nobody authenticated', () => {
     expect(answers).toHaveLength(1);
     expect(answers[0]!.length).toBeLessThanOrEqual(sized.length);
     expect(readErrorCode(attribute(decodeStun(answers[0]!)!, StunAttr.ErrorCode))).toBe(401);
+    expect(server.unauthenticatedSourceCount).toBe(1);
+  });
+
+  it('globally bounds challenge work even when the response cannot fit the request', async () => {
+    const now = Date.now();
+    const server = await serve({
+      now: () => now,
+      unauthenticatedLimits: { perSourcePerSecond: 100, totalPerSecond: 2 },
+    });
+    const nonce = vi.spyOn(
+      server as unknown as { nonce(client: { address: string; port: number }): string },
+      'nonce',
+    );
+    const bare = allocateRequest(0);
+    expect((await probe(server, Array.from({ length: 10 }, () => bare))).answers).toEqual([]);
+    expect(nonce).not.toHaveBeenCalled();
+    expect(server.unauthenticatedSourceCount).toBe(0);
+  });
+
+  it('does not let a saturated source consume the global challenge budget', async () => {
+    const now = Date.now();
+    const server = await serve({
+      now: () => now,
+      unauthenticatedLimits: { perSourcePerSecond: 1, totalPerSecond: 2 },
+    });
+    const internals = server as unknown as {
+      challenge(request: ReturnType<typeof decodeStun>, to: { address: string; port: number }, code: 401): void;
+      nonce(client: { address: string; port: number }): string;
+      send(bytes: Buffer, to: { address: string; port: number }): void;
+    };
+    const request = decodeStun(allocateRequest(20));
+    const undersized = decodeStun(allocateRequest(0));
+    if (!request) throw new Error('expected a valid allocate request');
+    if (!undersized) throw new Error('expected a valid undersized allocate request');
+    const nonce = vi.spyOn(internals, 'nonce');
+    vi.spyOn(internals, 'send').mockImplementation(() => undefined);
+    for (let index = 0; index < 10; index += 1) {
+      internals.challenge(undersized, { address: '192.0.2.3', port: 1000 + index }, 401);
+    }
+    internals.challenge(request, { address: '192.0.2.1', port: 1000 }, 401);
+    internals.challenge(request, { address: '192.0.2.1', port: 1001 }, 401);
+    internals.challenge(request, { address: '192.0.2.2', port: 1000 }, 401);
+    expect(nonce).toHaveBeenCalledTimes(2);
   });
 
   it('are answered at a limited rate per source address and in all; the rest are dropped', async () => {
@@ -229,8 +273,13 @@ describe('TURN server — requests nobody authenticated', () => {
       now: () => now,
       unauthenticatedLimits: { perSourcePerSecond: 3, totalPerSecond: 100 },
     });
+    const nonce = vi.spyOn(
+      perSource as unknown as { nonce(client: { address: string; port: number }): string },
+      'nonce',
+    );
     expect((await probe(perSource, burst)).answers).toHaveLength(3);
     expect((await probe(perSource, burst)).answers).toHaveLength(0);
+    expect(nonce).toHaveBeenCalledTimes(3);
 
     const inAll = await serve({
       now: () => now,

package/src/turn-server.ts

@@ -374,6 +374,11 @@ export class TurnServer {
     return count;
   }
 
+  /** Diagnostics only: unauthenticated source buckets retained in the current answer window. */
+  public get unauthenticatedSourceCount(): number {
+    return this.answerBuckets.size;
+  }
+
   /**
    * Close every allocation whose owner is not one of `owners`, and allocate for these owners only
    * from now on — also for a request whose authorization was answered before this call.
@@ -486,26 +491,30 @@ export class TurnServer {
     request: IStunMessage,
     to: ITransportAddress,
     cls: TStunClass,
+    minimumAnswerBytes: number,
     attrs: () => { type: number; value: Buffer }[],
   ): void {
     const now = this.now();
-    const total = (this.answerBudget ??= { tokens: this.limits.totalPerSecond, at: now });
-    const source = this.answerBuckets.get(to.address) ?? {
-      tokens: this.limits.perSourcePerSecond,
-      at: now,
-    };
-    this.answerBuckets.set(to.address, source);
-    // No answer is smaller than this: a request below it is dropped before any work.
-    if (request.raw.length < MIN_ANSWER_BYTES) return;
-    // Both budgets are checked before anything is computed, and charged only for an answer sent.
+    // Refuse requests that can never carry an answer before retaining any attacker-selected key.
+    if (request.raw.length < minimumAnswerBytes) return;
+    // Check an existing source before doing nonce/HMAC and encoding work. A new source stays
+    // allocation-free until its answer is known to fit the anti-amplification boundary below.
+    const existing = this.answerBuckets.get(to.address);
+    const source = existing ?? { tokens: this.limits.perSourcePerSecond, at: now };
     if (!refill(source, this.limits.perSourcePerSecond, now)) return;
+    const total = (this.answerBudget ??= { tokens: this.limits.totalPerSecond, at: now });
+    // The global budget is allocation-free: once exhausted, new source identities retain nothing.
     if (!refill(total, this.limits.totalPerSecond, now)) return;
+    // Charge every attempt that can reach nonce/HMAC generation, even when the encoded response is
+    // later rejected by the anti-amplification boundary. Otherwise a deliberately undersized request
+    // gets unlimited cryptographic work without ever spending an answer token.
+    total.tokens -= 1;
     const response = encodeStun(request.method, cls, request.transactionId, attrs(), {
       fingerprint: false,
     });
     if (response.length > request.raw.length) return;
+    if (existing === undefined) this.answerBuckets.set(to.address, source);
     source.tokens -= 1;
-    total.tokens -= 1;
     this.send(response, to);
   }
 
@@ -514,16 +523,21 @@ export class TurnServer {
     request: IStunMessage,
     to: ITransportAddress,
     code: number,
+    extraBytes = 0,
     extra: () => { type: number; value: Buffer }[] = () => [],
   ): void {
-    this.answerUnauthenticated(request, to, StunClass.Error, () => [
-      { type: StunAttr.ErrorCode, value: errorCode(code, '') },
-      ...extra(),
-    ]);
+    this.answerUnauthenticated(
+      request,
+      to,
+      StunClass.Error,
+      MIN_ANSWER_BYTES + extraBytes,
+      () => [{ type: StunAttr.ErrorCode, value: errorCode(code, '') }, ...extra()],
+    );
   }
 
   private challenge(request: IStunMessage, to: ITransportAddress, code: 401 | 438): void {
-    this.refuseUnauthenticated(request, to, code, () => [
+    const paddedRealmBytes = Math.ceil(Buffer.byteLength(this.realm) / 4) * 4;
+    this.refuseUnauthenticated(request, to, code, 4 + paddedRealmBytes + 4 + 16, () => [
       { type: StunAttr.Realm, value: Buffer.from(this.realm) },
       { type: StunAttr.Nonce, value: Buffer.from(this.nonce(to)) },
     ]);
@@ -601,9 +615,16 @@ export class TurnServer {
   private async request(request: IStunMessage, rinfo: RemoteInfo): Promise<void> {
     const client: ITransportAddress = { address: rinfo.address, port: rinfo.port };
     if (request.method === StunMethod.Binding) {
-      this.answerUnauthenticated(request, client, StunClass.Success, () => [
-        { type: StunAttr.XorMappedAddress, value: encodeXorAddress(client, request.transactionId) },
-      ]);
+      const addressBytes = isIPv4(client.address) ? 8 : 20;
+      this.answerUnauthenticated(
+        request,
+        client,
+        StunClass.Success,
+        20 + 4 + addressBytes,
+        () => [
+          { type: StunAttr.XorMappedAddress, value: encodeXorAddress(client, request.transactionId) },
+        ],
+      );
       return;
     }
     const known: number[] = [