@sproutboat/runtime 0.42.0 → 0.42.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @sproutboat/runtime
 
+## 0.42.1
+
+### Patch Changes
+
+- dbba349: fetch() and connect() now also refuse reserved space that carries no public service: AS112 and the old IPv4 anycast blocks (`192.31.196.0/24`, `192.52.193.0/24`, `192.88.99.0/24`, `192.175.48.0/24`), SIIT (`::ffff:0:0:0/96`), IETF protocol assignments including Teredo (`2001::/23`), `3fff::/20` and SRv6 (`5f00::/16`). Applies to the broker, the egress service and the standalone client alike; `SB_EGRESS_ALLOW` still overrides.
+- cf519dd: Outbound TCP sockets now set `TCP_NODELAY`. Without it, Nagle's algorithm and the peer's delayed ACK stalled every fresh HTTPS `fetch()` by about 44 ms on Linux (each small TLS handshake flight waited for an ACK). This covers `fetch()`, outbound WebSockets and `connect()` from `cloudflare:sockets` on the embedded transport (standalone binaries, including sockets handed over by `SB_EGRESS_FD`), and the egress tunnel's connections to origins in `wire`. No compatibility date: only latency changes, no result, header or error does.
+
 ## 0.42.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sproutboat/runtime",
-  "version": "0.42.0",
+  "version": "0.42.1",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/egress.test.ts

@@ -2,13 +2,7 @@ import { expect, test } from "bun:test";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import {
-  blockedRange,
-  egressAllowList,
-  egressRefusal,
-  parseAddress,
-  spliceEgressTable,
-} from "./egress";
+import { blockedRange, egressAllowList, egressRefusal, parseAddress, spliceEgressTable } from "./egress";
 import { validateHttpSyncSource } from "./source";
 import { wrapNativeFetchHandler } from "./wrap";
 
@@ -41,6 +35,17 @@ const BLOCKED = [
   "fd12::1",
   "fe80::1",
   "ff02::1",
+  "192.31.196.1",
+  "192.52.193.1",
+  "192.88.99.1",
+  "192.175.48.1",
+  "::ffff:0:7f00:1",
+  "2001::1",
+  "2001:0:4136:e378:8000:63bf:3fff:fdd2",
+  "2001:1ff::1",
+  "3fff::1",
+  "3fff:fff:ffff::1",
+  "5f00::1",
 ];
 const PUBLIC = [
   "1.1.1.1",
@@ -54,23 +59,25 @@ const PUBLIC = [
   "2002:808:808::1",
   "2001:4860:4860::8888",
   "2606:4700::1111",
+  "192.31.195.255",
+  "192.88.100.1",
+  "2001:200::1",
+  "4000::1",
+  "3ffe::1",
+  "5f01::1",
 ];
 const ALLOW = "8.8.4.4, 10.9.9.9";
 
 test("private and reserved addresses are blocked, public ones are not", () => {
-  for (const address of BLOCKED)
-    expect([address, blockedRange(address)]).not.toEqual([address, null]);
-  for (const address of PUBLIC)
-    expect([address, blockedRange(address)]).toEqual([address, null]);
+  for (const address of BLOCKED) expect([address, blockedRange(address)]).not.toEqual([address, null]);
+  for (const address of PUBLIC) expect([address, blockedRange(address)]).toEqual([address, null]);
   expect(blockedRange("::ffff:127.0.0.1")).toBe("127.0.0.0/8");
   expect(blockedRange("64:ff9b::a00:1")).toBe("10.0.0.0/8");
 });
 
 test("the operator allow list lets an exact address or everything through", () => {
   expect(egressRefusal("db", "10.9.9.9", egressAllowList(ALLOW))).toBeNull();
-  expect(egressRefusal("db", "10.9.9.8", egressAllowList(ALLOW))).toContain(
-    "SB_EGRESS_ALLOW=10.9.9.8",
-  );
+  expect(egressRefusal("db", "10.9.9.8", egressAllowList(ALLOW))).toContain("SB_EGRESS_ALLOW=10.9.9.8");
   expect(egressRefusal("db", "127.0.0.1", ["*"])).toBeNull();
   expect(egressRefusal("x", "169.254.169.254", [])).toBe(
     "fetch() refused: x resolves to 169.254.169.254, a private or reserved address (169.254.0.0/16). An operator can allow it with SB_EGRESS_ALLOW=169.254.169.254",
@@ -78,15 +85,7 @@ test("the operator allow list lets an exact address or everything through", () =
 });
 
 test("parseAddress rejects what is not an address", () => {
-  for (const bad of [
-    "",
-    "1.2.3",
-    "256.1.1.1",
-    "example.com",
-    "1::2::3",
-    "1:2:3:4:5:6:7:8:9",
-    "12345::",
-  ])
+  for (const bad of ["", "1.2.3", "256.1.1.1", "example.com", "1::2::3", "1:2:3:4:5:6:7:8:9", "12345::"])
     expect([bad, parseAddress(bad)]).toEqual([bad, null]);
 });
 
@@ -99,10 +98,7 @@ test("the C table in transport-embedded.js is generated from this one (bun run g
 
 test("the C check gives the same answer and message as the TS one", () => {
   const source = readFileSync(transportFile, "utf8");
-  const block = source.slice(
-    source.indexOf("// EGRESS:BEGIN"),
-    source.indexOf("// EGRESS:END"),
-  );
+  const block = source.slice(source.indexOf("// EGRESS:BEGIN"), source.indexOf("// EGRESS:END"));
   const dir = mkdtempSync(join(tmpdir(), "sb-egress-"));
   try {
     writeFileSync(
@@ -130,23 +126,14 @@ int main(int argc, char** argv) {
 }
 `,
     );
-    const cc = Bun.spawnSync([
-      "cc",
-      "-Wall",
-      "-Werror",
-      "-o",
-      join(dir, "check"),
-      join(dir, "check.c"),
-    ]);
+    const cc = Bun.spawnSync(["cc", "-Wall", "-Werror", "-o", join(dir, "check"), join(dir, "check.c")]);
     expect(cc.stderr.toString()).toBe("");
     const addresses = [...BLOCKED, ...PUBLIC, "10.9.9.9"];
     const run = Bun.spawnSync([join(dir, "check"), ...addresses], {
       env: { ...process.env, SB_EGRESS_ALLOW: ALLOW },
     });
     const fromC = run.stdout.toString().trimEnd().split("\n");
-    const fromTs = addresses.map(
-      (a) => egressRefusal("h", a, egressAllowList(ALLOW)) ?? "ok",
-    );
+    const fromTs = addresses.map((a) => egressRefusal("h", a, egressAllowList(ALLOW)) ?? "ok");
     expect(fromC).toEqual(fromTs);
   } finally {
     rmSync(dir, { recursive: true, force: true });
@@ -156,21 +143,13 @@ int main(int argc, char** argv) {
 test("#174: fetch() needs no config, so every sprout gets it", () => {
   const handler = `export default { async fetch() { return await fetch("https://api.example.com/"); } };`;
   expect(validateHttpSyncSource(handler)).toEqual({ ok: true });
-  const prelude = readFileSync(
-    new URL("./native-fetch-prelude.js", import.meta.url),
-    "utf8",
-  );
-  expect(wrapNativeFetchHandler(handler, prelude)).toContain(
-    "__sbInstallFetch();",
-  );
+  const prelude = readFileSync(new URL("./native-fetch-prelude.js", import.meta.url), "utf8");
+  expect(wrapNativeFetchHandler(handler, prelude)).toContain("__sbInstallFetch();");
 });
 
 test("SB_EGRESS_FD: the host connects, the sprout gets the socket", () => {
   const source = readFileSync(transportFile, "utf8");
-  const block = source.slice(
-    source.indexOf("// EGRESS-FD:BEGIN"),
-    source.indexOf("// EGRESS-FD:END"),
-  );
+  const block = source.slice(source.indexOf("// EGRESS-FD:BEGIN"), source.indexOf("// EGRESS-FD:END"));
   const dir = mkdtempSync(join(tmpdir(), "sb-egress-fd-"));
   try {
     // A fake host on one end of a socketpair: "up" gets a socket whose peer says
@@ -184,6 +163,8 @@ test("SB_EGRESS_FD: the host connects, the sprout gets the socket", () => {
 #include <string.h>
 #include <unistd.h>
 #include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <sys/time.h>
 #include <sys/wait.h>
 ${block}
@@ -261,18 +242,76 @@ int main(void) {
   }
 });
 
+test("sb_tcp_connect sets TCP_NODELAY on the socket it returns", () => {
+  // Nagle plus the peer's delayed ACK stalled every fresh HTTPS fetch about 44 ms on Linux (a TLS
+  // handshake writes small flights). Timing is flaky on CI and loopback on macOS does not show
+  // it, so ask the kernel: connect to a local listener and read the option back.
+  const source = readFileSync(transportFile, "utf8");
+  const between = (from: string, to: string) => source.slice(source.indexOf(from), source.indexOf(to));
+  const dir = mkdtempSync(join(tmpdir(), "sb-nodelay-"));
+  try {
+    writeFileSync(
+      join(dir, "check.c"),
+      `#include <errno.h>
+#include <pthread.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/uio.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
+#include <arpa/inet.h>
+${between("// EGRESS:BEGIN", "// EGRESS:END")}
+${between("// EGRESS-FD:BEGIN", "// EGRESS-FD:END")}
+${between("// TCP-CONNECT:BEGIN", "// TCP-CONNECT:END")}
+int main(void) {
+  int listener = socket(AF_INET, SOCK_STREAM, 0);
+  struct sockaddr_in addr;
+  memset(&addr, 0, sizeof(addr));
+  addr.sin_family = AF_INET;
+  addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+  if (bind(listener, (struct sockaddr*)&addr, sizeof(addr)) || listen(listener, 1)) return 2;
+  socklen_t len = sizeof(addr);
+  getsockname(listener, (struct sockaddr*)&addr, &len);
+  char refused[512] = "";
+  int fd = sb_tcp_connect("127.0.0.1", ntohs(addr.sin_port), refused, sizeof(refused));
+  int value = -1;
+  socklen_t vlen = sizeof(value);
+  if (fd >= 0) getsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &value, &vlen);
+  printf("fd %s nodelay %s\\n", fd >= 0 ? "yes" : "no", value > 0 ? "on" : "off");
+  return 0;
+}
+`,
+    );
+    const cc = Bun.spawnSync([
+      "cc",
+      "-Wall",
+      "-Werror",
+      "-Wno-unused-function",
+      "-Wno-unused-result",
+      "-o",
+      join(dir, "check"),
+      join(dir, "check.c"),
+    ]);
+    expect(cc.stderr.toString()).toBe("");
+    const run = Bun.spawnSync([join(dir, "check")], {
+      env: { ...process.env, SB_EGRESS_ALLOW: "127.0.0.1", SB_EGRESS_FD: "" },
+    });
+    expect(run.stdout.toString().trim()).toBe("fd yes nodelay on");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test("the Host header carries a non-default port", () => {
   const source = readFileSync(transportFile, "utf8");
-  const between = (from: string, to: string) =>
-    source.slice(source.indexOf(from), source.indexOf(to));
-  const buffer = between(
-    "typedef struct { char* p; size_t len; size_t cap; } sb_buf;",
-    "static void sb_putjson(",
-  );
-  const builder = between(
-    "// body_len, not strlen(body)",
-    "// Turn a whole raw response",
-  );
+  const between = (from: string, to: string) => source.slice(source.indexOf(from), source.indexOf(to));
+  const buffer = between("typedef struct { char* p; size_t len; size_t cap; } sb_buf;", "static void sb_putjson(");
+  const builder = between("// body_len, not strlen(body)", "// Turn a whole raw response");
   const dir = mkdtempSync(join(tmpdir(), "sb-host-"));
   try {
     writeFileSync(
@@ -318,10 +357,7 @@ int main(void) { show(80, 80); show(8080, 80); show(443, 443); show(8443, 443);
 
 test("async fetch: requests run on threads and come back through the host", () => {
   const source = readFileSync(transportFile, "utf8");
-  const block = source.slice(
-    source.indexOf("// ASYNC:BEGIN"),
-    source.indexOf("// ASYNC:END"),
-  );
+  const block = source.slice(source.indexOf("// ASYNC:BEGIN"), source.indexOf("// ASYNC:END"));
   const dir = mkdtempSync(join(tmpdir(), "sb-async-"));
   try {
     // Stand-ins: a client that takes 200 ms, and a host that records which timers fire.
@@ -385,13 +421,8 @@ int main(void) {
       .trimEnd()
       .split("\n");
     // 16 requests of 200 ms on 8 threads: two rounds, not sixteen.
-    expect(lines.slice(0, 16).sort()).toEqual(
-      Array.from({ length: 16 }, (_, i) => `${i + 1} h/${i + 1} body`).sort(),
-    );
-    expect(lines.slice(16)).toEqual([
-      "elapsed overlapped",
-      "outside a callback nothing",
-    ]);
+    expect(lines.slice(0, 16).sort()).toEqual(Array.from({ length: 16 }, (_, i) => `${i + 1} h/${i + 1} body`).sort());
+    expect(lines.slice(16)).toEqual(["elapsed overlapped", "outside a callback nothing"]);
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }

package/src/egress.ts

@@ -41,6 +41,18 @@ export const BLOCKED_RANGES = [
   "fe80::/10",
   "fec0::/10",
   "ff00::/8",
+  // Reserved space that carries no public service: AS112 and the IETF's old anycast
+  // blocks, SIIT (`::ffff:0:0:0/96`, which embeds an IPv4 address the mapped rule
+  // above does not see), IETF protocol assignments (includes Teredo, `2001::/32`),
+  // the second documentation block and SRv6 SIDs.
+  "192.31.196.0/24",
+  "192.52.193.0/24",
+  "192.88.99.0/24",
+  "192.175.48.0/24",
+  "::ffff:0:0:0/96",
+  "2001::/23",
+  "3fff::/20",
+  "5f00::/16",
 ] as const;
 
 /** Parse an IPv4 or IPv6 literal to its bytes; `null` when it is neither. */
@@ -123,11 +135,7 @@ export function egressAllowList(raw: string | undefined): string[] {
 
 /** Why `fetch()` may not connect to `address`, or `null` when it may. The
  *  message is identical in the C client; keep the two in step. */
-export function egressRefusal(
-  host: string,
-  address: string,
-  allow: readonly string[],
-): string | null {
+export function egressRefusal(host: string, address: string, allow: readonly string[]): string | null {
   if (allow.includes("*") || allow.includes(address)) return null;
   const range = blockedRange(address);
   if (range === null) return null;
@@ -149,8 +157,5 @@ const TABLE_BEGIN = /( *\/\/ EGRESS-TABLE:BEGIN[^\n]*\n)[\s\S]*?( *\/\/ EGRESS-T
 /** `source` with the generated table between its EGRESS-TABLE markers replaced. */
 export function spliceEgressTable(source: string): string {
   if (!TABLE_BEGIN.test(source)) throw new Error("EGRESS-TABLE markers not found");
-  return source.replace(
-    TABLE_BEGIN,
-    (_, begin: string, end: string) => `${begin}${egressRangesC()}\n${end}`,
-  );
+  return source.replace(TABLE_BEGIN, (_, begin: string, end: string) => `${begin}${egressRangesC()}\n${end}`);
 }

package/src/transport-embedded.js

@@ -20,6 +20,8 @@ Porffor.c`
 #include <stdint.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <netdb.h>
 #include <arpa/inet.h>
 #include <string.h>
@@ -2594,6 +2596,14 @@ static const char* sb_egress_blocked(const unsigned char* a, int len) {
     { 16, 10, { 254, 128, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fe80::/10" },
     { 16, 10, { 254, 192, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "fec0::/10" },
     { 16, 8, { 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "ff00::/8" },
+    { 4, 24, { 192, 31, 196, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.31.196.0/24" },
+    { 4, 24, { 192, 52, 193, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.52.193.0/24" },
+    { 4, 24, { 192, 88, 99, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.88.99.0/24" },
+    { 4, 24, { 192, 175, 48, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "192.175.48.0/24" },
+    { 16, 96, { 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 0, 0, 0, 0, 0, 0 }, "::ffff:0:0:0/96" },
+    { 16, 23, { 32, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "2001::/23" },
+    { 16, 20, { 63, 255, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "3fff::/20" },
+    { 16, 16, { 95, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }, "5f00::/16" },
   };
   // EGRESS-TABLE:END
   static const unsigned char mapped[12] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff };
@@ -2653,6 +2663,14 @@ static int sb_egress_refused(const char* host, const struct sockaddr* sa, char*
 // EGRESS:END
 
 // EGRESS-FD:BEGIN
+// TCP_NODELAY on an outbound socket. Without it Nagle holds a small write until the peer ACKs the
+// last one, and the peer delays that ACK: about 44 ms per TLS handshake flight on Linux. A unix
+// socket (an fd handed over by sproutd) refuses the option, which is fine: only TCP needs it.
+static void sb_tcp_nodelay(int fd) {
+  int one = 1;
+  setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
+}
+
 // SB_EGRESS_FD=N: a sandboxed host (sproutd) opens outbound connections for the
 // sprout, which may not open sockets itself. Ask on unix socket N with
 // "HOST PORT\n"; the host resolves, applies its policy and answers "ok\n" with the
@@ -2699,6 +2717,7 @@ static int sb_egress_fd_ask(int via, const char* host, int port, char* refused,
   if (!strcmp(answer, "ok") && fd >= 0) {
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+    sb_tcp_nodelay(fd);
     return fd;
   }
   if (fd >= 0) close(fd);
@@ -2707,6 +2726,7 @@ static int sb_egress_fd_ask(int via, const char* host, int port, char* refused,
 }
 // EGRESS-FD:END
 
+// TCP-CONNECT:BEGIN
 // refused gets the first refusal; a caller reports it when nothing connected.
 static int sb_tcp_connect(const char* host, int port, char* refused, size_t refused_len) {
   const char* via = getenv("SB_EGRESS_FD");
@@ -2739,13 +2759,14 @@ static int sb_tcp_connect(const char* host, int port, char* refused, size_t refu
     struct timeval tv; tv.tv_sec = 30; tv.tv_usec = 0;
     setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
     setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
-    if (connect(fd, it->ai_addr, it->ai_addrlen) == 0) break;
+    if (connect(fd, it->ai_addr, it->ai_addrlen) == 0) { sb_tcp_nodelay(fd); break; }
     close(fd);
     fd = -1;
   }
   freeaddrinfo(res);
   return fd;
 }
+// TCP-CONNECT:END
 
 // body_len, not strlen(body): a binary body can contain NUL bytes (#232).
 // Host carries the port unless it is the scheme's default (RFC 9110 7.2).

package/test/bearssl.ts

@@ -1,16 +1,14 @@
-import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { BEARSSL_SHA256, BEARSSL_URLS, BEARSSL_VENDORED_PATH, BEARSSL_VERSION } from "../../toolchain/src/deps";
+import { fetchPinned } from "../../toolchain/src/fetch-pinned";
 
 // The prelude carries crypto.subtle's native half on every transport, so a test that compiles a
 // handler using crypto.subtle needs BearSSL on the include path and link line, as the CLI arranges
 // for a build. Same pinned source as the CLI's src/bearssl.ts; built once into the toolchain cache.
-const COMMIT = "7bea48e5e850ab4cafbe68d3765cdaba13a86d6f";
-const VERSION = COMMIT.slice(0, 7);
-const URL_ = `https://bearssl.org/gitweb/?p=BearSSL;a=snapshot;h=${COMMIT};sf=tgz`;
-const SHA256 = "ed397832b1613582737d9c1ce01c1af74ad6a9e9c52a341e24433987cda0f372";
+const VERSION = BEARSSL_VERSION;
 
 const walk = async (dir: string): Promise<string[]> =>
   (
@@ -34,10 +32,14 @@ export async function bearsslEnv(): Promise<{ SB_EXTRA_CFLAGS: string; SB_EXTRA_
   const marker = join(objects, ".complete");
   if (!existsSync(marker)) {
     await mkdir(root, { recursive: true });
-    const response = await fetch(URL_);
-    if (!response.ok) throw new Error(`could not download ${URL_}: HTTP ${response.status}`);
-    const bytes = Buffer.from(await response.arrayBuffer());
-    if (createHash("sha256").update(bytes).digest("hex") !== SHA256) throw new Error("BearSSL checksum mismatch");
+    // Vendored tarball first (vendor/bearssl), then bearssl.org with bounded retry; both sha256-pinned: see
+    // toolchain/src/deps.ts. A downloaded copy is cached so a later run needs no network.
+    const bytes = await fetchPinned({
+      localPath: BEARSSL_VENDORED_PATH,
+      urls: BEARSSL_URLS,
+      sha256: BEARSSL_SHA256,
+      cachePath: join(dirname(root), "deps", `bearssl-src-${BEARSSL_SHA256}.tar.gz`),
+    });
     await writeFile(join(root, "bearssl.tar.gz"), bytes);
     await rm(tree, { recursive: true, force: true });
     const untar = Bun.spawnSync(["tar", "xzf", join(root, "bearssl.tar.gz"), "-C", root]);