dsh-mobile 0.6.12 → 0.6.14

package/lib/index.d.mts

@@ -540,6 +540,33 @@ interface AuthFailureEntry {
   readonly suppressed?: number;
 }
 //#endregion
+//#region src/http-failure-log.d.ts
+/** Fixed parser details safe to record without Node's raw packet, message or request headers. */
+type HttpParserCode = 'ERR_HTTP_REQUEST_TIMEOUT' | 'HPE_HEADER_OVERFLOW' | 'HPE_INVALID_CHUNK_SIZE' | 'HPE_INVALID_CONTENT_LENGTH' | 'HPE_INVALID_EOF_STATE' | 'HPE_INVALID_HEADER_TOKEN' | 'HPE_INVALID_TRANSFER_ENCODING' | 'HPE_UNEXPECTED_CONTENT_LENGTH' | 'other';
+/** A rejected inbound HTTP message's public response and bounded diagnostic category. */
+interface HttpParserFailure {
+  readonly status: 400 | 408 | 431;
+  readonly code: 'bad_request' | 'request_timeout' | 'headers_too_large';
+  readonly parserCode: HttpParserCode;
+}
+/** One sampled rejection. Arbitrary paths, query strings, body data and credentials are excluded. */
+type HttpFailureEntry = ({
+  readonly kind: 'parser';
+  readonly status: HttpParserFailure['status'];
+  readonly code: HttpParserCode;
+} | {
+  readonly kind: 'target';
+  readonly status: 400;
+  readonly code: 'bad_request';
+} | {
+  readonly kind: 'upstream';
+  readonly status: number;
+  readonly method: 'POST';
+  readonly path: '/api/session/prompt';
+}) & {
+  readonly suppressed?: number;
+};
+//#endregion
 //#region src/http-security.d.ts
 export declare const DEVICE_COOKIE = "dsh_ma_device";
 export declare const SESSION_COOKIE = "dsh_ma_session";
@@ -1002,9 +1029,10 @@ export declare class MobileAccessGateway {
   private readonly clientModuleTasks;
   private readonly clientModuleRevocations;
   private readonly authFailures;
+  private readonly httpFailures;
   constructor(config: ResolvedGatewayConfig, store: DeviceStore, extensions?: MobileAccessService | undefined, upstreamAuthenticatedUrl?: string | undefined, extraWebSocketPaths?: {
     has(pathname: string): boolean;
-  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void);
+  } | undefined, blockedUpgradeLog?: BlockedUpgradePathLog | undefined, onDiscoveryDegraded?: ((source: 'broadcast' | 'mdns', code: string) => void) | undefined, clientModulePreferences?: ClientModulePreferenceStore, authFailureLog?: (entry: AuthFailureEntry) => void, httpFailureLog?: (entry: HttpFailureEntry) => void);
   /** Initialize durable state, validate TLS, and bind the externally reachable listener. */
   start(): Promise<void>;
   /** Install a newly signed provided leaf for future TLS handshakes without dropping sessions. */
@@ -1921,7 +1949,7 @@ interface OriginConfigurationStatus {
 }
 /** Require a public HTTPS origin; custom external ports are supported. */
 export declare function validateOriginPublicOrigin(value: unknown): string;
-/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+/** Bind one explicit loopback, RFC1918 IPv4 or IPv6 ULA interface; zone IDs are unsupported. */
 export declare function validateOriginListenHost(value: unknown): string;
 export declare function validateOriginListenPort(value: unknown): number;
 /** Authorize direct proxy socket peers, not untrusted forwarded client headers. */

package/lib/index.mjs

@@ -9,7 +9,7 @@ import { performance as performance$1 } from "node:perf_hooks";
 import { execFile, spawn } from "node:child_process";
 import { createSocket } from "node:dgram";
 import { homedir, hostname, networkInterfaces, tmpdir } from "node:os";
-import { createServer as createServer$1, request } from "node:http";
+import { STATUS_CODES, createServer as createServer$1, request } from "node:http";
 import { createServer as createServer$2, request as request$1 } from "node:https";
 import { Readable, Transform, finished } from "node:stream";
 import { finished as finished$1, pipeline } from "node:stream/promises";
@@ -1968,7 +1968,7 @@ function authenticatedCookie(values, authenticate, accepts = () => true) {
 }
 //#endregion
 //#region src/auth-failure-log.ts
-const LOG_INTERVAL_MS = 3e4;
+const LOG_INTERVAL_MS$1 = 3e4;
 const MAX_LOGGED_ORIGIN_LENGTH = 512;
 function requestPathCategory(path) {
 	switch (path) {
@@ -2065,7 +2065,7 @@ var AuthFailureRecorder = class {
 			return;
 		}
 		const suppressed = window.suppressed;
-		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.nextLogAt = now + LOG_INTERVAL_MS$1;
 		window.suppressed = 0;
 		try {
 			this.observe({
@@ -2082,6 +2082,129 @@ var AuthFailureRecorder = class {
 	}
 };
 //#endregion
+//#region src/http-failure-log.ts
+function safeParserCode(code) {
+	switch (code) {
+		case "ERR_HTTP_REQUEST_TIMEOUT":
+		case "HPE_HEADER_OVERFLOW":
+		case "HPE_INVALID_CHUNK_SIZE":
+		case "HPE_INVALID_CONTENT_LENGTH":
+		case "HPE_INVALID_EOF_STATE":
+		case "HPE_INVALID_HEADER_TOKEN":
+		case "HPE_INVALID_TRANSFER_ENCODING":
+		case "HPE_UNEXPECTED_CONTENT_LENGTH": return code;
+		default: return "other";
+	}
+}
+/**
+* Classify Node's HTTP rejection without reflecting an unrecognized error code.
+* @param nodeCode - The parser error's machine code, not its message or raw packet.
+* @returns The fixed public HTTP status/category and allowlisted diagnostic code.
+*/
+function classifyHttpParserFailure(nodeCode) {
+	const parserCode = safeParserCode(nodeCode);
+	if (parserCode === "ERR_HTTP_REQUEST_TIMEOUT") return {
+		status: 408,
+		code: "request_timeout",
+		parserCode
+	};
+	if (parserCode === "HPE_HEADER_OVERFLOW") return {
+		status: 431,
+		code: "headers_too_large",
+		parserCode
+	};
+	return {
+		status: 400,
+		code: "bad_request",
+		parserCode
+	};
+}
+const LOG_INTERVAL_MS = 3e4;
+/**
+* Per-Gateway diagnostics with three fixed sampling slots and no timers or request-selected keys.
+* Each kind records once immediately, then at most once per 30 seconds with suppressed counts.
+* A sink failure cannot change a response, retry a write or expose the diagnostic sink's error.
+*/
+var HttpFailureRecorder = class {
+	observe;
+	now;
+	reportObserverFailure;
+	windows = {
+		parser: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		target: {
+			nextLogAt: 0,
+			suppressed: 0
+		},
+		upstream: {
+			nextLogAt: 0,
+			suppressed: 0
+		}
+	};
+	observerFailureReported = false;
+	constructor(observe, now = () => performance.now(), reportObserverFailure = () => {
+		process.emitWarning("Mobile access HTTP diagnostics could not be recorded", { code: "DSH_MOBILE_HTTP_LOG_FAILED" });
+	}) {
+		this.observe = observe;
+		this.now = now;
+		this.reportObserverFailure = reportObserverFailure;
+	}
+	/** Classify an inbound parser rejection and sample only its fixed status and safe code. */
+	recordParser(nodeCode) {
+		const failure = classifyHttpParserFailure(nodeCode);
+		this.record({
+			kind: "parser",
+			status: failure.status,
+			code: failure.parserCode
+		});
+		return failure;
+	}
+	/** Sample an invalid request target without retaining its raw or decoded URL. */
+	recordTarget() {
+		this.record({
+			kind: "target",
+			status: 400,
+			code: "bad_request"
+		});
+	}
+	/** Sample only authenticated prompt rejections; the caller must authorize before forwarding. */
+	recordUpstream(method, pathname, status) {
+		if (method !== "POST" || pathname !== "/api/session/prompt" || !Number.isInteger(status) || status < 400 || status > 599) return;
+		this.record({
+			kind: "upstream",
+			status,
+			method: "POST",
+			path: "/api/session/prompt"
+		});
+	}
+	record(entry) {
+		if (this.observe === void 0) return;
+		const now = this.now();
+		const window = this.windows[entry.kind];
+		if (now < window.nextLogAt) {
+			window.suppressed = Math.min(Number.MAX_SAFE_INTEGER, window.suppressed + 1);
+			return;
+		}
+		const suppressed = window.suppressed;
+		window.nextLogAt = now + LOG_INTERVAL_MS;
+		window.suppressed = 0;
+		try {
+			this.observe({
+				...entry,
+				...suppressed === 0 ? {} : { suppressed }
+			});
+		} catch (observerError) {
+			if (this.observerFailureReported) return;
+			this.observerFailureReported = true;
+			try {
+				this.reportObserverFailure();
+			} catch (reporterError) {}
+		}
+	}
+};
+//#endregion
 //#region src/client-module-recovery.ts
 const CLIENT_MODULE_RECOVERY_COPY = {
 	zh: {
@@ -5052,7 +5175,7 @@ function rejectUpgrade(socket, status, code) {
 	if (socket.destroyed) return;
 	const body = `${JSON.stringify({ error: code })}\n`;
 	socket.end([
-		`HTTP/1.1 ${String(status)} ${status === 401 ? "Unauthorized" : status === 403 ? "Forbidden" : "Bad Request"}`,
+		`HTTP/1.1 ${String(status)} ${STATUS_CODES[status] ?? "Bad Request"}`,
 		"Connection: close",
 		"Cache-Control: no-store",
 		"Content-Type: application/json; charset=utf-8",
@@ -5423,7 +5546,8 @@ var MobileAccessGateway = class {
 	clientModuleTasks = /* @__PURE__ */ new Set();
 	clientModuleRevocations = /* @__PURE__ */ new Set();
 	authFailures;
-	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog) {
+	httpFailures;
+	constructor(config, store, extensions, upstreamAuthenticatedUrl, extraWebSocketPaths, blockedUpgradeLog, onDiscoveryDegraded, clientModulePreferences, authFailureLog, httpFailureLog) {
 		this.config = config;
 		this.extensions = extensions;
 		this.upstreamAuthenticatedUrl = upstreamAuthenticatedUrl;
@@ -5431,6 +5555,7 @@ var MobileAccessGateway = class {
 		this.blockedUpgradeLog = blockedUpgradeLog;
 		this.onDiscoveryDegraded = onDiscoveryDegraded;
 		this.authFailures = new AuthFailureRecorder(authFailureLog);
+		this.httpFailures = new HttpFailureRecorder(httpFailureLog);
 		this.clientModulePreferences = clientModulePreferences ?? new ClientModulePreferenceStore(join(dirname(config.stateFile), `${basename(config.stateFile)}.client-modules.json`), config.excludedClientModules);
 		this.listenerTlsEnabled = config.tls.mode === "provided";
 		this.tlsEnabled = config.publicTls;
@@ -5527,8 +5652,10 @@ var MobileAccessGateway = class {
 					rejectUpgrade(client, mapped.status, mapped.code);
 				});
 			});
-			server.on("clientError", (_error, socket) => {
-				rejectUpgrade(socket, 400, "bad_request");
+			server.on("clientError", (error, socket) => {
+				const nodeCode = "code" in error && typeof error.code === "string" ? error.code : void 0;
+				const failure = this.httpFailures.recordParser(nodeCode);
+				rejectUpgrade(socket, failure.status, failure.code);
 			});
 			await new Promise((resolve, reject) => {
 				const failed = (error) => {
@@ -5932,7 +6059,13 @@ var MobileAccessGateway = class {
 		sendJson(response, 200, { loggedOut: true }, this.tlsEnabled);
 	}
 	async handleExternalRequest(request, response) {
-		const target = parseRequestTarget(request.url);
+		let target;
+		try {
+			target = parseRequestTarget(request.url);
+		} catch (error) {
+			if (error instanceof HttpError && error.status === 400) this.httpFailures.recordTarget();
+			throw error;
+		}
 		const policy = this.requirePolicy();
 		const isMutation = request.method !== "GET" && request.method !== "HEAD";
 		assertExternalTrust(request, policy, isMutation);
@@ -7093,6 +7226,7 @@ var MobileAccessGateway = class {
 			setSecurityHeaders(response, this.tlsEnabled, "proxied");
 			const headers = sanitizeResponseHeaders(proxied.headers, this.config.upstreamOrigin);
 			const statusCode = proxied.statusCode ?? 502;
+			this.httpFailures.recordUpstream(request$2.method, request$2.url?.split("?", 1)[0] ?? "", statusCode);
 			const cacheControl = revisionedStaticCacheControl(request$2, statusCode);
 			if (cacheControl !== void 0) headers["cache-control"] = cacheControl;
 			const compressible = canCompressResponse(request$2, proxied);
@@ -11620,12 +11754,16 @@ const MIN_ORIGIN_LISTEN_PORT = 1024;
 const RESERVED_LAN_GATEWAY_PORT$1 = 3443;
 /** DSH's own WebServer port; the plugin cannot function while it is taken. */
 const RESERVED_DSH_WEB_PORT = 3080;
-const PRIVATE_NETWORKS = [
-	"10.0.0.0/8",
-	"172.16.0.0/12",
-	"192.168.0.0/16"
-].map(parseCidr);
-const TRUSTED_NETWORKS = [...PRIVATE_NETWORKS, parseCidr("127.0.0.0/8")];
+const TRUSTED_NETWORKS = [
+	...[
+		"10.0.0.0/8",
+		"172.16.0.0/12",
+		"192.168.0.0/16",
+		"fc00::/7"
+	].map(parseCidr),
+	parseCidr("127.0.0.0/8"),
+	parseCidr("::1/128")
+];
 /** Require a public HTTPS origin; custom external ports are supported. */
 function validateOriginPublicOrigin(value) {
 	if (typeof value !== "string" || value.length > 512 || /[\s\u0000-\u001f\u007f\\@?#]/u.test(value)) throw new Error("origin_public_origin_invalid");
@@ -11647,10 +11785,15 @@ function validateOriginPublicOrigin(value) {
 	if (url.protocol !== "https:" || url.pathname !== "/" || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "" || url.port !== "" && Number(url.port) < 1 || (isIP(host) === 4 ? !isGloballyRoutableIpv4(host) : isIP(host) !== 0 || !validHostname)) throw new Error("origin_public_origin_invalid");
 	return url.origin;
 }
-/** Bind only one explicit loopback or RFC1918 IPv4 interface, never all interfaces. */
+/** Bind one explicit loopback, RFC1918 IPv4 or IPv6 ULA interface; zone IDs are unsupported. */
 function validateOriginListenHost(value) {
-	if (typeof value !== "string" || isIP(value) !== 4 || !isLoopbackAddress(value) && !addressAllowed(value, PRIVATE_NETWORKS)) throw new Error("origin_listen_host_invalid");
-	return value;
+	const addressFamily = isIP(value);
+	if (typeof value !== "string" || value.includes("%") || addressFamily === 0 || !addressAllowed(value, TRUSTED_NETWORKS.filter((range) => range.bits === (addressFamily === 6 ? 128 : 32)))) throw new Error("origin_listen_host_invalid");
+	return addressFamily === 6 ? new URL("http://[" + value + "]").hostname.slice(1, -1) : value;
+}
+/** Format a validated backend listener, including the brackets required by IPv6 URLs. */
+function formatOriginBackendOrigin(listenHost, listenPort) {
+	return "http://" + (isIP(listenHost) === 6 ? "[" + listenHost + "]" : listenHost) + ":" + String(listenPort);
 }
 function validateOriginListenPort(value) {
 	if (!Number.isSafeInteger(value) || Number(value) < MIN_ORIGIN_LISTEN_PORT || Number(value) > 65535) throw new Error("origin_listen_port_invalid");
@@ -11659,14 +11802,15 @@ function validateOriginListenPort(value) {
 }
 /** Authorize direct proxy socket peers, not untrusted forwarded client headers. */
 function validateOriginAllowedCidrs(value, listenHost) {
-	const input = value === void 0 && isLoopbackAddress(listenHost) ? ["127.0.0.0/8"] : value;
+	const addressFamily = isIP(listenHost);
+	const input = value === void 0 && isLoopbackAddress(listenHost) ? [addressFamily === 6 ? "::1/128" : "127.0.0.0/8"] : value;
 	if (!Array.isArray(input) || input.length === 0 || input.length > 16) throw new Error("origin_allowed_cidrs_invalid");
 	const cidrs = [];
 	for (const entry of input) {
-		if (typeof entry !== "string" || entry.length > 64 || isIP(entry.split("/")[0] ?? "") !== 4) throw new Error("origin_allowed_cidrs_invalid");
+		if (typeof entry !== "string" || entry.length > 64 || entry.includes("%") || isIP(entry.split("/")[0] ?? "") !== addressFamily) throw new Error("origin_allowed_cidrs_invalid");
 		try {
 			const cidr = parseCidr(entry);
-			if (cidr.bits !== 32 || !TRUSTED_NETWORKS.some((range) => cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
+			if (cidr.bits !== (addressFamily === 6 ? 128 : 32) || !TRUSTED_NETWORKS.some((range) => cidr.bits === range.bits && cidr.prefix >= range.prefix && addressAllowed(entry.split("/")[0], [range]))) throw new Error("untrusted CIDR");
 			cidrs.push(cidr.source);
 		} catch {
 			throw new Error("origin_allowed_cidrs_invalid");
@@ -11744,7 +11888,7 @@ var OriginConfigStore = class {
 				listenHost: settings.listenHost,
 				listenPort: settings.listenPort,
 				allowedCidrs: settings.allowedCidrs,
-				backendOrigin: "http://" + settings.listenHost + ":" + String(settings.listenPort)
+				backendOrigin: formatOriginBackendOrigin(settings.listenHost, settings.listenPort)
 			},
 			storagePath: this.stateRoot,
 			...this.errorCode === void 0 ? {} : { errorCode: this.errorCode }
@@ -11904,7 +12048,7 @@ var OriginController = class {
 			enabled: true,
 			state: "ready",
 			origin: settings.publicOrigin,
-			backendOrigin: "http://" + settings.listenHost + ":" + String(gateway.address().port)
+			backendOrigin: formatOriginBackendOrigin(settings.listenHost, gateway.address().port)
 		});
 	}
 	async stop() {
@@ -17601,6 +17745,8 @@ async function apply(ctx, config) {
 			logger.warn("%s discovery degraded while DSH remains available: %s", source, code);
 		}, clientModulePreferences, (entry) => {
 			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		lanGateway = candidate;
@@ -17659,6 +17805,8 @@ async function apply(ctx, config) {
 		const resolved = remoteGatewayConfig(template, publicOrigin, remoteDeviceFile, remoteInstanceId, listenPort, instanceId);
 		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
 			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
 		});
 		await candidate.start();
 		return candidate;
@@ -17675,7 +17823,11 @@ async function apply(ctx, config) {
 		if (!isFrpSelfSignedIngress(settings)) return createRemoteGateway(publicOrigin);
 		const ingress = await ensureFrpIngressCertificate(settings, remoteDeviceFile, Date.now(), void 0, stateDirectory);
 		const resolved = frpIngressGatewayConfig(template, settings, remoteDeviceFile, ingress);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		});
 		try {
 			await candidate.start();
 		} catch (error) {
@@ -17686,7 +17838,11 @@ async function apply(ctx, config) {
 	};
 	const createOriginGateway = async (settings) => {
 		const resolved = originGatewayConfig(template, settings, remoteDeviceFile, remoteInstanceId, settings.listenPort, instanceId);
-		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences);
+		const candidate = new MobileAccessGateway(resolved, new JsonDeviceStore(resolved.stateFile, resolved.maxDevices), mobileAccess, upstreamLoginUrl, webSocketPaths, blockedUpgradePaths, void 0, clientModulePreferences, (entry) => {
+			logger.warn("auth failure %s", JSON.stringify(entry));
+		}, (entry) => {
+			logger.warn("http failure %s", JSON.stringify(entry));
+		});
 		try {
 			await candidate.start();
 		} catch (error) {