jspurefix 5.8.5 → 5.9.2

package/src/transport/tcp/tcp-acceptor.ts

@@ -5,8 +5,10 @@ import { IJsFixConfig, IJsFixLogger } from '../../config'
 import { createServer as netCreateServer, Server, Socket } from 'net'
 import { createServer as tlsCreateServer, TlsOptions, TLSSocket } from 'tls'
 import { TlsOptionsFactory } from './tls-options-factory'
+import { describeNegotiated, describePeerCertificate, describeServerOptions } from './tls-diagnostics'
 import { inject, injectable } from 'tsyringe'
 import { DITokens } from '../../runtime/di-tokens'
+import { makeSessionScope } from '../../runtime/session-scope'
 
 @injectable()
 export class TcpAcceptor extends FixAcceptor {
@@ -40,19 +42,29 @@ export class TcpAcceptor extends FixAcceptor {
       const tlsOptions: TlsOptions | null = tcp?.tls ? TlsOptionsFactory.getTlsOptions(tcp.tls) : null
       this.logger.info('create tls server')
       if (!tlsOptions) return
+      this.logger.info(`tls server options ${describeServerOptions(tlsOptions)}`)
       this.server = tlsCreateServer(tlsOptions, (tlsSocket: TLSSocket) => {
         if (tcp?.tls?.enableTrace) {
           this.logger.info('enabling tls session trace')
           tlsSocket.enableTrace()
         }
-        if (tlsSocket.authorized) {
-          tlsSocket.setEncoding('utf8')
-          const id: number = this.getId()
-          this.logger.info(`tls creates session ${id} ${tlsSocket.authorized}`)
-          this.onSocket(id, tlsSocket, config)
-        } else {
-          this.logger.info('no transport created on tls with no authorized connection')
+        this.logger.info(`tls negotiated ${describeNegotiated(tlsSocket)}`)
+        this.logger.info(`tls peer certificate ${describePeerCertificate(tlsSocket)}`)
+        // mirrors the initiator fix for #94 - an unauthorized peer is only fatal when the
+        // caller has not explicitly opted out.  the default stays secure: rejectUnauthorized
+        // undefined means reject, exactly as before.
+        if (!tlsSocket.authorized && tlsOptions.rejectUnauthorized !== false) {
+          this.logger.warning(`no transport created, unauthorized tls connection: ${String(tlsSocket.authorizationError)}`)
+          tlsSocket.end()
+          return
         }
+        if (!tlsSocket.authorized) {
+          this.logger.warning(`accepting unauthorized tls peer (rejectUnauthorized: false): ${String(tlsSocket.authorizationError)}`)
+        }
+        tlsSocket.setEncoding('utf8')
+        const id: number = this.getId()
+        this.logger.info(`tls creates session ${id} authorized ${tlsSocket.authorized}`)
+        this.onSocket(id, tlsSocket, config)
       })
     } catch (e) {
       this.logger.error(e as Error)
@@ -82,17 +94,50 @@ export class TcpAcceptor extends FixAcceptor {
   }
 
   private onSocket (id: number, socket: Socket, config: IJsFixConfig): void {
-    const transport: MsgTransport = new MsgTransport(id, config, new TcpDuplex(socket))
-    this.saveTransport(id, transport)
+    // Every accepted connection gets its own DI scope: its own parse and transmit
+    // buffers, its own session description (hence its own SessionId and message
+    // store) and its own session message factory.  Without this, concurrent clients
+    // on one listener share buffers and collide on a single store.
+    const sessionConfig = makeSessionScope(config)
+    const remote = `${socket.remoteAddress ?? '?'}:${socket.remotePort ?? 0}`
+    this.applyKeepAlive(id, socket)
+    this.logger.info(`transport ${id} from ${remote} given its own session scope`)
+    const transport: MsgTransport = new MsgTransport(id, sessionConfig, new TcpDuplex(socket))
+    this.saveTransport(id, transport, remote)
     transport.receiver.on('end', () => {
-      this.harvestTransport(id)
+      this.harvestTransport(id, 'peer ended the connection')
     })
     transport.receiver.on('error', (e: Error) => {
       this.logger.error(e)
-      this.harvestTransport(id)
+      this.harvestTransport(id, `receiver error: ${e.message}`)
+    })
+    // 'end' only fires on a clean FIN.  A socket dropped by a firewall, or one this
+    // side destroyed after a failed graceful close, arrives here instead - without
+    // it the transport would sit in the map forever.
+    socket.on('close', (hadError: boolean) => {
+      this.harvestTransport(id, hadError ? 'socket closed after error' : 'socket closed')
     })
   }
 
+  /**
+   * TCP keep-alive is the only mechanism that detects a peer which has vanished
+   * without sending FIN or RST - the half open socket described in issue #153.  The
+   * session level TestRequest timeout is the protocol level backstop; this is the
+   * transport level one.
+   */
+  private applyKeepAlive (id: number, socket: Socket): void {
+    const configured = this.config.description.application?.tcp?.keepAliveMs
+    const keepAliveMs = configured ?? TcpAcceptor.defaultKeepAliveMs
+    if (keepAliveMs <= 0) {
+      this.logger.info(`transport ${id} keep-alive disabled`)
+      return
+    }
+    socket.setKeepAlive(true, keepAliveMs)
+    this.logger.info(`transport ${id} keep-alive enabled, initial delay ${keepAliveMs}ms`)
+  }
+
+  public static defaultKeepAliveMs: number = 30000
+
   public listen (): void {
     const port = this.config.description.application?.tcp?.port
     this.logger.info(`start to listen ${port}`)
@@ -107,20 +152,49 @@ export class TcpAcceptor extends FixAcceptor {
 
   public close (callback?: (err?: Error) => void): void {
     const port = this.config.description.application?.tcp?.port ?? -1
-    this.logger.info(`close listener on port ${port}`)
+    this.logger.info(`close listener on port ${port} with ${this.transportCount} live transport(s)`)
+    // Server.close only stops accepting - it waits for existing connections to go.
+    // Release them, otherwise a shutdown blocks on whichever counterparty happens to
+    // be connected (and forever on one that is half open).
+    Object.keys(this.transports).forEach(id => {
+      const tid = Number(id)
+      this.logger.info(`close: releasing transport ${tid}`)
+      this.transports[tid]?.end()
+    })
     this.server.close(callback)
   }
 
-  private saveTransport (tid: number, transport: MsgTransport): void {
+  /** how many connections this listener currently holds */
+  public get transportCount (): number {
+    return Object.keys(this.transports).length
+  }
+
+  /** ids of the live transports, for a periodic census in the application log */
+  public liveTransports (): string[] {
+    return Object.keys(this.transports).map(id => {
+      const meta = this.accepted[id as any]
+      const age = meta ? Math.round((Date.now() - meta.at) / 1000) : -1
+      return `${id}@${meta?.remote ?? '?'} up ${age}s`
+    })
+  }
+
+  private readonly accepted: Record<number, { remote: string, at: number }> = {}
+
+  private saveTransport (tid: number, transport: MsgTransport, remote: string): void {
     this.transports[tid] = transport
-    const keys: string[] = Object.keys(this.transports)
-    this.logger.info(`new transport id = ${tid} created total transports = ${keys.length}`)
+    this.accepted[tid] = { remote, at: Date.now() }
+    this.logger.info(`new transport id = ${tid} from ${remote} created total transports = ${this.transportCount}`)
     this.emit('transport', transport)
   }
 
-  private harvestTransport (tid: number): void {
+  private harvestTransport (tid: number, reason: string): void {
+    if (!this.transports[tid]) return
+    const meta = this.accepted[tid]
+    const lifetime = meta ? Math.round((Date.now() - meta.at) / 1000) : -1
     delete this.transports[tid]
-    const keys: string[] = Object.keys(this.transports)
-    this.logger.info(`transport ${tid} ends total transports = ${keys.length}`)
+    delete this.accepted[tid]
+    this.logger.info(`transport ${tid} from ${meta?.remote ?? '?'} harvested after ${lifetime}s ` +
+      `(${reason}) total transports = ${this.transportCount}`)
+    this.emit('harvested', tid, reason)
   }
 }

package/src/transport/tcp/tcp-initiator.ts

@@ -9,6 +9,7 @@ import { connect as tlsConnect, ConnectionOptions, TLSSocket } from 'tls'
 import { createConnection } from 'net'
 import Timeout = NodeJS.Timeout
 import { TlsOptionsFactory } from './tls-options-factory'
+import { describeConnectionOptions, describeNegotiated, describePeerCertificate } from './tls-diagnostics'
 import { inject, injectable } from 'tsyringe'
 import { DITokens } from '../../runtime/di-tokens'
 import { ITcpTransportDescription } from './tcp-transport-description'
@@ -67,8 +68,13 @@ export class TcpInitiator extends FixInitiator {
           this.logger.info(`connecting with timeout ${timeoutSeconds}`)
           this.tryConnect()
             .then((t: MsgTransport) => { resolve(t) })
-            .catch((_: Error) => {
-              this.repeatConnect(timeoutSeconds)
+            .catch((first: Error) => {
+              // carry the first failure into repeatConnect.  it used to be discarded, so a
+              // connect() whose timeout expires before the first retry interval fires - the
+              // default case, timeout and reconnectSeconds are both 5 - reported a generic
+              // "timeout whilst connecting" and threw away the reason.  see #94.
+              this.logger.info(`first connect attempt failed: ${first.message}`)
+              this.repeatConnect(timeoutSeconds, first)
                 .then((t: MsgTransport) => { resolve(t) })
                 .catch((e: Error) => { reject(e) })
             })
@@ -120,15 +126,26 @@ export class TcpInitiator extends FixInitiator {
       const connectionOptions: ConnectionOptions | null = tcp ? TlsOptionsFactory.getTlsConnectionOptions(tcp) : null
       if (connectionOptions) {
         try {
+          this.logger.info(`tls connect with ${describeConnectionOptions(connectionOptions)}`)
           tlsSocket = tlsConnect(connectionOptions, () => {
             if (!tlsSocket) return null
             this.logger.info(`client connected ${tlsSocket.authorized ? 'authorized' : 'unauthorized'}`)
-            if (!tlsSocket.authorized) {
+            this.logger.info(`tls negotiated ${describeNegotiated(tlsSocket)}`)
+            this.logger.info(`tls peer certificate ${describePeerCertificate(tlsSocket)}`)
+            // https://github.com/TimelordUK/jspurefix/issues/94 - honour rejectUnauthorized:
+            // false rather than always rejecting on an unauthorized cert. Node's tls.connect()
+            // never throws for an unauthorized peer by itself; it's the caller's job to decide
+            // what to do with tlsSocket.authorized, and rejectUnauthorized is how a caller opts
+            // out of that check - so only reject here when the caller didn't opt out.
+            if (!tlsSocket.authorized && connectionOptions.rejectUnauthorized !== false) {
               const error = tlsSocket.authorizationError
               this.logger.warning(`rejecting from state ${this.state} authorizationError ${error}`)
               tlsSocket.end()
               reject(error)
             } else {
+              if (!tlsSocket.authorized) {
+                this.logger.warning(`proceeding despite unauthorized TLS peer (rejectUnauthorized: false): ${tlsSocket.authorizationError}`)
+              }
               tlsSocket.setEncoding('utf8')
               const tlsDuplex = new TcpDuplex(tlsSocket)
               if (tcp?.tls?.enableTrace) {
@@ -140,6 +157,9 @@ export class TcpInitiator extends FixInitiator {
             }
           })
           tlsSocket.on('error', (err) => {
+            // previously silent - the socket error is the real reason a tls session failed,
+            // and without it the caller only ever sees repeatConnect's generic timeout.
+            this.logger.warning(`tls socket error from state ${this.state}: ${err.message}`)
             reject(err)
           })
         } catch (e) {
@@ -171,14 +191,14 @@ export class TcpInitiator extends FixInitiator {
     }
   }
 
-  private async repeatConnect (timeoutSeconds: number): Promise < MsgTransport > {
+  private async repeatConnect (timeoutSeconds: number, initialError?: Error): Promise < MsgTransport > {
     return await new Promise<MsgTransport>(async (resolve, reject) => {
       const application = this.application
       const promisify = util.promisify
       const timeoutPromise = promisify(setTimeout)
       const reconnectSeconds = application?.reconnectSeconds ?? 5
       let retries = 0
-      let lastError: Error
+      let lastError: Error | undefined = initialError
       const name = application?.name ?? 'initiator'
       this.th = setInterval(() => {
         ++retries
@@ -196,6 +216,7 @@ export class TcpInitiator extends FixInitiator {
         this.clearTimer()
         this.state = InitiatorState.Stopped
         const e = lastError ?? new Error(`${name}: timeout of ${timeoutSeconds} whilst connecting`)
+        this.logger.warning(`${name}: giving up after ${timeoutSeconds}s and ${retries} retries, last error: ${e.message}`)
         reject(e)
       }).catch(e => {
         reject(e)

package/src/transport/tcp/tcp-transport-description.ts

@@ -4,4 +4,11 @@ export interface ITcpTransportDescription {
   readonly port: number
   readonly host: string
   readonly tls?: ITlsOptions
+  /**
+   * TCP keep-alive probe delay in milliseconds for connections accepted by this
+   * listener.  Keep-alive is what lets the OS notice a peer that has vanished
+   * without FIN or RST - the half open socket in issue #153.  Set 0 to disable.
+   * Default 30000.
+   */
+  readonly keepAliveMs?: number
 }

package/src/transport/tcp/tls-diagnostics.ts

@@ -0,0 +1,76 @@
+import { ConnectionOptions, TLSSocket, TlsOptions } from 'tls'
+
+/*
+   tls failures are routinely reported as "it just times out" - see issues #94 and #151.  the
+   session either connects or it does not, and nothing in the log says which options were
+   actually applied or what the peer presented.  enableTrace exists but is node's raw handshake
+   trace: all or nothing, written to stderr rather than through IJsFixLogger.
+
+   these helpers render the small number of facts needed to diagnose a handshake, and are
+   deliberately conservative about what they include - never key material, never a full
+   certificate, only the identifying fields of one.
+ */
+
+function describeCommonOptions (options: ConnectionOptions | TlsOptions): string[] {
+  const parts: string[] = []
+  // presence only - the values are private keys and certificate bodies.
+  parts.push(`key ${options.key ? 'supplied' : 'none'}`)
+  parts.push(`cert ${options.cert ? 'supplied' : 'none'}`)
+  const ca = options.ca
+  const caCount = Array.isArray(ca) ? ca.length : (ca ? 1 : 0)
+  parts.push(`ca ${caCount}`)
+  // the whole point of #94/#151 - make it unambiguous which value won.
+  parts.push(`rejectUnauthorized ${String(options.rejectUnauthorized ?? '(default true)')}`)
+  parts.push(`requestCert ${String(options.requestCert ?? '(default false)')}`)
+  if (options.minVersion) parts.push(`minVersion ${options.minVersion}`)
+  if (options.maxVersion) parts.push(`maxVersion ${options.maxVersion}`)
+  return parts
+}
+
+export function describeConnectionOptions (options: ConnectionOptions): string {
+  const parts: string[] = [`host ${options.host ?? '?'}`, `port ${options.port ?? '?'}`]
+  if (options.servername) parts.push(`servername ${options.servername}`)
+  return parts.concat(describeCommonOptions(options)).join(', ')
+}
+
+export function describeServerOptions (options: TlsOptions): string {
+  return describeCommonOptions(options).join(', ')
+}
+
+/*
+   what the handshake actually negotiated.  the maintainer's suggestion in #94 was to reproduce
+   the connection in powershell to see the negotiated suite - this puts the same facts in our
+   own log instead.
+ */
+export function describeNegotiated (socket: TLSSocket): string {
+  const parts: string[] = []
+  parts.push(`protocol ${socket.getProtocol() ?? 'none'}`)
+  const cipher = socket.getCipher()
+  parts.push(`cipher ${cipher ? `${cipher.name} (${cipher.version})` : 'none'}`)
+  parts.push(`authorized ${socket.authorized}`)
+  if (!socket.authorized && socket.authorizationError) {
+    parts.push(`authorizationError ${String(socket.authorizationError)}`)
+  }
+  return parts.join(', ')
+}
+
+/*
+   identifying fields of the peer certificate only.  getPeerCertificate() returns the full DER
+   in .raw plus the public key - none of that belongs in a log, so pick fields explicitly.
+ */
+export function describePeerCertificate (socket: TLSSocket): string {
+  const cert = socket.getPeerCertificate(false)
+  if (!cert || Object.keys(cert).length === 0) {
+    return 'peer presented no certificate'
+  }
+  const subject = cert.subject ? (cert.subject.CN ?? JSON.stringify(cert.subject)) : '?'
+  const issuer = cert.issuer ? (cert.issuer.CN ?? JSON.stringify(cert.issuer)) : '?'
+  const parts: string[] = [
+    `subject ${subject}`,
+    `issuer ${issuer}`,
+    `valid ${cert.valid_from ?? '?'} to ${cert.valid_to ?? '?'}`
+  ]
+  if (cert.subjectaltname) parts.push(`san ${cert.subjectaltname}`)
+  if (cert.fingerprint256) parts.push(`sha256 ${cert.fingerprint256}`)
+  return parts.join(', ')
+}

package/src/transport/tcp/tls-options-factory.ts

@@ -5,6 +5,22 @@ const path = require('path')
 const fs = require('fs')
 
 export class TlsOptionsFactory {
+  /*
+     session descriptions are routinely hand written json, where a boolean flag is easily
+     quoted by mistake i.e. "rejectUnauthorized": "false".  node treats that string as truthy
+     and so does exactly the opposite of what was intended, silently.  accept the two string
+     spellings rather than inverting the caller's meaning - anything else is left alone so it
+     shows up as an obviously wrong value rather than being guessed at.
+   */
+  static asBoolean (value: any): any {
+    if (typeof value === 'string') {
+      const lowered = value.toLowerCase()
+      if (lowered === 'true') return true
+      if (lowered === 'false') return false
+    }
+    return value
+  }
+
   static read (filePath: string): string {
     const root: string = path.join(__dirname, '../../../')
     const fullPath = path.join(root, filePath)
@@ -18,8 +34,8 @@ export class TlsOptionsFactory {
     let tlsOptions: TlsOptions | null = null
     if (tls) {
       tlsOptions = {
-        requestCert: tls.requestCert,
-        rejectUnauthorized: tls.rejectUnauthorized
+        requestCert: TlsOptionsFactory.asBoolean(tls.requestCert),
+        rejectUnauthorized: TlsOptionsFactory.asBoolean(tls.rejectUnauthorized)
       } as TlsOptions
 
       if (tls.key) {
@@ -62,11 +78,27 @@ export class TlsOptionsFactory {
       if (tcp.tls.sessionTimeout) {
         connectionOptions.sessionTimeout = tcp.tls.sessionTimeout
       }
+      // https://github.com/TimelordUK/jspurefix/issues/151 - ITlsOptions declares these and
+      // getTlsOptions honours them on the server path, so map them here too rather than making
+      // nodeTlsConnectionOptions the only spelling that works for an initiator.  Applied before
+      // the spread below so an explicit nodeTlsConnectionOptions value still wins.
+      if (tls.requestCert !== undefined) {
+        connectionOptions.requestCert = TlsOptionsFactory.asBoolean(tls.requestCert)
+      }
+      if (tls.rejectUnauthorized !== undefined) {
+        connectionOptions.rejectUnauthorized = TlsOptionsFactory.asBoolean(tls.rejectUnauthorized)
+      }
       if (tls.nodeTlsConnectionOptions) {
         connectionOptions = {
           ...connectionOptions,
           ...tls.nodeTlsConnectionOptions
         }
+        if (connectionOptions.rejectUnauthorized !== undefined) {
+          connectionOptions.rejectUnauthorized = TlsOptionsFactory.asBoolean(connectionOptions.rejectUnauthorized)
+        }
+        if (connectionOptions.requestCert !== undefined) {
+          connectionOptions.requestCert = TlsOptionsFactory.asBoolean(connectionOptions.requestCert)
+        }
       }
     }
     return connectionOptions