opencode-ufr 0.2.0

package/src/daemon/vpn/proxy.ts

@@ -0,0 +1,102 @@
+/**
+ * A localhost HTTP CONNECT proxy that carries TCP connections through the
+ * userspace tunnel. The daemon's upstream fetches use Bun's fetch `proxy`
+ * option (verified: absolute-form requests to the proxy) — TLS stays
+ * end-to-end, the proxy just moves bytes.
+ */
+
+import { type Ipv4 } from "./ip"
+import { TcpStack } from "./stack"
+
+type ConnState = {
+  buf: Uint8Array[]
+  stream: ReturnType<TcpStack["dial"]> | null
+}
+
+export type ProxyHandle = {
+  port: number
+  stop(): void
+}
+
+export function startProxy(o: {
+  stack: TcpStack
+  remoteIp: Ipv4
+  allowedHostSuffix?: string // default: uni-freiburg.de — the tunnel carries nothing else
+  allowedPorts?: number[]
+  log?: (msg: string) => void
+}): ProxyHandle {
+  const log = o.log ?? (() => {})
+  const allowedPorts = o.allowedPorts ?? [443]
+  const suffix = (o.allowedHostSuffix ?? "uni-freiburg.de").toLowerCase()
+  const conns = new Map<object, ConnState>()
+
+  const server = Bun.listen({
+    hostname: "127.0.0.1",
+    port: 0,
+    socket: {
+      open(socket) {
+        conns.set(socket, { buf: [], stream: null })
+      },
+      data(socket, chunk) {
+        const state = conns.get(socket)
+        if (!state) return
+        if (state.stream) {
+          // tunnel established: raw bytes flow through the userspace TCP stack
+          state.stream.write(chunk)
+          return
+        }
+        state.buf.push(chunk)
+        const head = Buffer.concat(state.buf.map((c) => Buffer.from(c)))
+        const end = head.indexOf("\r\n\r\n")
+        if (end === -1) return
+        const request = head.subarray(0, end).toString()
+        const m = /^CONNECT\s+(\S+):(\d+)\s+HTTP\/1\.[01]$/i.exec(request.split("\r\n")[0] ?? "")
+        if (!m) {
+          socket.write("HTTP/1.1 400 Bad Request\r\n\r\n")
+          socket.end()
+          return
+        }
+        const port = Number(m[2])
+        if (!allowedPorts.includes(port) || !m[1]!.toLowerCase().endsWith(suffix)) {
+          // the tunnel only carries traffic to the uni host
+          log(`proxy: refusing CONNECT ${m[1]}:${port}`)
+          socket.write("HTTP/1.1 403 Forbidden\r\n\r\n")
+          socket.end()
+          return
+        }
+        socket.write("HTTP/1.1 200 Connection established\r\n\r\n")
+        try {
+          const stream = o.stack.dial(o.remoteIp, port, {
+            data: (d) => socket.write(d),
+            close: (hadError) => {
+              log(`proxy: tunnel side closed${hadError ? " (error)" : ""}`)
+              socket.end()
+            },
+          })
+          state.stream = stream
+          log(`proxy: CONNECT ${m[1]}:${port} dialed through the tunnel`)
+        } catch (e) {
+          log(`proxy: dial failed: ${(e as Error).message}`)
+          socket.write("HTTP/1.1 502 Bad Gateway\r\n\r\n")
+          socket.end()
+        }
+      },
+      close(socket) {
+        const state = conns.get(socket)
+        conns.delete(socket)
+        state?.stream?.end()
+      },
+      error(socket, err) {
+        const state = conns.get(socket)
+        conns.delete(socket)
+        state?.stream?.destroy()
+        log(`proxy: socket error: ${err.message}`)
+      },
+    },
+  })
+
+  return {
+    port: server.port,
+    stop: () => server.stop(true),
+  }
+}

package/src/daemon/vpn/stack.ts

@@ -0,0 +1,140 @@
+/**
+ * The userspace TCP/IP stack: owns the inner IP the tunnel was assigned,
+ * demultiplexes inbound IPv4/TCP datagrams to connections and dials out.
+ *
+ * One stack per tunnel. Only outbound connections to a single remote host are
+ * needed (the gateway daemon's upstream calls), so the connection table is
+ * keyed by (remotePort, localPort).
+ */
+
+import { type Ipv4, buildDatagram, parseDatagram } from "./ip"
+import { TcpConn, freshLocalPort, type TcpOptions } from "./tcp"
+
+export type PacketSink = (pkt: Uint8Array) => void
+
+export type StreamHandlers = {
+  open?(): void
+  data(chunk: Uint8Array): void
+  drain?(): void
+  close(hadError: boolean): void
+}
+
+export type VpnStream = {
+  /** Queue bytes; returns the number of bytes still buffered (0 = drained). */
+  write(data: Uint8Array): number
+  /** Graceful close after buffered data drains. */
+  end(): void
+  /** Abort. */
+  destroy(): void
+}
+
+export class TcpStack {
+  private local: Ipv4
+  private conns = new Map<string, TcpConn>()
+
+  constructor(
+    o: { local: Ipv4; sink: PacketSink; opts?: TcpOptions },
+    private readonly log: (msg: string) => void = () => {},
+  ) {
+    this.local = o.local
+    this.opts = o.opts ?? {}
+    // Deferring the sink to a microtask makes the wire asynchronous: a send
+    // during dial()/flush() can never re-enter the same connection mid-call
+    // (the tunnel round trip would otherwise run inside sendSegment).
+    this.sink = (pkt) => queueMicrotask(() => o.sink(pkt))
+  }
+
+  private opts: TcpOptions
+  private sink: PacketSink
+
+  /** Called once IPCP has assigned the tunnel's inner address. */
+  setLocal(ip: Ipv4): void {
+    this.local = ip
+  }
+
+  get innerIp(): Ipv4 {
+    return this.local
+  }
+
+  get openCount(): number {
+    return this.conns.size
+  }
+
+  /** Outbound connection. Returns a stream handle; handlers fire as the connection progresses. */
+  dial(remote: Ipv4, remotePort: number, h: StreamHandlers): VpnStream {
+    if (this.local === 0) throw new Error("tcp stack has no inner address yet (tunnel not established)")
+    let localPort = freshLocalPort()
+    for (let i = 0; this.conns.has(`${remotePort}:${localPort}`) && i < 100; i++) localPort = freshLocalPort()
+    const key = `${remotePort}:${localPort}`
+    let conn: TcpConn
+    let closed = false
+    conn = new TcpConn(
+      { local: this.local, remote, localPort, remotePort },
+      (pkt) => this.sink(pkt),
+      {
+        onOpen: () => h.open?.(),
+        onData: (_c, data) => h.data(data),
+        onDrain: () => h.drain?.(),
+        onClose: (c, err) => {
+          closed = true
+          this.conns.delete(key)
+          h.close(err)
+          this.log(`tcp ${key} closed${err ? " (error)" : ""}`)
+        },
+      },
+      this.opts,
+    )
+    this.conns.set(key, conn)
+    this.log(`tcp dial ${key} from ${this.local}`)
+    conn.dial()
+    return {
+      write: (data) => {
+        if (closed) return 0
+        try {
+          return conn.write(data)
+        } catch {
+          return 0
+        }
+      },
+      end: () => {
+        try { conn.fin() } catch { /* already closing */ }
+      },
+      destroy: () => conn.reset(),
+    }
+  }
+
+  /** Feed one datagram received from the tunnel. */
+  receive(pkt: Uint8Array): void {
+    const parsed = parseDatagram(pkt)
+    if (!parsed) return
+    if (parsed.dst !== this.local) return
+    const conn = this.conns.get(`${parsed.segment.header.srcPort}:${parsed.segment.header.dstPort}`)
+    if (!conn) {
+      // no listener: answer RST unless the segment is itself a RST or a bare ACK
+      const f = parsed.segment.header.flags
+      if (!(f & 0x04) && !(f & 0x10 && parsed.segment.payload.length === 0)) {
+        const seg = {
+          header: {
+            srcPort: parsed.segment.header.dstPort,
+            dstPort: parsed.segment.header.srcPort,
+            seq: 0,
+            ack: parsed.segment.header.seq,
+            dataOffset: 20,
+            flags: 0x04, // RST
+            window: 0,
+          },
+          payload: new Uint8Array(0),
+        }
+        this.sink(buildDatagram({ src: this.local, dst: parsed.src, segment: seg }))
+      }
+      return
+    }
+    conn.receive(parsed.segment)
+  }
+
+  /** Tear everything down (tunnel is going away). */
+  closeAll(): void {
+    for (const c of this.conns.values()) c.reset()
+    this.conns.clear()
+  }
+}

package/src/daemon/vpn/tcp.ts

@@ -0,0 +1,356 @@
+/**
+ * A single userspace TCP connection: the client side of the three-way
+ * handshake, data transfer, teardown — plus retransmission.
+ *
+ * Simplifications (fine for HTTPS through a tunnel to one known server):
+ * - we only ever dial out, never accept
+ * - inbound segments are processed in order; out-of-order data triggers a
+ *   duplicate ACK so the peer retransmits (no reorder buffer)
+ * - one retransmission timer per connection, exponential backoff, RST after
+ *   too many failed retransmits
+ * - the receive window is generous and inbound data is handed to the
+ *   application immediately (TLS sockets drain fast; no app backpressure)
+ */
+
+import {
+  ACK, FIN, PSH, RST, SYN,
+  type Ipv4,
+  type TcpSegment,
+  buildDatagram,
+} from "./ip"
+
+export type TcpOptions = {
+  mss?: number // max segment size we announce (fits the tunnel MTU)
+  rtoMs?: number // initial retransmission timeout
+  maxRetransmits?: number // give up (RST) after this many consecutive retransmits
+}
+
+export type ConnectionState =
+  | "closed"
+  | "syn-sent"
+  | "established"
+  | "fin-wait-1"
+  | "fin-wait-2"
+  | "time-wait"
+  | "close-wait"
+  | "last-ack"
+
+export type DialInfo = { local: Ipv4; remote: Ipv4; localPort: number; remotePort: number }
+
+/** What the stack hands to the application on this connection. */
+export type TcpEvents = {
+  onOpen?: (c: TcpConn) => void
+  onData?: (c: TcpConn, data: Uint8Array) => void
+  onDrain?: (c: TcpConn) => void
+  onClose?: (c: TcpConn, hadError: boolean) => void
+}
+
+const DEFAULT_MSS = 1360 // fits a 1400-byte tunnel MTU with IP+TCP headers
+const DEFAULT_RTO_MS = 500
+const DEFAULT_MAX_RETRANSMITS = 6
+const RECV_WINDOW = 65535
+
+export function freshLocalPort(): number {
+  return 32768 + Math.floor(Math.random() * 20000)
+}
+
+type QueueEntry = { seq: number; len: number; bytes: Uint8Array } // len counts SYN/FIN as 1
+
+export class TcpConn {
+  state: ConnectionState = "closed"
+  readonly localPort: number
+
+  private seq: number // next byte we will send (SND.NXT)
+  private acked: number // last byte the peer acknowledged (SND.UNA)
+  private rcvNext = 0 // next byte we expect from the peer (RCV.NXT)
+  private peerWindow = 0
+  private peerMss = 536
+  private outQueue: QueueEntry[] = []
+  private earlyQueue: Uint8Array[] = [] // application data written while syn-sent
+  private finQueued = false
+  private finSent = false
+  private closeFired = false
+  private peerFinSeen = false
+  private retransmits = 0
+  private rto: number
+  private timer: ReturnType<typeof setTimeout> | null = null
+  private errored = false
+  private dead = false
+
+  constructor(
+    readonly info: DialInfo,
+    private readonly sendPkt: (pkt: Uint8Array) => void,
+    private readonly events: TcpEvents,
+    private readonly opts: TcpOptions,
+  ) {
+    this.localPort = info.localPort
+    const isn = (Math.floor(Math.random() * 0x7fffffff) | 1) >>> 0
+    this.seq = isn
+    this.acked = isn
+    this.rto = opts.rtoMs ?? DEFAULT_RTO_MS
+  }
+
+  // -- outbound ------------------------------------------------------------
+
+  /** Start the connection (active open). */
+  dial(): void {
+    if (this.state !== "closed") throw new Error(`dial: connection is ${this.state}`)
+    this.state = "syn-sent"
+    const opts = new Uint8Array(4) // MSS option (kind 2, len 4)
+    opts[0] = 2; opts[1] = 4
+    opts[2] = (this.opts.mss ?? DEFAULT_MSS) >> 8
+    opts[3] = (this.opts.mss ?? DEFAULT_MSS) & 0xff
+    this.sendSegment({ flags: SYN }, new Uint8Array(0), 1, opts)
+    this.seq = (this.seq + 1) >>> 0
+    this.armRto()
+  }
+
+  /** Queue application data (sliced to fit the tunnel MTU and the peer's MSS). Returns buffered bytes now queued.
+   *  Data written before the handshake completes is buffered and sent once established. */
+  write(data: Uint8Array): number {
+    if (this.state === "syn-sent") {
+      this.earlyQueue.push(data)
+      return this.earlyQueue.reduce((n, d) => n + d.length, 0)
+    }
+    if (this.state !== "established" && this.state !== "close-wait") throw new Error(`write: connection is ${this.state}`)
+    if (this.finQueued) throw new Error("write after fin")
+    for (const early of this.earlyQueue.splice(0)) this.writeEstablished(early)
+    return this.writeEstablished(data)
+  }
+
+  private writeEstablished(data: Uint8Array): number {
+    const segSize = Math.min(this.peerMss, this.opts.mss ?? DEFAULT_MSS)
+    for (let i = 0; i < data.length; i += segSize) {
+      this.outQueue.push({ seq: this.seq, len: 0, bytes: data.slice(i, i + segSize) })
+      this.seq = (this.seq + Math.min(segSize, data.length - i)) >>> 0
+    }
+    this.flush()
+    return this.buffered
+  }
+
+  /** Graceful close: FIN after queued data drains. */
+  fin(): void {
+    if (this.dead || this.finQueued) return
+    this.finQueued = true
+    this.flush()
+  }
+
+  /** Abort: RST and drop everything. */
+  reset(): void {
+    if (this.dead) return
+    if (this.state !== "syn-sent" || this.rcvNext !== 0) {
+      this.sendSegment({ flags: RST, ack: this.rcvNext }, new Uint8Array(0), 0)
+    }
+    this.finish()
+  }
+
+  get buffered(): number {
+    return this.outQueue.reduce((n, e) => n + e.bytes.length, 0)
+  }
+
+  // -- inbound -------------------------------------------------------------
+
+  /** Feed one inbound segment (already parsed, addressed to this connection). */
+  receive(seg: TcpSegment): void {
+    if (this.dead) return
+    const f = seg.header.flags
+
+    if (f & RST) {
+      this.errored = true
+      this.finish()
+      return
+    }
+
+    if (this.state === "syn-sent") {
+      if (!(f & SYN)) return
+      this.rcvNext = (seg.header.seq + 1) >>> 0
+      this.peerWindow = seg.header.window || 1
+      this.readMss(seg)
+      if (f & ACK) {
+        this.processAck(seg.header.ack, seg.header.window) // acks our SYN: drops it from the queue
+        this.state = "established"
+        this.events.onOpen?.(this)
+        this.sendSegment({ flags: ACK }, new Uint8Array(0), 0)
+        // application data may have been written while we were syn-sent
+        if (this.earlyQueue.length > 0) {
+          for (const early of this.earlyQueue.splice(0)) this.writeEstablished(early)
+        } else {
+          this.flush()
+        }
+      } else {
+        // simultaneous open — reply SYN-ACK
+        const opts = new Uint8Array(4)
+        opts[0] = 2; opts[1] = 4
+        opts[2] = (this.opts.mss ?? DEFAULT_MSS) >> 8
+        opts[3] = (this.opts.mss ?? DEFAULT_MSS) & 0xff
+        this.sendSegment({ flags: SYN | ACK }, new Uint8Array(0), 1, opts)
+      }
+      return
+    }
+
+    if (f & SYN) return // stray retransmitted SYN after handshake
+    if (f & ACK) this.processAck(seg.header.ack, seg.header.window)
+
+    // drop data we have already seen (retransmissions while our ACK was lost)
+    const segEnd = (seg.header.seq + seg.payload.length + (f & FIN ? 1 : 0)) >>> 0
+    if (segEnd <= this.rcvNext) return
+    if (seg.header.seq !== this.rcvNext) {
+      // gap: duplicate-ACK so the peer retransmits what we are missing
+      this.sendSegment({ flags: ACK }, new Uint8Array(0), 0)
+      return
+    }
+
+    if (seg.payload.length > 0) {
+      this.rcvNext = (this.rcvNext + seg.payload.length) >>> 0
+      this.events.onData?.(this, seg.payload)
+      this.sendSegment({ flags: ACK }, new Uint8Array(0), 0) // ack the data
+    }
+
+    if (f & FIN) {
+      this.rcvNext = (this.rcvNext + 1) >>> 0
+      this.peerFinSeen = true
+      this.sendSegment({ flags: ACK }, new Uint8Array(0), 0)
+      if (this.state === "established" || this.state === "fin-wait-2") {
+        const wasEstablished = this.state === "established"
+        this.state = "close-wait"
+        if (!wasEstablished) this.finish() // our FIN was already acked: done
+        else this.fireClose(false) // peer closed first; app may still write, then fin()
+      }
+      return
+    }
+
+    if (this.finQueued && !this.outQueue.some((e) => e.len > 0) && this.unacked === 0) this.maybeSendFin()
+    this.flush()
+  }
+
+  // -- internals -----------------------------------------------------------
+
+  private sendSegment(partial: Partial<TcpSegment["header"]>, payload: Uint8Array, queueLen: number, options?: Uint8Array): void {
+    const header = {
+      srcPort: this.info.localPort,
+      dstPort: this.info.remotePort,
+      seq: this.seq,
+      ack: this.rcvNext,
+      dataOffset: options ? 20 + options.length : 20,
+      flags: 0,
+      window: RECV_WINDOW,
+      ...partial,
+    }
+    const seg: TcpSegment = { header, payload, options }
+    const bytes = buildDatagram({ src: this.info.local, dst: this.info.remote, segment: seg })
+    this.sendPkt(bytes)
+    if (queueLen > 0) this.outQueue.push({ seq: this.seq, len: queueLen, bytes })
+  }
+
+  private flush(): void {
+    let inFlight = this.unacked
+    let sent = false
+    while (this.outQueue.length > 0) {
+      const e = this.outQueue[0]!
+      if (e.len > 0) break // SYN/FIN marker: only retransmits move it
+      const window = Math.max(this.peerWindow, 1)
+      if (inFlight + e.bytes.length > window) break
+      const header = {
+        srcPort: this.info.localPort,
+        dstPort: this.info.remotePort,
+        seq: e.seq,
+        ack: this.rcvNext,
+        dataOffset: 20,
+        flags: ACK | PSH,
+        window: RECV_WINDOW,
+      }
+      this.sendPkt(buildDatagram({ src: this.info.local, dst: this.info.remote, segment: { header, payload: e.bytes } }))
+      inFlight += e.bytes.length
+      sent = true
+      this.outQueue.shift()
+    }
+    if (sent) this.armRto()
+    if (this.finQueued && this.buffered === 0) this.maybeSendFin()
+    if (this.buffered === 0) this.events.onDrain?.(this)
+  }
+
+  private maybeSendFin(): void {
+    if (this.finSent || this.outQueue.some((e) => e.len > 0)) return // FIN already in flight
+    this.finSent = true
+    this.sendSegment({ flags: FIN | ACK }, new Uint8Array(0), 1)
+    this.seq = (this.seq + 1) >>> 0
+    if (this.state === "established") this.state = "fin-wait-1"
+    else if (this.state === "close-wait") this.state = "last-ack"
+    this.armRto()
+  }
+
+  private readMss(seg: TcpSegment): void {
+    const opts = seg.options
+    if (!opts) return
+    let i = 0
+    while (i < opts.length) {
+      const kind = opts[i]!
+      if (kind === 0) break // end of options
+      const len = opts[i + 1] ?? 0
+      if (len < 2 || i + len > opts.length) break
+      if (kind === 2 && len === 4) this.peerMss = Math.max((opts[i + 2]! << 8) | opts[i + 3]!, 216)
+      i += len
+    }
+  }
+
+  private processAck(ack: number, window: number): void {
+    if (window > 0) this.peerWindow = window
+    const unacked = this.unacked
+    const newly = (ack - this.acked) >>> 0
+    if (newly === 0 || newly > unacked) return // stale or covering more than we sent
+    this.acked = ack
+    this.retransmits = 0
+    this.rto = this.opts.rtoMs ?? DEFAULT_RTO_MS
+    // drop fully acknowledged queue entries
+    while (this.outQueue.length > 0) {
+      const e = this.outQueue[0]!
+      if ((e.seq + e.len) >>> 0 > ack || (e.len === 0 && e.seq + e.bytes.length > ack)) break
+      this.outQueue.shift()
+    }
+    if (this.outQueue.length === 0 && this.unacked === 0) {
+      if (this.timer) { clearTimeout(this.timer); this.timer = null }
+    }
+    if (this.state === "fin-wait-1" && this.unacked === 0) this.state = "fin-wait-2"
+    if (this.state === "last-ack" && this.unacked === 0) { this.finish(); return }
+    this.flush()
+  }
+
+  get unacked(): number {
+    return (this.seq - this.acked) >>> 0
+  }
+
+  private armRto(): void {
+    if (this.timer) clearTimeout(this.timer)
+    this.timer = setTimeout(() => this.onRto(), this.rto)
+    this.timer.unref?.()
+  }
+
+  private onRto(): void {
+    this.timer = null
+    if (this.dead || this.unacked === 0) return
+    this.retransmits++
+    if (this.retransmits >= (this.opts.maxRetransmits ?? DEFAULT_MAX_RETRANSMITS)) {
+      this.errored = true
+      this.finish()
+      return
+    }
+    this.rto = Math.min(this.rto * 2, 5_000)
+    const first = this.outQueue[0]!
+    this.sendPkt(first.bytes) // go-back-N: resend oldest unacked segment
+    this.armRto()
+  }
+
+  private fireClose(hadError: boolean): void {
+    if (this.closeFired) return
+    this.closeFired = true
+    this.events.onClose?.(this, hadError)
+  }
+
+  private finish(): void {
+    if (this.dead) return
+    this.dead = true
+    if (this.timer) { clearTimeout(this.timer); this.timer = null }
+    this.state = "closed"
+    this.fireClose(this.errored)
+  }
+}