serverless-ircd 0.10.0 → 0.11.0

package/apps/cf-tcp-container/tests/container-server-tls.test.ts

@@ -0,0 +1,382 @@
+import { execFile } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { type ConnectionOptions, type TLSSocket, connect as tlsConnect } from 'node:tls';
+import { promisify } from 'node:util';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { type TlsListenerOptions, startContainerServer } from '../src/container-server.js';
+
+const execFileAsync = promisify(execFile);
+
+/**
+ * TLS-listener behavior of the container origin. The origin terminates
+ * TLS itself (Spectrum `tls_mode = "full"` topology): cert/key paths are
+ * supplied, `tls.createServer` binds :6697 (or an ephemeral port in
+ * tests), and plaintext :6667 stays closed unless explicitly requested.
+ */
+
+const OPENSSL_TIMEOUT_MS = 15_000;
+
+let certFiles: { certPath: string; keyPath: string; cert: string } | undefined;
+let certDir: string;
+
+/** Self-signed cert via the system `openssl` binary (see tls-e2e.test.ts). */
+async function generateSelfSignedCert(
+  dir: string,
+): Promise<{ certPath: string; keyPath: string; cert: string }> {
+  const certPath = join(dir, 'tls.pem');
+  const keyPath = join(dir, 'tls.key');
+  await execFileAsync(
+    'openssl',
+    [
+      'req',
+      '-x509',
+      '-newkey',
+      'rsa:2048',
+      '-keyout',
+      keyPath,
+      '-out',
+      certPath,
+      '-days',
+      '1',
+      '-nodes',
+      '-subj',
+      '/CN=localhost',
+    ],
+    { timeout: OPENSSL_TIMEOUT_MS },
+  );
+  const { readFile } = await import('node:fs/promises');
+  return { certPath, keyPath, cert: await readFile(certPath, 'utf8') };
+}
+
+/** Minimal TLS IRC test client (mirrors the Spectrum client path). */
+class TlsIrcClient extends EventEmitter {
+  readonly socket: TLSSocket;
+  readonly received: string[] = [];
+
+  constructor(host: string, port: number, ca: string, overrides: Partial<ConnectionOptions> = {}) {
+    super();
+    this.socket = tlsConnect({ host, port, rejectUnauthorized: false, ca, ...overrides });
+    this.socket.setEncoding('utf8');
+    this.socket.on('data', (text: string) => {
+      for (const line of text.split(/\r?\n/u)) {
+        if (line.length > 0) {
+          this.received.push(line);
+          this.emit('line', line);
+        }
+      }
+    });
+  }
+
+  secured(): Promise<void> {
+    return new Promise((resolve, reject) => {
+      if (this.socket.authorized !== undefined) resolve();
+      else {
+        this.socket.once('secure', () => resolve());
+        this.socket.once('error', reject);
+      }
+    });
+  }
+
+  private proxyHeaderPending = true;
+
+  send(line: string): Promise<void> {
+    // The origin requires a PROXY v1 header on every flow (Spectrum
+    // `proxy_protocol = "v1"`); emulate the edge by prefixing the first
+    // frame of each connection with the header line.
+    const frame = this.proxyHeaderPending
+      ? `PROXY TCP4 127.0.0.1 192.0.2.1 40000 6697\r\n${line}\r\n`
+      : `${line}\r\n`;
+    this.proxyHeaderPending = false;
+    return new Promise((resolve, reject) => {
+      this.socket.write(frame, (err) => (err ? reject(err) : resolve()));
+    });
+  }
+
+  waitFor(predicate: (line: string) => boolean, timeoutMs = 3000): Promise<string> {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        reject(new Error(`timeout; received: ${JSON.stringify(this.received)}`));
+      }, timeoutMs);
+      const check = (line: string): void => {
+        if (predicate(line)) {
+          clearTimeout(timeout);
+          this.off('line', check);
+          resolve(line);
+        }
+      };
+      for (const line of this.received) {
+        if (predicate(line)) {
+          clearTimeout(timeout);
+          resolve(line);
+          return;
+        }
+      }
+      this.on('line', check);
+    });
+  }
+
+  close(): Promise<void> {
+    return new Promise((resolve) => {
+      this.socket.once('close', () => resolve());
+      this.socket.end();
+    });
+  }
+}
+
+function certTls(overrides: Partial<TlsListenerOptions> = {}): TlsListenerOptions {
+  if (certFiles === undefined) throw new Error('cert material not generated');
+  return { certPath: certFiles.certPath, keyPath: certFiles.keyPath, port: 0, ...overrides };
+}
+
+describe('container-server — origin TLS listener', () => {
+  beforeAll(async () => {
+    certDir = await mkdtemp(join(tmpdir(), 'sirc-tls-origin-'));
+    try {
+      certFiles = await generateSelfSignedCert(certDir);
+    } catch (err) {
+      console.warn(String((err as Error).message));
+    }
+  }, 30_000);
+
+  afterAll(async () => {
+    await rm(certDir, { recursive: true, force: true });
+  });
+
+  it('binds a TLS listener on an ephemeral port and serves IRC over TLS', async () => {
+    if (certFiles === undefined) return; // openssl not available
+    const srv = await startContainerServer({
+      host: '127.0.0.1',
+      serverName: 'irc.tlsorigin.test',
+      networkName: 'TlsOriginNet',
+      tls: certTls(),
+    });
+    expect(srv.tlsPort).toBeGreaterThan(0);
+
+    const client = new TlsIrcClient('127.0.0.1', srv.tlsPort as number, certFiles.cert);
+    await client.secured();
+    await client.send('NICK tlsUser');
+    await client.send('USER tlsUser 0 * :TlsUser');
+    await client.waitFor((l) => l.startsWith(':irc.tlsorigin.test 001 '));
+    await client.send('PING :tls-listener');
+    await client.waitFor((l) => l === 'PONG :tls-listener');
+    await client.close();
+    await srv.close();
+  });
+
+  it('defaults the TLS listener port to 6697', async () => {
+    if (certFiles === undefined) return;
+    const srv = await startContainerServer({
+      host: '127.0.0.1',
+      serverName: 'irc.tlsorigin.test',
+      networkName: 'TlsOriginNet',
+      tls: certTls({ port: undefined }),
+    });
+    expect(srv.tlsPort).toBe(6697);
+    await srv.close();
+  });
+
+  it('does not open a plaintext listener when only TLS is configured', async () => {
+    if (certFiles === undefined) return;
+    const srv = await startContainerServer({
+      host: '127.0.0.1',
+      serverName: 'irc.tlsorigin.test',
+      networkName: 'TlsOriginNet',
+      tls: certTls({ port: undefined }),
+    });
+    expect(srv.tlsPort).toBe(6697);
+    expect(srv.port).toBeUndefined();
+    await srv.close();
+  });
+
+  it('serves both listeners when plaintext debug and TLS are both requested', async () => {
+    if (certFiles === undefined) return;
+    const srv = await startContainerServer({
+      host: '127.0.0.1',
+      port: 0,
+      serverName: 'irc.tlsorigin.test',
+      networkName: 'TlsOriginNet',
+      tls: certTls(),
+    });
+    expect(srv.port).toBeGreaterThan(0);
+    expect(srv.tlsPort).toBeGreaterThan(0);
+
+    const tlsClient = new TlsIrcClient('127.0.0.1', srv.tlsPort as number, certFiles.cert);
+    await tlsClient.secured();
+    await tlsClient.send('NICK secure');
+    await tlsClient.send('USER secure 0 * :Secure');
+    await tlsClient.waitFor((l) => l.startsWith(':irc.tlsorigin.test 001 secure'));
+    await tlsClient.close();
+
+    const { createConnection } = await import('node:net');
+    const plain = createConnection({ host: '127.0.0.1', port: srv.port as number });
+    await new Promise<void>((resolve) => plain.once('connect', () => resolve()));
+    plain.destroy();
+    await srv.close();
+  });
+
+  it('refuses TLS handshakes after close()', async () => {
+    if (certFiles === undefined) return;
+    const srv = await startContainerServer({
+      host: '127.0.0.1',
+      serverName: 'irc.tlsorigin.test',
+      networkName: 'TlsOriginNet',
+      tls: certTls(),
+    });
+    const port = srv.tlsPort as number;
+    await srv.close();
+    const refused = new Promise<void>((resolve, reject) => {
+      const probe = tlsConnect({ host: '127.0.0.1', port, rejectUnauthorized: false });
+      probe.once('error', () => resolve());
+      probe.once('secureConnect', () =>
+        reject(new Error('TLS listener still accepting after close')),
+      );
+    });
+    await expect(refused).resolves.toBeUndefined();
+  });
+
+  it('rejects startup with a clear error naming the path when the cert file is missing', async () => {
+    if (certFiles === undefined) return;
+    const missing = join(certDir, 'no-such-cert.pem');
+    await expect(
+      startContainerServer({
+        host: '127.0.0.1',
+        serverName: 'irc.tlsorigin.test',
+        networkName: 'TlsOriginNet',
+        tls: certTls({ certPath: missing }),
+      }),
+    ).rejects.toThrow(/no-such-cert\.pem/u);
+  });
+
+  it('rejects startup with a clear error naming the path when the key file is missing', async () => {
+    if (certFiles === undefined) return;
+    const missing = join(certDir, 'no-such-key.pem');
+    await expect(
+      startContainerServer({
+        host: '127.0.0.1',
+        serverName: 'irc.tlsorigin.test',
+        networkName: 'TlsOriginNet',
+        tls: certTls({ keyPath: missing }),
+      }),
+    ).rejects.toThrow(/no-such-key\.pem/u);
+  });
+
+  it('rejects startup when no listener is configured at all', async () => {
+    await expect(
+      startContainerServer({
+        host: '127.0.0.1',
+        serverName: 'irc.tlsorigin.test',
+        networkName: 'TlsOriginNet',
+      }),
+    ).rejects.toThrow(/no listener/u);
+  });
+
+  it('marks TLS-terminated connections as secure (user mode +S in 221)', async () => {
+    if (certFiles === undefined) return;
+    const srv = await startContainerServer({
+      host: '127.0.0.1',
+      serverName: 'irc.tlsorigin.test',
+      networkName: 'TlsOriginNet',
+      tls: certTls(),
+    });
+    const client = new TlsIrcClient('127.0.0.1', srv.tlsPort as number, certFiles.cert);
+    await client.secured();
+    await client.send('NICK modeS');
+    await client.send('USER modeS 0 * :ModeS');
+    await client.waitFor((l) => l.startsWith(':irc.tlsorigin.test 001 '));
+    await client.send('MODE modeS');
+    await client.waitFor((l) => l.startsWith(':irc.tlsorigin.test 221 modeS +S'));
+    await client.close();
+    await srv.close();
+  });
+
+  // Spectrum TCP applications cannot pin TLS versions at the edge (no
+  // `tls_versions` in the Cloudflare API/provider; the fixed floor is
+  // TLS 1.1), so the origin listener is the enforcement point: it only
+  // ever negotiates TLS 1.2 or 1.3 on the re-encrypted Spectrum→origin
+  // leg.
+  describe('pinned protocol versions (TLS 1.2 / 1.3 only)', () => {
+    it('completes an IRC registration over a forced TLS 1.2 handshake (floor)', async () => {
+      if (certFiles === undefined) return;
+      const srv = await startContainerServer({
+        host: '127.0.0.1',
+        serverName: 'irc.tlsorigin.test',
+        networkName: 'TlsOriginNet',
+        tls: certTls(),
+      });
+      const client = new TlsIrcClient('127.0.0.1', srv.tlsPort as number, certFiles.cert, {
+        minVersion: 'TLSv1.2',
+        maxVersion: 'TLSv1.2',
+      });
+      await client.secured();
+      await client.send('NICK floor12');
+      await client.send('USER floor12 0 * :Floor12');
+      await client.waitFor((l) => l.startsWith(':irc.tlsorigin.test 001 floor12'));
+      // Asserted after inbound data: the handshake is unambiguously
+      // complete (getProtocol() mid-handshake reports the offered, not
+      // the negotiated, version).
+      expect(client.socket.getProtocol()).toBe('TLSv1.2');
+      await client.send('PING :tls12-floor');
+      await client.waitFor((l) => l === 'PONG :tls12-floor');
+      await client.close();
+      await srv.close();
+    });
+
+    it('negotiates TLS 1.3 (ceiling)', async () => {
+      if (certFiles === undefined) return;
+      const srv = await startContainerServer({
+        host: '127.0.0.1',
+        serverName: 'irc.tlsorigin.test',
+        networkName: 'TlsOriginNet',
+        tls: certTls(),
+      });
+      const client = new TlsIrcClient('127.0.0.1', srv.tlsPort as number, certFiles.cert, {
+        minVersion: 'TLSv1.3',
+        maxVersion: 'TLSv1.3',
+      });
+      await client.secured();
+      await client.send('PING :tls13-ceiling');
+      await client.waitFor((l) => l === 'PONG :tls13-ceiling');
+      expect(client.socket.getProtocol()).toBe('TLSv1.3');
+      await client.close();
+      await srv.close();
+    });
+
+    it('rejects a TLS 1.1 handshake with a protocol-version alert', async () => {
+      if (certFiles === undefined) return;
+      const srv = await startContainerServer({
+        host: '127.0.0.1',
+        serverName: 'irc.tlsorigin.test',
+        networkName: 'TlsOriginNet',
+        tls: certTls(),
+      });
+      // `@SECLEVEL=0` lets the OpenSSL 3 client offer TLS 1.1 at all —
+      // without it the client errors locally before any handshake bytes
+      // reach the server.
+      const ca = certFiles.cert;
+      const rejected = new Promise<void>((resolve, reject) => {
+        const probe = tlsConnect({
+          host: '127.0.0.1',
+          port: srv.tlsPort as number,
+          rejectUnauthorized: false,
+          ca,
+          minVersion: 'TLSv1.1',
+          maxVersion: 'TLSv1.1',
+          ciphers: 'DEFAULT@SECLEVEL=0',
+        });
+        probe.once('error', (err: Error) => {
+          if (/protocol version/iu.test(err.message)) resolve();
+          else reject(err);
+        });
+        probe.once('secureConnect', () => {
+          probe.destroy();
+          reject(new Error('TLS 1.1 handshake accepted'));
+        });
+      });
+      await expect(rejected).resolves.toBeUndefined();
+      await srv.close();
+    });
+  });
+});