socketduct 0.1.15

package/test/integration/multiplexed-compatibility.test.js

@@ -0,0 +1,254 @@
+/* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-returns */
+import assert from "node:assert/strict"
+import {readFileSync} from "node:fs"
+import {mkdtemp, rm} from "node:fs/promises"
+import http from "node:http"
+import {createServer} from "node:net"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {connect as tlsConnect, createServer as createTlsServer} from "node:tls"
+import test from "node:test"
+
+import {StaticTokenStore} from "../../src/auth/static-token-store.js"
+import {MultiplexedSocketductConnection} from "../../src/client/multiplexed-connection.js"
+import {startMultiplexedTcpRelay} from "../../src/proxy/multiplexed-relay.js"
+import {generateTestCertificates} from "../helpers/tls-certificates.js"
+
+/** @type {WeakMap<import('node:net').Server, Set<import('node:net').Socket>>} */
+const serverSockets = new WeakMap()
+
+/** @param {import('node:net').Server} server - Server. @returns {Promise<number>} Bound port. */
+async function listen(server) {
+  const sockets = new Set()
+  serverSockets.set(server, sockets)
+  server.on("connection", (socket) => {
+    sockets.add(socket)
+    socket.once("close", () => sockets.delete(socket))
+  })
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  assert(address !== null && typeof address !== "string")
+  return address.port
+}
+
+/** @param {import('node:net').Server} server - Server. @returns {Promise<void>} */
+async function closeServer(server) {
+  for (const socket of serverSockets.get(server) ?? []) socket.destroy()
+  if (!server.listening) return
+  await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve(undefined)))
+}
+
+/** @param {import('node:http').RequestOptions} options - Request. @returns {Promise<{statusCode: number | undefined, body: string}>} */
+async function request(options) {
+  return await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("timed out waiting for HTTP response")), 2_000)
+    const req = http.request(options, (res) => {
+      /** @type {Buffer[]} */
+      const chunks = []
+      res.on("data", (chunk) => chunks.push(chunk))
+      res.on("error", (error) => { clearTimeout(timer); reject(error) })
+      res.on("end", () => {
+        clearTimeout(timer)
+        resolve({statusCode: res.statusCode, body: Buffer.concat(chunks).toString()})
+      })
+    })
+    req.on("error", (error) => { clearTimeout(timer); reject(error) })
+    req.end()
+  })
+}
+
+/** @param {number} targetPort - Allowed target. @returns {Promise<{relay: Awaited<ReturnType<typeof startMultiplexedTcpRelay>>, connection: MultiplexedSocketductConnection}>} */
+async function fixture(targetPort) {
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort
+  })
+  const connection = new MultiplexedSocketductConnection({
+    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}
+  })
+  return {relay, connection}
+}
+
+test("stock Node HTTP uses only createConnection, reuses keep-alive, and handles close-delimited responses", async (t) => {
+  let targetAccepts = 0
+  const target = http.createServer((req, res) => {
+    if (req.url === "/close") {
+      res.shouldKeepAlive = false
+      res.writeHead(200, {connection: "close"})
+      res.end("close-delimited")
+      return
+    }
+    res.end(`ok:${req.url}`)
+  })
+  target.on("connection", () => { targetAccepts += 1 })
+  const targetPort = await listen(target)
+  t.after(() => closeServer(target))
+  const {relay, connection} = await fixture(targetPort)
+  t.after(() => relay.close())
+  t.after(() => connection.close())
+  const agent = new http.Agent({keepAlive: true, maxSockets: 1})
+  agent.createConnection = connection.createConnection
+  t.after(() => agent.destroy())
+
+  assert.deepEqual(await request({agent, host: "127.0.0.1", port: targetPort, path: "/one"}), {statusCode: 200, body: "ok:/one"})
+  assert.deepEqual(await request({agent, host: "127.0.0.1", port: targetPort, path: "/two"}), {statusCode: 200, body: "ok:/two"})
+  assert.equal(targetAccepts, 1)
+  assert.deepEqual(await request({agent, host: "127.0.0.1", port: targetPort, path: "/close"}), {statusCode: 200, body: "close-delimited"})
+  assert.equal(relay.status().physicalAccepts, 1)
+})
+
+test("request abort resets one HTTP stream without closing a sibling", async (t) => {
+  const target = http.createServer((req, res) => {
+    if (req.url === "/slow") {
+      setTimeout(() => res.end("too-late"), 500).unref()
+      return
+    }
+    res.end("sibling-ok")
+  })
+  const targetPort = await listen(target)
+  t.after(() => closeServer(target))
+  const {relay, connection} = await fixture(targetPort)
+  t.after(() => relay.close())
+  t.after(() => connection.close())
+  const agent = new http.Agent({keepAlive: false, maxSockets: 2})
+  agent.createConnection = connection.createConnection
+  t.after(() => agent.destroy())
+
+  const aborted = new Promise((resolve) => {
+    const req = http.request({agent, host: "127.0.0.1", port: targetPort, path: "/slow"})
+    req.on("error", (error) => resolve(error))
+    req.end()
+    req.once("socket", () => req.destroy(new Error("cancelled")))
+  })
+  const sibling = await request({agent, host: "127.0.0.1", port: targetPort, path: "/fast"})
+  assert.match((await aborted).message, /cancelled/)
+  assert.equal(sibling.body, "sibling-ok")
+  assert.equal(relay.status().physicalConnections, 1)
+})
+
+test("HTTP upgrade/hijack and long-lived streaming work over virtual sockets", async (t) => {
+  const target = http.createServer((req, res) => {
+    res.writeHead(200)
+    res.write("part-1|")
+    setTimeout(() => res.end("part-2"), 20).unref()
+  })
+  target.on("upgrade", (_req, socket) => {
+    socket.write("HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: test\r\n\r\nhello")
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(target)
+  t.after(() => closeServer(target))
+  const {relay, connection} = await fixture(targetPort)
+  t.after(() => relay.close())
+  t.after(() => connection.close())
+  const agent = new http.Agent({keepAlive: false})
+  agent.createConnection = connection.createConnection
+  t.after(() => agent.destroy())
+
+  assert.equal((await request({agent, host: "127.0.0.1", port: targetPort, path: "/stream"})).body, "part-1|part-2")
+  const upgraded = await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error("timed out waiting for HTTP upgrade echo")), 2_000)
+    const req = http.request({agent, host: "127.0.0.1", port: targetPort, headers: {connection: "Upgrade", upgrade: "test"}})
+    req.on("upgrade", (_res, socket, head) => {
+      let value = head.toString()
+      const finish = () => {
+        if (!value.includes("hello") || !value.includes("ping")) return
+        socket.destroy()
+        clearTimeout(timer)
+        resolve(value)
+      }
+      socket.on("data", (chunk) => { value += chunk.toString(); finish() })
+      socket.write("ping")
+      finish()
+    })
+    req.on("error", (error) => { clearTimeout(timer); reject(error) })
+    req.end()
+  })
+  assert.match(upgraded, /hello/)
+  assert.match(upgraded, /ping/)
+})
+
+test("node:tls can wrap a VirtualSocket for transitional inner TLS", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-v3-inner-tls-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const target = createTlsServer({
+    cert: readFileSync(certs.serverCertFile),
+    key: readFileSync(certs.serverKeyFile)
+  }, (socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  t.after(() => closeServer(target))
+  const {relay, connection} = await fixture(targetPort)
+  t.after(() => relay.close())
+  t.after(() => connection.close())
+
+  const raw = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "inner-tls"})
+  const secure = tlsConnect({socket: raw, ca: readFileSync(certs.caCertFile), servername: "localhost"})
+  await new Promise((resolve, reject) => {
+    secure.once("secureConnect", resolve)
+    secure.once("error", reject)
+  })
+  const echoed = new Promise((resolve, reject) => {
+    secure.once("data", (chunk) => resolve(chunk.toString()))
+    secure.once("error", reject)
+  })
+  secure.write("secure-echo")
+  assert.equal(await echoed, "secure-echo")
+  secure.destroy()
+})
+
+test("v3 authenticates once over a verified outer TLS transport", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-v3-outer-tls-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  t.after(() => closeServer(target))
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.port === targetPort,
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+  t.after(() => relay.close())
+  const connection = new MultiplexedSocketductConnection({
+    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
+    tls: {caFile: certs.caCertFile, servername: "localhost"}
+  })
+  t.after(() => connection.close())
+  const first = connection.createConnection({host: "127.0.0.1", port: targetPort})
+  const second = connection.createConnection({host: "127.0.0.1", port: targetPort})
+  await Promise.all([
+    new Promise((resolve, reject) => { first.once("connect", resolve); first.once("error", reject) }),
+    new Promise((resolve, reject) => { second.once("connect", resolve); second.once("error", reject) })
+  ])
+  const echoed = new Promise((resolve, reject) => { second.once("data", (chunk) => resolve(chunk.toString())); second.once("error", reject) })
+  second.write("outer-tls")
+  assert.equal(await echoed, "outer-tls")
+  assert.equal(relay.status().physicalAccepts, 1)
+  assert.equal(relay.status().authenticatedConnections, 1)
+  first.destroy()
+  second.destroy()
+})
+
+test("raw TCP pre-connect writes are buffered until stream.opened", async (t) => {
+  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  t.after(() => closeServer(target))
+  const {relay, connection} = await fixture(targetPort)
+  t.after(() => relay.close())
+  t.after(() => connection.close())
+  const socket = connection.createConnection({host: "127.0.0.1", port: targetPort})
+  const echoed = new Promise((resolve, reject) => {
+    socket.once("data", (chunk) => resolve(chunk.toString()))
+    socket.once("error", reject)
+  })
+  socket.write("early")
+  assert.equal(await echoed, "early")
+  socket.destroy()
+})