socketduct 0.1.15

package/test/integration/socketduct-http-agent.test.js

@@ -0,0 +1,435 @@
+import assert from "node:assert/strict"
+import {mkdtemp, readdir, rm} from "node:fs/promises"
+import http from "node:http"
+import net from "node:net"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {setTimeout as delay} from "node:timers/promises"
+import test from "node:test"
+
+import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
+import {SocketductHttpAgent} from "../../src/client/http-agent.js"
+import {SocketductRelayError} from "../../src/client/socketduct-socket.js"
+import {startTcpRelay} from "../../src/proxy/tcp-relay.js"
+import {SessionStore} from "../../src/sessions/session.js"
+import {generateTestCertificates} from "../helpers/tls-certificates.js"
+
+const EMPTY_RELAY_STATUS = {
+  activeTunnels: 0,
+  activeTargets: 0,
+  sessions: 0,
+  attachedSessions: 0,
+  detachedSessions: 0,
+  bufferedTargetBytes: 0,
+  targetConnectionAttempts: 0,
+  targetRetryTimers: 0
+}
+
+/**
+ * @param {import('node:net').Server} server - Server to bind.
+ * @returns {Promise<number>} - Bound port.
+ */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  if (address === null || typeof address === "string") {
+    throw new Error("Server did not bind to a TCP port")
+  }
+  return /** @type {import('node:net').AddressInfo} */ (address).port
+}
+
+/**
+ * @param {import('node:net').Server} server - Server to close.
+ * @returns {Promise<void>} - Resolves when closed.
+ */
+async function closeServer(server) {
+  await new Promise((resolve, reject) => {
+    server.close((error) => {
+      if (error) {
+        reject(error)
+        return
+      }
+      resolve(undefined)
+    })
+  })
+}
+
+/**
+ * @param {() => boolean | Promise<boolean>} predicate - Completion predicate.
+ * @param {number} [timeoutMs] - Maximum wait.
+ * @returns {Promise<void>} - Resolves when the predicate succeeds.
+ */
+async function waitUntil(predicate, timeoutMs = 2_000) {
+  const deadline = Date.now() + timeoutMs
+  while (!await predicate()) {
+    if (Date.now() >= deadline) throw new Error("timed out waiting for condition")
+    await new Promise((resolve) => setTimeout(resolve, 2))
+  }
+}
+
+/**
+ * @param {import('node:http').RequestOptions} options - Request options.
+ * @returns {Promise<{statusCode: number | undefined, body: string}>} - Response details.
+ */
+async function request(options) {
+  return await new Promise((resolve, reject) => {
+    const req = http.request(options, (res) => {
+      /** @type {Buffer[]} */
+      const chunks = []
+      res.on("data", (chunk) => chunks.push(chunk))
+      res.on("end", () => {
+        resolve({statusCode: res.statusCode, body: Buffer.concat(chunks).toString("utf8")})
+      })
+    })
+    req.on("error", reject)
+    req.end()
+  })
+}
+
+test("SocketductHttpAgent sends HTTP requests over a Socketduct socket", async () => {
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-http-agent-test-"))
+  const targetServer = http.createServer((req, res) => {
+    if (req.url === "/_ping") {
+      res.writeHead(200, {"content-type": "text/plain"})
+      res.end("OK")
+      return
+    }
+    res.writeHead(404)
+    res.end("missing")
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const agent = new SocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent"
+  })
+
+  const response = await request({agent, host: "docker", port: 80, path: "/_ping", method: "GET"})
+
+  assert.equal(response.statusCode, 200)
+  assert.equal(response.body, "OK")
+  agent.destroy()
+  await relay.close()
+  await closeServer(targetServer)
+  await rm(spoolDirectory, {recursive: true, force: true})
+})
+
+test("SocketductHttpAgent reuses keep-alive sockets", async () => {
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-http-agent-keepalive-test-"))
+  let targetConnections = 0
+  const targetServer = http.createServer((req, res) => {
+    res.writeHead(200, {"content-type": "text/plain"})
+    res.end(`pong:${req.url}`)
+  })
+  targetServer.on("connection", () => {
+    targetConnections += 1
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const agent = new SocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent-keepalive",
+    keepAlive: true,
+    maxSockets: 1
+  })
+
+  const first = await request({agent, host: "docker", port: 80, path: "/one", method: "GET"})
+  const second = await request({agent, host: "docker", port: 80, path: "/two", method: "GET"})
+
+  assert.equal(first.body, "pong:/one")
+  assert.equal(second.body, "pong:/two")
+  assert.equal(targetConnections, 1)
+  agent.destroy()
+  await waitUntil(() => {
+    const status = relay.status()
+    return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+  })
+  assert.deepEqual(relay.status(), EMPTY_RELAY_STATUS)
+  await relay.close()
+  await closeServer(targetServer)
+  await rm(spoolDirectory, {recursive: true, force: true})
+})
+
+test("SocketductHttpAgent closes a reused session after target EOF through a TLS relay", async () => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-http-agent-tls-relay-close-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const spoolDirectory = join(root, "spool")
+  /** @type {Set<import('node:net').Socket>} */
+  const targetSockets = new Set()
+  const targetServer = http.createServer((req, res) => {
+    if (req.url === "/close") res.setHeader("connection", "close")
+    res.end(req.url === "/close" ? "tls-relay-close" : "tls-relay-keepalive")
+  })
+  targetServer.on("connection", (socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000}),
+    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+  })
+  /** @type {(() => void) | undefined} */
+  let resolveSocketClosed
+  /** @type {import('../../src/client/socketduct-socket.js').SocketductSocket | undefined} */
+  let observedSocket
+  const socketClosed = new Promise((resolve) => { resolveSocketClosed = () => resolve(undefined) })
+  class ObservedSocketductHttpAgent extends SocketductHttpAgent {
+    /**
+     * @override
+     * @param {import('node:http').ClientRequestArgs} options - HTTP connection options.
+     * @param {(error: Error | null, socket: import('../../src/client/socketduct-socket.js').SocketductSocket) => void} [callback] - Agent callback.
+     * @returns {import('../../src/client/socketduct-socket.js').SocketductSocket} Socketduct socket.
+     */
+    createConnection(options, callback) {
+      const socket = super.createConnection(options, callback)
+      observedSocket = socket
+      socket.once("close", () => resolveSocketClosed?.())
+      return socket
+    }
+  }
+  const agent = new ObservedSocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent-tls-relay-close",
+    keepAlive: true,
+    maxSockets: 1,
+    tls: {caFile: certs.caCertFile, servername: "localhost", rejectUnauthorized: true}
+  })
+
+  try {
+    assert.deepEqual(
+      await request({agent, host: "docker", port: 80, path: "/keepalive", method: "GET"}),
+      {statusCode: 200, body: "tls-relay-keepalive"}
+    )
+    assert.equal(targetSockets.size, 1)
+    assert.equal(relay.status().attachedSessions, 1)
+    assert.deepEqual(
+      await request({agent, host: "docker", port: 80, path: "/close", method: "GET"}),
+      {statusCode: 200, body: "tls-relay-close"}
+    )
+    await socketClosed
+
+    agent.destroy()
+    agent.destroy()
+    await waitUntil(async () => relay.status().sessions === 0 && targetSockets.size === 0 &&
+      (await readdir(spoolDirectory).catch((error) => {
+        if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
+        throw error
+      })).length === 0).catch((error) => {
+      throw new Error(`TLS relay resources did not return to zero: ${JSON.stringify(relay.status())}; targets=${targetSockets.size}`, {cause: error})
+    })
+
+    assert.deepEqual(relay.status(), EMPTY_RELAY_STATUS)
+    assert.equal(Object.keys(agent.sockets).length, 0)
+    assert.equal(Object.keys(agent.freeSockets).length, 0)
+    assert.equal(Object.keys(agent.requests).length, 0)
+    assert.equal(observedSocket?.listenerCount("connect"), 0)
+    observedSocket = undefined
+  } finally {
+    agent.destroy()
+    await relay.close()
+    for (const socket of targetSockets) socket.destroy()
+    await closeServer(targetServer)
+    await rm(root, {recursive: true, force: true})
+  }
+})
+
+test("SocketductHttpAgent reports unauthorized targets as HTTP request errors", async () => {
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-http-agent-deny-test-"))
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: () => false,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const agent = new SocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: 2375},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent-denied"
+  })
+
+  await assert.rejects(request({agent, host: "docker", port: 80, path: "/_ping", method: "GET"}), (error) => {
+    assert.ok(error instanceof SocketductRelayError)
+    assert.equal(error.code, "TARGET_UNAUTHORIZED")
+    assert.equal(error.retryable, false)
+    return true
+  })
+  agent.destroy()
+  await relay.close()
+  await rm(spoolDirectory, {recursive: true, force: true})
+})
+
+test("SocketductHttpAgent callback receives a typed pre-connect relay failure exactly once", async () => {
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-http-agent-callback-error-test-"))
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: () => false,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const agent = new SocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: 2375},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent-callback-error"
+  })
+
+  let callbackCount = 0
+  const result = await new Promise((resolve) => {
+    const socket = agent.createConnection({}, (error, connectedSocket) => {
+      callbackCount += 1
+      resolve({connectedSocket, error})
+    })
+    socket.on("error", () => {})
+  })
+
+  assert.equal(callbackCount, 1)
+  assert.ok(result.error instanceof SocketductRelayError)
+  assert.equal(result.error.code, "TARGET_UNAUTHORIZED")
+  assert.equal(result.error.retryable, false)
+  assert.ok(result.connectedSocket)
+  agent.destroy()
+  await relay.close()
+  await rm(spoolDirectory, {recursive: true, force: true})
+})
+
+test("SocketductHttpAgent handles delayed streaming response close without relay socket errors", async () => {
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-http-agent-stream-close-test-"))
+  const targetServer = http.createServer((req, res) => {
+    if (req.url === "/logs") {
+      res.writeHead(200, {"content-type": "application/octet-stream"})
+      void (async () => {
+        res.write("chunk-one")
+        await delay(10)
+        res.write("chunk-two")
+        await delay(10)
+        res.end()
+      })()
+      return
+    }
+
+    res.writeHead(404)
+    res.end("missing")
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const agent = new SocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent-stream-close"
+  })
+
+  const response = await request({agent, host: "docker", port: 80, path: "/logs", method: "GET"})
+
+  assert.equal(response.statusCode, 200)
+  assert.equal(response.body, "chunk-onechunk-two")
+  agent.destroy()
+  await relay.close()
+  await closeServer(targetServer)
+  await rm(spoolDirectory, {recursive: true, force: true})
+})
+
+test("SocketductHttpAgent ends responses that rely on target TCP close", async () => {
+  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-http-agent-target-eof-test-"))
+  const targetServer = net.createServer((socket) => {
+    socket.once("data", () => {
+      socket.write("HTTP/1.1 200 OK\r\nContent-Type: application/octet-stream\r\n\r\n")
+      socket.write("close-delimited-body")
+      socket.end()
+    })
+  })
+  const targetPort = await listen(targetServer)
+
+  const users = new InMemoryUserStore()
+  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+  await users.createUser({username: "kasper", password: "correct horse battery staple"})
+  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+  const relay = await startTcpRelay({
+    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+    tokens,
+    sessions: new SessionStore({now: () => 1000})
+  })
+  const agent = new SocketductHttpAgent({
+    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+    target: {host: "127.0.0.1", port: targetPort},
+    spoolDirectory,
+    sessionNamePrefix: "http-agent-target-eof"
+  })
+
+  const timeout = AbortSignal.timeout(1000)
+  const response = await new Promise((resolve, reject) => {
+    const req = http.request({agent, host: "docker", port: 80, path: "/raw", method: "POST", signal: timeout}, (res) => {
+      /** @type {Buffer[]} */
+      const chunks = []
+      res.on("data", (chunk) => chunks.push(chunk))
+      res.on("end", () => resolve({statusCode: res.statusCode, body: Buffer.concat(chunks).toString("utf8")}))
+    })
+    req.on("error", reject)
+    req.end("{}")
+  })
+
+  assert.deepEqual(response, {statusCode: 200, body: "close-delimited-body"})
+  agent.destroy()
+  await waitUntil(() => {
+    const status = relay.status()
+    return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+  })
+  assert.deepEqual(relay.status(), EMPTY_RELAY_STATUS)
+  await relay.close()
+  await closeServer(targetServer)
+  await rm(spoolDirectory, {recursive: true, force: true})
+})