socketduct 0.1.16 → 0.1.18

package/src/reverse/runtime.js

@@ -9,13 +9,28 @@ export async function startReverseHubRuntime(config) {
   if (config.relayTls === undefined) throw new Error("Reverse hub mode requires SOCKETDUCT_TLS_CERT_FILE and SOCKETDUCT_TLS_KEY_FILE")
   if (config.authTokens.length === 0) throw new Error("SOCKETDUCT_AUTH_TOKENS must contain hub client and gateway credentials")
   if (config.reverseGatewayBindings === undefined || config.reverseGatewayBindings.length === 0) throw new Error("SOCKETDUCT_REVERSE_GATEWAY_BINDINGS must bind at least one gateway ID to a credential username")
-  if (config.reverseRoutes === undefined || config.reverseRoutes.length === 0) throw new Error("SOCKETDUCT_REVERSE_ROUTES must allow at least one client/gateway/target route")
+  const exactRoutes = config.reverseRoutes ?? []
+  const routeClassRoutes = config.reverseRouteClassRoutes ?? []
+  if (exactRoutes.length === 0 && routeClassRoutes.length === 0) throw new Error("SOCKETDUCT_REVERSE_ROUTES or SOCKETDUCT_REVERSE_ROUTE_CLASS_ROUTES must allow at least one client route")
   if (config.compression === "off") throw new Error("Reverse hub mode requires SOCKETDUCT_COMPRESSION=auto")
   const bindings = new Map(config.reverseGatewayBindings.map((binding) => [binding.gatewayId, binding.username]))
-  const routes = new Set(config.reverseRoutes.map((route) => formatRoute(route.username, route.gatewayId, {host: route.host, port: route.port})))
-  const selections = new Set(config.reverseRoutes.map((route) => `${route.username}\0${route.gatewayId}`))
+  const authorizedRoutes = new Set([...exactRoutes, ...routeClassRoutes].map((route) => formatRoute(route.username, route.gatewayId, {host: route.host, port: route.port})))
+  const exactRouteKeys = new Set(exactRoutes.map((route) => formatRoute(route.username, route.gatewayId, {host: route.host, port: route.port})))
+  const exactSelections = new Set(exactRoutes.map((route) => `${route.username}\0${route.gatewayId}`))
+  const routeClassSelections = new Set(routeClassRoutes.map((route) => `${route.username}\0${route.routeClass}`))
+  const knownRouteClasses = [...new Set(routeClassRoutes.map((route) => route.routeClass))]
+  /** @type {Map<string, string[]>} */
+  const routeClassGateways = new Map()
+  for (const route of routeClassRoutes) {
+    const key = formatRouteClassRoute(route.username, route.routeClass, {host: route.host, port: route.port})
+    const gatewayIds = routeClassGateways.get(key) ?? []
+    gatewayIds.push(route.gatewayId)
+    routeClassGateways.set(key, gatewayIds)
+  }
+  const routeClassRows = new Set(routeClassRoutes.map((route) => `${formatRouteClassRoute(route.username, route.routeClass, {host: route.host, port: route.port})}\0${route.gatewayId}`))
   if (bindings.size !== config.reverseGatewayBindings.length) throw new Error("SOCKETDUCT_REVERSE_GATEWAY_BINDINGS contains a duplicate gateway ID")
-  if (routes.size !== config.reverseRoutes.length) throw new Error("SOCKETDUCT_REVERSE_ROUTES contains a duplicate route")
+  if (exactRouteKeys.size !== exactRoutes.length) throw new Error("SOCKETDUCT_REVERSE_ROUTES contains a duplicate route")
+  if (routeClassRows.size !== routeClassRoutes.length) throw new Error("SOCKETDUCT_REVERSE_ROUTE_CLASS_ROUTES contains a duplicate route")
   const relayTls = config.relayTls
   const tls = {
     certFile: relayTls.certFile,
@@ -28,9 +43,15 @@ export async function startReverseHubRuntime(config) {
     tls,
     tokens: new StaticTokenStore(config.authTokens),
     knownGatewayIds: [...bindings.keys()],
+    ...(knownRouteClasses.length === 0 ? {} : {knownRouteClasses}),
     authorizeGateway: ({principal, gatewayId}) => bindings.get(gatewayId) === principal.username,
-    authorizeClientGateway: ({principal, gatewayId}) => selections.has(`${principal.username}\0${gatewayId}`),
-    authorizeOpen: ({principal, gatewayId, target}) => routes.has(formatRoute(principal.username, gatewayId, target)),
+    authorizeClientGateway: ({principal, gatewayId}) => exactSelections.has(`${principal.username}\0${gatewayId}`),
+    ...(knownRouteClasses.length === 0 ? {} : {
+      authorizeClientRouteClass: ({principal, routeClass}) => routeClassSelections.has(`${principal.username}\0${routeClass}`),
+      resolveOpenGateways: ({principal, routeClass, target}) => [...(routeClassGateways.get(formatRouteClassRoute(principal.username, routeClass, target)) ?? [])]
+    }),
+    authorizeOpen: ({principal, gatewayId, target}) => authorizedRoutes.has(formatRoute(principal.username, gatewayId, target)),
+    resumeWindowMs: config.resumeWindowMs,
     handshakeTimeoutMs: config.handshakeTimeoutMs,
     maxInputBytesPerConnection: config.maxInputBytesPerConnection,
     compressionLimits: compressionLimits(config)
@@ -68,6 +89,11 @@ function formatRoute(username, gatewayId, target) {
   return `${username}\0${gatewayId}\0${target.host}\0${target.port}`
 }
 
+/** @param {string} username - Client. @param {string} routeClass - Route class. @param {{host: string, port: number}} target - Target. */
+function formatRouteClassRoute(username, routeClass, target) {
+  return `${username}\0${routeClass}\0${target.host}\0${target.port}`
+}
+
 /** @param {import('../config/environment.js').RelayEnvironmentConfig} config - Runtime limits. @returns {import('../protocol/compression.js').CompressionLimits} Defined codec limits. */
 function compressionLimits(config) {
   return {

package/test/e2e/reverse-gateway-process.test.js

@@ -6,6 +6,7 @@ import {createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
 import test from "node:test"
+import {connect as connectTls} from "node:tls"
 
 import {ReverseGatewayConnection} from "../../src/reverse/client.js"
 import {generateTestCertificates} from "../helpers/tls-certificates.js"
@@ -283,3 +284,95 @@ test("spawned reverse hub and outbound gateway expose an allowlisted Docker stre
   assert(gatewayEntries.some(({event}) => event === "transport.connected"))
   assert.doesNotMatch(gatewayContents, /process-gateway-token|127\.0\.0\.1|docker-server/)
 })
+
+test("one route-class client physical connection interleaves streams through different gateway processes", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-route-class-process-"))
+  t.after(() => rm(root, {recursive: true, force: true}))
+  const certificates = generateTestCertificates(root)
+  const targetSockets = new Set()
+  const targetA = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("a:"), chunk])))
+  })
+  const targetB = createServer((socket) => {
+    targetSockets.add(socket)
+    socket.once("close", () => targetSockets.delete(socket))
+    socket.on("data", (chunk) => socket.write(Buffer.concat([Buffer.from("b:"), chunk])))
+  })
+  const targetAPort = await listen(targetA)
+  const targetBPort = await listen(targetB)
+  t.after(() => {
+    for (const socket of targetSockets) socket.destroy()
+    return Promise.all([
+      new Promise((resolve) => targetA.close(() => resolve(undefined))),
+      new Promise((resolve) => targetB.close(() => resolve(undefined)))
+    ])
+  })
+
+  const {child: hub, port: hubPort} = await startProcessOnReservedPort({
+    SOCKETDUCT_MODE: "reverse-hub",
+    SOCKETDUCT_RELAY_HOST: "127.0.0.1",
+    SOCKETDUCT_TLS_CERT_FILE: certificates.serverCertFile,
+    SOCKETDUCT_TLS_KEY_FILE: certificates.serverKeyFile,
+    SOCKETDUCT_AUTH_TOKENS: "home-a:gateway-a-token,home-b:gateway-b-token,tensorbuzz:client-token",
+    SOCKETDUCT_REVERSE_GATEWAY_BINDINGS: "server-a-starlink:home-a,server-b-starlink:home-b",
+    SOCKETDUCT_REVERSE_ROUTE_CLASS_ROUTES: `tensorbuzz:starlink:server-a-starlink:127.0.0.1:${targetAPort},tensorbuzz:starlink:server-b-starlink:127.0.0.1:${targetBPort}`,
+    SOCKETDUCT_STATUS_INTERVAL_MS: "0"
+  }, "reverse-hub.started")
+  t.after(() => stopProcess(hub))
+
+  const gatewayA = await startProcess({
+    SOCKETDUCT_MODE: "reverse-gateway",
+    SOCKETDUCT_REVERSE_GATEWAY_ID: "server-a-starlink",
+    SOCKETDUCT_REVERSE_CONNECTION_ID: "route_class_process_gateway_a",
+    SOCKETDUCT_REVERSE_HUB_HOST: "127.0.0.1",
+    SOCKETDUCT_REVERSE_HUB_PORT: String(hubPort),
+    SOCKETDUCT_REVERSE_TOKEN: "gateway-a-token",
+    SOCKETDUCT_REVERSE_HUB_CA_FILE: certificates.caCertFile,
+    SOCKETDUCT_REVERSE_HUB_SERVERNAME: "localhost",
+    SOCKETDUCT_TARGET_ALLOWLIST: `127.0.0.1:${targetAPort}`,
+    SOCKETDUCT_STATUS_INTERVAL_MS: "0"
+  }, "reverse-gateway.started")
+  t.after(() => stopProcess(gatewayA))
+  const gatewayB = await startProcess({
+    SOCKETDUCT_MODE: "reverse-gateway",
+    SOCKETDUCT_REVERSE_GATEWAY_ID: "server-b-starlink",
+    SOCKETDUCT_REVERSE_CONNECTION_ID: "route_class_process_gateway_b",
+    SOCKETDUCT_REVERSE_HUB_HOST: "127.0.0.1",
+    SOCKETDUCT_REVERSE_HUB_PORT: String(hubPort),
+    SOCKETDUCT_REVERSE_TOKEN: "gateway-b-token",
+    SOCKETDUCT_REVERSE_HUB_CA_FILE: certificates.caCertFile,
+    SOCKETDUCT_REVERSE_HUB_SERVERNAME: "localhost",
+    SOCKETDUCT_TARGET_ALLOWLIST: `127.0.0.1:${targetBPort}`,
+    SOCKETDUCT_STATUS_INTERVAL_MS: "0"
+  }, "reverse-gateway.started")
+  t.after(() => stopProcess(gatewayB))
+
+  let clientPhysicalConnections = 0
+  const client = new ReverseGatewayConnection({
+    routeClass: "starlink",
+    connectionId: "route_class_process_client",
+    hub: {host: "127.0.0.1", port: hubPort, token: "client-token"},
+    tls: {caFile: certificates.caCertFile, servername: "localhost"},
+    createPhysicalSocket: ({host, port, tls}) => {
+      clientPhysicalConnections += 1
+      return connectTls({host, port, ...tls})
+    }
+  })
+  t.after(() => client.close())
+  await withTimeout(client.connect(), "route-class process client connect")
+  const streamA = client.createConnection({host: "127.0.0.1", port: targetAPort, sessionName: "route-class-a"})
+  const streamB = client.createConnection({host: "127.0.0.1", port: targetBPort, sessionName: "route-class-b"})
+  await withTimeout(Promise.all([onceEvent(streamA, "connect"), onceEvent(streamB, "connect")]), "route-class process streams")
+  const responseA = new Promise((resolve, reject) => { streamA.once("error", reject); streamA.once("data", resolve) })
+  const responseB = new Promise((resolve, reject) => { streamB.once("error", reject); streamB.once("data", resolve) })
+  streamA.write("one")
+  streamB.write("two")
+  assert.equal(Buffer.from(/** @type {Uint8Array} */ (await withTimeout(responseA, "route-class response A"))).toString(), "a:one")
+  assert.equal(Buffer.from(/** @type {Uint8Array} */ (await withTimeout(responseB, "route-class response B"))).toString(), "b:two")
+  assert.equal(clientPhysicalConnections, 1)
+  assert.equal(client.status().physicalConnects, 1)
+  streamA.destroy()
+  streamB.destroy()
+})