socketduct 0.1.25 → 0.1.27

package/test/integration/multiplexed-compatibility.test.js

@@ -1,5 +1,5 @@
 /* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-returns */
-import assert from "node:assert/strict"
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {readFileSync} from "node:fs"
 import {mkdtemp, rm} from "node:fs/promises"
 import http from "node:http"
@@ -7,7 +7,6 @@ import {createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
 import {connect as tlsConnect, createServer as createTlsServer} from "node:tls"
-import test from "node:test"
 
 import {StaticTokenStore} from "../../src/auth/static-token-store.js"
 import {MultiplexedSocketductConnection} from "../../src/client/multiplexed-connection.js"
@@ -33,7 +32,7 @@ async function listen(server) {
     })
   })
   const address = server.address()
-  assert(address !== null && typeof address !== "string")
+  if (address === null || typeof address === "string") throw new Error("Expected a bound TCP address")
   return address.port
 }
 
@@ -75,180 +74,182 @@ async function fixture(targetPort) {
   return {relay, connection}
 }
 
-test("stock Node HTTP uses only createConnection, reuses keep-alive, and handles close-delimited responses", async (t) => {
-  let targetAccepts = 0
-  const target = http.createServer((req, res) => {
-    if (req.url === "/close") {
-      res.shouldKeepAlive = false
-      res.writeHead(200, {connection: "close"})
-      res.end("close-delimited")
-      return
-    }
-    res.end(`ok:${req.url}`)
-  })
-  target.on("connection", () => { targetAccepts += 1 })
-  const targetPort = await listen(target)
-  t.after(() => closeServer(target))
-  const {relay, connection} = await fixture(targetPort)
-  t.after(() => relay.close())
-  t.after(() => connection.close())
-  const agent = new http.Agent({keepAlive: true, maxSockets: 1})
-  agent.createConnection = connection.createConnection
-  t.after(() => agent.destroy())
-
-  assert.deepEqual(await request({agent, host: "127.0.0.1", port: targetPort, path: "/one"}), {statusCode: 200, body: "ok:/one"})
-  assert.deepEqual(await request({agent, host: "127.0.0.1", port: targetPort, path: "/two"}), {statusCode: 200, body: "ok:/two"})
-  assert.equal(targetAccepts, 1)
-  assert.deepEqual(await request({agent, host: "127.0.0.1", port: targetPort, path: "/close"}), {statusCode: 200, body: "close-delimited"})
-  assert.equal(relay.status().physicalAccepts, 1)
-})
-
-test("request abort resets one HTTP stream without closing a sibling", async (t) => {
-  const target = http.createServer((req, res) => {
-    if (req.url === "/slow") {
-      setTimeout(() => res.end("too-late"), 500).unref()
-      return
-    }
-    res.end("sibling-ok")
-  })
-  const targetPort = await listen(target)
-  t.after(() => closeServer(target))
-  const {relay, connection} = await fixture(targetPort)
-  t.after(() => relay.close())
-  t.after(() => connection.close())
-  const agent = new http.Agent({keepAlive: false, maxSockets: 2})
-  agent.createConnection = connection.createConnection
-  t.after(() => agent.destroy())
-
-  const aborted = new Promise((resolve) => {
-    const req = http.request({agent, host: "127.0.0.1", port: targetPort, path: "/slow"})
-    req.on("error", (error) => resolve(error))
-    req.end()
-    req.once("socket", () => req.destroy(new Error("cancelled")))
-  })
-  const sibling = await request({agent, host: "127.0.0.1", port: targetPort, path: "/fast"})
-  assert.match((await aborted).message, /cancelled/)
-  assert.equal(sibling.body, "sibling-ok")
-  assert.equal(relay.status().physicalConnections, 1)
-})
-
-test("HTTP upgrade/hijack and long-lived streaming work over virtual sockets", async (t) => {
-  const target = http.createServer((req, res) => {
-    res.writeHead(200)
-    res.write("part-1|")
-    setTimeout(() => res.end("part-2"), 20).unref()
-  })
-  target.on("upgrade", (_req, socket) => {
-    socket.write("HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: test\r\n\r\nhello")
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(target)
-  t.after(() => closeServer(target))
-  const {relay, connection} = await fixture(targetPort)
-  t.after(() => relay.close())
-  t.after(() => connection.close())
-  const agent = new http.Agent({keepAlive: false})
-  agent.createConnection = connection.createConnection
-  t.after(() => agent.destroy())
-
-  assert.equal((await request({agent, host: "127.0.0.1", port: targetPort, path: "/stream"})).body, "part-1|part-2")
-  const upgraded = await new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error("timed out waiting for HTTP upgrade echo")), 2_000)
-    const req = http.request({agent, host: "127.0.0.1", port: targetPort, headers: {connection: "Upgrade", upgrade: "test"}})
-    req.on("upgrade", (_res, socket, head) => {
-      let value = head.toString()
-      const finish = () => {
-        if (!value.includes("hello") || !value.includes("ping")) return
-        socket.destroy()
-        clearTimeout(timer)
-        resolve(value)
+describe("multiplexed compatibility", () => {
+  it("stock Node HTTP uses only createConnection, reuses keep-alive, and handles close-delimited responses", async () => withTestCleanup(async (after) => {
+    let targetAccepts = 0
+    const target = http.createServer((req, res) => {
+      if (req.url === "/close") {
+        res.shouldKeepAlive = false
+        res.writeHead(200, {connection: "close"})
+        res.end("close-delimited")
+        return
       }
-      socket.on("data", (chunk) => { value += chunk.toString(); finish() })
-      socket.write("ping")
-      finish()
+      res.end(`ok:${req.url}`)
     })
-    req.on("error", (error) => { clearTimeout(timer); reject(error) })
-    req.end()
-  })
-  assert.match(upgraded, /hello/)
-  assert.match(upgraded, /ping/)
-})
-
-test("node:tls can wrap a VirtualSocket for transitional inner TLS", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-v3-inner-tls-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const target = createTlsServer({
-    cert: readFileSync(certs.serverCertFile),
-    key: readFileSync(certs.serverKeyFile)
-  }, (socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  t.after(() => closeServer(target))
-  const {relay, connection} = await fixture(targetPort)
-  t.after(() => relay.close())
-  t.after(() => connection.close())
-
-  const raw = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "inner-tls"})
-  const secure = tlsConnect({socket: raw, ca: readFileSync(certs.caCertFile), servername: "localhost"})
-  await new Promise((resolve, reject) => {
-    secure.once("secureConnect", resolve)
-    secure.once("error", reject)
-  })
-  const echoed = new Promise((resolve, reject) => {
-    secure.once("data", (chunk) => resolve(chunk.toString()))
-    secure.once("error", reject)
-  })
-  secure.write("secure-echo")
-  assert.equal(await echoed, "secure-echo")
-  secure.destroy()
-})
-
-test("v3 authenticates once over a verified outer TLS transport", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-v3-outer-tls-"))
-  t.after(() => rm(root, {recursive: true, force: true}))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  t.after(() => closeServer(target))
-  const relay = await startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.port === targetPort,
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
-  })
-  t.after(() => relay.close())
-  const connection = new MultiplexedSocketductConnection({
-    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
-    tls: {caFile: certs.caCertFile, servername: "localhost"}
-  })
-  t.after(() => connection.close())
-  const first = connection.createConnection({host: "127.0.0.1", port: targetPort})
-  const second = connection.createConnection({host: "127.0.0.1", port: targetPort})
-  await Promise.all([
-    new Promise((resolve, reject) => { first.once("connect", resolve); first.once("error", reject) }),
-    new Promise((resolve, reject) => { second.once("connect", resolve); second.once("error", reject) })
-  ])
-  const echoed = new Promise((resolve, reject) => { second.once("data", (chunk) => resolve(chunk.toString())); second.once("error", reject) })
-  second.write("outer-tls")
-  assert.equal(await echoed, "outer-tls")
-  assert.equal(relay.status().physicalAccepts, 1)
-  assert.equal(relay.status().authenticatedConnections, 1)
-  first.destroy()
-  second.destroy()
-})
-
-test("raw TCP pre-connect writes are buffered until stream.opened", async (t) => {
-  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  t.after(() => closeServer(target))
-  const {relay, connection} = await fixture(targetPort)
-  t.after(() => relay.close())
-  t.after(() => connection.close())
-  const socket = connection.createConnection({host: "127.0.0.1", port: targetPort})
-  const echoed = new Promise((resolve, reject) => {
-    socket.once("data", (chunk) => resolve(chunk.toString()))
-    socket.once("error", reject)
-  })
-  socket.write("early")
-  assert.equal(await echoed, "early")
-  socket.destroy()
+    target.on("connection", () => { targetAccepts += 1 })
+    const targetPort = await listen(target)
+    after(() => closeServer(target))
+    const {relay, connection} = await fixture(targetPort)
+    after(() => relay.close())
+    after(() => connection.close())
+    const agent = new http.Agent({keepAlive: true, maxSockets: 1})
+    agent.createConnection = connection.createConnection
+    after(() => agent.destroy())
+
+    expect(await request({agent, host: "127.0.0.1", port: targetPort, path: "/one"})).toEqual({statusCode: 200, body: "ok:/one"})
+    expect(await request({agent, host: "127.0.0.1", port: targetPort, path: "/two"})).toEqual({statusCode: 200, body: "ok:/two"})
+    expect(targetAccepts).toBe(1)
+    expect(await request({agent, host: "127.0.0.1", port: targetPort, path: "/close"})).toEqual({statusCode: 200, body: "close-delimited"})
+    expect(relay.status().physicalAccepts).toBe(1)
+  }))
+
+  it("request abort resets one HTTP stream without closing a sibling", async () => withTestCleanup(async (after) => {
+    const target = http.createServer((req, res) => {
+      if (req.url === "/slow") {
+        setTimeout(() => res.end("too-late"), 500).unref()
+        return
+      }
+      res.end("sibling-ok")
+    })
+    const targetPort = await listen(target)
+    after(() => closeServer(target))
+    const {relay, connection} = await fixture(targetPort)
+    after(() => relay.close())
+    after(() => connection.close())
+    const agent = new http.Agent({keepAlive: false, maxSockets: 2})
+    agent.createConnection = connection.createConnection
+    after(() => agent.destroy())
+
+    const aborted = new Promise((resolve) => {
+      const req = http.request({agent, host: "127.0.0.1", port: targetPort, path: "/slow"})
+      req.on("error", (error) => resolve(error))
+      req.end()
+      req.once("socket", () => req.destroy(new Error("cancelled")))
+    })
+    const sibling = await request({agent, host: "127.0.0.1", port: targetPort, path: "/fast"})
+    expect((await aborted).message).toMatch(/cancelled/)
+    expect(sibling.body).toBe("sibling-ok")
+    expect(relay.status().physicalConnections).toBe(1)
+  }))
+
+  it("HTTP upgrade/hijack and long-lived streaming work over virtual sockets", async () => withTestCleanup(async (after) => {
+    const target = http.createServer((req, res) => {
+      res.writeHead(200)
+      res.write("part-1|")
+      setTimeout(() => res.end("part-2"), 20).unref()
+    })
+    target.on("upgrade", (_req, socket) => {
+      socket.write("HTTP/1.1 101 Switching Protocols\r\nConnection: Upgrade\r\nUpgrade: test\r\n\r\nhello")
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(target)
+    after(() => closeServer(target))
+    const {relay, connection} = await fixture(targetPort)
+    after(() => relay.close())
+    after(() => connection.close())
+    const agent = new http.Agent({keepAlive: false})
+    agent.createConnection = connection.createConnection
+    after(() => agent.destroy())
+
+    expect((await request({agent, host: "127.0.0.1", port: targetPort, path: "/stream"})).body).toBe("part-1|part-2")
+    const upgraded = await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => reject(new Error("timed out waiting for HTTP upgrade echo")), 2_000)
+      const req = http.request({agent, host: "127.0.0.1", port: targetPort, headers: {connection: "Upgrade", upgrade: "test"}})
+      req.on("upgrade", (_res, socket, head) => {
+        let value = head.toString()
+        const finish = () => {
+          if (!value.includes("hello") || !value.includes("ping")) return
+          socket.destroy()
+          clearTimeout(timer)
+          resolve(value)
+        }
+        socket.on("data", (chunk) => { value += chunk.toString(); finish() })
+        socket.write("ping")
+        finish()
+      })
+      req.on("error", (error) => { clearTimeout(timer); reject(error) })
+      req.end()
+    })
+    expect(upgraded).toMatch(/hello/)
+    expect(upgraded).toMatch(/ping/)
+  }))
+
+  it("node:tls can wrap a VirtualSocket for transitional inner TLS", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-v3-inner-tls-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const target = createTlsServer({
+      cert: readFileSync(certs.serverCertFile),
+      key: readFileSync(certs.serverKeyFile)
+    }, (socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    after(() => closeServer(target))
+    const {relay, connection} = await fixture(targetPort)
+    after(() => relay.close())
+    after(() => connection.close())
+
+    const raw = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "inner-tls"})
+    const secure = tlsConnect({socket: raw, ca: readFileSync(certs.caCertFile), servername: "localhost"})
+    await new Promise((resolve, reject) => {
+      secure.once("secureConnect", resolve)
+      secure.once("error", reject)
+    })
+    const echoed = new Promise((resolve, reject) => {
+      secure.once("data", (chunk) => resolve(chunk.toString()))
+      secure.once("error", reject)
+    })
+    secure.write("secure-echo")
+    expect(await echoed).toBe("secure-echo")
+    secure.destroy()
+  }))
+
+  it("v3 authenticates once over a verified outer TLS transport", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-v3-outer-tls-"))
+    after(() => rm(root, {recursive: true, force: true}))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    after(() => closeServer(target))
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.port === targetPort,
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+    })
+    after(() => relay.close())
+    const connection = new MultiplexedSocketductConnection({
+      relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
+      tls: {caFile: certs.caCertFile, servername: "localhost"}
+    })
+    after(() => connection.close())
+    const first = connection.createConnection({host: "127.0.0.1", port: targetPort})
+    const second = connection.createConnection({host: "127.0.0.1", port: targetPort})
+    await Promise.all([
+      new Promise((resolve, reject) => { first.once("connect", resolve); first.once("error", reject) }),
+      new Promise((resolve, reject) => { second.once("connect", resolve); second.once("error", reject) })
+    ])
+    const echoed = new Promise((resolve, reject) => { second.once("data", (chunk) => resolve(chunk.toString())); second.once("error", reject) })
+    second.write("outer-tls")
+    expect(await echoed).toBe("outer-tls")
+    expect(relay.status().physicalAccepts).toBe(1)
+    expect(relay.status().authenticatedConnections).toBe(1)
+    first.destroy()
+    second.destroy()
+  }))
+
+  it("raw TCP pre-connect writes are buffered until stream.opened", async () => withTestCleanup(async (after) => {
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    after(() => closeServer(target))
+    const {relay, connection} = await fixture(targetPort)
+    after(() => relay.close())
+    after(() => connection.close())
+    const socket = connection.createConnection({host: "127.0.0.1", port: targetPort})
+    const echoed = new Promise((resolve, reject) => {
+      socket.once("data", (chunk) => resolve(chunk.toString()))
+      socket.once("error", reject)
+    })
+    socket.write("early")
+    expect(await echoed).toBe("early")
+    socket.destroy()
+  }))
 })