tickcli-js 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.4
+
+Idle pages send less. A visible page with no key, pointer, touch or gamepad input for 1 min asks the hub for a quarter of the update frames (nothing is lost, changes are merged into each frame); the first input brings the full rate back. In a 4-player test room the idle reader's download fell from 4.4 to 1.2 KB/s. Hidden pages already got no frames.
+
+## 0.1.3
+
+Flood limits. New sockets per client address (`connectsPerAddress`, 40 per 10 s) are checked before the server-wide accept budget, so one client can no longer spend it for everyone; IPv6 addresses count by their /64 (`addressKey`) for every per-address limit. `hardenServer(server)` in `tickcli-js/node` (used by `createGameServer` and `createRemoteServer`): request headers within 10 s, whole request 15 s, idle keep-alive 5 s, 100 headers. Remote: a deployment is looked up at most once per 15 s per id, found or not (`remote.forget(id)` drops one after an edit), fresh lookups are capped per address, and an upgrade over the address budget is refused before any lookup. `ws` 8.23.0 or later (GHSA-37g9-w4hg-h9qr, ping flood).
+
 ## 0.1.2
 
 Top speed for player fields: a third number in a range (`player: { x: [0, 800, 300] }`) caps how far the field moves per second. The hub cuts a faster move to that distance (10% headroom, senders' sample times) instead of refusing it, so speed hacks and teleports look like normal running to the others and to the host; removing a field first does not reset it; a new match allows one free jump. Ranges without the third number work as before.

package/README.md

@@ -262,6 +262,14 @@ Or in your own server: `createRemote({ hub, deployment })` gives `upgrade(req, s
 - A refused page stops and shows why ("This site is not allowed for deployment dep_ab12.").
 - Not a guard: a script outside a browser can send any `Origin`. The caps, the per-address limits and revoking the id are what stop a misused deployment.
 
+### Floods and DDoS
+
+The hub and adapters cap what one client can cost (table below: sockets and new sockets per address, messages, bytes, lookups, slow headers). Keep `ws` at 8.23.0 or later (a peer that floods pings while not reading exhausted memory in earlier versions, GHSA-37g9-w4hg-h9qr); `WS_OPTIONS` keeps compression off and messages at 16 KB (ws's own default is 100 MiB). What the server cannot do alone:
+
+- Volume (a full uplink, SYN floods): the host's network filter. Most VPS hosts include one; turn on the game or always-on profile if offered.
+- Before Node: a per-address limit on new TCP connections in the firewall, generous enough for a school or office behind one address, e.g. nftables `tcp dport 443 ct state new meter tcli4 { ip saddr limit rate over 30/second burst 60 packets } drop` (and the same with `ip6 saddr`).
+- In the proxy: short header timeouts (Caddy `servers { timeouts { read_header 5s } }`). Behind a proxy set `trustProxy` so limits count players, not the proxy.
+
 ## Protocol (version 1)
 
 Every message is JSON with `v: 1`.
@@ -309,8 +317,10 @@ Saving needs a host app that gives the hub a storage port (`new RoomHub({ saves
 |---|---|
 | Players per room | 16 |
 | Rooms on the server / per namespace | 500 / 50 |
-| Sockets on the server / unverified / per address | 2000 / 200 / 20 |
-| New sockets | 200 a second (over it: 1013 busy) |
+| Sockets on the server / unverified / per address | 2000 / 200 / 20 (an IPv6 address counts by its /64, `addressKey`) |
+| New sockets | 40 per address per 10 s (`connectsPerAddress`, checked first, so one client never spends the shared budget), then 200 a second for the whole server (over either: 1013 busy) |
+| HTTP (serve, remote) | request headers within 10 s, whole request 15 s, idle keep-alive 5 s, 100 headers (`hardenServer`; Node's defaults are 60 s, 300 s, 5 s, 2000) |
+| Deployment lookups (remote) | each id at most once per 15 s, found or not (`LOOKUP_MS`; `remote.forget(id)` after an edit); fresh lookups 20 per address per 10 s |
 | Joins per address | 30 a minute |
 | Message / player state / shared state | 16 KB / 2 KB / 64 KB (the client splits bigger host updates) |
 | Shape | plain JSON, depth 4, 64 keys per object, 64 items per list, text 200 characters, keys 40 characters (`SHAPE`); a write that breaks one is refused whole |

package/client/room.js

@@ -216,15 +216,39 @@
   // and how fast the game draws (game.js reports frames a second). When either is bad for 2 s the page asks for half the rate (then a quarter);
   // after 15 s of good readings it asks one step back. The hub uses the slower of its reading and the page's ask and says which (rate {div}).
   // navigator.connection (Chrome, Edge, Android) only sets the starting point: saveData or 3g = half, 2g = a quarter.
-  var Q = { rate: 1, every: 0, ask: 1, net: 1, dev: 1, lateMs: 0, fps: 0, rtt: 0 };
+  // Idle: a visible page with no key, pointer, touch or gamepad input for IDLE_MS = 1 min (someone who walked away; a short pause or a turn-based wait keeps the full rate) asks a quarter of
+  // the frames; the first input brings the full rate back. A hidden page already gets none (see the hub's vis).
+  var Q = { rate: 1, every: 0, ask: 1, net: 1, dev: 1, idle: 1, lateMs: 0, fps: 0, rtt: 0 };
   var late = [], lateBase = [], badSince = 0, goodSince = 0, devBad = 0, devGood = 0, askedAt = 0;
+  var IDLE_MS = 60000, lastInput = Date.now();
+  function touched() {
+    lastInput = Date.now();
+    if (Q.idle > 1) { Q.idle = 1; askRate(); }
+  }
+  function idleCheck() {
+    if (typeof document !== "undefined" && document.hidden) return;
+    try {
+      var gp = navigator.getGamepads && navigator.getGamepads();
+      for (var g = 0; gp && g < gp.length; g++) {
+        var pad = gp[g]; if (!pad) continue;
+        var i; for (i = 0; i < pad.buttons.length; i++) if (pad.buttons[i].pressed) return touched();
+        for (i = 0; i < pad.axes.length; i++) if (Math.abs(pad.axes[i]) > 0.3) return touched();
+      }
+    } catch (e) { /* no gamepads */ }
+    if (Q.idle === 1 && Date.now() - lastInput >= IDLE_MS) { Q.idle = 4; askRate(); }
+  }
+  try {
+    ["pointerdown", "pointermove", "keydown", "touchstart", "wheel"].forEach(function (ev) { addEventListener(ev, touched, { capture: true, passive: true }); });
+    addEventListener("visibilitychange", function () { if (typeof document === "undefined" || !document.hidden) touched(); });
+  } catch (e) { /* no window events */ }
+  setInterval(idleCheck, 2000);
   try {
     var nc = navigator.connection;
     if (nc) Q.net = nc.effectiveType === "slow-2g" || nc.effectiveType === "2g" ? 4 : nc.saveData || nc.effectiveType === "3g" ? 2 : 1;
   } catch (e) { /* no Network Information API */ }
   Q.ask = Q.net;
   function askRate() {
-    var want = Math.max(Q.net, Q.dev);
+    var want = Math.max(Q.net, Q.dev, Q.idle);
     if (want === Q.ask) return;
     Q.ask = want; askedAt = Date.now();
     send({ t: "rate", div: want });

package/dist/hub.d.ts

@@ -22,6 +22,7 @@ export interface Limits {
     maxConnections: number;
     maxPending: number;
     maxPerAddress: number;
+    connectsPerAddress: number;
     joinsPerMinute: number;
     messageBytes: number;
     playerStateBytes: number;
@@ -55,6 +56,9 @@ export interface Limits {
     saveDays: number;
 }
 export declare const DEFAULT_LIMITS: Limits;
+/** The key one client is counted by: an IPv4 address as is, an IPv6 address by its first 64 bits (a home, phone or server is handed a whole /64,
+ *  so per-address limits on full IPv6 addresses would not hold anyone). IPv4-mapped IPv6 counts as the IPv4 address. */
+export declare function addressKey(addr: string): string;
 /** One open socket, as the hub sees it. */
 export interface Conn {
     send(data: string): void;
@@ -435,6 +439,7 @@ export declare class RoomHub {
     private sessions;
     pending: number;
     private perAddr;
+    private addrHits;
     private joins;
     private refused;
     private timer;
@@ -497,10 +502,16 @@ export declare class RoomHub {
     private refuse;
     private count;
     /** A new socket. Null = refused (the caller closes it with the code given). */
-    connect(conn: Conn, addr: string): Session | {
+    /** `counted`: the adapter already spent this socket's allowAddress before its upgrade, so it is not counted twice. */
+    connect(conn: Conn, address: string, o?: {
+        counted?: boolean;
+    }): Session | {
         refused: number;
         reason: string;
     };
+    /** New-socket budget of one address (addressKey), connectsPerAddress per 10 s. Adapters may call it before costly work on an upgrade (a lookup):
+     *  false = refuse now. The window map is pruned when it grows, so random addresses cannot grow it without end. */
+    allowAddress(address: string): boolean;
     /** Meter: `n` copies of a text of `len` bytes (UTF-8, as on the wire) went out (to one room's sockets when given). */
     sent(len: number, n: number, room?: Room | null): void;
     receive(s: Session, text: string): void;

package/dist/hub.js

@@ -19,11 +19,22 @@ export const CLOSE = {
     restart: 1012, roomError: 1011, busy: 1013, silent: 4009, notAllowed: 4001, full: 4002, replaced: 4003, tooFast: 4004, badMessage: 4005, removed: 4006, gameUpdated: 4007, tooSlow: 4008, idle: 4010,
 };
 export const DEFAULT_LIMITS = {
-    maxPlayers: 16, maxRooms: 500, maxRoomsPerScope: 50, maxConnections: 2000, maxPending: 200, maxPerAddress: 20, joinsPerMinute: 30,
+    maxPlayers: 16, maxRooms: 500, maxRoomsPerScope: 50, maxConnections: 2000, maxPending: 200, maxPerAddress: 20, connectsPerAddress: 40, joinsPerMinute: 30,
     messageBytes: 16 * 1024, playerStateBytes: 2048, sharedStateBytes: 64 * 1024, stateRate: 50, sharedRate: 20, actionRate: 5, timeRate: 2,
     pendingMs: 5000, seatHoldMs: 30_000, evictAfterMs: 10_000, awayHoldMs: 300_000, hostSilenceMs: 5000, silentMs: 15_000, acceptRate: 200, roomOutBytes: 250 * 1024, maxOutMbit: 100, actionTimeoutMs: 5000, slowBytes: 64 * 1024, dropBytes: 256 * 1024, rateBytes: 16 * 1024, rateUpMs: 10_000, listRate: 1, idleMs: 15 * 60_000, idleWarnMs: 60_000, listIdleMs: 5 * 60_000, tickMs: 50,
     profileBytes: 16 * 1024, profileEveryMs: 3000, worldEveryMs: 5000, saveDays: 90,
 };
+/** The key one client is counted by: an IPv4 address as is, an IPv6 address by its first 64 bits (a home, phone or server is handed a whole /64,
+ *  so per-address limits on full IPv6 addresses would not hold anyone). IPv4-mapped IPv6 counts as the IPv4 address. */
+export function addressKey(addr) {
+    const a = String(addr || "?").toLowerCase().replace(/^::ffff:(?=\d+\.)/, "").replace(/%.*$/, "");
+    if (!a.includes(":"))
+        return a;
+    const [head, tail = ""] = a.split("::");
+    const h = head ? head.split(":") : [], t = tail ? tail.split(":") : [];
+    const groups = a.includes("::") ? [...h, ...Array(Math.max(0, 8 - h.length - t.length)).fill("0"), ...t] : h;
+    return `${groups.slice(0, 4).map((g) => (g || "0").replace(/^0+(?=.)/, "")).join(":")}::/64`;
+}
 /** Headroom on a declared top speed, so an honest player moving at full speed whose update was clamped once catches up again. */
 export const SPEED_SLACK = 1.1;
 const CODE_ABC = "ABCDEFGHJKMNPQRSTUVWXYZ23456789"; // no 0/O, 1/I/L
@@ -337,6 +348,7 @@ export class RoomHub {
     sessions = new Set();
     pending = 0;
     perAddr = new Map();
+    addrHits = new Map();
     joins = new Map();
     refused = {};
     timer = null;
@@ -395,14 +407,25 @@ export class RoomHub {
     refuse(why) { this.refused[why] = (this.refused[why] || 0) + 1; }
     count(what, n = 1) { this.counts[what] = (this.counts[what] || 0) + n; }
     /** A new socket. Null = refused (the caller closes it with the code given). */
-    connect(conn, addr) {
+    /** `counted`: the adapter already spent this socket's allowAddress before its upgrade, so it is not counted twice. */
+    connect(conn, address, o = {}) {
         const L = this.limits;
+        const addr = addressKey(address);
         if (this.closing)
             return { refused: CLOSE.restart, reason: "server restarting" };
         if (this.sessions.size >= L.maxConnections) {
             this.refuse("connections");
             return { refused: CLOSE.full, reason: "server is full" };
         }
+        // one address first: a single client flooding new sockets is cut here and never spends the server-wide budgets below that everyone shares
+        if ((this.perAddr.get(addr) || 0) >= L.maxPerAddress) {
+            this.refuse("address");
+            return { refused: CLOSE.tooFast, reason: "too many connections" };
+        }
+        if (!o.counted && !this.allowAddress(addr)) {
+            this.refuse("address_rate");
+            return { refused: CLOSE.busy, reason: "too many new connections, try again" };
+        }
         // busy (not full): the page tries again with its normal backoff, so a reconnect wave after a restart spreads out instead of ending on a "full" screen
         if (this.pending >= L.maxPending) {
             this.refuse("pending");
@@ -417,16 +440,29 @@ export class RoomHub {
             this.refuse("accept_rate");
             return { refused: CLOSE.busy, reason: "server is busy, try again" };
         }
-        if ((this.perAddr.get(addr) || 0) >= L.maxPerAddress) {
-            this.refuse("address");
-            return { refused: CLOSE.tooFast, reason: "too many connections" };
-        }
         const s = new Session(this, conn, addr);
         this.sessions.add(s);
         this.pending++;
         this.perAddr.set(addr, (this.perAddr.get(addr) || 0) + 1);
         return s;
     }
+    /** New-socket budget of one address (addressKey), connectsPerAddress per 10 s. Adapters may call it before costly work on an upgrade (a lookup):
+     *  false = refuse now. The window map is pruned when it grows, so random addresses cannot grow it without end. */
+    allowAddress(address) {
+        const key = addressKey(address), now = this.now();
+        let w = this.addrHits.get(key);
+        if (!w || now - w.at >= 10_000) {
+            if (this.addrHits.size >= 50_000)
+                for (const [k, v] of this.addrHits)
+                    if (now - v.at >= 10_000)
+                        this.addrHits.delete(k);
+            if (this.addrHits.size >= 50_000)
+                return false; // 50,000 addresses inside 10 s: refuse newcomers until the window turns
+            w = { at: now, n: 0 };
+            this.addrHits.set(key, w);
+        }
+        return ++w.n <= this.limits.connectsPerAddress;
+    }
     /** Meter: `n` copies of a text of `len` bytes (UTF-8, as on the wire) went out (to one room's sockets when given). */
     sent(len, n, room) {
         this.meter.framesOut += n;