feat(device-edge): add isolated B2 ingress domain

2026-08-04 11:39:01 +03:00
parent b1a5a26b9a
commit 3bb5e6dc27
35 changed files with 5790 additions and 19 deletions
@@ -0,0 +1,294 @@
+import { createServer as createHttpServer } from "node:http";
+import { connect, createServer as createTcpServer } from "node:net";
+
+export function createDeviceEdgeRelayRuntime(options = {}) {
+  const config = normalizeConfig(options);
+  const sessions = new Map();
+  const sessionsByAddress = new Map();
+  const connectionWindows = new Map();
+  let totalAccepted = 0;
+  let totalRejected = 0;
+  let totalForwarded = 0;
+
+  const tcpServer = createTcpServer({ allowHalfOpen: true }, (socket) => {
+    const remoteAddress = normalizeRemoteAddress(socket.remoteAddress);
+    if (
+      sessions.size >= config.maxConcurrentSessions
+      || currentAddressSessions(remoteAddress) >= config.maxSessionsPerAddress
+      || !consumeConnectionPermit(remoteAddress)
+    ) {
+      totalRejected += 1;
+      socket.destroy();
+      return;
+    }
+
+    const session = {
+      remoteAddress,
+      socket,
+      upstream: null,
+      closed: false,
+      forwarded: false,
+    };
+    sessions.set(socket, session);
+    incrementAddressSessions(remoteAddress);
+    totalAccepted += 1;
+
+    socket.setNoDelay(true);
+    socket.setTimeout(config.sessionTimeoutMs);
+    socket.pause();
+    socket.on("timeout", () => rejectSession(session));
+    socket.on("close", () => closeSession(session));
+    socket.on("error", () => rejectSession(session));
+
+    const upstream = connect({
+      host: config.upstreamHost,
+      port: config.upstreamPort,
+    });
+    session.upstream = upstream;
+    upstream.setNoDelay(true);
+    upstream.setTimeout(config.sessionTimeoutMs);
+    upstream.on("connect", () => {
+      if (session.closed) {
+        upstream.destroy();
+        return;
+      }
+      session.forwarded = true;
+      totalForwarded += 1;
+      socket.pipe(upstream);
+      upstream.pipe(socket);
+      socket.resume();
+    });
+    upstream.on("timeout", () => rejectSession(session));
+    upstream.on("error", () => rejectSession(session));
+    upstream.on("close", () => closeSession(session));
+  });
+
+  const healthServer = createHttpServer((request, response) => {
+    response.setHeader("Content-Type", "application/json; charset=utf-8");
+    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("X-Content-Type-Options", "nosniff");
+    if (request.method !== "GET" || request.url !== "/healthz") {
+      response.statusCode = 404;
+      response.end('{"ok":false,"error":"device_edge_relay_route_not_found"}\n');
+      return;
+    }
+    response.statusCode = 200;
+    response.end(`${JSON.stringify({
+      ok: true,
+      service: "nodedc-device-edge-relay",
+      ingress: config.ingressEnabled ? "relay-only" : "disabled",
+      protocolInspection: "disabled",
+      commandTransport: "disabled",
+      sessions: {
+        active: sessions.size,
+        accepted: totalAccepted,
+        rejected: totalRejected,
+        forwarded: totalForwarded,
+      },
+    })}\n`);
+  });
+
+  return {
+    async start() {
+      await listen(healthServer, config.healthPort, config.healthHost);
+      if (config.ingressEnabled) {
+        await listen(tcpServer, config.tcpPort, config.tcpHost);
+      }
+      return {
+        healthAddress: healthServer.address(),
+        tcpAddress: config.ingressEnabled ? tcpServer.address() : null,
+      };
+    },
+    async stop() {
+      for (const session of sessions.values()) rejectSession(session);
+      await Promise.all([
+        closeServer(healthServer),
+        config.ingressEnabled ? closeServer(tcpServer) : Promise.resolve(),
+      ]);
+    },
+    status() {
+      return {
+        activeSessions: sessions.size,
+        totalAccepted,
+        totalRejected,
+        totalForwarded,
+        ingress: config.ingressEnabled ? "relay-only" : "disabled",
+        protocolInspection: "disabled",
+        commandTransport: "disabled",
+      };
+    },
+  };
+
+  function currentAddressSessions(remoteAddress) {
+    return sessionsByAddress.get(remoteAddress) || 0;
+  }
+
+  function incrementAddressSessions(remoteAddress) {
+    sessionsByAddress.set(
+      remoteAddress,
+      currentAddressSessions(remoteAddress) + 1,
+    );
+  }
+
+  function decrementAddressSessions(remoteAddress) {
+    const current = currentAddressSessions(remoteAddress);
+    if (current <= 1) {
+      sessionsByAddress.delete(remoteAddress);
+    } else {
+      sessionsByAddress.set(remoteAddress, current - 1);
+    }
+  }
+
+  function consumeConnectionPermit(remoteAddress) {
+    const nowMs = config.now().getTime();
+    const current = connectionWindows.get(remoteAddress);
+    if (!current || nowMs - current.startedAt >= 60_000) {
+      connectionWindows.set(remoteAddress, { startedAt: nowMs, count: 1 });
+      return true;
+    }
+    if (current.count >= config.maxConnectionsPerMinutePerAddress) return false;
+    current.count += 1;
+    return true;
+  }
+
+  function rejectSession(session) {
+    if (!session.closed) totalRejected += 1;
+    session.socket.destroy();
+    session.upstream?.destroy();
+    closeSession(session);
+  }
+
+  function closeSession(session) {
+    if (session.closed) return;
+    session.closed = true;
+    sessions.delete(session.socket);
+    decrementAddressSessions(session.remoteAddress);
+  }
+}
+
+function normalizeConfig(input) {
+  const ingressEnabled = input.ingressEnabled === true;
+  return {
+    ingressEnabled,
+    healthHost: normalizeHost(input.healthHost, "127.0.0.1"),
+    healthPort: parseInteger(
+      input.healthPort,
+      18221,
+      0,
+      65535,
+      "device_edge_relay_health_port_invalid",
+    ),
+    tcpHost: normalizeTcpHost(input.tcpHost, ingressEnabled),
+    tcpPort: parseInteger(
+      input.tcpPort,
+      9921,
+      0,
+      65535,
+      "device_edge_relay_tcp_port_invalid",
+    ),
+    upstreamHost: ingressEnabled
+      ? normalizeUpstreamHost(input.upstreamHost)
+      : "disabled",
+    upstreamPort: ingressEnabled
+      ? parseInteger(
+        input.upstreamPort,
+        undefined,
+        1,
+        65535,
+        "device_edge_relay_upstream_port_invalid",
+      )
+      : 0,
+    maxConcurrentSessions: parseInteger(
+      input.maxConcurrentSessions,
+      100,
+      1,
+      10000,
+      "device_edge_relay_session_limit_invalid",
+    ),
+    maxSessionsPerAddress: parseInteger(
+      input.maxSessionsPerAddress,
+      10,
+      1,
+      1000,
+      "device_edge_relay_address_session_limit_invalid",
+    ),
+    maxConnectionsPerMinutePerAddress: parseInteger(
+      input.maxConnectionsPerMinutePerAddress,
+      30,
+      1,
+      10000,
+      "device_edge_relay_connection_rate_invalid",
+    ),
+    sessionTimeoutMs: parseInteger(
+      input.sessionTimeoutMs,
+      10000,
+      100,
+      60000,
+      "device_edge_relay_session_timeout_invalid",
+    ),
+    now: typeof input.now === "function" ? input.now : () => new Date(),
+  };
+}
+
+function normalizeHost(value, fallback) {
+  const normalized = String(value || fallback).trim();
+  if (!["127.0.0.1", "::1", "0.0.0.0", "::"].includes(normalized)) {
+    throw new TypeError("device_edge_relay_health_host_invalid");
+  }
+  return normalized;
+}
+
+function normalizeTcpHost(value, ingressEnabled) {
+  const fallback = ingressEnabled ? "0.0.0.0" : "127.0.0.1";
+  const normalized = String(value || fallback).trim();
+  const allowed = ingressEnabled ? ["0.0.0.0", "::"] : ["127.0.0.1", "::1"];
+  if (!allowed.includes(normalized)) {
+    throw new TypeError(
+      ingressEnabled
+        ? "device_edge_relay_public_ingress_host_invalid"
+        : "device_edge_relay_baseline_loopback_only",
+    );
+  }
+  return normalized;
+}
+
+function normalizeUpstreamHost(value) {
+  const normalized = String(value || "").trim();
+  if (
+    normalized.length === 0
+    || normalized.length > 253
+    || /[/:\\s]/.test(normalized)
+  ) {
+    throw new TypeError("device_edge_relay_upstream_host_invalid");
+  }
+  return normalized;
+}
+
+function normalizeRemoteAddress(value) {
+  const normalized = String(value || "unknown").trim();
+  return normalized.slice(0, 64) || "unknown";
+}
+
+function parseInteger(value, fallback, minimum, maximum, errorCode) {
+  const parsed = Number(value ?? fallback);
+  if (!Number.isSafeInteger(parsed) || parsed < minimum || parsed > maximum) {
+    throw new TypeError(errorCode);
+  }
+  return parsed;
+}
+
+function listen(server, port, host) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, host, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+function closeServer(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => (error ? reject(error) : resolve()));
+  });
+}