better logging

test/test.connection-limits.node.ts

@@ -0,0 +1,299 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import * as net from 'net';
+import { SmartProxy } from '../ts/proxies/smart-proxy/index.js';
+import { HttpProxy } from '../ts/proxies/http-proxy/index.js';
+
+let testServer: net.Server;
+let smartProxy: SmartProxy;
+let httpProxy: HttpProxy;
+const TEST_SERVER_PORT = 5100;
+const PROXY_PORT = 5101;
+const HTTP_PROXY_PORT = 5102;
+
+// Track all created servers and connections for cleanup
+const allServers: net.Server[] = [];
+const allProxies: (SmartProxy | HttpProxy)[] = [];
+const activeConnections: net.Socket[] = [];
+
+// Helper: Creates a test TCP server
+function createTestServer(port: number): Promise<net.Server> {
+  return new Promise((resolve) => {
+    const server = net.createServer((socket) => {
+      socket.on('data', (data) => {
+        socket.write(`Echo: ${data.toString()}`);
+      });
+      socket.on('error', () => {});
+    });
+    server.listen(port, 'localhost', () => {
+      console.log(`[Test Server] Listening on localhost:${port}`);
+      allServers.push(server);
+      resolve(server);
+    });
+  });
+}
+
+// Helper: Creates multiple concurrent connections
+async function createConcurrentConnections(
+  port: number,
+  count: number,
+  fromIP?: string
+): Promise<net.Socket[]> {
+  const connections: net.Socket[] = [];
+  const promises: Promise<net.Socket>[] = [];
+
+  for (let i = 0; i < count; i++) {
+    promises.push(
+      new Promise((resolve, reject) => {
+        const client = new net.Socket();
+        const timeout = setTimeout(() => {
+          client.destroy();
+          reject(new Error(`Connection ${i} timeout`));
+        }, 5000);
+
+        client.connect(port, 'localhost', () => {
+          clearTimeout(timeout);
+          activeConnections.push(client);
+          connections.push(client);
+          resolve(client);
+        });
+
+        client.on('error', (err) => {
+          clearTimeout(timeout);
+          reject(err);
+        });
+      })
+    );
+  }
+
+  await Promise.all(promises);
+  return connections;
+}
+
+// Helper: Clean up connections
+function cleanupConnections(connections: net.Socket[]): void {
+  connections.forEach(conn => {
+    if (!conn.destroyed) {
+      conn.destroy();
+    }
+  });
+}
+
+tap.test('Setup test environment', async () => {
+  testServer = await createTestServer(TEST_SERVER_PORT);
+  
+  // Create SmartProxy with low connection limits for testing
+  smartProxy = new SmartProxy({
+    routes: [{
+      name: 'test-route',
+      match: {
+        ports: PROXY_PORT
+      },
+      action: {
+        type: 'forward',
+        target: {
+          host: 'localhost',
+          port: TEST_SERVER_PORT
+        }
+      },
+      security: {
+        maxConnections: 5 // Low limit for testing
+      }
+    }],
+    maxConnectionsPerIP: 3, // Low per-IP limit
+    connectionRateLimitPerMinute: 10, // Low rate limit
+    defaults: {
+      security: {
+        maxConnections: 10 // Low global limit
+      }
+    }
+  });
+  
+  await smartProxy.start();
+  allProxies.push(smartProxy);
+});
+
+tap.test('Per-IP connection limits', async () => {
+  // Test that we can create up to the per-IP limit
+  const connections1 = await createConcurrentConnections(PROXY_PORT, 3);
+  expect(connections1.length).toEqual(3);
+  
+  // Try to create one more connection - should fail
+  try {
+    await createConcurrentConnections(PROXY_PORT, 1);
+    expect.fail('Should not allow more than 3 connections per IP');
+  } catch (err) {
+    expect(err.message).toInclude('ECONNRESET');
+  }
+  
+  // Clean up first set of connections
+  cleanupConnections(connections1);
+  await new Promise(resolve => setTimeout(resolve, 100));
+  
+  // Should be able to create new connections after cleanup
+  const connections2 = await createConcurrentConnections(PROXY_PORT, 2);
+  expect(connections2.length).toEqual(2);
+  
+  cleanupConnections(connections2);
+});
+
+tap.test('Route-level connection limits', async () => {
+  // Create multiple connections up to route limit
+  const connections = await createConcurrentConnections(PROXY_PORT, 5);
+  expect(connections.length).toEqual(5);
+  
+  // Try to exceed route limit
+  try {
+    await createConcurrentConnections(PROXY_PORT, 1);
+    expect.fail('Should not allow more than 5 connections for this route');
+  } catch (err) {
+    expect(err.message).toInclude('ECONNRESET');
+  }
+  
+  cleanupConnections(connections);
+});
+
+tap.test('Connection rate limiting', async () => {
+  // Create connections rapidly
+  const connections: net.Socket[] = [];
+  
+  // Create 10 connections rapidly (at rate limit)
+  for (let i = 0; i < 10; i++) {
+    try {
+      const conn = await createConcurrentConnections(PROXY_PORT, 1);
+      connections.push(...conn);
+      // Small delay to avoid per-IP limit
+      if (connections.length >= 3) {
+        cleanupConnections(connections.splice(0, 3));
+        await new Promise(resolve => setTimeout(resolve, 50));
+      }
+    } catch (err) {
+      // Expected to fail at some point due to rate limit
+      expect(i).toBeGreaterThan(0);
+      break;
+    }
+  }
+  
+  cleanupConnections(connections);
+});
+
+tap.test('HttpProxy per-IP validation', async () => {
+  // Create HttpProxy
+  httpProxy = new HttpProxy({
+    port: HTTP_PROXY_PORT,
+    maxConnectionsPerIP: 2,
+    connectionRateLimitPerMinute: 10,
+    routes: []
+  });
+  
+  await httpProxy.start();
+  allProxies.push(httpProxy);
+  
+  // Update SmartProxy to use HttpProxy for TLS termination
+  await smartProxy.stop();
+  smartProxy = new SmartProxy({
+    routes: [{
+      name: 'https-route',
+      match: {
+        ports: PROXY_PORT + 10
+      },
+      action: {
+        type: 'forward',
+        target: {
+          host: 'localhost',
+          port: TEST_SERVER_PORT
+        },
+        tls: {
+          mode: 'terminate'
+        }
+      }
+    }],
+    useHttpProxy: [PROXY_PORT + 10],
+    httpProxyPort: HTTP_PROXY_PORT,
+    maxConnectionsPerIP: 3
+  });
+  
+  await smartProxy.start();
+  
+  // Test that HttpProxy enforces its own per-IP limits
+  const connections = await createConcurrentConnections(PROXY_PORT + 10, 2);
+  expect(connections.length).toEqual(2);
+  
+  // Should reject additional connections
+  try {
+    await createConcurrentConnections(PROXY_PORT + 10, 1);
+    expect.fail('HttpProxy should enforce per-IP limits');
+  } catch (err) {
+    expect(err.message).toInclude('ECONNRESET');
+  }
+  
+  cleanupConnections(connections);
+});
+
+tap.test('IP tracking cleanup', async (tools) => {
+  // Create and close many connections from different IPs
+  const connections: net.Socket[] = [];
+  
+  for (let i = 0; i < 5; i++) {
+    const conn = await createConcurrentConnections(PROXY_PORT, 1);
+    connections.push(...conn);
+  }
+  
+  // Close all connections
+  cleanupConnections(connections);
+  
+  // Wait for cleanup interval (set to 60s in production, but we'll check immediately)
+  await tools.delayFor(100);
+  
+  // Verify that IP tracking has been cleaned up
+  const securityManager = (smartProxy as any).securityManager;
+  const ipCount = (securityManager.connectionsByIP as Map<string, any>).size;
+  
+  // Should have no IPs tracked after cleanup
+  expect(ipCount).toEqual(0);
+});
+
+tap.test('Cleanup queue race condition handling', async () => {
+  // Create many connections concurrently to trigger batched cleanup
+  const promises: Promise<net.Socket[]>[] = [];
+  
+  for (let i = 0; i < 20; i++) {
+    promises.push(createConcurrentConnections(PROXY_PORT, 1).catch(() => []));
+  }
+  
+  const results = await Promise.all(promises);
+  const allConnections = results.flat();
+  
+  // Close all connections rapidly
+  allConnections.forEach(conn => conn.destroy());
+  
+  // Give cleanup queue time to process
+  await new Promise(resolve => setTimeout(resolve, 500));
+  
+  // Verify all connections were cleaned up
+  const connectionManager = (smartProxy as any).connectionManager;
+  const remainingConnections = connectionManager.getConnectionCount();
+  
+  expect(remainingConnections).toEqual(0);
+});
+
+tap.test('Cleanup and shutdown', async () => {
+  // Clean up any remaining connections
+  cleanupConnections(activeConnections);
+  activeConnections.length = 0;
+  
+  // Stop all proxies
+  for (const proxy of allProxies) {
+    await proxy.stop();
+  }
+  allProxies.length = 0;
+  
+  // Close all test servers
+  for (const server of allServers) {
+    await new Promise<void>((resolve) => {
+      server.close(() => resolve());
+    });
+  }
+  allServers.length = 0;
+});
+
+tap.start();

test/test.http-proxy-security-limits.node.ts

@@ -0,0 +1,120 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { SecurityManager } from '../ts/proxies/http-proxy/security-manager.js';
+import { createLogger } from '../ts/proxies/http-proxy/models/types.js';
+
+let securityManager: SecurityManager;
+const logger = createLogger('error'); // Quiet logger for tests
+
+tap.test('Setup HttpProxy SecurityManager', async () => {
+  securityManager = new SecurityManager(logger, [], 3, 10); // Low limits for testing
+});
+
+tap.test('HttpProxy IP connection tracking', async () => {
+  const testIP = '10.0.0.1';
+  
+  // Track connections
+  securityManager.trackConnectionByIP(testIP, 'http-conn1');
+  securityManager.trackConnectionByIP(testIP, 'http-conn2');
+  
+  expect(securityManager.getConnectionCountByIP(testIP)).toEqual(2);
+  
+  // Validate IP should pass
+  let result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeTrue();
+  
+  // Add one more to reach limit
+  securityManager.trackConnectionByIP(testIP, 'http-conn3');
+  
+  // Should now reject new connections
+  result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeFalse();
+  expect(result.reason).toInclude('Maximum connections per IP (3) exceeded');
+  
+  // Remove a connection
+  securityManager.removeConnectionByIP(testIP, 'http-conn1');
+  
+  // Should allow connections again
+  result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeTrue();
+  
+  // Clean up
+  securityManager.removeConnectionByIP(testIP, 'http-conn2');
+  securityManager.removeConnectionByIP(testIP, 'http-conn3');
+});
+
+tap.test('HttpProxy connection rate limiting', async () => {
+  const testIP = '10.0.0.2';
+  
+  // Make 10 connections rapidly (at rate limit)
+  for (let i = 0; i < 10; i++) {
+    const result = securityManager.validateIP(testIP);
+    expect(result.allowed).toBeTrue();
+    // Track the connection to simulate real usage
+    securityManager.trackConnectionByIP(testIP, `rate-conn${i}`);
+  }
+  
+  // 11th connection should be rate limited
+  const result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeFalse();
+  expect(result.reason).toInclude('Connection rate limit (10/min) exceeded');
+  
+  // Clean up
+  for (let i = 0; i < 10; i++) {
+    securityManager.removeConnectionByIP(testIP, `rate-conn${i}`);
+  }
+});
+
+tap.test('HttpProxy CLIENT_IP header handling', async () => {
+  // This tests the scenario where SmartProxy forwards the real client IP
+  const realClientIP = '203.0.113.1';
+  const proxyIP = '127.0.0.1';
+  
+  // Simulate SmartProxy tracking the real client IP
+  securityManager.trackConnectionByIP(realClientIP, 'forwarded-conn1');
+  securityManager.trackConnectionByIP(realClientIP, 'forwarded-conn2');
+  securityManager.trackConnectionByIP(realClientIP, 'forwarded-conn3');
+  
+  // Real client IP should be at limit
+  let result = securityManager.validateIP(realClientIP);
+  expect(result.allowed).toBeFalse();
+  
+  // But proxy IP should still be allowed
+  result = securityManager.validateIP(proxyIP);
+  expect(result.allowed).toBeTrue();
+  
+  // Clean up
+  securityManager.removeConnectionByIP(realClientIP, 'forwarded-conn1');
+  securityManager.removeConnectionByIP(realClientIP, 'forwarded-conn2');
+  securityManager.removeConnectionByIP(realClientIP, 'forwarded-conn3');
+});
+
+tap.test('HttpProxy automatic cleanup', async (tools) => {
+  const testIP = '10.0.0.3';
+  
+  // Create and immediately remove connections
+  for (let i = 0; i < 5; i++) {
+    securityManager.trackConnectionByIP(testIP, `cleanup-conn${i}`);
+    securityManager.removeConnectionByIP(testIP, `cleanup-conn${i}`);
+  }
+  
+  // Add rate limit entries
+  for (let i = 0; i < 5; i++) {
+    securityManager.validateIP(testIP);
+  }
+  
+  // Wait a bit (cleanup runs every 60 seconds in production)
+  // For testing, we'll just verify the cleanup logic works
+  await tools.delayFor(100);
+  
+  // Manually trigger cleanup (in production this happens automatically)
+  (securityManager as any).performIpCleanup();
+  
+  // IP should be cleaned up
+  expect(securityManager.getConnectionCountByIP(testIP)).toEqual(0);
+});
+
+tap.test('Cleanup HttpProxy SecurityManager', async () => {
+  securityManager.clearIPTracking();
+});
+
+tap.start();

test/test.log-deduplication.node.ts

@@ -0,0 +1,112 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { LogDeduplicator } from '../ts/core/utils/log-deduplicator.js';
+
+let deduplicator: LogDeduplicator;
+
+tap.test('Setup log deduplicator', async () => {
+  deduplicator = new LogDeduplicator(1000); // 1 second flush interval for testing
+});
+
+tap.test('Connection rejection deduplication', async (tools) => {
+  // Simulate multiple connection rejections
+  for (let i = 0; i < 10; i++) {
+    deduplicator.log(
+      'connection-rejected',
+      'warn',
+      'Connection rejected',
+      { reason: 'global-limit', component: 'test' },
+      'global-limit'
+    );
+  }
+  
+  for (let i = 0; i < 5; i++) {
+    deduplicator.log(
+      'connection-rejected',
+      'warn',
+      'Connection rejected',
+      { reason: 'route-limit', component: 'test' },
+      'route-limit'
+    );
+  }
+  
+  // Force flush
+  deduplicator.flush('connection-rejected');
+  
+  // The logs should have been aggregated
+  // (Can't easily test the actual log output, but we can verify the mechanism works)
+  expect(deduplicator).toBeInstanceOf(LogDeduplicator);
+});
+
+tap.test('IP rejection deduplication', async (tools) => {
+  // Simulate rejections from multiple IPs
+  const ips = ['192.168.1.100', '192.168.1.101', '192.168.1.100', '10.0.0.1'];
+  const reasons = ['per-ip-limit', 'rate-limit', 'per-ip-limit', 'global-limit'];
+  
+  for (let i = 0; i < ips.length; i++) {
+    deduplicator.log(
+      'ip-rejected',
+      'warn',
+      `Connection rejected from ${ips[i]}`,
+      { remoteIP: ips[i], reason: reasons[i] },
+      ips[i]
+    );
+  }
+  
+  // Add more rejections from the same IP
+  for (let i = 0; i < 20; i++) {
+    deduplicator.log(
+      'ip-rejected',
+      'warn',
+      'Connection rejected from 192.168.1.100',
+      { remoteIP: '192.168.1.100', reason: 'rate-limit' },
+      '192.168.1.100'
+    );
+  }
+  
+  // Force flush
+  deduplicator.flush('ip-rejected');
+  
+  // Verify the deduplicator exists and works
+  expect(deduplicator).toBeInstanceOf(LogDeduplicator);
+});
+
+tap.test('Connection cleanup deduplication', async (tools) => {
+  // Simulate various cleanup events
+  const reasons = ['normal', 'timeout', 'error', 'normal', 'zombie'];
+  
+  for (const reason of reasons) {
+    for (let i = 0; i < 5; i++) {
+      deduplicator.log(
+        'connection-cleanup',
+        'info',
+        `Connection cleanup: ${reason}`,
+        { connectionId: `conn-${i}`, reason },
+        reason
+      );
+    }
+  }
+  
+  // Wait for automatic flush
+  await tools.delayFor(1500);
+  
+  // Verify deduplicator is working
+  expect(deduplicator).toBeInstanceOf(LogDeduplicator);
+});
+
+tap.test('Automatic periodic flush', async (tools) => {
+  // Add some events
+  deduplicator.log('test-event', 'info', 'Test message', {}, 'test');
+  
+  // Wait for automatic flush (should happen within 2x flush interval = 2 seconds)
+  await tools.delayFor(2500);
+  
+  // Events should have been flushed automatically
+  expect(deduplicator).toBeInstanceOf(LogDeduplicator);
+});
+
+tap.test('Cleanup deduplicator', async () => {
+  deduplicator.cleanup();
+  expect(deduplicator).toBeInstanceOf(LogDeduplicator);
+});
+
+tap.start();

test/test.shared-security-manager-limits.node.ts

@@ -0,0 +1,159 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { SharedSecurityManager } from '../ts/core/utils/shared-security-manager.js';
+import type { IRouteConfig, IRouteContext } from '../ts/proxies/smart-proxy/models/route-types.js';
+
+let securityManager: SharedSecurityManager;
+
+tap.test('Setup SharedSecurityManager', async () => {
+  securityManager = new SharedSecurityManager({
+    maxConnectionsPerIP: 5,
+    connectionRateLimitPerMinute: 10,
+    cleanupIntervalMs: 1000 // 1 second for faster testing
+  });
+});
+
+tap.test('IP connection tracking', async () => {
+  const testIP = '192.168.1.100';
+  
+  // Track multiple connections
+  securityManager.trackConnectionByIP(testIP, 'conn1');
+  securityManager.trackConnectionByIP(testIP, 'conn2');
+  securityManager.trackConnectionByIP(testIP, 'conn3');
+  
+  // Verify connection count
+  expect(securityManager.getConnectionCountByIP(testIP)).toEqual(3);
+  
+  // Remove a connection
+  securityManager.removeConnectionByIP(testIP, 'conn2');
+  expect(securityManager.getConnectionCountByIP(testIP)).toEqual(2);
+  
+  // Remove remaining connections
+  securityManager.removeConnectionByIP(testIP, 'conn1');
+  securityManager.removeConnectionByIP(testIP, 'conn3');
+  expect(securityManager.getConnectionCountByIP(testIP)).toEqual(0);
+});
+
+tap.test('Per-IP connection limits validation', async () => {
+  const testIP = '192.168.1.101';
+  
+  // Track connections up to limit
+  for (let i = 1; i <= 5; i++) {
+    securityManager.trackConnectionByIP(testIP, `conn${i}`);
+    const result = securityManager.validateIP(testIP);
+    expect(result.allowed).toBeTrue();
+  }
+  
+  // Verify we're at the limit
+  expect(securityManager.getConnectionCountByIP(testIP)).toEqual(5);
+  
+  // Next connection should be rejected
+  const result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeFalse();
+  expect(result.reason).toInclude('Maximum connections per IP');
+  
+  // Clean up
+  for (let i = 1; i <= 5; i++) {
+    securityManager.removeConnectionByIP(testIP, `conn${i}`);
+  }
+});
+
+tap.test('Connection rate limiting', async () => {
+  const testIP = '192.168.1.102';
+  
+  // Make connections at the rate limit
+  for (let i = 0; i < 10; i++) {
+    const result = securityManager.validateIP(testIP);
+    expect(result.allowed).toBeTrue();
+    securityManager.trackConnectionByIP(testIP, `conn${i}`);
+  }
+  
+  // Next connection should exceed rate limit
+  const result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeFalse();
+  expect(result.reason).toInclude('Connection rate limit');
+  
+  // Clean up connections
+  for (let i = 0; i < 10; i++) {
+    securityManager.removeConnectionByIP(testIP, `conn${i}`);
+  }
+});
+
+tap.test('Route-level connection limits', async () => {
+  const route: IRouteConfig = {
+    name: 'test-route',
+    match: { ports: 443 },
+    action: { type: 'forward', target: { host: 'localhost', port: 8080 } },
+    security: {
+      maxConnections: 3
+    }
+  };
+  
+  const context: IRouteContext = {
+    port: 443,
+    clientIp: '192.168.1.103',
+    serverIp: '0.0.0.0',
+    timestamp: Date.now(),
+    connectionId: 'test-conn'
+  };
+  
+  // Test with connection counts below limit
+  expect(securityManager.isAllowed(route, context, 0)).toBeTrue();
+  expect(securityManager.isAllowed(route, context, 2)).toBeTrue();
+  
+  // Test at limit
+  expect(securityManager.isAllowed(route, context, 3)).toBeFalse();
+  
+  // Test above limit
+  expect(securityManager.isAllowed(route, context, 5)).toBeFalse();
+});
+
+tap.test('IPv4/IPv6 normalization', async () => {
+  const ipv4 = '127.0.0.1';
+  const ipv4Mapped = '::ffff:127.0.0.1';
+  
+  // Track connection with IPv4
+  securityManager.trackConnectionByIP(ipv4, 'conn1');
+  
+  // Both representations should show the same connection
+  expect(securityManager.getConnectionCountByIP(ipv4)).toEqual(1);
+  expect(securityManager.getConnectionCountByIP(ipv4Mapped)).toEqual(1);
+  
+  // Track another connection with IPv6 representation
+  securityManager.trackConnectionByIP(ipv4Mapped, 'conn2');
+  
+  // Both should show 2 connections
+  expect(securityManager.getConnectionCountByIP(ipv4)).toEqual(2);
+  expect(securityManager.getConnectionCountByIP(ipv4Mapped)).toEqual(2);
+  
+  // Clean up
+  securityManager.removeConnectionByIP(ipv4, 'conn1');
+  securityManager.removeConnectionByIP(ipv4Mapped, 'conn2');
+});
+
+tap.test('Automatic cleanup of expired data', async (tools) => {
+  const testIP = '192.168.1.104';
+  
+  // Track a connection and then remove it
+  securityManager.trackConnectionByIP(testIP, 'temp-conn');
+  securityManager.removeConnectionByIP(testIP, 'temp-conn');
+  
+  // Add some rate limit entries (they expire after 1 minute)
+  for (let i = 0; i < 5; i++) {
+    securityManager.validateIP(testIP);
+  }
+  
+  // Wait for cleanup interval (set to 1 second in our test)
+  await tools.delayFor(1500);
+  
+  // The IP should be cleaned up since it has no connections
+  // Note: We can't directly check the internal map, but we can verify
+  // that a new connection is allowed (fresh rate limit)
+  const result = securityManager.validateIP(testIP);
+  expect(result.allowed).toBeTrue();
+});
+
+tap.test('Cleanup SharedSecurityManager', async () => {
+  securityManager.clearIPTracking();
+});
+
+tap.start();