Runner: Proxy härten (R13 Listen-Adressen, Hop-by-hop, Upgrade-Race, Touch, Timeout)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

runner/src/config.js

@@ -8,6 +8,7 @@ export function loadConfig(env = process.env) {
     previewsRoot: env.PREVIEWS_ROOT || '/var/www/previews',
     workRoot: env.RUNNER_WORK_ROOT || '/srv/webklar-preview-runner/work',
     cacheRoot: env.RUNNER_CACHE_ROOT || '/srv/webklar-preview-runner/cache',
+    sandboxSubnet: env.PREVIEW_SANDBOX_SUBNET || '172.30.0.0/24',
     apiPort: 8080,
     proxyPort: 8081,
     minFreeBytes: 1.5 * 1024 ** 3,

runner/src/index.js

@@ -4,6 +4,8 @@ import { createDocker } from './docker.js';
 import { createJobs } from './jobs.js';
 import { createDev } from './dev.js';
 import { createProxy } from './proxy.js';
+import os from 'node:os';
+import { listenAddresses } from './listen.js';
 
 const config = loadConfig(process.env);
 const docker = createDocker();
@@ -16,9 +18,9 @@ const dev = createDev({ config, docker, jobs: realJobs });
 dev.cleanupOrphans().catch((e) => console.error('cleanupOrphans', e));
 setInterval(() => dev.sweep().catch((e) => console.error('sweep', e)), 60e3).unref();
 
-createApiServer({ config, jobs, dev }).listen(config.apiPort, () => {
-  console.log(`Preview-Runner API auf Port ${config.apiPort}`);
-});
-createProxy({ config, dev }).listen(config.proxyPort, () => {
-  console.log(`Preview-Runner Proxy auf Port ${config.proxyPort}`);
-});
+// R13: nur auf Adressen außerhalb des Sandbox-Netzes lauschen (kein Zugriff aus Dev-Containern am Traefik-Auth vorbei).
+const addrs = listenAddresses(os.networkInterfaces(), config.sandboxSubnet);
+for (const addr of addrs) {
+  createApiServer({ config, jobs, dev }).listen(config.apiPort, addr, () => console.log(`Preview-Runner API auf ${addr}:${config.apiPort}`));
+  createProxy({ config, dev }).listen(config.proxyPort, addr, () => console.log(`Preview-Runner Proxy auf ${addr}:${config.proxyPort}`));
+}

runner/src/listen.js

@@ -0,0 +1,26 @@
+// R13: API und Proxy nur auf Adressen binden, die NICHT im Sandbox-Netz liegen (Dev-Container laufen fremden Code).
+import os from 'node:os';
+
+const ipToInt = (ip) => ip.split('.').reduce((a, o) => ((a << 8) | Number(o)) >>> 0, 0);
+
+export function inSubnet(ip, subnet) {
+  const [base, bits] = subnet.split('/');
+  const n = Number(bits);
+  if (!/^\d+\.\d+\.\d+\.\d+$/.test(base) || !Number.isInteger(n) || n < 0 || n > 32) throw new Error(`Ungültiges Sandbox-Netz: ${subnet}`);
+  const mask = n === 0 ? 0 : (~0 << (32 - n)) >>> 0;
+  return ((ipToInt(ip) & mask) >>> 0) === ((ipToInt(base) & mask) >>> 0);
+}
+
+export function listenAddresses(interfaces = os.networkInterfaces(), subnet, { allowLoopback = false } = {}) {
+  const out = [];
+  for (const list of Object.values(interfaces)) {
+    for (const i of list || []) {
+      if (i.family !== 'IPv4' && i.family !== 4) continue;
+      if (i.internal && !allowLoopback) continue;
+      if (inSubnet(i.address, subnet)) continue;
+      if (!out.includes(i.address)) out.push(i.address);
+    }
+  }
+  if (!out.length) throw new Error(`Keine Listen-Adresse außerhalb des Sandbox-Netzes ${subnet} gefunden – Runner startet nicht.`);
+  return out;
+}

runner/src/proxy.js

@@ -22,7 +22,21 @@ function html(res, status, body, extra = {}) {
   res.end(body);
 }
 
-export function createProxy({ config, dev, request = http.request }) {
+const HOP = ['connection', 'keep-alive', 'proxy-authorization', 'proxy-connection', 'te', 'trailer', 'transfer-encoding', 'upgrade'];
+// allowHalfOpen: ein vom Client geschlossener Socket ist zwar nicht 'destroyed', aber nicht mehr lesbar
+const gone = (s) => s.destroyed || !s.readable;
+const TOUCH_MS = 60e3;
+
+// Hop-by-hop-Header entfernen (samt der in Connection genannten Tokens). Auf dem Upgrade-Pfad bleiben Upgrade/Connection: Upgrade.
+export function stripHop(headers, { upgrade = false } = {}) {
+  const out = { ...headers };
+  const listed = String(headers.connection || '').split(',').map((t) => t.trim().toLowerCase()).filter(Boolean);
+  for (const k of Object.keys(out)) if (HOP.includes(k.toLowerCase()) || listed.includes(k.toLowerCase())) delete out[k];
+  if (upgrade) { out.connection = 'Upgrade'; out.upgrade = headers.upgrade; }
+  return out;
+}
+
+export function createProxy({ config, dev, request = http.request, upstreamTimeoutMs = 120e3, now = Date.now }) {
   // Sub aus dem Host-Header: exakt <sub>.<baseHost>, klein geschrieben, Port entfernt.
   function subOf(hostHeader) {
     const host = String(hostHeader || '').replace(/:\d+$/, '');
@@ -32,8 +46,8 @@ export function createProxy({ config, dev, request = http.request }) {
     return isValidSub(sub) ? sub : null;
   }
 
-  function fwdHeaders(req) {
-    const h = { ...req.headers };
+  function fwdHeaders(req, upgrade = false) {
+    const h = stripHop(req.headers, { upgrade });
     const prior = req.headers['x-forwarded-for'];
     const ip = req.socket.remoteAddress || '';
     h['x-forwarded-for'] = prior ? `${prior}, ${ip}` : ip;
@@ -45,7 +59,7 @@ export function createProxy({ config, dev, request = http.request }) {
   // Ergebnis: { target } wenn online, sonst { state }.
   async function resolve(sub) {
     let r;
-    try { r = await dev.wake(sub); } catch (e) { return { state: e?.status === 503 ? 'busy' : 'unknown' }; }
+    try { r = await dev.wake(sub); } catch (e) { if (e?.status !== 503) console.error('Proxy wake', sub, e); return { state: e?.status === 503 ? 'busy' : 'unknown' }; }
     if (r.state === 'online' && r.target) return { target: new URL(r.target) };
     return { state: r.state };
   }
@@ -63,14 +77,16 @@ export function createProxy({ config, dev, request = http.request }) {
       const up = request({
         hostname: r.target.hostname, port: r.target.port, method: req.method, path: req.url, headers: fwdHeaders(req),
       }, (ures) => {
-        res.writeHead(ures.statusCode, ures.headers);
+        res.writeHead(ures.statusCode, stripHop(ures.headers));
         ures.pipe(res);
         ures.on('error', () => res.destroy());
       });
+      let timedOut = false;
+      up.setTimeout(upstreamTimeoutMs, () => { timedOut = true; up.destroy(); });
       up.on('error', () => {
         if (!res.headersSent) {
-          const body = 'Die Preview ist gerade nicht erreichbar (502).';
-          res.writeHead(502, { 'Content-Type': 'text/plain; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
+          const body = timedOut ? 'Die Preview antwortet nicht rechtzeitig (504).' : 'Die Preview ist gerade nicht erreichbar (502).';
+          res.writeHead(timedOut ? 504 : 502, { 'Content-Type': 'text/plain; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
           res.end(body);
         } else res.destroy();
       });
@@ -89,10 +105,11 @@ export function createProxy({ config, dev, request = http.request }) {
       const sub = subOf(req.headers.host);
       if (!sub) return socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
       const r = await resolve(sub);
+      if (gone(socket)) return socket.destroy(); // Client hat sich während des Wartens verabschiedet
       if (!r.target) return socket.end('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
       dev.touch(sub);
       const up = request({
-        hostname: r.target.hostname, port: r.target.port, method: req.method, path: req.url, headers: fwdHeaders(req),
+        hostname: r.target.hostname, port: r.target.port, method: req.method, path: req.url, headers: fwdHeaders(req, true),
       });
       up.on('response', (ures) => { // Upstream lehnt das Upgrade ab: Antwort durchreichen und schließen
         let raw = `HTTP/1.1 ${ures.statusCode} ${ures.statusMessage}\r\n`;
@@ -101,6 +118,7 @@ export function createProxy({ config, dev, request = http.request }) {
         ures.pipe(socket);
       });
       up.on('upgrade', (ures, usock, uhead) => {
+        if (gone(socket)) { usock.destroy(); up.destroy(); return; }
         usock.on('error', () => { usock.destroy(); socket.destroy(); });
         // allowHalfOpen-Sockets bleiben nach 'end' offen: bei Ende oder Schließen einer Seite beide zerstören
         const both = () => { usock.destroy(); socket.destroy(); };
@@ -110,6 +128,10 @@ export function createProxy({ config, dev, request = http.request }) {
         socket.write(`${raw}\r\n`);
         if (uhead?.length) socket.write(uhead);
         if (head?.length) usock.write(head);
+        // Offene Verbindung (z. B. HMR) hält den Dev-Server wach: höchstens einmal pro Minute touch
+        let last = now();
+        const keep = () => { const t = now(); if (t - last >= TOUCH_MS) { last = t; dev.touch(sub); } };
+        usock.on('data', keep); socket.on('data', keep);
         usock.pipe(socket);
         socket.pipe(usock);
       });