feat: agent 经 hub 的回显连接补报另一地址族的出口，NAT66 的节点也显示 v6

src/agent_ws.rs

@@ -284,18 +284,25 @@ struct Rpc {
     params: serde_json::Value,
 }
 
+/// The node a request's bearer token belongs to, or the 401 text. The same
+/// text whether the token is malformed or merely unknown.
+fn authenticate(app: &App, headers: &HeaderMap) -> Result<i64, &'static str> {
+    let token = bearer(headers).ok_or("missing token")?;
+    match app.db.node_by_token(token) {
+        Ok(Some(id)) => Ok(id),
+        _ => Err("invalid token"),
+    }
+}
+
 pub async fn handler(
     State(app): State<Shared>,
     ConnectInfo(peer): ConnectInfo<std::net::SocketAddr>,
     headers: HeaderMap,
     upgrade: WebSocketUpgrade,
 ) -> Response {
-    let Some(token) = bearer(&headers) else {
-        return crate::api::answer(StatusCode::UNAUTHORIZED, "missing token");
-    };
-    let Ok(Some(node_id)) = app.db.node_by_token(token) else {
-        // The same response whether the token is malformed or merely unknown.
-        return crate::api::answer(StatusCode::UNAUTHORIZED, "invalid token");
+    let node_id = match authenticate(&app, &headers) {
+        Ok(id) => id,
+        Err(refusal) => return crate::api::answer(StatusCode::UNAUTHORIZED, refusal),
     };
     let ip = node_ip(&app, &headers, peer.ip()).to_string();
 
@@ -308,6 +315,38 @@ pub async fn handler(
     )
 }
 
+/// A glimpse rather than a session: an agent whose session runs over one
+/// address family connects here over the other, so the hub can record the
+/// address it appears at there. An interface holding only a private address of
+/// that family -- NAT66, a ULA behind a masquerading host -- says nothing of
+/// where it exits, and the session, arriving in one family, cannot.
+///
+/// A route of its own rather than a query on the session's: a hub from before
+/// this one would take `?echo` for a session, retire the live one, and flap the
+/// node on every connect, where it answers an unknown path with 404 and the
+/// agent goes without. Authenticated like a session, so no anonymous path, and
+/// it opens none: whatever is running is left alone.
+pub async fn echo(
+    State(app): State<Shared>,
+    ConnectInfo(peer): ConnectInfo<std::net::SocketAddr>,
+    headers: HeaderMap,
+    upgrade: WebSocketUpgrade,
+) -> Response {
+    let node_id = match authenticate(&app, &headers) {
+        Ok(id) => id,
+        Err(refusal) => return crate::api::answer(StatusCode::UNAUTHORIZED, refusal),
+    };
+    // A proxy that wrote nothing leaves the proxy's own address here, which
+    // would replace an exit recorded earlier with one the panel never shows.
+    let ip = node_ip(&app, &headers, peer.ip());
+    if public(ip) {
+        if let Err(e) = app.db.set_ip_other(node_id, &ip.to_string()) {
+            warn!("node {node_id}: storing the address seen in the other family failed: {e:#}");
+        }
+    }
+    upgrade.on_upgrade(|_| async {})
+}
+
 /// Extracts the node token from `Authorization: Bearer <token>`.
 pub(crate) fn bearer(headers: &HeaderMap) -> Option<&str> {
     headers.get("authorization")?.to_str().ok()?.strip_prefix("Bearer ").filter(|t| !t.is_empty())
@@ -860,6 +899,22 @@ mod tests {
             .unwrap()
     }
 
+    #[test]
+    fn a_token_opens_the_route_only_for_its_node() {
+        let app = app();
+        let token = crate::auth::random_token();
+        let id = app.db.create_node(&Node { name: "n".into(), ..Default::default() }, &token).unwrap();
+        let with = |value: &str| {
+            let mut h = HeaderMap::new();
+            h.insert("authorization", value.parse().unwrap());
+            h
+        };
+        assert_eq!(authenticate(&app, &with(&format!("Bearer {token}"))).ok(), Some(id));
+        for refused in [HeaderMap::new(), with("Bearer nope"), with("Basic abc")] {
+            assert!(authenticate(&app, &refused).is_err());
+        }
+    }
+
     /// A connected agent, the precondition for filing any report: the session
     /// holds the node's live state.
     fn connect(app: &App) -> (i64, mpsc::Receiver<String>) {

src/api.rs

@@ -158,21 +158,21 @@ pub(crate) const PUBLIC_METRICS: [&str; 18] = [
 
 /// The addresses the panel shows for a node, each with where it comes from: at
 /// most one per family, v4 first, the one the machine is reached by. The agent
-/// reports its interfaces; `ip` is where its connection arrived from, in dotted
-/// form for IPv4.
+/// reports its interfaces; `exits` are where the hub saw it: the address its
+/// session arrived from, and the one a short second connection arrived from in
+/// the other family, each in dotted form for IPv4.
 ///
 /// Per family an address set by hand comes first, then a public one on the
 /// interface. Failing both, where the interface holds only a private address of
-/// the family the connection used -- NAT, or a proxy in front -- the
-/// connection's public address, its exit, stands in. An exit in a family the
-/// interface does not hold is a translator such as NAT64 or WARP and is left
-/// out.
+/// that family -- NAT, or a proxy in front -- the public address the hub saw in
+/// it, its exit, stands in. An exit in a family the interface does not hold is a
+/// translator such as NAT64 or WARP and is left out.
 ///
 /// Private addresses appear only when nothing public is known, as where hub and
-/// node share a network and they are all there is. `ip` alone is the fallback
-/// for an agent reporting no interface.
+/// node share a network and they are all there is. The session's own exit alone
+/// is the fallback for an agent reporting no interface.
 fn addresses<'a>(
-    ip: &'a str,
+    exits: [&'a str; 2],
     (ipv4, ipv6): (&'a str, &'a str),
     (pin4, pin6): (&'a str, &'a str),
 ) -> Vec<(&'a str, &'static str)> {
@@ -183,10 +183,10 @@ fn addresses<'a>(
             Some((pin, "manual"))
         } else if public(held, v6) {
             Some((held, "interface"))
-        } else if !held.is_empty() && public(ip, v6) {
-            Some((ip, "exit"))
-        } else {
+        } else if held.is_empty() {
             None
+        } else {
+            exits.into_iter().find(|ip| public(ip, v6)).map(|exit| (exit, "exit"))
         }
     };
     let shown: Vec<_> = [family(pin4, ipv4, false), family(pin6, ipv6, true)].into_iter().flatten().collect();
@@ -197,7 +197,7 @@ fn addresses<'a>(
     if !held.is_empty() {
         return held;
     }
-    [ip].into_iter().filter(|a| !a.is_empty()).map(|a| (a, "connection")).collect()
+    [exits[0]].into_iter().filter(|a| !a.is_empty()).map(|a| (a, "connection")).collect()
 }
 
 /// One node as the UI consumes it: stored config, live metrics and the hub's
@@ -305,11 +305,12 @@ fn node_view(
     if full {
         let held = (node.ipv4.as_str(), node.ipv6.as_str());
         let (pin4, pin6) = (node.ipv4_pin.as_str(), node.ipv6_pin.as_str());
-        let shown = addresses(&node.ip, held, (pin4, pin6));
+        let exits = [node.ip.as_str(), node.ip_other.as_str()];
+        let shown = addresses(exits, held, (pin4, pin6));
         // What each family shows with its own pin cleared and the other's kept,
         // for the edit form to offer as the fallback.
         let auto = |pins, v6: bool| {
-            addresses(&node.ip, held, pins)
+            addresses(exits, held, pins)
                 .into_iter()
                 .find(|(a, _)| a.contains(':') == v6)
                 .map_or("", |(a, _)| a)
@@ -2971,7 +2972,7 @@ mod tests {
     #[test]
     fn a_node_shows_the_address_it_is_reached_by() {
         let rows = |ip, held, pins| -> Vec<String> {
-            addresses(ip, held, pins).into_iter().map(|(a, source)| format!("{a} {source}")).collect()
+            addresses([ip, ""], held, pins).into_iter().map(|(a, source)| format!("{a} {source}")).collect()
         };
         let none = ("", "");
         // A public interface is the machine; a different exit in front of it is a
@@ -2993,6 +2994,18 @@ mod tests {
         );
         // ...and over v6 by an older one reporting the ULA ahead of it.
         assert_eq!(rows("2401:b60:1c::5", ("10.10.1.5", "fd42:43af::1"), none), ["2401:b60:1c::5 exit"]);
+        // NAT66: a private v4 and a ULA v6, the session over v4 and a second
+        // connection over v6. Each exit stands in for its own family's address,
+        // and the one in a family the interface lacks is a translator again.
+        let both = |held| -> Vec<String> {
+            addresses(["203.0.113.7", "2001:db8:1::9"], held, none)
+                .into_iter()
+                .map(|(a, source)| format!("{a} {source}"))
+                .collect()
+        };
+        assert_eq!(both(("10.0.0.5", "fd00::5")), ["203.0.113.7 exit", "2001:db8:1::9 exit"]);
+        assert_eq!(both(("10.0.0.5", "")), ["203.0.113.7 exit"]);
+        assert_eq!(both(("10.0.0.5", "2401:b60:1c::5")), ["203.0.113.7 exit", "2401:b60:1c::5 interface"]);
         // Behind a transparent proxy the exit is the proxy's; the home line can
         // only be set by hand.
         let home = ("192.168.1.5", "2409:8a1e::5");

src/db.rs

@@ -83,6 +83,11 @@ CREATE TABLE IF NOT EXISTS node (
   swap_total INTEGER NOT NULL DEFAULT 0, disk_total INTEGER NOT NULL DEFAULT 0,
   agent_version TEXT NOT NULL DEFAULT '', ip TEXT NOT NULL DEFAULT '',
   ipv4 TEXT NOT NULL DEFAULT '', ipv6 TEXT NOT NULL DEFAULT '',
+  -- Where the hub saw the node in the address family `ip` is not in, from the
+  -- short connection an agent makes over it (`agent_ws::echo`).
+  -- Empty until one has arrived, and left as it was when none does: the family
+  -- it belongs to must still be held on an interface for it to be shown.
+  ip_other TEXT NOT NULL DEFAULT '',
   -- ISO 3166-1 alpha-2, looked up from `country_ip` once per address. Empty
   -- until the lookup answers, and empty is what a node whose country nobody
   -- could tell stays: the public page just leaves the badge off.
@@ -231,7 +236,7 @@ CREATE TABLE IF NOT EXISTS session (
 /// cannot: `open` runs `SCHEMA` before migrating, and on an older file the
 /// column is not there yet. `an_upgraded_release_matches_a_fresh_database`
 /// holds every migration to these rules, starting from v1.0.0's schema.
-const SCHEMA_VERSION: i64 = 12;
+const SCHEMA_VERSION: i64 = 13;
 
 /// Adds a column older databases lack. A duplicate column indicates the
 /// migration has already run; every other error must propagate.
@@ -404,6 +409,10 @@ fn migrate_to_12(conn: &Connection) -> Result<()> {
     add_column(conn, "node", "public_remark TEXT NOT NULL DEFAULT ''")
 }
 
+fn migrate_to_13(conn: &Connection) -> Result<()> {
+    add_column(conn, "node", "ip_other TEXT NOT NULL DEFAULT ''")
+}
+
 /// Brings a database already in service up to `SCHEMA_VERSION` and stamps it.
 /// `from` is its current version, so a fresh file passes `SCHEMA_VERSION` and
 /// receives only the stamp.
@@ -453,6 +462,9 @@ fn migrate(conn: &Connection, from: i64) -> Result<()> {
     if from < 12 {
         migrate_to_12(&tx)?;
     }
+    if from < 13 {
+        migrate_to_13(&tx)?;
+    }
     tx.execute_batch(&format!("PRAGMA user_version = {SCHEMA_VERSION}"))?;
     tx.commit()?;
     Ok(())
@@ -532,6 +544,10 @@ pub struct Node {
     pub agent_version: String,
     #[serde(default)]
     pub ip: String,
+    /// Likewise the address the hub saw, in the family `ip` is not; see the
+    /// column.
+    #[serde(default)]
+    pub ip_other: String,
     /// Reported by the agent from its own interfaces, unlike `ip`, which is
     /// merely the address the agent's connection originated from.
     #[serde(default)]
@@ -1308,6 +1324,16 @@ impl Db {
         Ok(blank && !source.is_empty())
     }
 
+    /// Records where the hub saw a node over the address family its session is
+    /// not in. Kept apart from `save_facts`, which an agent's hello rewrites: the
+    /// two arrive on different connections, in no fixed order.
+    pub fn set_ip_other(&self, id: i64, ip: &str) -> Result<()> {
+        // Unchanged is not written: a reconnecting agent, or a token holder
+        // repeating the request, would otherwise cost a write transaction each.
+        self.conn().execute("UPDATE node SET ip_other=?2 WHERE id=?1 AND ip_other<>?2", params![id, ip])?;
+        Ok(())
+    }
+
     /// Whether the node still lacks a country for `source`: false once a lookup
     /// has landed, or once the node has moved to another address.
     pub fn country_owed(&self, id: i64, source: &str) -> Result<bool> {
@@ -2617,6 +2643,7 @@ fn row_to_node(r: &rusqlite::Row<'_>) -> Node {
         disk_total: n("disk_total"),
         agent_version: s("agent_version"),
         ip: s("ip"),
+        ip_other: s("ip_other"),
         ipv4: s("ipv4"),
         ipv6: s("ipv6"),
         country: s("country"),
@@ -3486,6 +3513,24 @@ mod tests {
         );
     }
 
+    /// The address seen in the other family arrives on its own connection, in no
+    /// fixed order against the hello, and must not be wiped by it.
+    #[test]
+    fn the_address_seen_in_the_other_family_survives_a_hello() {
+        let db = db();
+        let id = node(&db, 1);
+        db.set_ip_other(id, "2001:db8:1::9").unwrap();
+        db.save_facts(
+            id,
+            &serde_json::json!({"ipv4": "10.0.0.5", "ipv6": "fd00::5"}),
+            "203.0.113.9",
+            "203.0.113.9",
+        )
+        .unwrap();
+        let stored = db.node(id).unwrap().unwrap();
+        assert_eq!((stored.ip.as_str(), stored.ip_other.as_str()), ("203.0.113.9", "2001:db8:1::9"));
+    }
+
     /// A correction must survive the node's return. `all_traffic` gates the month
     /// figures on the period they were written for, and `accumulate` restarts the
     /// counter when the stored period is stale, so a correction left under the

src/main.rs

@@ -585,6 +585,7 @@ async fn main() -> Result<()> {
         .merge(
             Router::new()
                 .route("/api/agent/ws", get(agent_ws::handler))
+                .route("/api/agent/echo", get(agent_ws::echo))
                 .route("/api/agent/register", post(api::agent_register))
                 .route("/install.sh", get(install_script))
                 .route("/agent/{arch}", get(agent_binary))