feat(traffic): add traffic graph domain model

commit: 7924808985266003c12ac5777ea74decb09756f5
author: brice · 3mo ago · 2026-06-29 20:59 UTC
parent: 1db619a
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +1144 -0

A internal/domain/traffic.go +636 -0

@@ -0,0 +1,636 @@
	1	+	package domain
	2	+
	3	+	import (
	4	+	"fmt"
	5	+	"net"
	6	+	"strconv"
	7	+	"strings"
	8	+	"time"
	9	+	)
	10	+
	11	+	type EntryPointProtocol string
	12	+
	13	+	const (
	14	+	EntryPointProtocolHTTP EntryPointProtocol = "http"
	15	+	EntryPointProtocolTLSMux EntryPointProtocol = "tls_mux"
	16	+	EntryPointProtocolTCP EntryPointProtocol = "tcp"
	17	+	EntryPointProtocolUDP EntryPointProtocol = "udp"
	18	+	)
	19	+
	20	+	type RouterProtocol string
	21	+
	22	+	const (
	23	+	RouterProtocolHTTP RouterProtocol = "http"
	24	+	RouterProtocolTCP RouterProtocol = "tcp"
	25	+	RouterProtocolUDP RouterProtocol = "udp"
	26	+	RouterProtocolTLSPassthrough RouterProtocol = "tls_passthrough"
	27	+	)
	28	+
	29	+	type NetworkProtocol string
	30	+
	31	+	const (
	32	+	NetworkProtocolTCP NetworkProtocol = "tcp"
	33	+	NetworkProtocolUDP NetworkProtocol = "udp"
	34	+	)
	35	+
	36	+	type TrafficGraph struct {
	37	+	Options TrafficOptions
	38	+	EntryPoints []EntryPoint
	39	+	Routers []TrafficRouter
	40	+	Services []TrafficService
	41	+	}
	42	+
	43	+	type TrafficOptions struct {
	44	+	TCP TCPOptions
	45	+	UDP UDPOptions
	46	+	}
	47	+
	48	+	type TCPOptions struct {
	49	+	DialTimeout time.Duration
	50	+	IdleTimeout time.Duration
	51	+	DrainTimeout time.Duration
	52	+	MaxConnections int
	53	+	}
	54	+
	55	+	type UDPOptions struct {
	56	+	IdleTimeout time.Duration
	57	+	DrainTimeout time.Duration
	58	+	MaxSessions int
	59	+	}
	60	+
	61	+	type EntryPoint struct {
	62	+	Name string
	63	+	Address string
	64	+	Protocol EntryPointProtocol
	65	+	TrustedCIDRs []string
	66	+	}
	67	+
	68	+	type TrafficRouter struct {
	69	+	Name string
	70	+	EntryPoint string
	71	+	Protocol RouterProtocol
	72	+	Rule TrafficRule
	73	+	Service string
	74	+	}
	75	+
	76	+	type TrafficRule struct {
	77	+	Host string
	78	+	SNI string
	79	+	}
	80	+
	81	+	type TrafficService struct {
	82	+	Name string
	83	+	Backends []TrafficBackend
	84	+	}
	85	+
	86	+	type TrafficBackend struct {
	87	+	Name string
	88	+	Host string
	89	+	Port int
	90	+	Protocol NetworkProtocol
	91	+	}
	92	+
	93	+	type TrafficStatus struct {
	94	+	LastReloadStatus string
	95	+	LastReloadError string
	96	+	EntryPoints []EntryPointStatus
	97	+	Routers []TrafficRouterStatus
	98	+	Services []TrafficServiceStatus
	99	+	Counters TrafficCounters
	100	+	}
	101	+
	102	+	type EntryPointStatus struct {
	103	+	Name string
	104	+	Address string
	105	+	Protocol EntryPointProtocol
	106	+	Active bool
	107	+	ActiveTCPConnections int64
	108	+	ActiveUDPSessions int64
	109	+	TotalAccepted int64
	110	+	TotalRefused int64
	111	+	TotalErrors int64
	112	+	BytesIn int64
	113	+	BytesOut int64
	114	+	}
	115	+
	116	+	type TrafficRouterStatus struct {
	117	+	Name string
	118	+	EntryPoint string
	119	+	Protocol RouterProtocol
	120	+	Active bool
	121	+	ActiveTCPConnections int64
	122	+	ActiveUDPSessions int64
	123	+	TotalAccepted int64
	124	+	TotalRefused int64
	125	+	TotalErrors int64
	126	+	BytesIn int64
	127	+	BytesOut int64
	128	+	}
	129	+
	130	+	type TrafficServiceStatus struct {
	131	+	Name string
	132	+	Active bool
	133	+	Backends []TrafficBackendStatus
	134	+	}
	135	+
	136	+	type TrafficBackendStatus struct {
	137	+	Name string
	138	+	Active bool
	139	+	ActiveTCPConnections int64
	140	+	ActiveUDPSessions int64
	141	+	TotalAccepted int64
	142	+	TotalRefused int64
	143	+	TotalErrors int64
	144	+	BytesIn int64
	145	+	BytesOut int64
	146	+	}
	147	+
	148	+	type TrafficCounters struct {
	149	+	ActiveTCPConnections int64
	150	+	ActiveUDPSessions int64
	151	+	TotalAccepted int64
	152	+	TotalRefused int64
	153	+	TotalErrors int64
	154	+	BytesIn int64
	155	+	BytesOut int64
	156	+	}
	157	+
	158	+	type TrafficServiceRefKind string
	159	+
	160	+	const (
	161	+	TrafficServiceRefRoute TrafficServiceRefKind = "route"
	162	+	TrafficServiceRefExternalRoute TrafficServiceRefKind = "external_route"
	163	+	TrafficServiceRefNetworkService TrafficServiceRefKind = "network_service"
	164	+	TrafficServiceRefStatic TrafficServiceRefKind = "static"
	165	+	)
	166	+
	167	+	type TrafficServiceRef struct {
	168	+	Kind TrafficServiceRefKind
	169	+	Domain string
	170	+	Name string
	171	+	PortName string
	172	+	Reserved bool
	173	+	}
	174	+
	175	+	func ParseTrafficServiceRef(value string) (TrafficServiceRef, error) {
	176	+	kind, rest, ok := strings.Cut(strings.TrimSpace(value), ":")
	177	+	if !ok \|\| rest == "" {
	178	+	return TrafficServiceRef{}, fmt.Errorf("invalid traffic service ref %q", value)
	179	+	}
	180	+	switch TrafficServiceRefKind(kind) {
	181	+	case TrafficServiceRefRoute:
	182	+	return TrafficServiceRef{Kind: TrafficServiceRefRoute, Domain: rest}, nil
	183	+	case TrafficServiceRefExternalRoute:
	184	+	return TrafficServiceRef{Kind: TrafficServiceRefExternalRoute, Domain: rest}, nil
	185	+	case TrafficServiceRefNetworkService:
	186	+	name, portName, ok := strings.Cut(rest, ":")
	187	+	if !ok \|\| name == "" \|\| portName == "" \|\| strings.Contains(portName, ":") {
	188	+	return TrafficServiceRef{}, fmt.Errorf("invalid network service ref %q", value)
	189	+	}
	190	+	return TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: name, PortName: portName}, nil
	191	+	case TrafficServiceRefStatic:
	192	+	return TrafficServiceRef{Kind: TrafficServiceRefStatic, Name: rest, Reserved: true}, nil
	193	+	default:
	194	+	return TrafficServiceRef{}, fmt.Errorf("invalid traffic service ref kind %q", kind)
	195	+	}
	196	+	}
	197	+
	198	+	func (g TrafficGraph) Validate() error {
	199	+	entryPoints, err := validateTrafficEntryPoints(g.EntryPoints)
	200	+	if err != nil {
	201	+	return err
	202	+	}
	203	+	services, err := validateTrafficServices(g.Services)
	204	+	if err != nil {
	205	+	return err
	206	+	}
	207	+	return g.validateRouters(entryPoints, services)
	208	+	}
	209	+
	210	+	func validateTrafficEntryPoints(entries []EntryPoint) (map[string]EntryPoint, error) {
	211	+	entryPoints := make(map[string]EntryPoint, len(entries))
	212	+	listenAddresses := newProtocolListenAddressSet()
	213	+	for _, entryPoint := range entries {
	214	+	if err := validateTrafficEntryPoint(entryPoint, entryPoints, listenAddresses); err != nil {
	215	+	return nil, err
	216	+	}
	217	+	entryPoints[entryPoint.Name] = entryPoint
	218	+	}
	219	+	return entryPoints, nil
	220	+	}
	221	+
	222	+	type protocolListenAddressSet struct {
	223	+	tcp listenAddressSet
	224	+	udp listenAddressSet
	225	+	}
	226	+
	227	+	func newProtocolListenAddressSet() *protocolListenAddressSet {
	228	+	return &protocolListenAddressSet{tcp: newListenAddressSet(), udp: newListenAddressSet()}
	229	+	}
	230	+
	231	+	func (s *protocolListenAddressSet) add(entryPoint EntryPoint, addr listenAddress) error {
	232	+	if entryPoint.Protocol == EntryPointProtocolUDP {
	233	+	return s.udp.add(addr, entryPoint.Name, "udp")
	234	+	}
	235	+	return s.tcp.add(addr, entryPoint.Name, "tcp")
	236	+	}
	237	+
	238	+	func validateTrafficEntryPoint(entryPoint EntryPoint, existing map[string]EntryPoint, listenAddresses *protocolListenAddressSet) error {
	239	+	if entryPoint.Name == "" {
	240	+	return fmt.Errorf("entrypoint name is required")
	241	+	}
	242	+	if _, exists := existing[entryPoint.Name]; exists {
	243	+	return fmt.Errorf("duplicate entrypoint name %q", entryPoint.Name)
	244	+	}
	245	+	if err := validateEntryPointProtocol(entryPoint.Protocol); err != nil {
	246	+	return fmt.Errorf("invalid entrypoint protocol for %q: %w", entryPoint.Name, err)
	247	+	}
	248	+	addr, err := parseListenAddress(entryPoint.Address)
	249	+	if err != nil {
	250	+	return fmt.Errorf("invalid entrypoint address for %q: %w", entryPoint.Name, err)
	251	+	}
	252	+	return listenAddresses.add(entryPoint, addr)
	253	+	}
	254	+
	255	+	func validateTrafficServices(values []TrafficService) (map[string]TrafficService, error) {
	256	+	services := make(map[string]TrafficService, len(values))
	257	+	for _, service := range values {
	258	+	if err := validateTrafficService(service, services); err != nil {
	259	+	return nil, err
	260	+	}
	261	+	services[service.Name] = service
	262	+	}
	263	+	return services, nil
	264	+	}
	265	+
	266	+	func validateTrafficService(service TrafficService, existing map[string]TrafficService) error {
	267	+	if service.Name == "" {
	268	+	return fmt.Errorf("traffic service name is required")
	269	+	}
	270	+	if _, exists := existing[service.Name]; exists {
	271	+	return fmt.Errorf("duplicate traffic service name %q", service.Name)
	272	+	}
	273	+	if _, err := ParseTrafficServiceRef(service.Name); err != nil {
	274	+	return fmt.Errorf("invalid traffic service ref %q: %w", service.Name, err)
	275	+	}
	276	+	for _, backend := range service.Backends {
	277	+	if err := validateTrafficBackend(service.Name, backend); err != nil {
	278	+	return err
	279	+	}
	280	+	}
	281	+	return nil
	282	+	}
	283	+
	284	+	func validateTrafficBackend(serviceName string, backend TrafficBackend) error {
	285	+	if backend.Port < 1 \|\| backend.Port > 65535 {
	286	+	return fmt.Errorf("invalid backend port %d for service %q", backend.Port, serviceName)
	287	+	}
	288	+	if err := validateNetworkProtocol(backend.Protocol); err != nil {
	289	+	return fmt.Errorf("invalid backend protocol for service %q: %w", serviceName, err)
	290	+	}
	291	+	return nil
	292	+	}
	293	+
	294	+	func (g TrafficGraph) validateRouters(entryPoints map[string]EntryPoint, services map[string]TrafficService) error {
	295	+	state := newRouterValidationState()
	296	+	for _, router := range g.Routers {
	297	+	if err := state.validateRouter(router, entryPoints, services); err != nil {
	298	+	return err
	299	+	}
	300	+	}
	301	+	return nil
	302	+	}
	303	+
	304	+	type routerValidationState struct {
	305	+	routerNames map[string]struct{}
	306	+	exactSNI map[string]map[string]string
	307	+	wildSNI map[string]map[string]string
	308	+	httpHosts map[string]map[string]string
	309	+	tcpRouters map[string]string
	310	+	udpRouters map[string]string
	311	+	}
	312	+
	313	+	func newRouterValidationState() *routerValidationState {
	314	+	return &routerValidationState{
	315	+	routerNames: map[string]struct{}{},
	316	+	exactSNI: map[string]map[string]string{},
	317	+	wildSNI: map[string]map[string]string{},
	318	+	httpHosts: map[string]map[string]string{},
	319	+	tcpRouters: map[string]string{},
	320	+	udpRouters: map[string]string{},
	321	+	}
	322	+	}
	323	+
	324	+	func (s *routerValidationState) validateRouter(router TrafficRouter, entryPoints map[string]EntryPoint, services map[string]TrafficService) error {
	325	+	if err := s.validateRouterName(router); err != nil {
	326	+	return err
	327	+	}
	328	+	entryPoint, serviceRef, service, err := resolveRouterTargets(router, entryPoints, services)
	329	+	if err != nil {
	330	+	return err
	331	+	}
	332	+	if err := validateRouterEntryPointProtocol(router, entryPoint); err != nil {
	333	+	return err
	334	+	}
	335	+	if err := validateRouterServiceRef(router, serviceRef, service); err != nil {
	336	+	return err
	337	+	}
	338	+	if err := s.validateRouterRule(router, entryPoint); err != nil {
	339	+	return err
	340	+	}
	341	+	return s.validateTLSPassthroughRule(router, entryPoint)
	342	+	}
	343	+
	344	+	func (s *routerValidationState) validateRouterName(router TrafficRouter) error {
	345	+	if router.Name == "" {
	346	+	return fmt.Errorf("traffic router name is required")
	347	+	}
	348	+	if _, exists := s.routerNames[router.Name]; exists {
	349	+	return fmt.Errorf("duplicate traffic router name %q", router.Name)
	350	+	}
	351	+	s.routerNames[router.Name] = struct{}{}
	352	+	return nil
	353	+	}
	354	+
	355	+	func resolveRouterTargets(router TrafficRouter, entryPoints map[string]EntryPoint, services map[string]TrafficService) (EntryPoint, TrafficServiceRef, TrafficService, error) {
	356	+	entryPoint, ok := entryPoints[router.EntryPoint]
	357	+	if !ok {
	358	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("router %q references unknown entrypoint %q", router.Name, router.EntryPoint)
	359	+	}
	360	+	serviceRef, err := ParseTrafficServiceRef(router.Service)
	361	+	if err != nil {
	362	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("router %q has invalid service ref: %w", router.Name, err)
	363	+	}
	364	+	service, ok := services[router.Service]
	365	+	if !ok {
	366	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("router %q references unknown service %q", router.Name, router.Service)
	367	+	}
	368	+	if err := validateRouterProtocol(router.Protocol); err != nil {
	369	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("invalid router protocol for %q: %w", router.Name, err)
	370	+	}
	371	+	return entryPoint, serviceRef, service, nil
	372	+	}
	373	+
	374	+	func (s *routerValidationState) validateRouterRule(router TrafficRouter, entryPoint EntryPoint) error {
	375	+	switch router.Protocol {
	376	+	case RouterProtocolTCP:
	377	+	return validateSingleL4Router(s.tcpRouters, "tcp", entryPoint.Name, router.Name)
	378	+	case RouterProtocolUDP:
	379	+	return validateSingleL4Router(s.udpRouters, "udp", entryPoint.Name, router.Name)
	380	+	case RouterProtocolHTTP:
	381	+	return s.validateHTTPRule(router, entryPoint)
	382	+	default:
	383	+	return nil
	384	+	}
	385	+	}
	386	+
	387	+	func validateSingleL4Router(routers map[string]string, protocol string, entryPoint string, routerName string) error {
	388	+	if existing := routers[entryPoint]; existing != "" {
	389	+	return fmt.Errorf("ambiguous %s routers on entrypoint %q: %q and %q", protocol, entryPoint, existing, routerName)
	390	+	}
	391	+	routers[entryPoint] = routerName
	392	+	return nil
	393	+	}
	394	+
	395	+	func (s *routerValidationState) validateHTTPRule(router TrafficRouter, entryPoint EntryPoint) error {
	396	+	if router.Rule.Host == "" {
	397	+	return nil
	398	+	}
	399	+	host := normalizeHost(router.Rule.Host)
	400	+	if existing := s.httpHosts[entryPoint.Name][host]; existing != "" {
	401	+	return fmt.Errorf("duplicate http host %q on entrypoint %q used by routers %q and %q", host, entryPoint.Name, existing, router.Name)
	402	+	}
	403	+	if err := s.validateHTTPRuleTLSConflicts(entryPoint.Name, host); err != nil {
	404	+	return err
	405	+	}
	406	+	putNested(s.httpHosts, entryPoint.Name, host, router.Name)
	407	+	return nil
	408	+	}
	409	+
	410	+	func (s *routerValidationState) validateHTTPRuleTLSConflicts(entryPoint string, host string) error {
	411	+	if s.exactSNI[entryPoint][host] != "" {
	412	+	return fmt.Errorf("http host conflicts with tls passthrough sni %q on entrypoint %q", host, entryPoint)
	413	+	}
	414	+	if wildcard := matchingWildcardSNI(host, s.wildSNI[entryPoint]); wildcard != "" {
	415	+	return fmt.Errorf("http host conflicts with wildcard tls passthrough sni %q on entrypoint %q", wildcard, entryPoint)
	416	+	}
	417	+	return nil
	418	+	}
	419	+
	420	+	func (s *routerValidationState) validateTLSPassthroughRule(router TrafficRouter, entryPoint EntryPoint) error {
	421	+	if router.Protocol != RouterProtocolTLSPassthrough \|\| router.Rule.SNI == "" {
	422	+	return nil
	423	+	}
	424	+	sni := normalizeHost(router.Rule.SNI)
	425	+	if strings.HasPrefix(sni, "*.") {
	426	+	return s.validateWildcardSNI(entryPoint.Name, sni, router.Name)
	427	+	}
	428	+	return s.validateExactSNI(entryPoint.Name, sni, router.Name)
	429	+	}
	430	+
	431	+	func (s *routerValidationState) validateWildcardSNI(entryPoint string, sni string, routerName string) error {
	432	+	if s.wildSNI[entryPoint][sni] != "" {
	433	+	return fmt.Errorf("ambiguous wildcard tls sni %q on entrypoint %q", sni, entryPoint)
	434	+	}
	435	+	if host := matchingHTTPHost(sni, s.httpHosts[entryPoint]); host != "" {
	436	+	return fmt.Errorf("http host conflicts with wildcard tls passthrough sni %q on entrypoint %q for host %q", sni, entryPoint, host)
	437	+	}
	438	+	putNested(s.wildSNI, entryPoint, sni, routerName)
	439	+	return nil
	440	+	}
	441	+
	442	+	func (s *routerValidationState) validateExactSNI(entryPoint string, sni string, routerName string) error {
	443	+	if s.exactSNI[entryPoint][sni] != "" {
	444	+	return fmt.Errorf("duplicate exact tls sni %q on entrypoint %q", sni, entryPoint)
	445	+	}
	446	+	if s.httpHosts[entryPoint][sni] != "" {
	447	+	return fmt.Errorf("http host conflicts with tls passthrough sni %q on entrypoint %q", sni, entryPoint)
	448	+	}
	449	+	putNested(s.exactSNI, entryPoint, sni, routerName)
	450	+	return nil
	451	+	}
	452	+
	453	+	func validateRouterEntryPointProtocol(router TrafficRouter, entryPoint EntryPoint) error {
	454	+	compatible := false
	455	+	switch router.Protocol {
	456	+	case RouterProtocolHTTP:
	457	+	compatible = entryPoint.Protocol == EntryPointProtocolHTTP \|\| entryPoint.Protocol == EntryPointProtocolTLSMux
	458	+	case RouterProtocolTLSPassthrough:
	459	+	compatible = entryPoint.Protocol == EntryPointProtocolTLSMux
	460	+	case RouterProtocolTCP:
	461	+	compatible = entryPoint.Protocol == EntryPointProtocolTCP
	462	+	case RouterProtocolUDP:
	463	+	compatible = entryPoint.Protocol == EntryPointProtocolUDP
	464	+	}
	465	+	if compatible {
	466	+	return nil
	467	+	}
	468	+	return fmt.Errorf("router %q protocol %s is incompatible with entrypoint %q protocol %s", router.Name, router.Protocol, entryPoint.Name, entryPoint.Protocol)
	469	+	}
	470	+
	471	+	func validateRouterServiceRef(router TrafficRouter, ref TrafficServiceRef, service TrafficService) error {
	472	+	switch router.Protocol {
	473	+	case RouterProtocolHTTP:
	474	+	if ref.Kind == TrafficServiceRefRoute \|\| ref.Kind == TrafficServiceRefExternalRoute {
	475	+	return nil
	476	+	}
	477	+	case RouterProtocolTCP, RouterProtocolUDP, RouterProtocolTLSPassthrough:
	478	+	return validateL4RouterService(router, ref, service)
	479	+	}
	480	+	if ref.Kind == TrafficServiceRefStatic {
	481	+	return fmt.Errorf("static traffic service ref %q is unsupported in traffic graph validation", router.Service)
	482	+	}
	483	+	return fmt.Errorf("router %q protocol %s does not support service ref kind %s", router.Name, router.Protocol, ref.Kind)
	484	+	}
	485	+
	486	+	func validateL4RouterService(router TrafficRouter, ref TrafficServiceRef, service TrafficService) error {
	487	+	want, ok := l4BackendProtocol(router.Protocol)
	488	+	if !ok {
	489	+	return nil
	490	+	}
	491	+	if ref.Kind != TrafficServiceRefNetworkService {
	492	+	if ref.Kind == TrafficServiceRefStatic {
	493	+	return fmt.Errorf("static traffic service ref %q is unsupported in traffic graph validation", router.Service)
	494	+	}
	495	+	return fmt.Errorf("l4 router %q requires network_service service ref", router.Name)
	496	+	}
	497	+	if len(service.Backends) != 1 {
	498	+	return fmt.Errorf("l4 router service must have exactly one backend for router %q", router.Name)
	499	+	}
	500	+	backend := service.Backends[0]
	501	+	if backend.Protocol != want {
	502	+	return fmt.Errorf("backend protocol %s does not match router protocol %s for router %q", backend.Protocol, want, router.Name)
	503	+	}
	504	+	return nil
	505	+	}
	506	+
	507	+	func l4BackendProtocol(protocol RouterProtocol) (NetworkProtocol, bool) {
	508	+	switch protocol {
	509	+	case RouterProtocolTCP:
	510	+	return NetworkProtocolTCP, true
	511	+	case RouterProtocolUDP:
	512	+	return NetworkProtocolUDP, true
	513	+	case RouterProtocolTLSPassthrough:
	514	+	return NetworkProtocolTCP, true
	515	+	default:
	516	+	return "", false
	517	+	}
	518	+	}
	519	+
	520	+	func validateEntryPointProtocol(protocol EntryPointProtocol) error {
	521	+	switch protocol {
	522	+	case EntryPointProtocolHTTP, EntryPointProtocolTLSMux, EntryPointProtocolTCP, EntryPointProtocolUDP:
	523	+	return nil
	524	+	default:
	525	+	return fmt.Errorf("%q", protocol)
	526	+	}
	527	+	}
	528	+
	529	+	func validateRouterProtocol(protocol RouterProtocol) error {
	530	+	switch protocol {
	531	+	case RouterProtocolHTTP, RouterProtocolTCP, RouterProtocolUDP, RouterProtocolTLSPassthrough:
	532	+	return nil
	533	+	default:
	534	+	return fmt.Errorf("%q", protocol)
	535	+	}
	536	+	}
	537	+
	538	+	func validateNetworkProtocol(protocol NetworkProtocol) error {
	539	+	switch protocol {
	540	+	case NetworkProtocolTCP, NetworkProtocolUDP:
	541	+	return nil
	542	+	default:
	543	+	return fmt.Errorf("%q", protocol)
	544	+	}
	545	+	}
	546	+
	547	+	type listenAddress struct {
	548	+	key string
	549	+	port int
	550	+	wildcard bool
	551	+	}
	552	+
	553	+	type listenAddressSet struct {
	554	+	byKey map[string]string
	555	+	all []registeredListenAddress
	556	+	}
	557	+
	558	+	type registeredListenAddress struct {
	559	+	addr listenAddress
	560	+	name string
	561	+	}
	562	+
	563	+	func newListenAddressSet() listenAddressSet {
	564	+	return listenAddressSet{byKey: map[string]string{}}
	565	+	}
	566	+
	567	+	func (s *listenAddressSet) add(addr listenAddress, name string, protocol string) error {
	568	+	if other, exists := s.byKey[addr.key]; exists {
	569	+	return fmt.Errorf("duplicate %s entrypoint address %q used by %q and %q", protocol, addr.key, other, name)
	570	+	}
	571	+	for _, existing := range s.all {
	572	+	if existing.addr.port == addr.port && (existing.addr.wildcard \|\| addr.wildcard) {
	573	+	return fmt.Errorf("conflicting %s entrypoint address %q used by %q and %q", protocol, addr.key, existing.name, name)
	574	+	}
	575	+	}
	576	+	s.byKey[addr.key] = name
	577	+	s.all = append(s.all, registeredListenAddress{addr: addr, name: name})
	578	+	return nil
	579	+	}
	580	+
	581	+	func parseListenAddress(address string) (listenAddress, error) {
	582	+	host, portValue, err := net.SplitHostPort(address)
	583	+	if err != nil {
	584	+	return listenAddress{}, err
	585	+	}
	586	+	port, err := strconv.Atoi(portValue)
	587	+	if err != nil \|\| port < 1 \|\| port > 65535 {
	588	+	return listenAddress{}, fmt.Errorf("invalid port %q", portValue)
	589	+	}
	590	+	return listenAddress{
	591	+	key: net.JoinHostPort(host, strconv.Itoa(port)),
	592	+	port: port,
	593	+	wildcard: isWildcardListenHost(host),
	594	+	}, nil
	595	+	}
	596	+
	597	+	func isWildcardListenHost(host string) bool {
	598	+	return host == "" \|\| host == "0.0.0.0" \|\| host == "::"
	599	+	}
	600	+
	601	+	func normalizeHost(host string) string {
	602	+	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(host)), ".")
	603	+	}
	604	+
	605	+	func matchingWildcardSNI(host string, wildcards map[string]string) string {
	606	+	for wildcard := range wildcards {
	607	+	if hostMatchesWildcard(host, wildcard) {
	608	+	return wildcard
	609	+	}
	610	+	}
	611	+	return ""
	612	+	}
	613	+
	614	+	func matchingHTTPHost(wildcard string, hosts map[string]string) string {
	615	+	for host := range hosts {
	616	+	if hostMatchesWildcard(host, wildcard) {
	617	+	return host
	618	+	}
	619	+	}
	620	+	return ""
	621	+	}
	622	+
	623	+	func hostMatchesWildcard(host string, wildcard string) bool {
	624	+	suffix, ok := strings.CutPrefix(wildcard, "*.")
	625	+	if !ok \|\| host == suffix {
	626	+	return false
	627	+	}
	628	+	return strings.HasSuffix(host, "."+suffix)
	629	+	}
	630	+
	631	+	func putNested(values map[string]map[string]string, key string, nestedKey string, value string) {
	632	+	if values[key] == nil {
	633	+	values[key] = map[string]string{}
	634	+	}
	635	+	values[key][nestedKey] = value
	636	+	}

@@ -0,0 +1,636 @@
	1	+	package domain
	2	+
	3	+	import (
	4	+	"fmt"
	5	+	"net"
	6	+	"strconv"
	7	+	"strings"
	8	+	"time"
	9	+	)
	10	+
	11	+	type EntryPointProtocol string
	12	+
	13	+	const (
	14	+	EntryPointProtocolHTTP EntryPointProtocol = "http"
	15	+	EntryPointProtocolTLSMux EntryPointProtocol = "tls_mux"
	16	+	EntryPointProtocolTCP EntryPointProtocol = "tcp"
	17	+	EntryPointProtocolUDP EntryPointProtocol = "udp"
	18	+	)
	19	+
	20	+	type RouterProtocol string
	21	+
	22	+	const (
	23	+	RouterProtocolHTTP RouterProtocol = "http"
	24	+	RouterProtocolTCP RouterProtocol = "tcp"
	25	+	RouterProtocolUDP RouterProtocol = "udp"
	26	+	RouterProtocolTLSPassthrough RouterProtocol = "tls_passthrough"
	27	+	)
	28	+
	29	+	type NetworkProtocol string
	30	+
	31	+	const (
	32	+	NetworkProtocolTCP NetworkProtocol = "tcp"
	33	+	NetworkProtocolUDP NetworkProtocol = "udp"
	34	+	)
	35	+
	36	+	type TrafficGraph struct {
	37	+	Options TrafficOptions
	38	+	EntryPoints []EntryPoint
	39	+	Routers []TrafficRouter
	40	+	Services []TrafficService
	41	+	}
	42	+
	43	+	type TrafficOptions struct {
	44	+	TCP TCPOptions
	45	+	UDP UDPOptions
	46	+	}
	47	+
	48	+	type TCPOptions struct {
	49	+	DialTimeout time.Duration
	50	+	IdleTimeout time.Duration
	51	+	DrainTimeout time.Duration
	52	+	MaxConnections int
	53	+	}
	54	+
	55	+	type UDPOptions struct {
	56	+	IdleTimeout time.Duration
	57	+	DrainTimeout time.Duration
	58	+	MaxSessions int
	59	+	}
	60	+
	61	+	type EntryPoint struct {
	62	+	Name string
	63	+	Address string
	64	+	Protocol EntryPointProtocol
	65	+	TrustedCIDRs []string
	66	+	}
	67	+
	68	+	type TrafficRouter struct {
	69	+	Name string
	70	+	EntryPoint string
	71	+	Protocol RouterProtocol
	72	+	Rule TrafficRule
	73	+	Service string
	74	+	}
	75	+
	76	+	type TrafficRule struct {
	77	+	Host string
	78	+	SNI string
	79	+	}
	80	+
	81	+	type TrafficService struct {
	82	+	Name string
	83	+	Backends []TrafficBackend
	84	+	}
	85	+
	86	+	type TrafficBackend struct {
	87	+	Name string
	88	+	Host string
	89	+	Port int
	90	+	Protocol NetworkProtocol
	91	+	}
	92	+
	93	+	type TrafficStatus struct {
	94	+	LastReloadStatus string
	95	+	LastReloadError string
	96	+	EntryPoints []EntryPointStatus
	97	+	Routers []TrafficRouterStatus
	98	+	Services []TrafficServiceStatus
	99	+	Counters TrafficCounters
	100	+	}
	101	+
	102	+	type EntryPointStatus struct {
	103	+	Name string
	104	+	Address string
	105	+	Protocol EntryPointProtocol
	106	+	Active bool
	107	+	ActiveTCPConnections int64
	108	+	ActiveUDPSessions int64
	109	+	TotalAccepted int64
	110	+	TotalRefused int64
	111	+	TotalErrors int64
	112	+	BytesIn int64
	113	+	BytesOut int64
	114	+	}
	115	+
	116	+	type TrafficRouterStatus struct {
	117	+	Name string
	118	+	EntryPoint string
	119	+	Protocol RouterProtocol
	120	+	Active bool
	121	+	ActiveTCPConnections int64
	122	+	ActiveUDPSessions int64
	123	+	TotalAccepted int64
	124	+	TotalRefused int64
	125	+	TotalErrors int64
	126	+	BytesIn int64
	127	+	BytesOut int64
	128	+	}
	129	+
	130	+	type TrafficServiceStatus struct {
	131	+	Name string
	132	+	Active bool
	133	+	Backends []TrafficBackendStatus
	134	+	}
	135	+
	136	+	type TrafficBackendStatus struct {
	137	+	Name string
	138	+	Active bool
	139	+	ActiveTCPConnections int64
	140	+	ActiveUDPSessions int64
	141	+	TotalAccepted int64
	142	+	TotalRefused int64
	143	+	TotalErrors int64
	144	+	BytesIn int64
	145	+	BytesOut int64
	146	+	}
	147	+
	148	+	type TrafficCounters struct {
	149	+	ActiveTCPConnections int64
	150	+	ActiveUDPSessions int64
	151	+	TotalAccepted int64
	152	+	TotalRefused int64
	153	+	TotalErrors int64
	154	+	BytesIn int64
	155	+	BytesOut int64
	156	+	}
	157	+
	158	+	type TrafficServiceRefKind string
	159	+
	160	+	const (
	161	+	TrafficServiceRefRoute TrafficServiceRefKind = "route"
	162	+	TrafficServiceRefExternalRoute TrafficServiceRefKind = "external_route"
	163	+	TrafficServiceRefNetworkService TrafficServiceRefKind = "network_service"
	164	+	TrafficServiceRefStatic TrafficServiceRefKind = "static"
	165	+	)
	166	+
	167	+	type TrafficServiceRef struct {
	168	+	Kind TrafficServiceRefKind
	169	+	Domain string
	170	+	Name string
	171	+	PortName string
	172	+	Reserved bool
	173	+	}
	174	+
	175	+	func ParseTrafficServiceRef(value string) (TrafficServiceRef, error) {
	176	+	kind, rest, ok := strings.Cut(strings.TrimSpace(value), ":")
	177	+	if !ok \|\| rest == "" {
	178	+	return TrafficServiceRef{}, fmt.Errorf("invalid traffic service ref %q", value)
	179	+	}
	180	+	switch TrafficServiceRefKind(kind) {
	181	+	case TrafficServiceRefRoute:
	182	+	return TrafficServiceRef{Kind: TrafficServiceRefRoute, Domain: rest}, nil
	183	+	case TrafficServiceRefExternalRoute:
	184	+	return TrafficServiceRef{Kind: TrafficServiceRefExternalRoute, Domain: rest}, nil
	185	+	case TrafficServiceRefNetworkService:
	186	+	name, portName, ok := strings.Cut(rest, ":")
	187	+	if !ok \|\| name == "" \|\| portName == "" \|\| strings.Contains(portName, ":") {
	188	+	return TrafficServiceRef{}, fmt.Errorf("invalid network service ref %q", value)
	189	+	}
	190	+	return TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: name, PortName: portName}, nil
	191	+	case TrafficServiceRefStatic:
	192	+	return TrafficServiceRef{Kind: TrafficServiceRefStatic, Name: rest, Reserved: true}, nil
	193	+	default:
	194	+	return TrafficServiceRef{}, fmt.Errorf("invalid traffic service ref kind %q", kind)
	195	+	}
	196	+	}
	197	+
	198	+	func (g TrafficGraph) Validate() error {
	199	+	entryPoints, err := validateTrafficEntryPoints(g.EntryPoints)
	200	+	if err != nil {
	201	+	return err
	202	+	}
	203	+	services, err := validateTrafficServices(g.Services)
	204	+	if err != nil {
	205	+	return err
	206	+	}
	207	+	return g.validateRouters(entryPoints, services)
	208	+	}
	209	+
	210	+	func validateTrafficEntryPoints(entries []EntryPoint) (map[string]EntryPoint, error) {
	211	+	entryPoints := make(map[string]EntryPoint, len(entries))
	212	+	listenAddresses := newProtocolListenAddressSet()
	213	+	for _, entryPoint := range entries {
	214	+	if err := validateTrafficEntryPoint(entryPoint, entryPoints, listenAddresses); err != nil {
	215	+	return nil, err
	216	+	}
	217	+	entryPoints[entryPoint.Name] = entryPoint
	218	+	}
	219	+	return entryPoints, nil
	220	+	}
	221	+
	222	+	type protocolListenAddressSet struct {
	223	+	tcp listenAddressSet
	224	+	udp listenAddressSet
	225	+	}
	226	+
	227	+	func newProtocolListenAddressSet() *protocolListenAddressSet {
	228	+	return &protocolListenAddressSet{tcp: newListenAddressSet(), udp: newListenAddressSet()}
	229	+	}
	230	+
	231	+	func (s *protocolListenAddressSet) add(entryPoint EntryPoint, addr listenAddress) error {
	232	+	if entryPoint.Protocol == EntryPointProtocolUDP {
	233	+	return s.udp.add(addr, entryPoint.Name, "udp")
	234	+	}
	235	+	return s.tcp.add(addr, entryPoint.Name, "tcp")
	236	+	}
	237	+
	238	+	func validateTrafficEntryPoint(entryPoint EntryPoint, existing map[string]EntryPoint, listenAddresses *protocolListenAddressSet) error {
	239	+	if entryPoint.Name == "" {
	240	+	return fmt.Errorf("entrypoint name is required")
	241	+	}
	242	+	if _, exists := existing[entryPoint.Name]; exists {
	243	+	return fmt.Errorf("duplicate entrypoint name %q", entryPoint.Name)
	244	+	}
	245	+	if err := validateEntryPointProtocol(entryPoint.Protocol); err != nil {
	246	+	return fmt.Errorf("invalid entrypoint protocol for %q: %w", entryPoint.Name, err)
	247	+	}
	248	+	addr, err := parseListenAddress(entryPoint.Address)
	249	+	if err != nil {
	250	+	return fmt.Errorf("invalid entrypoint address for %q: %w", entryPoint.Name, err)
	251	+	}
	252	+	return listenAddresses.add(entryPoint, addr)
	253	+	}
	254	+
	255	+	func validateTrafficServices(values []TrafficService) (map[string]TrafficService, error) {
	256	+	services := make(map[string]TrafficService, len(values))
	257	+	for _, service := range values {
	258	+	if err := validateTrafficService(service, services); err != nil {
	259	+	return nil, err
	260	+	}
	261	+	services[service.Name] = service
	262	+	}
	263	+	return services, nil
	264	+	}
	265	+
	266	+	func validateTrafficService(service TrafficService, existing map[string]TrafficService) error {
	267	+	if service.Name == "" {
	268	+	return fmt.Errorf("traffic service name is required")
	269	+	}
	270	+	if _, exists := existing[service.Name]; exists {
	271	+	return fmt.Errorf("duplicate traffic service name %q", service.Name)
	272	+	}
	273	+	if _, err := ParseTrafficServiceRef(service.Name); err != nil {
	274	+	return fmt.Errorf("invalid traffic service ref %q: %w", service.Name, err)
	275	+	}
	276	+	for _, backend := range service.Backends {
	277	+	if err := validateTrafficBackend(service.Name, backend); err != nil {
	278	+	return err
	279	+	}
	280	+	}
	281	+	return nil
	282	+	}
	283	+
	284	+	func validateTrafficBackend(serviceName string, backend TrafficBackend) error {
	285	+	if backend.Port < 1 \|\| backend.Port > 65535 {
	286	+	return fmt.Errorf("invalid backend port %d for service %q", backend.Port, serviceName)
	287	+	}
	288	+	if err := validateNetworkProtocol(backend.Protocol); err != nil {
	289	+	return fmt.Errorf("invalid backend protocol for service %q: %w", serviceName, err)
	290	+	}
	291	+	return nil
	292	+	}
	293	+
	294	+	func (g TrafficGraph) validateRouters(entryPoints map[string]EntryPoint, services map[string]TrafficService) error {
	295	+	state := newRouterValidationState()
	296	+	for _, router := range g.Routers {
	297	+	if err := state.validateRouter(router, entryPoints, services); err != nil {
	298	+	return err
	299	+	}
	300	+	}
	301	+	return nil
	302	+	}
	303	+
	304	+	type routerValidationState struct {
	305	+	routerNames map[string]struct{}
	306	+	exactSNI map[string]map[string]string
	307	+	wildSNI map[string]map[string]string
	308	+	httpHosts map[string]map[string]string
	309	+	tcpRouters map[string]string
	310	+	udpRouters map[string]string
	311	+	}
	312	+
	313	+	func newRouterValidationState() *routerValidationState {
	314	+	return &routerValidationState{
	315	+	routerNames: map[string]struct{}{},
	316	+	exactSNI: map[string]map[string]string{},
	317	+	wildSNI: map[string]map[string]string{},
	318	+	httpHosts: map[string]map[string]string{},
	319	+	tcpRouters: map[string]string{},
	320	+	udpRouters: map[string]string{},
	321	+	}
	322	+	}
	323	+
	324	+	func (s *routerValidationState) validateRouter(router TrafficRouter, entryPoints map[string]EntryPoint, services map[string]TrafficService) error {
	325	+	if err := s.validateRouterName(router); err != nil {
	326	+	return err
	327	+	}
	328	+	entryPoint, serviceRef, service, err := resolveRouterTargets(router, entryPoints, services)
	329	+	if err != nil {
	330	+	return err
	331	+	}
	332	+	if err := validateRouterEntryPointProtocol(router, entryPoint); err != nil {
	333	+	return err
	334	+	}
	335	+	if err := validateRouterServiceRef(router, serviceRef, service); err != nil {
	336	+	return err
	337	+	}
	338	+	if err := s.validateRouterRule(router, entryPoint); err != nil {
	339	+	return err
	340	+	}
	341	+	return s.validateTLSPassthroughRule(router, entryPoint)
	342	+	}
	343	+
	344	+	func (s *routerValidationState) validateRouterName(router TrafficRouter) error {
	345	+	if router.Name == "" {
	346	+	return fmt.Errorf("traffic router name is required")
	347	+	}
	348	+	if _, exists := s.routerNames[router.Name]; exists {
	349	+	return fmt.Errorf("duplicate traffic router name %q", router.Name)
	350	+	}
	351	+	s.routerNames[router.Name] = struct{}{}
	352	+	return nil
	353	+	}
	354	+
	355	+	func resolveRouterTargets(router TrafficRouter, entryPoints map[string]EntryPoint, services map[string]TrafficService) (EntryPoint, TrafficServiceRef, TrafficService, error) {
	356	+	entryPoint, ok := entryPoints[router.EntryPoint]
	357	+	if !ok {
	358	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("router %q references unknown entrypoint %q", router.Name, router.EntryPoint)
	359	+	}
	360	+	serviceRef, err := ParseTrafficServiceRef(router.Service)
	361	+	if err != nil {
	362	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("router %q has invalid service ref: %w", router.Name, err)
	363	+	}
	364	+	service, ok := services[router.Service]
	365	+	if !ok {
	366	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("router %q references unknown service %q", router.Name, router.Service)
	367	+	}
	368	+	if err := validateRouterProtocol(router.Protocol); err != nil {
	369	+	return EntryPoint{}, TrafficServiceRef{}, TrafficService{}, fmt.Errorf("invalid router protocol for %q: %w", router.Name, err)
	370	+	}
	371	+	return entryPoint, serviceRef, service, nil
	372	+	}
	373	+
	374	+	func (s *routerValidationState) validateRouterRule(router TrafficRouter, entryPoint EntryPoint) error {
	375	+	switch router.Protocol {
	376	+	case RouterProtocolTCP:
	377	+	return validateSingleL4Router(s.tcpRouters, "tcp", entryPoint.Name, router.Name)
	378	+	case RouterProtocolUDP:
	379	+	return validateSingleL4Router(s.udpRouters, "udp", entryPoint.Name, router.Name)
	380	+	case RouterProtocolHTTP:
	381	+	return s.validateHTTPRule(router, entryPoint)
	382	+	default:
	383	+	return nil
	384	+	}
	385	+	}
	386	+
	387	+	func validateSingleL4Router(routers map[string]string, protocol string, entryPoint string, routerName string) error {
	388	+	if existing := routers[entryPoint]; existing != "" {
	389	+	return fmt.Errorf("ambiguous %s routers on entrypoint %q: %q and %q", protocol, entryPoint, existing, routerName)
	390	+	}
	391	+	routers[entryPoint] = routerName
	392	+	return nil
	393	+	}
	394	+
	395	+	func (s *routerValidationState) validateHTTPRule(router TrafficRouter, entryPoint EntryPoint) error {
	396	+	if router.Rule.Host == "" {
	397	+	return nil
	398	+	}
	399	+	host := normalizeHost(router.Rule.Host)
	400	+	if existing := s.httpHosts[entryPoint.Name][host]; existing != "" {
	401	+	return fmt.Errorf("duplicate http host %q on entrypoint %q used by routers %q and %q", host, entryPoint.Name, existing, router.Name)
	402	+	}
	403	+	if err := s.validateHTTPRuleTLSConflicts(entryPoint.Name, host); err != nil {
	404	+	return err
	405	+	}
	406	+	putNested(s.httpHosts, entryPoint.Name, host, router.Name)
	407	+	return nil
	408	+	}
	409	+
	410	+	func (s *routerValidationState) validateHTTPRuleTLSConflicts(entryPoint string, host string) error {
	411	+	if s.exactSNI[entryPoint][host] != "" {
	412	+	return fmt.Errorf("http host conflicts with tls passthrough sni %q on entrypoint %q", host, entryPoint)
	413	+	}
	414	+	if wildcard := matchingWildcardSNI(host, s.wildSNI[entryPoint]); wildcard != "" {
	415	+	return fmt.Errorf("http host conflicts with wildcard tls passthrough sni %q on entrypoint %q", wildcard, entryPoint)
	416	+	}
	417	+	return nil
	418	+	}
	419	+
	420	+	func (s *routerValidationState) validateTLSPassthroughRule(router TrafficRouter, entryPoint EntryPoint) error {
	421	+	if router.Protocol != RouterProtocolTLSPassthrough \|\| router.Rule.SNI == "" {
	422	+	return nil
	423	+	}
	424	+	sni := normalizeHost(router.Rule.SNI)
	425	+	if strings.HasPrefix(sni, "*.") {
	426	+	return s.validateWildcardSNI(entryPoint.Name, sni, router.Name)
	427	+	}
	428	+	return s.validateExactSNI(entryPoint.Name, sni, router.Name)
	429	+	}
	430	+
	431	+	func (s *routerValidationState) validateWildcardSNI(entryPoint string, sni string, routerName string) error {
	432	+	if s.wildSNI[entryPoint][sni] != "" {
	433	+	return fmt.Errorf("ambiguous wildcard tls sni %q on entrypoint %q", sni, entryPoint)
	434	+	}
	435	+	if host := matchingHTTPHost(sni, s.httpHosts[entryPoint]); host != "" {
	436	+	return fmt.Errorf("http host conflicts with wildcard tls passthrough sni %q on entrypoint %q for host %q", sni, entryPoint, host)
	437	+	}
	438	+	putNested(s.wildSNI, entryPoint, sni, routerName)
	439	+	return nil
	440	+	}
	441	+
	442	+	func (s *routerValidationState) validateExactSNI(entryPoint string, sni string, routerName string) error {
	443	+	if s.exactSNI[entryPoint][sni] != "" {
	444	+	return fmt.Errorf("duplicate exact tls sni %q on entrypoint %q", sni, entryPoint)
	445	+	}
	446	+	if s.httpHosts[entryPoint][sni] != "" {
	447	+	return fmt.Errorf("http host conflicts with tls passthrough sni %q on entrypoint %q", sni, entryPoint)
	448	+	}
	449	+	putNested(s.exactSNI, entryPoint, sni, routerName)
	450	+	return nil
	451	+	}
	452	+
	453	+	func validateRouterEntryPointProtocol(router TrafficRouter, entryPoint EntryPoint) error {
	454	+	compatible := false
	455	+	switch router.Protocol {
	456	+	case RouterProtocolHTTP:
	457	+	compatible = entryPoint.Protocol == EntryPointProtocolHTTP \|\| entryPoint.Protocol == EntryPointProtocolTLSMux
	458	+	case RouterProtocolTLSPassthrough:
	459	+	compatible = entryPoint.Protocol == EntryPointProtocolTLSMux
	460	+	case RouterProtocolTCP:
	461	+	compatible = entryPoint.Protocol == EntryPointProtocolTCP
	462	+	case RouterProtocolUDP:
	463	+	compatible = entryPoint.Protocol == EntryPointProtocolUDP
	464	+	}
	465	+	if compatible {
	466	+	return nil
	467	+	}
	468	+	return fmt.Errorf("router %q protocol %s is incompatible with entrypoint %q protocol %s", router.Name, router.Protocol, entryPoint.Name, entryPoint.Protocol)
	469	+	}
	470	+
	471	+	func validateRouterServiceRef(router TrafficRouter, ref TrafficServiceRef, service TrafficService) error {
	472	+	switch router.Protocol {
	473	+	case RouterProtocolHTTP:
	474	+	if ref.Kind == TrafficServiceRefRoute \|\| ref.Kind == TrafficServiceRefExternalRoute {
	475	+	return nil
	476	+	}
	477	+	case RouterProtocolTCP, RouterProtocolUDP, RouterProtocolTLSPassthrough:
	478	+	return validateL4RouterService(router, ref, service)
	479	+	}
	480	+	if ref.Kind == TrafficServiceRefStatic {
	481	+	return fmt.Errorf("static traffic service ref %q is unsupported in traffic graph validation", router.Service)
	482	+	}
	483	+	return fmt.Errorf("router %q protocol %s does not support service ref kind %s", router.Name, router.Protocol, ref.Kind)
	484	+	}
	485	+
	486	+	func validateL4RouterService(router TrafficRouter, ref TrafficServiceRef, service TrafficService) error {
	487	+	want, ok := l4BackendProtocol(router.Protocol)
	488	+	if !ok {
	489	+	return nil
	490	+	}
	491	+	if ref.Kind != TrafficServiceRefNetworkService {
	492	+	if ref.Kind == TrafficServiceRefStatic {
	493	+	return fmt.Errorf("static traffic service ref %q is unsupported in traffic graph validation", router.Service)
	494	+	}
	495	+	return fmt.Errorf("l4 router %q requires network_service service ref", router.Name)
	496	+	}
	497	+	if len(service.Backends) != 1 {
	498	+	return fmt.Errorf("l4 router service must have exactly one backend for router %q", router.Name)
	499	+	}
	500	+	backend := service.Backends[0]
	501	+	if backend.Protocol != want {
	502	+	return fmt.Errorf("backend protocol %s does not match router protocol %s for router %q", backend.Protocol, want, router.Name)
	503	+	}
	504	+	return nil
	505	+	}
	506	+
	507	+	func l4BackendProtocol(protocol RouterProtocol) (NetworkProtocol, bool) {
	508	+	switch protocol {
	509	+	case RouterProtocolTCP:
	510	+	return NetworkProtocolTCP, true
	511	+	case RouterProtocolUDP:
	512	+	return NetworkProtocolUDP, true
	513	+	case RouterProtocolTLSPassthrough:
	514	+	return NetworkProtocolTCP, true
	515	+	default:
	516	+	return "", false
	517	+	}
	518	+	}
	519	+
	520	+	func validateEntryPointProtocol(protocol EntryPointProtocol) error {
	521	+	switch protocol {
	522	+	case EntryPointProtocolHTTP, EntryPointProtocolTLSMux, EntryPointProtocolTCP, EntryPointProtocolUDP:
	523	+	return nil
	524	+	default:
	525	+	return fmt.Errorf("%q", protocol)
	526	+	}
	527	+	}
	528	+
	529	+	func validateRouterProtocol(protocol RouterProtocol) error {
	530	+	switch protocol {
	531	+	case RouterProtocolHTTP, RouterProtocolTCP, RouterProtocolUDP, RouterProtocolTLSPassthrough:
	532	+	return nil
	533	+	default:
	534	+	return fmt.Errorf("%q", protocol)
	535	+	}
	536	+	}
	537	+
	538	+	func validateNetworkProtocol(protocol NetworkProtocol) error {
	539	+	switch protocol {
	540	+	case NetworkProtocolTCP, NetworkProtocolUDP:
	541	+	return nil
	542	+	default:
	543	+	return fmt.Errorf("%q", protocol)
	544	+	}
	545	+	}
	546	+
	547	+	type listenAddress struct {
	548	+	key string
	549	+	port int
	550	+	wildcard bool
	551	+	}
	552	+
	553	+	type listenAddressSet struct {
	554	+	byKey map[string]string
	555	+	all []registeredListenAddress
	556	+	}
	557	+
	558	+	type registeredListenAddress struct {
	559	+	addr listenAddress
	560	+	name string
	561	+	}
	562	+
	563	+	func newListenAddressSet() listenAddressSet {
	564	+	return listenAddressSet{byKey: map[string]string{}}
	565	+	}
	566	+
	567	+	func (s *listenAddressSet) add(addr listenAddress, name string, protocol string) error {
	568	+	if other, exists := s.byKey[addr.key]; exists {
	569	+	return fmt.Errorf("duplicate %s entrypoint address %q used by %q and %q", protocol, addr.key, other, name)
	570	+	}
	571	+	for _, existing := range s.all {
	572	+	if existing.addr.port == addr.port && (existing.addr.wildcard \|\| addr.wildcard) {
	573	+	return fmt.Errorf("conflicting %s entrypoint address %q used by %q and %q", protocol, addr.key, existing.name, name)
	574	+	}
	575	+	}
	576	+	s.byKey[addr.key] = name
	577	+	s.all = append(s.all, registeredListenAddress{addr: addr, name: name})
	578	+	return nil
	579	+	}
	580	+
	581	+	func parseListenAddress(address string) (listenAddress, error) {
	582	+	host, portValue, err := net.SplitHostPort(address)
	583	+	if err != nil {
	584	+	return listenAddress{}, err
	585	+	}
	586	+	port, err := strconv.Atoi(portValue)
	587	+	if err != nil \|\| port < 1 \|\| port > 65535 {
	588	+	return listenAddress{}, fmt.Errorf("invalid port %q", portValue)
	589	+	}
	590	+	return listenAddress{
	591	+	key: net.JoinHostPort(host, strconv.Itoa(port)),
	592	+	port: port,
	593	+	wildcard: isWildcardListenHost(host),
	594	+	}, nil
	595	+	}
	596	+
	597	+	func isWildcardListenHost(host string) bool {
	598	+	return host == "" \|\| host == "0.0.0.0" \|\| host == "::"
	599	+	}
	600	+
	601	+	func normalizeHost(host string) string {
	602	+	return strings.TrimSuffix(strings.ToLower(strings.TrimSpace(host)), ".")
	603	+	}
	604	+
	605	+	func matchingWildcardSNI(host string, wildcards map[string]string) string {
	606	+	for wildcard := range wildcards {
	607	+	if hostMatchesWildcard(host, wildcard) {
	608	+	return wildcard
	609	+	}
	610	+	}
	611	+	return ""
	612	+	}
	613	+
	614	+	func matchingHTTPHost(wildcard string, hosts map[string]string) string {
	615	+	for host := range hosts {
	616	+	if hostMatchesWildcard(host, wildcard) {
	617	+	return host
	618	+	}
	619	+	}
	620	+	return ""
	621	+	}
	622	+
	623	+	func hostMatchesWildcard(host string, wildcard string) bool {
	624	+	suffix, ok := strings.CutPrefix(wildcard, "*.")
	625	+	if !ok \|\| host == suffix {
	626	+	return false
	627	+	}
	628	+	return strings.HasSuffix(host, "."+suffix)
	629	+	}
	630	+
	631	+	func putNested(values map[string]map[string]string, key string, nestedKey string, value string) {
	632	+	if values[key] == nil {
	633	+	values[key] = map[string]string{}
	634	+	}
	635	+	values[key][nestedKey] = value
	636	+	}

A internal/domain/traffic_test.go +508 -0

@@ -0,0 +1,508 @@
	1	+	package domain
	2	+
	3	+	import (
	4	+	"testing"
	5	+	"time"
	6	+
	7	+	"github.com/stretchr/testify/require"
	8	+	)
	9	+
	10	+	func TestTrafficGraphValidateEntryPoints(t *testing.T) {
	11	+	tests := []struct {
	12	+	name string
	13	+	graph TrafficGraph
	14	+	wantErr string
	15	+	}{
	16	+	{
	17	+	name: "duplicate entrypoint names",
	18	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	19	+	{Name: "web", Address: ":80", Protocol: EntryPointProtocolHTTP},
	20	+	{Name: "web", Address: ":81", Protocol: EntryPointProtocolHTTP},
	21	+	}},
	22	+	wantErr: "duplicate entrypoint name",
	23	+	},
	24	+	{
	25	+	name: "invalid entrypoint address",
	26	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	27	+	{Name: "web", Address: "not-a-listen-address", Protocol: EntryPointProtocolHTTP},
	28	+	}},
	29	+	wantErr: "invalid entrypoint address",
	30	+	},
	31	+	{
	32	+	name: "invalid entrypoint protocol",
	33	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	34	+	{Name: "web", Address: ":80", Protocol: EntryPointProtocol("smtp")},
	35	+	}},
	36	+	wantErr: "invalid entrypoint protocol",
	37	+	},
	38	+	{
	39	+	name: "duplicate tcp address rejected",
	40	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	41	+	{Name: "web", Address: ":443", Protocol: EntryPointProtocolTLSMux},
	42	+	{Name: "tcp", Address: ":443", Protocol: EntryPointProtocolTCP},
	43	+	}},
	44	+	wantErr: "duplicate tcp entrypoint address",
	45	+	},
	46	+	{
	47	+	name: "duplicate udp address rejected",
	48	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	49	+	{Name: "dns1", Address: ":53", Protocol: EntryPointProtocolUDP},
	50	+	{Name: "dns2", Address: ":53", Protocol: EntryPointProtocolUDP},
	51	+	}},
	52	+	wantErr: "duplicate udp entrypoint address",
	53	+	},
	54	+	{
	55	+	name: "tcp wildcard address conflicts with ipv4 specific bind",
	56	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	57	+	{Name: "wild", Address: ":443", Protocol: EntryPointProtocolTCP},
	58	+	{Name: "specific", Address: "127.0.0.1:443", Protocol: EntryPointProtocolTCP},
	59	+	}},
	60	+	wantErr: "conflicting tcp entrypoint address",
	61	+	},
	62	+	{
	63	+	name: "tcp wildcard address conflicts with ipv6 wildcard bind",
	64	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	65	+	{Name: "wild", Address: ":443", Protocol: EntryPointProtocolTCP},
	66	+	{Name: "specific", Address: "[::]:443", Protocol: EntryPointProtocolTCP},
	67	+	}},
	68	+	wantErr: "conflicting tcp entrypoint address",
	69	+	},
	70	+	{
	71	+	name: "tcp and udp same numeric port allowed",
	72	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	73	+	{Name: "tcp", Address: ":53", Protocol: EntryPointProtocolTCP},
	74	+	{Name: "udp", Address: ":53", Protocol: EntryPointProtocolUDP},
	75	+	}},
	76	+	},
	77	+	}
	78	+
	79	+	for _, tt := range tests {
	80	+	t.Run(tt.name, func(t *testing.T) {
	81	+	err := tt.graph.Validate()
	82	+	if tt.wantErr == "" {
	83	+	require.NoError(t, err)
	84	+	return
	85	+	}
	86	+	require.ErrorContains(t, err, tt.wantErr)
	87	+	})
	88	+	}
	89	+	}
	90	+
	91	+	func TestTrafficGraphValidateRouterEntryPointProtocolCompatibility(t *testing.T) {
	92	+	tests := []struct {
	93	+	name string
	94	+	routerProtocol RouterProtocol
	95	+	entryProtocol EntryPointProtocol
	96	+	wantErr bool
	97	+	}{
	98	+	{name: "http router accepts http entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolHTTP},
	99	+	{name: "http router accepts tls mux entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolTLSMux},
	100	+	{name: "tls passthrough router accepts tls mux entrypoint", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolTLSMux},
	101	+	{name: "tcp router accepts tcp entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolTCP},
	102	+	{name: "udp router accepts udp entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolUDP},
	103	+	{name: "http router rejects udp entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolUDP, wantErr: true},
	104	+	{name: "http router rejects tcp entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolTCP, wantErr: true},
	105	+	{name: "udp router rejects tcp entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolTCP, wantErr: true},
	106	+	{name: "udp router rejects http entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolHTTP, wantErr: true},
	107	+	{name: "udp router rejects tls mux entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolTLSMux, wantErr: true},
	108	+	{name: "tcp router rejects udp entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolUDP, wantErr: true},
	109	+	{name: "tcp router rejects http entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolHTTP, wantErr: true},
	110	+	{name: "tcp router rejects tls mux entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolTLSMux, wantErr: true},
	111	+	{name: "tls passthrough router rejects http entrypoint", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolHTTP, wantErr: true},
	112	+	{name: "tls passthrough router rejects udp entrypoint", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolUDP, wantErr: true},
	113	+	{name: "tls passthrough router rejects tcp entrypoint per tls mux spec", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolTCP, wantErr: true},
	114	+	}
	115	+
	116	+	for _, tt := range tests {
	117	+	t.Run(tt.name, func(t *testing.T) {
	118	+	serviceName := "route:app.example.com"
	119	+	backendProtocol := NetworkProtocolTCP
	120	+	rule := TrafficRule{Host: "app.example.com"}
	121	+	switch tt.routerProtocol {
	122	+	case RouterProtocolUDP:
	123	+	serviceName = "network_service:app:game"
	124	+	backendProtocol = NetworkProtocolUDP
	125	+	rule = TrafficRule{}
	126	+	case RouterProtocolTCP, RouterProtocolTLSPassthrough:
	127	+	serviceName = "network_service:app:tcp"
	128	+	rule = TrafficRule{SNI: "app.example.com"}
	129	+	}
	130	+
	131	+	graph := TrafficGraph{
	132	+	EntryPoints: []EntryPoint{{Name: "entry", Address: ":12345", Protocol: tt.entryProtocol}},
	133	+	Routers: []TrafficRouter{{Name: "router", EntryPoint: "entry", Protocol: tt.routerProtocol, Rule: rule, Service: serviceName}},
	134	+	Services: []TrafficService{{Name: serviceName, Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: backendProtocol}}}},
	135	+	}
	136	+	err := graph.Validate()
	137	+	if !tt.wantErr {
	138	+	require.NoError(t, err)
	139	+	return
	140	+	}
	141	+	require.ErrorContains(t, err, "router \"router\" protocol "+string(tt.routerProtocol)+" is incompatible with entrypoint \"entry\" protocol "+string(tt.entryProtocol))
	142	+	})
	143	+	}
	144	+	}
	145	+
	146	+	func TestTrafficGraphValidateRouterNames(t *testing.T) {
	147	+	service := TrafficService{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: NetworkProtocolTCP}}}
	148	+	tests := []struct {
	149	+	name string
	150	+	routers []TrafficRouter
	151	+	wantErr string
	152	+	}{
	153	+	{
	154	+	name: "router name is required",
	155	+	routers: []TrafficRouter{{EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: service.Name}},
	156	+	wantErr: "traffic router name is required",
	157	+	},
	158	+	{
	159	+	name: "duplicate router names rejected",
	160	+	routers: []TrafficRouter{
	161	+	{Name: "web", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: service.Name},
	162	+	{Name: "web", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "api.example.com"}, Service: service.Name},
	163	+	},
	164	+	wantErr: "duplicate traffic router name \"web\"",
	165	+	},
	166	+	}
	167	+
	168	+	for _, tt := range tests {
	169	+	t.Run(tt.name, func(t *testing.T) {
	170	+	graph := TrafficGraph{
	171	+	EntryPoints: []EntryPoint{{Name: "web", Address: ":80", Protocol: EntryPointProtocolHTTP}},
	172	+	Routers: tt.routers,
	173	+	Services: []TrafficService{service},
	174	+	}
	175	+	require.ErrorContains(t, graph.Validate(), tt.wantErr)
	176	+	})
	177	+	}
	178	+	}
	179	+
	180	+	func TestTrafficGraphValidateDuplicateHTTPHosts(t *testing.T) {
	181	+	service := TrafficService{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: NetworkProtocolTCP}}}
	182	+	tests := []struct {
	183	+	name string
	184	+	entryProtocol EntryPointProtocol
	185	+	entryAddress string
	186	+	}{
	187	+	{name: "http entrypoint", entryProtocol: EntryPointProtocolHTTP, entryAddress: ":80"},
	188	+	{name: "tls mux entrypoint", entryProtocol: EntryPointProtocolTLSMux, entryAddress: ":443"},
	189	+	}
	190	+
	191	+	for _, tt := range tests {
	192	+	t.Run(tt.name, func(t *testing.T) {
	193	+	graph := TrafficGraph{
	194	+	EntryPoints: []EntryPoint{{Name: "web", Address: tt.entryAddress, Protocol: tt.entryProtocol}},
	195	+	Routers: []TrafficRouter{
	196	+	{Name: "one", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "App.Example.Com."}, Service: service.Name},
	197	+	{Name: "two", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: service.Name},
	198	+	},
	199	+	Services: []TrafficService{service},
	200	+	}
	201	+	require.ErrorContains(t, graph.Validate(), "duplicate http host \"app.example.com\" on entrypoint \"web\"")
	202	+	})
	203	+	}
	204	+	}
	205	+
	206	+	func TestTrafficGraphValidateAmbiguousL4Routers(t *testing.T) {
	207	+	tests := []struct {
	208	+	name string
	209	+	entryProtocol EntryPointProtocol
	210	+	routerProtocol RouterProtocol
	211	+	service TrafficService
	212	+	wantErr string
	213	+	}{
	214	+	{
	215	+	name: "multiple tcp routers on same entrypoint rejected",
	216	+	entryProtocol: EntryPointProtocolTCP,
	217	+	routerProtocol: RouterProtocolTCP,
	218	+	service: TrafficService{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 5432, Protocol: NetworkProtocolTCP}}},
	219	+	wantErr: "ambiguous tcp routers on entrypoint \"l4\"",
	220	+	},
	221	+	{
	222	+	name: "multiple udp routers on same entrypoint rejected",
	223	+	entryProtocol: EntryPointProtocolUDP,
	224	+	routerProtocol: RouterProtocolUDP,
	225	+	service: TrafficService{Name: "network_service:app:game", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 25565, Protocol: NetworkProtocolUDP}}},
	226	+	wantErr: "ambiguous udp routers on entrypoint \"l4\"",
	227	+	},
	228	+	}
	229	+
	230	+	for _, tt := range tests {
	231	+	t.Run(tt.name, func(t *testing.T) {
	232	+	graph := TrafficGraph{
	233	+	EntryPoints: []EntryPoint{{Name: "l4", Address: ":12345", Protocol: tt.entryProtocol}},
	234	+	Routers: []TrafficRouter{
	235	+	{Name: "one", EntryPoint: "l4", Protocol: tt.routerProtocol, Service: tt.service.Name},
	236	+	{Name: "two", EntryPoint: "l4", Protocol: tt.routerProtocol, Service: tt.service.Name},
	237	+	},
	238	+	Services: []TrafficService{tt.service},
	239	+	}
	240	+	require.ErrorContains(t, graph.Validate(), tt.wantErr)
	241	+	})
	242	+	}
	243	+	}
	244	+
	245	+	func TestTrafficGraphValidateTLSRules(t *testing.T) {
	246	+	tests := []struct {
	247	+	name string
	248	+	routers []TrafficRouter
	249	+	wantErr string
	250	+	}{
	251	+	{
	252	+	name: "duplicate exact tls sni on same entrypoint rejected",
	253	+	routers: []TrafficRouter{
	254	+	{Name: "one", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	255	+	{Name: "two", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	256	+	},
	257	+	wantErr: "duplicate exact tls sni",
	258	+	},
	259	+	{
	260	+	name: "exact sni plus wildcard deterministic allowed",
	261	+	routers: []TrafficRouter{
	262	+	{Name: "exact", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	263	+	{Name: "wild", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	264	+	},
	265	+	},
	266	+	{
	267	+	name: "ambiguous wildcard sni overlaps rejected",
	268	+	routers: []TrafficRouter{
	269	+	{Name: "wild1", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	270	+	{Name: "wild2", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	271	+	},
	272	+	wantErr: "ambiguous wildcard tls sni",
	273	+	},
	274	+	{
	275	+	name: "http host and tls passthrough sni conflict rejected",
	276	+	routers: []TrafficRouter{
	277	+	{Name: "http", EntryPoint: "tls", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: "route:app.example.com"},
	278	+	{Name: "pass", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "app.example.com"}, Service: "network_service:app:https"},
	279	+	},
	280	+	wantErr: "http host conflicts with tls passthrough sni",
	281	+	},
	282	+	{
	283	+	name: "http host conflicts with later wildcard tls passthrough sni",
	284	+	routers: []TrafficRouter{
	285	+	{Name: "http", EntryPoint: "tls", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: "route:app.example.com"},
	286	+	{Name: "pass", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	287	+	},
	288	+	wantErr: "http host conflicts with wildcard tls passthrough sni",
	289	+	},
	290	+	{
	291	+	name: "http host conflicts with earlier wildcard tls passthrough sni",
	292	+	routers: []TrafficRouter{
	293	+	{Name: "pass", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	294	+	{Name: "http", EntryPoint: "tls", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: "route:app.example.com"},
	295	+	},
	296	+	wantErr: "http host conflicts with wildcard tls passthrough sni",
	297	+	},
	298	+	}
	299	+
	300	+	for _, tt := range tests {
	301	+	t.Run(tt.name, func(t *testing.T) {
	302	+	graph := TrafficGraph{
	303	+	EntryPoints: []EntryPoint{{Name: "tls", Address: ":443", Protocol: EntryPointProtocolTLSMux}},
	304	+	Routers: tt.routers,
	305	+	Services: []TrafficService{
	306	+	{Name: "network_service:app:https", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 443, Protocol: NetworkProtocolTCP}}},
	307	+	{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.3", Port: 8080, Protocol: NetworkProtocolTCP}}},
	308	+	},
	309	+	}
	310	+	err := graph.Validate()
	311	+	if tt.wantErr == "" {
	312	+	require.NoError(t, err)
	313	+	return
	314	+	}
	315	+	require.ErrorContains(t, err, tt.wantErr)
	316	+	})
	317	+	}
	318	+	}
	319	+
	320	+	func TestTrafficGraphValidateBackendsAndL4Routers(t *testing.T) {
	321	+	tests := []struct {
	322	+	name string
	323	+	router TrafficRouter
	324	+	services []TrafficService
	325	+	wantErr string
	326	+	}{
	327	+	{
	328	+	name: "backend ports outside range rejected low",
	329	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	330	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Port: 0, Protocol: NetworkProtocolTCP}}}},
	331	+	wantErr: "invalid backend port",
	332	+	},
	333	+	{
	334	+	name: "backend ports outside range rejected high",
	335	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	336	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Port: 65536, Protocol: NetworkProtocolTCP}}}},
	337	+	wantErr: "invalid backend port",
	338	+	},
	339	+	{
	340	+	name: "l4 routers reject services with more than one backend",
	341	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	342	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{
	343	+	{Name: "app", Port: 5432, Protocol: NetworkProtocolTCP},
	344	+	{Name: "app2", Port: 5432, Protocol: NetworkProtocolTCP},
	345	+	}}},
	346	+	wantErr: "l4 router service must have exactly one backend",
	347	+	},
	348	+	{
	349	+	name: "tcp router requires tcp network backend",
	350	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	351	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Port: 53, Protocol: NetworkProtocolUDP}}}},
	352	+	wantErr: "backend protocol udp does not match router protocol tcp",
	353	+	},
	354	+	{
	355	+	name: "udp router requires udp network backend",
	356	+	router: TrafficRouter{Name: "udp", EntryPoint: "udp", Protocol: RouterProtocolUDP, Service: "network_service:app:game"},
	357	+	services: []TrafficService{{Name: "network_service:app:game", Backends: []TrafficBackend{{Name: "app", Port: 53, Protocol: NetworkProtocolTCP}}}},
	358	+	wantErr: "backend protocol tcp does not match router protocol udp",
	359	+	},
	360	+	{
	361	+	name: "tls passthrough requires tcp network backend",
	362	+	router: TrafficRouter{Name: "tls", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	363	+	services: []TrafficService{{Name: "network_service:app:https", Backends: []TrafficBackend{{Name: "app", Port: 443, Protocol: NetworkProtocolUDP}}}},
	364	+	wantErr: "backend protocol udp does not match router protocol tcp",
	365	+	},
	366	+	{
	367	+	name: "l4 router rejects route ref",
	368	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "route:app.example.com"},
	369	+	services: []TrafficService{{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Port: 443, Protocol: NetworkProtocolTCP}}}},
	370	+	wantErr: "requires network_service service ref",
	371	+	},
	372	+	{
	373	+	name: "static ref parses but graph validation rejects unsupported",
	374	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "static:maintenance"},
	375	+	services: []TrafficService{{Name: "static:maintenance", Backends: []TrafficBackend{{Name: "maintenance", Port: 443, Protocol: NetworkProtocolTCP}}}},
	376	+	wantErr: "static traffic service ref \"static:maintenance\" is unsupported",
	377	+	},
	378	+	}
	379	+
	380	+	for _, tt := range tests {
	381	+	t.Run(tt.name, func(t *testing.T) {
	382	+	graph := TrafficGraph{
	383	+	EntryPoints: []EntryPoint{
	384	+	{Name: "tcp", Address: ":443", Protocol: EntryPointProtocolTCP},
	385	+	{Name: "udp", Address: ":443", Protocol: EntryPointProtocolUDP},
	386	+	{Name: "tls", Address: ":8443", Protocol: EntryPointProtocolTLSMux},
	387	+	},
	388	+	Routers: []TrafficRouter{tt.router},
	389	+	Services: tt.services,
	390	+	}
	391	+	require.ErrorContains(t, graph.Validate(), tt.wantErr)
	392	+	})
	393	+	}
	394	+	}
	395	+
	396	+	func TestTrafficGraphValidateHTTPServiceRefs(t *testing.T) {
	397	+	tests := []struct {
	398	+	name string
	399	+	service string
	400	+	wantErr string
	401	+	}{
	402	+	{name: "http allows route", service: "route:app.example.com"},
	403	+	{name: "http allows external_route", service: "external_route:api.example.com"},
	404	+	{name: "http rejects network_service", service: "network_service:app:http", wantErr: "does not support service ref kind network_service"},
	405	+	{name: "http rejects static", service: "static:maintenance", wantErr: "static traffic service ref \"static:maintenance\" is unsupported"},
	406	+	}
	407	+
	408	+	for _, tt := range tests {
	409	+	t.Run(tt.name, func(t *testing.T) {
	410	+	graph := TrafficGraph{
	411	+	EntryPoints: []EntryPoint{{Name: "web", Address: ":80", Protocol: EntryPointProtocolHTTP}},
	412	+	Routers: []TrafficRouter{{Name: "web", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: tt.service}},
	413	+	Services: []TrafficService{{Name: tt.service, Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: NetworkProtocolTCP}}}},
	414	+	}
	415	+	err := graph.Validate()
	416	+	if tt.wantErr == "" {
	417	+	require.NoError(t, err)
	418	+	return
	419	+	}
	420	+	require.ErrorContains(t, err, tt.wantErr)
	421	+	})
	422	+	}
	423	+	}
	424	+
	425	+	func TestTrafficGraphValidateRouterServiceRefs(t *testing.T) {
	426	+	t.Run("router service ref is parsed", func(t *testing.T) {
	427	+	graph := TrafficGraph{
	428	+	EntryPoints: []EntryPoint{{Name: "tcp", Address: ":5432", Protocol: EntryPointProtocolTCP}},
	429	+	Routers: []TrafficRouter{{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:postgres:"}},
	430	+	Services: []TrafficService{{Name: "network_service:postgres:", Backends: []TrafficBackend{{Name: "postgres", Host: "10.0.0.4", Port: 5432, Protocol: NetworkProtocolTCP}}}},
	431	+	}
	432	+	require.ErrorContains(t, graph.Validate(), "invalid traffic service ref")
	433	+	})
	434	+
	435	+	t.Run("router service ref must exist as service name", func(t *testing.T) {
	436	+	graph := TrafficGraph{
	437	+	EntryPoints: []EntryPoint{{Name: "tcp", Address: ":5432", Protocol: EntryPointProtocolTCP}},
	438	+	Routers: []TrafficRouter{{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:postgres:db"}},
	439	+	}
	440	+	require.ErrorContains(t, graph.Validate(), "references unknown service")
	441	+	})
	442	+	}
	443	+
	444	+	func TestTrafficServiceRef(t *testing.T) {
	445	+	ref, err := ParseTrafficServiceRef("static:maintenance")
	446	+	require.NoError(t, err)
	447	+	require.Equal(t, TrafficServiceRefStatic, ref.Kind)
	448	+	require.True(t, ref.Reserved)
	449	+	require.Equal(t, "maintenance", ref.Name)
	450	+	}
	451	+
	452	+	func TestParseTrafficServiceRef(t *testing.T) {
	453	+	tests := []struct {
	454	+	input string
	455	+	want TrafficServiceRef
	456	+	}{
	457	+	{input: "route:app.example.com", want: TrafficServiceRef{Kind: TrafficServiceRefRoute, Domain: "app.example.com"}},
	458	+	{input: "external_route:api.example.com", want: TrafficServiceRef{Kind: TrafficServiceRefExternalRoute, Domain: "api.example.com"}},
	459	+	{input: "network_service:postgres:db", want: TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: "postgres", PortName: "db"}},
	460	+	{input: "network_service:web:http", want: TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: "web", PortName: "http"}},
	461	+	{input: "network_service:game:game", want: TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: "game", PortName: "game"}},
	462	+	{input: "static:maintenance", want: TrafficServiceRef{Kind: TrafficServiceRefStatic, Name: "maintenance", Reserved: true}},
	463	+	}
	464	+
	465	+	for _, tt := range tests {
	466	+	t.Run(tt.input, func(t *testing.T) {
	467	+	got, err := ParseTrafficServiceRef(tt.input)
	468	+	require.NoError(t, err)
	469	+	require.Equal(t, tt.want, got)
	470	+	})
	471	+	}
	472	+
	473	+	invalid := []string{"", "route:", "external_route:", "network_service:", "network_service:postgres", "network_service:postgres:", "network_service::db", "network_service:postgres:db:extra", "static:", "unknown:value"}
	474	+	for _, input := range invalid {
	475	+	t.Run("invalid "+input, func(t *testing.T) {
	476	+	_, err := ParseTrafficServiceRef(input)
	477	+	require.Error(t, err)
	478	+	})
	479	+	}
	480	+	}
	481	+
	482	+	func TestTrafficDomainTypesMatchSpecFields(t *testing.T) {
	483	+	graph := TrafficGraph{
	484	+	Options: TrafficOptions{
	485	+	TCP: TCPOptions{DialTimeout: time.Second, IdleTimeout: time.Minute, DrainTimeout: 2 * time.Second, MaxConnections: 100},
	486	+	UDP: UDPOptions{IdleTimeout: time.Minute, DrainTimeout: 2 * time.Second, MaxSessions: 50},
	487	+	},
	488	+	EntryPoints: []EntryPoint{{Name: "tcp", Address: ":1234", Protocol: EntryPointProtocolTCP, TrustedCIDRs: []string{"10.0.0.0/8"}}},
	489	+	Routers: []TrafficRouter{{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:game"}},
	490	+	Services: []TrafficService{{Name: "network_service:app:game", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 1234, Protocol: NetworkProtocolTCP}}}},
	491	+	}
	492	+	require.NoError(t, graph.Validate())
	493	+
	494	+	status := TrafficStatus{
	495	+	LastReloadStatus: "ok",
	496	+	LastReloadError: "",
	497	+	EntryPoints: []EntryPointStatus{{Name: "tcp", ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7}},
	498	+	Routers: []TrafficRouterStatus{{Name: "tcp", ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7}},
	499	+	Services: []TrafficServiceStatus{{Name: "network_service:app:game", Backends: []TrafficBackendStatus{{Name: "app", ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7}}}},
	500	+	Counters: TrafficCounters{ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7},
	501	+	}
	502	+	require.Equal(t, "ok", status.LastReloadStatus)
	503	+	require.Empty(t, status.LastReloadError)
	504	+	require.Equal(t, int64(7), status.EntryPoints[0].BytesOut)
	505	+	require.Equal(t, int64(7), status.Routers[0].BytesOut)
	506	+	require.Equal(t, int64(7), status.Services[0].Backends[0].BytesOut)
	507	+	require.Equal(t, int64(7), status.Counters.BytesOut)
	508	+	}

@@ -0,0 +1,508 @@
	1	+	package domain
	2	+
	3	+	import (
	4	+	"testing"
	5	+	"time"
	6	+
	7	+	"github.com/stretchr/testify/require"
	8	+	)
	9	+
	10	+	func TestTrafficGraphValidateEntryPoints(t *testing.T) {
	11	+	tests := []struct {
	12	+	name string
	13	+	graph TrafficGraph
	14	+	wantErr string
	15	+	}{
	16	+	{
	17	+	name: "duplicate entrypoint names",
	18	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	19	+	{Name: "web", Address: ":80", Protocol: EntryPointProtocolHTTP},
	20	+	{Name: "web", Address: ":81", Protocol: EntryPointProtocolHTTP},
	21	+	}},
	22	+	wantErr: "duplicate entrypoint name",
	23	+	},
	24	+	{
	25	+	name: "invalid entrypoint address",
	26	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	27	+	{Name: "web", Address: "not-a-listen-address", Protocol: EntryPointProtocolHTTP},
	28	+	}},
	29	+	wantErr: "invalid entrypoint address",
	30	+	},
	31	+	{
	32	+	name: "invalid entrypoint protocol",
	33	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	34	+	{Name: "web", Address: ":80", Protocol: EntryPointProtocol("smtp")},
	35	+	}},
	36	+	wantErr: "invalid entrypoint protocol",
	37	+	},
	38	+	{
	39	+	name: "duplicate tcp address rejected",
	40	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	41	+	{Name: "web", Address: ":443", Protocol: EntryPointProtocolTLSMux},
	42	+	{Name: "tcp", Address: ":443", Protocol: EntryPointProtocolTCP},
	43	+	}},
	44	+	wantErr: "duplicate tcp entrypoint address",
	45	+	},
	46	+	{
	47	+	name: "duplicate udp address rejected",
	48	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	49	+	{Name: "dns1", Address: ":53", Protocol: EntryPointProtocolUDP},
	50	+	{Name: "dns2", Address: ":53", Protocol: EntryPointProtocolUDP},
	51	+	}},
	52	+	wantErr: "duplicate udp entrypoint address",
	53	+	},
	54	+	{
	55	+	name: "tcp wildcard address conflicts with ipv4 specific bind",
	56	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	57	+	{Name: "wild", Address: ":443", Protocol: EntryPointProtocolTCP},
	58	+	{Name: "specific", Address: "127.0.0.1:443", Protocol: EntryPointProtocolTCP},
	59	+	}},
	60	+	wantErr: "conflicting tcp entrypoint address",
	61	+	},
	62	+	{
	63	+	name: "tcp wildcard address conflicts with ipv6 wildcard bind",
	64	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	65	+	{Name: "wild", Address: ":443", Protocol: EntryPointProtocolTCP},
	66	+	{Name: "specific", Address: "[::]:443", Protocol: EntryPointProtocolTCP},
	67	+	}},
	68	+	wantErr: "conflicting tcp entrypoint address",
	69	+	},
	70	+	{
	71	+	name: "tcp and udp same numeric port allowed",
	72	+	graph: TrafficGraph{EntryPoints: []EntryPoint{
	73	+	{Name: "tcp", Address: ":53", Protocol: EntryPointProtocolTCP},
	74	+	{Name: "udp", Address: ":53", Protocol: EntryPointProtocolUDP},
	75	+	}},
	76	+	},
	77	+	}
	78	+
	79	+	for _, tt := range tests {
	80	+	t.Run(tt.name, func(t *testing.T) {
	81	+	err := tt.graph.Validate()
	82	+	if tt.wantErr == "" {
	83	+	require.NoError(t, err)
	84	+	return
	85	+	}
	86	+	require.ErrorContains(t, err, tt.wantErr)
	87	+	})
	88	+	}
	89	+	}
	90	+
	91	+	func TestTrafficGraphValidateRouterEntryPointProtocolCompatibility(t *testing.T) {
	92	+	tests := []struct {
	93	+	name string
	94	+	routerProtocol RouterProtocol
	95	+	entryProtocol EntryPointProtocol
	96	+	wantErr bool
	97	+	}{
	98	+	{name: "http router accepts http entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolHTTP},
	99	+	{name: "http router accepts tls mux entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolTLSMux},
	100	+	{name: "tls passthrough router accepts tls mux entrypoint", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolTLSMux},
	101	+	{name: "tcp router accepts tcp entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolTCP},
	102	+	{name: "udp router accepts udp entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolUDP},
	103	+	{name: "http router rejects udp entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolUDP, wantErr: true},
	104	+	{name: "http router rejects tcp entrypoint", routerProtocol: RouterProtocolHTTP, entryProtocol: EntryPointProtocolTCP, wantErr: true},
	105	+	{name: "udp router rejects tcp entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolTCP, wantErr: true},
	106	+	{name: "udp router rejects http entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolHTTP, wantErr: true},
	107	+	{name: "udp router rejects tls mux entrypoint", routerProtocol: RouterProtocolUDP, entryProtocol: EntryPointProtocolTLSMux, wantErr: true},
	108	+	{name: "tcp router rejects udp entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolUDP, wantErr: true},
	109	+	{name: "tcp router rejects http entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolHTTP, wantErr: true},
	110	+	{name: "tcp router rejects tls mux entrypoint", routerProtocol: RouterProtocolTCP, entryProtocol: EntryPointProtocolTLSMux, wantErr: true},
	111	+	{name: "tls passthrough router rejects http entrypoint", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolHTTP, wantErr: true},
	112	+	{name: "tls passthrough router rejects udp entrypoint", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolUDP, wantErr: true},
	113	+	{name: "tls passthrough router rejects tcp entrypoint per tls mux spec", routerProtocol: RouterProtocolTLSPassthrough, entryProtocol: EntryPointProtocolTCP, wantErr: true},
	114	+	}
	115	+
	116	+	for _, tt := range tests {
	117	+	t.Run(tt.name, func(t *testing.T) {
	118	+	serviceName := "route:app.example.com"
	119	+	backendProtocol := NetworkProtocolTCP
	120	+	rule := TrafficRule{Host: "app.example.com"}
	121	+	switch tt.routerProtocol {
	122	+	case RouterProtocolUDP:
	123	+	serviceName = "network_service:app:game"
	124	+	backendProtocol = NetworkProtocolUDP
	125	+	rule = TrafficRule{}
	126	+	case RouterProtocolTCP, RouterProtocolTLSPassthrough:
	127	+	serviceName = "network_service:app:tcp"
	128	+	rule = TrafficRule{SNI: "app.example.com"}
	129	+	}
	130	+
	131	+	graph := TrafficGraph{
	132	+	EntryPoints: []EntryPoint{{Name: "entry", Address: ":12345", Protocol: tt.entryProtocol}},
	133	+	Routers: []TrafficRouter{{Name: "router", EntryPoint: "entry", Protocol: tt.routerProtocol, Rule: rule, Service: serviceName}},
	134	+	Services: []TrafficService{{Name: serviceName, Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: backendProtocol}}}},
	135	+	}
	136	+	err := graph.Validate()
	137	+	if !tt.wantErr {
	138	+	require.NoError(t, err)
	139	+	return
	140	+	}
	141	+	require.ErrorContains(t, err, "router \"router\" protocol "+string(tt.routerProtocol)+" is incompatible with entrypoint \"entry\" protocol "+string(tt.entryProtocol))
	142	+	})
	143	+	}
	144	+	}
	145	+
	146	+	func TestTrafficGraphValidateRouterNames(t *testing.T) {
	147	+	service := TrafficService{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: NetworkProtocolTCP}}}
	148	+	tests := []struct {
	149	+	name string
	150	+	routers []TrafficRouter
	151	+	wantErr string
	152	+	}{
	153	+	{
	154	+	name: "router name is required",
	155	+	routers: []TrafficRouter{{EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: service.Name}},
	156	+	wantErr: "traffic router name is required",
	157	+	},
	158	+	{
	159	+	name: "duplicate router names rejected",
	160	+	routers: []TrafficRouter{
	161	+	{Name: "web", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: service.Name},
	162	+	{Name: "web", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "api.example.com"}, Service: service.Name},
	163	+	},
	164	+	wantErr: "duplicate traffic router name \"web\"",
	165	+	},
	166	+	}
	167	+
	168	+	for _, tt := range tests {
	169	+	t.Run(tt.name, func(t *testing.T) {
	170	+	graph := TrafficGraph{
	171	+	EntryPoints: []EntryPoint{{Name: "web", Address: ":80", Protocol: EntryPointProtocolHTTP}},
	172	+	Routers: tt.routers,
	173	+	Services: []TrafficService{service},
	174	+	}
	175	+	require.ErrorContains(t, graph.Validate(), tt.wantErr)
	176	+	})
	177	+	}
	178	+	}
	179	+
	180	+	func TestTrafficGraphValidateDuplicateHTTPHosts(t *testing.T) {
	181	+	service := TrafficService{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: NetworkProtocolTCP}}}
	182	+	tests := []struct {
	183	+	name string
	184	+	entryProtocol EntryPointProtocol
	185	+	entryAddress string
	186	+	}{
	187	+	{name: "http entrypoint", entryProtocol: EntryPointProtocolHTTP, entryAddress: ":80"},
	188	+	{name: "tls mux entrypoint", entryProtocol: EntryPointProtocolTLSMux, entryAddress: ":443"},
	189	+	}
	190	+
	191	+	for _, tt := range tests {
	192	+	t.Run(tt.name, func(t *testing.T) {
	193	+	graph := TrafficGraph{
	194	+	EntryPoints: []EntryPoint{{Name: "web", Address: tt.entryAddress, Protocol: tt.entryProtocol}},
	195	+	Routers: []TrafficRouter{
	196	+	{Name: "one", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "App.Example.Com."}, Service: service.Name},
	197	+	{Name: "two", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: service.Name},
	198	+	},
	199	+	Services: []TrafficService{service},
	200	+	}
	201	+	require.ErrorContains(t, graph.Validate(), "duplicate http host \"app.example.com\" on entrypoint \"web\"")
	202	+	})
	203	+	}
	204	+	}
	205	+
	206	+	func TestTrafficGraphValidateAmbiguousL4Routers(t *testing.T) {
	207	+	tests := []struct {
	208	+	name string
	209	+	entryProtocol EntryPointProtocol
	210	+	routerProtocol RouterProtocol
	211	+	service TrafficService
	212	+	wantErr string
	213	+	}{
	214	+	{
	215	+	name: "multiple tcp routers on same entrypoint rejected",
	216	+	entryProtocol: EntryPointProtocolTCP,
	217	+	routerProtocol: RouterProtocolTCP,
	218	+	service: TrafficService{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 5432, Protocol: NetworkProtocolTCP}}},
	219	+	wantErr: "ambiguous tcp routers on entrypoint \"l4\"",
	220	+	},
	221	+	{
	222	+	name: "multiple udp routers on same entrypoint rejected",
	223	+	entryProtocol: EntryPointProtocolUDP,
	224	+	routerProtocol: RouterProtocolUDP,
	225	+	service: TrafficService{Name: "network_service:app:game", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 25565, Protocol: NetworkProtocolUDP}}},
	226	+	wantErr: "ambiguous udp routers on entrypoint \"l4\"",
	227	+	},
	228	+	}
	229	+
	230	+	for _, tt := range tests {
	231	+	t.Run(tt.name, func(t *testing.T) {
	232	+	graph := TrafficGraph{
	233	+	EntryPoints: []EntryPoint{{Name: "l4", Address: ":12345", Protocol: tt.entryProtocol}},
	234	+	Routers: []TrafficRouter{
	235	+	{Name: "one", EntryPoint: "l4", Protocol: tt.routerProtocol, Service: tt.service.Name},
	236	+	{Name: "two", EntryPoint: "l4", Protocol: tt.routerProtocol, Service: tt.service.Name},
	237	+	},
	238	+	Services: []TrafficService{tt.service},
	239	+	}
	240	+	require.ErrorContains(t, graph.Validate(), tt.wantErr)
	241	+	})
	242	+	}
	243	+	}
	244	+
	245	+	func TestTrafficGraphValidateTLSRules(t *testing.T) {
	246	+	tests := []struct {
	247	+	name string
	248	+	routers []TrafficRouter
	249	+	wantErr string
	250	+	}{
	251	+	{
	252	+	name: "duplicate exact tls sni on same entrypoint rejected",
	253	+	routers: []TrafficRouter{
	254	+	{Name: "one", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	255	+	{Name: "two", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	256	+	},
	257	+	wantErr: "duplicate exact tls sni",
	258	+	},
	259	+	{
	260	+	name: "exact sni plus wildcard deterministic allowed",
	261	+	routers: []TrafficRouter{
	262	+	{Name: "exact", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	263	+	{Name: "wild", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	264	+	},
	265	+	},
	266	+	{
	267	+	name: "ambiguous wildcard sni overlaps rejected",
	268	+	routers: []TrafficRouter{
	269	+	{Name: "wild1", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	270	+	{Name: "wild2", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	271	+	},
	272	+	wantErr: "ambiguous wildcard tls sni",
	273	+	},
	274	+	{
	275	+	name: "http host and tls passthrough sni conflict rejected",
	276	+	routers: []TrafficRouter{
	277	+	{Name: "http", EntryPoint: "tls", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: "route:app.example.com"},
	278	+	{Name: "pass", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "app.example.com"}, Service: "network_service:app:https"},
	279	+	},
	280	+	wantErr: "http host conflicts with tls passthrough sni",
	281	+	},
	282	+	{
	283	+	name: "http host conflicts with later wildcard tls passthrough sni",
	284	+	routers: []TrafficRouter{
	285	+	{Name: "http", EntryPoint: "tls", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: "route:app.example.com"},
	286	+	{Name: "pass", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	287	+	},
	288	+	wantErr: "http host conflicts with wildcard tls passthrough sni",
	289	+	},
	290	+	{
	291	+	name: "http host conflicts with earlier wildcard tls passthrough sni",
	292	+	routers: []TrafficRouter{
	293	+	{Name: "pass", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "*.example.com"}, Service: "network_service:app:https"},
	294	+	{Name: "http", EntryPoint: "tls", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: "route:app.example.com"},
	295	+	},
	296	+	wantErr: "http host conflicts with wildcard tls passthrough sni",
	297	+	},
	298	+	}
	299	+
	300	+	for _, tt := range tests {
	301	+	t.Run(tt.name, func(t *testing.T) {
	302	+	graph := TrafficGraph{
	303	+	EntryPoints: []EntryPoint{{Name: "tls", Address: ":443", Protocol: EntryPointProtocolTLSMux}},
	304	+	Routers: tt.routers,
	305	+	Services: []TrafficService{
	306	+	{Name: "network_service:app:https", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 443, Protocol: NetworkProtocolTCP}}},
	307	+	{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.3", Port: 8080, Protocol: NetworkProtocolTCP}}},
	308	+	},
	309	+	}
	310	+	err := graph.Validate()
	311	+	if tt.wantErr == "" {
	312	+	require.NoError(t, err)
	313	+	return
	314	+	}
	315	+	require.ErrorContains(t, err, tt.wantErr)
	316	+	})
	317	+	}
	318	+	}
	319	+
	320	+	func TestTrafficGraphValidateBackendsAndL4Routers(t *testing.T) {
	321	+	tests := []struct {
	322	+	name string
	323	+	router TrafficRouter
	324	+	services []TrafficService
	325	+	wantErr string
	326	+	}{
	327	+	{
	328	+	name: "backend ports outside range rejected low",
	329	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	330	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Port: 0, Protocol: NetworkProtocolTCP}}}},
	331	+	wantErr: "invalid backend port",
	332	+	},
	333	+	{
	334	+	name: "backend ports outside range rejected high",
	335	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	336	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Port: 65536, Protocol: NetworkProtocolTCP}}}},
	337	+	wantErr: "invalid backend port",
	338	+	},
	339	+	{
	340	+	name: "l4 routers reject services with more than one backend",
	341	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	342	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{
	343	+	{Name: "app", Port: 5432, Protocol: NetworkProtocolTCP},
	344	+	{Name: "app2", Port: 5432, Protocol: NetworkProtocolTCP},
	345	+	}}},
	346	+	wantErr: "l4 router service must have exactly one backend",
	347	+	},
	348	+	{
	349	+	name: "tcp router requires tcp network backend",
	350	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:db"},
	351	+	services: []TrafficService{{Name: "network_service:app:db", Backends: []TrafficBackend{{Name: "app", Port: 53, Protocol: NetworkProtocolUDP}}}},
	352	+	wantErr: "backend protocol udp does not match router protocol tcp",
	353	+	},
	354	+	{
	355	+	name: "udp router requires udp network backend",
	356	+	router: TrafficRouter{Name: "udp", EntryPoint: "udp", Protocol: RouterProtocolUDP, Service: "network_service:app:game"},
	357	+	services: []TrafficService{{Name: "network_service:app:game", Backends: []TrafficBackend{{Name: "app", Port: 53, Protocol: NetworkProtocolTCP}}}},
	358	+	wantErr: "backend protocol tcp does not match router protocol udp",
	359	+	},
	360	+	{
	361	+	name: "tls passthrough requires tcp network backend",
	362	+	router: TrafficRouter{Name: "tls", EntryPoint: "tls", Protocol: RouterProtocolTLSPassthrough, Rule: TrafficRule{SNI: "db.example.com"}, Service: "network_service:app:https"},
	363	+	services: []TrafficService{{Name: "network_service:app:https", Backends: []TrafficBackend{{Name: "app", Port: 443, Protocol: NetworkProtocolUDP}}}},
	364	+	wantErr: "backend protocol udp does not match router protocol tcp",
	365	+	},
	366	+	{
	367	+	name: "l4 router rejects route ref",
	368	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "route:app.example.com"},
	369	+	services: []TrafficService{{Name: "route:app.example.com", Backends: []TrafficBackend{{Name: "app", Port: 443, Protocol: NetworkProtocolTCP}}}},
	370	+	wantErr: "requires network_service service ref",
	371	+	},
	372	+	{
	373	+	name: "static ref parses but graph validation rejects unsupported",
	374	+	router: TrafficRouter{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "static:maintenance"},
	375	+	services: []TrafficService{{Name: "static:maintenance", Backends: []TrafficBackend{{Name: "maintenance", Port: 443, Protocol: NetworkProtocolTCP}}}},
	376	+	wantErr: "static traffic service ref \"static:maintenance\" is unsupported",
	377	+	},
	378	+	}
	379	+
	380	+	for _, tt := range tests {
	381	+	t.Run(tt.name, func(t *testing.T) {
	382	+	graph := TrafficGraph{
	383	+	EntryPoints: []EntryPoint{
	384	+	{Name: "tcp", Address: ":443", Protocol: EntryPointProtocolTCP},
	385	+	{Name: "udp", Address: ":443", Protocol: EntryPointProtocolUDP},
	386	+	{Name: "tls", Address: ":8443", Protocol: EntryPointProtocolTLSMux},
	387	+	},
	388	+	Routers: []TrafficRouter{tt.router},
	389	+	Services: tt.services,
	390	+	}
	391	+	require.ErrorContains(t, graph.Validate(), tt.wantErr)
	392	+	})
	393	+	}
	394	+	}
	395	+
	396	+	func TestTrafficGraphValidateHTTPServiceRefs(t *testing.T) {
	397	+	tests := []struct {
	398	+	name string
	399	+	service string
	400	+	wantErr string
	401	+	}{
	402	+	{name: "http allows route", service: "route:app.example.com"},
	403	+	{name: "http allows external_route", service: "external_route:api.example.com"},
	404	+	{name: "http rejects network_service", service: "network_service:app:http", wantErr: "does not support service ref kind network_service"},
	405	+	{name: "http rejects static", service: "static:maintenance", wantErr: "static traffic service ref \"static:maintenance\" is unsupported"},
	406	+	}
	407	+
	408	+	for _, tt := range tests {
	409	+	t.Run(tt.name, func(t *testing.T) {
	410	+	graph := TrafficGraph{
	411	+	EntryPoints: []EntryPoint{{Name: "web", Address: ":80", Protocol: EntryPointProtocolHTTP}},
	412	+	Routers: []TrafficRouter{{Name: "web", EntryPoint: "web", Protocol: RouterProtocolHTTP, Rule: TrafficRule{Host: "app.example.com"}, Service: tt.service}},
	413	+	Services: []TrafficService{{Name: tt.service, Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 8080, Protocol: NetworkProtocolTCP}}}},
	414	+	}
	415	+	err := graph.Validate()
	416	+	if tt.wantErr == "" {
	417	+	require.NoError(t, err)
	418	+	return
	419	+	}
	420	+	require.ErrorContains(t, err, tt.wantErr)
	421	+	})
	422	+	}
	423	+	}
	424	+
	425	+	func TestTrafficGraphValidateRouterServiceRefs(t *testing.T) {
	426	+	t.Run("router service ref is parsed", func(t *testing.T) {
	427	+	graph := TrafficGraph{
	428	+	EntryPoints: []EntryPoint{{Name: "tcp", Address: ":5432", Protocol: EntryPointProtocolTCP}},
	429	+	Routers: []TrafficRouter{{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:postgres:"}},
	430	+	Services: []TrafficService{{Name: "network_service:postgres:", Backends: []TrafficBackend{{Name: "postgres", Host: "10.0.0.4", Port: 5432, Protocol: NetworkProtocolTCP}}}},
	431	+	}
	432	+	require.ErrorContains(t, graph.Validate(), "invalid traffic service ref")
	433	+	})
	434	+
	435	+	t.Run("router service ref must exist as service name", func(t *testing.T) {
	436	+	graph := TrafficGraph{
	437	+	EntryPoints: []EntryPoint{{Name: "tcp", Address: ":5432", Protocol: EntryPointProtocolTCP}},
	438	+	Routers: []TrafficRouter{{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:postgres:db"}},
	439	+	}
	440	+	require.ErrorContains(t, graph.Validate(), "references unknown service")
	441	+	})
	442	+	}
	443	+
	444	+	func TestTrafficServiceRef(t *testing.T) {
	445	+	ref, err := ParseTrafficServiceRef("static:maintenance")
	446	+	require.NoError(t, err)
	447	+	require.Equal(t, TrafficServiceRefStatic, ref.Kind)
	448	+	require.True(t, ref.Reserved)
	449	+	require.Equal(t, "maintenance", ref.Name)
	450	+	}
	451	+
	452	+	func TestParseTrafficServiceRef(t *testing.T) {
	453	+	tests := []struct {
	454	+	input string
	455	+	want TrafficServiceRef
	456	+	}{
	457	+	{input: "route:app.example.com", want: TrafficServiceRef{Kind: TrafficServiceRefRoute, Domain: "app.example.com"}},
	458	+	{input: "external_route:api.example.com", want: TrafficServiceRef{Kind: TrafficServiceRefExternalRoute, Domain: "api.example.com"}},
	459	+	{input: "network_service:postgres:db", want: TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: "postgres", PortName: "db"}},
	460	+	{input: "network_service:web:http", want: TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: "web", PortName: "http"}},
	461	+	{input: "network_service:game:game", want: TrafficServiceRef{Kind: TrafficServiceRefNetworkService, Name: "game", PortName: "game"}},
	462	+	{input: "static:maintenance", want: TrafficServiceRef{Kind: TrafficServiceRefStatic, Name: "maintenance", Reserved: true}},
	463	+	}
	464	+
	465	+	for _, tt := range tests {
	466	+	t.Run(tt.input, func(t *testing.T) {
	467	+	got, err := ParseTrafficServiceRef(tt.input)
	468	+	require.NoError(t, err)
	469	+	require.Equal(t, tt.want, got)
	470	+	})
	471	+	}
	472	+
	473	+	invalid := []string{"", "route:", "external_route:", "network_service:", "network_service:postgres", "network_service:postgres:", "network_service::db", "network_service:postgres:db:extra", "static:", "unknown:value"}
	474	+	for _, input := range invalid {
	475	+	t.Run("invalid "+input, func(t *testing.T) {
	476	+	_, err := ParseTrafficServiceRef(input)
	477	+	require.Error(t, err)
	478	+	})
	479	+	}
	480	+	}
	481	+
	482	+	func TestTrafficDomainTypesMatchSpecFields(t *testing.T) {
	483	+	graph := TrafficGraph{
	484	+	Options: TrafficOptions{
	485	+	TCP: TCPOptions{DialTimeout: time.Second, IdleTimeout: time.Minute, DrainTimeout: 2 * time.Second, MaxConnections: 100},
	486	+	UDP: UDPOptions{IdleTimeout: time.Minute, DrainTimeout: 2 * time.Second, MaxSessions: 50},
	487	+	},
	488	+	EntryPoints: []EntryPoint{{Name: "tcp", Address: ":1234", Protocol: EntryPointProtocolTCP, TrustedCIDRs: []string{"10.0.0.0/8"}}},
	489	+	Routers: []TrafficRouter{{Name: "tcp", EntryPoint: "tcp", Protocol: RouterProtocolTCP, Service: "network_service:app:game"}},
	490	+	Services: []TrafficService{{Name: "network_service:app:game", Backends: []TrafficBackend{{Name: "app", Host: "10.0.0.2", Port: 1234, Protocol: NetworkProtocolTCP}}}},
	491	+	}
	492	+	require.NoError(t, graph.Validate())
	493	+
	494	+	status := TrafficStatus{
	495	+	LastReloadStatus: "ok",
	496	+	LastReloadError: "",
	497	+	EntryPoints: []EntryPointStatus{{Name: "tcp", ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7}},
	498	+	Routers: []TrafficRouterStatus{{Name: "tcp", ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7}},
	499	+	Services: []TrafficServiceStatus{{Name: "network_service:app:game", Backends: []TrafficBackendStatus{{Name: "app", ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7}}}},
	500	+	Counters: TrafficCounters{ActiveTCPConnections: 1, ActiveUDPSessions: 2, TotalAccepted: 3, TotalRefused: 4, TotalErrors: 5, BytesIn: 6, BytesOut: 7},
	501	+	}
	502	+	require.Equal(t, "ok", status.LastReloadStatus)
	503	+	require.Empty(t, status.LastReloadError)
	504	+	require.Equal(t, int64(7), status.EntryPoints[0].BytesOut)
	505	+	require.Equal(t, int64(7), status.Routers[0].BytesOut)
	506	+	require.Equal(t, int64(7), status.Services[0].Backends[0].BytesOut)
	507	+	require.Equal(t, int64(7), status.Counters.BytesOut)
	508	+	}