9router 0.2.71 → 0.2.73

package/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "9router-app",
-  "version": "0.2.71",
+  "version": "0.2.73",
   "description": "9Router web dashboard",
   "private": true,
   "scripts": {

package/app/src/mitm/cert/generate.js

@@ -0,0 +1,44 @@
+const path = require("path");
+const fs = require("fs");
+const os = require("os");
+
+const TARGET_HOST = "daily-cloudcode-pa.googleapis.com";
+
+/**
+ * Generate self-signed SSL certificate using selfsigned (pure JS, no openssl needed)
+ */
+async function generateCert() {
+  const certDir = path.join(os.homedir(), ".9router", "mitm");
+  const keyPath = path.join(certDir, "server.key");
+  const certPath = path.join(certDir, "server.crt");
+
+  if (fs.existsSync(keyPath) && fs.existsSync(certPath)) {
+    console.log("✅ SSL certificate already exists");
+    return { key: keyPath, cert: certPath };
+  }
+
+  if (!fs.existsSync(certDir)) {
+    fs.mkdirSync(certDir, { recursive: true });
+  }
+
+  const selfsigned = require("selfsigned");
+  const attrs = [{ name: "commonName", value: TARGET_HOST }];
+  const notAfter = new Date();
+  notAfter.setFullYear(notAfter.getFullYear() + 1);
+  const pems = await selfsigned.generate(attrs, {
+    keySize: 2048,
+    algorithm: "sha256",
+    notAfterDate: notAfter,
+    extensions: [
+      { name: "subjectAltName", altNames: [{ type: 2, value: TARGET_HOST }] }
+    ]
+  });
+
+  fs.writeFileSync(keyPath, pems.private);
+  fs.writeFileSync(certPath, pems.cert);
+
+  console.log(`✅ Generated SSL certificate for ${TARGET_HOST}`);
+  return { key: keyPath, cert: certPath };
+}
+
+module.exports = { generateCert };

package/app/src/mitm/cert/install.js

@@ -0,0 +1,136 @@
+const fs = require("fs");
+const crypto = require("crypto");
+const { exec } = require("child_process");
+const { execWithPassword } = require("../dns/dnsConfig.js");
+
+const IS_WIN = process.platform === "win32";
+
+// Get SHA1 fingerprint from cert file using Node.js crypto
+function getCertFingerprint(certPath) {
+  const pem = fs.readFileSync(certPath, "utf-8");
+  const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
+  return crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":");
+}
+
+/**
+ * Check if certificate is already installed in system store
+ */
+async function checkCertInstalled(certPath) {
+  if (IS_WIN) {
+    return checkCertInstalledWindows(certPath);
+  }
+  return checkCertInstalledMac(certPath);
+}
+
+function checkCertInstalledMac(certPath) {
+  return new Promise((resolve) => {
+    try {
+      const fingerprint = getCertFingerprint(certPath);
+      exec(`security find-certificate -a -Z /Library/Keychains/System.keychain | grep -i "${fingerprint}"`, (error) => {
+        resolve(!error);
+      });
+    } catch {
+      resolve(false);
+    }
+  });
+}
+
+function checkCertInstalledWindows(certPath) {
+  return new Promise((resolve) => {
+    // Check Root store for our cert by subject name
+    exec("certutil -store Root daily-cloudcode-pa.googleapis.com", (error) => {
+      resolve(!error);
+    });
+  });
+}
+
+/**
+ * Install SSL certificate to system trust store
+ */
+async function installCert(sudoPassword, certPath) {
+  if (!fs.existsSync(certPath)) {
+    throw new Error(`Certificate file not found: ${certPath}`);
+  }
+
+  const isInstalled = await checkCertInstalled(certPath);
+  if (isInstalled) {
+    console.log("✅ Certificate already installed");
+    return;
+  }
+
+  if (IS_WIN) {
+    await installCertWindows(certPath);
+  } else {
+    await installCertMac(sudoPassword, certPath);
+  }
+}
+
+async function installCertMac(sudoPassword, certPath) {
+  const command = `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`;
+  try {
+    await execWithPassword(command, sudoPassword);
+    console.log(`✅ Installed certificate to system keychain: ${certPath}`);
+  } catch (error) {
+    const msg = error.message?.includes("canceled") ? "User canceled authorization" : "Certificate install failed";
+    throw new Error(msg);
+  }
+}
+
+async function installCertWindows(certPath) {
+  // Use PowerShell elevated to add cert to Root store
+  const psCommand = `Start-Process certutil -ArgumentList '-addstore','Root','${certPath.replace(/'/g, "''")}' -Verb RunAs -Wait`;
+  return new Promise((resolve, reject) => {
+    exec(`powershell -Command "${psCommand}"`, (error) => {
+      if (error) {
+        reject(new Error(`Failed to install certificate: ${error.message}`));
+      } else {
+        console.log(`✅ Installed certificate to Windows Root store`);
+        resolve();
+      }
+    });
+  });
+}
+
+/**
+ * Uninstall SSL certificate from system store
+ */
+async function uninstallCert(sudoPassword, certPath) {
+  const isInstalled = await checkCertInstalled(certPath);
+  if (!isInstalled) {
+    console.log("Certificate not found in system store");
+    return;
+  }
+
+  if (IS_WIN) {
+    await uninstallCertWindows();
+  } else {
+    await uninstallCertMac(sudoPassword, certPath);
+  }
+}
+
+async function uninstallCertMac(sudoPassword, certPath) {
+  const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+  const command = `security delete-certificate -Z "${fingerprint}" /Library/Keychains/System.keychain`;
+  try {
+    await execWithPassword(command, sudoPassword);
+    console.log("✅ Uninstalled certificate from system keychain");
+  } catch (err) {
+    throw new Error("Failed to uninstall certificate");
+  }
+}
+
+async function uninstallCertWindows() {
+  const psCommand = `Start-Process certutil -ArgumentList '-delstore','Root','daily-cloudcode-pa.googleapis.com' -Verb RunAs -Wait`;
+  return new Promise((resolve, reject) => {
+    exec(`powershell -Command "${psCommand}"`, (error) => {
+      if (error) {
+        reject(new Error(`Failed to uninstall certificate: ${error.message}`));
+      } else {
+        console.log("✅ Uninstalled certificate from Windows Root store");
+        resolve();
+      }
+    });
+  });
+}
+
+module.exports = { installCert, uninstallCert, checkCertInstalled };

package/app/src/mitm/dns/dnsConfig.js

@@ -0,0 +1,130 @@
+const { exec, spawn } = require("child_process");
+const fs = require("fs");
+const path = require("path");
+
+const TARGET_HOST = "daily-cloudcode-pa.googleapis.com";
+const IS_WIN = process.platform === "win32";
+const HOSTS_FILE = IS_WIN
+  ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
+  : "/etc/hosts";
+
+/**
+ * Execute command with sudo password via stdin (macOS/Linux only)
+ */
+function execWithPassword(command, password) {
+  return new Promise((resolve, reject) => {
+    const child = spawn("sudo", ["-S", "sh", "-c", command], {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (d) => { stdout += d; });
+    child.stderr.on("data", (d) => { stderr += d; });
+
+    child.on("close", (code) => {
+      if (code === 0) resolve(stdout);
+      else reject(new Error(stderr || `Exit code ${code}`));
+    });
+
+    child.stdin.write(`${password}\n`);
+    child.stdin.end();
+  });
+}
+
+/**
+ * Execute elevated command on Windows via PowerShell RunAs
+ */
+function execElevatedWindows(command) {
+  return new Promise((resolve, reject) => {
+    const psCommand = `Start-Process cmd -ArgumentList '/c','${command.replace(/'/g, "''")}' -Verb RunAs -Wait`;
+    exec(`powershell -Command "${psCommand}"`, (error, stdout, stderr) => {
+      if (error) {
+        reject(new Error(`Elevated command failed: ${error.message}\n${stderr}`));
+      } else {
+        resolve(stdout);
+      }
+    });
+  });
+}
+
+/**
+ * Check if DNS entry already exists
+ */
+function checkDNSEntry() {
+  try {
+    const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
+    return hostsContent.includes(TARGET_HOST);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Add DNS entry to hosts file
+ */
+async function addDNSEntry(sudoPassword) {
+  if (checkDNSEntry()) {
+    console.log(`DNS entry for ${TARGET_HOST} already exists`);
+    return;
+  }
+
+  const entry = `127.0.0.1 ${TARGET_HOST}`;
+
+  try {
+    if (IS_WIN) {
+      // Windows: use elevated echo >> hosts
+      await execElevatedWindows(`echo ${entry} >> "${HOSTS_FILE}"`);
+    } else {
+      await execWithPassword(`echo "${entry}" >> ${HOSTS_FILE}`, sudoPassword);
+    }
+    // Flush DNS cache
+    if (IS_WIN) {
+      await execElevatedWindows("ipconfig /flushdns");
+    } else {
+      await execWithPassword("dscacheutil -flushcache && killall -HUP mDNSResponder", sudoPassword);
+    }
+    console.log(`✅ Added DNS entry: ${entry}`);
+  } catch (error) {
+    const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : "Failed to add DNS entry";
+    throw new Error(msg);
+  }
+}
+
+/**
+ * Remove DNS entry from hosts file
+ */
+async function removeDNSEntry(sudoPassword) {
+  if (!checkDNSEntry()) {
+    console.log(`DNS entry for ${TARGET_HOST} does not exist`);
+    return;
+  }
+
+  try {
+    if (IS_WIN) {
+      // Windows: read, filter, write back via elevated PowerShell
+      const psScript = `(Get-Content '${HOSTS_FILE}') | Where-Object { $_ -notmatch '${TARGET_HOST}' } | Set-Content '${HOSTS_FILE}'`;
+      const psCommand = `Start-Process powershell -ArgumentList '-Command','${psScript.replace(/'/g, "''")}' -Verb RunAs -Wait`;
+      await new Promise((resolve, reject) => {
+        exec(`powershell -Command "${psCommand}"`, (error) => {
+          if (error) reject(new Error(`Failed to remove DNS entry: ${error.message}`));
+          else resolve();
+        });
+      });
+    } else {
+      await execWithPassword(`sed -i '' '/${TARGET_HOST}/d' ${HOSTS_FILE}`, sudoPassword);
+    }
+    // Flush DNS cache
+    if (IS_WIN) {
+      await execElevatedWindows("ipconfig /flushdns");
+    } else {
+      await execWithPassword("dscacheutil -flushcache && killall -HUP mDNSResponder", sudoPassword);
+    }
+    console.log(`✅ Removed DNS entry for ${TARGET_HOST}`);
+  } catch (error) {
+    const msg = error.message?.includes("incorrect password") ? "Wrong sudo password" : "Failed to remove DNS entry";
+    throw new Error(msg);
+  }
+}
+
+module.exports = { addDNSEntry, removeDNSEntry, execWithPassword, checkDNSEntry };

package/app/src/mitm/manager.js

@@ -0,0 +1,227 @@
+const { spawn } = require("child_process");
+const path = require("path");
+const fs = require("fs");
+const os = require("os");
+const { addDNSEntry, removeDNSEntry } = require("./dns/dnsConfig");
+const { generateCert } = require("./cert/generate");
+const { installCert } = require("./cert/install");
+
+// Store server process
+let serverProcess = null;
+let serverPid = null;
+// Persist across Next.js hot reloads
+function getCachedPassword() { return globalThis.__mitmSudoPassword || null; }
+function setCachedPassword(pwd) { globalThis.__mitmSudoPassword = pwd; }
+
+// server.js is in same directory as this file
+const PID_FILE = path.join(os.homedir(), ".9router", "mitm", ".mitm.pid");
+
+// Check if a PID is alive
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Get MITM status
+ */
+async function getMitmStatus() {
+  // Check in-memory process first, then fallback to PID file
+  let running = serverProcess !== null && !serverProcess.killed;
+  let pid = serverPid;
+
+  if (!running) {
+    try {
+      if (fs.existsSync(PID_FILE)) {
+        const savedPid = parseInt(fs.readFileSync(PID_FILE, "utf-8").trim(), 10);
+        if (savedPid && isProcessAlive(savedPid)) {
+          running = true;
+          pid = savedPid;
+        } else {
+          // Stale PID file, clean up
+          fs.unlinkSync(PID_FILE);
+        }
+      }
+    } catch {
+      // Ignore
+    }
+  }
+
+  // Check DNS configuration
+  let dnsConfigured = false;
+  try {
+    const hostsContent = fs.readFileSync("/etc/hosts", "utf-8");
+    dnsConfigured = hostsContent.includes("daily-cloudcode-pa.googleapis.com");
+  } catch {
+    // Ignore
+  }
+
+  // Check cert
+  const certDir = path.join(os.homedir(), ".9router", "mitm");
+  const certExists = fs.existsSync(path.join(certDir, "server.crt"));
+
+  return { running, pid, dnsConfigured, certExists };
+}
+
+/**
+ * Start MITM proxy
+ * @param {string} apiKey - 9Router API key
+ * @param {string} sudoPassword - Sudo password for DNS/cert operations
+ */
+async function startMitm(apiKey, sudoPassword) {
+  // Check if already running
+  if (serverProcess && !serverProcess.killed) {
+    throw new Error("MITM proxy is already running");
+  }
+  
+  // 1. Generate SSL certificate if not exists
+  const certPath = path.join(os.homedir(), ".9router", "mitm", "server.crt");
+  if (!fs.existsSync(certPath)) {
+    console.log("Generating SSL certificate...");
+    await generateCert();
+  }
+  
+  // 2. Install certificate to system keychain
+  await installCert(sudoPassword, certPath);
+  
+  // 3. Add DNS entry
+  console.log("Adding DNS entry...");
+  await addDNSEntry(sudoPassword);
+  
+  // 4. Start MITM server
+  console.log("Starting MITM server...");
+  const serverPath = path.join(process.cwd(), "src/mitm/server.js");
+  serverProcess = spawn("node", [serverPath], {
+    env: {
+      ...process.env,
+      ROUTER_API_KEY: apiKey,
+      NODE_ENV: "production"
+    },
+    detached: false,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  
+  serverPid = serverProcess.pid;
+  
+  // Save PID to file
+  fs.writeFileSync(PID_FILE, String(serverPid));
+  
+  // Log server output
+  serverProcess.stdout.on("data", (data) => {
+    console.log(`[MITM Server] ${data.toString().trim()}`);
+  });
+  
+  serverProcess.stderr.on("data", (data) => {
+    console.error(`[MITM Server Error] ${data.toString().trim()}`);
+  });
+  
+  serverProcess.on("exit", (code) => {
+    console.log(`MITM server exited with code ${code}`);
+    serverProcess = null;
+    serverPid = null;
+    
+    // Remove PID file
+    try {
+      fs.unlinkSync(PID_FILE);
+    } catch (error) {
+      // Ignore
+    }
+  });
+  
+  // Wait and verify server actually started
+  const started = await new Promise((resolve) => {
+    let resolved = false;
+    const timeout = setTimeout(() => {
+      if (!resolved) { resolved = true; resolve(true); }
+    }, 2000);
+
+    serverProcess.on("exit", (code) => {
+      clearTimeout(timeout);
+      if (!resolved) { resolved = true; resolve(false); }
+    });
+
+    // Check stderr for error messages
+    serverProcess.stderr.on("data", (data) => {
+      const msg = data.toString().trim();
+      if (msg.includes("Port") && msg.includes("already in use")) {
+        clearTimeout(timeout);
+        if (!resolved) { resolved = true; resolve(false); }
+      }
+    });
+  });
+
+  if (!started) {
+    throw new Error("MITM server failed to start (port 443 may be in use)");
+  }
+
+  return {
+    running: true,
+    pid: serverPid
+  };
+}
+
+/**
+ * Stop MITM proxy
+ * @param {string} sudoPassword - Sudo password for DNS cleanup
+ */
+async function stopMitm(sudoPassword) {
+  // 1. Kill server process (in-memory or from PID file)
+  const proc = serverProcess;
+  if (proc && !proc.killed) {
+    console.log("Stopping MITM server...");
+    proc.kill("SIGTERM");
+    await new Promise(resolve => setTimeout(resolve, 1000));
+    if (!proc.killed) {
+      proc.kill("SIGKILL");
+    }
+    serverProcess = null;
+    serverPid = null;
+  } else {
+    // Fallback: kill by PID file
+    try {
+      if (fs.existsSync(PID_FILE)) {
+        const savedPid = parseInt(fs.readFileSync(PID_FILE, "utf-8").trim(), 10);
+        if (savedPid && isProcessAlive(savedPid)) {
+          console.log(`Killing MITM server (PID: ${savedPid})...`);
+          process.kill(savedPid, "SIGTERM");
+          await new Promise(resolve => setTimeout(resolve, 1000));
+          if (isProcessAlive(savedPid)) {
+            process.kill(savedPid, "SIGKILL");
+          }
+        }
+      }
+    } catch {
+      // Ignore
+    }
+    serverProcess = null;
+    serverPid = null;
+  }
+  
+  // 2. Remove DNS entry
+  console.log("Removing DNS entry...");
+  await removeDNSEntry(sudoPassword);
+  
+  // 3. Remove PID file
+  try {
+    fs.unlinkSync(PID_FILE);
+  } catch (error) {
+    // Ignore
+  }
+  
+  return {
+    running: false,
+    pid: null
+  };
+}
+
+module.exports = {
+  getMitmStatus,
+  startMitm,
+  stopMitm,
+  getCachedPassword,
+  setCachedPassword
+};