@blamejs/core 0.6.13 → 0.6.20

package/lib/network-proxy.js

@@ -0,0 +1,246 @@
+"use strict";
+
+var http = require("node:http");
+var https = require("node:https");
+var net = require("node:net");
+var tls = require("node:tls");
+
+var C = require("./constants");
+var validateOpts = require("./validate-opts");
+var lazyRequire = require("./lazy-require");
+var { defineClass } = require("./framework-error");
+
+var ProxyError = defineClass("ProxyError", { alwaysPermanent: false });
+
+var observability = lazyRequire(function () { return require("./observability"); });
+
+var STATE = {
+  http:    null,
+  https:   null,
+  noProxy: [],
+  auth:    null,
+  agentCache: new Map(),
+};
+
+function _parseAuth(spec) {
+  if (!spec) return null;
+  var idx = spec.indexOf(":");
+  if (idx === -1) return null;
+  return { user: spec.slice(0, idx), pass: spec.slice(idx + 1) };
+}
+
+function _parseProxyUrl(value) {
+  if (!value) return null;
+  var u;
+  try { u = new URL(value); } catch (_e) {
+    throw new ProxyError("proxy/bad-url", "invalid proxy URL: " + value);
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    throw new ProxyError("proxy/bad-protocol", "proxy URL must be http:// or https://, got " + u.protocol);
+  }
+  return u;
+}
+
+function _parseNoProxy(spec) {
+  if (!spec) return [];
+  return String(spec).split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+}
+
+function set(opts) {
+  opts = opts || {};
+  validateOpts(opts, ["http", "https", "no", "auth"], "proxy.set");
+  if (opts.http !== undefined)  STATE.http  = opts.http  ? _parseProxyUrl(opts.http)  : null;
+  if (opts.https !== undefined) STATE.https = opts.https ? _parseProxyUrl(opts.https) : null;
+  if (opts.no !== undefined)    STATE.noProxy = _parseNoProxy(opts.no);
+  if (opts.auth !== undefined)  STATE.auth = opts.auth ? _parseAuth(opts.auth) : null;
+  STATE.agentCache.clear();
+  _emitObs("network.proxy.set", {
+    httpSet:  !!STATE.http,
+    httpsSet: !!STATE.https,
+    noProxyCount: STATE.noProxy.length,
+  });
+}
+
+function fromEnv(envObj) {
+  var env = envObj || process.env;
+  var httpProxy  = env.HTTP_PROXY  || env.http_proxy;
+  var httpsProxy = env.HTTPS_PROXY || env.https_proxy;
+  var noProxy    = env.NO_PROXY    || env.no_proxy;
+  var allProxy   = env.ALL_PROXY   || env.all_proxy;
+  var authEnv    = env.BLAMEJS_PROXY_AUTH;
+  var changed = false;
+  if (httpProxy)  { STATE.http  = _parseProxyUrl(httpProxy);  changed = true; }
+  else if (allProxy) { STATE.http = _parseProxyUrl(allProxy); changed = true; }
+  if (httpsProxy) { STATE.https = _parseProxyUrl(httpsProxy); changed = true; }
+  else if (allProxy) { STATE.https = _parseProxyUrl(allProxy); changed = true; }
+  if (noProxy)    { STATE.noProxy = _parseNoProxy(noProxy);   changed = true; }
+  if (authEnv)    { STATE.auth = _parseAuth(authEnv);         changed = true; }
+  if (changed) {
+    STATE.agentCache.clear();
+    _emitObs("network.proxy.from_env", {
+      httpSet:  !!STATE.http,
+      httpsSet: !!STATE.https,
+      noProxyCount: STATE.noProxy.length,
+    });
+  }
+  return changed;
+}
+
+function _ipv4ToInt(ip) {
+  var p = ip.split(".");
+  return ((p[0] | 0) << 24 >>> 0) + ((p[1] | 0) << 16) + ((p[2] | 0) << 8) + (p[3] | 0);
+}
+
+function _matchCidr(cidr, host) {
+  var slash = cidr.indexOf("/");
+  if (slash === -1) return false;
+  var network = cidr.slice(0, slash);
+  var prefix = parseInt(cidr.slice(slash + 1), 10);
+  if (net.isIP(host) !== 4 || net.isIP(network) !== 4) return false;
+  if (!isFinite(prefix) || prefix < 0 || prefix > 32) return false;
+  if (prefix === 0) return true;
+  var mask = (0xffffffff << (32 - prefix)) >>> 0;
+  return (_ipv4ToInt(host) & mask) === (_ipv4ToInt(network) & mask);
+}
+
+function shouldProxy(targetUrl) {
+  var u = targetUrl instanceof URL ? targetUrl : new URL(String(targetUrl));
+  var host = u.hostname;
+  var rules = STATE.noProxy;
+  for (var i = 0; i < rules.length; i++) {
+    var r = rules[i];
+    if (r === "*") return false;
+    if (r.indexOf("/") !== -1 && _matchCidr(r, host)) return false;
+    var bare = r.charAt(0) === "." ? r.slice(1) : r;
+    if (host === bare) return false;
+    if (host.length > bare.length && host.slice(host.length - bare.length - 1) === "." + bare) return false;
+  }
+  if (u.protocol === "https:") return !!STATE.https;
+  if (u.protocol === "http:")  return !!STATE.http;
+  return false;
+}
+
+function _proxyForUrl(targetUrl) {
+  var u = targetUrl instanceof URL ? targetUrl : new URL(String(targetUrl));
+  if (!shouldProxy(u)) return null;
+  return u.protocol === "https:" ? STATE.https : STATE.http;
+}
+
+function _proxyAuthHeader(proxyUrl) {
+  var user = proxyUrl.username || (STATE.auth && STATE.auth.user) || "";
+  var pass = proxyUrl.password || (STATE.auth && STATE.auth.pass) || "";
+  if (!user && !pass) return null;
+  return "Basic " + Buffer.from(decodeURIComponent(user) + ":" + decodeURIComponent(pass), "utf8").toString("base64");
+}
+
+function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
+  var proxyPort = proxyUrl.port || (proxyUrl.protocol === "https:" ? 443 : 80);
+  var proxySocket = proxyUrl.protocol === "https:"
+    ? tls.connect({
+        host:       proxyUrl.hostname,
+        port:       proxyPort,
+        servername: proxyUrl.hostname,
+        minVersion: "TLSv1.3",
+        ecdhCurve:  C.TLS_GROUP_CURVE_STR,
+      })
+    : net.connect({ host: proxyUrl.hostname, port: proxyPort });
+  var settled = false;
+  function done(err, sock) { if (settled) return; settled = true; callback(err, sock); }
+  proxySocket.on("error", function (e) { done(e); });
+  proxySocket.on(proxyUrl.protocol === "https:" ? "secureConnect" : "connect", function () {
+    var lines = [
+      "CONNECT " + targetHost + ":" + targetPort + " HTTP/1.1",
+      "Host: " + targetHost + ":" + targetPort,
+    ];
+    var auth = _proxyAuthHeader(proxyUrl);
+    if (auth) lines.push("Proxy-Authorization: " + auth);
+    lines.push("", "");
+    proxySocket.write(lines.join("\r\n"));
+    var buf = Buffer.alloc(0);
+    function onData(chunk) {
+      buf = Buffer.concat([buf, chunk]);
+      var idx = buf.indexOf("\r\n\r\n");
+      if (idx === -1) return;
+      proxySocket.removeListener("data", onData);
+      var head = buf.slice(0, idx).toString("ascii");
+      var status = head.split("\r\n")[0] || "";
+      var match = /HTTP\/1\.[01] (\d{3})/.exec(status);
+      if (!match || parseInt(match[1], 10) !== 200) {
+        done(new ProxyError("proxy/connect-failed", "proxy CONNECT to " + targetHost + ":" + targetPort + " failed: " + status));
+        try { proxySocket.destroy(); } catch (_e) {}
+        return;
+      }
+      done(null, proxySocket);
+    }
+    proxySocket.on("data", onData);
+  });
+}
+
+function agentFor(targetUrl) {
+  var proxy = _proxyForUrl(targetUrl);
+  if (!proxy) return null;
+  var u = targetUrl instanceof URL ? targetUrl : new URL(String(targetUrl));
+  var key = proxy.toString() + "|" + u.protocol;
+  if (STATE.agentCache.has(key)) return STATE.agentCache.get(key);
+
+  var agent;
+  if (u.protocol === "https:") {
+    agent = new https.Agent({
+      keepAlive:  true,
+      minVersion: "TLSv1.3",
+      ecdhCurve:  C.TLS_GROUP_CURVE_STR,
+    });
+    agent.createConnection = function (options, cb) {
+      _connectThroughTunnel(proxy, options.host, options.port, function (err, tunnel) {
+        if (err) return cb(err);
+        var secure = tls.connect({
+          socket:     tunnel,
+          servername: options.servername || options.host,
+          minVersion: "TLSv1.3",
+          ecdhCurve:  C.TLS_GROUP_CURVE_STR,
+          ALPNProtocols: options.ALPNProtocols,
+        }, function () { cb(null, secure); });
+        secure.on("error", function (e) { cb(e); });
+      });
+    };
+  } else {
+    agent = new http.Agent({ keepAlive: true });
+    agent.createConnection = function (options, cb) {
+      _connectThroughTunnel(proxy, options.host, options.port, function (err, tunnel) {
+        if (err) return cb(err);
+        cb(null, tunnel);
+      });
+    };
+  }
+  STATE.agentCache.set(key, agent);
+  _emitObs("network.proxy.agent.created", { protocol: u.protocol });
+  return agent;
+}
+
+function snapshot() {
+  return {
+    http:    STATE.http  ? STATE.http.toString()  : null,
+    https:   STATE.https ? STATE.https.toString() : null,
+    noProxy: STATE.noProxy.slice(),
+    authSet: !!STATE.auth,
+  };
+}
+
+function _emitObs(name, fields) {
+  try { observability().emit(name, fields || {}); } catch (_e) {}
+}
+
+function _resetForTest() {
+  STATE.http = null; STATE.https = null; STATE.noProxy = []; STATE.auth = null;
+  STATE.agentCache.clear();
+}
+
+module.exports = {
+  set:           set,
+  fromEnv:       fromEnv,
+  shouldProxy:   shouldProxy,
+  agentFor:      agentFor,
+  snapshot:      snapshot,
+  ProxyError:    ProxyError,
+  _resetForTest: _resetForTest,
+};

package/lib/network-tls.js

@@ -0,0 +1,326 @@
+"use strict";
+
+var tls = require("node:tls");
+var fs = require("node:fs");
+var path = require("node:path");
+var nodeCrypto = require("node:crypto");
+
+var validateOpts = require("./validate-opts");
+var lazyRequire = require("./lazy-require");
+var { defineClass } = require("./framework-error");
+
+var TlsTrustError = defineClass("TlsTrustError", { alwaysPermanent: true });
+
+var observability = lazyRequire(function () { return require("./observability"); });
+var audit = lazyRequire(function () { return require("./audit"); });
+
+var STATE = {
+  cas:             [],
+  systemTrust:     false,
+  baselineFingerprints: null,
+};
+
+function _normalizePem(pem) {
+  if (Buffer.isBuffer(pem)) pem = pem.toString("utf8");
+  if (typeof pem !== "string") {
+    throw new TlsTrustError("tls/bad-ca", "CA must be a PEM string or path, got " + typeof pem);
+  }
+  return pem.replace(/\r\n/g, "\n").trim();
+}
+
+function _splitPemBundle(pem) {
+  var blocks = [];
+  var lines = pem.split("\n");
+  var current = null;
+  for (var i = 0; i < lines.length; i++) {
+    var line = lines[i];
+    if (line.indexOf("-----BEGIN CERTIFICATE-----") === 0) {
+      current = [line];
+    } else if (current) {
+      current.push(line);
+      if (line.indexOf("-----END CERTIFICATE-----") === 0) {
+        blocks.push(current.join("\n"));
+        current = null;
+      }
+    }
+  }
+  return blocks;
+}
+
+function _certMetadata(pem) {
+  try {
+    var x = new nodeCrypto.X509Certificate(pem);
+    return {
+      subject:     x.subject,
+      issuer:      x.issuer,
+      validFrom:   x.validFrom,
+      validTo:     x.validTo,
+      fingerprint256: x.fingerprint256,
+      serialNumber: x.serialNumber,
+      isSelfSigned: x.subject === x.issuer,
+    };
+  } catch (e) {
+    throw new TlsTrustError("tls/bad-ca-pem", "CA PEM not parseable: " + e.message);
+  }
+}
+
+function _isPathLike(s) {
+  if (s.indexOf("-----BEGIN") !== -1) return false;
+  if (s.length > 1024) return false;
+  if (/[\r\n]/.test(s)) return false;
+  return true;
+}
+
+function _readPath(p) {
+  var stat = fs.statSync(p);
+  if (stat.isDirectory()) {
+    var files = fs.readdirSync(p)
+      .filter(function (f) { return /\.(pem|crt|cer)$/i.test(f); })
+      .sort();
+    return files.map(function (f) { return fs.readFileSync(path.join(p, f), "utf8"); }).join("\n");
+  }
+  return fs.readFileSync(p, "utf8");
+}
+
+function addCa(pemOrPath, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["label", "audit"], "tls.addCa");
+  var raw = pemOrPath;
+  if (typeof pemOrPath === "string" && _isPathLike(pemOrPath)) {
+    var stat;
+    try { stat = fs.statSync(pemOrPath); } catch (_e) {
+      throw new TlsTrustError("tls/empty-pem", "tls.addCa: input has no PEM marker and is not a readable path: " +
+        pemOrPath);
+    }
+    raw = _readPath(pemOrPath);
+    if (!stat) raw = "";
+  }
+  raw = _normalizePem(raw);
+  var blocks = _splitPemBundle(raw);
+  if (blocks.length === 0) {
+    throw new TlsTrustError("tls/empty-pem", "no CERTIFICATE blocks found in PEM input");
+  }
+  var added = [];
+  for (var i = 0; i < blocks.length; i++) {
+    var meta = _certMetadata(blocks[i]);
+    STATE.cas.push({ pem: blocks[i], meta: meta, label: opts.label || null, addedAt: Date.now() });
+    added.push(meta);
+  }
+  _emitAuditAdd(added, opts);
+  _emitObs("network.tls.ca.added", { count: added.length });
+  return added;
+}
+
+function addCaBundle(p, opts) {
+  return addCa(p, opts);
+}
+
+function useSystemTrust(enable) {
+  STATE.systemTrust = enable !== false;
+  _emitObs("network.tls.system_trust.set", { enabled: STATE.systemTrust });
+}
+
+function isSystemTrustEnabled() { return !!STATE.systemTrust; }
+
+function getTrustStore() {
+  return STATE.cas.map(function (entry) {
+    return {
+      label:        entry.label,
+      addedAt:      entry.addedAt,
+      subject:      entry.meta.subject,
+      issuer:       entry.meta.issuer,
+      validFrom:    entry.meta.validFrom,
+      validTo:      entry.meta.validTo,
+      fingerprint256: entry.meta.fingerprint256,
+      serialNumber: entry.meta.serialNumber,
+      isSelfSigned: entry.meta.isSelfSigned,
+    };
+  });
+}
+
+function _emitAuditRemove(metaList, reason) {
+  var sink;
+  try { sink = audit(); } catch (_e) { sink = null; }
+  if (!sink || typeof sink.safeEmit !== "function") return;
+  for (var i = 0; i < metaList.length; i++) {
+    var m = metaList[i];
+    try {
+      sink.safeEmit({
+        action:   "network.tls.ca.removed",
+        outcome:  "success",
+        metadata: {
+          subject:        m.subject,
+          issuer:         m.issuer,
+          fingerprint256: m.fingerprint256,
+          validFrom:      m.validFrom,
+          validTo:        m.validTo,
+          isSelfSigned:   m.isSelfSigned,
+          label:          m.label,
+          reason:         reason || "operator",
+        },
+      });
+    } catch (_e) {}
+  }
+}
+
+function removeCa(fingerprint256, opts) {
+  if (typeof fingerprint256 !== "string" || fingerprint256.length === 0) {
+    throw new TlsTrustError("tls/bad-fingerprint", "tls.removeCa: fingerprint256 must be a non-empty string");
+  }
+  var fp = fingerprint256.toUpperCase();
+  var removed = [];
+  STATE.cas = STATE.cas.filter(function (entry) {
+    var entryFp = (entry.meta.fingerprint256 || "").toUpperCase();
+    if (entryFp === fp) {
+      removed.push(Object.assign({ label: entry.label }, entry.meta));
+      return false;
+    }
+    return true;
+  });
+  if (removed.length === 0) return 0;
+  if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove");
+  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "operator" });
+  return removed.length;
+}
+
+function removeCaByLabel(label, opts) {
+  if (typeof label !== "string" || label.length === 0) {
+    throw new TlsTrustError("tls/bad-label", "tls.removeCaByLabel: label must be a non-empty string");
+  }
+  var removed = [];
+  STATE.cas = STATE.cas.filter(function (entry) {
+    if (entry.label === label) {
+      removed.push(Object.assign({ label: entry.label }, entry.meta));
+      return false;
+    }
+    return true;
+  });
+  if (removed.length === 0) return 0;
+  if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-remove-by-label");
+  _emitObs("network.tls.ca.removed", { count: removed.length, reason: "label" });
+  return removed.length;
+}
+
+function clearAll(opts) {
+  if (STATE.cas.length === 0) return 0;
+  var removed = STATE.cas.map(function (e) { return Object.assign({ label: e.label }, e.meta); });
+  STATE.cas = [];
+  if (!opts || opts.audit !== false) _emitAuditRemove(removed, "operator-clear-all");
+  _emitObs("network.tls.ca.cleared", { count: removed.length });
+  return removed.length;
+}
+
+function purgeExpired(opts) {
+  var nowMs = Date.now();
+  var removed = [];
+  STATE.cas = STATE.cas.filter(function (entry) {
+    var validToMs = entry.meta.validTo ? Date.parse(entry.meta.validTo) : NaN;
+    if (isFinite(validToMs) && validToMs < nowMs) {
+      removed.push(Object.assign({ label: entry.label }, entry.meta));
+      return false;
+    }
+    return true;
+  });
+  if (removed.length === 0) return 0;
+  if (!opts || opts.audit !== false) _emitAuditRemove(removed, "expired");
+  _emitObs("network.tls.ca.purged_expired", { count: removed.length });
+  return removed.length;
+}
+
+function expiringSoon(windowMs) {
+  if (typeof windowMs !== "number" || !isFinite(windowMs) || windowMs < 0) {
+    throw new TlsTrustError("tls/bad-window", "tls.expiringSoon: windowMs must be a non-negative finite number");
+  }
+  var threshold = Date.now() + windowMs;
+  return STATE.cas.filter(function (entry) {
+    var validToMs = entry.meta.validTo ? Date.parse(entry.meta.validTo) : NaN;
+    return isFinite(validToMs) && validToMs <= threshold;
+  }).map(function (entry) {
+    return Object.assign({ label: entry.label }, entry.meta);
+  });
+}
+
+function captureBaselineFingerprints() {
+  STATE.baselineFingerprints = STATE.cas.map(function (e) { return e.meta.fingerprint256; });
+}
+
+function detectBaselineDrift() {
+  if (!STATE.baselineFingerprints) return null;
+  var current = STATE.cas.map(function (e) { return e.meta.fingerprint256; });
+  var added = current.filter(function (fp) { return STATE.baselineFingerprints.indexOf(fp) === -1; });
+  var removed = STATE.baselineFingerprints.filter(function (fp) { return current.indexOf(fp) === -1; });
+  return { added: added, removed: removed, drifted: added.length > 0 || removed.length > 0 };
+}
+
+function applyToContext(opts) {
+  opts = opts || {};
+  validateOpts(opts, ["base"], "tls.applyToContext");
+  var base = Object.assign({}, opts.base || {});
+  var caStrings = STATE.cas.map(function (e) { return e.pem; });
+  if (STATE.systemTrust) {
+    var rootCAs = tls.rootCertificates;
+    if (Array.isArray(rootCAs)) {
+      caStrings = caStrings.concat(rootCAs);
+    }
+  }
+  if (caStrings.length > 0) base.ca = caStrings;
+  return base;
+}
+
+function getCaPems() {
+  return STATE.cas.map(function (e) { return e.pem; });
+}
+
+function _emitAuditAdd(metaList, opts) {
+  if (opts.audit === false) return;
+  var sink;
+  try { sink = audit(); } catch (_e) { sink = null; }
+  if (!sink || typeof sink.safeEmit !== "function") return;
+  for (var i = 0; i < metaList.length; i++) {
+    var m = metaList[i];
+    try {
+      sink.safeEmit({
+        action:   "network.tls.ca.added",
+        outcome:  "success",
+        metadata: {
+          subject:        m.subject,
+          issuer:         m.issuer,
+          fingerprint256: m.fingerprint256,
+          validFrom:      m.validFrom,
+          validTo:        m.validTo,
+          isSelfSigned:   m.isSelfSigned,
+          label:          opts.label || null,
+        },
+      });
+    } catch (_e) {}
+  }
+}
+
+function _emitObs(name, fields) {
+  try { observability().emit(name, fields || {}); } catch (_e) {}
+}
+
+function _resetForTest() {
+  STATE.cas = [];
+  STATE.systemTrust = false;
+  STATE.baselineFingerprints = null;
+}
+
+module.exports = {
+  addCa:               addCa,
+  addCaBundle:         addCaBundle,
+  removeCa:            removeCa,
+  removeCaByLabel:     removeCaByLabel,
+  clearAll:            clearAll,
+  purgeExpired:        purgeExpired,
+  expiringSoon:        expiringSoon,
+  useSystemTrust:      useSystemTrust,
+  isSystemTrustEnabled: isSystemTrustEnabled,
+  getTrustStore:       getTrustStore,
+  captureBaselineFingerprints: captureBaselineFingerprints,
+  detectBaselineDrift: detectBaselineDrift,
+  applyToContext:      applyToContext,
+  getCaPems:           getCaPems,
+  TlsTrustError:       TlsTrustError,
+  _resetForTest:       _resetForTest,
+};