@camstack/system 1.2.428 → 1.2.430

package/dist/{tls-BgImdxCO.js → tls-C5IYg3V5.js}

@@ -459,6 +459,35 @@ async function issueLeaf(ca, identity, commonName, validDays, now) {
 		keyPem: await exportKeyPem(keys.privateKey)
 	};
 }
+/**
+* A server leaf for a key pair the CALLER holds (D856): an agent sends a CSR, the
+* hub signs its public key under the local root. Same extensions as
+* {@link issueLeaf} - `CA:FALSE`, serverAuth only - so a device that trusts the
+* hub root trusts the agent. The private key never exists on the hub.
+*/
+async function issueLeafFromCsr(ca, csrPem, identity, commonName, validDays, now) {
+	const csr = new require_x509_es.Pkcs10CertificateRequest(csrPem);
+	if (!await csr.verify(node_crypto.webcrypto)) throw new Error("CSR signature is invalid");
+	const extensions = [
+		new require_x509_es.BasicConstraintsExtension(false, void 0, true),
+		new require_x509_es.KeyUsagesExtension(require_x509_es.KeyUsageFlags.digitalSignature | require_x509_es.KeyUsageFlags.keyEncipherment, true),
+		new require_x509_es.ExtendedKeyUsageExtension([SERVER_AUTH_OID]),
+		await require_x509_es.SubjectKeyIdentifierExtension.create(csr.publicKey),
+		await require_x509_es.AuthorityKeyIdentifierExtension.create(ca.cert),
+		new require_x509_es.SubjectAlternativeNameExtension(subjectAltNames(identity))
+	];
+	return toCertPem(await require_x509_es.X509CertificateGenerator.create({
+		serialNumber: freshSerial(),
+		subject: `CN=${commonName}`,
+		issuer: ca.cert.subject,
+		notBefore: now,
+		notAfter: new Date(now.getTime() + validDays * MS_PER_DAY),
+		publicKey: csr.publicKey,
+		signingKey: ca.privateKey,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		extensions
+	}));
+}
 //#endregion
 //#region src/tls/cert-manager.ts
 var DEFAULT_COMMON_NAME = "camstack.local";
@@ -941,6 +970,293 @@ function applyCertificateToListener(dataDir) {
 	return reloadHttpsListener(loadTlsCert(certPath, keyPath));
 }
 //#endregion
+//#region src/tls/agent-https.ts
+/**
+* HTTPS for agents (D856): a leaf from the hub's LOCAL CA, so a device that
+* trusts the hub root trusts the agents too.
+*
+* The agent generates its key and a CSR; the hub signs only the PUBLIC key under
+* the local CA and returns the certificate - no private key ever crosses the mesh.
+* The agent keeps ONE file, `tls/agent-https.json` (0600: key + leaf + the pinned CA),
+* written atomically (temp file + rename) so a crash can never leave a key that does
+* not match its certificate. It persists no database.
+*
+* What the hub is willing to certify (the smaller safe option). The local CA is trusted
+* by every device that trusts the hub, so a compromised agent must not obtain a name it
+* does not own. The hub signs ONLY what it knows by itself:
+*   - the agent's node id (unique in the cluster), when it is a local-only name;
+*   - the remote address of the agent's LIVE mesh socket as the hub sees it, when it is
+*     a private address - never an address the agent reports.
+* Anything the agent reports (host names, interface addresses) is DROPPED and logged:
+* extra self-reported names would need an explicit operator approval flow, which does
+* not exist, so they are not certified. A name the hub's own certificate holds, or one
+* already certified to another node, is never signed (a NAT'd pair of agents would
+* otherwise share an address).
+*/
+require_x509_es.cryptoProvider.set(node_crypto.webcrypto);
+function agentHttpsPaths(dataDir) {
+	const dir = (0, node_path.join)(dataDir, "tls");
+	return {
+		dir,
+		bundlePath: (0, node_path.join)(dir, "agent-https.json"),
+		certPath: (0, node_path.join)(dir, "agent.crt"),
+		pendingKeyPath: (0, node_path.join)(dir, "agent.key.pending")
+	};
+}
+/**
+* The material on disk, or `null` while no hub-issued leaf is installed. A bundle that
+* cannot be parsed is reported through `onCorrupt` and treated as absent: a bad file must
+* never take the agent API down.
+*/
+function loadAgentHttps(dataDir, onCorrupt) {
+	const { bundlePath } = agentHttpsPaths(dataDir);
+	if (!(0, node_fs.existsSync)(bundlePath)) return null;
+	try {
+		const parsed = JSON.parse((0, node_fs.readFileSync)(bundlePath, "utf8"));
+		const field = (name) => {
+			const v = parsed !== null && typeof parsed === "object" ? Reflect.get(parsed, name) : null;
+			return typeof v === "string" && v.length > 0 ? v : null;
+		};
+		const keyPem = field("keyPem");
+		const certPem = field("certPem");
+		const caCertPem = field("caCertPem");
+		if (keyPem === null || certPem === null || caCertPem === null) {
+			onCorrupt?.("the bundle is missing a field");
+			return null;
+		}
+		if (!new node_crypto.X509Certificate(certPem).checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) {
+			onCorrupt?.("the certificate does not match the key");
+			return null;
+		}
+		return {
+			keyPem,
+			certPem,
+			caCertPem
+		};
+	} catch (error) {
+		onCorrupt?.(error instanceof Error ? error.message : String(error));
+		return null;
+	}
+}
+function collectAgentNames(nodeId, hostFacts) {
+	const identity = collectCertIdentity({
+		commonName: nodeId,
+		extraSans: [],
+		hostFacts
+	});
+	return {
+		hostnames: identity.dnsNames,
+		addresses: identity.ipAddresses
+	};
+}
+/** SHA-256 of the hub local CA this agent pinned, or `null` while none is. */
+function pinnedHttpsCaFingerprint(dataDir) {
+	const material = loadAgentHttps(dataDir);
+	return material === null ? null : new node_crypto.X509Certificate(material.caCertPem).fingerprint256;
+}
+/**
+* A fresh key pair (EC P-256, kept in `agent.key.pending`, 0600) and its CSR. The
+* key becomes `agent.key` only when the matching certificate is installed, so a
+* request that is never answered changes nothing that is being served.
+*/
+async function createAgentHttpsRequest(dataDir, nodeId, names) {
+	const paths = agentHttpsPaths(dataDir);
+	(0, node_fs.mkdirSync)(paths.dir, { recursive: true });
+	const keys = await node_crypto.webcrypto.subtle.generateKey({
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, true, ["sign", "verify"]);
+	const csr = await require_x509_es.Pkcs10CertificateRequestGenerator.create({
+		name: `CN=${nodeId}`,
+		keys,
+		signingAlgorithm: {
+			name: "ECDSA",
+			hash: "SHA-256"
+		}
+	});
+	const pkcs8 = await node_crypto.webcrypto.subtle.exportKey("pkcs8", keys.privateKey);
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(paths.pendingKeyPath, `${require_x509_es.PemConverter.encode(pkcs8, "PRIVATE KEY")}\n`);
+	return {
+		csrPem: `${csr.toString("pem")}\n`,
+		...names
+	};
+}
+var AgentHttpsInstallError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AgentHttpsInstallError";
+	}
+};
+/**
+* Install the hub-signed leaf for the pending key. Refused when it is not for that key, when
+* it is not signed by the CA it came with, or - once a CA is pinned - when that CA is not the
+* one this agent already pinned (the CA that arrives with a later leaf is never trusted on its
+* own say: the first one came over the authenticated mesh, every later leaf must chain to it).
+* Key, leaf and CA are written as ONE file, atomically.
+*/
+function installAgentHttps(dataDir, input) {
+	const paths = agentHttpsPaths(dataDir);
+	if (!(0, node_fs.existsSync)(paths.pendingKeyPath)) throw new AgentHttpsInstallError("no pending key: prepareHttpsCertificate was not called");
+	const keyPem = (0, node_fs.readFileSync)(paths.pendingKeyPath, "utf8");
+	let leaf;
+	let ca;
+	try {
+		leaf = new node_crypto.X509Certificate(input.certPem);
+		ca = new node_crypto.X509Certificate(input.caCertPem);
+	} catch {
+		throw new AgentHttpsInstallError("the certificate or the CA is not a valid PEM certificate");
+	}
+	if (!leaf.checkPrivateKey((0, node_crypto.createPrivateKey)(keyPem))) throw new AgentHttpsInstallError("the certificate is not for this node's pending key");
+	const pinned = loadAgentHttps(dataDir);
+	if (pinned !== null && input.caRotation !== true) {
+		const pinnedCa = new node_crypto.X509Certificate(pinned.caCertPem);
+		if (pinnedCa.fingerprint256 !== ca.fingerprint256 || !leaf.verify(pinnedCa.publicKey)) throw new AgentHttpsInstallError("the leaf does not chain to the hub local CA this agent pinned at its first install (if the hub rotated its local CA, renew HTTPS from the hub - it signals the rotation)");
+	}
+	if (!leaf.verify(ca.publicKey)) throw new AgentHttpsInstallError("the certificate is not signed by the CA that came with it");
+	if (new Date(leaf.validTo).getTime() <= Date.now()) throw new AgentHttpsInstallError("the certificate is already expired");
+	(0, node_fs.mkdirSync)(paths.dir, { recursive: true });
+	const tmp = `${paths.bundlePath}.tmp`;
+	(0, _camstack_types_node.writeOwnerOnlyFileSync)(tmp, JSON.stringify({
+		keyPem,
+		certPem: input.certPem,
+		caCertPem: input.caCertPem
+	}));
+	(0, node_fs.renameSync)(tmp, paths.bundlePath);
+	(0, node_fs.chmodSync)(paths.bundlePath, 384);
+	writeFileAtomic(paths.certPath, input.certPem.endsWith("\n") ? input.certPem : `${input.certPem}\n`);
+	return {
+		keyPem,
+		certPem: input.certPem,
+		caCertPem: input.caCertPem
+	};
+}
+function writeFileAtomic(path, content) {
+	const tmp = `${path}.tmp`;
+	(0, node_fs.writeFileSync)(tmp, content);
+	(0, node_fs.renameSync)(tmp, path);
+}
+/** Fingerprint, issuer, SANs and validity of a served leaf. */
+function describeHttpsLeaf(certPem) {
+	const x509 = new node_crypto.X509Certificate(certPem);
+	return {
+		fingerprintSha256: x509.fingerprint256,
+		issuer: x509.issuer.replaceAll("\n", ", "),
+		sans: (x509.subjectAltName ?? "").split(",").map((s) => s.trim()).filter((s) => s.length > 0),
+		notBefore: Date.parse(x509.validFrom),
+		notAfter: Date.parse(x509.validTo)
+	};
+}
+var LOCAL_SUFFIXES = [
+	".local",
+	".lan",
+	".home.arpa",
+	".internal",
+	".localdomain"
+];
+var LABEL_RE = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i;
+/** Private-network IPv4/IPv6: RFC 1918, CGNAT (Tailscale), link-local, ULA. */
+function isPrivateAddress(address) {
+	const family = (0, node_net.isIP)(address);
+	if (family === 4) {
+		const [a, b] = address.split(".").map(Number);
+		return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254;
+	}
+	if (family === 6) {
+		const lower = address.toLowerCase();
+		return lower.startsWith("fc") || lower.startsWith("fd") || lower.startsWith("fe80:");
+	}
+	return false;
+}
+/** The default docker bridge network (172.17.0.0/16): identical on every host, so it names nothing. */
+function isContainerBridgeAddress(address) {
+	return /^172\.17\.\d{1,3}\.\d{1,3}$/.test(address);
+}
+/** A name that cannot collide with public DNS. */
+function isLocalOnlyHostname(name) {
+	const lower = name.toLowerCase();
+	if (lower.length === 0 || lower.length > 253) return false;
+	if (!lower.includes(".")) return LABEL_RE.test(lower);
+	if (!LOCAL_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return false;
+	return lower.split(".").every((label) => LABEL_RE.test(label));
+}
+/**
+* The names the hub will sign for `nodeId`: its node id and the address of its live mesh
+* socket - nothing the agent says about itself. `excluded` holds every name already taken
+* (the hub's own certificate, other nodes' leaves); `reported` is what the agent claimed,
+* listed only so it can be logged as dropped.
+*/
+function acceptAgentSans(input) {
+	const excluded = input.excluded ?? /* @__PURE__ */ new Set();
+	const taken = (name) => excluded.has(name.toLowerCase());
+	const rejected = (input.reported ?? []).map((n) => `${n} (self-reported, not certified)`);
+	const dns = [];
+	const ips = [];
+	const id = input.nodeId.toLowerCase();
+	if (id !== "hub" && isLocalOnlyHostname(id) && !taken(id)) dns.push(id);
+	else rejected.push(`${input.nodeId} (node id: not a usable name)`);
+	const address = input.observedAddress?.replace(/^::ffff:/, "");
+	if (address !== void 0) if (address.includes("%")) rejected.push(`${address} (observed address: zone-scoped, only the node id is certified)`);
+	else if (isContainerBridgeAddress(address)) rejected.push(`${address} (observed address: a container bridge address, only the node id is certified)`);
+	else if ((0, node_net.isIP)(address) !== 0 && isPrivateAddress(address) && !taken(address)) ips.push(address);
+	else rejected.push(`${address} (observed address: not private or already certified)`);
+	return {
+		identity: {
+			dnsNames: dns,
+			ipAddresses: ips,
+			requiredDnsNames: dns,
+			requiredIpAddresses: ips
+		},
+		accepted: [...dns, ...ips],
+		rejected
+	};
+}
+/** The SAN values (lower-cased) of a certificate PEM: DNS names and IP addresses. */
+function certificateNames(certPem) {
+	const names = /* @__PURE__ */ new Set();
+	const san = new node_crypto.X509Certificate(certPem).subjectAltName ?? "";
+	for (const part of san.split(",")) {
+		const [, value] = part.trim().split(/:(.*)/s);
+		if (value !== void 0 && value.length > 0) names.add(value.toLowerCase());
+	}
+	return names;
+}
+/**
+* Hub side: sign an agent's CSR under the local CA in `<hubDataDir>/tls`. Throws when
+* there is no local CA to sign with or no name survives the policy.
+*/
+async function issueAgentHttpsLeaf(input) {
+	const caCertPath = (0, node_path.join)(input.hubDataDir, "tls", "camstack-ca.crt");
+	const caKeyPath = (0, node_path.join)(input.hubDataDir, "tls", "camstack-ca.key");
+	const hubLeafPath = (0, node_path.join)(input.hubDataDir, "tls", "camstack.crt");
+	if (!(0, node_fs.existsSync)(caCertPath) || !(0, node_fs.existsSync)(caKeyPath)) throw new Error("the hub has no local CA to sign with (no tls/camstack-ca.crt + key)");
+	const excluded = new Set(input.takenByOthers ?? []);
+	if ((0, node_fs.existsSync)(hubLeafPath)) for (const name of certificateNames((0, node_fs.readFileSync)(hubLeafPath, "utf8"))) excluded.add(name);
+	const sans = acceptAgentSans({
+		nodeId: input.nodeId,
+		observedAddress: input.observedAddress,
+		excluded,
+		...input.reportedNames !== void 0 ? { reported: input.reportedNames } : {}
+	});
+	if (sans.accepted.length === 0) throw new Error(`no name of node '${input.nodeId}' can be certified (${sans.rejected.join("; ") || "nothing offered"})`);
+	const ca = await loadCa((0, node_fs.readFileSync)(caCertPath, "utf8"), (0, node_fs.readFileSync)(caKeyPath, "utf8"));
+	return {
+		certPem: await issueLeafFromCsr(ca, input.csrPem, sans.identity, input.nodeId, 397, input.now ?? /* @__PURE__ */ new Date()),
+		caCertPem: ca.certPem,
+		accepted: sans.accepted,
+		rejected: sans.rejected
+	};
+}
+/** SHA-256 of a PEM (for logs that must not print a certificate). */
+function pemDigest(pem) {
+	return (0, node_crypto.createHash)("sha256").update(pem).digest("hex").slice(0, 16);
+}
+//#endregion
+Object.defineProperty(exports, "AgentHttpsInstallError", {
+	enumerable: true,
+	get: function() {
+		return AgentHttpsInstallError;
+	}
+});
 Object.defineProperty(exports, "CA_COMMON_NAME", {
 	enumerable: true,
 	get: function() {
@@ -983,6 +1299,18 @@ Object.defineProperty(exports, "UPLOADED_CA_FILE", {
 		return UPLOADED_CA_FILE;
 	}
 });
+Object.defineProperty(exports, "acceptAgentSans", {
+	enumerable: true,
+	get: function() {
+		return acceptAgentSans;
+	}
+});
+Object.defineProperty(exports, "agentHttpsPaths", {
+	enumerable: true,
+	get: function() {
+		return agentHttpsPaths;
+	}
+});
 Object.defineProperty(exports, "allFamiliesListenHost", {
 	enumerable: true,
 	get: function() {
@@ -1007,6 +1335,12 @@ Object.defineProperty(exports, "bindPendingLanHttp", {
 		return bindPendingLanHttp;
 	}
 });
+Object.defineProperty(exports, "certificateNames", {
+	enumerable: true,
+	get: function() {
+		return certificateNames;
+	}
+});
 Object.defineProperty(exports, "clearHttpsListener", {
 	enumerable: true,
 	get: function() {
@@ -1019,12 +1353,30 @@ Object.defineProperty(exports, "closeLanHttp", {
 		return closeLanHttp;
 	}
 });
+Object.defineProperty(exports, "collectAgentNames", {
+	enumerable: true,
+	get: function() {
+		return collectAgentNames;
+	}
+});
 Object.defineProperty(exports, "collectCertIdentity", {
 	enumerable: true,
 	get: function() {
 		return collectCertIdentity;
 	}
 });
+Object.defineProperty(exports, "createAgentHttpsRequest", {
+	enumerable: true,
+	get: function() {
+		return createAgentHttpsRequest;
+	}
+});
+Object.defineProperty(exports, "describeHttpsLeaf", {
+	enumerable: true,
+	get: function() {
+		return describeHttpsLeaf;
+	}
+});
 Object.defineProperty(exports, "ensureTlsCert", {
 	enumerable: true,
 	get: function() {
@@ -1037,18 +1389,66 @@ Object.defineProperty(exports, "evaluateExistingCert", {
 		return evaluateExistingCert;
 	}
 });
+Object.defineProperty(exports, "installAgentHttps", {
+	enumerable: true,
+	get: function() {
+		return installAgentHttps;
+	}
+});
+Object.defineProperty(exports, "isContainerBridgeAddress", {
+	enumerable: true,
+	get: function() {
+		return isContainerBridgeAddress;
+	}
+});
+Object.defineProperty(exports, "isLocalOnlyHostname", {
+	enumerable: true,
+	get: function() {
+		return isLocalOnlyHostname;
+	}
+});
+Object.defineProperty(exports, "isPrivateAddress", {
+	enumerable: true,
+	get: function() {
+		return isPrivateAddress;
+	}
+});
+Object.defineProperty(exports, "issueAgentHttpsLeaf", {
+	enumerable: true,
+	get: function() {
+		return issueAgentHttpsLeaf;
+	}
+});
 Object.defineProperty(exports, "leafFingerprintOf", {
 	enumerable: true,
 	get: function() {
 		return leafFingerprintOf;
 	}
 });
+Object.defineProperty(exports, "loadAgentHttps", {
+	enumerable: true,
+	get: function() {
+		return loadAgentHttps;
+	}
+});
 Object.defineProperty(exports, "loadTlsCert", {
 	enumerable: true,
 	get: function() {
 		return loadTlsCert;
 	}
 });
+Object.defineProperty(exports, "pemDigest", {
+	enumerable: true,
+	get: function() {
+		return pemDigest;
+	}
+});
+Object.defineProperty(exports, "pinnedHttpsCaFingerprint", {
+	enumerable: true,
+	get: function() {
+		return pinnedHttpsCaFingerprint;
+	}
+});
 Object.defineProperty(exports, "prepareBootTls", {
 	enumerable: true,
 	get: function() {
@@ -1133,6 +1533,12 @@ Object.defineProperty(exports, "storeUploadedCertificate", {
 		return storeUploadedCertificate;
 	}
 });
+Object.defineProperty(exports, "systemHostFacts", {
+	enumerable: true,
+	get: function() {
+		return systemHostFacts;
+	}
+});
 Object.defineProperty(exports, "validateUploadedTls", {
 	enumerable: true,
 	get: function() {