@lakutata/webrtc 0.0.0-stage → 3.1.1

package/dist/cjs/lib/turn/stun/message.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Message = void 0;
+exports.parseMessage = parseMessage;
+exports.paddingLength = paddingLength;
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("../../common/index.js");
+const attributes_js_1 = require("./attributes.js");
+const const_js_1 = require("./const.js");
+function parseMessage(data, integrityKey) {
+    if (!(0, const_js_1.isStunMessage)(data)) {
+        return undefined;
+    }
+    const messageType = data.readUInt16BE(0);
+    const transactionId = Buffer.from(data.slice(const_js_1.HEADER_LENGTH - 12, const_js_1.HEADER_LENGTH));
+    const attributeRepository = new attributes_js_1.AttributeRepository();
+    const rawAttributes = [];
+    // When integrityKey is provided, MESSAGE-INTEGRITY must be present and valid
+    // (RFC 5389 short-term credentials / RFC 7675 authenticated consent responses).
+    let messageIntegrityVerified = false;
+    for (let pos = const_js_1.HEADER_LENGTH; pos < data.length;) {
+        if (pos + 4 > data.length) {
+            return undefined;
+        }
+        const attrType = data.readUInt16BE(pos);
+        const attrLen = data.readUInt16BE(pos + 2);
+        const valueStart = pos + 4;
+        const valueEnd = valueStart + attrLen;
+        if (valueEnd > data.length) {
+            return undefined;
+        }
+        const payload = data.slice(valueStart, valueEnd);
+        const padLen = paddingLength(attrLen);
+        if (valueEnd + padLen > data.length) {
+            return undefined;
+        }
+        const attribute = attributes_js_1.ATTRIBUTES_BY_TYPE[attrType];
+        if (attribute) {
+            const [, attrName, , attrUnpack] = attribute;
+            let value;
+            try {
+                value =
+                    attrUnpack.name === attributes_js_1.unpackXorAddress.name
+                        ? attrUnpack(payload, transactionId)
+                        : attrUnpack(payload);
+            }
+            catch {
+                return undefined;
+            }
+            attributeRepository.setAttribute(attrName, value);
+            if (attrName === 'FINGERPRINT') {
+                const fingerprint = messageFingerprint(data.slice(0, pos));
+                if (attributeRepository.getAttributeValue('FINGERPRINT') !== fingerprint) {
+                    return undefined;
+                }
+            }
+            else if (attrName === 'MESSAGE-INTEGRITY' && integrityKey) {
+                const integrity = messageIntegrity(data.slice(0, pos), integrityKey);
+                const expected = attributeRepository.getAttributeValue('MESSAGE-INTEGRITY');
+                if (!integrity.equals(expected)) {
+                    return undefined;
+                }
+                messageIntegrityVerified = true;
+            }
+        }
+        else {
+            rawAttributes.push({
+                type: attrType,
+                length: attrLen,
+                value: Buffer.from(payload)
+            });
+        }
+        pos = valueEnd + padLen;
+    }
+    // Reject unsigned messages when the caller required authentication.
+    if (integrityKey && !messageIntegrityVerified) {
+        return undefined;
+    }
+    return new Message(messageType & 0x3eef, messageType & 0x0110, transactionId, attributeRepository.getAttributes(), rawAttributes);
+}
+class Message extends attributes_js_1.AttributeRepository {
+    constructor(messageMethod, messageClass, transactionId = (0, node_crypto_1.randomBytes)(12), attributes = [], rawAttributes = []) {
+        super(attributes);
+        this.messageMethod = messageMethod;
+        this.messageClass = messageClass;
+        this.transactionId = transactionId;
+        this.rawAttributes = rawAttributes;
+    }
+    toJSON() {
+        return this.json;
+    }
+    get json() {
+        return {
+            messageMethod: this.messageMethod,
+            messageClass: this.messageClass,
+            attributes: this.attributes,
+            rawAttributes: this.rawAttributes.map((attribute) => ({
+                type: attribute.type,
+                length: attribute.value.length
+            }))
+        };
+    }
+    get transactionIdHex() {
+        return this.transactionId.toString('hex');
+    }
+    appendRawAttribute(type, value) {
+        this.rawAttributes.push({ type, value: Buffer.from(value) });
+        return this;
+    }
+    get unknownAttributeTypes() {
+        return this.rawAttributes.map((attribute) => attribute.type);
+    }
+    get bytes() {
+        const body = Buffer.concat(this.serializedAttributes.map((attribute) => serializeAttribute(attribute.type, attribute.value)));
+        const header = Buffer.alloc(8);
+        header.writeUInt16BE(this.messageMethod | this.messageClass, 0);
+        header.writeUInt16BE(body.length, 2);
+        header.writeUInt32BE(const_js_1.COOKIE, 4);
+        return Buffer.concat([header, this.transactionId, body]);
+    }
+    addMessageIntegrity(key) {
+        //Signing again (a retry with a new nonce) replaces the integrity and the fingerprint after it
+        this.removeAttribute('FINGERPRINT').removeAttribute('MESSAGE-INTEGRITY');
+        this.setAttribute('MESSAGE-INTEGRITY', this.messageIntegrity(key));
+        return this;
+    }
+    messageIntegrity(key) {
+        const checkData = setBodyLength(this.bytes, this.bytes.length - const_js_1.HEADER_LENGTH + const_js_1.INTEGRITY_LENGTH);
+        return Buffer.from((0, node_crypto_1.createHmac)('sha1', key).update(checkData).digest('hex'), 'hex');
+    }
+    addFingerprint() {
+        this.removeAttribute('FINGERPRINT');
+        this.setAttribute('FINGERPRINT', messageFingerprint(this.bytes));
+        return this;
+    }
+    get serializedAttributes() {
+        const attributes = [];
+        for (const attrName of this.attributesKeys) {
+            const attrValue = this.getAttributeValue(attrName);
+            const [attrType, , attrPack] = attributes_js_1.ATTRIBUTES_BY_NAME[attrName];
+            const value = attrPack.name === attributes_js_1.packXorAddress.name
+                ? attrPack(attrValue, this.transactionId)
+                : attrPack(attrValue);
+            attributes.push({ type: attrType, value });
+        }
+        attributes.push(...this.rawAttributes.map((attribute) => ({
+            type: attribute.type,
+            value: Buffer.from(attribute.value)
+        })));
+        return attributes;
+    }
+}
+exports.Message = Message;
+function serializeAttribute(type, value) {
+    const attrLen = value.length;
+    const padLen = paddingLength(attrLen);
+    const header = Buffer.alloc(4);
+    header.writeUInt16BE(type, 0);
+    header.writeUInt16BE(attrLen, 2);
+    return Buffer.concat([header, value, Buffer.alloc(padLen)]);
+}
+const setBodyLength = (data, length) => {
+    const output = Buffer.alloc(data.length);
+    data.copy(output, 0, 0, 2);
+    output.writeUInt16BE(length, 2);
+    data.copy(output, 4, 4);
+    return output;
+};
+function messageFingerprint(data) {
+    const checkData = setBodyLength(data, data.length - const_js_1.HEADER_LENGTH + const_js_1.FINGERPRINT_LENGTH);
+    return ((0, index_js_1.crc32)(checkData) ^ const_js_1.FINGERPRINT_XOR) >>> 0;
+}
+function messageIntegrity(data, key) {
+    const checkData = setBodyLength(data, data.length - const_js_1.HEADER_LENGTH + const_js_1.INTEGRITY_LENGTH);
+    return Buffer.from((0, node_crypto_1.createHmac)('sha1', key).update(checkData).digest('hex'), 'hex');
+}
+function paddingLength(length) {
+    const rest = length % 4;
+    return rest === 0 ? 0 : 4 - rest;
+}

package/dist/cjs/lib/turn/turn/auth.d.ts

@@ -0,0 +1 @@
+export declare function makeTurnIntegrityKey(username: string, realm: string, password: string): NonSharedBuffer;

package/dist/cjs/lib/turn/turn/auth.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeTurnIntegrityKey = makeTurnIntegrityKey;
+const node_crypto_1 = require("node:crypto");
+function makeTurnIntegrityKey(username, realm, password) {
+    return (0, node_crypto_1.createHash)('md5')
+        .update(Buffer.from([username, realm, password].join(':')))
+        .digest();
+}

package/dist/cjs/lib/turn/turn/frame.d.ts

@@ -0,0 +1,13 @@
+export interface ChannelDataMessage {
+    channelNumber: number;
+    data: Buffer;
+}
+export declare function isChannelData(data: Buffer): boolean;
+export declare function encodeChannelData(channelNumber: number, data: Buffer): Buffer<ArrayBuffer>;
+export declare function decodeChannelData(data: Buffer): ChannelDataMessage | undefined;
+export declare function padTurnFrame(data: Buffer): Buffer<ArrayBufferLike>;
+export declare function splitTurnTcpFrames(buffer: Buffer): {
+    frames: Buffer<ArrayBufferLike>[];
+    malformed: boolean;
+    rest: Buffer<ArrayBufferLike>;
+};

package/dist/cjs/lib/turn/turn/frame.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isChannelData = isChannelData;
+exports.encodeChannelData = encodeChannelData;
+exports.decodeChannelData = decodeChannelData;
+exports.padTurnFrame = padTurnFrame;
+exports.splitTurnTcpFrames = splitTurnTcpFrames;
+const message_js_1 = require("../stun/message.js");
+function isChannelData(data) {
+    return data.length >= 4 && (data[0] & 0xc0) === 0x40;
+}
+function encodeChannelData(channelNumber, data) {
+    const header = Buffer.alloc(4);
+    header.writeUInt16BE(channelNumber, 0);
+    header.writeUInt16BE(data.length, 2);
+    return Buffer.concat([header, data]);
+}
+function decodeChannelData(data) {
+    if (!isChannelData(data) || data.length < 4) {
+        return undefined;
+    }
+    const channelNumber = data.readUInt16BE(0);
+    const length = data.readUInt16BE(2);
+    if (data.length < 4 + length) {
+        return undefined;
+    }
+    return {
+        channelNumber,
+        data: data.subarray(4, 4 + length)
+    };
+}
+function padTurnFrame(data) {
+    const padding = (0, message_js_1.paddingLength)(data.length);
+    return padding > 0 ? Buffer.concat([data, Buffer.alloc(padding)]) : data;
+}
+function splitTurnTcpFrames(buffer) {
+    const frames = [];
+    let offset = 0;
+    let malformed = false;
+    while (buffer.length - offset >= 4) {
+        let frameLength;
+        if (isChannelData(buffer.subarray(offset))) {
+            const payloadLength = buffer.readUInt16BE(offset + 2);
+            frameLength = 4 + payloadLength + (0, message_js_1.paddingLength)(payloadLength);
+        }
+        else if ((buffer[offset] & 0xc0) === 0) {
+            if (buffer.length - offset < 20) {
+                break;
+            }
+            const stunBodyLength = buffer.readUInt16BE(offset + 2);
+            frameLength = 20 + stunBodyLength + (0, message_js_1.paddingLength)(stunBodyLength);
+        }
+        else {
+            malformed = true;
+            break;
+        }
+        if (buffer.length - offset < frameLength) {
+            break;
+        }
+        frames.push(buffer.subarray(offset, offset + frameLength));
+        offset += frameLength;
+    }
+    return {
+        frames,
+        malformed,
+        rest: buffer.subarray(offset)
+    };
+}

package/dist/cjs/lib/turn/turn/protocol.d.ts

@@ -0,0 +1,147 @@
+import type { Address } from '../../common/index.js';
+import { type StunServerDatagram, StunServerProtocol, type StunServerProtocolOptions, type StunTransport } from '../protocol.js';
+export interface TurnServerClientPacket extends StunServerDatagram {
+    clientId: string;
+}
+export interface TurnServerTcpChunk {
+    clientId: string;
+    data: Buffer;
+    remoteAddress: Address;
+    localAddress?: Address;
+    transport: Extract<StunTransport, 'tcp' | 'tls'>;
+}
+export interface TurnServerRelayPacket {
+    relayId: string;
+    data: Buffer;
+    remoteAddress: Address;
+    localAddress: Address;
+}
+export interface TurnServerRelayBound {
+    allocationId: string;
+    relayId: string;
+    relayedAddress: Address;
+}
+export interface TurnServerRelayBindFailure {
+    allocationId: string;
+    errorCode?: number;
+    reason?: string;
+}
+export interface TurnServerClientClosed {
+    clientId: string;
+}
+export type TurnServerAction = {
+    type: 'send-client';
+    clientId: string;
+    transport: StunTransport;
+    remoteAddress: Address;
+    data: Buffer;
+} | {
+    type: 'send-relay';
+    relayId: string;
+    remoteAddress: Address;
+    data: Buffer;
+} | {
+    type: 'bind-relay';
+    allocationId: string;
+    relayId: string;
+} | {
+    type: 'close-relay';
+    relayId: string;
+} | {
+    type: 'close-client';
+    clientId: string;
+} | {
+    type: 'schedule-timeout';
+    at: number;
+} | {
+    type: 'ignore';
+    reason: 'binding-indication' | 'malformed' | 'non-request' | 'non-stun' | 'unknown-channel' | 'unknown-client' | 'unknown-relay' | 'unsupported-indication' | 'unsupported-method';
+};
+export interface TurnServerProtocolOptions extends Pick<StunServerProtocolOptions, 'fingerprint' | 'software'> {
+    realm?: string;
+    allocationLifetime?: number;
+    permissionLifetime?: number;
+    channelLifetime?: number;
+    nonceLifetime?: number;
+    maxAllocations?: number;
+    /**the allocations counted with the servers of other threads, in place of maxAllocations: reserve one before it
+     * is made (false when refused), release it once deleted */
+    allocationGate?: {
+        reserve(): boolean;
+        release(): void;
+    };
+    getPassword?: (username: string, realm: string) => string | undefined;
+    now?: () => number;
+}
+export declare class TurnServerProtocol {
+    readonly realm: string;
+    readonly bindingProtocol: StunServerProtocol;
+    private readonly fingerprint;
+    private readonly software?;
+    private readonly allocationLifetime;
+    private readonly permissionLifetime;
+    private readonly channelLifetime;
+    private readonly nonceLifetime;
+    private readonly maxAllocations;
+    private readonly allocationGate?;
+    private readonly getPassword;
+    private readonly nowProvider?;
+    private readonly allocations;
+    private readonly allocationIdByClientId;
+    private readonly allocationIdByRelayId;
+    private readonly nonces;
+    private readonly tcpBuffers;
+    constructor(options?: TurnServerProtocolOptions);
+    /**the allocations in use */
+    get allocationCount(): number;
+    get nextTimeoutAt(): number | undefined;
+    handleClientDatagram(input: TurnServerClientPacket): TurnServerAction[];
+    handleTcpChunk(input: TurnServerTcpChunk): TurnServerAction[];
+    handleRelayPacket(input: TurnServerRelayPacket): TurnServerAction[];
+    handleRelayBound(input: TurnServerRelayBound): TurnServerAction[];
+    handleRelayBindFailure(input: TurnServerRelayBindFailure): TurnServerAction[];
+    handleClientClosed(input: TurnServerClientClosed): TurnServerAction[];
+    handleTimer(now?: number): TurnServerAction[];
+    private handleClientPacket;
+    private handleBindingRequest;
+    private handleAllocateRequest;
+    private handleRefreshRequest;
+    private handleCreatePermissionRequest;
+    private handleChannelBindRequest;
+    private handleSendIndication;
+    private authenticateRequest;
+    private unauthorizedResponse;
+    private successResponse;
+    private errorResponse;
+    private addResponseAttributes;
+    private shouldAddFingerprint;
+    private issueNonce;
+    private sendClient;
+    private mapBindingAction;
+    private clientEndpoint;
+    /**
+     * Data of a client on a channel: relayed to the peer of the binding while the allocation and the binding last
+     * @param input
+     * @param now
+     */
+    private handleChannelData;
+    /**
+     * An allocation still alive: one expired is deleted now (the timer would delete it later)
+     * @param allocation
+     * @param now
+     * @param actions What deleting it takes.
+     */
+    private liveAllocation;
+    private getClientAllocation;
+    private getRelayAllocation;
+    private setPermission;
+    private getPermission;
+    private getChannelBinding;
+    private removeChannelBinding;
+    private deleteAllocation;
+    private cleanupExpired;
+    private computeNextTimeoutAt;
+    private finalizeActions;
+    private clampLifetime;
+    private now;
+}