@livedesk/hub 0.1.30 → 0.1.32

package/src/transport/udp-rendezvous.js

@@ -1,4 +1,5 @@
 import dgram from 'node:dgram';
+import crypto from 'node:crypto';
 import {
     decodeRendezvousMessage,
     encodeRendezvousMessage,
@@ -52,6 +53,91 @@ function consumeToken(bucket, rate, capacity, now) {
     return true;
 }
 
+function decodeCanonicalBase64Url(value, minimum, maximum = minimum) {
+    const text = String(value || '');
+    if (!/^[A-Za-z0-9_-]+$/u.test(text)) return null;
+    const bytes = Buffer.from(text, 'base64url');
+    return bytes.length >= minimum && bytes.length <= maximum && bytes.toString('base64url') === text
+        ? bytes
+        : null;
+}
+
+function trustedIssuerMap(values) {
+    const entries = Array.isArray(values)
+        ? values
+        : String(values || '').split(/[\s,]+/u).filter(Boolean);
+    if (entries.length > 10_000) throw new Error('udp-rendezvous-trusted-issuer-capacity');
+    const issuers = new Map();
+    for (const entry of entries) {
+        const publicKeyBytes = decodeCanonicalBase64Url(entry, 80, 160);
+        if (!publicKeyBytes) throw new Error('udp-rendezvous-trusted-issuer-invalid');
+        let publicKey;
+        try {
+            publicKey = crypto.createPublicKey({ key: publicKeyBytes, format: 'der', type: 'spki' });
+        } catch {
+            throw new Error('udp-rendezvous-trusted-issuer-invalid');
+        }
+        if (publicKey.asymmetricKeyType !== 'ec'
+            || publicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
+            throw new Error('udp-rendezvous-trusted-issuer-invalid');
+        }
+        const keyId = crypto.createHash('sha256').update(publicKeyBytes).digest('base64url');
+        issuers.set(keyId, publicKey);
+    }
+    return issuers;
+}
+
+function exactSafeText(value, maximum) {
+    return typeof value === 'string' && value.length > 0 && safeText(value, maximum) === value;
+}
+
+function verifyRendezvousProof(proof, roomId, role, current, trustedIssuers) {
+    try {
+        const parts = String(proof || '').split('.');
+        if (parts.length !== 2) return { ok: false, reason: 'invalid-proof' };
+        const payloadBytes = decodeCanonicalBase64Url(parts[0], 64, 1536);
+        const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
+        if (!payloadBytes || !signature) return { ok: false, reason: 'invalid-proof' };
+        const payload = JSON.parse(payloadBytes.toString('utf8'));
+        if (!payload || payload.version !== 2
+            || payload.protocol !== 'livedesk.udp.rendezvous-proof.v2'
+            || payload.roomId !== roomId
+            || !exactSafeText(payload.issuerKeyId, 64)
+            || !exactSafeText(payload.roomId, 160)
+            || !exactSafeText(payload.role, 16)
+            || !exactSafeText(payload.accountId, 128)
+            || !exactSafeText(payload.hubId, 128)
+            || !exactSafeText(payload.deviceId, 128)
+            || !Number.isSafeInteger(payload.issuedAt)
+            || !Number.isSafeInteger(payload.expiresAt)
+            || payload.issuedAt > current + 30_000
+            || payload.expiresAt <= current
+            || payload.expiresAt <= payload.issuedAt
+            || payload.expiresAt - payload.issuedAt > 120_000
+            || !decodeCanonicalBase64Url(payload.nonce, 16, 32)) {
+            return { ok: false, reason: 'invalid-proof' };
+        }
+        if (payload.role !== role) return { ok: false, reason: 'role-mismatch' };
+        const issuerKeyIdBytes = decodeCanonicalBase64Url(payload.issuerKeyId, 32, 32);
+        if (!issuerKeyIdBytes) return { ok: false, reason: 'invalid-proof' };
+        const issuerKey = trustedIssuers.get(payload.issuerKeyId);
+        if (!issuerKey) return { ok: false, reason: 'untrusted-issuer' };
+        const valid = crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), {
+                key: issuerKey,
+                dsaEncoding: 'ieee-p1363'
+            }, signature);
+        if (!valid) return { ok: false, reason: 'invalid-signature' };
+        return {
+            ok: true,
+            payload,
+            proofKey: `${payload.issuerKeyId}:${payload.nonce}:${payload.roomId}:${payload.role}`,
+            proofHash: crypto.createHash('sha256').update(String(proof), 'utf8').digest('base64url')
+        };
+    } catch {
+        return { ok: false, reason: 'invalid-proof' };
+    }
+}
+
 export function createUdpRendezvousServer({
     host = '0.0.0.0',
     port = 5199,
@@ -68,19 +154,24 @@ export function createUdpRendezvousServer({
     perSourceRate = DEFAULT_LIMITS.perSourceRate,
     perSourceBurst = DEFAULT_LIMITS.perSourceBurst,
     globalRate = DEFAULT_LIMITS.globalRate,
-    globalBurst = DEFAULT_LIMITS.globalBurst
+    globalBurst = DEFAULT_LIMITS.globalBurst,
+    trustedIssuerPublicKeys = [],
+    allowLegacyTokens = false
 } = {}) {
     const socket = dgram.createSocket('udp4');
     const rooms = new Map();
     const unpairedRooms = new Map();
     const sources = new Map();
     const evictableSources = new Map();
+    const consumedProofs = new Map();
+    const trustedIssuers = trustedIssuerMap(trustedIssuerPublicKeys);
     const limits = Object.freeze({
         roomTtlMs: normalizeInteger(roomTtlMs, DEFAULT_LIMITS.roomTtlMs),
         sourceTtlMs: normalizeInteger(sourceTtlMs, DEFAULT_LIMITS.sourceTtlMs),
         sweepIntervalMs: normalizeInteger(sweepIntervalMs, DEFAULT_LIMITS.sweepIntervalMs),
         statusIntervalMs: normalizeInteger(statusIntervalMs, DEFAULT_LIMITS.statusIntervalMs, 0),
         maxRooms: normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms),
+        maxConsumedProofs: Math.min(200_000, normalizeInteger(maxRooms, DEFAULT_LIMITS.maxRooms) * 2),
         maxSources: normalizeInteger(maxSources, DEFAULT_LIMITS.maxSources),
         maxRoomsPerSource: normalizeInteger(maxRoomsPerSource, DEFAULT_LIMITS.maxRoomsPerSource),
         perSourceRate: normalizeRate(perSourceRate, DEFAULT_LIMITS.perSourceRate),
@@ -103,6 +194,13 @@ export function createUdpRendezvousServer({
         sourceRoomLimitDrops: 0,
         roomCapacityDrops: 0,
         tokenMismatchDrops: 0,
+        untrustedIssuerDrops: 0,
+        roleMismatchDrops: 0,
+        bindingMismatchDrops: 0,
+        proofReplayDrops: 0,
+        endpointOverwriteDrops: 0,
+        idempotentRefreshes: 0,
+        proofCapacityDrops: 0,
         expiredRooms: 0,
         evictedRooms: 0,
         expiredSources: 0,
@@ -146,6 +244,9 @@ export function createUdpRendezvousServer({
         for (const [roomId, room] of rooms) {
             if (at - room.updatedAt >= limits.roomTtlMs) deleteRoom(roomId, 'expired');
         }
+        for (const [proofKey, consumed] of consumedProofs) {
+            if (consumed.expiresAt <= at) consumedProofs.delete(proofKey);
+        }
         for (const [key, source] of sources) {
             if (source.activeRooms === 0 && at - source.lastSeenAt >= limits.sourceTtlMs) {
                 sources.delete(key);
@@ -211,7 +312,7 @@ export function createUdpRendezvousServer({
         });
     }
 
-    function createRoom(roomId, token, source, at) {
+    function createRoom(roomId, binding, source, at, legacyToken = '') {
         if (source.activeRooms >= limits.maxRoomsPerSource) {
             counters.sourceRoomLimitDrops += 1;
             return null;
@@ -226,7 +327,8 @@ export function createUdpRendezvousServer({
             }
         }
         const room = {
-            token,
+            legacyToken,
+            binding,
             ownerSource: source.key,
             peers: new Map(),
             createdAt: at,
@@ -264,26 +366,83 @@ export function createUdpRendezvousServer({
         }
         const roomId = safeText(message.roomId, 160);
         const role = safeText(message.role, 16).toLowerCase();
-        const token = safeText(message.token, 256);
+        const token = safeText(message.token, 2048);
         if (!roomId || !token || !['hub', 'client'].includes(role)) {
             counters.invalidDatagrams += 1;
             return;
         }
+        const verification = allowLegacyTokens
+            ? { ok: true, legacy: true, token }
+            : verifyRendezvousProof(token, roomId, role, at, trustedIssuers);
+        if (!verification.ok) {
+            counters.invalidDatagrams += 1;
+            if (verification.reason === 'untrusted-issuer') counters.untrustedIssuerDrops += 1;
+            if (verification.reason === 'role-mismatch') counters.roleMismatchDrops += 1;
+            return;
+        }
         let room = rooms.get(roomId);
         if (room && at - room.updatedAt >= limits.roomTtlMs) {
             deleteRoom(roomId, 'expired');
             room = null;
         }
-        if (room && room.token !== token) {
-            counters.tokenMismatchDrops += 1;
-            return;
-        }
-        if (!room) {
-            room = createRoom(roomId, token, source, at);
-            if (!room) return;
+        if (verification.legacy) {
+            if (room && room.legacyToken !== token) {
+                counters.tokenMismatchDrops += 1;
+                return;
+            }
+            if (!room) {
+                room = createRoom(roomId, null, source, at, token);
+                if (!room) return;
+            }
+            room.updatedAt = at;
+            room.peers.set(role, { address: rinfo.address, port: rinfo.port });
+        } else {
+            const binding = {
+                issuerKeyId: verification.payload.issuerKeyId,
+                accountId: verification.payload.accountId,
+                hubId: verification.payload.hubId,
+                deviceId: verification.payload.deviceId
+            };
+            if (room && JSON.stringify(room.binding) !== JSON.stringify(binding)) {
+                counters.bindingMismatchDrops += 1;
+                return;
+            }
+            const endpoint = { address: rinfo.address, port: rinfo.port };
+            const consumed = consumedProofs.get(verification.proofKey);
+            const existingPeer = room?.peers.get(role);
+            if (consumed) {
+                const sameEndpoint = consumed.address === endpoint.address && consumed.port === endpoint.port;
+                const sameOwner = existingPeer?.proofKey === verification.proofKey
+                    && existingPeer.address === endpoint.address
+                    && existingPeer.port === endpoint.port;
+                if (sameEndpoint && sameOwner) {
+                    room.updatedAt = at;
+                    counters.idempotentRefreshes += 1;
+                    return;
+                }
+                counters.proofReplayDrops += 1;
+                if (existingPeer && !sameEndpoint) counters.endpointOverwriteDrops += 1;
+                return;
+            }
+            if (consumedProofs.size >= limits.maxConsumedProofs) {
+                counters.proofCapacityDrops += 1;
+                return;
+            }
+            if (existingPeer) {
+                counters.endpointOverwriteDrops += 1;
+                return;
+            }
+            if (!room) {
+                room = createRoom(roomId, binding, source, at);
+                if (!room) return;
+            }
+            room.updatedAt = at;
+            room.peers.set(role, { ...endpoint, proofKey: verification.proofKey, proofHash: verification.proofHash });
+            consumedProofs.set(verification.proofKey, {
+                ...endpoint,
+                expiresAt: verification.payload.expiresAt
+            });
         }
-        room.updatedAt = at;
-        room.peers.set(role, { address: rinfo.address, port: rinfo.port });
         counters.acceptedRegistrations += 1;
         if (room.peers.size < 2) {
             unpairedRooms.delete(roomId);
@@ -339,6 +498,9 @@ export function createUdpRendezvousServer({
             unpairedRooms: unpairedRooms.size,
             sources: sources.size,
             evictableSources: evictableSources.size,
+            consumedProofs: consumedProofs.size,
+            trustedIssuerCount: trustedIssuers.size,
+            securityReady: allowLegacyTokens || trustedIssuers.size > 0,
             limits: { ...limits },
             counters: { ...counters },
             lastError
@@ -367,6 +529,9 @@ export function createUdpRendezvousServer({
 
     async function start() {
         if (started) return { host, port: boundPort };
+        if (!allowLegacyTokens && trustedIssuers.size === 0) {
+            throw new Error('udp-rendezvous-trusted-issuer-required');
+        }
         await new Promise((resolve, reject) => {
             const onError = error => { socket.off('listening', onListening); reject(error); };
             const onListening = () => { socket.off('error', onError); resolve(); };
@@ -391,6 +556,7 @@ export function createUdpRendezvousServer({
         unpairedRooms.clear();
         sources.clear();
         evictableSources.clear();
+        consumedProofs.clear();
         if (started) {
             await new Promise(resolve => socket.close(() => resolve()));
             started = false;