@loadmill/droid-cua 2.41.0 → 2.43.0

package/build/src/network/certificate-install.js

@@ -0,0 +1,242 @@
+import { execFile } from "node:child_process";
+import { readFile, writeFile, mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { getCertificatePaths, loadCertificateAuthority } from "./certificate-authority.js";
+const execFileAsync = promisify(execFile);
+const MISSING = "__DROID_CERT_MISSING__";
+const APEX_CERTS = "/apex/com.android.conscrypt/cacerts";
+const SYSTEM_CERTS = "/system/etc/security/cacerts";
+function commandError(error) {
+    const output = [error?.stderr, error?.stdout, error?.message].find((value) => typeof value === "string" && value.trim());
+    return String(output || "Command failed").trim();
+}
+async function run(file, args, options = {}) {
+    try {
+        return await execFileAsync(file, args, { timeout: 120000, maxBuffer: 4 * 1024 * 1024, ...options });
+    }
+    catch (error) {
+        throw new Error(`${file} ${args.slice(0, 3).join(" ")}: ${commandError(error)}`);
+    }
+}
+async function adb(adbPath, serial, args, options) {
+    return run(adbPath, ["-s", serial, ...args], options);
+}
+async function shell(adbPath, serial, script) {
+    return adb(adbPath, serial, ["shell", script]);
+}
+async function requireAndroidRoot(adbPath, serial) {
+    try {
+        await adb(adbPath, serial, ["root"]);
+        await adb(adbPath, serial, ["wait-for-device"]);
+        const { stdout } = await adb(adbPath, serial, ["shell", "id", "-u"]);
+        if (stdout.trim() !== "0")
+            throw new Error("ADB did not gain root access.");
+    }
+    catch (error) {
+        throw new Error(`This Android Emulator image does not provide the root access needed for system CA trust. Use a rootable AOSP or Google APIs image. ${commandError(error)}`);
+    }
+}
+async function readRemoteCertificate(adbPath, serial, directory, fileName, namespacePid) {
+    const remote = `${directory}/${fileName}`;
+    const inner = `[ -f ${remote} ] && cat ${remote} || printf ${MISSING}`;
+    const result = namespacePid
+        ? await shell(adbPath, serial, `nsenter --mount=/proc/${namespacePid}/ns/mnt -- sh -c \"${inner}\"`)
+        : await shell(adbPath, serial, inner);
+    return result.stdout.trim() === MISSING ? null : result.stdout;
+}
+export async function selectAndroidCertificateFileName(ca, readExisting) {
+    const hash = ca.androidFileName.slice(0, -2);
+    for (let index = 0; index < 100; index += 1) {
+        const name = `${hash}.${index}`;
+        const existing = await readExisting(name);
+        if (existing === null || existing.trim() === ca.certificate.trim())
+            return { name, alreadyPresent: existing !== null };
+    }
+    throw new Error("The Android certificate store has too many certificates with the same subject hash.");
+}
+async function chooseCertificateName(adbPath, serial, directory, ca) {
+    return selectAndroidCertificateFileName(ca, (name) => readRemoteCertificate(adbPath, serial, directory, name));
+}
+async function isTrustedInNamespaces(adbPath, serial, directory, ca, pids) {
+    const hash = ca.androidFileName.slice(0, -2);
+    const results = await Promise.all(pids.map(async (pid) => {
+        for (let index = 0; index < 100; index += 1) {
+            const current = await readRemoteCertificate(adbPath, serial, directory, `${hash}.${index}`, pid);
+            if (current?.trim() === ca.certificate.trim())
+                return true;
+            if (current === null)
+                return false;
+        }
+        return false;
+    }));
+    return results.every(Boolean);
+}
+export async function getAndroidAvdName(adbPath, serial) {
+    const { stdout } = await adb(adbPath, serial, ["emu", "avd", "name"]);
+    const name = stdout.split(/\r?\n/).map((line) => line.trim()).find((line) => line && line !== "OK");
+    if (!name)
+        throw new Error("Could not identify the Android Virtual Device for certificate preparation.");
+    return name;
+}
+async function readPreparedDevices() {
+    try {
+        return JSON.parse(await readFile(getCertificatePaths().preparedDevices, "utf8"));
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+export async function hasPreparedAndroidCertificates() {
+    return Object.keys(await readPreparedDevices()).length > 0;
+}
+export async function recordPreparedAndroidCertificate(adbPath, serial, fingerprint) {
+    const prepared = await readPreparedDevices();
+    prepared[await getAndroidAvdName(adbPath, serial)] = fingerprint;
+    await writeFile(getCertificatePaths().preparedDevices, JSON.stringify(prepared, null, 2), { mode: 0o600 });
+}
+async function matchingPreparedAvd(adbPath, serial, ca = null) {
+    const prepared = await readPreparedDevices();
+    if (Object.keys(prepared).length === 0)
+        return null;
+    const avdName = await getAndroidAvdName(adbPath, serial);
+    if (!prepared[avdName])
+        return null;
+    const activeCa = ca || await loadCertificateAuthority();
+    if (prepared[avdName] !== activeCa.fingerprint) {
+        throw new Error(`The active network certificate has changed since ${avdName} was prepared. Run Tools → Install Network Certificate again.`);
+    }
+    return { avdName, ca: activeCa };
+}
+async function pushCertificate(adbPath, serial, ca, fileName) {
+    const tempDir = await mkdtemp(path.join(os.tmpdir(), "droid-network-ca-"));
+    const localPath = path.join(tempDir, fileName);
+    const remotePath = `/data/local/tmp/${fileName}`;
+    try {
+        await writeFile(localPath, ca.certificate, { mode: 0o600 });
+        await adb(adbPath, serial, ["push", localPath, remotePath]);
+        return remotePath;
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
+async function getZygotePids(adbPath, serial) {
+    const { stdout } = await shell(adbPath, serial, "pidof zygote zygote64 || true");
+    return [...new Set(stdout.trim().split(/\s+/).filter((value) => /^\d+$/.test(value)))];
+}
+async function requireMountCapabilities(adbPath, serial, directory) {
+    const { stdout } = await shell(adbPath, serial, `test -d '${directory}' && command -v nsenter && command -v mount && command -v chcon`);
+    if (!stdout.trim())
+        throw new Error("The certificate store or required mount tools are unavailable.");
+    const pids = await getZygotePids(adbPath, serial);
+    if (pids.length === 0)
+        throw new Error("No Android Zygote process was found.");
+    try {
+        await adb(adbPath, serial, ["shell", "nsenter", `--mount=/proc/${pids[0]}/ns/mnt`, "--", "true"]);
+    }
+    catch (error) {
+        throw new Error(`This emulator does not allow entry into application mount namespaces. ${commandError(error)}`);
+    }
+    return pids;
+}
+async function installMountedAndroid(adbPath, serial, ca, directory) {
+    let zygotes;
+    try {
+        zygotes = await requireMountCapabilities(adbPath, serial, directory);
+    }
+    catch (error) {
+        throw new Error(`This Android emulator cannot use Droid's system CA mount strategy. ${commandError(error)}`);
+    }
+    if (await isTrustedInNamespaces(adbPath, serial, directory, ca, zygotes))
+        return { changed: false };
+    const workDir = "/data/local/tmp/droid-cua-cacerts";
+    await shell(adbPath, serial, `mkdir -p '${workDir}' && cp '${directory}'/* '${workDir}/' && chmod 755 '${workDir}'`);
+    const { name } = await chooseCertificateName(adbPath, serial, workDir, ca);
+    const staged = await pushCertificate(adbPath, serial, ca, name);
+    await shell(adbPath, serial, `cp '${staged}' '${workDir}/${name}' && chown root:root '${workDir}'/* && chmod 644 '${workDir}'/* && chcon u:object_r:system_file:s0 '${workDir}' '${workDir}'/*`);
+    try {
+        // Zygote namespaces supply trust to newly launched apps.
+        for (const pid of zygotes) {
+            await adb(adbPath, serial, ["shell", "nsenter", `--mount=/proc/${pid}/ns/mnt`, "--", "mount", "--bind", workDir, directory]);
+        }
+    }
+    catch (error) {
+        throw new Error(`This emulator does not allow the required certificate-store bind mount. ${commandError(error)}`);
+    }
+    // Already running apps keep their own mount namespaces until restarted.
+    for (const pid of zygotes) {
+        const { stdout } = await shell(adbPath, serial, `ps -o PID -P ${pid} | tail -n +2`);
+        for (const appPid of stdout.trim().split(/\s+/).filter((value) => /^\d+$/.test(value))) {
+            try {
+                await adb(adbPath, serial, ["shell", "nsenter", `--mount=/proc/${appPid}/ns/mnt`, "--", "mount", "--bind", workDir, directory]);
+            }
+            catch { } // An app may exit while its mount is being updated.
+        }
+    }
+    const installed = await readRemoteCertificate(adbPath, serial, directory, name, zygotes[0]);
+    if (installed?.trim() !== ca.certificate.trim())
+        throw new Error("The Droid CA is not visible from Android's application mount namespace.");
+    return { changed: true };
+}
+export async function inspectNetworkDevice({ platform, deviceId, adbPath = process.env.DROID_CUA_ANDROID_ADB_PATH || "adb" }) {
+    if (platform === "ios") {
+        if (process.platform !== "darwin")
+            throw new Error("iOS Simulator certificate setup requires macOS.");
+        const { stdout } = await run("xcrun", ["simctl", "list", "devices", "--json"]);
+        const devices = JSON.parse(stdout).devices;
+        for (const [runtime, entries] of Object.entries(devices)) {
+            const simulator = entries.find((entry) => entry.udid === deviceId);
+            if (simulator)
+                return { platform, deviceId, osVersion: runtime.match(/iOS-([\d-]+)/)?.[1]?.replaceAll("-", ".") || runtime };
+        }
+        throw new Error("The connected device is not an available iOS Simulator.");
+    }
+    if (platform !== "android" || !/^emulator-\d+$/.test(deviceId)) {
+        throw new Error("Network certificate setup supports local iOS Simulators and Android Emulators only.");
+    }
+    const { stdout } = await adb(adbPath, deviceId, ["shell", "getprop", "ro.build.version.sdk"]);
+    const apiLevel = Number(stdout.trim());
+    if (!Number.isInteger(apiLevel) || apiLevel < 1) {
+        throw new Error(`Could not determine this Android Emulator's API level: ${stdout.trim() || "no value returned"}.`);
+    }
+    if (apiLevel > 36) {
+        const version = apiLevel === 37 ? "Android 17 (API 37)" : `Android API ${apiLevel}`;
+        throw new Error(`This emulator runs ${version}. Droid supports certificate setup through API 36, so installation stopped before checking root access. Use a rootable AOSP or Google APIs emulator on API 36 or earlier, without a Google Play image.`);
+    }
+    return { platform, deviceId, osVersion: `Android API ${apiLevel}`, apiLevel };
+}
+export async function installNetworkCertificate(target, ca, options = {}) {
+    if (target.platform === "ios") {
+        await run("xcrun", ["simctl", "keychain", target.deviceId, "add-root-cert", options.certificatePath]);
+        return { changed: true };
+    }
+    const adbPath = options.adbPath || process.env.DROID_CUA_ANDROID_ADB_PATH || "adb";
+    await requireAndroidRoot(adbPath, target.deviceId);
+    return installMountedAndroid(adbPath, target.deviceId, ca, target.apiLevel >= 34 ? APEX_CERTS : SYSTEM_CERTS);
+}
+export async function ensureCliAndroidCertificate(deviceId, ca, options = {}) {
+    const adbPath = options.adbPath || process.env.DROID_CUA_ANDROID_ADB_PATH || "adb";
+    const target = await inspectNetworkDevice({ platform: "android", deviceId, adbPath });
+    await requireAndroidRoot(adbPath, deviceId);
+    const directory = target.apiLevel >= 34 ? APEX_CERTS : SYSTEM_CERTS;
+    const pids = await requireMountCapabilities(adbPath, deviceId, directory);
+    if (await isTrustedInNamespaces(adbPath, deviceId, directory, ca, pids))
+        return { changed: false };
+    if (!await matchingPreparedAvd(adbPath, deviceId, ca)) {
+        throw new Error("The Android Emulator does not trust Droid's active network CA. Install it with Tools → Install Network Certificate or provision matching trust before running the CLI.");
+    }
+    return installNetworkCertificate(target, ca, { adbPath });
+}
+export async function reapplyPreparedAndroidCertificate(deviceId, options = {}) {
+    const adbPath = options.adbPath || process.env.DROID_CUA_ANDROID_ADB_PATH || "adb";
+    const prepared = await matchingPreparedAvd(adbPath, deviceId);
+    if (!prepared)
+        return null;
+    const target = await inspectNetworkDevice({ platform: "android", deviceId, adbPath });
+    const result = await installNetworkCertificate(target, prepared.ca, { adbPath });
+    return { ...result, avdName: prepared.avdName };
+}

package/build/src/network/local-proxy.js

@@ -0,0 +1,287 @@
+import { generateKeyPairSync, randomBytes, randomUUID } from "node:crypto";
+import http from "node:http";
+import https from "node:https";
+import net from "node:net";
+import forge from "node-forge";
+import { loadCertificateAuthority } from "./certificate-authority.js";
+import { BODY_CAPTURE_LIMIT } from "./network-capture.js";
+export const NETWORK_PROXY_HOST = "127.0.0.1";
+export const NETWORK_PROXY_PORT = 8765;
+function destination(authority) {
+    const url = new URL(`http://${authority}`);
+    const port = Number(url.port || 443);
+    if (!url.hostname || !Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("Invalid proxy destination.");
+    }
+    return { host: url.hostname.replace(/^\[|\]$/g, ""), port };
+}
+function leafCertificate(host, ca) {
+    const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    });
+    const root = forge.pki.certificateFromPem(ca.certificate);
+    const certificate = forge.pki.createCertificate();
+    certificate.publicKey = forge.pki.publicKeyFromPem(publicKey);
+    certificate.serialNumber = randomBytes(16).toString("hex").replace(/^./, "1");
+    certificate.validity.notBefore = new Date(Date.now() - 60_000);
+    certificate.validity.notAfter = new Date(Math.min(Date.now() + 24 * 60 * 60 * 1000, Date.parse(root.validity.notAfter)));
+    certificate.setSubject([{ name: "commonName", value: host }]);
+    certificate.setIssuer(root.subject.attributes);
+    certificate.setExtensions([
+        { name: "basicConstraints", cA: false, critical: true },
+        { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
+        { name: "extKeyUsage", serverAuth: true },
+        { name: "subjectAltName", altNames: net.isIP(host) ? [{ type: 7, ip: host }] : [{ type: 2, value: host }] },
+    ]);
+    certificate.sign(forge.pki.privateKeyFromPem(ca.privateKey), forge.md.sha256.create());
+    return { key: privateKey, cert: forge.pki.certificateToPem(certificate) };
+}
+function observeBody(stream, type, flowId, headers, onEvent) {
+    let bytes = 0;
+    let retained = 0;
+    let finished = false;
+    const chunks = [];
+    stream.on("data", (chunk) => {
+        bytes += chunk.length;
+        const length = Math.min(chunk.length, BODY_CAPTURE_LIMIT - retained);
+        if (length > 0) {
+            chunks.push(Buffer.from(chunk.subarray(0, length)));
+            retained += length;
+        }
+    });
+    function finish(complete) {
+        if (finished)
+            return;
+        finished = true;
+        onEvent({ type, flowId, headers, body: Buffer.concat(chunks), bytes, truncated: bytes > retained, complete });
+    }
+    stream.once("end", () => finish(true));
+    stream.once("aborted", () => finish(false));
+    stream.once("error", () => finish(false));
+    stream.once("close", () => finish(false));
+}
+function forward(request, response, target, onError, onEvent) {
+    const flowId = onEvent ? randomUUID() : null;
+    if (onEvent) {
+        onEvent({ type: "request", flowId, method: request.method, url: target.href, headers: request.headers });
+        observeBody(request, "request_body", flowId, request.headers, onEvent);
+    }
+    const headers = { ...request.headers };
+    delete headers["proxy-connection"];
+    delete headers["proxy-authorization"];
+    const outgoing = (target.protocol === "https:" ? https : http).request(target, {
+        method: request.method,
+        headers,
+        agent: false,
+    }, (upstream) => {
+        if (onEvent) {
+            onEvent({ type: "response", flowId, status: upstream.statusCode || 502, headers: upstream.headers });
+            observeBody(upstream, "response_body", flowId, upstream.headers, onEvent);
+        }
+        response.writeHead(upstream.statusCode || 502, upstream.headers);
+        upstream.once("aborted", () => response.destroy());
+        upstream.once("error", (error) => {
+            onError(error, { flowId, phase: "upstream" });
+            response.destroy();
+        });
+        upstream.pipe(response);
+    });
+    outgoing.on("error", (error) => {
+        onError(error, { flowId, phase: "upstream" });
+        if (!response.headersSent) {
+            if (onEvent) {
+                onEvent({ type: "response", flowId, status: 502, headers: {} });
+                onEvent({ type: "response_body", flowId, headers: {}, body: Buffer.alloc(0), bytes: 0, truncated: false, complete: true });
+            }
+            response.writeHead(502);
+        }
+        response.end();
+    });
+    request.on("error", () => outgoing.destroy());
+    response.on("close", () => outgoing.destroy());
+    request.pipe(outgoing);
+}
+export function createNetworkProxy({ host = NETWORK_PROXY_HOST, port = NETWORK_PROXY_PORT, onError = () => { }, onEvent = null, loadCa = loadCertificateAuthority } = {}) {
+    let server;
+    let ca;
+    let intercepting = false;
+    let activeEvents = null;
+    const leaves = new Map();
+    const sockets = new Set();
+    const interceptedSockets = new Set();
+    function handleError(error, { flowId, connectionId, phase = "proxy", emit = null } = {}) {
+        if (emit)
+            emit({ type: "error", flowId, connectionId, phase, code: error.code || null, message: error.message });
+        onError(error);
+    }
+    async function destroySockets(group) {
+        await Promise.all([...group].map((socket) => new Promise((resolve) => {
+            if (socket.destroyed)
+                return resolve();
+            socket.once("close", resolve);
+            socket.destroy();
+        })));
+    }
+    function rejectRequest(response, error, emit, status = 400) {
+        handleError(error, { emit });
+        if (response.headersSent) {
+            response.destroy();
+            return;
+        }
+        response.writeHead(status);
+        response.end();
+    }
+    function isSelf(target) {
+        return target.port === server?.address()?.port && [host, "localhost", "127.0.0.1"].includes(target.host);
+    }
+    function handleRequest(request, response) {
+        const emit = activeEvents;
+        let target;
+        try {
+            target = new URL(request.url.startsWith("http:") ? request.url : `http://${request.headers.host}${request.url}`);
+            if (isSelf({ host: target.hostname, port: Number(target.port || 80) }))
+                throw new Error("Proxy loop rejected.");
+        }
+        catch (error) {
+            rejectRequest(response, error, emit);
+            return;
+        }
+        try {
+            forward(request, response, target, (error, details) => handleError(error, { ...details, emit }), emit);
+        }
+        catch (error) {
+            rejectRequest(response, error, emit, 502);
+        }
+    }
+    function forwardTunnel(socket, head, target) {
+        const upstream = net.connect(target.port, target.host);
+        sockets.add(upstream);
+        upstream.once("connect", () => {
+            socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            if (head.length)
+                upstream.write(head);
+            socket.pipe(upstream).pipe(socket);
+        });
+        upstream.on("error", (error) => {
+            handleError(error);
+            if (!socket.destroyed)
+                socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+        });
+        socket.on("error", () => upstream.destroy());
+        socket.on("close", () => upstream.destroy());
+        upstream.on("close", () => sockets.delete(upstream));
+    }
+    function interceptTls(request, socket, head, target, emit) {
+        const connectionId = randomUUID();
+        emit?.({ type: "connect", connectionId, host: target.host, port: target.port });
+        let leaf = leaves.get(target.host);
+        try {
+            if (!leaf) {
+                leaf = leafCertificate(target.host, ca);
+                leaves.set(target.host, leaf);
+            }
+        }
+        catch (error) {
+            socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+            handleError(error, { connectionId, phase: "certificate", emit });
+            return;
+        }
+        let decryptedRequests = 0;
+        let tlsEstablished = false;
+        const secureServer = https.createServer(leaf, (decryptedRequest, decryptedResponse) => {
+            decryptedRequests++;
+            try {
+                const url = new URL(decryptedRequest.url, `https://${request.url}`);
+                forward(decryptedRequest, decryptedResponse, url, (error, details) => handleError(error, { ...details, connectionId, emit }), emit);
+            }
+            catch (error) {
+                rejectRequest(decryptedResponse, error, emit, error?.code === "ERR_INVALID_URL" ? 400 : 502);
+            }
+        });
+        secureServer.on("secureConnection", () => { tlsEstablished = true; });
+        secureServer.on("tlsClientError", (error) => handleError(error, { connectionId, phase: "tls", emit }));
+        secureServer.on("clientError", (error) => handleError(error, { connectionId, phase: "client", emit }));
+        interceptedSockets.add(socket);
+        socket.on("close", () => {
+            interceptedSockets.delete(socket);
+            emit?.({ type: "connect_end", connectionId, decryptedRequests, tlsEstablished });
+        });
+        socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        if (head.length)
+            socket.unshift(head);
+        secureServer.emit("connection", socket);
+        socket.resume();
+    }
+    function handleConnect(request, socket, head) {
+        let target;
+        try {
+            target = destination(request.url);
+            if (isSelf(target))
+                throw new Error("Proxy loop rejected.");
+        }
+        catch (error) {
+            socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+            handleError(error);
+            return;
+        }
+        if (intercepting)
+            interceptTls(request, socket, head, target, activeEvents);
+        else
+            forwardTunnel(socket, head, target);
+    }
+    return {
+        get address() { return server?.address() || null; },
+        async start() {
+            if (server)
+                return server.address();
+            const next = http.createServer(handleRequest);
+            next.on("connect", handleConnect);
+            next.on("connection", (socket) => {
+                sockets.add(socket);
+                socket.on("close", () => sockets.delete(socket));
+            });
+            try {
+                await new Promise((resolve, reject) => {
+                    next.once("error", reject);
+                    next.listen(port, host, () => {
+                        next.off("error", reject);
+                        resolve();
+                    });
+                });
+            }
+            catch (error) {
+                next.close();
+                throw error;
+            }
+            server = next;
+            return server.address();
+        },
+        async beginInterception(emit = onEvent) {
+            if (intercepting)
+                throw new Error("Proxy interception is already active.");
+            ca = await loadCa();
+            leaves.clear();
+            activeEvents = emit;
+            intercepting = true;
+            await destroySockets(sockets);
+        },
+        async endInterception() {
+            intercepting = false;
+            activeEvents = null;
+            ca = null;
+            leaves.clear();
+            await destroySockets(interceptedSockets);
+        },
+        async stop() {
+            if (!server)
+                return;
+            const current = server;
+            server = null;
+            await this.endInterception();
+            await destroySockets(sockets);
+            await new Promise((resolve) => current.close(resolve));
+        },
+    };
+}