@rstreamlabs/tunnels 3.8.0 → 3.8.1

package/dist/index.js

@@ -1781,6 +1781,7 @@ var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
+var maxTURNKeyringBytes = 8 * 1024;
 var turnTokenClaimsSchema = z8.object({
   exp: z8.number().int().optional(),
   iat: z8.number().int().optional(),
@@ -1909,6 +1910,75 @@ function resolveMode(credentials, mode) {
   }
   return "api";
 }
+async function readBoundedTURNKeyring(reader, chunks = [], size = 0) {
+  const result = await reader.read();
+  if (result.done) {
+    return Buffer.concat(chunks, size).toString("utf8");
+  }
+  const nextSize = size + result.value.byteLength;
+  if (nextSize > maxTURNKeyringBytes) {
+    await reader.cancel();
+    throw new Error("TURN keyring response exceeds the 8 KiB limit.");
+  }
+  return await readBoundedTURNKeyring(
+    reader,
+    [...chunks, result.value],
+    nextSize
+  );
+}
+function parseTURNServerPublicKeyHex(value) {
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(normalized)) {
+    throw new Error("TURN keyring must contain hexadecimal DER key material.");
+  }
+  try {
+    const key = import_crypto.default.createPublicKey({
+      key: Buffer.from(normalized, "hex"),
+      format: "der",
+      type: "spki"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN keyring public key must be an EC key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN keyring")) {
+      throw error;
+    }
+    throw new Error("TURN keyring contains an invalid DER public key.", {
+      cause: error
+    });
+  }
+}
+function parseAPPPrivateKey(value) {
+  try {
+    const key = import_crypto.default.createPrivateKey({
+      key: Buffer.from(value, "hex"),
+      format: "der",
+      type: "pkcs8"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN APP client secret must contain an EC private key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN APP")) {
+      throw error;
+    }
+    throw new Error("TURN APP client secret contains an invalid private key.", {
+      cause: error
+    });
+  }
+}
+function requireMatchingCurve(privateKey, publicKey) {
+  const privateCurve = privateKey.asymmetricKeyDetails?.namedCurve;
+  const publicCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+  if (!privateCurve || privateCurve !== publicCurve) {
+    throw new Error(
+      "TURN APP client and server keys must use the same named curve."
+    );
+  }
+}
 async function loadTURNServerPublicKeyHex(clusterDomain, options) {
   const configuredKey = normalizeOptionalString2(options.keyringBaseUrl);
   const keyringBaseURL = configuredKey ?? normalizeOptionalString2(options.apiUrl) ?? "https://rstream.io";
@@ -1916,11 +1986,19 @@ async function loadTURNServerPublicKeyHex(clusterDomain, options) {
     `/keyrings/turn/${clusterDomain}.spki.der.hex`,
     keyringBaseURL
   );
-  const response = await fetch(url);
+  const response = await fetch(url, { redirect: "manual" });
+  if (response.status >= 300 && response.status < 400) {
+    throw new Error(
+      "TURN keyring request was redirected; redirects are refused."
+    );
+  }
   if (!response.ok) {
-    throw new Error("Failed to load TURN keyring.");
+    throw new Error(`TURN keyring request returned HTTP ${response.status}.`);
+  }
+  if (!response.body) {
+    throw new Error("TURN keyring response body is missing.");
   }
-  return (await response.text()).trim();
+  return (await readBoundedTURNKeyring(response.body.getReader())).trim();
 }
 async function createAPITURNCredentials(options) {
   const projectId = normalizeOptionalString2(options.projectId);
@@ -2019,17 +2097,10 @@ async function createAPPTURNCredentials(options) {
   const ttlSeconds = normalizeTTLSeconds(options.ttlSeconds);
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
-  const clientPrivateKey = import_crypto.default.createPrivateKey({
-    key: Buffer.from(clientSecret, "hex"),
-    format: "der",
-    type: "pkcs8"
-  });
+  const clientPrivateKey = parseAPPPrivateKey(clientSecret);
   const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
-  const serverPublicKey = import_crypto.default.createPublicKey({
-    key: Buffer.from(serverPublicKeyHex, "hex"),
-    format: "der",
-    type: "spki"
-  });
+  const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
+  requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = import_crypto.default.diffieHellman({
     privateKey: clientPrivateKey,
     publicKey: serverPublicKey

package/dist/index.mjs

@@ -418,6 +418,7 @@ var defaultTURNPort = 3478;
 var defaultTURNSPort = 5349;
 var defaultTURNCredentialTTLSeconds = 10 * 60;
 var maxTURNCredentialTTLSeconds = 60 * 60;
+var maxTURNKeyringBytes = 8 * 1024;
 var turnTokenClaimsSchema = z.object({
   exp: z.number().int().optional(),
   iat: z.number().int().optional(),
@@ -546,6 +547,75 @@ function resolveMode(credentials, mode) {
   }
   return "api";
 }
+async function readBoundedTURNKeyring(reader, chunks = [], size = 0) {
+  const result = await reader.read();
+  if (result.done) {
+    return Buffer.concat(chunks, size).toString("utf8");
+  }
+  const nextSize = size + result.value.byteLength;
+  if (nextSize > maxTURNKeyringBytes) {
+    await reader.cancel();
+    throw new Error("TURN keyring response exceeds the 8 KiB limit.");
+  }
+  return await readBoundedTURNKeyring(
+    reader,
+    [...chunks, result.value],
+    nextSize
+  );
+}
+function parseTURNServerPublicKeyHex(value) {
+  const normalized = value.trim();
+  if (normalized.length === 0 || normalized.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(normalized)) {
+    throw new Error("TURN keyring must contain hexadecimal DER key material.");
+  }
+  try {
+    const key = crypto.createPublicKey({
+      key: Buffer.from(normalized, "hex"),
+      format: "der",
+      type: "spki"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN keyring public key must be an EC key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN keyring")) {
+      throw error;
+    }
+    throw new Error("TURN keyring contains an invalid DER public key.", {
+      cause: error
+    });
+  }
+}
+function parseAPPPrivateKey(value) {
+  try {
+    const key = crypto.createPrivateKey({
+      key: Buffer.from(value, "hex"),
+      format: "der",
+      type: "pkcs8"
+    });
+    if (key.asymmetricKeyType !== "ec") {
+      throw new Error("TURN APP client secret must contain an EC private key.");
+    }
+    return key;
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("TURN APP")) {
+      throw error;
+    }
+    throw new Error("TURN APP client secret contains an invalid private key.", {
+      cause: error
+    });
+  }
+}
+function requireMatchingCurve(privateKey, publicKey) {
+  const privateCurve = privateKey.asymmetricKeyDetails?.namedCurve;
+  const publicCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+  if (!privateCurve || privateCurve !== publicCurve) {
+    throw new Error(
+      "TURN APP client and server keys must use the same named curve."
+    );
+  }
+}
 async function loadTURNServerPublicKeyHex(clusterDomain, options) {
   const configuredKey = normalizeOptionalString2(options.keyringBaseUrl);
   const keyringBaseURL = configuredKey ?? normalizeOptionalString2(options.apiUrl) ?? "https://rstream.io";
@@ -553,11 +623,19 @@ async function loadTURNServerPublicKeyHex(clusterDomain, options) {
     `/keyrings/turn/${clusterDomain}.spki.der.hex`,
     keyringBaseURL
   );
-  const response = await fetch(url);
+  const response = await fetch(url, { redirect: "manual" });
+  if (response.status >= 300 && response.status < 400) {
+    throw new Error(
+      "TURN keyring request was redirected; redirects are refused."
+    );
+  }
   if (!response.ok) {
-    throw new Error("Failed to load TURN keyring.");
+    throw new Error(`TURN keyring request returned HTTP ${response.status}.`);
+  }
+  if (!response.body) {
+    throw new Error("TURN keyring response body is missing.");
   }
-  return (await response.text()).trim();
+  return (await readBoundedTURNKeyring(response.body.getReader())).trim();
 }
 async function createAPITURNCredentials(options) {
   const projectId = normalizeOptionalString2(options.projectId);
@@ -656,17 +734,10 @@ async function createAPPTURNCredentials(options) {
   const ttlSeconds = normalizeTTLSeconds(options.ttlSeconds);
   const exp = normalizeNow(options.now) + ttlSeconds;
   const username = `v1:${exp}:app:${projectEndpoint}:${clientId}`;
-  const clientPrivateKey = crypto.createPrivateKey({
-    key: Buffer.from(clientSecret, "hex"),
-    format: "der",
-    type: "pkcs8"
-  });
+  const clientPrivateKey = parseAPPPrivateKey(clientSecret);
   const serverPublicKeyHex = normalizeOptionalString2(options.serverPublicKeyHex) ?? await loadTURNServerPublicKeyHex(clusterDomain, options);
-  const serverPublicKey = crypto.createPublicKey({
-    key: Buffer.from(serverPublicKeyHex, "hex"),
-    format: "der",
-    type: "spki"
-  });
+  const serverPublicKey = parseTURNServerPublicKeyHex(serverPublicKeyHex);
+  requireMatchingCurve(clientPrivateKey, serverPublicKey);
   const sharedSecret = crypto.diffieHellman({
     privateKey: clientPrivateKey,
     publicKey: serverPublicKey

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rstreamlabs/tunnels",
-  "version": "3.8.0",
+  "version": "3.8.1",
   "description": "JS/TS SDK for the rstream Engine API and tunnel runtime APIs.",
   "author": "@uartnet <hello@rstream.io>",
   "repository": {