@sentry/roach 0.2.0 → 0.3.0

package/src/addresses.ts

@@ -1,103 +0,0 @@
-/**
- * The addresses that the proxy can send requests to.
- *
- * A run names its own origins (`service.ts`). So without this check, a run
- * could make the service send requests into its own network: to the GCP
- * metadata server, which gives tokens of the VM service account, or to
- * other hosts in the VPC. The proxy sends requests only to public
- * addresses.
- *
- * The check is on the address that the connection uses, after DNS. A host
- * name that resolves to a public address for the check and to a private
- * one for the connection (DNS rebinding) thus does not get through.
- */
-import { lookup as dnsLookup, type LookupAddress } from "node:dns";
-import { BlockList, isIP, type LookupFunction } from "node:net";
-
-/**
- * Addresses that are not on the public internet: this host, private
- * networks, link-local (with the metadata server), shared, documentation,
- * multicast, and reserved ranges. IPv6 forms that hold an IPv4 address
- * (NAT64, 6to4, Teredo) are refused too, because they can lead to a
- * private IPv4 address. `BlockList` checks IPv4-mapped IPv6 addresses,
- * such as `::ffff:127.0.0.1`, as IPv4.
- */
-const NOT_PUBLIC = new BlockList();
-for (const [network, prefix] of [
-  ["0.0.0.0", 8],
-  ["10.0.0.0", 8],
-  ["100.64.0.0", 10],
-  ["127.0.0.0", 8],
-  ["169.254.0.0", 16],
-  ["172.16.0.0", 12],
-  ["192.0.0.0", 24],
-  ["192.0.2.0", 24],
-  ["192.88.99.0", 24],
-  ["192.168.0.0", 16],
-  ["198.18.0.0", 15],
-  ["198.51.100.0", 24],
-  ["203.0.113.0", 24],
-  ["224.0.0.0", 4],
-  ["240.0.0.0", 4],
-] as const) {
-  NOT_PUBLIC.addSubnet(network, prefix, "ipv4");
-}
-for (const [network, prefix] of [
-  ["::", 96],
-  ["64:ff9b::", 96],
-  ["64:ff9b:1::", 48],
-  ["100::", 64],
-  ["2001::", 23],
-  ["2001:db8::", 32],
-  ["2002::", 16],
-  ["fc00::", 7],
-  ["fe80::", 10],
-  ["fec0::", 10],
-  ["ff00::", 8],
-] as const) {
-  NOT_PUBLIC.addSubnet(network, prefix, "ipv6");
-}
-
-/** Check that an IP address is on the public internet. */
-export function isPublicAddress(address: string): boolean {
-  const family = isIP(address);
-  if (family === 0) return false;
-  return !NOT_PUBLIC.check(address, family === 6 ? "ipv6" : "ipv4");
-}
-
-/** The error of a request to an address that is not public. */
-export const notPublicError = (host: string, address: string) =>
-  Object.assign(
-    new Error(
-      `Roach does not send requests to ${host}, because ${address} is not a public address`,
-    ),
-    { status: 403, code: "ERR_ROACH_NOT_PUBLIC" },
-  );
-
-/**
- * A DNS lookup for `http.request()` that fails when the host has an
- * address that is not public. It checks all addresses of the host, so the
- * choice of the connection does not matter.
- */
-export const publicLookup: LookupFunction = (hostname, options, callback) => {
-  dnsLookup(hostname, { ...options, all: true }, (error, addresses) => {
-    if (error) {
-      callback(error, "", 0);
-      return;
-    }
-    const blocked = addresses.find(({ address }) => !isPublicAddress(address));
-    if (blocked) {
-      callback(notPublicError(hostname, blocked.address), "", 0);
-      return;
-    }
-    if (options.all) {
-      // The type has only the single-address form of the callback.
-      (callback as unknown as (e: null, list: LookupAddress[]) => void)(
-        null,
-        addresses,
-      );
-      return;
-    }
-    callback(null, addresses[0]!.address, addresses[0]!.family);
-  });
-};

package/src/certificates.ts

@@ -1,169 +0,0 @@
-/**
- * The certificate authority of Roach.
- *
- * The proxy intercepts HTTPS. It signs one certificate for each host when a
- * client first connects to that host, and signs it again before it
- * expires. Runs name their own hosts, so the authority keeps the
- * certificates of at most `MAX_HOSTS` hosts, and keeps no files for them.
- * Clients must trust the authority certificate. The service loads
- * a fixed one, so that clients can trust it across restarts.
- */
-import { execFile } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
-import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { isIP } from "node:net";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import tls from "node:tls";
-
-function openssl(args: string[]): Promise<void> {
-  return new Promise((resolve, reject) => {
-    execFile("openssl", args, (error, _stdout, stderr) => {
-      if (error)
-        reject(new Error(`openssl failed: ${stderr || error.message}`));
-      else resolve();
-    });
-  });
-}
-
-/** A certificate authority that signs a certificate for each host. */
-export interface CertificateAuthority {
-  /** The PEM certificate that clients must trust. */
-  caCert: string;
-  /** The TLS context for a host. Signs its certificate on first use. */
-  contextFor(host: string): Promise<tls.SecureContext>;
-  /** Delete the keys and certificates. */
-  close(): Promise<void>;
-}
-
-/** A PEM certificate authority, such as the one of a deployed service. */
-export interface CertificateAuthorityPem {
-  cert: string;
-  key: string;
-}
-
-/** Days that a host certificate is valid. */
-const HOST_DAYS = 7;
-/** Sign a host again when its certificate is older than this. */
-const RESIGN_MS = (HOST_DAYS - 1) * 24 * 60 * 60 * 1000;
-/** The hosts with a certificate in memory. More hosts drop the oldest one. */
-const MAX_HOSTS = 1000;
-
-/**
- * Create a certificate authority in a new temporary directory. Without
- * `pem`, it creates a new authority that is valid for 7 days.
- */
-export async function createCertificateAuthority(
-  pem?: CertificateAuthorityPem,
-): Promise<CertificateAuthority> {
-  const directory = await mkdtemp(path.join(tmpdir(), "roach-ca-"));
-  const caKey = path.join(directory, "ca.key");
-  const caCertFile = path.join(directory, "ca.crt");
-  const hostKey = path.join(directory, "host.key");
-  if (pem) {
-    await writeFile(caKey, pem.key, { mode: 0o600 });
-    await writeFile(caCertFile, pem.cert);
-  } else {
-    await createAuthority(caKey, caCertFile);
-  }
-  // All hosts share one key. Only their certificates differ.
-  await openssl(["genrsa", "-out", hostKey, "2048"]);
-  const hostKeyPem = await readFile(hostKey, "utf8");
-  const contexts = new Map<
-    string,
-    { signed: number; context: Promise<tls.SecureContext> }
-  >();
-
-  const sign = async (host: string): Promise<tls.SecureContext> => {
-    const name = createHash("sha256").update(host).digest("hex").slice(0, 16);
-    const csr = path.join(directory, `${name}.csr`);
-    const extensions = path.join(directory, `${name}.ext`);
-    const cert = path.join(directory, `${name}.crt`);
-    const bare = host.replace(/^\[|\]$/g, "");
-    const altName = isIP(bare) ? `IP:${bare}` : `DNS:${host}`;
-    await writeFile(
-      extensions,
-      `subjectAltName=${altName}\nextendedKeyUsage=serverAuth\n`,
-    );
-    await openssl([
-      "req",
-      "-new",
-      "-key",
-      hostKey,
-      "-subj",
-      "/CN=Roach host",
-      "-out",
-      csr,
-    ]);
-    await openssl([
-      "x509",
-      "-req",
-      "-in",
-      csr,
-      "-CA",
-      caCertFile,
-      "-CAkey",
-      caKey,
-      "-set_serial",
-      `0x${randomBytes(8).toString("hex")}`,
-      "-days",
-      String(HOST_DAYS),
-      "-extfile",
-      extensions,
-      "-out",
-      cert,
-    ]);
-    const certPem = await readFile(cert, "utf8");
-    await Promise.all(
-      [csr, extensions, cert].map((file) => rm(file, { force: true })),
-    );
-    return tls.createSecureContext({ cert: certPem, key: hostKeyPem });
-  };
-
-  return {
-    caCert: await readFile(caCertFile, "utf8"),
-    contextFor(host) {
-      const now = Date.now();
-      let entry = contexts.get(host);
-      if (!entry || now - entry.signed > RESIGN_MS) {
-        const fresh = { signed: now, context: sign(host) };
-        // A failed signature must not stay in the cache.
-        fresh.context.catch(() => {
-          if (contexts.get(host) === fresh) contexts.delete(host);
-        });
-        contexts.delete(host);
-        contexts.set(host, fresh);
-        // A map keeps the order of insertion, so the first key is the oldest.
-        if (contexts.size > MAX_HOSTS) {
-          contexts.delete(contexts.keys().next().value!);
-        }
-        entry = fresh;
-      }
-      return entry.context;
-    },
-    close: () => rm(directory, { force: true, recursive: true }),
-  };
-}
-
-/** Create a new authority that is valid for 7 days. */
-async function createAuthority(caKey: string, caCertFile: string) {
-  await openssl([
-    "req",
-    "-x509",
-    "-newkey",
-    "rsa:2048",
-    "-nodes",
-    "-keyout",
-    caKey,
-    "-out",
-    caCertFile,
-    "-days",
-    "7",
-    "-subj",
-    "/CN=Roach CA",
-    "-addext",
-    "basicConstraints=critical,CA:TRUE",
-    "-addext",
-    "keyUsage=critical,keyCertSign,cRLSign",
-  ]);
-}

package/src/cli.ts

@@ -1,35 +0,0 @@
-/**
- * The command line of Roach.
- *
- * `cli.ts service <config.json>` starts the shared service (`service.ts`)
- * with the configuration in the file. It prints the URL of the service as
- * one JSON line, and stops on SIGINT or SIGTERM. The deployed container
- * runs this command.
- */
-import { readFile } from "node:fs/promises";
-import { startRoachService, type RoachServiceConfig } from "./service.ts";
-
-const [command, ...args] = process.argv.slice(2);
-if (command !== "service" || args.length !== 1) {
-  process.stderr.write("Usage: cli.ts service <config.json>\n");
-  process.exit(2);
-}
-
-const config = JSON.parse(
-  await readFile(args[0]!, "utf8"),
-) as RoachServiceConfig;
-const service = await startRoachService(config);
-process.stdout.write(`${JSON.stringify({ url: service.url })}\n`);
-
-/** Stop on SIGINT or SIGTERM. A failed close logs its error and exits 1. */
-const stop = () => {
-  service.close().then(
-    () => process.exit(0),
-    (error: unknown) => {
-      process.stderr.write(`[roach] Close failed: ${String(error)}\n`);
-      process.exit(1);
-    },
-  );
-};
-process.once("SIGINT", stop);
-process.once("SIGTERM", stop);

package/src/gcs.ts

@@ -1,145 +0,0 @@
-/**
- * The GCS store: the recordings of the shared service (`service.ts`) in a
- * Google Cloud Storage bucket.
- *
- * Each recording is the object `<prefix><key>`. A lifecycle rule of the
- * bucket deletes it 30 days after it was written (`deploy/gcp/`), so
- * nothing here deletes recordings.
- *
- * The store calls the JSON API with `fetch`, and takes its access token
- * from the metadata server of the VM. So it needs no key file and no
- * Google SDK. Two standard variables change the hosts, for local tests:
- * `STORAGE_EMULATOR_HOST` (a URL) and `GCE_METADATA_HOST` (a host).
- */
-import {
-  formatRecording,
-  type Recording,
-  type RecordingStore,
-} from "./store.ts";
-
-/** A call that takes longer than this fails. */
-const TIMEOUT_MS = 30_000;
-/** Tries of one call. GCS asks clients to retry 429 and 5xx. */
-const TRIES = 3;
-/** Get a new token when the current one expires within this time. */
-const TOKEN_MARGIN_MS = 60_000;
-
-const isTemporary = (status: number) => status === 429 || status >= 500;
-const wait = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-
-/** `fetch`, with a timeout and retries of temporary failures. */
-async function call(url: string, init: RequestInit): Promise<Response> {
-  for (let attempt = 1; ; attempt += 1) {
-    try {
-      const response = await fetch(url, {
-        ...init,
-        signal: AbortSignal.timeout(TIMEOUT_MS),
-      });
-      if (!isTemporary(response.status) || attempt === TRIES) return response;
-      await response.body?.cancel();
-    } catch (error) {
-      if (attempt === TRIES) throw error;
-    }
-    await wait(250 * 2 ** attempt);
-  }
-}
-
-/** The access token of the VM service account, from the metadata server. */
-function createTokenSource(metadataHost: string): () => Promise<string> {
-  let cached: { token: string; expires: number } | undefined;
-  return async () => {
-    if (cached && cached.expires - TOKEN_MARGIN_MS > Date.now()) {
-      return cached.token;
-    }
-    const response = await call(
-      `http://${metadataHost}/computeMetadata/v1/instance/service-accounts/default/token`,
-      { headers: { "metadata-flavor": "Google" } },
-    );
-    if (!response.ok) {
-      throw new Error(
-        `GCE metadata token failed with HTTP ${response.status}: ${await response.text()}`,
-      );
-    }
-    const body = (await response.json()) as {
-      access_token: string;
-      expires_in: number;
-    };
-    cached = {
-      token: body.access_token,
-      expires: Date.now() + body.expires_in * 1000,
-    };
-    return cached.token;
-  };
-}
-
-/** Where the store sends its calls. */
-interface GcsHosts {
-  /** The base URL of the storage API. */
-  storage: string;
-  /** The host of the metadata server. */
-  metadata: string;
-}
-
-/** The hosts of GCS, or the ones of the standard variables. */
-function gcsHosts(env = process.env): GcsHosts {
-  return {
-    storage: (
-      env.STORAGE_EMULATOR_HOST ?? "https://storage.googleapis.com"
-    ).replace(/\/$/, ""),
-    metadata: env.GCE_METADATA_HOST ?? "metadata.google.internal",
-  };
-}
-
-/** The store of the recordings in `bucket`, under `prefix`. */
-export function createGcsStore(bucket: string, prefix: string): RecordingStore {
-  const hosts = gcsHosts();
-  const token = createTokenSource(hosts.metadata);
-  const bucketPath = `b/${encodeURIComponent(bucket)}/o`;
-
-  const writeOne = async ([key, recording]: [string, Recording]) => {
-    const name = encodeURIComponent(`${prefix}${key}`);
-    const response = await call(
-      `${hosts.storage}/upload/storage/v1/${bucketPath}?uploadType=media&name=${name}`,
-      {
-        method: "POST",
-        headers: {
-          authorization: `Bearer ${await token()}`,
-          "content-type": "application/json",
-        },
-        body: formatRecording(recording),
-      },
-    );
-    if (!response.ok) {
-      throw new Error(
-        `GCS write of ${key} failed with HTTP ${response.status}: ${await response.text()}`,
-      );
-    }
-    await response.body?.cancel();
-  };
-
-  return {
-    async read(key) {
-      const name = encodeURIComponent(`${prefix}${key}`);
-      const response = await call(
-        `${hosts.storage}/storage/v1/${bucketPath}/${name}?alt=media`,
-        { headers: { authorization: `Bearer ${await token()}` } },
-      );
-      if (response.status === 404) {
-        await response.body?.cancel();
-        return undefined;
-      }
-      if (!response.ok) {
-        throw new Error(
-          `GCS read of ${key} failed with HTTP ${response.status}: ${await response.text()}`,
-        );
-      }
-      return (await response.json()) as Recording;
-    },
-
-    // GCS does not say if an object changed, so each write counts.
-    async write(recordings) {
-      await Promise.all(recordings.map(writeOne));
-      return recordings.length;
-    },
-  };
-}