@tdxvolt/volt-client-grpc 0.1.0

package/src/utils.js

@@ -0,0 +1,105 @@
+import ip from "ip";
+import _ from "lodash";
+import forge from "node-forge";
+import bs58 from "bs58";
+
+import {constants} from "./constants.js";
+
+const {pki} = forge;
+
+export const createSecureContextOptions = (cryptoOptions) => {
+  const tlsOptions = {
+    cert: Buffer.from(cryptoOptions.cert),
+    ca: Buffer.from(cryptoOptions.ca),
+    key: Buffer.from(cryptoOptions.key),
+  };
+  return tlsOptions;
+};
+
+export const getServiceAddress = (mdnsService) => {
+  let address;
+
+  if (mdnsService.txtRecord && mdnsService.txtRecord.ip) {
+    // Use the advertised IP address if present.
+    address = `${mdnsService.txtRecord.ip}:${mdnsService.port}`;
+  } else {
+    // Find a valid ipv4 address.
+    const ipv4 = _.find(mdnsService.addresses, (addy) => ip.isV4Format(addy));
+    const serviceDetails = {
+      host: ipv4,
+      port: mdnsService.port,
+    };
+
+    address = `${serviceDetails.host}:${serviceDetails.port}`;
+  }
+
+  return address;
+};
+
+export const privateKeyToPem = (keyPair) => {
+  return pki.privateKeyToPem(keyPair.privateKey);
+};
+
+export const publicKeyToPem = (keyPair) => {
+  return pki.publicKeyToPem(keyPair.publicKey);
+};
+
+export const deserialisePEM = (pem) => {
+  return pem.replace(/\\r\\n/g, "\r\n");
+};
+
+export const removeCarriageReturn = (inp) => {
+  return inp.replace(/\r\n/g, "\n");
+};
+
+export const createBase58Hash = (inp) => {
+  const md = forge.md.sha256.create();
+  md.update(inp);
+  const hashBuf = Buffer.from(md.digest().getBytes(), "binary");
+  return bs58.encode(hashBuf);
+};
+
+export const createPublicKeyFingerprint = (key) => {
+  // Remove carriage returns before creating hash to bring into line with openSSL / volt format.
+  return createBase58Hash(removeCarriageReturn(key));
+};
+
+export const signBase64 = (key, msg) => {
+  const md = forge.md.sha256.create();
+  md.update(msg);
+  const signature = key.sign(md);
+  return forge.util.encode64(signature);
+};
+
+export const verifyBase64 = (key, msg, signature) => {
+  const md = forge.md.sha256.create();
+  md.update(msg);
+  return key.verify(md.digest().bytes(), forge.util.decode64(signature));
+};
+
+export const getDIDResolutionURL = (didIn) => {
+  const did = didIn.toLowerCase().split(":");
+  if (did.length < 3) {
+    return "";
+  }
+
+  if (did[0] !== "did") {
+    return "";
+  }
+
+  if (did[1] !== "tdx") {
+    return "";
+  }
+
+  let hostName;
+  let didGUID;
+  if (did.length === 3) {
+    hostName = constants.defaultDIDHostName;
+    didGUID = did[2];
+  } else {
+    hostName = did[2];
+    didGUID = did[3];
+  }
+
+  return `https://${hostName}/api/identity/${didGUID}`;
+};

package/src/volt-client-internal.js

@@ -0,0 +1,288 @@
+/* eslint-disable no-underscore-dangle */
+import debug from "debug";
+import ip from "ip";
+import bent from "bent";
+import forge from "node-forge";
+import lodash from "lodash";
+import VoltConnection from "./volt-connection.js";
+import {getServiceDescriptors} from "./proto-utils.js";
+import {createClient as createGrpcClient} from "./grpc-utils.js";
+import * as voltUtils from "./utils.js";
+import {constants} from "./constants.js";
+import GRPCCall from "./grpc-call.js";
+
+const {pki} = forge;
+const {filter, pick} = lodash;
+
+const log = debug("volt-client-grpc:volt-client-internal");
+const voltServices = [
+  constants.serviceType.voltAPI,
+  constants.serviceType.fileAPI,
+  constants.serviceType.sqliteServerAPI,
+  constants.serviceType.ssiAPI,
+  constants.serviceType.tunnelAPI,
+  constants.serviceType.wireAPI,
+];
+
+function issueBind(bindRequest, ttl) {
+  // eslint-disable-next-line no-use-before-define
+  return unaryCall.call(this, "Bind", bindRequest).then((bindResponse) => {
+    log("got binding request response %j", bindResponse);
+    if (bindResponse.status && bindResponse.status.code) {
+      log("error in bind response: %s", bindResponse.status.message);
+      return Promise.reject(new Error(bindResponse.status.message));
+    } else {
+      switch (bindResponse.decision) {
+        case "POLICY_DECISION_PERMIT":
+          //
+          // The request status is permit => cache the bind response info.
+          //
+
+          // This is the certificate assigned to us by the volt.
+          this._crypto.cache.cert = bindResponse.cert;
+
+          // This is the signing CA used by the volt (don't ov)
+          this._crypto.cache.ca = bindResponse.chain;
+
+          // Resource id is assigned by the volt.
+          this._crypto.cache.client_id = bindResponse.identity_id;
+          this._crypto.saveCache();
+          break;
+        case "POLICY_DECISION_DENY":
+          log(">>>>>>>>>>>>>>> access request is DENIED <<<<<<<<<<<<<<<<<<<");
+          break;
+        case "POLICY_DECISION_PROMPT":
+        case "POLICY_DECISION_PENDING":
+          log("access pending approval - waiting...");
+          break;
+        default:
+          log("ignoring unknown bind descision %s", bindResponse.status);
+          break;
+      }
+    }
+
+    return bindResponse.decision;
+  });
+}
+
+function findDIDDocumentService(document, serviceType) {
+  if (!document.service) {
+    return [];
+  }
+
+  const matches = filter(document.service, (svc) => svc.type === serviceType);
+  return matches;
+}
+
+export async function bindInternal() {
+  try {
+    // Build grpc client info.
+    if (this.isRemote) {
+      const getJSON = bent("json");
+      // @todo - currently Volt tunnel CA discovery is not secure.
+      const protocol =
+        this._config.tunnel_host?.startsWith("localhost:") || this._config.cloud_host?.startsWith("localhost:")
+          ? "http"
+          : "https";
+      const tunnelURL = `${protocol}://${this._config.tunnel_host || this._config.cloud_host}/info`;
+      log("attempting to retrieve tunnel information from %s", tunnelURL);
+      const tunnelInfo = await getJSON(tunnelURL);
+      if (!tunnelInfo.ca_pem) {
+        throw new Error("Unable to fetch tunnel CA - cannot securely connect.");
+      } else {
+        log("Auto-fetched tunnel CA %s, remote address %s", tunnelInfo.ca_pem, tunnelInfo.local_address);
+        this._crypto.cache.tunnel_ca_pem = tunnelInfo.ca_pem;
+        this._crypto.cache.tunnel_address = tunnelInfo.local_address;
+      }
+    }
+
+    if (!this._crypto.cache.ca) {
+      this._crypto.cache.ca = this._options.ca_pem;
+    }
+
+    if (!this._crypto.cache.ca) {
+      throw new Error("No certificate authority found in configuration for target Volt - check configuration");
+    }
+
+    const keyPair = this._crypto.getKey();
+    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+
+    if (!this._crypto.cache.bindIp) {
+      // Default the IP address if none is specified. This is used to set the SAN in the
+      // certificate issued by the Volt.
+      this._crypto.cache.bindIp = ip.address();
+    }
+
+    this._crypto.saveCache();
+
+    // Form the request message.
+    const bindRequest = {
+      binding_name: this._config.client_name,
+      public_key: publicKeyPem,
+      host: this._crypto.cache.bindIp,
+      x509_credential: [],
+    };
+
+    if (this._crypto.cache.cert) {
+      bindRequest.x509_credential = [this._crypto.cache.cert + this._crypto.cache.ca];
+    }
+
+    if (this._options.challenge_code) {
+      bindRequest.challenge = voltUtils.signBase64(keyPair.privateKey, this._options.challenge_code);
+    } else {
+      log("****no Volt challenge code available**** => not sending challenge signature");
+    }
+
+    // For remote connections, add our cloud-issued certificate as an additional credential.
+    if (this._crypto.cache.tunnel_ca_pem && this._crypto.cache.cloud_cert) {
+      bindRequest.x509_credential = bindRequest.x509_credential.concat(
+        this._crypto.cache.cloud_cert + this._crypto.cache.tunnel_ca_pem
+      );
+    }
+
+    log("sending %d x509 credentials", bindRequest.x509_credential.length);
+    log("bind TTL is ", this._config.bindRequestTTL);
+
+    // This will block while the request is pending.
+    const pollInterval = 10000;
+    let decision = "";
+    do {
+      if (decision) {
+        // Wait a while before retrying.
+        // eslint-disable-next-line no-await-in-loop
+        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+      }
+      // eslint-disable-next-line no-await-in-loop
+      decision = await issueBind.call(this, bindRequest, this._options.bindRequestTTL);
+      log("binding decision: %s", decision);
+    } while (decision === "POLICY_DECISION_PROMPT" || decision === "POLICY_DECISION_PENDING");
+
+    return decision === "POLICY_DECISION_PERMIT";
+  } catch (err) {
+    log("failure binding to Volt [%s]", err.message);
+    throw err;
+  }
+}
+
+export function connectInternal() {
+  try {
+    if (this._voltConnection) {
+      log("connectInternal - Volt connection already exists");
+      return Promise.resolve();
+    }
+
+    const onDisconnected = () => {
+      this._connected = false;
+      this._session = null;
+
+      if (this._cachedClient) {
+        this._grpc.closeClient(this._cachedClient);
+        this._cachedClient = null;
+      }
+
+      if (this._cachedRemoteClient) {
+        this._grpc.closeClient(this._cachedRemoteClient);
+        this._cachedRemoteClient = null;
+      }
+    };
+
+    this._voltConnection = new VoltConnection(this, this._grpc, this._options);
+
+    this._voltConnection.on("connected", (session) => {
+      this._session = session;
+      this._connected = !!session;
+      if (!this._connected) {
+        onDisconnected();
+      }
+      this.emit("connected", !!session);
+    });
+
+    this._voltConnection.on("error", (err) => {
+      // Should auto-reconnect.
+      log("Volt connection error [%s]", err.message);
+      if (this._connected) {
+        onDisconnected();
+        this.emit("connected", false);
+      }
+    });
+
+    this._voltConnection.on("evt", (evt) => {
+      this.emit("evt", evt);
+    });
+
+    return this._voltConnection.connect();
+  } catch (err) {
+    log("connect - error [%s]", err.message);
+    throw err;
+  }
+}
+
+export function getVoltAPIClientInternal() {
+  if (!this._cachedClient) {
+    const serviceAddress = this.isRemote ? this._crypto.cache.tunnel_address : this._options.local_address;
+    log("creating cached VoltAPI service client on %s", serviceAddress);
+    let serviceDescriptors = {};
+    voltServices.forEach((pkg) => {
+      const packageDescriptors = getServiceDescriptors(this._grpc, pkg);
+      serviceDescriptors = {...serviceDescriptors, ...packageDescriptors};
+    });
+
+    this._cachedClient = createGrpcClient(
+      this._grpc,
+      serviceDescriptors,
+      serviceAddress,
+      this._crypto.cache,
+      this.isRemote && !this.isVoltTunnel,
+      this._config.cloud_host ? this._options.id : "",
+      this._config.cloud_host ? this._options.id : ""
+    );
+  }
+
+  return this._cachedClient;
+}
+
+export function unaryCall(method, request) {
+  const grpcClient = this.getVoltAPIClient();
+
+  const call = new GRPCCall(this, method, "METHOD_TYPE_UNARY");
+  call.start(grpcClient, request);
+  return call.wait();
+}
+
+export async function fetchVoltConfig(volt_did) {
+  const didResolution = voltUtils.getDIDResolutionURL(volt_did);
+  if (!didResolution) {
+    throw new Error(`Invalid Volt DID: ${volt_did}`);
+  }
+
+  const getJSON = bent("json");
+  const didDocument = await getJSON(didResolution);
+  const voltConfigServices = findDIDDocumentService(didDocument, constants.didServiceType.voltConfig);
+  if (voltConfigServices.length !== 1) {
+    log(
+      "Unexpected number of Volt configuration endpoints found in DID document for %s, services found: %d",
+      volt_did,
+      voltConfigServices.length
+    );
+  }
+  const serviceEndpoint = voltConfigServices[0].serviceEndpoint;
+  const resolvedConfig = await getJSON(serviceEndpoint);
+
+  const voltConfig = pick(
+    resolvedConfig,
+    "id",
+    "display_name",
+    "public_key",
+    "fingerprint",
+    "local_address",
+    "ca_pem",
+    "challenge_code"
+  );
+
+  return {
+    volt: voltConfig,
+    tunnel_ca_pem: resolvedConfig.tunnel_ca_pem,
+    tunnel_address: resolvedConfig.tunnel_address,
+    cloud_host: resolvedConfig.tunnel_address.split(":")[0],
+  };
+}