@tdxvolt/volt-client-grpc 0.1.0

package/src/volt-crypto.js

@@ -0,0 +1,213 @@
+/* eslint-disable no-underscore-dangle */
+import debug from "debug";
+import fs from "fs";
+import forge from "node-forge";
+import jwt from "jsonwebtoken";
+import crypto from "crypto";
+import * as voltUtils from "./utils.js";
+import {constants} from "./constants.js";
+
+const {pki} = forge;
+const log = debug("volt-client-grpc:volt-crypto");
+const aesAlgorithm = "aes-256-cbc";
+const rs256Algorithm = "RS256";
+
+export class VoltCrypto {
+  constructor(config, configPath) {
+    this._config = config;
+    this._voltConfig = config.volt;
+    this._configPath = configPath;
+    this._persistCache = !!configPath;
+
+    if (!this._config.crypto) {
+      this._cryptoCache = {};
+    } else {
+      this._cryptoCache = this._config.crypto;
+    }
+
+    // Determine if we're dealing with an encrypted key.
+    if (this._cryptoCache.key && this._cryptoCache.key.startsWith(constants.privateEncryptedKeyPrefix)) {
+      if (!config.p) {
+        throw new Error("encrypted key but no passphrase given");
+      }
+
+      // Need to unencrypt the private key.
+      const decrypted = pki.decryptRsaPrivateKey(this._cryptoCache.key, config.p);
+      if (!decrypted) {
+        throw new Error("failed to decrypt key - check passphrase");
+      }
+      this._cryptoCache.key = pki.privateKeyToPem(decrypted);
+    }
+
+    if (this._voltConfig.ca_pem) {
+      if (!this._cryptoCache.ca) {
+        // Copy the volt signing CA to the crypto cache.
+        this._cryptoCache.ca = this._voltConfig.ca_pem;
+      }
+
+      // Pre-cache the target Volt public key by extracting it from the signing certificate.
+      const voltCert = forge.pki.certificateFromPem(this._voltConfig.ca_pem);
+
+      // Extract Volt public key (used for encrypting tunnel payloads).
+      this._voltPublicKey = forge.pki.publicKeyToPem(voltCert.publicKey);
+      this._voltFingerprint = voltUtils.createPublicKeyFingerprint(this._voltPublicKey);
+    }
+  }
+
+  get cache() {
+    return this._cryptoCache;
+  }
+
+  get voltFingerprint() {
+    return this._voltFingerprint;
+  }
+
+  getKey() {
+    const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
+    const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e);
+    return {privateKey, publicKey};
+  }
+
+  /**
+   * Retrieves and re-hydrates the pub/priv key data from the crypto cache, or creates one if not found.
+   */
+  createKey() {
+    if (!this._cryptoCache.key) {
+      log("creating key");
+      return new Promise((resolve, reject) => {
+        pki.rsa.generateKeyPair({bits: 2048, workers: -1}, (err, keypair) => {
+          if (err) {
+            log("failure creating key [%s]", err.message);
+            reject(err);
+          } else {
+            log("successfully created key");
+            const pem = pki.privateKeyToPem(keypair.privateKey);
+            this._cryptoCache.key = pem;
+            resolve(keypair);
+          }
+        });
+      });
+    } else {
+      // Already have key data in the cache in pem format => create fully-formed pki instances.
+      log("createKey - key already exists");
+      return Promise.resolve(this.getKey());
+    }
+  }
+
+  /**
+   * Create cryptocache from scratch.
+   */
+  initialise() {
+    return this.createKey()
+      .then((/* keypair */) => {
+        return this.saveCache();
+      })
+      .then(() => {
+        return this._cryptoCache;
+      })
+      .catch((err) => {
+        log("failure initialising crypto [%s]", err.message);
+        return Promise.reject(err);
+      });
+  }
+
+  get isBound() {
+    return !!this._cryptoCache.cert;
+  }
+
+  /**
+   * Signs the identity resource id using the private key.
+   * @param {*} audience the token audience (usually the target volt)
+   * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
+   * @param {*} ttl time to live in seconds (default to 1 minute)
+   */
+  getIdentityToken(audience, tunnelling = false, ttl = 60) {
+    if (!this._cryptoCache.key) {
+      throw new Error("crypto cache invalid");
+    }
+
+    const keyPair = this.getKey();
+    const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+    const base58Key = voltUtils.createPublicKeyFingerprint(publicKeyPem);
+
+    log("base58 key is %s", base58Key);
+
+    // Allow TTL either side of the current time.
+    // @todo - fix with server time sync on volt connection.
+    const payload = {
+      aud: audience,
+      iat: Math.floor(Date.now() / 1000) - ttl,
+      exp: Math.floor(Date.now() / 1000) + ttl,
+    };
+
+    let sharedKey;
+    if (tunnelling) {
+      // Initialise the tunnel encryption key.
+      sharedKey = VoltCrypto.aesCreateKey();
+
+      // Encrypt the key details using the target Volt public key and include this in the JWT payload.
+      payload.sk = VoltCrypto.rsaEncrypt(this._voltPublicKey, sharedKey.key);
+      payload.iv = VoltCrypto.rsaEncrypt(this._voltPublicKey, sharedKey.iv);
+    }
+
+    // Sign synchronously.
+    const token = jwt.sign(payload, this._cryptoCache.key, {algorithm: rs256Algorithm, keyid: base58Key});
+
+    // Return the token along with any encryption key details.
+    return {
+      token,
+      sharedKey,
+    };
+  }
+
+  /**
+   * Creates the metadata required for a grpc call, including the Volt authentication token
+   * and optionally tunnel encryption parameters.
+   * @param {*} grpc
+   * @param {*} audience
+   * @param {*} tunnelling
+   * @param {*} ttl
+   * @returns
+   */
+  getIdentityMetadata(grpc, audience, tunnelling = false, ttl = 10) {
+    const identityToken = this.getIdentityToken(audience || this._voltConfig.id, tunnelling, ttl);
+    const metadata = new grpc.Metadata();
+    metadata.add(constants.authTokenName, identityToken.token);
+    return {...identityToken, metadata};
+  }
+
+  saveCache() {
+    if (this._persistCache) {
+      const clone = {...this._config, crypto: {...this._cryptoCache}};
+      if (this._config.p) {
+        // A passphrase option exists => encrypt the key before writing the cache file.
+        const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
+        clone.crypto.key = pki.encryptRsaPrivateKey(privateKey, this._config.p);
+      }
+      fs.writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
+    }
+  }
+
+  static aesCreateKey() {
+    // Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
+    const key = crypto.randomBytes(32);
+    const iv = crypto.randomBytes(16);
+    return {key, iv};
+  }
+
+  static aesEncrypt(buffer, key, iv) {
+    const cipher = crypto.createCipheriv(aesAlgorithm, key, iv);
+    const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
+    return crypted;
+  }
+
+  static aesDecrypt(buffer, key, iv) {
+    const cipher = crypto.createDecipheriv(aesAlgorithm, key, iv);
+    const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
+    return decrypted;
+  }
+
+  static rsaEncrypt(key, buffer) {
+    return crypto.publicEncrypt(key, buffer).toString("base64");
+  }
+}