@tdxvolt/volt-client-grpc 0.1.1 → 0.1.2

package/src/volt-connection.js

@@ -7,151 +7,160 @@ import GRPCCall from "./grpc-call.js";
 const log = debug("volt-client-grpc:volt-connection");
 
 function _cleanUp(immediateReconnect) {
-  this._session = false;
-
-  if (this._pingTimer) {
-    clearTimeout(this._pingTimer);
-    this._pingTimer = 0;
-  }
-
-  if (this._pingTimeoutTimer) {
-    clearTimeout(this._pingTimeoutTimer);
-    this._pingTimeoutTimer = 0;
-  }
-
-  if (!this._dying && (immediateReconnect || (this._autoRetry && !this._reconnectTimer))) {
-    this._reconnectTimer = setTimeout(
-      () => {
-        this._reconnectTimer = 0;
-        _doConnect.call(this);
-      },
-      immediateReconnect ? 0 : this._reconnectInterval
-    );
-  }
-
-  if (this.call && this.call.writable) {
-    this.call.end();
-  }
+	this._session = false;
+
+	if (this._pingTimer) {
+		clearTimeout(this._pingTimer);
+		this._pingTimer = 0;
+	}
+
+	if (this._pingTimeoutTimer) {
+		clearTimeout(this._pingTimeoutTimer);
+		this._pingTimeoutTimer = 0;
+	}
+
+	if (
+		!this._dying &&
+		(immediateReconnect || (this._autoRetry && !this._reconnectTimer))
+	) {
+		this._reconnectTimer = setTimeout(
+			() => {
+				this._reconnectTimer = 0;
+				_doConnect.call(this);
+			},
+			immediateReconnect ? 0 : this._reconnectInterval,
+		);
+	}
+
+	if (this.call?.writable) {
+		this.call.end();
+	}
 }
 
 function _connectionTimeoutHandler() {
-  log("server timed out");
-  this.emit("connected", false);
-  _cleanUp.call(this);
+	log("server timed out");
+	this.emit("connected", false);
+	_cleanUp.call(this);
 }
 
 function _doConnect() {
-  this.call = new GRPCCall(this._voltClient, "Connect", "METHOD_TYPE_BIDI");
-
-  const grpcClient = this._voltClient.getVoltAPIClient();
-  const helloPayload = {
-    hello: {},
-  };
-
-  this.call.start(grpcClient, helloPayload, (err, response) => {
-    if (err) {
-      log("error on connection stream [%s]", err.message);
-      _cleanUp.call(this);
-      this.emit("error", err);
-    } else {
-      switch (response.payload) {
-        case "ping": {
-          log("pinged");
-
-          // Received ping response from server => clear timeout.
-          if (this._pingTimeoutTimer) {
-            clearTimeout(this._pingTimeoutTimer);
-          }
-
-          // Schedule the next ping.
-          _startPingTimer.call(this);
-          break;
-        }
-        case "hello":
-          if (!this._session) {
-            this._session = true;
-            this.emit("connected", this._session);
-          }
-          break;
-        case "evt":
-          log("received event %s", response.evt.event_type);
-          this.emit("evt", response.evt);
-          break;
-        default:
-          log("unimplemented connect response payload: %s", response.payload);
-          break;
-      }
-    }
-  });
-
-  this.call
-    .wait()
-    .then(() => {
-      if (this._session) {
-        this.emit("connected", false);
-      }
-    })
-    .catch((err) => {
-      log("unexpected error on connect call [%s]", err.message);
-    })
-    .finally(() => {
-      _cleanUp.call(this);
-    });
-
-  _startPingTimer.call(this);
+	this.call = new GRPCCall(this._voltClient, "Connect", "METHOD_TYPE_BIDI");
+
+	const grpcClient = this._voltClient.getVoltAPIClient();
+	const helloPayload = {
+		hello: {},
+	};
+
+	this.call.start(grpcClient, helloPayload, (err, response) => {
+		if (err) {
+			log("error on connection stream [%s]", err.message);
+			_cleanUp.call(this);
+			this.emit("error", err);
+		} else {
+			switch (response.payload) {
+				case "ping": {
+					log("pinged");
+
+					// Received ping response from server => clear timeout.
+					if (this._pingTimeoutTimer) {
+						clearTimeout(this._pingTimeoutTimer);
+					}
+
+					// Schedule the next ping.
+					_startPingTimer.call(this);
+					break;
+				}
+				case "hello": {
+					if (!this._session) {
+						this._session = true;
+						this.emit("connected", this._session);
+					}
+					break;
+				}
+				case "evt": {
+					log("received event %s", response.evt.event_type);
+					this.emit("evt", response.evt);
+					break;
+				}
+				default:
+					log("unimplemented connect response payload: %s", response.payload);
+					break;
+			}
+		}
+	});
+
+	this.call
+		.wait()
+		.then(() => {
+			if (this._session) {
+				this.emit("connected", false);
+			}
+		})
+		.catch((err) => {
+			log("unexpected error on connect call [%s]", err.message);
+		})
+		.finally(() => {
+			_cleanUp.call(this);
+		});
+
+	_startPingTimer.call(this);
 }
 
 function _startPingTimer() {
-  if (this._pingTimer) {
-    log("ping timer running");
-    return;
-  }
-
-  this._pingTimer = setTimeout(() => {
-    // Send next ping to server.
-    const request = {ping: {timestamp: Date.now()}};
-
-    log("pinging Volt");
-    this.call.write(request);
-
-    this._pingTimer = 0;
-
-    // Schedule a timeout if we don't hear back from the server.
-    if (this._pingTimeoutTimer) {
-      clearTimeout(this._pingTimeoutTimer);
-    }
-
-    this._pingTimeoutTimer = setTimeout(_connectionTimeoutHandler.bind(this), this._timeoutInterval);
-  }, this._pingInterval);
+	if (this._pingTimer) {
+		log("ping timer running");
+		return;
+	}
+
+	this._pingTimer = setTimeout(() => {
+		// Send next ping to server.
+		const request = { ping: { timestamp: Date.now() } };
+
+		log("pinging Volt");
+		this.call.write(request);
+
+		this._pingTimer = 0;
+
+		// Schedule a timeout if we don't hear back from the server.
+		if (this._pingTimeoutTimer) {
+			clearTimeout(this._pingTimeoutTimer);
+		}
+
+		this._pingTimeoutTimer = setTimeout(
+			_connectionTimeoutHandler.bind(this),
+			this._timeoutInterval,
+		);
+	}, this._pingInterval);
 }
 
 export default class VoltConnection extends EventEmitter {
-  constructor(voltClient, grpc, options = {}) {
-    super();
-
-    this._grpc = grpc;
-    this._autoRetry = options.autoReconnect === undefined ? true : !!options.autoReconnect;
-    this._dying = false;
-    this._voltClient = voltClient;
-    this._options = options;
-    this._pingTimer = 0;
-    this._pingTimeoutTimer = 0;
-    this._session = false;
-    this._pingInterval = options.pingInterval || 10000;
-    this._reconnectInterval = options.reconnectInterval || 5000;
-    this._timeoutInterval = options.timeoutInterval || 60000;
-  }
-
-  connect(throwOnFail) {
-    if (throwOnFail) {
-      return _doConnect.call(this);
-    } else {
-      return Promise.resolve(_cleanUp.call(this, true));
-    }
-  }
-
-  disconnect() {
-    this._dying = true;
-    _cleanUp.call(this);
-  }
+	constructor(voltClient, grpc) {
+		super();
+
+		const config = voltClient.config;
+		this._grpc = grpc;
+		this._autoRetry =
+			config.autoReconnect === undefined ? true : !!config.autoReconnect;
+		this._dying = false;
+		this._voltClient = voltClient;
+		this._pingTimer = 0;
+		this._pingTimeoutTimer = 0;
+		this._session = false;
+		this._pingInterval = config.pingInterval || 10000;
+		this._reconnectInterval = config.reconnectInterval || 5000;
+		this._timeoutInterval = config.timeoutInterval || 60000;
+	}
+
+	connect(throwOnFail) {
+		if (throwOnFail) {
+			return _doConnect.call(this);
+		} else {
+			return Promise.resolve(_cleanUp.call(this, true));
+		}
+	}
+
+	disconnect() {
+		this._dying = true;
+		_cleanUp.call(this);
+	}
 }

package/src/volt-credential.js

@@ -0,0 +1,237 @@
+/* eslint-disable no-underscore-dangle */
+import debug from "debug";
+import fs from "fs";
+import forge from "node-forge";
+import jwt from "jsonwebtoken";
+import crypto from "crypto";
+import * as voltUtils from "./utils.js";
+import { constants } from "./constants.js";
+
+const { pki } = forge;
+const log = debug("volt-client-grpc:volt-credential");
+const aesAlgorithm = "aes-256-cbc";
+const rs256Algorithm = "RS256";
+
+export class VoltCredential {
+	constructor(config, configPath) {
+		this._config = config;
+		this._voltConfig = config.volt;
+		this._configPath = configPath;
+		this._persistCache = !!configPath;
+
+		if (this._config.credential) {
+			this._cryptoCache = this._config.credential;
+		} else {
+			this._cryptoCache = {};
+		}
+
+		// Determine if we're dealing with an encrypted key.
+		if (
+			this._cryptoCache.key?.startsWith(constants.privateEncryptedKeyPrefix)
+		) {
+			if (!config.p) {
+				throw new Error("encrypted key but no passphrase given");
+			}
+
+			// Need to unencrypt the private key.
+			const decrypted = pki.decryptRsaPrivateKey(
+				this._cryptoCache.key,
+				config.p,
+			);
+			if (!decrypted) {
+				throw new Error("failed to decrypt key - check passphrase");
+			}
+			this._cryptoCache.key = pki.privateKeyToPem(decrypted);
+		}
+
+		if (this._voltConfig.ca_pem) {
+			if (!this._cryptoCache.ca) {
+				// Copy the volt signing CA to the crypto cache.
+				this._cryptoCache.ca = this._voltConfig.ca_pem;
+			}
+
+			// Pre-cache the target Volt public key by extracting it from the signing certificate.
+			const voltCert = forge.pki.certificateFromPem(this._voltConfig.ca_pem);
+
+			// Extract Volt public key (used for encrypting Relay payloads).
+			this._voltPublicKey = forge.pki.publicKeyToPem(voltCert.publicKey);
+			this._voltFingerprint = voltUtils.createPublicKeyFingerprint(
+				this._voltPublicKey,
+			);
+		}
+	}
+
+	get config() {
+		return this._config;
+	}
+
+	get cache() {
+		return this._cryptoCache;
+	}
+
+	get voltFingerprint() {
+		return this._voltFingerprint;
+	}
+
+	getKey() {
+		const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
+		const publicKey = pki.rsa.setPublicKey(privateKey.n, privateKey.e);
+		return { privateKey, publicKey };
+	}
+
+	/**
+	 * Retrieves and re-hydrates the pub/priv key data from the crypto cache, or creates one if not found.
+	 */
+	createKey() {
+		if (this._cryptoCache.key) {
+			// Already have key data in the cache in pem format => create fully-formed pki instances.
+			log("createKey - key already exists");
+			return Promise.resolve(this.getKey());
+		} else {
+			log("creating key");
+			return new Promise((resolve, reject) => {
+				pki.rsa.generateKeyPair({ bits: 2048, workers: -1 }, (err, keypair) => {
+					if (err) {
+						log("failure creating key [%s]", err.message);
+						reject(err);
+					} else {
+						log("successfully created key");
+						const pem = pki.privateKeyToPem(keypair.privateKey);
+						this._cryptoCache.key = pem;
+						resolve(keypair);
+					}
+				});
+			});
+		}
+	}
+
+	/**
+	 * Create cryptocache from scratch.
+	 */
+	initialise() {
+		return this.createKey()
+			.then((/* keypair */) => {
+				return this.saveCache();
+			})
+			.then(() => {
+				return this._cryptoCache;
+			})
+			.catch((err) => {
+				log("failure initialising crypto [%s]", err.message);
+				return Promise.reject(err);
+			});
+	}
+
+	get isBound() {
+		return !!this._cryptoCache.cert;
+	}
+
+	/**
+	 * Signs the identity resource id using the private key.
+	 * @param {*} audience the token audience (usually the target volt)
+	 * @param {*} tunnelling flag indicating if the token is required for a tunnelled connection
+	 * @param {*} ttl time to live in seconds (default to 1 minute)
+	 */
+	getIdentityToken(audience, tunnelling = false, ttl = 60) {
+		if (!this._cryptoCache.key) {
+			throw new Error("crypto cache invalid");
+		}
+
+		const keyPair = this.getKey();
+		const publicKeyPem = pki.publicKeyToPem(keyPair.publicKey);
+		const base58Key = voltUtils.createPublicKeyFingerprint(publicKeyPem);
+
+		log("base58 key is %s", base58Key);
+
+		// Allow TTL either side of the current time.
+		// @todo - fix with server time sync on volt connection.
+		const payload = {
+			aud: audience,
+			iat: Math.floor(Date.now() / 1000) - ttl,
+			exp: Math.floor(Date.now() / 1000) + ttl,
+		};
+
+		let sharedKey;
+		if (tunnelling) {
+			// Initialise the Relay encryption key.
+			sharedKey = VoltCredential.aesCreateKey();
+
+			// Encrypt the key details using the target Volt public key and include this in the JWT payload.
+			payload.sk = VoltCredential.rsaEncrypt(
+				this._voltPublicKey,
+				sharedKey.key,
+			);
+			payload.iv = VoltCredential.rsaEncrypt(this._voltPublicKey, sharedKey.iv);
+		}
+
+		// Sign synchronously.
+		const token = jwt.sign(payload, this._cryptoCache.key, {
+			algorithm: rs256Algorithm,
+			keyid: base58Key,
+		});
+
+		// Return the token along with any encryption key details.
+		return {
+			token,
+			sharedKey,
+		};
+	}
+
+	/**
+	 * Creates the metadata required for a grpc call, including the Volt authentication token
+	 * and optionally tunnel encryption parameters.
+	 * @param {*} grpc
+	 * @param {*} audience
+	 * @param {*} tunnelling
+	 * @param {*} ttl
+	 * @returns
+	 */
+	getIdentityMetadata(grpc, audience, tunnelling = false, ttl = 60) {
+		const identityToken = this.getIdentityToken(
+			audience || this._voltConfig.id,
+			tunnelling,
+			ttl,
+		);
+		const metadata = new grpc.Metadata();
+		metadata.add(constants.authTokenName, identityToken.token);
+		return { ...identityToken, metadata };
+	}
+
+	saveCache() {
+		if (this._persistCache) {
+			const clone = { ...this._config, credential: { ...this._cryptoCache } };
+			if (this._config.p) {
+				// A passphrase option exists => encrypt the key before writing the cache file.
+				const privateKey = pki.privateKeyFromPem(this._cryptoCache.key);
+				clone.credential.key = pki.encryptRsaPrivateKey(
+					privateKey,
+					this._config.p,
+				);
+			}
+			fs.writeFileSync(this._configPath, JSON.stringify(clone, null, 2));
+		}
+	}
+
+	static aesCreateKey() {
+		// Generate random key for the AES-256 algorithm (32 bytes = 256 bits).
+		const key = crypto.randomBytes(32);
+		const iv = crypto.randomBytes(16);
+		return { key, iv };
+	}
+
+	static aesEncrypt(buffer, key, iv) {
+		const cipher = crypto.createCipheriv(aesAlgorithm, key, iv);
+		const crypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
+		return crypted;
+	}
+
+	static aesDecrypt(buffer, key, iv) {
+		const cipher = crypto.createDecipheriv(aesAlgorithm, key, iv);
+		const decrypted = Buffer.concat([cipher.update(buffer), cipher.final()]);
+		return decrypted;
+	}
+
+	static rsaEncrypt(key, buffer) {
+		return crypto.publicEncrypt(key, buffer).toString("base64");
+	}
+}