bedrock-portal-nethernet 2.4.0 → 2.5.0

package/README.md

@@ -1,12 +1,12 @@
-# BedrockPortalNethernet
-[![NPM version](https://img.shields.io/npm/v/bedrock-portal-nethernet.svg)](http://npmjs.com/package/bedrock-portal-nethernet)
-[![Discord](https://img.shields.io/badge/chat-on%20discord-brightgreen.svg)](https://discord.gg/KTyd9HWuBD)
-
-A simple server implementation for the Bedrock Edition Nethernet protocol used by [BedrockPortal](https://github.com/LucienHH/bedrock-portal). Join our [Discord](https://discord.com/invite/KTyd9HWuBD) for support.
-
-Based on bedrock-protocol but stripped down to only the necessary components for the Nethernet protocol.
-
-## Installation
-```shell
-npm install bedrock-portal-nethernet
+# BedrockPortalNethernet
+[![NPM version](https://img.shields.io/npm/v/bedrock-portal-nethernet.svg)](http://npmjs.com/package/bedrock-portal-nethernet)
+[![Discord](https://img.shields.io/badge/chat-on%20discord-brightgreen.svg)](https://discord.gg/KTyd9HWuBD)
+
+A simple server implementation for the Bedrock Edition Nethernet protocol used by [BedrockPortal](https://github.com/LucienHH/bedrock-portal). Join our [Discord](https://discord.com/invite/KTyd9HWuBD) for support.
+
+Based on bedrock-protocol but stripped down to only the necessary components for the Nethernet protocol.
+
+## Installation
+```shell
+npm install bedrock-portal-nethernet
 ```

package/dist/handshake/authorizationKeys.d.ts

@@ -1,5 +1,7 @@
-import crypto from 'crypto';
-export declare function getAuthorizationKey(protocolVersion: number, keyId: string): Promise<{
+import { createRemoteJWKSet } from 'jose';
+type AuthorizationVerifier = {
     issuer: string;
-    key: crypto.KeyObject;
-}>;
+    keys: ReturnType<typeof createRemoteJWKSet>;
+};
+export declare function getAuthorizationVerifier(protocolVersion: number): Promise<AuthorizationVerifier>;
+export {};

package/dist/handshake/authorizationKeys.js

@@ -1,19 +1,14 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAuthorizationKey = getAuthorizationKey;
-const crypto_1 = __importDefault(require("crypto"));
+exports.getAuthorizationVerifier = getAuthorizationVerifier;
+const jose_1 = require("jose");
 const debug = require('debug')('bedrock-portal-nethernet');
-const AUTHORISATION_KEY_REFRESH_INTERVAL_MS = 30 * 60 * 1000;
 const AUTHORISATION_FETCH_TIMEOUT_MS = 10_000;
 const AUTHORISATION_SERVICE_URI_FALLBACK = 'https://authorization.franchise.minecraft-services.net';
 const AUTHORISATION_SERVICE_OPENID_CONFIGURATION_PATH = '/.well-known/openid-configuration';
 const AUTHORISATION_SERVICE_KEYS_PATH = '/.well-known/keys';
 const MINECRAFT_SERVICES_DISCOVERY_URL = 'https://client.discovery.minecraft-services.net/api/v1.0/discovery/MinecraftPE/builds/';
-let cachedAuthorizationKeyring = null;
-let inflightAuthorizationKeyring = null;
+const authorizationVerifiers = new Map();
 async function fetchJson(url) {
     let response;
     try {
@@ -53,54 +48,22 @@ async function resolveAuthorizationUrls(protocolVersion) {
     }
     return { issuer, jwksUrl };
 }
-async function fetchAuthorizationKeyring(protocolVersion) {
+async function createAuthorizationVerifier(protocolVersion) {
     const { issuer, jwksUrl } = await resolveAuthorizationUrls(protocolVersion);
-    const payload = await fetchJson(jwksUrl);
-    const keys = new Map();
-    for (const jwk of payload.keys || []) {
-        if (!jwk.kid)
-            continue;
-        keys.set(jwk.kid, crypto_1.default.createPublicKey({ key: jwk, format: 'jwk' }));
-    }
-    if (keys.size === 0) {
-        throw new Error('No valid authentication keys returned by Microsoft');
-    }
     return {
-        fetchedAt: Date.now(),
         issuer,
-        keys,
-        protocolVersion,
+        keys: (0, jose_1.createRemoteJWKSet)(jwksUrl, {
+            cacheMaxAge: 30 * 60 * 1000,
+            timeoutDuration: AUTHORISATION_FETCH_TIMEOUT_MS,
+        }),
     };
 }
-function isAuthorizationKeyringFresh(protocolVersion) {
-    return cachedAuthorizationKeyring !== null &&
-        cachedAuthorizationKeyring.protocolVersion === protocolVersion &&
-        Date.now() - cachedAuthorizationKeyring.fetchedAt < AUTHORISATION_KEY_REFRESH_INTERVAL_MS;
-}
-async function refreshAuthorizationKeyring(protocolVersion) {
-    inflightAuthorizationKeyring ??= fetchAuthorizationKeyring(protocolVersion);
-    try {
-        const keyring = await inflightAuthorizationKeyring;
-        cachedAuthorizationKeyring = keyring;
-        return keyring;
-    }
-    finally {
-        inflightAuthorizationKeyring = null;
-    }
-}
-async function getAuthorizationKey(protocolVersion, keyId) {
-    let keyring = isAuthorizationKeyringFresh(protocolVersion)
-        ? cachedAuthorizationKeyring
-        : await refreshAuthorizationKeyring(protocolVersion);
-    if (!keyring || !keyring.keys.has(keyId)) {
-        keyring = await refreshAuthorizationKeyring(protocolVersion);
-    }
-    const key = keyring.keys.get(keyId);
-    if (!key) {
-        throw new Error(`Unrecognized authentication key ID: ${keyId}`);
+function getAuthorizationVerifier(protocolVersion) {
+    let verifier = authorizationVerifiers.get(protocolVersion);
+    if (!verifier) {
+        verifier = createAuthorizationVerifier(protocolVersion);
+        authorizationVerifiers.set(protocolVersion, verifier);
+        void verifier.catch(() => authorizationVerifiers.delete(protocolVersion));
     }
-    return {
-        issuer: keyring.issuer,
-        key,
-    };
+    return verifier;
 }

package/dist/handshake/keyExchange.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyExchange = KeyExchange;
-const jsonwebtoken_1 = require("jsonwebtoken");
+const jose_1 = require("jose");
 const crypto_1 = require("crypto");
 const debug = require('debug')('bedrock-portal-nethernet');
 const SALT = '🧂';
@@ -14,7 +14,7 @@ function KeyExchange(client) {
     client.publicKeyDER = client.ecdhKeyPair.publicKey.export(der);
     client.privateKeyPEM = client.ecdhKeyPair.privateKey.export(pem);
     client.clientX509 = client.publicKeyDER.toString('base64');
-    function startClientboundEncryption(publicKey) {
+    async function startClientboundEncryption(publicKey) {
         debug('[encrypt] Client pub key base64: ', publicKey);
         // const pubKeyDer = crypto.createPublicKey({ key: Buffer.from(publicKey.key, 'base64'), ...der })
         // Shared secret from the client's public key + our private key
@@ -28,10 +28,13 @@ function KeyExchange(client) {
         // const secretHash = crypto.createHash('sha256')
         // secretHash.update(SALT)
         // secretHash.update(client.sharedSecret)
-        const token = (0, jsonwebtoken_1.sign)({
+        const token = await new jose_1.SignJWT({
             salt: toBase64(SALT),
             signedToken: client.clientX509,
-        }, client.ecdhKeyPair.privateKey, { algorithm: 'ES384', header: { x5u: client.clientX509, alg: 'ES384' } });
+        })
+            .setProtectedHeader({ x5u: client.clientX509, alg: 'ES384' })
+            .setIssuedAt()
+            .sign(client.ecdhKeyPair.privateKey);
         client.write('server_to_client_handshake', { token });
         // client.secretKeyBytes = secretHash.digest()
         // // The encryption scheme is AES/CFB8/NoPadding with the
@@ -40,7 +43,12 @@ function KeyExchange(client) {
         // const initial = client.secretKeyBytes.slice(0, 16)
         // client.startEncryption(initial)
     }
-    client.on('server.client_handshake', startClientboundEncryption);
+    client.on('server.client_handshake', publicKey => {
+        void startClientboundEncryption(publicKey).catch(error => {
+            debug('Failed to create server handshake token', error);
+            client.server.nethernet?.closeConnection(client.connection, 'server handshake failed');
+        });
+    });
 }
 function toBase64(string) {
     return Buffer.from(string).toString('base64');

package/dist/handshake/loginVerify.js

@@ -4,27 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = __importDefault(require("crypto"));
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const jose_1 = require("jose");
+const identity_1 = require("../nethernet/identity");
 const constants_1 = require("./constants");
 const authorizationKeys_1 = require("./authorizationKeys");
 const debug = require('debug')('bedrock-portal-nethernet');
 const AUTHORISATION_AUDIENCE = 'api://auth-minecraft-services/multiplayer';
 const AUTHORISATION_CLOCK_TOLERANCE_SECONDS = 60;
-function getJwtObject(decoded, errorMessage) {
-    if (!decoded || typeof decoded === 'string') {
-        throw new Error(errorMessage);
-    }
-    return decoded;
-}
 function normalizeToken(token) {
     return token.replace(/^MCToken\s+/i, '').trim();
 }
 function getJwtHeader(token) {
-    const decoded = jsonwebtoken_1.default.decode(normalizeToken(token), { complete: true });
-    if (!decoded?.header || typeof decoded.header !== 'object') {
-        throw new Error('Missing JWT header');
-    }
-    return decoded.header;
+    return (0, jose_1.decodeProtectedHeader)(normalizeToken(token));
 }
 function getTokenUserData(decoded) {
     return {
@@ -43,17 +34,13 @@ exports.default = (client) => {
     const getDER = (b64) => crypto_1.default.createPublicKey({ key: Buffer.from(b64, 'base64'), format: 'der', type: 'spki' });
     async function verifyTokenAuth(token) {
         const normalizedToken = normalizeToken(token);
-        const header = getJwtHeader(normalizedToken);
-        if (!header.kid) {
-            throw new Error('Authorization token missing key id');
-        }
-        const { issuer, key } = await (0, authorizationKeys_1.getAuthorizationKey)(client.options.protocolVersion, header.kid);
-        const decoded = getJwtObject(jsonwebtoken_1.default.verify(normalizedToken, key, {
+        const { issuer, keys } = await (0, authorizationKeys_1.getAuthorizationVerifier)(client.options.protocolVersion);
+        const { payload: decoded } = await (0, jose_1.jwtVerify)(normalizedToken, keys, {
             algorithms: ['RS256'],
             clockTolerance: AUTHORISATION_CLOCK_TOLERANCE_SECONDS,
             issuer,
             audience: AUTHORISATION_AUDIENCE,
-        }), 'Invalid login token');
+        });
         const publicKey = decoded.cpk || decoded.clientPublicKey;
         if (!publicKey) {
             throw new Error('Authorization token missing client public key');
@@ -63,7 +50,7 @@ exports.default = (client) => {
             data: getTokenUserData(decoded),
         };
     }
-    function verifyChainAuth(chain) {
+    async function verifyChainAuth(chain) {
         let data = {};
         // There are three JWT tokens sent to us, one signed by the client
         // one signed by Mojang with the Mojang token we have and another one
@@ -74,14 +61,14 @@ exports.default = (client) => {
         let pubKey = getDER(getX5U(chain[0])); // the first one is client signed, allow it
         let finalKey = '';
         for (const token of chain) {
-            const decoded = getJwtObject(jsonwebtoken_1.default.verify(token, pubKey, { algorithms: ['ES384'] }), 'Invalid login token');
+            const { payload: decoded } = await (0, jose_1.jwtVerify)(token, pubKey, { algorithms: ['ES384'] });
             // Check if signed by Mojang key
             const x5u = getX5U(token);
             if (x5u === constants_1.PUBLIC_KEY && !data.extraData?.XUID) {
                 didVerify = true;
                 debug('Verified client with mojang key', x5u);
             }
-            pubKey = decoded.identityPublicKey ? getDER(decoded.identityPublicKey) : x5u;
+            pubKey = getDER(decoded.identityPublicKey || x5u);
             finalKey = decoded.identityPublicKey || finalKey; // non pem
             data = { ...data, ...decoded };
         }
@@ -90,16 +77,20 @@ exports.default = (client) => {
         }
         return { key: finalKey, data };
     }
-    function verifySkin(publicKey, token) {
+    async function verifySkin(publicKey, token) {
         if (getX5U(token) !== publicKey) {
             throw new Error('Invalid JWT signature');
         }
         const pubKey = getDER(publicKey);
-        return getJwtObject(jsonwebtoken_1.default.verify(token, pubKey, { algorithms: ['ES384'] }), 'Invalid JWT payload');
+        const { payload } = await (0, jose_1.jwtVerify)(token, pubKey, { algorithms: ['ES384'] });
+        return payload;
     }
     client.decodeLoginJWT = async (authTokens, skinTokens, authToken = '') => {
-        const { key, data } = authToken ? await verifyTokenAuth(authToken) : verifyChainAuth(authTokens);
-        const skinData = verifySkin(key, skinTokens);
+        const { key, data } = authToken ? await verifyTokenAuth(authToken) : await verifyChainAuth(authTokens);
+        if (!(0, identity_1.publicKeysEqual)(key, client.connection.peerPublicKey)) {
+            throw new Error('Login public key does not match WebRTC peer identity');
+        }
+        const skinData = await verifySkin(key, skinTokens);
         return { key, userData: data, skinData };
     };
     client.encodeLoginJWT = (localChain, mojangChain) => {
@@ -113,5 +104,5 @@ exports.default = (client) => {
 };
 function getX5U(token) {
     const hjson = getJwtHeader(token);
-    return hjson.x5u || '';
+    return typeof hjson.x5u === 'string' ? hjson.x5u : '';
 }

package/dist/nethernet/connection.d.ts

@@ -4,13 +4,21 @@ export declare const maxMessageSize = 10000;
 export declare class Connection {
     nethernet: Server;
     connectionId: bigint;
+    networkId: bigint;
+    peerPublicKey: Buffer;
     rtcConnection: PeerConnection;
     reliable: DataChannel | null;
     unreliable: DataChannel | null;
     promisedSegments: number;
-    buf: Buffer | null;
-    constructor(nethernet: Server, connectionId: bigint, rtcConnection: PeerConnection);
+    chunks: Buffer[];
+    iceConnected: boolean;
+    opened: boolean;
+    closed: boolean;
+    readyTimeout: NodeJS.Timeout;
+    constructor(nethernet: Server, networkId: bigint, connectionId: bigint, peerPublicKey: Buffer, rtcConnection: PeerConnection);
     setChannels(reliable: DataChannel | null, unreliable?: DataChannel): void;
+    setIceConnected(connected: boolean): void;
+    private openIfReady;
     handleMessage(data: string | Buffer | ArrayBuffer): void;
     onPacket(packet: Buffer): void;
     write(data: string | Buffer): number;

package/dist/nethernet/connection.js

@@ -3,32 +3,85 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Connection = exports.maxMessageSize = void 0;
 const debugFn = require('debug')('bedrock-portal-nethernet');
 exports.maxMessageSize = 10_000;
+const maxSegments = 256;
+const connectionReadyTimeout = 15_000;
 class Connection {
     nethernet;
     connectionId;
+    networkId;
+    peerPublicKey;
     rtcConnection;
     reliable;
     unreliable;
     promisedSegments;
-    buf;
-    constructor(nethernet, connectionId, rtcConnection) {
+    chunks;
+    iceConnected;
+    opened;
+    closed;
+    readyTimeout;
+    constructor(nethernet, networkId, connectionId, peerPublicKey, rtcConnection) {
         this.nethernet = nethernet;
         this.connectionId = connectionId;
+        this.networkId = networkId;
+        this.peerPublicKey = peerPublicKey;
         this.rtcConnection = rtcConnection;
         this.reliable = null;
         this.unreliable = null;
         this.promisedSegments = 0;
-        this.buf = Buffer.alloc(0);
+        this.chunks = [];
+        this.iceConnected = false;
+        this.opened = false;
+        this.closed = false;
+        this.readyTimeout = setTimeout(() => {
+            debugFn('Connection timed out waiting for reliable data channel', this.connectionId);
+            this.nethernet.closeConnection(this, 'reliable data channel timed out');
+        }, connectionReadyTimeout);
+        this.readyTimeout.unref();
     }
     setChannels(reliable, unreliable) {
         if (reliable) {
             this.reliable = reliable;
-            this.reliable.onMessage((msg) => this.handleMessage(msg));
+            this.reliable.onMessage((msg) => {
+                try {
+                    this.handleMessage(msg);
+                }
+                catch (error) {
+                    debugFn('Rejected invalid data channel message', this.connectionId, error);
+                    this.nethernet.closeConnection(this, 'invalid data channel message');
+                }
+            });
+            this.reliable.onOpen(() => {
+                debugFn('Reliable data channel opened', this.connectionId);
+                this.openIfReady();
+            });
+            this.reliable.onClosed(() => {
+                debugFn('Reliable data channel closed', this.connectionId);
+                this.nethernet.closeConnection(this, 'reliable data channel closed');
+            });
+            this.reliable.onError(error => {
+                debugFn('Reliable data channel error', this.connectionId, error);
+                this.nethernet.closeConnection(this, `reliable data channel error: ${error}`);
+            });
+            this.openIfReady();
         }
         if (unreliable) {
             this.unreliable = unreliable;
+            this.unreliable.onOpen(() => debugFn('Unreliable data channel opened', this.connectionId));
+            this.unreliable.onClosed(() => debugFn('Unreliable data channel closed', this.connectionId));
+            this.unreliable.onError(error => debugFn('Unreliable data channel error', this.connectionId, error));
         }
     }
+    setIceConnected(connected) {
+        this.iceConnected = connected;
+        this.openIfReady();
+    }
+    openIfReady() {
+        if (this.opened || this.closed || !this.iceConnected || !this.reliable?.isOpen())
+            return;
+        this.opened = true;
+        clearTimeout(this.readyTimeout);
+        this.nethernet.onOpenConnection(this);
+    }
     handleMessage(data) {
         if (typeof data === 'string') {
             data = Buffer.from(data);
@@ -46,15 +99,15 @@ class Connection {
             throw new Error(`Invalid promised segments: expected ${this.promisedSegments - 1}, got ${segments}`);
         }
         this.promisedSegments = segments;
-        this.buf = this.buf ? Buffer.concat([this.buf, data]) : data;
+        this.chunks.push(data);
         if (this.promisedSegments > 0) {
             return;
         }
-        this.onPacket(this.buf);
-        this.buf = null;
+        this.onPacket(Buffer.concat(this.chunks));
+        this.chunks = [];
     }
     onPacket(packet) {
-        this.nethernet.onEncapsulated(packet, this.connectionId);
+        this.nethernet.onEncapsulated(packet, this);
     }
     write(data) {
         if (!this.reliable) {
@@ -65,6 +118,9 @@ class Connection {
             data = Buffer.from(data);
         }
         let segments = Math.ceil(data.length / exports.maxMessageSize);
+        if (segments > maxSegments) {
+            throw new Error(`Data requires ${segments} segments, maximum is ${maxSegments}`);
+        }
         for (let i = 0; i < data.length; i += exports.maxMessageSize) {
             segments--;
             let end = i + exports.maxMessageSize;
@@ -73,7 +129,10 @@ class Connection {
             const frag = data.subarray(i, end);
             const message = Buffer.concat([Buffer.from([segments]), frag]);
             debugFn('Sending fragment', segments, 'header', message[0]);
-            this.reliable.sendMessageBinary(message);
+            if (!this.reliable.sendMessageBinary(message)) {
+                this.nethernet.closeConnection(this, 'failed to send reliable data channel message');
+                throw new Error(`Failed to send segment ${segments}`);
+            }
             n += frag.length;
         }
         if (segments !== 0) {
@@ -82,6 +141,10 @@ class Connection {
         return n;
     }
     close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        clearTimeout(this.readyTimeout);
         if (this.reliable) {
             this.reliable.close();
         }

package/dist/nethernet/identity.d.ts

@@ -0,0 +1,9 @@
+import crypto from 'crypto';
+export type ServerIdentity = {
+    privateKey: crypto.KeyObject;
+    publicKey: string;
+};
+export declare function createServerIdentity(): ServerIdentity;
+export declare function signServerIdentity(sdp: string, identity: ServerIdentity): Promise<string>;
+export declare function verifyIdentity(sdp: string): Promise<Buffer<ArrayBufferLike>>;
+export declare function publicKeysEqual(encodedKey: string, expectedKey: Buffer): boolean;

package/dist/nethernet/identity.js

@@ -0,0 +1,116 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServerIdentity = createServerIdentity;
+exports.signServerIdentity = signServerIdentity;
+exports.verifyIdentity = verifyIdentity;
+exports.publicKeysEqual = publicKeysEqual;
+const crypto_1 = __importDefault(require("crypto"));
+const jose_1 = require("jose");
+function createServerIdentity() {
+    const { privateKey, publicKey } = crypto_1.default.generateKeyPairSync('ec', { namedCurve: 'secp384r1' });
+    return {
+        privateKey,
+        publicKey: publicKey.export({ format: 'der', type: 'spki' }).toString('base64'),
+    };
+}
+async function signServerIdentity(sdp, identity) {
+    const now = Math.floor(Date.now() / 1000);
+    const token = await new jose_1.SignJWT({ cpk: identity.publicKey })
+        .setProtectedHeader({ alg: 'ES384', x5u: identity.publicKey })
+        .setIssuedAt(now)
+        .setExpirationTime(now + 60)
+        .sign(identity.privateKey);
+    const signedFingerprints = await new jose_1.CompactSign(fingerprintPayload(sdp))
+        .setProtectedHeader({ alg: 'ES384' })
+        .sign(identity.privateKey);
+    const [protectedHeader, , signature] = signedFingerprints.split('.');
+    const fingerprints = `${protectedHeader}..${signature}`;
+    const value = Buffer.from(JSON.stringify({
+        assertion: JSON.stringify({ fingerprints, token }),
+        idp: { domain: 'self', protocol: 'default' },
+    })).toString('base64');
+    return addSessionAttribute(sdp, `a=identity:${value}`);
+}
+async function verifyIdentity(sdp) {
+    const identityValue = getSdpAttribute(sdp, 'identity');
+    if (!identityValue)
+        throw new Error('Missing SDP identity assertion');
+    const identity = parseJson(Buffer.from(identityValue, 'base64').toString('utf8'), 'identity assertion');
+    if (!identity.assertion || !identity.idp?.domain || identity.idp.protocol !== 'default') {
+        throw new Error('Malformed SDP identity assertion');
+    }
+    const assertion = parseJson(identity.assertion, 'identity assertion payload');
+    if (!assertion.fingerprints || !assertion.token) {
+        throw new Error('Incomplete SDP identity assertion');
+    }
+    const token = (0, jose_1.decodeJwt)(assertion.token);
+    if (!token.cpk)
+        throw new Error('Identity token missing client public key');
+    const now = Date.now() / 1000;
+    if (token.exp !== undefined && token.exp <= now)
+        throw new Error('Identity token has expired');
+    if (token.nbf !== undefined && token.nbf > now)
+        throw new Error('Identity token is not valid yet');
+    const publicKey = parsePublicKey(token.cpk);
+    await verifyDetachedSignature(assertion.fingerprints, fingerprintPayload(sdp), publicKey);
+    return publicKey.export({ format: 'der', type: 'spki' });
+}
+function publicKeysEqual(encodedKey, expectedKey) {
+    return parsePublicKey(encodedKey).export({ format: 'der', type: 'spki' }).equals(expectedKey);
+}
+async function verifyDetachedSignature(compact, payload, publicKey) {
+    const parts = compact.split('.');
+    if (parts.length !== 3 || parts[1] !== '')
+        throw new Error('Malformed detached fingerprint signature');
+    await (0, jose_1.flattenedVerify)({
+        protected: parts[0],
+        payload: payload.toString('base64url'),
+        signature: parts[2],
+    }, publicKey, { algorithms: ['ES384'] });
+}
+function fingerprintPayload(sdp) {
+    const fingerprint = getSdpAttribute(sdp, 'fingerprint');
+    if (!fingerprint)
+        throw new Error('Missing SDP fingerprint');
+    const separator = fingerprint.indexOf(' ');
+    if (separator === -1)
+        throw new Error('Malformed SDP fingerprint');
+    return Buffer.from(JSON.stringify({
+        fingerprint: [{
+                algorithm: fingerprint.slice(0, separator),
+                digest: fingerprint.slice(separator + 1),
+            }],
+    }));
+}
+function addSessionAttribute(sdp, attribute) {
+    const lineEnding = sdp.includes('\r\n') ? '\r\n' : '\n';
+    const lines = sdp.split(lineEnding);
+    const mediaIndex = lines.findIndex(line => line.startsWith('m='));
+    if (mediaIndex === -1)
+        throw new Error('SDP has no media description');
+    lines.splice(mediaIndex, 0, attribute);
+    return lines.join(lineEnding);
+}
+function parsePublicKey(encodedKey) {
+    const publicKey = crypto_1.default.createPublicKey({ key: Buffer.from(encodedKey, 'base64'), format: 'der', type: 'spki' });
+    if (publicKey.asymmetricKeyType !== 'ec' || publicKey.asymmetricKeyDetails?.namedCurve !== 'secp384r1') {
+        throw new Error('Client public key must use the P-384 curve');
+    }
+    return publicKey;
+}
+function getSdpAttribute(sdp, name) {
+    const prefix = `a=${name}:`;
+    const line = sdp.split(/\r?\n/).find(line => line.startsWith(prefix));
+    return line?.slice(prefix.length).trim();
+}
+function parseJson(value, name) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new Error(`Malformed ${name}`);
+    }
+}

package/dist/nethernet/server.d.ts

@@ -1,17 +1,21 @@
 import { Connection } from './connection';
+import { ServerIdentity } from './identity';
 import { Signal } from '../signaling/signal';
 import { SignalStructure } from '../signaling/struct';
 export declare class Server {
     networkId: bigint;
     connectionId: bigint;
     signaling: Signal;
-    connections: Map<bigint, Connection>;
+    identity: ServerIdentity;
+    connections: Map<string, Connection>;
     onOpenConnection: (conn: Connection) => void;
-    onCloseConnection: (id: bigint, reason: string) => void;
-    onEncapsulated: (packet: Buffer, id: bigint) => void;
+    onCloseConnection: (conn: Connection, reason: string) => void;
+    onEncapsulated: (packet: Buffer, conn: Connection) => void;
     constructor(signaling: Signal, networkId?: bigint, connectionId?: bigint);
     handleCandidate(signal: SignalStructure): Promise<void>;
     handleOffer(signal: SignalStructure): Promise<void>;
     listen(): Promise<void>;
+    closeConnection(connection: Connection, reason: string): void;
     close(): void;
+    private connectionKey;
 }