kersiosocket 0.5.0-dev → 0.6.0-dev

package/src/socket/connection.js

@@ -22,6 +22,9 @@ const DEFAULTS = {
   url: 'wss://web.whatsapp.com/ws/chat',
   origin: 'https://web.whatsapp.com',
   clientPayload: EMPTY, // empty buffer is transport smoke-test only; real login needs verified auth payload
+  // Fail closed by default: callers must supply a pinned, independently tested server-certificate verifier.
+  strictServerCertificateVerification: true,
+  verifyServerCertificate: null,
   // stableMs: koneksi baru dianggap 'sehat' (counter backoff direset) kalau bertahan selama ini
   reconnect: { enabled: true, minDelay: 1000, maxDelay: 30000, factor: 2, stableMs: 30000 }
 }
@@ -48,6 +51,7 @@ class Connection extends EventEmitter {
     this.counters = { bytesIn: 0, bytesOut: 0, framesIn: 0, framesOut: 0 }
     this.frameLatency = new LatencyTracker() // dekripsi + dispatch per frame
     this.handshakeMs = 0
+    this.serverCertificateVerified = false
     this._t = null
     this._decoder = null
     this._hs = null
@@ -110,7 +114,7 @@ class Connection extends EventEmitter {
       ...this.counters,
       handshakeMs: this.handshakeMs,
       frameLatencyMs: this.frameLatency.summary(),
-      serverCertificateVerified: false,
+      serverCertificateVerified: this.serverCertificateVerified,
       rssMB: +(m.rss / 1048576).toFixed(1),
       heapUsedMB: +(m.heapUsed / 1048576).toFixed(1)
     }
@@ -129,7 +133,11 @@ class Connection extends EventEmitter {
 
   _onOpen() {
     this._decoder = new FrameDecoder()
-    this._hs = new ClientHandshake({ staticKey: this.staticKey })
+    this._hs = new ClientHandshake({
+      staticKey: this.staticKey,
+      verifyServerCertificate: this.config.verifyServerCertificate,
+      requireServerCertificateVerification: this.config.strictServerCertificateVerification
+    })
     this.startedAt = Date.now()
     this._setState('handshaking')
     this._write(encodeFrame(this._hs.hello(), WA_HEADER))
@@ -160,6 +168,7 @@ class Connection extends EventEmitter {
       const hs = this._hs
       const finish = hs.processServerHello(frame, this.clientPayload)
       this._noise = hs.noise
+      this.serverCertificateVerified = hs.serverCertificateVerified === true
       this._hs = null
       // Publish the completed Noise state before writing ClientFinish. A fake or
       // custom transport may synchronously deliver the server reply from send().
@@ -167,7 +176,7 @@ class Connection extends EventEmitter {
       this.handshakeMs = Date.now() - this.startedAt
       this._setState('noise-ready', {
         serverStatic: hs.serverStatic,
-        serverCertificateVerified: false
+        serverCertificateVerified: this.serverCertificateVerified
       })
       this._write(encodeFrame(finish))
       return
@@ -219,6 +228,10 @@ class Connection extends EventEmitter {
   _abortConnection(error, transport = this._t, generation = this._generation) {
     const err = error instanceof Error ? error : new Error(String(error))
     this._safeEmit('connection.error', err)
+    if (['ERR_NOISE_CERTIFICATE_VERIFIER_MISSING', 'ERR_NOISE_CERTIFICATE_REJECTED'].includes(err.code)) {
+      // Configuration/trust failures are not transient network failures. Stop auto-retry.
+      this.ended = true
+    }
     if (!transport || transport !== this._t || generation !== this._generation) return
     // Transition/cleanup synchronously. The transport's eventual close event is de-duplicated.
     this._onClose(1002, Buffer.from('protocol/transport failure'), transport, generation)

package/src/socket/noise.js

@@ -81,8 +81,11 @@ class ClientHandshake {
   /**
    * @param {{ staticKey: {public:Buffer, private:Buffer}, ephemeralKey?: object, header?: Buffer }} opts
    */
-  constructor({ staticKey, ephemeralKey = generateKeyPair(), header = WA_HEADER }) {
+  constructor({ staticKey, ephemeralKey = generateKeyPair(), header = WA_HEADER, verifyServerCertificate, requireServerCertificateVerification = false }) {
     this.staticKey = staticKey
+    this.verifyServerCertificate = verifyServerCertificate
+    this.requireServerCertificateVerification = requireServerCertificateVerification
+    this.serverCertificateVerified = false
     this.ephemeralKey = ephemeralKey
     this.noise = new NoiseState(header)
     this.noise.authenticate(ephemeralKey.public)
@@ -97,7 +100,8 @@ class ClientHandshake {
 
   /**
    * Proses ServerHello, kembalikan ClientFinish (protobuf).
-   * TODO v0.2: verifikasi rantai sertifikat server terhadap root key WhatsApp.
+   * Verifikasi sertifikat dipasok oleh verifier yang menggunakan root/intermediate key
+   * resmi yang dipin dan test vector independen. Tidak ada verifier bawaan yang diklaim.
    * @param {Buffer} data  isi frame ServerHello
    * @param {Buffer} clientPayload  ClientPayload (login/registrasi), sudah di-encode protobuf
    */
@@ -112,6 +116,22 @@ class ClientHandshake {
     n.mixIntoKey(sharedKey(this.ephemeralKey.private, this.serverStatic))
 
     this.serverCertificate = n.decrypt(sh.payload)
+    if (typeof this.verifyServerCertificate === 'function') {
+      const verified = this.verifyServerCertificate(this.serverCertificate, {
+        serverStatic: Buffer.from(this.serverStatic),
+        header: Buffer.from(WA_HEADER)
+      })
+      if (verified !== true) {
+        const error = new Error('Noise: sertifikat server ditolak oleh verifier')
+        error.code = 'ERR_NOISE_CERTIFICATE_REJECTED'
+        throw error
+      }
+      this.serverCertificateVerified = true
+    } else if (this.requireServerCertificateVerification) {
+      const error = new Error('Noise: koneksi ditolak karena verifier sertifikat server belum dikonfigurasi')
+      error.code = 'ERR_NOISE_CERTIFICATE_VERIFIER_MISSING'
+      throw error
+    }
 
     const encStatic = n.encrypt(this.staticKey.public)
     n.mixIntoKey(sharedKey(this.staticKey.private, sh.ephemeral))