libp2p 0.36.0 → 0.36.2-1473044

package/src/index.ts

@@ -0,0 +1,242 @@
+import { createLibp2pNode } from './libp2p.js'
+import type { AbortOptions, EventEmitter, RecursivePartial, Startable } from '@libp2p/interfaces'
+import type { Multiaddr } from '@multiformats/multiaddr'
+import type { FaultTolerance } from './transport-manager.js'
+import type { HostProperties } from './identify/index.js'
+import type { DualDHT } from '@libp2p/interfaces/dht'
+import type { Datastore } from 'interface-datastore'
+import type { PeerStore, PeerStoreInit } from '@libp2p/interfaces/peer-store'
+import type { PeerId } from '@libp2p/interfaces/peer-id'
+import type { AutoRelayConfig, RelayAdvertiseConfig } from './circuit/index.js'
+import type { PeerDiscovery } from '@libp2p/interfaces/peer-discovery'
+import type { Connection, ConnectionGater, ConnectionProtector, ProtocolStream } from '@libp2p/interfaces/connection'
+import type { Transport } from '@libp2p/interfaces/transport'
+import type { StreamMuxerFactory } from '@libp2p/interfaces/stream-muxer'
+import type { ConnectionEncrypter } from '@libp2p/interfaces/connection-encrypter'
+import type { PeerRouting } from '@libp2p/interfaces/peer-routing'
+import type { ContentRouting } from '@libp2p/interfaces/content-routing'
+import type { PubSub } from '@libp2p/interfaces/pubsub'
+import type { ConnectionManager, Registrar, StreamHandler } from '@libp2p/interfaces/registrar'
+import type { Metrics, MetricsInit } from '@libp2p/interfaces/metrics'
+import type { PeerInfo } from '@libp2p/interfaces/peer-info'
+import type { DialerInit } from '@libp2p/interfaces/dialer'
+import type { KeyChain } from './keychain/index.js'
+
+export interface PersistentPeerStoreOptions {
+  threshold?: number
+}
+
+export interface DEKConfig {
+  keyLength: number
+  iterationCount: number
+  salt: string
+  hash: string
+}
+
+export interface KeychainConfig {
+  pass?: string
+  dek?: DEKConfig
+}
+
+export interface MetricsConfig {
+  enabled?: boolean
+}
+
+export interface HopConfig {
+  enabled?: boolean
+  active?: boolean
+}
+
+export interface RelayConfig {
+  enabled: boolean
+  advertise: RelayAdvertiseConfig
+  hop: HopConfig
+  autoRelay: AutoRelayConfig
+}
+
+export interface NatManagerConfig {
+  enabled: boolean
+  externalAddress?: string
+  localAddress?: string
+  description?: string
+  ttl?: number
+  keepAlive: boolean
+  gateway?: string
+}
+
+export interface AddressesConfig {
+  listen: string[]
+  announce: string[]
+  noAnnounce: string[]
+  announceFilter: (multiaddrs: Multiaddr[]) => Multiaddr[]
+}
+
+export interface ConnectionManagerConfig {
+  /**
+   * If true, try to connect to all discovered peers up to the connection manager limit
+   */
+  autoDial?: boolean
+
+  /**
+   * The maximum number of connections to keep open
+   */
+  maxConnections: number
+
+  /**
+   * The minimum number of connections to keep open
+   */
+  minConnections: number
+
+  /**
+   * How long to wait between attempting to keep our number of concurrent connections
+   * above minConnections
+   */
+  autoDialInterval: number
+}
+
+export interface TransportManagerConfig {
+  faultTolerance?: FaultTolerance
+}
+
+export interface PeerStoreConfig {
+  persistence?: boolean
+  threshold?: number
+}
+
+export interface PeerRoutingConfig {
+  refreshManager: RefreshManagerConfig
+}
+
+export interface RefreshManagerConfig {
+  enabled?: boolean
+  interval: number
+  bootDelay: number
+}
+
+export interface Libp2pInit {
+  peerId: PeerId
+  host: HostProperties
+  addresses: AddressesConfig
+  connectionManager: ConnectionManagerConfig
+  connectionGater: Partial<ConnectionGater>
+  transportManager: TransportManagerConfig
+  datastore: Datastore
+  dialer: DialerInit
+  metrics: MetricsInit
+  peerStore: PeerStoreInit
+  peerRouting: PeerRoutingConfig
+  keychain: KeychainConfig
+  protocolPrefix: string
+  nat: NatManagerConfig
+  relay: RelayConfig
+
+  transports: Transport[]
+  streamMuxers?: StreamMuxerFactory[]
+  connectionEncryption?: ConnectionEncrypter[]
+  peerDiscovery?: PeerDiscovery[]
+  peerRouters?: PeerRouting[]
+  contentRouters?: ContentRouting[]
+  dht?: DualDHT
+  pubsub?: PubSub
+  connectionProtector?: ConnectionProtector
+}
+
+export interface Libp2pEvents {
+  'peer:discovery': CustomEvent<PeerInfo>
+}
+
+export interface Libp2p extends Startable, EventEmitter<Libp2pEvents> {
+  peerId: PeerId
+  peerStore: PeerStore
+  peerRouting: PeerRouting
+  contentRouting: ContentRouting
+  keychain: KeyChain
+  connectionManager: ConnectionManager
+  registrar: Registrar
+  metrics?: Metrics
+
+  pubsub?: PubSub
+  dht?: DualDHT
+
+  /**
+   * Load keychain keys from the datastore.
+   * Imports the private key as 'self', if needed.
+   */
+  loadKeychain: () => Promise<void>
+
+  /**
+   * Get a deduplicated list of peer advertising multiaddrs by concatenating
+   * the listen addresses used by transports with any configured
+   * announce addresses as well as observed addresses reported by peers.
+   *
+   * If Announce addrs are specified, configured listen addresses will be
+   * ignored though observed addresses will still be included.
+   */
+  getMultiaddrs: () => Multiaddr[]
+
+  /**
+   * Return a list of all connections this node has open, optionally filtering
+   * by a PeerId
+   */
+  getConnections: (peerId?: PeerId) => Connection[]
+
+  /**
+   * Return a list of all peers we currently have a connection open to
+   */
+  getPeers: () => PeerId[]
+
+  /**
+   * Dials to the provided peer. If successful, the known metadata of the
+   * peer will be added to the nodes `peerStore`
+   */
+  dial: (peer: PeerId | Multiaddr, options?: AbortOptions) => Promise<Connection>
+
+  /**
+   * Dials to the provided peer and tries to handshake with the given protocols in order.
+   * If successful, the known metadata of the peer will be added to the nodes `peerStore`,
+   * and the `MuxedStream` will be returned together with the successful negotiated protocol.
+   */
+  dialProtocol: (peer: PeerId | Multiaddr, protocols: string | string[], options?: AbortOptions) => Promise<ProtocolStream>
+
+  /**
+   * Disconnects all connections to the given `peer`
+   */
+  hangUp: (peer: PeerId | Multiaddr | string) => Promise<void>
+
+  /**
+   * Registers the `handler` for each protocol
+   */
+  handle: (protocol: string | string[], handler: StreamHandler) => Promise<void>
+
+  /**
+   * Removes the handler for each protocol. The protocol
+   * will no longer be supported on streams.
+   */
+  unhandle: (protocols: string[] | string) => Promise<void>
+
+  /**
+   * Pings the given peer in order to obtain the operation latency
+   */
+  ping: (peer: Multiaddr |PeerId) => Promise<number>
+
+  /**
+   * Sends a request to fetch the value associated with the given key from the given peer.
+   */
+  fetch: (peer: PeerId | Multiaddr | string, key: string) => Promise<Uint8Array | null>
+
+  /**
+   * Returns the public key for the passed PeerId. If the PeerId is of the 'RSA' type
+   * this may mean searching the DHT if the key is not present in the KeyStore.
+   */
+  getPublicKey: (peer: PeerId, options?: AbortOptions) => Promise<Uint8Array>
+}
+
+export type Libp2pOptions = RecursivePartial<Libp2pInit>
+
+/**
+ * Returns a new instance of the Libp2p interface, generating a new PeerId
+ * if one is not passed as part of the options.
+ */
+export async function createLibp2p (options: Libp2pOptions): Promise<Libp2p> {
+  return await createLibp2pNode(options)
+}

package/src/insecure/index.ts

@@ -0,0 +1,101 @@
+import { logger } from '@libp2p/logger'
+import { handshake } from 'it-handshake'
+import * as lp from 'it-length-prefixed'
+import { UnexpectedPeerError, InvalidCryptoExchangeError } from '@libp2p/interfaces/connection-encrypter/errors'
+import { Exchange, KeyType } from './pb/proto.js'
+import type { PeerId } from '@libp2p/interfaces/peer-id'
+import { peerIdFromBytes, peerIdFromKeys } from '@libp2p/peer-id'
+import type { ConnectionEncrypter, SecuredConnection } from '@libp2p/interfaces/connection-encrypter'
+import type { Duplex } from 'it-stream-types'
+
+const log = logger('libp2p:plaintext')
+const PROTOCOL = '/plaintext/2.0.0'
+
+function lpEncodeExchange (exchange: Exchange) {
+  const pb = Exchange.encode(exchange)
+
+  return lp.encode.single(pb)
+}
+
+/**
+ * Encrypt connection
+ */
+async function encrypt (localId: PeerId, conn: Duplex<Uint8Array>, remoteId?: PeerId): Promise<SecuredConnection> {
+  const shake = handshake(conn)
+
+  let type = KeyType.RSA
+
+  if (localId.type === 'Ed25519') {
+    type = KeyType.Ed25519
+  } else if (localId.type === 'secp256k1') {
+    type = KeyType.Secp256k1
+  }
+
+  // Encode the public key and write it to the remote peer
+  shake.write(
+    lpEncodeExchange({
+      id: localId.toBytes(),
+      pubkey: {
+        Type: type,
+        Data: localId.publicKey ?? new Uint8Array(0)
+      }
+    }).slice()
+  )
+
+  log('write pubkey exchange to peer %p', remoteId)
+
+  // Get the Exchange message
+  // @ts-expect-error needs to be generator
+  const response = (await lp.decode.fromReader(shake.reader).next()).value
+  const id = Exchange.decode(response.slice())
+  log('read pubkey exchange from peer %p', remoteId)
+
+  let peerId
+  try {
+    if (id.pubkey == null) {
+      throw new Error('Public key missing')
+    }
+
+    if (id.pubkey.Data.length === 0) {
+      throw new Error('Public key data too short')
+    }
+
+    if (id.id == null) {
+      throw new Error('Remote id missing')
+    }
+
+    peerId = await peerIdFromKeys(id.pubkey.Data)
+
+    if (!peerId.equals(peerIdFromBytes(id.id))) {
+      throw new Error('Public key did not match id')
+    }
+  } catch (err: any) {
+    log.error(err)
+    throw new InvalidCryptoExchangeError('Remote did not provide its public key')
+  }
+
+  if (remoteId != null && !peerId.equals(remoteId)) {
+    throw new UnexpectedPeerError()
+  }
+
+  log('plaintext key exchange completed successfully with peer %p', peerId)
+
+  shake.rest()
+  return {
+    conn: shake.stream,
+    remotePeer: peerId,
+    remoteEarlyData: new Uint8Array()
+  }
+}
+
+export class Plaintext implements ConnectionEncrypter {
+  public protocol: string = PROTOCOL
+
+  async secureInbound (localId: PeerId, conn: Duplex<Uint8Array>, remoteId?: PeerId): Promise<SecuredConnection> {
+    return await encrypt(localId, conn, remoteId)
+  }
+
+  async secureOutbound (localId: PeerId, conn: Duplex<Uint8Array>, remoteId: PeerId): Promise<SecuredConnection> {
+    return await encrypt(localId, conn, remoteId)
+  }
+}

package/src/insecure/pb/proto.ts

@@ -0,0 +1,61 @@
+/* eslint-disable import/export */
+/* eslint-disable @typescript-eslint/no-namespace */
+
+import { encodeMessage, decodeMessage, message, bytes, enumeration } from 'protons-runtime'
+
+export interface Exchange {
+  id?: Uint8Array
+  pubkey?: PublicKey
+}
+
+export namespace Exchange {
+  export const codec = () => {
+    return message<Exchange>({
+      1: { name: 'id', codec: bytes, optional: true },
+      2: { name: 'pubkey', codec: PublicKey.codec(), optional: true }
+    })
+  }
+
+  export const encode = (obj: Exchange): Uint8Array => {
+    return encodeMessage(obj, Exchange.codec())
+  }
+
+  export const decode = (buf: Uint8Array): Exchange => {
+    return decodeMessage(buf, Exchange.codec())
+  }
+}
+
+export enum KeyType {
+  RSA = 'RSA',
+  Ed25519 = 'Ed25519',
+  Secp256k1 = 'Secp256k1',
+  ECDSA = 'ECDSA'
+}
+
+export namespace KeyType {
+  export const codec = () => {
+    return enumeration<typeof KeyType>(KeyType)
+  }
+}
+
+export interface PublicKey {
+  Type: KeyType
+  Data: Uint8Array
+}
+
+export namespace PublicKey {
+  export const codec = () => {
+    return message<PublicKey>({
+      1: { name: 'Type', codec: KeyType.codec() },
+      2: { name: 'Data', codec: bytes }
+    })
+  }
+
+  export const encode = (obj: PublicKey): Uint8Array => {
+    return encodeMessage(obj, PublicKey.codec())
+  }
+
+  export const decode = (buf: Uint8Array): PublicKey => {
+    return decodeMessage(buf, PublicKey.codec())
+  }
+}

package/src/keychain/{cms.js → cms.ts}

@@ -1,18 +1,18 @@
-'use strict'
-
-// @ts-ignore node-forge types not exported
-require('node-forge/lib/pkcs7')
-// @ts-ignore node-forge types not exported
-require('node-forge/lib/pbe')
-// @ts-ignore node-forge types not exported
-const forge = require('node-forge/lib/forge')
-const { certificateForKey, findAsync } = require('./util')
-const errcode = require('err-code')
-const { fromString: uint8ArrayFromString } = require('uint8arrays/from-string')
-const { toString: uint8ArrayToString } = require('uint8arrays/to-string')
-const { codes } = require('../errors')
-
-const privates = new WeakMap()
+import 'node-forge/lib/pkcs7.js'
+import 'node-forge/lib/pbe.js'
+// @ts-expect-error types are missing
+import forge from 'node-forge/lib/forge.js'
+import { certificateForKey, findAsync } from './util.js'
+import errCode from 'err-code'
+import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
+import { toString as uint8ArrayToString } from 'uint8arrays/to-string'
+import { codes } from '../errors.js'
+import { logger } from '@libp2p/logger'
+import type { KeyChain } from './index.js'
+
+const log = logger('libp2p:keychain:cms')
+
+const privates = new WeakMap<object, { dek: string }>()
 
 /**
  * Cryptographic Message Syntax (aka PKCS #7)
@@ -23,16 +23,15 @@ const privates = new WeakMap()
  *
  * See RFC 5652 for all the details.
  */
-class CMS {
+export class CMS {
+  private readonly keychain: KeyChain
+
   /**
    * Creates a new instance with a keychain
-   *
-   * @param {import('./index')} keychain - the available keys
-   * @param {string} dek
    */
-  constructor (keychain, dek) {
-    if (!keychain) {
-      throw errcode(new Error('keychain is required'), codes.ERR_KEYCHAIN_REQUIRED)
+  constructor (keychain: KeyChain, dek: string) {
+    if (keychain == null) {
+      throw errCode(new Error('keychain is required'), codes.ERR_KEYCHAIN_REQUIRED)
     }
 
     this.keychain = keychain
@@ -43,20 +42,21 @@ class CMS {
    * Creates some protected data.
    *
    * The output Uint8Array contains the PKCS #7 message in DER.
-   *
-   * @param {string} name - The local key name.
-   * @param {Uint8Array} plain - The data to encrypt.
-   * @returns {Promise<Uint8Array>}
    */
-  async encrypt (name, plain) {
+  async encrypt (name: string, plain: Uint8Array): Promise<Uint8Array> {
     if (!(plain instanceof Uint8Array)) {
-      throw errcode(new Error('Plain data must be a Uint8Array'), codes.ERR_INVALID_PARAMETERS)
+      throw errCode(new Error('Plain data must be a Uint8Array'), codes.ERR_INVALID_PARAMETERS)
     }
 
     const key = await this.keychain.findKeyByName(name)
-    const pem = await this.keychain._getPrivateKey(name)
-    /** @type {string} */
-    const dek = privates.get(this).dek
+    const pem = await this.keychain.getPrivateKey(name)
+    const cached = privates.get(this)
+
+    if (cached == null) {
+      throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS)
+    }
+
+    const dek = cached.dek
     const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek)
     const certificate = await certificateForKey(key, privateKey)
 
@@ -76,71 +76,75 @@ class CMS {
    *
    * The keychain must contain one of the keys used to encrypt the data.  If none of the keys
    * exists, an Error is returned with the property 'missingKeys'.  It is array of key ids.
-   *
-   * @param {Uint8Array} cmsData - The CMS encrypted data to decrypt.
-   * @returns {Promise<Uint8Array>}
    */
-  async decrypt (cmsData) {
+  async decrypt (cmsData: Uint8Array): Promise<Uint8Array> {
     if (!(cmsData instanceof Uint8Array)) {
-      throw errcode(new Error('CMS data is required'), codes.ERR_INVALID_PARAMETERS)
+      throw errCode(new Error('CMS data is required'), codes.ERR_INVALID_PARAMETERS)
     }
 
-    let cms
+    let cms: any
     try {
       const buf = forge.util.createBuffer(uint8ArrayToString(cmsData, 'ascii'))
       const obj = forge.asn1.fromDer(buf)
-      // @ts-ignore not defined
+
       cms = forge.pkcs7.messageFromAsn1(obj)
-    } catch (/** @type {any} */ err) {
-      throw errcode(new Error('Invalid CMS: ' + err.message), codes.ERR_INVALID_CMS)
+    } catch (err: any) {
+      log.error(err)
+      throw errCode(new Error('Invalid CMS'), codes.ERR_INVALID_CMS)
     }
 
     // Find a recipient whose key we hold. We only deal with recipient certs
     // issued by ipfs (O=ipfs).
-    const recipients = cms.recipients
-      // @ts-ignore cms types not defined
+    const recipients: any = cms.recipients
+      // @ts-expect-error cms types not defined
       .filter(r => r.issuer.find(a => a.shortName === 'O' && a.value === 'ipfs'))
-      // @ts-ignore cms types not defined
+      // @ts-expect-error cms types not defined
       .filter(r => r.issuer.find(a => a.shortName === 'CN'))
-      // @ts-ignore cms types not defined
+      // @ts-expect-error cms types not defined
       .map(r => {
         return {
           recipient: r,
-          // @ts-ignore cms types not defined
+          // @ts-expect-error cms types not defined
           keyId: r.issuer.find(a => a.shortName === 'CN').value
         }
       })
 
-    const r = await findAsync(recipients, async (recipient) => {
+    const r = await findAsync(recipients, async (recipient: any) => {
       try {
         const key = await this.keychain.findKeyById(recipient.keyId)
-        if (key) return true
-      } catch (/** @type {any} */ err) {
+        if (key != null) {
+          return true
+        }
+      } catch (err: any) {
         return false
       }
       return false
     })
 
-    if (!r) {
-      // @ts-ignore cms types not defined
-      const missingKeys = recipients.map(r => r.keyId)
-      throw errcode(new Error('Decryption needs one of the key(s): ' + missingKeys.join(', ')), codes.ERR_MISSING_KEYS, {
+    if (r == null) {
+      // @ts-expect-error cms types not defined
+      const missingKeys: string[] = recipients.map(r => r.keyId)
+      throw errCode(new Error(`Decryption needs one of the key(s): ${missingKeys.join(', ')}`), codes.ERR_MISSING_KEYS, {
         missingKeys
       })
     }
 
     const key = await this.keychain.findKeyById(r.keyId)
 
-    if (!key) {
-      throw errcode(new Error('No key available to decrypto'), codes.ERR_NO_KEY)
+    if (key == null) {
+      throw errCode(new Error('No key available to decrypto'), codes.ERR_NO_KEY)
+    }
+
+    const pem = await this.keychain.getPrivateKey(key.name)
+    const cached = privates.get(this)
+
+    if (cached == null) {
+      throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS)
     }
 
-    const pem = await this.keychain._getPrivateKey(key.name)
-    const dek = privates.get(this).dek
+    const dek = cached.dek
     const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek)
     cms.decrypt(r.recipient, privateKey)
     return uint8ArrayFromString(cms.content.getBytes(), 'ascii')
   }
 }
-
-module.exports = CMS