libp2p 0.36.2 → 0.37.0-b09eb8f

package/src/insecure/index.ts

@@ -0,0 +1,101 @@
+import { logger } from '@libp2p/logger'
+import { handshake } from 'it-handshake'
+import * as lp from 'it-length-prefixed'
+import { UnexpectedPeerError, InvalidCryptoExchangeError } from '@libp2p/interfaces/connection-encrypter/errors'
+import { Exchange, KeyType } from './pb/proto.js'
+import type { PeerId } from '@libp2p/interfaces/peer-id'
+import { peerIdFromBytes, peerIdFromKeys } from '@libp2p/peer-id'
+import type { ConnectionEncrypter, SecuredConnection } from '@libp2p/interfaces/connection-encrypter'
+import type { Duplex } from 'it-stream-types'
+
+const log = logger('libp2p:plaintext')
+const PROTOCOL = '/plaintext/2.0.0'
+
+function lpEncodeExchange (exchange: Exchange) {
+  const pb = Exchange.encode(exchange)
+
+  return lp.encode.single(pb)
+}
+
+/**
+ * Encrypt connection
+ */
+async function encrypt (localId: PeerId, conn: Duplex<Uint8Array>, remoteId?: PeerId): Promise<SecuredConnection> {
+  const shake = handshake(conn)
+
+  let type = KeyType.RSA
+
+  if (localId.type === 'Ed25519') {
+    type = KeyType.Ed25519
+  } else if (localId.type === 'secp256k1') {
+    type = KeyType.Secp256k1
+  }
+
+  // Encode the public key and write it to the remote peer
+  shake.write(
+    lpEncodeExchange({
+      id: localId.toBytes(),
+      pubkey: {
+        Type: type,
+        Data: localId.publicKey ?? new Uint8Array(0)
+      }
+    }).slice()
+  )
+
+  log('write pubkey exchange to peer %p', remoteId)
+
+  // Get the Exchange message
+  // @ts-expect-error needs to be generator
+  const response = (await lp.decode.fromReader(shake.reader).next()).value
+  const id = Exchange.decode(response.slice())
+  log('read pubkey exchange from peer %p', remoteId)
+
+  let peerId
+  try {
+    if (id.pubkey == null) {
+      throw new Error('Public key missing')
+    }
+
+    if (id.pubkey.Data.length === 0) {
+      throw new Error('Public key data too short')
+    }
+
+    if (id.id == null) {
+      throw new Error('Remote id missing')
+    }
+
+    peerId = await peerIdFromKeys(id.pubkey.Data)
+
+    if (!peerId.equals(peerIdFromBytes(id.id))) {
+      throw new Error('Public key did not match id')
+    }
+  } catch (err: any) {
+    log.error(err)
+    throw new InvalidCryptoExchangeError('Remote did not provide its public key')
+  }
+
+  if (remoteId != null && !peerId.equals(remoteId)) {
+    throw new UnexpectedPeerError()
+  }
+
+  log('plaintext key exchange completed successfully with peer %p', peerId)
+
+  shake.rest()
+  return {
+    conn: shake.stream,
+    remotePeer: peerId,
+    remoteEarlyData: new Uint8Array()
+  }
+}
+
+export class Plaintext implements ConnectionEncrypter {
+  public protocol: string = PROTOCOL
+
+  async secureInbound (localId: PeerId, conn: Duplex<Uint8Array>, remoteId?: PeerId): Promise<SecuredConnection> {
+    return await encrypt(localId, conn, remoteId)
+  }
+
+  async secureOutbound (localId: PeerId, conn: Duplex<Uint8Array>, remoteId: PeerId): Promise<SecuredConnection> {
+    return await encrypt(localId, conn, remoteId)
+  }
+}

package/src/insecure/pb/proto.ts

@@ -0,0 +1,68 @@
+/* eslint-disable import/export */
+/* eslint-disable @typescript-eslint/no-namespace */
+
+import { encodeMessage, decodeMessage, message, bytes, enumeration } from 'protons-runtime'
+import type { Codec } from 'protons-runtime'
+
+export interface Exchange {
+  id?: Uint8Array
+  pubkey?: PublicKey
+}
+
+export namespace Exchange {
+  export const codec = (): Codec<Exchange> => {
+    return message<Exchange>({
+      1: { name: 'id', codec: bytes, optional: true },
+      2: { name: 'pubkey', codec: PublicKey.codec(), optional: true }
+    })
+  }
+
+  export const encode = (obj: Exchange): Uint8Array => {
+    return encodeMessage(obj, Exchange.codec())
+  }
+
+  export const decode = (buf: Uint8Array): Exchange => {
+    return decodeMessage(buf, Exchange.codec())
+  }
+}
+
+export enum KeyType {
+  RSA = 'RSA',
+  Ed25519 = 'Ed25519',
+  Secp256k1 = 'Secp256k1',
+  ECDSA = 'ECDSA'
+}
+
+enum __KeyTypeValues {
+  RSA = 0,
+  Ed25519 = 1,
+  Secp256k1 = 2,
+  ECDSA = 3
+}
+
+export namespace KeyType {
+  export const codec = () => {
+    return enumeration<typeof KeyType>(__KeyTypeValues)
+  }
+}
+export interface PublicKey {
+  Type: KeyType
+  Data: Uint8Array
+}
+
+export namespace PublicKey {
+  export const codec = (): Codec<PublicKey> => {
+    return message<PublicKey>({
+      1: { name: 'Type', codec: KeyType.codec() },
+      2: { name: 'Data', codec: bytes }
+    })
+  }
+
+  export const encode = (obj: PublicKey): Uint8Array => {
+    return encodeMessage(obj, PublicKey.codec())
+  }
+
+  export const decode = (buf: Uint8Array): PublicKey => {
+    return decodeMessage(buf, PublicKey.codec())
+  }
+}

package/src/keychain/{cms.js → cms.ts}

@@ -1,18 +1,18 @@
-'use strict'
-
-// @ts-ignore node-forge types not exported
-require('node-forge/lib/pkcs7')
-// @ts-ignore node-forge types not exported
-require('node-forge/lib/pbe')
-// @ts-ignore node-forge types not exported
-const forge = require('node-forge/lib/forge')
-const { certificateForKey, findAsync } = require('./util')
-const errcode = require('err-code')
-const { fromString: uint8ArrayFromString } = require('uint8arrays/from-string')
-const { toString: uint8ArrayToString } = require('uint8arrays/to-string')
-const { codes } = require('../errors')
-
-const privates = new WeakMap()
+import 'node-forge/lib/pkcs7.js'
+import 'node-forge/lib/pbe.js'
+// @ts-expect-error types are missing
+import forge from 'node-forge/lib/forge.js'
+import { certificateForKey, findAsync } from './util.js'
+import errCode from 'err-code'
+import { fromString as uint8ArrayFromString } from 'uint8arrays/from-string'
+import { toString as uint8ArrayToString } from 'uint8arrays/to-string'
+import { codes } from '../errors.js'
+import { logger } from '@libp2p/logger'
+import type { KeyChain } from './index.js'
+
+const log = logger('libp2p:keychain:cms')
+
+const privates = new WeakMap<object, { dek: string }>()
 
 /**
  * Cryptographic Message Syntax (aka PKCS #7)
@@ -23,16 +23,15 @@ const privates = new WeakMap()
  *
  * See RFC 5652 for all the details.
  */
-class CMS {
+export class CMS {
+  private readonly keychain: KeyChain
+
   /**
    * Creates a new instance with a keychain
-   *
-   * @param {import('./index')} keychain - the available keys
-   * @param {string} dek
    */
-  constructor (keychain, dek) {
-    if (!keychain) {
-      throw errcode(new Error('keychain is required'), codes.ERR_KEYCHAIN_REQUIRED)
+  constructor (keychain: KeyChain, dek: string) {
+    if (keychain == null) {
+      throw errCode(new Error('keychain is required'), codes.ERR_KEYCHAIN_REQUIRED)
     }
 
     this.keychain = keychain
@@ -43,20 +42,21 @@ class CMS {
    * Creates some protected data.
    *
    * The output Uint8Array contains the PKCS #7 message in DER.
-   *
-   * @param {string} name - The local key name.
-   * @param {Uint8Array} plain - The data to encrypt.
-   * @returns {Promise<Uint8Array>}
    */
-  async encrypt (name, plain) {
+  async encrypt (name: string, plain: Uint8Array): Promise<Uint8Array> {
     if (!(plain instanceof Uint8Array)) {
-      throw errcode(new Error('Plain data must be a Uint8Array'), codes.ERR_INVALID_PARAMETERS)
+      throw errCode(new Error('Plain data must be a Uint8Array'), codes.ERR_INVALID_PARAMETERS)
     }
 
     const key = await this.keychain.findKeyByName(name)
-    const pem = await this.keychain._getPrivateKey(name)
-    /** @type {string} */
-    const dek = privates.get(this).dek
+    const pem = await this.keychain.getPrivateKey(name)
+    const cached = privates.get(this)
+
+    if (cached == null) {
+      throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS)
+    }
+
+    const dek = cached.dek
     const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek)
     const certificate = await certificateForKey(key, privateKey)
 
@@ -76,71 +76,75 @@ class CMS {
    *
    * The keychain must contain one of the keys used to encrypt the data.  If none of the keys
    * exists, an Error is returned with the property 'missingKeys'.  It is array of key ids.
-   *
-   * @param {Uint8Array} cmsData - The CMS encrypted data to decrypt.
-   * @returns {Promise<Uint8Array>}
    */
-  async decrypt (cmsData) {
+  async decrypt (cmsData: Uint8Array): Promise<Uint8Array> {
     if (!(cmsData instanceof Uint8Array)) {
-      throw errcode(new Error('CMS data is required'), codes.ERR_INVALID_PARAMETERS)
+      throw errCode(new Error('CMS data is required'), codes.ERR_INVALID_PARAMETERS)
     }
 
-    let cms
+    let cms: any
     try {
       const buf = forge.util.createBuffer(uint8ArrayToString(cmsData, 'ascii'))
       const obj = forge.asn1.fromDer(buf)
-      // @ts-ignore not defined
+
       cms = forge.pkcs7.messageFromAsn1(obj)
-    } catch (/** @type {any} */ err) {
-      throw errcode(new Error('Invalid CMS: ' + err.message), codes.ERR_INVALID_CMS)
+    } catch (err: any) {
+      log.error(err)
+      throw errCode(new Error('Invalid CMS'), codes.ERR_INVALID_CMS)
     }
 
     // Find a recipient whose key we hold. We only deal with recipient certs
     // issued by ipfs (O=ipfs).
-    const recipients = cms.recipients
-      // @ts-ignore cms types not defined
+    const recipients: any = cms.recipients
+      // @ts-expect-error cms types not defined
       .filter(r => r.issuer.find(a => a.shortName === 'O' && a.value === 'ipfs'))
-      // @ts-ignore cms types not defined
+      // @ts-expect-error cms types not defined
       .filter(r => r.issuer.find(a => a.shortName === 'CN'))
-      // @ts-ignore cms types not defined
+      // @ts-expect-error cms types not defined
       .map(r => {
         return {
           recipient: r,
-          // @ts-ignore cms types not defined
+          // @ts-expect-error cms types not defined
           keyId: r.issuer.find(a => a.shortName === 'CN').value
         }
       })
 
-    const r = await findAsync(recipients, async (recipient) => {
+    const r = await findAsync(recipients, async (recipient: any) => {
       try {
         const key = await this.keychain.findKeyById(recipient.keyId)
-        if (key) return true
-      } catch (/** @type {any} */ err) {
+        if (key != null) {
+          return true
+        }
+      } catch (err: any) {
         return false
       }
       return false
     })
 
-    if (!r) {
-      // @ts-ignore cms types not defined
-      const missingKeys = recipients.map(r => r.keyId)
-      throw errcode(new Error('Decryption needs one of the key(s): ' + missingKeys.join(', ')), codes.ERR_MISSING_KEYS, {
+    if (r == null) {
+      // @ts-expect-error cms types not defined
+      const missingKeys: string[] = recipients.map(r => r.keyId)
+      throw errCode(new Error(`Decryption needs one of the key(s): ${missingKeys.join(', ')}`), codes.ERR_MISSING_KEYS, {
         missingKeys
       })
     }
 
     const key = await this.keychain.findKeyById(r.keyId)
 
-    if (!key) {
-      throw errcode(new Error('No key available to decrypto'), codes.ERR_NO_KEY)
+    if (key == null) {
+      throw errCode(new Error('No key available to decrypto'), codes.ERR_NO_KEY)
+    }
+
+    const pem = await this.keychain.getPrivateKey(key.name)
+    const cached = privates.get(this)
+
+    if (cached == null) {
+      throw errCode(new Error('dek missing'), codes.ERR_INVALID_PARAMETERS)
     }
 
-    const pem = await this.keychain._getPrivateKey(key.name)
-    const dek = privates.get(this).dek
+    const dek = cached.dek
     const privateKey = forge.pki.decryptRsaPrivateKey(pem, dek)
     cms.decrypt(r.recipient, privateKey)
     return uint8ArrayFromString(cms.content.getBytes(), 'ascii')
   }
 }
-
-module.exports = CMS