omniroute 2.3.13 → 2.3.15

package/app/src/mitm/cert/install.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCertInstalled = checkCertInstalled;
+exports.installCert = installCert;
+exports.uninstallCert = uninstallCert;
+const fs_1 = __importDefault(require("fs"));
+const crypto_1 = __importDefault(require("crypto"));
+const child_process_1 = require("child_process");
+const dnsConfig_1 = require("../dns/dnsConfig");
+const IS_WIN = process.platform === "win32";
+// Get SHA1 fingerprint from cert file using Node.js crypto
+function getCertFingerprint(certPath) {
+    const pem = fs_1.default.readFileSync(certPath, "utf-8");
+    const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
+    return crypto_1.default.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":");
+}
+/**
+ * Check if certificate is already installed in system store
+ */
+async function checkCertInstalled(certPath) {
+    if (IS_WIN) {
+        return checkCertInstalledWindows(certPath);
+    }
+    return checkCertInstalledMac(certPath);
+}
+function checkCertInstalledMac(certPath) {
+    return new Promise((resolve) => {
+        try {
+            const fingerprint = getCertFingerprint(certPath);
+            (0, child_process_1.exec)(`security find-certificate -a -Z /Library/Keychains/System.keychain | grep -i "${fingerprint}"`, (error) => {
+                resolve(!error);
+            });
+        }
+        catch {
+            resolve(false);
+        }
+    });
+}
+function checkCertInstalledWindows(certPath) {
+    return new Promise((resolve) => {
+        // Check Root store for our cert by subject name
+        (0, child_process_1.exec)("certutil -store Root daily-cloudcode-pa.googleapis.com", (error) => {
+            resolve(!error);
+        });
+    });
+}
+/**
+ * Install SSL certificate to system trust store
+ */
+async function installCert(sudoPassword, certPath) {
+    if (!fs_1.default.existsSync(certPath)) {
+        throw new Error(`Certificate file not found: ${certPath}`);
+    }
+    const isInstalled = await checkCertInstalled(certPath);
+    if (isInstalled) {
+        console.log("✅ Certificate already installed");
+        return;
+    }
+    if (IS_WIN) {
+        await installCertWindows(certPath);
+    }
+    else {
+        await installCertMac(sudoPassword, certPath);
+    }
+}
+async function installCertMac(sudoPassword, certPath) {
+    const command = `sudo -S security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`;
+    try {
+        await (0, dnsConfig_1.execWithPassword)(command, sudoPassword);
+        console.log(`✅ Installed certificate to system keychain: ${certPath}`);
+    }
+    catch (error) {
+        const msg = error.message?.includes("canceled")
+            ? "User canceled authorization"
+            : "Certificate install failed";
+        throw new Error(msg);
+    }
+}
+async function installCertWindows(certPath) {
+    // Use PowerShell elevated to add cert to Root store
+    const psCommand = `Start-Process certutil -ArgumentList '-addstore','Root','${certPath.replace(/'/g, "''")}' -Verb RunAs -Wait`;
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.exec)(`powershell -Command "${psCommand}"`, (error) => {
+            if (error) {
+                reject(new Error(`Failed to install certificate: ${error.message}`));
+            }
+            else {
+                console.log(`✅ Installed certificate to Windows Root store`);
+                resolve(void 0);
+            }
+        });
+    });
+}
+/**
+ * Uninstall SSL certificate from system store
+ */
+async function uninstallCert(sudoPassword, certPath) {
+    const isInstalled = await checkCertInstalled(certPath);
+    if (!isInstalled) {
+        console.log("Certificate not found in system store");
+        return;
+    }
+    if (IS_WIN) {
+        await uninstallCertWindows();
+    }
+    else {
+        await uninstallCertMac(sudoPassword, certPath);
+    }
+}
+async function uninstallCertMac(sudoPassword, certPath) {
+    const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+    const command = `sudo -S security delete-certificate -Z "${fingerprint}" /Library/Keychains/System.keychain`;
+    try {
+        await (0, dnsConfig_1.execWithPassword)(command, sudoPassword);
+        console.log("✅ Uninstalled certificate from system keychain");
+    }
+    catch (err) {
+        throw new Error("Failed to uninstall certificate");
+    }
+}
+async function uninstallCertWindows() {
+    const psCommand = `Start-Process certutil -ArgumentList '-delstore','Root','daily-cloudcode-pa.googleapis.com' -Verb RunAs -Wait`;
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.exec)(`powershell -Command "${psCommand}"`, (error) => {
+            if (error) {
+                reject(new Error(`Failed to uninstall certificate: ${error.message}`));
+            }
+            else {
+                console.log("✅ Uninstalled certificate from Windows Root store");
+                resolve(void 0);
+            }
+        });
+    });
+}

package/app/src/mitm/dns/dnsConfig.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.execWithPassword = execWithPassword;
+exports.checkDNSEntry = checkDNSEntry;
+exports.addDNSEntry = addDNSEntry;
+exports.removeDNSEntry = removeDNSEntry;
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const TARGET_HOST = "daily-cloudcode-pa.googleapis.com";
+const IS_WIN = process.platform === "win32";
+const HOSTS_FILE = IS_WIN
+    ? path_1.default.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
+    : "/etc/hosts";
+/**
+ * Execute command with sudo password via stdin (macOS/Linux only)
+ */
+function execWithPassword(command, password) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.exec)(command, (error, stdout, stderr) => {
+            if (error) {
+                reject(new Error(`Command failed: ${error.message}\n${stderr}`));
+            }
+            else {
+                resolve(stdout);
+            }
+        });
+        child.stdin.write(`${password}\n`);
+        child.stdin.end();
+    });
+}
+/**
+ * Execute elevated command on Windows via PowerShell RunAs
+ */
+function execElevatedWindows(command) {
+    return new Promise((resolve, reject) => {
+        const psCommand = `Start-Process cmd -ArgumentList '/c','${command.replace(/'/g, "''")}' -Verb RunAs -Wait`;
+        (0, child_process_1.exec)(`powershell -Command "${psCommand}"`, (error, stdout, stderr) => {
+            if (error) {
+                reject(new Error(`Elevated command failed: ${error.message}\n${stderr}`));
+            }
+            else {
+                resolve(stdout);
+            }
+        });
+    });
+}
+/**
+ * Check if DNS entry already exists
+ */
+function checkDNSEntry() {
+    try {
+        const hostsContent = fs_1.default.readFileSync(HOSTS_FILE, "utf8");
+        return hostsContent.includes(TARGET_HOST);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Add DNS entry to hosts file
+ */
+async function addDNSEntry(sudoPassword) {
+    if (checkDNSEntry()) {
+        console.log(`DNS entry for ${TARGET_HOST} already exists`);
+        return;
+    }
+    const entry = `127.0.0.1 ${TARGET_HOST}`;
+    try {
+        if (IS_WIN) {
+            // Windows: use elevated echo >> hosts
+            await execElevatedWindows(`echo ${entry} >> "${HOSTS_FILE}"`);
+        }
+        else {
+            const command = `echo "${entry}" | sudo -S tee -a ${HOSTS_FILE} > /dev/null`;
+            await execWithPassword(command, sudoPassword);
+        }
+        console.log(`✅ Added DNS entry: ${entry}`);
+    }
+    catch (error) {
+        throw new Error(`Failed to add DNS entry: ${error.message}`);
+    }
+}
+/**
+ * Remove DNS entry from hosts file
+ */
+async function removeDNSEntry(sudoPassword) {
+    if (!checkDNSEntry()) {
+        console.log(`DNS entry for ${TARGET_HOST} does not exist`);
+        return;
+    }
+    try {
+        if (IS_WIN) {
+            // Windows: read, filter, write back via elevated PowerShell
+            const psScript = `(Get-Content '${HOSTS_FILE}') | Where-Object { $_ -notmatch '${TARGET_HOST}' } | Set-Content '${HOSTS_FILE}'`;
+            const psCommand = `Start-Process powershell -ArgumentList '-Command','${psScript.replace(/'/g, "''")}' -Verb RunAs -Wait`;
+            await new Promise((resolve, reject) => {
+                (0, child_process_1.exec)(`powershell -Command "${psCommand}"`, (error) => {
+                    if (error)
+                        reject(new Error(`Failed to remove DNS entry: ${error.message}`));
+                    else
+                        resolve(void 0);
+                });
+            });
+        }
+        else {
+            const command = `sudo -S sed -i '' '/${TARGET_HOST}/d' ${HOSTS_FILE}`;
+            await execWithPassword(command, sudoPassword);
+        }
+        console.log(`✅ Removed DNS entry for ${TARGET_HOST}`);
+    }
+    catch (error) {
+        throw new Error(`Failed to remove DNS entry: ${error.message}`);
+    }
+}

package/app/src/mitm/manager.js

@@ -0,0 +1,229 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getCachedPassword = getCachedPassword;
+exports.setCachedPassword = setCachedPassword;
+exports.clearCachedPassword = clearCachedPassword;
+exports.getMitmStatus = getMitmStatus;
+exports.startMitm = startMitm;
+exports.stopMitm = stopMitm;
+const child_process_1 = require("child_process");
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const dataPaths_1 = require("@/lib/dataPaths");
+const dnsConfig_1 = require("./dns/dnsConfig");
+const generate_1 = require("./cert/generate");
+const install_1 = require("./cert/install");
+// Store server process
+let serverProcess = null;
+let serverPid = null;
+// Module-scoped password cache (not exposed on globalThis).
+// Cleared automatically when the MITM proxy is stopped.
+let _cachedPassword = null;
+function getCachedPassword() {
+    return _cachedPassword;
+}
+function setCachedPassword(pwd) {
+    _cachedPassword = pwd || null;
+}
+function clearCachedPassword() {
+    _cachedPassword = null;
+}
+// server.js is in same directory as this file
+const PID_FILE = path_1.default.join((0, dataPaths_1.resolveDataDir)(), "mitm", ".mitm.pid");
+// Check if a PID is alive
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Get MITM status
+ */
+async function getMitmStatus() {
+    // Check in-memory process first, then fallback to PID file
+    let running = serverProcess !== null && !serverProcess.killed;
+    let pid = serverPid;
+    if (!running) {
+        try {
+            if (fs_1.default.existsSync(PID_FILE)) {
+                const savedPid = parseInt(fs_1.default.readFileSync(PID_FILE, "utf-8").trim(), 10);
+                if (savedPid && isProcessAlive(savedPid)) {
+                    running = true;
+                    pid = savedPid;
+                }
+                else {
+                    // Stale PID file, clean up
+                    fs_1.default.unlinkSync(PID_FILE);
+                }
+            }
+        }
+        catch {
+            // Ignore
+        }
+    }
+    // Check DNS configuration
+    let dnsConfigured = false;
+    try {
+        const hostsContent = fs_1.default.readFileSync("/etc/hosts", "utf-8");
+        dnsConfigured = hostsContent.includes("daily-cloudcode-pa.googleapis.com");
+    }
+    catch {
+        // Ignore
+    }
+    // Check cert
+    const certDir = path_1.default.join((0, dataPaths_1.resolveDataDir)(), "mitm");
+    const certExists = fs_1.default.existsSync(path_1.default.join(certDir, "server.crt"));
+    return { running, pid, dnsConfigured, certExists };
+}
+/**
+ * Start MITM proxy
+ * @param {string} apiKey - OmniRoute API key
+ * @param {string} sudoPassword - Sudo password for DNS/cert operations
+ */
+async function startMitm(apiKey, sudoPassword) {
+    // Check if already running
+    if (serverProcess && !serverProcess.killed) {
+        throw new Error("MITM proxy is already running");
+    }
+    // 1. Generate SSL certificate if not exists
+    const certPath = path_1.default.join((0, dataPaths_1.resolveDataDir)(), "mitm", "server.crt");
+    if (!fs_1.default.existsSync(certPath)) {
+        console.log("Generating SSL certificate...");
+        await (0, generate_1.generateCert)();
+    }
+    // 2. Install certificate to system keychain
+    await (0, install_1.installCert)(sudoPassword, certPath);
+    // 3. Add DNS entry
+    console.log("Adding DNS entry...");
+    await (0, dnsConfig_1.addDNSEntry)(sudoPassword);
+    // 4. Start MITM server
+    console.log("Starting MITM server...");
+    const serverPath = path_1.default.join(process.cwd(), "src/mitm/server.js");
+    serverProcess = (0, child_process_1.spawn)("node", [serverPath], {
+        env: {
+            ...process.env,
+            ROUTER_API_KEY: apiKey,
+            NODE_ENV: "production",
+        },
+        detached: false,
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    serverPid = serverProcess.pid;
+    // Save PID to file
+    fs_1.default.writeFileSync(PID_FILE, String(serverPid));
+    // Log server output
+    serverProcess.stdout.on("data", (data) => {
+        console.log(`[MITM Server] ${data.toString().trim()}`);
+    });
+    serverProcess.stderr.on("data", (data) => {
+        console.error(`[MITM Server Error] ${data.toString().trim()}`);
+    });
+    serverProcess.on("exit", (code) => {
+        console.log(`MITM server exited with code ${code}`);
+        serverProcess = null;
+        serverPid = null;
+        // Remove PID file
+        try {
+            fs_1.default.unlinkSync(PID_FILE);
+        }
+        catch (error) {
+            // Ignore
+        }
+    });
+    // Wait and verify server actually started
+    const started = await new Promise((resolve) => {
+        let resolved = false;
+        const timeout = setTimeout(() => {
+            if (!resolved) {
+                resolved = true;
+                resolve(true);
+            }
+        }, 2000);
+        serverProcess.on("exit", (code) => {
+            clearTimeout(timeout);
+            if (!resolved) {
+                resolved = true;
+                resolve(false);
+            }
+        });
+        // Check stderr for error messages
+        serverProcess.stderr.on("data", (data) => {
+            const msg = data.toString().trim();
+            if (msg.includes("Port") && msg.includes("already in use")) {
+                clearTimeout(timeout);
+                if (!resolved) {
+                    resolved = true;
+                    resolve(false);
+                }
+            }
+        });
+    });
+    if (!started) {
+        throw new Error("MITM server failed to start (port 443 may be in use)");
+    }
+    return {
+        running: true,
+        pid: serverPid,
+    };
+}
+/**
+ * Stop MITM proxy
+ * @param {string} sudoPassword - Sudo password for DNS cleanup
+ */
+async function stopMitm(sudoPassword) {
+    // 1. Kill server process (in-memory or from PID file)
+    const proc = serverProcess;
+    if (proc && !proc.killed) {
+        console.log("Stopping MITM server...");
+        proc.kill("SIGTERM");
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+        if (!proc.killed) {
+            proc.kill("SIGKILL");
+        }
+        serverProcess = null;
+        serverPid = null;
+    }
+    else {
+        // Fallback: kill by PID file
+        try {
+            if (fs_1.default.existsSync(PID_FILE)) {
+                const savedPid = parseInt(fs_1.default.readFileSync(PID_FILE, "utf-8").trim(), 10);
+                if (savedPid && isProcessAlive(savedPid)) {
+                    console.log(`Killing MITM server (PID: ${savedPid})...`);
+                    process.kill(savedPid, "SIGTERM");
+                    await new Promise((resolve) => setTimeout(resolve, 1000));
+                    if (isProcessAlive(savedPid)) {
+                        process.kill(savedPid, "SIGKILL");
+                    }
+                }
+            }
+        }
+        catch {
+            // Ignore
+        }
+        serverProcess = null;
+        serverPid = null;
+    }
+    // 2. Remove DNS entry
+    console.log("Removing DNS entry...");
+    await (0, dnsConfig_1.removeDNSEntry)(sudoPassword);
+    // 3. Clean up
+    clearCachedPassword(); // Clear password from memory when proxy stops
+    try {
+        fs_1.default.unlinkSync(PID_FILE);
+    }
+    catch (error) {
+        // Ignore
+    }
+    return {
+        running: false,
+        pid: null,
+    };
+}