open-managed-agents 0.1.0

package/dist/src/control-plane/egress/vendor/mitm-ca.js

@@ -0,0 +1,226 @@
+/**
+ * MITM CA loader/generator for the in-process TLS-terminating proxy.
+ *
+ * The CA is supplied via `network.tlsTerminate.{caCertPath,caKeyPath}` (see
+ * sandbox-config.ts). If both paths are omitted, SRT generates an ephemeral
+ * RSA-2048 self-signed CA into a temp directory; the cert path is what the
+ * trust env vars point at. The caller is responsible for cleaning up via
+ * `disposeMitmCA()` (SandboxManager.reset() does this).
+ */
+import forge from 'node-forge';
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { rootCertificates } from 'node:tls';
+import { logForDebugging } from "../utils/debug.js";
+const { pki, md, random, util } = forge;
+/**
+ * Matches one PEM CERTIFICATE block. Used to extract just the certificates
+ * out of files listed in tlsTerminate.extraCaCertPaths before they are
+ * copied into the (world-readable) trust bundle.
+ */
+const PEM_CERT_BLOCK = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+/**
+ * Create a MitmCA. If `caCertPath`/`caKeyPath` are provided, load from disk
+ * (throws if either file is missing, unreadable, not PEM, fails to parse, or
+ * the key is not RSA). If both are omitted, generate an ephemeral CA into a
+ * fresh temp directory.
+ *
+ * Pure factory: no module-level state. The caller (SandboxManager) owns the
+ * returned object and its lifetime.
+ */
+export function createMitmCA(opts) {
+    if (opts.caCertPath && opts.caKeyPath) {
+        return loadCA(opts.caCertPath, opts.caKeyPath, opts.extraCaCertPaths);
+    }
+    if (opts.caCertPath || opts.caKeyPath) {
+        throw new Error('tlsTerminate: caCertPath and caKeyPath must be provided together');
+    }
+    return generateEphemeralCA(opts.extraCaCertPaths);
+}
+/**
+ * Remove the SRT-owned temp directories for this CA: the trust-bundle dir
+ * always, and the cert/key dir too when SRT generated the CA (for an
+ * ephemeral CA they are the same directory). User-supplied CA files are
+ * left alone.
+ */
+export async function disposeMitmCA(ca) {
+    const dirs = new Set([dirname(ca.trustBundlePath)]);
+    if (ca.ephemeral)
+        dirs.add(dirname(ca.certPath));
+    for (const dir of dirs) {
+        try {
+            await rm(dir, { recursive: true, force: true });
+        }
+        catch (err) {
+            logForDebugging(`[mitm-ca] cleanup failed: ${err.message}`, {
+                level: 'warn',
+            });
+        }
+    }
+}
+/**
+ * Write the child-facing trust bundle into `dir` and return its path: the
+ * MITM CA first, then the roots the host would normally trust, so HTTPS
+ * clients in the sandbox accept proxy-minted leaves AND can still verify the
+ * real certificate of any host SRT tunnels opaquely instead of terminating
+ * (tlsTerminate.excludeDomains). Bundling Node's root store is best-effort
+ * compatibility — a tool with its own CA file config is unaffected. Extra
+ * roots from tlsTerminate.extraCaCertPaths go last, with the same append
+ * semantics as NODE_EXTRA_CA_CERTS.
+ */
+function writeTrustBundle(dir, caCertPem, extraCaCertPaths) {
+    const parts = [caCertPem.trim(), ...rootCertificates];
+    // Honour extra roots the parent process trusts (e.g. a corporate CA).
+    const extra = process.env.NODE_EXTRA_CA_CERTS;
+    if (extra) {
+        try {
+            parts.push(readFileSync(extra, 'utf8').trim());
+        }
+        catch {
+            // Missing/unreadable NODE_EXTRA_CA_CERTS: ignore, same as Node does.
+        }
+    }
+    // Honour site-local roots from config (tlsTerminate.extraCaCertPaths),
+    // e.g. an internal mTLS CA presented by excluded/passthrough hosts. Paths
+    // may exist on only some hosts, so a missing file is skipped, not fatal —
+    // but log it, or a typo'd path is undiagnosable.
+    for (const extraPath of extraCaCertPaths ?? []) {
+        let raw;
+        try {
+            raw = readFileSync(extraPath, 'utf8');
+        }
+        catch (err) {
+            const code = err.code ?? String(err);
+            logForDebugging(`[mitm-ca] extraCaCertPaths: cannot read ${extraPath} (${code}); ` +
+                `skipping`, { level: 'warn' });
+            continue;
+        }
+        // Append only the CERTIFICATE blocks. The bundle is world-readable
+        // (0o644) and handed to the sandboxed child, so anything else the file
+        // carries (e.g. the key of a combined cert+key PEM) must not be copied.
+        const certs = raw.match(PEM_CERT_BLOCK);
+        if (!certs) {
+            logForDebugging(`[mitm-ca] extraCaCertPaths: ${extraPath} has no PEM CERTIFICATE ` +
+                `block; skipping`, { level: 'warn' });
+            continue;
+        }
+        parts.push(...certs);
+    }
+    const path = join(dir, 'trust-bundle.crt');
+    writeFileSync(path, parts.join('\n') + '\n', { mode: 0o644 });
+    return path;
+}
+function loadCA(certPath, keyPath, extraCaCertPaths) {
+    const certPem = readPem(certPath, 'CERTIFICATE', 'tlsTerminate.caCertPath');
+    const keyPem = readPem(keyPath, 'PRIVATE KEY', 'tlsTerminate.caKeyPath');
+    let cert;
+    let key;
+    try {
+        cert = pki.certificateFromPem(certPem);
+        key = pki.privateKeyFromPem(keyPem);
+    }
+    catch (err) {
+        throw new Error(`tlsTerminate: failed to parse CA from ${certPath}: ` +
+            err.message);
+    }
+    if (!('n' in key) || !('d' in key)) {
+        // node-forge can only sign with RSA private keys.
+        throw new Error(`tlsTerminate.caKeyPath: CA key at ${keyPath} must be RSA`);
+    }
+    // The CA files are the user's; the trust bundle still needs an SRT-owned
+    // directory of its own.
+    const bundleDir = mkdtempSync(join(tmpdir(), 'srt-ca-'));
+    const trustBundlePath = writeTrustBundle(bundleDir, certPem, extraCaCertPaths);
+    logForDebugging(`[mitm-ca] loaded CA from ${certPath}`);
+    return {
+        certPath,
+        keyPath,
+        trustBundlePath,
+        certPem,
+        keyPem,
+        cert,
+        key: key,
+        leafCerts: new Map(),
+        secureContexts: new Map(),
+        ephemeral: false,
+    };
+}
+function generateEphemeralCA(extraCaCertPaths) {
+    const keys = pki.rsa.generateKeyPair(2048);
+    const cert = pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = randomSerial();
+    cert.validity.notBefore = daysFromNow(-1);
+    cert.validity.notAfter = daysFromNow(825);
+    const subject = [
+        { name: 'commonName', value: 'sandbox-runtime ephemeral CA' },
+        { name: 'organizationName', value: 'sandbox-runtime' },
+    ];
+    cert.setSubject(subject);
+    cert.setIssuer(subject);
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: true, critical: true },
+        {
+            name: 'keyUsage',
+            critical: true,
+            keyCertSign: true,
+            cRLSign: true,
+            digitalSignature: true,
+        },
+        { name: 'subjectKeyIdentifier' },
+    ]);
+    cert.sign(keys.privateKey, md.sha256.create());
+    const certPem = pki.certificateToPem(cert);
+    const keyPem = pki.privateKeyToPem(keys.privateKey);
+    // Write to disk so trust env vars (NODE_EXTRA_CA_CERTS etc.) can point at
+    // a real path. mkdtemp gives us an unguessable per-process directory.
+    const dir = mkdtempSync(join(tmpdir(), 'srt-ca-'));
+    const certPath = join(dir, 'ca.crt');
+    const keyPath = join(dir, 'ca.key');
+    writeFileSync(certPath, certPem, { mode: 0o644 });
+    writeFileSync(keyPath, keyPem, { mode: 0o600 });
+    const trustBundlePath = writeTrustBundle(dir, certPem, extraCaCertPaths);
+    logForDebugging(`[mitm-ca] generated ephemeral CA at ${certPath}`);
+    return {
+        certPath,
+        keyPath,
+        trustBundlePath,
+        certPem,
+        keyPem,
+        cert,
+        key: keys.privateKey,
+        leafCerts: new Map(),
+        secureContexts: new Map(),
+        ephemeral: true,
+    };
+}
+function readPem(path, label, field) {
+    let pem;
+    try {
+        pem = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        const code = err.code ?? String(err);
+        throw new Error(`${field}: cannot read ${path} (${code})`);
+    }
+    // Accept either the exact label or a prefixed variant (e.g. "RSA PRIVATE KEY",
+    // "EC PRIVATE KEY") for the key case.
+    if (!new RegExp(`-----BEGIN [A-Z ]*${label}-----`).test(pem)) {
+        throw new Error(`${field}: ${path} is not a PEM ${label}`);
+    }
+    return pem;
+}
+function randomSerial() {
+    // 16 random bytes, high bit cleared so the DER INTEGER stays positive.
+    const bytes = random.getBytesSync(16);
+    const hex = util.bytesToHex(bytes);
+    const firstNibble = parseInt(hex[0], 16) & 0x7;
+    return firstNibble.toString(16) + hex.slice(1);
+}
+function daysFromNow(days) {
+    const d = new Date();
+    d.setDate(d.getDate() + days);
+    return d;
+}

package/dist/src/control-plane/egress/vendor/mitm-leaf.js

@@ -0,0 +1,124 @@
+/**
+ * Per-host leaf certificate minter for the in-process TLS-terminating proxy.
+ *
+ * Given a MitmCA (see mitm-ca.ts), mints a leaf certificate for a specific
+ * hostname on first use and caches it for the lifetime of that CA instance.
+ * The leaf is signed by the CA and carries SAN=DNS:<host> (or IP:<addr>),
+ * so a client that trusts the CA will accept it for that host.
+ */
+import forge from 'node-forge';
+import { isIP } from 'node:net';
+import { createSecureContext } from 'node:tls';
+import { logForDebugging } from "../utils/debug.js";
+const { pki, md, random, util } = forge;
+/**
+ * Mint (or return cached) an RSA-2048 leaf cert for `hostname`, signed by `ca`.
+ * The cache lives on `ca.leafCerts`.
+ */
+export function mintLeafCert(ca, hostname) {
+    const cached = ca.leafCerts.get(hostname);
+    if (cached)
+        return cached;
+    const keys = pki.rsa.generateKeyPair(2048);
+    const cert = pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = randomSerial();
+    const notBefore = daysFromNow(-1);
+    cert.validity.notBefore = notBefore;
+    cert.validity.notAfter = clampValidity(ca.cert, notBefore);
+    cert.setSubject([{ name: 'commonName', value: hostname }]);
+    cert.setIssuer(ca.cert.subject.attributes);
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: false, critical: true },
+        {
+            name: 'keyUsage',
+            critical: true,
+            digitalSignature: true,
+            keyEncipherment: true,
+        },
+        { name: 'extKeyUsage', serverAuth: true },
+        { name: 'subjectAltName', altNames: [sanFor(hostname)] },
+        { name: 'subjectKeyIdentifier' },
+        // Python ≥3.13 enables ssl.VERIFY_X509_STRICT by default, which enforces
+        // RFC 5280's "AKI MUST be present on non-self-signed certs". curl/Go/Node
+        // don't enforce this, but requests/urllib3/httpx/google-auth all reject
+        // a leaf without AKI under 3.13. See caSubjectKeyId() for why we can't
+        // just pass the CA's stored SKI value through.
+        { name: 'authorityKeyIdentifier', keyIdentifier: caSubjectKeyId(ca.cert) },
+    ]);
+    cert.sign(ca.key, md.sha256.create());
+    const leaf = {
+        certPem: pki.certificateToPem(cert) + ca.certPem,
+        keyPem: pki.privateKeyToPem(keys.privateKey),
+    };
+    ca.leafCerts.set(hostname, leaf);
+    logForDebugging(`[mitm-leaf] minted RSA leaf for ${hostname}`);
+    return leaf;
+}
+/**
+ * Mint-or-cache a Node TLS SecureContext for `hostname`. Intended as the
+ * SNICallback target in the terminating proxy. The cache lives on
+ * `ca.secureContexts`.
+ */
+export function secureContextFor(ca, hostname) {
+    const cached = ca.secureContexts.get(hostname);
+    if (cached)
+        return cached;
+    const { certPem, keyPem } = mintLeafCert(ca, hostname);
+    const ctx = createSecureContext({ cert: certPem, key: keyPem });
+    ca.secureContexts.set(hostname, ctx);
+    return ctx;
+}
+/**
+ * Return the CA's Subject Key Identifier as raw bytes for use as the leaf's
+ * authorityKeyIdentifier.keyIdentifier.
+ *
+ * node-forge stores a cert's subjectKeyIdentifier extension value as a *hex
+ * string* (both for in-memory certs and certs parsed from PEM), but expects
+ * AKI's keyIdentifier as *raw bytes* — passing the hex through verbatim
+ * encodes the ASCII hex chars as the key id and the chain fails to verify.
+ * If the CA has no SKI extension (e.g. a v1 user-supplied CA), derive the
+ * RFC 5280 method-1 value from its public key.
+ */
+function caSubjectKeyId(caCert) {
+    const ext = caCert.getExtension('subjectKeyIdentifier');
+    return ext?.subjectKeyIdentifier
+        ? util.hexToBytes(ext.subjectKeyIdentifier)
+        : caCert.generateSubjectKeyIdentifier().getBytes();
+}
+function sanFor(hostname) {
+    // RFC 5280 GeneralName tags: 2 = dNSName, 7 = iPAddress.
+    return isIP(hostname) !== 0
+        ? { type: 7, ip: hostname }
+        : { type: 2, value: hostname };
+}
+/**
+ * Leaf validity capped at min(CA notAfter, notBefore+99d).
+ *
+ * 99d sits below every TLS cert validity ceiling we care about: the current
+ * (2026-03) CA/B baseline of 200d, the next step-down to 100d in 2027-03, the
+ * historical 398d public cap, and the macOS ~825d ceiling that trips
+ * errSecCertificateIsNotStandardsCompliant on user-installed roots. Leaves are
+ * re-minted per session, so we don't need the headroom.
+ *
+ * Anchored at notBefore — not now — because notBefore is backdated by 1 day,
+ * so `now+Nd` would produce an (N+1)-day span and lose a day of margin.
+ */
+function clampValidity(caCert, notBefore) {
+    const caEnd = caCert.validity.notAfter;
+    const max = new Date(notBefore);
+    max.setDate(max.getDate() + 99);
+    return caEnd < max ? new Date(caEnd) : max;
+}
+function randomSerial() {
+    // 16 random bytes, high bit cleared so the DER INTEGER stays positive.
+    const bytes = random.getBytesSync(16);
+    const hex = util.bytesToHex(bytes);
+    const firstNibble = parseInt(hex[0], 16) & 0x7;
+    return firstNibble.toString(16) + hex.slice(1);
+}
+function daysFromNow(days) {
+    const d = new Date();
+    d.setDate(d.getDate() + days);
+    return d;
+}