pyre-cli 2.0.0 → 3.0.0

package/src/p2p/server.ts

@@ -1,7 +1,10 @@
 import net from 'node:net';
+import tls from 'node:tls';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
 import chalk from 'chalk';
 import { collectAll } from '../monitors/index.js';
-import { encodeAuthOk, encodeAuthFail, encodeData, encodePing, encodePong, encodeDisconnect } from './protocol.js';
+import { encodeAuthOk, encodeAuthFail, encodeData, encodePing, encodePong, encodeDisconnect, hashPassword, computeHMAC, verifyHMAC, signMessage, decodeMessage, generateNonce } from './protocol.js';
 import type { P2PServerOptions, P2PConnectionInfo } from './types.js';
 
 interface Peer {
@@ -12,9 +15,14 @@ interface Peer {
   readBuffer: Buffer;
   readExpectingHeader: boolean;
   readMessageLength: number;
+  ip: string;
+  pendingNonce: string | null;
 }
 
 const HEADER_SIZE = 4;
+const DEFAULT_RATE_LIMIT_MAX = 5;
+const DEFAULT_RATE_LIMIT_WINDOW = 60000;
+const HMAC_KEY_LENGTH = 32;
 
 function readMessageFromPeer(peer: Peer): Buffer | null {
   while (peer.readBuffer.length > 0) {
@@ -42,14 +50,44 @@ function readMessageFromPeer(peer: Peer): Buffer | null {
   return null;
 }
 
+function isIPAllowed(ip: string, allowedIPs: string[], deniedIPs: string[]): boolean {
+  for (const denied of deniedIPs) {
+    if (ip === denied || ip.startsWith(denied)) {
+      return false;
+    }
+  }
+  if (allowedIPs.length === 0) {
+    return true;
+  }
+  for (const allowed of allowedIPs) {
+    if (ip === allowed || ip.startsWith(allowed)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+interface RateLimitEntry {
+  attempts: number;
+  firstAttempt: number;
+}
+
+function deriveHMACKey(password: string): string {
+  return crypto.createHash('sha256').update(password).digest('hex').slice(0, HMAC_KEY_LENGTH);
+}
+
 export class P2PServer {
-  private server: net.Server | null = null;
+  private server: net.Server | tls.Server | null = null;
   private peers: Map<net.Socket, Peer> = new Map();
   private options: P2PServerOptions;
   private running = false;
+  private rateLimitMap: Map<string, RateLimitEntry> = new Map();
+  private auditStream: fs.WriteStream | null = null;
+  private hmacKey: string;
 
   constructor(options: P2PServerOptions) {
     this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
   }
 
   get info(): P2PConnectionInfo {
@@ -61,16 +99,45 @@ export class P2PServer {
   }
 
   async start(): Promise<void> {
+    if (this.options.auditLog) {
+      try {
+        fs.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-audit.log`;
+        this.auditStream = fs.createWriteStream(logFile, { flags: 'a' });
+      } catch {
+        console.log(chalk.yellow('Warning: could not open audit log'));
+      }
+    }
+
     return new Promise((resolve, reject) => {
-      this.server = net.createServer((socket) => this.onConnection(socket));
-      this.server.on('error', (err) => reject(err));
+      const useTLS = !!(this.options.tlsCert && this.options.tlsKey);
+
+      if (useTLS) {
+        const tlsOptions: tls.SecureContextOptions = {
+          key: fs.readFileSync(this.options.tlsKey!),
+          cert: fs.readFileSync(this.options.tlsCert!),
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs.readFileSync(this.options.tlsCA!);
+        }
+        this.server = tls.createServer(tlsOptions, (socket) => this.onConnection(socket));
+      } else {
+        this.server = net.createServer((socket) => this.onConnection(socket));
+      }
+
+      this.server.on('error', (err: Error) => reject(err));
       this.server.listen(this.options.port, this.options.host, () => {
         this.running = true;
         const addr = this.server?.address();
         const bound = addr ? (typeof addr === 'object' ? `${addr.address}:${addr.port}` : String(addr)) : 'unknown';
-        console.log(chalk.green(`P2P server listening on ${bound}`));
+        const protocol = useTLS ? 'TLS' : 'TCP';
+        console.log(chalk.green(`P2P server listening on ${bound} (${protocol})`));
         console.log(chalk.dim(`  Password: ${this.options.password}`));
         console.log(chalk.dim(`  Interval: ${this.options.intervalMs}ms`));
+        const allowedIPs = this.options.allowedIPs ?? [];
+        const deniedIPs = this.options.deniedIPs ?? [];
+        if (allowedIPs.length > 0) console.log(chalk.dim(`  Allowed IPs: ${allowedIPs.join(', ')}`));
+        if (deniedIPs.length > 0) console.log(chalk.dim(`  Denied IPs: ${deniedIPs.join(', ')}`));
         resolve();
       });
     });
@@ -82,13 +149,79 @@ export class P2PServer {
       this.disconnectPeer(peer, 'Server shutting down');
     }
     this.peers.clear();
+    this.rateLimitMap.clear();
     if (this.server) {
       this.server.close();
       this.server = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
+  }
+
+  private audit(ip: string, event: string, detail: string): void {
+    if (!this.auditStream) return;
+    const ts = new Date().toISOString();
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}\n`);
+  }
+
+  private getPeerIP(socket: net.Socket): string {
+    const addr = socket.remoteAddress;
+    if (!addr) return 'unknown';
+    if (addr.startsWith('::ffff:')) {
+      return addr.slice(7);
+    }
+    return addr;
+  }
+
+  private checkRateLimit(ip: string): boolean {
+    const maxAttempts = this.options.rateLimitMaxAttempts ?? DEFAULT_RATE_LIMIT_MAX;
+    const windowMs = this.options.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW;
+    const now = Date.now();
+
+    const entry = this.rateLimitMap.get(ip);
+    if (!entry) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+
+    if (now - entry.firstAttempt > windowMs) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+
+    entry.attempts++;
+    if (entry.attempts > maxAttempts) {
+      return false;
+    }
+    return true;
+  }
+
+  private cleanupRateLimit(ip: string): void {
+    this.rateLimitMap.delete(ip);
   }
 
   private onConnection(socket: net.Socket): void {
+    const ip = this.getPeerIP(socket);
+
+    const allowedIPs = this.options.allowedIPs ?? [];
+    const deniedIPs = this.options.deniedIPs ?? [];
+
+    if (!isIPAllowed(ip, allowedIPs, deniedIPs)) {
+      this.audit(ip, 'BLOCKED', 'IP not allowed');
+      console.log(chalk.yellow(`Blocked IP: ${ip}`));
+      socket.destroy();
+      return;
+    }
+
+    if (!this.checkRateLimit(ip)) {
+      this.audit(ip, 'RATE_LIMITED', 'Too many auth attempts');
+      console.log(chalk.yellow(`Rate limit exceeded for IP: ${ip}`));
+      socket.destroy();
+      return;
+    }
+
     const peer: Peer = {
       socket,
       authenticated: false,
@@ -97,6 +230,8 @@ export class P2PServer {
       readBuffer: Buffer.alloc(0),
       readExpectingHeader: true,
       readMessageLength: 0,
+      ip,
+      pendingNonce: null,
     };
     this.peers.set(socket, peer);
 
@@ -104,6 +239,7 @@ export class P2PServer {
       ? `${socket.remoteAddress}:${socket.remotePort}`
       : 'unknown';
     console.log(chalk.cyan(`Peer connected: ${remoteAddr}`));
+    this.audit(ip, 'CONNECT', remoteAddr);
 
     socket.on('data', (data) => this.onData(peer, data));
     socket.on('close', () => this.onPeerClose(peer));
@@ -115,6 +251,10 @@ export class P2PServer {
         this.disconnectPeer(peer, 'Authentication timeout');
       }
     });
+
+    const nonce = generateNonce();
+    this.sendSigned(peer, signMessage('challenge', { nonce }, this.hmacKey));
+    peer.pendingNonce = nonce;
   }
 
   private onData(peer: Peer, data: Buffer): void {
@@ -131,34 +271,62 @@ export class P2PServer {
 
   private handleAuthMessage(peer: Peer, body: Buffer): void {
     try {
-      const msg = JSON.parse(body.toString('utf-8'));
-      if (msg.kind === 'auth' && typeof msg.payload?.password === 'string') {
-        if (msg.payload.password === this.options.password) {
-          peer.authenticated = true;
-          peer.socket.write(encodeAuthOk());
-          console.log(chalk.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
-          this.startDataStream(peer);
-          this.startPing(peer);
-        } else {
-          peer.socket.write(encodeAuthFail('Invalid password'));
-          this.disconnectPeer(peer, 'Authentication failed');
-        }
-      } else {
-        peer.socket.write(encodeAuthFail('Expected auth message first'));
+      const raw = body.toString('utf-8');
+      const msg = decodeMessage(body);
+      if (msg.kind !== 'auth') {
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Expected auth message first' }, this.hmacKey));
         this.disconnectPeer(peer, 'Expected auth message');
+        return;
+      }
+
+      const authPayload = msg.payload as { passwordHash?: string; nonce?: string };
+      if (!authPayload.passwordHash || !authPayload.nonce) {
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid auth payload' }, this.hmacKey));
+        this.disconnectPeer(peer, 'Invalid auth payload');
+        return;
+      }
+
+      if (peer.pendingNonce && authPayload.nonce !== peer.pendingNonce) {
+        this.audit(peer.ip, 'AUTH_FAIL', 'Nonce mismatch');
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid nonce' }, this.hmacKey));
+        this.disconnectPeer(peer, 'Invalid nonce');
+        return;
+      }
+
+      const expectedHash = hashPassword(this.options.password, authPayload.nonce);
+      if (authPayload.passwordHash !== expectedHash) {
+        this.audit(peer.ip, 'AUTH_FAIL', 'Invalid password hash');
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid password' }, this.hmacKey));
+        this.disconnectPeer(peer, 'Authentication failed');
+        return;
       }
+
+      peer.authenticated = true;
+      this.cleanupRateLimit(peer.ip);
+      peer.pendingNonce = null;
+      peer.socket.write(signMessage('auth-ok', { ok: true }, this.hmacKey));
+      console.log(chalk.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, 'AUTH_OK', 'Challenge-response successful');
+      this.startDataStream(peer);
+      this.startPing(peer);
     } catch {
-      peer.socket.write(encodeAuthFail('Invalid message format'));
+      peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid message format' }, this.hmacKey));
       this.disconnectPeer(peer, 'Invalid message format');
     }
   }
 
+  private sendSigned(peer: Peer, message: Buffer): void {
+    if (!peer.socket.destroyed) {
+      peer.socket.write(message);
+    }
+  }
+
   private startDataStream(peer: Peer): void {
     const send = async () => {
       if (!peer.authenticated || peer.socket.destroyed) return;
       try {
         const data = await collectAll({ detailed: this.options.detailed });
-        peer.socket.write(encodeData(data));
+        this.sendSigned(peer, signMessage('data', { stats: data }, this.hmacKey));
       } catch {
         // skip failed tick
       }
@@ -171,28 +339,31 @@ export class P2PServer {
   private startPing(peer: Peer): void {
     peer.pingHandle = setInterval(() => {
       if (peer.socket.destroyed) return;
-      peer.socket.write(encodePing());
+      this.sendSigned(peer, signMessage('ping', { ts: Date.now() }, this.hmacKey));
     }, 5000);
   }
 
   private onPeerClose(peer: Peer): void {
     this.cleanupPeer(peer);
     console.log(chalk.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
+    this.audit(peer.ip, 'DISCONNECT', 'Peer closed connection');
   }
 
   private onPeerError(peer: Peer, err: Error): void {
     const code = (err as any).code;
     if (code === 'ECONNRESET') {
       console.log(chalk.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, 'ERROR', 'Connection reset');
     } else {
       console.log(chalk.red(`Peer error: ${err.message}`));
+      this.audit(peer.ip, 'ERROR', err.message);
     }
     this.cleanupPeer(peer);
   }
 
   private disconnectPeer(peer: Peer, reason: string): void {
     try {
-      peer.socket.write(encodeDisconnect(reason));
+      this.sendSigned(peer, signMessage('disconnect', { reason }, this.hmacKey));
     } catch {
       // socket may already be closed
     }

package/src/p2p/types.ts

@@ -5,15 +5,21 @@
  * (host) and a pyre client (peer) over a TCP connection.
  */
 
-export type P2PMessageKind = 'auth' | 'auth-ok' | 'auth-fail' | 'data' | 'ping' | 'pong' | 'disconnect';
+export type P2PMessageKind = 'auth' | 'auth-ok' | 'auth-fail' | 'data' | 'ping' | 'pong' | 'disconnect' | 'challenge';
 
 export interface P2PMessage {
   kind: P2PMessageKind;
   payload: unknown;
+  hmac?: string;
+}
+
+export interface ChallengeMessage {
+  nonce: string;
 }
 
 export interface AuthMessage {
-  password: string;
+  passwordHash: string;
+  nonce: string;
 }
 
 export interface AuthOkMessage {
@@ -42,6 +48,7 @@ export interface DisconnectMessage {
 }
 
 export type P2PPayload =
+  | ChallengeMessage
   | AuthMessage
   | AuthOkMessage
   | AuthFailMessage
@@ -56,16 +63,35 @@ export interface P2PServerOptions {
   password: string;
   intervalMs: number;
   detailed: boolean;
+  tlsCert?: string;
+  tlsKey?: string;
+  tlsCA?: string;
+  rateLimitMaxAttempts?: number;
+  rateLimitWindowMs?: number;
+  allowedIPs?: string[];
+  deniedIPs?: string[];
+  auditLog?: string;
+  hmacKey?: string;
 }
 
 export interface P2PClientOptions {
   host: string;
   port: number;
   password: string;
+  tls?: boolean;
+  tlsCA?: string;
+  tlsInsecure?: boolean;
+  auditLog?: string;
+  hmacKey?: string;
 }
 
 export interface P2PConnectionInfo {
   host: string;
   port: number;
   peersConnected: number;
+}
+
+interface RateLimitEntry {
+  attempts: number;
+  firstAttempt: number;
 }