sliftutils 1.4.88 → 1.5.0

package/index.d.ts

@@ -72,7 +72,7 @@ declare module "sliftutils/misc/https/certs" {
     import * as forge from "node-forge";
     import { MaybePromise } from "socket-function/src/types";
     export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-    export declare const identityStorageKey = "machineCA_10";
+    export declare const identityStorageKey = "machineCA_11";
     export type IdentityStorageType = {
         domain: string;
         certB64: string;
@@ -99,7 +99,7 @@ declare module "sliftutils/misc/https/certs" {
     export declare const sign: (keyPair: {
         key: string | Buffer;
     }, data: unknown) => string;
-    export declare function verify(cert: string, signature: string, data: unknown): boolean;
+    export declare function verify(cert: string, signature: string, data: unknown): void;
     export declare function validateCACert(domain: string, cert: string | Buffer): void;
     export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
     export declare function generateKeyPair(): forge.pki.rsa.KeyPair;
@@ -108,21 +108,22 @@ declare module "sliftutils/misc/https/certs" {
     export declare function createCertFromCA(config: {
         CAKeyPair: X509KeyPair;
     }): X509KeyPair;
-    export declare function getMachineId(domainName: string): string;
+    export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
     export type NodeIdParts = {
         threadId: string;
         machineId: string;
         domain: string;
         port: number;
     };
-    export declare function decodeNodeId(nodeId: string): NodeIdParts | undefined;
-    export declare function decodeNodeIdAssert(nodeId: string): NodeIdParts;
+    export declare function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined;
+    export declare function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts;
     export declare function encodeNodeId(parts: NodeIdParts): string;
     export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
     export declare function loadIdentityCA(domain: string): Promise<void>;
     export declare function getIdentityCA(domain: string): X509KeyPair;
     export declare function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>;
     export declare function getOwnMachineId(domain: string): string;
+    export declare function getOwnThreadId(domain: string): string;
     /** Part of the machineId comes from the publicKey, so we can use it to verify */
     export declare function verifyMachineIdForPublicKey(config: {
         machineId: string;
@@ -291,6 +292,11 @@ declare module "sliftutils/misc/random" {
 
 }
 
+declare module "sliftutils/misc/strings" {
+    export declare function ellipsize(text: string, maxLength: number): string;
+
+}
+
 declare module "sliftutils/misc/types" {
     export declare function isDefined<T>(value: T | undefined | null): value is T;
     export declare function freezeObject(value: unknown): unknown;

package/misc/https/certs.d.ts

@@ -5,7 +5,7 @@
 import * as forge from "node-forge";
 import { MaybePromise } from "socket-function/src/types";
 export declare const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
-export declare const identityStorageKey = "machineCA_10";
+export declare const identityStorageKey = "machineCA_11";
 export type IdentityStorageType = {
     domain: string;
     certB64: string;
@@ -32,7 +32,7 @@ export declare function getPublicIdentifier(PEMorDER: string | Buffer): Buffer;
 export declare const sign: (keyPair: {
     key: string | Buffer;
 }, data: unknown) => string;
-export declare function verify(cert: string, signature: string, data: unknown): boolean;
+export declare function verify(cert: string, signature: string, data: unknown): void;
 export declare function validateCACert(domain: string, cert: string | Buffer): void;
 export declare function validateCertificate(domain: string, cert: Buffer | string, issuerCert: Buffer | string): void;
 export declare function generateKeyPair(): forge.pki.rsa.KeyPair;
@@ -41,21 +41,22 @@ export declare function generateTestCA(domain: string): X509KeyPair;
 export declare function createCertFromCA(config: {
     CAKeyPair: X509KeyPair;
 }): X509KeyPair;
-export declare function getMachineId(domainName: string): string;
+export declare function getMachineId(domainNameOrNodeId: string, domain: string): string;
 export type NodeIdParts = {
     threadId: string;
     machineId: string;
     domain: string;
     port: number;
 };
-export declare function decodeNodeId(nodeId: string): NodeIdParts | undefined;
-export declare function decodeNodeIdAssert(nodeId: string): NodeIdParts;
+export declare function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined;
+export declare function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts;
 export declare function encodeNodeId(parts: NodeIdParts): string;
 export declare function setIdentityCARaw(domain: string, json: string): Promise<void>;
 export declare function loadIdentityCA(domain: string): Promise<void>;
 export declare function getIdentityCA(domain: string): X509KeyPair;
 export declare function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>;
 export declare function getOwnMachineId(domain: string): string;
+export declare function getOwnThreadId(domain: string): string;
 /** Part of the machineId comes from the publicKey, so we can use it to verify */
 export declare function verifyMachineIdForPublicKey(config: {
     machineId: string;

package/misc/https/certs.ts

@@ -19,6 +19,7 @@ import { MaybePromise } from "socket-function/src/types";
 import { SocketFunction } from "socket-function/SocketFunction";
 import { resetAllNodeCallFactories } from "socket-function/src/nodeCache";
 import { getKeyStore } from "./persistentLocalStorage";
+import { ellipsize } from "../strings";
 
 setFlag(require, "node-forge", "allowclient", true);
 setFlag(require, "js-sha256", "allowclient", true);
@@ -27,7 +28,7 @@ const timeInDay = 1000 * 60 * 60 * 24;
 
 export const CA_NOT_FOUND_ERROR = "18aa7318-f88f-4d2d-b41f-3daf4a433827";
 
-export const identityStorageKey = "machineCA_10";
+export const identityStorageKey = "machineCA_11";
 export type IdentityStorageType = { domain: string; certB64: string; keyB64: string };
 
 function getIdentityStore(domain: string) {
@@ -99,21 +100,17 @@ export function createX509(
                     //{ type: 7, ip: "127.0.0.1" }
                 ]
             },
-            // NOTE: nameConstraints are supported with our branch. But... chrome doesn't support them, so there's no point in using them.
+            // NOTE: nameConstraints require our forked node-forge:
             //      "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
-            // {
-            //     name: "nameConstraints",
-            //     permittedSubtrees: [
-            //         // Chrome doesn't respect nameConstraints per https://bugs.chromium.org/p/chromium/issues/detail?id=1072083,
-            //         //  as the spec decided that "free to process or ignore such information" (when present in self
-            //         //  signed certificates), and therefore the chrome implementation decided "The first order is to behave predictably",
-            //         //  so... they're not going to support it, because why have a feature in one place, if it isn't
-            //         //  on android as well... ugh...
-            //         // Works fine on Edge though
-            //         { type: 2, value: forge.util.encodeUtf8(domain) },
-            //         { type: 2, value: forge.util.encodeUtf8(localHostDomain) },
-            //     ]
-            // },
+            //  Chrome ignores them (https://bugs.chromium.org/p/chromium/issues/detail?id=1072083),
+            //  but our own validation (validateCACert/validateCertificate) enforces them.
+            {
+                name: "nameConstraints",
+                permittedSubtrees: [
+                    { type: 2, value: forge.util.encodeUtf8(domain) },
+                    { type: 2, value: forge.util.encodeUtf8(localHostDomain) },
+                ]
+            },
         ]);
         certObj.setExtensions(extensions);
 
@@ -191,7 +188,9 @@ export const sign = measureWrap(function sign(keyPair: { key: string | Buffer },
 
 export function verify(cert: string, signature: string, data: unknown) {
     let certObj = parseCert(cert);
-    return (certObj.publicKey as forge.pki.rsa.PublicKey).verify(JSON.stringify(data), signature);
+    if (!(certObj.publicKey as forge.pki.rsa.PublicKey).verify(JSON.stringify(data), signature)) {
+        throw new Error(`Signature verification failed. Signature: ${JSON.stringify(signature)} | Data: ${ellipsize(JSON.stringify(data), 1024)}`);
+    }
 }
 
 function normalizeCertToPEM(PEMorDER: string | Buffer): string {
@@ -211,7 +210,7 @@ function getDomainPartFromPublicKey(publicKey: { publicKeyBytes: Buffer } | forg
     } else {
         bytes = Buffer.from(new Uint32Array((publicKey as any).n.data).buffer);
     }
-    return "b" + sha265.sha256(Buffer.from(bytes)).slice(0, 16).replaceAll("+", "-").replaceAll("/", "_");
+    return "b" + Buffer.from(sha265.sha256.array(Buffer.from(bytes))).toString("base64").slice(0, 16).replaceAll("+", "-").replaceAll("/", "_");
 }
 
 export function validateCACert(domain: string, cert: string | Buffer) {
@@ -440,8 +439,8 @@ export function createCertFromCA(config: {
     });
 }
 
-export function getMachineId(domainName: string) {
-    return domainName.split(".").slice(-3).join(".");
+export function getMachineId(domainNameOrNodeId: string, domain: string) {
+    return decodeNodeIdAssert(domainNameOrNodeId, domain, "allowMissingThreadId").machineId;
 }
 
 export type NodeIdParts = {
@@ -450,13 +449,18 @@ export type NodeIdParts = {
     domain: string;
     port: number;
 };
-export function decodeNodeId(nodeId: string): NodeIdParts | undefined {
+export function decodeNodeId(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts | undefined {
     let locationObj = getNodeIdLocation(nodeId);
     if (!locationObj) {
         return undefined;
     }
     let parts = locationObj.address.split(".");
-    if (nodeId.startsWith("127-0-0-1.") && parts.length === 3) {
+    // NOTE: We have to only allow localhost domains on our own domain, as the underlying domain
+    //  gets stripped when we're looking at the machineId. So if we allowed localhost domains on
+    //  other domains, a server could trick us into connecting to it, and then once the connection
+    //  is established, it could talk back and we would think it has a localhost machineId, which
+    //  is implicitly trusted, which would then give it access to everything.
+    if (locationObj.address === `127-0-0-1.${domain}` && nodeId.includes(":")) {
         return {
             threadId: "",
             machineId: parts.at(-3) || "",
@@ -464,7 +468,8 @@ export function decodeNodeId(nodeId: string): NodeIdParts | undefined {
             port: locationObj.port,
         };
     }
-    if (parts.length < 4) {
+    let isValid = parts.length >= 4 || allowMissingThreadId && parts.length === 3;
+    if (!isValid) {
         return undefined;
     }
     return {
@@ -474,10 +479,10 @@ export function decodeNodeId(nodeId: string): NodeIdParts | undefined {
         port: locationObj.port,
     };
 }
-export function decodeNodeIdAssert(nodeId: string): NodeIdParts {
-    let result = decodeNodeId(nodeId);
+export function decodeNodeIdAssert(nodeId: string, domain: string, allowMissingThreadId?: "allowMissingThreadId"): NodeIdParts {
+    let result = decodeNodeId(nodeId, domain, allowMissingThreadId);
     if (!result) {
-        throw new Error(`Invalid nodeId: ${nodeId}`);
+        throw new Error(`Invalid nodeId: ${JSON.stringify(nodeId)}`);
     }
     return result;
 }
@@ -523,7 +528,10 @@ export function getIdentityCAPromise(domain: string): MaybePromise<X509KeyPair>
 
 
 export function getOwnMachineId(domain: string) {
-    return getMachineId(getIdentityCA(domain).domain);
+    return getMachineId(getIdentityCA(domain).domain, domain);
+}
+export function getOwnThreadId(domain: string) {
+    return decodeNodeIdAssert(getThreadKeyCert(domain).domain, domain).threadId;
 }
 
 /** Part of the machineId comes from the publicKey, so we can use it to verify */
@@ -533,7 +541,8 @@ export function verifyMachineIdForPublicKey(config: {
 }): boolean {
     let { machineId, publicKey } = config;
     let domainPart = getDomainPartFromPublicKey(publicKey);
-    return machineId.split(".").at(-3) === domainPart;
+    // machineId is the bare key-hash label, but also accept legacy "hash.domain.tld" forms
+    return machineId.split(".")[0] === domainPart;
 }
 
 // NOTE: We don't have a cache per CA, as... the CA should be set first

package/misc/strings.d.ts

@@ -0,0 +1 @@
+export declare function ellipsize(text: string, maxLength: number): string;

package/misc/strings.ts

@@ -0,0 +1,8 @@
+module.allowclient = true;
+
+export function ellipsize(text: string, maxLength: number): string {
+    if (text.length <= maxLength) {
+        return text;
+    }
+    return text.slice(0, maxLength - 3) + "...";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.4.88",
+    "version": "1.5.0",
     "main": "index.js",
     "license": "MIT",
     "files": [