sliftutils 1.7.143 → 1.7.144

package/index.d.ts

@@ -417,6 +417,7 @@ declare module "sliftutils/misc/random" {
     export declare function getSeededRandom(seed: number): () => number;
     export declare function shuffle<T>(array: T[], seed: number): T[];
     export declare function secureRandom(): number;
+    export declare function secureRandomHex(byteLength: number): string;
 
 }
 

package/misc/random.d.ts

@@ -1,3 +1,4 @@
 export declare function getSeededRandom(seed: number): () => number;
 export declare function shuffle<T>(array: T[], seed: number): T[];
 export declare function secureRandom(): number;
+export declare function secureRandomHex(byteLength: number): string;

package/misc/random.ts

@@ -42,4 +42,14 @@ export function secureRandom(): number {
         crypto.getRandomValues(randomData);
     }
     return randomDataF64[0];
+}
+
+export function secureRandomHex(byteLength: number): string {
+    let data = new Uint8Array(byteLength);
+    if (!isNode()) {
+        window.crypto.getRandomValues(data);
+    } else {
+        crypto.getRandomValues(data);
+    }
+    return Array.from(data).map(x => x.toString(16).padStart(2, "0")).join("");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sliftutils",
-    "version": "1.7.143",
+    "version": "1.7.144",
     "main": "index.js",
     "license": "MIT",
     "files": [

package/security/machines/identity2.ts

@@ -1,9 +1,38 @@
+/*
+    NOTE: This whole verification process isn't secure if someone man-in-the-middles the IP. There is a way to make it more secure, but right now it is quite a bit of work. Here is the outline, though. 
+
+    a) Use libsodium, do handshake ourself over unsecured websocket (or random self signed websocket), and use ChaCha20 for encryption so it's fast
+        - This lets us use ED25519 certificates. 
+    b) Integrate with socket-function, So we can do everything with regular socket function calls. It's a lot nicer of an interface. We can even have it proxied to Python. As annoying as that is...
+    c) Use github pages to host the site, so we can also host the machine keys
+        - Every time they change, we need to redeploy, and... we don't get revocations without deploying. BUT... it's better than nothing.
+
+    NOTE: Just using real HTTPS certificates isn't really an alternative.
+        - They won't be bound to IPs
+        - Revoking them is a lot more difficult (and they won't be automatically revoked)
+        - Once you reach certain level of machines, you're going to run into problems with different certificates per machine
+        - You're still going to need a way to give servers access to either the certificates or a way to generate the certificates.
+
+    So doing it with our own code isn't about cost or difficulty. The reason we would want to implement it ourselves is because HTTPS wasn't made to create an internal network of trust. It's designed around web browsing, and it works well for that. However, for two-way authentication, there are significantly better systems.
+*/
+
 import sha256 from "js-sha256";
 import { isNode } from "socket-function/src/misc";
+import { secureRandomHex } from "../../misc/random";
 import { getCommonName, getIdentityCA, getMachineId, getThreadKeyCert, sign, validateCertificate, verify } from "../../misc/https/certs";
 import { getTrustedMachines } from "./machines";
 
 const MAX_SIGNED_AGE = 5 * 60 * 1000;
+// Clocks disagree, so a payload from slightly ahead is normal - but one from far ahead would
+// never age out, and so would never stop being accepted.
+const MAX_SIGNED_FUTURE = 60 * 60 * 1000;
+const NONCE_BYTES = 16;
+// Nonces of the requests we have accepted, so none of them can be replayed. Cleared wholesale at
+// the limit rather than expired one by one: reaching it takes a million signed requests inside
+// the five minute window, which is a server being hammered - something we would notice for other
+// reasons - and all it buys is one replay of one request.
+const MAX_SEEN_NONCES = 1000 * 1000;
+let seenNonces = new Set<string>();
 
 export type SignedRequest<T> = {
     signature: string;
@@ -16,6 +45,9 @@ export type SignedRequest<T> = {
         // real server, and the middleman cannot write requests of its own because it is not a
         // trusted machine.
         targetId: string;
+        targetIsMachineId?: boolean;
+        // Makes the request one use only - the server refuses a nonce it has already accepted
+        nonce: string;
         // The thread certificate that signed this
         cert: string;
         // The machine CA that issued cert - the machineId comes from its common name
@@ -40,12 +72,25 @@ function dataHash(data: unknown) {
     return sha256.sha256(JSON.stringify(data));
 }
 
-export function signRequest<T>(domain: string, config: { targetId: string; data: T }): SignedRequest<T> {
+function assertSignedTime(kind: string, time: number) {
+    let oldest = Date.now() - MAX_SIGNED_AGE;
+    if (time < oldest) {
+        throw new Error(`Signed ${kind} is too old, ${time} < ${oldest}`);
+    }
+    let newest = Date.now() + MAX_SIGNED_FUTURE;
+    if (time > newest) {
+        throw new Error(`Signed ${kind} is too far in the future, ${time} > ${newest}`);
+    }
+}
+
+export function signRequest<T>(domain: string, config: { targetId: string; targetIsMachineId?: boolean; data: T }): SignedRequest<T> {
     let threadKeyCert = getThreadKeyCert(domain);
     let issuer = getIdentityCA(domain);
     let payload: SignedRequest<T>["payload"] = {
         time: Date.now(),
         targetId: config.targetId,
+        targetIsMachineId: config.targetIsMachineId,
+        nonce: secureRandomHex(NONCE_BYTES),
         cert: threadKeyCert.cert.toString(),
         certIssuer: issuer.cert.toString(),
         data: config.data,
@@ -69,15 +114,20 @@ export function verifyRequest<T>(domain: string, signed: SignedRequest<T>, ownId
     reply: SignedReply;
 } {
     let { signature, payload } = signed;
-    let signedThreshold = Date.now() - MAX_SIGNED_AGE;
-    if (payload.time < signedThreshold) {
-        throw new Error(`Signed request too old, ${payload.time} < ${signedThreshold}`);
-    }
+    assertSignedTime("request", payload.time);
     verify(payload.cert, signature, payload);
     validateCertificate(domain, payload.cert, payload.certIssuer);
     if (!ownIdentities.includes(payload.targetId)) {
         throw new Error(`Request is for someone else. It is addressed to ${payload.targetId}, we are ${ownIdentities.join(", ")}`);
     }
+    // After the signature, so only a real signer can take up a slot
+    if (seenNonces.has(payload.nonce)) {
+        throw new Error(`Request ${payload.nonce} was already used, so it is being refused as a replay`);
+    }
+    if (seenNonces.size >= MAX_SEEN_NONCES) {
+        seenNonces.clear();
+    }
+    seenNonces.add(payload.nonce);
     let machineId = getMachineId(getCommonName(payload.certIssuer), domain);
     let threadKeyCert = getThreadKeyCert(domain);
     let issuer = getIdentityCA(domain);
@@ -96,15 +146,13 @@ export function verifyRequest<T>(domain: string, signed: SignedRequest<T>, ownId
 }
 
 /** Returns the machineId that replied. Throws if the signature, certificate chain, or time do
-    not check out, or if the reply does not answer the request we actually sent. On node the
-    replying machine must also be one of the trusted machines - the browser has no machine list,
-    so there this check is skipped. */
+    not check out, or if the reply does not answer the request we actually sent. When the request
+    said targetIsMachineId, the machine that replied must be the machine the request was
+    addressed to. On node the replying machine must also be one of the trusted machines - the
+    browser has no machine list, so there that check is skipped. */
 export async function verifyReply(domain: string, request: SignedRequest<unknown>, reply: SignedReply): Promise<{ machineId: string }> {
     let { signature, payload } = reply;
-    let signedThreshold = Date.now() - MAX_SIGNED_AGE;
-    if (payload.time < signedThreshold) {
-        throw new Error(`Signed reply too old, ${payload.time} < ${signedThreshold}`);
-    }
+    assertSignedTime("reply", payload.time);
     verify(payload.cert, signature, payload);
     validateCertificate(domain, payload.cert, payload.certIssuer);
     let { data: requestData, ...requestRest } = request.payload;
@@ -113,6 +161,9 @@ export async function verifyReply(domain: string, request: SignedRequest<unknown
         throw new Error(`Reply answers a different request than the one we sent`);
     }
     let machineId = getMachineId(getCommonName(payload.certIssuer), domain);
+    if (request.payload.targetIsMachineId && machineId !== request.payload.targetId) {
+        throw new Error(`Reply is from machine ${machineId}, but the request was addressed to machine ${request.payload.targetId}`);
+    }
     if (isNode()) {
         if (!(await getTrustedMachines()).some(machine => machine.machineId === machineId)) {
             throw new Error(`Reply is signed by ${machineId}, which is not a trusted machine`);