socket-function 0.8.0 → 0.8.3

package/SocketFunction.ts

@@ -30,6 +30,8 @@ export class SocketFunction {
         type: "gzip";
     };
     public static httpETagCache = false;
+    public static rejectUnauthorized = true;
+    public static additionalTrustedRootCAs: string[] = [];
 
     public static register<
         ClassInstance extends object,

package/SocketFunctionTypes.ts

@@ -1,3 +1,6 @@
+import debugbreak from "debugbreak";
+import * as tls from "tls";
+
 export const socket = Symbol("socket");
 
 export type SocketExposedInterface = {
@@ -30,13 +33,13 @@ export interface SocketFunctionHook<ExposedType extends SocketExposedInterface =
 export type HookContext<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> = {
     call: CallType;
     context: SocketRegistered["context"];
-    // If the result is overriden, we continue evaluating hooks and perform the final call
+    // If the result is overriden, we continue evaluating hooks BUT NOT perform the final call
     overrideResult?: unknown;
 };
 
 export type ClientHookContext<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> = {
     call: CallType;
-    // If the result is overriden, we continue evaluating hooks and perform the final call
+    // If the result is overriden, we continue evaluating hooks BUT NOT perform the final call
     overrideResult?: unknown;
 };
 export interface SocketFunctionClientHook<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> {
@@ -70,8 +73,28 @@ export type CallerContext = {
     // The location of the server. It helps if it is told, due to the fact that one server
     //  can serve multiple domains.
     serverLocation: NetworkLocation;
+
+    // NOTE: Only set in NodeJS, as clientside we are not given access to the certificate information.
+    //  TODO: Limit this type to only have the information we need, possible in a slightly different format.
+    certInfo: tls.DetailedPeerCertificate | undefined;
+
+    // TODO: Add callerBrowserAuthIP, which will allow "Proxy-IP" (or whatever cloudflare uses? It has to be a
+    //  header which the browser is restricted from sending), to override this, allowing the browser to use
+    //  proxies.
+    //  - We have to also ONLY accept this from certain trusted servers, as otherwise it is too easy to spoof.
+    //callerBrowserAuthIP: string;
 };
 
+export function setCertInfo(socket: tls.TLSSocket | undefined, context: CallerContext) {
+    if (!socket) return;
+    let cert = socket.getPeerCertificate(true);
+    /** Check for a property, because "If the peer does not provide a certificate, an empty object will be
+        returned. If the socket has been destroyed, `null` will be returned." */
+    if (cert?.issuer) {
+        context.certInfo = cert;
+    }
+}
+
 // IMPORTANT! Nodes at the same network location may vary, so you cannot store NetworkLocation
 //  in a list of allowed users, otherwise they can be impersonated!
 export interface NetworkLocation {

package/hot/HotReloadController.ts

@@ -0,0 +1,65 @@
+import { SocketFunction } from "../SocketFunction";
+import { cache, lazy } from "../src/caching";
+import * as fs from "fs";
+
+/** Hot reloads server and client files, just trigger a refresh clientside,
+ *      while triggering per file re-evaluation and export updates serverside.
+ *      - Requires HotReloadController to be exposed.
+ */
+export function watchFilesAndTriggerHotReloading() {
+    setInterval(() => {
+        for (let module of Object.values(require.cache)) {
+            if (!module) continue;
+            hotReloadModule(module);
+        }
+    }, 5000);
+}
+
+
+const hotReloadModule = cache((module: NodeJS.Module) => {
+    if (!module.updateContents) return;
+    fs.watchFile(module.filename, { persistent: false, interval: 1000 }, (curr, prev) => {
+        if (curr.mtime.getTime() === prev.mtime.getTime()) return;
+        console.log(`Hot reloading due to change: ${module.filename}`);
+        module.updateContents?.();
+        triggerClientSideReload();
+    });
+});
+let reloadTriggering = false;
+let clientWatcherNodes = new Set<string>();
+function triggerClientSideReload() {
+    if (reloadTriggering) return;
+    reloadTriggering = true;
+    setTimeout(async () => {
+        reloadTriggering = false;
+        for (let clientNodeId of clientWatcherNodes) {
+            console.log(`Notifying client of hot reload: ${clientNodeId}`);
+            HotReloadController.nodes[clientNodeId].fileUpdated().catch(() => {
+                console.log(`Removing erroring client: ${clientNodeId}`);
+                clientWatcherNodes.delete(clientNodeId);
+            });
+        }
+    }, 300);
+}
+
+class HotReloadControllerBase {
+    async watchFiles() {
+        let callerId = HotReloadController.context.caller?.nodeId;
+        if (!callerId) {
+            throw new Error("No nodeId?");
+        }
+        clientWatcherNodes.add(callerId);
+    }
+    async fileUpdated() {
+        document.location.reload();
+    }
+}
+
+export const HotReloadController = SocketFunction.register(
+    "HotReloadController-032b2250-3aac-4187-8c95-75412742b8f5",
+    new HotReloadControllerBase(),
+    {
+        watchFiles: {},
+        fileUpdated: {}
+    }
+);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.8.0",
+	"version": "0.8.3",
 	"main": "index.js",
 	"license": "MIT",
 	"dependencies": {
@@ -9,7 +9,7 @@
 		"@types/ws": "^8.5.3",
 		"cookie": "^0.5.0",
 		"debugbreak": "^0.6.5",
-		"typenode": "*",
+		"typenode": "^0.5.6",
 		"ws": "^8.8.0"
 	},
 	"scripts": {

package/spec.txt

@@ -1,6 +1,5 @@
 spec.txt
 
-- Add a flag for rejectUnauthorized, that is off by default
 - Add the ability to specify the certs yourself (so you can specify your identity with a real cert)
     - Then use real certificates on the server
 - Fix multiple clients on the same machines

package/src/CallFactory.ts

@@ -1,13 +1,14 @@
-import { CallerContext, CallType, NetworkLocation } from "../SocketFunctionTypes";
+import { CallerContext, CallType, NetworkLocation, setCertInfo } from "../SocketFunctionTypes";
 import * as ws from "ws";
 import type * as net from "net";
 import { performLocalCall } from "./callManager";
 import { convertErrorStackToError, formatNumberSuffixed, isNode } from "./misc";
-import { createWebsocket, getNodeId, getTLSSocket } from "./nodeAuthentication";
+import { createWebsocketFactory, getNodeId, getTLSSocket } from "./nodeAuthentication";
 import debugbreak from "debugbreak";
 import http from "http";
 import { SocketFunction } from "../SocketFunction";
 import { gzip } from "zlib";
+import * as tls from "tls";
 
 const retryInterval = 2000;
 
@@ -80,6 +81,8 @@ export async function callFactoryFromWS(
 
 export interface SenderInterface {
     nodeId?: string;
+    // Only set AFTER "open" (if set at all, as in the browser we don't have access to the socket).
+    socket?: tls.TLSSocket;
 
     send(data: string | Buffer): void;
 
@@ -107,6 +110,8 @@ async function createCallFactory(
         niceConnectionName += `(${fromPort})`;
     }
 
+    const createWebsocket = createWebsocketFactory();
+
     let retriesEnabled = location.listeningPorts.length > 0;
 
     let lastReceivedSeqNum = 0;
@@ -127,7 +132,7 @@ async function createCallFactory(
     let nextSeqNum = Math.random();
 
     const pendingNodeId = "PENDING";
-    let callerContext: CallerContext = { location, nodeId: pendingNodeId, serverLocation, fromPort };
+    let callerContext: CallerContext = { location, nodeId: pendingNodeId, serverLocation, fromPort, certInfo: undefined };
     let webSocket!: SenderInterface;
     if (!webSocketBase) {
         await tryToReconnect();
@@ -258,8 +263,8 @@ async function createCallFactory(
                     return;
                 }
 
-                console.error(`Connection retry to ${location.address}:${port} failed, retrying in ${retryInterval}ms`);
                 reconnectAttempts++;
+                console.error(`Connection retry to ${location.address}:${port} failed (attempt ${reconnectAttempts}), retrying in ${retryInterval}ms, error: ${JSON.stringify(connectError)}`);
                 await new Promise(resolve => setTimeout(resolve, retryInterval));
             }
         })();
@@ -278,6 +283,8 @@ async function createCallFactory(
         });
 
         webSocket.addEventListener("message", onMessage);
+
+        setCertInfo(webSocket.socket || (webSocket as any)._socket, callerContext);
     }
 
 
@@ -361,8 +368,6 @@ async function createCallFactory(
                 }
                 return;
             }
-            debugbreak(1);
-            debugger;
             throw new Error(`Unhandled data type ${typeof message}`);
         } catch (e: any) {
             console.error(e.stack);

package/src/callHTTPHandler.ts

@@ -2,7 +2,7 @@ import https from "https";
 import http from "http";
 import net from "net";
 import tls from "tls";
-import { CallerContext, CallType, NetworkLocation } from "../SocketFunctionTypes";
+import { CallerContext, CallType, NetworkLocation, setCertInfo } from "../SocketFunctionTypes";
 import { performLocalCall } from "./callManager";
 import { getNodeIdRaw } from "./nodeAuthentication";
 import debugbreak from "debugbreak";
@@ -111,7 +111,9 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
                 listeningPorts: [],
             },
             serverLocation: getServerLocationFromRequest(request),
+            certInfo: undefined,
         };
+        setCertInfo(socket, caller);
 
         let classGuid = urlObj.searchParams.get("classGuid");
         let functionName = urlObj.searchParams.get("functionName");
@@ -173,8 +175,8 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
 
         // NOTE: Our ETag caching is only to reduce data sent on the wire, we evaluate the calls
         //  every time (so it is strictly a wire cache, not computation cache)
-        response.setHeader("cache-control", "private, s-maxage=0, max-age=0, must-revalidate");
         if (SocketFunction.httpETagCache) {
+            response.setHeader("cache-control", "private, s-maxage=0, max-age=0, must-revalidate");
             let hash = sha256Hash(resultBuffer);
             response.setHeader("ETag", hash);
             if (request.headers["if-none-match"] === hash) {

package/src/callManager.ts

@@ -30,8 +30,7 @@ export async function performLocalCall(
     }
 
     let controller = classDef.controller;
-    let shape = classDef.shape;
-    let functionShape = shape[call.functionName];
+    let functionShape = classDef.shape[call.functionName];
     if (!functionShape) {
         throw new Error(`Function ${call.functionName} not exposed`);
     }
@@ -41,7 +40,7 @@ export async function performLocalCall(
     }
 
     let curContext: CallContextType = {};
-    let serverContext = await runServerHooks(call, { caller, curContext }, shape);
+    let serverContext = await runServerHooks(call, { caller, curContext }, functionShape);
     if ("overrideResult" in serverContext) {
         return serverContext.overrideResult;
     }

package/src/nodeAuthentication.ts

@@ -11,14 +11,20 @@ import crypto from "crypto";
 import { isNode, sha256Hash } from "./misc";
 import { getArgs } from "./args";
 import { SenderInterface } from "./CallFactory";
+import { SocketFunction } from "../SocketFunction";
 
-export const getCertKeyPair = lazy((): { key: Buffer; cert: Buffer } => {
+let certKeyPairOverride: { key: Buffer; cert: Buffer } | undefined;
+export function getCertKeyPair(): { key: Buffer; cert: Buffer } {
+    if (certKeyPairOverride) return certKeyPairOverride;
+    return getCertKeyPairBase();
+}
+const getCertKeyPairBase = lazy((): { key: Buffer; cert: Buffer } => {
     // TODO: Also get this working clientside...
-    //  - Probably using node-forge, maybe using this as an example: https://github.com/jfromaniello/selfsigned/blob/master/index.js
+    //  - Use https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey
+    //      - We might need node-forge for the Certificate Signing Request and x509 stuff
+    //  - Use ECDSA keys
     //  - ALSO, get our nodeId set in our cookies, so HTTP requests can work as well
-    //      - We will need to call some kind of endpoint to do this?
-    //  - Then download the certs and try to get the user to install them, so chrome can use
-    //      them? Otherwise there is no point of having certs clientside.
+    //      - We will need callHTTPHandler to support this
 
     // https://nodejs.org/en/knowledge/HTTP/servers/how-to-create-a-HTTPS-server/
 
@@ -38,6 +44,16 @@ export const getCertKeyPair = lazy((): { key: Buffer; cert: Buffer } => {
     return { key, cert };
 });
 
+export function overrideCertKeyPair<T>(certKey: { key: Buffer; cert: Buffer; }, code: () => T): T {
+    let prevOverride = certKeyPairOverride;
+    certKeyPairOverride = certKey;
+    try {
+        return code();
+    } finally {
+        certKeyPairOverride = prevOverride;
+    }
+}
+
 export function getTLSSocket(webSocket: ws.WebSocket) {
     return (webSocket as any)._socket as tls.TLSSocket;
 }
@@ -67,86 +83,59 @@ export const getNodeId = cacheWeak(function (webSocket: SenderInterface | ws.Web
         if (webSocket.nodeId) {
             return webSocket.nodeId;
         }
-        throw new Error(`Missing nodeId. If it is from the browser, this likely means your websocket and HTTP request are using different domains (so the cookies are lost). If it is from NodeJs peer certificate must use an RSA key or EC key (which should have a .pubkey property)`);
+        throw new Error(`Missing nodeId. If it is from the browser, this likely means your websocket and HTTP request are using different domains (so the cookies are lost). If it is from NodeJs peer certificate must use an RSA key or EC key (which should have a .modulus property)`);
     }
     return nodeId;
 });
 
+export function getNodeIdFromCert(cert: { modulus: Buffer }) {
+    // Apparently some implementations strip preceding zeros, which makes sense, as it is a modulus so
+    //  preceding zeros aren't needed.
+    let startIndex = 0;
+    while (startIndex < cert.modulus.length && cert.modulus[startIndex] === 0) {
+        startIndex++;
+    }
+    return sha256Hash(cert.modulus.slice(startIndex));
+}
 export function getNodeIdRaw(socket: tls.TLSSocket) {
     let peerCert = socket.getPeerCertificate();
     if (!peerCert) {
         throw new Error("WebSocket connections must provided a peer certificate");
     }
-    let pubkey = (peerCert as any).pubkey as Buffer | undefined;
-    if (!pubkey) {
-        return undefined;
-    }
-    return sha256Hash(pubkey);
+
+    if (!peerCert.modulus) return undefined;
+    return getNodeIdFromCert({ modulus: Buffer.from(peerCert.modulus, "hex") });
 }
 
-export function createWebsocket(address: string, port: number): SenderInterface {
-    console.log(`Connecting to ${address}:${port}`);
+/** NOTE: We create a factory, which embeds the key/cert information. Otherwise retries might use
+ *      a different key/cert context.
+ */
+export function createWebsocketFactory(): (address: string, port: number) => SenderInterface {
+
     if (!isNode()) {
         // NOTE: We assume an HTTP request has already been made, which will setup a nodeId cookie
         //  (And as this point we can't even use peer certificates if we wanted to, as this must be done
         //      directly in the browser)
-        return new WebSocket(`wss://${address}:${port}`);
+        return (address: string, port: number) => {
+            console.log(`Connecting to ${address}:${port}`);
+            return new WebSocket(`wss://${address}:${port}`);
+        };
     } else {
         let { key, cert } = getCertKeyPair();
-        return new ws.WebSocket(`wss://${address}:${port}`, {
-            cert,
-            key,
-            rejectUnauthorized: false,
-        });
+        let rejectUnauthorized = SocketFunction.rejectUnauthorized;
+        return (address: string, port: number) => {
+            console.log(`Connecting to ${address}:${port}`);
+            let webSocket = new ws.WebSocket(`wss://${address}:${port}`, {
+                cert,
+                key,
+                rejectUnauthorized,
+                ca: tls.rootCertificates.concat(SocketFunction.additionalTrustedRootCAs),
+            });
+            let result = Object.assign(webSocket, { socket: undefined as tls.TLSSocket | undefined });
+            webSocket.once("upgrade", e => {
+                result.socket = e.socket as tls.TLSSocket;
+            });
+            return result;
+        };
     }
-}
-
-
-
-/*
-const port = 2422;
-let { key, cert } = getCertKeyPair();
-console.log(process.argv);
-if (process.argv.includes("--server")) {
-    
-    let server = https.createServer({
-        key,
-        cert,
-        rejectUnauthorized: false,
-        requestCert: true
-    });
-    let listenPromise = new Promise<void>((resolve, error) => {
-        server.on("listening", () => {
-            resolve();
-        });
-        server.on("error", e => {
-            error(e);
-        });
-    });
-    
-    server.on("request", (request, response) => {
-        // TODO: Handle HTTP requests
-        //  - HTTP CAN have a nodeId, simply through setting cookies
-        //      - Cookies could always be set via a request before we open
-        //          the websocket connection?
-    });
-
-    const webSocketServer = new ws.Server({
-        noServer: true,
-    });
-    server.on("upgrade", (request, socket, upgradeHead) => {
-        webSocketServer.handleUpgrade(request, socket, upgradeHead, (ws) => {
-            console.log("peer", getTLSSocket(ws).getPeerCertificate()?.pubkey.toString("hex").slice(100));
-            console.log("cert", getTLSSocket(ws).getCertificate()?.pubkey.toString("hex").slice(100));
-        });
-    });
-
-    server.listen(2422, "127.0.0.1");
-} else {
-    let socket = new ws.WebSocket(`wss://127.0.0.1:${port}`, { rejectUnauthorized: false, cert, key });
-    socket.on("open", () => {
-        console.log("peer", getTLSSocket(socket).getPeerCertificate()?.pubkey.toString("hex").slice(100));
-        console.log("cert", getTLSSocket(socket).getCertificate()?.pubkey.toString("hex").slice(100));
-    });
-}
-*/
+}

package/src/webSocketServer.ts

@@ -11,6 +11,7 @@ import { getCertKeyPair, getNodeId, getNodeIdRaw } from "./nodeAuthentication";
 import debugbreak from "debugbreak";
 import { cache } from "./caching";
 import { getNodeIdFromRequest, getServerLocationFromRequest, httpCallHandler } from "./callHTTPHandler";
+import { SocketFunction } from "../SocketFunction";
 
 // TODO: Support conditional peer certificate requests, as it the certificate prompt
 //  seems suspicious in the browser (the user can just click cancel though).
@@ -41,8 +42,18 @@ export async function startSocketServer(
     //  so it is easy to read, and consistent.
     let httpsServer = https.createServer({
         ...config,
-        rejectUnauthorized: false,
+        rejectUnauthorized: SocketFunction.rejectUnauthorized,
         requestCert: true,
+        ca: tls.rootCertificates.concat(SocketFunction.additionalTrustedRootCAs),
+    });
+    httpsServer.on("connection", socket => {
+        console.log("Client connection established");
+    });
+    httpsServer.on("error", e => {
+        console.error(`Connection attempt error ${e.message}`);
+    });
+    httpsServer.on("tlsClientError", e => {
+        console.error(`TLS client error ${e.message}`);
     });