socket-function 0.8.32 → 0.8.34

package/hot/HotReloadController.ts

@@ -1,3 +1,5 @@
+/// <reference path="../../typenode/index.d.ts" />
+/// <reference path="../require/RequireController.ts" />
 module.allowclient = true;
 
 import { SocketFunction } from "../SocketFunction";

package/index.d.ts

@@ -0,0 +1 @@
+/// <reference path="../typenode/index.d.ts" />

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.8.32",
+	"version": "0.8.34",
 	"main": "index.js",
 	"license": "MIT",
 	"note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -14,7 +14,7 @@
 		"mobx": "^6.6.2",
 		"node-forge": "https://github.com/sliftist/forge#name",
 		"preact": "^10.10.6",
-		"typenode": "^4.8.7",
+		"typenode": "^4.9.4-a",
 		"ws": "^8.8.0"
 	},
 	"scripts": {

package/require/RequireController.ts

@@ -216,7 +216,7 @@ class RequireControllerBase {
             //require(rootPath);
             let clientModule = require.cache[resolvedPath];
             if (!clientModule) {
-                clientModule = createNotFoundModule(`Module ${pathRequest} (resolved to ${resolvedPath}) was not included serverside.`);
+                clientModule = createNotFoundModule(`Module ${pathRequest} (resolved to ${JSON.stringify(resolvedPath)}) was not included serverside. Resolve root ${JSON.stringify(this.rootResolvePath)} (set by call to setRequireBootRequire), resolve search paths: ${JSON.stringify(searchPaths)})}`);
             }
             if (!clientModule.allowclient) {
                 clientModule = createNotFoundModule(`Module ${pathRequest} (resolved to ${resolvedPath}) is not allowed clientside (set module.allowclient in it, or call setFlag when it is imported).`);

package/src/tlsParsing.ts

@@ -0,0 +1,97 @@
+export function parseTLSHello(buffer: Buffer): {
+    extensions: {
+        type: number;
+        data: Buffer;
+    }[];
+} {
+    let output: {
+        extensions: {
+            type: number;
+            data: Buffer;
+        }[];
+    } = {
+        extensions: []
+    };
+
+    try {
+        let pos = 0;
+
+        function readShort() {
+            let high = buffer[pos++];
+            let low = buffer[pos++];
+            return high * 256 + low;
+        }
+
+        let type = buffer[pos++];
+        let version = readShort();
+
+        var contentLength = readShort();
+
+        let clientMessageType = buffer[pos++];
+        // High length byte (how would this be used if contentLength is only 2 bytes?)
+        pos++;
+        let clientMessageLength = readShort();
+
+        // Client version
+        let clientVersion = readShort();
+
+        // Client random
+        pos += 32;
+
+        // Session id
+        let sessionIdLength = buffer[pos++];
+        pos += sessionIdLength;
+
+
+        let cipherSuiteLength = readShort();
+        pos += cipherSuiteLength;
+
+        let compressionLength = buffer[pos++];
+        pos += compressionLength;
+
+        let extensionsLength = readShort();
+        let extensionsEnd = pos + extensionsLength;
+        while (pos < extensionsEnd) {
+            let extensionType = readShort();
+            let length = readShort();
+
+            output.extensions.push({
+                type: extensionType, data: viewSliceBuffer(buffer, pos, length)
+            });
+
+            pos += length;
+        }
+    } catch { }
+
+    return output;
+}
+
+export const SNIType = 0x0;
+export function parseSNIExtension(data: Buffer): string[] {
+    let pos = 0;
+    function readShort() {
+        let high = data[pos++];
+        let low = data[pos++];
+        return high * 256 + low;
+    }
+
+    let snis: string[] = [];
+
+    try {
+        while (pos < data.length) {
+            let len = readShort();
+            let end = pos + len;
+            let type = data[pos++];
+            let len2 = readShort();
+            snis.push(viewSliceBuffer(data, pos, len2).toString());
+            pos = end;
+        }
+    } catch { }
+
+    return snis;
+}
+
+function viewSliceBuffer(data: Buffer, index: number, count?: number) {
+    count = count ?? (data.length - index);
+    return Buffer.from(data.buffer, data.byteOffset + index, count);
+}

package/src/webSocketServer.ts

@@ -8,17 +8,25 @@ import { getNodeIdsFromRequest, httpCallHandler } from "./callHTTPHandler";
 import { SocketFunction } from "../SocketFunction";
 import { getTrustedUserCertificates, loadTrustedUserCertificates, watchUserCertificates } from "./certStore";
 import { createCallFactory } from "./CallFactory";
+import { parseSNIExtension, parseTLSHello, SNIType } from "./tlsParsing";
+import debugbreak from "debugbreak";
 
 export type SocketServerConfig = (
-    {
+    https.ServerOptions & {
         port: number;
+
         // public sets ip to "0.0.0.0", otherwise it defaults to "127.0.0.1", which
         //  causes the server to only accept local connections.
         public?: boolean;
         ip?: string;
-    } & (
-        https.ServerOptions
-    )
+
+        /** If the SNI matches this domain, we use a different key/cert.
+         *  - Also requestCert may be specified (otherwise it defaults to true)
+         */
+        SNICerts?: {
+            [domain: string]: https.ServerOptions;
+        };
+    }
 );
 
 export async function startSocketServer(
@@ -31,69 +39,79 @@ export async function startSocketServer(
         config.cert = cert;
     }
 
-    await loadTrustedUserCertificates();
-
-    // TODO: Only allow unauthorized for ip certificates, and then for domains use the domain as the nodeId,
-    //  so it is easy to read, and consistent.
-    let options: https.ServerOptions = {
-        ...config,
-        rejectUnauthorized: SocketFunction.rejectUnauthorized,
-        requestCert: true,
-    };
 
-    let httpsServer = https.createServer(options);
-    watchUserCertificates(() => {
-        options.ca = tls.rootCertificates.concat(getTrustedUserCertificates());
-        httpsServer.setSecureContext(options);
+    const webSocketServer = new ws.Server({
+        noServer: true,
     });
 
-    httpsServer.on("connection", socket => {
-        console.log("Client connection established");
-        socket.on("error", e => {
-            console.log(`Client socket error ${e.message}`);
-        });
-        socket.on("close", () => {
-            console.log("Client socket closed");
+    await loadTrustedUserCertificates();
+
+    function setupHTTPSServer(options: https.ServerOptions) {
+        let httpsServer = https.createServer(options);
+        watchUserCertificates(() => {
+            options.ca = tls.rootCertificates.concat(getTrustedUserCertificates());
+            httpsServer.setSecureContext(options);
         });
-    });
-    httpsServer.on("error", e => {
-        console.error(`Connection attempt error ${e.message}`);
-    });
-    httpsServer.on("tlsClientError", e => {
-        console.error(`TLS client error ${e.message}`);
-    });
 
+        httpsServer.on("connection", socket => {
+            console.log("Client connection established");
+            socket.on("error", e => {
+                console.log(`Client socket error ${e.message}`);
+            });
+            socket.on("close", () => {
+                console.log("Client socket closed");
+            });
+        });
+        httpsServer.on("error", e => {
+            console.error(`Connection attempt error ${e.message}`);
+        });
+        httpsServer.on("tlsClientError", e => {
+            console.error(`TLS client error ${e.message}`);
+        });
 
-    httpsServer.on("request", httpCallHandler);
+        httpsServer.on("request", httpCallHandler);
 
-    const webSocketServer = new ws.Server({
-        noServer: true,
-    });
-    httpsServer.on("upgrade", (request, socket, upgradeHead) => {
-        socket.on("error", e => {
-            console.log(`Client socket error ${e.message}`);
-        });
+        httpsServer.on("upgrade", (request, socket, upgradeHead) => {
+            socket.on("error", e => {
+                console.log(`Client socket error ${e.message}`);
+            });
 
-        let originHeader = request.headers["origin"];
-        if (originHeader) {
-            try {
-                let host = new URL("ws://" + request.headers["host"]).hostname;
-                let origin = new URL(originHeader).hostname;
-                if (host !== origin) {
-                    throw new Error(`Invalid cross thread request, ${JSON.stringify(host)} !== ${JSON.stringify(origin)}`);
+            let originHeader = request.headers["origin"];
+            if (originHeader) {
+                try {
+                    let host = new URL("ws://" + request.headers["host"]).hostname;
+                    let origin = new URL(originHeader).hostname;
+                    if (host !== origin) {
+                        throw new Error(`Invalid cross thread request, ${JSON.stringify(host)} !== ${JSON.stringify(origin)}`);
+                    }
+                } catch (e) {
+                    console.error(e);
+                    return;
                 }
-            } catch (e) {
-                console.error(e);
-                return;
             }
-        }
-        webSocketServer.handleUpgrade(request, socket, upgradeHead, (ws) => {
-            const { nodeId, localNodeId } = getNodeIdsFromRequest(request);
-            createCallFactory(ws, nodeId, localNodeId).catch(e => {
-                console.error(`Error in creating call factory, ${e.stack}`);
+            webSocketServer.handleUpgrade(request, socket, upgradeHead, (ws) => {
+                const { nodeId, localNodeId } = getNodeIdsFromRequest(request);
+                createCallFactory(ws, nodeId, localNodeId).catch(e => {
+                    console.error(`Error in creating call factory, ${e.stack}`);
+                });
             });
         });
-    });
+        return httpsServer;
+    }
+
+    // TODO: Only allow unauthorized for ip certificates, and then for domains use the domain as the nodeId,
+    //  so it is easy to read, and consistent.
+    let options: https.ServerOptions = {
+        rejectUnauthorized: SocketFunction.rejectUnauthorized,
+        requestCert: true,
+        ...config,
+    };
+
+    const mainHTTPSServer = setupHTTPSServer(options);
+    let sniServers = new Map<string, https.Server>();
+    for (let [domain, obj] of Object.entries(config.SNICerts || {})) {
+        sniServers.set(domain, setupHTTPSServer(obj));
+    }
 
     let httpServer = http.createServer({}, async function (req, res) {
         let url = new URL("http://" + req.headers.host + req.url);
@@ -114,7 +132,17 @@ export async function startSocketServer(
         socket.once("data", buffer => {
             // All HTTPS requests start with 22, and no HTTP requests start with 22,
             //  so we just need to read the first byte.
-            let server = buffer[0] === 22 ? httpsServer : httpServer;
+
+            let server: https.Server | http.Server;
+            if (buffer[0] !== 22) {
+                server = httpServer;
+            } else {
+                debugbreak(1);
+                debugger;
+                let data = parseTLSHello(buffer);
+                let sni = data.extensions.filter(x => x.type === SNIType).flatMap(x => parseSNIExtension(x.data))[0];
+                server = sniServers.get(sni) || mainHTTPSServer;
+            }
 
             // NOTE: Messages aren't dequeued until the current handler finishes, so we don't need to pause the socket or anything.
             server.emit("connection", socket);