socket-function 0.8.34 → 0.8.35

package/SocketFunction.ts

@@ -28,7 +28,6 @@ export class SocketFunction {
         type: "gzip";
     };
     public static httpETagCache = false;
-    public static rejectUnauthorized = true;
 
     public static register<
         ClassInstance extends object,
@@ -129,11 +128,12 @@ export class SocketFunction {
     }
 
     public static mountedNodeId: string = "NOTMOUNTED";
-    public static async mount(config: SocketServerConfig) {
+    public static async mount(config: SocketServerConfig & { nodeId: string }) {
         if (this.mountedNodeId !== "NOTMOUNTED") {
             throw new Error("SocketFunction already mounted, mounting twice in one thread is not allowed.");
         }
-        this.mountedNodeId = await startSocketServer(config);
+        this.mountedNodeId = config.nodeId;
+        await startSocketServer(config);
         return this.mountedNodeId;
     }
 

package/SocketFunctionTypes.ts

@@ -1,11 +1,5 @@
 module.allowclient = true;
 
-import debugbreak from "debugbreak";
-import * as tls from "tls";
-import { SenderInterface } from "./src/CallFactory";
-import { isNode } from "./src/misc";
-import { CertInfo, getNodeIdFromCert } from "./src/nodeAuthentication";
-import { getClientNodeId } from "./src/nodeCache";
 import { getCallObj } from "./src/nodeProxy";
 import { Args, MaybePromise } from "./src/types";
 
@@ -52,14 +46,14 @@ export interface SocketFunctionHook<ExposedType extends SocketExposedInterface =
     (config: HookContext<ExposedType, CallContext>): MaybePromise<void>;
 }
 export type HookContext<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> = {
-    call: CallType;
+    call: FullCallType;
     context: SocketRegistered<ExposedType, CallContext>["context"];
     // If the result is overriden, we continue evaluating hooks BUT DO NOT perform the final call
     overrideResult?: unknown;
 };
 
 export type ClientHookContext<ExposedType extends SocketExposedInterface = SocketExposedInterface, CallContext extends CallContextType = CallContextType> = {
-    call: CallType;
+    call: FullCallType;
     /** If the calls takes longer than this (for ANY reason), we return with an error.
      *      - Different from reconnectTimeout, which only errors if we lose the connection.
     */
@@ -101,15 +95,6 @@ export type CallerContextBase = {
     //      a more permanent identity, you must derive it from certInfo yourself.
     nodeId: string;
 
-    /** Gives further info on the node. When we set this, we always make sure it has a verified
-     *      issuer. It may be set by app code, which should make sure the issuer is verified (not
-     *      necessarily by the machine, but just in some sense, 'verified', to secure the common name
-     *      of the cert and prevent anyone from using the same common name as someone else).
-     *  IF set, is directly used to derive nodeId (by nodeAuthentication.ts)
-     */
-    certInfo: CertInfo | undefined;
-    updateCertInfo?: (certInfo: CertInfo, callbackPort: number | undefined) => void;
-
     // The nodeId they contacted. This is useful to determine their intention (otherwise
     //  requests can be redirected to us and would accept them, even though they are being
     //  blatantly MITMed).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "socket-function",
-	"version": "0.8.34",
+	"version": "0.8.35",
 	"main": "index.js",
 	"license": "MIT",
 	"note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -10,7 +10,6 @@
 		"@types/node-forge": "^1.3.1",
 		"@types/ws": "^8.5.3",
 		"cookie": "^0.5.0",
-		"debugbreak": "^0.6.5",
 		"mobx": "^6.6.2",
 		"node-forge": "https://github.com/sliftist/forge#name",
 		"preact": "^10.10.6",
@@ -22,6 +21,7 @@
 		"type": "yarn tsc --noEmit"
 	},
 	"devDependencies": {
+		"debugbreak": "^0.6.5",
 		"typedev": "^0.1.0"
 	}
 }

package/src/CallFactory.ts

@@ -1,8 +1,8 @@
-import { CallerContext, CallerContextBase, CallType } from "../SocketFunctionTypes";
+import { CallerContext, CallerContextBase, CallType, FullCallType } from "../SocketFunctionTypes";
 import * as ws from "ws";
 import { performLocalCall } from "./callManager";
 import { convertErrorStackToError, formatNumberSuffixed, isNode } from "./misc";
-import { createWebsocketFactory, getNodeIdFromCert, getTLSSocket } from "./nodeAuthentication";
+import { createWebsocketFactory, getTLSSocket } from "./nodeAuthentication";
 import { SocketFunction } from "../SocketFunction";
 import { gzip } from "zlib";
 import * as tls from "tls";
@@ -10,7 +10,7 @@ import { getClientNodeId, getNodeIdLocation, registerNodeClient } from "./nodeCa
 
 const retryInterval = 2000;
 
-type InternalCallType = CallType & {
+type InternalCallType = FullCallType & {
     seqNum: number;
     isReturn: false;
     compress: boolean;
@@ -77,16 +77,7 @@ export async function createCallFactory(
 
     let callerContext: CallerContextBase = {
         nodeId,
-        localNodeId,
-        certInfo: webSocketBase?.socket?.getPeerCertificate(true),
-        updateCertInfo: (certRaw, port) => {
-            let nodeId = getNodeIdFromCert(certRaw, port);
-            if (!nodeId) {
-                return;
-            }
-            callerContext.nodeId = nodeId;
-            callerContext.certInfo = certRaw;
-        }
+        localNodeId
     };
 
     let callFactory: CallFactory = {
@@ -99,6 +90,7 @@ export async function createCallFactory(
 
             let seqNum = nextSeqNum++;
             let fullCall: InternalCallType = {
+                nodeId,
                 isReturn: false,
                 args: call.args,
                 classGuid: call.classGuid,

package/src/callHTTPHandler.ts

@@ -1,6 +1,6 @@
 import http from "http";
 import tls from "tls";
-import { CallerContext, CallType } from "../SocketFunctionTypes";
+import { CallerContext, CallType, FullCallType } from "../SocketFunctionTypes";
 import { isDataImmutable, performLocalCall } from "./callManager";
 import { SocketFunction } from "../SocketFunction";
 import { gzip } from "zlib";
@@ -79,7 +79,6 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
 
         let caller: CallerContext = {
             nodeId,
-            certInfo: undefined,
             localNodeId,
         };
 
@@ -112,7 +111,8 @@ export async function httpCallHandler(request: http.IncomingMessage, response: h
             args = JSON.parse(payload.toString())["args"] as unknown[];
         }
 
-        let call: CallType = {
+        let call: FullCallType = {
+            nodeId,
             classGuid,
             functionName,
             args,

package/src/callManager.ts

@@ -1,4 +1,4 @@
-import { CallContextType, CallerContext, CallType, ClientHookContext, HookContext, SocketExposedInterface, SocketExposedInterfaceClass, SocketExposedShape, SocketFunctionClientHook, SocketFunctionHook, SocketRegistered } from "../SocketFunctionTypes";
+import { CallContextType, CallerContext, CallType, ClientHookContext, FullCallType, HookContext, SocketExposedInterface, SocketExposedInterfaceClass, SocketExposedShape, SocketFunctionClientHook, SocketFunctionHook, SocketRegistered } from "../SocketFunctionTypes";
 import { _setSocketContext } from "../SocketFunction";
 
 let classes: {
@@ -14,7 +14,7 @@ let globalClientHooks: SocketFunctionClientHook[] = [];
 
 export async function performLocalCall(
     config: {
-        call: CallType;
+        call: FullCallType;
         caller: CallerContext;
     }
 ): Promise<unknown> {
@@ -92,7 +92,7 @@ export function unregisterGlobalClientHook(hook: SocketFunctionClientHook) {
 }
 
 export async function runClientHooks(
-    callType: CallType,
+    callType: FullCallType,
     hooks: SocketExposedShape[""],
 ): Promise<ClientHookContext> {
     let context: ClientHookContext = { call: callType };
@@ -106,7 +106,7 @@ export async function runClientHooks(
 }
 
 async function runServerHooks(
-    callType: CallType,
+    callType: FullCallType,
     context: SocketRegistered["context"],
     hooks: SocketExposedShape[""],
 ): Promise<HookContext> {

package/src/certStore.ts

@@ -1,50 +1,24 @@
-import * as os from "os";
-import * as fs from "fs/promises";
-import * as fsSync from "fs";
-import * as child_process from "child_process";
 import * as tls from "tls";
-import { SocketFunction } from "../SocketFunction";
-import { isNode, isNodeTrue, sha256Hash } from "./misc";
-import { lazy } from "./caching";
 
 let trustedCerts = new Set<string>();
-let loadedTrustedCerts = false;
 let watchCallbacks = new Set<(certs: string[]) => void>();
 
-let storePath = isNodeTrue() && process.argv[1].replaceAll("\\", "/").split("/").slice(0, -1).join("/") + "/certstore/";
-if (isNode()) {
-    if (!fsSync.existsSync(storePath)) {
-        fsSync.mkdirSync(storePath);
-    }
-}
-
 /** Must be populated before the server starts */
-export async function trustUserCertificate(cert: string) {
+export function trustCertificate(cert: string | Buffer) {
+    cert = cert.toString();
     if (trustedCerts.has(cert)) return;
     trustedCerts.add(cert);
-    await fs.writeFile(storePath + sha256Hash(Buffer.from(cert)) + ".cer", cert);
-    let certs = getTrustedUserCertificates();
+    let certs = getTrustedCertificates();
     for (let callback of watchCallbacks) {
         callback(certs);
     }
 }
-export const loadTrustedUserCertificates = lazy(async () => {
-    let files = await fs.readdir(storePath);
-    for (let file of files) {
-        let cert = await fs.readFile(storePath + file, "utf8");
-        trustedCerts.add(cert);
-    }
-    loadedTrustedCerts = true;
-});
-export function getTrustedUserCertificates(): string[] {
-    if (!loadedTrustedCerts) {
-        throw new Error("Must call loadTrustedUserCertificates (and await it) before calling getTrustedUserCertificates");
-    }
-    return Array.from(trustedCerts);
+export function getTrustedCertificates(): string[] {
+    return tls.rootCertificates.concat(Array.from(trustedCerts));
 }
 
-export function watchUserCertificates(callback: (certs: string[]) => void) {
+export function watchTrustedCertificates(callback: (certs: string[]) => void) {
     watchCallbacks.add(callback);
-    callback(getTrustedUserCertificates());
+    callback(getTrustedCertificates());
     return () => watchCallbacks.delete(callback);
 }

package/src/nodeAuthentication.ts

@@ -1,88 +1,15 @@
 import ws from "ws";
 import tls from "tls";
-import net from "net";
-import { getAppFolder } from "./storagePath";
-import fs from "fs";
-import child_process from "child_process";
-import { cacheWeak, lazy } from "./caching";
-import https from "https";
-import debugbreak from "debugbreak";
-import crypto from "crypto";
-import { isNode, sha256Hash } from "./misc";
-import { getArgs } from "./args";
+import { isNode } from "./misc";
 import { SenderInterface } from "./CallFactory";
-import { SocketFunction } from "../SocketFunction";
-import { getTrustedUserCertificates } from "./certStore";
-import { getClientNodeId, getNodeId, getNodeIdLocation } from "./nodeCache";
+import { getTrustedCertificates } from "./certStore";
+import { getNodeIdLocation } from "./nodeCache";
 
-export type CertInfo = { raw: Buffer | string; issuerCertificate: { raw: Buffer | string } };
-
-let certKeyPairOverride: { key: Buffer; cert: Buffer } | undefined;
-export function getCertKeyPair(): { key: Buffer; cert: Buffer } {
-    if (certKeyPairOverride) return certKeyPairOverride;
-    return getCertKeyPairBase();
-}
-const getCertKeyPairBase = lazy((): { key: Buffer; cert: Buffer } => {
-    // https://nodejs.org/en/knowledge/HTTP/servers/how-to-create-a-HTTPS-server/
-
-    let folder = getAppFolder();
-    let identityPrefix = getArgs().identity || "";
-    let keyPath = folder + identityPrefix + "key.pem";
-    let certPath = folder + identityPrefix + "cert.pem";
-    if (!fs.existsSync(keyPath) || !fs.existsSync(certPath)) {
-        child_process.execSync(`openssl genrsa -out "${keyPath}"`);
-        child_process.execSync(`openssl req -new -key "${keyPath}" -out csr.pem -subj "/CN=notused"`);
-        child_process.execSync(`openssl x509 -req -days 9999 -in csr.pem -signkey "${keyPath}" -out "${certPath}"`);
-        fs.rmSync("csr.pem");
-    }
-
-    let key = fs.readFileSync(keyPath);
-    let cert = fs.readFileSync(certPath);
-    return { key, cert };
-});
-
-export function overrideCertKeyPair<T>(certKey: { key: Buffer; cert: Buffer; }, code: () => T): T {
-    if (!isNode()) {
-        throw new Error(`Cannot override cert/key pair in browser`);
-    }
-    let prevOverride = certKeyPairOverride;
-    certKeyPairOverride = certKey;
-    try {
-        return code();
-    } finally {
-        certKeyPairOverride = prevOverride;
-    }
-}
 
 export function getTLSSocket(webSocket: ws.WebSocket) {
     return (webSocket as any)._socket as tls.TLSSocket;
 }
 
-export async function getOwnNodeId() {
-    if (!isNode()) {
-        throw new Error(`Clientside nodeIds are not exposed to the client`);
-    }
-
-    // This is BASICALLY just sha256Hash(getCertKeyPari().cert), however... I'm not 100% the format
-    //  is the same, we would have to verify it. It isn't that important, other nodes know our nodeId,
-    //  and clients don't really have a reason to use this anyway (they can't verify it, they can only
-    //  really verify with a location).
-    throw new Error(`TODO: Implement getOwnNodeId`);
-}
-
-export function getNodeIdFromCert(certRaw: { raw: Buffer | string } | undefined, callbackPort: number | undefined) {
-    if (!certRaw?.raw) return undefined;
-    let cert = new crypto.X509Certificate(certRaw.raw);
-    if (!callbackPort) {
-        return getClientNodeId(cert.subject);
-    }
-    let subject = cert.subject;
-    if (subject.startsWith("CN=")) {
-        subject = subject.slice("CN=".length);
-    }
-    return getNodeId(subject, callbackPort);
-}
-
 /** NOTE: We create a factory, which embeds the key/cert information. Otherwise retries might use
  *      a different key/cert context.
  */
@@ -98,8 +25,6 @@ export function createWebsocketFactory(): (nodeId: string) => SenderInterface {
             return new WebSocket(`wss://${address}:${port}`);
         };
     } else {
-        let { key, cert } = getCertKeyPair();
-        let rejectUnauthorized = SocketFunction.rejectUnauthorized;
         return (nodeId: string) => {
             let location = getNodeIdLocation(nodeId);
             if (!location) throw new Error(`Cannot connect to ${nodeId}, no address known`);
@@ -107,10 +32,7 @@ export function createWebsocketFactory(): (nodeId: string) => SenderInterface {
 
             console.log(`Connecting to ${address}:${port}`);
             let webSocket = new ws.WebSocket(`wss://${address}:${port}`, {
-                cert,
-                key,
-                rejectUnauthorized,
-                ca: tls.rootCertificates.concat(getTrustedUserCertificates()),
+                ca: tls.rootCertificates.concat(getTrustedCertificates()),
             });
             let result = Object.assign(webSocket, { socket: undefined as tls.TLSSocket | undefined });
             webSocket.once("upgrade", e => {

package/src/webSocketServer.ts

@@ -3,16 +3,20 @@ import http from "http";
 import net from "net";
 import tls from "tls";
 import * as ws from "ws";
-import { getCertKeyPair, getNodeIdFromCert } from "./nodeAuthentication";
 import { getNodeIdsFromRequest, httpCallHandler } from "./callHTTPHandler";
 import { SocketFunction } from "../SocketFunction";
-import { getTrustedUserCertificates, loadTrustedUserCertificates, watchUserCertificates } from "./certStore";
+import { getTrustedCertificates, watchTrustedCertificates } from "./certStore";
 import { createCallFactory } from "./CallFactory";
 import { parseSNIExtension, parseTLSHello, SNIType } from "./tlsParsing";
 import debugbreak from "debugbreak";
 
 export type SocketServerConfig = (
     https.ServerOptions & {
+        nodeId?: string;
+
+        key: string | Buffer;
+        cert: string | Buffer;
+
         port: number;
 
         // public sets ip to "0.0.0.0", otherwise it defaults to "127.0.0.1", which
@@ -20,9 +24,7 @@ export type SocketServerConfig = (
         public?: boolean;
         ip?: string;
 
-        /** If the SNI matches this domain, we use a different key/cert.
-         *  - Also requestCert may be specified (otherwise it defaults to true)
-         */
+        /** If the SNI matches this domain, we use a different key/cert. */
         SNICerts?: {
             [domain: string]: https.ServerOptions;
         };
@@ -31,25 +33,16 @@ export type SocketServerConfig = (
 
 export async function startSocketServer(
     config: SocketServerConfig
-): Promise<string> {
-    let isSecure = "cert" in config || "key" in config || "pfx" in config;
-    if (!isSecure) {
-        let { key, cert } = getCertKeyPair();
-        config.key = key;
-        config.cert = cert;
-    }
-
+): Promise<void> {
 
     const webSocketServer = new ws.Server({
         noServer: true,
     });
 
-    await loadTrustedUserCertificates();
-
     function setupHTTPSServer(options: https.ServerOptions) {
         let httpsServer = https.createServer(options);
-        watchUserCertificates(() => {
-            options.ca = tls.rootCertificates.concat(getTrustedUserCertificates());
+        watchTrustedCertificates(() => {
+            options.ca = getTrustedCertificates();
             httpsServer.setSecureContext(options);
         });
 
@@ -102,8 +95,6 @@ export async function startSocketServer(
     // TODO: Only allow unauthorized for ip certificates, and then for domains use the domain as the nodeId,
     //  so it is easy to read, and consistent.
     let options: https.ServerOptions = {
-        rejectUnauthorized: SocketFunction.rejectUnauthorized,
-        requestCert: true,
         ...config,
     };
 
@@ -137,8 +128,6 @@ export async function startSocketServer(
             if (buffer[0] !== 22) {
                 server = httpServer;
             } else {
-                debugbreak(1);
-                debugger;
                 let data = parseTLSHello(buffer);
                 let sni = data.extensions.filter(x => x.type === SNIType).flatMap(x => parseSNIExtension(x.data))[0];
                 server = sniServers.get(sni) || mainHTTPSServer;
@@ -176,11 +165,5 @@ export async function startSocketServer(
 
     let port = (realServer.address() as net.AddressInfo).port;
 
-    console.log(`Started Listening on ${host}:${port}`);
-
-    let serverNodeId = getNodeIdFromCert({ raw: config.cert as Buffer | string }, port);
-    if (!serverNodeId) {
-        throw new Error(`Something is wrong with our cert, we don't have a nodeId?`);
-    }
-    return serverNodeId;
+    console.log(`Started Listening on ${config.nodeId || host}:${port}`);
 }