cryptnode 0.1.1__1-py3-none-win_amd64.whl

cryptnode/logs.py

@@ -0,0 +1,47 @@
+"""Per-portal 60-day product log retention without capacity eviction."""
+
+from __future__ import annotations
+
+from datetime import date, timedelta
+from pathlib import Path
+import re
+from typing import BinaryIO, Optional
+
+from .security import secure_directory
+
+
+_DAILY = re.compile(r"(host|control|data|core)-(\d{4}-\d{2}-\d{2})\.log\Z")
+
+
+def open_log(directory: Path, duty: str) -> Optional[BinaryIO]:
+    if duty not in ("host", "control", "data", "core"):
+        raise ValueError("invalid log duty")
+    try:
+        secure_directory(directory)
+        path = directory / ("%s-%s.log" % (duty, date.today().isoformat()))
+        if path.is_symlink():
+            raise OSError("log is a symbolic link")
+        return path.open("ab", buffering=0)
+    except OSError:
+        return None
+
+
+def prune_expired(directory: Path, *, today: Optional[date] = None) -> int:
+    """Only delete complete days older than the most recent 60 calendar days."""
+    if not directory.is_dir() or directory.is_symlink():
+        return 0
+    cutoff = (today or date.today()) - timedelta(days=59)
+    removed = 0
+    for path in directory.iterdir():
+        match = _DAILY.fullmatch(path.name)
+        if not match or path.is_symlink() or not path.is_file():
+            continue
+        try:
+            day = date.fromisoformat(match.group(2))
+        except ValueError:
+            continue
+        if day < cutoff:
+            path.unlink()
+            removed += 1
+    return removed
+

cryptnode/models.py

@@ -0,0 +1,52 @@
+"""Small, immutable identities shared across the CryptNode boundary."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Dict
+
+
+class NodeError(Exception):
+    def __init__(self, code: str, message: str):
+        self.code = code
+        super().__init__(message)
+
+
+@dataclass(frozen=True)
+class BundleIdentity:
+    portal_id: int
+    portal_name: str
+    access_host: str
+    port_base: int
+    pair_id: str
+    created_at: str
+    own_cert_sha256: str
+    peer_cert_sha256: str
+
+
+@dataclass(frozen=True)
+class ClientBundle:
+    identity: BundleIdentity
+    files: Dict[str, bytes]
+
+
+@dataclass(frozen=True)
+class Profile:
+    portal_id: int
+    portal_name: str
+    node_id: int
+    access_host: str
+    port_base: int
+    pair_id: str
+    created_at: str
+    own_cert_sha256: str
+    peer_cert_sha256: str
+
+    @property
+    def local_addr(self) -> str:
+        return "127.%d.255.252" % self.portal_id
+
+    @property
+    def anchor_port(self) -> int:
+        return 20000 + self.node_id * 100
+

cryptnode/paths.py

@@ -0,0 +1,135 @@
+"""Product data paths and non-secret Portal Profile metadata."""
+
+from __future__ import annotations
+
+from dataclasses import asdict
+import json
+import os
+from pathlib import Path
+import re
+import stat
+from typing import Iterable
+
+from .models import NodeError, Profile
+
+
+_PROFILE_KEYS = {"portal_id", "portal_name", "node_id", "access_host", "port_base",
+                 "pair_id", "created_at", "own_cert_sha256", "peer_cert_sha256"}
+_PORTAL_NAME = re.compile(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\Z")
+
+
+def default_root() -> Path:
+    if os.name == "nt":
+        program_data = os.environ.get("ProgramData")
+        if not program_data:
+            raise NodeError("install_dir", "ProgramData is unavailable")
+        return Path(program_data) / "CryptNode" / "data"
+    user = os.environ.get("SUDO_USER")
+    if user:
+        import pwd
+        return Path(pwd.getpwnam(user).pw_dir) / "CryptNode"
+    return Path.home() / "CryptNode"
+
+
+def pointer_path() -> Path:
+    if os.name == "nt":
+        return default_root().parent / "install-dir"
+    return Path("/etc/cryptnode/install-dir")
+
+
+def active_root() -> Path:
+    override = os.environ.get("CRYPTNODE_INSTALL_DIR")
+    if override:
+        return checked_absolute(Path(override))
+    pointer = pointer_path()
+    try:
+        pointer_stat = pointer.lstat()
+    except FileNotFoundError:
+        pointer_stat = None
+    except PermissionError:
+        raise NodeError("install_dir_access", "CryptNode installation pointer is not readable") from None
+    if pointer_stat is not None:
+        if not stat.S_ISREG(pointer_stat.st_mode):
+            raise NodeError("path_link", "CryptNode installation pointer is not a regular file")
+        try:
+            return checked_absolute(Path(pointer.read_text(encoding="utf-8").strip()))
+        except PermissionError:
+            raise NodeError("install_dir_access", "CryptNode installation pointer is not readable") from None
+    raise NodeError("not_deployed", "尚未部署；请先执行 crnode deploy <安装目录>")
+
+
+def checked_absolute(path: Path) -> Path:
+    path = Path(path)
+    if not path.is_absolute() or ".." in path.parts or path == Path(path.anchor):
+        raise NodeError("install_dir", "install_dir must be an absolute non-root path")
+    current = Path(path.anchor)
+    for part in path.parts[1:]:
+        current = current / part
+        try:
+            metadata = current.lstat()
+        except FileNotFoundError:
+            continue
+        except NotADirectoryError:
+            raise NodeError("install_dir", "install_dir traverses a non-directory") from None
+        except PermissionError:
+            raise NodeError("install_dir_access", "install_dir ancestor is not readable") from None
+        if stat.S_ISLNK(metadata.st_mode):
+            raise NodeError("path_link", "install_dir cannot traverse a symbolic link")
+        if os.name == "nt":
+            attrs = metadata.st_file_attributes
+            if attrs & 0x400:
+                raise NodeError("path_link", "install_dir cannot traverse a reparse point")
+    return path
+
+
+def profile_dir(root: Path, portal_id: int) -> Path:
+    if type(portal_id) is not int or not 1 <= portal_id <= 99:
+        raise NodeError("portal_id", "portal_id must be 1..99")
+    return checked_absolute(root) / "portals" / ("portal-%02d" % portal_id)
+
+
+def profile_json(profile: Profile) -> bytes:
+    return (json.dumps(asdict(profile), sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
+
+
+def read_profile(directory: Path) -> Profile:
+    path = directory / "portal.json"
+    if path.is_symlink() or not path.is_file() or path.stat().st_size > 8192:
+        raise NodeError("profile_invalid", "Portal Profile metadata is missing or unsafe")
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+        if not isinstance(value, dict) or set(value) != _PROFILE_KEYS:
+            raise ValueError("profile keys")
+        profile = Profile(**value)
+        if (type(profile.portal_id) is not int or not 1 <= profile.portal_id <= 99
+                or type(profile.node_id) is not int or not 1 <= profile.node_id <= 99
+                or not isinstance(profile.portal_name, str)
+                or not _PORTAL_NAME.fullmatch(profile.portal_name)
+                or directory.name != "portal-%02d" % profile.portal_id):
+            raise ValueError("profile identity")
+        return profile
+    except (OSError, TypeError, ValueError, UnicodeError):
+        raise NodeError("profile_invalid", "Portal Profile metadata is invalid") from None
+
+
+def profiles(root: Path) -> Iterable[Profile]:
+    parent = checked_absolute(root) / "portals"
+    if not parent.exists():
+        return ()
+    result = []
+    for directory in sorted(parent.iterdir()):
+        if directory.is_symlink() or not directory.is_dir():
+            raise NodeError("profile_invalid", "Portal Profile entry is unsafe")
+        result.append(read_profile(directory))
+    names = [profile.portal_name for profile in result]
+    if len(names) != len(set(names)):
+        raise NodeError("profile_ambiguous", "Portal Profile names are duplicated")
+    return tuple(result)
+
+
+def select_profile(root: Path, selector: str) -> Profile:
+    rows = tuple(profiles(root))
+    matches = [row for row in rows if selector in (str(row.portal_id), row.portal_name)]
+    if len(matches) != 1:
+        raise NodeError("portal_selection", "portal does not select one unique Profile")
+    return matches[0]

cryptnode/processes.py

@@ -0,0 +1,183 @@
+"""Private child processes, local readiness and bounded shutdown."""
+
+from __future__ import annotations
+
+import os
+from datetime import date
+from pathlib import Path
+import socket
+import subprocess
+import threading
+import time
+from typing import Optional, Sequence
+
+from .logs import open_log
+from .models import NodeError, Profile
+
+
+_WINDOWS_JOB = None
+
+
+def _assign_kill_on_close(process: subprocess.Popen) -> None:
+    """Keep all private children in the Host's kill-on-close Windows Job."""
+    if os.name != "nt":
+        return
+    import ctypes
+    from ctypes import wintypes
+
+    class BasicLimit(ctypes.Structure):
+        _fields_ = [("PerProcessUserTimeLimit", ctypes.c_longlong),
+                    ("PerJobUserTimeLimit", ctypes.c_longlong), ("LimitFlags", wintypes.DWORD),
+                    ("MinimumWorkingSetSize", ctypes.c_size_t),
+                    ("MaximumWorkingSetSize", ctypes.c_size_t),
+                    ("ActiveProcessLimit", wintypes.DWORD), ("Affinity", ctypes.c_size_t),
+                    ("PriorityClass", wintypes.DWORD), ("SchedulingClass", wintypes.DWORD)]
+
+    class IoCounters(ctypes.Structure):
+        _fields_ = [("ReadOperationCount", ctypes.c_ulonglong),
+                    ("WriteOperationCount", ctypes.c_ulonglong),
+                    ("OtherOperationCount", ctypes.c_ulonglong),
+                    ("ReadTransferCount", ctypes.c_ulonglong),
+                    ("WriteTransferCount", ctypes.c_ulonglong),
+                    ("OtherTransferCount", ctypes.c_ulonglong)]
+
+    class ExtendedLimit(ctypes.Structure):
+        _fields_ = [("BasicLimitInformation", BasicLimit), ("IoInfo", IoCounters),
+                    ("ProcessMemoryLimit", ctypes.c_size_t), ("JobMemoryLimit", ctypes.c_size_t),
+                    ("PeakProcessMemoryUsed", ctypes.c_size_t),
+                    ("PeakJobMemoryUsed", ctypes.c_size_t)]
+
+    kernel = ctypes.windll.kernel32
+    kernel.CreateJobObjectW.restype = wintypes.HANDLE
+    kernel.CreateJobObjectW.argtypes = [ctypes.c_void_p, wintypes.LPCWSTR]
+    kernel.OpenProcess.restype = wintypes.HANDLE
+    kernel.OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]
+    kernel.SetInformationJobObject.argtypes = [wintypes.HANDLE, ctypes.c_int, ctypes.c_void_p, wintypes.DWORD]
+    kernel.AssignProcessToJobObject.argtypes = [wintypes.HANDLE, wintypes.HANDLE]
+    kernel.CloseHandle.argtypes = [wintypes.HANDLE]
+    global _WINDOWS_JOB
+    if _WINDOWS_JOB is None:
+        job = kernel.CreateJobObjectW(None, None)
+        if not job:
+            raise NodeError("job_object", "cannot create CryptNode process Job")
+        limits = ExtendedLimit()
+        limits.BasicLimitInformation.LimitFlags = 0x2000  # JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+        if not kernel.SetInformationJobObject(job, 9, ctypes.byref(limits), ctypes.sizeof(limits)):
+            kernel.CloseHandle(job)
+            raise NodeError("job_object", "cannot set CryptNode Job exit policy")
+        _WINDOWS_JOB = job
+    handle = kernel.OpenProcess(0x0100 | 0x0001, False, process.pid)
+    if not handle:
+        raise NodeError("job_object", "cannot open private child process")
+    try:
+        if not kernel.AssignProcessToJobObject(_WINDOWS_JOB, handle):
+            raise NodeError("job_object", "cannot attach private child to CryptNode Job")
+    finally:
+        kernel.CloseHandle(handle)
+
+
+def resource_binary(name: str) -> Path:
+    if name not in ("crnode-core", "crnode-tls"):
+        raise ValueError("unknown private binary")
+    platform = "windows" if os.name == "nt" else "linux"
+    suffix = ".exe" if os.name == "nt" else ""
+    path = Path(__file__).parent / "resources" / platform / (name + suffix)
+    if path.is_symlink() or not path.is_file():
+        raise NodeError("kernel_missing", "private CryptNode kernel is missing")
+    return path
+
+
+def port_available(profile: Profile, port: int) -> bool:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as probe:
+        try:
+            if os.name != "nt":
+                # A just-closed tunnel can leave TCP connections in TIME_WAIT.
+                # Reuse their address, but still reject a live listener.
+                probe.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            probe.bind((profile.local_addr, port))
+            return True
+        except OSError:
+            return False
+
+
+def require_ports(profile: Profile, ports: Sequence[int]) -> None:
+    for port in ports:
+        if not port_available(profile, port):
+            raise NodeError("port_conflict", "%s:%d is occupied" % (profile.local_addr, port))
+
+
+def wait_listener(profile: Profile, port: int, process: subprocess.Popen, timeout: float = 10.0) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if process.poll() is not None:
+            raise NodeError("kernel_exit", "private kernel exited before listener readiness")
+        try:
+            with socket.create_connection((profile.local_addr, port), timeout=0.2):
+                return
+        except OSError:
+            time.sleep(0.1)
+    raise NodeError("kernel_timeout", "private kernel listener did not become ready")
+
+
+class Child:
+    def __init__(self, command: Sequence[str], directory: Path, duty: str, *, env=None) -> None:
+        self.directory = directory
+        self.duty = duty
+        self.log_error = False
+        self.log = None
+        self.log_day = None
+        flags = (subprocess.CREATE_NEW_PROCESS_GROUP | subprocess.CREATE_NO_WINDOW) if os.name == "nt" else 0
+        try:
+            self.process = subprocess.Popen(list(command), cwd=str(directory), stdin=subprocess.DEVNULL,
+                                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                                            creationflags=flags, close_fds=True, env=env)
+            try:
+                _assign_kill_on_close(self.process)
+            except NodeError:
+                self.process.kill()
+                self.process.wait(timeout=3)
+                raise
+        except OSError as exc:
+            raise NodeError("kernel_start", "private kernel failed to start") from exc
+        self.pump = threading.Thread(target=self._drain, daemon=True)
+        self.pump.start()
+
+    def _drain(self) -> None:
+        assert self.process.stdout is not None
+        try:
+            while True:
+                chunk = self.process.stdout.read1(8192)
+                if not chunk:
+                    break
+                day = date.today()
+                if self.log_day != day:
+                    if self.log is not None:
+                        self.log.close()
+                    self.log = open_log(self.directory / "logs", self.duty)
+                    self.log_day = day
+                if self.log is None:
+                    self.log_error = True
+                    continue
+                try:
+                    self.log.write(chunk)
+                except OSError:
+                    self.log_error = True
+                    self.log.close()
+                    self.log = None
+        finally:
+            self.process.stdout.close()
+            if self.log is not None:
+                self.log.close()
+
+    def poll(self) -> Optional[int]:
+        return self.process.poll()
+
+    def stop(self, timeout: float = 8.0) -> None:
+        if self.process.poll() is None:
+            self.process.terminate()
+            try:
+                self.process.wait(timeout=timeout)
+            except subprocess.TimeoutExpired:
+                self.process.kill()
+                self.process.wait(timeout=3)
+        self.pump.join(timeout=3)

cryptnode/resources/__init__.py

@@ -0,0 +1,2 @@
+"""Platform-private kernels are inserted into the published platform wheel."""
+

cryptnode/security.py

@@ -0,0 +1,135 @@
+"""Privilege, path and atomic-file safeguards for product-owned state."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import stat
+import shutil
+import sys
+import tempfile
+
+from .models import NodeError
+from .paths import checked_absolute
+
+
+def is_administrator() -> bool:
+    if os.name == "nt":
+        import ctypes
+        return bool(ctypes.windll.shell32.IsUserAnAdmin())
+    return os.geteuid() == 0
+
+
+def require_administrator() -> None:
+    if not is_administrator():
+        hint = "请使用 sudo crnode ... 执行此操作"
+        if os.name == "nt":
+            hint = "此操作需要管理员权限；请先进入 gsudo 环境，或运行 gsudo crnode ..."
+            if shutil.which("gsudo") is None:
+                hint += "；未找到 gsudo，可运行 winget install --id gerardog.gsudo -e 安装"
+        raise NodeError("administrator_required", hint)
+    if os.name != "nt":
+        trusted_runtime_account()
+
+
+def trusted_runtime_account():
+    """Bind a privileged Linux command to its deployment user's venv."""
+    import pwd
+
+    name = os.environ.get("SUDO_USER")
+    if not name or name == "root":
+        raise NodeError("runtime_user", "需要从可信部署用户的 sudo 会话执行")
+    try:
+        account = pwd.getpwnam(name)
+    except KeyError:
+        raise NodeError("runtime_user", "部署用户不存在") from None
+    prefix = Path(sys.prefix)
+    if (account.pw_uid == 0 or sys.prefix == sys.base_prefix
+            or prefix.stat().st_uid != account.pw_uid):
+        raise NodeError("runtime_python", "需要部署用户自有的可信虚拟环境")
+    if prefix.stat().st_mode & 0o002:
+        raise NodeError("runtime_python", "虚拟环境不能允许所有用户写入")
+    return account
+
+
+def _restrict_windows(path: Path, directory: bool, public_read: bool = False) -> None:
+    # One DACL replacement removes inherited and pre-existing explicit grants.
+    # Users may read only selected metadata; that ACE never inherits to children.
+    import ctypes
+    from ctypes import wintypes
+
+    entries = "(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)" if directory else "(A;;FA;;;SY)(A;;FA;;;BA)"
+    if public_read:
+        entries += "(A;;GRGX;;;BU)" if directory else "(A;;FR;;;BU)"
+    descriptor = ctypes.c_void_p()
+    advapi = ctypes.WinDLL("advapi32", use_last_error=True)
+    kernel = ctypes.WinDLL("kernel32", use_last_error=True)
+    convert = advapi.ConvertStringSecurityDescriptorToSecurityDescriptorW
+    convert.argtypes = [wintypes.LPCWSTR, wintypes.DWORD,
+                        ctypes.POINTER(ctypes.c_void_p), ctypes.POINTER(wintypes.DWORD)]
+    convert.restype = wintypes.BOOL
+    set_file = advapi.SetFileSecurityW
+    set_file.argtypes = [wintypes.LPCWSTR, wintypes.DWORD, ctypes.c_void_p]
+    set_file.restype = wintypes.BOOL
+    kernel.LocalFree.argtypes = [ctypes.c_void_p]
+    kernel.LocalFree.restype = ctypes.c_void_p
+    if not convert("D:P" + entries, 1, ctypes.byref(descriptor), None):
+        raise NodeError("acl_failed", "cannot construct CryptNode product ACL")
+    try:
+        # DACL_SECURITY_INFORMATION | PROTECTED_DACL_SECURITY_INFORMATION
+        if not set_file(str(path), 0x80000004, descriptor):
+            raise NodeError("acl_failed", "cannot restrict CryptNode product state")
+    finally:
+        kernel.LocalFree(descriptor)
+
+
+def secure_directory(path: Path, *, public_read: bool = False) -> None:
+    checked_absolute(path)
+    path.mkdir(parents=True, exist_ok=True, mode=0o700)
+    if path.is_symlink() or not path.is_dir():
+        raise NodeError("path_link", "product directory is unsafe")
+    if os.name == "nt":
+        _restrict_windows(path, True, public_read)
+    else:
+        path.chmod(0o700)
+
+
+def atomic_write(path: Path, data: bytes, *, secret: bool = False,
+                 public_read: bool = False, parent_public_read: bool = False) -> None:
+    if secret and public_read:
+        raise ValueError("secret files cannot be public")
+    if path.is_symlink() or (path.exists() and not path.is_file()):
+        raise NodeError("path_link", "product file path is unsafe")
+    secure_directory(path.parent, public_read=parent_public_read)
+    descriptor, temporary = tempfile.mkstemp(prefix=".cryptnode-", dir=str(path.parent))
+    try:
+        with os.fdopen(descriptor, "wb") as stream:
+            stream.write(data)
+            stream.flush()
+            os.fsync(stream.fileno())
+        if os.name == "nt":
+            _restrict_windows(Path(temporary), False, public_read)
+        else:
+            os.chmod(temporary, 0o600 if secret else 0o640)
+        os.replace(temporary, path)
+        if os.name != "nt":
+            directory = os.open(str(path.parent), os.O_RDONLY | os.O_DIRECTORY)
+            try:
+                os.fsync(directory)
+            finally:
+                os.close(directory)
+    finally:
+        if os.path.exists(temporary):
+            os.unlink(temporary)
+
+
+def assert_private_file(path: Path) -> None:
+    if path.is_symlink() or not path.is_file():
+        raise NodeError("file_unsafe", "private file is missing or unsafe")
+    if os.name != "nt":
+        metadata = path.stat()
+        if (not stat.S_ISREG(metadata.st_mode) or metadata.st_nlink != 1
+                or stat.S_IMODE(metadata.st_mode) & 0o077):
+            raise NodeError("file_unsafe", "private file permissions are too broad")
+
+

cryptnode/tls.py

@@ -0,0 +1,49 @@
+"""Fixed stunnel client policy for the two CryptNode duties."""
+
+from __future__ import annotations
+
+import os
+import re
+
+from .models import Profile
+
+
+def render_policy(profile: Profile, duty: str) -> str:
+    if duty not in ("control", "data"):
+        raise ValueError("duty must be control or data")
+    local_port = 13200 if duty == "control" else 13201
+    remote_port = profile.port_base if duty == "control" else profile.port_base + 1
+    lines = (["foreground = yes"] if os.name != "nt" else []) + [
+        "debug = notice", "sslVersionMin = TLSv1.2",
+        "sslVersionMax = TLSv1.3",
+        "ciphers = ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256",
+        "ciphersuites = TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256",
+        "options = NO_COMPRESSION", "renegotiation = no", "sessionResume = no",
+        "[cryptnode-%s]" % duty, "client = yes", "verifyChain = yes",
+        "CAfile = certs/ca.pem", "cert = certs/cert.pem", "key = certs/key.pem",
+        "checkHost = node.crypt", "sni = node.crypt",
+        "accept = %s:%d" % (profile.local_addr, local_port),
+        "connect = %s:%d" % (profile.access_host, remote_port),
+    ]
+    return "\n".join(lines) + "\n"
+
+
+def start_tunnel(directory, profile: Profile, duty: str):
+    from pathlib import Path
+    from .models import NodeError
+    from .processes import Child, resource_binary, wait_listener
+
+    directory = Path(directory)
+    policy = directory / ("%s.conf" % duty)
+    if policy.is_symlink() or policy.read_text(encoding="utf-8") != render_policy(profile, duty):
+        raise NodeError("tls_policy", "stunnel policy differs from the fixed CryptNode policy")
+    if not isinstance(profile.peer_cert_sha256, str) or not re.fullmatch(r"[0-9a-f]{64}", profile.peer_cert_sha256):
+        raise NodeError("peer_fingerprint", "门户证书指纹缺失或格式错误")
+    environment = dict(os.environ, CRYPTNODE_PEER_SHA256=profile.peer_cert_sha256)
+    child = Child([str(resource_binary("crnode-tls")), str(policy)], directory, duty, env=environment)
+    try:
+        wait_listener(profile, 13200 if duty == "control" else 13201, child.process)
+    except Exception:
+        child.stop()
+        raise
+    return child