2af57e6686
Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.
Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay: native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent: host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e: browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth: Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web: browser login + Web Crypto E2E + client-side preview rendering
Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.
NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.
54 lines
2.2 KiB
TypeScript
54 lines
2.2 KiB
TypeScript
/**
|
|
* T6 — HKDF session-key derivation with DIRECTION-SPLIT subkeys.
|
|
*
|
|
* CRITICAL (finding #1): one shared AEAD key across both directions + a deterministic seq-nonce
|
|
* ⇒ client-seq=N and host-seq=N reuse an identical (key, nonce) ⇒ GCM catastrophe, and lets a
|
|
* relay reflect a c2h frame back as h2c. Fix: derive the §4.4 master, then HKDF-Expand it into two
|
|
* disjoint subkeys under the FROZEN labels so client-write/host-read share one key and
|
|
* host-write/client-read share the OTHER, never the same.
|
|
*/
|
|
import { hkdf } from '@noble/hashes/hkdf'
|
|
import { sha256 } from '@noble/hashes/sha2'
|
|
import type { AeadAlg, DirectionalKeys } from 'relay-contracts'
|
|
import { HKDF_INFO, HKDF_INFO_C2H, HKDF_INFO_H2C, AEAD_KEY_BYTES } from 'relay-contracts'
|
|
import { concatBytes } from 'relay-contracts'
|
|
import { wrapAeadKey } from './aead-key.js'
|
|
|
|
const encoder = new TextEncoder()
|
|
const EMPTY = new Uint8Array(0)
|
|
|
|
/** §4.4 master secret: HKDF-SHA256(ikm=sharedSecret, salt=clientNonce‖hostNonce, info=HKDF_INFO). */
|
|
export function deriveMaster(
|
|
sharedSecret: Uint8Array,
|
|
clientNonce: Uint8Array,
|
|
hostNonce: Uint8Array,
|
|
): Uint8Array {
|
|
const salt = concatBytes([clientNonce, hostNonce])
|
|
return hkdf(sha256, sharedSecret, salt, encoder.encode(HKDF_INFO), AEAD_KEY_BYTES)
|
|
}
|
|
|
|
/** Expand the master into a single direction subkey under the given frozen label. */
|
|
function expandSubkey(master: Uint8Array, label: string): Uint8Array {
|
|
return hkdf(sha256, master, EMPTY, encoder.encode(label), AEAD_KEY_BYTES)
|
|
}
|
|
|
|
/**
|
|
* Derive the direction-split `DirectionalKeys` (c2h / h2c) for a session. `salt` is BOTH nonces in
|
|
* fixed client‖host order, so swapping the nonce roles yields different keys; the two subkeys are
|
|
* disjoint by construction (distinct frozen labels).
|
|
*/
|
|
export async function deriveSessionKeys(
|
|
sharedSecret: Uint8Array,
|
|
clientNonce: Uint8Array,
|
|
hostNonce: Uint8Array,
|
|
alg: AeadAlg,
|
|
): Promise<DirectionalKeys> {
|
|
const master = deriveMaster(sharedSecret, clientNonce, hostNonce)
|
|
const c2h = expandSubkey(master, HKDF_INFO_C2H)
|
|
const h2c = expandSubkey(master, HKDF_INFO_H2C)
|
|
return {
|
|
c2h: wrapAeadKey(c2h, alg, 'c2h'),
|
|
h2c: wrapAeadKey(h2c, alg, 'h2c'),
|
|
}
|
|
}
|