505 lines
23 KiB
JavaScript
505 lines
23 KiB
JavaScript
// LAN-Synchronisation zwischen MrTerm-Clients (Peer-to-Peer, Ende-zu-Ende verschlüsselt).
|
|
//
|
|
// Finden: UDP-Broadcast auf Port 47811 ("Beacon" mit Geräte-ID, Name, TCP-Port, koppelbar ja/nein).
|
|
// Koppeln: X25519-Schlüsselaustausch mit Commitment (der Initiator legt sich per Hash auf seinen Schlüssel fest,
|
|
// bevor er den des anderen kennt). Beide Geräte zeigen denselben 6-stelligen Vergleichscode (SAS);
|
|
// der Nutzer bestätigt auf beiden Geräten. Ergebnis: dauerhafter Kopplungsschlüssel (32 Byte).
|
|
// Sitzung: Gegenseitige Authentisierung per HMAC mit dem Kopplungsschlüssel, frische X25519-Schlüssel je Sitzung
|
|
// (Forward Secrecy), danach alle Nachrichten AES-256-GCM-verschlüsselt.
|
|
// Abgleich: Beide Seiten senden einen Schnappschuss; pro Eintrag gewinnt die neueste Änderung (updatedAt),
|
|
// Löschvermerke (tombstones) entfernen Einträge. Geheimnisse (SSH-Schlüssel, Passwörter, VPN-Konfigurationen)
|
|
// werden nur übertragen, wenn der Nutzer sie freigegeben hat.
|
|
const dgram = require('dgram');
|
|
const net = require('net');
|
|
const os = require('os');
|
|
const crypto = require('crypto');
|
|
const i18n = require('../i18n');
|
|
const fs = require('fs');
|
|
const { execFileSync } = require('child_process');
|
|
|
|
// Lokale Firewall erkennen, die Broadcasts/eingehende Verbindungen blockieren könnte (Linux).
|
|
// Ob die Ports bereits freigegeben sind, lässt sich ohne root nicht prüfen (UFW-Regeln sind nur für root lesbar).
|
|
function localFirewall() {
|
|
if (process.platform !== 'linux') return null;
|
|
const read = (f) => { try { return fs.readFileSync(f, 'utf8'); } catch { return ''; } };
|
|
const active = (unit) => { try { return execFileSync('systemctl', ['is-active', unit], { timeout: 3000 }).toString().trim() === 'active'; } catch { return false; } };
|
|
const os = (read('/etc/os-release').match(/^ID=(.*)$/m) || [])[1]?.replace(/"/g, '') || '';
|
|
const ufw = /^ENABLED=yes/m.test(read('/etc/ufw/ufw.conf')) || active('ufw');
|
|
const firewalld = active('firewalld');
|
|
if (!ufw && !firewalld && os !== 'cachyos') return null;
|
|
return { os, ufw, firewalld };
|
|
}
|
|
|
|
const UDP_PORT = 47811;
|
|
const TCP_PORT = 47812;
|
|
const PROTO = 1;
|
|
const COLLECTIONS = ['groups', 'hosts', 'keys', 'snippets', 'forwards', 'vpns'];
|
|
const SECRETS = { keys: ['privateKey', 'passphrase'], hosts: ['password'], vpns: ['config', 'password'] };
|
|
const SPKI_X25519 = Buffer.from('302a300506032b656e032100', 'hex');
|
|
const MAX_FRAME = 32 * 1024 * 1024;
|
|
|
|
const sha = (...parts) => crypto.createHash('sha256').update(Buffer.concat(parts.map((p) => Buffer.from(p)))).digest();
|
|
const hmac = (key, ...parts) => crypto.createHmac('sha256', key).update(Buffer.concat(parts.map((p) => Buffer.from(p)))).digest();
|
|
const hkdf = (ikm, salt, info) => Buffer.from(crypto.hkdfSync('sha256', ikm, salt, info, 32));
|
|
const ts = (x) => x?.updatedAt || x?.createdAt || 0;
|
|
|
|
function x25519() {
|
|
const { publicKey, privateKey } = crypto.generateKeyPairSync('x25519');
|
|
return { privateKey, pub: publicKey.export({ type: 'spki', format: 'der' }).subarray(-32) };
|
|
}
|
|
function dh(privateKey, peerPub) {
|
|
const pk = crypto.createPublicKey({ key: Buffer.concat([SPKI_X25519, Buffer.from(peerPub)]), format: 'der', type: 'spki' });
|
|
return crypto.diffieHellman({ privateKey, publicKey: pk });
|
|
}
|
|
|
|
// ---------------------------------------------------------------- Framing (4 Byte Länge + Nutzlast)
|
|
class Channel {
|
|
constructor(sock) {
|
|
this.sock = sock;
|
|
this.buf = Buffer.alloc(0);
|
|
this.queue = [];
|
|
this.waiters = [];
|
|
this.keys = null; // { send, recv } nach dem Handshake
|
|
sock.on('data', (d) => this.onData(d));
|
|
const fail = (e) => { this.closed = e || new Error('closed'); this.waiters.splice(0).forEach((w) => w.reject(this.closed)); };
|
|
sock.on('close', () => fail());
|
|
sock.on('error', (e) => fail(e));
|
|
sock.setTimeout(180000, () => sock.destroy(new Error('timeout')));
|
|
}
|
|
onData(d) {
|
|
this.buf = Buffer.concat([this.buf, d]);
|
|
while (this.buf.length >= 4) {
|
|
const len = this.buf.readUInt32BE(0);
|
|
if (len > MAX_FRAME) { this.sock.destroy(new Error('frame too large')); return; }
|
|
if (this.buf.length < 4 + len) break;
|
|
const frame = this.buf.subarray(4, 4 + len);
|
|
this.buf = this.buf.subarray(4 + len);
|
|
let msg;
|
|
try { msg = this.decode(frame); } catch (e) { this.sock.destroy(e); return; }
|
|
const w = this.waiters.shift();
|
|
if (w) w.resolve(msg); else this.queue.push(msg);
|
|
}
|
|
}
|
|
encode(obj) {
|
|
const plain = Buffer.from(JSON.stringify(obj));
|
|
if (!this.keys) return plain;
|
|
const iv = crypto.randomBytes(12);
|
|
const c = crypto.createCipheriv('aes-256-gcm', this.keys.send, iv);
|
|
return Buffer.concat([iv, c.update(plain), c.final(), c.getAuthTag()]);
|
|
}
|
|
decode(frame) {
|
|
if (!this.keys) return JSON.parse(frame.toString('utf8'));
|
|
const d = crypto.createDecipheriv('aes-256-gcm', this.keys.recv, frame.subarray(0, 12));
|
|
d.setAuthTag(frame.subarray(frame.length - 16));
|
|
return JSON.parse(Buffer.concat([d.update(frame.subarray(12, frame.length - 16)), d.final()]).toString('utf8'));
|
|
}
|
|
send(obj) {
|
|
const p = this.encode(obj);
|
|
const h = Buffer.alloc(4); h.writeUInt32BE(p.length);
|
|
this.sock.write(Buffer.concat([h, p]));
|
|
}
|
|
recv(type, timeout = 30000) {
|
|
const msg = this.queue.length ? Promise.resolve(this.queue.shift()) : this.closed ? Promise.reject(this.closed) : new Promise((resolve, reject) => this.waiters.push({ resolve, reject }));
|
|
let t;
|
|
const to = new Promise((_, rej) => { t = setTimeout(() => rej(new Error('timeout')), timeout); });
|
|
return Promise.race([msg, to]).finally(() => clearTimeout(t)).then((m) => {
|
|
if (m?.t === 'error') throw new Error(m.msg || 'remote error');
|
|
if (type && m?.t !== type) throw new Error(`unexpected message ${m?.t}`);
|
|
return m;
|
|
});
|
|
}
|
|
close() { try { this.sock.end(); } catch {} }
|
|
}
|
|
|
|
// ---------------------------------------------------------------- Zusammenführen
|
|
// Schnappschuss für ein Gerät; nicht freigegebene Geheimnisse werden entfernt
|
|
function snapshot(data) {
|
|
const share = data.sync?.share || {};
|
|
const out = { tombstones: data.tombstones || [], knownHosts: data.knownHosts || {} };
|
|
for (const c of COLLECTIONS) {
|
|
out[c] = (data[c] || []).map((x) => {
|
|
const fields = SECRETS[c];
|
|
if (!fields || (share[c] || []).includes(x.id)) return x;
|
|
const y = { ...x, _noSecret: true };
|
|
fields.forEach((f) => delete y[f]);
|
|
return y;
|
|
});
|
|
}
|
|
return out;
|
|
}
|
|
|
|
// Eingehenden Schnappschuss übernehmen; liefert true, wenn sich etwas geändert hat
|
|
function merge(data, incoming) {
|
|
let changed = false;
|
|
const tombs = new Map((data.tombstones || []).map((t) => [`${t.c}|${t.id}`, t]));
|
|
for (const t of incoming.tombstones || []) {
|
|
const k = `${t.c}|${t.id}`;
|
|
if (!tombs.has(k) || tombs.get(k).at < t.at) { tombs.set(k, t); changed = true; }
|
|
}
|
|
data.tombstones = [...tombs.values()];
|
|
for (const c of COLLECTIONS) {
|
|
const list = data[c] || (data[c] = []);
|
|
for (const inc of incoming[c] || []) {
|
|
if (!inc?.id) continue;
|
|
const tomb = tombs.get(`${c}|${inc.id}`);
|
|
if (tomb && tomb.at >= ts(inc)) continue;
|
|
const i = list.findIndex((x) => x.id === inc.id);
|
|
const local = list[i];
|
|
if (local && ts(local) >= ts(inc)) continue;
|
|
const { _noSecret, ...item } = inc;
|
|
// Nicht freigegebene Geheimnisse: lokale Werte behalten
|
|
if (_noSecret && local) (SECRETS[c] || []).forEach((f) => { if (local[f] !== undefined) item[f] = local[f]; });
|
|
if (i >= 0) list[i] = item; else list.push(item);
|
|
changed = true;
|
|
}
|
|
// Löschvermerke anwenden
|
|
const before = list.length;
|
|
data[c] = list.filter((x) => { const t = tombs.get(`${c}|${x.id}`); return !t || t.at < ts(x); });
|
|
if (data[c].length !== before) changed = true;
|
|
}
|
|
for (const [id, kh] of Object.entries(incoming.knownHosts || {})) {
|
|
const t = tombs.get(`knownHosts|${id}`);
|
|
if (t && t.at >= (kh.addedAt || 0)) continue;
|
|
const local = data.knownHosts[id];
|
|
if (!local || (kh.addedAt || 0) > (local.addedAt || 0)) { data.knownHosts[id] = kh; changed = true; }
|
|
}
|
|
for (const t of tombs.values()) {
|
|
if (t.c === 'knownHosts' && data.knownHosts[t.id] && (data.knownHosts[t.id].addedAt || 0) <= t.at) { delete data.knownHosts[t.id]; changed = true; }
|
|
}
|
|
return changed;
|
|
}
|
|
|
|
// ---------------------------------------------------------------- Dienst
|
|
class SyncService {
|
|
/**
|
|
* @param {import('./store').Store} store
|
|
* @param {(event: string, payload?: any) => void} emit Ereignisse an die Oberfläche
|
|
* @param {(req: { code, name, id }) => Promise<boolean>} confirmPair Vergleichscode anzeigen und Bestätigung abwarten
|
|
*/
|
|
constructor(store, emit, confirmPair) {
|
|
this.store = store;
|
|
this.emit = emit;
|
|
this.confirmPair = confirmPair;
|
|
this.seen = new Map(); // id -> { id, name, address, port, pairable, at }
|
|
this.pairable = false;
|
|
this.running = false;
|
|
this.lastError = '';
|
|
this.syncing = new Set();
|
|
this.firewall = localFirewall();
|
|
}
|
|
|
|
get cfg() {
|
|
const d = this.store.get();
|
|
d.sync ||= { enabled: false, peers: [], share: { keys: [], hosts: [], vpns: [] } };
|
|
const s = d.sync;
|
|
if (!s.deviceId) s.deviceId = crypto.randomUUID();
|
|
if (!s.deviceName) s.deviceName = process.env.MRTERM_DEVICE || os.hostname();
|
|
s.peers ||= []; s.share ||= { keys: [], hosts: [], vpns: [] };
|
|
return s;
|
|
}
|
|
|
|
// ------------------------------------------------ Start/Stop
|
|
async start() {
|
|
if (this.running || this.store.sealed || !this.cfg.enabled) return;
|
|
this.running = true;
|
|
this.server = net.createServer((sock) => this.accept(sock).catch(() => sock.destroy()));
|
|
this.server.on('error', () => {});
|
|
await new Promise((res) => {
|
|
this.server.once('error', () => this.server.listen(0, res));
|
|
this.server.listen(TCP_PORT, res);
|
|
});
|
|
this.port = this.server.address().port;
|
|
this.udp = dgram.createSocket({ type: 'udp4', reuseAddr: true });
|
|
this.udp.on('error', () => {});
|
|
this.udp.on('message', (msg, rinfo) => this.onBeacon(msg, rinfo));
|
|
await new Promise((res) => this.udp.bind(UDP_PORT, () => { try { this.udp.setBroadcast(true); } catch {} res(); }));
|
|
this.beaconTimer = setInterval(() => this.beacon(), 5000);
|
|
this.syncTimer = setInterval(() => this.syncAll(), 120000);
|
|
this.beacon();
|
|
this.emitState();
|
|
}
|
|
|
|
stop() {
|
|
if (!this.running) return;
|
|
this.running = false;
|
|
clearInterval(this.beaconTimer); clearInterval(this.syncTimer); clearTimeout(this.debounce);
|
|
try { this.server.close(); } catch {}
|
|
try { this.udp.close(); } catch {}
|
|
this.seen.clear();
|
|
this.emitState();
|
|
}
|
|
|
|
setEnabled(on, name) {
|
|
const c = this.cfg;
|
|
c.enabled = !!on;
|
|
if (name) c.deviceName = String(name).slice(0, 60);
|
|
this.store.save();
|
|
if (on) this.start(); else this.stop();
|
|
return this.status();
|
|
}
|
|
|
|
// ------------------------------------------------ Finden
|
|
broadcastAddrs() {
|
|
const out = new Set(['255.255.255.255']);
|
|
let ifaces = {};
|
|
try { ifaces = os.networkInterfaces(); } catch {} // Android: je nach Version eingeschränkt
|
|
for (const list of Object.values(ifaces)) {
|
|
for (const a of list || []) {
|
|
if (a.family !== 'IPv4' || a.internal) continue;
|
|
const ip = a.address.split('.').map(Number), mask = a.netmask.split('.').map(Number);
|
|
out.add(ip.map((o, i) => (o & mask[i]) | (~mask[i] & 255)).join('.'));
|
|
}
|
|
}
|
|
return [...out];
|
|
}
|
|
|
|
beacon() {
|
|
if (!this.running) return;
|
|
const c = this.cfg;
|
|
const msg = Buffer.from(JSON.stringify({ mrterm: PROTO, id: c.deviceId, name: c.deviceName, port: this.port, pairable: this.pairable }));
|
|
for (const addr of this.broadcastAddrs()) this.udp.send(msg, UDP_PORT, addr, () => {});
|
|
// Einträge älter als 20 s gelten als offline
|
|
for (const [id, p] of this.seen) if (Date.now() - p.at > 20000) { this.seen.delete(id); this.emitState(); }
|
|
}
|
|
|
|
onBeacon(buf, rinfo) {
|
|
let b;
|
|
try { b = JSON.parse(buf.toString('utf8')); } catch { return; }
|
|
if (b?.mrterm !== PROTO || !b.id || b.id === this.cfg.deviceId || !Number.isInteger(b.port)) return;
|
|
const known = this.seen.get(b.id);
|
|
this.seen.set(b.id, { id: b.id, name: String(b.name || '').slice(0, 60), address: rinfo.address, port: b.port, pairable: !!b.pairable, at: Date.now() });
|
|
const peer = this.cfg.peers.find((p) => p.id === b.id);
|
|
if (peer && peer.address !== rinfo.address) { peer.address = rinfo.address; peer.port = b.port; }
|
|
if (!known) { this.emitState(); if (peer) this.syncWith(peer).catch(() => {}); }
|
|
else if (known.pairable !== !!b.pairable) this.emitState();
|
|
}
|
|
|
|
setPairable(on) {
|
|
this.pairable = !!on;
|
|
clearTimeout(this.pairTimer);
|
|
if (on) this.pairTimer = setTimeout(() => this.setPairable(false), 180000);
|
|
this.beacon();
|
|
this.emitState();
|
|
}
|
|
|
|
// ------------------------------------------------ Status für die Oberfläche
|
|
status() {
|
|
const c = this.cfg;
|
|
return {
|
|
enabled: c.enabled, running: this.running, deviceId: c.deviceId, deviceName: c.deviceName, pairable: this.pairable, port: this.port,
|
|
peers: c.peers.map((p) => ({ id: p.id, name: p.name, lastSync: p.lastSync || 0, online: this.seen.has(p.id), address: p.address, error: p.error || '' })),
|
|
nearby: [...this.seen.values()].filter((p) => !c.peers.some((x) => x.id === p.id)).map(({ id, name, address, pairable }) => ({ id, name, address, pairable })),
|
|
share: c.share, asked: !!c.asked, sealed: !!this.store.sealed, firewall: this.firewall,
|
|
};
|
|
}
|
|
emitState() { this.emit('sync:state', this.status()); }
|
|
|
|
// ------------------------------------------------ Verbindungen
|
|
connect(address, port) {
|
|
return new Promise((resolve, reject) => {
|
|
const sock = net.connect({ host: address, port, timeout: 8000 });
|
|
sock.once('connect', () => { sock.setTimeout(0); resolve(new Channel(sock)); });
|
|
sock.once('timeout', () => { sock.destroy(); reject(new Error('timeout')); });
|
|
sock.once('error', reject);
|
|
});
|
|
}
|
|
|
|
// Eingehende Verbindung: Kopplung oder Synchronisation
|
|
async accept(sock) {
|
|
const ch = new Channel(sock);
|
|
try {
|
|
const first = await ch.recv(null, 10000);
|
|
if (first.t === 'pair') await this.pairResponder(ch, first);
|
|
else if (first.t === 'hello') await this.sessionResponder(ch, first);
|
|
} catch (e) {
|
|
try { ch.send({ t: 'error', msg: e.message }); } catch {}
|
|
} finally { ch.close(); }
|
|
}
|
|
|
|
// ------------------------------------------------ Kopplung
|
|
// Initiator (Gerät, auf dem der Nutzer ein anderes Gerät ausgewählt hat)
|
|
async pair(id) {
|
|
const target = this.seen.get(id);
|
|
if (!target) throw new Error('Device not found');
|
|
const ch = await this.connect(target.address, target.port);
|
|
try {
|
|
const me = x25519();
|
|
const nonce = crypto.randomBytes(16);
|
|
const c = this.cfg;
|
|
ch.send({ t: 'pair', v: PROTO, id: c.deviceId, name: c.deviceName, commit: sha(me.pub, nonce).toString('base64') });
|
|
const r = await ch.recv('pair-pub');
|
|
ch.send({ t: 'pair-reveal', pub: me.pub.toString('base64'), nonce: nonce.toString('base64') });
|
|
const peerPub = Buffer.from(r.pub, 'base64');
|
|
const { code, key } = this.derivePair(dh(me.privateKey, peerPub), peerPub, me.pub, r.id, c.deviceId);
|
|
return await this.finishPair(ch, { id: r.id, name: r.name, address: target.address, port: target.port }, code, key, 'initiator');
|
|
} finally { ch.close(); }
|
|
}
|
|
|
|
// Gegenseite: nur solange "koppelbar" aktiv ist
|
|
async pairResponder(ch, msg) {
|
|
if (!this.pairable) throw new Error(i18n.t('Device is not ready for pairing'));
|
|
const me = x25519();
|
|
const c = this.cfg;
|
|
ch.send({ t: 'pair-pub', id: c.deviceId, name: c.deviceName, pub: me.pub.toString('base64') });
|
|
const rev = await ch.recv('pair-reveal');
|
|
const peerPub = Buffer.from(rev.pub, 'base64');
|
|
if (!sha(peerPub, Buffer.from(rev.nonce, 'base64')).equals(Buffer.from(msg.commit, 'base64'))) throw new Error('Commitment mismatch');
|
|
const { code, key } = this.derivePair(dh(me.privateKey, peerPub), me.pub, peerPub, c.deviceId, msg.id);
|
|
const addr = ch.sock.remoteAddress?.replace(/^::ffff:/, '');
|
|
await this.finishPair(ch, { id: msg.id, name: String(msg.name || '').slice(0, 60), address: addr, port: this.seen.get(msg.id)?.port || TCP_PORT }, code, key, 'responder');
|
|
}
|
|
|
|
// Vergleichscode und Kopplungsschlüssel aus dem Schlüsselaustausch (Reihenfolge: Responder, Initiator)
|
|
derivePair(shared, pubR, pubI, idR, idI) {
|
|
const transcript = Buffer.concat([pubR, pubI, Buffer.from(`${idR}|${idI}`)]);
|
|
const code = String(sha('mrterm-sas', transcript).readUInt32BE(0) % 1000000).padStart(6, '0');
|
|
const key = hkdf(shared, transcript, 'mrterm-pair-key');
|
|
return { code, key };
|
|
}
|
|
|
|
async finishPair(ch, peer, code, key, role) {
|
|
const ok = await this.confirmPair({ code, name: peer.name, id: peer.id, role });
|
|
ch.send({ t: 'pair-confirm', ok, mac: ok ? hmac(key, 'confirm', role).toString('base64') : '' });
|
|
const r = await ch.recv('pair-confirm', 120000);
|
|
const other = role === 'initiator' ? 'responder' : 'initiator';
|
|
if (!ok) throw new Error(i18n.t('Pairing was rejected on this device.'));
|
|
if (!r.ok) throw new Error(i18n.t('Pairing was rejected on the other device.'));
|
|
if (!crypto.timingSafeEqual(Buffer.from(r.mac, 'base64'), hmac(key, 'confirm', other))) throw new Error(i18n.t('Pairing verification failed.'));
|
|
const c = this.cfg;
|
|
c.peers = [...c.peers.filter((p) => p.id !== peer.id), { ...peer, key: key.toString('base64'), pairedAt: Date.now() }];
|
|
this.store.save();
|
|
this.setPairable(false);
|
|
this.emit('sync:paired', { id: peer.id, name: peer.name });
|
|
this.emitState();
|
|
if (role === 'initiator') setTimeout(() => this.syncWith(c.peers.find((p) => p.id === peer.id)).catch(() => {}), 1500);
|
|
return true;
|
|
}
|
|
|
|
unpair(id) {
|
|
const c = this.cfg;
|
|
c.peers = c.peers.filter((p) => p.id !== id);
|
|
this.store.save();
|
|
this.emitState();
|
|
return this.status();
|
|
}
|
|
|
|
// ------------------------------------------------ Sitzung (authentisiert + verschlüsselt)
|
|
sessionKeys(pairKey, shared, transcript, initiator) {
|
|
const k1 = hkdf(Buffer.concat([pairKey, shared]), transcript, 'mrterm-i2r');
|
|
const k2 = hkdf(Buffer.concat([pairKey, shared]), transcript, 'mrterm-r2i');
|
|
return initiator ? { send: k1, recv: k2 } : { send: k2, recv: k1 };
|
|
}
|
|
|
|
async syncWith(peer) {
|
|
if (!peer || !this.running || this.store.sealed || this.syncing.has(peer.id)) return;
|
|
const live = this.seen.get(peer.id);
|
|
const address = live?.address || peer.address;
|
|
const port = live?.port || peer.port || TCP_PORT;
|
|
if (!address) return;
|
|
this.syncing.add(peer.id);
|
|
let ch;
|
|
try {
|
|
ch = await this.connect(address, port);
|
|
const key = Buffer.from(peer.key, 'base64');
|
|
const me = x25519();
|
|
const nI = crypto.randomBytes(16);
|
|
const c = this.cfg;
|
|
ch.send({ t: 'hello', v: PROTO, id: c.deviceId, eph: me.pub.toString('base64'), nonce: nI.toString('base64') });
|
|
const r = await ch.recv('hello');
|
|
if (r.id !== peer.id) throw new Error('Unexpected device');
|
|
const transcript = Buffer.concat([Buffer.from(c.deviceId), Buffer.from(peer.id), me.pub, Buffer.from(r.eph, 'base64'), nI, Buffer.from(r.nonce, 'base64')]);
|
|
if (!crypto.timingSafeEqual(Buffer.from(r.mac, 'base64'), hmac(key, 'responder', transcript))) throw new Error('Authentication failed');
|
|
ch.send({ t: 'auth', mac: hmac(key, 'initiator', transcript).toString('base64') });
|
|
ch.keys = this.sessionKeys(key, dh(me.privateKey, Buffer.from(r.eph, 'base64')), transcript, true);
|
|
ch.send({ t: 'state', data: snapshot(this.store.get()) });
|
|
const theirs = await ch.recv('state');
|
|
this.applyRemote(theirs.data);
|
|
Object.assign(peer, { lastSync: Date.now(), error: '', address, port });
|
|
this.store.muted = true; this.store.save(); this.store.muted = false;
|
|
} catch (e) {
|
|
peer.error = e.message;
|
|
throw e;
|
|
} finally {
|
|
this.syncing.delete(peer.id);
|
|
ch?.close();
|
|
this.emitState();
|
|
}
|
|
}
|
|
|
|
async sessionResponder(ch, msg) {
|
|
const c = this.cfg;
|
|
const peer = c.peers.find((p) => p.id === msg.id);
|
|
if (!peer || this.store.sealed) throw new Error('Unknown device');
|
|
const key = Buffer.from(peer.key, 'base64');
|
|
const me = x25519();
|
|
const nR = crypto.randomBytes(16);
|
|
const transcript = Buffer.concat([Buffer.from(msg.id), Buffer.from(c.deviceId), Buffer.from(msg.eph, 'base64'), me.pub, Buffer.from(msg.nonce, 'base64'), nR]);
|
|
ch.send({ t: 'hello', id: c.deviceId, eph: me.pub.toString('base64'), nonce: nR.toString('base64'), mac: hmac(key, 'responder', transcript).toString('base64') });
|
|
const a = await ch.recv('auth');
|
|
if (!crypto.timingSafeEqual(Buffer.from(a.mac, 'base64'), hmac(key, 'initiator', transcript))) throw new Error('Authentication failed');
|
|
ch.keys = this.sessionKeys(key, dh(me.privateKey, Buffer.from(msg.eph, 'base64')), transcript, false);
|
|
const theirs = await ch.recv('state');
|
|
ch.send({ t: 'state', data: snapshot(this.store.get()) });
|
|
this.applyRemote(theirs.data);
|
|
Object.assign(peer, { lastSync: Date.now(), error: '', address: ch.sock.remoteAddress?.replace(/^::ffff:/, '') || peer.address });
|
|
this.store.muted = true; this.store.save(); this.store.muted = false;
|
|
this.emitState();
|
|
}
|
|
|
|
applyRemote(data) {
|
|
if (merge(this.store.get(), data || {})) {
|
|
this.store.muted = true; this.store.save(); this.store.muted = false;
|
|
this.emit('sync:changed');
|
|
// Änderungen an weitere gekoppelte Geräte weitergeben
|
|
this.schedule(3000);
|
|
}
|
|
}
|
|
|
|
// Nach lokalen Änderungen (entprellt) mit allen erreichbaren Geräten abgleichen
|
|
schedule(delay = 2000) {
|
|
if (!this.running) return;
|
|
clearTimeout(this.debounce);
|
|
this.debounce = setTimeout(() => this.syncAll(), delay);
|
|
}
|
|
|
|
async syncAll() {
|
|
const results = await Promise.allSettled(this.cfg.peers.filter((p) => this.seen.has(p.id) || p.address).map((p) => this.syncWith(p)));
|
|
return results.filter((r) => r.status === 'fulfilled').length;
|
|
}
|
|
|
|
setShare(share) {
|
|
const clean = (a) => (Array.isArray(a) ? a.filter((x) => typeof x === 'string') : []);
|
|
const c = this.cfg;
|
|
c.share = { keys: clean(share?.keys), hosts: clean(share?.hosts), vpns: clean(share?.vpns), declined: { keys: [], hosts: [], vpns: [] } };
|
|
c.asked = true;
|
|
this.store.save();
|
|
return this.status();
|
|
}
|
|
|
|
// Einzelnes neues Geheimnis teilen oder ablehnen (Ablehnung wird gemerkt, damit nicht erneut gefragt wird)
|
|
shareItem(c, id, yes) {
|
|
if (!SECRETS[c] || typeof id !== 'string') throw new Error('Invalid');
|
|
const sh = this.cfg.share;
|
|
sh.declined ||= { keys: [], hosts: [], vpns: [] };
|
|
sh[c] = (sh[c] || []).filter((x) => x !== id);
|
|
sh.declined[c] = (sh.declined[c] || []).filter((x) => x !== id);
|
|
(yes ? sh[c] : sh.declined[c]).push(id);
|
|
this.store.save();
|
|
if (yes) this.schedule(500);
|
|
return this.status();
|
|
}
|
|
|
|
// Gerät per IP hinzufügen (wenn Broadcasts im Netz blockiert sind)
|
|
async probe(address, port = TCP_PORT) {
|
|
if (!/^[\w.:-]+$/.test(address)) throw new Error('Invalid address');
|
|
// Kurzer Test, ob dort ein MrTerm lauscht; das Gerät erscheint danach unter "In der Nähe"
|
|
const ch = await this.connect(address, Number(port) || TCP_PORT);
|
|
ch.close();
|
|
this.seen.set(`manual:${address}`, { id: `manual:${address}`, name: address, address, port: Number(port) || TCP_PORT, pairable: true, at: Date.now() + 600000 });
|
|
this.emitState();
|
|
return true;
|
|
}
|
|
}
|
|
|
|
module.exports = { SyncService, snapshot, merge, Channel };
|