fix: close APT adversarial runtime gaps

2026-08-19 21:59:19 +00:00
parent 2f492b662d
commit cf75ea9bc2
9 changed files with 688 additions and 233 deletions
@@ -13,7 +13,12 @@ const {
  createBridgeHandler,
  loadPairingEnvelope,
 } = require('../src/electron-runtime');
-const { APT_EXTENSION_ORIGIN, BridgeAuth } = require('../src/bridge-auth');
+const {
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  computeCookieProof,
+  createRequestLimiter,
+} = require('../src/bridge-auth');
 const { createSessionStore } = require('../src/session-store');

 const ROOT = path.join(__dirname, '..');
@@ -33,12 +38,11 @@ function responseHarness() {
  };
 }

-function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, secret, body = '{}' } = {}) {
+function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, url = '/cookie', body = '{}' } = {}) {
  const request = new PassThrough();
  request.method = method;
-  request.url = '/cookie';
+  request.url = url;
  request.headers = { origin };
-  if (secret !== undefined) request.headers['x-apt-pairing'] = secret;
  process.nextTick(() => request.end(body));
  return request;
 }
@@ -47,10 +51,19 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
  const sessionStore = createSessionStore();
  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
  const calls = [];
+  const tracked = [];
  const proxyManager = {
-    launchProxy(request) { calls.push(request); return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' }; },
-    stopProxy(processId) { calls.push({ processId }); return { success: true, processId, status: 'stop-requested' }; },
-    listTrackedProxies() { return []; },
+    launchProxy(request) {
+      calls.push(request);
+      tracked.push({ processId: 91, deviceId: request.deviceId, status: 'running', startedAt: 1 });
+      return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' };
+    },
+    stopProxy(processId) {
+      calls.push({ processId });
+      tracked.splice(0, tracked.length);
+      return { success: true, processId, status: 'stop-requested' };
+    },
+    listTrackedProxies() { return tracked.slice(); },
  };
  const runtime = new AppRuntime({
    sessionStore,
@@ -86,8 +99,10 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
  assert.equal((await runtime.stopProxy(999)).success, false);
 });

-test('bridge rejects unknown preflight and unauthenticated requests before reading their body', async () => {
-  const auth = new BridgeAuth();
+test('bridge authenticates itself before accepting a one-time HMAC cookie request', async () => {
+  const protect = (value) => Buffer.from(`protected:${value}`);
+  const unprotect = (value) => Buffer.from(value).toString().slice('protected:'.length);
+  const auth = new BridgeAuth({ protect, unprotect });
  const secret = auth.rotate().secret;
  const sessionStore = createSessionStore();
  let stateNotifications = 0;
@@ -103,44 +118,72 @@ test('bridge rejects unknown preflight and unauthenticated requests before readi
  assert.equal(unknownResponse.statusCode, 403);
  assert.equal(unknownResponse.headers['access-control-allow-origin'], undefined);

-  const unauthenticated = requestHarness({ body: '{'.repeat(1000) });
-  let dataRead = false;
-  unauthenticated.on('data', () => { dataRead = true; });
-  const unauthenticatedResponse = responseHarness();
-  await handler(unauthenticated, unauthenticatedResponse);
-  assert.equal(unauthenticatedResponse.statusCode, 403);
-  assert.equal(dataRead, false);
-
-  const allowedPreflight = requestHarness({ method: 'OPTIONS', secret });
+  const allowedPreflight = requestHarness({ method: 'OPTIONS' });
  const allowedResponse = responseHarness();
  await handler(allowedPreflight, allowedResponse);
  assert.equal(allowedResponse.statusCode, 204);
  assert.equal(allowedResponse.headers['access-control-allow-origin'], APT_EXTENSION_ORIGIN);
-  assert.match(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/);
+  assert.doesNotMatch(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/i);

-  const accepted = requestHarness({
-    secret,
-    body: JSON.stringify({ deploymentUrl: 'https://customer.avasecurity.com', cookieValue: 'valid-cookie' }),
-  });
+  const clientNonce = Buffer.alloc(32, 3).toString('base64url');
+  const challengeResponse = responseHarness();
+  await handler(requestHarness({ url: '/challenge', body: JSON.stringify({ clientNonce }) }), challengeResponse);
+  assert.equal(challengeResponse.statusCode, 200);
+  const challenge = JSON.parse(challengeResponse.body);
+  assert.equal(JSON.stringify(challenge).includes(secret), false);
+
+  const cookieBody = {
+    clientNonce,
+    serverNonce: challenge.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'valid-cookie',
+  };
+  cookieBody.proof = computeCookieProof(secret, cookieBody);
  const acceptedResponse = responseHarness();
-  await handler(accepted, acceptedResponse);
+  await handler(requestHarness({ body: JSON.stringify(cookieBody) }), acceptedResponse);
  assert.equal(acceptedResponse.statusCode, 200);
  assert.deepEqual(sessionStore.describe(), { connected: true, origin: 'https://customer.avasecurity.com' });
  assert.equal(stateNotifications, 1);
  assert.equal(acceptedResponse.body.includes('valid-cookie'), false);
+
+  const replayResponse = responseHarness();
+  await handler(requestHarness({ body: JSON.stringify(cookieBody) }), replayResponse);
+  assert.equal(replayResponse.statusCode, 403);
 });

-test('pairing envelope persists with restrictive permissions and secrets are returned once', () => {
+test('bridge limiter encloses body reads and HMAC authentication under forged floods', async () => {
+  const auth = new BridgeAuth({ protect: (value) => Buffer.from(value), unprotect: (value) => Buffer.from(value).toString() });
+  auth.rotate();
+  const limiter = createRequestLimiter({ maxConcurrent: 1 });
+  const handler = createBridgeHandler({ bridgeAuth: auth, sessionStore: createSessionStore(), limiter, deadlineMs: 50 });
+  const held = new PassThrough();
+  held.method = 'POST';
+  held.url = '/challenge';
+  held.headers = { origin: APT_EXTENSION_ORIGIN };
+  const first = handler(held, responseHarness());
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(limiter.active, 1);
+  const rejected = responseHarness();
+  await handler(requestHarness({ url: '/challenge', body: JSON.stringify({ clientNonce: 'A'.repeat(43) }) }), rejected);
+  assert.equal(rejected.statusCode, 429);
+  held.end('{}');
+  await first;
+});
+
+test('pairing envelope persists encrypted with restrictive permissions and secrets are returned once', () => {
  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-'));
  const envelopePath = path.join(directory, 'bridge-pairing.json');
-  const controller = new PairingController({ envelopePath });
+  const protect = (value) => Buffer.from(`dpapi:${value}`);
+  const unprotect = (value) => Buffer.from(value).toString().slice('dpapi:'.length);
+  const controller = new PairingController({ envelopePath, protect, unprotect });

  const first = controller.initialize();
  assert.equal(first.paired, true);
  assert.match(first.secret, /^[A-Za-z0-9_-]{43}$/);
  assert.deepEqual(controller.getStatus(), { paired: true });
-  const persisted = loadPairingEnvelope(envelopePath);
+  const persisted = loadPairingEnvelope(envelopePath, { protect, unprotect });
  assert.equal(Object.values(persisted).includes(first.secret), false);
+  assert.equal(fs.readFileSync(envelopePath, 'utf8').includes(first.secret), false);
  if (process.platform !== 'win32') assert.equal(fs.statSync(envelopePath).mode & 0o777, 0o600);

  const rotated = controller.rotate();
@@ -152,6 +195,84 @@ test('pairing envelope persists with restrictive permissions and secrets are ret
  assert.equal(fs.existsSync(envelopePath), false);
 });

+test('pairing fails closed and reports unavailable without secure storage', () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-unavailable-'));
+  const controller = new PairingController({ envelopePath: path.join(directory, 'bridge-pairing.json') });
+  assert.deepEqual(controller.initialize(), { paired: false, unavailable: true });
+  assert.deepEqual(controller.getStatus(), { paired: false, unavailable: true });
+  assert.throws(() => controller.rotate(), (error) => error.code === 'SECURE_STORAGE_UNAVAILABLE');
+});
+
+test('runtime reconciles exited children and permits relaunch for the same device', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const tracked = [];
+  let nextPid = 4101;
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: { getDevices: async () => [{ guid: deviceId }] },
+    proxyManager: {
+      launchProxy() {
+        const entry = { processId: nextPid++, deviceId, status: 'running', startedAt: 1 };
+        tracked.push(entry);
+        return { success: true, ...entry };
+      },
+      stopProxy() { throw new Error('unused'); },
+      listTrackedProxies() { return tracked.slice(); },
+    },
+  });
+  await runtime.getDevices();
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4101);
+  tracked.length = 0;
+  assert.deepEqual(runtime.getConnectionState().activeProxies, []);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4102);
+});
+
+test('disconnect stops every owned proxy before clearing the Alta session', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const tracked = [
+    { processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 },
+    { processId: 4102, deviceId: '550e8400-e29b-41d4-a716-446655440001', status: 'running', startedAt: 1 },
+  ];
+  const stopped = [];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {},
+    proxyManager: {
+      listTrackedProxies() { return tracked.slice(); },
+      stopProxy(processId) {
+        stopped.push(processId);
+        tracked.splice(tracked.findIndex((entry) => entry.processId === processId), 1);
+        return { success: true, processId, status: 'stop-requested' };
+      },
+    },
+  });
+  const state = runtime.disconnect();
+  assert.deepEqual(stopped, [4101, 4102]);
+  assert.equal(state.connected, false);
+  assert.deepEqual(state.activeProxies, []);
+});
+
+test('disconnect reports failure truthfully and retains session when an owned proxy cannot stop', () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const tracked = [{ processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 }];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {},
+    proxyManager: {
+      listTrackedProxies() { return tracked.slice(); },
+      stopProxy() { return { success: false, processId: 4101, status: 'permission-denied' }; },
+    },
+  });
+  const state = runtime.disconnect();
+  assert.equal(state.success, false);
+  assert.equal(state.connected, true);
+  assert.deepEqual(state.activeProxies.map((entry) => entry.processId), [4101]);
+});
+
 test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
  const opened = [];
  const runtime = new AppRuntime({