Stop requesting GSS credential delegation (TGT NOT FORWARDABLE storm)

lib/js-gssapi/.gitignore

@@ -0,0 +1,3 @@
+node_modules
+build
+package-lock.json

lib/js-gssapi/CMakeLists.txt

@@ -0,0 +1,52 @@
+cmake_minimum_required(VERSION 3.9)
+cmake_policy(SET CMP0042 NEW)
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
+set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
+
+project (node-gssapi)
+
+set(KRB5_DIR
+    "$ENV{KRB5_DIR}"
+    CACHE
+    PATH
+    "Root of MIT Kerberos source tree (optional).")
+mark_as_advanced(KRB5_DIR)
+
+if(CMAKE_SIZEOF_VOID_P EQUAL 8)
+  set (bit_suffix 64)
+else()
+  set (bit_suffix 32)
+endif()
+
+find_path(KRB5_INCLUDE_DIR krb5.h PATHS ${KRB5_DIR}/include)
+mark_as_advanced(KRB5_INCLUDE_DIR)
+find_library(KRB5_KRB5_LIB NAMES krb5 "krb5_${bit_suffix}" PATHS ${KRB5_DIR}/lib ${KRB5_DIR}/lib/amd64 ${KRB5_DIR}/lib/i386})
+find_library(KRB5_COM_ERR_LIB NAMES com_err "comerr${bit_suffix}" PATHS ${KRB5_DIR}/lib ${KRB5_DIR}/lib/amd64 ${KRB5_DIR}/lib/i386})
+find_library(KRB5_GSSAPI_LIB NAMES gssapi_krb5 "gssapi${bit_suffix}" PATHS ${KRB5_DIR}/lib ${KRB5_DIR}/lib/amd64 ${KRB5_DIR}/lib/i386})
+
+set(KRB5_LIBRARIES
+    ${KRB5_KRB5_LIB}
+    ${KRB5_COM_ERR_LIB}
+    ${KRB5_GSSAPI_LIB}
+    )
+mark_as_advanced(KRB5_LIBRARIES)
+
+if (NOT KRB5_KRB5_LIB OR NOT KRB5_COM_ERR_LIB OR NOT KRB5_GSSAPI_LIB)
+message(FATAL_ERROR "Could not find all Kerberos libraries. Perhaps you need to set KRB5_DIR in your environment")
+endif()
+
+execute_process(COMMAND node -p "require('node-addon-api').include"
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+    OUTPUT_VARIABLE NODE_ADDON_API_DIR
+    )
+string(REPLACE "\n" "" NODE_ADDON_API_DIR ${NODE_ADDON_API_DIR})
+string(REPLACE "\"" "" NODE_ADDON_API_DIR ${NODE_ADDON_API_DIR})
+
+
+add_library(node-gssapi SHARED src/bind.cc src/module.cc ${CMAKE_JS_SRC})
+target_include_directories(node-gssapi PRIVATE  ${CMAKE_JS_INC} ${NODE_ADDON_API_DIR} ${KRB5_INCLUDE_DIR})
+target_link_libraries(node-gssapi PRIVATE ${CMAKE_JS_LIB} ${KRB5_LIBRARIES})
+set_target_properties(node-gssapi PROPERTIES PREFIX "" SUFFIX ".node")
+target_compile_definitions(node-gssapi PUBLIC -DNAPI_VERSION=5)

lib/js-gssapi/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2019 jalfd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

lib/js-gssapi/README.md

@@ -0,0 +1,38 @@
+# @amrc-factoryplus/gssapi
+
+GSSAPI bindings for Node.js.
+
+This is a fork of [gssapi.js](https://www.npmjs.com/package/gssapi.js)
+2.0.1 (upstream: `bitbucket:karoshealth/node-gssapi`, MIT licence).
+
+The JS API is identical to upstream. There is one behavioural change:
+
+## No credential delegation
+
+Upstream passes `GSS_C_DELEG_FLAG` unconditionally to
+`gss_init_sec_context`. That makes libkrb5 request a forwarded TGT
+from the KDC on *every* client context creation, i.e. on every
+Factory+ HTTP token fetch and MQTT connection. When the client's TGT
+is not forwardable (the normal case for ACS service principals, whose
+TGTs come straight from a keytab) the KDC refuses the request:
+
+    TGS_REQ ... TGT NOT FORWARDABLE: authtime ...,
+        sv1xxx@REALM for krbtgt/REALM@REALM,
+        KDC can't fulfill requested option
+
+libkrb5 then silently drops the flag and carries on without
+delegation, so the only effects are a wasted KDC round trip per token
+and a KDC log line per request. Under load (service reconnect storms)
+this multiplies into significant KDC noise and traffic.
+
+Nothing in Factory+ consumes delegated credentials - the server side
+(`acceptSecContext`) discards them - so this fork simply does not
+request delegation. If a future service genuinely needs delegation it
+should be added as an explicit per-context option, not a global
+default.
+
+## Building
+
+Native module built with cmake-js at install time; requires cmake and
+MIT Kerberos headers/libraries (`libkrb5-dev` on Debian). Unchanged
+from upstream.

lib/js-gssapi/dist/index.d.ts

@@ -0,0 +1,23 @@
+/// <reference types="node" />
+export interface ClientContextOptions {
+    krbCcache?: string;
+    server: string;
+    mech?: "krb5" | "spnego";
+}
+export interface GssSecContext {
+    isComplete(): boolean;
+}
+export interface ServerGssSecContext extends GssSecContext {
+    clientName(): string;
+}
+export declare function createClientContext(options: ClientContextOptions): GssSecContext;
+export declare function createServerContext(): ServerGssSecContext;
+export declare function initSecContext(ctx: GssSecContext, token?: Buffer): Promise<Buffer>;
+export declare function acceptSecContext(ctx: ServerGssSecContext, token: Buffer): Promise<Buffer>;
+export declare function setKeytabPath(path: string): undefined;
+export declare function verifyCredentials(username: string, password: string, options?: {
+    keytab?: string;
+    serverPrincipal?: string;
+}): Promise<void>;
+export declare function kinit(ccname: string, username: string, password: string): Promise<string>;
+export declare function kdestroy(ccname: string): Promise<undefined>;

lib/js-gssapi/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@amrc-factoryplus/gssapi",
+  "version": "2.1.0",
+  "description": "GSSAPI bindings for Node.js. AMRC fork of gssapi.js without credential delegation.",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist/index.js",
+    "dist/index.d.ts",
+    "CMakeLists.txt",
+    "src/*"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "github:AMRC-FactoryPlus/amrc-connectivity-stack",
+    "directory": "lib/js-gssapi"
+  },
+  "scripts": {
+    "install": "cmake-js compile"
+  },
+  "author": "Jesper Alf Dam <jdam@vitalimages.com>",
+  "contributors": [
+    "AMRC <factoryplus@amrc.co.uk>"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "bindings": "^1.5.0",
+    "cmake-js": "^6.1.0",
+    "node-addon-api": "^1.7.2"
+  }
+}

lib/js-gssapi/src/.clang-format

@@ -0,0 +1,115 @@
+---
+Language: Cpp
+# BasedOnStyle:
+AccessModifierOffset: -4
+AlignAfterOpenBracket: Align
+AlignConsecutiveAssignments: false
+AlignConsecutiveDeclarations: false
+AlignEscapedNewlines: Right
+AlignOperands: true
+AlignTrailingComments: false
+AllowAllParametersOfDeclarationOnNextLine: false
+AllowShortBlocksOnASingleLine: false
+AllowShortCaseLabelsOnASingleLine: false
+AllowShortFunctionsOnASingleLine: InlineOnly
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+AlwaysBreakAfterReturnType: None
+AlwaysBreakBeforeMultilineStrings: false
+AlwaysBreakTemplateDeclarations: Yes
+BinPackArguments: false
+BinPackParameters: false
+BreakBeforeBraces: Custom
+BraceWrapping:
+  AfterClass: true
+  AfterControlStatement: false
+  AfterEnum: false
+  AfterFunction: true
+  AfterNamespace: false
+#  AfterObjCDeclaration: true
+  AfterStruct: true
+  AfterUnion: true
+  AfterExternBlock: false
+  BeforeCatch: false
+  BeforeElse: false
+  IndentBraces: false
+  SplitEmptyFunction: false
+  SplitEmptyRecord: false
+  SplitEmptyNamespace: false
+# BreakAfterJavaFieldAnnotations:
+BreakBeforeBinaryOperators: None
+BreakBeforeTernaryOperators: true
+BreakConstructorInitializers: BeforeColon
+BreakInheritanceList: AfterColon
+BreakStringLiterals: true
+ColumnLimit: 100
+CommentPragmas: '^// emacs: '
+CompactNamespaces: false
+ConstructorInitializerAllOnOneLineOrOnePerLine: true
+ConstructorInitializerIndentWidth: 4
+ContinuationIndentWidth: 4
+Cpp11BracedListStyle: true
+DerivePointerAlignment: false
+DisableFormat: false
+# ExperimentalAutoDetectBinPacking:
+FixNamespaceComments: true
+# ForEachMacros:
+IncludeBlocks: Merge
+IncludeCategories:
+  - Regex: '^<(asm|camutility|charls|cluster-backbone|docview|evbase|evclientbase|evdbus|evlogin|evncserver2|ftgl|fus3d|general2d|general3d|libwfm|mcop|micppunit|mistral|mitest|openglutils|pasviewer|qtutility|report|ris|session-manager|sickle|sparrow|sturgeon|third-party|catch|trompeloeil|tinymath|trident|vdbclient|vdbserver|virtualxray3d|wfm|wlmscp|yargnits)/'
+    Priority: 4
+  - Regex: '^<boost/'
+    Priority: 2
+  - Regex: '^<Q.+>'
+    Priority: 3
+  - Regex: '<[[:alnum:]]+>'
+    Priority: 1
+  - Regex: '^".+'
+    Priority: 5
+IncludeIsMainRegex: '(_unix|_linux|_windows)?$'
+IndentCaseLabels: false
+IndentPPDirectives: None
+IndentWidth: 4
+IndentWrappedFunctionNames: false
+JavaScriptQuotes: Leave
+JavaScriptWrapImports: true
+KeepEmptyLinesAtTheStartOfBlocks: false
+# MacroBlockBegin:
+# MacroBlockEnd:
+MaxEmptyLinesToKeep: 1
+NamespaceIndentation: All
+# ObjCBinPackProtocolList: Auto
+# ObjCBlockIndentWidth: 4
+# ObjCSpaceAfterProperty: false
+# ObjCSpaceBeforeProtocolList: false
+# PenaltyBreakAssignment
+# PenaltyBreakBeforeFirstCallParameter
+# PenaltyBreakComment
+# PenaltyBreakFirstLessLess
+# PenaltyBreakString
+# PenaltyBreakTemplateDeclaration
+# PenaltyExcessCharacter
+# PenaltyReturnTypeOnItsOwnLine
+PointerAlignment: Right
+# RawStringFormats:
+ReflowComments: true
+SortIncludes: true
+SortUsingDeclarations: true
+SpaceAfterCStyleCast: false
+SpaceAfterTemplateKeyword: false
+SpaceBeforeAssignmentOperators: true
+SpaceBeforeCpp11BracedList: false
+SpaceBeforeCtorInitializerColon: true
+SpaceBeforeInheritanceColon: true
+SpaceBeforeParens: ControlStatements
+SpaceBeforeRangeBasedForLoopColon: true
+SpaceInEmptyParentheses: false
+SpacesBeforeTrailingComments: 1
+SpacesInAngles: false
+SpacesInCStyleCastParentheses: false
+SpacesInContainerLiterals: true
+SpacesInParentheses: false
+SpacesInSquareBrackets: false
+Standard: Cpp11
+TabWidth: 4
+UseTab: Never