Relay security integration

src/application.ts

@@ -2,6 +2,7 @@ import crypto from 'crypto'
 import os from 'os'
 import path from 'path'
 import process from 'process'
+import axios from 'axios'
 import Redis from 'ioredis'
 import pg from 'pg'
 import { BootMixin } from '@loopback/boot'
@@ -71,6 +72,8 @@ export class PocketGatewayApplication extends BootMixin(ServiceMixin(RepositoryM
       ALTRUIST_ONLY_CHAINS,
       REDIS_LOCAL_TTL_FACTOR,
       RATE_LIMITER_URL,
+      RELAY_SECURITY_URL,
+      RELAY_SECURITY_HEALTHCHECK_PATH,
       RATE_LIMITER_TOKEN,
       GATEWAY_HOST,
     }: // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -90,6 +93,8 @@ export class PocketGatewayApplication extends BootMixin(ServiceMixin(RepositoryM
     const altruistOnlyChains: string[] = (ALTRUIST_ONLY_CHAINS || '').replace(' ', '').split(',')
     const ttlFactor = parseFloat(REDIS_LOCAL_TTL_FACTOR) || 1
     const rateLimiterURL: string = RATE_LIMITER_URL || ''
+    const relaySecurityURL: string = RELAY_SECURITY_URL || ''
+    const relaySecurityHealthCheckPath = RELAY_SECURITY_HEALTHCHECK_PATH || ''
     const rateLimiterToken: string = RATE_LIMITER_TOKEN || ''
     const gatewayHost: string = GATEWAY_HOST || 'localhost'
 
@@ -194,6 +199,20 @@ export class PocketGatewayApplication extends BootMixin(ServiceMixin(RepositoryM
     }
     this.bind('influxWriteAPIs').to(influxWriteAPIs)
 
+    // HealthCheck relay security, first set to undefined until health check pass to avoid errors
+    this.bind('relaySecurityURL').to(undefined)
+    if (relaySecurityURL) {
+      try {
+        await axios({
+          method: 'GET',
+          url: `${relaySecurityURL}${relaySecurityHealthCheckPath}`,
+        })
+        this.bind('relaySecurityURL').to(relaySecurityURL)
+      } catch (error) {
+        logger.log('warn', 'Error on relay security health check: ' + error)
+      }
+    }
+
     // Create a UID for this process
     const parts = [os.hostname(), process.pid, +new Date()]
     const hash = crypto.createHash('md5').update(parts.join(''))

src/controllers/v1.controller.ts

@@ -70,6 +70,7 @@ export class V1Controller {
     @inject('altruistOnlyChains') private altruistOnlyChains: string[],
     @inject('dispatchURL') private dispatchURL: string,
     @inject('rateLimiterURL') private rateLimiterURL: string,
+    @inject('relaySecurityURL') private relaySecurityURL: string,
     @inject('rateLimiterToken') private rateLimiterToken: string,
     @inject('gatewayHost') private gatewayHost: string,
     @repository(ApplicationsRepository)
@@ -116,6 +117,7 @@ export class V1Controller {
       alwaysRedirectToAltruists: this.alwaysRedirectToAltruists,
       altruistOnlyChains: this.altruistOnlyChains,
       dispatchers: this.dispatchURL,
+      relaySecurityURL: this.relaySecurityURL,
       request: this.request,
     })
   }

src/observers/environment.observer.ts

@@ -47,6 +47,8 @@ export class EnvironmentObserver implements LifeCycleObserver {
     'ALTRUIST_ONLY_CHAINS',
     'REDIS_LOCAL_TTL_FACTOR',
     'RATE_LIMITER_URL',
+    'RELAY_SECURITY_URL',
+    'RELAY_SECURITY_HEALTHCHECK_PATH',
     'RATE_LIMITER_TOKEN',
   ]
 

src/services/pocket-relayer.ts

@@ -26,6 +26,7 @@ import { enforceEVMRestrictions } from '../utils/evm/restrictions'
 import { getApplicationPublicKey } from '../utils/helpers'
 import { parseJSONRPCError, parseMethod, parseRawData, parseRPCID } from '../utils/parsing'
 import { filterCheckedNodes, isCheckPromiseResolved, loadBlockchain } from '../utils/relayer'
+import { sendRelayForVerification } from '../utils/security/security'
 import { CheckResult, RelayResponse, SendRelayOptions } from '../utils/types'
 import { Cache } from './cache'
 import { NodeSticker } from './node-sticker'
@@ -55,6 +56,7 @@ export class PocketRelayer {
   alwaysRedirectToAltruists: boolean
   altruistOnlyChains: string[]
   dispatchers: string
+  relaySecurityURL: string
   requestURL: string
 
   constructor({
@@ -79,6 +81,7 @@ export class PocketRelayer {
     alwaysRedirectToAltruists = false,
     altruistOnlyChains = [],
     dispatchers,
+    relaySecurityURL,
     request,
   }: {
     host: string
@@ -102,6 +105,7 @@ export class PocketRelayer {
     alwaysRedirectToAltruists?: boolean
     altruistOnlyChains?: string[]
     dispatchers?: string
+    relaySecurityURL?: string
     request?: Request
   }) {
     this.host = host
@@ -125,6 +129,7 @@ export class PocketRelayer {
     this.alwaysRedirectToAltruists = alwaysRedirectToAltruists
     this.altruistOnlyChains = altruistOnlyChains
     this.dispatchers = dispatchers
+    this.relaySecurityURL = relaySecurityURL
     this.requestURL = `${request?.headers?.host}${request?.url}`
   }
 
@@ -333,6 +338,31 @@ export class PocketRelayer {
                   serviceNode: relay.serviceNode.publicKey,
                 })
               })
+            // Send relay for security check
+            if (this.relaySecurityURL) {
+              sendRelayForVerification(
+                this.relaySecurityURL,
+                {
+                  applicationID,
+                  blockchainID,
+                  applicationPublicKey,
+                  sessionKey: this.session.key,
+                  nodePublicKey: relay.serviceNode.publicKey,
+                  request: rawData.toString(),
+                  response: relay.response,
+                  altruist: blockchainAltruist + blockchainPath,
+                  blockHeightRequest: blockchainSyncCheck.body,
+                  syncCheckThreshold: blockchainSyncCheck?.allowance,
+                },
+                this.cache
+              ).catch(function (error) {
+                logger.log('warn', 'error sending relay for verification: ' + error, {
+                  requestID,
+                  typeID: application.id,
+                  serviceNode: relay.serviceNode.publicKey,
+                })
+              })
+            }
 
             // Clear error log
             // TODO: Implement servicerPubKey and uncomment
@@ -680,7 +710,6 @@ export class PocketRelayer {
     let nodes: Node[] = session.nodes
 
     this.session = session
-    // sessionKey = "blockchain and a hash of the all the nodes in this session, sorted by public key"
     const { key } = session
 
     this.session = session

src/utils/security/security.ts

@@ -0,0 +1,63 @@
+import axios from 'axios'
+import { Cache } from '../../services/cache'
+import { parseMethod, parseRawData } from '../parsing'
+
+const routes = {
+  getMethods: '/relay/methods',
+  verifyRelay: '/relay/verify',
+}
+const methodsKey = 'relay-security-methods'
+
+export type RelayCheck = {
+  applicationID: string
+  blockchainID: string
+  applicationPublicKey: string
+  sessionKey: string
+  nodePublicKey: string
+  request: string
+  response: string
+  altruist: string
+  blockHeightRequest: string
+  syncCheckThreshold: number
+}
+
+export async function sendRelayForVerification(relaySecurityURL: string, check: RelayCheck, cache: Cache) {
+  const methodsToVerify = await getMethodsToVerify(relaySecurityURL, cache)
+  const relayMethods = parseMethod(parseRawData(check.request)).split(',')
+
+  let send = false
+  for (const method of relayMethods) {
+    if (methodsToVerify.includes(method)) {
+      send = true
+      break
+    }
+  }
+
+  if (!send) {
+    return
+  }
+
+  axios({
+    method: 'POST',
+    url: `${relaySecurityURL}${routes.verifyRelay}`,
+    data: check,
+  }).catch(function (err) {
+    throw err
+  })
+}
+
+async function getMethodsToVerify(url: string, cache: Cache): Promise<string[]> {
+  const cachedMethods = await cache.get(methodsKey)
+
+  if (cachedMethods) {
+    return JSON.parse(cachedMethods)
+  }
+
+  const { data } = await axios({
+    method: 'GET',
+    url: `${url}${routes.getMethods}`,
+  })
+
+  await cache.set(methodsKey, JSON.stringify(data), 'EX', 600)
+  return data
+}

tests/acceptance/test-helper.ts

@@ -33,6 +33,7 @@ export const DUMMY_ENV = {
   AWS_REGION: 'test',
   BLOCKED_ADDRESSES_URL: 'https://blocked.addresses',
   RATE_LIMITER_URL: 'https://rate.limiter',
+  RELAY_SECURITY_URL: '',
   RATE_LIMITER_TOKEN: 'rate-limiter-token',
   ALTRUIST_ONLY_CHAINS: '',
   GATEWAY_HOST: 'localhost',