Skip to content

Commit 586dfe9

Browse files
MartiiMartii
authored
Rework cert detection a bit (OpenUserJS#1532)
* This is a WIP... so there might be an error thrown when running on actual pro *(hopefully not)*... working on it now, so possible downtime expectation perhaps. Works on local pro so far. * Check for backup alternate keys * Ensure keys are in UTF-8 Auto-merge
1 parent 1f29b34 commit 586dfe9

File tree

3 files changed

+109
-64
lines changed

3 files changed

+109
-64
lines changed

‎app.js

Lines changed: 16 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,5 @@
11
'use strict';
22

3-
// Define some pseudo module globals
4-
var isPro = require('./libs/debug').isPro;
5-
var isDev = require('./libs/debug').isDev;
6-
var isDbg = require('./libs/debug').isDbg;
7-
83
// Stamp a message for stdout...
94
console.log('Starting application...');
105

@@ -13,6 +8,16 @@ if (isPro) {
138
console.warn('Starting application...');
149
}
1510

11+
// Define some pseudo module globals
12+
var isPro = require('./libs/debug').isPro;
13+
var isDev = require('./libs/debug').isDev;
14+
var isDbg = require('./libs/debug').isDbg;
15+
16+
var isSecured = require('./libs/debug').isSecured;
17+
var privkey = require('./libs/debug').privkey;
18+
var fullchain = require('./libs/debug').fullchain;
19+
var chain = require('./libs/debug').chain;
20+
1621
//
1722
var path = require('path');
1823
var crypto = require('crypto');
@@ -80,10 +85,6 @@ var https = require('https');
8085
var sslOptions = null;
8186
var server = http.createServer(app);
8287
var secureServer = null;
83-
var privkey = './keys/private.key';
84-
var fullchain = './keys/cert.crt';
85-
var chain = './keys/intermediate.crt';
86-
var secured = null;
8788

8889
app.set('port', process.env.PORT || 8080);
8990
app.set('securePort', process.env.SECURE_PORT || null);
@@ -268,20 +269,11 @@ app.use(function (aReq, aRes, aNext) {
268269
});
269270

270271
// Force HTTPS
271-
secured = true;
272-
try {
273-
fs.accessSync(privkey, fs.constants.F_OK);
274-
fs.accessSync(fullchain, fs.constants.F_OK);
275-
fs.accessSync(chain, fs.constants.F_OK);
276-
} catch (aE) {
277-
secured = false;
278-
}
279-
280-
if (app.get('securePort') && secured) {
272+
if (app.get('securePort') && isSecured) {
281273
sslOptions = {
282-
key: fs.readFileSync(privkey),
283-
cert: fs.readFileSync(fullchain),
284-
ca: fs.readFileSync(chain),
274+
key: fs.readFileSync(privkey, 'utf8'),
275+
cert: fs.readFileSync(fullchain, 'utf8'),
276+
ca: fs.readFileSync(chain, 'utf8'),
285277
ciphers: [
286278
'ECDHE-RSA-AES128-GCM-SHA256',
287279
'ECDHE-ECDSA-AES128-GCM-SHA256',
@@ -359,7 +351,7 @@ app.use(session({
359351
unset: 'destroy',
360352
cookie: {
361353
maxAge: 5 * 60 * 1000, // minutes in ms NOTE: Expanded after successful auth
362-
secure: (isPro && secured ? true : false),
354+
secure: (isPro && isSecured ? true : false),
363355
sameSite: 'lax' // NOTE: Current auth necessity
364356
},
365357
rolling: true,
@@ -508,7 +500,7 @@ function pingCert() {
508500
});
509501
};
510502

511-
if (secured) {
503+
if (isSecured) {
512504
pingCertTimer = setInterval(pingCert, 60 * 60 * 1000); // NOTE: Check every hour
513505
}
514506

‎controllers/scriptStorage.js

Lines changed: 46 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
var isPro = require('../libs/debug').isPro;
55
var isDev = require('../libs/debug').isDev;
66
var isDbg = require('../libs/debug').isDbg;
7+
var isSecured = require('../libs/debug').isSecured;
78
var statusError = require('../libs/debug').statusError;
89

910
//
@@ -249,54 +250,59 @@ var sourceMinBruteforce = new ExpressBrute(store, {
249250
});
250251

251252
var githubHookAddresses = [];
252-
request({
253-
url: 'https://api.github.com/meta',
254-
headers: {
255-
'User-Agent': 'OpenUserJS'
256-
}
257-
}, function (aErr, aRes, aBody) {
258-
var meta = null;
259253

260-
if (aErr
261-
|| aRes.statusCode !== 200
262-
|| !/^application\/json;/.test(aRes.headers['content-type'])) {
254+
if (isSecured) {
255+
request({
256+
url: 'https://api.github.com/meta',
257+
headers: {
258+
'User-Agent': 'OpenUserJS'
259+
}
260+
}, function (aErr, aRes, aBody) {
261+
var meta = null;
263262

264-
console.error([
265-
colors.red('Error retrieving GitHub `hooks`'),
266-
aRes.statusCode,
267-
aRes.headers['content-type'],
268-
aErr
269-
].join('\n'));
270-
return;
271-
}
263+
if (aErr
264+
|| aRes.statusCode !== 200
265+
|| !/^application\/json;/.test(aRes.headers['content-type'])) {
272266

273-
try {
274-
meta = JSON.parse(aBody);
275-
} catch (aE) {
276-
console.error(colors.red('Error retrieving GitHub `hooks`', aE));
277-
return;
278-
}
267+
console.error([
268+
colors.red('Error retrieving GitHub `hooks`'),
269+
aRes.statusCode,
270+
aRes.headers['content-type'],
271+
aErr
272+
].join('\n'));
273+
return;
274+
}
275+
276+
try {
277+
meta = JSON.parse(aBody);
278+
} catch (aE) {
279+
console.error(colors.red('Error retrieving GitHub `hooks`', aE));
280+
return;
281+
}
279282

280-
if (meta && meta.hooks && Array.isArray(meta.hooks)) {
281-
meta.hooks.forEach(function (aEl, aIdx, aArr) {
282-
if (typeof aEl === 'string' && /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}$/.test(aEl)) {
283-
githubHookAddresses.push(aEl);
283+
if (meta && meta.hooks && Array.isArray(meta.hooks)) {
284+
meta.hooks.forEach(function (aEl, aIdx, aArr) {
285+
if (typeof aEl === 'string' && /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}$/.test(aEl)) {
286+
githubHookAddresses.push(aEl);
287+
} else {
288+
console.warn(
289+
colors.yellow('GitHub `hooks` element', aEl, 'does not match IPv4 CIDR specification')
290+
);
291+
}
292+
});
293+
if (githubHookAddresses.length > 0) {
294+
console.log(colors.green('Using GitHub `hooks` of'), githubHookAddresses);
284295
} else {
285-
console.warn(
286-
colors.yellow('GitHub `hooks` element', aEl, 'does not match IPv4 CIDR specification')
287-
);
296+
console.error(colors.red('Error retrieving GitHub `hooks`... no compatible elements found'));
288297
}
289-
});
290-
if (githubHookAddresses.length > 0) {
291-
console.log(colors.green('Using GitHub `hooks` of'), githubHookAddresses);
298+
292299
} else {
293-
console.error(colors.red('Error retrieving GitHub `hooks`... no compatible elements found'));
300+
console.error(colors.red('Error retrieving GitHub `hooks`'));
294301
}
295-
296-
} else {
297-
console.error(colors.red('Error retrieving GitHub `hooks`'));
298-
}
299-
});
302+
});
303+
} else {
304+
console.warn(colors.yellow('Disabling GitHub `hooks` in unsecure mode'));
305+
}
300306

301307
//
302308
function getInstallNameBase(aReq, aOptions) {

‎libs/debug.js

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,56 @@
11
'use strict';
22

3+
var fs = require('fs');
4+
35
var isPro = process.env.NODE_ENV === 'production';
46
var isDev = !isPro;
57
var isDbg = typeof v8debug === 'object';
68

9+
var isSecure = null;
10+
var privkey = null;
11+
var fullchain = null;
12+
var chain = null;
13+
14+
try {
15+
// Check for primary keys
16+
privkey = './keys/private.key';
17+
fullchain = './keys/cert.crt';
18+
chain = './keys/intermediate.crt';
19+
20+
fs.accessSync(privkey, fs.constants.F_OK);
21+
fs.accessSync(fullchain, fs.constants.F_OK);
22+
fs.accessSync(chain, fs.constants.F_OK);
23+
24+
exports.privkey = privkey;
25+
exports.fullchain = fullchain;
26+
exports.chain = chain;
27+
exports.isSecured = true;
28+
29+
} catch (aE) {
30+
// Check for backup alternate keys
31+
try {
32+
privkey = './keys/priv.pem';
33+
fullchain = './keys/fullchain.pem';
34+
chain = './keys/chain.pem';
35+
36+
fs.accessSync(privkey, fs.constants.F_OK);
37+
fs.accessSync(fullchain, fs.constants.F_OK);
38+
fs.accessSync(chain, fs.constants.F_OK);
39+
40+
exports.privkey = privkey;
41+
exports.fullchain = fullchain;
42+
exports.chain = chain;
43+
exports.isSecured = true;
44+
45+
} catch (aE) {
46+
// Ensure that all items are nulled or equivalent
47+
exports.privkey = null;
48+
exports.fullchain = null;
49+
exports.chain = null;
50+
exports.isSecured = false;
51+
}
52+
}
53+
754
exports.isPro = isPro;
855
exports.isDev = isDev;
956
exports.isDbg = isDbg;

0 commit comments

Comments
 (0)