Moved to GreenLock v3
Ylian Saint-Hilaire committed
Nov 13, 2019 at 22:47 UTC
1ff68e3ca2cd0ce505953817ff12c75a1cafdb46
4 files changed
+173
-89
letsEncrypt.js
+128
-68
@@ -12,58 +12,90 @@
12
/*jshint node: true */
13
/*jshint strict: false */
14
/*jshint esversion: 6 */
15
-"use strict";
15
+'use strict';
16
17
-module.exports.CreateLetsEncrypt = function (parent) {
17
+module.exports.CreateLetsEncrypt = function(parent) {
18
try {
19
+ parent.debug('cert', "Initializing Let's Encrypt support");
20
+
21
+ // Check the current node version
22
+ if (Number(process.version.match(/^v(\d+\.\d+)/)[1]) < 8) { return null; }
23
+
24
// Try to delete the "./ursa-optional" or "./node_modules/ursa-optional" folder if present.
25
// This is an optional module that GreenLock uses that causes issues.
26
try {
27
const fs = require('fs');
23
- if (fs.existsSync(obj.path.join(__dirname, 'ursa-optional'))) { fs.unlinkSync(obj.path.join(__dirname, 'ursa-optional')); }
24
- if (fs.existsSync(obj.path.join(__dirname, 'node_modules', 'ursa-optional'))) { fs.unlinkSync(obj.path.join(__dirname, 'node_modules', 'ursa-optional')); }
28
+ if (fs.existsSync(parent.path.join(__dirname, 'ursa-optional'))) { fs.unlinkSync(obj.path.join(__dirname, 'ursa-optional')); }
29
+ if (fs.existsSync(parent.path.join(__dirname, 'node_modules', 'ursa-optional'))) { fs.unlinkSync(obj.path.join(__dirname, 'node_modules', 'ursa-optional')); }
30
} catch (ex) { }
31
32
// Get GreenLock setup and running.
33
const greenlock = require('greenlock');
34
var obj = {};
35
obj.parent = parent;
36
+ obj.path = require('path');
37
obj.redirWebServerHooked = false;
38
obj.leDomains = null;
39
obj.leResults = null;
40
+ obj.performRestart = false;
41
42
// Setup the certificate storage paths
36
- obj.configPath = obj.parent.path.join(obj.parent.datapath, 'letsencrypt');
37
- obj.webrootPath = obj.parent.path.join(obj.parent.datapath, 'letsencrypt', 'webroot');
43
+ obj.configPath = obj.path.join(obj.parent.datapath, 'letsencrypt');
44
try { obj.parent.fs.mkdirSync(obj.configPath); } catch (e) { }
39
- try { obj.parent.fs.mkdirSync(obj.webrootPath); } catch (e) { }
40
-
41
- // Storage Backend, store data in the "meshcentral-data/letencrypt" folder.
42
- var leStore = require('le-store-certbot').create({ configDir: obj.configPath, webrootPath: obj.webrootPath, debug: obj.parent.args.debug > 0 });
45
44
- // ACME Challenge Handlers
45
- var leHttpChallenge = require('le-challenge-fs').create({ webrootPath: obj.webrootPath, debug: obj.parent.args.debug > 0 });
46
-
47
- // Function to agree to terms of service
48
- function leAgree(opts, agreeCb) { agreeCb(null, opts.tosUrl); }
46
+ // Setup Let's Encrypt default configuration
47
+ obj.leDefaults = {
48
+ agreeToTerms: true,
49
+ //serverKeyType: 'RSA-2048', // Seems like only "RSA-2048" or "P-256" is supported.
50
+ store: {
51
+ module: 'greenlock-store-fs',
52
+ basePath: obj.configPath
53
+ }
54
+ };
55
56
+ // Get package and maintainer email
57
+ const pkg = require('./package.json');
58
+ var maintainerEmail = null;
59
+ if (typeof pkg.author == 'string') {
60
+ // Older NodeJS
61
+ maintainerEmail = pkg.author;
62
+ var i = maintainerEmail.indexOf('<');
63
+ if (i >= 0) { maintainerEmail = maintainerEmail.substring(i + 1); }
64
+ var i = maintainerEmail.indexOf('>');
65
+ if (i >= 0) { maintainerEmail = maintainerEmail.substring(0, i); }
66
+ } else if (typeof pkg.author == 'object') {
67
+ // Latest NodeJS
68
+ maintainerEmail = pkg.author.email;
69
+ }
70
+
71
// Create the main GreenLock code module.
72
var greenlockargs = {
52
- version: 'draft-12',
53
- server: (obj.parent.config.letsencrypt.production === true) ? 'https://acme-v02.api.letsencrypt.org/directory' : 'https://acme-staging-v02.api.letsencrypt.org/directory',
54
- store: leStore,
55
- challenges: { 'http-01': leHttpChallenge },
56
- challengeType: 'http-01',
57
- agreeToTerms: leAgree,
58
- debug: obj.parent.args.debug > 0
73
+ parent: obj,
74
+ packageRoot: __dirname,
75
+ packageAgent: pkg.name + '/' + pkg.version,
76
+ manager: obj.path.join(__dirname, 'letsencrypt.js'),
77
+ maintainerEmail: maintainerEmail,
78
+ notify: function (ev, args) { if (typeof args == 'string') { parent.debug('cert', ev + ': ' + args); } else { parent.debug('cert', ev + ': ' + JSON.stringify(args)); } },
79
+ staging: (obj.parent.config.letsencrypt.production !== true),
80
+ debug: (obj.parent.args.debug > 0)
81
};
82
+
83
if (obj.parent.args.debug == null) { greenlockargs.log = function (debug) { }; } // If not in debug mode, ignore all console output from greenlock (makes things clean).
84
obj.le = greenlock.create(greenlockargs);
85
86
// Hook up GreenLock to the redirection server
64
- if (obj.parent.redirserver.port == 80) { obj.parent.redirserver.app.use('/', obj.le.middleware()); obj.redirWebServerHooked = true; }
87
+ if (obj.parent.redirserver.port == 80) { obj.redirWebServerHooked = true; }
88
+
89
+ // Respond to a challenge
90
+ obj.challenge = function (token, hostname, func) {
91
+ parent.debug('cert', "Challenge " + hostname + "/" + token);
92
+ obj.le.challenges.get({ type: 'http-01', servername: hostname, token: token })
93
+ .then(function (results) { func(results.keyAuthorization); })
94
+ .catch(function (e) { console.log('LE-ERROR', e); func(null); }); // unexpected error, not related to renewal
95
+ }
96
97
obj.getCertificate = function (certs, func) {
98
+ parent.debug('cert', "Getting certs from local store");
99
if (certs.CommonName.indexOf('.') == -1) { console.log("ERROR: Use --cert to setup the default server name before using Let's Encrypt."); func(certs); return; }
100
if (obj.parent.config.letsencrypt == null) { func(certs); return; }
101
if (obj.parent.config.letsencrypt.email == null) { console.log("ERROR: Let's Encrypt email address not specified."); func(certs); return; }
@@ -72,7 +104,7 @@ module.exports.CreateLetsEncrypt = function (parent) {
104
if ((obj.parent.config.letsencrypt.rsakeysize != null) && (obj.parent.config.letsencrypt.rsakeysize !== 2048) && (obj.parent.config.letsencrypt.rsakeysize !== 3072)) { console.log("ERROR: Invalid Let's Encrypt certificate key size, must be 2048 or 3072."); func(certs); return; }
105
106
// Get the list of domains
75
- obj.leDomains = [certs.CommonName];
107
+ obj.leDomains = [ certs.CommonName ];
108
if (obj.parent.config.letsencrypt.names != null) {
109
if (typeof obj.parent.config.letsencrypt.names == 'string') { obj.parent.config.letsencrypt.names = obj.parent.config.letsencrypt.names.split(','); }
110
obj.parent.config.letsencrypt.names.map(function (s) { return s.trim(); }); // Trim each name
@@ -81,67 +113,95 @@ module.exports.CreateLetsEncrypt = function (parent) {
113
obj.leDomains.sort(); // Sort the array so it's always going to be in the same order.
114
}
115
84
- obj.le.check({ domains: obj.leDomains }).then(function (results) {
85
- if (results) {
86
- obj.leResults = results;
116
+ // Get altnames
117
+ obj.altnames = [];
118
+ obj.servername = certs.CommonName;
119
+ for (var i in obj.leDomains) { if (obj.leDomains[i] != certs.CommonName) { obj.altnames.push(obj.leDomains[i]); } }
120
121
+ // Get the Let's Encrypt certificate from our own storage
122
+ obj.le.get({ servername: certs.CommonName })
123
+ .then(function (results) {
124
// If we already have real certificates, use them.
89
- if (results.altnames.indexOf(certs.CommonName) >= 0) {
90
- certs.web.cert = results.cert;
91
- certs.web.key = results.privkey;
92
- certs.web.ca = [results.chain];
93
- }
94
- for (var i in obj.parent.config.domains) {
95
- if ((obj.parent.config.domains[i].dns != null) && (obj.parent.certificateOperations.compareCertificateNames(results.altnames, obj.parent.config.domains[i].dns))) {
96
- certs.dns[i].cert = results.cert;
97
- certs.dns[i].key = results.privkey;
98
- certs.dns[i].ca = [results.chain];
125
+ if (results) {
126
+ if (results.site.altnames.indexOf(certs.CommonName) >= 0) {
127
+ certs.web.cert = results.pems.cert;
128
+ certs.web.key = results.pems.privkey;
129
+ certs.web.ca = [results.pems.chain];
130
+ }
131
+ for (var i in obj.parent.config.domains) {
132
+ if ((obj.parent.config.domains[i].dns != null) && (obj.parent.certificateOperations.compareCertificateNames(results.site.altnames, obj.parent.config.domains[i].dns))) {
133
+ certs.dns[i].cert = results.pems.cert;
134
+ certs.dns[i].key = results.pems.privkey;
135
+ certs.dns[i].ca = [results.pems.chain];
136
+ }
137
}
138
}
139
+ parent.debug('cert', "Got certs from local store");
140
func(certs);
141
142
// Check if the Let's Encrypt certificate needs to be renewed.
143
setTimeout(obj.checkRenewCertificate, 60000); // Check in 1 minute.
144
setInterval(obj.checkRenewCertificate, 86400000); // Check again in 24 hours and every 24 hours.
145
return;
107
- } else {
108
- // Otherwise return default certificates and try to get a real one
146
+ })
147
+ .catch(function (e) {
148
+ parent.debug('cert', "Unable to get certs from local store");
149
+ setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
150
func(certs);
110
- }
111
- console.log("Attempting to get Let's Encrypt certificate, may take a few minutes...");
112
-
113
- // Figure out the RSA key size
114
- var rsaKeySize = (obj.parent.config.letsencrypt.rsakeysize === 2048) ? 2048 : 3072;
115
-
116
- // TODO: Only register on one of the peers if multi-peers are active.
117
- // Register Certificate manually
118
- obj.le.register({
119
- domains: obj.leDomains,
120
- email: obj.parent.config.letsencrypt.email,
121
- agreeTos: true,
122
- rsaKeySize: rsaKeySize,
123
- challengeType: 'http-01',
124
- renewWithin: 45 * 24 * 60 * 60 * 1000, // Certificate renewal may begin at this time (45 days)
125
- renewBy: 60 * 24 * 60 * 60 * 1000 // Certificate renewal should happen by this time (60 days)
126
- }).then(function (xresults) {
127
- obj.parent.performServerCertUpdate(); // Reset the server, TODO: Reset all peers
128
- }, function (err) {
129
- console.error("ERROR: Let's encrypt error: ", err);
151
});
131
- });
132
- };
152
+ }
153
154
// Check if we need to renew the certificate, call this every day.
155
obj.checkRenewCertificate = function () {
136
- if (obj.leResults == null) { return; }
137
- // TODO: Only renew on one of the peers if multi-peers are active.
138
- // Check if we need to renew the certificate
139
- obj.le.renew({ duplicate: false, domains: obj.leDomains, email: obj.parent.config.letsencrypt.email }, obj.leResults).then(function (xresults) {
140
- obj.parent.performServerCertUpdate(); // Reset the server, TODO: Reset all peers
141
- }, function (err) { }); // If we can't renew, ignore.
142
- };
156
+ parent.debug('cert', "Checking certs");
157
+
158
+ // Setup renew options
159
+ var renewOptions = { servername: obj.servername };
160
+ if (obj.altnames.length > 0) { renewOptions.altnames = obj.altnames; }
161
+ obj.le.renew(renewOptions)
162
+ .then(function (results) {
163
+ parent.debug('cert', "Checks completed");
164
+ if (obj.performRestart === true) { parent.debug('cert', "Certs changed, restarting..."); obj.parent.performServerCertUpdate(); } // Reset the server, TODO: Reset all peers
165
+ })
166
+ .catch(function (e) { console.log(e); func(certs); });
167
+ }
168
169
return obj;
170
} catch (ex) { console.log(ex); } // Unable to start Let's Encrypt
171
return null;
172
+};
173
+
174
+// GreenLock v3 Manager
175
+module.exports.create = function (options) {
176
+ var manager = { parent: options.parent };
177
+ manager.find = async function (options) {
178
+ //console.log('LE-FIND', options);
179
+ return Promise.resolve([ { subject: options.servername, altnames: options.altnames } ]);
180
+ };
181
+
182
+ manager.set = function (options) {
183
+ manager.parent.parent.debug('cert', "Certificate has been set");
184
+ manager.parent.performRestart = true;
185
+ return null;
186
+ };
187
+
188
+ manager.remove = function (options) {
189
+ manager.parent.parent.debug('cert', "Certificate has been removed");
190
+ manager.parent.performRestart = true;
191
+ return null;
192
+ };
193
+
194
+ // set the global config
195
+ manager.defaults = async function (options) {
196
+ //console.log('LE-DEFAULTS', options);
197
+ if (options != null) { for (var i in options) { if (manager.parent.leDefaults[i] == null) { manager.parent.leDefaults[i] = options[i]; } } }
198
+ var r = manager.parent.leDefaults;
199
+ var mainsite = { subject: manager.parent.servername };
200
+ if (manager.parent.altnames.length > 0) { mainsite.altnames = manager.parent.altnames; }
201
+ r.subscriberEmail = manager.parent.parent.config.letsencrypt.email;
202
+ r.sites = { mainsite: mainsite };
203
+ return r;
204
+ };
205
+
206
+ return manager;
207
};
\ No newline at end of file
meshcentral.js
+14
-6
@@ -1935,7 +1935,14 @@ function InstallModules(modules, func) {
1935
// Modules may contain a version tag (foobar@1.0.0), remove it so the module can be found using require
1936
var moduleName = modules[i].split("@", 1)[0];
1937
try {
1938
- require(moduleName);
1938
+ if (moduleName == 'greenlock') {
1939
+ // Check if we have GreenLock v3
1940
+ delete require.cache[require.resolve('greenlock')]; // Clear the require cache
1941
+ if (typeof require('greenlock').challengeType == 'string') { missingModules.push(modules[i]); }
1942
+ } else {
1943
+ // For all other modules, do the check here.
1944
+ require(moduleName);
1945
+ }
1946
} catch (e) {
1947
if (previouslyInstalledModules[modules[i]] !== true) { missingModules.push(modules[i]); }
1948
}
@@ -2001,20 +2008,21 @@ function mainStart() {
2008
if (config.domains[i].auth == 'ldap') { ldap = true; }
2009
}
2010
2011
+ // Get the current node version
2012
+ var nodeVersion = Number(process.version.match(/^v(\d+\.\d+)/)[1]);
2013
+
2014
// Build the list of required modules
2015
var modules = ['ws', 'cbor', 'nedb', 'https', 'yauzl', 'xmldom', 'ipcheck', 'express', 'archiver', 'multiparty', 'node-forge', 'express-ws', 'compression', 'body-parser', 'connect-redis', 'cookie-session', 'express-handlebars'];
2016
if (require('os').platform() == 'win32') { modules.push('node-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
2017
if (ldap == true) { modules.push('ldapauth-fork'); }
2008
- if (config.letsencrypt != null) { modules.push('greenlock@2.8.8'); modules.push('le-store-certbot'); modules.push('le-challenge-fs'); modules.push('le-acme-core'); } // Add Greenlock Modules
2018
+ //if (config.letsencrypt != null) { modules.push('greenlock@2.8.8'); modules.push('le-store-certbot'); modules.push('le-challenge-fs'); modules.push('le-acme-core'); } // Add Greenlock Modules
2019
+ if (config.letsencrypt != null) { if (nodeVersion < 8) { console.log("WARNING: Let's Encrypt support requires Node v8 or higher."); } else { modules.push('greenlock'); } } // Add Greenlock Module
2020
if (config.settings.mqtt != null) { modules.push('aedes'); } // Add MQTT Modules
2021
if (config.settings.mongodb != null) { modules.push('mongodb'); } // Add MongoDB, official driver.
2022
if (config.settings.vault != null) { modules.push('node-vault'); } // Add official HashiCorp's Vault module.
2023
else if (config.settings.xmongodb != null) { modules.push('mongojs'); } // Add MongoJS, old driver.
2024
if (config.smtp != null) { modules.push('nodemailer'); } // Add SMTP support
2025
2015
- // Get the current node version
2016
- var nodeVersion = Number(process.version.match(/^v(\d+\.\d+)/)[1]);
2017
-
2026
// If running NodeJS < 8, install "util.promisify"
2027
if (nodeVersion < 8) { modules.push('util.promisify'); }
2028
@@ -2027,7 +2035,7 @@ function mainStart() {
2035
if (yubikey == true) { modules.push('yubikeyotp'); } // Add YubiKey OTP support
2036
if (allsspi == false) { modules.push('otplib'); } // Google Authenticator support
2037
}
2030
-
2038
+
2039
// Install any missing modules and launch the server
2040
InstallModules(modules, function () { meshserver = CreateMeshCentralServer(config, args); meshserver.Start(); });
2041
package.json
+2
-6
@@ -1,10 +1,6 @@
1
{
2
"name": "meshcentral",
3
-<<<<<<< HEAD
4
- "version": "0.4.3-t",
5
-=======
6
- "version": "0.4.3-w",
7
->>>>>>> b8ca6da3db12bf23b94068970eaf63ec22cb391e
3
+ "version": "0.4.3-z",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
@@ -34,7 +30,7 @@
30
"dependencies": {
31
"archiver": "^3.0.0",
32
"body-parser": "^1.19.0",
37
- "cbor": "4.1.5",
33
+ "cbor": "^4.1.5",
34
"compression": "^1.7.4",
35
"connect-redis": "^3.4.1",
36
"cookie-session": "^2.0.0-beta.3",
redirserver.js
+29
-9
@@ -23,11 +23,12 @@ module.exports.CreateRedirServer = function (parent, db, args, func) {
23
obj.db = db;
24
obj.args = args;
25
obj.certificates = null;
26
- obj.express = require("express");
27
- obj.net = require("net");
26
+ obj.express = require('express');
27
+ obj.net = require('net');
28
obj.app = obj.express();
29
obj.tcpServer = null;
30
obj.port = null;
31
+ const leChallengePrefix = '/.well-known/acme-challenge/';
32
33
// Perform an HTTP to HTTPS redirection
34
function performRedirection(req, res) {
@@ -49,14 +50,14 @@ module.exports.CreateRedirServer = function (parent, db, args, func) {
50
*/
51
52
// Renter the terms of service.
52
- obj.app.get("/MeshServerRootCert.cer", function (req, res) {
53
+ obj.app.get('/MeshServerRootCert.cer', function (req, res) {
54
// The redirection server starts before certificates are loaded, make sure to handle the case where no certificate is loaded now.
55
if (obj.certificates != null) {
55
- res.set({ "Cache-Control": "no-cache, no-store, must-revalidate", "Pragma": "no-cache", "Expires": "0", "Content-Type": "application/octet-stream", "Content-Disposition": "attachment; filename=\"" + obj.certificates.RootName + ".cer\"" });
56
+ res.set({ 'Cache-Control': "no-cache, no-store, must-revalidate", "Pragma": "no-cache", "Expires": "0", "Content-Type": "application/octet-stream", "Content-Disposition": "attachment; filename=\"" + obj.certificates.RootName + ".cer\"" });
57
var rootcert = obj.certificates.root.cert;
57
- var i = rootcert.indexOf("-----BEGIN CERTIFICATE-----\r\n");
58
+ var i = rootcert.indexOf('-----BEGIN CERTIFICATE-----\r\n');
59
if (i >= 0) { rootcert = rootcert.substring(i + 29); }
59
- i = rootcert.indexOf("-----END CERTIFICATE-----");
60
+ i = rootcert.indexOf('-----END CERTIFICATE-----');
61
if (i >= 0) { rootcert = rootcert.substring(i, 0); }
62
res.send(Buffer.from(rootcert, "base64"));
63
} else {
@@ -66,9 +67,17 @@ module.exports.CreateRedirServer = function (parent, db, args, func) {
67
68
// Add HTTP security headers to all responses
69
obj.app.use(function (req, res, next) {
69
- res.removeHeader("X-Powered-By");
70
- res.set({ "strict-transport-security": "max-age=60000; includeSubDomains", "Referrer-Policy": "no-referrer", "x-frame-options": "SAMEORIGIN", "X-XSS-Protection": "1; mode=block", "X-Content-Type-Options": "nosniff", "Content-Security-Policy": "default-src http: ws: \"self\" \"unsafe-inline\"" });
71
- return next();
70
+ parent.debug('webrequest', req.url + ' (RedirServer)');
71
+ res.removeHeader('X-Powered-By');
72
+
73
+ if ((parent.letsencrypt != null) && (req.url.startsWith(leChallengePrefix))) {
74
+ // Let's Encrypt Support
75
+ parent.letsencrypt.challenge(req.url.slice(leChallengePrefix.length), getCleanHostname(req), function (response) { if (response == null) { res.sendStatus(404); } else { res.send(response); } });
76
+ } else {
77
+ // Everything else
78
+ res.set({ 'strict-transport-security': "max-age=60000; includeSubDomains", "Referrer-Policy": "no-referrer", "x-frame-options": "SAMEORIGIN", "X-XSS-Protection": "1; mode=block", "X-Content-Type-Options": "nosniff", "Content-Security-Policy": "default-src http: ws: \"self\" \"unsafe-inline\"" });
79
+ return next();
80
+ }
81
});
82
83
// Once the main web server is started, call this to hookup additional handlers
@@ -125,6 +134,17 @@ module.exports.CreateRedirServer = function (parent, db, args, func) {
134
});
135
}
136
137
+ // Get the remote hostname correctly
138
+ const servernameRe = /^[a-z0-9\.\-]+$/i;
139
+ function getHostname(req) { return req.hostname || req.headers['x-forwarded-host'] || (req.headers.host || ''); };
140
+ function getCleanHostname(req) {
141
+ var servername = getHostname(req).toLowerCase().replace(/:.*/, '');
142
+ try { req.hostname = servername; } catch (e) { } // read-only express property
143
+ if (req.headers['x-forwarded-host']) { req.headers['x-forwarded-host'] = servername; }
144
+ try { req.headers.host = servername; } catch (e) { }
145
+ return (servernameRe.test(servername) && -1 === servername.indexOf('..') && servername) || '';
146
+ };
147
+
148
CheckListenPort(args.redirport, StartRedirServer);
149
150
return obj;