Added code to skip the agent code signing certificate if missing and getting certs from database or vault (#4299)
Ylian Saint-Hilaire committed
Jul 21, 2022 at 17:17 UTC
3dd8531ef959343e179d0fa669c32ab9569e50a4
2 files changed
+10
-3
certoperations.js
+4
@@ -855,6 +855,9 @@ module.exports.CertificateOperations = function (parent) {
855
if (obj.fileExists("codesign-cert-public.crt") && obj.fileExists("codesign-cert-private.key")) {
856
r.codesign = { cert: obj.fileLoad("codesign-cert-public.crt", 'utf8'), key: obj.decryptPrivateKey(obj.fileLoad("codesign-cert-private.key", 'utf8')) };
857
if (obj.checkCertificate(r.codesign.cert, r.codesign.key) == false) { delete r.codesign; } else { rcount++; }
858
+ } else {
859
+ // If we are reading certificates from a database or vault and are just missing the code signing cert, skip it.
860
+ if (parent.configurationFiles != null) { rcount++; }
861
}
862
863
// If the swarm server certificate exist, load it (This is an optional certificate)
@@ -969,6 +972,7 @@ module.exports.CertificateOperations = function (parent) {
972
}
973
}
974
975
+ // If we have all the certificates we need, stop here.
976
if (rcount === rcountmax) {
977
if ((certargs == null) && (mpscertargs == null)) { if (func != undefined) { func(r); } return r; } // If no certificate arguments are given, keep the certificate
978
var xcountry, xcountryField = webCertificate.subject.getField('C');
webserver.js
+6
-3
@@ -896,9 +896,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
896
var origin = 'https://' + (domain.dns ? domain.dns : parent.certificates.CommonName);
897
if (httpport != 443) { origin += ':' + httpport; }
898
899
- const sec = parent.decryptSessionData(req.session.e);
899
+ var u2fchallenge = null;
900
+ if ((req.session != null) && (req.session.e != null)) { const sec = parent.decryptSessionData(req.session.e); if (sec != null) { u2fchallenge = sec.u2f; } }
901
var assertionExpectations = {
901
- challenge: sec.u2f,
902
+ challenge: u2fchallenge,
903
origin: origin,
904
factor: 'either',
905
fmt: 'fido-u2f',
@@ -978,6 +979,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
979
// Return a U2F hardware key challenge
980
function getHardwareKeyChallenge(req, domain, user, func) {
981
delete req.session.u2f;
982
+ if (req.session = null) { req.session = {}; }
983
const sec = parent.decryptSessionData(req.session.e);
984
985
if (user.otphkeys && (user.otphkeys.length > 0)) {
@@ -1015,6 +1017,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
1017
if (domain == null) { return; }
1018
if ((domain.loginkey != null) && (domain.loginkey.indexOf(req.query.key) == -1)) { res.sendStatus(404); return; } // Check 3FA URL key
1019
if (req.body == null) { res.sendStatus(404); return; } // Post body is empty or can't be parsed
1020
+ if (req.session == null) { req.session = {}; }
1021
1022
// Check if this is a banned ip address
1023
if (obj.checkAllowLogin(req) == false) {
@@ -3019,7 +3022,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF
3022
3023
// Encrypt the hardware key challenge state if needed
3024
var hwstate = null;
3022
- if (hardwareKeyChallenge) {
3025
+ if (hardwareKeyChallenge && req.session) {
3026
const sec = parent.decryptSessionData(req.session.e);
3027
hwstate = obj.parent.encodeCookie({ u: sec.tuser, p: sec.tpass, c: sec.u2f }, obj.parent.loginCookieEncryptionKey)
3028
}