More Let's Encrypt changes.
Ylian Saint-Hilaire committed
Nov 18, 2019 at 14:17 UTC
be922433e05d3d3fee6cd111e1817475c0470a1b
3 files changed
+96
-38
letsEncrypt.js
+84
-28
@@ -74,6 +74,10 @@ module.exports.CreateLetsEncrypt = function (parent) {
74
maintainerEmail = pkg.author.email;
75
}
76
77
+ // Check if we need to be in debug mode
78
+ var ledebug = false;
79
+ try { ledebug = ((obj.parent.args.debug != null) || (obj.parent.args.debug.indexOf('cert'))); } catch (ex) { }
80
+
81
// Create the main GreenLock code module for production.
82
var greenlockargs = {
83
parent: obj,
@@ -83,7 +87,7 @@ module.exports.CreateLetsEncrypt = function (parent) {
87
maintainerEmail: maintainerEmail,
88
notify: function (ev, args) { if (typeof args == 'string') { parent.debug('cert', ev + ': ' + args); } else { parent.debug('cert', ev + ': ' + JSON.stringify(args)); } },
89
staging: false,
86
- debug: (obj.parent.args.debug > 0)
90
+ debug: ledebug
91
};
92
if (obj.parent.args.debug == null) { greenlockargs.log = function (debug) { }; } // If not in debug mode, ignore all console output from greenlock (makes things clean).
93
obj.le = greenlock.create(greenlockargs);
@@ -95,9 +99,9 @@ module.exports.CreateLetsEncrypt = function (parent) {
99
packageAgent: pkg.name + '/' + pkg.version,
100
manager: obj.path.join(__dirname, 'letsencrypt.js'),
101
maintainerEmail: maintainerEmail,
98
- notify: function (ev, args) { if (typeof args == 'string') { parent.debug('cert', ev + ': ' + args); } else { parent.debug('cert', ev + ': ' + JSON.stringify(args)); } },
102
+ notify: function (ev, args) { if (typeof args == 'string') { parent.debug('cert', 'Notify: ' + ev + ': ' + args); } else { parent.debug('cert', 'Notify: ' + ev + ': ' + JSON.stringify(args)); } },
103
staging: true,
100
- debug: (obj.parent.args.debug > 0)
104
+ debug: ledebug
105
};
106
if (obj.parent.args.debug == null) { greenlockargsstaging.log = function (debug) { }; } // If not in debug mode, ignore all console output from greenlock (makes things clean).
107
obj.leStaging = greenlock.create(greenlockargsstaging);
@@ -213,33 +217,85 @@ module.exports.CreateLetsEncrypt = function (parent) {
217
218
// Check if we need to renew the certificate, call this every day.
219
obj.checkRenewCertificate = function () {
216
- parent.debug('cert', "Checking certs for " + obj.leDomains[0] + " (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
220
obj.certCheckStart = Date.now();
221
222
+ // Check if there is anything in the let's encrypt folder
223
+ var somethingIsinFolder = false;
224
+ try {
225
+ var filesinFolder = require('fs').readdirSync(obj.runAsProduction ? obj.configPath : obj.configPathStaging);
226
+ console.log('filesinFolder', filesinFolder);
227
+ somethingIsinFolder = (filesinFolder.indexOf(obj.runAsProduction ? 'live' : 'staging') != -1);
228
+ } catch (ex) { console.log(ex); }
229
+
230
// Setup renew options
220
- var renewOptions = { servername: obj.leDomains[0] };
221
- if (obj.leDomains.length > 0) { renewOptions.altnames = obj.leDomains; }
222
- const xle = (obj.runAsProduction === true)? obj.le : obj.leStaging;
223
- xle.renew(renewOptions)
224
- .then(function (results) {
225
- if ((results == null) || (typeof results != 'object') || (results.length == 0) || (results[0].error != null)) {
226
- parent.debug('cert', "Unable to get a certificate (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
227
- } else {
228
- parent.debug('cert', "Checks completed (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
229
- if (obj.performRestart === true) { parent.debug('cert', "Certs changed, restarting..."); obj.parent.performServerCertUpdate(); } // Reset the server, TODO: Reset all peers
230
- else if (obj.performMoveToProduction == true) {
231
- parent.debug('cert', "Staging certificate received, moving to production...");
232
- obj.runAsProduction = true;
233
- obj.performMoveToProduction = false;
234
- obj.performRestart = true;
235
- setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
236
- }
237
- }
238
- })
239
- .catch(function (ex) {
240
- parent.debug('cert', "checkRenewCertificate exception: (" + JSON.stringify(ex) + ")");
231
+ const xle = (obj.runAsProduction === true) ? obj.le : obj.leStaging;
232
+ var renewOptions = { servername: obj.leDomains[0], altnames: obj.leDomains };
233
+
234
+ // Add the domains
235
+ if (somethingIsinFolder == false) {
236
+ try {
237
+ var addOptions = { subject: obj.leDomains[0], altnames: obj.leDomains };
238
+ parent.debug('cert', "Adding domains: " + JSON.stringify(addOptions));
239
+ xle.add(addOptions);
240
+ } catch (ex) {
241
+ parent.debug('cert', "add certificate exception: (" + JSON.stringify(ex) + ")");
242
console.log(ex);
242
- });
243
+ }
244
+ }
245
+
246
+ /*
247
+ if (somethingIsinFolder == false) {
248
+ parent.debug('cert', "Getting certificate for " + obj.leDomains[0] + " (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
249
+ xle.get({ servername: obj.leDomains[0] })
250
+ .then(function (results) {
251
+ if ((results == null) || (typeof results != 'object') || (results.length == 0) || (results[0].error != null)) {
252
+ parent.debug('cert', "Unable to get a certificate (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
253
+ } else {
254
+ parent.debug('cert', "Get certificate completed (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
255
+ if (obj.performRestart === true) { parent.debug('cert', "Certs changed, restarting..."); obj.parent.performServerCertUpdate(); } // Reset the server, TODO: Reset all peers
256
+ else if (obj.performMoveToProduction == true) {
257
+ parent.debug('cert', "Staging certificate received, moving to production...");
258
+ obj.runAsProduction = true;
259
+ obj.performMoveToProduction = false;
260
+ obj.performRestart = true;
261
+ setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
262
+ }
263
+ }
264
+ })
265
+ .catch(function (ex) {
266
+ parent.debug('cert', "getCertificate exception: (" + JSON.stringify(ex) + ")");
267
+ console.log(ex);
268
+ });
269
+ return;
270
+ }
271
+ */
272
+
273
+ parent.debug('cert', "Checking certificate for " + obj.leDomains[0] + " (" + (obj.runAsProduction ? "Production" : "Staging") + ")");
274
+ try {
275
+ xle.renew(renewOptions)
276
+ .then(function (results) {
277
+ if ((results == null) || (typeof results != 'object') || (results.length == 0) || (results[0].error != null)) {
278
+ parent.debug('cert', "Unable to get a certificate (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
279
+ } else {
280
+ parent.debug('cert', "Checks completed (" + (obj.runAsProduction ? "Production" : "Staging") + ", " + (Date.now() - obj.certCheckStart) + "ms): " + JSON.stringify(results));
281
+ if (obj.performRestart === true) { parent.debug('cert', "Certs changed, restarting..."); obj.parent.performServerCertUpdate(); } // Reset the server, TODO: Reset all peers
282
+ else if (obj.performMoveToProduction == true) {
283
+ parent.debug('cert', "Staging certificate received, moving to production...");
284
+ obj.runAsProduction = true;
285
+ obj.performMoveToProduction = false;
286
+ obj.performRestart = true;
287
+ setTimeout(obj.checkRenewCertificate, 10000); // Check the certificate in 10 seconds.
288
+ }
289
+ }
290
+ })
291
+ .catch(function (ex) {
292
+ parent.debug('cert', "checkCertificate exception: (" + JSON.stringify(ex) + ")");
293
+ console.log(ex);
294
+ });
295
+ } catch (ex) {
296
+ parent.debug('cert', "checkCertificate main exception: (" + JSON.stringify(ex) + ")");
297
+ console.log(ex);
298
+ }
299
}
300
301
return obj;
@@ -256,14 +312,14 @@ module.exports.create = function (options) {
312
};
313
314
manager.set = function (options) {
259
- manager.parent.parent.debug('cert', "Certificate has been set");
315
+ manager.parent.parent.debug('cert', "Certificate has been set: " + JSON.stringify(options));
316
if (manager.parent.parent.config.letsencrypt.production == manager.parent.runAsProduction) { manager.parent.performRestart = true; }
317
else if ((manager.parent.parent.config.letsencrypt.production === true) && (manager.parent.runAsProduction === false)) { manager.parent.performMoveToProduction = true; }
318
return null;
319
};
320
321
manager.remove = function (options) {
266
- manager.parent.parent.debug('cert', "Certificate has been removed");
322
+ manager.parent.parent.debug('cert', "Certificate has been removed: " + JSON.stringify(options));
323
if (manager.parent.parent.config.letsencrypt.production == manager.parent.runAsProduction) { manager.parent.performRestart = true; }
324
else if ((manager.parent.parent.config.letsencrypt.production === true) && (manager.parent.runAsProduction === false)) { manager.parent.performMoveToProduction = true; }
325
return null;
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.4.4-k",
3
+ "version": "0.4.4-l",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",
webserver.js
+11
-9
@@ -687,15 +687,17 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
687
// Login failed, wait a random delay
688
setTimeout(function () {
689
// If the account is locked, display that.
690
- var xuserid = 'user/' + domain.id + '/' + xusername.toLowerCase();
691
- if (err == 'locked') {
692
- parent.debug('web', 'handleLoginRequest: login failed, locked account');
693
- req.session.messageid = 110; // Account locked.
694
- obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'User login attempt on locked account from ' + cleanRemoteAddr(req.ip) });
695
- } else {
696
- parent.debug('web', 'handleLoginRequest: login failed, bad username and password');
697
- req.session.messageid = 112; // Login failed, check username and password.
698
- obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'Invalid user login attempt from ' + cleanRemoteAddr(req.ip) });
690
+ if (typeof xusername == 'string') {
691
+ var xuserid = 'user/' + domain.id + '/' + xusername.toLowerCase();
692
+ if (err == 'locked') {
693
+ parent.debug('web', 'handleLoginRequest: login failed, locked account');
694
+ req.session.messageid = 110; // Account locked.
695
+ obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'User login attempt on locked account from ' + cleanRemoteAddr(req.ip) });
696
+ } else {
697
+ parent.debug('web', 'handleLoginRequest: login failed, bad username and password');
698
+ req.session.messageid = 112; // Login failed, check username and password.
699
+ obj.parent.DispatchEvent(['*', 'server-users', xuserid], obj, { action: 'authfail', userid: xuserid, username: xusername, domain: domain.id, msg: 'Invalid user login attempt from ' + cleanRemoteAddr(req.ip) });
700
+ }
701
}
702
703
// Clean up login mode and display password hint if present.