-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(repo): load system certs when custom cert specified
fixes #139
- Loading branch information
Showing
12 changed files
with
391 additions
and
119 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,12 +1,64 @@ | ||
| import { X509Certificate } from 'crypto' | ||
| import fs from 'fs' | ||
| import path from 'path' | ||
|
|
||
| import { CamundaPlatform8Configuration } from './Configuration' | ||
| import { getSystemCertificates } from './GetSystemCertificates' | ||
|
|
||
| export function GetCertificateAuthority( | ||
| export async function GetCustomCertificateBuffer( | ||
| config: CamundaPlatform8Configuration | ||
| ): string | undefined { | ||
| ): Promise<Buffer | undefined> { | ||
| const customRootCertPath = config.CAMUNDA_CUSTOM_ROOT_CERT_PATH | ||
| return customRootCertPath | ||
| ? fs.readFileSync(customRootCertPath, 'utf-8') | ||
| : undefined | ||
|
|
||
| if (!customRootCertPath) { | ||
| return undefined | ||
| } | ||
| const rootCerts: string[] = [] | ||
|
|
||
| if (customRootCertPath) { | ||
| const cert = readRootCertificate(customRootCertPath) | ||
|
|
||
| if (cert) { | ||
| rootCerts.push(cert) | ||
| } | ||
| } | ||
|
|
||
| // (2) use certificates from OS keychain | ||
| const systemCertificates = await getSystemCertificates() | ||
| rootCerts.push(...systemCertificates) | ||
|
|
||
| if (!rootCerts.length) { | ||
| return undefined | ||
| } | ||
|
|
||
| return Buffer.from(rootCerts.join('\n')) | ||
| } | ||
|
|
||
| function readRootCertificate(certPath) { | ||
| let cert | ||
|
|
||
| try { | ||
| const absolutePath = path.isAbsolute(certPath) | ||
| ? certPath | ||
| : path.join(process.cwd(), certPath) | ||
|
|
||
| cert = fs.readFileSync(absolutePath) | ||
| } catch (err) { | ||
| console.error('Failed to read custom SSL certificate:', err) | ||
|
|
||
| return | ||
| } | ||
|
|
||
| let parsed | ||
| try { | ||
| parsed = new X509Certificate(cert) | ||
| } catch (err) { | ||
| console.warn('Failed to parse custom SSL certificate:', err) | ||
| } | ||
|
|
||
| if (parsed && parsed.issuer !== parsed.subject) { | ||
| console.warn('Custom SSL certificate appears to be not a root certificate') | ||
| } | ||
|
|
||
| return cert | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,159 @@ | ||
| /** | ||
| * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH | ||
| * under one or more contributor license agreements. See the NOTICE file | ||
| * distributed with this work for additional information regarding copyright | ||
| * ownership. | ||
| * | ||
| * Camunda licenses this file to you under the MIT; you may not use this file | ||
| * except in compliance with the MIT License. | ||
| */ | ||
|
|
||
| /** | ||
| * This file contains code adapted from https://github.com/microsoft/vscode-proxy-agent | ||
| * | ||
| * MIT License | ||
| * | ||
| * Copyright (c) 2014 Nathan Rajlich <nathan@tootallnate.net> | ||
| * Copyright (c) 2015 Félicien François <felicien@tweakstyle.com> | ||
| * Copyright (c) Microsoft Corporation. | ||
| * | ||
| * Permission is hereby granted, free of charge, to any person obtaining | ||
| * a copy of this software and associated documentation files (the | ||
| * 'Software'), to deal in the Software without restriction, including | ||
| * without limitation the rights to use, copy, modify, merge, publish, | ||
| * distribute, sublicense, and/or sell copies of the Software, and to | ||
| * permit persons to whom the Software is furnished to do so, subject to | ||
| * the following conditions: | ||
| * | ||
| * The above copyright notice and this permission notice shall be | ||
| * included in all copies or substantial portions of the Software. | ||
| * | ||
| * THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, | ||
| * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF | ||
| * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. | ||
| * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY | ||
| * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, | ||
| * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE | ||
| * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | ||
| */ | ||
|
|
||
| import cp from 'child_process' | ||
| import fs from 'fs/promises' | ||
| import os from 'os' | ||
|
|
||
| let _cachedCertificates | ||
|
|
||
| module.exports = getSystemCertificates | ||
|
|
||
| /** | ||
| * Get certificates from the system keychain. | ||
| * | ||
| */ | ||
| export async function getSystemCertificates(): Promise<string[]> { | ||
| if (_cachedCertificates) { | ||
| return _cachedCertificates | ||
| } | ||
|
|
||
| _cachedCertificates = (await readCaCertificates()) || [] | ||
|
|
||
| return _cachedCertificates | ||
| } | ||
|
|
||
| async function readCaCertificates() { | ||
| if (process.platform === 'win32') { | ||
| return readWindowsCaCertificates() | ||
| } | ||
| if (process.platform === 'darwin') { | ||
| return readMacCaCertificates() | ||
| } | ||
| if (process.platform === 'linux') { | ||
| return readLinuxCaCertificates() | ||
| } | ||
| throw new Error(`Unsupported platform: ${process.platform}`) | ||
| } | ||
|
|
||
| async function readWindowsCaCertificates() { | ||
| // eslint-disable-next-line @typescript-eslint/no-var-requires | ||
| const winCA = require('vscode-windows-ca-certs') | ||
| const ders: string[] = [] | ||
| const store = new winCA.Crypt32() | ||
| try { | ||
| let der = store.next() | ||
| while (der) { | ||
| ders.push(der) | ||
| der = store.next() | ||
| } | ||
| } finally { | ||
| store.done() | ||
| } | ||
|
|
||
| const certs = new Set(ders.map(derToPem)) | ||
|
|
||
| return Array.from(certs) | ||
| } | ||
|
|
||
| async function readMacCaCertificates() { | ||
| const args = ['find-certificate', '-a', '-p'] | ||
| const systemRootCertsPath = | ||
| '/System/Library/Keychains/SystemRootCertificates.keychain' | ||
|
|
||
| const trusted = await spawnPromise('/usr/bin/security', args) | ||
| const systemTrusted = await spawnPromise('/usr/bin/security', [ | ||
| ...args, | ||
| systemRootCertsPath, | ||
| ]) | ||
|
|
||
| const certs = new Set(splitCerts(trusted).concat(splitCerts(systemTrusted))) | ||
|
|
||
| return Array.from(certs) | ||
| } | ||
|
|
||
| const linuxCaCertificatePaths = [ | ||
| '/etc/ssl/certs/ca-certificates.crt', | ||
| '/etc/ssl/certs/ca-bundle.crt', | ||
| ] | ||
|
|
||
| async function readLinuxCaCertificates() { | ||
| for (const certPath of linuxCaCertificatePaths) { | ||
| try { | ||
| const content = await fs.readFile(certPath, { encoding: 'utf8' }) | ||
| const certs = new Set(splitCerts(content)) | ||
| return Array.from(certs) | ||
| } catch (err) { | ||
| if ((err as { code?: string })?.code !== 'ENOENT') { | ||
| throw err | ||
| } | ||
| } | ||
| } | ||
| // Return an empty array if no certificates are found | ||
| return [] | ||
| } | ||
|
|
||
| // helper ///////////////// | ||
|
|
||
| function spawnPromise(command, args) { | ||
| return new Promise((resolve, reject) => { | ||
| const child = cp.spawn(command, args) | ||
| const stdout: string[] = [] | ||
| child.stdout.setEncoding('utf8') | ||
| child.stdout.on('data', (str) => stdout.push(str)) | ||
| child.on('error', reject) | ||
| child.on('exit', (code) => (code ? reject(code) : resolve(stdout.join('')))) | ||
| }) | ||
| } | ||
|
|
||
| function derToPem(blob) { | ||
| const lines = ['-----BEGIN CERTIFICATE-----'] | ||
| const der = blob.toString('base64') | ||
| for (let i = 0; i < der.length; i += 64) { | ||
| lines.push(der.substr(i, 64)) | ||
| } | ||
| lines.push('-----END CERTIFICATE-----', '') | ||
| return lines.join(os.EOL) | ||
| } | ||
|
|
||
| function splitCerts(certs) { | ||
| return certs | ||
| .split(/(?=-----BEGIN CERTIFICATE-----)/g) | ||
| .filter((pem) => !!pem.length) | ||
| } |
Oops, something went wrong.