goldilocks.js/lib/modules/tls.js

'use strict';

module.exports.create = function (deps, config, netHandler) {
  var tls = require('tls');
  var parseSni = require('sni');
  var greenlock = require('greenlock');
  var domainMatches = require('../match-domain').match;

  function extractSocketProp(socket, propName) {
    // remoteAddress, remotePort... ugh... https://github.com/nodejs/node/issues/8854
    return socket[propName]
      || socket['_' + propName]
      || socket._handle._parent.owner.stream[propName]
      ;
  }

  var le = greenlock.create({
    // server: 'staging'
    server: 'https://acme-v01.api.letsencrypt.org/directory'

  , challenges: {
      'http-01': require('le-challenge-fs').create({ webrootPath: '/tmp/acme-challenges', debug: config.debug })
    , 'tls-sni-01': require('le-challenge-sni').create({ debug: config.debug })
      // TODO dns-01
      //, 'dns-01': require('le-challenge-ddns').create()
    }

  , store: require('le-store-certbot').create({ webrootPath: '/tmp/acme-challenges' })

  , approveDomains: function (opts, certs, cb) {
      // This is where you check your database and associated
      // email addresses with domains and agreements and such

      // The domains being approved for the first time are listed in opts.domains
      // Certs being renewed are listed in certs.altnames
      if (certs) {
        // TODO make sure the same options are used for renewal as for registration?
        opts.domains = certs.altnames;

        cb(null, { options: opts, certs: certs });
        return;
      }

      function complete(optsOverride) {
        Object.keys(optsOverride).forEach(function (key) {
          opts[key] = optsOverride[key];
        });

        cb(null, { options: opts, certs: certs });
      }


      // check config for domain name
      if (-1 !== (config.tls.servernames || []).indexOf(opts.domain)) {
        // TODO how to handle SANs?
        // TODO fetch domain-specific email
        // TODO fetch domain-specific acmeDirectory
        // NOTE: you can also change other options such as `challengeType` and `challenge`
        // opts.challengeType = 'http-01';
        // opts.challenge = require('le-challenge-fs').create({}); // TODO this doesn't actually work yet
        complete({
          email: config.tls.email
        , agreeTos: true
        , server: config.tls.acmeDirectoryUrl || le.server
        , challengeType: config.tls.challengeType || 'http-01'
        });
        return;
      }

      // TODO ask http module (and potentially all other modules) about what domains it can
      // handle. We can allow any domains that other modules will handle after we terminate TLS.
      cb(new Error('domain is not allowed'));
      // if (!modules.http) {
      //   modules.http = require('./modules/http.js').create(deps, config);
      // }
      // modules.http.checkServername(opts.domain).then(function (stuff) {
      //   if (!stuff || !stuff.domains) {
      //     // TODO once precheck is implemented we can just let it pass if it passes, yknow?
      //     cb(new Error('domain is not allowed'));
      //     return;
      //   }

      //   complete({
      //     domain: stuff.domain || stuff.domains[0]
      //   , domains: stuff.domains
      //   , email: stuff.email || program.email
      //   , server: stuff.acmeDirectoryUrl || program.acmeDirectoryUrl
      //   , challengeType: stuff.challengeType || program.challengeType
      //   , challenge: stuff.challenge
      //   });
      //   return;
      // }, cb);
    }
  });
  le.tlsOptions = le.tlsOptions || le.httpsOptions;

  var secureContexts = {};
  var terminatorOpts = require('localhost.daplie.me-certificates').merge({});
  terminatorOpts.SNICallback = function (sni, cb) {
    console.log("[tlsOptions.SNICallback] SNI: '" + sni + "'");

    var tlsOptions;

    // Static Certs
    if (/.*localhost.*\.daplie\.me/.test(sni.toLowerCase())) {
      // TODO implement
      if (!secureContexts[sni]) {
        tlsOptions = require('localhost.daplie.me-certificates').mergeTlsOptions(sni, {});
      }
      if (tlsOptions) {
        secureContexts[sni] = tls.createSecureContext(tlsOptions);
      }
      if (secureContexts[sni]) {
        console.log('Got static secure context:', sni, secureContexts[sni]);
        cb(null, secureContexts[sni]);
        return;
      }
    }

    le.tlsOptions.SNICallback(sni, cb);
  };

  var terminator = tls.createServer(terminatorOpts, function (socket) {
    console.log('(pre-terminated) tls connection, addr:', socket.remoteAddress);

    netHandler(socket, {
      servername: socket.servername
    , encrypted: true
      // remoteAddress... ugh... https://github.com/nodejs/node/issues/8854
    , remoteAddress: extractSocketProp(socket, 'remoteAddress')
    , remotePort:    extractSocketProp(socket, 'remotePort')
    , remoteFamily:  extractSocketProp(socket, 'remoteFamily')
    });
  });

  function proxy(socket, opts, mod) {
    var destination = mod.address.split(':');

    var newConn = deps.net.createConnection({
        port: destination[1]
      , host: destination[0] || '127.0.0.1'

      , servername: opts.servername
      , data: opts.firstChunk
      , remoteFamily:  opts.family  || extractSocketProp(socket, 'remoteFamily')
      , remoteAddress: opts.address || extractSocketProp(socket, 'remoteAddress')
      , remotePort:    opts.port    || extractSocketProp(socket, 'remotePort')
    });

    newConn.write(opts.firstChunk);
    newConn.pipe(socket);
    socket.pipe(newConn);
  }

  function terminate(socket, opts) {
    console.log('[tls-terminate] ' + opts.localAddress || socket.localAddress + ':' + opts.localPort || socket.localPort + ' servername', opts.servername, socket.remoteAddress);

    if (opts.hyperPeek) {
      // This connection was peeked at using a method that doesn't interferre with the TLS
      // server's ability to handle it properly. Currently the only way this happens is
      // with tunnel connections where we have the first chunk of data before creating the
      // new connection (thus removing need to get data off the new connection).
      terminator.emit('connection', socket);
      return;
    }

    // The hyperPeek flag wasn't set, so we had to read data off of this connection, which
    // means we can no longer use it directly in the TLS server.
    // See https://github.com/nodejs/node/issues/8752 (node's internal networking layer == 💩 sometimes)
    var myDuplex = require('tunnel-packer').Stream.create(socket);
    myDuplex.remoteAddress = opts.remoteAddress || myDuplex.remoteAddress;
    myDuplex.remotePort = opts.remotePort || myDuplex.remotePort;

    socket.on('data', function (chunk) {
      console.log('[' + Date.now() + '] tls socket data', chunk.byteLength);
      myDuplex.push(chunk);
    });
    socket.on('error', function (err) {
      console.error('[error] httpsTunnel (Admin) TODO close');
      console.error(err);
      myDuplex.emit('error', err);
    });
    socket.on('close', function () {
      myDuplex.end();
    });

    terminator.emit('connection', myDuplex);
    process.nextTick(function () {
      // this must happen after the socket is emitted to the next in the chain,
      // but before any more data comes in via the network
      socket.unshift(opts.firstChunk);
    });
  }

  function handleConn(socket, opts) {
    opts.servername = (parseSni(opts.firstChunk)||'').toLowerCase() || 'localhost.invalid';
    // needs to wind up in one of 2 states:
    // 1. SNI-based Proxy / Tunnel (we don't even need to put it through the tlsSocket)
    // 2. Terminated (goes on to a particular module or route, including the admin interface)
    // 3. Closed (we don't recognize the SNI servername as something we actually want to handle)

    // We always want to terminate is the SNI matches the challenge pattern, unless a client
    // on the south side has temporarily claimed a particular challenge. For the time being
    // we don't have a way for the south-side to communicate with us, so that part isn't done.
    if (domainMatches('*.acme-challenge.invalid', opts.servername)) {
      terminate(socket, opts);
      return;
    }

    var handled = (config.tls.modules || []).some(function (mod) {
      var relevant = mod.domains.some(function (pattern) {
        return domainMatches(pattern, opts.servername);
      });
      if (!relevant) {
        return false;
      }

      if (mod.name === 'proxy') {
        proxy(socket, opts, mod);
      }
      else {
        console.error('saw unknown TLS module', mod);
        return false;
      }

      return true;
    });

    // TODO: figure out all of the domains that the other modules intend to handle, and only
    // terminate those ones, closing connections for all others.
    if (!handled) {
      terminate(socket, opts);
    }
  }

  return {
    emit: function (type, socket) {
      if (type === 'connection') {
        handleConn(socket, socket.__opts);
      }
    }
  , middleware: le.middleware()
  };
};