navy 7.0.0-alpha.4 → 7.1.0

package/lib/util/__tests__/https.js

@@ -18,6 +18,7 @@ describe('util/https', function () {
   let pkiStub;
   let mdStub;
   let httpsModule;
+  let certObj;
   function loadModule() {
     httpsModule = _proxyquire.default.noCallThru()('../https', {
       '../config': {
@@ -52,9 +53,21 @@ describe('util/https', function () {
       mkdirSync: sandbox.stub(),
       unlinkSync: sandbox.stub(),
       readFileSync: sandbox.stub().returns('--PEM--'),
-      writeFileSync: sandbox.stub()
+      writeFileSync: sandbox.stub(),
+      copyFileSync: sandbox.stub()
     };
-    const certObj = {
+    const caCertFromPem = {
+      subject: {
+        attributes: [{
+          name: 'commonName',
+          value: 'ca'
+        }]
+      },
+      generateSubjectKeyIdentifier: sandbox.stub().returns({
+        getBytes: () => 'ca-subject-key-id'
+      })
+    };
+    certObj = {
       publicKey: null,
       serialNumber: null,
       validity: {
@@ -81,14 +94,7 @@ describe('util/https', function () {
       publicKeyToPem: sandbox.stub().returns('pub-pem'),
       certificateToPem: sandbox.stub().returns('cert-pem'),
       privateKeyFromPem: sandbox.stub().returns('priv-key-obj'),
-      certificateFromPem: sandbox.stub().returns({
-        subject: {
-          attributes: [{
-            name: 'commonName',
-            value: 'ca'
-          }]
-        }
-      })
+      certificateFromPem: sandbox.stub().returns(caCertFromPem)
     };
     mdStub = {
       sha256: {
@@ -297,5 +303,176 @@ describe('util/https', function () {
       }
       (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
     });
+    it('should prefer the parsed hostname over the raw certName segment', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        serviceUrl: 'https://tls-host.example.com:8443/app'
+      });
+      (0, _chai.expect)(certObj.setSubject.firstCall.args[0][0].value).to.equal('tls-host.example.com');
+    });
+    it('should keep certName when serviceUrl is not a valid URL', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        serviceUrl: 'https://bad['
+      });
+      const writtenPaths = fsStub.writeFileSync.getCalls().map(c => c.args[0]);
+      (0, _chai.expect)(writtenPaths.some(p => p.endsWith('bad[.key'))).to.equal(true);
+    });
+    it('should fall back to certName when serviceUrl has no hostname', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        serviceUrl: 'https://?q=1'
+      });
+      (0, _chai.expect)(certObj.setSubject.firstCall.args[0][0].value).to.equal('?q=1');
+    });
+    it('should wrap non-Error signing failures in NavyError', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      pkiStub.certificateFromPem.callsFake(() => {
+        const failure = 'string failure';
+        throw failure;
+      });
+      let caught;
+      try {
+        await httpsModule.createCert({
+          serviceUrl: 'https://web.local'
+        });
+      } catch (err) {
+        caught = err;
+      }
+      (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+      (0, _chai.expect)(caught.message).to.equal('string failure');
+    });
+    it('should use IP SAN when hostName is an IP address', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/cfg/tls-certs') return true;
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.createCert({
+        hostName: '127.0.0.1'
+      });
+      const extensions = certObj.setExtensions.firstCall.args[0];
+      const sanExt = extensions.find(ext => ext.name === 'subjectAltName');
+      (0, _chai.expect)(sanExt.altNames).to.eql([{
+        type: 7,
+        ip: '127.0.0.1'
+      }]);
+    });
+  });
+  describe('hostNameFromIssueUrl', function () {
+    it('should throw when the URL is empty', function () {
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('')).to.throw(/must not be empty/);
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('   ')).to.throw(/must not be empty/);
+    });
+    it('should prepend https when no scheme is supplied', function () {
+      (0, _chai.expect)(httpsModule.hostNameFromIssueUrl('example.local')).to.equal('example.local');
+    });
+    it('should accept an explicit scheme', function () {
+      (0, _chai.expect)(httpsModule.hostNameFromIssueUrl('http://example.local')).to.equal('example.local');
+    });
+    it('should throw when the URL cannot be parsed', function () {
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('http://')).to.throw(/Invalid URL/);
+    });
+    it('should throw when no hostname can be determined', function () {
+      (0, _chai.expect)(() => httpsModule.hostNameFromIssueUrl('file:///tmp/cert.crt')).to.throw(/Could not determine a hostname/);
+    });
+  });
+  describe('issueLeafCertForUrl', function () {
+    it('should write cert, key, and CA copy files to the output dir', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      const result = await httpsModule.issueLeafCertForUrl('https://issued.local', '/out/certs');
+      (0, _chai.expect)(fsStub.mkdirSync.calledWith('/out/certs', {
+        recursive: true
+      })).to.equal(true);
+      (0, _chai.expect)(fsStub.writeFileSync.callCount).to.equal(2);
+      (0, _chai.expect)(fsStub.copyFileSync.calledOnce).to.equal(true);
+      (0, _chai.expect)(result.certPath).to.equal('/out/certs/issued.local.crt');
+      (0, _chai.expect)(result.keyPath).to.equal('/out/certs/issued.local.key');
+      (0, _chai.expect)(result.caCopyPath).to.equal('/out/certs/navy-root-ca.crt');
+    });
+    it('should sanitise unsafe characters in the output file base name', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      const result = await httpsModule.issueLeafCertForUrl('https://[::1]', '/out');
+      (0, _chai.expect)(result.certPath).to.equal('/out/___1_.crt');
+      (0, _chai.expect)(result.keyPath).to.equal('/out/___1_.key');
+    });
+    it('should wrap non-Error build failures in NavyError', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      pkiStub.certificateFromPem.callsFake(() => {
+        const failure = 'forge broke';
+        throw failure;
+      });
+      let caught;
+      try {
+        await httpsModule.issueLeafCertForUrl('https://issued.local', '/out');
+      } catch (err) {
+        caught = err;
+      }
+      (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+      (0, _chai.expect)(caught.message).to.equal('forge broke');
+    });
+    it('should wrap build failures in NavyError', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      pkiStub.certificateFromPem.throws(new Error('forge broke'));
+      let caught;
+      try {
+        await httpsModule.issueLeafCertForUrl('https://issued.local', '/out');
+      } catch (err) {
+        caught = err;
+      }
+      (0, _chai.expect)(caught).to.be.instanceof(_errors.NavyError);
+      (0, _chai.expect)(caught.message).to.equal('forge broke');
+    });
+    it('should use IP SAN when issuing for an IP address URL', async function () {
+      fsStub.existsSync.callsFake(p => {
+        if (p === '/default-ca-dir') return true;
+        if (p === '/default-ca-dir/ca.crt' || p === '/default-ca-dir/ca.key') return true;
+        return false;
+      });
+      await httpsModule.issueLeafCertForUrl('https://192.168.1.10', '/out');
+      const extensions = certObj.setExtensions.firstCall.args[0];
+      const sanExt = extensions.find(ext => ext.name === 'subjectAltName');
+      (0, _chai.expect)(sanExt.altNames).to.eql([{
+        type: 7,
+        ip: '192.168.1.10'
+      }]);
+    });
   });
 });

package/lib/util/__tests__/install-root-ca.js

@@ -0,0 +1,282 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+var _chai = require("chai");
+var _sinon = _interopRequireDefault(require("sinon"));
+var _proxyquire = _interopRequireDefault(require("proxyquire"));
+var _path = _interopRequireDefault(require("path"));
+var _errors = require("../../errors");
+/* eslint-env mocha */
+
+describe('util/install-root-ca', function () {
+  let sandbox;
+  let fsStub;
+  let osStub;
+  let execFileSyncStub;
+  let installRootCaModule;
+  let platformStub;
+  const caPath = '/tmp/navy/ca.crt';
+  function certutilPath(systemRoot = 'C:\\Windows') {
+    return _path.default.join(systemRoot, 'System32', 'certutil.exe');
+  }
+  function expectThrownMessage(fn, messagePattern) {
+    let caught;
+    try {
+      fn();
+    } catch (err) {
+      caught = err;
+    }
+    (0, _chai.expect)(caught).to.not.equal(undefined);
+    (0, _chai.expect)(String(caught.message)).to.match(messagePattern);
+  }
+  function loadModule() {
+    installRootCaModule = _proxyquire.default.noCallThru()('../install-root-ca', {
+      '../errors': {
+        NavyError: _errors.NavyError
+      },
+      fs: fsStub,
+      os: osStub,
+      child_process: {
+        execFileSync: execFileSyncStub
+      }
+    });
+  }
+  beforeEach(function () {
+    sandbox = _sinon.default.createSandbox();
+    fsStub = {
+      existsSync: sandbox.stub()
+    };
+    osStub = {
+      homedir: sandbox.stub().returns('/Users/tester')
+    };
+    execFileSyncStub = sandbox.stub();
+    platformStub = sandbox.stub(process, 'platform').value('darwin');
+    loadModule();
+  });
+  afterEach(function () {
+    sandbox.restore();
+  });
+  describe('caughtErrorMessage', function () {
+    it('should return nullish values as strings', function () {
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage(null)).to.equal('null');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage(undefined)).to.equal('undefined');
+    });
+    it('should return message text when it is present', function () {
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage({
+        message: 'object failed'
+      })).to.equal('object failed');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage(new Error('error failed'))).to.equal('error failed');
+    });
+    it('should fall back to String(e) when no usable message exists', function () {
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage('plain failure')).to.equal('plain failure');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage({})).to.equal('[object Object]');
+      (0, _chai.expect)(installRootCaModule.caughtErrorMessage({
+        message: ''
+      })).to.equal('[object Object]');
+    });
+  });
+  describe('installRootCaToTrustStore', function () {
+    it('should throw when the CA file does not exist', function () {
+      fsStub.existsSync.returns(false);
+      expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /CA certificate not found/);
+    });
+    describe('macOS', function () {
+      beforeEach(function () {
+        platformStub.value('darwin');
+        fsStub.existsSync.callsFake(p => p === caPath || p.endsWith('login.keychain-db'));
+      });
+      it('should add the CA to the login keychain when found', function () {
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal('security');
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1]).to.eql(['add-trusted-cert', '-d', '-r', 'trustRoot', '-k', '/Users/tester/Library/Keychains/login.keychain-db', caPath]);
+      });
+      it('should fall back to login.keychain when login.keychain-db is missing', function () {
+        fsStub.existsSync.callsFake(p => p === caPath || p.endsWith('login.keychain'));
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1][5]).to.equal('/Users/tester/Library/Keychains/login.keychain');
+      });
+      it('should throw when no login keychain can be found', function () {
+        fsStub.existsSync.callsFake(p => p === caPath);
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Could not find your macOS login keychain/);
+      });
+      it('should wrap security command failures in NavyError', function () {
+        execFileSyncStub.throws(new Error('security failed'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Could not add the Navy root CA/);
+      });
+      it('should use error.message when the thrown value exposes one', function () {
+        execFileSyncStub.throws({
+          message: 'security object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /security object failed/);
+      });
+      it('should stringify non-Error exec failures', function () {
+        execFileSyncStub.throws('plain failure');
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /plain failure/);
+      });
+      it('should stringify null exec failures', function () {
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+    });
+    describe('linux', function () {
+      beforeEach(function () {
+        platformStub.value('linux');
+        fsStub.existsSync.callsFake(p => p === caPath);
+      });
+      it('should install via update-ca-certificates on Debian-style systems', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.callCount).to.equal(2);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal('sudo');
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1]).to.eql(['cp', caPath, '/usr/local/share/ca-certificates/navy-dev-ca.crt']);
+        (0, _chai.expect)(execFileSyncStub.secondCall.args[1]).to.eql(['/usr/sbin/update-ca-certificates']);
+      });
+      it('should wrap Debian install failures in NavyError', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        execFileSyncStub.throws(new Error('sudo denied'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /update-ca-certificates/);
+      });
+      it('should use error.message for Debian install failures when present', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        execFileSyncStub.throws({
+          message: 'debian object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /debian object failed/);
+      });
+      it('should stringify null Debian install failures', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/sbin/update-ca-certificates') return true;
+          return false;
+        });
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+      it('should install via update-ca-trust on Fedora-style systems', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.callCount).to.equal(2);
+        (0, _chai.expect)(execFileSyncStub.secondCall.args[1]).to.eql(['/usr/bin/update-ca-trust', 'extract']);
+      });
+      it('should wrap Fedora install failures in NavyError', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        execFileSyncStub.throws(new Error('trust failed'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /update-ca-trust/);
+      });
+      it('should use error.message for Fedora install failures when present', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        execFileSyncStub.throws({
+          message: 'fedora object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /fedora object failed/);
+      });
+      it('should stringify null Fedora install failures', function () {
+        fsStub.existsSync.callsFake(p => {
+          if (p === caPath) return true;
+          if (p === '/usr/bin/update-ca-trust') return true;
+          return false;
+        });
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+      it('should throw when no supported Linux tooling is present', function () {
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Automatic Linux install needs/);
+      });
+    });
+    describe('windows', function () {
+      beforeEach(function () {
+        platformStub.value('win32');
+        fsStub.existsSync.callsFake(p => p === caPath);
+      });
+      it('should add the CA via certutil when available', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        installRootCaModule.installRootCaToTrustStore(caPath);
+        (0, _chai.expect)(execFileSyncStub.calledOnce).to.equal(true);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal(certutil);
+        (0, _chai.expect)(execFileSyncStub.firstCall.args[1]).to.eql(['-user', '-addstore', 'Root', caPath]);
+      });
+      it('should use SystemRoot from the environment when set', function () {
+        const previousSystemRoot = process.env.SystemRoot;
+        process.env.SystemRoot = 'D:\\WinRoot';
+        const certutil = certutilPath('D:\\WinRoot');
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        try {
+          installRootCaModule.installRootCaToTrustStore(caPath);
+          (0, _chai.expect)(execFileSyncStub.firstCall.args[0]).to.equal(certutil);
+        } finally {
+          if (previousSystemRoot === undefined) {
+            delete process.env.SystemRoot;
+          } else {
+            process.env.SystemRoot = previousSystemRoot;
+          }
+        }
+      });
+      it('should throw when certutil.exe is missing', function () {
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /certutil.exe not found/);
+      });
+      it('should wrap certutil failures in NavyError', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        execFileSyncStub.throws(new Error('certutil failed'));
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /Trusted Root store/);
+      });
+      it('should use error.message for certutil failures when present', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        execFileSyncStub.throws({
+          message: 'certutil object failed'
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /certutil object failed/);
+      });
+      it('should stringify null certutil failures', function () {
+        const certutil = certutilPath();
+        fsStub.existsSync.callsFake(p => p === caPath || p === certutil);
+        execFileSyncStub.callsFake(() => {
+          const thrown = null;
+          throw thrown;
+        });
+        expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /null/);
+      });
+    });
+    it('should throw on unsupported platforms', function () {
+      platformStub.value('freebsd');
+      fsStub.existsSync.returns(true);
+      expectThrownMessage(() => installRootCaModule.installRootCaToTrustStore(caPath), /not supported on freebsd/);
+    });
+  });
+});